grsecurity-{3.2.70,3.14.50,4.1.5}-20150810212920150810

87 files changed, 13527 insertions, 17543 deletions

diff --git a/3.14.49/1047_linux-3.14.48.patch b/3.14.49/1047_linux-3.14.48.patch
deleted file mode 100644
index 3a7169d..0000000
--- a/3.14.49/1047_linux-3.14.48.patch
+++ /dev/null
@@ -1,1019 +0,0 @@
-diff --git a/Makefile b/Makefile
-index f9041e6..25393e8 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 47
-+SUBLEVEL = 48
- EXTRAVERSION =
- NAME = Remembering Coco
- 
-diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
-index 9f79231..7d35af3 100644
---- a/arch/arm/include/asm/kvm_mmu.h
-+++ b/arch/arm/include/asm/kvm_mmu.h
-@@ -117,13 +117,14 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
- 	(__boundary - 1 < (end) - 1)? __boundary: (end);		\
- })
- 
-+#define kvm_pgd_index(addr)                    pgd_index(addr)
-+
- static inline bool kvm_page_empty(void *ptr)
- {
- 	struct page *ptr_page = virt_to_page(ptr);
- 	return page_count(ptr_page) == 1;
- }
- 
--
- #define kvm_pte_table_empty(ptep) kvm_page_empty(ptep)
- #define kvm_pmd_table_empty(pmdp) kvm_page_empty(pmdp)
- #define kvm_pud_table_empty(pudp) (0)
-diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index 2e74a61..f6a52a2 100644
---- a/arch/arm/kvm/arm.c
-+++ b/arch/arm/kvm/arm.c
-@@ -441,6 +441,7 @@ static void update_vttbr(struct kvm *kvm)
- 
- static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- {
-+	struct kvm *kvm = vcpu->kvm;
- 	int ret;
- 
- 	if (likely(vcpu->arch.has_run_once))
-@@ -452,12 +453,20 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- 	 * Initialize the VGIC before running a vcpu the first time on
- 	 * this VM.
- 	 */
--	if (unlikely(!vgic_initialized(vcpu->kvm))) {
--		ret = kvm_vgic_init(vcpu->kvm);
-+	if (unlikely(!vgic_initialized(kvm))) {
-+		ret = kvm_vgic_init(kvm);
- 		if (ret)
- 			return ret;
- 	}
- 
-+	/*
-+	 * Enable the arch timers only if we have an in-kernel VGIC
-+	 * and it has been properly initialized, since we cannot handle
-+	 * interrupts from the virtual timer with a userspace gic.
-+	 */
-+	if (irqchip_in_kernel(kvm) && vgic_initialized(kvm))
-+		kvm_timer_enable(kvm);
-+
- 	return 0;
- }
- 
-diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
-index 0d68d40..a1467e7 100644
---- a/arch/arm/kvm/interrupts.S
-+++ b/arch/arm/kvm/interrupts.S
-@@ -159,13 +159,9 @@ __kvm_vcpu_return:
- 	@ Don't trap coprocessor accesses for host kernel
- 	set_hstr vmexit
- 	set_hdcr vmexit
--	set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
-+	set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore
- 
- #ifdef CONFIG_VFPv3
--	@ Save floating point registers we if let guest use them.
--	tst	r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
--	bne	after_vfp_restore
--
- 	@ Switch VFP/NEON hardware state to the host's
- 	add	r7, vcpu, #VCPU_VFP_GUEST
- 	store_vfp_state r7
-@@ -177,6 +173,8 @@ after_vfp_restore:
- 	@ Restore FPEXC_EN which we clobbered on entry
- 	pop	{r2}
- 	VFPFMXR FPEXC, r2
-+#else
-+after_vfp_restore:
- #endif
- 
- 	@ Reset Hyp-role
-@@ -467,7 +465,7 @@ switch_to_guest_vfp:
- 	push	{r3-r7}
- 
- 	@ NEON/VFP used.  Turn on VFP access.
--	set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
-+	set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))
- 
- 	@ Switch VFP/NEON hardware state to the guest's
- 	add	r7, r0, #VCPU_VFP_HOST
-diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
-index 76af9302..2973b2d 100644
---- a/arch/arm/kvm/interrupts_head.S
-+++ b/arch/arm/kvm/interrupts_head.S
-@@ -578,8 +578,13 @@ vcpu	.req	r0		@ vcpu pointer always in r0
- .endm
- 
- /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return
-- * (hardware reset value is 0). Keep previous value in r2. */
--.macro set_hcptr operation, mask
-+ * (hardware reset value is 0). Keep previous value in r2.
-+ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if
-+ * VFP wasn't already enabled (always executed on vmtrap).
-+ * If a label is specified with vmexit, it is branched to if VFP wasn't
-+ * enabled.
-+ */
-+.macro set_hcptr operation, mask, label = none
- 	mrc	p15, 4, r2, c1, c1, 2
- 	ldr	r3, =\mask
- 	.if \operation == vmentry
-@@ -588,6 +593,17 @@ vcpu	.req	r0		@ vcpu pointer always in r0
- 	bic	r3, r2, r3		@ Don't trap defined coproc-accesses
- 	.endif
- 	mcr	p15, 4, r3, c1, c1, 2
-+	.if \operation != vmentry
-+	.if \operation == vmexit
-+	tst	r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
-+	beq	1f
-+	.endif
-+	isb
-+	.if \label != none
-+	b	\label
-+	.endif
-+1:
-+	.endif
- .endm
- 
- /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return
-diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
-index 524b4b5..c612e37 100644
---- a/arch/arm/kvm/mmu.c
-+++ b/arch/arm/kvm/mmu.c
-@@ -194,7 +194,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
- 	phys_addr_t addr = start, end = start + size;
- 	phys_addr_t next;
- 
--	pgd = pgdp + pgd_index(addr);
-+	pgd = pgdp + kvm_pgd_index(addr);
- 	do {
- 		next = kvm_pgd_addr_end(addr, end);
- 		if (!pgd_none(*pgd))
-@@ -264,7 +264,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
- 	phys_addr_t next;
- 	pgd_t *pgd;
- 
--	pgd = kvm->arch.pgd + pgd_index(addr);
-+	pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- 	do {
- 		next = kvm_pgd_addr_end(addr, end);
- 		stage2_flush_puds(kvm, pgd, addr, next);
-@@ -649,7 +649,7 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
- 	pud_t *pud;
- 	pmd_t *pmd;
- 
--	pgd = kvm->arch.pgd + pgd_index(addr);
-+	pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- 	pud = pud_offset(pgd, addr);
- 	if (pud_none(*pud)) {
- 		if (!cache)
-diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
-index 681cb90..91f33c2 100644
---- a/arch/arm64/include/asm/kvm_emulate.h
-+++ b/arch/arm64/include/asm/kvm_emulate.h
-@@ -41,6 +41,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
- static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
- {
- 	vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
-+	if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features))
-+		vcpu->arch.hcr_el2 &= ~HCR_RW;
- }
- 
- static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
-diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
-index 0d51874..15a8a86 100644
---- a/arch/arm64/include/asm/kvm_mmu.h
-+++ b/arch/arm64/include/asm/kvm_mmu.h
-@@ -69,6 +69,8 @@
- #define PTRS_PER_S2_PGD (1 << (KVM_PHYS_SHIFT - PGDIR_SHIFT))
- #define S2_PGD_ORDER	get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
- 
-+#define kvm_pgd_index(addr)    (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
-+
- int create_hyp_mappings(void *from, void *to);
- int create_hyp_io_mappings(void *from, void *to, phys_addr_t);
- void free_boot_hyp_pgd(void);
-diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
-index 5dfc8331..3aaf3bc 100644
---- a/arch/arm64/kvm/hyp.S
-+++ b/arch/arm64/kvm/hyp.S
-@@ -629,6 +629,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
- 	 * Instead, we invalidate Stage-2 for this IPA, and the
- 	 * whole of Stage-1. Weep...
- 	 */
-+	lsr	x1, x1, #12
- 	tlbi	ipas2e1is, x1
- 	/*
- 	 * We have to ensure completion of the invalidation at Stage-2,
-diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
-index 70a7816..0b43265 100644
---- a/arch/arm64/kvm/reset.c
-+++ b/arch/arm64/kvm/reset.c
-@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
- 			if (!cpu_has_32bit_el1())
- 				return -EINVAL;
- 			cpu_reset = &default_regs_reset32;
--			vcpu->arch.hcr_el2 &= ~HCR_RW;
- 		} else {
- 			cpu_reset = &default_regs_reset;
- 		}
-diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
-index 9488fa5..afc96ec 100644
---- a/arch/mips/include/asm/mach-generic/spaces.h
-+++ b/arch/mips/include/asm/mach-generic/spaces.h
-@@ -94,7 +94,11 @@
- #endif
- 
- #ifndef FIXADDR_TOP
-+#ifdef CONFIG_KVM_GUEST
-+#define FIXADDR_TOP		((unsigned long)(long)(int)0x7ffe0000)
-+#else
- #define FIXADDR_TOP		((unsigned long)(long)(int)0xfffe0000)
- #endif
-+#endif
- 
- #endif /* __ASM_MACH_GENERIC_SPACES_H */
-diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
-index 38265dc..65dfbd0 100644
---- a/arch/powerpc/perf/core-book3s.c
-+++ b/arch/powerpc/perf/core-book3s.c
-@@ -124,7 +124,16 @@ static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {}
- 
- static bool regs_use_siar(struct pt_regs *regs)
- {
--	return !!regs->result;
-+	/*
-+	 * When we take a performance monitor exception the regs are setup
-+	 * using perf_read_regs() which overloads some fields, in particular
-+	 * regs->result to tell us whether to use SIAR.
-+	 *
-+	 * However if the regs are from another exception, eg. a syscall, then
-+	 * they have not been setup using perf_read_regs() and so regs->result
-+	 * is something random.
-+	 */
-+	return ((TRAP(regs) == 0xf00) && regs->result);
- }
- 
- /*
-diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
-index 27bb554..7ef2862 100644
---- a/arch/sparc/kernel/ldc.c
-+++ b/arch/sparc/kernel/ldc.c
-@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len,
- 	if (len & (8UL - 1))
- 		return ERR_PTR(-EINVAL);
- 
--	buf = kzalloc(len, GFP_KERNEL);
-+	buf = kzalloc(len, GFP_ATOMIC);
- 	if (!buf)
- 		return ERR_PTR(-ENOMEM);
- 
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 5dab54a..96e743a 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -2440,9 +2440,19 @@ config X86_DMA_REMAP
- 	depends on STA2X11
- 
- config IOSF_MBI
--	tristate
--	default m
-+	tristate "Intel System On Chip IOSF Sideband support"
- 	depends on PCI
-+	---help---
-+	  Enables sideband access to mailbox registers on SoC's. The sideband is
-+	  available on the following platforms. This list is not meant to be
-+	  exclusive.
-+	   - BayTrail
-+	   - Cherryview
-+	   - Braswell
-+	   - Quark
-+
-+	  You should say Y if you are running a kernel on one of these
-+	  platforms.
- 
- source "net/Kconfig"
- 
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index e9dc029..ac03bd7 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -571,7 +571,7 @@ struct kvm_arch {
- 	struct kvm_pic *vpic;
- 	struct kvm_ioapic *vioapic;
- 	struct kvm_pit *vpit;
--	int vapics_in_nmi_mode;
-+	atomic_t vapics_in_nmi_mode;
- 	struct mutex apic_map_lock;
- 	struct kvm_apic_map *apic_map;
- 
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 298781d..1406ffd 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work)
- 		 * LVT0 to NMI delivery. Other PIC interrupts are just sent to
- 		 * VCPU0, and only if its LVT0 is in EXTINT mode.
- 		 */
--		if (kvm->arch.vapics_in_nmi_mode > 0)
-+		if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
- 			kvm_for_each_vcpu(i, vcpu, kvm)
- 				kvm_apic_nmi_wd_deliver(vcpu);
- 	}
-diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 453e5fb..6456734 100644
---- a/arch/x86/kvm/lapic.c
-+++ b/arch/x86/kvm/lapic.c
-@@ -1109,10 +1109,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
- 		if (!nmi_wd_enabled) {
- 			apic_debug("Receive NMI setting on APIC_LVT0 "
- 				   "for cpu %d\n", apic->vcpu->vcpu_id);
--			apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
-+			atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- 		}
- 	} else if (nmi_wd_enabled)
--		apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
-+		atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- }
- 
- static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
-diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
-index 4f25ec0..bf00138 100644
---- a/arch/x86/pci/acpi.c
-+++ b/arch/x86/pci/acpi.c
-@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
- 			DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
- 		},
- 	},
-+	/* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
-+	/* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
-+	{
-+		.callback = set_use_crs,
-+		.ident = "Foxconn K8M890-8237A",
-+		.matches = {
-+			DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
-+			DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
-+			DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
-+		},
-+	},
- 
- 	/* Now for the blacklist.. */
- 
-@@ -124,8 +135,10 @@ void __init pci_acpi_crs_quirks(void)
- {
- 	int year;
- 
--	if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008)
--		pci_use_crs = false;
-+	if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) {
-+		if (iomem_resource.end <= 0xffffffff)
-+			pci_use_crs = false;
-+	}
- 
- 	dmi_check_system(pci_crs_quirks);
- 
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 533a509..fbc693b 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -417,7 +417,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
- 
- 	val |= vid;
- 
--	wrmsrl(MSR_IA32_PERF_CTL, val);
-+	wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
- }
- 
- #define BYT_BCLK_FREQS 5
-diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
-index 5967667..1f35487 100644
---- a/drivers/crypto/talitos.c
-+++ b/drivers/crypto/talitos.c
-@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count,
- 		sg_count--;
- 		link_tbl_ptr--;
- 	}
--	be16_add_cpu(&link_tbl_ptr->len, cryptlen);
-+	link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len)
-+					+ cryptlen);
- 
- 	/* tag end of link table */
- 	link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN;
-@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
- 		break;
- 	default:
- 		dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
-+		kfree(t_alg);
- 		return ERR_PTR(-EINVAL);
- 	}
- 
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 9cbef59..9359740 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -1922,9 +1922,15 @@ static void free_pt_##LVL (unsigned long __pt)			\
- 	pt = (u64 *)__pt;					\
- 								\
- 	for (i = 0; i < 512; ++i) {				\
-+		/* PTE present? */				\
- 		if (!IOMMU_PTE_PRESENT(pt[i]))			\
- 			continue;				\
- 								\
-+		/* Large PTE? */				\
-+		if (PM_PTE_LEVEL(pt[i]) == 0 ||			\
-+		    PM_PTE_LEVEL(pt[i]) == 7)			\
-+			continue;				\
-+								\
- 		p = (unsigned long)IOMMU_PTE_PAGE(pt[i]);	\
- 		FN(p);						\
- 	}							\
-diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 25f7419..62c3fb9 100644
---- a/drivers/net/phy/phy_device.c
-+++ b/drivers/net/phy/phy_device.c
-@@ -765,10 +765,11 @@ static int genphy_config_advert(struct phy_device *phydev)
- 	if (phydev->supported & (SUPPORTED_1000baseT_Half |
- 				 SUPPORTED_1000baseT_Full)) {
- 		adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
--		if (adv != oldadv)
--			changed = 1;
- 	}
- 
-+	if (adv != oldadv)
-+		changed = 1;
-+
- 	err = phy_write(phydev, MII_CTRL1000, adv);
- 	if (err < 0)
- 		return err;
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 1d7e8a3..aa24f7d 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2905,17 +2905,6 @@ restart:
- 				vfsmnt = &mnt->mnt;
- 				continue;
- 			}
--			/*
--			 * Filesystems needing to implement special "root names"
--			 * should do so with ->d_dname()
--			 */
--			if (IS_ROOT(dentry) &&
--			   (dentry->d_name.len != 1 ||
--			    dentry->d_name.name[0] != '/')) {
--				WARN(1, "Root dentry has weird name <%.*s>\n",
--				     (int) dentry->d_name.len,
--				     dentry->d_name.name);
--			}
- 			if (!error)
- 				error = is_mounted(vfsmnt) ? 1 : 2;
- 			break;
-diff --git a/fs/inode.c b/fs/inode.c
-index e846a32..644875b 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -1631,8 +1631,8 @@ int file_remove_suid(struct file *file)
- 		error = security_inode_killpriv(dentry);
- 	if (!error && killsuid)
- 		error = __remove_suid(dentry, killsuid);
--	if (!error && (inode->i_sb->s_flags & MS_NOSEC))
--		inode->i_flags |= S_NOSEC;
-+	if (!error)
-+		inode_has_no_xattr(inode);
- 
- 	return error;
- }
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 2faa7ea..fc99d18 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -3031,11 +3031,15 @@ bool fs_fully_visible(struct file_system_type *type)
- 		if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
- 			continue;
- 
--		/* This mount is not fully visible if there are any child mounts
--		 * that cover anything except for empty directories.
-+		/* This mount is not fully visible if there are any
-+		 * locked child mounts that cover anything except for
-+		 * empty directories.
- 		 */
- 		list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
- 			struct inode *inode = child->mnt_mountpoint->d_inode;
-+			/* Only worry about locked mounts */
-+			if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
-+				continue;
- 			if (!S_ISDIR(inode->i_mode))
- 				goto next;
- 			if (inode->i_nlink > 2)
-diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
-index 6d9aedd..327b155 100644
---- a/include/kvm/arm_arch_timer.h
-+++ b/include/kvm/arm_arch_timer.h
-@@ -60,7 +60,8 @@ struct arch_timer_cpu {
- 
- #ifdef CONFIG_KVM_ARM_TIMER
- int kvm_timer_hyp_init(void);
--int kvm_timer_init(struct kvm *kvm);
-+void kvm_timer_enable(struct kvm *kvm);
-+void kvm_timer_init(struct kvm *kvm);
- void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- 			  const struct kvm_irq_level *irq);
- void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu);
-@@ -73,11 +74,8 @@ static inline int kvm_timer_hyp_init(void)
- 	return 0;
- };
- 
--static inline int kvm_timer_init(struct kvm *kvm)
--{
--	return 0;
--}
--
-+static inline void kvm_timer_enable(struct kvm *kvm) {}
-+static inline void kvm_timer_init(struct kvm *kvm) {}
- static inline void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- 					const struct kvm_irq_level *irq) {}
- static inline void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu) {}
-diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
-index 3573a81..8ba379f 100644
---- a/include/net/netns/sctp.h
-+++ b/include/net/netns/sctp.h
-@@ -31,6 +31,7 @@ struct netns_sctp {
- 	struct list_head addr_waitq;
- 	struct timer_list addr_wq_timer;
- 	struct list_head auto_asconf_splist;
-+	/* Lock that protects both addr_waitq and auto_asconf_splist */
- 	spinlock_t addr_wq_lock;
- 
- 	/* Lock that protects the local_addr_list writers */
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 0dfcc92..2c2d388 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -219,6 +219,10 @@ struct sctp_sock {
- 	atomic_t pd_mode;
- 	/* Receive to here while partial delivery is in effect. */
- 	struct sk_buff_head pd_lobby;
-+
-+	/* These must be the last fields, as they will skipped on copies,
-+	 * like on accept and peeloff operations
-+	 */
- 	struct list_head auto_asconf_list;
- 	int do_auto_asconf;
- };
-diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
-index a9a4a1b..8d423bc 100644
---- a/net/bridge/br_ioctl.c
-+++ b/net/bridge/br_ioctl.c
-@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- 		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
- 			return -EPERM;
- 
--		spin_lock_bh(&br->lock);
- 		br_stp_set_bridge_priority(br, args[1]);
--		spin_unlock_bh(&br->lock);
- 		return 0;
- 
- 	case BRCTL_SET_PORT_PRIORITY:
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 11a2e6c..7bbc8fe 100644
---- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -1086,6 +1086,9 @@ static void br_multicast_add_router(struct net_bridge *br,
- 	struct net_bridge_port *p;
- 	struct hlist_node *slot = NULL;
- 
-+	if (!hlist_unhashed(&port->rlist))
-+		return;
-+
- 	hlist_for_each_entry(p, &br->router_list, rlist) {
- 		if ((unsigned long) port >= (unsigned long) p)
- 			break;
-@@ -1113,12 +1116,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
- 	if (port->multicast_router != 1)
- 		return;
- 
--	if (!hlist_unhashed(&port->rlist))
--		goto timer;
--
- 	br_multicast_add_router(br, port);
- 
--timer:
- 	mod_timer(&port->multicast_router_timer,
- 		  now + br->multicast_querier_interval);
- }
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 189ba1e..9a0005a 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
- 	return true;
- }
- 
--/* called under bridge lock */
-+/* Acquires and releases bridge lock */
- void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- {
- 	struct net_bridge_port *p;
- 	int wasroot;
- 
-+	spin_lock_bh(&br->lock);
- 	wasroot = br_is_root_bridge(br);
- 
- 	list_for_each_entry(p, &br->port_list, list) {
-@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- 	br_port_state_selection(br);
- 	if (br_is_root_bridge(br) && !wasroot)
- 		br_become_root_bridge(br);
-+	spin_unlock_bh(&br->lock);
- }
- 
- /* called under bridge lock */
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 7d95f69..0f062c6 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -976,6 +976,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
- 	rc = 0;
- 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
- 		goto out_unlock_bh;
-+	if (neigh->dead)
-+		goto out_dead;
- 
- 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
- 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
-@@ -1032,6 +1034,13 @@ out_unlock_bh:
- 		write_unlock(&neigh->lock);
- 	local_bh_enable();
- 	return rc;
-+
-+out_dead:
-+	if (neigh->nud_state & NUD_STALE)
-+		goto out_unlock_bh;
-+	write_unlock_bh(&neigh->lock);
-+	kfree_skb(skb);
-+	return 1;
- }
- EXPORT_SYMBOL(__neigh_event_send);
- 
-@@ -1095,6 +1104,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
- 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
- 	    (old & (NUD_NOARP | NUD_PERMANENT)))
- 		goto out;
-+	if (neigh->dead)
-+		goto out;
- 
- 	if (!(new & NUD_VALID)) {
- 		neigh_del_timer(neigh);
-@@ -1244,6 +1255,8 @@ EXPORT_SYMBOL(neigh_update);
-  */
- void __neigh_set_probe_once(struct neighbour *neigh)
- {
-+	if (neigh->dead)
-+		return;
- 	neigh->updated = jiffies;
- 	if (!(neigh->nud_state & NUD_FAILED))
- 		return;
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 69ec61a..8207f8d 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -368,9 +368,11 @@ refill:
- 		for (order = NETDEV_FRAG_PAGE_MAX_ORDER; ;) {
- 			gfp_t gfp = gfp_mask;
- 
--			if (order)
-+			if (order) {
- 				gfp |= __GFP_COMP | __GFP_NOWARN |
- 				       __GFP_NOMEMALLOC;
-+				gfp &= ~__GFP_WAIT;
-+			}
- 			nc->frag.page = alloc_pages(gfp, order);
- 			if (likely(nc->frag.page))
- 				break;
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 650dd58..8ebfa52 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1914,8 +1914,10 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
- 	do {
- 		gfp_t gfp = prio;
- 
--		if (order)
-+		if (order) {
- 			gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
-+			gfp &= ~__GFP_WAIT;
-+		}
- 		pfrag->page = alloc_pages(gfp, order);
- 		if (likely(pfrag->page)) {
- 			pfrag->offset = 0;
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 07bd8ed..951fe55 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog)
- 				err = 0;
- 			if (err)
- 				goto out;
-+
-+			tcp_fastopen_init_key_once(true);
- 		}
- 		err = inet_csk_listen_start(sk, backlog);
- 		if (err)
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 29d240b..dc45221 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2684,10 +2684,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- 
- 	case TCP_FASTOPEN:
- 		if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
--		    TCPF_LISTEN)))
-+		    TCPF_LISTEN))) {
-+			tcp_fastopen_init_key_once(true);
-+
- 			err = fastopen_init_queue(sk, val);
--		else
-+		} else {
- 			err = -EINVAL;
-+		}
- 		break;
- 	case TCP_TIMESTAMP:
- 		if (!tp->repair)
-diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
-index f195d93..ee6518d 100644
---- a/net/ipv4/tcp_fastopen.c
-+++ b/net/ipv4/tcp_fastopen.c
-@@ -84,8 +84,6 @@ void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
- 	__be32 path[4] = { src, dst, 0, 0 };
- 	struct tcp_fastopen_context *ctx;
- 
--	tcp_fastopen_init_key_once(true);
--
- 	rcu_read_lock();
- 	ctx = rcu_dereference(tcp_fastopen_ctx);
- 	if (ctx) {
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 48b1817..84a60b8 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct sock *sk)
- 	sk_refcnt_debug_dec(sk);
- }
- 
--static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
--{
--	int x = atomic_read(&f->rr_cur) + 1;
--
--	if (x >= num)
--		x = 0;
--
--	return x;
--}
--
- static unsigned int fanout_demux_hash(struct packet_fanout *f,
- 				      struct sk_buff *skb,
- 				      unsigned int num)
-@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
- 				    struct sk_buff *skb,
- 				    unsigned int num)
- {
--	int cur, old;
-+	unsigned int val = atomic_inc_return(&f->rr_cur);
- 
--	cur = atomic_read(&f->rr_cur);
--	while ((old = atomic_cmpxchg(&f->rr_cur, cur,
--				     fanout_rr_next(f, num))) != cur)
--		cur = old;
--	return cur;
-+	return val % num;
- }
- 
- static unsigned int fanout_demux_cpu(struct packet_fanout *f,
-@@ -1345,7 +1331,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
- 			     struct packet_type *pt, struct net_device *orig_dev)
- {
- 	struct packet_fanout *f = pt->af_packet_priv;
--	unsigned int num = f->num_members;
-+	unsigned int num = ACCESS_ONCE(f->num_members);
- 	struct packet_sock *po;
- 	unsigned int idx;
- 
-diff --git a/net/sctp/output.c b/net/sctp/output.c
-index 740ca5f..e39e6d5 100644
---- a/net/sctp/output.c
-+++ b/net/sctp/output.c
-@@ -599,7 +599,9 @@ out:
- 	return err;
- no_route:
- 	kfree_skb(nskb);
--	IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
-+
-+	if (asoc)
-+		IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
- 
- 	/* FIXME: Returning the 'err' will effect all the associations
- 	 * associated with a socket, although only one of the paths of the
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 604a6ac..f940fdc 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -1532,8 +1532,10 @@ static void sctp_close(struct sock *sk, long timeout)
- 
- 	/* Supposedly, no process has access to the socket, but
- 	 * the net layers still may.
-+	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
-+	 * held and that should be grabbed before socket lock.
- 	 */
--	local_bh_disable();
-+	spin_lock_bh(&net->sctp.addr_wq_lock);
- 	bh_lock_sock(sk);
- 
- 	/* Hold the sock, since sk_common_release() will put sock_put()
-@@ -1543,7 +1545,7 @@ static void sctp_close(struct sock *sk, long timeout)
- 	sk_common_release(sk);
- 
- 	bh_unlock_sock(sk);
--	local_bh_enable();
-+	spin_unlock_bh(&net->sctp.addr_wq_lock);
- 
- 	sock_put(sk);
- 
-@@ -3511,6 +3513,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- 	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
- 		return 0;
- 
-+	spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- 	if (val == 0 && sp->do_auto_asconf) {
- 		list_del(&sp->auto_asconf_list);
- 		sp->do_auto_asconf = 0;
-@@ -3519,6 +3522,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- 		    &sock_net(sk)->sctp.auto_asconf_splist);
- 		sp->do_auto_asconf = 1;
- 	}
-+	spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- 	return 0;
- }
- 
-@@ -4009,18 +4013,28 @@ static int sctp_init_sock(struct sock *sk)
- 	local_bh_disable();
- 	percpu_counter_inc(&sctp_sockets_allocated);
- 	sock_prot_inuse_add(net, sk->sk_prot, 1);
-+
-+	/* Nothing can fail after this block, otherwise
-+	 * sctp_destroy_sock() will be called without addr_wq_lock held
-+	 */
- 	if (net->sctp.default_auto_asconf) {
-+		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
- 		list_add_tail(&sp->auto_asconf_list,
- 		    &net->sctp.auto_asconf_splist);
- 		sp->do_auto_asconf = 1;
--	} else
-+		spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
-+	} else {
- 		sp->do_auto_asconf = 0;
-+	}
-+
- 	local_bh_enable();
- 
- 	return 0;
- }
- 
--/* Cleanup any SCTP per socket resources.  */
-+/* Cleanup any SCTP per socket resources. Must be called with
-+ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
-+ */
- static void sctp_destroy_sock(struct sock *sk)
- {
- 	struct sctp_sock *sp;
-@@ -6973,6 +6987,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
- 	newinet->mc_list = NULL;
- }
- 
-+static inline void sctp_copy_descendant(struct sock *sk_to,
-+					const struct sock *sk_from)
-+{
-+	int ancestor_size = sizeof(struct inet_sock) +
-+			    sizeof(struct sctp_sock) -
-+			    offsetof(struct sctp_sock, auto_asconf_list);
-+
-+	if (sk_from->sk_family == PF_INET6)
-+		ancestor_size += sizeof(struct ipv6_pinfo);
-+
-+	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
-+}
-+
- /* Populate the fields of the newsk from the oldsk and migrate the assoc
-  * and its messages to the newsk.
-  */
-@@ -6987,7 +7014,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- 	struct sk_buff *skb, *tmp;
- 	struct sctp_ulpevent *event;
- 	struct sctp_bind_hashbucket *head;
--	struct list_head tmplist;
- 
- 	/* Migrate socket buffer sizes and all the socket level options to the
- 	 * new socket.
-@@ -6995,12 +7021,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- 	newsk->sk_sndbuf = oldsk->sk_sndbuf;
- 	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
- 	/* Brute force copy old sctp opt. */
--	if (oldsp->do_auto_asconf) {
--		memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
--		inet_sk_copy_descendant(newsk, oldsk);
--		memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
--	} else
--		inet_sk_copy_descendant(newsk, oldsk);
-+	sctp_copy_descendant(newsk, oldsk);
- 
- 	/* Restore the ep value that was overwritten with the above structure
- 	 * copy.
-diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
-index 5081e80..c6fe405 100644
---- a/virt/kvm/arm/arch_timer.c
-+++ b/virt/kvm/arm/arch_timer.c
-@@ -61,12 +61,14 @@ static void timer_disarm(struct arch_timer_cpu *timer)
- 
- static void kvm_timer_inject_irq(struct kvm_vcpu *vcpu)
- {
-+	int ret;
- 	struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
- 
- 	timer->cntv_ctl |= ARCH_TIMER_CTRL_IT_MASK;
--	kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
--			    timer->irq->irq,
--			    timer->irq->level);
-+	ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
-+				  timer->irq->irq,
-+				  timer->irq->level);
-+	WARN_ON(ret);
- }
- 
- static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
-@@ -307,12 +309,24 @@ void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu)
- 	timer_disarm(timer);
- }
- 
--int kvm_timer_init(struct kvm *kvm)
-+void kvm_timer_enable(struct kvm *kvm)
- {
--	if (timecounter && wqueue) {
--		kvm->arch.timer.cntvoff = kvm_phys_timer_read();
-+	if (kvm->arch.timer.enabled)
-+		return;
-+
-+	/*
-+	 * There is a potential race here between VCPUs starting for the first
-+	 * time, which may be enabling the timer multiple times.  That doesn't
-+	 * hurt though, because we're just setting a variable to the same
-+	 * variable that it already was.  The important thing is that all
-+	 * VCPUs have the enabled variable set, before entering the guest, if
-+	 * the arch timers are enabled.
-+	 */
-+	if (timecounter && wqueue)
- 		kvm->arch.timer.enabled = 1;
--	}
-+}
- 
--	return 0;
-+void kvm_timer_init(struct kvm *kvm)
-+{
-+	kvm->arch.timer.cntvoff = kvm_phys_timer_read();
- }
-diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
-index c324a52..152ec76 100644
---- a/virt/kvm/arm/vgic.c
-+++ b/virt/kvm/arm/vgic.c
-@@ -1042,6 +1042,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- 			  lr, irq, vgic_cpu->vgic_lr[lr]);
- 		BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
- 		vgic_cpu->vgic_lr[lr] |= GICH_LR_PENDING_BIT;
-+		__clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
- 		return true;
- 	}
- 
-@@ -1055,6 +1056,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- 	vgic_cpu->vgic_lr[lr] = MK_LR_PEND(sgi_source_id, irq);
- 	vgic_cpu->vgic_irq_lr_map[irq] = lr;
- 	set_bit(lr, vgic_cpu->lr_used);
-+	__clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
- 
- 	if (!vgic_irq_is_edge(vcpu, irq))
- 		vgic_cpu->vgic_lr[lr] |= GICH_LR_EOI;
-@@ -1209,6 +1211,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
- 	if (vgic_cpu->vgic_misr & GICH_MISR_U)
- 		vgic_cpu->vgic_hcr &= ~GICH_HCR_UIE;
- 
-+	/*
-+	 * In the next iterations of the vcpu loop, if we sync the vgic state
-+	 * after flushing it, but before entering the guest (this happens for
-+	 * pending signals and vmid rollovers), then make sure we don't pick
-+	 * up any old maintenance interrupts here.
-+	 */
-+	memset(vgic_cpu->vgic_eisr, 0, sizeof(vgic_cpu->vgic_eisr[0]) * 2);
-+
- 	return level_pending;
- }
- 
diff --git a/3.14.49/1048_linux-3.14.49.patch b/3.14.49/1048_linux-3.14.49.patch
deleted file mode 100644
index a202904..0000000
--- a/3.14.49/1048_linux-3.14.49.patch
+++ /dev/null
@@ -1,4039 +0,0 @@
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index 01ef408..8faff12 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -91,5 +91,5 @@ mpp61         61       gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62         62       gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
-                        audio(mclk), uart0(cts)
- mpp63         63       gpo, spi0(sck), tclk
--mpp64         64       gpio, spi0(miso), spi0-1(cs1)
--mpp65         65       gpio, spi0(mosi), spi0-1(cs2)
-+mpp64         64       gpio, spi0(miso), spi0(cs1)
-+mpp65         65       gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index bfa0a2e..86dec67 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -41,15 +41,15 @@ mpp20         20       gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21         21       gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22         22       gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23         23       gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24         24       gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25         25       gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26         26       gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24         24       gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25         25       gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26         26       gpio, lcd(clk), tdm(fsync)
- mpp27         27       gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28         28       gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30         30       gpio, tdm(int1), sd0(clk)
--mpp31         31       gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32         32       gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31         31       gpio, tdm(int2), sd0(cmd)
-+mpp32         32       gpio, tdm(int3), sd0(d0)
- mpp33         33       gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34         34       gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35         35       gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -57,21 +57,18 @@ mpp36         36       gpio, spi(mosi)
- mpp37         37       gpio, spi(miso)
- mpp38         38       gpio, spi(sck)
- mpp39         39       gpio, spi(cs0)
--mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
--                       pcie(clkreq0)
-+mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41         41       gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
-                        pcie(clkreq1)
--mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
--                       vdd(cpu0-pd)
--mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
--                       vdd(cpu2-3-pd){1}
-+mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44         44       gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
-                        mem(bat)
- mpp45         45       gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46         46       gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47         47       gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
-                        ref(clkout)
--mpp48         48       gpio, tclk, dev(burst/last)
-+mpp48         48       gpio, dev(clkout), dev(burst/last)
- 
- * Marvell Armada XP (mv78260 and mv78460 only)
- 
-@@ -83,9 +80,9 @@ mpp51         51       gpio, dev(ad16)
- mpp52         52       gpio, dev(ad17)
- mpp53         53       gpio, dev(ad18)
- mpp54         54       gpio, dev(ad19)
--mpp55         55       gpio, dev(ad20), vdd(cpu0-pd)
--mpp56         56       gpio, dev(ad21), vdd(cpu1-pd)
--mpp57         57       gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55         55       gpio, dev(ad20)
-+mpp56         56       gpio, dev(ad21)
-+mpp57         57       gpio, dev(ad22)
- mpp58         58       gpio, dev(ad23)
- mpp59         59       gpio, dev(ad24)
- mpp60         60       gpio, dev(ad25)
-@@ -95,6 +92,3 @@ mpp63         63       gpio, dev(ad28)
- mpp64         64       gpio, dev(ad29)
- mpp65         65       gpio, dev(ad30)
- mpp66         66       gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-index 22ed679..4d1673c 100644
---- a/Documentation/devicetree/bindings/spi/spi_pl022.txt
-+++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-@@ -4,9 +4,9 @@ Required properties:
- - compatible : "arm,pl022", "arm,primecell"
- - reg : Offset and length of the register set for the device
- - interrupts : Should contain SPI controller interrupt
-+- num-cs : total number of chipselects
- 
- Optional properties:
--- num-cs : total number of chipselects
- - cs-gpios : should specify GPIOs used for chipselects.
-   The gpios will be referred to as reg = <index> in the SPI child nodes.
-   If unspecified, a single SPI device without a chip select can be used.
-diff --git a/Makefile b/Makefile
-index 25393e8..fee8460 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 48
-+SUBLEVEL = 49
- EXTRAVERSION =
- NAME = Remembering Coco
- 
-diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
-index 03cd689..90de5c5 100644
---- a/arch/arc/include/asm/cmpxchg.h
-+++ b/arch/arc/include/asm/cmpxchg.h
-@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
- 	"	scond   %3, [%1]	\n"
- 	"	bnz     1b		\n"
- 	"2:				\n"
--	: "=&r"(prev)
--	: "r"(ptr), "ir"(expected),
--	  "r"(new) /* can't be "ir". scond can't take limm for "b" */
--	: "cc");
-+	: "=&r"(prev)	/* Early clobber, to prevent reg reuse */
-+	: "r"(ptr),	/* Not "m": llock only supports reg direct addr mode */
-+	  "ir"(expected),
-+	  "r"(new)	/* can't be "ir". scond can't take LIMM for "b" */
-+	: "cc", "memory"); /* so that gcc knows memory is being written here */
- 
- 	return prev;
- }
-diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
-index a268a9a..a622dd0 100644
---- a/arch/arm64/kernel/vdso/Makefile
-+++ b/arch/arm64/kernel/vdso/Makefile
-@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin
- ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
- 		$(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- 
-+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
-+# down to collect2, resulting in silent corruption of the vDSO image.
-+ccflags-y += -Wl,-shared
-+
- obj-y += vdso.o
- extra-y += vdso.lds vdso-offsets.h
- CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
-diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
-index baa758d..76c1e6c 100644
---- a/arch/arm64/mm/context.c
-+++ b/arch/arm64/mm/context.c
-@@ -92,6 +92,14 @@ static void reset_context(void *info)
- 	unsigned int cpu = smp_processor_id();
- 	struct mm_struct *mm = current->active_mm;
- 
-+	/*
-+	 * current->active_mm could be init_mm for the idle thread immediately
-+	 * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to
-+	 * the reserved value, so no need to reset any context.
-+	 */
-+	if (mm == &init_mm)
-+		return;
-+
- 	smp_rmb();
- 	asid = cpu_last_asid + cpu;
- 
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 023747b..e3a24b7 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
- 
- int pmd_huge(pmd_t pmd)
- {
--	return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
- 
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
--	return !(pud_val(pud) & PUD_TABLE_BIT);
-+	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- 	return 0;
- #endif
-diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
-index d0b4c2e..aeb95a1 100644
---- a/arch/arm64/mm/init.c
-+++ b/arch/arm64/mm/init.c
-@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void)
- 		 * memmap entries are valid from the bank end aligned to
- 		 * MAX_ORDER_NR_PAGES.
- 		 */
--		prev_end = ALIGN(start + __phys_to_pfn(reg->size),
-+		prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size),
- 				 MAX_ORDER_NR_PAGES);
- 	}
- 
-diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c
-index e75ef82..c76f297 100644
---- a/arch/mips/kvm/kvm_mips_emul.c
-+++ b/arch/mips/kvm/kvm_mips_emul.c
-@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run)
- 		if (vcpu->mmio_needed == 2)
- 			*gpr = *(int16_t *) run->mmio.data;
- 		else
--			*gpr = *(int16_t *) run->mmio.data;
-+			*gpr = *(uint16_t *)run->mmio.data;
- 
- 		break;
- 	case 1:
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 246ef68..2c3c578 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- 	 * Obtain a permanent mapping for the FACS. This is required for the
- 	 * Global Lock and the Firmware Waking Vector
- 	 */
--	status = acpi_tb_initialize_facs();
--	if (ACPI_FAILURE(status)) {
--		ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
--		return_ACPI_STATUS(status);
-+	if (!(flags & ACPI_NO_FACS_INIT)) {
-+		status = acpi_tb_initialize_facs();
-+		if (ACPI_FAILURE(status)) {
-+			ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+			return_ACPI_STATUS(status);
-+		}
- 	}
- #endif				/* !ACPI_REDUCED_HARDWARE */
- 
-diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
-index b48aefa..60be8d0 100644
---- a/drivers/acpi/bus.c
-+++ b/drivers/acpi/bus.c
-@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void)
- u8 acpi_gbl_permanent_mmap;
- 
- 
-+/**
-+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace.
-+ *
-+ * The ACPI tables are accessible after this, but the handling of events has not
-+ * been initialized and the global lock is not available yet, so AML should not
-+ * be executed at this point.
-+ *
-+ * Doing this before switching the EFI runtime services to virtual mode allows
-+ * the EfiBootServices memory to be freed slightly earlier on boot.
-+ */
- void __init acpi_early_init(void)
- {
- 	acpi_status status;
-@@ -510,26 +520,42 @@ void __init acpi_early_init(void)
- 		acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi;
- 	}
- #endif
-+	return;
-+
-+ error0:
-+	disable_acpi();
-+}
-+
-+/**
-+ * acpi_subsystem_init - Finalize the early initialization of ACPI.
-+ *
-+ * Switch over the platform to the ACPI mode (if possible), initialize the
-+ * handling of ACPI events, install the interrupt and global lock handlers.
-+ *
-+ * Doing this too early is generally unsafe, but at the same time it needs to be
-+ * done before all things that really depend on ACPI.  The right spot appears to
-+ * be before finalizing the EFI initialization.
-+ */
-+void __init acpi_subsystem_init(void)
-+{
-+	acpi_status status;
-+
-+	if (acpi_disabled)
-+		return;
- 
- 	status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE);
- 	if (ACPI_FAILURE(status)) {
- 		printk(KERN_ERR PREFIX "Unable to enable ACPI\n");
--		goto error0;
-+		disable_acpi();
-+	} else {
-+		/*
-+		 * If the system is using ACPI then we can be reasonably
-+		 * confident that any regulators are managed by the firmware
-+		 * so tell the regulator core it has everything it needs to
-+		 * know.
-+		 */
-+		regulator_has_full_constraints();
- 	}
--
--	/*
--	 * If the system is using ACPI then we can be reasonably
--	 * confident that any regulators are managed by the firmware
--	 * so tell the regulator core it has everything it needs to
--	 * know.
--	 */
--	regulator_has_full_constraints();
--
--	return;
--
--      error0:
--	disable_acpi();
--	return;
- }
- 
- static int __init acpi_bus_init(void)
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index b1c0fcd..b0e6691 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "ST3320[68]13AS",	"SD1[5-9]",	ATA_HORKAGE_NONCQ |
- 						ATA_HORKAGE_FIRMWARE_WARN },
- 
--	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
-+	/* drives which fail FPDMA_AA activation (some may freeze afterwards) */
- 	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
- 	{ "ST1000LM024 HN-M101MBB", "2BA30001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
-+	{ "VB0250EAVER",	"HPG7",		ATA_HORKAGE_BROKEN_FPDMA_AA },
- 
- 	/* Blacklist entries taken from Silicon Image 3124/3132
- 	   Windows driver .inf file - also several Linux problem reports */
-@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "Micron_M550*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
- 	{ "Crucial_CT*M550SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
- 
-+	/* devices that don't properly handle TRIM commands */
-+	{ "SuperSSpeed S238*",		NULL,	ATA_HORKAGE_NOTRIM, },
-+
- 	/*
- 	 * Some WD SATA-I drives spin up and down erratically when the link
- 	 * is put into the slumber mode.  We don't have full list of the
-@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
- 	else /* In the ancient relic department - skip all of this */
- 		return 0;
- 
--	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
-+	/* On some disks, this command causes spin-up, so we need longer timeout */
-+	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
- 
- 	DPRINTK("EXIT, err_mask=%x\n", err_mask);
- 	return err_mask;
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index ef8567d..6fecf0b 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
- 		rbuf[14] = (lowest_aligned >> 8) & 0x3f;
- 		rbuf[15] = lowest_aligned;
- 
--		if (ata_id_has_trim(args->id)) {
-+		if (ata_id_has_trim(args->id) &&
-+		    !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
- 			rbuf[14] |= 0x80; /* TPE */
- 
- 			if (ata_id_has_zero_after_trim(args->id))
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 2495ee5..f0c15f9 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
- 	kfree(fw_priv);
- }
- 
--static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
- {
--	struct firmware_priv *fw_priv = to_firmware_priv(dev);
--
- 	if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
- 		return -ENOMEM;
- 	if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
-@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
- 	return 0;
- }
- 
-+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+	struct firmware_priv *fw_priv = to_firmware_priv(dev);
-+	int err = 0;
-+
-+	mutex_lock(&fw_lock);
-+	if (fw_priv->buf)
-+		err = do_firmware_uevent(fw_priv, env);
-+	mutex_unlock(&fw_lock);
-+	return err;
-+}
-+
- static struct class firmware_class = {
- 	.name		= "firmware",
- 	.class_attrs	= firmware_class_attrs,
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 2f9a3d8..58559d7 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
- static void regmap_field_init(struct regmap_field *rm_field,
- 	struct regmap *regmap, struct reg_field reg_field)
- {
--	int field_bits = reg_field.msb - reg_field.lsb + 1;
- 	rm_field->regmap = regmap;
- 	rm_field->reg = reg_field.reg;
- 	rm_field->shift = reg_field.lsb;
--	rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
-+	rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
- 	rm_field->id_size = reg_field.id_size;
- 	rm_field->id_offset = reg_field.id_offset;
- }
-@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
- 					  &ival);
- 			if (ret != 0)
- 				return ret;
--			memcpy(val + (i * val_bytes), &ival, val_bytes);
-+			map->format.format_val(val + (i * val_bytes), ival, 0);
- 		}
- 	}
- 
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index 63688d3..12be7cb 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
- 	rbd_assert(obj_request_type_valid(type));
- 
- 	size = strlen(object_name) + 1;
--	name = kmalloc(size, GFP_KERNEL);
-+	name = kmalloc(size, GFP_NOIO);
- 	if (!name)
- 		return NULL;
- 
--	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
-+	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
- 	if (!obj_request) {
- 		kfree(name);
- 		return NULL;
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index c0e7a9aa9..c23658e 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
- 	}
- 	fw_ptr = fw->data;
- 
-+	kfree_skb(skb);
-+
- 	/* This Intel specific command enables the manufacturer mode of the
- 	 * controller.
- 	 *
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index 5c85350..19e301f 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void)
- 	/* Query intel_iommu to see if we need the workaround. Presumably that
- 	 * was loaded first.
- 	 */
--	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
-+	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
- 	     gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
- 	     intel_iommu_gfx_mapped)
- 		return 1;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index 102463ba..643bba7 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- 		goto cleanup;
- 	}
- 
-+	ibmvtpm->dev = dev;
-+	ibmvtpm->vdev = vio_dev;
-+
- 	crq_q = &ibmvtpm->crq_queue;
- 	crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
- 	if (!crq_q->crq_addr) {
-@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- 
- 	crq_q->index = 0;
- 
--	ibmvtpm->dev = dev;
--	ibmvtpm->vdev = vio_dev;
- 	TPM_VPRIV(chip) = (void *)ibmvtpm;
- 
- 	spin_lock_init(&ibmvtpm->rtce_lock);
-diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
-index 831b482..ddd03f8 100644
---- a/drivers/clocksource/exynos_mct.c
-+++ b/drivers/clocksource/exynos_mct.c
-@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
- 
- 	if (mct_int_type == MCT_INT_SPI) {
--		evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
--		if (request_irq(evt->irq, exynos4_mct_tick_isr,
--				IRQF_TIMER | IRQF_NOBALANCING,
--				evt->name, mevt)) {
--			pr_err("exynos-mct: cannot register IRQ %d\n",
--				evt->irq);
-+
-+		if (evt->irq == -1)
- 			return -EIO;
--		}
--		irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
-+
-+		irq_force_affinity(evt->irq, cpumask_of(cpu));
-+		enable_irq(evt->irq);
- 	} else {
- 		enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
- 	}
-@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- static void exynos4_local_timer_stop(struct clock_event_device *evt)
- {
- 	evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
--	if (mct_int_type == MCT_INT_SPI)
--		free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
--	else
-+	if (mct_int_type == MCT_INT_SPI) {
-+		if (evt->irq != -1)
-+			disable_irq_nosync(evt->irq);
-+	} else {
- 		disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
-+	}
- }
- 
- static int exynos4_mct_cpu_notify(struct notifier_block *self,
-@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
- 
- static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
- {
--	int err;
-+	int err, cpu;
- 	struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
- 	struct clk *mct_clk, *tick_clk;
- 
-@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
- 		WARN(err, "MCT: can't request IRQ %d (%d)\n",
- 		     mct_irqs[MCT_L0_IRQ], err);
- 	} else {
--		irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
-+		for_each_possible_cpu(cpu) {
-+			int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
-+			struct mct_clock_event_device *pcpu_mevt =
-+				per_cpu_ptr(&percpu_mct_tick, cpu);
-+
-+			pcpu_mevt->evt.irq = -1;
-+
-+			irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
-+			if (request_irq(mct_irq,
-+					exynos4_mct_tick_isr,
-+					IRQF_TIMER | IRQF_NOBALANCING,
-+					pcpu_mevt->name, pcpu_mevt)) {
-+				pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
-+									cpu);
-+
-+				continue;
-+			}
-+			pcpu_mevt->evt.irq = mct_irq;
-+		}
- 	}
- 
- 	err = register_cpu_notifier(&exynos4_mct_cpu_nb);
-diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
-index e3d2052..1adc039 100644
---- a/drivers/cpuidle/cpuidle.c
-+++ b/drivers/cpuidle/cpuidle.c
-@@ -131,6 +131,9 @@ int cpuidle_idle_call(void)
- 
- 	/* ask the governor for the next state */
- 	next_state = cpuidle_curr_governor->select(drv, dev);
-+	if (next_state < 0)
-+		return -EBUSY;
-+
- 	if (need_resched()) {
- 		dev->last_residency = 0;
- 		/* give the governor an opportunity to reflect on the outcome */
-diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
-index cf7f2f0..027c484 100644
---- a/drivers/cpuidle/governors/menu.c
-+++ b/drivers/cpuidle/governors/menu.c
-@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
- 		data->needs_update = 0;
- 	}
- 
--	data->last_state_idx = 0;
-+	data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1;
- 	data->exit_us = 0;
- 
- 	/* Special case when user has set very strict latency requirement */
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index 394cbc5..6b2f01d 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- 	dma_cookie_t cookie = 0;
- 	int busy = mv_chan_is_busy(mv_chan);
- 	u32 current_desc = mv_chan_get_current_desc(mv_chan);
--	int seen_current = 0;
-+	int current_cleaned = 0;
-+	struct mv_xor_desc *hw_desc;
- 
- 	dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
- 	dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
-@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- 
- 	list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
- 					chain_node) {
--		prefetch(_iter);
--		prefetch(&_iter->async_tx);
- 
--		/* do not advance past the current descriptor loaded into the
--		 * hardware channel, subsequent descriptors are either in
--		 * process or have not been submitted
--		 */
--		if (seen_current)
--			break;
-+		/* clean finished descriptors */
-+		hw_desc = iter->hw_desc;
-+		if (hw_desc->status & XOR_DESC_SUCCESS) {
-+			cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
-+								cookie);
- 
--		/* stop the search if we reach the current descriptor and the
--		 * channel is busy
--		 */
--		if (iter->async_tx.phys == current_desc) {
--			seen_current = 1;
--			if (busy)
-+			/* done processing desc, clean slot */
-+			mv_xor_clean_slot(iter, mv_chan);
-+
-+			/* break if we did cleaned the current */
-+			if (iter->async_tx.phys == current_desc) {
-+				current_cleaned = 1;
-+				break;
-+			}
-+		} else {
-+			if (iter->async_tx.phys == current_desc) {
-+				current_cleaned = 0;
- 				break;
-+			}
- 		}
--
--		cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
--
--		if (mv_xor_clean_slot(iter, mv_chan))
--			break;
- 	}
- 
- 	if ((busy == 0) && !list_empty(&mv_chan->chain)) {
--		struct mv_xor_desc_slot *chain_head;
--		chain_head = list_entry(mv_chan->chain.next,
--					struct mv_xor_desc_slot,
--					chain_node);
--
--		mv_xor_start_new_chain(mv_chan, chain_head);
-+		if (current_cleaned) {
-+			/*
-+			 * current descriptor cleaned and removed, run
-+			 * from list head
-+			 */
-+			iter = list_entry(mv_chan->chain.next,
-+					  struct mv_xor_desc_slot,
-+					  chain_node);
-+			mv_xor_start_new_chain(mv_chan, iter);
-+		} else {
-+			if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
-+				/*
-+				 * descriptors are still waiting after
-+				 * current, trigger them
-+				 */
-+				iter = list_entry(iter->chain_node.next,
-+						  struct mv_xor_desc_slot,
-+						  chain_node);
-+				mv_xor_start_new_chain(mv_chan, iter);
-+			} else {
-+				/*
-+				 * some descriptors are still waiting
-+				 * to be cleaned
-+				 */
-+				tasklet_schedule(&mv_chan->irq_tasklet);
-+			}
-+		}
- 	}
- 
- 	if (cookie > 0)
-diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
-index d074922..5d14e4b 100644
---- a/drivers/dma/mv_xor.h
-+++ b/drivers/dma/mv_xor.h
-@@ -33,6 +33,7 @@
- #define XOR_OPERATION_MODE_XOR		0
- #define XOR_OPERATION_MODE_MEMCPY	2
- #define XOR_DESCRIPTOR_SWAP		BIT(14)
-+#define XOR_DESC_SUCCESS		0x40000000
- 
- #define XOR_CURR_DESC(chan)	(chan->mmr_high_base + 0x10 + (chan->idx * 4))
- #define XOR_NEXT_DESC(chan)	(chan->mmr_high_base + 0x00 + (chan->idx * 4))
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3b7d32d..903db3c 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
- 		return -EINVAL;
- 
--	/* For some reason crtc x/y offsets are signed internally. */
--	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
-+	/*
-+	 * Universal plane src offsets are only 16.16, prevent havoc for
-+	 * drivers using universal plane code internally.
-+	 */
-+	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
- 		return -ERANGE;
- 
- 	drm_modeset_lock_all(dev);
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index eb89653..c5e96a3 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
- 
- 	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
- 	cmd->type = QXL_SURFACE_CMD_CREATE;
-+	cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
- 	cmd->u.surface_create.format = surf->surf.format;
- 	cmd->u.surface_create.width = surf->surf.width;
- 	cmd->u.surface_create.height = surf->surf.height;
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index 0bb86e6..56a13a9 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- 	qobj = gem_to_qxl_bo(gobj);
- 
- 	ret = qxl_release_list_add(release, qobj);
--	if (ret)
-+	if (ret) {
-+		drm_gem_object_unreference_unlocked(gobj);
- 		return NULL;
-+	}
- 
- 	return qobj;
- }
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index c4558bd..2fd2fb3 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
- 	WDOORBELL32(ring->doorbell_index, ring->wptr);
- }
- 
-+static void cik_compute_stop(struct radeon_device *rdev,
-+			     struct radeon_ring *ring)
-+{
-+	u32 j, tmp;
-+
-+	cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
-+	/* Disable wptr polling. */
-+	tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
-+	tmp &= ~WPTR_POLL_EN;
-+	WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
-+	/* Disable HQD. */
-+	if (RREG32(CP_HQD_ACTIVE) & 1) {
-+		WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
-+		for (j = 0; j < rdev->usec_timeout; j++) {
-+			if (!(RREG32(CP_HQD_ACTIVE) & 1))
-+				break;
-+			udelay(1);
-+		}
-+		WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
-+		WREG32(CP_HQD_PQ_RPTR, 0);
-+		WREG32(CP_HQD_PQ_WPTR, 0);
-+	}
-+	cik_srbm_select(rdev, 0, 0, 0, 0);
-+}
-+
- /**
-  * cik_cp_compute_enable - enable/disable the compute CP MEs
-  *
-@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
- 	if (enable)
- 		WREG32(CP_MEC_CNTL, 0);
- 	else {
-+		/*
-+		 * To make hibernation reliable we need to clear compute ring
-+		 * configuration before halting the compute ring.
-+		 */
-+		mutex_lock(&rdev->srbm_mutex);
-+		cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
-+		cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
-+		mutex_unlock(&rdev->srbm_mutex);
-+
- 		WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
- 		rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
- 		rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
-diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
-index 66ba713..e590aec 100644
---- a/drivers/gpu/drm/radeon/cik_sdma.c
-+++ b/drivers/gpu/drm/radeon/cik_sdma.c
-@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
- 	}
- 	rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
- 	rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
-+
-+	/* FIXME use something else than big hammer but after few days can not
-+	 * seem to find good combination so reset SDMA blocks as it seems we
-+	 * do not shut them down properly. This fix hibernation and does not
-+	 * affect suspend to ram.
-+	 */
-+	WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
-+	(void)RREG32(SRBM_SOFT_RESET);
-+	udelay(50);
-+	WREG32(SRBM_SOFT_RESET, 0);
-+	(void)RREG32(SRBM_SOFT_RESET);
- }
- 
- /**
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index a8f9b46..e609722 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
- 			}
- 		}
- 	}
--	mb();
--	radeon_gart_tlb_flush(rdev);
-+	if (rdev->gart.ptr) {
-+		mb();
-+		radeon_gart_tlb_flush(rdev);
-+	}
- }
- 
- /**
-@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
- 			}
- 		}
- 	}
--	mb();
--	radeon_gart_tlb_flush(rdev);
-+	if (rdev->gart.ptr) {
-+		mb();
-+		radeon_gart_tlb_flush(rdev);
-+	}
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index b3f0293..f8b20e1 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- 	struct drm_mode_config *mode_config = &dev->mode_config;
- 	struct drm_connector *connector;
- 
-+	mutex_lock(&mode_config->mutex);
- 	if (mode_config->num_connector) {
- 		list_for_each_entry(connector, &mode_config->connector_list, head)
- 			radeon_connector_hotplug(connector);
- 	}
-+	mutex_unlock(&mode_config->mutex);
- 	/* Just fire off a uevent and let userspace tell us what to do */
- 	drm_helper_hpd_irq_event(dev);
- }
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index 11804cc..c9053f7 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- 	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- 	{ 0, 0, 0, 0 },
- };
- 
-diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
-index d219c06..972444a 100644
---- a/drivers/hwmon/mcp3021.c
-+++ b/drivers/hwmon/mcp3021.c
-@@ -31,14 +31,11 @@
- /* output format */
- #define MCP3021_SAR_SHIFT	2
- #define MCP3021_SAR_MASK	0x3ff
--
- #define MCP3021_OUTPUT_RES	10	/* 10-bit resolution */
--#define MCP3021_OUTPUT_SCALE	4
- 
- #define MCP3221_SAR_SHIFT	0
- #define MCP3221_SAR_MASK	0xfff
- #define MCP3221_OUTPUT_RES	12	/* 12-bit resolution */
--#define MCP3221_OUTPUT_SCALE	1
- 
- enum chips {
- 	mcp3021,
-@@ -54,7 +51,6 @@ struct mcp3021_data {
- 	u16 sar_shift;
- 	u16 sar_mask;
- 	u8 output_res;
--	u8 output_scale;
- };
- 
- static int mcp3021_read16(struct i2c_client *client)
-@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
- 
- static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
- {
--	if (val == 0)
--		return 0;
--
--	val = val * data->output_scale - data->output_scale / 2;
--
--	return val * DIV_ROUND_CLOSEST(data->vdd,
--			(1 << data->output_res) * data->output_scale);
-+	return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
- }
- 
- static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
-@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
- 		data->sar_shift = MCP3021_SAR_SHIFT;
- 		data->sar_mask = MCP3021_SAR_MASK;
- 		data->output_res = MCP3021_OUTPUT_RES;
--		data->output_scale = MCP3021_OUTPUT_SCALE;
- 		break;
- 
- 	case mcp3221:
- 		data->sar_shift = MCP3221_SAR_SHIFT;
- 		data->sar_mask = MCP3221_SAR_MASK;
- 		data->output_res = MCP3221_OUTPUT_RES;
--		data->output_scale = MCP3221_OUTPUT_SCALE;
- 		break;
- 	}
- 
-diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
-index 8873d84..50862c9 100644
---- a/drivers/i2c/busses/i2c-at91.c
-+++ b/drivers/i2c/busses/i2c-at91.c
-@@ -62,6 +62,9 @@
- #define	AT91_TWI_UNRE		0x0080	/* Underrun Error */
- #define	AT91_TWI_NACK		0x0100	/* Not Acknowledged */
- 
-+#define	AT91_TWI_INT_MASK \
-+	(AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
-+
- #define	AT91_TWI_IER		0x0024	/* Interrupt Enable Register */
- #define	AT91_TWI_IDR		0x0028	/* Interrupt Disable Register */
- #define	AT91_TWI_IMR		0x002c	/* Interrupt Mask Register */
-@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
- 
- static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
- {
--	at91_twi_write(dev, AT91_TWI_IDR,
--		       AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
-+	at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
- }
- 
- static void at91_twi_irq_save(struct at91_twi_dev *dev)
- {
--	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
-+	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
- 	at91_disable_twi_interrupts(dev);
- }
- 
-@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data)
- 	dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
- 			 dev->buf_len, DMA_TO_DEVICE);
- 
-+	/*
-+	 * When this callback is called, THR/TX FIFO is likely not to be empty
-+	 * yet. So we have to wait for TXCOMP or NACK bits to be set into the
-+	 * Status Register to be sure that the STOP bit has been sent and the
-+	 * transfer is completed. The NACK interrupt has already been enabled,
-+	 * we just have to enable TXCOMP one.
-+	 */
-+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- 	at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
- }
- 
-@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data)
- 	/* The last two bytes have to be read without using dma */
- 	dev->buf += dev->buf_len - 2;
- 	dev->buf_len = 2;
--	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
-+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
- }
- 
- static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
-@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
- 	/* catch error flags */
- 	dev->transfer_status |= status;
- 
--	if (irqstatus & AT91_TWI_TXCOMP) {
-+	if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
- 		at91_disable_twi_interrupts(dev);
- 		complete(&dev->cmd_complete);
- 	}
-@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- 	int ret;
- 	bool has_unre_flag = dev->pdata->has_unre_flag;
- 
-+	/*
-+	 * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
-+	 * read flag but shows the state of the transmission at the time the
-+	 * Status Register is read. According to the programmer datasheet,
-+	 * TXCOMP is set when both holding register and internal shifter are
-+	 * empty and STOP condition has been sent.
-+	 * Consequently, we should enable NACK interrupt rather than TXCOMP to
-+	 * detect transmission failure.
-+	 *
-+	 * Besides, the TXCOMP bit is already set before the i2c transaction
-+	 * has been started. For read transactions, this bit is cleared when
-+	 * writing the START bit into the Control Register. So the
-+	 * corresponding interrupt can safely be enabled just after.
-+	 * However for write transactions managed by the CPU, we first write
-+	 * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
-+	 * interrupt. If TXCOMP interrupt were enabled before writing into THR,
-+	 * the interrupt handler would be called immediately and the i2c command
-+	 * would be reported as completed.
-+	 * Also when a write transaction is managed by the DMA controller,
-+	 * enabling the TXCOMP interrupt in this function may lead to a race
-+	 * condition since we don't know whether the TXCOMP interrupt is enabled
-+	 * before or after the DMA has started to write into THR. So the TXCOMP
-+	 * interrupt is enabled later by at91_twi_write_data_dma_callback().
-+	 * Immediately after in that DMA callback, we still need to send the
-+	 * STOP condition manually writing the corresponding bit into the
-+	 * Control Register.
-+	 */
-+
- 	dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
- 		(dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
- 
-@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- 		 * seems to be the best solution.
- 		 */
- 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- 			at91_twi_read_data_dma(dev);
--			/*
--			 * It is important to enable TXCOMP irq here because
--			 * doing it only when transferring the last two bytes
--			 * will mask NACK errors since TXCOMP is set when a
--			 * NACK occurs.
--			 */
--			at91_twi_write(dev, AT91_TWI_IER,
--			       AT91_TWI_TXCOMP);
--		} else
-+		} else {
- 			at91_twi_write(dev, AT91_TWI_IER,
--			       AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
-+				       AT91_TWI_TXCOMP |
-+				       AT91_TWI_NACK |
-+				       AT91_TWI_RXRDY);
-+		}
- 	} else {
- 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- 			at91_twi_write_data_dma(dev);
--			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- 		} else {
- 			at91_twi_write_next_byte(dev);
- 			at91_twi_write(dev, AT91_TWI_IER,
--				AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
-+				       AT91_TWI_TXCOMP |
-+				       AT91_TWI_NACK |
-+				       AT91_TWI_TXRDY);
- 		}
- 	}
- 
-diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
-index e6bf77d..ed4e45f 100644
---- a/drivers/iio/adc/at91_adc.c
-+++ b/drivers/iio/adc/at91_adc.c
-@@ -58,7 +58,7 @@ struct at91_adc_caps {
- 	u8	ts_pen_detect_sensitivity;
- 
- 	/* startup time calculate function */
--	u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
-+	u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
- 
- 	u8	num_channels;
- 	struct at91_adc_reg_desc registers;
-@@ -82,7 +82,7 @@ struct at91_adc_state {
- 	u8			num_channels;
- 	void __iomem		*reg_base;
- 	struct at91_adc_reg_desc *registers;
--	u8			startup_time;
-+	u32			startup_time;
- 	u8			sample_hold_time;
- 	bool			sleep_mode;
- 	struct iio_trigger	**trig;
-@@ -590,7 +590,7 @@ ret:
- 	return ret;
- }
- 
--static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
- {
- 	/*
- 	 * Number of ticks needed to cover the startup time of the ADC
-@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
- 	return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
- }
- 
--static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
- {
- 	/*
- 	 * For sama5d3x and at91sam9x5, the formula changes to:
-diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
-index e8199cc..1e66651 100644
---- a/drivers/iio/dac/ad5624r_spi.c
-+++ b/drivers/iio/dac/ad5624r_spi.c
-@@ -22,7 +22,7 @@
- #include "ad5624r.h"
- 
- static int ad5624r_spi_write(struct spi_device *spi,
--			     u8 cmd, u8 addr, u16 val, u8 len)
-+			     u8 cmd, u8 addr, u16 val, u8 shift)
- {
- 	u32 data;
- 	u8 msg[3];
-@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
- 	 * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
- 	 * for the AD5664R, AD5644R, and AD5624R, respectively.
- 	 */
--	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
-+	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
- 	msg[0] = data >> 16;
- 	msg[1] = data >> 8;
- 	msg[2] = data;
-diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
-index 84a0789..7a80509 100644
---- a/drivers/iio/temperature/tmp006.c
-+++ b/drivers/iio/temperature/tmp006.c
-@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
- 	struct tmp006_data *data = iio_priv(indio_dev);
- 	int i;
- 
-+	if (mask != IIO_CHAN_INFO_SAMP_FREQ)
-+		return -EINVAL;
-+
- 	for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
- 		if ((val == tmp006_freqs[i][0]) &&
- 		    (val2 == tmp006_freqs[i][1])) {
-diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
-index 6014227..dd2b610 100644
---- a/drivers/infiniband/ulp/isert/ib_isert.c
-+++ b/drivers/infiniband/ulp/isert/ib_isert.c
-@@ -59,6 +59,8 @@ static int
- isert_rdma_accept(struct isert_conn *isert_conn);
- struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
- 
-+static void isert_release_work(struct work_struct *work);
-+
- static void
- isert_qp_event_callback(struct ib_event *e, void *context)
- {
-@@ -206,7 +208,7 @@ fail:
- static void
- isert_free_rx_descriptors(struct isert_conn *isert_conn)
- {
--	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
-+	struct ib_device *ib_dev = isert_conn->conn_device->ib_device;
- 	struct iser_rx_desc *rx_desc;
- 	int i;
- 
-@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- 	mutex_init(&isert_conn->conn_mutex);
- 	spin_lock_init(&isert_conn->conn_lock);
- 	INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
-+	INIT_WORK(&isert_conn->release_work, isert_release_work);
- 
- 	isert_conn->conn_cm_id = cma_id;
- 	isert_conn->responder_resources = event->param.conn.responder_resources;
-@@ -647,9 +650,9 @@ out:
- static void
- isert_connect_release(struct isert_conn *isert_conn)
- {
--	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
- 	struct isert_device *device = isert_conn->conn_device;
- 	int cq_index;
-+	struct ib_device *ib_dev = device->ib_device;
- 
- 	pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
- 
-@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn)
- 		isert_conn_free_fastreg_pool(isert_conn);
- 
- 	isert_free_rx_descriptors(isert_conn);
--	rdma_destroy_id(isert_conn->conn_cm_id);
-+	if (isert_conn->conn_cm_id)
-+		rdma_destroy_id(isert_conn->conn_cm_id);
- 
- 	if (isert_conn->conn_qp) {
- 		cq_index = ((struct isert_cq_desc *)
-@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- {
- 	struct isert_np *isert_np = cma_id->context;
- 	struct isert_conn *isert_conn;
-+	bool terminating = false;
- 
- 	if (isert_np->np_cm_id == cma_id)
- 		return isert_np_cma_handler(cma_id->context, event);
-@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- 	isert_conn = cma_id->qp->qp_context;
- 
- 	mutex_lock(&isert_conn->conn_mutex);
-+	terminating = (isert_conn->state == ISER_CONN_TERMINATING);
- 	isert_conn_terminate(isert_conn);
- 	mutex_unlock(&isert_conn->conn_mutex);
- 
- 	pr_info("conn %p completing conn_wait\n", isert_conn);
- 	complete(&isert_conn->conn_wait);
- 
-+	if (terminating)
-+		goto out;
-+
-+	mutex_lock(&isert_np->np_accept_mutex);
-+	if (!list_empty(&isert_conn->conn_accept_node)) {
-+		list_del_init(&isert_conn->conn_accept_node);
-+		isert_put_conn(isert_conn);
-+		queue_work(isert_release_wq, &isert_conn->release_work);
-+	}
-+	mutex_unlock(&isert_np->np_accept_mutex);
-+
-+out:
- 	return 0;
- }
- 
--static void
-+static int
- isert_connect_error(struct rdma_cm_id *cma_id)
- {
- 	struct isert_conn *isert_conn = cma_id->qp->qp_context;
- 
-+	isert_conn->conn_cm_id = NULL;
- 	isert_put_conn(isert_conn);
-+
-+	return -1;
- }
- 
- static int
-@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- 	case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
- 	case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
- 	case RDMA_CM_EVENT_CONNECT_ERROR:
--		isert_connect_error(cma_id);
-+		ret = isert_connect_error(cma_id);
- 		break;
- 	default:
- 		pr_err("Unhandled RDMA CMA event: %d\n", event->event);
-@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
- 
- 	wait_for_completion(&isert_conn->conn_wait_comp_err);
- 
--	INIT_WORK(&isert_conn->release_work, isert_release_work);
- 	queue_work(isert_release_wq, &isert_conn->release_work);
- }
- 
-diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
-index f37d63c..825545c 100644
---- a/drivers/leds/led-class.c
-+++ b/drivers/leds/led-class.c
-@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev)
- }
- EXPORT_SYMBOL_GPL(led_classdev_resume);
- 
-+#ifdef CONFIG_PM_SLEEP
- static int led_suspend(struct device *dev)
- {
- 	struct led_classdev *led_cdev = dev_get_drvdata(dev);
-@@ -197,11 +198,9 @@ static int led_resume(struct device *dev)
- 
- 	return 0;
- }
-+#endif
- 
--static const struct dev_pm_ops leds_class_dev_pm_ops = {
--	.suspend        = led_suspend,
--	.resume         = led_resume,
--};
-+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
- 
- /**
-  * led_classdev_register - register a new object of led_classdev class.
-diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
-index 28a9012..b3b0697 100644
---- a/drivers/md/dm-stats.c
-+++ b/drivers/md/dm-stats.c
-@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
- 		return -EINVAL;
- 
- 	if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
-+		if (!divisor)
-+			return -EINVAL;
- 		step = end - start;
- 		if (do_div(step, divisor))
- 			step++;
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 40959ee..b4067b9 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
- 	    mddev->ctime         != info->ctime         ||
- 	    mddev->level         != info->level         ||
- /*	    mddev->layout        != info->layout        || */
--	    !mddev->persistent	 != info->not_persistent||
-+	    mddev->persistent	 != !info->not_persistent ||
- 	    mddev->chunk_sectors != info->chunk_size >> 9 ||
- 	    /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
- 	    ((state^info->state) & 0xfffffe00)
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index b88757c..a03178e 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- 
- 		if (s < 0 && nr_center < -s) {
- 			/* not enough in central node */
--			shift(left, center, nr_center);
--			s = nr_center - target;
-+			shift(left, center, -nr_center);
-+			s += nr_center;
- 			shift(left, right, s);
- 			nr_right += s;
- 		} else
-@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- 		if (s > 0 && nr_center < s) {
- 			/* not enough in central node */
- 			shift(center, right, nr_center);
--			s = target - nr_center;
-+			s -= nr_center;
- 			shift(left, right, s);
- 			nr_left -= s;
- 		} else
-diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
-index 200ac12..fdd3793 100644
---- a/drivers/md/persistent-data/dm-btree.c
-+++ b/drivers/md/persistent-data/dm-btree.c
-@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
- 	int r;
- 	struct del_stack *s;
- 
--	s = kmalloc(sizeof(*s), GFP_KERNEL);
-+	s = kmalloc(sizeof(*s), GFP_NOIO);
- 	if (!s)
- 		return -ENOMEM;
- 	s->info = info;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index f4e22bc..199c9cc 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
- 	smm->recursion_count++;
- }
- 
-+static int apply_bops(struct sm_metadata *smm)
-+{
-+	int r = 0;
-+
-+	while (!brb_empty(&smm->uncommitted)) {
-+		struct block_op bop;
-+
-+		r = brb_pop(&smm->uncommitted, &bop);
-+		if (r) {
-+			DMERR("bug in bop ring buffer");
-+			break;
-+		}
-+
-+		r = commit_bop(smm, &bop);
-+		if (r)
-+			break;
-+	}
-+
-+	return r;
-+}
-+
- static int out(struct sm_metadata *smm)
- {
- 	int r = 0;
-@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
- 		return -ENOMEM;
- 	}
- 
--	if (smm->recursion_count == 1) {
--		while (!brb_empty(&smm->uncommitted)) {
--			struct block_op bop;
--
--			r = brb_pop(&smm->uncommitted, &bop);
--			if (r) {
--				DMERR("bug in bop ring buffer");
--				break;
--			}
--
--			r = commit_bop(smm, &bop);
--			if (r)
--				break;
--		}
--	}
-+	if (smm->recursion_count == 1)
-+		apply_bops(smm);
- 
- 	smm->recursion_count--;
- 
-@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
- 		}
- 		old_len = smm->begin;
- 
-+		r = apply_bops(smm);
-+		if (r) {
-+			DMERR("%s: apply_bops failed", __func__);
-+			goto out;
-+		}
-+
- 		r = sm_ll_commit(&smm->ll);
- 		if (r)
- 			goto out;
-@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
- 	if (r)
- 		return r;
- 
-+	r = apply_bops(smm);
-+	if (r) {
-+		DMERR("%s: apply_bops failed", __func__);
-+		return r;
-+	}
-+
- 	return sm_metadata_commit(sm);
- }
- 
-diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
-index fb504f1..5930aee 100644
---- a/drivers/media/dvb-frontends/af9013.c
-+++ b/drivers/media/dvb-frontends/af9013.c
-@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
- 			}
- 		}
- 
-+		/* Return an error if can't find bandwidth or the right clock */
-+		if (i == ARRAY_SIZE(coeff_lut))
-+			return -EINVAL;
-+
- 		ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
- 			sizeof(coeff_lut[i].val));
- 	}
-diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
-index 2916d7c..7bc68b3 100644
---- a/drivers/media/dvb-frontends/cx24116.c
-+++ b/drivers/media/dvb-frontends/cx24116.c
-@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- 	struct cx24116_state *state = fe->demodulator_priv;
- 	int i, ret;
- 
-+	/* Validate length */
-+	if (d->msg_len > sizeof(d->msg))
-+                return -EINVAL;
-+
- 	/* Dump DiSEqC message */
- 	if (debug) {
- 		printk(KERN_INFO "cx24116: %s(", __func__);
-@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- 		printk(") toneburst=%d\n", toneburst);
- 	}
- 
--	/* Validate length */
--	if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
--		return -EINVAL;
--
- 	/* DiSEqC message */
- 	for (i = 0; i < d->msg_len; i++)
- 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
-diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
-index a6c3c9e..d2eab06 100644
---- a/drivers/media/dvb-frontends/cx24117.c
-+++ b/drivers/media/dvb-frontends/cx24117.c
-@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
- 	dev_dbg(&state->priv->i2c->dev, ")\n");
- 
- 	/* Validate length */
--	if (d->msg_len > 15)
-+	if (d->msg_len > sizeof(d->msg))
- 		return -EINVAL;
- 
- 	/* DiSEqC message */
-diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
-index 93eeaf7..0b4f8fe 100644
---- a/drivers/media/dvb-frontends/s5h1420.c
-+++ b/drivers/media/dvb-frontends/s5h1420.c
-@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
- 	int result = 0;
- 
- 	dprintk("enter %s\n", __func__);
--	if (cmd->msg_len > 8)
-+	if (cmd->msg_len > sizeof(cmd->msg))
- 		return -EINVAL;
- 
- 	/* setup for DISEQC */
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index b1e21fc..d71f5ef 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
- 
- 	ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
- 
-+	mmc_blk_put(md);
-+
- 	return ret;
- }
- 
-@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- 			break;
- 		case MMC_BLK_CMD_ERR:
- 			ret = mmc_blk_cmd_err(md, card, brq, req, ret);
--			if (!mmc_blk_reset(md, card->host, type))
--				break;
--			goto cmd_abort;
-+			if (mmc_blk_reset(md, card->host, type))
-+				goto cmd_abort;
-+			if (!ret)
-+				goto start_new_req;
-+			break;
- 		case MMC_BLK_RETRY:
- 			if (retry++ < 5)
- 				break;
-diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
-index f8a7dd1..70a3db3 100644
---- a/drivers/mtd/maps/dc21285.c
-+++ b/drivers/mtd/maps/dc21285.c
-@@ -38,9 +38,9 @@ static void nw_en_write(void)
- 	 * we want to write a bit pattern XXX1 to Xilinx to enable
- 	 * the write gate, which will be open for about the next 2ms.
- 	 */
--	spin_lock_irqsave(&nw_gpio_lock, flags);
-+	raw_spin_lock_irqsave(&nw_gpio_lock, flags);
- 	nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
--	spin_unlock_irqrestore(&nw_gpio_lock, flags);
-+	raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
- 
- 	/*
- 	 * let the ISA bus to catch on...
-diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
-index 5073cbc..32d5e40 100644
---- a/drivers/mtd/mtd_blkdevs.c
-+++ b/drivers/mtd/mtd_blkdevs.c
-@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
- 		return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
- 
- 	mutex_lock(&dev->lock);
-+	mutex_lock(&mtd_table_mutex);
- 
- 	if (dev->open)
- 		goto unlock;
-@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
- 
- unlock:
- 	dev->open++;
-+	mutex_unlock(&mtd_table_mutex);
- 	mutex_unlock(&dev->lock);
- 	blktrans_dev_put(dev);
- 	return ret;
-@@ -232,6 +234,7 @@ error_release:
- error_put:
- 	module_put(dev->tr->owner);
- 	kref_put(&dev->ref, blktrans_dev_release);
-+	mutex_unlock(&mtd_table_mutex);
- 	mutex_unlock(&dev->lock);
- 	blktrans_dev_put(dev);
- 	return ret;
-@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- 		return;
- 
- 	mutex_lock(&dev->lock);
-+	mutex_lock(&mtd_table_mutex);
- 
- 	if (--dev->open)
- 		goto unlock;
-@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- 		__put_mtd_device(dev->mtd);
- 	}
- unlock:
-+	mutex_unlock(&mtd_table_mutex);
- 	mutex_unlock(&dev->lock);
- 	blktrans_dev_put(dev);
- }
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 9715a7b..efc542d 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd,
- 			oob += chip->ecc.prepad;
- 		}
- 
--		chip->read_buf(mtd, oob, eccbytes);
-+		chip->write_buf(mtd, oob, eccbytes);
- 		oob += eccbytes;
- 
- 		if (chip->ecc.postpad) {
-@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- 					int *busw)
- {
- 	struct nand_onfi_params *p = &chip->onfi_params;
--	int i;
-+	int i, j;
- 	int val;
- 
- 	/* Try ONFI for unknown chip or LP */
-@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- 		chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I')
- 		return 0;
- 
--	/*
--	 * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not
--	 * with NAND_BUSWIDTH_16
--	 */
--	if (chip->options & NAND_BUSWIDTH_16) {
--		pr_err("ONFI cannot be probed in 16-bit mode; aborting\n");
--		return 0;
--	}
--
- 	chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
- 	for (i = 0; i < 3; i++) {
--		chip->read_buf(mtd, (uint8_t *)p, sizeof(*p));
-+		for (j = 0; j < sizeof(*p); j++)
-+			((uint8_t *)p)[j] = chip->read_byte(mtd);
- 		if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
- 				le16_to_cpu(p->crc)) {
- 			break;
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 5924f72..f35ce8e 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
- 	ath_stop_ani(sc);
- 	ath9k_hw_disable_interrupts(ah);
- 
--	if (!ath_drain_all_txq(sc))
--		ret = false;
--
--	if (!ath_stoprecv(sc))
--		ret = false;
-+	if (AR_SREV_9300_20_OR_LATER(ah)) {
-+		ret &= ath_stoprecv(sc);
-+		ret &= ath_drain_all_txq(sc);
-+	} else {
-+		ret &= ath_drain_all_txq(sc);
-+		ret &= ath_stoprecv(sc);
-+	}
- 
- 	return ret;
- }
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 3935614..e99f329 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells);
- #ifdef CONFIG_NUMA
- int __weak of_node_to_nid(struct device_node *np)
- {
--	return numa_node_id();
-+	return NUMA_NO_NODE;
- }
- #endif
- 
-diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
-index 615a45a..582688fe 100644
---- a/drivers/pcmcia/topic.h
-+++ b/drivers/pcmcia/topic.h
-@@ -104,6 +104,9 @@
- #define TOPIC_EXCA_IF_CONTROL		0x3e	/* 8 bit */
- #define TOPIC_EXCA_IFC_33V_ENA		0x01
- 
-+#define TOPIC_PCI_CFG_PPBCN		0x3e	/* 16-bit */
-+#define TOPIC_PCI_CFG_PPBCN_WBEN	0x0400
-+
- static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
- {
- 	struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
-@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
- static int topic95_override(struct yenta_socket *socket)
- {
- 	u8 fctrl;
-+	u16 ppbcn;
- 
- 	/* enable 3.3V support for 16bit cards */
- 	fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
-@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
- 	/* tell yenta to use exca registers to power 16bit cards */
- 	socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
- 
-+	/* Disable write buffers to prevent lockups under load with numerous
-+	   Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
-+	   net.  This is not a power-on default according to the datasheet
-+	   but some BIOSes seem to set it. */
-+	if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
-+	    && socket->dev->revision <= 7
-+	    && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
-+		ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
-+		pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
-+		dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
-+	}
-+
- 	return 0;
- }
- 
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-index ae1f760..bb525b1 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
- 	MPP_MODE(64,
- 	   MPP_FUNCTION(0x0, "gpio", NULL),
- 	   MPP_FUNCTION(0x1, "spi0", "miso"),
--	   MPP_FUNCTION(0x2, "spi0-1", "cs1")),
-+	   MPP_FUNCTION(0x2, "spi0", "cs1")),
- 	MPP_MODE(65,
- 	   MPP_FUNCTION(0x0, "gpio", NULL),
- 	   MPP_FUNCTION(0x1, "spi0", "mosi"),
--	   MPP_FUNCTION(0x2, "spi0-1", "cs2")),
-+	   MPP_FUNCTION(0x2, "spi0", "cs2")),
- };
- 
- static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-index 843a51f..d918c51 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-@@ -14,10 +14,7 @@
-  * available: mv78230, mv78260 and mv78460. From a pin muxing
-  * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
-  * both have 67 MPP pins (more GPIOs and address lines for the memory
-- * bus mainly). The only difference between the mv78260 and the
-- * mv78460 in terms of pin muxing is the addition of two functions on
-- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
-- * cores, mv78460 has four cores).
-+ * bus mainly).
-  */
- 
- #include <linux/err.h>
-@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 	MPP_MODE(24,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sata1", "prsnt",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re",   V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "rst",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "hsync",      V_MV78230_PLUS)),
- 	MPP_MODE(25,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sata0", "prsnt",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we",   V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "pclk",       V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "vsync",      V_MV78230_PLUS)),
- 	MPP_MODE(26,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "fsync",      V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS)),
- 	MPP_MODE(27,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "ptp", "trig",       V_MV78230_PLUS),
-@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "ptp", "clk",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "int0",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS)),
- 	MPP_MODE(30,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "clk",        V_MV78230_PLUS),
-@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 	MPP_MODE(31,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "cmd",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS)),
- 	MPP_MODE(32,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "d0",         V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS)),
- 	MPP_MODE(33,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "d1",         V_MV78230_PLUS),
-@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "spi", "cs1",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart2", "cts",      V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd",    V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync",  V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0",   V_MV78230_PLUS)),
- 	MPP_MODE(41,
-@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "rxd",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart0", "cts",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "int7",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS)),
- 	MPP_MODE(43,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "txd",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart0", "rts",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "spi", "cs3",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd",  V_MV78460)),
-+		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS)),
- 	MPP_MODE(44,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "cts",      V_MV78230_PLUS),
-@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3",   V_MV78230_PLUS)),
- 	MPP_MODE(48,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "tclk", NULL,        V_MV78230_PLUS),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "clkout",     V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
- 	MPP_MODE(49,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
-@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x1, "dev", "ad19",       V_MV78260_PLUS)),
- 	MPP_MODE(55,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd",    V_MV78260_PLUS)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS)),
- 	MPP_MODE(56,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd",    V_MV78260_PLUS)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS)),
- 	MPP_MODE(57,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd",  V_MV78460)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS)),
- 	MPP_MODE(58,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "dev", "ad23",       V_MV78260_PLUS)),
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index fed4111..1beb232 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = {
- };
- 
- static struct calling_interface_buffer *buffer;
--static struct page *bufferpage;
- static DEFINE_MUTEX(buffer_mutex);
- 
- static int hwswitch_state;
-@@ -825,12 +824,11 @@ static int __init dell_init(void)
- 	 * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
- 	 * is passed to SMI handler.
- 	 */
--	bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
--	if (!bufferpage) {
-+	buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
-+	if (!buffer) {
- 		ret = -ENOMEM;
- 		goto fail_buffer;
- 	}
--	buffer = page_address(bufferpage);
- 
- 	ret = dell_setup_rfkill();
- 
-@@ -892,7 +890,7 @@ fail_backlight:
- 	cancel_delayed_work_sync(&dell_rfkill_work);
- 	dell_cleanup_rfkill();
- fail_rfkill:
--	free_page((unsigned long)bufferpage);
-+	free_page((unsigned long)buffer);
- fail_buffer:
- 	platform_device_del(platform_device);
- fail_platform_device2:
-diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
-index 6dd060a..0d1a5d4 100644
---- a/drivers/platform/x86/ideapad-laptop.c
-+++ b/drivers/platform/x86/ideapad-laptop.c
-@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
- static int ideapad_rfk_set(void *data, bool blocked)
- {
- 	struct ideapad_rfk_priv *priv = data;
-+	int opcode = ideapad_rfk_data[priv->dev].opcode;
- 
--	return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
-+	return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
- }
- 
- static struct rfkill_ops ideapad_rfk_ops = {
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 5d8d2dc..427cb62 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
- static void print_constraints(struct regulator_dev *rdev)
- {
- 	struct regulation_constraints *constraints = rdev->constraints;
--	char buf[80] = "";
-+	char buf[160] = "";
- 	int count = 0;
- 	int ret;
- 
-diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
-index 0801f3d..02edae7 100644
---- a/drivers/scsi/ipr.h
-+++ b/drivers/scsi/ipr.h
-@@ -264,7 +264,7 @@
- #define IPR_RUNTIME_RESET				0x40000000
- 
- #define IPR_IPL_INIT_MIN_STAGE_TIME			5
--#define IPR_IPL_INIT_DEFAULT_STAGE_TIME                 15
-+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME                 30
- #define IPR_IPL_INIT_STAGE_UNKNOWN			0x0
- #define IPR_IPL_INIT_STAGE_TRANSOP			0xB0000000
- #define IPR_IPL_INIT_STAGE_MASK				0xff000000
-diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
-index 0a1dcb4..13f4bef 100644
---- a/drivers/scsi/qla2xxx/qla_isr.c
-+++ b/drivers/scsi/qla2xxx/qla_isr.c
-@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
- 	struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
- 	struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
- 	struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
--	uint32_t	rscn_entry, host_pid;
-+	uint32_t	rscn_entry, host_pid, tmp_pid;
- 	unsigned long	flags;
-+	fc_port_t	*fcport = NULL;
- 
- 	/* Setup to process RIO completion. */
- 	handle_cnt = 0;
-@@ -968,6 +969,20 @@ skip_rio:
- 		if (qla2x00_is_a_vp_did(vha, rscn_entry))
- 			break;
- 
-+		/*
-+		 * Search for the rport related to this RSCN entry and mark it
-+		 * as lost.
-+		 */
-+		list_for_each_entry(fcport, &vha->vp_fcports, list) {
-+			if (atomic_read(&fcport->state) != FCS_ONLINE)
-+				continue;
-+			tmp_pid = fcport->d_id.b24;
-+			if (fcport->d_id.b24 == rscn_entry) {
-+				qla2x00_mark_device_lost(vha, fcport, 0, 0);
-+				break;
-+			}
-+		}
-+
- 		atomic_set(&vha->loop_down_timer, 0);
- 		vha->flags.management_server_logged_in = 0;
- 
-diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
-index e3e794e..b85eaa0 100644
---- a/drivers/scsi/scsi_transport_srp.c
-+++ b/drivers/scsi/scsi_transport_srp.c
-@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work)
- 	}
- }
- 
-+/**
-+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-+ *
-+ * To do: add support for scsi-mq in this function.
-+ */
-+static int scsi_request_fn_active(struct Scsi_Host *shost)
-+{
-+	struct scsi_device *sdev;
-+	struct request_queue *q;
-+	int request_fn_active = 0;
-+
-+	shost_for_each_device(sdev, shost) {
-+		q = sdev->request_queue;
-+
-+		spin_lock_irq(q->queue_lock);
-+		request_fn_active += q->request_fn_active;
-+		spin_unlock_irq(q->queue_lock);
-+	}
-+
-+	return request_fn_active;
-+}
-+
-+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
-+static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
-+{
-+	while (scsi_request_fn_active(shost))
-+		msleep(20);
-+}
-+
- static void __rport_fail_io_fast(struct srp_rport *rport)
- {
- 	struct Scsi_Host *shost = rport_to_shost(rport);
-@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport)
- 
- 	/* Involve the LLD if possible to terminate all I/O on the rport. */
- 	i = to_srp_internal(shost->transportt);
--	if (i->f->terminate_rport_io)
-+	if (i->f->terminate_rport_io) {
-+		srp_wait_for_queuecommand(shost);
- 		i->f->terminate_rport_io(rport);
-+	}
- }
- 
- /**
-@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport)
- EXPORT_SYMBOL(srp_start_tl_fail_timers);
- 
- /**
-- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-- */
--static int scsi_request_fn_active(struct Scsi_Host *shost)
--{
--	struct scsi_device *sdev;
--	struct request_queue *q;
--	int request_fn_active = 0;
--
--	shost_for_each_device(sdev, shost) {
--		q = sdev->request_queue;
--
--		spin_lock_irq(q->queue_lock);
--		request_fn_active += q->request_fn_active;
--		spin_unlock_irq(q->queue_lock);
--	}
--
--	return request_fn_active;
--}
--
--/**
-  * srp_reconnect_rport() - reconnect to an SRP target port
-  * @rport: SRP target port.
-  *
-@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
- 	if (res)
- 		goto out;
- 	scsi_target_block(&shost->shost_gendev);
--	while (scsi_request_fn_active(shost))
--		msleep(20);
-+	srp_wait_for_queuecommand(shost);
- 	res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
- 	pr_debug("%s (state %d): transport.reconnect() returned %d\n",
- 		 dev_name(&shost->shost_gendev), rport->state, res);
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index d6563ec..f3e3ae8 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master)
- 
- 	spin_lock_irqsave(&master->queue_lock, flags);
- 	mesg = master->cur_msg;
--	master->cur_msg = NULL;
--
--	queue_kthread_work(&master->kworker, &master->pump_messages);
- 	spin_unlock_irqrestore(&master->queue_lock, flags);
- 
- 	if (master->cur_msg_prepared && master->unprepare_message) {
-@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master)
- 		}
- 	}
- 
--	trace_spi_message_done(mesg);
--
-+	spin_lock_irqsave(&master->queue_lock, flags);
-+	master->cur_msg = NULL;
- 	master->cur_msg_prepared = false;
-+	queue_kthread_work(&master->kworker, &master->pump_messages);
-+	spin_unlock_irqrestore(&master->queue_lock, flags);
-+
-+	trace_spi_message_done(mesg);
- 
- 	mesg->state = NULL;
- 	if (mesg->complete)
-diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
-index ea96537..d060b1f 100644
---- a/drivers/staging/rtl8712/rtl8712_recv.c
-+++ b/drivers/staging/rtl8712/rtl8712_recv.c
-@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
- 		/* for first fragment packet, driver need allocate 1536 +
- 		 * drvinfo_sz + RXDESC_SIZE to defrag packet. */
- 		if ((mf == 1) && (frag == 0))
--			alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
-+			/*1658+6=1664, 1664 is 128 alignment.*/
-+			alloc_sz = max_t(u16, tmp_len, 1658);
- 		else
- 			alloc_sz = tmp_len;
- 		/* 2 is for IP header 4 bytes alignment in QoS packet case.
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index b61c555..c8d7b30 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = {
- 
- static int __init iscsi_target_init_module(void)
- {
--	int ret = 0;
-+	int ret = 0, size;
- 
- 	pr_debug("iSCSI-Target "ISCSIT_VERSION"\n");
- 
-@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void)
- 		pr_err("Unable to allocate memory for iscsit_global\n");
- 		return -1;
- 	}
-+	spin_lock_init(&iscsit_global->ts_bitmap_lock);
- 	mutex_init(&auth_id_lock);
- 	spin_lock_init(&sess_idr_lock);
- 	idr_init(&tiqn_idr);
-@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void)
- 	if (ret < 0)
- 		goto out;
- 
--	ret = iscsi_thread_set_init();
--	if (ret < 0)
-+	size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long);
-+	iscsit_global->ts_bitmap = vzalloc(size);
-+	if (!iscsit_global->ts_bitmap) {
-+		pr_err("Unable to allocate iscsit_global->ts_bitmap\n");
- 		goto configfs_out;
--
--	if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) !=
--			TARGET_THREAD_SET_COUNT) {
--		pr_err("iscsi_allocate_thread_sets() returned"
--			" unexpected value!\n");
--		goto ts_out1;
- 	}
- 
- 	lio_qr_cache = kmem_cache_create("lio_qr_cache",
-@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void)
- 	if (!lio_qr_cache) {
- 		pr_err("nable to kmem_cache_create() for"
- 				" lio_qr_cache\n");
--		goto ts_out2;
-+		goto bitmap_out;
- 	}
- 
- 	lio_dr_cache = kmem_cache_create("lio_dr_cache",
-@@ -597,10 +594,8 @@ dr_out:
- 	kmem_cache_destroy(lio_dr_cache);
- qr_out:
- 	kmem_cache_destroy(lio_qr_cache);
--ts_out2:
--	iscsi_deallocate_thread_sets();
--ts_out1:
--	iscsi_thread_set_free();
-+bitmap_out:
-+	vfree(iscsit_global->ts_bitmap);
- configfs_out:
- 	iscsi_target_deregister_configfs();
- out:
-@@ -610,8 +605,6 @@ out:
- 
- static void __exit iscsi_target_cleanup_module(void)
- {
--	iscsi_deallocate_thread_sets();
--	iscsi_thread_set_free();
- 	iscsit_release_discovery_tpg();
- 	iscsit_unregister_transport(&iscsi_target_transport);
- 	kmem_cache_destroy(lio_qr_cache);
-@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void)
- 
- 	iscsi_target_deregister_configfs();
- 
-+	vfree(iscsit_global->ts_bitmap);
- 	kfree(iscsit_global);
- }
- 
-@@ -3653,17 +3647,16 @@ static int iscsit_send_reject(
- 
- void iscsit_thread_get_cpumask(struct iscsi_conn *conn)
- {
--	struct iscsi_thread_set *ts = conn->thread_set;
- 	int ord, cpu;
- 	/*
--	 * thread_id is assigned from iscsit_global->ts_bitmap from
--	 * within iscsi_thread_set.c:iscsi_allocate_thread_sets()
-+	 * bitmap_id is assigned from iscsit_global->ts_bitmap from
-+	 * within iscsit_start_kthreads()
- 	 *
--	 * Here we use thread_id to determine which CPU that this
--	 * iSCSI connection's iscsi_thread_set will be scheduled to
-+	 * Here we use bitmap_id to determine which CPU that this
-+	 * iSCSI connection's RX/TX threads will be scheduled to
- 	 * execute upon.
- 	 */
--	ord = ts->thread_id % cpumask_weight(cpu_online_mask);
-+	ord = conn->bitmap_id % cpumask_weight(cpu_online_mask);
- 	for_each_online_cpu(cpu) {
- 		if (ord-- == 0) {
- 			cpumask_set_cpu(cpu, conn->conn_cpumask);
-@@ -3855,7 +3848,7 @@ check_rsp_state:
- 	switch (state) {
- 	case ISTATE_SEND_LOGOUTRSP:
- 		if (!iscsit_logout_post_handler(cmd, conn))
--			goto restart;
-+			return -ECONNRESET;
- 		/* fall through */
- 	case ISTATE_SEND_STATUS:
- 	case ISTATE_SEND_ASYNCMSG:
-@@ -3883,8 +3876,6 @@ check_rsp_state:
- 
- err:
- 	return -1;
--restart:
--	return -EAGAIN;
- }
- 
- static int iscsit_handle_response_queue(struct iscsi_conn *conn)
-@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn)
- int iscsi_target_tx_thread(void *arg)
- {
- 	int ret = 0;
--	struct iscsi_conn *conn;
--	struct iscsi_thread_set *ts = arg;
-+	struct iscsi_conn *conn = arg;
- 	/*
- 	 * Allow ourselves to be interrupted by SIGINT so that a
- 	 * connection recovery / failure event can be triggered externally.
- 	 */
- 	allow_signal(SIGINT);
- 
--restart:
--	conn = iscsi_tx_thread_pre_handler(ts);
--	if (!conn)
--		goto out;
--
--	ret = 0;
--
- 	while (!kthread_should_stop()) {
- 		/*
- 		 * Ensure that both TX and RX per connection kthreads
-@@ -3934,11 +3917,9 @@ restart:
- 		iscsit_thread_check_cpumask(conn, current, 1);
- 
- 		wait_event_interruptible(conn->queues_wq,
--					 !iscsit_conn_all_queues_empty(conn) ||
--					 ts->status == ISCSI_THREAD_SET_RESET);
-+					 !iscsit_conn_all_queues_empty(conn));
- 
--		if ((ts->status == ISCSI_THREAD_SET_RESET) ||
--		     signal_pending(current))
-+		if (signal_pending(current))
- 			goto transport_err;
- 
- get_immediate:
-@@ -3949,15 +3930,14 @@ get_immediate:
- 		ret = iscsit_handle_response_queue(conn);
- 		if (ret == 1)
- 			goto get_immediate;
--		else if (ret == -EAGAIN)
--			goto restart;
-+		else if (ret == -ECONNRESET)
-+			goto out;
- 		else if (ret < 0)
- 			goto transport_err;
- 	}
- 
- transport_err:
- 	iscsit_take_action_for_connection_exit(conn);
--	goto restart;
- out:
- 	return 0;
- }
-@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg)
- 	int ret;
- 	u8 buffer[ISCSI_HDR_LEN], opcode;
- 	u32 checksum = 0, digest = 0;
--	struct iscsi_conn *conn = NULL;
--	struct iscsi_thread_set *ts = arg;
-+	struct iscsi_conn *conn = arg;
- 	struct kvec iov;
- 	/*
- 	 * Allow ourselves to be interrupted by SIGINT so that a
-@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg)
- 	 */
- 	allow_signal(SIGINT);
- 
--restart:
--	conn = iscsi_rx_thread_pre_handler(ts);
--	if (!conn)
--		goto out;
--
- 	if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
- 		struct completion comp;
- 		int rc;
-@@ -4069,7 +4043,7 @@ restart:
- 		if (rc < 0)
- 			goto transport_err;
- 
--		goto out;
-+		goto transport_err;
- 	}
- 
- 	while (!kthread_should_stop()) {
-@@ -4145,8 +4119,6 @@ transport_err:
- 	if (!signal_pending(current))
- 		atomic_set(&conn->transport_failed, 1);
- 	iscsit_take_action_for_connection_exit(conn);
--	goto restart;
--out:
- 	return 0;
- }
- 
-@@ -4208,7 +4180,24 @@ int iscsit_close_connection(
- 	if (conn->conn_transport->transport_type == ISCSI_TCP)
- 		complete(&conn->conn_logout_comp);
- 
--	iscsi_release_thread_set(conn);
-+	if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) {
-+		if (conn->tx_thread &&
-+		    cmpxchg(&conn->tx_thread_active, true, false)) {
-+			send_sig(SIGINT, conn->tx_thread, 1);
-+			kthread_stop(conn->tx_thread);
-+		}
-+	} else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) {
-+		if (conn->rx_thread &&
-+		    cmpxchg(&conn->rx_thread_active, true, false)) {
-+			send_sig(SIGINT, conn->rx_thread, 1);
-+			kthread_stop(conn->rx_thread);
-+		}
-+	}
-+
-+	spin_lock(&iscsit_global->ts_bitmap_lock);
-+	bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+			      get_order(1));
-+	spin_unlock(&iscsit_global->ts_bitmap_lock);
- 
- 	iscsit_stop_timers_for_cmds(conn);
- 	iscsit_stop_nopin_response_timer(conn);
-@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession(
- 	struct iscsi_conn *conn)
- {
- 	struct iscsi_session *sess = conn->sess;
--
--	iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
--	iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
- 
- 	atomic_set(&conn->conn_logout_remove, 0);
- 	complete(&conn->conn_logout_comp);
- 
- 	iscsit_dec_conn_usage_count(conn);
--	iscsit_stop_session(sess, 1, 1);
-+	iscsit_stop_session(sess, sleep, sleep);
- 	iscsit_dec_session_usage_count(sess);
- 	target_put_session(sess->se_sess);
- }
-@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession(
- static void iscsit_logout_post_handler_samecid(
- 	struct iscsi_conn *conn)
- {
--	iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
--	iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
- 
- 	atomic_set(&conn->conn_logout_remove, 0);
- 	complete(&conn->conn_logout_comp);
- 
--	iscsit_cause_connection_reinstatement(conn, 1);
-+	iscsit_cause_connection_reinstatement(conn, sleep);
- 	iscsit_dec_conn_usage_count(conn);
- }
- 
-diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
-index 1d4a8c8..825b579 100644
---- a/drivers/target/iscsi/iscsi_target_core.h
-+++ b/drivers/target/iscsi/iscsi_target_core.h
-@@ -601,6 +601,11 @@ struct iscsi_conn {
- 	struct iscsi_session	*sess;
- 	/* Pointer to thread_set in use for this conn's threads */
- 	struct iscsi_thread_set	*thread_set;
-+	int			bitmap_id;
-+	int			rx_thread_active;
-+	struct task_struct	*rx_thread;
-+	int			tx_thread_active;
-+	struct task_struct	*tx_thread;
- 	/* list_head for session connection list */
- 	struct list_head	conn_list;
- } ____cacheline_aligned;
-@@ -869,10 +874,12 @@ struct iscsit_global {
- 	/* Unique identifier used for the authentication daemon */
- 	u32			auth_id;
- 	u32			inactive_ts;
-+#define ISCSIT_BITMAP_BITS	262144
- 	/* Thread Set bitmap count */
- 	int			ts_bitmap_count;
- 	/* Thread Set bitmap pointer */
- 	unsigned long		*ts_bitmap;
-+	spinlock_t		ts_bitmap_lock;
- 	/* Used for iSCSI discovery session authentication */
- 	struct iscsi_node_acl	discovery_acl;
- 	struct iscsi_portal_group	*discovery_tpg;
-diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
-index 0d1e6ee..7396d90 100644
---- a/drivers/target/iscsi/iscsi_target_erl0.c
-+++ b/drivers/target/iscsi/iscsi_target_erl0.c
-@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn)
- 	}
- 	spin_unlock_bh(&conn->state_lock);
- 
--	iscsi_thread_set_force_reinstatement(conn);
-+	if (conn->tx_thread && conn->tx_thread_active)
-+		send_sig(SIGINT, conn->tx_thread, 1);
-+	if (conn->rx_thread && conn->rx_thread_active)
-+		send_sig(SIGINT, conn->rx_thread, 1);
- 
- sleep:
- 	wait_for_completion(&conn->conn_wait_rcfr_comp);
-@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep)
- 		return;
- 	}
- 
--	if (iscsi_thread_set_force_reinstatement(conn) < 0) {
--		spin_unlock_bh(&conn->state_lock);
--		return;
--	}
-+	if (conn->tx_thread && conn->tx_thread_active)
-+		send_sig(SIGINT, conn->tx_thread, 1);
-+	if (conn->rx_thread && conn->rx_thread_active)
-+		send_sig(SIGINT, conn->rx_thread, 1);
- 
- 	atomic_set(&conn->connection_reinstatement, 1);
- 	if (!sleep) {
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index c5d3811..449df09 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
- 		iscsit_start_nopin_timer(conn);
- }
- 
-+int iscsit_start_kthreads(struct iscsi_conn *conn)
-+{
-+	int ret = 0;
-+
-+	spin_lock(&iscsit_global->ts_bitmap_lock);
-+	conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap,
-+					ISCSIT_BITMAP_BITS, get_order(1));
-+	spin_unlock(&iscsit_global->ts_bitmap_lock);
-+
-+	if (conn->bitmap_id < 0) {
-+		pr_err("bitmap_find_free_region() failed for"
-+		       " iscsit_start_kthreads()\n");
-+		return -ENOMEM;
-+	}
-+
-+	conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn,
-+				      "%s", ISCSI_TX_THREAD_NAME);
-+	if (IS_ERR(conn->tx_thread)) {
-+		pr_err("Unable to start iscsi_target_tx_thread\n");
-+		ret = PTR_ERR(conn->tx_thread);
-+		goto out_bitmap;
-+	}
-+	conn->tx_thread_active = true;
-+
-+	conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn,
-+				      "%s", ISCSI_RX_THREAD_NAME);
-+	if (IS_ERR(conn->rx_thread)) {
-+		pr_err("Unable to start iscsi_target_rx_thread\n");
-+		ret = PTR_ERR(conn->rx_thread);
-+		goto out_tx;
-+	}
-+	conn->rx_thread_active = true;
-+
-+	return 0;
-+out_tx:
-+	kthread_stop(conn->tx_thread);
-+	conn->tx_thread_active = false;
-+out_bitmap:
-+	spin_lock(&iscsit_global->ts_bitmap_lock);
-+	bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+			      get_order(1));
-+	spin_unlock(&iscsit_global->ts_bitmap_lock);
-+	return ret;
-+}
-+
- int iscsi_post_login_handler(
- 	struct iscsi_np *np,
- 	struct iscsi_conn *conn,
-@@ -691,7 +736,7 @@ int iscsi_post_login_handler(
- 	struct se_session *se_sess = sess->se_sess;
- 	struct iscsi_portal_group *tpg = sess->tpg;
- 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
--	struct iscsi_thread_set *ts;
-+	int rc;
- 
- 	iscsit_inc_conn_usage_count(conn);
- 
-@@ -706,7 +751,6 @@ int iscsi_post_login_handler(
- 	/*
- 	 * SCSI Initiator -> SCSI Target Port Mapping
- 	 */
--	ts = iscsi_get_thread_set();
- 	if (!zero_tsih) {
- 		iscsi_set_session_parameters(sess->sess_ops,
- 				conn->param_list, 0);
-@@ -733,9 +777,11 @@ int iscsi_post_login_handler(
- 			sess->sess_ops->InitiatorName);
- 		spin_unlock_bh(&sess->conn_lock);
- 
--		iscsi_post_login_start_timers(conn);
-+		rc = iscsit_start_kthreads(conn);
-+		if (rc)
-+			return rc;
- 
--		iscsi_activate_thread_set(conn, ts);
-+		iscsi_post_login_start_timers(conn);
- 		/*
- 		 * Determine CPU mask to ensure connection's RX and TX kthreads
- 		 * are scheduled on the same CPU.
-@@ -792,8 +838,11 @@ int iscsi_post_login_handler(
- 		" iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
- 	spin_unlock_bh(&se_tpg->session_lock);
- 
-+	rc = iscsit_start_kthreads(conn);
-+	if (rc)
-+		return rc;
-+
- 	iscsi_post_login_start_timers(conn);
--	iscsi_activate_thread_set(conn, ts);
- 	/*
- 	 * Determine CPU mask to ensure connection's RX and TX kthreads
- 	 * are scheduled on the same CPU.
-diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
-index ee52ab7..c501eba 100644
---- a/drivers/thermal/step_wise.c
-+++ b/drivers/thermal/step_wise.c
-@@ -76,7 +76,7 @@ static unsigned long get_target_state(struct thermal_instance *instance,
- 			next_target = instance->upper;
- 		break;
- 	case THERMAL_TREND_DROPPING:
--		if (cur_state == instance->lower) {
-+		if (cur_state <= instance->lower) {
- 			if (!throttle)
- 				next_target = THERMAL_NO_TARGET;
- 		} else {
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 45b7b96..8016aaa 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
- 	snoop(&urb->dev->dev, "urb complete\n");
- 	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
- 			as->status, COMPLETE, NULL, 0);
--	if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
-+	if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
- 		snoop_urb_data(urb, urb->actual_length);
- 
- 	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
-@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps)
- 	for (;;) {
- 		__set_current_state(TASK_INTERRUPTIBLE);
- 		as = async_getcompleted(ps);
--		if (as)
-+		if (as || !connected(ps))
- 			break;
- 		if (signal_pending(current))
- 			break;
-@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
- 	}
- 	if (signal_pending(current))
- 		return -EINTR;
--	return -EIO;
-+	return -ENODEV;
- }
- 
- static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
-@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
- 	struct async *as;
- 
- 	as = async_getcompleted(ps);
--	retval = -EAGAIN;
- 	if (as) {
- 		retval = processcompl(as, (void __user * __user *)arg);
- 		free_async(as);
-+	} else {
-+		retval = (connected(ps) ? -EAGAIN : -ENODEV);
- 	}
- 	return retval;
- }
-@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
- 	}
- 	if (signal_pending(current))
- 		return -EINTR;
--	return -EIO;
-+	return -ENODEV;
- }
- 
- static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
-@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
- 	int retval;
- 	struct async *as;
- 
--	retval = -EAGAIN;
- 	as = async_getcompleted(ps);
- 	if (as) {
- 		retval = processcompl_compat(as, (void __user * __user *)arg);
- 		free_async(as);
-+	} else {
-+		retval = (connected(ps) ? -EAGAIN : -ENODEV);
- 	}
- 	return retval;
- }
-@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg)
- {
- 	__u32 caps;
- 
--	caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM;
-+	caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
-+			USBDEVFS_CAP_REAP_AFTER_DISCONNECT;
- 	if (!ps->dev->bus->no_stop_on_short)
- 		caps |= USBDEVFS_CAP_BULK_CONTINUATION;
- 	if (ps->dev->bus->sg_tablesize)
-@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 		return -EPERM;
- 
- 	usb_lock_device(dev);
-+
-+	/* Reap operations are allowed even after disconnection */
-+	switch (cmd) {
-+	case USBDEVFS_REAPURB:
-+		snoop(&dev->dev, "%s: REAPURB\n", __func__);
-+		ret = proc_reapurb(ps, p);
-+		goto done;
-+
-+	case USBDEVFS_REAPURBNDELAY:
-+		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
-+		ret = proc_reapurbnonblock(ps, p);
-+		goto done;
-+
-+#ifdef CONFIG_COMPAT
-+	case USBDEVFS_REAPURB32:
-+		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
-+		ret = proc_reapurb_compat(ps, p);
-+		goto done;
-+
-+	case USBDEVFS_REAPURBNDELAY32:
-+		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
-+		ret = proc_reapurbnonblock_compat(ps, p);
-+		goto done;
-+#endif
-+	}
-+
- 	if (!connected(ps)) {
- 		usb_unlock_device(dev);
- 		return -ENODEV;
-@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 			inode->i_mtime = CURRENT_TIME;
- 		break;
- 
--	case USBDEVFS_REAPURB32:
--		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
--		ret = proc_reapurb_compat(ps, p);
--		break;
--
--	case USBDEVFS_REAPURBNDELAY32:
--		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
--		ret = proc_reapurbnonblock_compat(ps, p);
--		break;
--
- 	case USBDEVFS_IOCTL32:
- 		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
- 		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
-@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 		ret = proc_unlinkurb(ps, p);
- 		break;
- 
--	case USBDEVFS_REAPURB:
--		snoop(&dev->dev, "%s: REAPURB\n", __func__);
--		ret = proc_reapurb(ps, p);
--		break;
--
--	case USBDEVFS_REAPURBNDELAY:
--		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
--		ret = proc_reapurbnonblock(ps, p);
--		break;
--
- 	case USBDEVFS_DISCSIGNAL:
- 		snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
- 		ret = proc_disconnectsignal(ps, p);
-@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 		ret = proc_disconnect_claim(ps, p);
- 		break;
- 	}
-+
-+ done:
- 	usb_unlock_device(dev);
- 	if (ret >= 0)
- 		inode->i_atime = CURRENT_TIME;
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 0985ff7..a05fc58 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
- 		dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n");
- 		ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
- 		break;
-+	case USB_REQ_SET_INTERFACE:
-+		dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
-+		dwc->start_config_issued = false;
-+		/* Fall through */
- 	default:
- 		dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
- 		ret = dwc3_ep0_delegate_req(dwc, ctrl);
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 8f6738d..a57ad1f 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param)
- 		if (!(reg & DWC3_DGCMD_CMDACT)) {
- 			dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- 					DWC3_DGCMD_STATUS(reg));
-+			if (DWC3_DGCMD_STATUS(reg))
-+				return -EINVAL;
- 			return 0;
- 		}
- 
-@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- 		if (!(reg & DWC3_DEPCMD_CMDACT)) {
- 			dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- 					DWC3_DEPCMD_STATUS(reg));
-+			if (DWC3_DEPCMD_STATUS(reg))
-+				return -EINVAL;
- 			return 0;
- 		}
- 
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 9bce4f0..f8893b3 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 		/* Attempt to use the ring cache */
- 		if (virt_dev->num_rings_cached == 0)
- 			return -ENOMEM;
-+		virt_dev->num_rings_cached--;
- 		virt_dev->eps[ep_index].new_ring =
- 			virt_dev->ring_cache[virt_dev->num_rings_cached];
- 		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
--		virt_dev->num_rings_cached--;
- 		xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
- 					1, type);
- 	}
-diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
-index 0241a3a..1e9bde4 100644
---- a/drivers/usb/musb/musb_virthub.c
-+++ b/drivers/usb/musb/musb_virthub.c
-@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
- #ifdef CONFIG_USB_MUSB_HOST
- 	return 1;
- #else
--	if (musb->port_mode == MUSB_PORT_MODE_HOST)
--		return 1;
--	return musb->g.dev.driver != NULL;
-+	return musb->port_mode == MUSB_PORT_MODE_HOST;
- #endif
- }
- 
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 73c7292..d11335d 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
- 	{ USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
- 	{ USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
-+	{ USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
- 	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- 	{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
- 	{ USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 8b34841..096438e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
- 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- 	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
- 	{ } /* Terminating entry */
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 9a08e18..3d66e9c 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void)
- 	tty_unregister_driver(usb_serial_tty_driver);
- 	put_tty_driver(usb_serial_tty_driver);
- 	bus_unregister(&usb_serial_bus_type);
-+	idr_destroy(&serial_minors);
- }
- 
- 
-diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
-index 09cf013..90a6406 100644
---- a/drivers/watchdog/omap_wdt.c
-+++ b/drivers/watchdog/omap_wdt.c
-@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
- 
- 	pm_runtime_get_sync(wdev->dev);
- 
-+	/*
-+	 * Make sure the watchdog is disabled. This is unfortunately required
-+	 * because writing to various registers with the watchdog running has no
-+	 * effect.
-+	 */
-+	omap_wdt_disable(wdev);
-+
- 	/* initialize prescaler */
- 	while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
- 		cpu_relax();
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index bb7991c..bfdeadb 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
- 	unlock_new_inode(inode);
- 	return inode;
- error:
--	unlock_new_inode(inode);
--	iput(inode);
-+	iget_failed(inode);
- 	return ERR_PTR(retval);
- 
- }
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
-index 59dc8e8..de8606c 100644
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
- 	unlock_new_inode(inode);
- 	return inode;
- error:
--	unlock_new_inode(inode);
--	iput(inode);
-+	iget_failed(inode);
- 	return ERR_PTR(retval);
- 
- }
-diff --git a/fs/bio.c b/fs/bio.c
-index 8754e7b..b2b1451 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
-  * Allocates and returns a new bio which represents @sectors from the start of
-  * @bio, and updates @bio to represent the remaining sectors.
-  *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
-  */
- struct bio *bio_split(struct bio *bio, int sectors,
- 		      gfp_t gfp, struct bio_set *bs)
-@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- 	BUG_ON(sectors <= 0);
- 	BUG_ON(sectors >= bio_sectors(bio));
- 
--	split = bio_clone_fast(bio, gfp, bs);
-+	/*
-+	 * Discards need a mutable bio_vec to accommodate the payload
-+	 * required by the DSM TRIM and UNMAP commands.
-+	 */
-+	if (bio->bi_rw & REQ_DISCARD)
-+		split = bio_clone_bioset(bio, gfp, bs);
-+	else
-+		split = bio_clone_fast(bio, gfp, bs);
-+
- 	if (!split)
- 		return NULL;
- 
-diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
-index ab485e5..644942a 100644
---- a/fs/btrfs/inode-map.c
-+++ b/fs/btrfs/inode-map.c
-@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- 		__btrfs_add_free_space(ctl, info->offset, count);
- free:
- 		rb_erase(&info->offset_index, rbroot);
--		kfree(info);
-+		kmem_cache_free(btrfs_free_space_cachep, info);
- 	}
- }
- 
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 3e16042..d40ae42 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -2743,7 +2743,7 @@ out_unlock:
- static long btrfs_ioctl_file_extent_same(struct file *file,
- 			struct btrfs_ioctl_same_args __user *argp)
- {
--	struct btrfs_ioctl_same_args *same;
-+	struct btrfs_ioctl_same_args *same = NULL;
- 	struct btrfs_ioctl_same_extent_info *info;
- 	struct inode *src = file_inode(file);
- 	u64 off;
-@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
- 
- 	if (IS_ERR(same)) {
- 		ret = PTR_ERR(same);
-+		same = NULL;
- 		goto out;
- 	}
- 
-@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
- 
- out:
- 	mnt_drop_write_file(file);
-+	kfree(same);
- 	return ret;
- }
- 
-diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
-index e6574d7..a7c5277 100644
---- a/fs/ext4/indirect.c
-+++ b/fs/ext4/indirect.c
-@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
- 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
- 		EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
- 				 "non-extent mapped inodes with bigalloc");
--		return -ENOSPC;
-+		return -EUCLEAN;
- 	}
- 
- 	goal = ext4_find_goal(inode, map->m_lblk, partial);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index da03340..f9c63ae 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page,
- 					     unsigned int offset,
- 					     unsigned int length)
- {
--	int to_release = 0;
-+	int to_release = 0, contiguous_blks = 0;
- 	struct buffer_head *head, *bh;
- 	unsigned int curr_off = 0;
- 	struct inode *inode = page->mapping->host;
-@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page,
- 
- 		if ((offset <= curr_off) && (buffer_delay(bh))) {
- 			to_release++;
-+			contiguous_blks++;
- 			clear_buffer_delay(bh);
-+		} else if (contiguous_blks) {
-+			lblk = page->index <<
-+			       (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+			lblk += (curr_off >> inode->i_blkbits) -
-+				contiguous_blks;
-+			ext4_es_remove_extent(inode, lblk, contiguous_blks);
-+			contiguous_blks = 0;
- 		}
- 		curr_off = next_off;
- 	} while ((bh = bh->b_this_page) != head);
- 
--	if (to_release) {
-+	if (contiguous_blks) {
- 		lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
--		ext4_es_remove_extent(inode, lblk, to_release);
-+		lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
-+		ext4_es_remove_extent(inode, lblk, contiguous_blks);
- 	}
- 
- 	/* If we have released all the blocks belonging to a cluster, then we
-@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page,
- 		ext4_walk_page_buffers(handle, page_bufs, 0, len,
- 				       NULL, bget_one);
- 	}
--	/* As soon as we unlock the page, it can go away, but we have
--	 * references to buffers so we are safe */
-+	/*
-+	 * We need to release the page lock before we start the
-+	 * journal, so grab a reference so the page won't disappear
-+	 * out from under us.
-+	 */
-+	get_page(page);
- 	unlock_page(page);
- 
- 	handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
- 				    ext4_writepage_trans_blocks(inode));
- 	if (IS_ERR(handle)) {
- 		ret = PTR_ERR(handle);
--		goto out;
-+		put_page(page);
-+		goto out_no_pagelock;
- 	}
--
- 	BUG_ON(!ext4_handle_valid(handle));
- 
-+	lock_page(page);
-+	put_page(page);
-+	if (page->mapping != mapping) {
-+		/* The page got truncated from under us */
-+		ext4_journal_stop(handle);
-+		ret = 0;
-+		goto out;
-+	}
-+
- 	if (inline_data) {
- 		ret = ext4_journal_get_write_access(handle, inode_bh);
- 
-@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page,
- 				       NULL, bput_one);
- 	ext4_set_inode_state(inode, EXT4_STATE_JDATA);
- out:
-+	unlock_page(page);
-+out_no_pagelock:
- 	brelse(inode_bh);
- 	return ret;
- }
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 7620133..c4a5e4d 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4793,18 +4793,12 @@ do_more:
- 		/*
- 		 * blocks being freed are metadata. these blocks shouldn't
- 		 * be used until this transaction is committed
-+		 *
-+		 * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
-+		 * to fail.
- 		 */
--	retry:
--		new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
--		if (!new_entry) {
--			/*
--			 * We use a retry loop because
--			 * ext4_free_blocks() is not allowed to fail.
--			 */
--			cond_resched();
--			congestion_wait(BLK_RW_ASYNC, HZ/50);
--			goto retry;
--		}
-+		new_entry = kmem_cache_alloc(ext4_free_data_cachep,
-+				GFP_NOFS|__GFP_NOFAIL);
- 		new_entry->efd_start_cluster = bit;
- 		new_entry->efd_group = block_group;
- 		new_entry->efd_count = count_clusters;
-diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
-index 2ae73a8..be92ed2 100644
---- a/fs/ext4/migrate.c
-+++ b/fs/ext4/migrate.c
-@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode)
- 	struct ext4_inode_info		*ei = EXT4_I(inode);
- 	struct ext4_extent		*ex;
- 	unsigned int			i, len;
-+	ext4_lblk_t			start, end;
- 	ext4_fsblk_t			blk;
- 	handle_t			*handle;
- 	int				ret;
-@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode)
- 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC))
- 		return -EOPNOTSUPP;
- 
-+	/*
-+	 * In order to get correct extent info, force all delayed allocation
-+	 * blocks to be allocated, otherwise delayed allocation blocks may not
-+	 * be reflected and bypass the checks on extent header.
-+	 */
-+	if (test_opt(inode->i_sb, DELALLOC))
-+		ext4_alloc_da_blocks(inode);
-+
- 	handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
- 	if (IS_ERR(handle))
- 		return PTR_ERR(handle);
-@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode)
- 		goto errout;
- 	}
- 	if (eh->eh_entries == 0)
--		blk = len = 0;
-+		blk = len = start = end = 0;
- 	else {
- 		len = le16_to_cpu(ex->ee_len);
- 		blk = ext4_ext_pblock(ex);
--		if (len > EXT4_NDIR_BLOCKS) {
-+		start = le32_to_cpu(ex->ee_block);
-+		end = start + len - 1;
-+		if (end >= EXT4_NDIR_BLOCKS) {
- 			ret = -EOPNOTSUPP;
- 			goto errout;
- 		}
-@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode)
- 
- 	ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
- 	memset(ei->i_data, 0, sizeof(ei->i_data));
--	for (i=0; i < len; i++)
-+	for (i = start; i <= end; i++)
- 		ei->i_data[i] = cpu_to_le32(blk++);
- 	ext4_mark_inode_dirty(handle, inode);
- errout:
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 9fb3e6c..a07af5b 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb)
- 		dump_orphan_list(sb, sbi);
- 	J_ASSERT(list_empty(&sbi->s_orphan));
- 
-+	sync_blockdev(sb->s_bdev);
- 	invalidate_bdev(sb->s_bdev);
- 	if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
- 		/*
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 73f6bcb..faf00af 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- 		goto err_fput;
- 
- 	fuse_conn_init(fc);
-+	fc->release = fuse_free_conn;
- 
- 	fc->dev = sb->s_dev;
- 	fc->sb = sb;
-@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- 		fc->dont_mask = 1;
- 	sb->s_flags |= MS_POSIXACL;
- 
--	fc->release = fuse_free_conn;
- 	fc->flags = d.flags;
- 	fc->user_id = d.user_id;
- 	fc->group_id = d.group_id;
-diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index 4534ff6..77b583d 100644
---- a/fs/hpfs/super.c
-+++ b/fs/hpfs/super.c
-@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
- }
- 
- /* Filesystem error... */
--static char err_buf[1024];
--
- void hpfs_error(struct super_block *s, const char *fmt, ...)
- {
-+	struct va_format vaf;
- 	va_list args;
- 
- 	va_start(args, fmt);
--	vsnprintf(err_buf, sizeof(err_buf), fmt, args);
-+
-+	vaf.fmt = fmt;
-+	vaf.va = &args;
-+
-+	pr_err("filesystem error: %pV", &vaf);
-+
- 	va_end(args);
- 
--	printk("HPFS: filesystem error: %s", err_buf);
- 	if (!hpfs_sb(s)->sb_was_error) {
- 		if (hpfs_sb(s)->sb_err == 2) {
- 			printk("; crashing the system because you wanted it\n");
-diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
-index 7f34f47..b892355 100644
---- a/fs/jbd2/checkpoint.c
-+++ b/fs/jbd2/checkpoint.c
-@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- 	unsigned long	blocknr;
- 
- 	if (is_journal_aborted(journal))
--		return 1;
-+		return -EIO;
- 
- 	if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
- 		return 1;
-@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- 	 * jbd2_cleanup_journal_tail() doesn't get called all that often.
- 	 */
- 	if (journal->j_flags & JBD2_BARRIER)
--		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
- 
--	__jbd2_update_log_tail(journal, first_tid, blocknr);
--	return 0;
-+	return __jbd2_update_log_tail(journal, first_tid, blocknr);
- }
- 
- 
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index f2d78a3..e8d62d7 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
-  *
-  * Requires j_checkpoint_mutex
-  */
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- {
- 	unsigned long freed;
-+	int ret;
- 
- 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- 
-@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- 	 * space and if we lose sb update during power failure we'd replay
- 	 * old transaction with possibly newly overwritten data.
- 	 */
--	jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+	ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+	if (ret)
-+		goto out;
-+
- 	write_lock(&journal->j_state_lock);
- 	freed = block - journal->j_tail;
- 	if (block < journal->j_tail)
-@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- 	journal->j_tail_sequence = tid;
- 	journal->j_tail = block;
- 	write_unlock(&journal->j_state_lock);
-+
-+out:
-+	return ret;
- }
- 
- /*
-@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
- 	return jbd2_journal_start_thread(journal);
- }
- 
--static void jbd2_write_superblock(journal_t *journal, int write_op)
-+static int jbd2_write_superblock(journal_t *journal, int write_op)
- {
- 	struct buffer_head *bh = journal->j_sb_buffer;
- 	journal_superblock_t *sb = journal->j_superblock;
-@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- 		printk(KERN_ERR "JBD2: Error %d detected when updating "
- 		       "journal superblock for %s.\n", ret,
- 		       journal->j_devname);
-+		jbd2_journal_abort(journal, ret);
- 	}
-+
-+	return ret;
- }
- 
- /**
-@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
-  * Update a journal's superblock information about log tail and write it to
-  * disk, waiting for the IO to complete.
-  */
--void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
-+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- 				     unsigned long tail_block, int write_op)
- {
- 	journal_superblock_t *sb = journal->j_superblock;
-+	int ret;
- 
- 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- 	jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
-@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- 	sb->s_sequence = cpu_to_be32(tail_tid);
- 	sb->s_start    = cpu_to_be32(tail_block);
- 
--	jbd2_write_superblock(journal, write_op);
-+	ret = jbd2_write_superblock(journal, write_op);
-+	if (ret)
-+		goto out;
- 
- 	/* Log is no longer empty */
- 	write_lock(&journal->j_state_lock);
- 	WARN_ON(!sb->s_sequence);
- 	journal->j_flags &= ~JBD2_FLUSHED;
- 	write_unlock(&journal->j_state_lock);
-+
-+out:
-+	return ret;
- }
- 
- /**
-@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal)
- 		return -EIO;
- 
- 	mutex_lock(&journal->j_checkpoint_mutex);
--	jbd2_cleanup_journal_tail(journal);
-+	if (!err) {
-+		err = jbd2_cleanup_journal_tail(journal);
-+		if (err < 0) {
-+			mutex_unlock(&journal->j_checkpoint_mutex);
-+			goto out;
-+		}
-+		err = 0;
-+	}
- 
- 	/* Finally, mark the journal as really needing no recovery.
- 	 * This sets s_start==0 in the underlying superblock, which is
-@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal)
- 	J_ASSERT(journal->j_head == journal->j_tail);
- 	J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
- 	write_unlock(&journal->j_state_lock);
--	return 0;
-+out:
-+	return err;
- }
- 
- /**
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index fa6d721..4495cad 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
- 	if (args->npages != 0)
- 		xdr_write_pages(xdr, args->pages, 0, args->len);
- 	else
--		xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
-+		xdr_reserve_space(xdr, args->len);
- 
- 	error = nfsacl_encode(xdr->buf, base, args->inode,
- 			    (args->mask & NFS_ACL) ?
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index b4f177f..c402b67 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1482,6 +1482,8 @@ restart:
- 					spin_unlock(&state->state_lock);
- 				}
- 				nfs4_put_open_state(state);
-+				clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
-+					&state->flags);
- 				spin_lock(&sp->so_lock);
- 				goto restart;
- 			}
-diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
-index 14e58f2..98d4948 100644
---- a/fs/xfs/xfs_symlink.c
-+++ b/fs/xfs/xfs_symlink.c
-@@ -102,7 +102,7 @@ xfs_readlink_bmap(
- 			cur_chunk += sizeof(struct xfs_dsymlink_hdr);
- 		}
- 
--		memcpy(link + offset, bp->b_addr, byte_cnt);
-+		memcpy(link + offset, cur_chunk, byte_cnt);
- 
- 		pathlen -= byte_cnt;
- 		offset += byte_cnt;
-diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
-index 8fc12f8..69afb57 100644
---- a/include/acpi/actypes.h
-+++ b/include/acpi/actypes.h
-@@ -561,6 +561,7 @@ typedef u64 acpi_integer;
- #define ACPI_NO_ACPI_ENABLE             0x10
- #define ACPI_NO_DEVICE_INIT             0x20
- #define ACPI_NO_OBJECT_INIT             0x40
-+#define ACPI_NO_FACS_INIT               0x80
- 
- /*
-  * Initialization state
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index cd80aa8..77af621 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
- #define ACPI_OST_SC_INSERT_NOT_SUPPORTED	0x82
- 
- extern void acpi_early_init(void);
-+extern void acpi_subsystem_init(void);
- 
- extern int acpi_nvs_register(__u64 start, __u64 size);
- 
-@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev)
- }
- 
- static inline void acpi_early_init(void) { }
-+static inline void acpi_subsystem_init(void) { }
- 
- static inline int early_acpi_boot_init(void)
- {
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 0dae71e..e1fb0f6 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
- int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
- int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- 			      unsigned long *block);
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- 
- /* Commit management */
-@@ -1157,7 +1157,7 @@ extern int	   jbd2_journal_recover    (journal_t *journal);
- extern int	   jbd2_journal_wipe       (journal_t *, int);
- extern int	   jbd2_journal_skip_recovery	(journal_t *);
- extern void	   jbd2_journal_update_sb_errno(journal_t *);
--extern void	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
-+extern int	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
- 				unsigned long, int);
- extern void	   __jbd2_journal_abort_hard	(journal_t *);
- extern void	   jbd2_journal_abort      (journal_t *, int);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index b84e786..189c9ff 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -428,6 +428,7 @@ enum {
- 	ATA_HORKAGE_NO_NCQ_TRIM	= (1 << 19),	/* don't use queued TRIM */
- 	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
- 	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
-+	ATA_HORKAGE_NOTRIM = (1 << 24),		/* don't use TRIM */
- 
- 	 /* DMA mask for user DMA control: User visible values; DO NOT
- 	    renumber */
-diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
-index 53988cb..3a36a2c 100644
---- a/include/linux/nfs_xdr.h
-+++ b/include/linux/nfs_xdr.h
-@@ -1155,7 +1155,7 @@ struct nfs41_state_protection {
- 	struct nfs4_op_map allow;
- };
- 
--#define NFS4_EXCHANGE_ID_LEN	(48)
-+#define NFS4_EXCHANGE_ID_LEN	(127)
- struct nfs41_exchange_id_args {
- 	struct nfs_client		*client;
- 	nfs4_verifier			*verifier;
-diff --git a/include/linux/of.h b/include/linux/of.h
-index 3f8144d..9f2698d 100644
---- a/include/linux/of.h
-+++ b/include/linux/of.h
-@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop,
- #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
- extern int of_node_to_nid(struct device_node *np);
- #else
--static inline int of_node_to_nid(struct device_node *device) { return 0; }
-+static inline int of_node_to_nid(struct device_node *device)
-+{
-+	return NUMA_NO_NODE;
-+}
- #endif
- 
- static inline struct device_node *of_find_matching_node(
-diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h
-index 0c65e4b..ef29266 100644
---- a/include/uapi/linux/usbdevice_fs.h
-+++ b/include/uapi/linux/usbdevice_fs.h
-@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo {
- 	char port [127];	/* e.g. port 3 connects to device 27 */
- };
- 
--/* Device capability flags */
-+/* System and bus capability flags */
- #define USBDEVFS_CAP_ZERO_PACKET		0x01
- #define USBDEVFS_CAP_BULK_CONTINUATION		0x02
- #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM		0x04
- #define USBDEVFS_CAP_BULK_SCATTER_GATHER	0x08
-+#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT	0x10
- 
- /* USBDEVFS_DISCONNECT_CLAIM flags & struct */
- 
-diff --git a/init/main.c b/init/main.c
-index 58c132d..008edce 100644
---- a/init/main.c
-+++ b/init/main.c
-@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void)
- 
- 	check_bugs();
- 
-+	acpi_subsystem_init();
- 	sfi_init_late();
- 
- 	if (efi_enabled(EFI_RUNTIME_SERVICES)) {
-diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
-index 1ef0606..0296d6f 100644
---- a/kernel/irq/devres.c
-+++ b/kernel/irq/devres.c
-@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- 		return -ENOMEM;
- 
- 	rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
--	if (rc) {
-+	if (rc < 0) {
- 		devres_free(dr);
- 		return rc;
- 	}
-@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- 	dr->dev_id = dev_id;
- 	devres_add(dev, dr);
- 
--	return 0;
-+	return rc;
- }
- EXPORT_SYMBOL(devm_request_any_context_irq);
- 
-diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 2fac9cc..9d18628 100644
---- a/kernel/power/Kconfig
-+++ b/kernel/power/Kconfig
-@@ -191,7 +191,7 @@ config DPM_WATCHDOG
- config DPM_WATCHDOG_TIMEOUT
- 	int "Watchdog timeout in seconds"
- 	range 1 120
--	default 12
-+	default 60
- 	depends on DPM_WATCHDOG
- 
- config PM_TRACE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index a755ad7..02e7fb4 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file)
- 	 * already done the capabilities checks at open time.
- 	 */
- 	if (from_file && type != SYSLOG_ACTION_OPEN)
--		return 0;
-+		goto ok;
- 
- 	if (syslog_action_restricted(type)) {
- 		if (capable(CAP_SYSLOG))
--			return 0;
-+			goto ok;
- 		/*
- 		 * For historical reasons, accept CAP_SYS_ADMIN too, with
- 		 * a warning.
-@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file)
- 				     "CAP_SYS_ADMIN but no CAP_SYSLOG "
- 				     "(deprecated).\n",
- 				 current->comm, task_pid_nr(current));
--			return 0;
-+			goto ok;
- 		}
- 		return -EPERM;
- 	}
-+ok:
- 	return security_syslog(type);
- }
- 
-@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
- 	if (error)
- 		goto out;
- 
--	error = security_syslog(type);
--	if (error)
--		return error;
--
- 	switch (type) {
- 	case SYSLOG_ACTION_CLOSE:	/* Close log */
- 		break;
-diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
-index 1254f31..ae359f0 100644
---- a/kernel/rcu/tiny.c
-+++ b/kernel/rcu/tiny.c
-@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
- 
- 	/* Move the ready-to-invoke callbacks to a local list. */
- 	local_irq_save(flags);
-+	if (rcp->donetail == &rcp->rcucblist) {
-+		/* No callbacks ready, so just leave. */
-+		local_irq_restore(flags);
-+		return;
-+	}
- 	RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
- 	list = rcp->rcucblist;
- 	rcp->rcucblist = *rcp->donetail;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index c8bd809..c1be95c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -422,6 +422,7 @@ enum {
- 
- 	TRACE_CONTROL_BIT,
- 
-+	TRACE_BRANCH_BIT,
- /*
-  * Abuse of the trace_recursion.
-  * As we need a way to maintain state if we are tracing the function
-diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
-index 697fb9b..60850b4 100644
---- a/kernel/trace/trace_branch.c
-+++ b/kernel/trace/trace_branch.c
-@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 	struct trace_branch *entry;
- 	struct ring_buffer *buffer;
- 	unsigned long flags;
--	int cpu, pc;
-+	int pc;
- 	const char *p;
- 
-+	if (current->trace_recursion & TRACE_BRANCH_BIT)
-+		return;
-+
- 	/*
- 	 * I would love to save just the ftrace_likely_data pointer, but
- 	 * this code can also be used by modules. Ugly things can happen
-@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 	if (unlikely(!tr))
- 		return;
- 
--	local_irq_save(flags);
--	cpu = raw_smp_processor_id();
--	data = per_cpu_ptr(tr->trace_buffer.data, cpu);
--	if (atomic_inc_return(&data->disabled) != 1)
-+	raw_local_irq_save(flags);
-+	current->trace_recursion |= TRACE_BRANCH_BIT;
-+	data = this_cpu_ptr(tr->trace_buffer.data);
-+	if (atomic_read(&data->disabled))
- 		goto out;
- 
- 	pc = preempt_count();
-@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 		__buffer_unlock_commit(buffer, event);
- 
-  out:
--	atomic_dec(&data->disabled);
--	local_irq_restore(flags);
-+	current->trace_recursion &= ~TRACE_BRANCH_BIT;
-+	raw_local_irq_restore(flags);
- }
- 
- static inline
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index cb347e8..7b244d0 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps,
- 
- static char infix_next(struct filter_parse_state *ps)
- {
-+	if (!ps->infix.cnt)
-+		return 0;
-+
- 	ps->infix.cnt--;
- 
- 	return ps->infix.string[ps->infix.tail++];
-@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps)
- 
- static void infix_advance(struct filter_parse_state *ps)
- {
-+	if (!ps->infix.cnt)
-+		return;
-+
- 	ps->infix.cnt--;
- 	ps->infix.tail++;
- }
-@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps)
- 			continue;
- 		}
- 		n_normal_preds++;
--		WARN_ON_ONCE(cnt < 0);
-+		/* all ops should have operands */
-+		if (cnt < 0)
-+			break;
- 	}
- 
- 	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index e5c4ebe..c0634aa 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 	unsigned a, b;
- 	int c, old_c, totaldigits;
- 	const char __user __force *ubuf = (const char __user __force *)buf;
--	int exp_digit, in_range;
-+	int at_start, in_range;
- 
- 	totaldigits = c = 0;
- 	bitmap_zero(maskp, nmaskbits);
- 	do {
--		exp_digit = 1;
-+		at_start = 1;
- 		in_range = 0;
- 		a = b = 0;
- 
-@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 				break;
- 
- 			if (c == '-') {
--				if (exp_digit || in_range)
-+				if (at_start || in_range)
- 					return -EINVAL;
- 				b = 0;
- 				in_range = 1;
--				exp_digit = 1;
- 				continue;
- 			}
- 
-@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 			b = b * 10 + (c - '0');
- 			if (!in_range)
- 				a = b;
--			exp_digit = 0;
-+			at_start = 0;
- 			totaldigits++;
- 		}
- 		if (!(a <= b))
- 			return -EINVAL;
- 		if (b >= nmaskbits)
- 			return -ERANGE;
--		while (a <= b) {
--			set_bit(a, maskp);
--			a++;
-+		if (!at_start) {
-+			while (a <= b) {
-+				set_bit(a, maskp);
-+				a++;
-+			}
- 		}
- 	} while (buflen && c == ',');
- 	return 0;
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 9186550..08046f3 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
- 	if (err < 0) {
- 		if (err == -EIO)
- 			c->status = Disconnected;
--		goto reterr;
-+		if (err != -ERESTARTSYS)
-+			goto reterr;
- 	}
- 	if (req->status == REQ_STATUS_ERROR) {
- 		p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
-diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
-index aade4a5..bde94d8 100644
---- a/net/ceph/osdmap.c
-+++ b/net/ceph/osdmap.c
-@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
- {
- 	int j;
- 	dout("crush_decode_tree_bucket %p to %p\n", *p, end);
--	ceph_decode_32_safe(p, end, b->num_nodes, bad);
-+	ceph_decode_8_safe(p, end, b->num_nodes, bad);
- 	b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
- 	if (b->node_weights == NULL)
- 		return -ENOMEM;
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index c7a7a86..9e58c99 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
- {
- 	struct ieee80211_local *local =
- 		container_of(work, struct ieee80211_local, restart_work);
-+	struct ieee80211_sub_if_data *sdata;
- 
- 	/* wait for scan work complete */
- 	flush_workqueue(local->workqueue);
-@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work)
- 	     "%s called with hardware scan in progress\n", __func__);
- 
- 	rtnl_lock();
-+	list_for_each_entry(sdata, &local->interfaces, list)
-+		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
- 	ieee80211_scan_cancel(local);
- 	ieee80211_reconfig(local);
- 	rtnl_unlock();
-diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
-index e860d4f..ab21968 100644
---- a/net/sunrpc/backchannel_rqst.c
-+++ b/net/sunrpc/backchannel_rqst.c
-@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
- 
- 	dprintk("RPC:        free allocations for req= %p\n", req);
- 	WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
--	xbufp = &req->rq_private_buf;
-+	xbufp = &req->rq_rcv_buf;
- 	free_page((unsigned long)xbufp->head[0].iov_base);
- 	xbufp = &req->rq_snd_buf;
- 	free_page((unsigned long)xbufp->head[0].iov_base);
-diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
-index 7e71e06..048550a 100644
---- a/security/integrity/evm/evm_main.c
-+++ b/security/integrity/evm/evm_main.c
-@@ -20,6 +20,7 @@
- #include <linux/xattr.h>
- #include <linux/integrity.h>
- #include <linux/evm.h>
-+#include <linux/magic.h>
- #include <crypto/hash.h>
- #include "evm.h"
- 
-@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
- 		iint = integrity_iint_find(dentry->d_inode);
- 		if (iint && (iint->flags & IMA_NEW_FILE))
- 			return 0;
-+
-+		/* exception for pseudo filesystems */
-+		if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
-+		    || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
-+			return 0;
-+
-+		integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
-+				    dentry->d_inode, dentry->d_name.name,
-+				    "update_metadata",
-+				    integrity_status_msg[evm_status],
-+				    -EPERM, 0);
- 	}
- out:
- 	if (evm_status != INTEGRITY_PASS)
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index f79fa8b..5cb7de9 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- 		       const char *op, const char *cause);
- int ima_init_crypto(void);
- void ima_putc(struct seq_file *m, void *data, int datalen);
--void ima_print_digest(struct seq_file *m, u8 *digest, int size);
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
- struct ima_template_desc *ima_template_desc_current(void);
- int ima_init_template(void);
- 
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 468a3ba..35f3c90 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = {
- 	.release = seq_release,
- };
- 
--void ima_print_digest(struct seq_file *m, u8 *digest, int size)
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
- {
--	int i;
-+	u32 i;
- 
- 	for (i = 0; i < size; i++)
- 		seq_printf(m, "%02x", *(digest + i));
-diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
-index e8592e7..dcf77b7 100644
---- a/security/integrity/ima/ima_template_lib.c
-+++ b/security/integrity/ima/ima_template_lib.c
-@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
- 					 enum data_formats datafmt,
- 					 struct ima_field_data *field_data)
- {
--	u8 *buf_ptr = field_data->data, buflen = field_data->len;
-+	u8 *buf_ptr = field_data->data;
-+	u32 buflen = field_data->len;
- 
- 	switch (datafmt) {
- 	case DATA_FMT_DIGEST_WITH_ALGO:
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index 2fb2576..04d0d7c 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring,
- 	if (index_key->type == &key_type_keyring)
- 		up_write(&keyring_serialise_link_sem);
- 
--	if (edit && !edit->dead_leaf) {
--		key_payload_reserve(keyring,
--				    keyring->datalen - KEYQUOTA_LINK_BYTES);
-+	if (edit) {
-+		if (!edit->dead_leaf) {
-+			key_payload_reserve(keyring,
-+				keyring->datalen - KEYQUOTA_LINK_BYTES);
-+		}
- 		assoc_array_cancel_edit(edit);
- 	}
- 	up_write(&keyring->sem);
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index ba17522..2f503c0 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -3955,6 +3955,7 @@ enum {
- 	ALC269_FIXUP_LIFEBOOK,
- 	ALC269_FIXUP_LIFEBOOK_EXTMIC,
- 	ALC269_FIXUP_LIFEBOOK_HP_PIN,
-+	ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
- 	ALC269_FIXUP_AMIC,
- 	ALC269_FIXUP_DMIC,
- 	ALC269VB_FIXUP_AMIC,
-@@ -3973,6 +3974,7 @@ enum {
- 	ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
- 	ALC269_FIXUP_HEADSET_MODE,
- 	ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
-+	ALC269_FIXUP_ASPIRE_HEADSET_MIC,
- 	ALC269_FIXUP_ASUS_X101_FUNC,
- 	ALC269_FIXUP_ASUS_X101_VERB,
- 	ALC269_FIXUP_ASUS_X101,
-@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = {
- 			{ }
- 		},
- 	},
-+	[ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = {
-+		.type = HDA_FIXUP_FUNC,
-+		.v.func = alc269_fixup_pincfg_no_hp_to_lineout,
-+	},
- 	[ALC269_FIXUP_AMIC] = {
- 		.type = HDA_FIXUP_PINS,
- 		.v.pins = (const struct hda_pintbl[]) {
-@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = {
- 		.type = HDA_FIXUP_FUNC,
- 		.v.func = alc_fixup_headset_mode_no_hp_mic,
- 	},
-+	[ALC269_FIXUP_ASPIRE_HEADSET_MIC] = {
-+		.type = HDA_FIXUP_PINS,
-+		.v.pins = (const struct hda_pintbl[]) {
-+			{ 0x19, 0x01a1913c }, /* headset mic w/o jack detect */
-+			{ }
-+		},
-+		.chained = true,
-+		.chain_id = ALC269_FIXUP_HEADSET_MODE,
-+	},
- 	[ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
- 		.type = HDA_FIXUP_PINS,
- 		.v.pins = (const struct hda_pintbl[]) {
-@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
-+	SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
-+	SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
- 	SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
- 	SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
- 	SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
-@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
- 	SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
- 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
-+	SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
- 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- 	SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index ce9c8e1..fbee45c 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -41,7 +41,7 @@ struct wm5102_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- static const struct wm_adsp_region wm5102_dsp1_regions[] = {
-diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
-index 2c3c962..0fce853 100644
---- a/sound/soc/codecs/wm5110.c
-+++ b/sound/soc/codecs/wm5110.c
-@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- #define WM5110_NG_SRC(name, base) \
-diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
-index 2f167a8..62bacb8 100644
---- a/sound/soc/codecs/wm8737.c
-+++ b/sound/soc/codecs/wm8737.c
-@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
- 
- 			/* Fast VMID ramp at 2*2.5k */
- 			snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
--					    WM8737_VMIDSEL_MASK, 0x4);
-+					    WM8737_VMIDSEL_MASK,
-+					    2 << WM8737_VMIDSEL_SHIFT);
- 
- 			/* Bring VMID up */
- 			snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
-@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
- 
- 		/* VMID at 2*300k */
- 		snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
--				    WM8737_VMIDSEL_MASK, 2);
-+				    WM8737_VMIDSEL_MASK,
-+				    1 << WM8737_VMIDSEL_SHIFT);
- 
- 		break;
- 
-diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
-index db94931..0bb4a64 100644
---- a/sound/soc/codecs/wm8903.h
-+++ b/sound/soc/codecs/wm8903.h
-@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
- #define WM8903_VMID_BUF_ENA_WIDTH                    1  /* VMID_BUF_ENA */
- 
- #define WM8903_VMID_RES_50K                          2
--#define WM8903_VMID_RES_250K                         3
-+#define WM8903_VMID_RES_250K                         4
- #define WM8903_VMID_RES_5K                           6
- 
- /*
-diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
-index 1c1fc61..475fc24 100644
---- a/sound/soc/codecs/wm8955.c
-+++ b/sound/soc/codecs/wm8955.c
-@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
- 		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
- 				    WM8955_K_17_9_MASK,
- 				    (pll.k >> 9) & WM8955_K_17_9_MASK);
--		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
-+		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
- 				    WM8955_K_8_0_MASK,
- 				    pll.k & WM8955_K_8_0_MASK);
- 		if (pll.k)
-diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
-index edfd4ed..e04dbaa 100644
---- a/sound/soc/codecs/wm8960.c
-+++ b/sound/soc/codecs/wm8960.c
-@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
- SOC_ENUM("ADC Polarity", wm8960_enum[0]),
- SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
- 
--SOC_ENUM("DAC Polarity", wm8960_enum[2]),
-+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
- SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
- 		    wm8960_get_deemph, wm8960_put_deemph),
- 
-diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
-index 555115e..1461ae61 100644
---- a/sound/soc/codecs/wm8997.c
-+++ b/sound/soc/codecs/wm8997.c
-@@ -40,7 +40,7 @@ struct wm8997_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- static const struct reg_default wm8997_sysclk_reva_patch[] = {
-diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
-index 3a3d17c..6644525 100644
---- a/sound/soc/fsl/imx-wm8962.c
-+++ b/sound/soc/fsl/imx-wm8962.c
-@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
- 		dev_err(&pdev->dev, "audmux internal port setup failed\n");
- 		return ret;
- 	}
--	imx_audmux_v2_configure_port(ext_port,
-+	ret = imx_audmux_v2_configure_port(ext_port,
- 			IMX_AUDMUX_V2_PTCR_SYN,
- 			IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
- 	if (ret) {
diff --git a/3.14.49/0000_README b/3.14.50/0000_README
index eb9a47e..5416cb6 100644
--- a/3.14.49/0000_README
+++ b/3.14.50/0000_README
@@ -2,15 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1047_linux-3.14.48.patch
+Patch:	1049_linux-3.14.50.patch
 From:	http://www.kernel.org
-Desc:	Linux 3.14.48
+Desc:	Linux 3.14.50
 
-Patch:	1048_linux-3.14.49.patch
-From:	http://www.kernel.org
-Desc:	Linux 3.14.49
-
-Patch:	4420_grsecurity-3.1-3.14.49-201508032312.patch
+Patch:	4420_grsecurity-3.1-3.14.50-201508102128.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.14.50/1049_linux-3.14.50.patch b/3.14.50/1049_linux-3.14.50.patch
new file mode 100644
index 0000000..bd7d238
--- /dev/null
+++ b/3.14.50/1049_linux-3.14.50.patch
@@ -0,0 +1,700 @@
+diff --git a/Makefile b/Makefile
+index fee8460..d71c40a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 49
++SUBLEVEL = 50
+ EXTRAVERSION =
+ NAME = Remembering Coco
+ 
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2..2a58af7 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ 	long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+ 
+-#define instruction_pointer(regs)	((regs)->ret)
++#define instruction_pointer(regs)	(unsigned long)((regs)->ret)
+ #define profile_pc(regs)		instruction_pointer(regs)
+ 
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97..52c179b 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_enable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (IS_ERR_OR_NULL(clk))
++		return;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_disable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ 	unsigned long flags;
+ 	unsigned long rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	rate = clk->get_rate(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ 	unsigned long flags, actual_rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ 	unsigned long flags;
+ 	long ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ 	unsigned long flags;
+ 	int ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_parent)
+ 		return -ENOSYS;
+ 
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+ 
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+-	return clk->parent;
++	return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+ 
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 29bd7be..1ecd47b 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early)
+ 	jno	.Lesa2
+ 	ahi	%r15,-80
+ 	stmh	%r6,%r15,96(%r15)		# store upper register halves
++	basr	%r13,0
++	lmh	%r0,%r15,.Lzeroes-.(%r13)	# clear upper register halves
+ .Lesa2:
+ #endif
+ 	lr	%r10,%r2			# save string pointer
+@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early)
+ #endif
+ 	lm	%r6,%r15,120(%r15)		# restore registers
+ 	br	%r14
++.Lzeroes:
++	.fill	64,4,0
+ 
+ .LwritedataS4:
+ 	.long	0x00760005			# SCLP command for write data
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index 74c9172..bdb3ecf 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1146,7 +1146,7 @@ static void __init load_hv_initrd(void)
+ 
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+-	free_bootmem(__pa(begin), end - begin);
++	free_bootmem_late(__pa(begin), end - begin);
+ }
+ 
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 78cbb2d..ec5a3c7 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ 		unsigned int e820_type = 0;
+ 		unsigned long m = efi->efi_memmap;
+ 
++#ifdef CONFIG_X86_64
++		m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ 		switch (d->type) {
+ 		case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index c5b56ed..a814c80 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -54,7 +54,7 @@ ENTRY(efi_pe_entry)
+ 	call	reloc
+ reloc:
+ 	popl	%ecx
+-	subl	reloc, %ecx
++	subl	$reloc, %ecx
+ 	movl	%ecx, BP_code32_start(%eax)
+ 
+ 	sub	$0x4, %esp
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index d8f80e7..a717585 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -703,8 +703,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		return -EINVAL;
+ 
+ 	disk = get_gendisk(MKDEV(major, minor), &part);
+-	if (!disk || part)
++	if (!disk)
+ 		return -EINVAL;
++	if (part) {
++		put_disk(disk);
++		return -EINVAL;
++	}
+ 
+ 	rcu_read_lock();
+ 	spin_lock_irq(disk->queue->queue_lock);
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084..85aa761 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 				       ATA_LFLAG_NO_SRST |
+ 				       ATA_LFLAG_ASSUME_ATA;
+ 		}
++	} else if (vendor == 0x11ab && devid == 0x4140) {
++		/* Marvell 4140 quirks */
++		ata_for_each_link(link, ap, EDGE) {
++			/* port 4 is for SEMB device and it doesn't like SRST */
++			if (link->pmp == 4)
++				link->flags |= ATA_LFLAG_DISABLED;
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index a096633..c6f7e91 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ 		goto err_out;
+ 	}
+ 
++	/* TSC-25 data sheet specifies a delay after the RESET command */
++	msleep(150);
++
+ 	/* set coordinate output rate */
+ 	buf[0] = buf[1] = 0xFF;
+ 	ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index b96ee9d..9be97e0 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ 		spin_lock_irqsave(&conf->device_lock, flags);
+ 		if (r1_bio->mddev->degraded == conf->raid_disks ||
+ 		    (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+-		     !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++		     test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ 			uptodate = 1;
+ 		spin_unlock_irqrestore(&conf->device_lock, flags);
+ 	}
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index a7d9f95..7fd86be 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -47,6 +47,6 @@
+ #define ESDHC_DMA_SYSCTL	0x40c
+ #define ESDHC_DMA_SNOOP		0x00000040
+ 
+-#define ESDHC_HOST_CONTROL_RES	0x05
++#define ESDHC_HOST_CONTROL_RES	0x01
+ 
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 561c6b4..b807666 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -257,6 +257,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ 			goto err_of_parse;
+ 		sdhci_get_of_property(pdev);
+ 		pdata = pxav3_get_mmc_pdata(dev);
++		pdev->dev.platform_data = pdata;
+ 	} else if (pdata) {
+ 		/* on-chip device */
+ 		if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index a1d6986..f310982 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ 	spin_lock(&st_use_lock);
+ 	STp->in_use = 0;
+ 	spin_unlock(&st_use_lock);
+-	scsi_tape_put(STp);
+ 	if (resumed)
+ 		scsi_autopm_put_device(STp->device);
++	scsi_tape_put(STp);
+ 	return retval;
+ 
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index c8d7b30..55ec9b4 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4476,7 +4476,18 @@ static void iscsit_logout_post_handler_closesession(
+ 	struct iscsi_conn *conn)
+ {
+ 	struct iscsi_session *sess = conn->sess;
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++	/*
++	 * Traditional iscsi/tcp will invoke this logic from TX thread
++	 * context during session logout, so clear tx_thread_active and
++	 * sleep if iscsit_close_connection() has not already occured.
++	 *
++	 * Since iser-target invokes this logic from it's own workqueue,
++	 * always sleep waiting for RX/TX thread shutdown to complete
++	 * within iscsit_close_connection().
++	 */
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4490,7 +4501,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ 	struct iscsi_conn *conn)
+ {
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4709,6 +4723,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 	struct iscsi_session *sess;
+ 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ 	struct se_session *se_sess, *se_sess_tmp;
++	LIST_HEAD(free_list);
+ 	int session_count = 0;
+ 
+ 	spin_lock_bh(&se_tpg->session_lock);
+@@ -4730,14 +4745,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 		}
+ 		atomic_set(&sess->session_reinstatement, 1);
+ 		spin_unlock(&sess->conn_lock);
+-		spin_unlock_bh(&se_tpg->session_lock);
+ 
+-		iscsit_free_session(sess);
+-		spin_lock_bh(&se_tpg->session_lock);
++		list_move_tail(&se_sess->sess_list, &free_list);
++	}
++	spin_unlock_bh(&se_tpg->session_lock);
+ 
++	list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++		sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
++
++		iscsit_free_session(sess);
+ 		session_count++;
+ 	}
+-	spin_unlock_bh(&se_tpg->session_lock);
+ 
+ 	pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ 			" Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b9e16abb..5c95765 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -480,10 +480,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ 	u32 pls = status_reg & PORT_PLS_MASK;
+ 
+ 	/* resume state is a xHCI internal state.
+-	 * Do not report it to usb core.
++	 * Do not report it to usb core, instead, pretend to be U3,
++	 * thus usb core knows it's not ready for transfer
+ 	 */
+-	if (pls == XDEV_RESUME)
++	if (pls == XDEV_RESUME) {
++		*status |= USB_SS_PORT_LS_U3;
+ 		return;
++	}
+ 
+ 	/* When the CAS bit is set then warm reset
+ 	 * should be performed on port
+@@ -584,7 +587,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ 		status |= USB_PORT_STAT_C_RESET << 16;
+ 	/* USB3.0 only */
+ 	if (hcd->speed == HCD_USB3) {
+-		if ((raw_port_status & PORT_PLC))
++		/* Port link change with port in resume state should not be
++		 * reported to usbcore, as this is an internal state to be
++		 * handled by xhci driver. Reporting PLC to usbcore may
++		 * cause usbcore clearing PLC first and port change event
++		 * irq won't be generated.
++		 */
++		if ((raw_port_status & PORT_PLC) &&
++			(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ 			status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ 		if ((raw_port_status & PORT_WRC))
+ 			status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1114,10 +1124,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
+ 	if (hcd->self.root_hub->do_remote_wakeup) {
+-		if (bus_state->resuming_ports) {
++		if (bus_state->resuming_ports ||	/* USB2 */
++		    bus_state->port_remote_wakeup) {	/* USB3 */
+ 			spin_unlock_irqrestore(&xhci->lock, flags);
+-			xhci_dbg(xhci, "suspend failed because "
+-						"a port is resuming\n");
++			xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ 			return -EBUSY;
+ 		}
+ 	}
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f615712..bcc43a2 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1740,6 +1740,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 		usb_hcd_resume_root_hub(hcd);
+ 	}
+ 
++	if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++		bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ 	if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ 		xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 16f4f8d..fc61e663b 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3424,6 +3424,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ 			return -EINVAL;
+ 	}
+ 
++	if (virt_dev->tt_info)
++		old_active_eps = virt_dev->tt_info->active_eps;
++
+ 	if (virt_dev->udev != udev) {
+ 		/* If the virt_dev and the udev does not match, this virt_dev
+ 		 * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 70facb7..c167485 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0		(0x0 << 5)
+ #define XDEV_U2		(0x2 << 5)
+ #define XDEV_U3		(0x3 << 5)
++#define XDEV_INACTIVE	(0x6 << 5)
+ #define XDEV_RESUME	(0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER	(1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 821e1e2..da380a9 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2032,6 +2032,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_READ_DISC_INFO ),
+ 
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++		"ZTE,Incorporated",
++		"ZTE WCDMA Technologies MSM",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+  * This encrypted pen drive returns bogus data for the initial READ(10).
+  */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 78987e4..85095d7 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -876,6 +876,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ 		}
+ 		if (eventfp != d->log_file) {
+ 			filep = d->log_file;
++			d->log_file = eventfp;
+ 			ctx = d->log_ctx;
+ 			d->log_ctx = eventfp ?
+ 				eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index aa24f7d..3d2f27b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -587,6 +587,9 @@ repeat:
+ 	if (unlikely(d_unhashed(dentry)))
+ 		goto kill_it;
+ 
++	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++		goto kill_it;
++
+ 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ 		if (dentry->d_op->d_delete(dentry))
+ 			goto kill_it;
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107..7a5237a 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ 		    !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ 			/*
+-			 * If the interrupt has a parent irq and runs
+-			 * in the thread context of the parent irq,
+-			 * retrigger the parent.
++			 * If the interrupt is running in the thread
++			 * context of the parent irq we need to be
++			 * careful, because we cannot trigger it
++			 * directly.
+ 			 */
+-			if (desc->parent_irq &&
+-			    irq_settings_is_nested_thread(desc))
++			if (irq_settings_is_nested_thread(desc)) {
++				/*
++				 * If the parent_irq is valid, we
++				 * retrigger the parent, otherwise we
++				 * do nothing.
++				 */
++				if (!desc->parent_irq)
++					return;
+ 				irq = desc->parent_irq;
++			}
+ 			/* Set it pending and activate the softirq: */
+ 			set_bit(irq, irqs_resend);
+ 			tasklet_schedule(&resend_tasklet);
+diff --git a/mm/memory.c b/mm/memory.c
+index 749e1c6..e9ddc7a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3234,6 +3234,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 
+ 	pte_unmap(page_table);
+ 
++	/* File mapping without ->vm_ops ? */
++	if (vma->vm_flags & VM_SHARED)
++		return VM_FAULT_SIGBUS;
++
+ 	/* Check if we need to add a guard page to the stack */
+ 	if (check_stack_guard_page(vma, address) < 0)
+ 		return VM_FAULT_SIGSEGV;
+@@ -3502,6 +3506,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+ 
+ 	pte_unmap(page_table);
++	/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
++	if (!vma->vm_ops->fault)
++		return VM_FAULT_SIGBUS;
+ 	return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
+ }
+ 
+@@ -3650,11 +3657,9 @@ static int handle_pte_fault(struct mm_struct *mm,
+ 	entry = ACCESS_ONCE(*pte);
+ 	if (!pte_present(entry)) {
+ 		if (pte_none(entry)) {
+-			if (vma->vm_ops) {
+-				if (likely(vma->vm_ops->fault))
+-					return do_linear_fault(mm, vma, address,
++			if (vma->vm_ops)
++				return do_linear_fault(mm, vma, address,
+ 						pte, pmd, flags, entry);
+-			}
+ 			return do_anonymous_page(mm, vma, address,
+ 						 pte, pmd, flags);
+ 		}
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 653ce5d..5d8bc1f 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -712,6 +712,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+ 
+ 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ 	sdata->vif.debugfs_dir = NULL;
++	sdata->debugfs.subdir_stations = NULL;
+ }
+ 
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index e8fdb17..a985158 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ 	}
+ 
+ 	ibmr = rds_ib_alloc_fmr(rds_ibdev);
+-	if (IS_ERR(ibmr))
++	if (IS_ERR(ibmr)) {
++		rds_ib_dev_put(rds_ibdev);
+ 		return ibmr;
++	}
+ 
+ 	ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ 	if (ret == 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2f503c0..907371d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2282,7 +2282,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+-	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+ 
+ 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ 	SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index b16be39..9a3e107 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ 	{ 0 }
+ };
+ 
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++	{ 3, NULL, .dB = &bose_companion5_dB },
++	{ 0 }	/* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++	{ 7, NULL, .dB = &dragonfly_1_2_dB },
++	{ 0 }	/* terminator */
++};
++
+ /*
+  * Control map entries
+  */
+@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.id = USB_ID(0x25c4, 0x0003),
+ 		.map = scms_usb3318_map,
+ 	},
++	{
++		/* Bose Companion 5 */
++		.id = USB_ID(0x05a7, 0x1020),
++		.map = bose_companion5_map,
++	},
++	{
++		/* Dragonfly DAC 1.2 */
++		.id = USB_ID(0x21b4, 0x0081),
++		.map = dragonfly_1_2_map,
++	},
+ 	{ 0 } /* terminator */
+ };
+ 
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 5293b5a..7c24088 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ 	}
+ },
+ 
++/* Steinberg devices */
++{
++	/* Steinberg MI2 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++{
++	/* Steinberg MI4 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++
+ /* TerraTec devices */
+ {
+ 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
diff --git a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
index 75ba2f6..1086c4e 100644
--- a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch
+++ b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
@@ -328,7 +328,7 @@ index 855d9b3..154c500 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index fee8460..5d81b33 100644
+index d71c40a..4d15036 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -10431,6 +10431,40 @@ index ad7e178..26cd4a7 100644
  	if (unlikely(ret))
  		ret = copy_to_user_fixup(to, from, size);
  	return ret;
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 11fdf0e..50d6f16 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+  * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+ 
+ #define VISEntryHalf					\
+-	rd		%fprs, %o5;			\
+-	andcc		%o5, FPRS_FEF, %g0;		\
+-	be,pt		%icc, 297f;			\
+-	 sethi		%hi(298f), %g7;			\
+-	sethi		%hi(VISenterhalf), %g1;		\
+-	jmpl		%g1 + %lo(VISenterhalf), %g0;	\
+-	 or		%g7, %lo(298f), %g7;		\
+-	clr		%o5;				\
+-297:	wr		%o5, FPRS_FEF, %fprs;		\
+-298:
++	VISEntry
++
++#define VISExitHalf					\
++	VISExit
+ 
+ #define VISEntryHalfFast(fail_label)			\
+ 	rd		%fprs, %o5;			\
+@@ -47,7 +41,7 @@
+ 	ba,a,pt		%xcc, fail_label;		\
+ 297:	wr		%o5, FPRS_FEF, %fprs;
+ 
+-#define VISExitHalf					\
++#define VISExitHalfFast					\
+ 	wr		%o5, 0, %fprs;
+ 
+ #ifndef __ASSEMBLY__
 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
 index d15cc17..d0ae796 100644
 --- a/arch/sparc/kernel/Makefile
@@ -11092,6 +11126,105 @@ index dbe119b..089c7c1 100644
  
  lib-$(CONFIG_SPARC32) += ashrdi3.o
  lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a..83aeeb1 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
+ 	add		%o0, 0x40, %o0
+ 	bne,pt		%icc, 1b
+ 	 LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++	VISExitHalfFast
++#else
+ 	VISExitHalf
+-
++#endif
+ 	brz,pn		%o2, .Lexit
+ 	 cmp		%o2, 19
+ 	ble,pn		%icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9..a063d84 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
+ 
+ 	 stx		%g3, [%g6 + TI_GSR]
+ 2:	add		%g6, %g1, %g3
+-	cmp		%o5, FPRS_DU
+-	be,pn		%icc, 6f
+-	 sll		%g1, 3, %g1
++	mov		FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++	sll		%g1, 3, %g1
+ 	stb		%o5, [%g3 + TI_FPSAVED]
+ 	rd		%gsr, %g2
+ 	add		%g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
+ 	.align		32
+ 80:	jmpl		%g7 + %g0, %g0
+ 	 nop
+-
+-6:	ldub		[%g3 + TI_FPSAVED], %o5
+-	or		%o5, FPRS_DU, %o5
+-	add		%g6, TI_FPREGS+0x80, %g2
+-	stb		%o5, [%g3 + TI_FPSAVED]
+-
+-	sll		%g1, 5, %g1
+-	add		%g6, TI_FPREGS+0xc0, %g3
+-	wr		%g0, FPRS_FEF, %fprs
+-	membar		#Sync
+-	stda		%f32, [%g2 + %g1] ASI_BLK_P
+-	stda		%f48, [%g3 + %g1] ASI_BLK_P
+-	membar		#Sync
+-	ba,pt		%xcc, 80f
+-	 nop
+-
+-	.align		32
+-80:	jmpl		%g7 + %g0, %g0
+-	 nop
+-
+-	.align		32
+-VISenterhalf:
+-	ldub		[%g6 + TI_FPDEPTH], %g1
+-	brnz,a,pn	%g1, 1f
+-	 cmp		%g1, 1
+-	stb		%g0, [%g6 + TI_FPSAVED]
+-	stx		%fsr, [%g6 + TI_XFSR]
+-	clr		%o5
+-	jmpl		%g7 + %g0, %g0
+-	 wr		%g0, FPRS_FEF, %fprs
+-
+-1:	bne,pn		%icc, 2f
+-	 srl		%g1, 1, %g1
+-	ba,pt		%xcc, vis1
+-	 sub		%g7, 8, %g7
+-2:	addcc		%g6, %g1, %g3
+-	sll		%g1, 3, %g1
+-	andn		%o5, FPRS_DU, %g2
+-	stb		%g2, [%g3 + TI_FPSAVED]
+-
+-	rd		%gsr, %g2
+-	add		%g6, %g1, %g3
+-	stx		%g2, [%g3 + TI_GSR]
+-	add		%g6, %g1, %g2
+-	stx		%fsr, [%g2 + TI_XFSR]
+-	sll		%g1, 5, %g1
+-3:	andcc		%o5, FPRS_DL, %g0
+-	be,pn		%icc, 4f
+-	 add		%g6, TI_FPREGS, %g2
+-
+-	add		%g6, TI_FPREGS+0x40, %g3
+-	membar		#Sync
+-	stda		%f0, [%g2 + %g1] ASI_BLK_P
+-	stda		%f16, [%g3 + %g1] ASI_BLK_P
+-	membar		#Sync
+-	ba,pt		%xcc, 4f
+-	 nop
+-
+-	.align		32
+-4:	and		%o5, FPRS_DU, %o5
+-	jmpl		%g7 + %g0, %g0
+-	 wr		%o5, FPRS_FEF, %fprs
 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
 index 85c233d..68500e0 100644
 --- a/arch/sparc/lib/atomic_64.S
@@ -11307,7 +11440,7 @@ index 85c233d..68500e0 100644
  	cmp	%g1, %g7
  	bne,pn	%xcc, BACKOFF_LABEL(2f, 1b)
 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 323335b..ed85ea2 100644
+index 323335b..e8ee09d 100644
 --- a/arch/sparc/lib/ksyms.c
 +++ b/arch/sparc/lib/ksyms.c
 @@ -100,12 +100,18 @@ EXPORT_SYMBOL(__clear_user);
@@ -11329,6 +11462,17 @@ index 323335b..ed85ea2 100644
  EXPORT_SYMBOL(atomic64_sub_ret);
  EXPORT_SYMBOL(atomic64_dec_if_positive);
  
+@@ -126,10 +132,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+ 
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ 		unsigned long *);
 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
 index 30c3ecc..736f015 100644
 --- a/arch/sparc/mm/Makefile
@@ -12816,21 +12960,6 @@ index 67e9f5c..2af15db 100644
  
  KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
  GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 78cbb2d..ec5a3c7 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
- 		unsigned int e820_type = 0;
- 		unsigned long m = efi->efi_memmap;
- 
-+#ifdef CONFIG_X86_64
-+		m |= (u64)efi->efi_memmap_hi << 32;
-+#endif
-+
- 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
- 		switch (d->type) {
- 		case EFI_RESERVED_TYPE:
 diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
 index a53440e..c3dbf1e 100644
 --- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -12874,7 +13003,7 @@ index a53440e..c3dbf1e 100644
  .previous
  
 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index c5b56ed..9f79ed3 100644
+index a814c80..5df45f6 100644
 --- a/arch/x86/boot/compressed/head_32.S
 +++ b/arch/x86/boot/compressed/head_32.S
 @@ -119,10 +119,10 @@ preferred_addr:
@@ -36926,10 +37055,10 @@ index af00795..2bb8105 100644
  #define XCHAL_ICACHE_SIZE		32768	/* I-cache size in bytes or 0 */
  #define XCHAL_DCACHE_SIZE		32768	/* D-cache size in bytes or 0 */
 diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index d8f80e7..5f41702 100644
+index a717585..11de03b 100644
 --- a/block/blk-cgroup.c
 +++ b/block/blk-cgroup.c
-@@ -809,7 +809,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
+@@ -813,7 +813,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
  static struct cgroup_subsys_state *
  blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
  {
@@ -36938,7 +37067,7 @@ index d8f80e7..5f41702 100644
  	struct blkcg *blkcg;
  
  	if (!parent_css) {
-@@ -823,7 +823,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
+@@ -827,7 +827,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
  
  	blkcg->cfq_weight = CFQ_WEIGHT_DEFAULT;
  	blkcg->cfq_leaf_weight = CFQ_WEIGHT_DEFAULT;
@@ -46093,7 +46222,7 @@ index 3e6d115..ffecdeb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index b96ee9d..1d38b21 100644
+index 9be97e0..71b21b0 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
 @@ -1937,7 +1937,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -49509,7 +49638,7 @@ index f9e96c4..6b1faeb 100644
  deferred:
  #endif
 diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 841b608..198a8b7 100644
+index 841b608..1f38243 100644
 --- a/drivers/net/virtio_net.c
 +++ b/drivers/net/virtio_net.c
 @@ -47,7 +47,7 @@ module_param(gso, bool, 0444);
@@ -49521,6 +49650,18 @@ index 841b608..198a8b7 100644
  
  #define VIRTNET_DRIVER_VERSION "1.0.0"
  
+@@ -1652,9 +1652,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* Do we support "hardware" checksums? */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ 		/* This opens up the world of extra features. */
+-		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 		if (csum)
+-			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 
+ 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
 index 0fa3b44..e913fc9 100644
 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -53028,21 +53169,6 @@ index 40d8592..8e89146 100644
  	int block_sectors = 0;
  	long error_sector;
  	struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
-diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
-index a1d6986..f310982 100644
---- a/drivers/scsi/st.c
-+++ b/drivers/scsi/st.c
-@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
- 	spin_lock(&st_use_lock);
- 	STp->in_use = 0;
- 	spin_unlock(&st_use_lock);
--	scsi_tape_put(STp);
- 	if (resumed)
- 		scsi_autopm_put_device(STp->device);
-+	scsi_tape_put(STp);
- 	return retval;
- 
- }
 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
 index f3e3ae8..f876b14 100644
 --- a/drivers/spi/spi.c
@@ -74381,7 +74507,7 @@ index a93f7e6..d58bcbe 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index aa24f7d..8f1bf8c 100644
+index 3d2f27b..8f1bf8c 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -250,7 +250,7 @@ static void __d_free(struct rcu_head *head)
@@ -74393,17 +74519,7 @@ index aa24f7d..8f1bf8c 100644
  	this_cpu_dec(nr_dentry);
  	if (dentry->d_op && dentry->d_op->d_release)
  		dentry->d_op->d_release(dentry);
-@@ -587,6 +587,9 @@ repeat:
- 	if (unlikely(d_unhashed(dentry)))
- 		goto kill_it;
- 
-+	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
-+		goto kill_it;
-+
- 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
- 		if (dentry->d_op->d_delete(dentry))
- 			goto kill_it;
-@@ -596,7 +599,7 @@ repeat:
+@@ -599,7 +599,7 @@ repeat:
  		dentry->d_flags |= DCACHE_REFERENCED;
  	dentry_lru_add(dentry);
  
@@ -74412,7 +74528,7 @@ index aa24f7d..8f1bf8c 100644
  	spin_unlock(&dentry->d_lock);
  	return;
  
-@@ -651,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
+@@ -654,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
  	 * We also need to leave mountpoints alone,
  	 * directory or not.
  	 */
@@ -74421,7 +74537,7 @@ index aa24f7d..8f1bf8c 100644
  		if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
  			spin_unlock(&dentry->d_lock);
  			return -EBUSY;
-@@ -667,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
+@@ -670,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
  /* This must be called with d_lock held */
  static inline void __dget_dlock(struct dentry *dentry)
  {
@@ -74430,7 +74546,7 @@ index aa24f7d..8f1bf8c 100644
  }
  
  static inline void __dget(struct dentry *dentry)
-@@ -708,8 +711,8 @@ repeat:
+@@ -711,8 +711,8 @@ repeat:
  		goto repeat;
  	}
  	rcu_read_unlock();
@@ -74441,7 +74557,7 @@ index aa24f7d..8f1bf8c 100644
  	spin_unlock(&ret->d_lock);
  	return ret;
  }
-@@ -792,7 +795,7 @@ restart:
+@@ -795,7 +795,7 @@ restart:
  	spin_lock(&inode->i_lock);
  	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
  		spin_lock(&dentry->d_lock);
@@ -74450,7 +74566,7 @@ index aa24f7d..8f1bf8c 100644
  			/*
  			 * inform the fs via d_prune that this dentry
  			 * is about to be unhashed and destroyed.
-@@ -884,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -887,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
  		 * We found an inuse dentry which was not removed from
  		 * the LRU because of laziness during lookup. Do not free it.
  		 */
@@ -74459,7 +74575,7 @@ index aa24f7d..8f1bf8c 100644
  			spin_unlock(&dentry->d_lock);
  			continue;
  		}
-@@ -930,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
+@@ -933,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
  	 * counts, just remove them from the LRU. Otherwise give them
  	 * another pass through the LRU.
  	 */
@@ -74468,7 +74584,7 @@ index aa24f7d..8f1bf8c 100644
  		d_lru_isolate(dentry);
  		spin_unlock(&dentry->d_lock);
  		return LRU_REMOVED;
-@@ -1269,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+@@ -1272,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
  	 * loop in shrink_dcache_parent() might not make any progress
  	 * and loop forever.
  	 */
@@ -74477,7 +74593,7 @@ index aa24f7d..8f1bf8c 100644
  		dentry_lru_del(dentry);
  	} else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
  		/*
-@@ -1323,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1326,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
  	struct select_data *data = _data;
  	enum d_walk_ret ret = D_WALK_CONTINUE;
  
@@ -74491,7 +74607,7 @@ index aa24f7d..8f1bf8c 100644
  			goto out;
  		printk(KERN_ERR
  		       "BUG: Dentry %p{i=%lx,n=%s}"
-@@ -1337,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1340,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
  		       dentry->d_inode ?
  		       dentry->d_inode->i_ino : 0UL,
  		       dentry->d_name.name,
@@ -74500,7 +74616,7 @@ index aa24f7d..8f1bf8c 100644
  		       dentry->d_sb->s_type->name,
  		       dentry->d_sb->s_id);
  		BUG();
-@@ -1495,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1498,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	 */
  	dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
  	if (name->len > DNAME_INLINE_LEN-1) {
@@ -74509,7 +74625,7 @@ index aa24f7d..8f1bf8c 100644
  		if (!dname) {
  			kmem_cache_free(dentry_cache, dentry); 
  			return NULL;
-@@ -1513,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1516,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	smp_wmb();
  	dentry->d_name.name = dname;
  
@@ -74518,7 +74634,7 @@ index aa24f7d..8f1bf8c 100644
  	dentry->d_flags = 0;
  	spin_lock_init(&dentry->d_lock);
  	seqcount_init(&dentry->d_seq);
-@@ -1522,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1525,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	dentry->d_sb = sb;
  	dentry->d_op = NULL;
  	dentry->d_fsdata = NULL;
@@ -74528,7 +74644,7 @@ index aa24f7d..8f1bf8c 100644
  	INIT_HLIST_BL_NODE(&dentry->d_hash);
  	INIT_LIST_HEAD(&dentry->d_lru);
  	INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2276,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2279,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
  				goto next;
  		}
  
@@ -74537,7 +74653,7 @@ index aa24f7d..8f1bf8c 100644
  		found = dentry;
  		spin_unlock(&dentry->d_lock);
  		break;
-@@ -2375,7 +2381,7 @@ again:
+@@ -2378,7 +2381,7 @@ again:
  	spin_lock(&dentry->d_lock);
  	inode = dentry->d_inode;
  	isdir = S_ISDIR(inode->i_mode);
@@ -74546,7 +74662,7 @@ index aa24f7d..8f1bf8c 100644
  		if (!spin_trylock(&inode->i_lock)) {
  			spin_unlock(&dentry->d_lock);
  			cpu_relax();
-@@ -3308,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3311,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
  
  		if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
  			dentry->d_flags |= DCACHE_GENOCIDE;
@@ -74555,7 +74671,7 @@ index aa24f7d..8f1bf8c 100644
  		}
  	}
  	return D_WALK_CONTINUE;
-@@ -3424,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3427,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -77944,7 +78060,7 @@ index b29e42f..5ea7fdf 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index ccb8000..ac58c5a 100644
+index ccb8000..02d506e 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -331,17 +331,34 @@ int generic_permission(struct inode *inode, int mask)
@@ -78000,6 +78116,15 @@ index ccb8000..ac58c5a 100644
  	return -EACCES;
  }
  
+@@ -733,7 +742,7 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
+ 		return 0;
+ 
+ 	/* Allowed if parent directory not sticky and world-writable. */
+-	parent = nd->path.dentry->d_inode;
++	parent = nd->inode;
+ 	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
+ 		return 0;
+ 
 @@ -821,7 +830,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  {
  	struct dentry *dentry = link->dentry;
@@ -111608,7 +111733,7 @@ index 9502057..a83c0d4 100644
  	}
  	unset_migratetype_isolate(page, MIGRATE_MOVABLE);
 diff --git a/mm/memory.c b/mm/memory.c
-index 749e1c6..f7fbc29 100644
+index e9ddc7a..f465481 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -112065,7 +112190,7 @@ index 749e1c6..f7fbc29 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3228,27 +3412,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3228,31 +3412,29 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -112076,6 +112201,13 @@ index 749e1c6..f7fbc29 100644
  
 -	pte_unmap(page_table);
 -
+ 	/* File mapping without ->vm_ops ? */
+-	if (vma->vm_flags & VM_SHARED)
++	if (vma->vm_flags & VM_SHARED) {
++		pte_unmap(page_table);
+ 		return VM_FAULT_SIGBUS;
++	}
+ 
 -	/* Check if we need to add a guard page to the stack */
 -	if (check_stack_guard_page(vma, address) < 0)
 -		return VM_FAULT_SIGSEGV;
@@ -112098,7 +112230,7 @@ index 749e1c6..f7fbc29 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3272,6 +3452,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3276,6 +3458,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -112110,7 +112242,7 @@ index 749e1c6..f7fbc29 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3279,6 +3464,12 @@ setpte:
+@@ -3283,6 +3470,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -112123,7 +112255,7 @@ index 749e1c6..f7fbc29 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3423,6 +3614,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3427,6 +3620,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -112136,7 +112268,7 @@ index 749e1c6..f7fbc29 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3444,6 +3641,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3448,6 +3647,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -112151,7 +112283,7 @@ index 749e1c6..f7fbc29 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3691,6 +3896,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3696,6 +3903,12 @@ static int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -112164,7 +112296,7 @@ index 749e1c6..f7fbc29 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3707,9 +3918,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3712,9 +3925,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -112206,7 +112338,7 @@ index 749e1c6..f7fbc29 100644
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
  	if (!pud)
-@@ -3837,6 +4080,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3842,6 +4087,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -112230,7 +112362,7 @@ index 749e1c6..f7fbc29 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3867,6 +4127,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3872,6 +4134,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -112261,7 +112393,7 @@ index 749e1c6..f7fbc29 100644
  #endif /* __PAGETABLE_PMD_FOLDED */
  
  #if !defined(__HAVE_ARCH_GATE_AREA)
-@@ -3880,7 +4164,7 @@ static int __init gate_vma_init(void)
+@@ -3885,7 +4171,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -112270,7 +112402,7 @@ index 749e1c6..f7fbc29 100644
  
  	return 0;
  }
-@@ -4014,8 +4298,8 @@ out:
+@@ -4019,8 +4305,8 @@ out:
  	return ret;
  }
  
@@ -112281,7 +112413,7 @@ index 749e1c6..f7fbc29 100644
  {
  	resource_size_t phys_addr;
  	unsigned long prot = 0;
-@@ -4041,8 +4325,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -4046,8 +4332,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
   * Access another process' address space as given in mm.  If non-NULL, use the
   * given task for page fault accounting.
   */
@@ -112292,7 +112424,7 @@ index 749e1c6..f7fbc29 100644
  {
  	struct vm_area_struct *vma;
  	void *old_buf = buf;
-@@ -4050,7 +4334,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4055,7 +4341,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
  	down_read(&mm->mmap_sem);
  	/* ignore errors, just check how much was successfully transferred */
  	while (len) {
@@ -112301,7 +112433,7 @@ index 749e1c6..f7fbc29 100644
  		void *maddr;
  		struct page *page = NULL;
  
-@@ -4109,8 +4393,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4114,8 +4400,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
   *
   * The caller must hold a reference on @mm.
   */
@@ -112312,7 +112444,7 @@ index 749e1c6..f7fbc29 100644
  {
  	return __access_remote_vm(NULL, mm, addr, buf, len, write);
  }
-@@ -4120,11 +4404,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4125,11 +4411,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
   * Source/target buffer must be kernel space,
   * Do not walk the page table directly, use get_user_pages
   */
@@ -117100,19 +117232,19 @@ index d125290..e86e034 100644
  	a0 = a[0];
  	a1 = a[1];
 diff --git a/net/core/datagram.c b/net/core/datagram.c
-index a16ed7b..689402b 100644
+index a16ed7b..a334f7d 100644
 --- a/net/core/datagram.c
 +++ b/net/core/datagram.c
 @@ -130,6 +130,35 @@ out_noerr:
  	goto out;
  }
  
-+static int skb_set_peeked(struct sk_buff *skb)
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
 +{
 +	struct sk_buff *nskb;
 +
 +	if (skb->peeked)
-+		return 0;
++		return skb;
 +
 +	/* We have to unshare an skb before modifying it. */
 +	if (!skb_shared(skb))
@@ -117120,7 +117252,7 @@ index a16ed7b..689402b 100644
 +
 +	nskb = skb_clone(skb, GFP_ATOMIC);
 +	if (!nskb)
-+		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
 +
 +	skb->prev->next = nskb;
 +	skb->next->prev = nskb;
@@ -117133,7 +117265,7 @@ index a16ed7b..689402b 100644
 +done:
 +	skb->peeked = 1;
 +
-+	return 0;
++	return skb;
 +}
 +
  /**
@@ -117158,20 +117290,21 @@ index a16ed7b..689402b 100644
  		int _off = *off;
  
  		last = (struct sk_buff *)queue;
-@@ -198,7 +227,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -198,7 +227,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
  					_off -= skb->len;
  					continue;
  				}
 -				skb->peeked = 1;
 +
-+				error = skb_set_peeked(skb);
-+				if (error)
++				skb = skb_set_peeked(skb);
++				error = PTR_ERR(skb);
++				if (IS_ERR(skb))
 +					goto unlock_err;
 +
  				atomic_inc(&skb->users);
  			} else
  				__skb_unlink(skb, queue);
-@@ -222,6 +255,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -222,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
  
  	return NULL;
  
@@ -117180,7 +117313,7 @@ index a16ed7b..689402b 100644
  no_packet:
  	*err = error;
  	return NULL;
-@@ -301,7 +336,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+@@ -301,7 +337,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
  	}
  
  	kfree_skb(skb);
@@ -121788,6 +121921,19 @@ index b7ebe23..b6352f6 100644
  }
  #endif
  
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f6..140a44a 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+ 
+ 	/* check for all kinds of wrapping and the like */
+ 	start = (unsigned long)optval;
+-	if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++	if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
 diff --git a/net/rds/iw.h b/net/rds/iw.h
 index 04ce3b1..48119a6 100644
 --- a/net/rds/iw.h
@@ -135209,10 +135355,10 @@ index 0000000..176c32f
 +#endif
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..51560ee
+index 0000000..b5dfeff
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6061 @@
+@@ -0,0 +1,6092 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -135517,6 +135663,7 @@ index 0000000..51560ee
 +_iwl_dbgfs_d3_sram_write_3315 _iwl_dbgfs_d3_sram_write 3 3315 NULL
 +dbDiscardAG_3322 dbDiscardAG 3 3322 NULL
 +compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
++ocfs2_extend_xattr_bucket_3328 ocfs2_extend_xattr_bucket 4 3328 NULL
 +read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
 +sysfs_create_group_3339 sysfs_create_group 0 3339 NULL
 +tty_port_register_device_attr_3341 tty_port_register_device_attr 3 3341 NULL
@@ -135611,7 +135758,7 @@ index 0000000..51560ee
 +__copy_from_user_inatomic_4365 __copy_from_user_inatomic 0-3 4365 NULL nohasharray
 +lookup_string_4365 lookup_string 0 4365 &__copy_from_user_inatomic_4365
 +irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
-+access_process_vm_4412 access_process_vm 0 4412 NULL nohasharray
++access_process_vm_4412 access_process_vm 0-2-4 4412 NULL nohasharray
 +cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 &access_process_vm_4412
 +libfc_vport_create_4415 libfc_vport_create 2 4415 NULL
 +rtw_android_get_rssi_4421 rtw_android_get_rssi 0 4421 NULL
@@ -135967,6 +136114,7 @@ index 0000000..51560ee
 +ocfs2_find_path_8754 ocfs2_find_path 0 8754 NULL
 +yurex_write_8761 yurex_write 3 8761 NULL
 +joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
++x32_arch_ptrace_8767 x32_arch_ptrace 3 8767 NULL
 +kstrtoint_from_user_8778 kstrtoint_from_user 2 8778 NULL
 +paging32_prefetch_gpte_8783 paging32_prefetch_gpte 4 8783 NULL
 +ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 3-4 8785 NULL
@@ -136209,6 +136357,7 @@ index 0000000..51560ee
 +insert_inline_extent_backref_11063 insert_inline_extent_backref 8 11063 NULL
 +tcp_send_mss_11079 tcp_send_mss 0 11079 NULL
 +count_argc_11083 count_argc 0 11083 NULL
++ocfs2_blocks_per_xattr_bucket_11099 ocfs2_blocks_per_xattr_bucket 0 11099 NULL
 +kvm_write_guest_cached_11106 kvm_write_guest_cached 4 11106 NULL
 +tw_change_queue_depth_11116 tw_change_queue_depth 2 11116 NULL
 +page_offset_11120 page_offset 0 11120 NULL
@@ -136405,6 +136554,7 @@ index 0000000..51560ee
 +snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
 +bfad_debugfs_read_13119 bfad_debugfs_read 3 13119 NULL
 +blk_update_request_13146 blk_update_request 3 13146 NULL
++ocfs2_quota_trans_credits_13150 ocfs2_quota_trans_credits 0 13150 NULL
 +caif_stream_recvmsg_13173 caif_stream_recvmsg 4 13173 NULL
 +pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
 +ucs2_strlen_13178 ucs2_strlen 0 13178 NULL
@@ -136774,7 +136924,7 @@ index 0000000..51560ee
 +befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
 +tx_tx_start_templates_read_17164 tx_tx_start_templates_read 3 17164 NULL
 +UniStrnlen_17169 UniStrnlen 0 17169 NULL
-+access_remote_vm_17189 access_remote_vm 0 17189 NULL nohasharray
++access_remote_vm_17189 access_remote_vm 0-2-4 17189 NULL nohasharray
 +iwl_dbgfs_txfifo_flush_write_17189 iwl_dbgfs_txfifo_flush_write 3 17189 &access_remote_vm_17189 nohasharray
 +ocfs2_flock_handle_signal_17189 ocfs2_flock_handle_signal 0 17189 &iwl_dbgfs_txfifo_flush_write_17189
 +iscsit_find_cmd_from_itt_or_dump_17194 iscsit_find_cmd_from_itt_or_dump 3 17194 NULL nohasharray
@@ -136814,6 +136964,7 @@ index 0000000..51560ee
 +osst_execute_17607 osst_execute 7-6 17607 NULL
 +ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout_17618 ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout 3 17618 NULL
 +dma_map_page_17628 dma_map_page 0 17628 NULL
++ocfs2_rotate_subtree_left_17634 ocfs2_rotate_subtree_left 5 17634 NULL
 +twl4030_set_gpio_direction_17645 twl4030_set_gpio_direction 1 17645 NULL
 +SYSC_migrate_pages_17657 SYSC_migrate_pages 2 17657 NULL
 +packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
@@ -137164,6 +137315,7 @@ index 0000000..51560ee
 +bl_add_page_to_bio_21094 bl_add_page_to_bio 2 21094 NULL nohasharray
 +multipath_status_21094 multipath_status 5 21094 &bl_add_page_to_bio_21094
 +rate_control_pid_events_read_21099 rate_control_pid_events_read 3 21099 NULL
++ocfs2_extend_meta_needed_21104 ocfs2_extend_meta_needed 0 21104 NULL
 +ath6kl_send_go_probe_resp_21113 ath6kl_send_go_probe_resp 3 21113 NULL
 +_efx_mcdi_rpc_async_21119 _efx_mcdi_rpc_async 4-5 21119 NULL
 +i2400m_rx_trace_21127 i2400m_rx_trace 3 21127 NULL
@@ -137183,6 +137335,7 @@ index 0000000..51560ee
 +get_zeroed_page_21322 get_zeroed_page 0 21322 NULL
 +ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
 +read_file_bool_bmps_21344 read_file_bool_bmps 3 21344 NULL
++ocfs2_find_subtree_root_21351 ocfs2_find_subtree_root 0 21351 NULL
 +gfs2_ea_get_copy_21353 gfs2_ea_get_copy 0 21353 NULL
 +alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
 +SYSC_rt_sigpending_21379 SYSC_rt_sigpending 2 21379 NULL
@@ -137360,6 +137513,7 @@ index 0000000..51560ee
 +usblp_write_23178 usblp_write 3 23178 NULL
 +gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
 +mpi_alloc_limb_space_23190 mpi_alloc_limb_space 1 23190 NULL
++convert_ip_to_linear_23198 convert_ip_to_linear 0 23198 NULL
 +tty_buffer_request_room_23228 tty_buffer_request_room 2-0 23228 NULL
 +xlog_get_bp_23229 xlog_get_bp 2 23229 NULL nohasharray
 +__read_status_pci_23229 __read_status_pci 0 23229 &xlog_get_bp_23229
@@ -137776,6 +137930,7 @@ index 0000000..51560ee
 +sky2_pci_read16_27863 sky2_pci_read16 0 27863 NULL
 +ieee80211_if_read_dot11MeshHWMProotInterval_27873 ieee80211_if_read_dot11MeshHWMProotInterval 3 27873 NULL
 +unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
++SyS_ptrace_27924 SyS_ptrace 3 27924 NULL
 +check_mapped_name_27943 check_mapped_name 3 27943 NULL
 +bio_next_split_27961 bio_next_split 2 27961 NULL nohasharray
 +tracing_clock_write_27961 tracing_clock_write 3 27961 &bio_next_split_27961
@@ -137996,6 +138151,7 @@ index 0000000..51560ee
 +read_4k_modal_eeprom_30212 read_4k_modal_eeprom 3 30212 NULL
 +SyS_semop_30227 SyS_semop 3 30227 NULL
 +bitmap_file_set_bit_30228 bitmap_file_set_bit 2 30228 NULL
++ocfs2_calc_bg_discontig_credits_30230 ocfs2_calc_bg_discontig_credits 0 30230 NULL
 +shmem_unuse_inode_30263 shmem_unuse_inode 0 30263 NULL
 +rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
 +try_break_deleg_30271 try_break_deleg 0 30271 NULL nohasharray
@@ -138007,6 +138163,7 @@ index 0000000..51560ee
 +osc_contention_seconds_seq_write_30305 osc_contention_seconds_seq_write 3 30305 NULL
 +ext4_acl_from_disk_30320 ext4_acl_from_disk 2 30320 NULL
 +i8254_read_30330 i8254_read 0 30330 NULL
++generic_ptrace_pokedata_30338 generic_ptrace_pokedata 2 30338 NULL
 +resource_from_user_30341 resource_from_user 3 30341 NULL
 +o2nm_this_node_30342 o2nm_this_node 0 30342 NULL
 +gfs2_trans_begin_30359 gfs2_trans_begin 0 30359 NULL
@@ -138081,6 +138238,7 @@ index 0000000..51560ee
 +size_inside_page_31141 size_inside_page 0 31141 NULL
 +w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
 +ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
++crypto_rng_seedsize_31196 crypto_rng_seedsize 0 31196 NULL
 +r592_read_fifo_pio_31198 r592_read_fifo_pio 3 31198 NULL
 +mtdchar_readoob_31200 mtdchar_readoob 4 31200 NULL
 +__btrfs_free_reserved_extent_31207 __btrfs_free_reserved_extent 2 31207 NULL
@@ -138177,6 +138335,7 @@ index 0000000..51560ee
 +calc_hmac_32010 calc_hmac 3 32010 NULL
 +aead_len_32021 aead_len 0 32021 NULL
 +stk_read_32038 stk_read 3 32038 NULL
++ocfs2_update_edge_lengths_32046 ocfs2_update_edge_lengths 3 32046 NULL
 +SYSC_llistxattr_32061 SYSC_llistxattr 3 32061 NULL
 +proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
 +xfs_buf_iowait_32068 xfs_buf_iowait 0 32068 NULL
@@ -138258,6 +138417,7 @@ index 0000000..51560ee
 +zlib_inflate_workspacesize_32927 zlib_inflate_workspacesize 0 32927 NULL
 +rmap_recycle_32938 rmap_recycle 3 32938 NULL
 +xfs_log_reserve_32959 xfs_log_reserve 0 32959 NULL
++arch_ptrace_32981 arch_ptrace 3 32981 NULL
 +compat_filldir_32999 compat_filldir 3 32999 NULL
 +SyS_syslog_33007 SyS_syslog 3 33007 NULL
 +br_multicast_set_hash_max_33012 br_multicast_set_hash_max 2 33012 NULL
@@ -138389,6 +138549,7 @@ index 0000000..51560ee
 +mwifiex_regrdwr_read_34472 mwifiex_regrdwr_read 3 34472 NULL
 +skcipher_sndbuf_34476 skcipher_sndbuf 0 34476 NULL
 +i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
++ocfs2_mv_xattr_buckets_34484 ocfs2_mv_xattr_buckets 6 34484 NULL
 +security_inode_permission_34488 security_inode_permission 0 34488 NULL
 +SyS_pwritev_34494 SyS_pwritev 3 34494 NULL
 +qp_alloc_res_34496 qp_alloc_res 5 34496 NULL
@@ -138510,6 +138671,7 @@ index 0000000..51560ee
 +SYSC_pwritev_35690 SYSC_pwritev 3 35690 NULL
 +rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
 +md_super_write_35703 md_super_write 4 35703 NULL
++ocfs2_extent_recs_per_gd_35710 ocfs2_extent_recs_per_gd 0 35710 NULL
 +iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
 +udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
 +pvr2_hdw_cpufw_get_35824 pvr2_hdw_cpufw_get 0-4-2 35824 NULL
@@ -138546,6 +138708,7 @@ index 0000000..51560ee
 +mtip_hw_read_device_status_36082 mtip_hw_read_device_status 3 36082 NULL
 +vga_arb_write_36112 vga_arb_write 3 36112 NULL
 +simple_xattr_alloc_36118 simple_xattr_alloc 2 36118 NULL
++compat_ptrace_request_36131 compat_ptrace_request 3 36131 NULL
 +ext3_readpages_36144 ext3_readpages 4 36144 NULL
 +twl_set_36154 twl_set 2 36154 NULL
 +b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
@@ -138663,6 +138826,7 @@ index 0000000..51560ee
 +_iwl_dbgfs_fw_restart_write_37270 _iwl_dbgfs_fw_restart_write 3 37270 NULL
 +ieee80211_if_read_power_mode_37305 ieee80211_if_read_power_mode 3 37305 NULL
 +ext3_direct_IO_37308 ext3_direct_IO 4 37308 NULL
++ocfs2_calc_extend_credits_37310 ocfs2_calc_extend_credits 0 37310 NULL
 +jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
 +send_msg_37323 send_msg 4 37323 NULL
 +l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL nohasharray
@@ -138791,6 +138955,7 @@ index 0000000..51560ee
 +_ipw_read32_38565 _ipw_read32 0 38565 NULL
 +snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5-3 38567 NULL
 +copy_ctl_value_to_user_38587 copy_ctl_value_to_user 4 38587 NULL
++compat_sys_ptrace_38595 compat_sys_ptrace 3 38595 NULL
 +rd_allocate_sgl_table_38607 rd_allocate_sgl_table 3 38607 NULL
 +icn_writecmd_38629 icn_writecmd 2 38629 NULL
 +write_enabled_file_bool_38630 write_enabled_file_bool 3 38630 NULL
@@ -139011,6 +139176,7 @@ index 0000000..51560ee
 +provide_user_output_41105 provide_user_output 3 41105 NULL
 +f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
 +ath10k_read_wmi_services_41112 ath10k_read_wmi_services 3 41112 NULL
++ocfs2_extend_trans_41116 ocfs2_extend_trans 2 41116 NULL
 +v4l2_ctrl_new_int_menu_41151 v4l2_ctrl_new_int_menu 4 41151 NULL
 +tx_frag_mpdu_alloc_failed_read_41167 tx_frag_mpdu_alloc_failed_read 3 41167 NULL
 +dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
@@ -139331,6 +139497,7 @@ index 0000000..51560ee
 +sysfs_create_link_44685 sysfs_create_link 0 44685 NULL
 +ts_read_44687 ts_read 3 44687 NULL
 +lov_emerg_alloc_44698 lov_emerg_alloc 1 44698 NULL
++__ocfs2_rotate_tree_left_44705 __ocfs2_rotate_tree_left 3 44705 NULL
 +xfer_to_user_44713 xfer_to_user 3 44713 NULL nohasharray
 +__generic_block_fiemap_44713 __generic_block_fiemap 4 44713 &xfer_to_user_44713
 +_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
@@ -139360,7 +139527,7 @@ index 0000000..51560ee
 +regmap_spi_read_44921 regmap_spi_read 3-5 44921 NULL
 +tx_queue_status_read_44978 tx_queue_status_read 3 44978 NULL
 +bytepos_delta_45017 bytepos_delta 0-2 45017 NULL
-+ptrace_writedata_45021 ptrace_writedata 4 45021 NULL
++ptrace_writedata_45021 ptrace_writedata 4-3 45021 NULL
 +dm_kvzalloc_45025 dm_kvzalloc 1 45025 NULL
 +sysfs_do_create_link_sd_45057 sysfs_do_create_link_sd 0 45057 NULL
 +sel_write_user_45060 sel_write_user 3 45060 NULL
@@ -139452,7 +139619,7 @@ index 0000000..51560ee
 +sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
 +fnic_reset_stats_read_46030 fnic_reset_stats_read 3 46030 NULL nohasharray
 +get_free_entries_46030 get_free_entries 1 46030 &fnic_reset_stats_read_46030
-+__access_remote_vm_46031 __access_remote_vm 0 46031 NULL
++__access_remote_vm_46031 __access_remote_vm 0-3-5 46031 NULL
 +snd_emu10k1x_ptr_read_46049 snd_emu10k1x_ptr_read 0 46049 NULL
 +__ocfs2_move_extent_46060 __ocfs2_move_extent 3-4 46060 NULL nohasharray
 +dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 &__ocfs2_move_extent_46060
@@ -139578,6 +139745,7 @@ index 0000000..51560ee
 +sta_vht_capa_read_47409 sta_vht_capa_read 3 47409 NULL
 +crypto_ablkcipher_alignmask_47410 crypto_ablkcipher_alignmask 0 47410 NULL
 +lbs_wrrf_write_47418 lbs_wrrf_write 3 47418 NULL
++environ_read_47451 environ_read 3 47451 NULL
 +nvme_trans_send_fw_cmd_47479 nvme_trans_send_fw_cmd 4 47479 NULL
 +newpart_47485 newpart 6-4 47485 NULL
 +core_sys_select_47494 core_sys_select 1 47494 NULL
@@ -139817,6 +139985,7 @@ index 0000000..51560ee
 +dn_mss_from_pmtu_50011 dn_mss_from_pmtu 0-2 50011 NULL
 +xfs_ialloc_inode_init_50015 xfs_ialloc_inode_init 0 50015 NULL
 +security_context_to_sid_50019 security_context_to_sid 2 50019 NULL
++ptrace_readdata_50020 ptrace_readdata 2-4 50020 NULL
 +isdn_read_50021 isdn_read 3 50021 NULL
 +mdc_rename_pack_50023 mdc_rename_pack 4-6 50023 NULL
 +brcmf_debugfs_chipinfo_read_50033 brcmf_debugfs_chipinfo_read 3 50033 NULL
@@ -139951,7 +140120,8 @@ index 0000000..51560ee
 +init_map_ipmac_51317 init_map_ipmac 5 51317 NULL
 +alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
 +ext2_xattr_get_51327 ext2_xattr_get 0 51327 NULL
-+alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
++alloc_smp_req_51337 alloc_smp_req 1 51337 NULL nohasharray
++compat_arch_ptrace_51337 compat_arch_ptrace 3 51337 &alloc_smp_req_51337
 +ipw_get_event_log_len_51341 ipw_get_event_log_len 0 51341 NULL
 +ieee80211_if_fmt_estab_plinks_51370 ieee80211_if_fmt_estab_plinks 3 51370 NULL
 +radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
@@ -140334,6 +140504,7 @@ index 0000000..51560ee
 +memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
 +lbs_failcount_write_55276 lbs_failcount_write 3 55276 NULL
 +persistent_ram_new_55286 persistent_ram_new 2-1 55286 NULL
++ptrace_request_55288 ptrace_request 3 55288 NULL
 +rx_streaming_interval_read_55291 rx_streaming_interval_read 3 55291 NULL nohasharray
 +xd_read_cis_55291 xd_read_cis 4 55291 &rx_streaming_interval_read_55291
 +lov_get_stripecnt_55297 lov_get_stripecnt 0-3 55297 NULL
@@ -140590,6 +140761,7 @@ index 0000000..51560ee
 +ld2_57794 ld2 0 57794 NULL
 +ivtv_read_57796 ivtv_read 3 57796 NULL
 +ion_test_ioctl_57799 ion_test_ioctl 2 57799 NULL
++generic_ptrace_peekdata_57806 generic_ptrace_peekdata 2 57806 NULL
 +bfad_debugfs_read_regrd_57830 bfad_debugfs_read_regrd 3 57830 NULL
 +copy_to_user_57835 copy_to_user 3-0 57835 NULL
 +xfs_rtpick_extent_57843 xfs_rtpick_extent 0 57843 NULL nohasharray
@@ -140691,6 +140863,7 @@ index 0000000..51560ee
 +ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout_58965 ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout 3 58965 NULL
 +crypto_aead_ivsize_58970 crypto_aead_ivsize 0 58970 NULL
 +__mem_cgroup_try_charge_58976 __mem_cgroup_try_charge 0 58976 NULL
++bch_extent_to_text_58987 bch_extent_to_text 2 58987 NULL
 +init_list_set_59005 init_list_set 3 59005 NULL
 +ep_write_59008 ep_write 3 59008 NULL
 +lpfc_idiag_baracc_write_59014 lpfc_idiag_baracc_write 3 59014 NULL
@@ -140777,6 +140950,7 @@ index 0000000..51560ee
 +pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
 +l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
 +ffs_prepare_buffer_59892 ffs_prepare_buffer 2 59892 NULL
++ocfs2_extend_rotate_transaction_59894 ocfs2_extend_rotate_transaction 2-3 59894 NULL
 +kvm_mmu_notifier_invalidate_range_start_59944 kvm_mmu_notifier_invalidate_range_start 3-4 59944 NULL
 +ath10k_read_dfs_stats_59949 ath10k_read_dfs_stats 3 59949 NULL
 +dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL nohasharray
@@ -140997,10 +141171,12 @@ index 0000000..51560ee
 +nfsd_read_file_62241 nfsd_read_file 6 62241 NULL
 +subtract_dirty_62242 subtract_dirty 2-3 62242 NULL
 +ion_handle_test_dma_62262 ion_handle_test_dma 4-5 62262 NULL
++get_random_int_62279 get_random_int 0 62279 NULL
 +il_dbgfs_sram_read_62296 il_dbgfs_sram_read 3 62296 NULL
 +sparse_early_usemaps_alloc_pgdat_section_62304 sparse_early_usemaps_alloc_pgdat_section 2 62304 NULL
 +subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
 +Wb35Reg_BurstWrite_62327 Wb35Reg_BurstWrite 4 62327 NULL
++ocfs2_xattr_buckets_per_cluster_62330 ocfs2_xattr_buckets_per_cluster 0 62330 NULL
 +subseq_list_62332 subseq_list 3-0 62332 NULL
 +ll_statahead_max_seq_write_62333 ll_statahead_max_seq_write 3 62333 NULL
 +flash_write_62354 flash_write 3 62354 NULL
@@ -141145,6 +141321,7 @@ index 0000000..51560ee
 +bypass_wd_write_64120 bypass_wd_write 3 64120 NULL
 +ext4_prepare_inline_data_64124 ext4_prepare_inline_data 3 64124 NULL
 +init_bch_64130 init_bch 1-2 64130 NULL
++SYSC_ptrace_64136 SYSC_ptrace 3 64136 NULL
 +ablkcipher_copy_iv_64140 ablkcipher_copy_iv 3 64140 NULL
 +dlfb_ops_write_64150 dlfb_ops_write 3 64150 NULL
 +cpumask_scnprintf_64170 cpumask_scnprintf 0-2 64170 NULL
@@ -141374,7 +141551,7 @@ index 0000000..560cd7b
 +zpios_read_64734 zpios_read 3 64734 NULL
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 new file mode 100644
-index 0000000..7e07890
+index 0000000..2133228
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 @@ -0,0 +1,260 @@
@@ -141411,7 +141588,7 @@ index 0000000..7e07890
 +tree size_overflow_type_TI;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20140725_01",
++	.version	= "20140725_02",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
diff --git a/3.14.49/4425_grsec_remove_EI_PAX.patch b/3.14.50/4425_grsec_remove_EI_PAX.patch
index a80a5d7..a80a5d7 100644
--- a/3.14.49/4425_grsec_remove_EI_PAX.patch
+++ b/3.14.50/4425_grsec_remove_EI_PAX.patch
diff --git a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
index 4c236cc..4c236cc 100644
--- a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.14.49/4430_grsec-remove-localversion-grsec.patch b/3.14.50/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.14.49/4430_grsec-remove-localversion-grsec.patch
+++ b/3.14.50/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.14.49/4435_grsec-mute-warnings.patch b/3.14.50/4435_grsec-mute-warnings.patch
index 2c2d463..2c2d463 100644
--- a/3.14.49/4435_grsec-mute-warnings.patch
+++ b/3.14.50/4435_grsec-mute-warnings.patch
diff --git a/3.14.49/4440_grsec-remove-protected-paths.patch b/3.14.50/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.14.49/4440_grsec-remove-protected-paths.patch
+++ b/3.14.50/4440_grsec-remove-protected-paths.patch
diff --git a/3.14.49/4450_grsec-kconfig-default-gids.patch b/3.14.50/4450_grsec-kconfig-default-gids.patch
index b96defc..b96defc 100644
--- a/3.14.49/4450_grsec-kconfig-default-gids.patch
+++ b/3.14.50/4450_grsec-kconfig-default-gids.patch
diff --git a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
index bba906e..bba906e 100644
--- a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.14.49/4470_disable-compat_vdso.patch b/3.14.50/4470_disable-compat_vdso.patch
index 3b3953b..3b3953b 100644
--- a/3.14.49/4470_disable-compat_vdso.patch
+++ b/3.14.50/4470_disable-compat_vdso.patch
diff --git a/3.14.49/4475_emutramp_default_on.patch b/3.14.50/4475_emutramp_default_on.patch
index a128205..a128205 100644
--- a/3.14.49/4475_emutramp_default_on.patch
+++ b/3.14.50/4475_emutramp_default_on.patch
diff --git a/3.2.69/0000_README b/3.2.70/0000_README
index 96cd54d..52d8c39 100644
--- a/3.2.69/0000_README
+++ b/3.2.70/0000_README
@@ -194,7 +194,11 @@ Patch:	1068_linux-3.2.69.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.69
 
-Patch:	4420_grsecurity-3.1-3.2.69-201508020900.patch
+Patch:	1069_linux-3.2.70.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.70
+
+Patch:	4420_grsecurity-3.1-3.2.70-201508102127.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.69/1021_linux-3.2.22.patch b/3.2.70/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.69/1021_linux-3.2.22.patch
+++ b/3.2.70/1021_linux-3.2.22.patch
diff --git a/3.2.69/1022_linux-3.2.23.patch b/3.2.70/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.69/1022_linux-3.2.23.patch
+++ b/3.2.70/1022_linux-3.2.23.patch
diff --git a/3.2.69/1023_linux-3.2.24.patch b/3.2.70/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.69/1023_linux-3.2.24.patch
+++ b/3.2.70/1023_linux-3.2.24.patch
diff --git a/3.2.69/1024_linux-3.2.25.patch b/3.2.70/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.69/1024_linux-3.2.25.patch
+++ b/3.2.70/1024_linux-3.2.25.patch
diff --git a/3.2.69/1025_linux-3.2.26.patch b/3.2.70/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.69/1025_linux-3.2.26.patch
+++ b/3.2.70/1025_linux-3.2.26.patch
diff --git a/3.2.69/1026_linux-3.2.27.patch b/3.2.70/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.69/1026_linux-3.2.27.patch
+++ b/3.2.70/1026_linux-3.2.27.patch
diff --git a/3.2.69/1027_linux-3.2.28.patch b/3.2.70/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.69/1027_linux-3.2.28.patch
+++ b/3.2.70/1027_linux-3.2.28.patch
diff --git a/3.2.69/1028_linux-3.2.29.patch b/3.2.70/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.69/1028_linux-3.2.29.patch
+++ b/3.2.70/1028_linux-3.2.29.patch
diff --git a/3.2.69/1029_linux-3.2.30.patch b/3.2.70/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.69/1029_linux-3.2.30.patch
+++ b/3.2.70/1029_linux-3.2.30.patch
diff --git a/3.2.69/1030_linux-3.2.31.patch b/3.2.70/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.69/1030_linux-3.2.31.patch
+++ b/3.2.70/1030_linux-3.2.31.patch
diff --git a/3.2.69/1031_linux-3.2.32.patch b/3.2.70/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.69/1031_linux-3.2.32.patch
+++ b/3.2.70/1031_linux-3.2.32.patch
diff --git a/3.2.69/1032_linux-3.2.33.patch b/3.2.70/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.69/1032_linux-3.2.33.patch
+++ b/3.2.70/1032_linux-3.2.33.patch
diff --git a/3.2.69/1033_linux-3.2.34.patch b/3.2.70/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.69/1033_linux-3.2.34.patch
+++ b/3.2.70/1033_linux-3.2.34.patch
diff --git a/3.2.69/1034_linux-3.2.35.patch b/3.2.70/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.69/1034_linux-3.2.35.patch
+++ b/3.2.70/1034_linux-3.2.35.patch
diff --git a/3.2.69/1035_linux-3.2.36.patch b/3.2.70/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.69/1035_linux-3.2.36.patch
+++ b/3.2.70/1035_linux-3.2.36.patch
diff --git a/3.2.69/1036_linux-3.2.37.patch b/3.2.70/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.69/1036_linux-3.2.37.patch
+++ b/3.2.70/1036_linux-3.2.37.patch
diff --git a/3.2.69/1037_linux-3.2.38.patch b/3.2.70/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.69/1037_linux-3.2.38.patch
+++ b/3.2.70/1037_linux-3.2.38.patch
diff --git a/3.2.69/1038_linux-3.2.39.patch b/3.2.70/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.69/1038_linux-3.2.39.patch
+++ b/3.2.70/1038_linux-3.2.39.patch
diff --git a/3.2.69/1039_linux-3.2.40.patch b/3.2.70/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.69/1039_linux-3.2.40.patch
+++ b/3.2.70/1039_linux-3.2.40.patch
diff --git a/3.2.69/1040_linux-3.2.41.patch b/3.2.70/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.69/1040_linux-3.2.41.patch
+++ b/3.2.70/1040_linux-3.2.41.patch
diff --git a/3.2.69/1041_linux-3.2.42.patch b/3.2.70/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.69/1041_linux-3.2.42.patch
+++ b/3.2.70/1041_linux-3.2.42.patch
diff --git a/3.2.69/1042_linux-3.2.43.patch b/3.2.70/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.69/1042_linux-3.2.43.patch
+++ b/3.2.70/1042_linux-3.2.43.patch
diff --git a/3.2.69/1043_linux-3.2.44.patch b/3.2.70/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.69/1043_linux-3.2.44.patch
+++ b/3.2.70/1043_linux-3.2.44.patch
diff --git a/3.2.69/1044_linux-3.2.45.patch b/3.2.70/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.69/1044_linux-3.2.45.patch
+++ b/3.2.70/1044_linux-3.2.45.patch
diff --git a/3.2.69/1045_linux-3.2.46.patch b/3.2.70/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.69/1045_linux-3.2.46.patch
+++ b/3.2.70/1045_linux-3.2.46.patch
diff --git a/3.2.69/1046_linux-3.2.47.patch b/3.2.70/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.69/1046_linux-3.2.47.patch
+++ b/3.2.70/1046_linux-3.2.47.patch
diff --git a/3.2.69/1047_linux-3.2.48.patch b/3.2.70/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.69/1047_linux-3.2.48.patch
+++ b/3.2.70/1047_linux-3.2.48.patch
diff --git a/3.2.69/1048_linux-3.2.49.patch b/3.2.70/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.69/1048_linux-3.2.49.patch
+++ b/3.2.70/1048_linux-3.2.49.patch
diff --git a/3.2.69/1049_linux-3.2.50.patch b/3.2.70/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.69/1049_linux-3.2.50.patch
+++ b/3.2.70/1049_linux-3.2.50.patch
diff --git a/3.2.69/1050_linux-3.2.51.patch b/3.2.70/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.69/1050_linux-3.2.51.patch
+++ b/3.2.70/1050_linux-3.2.51.patch
diff --git a/3.2.69/1051_linux-3.2.52.patch b/3.2.70/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.69/1051_linux-3.2.52.patch
+++ b/3.2.70/1051_linux-3.2.52.patch
diff --git a/3.2.69/1052_linux-3.2.53.patch b/3.2.70/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.69/1052_linux-3.2.53.patch
+++ b/3.2.70/1052_linux-3.2.53.patch
diff --git a/3.2.69/1053_linux-3.2.54.patch b/3.2.70/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.69/1053_linux-3.2.54.patch
+++ b/3.2.70/1053_linux-3.2.54.patch
diff --git a/3.2.69/1054_linux-3.2.55.patch b/3.2.70/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.69/1054_linux-3.2.55.patch
+++ b/3.2.70/1054_linux-3.2.55.patch
diff --git a/3.2.69/1055_linux-3.2.56.patch b/3.2.70/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.69/1055_linux-3.2.56.patch
+++ b/3.2.70/1055_linux-3.2.56.patch
diff --git a/3.2.69/1056_linux-3.2.57.patch b/3.2.70/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.69/1056_linux-3.2.57.patch
+++ b/3.2.70/1056_linux-3.2.57.patch
diff --git a/3.2.69/1057_linux-3.2.58.patch b/3.2.70/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.69/1057_linux-3.2.58.patch
+++ b/3.2.70/1057_linux-3.2.58.patch
diff --git a/3.2.69/1058_linux-3.2.59.patch b/3.2.70/1058_linux-3.2.59.patch
index cd59fe9..cd59fe9 100644
--- a/3.2.69/1058_linux-3.2.59.patch
+++ b/3.2.70/1058_linux-3.2.59.patch
diff --git a/3.2.69/1059_linux-3.2.60.patch b/3.2.70/1059_linux-3.2.60.patch
index c5a9389..c5a9389 100644
--- a/3.2.69/1059_linux-3.2.60.patch
+++ b/3.2.70/1059_linux-3.2.60.patch
diff --git a/3.2.69/1060_linux-3.2.61.patch b/3.2.70/1060_linux-3.2.61.patch
index a1bf580..a1bf580 100644
--- a/3.2.69/1060_linux-3.2.61.patch
+++ b/3.2.70/1060_linux-3.2.61.patch
diff --git a/3.2.69/1061_linux-3.2.62.patch b/3.2.70/1061_linux-3.2.62.patch
index 34217f0..34217f0 100644
--- a/3.2.69/1061_linux-3.2.62.patch
+++ b/3.2.70/1061_linux-3.2.62.patch
diff --git a/3.2.69/1062_linux-3.2.63.patch b/3.2.70/1062_linux-3.2.63.patch
index f7c7415..f7c7415 100644
--- a/3.2.69/1062_linux-3.2.63.patch
+++ b/3.2.70/1062_linux-3.2.63.patch
diff --git a/3.2.69/1063_linux-3.2.64.patch b/3.2.70/1063_linux-3.2.64.patch
index 862b4f0..862b4f0 100644
--- a/3.2.69/1063_linux-3.2.64.patch
+++ b/3.2.70/1063_linux-3.2.64.patch
diff --git a/3.2.69/1064_linux-3.2.65.patch b/3.2.70/1064_linux-3.2.65.patch
index c3ae4fa..c3ae4fa 100644
--- a/3.2.69/1064_linux-3.2.65.patch
+++ b/3.2.70/1064_linux-3.2.65.patch
diff --git a/3.2.69/1065_linux-3.2.66.patch b/3.2.70/1065_linux-3.2.66.patch
index 73fa646..73fa646 100644
--- a/3.2.69/1065_linux-3.2.66.patch
+++ b/3.2.70/1065_linux-3.2.66.patch
diff --git a/3.2.69/1066_linux-3.2.67.patch b/3.2.70/1066_linux-3.2.67.patch
index c0a9278..c0a9278 100644
--- a/3.2.69/1066_linux-3.2.67.patch
+++ b/3.2.70/1066_linux-3.2.67.patch
diff --git a/3.2.69/1067_linux-3.2.68.patch b/3.2.70/1067_linux-3.2.68.patch
index 200e8b8..200e8b8 100644
--- a/3.2.69/1067_linux-3.2.68.patch
+++ b/3.2.70/1067_linux-3.2.68.patch
diff --git a/3.2.69/1068_linux-3.2.69.patch b/3.2.70/1068_linux-3.2.69.patch
index 8848e8e..8848e8e 100644
--- a/3.2.69/1068_linux-3.2.69.patch
+++ b/3.2.70/1068_linux-3.2.69.patch
diff --git a/3.2.70/1069_linux-3.2.70.patch b/3.2.70/1069_linux-3.2.70.patch
new file mode 100644
index 0000000..b694627
--- /dev/null
+++ b/3.2.70/1069_linux-3.2.70.patch
@@ -0,0 +1,5879 @@
+diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
+index c67077c..e1a3d59 100644
+--- a/Documentation/networking/rds.txt
++++ b/Documentation/networking/rds.txt
+@@ -62,11 +62,10 @@ Socket Interface
+ ================
+ 
+   AF_RDS, PF_RDS, SOL_RDS
+-        These constants haven't been assigned yet, because RDS isn't in
+-        mainline yet. Currently, the kernel module assigns some constant
+-        and publishes it to user space through two sysctl files
+-                /proc/sys/net/rds/pf_rds
+-                /proc/sys/net/rds/sol_rds
++	AF_RDS and PF_RDS are the domain type to be used with socket(2)
++	to create RDS sockets. SOL_RDS is the socket-level to be used
++	with setsockopt(2) and getsockopt(2) for RDS specific socket
++	options.
+ 
+   fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
+         This creates a new, unbound RDS socket.
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index b04cb7d..074da62 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -164,8 +164,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
+ }
+ 
+ static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
+-			       unsigned ** const pins,
+-			       unsigned * const num_pins)
++			       const unsigned **pins,
++			       unsigned *num_pins)
+ {
+ 	*pins = (unsigned *) foo_groups[selector].pins;
+ 	*num_pins = foo_groups[selector].num_pins;
+diff --git a/Makefile b/Makefile
+index 8071888..41a626b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 0e9ce8d..a4b1186 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE	(TASK_SIZE / 3 * 2)
+ 
+ /* When the program starts, a1 contains a pointer to a function to be 
+    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
+diff --git a/arch/mips/include/asm/cacheflush.h b/arch/mips/include/asm/cacheflush.h
+index 69468de..484c5bc 100644
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -29,6 +29,20 @@
+  *  - flush_icache_all() flush the entire instruction cache
+  *  - flush_data_cache_page() flushes a page from the data cache
+  */
++
++ /*
++ * This flag is used to indicate that the page pointed to by a pte
++ * is dirty and requires cleaning before returning it to the user.
++ */
++#define PG_dcache_dirty			PG_arch_1
++
++#define Page_dcache_dirty(page)		\
++	test_bit(PG_dcache_dirty, &(page)->flags)
++#define SetPageDcacheDirty(page)	\
++	set_bit(PG_dcache_dirty, &(page)->flags)
++#define ClearPageDcacheDirty(page)	\
++	clear_bit(PG_dcache_dirty, &(page)->flags)
++
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+@@ -37,13 +51,15 @@ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ 	unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
+ extern void __flush_dcache_page(struct page *page);
++extern void __flush_icache_page(struct vm_area_struct *vma, struct page *page);
+ 
+ #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1
+ static inline void flush_dcache_page(struct page *page)
+ {
+-	if (cpu_has_dc_aliases || !cpu_has_ic_fills_f_dc)
++	if (cpu_has_dc_aliases)
+ 		__flush_dcache_page(page);
+-
++	else if (!cpu_has_ic_fills_f_dc)
++		SetPageDcacheDirty(page);
+ }
+ 
+ #define flush_dcache_mmap_lock(mapping)		do { } while (0)
+@@ -61,6 +77,11 @@ static inline void flush_anon_page(struct vm_area_struct *vma,
+ static inline void flush_icache_page(struct vm_area_struct *vma,
+ 	struct page *page)
+ {
++	if (!cpu_has_ic_fills_f_dc && (vma->vm_flags & VM_EXEC) &&
++	    Page_dcache_dirty(page)) {
++		__flush_icache_page(vma, page);
++		ClearPageDcacheDirty(page);
++	}
+ }
+ 
+ extern void (*flush_icache_range)(unsigned long start, unsigned long end);
+@@ -95,19 +116,6 @@ extern void (*flush_icache_all)(void);
+ extern void (*local_flush_data_cache_page)(void * addr);
+ extern void (*flush_data_cache_page)(unsigned long addr);
+ 
+-/*
+- * This flag is used to indicate that the page pointed to by a pte
+- * is dirty and requires cleaning before returning it to the user.
+- */
+-#define PG_dcache_dirty			PG_arch_1
+-
+-#define Page_dcache_dirty(page)		\
+-	test_bit(PG_dcache_dirty, &(page)->flags)
+-#define SetPageDcacheDirty(page)	\
+-	set_bit(PG_dcache_dirty, &(page)->flags)
+-#define ClearPageDcacheDirty(page)	\
+-	clear_bit(PG_dcache_dirty, &(page)->flags)
+-
+ /* Run kernel code uncached, useful for cache probing functions. */
+ unsigned long run_uncached(void *func);
+ 
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index ca400f7..0f4991b 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -153,8 +153,32 @@
+ #define cpu_has_mips_r	(cpu_has_mips32r1 | cpu_has_mips32r2 | \
+ 			 cpu_has_mips64r1 | cpu_has_mips64r2)
+ 
++/*
++ * cpu_has_mips_r2_exec_hazard - return if IHB is required on current processor
++ *
++ * Returns non-zero value if the current processor implementation requires
++ * an IHB instruction to deal with an instruction hazard as per MIPS R2
++ * architecture specification, zero otherwise.
++ */
+ #ifndef cpu_has_mips_r2_exec_hazard
+-#define cpu_has_mips_r2_exec_hazard cpu_has_mips_r2
++#define cpu_has_mips_r2_exec_hazard					\
++({									\
++	int __res;							\
++									\
++	switch (current_cpu_type()) {					\
++	case CPU_74K:							\
++	case CPU_CAVIUM_OCTEON:						\
++	case CPU_CAVIUM_OCTEON_PLUS:					\
++	case CPU_CAVIUM_OCTEON2:					\
++		__res = 0;						\
++		break;							\
++									\
++	default:							\
++		__res = 1;						\
++	}								\
++									\
++	__res;								\
++})
+ #endif
+ 
+ /*
+diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+index a58addb..6ae8e3c 100644
+--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+@@ -51,7 +51,6 @@
+ #define cpu_has_mips32r2	0
+ #define cpu_has_mips64r1	0
+ #define cpu_has_mips64r2	1
+-#define cpu_has_mips_r2_exec_hazard 0
+ #define cpu_has_dsp		0
+ #define cpu_has_mipsmt		0
+ #define cpu_has_vint		0
+diff --git a/arch/mips/include/asm/octeon/pci-octeon.h b/arch/mips/include/asm/octeon/pci-octeon.h
+index fba2ba2..ac83283 100644
+--- a/arch/mips/include/asm/octeon/pci-octeon.h
++++ b/arch/mips/include/asm/octeon/pci-octeon.h
+@@ -11,9 +11,6 @@
+ 
+ #include <linux/pci.h>
+ 
+-/* Some PCI cards require delays when accessing config space. */
+-#define PCI_CONFIG_SPACE_DELAY 10000
+-
+ /*
+  * The physical memory base mapped by BAR1.  256MB at the end of the
+  * first 4GB.
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index 7f50318..6e489e5 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -111,7 +111,7 @@ void __init init_IRQ(void)
+ #endif
+ }
+ 
+-#ifdef DEBUG_STACKOVERFLOW
++#ifdef CONFIG_DEBUG_STACKOVERFLOW
+ static inline void check_stack_overflow(void)
+ {
+ 	unsigned long sp;
+diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
+index 829320c..0f8839b 100644
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -118,6 +118,18 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr)
+ 
+ EXPORT_SYMBOL(__flush_anon_page);
+ 
++void __flush_icache_page(struct vm_area_struct *vma, struct page *page)
++{
++	unsigned long addr;
++
++	if (PageHighMem(page))
++		return;
++
++	addr = (unsigned long) page_address(page);
++	flush_data_cache_page(addr);
++}
++EXPORT_SYMBOL_GPL(__flush_icache_page);
++
+ void __update_cache(struct vm_area_struct *vma, unsigned long address,
+ 	pte_t pte)
+ {
+diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
+index ed1c542..66d3c38 100644
+--- a/arch/mips/pci/pci-octeon.c
++++ b/arch/mips/pci/pci-octeon.c
+@@ -279,9 +279,6 @@ static int octeon_read_config(struct pci_bus *bus, unsigned int devfn,
+ 	pci_addr.s.func = devfn & 0x7;
+ 	pci_addr.s.reg = reg;
+ 
+-#if PCI_CONFIG_SPACE_DELAY
+-	udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ 	switch (size) {
+ 	case 4:
+ 		*val = le32_to_cpu(cvmx_read64_uint32(pci_addr.u64));
+@@ -316,9 +313,6 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+ 	pci_addr.s.func = devfn & 0x7;
+ 	pci_addr.s.reg = reg;
+ 
+-#if PCI_CONFIG_SPACE_DELAY
+-	udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ 	switch (size) {
+ 	case 4:
+ 		cvmx_write64_uint32(pci_addr.u64, cpu_to_le32(val));
+diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
+index 0583c463..37a8790 100644
+--- a/arch/mips/pci/pcie-octeon.c
++++ b/arch/mips/pci/pcie-octeon.c
+@@ -1219,9 +1219,6 @@ static inline int octeon_pcie_write_config(int pcie_port, struct pci_bus *bus,
+ 					devfn & 0x7, reg, val);
+ 		return PCIBIOS_SUCCESSFUL;
+ 	}
+-#if PCI_CONFIG_SPACE_DELAY
+-	udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ 	return PCIBIOS_FUNC_NOT_SUPPORTED;
+ }
+ 
+diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
+index 5bf34ec..2ca1735 100644
+--- a/arch/mips/power/hibernate.S
++++ b/arch/mips/power/hibernate.S
+@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend)
+ END(swsusp_arch_suspend)
+ 
+ LEAF(swsusp_arch_resume)
++	/* Avoid TLB mismatch during and after kernel resume */
++	jal local_flush_tlb_all
+ 	PTR_L t0, restore_pblist
+ 0:
+ 	PTR_L t1, PBE_ADDRESS(t0)   /* source */
+@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume)
+ 	bne t1, t3, 1b
+ 	PTR_L t0, PBE_NEXT(t0)
+ 	bnez t0, 0b
+-	jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
+ 	PTR_LA t0, saved_regs
+ 	PTR_L ra, PT_R31(t0)
+ 	PTR_L sp, PT_R29(t0)
+diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
+index a7bb757..c3f1be95 100644
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -121,11 +121,13 @@ extern void __ashrdi3(void);
+ extern void __ashldi3(void);
+ extern void __lshrdi3(void);
+ extern void __muldi3(void);
++extern void __ucmpdi2(void);
+ 
+ EXPORT_SYMBOL(__ashrdi3);
+ EXPORT_SYMBOL(__ashldi3);
+ EXPORT_SYMBOL(__lshrdi3);
+ EXPORT_SYMBOL(__muldi3);
++EXPORT_SYMBOL(__ucmpdi2);
+ 
+ asmlinkage void * __canonicalize_funcptr_for_compare(void *);
+ EXPORT_SYMBOL(__canonicalize_funcptr_for_compare);
+diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
+index 5f2e690..5651536 100644
+--- a/arch/parisc/lib/Makefile
++++ b/arch/parisc/lib/Makefile
+@@ -2,6 +2,7 @@
+ # Makefile for parisc-specific library files
+ #
+ 
+-lib-y	:= lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o
++lib-y	:= lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
++	   ucmpdi2.o
+ 
+ obj-y	:= iomap.o
+diff --git a/arch/parisc/lib/ucmpdi2.c b/arch/parisc/lib/ucmpdi2.c
+new file mode 100644
+index 0000000..149c016
+--- /dev/null
++++ b/arch/parisc/lib/ucmpdi2.c
+@@ -0,0 +1,25 @@
++#include <linux/module.h>
++
++union ull_union {
++	unsigned long long ull;
++	struct {
++		unsigned int high;
++		unsigned int low;
++	} ui;
++};
++
++int __ucmpdi2(unsigned long long a, unsigned long long b)
++{
++	union ull_union au = {.ull = a};
++	union ull_union bu = {.ull = b};
++
++	if (au.ui.high < bu.ui.high)
++		return 0;
++	else if (au.ui.high > bu.ui.high)
++		return 2;
++	if (au.ui.low < bu.ui.low)
++		return 0;
++	else if (au.ui.low > bu.ui.low)
++		return 2;
++	return 1;
++}
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 02ebe1a..4f15565 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -62,12 +62,22 @@ struct cache_type_info {
+ };
+ 
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED     0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA        2
++#define CACHE_TYPE_UNIFIED     0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D   1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA        3
+ 
+ static const struct cache_type_info cache_type_info[] = {
+ 	{
++		/* Embedded systems that use cache-size, cache-block-size,
++		 * etc. for the Unified (typically L2) cache. */
++		.name            = "Unified",
++		.size_prop       = "cache-size",
++		.line_size_props = { "cache-line-size",
++				     "cache-block-size", },
++		.nr_sets_prop    = "cache-sets",
++	},
++	{
+ 		/* PowerPC Processor binding says the [di]-cache-*
+ 		 * must be equal on unified caches, so just use
+ 		 * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
+ {
+ 	struct cache *iter;
+ 
+-	if (cache->type == CACHE_TYPE_UNIFIED)
++	if (cache->type == CACHE_TYPE_UNIFIED ||
++	    cache->type == CACHE_TYPE_UNIFIED_D)
+ 		return cache;
+ 
+ 	list_for_each_entry(iter, &cache_list, list)
+@@ -324,15 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np)
+ 	return of_get_property(np, "cache-unified", NULL);
+ }
+ 
+-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++/*
++ * Unified caches can have two different sets of tags.  Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc.   Check on initialization for which type we have, and
++ * return the appropriate structure type.  Assume it's embedded if it isn't
++ * open firmware.  If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+-	struct cache *cache;
++	return of_get_property(np,
++		cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++		CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+ 
++/*
++ */
++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ 	pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+ 
+-	cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+-	return cache;
++	return new_cache(cache_is_unified_d(node), level, node);
+ }
+ 
+ static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
+diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c
+index 564c1d8..e80026c 100644
+--- a/arch/powerpc/kernel/perf_callchain.c
++++ b/arch/powerpc/kernel/perf_callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
+ 	sp = regs->gpr[1];
+ 	perf_callchain_store(entry, next_ip);
+ 
+-	for (;;) {
++	while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ 		fp = (unsigned long __user *) sp;
+ 		if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ 			return;
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 82288e9..83940d7 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -428,7 +428,7 @@ void __init smp_setup_cpu_maps(void)
+ 	DBG("smp_setup_cpu_maps()\n");
+ 
+ 	while ((dn = of_find_node_by_type(dn, "cpu")) && cpu < nr_cpu_ids) {
+-		const int *intserv;
++		const __be32 *intserv;
+ 		int j, len;
+ 
+ 		DBG("  * %s...\n", dn->full_name);
+@@ -447,10 +447,18 @@ void __init smp_setup_cpu_maps(void)
+ 		}
+ 
+ 		for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
++			bool avail;
++
+ 			DBG("    thread %d -> cpu %d (hard id %d)\n",
+-			    j, cpu, intserv[j]);
+-			set_cpu_present(cpu, of_device_is_available(dn));
+-			set_hard_smp_processor_id(cpu, intserv[j]);
++			    j, cpu, be32_to_cpu(intserv[j]));
++
++			avail = of_device_is_available(dn);
++			if (!avail)
++				avail = !of_property_match_string(dn,
++						"enable-method", "spin-table");
++
++			set_cpu_present(cpu, avail);
++			set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
+ 			set_cpu_possible(cpu, true);
+ 			cpu++;
+ 		}
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 3e8fe4b..cec664a 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -212,6 +212,7 @@ SECTIONS
+ 		*(.opd)
+ 	}
+ 
++	. = ALIGN(256);
+ 	.got : AT(ADDR(.got) - LOAD_OFFSET) {
+ 		__toc_start = .;
+ 		*(.got)
+diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
+index 5a783d8..67a42ed 100644
+--- a/arch/powerpc/mm/mmap_64.c
++++ b/arch/powerpc/mm/mmap_64.c
+@@ -53,14 +53,6 @@ static inline int mmap_is_legacy(void)
+ 	return sysctl_legacy_va_layout;
+ }
+ 
+-/*
+- * Since get_random_int() returns the same value within a 1 jiffy window,
+- * we will almost always get the same randomisation for the stack and mmap
+- * region. This will mean the relative distance between stack and mmap will
+- * be the same.
+- *
+- * To avoid this we can shift the randomness by 1 bit.
+- */
+ static unsigned long mmap_rnd(void)
+ {
+ 	unsigned long rnd = 0;
+@@ -68,11 +60,11 @@ static unsigned long mmap_rnd(void)
+ 	if (current->flags & PF_RANDOMIZE) {
+ 		/* 8MB for 32bit, 1GB for 64bit */
+ 		if (is_32bit_task())
+-			rnd = (long)(get_random_int() % (1<<(22-PAGE_SHIFT)));
++			rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+ 		else
+-			rnd = (long)(get_random_int() % (1<<(29-PAGE_SHIFT)));
++			rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+ 	}
+-	return (rnd << PAGE_SHIFT) * 2;
++	return rnd << PAGE_SHIFT;
+ }
+ 
+ static inline unsigned long mmap_base(void)
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 0f1b706..2767276 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ 		goto out;
+ 	}
+ 
++	rc = dlpar_acquire_drc(drc_index);
++	if (rc) {
++		rc = -EINVAL;
++		goto out;
++	}
++
+ 	dn = dlpar_configure_connector(drc_index);
+ 	if (!dn) {
+ 		rc = -EINVAL;
+@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ 	kfree(dn->full_name);
+ 	dn->full_name = cpu_name;
+ 
+-	rc = dlpar_acquire_drc(drc_index);
+-	if (rc) {
+-		dlpar_free_cc_nodes(dn);
+-		rc = -EINVAL;
+-		goto out;
+-	}
+-
+ 	rc = dlpar_attach_node(dn);
+ 	if (rc) {
+ 		dlpar_release_drc(drc_index);
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index 31086ea..568521a 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -16,11 +16,12 @@
+ #define GHASH_DIGEST_SIZE	16
+ 
+ struct ghash_ctx {
+-	u8 icv[16];
+-	u8 key[16];
++	u8 key[GHASH_BLOCK_SIZE];
+ };
+ 
+ struct ghash_desc_ctx {
++	u8 icv[GHASH_BLOCK_SIZE];
++	u8 key[GHASH_BLOCK_SIZE];
+ 	u8 buffer[GHASH_BLOCK_SIZE];
+ 	u32 bytes;
+ };
+@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
+ static int ghash_init(struct shash_desc *desc)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ 
+ 	memset(dctx, 0, sizeof(*dctx));
++	memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
+ 
+ 	return 0;
+ }
+@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ 	}
+ 
+ 	memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
+-	memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
+ 
+ 	return 0;
+ }
+@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
+ 			 const u8 *src, unsigned int srclen)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+-	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ 	unsigned int n;
+ 	u8 *buf = dctx->buffer;
+ 	int ret;
+@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
+ 		src += n;
+ 
+ 		if (!dctx->bytes) {
+-			ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
++			ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
+ 					      GHASH_BLOCK_SIZE);
+ 			if (ret != GHASH_BLOCK_SIZE)
+ 				return -EIO;
+@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc,
+ 
+ 	n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ 	if (n) {
+-		ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
++		ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
+ 		if (ret != n)
+ 			return -EIO;
+ 		src += n;
+@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc,
+ 	return 0;
+ }
+ 
+-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_desc_ctx *dctx)
+ {
+ 	u8 *buf = dctx->buffer;
+ 	int ret;
+@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+ 
+ 		memset(pos, 0, dctx->bytes);
+ 
+-		ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
++		ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
+ 		if (ret != GHASH_BLOCK_SIZE)
+ 			return -EIO;
++
++		dctx->bytes = 0;
+ 	}
+ 
+-	dctx->bytes = 0;
+ 	return 0;
+ }
+ 
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+-	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ 	int ret;
+ 
+-	ret = ghash_flush(ctx, dctx);
++	ret = ghash_flush(dctx);
+ 	if (!ret)
+-		memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++		memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
+ 	return ret;
+ }
+ 
+diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
+index 47df775..ba17092 100644
+--- a/arch/s390/kernel/suspend.c
++++ b/arch/s390/kernel/suspend.c
+@@ -9,6 +9,8 @@
+ #include <linux/pfn.h>
+ #include <linux/suspend.h>
+ #include <linux/mm.h>
++#include <asm/ipl.h>
++#include <asm/sections.h>
+ #include <asm/system.h>
+ 
+ /*
+@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn)
+ {
+ 	unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
+ 	unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
++	unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
++	unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
+ 
+ 	/* Always save lowcore pages (LC protection might be enabled). */
+ 	if (pfn <= LC_PAGES)
+@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn)
+ 	if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
+ 		return 1;
+ 	/* Skip memory holes and read-only pages (NSS, DCSS, ...). */
++	if (pfn >= stext_pfn && pfn <= eshared_pfn)
++		return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
+ 	if (tprot(PFN_PHYS(pfn)))
+ 		return 1;
+ 	return 0;
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index d026389..c593e1e 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -219,6 +219,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
+ 	for (n = mem->count - 1; n > 0 ; n--)
+ 		memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
+ 
++	memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
+ 	mem->vm[0].cpus_total = cpus;
+ 	mem->vm[0].cpus_configured = cpus;
+ 	mem->vm[0].cpus_standby = 0;
+diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c
+index f1cf6ef..a0ef32e 100644
+--- a/arch/sparc/kernel/leon_pci.c
++++ b/arch/sparc/kernel/leon_pci.c
+@@ -78,7 +78,6 @@ EXPORT_SYMBOL(pcibios_bus_to_resource);
+ 
+ void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
+ {
+-	struct leon_pci_info *info = pbus->sysdata;
+ 	struct pci_dev *dev;
+ 	int i, has_io, has_mem;
+ 	u16 cmd;
+@@ -153,18 +152,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
+ 	return pci_enable_resources(dev, mask);
+ }
+ 
+-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev)
+-{
+-	/*
+-	 * Currently the OpenBoot nodes are not connected with the PCI device,
+-	 * this is because the LEON PROM does not create PCI nodes. Eventually
+-	 * this will change and the same approach as pcic.c can be used to
+-	 * match PROM nodes with pci devices.
+-	 */
+-	return NULL;
+-}
+-EXPORT_SYMBOL(pci_device_to_OF_node);
+-
+ void __devinit pcibios_update_irq(struct pci_dev *dev, int irq)
+ {
+ #ifdef CONFIG_PCI_DEBUG
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 5e4252b..0ff682d 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -368,11 +368,11 @@ static unsigned long mmap_rnd(void)
+ 	if (current->flags & PF_RANDOMIZE) {
+ 		unsigned long val = get_random_int();
+ 		if (test_thread_flag(TIF_32BIT))
+-			rnd = (val % (1UL << (22UL-PAGE_SHIFT)));
++			rnd = (val % (1UL << (23UL-PAGE_SHIFT)));
+ 		else
+-			rnd = (val % (1UL << (29UL-PAGE_SHIFT)));
++			rnd = (val % (1UL << (30UL-PAGE_SHIFT)));
+ 	}
+-	return (rnd << PAGE_SHIFT) * 2;
++	return rnd << PAGE_SHIFT;
+ }
+ 
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 28a1bca..d720208 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -133,7 +133,8 @@ config SBUS
+ 	bool
+ 
+ config NEED_DMA_MAP_STATE
+-       def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG)
++	def_bool y
++	depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
+ 
+ config NEED_SG_DMA_LENGTH
+ 	def_bool y
+diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
+index f229b13..0c54822 100644
+--- a/arch/x86/include/asm/iommu_table.h
++++ b/arch/x86/include/asm/iommu_table.h
+@@ -79,11 +79,12 @@ struct iommu_table_entry {
+  *  d). Similar to the 'init', except that this gets called from pci_iommu_init
+  *      where we do have a memory allocator.
+  *
+- * The standard vs the _FINISH differs in that the _FINISH variant will
+- * continue detecting other IOMMUs in the call list after the
+- * the detection routine returns a positive number. The _FINISH will
+- * stop the execution chain. Both will still call the 'init' and
+- * 'late_init' functions if they are set.
++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
++ * in that the former will continue detecting other IOMMUs in the call
++ * list after the detection routine returns a positive number, while the
++ * latter will stop the execution chain upon first successful detection.
++ * Both variants will still call the 'init' and 'late_init' functions if
++ * they are set.
+  */
+ #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init)		\
+ 	__IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 41b2f57..78842ce 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -700,9 +700,12 @@ void native_machine_shutdown(void)
+ 	/* Make certain I only run on the appropriate processor */
+ 	set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
+ 
+-	/* O.K Now that I'm on the appropriate processor,
+-	 * stop all of the others.
++	/*
++	 * O.K Now that I'm on the appropriate processor, stop all of the
++	 * others. Also disable the local irq to not receive the per-cpu
++	 * timer interrupt which may trigger scheduler's load balance.
+ 	 */
++	local_irq_disable();
+ 	stop_other_cpus();
+ #endif
+ 
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index bfc9507..4a949c7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3609,7 +3609,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ 		}
+ 	}
+ 
+-	mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
++	mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
+ 	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+ 		pte_size = sp->role.cr4_pae ? 8 : 4;
+ 		misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 8831c43..421958f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3032,8 +3032,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+ 
+ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+-	unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
+-		    KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
++	/*
++	 * Pass through host's Machine Check Enable value to hw_cr4, which
++	 * is in force while we are in guest mode.  Do not let guests control
++	 * this bit, even if host CR4.MCE == 0.
++	 */
++	unsigned long hw_cr4 =
++		(read_cr4() & X86_CR4_MCE) |
++		(cr4 & ~X86_CR4_MCE) |
++		(to_vmx(vcpu)->rmode.vm86_active ?
++		 KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
+ 
+ 	if (cr4 & X86_CR4_VMXE) {
+ 		/*
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 554b7b5..433b21d 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n)
+ 	char c;
+ 
+ 	while (1) {
+-		if (res>n)
++		if (res >= n)
+ 			return n+1;
+ 		if (__get_user(c, s))
+ 			return 0;
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 5a5b6e4..11e3100 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -150,7 +150,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 	}
+ 	cleanup_addr = proglen; /* epilogue address */
+ 
+-	for (pass = 0; pass < 10; pass++) {
++	/* JITed image shrinks with every pass and the loop iterates
++	 * until the image stops shrinking. Very large bpf programs
++	 * may converge on the last pass. In such case do one more
++	 * pass to emit the final image
++	 */
++	for (pass = 0; pass < 10 || image; pass++) {
+ 		u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ 		/* no prologue/epilogue for trivial filters (RET something) */
+ 		proglen = 0;
+diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
+index b7491ee..6454fe6 100644
+--- a/drivers/acpi/acpica/acmacros.h
++++ b/drivers/acpi/acpica/acmacros.h
+@@ -59,19 +59,15 @@
+ #define ACPI_SET64(ptr)                 *ACPI_CAST_PTR (u64, ptr)
+ 
+ /*
+- * printf() format helpers
++ * printf() format helper. This macros is a workaround for the difficulties
++ * with emitting 64-bit integers and 64-bit pointers with the same code
++ * for both 32-bit and 64-bit hosts.
+  */
+ 
+ /* Split 64-bit integer into two 32-bit values. Use with %8.8_x%8.8_x */
+ 
+ #define ACPI_FORMAT_UINT64(i)           ACPI_HIDWORD(i), ACPI_LODWORD(i)
+ 
+-#if ACPI_MACHINE_WIDTH == 64
+-#define ACPI_FORMAT_NATIVE_UINT(i)      ACPI_FORMAT_UINT64(i)
+-#else
+-#define ACPI_FORMAT_NATIVE_UINT(i)      0, (i)
+-#endif
+-
+ /*
+  * Macros for moving data around to/from buffers that are possibly unaligned.
+  * If the hardware supports the transfer of unaligned data, just do the store.
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index c627a28..9d19587 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ 			  obj_desc,
+-			  ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++			  ACPI_FORMAT_UINT64(obj_desc->region.address),
+ 			  obj_desc->region.length));
+ 
+ 	/* Now the address and length are valid for this opregion */
+@@ -545,7 +545,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ 			  obj_desc,
+-			  ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++			  ACPI_FORMAT_UINT64(obj_desc->region.address),
+ 			  obj_desc->region.length));
+ 
+ 	/* Now the address and length are valid for this opregion */
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index f0edf5c..cb18ab4 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -450,8 +450,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
+ 	ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ 			  "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ 			  &region_obj->region.handler->address_space, handler,
+-			  ACPI_FORMAT_NATIVE_UINT(region_obj->region.address +
+-						  region_offset),
++			  ACPI_FORMAT_UINT64(region_obj->region.address +
++					     region_offset),
+ 			  acpi_ut_get_region_name(region_obj->region.
+ 						  space_id)));
+ 
+diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
+index 61b8c0e..c572fa0 100644
+--- a/drivers/acpi/acpica/exdump.c
++++ b/drivers/acpi/acpica/exdump.c
+@@ -613,8 +613,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)
+ 			acpi_os_printf("\n");
+ 		} else {
+ 			acpi_os_printf(" base %8.8X%8.8X Length %X\n",
+-				       ACPI_FORMAT_NATIVE_UINT(obj_desc->region.
+-							       address),
++				       ACPI_FORMAT_UINT64(obj_desc->region.
++							  address),
+ 				       obj_desc->region.length);
+ 		}
+ 		break;
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index b334f54..be22142 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -257,17 +257,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc,
+ 	}
+ 
+ 	ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD,
+-			      " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n",
++			      " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n",
+ 			      acpi_ut_get_region_name(rgn_desc->region.
+ 						      space_id),
+ 			      rgn_desc->region.space_id,
+ 			      obj_desc->common_field.access_byte_width,
+ 			      obj_desc->common_field.base_byte_offset,
+-			      field_datum_byte_offset, ACPI_CAST_PTR(void,
+-								     (rgn_desc->
+-								      region.
+-								      address +
+-								      region_offset))));
++			      field_datum_byte_offset,
++			      ACPI_FORMAT_UINT64(rgn_desc->region.address +
++						 region_offset)));
+ 
+ 	/* Invoke the appropriate address_space/op_region handler */
+ 
+diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
+index f0d5e14..dd5e930 100644
+--- a/drivers/acpi/acpica/exregion.c
++++ b/drivers/acpi/acpica/exregion.c
+@@ -174,7 +174,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ 		if (!mem_info->mapped_logical_address) {
+ 			ACPI_ERROR((AE_INFO,
+ 				    "Could not map memory at 0x%8.8X%8.8X, size %u",
+-				    ACPI_FORMAT_NATIVE_UINT(address),
++				    ACPI_FORMAT_UINT64(address),
+ 				    (u32) map_length));
+ 			mem_info->mapped_length = 0;
+ 			return_ACPI_STATUS(AE_NO_MEMORY);
+@@ -195,8 +195,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ 			  "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n",
+-			  bit_width, function,
+-			  ACPI_FORMAT_NATIVE_UINT(address)));
++			  bit_width, function, ACPI_FORMAT_UINT64(address)));
+ 
+ 	/*
+ 	 * Perform the memory read or write
+@@ -298,8 +297,7 @@ acpi_ex_system_io_space_handler(u32 function,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ 			  "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n",
+-			  bit_width, function,
+-			  ACPI_FORMAT_NATIVE_UINT(address)));
++			  bit_width, function, ACPI_FORMAT_UINT64(address)));
+ 
+ 	/* Decode the function parameter */
+ 
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 5f16058..d43b8af 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -141,17 +141,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ 	byte_width = ACPI_DIV_8(bit_width);
+ 	last_address = address + byte_width - 1;
+ 
+-	ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X",
+-			  ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void,
+-								      last_address),
+-			  byte_width));
++	ACPI_DEBUG_PRINT((ACPI_DB_IO,
++			  "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X",
++			  ACPI_FORMAT_UINT64(address),
++			  ACPI_FORMAT_UINT64(last_address), byte_width));
+ 
+ 	/* Maximum 16-bit address in I/O space */
+ 
+ 	if (last_address > ACPI_UINT16_MAX) {
+ 		ACPI_ERROR((AE_INFO,
+-			    "Illegal I/O port address/length above 64K: %p/0x%X",
+-			    ACPI_CAST_PTR(void, address), byte_width));
++			    "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X",
++			    ACPI_FORMAT_UINT64(address), byte_width));
+ 		return_ACPI_STATUS(AE_LIMIT);
+ 	}
+ 
+@@ -180,8 +180,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ 
+ 			if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ 				ACPI_DEBUG_PRINT((ACPI_DB_IO,
+-						  "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)",
+-						  ACPI_CAST_PTR(void, address),
++						  "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)",
++						  ACPI_FORMAT_UINT64(address),
+ 						  byte_width, port_info->name,
+ 						  port_info->start,
+ 						  port_info->end));
+diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
+index b683cc2..0a68c73 100644
+--- a/drivers/acpi/acpica/nsdump.c
++++ b/drivers/acpi/acpica/nsdump.c
+@@ -251,12 +251,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ 		switch (type) {
+ 		case ACPI_TYPE_PROCESSOR:
+ 
+-			acpi_os_printf("ID %X Len %.4X Addr %p\n",
++			acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n",
+ 				       obj_desc->processor.proc_id,
+ 				       obj_desc->processor.length,
+-				       ACPI_CAST_PTR(void,
+-						     obj_desc->processor.
+-						     address));
++				       ACPI_FORMAT_UINT64(obj_desc->processor.
++							  address));
+ 			break;
+ 
+ 		case ACPI_TYPE_DEVICE:
+@@ -327,8 +326,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ 							       space_id));
+ 			if (obj_desc->region.flags & AOPOBJ_DATA_VALID) {
+ 				acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n",
+-					       ACPI_FORMAT_NATIVE_UINT
+-					       (obj_desc->region.address),
++					       ACPI_FORMAT_UINT64(obj_desc->
++								  region.
++								  address),
+ 					       obj_desc->region.length);
+ 			} else {
+ 				acpi_os_printf
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index 62365f6..08a3380 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -228,9 +228,9 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index)
+ 	status = acpi_os_table_override(table_desc->pointer, &override_table);
+ 	if (ACPI_SUCCESS(status) && override_table) {
+ 		ACPI_INFO((AE_INFO,
+-			   "%4.4s @ 0x%p Table override, replaced with:",
++			   "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
+ 			   table_desc->pointer->signature,
+-			   ACPI_CAST_PTR(void, table_desc->address)));
++			   ACPI_FORMAT_UINT64(table_desc->address)));
+ 
+ 		/* We can delete the table that was passed as a parameter */
+ 
+diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
+index 0f2d395..24de78fe 100644
+--- a/drivers/acpi/acpica/tbutils.c
++++ b/drivers/acpi/acpica/tbutils.c
+@@ -237,16 +237,12 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ {
+ 	struct acpi_table_header local_header;
+ 
+-	/*
+-	 * The reason that the Address is cast to a void pointer is so that we
+-	 * can use %p which will work properly on both 32-bit and 64-bit hosts.
+-	 */
+ 	if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) {
+ 
+ 		/* FACS only has signature and length fields */
+ 
+-		ACPI_INFO((AE_INFO, "%4.4s %p %05X",
+-			   header->signature, ACPI_CAST_PTR(void, address),
++		ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X %05X",
++			   header->signature, ACPI_FORMAT_UINT64(address),
+ 			   header->length));
+ 	} else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) {
+ 
+@@ -257,8 +253,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ 					  header)->oem_id, ACPI_OEM_ID_SIZE);
+ 		acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
+ 
+-		ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)",
+-			   ACPI_CAST_PTR (void, address),
++		ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %6.6s)",
++			   ACPI_FORMAT_UINT64(address),
+ 			   (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
+ 			    revision >
+ 			    0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
+@@ -272,8 +268,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ 		acpi_tb_cleanup_table_header(&local_header, header);
+ 
+ 		ACPI_INFO((AE_INFO,
+-			   "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)",
+-			   local_header.signature, ACPI_CAST_PTR(void, address),
++			   "%-4.4s 0x%8.8X%8.8X %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
++			   local_header.signature, ACPI_FORMAT_UINT64(address),
+ 			   local_header.length, local_header.revision,
+ 			   local_header.oem_id, local_header.oem_table_id,
+ 			   local_header.oem_revision,
+@@ -488,9 +484,8 @@ acpi_tb_install_table(acpi_physical_address address,
+ 	status = acpi_os_table_override(mapped_table, &override_table);
+ 	if (ACPI_SUCCESS(status) && override_table) {
+ 		ACPI_INFO((AE_INFO,
+-			   "%4.4s @ 0x%p Table override, replaced with:",
+-			   mapped_table->signature, ACPI_CAST_PTR(void,
+-								  address)));
++			   "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
++			   mapped_table->signature, ACPI_FORMAT_UINT64(address)));
+ 
+ 		acpi_gbl_root_table_list.tables[table_index].pointer =
+ 		    override_table;
+diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
+index 7eb6c6c..0272fbe 100644
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -119,7 +119,7 @@ static acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
+  *
+  ******************************************************************************/
+ 
+-acpi_status acpi_find_root_pointer(acpi_size *table_address)
++acpi_status acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+ 	u8 *table_ptr;
+ 	u8 *mem_rover;
+@@ -177,7 +177,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ 			physical_address +=
+ 			    (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+ 
+-			*table_address = physical_address;
++			*table_address =
++			    (acpi_physical_address) physical_address;
+ 			return_ACPI_STATUS(AE_OK);
+ 		}
+ 	}
+@@ -210,7 +211,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ 		    (ACPI_HI_RSDP_WINDOW_BASE +
+ 		     ACPI_PTR_DIFF(mem_rover, table_ptr));
+ 
+-		*table_address = physical_address;
++		*table_address = (acpi_physical_address) physical_address;
+ 		return_ACPI_STATUS(AE_OK);
+ 	}
+ 
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index a6664d2..7be7aa6 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -179,7 +179,7 @@ static void __init acpi_request_region (struct acpi_generic_address *addr,
+ 		request_mem_region(addr->address, length, desc);
+ }
+ 
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ 	acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ 		"ACPI PM1a_EVT_BLK");
+@@ -208,10 +208,7 @@ static int __init acpi_reserve_resources(void)
+ 	if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ 		acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ 			       acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+-	return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+ 
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1630,6 +1627,7 @@ acpi_status __init acpi_os_initialize(void)
+ 
+ acpi_status __init acpi_os_initialize1(void)
+ {
++	acpi_reserve_resources();
+ 	kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ 	kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ 	kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1);
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 81f32e5..e2958aa 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -67,6 +67,7 @@ enum board_ids {
+ 	board_ahci_yes_fbs,
+ 
+ 	/* board IDs for specific chipsets in alphabetical order */
++	board_ahci_avn,
+ 	board_ahci_mcp65,
+ 	board_ahci_mcp77,
+ 	board_ahci_mcp89,
+@@ -85,6 +86,8 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ 				 unsigned long deadline);
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++			      unsigned long deadline);
+ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ 				unsigned long deadline);
+ #ifdef CONFIG_PM
+@@ -108,6 +111,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
+ 
+ #define AHCI_HFLAGS(flags)	.private_data	= (void *)(flags)
+ 
++static struct ata_port_operations ahci_avn_ops = {
++	.inherits		= &ahci_ops,
++	.hardreset		= ahci_avn_hardreset,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ 	/* by features */
+ 	[board_ahci] =
+@@ -156,6 +164,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ 		.port_ops	= &ahci_ops,
+ 	},
+ 	/* by chipsets */
++	[board_ahci_avn] = {
++		.flags		= AHCI_FLAG_COMMON,
++		.pio_mask	= ATA_PIO4,
++		.udma_mask	= ATA_UDMA6,
++		.port_ops	= &ahci_avn_ops,
++	},
+ 	[board_ahci_mcp65] =
+ 	{
+ 		AHCI_HFLAGS	(AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+@@ -302,14 +316,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
+-	{ PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
+-	{ PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
++	{ PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
++	{ PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
+ 	{ PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
+@@ -680,6 +694,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ 	return rc;
+ }
+ 
++/*
++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
++ *
++ * It has been observed with some SSDs that the timing of events in the
++ * link synchronization phase can leave the port in a state that can not
++ * be recovered by a SATA-hard-reset alone.  The failing signature is
++ * SStatus.DET stuck at 1 ("Device presence detected but Phy
++ * communication not established").  It was found that unloading and
++ * reloading the driver when this problem occurs allows the drive
++ * connection to be recovered (DET advanced to 0x3).  The critical
++ * component of reloading the driver is that the port state machines are
++ * reset by bouncing "port enable" in the AHCI PCS configuration
++ * register.  So, reproduce that effect by bouncing a port whenever we
++ * see DET==1 after a reset.
++ */
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++			      unsigned long deadline)
++{
++	const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++	struct ata_port *ap = link->ap;
++	struct ahci_port_priv *pp = ap->private_data;
++	u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++	unsigned long tmo = deadline - jiffies;
++	struct ata_taskfile tf;
++	bool online;
++	int rc, i;
++
++	DPRINTK("ENTER\n");
++
++	ahci_stop_engine(ap);
++
++	for (i = 0; i < 2; i++) {
++		u16 val;
++		u32 sstatus;
++		int port = ap->port_no;
++		struct ata_host *host = ap->host;
++		struct pci_dev *pdev = to_pci_dev(host->dev);
++
++		/* clear D2H reception area to properly wait for D2H FIS */
++		ata_tf_init(link->device, &tf);
++		tf.command = ATA_BUSY;
++		ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++		rc = sata_link_hardreset(link, timing, deadline, &online,
++				ahci_check_ready);
++
++		if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
++				(sstatus & 0xf) != 1)
++			break;
++
++		ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
++				port);
++
++		pci_read_config_word(pdev, 0x92, &val);
++		val &= ~(1 << port);
++		pci_write_config_word(pdev, 0x92, val);
++		ata_msleep(ap, 1000);
++		val |= 1 << port;
++		pci_write_config_word(pdev, 0x92, val);
++		deadline += tmo;
++	}
++
++	ahci_start_engine(ap);
++
++	if (online)
++		*class = ahci_dev_classify(ap);
++
++	DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
++	return rc;
++}
++
++
+ #ifdef CONFIG_PM
+ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
+ {
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index b175000..cdf58f7 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -314,6 +314,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
+ extern struct ata_port_operations ahci_ops;
+ extern struct ata_port_operations ahci_pmp_retry_srst_ops;
+ 
++unsigned int ahci_dev_classify(struct ata_port *ap);
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ 			u32 opts);
+ void ahci_save_initial_config(struct device *dev,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index de2802c..41ffb8c 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1137,7 +1137,7 @@ static void ahci_dev_config(struct ata_device *dev)
+ 	}
+ }
+ 
+-static unsigned int ahci_dev_classify(struct ata_port *ap)
++unsigned int ahci_dev_classify(struct ata_port *ap)
+ {
+ 	void __iomem *port_mmio = ahci_port_base(ap);
+ 	struct ata_taskfile tf;
+@@ -1151,6 +1151,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)
+ 
+ 	return ata_dev_classify(&tf);
+ }
++EXPORT_SYMBOL_GPL(ahci_dev_classify);
+ 
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ 			u32 opts)
+@@ -1668,8 +1669,7 @@ static void ahci_port_intr(struct ata_port *ap)
+ 	if (unlikely(resetting))
+ 		status &= ~PORT_IRQ_BAD_PMP;
+ 
+-	/* if LPM is enabled, PHYRDY doesn't mean anything */
+-	if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
++	if (sata_lpm_ignore_phy_events(&ap->link)) {
+ 		status &= ~PORT_IRQ_PHYRDY;
+ 		ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
+ 	}
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 5d8fc3d..fcd8586 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6615,6 +6615,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
+ 	return tmp;
+ }
+ 
++/**
++ *	sata_lpm_ignore_phy_events - test if PHY event should be ignored
++ *	@link: Link receiving the event
++ *
++ *	Test whether the received PHY event has to be ignored or not.
++ *
++ *	LOCKING:
++ *	None:
++ *
++ *	RETURNS:
++ *	True if the event has to be ignored.
++ */
++bool sata_lpm_ignore_phy_events(struct ata_link *link)
++{
++	unsigned long lpm_timeout = link->last_lpm_change +
++				    msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
++
++	/* if LPM is enabled, PHYRDY doesn't mean anything */
++	if (link->lpm_policy > ATA_LPM_MAX_POWER)
++		return true;
++
++	/* ignore the first PHY event after the LPM policy changed
++	 * as it is might be spurious
++	 */
++	if ((link->flags & ATA_LFLAG_CHANGED) &&
++	    time_before(jiffies, lpm_timeout))
++		return true;
++
++	return false;
++}
++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
++
+ /*
+  * Dummy port_ops
+  */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 7d1a478..f54b0775 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3423,6 +3423,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ 		}
+ 	}
+ 
++	link->last_lpm_change = jiffies;
++	link->flags |= ATA_LFLAG_CHANGED;
++
+ 	return 0;
+ 
+ fail:
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 3eb6ad2..9f32f43 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	/* Atheros AR3011 with sflash firmware*/
+ 	{ USB_DEVICE(0x0489, 0xE027) },
+ 	{ USB_DEVICE(0x0489, 0xE03D) },
++	{ USB_DEVICE(0x04F2, 0xAFF1) },
+ 	{ USB_DEVICE(0x0930, 0x0215) },
+ 	{ USB_DEVICE(0x0CF3, 0x3002) },
+ 	{ USB_DEVICE(0x0CF3, 0xE019) },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 5c385e5..92973a3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -148,6 +148,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	/* Atheros 3011 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
+index 5948a21..203361e 100644
+--- a/drivers/edac/Kconfig
++++ b/drivers/edac/Kconfig
+@@ -214,7 +214,7 @@ config EDAC_I7300
+ 
+ config EDAC_SBRIDGE
+ 	tristate "Intel Sandy-Bridge Integrated MC"
+-	depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
++	depends on EDAC_MM_EDAC && PCI && X86 && X86_MCE_INTEL
+ 	depends on EXPERIMENTAL
+ 	help
+ 	  Support for error detection and correction the Intel
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index da71881..f8f790c 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -20,6 +20,7 @@
+ #include <linux/mmzone.h>
+ #include <linux/smp.h>
+ #include <linux/bitmap.h>
++#include <linux/math64.h>
+ #include <asm/processor.h>
+ #include <asm/mce.h>
+ 
+@@ -671,6 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 	u32 reg;
+ 	u64 limit, prv = 0;
+ 	u64 tmp_mb;
++	u32 gb, mb;
+ 	u32 rir_way;
+ 
+ 	/*
+@@ -683,8 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 	pvt->tolm = GET_TOLM(reg);
+ 	tmp_mb = (1 + pvt->tolm) >> 20;
+ 
+-	debugf0("TOLM: %Lu.%03Lu GB (0x%016Lx)\n",
+-		tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tolm);
++	gb = div_u64_rem(tmp_mb, 1024, &mb);
++	debugf0("TOHM: %u.%03u GB (0x%016Lx)\n",
++		gb, (mb*1000)/1024, (u64)pvt->tohm);
+ 
+ 	/* Address range is already 45:25 */
+ 	pci_read_config_dword(pvt->pci_sad1, TOHM,
+@@ -692,8 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 	pvt->tohm = GET_TOHM(reg);
+ 	tmp_mb = (1 + pvt->tohm) >> 20;
+ 
+-	debugf0("TOHM: %Lu.%03Lu GB (0x%016Lx)",
+-		tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tohm);
++	gb = div_u64_rem(tmp_mb, 1024, &mb);
++	debugf0("TOHM: %u.%03u GB (0x%016Lx)",
++		gb, (mb*1000)/1024, (u64)pvt->tohm);
+ 
+ 	/*
+ 	 * Step 2) Get SAD range and SAD Interleave list
+@@ -715,10 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 			break;
+ 
+ 		tmp_mb = (limit + 1) >> 20;
+-		debugf0("SAD#%d %s up to %Lu.%03Lu GB (0x%016Lx) %s reg=0x%08x\n",
++		gb = div_u64_rem(tmp_mb, 1000, &mb);
++		debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n",
+ 			n_sads,
+ 			get_dram_attr(reg),
+-			tmp_mb / 1000, tmp_mb % 1000,
++			gb, (mb*1000)/1024,
+ 			((u64)tmp_mb) << 20L,
+ 			INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]",
+ 			reg);
+@@ -748,8 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 			break;
+ 		tmp_mb = (limit + 1) >> 20;
+ 
+-		debugf0("TAD#%d: up to %Lu.%03Lu GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+-			n_tads, tmp_mb / 1000, tmp_mb % 1000,
++		gb = div_u64_rem(tmp_mb, 1000, &mb);
++		debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
++			n_tads, gb, (mb*1000)/1024,
+ 			((u64)tmp_mb) << 20L,
+ 			(u32)TAD_SOCK(reg),
+ 			(u32)TAD_CH(reg),
+@@ -772,9 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 					      tad_ch_nilv_offset[j],
+ 					      &reg);
+ 			tmp_mb = TAD_OFFSET(reg) >> 20;
+-			debugf0("TAD CH#%d, offset #%d: %Lu.%03Lu GB (0x%016Lx), reg=0x%08x\n",
++			gb = div_u64_rem(tmp_mb, 1024, &mb);
++			debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
+ 				i, j,
+-				tmp_mb / 1000, tmp_mb % 1000,
++				gb, (mb*1000)/1024,
+ 				((u64)tmp_mb) << 20L,
+ 				reg);
+ 		}
+@@ -796,9 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 
+ 			tmp_mb = RIR_LIMIT(reg) >> 20;
+ 			rir_way = 1 << RIR_WAY(reg);
+-			debugf0("CH#%d RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d, reg=0x%08x\n",
++			gb = div_u64_rem(tmp_mb, 1024, &mb);
++			debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
+ 				i, j,
+-				tmp_mb / 1000, tmp_mb % 1000,
++				gb, (mb*1000)/1024,
+ 				((u64)tmp_mb) << 20L,
+ 				rir_way,
+ 				reg);
+@@ -809,9 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 						      &reg);
+ 				tmp_mb = RIR_OFFSET(reg) << 6;
+ 
+-				debugf0("CH#%d RIR#%d INTL#%d, offset %Lu.%03Lu GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
++				gb = div_u64_rem(tmp_mb, 1024, &mb);
++				debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
+ 					i, j, k,
+-					tmp_mb / 1000, tmp_mb % 1000,
++					gb, (mb*1000)/1024,
+ 					((u64)tmp_mb) << 20L,
+ 					(u32)RIR_RNK_TGT(reg),
+ 					reg);
+@@ -849,6 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	u8			ch_way,sck_way;
+ 	u32			tad_offset;
+ 	u32			rir_way;
++	u32			gb, mb;
+ 	u64			ch_addr, offset, limit, prv = 0;
+ 
+ 
+@@ -859,7 +869,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	 * range (e. g. VGA addresses). It is unlikely, however, that the
+ 	 * memory controller would generate an error on that range.
+ 	 */
+-	if ((addr > (u64) pvt->tolm) && (addr < (1L << 32))) {
++	if ((addr > (u64) pvt->tolm) && (addr < (1LL << 32))) {
+ 		sprintf(msg, "Error at TOLM area, on addr 0x%08Lx", addr);
+ 		edac_mc_handle_ce_no_info(mci, msg);
+ 		return -EINVAL;
+@@ -1054,7 +1064,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	ch_addr = addr & 0x7f;
+ 	/* Remove socket wayness and remove 6 bits */
+ 	addr >>= 6;
+-	addr /= sck_xch;
++	addr = div_u64(addr, sck_xch);
+ #if 0
+ 	/* Divide by channel way */
+ 	addr = addr / ch_way;
+@@ -1074,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 			continue;
+ 
+ 		limit = RIR_LIMIT(reg);
+-
+-		debugf0("RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d\n",
++		gb = div_u64_rem(limit >> 20, 1024, &mb);
++		debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
+ 			n_rir,
+-			(limit >> 20) / 1000, (limit >> 20) % 1000,
++			gb, (mb*1000)/1024,
+ 			limit,
+ 			1 << RIR_WAY(reg));
+ 		if  (ch_addr <= limit)
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 2861ef4..20f7daa 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -410,24 +410,48 @@ static void __init dmi_dump_ids(void)
+ 	printk(KERN_CONT "\n");
+ }
+ 
+-static int __init dmi_present(const char __iomem *p)
++static int __init dmi_present(const u8 *buf)
+ {
+-	u8 buf[15];
++	int smbios_ver;
+ 
+-	memcpy_fromio(buf, p, 15);
+-	if (dmi_checksum(buf, 15)) {
++	if (memcmp(buf, "_SM_", 4) == 0 &&
++	    buf[5] < 32 && dmi_checksum(buf, buf[5])) {
++		smbios_ver = (buf[6] << 8) + buf[7];
++
++		/* Some BIOS report weird SMBIOS version, fix that up */
++		switch (smbios_ver) {
++		case 0x021F:
++		case 0x0221:
++			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
++				 smbios_ver & 0xFF, 3);
++			smbios_ver = 0x0203;
++			break;
++		case 0x0233:
++			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
++			smbios_ver = 0x0206;
++			break;
++		}
++	} else {
++		smbios_ver = 0;
++	}
++
++	buf += 16;
++
++	if (memcmp(buf, "_DMI_", 5) == 0 && dmi_checksum(buf, 15)) {
++		if (smbios_ver)
++			dmi_ver = smbios_ver;
++		else
++			dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
+ 		dmi_num = (buf[13] << 8) | buf[12];
+ 		dmi_len = (buf[7] << 8) | buf[6];
+ 		dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+ 			(buf[9] << 8) | buf[8];
+ 
+ 		if (dmi_walk_early(dmi_decode) == 0) {
+-			if (dmi_ver)
++			if (smbios_ver) {
+ 				pr_info("SMBIOS %d.%d present.\n",
+ 				       dmi_ver >> 8, dmi_ver & 0xFF);
+-			else {
+-				dmi_ver = (buf[14] & 0xF0) << 4 |
+-					   (buf[14] & 0x0F);
++			} else {
+ 				pr_info("Legacy DMI %d.%d present.\n",
+ 				       dmi_ver >> 8, dmi_ver & 0xFF);
+ 			}
+@@ -435,40 +459,14 @@ static int __init dmi_present(const char __iomem *p)
+ 			return 0;
+ 		}
+ 	}
+-	dmi_ver = 0;
+-	return 1;
+-}
+ 
+-static int __init smbios_present(const char __iomem *p)
+-{
+-	u8 buf[32];
+-
+-	memcpy_fromio(buf, p, 32);
+-	if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+-		dmi_ver = (buf[6] << 8) + buf[7];
+-
+-		/* Some BIOS report weird SMBIOS version, fix that up */
+-		switch (dmi_ver) {
+-		case 0x021F:
+-		case 0x0221:
+-			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
+-			       dmi_ver & 0xFF, 3);
+-			dmi_ver = 0x0203;
+-			break;
+-		case 0x0233:
+-			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
+-			dmi_ver = 0x0206;
+-			break;
+-		}
+-		return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+-	}
+ 	return 1;
+ }
+ 
+ void __init dmi_scan_machine(void)
+ {
+ 	char __iomem *p, *q;
+-	int rc;
++	char buf[32];
+ 
+ 	if (efi_enabled(EFI_CONFIG_TABLES)) {
+ 		if (efi.smbios == EFI_INVALID_TABLE_ADDR)
+@@ -481,10 +479,10 @@ void __init dmi_scan_machine(void)
+ 		p = dmi_ioremap(efi.smbios, 32);
+ 		if (p == NULL)
+ 			goto error;
+-
+-		rc = smbios_present(p);
++		memcpy_fromio(buf, p, 32);
+ 		dmi_iounmap(p, 32);
+-		if (!rc) {
++
++		if (!dmi_present(buf)) {
+ 			dmi_available = 1;
+ 			goto out;
+ 		}
+@@ -499,18 +497,15 @@ void __init dmi_scan_machine(void)
+ 		if (p == NULL)
+ 			goto error;
+ 
++		memset(buf, 0, 16);
+ 		for (q = p; q < p + 0x10000; q += 16) {
+-			if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
+-				rc = smbios_present(q);
+-			else if (memcmp(q, "_DMI_", 5) == 0)
+-				rc = dmi_present(q);
+-			else
+-				continue;
+-			if (!rc) {
++			memcpy_fromio(buf + 16, q, 16);
++			if (!dmi_present(buf)) {
+ 				dmi_available = 1;
+ 				dmi_iounmap(p, 0x10000);
+ 				goto out;
+ 			}
++			memcpy(buf, buf + 16, 16);
+ 		}
+ 		dmi_iounmap(p, 0x10000);
+ 	}
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 36ae055..e901fef 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -726,6 +726,7 @@ static struct class gpio_class = {
+  */
+ int gpio_export(unsigned gpio, bool direction_may_change)
+ {
++	struct gpio_chip	*chip;
+ 	unsigned long		flags;
+ 	struct gpio_desc	*desc;
+ 	int			status;
+@@ -743,10 +744,18 @@ int gpio_export(unsigned gpio, bool direction_may_change)
+ 		return -EINVAL;
+ 	}
+ 
++	desc = &gpio_desc[gpio];
++	chip = desc->chip;
++
+ 	mutex_lock(&sysfs_lock);
+ 
++	/* check if chip is being removed */
++	if (!chip || !chip->exported) {
++		status = -ENODEV;
++		goto fail_unlock;
++	}
++
+ 	spin_lock_irqsave(&gpio_lock, flags);
+-	desc = &gpio_desc[gpio];
+ 	if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
+ 	     test_bit(FLAG_EXPORT, &desc->flags)) {
+ 		spin_unlock_irqrestore(&gpio_lock, flags);
+@@ -973,12 +982,15 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ {
+ 	int			status;
+ 	struct device		*dev;
++	struct gpio_desc *desc;
++	unsigned int i;
+ 
+ 	mutex_lock(&sysfs_lock);
+ 	dev = class_find_device(&gpio_class, NULL, chip, match_export);
+ 	if (dev) {
+ 		put_device(dev);
+ 		device_unregister(dev);
++		/* prevent further gpiod exports */
+ 		chip->exported = 0;
+ 		status = 0;
+ 	} else
+@@ -988,6 +1000,13 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ 	if (status)
+ 		pr_debug("%s: chip %s status %d\n", __func__,
+ 				chip->label, status);
++
++	/* unregister gpio class devices owned by sysfs */
++	for (i = 0; i < chip->ngpio; i++) {
++		desc = &gpio_desc[chip->base + i];
++		if (test_and_clear_bit(FLAG_SYSFS, &desc->flags))
++			gpio_free(chip->base + i);
++	}
+ }
+ 
+ static int __init gpiolib_sysfs_init(void)
+@@ -1137,6 +1156,8 @@ int gpiochip_remove(struct gpio_chip *chip)
+ 	int		status = 0;
+ 	unsigned	id;
+ 
++	gpiochip_unexport(chip);
++
+ 	spin_lock_irqsave(&gpio_lock, flags);
+ 
+ 	of_gpiochip_remove(chip);
+@@ -1154,9 +1175,6 @@ int gpiochip_remove(struct gpio_chip *chip)
+ 
+ 	spin_unlock_irqrestore(&gpio_lock, flags);
+ 
+-	if (status == 0)
+-		gpiochip_unexport(chip);
+-
+ 	return status;
+ }
+ EXPORT_SYMBOL_GPL(gpiochip_remove);
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 927d170..76c4f2a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -302,8 +302,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
+ 		misc |= ATOM_COMPOSITESYNC;
+ 	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ 		misc |= ATOM_INTERLACE;
+-	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ 		misc |= ATOM_DOUBLE_CLOCK_MODE;
++	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++		misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+ 
+ 	args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ 	args.ucCRTC = radeon_crtc->crtc_id;
+@@ -346,8 +348,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ 		misc |= ATOM_COMPOSITESYNC;
+ 	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ 		misc |= ATOM_INTERLACE;
+-	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ 		misc |= ATOM_DOUBLE_CLOCK_MODE;
++	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++		misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+ 
+ 	args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ 	args.ucCRTC = radeon_crtc->crtc_id;
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 44a1ea4..a7e6f03 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ 			   GFP_KERNEL);
+ 	if (!open_info) {
+ 		err = -ENOMEM;
+-		goto error0;
++		goto error_gpadl;
+ 	}
+ 
+ 	init_completion(&open_info->waitevent);
+@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ 
+ 	if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ 		err = -EINVAL;
+-		goto error0;
++		goto error_gpadl;
+ 	}
+ 
+ 	if (userdatalen)
+@@ -234,6 +234,9 @@ error1:
+ 	list_del(&open_info->msglistentry);
+ 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+ 
++error_gpadl:
++	vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ 	free_pages((unsigned long)out,
+ 		get_order(send_ringbuffer_size + recv_ringbuffer_size));
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 12b85ff..7f963328b 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,7 +606,7 @@ int vmbus_request_offers(void)
+ {
+ 	struct vmbus_channel_message_header *msg;
+ 	struct vmbus_channel_msginfo *msginfo;
+-	int ret, t;
++	int ret;
+ 
+ 	msginfo = kmalloc(sizeof(*msginfo) +
+ 			  sizeof(struct vmbus_channel_message_header),
+@@ -614,8 +614,6 @@ int vmbus_request_offers(void)
+ 	if (!msginfo)
+ 		return -ENOMEM;
+ 
+-	init_completion(&msginfo->waitevent);
+-
+ 	msg = (struct vmbus_channel_message_header *)msginfo->msg;
+ 
+ 	msg->msgtype = CHANNELMSG_REQUESTOFFERS;
+@@ -629,14 +627,6 @@ int vmbus_request_offers(void)
+ 		goto cleanup;
+ 	}
+ 
+-	t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+-	if (t == 0) {
+-		ret = -ETIMEDOUT;
+-		goto cleanup;
+-	}
+-
+-
+-
+ cleanup:
+ 	kfree(msginfo);
+ 
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 055ebeb..c1fef27 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ 	if (dmasync)
+ 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+ 
++	if (!size)
++		return ERR_PTR(-EINVAL);
++
+ 	/*
+ 	 * If the combination of the addr and size requested for this memory
+ 	 * region causes an integer overflow, return error.
+ 	 */
+-	if ((PAGE_ALIGN(addr + size) <= size) ||
+-	    (PAGE_ALIGN(addr + size) <= addr))
++	if (((addr + size) < addr) ||
++	    PAGE_ALIGN(addr + size) < (addr + size))
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	if (!can_do_mlock())
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index a16f0c8..2ed14a7 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
+ 
+ 	memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+ 
+-	*lso_hdr_sz  = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+-				   wr->wr.ud.hlen);
++	*lso_hdr_sz  = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ 	*lso_seg_len = halign;
+ 	return 0;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 2d5bb5b..548ea99 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -296,7 +296,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev,
+ 					 unsigned int x2, unsigned int y2)
+ {
+ 	elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+-	elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++	elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+ 
+ /*
+@@ -692,18 +692,18 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
+ static int elantech_packet_check_v4(struct psmouse *psmouse)
+ {
+ 	unsigned char *packet = psmouse->packet;
++	unsigned char packet_type = packet[3] & 0x03;
+ 
+-	if ((packet[0] & 0x0c) == 0x04 &&
+-	    (packet[3] & 0x1f) == 0x11)
++	switch (packet_type) {
++	case 0:
++		return PACKET_V4_STATUS;
++
++	case 1:
+ 		return PACKET_V4_HEAD;
+ 
+-	if ((packet[0] & 0x0c) == 0x04 &&
+-	    (packet[3] & 0x1f) == 0x12)
++	case 2:
+ 		return PACKET_V4_MOTION;
+-
+-	if ((packet[0] & 0x0c) == 0x04 &&
+-	    (packet[3] & 0x1f) == 0x10)
+-		return PACKET_V4_STATUS;
++	}
+ 
+ 	return PACKET_UNKNOWN;
+ }
+@@ -766,6 +766,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
+ }
+ 
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++		unsigned int rate)
++{
++	struct elantech_data *etd = psmouse->private;
++
++	etd->original_set_rate(psmouse, rate);
++	if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++		psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+  * Put the touchpad into absolute mode
+  */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -1131,10 +1146,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ 		return true;
+ 
+ 	/*
+-	 * Some models have a revision higher then 20. Meaning param[2] may
+-	 * be 10 or 20, skip the rates check for these.
++	 * Some hw_version >= 4 models have a revision higher then 20. Meaning
++	 * that param[2] may be 10 or 20, skip the rates check for these.
+ 	 */
+-	if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++	if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
++	    param[2] < 40)
+ 		return true;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(rates); i++)
+@@ -1269,6 +1285,12 @@ static int elantech_set_properties(struct elantech_data *etd)
+ 			etd->hw_version = 3;
+ 			break;
+ 		case 6:
++		case 7:
++		case 8:
++		case 9:
++		case 10:
++		case 13:
++		case 14:
+ 			etd->hw_version = 4;
+ 			break;
+ 		default:
+@@ -1353,6 +1375,11 @@ int elantech_init(struct psmouse *psmouse)
+ 		goto init_fail;
+ 	}
+ 
++	if (etd->fw_version == 0x381f17) {
++		etd->original_set_rate = psmouse->set_rate;
++		psmouse->set_rate = elantech_set_rate_restore_reg_07;
++	}
++
+ 	if (elantech_set_input_params(psmouse)) {
+ 		psmouse_err(psmouse, "failed to query touchpad range.\n");
+ 		goto init_fail;
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 3569bed..092ac72 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -136,6 +136,7 @@ struct elantech_data {
+ 	unsigned int width;
+ 	struct finger_pos mt[ETP_MAX_FINGERS];
+ 	unsigned char parity[256];
++	void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+ 
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index b5fdcb7..34842e5 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -171,7 +171,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ 		       unsigned long addr, unsigned long len)
+ {
+-	return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++	return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+ 
+ /*
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c293d9c..6056ee7 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1554,7 +1554,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+ 
+ 	conf->slab_cache = sc;
+ 	conf->active_name = 1-conf->active_name;
+-	conf->pool_size = newsize;
++	if (!err)
++		conf->pool_size = newsize;
+ 	return err;
+ }
+ 
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index 9729b92..f8449d5 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ 
+ 		if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
+ 			if (msb->data_dir == READ) {
+-				for (cnt = 0; cnt < msb->current_seg; cnt++)
++				for (cnt = 0; cnt < msb->current_seg; cnt++) {
+ 					t_len += msb->req_sg[cnt].length
+ 						 / msb->page_size;
+ 
+@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ 						t_len += msb->current_page - 1;
+ 
+ 					t_len *= msb->page_size;
++				}
+ 			}
+ 		} else
+ 			t_len = blk_rq_bytes(msb->block_req);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 411a994..fc7386e 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2424,6 +2424,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ 	switch (mode) {
+ 	case PM_HIBERNATION_PREPARE:
+ 	case PM_SUSPEND_PREPARE:
++	case PM_RESTORE_PREPARE:
+ 
+ 		spin_lock_irqsave(&host->lock, flags);
+ 		host->rescan_disable = 1;
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index ad76592..7ac2c05 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ 		/* Validate the request */
+ 		err = -EINVAL;
+ 		if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+-		    req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++		    req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ 			break;
+ 		if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM &&
+ 		    req.dtype != UBI_UNKNOWN)
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index cd26da8..22b3636 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
+ 				 * during re-size.
+ 				 */
+ 				ubi_scan_move_to_list(sv, seb, &si->erase);
+-			vol->eba_tbl[seb->lnum] = seb->pnum;
++			else
++				vol->eba_tbl[seb->lnum] = seb->pnum;
+ 		}
+ 	}
+ 
+diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
+index f6a7d7a..b14ab43 100644
+--- a/drivers/mtd/ubi/misc.c
++++ b/drivers/mtd/ubi/misc.c
+@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
+ 	for (i = 0; i < vol->used_ebs; i++) {
+ 		int size;
+ 
++		cond_resched();
++
+ 		if (i == vol->used_ebs - 1)
+ 			size = vol->last_eb_bytes;
+ 		else
+diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
+index b2b62de..c5b2357 100644
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -408,7 +408,7 @@ static int compare_lebs(struct ubi_device *ubi, const struct ubi_scan_leb *seb,
+ 		second_is_newer = !second_is_newer;
+ 	} else {
+ 		dbg_bld("PEB %d CRC is OK", pnum);
+-		bitflips = !!err;
++		bitflips |= !!err;
+ 	}
+ 
+ 	vfree(buf);
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index cf42971..422e5be 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -665,7 +665,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ 				int cancel)
+ {
+ 	int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+-	int vol_id = -1, uninitialized_var(lnum);
++	int vol_id = -1, lnum = -1;
+ 	struct ubi_wl_entry *e1, *e2;
+ 	struct ubi_vid_hdr *vid_hdr;
+ 
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 6546191..bd4e598 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -149,6 +149,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
+ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
+ 				     struct e1000_rx_ring *rx_ring,
+ 				     int *work_done, int work_to_do);
++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
++					 struct e1000_rx_ring *rx_ring,
++					 int cleaned_count)
++{
++}
+ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
+ 				   struct e1000_rx_ring *rx_ring,
+ 				   int cleaned_count);
+@@ -3322,8 +3327,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ 		msleep(1);
+ 	/* e1000_down has a dependency on max_frame_size */
+ 	hw->max_frame_size = max_frame;
+-	if (netif_running(netdev))
++	if (netif_running(netdev)) {
++		/* prevent buffers from being reallocated */
++		adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
+ 		e1000_down(adapter);
++	}
+ 
+ 	/* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+ 	 * means we reserve 2 more, this pushes us to allocate from the next
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 9663e0b..bb335ab 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -42,7 +42,7 @@
+ #define PSF_TX		0x1000
+ #define EXT_EVENT	1
+ #define CAL_EVENT	7
+-#define CAL_TRIGGER	7
++#define CAL_TRIGGER	1
+ #define PER_TRIGGER	6
+ 
+ /* phyter seems to miss the mark by 16 ns */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 1644b1f..ec347d2 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -367,6 +367,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ 	{RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ 	{RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++	{RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ 	{RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ 	{RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ 	{RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index e5fe956..17e6429 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -117,7 +117,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+ 	reqtype =  REALTEK_USB_VENQT_READ;
+ 
+ 	status = usb_control_msg(udev, pipe, request, reqtype, value, index,
+-				 pdata, len, 0); /* max. timeout */
++				 pdata, len, 1000);
+ 
+ 	if (status < 0)
+ 		pr_err("reg 0x%x, usbctrl_vendorreq TimeOut! status:0x%x value=0x%x\n",
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 1ce729d..b7d782f 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -27,6 +27,8 @@ struct backend_info {
+ 	enum xenbus_state frontend_state;
+ 	struct xenbus_watch hotplug_status_watch;
+ 	u8 have_hotplug_status_watch:1;
++
++	const char *hotplug_script;
+ };
+ 
+ static int connect_rings(struct backend_info *);
+@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev)
+ 		xenvif_disconnect(be->vif);
+ 		be->vif = NULL;
+ 	}
++	kfree(be->hotplug_script);
+ 	kfree(be);
+ 	dev_set_drvdata(&dev->dev, NULL);
+ 	return 0;
+@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev,
+ 	struct xenbus_transaction xbt;
+ 	int err;
+ 	int sg;
++	const char *script;
+ 	struct backend_info *be = kzalloc(sizeof(struct backend_info),
+ 					  GFP_KERNEL);
+ 	if (!be) {
+@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev,
+ 		goto fail;
+ 	}
+ 
++	script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
++	if (IS_ERR(script)) {
++		err = PTR_ERR(script);
++		xenbus_dev_fatal(dev, err, "reading script");
++		goto fail;
++	}
++
++	be->hotplug_script = script;
++
+ 	err = xenbus_switch_state(dev, XenbusStateInitWait);
+ 	if (err)
+ 		goto fail;
+@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev,
+ 			  struct kobj_uevent_env *env)
+ {
+ 	struct backend_info *be = dev_get_drvdata(&xdev->dev);
+-	char *val;
+ 
+-	val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+-	if (IS_ERR(val)) {
+-		int err = PTR_ERR(val);
+-		xenbus_dev_fatal(xdev, err, "reading script");
+-		return err;
+-	} else {
+-		if (add_uevent_var(env, "script=%s", val)) {
+-			kfree(val);
+-			return -ENOMEM;
+-		}
+-		kfree(val);
+-	}
++	if (!be)
++		return 0;
++
++	if (add_uevent_var(env, "script=%s", be->hotplug_script))
++		return -ENOMEM;
+ 
+-	if (!be || !be->vif)
++	if (!be->vif)
+ 		return 0;
+ 
+ 	return add_uevent_var(env, "vif=%s", be->vif->dev->name);
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 37639a6..21935580 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -761,6 +761,42 @@ int of_property_read_string_index(struct device_node *np, const char *propname,
+ }
+ EXPORT_SYMBOL_GPL(of_property_read_string_index);
+ 
++/**
++ * of_property_match_string() - Find string in a list and return index
++ * @np: pointer to node containing string list property
++ * @propname: string list property name
++ * @string: pointer to string to search for in string list
++ *
++ * This function searches a string list property and returns the index
++ * of a specific string value.
++ */
++int of_property_match_string(struct device_node *np, const char *propname,
++			     const char *string)
++{
++	struct property *prop = of_find_property(np, propname, NULL);
++	size_t l;
++	int i;
++	const char *p, *end;
++
++	if (!prop)
++		return -EINVAL;
++	if (!prop->value)
++		return -ENODATA;
++
++	p = prop->value;
++	end = p + prop->length;
++
++	for (i = 0; p < end; i++, p += l) {
++		l = strlen(p) + 1;
++		if (p + l > end)
++			return -EILSEQ;
++		pr_debug("comparing %s with %s\n", string, p);
++		if (strcmp(string, p) == 0)
++			return i; /* Found it; return index */
++	}
++	return -ENODATA;
++}
++EXPORT_SYMBOL_GPL(of_property_match_string);
+ 
+ /**
+  * of_property_count_strings - Find and return the number of strings from a
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 8877b83..ba3638e 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -1046,7 +1046,14 @@ static int __devinit compal_probe(struct platform_device *pdev)
+ 
+ 	/* Power supply */
+ 	initialize_power_supply_data(data);
+-	power_supply_register(&compal_device->dev, &data->psy);
++	err = power_supply_register(&compal_device->dev, &data->psy);
++	if (err < 0) {
++		hwmon_device_unregister(data->hwmon_dev);
++		sysfs_remove_group(&pdev->dev.kobj,
++				&compal_attribute_group);
++		kfree(data);
++		return err;
++	}
+ 
+ 	platform_set_drvdata(pdev, data);
+ 
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 3868ab2..fb37df6 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
+ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
+ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
+ static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
+ 
+ /* Functions */
+ 
+@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ 				}
+ 
+ 				/* Now complete the io */
++				scsi_dma_unmap(cmd);
++				cmd->scsi_done(cmd);
+ 				tw_dev->state[request_id] = TW_S_COMPLETED;
+ 				twa_free_request_id(tw_dev, request_id);
+ 				tw_dev->posted_request_count--;
+-				tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-				twa_unmap_scsi_data(tw_dev, request_id);
+ 			}
+ 
+ 			/* Check for valid status after each drain */
+@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
+ 	}
+ } /* End twa_load_sgl() */
+ 
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	int use_sg;
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	use_sg = scsi_dma_map(cmd);
+-	if (!use_sg)
+-		return 0;
+-	else if (use_sg < 0) {
+-		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
+-		return 0;
+-	}
+-
+-	cmd->SCp.phase = TW_PHASE_SGLIST;
+-	cmd->SCp.have_data_in = use_sg;
+-
+-	return use_sg;
+-} /* End twa_map_scsi_sg_data() */
+-
+ /* This function will poll for a response interrupt of a request */
+ static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+ {
+@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ 		    (tw_dev->state[i] != TW_S_INITIAL) &&
+ 		    (tw_dev->state[i] != TW_S_COMPLETED)) {
+ 			if (tw_dev->srb[i]) {
+-				tw_dev->srb[i]->result = (DID_RESET << 16);
+-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+-				twa_unmap_scsi_data(tw_dev, i);
++				struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++				cmd->result = (DID_RESET << 16);
++				scsi_dma_unmap(cmd);
++				cmd->scsi_done(cmd);
+ 			}
+ 		}
+ 	}
+@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ 	/* Save the scsi command for use by the ISR */
+ 	tw_dev->srb[request_id] = SCpnt;
+ 
+-	/* Initialize phase to zero */
+-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ 	retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ 	switch (retval) {
+ 	case SCSI_MLQUEUE_HOST_BUSY:
++		scsi_dma_unmap(SCpnt);
+ 		twa_free_request_id(tw_dev, request_id);
+-		twa_unmap_scsi_data(tw_dev, request_id);
+ 		break;
+ 	case 1:
+-		tw_dev->state[request_id] = TW_S_COMPLETED;
+-		twa_free_request_id(tw_dev, request_id);
+-		twa_unmap_scsi_data(tw_dev, request_id);
+ 		SCpnt->result = (DID_ERROR << 16);
++		scsi_dma_unmap(SCpnt);
+ 		done(SCpnt);
++		tw_dev->state[request_id] = TW_S_COMPLETED;
++		twa_free_request_id(tw_dev, request_id);
+ 		retval = 0;
+ 	}
+ out:
+@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ 				command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+ 				command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
+ 			} else {
+-				sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
+-				if (sg_count == 0)
++				sg_count = scsi_dma_map(srb);
++				if (sg_count < 0)
+ 					goto out;
+ 
+ 				scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
+ 	return(table[index].text);
+ } /* End twa_string_lookup() */
+ 
+-/* This function will perform a pci-dma unmap */
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+-		scsi_dma_unmap(cmd);
+-} /* End twa_unmap_scsi_data() */
+-
+ /* This function gets called when a disk is coming on-line */
+ static int twa_slave_configure(struct scsi_device *sdev)
+ {
+diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
+index 040f721..0fdc83c 100644
+--- a/drivers/scsi/3w-9xxx.h
++++ b/drivers/scsi/3w-9xxx.h
+@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+ 
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE  1
+-#define TW_PHASE_SGLIST  2
+-
+ /* Misc defines */
+ #define TW_9550SX_DRAIN_COMPLETED	      0xFFFF
+ #define TW_SECTOR_SIZE                        512
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+index 13e39e1..c555ccb 100644
+--- a/drivers/scsi/3w-sas.c
++++ b/drivers/scsi/3w-sas.c
+@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+ 	return 0;
+ } /* End twl_post_command_packet() */
+ 
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	int use_sg;
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	use_sg = scsi_dma_map(cmd);
+-	if (!use_sg)
+-		return 0;
+-	else if (use_sg < 0) {
+-		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+-		return 0;
+-	}
+-
+-	cmd->SCp.phase = TW_PHASE_SGLIST;
+-	cmd->SCp.have_data_in = use_sg;
+-
+-	return use_sg;
+-} /* End twl_map_scsi_sg_data() */
+-
+ /* This function hands scsi cdb's to the firmware */
+ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+ {
+@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ 	if (!sglistarg) {
+ 		/* Map sglist from scsi layer to cmd packet */
+ 		if (scsi_sg_count(srb)) {
+-			sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+-			if (sg_count == 0)
++			sg_count = scsi_dma_map(srb);
++			if (sg_count <= 0)
+ 				goto out;
+ 
+ 			scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1116,15 +1096,6 @@ out:
+ 	return retval;
+ } /* End twl_initialize_device_extension() */
+ 
+-/* This function will perform a pci-dma unmap */
+-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+-		scsi_dma_unmap(cmd);
+-} /* End twl_unmap_scsi_data() */
+-
+ /* This function will handle attention interrupts */
+ static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+ {
+@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+ 			}
+ 
+ 			/* Now complete the io */
++			scsi_dma_unmap(cmd);
++			cmd->scsi_done(cmd);
+ 			tw_dev->state[request_id] = TW_S_COMPLETED;
+ 			twl_free_request_id(tw_dev, request_id);
+ 			tw_dev->posted_request_count--;
+-			tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-			twl_unmap_scsi_data(tw_dev, request_id);
+ 		}
+ 
+ 		/* Check for another response interrupt */
+@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
+ 		if ((tw_dev->state[i] != TW_S_FINISHED) &&
+ 		    (tw_dev->state[i] != TW_S_INITIAL) &&
+ 		    (tw_dev->state[i] != TW_S_COMPLETED)) {
+-			if (tw_dev->srb[i]) {
+-				tw_dev->srb[i]->result = (DID_RESET << 16);
+-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+-				twl_unmap_scsi_data(tw_dev, i);
++			struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++			if (cmd) {
++				cmd->result = (DID_RESET << 16);
++				scsi_dma_unmap(cmd);
++				cmd->scsi_done(cmd);
+ 			}
+ 		}
+ 	}
+@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ 	/* Save the scsi command for use by the ISR */
+ 	tw_dev->srb[request_id] = SCpnt;
+ 
+-	/* Initialize phase to zero */
+-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ 	retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ 	if (retval) {
+ 		tw_dev->state[request_id] = TW_S_COMPLETED;
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+index d474892..fec6449 100644
+--- a/drivers/scsi/3w-sas.h
++++ b/drivers/scsi/3w-sas.h
+@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+ 
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SGLIST  2
+-
+ /* Misc defines */
+ #define TW_SECTOR_SIZE                        512
+ #define TW_MAX_UNITS			      32
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 7fe96ff..86bc5f9 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
+ 	return 0;
+ } /* End tw_initialize_device_extension() */
+ 
+-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+-	int use_sg;
+-
+-	dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
+-
+-	use_sg = scsi_dma_map(cmd);
+-	if (use_sg < 0) {
+-		printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
+-		return 0;
+-	}
+-
+-	cmd->SCp.phase = TW_PHASE_SGLIST;
+-	cmd->SCp.have_data_in = use_sg;
+-
+-	return use_sg;
+-} /* End tw_map_scsi_sg_data() */
+-
+-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+-	dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
+-
+-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+-		scsi_dma_unmap(cmd);
+-} /* End tw_unmap_scsi_data() */
+-
+ /* This function will reset a device extension */
+ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ {
+@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ 			srb = tw_dev->srb[i];
+ 			if (srb != NULL) {
+ 				srb->result = (DID_RESET << 16);
+-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+-				tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
++				scsi_dma_unmap(srb);
++				srb->scsi_done(srb);
+ 			}
+ 		}
+ 	}
+@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
+ 	command_packet->byte8.io.lba = lba;
+ 	command_packet->byte6.block_count = num_sectors;
+ 
+-	use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+-	if (!use_sg)
++	use_sg = scsi_dma_map(srb);
++	if (use_sg <= 0)
+ 		return 1;
+ 
+ 	scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
+@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
+ 	/* Save the scsi command for use by the ISR */
+ 	tw_dev->srb[request_id] = SCpnt;
+ 
+-	/* Initialize phase to zero */
+-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ 	switch (*command) {
+ 		case READ_10:
+ 		case READ_6:
+@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
+ 
+ 				/* Now complete the io */
+ 				if ((error != TW_ISR_DONT_COMPLETE)) {
++					scsi_dma_unmap(tw_dev->srb[request_id]);
++					tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+ 					tw_dev->state[request_id] = TW_S_COMPLETED;
+ 					tw_state_request_finish(tw_dev, request_id);
+ 					tw_dev->posted_request_count--;
+-					tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-					
+-					tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+ 				}
+ 			}
+ 				
+diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
+index 49dcf03..1d31858 100644
+--- a/drivers/scsi/3w-xxxx.h
++++ b/drivers/scsi/3w-xxxx.h
+@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
+ #define TW_AEN_SMART_FAIL        0x000F
+ #define TW_AEN_SBUF_FAIL         0x0024
+ 
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_ALIGNMENT_6000		      64 /* 64 bytes */
+ #define TW_ALIGNMENT_7000                     4  /* 4 bytes */
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index bfd87fa..3e0f71c 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
+ 			fp_possible = io_info.fpOkForIo;
+ 	}
+ 
+-	/* Use smp_processor_id() for now until cmd->request->cpu is CPU
++	/* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
+ 	   id by default, not CPU group id, otherwise all MSI-X queues won't
+ 	   be utilized */
+ 	cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
+-		smp_processor_id() % instance->msix_vectors : 0;
++		raw_smp_processor_id() % instance->msix_vectors : 0;
+ 
+ 	if (fp_possible) {
+ 		megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp,
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 5c6b5f5..a50825b 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1338,6 +1338,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ {
+ 	u64 start_lba = blk_rq_pos(scmd->request);
+ 	u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++	u64 factor = scmd->device->sector_size / 512;
+ 	u64 bad_lba;
+ 	int info_valid;
+ 	/*
+@@ -1359,16 +1360,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ 	if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ 		return 0;
+ 
+-	if (scmd->device->sector_size < 512) {
+-		/* only legitimate sector_size here is 256 */
+-		start_lba <<= 1;
+-		end_lba <<= 1;
+-	} else {
+-		/* be careful ... don't want any overflows */
+-		u64 factor = scmd->device->sector_size / 512;
+-		do_div(start_lba, factor);
+-		do_div(end_lba, factor);
+-	}
++	/* be careful ... don't want any overflows */
++	do_div(start_lba, factor);
++	do_div(end_lba, factor);
+ 
+ 	/* The bad lba was reported incorrectly, we have no idea where
+ 	 * the error is.
+@@ -1895,8 +1889,7 @@ got_data:
+ 	if (sector_size != 512 &&
+ 	    sector_size != 1024 &&
+ 	    sector_size != 2048 &&
+-	    sector_size != 4096 &&
+-	    sector_size != 256) {
++	    sector_size != 4096) {
+ 		sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ 			  sector_size);
+ 		/*
+@@ -1945,8 +1938,6 @@ got_data:
+ 		sdkp->capacity <<= 2;
+ 	else if (sector_size == 1024)
+ 		sdkp->capacity <<= 1;
+-	else if (sector_size == 256)
+-		sdkp->capacity >>= 1;
+ 
+ 	blk_queue_physical_block_size(sdp->request_queue,
+ 				      sdkp->physical_block_size);
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 2d25616..b4cac39 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
+ 			md->from_user = 0;
+ 	}
+ 
++	if (unlikely(iov_count > UIO_MAXIOV))
++		return -EINVAL;
++
+ 	if (iov_count) {
+ 		int len, size = sizeof(struct sg_iovec) * iov_count;
+ 		struct iovec *iov;
+diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
+index c43a9e8..54ef3d4 100644
+--- a/drivers/staging/hv/storvsc_drv.c
++++ b/drivers/staging/hv/storvsc_drv.c
+@@ -940,23 +940,24 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
+ 			if (bounce_sgl[j].length == PAGE_SIZE) {
+ 				/* full..move to next entry */
+ 				kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++				bounce_addr = 0;
+ 				j++;
++			}
+ 
+-				/* if we need to use another bounce buffer */
+-				if (srclen || i != orig_sgl_count - 1)
+-					bounce_addr =
++			/* if we need to use another bounce buffer */
++			if (srclen && bounce_addr == 0)
++				bounce_addr =
+ 					(unsigned long)kmap_atomic(
+ 					sg_page((&bounce_sgl[j])), KM_IRQ0);
+ 
+-			} else if (srclen == 0 && i == orig_sgl_count - 1) {
+-				/* unmap the last bounce that is < PAGE_SIZE */
+-				kunmap_atomic((void *)bounce_addr, KM_IRQ0);
+-			}
+ 		}
+ 
+ 		kunmap_atomic((void *)(src_addr - orig_sgl[i].offset), KM_IRQ0);
+ 	}
+ 
++	if (bounce_addr)
++		kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++
+ 	local_irq_restore(flags);
+ 
+ 	return total_copied;
+diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
+index 2d3a420..955c6de 100644
+--- a/drivers/staging/line6/pcm.c
++++ b/drivers/staging/line6/pcm.c
+@@ -88,10 +88,13 @@ static DEVICE_ATTR(impulse_period, S_IWUSR | S_IRUGO, pcm_get_impulse_period,
+ 
+ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ {
+-	unsigned long flags_old =
+-	    __sync_fetch_and_or(&line6pcm->flags, channels);
+-	unsigned long flags_new = flags_old | channels;
+-	int err = 0;
++	unsigned long flags_old, flags_new;
++	int err;
++
++	do {
++		flags_old = ACCESS_ONCE(line6pcm->flags);
++		flags_new = flags_old | channels;
++	} while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+ 
+ #if LINE6_BACKUP_MONITOR_SIGNAL
+ 	if (!(line6pcm->line6->properties->capabilities & LINE6_BIT_HWMON)) {
+@@ -133,10 +136,8 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ 		line6pcm->prev_fsize = 0;
+ 		err = line6_submit_audio_in_all_urbs(line6pcm);
+ 
+-		if (err < 0) {
+-			__sync_fetch_and_and(&line6pcm->flags, ~channels);
+-			return err;
+-		}
++		if (err < 0)
++			goto fail;
+ 	}
+ 
+ 	if (((flags_old & MASK_PLAYBACK) == 0) &&
+@@ -160,20 +161,29 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ 		line6pcm->count_out = 0;
+ 		err = line6_submit_audio_out_all_urbs(line6pcm);
+ 
+-		if (err < 0) {
+-			__sync_fetch_and_and(&line6pcm->flags, ~channels);
+-			return err;
+-		}
++		if (err < 0)
++			goto fail;
+ 	}
+ 
+ 	return 0;
++
++fail:
++	do {
++		flags_old = ACCESS_ONCE(line6pcm->flags);
++		flags_new = flags_old & ~channels;
++	} while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
++
++	return err;
+ }
+ 
+ int line6_pcm_stop(struct snd_line6_pcm *line6pcm, int channels)
+ {
+-	unsigned long flags_old =
+-	    __sync_fetch_and_and(&line6pcm->flags, ~channels);
+-	unsigned long flags_new = flags_old & ~channels;
++	unsigned long flags_old, flags_new;
++
++	do {
++		flags_old = ACCESS_ONCE(line6pcm->flags);
++		flags_new = flags_old & ~channels;
++	} while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+ 
+ 	if (((flags_old & MASK_CAPTURE) != 0) &&
+ 	    ((flags_new & MASK_CAPTURE) == 0)) {
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index 4683d5f..9a584da 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -274,11 +274,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
+  * LCD types
+  */
+ #define LCD_TYPE_NONE		0
+-#define LCD_TYPE_OLD		1
+-#define LCD_TYPE_KS0074		2
+-#define LCD_TYPE_HANTRONIX	3
+-#define LCD_TYPE_NEXCOM		4
+-#define LCD_TYPE_CUSTOM		5
++#define LCD_TYPE_CUSTOM		1
++#define LCD_TYPE_OLD		2
++#define LCD_TYPE_KS0074		3
++#define LCD_TYPE_HANTRONIX	4
++#define LCD_TYPE_NEXCOM		5
+ 
+ /*
+  * keypad types
+@@ -456,8 +456,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");
+ static int lcd_type = -1;
+ module_param(lcd_type, int, 0000);
+ MODULE_PARM_DESC(lcd_type,
+-		 "LCD type: 0=none, 1=old //, 2=serial ks0074, "
+-		 "3=hantronix //, 4=nexcom //, 5=compiled-in");
++		 "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom");
+ 
+ static int lcd_proto = -1;
+ module_param(lcd_proto, int, 0000);
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index ebf9b60..1fb9e58 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -569,6 +569,7 @@ static struct se_device *pscsi_create_virtdevice(
+ 					" pdv_host_id: %d\n", pdv->pdv_host_id);
+ 				return ERR_PTR(-EINVAL);
+ 			}
++			pdv->pdv_lld_host = sh;
+ 		}
+ 	} else {
+ 		if (phv->phv_mode == PHV_VIRUTAL_HOST_ID) {
+@@ -655,6 +656,8 @@ static void pscsi_free_device(void *p)
+ 		if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
+ 		    (phv->phv_lld_host != NULL))
+ 			scsi_host_put(phv->phv_lld_host);
++		else if (pdv->pdv_lld_host)
++			scsi_host_put(pdv->pdv_lld_host);
+ 
+ 		if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
+ 			scsi_device_put(sd);
+diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
+index fdc17b6..8b0a336 100644
+--- a/drivers/target/target_core_pscsi.h
++++ b/drivers/target/target_core_pscsi.h
+@@ -46,6 +46,7 @@ struct pscsi_dev_virt {
+ 	struct block_device *pdv_bd;
+ 	struct scsi_device *pdv_sd;
+ 	struct se_hba *pdv_se_hba;
++	struct Scsi_Host *pdv_lld_host;
+ } ____cacheline_aligned;
+ 
+ typedef enum phv_modes {
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 52fdf60..df8f8e0 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -167,7 +167,7 @@ static int __init xen_hvc_init(void)
+ 
+ 	if (xen_initial_domain()) {
+ 		ops = &dom0_hvc_ops;
+-		xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++		xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ 	} else {
+ 		if (!xen_start_info->console.domU.evtchn)
+ 			return -ENODEV;
+diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
+index 6563cad..746e771 100644
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ 	{ .compatible = "ibm,qpace-nwp-serial",
+ 		.data = (void *)PORT_NWPSERIAL, },
+ #endif
+-	{ .type = "serial",         .data = (void *)PORT_UNKNOWN, },
+ 	{ /* end of list */ },
+ };
+ 
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 6cd4143..d9706e7 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+ 
+ static int __devinit ulite_probe(struct platform_device *pdev)
+ {
+-	struct resource *res, *res2;
++	struct resource *res;
++	int irq;
+ 	int id = pdev->id;
+ #ifdef CONFIG_OF
+ 	const __be32 *prop;
+@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
+ 	if (!res)
+ 		return -ENODEV;
+ 
+-	res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!res2)
+-		return -ENODEV;
++	irq = platform_get_irq(pdev, 0);
++	if (irq <= 0)
++		return -ENXIO;
+ 
+-	return ulite_assign(&pdev->dev, id, res->start, res2->start);
++	return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+ 
+ static int __devexit ulite_remove(struct platform_device *pdev)
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b627363..778c39a 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
+  **/
+ static int __devinit xuartps_probe(struct platform_device *pdev)
+ {
+-	int rc;
++	int rc, irq;
+ 	struct uart_port *port;
+-	struct resource *res, *res2;
++	struct resource *res;
+ 	int clk = 0;
+ 
+ #ifdef CONFIG_OF
+@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ 	if (!res)
+ 		return -ENODEV;
+ 
+-	res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!res2)
+-		return -ENODEV;
++	irq = platform_get_irq(pdev, 0);
++	if (irq <= 0)
++		return -ENXIO;
+ 
+ 	/* Initialize the port structure */
+ 	port = xuartps_get_port();
+@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ 		 * and triggers invocation of the config_port() entry point.
+ 		 */
+ 		port->mapbase = res->start;
+-		port->irq = res2->start;
++		port->irq = irq;
+ 		port->dev = &pdev->dev;
+ 		port->uartclk = clk;
+ 		dev_set_drvdata(&pdev->dev, port);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 360ddb5..57d6302 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -947,11 +947,16 @@ static int acm_probe(struct usb_interface *intf,
+ 	}
+ 
+ 	while (buflen > 0) {
++		elength = buffer[0];
++		if (!elength) {
++			dev_err(&intf->dev, "skipping garbage byte\n");
++			elength = 1;
++			goto next_desc;
++		}
+ 		if (buffer[1] != USB_DT_CS_INTERFACE) {
+ 			dev_err(&intf->dev, "skipping garbage\n");
+ 			goto next_desc;
+ 		}
+-		elength = buffer[0];
+ 
+ 		switch (buffer[2]) {
+ 		case USB_CDC_UNION_TYPE: /* we've found it */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 06dfb4f..d34005b 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -224,7 +224,7 @@ static void wdm_int_callback(struct urb *urb)
+ 	case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+ 		dev_dbg(&desc->intf->dev,
+ 			"NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
+-			dr->wIndex, dr->wLength);
++			le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
+ 		break;
+ 
+ 	case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+@@ -237,14 +237,16 @@ static void wdm_int_callback(struct urb *urb)
+ 		clear_bit(WDM_POLL_RUNNING, &desc->flags);
+ 		dev_err(&desc->intf->dev,
+ 			"unknown notification %d received: index %d len %d\n",
+-			dr->bNotificationType, dr->wIndex, dr->wLength);
++			dr->bNotificationType,
++			le16_to_cpu(dr->wIndex),
++			le16_to_cpu(dr->wLength));
+ 		goto exit;
+ 	}
+ 
+ 	req->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
+ 	req->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+ 	req->wValue = 0;
+-	req->wIndex = desc->inum;
++	req->wIndex = desc->inum; /* already converted */
+ 	req->wLength = cpu_to_le16(desc->wMaxCommand);
+ 
+ 	usb_fill_control_urb(
+@@ -401,7 +403,7 @@ static ssize_t wdm_write
+ 			     USB_RECIP_INTERFACE);
+ 	req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
+ 	req->wValue = 0;
+-	req->wIndex = desc->inum;
++	req->wIndex = desc->inum; /* already converted */
+ 	req->wLength = cpu_to_le16(count);
+ 	set_bit(WDM_IN_USE, &desc->flags);
+ 	desc->outbuf = buf;
+@@ -414,7 +416,7 @@ static ssize_t wdm_write
+ 		dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ 	} else {
+ 		dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
+-			req->wIndex);
++			le16_to_cpu(req->wIndex));
+ 	}
+ out:
+ 	usb_autopm_put_interface(desc->intf);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 25e9eb4..a47e29a 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2060,8 +2060,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		break;
+ 	case COMP_DEV_ERR:
+ 	case COMP_STALL:
++		frame->status = -EPROTO;
++		skip_td = true;
++		break;
+ 	case COMP_TX_ERR:
+ 		frame->status = -EPROTO;
++		if (event_trb != td->last_trb)
++			return 0;
+ 		skip_td = true;
+ 		break;
+ 	case COMP_STOP:
+@@ -2646,7 +2651,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ 		xhci_halt(xhci);
+ hw_died:
+ 		spin_unlock(&xhci->lock);
+-		return -ESHUTDOWN;
++		return IRQ_HANDLED;
+ 	}
+ 
+ 	/*
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index efbdf83..d676ae0 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1231,7 +1231,7 @@ union xhci_trb {
+  * since the command ring is 64-byte aligned.
+  * It must also be greater than 16.
+  */
+-#define TRBS_PER_SEGMENT	64
++#define TRBS_PER_SEGMENT	256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS	(TRBS_PER_SEGMENT - 3)
+ #define SEGMENT_SIZE		(TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 641caf8..6f7d84e 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1524,16 +1524,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ 		(devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
+ 		musb->int_usb, musb->int_tx, musb->int_rx);
+ 
+-	/* the core can interrupt us for multiple reasons; docs have
+-	 * a generic interrupt flowchart to follow
++	/**
++	 * According to Mentor Graphics' documentation, flowchart on page 98,
++	 * IRQ should be handled as follows:
++	 *
++	 * . Resume IRQ
++	 * . Session Request IRQ
++	 * . VBUS Error IRQ
++	 * . Suspend IRQ
++	 * . Connect IRQ
++	 * . Disconnect IRQ
++	 * . Reset/Babble IRQ
++	 * . SOF IRQ (we're not using this one)
++	 * . Endpoint 0 IRQ
++	 * . TX Endpoints
++	 * . RX Endpoints
++	 *
++	 * We will be following that flowchart in order to avoid any problems
++	 * that might arise with internal Finite State Machine.
+ 	 */
++
+ 	if (musb->int_usb)
+ 		retval |= musb_stage0_irq(musb, musb->int_usb,
+ 				devctl, power);
+ 
+-	/* "stage 1" is handling endpoint irqs */
+-
+-	/* handle endpoint 0 first */
+ 	if (musb->int_tx & 1) {
+ 		if (devctl & MUSB_DEVCTL_HM)
+ 			retval |= musb_h_ep0_irq(musb);
+@@ -1541,43 +1555,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ 			retval |= musb_g_ep0_irq(musb);
+ 	}
+ 
+-	/* RX on endpoints 1-15 */
+-	reg = musb->int_rx >> 1;
++	reg = musb->int_tx >> 1;
+ 	ep_num = 1;
+ 	while (reg) {
+ 		if (reg & 1) {
+-			/* musb_ep_select(musb->mregs, ep_num); */
+-			/* REVISIT just retval = ep->rx_irq(...) */
+ 			retval = IRQ_HANDLED;
+ 			if (devctl & MUSB_DEVCTL_HM) {
+ 				if (is_host_capable())
+-					musb_host_rx(musb, ep_num);
++					musb_host_tx(musb, ep_num);
+ 			} else {
+ 				if (is_peripheral_capable())
+-					musb_g_rx(musb, ep_num);
++					musb_g_tx(musb, ep_num);
+ 			}
+ 		}
+-
+ 		reg >>= 1;
+ 		ep_num++;
+ 	}
+ 
+-	/* TX on endpoints 1-15 */
+-	reg = musb->int_tx >> 1;
++	reg = musb->int_rx >> 1;
+ 	ep_num = 1;
+ 	while (reg) {
+ 		if (reg & 1) {
+-			/* musb_ep_select(musb->mregs, ep_num); */
+-			/* REVISIT just retval |= ep->tx_irq(...) */
+ 			retval = IRQ_HANDLED;
+ 			if (devctl & MUSB_DEVCTL_HM) {
+ 				if (is_host_capable())
+-					musb_host_tx(musb, ep_num);
++					musb_host_rx(musb, ep_num);
+ 			} else {
+ 				if (is_peripheral_capable())
+-					musb_g_tx(musb, ep_num);
++					musb_g_rx(musb, ep_num);
+ 			}
+ 		}
++
+ 		reg >>= 1;
+ 		ep_num++;
+ 	}
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7f32c74..073a0f98 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ 	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
++	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
++	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e13ebb0..8257d3b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+ 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ 	{ USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++	{ USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+ 	{ USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ 	{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 361192c..e4a57bb 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -155,6 +155,7 @@
+ #define XSENS_AWINDA_STATION_PID 0x0101
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID		0x0200	/* Xsens MTw */
++#define XSENS_MTDEVBOARD_PID	0x0300	/* Motion Tracker Development Board */
+ #define XSENS_CONVERTER_PID	0xD00D	/* Xsens USB-serial converter */
+ 
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7ba38ea..a440387 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
+ 	{ USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
+-	{ USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 71fd9da..e3b7af8 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -62,10 +62,6 @@
+ #define ALCATEL_VENDOR_ID	0x11f7
+ #define ALCATEL_PRODUCT_ID	0x02df
+ 
+-/* Samsung I330 phone cradle */
+-#define SAMSUNG_VENDOR_ID	0x04e8
+-#define SAMSUNG_PRODUCT_ID	0x8001
+-
+ #define SIEMENS_VENDOR_ID	0x11f5
+ #define SIEMENS_PRODUCT_ID_SX1	0x0001
+ #define SIEMENS_PRODUCT_ID_X65	0x0003
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 0e2c2de..68e8552 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -752,6 +752,13 @@ UNUSUAL_DEV(  0x059f, 0x0643, 0x0000, 0x0000,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_GO_SLOW ),
+ 
++/* Reported by Christian Schaller <cschalle@redhat.com> */
++UNUSUAL_DEV(  0x059f, 0x0651, 0x0000, 0x0000,
++		"LaCie",
++		"External HDD",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_WP_DETECT ),
++
+ /* Submitted by Joel Bourquard <numlock@freesurf.ch>
+  * Some versions of this device need the SubClass and Protocol overrides
+  * while others don't.
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index f6227cc..bcf7711 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -895,7 +895,7 @@ static int find_virq(unsigned int virq, unsigned int cpu)
+ 	return rc;
+ }
+ 
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ 	struct evtchn_bind_virq bind_virq;
+ 	int evtchn, irq, ret;
+@@ -909,8 +909,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+ 		if (irq == -1)
+ 			goto out;
+ 
+-		irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+-					      handle_percpu_irq, "virq");
++		if (percpu)
++			irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++						      handle_percpu_irq, "virq");
++		else
++			irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++						      handle_edge_irq, "virq");
+ 
+ 		bind_virq.virq = virq;
+ 		bind_virq.vcpu = cpu;
+@@ -1023,7 +1027,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ {
+ 	int irq, retval;
+ 
+-	irq = bind_virq_to_irq(virq, cpu);
++	irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ 	if (irq < 0)
+ 		return irq;
+ 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 82ab1c3..bb8cb69 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+ 
+-bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+ 
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+  * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ 		 * This means that some fields may still be read-only because
+ 		 * they have entries in the config_field list that intercept
+ 		 * the write and do nothing. */
+-		if (dev_data->permissive || permissive) {
++		if (dev_data->permissive || xen_pcibk_permissive) {
+ 			switch (size) {
+ 			case 1:
+ 				err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index 2e1d73d..62461a8 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,7 +64,7 @@ struct config_field_entry {
+ 	void *data;
+ };
+ 
+-extern bool permissive;
++extern bool xen_pcibk_permissive;
+ 
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+ 
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index a5bb81a..1667a90 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ 
+ 	cmd->val = value;
+ 
+-	if (!permissive && (!dev_data || !dev_data->permissive))
++	if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
+ 		return 0;
+ 
+ 	/* Only allow the guest to control certain bits. */
+diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
+index cf38e15..08d90e2 100644
+--- a/firmware/ihex2fw.c
++++ b/firmware/ihex2fw.c
+@@ -86,6 +86,7 @@ int main(int argc, char **argv)
+ 		case 'j':
+ 			include_jump = 1;
+ 			break;
++		default:
+ 			return usage();
+ 		}
+ 	}
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 2aed667..d252462 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -746,6 +746,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	    i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ 		int elf_prot = 0, elf_flags;
+ 		unsigned long k, vaddr;
++		unsigned long total_size = 0;
+ 
+ 		if (elf_ppnt->p_type != PT_LOAD)
+ 			continue;
+@@ -809,10 +810,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ #else
+ 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++			total_size = total_mapping_size(elf_phdata,
++							loc->elf_ex.e_phnum);
++			if (!total_size) {
++				retval = -EINVAL;
++				goto out_free_dentry;
++			}
+ 		}
+ 
+ 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+-				elf_prot, elf_flags, 0);
++				elf_prot, elf_flags, total_size);
+ 		if (BAD_ADDR(error)) {
+ 			send_sig(SIGKILL, current, 0);
+ 			retval = IS_ERR((void *)error) ?
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index a694317..da528f8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5678,12 +5678,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
+ 		return -ENOSPC;
+ 	}
+ 
+-	if (btrfs_test_opt(root, DISCARD))
+-		ret = btrfs_discard_extent(root, start, len, NULL);
+-
+ 	if (pin)
+ 		pin_down_extent(root, cache, start, len, 1);
+ 	else {
++		if (btrfs_test_opt(root, DISCARD))
++			ret = btrfs_discard_extent(root, start, len, NULL);
+ 		btrfs_add_free_space(cache, start, len);
+ 		btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
+ 	}
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7cbe2f8..52bacff 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2263,6 +2263,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ 	if (off + len == src->i_size)
+ 		len = ALIGN(src->i_size, bs) - off;
+ 
++	if (len == 0) {
++		ret = 0;
++		goto out_unlock;
++	}
++
+ 	/* verify the end result is block aligned */
+ 	if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
+ 	    !IS_ALIGNED(destoff, bs))
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index 3848b04..60ff45e 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
+ /*
+  * Check if the attribute is in a supported namespace.
+  *
+- * This applied after the check for the synthetic attributes in the system
++ * This is applied after the check for the synthetic attributes in the system
+  * namespace.
+  */
+-static bool btrfs_is_valid_xattr(const char *name)
++static int btrfs_is_valid_xattr(const char *name)
+ {
+-	return !strncmp(name, XATTR_SECURITY_PREFIX,
+-			XATTR_SECURITY_PREFIX_LEN) ||
+-	       !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
+-	       !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+-	       !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
++	int len = strlen(name);
++	int prefixlen = 0;
++
++	if (!strncmp(name, XATTR_SECURITY_PREFIX,
++			XATTR_SECURITY_PREFIX_LEN))
++		prefixlen = XATTR_SECURITY_PREFIX_LEN;
++	else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
++		prefixlen = XATTR_SYSTEM_PREFIX_LEN;
++	else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++		prefixlen = XATTR_TRUSTED_PREFIX_LEN;
++	else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
++		prefixlen = XATTR_USER_PREFIX_LEN;
++	else
++		return -EOPNOTSUPP;
++
++	/*
++	 * The name cannot consist of just prefix
++	 */
++	if (len <= prefixlen)
++		return -EINVAL;
++
++	return 0;
+ }
+ 
+ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ 		       void *buffer, size_t size)
+ {
++	int ret;
++
+ 	/*
+ 	 * If this is a request for a synthetic attribute in the system.*
+ 	 * namespace use the generic infrastructure to resolve a handler
+@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ 		return generic_getxattr(dentry, name, buffer, size);
+ 
+-	if (!btrfs_is_valid_xattr(name))
+-		return -EOPNOTSUPP;
++	ret = btrfs_is_valid_xattr(name);
++	if (ret)
++		return ret;
+ 	return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
+ }
+ 
+@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ 		   size_t size, int flags)
+ {
+ 	struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++	int ret;
+ 
+ 	/*
+ 	 * The permission on security.* and system.* is not checked
+@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ 		return generic_setxattr(dentry, name, value, size, flags);
+ 
+-	if (!btrfs_is_valid_xattr(name))
+-		return -EOPNOTSUPP;
++	ret = btrfs_is_valid_xattr(name);
++	if (ret)
++		return ret;
+ 
+ 	if (size == 0)
+ 		value = "";  /* empty EA, do not remove */
+@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ {
+ 	struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++	int ret;
+ 
+ 	/*
+ 	 * The permission on security.* and system.* is not checked
+@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ 		return generic_removexattr(dentry, name);
+ 
+-	if (!btrfs_is_valid_xattr(name))
+-		return -EOPNOTSUPP;
++	ret = btrfs_is_valid_xattr(name);
++	if (ret)
++		return ret;
+ 
+ 	return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0,
+ 				XATTR_REPLACE);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 8bc98af..8a35300 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1016,13 +1016,13 @@ ascend:
+ 		/* might go back up the wrong parent if we have had a rename */
+ 		if (!locked && read_seqretry(&rename_lock, seq))
+ 			goto rename_retry;
+-		next = child->d_child.next;
+-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++		/* go into the first sibling still alive */
++		do {
++			next = child->d_child.next;
+ 			if (next == &this_parent->d_subdirs)
+ 				goto ascend;
+ 			child = list_entry(next, struct dentry, d_child);
+-			next = next->next;
+-		}
++		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ 		rcu_read_unlock();
+ 		goto resume;
+ 	}
+@@ -1142,13 +1142,13 @@ ascend:
+ 		/* might go back up the wrong parent if we have had a rename */
+ 		if (!locked && read_seqretry(&rename_lock, seq))
+ 			goto rename_retry;
+-		next = child->d_child.next;
+-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++		/* go into the first sibling still alive */
++		do {
++			next = child->d_child.next;
+ 			if (next == &this_parent->d_subdirs)
+ 				goto ascend;
+ 			child = list_entry(next, struct dentry, d_child);
+-			next = next->next;
+-		}
++		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ 		rcu_read_unlock();
+ 		goto resume;
+ 	}
+@@ -2938,13 +2938,13 @@ ascend:
+ 		/* might go back up the wrong parent if we have had a rename */
+ 		if (!locked && read_seqretry(&rename_lock, seq))
+ 			goto rename_retry;
+-		next = child->d_child.next;
+-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++		/* go into the first sibling still alive */
++		do {
++			next = child->d_child.next;
+ 			if (next == &this_parent->d_subdirs)
+ 				goto ascend;
+ 			child = list_entry(next, struct dentry, d_child);
+-			next = next->next;
+-		}
++		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ 		rcu_read_unlock();
+ 		goto resume;
+ 	}
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index a15f1e2..74f03b5 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -135,6 +135,7 @@ static void debugfs_evict_inode(struct inode *inode)
+ 
+ static const struct super_operations debugfs_super_operations = {
+ 	.evict_inode	= debugfs_evict_inode,
++	.statfs		= simple_statfs,
+ };
+ 
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 834d9a1..2da63ab 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -321,7 +321,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ 	ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+ 	ext4_lblk_t last = lblock + len - 1;
+ 
+-	if (lblock > last)
++	if (len == 0 || lblock > last)
+ 		return 0;
+ 	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+@@ -4470,13 +4470,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ 	struct ext4_map_blocks map;
+ 	unsigned int credits, blkbits = inode->i_blkbits;
+ 
+-	/*
+-	 * currently supporting (pre)allocate mode for extent-based
+-	 * files _only_
+-	 */
+-	if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+-		return -EOPNOTSUPP;
+-
+ 	/* Return error if mode is not supported */
+ 	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ 		return -EOPNOTSUPP;
+@@ -4497,6 +4490,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ 	 */
+ 	credits = ext4_chunk_trans_blocks(inode, max_blocks);
+ 	mutex_lock(&inode->i_mutex);
++
++	/*
++	 * We only support preallocation for extent-based files only
++	 */
++	if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++		ret = -EOPNOTSUPP;
++		goto out;
++	}
++
+ 	ret = inode_newsize_ok(inode, (len + offset));
+ 	if (ret) {
+ 		mutex_unlock(&inode->i_mutex);
+@@ -4553,6 +4555,7 @@ retry:
+ 		ret = 0;
+ 		goto retry;
+ 	}
++out:
+ 	mutex_unlock(&inode->i_mutex);
+ 	trace_ext4_fallocate_exit(inode, offset, max_blocks,
+ 				ret > 0 ? ret2 : ret);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index c9f2e3d..cd1dd49 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1456,7 +1456,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 			  struct inode *inode)
+ {
+ 	struct inode *dir = dentry->d_parent->d_inode;
+-	struct buffer_head *bh;
++	struct buffer_head *bh = NULL;
+ 	struct ext4_dir_entry_2 *de;
+ 	struct super_block *sb;
+ 	int	retval;
+@@ -1471,7 +1471,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 	if (is_dx(dir)) {
+ 		retval = ext4_dx_add_entry(handle, dentry, inode);
+ 		if (!retval || (retval != ERR_BAD_DX_DIR))
+-			return retval;
++			goto out;
+ 		ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ 		dx_fallback++;
+ 		ext4_mark_inode_dirty(handle, dir);
+@@ -1482,14 +1482,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 		if(!bh)
+ 			return retval;
+ 		retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+-		if (retval != -ENOSPC) {
+-			brelse(bh);
+-			return retval;
+-		}
++		if (retval != -ENOSPC)
++			goto out;
+ 
+ 		if (blocks == 1 && !dx_fallback &&
+-		    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+-			return make_indexed_dir(handle, dentry, inode, bh);
++		    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++			retval = make_indexed_dir(handle, dentry, inode, bh);
++			bh = NULL; /* make_indexed_dir releases bh */
++			goto out;
++		}
+ 		brelse(bh);
+ 	}
+ 	bh = ext4_append(handle, dir, &block, &retval);
+@@ -1499,6 +1500,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 	de->inode = 0;
+ 	de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
+ 	retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ 	brelse(bh);
+ 	if (retval == 0)
+ 		ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 6b08864..c9e18f3 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -196,8 +196,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ 		goto out_err;
+ 	}
+ 	/* copy the full handle */
+-	if (copy_from_user(handle, ufh,
+-			   sizeof(struct file_handle) +
++	*handle = f_handle;
++	if (copy_from_user(&handle->f_handle,
++			   &ufh->f_handle,
+ 			   f_handle.handle_bytes)) {
+ 		retval = -EFAULT;
+ 		goto out_handle;
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index da6d7ba..421834b 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -711,11 +711,16 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
+ {
+ 	jbd2_journal_revoke_header_t *header;
+ 	int offset, max;
++	__u32 rcount;
+ 	int record_len = 4;
+ 
+ 	header = (jbd2_journal_revoke_header_t *) bh->b_data;
+ 	offset = sizeof(jbd2_journal_revoke_header_t);
+-	max = be32_to_cpu(header->r_count);
++	rcount = be32_to_cpu(header->r_count);
++
++	if (rcount > journal->j_blocksize)
++		return -EINVAL;
++	max = rcount;
+ 
+ 	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+ 		record_len = 8;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 6e91f8b..d455ea0 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3272,10 +3272,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess
+ 	return nfserr_old_stateid;
+ }
+ 
++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
++{
++	if (ols->st_stateowner->so_is_open_owner &&
++	    !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++		return nfserr_bad_stateid;
++	return nfs_ok;
++}
++
+ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ {
+ 	struct nfs4_stid *s;
+-	struct nfs4_ol_stateid *ols;
+ 	__be32 status;
+ 
+ 	if (STALE_STATEID(stateid))
+@@ -3289,11 +3296,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ 		return status;
+ 	if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
+ 		return nfs_ok;
+-	ols = openlockstateid(s);
+-	if (ols->st_stateowner->so_is_open_owner
+-	    && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
+-		return nfserr_bad_stateid;
+-	return nfs_ok;
++	return nfsd4_check_openowner_confirmed(openlockstateid(s));
+ }
+ 
+ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
+@@ -3360,8 +3363,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
+ 		status = nfs4_check_fh(current_fh, stp);
+ 		if (status)
+ 			goto out;
+-		if (stp->st_stateowner->so_is_open_owner
+-		    && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++		status = nfsd4_check_openowner_confirmed(stp);
++		if (status)
+ 			goto out;
+ 		status = nfs4_check_openmode(stp, flags);
+ 		if (status)
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae1..090d8ce 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ 	nchildren = nilfs_btree_node_get_nchildren(node);
+ 
+ 	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+-		     level > NILFS_BTREE_LEVEL_MAX ||
++		     level >= NILFS_BTREE_LEVEL_MAX ||
+ 		     nchildren < 0 ||
+ 		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ 		pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index dbc372e..7ba6ac1 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -729,6 +729,19 @@ lookup:
+ 	if (tmpres) {
+ 		spin_unlock(&dlm->spinlock);
+ 		spin_lock(&tmpres->spinlock);
++
++		/*
++		 * Right after dlm spinlock was released, dlm_thread could have
++		 * purged the lockres. Check if lockres got unhashed. If so
++		 * start over.
++		 */
++		if (hlist_unhashed(&tmpres->hash_node)) {
++			spin_unlock(&tmpres->spinlock);
++			dlm_lockres_put(tmpres);
++			tmpres = NULL;
++			goto lookup;
++		}
++
+ 		/* Wait on the thread that is mastering the resource */
+ 		if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ 			__dlm_wait_on_lockres(tmpres);
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index e043c4c..f58f1c4 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -361,7 +361,7 @@ nomem:
+ }
+ 
+ enum {
+-	Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++	Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+ 
+ static const match_table_t tokens = {
+@@ -370,6 +370,7 @@ static const match_table_t tokens = {
+ 	{Opt_umask, "umask=%o"},
+ 	{Opt_dmask, "dmask=%o"},
+ 	{Opt_fmask, "fmask=%o"},
++	{Opt_err, NULL},
+ };
+ 
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8ca88fc..d2cbeff 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
+ }
+ 
+ static int
+-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+-			int atomic)
++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
++			size_t *remaining, int atomic)
+ {
+ 	unsigned long copy;
+ 
+-	while (len > 0) {
++	while (*remaining > 0) {
+ 		while (!iov->iov_len)
+ 			iov++;
+-		copy = min_t(unsigned long, len, iov->iov_len);
++		copy = min_t(unsigned long, *remaining, iov->iov_len);
+ 
+ 		if (atomic) {
+-			if (__copy_from_user_inatomic(to, iov->iov_base, copy))
++			if (__copy_from_user_inatomic(addr + *offset,
++						      iov->iov_base, copy))
+ 				return -EFAULT;
+ 		} else {
+-			if (copy_from_user(to, iov->iov_base, copy))
++			if (copy_from_user(addr + *offset,
++					   iov->iov_base, copy))
+ 				return -EFAULT;
+ 		}
+-		to += copy;
+-		len -= copy;
++		*offset += copy;
++		*remaining -= copy;
+ 		iov->iov_base += copy;
+ 		iov->iov_len -= copy;
+ 	}
+@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+ }
+ 
+ static int
+-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
+-		      int atomic)
++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
++		      size_t *remaining, int atomic)
+ {
+ 	unsigned long copy;
+ 
+-	while (len > 0) {
++	while (*remaining > 0) {
+ 		while (!iov->iov_len)
+ 			iov++;
+-		copy = min_t(unsigned long, len, iov->iov_len);
++		copy = min_t(unsigned long, *remaining, iov->iov_len);
+ 
+ 		if (atomic) {
+-			if (__copy_to_user_inatomic(iov->iov_base, from, copy))
++			if (__copy_to_user_inatomic(iov->iov_base,
++						    addr + *offset, copy))
+ 				return -EFAULT;
+ 		} else {
+-			if (copy_to_user(iov->iov_base, from, copy))
++			if (copy_to_user(iov->iov_base,
++					 addr + *offset, copy))
+ 				return -EFAULT;
+ 		}
+-		from += copy;
+-		len -= copy;
++		*offset += copy;
++		*remaining -= copy;
+ 		iov->iov_base += copy;
+ 		iov->iov_len -= copy;
+ 	}
+@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ 			struct pipe_buffer *buf = pipe->bufs + curbuf;
+ 			const struct pipe_buf_operations *ops = buf->ops;
+ 			void *addr;
+-			size_t chars = buf->len;
++			size_t chars = buf->len, remaining;
+ 			int error, atomic;
+ 
+ 			if (chars > total_len)
+@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ 			}
+ 
+ 			atomic = !iov_fault_in_pages_write(iov, chars);
++			remaining = chars;
+ redo:
+ 			addr = ops->map(pipe, buf, atomic);
+-			error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
++			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
++						      &remaining, atomic);
+ 			ops->unmap(pipe, buf, addr);
+ 			if (unlikely(error)) {
+ 				/*
+@@ -414,7 +420,6 @@ redo:
+ 				break;
+ 			}
+ 			ret += chars;
+-			buf->offset += chars;
+ 			buf->len -= chars;
+ 
+ 			/* Was it a packet buffer? Clean up and exit */
+@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ 		if (ops->can_merge && offset + chars <= PAGE_SIZE) {
+ 			int error, atomic = 1;
+ 			void *addr;
++			size_t remaining = chars;
+ 
+ 			error = ops->confirm(pipe, buf);
+ 			if (error)
+@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ 			iov_fault_in_pages_read(iov, chars);
+ redo1:
+ 			addr = ops->map(pipe, buf, atomic);
+-			error = pipe_iov_copy_from_user(offset + addr, iov,
+-							chars, atomic);
++			error = pipe_iov_copy_from_user(addr, &offset, iov,
++							&remaining, atomic);
+ 			ops->unmap(pipe, buf, addr);
+ 			ret = error;
+ 			do_wakeup = 1;
+@@ -565,6 +571,8 @@ redo1:
+ 			struct page *page = pipe->tmp_page;
+ 			char *src;
+ 			int error, atomic = 1;
++			int offset = 0;
++			size_t remaining;
+ 
+ 			if (!page) {
+ 				page = alloc_page(GFP_HIGHUSER);
+@@ -585,14 +593,15 @@ redo1:
+ 				chars = total_len;
+ 
+ 			iov_fault_in_pages_read(iov, chars);
++			remaining = chars;
+ redo2:
+ 			if (atomic)
+ 				src = kmap_atomic(page, KM_USER0);
+ 			else
+ 				src = kmap(page);
+ 
+-			error = pipe_iov_copy_from_user(src, iov, chars,
+-							atomic);
++			error = pipe_iov_copy_from_user(src, &offset, iov,
++							&remaining, atomic);
+ 			if (atomic)
+ 				kunmap_atomic(src, KM_USER0);
+ 			else
+diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
+index f554a93..2ba218e 100644
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -125,7 +125,7 @@ void acpi_free(void *address);
+  */
+ acpi_status acpi_reallocate_root_table(void);
+ 
+-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address);
++acpi_status acpi_find_root_pointer(acpi_physical_address *rsdp_address);
+ 
+ acpi_status acpi_load_tables(void);
+ 
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index ed73f67..b0d7ef8 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -198,9 +198,29 @@ typedef int INT32;
+ typedef s32 acpi_native_int;
+ 
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+ 
++#else				/* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif				/* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR                    ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX                   ACPI_UINT32_MAX
+ 
+diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
+index 5af3ed5..b9f9210 100644
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -75,6 +75,7 @@
+ #define ACPI_CONSTANT_EVAL_ONLY
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+ 
+ #ifdef ACPI_EXEC_APP
+diff --git a/include/linux/jhash.h b/include/linux/jhash.h
+index 47cb09e..348c6f4 100644
+--- a/include/linux/jhash.h
++++ b/include/linux/jhash.h
+@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
+ }
+ 
+ 
+-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
+-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
+ {
+-	a += JHASH_INITVAL;
+-	b += JHASH_INITVAL;
++	a += initval;
++	b += initval;
+ 	c += initval;
+ 
+ 	__jhash_final(a, b, c);
+@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
+ 	return c;
+ }
+ 
++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++{
++	return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
++}
++
+ static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
+ {
+-	return jhash_3words(a, b, 0, initval);
++	return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
+ }
+ 
+ static inline u32 jhash_1word(u32 a, u32 initval)
+ {
+-	return jhash_3words(a, 0, 0, initval);
++	return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
+ }
+ 
+ #endif /* _LINUX_JHASH_H */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 42ac6ad..3d4b5b6 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -182,6 +182,7 @@ enum {
+ 	ATA_LFLAG_DISABLED	= (1 << 6), /* link is disabled */
+ 	ATA_LFLAG_SW_ACTIVITY	= (1 << 7), /* keep activity stats */
+ 	ATA_LFLAG_NO_LPM	= (1 << 8), /* disable LPM on this link */
++	ATA_LFLAG_CHANGED	= (1 << 10), /* LPM state changed on this link */
+ 
+ 	/* struct ata_port flags */
+ 	ATA_FLAG_SLAVE_POSS	= (1 << 0), /* host supports slave dev */
+@@ -284,6 +285,12 @@ enum {
+ 	 */
+ 	ATA_TMOUT_PMP_SRST_WAIT	= 5000,
+ 
++	/* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
++	 * be a spurious PHY event, so ignore the first PHY event that
++	 * occurs within 10s after the policy change.
++	 */
++	ATA_TMOUT_SPURIOUS_PHY	= 10000,
++
+ 	/* ATA bus states */
+ 	BUS_UNKNOWN		= 0,
+ 	BUS_DMA			= 1,
+@@ -728,6 +735,8 @@ struct ata_link {
+ 	struct ata_eh_context	eh_context;
+ 
+ 	struct ata_device	device[ATA_MAX_DEVICES];
++
++	unsigned long		last_lpm_change; /* when last LPM change happened */
+ };
+ #define ATA_LINK_CLEAR_BEGIN		offsetof(struct ata_link, active_tag)
+ #define ATA_LINK_CLEAR_END		offsetof(struct ata_link, device[0])
+@@ -1064,6 +1073,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
+ extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
+ extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
+ extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
++extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
+ 
+ extern int ata_cable_40wire(struct ata_port *ap);
+ extern int ata_cable_80wire(struct ata_port *ap);
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index 7454ad7..d4d512f 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -457,7 +457,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA          0
+ #define NILFS_BTREE_LEVEL_NODE_MIN      (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX           14
++#define NILFS_BTREE_LEVEL_MAX           14	/* Max level (exclusive) */
+ 
+ /**
+  * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 9bf9611..c81ef31 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -211,6 +211,9 @@ extern int of_property_read_string(struct device_node *np,
+ extern int of_property_read_string_index(struct device_node *np,
+ 					 const char *propname,
+ 					 int index, const char **output);
++extern int of_property_match_string(struct device_node *np,
++				    const char *propname,
++				    const char *string);
+ extern int of_property_count_strings(struct device_node *np,
+ 				     const char *propname);
+ extern int of_device_is_compatible(const struct device_node *device,
+@@ -315,6 +318,13 @@ static inline int of_property_read_u64(const struct device_node *np,
+ 	return -ENOSYS;
+ }
+ 
++static inline int of_property_match_string(struct device_node *np,
++					   const char *propname,
++					   const char *string)
++{
++	return -ENOSYS;
++}
++
+ static inline struct device_node *of_parse_phandle(struct device_node *np,
+ 						   const char *phandle_name,
+ 						   int index)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index cb34ff4..44e5f47 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2347,15 +2347,15 @@ static inline bool thread_group_leader(struct task_struct *p)
+  * all we care about is that we have a task with the appropriate
+  * pid, we don't actually care if we have the right task.
+  */
+-static inline int has_group_leader_pid(struct task_struct *p)
++static inline bool has_group_leader_pid(struct task_struct *p)
+ {
+-	return p->pid == p->tgid;
++	return task_pid(p) == p->signal->leader_pid;
+ }
+ 
+ static inline
+-int same_thread_group(struct task_struct *p1, struct task_struct *p2)
++bool same_thread_group(struct task_struct *p1, struct task_struct *p2)
+ {
+-	return p1->tgid == p2->tgid;
++	return p1->signal == p2->signal;
+ }
+ 
+ static inline struct task_struct *next_thread(const struct task_struct *p)
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 416dcb0..b8b2e50 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1202,6 +1202,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
+ 
+ extern int ip_vs_use_count_inc(void);
+ extern void ip_vs_use_count_dec(void);
++extern int ip_vs_register_nl_ioctl(void);
++extern void ip_vs_unregister_nl_ioctl(void);
+ extern int ip_vs_control_init(void);
+ extern void ip_vs_control_cleanup(void);
+ extern struct ip_vs_dest *
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index a15432da..2cccd82 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -209,6 +209,7 @@ extern struct sctp_globals {
+ 	struct list_head addr_waitq;
+ 	struct timer_list addr_wq_timer;
+ 	struct list_head auto_asconf_splist;
++	/* Lock that protects both addr_waitq and auto_asconf_splist */
+ 	spinlock_t addr_wq_lock;
+ 
+ 	/* Lock that protects the local_addr_list writers */
+@@ -355,6 +356,10 @@ struct sctp_sock {
+ 	atomic_t pd_mode;
+ 	/* Receive to here while partial delivery is in effect. */
+ 	struct sk_buff_head pd_lobby;
++
++	/* These must be the last fields, as they will skipped on copies,
++	 * like on accept and peeloff operations
++	 */
+ 	struct list_head auto_asconf_list;
+ 	int do_auto_asconf;
+ };
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index 4f865df..7ee55e3 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -43,7 +43,8 @@
+ 
+ #define EMUPAGESIZE     4096
+ #define MAXREQVOICES    8
+-#define MAXPAGES        8192
++#define MAXPAGES0       4096	/* 32 bit mode */
++#define MAXPAGES1       8192	/* 31 bit mode */
+ #define RESERVED        0
+ #define NUM_MIDI        16
+ #define NUM_G           64              /* use all channels */
+@@ -52,8 +53,7 @@
+ 
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK	0x7fffffffUL	/* 31bit */
+-#define AUDIGY_DMA_MASK		0x7fffffffUL	/* 31bit FIXME - 32 should work? */
+-						/* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK		0xffffffffUL	/* 32bit mode */
+ 
+ #define TMEMSIZE        256*1024
+ #define TMEMSIZEREG     4
+@@ -470,8 +470,11 @@
+ 
+ #define MAPB			0x0d		/* Cache map B						*/
+ 
+-#define MAP_PTE_MASK		0xffffe000	/* The 19 MSBs of the PTE indexed by the PTI		*/
+-#define MAP_PTI_MASK		0x00001fff	/* The 13 bit index to one of the 8192 PTE dwords      	*/
++#define MAP_PTE_MASK0		0xfffff000	/* The 20 MSBs of the PTE indexed by the PTI		*/
++#define MAP_PTI_MASK0		0x00000fff	/* The 12 bit index to one of the 4096 PTE dwords      	*/
++
++#define MAP_PTE_MASK1		0xffffe000	/* The 19 MSBs of the PTE indexed by the PTI		*/
++#define MAP_PTI_MASK1		0x00001fff	/* The 13 bit index to one of the 8192 PTE dwords      	*/
+ 
+ /* 0x0e, 0x0f: Not used */
+ 
+@@ -1708,6 +1711,7 @@ struct snd_emu10k1 {
+ 	unsigned short model;			/* subsystem id */
+ 	unsigned int card_type;			/* EMU10K1_CARD_* */
+ 	unsigned int ecard_ctrl;		/* ecard control bits */
++	unsigned int address_mode;		/* address mode */
+ 	unsigned long dma_mask;			/* PCI DMA mask */
+ 	unsigned int delay_pcm_irq;		/* in samples */
+ 	int max_cache_pages;			/* max memory size / PAGE_SIZE */
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 8f3d622..89b672d 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+ 			      irq_handler_t handler,
+ 			      unsigned long irqflags, const char *devname,
+ 			      void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ 			    irq_handler_t handler,
+ 			    unsigned long irqflags, const char *devname,
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index f79803a..f07c144 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -225,7 +225,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ 	 */
+ 	int dumpable = 0;
+ 	/* Don't let security modules deny introspection */
+-	if (task == current)
++	if (same_thread_group(task, current))
+ 		return 0;
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+@@ -640,6 +640,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
+ static int ptrace_resume(struct task_struct *child, long request,
+ 			 unsigned long data)
+ {
++	bool need_siglock;
++
+ 	if (!valid_signal(data))
+ 		return -EIO;
+ 
+@@ -667,8 +669,26 @@ static int ptrace_resume(struct task_struct *child, long request,
+ 		user_disable_single_step(child);
+ 	}
+ 
++	/*
++	 * Change ->exit_code and ->state under siglock to avoid the race
++	 * with wait_task_stopped() in between; a non-zero ->exit_code will
++	 * wrongly look like another report from tracee.
++	 *
++	 * Note that we need siglock even if ->exit_code == data and/or this
++	 * status was not reported yet, the new status must not be cleared by
++	 * wait_task_stopped() after resume.
++	 *
++	 * If data == 0 we do not care if wait_task_stopped() reports the old
++	 * status and clears the code too; this can't race with the tracee, it
++	 * takes siglock after resume.
++	 */
++	need_siglock = data && !thread_group_empty(current);
++	if (need_siglock)
++		spin_lock_irq(&child->sighand->siglock);
+ 	child->exit_code = data;
+ 	wake_up_state(child, __TASK_TRACED);
++	if (need_siglock)
++		spin_unlock_irq(&child->sighand->siglock);
+ 
+ 	return 0;
+ }
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 2c71d91..44bc103 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip)
+ EXPORT_SYMBOL(local_bh_enable_ip);
+ 
+ /*
+- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+- * and we fall back to softirqd after that.
++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
++ * but break the loop if need_resched() is set or after 2 ms.
++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
++ * certain cases, such as stop_machine(), jiffies may cease to
++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
++ * well to make sure we eventually return from this method.
+  *
+- * This number has been established via experimentation.
++ * These limits have been established via experimentation.
+  * The two things to balance is latency against fairness -
+  * we want to handle softirqs as soon as possible, but they
+  * should not be able to lock up the box.
+  */
++#define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
+ #define MAX_SOFTIRQ_RESTART 10
+ 
+ asmlinkage void __do_softirq(void)
+ {
+ 	struct softirq_action *h;
+ 	__u32 pending;
+-	int max_restart = MAX_SOFTIRQ_RESTART;
++	unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
+ 	int cpu;
++	int max_restart = MAX_SOFTIRQ_RESTART;
+ 
+ 	pending = local_softirq_pending();
+ 	account_system_vtime(current);
+@@ -255,11 +261,13 @@ restart:
+ 	local_irq_disable();
+ 
+ 	pending = local_softirq_pending();
+-	if (pending && --max_restart)
+-		goto restart;
++	if (pending) {
++		if (time_before(jiffies, end) && !need_resched() &&
++		    --max_restart)
++			goto restart;
+ 
+-	if (pending)
+ 		wakeup_softirqd();
++	}
+ 
+ 	lockdep_softirq_exit();
+ 
+diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
+index a5457d5..6ad2e2d 100644
+--- a/kernel/trace/ring_buffer_benchmark.c
++++ b/kernel/trace/ring_buffer_benchmark.c
+@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)
+ 
+ 	if (producer_fifo >= 0) {
+ 		struct sched_param param = {
+-			.sched_priority = consumer_fifo
++			.sched_priority = producer_fifo
+ 		};
+ 		sched_setscheduler(producer, SCHED_FIFO, &param);
+ 	} else
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index b0996c1..47343cc 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1343,19 +1343,25 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ 	int n_normal_preds = 0, n_logical_preds = 0;
+ 	struct postfix_elt *elt;
++	int cnt = 0;
+ 
+ 	list_for_each_entry(elt, &ps->postfix, list) {
+-		if (elt->op == OP_NONE)
++		if (elt->op == OP_NONE) {
++			cnt++;
+ 			continue;
++		}
+ 
+ 		if (elt->op == OP_AND || elt->op == OP_OR) {
+ 			n_logical_preds++;
++			cnt--;
+ 			continue;
+ 		}
++		cnt--;
+ 		n_normal_preds++;
++		WARN_ON_ONCE(cnt < 0);
+ 	}
+ 
+-	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ 		return -EINVAL;
+ 	}
+diff --git a/lib/string.c b/lib/string.c
+index 40136f6..dcbe695 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -595,7 +595,7 @@ EXPORT_SYMBOL(memset);
+ void memzero_explicit(void *s, size_t count)
+ {
+ 	memset(s, 0, count);
+-	OPTIMIZER_HIDE_VAR(s);
++	barrier();
+ }
+ EXPORT_SYMBOL(memzero_explicit);
+ 
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 1bf1f74..62bfbd9 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -560,7 +560,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	 */
+ 	setpoint = (freerun + limit) / 2;
+ 	x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+-		    limit - setpoint + 1);
++		      (limit - setpoint) | 1);
+ 	pos_ratio = x;
+ 	pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+ 	pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -611,7 +611,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	 * scale global setpoint to bdi's:
+ 	 *	bdi_setpoint = setpoint * bdi_thresh / thresh
+ 	 */
+-	x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++	x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ 	bdi_setpoint = setpoint * (u64)x >> 16;
+ 	/*
+ 	 * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -626,7 +626,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 
+ 	if (bdi_dirty < x_intercept - span / 4) {
+ 		pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+-				    x_intercept - bdi_setpoint + 1);
++				      (x_intercept - bdi_setpoint) | 1);
+ 	} else
+ 		pos_ratio /= 4;
+ 
+diff --git a/mm/slub.c b/mm/slub.c
+index 6a4c2fb..60c6969 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1873,18 +1873,24 @@ redo:
+ /* Unfreeze all the cpu partial slabs */
+ static void unfreeze_partials(struct kmem_cache *s)
+ {
+-	struct kmem_cache_node *n = NULL;
++	struct kmem_cache_node *n = NULL, *n2 = NULL;
+ 	struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
+ 	struct page *page, *discard_page = NULL;
+ 
+ 	while ((page = c->partial)) {
+-		enum slab_modes { M_PARTIAL, M_FREE };
+-		enum slab_modes l, m;
+ 		struct page new;
+ 		struct page old;
+ 
+ 		c->partial = page->next;
+-		l = M_FREE;
++
++		n2 = get_node(s, page_to_nid(page));
++		if (n != n2) {
++			if (n)
++				spin_unlock(&n->list_lock);
++
++			n = n2;
++			spin_lock(&n->list_lock);
++		}
+ 
+ 		do {
+ 
+@@ -1897,40 +1903,17 @@ static void unfreeze_partials(struct kmem_cache *s)
+ 
+ 			new.frozen = 0;
+ 
+-			if (!new.inuse && (!n || n->nr_partial > s->min_partial))
+-				m = M_FREE;
+-			else {
+-				struct kmem_cache_node *n2 = get_node(s,
+-							page_to_nid(page));
+-
+-				m = M_PARTIAL;
+-				if (n != n2) {
+-					if (n)
+-						spin_unlock(&n->list_lock);
+-
+-					n = n2;
+-					spin_lock(&n->list_lock);
+-				}
+-			}
+-
+-			if (l != m) {
+-				if (l == M_PARTIAL)
+-					remove_partial(n, page);
+-				else
+-					add_partial(n, page,
+-						DEACTIVATE_TO_TAIL);
+-
+-				l = m;
+-			}
+-
+ 		} while (!cmpxchg_double_slab(s, page,
+ 				old.freelist, old.counters,
+ 				new.freelist, new.counters,
+ 				"unfreezing slab"));
+ 
+-		if (m == M_FREE) {
++		if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
+ 			page->next = discard_page;
+ 			discard_page = page;
++		} else {
++			add_partial(n, page, DEACTIVATE_TO_TAIL);
++			stat(s, FREE_ADD_PARTIAL);
+ 		}
+ 	}
+ 
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 7222fe1..ea0e15c 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ 		if (!capable(CAP_NET_ADMIN))
+ 			return -EPERM;
+ 
+-		spin_lock_bh(&br->lock);
+ 		br_stp_set_bridge_priority(br, args[1]);
+-		spin_unlock_bh(&br->lock);
+ 		return 0;
+ 
+ 	case BRCTL_SET_PORT_PRIORITY:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 398a297..1bd197f 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ 		}
+ 
+ 		err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+-		if (!err)
++		if (err)
+ 			break;
+ 	}
+ 
+@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br,
+ 	struct net_bridge_port *p;
+ 	struct hlist_node *n, *slot = NULL;
+ 
++	if (!hlist_unhashed(&port->rlist))
++		return;
++
+ 	hlist_for_each_entry(p, n, &br->router_list, rlist) {
+ 		if ((unsigned long) port >= (unsigned long) p)
+ 			break;
+@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
+ 	if (port->multicast_router != 1)
+ 		return;
+ 
+-	if (!hlist_unhashed(&port->rlist))
+-		goto timer;
+-
+ 	br_multicast_add_router(br, port);
+ 
+-timer:
+ 	mod_timer(&port->multicast_router_timer,
+ 		  now + br->multicast_querier_interval);
+ }
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 19308e3..0f7dc60 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -235,12 +235,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+ 	return true;
+ }
+ 
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ 	struct net_bridge_port *p;
+ 	int wasroot;
+ 
++	spin_lock_bh(&br->lock);
+ 	wasroot = br_is_root_bridge(br);
+ 
+ 	list_for_each_entry(p, &br->port_list, list) {
+@@ -258,6 +259,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ 	br_port_state_selection(br);
+ 	if (br_is_root_bridge(br) && !wasroot)
+ 		br_become_root_bridge(br);
++	spin_unlock_bh(&br->lock);
+ }
+ 
+ /* called under bridge lock */
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 7eed9eb..7e4b4b4 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -366,6 +366,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
+ 		release_sock(sk);
+ 		timeo = schedule_timeout(timeo);
+ 		lock_sock(sk);
++
++		if (sock_flag(sk, SOCK_DEAD))
++			break;
++
+ 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ 	}
+ 
+@@ -410,6 +414,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		struct sk_buff *skb;
+ 
+ 		lock_sock(sk);
++		if (sock_flag(sk, SOCK_DEAD)) {
++			err = -ECONNRESET;
++			goto unlock;
++		}
+ 		skb = skb_dequeue(&sk->sk_receive_queue);
+ 		caif_check_flow_release(sk);
+ 
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 0ea3fd3..c8c2645 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -955,6 +955,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ 	rc = 0;
+ 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ 		goto out_unlock_bh;
++	if (neigh->dead)
++		goto out_dead;
+ 
+ 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ 		if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+@@ -1003,6 +1005,13 @@ out_unlock_bh:
+ 		write_unlock(&neigh->lock);
+ 	local_bh_enable();
+ 	return rc;
++
++out_dead:
++	if (neigh->nud_state & NUD_STALE)
++		goto out_unlock_bh;
++	write_unlock_bh(&neigh->lock);
++	kfree_skb(skb);
++	return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+ 
+@@ -1066,6 +1075,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ 	    (old & (NUD_NOARP | NUD_PERMANENT)))
+ 		goto out;
++	if (neigh->dead)
++		goto out;
+ 
+ 	if (!(new & NUD_VALID)) {
+ 		neigh_del_timer(neigh);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 8c2e259..5e92043 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1248,10 +1248,8 @@ csum_copy_err:
+ 		UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+ 	unlock_sock_fast(sk, slow);
+ 
+-	if (noblock)
+-		return -EAGAIN;
+-
+-	/* starting over for a new packet */
++	/* starting over for a new packet, but check if we need to yield */
++	cond_resched();
+ 	msg->msg_flags &= ~MSG_TRUNC;
+ 	goto try_again;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d131a95..dc08afd 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -451,10 +451,8 @@ csum_copy_err:
+ 	}
+ 	unlock_sock_fast(sk, slow);
+ 
+-	if (noblock)
+-		return -EAGAIN;
+-
+-	/* starting over for a new packet */
++	/* starting over for a new packet, but check if we need to yield */
++	cond_resched();
+ 	msg->msg_flags &= ~MSG_TRUNC;
+ 	goto try_again;
+ }
+diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
+index a1c6bfd..34583c5 100644
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+ 
+ 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+ 
+-	if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+-		    skb_headroom(skb) < WEP_IV_LEN))
++	if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
+ 		return NULL;
+ 
+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ 	size_t len;
+ 	u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+ 
++	if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
++		return -1;
++
+ 	iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+ 	if (!iv)
+ 		return -1;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index d864aaf..197ed93 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2003,10 +2003,18 @@ static int __init ip_vs_init(void)
+ 		goto cleanup_dev;
+ 	}
+ 
++	ret = ip_vs_register_nl_ioctl();
++	if (ret < 0) {
++		pr_err("can't register netlink/ioctl.\n");
++		goto cleanup_hooks;
++	}
++
+ 	pr_info("ipvs loaded.\n");
+ 
+ 	return ret;
+ 
++cleanup_hooks:
++	nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ cleanup_dev:
+ 	unregister_pernet_device(&ipvs_core_dev_ops);
+ cleanup_sub:
+@@ -2022,6 +2030,7 @@ exit:
+ 
+ static void __exit ip_vs_cleanup(void)
+ {
++	ip_vs_unregister_nl_ioctl();
+ 	nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ 	unregister_pernet_device(&ipvs_core_dev_ops);
+ 	unregister_pernet_subsys(&ipvs_core_ops);	/* free ip_vs struct */
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 93acfa1..1e27a1f 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3689,6 +3689,9 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+ 	cancel_work_sync(&ipvs->defense_work.work);
+ 	unregister_net_sysctl_table(ipvs->sysctl_hdr);
+ 	ip_vs_stop_estimator(net, &ipvs->tot_stats);
++
++	if (!net_eq(net, &init_net))
++		kfree(ipvs->sysctl_tbl);
+ }
+ 
+ #else
+@@ -3751,21 +3754,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
+ 	free_percpu(ipvs->tot_stats.cpustats);
+ }
+ 
+-int __init ip_vs_control_init(void)
++int __init ip_vs_register_nl_ioctl(void)
+ {
+-	int idx;
+ 	int ret;
+ 
+-	EnterFunction(2);
+-
+-	/* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+-	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
+-		INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+-		INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+-	}
+-
+-	smp_wmb();	/* Do we really need it now ? */
+-
+ 	ret = nf_register_sockopt(&ip_vs_sockopts);
+ 	if (ret) {
+ 		pr_err("cannot register sockopt.\n");
+@@ -3777,28 +3769,47 @@ int __init ip_vs_control_init(void)
+ 		pr_err("cannot register Generic Netlink interface.\n");
+ 		goto err_genl;
+ 	}
+-
+-	ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+-	if (ret < 0)
+-		goto err_notf;
+-
+-	LeaveFunction(2);
+ 	return 0;
+ 
+-err_notf:
+-	ip_vs_genl_unregister();
+ err_genl:
+ 	nf_unregister_sockopt(&ip_vs_sockopts);
+ err_sock:
+ 	return ret;
+ }
+ 
++void ip_vs_unregister_nl_ioctl(void)
++{
++	ip_vs_genl_unregister();
++	nf_unregister_sockopt(&ip_vs_sockopts);
++}
++
++int __init ip_vs_control_init(void)
++{
++	int idx;
++	int ret;
++
++	EnterFunction(2);
++
++	/* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
++	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
++		INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
++		INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
++	}
++
++	smp_wmb();	/* Do we really need it now ? */
++
++	ret = register_netdevice_notifier(&ip_vs_dst_notifier);
++	if (ret < 0)
++		return ret;
++
++	LeaveFunction(2);
++	return 0;
++}
++
+ 
+ void ip_vs_control_cleanup(void)
+ {
+ 	EnterFunction(2);
+ 	unregister_netdevice_notifier(&ip_vs_dst_notifier);
+-	ip_vs_genl_unregister();
+-	nf_unregister_sockopt(&ip_vs_sockopts);
+ 	LeaveFunction(2);
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 4f19bf2..0c21f06 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1170,16 +1170,6 @@ static void packet_sock_destruct(struct sock *sk)
+ 	sk_refcnt_debug_dec(sk);
+ }
+ 
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+-	int x = atomic_read(&f->rr_cur) + 1;
+-
+-	if (x >= num)
+-		x = 0;
+-
+-	return x;
+-}
+-
+ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+ 	u32 idx, hash = skb->rxhash;
+@@ -1191,13 +1181,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s
+ 
+ static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+-	int cur, old;
++	unsigned int val = atomic_inc_return(&f->rr_cur);
+ 
+-	cur = atomic_read(&f->rr_cur);
+-	while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+-				     fanout_rr_next(f, num))) != cur)
+-		cur = old;
+-	return f->arr[cur];
++	return f->arr[val % num];
+ }
+ 
+ static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+@@ -1211,7 +1197,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ 			     struct packet_type *pt, struct net_device *orig_dev)
+ {
+ 	struct packet_fanout *f = pt->af_packet_priv;
+-	unsigned int num = f->num_members;
++	unsigned int num = ACCESS_ONCE(f->num_members);
+ 	struct packet_sock *po;
+ 	struct sock *sk;
+ 
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index c3b8549..6d56eec 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,9 @@ out:
+ 	return err;
+ no_route:
+ 	kfree_skb(nskb);
+-	IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
++
++	if (asoc)
++		IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+ 
+ 	/* FIXME: Returning the 'err' will effect all the associations
+ 	 * associated with a socket, although only one of the paths of the
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index fc63664..24e88af 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ 
+ 	/* Supposedly, no process has access to the socket, but
+ 	 * the net layers still may.
++	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++	 * held and that should be grabbed before socket lock.
+ 	 */
+-	sctp_local_bh_disable();
++	spin_lock_bh(&sctp_globals.addr_wq_lock);
+ 	sctp_bh_lock_sock(sk);
+ 
+ 	/* Hold the sock, since sk_common_release() will put sock_put()
+@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ 	sk_common_release(sk);
+ 
+ 	sctp_bh_unlock_sock(sk);
+-	sctp_local_bh_enable();
++	spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ 
+ 	sock_put(sk);
+ 
+@@ -3499,6 +3501,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ 	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+ 		return 0;
+ 
++	spin_lock_bh(&sctp_globals.addr_wq_lock);
+ 	if (val == 0 && sp->do_auto_asconf) {
+ 		list_del(&sp->auto_asconf_list);
+ 		sp->do_auto_asconf = 0;
+@@ -3507,6 +3510,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ 		    &sctp_auto_asconf_splist);
+ 		sp->do_auto_asconf = 1;
+ 	}
++	spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ 	return 0;
+ }
+ 
+@@ -3942,18 +3946,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ 	local_bh_disable();
+ 	percpu_counter_inc(&sctp_sockets_allocated);
+ 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++
++	/* Nothing can fail after this block, otherwise
++	 * sctp_destroy_sock() will be called without addr_wq_lock held
++	 */
+ 	if (sctp_default_auto_asconf) {
++		spin_lock(&sctp_globals.addr_wq_lock);
+ 		list_add_tail(&sp->auto_asconf_list,
+ 		    &sctp_auto_asconf_splist);
+ 		sp->do_auto_asconf = 1;
+-	} else
++		spin_unlock(&sctp_globals.addr_wq_lock);
++	} else {
+ 		sp->do_auto_asconf = 0;
++	}
++
+ 	local_bh_enable();
+ 
+ 	return 0;
+ }
+ 
+-/* Cleanup any SCTP per socket resources.  */
++/* Cleanup any SCTP per socket resources. Must be called with
++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true
++ */
+ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+ {
+ 	struct sctp_sock *sp;
+@@ -6719,6 +6733,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ 	newinet->mc_list = NULL;
+ }
+ 
++static inline void sctp_copy_descendant(struct sock *sk_to,
++					const struct sock *sk_from)
++{
++	int ancestor_size = sizeof(struct inet_sock) +
++			    sizeof(struct sctp_sock) -
++			    offsetof(struct sctp_sock, auto_asconf_list);
++
++	if (sk_from->sk_family == PF_INET6)
++		ancestor_size += sizeof(struct ipv6_pinfo);
++
++	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
++}
++
+ /* Populate the fields of the newsk from the oldsk and migrate the assoc
+  * and its messages to the newsk.
+  */
+@@ -6733,7 +6760,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ 	struct sk_buff *skb, *tmp;
+ 	struct sctp_ulpevent *event;
+ 	struct sctp_bind_hashbucket *head;
+-	struct list_head tmplist;
+ 
+ 	/* Migrate socket buffer sizes and all the socket level options to the
+ 	 * new socket.
+@@ -6741,12 +6767,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ 	newsk->sk_sndbuf = oldsk->sk_sndbuf;
+ 	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
+ 	/* Brute force copy old sctp opt. */
+-	if (oldsp->do_auto_asconf) {
+-		memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+-		inet_sk_copy_descendant(newsk, oldsk);
+-		memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+-	} else
+-		inet_sk_copy_descendant(newsk, oldsk);
++	sctp_copy_descendant(newsk, oldsk);
+ 
+ 	/* Restore the ep value that was overwritten with the above structure
+ 	 * copy.
+diff --git a/net/socket.c b/net/socket.c
+index 116cf9d..10ea25a 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1911,14 +1911,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+ 	int err, ctl_len, iov_size, total_len;
+ 
+ 	err = -EFAULT;
+-	if (MSG_CMSG_COMPAT & flags) {
+-		if (get_compat_msghdr(msg_sys, msg_compat))
+-			return -EFAULT;
+-	} else {
++	if (MSG_CMSG_COMPAT & flags)
++		err = get_compat_msghdr(msg_sys, msg_compat);
++	else
+ 		err = copy_msghdr_from_user(msg_sys, msg);
+-		if (err)
+-			return err;
+-	}
++	if (err)
++		return err;
+ 
+ 	/* do not move before msg_sys is valid */
+ 	err = -EMSGSIZE;
+@@ -2130,14 +2128,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+ 	struct sockaddr __user *uaddr;
+ 	int __user *uaddr_len;
+ 
+-	if (MSG_CMSG_COMPAT & flags) {
+-		if (get_compat_msghdr(msg_sys, msg_compat))
+-			return -EFAULT;
+-	} else {
++	if (MSG_CMSG_COMPAT & flags)
++		err = get_compat_msghdr(msg_sys, msg_compat);
++	else
+ 		err = copy_msghdr_from_user(msg_sys, msg);
+-		if (err)
+-			return err;
+-	}
++	if (err)
++		return err;
+ 
+ 	err = -EMSGSIZE;
+ 	if (msg_sys->msg_iovlen > UIO_MAXIOV)
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 8705ee3..9b1f371 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1870,6 +1870,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
+ 		unix_state_unlock(sk);
+ 		timeo = schedule_timeout(timeo);
+ 		unix_state_lock(sk);
++
++		if (sock_flag(sk, SOCK_DEAD))
++			break;
++
+ 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ 	}
+ 
+@@ -1930,6 +1934,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		struct sk_buff *skb;
+ 
+ 		unix_state_lock(sk);
++		if (sock_flag(sk, SOCK_DEAD)) {
++			err = -ECONNRESET;
++			goto unlock;
++		}
+ 		skb = skb_peek(&sk->sk_receive_queue);
+ 		if (skb == NULL) {
+ 			unix_sk(sk)->recursion_level = 0;
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 0920ea3..5776921 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
+ 	{ XFRM_MSG_FLUSHPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ 	{ XFRM_MSG_NEWAE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ 	{ XFRM_MSG_GETAE,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_REPORT,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_MIGRATE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++	{ XFRM_MSG_NEWSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_GETSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_GETSPDINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_MAPPING,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
+ };
+ 
+ static struct nlmsg_perm nlmsg_audit_perms[] =
+diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
+index eaa198e..f33e3cc 100644
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
+ 	}
+ #endif
+  
+-	strcpy(card->driver, emu->card_capabilities->driver);
+-	strcpy(card->shortname, emu->card_capabilities->name);
++	strlcpy(card->driver, emu->card_capabilities->driver,
++		sizeof(card->driver));
++	strlcpy(card->shortname, emu->card_capabilities->name,
++		sizeof(card->shortname));
+ 	snprintf(card->longname, sizeof(card->longname),
+ 		 "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ 		 card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index f35284b..8295950 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ 	snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+ 
+ 	/* invalidate maps */
+-	temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++	temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 	snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ 	snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ 		snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+ 
+ 		/* invalidate maps */
+-		temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++		temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 		snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ 		snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ 		
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index d37b946..705e73e 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ 	snd_emu10k1_ptr_write(emu, TCB, 0, 0);	/* taken from original driver */
+ 	snd_emu10k1_ptr_write(emu, TCBS, 0, 4);	/* taken from original driver */
+ 
+-	silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++	silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 	for (ch = 0; ch < NUM_G; ch++) {
+ 		snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ 		snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ 		outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ 	}
+ 
++	if (emu->address_mode == 0) {
++		/* use 16M in 4G */
++		outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ 	 *
+ 	 */
+ 	{.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+-	 .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++	 .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ 	 .id = "Audigy2",
+ 	 .emu10k2_chip = 1,
+ 	 .ca0108_chip = 1,
+@@ -1528,7 +1533,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ 	 .adc_1361t = 1,  /* 24 bit capture instead of 16bit */
+ 	 .ac97_chip = 1} ,
+ 	{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+-	 .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++	 .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ 	 .id = "Audigy2",
+ 	 .emu10k2_chip = 1,
+ 	 .ca0102_chip = 1,
+@@ -1832,8 +1837,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ 
+ 	is_audigy = emu->audigy = c->emu10k2_chip;
+ 
++	/* set addressing mode */
++	emu->address_mode = is_audigy ? 0 : 1;
+ 	/* set the DMA transfer mask */
+-	emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++	emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ 	if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ 	    pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ 		snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);
+@@ -1856,7 +1863,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ 
+ 	emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ 	if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+-				32 * 1024, &emu->ptb_pages) < 0) {
++				(emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ 		err = -ENOMEM;
+ 		goto error;
+ 	}
+@@ -1955,8 +1962,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ 
+ 	/* Clear silent pages and set up pointers */
+ 	memset(emu->silent_page.area, 0, PAGE_SIZE);
+-	silent_page = emu->silent_page.addr << 1;
+-	for (idx = 0; idx < MAXPAGES; idx++)
++	silent_page = emu->silent_page.addr << emu->address_mode;
++	for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ 		((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+ 
+ 	/* set up voice indices */
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index e22b8e2..c673d2b 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
+ 	snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ 	snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ 	/* invalidate maps */
+-	silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++	silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 	snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ 	snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ 	/* modulation envelope */
+diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
+index bc38dd4..9c499e6 100644
+--- a/sound/pci/emu10k1/emuproc.c
++++ b/sound/pci/emu10k1/emuproc.c
+@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
+ 	struct snd_emu10k1 *emu = entry->private_data;
+ 	u32 value;
+ 	u32 value2;
+-	unsigned long flags;
+ 	u32 rate;
+ 
+ 	if (emu->card_capabilities->emu_model) {
+-		spin_lock_irqsave(&emu->emu_lock, flags);
+ 		snd_emu1010_fpga_read(emu, 0x38, &value);
+-		spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 		if ((value & 0x1) == 0) {
+-			spin_lock_irqsave(&emu->emu_lock, flags);
+ 			snd_emu1010_fpga_read(emu, 0x2a, &value);
+ 			snd_emu1010_fpga_read(emu, 0x2b, &value2);
+-			spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 			rate = 0x1770000 / (((value << 5) | value2)+1);	
+ 			snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
+ 		} else {
+ 			snd_iprintf(buffer, "ADAT Unlocked\n");
+ 		}
+-		spin_lock_irqsave(&emu->emu_lock, flags);
+ 		snd_emu1010_fpga_read(emu, 0x20, &value);
+-		spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 		if ((value & 0x4) == 0) {
+-			spin_lock_irqsave(&emu->emu_lock, flags);
+ 			snd_emu1010_fpga_read(emu, 0x28, &value);
+ 			snd_emu1010_fpga_read(emu, 0x29, &value2);
+-			spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 			rate = 0x1770000 / (((value << 5) | value2)+1);	
+ 			snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
+ 		} else {
+@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
+ {
+ 	struct snd_emu10k1 *emu = entry->private_data;
+ 	u32 value;
+-	unsigned long flags;
+ 	int i;
+ 	snd_iprintf(buffer, "EMU1010 Registers:\n\n");
+ 
+ 	for(i = 0; i < 0x40; i+=1) {
+-		spin_lock_irqsave(&emu->emu_lock, flags);
+ 		snd_emu1010_fpga_read(emu, i, &value);
+-		spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 		snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
+ 	}
+ }
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index 4f502a2..87b7c65 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+  * aligned pages in others
+  */
+ #define __set_ptb_entry(emu,page,addr) \
+-	(((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++	(((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+ 
+ #define UNIT_PAGES		(PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES		(MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0		(MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1		(MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset)	((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
+ 		}
+ 		page = blk->mapped_page + blk->pages;
+ 	}
+-	size = MAX_ALIGN_PAGES - page;
++	size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ 	if (size >= max_size) {
+ 		*nextp = pos;
+ 		return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
+ 		q = get_emu10k1_memblk(p, mapped_link);
+ 		end_page = q->mapped_page;
+ 	} else
+-		end_page = MAX_ALIGN_PAGES;
++		end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+ 
+ 	/* remove links */
+ 	list_del(&blk->mapped_link);
+@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ 	if (snd_BUG_ON(!emu))
+ 		return NULL;
+ 	if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+-		       runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++		       runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ 		return NULL;
+ 	hdr = emu->memhdr;
+ 	if (snd_BUG_ON(!hdr))
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 843d9f3..6a524fb 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4598,6 +4598,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f150b9, .name = "CX20665",
+ 	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f1, .name = "CX20721",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f2, .name = "CX20722",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f3, .name = "CX20723",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f4, .name = "CX20724",
++	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f1510f, .name = "CX20751/2",
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f15110, .name = "CX20751/2",
+@@ -4632,6 +4640,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 561d5e0..e99c10b 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
+ 	if (gpio_nreset >= 0) {
+ 		/* Reset codec */
+ 		gpio_direction_output(gpio_nreset, 0);
+-		udelay(1);
++		mdelay(1);
+ 		gpio_set_value(gpio_nreset, 1);
+ 		/* Give the codec time to wake up */
+-		udelay(1);
++		mdelay(1);
+ 	}
+ 
+ 	cs4271->gpio_nreset = gpio_nreset;
+diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
+index 57ad22a..6ab4f27 100644
+--- a/sound/soc/codecs/wm8741.c
++++ b/sound/soc/codecs/wm8741.c
+@@ -117,7 +117,7 @@ static struct {
+ };
+ 
+ static unsigned int rates_11289[] = {
+-	44100, 88235,
++	44100, 88200,
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_11289 = {
+@@ -144,7 +144,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = {
+ };
+ 
+ static unsigned int rates_16934[] = {
+-	44100, 88235,
++	44100, 88200,
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_16934 = {
+@@ -162,7 +162,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = {
+ };
+ 
+ static unsigned int rates_22579[] = {
+-	44100, 88235, 1764000
++	44100, 88200, 176400
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_22579 = {
+@@ -180,7 +180,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = {
+ };
+ 
+ static unsigned int rates_36864[] = {
+-	48000, 96000, 19200
++	48000, 96000, 192000
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_36864 = {
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index b2abe93..8d26104 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -336,7 +336,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
+ 	{ "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ 	{ "Right Input Mixer", NULL, "RINPUT1", },  /* Really Boost Switch */
+ 	{ "Right Input Mixer", NULL, "RINPUT2" },
+-	{ "Right Input Mixer", NULL, "LINPUT3" },
++	{ "Right Input Mixer", NULL, "RINPUT3" },
+ 
+ 	{ "Left ADC", NULL, "Left Input Mixer" },
+ 	{ "Right ADC", NULL, "Right Input Mixer" },
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index b73f226..9a56798 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2449,7 +2449,7 @@ static struct {
+ };
+ 
+ static int fs_ratios[] = {
+-	64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++	64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+ 
+ static int bclk_divs[] = {
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 1d83a40..3dc1b8a 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2675,12 +2675,18 @@ int snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ 		kfree(w);
+ 		return -ENOMEM;
+ 	}
+-	if (dapm->codec && dapm->codec->name_prefix)
++	if (dapm->codec && dapm->codec->name_prefix) {
+ 		snprintf(w->name, name_len, "%s %s",
+ 			dapm->codec->name_prefix, widget->name);
+-	else
++		if (widget->sname)
++			w->sname = kasprintf(GFP_KERNEL, "%s %s",
++					     dapm->codec->name_prefix,
++					     widget->sname);
++	} else {
+ 		snprintf(w->name, name_len, "%s", widget->name);
+-
++		if (widget->sname)
++			w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
++	}
+ 	switch (w->id) {
+ 	case snd_soc_dapm_switch:
+ 	case snd_soc_dapm_mixer:
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index 319754c..daf61ab 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ 	if (snd_BUG_ON(!arg || !emu))
+ 		return -ENXIO;
+ 
+-	mutex_lock(&emu->register_mutex);
+-
+-	if (!snd_emux_inc_count(emu)) {
+-		mutex_unlock(&emu->register_mutex);
++	if (!snd_emux_inc_count(emu))
+ 		return -EFAULT;
+-	}
+ 
+ 	memset(&callback, 0, sizeof(callback));
+ 	callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ 	if (p == NULL) {
+ 		snd_printk(KERN_ERR "can't create port\n");
+ 		snd_emux_dec_count(emu);
+-		mutex_unlock(&emu->register_mutex);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ 	reset_port_mode(p, arg->seq_mode);
+ 
+ 	snd_emux_reset_port(p);
+-
+-	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+ 
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
+ 	if (snd_BUG_ON(!emu))
+ 		return -ENXIO;
+ 
+-	mutex_lock(&emu->register_mutex);
+ 	snd_emux_sounds_off_all(p);
+ 	snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ 	snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ 	snd_emux_dec_count(emu);
+ 
+-	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+ 
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index 7778b8e..a020920 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
+ 	if (emu->voices)
+ 		snd_emux_terminate_all(emu);
+ 		
+-	mutex_lock(&emu->register_mutex);
+ 	if (emu->client >= 0) {
+ 		snd_seq_delete_kernel_client(emu->client);
+ 		emu->client = -1;
+ 	}
+-	mutex_unlock(&emu->register_mutex);
+ }
+ 
+ 
+@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
+ /*
+  * increment usage count
+  */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ 	emu->used++;
+ 	if (!try_module_get(emu->ops.owner))
+@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ 	return 1;
+ }
+ 
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++	int ret;
++
++	mutex_lock(&emu->register_mutex);
++	ret = __snd_emux_inc_count(emu);
++	mutex_unlock(&emu->register_mutex);
++	return ret;
++}
+ 
+ /*
+  * decrease usage count
+  */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ 	module_put(emu->card->module);
+ 	emu->used--;
+@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ 	module_put(emu->ops.owner);
+ }
+ 
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++	mutex_lock(&emu->register_mutex);
++	__snd_emux_dec_count(emu);
++	mutex_unlock(&emu->register_mutex);
++}
+ 
+ /*
+  * Routine that is called upon a first use of a particular port
+@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)
+ 
+ 	mutex_lock(&emu->register_mutex);
+ 	snd_emux_init_port(p);
+-	snd_emux_inc_count(emu);
++	__snd_emux_inc_count(emu);
+ 	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+ 
+ 	mutex_lock(&emu->register_mutex);
+ 	snd_emux_sounds_off_all(p);
+-	snd_emux_dec_count(emu);
++	__snd_emux_dec_count(emu);
+ 	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 88160b7..488e531 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -838,6 +838,8 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 	case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ 	case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ 	case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
++	case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
++	case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+ 	case USB_ID(0x046d, 0x0991):
+ 	/* Most audio usb devices lie about volume resolution.
+ 	 * Most Logitech webcams have res = 384.
+@@ -1423,11 +1425,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ 		snd_printk(KERN_ERR "invalid MIXER UNIT descriptor %d\n", unitid);
+ 		return -EINVAL;
+ 	}
+-	/* no bmControls field (e.g. Maya44) -> ignore */
+-	if (desc->bLength <= 10 + input_pins) {
+-		snd_printdd(KERN_INFO "MU %d has no bmControls field\n", unitid);
+-		return 0;
+-	}
+ 
+ 	num_ins = 0;
+ 	ich = 0;
+@@ -1435,6 +1432,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ 		err = parse_audio_unit(state, desc->baSourceID[pin]);
+ 		if (err < 0)
+ 			return err;
++		/* no bmControls field (e.g. Maya44) -> ignore */
++		if (desc->bLength <= 10 + input_pins)
++			continue;
+ 		err = check_input_term(state, desc->baSourceID[pin], &iterm);
+ 		if (err < 0)
+ 			return err;
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 1e0798f..851786f 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.ignore_ctl_error = 1,
+ 	},
+ 	{
++		/* MAYA44 USB+ */
++		.id = USB_ID(0x2573, 0x0008),
++		.map = maya44_map,
++	},
++	{
+ 		/* KEF X300A */
+ 		.id = USB_ID(0x27ac, 0x1000),
+ 		.map = scms_usb3318_map,
diff --git a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
index e361065..9aaf5cc 100644
--- a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch
+++ b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
@@ -315,7 +315,7 @@ index 2a68089..b3300e1 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 8071888..b024b7b 100644
+index 41a626b..31e889e 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1693,14 +1693,14 @@ index af18cea..b5dc173 100644
  
  #endif /* __ASSEMBLY__ */
 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 0e9ce8d..6ef1e03 100644
+index a4b1186..6ef1e03 100644
 --- a/arch/arm/include/asm/elf.h
 +++ b/arch/arm/include/asm/elf.h
 @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
  
--#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
+-#define ELF_ET_DYN_BASE	(TASK_SIZE / 3 * 2)
 +#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
 +
 +#ifdef CONFIG_PAX_ASLR
@@ -4188,21 +4188,19 @@ index 883fc6c..28c0acd 100644
  
  void __init gt641xx_irq_init(void)
 diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index 7f50318..20685b9 100644
+index 6e489e5..79e10cb 100644
 --- a/arch/mips/kernel/irq.c
 +++ b/arch/mips/kernel/irq.c
-@@ -111,7 +111,10 @@ void __init init_IRQ(void)
- #endif
+@@ -112,6 +112,8 @@ void __init init_IRQ(void)
  }
  
+ #ifdef CONFIG_DEBUG_STACKOVERFLOW
 +
- #ifdef DEBUG_STACKOVERFLOW
 +extern void gr_handle_kernel_exploit(void);
-+
  static inline void check_stack_overflow(void)
  {
  	unsigned long sp;
-@@ -127,6 +130,7 @@ static inline void check_stack_overflow(void)
+@@ -127,6 +129,7 @@ static inline void check_stack_overflow(void)
  		printk("do_IRQ: stack overflow: %ld\n",
  		       sp - sizeof(struct thread_info));
  		dump_stack();
@@ -4472,10 +4470,10 @@ index 302d779..b8b4e97 100644
 -	return ret;
 -}
 diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
-index ed1c542..88552ac 100644
+index 66d3c38..fed57fa 100644
 --- a/arch/mips/pci/pci-octeon.c
 +++ b/arch/mips/pci/pci-octeon.c
-@@ -335,8 +335,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -329,8 +329,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
  
  
  static struct pci_ops octeon_pci_ops = {
@@ -4487,10 +4485,10 @@ index ed1c542..88552ac 100644
  
  static struct resource octeon_pci_mem_resource = {
 diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
-index 0583c463..c07a38e 100644
+index 37a8790..dd636c1 100644
 --- a/arch/mips/pci/pcie-octeon.c
 +++ b/arch/mips/pci/pcie-octeon.c
-@@ -1238,8 +1238,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -1235,8 +1235,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
  }
  
  static struct pci_ops octeon_pcie0_ops = {
@@ -4501,7 +4499,7 @@ index 0583c463..c07a38e 100644
  };
  
  static struct resource octeon_pcie0_mem_resource = {
-@@ -1259,8 +1259,8 @@ static struct pci_controller octeon_pcie0_controller = {
+@@ -1256,8 +1256,8 @@ static struct pci_controller octeon_pcie0_controller = {
  };
  
  static struct pci_ops octeon_pcie1_ops = {
@@ -6337,13 +6335,13 @@ index 7450843..9f8cfc7 100644
  		return 0;
  	}
 diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 5a783d8..522eb00 100644
+index 67a42ed..333731a 100644
 --- a/arch/powerpc/mm/mmap_64.c
 +++ b/arch/powerpc/mm/mmap_64.c
-@@ -61,10 +61,14 @@ static inline int mmap_is_legacy(void)
-  *
-  * To avoid this we can shift the randomness by 1 bit.
-  */
+@@ -53,10 +53,14 @@ static inline int mmap_is_legacy(void)
+ 	return sysctl_legacy_va_layout;
+ }
+ 
 -static unsigned long mmap_rnd(void)
 +static unsigned long mmap_rnd(struct mm_struct *mm)
  {
@@ -6356,8 +6354,8 @@ index 5a783d8..522eb00 100644
  	if (current->flags & PF_RANDOMIZE) {
  		/* 8MB for 32bit, 1GB for 64bit */
  		if (is_32bit_task())
-@@ -75,7 +79,7 @@ static unsigned long mmap_rnd(void)
- 	return (rnd << PAGE_SHIFT) * 2;
+@@ -67,7 +71,7 @@ static unsigned long mmap_rnd(void)
+ 	return rnd << PAGE_SHIFT;
  }
  
 -static inline unsigned long mmap_base(void)
@@ -6365,7 +6363,7 @@ index 5a783d8..522eb00 100644
  {
  	unsigned long gap = rlimit(RLIMIT_STACK);
  
-@@ -84,7 +88,7 @@ static inline unsigned long mmap_base(void)
+@@ -76,7 +80,7 @@ static inline unsigned long mmap_base(void)
  	else if (gap > MAX_GAP)
  		gap = MAX_GAP;
  
@@ -6374,7 +6372,7 @@ index 5a783d8..522eb00 100644
  }
  
  /*
-@@ -99,10 +103,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -91,10 +95,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
  	 */
  	if (mmap_is_legacy()) {
  		mm->mmap_base = TASK_UNMAPPED_BASE;
@@ -8258,7 +8256,7 @@ index 42b282f..408977c 100644
  		addr = vmm->vm_end;
  		if (flags & MAP_SHARED)
 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index 5e4252b..379f84f 100644
+index 0ff682d..60e979d 100644
 --- a/arch/sparc/kernel/sys_sparc_64.c
 +++ b/arch/sparc/kernel/sys_sparc_64.c
 @@ -119,12 +119,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
@@ -10487,7 +10485,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 28a1bca..0443883 100644
+index d720208..5653761 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -75,6 +75,7 @@ config X86
@@ -10498,7 +10496,7 @@ index 28a1bca..0443883 100644
  	select ARCH_SUPPORTS_ATOMIC_RMW
  
  config INSTRUCTION_DECODER
-@@ -236,7 +237,7 @@ config X86_HT
+@@ -237,7 +238,7 @@ config X86_HT
  
  config X86_32_LAZY_GS
  	def_bool y
@@ -10507,7 +10505,7 @@ index 28a1bca..0443883 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -526,6 +527,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -527,6 +528,7 @@ config SCHED_OMIT_FRAME_POINTER
  
  menuconfig PARAVIRT_GUEST
  	bool "Paravirtualized guest support"
@@ -10515,7 +10513,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Say Y here to get to see options related to running Linux under
  	  various hypervisors.  This option alone does not add any kernel code.
-@@ -903,6 +905,7 @@ config VM86
+@@ -904,6 +906,7 @@ config VM86
  
  config X86_16BIT
  	bool "Enable support for 16-bit segments" if EXPERT
@@ -10523,7 +10521,7 @@ index 28a1bca..0443883 100644
  	default y
  	---help---
  	  This option is required by programs like Wine to run 16-bit
-@@ -1040,7 +1043,7 @@ choice
+@@ -1041,7 +1044,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -10532,7 +10530,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1077,7 +1080,7 @@ config NOHIGHMEM
+@@ -1078,7 +1081,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -10541,7 +10539,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1131,7 +1134,7 @@ config PAGE_OFFSET
+@@ -1132,7 +1135,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -10550,7 +10548,7 @@ index 28a1bca..0443883 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1514,6 +1517,7 @@ config SECCOMP
+@@ -1515,6 +1518,7 @@ config SECCOMP
  
  config CC_STACKPROTECTOR
  	bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
@@ -10558,7 +10556,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  This option turns on the -fstack-protector GCC feature. This
  	  feature puts, at the beginning of functions, a canary value on
-@@ -1532,6 +1536,7 @@ source kernel/Kconfig.hz
+@@ -1533,6 +1537,7 @@ source kernel/Kconfig.hz
  
  config KEXEC
  	bool "kexec system call"
@@ -10566,7 +10564,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1634,6 +1639,8 @@ config X86_NEED_RELOCS
+@@ -1635,6 +1640,8 @@ config X86_NEED_RELOCS
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned" if X86_32
  	default "0x1000000"
@@ -10575,7 +10573,7 @@ index 28a1bca..0443883 100644
  	range 0x2000 0x1000000
  	---help---
  	  This value puts the alignment restrictions on physical address
-@@ -1665,9 +1672,10 @@ config HOTPLUG_CPU
+@@ -1666,9 +1673,10 @@ config HOTPLUG_CPU
  	  Say N if you want to disable CPU hotplug.
  
  config COMPAT_VDSO
@@ -10587,7 +10585,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Map the 32-bit VDSO to the predictable old-style address too.
  
-@@ -1720,6 +1728,22 @@ config CMDLINE_OVERRIDE
+@@ -1721,6 +1729,22 @@ config CMDLINE_OVERRIDE
  	  This is used to work around broken boot loaders.  This should
  	  be set to 'N' under normal conditions.
  
@@ -23597,7 +23595,7 @@ index 42eb330..139955c 100644
  
  	return ret;
 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index 41b2f57..9dd7145 100644
+index 78842ce..2e4b56d 100644
 --- a/arch/x86/kernel/reboot.c
 +++ b/arch/x86/kernel/reboot.c
 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
@@ -23700,7 +23698,7 @@ index 41b2f57..9dd7145 100644
  {
  	int i;
  	int attempt = 0;
-@@ -717,13 +749,13 @@ void native_machine_shutdown(void)
+@@ -720,13 +752,13 @@ void native_machine_shutdown(void)
  #endif
  }
  
@@ -23716,7 +23714,7 @@ index 41b2f57..9dd7145 100644
  {
  	printk("machine restart\n");
  
-@@ -732,7 +764,7 @@ static void native_machine_restart(char *__unused)
+@@ -735,7 +767,7 @@ static void native_machine_restart(char *__unused)
  	__machine_emergency_restart(0);
  }
  
@@ -23725,7 +23723,7 @@ index 41b2f57..9dd7145 100644
  {
  	/* stop other cpus and apics */
  	machine_shutdown();
-@@ -743,7 +775,7 @@ static void native_machine_halt(void)
+@@ -746,7 +778,7 @@ static void native_machine_halt(void)
  	stop_this_cpu(NULL);
  }
  
@@ -23734,7 +23732,7 @@ index 41b2f57..9dd7145 100644
  {
  	if (pm_power_off) {
  		if (!reboot_force)
-@@ -752,9 +784,10 @@ static void native_machine_power_off(void)
+@@ -755,9 +787,10 @@ static void native_machine_power_off(void)
  	}
  	/* a fallback in case there is no PM info available */
  	tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -25424,7 +25422,7 @@ index 176205a..920cd58 100644
  #define APIC_LVT_NUM			6
  /* 14 is the version for Xeon and Pentium 8.4.8*/
 diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index bfc9507..bf85b38 100644
+index 4a949c7..a1e965f 100644
 --- a/arch/x86/kvm/mmu.c
 +++ b/arch/x86/kvm/mmu.c
 @@ -3558,7 +3558,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
@@ -25495,7 +25493,7 @@ index 7a2d9d6..0e8286c 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 8831c43..98f1a3e 100644
+index 421958f..79e1420 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1100,12 +1100,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -25550,7 +25548,7 @@ index 8831c43..98f1a3e 100644
  
  	if (enable_ept && !cpu_has_vmx_ept_2m_page())
  		kvm_disable_largepages();
-@@ -3638,7 +3649,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3646,7 +3657,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	unsigned long cr4;
  
  	vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS);  /* 22.2.3 */
@@ -25561,7 +25559,7 @@ index 8831c43..98f1a3e 100644
  
  	/* Save the most likely value for this task's CR4 in the VMCS. */
  	cr4 = read_cr4();
-@@ -3655,7 +3669,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3663,7 +3677,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	vmcs_writel(HOST_IDTR_BASE, dt.address);   /* 22.2.4 */
  
  	asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
@@ -25570,7 +25568,7 @@ index 8831c43..98f1a3e 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6206,6 +6220,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6214,6 +6228,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp .Lkvm_vmx_return \n\t"
  		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		".Lkvm_vmx_return: "
@@ -25583,7 +25581,7 @@ index 8831c43..98f1a3e 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%"R"sp) \n\t"
  		"pop %0 \n\t"
-@@ -6254,6 +6274,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6262,6 +6282,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -25595,7 +25593,7 @@ index 8831c43..98f1a3e 100644
  	      : "cc", "memory"
  		, R"ax", R"bx", R"di", R"si"
  #ifdef CONFIG_X86_64
-@@ -6282,7 +6307,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6290,7 +6315,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		}
  	}
  
@@ -28443,7 +28441,7 @@ index e218d5d..3966c85 100644
 +EXPORT_SYMBOL(set_fs);
 +#endif
 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index 554b7b5..4027e2c 100644
+index 433b21d..466fd0c 100644
 --- a/arch/x86/lib/usercopy_64.c
 +++ b/arch/x86/lib/usercopy_64.c
 @@ -42,6 +42,12 @@ long
@@ -31046,7 +31044,7 @@ index 6687022..ceabcfa 100644
 +	pax_force_retaddr
  	ret
 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 5a5b6e4..07b4acb 100644
+index 11e3100..db113e1 100644
 --- a/arch/x86/net/bpf_jit_comp.c
 +++ b/arch/x86/net/bpf_jit_comp.c
 @@ -11,6 +11,7 @@
@@ -31241,7 +31239,7 @@ index 5a5b6e4..07b4acb 100644
  		addrs[i] = proglen;
  	}
  	cleanup_addr = proglen; /* epilogue address */
-@@ -221,6 +337,10 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -226,6 +342,10 @@ void bpf_jit_compile(struct sk_filter *fp)
  		for (i = 0; i < flen; i++) {
  			unsigned int K = filter[i].k;
  
@@ -31252,7 +31250,7 @@ index 5a5b6e4..07b4acb 100644
  			switch (filter[i].code) {
  			case BPF_S_ALU_ADD_X: /* A += X; */
  				seen |= SEEN_XREG;
-@@ -253,10 +373,8 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -258,10 +378,8 @@ void bpf_jit_compile(struct sk_filter *fp)
  			case BPF_S_ALU_MUL_K: /* A *= K */
  				if (is_imm8(K))
  					EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */
@@ -31265,7 +31263,7 @@ index 5a5b6e4..07b4acb 100644
  				break;
  			case BPF_S_ALU_DIV_X: /* A /= X; */
  				seen |= SEEN_XREG;
-@@ -269,15 +387,21 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -274,15 +392,21 @@ void bpf_jit_compile(struct sk_filter *fp)
  					EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
  								(addrs[i] - 4));
  				} else {
@@ -31288,7 +31286,7 @@ index 5a5b6e4..07b4acb 100644
  				EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
  				break;
  			case BPF_S_ALU_AND_X:
-@@ -477,7 +601,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -482,7 +606,7 @@ void bpf_jit_compile(struct sk_filter *fp)
  common_load:			seen |= SEEN_DATAREF;
  				if ((int)K < 0) {
  					/* Abort the JIT because __load_pointer() is needed. */
@@ -31297,7 +31295,7 @@ index 5a5b6e4..07b4acb 100644
  				}
  				t_offset = func - (image + addrs[i]);
  				EMIT1_off32(0xbe, K); /* mov imm32,%esi */
-@@ -492,7 +616,7 @@ common_load:			seen |= SEEN_DATAREF;
+@@ -497,7 +621,7 @@ common_load:			seen |= SEEN_DATAREF;
  			case BPF_S_LDX_B_MSH:
  				if ((int)K < 0) {
  					/* Abort the JIT because __load_pointer() is needed. */
@@ -31306,7 +31304,7 @@ index 5a5b6e4..07b4acb 100644
  				}
  				seen |= SEEN_DATAREF | SEEN_XREG;
  				t_offset = sk_load_byte_msh - (image + addrs[i]);
-@@ -572,7 +696,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -577,7 +701,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  				}
  				if (filter[i].jt != 0) {
  					if (filter[i].jf && f_offset)
@@ -31315,7 +31313,7 @@ index 5a5b6e4..07b4acb 100644
  					EMIT_COND_JMP(t_op, t_offset);
  					if (filter[i].jf)
  						EMIT_JMP(f_offset);
-@@ -582,17 +706,18 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -587,17 +711,18 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  				break;
  			default:
  				/* hmm, too complex filter, give up with jit compiler */
@@ -31338,7 +31336,7 @@ index 5a5b6e4..07b4acb 100644
  			}
  			proglen += ilen;
  			addrs[i] = proglen;
-@@ -613,11 +738,9 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -618,11 +743,9 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  			break;
  		}
  		if (proglen == oldproglen) {
@@ -31352,7 +31350,7 @@ index 5a5b6e4..07b4acb 100644
  		}
  		oldproglen = proglen;
  	}
-@@ -633,7 +756,10 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -638,7 +761,10 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  		bpf_flush_icache(image, image + proglen);
  
  		fp->bpf_func = (void *)image;
@@ -31364,7 +31362,7 @@ index 5a5b6e4..07b4acb 100644
  out:
  	kfree(addrs);
  	return;
-@@ -641,18 +767,20 @@ out:
+@@ -646,18 +772,20 @@ out:
  
  static void jit_free_defer(struct work_struct *arg)
  {
@@ -33729,10 +33727,10 @@ index cb842a8..6688e24 100644
  	 * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
  	 */
 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
-index de2802c..2260da9 100644
+index 41ffb8c..2afaff8 100644
 --- a/drivers/ata/libahci.c
 +++ b/drivers/ata/libahci.c
-@@ -1211,7 +1211,7 @@ int ahci_kick_engine(struct ata_port *ap)
+@@ -1212,7 +1212,7 @@ int ahci_kick_engine(struct ata_port *ap)
  }
  EXPORT_SYMBOL_GPL(ahci_kick_engine);
  
@@ -33742,7 +33740,7 @@ index de2802c..2260da9 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 5d8fc3d..d537f03 100644
+index fcd8586..19ba966 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
 @@ -4790,7 +4790,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
@@ -38367,10 +38365,10 @@ index b153674..ad2ba9b 100644
  	 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
  	 },
 diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index da71881..8d7d62c 100644
+index f8f790c..b43f147 100644
 --- a/drivers/edac/sb_edac.c
 +++ b/drivers/edac/sb_edac.c
-@@ -367,7 +367,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
+@@ -368,7 +368,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
  /*
   *	pci_device_id	table for which devices we are looking for
   */
@@ -38482,10 +38480,10 @@ index 94a58a0..f5eba42 100644
  	container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
  
 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 2861ef4..9e90c69 100644
+index 20f7daa..91678be 100644
 --- a/drivers/firmware/dmi_scan.c
 +++ b/drivers/firmware/dmi_scan.c
-@@ -490,11 +490,6 @@ void __init dmi_scan_machine(void)
+@@ -488,11 +488,6 @@ void __init dmi_scan_machine(void)
  		}
  	}
  	else {
@@ -38497,7 +38495,7 @@ index 2861ef4..9e90c69 100644
  		p = dmi_ioremap(0xF0000, 0x10000);
  		if (p == NULL)
  			goto error;
-@@ -775,7 +770,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -770,7 +765,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
  	if (buf == NULL)
  		return -1;
  
@@ -40584,10 +40582,10 @@ index 4ef02b2..8a96831 100644
  
  		for (i = 0; i < hid->maxcollection; i++)
 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 44a1ea4..21cce84 100644
+index a7e6f03..a2b6d86 100644
 --- a/drivers/hv/channel.c
 +++ b/drivers/hv/channel.c
-@@ -403,8 +403,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -406,8 +406,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
  	unsigned long flags;
  	int ret = 0;
  
@@ -43051,7 +43049,7 @@ index 614ebeb..ce439fd 100644
  		.callback = ss4200_led_dmi_callback,
  		.ident = "Intel SS4200-E",
 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index b5fdcb7..3cb34b8 100644
+index 34842e5..3cb34b8 100644
 --- a/drivers/lguest/core.c
 +++ b/drivers/lguest/core.c
 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
@@ -43081,15 +43079,6 @@ index b5fdcb7..3cb34b8 100644
  	       end_switcher_text - start_switcher_text);
  
  	printk(KERN_INFO "lguest: mapped switcher at %p\n",
-@@ -171,7 +179,7 @@ static void unmap_switcher(void)
- bool lguest_address_ok(const struct lguest *lg,
- 		       unsigned long addr, unsigned long len)
- {
--	return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
-+	return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
- }
- 
- /*
 diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
 index 3b62be16..e33134a 100644
 --- a/drivers/lguest/page_tables.c
@@ -43750,7 +43739,7 @@ index abac83a..3652f35 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index c293d9c..808ae97 100644
+index 6056ee7..a4c3ba4 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -598,23 +598,23 @@ async_copy_data(int frombio, struct bio *bio, struct page *page,
@@ -43806,7 +43795,7 @@ index c293d9c..808ae97 100644
  	sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
  
  	conf->active_name = 0;
-@@ -1618,19 +1626,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1619,19 +1627,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdevname(rdev->bdev, b));
@@ -43830,7 +43819,7 @@ index c293d9c..808ae97 100644
  		if (conf->mddev->degraded >= conf->max_degraded)
  			printk_ratelimited(
  				KERN_WARNING
-@@ -1650,7 +1658,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1651,7 +1659,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdn);
@@ -46997,6 +46986,22 @@ index 3d21742..b8e03e7 100644
  	// waiting for all pending urbs to complete?
  	if (dev->wait) {
  		if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index f13a673..218ebf0 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -981,9 +981,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* Do we support "hardware" checksums? */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ 		/* This opens up the world of extra features. */
+-		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 		if (csum)
+-			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 
+ 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
 index 28ceef2..655b059 100644
 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -48357,7 +48362,7 @@ index 26fba2d..693b4d3 100644
  				     1, asus->debug.method_id,
  				     &input, &output);
 diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 8877b83..024cf2c 100644
+index ba3638e..70e74af 100644
 --- a/drivers/platform/x86/compal-laptop.c
 +++ b/drivers/platform/x86/compal-laptop.c
 @@ -775,7 +775,7 @@ static int dmi_check_cb_extra(const struct dmi_system_id *id)
@@ -50086,7 +50091,7 @@ index 21a045e..ec89e03 100644
  
  	transport_setup_device(&rport->dev);
 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 5c6b5f5..015ec9d 100644
+index a50825b..7995f6ea 100644
 --- a/drivers/scsi/sd.c
 +++ b/drivers/scsi/sd.c
 @@ -105,7 +105,7 @@ static void sd_shutdown(struct device *);
@@ -50098,7 +50103,7 @@ index 5c6b5f5..015ec9d 100644
  static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer);
  static void scsi_disk_release(struct device *cdev);
  static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
-@@ -1390,7 +1390,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+@@ -1384,7 +1384,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
   *
   *	Note: potentially run from within an ISR. Must not block.
   **/
@@ -50107,7 +50112,7 @@ index 5c6b5f5..015ec9d 100644
  {
  	int result = SCpnt->result;
  	unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
-@@ -2635,7 +2635,7 @@ static int sd_probe(struct device *dev)
+@@ -2626,7 +2626,7 @@ static int sd_probe(struct device *dev)
  	device_initialize(&sdkp->dev);
  	sdkp->dev.parent = dev;
  	sdkp->dev.class = &sd_disk_class;
@@ -50117,7 +50122,7 @@ index 5c6b5f5..015ec9d 100644
  	if (device_add(&sdkp->dev))
  		goto out_free_index;
 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 2d25616..c464bcf 100644
+index b4cac39..c464bcf 100644
 --- a/drivers/scsi/sg.c
 +++ b/drivers/scsi/sg.c
 @@ -1077,7 +1077,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
@@ -50129,17 +50134,7 @@ index 2d25616..c464bcf 100644
  	case BLKTRACESTART:
  		return blk_trace_startstop(sdp->device->request_queue, 1);
  	case BLKTRACESTOP:
-@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
- 			md->from_user = 0;
- 	}
- 
-+	if (unlikely(iov_count > UIO_MAXIOV))
-+		return -EINVAL;
-+
- 	if (iov_count) {
- 		int len, size = sizeof(struct sg_iovec) * iov_count;
- 		struct iovec *iov;
-@@ -2312,7 +2315,7 @@ struct sg_proc_leaf {
+@@ -2315,7 +2315,7 @@ struct sg_proc_leaf {
  	const struct file_operations * fops;
  };
  
@@ -50148,7 +50143,7 @@ index 2d25616..c464bcf 100644
  	{"allow_dio", &adio_fops},
  	{"debug", &debug_fops},
  	{"def_reserved_size", &dressz_fops},
-@@ -2327,7 +2330,7 @@ sg_proc_init(void)
+@@ -2330,7 +2330,7 @@ sg_proc_init(void)
  {
  	int k, mask;
  	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
@@ -56912,10 +56907,10 @@ index 4a88ac3..d2e1657 100644
  EXPORT_SYMBOL_GPL(virtqueue_kick);
  
 diff --git a/drivers/xen/events.c b/drivers/xen/events.c
-index f6227cc..3e22fab 100644
+index bcf7711..98a489c 100644
 --- a/drivers/xen/events.c
 +++ b/drivers/xen/events.c
-@@ -1632,7 +1632,7 @@ void xen_irq_resume(void)
+@@ -1636,7 +1636,7 @@ void xen_irq_resume(void)
  	restore_pirqs();
  }
  
@@ -56924,7 +56919,7 @@ index f6227cc..3e22fab 100644
  	.name			= "xen-dyn",
  
  	.irq_disable		= disable_dynirq,
-@@ -1646,7 +1646,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
+@@ -1650,7 +1650,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
  	.irq_retrigger		= retrigger_dynirq,
  };
  
@@ -56933,7 +56928,7 @@ index f6227cc..3e22fab 100644
  	.name			= "xen-pirq",
  
  	.irq_startup		= startup_pirq,
-@@ -1666,7 +1666,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
+@@ -1670,7 +1670,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
  	.irq_retrigger		= retrigger_dynirq,
  };
  
@@ -57368,7 +57363,7 @@ index a6395bd..f1e376a 100644
  		(unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
  #ifdef __alpha__
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 2aed667..52b96fd 100644
+index d252462..ebd7fd4 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -32,6 +32,7 @@
@@ -58005,10 +58000,12 @@ index 2aed667..52b96fd 100644
  	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
  		current->personality |= READ_IMPLIES_EXEC;
  
-@@ -809,6 +1246,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -810,8 +1247,21 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  #else
  			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
  #endif
+-			total_size = total_mapping_size(elf_phdata,
+-							loc->elf_ex.e_phnum);
 +
 +#ifdef CONFIG_PAX_RANDMMAP
 +			/* PaX: randomize base address at the default exe base if requested */
@@ -58023,10 +58020,11 @@ index 2aed667..52b96fd 100644
 +			}
 +#endif
 +
- 		}
- 
- 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -841,9 +1292,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
++			total_size = total_mapping_size(elf_phdata, loc->elf_ex.e_phnum);
+ 			if (!total_size) {
+ 				retval = -EINVAL;
+ 				goto out_free_dentry;
+@@ -848,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		 * allowed task size. Note that p_filesz must always be
  		 * <= p_memsz so it is only necessary to check p_memsz.
  		 */
@@ -58039,7 +58037,7 @@ index 2aed667..52b96fd 100644
  			/* set_brk can never work. Avoid overflows. */
  			send_sig(SIGKILL, current, 0);
  			retval = -EINVAL;
-@@ -882,17 +1333,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -889,17 +1339,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		goto out_free_dentry;
  	}
  	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -58090,7 +58088,7 @@ index 2aed667..52b96fd 100644
  					    load_bias);
  		if (!IS_ERR((void *)elf_entry)) {
  			/*
-@@ -1099,7 +1577,7 @@ out:
+@@ -1106,7 +1583,7 @@ out:
   * Decide what to dump of a segment, part, all or none.
   */
  static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -58099,7 +58097,7 @@ index 2aed667..52b96fd 100644
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1133,7 +1611,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1140,7 +1617,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -58108,7 +58106,7 @@ index 2aed667..52b96fd 100644
  		goto whole;
  
  	/*
-@@ -1355,9 +1833,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1362,9 +1839,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -58120,7 +58118,7 @@ index 2aed667..52b96fd 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1852,14 +2330,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1859,14 +2336,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -58137,7 +58135,7 @@ index 2aed667..52b96fd 100644
  	return size;
  }
  
-@@ -1953,7 +2431,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1960,7 +2437,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -58146,7 +58144,7 @@ index 2aed667..52b96fd 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -1967,10 +2445,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1974,10 +2451,12 @@ static int elf_core_dump(struct coredump_params *cprm)
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -58159,7 +58157,7 @@ index 2aed667..52b96fd 100644
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -1984,7 +2464,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1991,7 +2470,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -58168,7 +58166,7 @@ index 2aed667..52b96fd 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -1995,6 +2475,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2002,6 +2481,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -58176,7 +58174,7 @@ index 2aed667..52b96fd 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2019,7 +2500,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2026,7 +2506,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -58185,7 +58183,7 @@ index 2aed667..52b96fd 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2028,6 +2509,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2035,6 +2515,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -58193,7 +58191,7 @@ index 2aed667..52b96fd 100644
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2045,6 +2527,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2052,6 +2533,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -58201,7 +58199,7 @@ index 2aed667..52b96fd 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2065,6 +2548,167 @@ out:
+@@ -2072,6 +2554,167 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -58482,7 +58480,7 @@ index dede441..f2a2507 100644
  
  		WARN_ON(trans->transid != btrfs_header_generation(parent));
 diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index a694317..dc698a1 100644
+index da528f8..97002a3 100644
 --- a/fs/btrfs/extent-tree.c
 +++ b/fs/btrfs/extent-tree.c
 @@ -5644,7 +5644,7 @@ again:
@@ -58495,10 +58493,10 @@ index a694317..dc698a1 100644
  		do_chunk_alloc(trans, root->fs_info->extent_root,
  			       num_bytes, data, CHUNK_ALLOC_FORCE);
 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 7cbe2f8..20cc43f 100644
+index 52bacff..a4b7f29 100644
 --- a/fs/btrfs/ioctl.c
 +++ b/fs/btrfs/ioctl.c
-@@ -2770,7 +2770,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+@@ -2775,7 +2775,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
  		up_read(&info->groups_sem);
  	}
  
@@ -59438,7 +59436,7 @@ index 739fb59..5385976 100644
  static int __init init_cramfs_fs(void)
  {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 8bc98af..68601d9 100644
+index 8a35300..aee4955 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -103,11 +103,11 @@ static unsigned int d_hash_shift __read_mostly;
@@ -59481,24 +59479,6 @@ index 8bc98af..68601d9 100644
  	/*
  	 * If this dentry needs lookup, don't set the referenced flag so that it
  	 * is more likely to be cleaned up by the dcache shrinker in case of
-@@ -1016,13 +1019,13 @@ ascend:
- 		/* might go back up the wrong parent if we have had a rename */
- 		if (!locked && read_seqretry(&rename_lock, seq))
- 			goto rename_retry;
--		next = child->d_child.next;
--		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
-+		/* go into the first sibling still alive */
-+		do {
-+			next = child->d_child.next;
- 			if (next == &this_parent->d_subdirs)
- 				goto ascend;
- 			child = list_entry(next, struct dentry, d_child);
--			next = next->next;
--		}
-+		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
- 		rcu_read_unlock();
- 		goto resume;
- 	}
 @@ -1235,6 +1238,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	dentry->d_sb = sb;
  	dentry->d_op = NULL;
@@ -59520,10 +59500,10 @@ index 8bc98af..68601d9 100644
  	dcache_init();
  	inode_init();
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index a15f1e2..3077628 100644
+index 74f03b5..c4a9396 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
-@@ -164,6 +164,7 @@ static struct file_system_type debug_fs_type = {
+@@ -165,6 +165,7 @@ static struct file_system_type debug_fs_type = {
  	.mount =	debug_mount,
  	.kill_sb =	kill_litter_super,
  };
@@ -59531,7 +59511,7 @@ index a15f1e2..3077628 100644
  
  static int debugfs_create_by_name(const char *name, mode_t mode,
  				  struct dentry *parent,
-@@ -277,11 +278,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+@@ -278,11 +279,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
   * If debugfs is not enabled in the kernel, the value -%ENODEV will be
   * returned.
   */
@@ -61286,7 +61266,7 @@ index 22764c7..86372c9 100644
  			break;
  		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
 diff --git a/fs/fhandle.c b/fs/fhandle.c
-index 6b08864..030db71 100644
+index c9e18f3..030db71 100644
 --- a/fs/fhandle.c
 +++ b/fs/fhandle.c
 @@ -8,6 +8,7 @@
@@ -61306,18 +61286,6 @@ index 6b08864..030db71 100644
  		retval = -EPERM;
  		goto out_err;
  	}
-@@ -196,8 +197,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
- 		goto out_err;
- 	}
- 	/* copy the full handle */
--	if (copy_from_user(handle, ufh,
--			   sizeof(struct file_handle) +
-+	*handle = f_handle;
-+	if (copy_from_user(&handle->f_handle,
-+			   &ufh->f_handle,
- 			   f_handle.handle_bytes)) {
- 		retval = -EFAULT;
- 		goto out_handle;
 diff --git a/fs/fifo.c b/fs/fifo.c
 index cf6f434..3d7942c 100644
 --- a/fs/fifo.c
@@ -64749,10 +64717,10 @@ index 5d22872..523db20 100644
  		kfree(link);
  }
 diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
-index e043c4c..f99d456 100644
+index f58f1c4..7aed9d4 100644
 --- a/fs/omfs/inode.c
 +++ b/fs/omfs/inode.c
-@@ -570,6 +570,7 @@ static struct file_system_type omfs_fs_type = {
+@@ -571,6 +571,7 @@ static struct file_system_type omfs_fs_type = {
  	.kill_sb = kill_block_super,
  	.fs_flags = FS_REQUIRES_DEV,
  };
@@ -64917,7 +64885,7 @@ index bd8ae78..539d250 100644
  		ldm_crit ("Out of memory.");
  		return false;
 diff --git a/fs/pipe.c b/fs/pipe.c
-index 8ca88fc..db6ce82 100644
+index d2cbeff..db6ce82 100644
 --- a/fs/pipe.c
 +++ b/fs/pipe.c
 @@ -33,7 +33,7 @@ unsigned int pipe_max_size = 1048576;
@@ -64929,109 +64897,7 @@ index 8ca88fc..db6ce82 100644
  
  /*
   * We use a start+len construction, which provides full use of the 
-@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
- }
- 
- static int
--pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
--			int atomic)
-+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
-+			size_t *remaining, int atomic)
- {
- 	unsigned long copy;
- 
--	while (len > 0) {
-+	while (*remaining > 0) {
- 		while (!iov->iov_len)
- 			iov++;
--		copy = min_t(unsigned long, len, iov->iov_len);
-+		copy = min_t(unsigned long, *remaining, iov->iov_len);
- 
- 		if (atomic) {
--			if (__copy_from_user_inatomic(to, iov->iov_base, copy))
-+			if (__copy_from_user_inatomic(addr + *offset,
-+						      iov->iov_base, copy))
- 				return -EFAULT;
- 		} else {
--			if (copy_from_user(to, iov->iov_base, copy))
-+			if (copy_from_user(addr + *offset,
-+					   iov->iov_base, copy))
- 				return -EFAULT;
- 		}
--		to += copy;
--		len -= copy;
-+		*offset += copy;
-+		*remaining -= copy;
- 		iov->iov_base += copy;
- 		iov->iov_len -= copy;
- 	}
-@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
- }
- 
- static int
--pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
--		      int atomic)
-+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
-+		      size_t *remaining, int atomic)
- {
- 	unsigned long copy;
- 
--	while (len > 0) {
-+	while (*remaining > 0) {
- 		while (!iov->iov_len)
- 			iov++;
--		copy = min_t(unsigned long, len, iov->iov_len);
-+		copy = min_t(unsigned long, *remaining, iov->iov_len);
- 
- 		if (atomic) {
--			if (__copy_to_user_inatomic(iov->iov_base, from, copy))
-+			if (__copy_to_user_inatomic(iov->iov_base,
-+						    addr + *offset, copy))
- 				return -EFAULT;
- 		} else {
--			if (copy_to_user(iov->iov_base, from, copy))
-+			if (copy_to_user(iov->iov_base,
-+					 addr + *offset, copy))
- 				return -EFAULT;
- 		}
--		from += copy;
--		len -= copy;
-+		*offset += copy;
-+		*remaining -= copy;
- 		iov->iov_base += copy;
- 		iov->iov_len -= copy;
- 	}
-@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- 			struct pipe_buffer *buf = pipe->bufs + curbuf;
- 			const struct pipe_buf_operations *ops = buf->ops;
- 			void *addr;
--			size_t chars = buf->len;
-+			size_t chars = buf->len, remaining;
- 			int error, atomic;
- 
- 			if (chars > total_len)
-@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- 			}
- 
- 			atomic = !iov_fault_in_pages_write(iov, chars);
-+			remaining = chars;
- redo:
- 			addr = ops->map(pipe, buf, atomic);
--			error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
-+			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
-+						      &remaining, atomic);
- 			ops->unmap(pipe, buf, addr);
- 			if (unlikely(error)) {
- 				/*
-@@ -414,7 +420,6 @@ redo:
- 				break;
- 			}
- 			ret += chars;
--			buf->offset += chars;
- 			buf->len -= chars;
- 
- 			/* Was it a packet buffer? Clean up and exit */
-@@ -437,9 +442,9 @@ redo:
+@@ -442,9 +442,9 @@ redo:
  		}
  		if (bufs)	/* More to do? */
  			continue;
@@ -65043,7 +64909,7 @@ index 8ca88fc..db6ce82 100644
  			/* syscall merging: Usually we must not sleep
  			 * if O_NONBLOCK is set, or if we got some data.
  			 * But if a writer sleeps in kernel space, then
-@@ -503,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+@@ -508,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
  	mutex_lock(&inode->i_mutex);
  	pipe = inode->i_pipe;
  
@@ -65052,26 +64918,7 @@ index 8ca88fc..db6ce82 100644
  		send_sig(SIGPIPE, current, 0);
  		ret = -EPIPE;
  		goto out;
-@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- 		if (ops->can_merge && offset + chars <= PAGE_SIZE) {
- 			int error, atomic = 1;
- 			void *addr;
-+			size_t remaining = chars;
- 
- 			error = ops->confirm(pipe, buf);
- 			if (error)
-@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- 			iov_fault_in_pages_read(iov, chars);
- redo1:
- 			addr = ops->map(pipe, buf, atomic);
--			error = pipe_iov_copy_from_user(offset + addr, iov,
--							chars, atomic);
-+			error = pipe_iov_copy_from_user(addr, &offset, iov,
-+							&remaining, atomic);
- 			ops->unmap(pipe, buf, addr);
- 			ret = error;
- 			do_wakeup = 1;
-@@ -552,7 +558,7 @@ redo1:
+@@ -558,7 +558,7 @@ redo1:
  	for (;;) {
  		int bufs;
  
@@ -65080,34 +64927,7 @@ index 8ca88fc..db6ce82 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -565,6 +571,8 @@ redo1:
- 			struct page *page = pipe->tmp_page;
- 			char *src;
- 			int error, atomic = 1;
-+			int offset = 0;
-+			size_t remaining;
- 
- 			if (!page) {
- 				page = alloc_page(GFP_HIGHUSER);
-@@ -585,14 +593,15 @@ redo1:
- 				chars = total_len;
- 
- 			iov_fault_in_pages_read(iov, chars);
-+			remaining = chars;
- redo2:
- 			if (atomic)
- 				src = kmap_atomic(page, KM_USER0);
- 			else
- 				src = kmap(page);
- 
--			error = pipe_iov_copy_from_user(src, iov, chars,
--							atomic);
-+			error = pipe_iov_copy_from_user(src, &offset, iov,
-+							&remaining, atomic);
- 			if (atomic)
- 				kunmap_atomic(src, KM_USER0);
- 			else
-@@ -643,9 +652,9 @@ redo2:
+@@ -652,9 +652,9 @@ redo2:
  			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
  			do_wakeup = 0;
  		}
@@ -65119,7 +64939,7 @@ index 8ca88fc..db6ce82 100644
  	}
  out:
  	mutex_unlock(&inode->i_mutex);
-@@ -712,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -721,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
  	mask = 0;
  	if (filp->f_mode & FMODE_READ) {
  		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
@@ -65128,7 +64948,7 @@ index 8ca88fc..db6ce82 100644
  			mask |= POLLHUP;
  	}
  
-@@ -722,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -731,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
  		 * Most Unices do not set POLLERR for FIFOs but on Linux they
  		 * behave exactly like pipes for poll().
  		 */
@@ -65137,7 +64957,7 @@ index 8ca88fc..db6ce82 100644
  			mask |= POLLERR;
  	}
  
-@@ -736,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
+@@ -745,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
  
  	mutex_lock(&inode->i_mutex);
  	pipe = inode->i_pipe;
@@ -65151,7 +64971,7 @@ index 8ca88fc..db6ce82 100644
  		free_pipe_info(inode);
  	} else {
  		wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
-@@ -829,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -838,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
  
  	if (inode->i_pipe) {
  		ret = 0;
@@ -65160,7 +64980,7 @@ index 8ca88fc..db6ce82 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -846,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -855,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
  
  	if (inode->i_pipe) {
  		ret = 0;
@@ -65169,7 +64989,7 @@ index 8ca88fc..db6ce82 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -867,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -876,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
  	if (inode->i_pipe) {
  		ret = 0;
  		if (filp->f_mode & FMODE_READ)
@@ -65181,7 +65001,7 @@ index 8ca88fc..db6ce82 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -961,7 +970,7 @@ void free_pipe_info(struct inode *inode)
+@@ -970,7 +970,7 @@ void free_pipe_info(struct inode *inode)
  	inode->i_pipe = NULL;
  }
  
@@ -65190,7 +65010,7 @@ index 8ca88fc..db6ce82 100644
  
  /*
   * pipefs_dname() is called from d_path().
-@@ -991,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
+@@ -1000,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
  		goto fail_iput;
  	inode->i_pipe = pipe;
  
@@ -65200,7 +65020,7 @@ index 8ca88fc..db6ce82 100644
  	inode->i_fop = &rdwr_pipefifo_fops;
  
  	/*
-@@ -1203,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
+@@ -1212,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
   * Currently we rely on the pipe array holding a power-of-2 number
   * of pages.
   */
@@ -65209,7 +65029,7 @@ index 8ca88fc..db6ce82 100644
  {
  	unsigned long nr_pages;
  
-@@ -1253,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -1262,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
  
  	switch (cmd) {
  	case F_SETPIPE_SZ: {
@@ -84014,10 +83834,10 @@ index f93d8c1..71244f6 100644
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 42ac6ad..703f223 100644
+index 3d4b5b6..3648fe8 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -915,7 +915,7 @@ struct ata_port_operations {
+@@ -924,7 +924,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -85621,7 +85441,7 @@ index 9aaf5bf..d5ee2a5 100644
  }
  
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index cb34ff4..c086c98 100644
+index 44e5f47..bf5c1f5 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -101,6 +101,7 @@ struct bio_list;
@@ -87830,7 +87650,7 @@ index 6e4569f..0c8aa25 100644
  	 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
  #define FIB_RES_GW(res)			(FIB_RES_NH(res).nh_gw)
 diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 416dcb0..e203877 100644
+index b8b2e50..91489a1 100644
 --- a/include/net/ip_vs.h
 +++ b/include/net/ip_vs.h
 @@ -509,7 +509,7 @@ struct ip_vs_conn {
@@ -88203,10 +88023,10 @@ index 4d1be75..a54d29e 100644
  
  /* Get the size of a DATA chunk payload. */
 diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index a15432da..9459dcc 100644
+index 2cccd82..03b6412 100644
 --- a/include/net/sctp/structs.h
 +++ b/include/net/sctp/structs.h
-@@ -644,7 +644,7 @@ struct sctp_pf {
+@@ -649,7 +649,7 @@ struct sctp_pf {
  					  struct sctp_association *asoc);
  	void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
  	struct sctp_af *af;
@@ -96335,7 +96155,7 @@ index 76b8e77..a2930e8 100644
  }
  
 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index f79803a..0dcc1be 100644
+index f07c144..d2ad3b0 100644
 --- a/kernel/ptrace.c
 +++ b/kernel/ptrace.c
 @@ -211,7 +211,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
@@ -96428,7 +96248,7 @@ index f79803a..0dcc1be 100644
  	return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
  }
  
-@@ -720,7 +740,7 @@ int ptrace_request(struct task_struct *child, long request,
+@@ -740,7 +760,7 @@ int ptrace_request(struct task_struct *child, long request,
  	bool seized = child->ptrace & PT_SEIZED;
  	int ret = -EIO;
  	siginfo_t siginfo, *si;
@@ -96437,7 +96257,7 @@ index f79803a..0dcc1be 100644
  	unsigned long __user *datalp = datavp;
  	unsigned long flags;
  
-@@ -922,14 +942,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+@@ -942,14 +962,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
  		goto out;
  	}
  
@@ -96460,7 +96280,7 @@ index f79803a..0dcc1be 100644
  		goto out_put_task_struct;
  	}
  
-@@ -957,7 +984,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
+@@ -977,7 +1004,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
  	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
  	if (copied != sizeof(tmp))
  		return -EIO;
@@ -96469,7 +96289,7 @@ index f79803a..0dcc1be 100644
  }
  
  int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
-@@ -1051,7 +1078,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
+@@ -1071,7 +1098,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
  }
  
  asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
@@ -96478,7 +96298,7 @@ index f79803a..0dcc1be 100644
  {
  	struct task_struct *child;
  	long ret;
-@@ -1067,14 +1094,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+@@ -1087,14 +1114,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
  		goto out;
  	}
  
@@ -97949,7 +97769,7 @@ index 9e800b2..1533ba5 100644
  	raw_spin_unlock_irq(&call_function.lock);
  }
 diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 2c71d91..6b690a4 100644
+index 44bc103..c131116 100644
 --- a/kernel/softirq.c
 +++ b/kernel/softirq.c
 @@ -52,11 +52,11 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
@@ -97966,7 +97786,7 @@ index 2c71d91..6b690a4 100644
  	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
  	"TASKLET", "SCHED", "HRTIMER", "RCU"
  };
-@@ -235,7 +235,7 @@ restart:
+@@ -241,7 +241,7 @@ restart:
  			kstat_incr_softirqs_this_cpu(vec_nr);
  
  			trace_softirq_entry(vec_nr);
@@ -97975,7 +97795,7 @@ index 2c71d91..6b690a4 100644
  			trace_softirq_exit(vec_nr);
  			if (unlikely(prev_count != preempt_count())) {
  				printk(KERN_ERR "huh, entered softirq %u %s %p"
-@@ -385,7 +385,7 @@ void raise_softirq(unsigned int nr)
+@@ -393,7 +393,7 @@ void raise_softirq(unsigned int nr)
  	local_irq_restore(flags);
  }
  
@@ -97984,7 +97804,7 @@ index 2c71d91..6b690a4 100644
  {
  	softirq_vec[nr].action = action;
  }
-@@ -441,7 +441,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
+@@ -449,7 +449,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
  
  EXPORT_SYMBOL(__tasklet_hi_schedule_first);
  
@@ -97993,7 +97813,7 @@ index 2c71d91..6b690a4 100644
  {
  	struct tasklet_struct *list;
  
-@@ -476,7 +476,7 @@ static void tasklet_action(struct softirq_action *a)
+@@ -484,7 +484,7 @@ static void tasklet_action(struct softirq_action *a)
  	}
  }
  
@@ -98002,7 +97822,7 @@ index 2c71d91..6b690a4 100644
  {
  	struct tasklet_struct *list;
  
-@@ -712,7 +712,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
+@@ -720,7 +720,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -98011,7 +97831,7 @@ index 2c71d91..6b690a4 100644
  	.notifier_call	= remote_softirq_cpu_notify,
  };
  
-@@ -894,7 +894,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
+@@ -902,7 +902,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
  	return NOTIFY_OK;
  }
  
@@ -99610,7 +99430,7 @@ index 875fed4..7a76cbb 100644
  }
  
 diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index b0996c1..9c39703 100644
+index 47343cc..9c39703 100644
 --- a/kernel/trace/trace_events_filter.c
 +++ b/kernel/trace/trace_events_filter.c
 @@ -1027,6 +1027,9 @@ static void parse_init(struct filter_parse_state *ps,
@@ -99633,36 +99453,15 @@ index b0996c1..9c39703 100644
  	ps->infix.cnt--;
  	ps->infix.tail++;
  }
-@@ -1343,19 +1349,27 @@ static int check_preds(struct filter_parse_state *ps)
- {
- 	int n_normal_preds = 0, n_logical_preds = 0;
- 	struct postfix_elt *elt;
-+	int cnt = 0;
- 
- 	list_for_each_entry(elt, &ps->postfix, list) {
--		if (elt->op == OP_NONE)
-+		if (elt->op == OP_NONE) {
-+			cnt++;
- 			continue;
-+		}
- 
- 		if (elt->op == OP_AND || elt->op == OP_OR) {
- 			n_logical_preds++;
-+			cnt--;
+@@ -1356,6 +1362,8 @@ static int check_preds(struct filter_parse_state *ps)
+ 			cnt--;
  			continue;
  		}
 +		// OP_NOT is not supported in this kernel, will get
 +		// a reject here when it's backported
-+		cnt--;
+ 		cnt--;
  		n_normal_preds++;
-+		WARN_ON_ONCE(cnt < 0);
- 	}
- 
--	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
-+	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
- 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
- 		return -EINVAL;
- 	}
+ 		WARN_ON_ONCE(cnt < 0);
 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
 index a7d2a4c..b034c76 100644
 --- a/kernel/trace/trace_functions_graph.c
@@ -104650,7 +104449,7 @@ index d0cb11f..e0a7fea 100644
  	struct mm_struct *mm;
  
 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 1bf1f74..5e27559 100644
+index 62bfbd9..bfd70ee 100644
 --- a/mm/page-writeback.c
 +++ b/mm/page-writeback.c
 @@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -105763,7 +105562,7 @@ index 8105be4..93fb21c 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 6a4c2fb..18d36e8 100644
+index 60c6969..dd5e22f 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -186,7 +186,7 @@ static enum {
@@ -105793,7 +105592,7 @@ index 6a4c2fb..18d36e8 100644
  		s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
  #ifdef CONFIG_STACKTRACE
  	{
-@@ -2537,6 +2537,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
+@@ -2520,6 +2520,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
  
  	slab_free_hook(s, x);
  
@@ -105808,7 +105607,7 @@ index 6a4c2fb..18d36e8 100644
  redo:
  	/*
  	 * Determine the currently cpus per cpu slab.
-@@ -2572,6 +2580,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
+@@ -2555,6 +2563,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
  
  	page = virt_to_head_page(x);
  
@@ -105817,7 +105616,7 @@ index 6a4c2fb..18d36e8 100644
  	slab_free(s, page, x, _RET_IP_);
  
  	trace_kmem_cache_free(_RET_IP_, x);
-@@ -2605,7 +2615,7 @@ static int slub_min_objects;
+@@ -2588,7 +2598,7 @@ static int slub_min_objects;
   * Merge control. If this is set then no merging of slab caches will occur.
   * (Could be removed. This was introduced to pacify the merge skeptics.)
   */
@@ -105826,7 +105625,7 @@ index 6a4c2fb..18d36e8 100644
  
  /*
   * Calculate the order of allocation given an slab object size.
-@@ -2909,6 +2919,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+@@ -2892,6 +2902,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
  	s->inuse = size;
  
  	if (((flags & (SLAB_DESTROY_BY_RCU | SLAB_POISON)) ||
@@ -105836,7 +105635,7 @@ index 6a4c2fb..18d36e8 100644
  		s->ctor)) {
  		/*
  		 * Relocate free pointer after the object if it is not
-@@ -3055,7 +3068,7 @@ static int kmem_cache_open(struct kmem_cache *s,
+@@ -3038,7 +3051,7 @@ static int kmem_cache_open(struct kmem_cache *s,
  	else
  		s->cpu_partial = 30;
  
@@ -105845,7 +105644,7 @@ index 6a4c2fb..18d36e8 100644
  #ifdef CONFIG_NUMA
  	s->remote_node_defrag_ratio = 1000;
  #endif
-@@ -3159,8 +3172,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
+@@ -3142,8 +3155,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
  void kmem_cache_destroy(struct kmem_cache *s)
  {
  	down_write(&slub_lock);
@@ -105855,7 +105654,7 @@ index 6a4c2fb..18d36e8 100644
  		list_del(&s->list);
  		up_write(&slub_lock);
  		if (kmem_cache_close(s)) {
-@@ -3189,6 +3201,10 @@ static struct kmem_cache *kmem_cache;
+@@ -3172,6 +3184,10 @@ static struct kmem_cache *kmem_cache;
  static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT];
  #endif
  
@@ -105866,7 +105665,7 @@ index 6a4c2fb..18d36e8 100644
  static int __init setup_slub_min_order(char *str)
  {
  	get_option(&str, &slub_min_order);
-@@ -3303,6 +3319,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
+@@ -3286,6 +3302,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
  		return kmalloc_dma_caches[index];
  
  #endif
@@ -105880,7 +105679,7 @@ index 6a4c2fb..18d36e8 100644
  	return kmalloc_caches[index];
  }
  
-@@ -3371,6 +3394,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3354,6 +3377,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
  EXPORT_SYMBOL(__kmalloc_node);
  #endif
  
@@ -105940,7 +105739,7 @@ index 6a4c2fb..18d36e8 100644
  size_t ksize(const void *object)
  {
  	struct page *page;
-@@ -3435,6 +3511,7 @@ void kfree(const void *x)
+@@ -3418,6 +3494,7 @@ void kfree(const void *x)
  	if (unlikely(ZERO_OR_NULL_PTR(x)))
  		return;
  
@@ -105948,7 +105747,7 @@ index 6a4c2fb..18d36e8 100644
  	page = virt_to_head_page(x);
  	if (unlikely(!PageSlab(page))) {
  		BUG_ON(!PageCompound(page));
-@@ -3645,7 +3722,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
+@@ -3628,7 +3705,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
  	int node;
  
  	list_add(&s->list, &slab_caches);
@@ -105957,7 +105756,7 @@ index 6a4c2fb..18d36e8 100644
  
  	for_each_node_state(node, N_NORMAL_MEMORY) {
  		struct kmem_cache_node *n = get_node(s, node);
-@@ -3762,17 +3839,17 @@ void __init kmem_cache_init(void)
+@@ -3745,17 +3822,17 @@ void __init kmem_cache_init(void)
  
  	/* Caches that are not of the two-to-the-power-of size */
  	if (KMALLOC_MIN_SIZE <= 32) {
@@ -105978,7 +105777,7 @@ index 6a4c2fb..18d36e8 100644
  		caches++;
  	}
  
-@@ -3814,6 +3891,22 @@ void __init kmem_cache_init(void)
+@@ -3797,6 +3874,22 @@ void __init kmem_cache_init(void)
  		}
  	}
  #endif
@@ -106001,7 +105800,7 @@ index 6a4c2fb..18d36e8 100644
  	printk(KERN_INFO
  		"SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
  		" CPUs=%d, Nodes=%d\n",
-@@ -3840,7 +3933,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+@@ -3823,7 +3916,7 @@ static int slab_unmergeable(struct kmem_cache *s)
  	/*
  	 * We may have set a slab to be unmergeable during bootstrap.
  	 */
@@ -106010,7 +105809,7 @@ index 6a4c2fb..18d36e8 100644
  		return 1;
  
  	return 0;
-@@ -3897,9 +3990,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3880,9 +3973,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
  		return NULL;
  
  	down_write(&slub_lock);
@@ -106029,7 +105828,7 @@ index 6a4c2fb..18d36e8 100644
  		/*
  		 * Adjust the object sizes so that we clear
  		 * the complete object on kzalloc.
-@@ -3908,7 +4009,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3891,7 +3992,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
  		s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
  
  		if (sysfs_slab_alias(s, name)) {
@@ -106038,7 +105837,7 @@ index 6a4c2fb..18d36e8 100644
  			goto err;
  		}
  		up_write(&slub_lock);
-@@ -3979,7 +4080,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
+@@ -3962,7 +4063,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
  	return NOTIFY_OK;
  }
  
@@ -106047,7 +105846,7 @@ index 6a4c2fb..18d36e8 100644
  	.notifier_call = slab_cpuup_callback
  };
  
-@@ -4037,7 +4138,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4020,7 +4121,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
  }
  #endif
  
@@ -106056,7 +105855,7 @@ index 6a4c2fb..18d36e8 100644
  static int count_inuse(struct page *page)
  {
  	return page->inuse;
-@@ -4424,12 +4525,12 @@ static void resiliency_test(void)
+@@ -4407,12 +4508,12 @@ static void resiliency_test(void)
  	validate_slab_cache(kmalloc_caches[9]);
  }
  #else
@@ -106071,7 +105870,7 @@ index 6a4c2fb..18d36e8 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4676,7 +4777,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4659,7 +4760,7 @@ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
  {
@@ -106080,7 +105879,7 @@ index 6a4c2fb..18d36e8 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -5243,6 +5344,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5226,6 +5327,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -106088,7 +105887,7 @@ index 6a4c2fb..18d36e8 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5271,7 +5373,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
+@@ -5254,7 +5356,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
  	}
  
  	s->kobj.kset = slab_kset;
@@ -106097,7 +105896,7 @@ index 6a4c2fb..18d36e8 100644
  	if (err) {
  		kobject_put(&s->kobj);
  		return err;
-@@ -5305,6 +5407,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5288,6 +5390,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -106105,7 +105904,7 @@ index 6a4c2fb..18d36e8 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5318,6 +5421,7 @@ struct saved_alias {
+@@ -5301,6 +5404,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -106113,7 +105912,7 @@ index 6a4c2fb..18d36e8 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5340,6 +5444,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5323,6 +5427,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -107247,10 +107046,10 @@ index f20c4fd..73aee41 100644
  	if (err < 0) {
  		pr_err("bridge: can't register sap for STP\n");
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 398a297..83fc29c 100644
+index 1bd197f..1119378 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
-@@ -1416,7 +1416,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+@@ -1415,7 +1415,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
  	nexthdr = ip6h->nexthdr;
  	offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
  
@@ -107344,7 +107143,7 @@ index 45f93f8..550f429 100644
  			break;
  		}
 diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index 7eed9eb..fd7291e 100644
+index 7e4b4b4..6c8ce35 100644
 --- a/net/caif/caif_socket.c
 +++ b/net/caif/caif_socket.c
 @@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
@@ -107449,7 +107248,7 @@ index 7eed9eb..fd7291e 100644
  			set_rx_flow_on(cf_sk);
  			caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
  	}
-@@ -852,7 +853,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
+@@ -860,7 +861,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
  	/*ifindex = id of the interface.*/
  	cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
  
@@ -107458,7 +107257,7 @@ index 7eed9eb..fd7291e 100644
  	cf_sk->layer.receive = caif_sktrecv_cb;
  
  	err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
-@@ -941,7 +942,7 @@ static int caif_release(struct socket *sock)
+@@ -949,7 +950,7 @@ static int caif_release(struct socket *sock)
  	spin_unlock_bh(&sk->sk_receive_queue.lock);
  	sock->sk = NULL;
  
@@ -107467,7 +107266,7 @@ index 7eed9eb..fd7291e 100644
  
  	WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
  	if (cf_sk->debugfs_socket_dir != NULL)
-@@ -1120,7 +1121,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
+@@ -1128,7 +1129,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
  	cf_sk->conn_req.protocol = protocol;
  	/* Increase the number of sockets created. */
  	dbfs_atomic_inc(&cnt.caif_nr_socks);
@@ -108245,10 +108044,10 @@ index 66e3f1f..317ae80 100644
  
  	m->msg_iov = iov;
 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 0ea3fd3..d87fef1 100644
+index c8c2645..e503d27 100644
 --- a/net/core/neighbour.c
 +++ b/net/core/neighbour.c
-@@ -2803,11 +2803,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
+@@ -2814,11 +2814,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
  		/* Terminate the table early */
  		memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
  	} else {
@@ -110199,7 +109998,7 @@ index 2e0f0af..e2948bf 100644
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 8c2e259..90d7b4e 100644
+index 5e92043..90d7b4e 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
 @@ -86,6 +86,7 @@
@@ -110270,20 +110069,7 @@ index 8c2e259..90d7b4e 100644
  	ulen = skb->len - sizeof(struct udphdr);
  	copied = len;
  	if (copied > ulen)
-@@ -1248,10 +1269,8 @@ csum_copy_err:
- 		UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -1486,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+@@ -1484,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
  
  drop:
  	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -110292,7 +110078,7 @@ index 8c2e259..90d7b4e 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -1505,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -1503,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  
  		if (!skb1) {
@@ -110301,7 +110087,7 @@ index 8c2e259..90d7b4e 100644
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					 IS_UDPLITE(sk));
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -1674,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -1672,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -110311,7 +110097,7 @@ index 8c2e259..90d7b4e 100644
  	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
  
  	/*
-@@ -2097,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2095,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
  		sk_wmem_alloc_get(sp),
  		sk_rmem_alloc_get(sp),
  		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
@@ -110906,7 +110692,7 @@ index 655cc60..c49497a 100644
  
  static int tcp6_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d131a95..59d5161 100644
+index dc08afd..59d5161 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -50,6 +50,10 @@
@@ -110920,20 +110706,7 @@ index d131a95..59d5161 100644
  int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
  {
  	const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -451,10 +455,8 @@ csum_copy_err:
- 	}
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -546,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+@@ -544,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
  
  	return 0;
  drop:
@@ -110942,7 +110715,7 @@ index d131a95..59d5161 100644
  drop_no_sk_drops_inc:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
  	kfree_skb(skb);
-@@ -622,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -620,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  			continue;
  		}
  drop:
@@ -110951,7 +110724,7 @@ index d131a95..59d5161 100644
  		UDP6_INC_STATS_BH(sock_net(sk),
  				UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
  		UDP6_INC_STATS_BH(sock_net(sk),
-@@ -777,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -775,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
  				proto == IPPROTO_UDPLITE);
  
@@ -110961,7 +110734,7 @@ index d131a95..59d5161 100644
  		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
  
  		kfree_skb(skb);
-@@ -793,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -791,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  	if (!sock_owned_by_user(sk))
  		udpv6_queue_rcv_skb(sk, skb);
  	else if (sk_add_backlog(sk, skb)) {
@@ -110970,7 +110743,7 @@ index d131a95..59d5161 100644
  		bh_unlock_sock(sk);
  		sock_put(sk);
  		goto discard;
-@@ -1409,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
+@@ -1407,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
  		   0, 0L, 0,
  		   sock_i_uid(sp), 0,
  		   sock_i_ino(sp),
@@ -111640,7 +111413,7 @@ index 6422845..2c19968 100644
  
  	if (!todrop_rate[i]) return 0;
 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index d864aaf..d6afbda 100644
+index 197ed93..49519a9 100644
 --- a/net/netfilter/ipvs/ip_vs_core.c
 +++ b/net/netfilter/ipvs/ip_vs_core.c
 @@ -562,7 +562,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
@@ -111662,7 +111435,7 @@ index d864aaf..d6afbda 100644
  	if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
  	    cp->protocol == IPPROTO_SCTP) {
 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 93acfa1..e846c43 100644
+index 1e27a1f..9774f6b 100644
 --- a/net/netfilter/ipvs/ip_vs_ctl.c
 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
 @@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
@@ -112385,7 +112158,7 @@ index b4d889b..bb33240 100644
  		*uaddr_len = sizeof(struct sockaddr_ax25);
  	}
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 4f19bf2..e3a2b51 100644
+index 0c21f06..0f53a06 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
 @@ -195,6 +195,7 @@ struct tpacket_kbdq_core {
@@ -112404,7 +112177,7 @@ index 4f19bf2..e3a2b51 100644
  	prb_init_ft_ops(p1, req_u);
  	prb_setup_retire_blk_timer(po, tx_ring);
  	prb_open_block(p1, pbd);
-@@ -1678,7 +1680,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1664,7 +1666,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.tp_packets++;
@@ -112413,7 +112186,7 @@ index 4f19bf2..e3a2b51 100644
  	__skb_queue_tail(&sk->sk_receive_queue, skb);
  	spin_unlock(&sk->sk_receive_queue.lock);
  	sk->sk_data_ready(sk, skb->len);
-@@ -1687,7 +1689,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1673,7 +1675,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  drop_n_acct:
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.tp_drops++;
@@ -112422,7 +112195,7 @@ index 4f19bf2..e3a2b51 100644
  	spin_unlock(&sk->sk_receive_queue.lock);
  
  drop_n_restore:
-@@ -1778,6 +1780,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1764,6 +1766,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
  			if ((int)snaplen < 0)
  				snaplen = 0;
  		}
@@ -112441,7 +112214,7 @@ index 4f19bf2..e3a2b51 100644
  	}
  	spin_lock(&sk->sk_receive_queue.lock);
  	h.raw = packet_current_rx_frame(po, skb,
-@@ -2623,6 +2637,7 @@ out:
+@@ -2609,6 +2623,7 @@ out:
  
  static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
  {
@@ -112449,7 +112222,7 @@ index 4f19bf2..e3a2b51 100644
  	struct sock_exterr_skb *serr;
  	struct sk_buff *skb, *skb2;
  	int copied, err;
-@@ -2644,8 +2659,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+@@ -2630,8 +2645,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
  	sock_recv_timestamp(msg, sk, skb);
  
  	serr = SKB_EXT_ERR(skb);
@@ -112460,7 +112233,7 @@ index 4f19bf2..e3a2b51 100644
  
  	msg->msg_flags |= MSG_ERRQUEUE;
  	err = copied;
-@@ -3273,7 +3289,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3259,7 +3275,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
  			len = sizeof(int);
@@ -112469,7 +112242,7 @@ index 4f19bf2..e3a2b51 100644
  			return -EFAULT;
  		switch (val) {
  		case TPACKET_V1:
-@@ -3323,7 +3339,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3309,7 +3325,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -112482,7 +112255,7 @@ index 4f19bf2..e3a2b51 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -3614,6 +3634,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+@@ -3600,6 +3620,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
  			goto out;
  		if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
  			goto out;
@@ -112661,6 +112434,19 @@ index e29e0ca..fa3a6a3 100644
  }
  #endif
  
+diff --git a/net/rds/info.c b/net/rds/info.c
+index f1c016c..a4adb39 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+ 
+ 	/* check for all kinds of wrapping and the like */
+ 	start = (unsigned long)optval;
+-	if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++	if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
 diff --git a/net/rds/iw.h b/net/rds/iw.h
 index 04ce3b1..48119a6 100644
 --- a/net/rds/iw.h
@@ -113310,10 +113096,10 @@ index 76388b0..a967f68 100644
  	sctp_generate_t1_cookie_event,
  	sctp_generate_t1_init_event,
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index fc63664..832978a 100644
+index 24e88af..047e703 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
-@@ -2190,11 +2190,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
+@@ -2192,11 +2192,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
  {
  	struct sctp_association *asoc;
  	struct sctp_ulpevent *event;
@@ -113328,7 +113114,7 @@ index fc63664..832978a 100644
  
  	/*
  	 * At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
-@@ -4180,13 +4182,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4194,13 +4196,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
  static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
  				  int __user *optlen)
  {
@@ -113346,7 +113132,7 @@ index fc63664..832978a 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4204,6 +4209,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4218,6 +4223,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
   */
  static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -113355,7 +113141,7 @@ index fc63664..832978a 100644
  	/* Applicable to UDP-style socket only */
  	if (sctp_style(sk, TCP))
  		return -EOPNOTSUPP;
-@@ -4212,7 +4219,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4226,7 +4233,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
  	len = sizeof(int);
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -113365,7 +113151,7 @@ index fc63664..832978a 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4576,12 +4584,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4590,12 +4598,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
   */
  static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -113382,7 +113168,7 @@ index fc63664..832978a 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4622,6 +4633,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4636,6 +4647,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
  		addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
  		if (space_left < addrlen)
  			return -ENOMEM;
@@ -113445,7 +113231,7 @@ index 8da4481..d02565e 100644
  			+ (rtt >> sctp_rto_alpha);
  	} else {
 diff --git a/net/socket.c b/net/socket.c
-index 116cf9d..a13ae17 100644
+index 10ea25a..e5f6b01 100644
 --- a/net/socket.c
 +++ b/net/socket.c
 @@ -88,6 +88,7 @@
@@ -113629,7 +113415,7 @@ index 116cf9d..a13ae17 100644
  	int err, err2;
  	int fput_needed;
  
-@@ -1973,7 +2039,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -1971,7 +2037,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
  		 * checking falls down on this.
  		 */
  		if (copy_from_user(ctl_buf,
@@ -113638,7 +113424,7 @@ index 116cf9d..a13ae17 100644
  				   ctl_len))
  			goto out_freectl;
  		msg_sys->msg_control = ctl_buf;
-@@ -2124,7 +2190,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2122,7 +2188,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
  	int err, iov_size, total_len, len;
  
  	/* kernel mode address */
@@ -113647,7 +113433,7 @@ index 116cf9d..a13ae17 100644
  
  	/* user mode address pointers */
  	struct sockaddr __user *uaddr;
-@@ -2155,7 +2221,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2151,7 +2217,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
  	/* Save the user-mode address (verify_iovec will change the
  	 * kernel msghdr to use the kernel address space)
  	 */
@@ -113657,7 +113443,7 @@ index 116cf9d..a13ae17 100644
  	uaddr_len = COMPAT_NAMELEN(msg);
  	if (MSG_CMSG_COMPAT & flags)
  		err = verify_compat_iovec(msg_sys, iov,
-@@ -2799,9 +2866,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2795,9 +2862,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  	}
  
  	ifr = compat_alloc_user_space(buf_size);
@@ -113669,7 +113455,7 @@ index 116cf9d..a13ae17 100644
  		return -EFAULT;
  
  	if (put_user(convert_in ? rxnfc : compat_ptr(data),
-@@ -2823,12 +2890,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2819,12 +2886,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  			offsetof(struct ethtool_rxnfc, fs.ring_cookie));
  
  		if (copy_in_user(rxnfc, compat_rxnfc,
@@ -113686,7 +113472,7 @@ index 116cf9d..a13ae17 100644
  		    copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
  				 sizeof(rxnfc->rule_cnt)))
  			return -EFAULT;
-@@ -2840,12 +2907,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2836,12 +2903,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  
  	if (convert_out) {
  		if (copy_in_user(compat_rxnfc, rxnfc,
@@ -113703,7 +113489,7 @@ index 116cf9d..a13ae17 100644
  		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
  				 sizeof(rxnfc->rule_cnt)))
  			return -EFAULT;
-@@ -2915,14 +2982,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -2911,14 +2978,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
  		old_fs = get_fs();
  		set_fs(KERNEL_DS);
  		err = dev_ioctl(net, cmd,
@@ -113720,7 +113506,7 @@ index 116cf9d..a13ae17 100644
  			return -EFAULT;
  
  		if (get_user(data, &ifr32->ifr_ifru.ifru_data))
-@@ -3024,7 +3091,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -3020,7 +3087,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
  
  	old_fs = get_fs();
  	set_fs(KERNEL_DS);
@@ -113729,7 +113515,7 @@ index 116cf9d..a13ae17 100644
  	set_fs(old_fs);
  
  	if (cmd == SIOCGIFMAP && !err) {
-@@ -3129,7 +3196,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3125,7 +3192,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
  		ret |= __get_user(rtdev, &(ur4->rt_dev));
  		if (rtdev) {
  			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -113738,7 +113524,7 @@ index 116cf9d..a13ae17 100644
  			devname[15] = 0;
  		} else
  			r4.rt_dev = NULL;
-@@ -3369,8 +3436,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3365,8 +3432,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
  	int __user *uoptlen;
  	int err;
  
@@ -113749,7 +113535,7 @@ index 116cf9d..a13ae17 100644
  
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
-@@ -3390,7 +3457,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3386,7 +3453,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
  	char __user *uoptval;
  	int err;
  
@@ -114590,7 +114376,7 @@ index 1983717..4d6102c 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8705ee3..cf68ef1 100644
+index 9b1f371..ff529bf 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -114639,7 +114425,7 @@ index 8705ee3..cf68ef1 100644
  		mutex_unlock(&path.dentry->d_inode->i_mutex);
  		dput(path.dentry);
  		path.dentry = dentry;
-@@ -2180,11 +2200,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2188,11 +2208,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
  	writable = unix_writable(sk);
  	other = unix_peer_get(sk);
  	if (other) {
@@ -114656,7 +114442,7 @@ index 8705ee3..cf68ef1 100644
  		sock_put(other);
  	}
  
-@@ -2276,9 +2299,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2284,9 +2307,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -114671,7 +114457,7 @@ index 8705ee3..cf68ef1 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2303,10 +2330,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2311,10 +2338,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -119101,7 +118887,7 @@ index 6ce2778..f25c378 100644
  
  fail:
 diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
-index 7778b8e..3d619fc 100644
+index a020920..55579f6 100644
 --- a/sound/synth/emux/emux_seq.c
 +++ b/sound/synth/emux/emux_seq.c
 @@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
diff --git a/3.2.69/4425_grsec_remove_EI_PAX.patch b/3.2.70/4425_grsec_remove_EI_PAX.patch
index ba92792..ba92792 100644
--- a/3.2.69/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.70/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
index caaeed1..caaeed1 100644
--- a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.69/4430_grsec-remove-localversion-grsec.patch b/3.2.70/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.69/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.70/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.69/4435_grsec-mute-warnings.patch b/3.2.70/4435_grsec-mute-warnings.patch
index baa71cb..baa71cb 100644
--- a/3.2.69/4435_grsec-mute-warnings.patch
+++ b/3.2.70/4435_grsec-mute-warnings.patch
diff --git a/3.2.69/4440_grsec-remove-protected-paths.patch b/3.2.70/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.69/4440_grsec-remove-protected-paths.patch
+++ b/3.2.70/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.69/4450_grsec-kconfig-default-gids.patch b/3.2.70/4450_grsec-kconfig-default-gids.patch
index 5e1cb04..5e1cb04 100644
--- a/3.2.69/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.70/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
index f73d198..f73d198 100644
--- a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.69/4470_disable-compat_vdso.patch b/3.2.70/4470_disable-compat_vdso.patch
index 34d46de..34d46de 100644
--- a/3.2.69/4470_disable-compat_vdso.patch
+++ b/3.2.70/4470_disable-compat_vdso.patch
diff --git a/3.2.69/4475_emutramp_default_on.patch b/3.2.70/4475_emutramp_default_on.patch
index 2db58ab..2db58ab 100644
--- a/3.2.69/4475_emutramp_default_on.patch
+++ b/3.2.70/4475_emutramp_default_on.patch
diff --git a/4.1.4/1003_linux-4.1.4.patch b/4.1.4/1003_linux-4.1.4.patch
deleted file mode 100644
index d9bc159..0000000
--- a/4.1.4/1003_linux-4.1.4.patch
+++ /dev/null
@@ -1,11078 +0,0 @@
-diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
-index d0d0c57..0a378a8 100644
---- a/Documentation/ABI/testing/ima_policy
-+++ b/Documentation/ABI/testing/ima_policy
-@@ -20,17 +20,19 @@ Description:
- 		action: measure | dont_measure | appraise | dont_appraise | audit
- 		condition:= base | lsm  [option]
- 			base:	[[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
--				 [fowner]]
-+				[euid=] [fowner=]]
- 			lsm:	[[subj_user=] [subj_role=] [subj_type=]
- 				 [obj_user=] [obj_role=] [obj_type=]]
- 			option:	[[appraise_type=]] [permit_directio]
- 
- 		base: 	func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
- 				[FIRMWARE_CHECK]
--			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
-+			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
-+			       [[^]MAY_EXEC]
- 			fsmagic:= hex value
- 			fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
- 			uid:= decimal value
-+			euid:= decimal value
- 			fowner:=decimal value
- 		lsm:  	are LSM specific
- 		option:	appraise_type:= [imasig]
-@@ -49,11 +51,25 @@ Description:
- 			dont_measure fsmagic=0x01021994
- 			dont_appraise fsmagic=0x01021994
- 			# RAMFS_MAGIC
--			dont_measure fsmagic=0x858458f6
- 			dont_appraise fsmagic=0x858458f6
-+			# DEVPTS_SUPER_MAGIC
-+			dont_measure fsmagic=0x1cd1
-+			dont_appraise fsmagic=0x1cd1
-+			# BINFMTFS_MAGIC
-+			dont_measure fsmagic=0x42494e4d
-+			dont_appraise fsmagic=0x42494e4d
- 			# SECURITYFS_MAGIC
- 			dont_measure fsmagic=0x73636673
- 			dont_appraise fsmagic=0x73636673
-+			# SELINUX_MAGIC
-+			dont_measure fsmagic=0xf97cff8c
-+			dont_appraise fsmagic=0xf97cff8c
-+			# CGROUP_SUPER_MAGIC
-+			dont_measure fsmagic=0x27e0eb
-+			dont_appraise fsmagic=0x27e0eb
-+			# NSFS_MAGIC
-+			dont_measure fsmagic=0x6e736673
-+			dont_appraise fsmagic=0x6e736673
- 
- 			measure func=BPRM_CHECK
- 			measure func=FILE_MMAP mask=MAY_EXEC
-@@ -70,10 +86,6 @@ Description:
- 		Examples of LSM specific definitions:
- 
- 		SELinux:
--			# SELINUX_MAGIC
--			dont_measure fsmagic=0xf97cff8c
--			dont_appraise fsmagic=0xf97cff8c
--
- 			dont_measure obj_type=var_log_t
- 			dont_appraise obj_type=var_log_t
- 			dont_measure obj_type=auditd_log_t
-diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
-index 0a93215..9231dae 100644
---- a/Documentation/ABI/testing/sysfs-ata
-+++ b/Documentation/ABI/testing/sysfs-ata
-@@ -90,6 +90,17 @@ gscr
- 	130:	SATA_PMP_GSCR_SII_GPIO
- 	Only valid if the device is a PM.
- 
-+trim
-+
-+	Shows the DSM TRIM mode currently used by the device. Valid
-+	values are:
-+	unsupported:		Drive does not support DSM TRIM
-+	unqueued:		Drive supports unqueued DSM TRIM only
-+	queued:			Drive supports queued DSM TRIM
-+	forced_unqueued:	Drive's unqueued DSM support is known to be
-+				buggy and only unqueued TRIM commands
-+				are sent
-+
- spdn_cnt
- 
- 	Number of time libata decided to lower the speed of link due to errors.
-diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
-index 3befcb1..1fbdd79 100644
---- a/Documentation/ABI/testing/sysfs-bus-iio
-+++ b/Documentation/ABI/testing/sysfs-bus-iio
-@@ -1165,10 +1165,8 @@ Description:
- 		object is near the sensor, usually be observing
- 		reflectivity of infrared or ultrasound emitted.
- 		Often these sensors are unit less and as such conversion
--		to SI units is not possible.  Where it is, the units should
--		be meters.  If such a conversion is not possible, the reported
--		values should behave in the same way as a distance, i.e. lower
--		values indicate something is closer to the sensor.
-+		to SI units is not possible. Higher proximity measurements
-+		indicate closer objects, and vice versa.
- 
- What:		/sys/.../iio:deviceX/in_illuminance_input
- What:		/sys/.../iio:deviceX/in_illuminance_raw
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index adda2a8..e357b02 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -92,5 +92,5 @@ mpp61         61       gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62         62       gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
-                        audio(mclk), uart0(cts)
- mpp63         63       gpo, spi0(sck), tclk
--mpp64         64       gpio, spi0(miso), spi0-1(cs1)
--mpp65         65       gpio, spi0(mosi), spi0-1(cs2)
-+mpp64         64       gpio, spi0(miso), spi0(cs1)
-+mpp65         65       gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-index 7de0cda..bedbe42 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-@@ -22,8 +22,8 @@ mpp5          5        gpio, dev(ad7), spi0(cs2), spi1(cs2)
- mpp6          6        gpio, dev(ad0), led(p1), audio(rclk)
- mpp7          7        gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
- mpp8          8        gpio, dev (bootcs), spi0(cs0), spi1(cs0)
--mpp9          9        gpio, nf(wen), spi0(sck), spi1(sck)
--mpp10        10        gpio, nf(ren), dram(vttctrl), led(c1)
-+mpp9          9        gpio, spi0(sck), spi1(sck), nand(we)
-+mpp10        10        gpio, dram(vttctrl), led(c1), nand(re)
- mpp11        11        gpio, dev(a0), led(c2), audio(sdo)
- mpp12        12        gpio, dev(a1), audio(bclk)
- mpp13        13        gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-index b17c968..4ac138a 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-@@ -27,15 +27,15 @@ mpp8          8        gpio, ge0(txd1), dev(ad10)
- mpp9          9        gpio, ge0(txd2), dev(ad11)
- mpp10         10       gpio, ge0(txd3), dev(ad12)
- mpp11         11       gpio, ge0(txctl), dev(ad13)
--mpp12         12       gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
--mpp13         13       gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
--mpp14         14       gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
--mpp15         15       gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
--mpp16         16       gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
-+mpp12         12       gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
-+mpp13         13       gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
-+mpp14         14       gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
-+mpp15         15       gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
-+mpp16         16       gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
- mpp17         17       gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
--mpp18         18       gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
--mpp19         19       gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
--mpp20         20       gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
-+mpp18         18       gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
-+mpp19         19       gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
-+mpp20         20       gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
- mpp21         21       gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
- mpp22         22       gpio, spi0(mosi), dev(ad0)
- mpp23         23       gpio, spi0(sck), dev(ad2)
-@@ -58,23 +58,23 @@ mpp39         39       gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2)
- mpp40         40       gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
- mpp41         41       gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
- mpp42         42       gpio, ua1(txd), ua0(rts), dev(ad7)
--mpp43         43       gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
--mpp44         44       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
--mpp45         45       gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp46         46       gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp47         47       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
--mpp48         48       gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
--mpp49         49       gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
--mpp50         50       gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
-+mpp43         43       gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
-+mpp44         44       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
-+mpp45         45       gpio, ref(clk_out0), pcie0(rstout)
-+mpp46         46       gpio, ref(clk_out1), pcie0(rstout)
-+mpp47         47       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
-+mpp48         48       gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
-+mpp49         49       gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
-+mpp50         50       gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
- mpp51         51       gpio, tdm2c(dtx), audio(sdo), m(decc_err)
--mpp52         52       gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
-+mpp52         52       gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
- mpp53         53       gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
--mpp54         54       gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
-+mpp54         54       gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
- mpp55         55       gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
- mpp56         56       gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
- mpp57         57       gpio, spi1(sck), sd0(clk)
- mpp58         58       gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
--mpp59         59       gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
-+mpp59         59       gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
- 
- [1]: only available on 88F6820 and 88F6828
- [2]: only available on 88F6828
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index 373dbccd..96e7744 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -42,15 +42,15 @@ mpp20         20       gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21         21       gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22         22       gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23         23       gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24         24       gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25         25       gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26         26       gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24         24       gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25         25       gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26         26       gpio, lcd(clk), tdm(fsync)
- mpp27         27       gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28         28       gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30         30       gpio, tdm(int1), sd0(clk)
--mpp31         31       gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32         32       gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31         31       gpio, tdm(int2), sd0(cmd)
-+mpp32         32       gpio, tdm(int3), sd0(d0)
- mpp33         33       gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34         34       gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35         35       gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -58,21 +58,18 @@ mpp36         36       gpio, spi(mosi)
- mpp37         37       gpio, spi(miso)
- mpp38         38       gpio, spi(sck)
- mpp39         39       gpio, spi(cs0)
--mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
--                       pcie(clkreq0)
-+mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41         41       gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
-                        pcie(clkreq1)
--mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
--                       vdd(cpu0-pd)
--mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
--                       vdd(cpu2-3-pd){1}
-+mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44         44       gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
-                        mem(bat)
- mpp45         45       gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46         46       gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47         47       gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
-                        ref(clkout)
--mpp48         48       gpio, tclk, dev(burst/last)
-+mpp48         48       gpio, dev(clkout), dev(burst/last)
- 
- * Marvell Armada XP (mv78260 and mv78460 only)
- 
-@@ -84,9 +81,9 @@ mpp51         51       gpio, dev(ad16)
- mpp52         52       gpio, dev(ad17)
- mpp53         53       gpio, dev(ad18)
- mpp54         54       gpio, dev(ad19)
--mpp55         55       gpio, dev(ad20), vdd(cpu0-pd)
--mpp56         56       gpio, dev(ad21), vdd(cpu1-pd)
--mpp57         57       gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55         55       gpio, dev(ad20)
-+mpp56         56       gpio, dev(ad21)
-+mpp57         57       gpio, dev(ad22)
- mpp58         58       gpio, dev(ad23)
- mpp59         59       gpio, dev(ad24)
- mpp60         60       gpio, dev(ad25)
-@@ -96,6 +93,3 @@ mpp63         63       gpio, dev(ad28)
- mpp64         64       gpio, dev(ad29)
- mpp65         65       gpio, dev(ad30)
- mpp66         66       gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/usb/atmel-usb.txt b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-index e180d56..de773a0 100644
---- a/Documentation/devicetree/bindings/usb/atmel-usb.txt
-+++ b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-@@ -60,9 +60,9 @@ Atmel High-Speed USB device controller
- 
- Required properties:
-  - compatible: Should be one of the following
--	       "at91sam9rl-udc"
--	       "at91sam9g45-udc"
--	       "sama5d3-udc"
-+	       "atmel,at91sam9rl-udc"
-+	       "atmel,at91sam9g45-udc"
-+	       "atmel,sama5d3-udc"
-  - reg: Address and length of the register set for the device
-  - interrupts: Should contain usba interrupt
-  - ep childnode: To specify the number of endpoints and their properties.
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 6726139..cd03a0f 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -1398,7 +1398,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
- 			The list of supported hash algorithms is defined
- 			in crypto/hash_info.h.
- 
--	ima_tcb		[IMA]
-+	ima_policy=	[IMA]
-+			The builtin measurement policy to load during IMA
-+			setup.  Specyfing "tcb" as the value, measures all
-+			programs exec'd, files mmap'd for exec, and all files
-+			opened with the read mode bit set by either the
-+			effective uid (euid=0) or uid=0.
-+			Format: "tcb"
-+
-+	ima_tcb		[IMA] Deprecated.  Use ima_policy= instead.
- 			Load a policy which meets the needs of the Trusted
- 			Computing Base.  This means IMA will measure all
- 			programs exec'd, files mmap'd for exec, and all files
-diff --git a/Makefile b/Makefile
-index e3cdec4..36f3225 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 1
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Series 4800
- 
-diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
-index 89ef4a5..45e7761 100644
---- a/arch/arm/boot/dts/at91-sama5d4ek.dts
-+++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
-@@ -108,8 +108,8 @@
- 			mmc0: mmc@f8000000 {
- 				pinctrl-names = "default";
- 				pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>;
--				slot@1 {
--					reg = <1>;
-+				slot@0 {
-+					reg = <0>;
- 					bus-width = <4>;
- 					cd-gpios = <&pioE 5 0>;
- 				};
-diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
-index 70e59c5..e544211 100644
---- a/arch/arm/boot/dts/at91sam9g45.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
-@@ -1148,7 +1148,7 @@
- 			usb2: gadget@fff78000 {
- 				#address-cells = <1>;
- 				#size-cells = <0>;
--				compatible = "atmel,at91sam9rl-udc";
-+				compatible = "atmel,at91sam9g45-udc";
- 				reg = <0x00600000 0x80000
- 				       0xfff78000 0x400>;
- 				interrupts = <27 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
-index 3aa56ae..3314a73 100644
---- a/arch/arm/boot/dts/at91sam9x5.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
-@@ -1062,7 +1062,7 @@
- 			usb2: gadget@f803c000 {
- 				#address-cells = <1>;
- 				#size-cells = <0>;
--				compatible = "atmel,at91sam9rl-udc";
-+				compatible = "atmel,at91sam9g45-udc";
- 				reg = <0x00500000 0x80000
- 				       0xf803c000 0x400>;
- 				interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
-index bbcfb5a..0cb8b0b 100644
---- a/arch/arm/boot/dts/imx23.dtsi
-+++ b/arch/arm/boot/dts/imx23.dtsi
-@@ -435,6 +435,7 @@
- 				interrupts = <36 37 38 39 40 41 42 43 44>;
- 				status = "disabled";
- 				clocks = <&clks 26>;
-+				#io-channel-cells = <1>;
- 			};
- 
- 			spdif@80054000 {
-diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
-index 57ab858..37e6182 100644
---- a/arch/arm/boot/dts/sama5d3.dtsi
-+++ b/arch/arm/boot/dts/sama5d3.dtsi
-@@ -1321,7 +1321,7 @@
- 		usb0: gadget@00500000 {
- 			#address-cells = <1>;
- 			#size-cells = <0>;
--			compatible = "atmel,at91sam9rl-udc";
-+			compatible = "atmel,sama5d3-udc";
- 			reg = <0x00500000 0x100000
- 			       0xf8030000 0x4000>;
- 			interrupts = <33 IRQ_TYPE_LEVEL_HIGH 2>;
-diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
-index 6b1bb58..a5f5f40 100644
---- a/arch/arm/boot/dts/sama5d4.dtsi
-+++ b/arch/arm/boot/dts/sama5d4.dtsi
-@@ -123,7 +123,7 @@
- 		usb0: gadget@00400000 {
- 			#address-cells = <1>;
- 			#size-cells = <0>;
--			compatible = "atmel,at91sam9rl-udc";
-+			compatible = "atmel,sama5d3-udc";
- 			reg = <0x00400000 0x100000
- 			       0xfc02c000 0x4000>;
- 			interrupts = <47 IRQ_TYPE_LEVEL_HIGH 2>;
-@@ -1125,10 +1125,10 @@
- 				compatible = "atmel,at91sam9g46-aes";
- 				reg = <0xfc044000 0x100>;
- 				interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
--				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(41)>,
--				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(40)>;
-+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(41))>,
-+				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(40))>;
- 				dma-names = "tx", "rx";
- 				clocks = <&aes_clk>;
- 				clock-names = "aes_clk";
-@@ -1139,10 +1139,10 @@
- 				compatible = "atmel,at91sam9g46-tdes";
- 				reg = <0xfc04c000 0x100>;
- 				interrupts = <14 IRQ_TYPE_LEVEL_HIGH 0>;
--				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(42)>,
--				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(43)>;
-+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(42))>,
-+				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(43))>;
- 				dma-names = "tx", "rx";
- 				clocks = <&tdes_clk>;
- 				clock-names = "tdes_clk";
-@@ -1153,8 +1153,8 @@
- 				compatible = "atmel,at91sam9g46-sha";
- 				reg = <0xfc050000 0x100>;
- 				interrupts = <15 IRQ_TYPE_LEVEL_HIGH 0>;
--				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(44)>;
-+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(44))>;
- 				dma-names = "tx";
- 				clocks = <&sha_clk>;
- 				clock-names = "sha_clk";
-diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index cca5b87..f11d825 100644
---- a/arch/arm/kernel/smp.c
-+++ b/arch/arm/kernel/smp.c
-@@ -576,7 +576,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	struct pt_regs *old_regs = set_irq_regs(regs);
- 
- 	if ((unsigned)ipinr < NR_IPI) {
--		trace_ipi_entry(ipi_types[ipinr]);
-+		trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- 		__inc_irq_stat(cpu, ipi_irqs[ipinr]);
- 	}
- 
-@@ -635,7 +635,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	}
- 
- 	if ((unsigned)ipinr < NR_IPI)
--		trace_ipi_exit(ipi_types[ipinr]);
-+		trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- 	set_irq_regs(old_regs);
- }
- 
-diff --git a/arch/arm/mach-dove/include/mach/irqs.h b/arch/arm/mach-dove/include/mach/irqs.h
-index 03d401d..3f29e6bc 100644
---- a/arch/arm/mach-dove/include/mach/irqs.h
-+++ b/arch/arm/mach-dove/include/mach/irqs.h
-@@ -14,73 +14,73 @@
- /*
-  * Dove Low Interrupt Controller
-  */
--#define IRQ_DOVE_BRIDGE		0
--#define IRQ_DOVE_H2C		1
--#define IRQ_DOVE_C2H		2
--#define IRQ_DOVE_NAND		3
--#define IRQ_DOVE_PDMA		4
--#define IRQ_DOVE_SPI1		5
--#define IRQ_DOVE_SPI0		6
--#define IRQ_DOVE_UART_0		7
--#define IRQ_DOVE_UART_1		8
--#define IRQ_DOVE_UART_2		9
--#define IRQ_DOVE_UART_3		10
--#define IRQ_DOVE_I2C		11
--#define IRQ_DOVE_GPIO_0_7	12
--#define IRQ_DOVE_GPIO_8_15	13
--#define IRQ_DOVE_GPIO_16_23	14
--#define IRQ_DOVE_PCIE0_ERR	15
--#define IRQ_DOVE_PCIE0		16
--#define IRQ_DOVE_PCIE1_ERR	17
--#define IRQ_DOVE_PCIE1		18
--#define IRQ_DOVE_I2S0		19
--#define IRQ_DOVE_I2S0_ERR	20
--#define IRQ_DOVE_I2S1		21
--#define IRQ_DOVE_I2S1_ERR	22
--#define IRQ_DOVE_USB_ERR	23
--#define IRQ_DOVE_USB0		24
--#define IRQ_DOVE_USB1		25
--#define IRQ_DOVE_GE00_RX	26
--#define IRQ_DOVE_GE00_TX	27
--#define IRQ_DOVE_GE00_MISC	28
--#define IRQ_DOVE_GE00_SUM	29
--#define IRQ_DOVE_GE00_ERR	30
--#define IRQ_DOVE_CRYPTO		31
-+#define IRQ_DOVE_BRIDGE		(1 + 0)
-+#define IRQ_DOVE_H2C		(1 + 1)
-+#define IRQ_DOVE_C2H		(1 + 2)
-+#define IRQ_DOVE_NAND		(1 + 3)
-+#define IRQ_DOVE_PDMA		(1 + 4)
-+#define IRQ_DOVE_SPI1		(1 + 5)
-+#define IRQ_DOVE_SPI0		(1 + 6)
-+#define IRQ_DOVE_UART_0		(1 + 7)
-+#define IRQ_DOVE_UART_1		(1 + 8)
-+#define IRQ_DOVE_UART_2		(1 + 9)
-+#define IRQ_DOVE_UART_3		(1 + 10)
-+#define IRQ_DOVE_I2C		(1 + 11)
-+#define IRQ_DOVE_GPIO_0_7	(1 + 12)
-+#define IRQ_DOVE_GPIO_8_15	(1 + 13)
-+#define IRQ_DOVE_GPIO_16_23	(1 + 14)
-+#define IRQ_DOVE_PCIE0_ERR	(1 + 15)
-+#define IRQ_DOVE_PCIE0		(1 + 16)
-+#define IRQ_DOVE_PCIE1_ERR	(1 + 17)
-+#define IRQ_DOVE_PCIE1		(1 + 18)
-+#define IRQ_DOVE_I2S0		(1 + 19)
-+#define IRQ_DOVE_I2S0_ERR	(1 + 20)
-+#define IRQ_DOVE_I2S1		(1 + 21)
-+#define IRQ_DOVE_I2S1_ERR	(1 + 22)
-+#define IRQ_DOVE_USB_ERR	(1 + 23)
-+#define IRQ_DOVE_USB0		(1 + 24)
-+#define IRQ_DOVE_USB1		(1 + 25)
-+#define IRQ_DOVE_GE00_RX	(1 + 26)
-+#define IRQ_DOVE_GE00_TX	(1 + 27)
-+#define IRQ_DOVE_GE00_MISC	(1 + 28)
-+#define IRQ_DOVE_GE00_SUM	(1 + 29)
-+#define IRQ_DOVE_GE00_ERR	(1 + 30)
-+#define IRQ_DOVE_CRYPTO		(1 + 31)
- 
- /*
-  * Dove High Interrupt Controller
-  */
--#define IRQ_DOVE_AC97		32
--#define IRQ_DOVE_PMU		33
--#define IRQ_DOVE_CAM		34
--#define IRQ_DOVE_SDIO0		35
--#define IRQ_DOVE_SDIO1		36
--#define IRQ_DOVE_SDIO0_WAKEUP	37
--#define IRQ_DOVE_SDIO1_WAKEUP	38
--#define IRQ_DOVE_XOR_00		39
--#define IRQ_DOVE_XOR_01		40
--#define IRQ_DOVE_XOR0_ERR	41
--#define IRQ_DOVE_XOR_10		42
--#define IRQ_DOVE_XOR_11		43
--#define IRQ_DOVE_XOR1_ERR	44
--#define IRQ_DOVE_LCD_DCON	45
--#define IRQ_DOVE_LCD1		46
--#define IRQ_DOVE_LCD0		47
--#define IRQ_DOVE_GPU		48
--#define IRQ_DOVE_PERFORM_MNTR	49
--#define IRQ_DOVE_VPRO_DMA1	51
--#define IRQ_DOVE_SSP_TIMER	54
--#define IRQ_DOVE_SSP		55
--#define IRQ_DOVE_MC_L2_ERR	56
--#define IRQ_DOVE_CRYPTO_ERR	59
--#define IRQ_DOVE_GPIO_24_31	60
--#define IRQ_DOVE_HIGH_GPIO	61
--#define IRQ_DOVE_SATA		62
-+#define IRQ_DOVE_AC97		(1 + 32)
-+#define IRQ_DOVE_PMU		(1 + 33)
-+#define IRQ_DOVE_CAM		(1 + 34)
-+#define IRQ_DOVE_SDIO0		(1 + 35)
-+#define IRQ_DOVE_SDIO1		(1 + 36)
-+#define IRQ_DOVE_SDIO0_WAKEUP	(1 + 37)
-+#define IRQ_DOVE_SDIO1_WAKEUP	(1 + 38)
-+#define IRQ_DOVE_XOR_00		(1 + 39)
-+#define IRQ_DOVE_XOR_01		(1 + 40)
-+#define IRQ_DOVE_XOR0_ERR	(1 + 41)
-+#define IRQ_DOVE_XOR_10		(1 + 42)
-+#define IRQ_DOVE_XOR_11		(1 + 43)
-+#define IRQ_DOVE_XOR1_ERR	(1 + 44)
-+#define IRQ_DOVE_LCD_DCON	(1 + 45)
-+#define IRQ_DOVE_LCD1		(1 + 46)
-+#define IRQ_DOVE_LCD0		(1 + 47)
-+#define IRQ_DOVE_GPU		(1 + 48)
-+#define IRQ_DOVE_PERFORM_MNTR	(1 + 49)
-+#define IRQ_DOVE_VPRO_DMA1	(1 + 51)
-+#define IRQ_DOVE_SSP_TIMER	(1 + 54)
-+#define IRQ_DOVE_SSP		(1 + 55)
-+#define IRQ_DOVE_MC_L2_ERR	(1 + 56)
-+#define IRQ_DOVE_CRYPTO_ERR	(1 + 59)
-+#define IRQ_DOVE_GPIO_24_31	(1 + 60)
-+#define IRQ_DOVE_HIGH_GPIO	(1 + 61)
-+#define IRQ_DOVE_SATA		(1 + 62)
- 
- /*
-  * DOVE General Purpose Pins
-  */
--#define IRQ_DOVE_GPIO_START	64
-+#define IRQ_DOVE_GPIO_START	65
- #define NR_GPIO_IRQS		64
- 
- /*
-diff --git a/arch/arm/mach-dove/irq.c b/arch/arm/mach-dove/irq.c
-index 4a5a7ae..df0223f 100644
---- a/arch/arm/mach-dove/irq.c
-+++ b/arch/arm/mach-dove/irq.c
-@@ -126,14 +126,14 @@ __exception_irq_entry dove_legacy_handle_irq(struct pt_regs *regs)
- 	stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_LOW_OFF);
- 	stat &= readl_relaxed(dove_irq_base + IRQ_MASK_LOW_OFF);
- 	if (stat) {
--		unsigned int hwirq = __fls(stat);
-+		unsigned int hwirq = 1 + __fls(stat);
- 		handle_IRQ(hwirq, regs);
- 		return;
- 	}
- 	stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_HIGH_OFF);
- 	stat &= readl_relaxed(dove_irq_base + IRQ_MASK_HIGH_OFF);
- 	if (stat) {
--		unsigned int hwirq = 32 + __fls(stat);
-+		unsigned int hwirq = 33 + __fls(stat);
- 		handle_IRQ(hwirq, regs);
- 		return;
- 	}
-@@ -144,8 +144,8 @@ void __init dove_init_irq(void)
- {
- 	int i;
- 
--	orion_irq_init(0, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
--	orion_irq_init(32, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
-+	orion_irq_init(1, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-+	orion_irq_init(33, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
- 
- #ifdef CONFIG_MULTI_IRQ_HANDLER
- 	set_handle_irq(dove_legacy_handle_irq);
-diff --git a/arch/arm/vdso/vdsomunge.c b/arch/arm/vdso/vdsomunge.c
-index 9005b07..aedec81 100644
---- a/arch/arm/vdso/vdsomunge.c
-+++ b/arch/arm/vdso/vdsomunge.c
-@@ -45,13 +45,11 @@
-  * it does.
-  */
- 
--#define _GNU_SOURCE
--
- #include <byteswap.h>
- #include <elf.h>
- #include <errno.h>
--#include <error.h>
- #include <fcntl.h>
-+#include <stdarg.h>
- #include <stdbool.h>
- #include <stdio.h>
- #include <stdlib.h>
-@@ -82,11 +80,25 @@
- #define EF_ARM_ABI_FLOAT_HARD 0x400
- #endif
- 
-+static int failed;
-+static const char *argv0;
- static const char *outfile;
- 
-+static void fail(const char *fmt, ...)
-+{
-+	va_list ap;
-+
-+	failed = 1;
-+	fprintf(stderr, "%s: ", argv0);
-+	va_start(ap, fmt);
-+	vfprintf(stderr, fmt, ap);
-+	va_end(ap);
-+	exit(EXIT_FAILURE);
-+}
-+
- static void cleanup(void)
- {
--	if (error_message_count > 0 && outfile != NULL)
-+	if (failed && outfile != NULL)
- 		unlink(outfile);
- }
- 
-@@ -119,68 +131,66 @@ int main(int argc, char **argv)
- 	int infd;
- 
- 	atexit(cleanup);
-+	argv0 = argv[0];
- 
- 	if (argc != 3)
--		error(EXIT_FAILURE, 0, "Usage: %s [infile] [outfile]", argv[0]);
-+		fail("Usage: %s [infile] [outfile]\n", argv[0]);
- 
- 	infile = argv[1];
- 	outfile = argv[2];
- 
- 	infd = open(infile, O_RDONLY);
- 	if (infd < 0)
--		error(EXIT_FAILURE, errno, "Cannot open %s", infile);
-+		fail("Cannot open %s: %s\n", infile, strerror(errno));
- 
- 	if (fstat(infd, &stat) != 0)
--		error(EXIT_FAILURE, errno, "Failed stat for %s", infile);
-+		fail("Failed stat for %s: %s\n", infile, strerror(errno));
- 
- 	inbuf = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, infd, 0);
- 	if (inbuf == MAP_FAILED)
--		error(EXIT_FAILURE, errno, "Failed to map %s", infile);
-+		fail("Failed to map %s: %s\n", infile, strerror(errno));
- 
- 	close(infd);
- 
- 	inhdr = inbuf;
- 
- 	if (memcmp(&inhdr->e_ident, ELFMAG, SELFMAG) != 0)
--		error(EXIT_FAILURE, 0, "Not an ELF file");
-+		fail("Not an ELF file\n");
- 
- 	if (inhdr->e_ident[EI_CLASS] != ELFCLASS32)
--		error(EXIT_FAILURE, 0, "Unsupported ELF class");
-+		fail("Unsupported ELF class\n");
- 
- 	swap = inhdr->e_ident[EI_DATA] != HOST_ORDER;
- 
- 	if (read_elf_half(inhdr->e_type, swap) != ET_DYN)
--		error(EXIT_FAILURE, 0, "Not a shared object");
-+		fail("Not a shared object\n");
- 
--	if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) {
--		error(EXIT_FAILURE, 0, "Unsupported architecture %#x",
--		      inhdr->e_machine);
--	}
-+	if (read_elf_half(inhdr->e_machine, swap) != EM_ARM)
-+		fail("Unsupported architecture %#x\n", inhdr->e_machine);
- 
- 	e_flags = read_elf_word(inhdr->e_flags, swap);
- 
- 	if (EF_ARM_EABI_VERSION(e_flags) != EF_ARM_EABI_VER5) {
--		error(EXIT_FAILURE, 0, "Unsupported EABI version %#x",
--		      EF_ARM_EABI_VERSION(e_flags));
-+		fail("Unsupported EABI version %#x\n",
-+		     EF_ARM_EABI_VERSION(e_flags));
- 	}
- 
- 	if (e_flags & EF_ARM_ABI_FLOAT_HARD)
--		error(EXIT_FAILURE, 0,
--		      "Unexpected hard-float flag set in e_flags");
-+		fail("Unexpected hard-float flag set in e_flags\n");
- 
- 	clear_soft_float = !!(e_flags & EF_ARM_ABI_FLOAT_SOFT);
- 
- 	outfd = open(outfile, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
- 	if (outfd < 0)
--		error(EXIT_FAILURE, errno, "Cannot open %s", outfile);
-+		fail("Cannot open %s: %s\n", outfile, strerror(errno));
- 
- 	if (ftruncate(outfd, stat.st_size) != 0)
--		error(EXIT_FAILURE, errno, "Cannot truncate %s", outfile);
-+		fail("Cannot truncate %s: %s\n", outfile, strerror(errno));
- 
- 	outbuf = mmap(NULL, stat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
- 		      outfd, 0);
- 	if (outbuf == MAP_FAILED)
--		error(EXIT_FAILURE, errno, "Failed to map %s", outfile);
-+		fail("Failed to map %s: %s\n", outfile, strerror(errno));
- 
- 	close(outfd);
- 
-@@ -195,7 +205,7 @@ int main(int argc, char **argv)
- 	}
- 
- 	if (msync(outbuf, stat.st_size, MS_SYNC) != 0)
--		error(EXIT_FAILURE, errno, "Failed to sync %s", outfile);
-+		fail("Failed to sync %s: %s\n", outfile, strerror(errno));
- 
- 	return EXIT_SUCCESS;
- }
-diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
-index 2cb0081..d3a202b 100644
---- a/arch/arm64/kernel/smp.c
-+++ b/arch/arm64/kernel/smp.c
-@@ -569,7 +569,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	struct pt_regs *old_regs = set_irq_regs(regs);
- 
- 	if ((unsigned)ipinr < NR_IPI) {
--		trace_ipi_entry(ipi_types[ipinr]);
-+		trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- 		__inc_irq_stat(cpu, ipi_irqs[ipinr]);
- 	}
- 
-@@ -612,7 +612,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	}
- 
- 	if ((unsigned)ipinr < NR_IPI)
--		trace_ipi_exit(ipi_types[ipinr]);
-+		trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- 	set_irq_regs(old_regs);
- }
- 
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 2de9d2e..0eeb4f09 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
- 
- int pmd_huge(pmd_t pmd)
- {
--	return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
- 
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
--	return !(pud_val(pud) & PUD_TABLE_BIT);
-+	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- 	return 0;
- #endif
-diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
-index de0a81a..98a26ce 100644
---- a/arch/arm64/net/bpf_jit.h
-+++ b/arch/arm64/net/bpf_jit.h
-@@ -110,6 +110,10 @@
- /* Rd = Rn >> shift; signed */
- #define A64_ASR(sf, Rd, Rn, shift) A64_SBFM(sf, Rd, Rn, shift, (sf) ? 63 : 31)
- 
-+/* Zero extend */
-+#define A64_UXTH(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 15)
-+#define A64_UXTW(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 31)
-+
- /* Move wide (immediate) */
- #define A64_MOVEW(sf, Rd, imm16, shift, type) \
- 	aarch64_insn_gen_movewide(Rd, imm16, shift, \
-diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
-index dc6a484..c047598 100644
---- a/arch/arm64/net/bpf_jit_comp.c
-+++ b/arch/arm64/net/bpf_jit_comp.c
-@@ -113,9 +113,9 @@ static inline void emit_a64_mov_i(const int is64, const int reg,
- static inline int bpf2a64_offset(int bpf_to, int bpf_from,
- 				 const struct jit_ctx *ctx)
- {
--	int to = ctx->offset[bpf_to + 1];
-+	int to = ctx->offset[bpf_to];
- 	/* -1 to account for the Branch instruction */
--	int from = ctx->offset[bpf_from + 1] - 1;
-+	int from = ctx->offset[bpf_from] - 1;
- 
- 	return to - from;
- }
-@@ -289,23 +289,41 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
- 	case BPF_ALU | BPF_END | BPF_FROM_BE:
- #ifdef CONFIG_CPU_BIG_ENDIAN
- 		if (BPF_SRC(code) == BPF_FROM_BE)
--			break;
-+			goto emit_bswap_uxt;
- #else /* !CONFIG_CPU_BIG_ENDIAN */
- 		if (BPF_SRC(code) == BPF_FROM_LE)
--			break;
-+			goto emit_bswap_uxt;
- #endif
- 		switch (imm) {
- 		case 16:
- 			emit(A64_REV16(is64, dst, dst), ctx);
-+			/* zero-extend 16 bits into 64 bits */
-+			emit(A64_UXTH(is64, dst, dst), ctx);
- 			break;
- 		case 32:
- 			emit(A64_REV32(is64, dst, dst), ctx);
-+			/* upper 32 bits already cleared */
- 			break;
- 		case 64:
- 			emit(A64_REV64(dst, dst), ctx);
- 			break;
- 		}
- 		break;
-+emit_bswap_uxt:
-+		switch (imm) {
-+		case 16:
-+			/* zero-extend 16 bits into 64 bits */
-+			emit(A64_UXTH(is64, dst, dst), ctx);
-+			break;
-+		case 32:
-+			/* zero-extend 32 bits into 64 bits */
-+			emit(A64_UXTW(is64, dst, dst), ctx);
-+			break;
-+		case 64:
-+			/* nop */
-+			break;
-+		}
-+		break;
- 	/* dst = imm */
- 	case BPF_ALU | BPF_MOV | BPF_K:
- 	case BPF_ALU64 | BPF_MOV | BPF_K:
-@@ -640,10 +658,11 @@ static int build_body(struct jit_ctx *ctx)
- 		const struct bpf_insn *insn = &prog->insnsi[i];
- 		int ret;
- 
-+		ret = build_insn(insn, ctx);
-+
- 		if (ctx->image == NULL)
- 			ctx->offset[i] = ctx->idx;
- 
--		ret = build_insn(insn, ctx);
- 		if (ret > 0) {
- 			i++;
- 			continue;
-diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
-index 33013df..5c68c85 100644
---- a/arch/m68k/Kconfig.cpu
-+++ b/arch/m68k/Kconfig.cpu
-@@ -125,6 +125,13 @@ endif # M68KCLASSIC
- 
- if COLDFIRE
- 
-+choice
-+	prompt "ColdFire SoC type"
-+	default M520x
-+	help
-+	  Select the type of ColdFire System-on-Chip (SoC) that you want
-+	  to build for.
-+
- config M5206
- 	bool "MCF5206"
- 	depends on !MMU
-@@ -174,9 +181,6 @@ config M525x
- 	help
- 	  Freescale (Motorola) Coldfire 5251/5253 processor support.
- 
--config M527x
--	bool
--
- config M5271
- 	bool "MCF5271"
- 	depends on !MMU
-@@ -223,9 +227,6 @@ config M5307
- 	help
- 	  Motorola ColdFire 5307 processor support.
- 
--config M53xx
--	bool
--
- config M532x
- 	bool "MCF532x"
- 	depends on !MMU
-@@ -251,9 +252,6 @@ config M5407
- 	help
- 	  Motorola ColdFire 5407 processor support.
- 
--config M54xx
--	bool
--
- config M547x
- 	bool "MCF547x"
- 	select M54xx
-@@ -280,6 +278,17 @@ config M5441x
- 	help
- 	  Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
- 
-+endchoice
-+
-+config M527x
-+	bool
-+
-+config M53xx
-+	bool
-+
-+config M54xx
-+	bool
-+
- endif # COLDFIRE
- 
- 
-@@ -416,22 +425,10 @@ config HAVE_MBAR
- config HAVE_IPSBAR
- 	bool
- 
--config CLOCK_SET
--	bool "Enable setting the CPU clock frequency"
--	depends on COLDFIRE
--	default n
--	help
--	  On some CPU's you do not need to know what the core CPU clock
--	  frequency is. On these you can disable clock setting. On some
--	  traditional 68K parts, and on all ColdFire parts you need to set
--	  the appropriate CPU clock frequency. On these devices many of the
--	  onboard peripherals derive their timing from the master CPU clock
--	  frequency.
--
- config CLOCK_FREQ
- 	int "Set the core clock frequency"
- 	default "66666666"
--	depends on CLOCK_SET
-+	depends on COLDFIRE
- 	help
- 	  Define the CPU clock frequency in use. This is the core clock
- 	  frequency, it may or may not be the same as the external clock
-diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h
-index c94557b..50aa4da 100644
---- a/arch/m68k/include/asm/coldfire.h
-+++ b/arch/m68k/include/asm/coldfire.h
-@@ -19,7 +19,7 @@
-  *	in any case new boards come along from time to time that have yet
-  *	another different clocking frequency.
-  */
--#ifdef CONFIG_CLOCK_SET
-+#ifdef CONFIG_CLOCK_FREQ
- #define	MCF_CLK		CONFIG_CLOCK_FREQ
- #else
- #error "Don't know what your ColdFire CPU clock frequency is??"
-diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
-index e5a693b..443f44d 100644
---- a/arch/openrisc/Kconfig
-+++ b/arch/openrisc/Kconfig
-@@ -17,6 +17,7 @@ config OPENRISC
- 	select GENERIC_IRQ_SHOW
- 	select GENERIC_IOMAP
- 	select GENERIC_CPU_DEVICES
-+	select HAVE_UID16
- 	select GENERIC_ATOMIC64
- 	select GENERIC_CLOCKEVENTS
- 	select GENERIC_STRNCPY_FROM_USER
-@@ -31,9 +32,6 @@ config MMU
- config HAVE_DMA_ATTRS
- 	def_bool y
- 
--config UID16
--	def_bool y
--
- config RWSEM_GENERIC_SPINLOCK
- 	def_bool y
- 
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 9d518d6..844b06d 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 	}
- }
-+
-+const char *arch_vma_name(struct vm_area_struct *vma)
-+{
-+	if (vma->vm_flags & VM_MPX)
-+		return "[mpx]";
-+	return NULL;
-+}
-diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
-index c439ec4..4d1c11c 100644
---- a/arch/x86/mm/mpx.c
-+++ b/arch/x86/mm/mpx.c
-@@ -18,26 +18,9 @@
- #include <asm/processor.h>
- #include <asm/fpu-internal.h>
- 
--static const char *mpx_mapping_name(struct vm_area_struct *vma)
--{
--	return "[mpx]";
--}
--
--static struct vm_operations_struct mpx_vma_ops = {
--	.name = mpx_mapping_name,
--};
--
--static int is_mpx_vma(struct vm_area_struct *vma)
--{
--	return (vma->vm_ops == &mpx_vma_ops);
--}
--
- /*
-  * This is really a simplified "vm_mmap". it only handles MPX
-  * bounds tables (the bounds directory is user-allocated).
-- *
-- * Later on, we use the vma->vm_ops to uniquely identify these
-- * VMAs.
-  */
- static unsigned long mpx_mmap(unsigned long len)
- {
-@@ -83,7 +66,6 @@ static unsigned long mpx_mmap(unsigned long len)
- 		ret = -ENOMEM;
- 		goto out;
- 	}
--	vma->vm_ops = &mpx_vma_ops;
- 
- 	if (vm_flags & VM_LOCKED) {
- 		up_write(&mm->mmap_sem);
-@@ -661,7 +643,7 @@ static int zap_bt_entries(struct mm_struct *mm,
- 		 * so stop immediately and return an error.  This
- 		 * probably results in a SIGSEGV.
- 		 */
--		if (!is_mpx_vma(vma))
-+		if (!(vma->vm_flags & VM_MPX))
- 			return -EINVAL;
- 
- 		len = min(vma->vm_end, end) - addr;
-diff --git a/block/bio.c b/block/bio.c
-index f66a4ea..4441522 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -1814,8 +1814,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
-  * Allocates and returns a new bio which represents @sectors from the start of
-  * @bio, and updates @bio to represent the remaining sectors.
-  *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
-  */
- struct bio *bio_split(struct bio *bio, int sectors,
- 		      gfp_t gfp, struct bio_set *bs)
-@@ -1825,7 +1826,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- 	BUG_ON(sectors <= 0);
- 	BUG_ON(sectors >= bio_sectors(bio));
- 
--	split = bio_clone_fast(bio, gfp, bs);
-+	/*
-+	 * Discards need a mutable bio_vec to accommodate the payload
-+	 * required by the DSM TRIM and UNMAP commands.
-+	 */
-+	if (bio->bi_rw & REQ_DISCARD)
-+		split = bio_clone_bioset(bio, gfp, bs);
-+	else
-+		split = bio_clone_fast(bio, gfp, bs);
-+
- 	if (!split)
- 		return NULL;
- 
-diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
-index f973308..3f5b537 100644
---- a/crypto/asymmetric_keys/asymmetric_keys.h
-+++ b/crypto/asymmetric_keys/asymmetric_keys.h
-@@ -11,6 +11,9 @@
- 
- extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
- 
-+extern int __asymmetric_key_hex_to_key_id(const char *id,
-+					  struct asymmetric_key_id *match_id,
-+					  size_t hexlen);
- static inline
- const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
- {
-diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
-index bcbbbd7..b0e4ed2 100644
---- a/crypto/asymmetric_keys/asymmetric_type.c
-+++ b/crypto/asymmetric_keys/asymmetric_type.c
-@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids(
- 	return false;
- }
- 
-+/* helper function can be called directly with pre-allocated memory */
-+inline int __asymmetric_key_hex_to_key_id(const char *id,
-+				   struct asymmetric_key_id *match_id,
-+				   size_t hexlen)
-+{
-+	match_id->len = hexlen;
-+	return hex2bin(match_id->data, id, hexlen);
-+}
-+
- /**
-  * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
-  * @id: The ID as a hex string.
-@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids(
- struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
- {
- 	struct asymmetric_key_id *match_id;
--	size_t hexlen;
-+	size_t asciihexlen;
- 	int ret;
- 
- 	if (!*id)
- 		return ERR_PTR(-EINVAL);
--	hexlen = strlen(id);
--	if (hexlen & 1)
-+	asciihexlen = strlen(id);
-+	if (asciihexlen & 1)
- 		return ERR_PTR(-EINVAL);
- 
--	match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
-+	match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
- 			   GFP_KERNEL);
- 	if (!match_id)
- 		return ERR_PTR(-ENOMEM);
--	match_id->len = hexlen / 2;
--	ret = hex2bin(match_id->data, id, hexlen / 2);
-+	ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
- 	if (ret < 0) {
- 		kfree(match_id);
- 		return ERR_PTR(-EINVAL);
-diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
-index a6c4203..24f17e6 100644
---- a/crypto/asymmetric_keys/x509_public_key.c
-+++ b/crypto/asymmetric_keys/x509_public_key.c
-@@ -28,17 +28,30 @@ static bool use_builtin_keys;
- static struct asymmetric_key_id *ca_keyid;
- 
- #ifndef MODULE
-+static struct {
-+	struct asymmetric_key_id id;
-+	unsigned char data[10];
-+} cakey;
-+
- static int __init ca_keys_setup(char *str)
- {
- 	if (!str)		/* default system keyring */
- 		return 1;
- 
- 	if (strncmp(str, "id:", 3) == 0) {
--		struct asymmetric_key_id *p;
--		p = asymmetric_key_hex_to_key_id(str + 3);
--		if (p == ERR_PTR(-EINVAL))
--			pr_err("Unparsable hex string in ca_keys\n");
--		else if (!IS_ERR(p))
-+		struct asymmetric_key_id *p = &cakey.id;
-+		size_t hexlen = (strlen(str) - 3) / 2;
-+		int ret;
-+
-+		if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
-+			pr_err("Missing or invalid ca_keys id\n");
-+			return 1;
-+		}
-+
-+		ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
-+		if (ret < 0)
-+			pr_err("Unparsable ca_keys id hex string\n");
-+		else
- 			ca_keyid = p;	/* owner key 'id:xxxxxx' */
- 	} else if (strcmp(str, "builtin") == 0) {
- 		use_builtin_keys = true;
-diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
-index 37fb190..73f056a 100644
---- a/drivers/acpi/acpi_lpss.c
-+++ b/drivers/acpi/acpi_lpss.c
-@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
- 				pdata->mmio_size = resource_size(rentry->res);
- 			pdata->mmio_base = ioremap(rentry->res->start,
- 						   pdata->mmio_size);
--			if (!pdata->mmio_base)
--				goto err_out;
- 			break;
- 		}
- 
- 	acpi_dev_free_resource_list(&resource_list);
- 
-+	if (!pdata->mmio_base) {
-+		ret = -ENOMEM;
-+		goto err_out;
-+	}
-+
- 	pdata->dev_desc = dev_desc;
- 
- 	if (dev_desc->setup)
-diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
-index 87b2752..7f50dd9 100644
---- a/drivers/acpi/acpica/aclocal.h
-+++ b/drivers/acpi/acpica/aclocal.h
-@@ -213,6 +213,7 @@ struct acpi_table_list {
- 
- #define ACPI_TABLE_INDEX_DSDT           (0)
- #define ACPI_TABLE_INDEX_FACS           (1)
-+#define ACPI_TABLE_INDEX_X_FACS         (2)
- 
- struct acpi_find_context {
- 	char *search_for;
-diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
-index 7d24860..05be59c 100644
---- a/drivers/acpi/acpica/tbfadt.c
-+++ b/drivers/acpi/acpica/tbfadt.c
-@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
- 	/* If Hardware Reduced flag is set, there is no FACS */
- 
- 	if (!acpi_gbl_reduced_hardware) {
--		acpi_tb_install_fixed_table((acpi_physical_address)
--					    acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
--					    ACPI_TABLE_INDEX_FACS);
-+		if (acpi_gbl_FADT.facs) {
-+			acpi_tb_install_fixed_table((acpi_physical_address)
-+						    acpi_gbl_FADT.facs,
-+						    ACPI_SIG_FACS,
-+						    ACPI_TABLE_INDEX_FACS);
-+		}
-+		if (acpi_gbl_FADT.Xfacs) {
-+			acpi_tb_install_fixed_table((acpi_physical_address)
-+						    acpi_gbl_FADT.Xfacs,
-+						    ACPI_SIG_FACS,
-+						    ACPI_TABLE_INDEX_X_FACS);
-+		}
- 	}
- }
- 
-@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
- 	acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
- 
- 	/*
--	 * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
-+	 * Expand the 32-bit DSDT addresses to 64-bit as necessary.
- 	 * Later ACPICA code will always use the X 64-bit field.
- 	 */
--	acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
--						     acpi_gbl_FADT.facs,
--						     acpi_gbl_FADT.Xfacs);
--
- 	acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
- 						     acpi_gbl_FADT.dsdt,
- 						     acpi_gbl_FADT.Xdsdt);
-diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
-index 6559a58..2fb1afa 100644
---- a/drivers/acpi/acpica/tbutils.c
-+++ b/drivers/acpi/acpica/tbutils.c
-@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
- 
- acpi_status acpi_tb_initialize_facs(void)
- {
--	acpi_status status;
-+	struct acpi_table_facs *facs32;
-+	struct acpi_table_facs *facs64;
- 
- 	/* If Hardware Reduced flag is set, there is no FACS */
- 
-@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void)
- 		return (AE_OK);
- 	}
- 
--	status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
--					 ACPI_CAST_INDIRECT_PTR(struct
--								acpi_table_header,
--								&acpi_gbl_FACS));
--	return (status);
-+	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-+				      ACPI_CAST_INDIRECT_PTR(struct
-+							     acpi_table_header,
-+							     &facs32));
-+	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
-+				      ACPI_CAST_INDIRECT_PTR(struct
-+							     acpi_table_header,
-+							     &facs64));
-+
-+	if (acpi_gbl_use32_bit_facs_addresses) {
-+		acpi_gbl_FACS = facs32 ? facs32 : facs64;
-+	} else {
-+		acpi_gbl_FACS = facs64 ? facs64 : facs32;
-+	}
-+
-+	return (AE_OK);
- }
- #endif				/* !ACPI_REDUCED_HARDWARE */
- 
-@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void)
- u8 acpi_tb_tables_loaded(void)
- {
- 
--	if (acpi_gbl_root_table_list.current_table_count >= 3) {
-+	if (acpi_gbl_root_table_list.current_table_count >= 4) {
- 		return (TRUE);
- 	}
- 
-@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
- 	table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
- 
- 	/*
--	 * First two entries in the table array are reserved for the DSDT
--	 * and FACS, which are not actually present in the RSDT/XSDT - they
--	 * come from the FADT
-+	 * First three entries in the table array are reserved for the DSDT
-+	 * and 32bit/64bit FACS, which are not actually present in the
-+	 * RSDT/XSDT - they come from the FADT
- 	 */
--	acpi_gbl_root_table_list.current_table_count = 2;
-+	acpi_gbl_root_table_list.current_table_count = 3;
- 
- 	/* Initialize the root table array from the RSDT/XSDT */
- 
-diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
-index aadb300..b63e35d 100644
---- a/drivers/acpi/acpica/tbxfload.c
-+++ b/drivers/acpi/acpica/tbxfload.c
-@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespace(void)
- 
- 	(void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
- 	for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
--		if ((!ACPI_COMPARE_NAME
-+		if (!acpi_gbl_root_table_list.tables[i].address ||
-+		    (!ACPI_COMPARE_NAME
- 		     (&(acpi_gbl_root_table_list.tables[i].signature),
- 		      ACPI_SIG_SSDT)
- 		     &&
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 083a768..42a32a6 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -179,10 +179,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- 	 * Obtain a permanent mapping for the FACS. This is required for the
- 	 * Global Lock and the Firmware Waking Vector
- 	 */
--	status = acpi_tb_initialize_facs();
--	if (ACPI_FAILURE(status)) {
--		ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
--		return_ACPI_STATUS(status);
-+	if (!(flags & ACPI_NO_FACS_INIT)) {
-+		status = acpi_tb_initialize_facs();
-+		if (ACPI_FAILURE(status)) {
-+			ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+			return_ACPI_STATUS(status);
-+		}
- 	}
- #endif				/* !ACPI_REDUCED_HARDWARE */
- 
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 5226a8b..98f5316 100644