Grsec/PaX: 3.0-{3.2.63,3.14.18,3.16.2}-20140915085420140915

57 files changed, 6927 insertions, 850 deletions

diff --git a/3.14.18/0000_README b/3.14.18/0000_README
index bfce1bf..09338f7 100644
--- a/3.14.18/0000_README
+++ b/3.14.18/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.14.18-201409112236.patch
+Patch:	4420_grsecurity-3.0-3.14.18-201409141906.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.14.18/4420_grsecurity-3.0-3.14.18-201409112236.patch b/3.14.18/4420_grsecurity-3.0-3.14.18-201409141906.patch
index 79d4ee6..54a332a 100644
--- a/3.14.18/4420_grsecurity-3.0-3.14.18-201409112236.patch
+++ b/3.14.18/4420_grsecurity-3.0-3.14.18-201409141906.patch
@@ -876,7 +876,7 @@ index 4733d32..b142a40 100644
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 62d2cb5..09d45e3 100644
+index 62d2cb5..0d7f7f5 100644
 --- a/arch/arm/include/asm/atomic.h
 +++ b/arch/arm/include/asm/atomic.h
 @@ -18,17 +18,35 @@
@@ -1379,7 +1379,7 @@ index 62d2cb5..09d45e3 100644
  "	sbc	%R0, %R0, %R4\n"
  "	strexd	%1, %0, %H0, [%3]\n"
  "	teq	%1, #0\n"
-@@ -344,16 +691,29 @@ static inline long long atomic64_sub_return(long long i, atomic64_t *v)
+@@ -344,10 +691,25 @@ static inline long long atomic64_sub_return(long long i, atomic64_t *v)
  	__asm__ __volatile__("@ atomic64_sub_return\n"
  "1:	ldrexd	%0, %H0, [%3]\n"
  "	subs	%Q0, %Q0, %Q4\n"
@@ -1406,13 +1406,7 @@ index 62d2cb5..09d45e3 100644
  	: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter), "r" (i)
  	: "cc");
- 
--	smp_mb();
--
- 	return result;
- }
- 
-@@ -382,6 +742,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
+@@ -382,6 +744,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
  	return oldval;
  }
  
@@ -1444,7 +1438,7 @@ index 62d2cb5..09d45e3 100644
  static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
  {
  	long long result;
-@@ -406,20 +791,34 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
+@@ -406,20 +793,34 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
  static inline long long atomic64_dec_if_positive(atomic64_t *v)
  {
  	long long result;
@@ -1485,7 +1479,7 @@ index 62d2cb5..09d45e3 100644
  	: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter)
  	: "cc");
-@@ -442,13 +841,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -442,13 +843,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
  "	teq	%0, %5\n"
  "	teqeq	%H0, %H5\n"
  "	moveq	%1, #0\n"
@@ -1514,7 +1508,7 @@ index 62d2cb5..09d45e3 100644
  	: "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter), "r" (u), "r" (a)
  	: "cc");
-@@ -461,10 +872,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -461,10 +874,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
  
  #define atomic64_add_negative(a, v)	(atomic64_add_return((a), (v)) < 0)
  #define atomic64_inc(v)			atomic64_add(1LL, (v))
@@ -5049,6 +5043,17 @@ index 0c8e553..112d734 100644
  	help
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
+diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
+index f37238f..810b95f 100644
+--- a/arch/ia64/Makefile
++++ b/arch/ia64/Makefile
+@@ -99,5 +99,6 @@ endef
+ archprepare: make_nr_irqs_h FORCE
+ PHONY += make_nr_irqs_h FORCE
+ 
++make_nr_irqs_h: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
+ make_nr_irqs_h: FORCE
+ 	$(Q)$(MAKE) $(build)=arch/ia64/kernel include/generated/nr-irqs.h
 diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
 index 6e6fe18..a6ae668 100644
 --- a/arch/ia64/include/asm/atomic.h
@@ -12291,10 +12296,18 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index e409891..d64a8f7 100644
+index e409891..8ec65be 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
-@@ -126,7 +126,7 @@ config X86
+@@ -22,6 +22,7 @@ config X86_64
+ config X86
+ 	def_bool y
+ 	select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
++	select ARCH_HAS_FAST_MULTIPLIER
+ 	select ARCH_MIGHT_HAVE_PC_PARPORT
+ 	select ARCH_MIGHT_HAVE_PC_SERIO
+ 	select HAVE_AOUT if X86_32
+@@ -126,7 +127,7 @@ config X86
  	select RTC_LIB
  	select HAVE_DEBUG_STACKOVERFLOW
  	select HAVE_IRQ_EXIT_ON_IRQ_STACK if X86_64
@@ -12303,7 +12316,7 @@ index e409891..d64a8f7 100644
  	select ARCH_SUPPORTS_ATOMIC_RMW
  
  config INSTRUCTION_DECODER
-@@ -252,7 +252,7 @@ config X86_HT
+@@ -252,7 +253,7 @@ config X86_HT
  
  config X86_32_LAZY_GS
  	def_bool y
@@ -12312,7 +12325,7 @@ index e409891..d64a8f7 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -590,6 +590,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -590,6 +591,7 @@ config SCHED_OMIT_FRAME_POINTER
  
  menuconfig HYPERVISOR_GUEST
  	bool "Linux guest support"
@@ -12320,7 +12333,7 @@ index e409891..d64a8f7 100644
  	---help---
  	  Say Y here to enable options for running Linux under various hyper-
  	  visors. This option enables basic hypervisor detection and platform
-@@ -1129,7 +1130,7 @@ choice
+@@ -1129,7 +1131,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -12329,7 +12342,7 @@ index e409891..d64a8f7 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1166,7 +1167,7 @@ config NOHIGHMEM
+@@ -1166,7 +1168,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -12338,7 +12351,7 @@ index e409891..d64a8f7 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1219,7 +1220,7 @@ config PAGE_OFFSET
+@@ -1219,7 +1221,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -12347,7 +12360,7 @@ index e409891..d64a8f7 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1624,6 +1625,7 @@ source kernel/Kconfig.hz
+@@ -1624,6 +1626,7 @@ source kernel/Kconfig.hz
  
  config KEXEC
  	bool "kexec system call"
@@ -12355,7 +12368,7 @@ index e409891..d64a8f7 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1775,7 +1777,9 @@ config X86_NEED_RELOCS
+@@ -1775,7 +1778,9 @@ config X86_NEED_RELOCS
  
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned"
@@ -12366,7 +12379,7 @@ index e409891..d64a8f7 100644
  	range 0x2000 0x1000000 if X86_32
  	range 0x200000 0x1000000 if X86_64
  	---help---
-@@ -1855,9 +1859,10 @@ config DEBUG_HOTPLUG_CPU0
+@@ -1855,9 +1860,10 @@ config DEBUG_HOTPLUG_CPU0
  	  If unsure, say N.
  
  config COMPAT_VDSO
@@ -15784,7 +15797,7 @@ index 69bbb48..32517fe 100644
  
  #define smp_load_acquire(p)						\
 diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
-index 9fc1af7..776d75a 100644
+index 9fc1af7..98cab0b 100644
 --- a/arch/x86/include/asm/bitops.h
 +++ b/arch/x86/include/asm/bitops.h
 @@ -49,7 +49,7 @@
@@ -15868,6 +15881,15 @@ index 9fc1af7..776d75a 100644
  {
  	int bitpos = -1;
  	/*
+@@ -499,8 +499,6 @@ static __always_inline int fls64(__u64 x)
+ 
+ #include <asm-generic/bitops/sched.h>
+ 
+-#define ARCH_HAS_FAST_MULTIPLIER 1
+-
+ #include <asm/arch_hweight.h>
+ 
+ #include <asm-generic/bitops/const_hweight.h>
 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
 index 4fa687a..60f2d39 100644
 --- a/arch/x86/include/asm/boot.h
@@ -59392,10 +59414,126 @@ index a93f7e6..d58bcbe 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 7f3b400..9c911f2 100644
+index 7f3b400..f91b141 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
-@@ -1495,7 +1495,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -106,8 +106,7 @@ static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
+ 					unsigned int hash)
+ {
+ 	hash += (unsigned long) parent / L1_CACHE_BYTES;
+-	hash = hash + (hash >> d_hash_shift);
+-	return dentry_hashtable + (hash & d_hash_mask);
++	return dentry_hashtable + hash_32(hash, d_hash_shift);
+ }
+ 
+ /* Statistics gathering. */
+@@ -251,7 +250,7 @@ static void __d_free(struct rcu_head *head)
+  */
+ static void d_free(struct dentry *dentry)
+ {
+-	BUG_ON((int)dentry->d_lockref.count > 0);
++	BUG_ON((int)__lockref_read(&dentry->d_lockref) > 0);
+ 	this_cpu_dec(nr_dentry);
+ 	if (dentry->d_op && dentry->d_op->d_release)
+ 		dentry->d_op->d_release(dentry);
+@@ -597,7 +596,7 @@ repeat:
+ 		dentry->d_flags |= DCACHE_REFERENCED;
+ 	dentry_lru_add(dentry);
+ 
+-	dentry->d_lockref.count--;
++	__lockref_dec(&dentry->d_lockref);
+ 	spin_unlock(&dentry->d_lock);
+ 	return;
+ 
+@@ -652,7 +651,7 @@ int d_invalidate(struct dentry * dentry)
+ 	 * We also need to leave mountpoints alone,
+ 	 * directory or not.
+ 	 */
+-	if (dentry->d_lockref.count > 1 && dentry->d_inode) {
++	if (__lockref_read(&dentry->d_lockref) > 1 && dentry->d_inode) {
+ 		if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
+ 			spin_unlock(&dentry->d_lock);
+ 			return -EBUSY;
+@@ -668,7 +667,7 @@ EXPORT_SYMBOL(d_invalidate);
+ /* This must be called with d_lock held */
+ static inline void __dget_dlock(struct dentry *dentry)
+ {
+-	dentry->d_lockref.count++;
++	__lockref_inc(&dentry->d_lockref);
+ }
+ 
+ static inline void __dget(struct dentry *dentry)
+@@ -709,8 +708,8 @@ repeat:
+ 		goto repeat;
+ 	}
+ 	rcu_read_unlock();
+-	BUG_ON(!ret->d_lockref.count);
+-	ret->d_lockref.count++;
++	BUG_ON(!__lockref_read(&ret->d_lockref));
++	__lockref_inc(&ret->d_lockref);
+ 	spin_unlock(&ret->d_lock);
+ 	return ret;
+ }
+@@ -793,7 +792,7 @@ restart:
+ 	spin_lock(&inode->i_lock);
+ 	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+ 		spin_lock(&dentry->d_lock);
+-		if (!dentry->d_lockref.count) {
++		if (!__lockref_read(&dentry->d_lockref)) {
+ 			/*
+ 			 * inform the fs via d_prune that this dentry
+ 			 * is about to be unhashed and destroyed.
+@@ -885,7 +884,7 @@ static void shrink_dentry_list(struct list_head *list)
+ 		 * We found an inuse dentry which was not removed from
+ 		 * the LRU because of laziness during lookup. Do not free it.
+ 		 */
+-		if (dentry->d_lockref.count) {
++		if (__lockref_read(&dentry->d_lockref)) {
+ 			spin_unlock(&dentry->d_lock);
+ 			continue;
+ 		}
+@@ -931,7 +930,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
+ 	 * counts, just remove them from the LRU. Otherwise give them
+ 	 * another pass through the LRU.
+ 	 */
+-	if (dentry->d_lockref.count) {
++	if (__lockref_read(&dentry->d_lockref) > 0) {
+ 		d_lru_isolate(dentry);
+ 		spin_unlock(&dentry->d_lock);
+ 		return LRU_REMOVED;
+@@ -1269,7 +1268,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+ 	 * loop in shrink_dcache_parent() might not make any progress
+ 	 * and loop forever.
+ 	 */
+-	if (dentry->d_lockref.count) {
++	if (__lockref_read(&dentry->d_lockref)) {
+ 		dentry_lru_del(dentry);
+ 	} else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
+ 		/*
+@@ -1323,11 +1322,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+ 	struct select_data *data = _data;
+ 	enum d_walk_ret ret = D_WALK_CONTINUE;
+ 
+-	if (dentry->d_lockref.count) {
++	if (__lockref_read(&dentry->d_lockref)) {
+ 		dentry_lru_del(dentry);
+ 		if (likely(!list_empty(&dentry->d_subdirs)))
+ 			goto out;
+-		if (dentry == data->start && dentry->d_lockref.count == 1)
++		if (dentry == data->start && __lockref_read(&dentry->d_lockref) == 1)
+ 			goto out;
+ 		printk(KERN_ERR
+ 		       "BUG: Dentry %p{i=%lx,n=%s}"
+@@ -1337,7 +1336,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+ 		       dentry->d_inode ?
+ 		       dentry->d_inode->i_ino : 0UL,
+ 		       dentry->d_name.name,
+-		       dentry->d_lockref.count,
++		       __lockref_read(&dentry->d_lockref),
+ 		       dentry->d_sb->s_type->name,
+ 		       dentry->d_sb->s_id);
+ 		BUG();
+@@ -1495,7 +1494,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	 */
  	dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
  	if (name->len > DNAME_INLINE_LEN-1) {
@@ -59404,7 +59542,43 @@ index 7f3b400..9c911f2 100644
  		if (!dname) {
  			kmem_cache_free(dentry_cache, dentry); 
  			return NULL;
-@@ -3430,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -1513,7 +1512,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+ 	smp_wmb();
+ 	dentry->d_name.name = dname;
+ 
+-	dentry->d_lockref.count = 1;
++	__lockref_set(&dentry->d_lockref, 1);
+ 	dentry->d_flags = 0;
+ 	spin_lock_init(&dentry->d_lock);
+ 	seqcount_init(&dentry->d_seq);
+@@ -2276,7 +2275,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+ 				goto next;
+ 		}
+ 
+-		dentry->d_lockref.count++;
++		__lockref_inc(&dentry->d_lockref);
+ 		found = dentry;
+ 		spin_unlock(&dentry->d_lock);
+ 		break;
+@@ -2375,7 +2374,7 @@ again:
+ 	spin_lock(&dentry->d_lock);
+ 	inode = dentry->d_inode;
+ 	isdir = S_ISDIR(inode->i_mode);
+-	if (dentry->d_lockref.count == 1) {
++	if (__lockref_read(&dentry->d_lockref) == 1) {
+ 		if (!spin_trylock(&inode->i_lock)) {
+ 			spin_unlock(&dentry->d_lock);
+ 			cpu_relax();
+@@ -3314,7 +3313,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+ 
+ 		if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
+ 			dentry->d_flags |= DCACHE_GENOCIDE;
+-			dentry->d_lockref.count--;
++			__lockref_dec(&dentry->d_lockref);
+ 		}
+ 	}
+ 	return D_WALK_CONTINUE;
+@@ -3430,7 +3429,8 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -62559,10 +62733,18 @@ index b29e42f..5ea7fdf 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index bdea109..e242796 100644
+index bdea109..6e919ab 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
-@@ -330,17 +330,34 @@ int generic_permission(struct inode *inode, int mask)
+@@ -34,6 +34,7 @@
+ #include <linux/device_cgroup.h>
+ #include <linux/fs_struct.h>
+ #include <linux/posix_acl.h>
++#include <linux/hash.h>
+ #include <asm/uaccess.h>
+ 
+ #include "internal.h"
+@@ -330,17 +331,34 @@ int generic_permission(struct inode *inode, int mask)
  	if (ret != -EACCES)
  		return ret;
  
@@ -62600,7 +62782,7 @@ index bdea109..e242796 100644
  	 * Read/write DACs are always overridable.
  	 * Executable DACs are overridable when there is
  	 * at least one exec bit set.
-@@ -349,14 +366,6 @@ int generic_permission(struct inode *inode, int mask)
+@@ -349,14 +367,6 @@ int generic_permission(struct inode *inode, int mask)
  		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
  			return 0;
  
@@ -62615,7 +62797,7 @@ index bdea109..e242796 100644
  	return -EACCES;
  }
  
-@@ -822,7 +831,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -822,7 +832,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  {
  	struct dentry *dentry = link->dentry;
  	int error;
@@ -62624,7 +62806,7 @@ index bdea109..e242796 100644
  
  	BUG_ON(nd->flags & LOOKUP_RCU);
  
-@@ -843,6 +852,12 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -843,6 +853,12 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  	if (error)
  		goto out_put_nd_path;
  
@@ -62637,7 +62819,7 @@ index bdea109..e242796 100644
  	nd->last_type = LAST_BIND;
  	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
  	error = PTR_ERR(*p);
-@@ -1591,6 +1606,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
+@@ -1591,6 +1607,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
  		if (res)
  			break;
  		res = walk_component(nd, path, LOOKUP_FOLLOW);
@@ -62646,6 +62828,16 @@ index bdea109..e242796 100644
  		put_link(nd, &link, cookie);
  	} while (res > 0);
  
+@@ -1624,8 +1642,7 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
+ 
+ static inline unsigned int fold_hash(unsigned long hash)
+ {
+-	hash += hash >> (8*sizeof(int));
+-	return hash;
++	return hash_64(hash, 32);
+ }
+ 
+ #else	/* 32-bit case */
 @@ -1664,7 +1681,7 @@ EXPORT_SYMBOL(full_name_hash);
  static inline unsigned long hash_name(const char *name, unsigned int *hashp)
  {
@@ -81077,10 +81269,28 @@ index 0000000..e7ffaaf
 +
 +#endif
 diff --git a/include/linux/hash.h b/include/linux/hash.h
-index bd1754c..8240892 100644
+index bd1754c..69b7715 100644
 --- a/include/linux/hash.h
 +++ b/include/linux/hash.h
-@@ -83,7 +83,7 @@ static inline u32 hash32_ptr(const void *ptr)
+@@ -37,6 +37,9 @@ static __always_inline u64 hash_64(u64 val, unsigned int bits)
+ {
+ 	u64 hash = val;
+ 
++#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
++	hash = hash * GOLDEN_RATIO_PRIME_64;
++#else
+ 	/*  Sigh, gcc can't optimise this alone like it does for 32 bits. */
+ 	u64 n = hash;
+ 	n <<= 18;
+@@ -51,6 +54,7 @@ static __always_inline u64 hash_64(u64 val, unsigned int bits)
+ 	hash += n;
+ 	n <<= 2;
+ 	hash += n;
++#endif
+ 
+ 	/* High bits are more random, so use them. */
+ 	return hash >> (64 - bits);
+@@ -83,7 +87,7 @@ static inline u32 hash32_ptr(const void *ptr)
  struct fast_hash_ops {
  	u32 (*hash)(const void *data, u32 len, u32 seed);
  	u32 (*hash2)(const u32 *data, u32 len, u32 seed);
@@ -81596,6 +81806,47 @@ index ef95941..82db65a 100644
  /**
   * list_move - delete from one list and add as another's head
   * @list: the entry to move
+diff --git a/include/linux/lockref.h b/include/linux/lockref.h
+index 4bfde0e..d6e2e09 100644
+--- a/include/linux/lockref.h
++++ b/include/linux/lockref.h
+@@ -47,4 +47,36 @@ static inline int __lockref_is_dead(const struct lockref *l)
+ 	return ((int)l->count < 0);
+ }
+ 
++static inline unsigned int __lockref_read(struct lockref *lockref)
++{
++	return lockref->count;
++}
++
++static inline void __lockref_set(struct lockref *lockref, unsigned int count)
++{
++	lockref->count = count;
++}
++
++static inline void __lockref_inc(struct lockref *lockref)
++{
++
++#ifdef CONFIG_PAX_REFCOUNT
++	atomic_inc((atomic_t *)&lockref->count);
++#else
++	lockref->count++;
++#endif
++
++}
++
++static inline void __lockref_dec(struct lockref *lockref)
++{
++
++#ifdef CONFIG_PAX_REFCOUNT
++	atomic_dec((atomic_t *)&lockref->count);
++#else
++	lockref->count--;
++#endif
++
++}
++
+ #endif /* __LINUX_LOCKREF_H */
 diff --git a/include/linux/math64.h b/include/linux/math64.h
 index c45c089..298841c 100644
 --- a/include/linux/math64.h
@@ -87904,7 +88155,7 @@ index c44bff8..a3c5876 100644
  			else
  				new_fs = fs;
 diff --git a/kernel/futex.c b/kernel/futex.c
-index e3087af..8e3b90f 100644
+index e3087af..4730710 100644
 --- a/kernel/futex.c
 +++ b/kernel/futex.c
 @@ -54,6 +54,7 @@
@@ -87954,7 +88205,15 @@ index e3087af..8e3b90f 100644
  
  	pagefault_disable();
  	ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
-@@ -3019,6 +3025,7 @@ static void __init futex_detect_cmpxchg(void)
+@@ -2614,6 +2620,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	 * shared futexes. We need to compare the keys:
+ 	 */
+ 	if (match_futex(&q.key, &key2)) {
++		queue_unlock(hb);
+ 		ret = -EINVAL;
+ 		goto out_put_keys;
+ 	}
+@@ -3019,6 +3026,7 @@ static void __init futex_detect_cmpxchg(void)
  {
  #ifndef CONFIG_HAVE_FUTEX_CMPXCHG
  	u32 curval;
@@ -87962,7 +88221,7 @@ index e3087af..8e3b90f 100644
  
  	/*
  	 * This will fail and we want it. Some arch implementations do
-@@ -3030,8 +3037,11 @@ static void __init futex_detect_cmpxchg(void)
+@@ -3030,8 +3038,11 @@ static void __init futex_detect_cmpxchg(void)
  	 * implementation, the non-functional ones will return
  	 * -ENOSYS.
  	 */
@@ -88196,10 +88455,26 @@ index 3127ad5..159d880 100644
  		return -ENOMEM;
  	reset_iter(iter, 0);
 diff --git a/kernel/kcmp.c b/kernel/kcmp.c
-index e30ac0f..3528cac 100644
+index e30ac0f..a7fcafb 100644
 --- a/kernel/kcmp.c
 +++ b/kernel/kcmp.c
-@@ -99,6 +99,10 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
+@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int type)
+  */
+ static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type)
+ {
+-	long ret;
++	long t1, t2;
+ 
+-	ret = kptr_obfuscate((long)v1, type) - kptr_obfuscate((long)v2, type);
++	t1 = kptr_obfuscate((long)v1, type);
++	t2 = kptr_obfuscate((long)v2, type);
+ 
+-	return (ret < 0) | ((ret > 0) << 1);
++	return (t1 < t2) | ((t1 > t2) << 1);
+ }
+ 
+ /* The caller must have pinned the task */
+@@ -99,6 +100,10 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
  	struct task_struct *task1, *task2;
  	int ret;
  
@@ -91888,10 +92163,71 @@ index 7c7964c..2a0d412 100644
  		update_vsyscall_tz();
  		if (firsttime) {
 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
-index fe75444..190c528 100644
+index fe75444..b8a1463 100644
 --- a/kernel/time/alarmtimer.c
 +++ b/kernel/time/alarmtimer.c
-@@ -811,7 +811,7 @@ static int __init alarmtimer_init(void)
+@@ -464,18 +464,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
+ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ 							ktime_t now)
+ {
++	unsigned long flags;
+ 	struct k_itimer *ptr = container_of(alarm, struct k_itimer,
+ 						it.alarm.alarmtimer);
+-	if (posix_timer_event(ptr, 0) != 0)
+-		ptr->it_overrun++;
++	enum alarmtimer_restart result = ALARMTIMER_NORESTART;
++
++	spin_lock_irqsave(&ptr->it_lock, flags);
++	if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
++		if (posix_timer_event(ptr, 0) != 0)
++			ptr->it_overrun++;
++	}
+ 
+ 	/* Re-add periodic timers */
+ 	if (ptr->it.alarm.interval.tv64) {
+ 		ptr->it_overrun += alarm_forward(alarm, now,
+ 						ptr->it.alarm.interval);
+-		return ALARMTIMER_RESTART;
++		result = ALARMTIMER_RESTART;
+ 	}
+-	return ALARMTIMER_NORESTART;
++	spin_unlock_irqrestore(&ptr->it_lock, flags);
++
++	return result;
+ }
+ 
+ /**
+@@ -541,18 +549,22 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+  * @new_timer: k_itimer pointer
+  * @cur_setting: itimerspec data to fill
+  *
+- * Copies the itimerspec data out from the k_itimer
++ * Copies out the current itimerspec data
+  */
+ static void alarm_timer_get(struct k_itimer *timr,
+ 				struct itimerspec *cur_setting)
+ {
+-	memset(cur_setting, 0, sizeof(struct itimerspec));
++	ktime_t relative_expiry_time =
++		alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
+ 
+-	cur_setting->it_interval =
+-			ktime_to_timespec(timr->it.alarm.interval);
+-	cur_setting->it_value =
+-		ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
+-	return;
++	if (ktime_to_ns(relative_expiry_time) > 0) {
++		cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
++	} else {
++		cur_setting->it_value.tv_sec = 0;
++		cur_setting->it_value.tv_nsec = 0;
++	}
++
++	cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
+ }
+ 
+ /**
+@@ -811,7 +823,7 @@ static int __init alarmtimer_init(void)
  	struct platform_device *pdev;
  	int error = 0;
  	int i;
@@ -92675,6 +93011,20 @@ index b4defde..f092808 100644
  	}
  
  	spin_unlock_irq(&pool->lock);
+diff --git a/lib/Kconfig b/lib/Kconfig
+index 991c98b..88061cf 100644
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -51,6 +51,9 @@ config PERCPU_RWSEM
+ config ARCH_USE_CMPXCHG_LOCKREF
+ 	bool
+ 
++config ARCH_HAS_FAST_MULTIPLIER
++	bool
++
+ config CRC_CCITT
+ 	tristate "CRC-CCITT functions"
+ 	help
 diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
 index a48abea..e108def 100644
 --- a/lib/Kconfig.debug
@@ -92755,10 +93105,25 @@ index 48140e3..de854e5 100644
  
  ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
 diff --git a/lib/assoc_array.c b/lib/assoc_array.c
-index c0b1007..ae146f0 100644
+index c0b1007..2404d03 100644
 --- a/lib/assoc_array.c
 +++ b/lib/assoc_array.c
-@@ -1735,7 +1735,7 @@ ascend_old_tree:
+@@ -1723,11 +1723,13 @@ ascend_old_tree:
+ 		shortcut = assoc_array_ptr_to_shortcut(ptr);
+ 		slot = shortcut->parent_slot;
+ 		cursor = shortcut->back_pointer;
++		if (!cursor)
++			goto gc_complete;
+ 	} else {
+ 		slot = node->parent_slot;
+ 		cursor = ptr;
+ 	}
+-	BUG_ON(!ptr);
++	BUG_ON(!cursor);
+ 	node = assoc_array_ptr_to_node(cursor);
+ 	slot++;
+ 	goto continue_node;
+@@ -1735,7 +1737,7 @@ ascend_old_tree:
  gc_complete:
  	edit->set[0].to = new_root;
  	assoc_array_apply_edit(edit);
@@ -92925,6 +93290,28 @@ index fea973f..386626f 100644
  	.hash  = jhash,
  	.hash2 = jhash2,
  };
+diff --git a/lib/hweight.c b/lib/hweight.c
+index b7d81ba..9a5c1f2 100644
+--- a/lib/hweight.c
++++ b/lib/hweight.c
+@@ -11,7 +11,7 @@
+ 
+ unsigned int __sw_hweight32(unsigned int w)
+ {
+-#ifdef ARCH_HAS_FAST_MULTIPLIER
++#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+ 	w -= (w >> 1) & 0x55555555;
+ 	w =  (w & 0x33333333) + ((w >> 2) & 0x33333333);
+ 	w =  (w + (w >> 4)) & 0x0f0f0f0f;
+@@ -49,7 +49,7 @@ unsigned long __sw_hweight64(__u64 w)
+ 	return __sw_hweight32((unsigned int)(w >> 32)) +
+ 	       __sw_hweight32((unsigned int)w);
+ #elif BITS_PER_LONG == 64
+-#ifdef ARCH_HAS_FAST_MULTIPLIER
++#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+ 	w -= (w >> 1) & 0x5555555555555555ul;
+ 	w =  (w & 0x3333333333333333ul) + ((w >> 2) & 0x3333333333333333ul);
+ 	w =  (w + (w >> 4)) & 0x0f0f0f0f0f0f0f0ful;
 diff --git a/lib/inflate.c b/lib/inflate.c
 index 013a761..c28f3fc 100644
 --- a/lib/inflate.c
@@ -93211,6 +93598,98 @@ index c24c2f7..f0296f4 100644
 +	pax_close_kernel();
 +}
 +EXPORT_SYMBOL(pax_list_del_rcu);
+diff --git a/lib/lockref.c b/lib/lockref.c
+index f07a40d..0a445a7 100644
+--- a/lib/lockref.c
++++ b/lib/lockref.c
+@@ -49,13 +49,13 @@
+ void lockref_get(struct lockref *lockref)
+ {
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 	,
+ 		return;
+ 	);
+ 
+ 	spin_lock(&lockref->lock);
+-	lockref->count++;
++	__lockref_inc(lockref);
+ 	spin_unlock(&lockref->lock);
+ }
+ EXPORT_SYMBOL(lockref_get);
+@@ -70,7 +70,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+ 	int retval;
+ 
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 		if (!old.count)
+ 			return 0;
+ 	,
+@@ -80,7 +80,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	retval = 0;
+ 	if (lockref->count) {
+-		lockref->count++;
++		__lockref_inc(lockref);
+ 		retval = 1;
+ 	}
+ 	spin_unlock(&lockref->lock);
+@@ -97,7 +97,7 @@ EXPORT_SYMBOL(lockref_get_not_zero);
+ int lockref_get_or_lock(struct lockref *lockref)
+ {
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 		if (!old.count)
+ 			break;
+ 	,
+@@ -107,7 +107,7 @@ int lockref_get_or_lock(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	if (!lockref->count)
+ 		return 0;
+-	lockref->count++;
++	__lockref_inc(lockref);
+ 	spin_unlock(&lockref->lock);
+ 	return 1;
+ }
+@@ -121,7 +121,7 @@ EXPORT_SYMBOL(lockref_get_or_lock);
+ int lockref_put_or_lock(struct lockref *lockref)
+ {
+ 	CMPXCHG_LOOP(
+-		new.count--;
++		__lockref_dec(&new);
+ 		if (old.count <= 1)
+ 			break;
+ 	,
+@@ -131,7 +131,7 @@ int lockref_put_or_lock(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	if (lockref->count <= 1)
+ 		return 0;
+-	lockref->count--;
++	__lockref_dec(lockref);
+ 	spin_unlock(&lockref->lock);
+ 	return 1;
+ }
+@@ -158,7 +158,7 @@ int lockref_get_not_dead(struct lockref *lockref)
+ 	int retval;
+ 
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 		if ((int)old.count < 0)
+ 			return 0;
+ 	,
+@@ -168,7 +168,7 @@ int lockref_get_not_dead(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	retval = 0;
+ 	if ((int) lockref->count >= 0) {
+-		lockref->count++;
++		__lockref_inc(lockref);
+ 		retval = 1;
+ 	}
+ 	spin_unlock(&lockref->lock);
 diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
 index 963b703..438bc51 100644
 --- a/lib/percpu-refcount.c
@@ -93277,6 +93756,22 @@ index 0922579..9d7adb9 100644
 +	printk("%lu pages hwpoisoned\n", atomic_long_read_unchecked(&num_poisoned_pages));
  #endif
  }
+diff --git a/lib/string.c b/lib/string.c
+index e5878de..315fad2 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -789,9 +789,9 @@ void *memchr_inv(const void *start, int c, size_t bytes)
+ 		return check_bytes8(start, value, bytes);
+ 
+ 	value64 = value;
+-#if defined(ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
++#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
+ 	value64 *= 0x0101010101010101;
+-#elif defined(ARCH_HAS_FAST_MULTIPLIER)
++#elif defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER)
+ 	value64 *= 0x01010101;
+ 	value64 |= value64 << 32;
+ #else
 diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
 index bb2b201..46abaf9 100644
 --- a/lib/strncpy_from_user.c
diff --git a/3.16.2/0000_README b/3.16.2/0000_README
index cc45d50..f31f3fb 100644
--- a/3.16.2/0000_README
+++ b/3.16.2/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.16.2-201409112237.patch
+Patch:	4420_grsecurity-3.0-3.16.2-201409141907.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.16.2/4420_grsecurity-3.0-3.16.2-201409112237.patch b/3.16.2/4420_grsecurity-3.0-3.16.2-201409141907.patch
index 2e227af..b3502f0 100644
--- a/3.16.2/4420_grsecurity-3.0-3.16.2-201409112237.patch
+++ b/3.16.2/4420_grsecurity-3.0-3.16.2-201409141907.patch
@@ -785,7 +785,7 @@ index ee78eba..a06b48d 100644
  Daniel Borkmann <dborkman@redhat.com>
 -Alexei Starovoitov <ast@plumgrid.com>
 diff --git a/Makefile b/Makefile
-index c261752..7b9958b 100644
+index c261752..e1d82656 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -303,8 +303,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -887,6 +887,15 @@ index c261752..7b9958b 100644
  ifdef CONFIG_READABLE_ASM
  # Disable optimizations that make assembler listings hard to read.
  # reorder blocks reorders the control in the function
+@@ -692,7 +762,7 @@ KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
+ 
+ ifdef CONFIG_DEBUG_INFO
+ KBUILD_CFLAGS	+= -g
+-KBUILD_AFLAGS	+= -Wa,-gdwarf-2
++KBUILD_AFLAGS	+= -Wa,--gdwarf-2
+ endif
+ 
+ ifdef CONFIG_DEBUG_INFO_REDUCED
 @@ -839,7 +909,7 @@ export mod_sign_cmd
  
  
@@ -1372,7 +1381,7 @@ index 290f02ee..a639059 100644
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
 diff --git a/arch/arm/include/asm/atomic.h b/arch/arm/include/asm/atomic.h
-index 3040359..89b3dfc 100644
+index 3040359..cf3bab0 100644
 --- a/arch/arm/include/asm/atomic.h
 +++ b/arch/arm/include/asm/atomic.h
 @@ -18,17 +18,35 @@
@@ -1903,7 +1912,7 @@ index 3040359..89b3dfc 100644
  "	sbc	%R0, %R0, %R4\n"
  "	strexd	%1, %0, %H0, [%3]\n"
  "	teq	%1, #0\n"
-@@ -371,16 +731,29 @@ static inline long long atomic64_sub_return(long long i, atomic64_t *v)
+@@ -371,10 +731,25 @@ static inline long long atomic64_sub_return(long long i, atomic64_t *v)
  	__asm__ __volatile__("@ atomic64_sub_return\n"
  "1:	ldrexd	%0, %H0, [%3]\n"
  "	subs	%Q0, %Q0, %Q4\n"
@@ -1930,13 +1939,7 @@ index 3040359..89b3dfc 100644
  	: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter), "r" (i)
  	: "cc");
- 
--	smp_mb();
--
- 	return result;
- }
- 
-@@ -410,6 +783,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
+@@ -410,6 +785,31 @@ static inline long long atomic64_cmpxchg(atomic64_t *ptr, long long old,
  	return oldval;
  }
  
@@ -1968,7 +1971,7 @@ index 3040359..89b3dfc 100644
  static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
  {
  	long long result;
-@@ -435,21 +833,35 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
+@@ -435,21 +835,35 @@ static inline long long atomic64_xchg(atomic64_t *ptr, long long new)
  static inline long long atomic64_dec_if_positive(atomic64_t *v)
  {
  	long long result;
@@ -2010,7 +2013,7 @@ index 3040359..89b3dfc 100644
  	: "=&r" (result), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter)
  	: "cc");
-@@ -473,13 +885,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -473,13 +887,25 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
  "	teq	%0, %5\n"
  "	teqeq	%H0, %H5\n"
  "	moveq	%1, #0\n"
@@ -2039,7 +2042,7 @@ index 3040359..89b3dfc 100644
  	: "=&r" (val), "+r" (ret), "=&r" (tmp), "+Qo" (v->counter)
  	: "r" (&v->counter), "r" (u), "r" (a)
  	: "cc");
-@@ -492,10 +916,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
+@@ -492,10 +918,13 @@ static inline int atomic64_add_unless(atomic64_t *v, long long a, long long u)
  
  #define atomic64_add_negative(a, v)	(atomic64_add_return((a), (v)) < 0)
  #define atomic64_inc(v)			atomic64_add(1LL, (v))
@@ -5575,6 +5578,17 @@ index 2f3abcf..e63c7fa 100644
  	help
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
+diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
+index f37238f..810b95f 100644
+--- a/arch/ia64/Makefile
++++ b/arch/ia64/Makefile
+@@ -99,5 +99,6 @@ endef
+ archprepare: make_nr_irqs_h FORCE
+ PHONY += make_nr_irqs_h FORCE
+ 
++make_nr_irqs_h: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
+ make_nr_irqs_h: FORCE
+ 	$(Q)$(MAKE) $(build)=arch/ia64/kernel include/generated/nr-irqs.h
 diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
 index 0f8bf48..40ea950 100644
 --- a/arch/ia64/include/asm/atomic.h
@@ -12766,10 +12780,18 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 27adfd9..bc3551d 100644
+index 27adfd9..2362ac6 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
-@@ -128,7 +128,7 @@ config X86
+@@ -22,6 +22,7 @@ config X86_64
+ config X86
+ 	def_bool y
+ 	select ARCH_HAS_DEBUG_STRICT_USER_COPY_CHECKS
++	select ARCH_HAS_FAST_MULTIPLIER
+ 	select ARCH_MIGHT_HAVE_PC_PARPORT
+ 	select ARCH_MIGHT_HAVE_PC_SERIO
+ 	select HAVE_AOUT if X86_32
+@@ -128,7 +129,7 @@ config X86
  	select RTC_LIB
  	select HAVE_DEBUG_STACKOVERFLOW
  	select HAVE_IRQ_EXIT_ON_IRQ_STACK if X86_64
@@ -12778,7 +12800,7 @@ index 27adfd9..bc3551d 100644
  	select GENERIC_CPU_AUTOPROBE
  	select HAVE_ARCH_AUDITSYSCALL
  	select ARCH_SUPPORTS_ATOMIC_RMW
-@@ -253,7 +253,7 @@ config X86_HT
+@@ -253,7 +254,7 @@ config X86_HT
  
  config X86_32_LAZY_GS
  	def_bool y
@@ -12787,7 +12809,7 @@ index 27adfd9..bc3551d 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -549,6 +549,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -549,6 +550,7 @@ config SCHED_OMIT_FRAME_POINTER
  
  menuconfig HYPERVISOR_GUEST
  	bool "Linux guest support"
@@ -12795,7 +12817,7 @@ index 27adfd9..bc3551d 100644
  	---help---
  	  Say Y here to enable options for running Linux under various hyper-
  	  visors. This option enables basic hypervisor detection and platform
-@@ -1076,6 +1077,7 @@ choice
+@@ -1076,6 +1078,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -12803,7 +12825,7 @@ index 27adfd9..bc3551d 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1112,6 +1114,7 @@ config NOHIGHMEM
+@@ -1112,6 +1115,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -12811,7 +12833,7 @@ index 27adfd9..bc3551d 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1164,7 +1167,7 @@ config PAGE_OFFSET
+@@ -1164,7 +1168,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -12820,7 +12842,7 @@ index 27adfd9..bc3551d 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1578,6 +1581,7 @@ source kernel/Kconfig.hz
+@@ -1578,6 +1582,7 @@ source kernel/Kconfig.hz
  
  config KEXEC
  	bool "kexec system call"
@@ -12828,7 +12850,7 @@ index 27adfd9..bc3551d 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1728,7 +1732,9 @@ config X86_NEED_RELOCS
+@@ -1728,7 +1733,9 @@ config X86_NEED_RELOCS
  
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned"
@@ -12839,7 +12861,7 @@ index 27adfd9..bc3551d 100644
  	range 0x2000 0x1000000 if X86_32
  	range 0x200000 0x1000000 if X86_64
  	---help---
-@@ -1811,6 +1817,7 @@ config COMPAT_VDSO
+@@ -1811,6 +1818,7 @@ config COMPAT_VDSO
  	def_bool n
  	prompt "Disable the 32-bit vDSO (needed for glibc 2.3.3)"
  	depends on X86_32 || IA32_EMULATION
@@ -16235,7 +16257,7 @@ index 5c7198c..44180b5 100644
  
  #define smp_load_acquire(p)						\
 diff --git a/arch/x86/include/asm/bitops.h b/arch/x86/include/asm/bitops.h
-index afcd35d..141b32d 100644
+index afcd35d..d01b118 100644
 --- a/arch/x86/include/asm/bitops.h
 +++ b/arch/x86/include/asm/bitops.h
 @@ -50,7 +50,7 @@
@@ -16319,6 +16341,15 @@ index afcd35d..141b32d 100644
  {
  	int bitpos = -1;
  	/*
+@@ -497,8 +497,6 @@ static __always_inline int fls64(__u64 x)
+ 
+ #include <asm-generic/bitops/sched.h>
+ 
+-#define ARCH_HAS_FAST_MULTIPLIER 1
+-
+ #include <asm/arch_hweight.h>
+ 
+ #include <asm-generic/bitops/const_hweight.h>
 diff --git a/arch/x86/include/asm/boot.h b/arch/x86/include/asm/boot.h
 index 4fa687a..60f2d39 100644
 --- a/arch/x86/include/asm/boot.h
@@ -62053,10 +62084,141 @@ index a93f7e6..d58bcbe 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 06f6585..65499d1 100644
+index 06f6585..c9c5b6c 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
-@@ -1445,7 +1445,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -106,8 +106,7 @@ static inline struct hlist_bl_head *d_hash(const struct dentry *parent,
+ 					unsigned int hash)
+ {
+ 	hash += (unsigned long) parent / L1_CACHE_BYTES;
+-	hash = hash + (hash >> d_hash_shift);
+-	return dentry_hashtable + (hash & d_hash_mask);
++	return dentry_hashtable + hash_32(hash, d_hash_shift);
+ }
+ 
+ /* Statistics gathering. */
+@@ -479,7 +478,7 @@ static void __dentry_kill(struct dentry *dentry)
+ 	 * dentry_iput drops the locks, at which point nobody (except
+ 	 * transient RCU lookups) can reach this dentry.
+ 	 */
+-	BUG_ON((int)dentry->d_lockref.count > 0);
++	BUG_ON((int)__lockref_read(&dentry->d_lockref) > 0);
+ 	this_cpu_dec(nr_dentry);
+ 	if (dentry->d_op && dentry->d_op->d_release)
+ 		dentry->d_op->d_release(dentry);
+@@ -532,7 +531,7 @@ static inline struct dentry *lock_parent(struct dentry *dentry)
+ 	struct dentry *parent = dentry->d_parent;
+ 	if (IS_ROOT(dentry))
+ 		return NULL;
+-	if (unlikely((int)dentry->d_lockref.count < 0))
++	if (unlikely((int)__lockref_read(&dentry->d_lockref) < 0))
+ 		return NULL;
+ 	if (likely(spin_trylock(&parent->d_lock)))
+ 		return parent;
+@@ -609,7 +608,7 @@ repeat:
+ 		dentry->d_flags |= DCACHE_REFERENCED;
+ 	dentry_lru_add(dentry);
+ 
+-	dentry->d_lockref.count--;
++	__lockref_dec(&dentry->d_lockref);
+ 	spin_unlock(&dentry->d_lock);
+ 	return;
+ 
+@@ -664,7 +663,7 @@ int d_invalidate(struct dentry * dentry)
+ 	 * We also need to leave mountpoints alone,
+ 	 * directory or not.
+ 	 */
+-	if (dentry->d_lockref.count > 1 && dentry->d_inode) {
++	if (__lockref_read(&dentry->d_lockref) > 1 && dentry->d_inode) {
+ 		if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
+ 			spin_unlock(&dentry->d_lock);
+ 			return -EBUSY;
+@@ -680,7 +679,7 @@ EXPORT_SYMBOL(d_invalidate);
+ /* This must be called with d_lock held */
+ static inline void __dget_dlock(struct dentry *dentry)
+ {
+-	dentry->d_lockref.count++;
++	__lockref_inc(&dentry->d_lockref);
+ }
+ 
+ static inline void __dget(struct dentry *dentry)
+@@ -721,8 +720,8 @@ repeat:
+ 		goto repeat;
+ 	}
+ 	rcu_read_unlock();
+-	BUG_ON(!ret->d_lockref.count);
+-	ret->d_lockref.count++;
++	BUG_ON(!__lockref_read(&ret->d_lockref));
++	__lockref_inc(&ret->d_lockref);
+ 	spin_unlock(&ret->d_lock);
+ 	return ret;
+ }
+@@ -805,7 +804,7 @@ restart:
+ 	spin_lock(&inode->i_lock);
+ 	hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
+ 		spin_lock(&dentry->d_lock);
+-		if (!dentry->d_lockref.count) {
++		if (!__lockref_read(&dentry->d_lockref)) {
+ 			/*
+ 			 * inform the fs via d_prune that this dentry
+ 			 * is about to be unhashed and destroyed.
+@@ -848,7 +847,7 @@ static void shrink_dentry_list(struct list_head *list)
+ 		 * We found an inuse dentry which was not removed from
+ 		 * the LRU because of laziness during lookup. Do not free it.
+ 		 */
+-		if ((int)dentry->d_lockref.count > 0) {
++		if ((int)__lockref_read(&dentry->d_lockref) > 0) {
+ 			spin_unlock(&dentry->d_lock);
+ 			if (parent)
+ 				spin_unlock(&parent->d_lock);
+@@ -886,8 +885,8 @@ static void shrink_dentry_list(struct list_head *list)
+ 		dentry = parent;
+ 		while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) {
+ 			parent = lock_parent(dentry);
+-			if (dentry->d_lockref.count != 1) {
+-				dentry->d_lockref.count--;
++			if (__lockref_read(&dentry->d_lockref) != 1) {
++				__lockref_inc(&dentry->d_lockref);
+ 				spin_unlock(&dentry->d_lock);
+ 				if (parent)
+ 					spin_unlock(&parent->d_lock);
+@@ -927,7 +926,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
+ 	 * counts, just remove them from the LRU. Otherwise give them
+ 	 * another pass through the LRU.
+ 	 */
+-	if (dentry->d_lockref.count) {
++	if (__lockref_read(&dentry->d_lockref) > 0) {
+ 		d_lru_isolate(dentry);
+ 		spin_unlock(&dentry->d_lock);
+ 		return LRU_REMOVED;
+@@ -1262,7 +1261,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+ 	} else {
+ 		if (dentry->d_flags & DCACHE_LRU_LIST)
+ 			d_lru_del(dentry);
+-		if (!dentry->d_lockref.count) {
++		if (!__lockref_read(&dentry->d_lockref)) {
+ 			d_shrink_add(dentry, &data->dispose);
+ 			data->found++;
+ 		}
+@@ -1310,7 +1309,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
+ 		return D_WALK_CONTINUE;
+ 
+ 	/* root with refcount 1 is fine */
+-	if (dentry == _data && dentry->d_lockref.count == 1)
++	if (dentry == _data && __lockref_read(&dentry->d_lockref) == 1)
+ 		return D_WALK_CONTINUE;
+ 
+ 	printk(KERN_ERR "BUG: Dentry %p{i=%lx,n=%pd} "
+@@ -1319,7 +1318,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
+ 		       dentry->d_inode ?
+ 		       dentry->d_inode->i_ino : 0UL,
+ 		       dentry,
+-		       dentry->d_lockref.count,
++		       __lockref_read(&dentry->d_lockref),
+ 		       dentry->d_sb->s_type->name,
+ 		       dentry->d_sb->s_id);
+ 	WARN_ON(1);
+@@ -1445,7 +1444,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	 */
  	dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
  	if (name->len > DNAME_INLINE_LEN-1) {
@@ -62065,7 +62227,34 @@ index 06f6585..65499d1 100644
  		if (!dname) {
  			kmem_cache_free(dentry_cache, dentry); 
  			return NULL;
-@@ -2402,7 +2402,7 @@ void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
+@@ -1463,7 +1462,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+ 	smp_wmb();
+ 	dentry->d_name.name = dname;
+ 
+-	dentry->d_lockref.count = 1;
++	__lockref_set(&dentry->d_lockref, 1);
+ 	dentry->d_flags = 0;
+ 	spin_lock_init(&dentry->d_lock);
+ 	seqcount_init(&dentry->d_seq);
+@@ -2226,7 +2225,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+ 				goto next;
+ 		}
+ 
+-		dentry->d_lockref.count++;
++		__lockref_inc(&dentry->d_lockref);
+ 		found = dentry;
+ 		spin_unlock(&dentry->d_lock);
+ 		break;
+@@ -2325,7 +2324,7 @@ again:
+ 	spin_lock(&dentry->d_lock);
+ 	inode = dentry->d_inode;
+ 	isdir = S_ISDIR(inode->i_mode);
+-	if (dentry->d_lockref.count == 1) {
++	if (__lockref_read(&dentry->d_lockref) == 1) {
+ 		if (!spin_trylock(&inode->i_lock)) {
+ 			spin_unlock(&dentry->d_lock);
+ 			cpu_relax();
+@@ -2402,7 +2401,7 @@ void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
  }
  EXPORT_SYMBOL(dentry_update_name_case);
  
@@ -62074,7 +62263,7 @@ index 06f6585..65499d1 100644
  {
  	if (dname_external(target)) {
  		if (dname_external(dentry)) {
-@@ -2430,7 +2430,7 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
+@@ -2430,7 +2429,7 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
  					target->d_name.len + 1);
  			target->d_name.name = dentry->d_name.name;
  			dentry->d_name.name = dentry->d_iname;
@@ -62083,7 +62272,7 @@ index 06f6585..65499d1 100644
  			/*
  			 * Both are internal.
  			 */
-@@ -2440,6 +2440,14 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
+@@ -2440,6 +2439,14 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
  				swap(((long *) &dentry->d_iname)[i],
  				     ((long *) &target->d_iname)[i]);
  			}
@@ -62098,7 +62287,7 @@ index 06f6585..65499d1 100644
  		}
  	}
  	swap(dentry->d_name.len, target->d_name.len);
-@@ -2540,7 +2548,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
+@@ -2540,7 +2547,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
  	list_del(&target->d_u.d_child);
  
  	/* Switch the names.. */
@@ -62107,7 +62296,7 @@ index 06f6585..65499d1 100644
  	swap(dentry->d_name.hash, target->d_name.hash);
  
  	/* ... and switch the parents */
-@@ -2679,7 +2687,7 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
+@@ -2679,7 +2686,7 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
  
  	dparent = dentry->d_parent;
  
@@ -62116,7 +62305,16 @@ index 06f6585..65499d1 100644
  	swap(dentry->d_name.hash, anon->d_name.hash);
  
  	dentry->d_parent = dentry;
-@@ -3413,7 +3421,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3297,7 +3304,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+ 
+ 		if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
+ 			dentry->d_flags |= DCACHE_GENOCIDE;
+-			dentry->d_lockref.count--;
++			__lockref_dec(&dentry->d_lockref);
+ 		}
+ 	}
+ 	return D_WALK_CONTINUE;
+@@ -3413,7 +3420,8 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -65411,10 +65609,18 @@ index d55297f..f5b28c5 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index 9eb787e..5f520b67 100644
+index 9eb787e..2de9500 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
-@@ -330,17 +330,32 @@ int generic_permission(struct inode *inode, int mask)
+@@ -34,6 +34,7 @@
+ #include <linux/device_cgroup.h>
+ #include <linux/fs_struct.h>
+ #include <linux/posix_acl.h>
++#include <linux/hash.h>
+ #include <asm/uaccess.h>
+ 
+ #include "internal.h"
+@@ -330,17 +331,32 @@ int generic_permission(struct inode *inode, int mask)
  	if (ret != -EACCES)
  		return ret;
  
@@ -65451,7 +65657,7 @@ index 9eb787e..5f520b67 100644
  	 * Read/write DACs are always overridable.
  	 * Executable DACs are overridable when there is
  	 * at least one exec bit set.
-@@ -349,14 +364,6 @@ int generic_permission(struct inode *inode, int mask)
+@@ -349,14 +365,6 @@ int generic_permission(struct inode *inode, int mask)
  		if (capable_wrt_inode_uidgid(inode, CAP_DAC_OVERRIDE))
  			return 0;
  
@@ -65466,7 +65672,7 @@ index 9eb787e..5f520b67 100644
  	return -EACCES;
  }
  EXPORT_SYMBOL(generic_permission);
-@@ -824,7 +831,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -824,7 +832,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  {
  	struct dentry *dentry = link->dentry;
  	int error;
@@ -65475,7 +65681,7 @@ index 9eb787e..5f520b67 100644
  
  	BUG_ON(nd->flags & LOOKUP_RCU);
  
-@@ -845,6 +852,12 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -845,6 +853,12 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  	if (error)
  		goto out_put_nd_path;
  
@@ -65488,7 +65694,7 @@ index 9eb787e..5f520b67 100644
  	nd->last_type = LAST_BIND;
  	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
  	error = PTR_ERR(*p);
-@@ -1596,6 +1609,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
+@@ -1596,6 +1610,8 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
  		if (res)
  			break;
  		res = walk_component(nd, path, LOOKUP_FOLLOW);
@@ -65497,6 +65703,16 @@ index 9eb787e..5f520b67 100644
  		put_link(nd, &link, cookie);
  	} while (res > 0);
  
+@@ -1629,8 +1645,7 @@ static inline int nested_symlink(struct path *path, struct nameidata *nd)
+ 
+ static inline unsigned int fold_hash(unsigned long hash)
+ {
+-	hash += hash >> (8*sizeof(int));
+-	return hash;
++	return hash_64(hash, 32);
+ }
+ 
+ #else	/* 32-bit case */
 @@ -1669,7 +1684,7 @@ EXPORT_SYMBOL(full_name_hash);
  static inline unsigned long hash_name(const char *name, unsigned int *hashp)
  {
@@ -84466,10 +84682,28 @@ index 0000000..e7ffaaf
 +
 +#endif
 diff --git a/include/linux/hash.h b/include/linux/hash.h
-index bd1754c..8240892 100644
+index bd1754c..69b7715 100644
 --- a/include/linux/hash.h
 +++ b/include/linux/hash.h
-@@ -83,7 +83,7 @@ static inline u32 hash32_ptr(const void *ptr)
+@@ -37,6 +37,9 @@ static __always_inline u64 hash_64(u64 val, unsigned int bits)
+ {
+ 	u64 hash = val;
+ 
++#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
++	hash = hash * GOLDEN_RATIO_PRIME_64;
++#else
+ 	/*  Sigh, gcc can't optimise this alone like it does for 32 bits. */
+ 	u64 n = hash;
+ 	n <<= 18;
+@@ -51,6 +54,7 @@ static __always_inline u64 hash_64(u64 val, unsigned int bits)
+ 	hash += n;
+ 	n <<= 2;
+ 	hash += n;
++#endif
+ 
+ 	/* High bits are more random, so use them. */
+ 	return hash >> (64 - bits);
+@@ -83,7 +87,7 @@ static inline u32 hash32_ptr(const void *ptr)
  struct fast_hash_ops {
  	u32 (*hash)(const void *data, u32 len, u32 seed);
  	u32 (*hash2)(const u32 *data, u32 len, u32 seed);
@@ -85001,6 +85235,47 @@ index ef95941..82db65a 100644
  /**
   * list_move - delete from one list and add as another's head
   * @list: the entry to move
+diff --git a/include/linux/lockref.h b/include/linux/lockref.h
+index 4bfde0e..d6e2e09 100644
+--- a/include/linux/lockref.h
++++ b/include/linux/lockref.h
+@@ -47,4 +47,36 @@ static inline int __lockref_is_dead(const struct lockref *l)
+ 	return ((int)l->count < 0);
+ }
+ 
++static inline unsigned int __lockref_read(struct lockref *lockref)
++{
++	return lockref->count;
++}
++
++static inline void __lockref_set(struct lockref *lockref, unsigned int count)
++{
++	lockref->count = count;
++}
++
++static inline void __lockref_inc(struct lockref *lockref)
++{
++
++#ifdef CONFIG_PAX_REFCOUNT
++	atomic_inc((atomic_t *)&lockref->count);
++#else
++	lockref->count++;
++#endif
++
++}
++
++static inline void __lockref_dec(struct lockref *lockref)
++{
++
++#ifdef CONFIG_PAX_REFCOUNT
++	atomic_dec((atomic_t *)&lockref->count);
++#else
++	lockref->count--;
++#endif
++
++}
++
+ #endif /* __LINUX_LOCKREF_H */
 diff --git a/include/linux/math64.h b/include/linux/math64.h
 index c45c089..298841c 100644
 --- a/include/linux/math64.h
@@ -91425,7 +91700,7 @@ index 6a13c46..a623c8e 100644
  			else
  				new_fs = fs;
 diff --git a/kernel/futex.c b/kernel/futex.c
-index b632b5f..ca00da9 100644
+index b632b5f..0aa434d 100644
 --- a/kernel/futex.c
 +++ b/kernel/futex.c
 @@ -202,7 +202,7 @@ struct futex_pi_state {
@@ -91467,7 +91742,15 @@ index b632b5f..ca00da9 100644
  
  	pagefault_disable();
  	ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
-@@ -3033,6 +3038,7 @@ static void __init futex_detect_cmpxchg(void)
+@@ -2628,6 +2633,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	 * shared futexes. We need to compare the keys:
+ 	 */
+ 	if (match_futex(&q.key, &key2)) {
++		queue_unlock(hb);
+ 		ret = -EINVAL;
+ 		goto out_put_keys;
+ 	}
+@@ -3033,6 +3039,7 @@ static void __init futex_detect_cmpxchg(void)
  {
  #ifndef CONFIG_HAVE_FUTEX_CMPXCHG
  	u32 curval;
@@ -91475,7 +91758,7 @@ index b632b5f..ca00da9 100644
  
  	/*
  	 * This will fail and we want it. Some arch implementations do
-@@ -3044,8 +3050,11 @@ static void __init futex_detect_cmpxchg(void)
+@@ -3044,8 +3051,11 @@ static void __init futex_detect_cmpxchg(void)
  	 * implementation, the non-functional ones will return
  	 * -ENOSYS.
  	 */
@@ -91709,10 +91992,26 @@ index cb0cf37..b69e161 100644
  		return -ENOMEM;
  	reset_iter(iter, 0);
 diff --git a/kernel/kcmp.c b/kernel/kcmp.c
-index e30ac0f..3528cac 100644
+index e30ac0f..a7fcafb 100644
 --- a/kernel/kcmp.c
 +++ b/kernel/kcmp.c
-@@ -99,6 +99,10 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
+@@ -44,11 +44,12 @@ static long kptr_obfuscate(long v, int type)
+  */
+ static int kcmp_ptr(void *v1, void *v2, enum kcmp_type type)
+ {
+-	long ret;
++	long t1, t2;
+ 
+-	ret = kptr_obfuscate((long)v1, type) - kptr_obfuscate((long)v2, type);
++	t1 = kptr_obfuscate((long)v1, type);
++	t2 = kptr_obfuscate((long)v2, type);
+ 
+-	return (ret < 0) | ((ret > 0) << 1);
++	return (t1 < t2) | ((t1 > t2) << 1);
+ }
+ 
+ /* The caller must have pinned the task */
+@@ -99,6 +100,10 @@ SYSCALL_DEFINE5(kcmp, pid_t, pid1, pid_t, pid2, int, type,
  	struct task_struct *task1, *task2;
  	int ret;
  
@@ -95917,10 +96216,71 @@ index 7c7964c..2a0d412 100644
  		update_vsyscall_tz();
  		if (firsttime) {
 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
-index fe75444..190c528 100644
+index fe75444..b8a1463 100644
 --- a/kernel/time/alarmtimer.c
 +++ b/kernel/time/alarmtimer.c
-@@ -811,7 +811,7 @@ static int __init alarmtimer_init(void)
+@@ -464,18 +464,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
+ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ 							ktime_t now)
+ {
++	unsigned long flags;
+ 	struct k_itimer *ptr = container_of(alarm, struct k_itimer,
+ 						it.alarm.alarmtimer);
+-	if (posix_timer_event(ptr, 0) != 0)
+-		ptr->it_overrun++;
++	enum alarmtimer_restart result = ALARMTIMER_NORESTART;
++
++	spin_lock_irqsave(&ptr->it_lock, flags);
++	if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
++		if (posix_timer_event(ptr, 0) != 0)
++			ptr->it_overrun++;
++	}
+ 
+ 	/* Re-add periodic timers */
+ 	if (ptr->it.alarm.interval.tv64) {
+ 		ptr->it_overrun += alarm_forward(alarm, now,
+ 						ptr->it.alarm.interval);
+-		return ALARMTIMER_RESTART;
++		result = ALARMTIMER_RESTART;
+ 	}
+-	return ALARMTIMER_NORESTART;
++	spin_unlock_irqrestore(&ptr->it_lock, flags);
++
++	return result;
+ }
+ 
+ /**
+@@ -541,18 +549,22 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+  * @new_timer: k_itimer pointer
+  * @cur_setting: itimerspec data to fill
+  *
+- * Copies the itimerspec data out from the k_itimer
++ * Copies out the current itimerspec data
+  */
+ static void alarm_timer_get(struct k_itimer *timr,
+ 				struct itimerspec *cur_setting)
+ {
+-	memset(cur_setting, 0, sizeof(struct itimerspec));
++	ktime_t relative_expiry_time =
++		alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
+ 
+-	cur_setting->it_interval =
+-			ktime_to_timespec(timr->it.alarm.interval);
+-	cur_setting->it_value =
+-		ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
+-	return;
++	if (ktime_to_ns(relative_expiry_time) > 0) {
++		cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
++	} else {
++		cur_setting->it_value.tv_sec = 0;
++		cur_setting->it_value.tv_nsec = 0;
++	}
++
++	cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
+ }
+ 
+ /**
+@@ -811,7 +823,7 @@ static int __init alarmtimer_init(void)
  	struct platform_device *pdev;
  	int error = 0;
  	int i;
@@ -96716,6 +97076,20 @@ index 35974ac..43c9e87 100644
  	}
  
  	spin_unlock_irq(&pool->lock);
+diff --git a/lib/Kconfig b/lib/Kconfig
+index 334f772..74b8ec3 100644
+--- a/lib/Kconfig
++++ b/lib/Kconfig
+@@ -51,6 +51,9 @@ config PERCPU_RWSEM
+ config ARCH_USE_CMPXCHG_LOCKREF
+ 	bool
+ 
++config ARCH_HAS_FAST_MULTIPLIER
++	bool
++
+ config CRC_CCITT
+ 	tristate "CRC-CCITT functions"
+ 	help
 diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
 index 7a638aa..20db901 100644
 --- a/lib/Kconfig.debug
@@ -96804,10 +97178,25 @@ index ba967a1..2cc869a 100644
  
  ifneq ($(CONFIG_HAVE_DEC_LOCK),y)
 diff --git a/lib/assoc_array.c b/lib/assoc_array.c
-index c0b1007..ae146f0 100644
+index c0b1007..2404d03 100644
 --- a/lib/assoc_array.c
 +++ b/lib/assoc_array.c
-@@ -1735,7 +1735,7 @@ ascend_old_tree:
+@@ -1723,11 +1723,13 @@ ascend_old_tree:
+ 		shortcut = assoc_array_ptr_to_shortcut(ptr);
+ 		slot = shortcut->parent_slot;
+ 		cursor = shortcut->back_pointer;
++		if (!cursor)
++			goto gc_complete;
+ 	} else {
+ 		slot = node->parent_slot;
+ 		cursor = ptr;
+ 	}
+-	BUG_ON(!ptr);
++	BUG_ON(!cursor);
+ 	node = assoc_array_ptr_to_node(cursor);
+ 	slot++;
+ 	goto continue_node;
+@@ -1735,7 +1737,7 @@ ascend_old_tree:
  gc_complete:
  	edit->set[0].to = new_root;
  	assoc_array_apply_edit(edit);
@@ -96952,6 +97341,28 @@ index fea973f..386626f 100644
  	.hash  = jhash,
  	.hash2 = jhash2,
  };
+diff --git a/lib/hweight.c b/lib/hweight.c
+index b7d81ba..9a5c1f2 100644
+--- a/lib/hweight.c
++++ b/lib/hweight.c
+@@ -11,7 +11,7 @@
+ 
+ unsigned int __sw_hweight32(unsigned int w)
+ {
+-#ifdef ARCH_HAS_FAST_MULTIPLIER
++#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+ 	w -= (w >> 1) & 0x55555555;
+ 	w =  (w & 0x33333333) + ((w >> 2) & 0x33333333);
+ 	w =  (w + (w >> 4)) & 0x0f0f0f0f;
+@@ -49,7 +49,7 @@ unsigned long __sw_hweight64(__u64 w)
+ 	return __sw_hweight32((unsigned int)(w >> 32)) +
+ 	       __sw_hweight32((unsigned int)w);
+ #elif BITS_PER_LONG == 64
+-#ifdef ARCH_HAS_FAST_MULTIPLIER
++#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
+ 	w -= (w >> 1) & 0x5555555555555555ul;
+ 	w =  (w & 0x3333333333333333ul) + ((w >> 2) & 0x3333333333333333ul);
+ 	w =  (w + (w >> 4)) & 0x0f0f0f0f0f0f0f0ful;
 diff --git a/lib/inflate.c b/lib/inflate.c
 index 013a761..c28f3fc 100644
 --- a/lib/inflate.c
@@ -97238,6 +97649,98 @@ index c24c2f7..f0296f4 100644
 +	pax_close_kernel();
 +}
 +EXPORT_SYMBOL(pax_list_del_rcu);
+diff --git a/lib/lockref.c b/lib/lockref.c
+index f07a40d..0a445a7 100644
+--- a/lib/lockref.c
++++ b/lib/lockref.c
+@@ -49,13 +49,13 @@
+ void lockref_get(struct lockref *lockref)
+ {
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 	,
+ 		return;
+ 	);
+ 
+ 	spin_lock(&lockref->lock);
+-	lockref->count++;
++	__lockref_inc(lockref);
+ 	spin_unlock(&lockref->lock);
+ }
+ EXPORT_SYMBOL(lockref_get);
+@@ -70,7 +70,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+ 	int retval;
+ 
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 		if (!old.count)
+ 			return 0;
+ 	,
+@@ -80,7 +80,7 @@ int lockref_get_not_zero(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	retval = 0;
+ 	if (lockref->count) {
+-		lockref->count++;
++		__lockref_inc(lockref);
+ 		retval = 1;
+ 	}
+ 	spin_unlock(&lockref->lock);
+@@ -97,7 +97,7 @@ EXPORT_SYMBOL(lockref_get_not_zero);
+ int lockref_get_or_lock(struct lockref *lockref)
+ {
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 		if (!old.count)
+ 			break;
+ 	,
+@@ -107,7 +107,7 @@ int lockref_get_or_lock(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	if (!lockref->count)
+ 		return 0;
+-	lockref->count++;
++	__lockref_inc(lockref);
+ 	spin_unlock(&lockref->lock);
+ 	return 1;
+ }
+@@ -121,7 +121,7 @@ EXPORT_SYMBOL(lockref_get_or_lock);
+ int lockref_put_or_lock(struct lockref *lockref)
+ {
+ 	CMPXCHG_LOOP(
+-		new.count--;
++		__lockref_dec(&new);
+ 		if (old.count <= 1)
+ 			break;
+ 	,
+@@ -131,7 +131,7 @@ int lockref_put_or_lock(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	if (lockref->count <= 1)
+ 		return 0;
+-	lockref->count--;
++	__lockref_dec(lockref);
+ 	spin_unlock(&lockref->lock);
+ 	return 1;
+ }
+@@ -158,7 +158,7 @@ int lockref_get_not_dead(struct lockref *lockref)
+ 	int retval;
+ 
+ 	CMPXCHG_LOOP(
+-		new.count++;
++		__lockref_inc(&new);
+ 		if ((int)old.count < 0)
+ 			return 0;
+ 	,
+@@ -168,7 +168,7 @@ int lockref_get_not_dead(struct lockref *lockref)
+ 	spin_lock(&lockref->lock);
+ 	retval = 0;
+ 	if ((int) lockref->count >= 0) {
+-		lockref->count++;
++		__lockref_inc(lockref);
+ 		retval = 1;
+ 	}
+ 	spin_unlock(&lockref->lock);
 diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
 index 963b703..438bc51 100644
 --- a/lib/percpu-refcount.c
@@ -97304,6 +97807,22 @@ index 0922579..9d7adb9 100644
 +	printk("%lu pages hwpoisoned\n", atomic_long_read_unchecked(&num_poisoned_pages));
  #endif
  }
+diff --git a/lib/string.c b/lib/string.c
+index 992bf30..f3c6ff5 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -807,9 +807,9 @@ void *memchr_inv(const void *start, int c, size_t bytes)
+ 		return check_bytes8(start, value, bytes);
+ 
+ 	value64 = value;
+-#if defined(ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
++#if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
+ 	value64 *= 0x0101010101010101;
+-#elif defined(ARCH_HAS_FAST_MULTIPLIER)
++#elif defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER)
+ 	value64 *= 0x01010101;
+ 	value64 |= value64 << 32;
+ #else
 diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
 index bb2b201..46abaf9 100644
 --- a/lib/strncpy_from_user.c
diff --git a/3.2.62/0000_README b/3.2.63/0000_README
index 18c3bc7..dfb7000 100644
--- a/3.2.62/0000_README
+++ b/3.2.63/0000_README
@@ -166,7 +166,11 @@ Patch:	1061_linux-3.2.62.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.62
 
-Patch:	4420_grsecurity-3.0-3.2.62-201409112233.patch
+Patch:	1062_linux-3.2.63.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.63
+
+Patch:	4420_grsecurity-3.0-3.2.63-201409150854.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.62/1021_linux-3.2.22.patch b/3.2.63/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.62/1021_linux-3.2.22.patch
+++ b/3.2.63/1021_linux-3.2.22.patch
diff --git a/3.2.62/1022_linux-3.2.23.patch b/3.2.63/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.62/1022_linux-3.2.23.patch
+++ b/3.2.63/1022_linux-3.2.23.patch
diff --git a/3.2.62/1023_linux-3.2.24.patch b/3.2.63/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.62/1023_linux-3.2.24.patch
+++ b/3.2.63/1023_linux-3.2.24.patch
diff --git a/3.2.62/1024_linux-3.2.25.patch b/3.2.63/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.62/1024_linux-3.2.25.patch
+++ b/3.2.63/1024_linux-3.2.25.patch
diff --git a/3.2.62/1025_linux-3.2.26.patch b/3.2.63/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.62/1025_linux-3.2.26.patch
+++ b/3.2.63/1025_linux-3.2.26.patch
diff --git a/3.2.62/1026_linux-3.2.27.patch b/3.2.63/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.62/1026_linux-3.2.27.patch
+++ b/3.2.63/1026_linux-3.2.27.patch
diff --git a/3.2.62/1027_linux-3.2.28.patch b/3.2.63/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.62/1027_linux-3.2.28.patch
+++ b/3.2.63/1027_linux-3.2.28.patch
diff --git a/3.2.62/1028_linux-3.2.29.patch b/3.2.63/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.62/1028_linux-3.2.29.patch
+++ b/3.2.63/1028_linux-3.2.29.patch
diff --git a/3.2.62/1029_linux-3.2.30.patch b/3.2.63/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.62/1029_linux-3.2.30.patch
+++ b/3.2.63/1029_linux-3.2.30.patch
diff --git a/3.2.62/1030_linux-3.2.31.patch b/3.2.63/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.62/1030_linux-3.2.31.patch
+++ b/3.2.63/1030_linux-3.2.31.patch
diff --git a/3.2.62/1031_linux-3.2.32.patch b/3.2.63/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.62/1031_linux-3.2.32.patch
+++ b/3.2.63/1031_linux-3.2.32.patch
diff --git a/3.2.62/1032_linux-3.2.33.patch b/3.2.63/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.62/1032_linux-3.2.33.patch
+++ b/3.2.63/1032_linux-3.2.33.patch
diff --git a/3.2.62/1033_linux-3.2.34.patch b/3.2.63/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.62/1033_linux-3.2.34.patch
+++ b/3.2.63/1033_linux-3.2.34.patch
diff --git a/3.2.62/1034_linux-3.2.35.patch b/3.2.63/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.62/1034_linux-3.2.35.patch
+++ b/3.2.63/1034_linux-3.2.35.patch
diff --git a/3.2.62/1035_linux-3.2.36.patch b/3.2.63/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.62/1035_linux-3.2.36.patch
+++ b/3.2.63/1035_linux-3.2.36.patch
diff --git a/3.2.62/1036_linux-3.2.37.patch b/3.2.63/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.62/1036_linux-3.2.37.patch
+++ b/3.2.63/1036_linux-3.2.37.patch
diff --git a/3.2.62/1037_linux-3.2.38.patch b/3.2.63/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.62/1037_linux-3.2.38.patch
+++ b/3.2.63/1037_linux-3.2.38.patch
diff --git a/3.2.62/1038_linux-3.2.39.patch b/3.2.63/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.62/1038_linux-3.2.39.patch
+++ b/3.2.63/1038_linux-3.2.39.patch
diff --git a/3.2.62/1039_linux-3.2.40.patch b/3.2.63/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.62/1039_linux-3.2.40.patch
+++ b/3.2.63/1039_linux-3.2.40.patch
diff --git a/3.2.62/1040_linux-3.2.41.patch b/3.2.63/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.62/1040_linux-3.2.41.patch
+++ b/3.2.63/1040_linux-3.2.41.patch
diff --git a/3.2.62/1041_linux-3.2.42.patch b/3.2.63/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.62/1041_linux-3.2.42.patch
+++ b/3.2.63/1041_linux-3.2.42.patch
diff --git a/3.2.62/1042_linux-3.2.43.patch b/3.2.63/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.62/1042_linux-3.2.43.patch
+++ b/3.2.63/1042_linux-3.2.43.patch
diff --git a/3.2.62/1043_linux-3.2.44.patch b/3.2.63/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.62/1043_linux-3.2.44.patch
+++ b/3.2.63/1043_linux-3.2.44.patch
diff --git a/3.2.62/1044_linux-3.2.45.patch b/3.2.63/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.62/1044_linux-3.2.45.patch
+++ b/3.2.63/1044_linux-3.2.45.patch
diff --git a/3.2.62/1045_linux-3.2.46.patch b/3.2.63/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.62/1045_linux-3.2.46.patch
+++ b/3.2.63/1045_linux-3.2.46.patch
diff --git a/3.2.62/1046_linux-3.2.47.patch b/3.2.63/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.62/1046_linux-3.2.47.patch
+++ b/3.2.63/1046_linux-3.2.47.patch
diff --git a/3.2.62/1047_linux-3.2.48.patch b/3.2.63/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.62/1047_linux-3.2.48.patch
+++ b/3.2.63/1047_linux-3.2.48.patch
diff --git a/3.2.62/1048_linux-3.2.49.patch b/3.2.63/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.62/1048_linux-3.2.49.patch
+++ b/3.2.63/1048_linux-3.2.49.patch
diff --git a/3.2.62/1049_linux-3.2.50.patch b/3.2.63/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.62/1049_linux-3.2.50.patch
+++ b/3.2.63/1049_linux-3.2.50.patch
diff --git a/3.2.62/1050_linux-3.2.51.patch b/3.2.63/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.62/1050_linux-3.2.51.patch
+++ b/3.2.63/1050_linux-3.2.51.patch
diff --git a/3.2.62/1051_linux-3.2.52.patch b/3.2.63/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.62/1051_linux-3.2.52.patch
+++ b/3.2.63/1051_linux-3.2.52.patch
diff --git a/3.2.62/1052_linux-3.2.53.patch b/3.2.63/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.62/1052_linux-3.2.53.patch
+++ b/3.2.63/1052_linux-3.2.53.patch
diff --git a/3.2.62/1053_linux-3.2.54.patch b/3.2.63/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.62/1053_linux-3.2.54.patch
+++ b/3.2.63/1053_linux-3.2.54.patch
diff --git a/3.2.62/1054_linux-3.2.55.patch b/3.2.63/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.62/1054_linux-3.2.55.patch
+++ b/3.2.63/1054_linux-3.2.55.patch
diff --git a/3.2.62/1055_linux-3.2.56.patch b/3.2.63/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.62/1055_linux-3.2.56.patch
+++ b/3.2.63/1055_linux-3.2.56.patch
diff --git a/3.2.62/1056_linux-3.2.57.patch b/3.2.63/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.62/1056_linux-3.2.57.patch
+++ b/3.2.63/1056_linux-3.2.57.patch
diff --git a/3.2.62/1057_linux-3.2.58.patch b/3.2.63/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.62/1057_linux-3.2.58.patch
+++ b/3.2.63/1057_linux-3.2.58.patch
diff --git a/3.2.62/1058_linux-3.2.59.patch b/3.2.63/1058_linux-3.2.59.patch
index cd59fe9..cd59fe9 100644
--- a/3.2.62/1058_linux-3.2.59.patch
+++ b/3.2.63/1058_linux-3.2.59.patch
diff --git a/3.2.62/1059_linux-3.2.60.patch b/3.2.63/1059_linux-3.2.60.patch
index c5a9389..c5a9389 100644
--- a/3.2.62/1059_linux-3.2.60.patch
+++ b/3.2.63/1059_linux-3.2.60.patch
diff --git a/3.2.62/1060_linux-3.2.61.patch b/3.2.63/1060_linux-3.2.61.patch
index a1bf580..a1bf580 100644
--- a/3.2.62/1060_linux-3.2.61.patch
+++ b/3.2.63/1060_linux-3.2.61.patch
diff --git a/3.2.62/1061_linux-3.2.62.patch b/3.2.63/1061_linux-3.2.62.patch
index 34217f0..34217f0 100644
--- a/3.2.62/1061_linux-3.2.62.patch
+++ b/3.2.63/1061_linux-3.2.62.patch
diff --git a/3.2.63/1062_linux-3.2.63.patch b/3.2.63/1062_linux-3.2.63.patch
new file mode 100644
index 0000000..f7c7415
--- /dev/null
+++ b/3.2.63/1062_linux-3.2.63.patch
@@ -0,0 +1,5394 @@
+diff --git a/Documentation/sound/alsa/ALSA-Configuration.txt b/Documentation/sound/alsa/ALSA-Configuration.txt
+index 936699e..15806ef 100644
+--- a/Documentation/sound/alsa/ALSA-Configuration.txt
++++ b/Documentation/sound/alsa/ALSA-Configuration.txt
+@@ -2018,8 +2018,8 @@ Prior to version 0.9.0rc4 options had a 'snd_' prefix. This was removed.
+   -------------------
+ 
+     Module for sound cards based on the Asus AV66/AV100/AV200 chips,
+-    i.e., Xonar D1, DX, D2, D2X, DS, Essence ST (Deluxe), Essence STX,
+-    HDAV1.3 (Deluxe), and HDAV1.3 Slim.
++    i.e., Xonar D1, DX, D2, D2X, DS, DSX, Essence ST (Deluxe),
++    Essence STX (II), HDAV1.3 (Deluxe), and HDAV1.3 Slim.
+ 
+     This module supports autoprobe and multiple cards.
+ 
+diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
+index 22bf11b..53feeac 100644
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -29,6 +29,9 @@ Rules on what kind of patches are accepted, and which ones are not, into the
+ 
+ Procedure for submitting patches to the -stable tree:
+ 
++ - If the patch covers files in net/ or drivers/net please follow netdev stable
++   submission guidelines as described in
++   Documentation/networking/netdev-FAQ.txt
+  - Send the patch, after verifying that it follows the above rules, to
+    stable@vger.kernel.org.  You must note the upstream commit ID in the
+    changelog of your submission.
+diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
+index d6498e3..f33a936 100644
+--- a/Documentation/x86/x86_64/mm.txt
++++ b/Documentation/x86/x86_64/mm.txt
+@@ -12,6 +12,8 @@ ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space
+ ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole
+ ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
+ ... unused hole ...
++ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
++... unused hole ...
+ ffffffff80000000 - ffffffffa0000000 (=512 MB)  kernel text mapping, from phys 0
+ ffffffffa0000000 - fffffffffff00000 (=1536 MB) module mapping space
+ 
+diff --git a/Makefile b/Makefile
+index 30a5c65..6d3f2d4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 62
++SUBLEVEL = 63
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+@@ -592,6 +592,8 @@ KBUILD_CFLAGS	+= -fomit-frame-pointer
+ endif
+ endif
+ 
++KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
++
+ ifdef CONFIG_DEBUG_INFO
+ KBUILD_CFLAGS	+= -g
+ KBUILD_AFLAGS	+= -gdwarf-2
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 9a8531e..9d95a46 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -76,26 +76,21 @@
+ #ifndef CONFIG_THUMB2_KERNEL
+ 	.macro	svc_exit, rpsr
+ 	msr	spsr_cxsf, \rpsr
+-#if defined(CONFIG_CPU_V6)
+-	ldr	r0, [sp]
+-	strex	r1, r2, [sp]			@ clear the exclusive monitor
+-	ldmib	sp, {r1 - pc}^			@ load r1 - pc, cpsr
+-#elif defined(CONFIG_CPU_32v6K)
+-	clrex					@ clear the exclusive monitor
+-	ldmia	sp, {r0 - pc}^			@ load r0 - pc, cpsr
+-#else
+-	ldmia	sp, {r0 - pc}^			@ load r0 - pc, cpsr
++#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
++	@ We must avoid clrex due to Cortex-A15 erratum #830321
++	sub	r0, sp, #4			@ uninhabited address
++	strex	r1, r2, [r0]			@ clear the exclusive monitor
+ #endif
++	ldmia	sp, {r0 - pc}^			@ load r0 - pc, cpsr
+ 	.endm
+ 
+ 	.macro	restore_user_regs, fast = 0, offset = 0
+ 	ldr	r1, [sp, #\offset + S_PSR]	@ get calling cpsr
+ 	ldr	lr, [sp, #\offset + S_PC]!	@ get pc
+ 	msr	spsr_cxsf, r1			@ save in spsr_svc
+-#if defined(CONFIG_CPU_V6)
++#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
++	@ We must avoid clrex due to Cortex-A15 erratum #830321
+ 	strex	r1, r2, [sp]			@ clear the exclusive monitor
+-#elif defined(CONFIG_CPU_32v6K)
+-	clrex					@ clear the exclusive monitor
+ #endif
+ 	.if	\fast
+ 	ldmdb	sp, {r1 - lr}^			@ get calling r1 - lr
+@@ -123,7 +118,10 @@
+ 	.macro	svc_exit, rpsr
+ 	ldr	lr, [sp, #S_SP]			@ top of the stack
+ 	ldrd	r0, r1, [sp, #S_LR]		@ calling lr and pc
+-	clrex					@ clear the exclusive monitor
++
++	@ We must avoid clrex due to Cortex-A15 erratum #830321
++	strex	r2, r1, [sp, #S_LR]		@ clear the exclusive monitor
++
+ 	stmdb	lr!, {r0, r1, \rpsr}		@ calling lr and rfe context
+ 	ldmia	sp, {r0 - r12}
+ 	mov	sp, lr
+@@ -132,13 +130,16 @@
+ 	.endm
+ 
+ 	.macro	restore_user_regs, fast = 0, offset = 0
+-	clrex					@ clear the exclusive monitor
+ 	mov	r2, sp
+ 	load_user_sp_lr r2, r3, \offset + S_SP	@ calling sp, lr
+ 	ldr	r1, [sp, #\offset + S_PSR]	@ get calling cpsr
+ 	ldr	lr, [sp, #\offset + S_PC]	@ get pc
+ 	add	sp, sp, #\offset + S_SP
+ 	msr	spsr_cxsf, r1			@ save in spsr_svc
++
++	@ We must avoid clrex due to Cortex-A15 erratum #830321
++	strex	r1, r2, [sp]			@ clear the exclusive monitor
++
+ 	.if	\fast
+ 	ldmdb	sp, {r1 - r12}			@ get calling r1 - r12
+ 	.else
+diff --git a/arch/arm/mach-omap2/control.c b/arch/arm/mach-omap2/control.c
+index e34d27f..724f823 100644
+--- a/arch/arm/mach-omap2/control.c
++++ b/arch/arm/mach-omap2/control.c
+@@ -282,7 +282,8 @@ void omap3_save_scratchpad_contents(void)
+ 		scratchpad_contents.public_restore_ptr =
+ 			virt_to_phys(omap3_restore_3630);
+ 	else if (omap_rev() != OMAP3430_REV_ES3_0 &&
+-					omap_rev() != OMAP3430_REV_ES3_1)
++					omap_rev() != OMAP3430_REV_ES3_1 &&
++					omap_rev() != OMAP3430_REV_ES3_1_2)
+ 		scratchpad_contents.public_restore_ptr =
+ 			virt_to_phys(omap3_restore);
+ 	else
+diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
+index 8074199..5d777a5 100644
+--- a/arch/arm/mm/abort-ev6.S
++++ b/arch/arm/mm/abort-ev6.S
+@@ -17,12 +17,6 @@
+  */
+ 	.align	5
+ ENTRY(v6_early_abort)
+-#ifdef CONFIG_CPU_V6
+-	sub	r1, sp, #4			@ Get unused stack location
+-	strex	r0, r1, [r1]			@ Clear the exclusive monitor
+-#elif defined(CONFIG_CPU_32v6K)
+-	clrex
+-#endif
+ 	mrc	p15, 0, r1, c5, c0, 0		@ get FSR
+ 	mrc	p15, 0, r0, c6, c0, 0		@ get FAR
+ /*
+diff --git a/arch/arm/mm/abort-ev7.S b/arch/arm/mm/abort-ev7.S
+index 7033752..4812ad0 100644
+--- a/arch/arm/mm/abort-ev7.S
++++ b/arch/arm/mm/abort-ev7.S
+@@ -13,12 +13,6 @@
+  */
+ 	.align	5
+ ENTRY(v7_early_abort)
+-	/*
+-	 * The effect of data aborts on on the exclusive access monitor are
+-	 * UNPREDICTABLE. Do a CLREX to clear the state
+-	 */
+-	clrex
+-
+ 	mrc	p15, 0, r1, c5, c0, 0		@ get FSR
+ 	mrc	p15, 0, r0, c6, c0, 0		@ get FAR
+ 
+diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile
+index 4c4e58e..5365519 100644
+--- a/arch/microblaze/boot/Makefile
++++ b/arch/microblaze/boot/Makefile
+@@ -8,7 +8,7 @@ obj-y += linked_dtb.o
+ 
+ targets := linux.bin linux.bin.gz simpleImage.%
+ 
+-OBJCOPYFLAGS := -O binary
++OBJCOPYFLAGS := -R .note -R .comment -R .note.gnu.build-id -O binary
+ 
+ # Ensure system.dtb exists
+ $(obj)/linked_dtb.o: $(obj)/system.dtb
+diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
+index 2d9028f..3c5f61c 100644
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -266,6 +266,18 @@ static irqreturn_t octeon_rlm_interrupt(int cpl, void *dev_id)
+ }
+ #endif
+ 
++static char __read_mostly octeon_system_type[80];
++
++static int __init init_octeon_system_type(void)
++{
++	snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
++		cvmx_board_type_to_string(octeon_bootinfo->board_type),
++		octeon_model_get_string(read_c0_prid()));
++
++	return 0;
++}
++early_initcall(init_octeon_system_type);
++
+ /**
+  * Return a string representing the system type
+  *
+@@ -273,11 +285,7 @@ static irqreturn_t octeon_rlm_interrupt(int cpl, void *dev_id)
+  */
+ const char *octeon_board_type_string(void)
+ {
+-	static char name[80];
+-	sprintf(name, "%s (%s)",
+-		cvmx_board_type_to_string(octeon_bootinfo->board_type),
+-		octeon_model_get_string(read_c0_prid()));
+-	return name;
++	return octeon_system_type;
+ }
+ 
+ const char *get_system_type(void)
+diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
+index 0c527f6..e132bfd 100644
+--- a/arch/mips/kernel/irq-gic.c
++++ b/arch/mips/kernel/irq-gic.c
+@@ -166,11 +166,13 @@ static void __init gic_setup_intr(unsigned int intr, unsigned int cpu,
+ {
+ 	/* Setup Intr to Pin mapping */
+ 	if (pin & GIC_MAP_TO_NMI_MSK) {
++		int i;
++
+ 		GICWRITE(GIC_REG_ADDR(SHARED, GIC_SH_MAP_TO_PIN(intr)), pin);
+ 		/* FIXME: hack to route NMI to all cpu's */
+-		for (cpu = 0; cpu < NR_CPUS; cpu += 32) {
++		for (i = 0; i < NR_CPUS; i += 32) {
+ 			GICWRITE(GIC_REG_ADDR(SHARED,
+-					  GIC_SH_MAP_TO_VPE_REG_OFF(intr, cpu)),
++					  GIC_SH_MAP_TO_VPE_REG_OFF(intr, i)),
+ 				 0xffffffff);
+ 		}
+ 	} else {
+diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
+index 315fc0b..dc6ffe0 100644
+--- a/arch/mips/kernel/perf_event_mipsxx.c
++++ b/arch/mips/kernel/perf_event_mipsxx.c
+@@ -162,11 +162,6 @@ static unsigned int counters_total_to_per_cpu(unsigned int counters)
+ 	return counters >> vpe_shift();
+ }
+ 
+-static unsigned int counters_per_cpu_to_total(unsigned int counters)
+-{
+-	return counters << vpe_shift();
+-}
+-
+ #else /* !CONFIG_MIPS_MT_SMP */
+ #define vpe_id()	0
+ 
+diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
+index 4e6ea1f..e56c692 100644
+--- a/arch/mips/kernel/ptrace.c
++++ b/arch/mips/kernel/ptrace.c
+@@ -162,6 +162,7 @@ int ptrace_setfpregs(struct task_struct *child, __u32 __user *data)
+ 		__get_user(fregs[i], i + (__u64 __user *) data);
+ 
+ 	__get_user(child->thread.fpu.fcr31, data + 64);
++	child->thread.fpu.fcr31 &= ~FPU_CSR_ALL_X;
+ 
+ 	/* FIR may not be written.  */
+ 
+@@ -452,7 +453,7 @@ long arch_ptrace(struct task_struct *child, long request,
+ 			break;
+ #endif
+ 		case FPC_CSR:
+-			child->thread.fpu.fcr31 = data;
++			child->thread.fpu.fcr31 = data & ~FPU_CSR_ALL_X;
+ 			break;
+ 		case DSP_BASE ... DSP_BASE + 5: {
+ 			dspreg_t *dregs;
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 7d5ac0b..fe425bb 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -12,6 +12,7 @@
+ #include <linux/highmem.h>
+ #include <linux/kernel.h>
+ #include <linux/linkage.h>
++#include <linux/preempt.h>
+ #include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/mm.h>
+@@ -599,6 +600,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+ 	/* Catch bad driver code */
+ 	BUG_ON(size == 0);
+ 
++	preempt_disable();
+ 	if (cpu_has_inclusive_pcaches) {
+ 		if (size >= scache_size)
+ 			r4k_blast_scache();
+@@ -619,6 +621,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+ 		R4600_HIT_CACHEOP_WAR_IMPL;
+ 		blast_dcache_range(addr, addr + size);
+ 	}
++	preempt_enable();
+ 
+ 	bc_wback_inv(addr, size);
+ 	__sync();
+@@ -629,6 +632,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ 	/* Catch bad driver code */
+ 	BUG_ON(size == 0);
+ 
++	preempt_disable();
+ 	if (cpu_has_inclusive_pcaches) {
+ 		if (size >= scache_size)
+ 			r4k_blast_scache();
+@@ -653,6 +657,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ 		R4600_HIT_CACHEOP_WAR_IMPL;
+ 		blast_inv_dcache_range(addr, addr + size);
+ 	}
++	preempt_enable();
+ 
+ 	bc_inv(addr, size);
+ 	__sync();
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index e06370f..3ee768e 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -1282,6 +1282,7 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
+ 	}
+ #ifdef CONFIG_HUGETLB_PAGE
+ 	uasm_l_tlb_huge_update(&l, p);
++	UASM_i_LW(&p, K0, 0, K1);
+ 	build_huge_update_entries(&p, htlb_info.huge_pte, K1);
+ 	build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random,
+ 				   htlb_info.restore_scratch);
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index c75018d..23a3019 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -19,6 +19,7 @@
+ #include <linux/threads.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
++#include <linux/serial_reg.h>
+ #include <asm/processor.h>
+ #include <asm/page.h>
+ #include <asm/mmu.h>
+diff --git a/arch/openrisc/kernel/init_task.c b/arch/openrisc/kernel/init_task.c
+index 45744a38..ca53408 100644
+--- a/arch/openrisc/kernel/init_task.c
++++ b/arch/openrisc/kernel/init_task.c
+@@ -17,6 +17,7 @@
+ 
+ #include <linux/init_task.h>
+ #include <linux/mqueue.h>
++#include <linux/export.h>
+ 
+ static struct signal_struct init_signals = INIT_SIGNALS(init_signals);
+ static struct sighand_struct init_sighand = INIT_SIGHAND(init_sighand);
+diff --git a/arch/openrisc/kernel/irq.c b/arch/openrisc/kernel/irq.c
+index 59b3023..4bfead2 100644
+--- a/arch/openrisc/kernel/irq.c
++++ b/arch/openrisc/kernel/irq.c
+@@ -23,6 +23,7 @@
+ #include <linux/irq.h>
+ #include <linux/seq_file.h>
+ #include <linux/kernel_stat.h>
++#include <linux/export.h>
+ 
+ #include <linux/irqflags.h>
+ 
+diff --git a/arch/powerpc/include/asm/pte-hash64-64k.h b/arch/powerpc/include/asm/pte-hash64-64k.h
+index 59247e8..4ac50bb 100644
+--- a/arch/powerpc/include/asm/pte-hash64-64k.h
++++ b/arch/powerpc/include/asm/pte-hash64-64k.h
+@@ -40,17 +40,39 @@
+ 
+ #ifndef __ASSEMBLY__
+ 
++#include <asm/system.h> /* for smp_rmb() */
++
+ /*
+  * With 64K pages on hash table, we have a special PTE format that
+  * uses a second "half" of the page table to encode sub-page information
+  * in order to deal with 64K made of 4K HW pages. Thus we override the
+  * generic accessors and iterators here
+  */
+-#define __real_pte(e,p) 	((real_pte_t) { \
+-			(e), ((e) & _PAGE_COMBO) ? \
+-				(pte_val(*((p) + PTRS_PER_PTE))) : 0 })
+-#define __rpte_to_hidx(r,index)	((pte_val((r).pte) & _PAGE_COMBO) ? \
+-        (((r).hidx >> ((index)<<2)) & 0xf) : ((pte_val((r).pte) >> 12) & 0xf))
++#define __real_pte __real_pte
++static inline real_pte_t __real_pte(pte_t pte, pte_t *ptep)
++{
++	real_pte_t rpte;
++
++	rpte.pte = pte;
++	rpte.hidx = 0;
++	if (pte_val(pte) & _PAGE_COMBO) {
++		/*
++		 * Make sure we order the hidx load against the _PAGE_COMBO
++		 * check. The store side ordering is done in __hash_page_4K
++		 */
++		smp_rmb();
++		rpte.hidx = pte_val(*((ptep) + PTRS_PER_PTE));
++	}
++	return rpte;
++}
++
++static inline unsigned long __rpte_to_hidx(real_pte_t rpte, unsigned long index)
++{
++	if ((pte_val(rpte.pte) & _PAGE_COMBO))
++		return (rpte.hidx >> (index<<2)) & 0xf;
++	return (pte_val(rpte.pte) >> 12) & 0xf;
++}
++
+ #define __rpte_to_pte(r)	((r).pte)
+ #define __rpte_sub_valid(rpte, index) \
+ 	(pte_val(rpte.pte) & (_PAGE_HPTE_SUB0 >> (index)))
+diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
+index 458ed3b..12659ab 100644
+--- a/arch/powerpc/kernel/pci-common.c
++++ b/arch/powerpc/kernel/pci-common.c
+@@ -363,7 +363,6 @@ static pgprot_t __pci_mmap_set_pgprot(struct pci_dev *dev, struct resource *rp,
+ 				      enum pci_mmap_state mmap_state,
+ 				      int write_combine)
+ {
+-	unsigned long prot = pgprot_val(protection);
+ 
+ 	/* Write combine is always 0 on non-memory space mappings. On
+ 	 * memory space, if the user didn't pass 1, we check for a
+@@ -380,9 +379,9 @@ static pgprot_t __pci_mmap_set_pgprot(struct pci_dev *dev, struct resource *rp,
+ 
+ 	/* XXX would be nice to have a way to ask for write-through */
+ 	if (write_combine)
+-		return pgprot_noncached_wc(prot);
++		return pgprot_noncached_wc(protection);
+ 	else
+-		return pgprot_noncached(prot);
++		return pgprot_noncached(protection);
+ }
+ 
+ /*
+diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c
+index e94b57f..75dd32e 100644
+--- a/arch/powerpc/mm/init_64.c
++++ b/arch/powerpc/mm/init_64.c
+@@ -218,7 +218,8 @@ static void __meminit vmemmap_create_mapping(unsigned long start,
+ 					     unsigned long phys)
+ {
+ 	int  mapped = htab_bolt_mapping(start, start + page_size, phys,
+-					PAGE_KERNEL, mmu_vmemmap_psize,
++					pgprot_val(PAGE_KERNEL),
++					mmu_vmemmap_psize,
+ 					mmu_kernel_ssize);
+ 	BUG_ON(mapped < 0);
+ }
+diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
+index 24523dc..f4b78a3 100644
+--- a/arch/powerpc/mm/numa.c
++++ b/arch/powerpc/mm/numa.c
+@@ -600,8 +600,8 @@ static int __cpuinit cpu_numa_callback(struct notifier_block *nfb,
+ 	case CPU_UP_CANCELED:
+ 	case CPU_UP_CANCELED_FROZEN:
+ 		unmap_cpu_from_node(lcpu);
+-		break;
+ 		ret = NOTIFY_OK;
++		break;
+ #endif
+ 	}
+ 	return ret;
+diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
+index a3c40e8..aed3d91 100644
+--- a/arch/s390/Kconfig
++++ b/arch/s390/Kconfig
+@@ -119,6 +119,7 @@ config S390
+ 	select ARCH_INLINE_WRITE_UNLOCK_BH
+ 	select ARCH_INLINE_WRITE_UNLOCK_IRQ
+ 	select ARCH_INLINE_WRITE_UNLOCK_IRQRESTORE
++	select ARCH_SUPPORTS_ATOMIC_RMW
+ 
+ config SCHED_OMIT_FRAME_POINTER
+ 	def_bool y
+diff --git a/arch/sparc/include/asm/Kbuild b/arch/sparc/include/asm/Kbuild
+index 2c2e388..39a0b4f 100644
+--- a/arch/sparc/include/asm/Kbuild
++++ b/arch/sparc/include/asm/Kbuild
+@@ -21,3 +21,4 @@ generic-y += div64.h
+ generic-y += local64.h
+ generic-y += irq_regs.h
+ generic-y += local.h
++generic-y += types.h
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index ddbbea3..7ee5a1c 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -25,7 +25,8 @@
+ 
+ /* The kernel image occupies 0x4000000 to 0x6000000 (4MB --> 96MB).
+  * The page copy blockops can use 0x6000000 to 0x8000000.
+- * The TSB is mapped in the 0x8000000 to 0xa000000 range.
++ * The 8K TSB is mapped in the 0x8000000 to 0x8400000 range.
++ * The 4M TSB is mapped in the 0x8400000 to 0x8800000 range.
+  * The PROM resides in an area spanning 0xf0000000 to 0x100000000.
+  * The vmalloc area spans 0x100000000 to 0x200000000.
+  * Since modules need to be in the lowest 32-bits of the address space,
+@@ -34,7 +35,8 @@
+  * 0x400000000.
+  */
+ #define	TLBTEMP_BASE		_AC(0x0000000006000000,UL)
+-#define	TSBMAP_BASE		_AC(0x0000000008000000,UL)
++#define	TSBMAP_8K_BASE		_AC(0x0000000008000000,UL)
++#define	TSBMAP_4M_BASE		_AC(0x0000000008400000,UL)
+ #define MODULES_VADDR		_AC(0x0000000010000000,UL)
+ #define MODULES_LEN		_AC(0x00000000e0000000,UL)
+ #define MODULES_END		_AC(0x00000000f0000000,UL)
+diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
+index f0d6a97..1a4bb97 100644
+--- a/arch/sparc/include/asm/tlbflush_64.h
++++ b/arch/sparc/include/asm/tlbflush_64.h
+@@ -35,6 +35,8 @@ static inline void flush_tlb_range(struct vm_area_struct *vma,
+ {
+ }
+ 
++void flush_tlb_kernel_range(unsigned long start, unsigned long end);
++
+ #define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
+ 
+ extern void flush_tlb_pending(void);
+@@ -49,11 +51,6 @@ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
+ 
+ #ifndef CONFIG_SMP
+ 
+-#define flush_tlb_kernel_range(start,end) \
+-do {	flush_tsb_kernel_range(start,end); \
+-	__flush_tlb_kernel_range(start,end); \
+-} while (0)
+-
+ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
+ {
+ 	__flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
+@@ -64,11 +61,6 @@ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vad
+ extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
+ extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
+ 
+-#define flush_tlb_kernel_range(start, end) \
+-do {	flush_tsb_kernel_range(start,end); \
+-	smp_flush_tlb_kernel_range(start, end); \
+-} while (0)
+-
+ #define global_flush_tlb_page(mm, vaddr) \
+ 	smp_flush_tlb_page(mm, vaddr)
+ 
+diff --git a/arch/sparc/include/asm/types.h b/arch/sparc/include/asm/types.h
+deleted file mode 100644
+index 91e5a03..0000000
+--- a/arch/sparc/include/asm/types.h
++++ /dev/null
+@@ -1,23 +0,0 @@
+-#ifndef _SPARC_TYPES_H
+-#define _SPARC_TYPES_H
+-/*
+- * This file is never included by application software unless
+- * explicitly requested (e.g., via linux/types.h) in which case the
+- * application is Linux specific so (user-) name space pollution is
+- * not a major issue.  However, for interoperability, libraries still
+- * need to be careful to avoid a name clashes.
+- */
+-
+-#if defined(__sparc__)
+-
+-#include <asm-generic/int-ll64.h>
+-
+-#ifndef __ASSEMBLY__
+-
+-typedef unsigned short umode_t;
+-
+-#endif /* __ASSEMBLY__ */
+-
+-#endif /* defined(__sparc__) */
+-
+-#endif /* defined(_SPARC_TYPES_H) */
+diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
+index 435e406..1beaf60 100644
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1339,7 +1339,7 @@ int ldc_connect(struct ldc_channel *lp)
+ 	if (!(lp->flags & LDC_FLAG_ALLOCED_QUEUES) ||
+ 	    !(lp->flags & LDC_FLAG_REGISTERED_QUEUES) ||
+ 	    lp->hs_state != LDC_HS_OPEN)
+-		err = -EINVAL;
++		err = ((lp->hs_state > LDC_HS_OPEN) ? 0 : -EINVAL);
+ 	else
+ 		err = start_handshake(lp);
+ 
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index e21d3c0d..ffd1245 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -151,7 +151,7 @@ void cpu_panic(void)
+ #define NUM_ROUNDS	64	/* magic value */
+ #define NUM_ITERS	5	/* likewise */
+ 
+-static DEFINE_SPINLOCK(itc_sync_lock);
++static DEFINE_RAW_SPINLOCK(itc_sync_lock);
+ static unsigned long go[SLAVE + 1];
+ 
+ #define DEBUG_TICK_SYNC	0
+@@ -259,7 +259,7 @@ static void smp_synchronize_one_tick(int cpu)
+ 	go[MASTER] = 0;
+ 	membar_safe("#StoreLoad");
+ 
+-	spin_lock_irqsave(&itc_sync_lock, flags);
++	raw_spin_lock_irqsave(&itc_sync_lock, flags);
+ 	{
+ 		for (i = 0; i < NUM_ROUNDS*NUM_ITERS; i++) {
+ 			while (!go[MASTER])
+@@ -270,7 +270,7 @@ static void smp_synchronize_one_tick(int cpu)
+ 			membar_safe("#StoreLoad");
+ 		}
+ 	}
+-	spin_unlock_irqrestore(&itc_sync_lock, flags);
++	raw_spin_unlock_irqrestore(&itc_sync_lock, flags);
+ }
+ 
+ #if defined(CONFIG_SUN_LDOMS) && defined(CONFIG_HOTPLUG_CPU)
+diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
+index d97f3eb..085c60f 100644
+--- a/arch/sparc/kernel/sys32.S
++++ b/arch/sparc/kernel/sys32.S
+@@ -87,7 +87,7 @@ SIGN1(sys32_io_submit, compat_sys_io_submit, %o1)
+ SIGN1(sys32_mq_open, compat_sys_mq_open, %o1)
+ SIGN1(sys32_select, compat_sys_select, %o0)
+ SIGN1(sys32_mkdir, sys_mkdir, %o1)
+-SIGN3(sys32_futex, compat_sys_futex, %o1, %o2, %o5)
++SIGN1(sys32_futex, compat_sys_futex, %o1)
+ SIGN1(sys32_sysfs, compat_sys_sysfs, %o0)
+ SIGN2(sys32_sendfile, compat_sys_sendfile, %o0, %o1)
+ SIGN2(sys32_sendfile64, compat_sys_sendfile64, %o0, %o1)
+diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
+index 76e4ac1..1c90812 100644
+--- a/arch/sparc/kernel/unaligned_64.c
++++ b/arch/sparc/kernel/unaligned_64.c
+@@ -156,17 +156,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
+ unsigned long compute_effective_address(struct pt_regs *regs,
+ 					unsigned int insn, unsigned int rd)
+ {
++	int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
+ 	unsigned int rs1 = (insn >> 14) & 0x1f;
+ 	unsigned int rs2 = insn & 0x1f;
+-	int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
++	unsigned long addr;
+ 
+ 	if (insn & 0x2000) {
+ 		maybe_flush_windows(rs1, 0, rd, from_kernel);
+-		return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
++		addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
+ 	} else {
+ 		maybe_flush_windows(rs1, rs2, rd, from_kernel);
+-		return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
++		addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
+ 	}
++
++	if (!from_kernel && test_thread_flag(TIF_32BIT))
++		addr &= 0xffffffff;
++
++	return addr;
+ }
+ 
+ /* This is just to make gcc think die_if_kernel does return... */
+diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
+index 0aed756..e993fc8 100644
+--- a/arch/sparc/lib/NG2memcpy.S
++++ b/arch/sparc/lib/NG2memcpy.S
+@@ -236,6 +236,7 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
+ 	 */
+ 	VISEntryHalf
+ 
++	membar		#Sync
+ 	alignaddr	%o1, %g0, %g0
+ 
+ 	add		%o1, (64 - 1), %o4
+diff --git a/arch/sparc/math-emu/math_32.c b/arch/sparc/math-emu/math_32.c
+index aa4d55b..5ce8f2f 100644
+--- a/arch/sparc/math-emu/math_32.c
++++ b/arch/sparc/math-emu/math_32.c
+@@ -499,7 +499,7 @@ static int do_one_mathemu(u32 insn, unsigned long *pfsr, unsigned long *fregs)
+ 		case 0: fsr = *pfsr;
+ 			if (IR == -1) IR = 2;
+ 			/* fcc is always fcc0 */
+-			fsr &= ~0xc00; fsr |= (IR << 10); break;
++			fsr &= ~0xc00; fsr |= (IR << 10);
+ 			*pfsr = fsr;
+ 			break;
+ 		case 1: rd->s = IR; break;
+diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
+index 504c062..2c0b966 100644
+--- a/arch/sparc/mm/fault_64.c
++++ b/arch/sparc/mm/fault_64.c
+@@ -95,38 +95,51 @@ static unsigned int get_user_insn(unsigned long tpc)
+ 	pte_t *ptep, pte;
+ 	unsigned long pa;
+ 	u32 insn = 0;
+-	unsigned long pstate;
+ 
+-	if (pgd_none(*pgdp))
+-		goto outret;
++	if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
++		goto out;
+ 	pudp = pud_offset(pgdp, tpc);
+-	if (pud_none(*pudp))
+-		goto outret;
+-	pmdp = pmd_offset(pudp, tpc);
+-	if (pmd_none(*pmdp))
+-		goto outret;
+-
+-	/* This disables preemption for us as well. */
+-	__asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
+-	__asm__ __volatile__("wrpr %0, %1, %%pstate"
+-				: : "r" (pstate), "i" (PSTATE_IE));
+-	ptep = pte_offset_map(pmdp, tpc);
+-	pte = *ptep;
+-	if (!pte_present(pte))
++	if (pud_none(*pudp) || unlikely(pud_bad(*pudp)))
+ 		goto out;
+ 
+-	pa  = (pte_pfn(pte) << PAGE_SHIFT);
+-	pa += (tpc & ~PAGE_MASK);
+-
+-	/* Use phys bypass so we don't pollute dtlb/dcache. */
+-	__asm__ __volatile__("lduwa [%1] %2, %0"
+-			     : "=r" (insn)
+-			     : "r" (pa), "i" (ASI_PHYS_USE_EC));
++	/* This disables preemption for us as well. */
++	local_irq_disable();
+ 
++	pmdp = pmd_offset(pudp, tpc);
++	if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp)))
++		goto out_irq_enable;
++
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++	if (pmd_trans_huge(*pmdp)) {
++		if (pmd_trans_splitting(*pmdp))
++			goto out_irq_enable;
++
++		pa  = pmd_pfn(*pmdp) << PAGE_SHIFT;
++		pa += tpc & ~HPAGE_MASK;
++
++		/* Use phys bypass so we don't pollute dtlb/dcache. */
++		__asm__ __volatile__("lduwa [%1] %2, %0"
++				     : "=r" (insn)
++				     : "r" (pa), "i" (ASI_PHYS_USE_EC));
++	} else
++#endif
++	{
++		ptep = pte_offset_map(pmdp, tpc);
++		pte = *ptep;
++		if (pte_present(pte)) {
++			pa  = (pte_pfn(pte) << PAGE_SHIFT);
++			pa += (tpc & ~PAGE_MASK);
++
++			/* Use phys bypass so we don't pollute dtlb/dcache. */
++			__asm__ __volatile__("lduwa [%1] %2, %0"
++					     : "=r" (insn)
++					     : "r" (pa), "i" (ASI_PHYS_USE_EC));
++		}
++		pte_unmap(ptep);
++	}
++out_irq_enable:
++	local_irq_enable();
+ out:
+-	pte_unmap(ptep);
+-	__asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
+-outret:
+ 	return insn;
+ }
+ 
+@@ -154,7 +167,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
+ extern unsigned long compute_effective_address(struct pt_regs *, unsigned int, unsigned int);
+ 
+ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
+-			     unsigned int insn, int fault_code)
++			     unsigned long fault_addr, unsigned int insn,
++			     int fault_code)
+ {
+ 	unsigned long addr;
+ 	siginfo_t info;
+@@ -162,10 +176,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
+ 	info.si_code = code;
+ 	info.si_signo = sig;
+ 	info.si_errno = 0;
+-	if (fault_code & FAULT_CODE_ITLB)
++	if (fault_code & FAULT_CODE_ITLB) {
+ 		addr = regs->tpc;
+-	else
+-		addr = compute_effective_address(regs, insn, 0);
++	} else {
++		/* If we were able to probe the faulting instruction, use it
++		 * to compute a precise fault address.  Otherwise use the fault
++		 * time provided address which may only have page granularity.
++		 */
++		if (insn)
++			addr = compute_effective_address(regs, insn, 0);
++		else
++			addr = fault_addr;
++	}
+ 	info.si_addr = (void __user *) addr;
+ 	info.si_trapno = 0;
+ 
+@@ -240,7 +262,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code,
+ 		/* The si_code was set to make clear whether
+ 		 * this was a SEGV_MAPERR or SEGV_ACCERR fault.
+ 		 */
+-		do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code);
++		do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code);
+ 		return;
+ 	}
+ 
+@@ -260,18 +282,6 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs)
+ 	show_regs(regs);
+ }
+ 
+-static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
+-							 unsigned long addr)
+-{
+-	static int times;
+-
+-	if (times++ < 10)
+-		printk(KERN_ERR "FAULT[%s:%d]: 32-bit process "
+-		       "reports 64-bit fault address [%lx]\n",
+-		       current->comm, current->pid, addr);
+-	show_regs(regs);
+-}
+-
+ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ {
+ 	struct mm_struct *mm = current->mm;
+@@ -299,10 +309,8 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ 				goto intr_or_no_mm;
+ 			}
+ 		}
+-		if (unlikely((address >> 32) != 0)) {
+-			bogus_32bit_fault_address(regs, address);
++		if (unlikely((address >> 32) != 0))
+ 			goto intr_or_no_mm;
+-		}
+ 	}
+ 
+ 	if (regs->tstate & TSTATE_PRIV) {
+@@ -492,7 +500,7 @@ do_sigbus:
+ 	 * Send a sigbus, regardless of whether we were in kernel
+ 	 * or user mode.
+ 	 */
+-	do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code);
++	do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code);
+ 
+ 	/* Kernel mode? Handle exceptions or die */
+ 	if (regs->tstate & TSTATE_PRIV)
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index b4989f9..d2c5737 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -309,6 +309,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *
+ 	tsb_index = MM_TSB_BASE;
+ 	tsb_hash_shift = PAGE_SHIFT;
+ 
++	/* Don't insert a non-valid PTE into the TSB, we'll deadlock.  */
++	if (!(pte_val(pte) & _PAGE_VALID))
++		return;
++
+ 	spin_lock_irqsave(&mm->context.lock, flags);
+ 
+ #ifdef CONFIG_HUGETLB_PAGE
+@@ -2436,3 +2440,26 @@ void __flush_tlb_all(void)
+ 	__asm__ __volatile__("wrpr	%0, 0, %%pstate"
+ 			     : : "r" (pstate));
+ }
++
++#ifdef CONFIG_SMP
++#define do_flush_tlb_kernel_range	smp_flush_tlb_kernel_range
++#else
++#define do_flush_tlb_kernel_range	__flush_tlb_kernel_range
++#endif
++
++void flush_tlb_kernel_range(unsigned long start, unsigned long end)
++{
++	if (start < HI_OBP_ADDRESS && end > LOW_OBP_ADDRESS) {
++		if (start < LOW_OBP_ADDRESS) {
++			flush_tsb_kernel_range(start, LOW_OBP_ADDRESS);
++			do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS);
++		}
++		if (end > HI_OBP_ADDRESS) {
++			flush_tsb_kernel_range(end, HI_OBP_ADDRESS);
++			do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS);
++		}
++	} else {
++		flush_tsb_kernel_range(start, end);
++		do_flush_tlb_kernel_range(start, end);
++	}
++}
+diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
+index 3ebcac7..6ddf60b 100644
+--- a/arch/sparc/mm/tsb.c
++++ b/arch/sparc/mm/tsb.c
+@@ -151,7 +151,19 @@ static void setup_tsb_params(struct mm_struct *mm, unsigned long tsb_idx, unsign
+ 	mm->context.tsb_block[tsb_idx].tsb_nentries =
+ 		tsb_bytes / sizeof(struct tsb);
+ 
+-	base = TSBMAP_BASE;
++	switch (tsb_idx) {
++	case MM_TSB_BASE:
++		base = TSBMAP_8K_BASE;
++		break;
++#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
++	case MM_TSB_HUGE:
++		base = TSBMAP_4M_BASE;
++		break;
++#endif
++	default:
++		BUG();
++	}
++
+ 	tte = pgprot_val(PAGE_KERNEL_LOCKED);
+ 	tsb_paddr = __pa(mm->context.tsb_block[tsb_idx].tsb);
+ 	BUG_ON(tsb_paddr & (tsb_bytes - 1UL));
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 901447e..28a1bca 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -896,10 +896,27 @@ config VM86
+ 	default y
+ 	depends on X86_32
+ 	---help---
+-	  This option is required by programs like DOSEMU to run 16-bit legacy
+-	  code on X86 processors. It also may be needed by software like
+-	  XFree86 to initialize some video cards via BIOS. Disabling this
+-	  option saves about 6k.
++	  This option is required by programs like DOSEMU to run
++	  16-bit real mode legacy code on x86 processors. It also may
++	  be needed by software like XFree86 to initialize some video
++	  cards via BIOS. Disabling this option saves about 6K.
++
++config X86_16BIT
++	bool "Enable support for 16-bit segments" if EXPERT
++	default y
++	---help---
++	  This option is required by programs like Wine to run 16-bit
++	  protected mode legacy code on x86 processors.  Disabling
++	  this option saves about 300 bytes on i386, or around 6K text
++	  plus 16K runtime memory on x86-64,
++
++config X86_ESPFIX32
++	def_bool y
++	depends on X86_16BIT && X86_32
++
++config X86_ESPFIX64
++	def_bool y
++	depends on X86_16BIT && X86_64
+ 
+ config TOSHIBA
+ 	tristate "Toshiba Laptop support"
+diff --git a/arch/x86/include/asm/espfix.h b/arch/x86/include/asm/espfix.h
+new file mode 100644
+index 0000000..99efebb
+--- /dev/null
++++ b/arch/x86/include/asm/espfix.h
+@@ -0,0 +1,16 @@
++#ifndef _ASM_X86_ESPFIX_H
++#define _ASM_X86_ESPFIX_H
++
++#ifdef CONFIG_X86_64
++
++#include <asm/percpu.h>
++
++DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
++DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
++
++extern void init_espfix_bsp(void);
++extern void init_espfix_ap(void);
++
++#endif /* CONFIG_X86_64 */
++
++#endif /* _ASM_X86_ESPFIX_H */
+diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
+index bba3cf8..0a8b519 100644
+--- a/arch/x86/include/asm/irqflags.h
++++ b/arch/x86/include/asm/irqflags.h
+@@ -129,7 +129,7 @@ static inline notrace unsigned long arch_local_irq_save(void)
+ 
+ #define PARAVIRT_ADJUST_EXCEPTION_FRAME	/*  */
+ 
+-#define INTERRUPT_RETURN	iretq
++#define INTERRUPT_RETURN	jmp native_iret
+ #define USERGS_SYSRET64				\
+ 	swapgs;					\
+ 	sysretq;
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 766ea16..51817fa 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -59,5 +59,7 @@ typedef struct { pteval_t pte; } pte_t;
+ #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
+ #define MODULES_END      _AC(0xffffffffff000000, UL)
+ #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
++#define ESPFIX_PGD_ENTRY _AC(-2, UL)
++#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)
+ 
+ #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
+diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
+index 9756551..8a87336 100644
+--- a/arch/x86/include/asm/setup.h
++++ b/arch/x86/include/asm/setup.h
+@@ -61,6 +61,8 @@ static inline void x86_ce4100_early_setup(void) { }
+ 
+ #ifndef _SETUP
+ 
++#include <asm/espfix.h>
++
+ /*
+  * This is set up by the setup-routine at boot-time
+  */
+diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
+index 8baca3c..96efa3e 100644
+--- a/arch/x86/kernel/Makefile
++++ b/arch/x86/kernel/Makefile
+@@ -27,6 +27,7 @@ obj-$(CONFIG_X86_32)	+= sys_i386_32.o i386_ksyms_32.o
+ obj-$(CONFIG_X86_64)	+= sys_x86_64.o x8664_ksyms_64.o
+ obj-$(CONFIG_X86_64)	+= syscall_64.o vsyscall_64.o
+ obj-$(CONFIG_X86_64)	+= vsyscall_emu_64.o
++obj-$(CONFIG_X86_ESPFIX64)	+= espfix_64.o
+ obj-y			+= bootflag.o e820.o
+ obj-y			+= pci-dma.o quirks.o topology.o kdebugfs.o
+ obj-y			+= alternative.o i8253.o pci-nommu.o hw_breakpoint.o
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index dd52355..0fa4f89 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -527,6 +527,7 @@ syscall_exit:
+ restore_all:
+ 	TRACE_IRQS_IRET
+ restore_all_notrace:
++#ifdef CONFIG_X86_ESPFIX32
+ 	movl PT_EFLAGS(%esp), %eax	# mix EFLAGS, SS and CS
+ 	# Warning: PT_OLDSS(%esp) contains the wrong/random values if we
+ 	# are returning to the kernel.
+@@ -537,6 +538,7 @@ restore_all_notrace:
+ 	cmpl $((SEGMENT_LDT << 8) | USER_RPL), %eax
+ 	CFI_REMEMBER_STATE
+ 	je ldt_ss			# returning to user-space with LDT SS
++#endif
+ restore_nocheck:
+ 	RESTORE_REGS 4			# skip orig_eax/error_code
+ irq_return:
+@@ -552,6 +554,7 @@ ENTRY(iret_exc)
+ 	.long irq_return,iret_exc
+ .previous
+ 
++#ifdef CONFIG_X86_ESPFIX32
+ 	CFI_RESTORE_STATE
+ ldt_ss:
+ #ifdef CONFIG_PARAVIRT
+@@ -595,6 +598,7 @@ ldt_ss:
+ 	lss (%esp), %esp		/* switch to espfix segment */
+ 	CFI_ADJUST_CFA_OFFSET -8
+ 	jmp restore_nocheck
++#endif
+ 	CFI_ENDPROC
+ ENDPROC(system_call)
+ 
+@@ -766,6 +770,7 @@ ENDPROC(ptregs_clone)
+  * the high word of the segment base from the GDT and swiches to the
+  * normal stack and adjusts ESP with the matching offset.
+  */
++#ifdef CONFIG_X86_ESPFIX32
+ 	/* fixup the stack */
+ 	mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
+ 	mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
+@@ -775,8 +780,10 @@ ENDPROC(ptregs_clone)
+ 	pushl_cfi %eax
+ 	lss (%esp), %esp		/* switch to the normal stack segment */
+ 	CFI_ADJUST_CFA_OFFSET -8
++#endif
+ .endm
+ .macro UNWIND_ESPFIX_STACK
++#ifdef CONFIG_X86_ESPFIX32
+ 	movl %ss, %eax
+ 	/* see if on espfix stack */
+ 	cmpw $__ESPFIX_SS, %ax
+@@ -787,6 +794,7 @@ ENDPROC(ptregs_clone)
+ 	/* switch to normal stack */
+ 	FIXUP_ESPFIX_STACK
+ 27:
++#endif
+ .endm
+ 
+ /*
+@@ -1323,11 +1331,13 @@ END(debug)
+  */
+ ENTRY(nmi)
+ 	RING0_INT_FRAME
++#ifdef CONFIG_X86_ESPFIX32
+ 	pushl_cfi %eax
+ 	movl %ss, %eax
+ 	cmpw $__ESPFIX_SS, %ax
+ 	popl_cfi %eax
+ 	je nmi_espfix_stack
++#endif
+ 	cmpl $ia32_sysenter_target,(%esp)
+ 	je nmi_stack_fixup
+ 	pushl_cfi %eax
+@@ -1367,6 +1377,7 @@ nmi_debug_stack_check:
+ 	FIX_STACK 24, nmi_stack_correct, 1
+ 	jmp nmi_stack_correct
+ 
++#ifdef CONFIG_X86_ESPFIX32
+ nmi_espfix_stack:
+ 	/* We have a RING0_INT_FRAME here.
+ 	 *
+@@ -1388,6 +1399,7 @@ nmi_espfix_stack:
+ 	lss 12+4(%esp), %esp		# back to espfix stack
+ 	CFI_ADJUST_CFA_OFFSET -24
+ 	jmp irq_return
++#endif
+ 	CFI_ENDPROC
+ END(nmi)
+ 
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index 6274f5f..4b511ef 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -55,6 +55,7 @@
+ #include <asm/paravirt.h>
+ #include <asm/ftrace.h>
+ #include <asm/percpu.h>
++#include <asm/pgtable_types.h>
+ 
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
+ #include <linux/elf-em.h>
+@@ -862,17 +863,47 @@ restore_args:
+ irq_return:
+ 	INTERRUPT_RETURN
+ 
+-	.section __ex_table, "a"
+-	.quad irq_return, bad_iret
+-	.previous
+-
+-#ifdef CONFIG_PARAVIRT
+ ENTRY(native_iret)
++	/*
++	 * Are we returning to a stack segment from the LDT?  Note: in
++	 * 64-bit mode SS:RSP on the exception stack is always valid.
++	 */
++#ifdef CONFIG_X86_ESPFIX64
++	testb $4,(SS-RIP)(%rsp)
++	jnz native_irq_return_ldt
++#endif
++
++native_irq_return_iret:
+ 	iretq
+ 
+ 	.section __ex_table,"a"
+-	.quad native_iret, bad_iret
++	.quad native_irq_return_iret, bad_iret
+ 	.previous
++
++#ifdef CONFIG_X86_ESPFIX64
++native_irq_return_ldt:
++	pushq_cfi %rax
++	pushq_cfi %rdi
++	SWAPGS
++	movq PER_CPU_VAR(espfix_waddr),%rdi
++	movq %rax,(0*8)(%rdi)	/* RAX */
++	movq (2*8)(%rsp),%rax	/* RIP */
++	movq %rax,(1*8)(%rdi)
++	movq (3*8)(%rsp),%rax	/* CS */
++	movq %rax,(2*8)(%rdi)
++	movq (4*8)(%rsp),%rax	/* RFLAGS */
++	movq %rax,(3*8)(%rdi)
++	movq (6*8)(%rsp),%rax	/* SS */
++	movq %rax,(5*8)(%rdi)
++	movq (5*8)(%rsp),%rax	/* RSP */
++	movq %rax,(4*8)(%rdi)
++	andl $0xffff0000,%eax
++	popq_cfi %rdi
++	orq PER_CPU_VAR(espfix_stack),%rax
++	SWAPGS
++	movq %rax,%rsp
++	popq_cfi %rax
++	jmp native_irq_return_iret
+ #endif
+ 
+ 	.section .fixup,"ax"
+@@ -938,9 +969,40 @@ ENTRY(retint_kernel)
+ 	call preempt_schedule_irq
+ 	jmp exit_intr
+ #endif
+-
+ 	CFI_ENDPROC
+ END(common_interrupt)
++
++	/*
++	 * If IRET takes a fault on the espfix stack, then we
++	 * end up promoting it to a doublefault.  In that case,
++	 * modify the stack to make it look like we just entered
++	 * the #GP handler from user space, similar to bad_iret.
++	 */
++#ifdef CONFIG_X86_ESPFIX64
++	ALIGN
++__do_double_fault:
++	XCPT_FRAME 1 RDI+8
++	movq RSP(%rdi),%rax		/* Trap on the espfix stack? */
++	sarq $PGDIR_SHIFT,%rax
++	cmpl $ESPFIX_PGD_ENTRY,%eax
++	jne do_double_fault		/* No, just deliver the fault */
++	cmpl $__KERNEL_CS,CS(%rdi)
++	jne do_double_fault
++	movq RIP(%rdi),%rax
++	cmpq $native_irq_return_iret,%rax
++	jne do_double_fault		/* This shouldn't happen... */
++	movq PER_CPU_VAR(kernel_stack),%rax
++	subq $(6*8-KERNEL_STACK_OFFSET),%rax	/* Reset to original stack */
++	movq %rax,RSP(%rdi)
++	movq $0,(%rax)			/* Missing (lost) #GP error code */
++	movq $general_protection,RIP(%rdi)
++	retq
++	CFI_ENDPROC
++END(__do_double_fault)
++#else
++# define __do_double_fault do_double_fault
++#endif
++
+ /*
+  * End of kprobes section
+  */
+@@ -1107,7 +1169,7 @@ zeroentry overflow do_overflow
+ zeroentry bounds do_bounds
+ zeroentry invalid_op do_invalid_op
+ zeroentry device_not_available do_device_not_available
+-paranoiderrorentry double_fault do_double_fault
++paranoiderrorentry double_fault __do_double_fault
+ zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun
+ errorentry invalid_TSS do_invalid_TSS
+ errorentry segment_not_present do_segment_not_present
+@@ -1438,7 +1500,7 @@ error_sti:
+  */
+ error_kernelspace:
+ 	incl %ebx
+-	leaq irq_return(%rip),%rcx
++	leaq native_irq_return_iret(%rip),%rcx
+ 	cmpq %rcx,RIP+8(%rsp)
+ 	je error_swapgs
+ 	movl %ecx,%eax	/* zero extend */
+diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
+new file mode 100644
+index 0000000..94d857f
+--- /dev/null
++++ b/arch/x86/kernel/espfix_64.c
+@@ -0,0 +1,208 @@
++/* ----------------------------------------------------------------------- *
++ *
++ *   Copyright 2014 Intel Corporation; author: H. Peter Anvin
++ *
++ *   This program is free software; you can redistribute it and/or modify it
++ *   under the terms and conditions of the GNU General Public License,
++ *   version 2, as published by the Free Software Foundation.
++ *
++ *   This program is distributed in the hope it will be useful, but WITHOUT
++ *   ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ *   FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
++ *   more details.
++ *
++ * ----------------------------------------------------------------------- */
++
++/*
++ * The IRET instruction, when returning to a 16-bit segment, only
++ * restores the bottom 16 bits of the user space stack pointer.  This
++ * causes some 16-bit software to break, but it also leaks kernel state
++ * to user space.
++ *
++ * This works around this by creating percpu "ministacks", each of which
++ * is mapped 2^16 times 64K apart.  When we detect that the return SS is
++ * on the LDT, we copy the IRET frame to the ministack and use the
++ * relevant alias to return to userspace.  The ministacks are mapped
++ * readonly, so if the IRET fault we promote #GP to #DF which is an IST
++ * vector and thus has its own stack; we then do the fixup in the #DF
++ * handler.
++ *
++ * This file sets up the ministacks and the related page tables.  The
++ * actual ministack invocation is in entry_64.S.
++ */
++
++#include <linux/init.h>
++#include <linux/init_task.h>
++#include <linux/kernel.h>
++#include <linux/percpu.h>
++#include <linux/gfp.h>
++#include <linux/random.h>
++#include <asm/pgtable.h>
++#include <asm/pgalloc.h>
++#include <asm/setup.h>
++#include <asm/espfix.h>
++
++/*
++ * Note: we only need 6*8 = 48 bytes for the espfix stack, but round
++ * it up to a cache line to avoid unnecessary sharing.
++ */
++#define ESPFIX_STACK_SIZE	(8*8UL)
++#define ESPFIX_STACKS_PER_PAGE	(PAGE_SIZE/ESPFIX_STACK_SIZE)
++
++/* There is address space for how many espfix pages? */
++#define ESPFIX_PAGE_SPACE	(1UL << (PGDIR_SHIFT-PAGE_SHIFT-16))
++
++#define ESPFIX_MAX_CPUS		(ESPFIX_STACKS_PER_PAGE * ESPFIX_PAGE_SPACE)
++#if CONFIG_NR_CPUS > ESPFIX_MAX_CPUS
++# error "Need more than one PGD for the ESPFIX hack"
++#endif
++
++#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO)
++
++/* This contains the *bottom* address of the espfix stack */
++DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
++DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
++
++/* Initialization mutex - should this be a spinlock? */
++static DEFINE_MUTEX(espfix_init_mutex);
++
++/* Page allocation bitmap - each page serves ESPFIX_STACKS_PER_PAGE CPUs */
++#define ESPFIX_MAX_PAGES  DIV_ROUND_UP(CONFIG_NR_CPUS, ESPFIX_STACKS_PER_PAGE)
++static void *espfix_pages[ESPFIX_MAX_PAGES];
++
++static __page_aligned_bss pud_t espfix_pud_page[PTRS_PER_PUD]
++	__aligned(PAGE_SIZE);
++
++static unsigned int page_random, slot_random;
++
++/*
++ * This returns the bottom address of the espfix stack for a specific CPU.
++ * The math allows for a non-power-of-two ESPFIX_STACK_SIZE, in which case
++ * we have to account for some amount of padding at the end of each page.
++ */
++static inline unsigned long espfix_base_addr(unsigned int cpu)
++{
++	unsigned long page, slot;
++	unsigned long addr;
++
++	page = (cpu / ESPFIX_STACKS_PER_PAGE) ^ page_random;
++	slot = (cpu + slot_random) % ESPFIX_STACKS_PER_PAGE;
++	addr = (page << PAGE_SHIFT) + (slot * ESPFIX_STACK_SIZE);
++	addr = (addr & 0xffffUL) | ((addr & ~0xffffUL) << 16);
++	addr += ESPFIX_BASE_ADDR;
++	return addr;
++}
++
++#define PTE_STRIDE        (65536/PAGE_SIZE)
++#define ESPFIX_PTE_CLONES (PTRS_PER_PTE/PTE_STRIDE)
++#define ESPFIX_PMD_CLONES PTRS_PER_PMD
++#define ESPFIX_PUD_CLONES (65536/(ESPFIX_PTE_CLONES*ESPFIX_PMD_CLONES))
++
++#define PGTABLE_PROT	  ((_KERNPG_TABLE & ~_PAGE_RW) | _PAGE_NX)
++
++static void init_espfix_random(void)
++{
++	unsigned long rand;
++
++	/*
++	 * This is run before the entropy pools are initialized,
++	 * but this is hopefully better than nothing.
++	 */
++	if (!arch_get_random_long(&rand)) {
++		/* The constant is an arbitrary large prime */
++		rdtscll(rand);
++		rand *= 0xc345c6b72fd16123UL;
++	}
++
++	slot_random = rand % ESPFIX_STACKS_PER_PAGE;
++	page_random = (rand / ESPFIX_STACKS_PER_PAGE)
++		& (ESPFIX_PAGE_SPACE - 1);
++}
++
++void __init init_espfix_bsp(void)
++{
++	pgd_t *pgd_p;
++	pteval_t ptemask;
++
++	ptemask = __supported_pte_mask;
++
++	/* Install the espfix pud into the kernel page directory */
++	pgd_p = &init_level4_pgt[pgd_index(ESPFIX_BASE_ADDR)];
++	pgd_populate(&init_mm, pgd_p, (pud_t *)espfix_pud_page);
++
++	/* Randomize the locations */
++	init_espfix_random();
++
++	/* The rest is the same as for any other processor */
++	init_espfix_ap();
++}
++
++void init_espfix_ap(void)
++{
++	unsigned int cpu, page;
++	unsigned long addr;
++	pud_t pud, *pud_p;
++	pmd_t pmd, *pmd_p;
++	pte_t pte, *pte_p;
++	int n;
++	void *stack_page;
++	pteval_t ptemask;
++
++	/* We only have to do this once... */
++	if (likely(this_cpu_read(espfix_stack)))
++		return;		/* Already initialized */
++
++	cpu = smp_processor_id();
++	addr = espfix_base_addr(cpu);
++	page = cpu/ESPFIX_STACKS_PER_PAGE;
++
++	/* Did another CPU already set this up? */
++	stack_page = ACCESS_ONCE(espfix_pages[page]);
++	if (likely(stack_page))
++		goto done;
++
++	mutex_lock(&espfix_init_mutex);
++
++	/* Did we race on the lock? */
++	stack_page = ACCESS_ONCE(espfix_pages[page]);
++	if (stack_page)
++		goto unlock_done;
++
++	ptemask = __supported_pte_mask;
++
++	pud_p = &espfix_pud_page[pud_index(addr)];
++	pud = *pud_p;
++	if (!pud_present(pud)) {
++		pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
++		pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
++		paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
++		for (n = 0; n < ESPFIX_PUD_CLONES; n++)
++			set_pud(&pud_p[n], pud);
++	}
++
++	pmd_p = pmd_offset(&pud, addr);
++	pmd = *pmd_p;
++	if (!pmd_present(pmd)) {
++		pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
++		pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
++		paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
++		for (n = 0; n < ESPFIX_PMD_CLONES; n++)
++			set_pmd(&pmd_p[n], pmd);
++	}
++
++	pte_p = pte_offset_kernel(&pmd, addr);
++	stack_page = (void *)__get_free_page(GFP_KERNEL);
++	pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
++	for (n = 0; n < ESPFIX_PTE_CLONES; n++)
++		set_pte(&pte_p[n*PTE_STRIDE], pte);
++
++	/* Job is done for this CPU and any CPU which shares this page */
++	ACCESS_ONCE(espfix_pages[page]) = stack_page;
++
++unlock_done:
++	mutex_unlock(&espfix_init_mutex);
++done:
++	this_cpu_write(espfix_stack, addr);
++	this_cpu_write(espfix_waddr, (unsigned long)stack_page
++		       + (addr & ~PAGE_MASK));
++}
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index 3e0ccbf..0a8e65e 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -21,8 +21,6 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+ 
+-int sysctl_ldt16 = 0;
+-
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -232,16 +230,10 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ 		}
+ 	}
+ 
+-	/*
+-	 * On x86-64 we do not support 16-bit segments due to
+-	 * IRET leaking the high bits of the kernel stack address.
+-	 */
+-#ifdef CONFIG_X86_64
+-	if (!ldt_info.seg_32bit && !sysctl_ldt16) {
++	if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
+ 	}
+-#endif
+ 
+ 	fill_ldt(&ldt, &ldt_info);
+ 	if (oldmode)
+diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
+index 3f08f34..a1da673 100644
+--- a/arch/x86/kernel/paravirt_patch_64.c
++++ b/arch/x86/kernel/paravirt_patch_64.c
+@@ -6,7 +6,6 @@ DEF_NATIVE(pv_irq_ops, irq_disable, "cli");
+ DEF_NATIVE(pv_irq_ops, irq_enable, "sti");
+ DEF_NATIVE(pv_irq_ops, restore_fl, "pushq %rdi; popfq");
+ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
+-DEF_NATIVE(pv_cpu_ops, iret, "iretq");
+ DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
+ DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
+ DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
+@@ -50,7 +49,6 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+ 		PATCH_SITE(pv_irq_ops, save_fl);
+ 		PATCH_SITE(pv_irq_ops, irq_enable);
+ 		PATCH_SITE(pv_irq_ops, irq_disable);
+-		PATCH_SITE(pv_cpu_ops, iret);
+ 		PATCH_SITE(pv_cpu_ops, irq_enable_sysexit);
+ 		PATCH_SITE(pv_cpu_ops, usergs_sysret32);
+ 		PATCH_SITE(pv_cpu_ops, usergs_sysret64);
+diff --git a/arch/x86/kernel/resource.c b/arch/x86/kernel/resource.c
+index 2a26819..80eab01 100644
+--- a/arch/x86/kernel/resource.c
++++ b/arch/x86/kernel/resource.c
+@@ -37,10 +37,12 @@ static void remove_e820_regions(struct resource *avail)
+ 
+ void arch_remove_reservations(struct resource *avail)
+ {
+-	/* Trim out BIOS areas (low 1MB and high 2MB) and E820 regions */
++	/*
++	 * Trim out BIOS area (high 2MB) and E820 regions. We do not remove
++	 * the low 1MB unconditionally, as this area is needed for some ISA
++	 * cards requiring a memory range, e.g. the i82365 PCMCIA controller.
++	 */
+ 	if (avail->flags & IORESOURCE_MEM) {
+-		if (avail->start < BIOS_END)
+-			avail->start = BIOS_END;
+ 		resource_clip(avail, BIOS_ROM_BASE, BIOS_ROM_END);
+ 
+ 		remove_e820_regions(avail);
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index b88eadb..6e68bd9 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -266,6 +266,13 @@ notrace static void __cpuinit start_secondary(void *unused)
+ 	check_tsc_sync_target();
+ 
+ 	/*
++	 * Enable the espfix hack for this CPU
++	 */
++#ifdef CONFIG_X86_ESPFIX64
++	init_espfix_ap();
++#endif
++
++	/*
+ 	 * We need to hold call_lock, so there is no inconsistency
+ 	 * between the time smp_call_function() determines number of
+ 	 * IPI recipients, and the time when the determination is made
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index f5302da..638cab5 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -1818,6 +1818,7 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ {
+ 	int rc;
+ 	unsigned long cs;
++	int cpl = ctxt->ops->cpl(ctxt);
+ 
+ 	rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes);
+ 	if (rc != X86EMUL_CONTINUE)
+@@ -1827,6 +1828,9 @@ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ 	rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
+ 	if (rc != X86EMUL_CONTINUE)
+ 		return rc;
++	/* Outer-privilege level return is not implemented */
++	if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
++		return X86EMUL_UNHANDLEABLE;
+ 	rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS);
+ 	return rc;
+ }
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index 0002a3a..e04e677 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -30,11 +30,13 @@ struct pg_state {
+ 	unsigned long start_address;
+ 	unsigned long current_address;
+ 	const struct addr_marker *marker;
++	unsigned long lines;
+ };
+ 
+ struct addr_marker {
+ 	unsigned long start_address;
+ 	const char *name;
++	unsigned long max_lines;
+ };
+ 
+ /* indices for address_markers; keep sync'd w/ address_markers below */
+@@ -45,6 +47,7 @@ enum address_markers_idx {
+ 	LOW_KERNEL_NR,
+ 	VMALLOC_START_NR,
+ 	VMEMMAP_START_NR,
++	ESPFIX_START_NR,
+ 	HIGH_KERNEL_NR,
+ 	MODULES_VADDR_NR,
+ 	MODULES_END_NR,
+@@ -67,6 +70,7 @@ static struct addr_marker address_markers[] = {
+ 	{ PAGE_OFFSET,		"Low Kernel Mapping" },
+ 	{ VMALLOC_START,        "vmalloc() Area" },
+ 	{ VMEMMAP_START,        "Vmemmap" },
++	{ ESPFIX_BASE_ADDR,	"ESPfix Area", 16 },
+ 	{ __START_KERNEL_map,   "High Kernel Mapping" },
+ 	{ MODULES_VADDR,        "Modules" },
+ 	{ MODULES_END,          "End Modules" },
+@@ -163,7 +167,7 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ 		      pgprot_t new_prot, int level)
+ {
+ 	pgprotval_t prot, cur;
+-	static const char units[] = "KMGTPE";
++	static const char units[] = "BKMGTPE";
+ 
+ 	/*
+ 	 * If we have a "break" in the series, we need to flush the state that
+@@ -178,6 +182,7 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ 		st->current_prot = new_prot;
+ 		st->level = level;
+ 		st->marker = address_markers;
++		st->lines = 0;
+ 		seq_printf(m, "---[ %s ]---\n", st->marker->name);
+ 	} else if (prot != cur || level != st->level ||
+ 		   st->current_address >= st->marker[1].start_address) {
+@@ -188,17 +193,21 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ 		/*
+ 		 * Now print the actual finished series
+ 		 */
+-		seq_printf(m, "0x%0*lx-0x%0*lx   ",
+-			   width, st->start_address,
+-			   width, st->current_address);
+-
+-		delta = (st->current_address - st->start_address) >> 10;
+-		while (!(delta & 1023) && unit[1]) {
+-			delta >>= 10;
+-			unit++;
++		if (!st->marker->max_lines ||
++		    st->lines < st->marker->max_lines) {
++			seq_printf(m, "0x%0*lx-0x%0*lx   ",
++				   width, st->start_address,
++				   width, st->current_address);
++
++			delta = (st->current_address - st->start_address);
++			while (!(delta & 1023) && unit[1]) {
++				delta >>= 10;
++				unit++;
++			}
++			seq_printf(m, "%9lu%c ", delta, *unit);
++			printk_prot(m, st->current_prot, st->level);
+ 		}
+-		seq_printf(m, "%9lu%c ", delta, *unit);
+-		printk_prot(m, st->current_prot, st->level);
++		st->lines++;
+ 
+ 		/*
+ 		 * We print markers for special areas of address space,
+@@ -206,7 +215,15 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ 		 * This helps in the interpretation.
+ 		 */
+ 		if (st->current_address >= st->marker[1].start_address) {
++			if (st->marker->max_lines &&
++			    st->lines > st->marker->max_lines) {
++				unsigned long nskip =
++					st->lines - st->marker->max_lines;
++				seq_printf(m, "... %lu entr%s skipped ... \n",
++					   nskip, nskip == 1 ? "y" : "ies");
++			}
+ 			st->marker++;
++			st->lines = 0;
+ 			seq_printf(m, "---[ %s ]---\n", st->marker->name);
+ 		}
+ 
+diff --git a/arch/x86/pci/i386.c b/arch/x86/pci/i386.c
+index 794b092..2d3c854 100644
+--- a/arch/x86/pci/i386.c
++++ b/arch/x86/pci/i386.c
+@@ -73,6 +73,10 @@ pcibios_align_resource(void *data, const struct resource *res,
+ 			return start;
+ 		if (start & 0x300)
+ 			start = (start + 0x3ff) & ~0x3ff;
++	} else if (res->flags & IORESOURCE_MEM) {
++		/* The low 1MB range is reserved for ISA cards */
++		if (start < BIOS_END)
++			start = BIOS_END;
+ 	}
+ 	return start;
+ }
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index 51bdc05..468d591 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,7 +41,6 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled			sysctl_vsyscall32
+ #define arch_setup_additional_pages	syscall32_setup_pages
+-extern int sysctl_ldt16;
+ #endif
+ 
+ /*
+@@ -389,13 +388,6 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
+-	{
+-		.procname	= "ldt16",
+-		.data		= &sysctl_ldt16,
+-		.maxlen		= sizeof(int),
+-		.mode		= 0644,
+-		.proc_handler	= proc_dointvec
+-	},
+ 	{}
+ };
+ 
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index d50a821..1a82319 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -397,7 +397,7 @@ void xen_setup_timer(int cpu)
+ 	irq = bind_virq_to_irqhandler(VIRQ_TIMER, cpu, xen_timer_interrupt,
+ 				      IRQF_DISABLED|IRQF_PERCPU|
+ 				      IRQF_NOBALANCING|IRQF_TIMER|
+-				      IRQF_FORCE_RESUME,
++				      IRQF_FORCE_RESUME|IRQF_EARLY_RESUME,
+ 				      name, NULL);
+ 
+ 	evt = &per_cpu(xen_clock_events, cpu);
+diff --git a/block/blk-tag.c b/block/blk-tag.c
+index 4af6f5c..f606487 100644
+--- a/block/blk-tag.c
++++ b/block/blk-tag.c
+@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struct request_queue *q, int tag)
+ EXPORT_SYMBOL(blk_queue_find_tag);
+ 
+ /**
+- * __blk_free_tags - release a given set of tag maintenance info
++ * blk_free_tags - release a given set of tag maintenance info
+  * @bqt:	the tag map to free
+  *
+- * Tries to free the specified @bqt.  Returns true if it was
+- * actually freed and false if there are still references using it
++ * Drop the reference count on @bqt and frees it when the last reference
++ * is dropped.
+  */
+-static int __blk_free_tags(struct blk_queue_tag *bqt)
++void blk_free_tags(struct blk_queue_tag *bqt)
+ {
+-	int retval;
+-
+-	retval = atomic_dec_and_test(&bqt->refcnt);
+-	if (retval) {
++	if (atomic_dec_and_test(&bqt->refcnt)) {
+ 		BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
+ 							bqt->max_depth);
+ 
+@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_queue_tag *bqt)
+ 
+ 		kfree(bqt);
+ 	}
+-
+-	return retval;
+ }
++EXPORT_SYMBOL(blk_free_tags);
+ 
+ /**
+  * __blk_queue_free_tags - release tag maintenance info
+@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct request_queue *q)
+ 	if (!bqt)
+ 		return;
+ 
+-	__blk_free_tags(bqt);
++	blk_free_tags(bqt);
+ 
+ 	q->queue_tags = NULL;
+ 	queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
+ }
+ 
+ /**
+- * blk_free_tags - release a given set of tag maintenance info
+- * @bqt:	the tag map to free
+- *
+- * For externally managed @bqt frees the map.  Callers of this
+- * function must guarantee to have released all the queues that
+- * might have been using this tag map.
+- */
+-void blk_free_tags(struct blk_queue_tag *bqt)
+-{
+-	if (unlikely(!__blk_free_tags(bqt)))
+-		BUG();
+-}
+-EXPORT_SYMBOL(blk_free_tags);
+-
+-/**
+  * blk_queue_free_tags - release tag maintenance info
+  * @q:  the request queue for the device
+  *
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ac33d5f..bf948e1 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -21,6 +21,7 @@
+ #include <linux/module.h>
+ #include <linux/net.h>
+ #include <linux/rwsem.h>
++#include <linux/security.h>
+ 
+ struct alg_type_list {
+ 	const struct af_alg_type *type;
+@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+ 
+ 	sock_init_data(newsock, sk2);
+ 	sock_graft(sk2, newsock);
++	security_sk_clone(sk, sk2);
+ 
+ 	err = type->accept(ask->private, sk2);
+ 	if (err) {
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 48fd158..05df096 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -193,6 +193,8 @@ static bool advance_transaction(struct acpi_ec *ec)
+ 				t->rdata[t->ri++] = acpi_ec_read_data(ec);
+ 				if (t->rlen == t->ri) {
+ 					t->flags |= ACPI_EC_COMMAND_COMPLETE;
++					if (t->command == ACPI_EC_COMMAND_QUERY)
++						pr_debug("hardware QR_EC completion\n");
+ 					wakeup = true;
+ 				}
+ 			} else
+@@ -204,7 +206,20 @@ static bool advance_transaction(struct acpi_ec *ec)
+ 		}
+ 		return wakeup;
+ 	} else {
+-		if ((status & ACPI_EC_FLAG_IBF) == 0) {
++		/*
++		 * There is firmware refusing to respond QR_EC when SCI_EVT
++		 * is not set, for which case, we complete the QR_EC
++		 * without issuing it to the firmware.
++		 * https://bugzilla.kernel.org/show_bug.cgi?id=86211
++		 */
++		if (!(status & ACPI_EC_FLAG_SCI) &&
++		    (t->command == ACPI_EC_COMMAND_QUERY)) {
++			t->flags |= ACPI_EC_COMMAND_POLL;
++			t->rdata[t->ri++] = 0x00;
++			t->flags |= ACPI_EC_COMMAND_COMPLETE;
++			pr_debug("software QR_EC completion\n");
++			wakeup = true;
++		} else if ((status & ACPI_EC_FLAG_IBF) == 0) {
+ 			acpi_ec_write_cmd(ec, t->command);
+ 			t->flags |= ACPI_EC_COMMAND_POLL;
+ 		} else
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 44a4434..43b0acf 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -463,6 +463,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 
+ 	/* Promise */
+ 	{ PCI_VDEVICE(PROMISE, 0x3f20), board_ahci },	/* PDC42819 */
++	{ PCI_VDEVICE(PROMISE, 0x3781), board_ahci },   /* FastTrak TX8660 ahci-mode */
+ 
+ 	/* Asmedia */
+ 	{ PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci },	/* ASM1060 */
+diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
+index e265f83..19759d3 100644
+--- a/drivers/ata/pata_scc.c
++++ b/drivers/ata/pata_scc.c
+@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct ata_link *link, unsigned int devmask,
+  *	Note: Original code is ata_bus_softreset().
+  */
+ 
+-static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
++static int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
+                                       unsigned long deadline)
+ {
+ 	struct ata_ioports *ioaddr = &ap->ioaddr;
+@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
+ 	udelay(20);
+ 	out_be32(ioaddr->ctl_addr, ap->ctl);
+ 
+-	scc_wait_after_reset(&ap->link, devmask, deadline);
+-
+-	return 0;
++	return scc_wait_after_reset(&ap->link, devmask, deadline);
+ }
+ 
+ /**
+@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes,
+ {
+ 	struct ata_port *ap = link->ap;
+ 	unsigned int slave_possible = ap->flags & ATA_FLAG_SLAVE_POSS;
+-	unsigned int devmask = 0, err_mask;
++	unsigned int devmask = 0;
++	int rc;
+ 	u8 err;
+ 
+ 	DPRINTK("ENTER\n");
+@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes,
+ 
+ 	/* issue bus reset */
+ 	DPRINTK("about to softreset, devmask=%x\n", devmask);
+-	err_mask = scc_bus_softreset(ap, devmask, deadline);
+-	if (err_mask) {
+-		ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", err_mask);
++	rc = scc_bus_softreset(ap, devmask, deadline);
++	if (rc) {
++		ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", rc);
+ 		return -EIO;
+ 	}
+ 
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index 0d91655..c234b9e 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -533,11 +533,10 @@ EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
+ void tpm_get_timeouts(struct tpm_chip *chip)
+ {
+ 	struct tpm_cmd_t tpm_cmd;
+-	struct timeout_t *timeout_cap;
++	unsigned long new_timeout[4];
++	unsigned long old_timeout[4];
+ 	struct duration_t *duration_cap;
+ 	ssize_t rc;
+-	u32 timeout;
+-	unsigned int scale = 1;
+ 
+ 	tpm_cmd.header.in = tpm_getcap_header;
+ 	tpm_cmd.params.getcap_in.cap = TPM_CAP_PROP;
+@@ -554,25 +553,46 @@ void tpm_get_timeouts(struct tpm_chip *chip)
+ 	    != sizeof(tpm_cmd.header.out) + sizeof(u32) + 4 * sizeof(u32))
+ 		return;
+ 
+-	timeout_cap = &tpm_cmd.params.getcap_out.cap.timeout;
+-	/* Don't overwrite default if value is 0 */
+-	timeout = be32_to_cpu(timeout_cap->a);
+-	if (timeout && timeout < 1000) {
+-		/* timeouts in msec rather usec */
+-		scale = 1000;
+-		chip->vendor.timeout_adjusted = true;
++	old_timeout[0] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.a);
++	old_timeout[1] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.b);
++	old_timeout[2] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.c);
++	old_timeout[3] = be32_to_cpu(tpm_cmd.params.getcap_out.cap.timeout.d);
++	memcpy(new_timeout, old_timeout, sizeof(new_timeout));
++
++	/*
++	 * Provide ability for vendor overrides of timeout values in case
++	 * of misreporting.
++	 */
++	if (chip->vendor.update_timeouts != NULL)
++		chip->vendor.timeout_adjusted =
++			chip->vendor.update_timeouts(chip, new_timeout);
++
++	if (!chip->vendor.timeout_adjusted) {
++		/* Don't overwrite default if value is 0 */
++		if (new_timeout[0] != 0 && new_timeout[0] < 1000) {
++			int i;
++
++			/* timeouts in msec rather usec */
++			for (i = 0; i != ARRAY_SIZE(new_timeout); i++)
++				new_timeout[i] *= 1000;
++			chip->vendor.timeout_adjusted = true;
++		}
+ 	}
+-	if (timeout)
+-		chip->vendor.timeout_a = usecs_to_jiffies(timeout * scale);
+-	timeout = be32_to_cpu(timeout_cap->b);
+-	if (timeout)
+-		chip->vendor.timeout_b = usecs_to_jiffies(timeout * scale);
+-	timeout = be32_to_cpu(timeout_cap->c);
+-	if (timeout)
+-		chip->vendor.timeout_c = usecs_to_jiffies(timeout * scale);
+-	timeout = be32_to_cpu(timeout_cap->d);
+-	if (timeout)
+-		chip->vendor.timeout_d = usecs_to_jiffies(timeout * scale);
++
++	/* Report adjusted timeouts */
++	if (chip->vendor.timeout_adjusted) {
++		dev_info(chip->dev,
++			 HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n",
++			 old_timeout[0], new_timeout[0],
++			 old_timeout[1], new_timeout[1],
++			 old_timeout[2], new_timeout[2],
++			 old_timeout[3], new_timeout[3]);
++	}
++
++	chip->vendor.timeout_a = usecs_to_jiffies(new_timeout[0]);
++	chip->vendor.timeout_b = usecs_to_jiffies(new_timeout[1]);
++	chip->vendor.timeout_c = usecs_to_jiffies(new_timeout[2]);
++	chip->vendor.timeout_d = usecs_to_jiffies(new_timeout[3]);
+ 
+ duration:
+ 	tpm_cmd.header.in = tpm_getcap_header;
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 9c4163c..befbe67 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -80,6 +80,9 @@ struct tpm_vendor_specific {
+ 	int (*send) (struct tpm_chip *, u8 *, size_t);
+ 	void (*cancel) (struct tpm_chip *);
+ 	u8 (*status) (struct tpm_chip *);
++	bool (*update_timeouts)(struct tpm_chip *chip,
++				unsigned long *timeout_cap);
++
+ 	void (*release) (struct device *);
+ 	struct miscdevice miscdev;
+ 	struct attribute_group *attr_group;
+diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
+index c7e5282..f8e94fe 100644
+--- a/drivers/char/tpm/tpm_tis.c
++++ b/drivers/char/tpm/tpm_tis.c
+@@ -396,6 +396,36 @@ out_err:
+ 	return rc;
+ }
+ 
++struct tis_vendor_timeout_override {
++	u32 did_vid;
++	unsigned long timeout_us[4];
++};
++
++static const struct tis_vendor_timeout_override vendor_timeout_overrides[] = {
++	/* Atmel 3204 */
++	{ 0x32041114, { (TIS_SHORT_TIMEOUT*1000), (TIS_LONG_TIMEOUT*1000),
++			(TIS_SHORT_TIMEOUT*1000), (TIS_SHORT_TIMEOUT*1000) } },
++};
++
++static bool tpm_tis_update_timeouts(struct tpm_chip *chip,
++				    unsigned long *timeout_cap)
++{
++	int i;
++	u32 did_vid;
++
++	did_vid = ioread32(chip->vendor.iobase + TPM_DID_VID(0));
++
++	for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) {
++		if (vendor_timeout_overrides[i].did_vid != did_vid)
++			continue;
++		memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us,
++		       sizeof(vendor_timeout_overrides[i].timeout_us));
++		return true;
++	}
++
++	return false;
++}
++
+ /*
+  * Early probing for iTPM with STS_DATA_EXPECT flaw.
+  * Try sending command without itpm flag set and if that
+@@ -483,6 +513,7 @@ static struct tpm_vendor_specific tpm_tis = {
+ 	.recv = tpm_tis_recv,
+ 	.send = tpm_tis_send,
+ 	.cancel = tpm_tis_ready,
++	.update_timeouts = tpm_tis_update_timeouts,
+ 	.req_complete_mask = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ 	.req_complete_val = TPM_STS_DATA_AVAIL | TPM_STS_VALID,
+ 	.req_canceled = TPM_STS_COMMAND_READY,
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 5efba47..9b3f787 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -2765,6 +2765,7 @@ static u32 evergreen_get_ih_wptr(struct radeon_device *rdev)
+ 		tmp = RREG32(IH_RB_CNTL);
+ 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ 		WREG32(IH_RB_CNTL, tmp);
++		wptr &= ~RB_OVERFLOW;
+ 	}
+ 	return (wptr & rdev->ih.ptr_mask);
+ }
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index f7e3cc0..ab46a99 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3280,6 +3280,7 @@ static u32 r600_get_ih_wptr(struct radeon_device *rdev)
+ 		tmp = RREG32(IH_RB_CNTL);
+ 		tmp |= IH_WPTR_OVERFLOW_CLEAR;
+ 		WREG32(IH_RB_CNTL, tmp);
++		wptr &= ~RB_OVERFLOW;
+ 	}
+ 	return (wptr & rdev->ih.ptr_mask);
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index e4e455e..6d9c32b 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -1873,7 +1873,7 @@ static const char *thermal_controller_names[] = {
+ 	"adm1032",
+ 	"adm1030",
+ 	"max6649",
+-	"lm64",
++	"lm63", /* lm64 */
+ 	"f75375",
+ 	"asc7xxx",
+ };
+@@ -1884,7 +1884,7 @@ static const char *pp_lib_thermal_controller_names[] = {
+ 	"adm1032",
+ 	"adm1030",
+ 	"max6649",
+-	"lm64",
++	"lm63", /* lm64 */
+ 	"f75375",
+ 	"RV6xx",
+ 	"RV770",
+diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+index 9e4313e..508c64c 100644
+--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
+@@ -398,13 +398,18 @@ static int ttm_pool_get_num_unused_pages(void)
+ static int ttm_pool_mm_shrink(struct shrinker *shrink,
+ 			      struct shrink_control *sc)
+ {
+-	static atomic_t start_pool = ATOMIC_INIT(0);
++	static DEFINE_MUTEX(lock);
++	static unsigned start_pool;
+ 	unsigned i;
+-	unsigned pool_offset = atomic_add_return(1, &start_pool);
++	unsigned pool_offset;
+ 	struct ttm_page_pool *pool;
+ 	int shrink_pages = sc->nr_to_scan;
+ 
+-	pool_offset = pool_offset % NUM_POOLS;
++	if (shrink_pages == 0)
++		goto out;
++	if (!mutex_trylock(&lock))
++		return -1;
++	pool_offset = ++start_pool % NUM_POOLS;
+ 	/* select start pool in round robin fashion */
+ 	for (i = 0; i < NUM_POOLS; ++i) {
+ 		unsigned nr_free = shrink_pages;
+@@ -413,6 +418,8 @@ static int ttm_pool_mm_shrink(struct shrinker *shrink,
+ 		pool = &_manager->pools[(i + pool_offset)%NUM_POOLS];
+ 		shrink_pages = ttm_page_pool_free(pool, nr_free);
+ 	}
++	mutex_unlock(&lock);
++out:
+ 	/* return estimated number of unused pages in pool */
+ 	return ttm_pool_get_num_unused_pages();
+ }
+diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
+index 888ece6..f870bb3 100644
+--- a/drivers/hid/hid-cherry.c
++++ b/drivers/hid/hid-cherry.c
+@@ -29,7 +29,7 @@
+ static __u8 *ch_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	if (*rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
++	if (*rsize >= 18 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
+ 		hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");
+ 		rdesc[11] = rdesc[16] = 0xff;
+ 		rdesc[12] = rdesc[17] = 0x03;
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index f2ba9ef..25dfb5f 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -26,7 +26,7 @@
+ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	if (*rsize >= 74 &&
++	if (*rsize >= 75 &&
+ 		rdesc[61] == 0x05 && rdesc[62] == 0x08 &&
+ 		rdesc[63] == 0x19 && rdesc[64] == 0x08 &&
+ 		rdesc[65] == 0x29 && rdesc[66] == 0x0f &&
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index e7a7bd1..3ad6cd4 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -111,14 +111,14 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ {
+ 	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+ 
+-	if ((quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
++	if ((quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
+ 			rdesc[84] == 0x8c && rdesc[85] == 0x02) {
+ 		hid_info(hdev,
+ 			 "fixing up Logitech keyboard report descriptor\n");
+ 		rdesc[84] = rdesc[89] = 0x4d;
+ 		rdesc[85] = rdesc[90] = 0x10;
+ 	}
+-	if ((quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&
++	if ((quirks & LG_RDESC_REL_ABS) && *rsize >= 51 &&
+ 			rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
+ 			rdesc[49] == 0x81 && rdesc[50] == 0x06) {
+ 		hid_info(hdev,
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 828a0dd..488a21a 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -230,13 +230,6 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ 		return;
+ 	}
+ 
+-	if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
+-	    (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
+-		dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n",
+-			__func__, dj_report->device_index);
+-		return;
+-	}
+-
+ 	if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+ 		/* The device is already known. No need to reallocate it. */
+ 		dbg_hid("%s: device is already known\n", __func__);
+@@ -686,7 +679,6 @@ static int logi_dj_raw_event(struct hid_device *hdev,
+ 	struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
+ 	struct dj_report *dj_report = (struct dj_report *) data;
+ 	unsigned long flags;
+-	bool report_processed = false;
+ 
+ 	dbg_hid("%s, size:%d\n", __func__, size);
+ 
+@@ -714,27 +706,41 @@ static int logi_dj_raw_event(struct hid_device *hdev,
+ 	 * anything else with it.
+ 	 */
+ 
++	/* case 1) */
++	if (data[0] != REPORT_ID_DJ_SHORT)
++		return false;
++
++	if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
++	    (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
++		/*
++		 * Device index is wrong, bail out.
++		 * This driver can ignore safely the receiver notifications,
++		 * so ignore those reports too.
++		 */
++		if (dj_report->device_index != DJ_RECEIVER_INDEX)
++			dev_err(&hdev->dev, "%s: invalid device index:%d\n",
++				__func__, dj_report->device_index);
++		return false;
++	}
++
+ 	spin_lock_irqsave(&djrcv_dev->lock, flags);
+-	if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
+-		switch (dj_report->report_type) {
+-		case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
+-		case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
+-			logi_dj_recv_queue_notification(djrcv_dev, dj_report);
+-			break;
+-		case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
+-			if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
+-			    STATUS_LINKLOSS) {
+-				logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
+-			}
+-			break;
+-		default:
+-			logi_dj_recv_forward_report(djrcv_dev, dj_report);
++	switch (dj_report->report_type) {
++	case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
++	case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
++		logi_dj_recv_queue_notification(djrcv_dev, dj_report);
++		break;
++	case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
++		if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
++		    STATUS_LINKLOSS) {
++			logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
+ 		}
+-		report_processed = true;
++		break;
++	default:
++		logi_dj_recv_forward_report(djrcv_dev, dj_report);
+ 	}
+ 	spin_unlock_irqrestore(&djrcv_dev->lock, flags);
+ 
+-	return report_processed;
++	return true;
+ }
+ 
+ static int logi_dj_probe(struct hid_device *hdev,
+diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
+index 4a40003..daeb0aa 100644
+--- a/drivers/hid/hid-logitech-dj.h
++++ b/drivers/hid/hid-logitech-dj.h
+@@ -27,6 +27,7 @@
+ 
+ #define DJ_MAX_PAIRED_DEVICES			6
+ #define DJ_MAX_NUMBER_NOTIFICATIONS		8
++#define DJ_RECEIVER_INDEX			0
+ #define DJ_DEVICE_INDEX_MIN 			1
+ #define DJ_DEVICE_INDEX_MAX 			6
+ 
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index 7cf3ffe..81356f6 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -308,6 +308,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+ 		if (size < 4 || ((size - 4) % 9) != 0)
+ 			return 0;
+ 		npoints = (size - 4) / 9;
++		if (npoints > 15) {
++			hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
++					size);
++			return 0;
++		}
+ 		msc->ntouches = 0;
+ 		for (ii = 0; ii < npoints; ii++)
+ 			magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
+@@ -331,6 +336,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+ 		if (size < 6 || ((size - 6) % 8) != 0)
+ 			return 0;
+ 		npoints = (size - 6) / 8;
++		if (npoints > 15) {
++			hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
++					size);
++			return 0;
++		}
+ 		msc->ntouches = 0;
+ 		for (ii = 0; ii < npoints; ii++)
+ 			magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
+diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
+index dedf757..eb0271e 100644
+--- a/drivers/hid/hid-monterey.c
++++ b/drivers/hid/hid-monterey.c
+@@ -25,7 +25,7 @@
+ static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
++	if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
+ 		hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
+ 		rdesc[30] = 0x0c;
+ 	}
+diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
+index f1ea3ff..99f317a 100644
+--- a/drivers/hid/hid-petalynx.c
++++ b/drivers/hid/hid-petalynx.c
+@@ -26,7 +26,7 @@
+ static __u8 *pl_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	if (*rsize >= 60 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
++	if (*rsize >= 62 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
+ 			rdesc[41] == 0x00 && rdesc[59] == 0x26 &&
+ 			rdesc[60] == 0xf9 && rdesc[61] == 0x00) {
+ 		hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");
+diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
+index 1daeaca..c952131 100644
+--- a/drivers/hid/hid-picolcd.c
++++ b/drivers/hid/hid-picolcd.c
+@@ -2382,6 +2382,12 @@ static int picolcd_raw_event(struct hid_device *hdev,
+ 	if (!data)
+ 		return 1;
+ 
++	if (size > 64) {
++		hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
++				size);
++		return 0;
++	}
++
+ 	if (report->id == REPORT_KEY_STATE) {
+ 		if (data->input_keys)
+ 			ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
+diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
+index d484a00..3d6ae7b 100644
+--- a/drivers/hid/hid-sunplus.c
++++ b/drivers/hid/hid-sunplus.c
+@@ -25,7 +25,7 @@
+ static __u8 *sp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	if (*rsize >= 107 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
++	if (*rsize >= 112 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
+ 			rdesc[106] == 0x03) {
+ 		hid_info(hdev, "fixing up Sunplus Wireless Desktop report descriptor\n");
+ 		rdesc[105] = rdesc[110] = 0x03;
+diff --git a/drivers/hwmon/ads1015.c b/drivers/hwmon/ads1015.c
+index dd87ae9..2f14cad 100644
+--- a/drivers/hwmon/ads1015.c
++++ b/drivers/hwmon/ads1015.c
+@@ -186,7 +186,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
+ 		}
+ 
+ 		channel = be32_to_cpup(property);
+-		if (channel > ADS1015_CHANNELS) {
++		if (channel >= ADS1015_CHANNELS) {
+ 			dev_err(&client->dev,
+ 				"invalid channel index %d on %s\n",
+ 				channel, node->full_name);
+@@ -200,6 +200,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
+ 				dev_err(&client->dev,
+ 					"invalid gain on %s\n",
+ 					node->full_name);
++				return -EINVAL;
+ 			}
+ 		}
+ 
+@@ -210,6 +211,7 @@ static int ads1015_get_channels_config_of(struct i2c_client *client)
+ 				dev_err(&client->dev,
+ 					"invalid data_rate on %s\n",
+ 					node->full_name);
++				return -EINVAL;
+ 			}
+ 		}
+ 
+diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
+index 75be6c4..b7f3356 100644
+--- a/drivers/hwmon/amc6821.c
++++ b/drivers/hwmon/amc6821.c
+@@ -360,11 +360,13 @@ static ssize_t set_pwm1_enable(
+ 	if (config)
+ 		return config;
+ 
++	mutex_lock(&data->update_lock);
+ 	config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF1);
+ 	if (config < 0) {
+ 			dev_err(&client->dev,
+ 			"Error reading configuration register, aborting.\n");
+-			return -EIO;
++			count = config;
++			goto unlock;
+ 	}
+ 
+ 	switch (val) {
+@@ -381,14 +383,15 @@ static ssize_t set_pwm1_enable(
+ 		config |= AMC6821_CONF1_FDRC1;
+ 		break;
+ 	default:
+-		return -EINVAL;
++		count = -EINVAL;
++		goto unlock;
+ 	}
+-	mutex_lock(&data->update_lock);
+ 	if (i2c_smbus_write_byte_data(client, AMC6821_REG_CONF1, config)) {
+ 			dev_err(&client->dev,
+ 			"Configuration register write error, aborting.\n");
+ 			count = -EIO;
+ 	}
++unlock:
+ 	mutex_unlock(&data->update_lock);
+ 	return count;
+ }
+@@ -495,8 +498,9 @@ static ssize_t set_temp_auto_point_temp(
+ 		return -EINVAL;
+ 	}
+ 
+-	data->valid = 0;
+ 	mutex_lock(&data->update_lock);
++	data->valid = 0;
++
+ 	switch (ix) {
+ 	case 0:
+ 		ptemp[0] = SENSORS_LIMIT(val / 1000, 0,
+@@ -669,13 +673,14 @@ static ssize_t set_fan1_div(
+ 	if (config)
+ 		return config;
+ 
++	mutex_lock(&data->update_lock);
+ 	config = i2c_smbus_read_byte_data(client, AMC6821_REG_CONF4);
+ 	if (config < 0) {
+ 		dev_err(&client->dev,
+ 			"Error reading configuration register, aborting.\n");
+-		return -EIO;
++		count = config;
++		goto EXIT;
+ 	}
+-	mutex_lock(&data->update_lock);
+ 	switch (val) {
+ 	case 2:
+ 		config &= ~AMC6821_CONF4_PSPR;
+diff --git a/drivers/hwmon/gpio-fan.c b/drivers/hwmon/gpio-fan.c
+index 9ba38f3..05c4f47 100644
+--- a/drivers/hwmon/gpio-fan.c
++++ b/drivers/hwmon/gpio-fan.c
+@@ -195,7 +195,7 @@ static int get_fan_speed_index(struct gpio_fan_data *fan_data)
+ 	return -EINVAL;
+ }
+ 
+-static int rpm_to_speed_index(struct gpio_fan_data *fan_data, int rpm)
++static int rpm_to_speed_index(struct gpio_fan_data *fan_data, unsigned long rpm)
+ {
+ 	struct gpio_fan_speed *speed = fan_data->speed;
+ 	int i;
+diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
+index a42a7b0..5ce5d5a 100644
+--- a/drivers/hwmon/lm78.c
++++ b/drivers/hwmon/lm78.c
+@@ -102,7 +102,7 @@ static inline int FAN_FROM_REG(u8 val, int div)
+ 
+ /* TEMP: mC (-128C to +127C)
+    REG: 1C/bit, two's complement */
+-static inline s8 TEMP_TO_REG(int val)
++static inline s8 TEMP_TO_REG(long val)
+ {
+ 	int nval = SENSORS_LIMIT(val, -128000, 127000) ;
+ 	return nval<0 ? (nval-500)/1000 : (nval+500)/1000;
+diff --git a/drivers/hwmon/lm85.c b/drivers/hwmon/lm85.c
+index da72dc1..97bfba2 100644
+--- a/drivers/hwmon/lm85.c
++++ b/drivers/hwmon/lm85.c
+@@ -157,7 +157,7 @@ static inline u16 FAN_TO_REG(unsigned long val)
+ 
+ /* Temperature is reported in .001 degC increments */
+ #define TEMP_TO_REG(val)	\
+-		SENSORS_LIMIT(SCALE(val, 1000, 1), -127, 127)
++		DIV_ROUND_CLOSEST(SENSORS_LIMIT((val), -127000, 127000), 1000)
+ #define TEMPEXT_FROM_REG(val, ext)	\
+ 		SCALE(((val) << 4) + (ext), 16, 1000)
+ #define TEMP_FROM_REG(val)	((val) * 1000)
+@@ -190,7 +190,7 @@ static const int lm85_range_map[] = {
+ 	13300, 16000, 20000, 26600, 32000, 40000, 53300, 80000
+ };
+ 
+-static int RANGE_TO_REG(int range)
++static int RANGE_TO_REG(long range)
+ {
+ 	int i;
+ 
+@@ -212,7 +212,7 @@ static const int adm1027_freq_map[8] = { /* 1 Hz */
+ 	11, 15, 22, 29, 35, 44, 59, 88
+ };
+ 
+-static int FREQ_TO_REG(const int *map, int freq)
++static int FREQ_TO_REG(const int *map, unsigned long freq)
+ {
+ 	int i;
+ 
+@@ -443,7 +443,13 @@ static ssize_t store_vrm_reg(struct device *dev, struct device_attribute *attr,
+ 		const char *buf, size_t count)
+ {
+ 	struct lm85_data *data = dev_get_drvdata(dev);
+-	data->vrm = simple_strtoul(buf, NULL, 10);
++	unsigned long val;
++
++	val = simple_strtoul(buf, NULL, 10);
++	if (val > 255)
++		return -EINVAL;
++
++	data->vrm = val;
+ 	return count;
+ }
+ 
+diff --git a/drivers/hwmon/lm92.c b/drivers/hwmon/lm92.c
+index 8fcbd4d4..5d091fa 100644
+--- a/drivers/hwmon/lm92.c
++++ b/drivers/hwmon/lm92.c
+@@ -73,12 +73,9 @@ static inline int TEMP_FROM_REG(s16 reg)
+ 	return reg / 8 * 625 / 10;
+ }
+ 
+-static inline s16 TEMP_TO_REG(int val)
++static inline s16 TEMP_TO_REG(long val)
+ {
+-	if (val <= -60000)
+-		return -60000 * 10 / 625 * 8;
+-	if (val >= 160000)
+-		return 160000 * 10 / 625 * 8;
++	val = clamp_val(val, -60000, 160000);
+ 	return val * 10 / 625 * 8;
+ }
+ 
+@@ -192,10 +189,12 @@ static ssize_t set_temp1_crit_hyst(struct device *dev, struct device_attribute *
+ 	struct lm92_data *data = i2c_get_clientdata(client);
+ 	long val = simple_strtol(buf, NULL, 10);
+ 
++	val = clamp_val(val, -120000, 220000);
+ 	mutex_lock(&data->update_lock);
+-	data->temp1_hyst = TEMP_FROM_REG(data->temp1_crit) - val;
++	 data->temp1_hyst =
++		TEMP_TO_REG(TEMP_FROM_REG(data->temp1_crit) - val);
+ 	i2c_smbus_write_word_swapped(client, LM92_REG_TEMP_HYST,
+-				     TEMP_TO_REG(data->temp1_hyst));
++				     data->temp1_hyst);
+ 	mutex_unlock(&data->update_lock);
+ 	return count;
+ }
+diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c
+index 5ab6953..029a2e1 100644
+--- a/drivers/hwmon/sis5595.c
++++ b/drivers/hwmon/sis5595.c
+@@ -149,7 +149,7 @@ static inline int TEMP_FROM_REG(s8 val)
+ {
+ 	return val * 830 + 52120;
+ }
+-static inline s8 TEMP_TO_REG(int val)
++static inline s8 TEMP_TO_REG(long val)
+ {
+ 	int nval = SENSORS_LIMIT(val, -54120, 157530) ;
+ 	return nval<0 ? (nval-5212-415)/830 : (nval-5212+415)/830;
+diff --git a/drivers/hwmon/smsc47m192.c b/drivers/hwmon/smsc47m192.c
+index 40b2667..7d1373d 100644
+--- a/drivers/hwmon/smsc47m192.c
++++ b/drivers/hwmon/smsc47m192.c
+@@ -84,7 +84,7 @@ static inline u8 IN_TO_REG(unsigned long val, int n)
+    REG: 1C/bit, two's complement */
+ static inline s8 TEMP_TO_REG(int val)
+ {
+-	return SENSORS_LIMIT(SCALE(val, 1, 1000), -128000, 127000);
++	return SCALE(SENSORS_LIMIT(val, -128000, 127000), 1, 1000);
+ }
+ 
+ static inline int TEMP_FROM_REG(s8 val)
+@@ -349,7 +349,13 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr,
+ 		const char *buf, size_t count)
+ {
+ 	struct smsc47m192_data *data = dev_get_drvdata(dev);
+-	data->vrm = simple_strtoul(buf, NULL, 10);
++	unsigned long val;
++
++	val = simple_strtoul(buf, NULL, 10);
++	if (val > 255)
++		return -EINVAL;
++ 
++	data->vrm = val;
+ 	return count;
+ }
+ static DEVICE_ATTR(vrm, S_IRUGO | S_IWUSR, show_vrm, set_vrm);
+diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
+index 1a696f7..2882556 100644
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -46,6 +46,7 @@
+ #include <linux/completion.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
++#include <linux/sysctl.h>
+ 
+ #include <rdma/iw_cm.h>
+ #include <rdma/ib_addr.h>
+@@ -65,6 +66,20 @@ struct iwcm_work {
+ 	struct list_head free_list;
+ };
+ 
++static unsigned int default_backlog = 256;
++
++static struct ctl_table_header *iwcm_ctl_table_hdr;
++static struct ctl_table iwcm_ctl_table[] = {
++	{
++		.procname	= "default_backlog",
++		.data		= &default_backlog,
++		.maxlen		= sizeof(default_backlog),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec,
++	},
++	{ }
++};
++
+ /*
+  * The following services provide a mechanism for pre-allocating iwcm_work
+  * elements.  The design pre-allocates them  based on the cm_id type:
+@@ -419,6 +434,9 @@ int iw_cm_listen(struct iw_cm_id *cm_id, int backlog)
+ 
+ 	cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
+ 
++	if (!backlog)
++		backlog = default_backlog;
++
+ 	ret = alloc_work_entries(cm_id_priv, backlog);
+ 	if (ret)
+ 		return ret;
+@@ -1014,17 +1032,33 @@ int iw_cm_init_qp_attr(struct iw_cm_id *cm_id,
+ }
+ EXPORT_SYMBOL(iw_cm_init_qp_attr);
+ 
++static struct ctl_path iwcm_ctl_path[] = {
++	{ .procname = "net" },
++	{ .procname = "iw_cm" },
++	{ }
++};
++
+ static int __init iw_cm_init(void)
+ {
+ 	iwcm_wq = create_singlethread_workqueue("iw_cm_wq");
+ 	if (!iwcm_wq)
+ 		return -ENOMEM;
+ 
++	iwcm_ctl_table_hdr = register_net_sysctl_table(&init_net,
++						       iwcm_ctl_path,
++						       iwcm_ctl_table);
++	if (!iwcm_ctl_table_hdr) {
++		pr_err("iw_cm: couldn't register sysctl paths\n");
++		destroy_workqueue(iwcm_wq);
++		return -ENOMEM;
++	}
++
+ 	return 0;
+ }
+ 
+ static void __exit iw_cm_cleanup(void)
+ {
++	unregister_net_sysctl_table(iwcm_ctl_table_hdr);
+ 	destroy_workqueue(iwcm_wq);
+ }
+ 
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 6cc8e67..486982f 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2592,14 +2592,16 @@ free_domains:
+ 
+ static void cleanup_domain(struct protection_domain *domain)
+ {
+-	struct iommu_dev_data *dev_data, *next;
++	struct iommu_dev_data *entry;
+ 	unsigned long flags;
+ 
+ 	write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+ 
+-	list_for_each_entry_safe(dev_data, next, &domain->dev_list, list) {
+-		__detach_device(dev_data);
+-		atomic_set(&dev_data->bind, 0);
++	while (!list_empty(&domain->dev_list)) {
++		entry = list_first_entry(&domain->dev_list,
++					 struct iommu_dev_data, list);
++		__detach_device(entry);
++		atomic_set(&entry->bind, 0);
+ 	}
+ 
+ 	write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 276ef38..e83aa8e 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -2318,19 +2318,34 @@ static bool device_has_rmrr(struct pci_dev *dev)
+ 	return false;
+ }
+ 
++/*
++ * There are a couple cases where we need to restrict the functionality of
++ * devices associated with RMRRs.  The first is when evaluating a device for
++ * identity mapping because problems exist when devices are moved in and out
++ * of domains and their respective RMRR information is lost.  This means that
++ * a device with associated RMRRs will never be in a "passthrough" domain.
++ * The second is use of the device through the IOMMU API.  This interface
++ * expects to have full control of the IOVA space for the device.  We cannot
++ * satisfy both the requirement that RMRR access is maintained and have an
++ * unencumbered IOVA space.  We also have no ability to quiesce the device's
++ * use of the RMRR space or even inform the IOMMU API user of the restriction.
++ * We therefore prevent devices associated with an RMRR from participating in
++ * the IOMMU API, which eliminates them from device assignment.
++ *
++ * In both cases we assume that PCI USB devices with RMRRs have them largely
++ * for historical reasons and that the RMRR space is not actively used post
++ * boot.  This exclusion may change if vendors begin to abuse it.
++ */
++static bool device_is_rmrr_locked(struct pci_dev *pdev)
++{
++	return device_has_rmrr(pdev) &&
++		(pdev->class >> 8) != PCI_CLASS_SERIAL_USB;
++}
++
+ static int iommu_should_identity_map(struct pci_dev *pdev, int startup)
+ {
+ 
+-	/*
+-	 * We want to prevent any device associated with an RMRR from
+-	 * getting placed into the SI Domain. This is done because
+-	 * problems exist when devices are moved in and out of domains
+-	 * and their respective RMRR info is lost. We exempt USB devices
+-	 * from this process due to their usage of RMRRs that are known
+-	 * to not be needed after BIOS hand-off to OS.
+-	 */
+-	if (device_has_rmrr(pdev) &&
+-	    (pdev->class >> 8) != PCI_CLASS_SERIAL_USB)
++	if (device_is_rmrr_locked(pdev))
+ 		return 0;
+ 
+ 	if ((iommu_identity_mapping & IDENTMAP_AZALIA) && IS_AZALIA(pdev))
+@@ -3981,6 +3996,11 @@ static int intel_iommu_attach_device(struct iommu_domain *domain,
+ 	struct intel_iommu *iommu;
+ 	int addr_width;
+ 
++	if (device_is_rmrr_locked(pdev)) {
++		dev_warn(dev, "Device is ineligible for IOMMU domain attach due to platform RMRR requirement.  Contact your platform vendor.\n");
++		return -EPERM;
++	}
++
+ 	/* normally pdev is not mapped */
+ 	if (unlikely(domain_context_mapped(pdev))) {
+ 		struct dmar_domain *old_domain;
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index c706a7b..aec029a 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1233,12 +1233,12 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ 		mddev->degraded++;
+ 		set_bit(Faulty, &rdev->flags);
+ 		spin_unlock_irqrestore(&conf->device_lock, flags);
+-		/*
+-		 * if recovery is running, make sure it aborts.
+-		 */
+-		set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ 	} else
+ 		set_bit(Faulty, &rdev->flags);
++	/*
++	 * if recovery is running, make sure it aborts.
++	 */
++	set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ 	set_bit(MD_CHANGE_DEVS, &mddev->flags);
+ 	printk(KERN_ALERT
+ 	       "md/raid1:%s: Disk failure on %s, disabling device.\n"
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 6d05e26..abac83a 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1272,11 +1272,11 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ 		spin_lock_irqsave(&conf->device_lock, flags);
+ 		mddev->degraded++;
+ 		spin_unlock_irqrestore(&conf->device_lock, flags);
+-		/*
+-		 * if recovery is running, make sure it aborts.
+-		 */
+-		set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ 	}
++	/*
++	 * If recovery is running, make sure it aborts.
++	 */
++	set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ 	set_bit(Blocked, &rdev->flags);
+ 	set_bit(Faulty, &rdev->flags);
+ 	set_bit(MD_CHANGE_DEVS, &mddev->flags);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 7c963c4..c293d9c 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3240,6 +3240,8 @@ static void handle_stripe(struct stripe_head *sh)
+ 				set_bit(R5_Wantwrite, &dev->flags);
+ 				if (prexor)
+ 					continue;
++				if (s.failed > 1)
++					continue;
+ 				if (!test_bit(R5_Insync, &dev->flags) ||
+ 				    ((i == sh->pd_idx || i == sh->qd_idx)  &&
+ 				     s.failed == 0))
+diff --git a/drivers/media/dvb/frontends/tda10071.c b/drivers/media/dvb/frontends/tda10071.c
+index 0c37434..ba792849 100644
+--- a/drivers/media/dvb/frontends/tda10071.c
++++ b/drivers/media/dvb/frontends/tda10071.c
+@@ -644,6 +644,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe,
+ 	struct dtv_frontend_properties *c = &fe->dtv_property_cache;
+ 	int ret, i;
+ 	u8 mode, rolloff, pilot, inversion, div;
++	fe_modulation_t modulation;
+ 
+ 	dbg("%s: delivery_system=%d modulation=%d frequency=%d " \
+ 		"symbol_rate=%d inversion=%d pilot=%d rolloff=%d", __func__,
+@@ -677,10 +678,13 @@ static int tda10071_set_frontend(struct dvb_frontend *fe,
+ 
+ 	switch (c->delivery_system) {
+ 	case SYS_DVBS:
++		modulation = QPSK;
+ 		rolloff = 0;
+ 		pilot = 2;
+ 		break;
+ 	case SYS_DVBS2:
++		modulation = c->modulation;
++
+ 		switch (c->rolloff) {
+ 		case ROLLOFF_20:
+ 			rolloff = 2;
+@@ -722,7 +726,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe,
+ 
+ 	for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) {
+ 		if (c->delivery_system == TDA10071_MODCOD[i].delivery_system &&
+-			c->modulation == TDA10071_MODCOD[i].modulation &&
++			modulation == TDA10071_MODCOD[i].modulation &&
+ 			c->fec_inner == TDA10071_MODCOD[i].fec) {
+ 			mode = TDA10071_MODCOD[i].val;
+ 			dbg("%s: mode found=%02x", __func__, mode);
+diff --git a/drivers/media/video/gspca/pac7302.c b/drivers/media/video/gspca/pac7302.c
+index 6ddc769..ae433ef 100644
+--- a/drivers/media/video/gspca/pac7302.c
++++ b/drivers/media/video/gspca/pac7302.c
+@@ -1190,6 +1190,7 @@ static const struct usb_device_id device_table[] = {
+ 	{USB_DEVICE(0x093a, 0x2620)},
+ 	{USB_DEVICE(0x093a, 0x2621)},
+ 	{USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP},
++	{USB_DEVICE(0x093a, 0x2623), .driver_info = FL_VFLIP},
+ 	{USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP},
+ 	{USB_DEVICE(0x093a, 0x2625)},
+ 	{USB_DEVICE(0x093a, 0x2626)},
+diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c
+index c7382bb..65fc4af 100644
+--- a/drivers/mtd/ftl.c
++++ b/drivers/mtd/ftl.c
+@@ -1074,7 +1074,6 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
+ 			return;
+ 	}
+ 
+-	ftl_freepart(partition);
+ 	kfree(partition);
+ }
+ 
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index b74cdf6..fed39de 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -455,6 +455,7 @@ static int macvlan_init(struct net_device *dev)
+ 				  (lowerdev->state & MACVLAN_STATE_MASK);
+ 	dev->features 		= lowerdev->features & MACVLAN_FEATURES;
+ 	dev->features		|= NETIF_F_LLTX;
++	dev->vlan_features	= lowerdev->vlan_features & MACVLAN_FEATURES;
+ 	dev->gso_max_size	= lowerdev->gso_max_size;
+ 	dev->iflink		= lowerdev->ifindex;
+ 	dev->hard_header_len	= lowerdev->hard_header_len;
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 2b349d3..c974581 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ 	nf_reset(skb);
+ 
+ 	skb->ip_summed = CHECKSUM_NONE;
+-	ip_select_ident(skb, &rt->dst, NULL);
++	ip_select_ident(skb, NULL);
+ 	ip_send_check(iph);
+ 
+ 	ip_local_out(skb);
+diff --git a/drivers/net/wireless/ath/carl9170/carl9170.h b/drivers/net/wireless/ath/carl9170/carl9170.h
+index 6cfbb41..8bcf6b9 100644
+--- a/drivers/net/wireless/ath/carl9170/carl9170.h
++++ b/drivers/net/wireless/ath/carl9170/carl9170.h
+@@ -265,6 +265,7 @@ struct ar9170 {
+ 	atomic_t rx_work_urbs;
+ 	atomic_t rx_pool_urbs;
+ 	kernel_ulong_t features;
++	bool usb_ep_cmd_is_bulk;
+ 
+ 	/* firmware settings */
+ 	struct completion fw_load_wait;
+diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
+index 333b69e..5538596 100644
+--- a/drivers/net/wireless/ath/carl9170/usb.c
++++ b/drivers/net/wireless/ath/carl9170/usb.c
+@@ -614,9 +614,16 @@ int __carl9170_exec_cmd(struct ar9170 *ar, struct carl9170_cmd *cmd,
+ 		goto err_free;
+ 	}
+ 
+-	usb_fill_int_urb(urb, ar->udev, usb_sndintpipe(ar->udev,
+-		AR9170_USB_EP_CMD), cmd, cmd->hdr.len + 4,
+-		carl9170_usb_cmd_complete, ar, 1);
++	if (ar->usb_ep_cmd_is_bulk)
++		usb_fill_bulk_urb(urb, ar->udev,
++				  usb_sndbulkpipe(ar->udev, AR9170_USB_EP_CMD),
++				  cmd, cmd->hdr.len + 4,
++				  carl9170_usb_cmd_complete, ar);
++	else
++		usb_fill_int_urb(urb, ar->udev,
++				 usb_sndintpipe(ar->udev, AR9170_USB_EP_CMD),
++				 cmd, cmd->hdr.len + 4,
++				 carl9170_usb_cmd_complete, ar, 1);
+ 
+ 	if (free_buf)
+ 		urb->transfer_flags |= URB_FREE_BUFFER;
+@@ -1025,9 +1032,10 @@ static void carl9170_usb_firmware_step2(const struct firmware *fw,
+ static int carl9170_usb_probe(struct usb_interface *intf,
+ 			      const struct usb_device_id *id)
+ {
++	struct usb_endpoint_descriptor *ep;
+ 	struct ar9170 *ar;
+ 	struct usb_device *udev;
+-	int err;
++	int i, err;
+ 
+ 	err = usb_reset_device(interface_to_usbdev(intf));
+ 	if (err)
+@@ -1043,6 +1051,21 @@ static int carl9170_usb_probe(struct usb_interface *intf,
+ 	ar->intf = intf;
+ 	ar->features = id->driver_info;
+ 
++	/* We need to remember the type of endpoint 4 because it differs
++	 * between high- and full-speed configuration. The high-speed
++	 * configuration specifies it as interrupt and the full-speed
++	 * configuration as bulk endpoint. This information is required
++	 * later when sending urbs to that endpoint.
++	 */
++	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; ++i) {
++		ep = &intf->cur_altsetting->endpoint[i].desc;
++
++		if (usb_endpoint_num(ep) == AR9170_USB_EP_CMD &&
++		    usb_endpoint_dir_out(ep) &&
++		    usb_endpoint_type(ep) == USB_ENDPOINT_XFER_BULK)
++			ar->usb_ep_cmd_is_bulk = true;
++	}
++
+ 	usb_set_intfdata(intf, ar);
+ 	SET_IEEE80211_DEV(ar->hw, &intf->dev);
+ 
+diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
+index 160e751..0787b97 100644
+--- a/drivers/sbus/char/bbc_envctrl.c
++++ b/drivers/sbus/char/bbc_envctrl.c
+@@ -452,6 +452,9 @@ static void attach_one_temp(struct bbc_i2c_bus *bp, struct platform_device *op,
+ 	if (!tp)
+ 		return;
+ 
++	INIT_LIST_HEAD(&tp->bp_list);
++	INIT_LIST_HEAD(&tp->glob_list);
++
+ 	tp->client = bbc_i2c_attach(bp, op);
+ 	if (!tp->client) {
+ 		kfree(tp);
+@@ -497,6 +500,9 @@ static void attach_one_fan(struct bbc_i2c_bus *bp, struct platform_device *op,
+ 	if (!fp)
+ 		return;
+ 
++	INIT_LIST_HEAD(&fp->bp_list);
++	INIT_LIST_HEAD(&fp->glob_list);
++
+ 	fp->client = bbc_i2c_attach(bp, op);
+ 	if (!fp->client) {
+ 		kfree(fp);
+diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
+index 5426682..7179f72 100644
+--- a/drivers/sbus/char/bbc_i2c.c
++++ b/drivers/sbus/char/bbc_i2c.c
+@@ -301,13 +301,18 @@ static struct bbc_i2c_bus * __init attach_one_i2c(struct platform_device *op, in
+ 	if (!bp)
+ 		return NULL;
+ 
++	INIT_LIST_HEAD(&bp->temps);
++	INIT_LIST_HEAD(&bp->fans);
++
+ 	bp->i2c_control_regs = of_ioremap(&op->resource[0], 0, 0x2, "bbc_i2c_regs");
+ 	if (!bp->i2c_control_regs)
+ 		goto fail;
+ 
+-	bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
+-	if (!bp->i2c_bussel_reg)
+-		goto fail;
++	if (op->num_resources == 2) {
++		bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
++		if (!bp->i2c_bussel_reg)
++			goto fail;
++	}
+ 
+ 	bp->waiting = 0;
+ 	init_waitqueue_head(&bp->wq);
+diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
+index 546d46b..506a3ee 100644
+--- a/drivers/scsi/bfa/bfa_ioc.h
++++ b/drivers/scsi/bfa/bfa_ioc.h
+@@ -72,7 +72,7 @@ struct bfa_sge_s {
+ } while (0)
+ 
+ #define bfa_swap_words(_x)  (	\
+-	((_x) << 32) | ((_x) >> 32))
++	((u64)(_x) << 32) | ((u64)(_x) >> 32))
+ 
+ #ifdef __BIG_ENDIAN
+ #define bfa_sge_to_be(_x)
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index 5b7e1bf..603a2cb 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -2769,7 +2769,7 @@ static int hpsa_big_passthru_ioctl(struct ctlr_info *h, void __user *argp)
+ 		}
+ 		if (ioc->Request.Type.Direction == XFER_WRITE) {
+ 			if (copy_from_user(buff[sg_used], data_ptr, sz)) {
+-				status = -ENOMEM;
++				status = -EFAULT;
+ 				goto cleanup1;
+ 			}
+ 		} else
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index cd4ac38..0bdc4a7 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -793,6 +793,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
+ 			scsi_next_command(cmd);
+ 			return;
+ 		}
++	} else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
++		/*
++		 * Certain non BLOCK_PC requests are commands that don't
++		 * actually transfer anything (FLUSH), so cannot use
++		 * good_bytes != blk_rq_bytes(req) as the signal for an error.
++		 * This sets the error explicitly for the problem case.
++		 */
++		error = __scsi_error_from_host_byte(cmd, result);
+ 	}
+ 
+ 	/* no bidi support for !REQ_TYPE_BLOCK_PC yet */
+diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
+index 8960f1a..c43a9e8 100644
+--- a/drivers/staging/hv/storvsc_drv.c
++++ b/drivers/staging/hv/storvsc_drv.c
+@@ -32,6 +32,7 @@
+ #include <linux/module.h>
+ #include <linux/device.h>
+ #include <linux/hyperv.h>
++#include <linux/blkdev.h>
+ #include <scsi/scsi.h>
+ #include <scsi/scsi_cmnd.h>
+ #include <scsi/scsi_host.h>
+@@ -1129,6 +1130,16 @@ static void storvsc_command_completion(struct hv_storvsc_request *request)
+ 	kmem_cache_free(host_dev->request_pool, cmd_request);
+ }
+ 
++/*
++ * The host guarantees to respond to each command, although I/O latencies might
++ * be unbounded on Azure.  Reset the timer unconditionally to give the host a
++ * chance to perform EH.
++ */
++static enum blk_eh_timer_return storvsc_eh_timed_out(struct scsi_cmnd *scmnd)
++{
++	return BLK_EH_RESET_TIMER;
++}
++
+ static bool storvsc_check_scsi_cmd(struct scsi_cmnd *scmnd)
+ {
+ 	bool allowed = true;
+@@ -1305,6 +1316,7 @@ static struct scsi_host_template scsi_driver = {
+ 	.bios_param =		storvsc_get_chs,
+ 	.queuecommand =		storvsc_queuecommand,
+ 	.eh_host_reset_handler =	storvsc_host_reset_handler,
++	.eh_timed_out =		storvsc_eh_timed_out,
+ 	.slave_alloc =		storvsc_device_alloc,
+ 	.slave_configure =	storvsc_device_configure,
+ 	.cmd_per_lun =		1,
+diff --git a/drivers/staging/vt6655/bssdb.c b/drivers/staging/vt6655/bssdb.c
+index 577599e..ed4259c 100644
+--- a/drivers/staging/vt6655/bssdb.c
++++ b/drivers/staging/vt6655/bssdb.c
+@@ -1083,7 +1083,7 @@ start:
+         pDevice->byERPFlag &= ~(WLAN_SET_ERP_USE_PROTECTION(1));
+     }
+ 
+-{
++    if (pDevice->eCommandState == WLAN_ASSOCIATE_WAIT) {
+        pDevice->byReAssocCount++;
+    if((pDevice->byReAssocCount > 10) && (pDevice->bLinkPass != true)) {  //10 sec timeout
+                      printk("Re-association timeout!!!\n");
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index d8dd784..d540a06 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -2679,6 +2679,7 @@ static  irqreturn_t  device_intr(int irq,  void *dev_instance) {
+     unsigned char byData = 0;
+     int             ii= 0;
+ //    unsigned char byRSSI;
++    unsigned long flags;
+ 
+ 
+     MACvReadISR(pDevice->PortOffset, &pDevice->dwIsr);
+@@ -2704,7 +2705,8 @@ static  irqreturn_t  device_intr(int irq,  void *dev_instance) {
+ 
+     handled = 1;
+     MACvIntDisable(pDevice->PortOffset);
+-    spin_lock_irq(&pDevice->lock);
++
++    spin_lock_irqsave(&pDevice->lock, flags);
+ 
+     //Make sure current page is 0
+     VNSvInPortB(pDevice->PortOffset + MAC_REG_PAGE1SEL, &byOrgPageSel);
+@@ -2952,7 +2954,8 @@ static  irqreturn_t  device_intr(int irq,  void *dev_instance) {
+         MACvSelectPage1(pDevice->PortOffset);
+     }
+ 
+-    spin_unlock_irq(&pDevice->lock);
++    spin_unlock_irqrestore(&pDevice->lock, flags);
++
+     MACvIntEnable(pDevice->PortOffset, IMR_MASK_VALUE);
+ 
+     return IRQ_RETVAL(handled);
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 488214a..d7162a2 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -225,6 +225,9 @@ static void uart_shutdown(struct tty_struct *tty, struct uart_state *state)
+ 		/*
+ 		 * Turn off DTR and RTS early.
+ 		 */
++		if (uart_console(uport) && tty)
++			uport->cons->cflag = tty->termios->c_cflag;
++
+ 		if (!tty || (tty->termios->c_cflag & HUPCL))
+ 			uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+ 
+diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
+index b5fa2a5..5d80bb9 100644
+--- a/drivers/tty/serial/sunsab.c
++++ b/drivers/tty/serial/sunsab.c
+@@ -156,6 +156,15 @@ receive_chars(struct uart_sunsab_port *up,
+ 	    (up->port.line == up->port.cons->index))
+ 		saw_console_brk = 1;
+ 
++	if (count == 0) {
++		if (unlikely(stat->sreg.isr1 & SAB82532_ISR1_BRK)) {
++			stat->sreg.isr0 &= ~(SAB82532_ISR0_PERR |
++					     SAB82532_ISR0_FERR);
++			up->port.icount.brk++;
++			uart_handle_break(&up->port);
++		}
++	}
++
+ 	for (i = 0; i < count; i++) {
+ 		unsigned char ch = buf[i], flag;
+ 
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 3807294..f08732b 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2651,6 +2651,43 @@ static int finish_port_resume(struct usb_device *udev)
+ }
+ 
+ /*
++ * There are some SS USB devices which take longer time for link training.
++ * XHCI specs 4.19.4 says that when Link training is successful, port
++ * sets CSC bit to 1. So if SW reads port status before successful link
++ * training, then it will not find device to be present.
++ * USB Analyzer log with such buggy devices show that in some cases
++ * device switch on the RX termination after long delay of host enabling
++ * the VBUS. In few other cases it has been seen that device fails to
++ * negotiate link training in first attempt. It has been
++ * reported till now that few devices take as long as 2000 ms to train
++ * the link after host enabling its VBUS and termination. Following
++ * routine implements a 2000 ms timeout for link training. If in a case
++ * link trains before timeout, loop will exit earlier.
++ *
++ * FIXME: If a device was connected before suspend, but was removed
++ * while system was asleep, then the loop in the following routine will
++ * only exit at timeout.
++ *
++ * This routine should only be called when persist is enabled for a SS
++ * device.
++ */
++static int wait_for_ss_port_enable(struct usb_device *udev,
++		struct usb_hub *hub, int *port1,
++		u16 *portchange, u16 *portstatus)
++{
++	int status = 0, delay_ms = 0;
++
++	while (delay_ms < 2000) {
++		if (status || *portstatus & USB_PORT_STAT_CONNECTION)
++			break;
++		msleep(20);
++		delay_ms += 20;
++		status = hub_port_status(hub, *port1, portstatus, portchange);
++	}
++	return status;
++}
++
++/*
+  * usb_port_resume - re-activate a suspended usb device's upstream port
+  * @udev: device to re-activate, not a root hub
+  * Context: must be able to sleep; device not locked; pm locks held
+@@ -2742,6 +2779,10 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
+ 
+ 	clear_bit(port1, hub->busy_bits);
+ 
++	if (udev->persist_enabled && hub_is_superspeed(hub->hdev))
++		status = wait_for_ss_port_enable(udev, hub, &port1, &portchange,
++				&portstatus);
++
+ 	status = check_port_resume_type(udev,
+ 			hub, port1, status, portchange, portstatus);
+ 	if (status == 0)
+@@ -3354,6 +3395,7 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
+ 			le16_to_cpu(hub->descriptor->wHubCharacteristics);
+ 	struct usb_device *udev;
+ 	int status, i;
++	static int unreliable_port = -1;
+ 
+ 	dev_dbg (hub_dev,
+ 		"port %d, status %04x, change %04x, %s\n",
+@@ -3415,10 +3457,11 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
+ 				USB_PORT_STAT_C_ENABLE)) {
+ 		status = hub_port_debounce(hub, port1);
+ 		if (status < 0) {
+-			if (printk_ratelimit())
++			if (port1 != unreliable_port && printk_ratelimit())
+ 				dev_err(hub_dev, "connect-debounce failed, "
+ 						"port %d disabled\n", port1);
+ 			portstatus &= ~USB_PORT_STAT_CONNECTION;
++			unreliable_port = port1;
+ 		} else {
+ 			portstatus = status;
+ 		}
+diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
+index e0ae777..6c43152 100644
+--- a/drivers/usb/host/ohci-q.c
++++ b/drivers/usb/host/ohci-q.c
+@@ -294,8 +294,7 @@ static void periodic_unlink (struct ohci_hcd *ohci, struct ed *ed)
+  *  - ED_OPER: when there's any request queued, the ED gets rescheduled
+  *    immediately.  HC should be working on them.
+  *
+- *  - ED_IDLE:  when there's no TD queue. there's no reason for the HC
+- *    to care about this ED; safe to disable the endpoint.
++ *  - ED_IDLE: when there's no TD queue or the HC isn't running.
+  *
+  * When finish_unlinks() runs later, after SOF interrupt, it will often
+  * complete one or more URB unlinks before making that state change.
+@@ -909,6 +908,10 @@ rescan_all:
+ 		int			completed, modified;
+ 		__hc32			*prev;
+ 
++		/* Is this ED already invisible to the hardware? */
++		if (ed->state == ED_IDLE)
++			goto ed_idle;
++
+ 		/* only take off EDs that the HC isn't using, accounting for
+ 		 * frame counter wraps and EDs with partially retired TDs
+ 		 */
+@@ -938,12 +941,20 @@ skip_ed:
+ 			}
+ 		}
+ 
++		/* ED's now officially unlinked, hc doesn't see */
++		ed->state = ED_IDLE;
++		if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
++			ohci->eds_scheduled--;
++		ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
++		ed->hwNextED = 0;
++		wmb();
++		ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
++ed_idle:
++
+ 		/* reentrancy:  if we drop the schedule lock, someone might
+ 		 * have modified this list.  normally it's just prepending
+ 		 * entries (which we'd ignore), but paranoia won't hurt.
+ 		 */
+-		*last = ed->ed_next;
+-		ed->ed_next = NULL;
+ 		modified = 0;
+ 
+ 		/* unlink urbs as requested, but rescan the list after
+@@ -1001,19 +1012,20 @@ rescan_this:
+ 		if (completed && !list_empty (&ed->td_list))
+ 			goto rescan_this;
+ 
+-		/* ED's now officially unlinked, hc doesn't see */
+-		ed->state = ED_IDLE;
+-		if (quirk_zfmicro(ohci) && ed->type == PIPE_INTERRUPT)
+-			ohci->eds_scheduled--;
+-		ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
+-		ed->hwNextED = 0;
+-		wmb ();
+-		ed->hwINFO &= ~cpu_to_hc32 (ohci, ED_SKIP | ED_DEQUEUE);
+-
+-		/* but if there's work queued, reschedule */
+-		if (!list_empty (&ed->td_list)) {
+-			if (HC_IS_RUNNING(ohci_to_hcd(ohci)->state))
+-				ed_schedule (ohci, ed);
++		/*
++		 * If no TDs are queued, take ED off the ed_rm_list.
++		 * Otherwise, if the HC is running, reschedule.
++		 * If not, leave it on the list for further dequeues.
++		 */
++		if (list_empty(&ed->td_list)) {
++			*last = ed->ed_next;
++			ed->ed_next = NULL;
++		} else if (HC_IS_RUNNING(ohci_to_hcd(ohci)->state)) {
++			*last = ed->ed_next;
++			ed->ed_next = NULL;
++			ed_schedule(ohci, ed);
++		} else {
++			last = &ed->ed_next;
+ 		}
+ 
+ 		if (modified)
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 15685c3..e9ce957 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -98,6 +98,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	/* AMD PLL quirk */
+ 	if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
+ 		xhci->quirks |= XHCI_AMD_PLL_FIX;
++
++	if (pdev->vendor == PCI_VENDOR_ID_AMD)
++		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ 			pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
+ 		xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index bc5ee84..4b6abb6 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -572,9 +572,12 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 	struct xhci_virt_device *dev = xhci->devs[slot_id];
+ 	struct xhci_virt_ep *ep = &dev->eps[ep_index];
+ 	struct xhci_ring *ep_ring;
+-	struct xhci_generic_trb *trb;
++	struct xhci_segment *new_seg;
++	union xhci_trb *new_deq;
+ 	dma_addr_t addr;
+ 	u64 hw_dequeue;
++	bool cycle_found = false;
++	bool td_last_trb_found = false;
+ 
+ 	ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
+ 			ep_index, stream_id);
+@@ -598,44 +601,45 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 		hw_dequeue = le64_to_cpu(ep_ctx->deq);
+ 	}
+ 
+-	/* Find virtual address and segment of hardware dequeue pointer */
+-	state->new_deq_seg = ep_ring->deq_seg;
+-	state->new_deq_ptr = ep_ring->dequeue;
+-	while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
+-			!= (dma_addr_t)(hw_dequeue & ~0xf)) {
+-		next_trb(xhci, ep_ring, &state->new_deq_seg,
+-					&state->new_deq_ptr);
+-		if (state->new_deq_ptr == ep_ring->dequeue) {
+-			WARN_ON(1);
+-			return;
+-		}
+-	}
++	new_seg = ep_ring->deq_seg;
++	new_deq = ep_ring->dequeue;
++	state->new_cycle_state = hw_dequeue & 0x1;
++
+ 	/*
+-	 * Find cycle state for last_trb, starting at old cycle state of
+-	 * hw_dequeue. If there is only one segment ring, find_trb_seg() will
+-	 * return immediately and cannot toggle the cycle state if this search
+-	 * wraps around, so add one more toggle manually in that case.
++	 * We want to find the pointer, segment and cycle state of the new trb
++	 * (the one after current TD's last_trb). We know the cycle state at
++	 * hw_dequeue, so walk the ring until both hw_dequeue and last_trb are
++	 * found.
+ 	 */
+-	state->new_cycle_state = hw_dequeue & 0x1;
+-	if (ep_ring->first_seg == ep_ring->first_seg->next &&
+-			cur_td->last_trb < state->new_deq_ptr)
+-		state->new_cycle_state ^= 0x1;
+-
+-	state->new_deq_ptr = cur_td->last_trb;
+-	xhci_dbg(xhci, "Finding segment containing last TRB in TD.\n");
+-	state->new_deq_seg = find_trb_seg(state->new_deq_seg,
+-			state->new_deq_ptr, &state->new_cycle_state);
+-	if (!state->new_deq_seg) {
+-		WARN_ON(1);
+-		return;
+-	}
++	do {
++		if (!cycle_found && xhci_trb_virt_to_dma(new_seg, new_deq)
++		    == (dma_addr_t)(hw_dequeue & ~0xf)) {
++			cycle_found = true;
++			if (td_last_trb_found)
++				break;
++		}
++		if (new_deq == cur_td->last_trb)
++			td_last_trb_found = true;
++
++		if (cycle_found &&
++		    TRB_TYPE_LINK_LE32(new_deq->generic.field[3]) &&
++		    new_deq->generic.field[3] & cpu_to_le32(LINK_TOGGLE))
++			state->new_cycle_state ^= 0x1;
++
++		next_trb(xhci, ep_ring, &new_seg, &new_deq);
++
++		/* Search wrapped around, bail out */
++		if (new_deq == ep->ring->dequeue) {
++			xhci_err(xhci, "Error: Failed finding new dequeue state\n");
++			state->new_deq_seg = NULL;
++			state->new_deq_ptr = NULL;
++			return;
++		}
++
++	} while (!cycle_found || !td_last_trb_found);
+ 
+-	/* Increment to find next TRB after last_trb. Cycle if appropriate. */
+-	trb = &state->new_deq_ptr->generic;
+-	if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
+-	    (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
+-		state->new_cycle_state ^= 0x1;
+-	next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
++	state->new_deq_seg = new_seg;
++	state->new_deq_ptr = new_deq;
+ 
+ 	/* Don't update the ring cycle state for the producer (us). */
+ 	xhci_dbg(xhci, "Cycle state = 0x%x\n", state->new_cycle_state);
+@@ -2433,7 +2437,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ 		 * last TRB of the previous TD. The command completion handle
+ 		 * will take care the rest.
+ 		 */
+-		if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
++		if (!event_seg && (trb_comp_code == COMP_STOP ||
++				   trb_comp_code == COMP_STOP_INVAL)) {
+ 			ret = 0;
+ 			goto cleanup;
+ 		}
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 457a7ac..4cc1804 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -2819,6 +2819,9 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
+ 			ep_index, ep->stopped_stream, ep->stopped_td,
+ 			&deq_state);
+ 
++	if (!deq_state.new_deq_ptr || !deq_state.new_deq_seg)
++		return;
++
+ 	/* HW with the reset endpoint quirk will use the saved dequeue state to
+ 	 * issue a configure endpoint command later.
+ 	 */
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index 7af163d..f1bfd01 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3248,6 +3248,7 @@ static const struct usb_device_id sisusb_table[] = {
+ 	{ USB_DEVICE(0x0711, 0x0918) },
+ 	{ USB_DEVICE(0x0711, 0x0920) },
+ 	{ USB_DEVICE(0x0711, 0x0950) },
++	{ USB_DEVICE(0x0711, 0x5200) },
+ 	{ USB_DEVICE(0x182d, 0x021c) },
+ 	{ USB_DEVICE(0x182d, 0x0269) },
+ 	{ }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index d6e6205..0d34f85 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -162,6 +162,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+@@ -684,6 +685,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
+ 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
+ 	{ USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
++	{ USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++	{ USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ 	{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
+@@ -956,6 +959,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
+ 	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
+ 	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
++	/* ekey Devices */
++	{ USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 55af915..cbcb1e6 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -42,6 +42,8 @@
+ /* www.candapter.com Ewert Energy Systems CANdapter device */
+ #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+ 
++#define FTDI_BM_ATOM_NANO_PID	0xa559	/* Basic Micro ATOM Nano USB2Serial */
++
+ /*
+  * Texas Instruments XDS100v2 JTAG / BeagleBone A3
+  * http://processors.wiki.ti.com/index.php/XDS100
+@@ -140,12 +142,15 @@
+ /*
+  * Xsens Technologies BV products (http://www.xsens.com).
+  */
+-#define XSENS_CONVERTER_0_PID	0xD388
+-#define XSENS_CONVERTER_1_PID	0xD389
++#define XSENS_VID		0x2639
++#define XSENS_CONVERTER_PID	0xD00D	/* Xsens USB-serial converter */
++#define XSENS_MTW_PID		0x0200	/* Xsens MTw */
++#define XSENS_CONVERTER_0_PID	0xD388	/* Xsens USB converter */
++#define XSENS_CONVERTER_1_PID	0xD389	/* Xsens Wireless Receiver */
+ #define XSENS_CONVERTER_2_PID	0xD38A
+-#define XSENS_CONVERTER_3_PID	0xD38B
+-#define XSENS_CONVERTER_4_PID	0xD38C
+-#define XSENS_CONVERTER_5_PID	0xD38D
++#define XSENS_CONVERTER_3_PID	0xD38B	/* Xsens USB-serial converter */
++#define XSENS_CONVERTER_4_PID	0xD38C	/* Xsens Wireless Receiver */
++#define XSENS_CONVERTER_5_PID	0xD38D	/* Xsens Awinda Station */
+ #define XSENS_CONVERTER_6_PID	0xD38E
+ #define XSENS_CONVERTER_7_PID	0xD38F
+ 
+@@ -1369,3 +1374,8 @@
+ #define BRAINBOXES_US_160_6_PID		0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
+ #define BRAINBOXES_US_160_7_PID		0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
+ #define BRAINBOXES_US_160_8_PID		0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
++
++/*
++ * ekey biometric systems GmbH (http://ekey.net/)
++ */
++#define FTDI_EKEY_CONV_USB_PID		0xCB08	/* Converter USB */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 7a1c91e..d8360be 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -496,6 +496,10 @@ static void option_instat_callback(struct urb *urb);
+ #define INOVIA_VENDOR_ID			0x20a6
+ #define INOVIA_SEW858				0x1105
+ 
++/* VIA Telecom */
++#define VIATELECOM_VENDOR_ID			0x15eb
++#define VIATELECOM_PRODUCT_CDS7			0x0001
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ 		OPTION_BLACKLIST_NONE = 0,
+@@ -1740,6 +1744,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
++	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 45a288c..7ba38ea 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -51,6 +51,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+ 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+ 	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
++	{ USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
+ 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ 	{ USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ 	{ USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 42bc082..71fd9da 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -22,6 +22,7 @@
+ #define PL2303_PRODUCT_ID_GPRS		0x0609
+ #define PL2303_PRODUCT_ID_HCR331	0x331a
+ #define PL2303_PRODUCT_ID_MOTOROLA	0x0307
++#define PL2303_PRODUCT_ID_ZTEK		0xe1f1
+ 
+ #define ATEN_VENDOR_ID		0x0557
+ #define ATEN_VENDOR_ID2		0x0547
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 8f76a2b..803806c 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -791,29 +791,39 @@ int usb_serial_probe(struct usb_interface *interface,
+ 		if (usb_endpoint_is_bulk_in(endpoint)) {
+ 			/* we found a bulk in endpoint */
+ 			dbg("found bulk in on endpoint %d", i);
+-			bulk_in_endpoint[num_bulk_in] = endpoint;
+-			++num_bulk_in;
++			if (num_bulk_in < MAX_NUM_PORTS) {
++				bulk_in_endpoint[num_bulk_in] = endpoint;
++				++num_bulk_in;
++			}
+ 		}
+ 
+ 		if (usb_endpoint_is_bulk_out(endpoint)) {
+ 			/* we found a bulk out endpoint */
+ 			dbg("found bulk out on endpoint %d", i);
+-			bulk_out_endpoint[num_bulk_out] = endpoint;
+-			++num_bulk_out;
++			if (num_bulk_out < MAX_NUM_PORTS) {
++				bulk_out_endpoint[num_bulk_out] = endpoint;
++				++num_bulk_out;
++			}
+ 		}
+ 
+ 		if (usb_endpoint_is_int_in(endpoint)) {
+ 			/* we found a interrupt in endpoint */
+ 			dbg("found interrupt in on endpoint %d", i);
+-			interrupt_in_endpoint[num_interrupt_in] = endpoint;
+-			++num_interrupt_in;
++			if (num_interrupt_in < MAX_NUM_PORTS) {
++				interrupt_in_endpoint[num_interrupt_in] =
++						endpoint;
++				++num_interrupt_in;
++			}
+ 		}
+ 
+ 		if (usb_endpoint_is_int_out(endpoint)) {
+ 			/* we found an interrupt out endpoint */
+ 			dbg("found interrupt out on endpoint %d", i);
+-			interrupt_out_endpoint[num_interrupt_out] = endpoint;
+-			++num_interrupt_out;
++			if (num_interrupt_out < MAX_NUM_PORTS) {
++				interrupt_out_endpoint[num_interrupt_out] =
++						endpoint;
++				++num_interrupt_out;
++			}
+ 		}
+ 	}
+ 
+@@ -836,8 +846,10 @@ int usb_serial_probe(struct usb_interface *interface,
+ 				if (usb_endpoint_is_int_in(endpoint)) {
+ 					/* we found a interrupt in endpoint */
+ 					dbg("found interrupt in for Prolific device on separate interface");
+-					interrupt_in_endpoint[num_interrupt_in] = endpoint;
+-					++num_interrupt_in;
++					if (num_interrupt_in < MAX_NUM_PORTS) {
++						interrupt_in_endpoint[num_interrupt_in] = endpoint;
++						++num_interrupt_in;
++					}
+ 				}
+ 			}
+ 		}
+@@ -876,6 +888,11 @@ int usb_serial_probe(struct usb_interface *interface,
+ 			num_ports = type->num_ports;
+ 	}
+ 
++	if (num_ports > MAX_NUM_PORTS) {
++		dev_warn(&interface->dev, "too many ports requested: %d\n", num_ports);
++		num_ports = MAX_NUM_PORTS;
++	}
++
+ 	serial->num_ports = num_ports;
+ 	serial->num_bulk_in = num_bulk_in;
+ 	serial->num_bulk_out = num_bulk_out;
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 0ec60cd..5481809 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -1006,6 +1006,10 @@ static void command_port_read_callback(struct urb *urb)
+ 		dbg("%s - command_info is NULL, exiting.", __func__);
+ 		return;
+ 	}
++	if (!urb->actual_length) {
++		dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
++		return;
++	}
+ 	if (status) {
+ 		dbg("%s - nonzero urb status: %d", __func__, status);
+ 		if (status != -ENOENT)
+@@ -1027,7 +1031,8 @@ static void command_port_read_callback(struct urb *urb)
+ 		/* These are unsolicited reports from the firmware, hence no
+ 		   waiting command to wakeup */
+ 		dbg("%s - event received", __func__);
+-	} else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
++	} else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
++		(urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
+ 		memcpy(command_info->result_buffer, &data[1],
+ 						urb->actual_length - 1);
+ 		command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index c7fb3a4..d7c9b68 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -717,7 +717,7 @@ again:
+ 				found_next = 1;
+ 			if (ret != 0)
+ 				goto insert;
+-			slot = 0;
++			slot = path->slots[0];
+ 		}
+ 		btrfs_item_key_to_cpu(path->nodes[0], &found_key, slot);
+ 		if (found_key.objectid != BTRFS_EXTENT_CSUM_OBJECTID ||
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 20431b4..c0c51e1 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1638,6 +1638,12 @@ unlink_target:
+ 				    target_dentry, toName);
+ 	}
+ 
++	/* force revalidate to go get info when needed */
++	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
++
++	source_dir->i_ctime = source_dir->i_mtime = target_dir->i_ctime =
++		target_dir->i_mtime = current_fs_time(source_dir->i_sb);
++
+ cifs_rename_exit:
+ 	kfree(info_buf_source);
+ 	kfree(fromName);
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index fb001cd..01951c6b 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -380,7 +380,7 @@ EXPORT_SYMBOL_GPL(debugfs_remove);
+  */
+ void debugfs_remove_recursive(struct dentry *dentry)
+ {
+-	struct dentry *child, *next, *parent;
++	struct dentry *child, *parent;
+ 
+ 	if (!dentry)
+ 		return;
+@@ -392,31 +392,49 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ 	parent = dentry;
+  down:
+ 	mutex_lock(&parent->d_inode->i_mutex);
+-	list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) {
++ loop:
++	/*
++	 * The parent->d_subdirs is protected by the d_lock. Outside that
++	 * lock, the child can be unlinked and set to be freed which can
++	 * use the d_u.d_child as the rcu head and corrupt this list.
++	 */
++	spin_lock(&parent->d_lock);
++	list_for_each_entry(child, &parent->d_subdirs, d_u.d_child) {
+ 		if (!debugfs_positive(child))
+ 			continue;
+ 
+ 		/* perhaps simple_empty(child) makes more sense */
+ 		if (!list_empty(&child->d_subdirs)) {
++			spin_unlock(&parent->d_lock);
+ 			mutex_unlock(&parent->d_inode->i_mutex);
+ 			parent = child;
+ 			goto down;
+ 		}
+- up:
++
++		spin_unlock(&parent->d_lock);
++
+ 		if (!__debugfs_remove(child, parent))
+ 			simple_release_fs(&debugfs_mount, &debugfs_mount_count);
++
++		/*
++		 * The parent->d_lock protects agaist child from unlinking
++		 * from d_subdirs. When releasing the parent->d_lock we can
++		 * no longer trust that the next pointer is valid.
++		 * Restart the loop. We'll skip this one with the
++		 * debugfs_positive() check.
++		 */
++		goto loop;
+ 	}
++	spin_unlock(&parent->d_lock);
+ 
+ 	mutex_unlock(&parent->d_inode->i_mutex);
+ 	child = parent;
+ 	parent = parent->d_parent;
+ 	mutex_lock(&parent->d_inode->i_mutex);
+ 
+-	if (child != dentry) {
+-		next = list_entry(child->d_u.d_child.next, struct dentry,
+-					d_u.d_child);
+-		goto up;
+-	}
++	if (child != dentry)
++		/* go up */
++		goto loop;
+ 
+ 	if (!__debugfs_remove(child, parent))
+ 		simple_release_fs(&debugfs_mount, &debugfs_mount_count);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 7168eeb..818b43e 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3128,13 +3128,28 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
+ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
+ {
+ 	struct ext4_prealloc_space *pa = ac->ac_pa;
+-	int len;
++	struct ext4_buddy e4b;
++	int err;
+ 
+-	if (pa && pa->pa_type == MB_INODE_PA) {
+-		len = ac->ac_b_ex.fe_len;
+-		pa->pa_free += len;
++	if (pa == NULL) {
++		err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
++		if (err) {
++			/*
++			 * This should never happen since we pin the
++			 * pages in the ext4_allocation_context so
++			 * ext4_mb_load_buddy() should never fail.
++			 */
++			WARN(1, "mb_load_buddy failed (%d)", err);
++			return;
++		}
++		ext4_lock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
++		mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
++			       ac->ac_f_ex.fe_len);
++		ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
++		return;
+ 	}
+-
++	if (pa->pa_type == MB_INODE_PA)
++		pa->pa_free += ac->ac_b_ex.fe_len;
+ }
+ 
+ /*
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index a5f25a7..2f9197f 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -68,7 +68,7 @@ static void isofs_put_super(struct super_block *sb)
+ 	return;
+ }
+ 
+-static int isofs_read_inode(struct inode *);
++static int isofs_read_inode(struct inode *, int relocated);
+ static int isofs_statfs (struct dentry *, struct kstatfs *);
+ 
+ static struct kmem_cache *isofs_inode_cachep;
+@@ -1263,7 +1263,7 @@ out_toomany:
+ 	goto out;
+ }
+ 
+-static int isofs_read_inode(struct inode *inode)
++static int isofs_read_inode(struct inode *inode, int relocated)
+ {
+ 	struct super_block *sb = inode->i_sb;
+ 	struct isofs_sb_info *sbi = ISOFS_SB(sb);
+@@ -1408,7 +1408,7 @@ static int isofs_read_inode(struct inode *inode)
+ 	 */
+ 
+ 	if (!high_sierra) {
+-		parse_rock_ridge_inode(de, inode);
++		parse_rock_ridge_inode(de, inode, relocated);
+ 		/* if we want uid/gid set, override the rock ridge setting */
+ 		if (sbi->s_uid_set)
+ 			inode->i_uid = sbi->s_uid;
+@@ -1487,9 +1487,10 @@ static int isofs_iget5_set(struct inode *ino, void *data)
+  * offset that point to the underlying meta-data for the inode.  The
+  * code below is otherwise similar to the iget() code in
+  * include/linux/fs.h */
+-struct inode *isofs_iget(struct super_block *sb,
+-			 unsigned long block,
+-			 unsigned long offset)
++struct inode *__isofs_iget(struct super_block *sb,
++			   unsigned long block,
++			   unsigned long offset,
++			   int relocated)
+ {
+ 	unsigned long hashval;
+ 	struct inode *inode;
+@@ -1511,7 +1512,7 @@ struct inode *isofs_iget(struct super_block *sb,
+ 		return ERR_PTR(-ENOMEM);
+ 
+ 	if (inode->i_state & I_NEW) {
+-		ret = isofs_read_inode(inode);
++		ret = isofs_read_inode(inode, relocated);
+ 		if (ret < 0) {
+ 			iget_failed(inode);
+ 			inode = ERR_PTR(ret);
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 7d33de8..f9c9793 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -107,7 +107,7 @@ extern int iso_date(char *, int);
+ 
+ struct inode;		/* To make gcc happy */
+ 
+-extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *);
++extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *, int relocated);
+ extern int get_rock_ridge_filename(struct iso_directory_record *, char *, struct inode *);
+ extern int isofs_name_translate(struct iso_directory_record *, char *, struct inode *);
+ 
+@@ -118,9 +118,24 @@ extern struct dentry *isofs_lookup(struct inode *, struct dentry *, struct namei
+ extern struct buffer_head *isofs_bread(struct inode *, sector_t);
+ extern int isofs_get_blocks(struct inode *, sector_t, struct buffer_head **, unsigned long);
+ 
+-extern struct inode *isofs_iget(struct super_block *sb,
+-                                unsigned long block,
+-                                unsigned long offset);
++struct inode *__isofs_iget(struct super_block *sb,
++			   unsigned long block,
++			   unsigned long offset,
++			   int relocated);
++
++static inline struct inode *isofs_iget(struct super_block *sb,
++				       unsigned long block,
++				       unsigned long offset)
++{
++	return __isofs_iget(sb, block, offset, 0);
++}
++
++static inline struct inode *isofs_iget_reloc(struct super_block *sb,
++					     unsigned long block,
++					     unsigned long offset)
++{
++	return __isofs_iget(sb, block, offset, 1);
++}
+ 
+ /* Because the inode number is no longer relevant to finding the
+  * underlying meta-data for an inode, we are free to choose a more
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index 70e79d0..ee62cc0 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -288,12 +288,16 @@ eio:
+ 	goto out;
+ }
+ 
++#define RR_REGARD_XA 1
++#define RR_RELOC_DE 2
++
+ static int
+ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+-				struct inode *inode, int regard_xa)
++				struct inode *inode, int flags)
+ {
+ 	int symlink_len = 0;
+ 	int cnt, sig;
++	unsigned int reloc_block;
+ 	struct inode *reloc;
+ 	struct rock_ridge *rr;
+ 	int rootflag;
+@@ -305,7 +309,7 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+ 
+ 	init_rock_state(&rs, inode);
+ 	setup_rock_ridge(de, inode, &rs);
+-	if (regard_xa) {
++	if (flags & RR_REGARD_XA) {
+ 		rs.chr += 14;
+ 		rs.len -= 14;
+ 		if (rs.len < 0)
+@@ -485,12 +489,22 @@ repeat:
+ 					"relocated directory\n");
+ 			goto out;
+ 		case SIG('C', 'L'):
+-			ISOFS_I(inode)->i_first_extent =
+-			    isonum_733(rr->u.CL.location);
+-			reloc =
+-			    isofs_iget(inode->i_sb,
+-				       ISOFS_I(inode)->i_first_extent,
+-				       0);
++			if (flags & RR_RELOC_DE) {
++				printk(KERN_ERR
++				       "ISOFS: Recursive directory relocation "
++				       "is not supported\n");
++				goto eio;
++			}
++			reloc_block = isonum_733(rr->u.CL.location);
++			if (reloc_block == ISOFS_I(inode)->i_iget5_block &&
++			    ISOFS_I(inode)->i_iget5_offset == 0) {
++				printk(KERN_ERR
++				       "ISOFS: Directory relocation points to "
++				       "itself\n");
++				goto eio;
++			}
++			ISOFS_I(inode)->i_first_extent = reloc_block;
++			reloc = isofs_iget_reloc(inode->i_sb, reloc_block, 0);
+ 			if (IS_ERR(reloc)) {
+ 				ret = PTR_ERR(reloc);
+ 				goto out;
+@@ -637,9 +651,11 @@ static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
+ 	return rpnt;
+ }
+ 
+-int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
++int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode,
++			   int relocated)
+ {
+-	int result = parse_rock_ridge_inode_internal(de, inode, 0);
++	int flags = relocated ? RR_RELOC_DE : 0;
++	int result = parse_rock_ridge_inode_internal(de, inode, flags);
+ 
+ 	/*
+ 	 * if rockridge flag was reset and we didn't look for attributes
+@@ -647,7 +663,8 @@ int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
+ 	 */
+ 	if ((ISOFS_SB(inode->i_sb)->s_rock_offset == -1)
+ 	    && (ISOFS_SB(inode->i_sb)->s_rock == 2)) {
+-		result = parse_rock_ridge_inode_internal(de, inode, 14);
++		result = parse_rock_ridge_inode_internal(de, inode,
++							 flags | RR_REGARD_XA);
+ 	}
+ 	return result;
+ }
+diff --git a/fs/namespace.c b/fs/namespace.c
+index ca4913a..a1e663d 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2333,6 +2333,14 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
+ 	if (flags & MS_RDONLY)
+ 		mnt_flags |= MNT_READONLY;
+ 
++	/* The default atime for remount is preservation */
++	if ((flags & MS_REMOUNT) &&
++	    ((flags & (MS_NOATIME | MS_NODIRATIME | MS_RELATIME |
++		       MS_STRICTATIME)) == 0)) {
++		mnt_flags &= ~MNT_ATIME_MASK;
++		mnt_flags |= path.mnt->mnt_flags & MNT_ATIME_MASK;
++	}
++
+ 	flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE | MS_BORN |
+ 		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
+ 		   MS_STRICTATIME);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 5aea30a..c4a2a68 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2004,24 +2004,31 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ {
+ 	struct nfs4_closedata *calldata = data;
+ 	struct nfs4_state *state = calldata->state;
++	bool is_rdonly, is_wronly, is_rdwr;
+ 	int call_close = 0;
+ 
+ 	if (nfs_wait_on_sequence(calldata->arg.seqid, task) != 0)
+ 		return;
+ 
+ 	task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+-	calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
+ 	spin_lock(&state->owner->so_lock);
++	is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
++	is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
++	is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
++	/* Calculate the current open share mode */
++	calldata->arg.fmode = 0;
++	if (is_rdonly || is_rdwr)
++		calldata->arg.fmode |= FMODE_READ;
++	if (is_wronly || is_rdwr)
++		calldata->arg.fmode |= FMODE_WRITE;
+ 	/* Calculate the change in open mode */
+ 	if (state->n_rdwr == 0) {
+ 		if (state->n_rdonly == 0) {
+-			call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
+-			call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
++			call_close |= is_rdonly || is_rdwr;
+ 			calldata->arg.fmode &= ~FMODE_READ;
+ 		}
+ 		if (state->n_wronly == 0) {
+-			call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
+-			call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
++			call_close |= is_wronly || is_rdwr;
+ 			calldata->arg.fmode &= ~FMODE_WRITE;
+ 		}
+ 	}
+diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
+index eb71106..938a77f 100644
+--- a/fs/reiserfs/journal.c
++++ b/fs/reiserfs/journal.c
+@@ -1916,15 +1916,19 @@ static int do_journal_release(struct reiserfs_transaction_handle *th,
+ 	}
+ 
+ 	reiserfs_mounted_fs_count--;
+-	/* wait for all commits to finish */
+-	cancel_delayed_work(&SB_JOURNAL(sb)->j_work);
+ 
+ 	/*
+ 	 * We must release the write lock here because
+ 	 * the workqueue job (flush_async_commit) needs this lock
+ 	 */
+ 	reiserfs_write_unlock(sb);
+-	flush_workqueue(commit_wq);
++	/*
++	 * Cancel flushing of old commits. Note that this work will not
++	 * be requeued because superblock is being shutdown and doesn't
++	 * have MS_ACTIVE set.
++	 */
++	/* wait for all commits to finish */
++	cancel_delayed_work_sync(&SB_JOURNAL(sb)->j_work);
+ 
+ 	if (!reiserfs_mounted_fs_count) {
+ 		destroy_workqueue(commit_wq);
+@@ -4211,8 +4215,15 @@ static int do_journal_end(struct reiserfs_transaction_handle *th,
+ 	if (flush) {
+ 		flush_commit_list(sb, jl, 1);
+ 		flush_journal_list(sb, jl, 1);
+-	} else if (!(jl->j_state & LIST_COMMIT_PENDING))
+-		queue_delayed_work(commit_wq, &journal->j_work, HZ / 10);
++	} else if (!(jl->j_state & LIST_COMMIT_PENDING)) {
++		/*
++		 * Avoid queueing work when sb is being shut down. Transaction
++		 * will be flushed on journal shutdown.
++		 */
++		if (sb->s_flags & MS_ACTIVE)
++			queue_delayed_work(commit_wq,
++					   &journal->j_work, HZ / 10);
++	}
+ 
+ 	/* if the next transaction has any chance of wrapping, flush
+ 	 ** transactions that might get overwritten.  If any journal lists are very
+diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
+index f85c5ab..11670e3 100644
+--- a/include/linux/mempolicy.h
++++ b/include/linux/mempolicy.h
+@@ -205,7 +205,7 @@ extern struct zonelist *huge_zonelist(struct vm_area_struct *vma,
+ extern bool init_nodemask_of_mempolicy(nodemask_t *mask);
+ extern bool mempolicy_nodemask_intersects(struct task_struct *tsk,
+ 				const nodemask_t *mask);
+-extern unsigned slab_node(struct mempolicy *policy);
++extern unsigned slab_node(void);
+ 
+ extern enum zone_type policy_zone;
+ 
+diff --git a/include/linux/mount.h b/include/linux/mount.h
+index 33fe53d..fc17c4d 100644
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -43,6 +43,7 @@ struct mnt_namespace;
+  */
+ #define MNT_SHARED_MASK	(MNT_UNBINDABLE)
+ #define MNT_PROPAGATION_MASK	(MNT_SHARED | MNT_UNBINDABLE)
++#define MNT_ATIME_MASK (MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME )
+ 
+ 
+ #define MNT_INTERNAL	0x4000
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index ba0ddb0..6172a44 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -47,13 +47,12 @@ struct inet_peer {
+ 	};
+ 	/*
+ 	 * Once inet_peer is queued for deletion (refcnt == -1), following fields
+-	 * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
++	 * are not available: rid, tcp_ts, tcp_ts_stamp
+ 	 * We can share memory with rcu_head to help keep inet_peer small.
+ 	 */
+ 	union {
+ 		struct {
+ 			atomic_t			rid;		/* Frag reception counter */
+-			atomic_t			ip_id_count;	/* IP ID for the next packet */
+ 			__u32				tcp_ts;
+ 			__u32				tcp_ts_stamp;
+ 		};
+@@ -103,7 +102,7 @@ extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
+ extern void inetpeer_invalidate_tree(int family);
+ 
+ /*
+- * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
++ * temporary check to make sure we dont access rid, tcp_ts,
+  * tcp_ts_stamp if no refcount is taken on inet_peer
+  */
+ static inline void inet_peer_refcheck(const struct inet_peer *p)
+@@ -111,13 +110,4 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
+ 	WARN_ON_ONCE(atomic_read(&p->refcnt) <= 0);
+ }
+ 
+-
+-/* can be called with or without local BH being disabled */
+-static inline int inet_getid(struct inet_peer *p, int more)
+-{
+-	more++;
+-	inet_peer_refcheck(p);
+-	return atomic_add_return(more, &p->ip_id_count) - more;
+-}
+-
+ #endif /* _NET_INETPEER_H */
+diff --git a/include/net/ip.h b/include/net/ip.h
+index b935e6c..1ee535b 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -264,9 +264,10 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
+ 		 !(dst_metric_locked(dst, RTAX_MTU)));
+ }
+ 
+-extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
++u32 ip_idents_reserve(u32 hash, int segs);
++void __ip_select_ident(struct iphdr *iph, int segs);
+ 
+-static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
++static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
+ {
+ 	struct iphdr *iph = ip_hdr(skb);
+ 
+@@ -276,24 +277,20 @@ static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, s
+ 		 * does not change, they drop every other packet in
+ 		 * a TCP stream using header compression.
+ 		 */
+-		iph->id = (sk && inet_sk(sk)->inet_daddr) ?
+-					htons(inet_sk(sk)->inet_id++) : 0;
+-	} else
+-		__ip_select_ident(iph, dst, 0);
+-}
+-
+-static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
+-{
+-	struct iphdr *iph = ip_hdr(skb);
+-
+-	if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
+ 		if (sk && inet_sk(sk)->inet_daddr) {
+ 			iph->id = htons(inet_sk(sk)->inet_id);
+-			inet_sk(sk)->inet_id += 1 + more;
+-		} else
++			inet_sk(sk)->inet_id += segs;
++		} else {
+ 			iph->id = 0;
+-	} else
+-		__ip_select_ident(iph, dst, more);
++		}
++	} else {
++		__ip_select_ident(iph, segs);
++	}
++}
++
++static inline void ip_select_ident(struct sk_buff *skb, struct sock *sk)
++{
++	ip_select_ident_segs(skb, sk, 1);
+ }
+ 
+ /*
+diff --git a/include/net/ipip.h b/include/net/ipip.h
+index 4dccfe3..e8ee3bb 100644
+--- a/include/net/ipip.h
++++ b/include/net/ipip.h
+@@ -50,7 +50,7 @@ struct ip_tunnel_prl_entry {
+ 	int pkt_len = skb->len - skb_transport_offset(skb);		\
+ 									\
+ 	skb->ip_summed = CHECKSUM_NONE;					\
+-	ip_select_ident(skb, &rt->dst, NULL);				\
++	ip_select_ident(skb, NULL);				\
+ 									\
+ 	err = ip_local_out(skb);					\
+ 	if (likely(net_xmit_eval(err) == 0)) {				\
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 0580673..00a2eb6 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -388,14 +388,19 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a);
+ int ip6_frag_match(struct inet_frag_queue *q, void *a);
+ 
+ /* more secured version of ipv6_addr_hash() */
+-static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval)
+ {
+ 	u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+ 
+ 	return jhash_3words(v,
+ 			    (__force u32)a->s6_addr32[2],
+ 			    (__force u32)a->s6_addr32[3],
+-			    ipv6_hash_secret);
++			    initval);
++}
++
++static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++{
++	return __ipv6_addr_jhash(a, ipv6_hash_secret);
+ }
+ 
+ static inline int ipv6_addr_any(const struct in6_addr *a)
+diff --git a/include/net/netlabel.h b/include/net/netlabel.h
+index f674409..c8ba2e2 100644
+--- a/include/net/netlabel.h
++++ b/include/net/netlabel.h
+@@ -395,10 +395,10 @@ int netlbl_secattr_catmap_walk(struct netlbl_lsm_secattr_catmap *catmap,
+ 			       u32 offset);
+ int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
+ 				   u32 offset);
+-int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
++int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap **catmap,
+ 				 u32 bit,
+ 				 gfp_t flags);
+-int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
++int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap **catmap,
+ 				 u32 start,
+ 				 u32 end,
+ 				 gfp_t flags);
+@@ -506,14 +506,14 @@ static inline int netlbl_secattr_catmap_walk_rng(
+ 	return -ENOENT;
+ }
+ static inline int netlbl_secattr_catmap_setbit(
+-	                              struct netlbl_lsm_secattr_catmap *catmap,
++				      struct netlbl_lsm_secattr_catmap **catmap,
+ 				      u32 bit,
+ 				      gfp_t flags)
+ {
+ 	return 0;
+ }
+ static inline int netlbl_secattr_catmap_setrng(
+-	                              struct netlbl_lsm_secattr_catmap *catmap,
++				      struct netlbl_lsm_secattr_catmap **catmap,
+ 				      u32 start,
+ 				      u32 end,
+ 				      gfp_t flags)
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index c2e542b..b1c3d1c 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -3,8 +3,6 @@
+ 
+ #include <linux/types.h>
+ 
+-extern __u32 secure_ip_id(__be32 daddr);
+-extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+ extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+ extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ 				      __be16 dport);
+diff --git a/init/main.c b/init/main.c
+index 7474450..e937d9b 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -610,6 +610,10 @@ asmlinkage void __init start_kernel(void)
+ 	if (efi_enabled(EFI_RUNTIME_SERVICES))
+ 		efi_enter_virtual_mode();
+ #endif
++#ifdef CONFIG_X86_ESPFIX64
++	/* Should be run before the first non-init thread is created */
++	init_espfix_bsp();
++#endif
+ 	thread_info_cache_init();
+ 	cred_init();
+ 	fork_init(totalram_pages);
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 648f25a..4babd77 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2843,21 +2843,16 @@ static void rb_iter_reset(struct ring_buffer_iter *iter)
+ 	struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
+ 
+ 	/* Iterator usage is expected to have record disabled */
+-	if (list_empty(&cpu_buffer->reader_page->list)) {
+-		iter->head_page = rb_set_head_page(cpu_buffer);
+-		if (unlikely(!iter->head_page))
+-			return;
+-		iter->head = iter->head_page->read;
+-	} else {
+-		iter->head_page = cpu_buffer->reader_page;
+-		iter->head = cpu_buffer->reader_page->read;
+-	}
++	iter->head_page = cpu_buffer->reader_page;
++	iter->head = cpu_buffer->reader_page->read;
++
++	iter->cache_reader_page = iter->head_page;
++	iter->cache_read = iter->head;
++
+ 	if (iter->head)
+ 		iter->read_stamp = cpu_buffer->read_stamp;
+ 	else
+ 		iter->read_stamp = iter->head_page->page->time_stamp;
+-	iter->cache_reader_page = cpu_buffer->reader_page;
+-	iter->cache_read = cpu_buffer->read;
+ }
+ 
+ /**
+@@ -3246,12 +3241,14 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
+ 		return NULL;
+ 
+ 	/*
+-	 * We repeat when a time extend is encountered.
+-	 * Since the time extend is always attached to a data event,
+-	 * we should never loop more than once.
+-	 * (We never hit the following condition more than twice).
++	 * We repeat when a time extend is encountered or we hit
++	 * the end of the page. Since the time extend is always attached
++	 * to a data event, we should never loop more than three times.
++	 * Once for going to next page, once on time extend, and
++	 * finally once to get the event.
++	 * (We never hit the following condition more than thrice).
+ 	 */
+-	if (RB_WARN_ON(cpu_buffer, ++nr_loops > 2))
++	if (RB_WARN_ON(cpu_buffer, ++nr_loops > 3))
+ 		return NULL;
+ 
+ 	if (rb_per_cpu_empty(cpu_buffer))
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index c9f7e6f..a72fa33 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1601,8 +1601,14 @@ static unsigned interleave_nodes(struct mempolicy *policy)
+  * task can change it's policy.  The system default policy requires no
+  * such protection.
+  */
+-unsigned slab_node(struct mempolicy *policy)
++unsigned slab_node(void)
+ {
++	struct mempolicy *policy;
++
++	if (in_interrupt())
++		return numa_node_id();
++
++	policy = current->mempolicy;
+ 	if (!policy || policy->flags & MPOL_F_LOCAL)
+ 		return numa_node_id();
+ 
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index d8762b2..62a7fa23 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2054,7 +2054,7 @@ static inline int
+ gfp_to_alloc_flags(gfp_t gfp_mask)
+ {
+ 	int alloc_flags = ALLOC_WMARK_MIN | ALLOC_CPUSET;
+-	const gfp_t wait = gfp_mask & __GFP_WAIT;
++	const bool atomic = !(gfp_mask & (__GFP_WAIT | __GFP_NO_KSWAPD));
+ 
+ 	/* __GFP_HIGH is assumed to be the same as ALLOC_HIGH to save a branch. */
+ 	BUILD_BUG_ON(__GFP_HIGH != (__force gfp_t) ALLOC_HIGH);
+@@ -2063,20 +2063,20 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
+ 	 * The caller may dip into page reserves a bit more if the caller
+ 	 * cannot run direct reclaim, or if the caller has realtime scheduling
+ 	 * policy or is asking for __GFP_HIGH memory.  GFP_ATOMIC requests will
+-	 * set both ALLOC_HARDER (!wait) and ALLOC_HIGH (__GFP_HIGH).
++	 * set both ALLOC_HARDER (atomic == true) and ALLOC_HIGH (__GFP_HIGH).
+ 	 */
+ 	alloc_flags |= (__force int) (gfp_mask & __GFP_HIGH);
+ 
+-	if (!wait) {
++	if (atomic) {
+ 		/*
+-		 * Not worth trying to allocate harder for
+-		 * __GFP_NOMEMALLOC even if it can't schedule.
++		 * Not worth trying to allocate harder for __GFP_NOMEMALLOC even
++		 * if it can't schedule.
+ 		 */
+-		if  (!(gfp_mask & __GFP_NOMEMALLOC))
++		if (!(gfp_mask & __GFP_NOMEMALLOC))
+ 			alloc_flags |= ALLOC_HARDER;
+ 		/*
+-		 * Ignore cpuset if GFP_ATOMIC (!wait) rather than fail alloc.
+-		 * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
++		 * Ignore cpuset mems for GFP_ATOMIC rather than fail, see the
++		 * comment for __cpuset_node_allowed_softwall().
+ 		 */
+ 		alloc_flags &= ~ALLOC_CPUSET;
+ 	} else if (unlikely(rt_task(current)) && !in_interrupt())
+diff --git a/mm/slab.c b/mm/slab.c
+index 4c3b671..aea5e42 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3270,7 +3270,7 @@ static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags)
+ 	if (cpuset_do_slab_mem_spread() && (cachep->flags & SLAB_MEM_SPREAD))
+ 		nid_alloc = cpuset_slab_spread_node();
+ 	else if (current->mempolicy)
+-		nid_alloc = slab_node(current->mempolicy);
++		nid_alloc = slab_node();
+ 	if (nid_alloc != nid_here)
+ 		return ____cache_alloc_node(cachep, flags, nid_alloc);
+ 	return NULL;
+@@ -3302,7 +3302,7 @@ static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags)
+ 
+ retry_cpuset:
+ 	cpuset_mems_cookie = get_mems_allowed();
+-	zonelist = node_zonelist(slab_node(current->mempolicy), flags);
++	zonelist = node_zonelist(slab_node(), flags);
+ 
+ retry:
+ 	/*
+diff --git a/mm/slub.c b/mm/slub.c
+index fc719f7..6a4c2fb 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1608,7 +1608,7 @@ static struct page *get_any_partial(struct kmem_cache *s, gfp_t flags,
+ 
+ 	do {
+ 		cpuset_mems_cookie = get_mems_allowed();
+-		zonelist = node_zonelist(slab_node(current->mempolicy), flags);
++		zonelist = node_zonelist(slab_node(), flags);
+ 		for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
+ 			struct kmem_cache_node *n;
+ 
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index 158887a..74e59cd 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -804,7 +804,8 @@ static int l2cap_sock_shutdown(struct socket *sock, int how)
+ 		sk->sk_shutdown = SHUTDOWN_MASK;
+ 		l2cap_chan_close(chan, 0);
+ 
+-		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
++		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
++		    !(current->flags & PF_EXITING))
+ 			err = bt_sock_wait_state(sk, BT_CLOSED,
+ 							sk->sk_lingertime);
+ 	}
+diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
+index 14c4864..93a8241 100644
+--- a/net/bluetooth/rfcomm/sock.c
++++ b/net/bluetooth/rfcomm/sock.c
+@@ -901,7 +901,8 @@ static int rfcomm_sock_shutdown(struct socket *sock, int how)
+ 		sk->sk_shutdown = SHUTDOWN_MASK;
+ 		__rfcomm_sock_close(sk);
+ 
+-		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
++		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
++		    !(current->flags & PF_EXITING))
+ 			err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
+ 	}
+ 	release_sock(sk);
+diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
+index a324b00..2e80aee7 100644
+--- a/net/bluetooth/sco.c
++++ b/net/bluetooth/sco.c
+@@ -774,7 +774,8 @@ static int sco_sock_shutdown(struct socket *sock, int how)
+ 		sco_sock_clear_timer(sk);
+ 		__sco_sock_close(sk);
+ 
+-		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime)
++		if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
++		    !(current->flags & PF_EXITING))
+ 			err = bt_sock_wait_state(sk, BT_CLOSED,
+ 							sk->sk_lingertime);
+ 	}
+@@ -794,7 +795,8 @@ static int sco_sock_release(struct socket *sock)
+ 
+ 	sco_sock_close(sk);
+ 
+-	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime) {
++	if (sock_flag(sk, SOCK_LINGER) && sk->sk_lingertime &&
++	    !(current->flags & PF_EXITING)) {
+ 		lock_sock(sk);
+ 		err = bt_sock_wait_state(sk, BT_CLOSED, sk->sk_lingertime);
+ 		release_sock(sk);
+diff --git a/net/compat.c b/net/compat.c
+index 41724c9..759e542 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -85,7 +85,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ {
+ 	int tot_len;
+ 
+-	if (kern_msg->msg_namelen) {
++	if (kern_msg->msg_name && kern_msg->msg_namelen) {
+ 		if (mode == VERIFY_READ) {
+ 			int err = move_addr_to_kernel(kern_msg->msg_name,
+ 						      kern_msg->msg_namelen,
+@@ -93,10 +93,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ 			if (err < 0)
+ 				return err;
+ 		}
+-		if (kern_msg->msg_name)
+-			kern_msg->msg_name = kern_address;
+-	} else
++		kern_msg->msg_name = kern_address;
++	} else {
+ 		kern_msg->msg_name = NULL;
++		kern_msg->msg_namelen = 0;
++	}
+ 
+ 	tot_len = iov_from_user_compat_to_kern(kern_iov,
+ 					  (struct compat_iovec __user *)kern_msg->msg_iov,
+diff --git a/net/core/iovec.c b/net/core/iovec.c
+index 139ef93..66e3f1f 100644
+--- a/net/core/iovec.c
++++ b/net/core/iovec.c
+@@ -39,7 +39,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
+ {
+ 	int size, ct, err;
+ 
+-	if (m->msg_namelen) {
++	if (m->msg_name && m->msg_namelen) {
+ 		if (mode == VERIFY_READ) {
+ 			void __user *namep;
+ 			namep = (void __user __force *) m->msg_name;
+@@ -48,10 +48,10 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
+ 			if (err < 0)
+ 				return err;
+ 		}
+-		if (m->msg_name)
+-			m->msg_name = address;
++		m->msg_name = address;
+ 	} else {
+ 		m->msg_name = NULL;
++		m->msg_namelen = 0;
+ 	}
+ 
+ 	size = m->msg_iovlen * sizeof(struct iovec);
+@@ -157,6 +157,10 @@ EXPORT_SYMBOL(memcpy_fromiovec);
+ int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+ 			int offset, int len)
+ {
++	/* No data? Done! */
++	if (len == 0)
++		return 0;
++
+ 	/* Skip over the finished iovecs */
+ 	while (offset >= iov->iov_len) {
+ 		offset -= iov->iov_len;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index 925991a..fd53919 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -79,29 +79,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ #endif
+ 
+ #ifdef CONFIG_INET
+-__u32 secure_ip_id(__be32 daddr)
+-{
+-	u32 hash[MD5_DIGEST_WORDS];
+-
+-	hash[0] = (__force __u32) daddr;
+-	hash[1] = net_secret[13];
+-	hash[2] = net_secret[14];
+-	hash[3] = net_secret[15];
+-
+-	md5_transform(hash, net_secret);
+-
+-	return hash[0];
+-}
+-
+-__u32 secure_ipv6_id(const __be32 daddr[4])
+-{
+-	__u32 hash[4];
+-
+-	memcpy(hash, daddr, 16);
+-	md5_transform(hash, net_secret);
+-
+-	return hash[0];
+-}
+ 
+ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+ 				 __be16 sport, __be16 dport)
+diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
+index afaa735..dbec8b5 100644
+--- a/net/ipv4/cipso_ipv4.c
++++ b/net/ipv4/cipso_ipv4.c
+@@ -974,7 +974,7 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
+ 				return -EPERM;
+ 			break;
+ 		}
+-		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
++		ret_val = netlbl_secattr_catmap_setbit(&secattr->attr.mls.cat,
+ 						       host_spot,
+ 						       GFP_ATOMIC);
+ 		if (ret_val != 0)
+@@ -1076,7 +1076,7 @@ static int cipso_v4_map_cat_enum_ntoh(const struct cipso_v4_doi *doi_def,
+ 	u32 iter;
+ 
+ 	for (iter = 0; iter < net_cat_len; iter += 2) {
+-		ret_val = netlbl_secattr_catmap_setbit(secattr->attr.mls.cat,
++		ret_val = netlbl_secattr_catmap_setbit(&secattr->attr.mls.cat,
+ 				get_unaligned_be16(&net_cat[iter]),
+ 				GFP_ATOMIC);
+ 		if (ret_val != 0)
+@@ -1218,7 +1218,7 @@ static int cipso_v4_map_cat_rng_ntoh(const struct cipso_v4_doi *doi_def,
+ 		else
+ 			cat_low = 0;
+ 
+-		ret_val = netlbl_secattr_catmap_setrng(secattr->attr.mls.cat,
++		ret_val = netlbl_secattr_catmap_setrng(&secattr->attr.mls.cat,
+ 						       cat_low,
+ 						       cat_high,
+ 						       GFP_ATOMIC);
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 7f7e670..7fe66d9 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -342,7 +342,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
+ 	pip->saddr    = fl4.saddr;
+ 	pip->protocol = IPPROTO_IGMP;
+ 	pip->tot_len  = 0;	/* filled in later */
+-	ip_select_ident(skb, &rt->dst, NULL);
++	ip_select_ident(skb, NULL);
+ 	((u8*)&pip[1])[0] = IPOPT_RA;
+ 	((u8*)&pip[1])[1] = 4;
+ 	((u8*)&pip[1])[2] = 0;
+@@ -683,7 +683,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
+ 	iph->daddr    = dst;
+ 	iph->saddr    = fl4.saddr;
+ 	iph->protocol = IPPROTO_IGMP;
+-	ip_select_ident(skb, &rt->dst, NULL);
++	ip_select_ident(skb, NULL);
+ 	((u8*)&iph[1])[0] = IPOPT_RA;
+ 	((u8*)&iph[1])[1] = 4;
+ 	((u8*)&iph[1])[2] = 0;
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index 58c4e696..9d74cc7 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -26,20 +26,7 @@
+  *  Theory of operations.
+  *  We keep one entry for each peer IP address.  The nodes contains long-living
+  *  information about the peer which doesn't depend on routes.
+- *  At this moment this information consists only of ID field for the next
+- *  outgoing IP packet.  This field is incremented with each packet as encoded
+- *  in inet_getid() function (include/net/inetpeer.h).
+- *  At the moment of writing this notes identifier of IP packets is generated
+- *  to be unpredictable using this code only for packets subjected
+- *  (actually or potentially) to defragmentation.  I.e. DF packets less than
+- *  PMTU in size when local fragmentation is disabled use a constant ID and do
+- *  not use this code (see ip_select_ident() in include/net/ip.h).
+  *
+- *  Route cache entries hold references to our nodes.
+- *  New cache entries get references via lookup by destination IP address in
+- *  the avl tree.  The reference is grabbed only when it's needed i.e. only
+- *  when we try to output IP packet which needs an unpredictable ID (see
+- *  __ip_select_ident() in net/ipv4/route.c).
+  *  Nodes are removed only when reference counter goes to 0.
+  *  When it's happened the node may be removed when a sufficient amount of
+  *  time has been passed since its last use.  The less-recently-used entry can
+@@ -62,7 +49,6 @@
+  *		refcnt: atomically against modifications on other CPU;
+  *		   usually under some other lock to prevent node disappearing
+  *		daddr: unchangeable
+- *		ip_id_count: atomic value (no lock needed)
+  */
+ 
+ static struct kmem_cache *peer_cachep __read_mostly;
+@@ -488,10 +474,6 @@ relookup:
+ 		p->daddr = *daddr;
+ 		atomic_set(&p->refcnt, 1);
+ 		atomic_set(&p->rid, 0);
+-		atomic_set(&p->ip_id_count,
+-				(daddr->family == AF_INET) ?
+-					secure_ip_id(daddr->addr.a4) :
+-					secure_ipv6_id(daddr->addr.a6));
+ 		p->tcp_ts_stamp = 0;
+ 		p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
+ 		p->rate_tokens = 0;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 16191f0..223085f 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -162,7 +162,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
+ 	iph->daddr    = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
+ 	iph->saddr    = saddr;
+ 	iph->protocol = sk->sk_protocol;
+-	ip_select_ident(skb, &rt->dst, sk);
++	ip_select_ident(skb, sk);
+ 
+ 	if (opt && opt->opt.optlen) {
+ 		iph->ihl += opt->opt.optlen>>2;
+@@ -390,8 +390,7 @@ packet_routed:
+ 		ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
+ 	}
+ 
+-	ip_select_ident_more(skb, &rt->dst, sk,
+-			     (skb_shinfo(skb)->gso_segs ?: 1) - 1);
++	ip_select_ident_segs(skb, sk, skb_shinfo(skb)->gso_segs ?: 1);
+ 
+ 	skb->priority = sk->sk_priority;
+ 	skb->mark = sk->sk_mark;
+@@ -1334,7 +1333,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ 	iph->ihl = 5;
+ 	iph->tos = inet->tos;
+ 	iph->frag_off = df;
+-	ip_select_ident(skb, &rt->dst, sk);
++	ip_select_ident(skb, sk);
+ 	iph->ttl = ttl;
+ 	iph->protocol = sk->sk_protocol;
+ 	iph->saddr = fl4->saddr;
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 140d377..7993d16 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1579,7 +1579,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
+ 	iph->protocol	=	IPPROTO_IPIP;
+ 	iph->ihl	=	5;
+ 	iph->tot_len	=	htons(skb->len);
+-	ip_select_ident(skb, skb_dst(skb), NULL);
++	ip_select_ident(skb, NULL);
+ 	ip_send_check(iph);
+ 
+ 	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index cfded93..75fea1f 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -380,7 +380,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
+ 		iph->check   = 0;
+ 		iph->tot_len = htons(length);
+ 		if (!iph->id)
+-			ip_select_ident(skb, &rt->dst, NULL);
++			ip_select_ident(skb, NULL);
+ 
+ 		iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
+ 	}
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 6526110..d361dc0 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1344,46 +1344,53 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
+ 		rt->rt_peer_genid = rt_peer_genid();
+ }
+ 
+-/*
+- * Peer allocation may fail only in serious out-of-memory conditions.  However
+- * we still can generate some output.
+- * Random ID selection looks a bit dangerous because we have no chances to
+- * select ID being unique in a reasonable period of time.
+- * But broken packet identifier may be better than no packet at all.
++#define IP_IDENTS_SZ 2048u
++struct ip_ident_bucket {
++	atomic_t	id;
++	u32		stamp32;
++};
++
++static struct ip_ident_bucket *ip_idents __read_mostly;
++
++/* In order to protect privacy, we add a perturbation to identifiers
++ * if one generator is seldom used. This makes hard for an attacker
++ * to infer how many packets were sent between two points in time.
+  */
+-static void ip_select_fb_ident(struct iphdr *iph)
++u32 ip_idents_reserve(u32 hash, int segs)
+ {
+-	static DEFINE_SPINLOCK(ip_fb_id_lock);
+-	static u32 ip_fallback_id;
+-	u32 salt;
++	struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
++	u32 old = ACCESS_ONCE(bucket->stamp32);
++	u32 now = (u32)jiffies;
++	u32 delta = 0;
++
++	if (old != now && cmpxchg(&bucket->stamp32, old, now) == old) {
++		u64 x = random32();
++
++		x *= (now - old);
++		delta = (u32)(x >> 32);
++	}
+ 
+-	spin_lock_bh(&ip_fb_id_lock);
+-	salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr);
+-	iph->id = htons(salt & 0xFFFF);
+-	ip_fallback_id = salt;
+-	spin_unlock_bh(&ip_fb_id_lock);
++	return atomic_add_return(segs + delta, &bucket->id) - segs;
+ }
++EXPORT_SYMBOL(ip_idents_reserve);
+ 
+-void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
++void __ip_select_ident(struct iphdr *iph, int segs)
+ {
+-	struct rtable *rt = (struct rtable *) dst;
+-
+-	if (rt && !(rt->dst.flags & DST_NOPEER)) {
+-		if (rt->peer == NULL)
+-			rt_bind_peer(rt, rt->rt_dst, 1);
++	static u32 ip_idents_hashrnd __read_mostly;
++	static bool hashrnd_initialized = false;
++	u32 hash, id;
+ 
+-		/* If peer is attached to destination, it is never detached,
+-		   so that we need not to grab a lock to dereference it.
+-		 */
+-		if (rt->peer) {
+-			iph->id = htons(inet_getid(rt->peer, more));
+-			return;
+-		}
+-	} else if (!rt)
+-		printk(KERN_DEBUG "rt_bind_peer(0) @%p\n",
+-		       __builtin_return_address(0));
++	if (unlikely(!hashrnd_initialized)) {
++		hashrnd_initialized = true;
++		get_random_bytes(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
++	}
+ 
+-	ip_select_fb_ident(iph);
++	hash = jhash_3words((__force u32)iph->daddr,
++			    (__force u32)iph->saddr,
++			    iph->protocol,
++			    ip_idents_hashrnd);
++	id = ip_idents_reserve(hash, segs);
++	iph->id = htons(id);
+ }
+ EXPORT_SYMBOL(__ip_select_ident);
+ 
+@@ -3023,7 +3030,6 @@ static int rt_fill_info(struct net *net,
+ 	error = rt->dst.error;
+ 	if (peer) {
+ 		inet_peer_refcheck(rt->peer);
+-		id = atomic_read(&peer->ip_id_count) & 0xffff;
+ 		if (peer->tcp_ts_stamp) {
+ 			ts = peer->tcp_ts;
+ 			tsage = get_seconds() - peer->tcp_ts_stamp;
+@@ -3455,6 +3461,12 @@ int __init ip_rt_init(void)
+ {
+ 	int rc = 0;
+ 
++	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
++	if (!ip_idents)
++		panic("IP: failed to allocate ip_idents\n");
++
++	get_random_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++
+ #ifdef CONFIG_IP_ROUTE_CLASSID
+ 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
+ 	if (!ip_rt_acct)
+diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
+index 80fa2bf..c042e52 100644
+--- a/net/ipv4/tcp_vegas.c
++++ b/net/ipv4/tcp_vegas.c
+@@ -218,7 +218,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+ 			 * This is:
+ 			 *     (actual rate in segments) * baseRTT
+ 			 */
+-			target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
++			target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT;
++			do_div(target_cwnd, rtt);
+ 
+ 			/* Calculate the difference between the window we had,
+ 			 * and the window we would like to have. This quantity
+diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
+index ac43cd7..b4d1858 100644
+--- a/net/ipv4/tcp_veno.c
++++ b/net/ipv4/tcp_veno.c
+@@ -144,7 +144,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+ 
+ 		rtt = veno->minrtt;
+ 
+-		target_cwnd = (tp->snd_cwnd * veno->basertt);
++		target_cwnd = (u64)tp->snd_cwnd * veno->basertt;
+ 		target_cwnd <<= V_PARAM_SHIFT;
+ 		do_div(target_cwnd, rtt);
+ 
+diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
+index 938553e..5531eb2 100644
+--- a/net/ipv4/xfrm4_mode_tunnel.c
++++ b/net/ipv4/xfrm4_mode_tunnel.c
+@@ -54,12 +54,12 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
+ 
+ 	top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
+ 		0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
+-	ip_select_ident(skb, dst->child, NULL);
+ 
+ 	top_iph->ttl = ip4_dst_hoplimit(dst->child);
+ 
+ 	top_iph->saddr = x->props.saddr.a4;
+ 	top_iph->daddr = x->id.daddr.a4;
++	ip_select_ident(skb, NULL);
+ 
+ 	return 0;
+ }
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 064b5c9..46fc6a3 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -600,22 +600,19 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ 
+ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+ {
+-	static atomic_t ipv6_fragmentation_id;
+-	int ident;
++	static u32 ip6_idents_hashrnd __read_mostly;
++	static bool hashrnd_initialized = false;
++	u32 hash, id;
+ 
+-	if (rt && !(rt->dst.flags & DST_NOPEER)) {
+-		struct inet_peer *peer;
+-
+-		if (!rt->rt6i_peer)
+-			rt6_bind_peer(rt, 1);
+-		peer = rt->rt6i_peer;
+-		if (peer) {
+-			fhdr->identification = htonl(inet_getid(peer, 0));
+-			return;
+-		}
++	if (unlikely(!hashrnd_initialized)) {
++		hashrnd_initialized = true;
++		get_random_bytes(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+ 	}
+-	ident = atomic_inc_return(&ipv6_fragmentation_id);
+-	fhdr->identification = htonl(ident);
++	hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
++	hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
++
++	id = ip_idents_reserve(hash, 1);
++	fhdr->identification = htonl(id);
+ }
+ 
+ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index 38c0813..cc8f8b4 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -853,7 +853,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+ 	iph->daddr		=	cp->daddr.ip;
+ 	iph->saddr		=	saddr;
+ 	iph->ttl		=	old_iph->ttl;
+-	ip_select_ident(skb, &rt->dst, NULL);
++	ip_select_ident(skb, NULL);
+ 
+ 	/* Another hack: avoid icmp_send in ip_fragment */
+ 	skb->local_df = 1;
+diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
+index 824f184..bcecae0 100644
+--- a/net/netlabel/netlabel_kapi.c
++++ b/net/netlabel/netlabel_kapi.c
+@@ -523,7 +523,7 @@ int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
+ 
+ /**
+  * netlbl_secattr_catmap_setbit - Set a bit in a LSM secattr catmap
+- * @catmap: the category bitmap
++ * @catmap: pointer to the category bitmap
+  * @bit: the bit to set
+  * @flags: memory allocation flags
+  *
+@@ -532,18 +532,25 @@ int netlbl_secattr_catmap_walk_rng(struct netlbl_lsm_secattr_catmap *catmap,
+  * negative values on failure.
+  *
+  */
+-int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
++int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap **catmap,
+ 				 u32 bit,
+ 				 gfp_t flags)
+ {
+-	struct netlbl_lsm_secattr_catmap *iter = catmap;
++	struct netlbl_lsm_secattr_catmap *iter = *catmap;
+ 	u32 node_bit;
+ 	u32 node_idx;
+ 
+ 	while (iter->next != NULL &&
+ 	       bit >= (iter->startbit + NETLBL_CATMAP_SIZE))
+ 		iter = iter->next;
+-	if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
++	if (bit < iter->startbit) {
++		iter = netlbl_secattr_catmap_alloc(flags);
++		if (iter == NULL)
++			return -ENOMEM;
++		iter->next = *catmap;
++		iter->startbit = bit & ~(NETLBL_CATMAP_SIZE - 1);
++		*catmap = iter;
++	} else if (bit >= (iter->startbit + NETLBL_CATMAP_SIZE)) {
+ 		iter->next = netlbl_secattr_catmap_alloc(flags);
+ 		if (iter->next == NULL)
+ 			return -ENOMEM;
+@@ -561,7 +568,7 @@ int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
+ 
+ /**
+  * netlbl_secattr_catmap_setrng - Set a range of bits in a LSM secattr catmap
+- * @catmap: the category bitmap
++ * @catmap: pointer to the category bitmap
+  * @start: the starting bit
+  * @end: the last bit in the string
+  * @flags: memory allocation flags
+@@ -571,15 +578,16 @@ int netlbl_secattr_catmap_setbit(struct netlbl_lsm_secattr_catmap *catmap,
+  * on success, negative values on failure.
+  *
+  */
+-int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
++int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap **catmap,
+ 				 u32 start,
+ 				 u32 end,
+ 				 gfp_t flags)
+ {
+ 	int ret_val = 0;
+-	struct netlbl_lsm_secattr_catmap *iter = catmap;
++	struct netlbl_lsm_secattr_catmap *iter = *catmap;
+ 	u32 iter_max_spot;
+ 	u32 spot;
++	u32 orig_spot = iter->startbit;
+ 
+ 	/* XXX - This could probably be made a bit faster by combining writes
+ 	 * to the catmap instead of setting a single bit each time, but for
+@@ -597,7 +605,9 @@ int netlbl_secattr_catmap_setrng(struct netlbl_lsm_secattr_catmap *catmap,
+ 			iter = iter->next;
+ 			iter_max_spot = iter->startbit + NETLBL_CATMAP_SIZE;
+ 		}
+-		ret_val = netlbl_secattr_catmap_setbit(iter, spot, GFP_ATOMIC);
++		ret_val = netlbl_secattr_catmap_setbit(&iter, spot, flags);
++		if (iter->startbit < orig_spot)
++			*catmap = iter;
+ 	}
+ 
+ 	return ret_val;
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 25b207b..da54d29 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1188,6 +1188,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
+ 	asoc->c = new->c;
+ 	asoc->peer.rwnd = new->peer.rwnd;
+ 	asoc->peer.sack_needed = new->peer.sack_needed;
++	asoc->peer.auth_capable = new->peer.auth_capable;
+ 	asoc->peer.i = new->peer.i;
+ 	sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
+ 			 asoc->peer.i.initial_tsn, GFP_ATOMIC);
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index cf3e22c..5bd9aa9 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,7 @@ out:
+ 	return err;
+ no_route:
+ 	kfree_skb(nskb);
+-	IP_INC_STATS_BH(&init_net, IPSTATS_MIB_OUTNOROUTES);
++	IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+ 
+ 	/* FIXME: Returning the 'err' will effect all the associations
+ 	 * associated with a socket, although only one of the paths of the
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 7db62b4..e3adb49 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -1842,7 +1842,7 @@ static void smack_set_catset(char *catset, struct netlbl_lsm_secattr *sap)
+ 		for (m = 0x80; m != 0; m >>= 1, cat++) {
+ 			if ((m & *cp) == 0)
+ 				continue;
+-			rc = netlbl_secattr_catmap_setbit(sap->attr.mls.cat,
++			rc = netlbl_secattr_catmap_setbit(&sap->attr.mls.cat,
+ 							  cat, GFP_ATOMIC);
+ 		}
+ }
+diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig
+index e7244ac..e2e4829 100644
+--- a/sound/pci/Kconfig
++++ b/sound/pci/Kconfig
+@@ -852,8 +852,8 @@ config SND_VIRTUOSO
+ 	select SND_JACK if INPUT=y || INPUT=SND
+ 	help
+ 	  Say Y here to include support for sound cards based on the
+-	  Asus AV66/AV100/AV200 chips, i.e., Xonar D1, DX, D2, D2X, DS,
+-	  Essence ST (Deluxe), and Essence STX.
++	  Asus AV66/AV100/AV200 chips, i.e., Xonar D1, DX, D2, D2X, DS, DSX,
++	  Essence ST (Deluxe), and Essence STX (II).
+ 	  Support for the HDAV1.3 (Deluxe) and HDAV1.3 Slim is experimental;
+ 	  for the Xense, missing.
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 400168e..491cdf0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -436,6 +436,8 @@ static void alc_fix_pll(struct hda_codec *codec)
+ 			    spec->pll_coef_idx);
+ 	val = snd_hda_codec_read(codec, spec->pll_nid, 0,
+ 				 AC_VERB_GET_PROC_COEF, 0);
++	if (val == -1)
++		return;
+ 	snd_hda_codec_write(codec, spec->pll_nid, 0, AC_VERB_SET_COEF_INDEX,
+ 			    spec->pll_coef_idx);
+ 	snd_hda_codec_write(codec, spec->pll_nid, 0, AC_VERB_SET_PROC_COEF,
+@@ -4773,6 +4775,8 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ static void alc269_toggle_power_output(struct hda_codec *codec, int power_up)
+ {
+ 	int val = alc_read_coef_idx(codec, 0x04);
++	if (val == -1)
++		return;
+ 	if (power_up)
+ 		val |= 1 << 11;
+ 	else
+@@ -5184,27 +5188,30 @@ static int alc269_fill_coef(struct hda_codec *codec)
+ 	if ((alc_get_coef0(codec) & 0x00ff) == 0x017) {
+ 		val = alc_read_coef_idx(codec, 0x04);
+ 		/* Power up output pin */
+-		alc_write_coef_idx(codec, 0x04, val | (1<<11));
++		if (val != -1)
++			alc_write_coef_idx(codec, 0x04, val | (1<<11));
+ 	}
+ 
+ 	if ((alc_get_coef0(codec) & 0x00ff) == 0x018) {
+ 		val = alc_read_coef_idx(codec, 0xd);
+-		if ((val & 0x0c00) >> 10 != 0x1) {
++		if (val != -1 && (val & 0x0c00) >> 10 != 0x1) {
+ 			/* Capless ramp up clock control */
+ 			alc_write_coef_idx(codec, 0xd, val | (1<<10));
+ 		}
+ 		val = alc_read_coef_idx(codec, 0x17);
+-		if ((val & 0x01c0) >> 6 != 0x4) {
++		if (val != -1 && (val & 0x01c0) >> 6 != 0x4) {
+ 			/* Class D power on reset */
+ 			alc_write_coef_idx(codec, 0x17, val | (1<<7));
+ 		}
+ 	}
+ 
+ 	val = alc_read_coef_idx(codec, 0xd); /* Class D */
+-	alc_write_coef_idx(codec, 0xd, val | (1<<14));
++	if (val != -1)
++		alc_write_coef_idx(codec, 0xd, val | (1<<14));
+ 
+ 	val = alc_read_coef_idx(codec, 0x4); /* HP */
+-	alc_write_coef_idx(codec, 0x4, val | (1<<11));
++	if (val != -1)
++		alc_write_coef_idx(codec, 0x4, val | (1<<11));
+ 
+ 	return 0;
+ }
+diff --git a/sound/pci/oxygen/virtuoso.c b/sound/pci/oxygen/virtuoso.c
+index 4149a0c..7edd5e4 100644
+--- a/sound/pci/oxygen/virtuoso.c
++++ b/sound/pci/oxygen/virtuoso.c
+@@ -52,6 +52,8 @@ static DEFINE_PCI_DEVICE_TABLE(xonar_ids) = {
+ 	{ OXYGEN_PCI_SUBID(0x1043, 0x835d) },
+ 	{ OXYGEN_PCI_SUBID(0x1043, 0x835e) },
+ 	{ OXYGEN_PCI_SUBID(0x1043, 0x838e) },
++	{ OXYGEN_PCI_SUBID(0x1043, 0x8522) },
++	{ OXYGEN_PCI_SUBID(0x1043, 0x85f4) },
+ 	{ OXYGEN_PCI_SUBID_BROKEN_EEPROM },
+ 	{ }
+ };
+diff --git a/sound/pci/oxygen/xonar_pcm179x.c b/sound/pci/oxygen/xonar_pcm179x.c
+index 8433aa7..4cac06a 100644
+--- a/sound/pci/oxygen/xonar_pcm179x.c
++++ b/sound/pci/oxygen/xonar_pcm179x.c
+@@ -100,8 +100,8 @@
+  */
+ 
+ /*
+- * Xonar Essence ST (Deluxe)/STX
+- * -----------------------------
++ * Xonar Essence ST (Deluxe)/STX (II)
++ * ----------------------------------
+  *
+  * CMI8788:
+  *
+@@ -1138,6 +1138,14 @@ int __devinit get_xonar_pcm179x_model(struct oxygen *chip,
+ 		chip->model.resume = xonar_stx_resume;
+ 		chip->model.set_dac_params = set_pcm1796_params;
+ 		break;
++	case 0x85f4:
++		chip->model = model_xonar_st;
++		/* TODO: daughterboard support */
++		chip->model.shortname = "Xonar STX II";
++		chip->model.init = xonar_stx_init;
++		chip->model.resume = xonar_stx_resume;
++		chip->model.set_dac_params = set_pcm1796_params;
++		break;
+ 	default:
+ 		return -EINVAL;
+ 	}
+diff --git a/sound/pci/oxygen/xonar_wm87x6.c b/sound/pci/oxygen/xonar_wm87x6.c
+index 915546a..30495b8 100644
+--- a/sound/pci/oxygen/xonar_wm87x6.c
++++ b/sound/pci/oxygen/xonar_wm87x6.c
+@@ -1255,7 +1255,6 @@ static void dump_wm87x6_registers(struct oxygen *chip,
+ }
+ 
+ static const struct oxygen_model model_xonar_ds = {
+-	.shortname = "Xonar DS",
+ 	.longname = "Asus Virtuoso 66",
+ 	.chip = "AV200",
+ 	.init = xonar_ds_init,
+@@ -1325,6 +1324,11 @@ int __devinit get_xonar_wm87x6_model(struct oxygen *chip,
+ 	switch (id->subdevice) {
+ 	case 0x838e:
+ 		chip->model = model_xonar_ds;
++		chip->model.shortname = "Xonar DS";
++		break;
++	case 0x8522:
++		chip->model = model_xonar_ds;
++		chip->model.shortname = "Xonar DSX";
+ 		break;
+ 	case 0x835e:
+ 		chip->model = model_xonar_hdav_slim;
+diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
+index b583e60..72886e3 100644
+--- a/sound/soc/pxa/pxa-ssp.c
++++ b/sound/soc/pxa/pxa-ssp.c
+@@ -778,9 +778,7 @@ static int pxa_ssp_remove(struct snd_soc_dai *dai)
+ 			  SNDRV_PCM_RATE_44100 | SNDRV_PCM_RATE_48000 |	\
+ 			  SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000)
+ 
+-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
+-			    SNDRV_PCM_FMTBIT_S24_LE |	\
+-			    SNDRV_PCM_FMTBIT_S32_LE)
++#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE)
+ 
+ static struct snd_soc_dai_ops pxa_ssp_dai_ops = {
+ 	.startup	= pxa_ssp_startup,
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index bff42bf..ad22bd9 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -824,11 +824,9 @@ static int i2s_suspend(struct snd_soc_dai *dai)
+ {
+ 	struct i2s_dai *i2s = to_info(dai);
+ 
+-	if (dai->active) {
+-		i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
+-		i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
+-		i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
+-	}
++	i2s->suspend_i2smod = readl(i2s->addr + I2SMOD);
++	i2s->suspend_i2scon = readl(i2s->addr + I2SCON);
++	i2s->suspend_i2spsr = readl(i2s->addr + I2SPSR);
+ 
+ 	return 0;
+ }
+@@ -837,11 +835,9 @@ static int i2s_resume(struct snd_soc_dai *dai)
+ {
+ 	struct i2s_dai *i2s = to_info(dai);
+ 
+-	if (dai->active) {
+-		writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
+-		writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
+-		writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
+-	}
++	writel(i2s->suspend_i2scon, i2s->addr + I2SCON);
++	writel(i2s->suspend_i2smod, i2s->addr + I2SMOD);
++	writel(i2s->suspend_i2spsr, i2s->addr + I2SPSR);
+ 
+ 	return 0;
+ }
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index 5dbb35d..c946700 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -61,6 +61,14 @@ static pfn_t kvm_pin_pages(struct kvm *kvm, struct kvm_memory_slot *slot,
+ 	return pfn;
+ }
+ 
++static void kvm_unpin_pages(struct kvm *kvm, pfn_t pfn, unsigned long npages)
++{
++	unsigned long i;
++
++	for (i = 0; i < npages; ++i)
++		kvm_release_pfn_clean(pfn + i);
++}
++
+ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ {
+ 	gfn_t gfn, end_gfn;
+@@ -121,6 +129,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ 		if (r) {
+ 			printk(KERN_ERR "kvm_iommu_map_address:"
+ 			       "iommu failed to map pfn=%llx\n", pfn);
++			kvm_unpin_pages(kvm, pfn, page_size);
+ 			goto unmap_pages;
+ 		}
+ 
+@@ -132,7 +141,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ 	return 0;
+ 
+ unmap_pages:
+-	kvm_iommu_put_pages(kvm, slot->base_gfn, gfn);
++	kvm_iommu_put_pages(kvm, slot->base_gfn, gfn - slot->base_gfn);
+ 	return r;
+ }
+ 
+@@ -273,14 +282,6 @@ out_unlock:
+ 	return r;
+ }
+ 
+-static void kvm_unpin_pages(struct kvm *kvm, pfn_t pfn, unsigned long npages)
+-{
+-	unsigned long i;
+-
+-	for (i = 0; i < npages; ++i)
+-		kvm_release_pfn_clean(pfn + i);
+-}
+-
+ static void kvm_iommu_put_pages(struct kvm *kvm,
+ 				gfn_t base_gfn, unsigned long npages)
+ {
diff --git a/3.2.62/4420_grsecurity-3.0-3.2.62-201409112233.patch b/3.2.63/4420_grsecurity-3.0-3.2.63-201409150854.patch
index 51b445a..0e57ae5 100644
--- a/3.2.62/4420_grsecurity-3.0-3.2.62-201409112233.patch
+++ b/3.2.63/4420_grsecurity-3.0-3.2.63-201409150854.patch
@@ -273,7 +273,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 30a5c65..efb1be9 100644
+index 6d3f2d4..8bd5807 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -391,12 +391,8 @@ index 30a5c65..efb1be9 100644
  include $(srctree)/arch/$(SRCARCH)/Makefile
  
  ifneq ($(CONFIG_FRAME_WARN),0)
-@@ -592,9 +668,11 @@ KBUILD_CFLAGS	+= -fomit-frame-pointer
- endif
- endif
+@@ -596,7 +672,7 @@ KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
  
-+KBUILD_CFLAGS   += $(call cc-option, -fno-var-tracking-assignments)
-+
  ifdef CONFIG_DEBUG_INFO
  KBUILD_CFLAGS	+= -g
 -KBUILD_AFLAGS	+= -gdwarf-2
@@ -404,7 +400,7 @@ index 30a5c65..efb1be9 100644
  endif
  
  ifdef CONFIG_DEBUG_INFO_REDUCED
-@@ -708,7 +786,7 @@ export mod_strip_cmd
+@@ -710,7 +786,7 @@ export mod_strip_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -413,7 +409,7 @@ index 30a5c65..efb1be9 100644
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -932,6 +1010,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
+@@ -934,6 +1010,8 @@ vmlinux.o: $(modpost-init) $(vmlinux-main) FORCE
  
  # The actual objects are generated when descending, 
  # make sure no implicit rule kicks in
@@ -422,7 +418,7 @@ index 30a5c65..efb1be9 100644
  $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
  
  # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -941,7 +1021,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
+@@ -943,7 +1021,7 @@ $(sort $(vmlinux-init) $(vmlinux-main)) $(vmlinux-lds): $(vmlinux-dirs) ;
  # Error messages still appears in the original language
  
  PHONY += $(vmlinux-dirs)
@@ -431,7 +427,7 @@ index 30a5c65..efb1be9 100644
  	$(Q)$(MAKE) $(build)=$@
  
  # Store (new) KERNELRELASE string in include/config/kernel.release
-@@ -981,10 +1061,13 @@ prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
+@@ -983,10 +1061,13 @@ prepare1: prepare2 include/linux/version.h include/generated/utsrelease.h \
  
  archprepare: archscripts prepare1 scripts_basic
  
@@ -445,7 +441,7 @@ index 30a5c65..efb1be9 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1089,6 +1172,8 @@ all: modules
+@@ -1091,6 +1172,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -454,7 +450,7 @@ index 30a5c65..efb1be9 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1104,7 +1189,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1106,7 +1189,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -463,7 +459,7 @@ index 30a5c65..efb1be9 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1164,6 +1249,9 @@ MRPROPER_DIRS  += include/config usr/include include/generated          \
+@@ -1166,6 +1249,9 @@ MRPROPER_DIRS  += include/config usr/include include/generated          \
                    arch/*/include/generated
  MRPROPER_FILES += .config .config.old .version .old_version             \
                    include/linux/version.h                               \
@@ -473,7 +469,7 @@ index 30a5c65..efb1be9 100644
  		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
  
  # clean - Delete most, but leave enough to build external modules
-@@ -1200,7 +1288,7 @@ distclean: mrproper
+@@ -1202,7 +1288,7 @@ distclean: mrproper
  	@find $(srctree) $(RCS_FIND_IGNORE) \
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -482,7 +478,7 @@ index 30a5c65..efb1be9 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1361,6 +1449,8 @@ PHONY += $(module-dirs) modules
+@@ -1363,6 +1449,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -491,7 +487,7 @@ index 30a5c65..efb1be9 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1487,17 +1577,21 @@ else
+@@ -1489,17 +1577,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -517,7 +513,7 @@ index 30a5c65..efb1be9 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1507,11 +1601,15 @@ endif
+@@ -1509,11 +1601,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -3107,6 +3103,17 @@ index 27489b6..45ab736 100644
  	help
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
+diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
+index be7bfa1..32098c5 100644
+--- a/arch/ia64/Makefile
++++ b/arch/ia64/Makefile
+@@ -101,5 +101,6 @@ endef
+ archprepare: make_nr_irqs_h FORCE
+ PHONY += make_nr_irqs_h FORCE
+ 
++make_nr_irqs_h: KBUILD_CFLAGS := $(filter-out $(GCC_PLUGINS_CFLAGS),$(KBUILD_CFLAGS))
+ make_nr_irqs_h: FORCE
+ 	$(Q)$(MAKE) $(build)=arch/ia64/kernel include/generated/nr-irqs.h
 diff --git a/arch/ia64/include/asm/atomic.h b/arch/ia64/include/asm/atomic.h
 index 2fc214b..7597423 100644
 --- a/arch/ia64/include/asm/atomic.h
@@ -4110,10 +4117,10 @@ index bf128d7..bc244d6 100644
 -	return sp & ALMASK;
 -}
 diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
-index 4e6ea1f..0922422 100644
+index e56c692..c994648 100644
 --- a/arch/mips/kernel/ptrace.c
 +++ b/arch/mips/kernel/ptrace.c
-@@ -529,6 +529,10 @@ static inline int audit_arch(void)
+@@ -530,6 +530,10 @@ static inline int audit_arch(void)
  	return arch;
  }
  
@@ -4124,7 +4131,7 @@ index 4e6ea1f..0922422 100644
  /*
   * Notification of system call entry/exit
   * - triggered by current->work.syscall_trace
-@@ -538,6 +542,11 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
+@@ -539,6 +543,11 @@ asmlinkage void syscall_trace_enter(struct pt_regs *regs)
  	/* do the secure computing check first */
  	secure_computing(regs->regs[2]);
  
@@ -6249,7 +6256,7 @@ index 5b63bd3..248942d 100644
  };
  
 diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
-index 24523dc..337e4c3 100644
+index f4b78a3..a11ee27 100644
 --- a/arch/powerpc/mm/numa.c
 +++ b/arch/powerpc/mm/numa.c
 @@ -659,7 +659,7 @@ static void __init parse_drconf_memory(struct device_node *memory)
@@ -7772,7 +7779,7 @@ index 96ee50a..68ce124 100644
  	if (unlikely(current->audit_context)) {
  		unsigned long tstate = regs->tstate;
 diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
-index e21d3c0d..8f453c1 100644
+index ffd1245..948b0b7 100644
 --- a/arch/sparc/kernel/smp_64.c
 +++ b/arch/sparc/kernel/smp_64.c
 @@ -871,8 +871,8 @@ extern unsigned long xcall_flush_dcache_page_cheetah;
@@ -8324,37 +8331,10 @@ index 0cbdaa4..f37a97c 100644
  }
  EXPORT_SYMBOL(die_if_kernel);
 diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
-index 76e4ac1..439d7e8 100644
+index 1c90812..439d7e8 100644
 --- a/arch/sparc/kernel/unaligned_64.c
 +++ b/arch/sparc/kernel/unaligned_64.c
-@@ -156,17 +156,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
- unsigned long compute_effective_address(struct pt_regs *regs,
- 					unsigned int insn, unsigned int rd)
- {
-+	int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
- 	unsigned int rs1 = (insn >> 14) & 0x1f;
- 	unsigned int rs2 = insn & 0x1f;
--	int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
-+	unsigned long addr;
- 
- 	if (insn & 0x2000) {
- 		maybe_flush_windows(rs1, 0, rd, from_kernel);
--		return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
-+		addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
- 	} else {
- 		maybe_flush_windows(rs1, rs2, rd, from_kernel);
--		return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
-+		addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
- 	}
-+
-+	if (!from_kernel && test_thread_flag(TIF_32BIT))
-+		addr &= 0xffffffff;
-+
-+	return addr;
- }
- 
- /* This is just to make gcc think die_if_kernel does return... */
-@@ -279,7 +285,7 @@ static void log_unaligned(struct pt_regs *regs)
+@@ -285,7 +285,7 @@ static void log_unaligned(struct pt_regs *regs)
  	static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
  
  	if (__ratelimit(&ratelimit)) {
@@ -9077,7 +9057,7 @@ index 8023fd7..3a6d569 100644
  		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
  			goto bad_area;
 diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 504c062..a383267 100644
+index 2c0b966..00bf94e 100644
 --- a/arch/sparc/mm/fault_64.c
 +++ b/arch/sparc/mm/fault_64.c
 @@ -21,6 +21,9 @@
@@ -9099,7 +9079,7 @@ index 504c062..a383267 100644
  	printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
  	dump_stack();
  	unhandled_fault(regs->tpc, current, regs);
-@@ -272,6 +275,466 @@ static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
+@@ -282,6 +285,466 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs)
  	show_regs(regs);
  }
  
@@ -9566,7 +9546,7 @@ index 504c062..a383267 100644
  asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
  {
  	struct mm_struct *mm = current->mm;
-@@ -340,6 +803,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+@@ -348,6 +811,29 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
  	if (!vma)
  		goto bad_area;
  
@@ -9741,7 +9721,7 @@ index 7b00de6..78239f4 100644
  	protection_map[13] = PAGE_READONLY;
  	protection_map[14] = PAGE_SHARED;
 diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
-index b4989f9..530099e 100644
+index d2c5737..05a3e21 100644
 --- a/arch/sparc/mm/init_64.c
 +++ b/arch/sparc/mm/init_64.c
 @@ -170,9 +170,9 @@ unsigned long sparc64_kern_sec_context __read_mostly;
@@ -9765,7 +9745,7 @@ index b4989f9..530099e 100644
  #endif
  
  #ifdef DCACHE_ALIASING_POSSIBLE
-@@ -417,10 +417,10 @@ void mmu_info(struct seq_file *m)
+@@ -421,10 +421,10 @@ void mmu_info(struct seq_file *m)
  
  #ifdef CONFIG_DEBUG_DCFLUSH
  	seq_printf(m, "DCPageFlushes\t: %d\n",
@@ -9981,7 +9961,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 901447e..38d9380 100644
+index 28a1bca..5ebf70a 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -75,6 +75,7 @@ config X86
@@ -10009,7 +9989,7 @@ index 901447e..38d9380 100644
  	---help---
  	  Say Y here to get to see options related to running Linux under
  	  various hypervisors.  This option alone does not add any kernel code.
-@@ -1023,7 +1025,7 @@ choice
+@@ -1040,7 +1042,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -10018,7 +9998,7 @@ index 901447e..38d9380 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1060,7 +1062,7 @@ config NOHIGHMEM
+@@ -1077,7 +1079,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -10027,7 +10007,7 @@ index 901447e..38d9380 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1114,7 +1116,7 @@ config PAGE_OFFSET
+@@ -1131,7 +1133,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -10036,7 +10016,7 @@ index 901447e..38d9380 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1497,6 +1499,7 @@ config SECCOMP
+@@ -1514,6 +1516,7 @@ config SECCOMP
  
  config CC_STACKPROTECTOR
  	bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
@@ -10044,7 +10024,7 @@ index 901447e..38d9380 100644
  	---help---
  	  This option turns on the -fstack-protector GCC feature. This
  	  feature puts, at the beginning of functions, a canary value on
-@@ -1515,6 +1518,7 @@ source kernel/Kconfig.hz
+@@ -1532,6 +1535,7 @@ source kernel/Kconfig.hz
  
  config KEXEC
  	bool "kexec system call"
@@ -10052,7 +10032,7 @@ index 901447e..38d9380 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1617,6 +1621,8 @@ config X86_NEED_RELOCS
+@@ -1634,6 +1638,8 @@ config X86_NEED_RELOCS
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned" if X86_32
  	default "0x1000000"
@@ -10061,7 +10041,7 @@ index 901447e..38d9380 100644
  	range 0x2000 0x1000000
  	---help---
  	  This value puts the alignment restrictions on physical address
-@@ -1648,9 +1654,10 @@ config HOTPLUG_CPU
+@@ -1665,9 +1671,10 @@ config HOTPLUG_CPU
  	  Say N if you want to disable CPU hotplug.
  
  config COMPAT_VDSO
@@ -11820,7 +11800,7 @@ index 20370c6..a2eb9b0 100644
  		"popl %%ebp\n\t"
  		"popl %%edi\n\t"
 diff --git a/arch/x86/include/asm/atomic.h b/arch/x86/include/asm/atomic.h
-index 58cb6d4..612b126 100644
+index 58cb6d4..9503df6 100644
 --- a/arch/x86/include/asm/atomic.h
 +++ b/arch/x86/include/asm/atomic.h
 @@ -22,7 +22,18 @@
@@ -12092,7 +12072,7 @@ index 58cb6d4..612b126 100644
 + *
 + * Atomically adds @i to @v and returns @i + @v
 + */
-+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
++static inline int __intentional_overflow(-1) atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
 +{
 +#ifdef CONFIG_M386
 +	int __i;
@@ -12121,7 +12101,7 @@ index 58cb6d4..612b126 100644
  }
  
  #define atomic_inc_return(v)  (atomic_add_return(1, v))
-+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
++static inline int __intentional_overflow(-1) atomic_inc_return_unchecked(atomic_unchecked_t *v)
 +{
 +	return atomic_add_return_unchecked(1, v);
 +}
@@ -13711,7 +13691,7 @@ index d8e8eef..1765f78 100644
   * Convert a virtual cached pointer to an uncached pointer
   */
 diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
-index bba3cf8..06bc8da 100644
+index 0a8b519..80e7d5b 100644
 --- a/arch/x86/include/asm/irqflags.h
 +++ b/arch/x86/include/asm/irqflags.h
 @@ -141,6 +141,11 @@ static inline notrace unsigned long arch_local_irq_save(void)
@@ -14891,19 +14871,21 @@ index 975f709..9f779c9 100644
  }
  
 diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
-index 766ea16..5b96cb3 100644
+index 51817fa..19195fc 100644
 --- a/arch/x86/include/asm/pgtable_64_types.h
 +++ b/arch/x86/include/asm/pgtable_64_types.h
-@@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
+@@ -59,7 +59,12 @@ typedef struct { pteval_t pte; } pte_t;
  #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
  #define MODULES_END      _AC(0xffffffffff000000, UL)
  #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
 +#define MODULES_EXEC_VADDR MODULES_VADDR
 +#define MODULES_EXEC_END MODULES_END
-+
+ #define ESPFIX_PGD_ENTRY _AC(-2, UL)
+ #define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)
+ 
 +#define ktla_ktva(addr)		(addr)
 +#define ktva_ktla(addr)		(addr)
- 
++
  #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
 diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
 index 013286a..8b42f4f 100644
@@ -18414,7 +18396,7 @@ index cd28a35..c72ed9a 100644
  #include <asm/processor.h>
  #include <asm/fcntl.h>
 diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
-index dd52355..371d3b9 100644
+index 0fa4f89..40ff646 100644
 --- a/arch/x86/kernel/entry_32.S
 +++ b/arch/x86/kernel/entry_32.S
 @@ -180,13 +180,153 @@
@@ -18774,7 +18756,7 @@ index dd52355..371d3b9 100644
  restore_all:
  	TRACE_IRQS_IRET
  restore_all_notrace:
-@@ -578,14 +785,34 @@ ldt_ss:
+@@ -581,14 +788,34 @@ ldt_ss:
   * compensating for the offset by changing to the ESPFIX segment with
   * a base address that matches for the difference.
   */
@@ -18812,7 +18794,7 @@ index dd52355..371d3b9 100644
  	pushl_cfi $__ESPFIX_SS
  	pushl_cfi %eax			/* new kernel esp */
  	/* Disable interrupts, but do not irqtrace this section: we
-@@ -614,34 +841,28 @@ work_resched:
+@@ -618,34 +845,28 @@ work_resched:
  	movl TI_flags(%ebp), %ecx
  	andl $_TIF_WORK_MASK, %ecx	# is there any work to be done other
  					# than syscall tracing?
@@ -18852,7 +18834,7 @@ index dd52355..371d3b9 100644
  
  	# perform syscall exit tracing
  	ALIGN
-@@ -649,11 +870,14 @@ syscall_trace_entry:
+@@ -653,11 +874,14 @@ syscall_trace_entry:
  	movl $-ENOSYS,PT_EAX(%esp)
  	movl %esp, %eax
  	call syscall_trace_enter
@@ -18868,7 +18850,7 @@ index dd52355..371d3b9 100644
  
  	# perform syscall exit tracing
  	ALIGN
-@@ -666,25 +890,29 @@ syscall_exit_work:
+@@ -670,25 +894,29 @@ syscall_exit_work:
  	movl %esp, %eax
  	call syscall_trace_leave
  	jmp resume_userspace
@@ -18902,7 +18884,7 @@ index dd52355..371d3b9 100644
  	CFI_ENDPROC
  /*
   * End of kprobes section
-@@ -758,6 +986,36 @@ ptregs_clone:
+@@ -762,6 +990,36 @@ ptregs_clone:
  	CFI_ENDPROC
  ENDPROC(ptregs_clone)
  
@@ -18939,9 +18921,9 @@ index dd52355..371d3b9 100644
  .macro FIXUP_ESPFIX_STACK
  /*
   * Switch back for ESPFIX stack to the normal zerobased stack
-@@ -767,8 +1025,15 @@ ENDPROC(ptregs_clone)
-  * normal stack and adjusts ESP with the matching offset.
+@@ -772,8 +1030,15 @@ ENDPROC(ptregs_clone)
   */
+ #ifdef CONFIG_X86_ESPFIX32
  	/* fixup the stack */
 -	mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
 -	mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
@@ -18957,7 +18939,7 @@ index dd52355..371d3b9 100644
  	shl $16, %eax
  	addl %esp, %eax			/* the adjusted stack pointer */
  	pushl_cfi $__KERNEL_DS
-@@ -821,7 +1086,7 @@ vector=vector+1
+@@ -829,7 +1094,7 @@ vector=vector+1
    .endr
  2:	jmp common_interrupt
  .endr
@@ -18966,7 +18948,7 @@ index dd52355..371d3b9 100644
  
  .previous
  END(interrupt)
-@@ -869,7 +1134,7 @@ ENTRY(coprocessor_error)
+@@ -877,7 +1142,7 @@ ENTRY(coprocessor_error)
  	pushl_cfi $do_coprocessor_error
  	jmp error_code
  	CFI_ENDPROC
@@ -18975,7 +18957,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(simd_coprocessor_error)
  	RING0_INT_FRAME
-@@ -890,7 +1155,7 @@ ENTRY(simd_coprocessor_error)
+@@ -898,7 +1163,7 @@ ENTRY(simd_coprocessor_error)
  #endif
  	jmp error_code
  	CFI_ENDPROC
@@ -18984,7 +18966,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(device_not_available)
  	RING0_INT_FRAME
-@@ -898,7 +1163,7 @@ ENTRY(device_not_available)
+@@ -906,7 +1171,7 @@ ENTRY(device_not_available)
  	pushl_cfi $do_device_not_available
  	jmp error_code
  	CFI_ENDPROC
@@ -18993,7 +18975,7 @@ index dd52355..371d3b9 100644
  
  #ifdef CONFIG_PARAVIRT
  ENTRY(native_iret)
-@@ -907,12 +1172,12 @@ ENTRY(native_iret)
+@@ -915,12 +1180,12 @@ ENTRY(native_iret)
  	.align 4
  	.long native_iret, iret_exc
  .previous
@@ -19008,7 +18990,7 @@ index dd52355..371d3b9 100644
  #endif
  
  ENTRY(overflow)
-@@ -921,7 +1186,7 @@ ENTRY(overflow)
+@@ -929,7 +1194,7 @@ ENTRY(overflow)
  	pushl_cfi $do_overflow
  	jmp error_code
  	CFI_ENDPROC
@@ -19017,7 +18999,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(bounds)
  	RING0_INT_FRAME
-@@ -929,7 +1194,7 @@ ENTRY(bounds)
+@@ -937,7 +1202,7 @@ ENTRY(bounds)
  	pushl_cfi $do_bounds
  	jmp error_code
  	CFI_ENDPROC
@@ -19026,7 +19008,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(invalid_op)
  	RING0_INT_FRAME
-@@ -937,7 +1202,7 @@ ENTRY(invalid_op)
+@@ -945,7 +1210,7 @@ ENTRY(invalid_op)
  	pushl_cfi $do_invalid_op
  	jmp error_code
  	CFI_ENDPROC
@@ -19035,7 +19017,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(coprocessor_segment_overrun)
  	RING0_INT_FRAME
-@@ -945,35 +1210,35 @@ ENTRY(coprocessor_segment_overrun)
+@@ -953,35 +1218,35 @@ ENTRY(coprocessor_segment_overrun)
  	pushl_cfi $do_coprocessor_segment_overrun
  	jmp error_code
  	CFI_ENDPROC
@@ -19076,7 +19058,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(divide_error)
  	RING0_INT_FRAME
-@@ -981,7 +1246,7 @@ ENTRY(divide_error)
+@@ -989,7 +1254,7 @@ ENTRY(divide_error)
  	pushl_cfi $do_divide_error
  	jmp error_code
  	CFI_ENDPROC
@@ -19085,7 +19067,7 @@ index dd52355..371d3b9 100644
  
  #ifdef CONFIG_X86_MCE
  ENTRY(machine_check)
-@@ -990,7 +1255,7 @@ ENTRY(machine_check)
+@@ -998,7 +1263,7 @@ ENTRY(machine_check)
  	pushl_cfi machine_check_vector
  	jmp error_code
  	CFI_ENDPROC
@@ -19094,7 +19076,7 @@ index dd52355..371d3b9 100644
  #endif
  
  ENTRY(spurious_interrupt_bug)
-@@ -999,7 +1264,7 @@ ENTRY(spurious_interrupt_bug)
+@@ -1007,7 +1272,7 @@ ENTRY(spurious_interrupt_bug)
  	pushl_cfi $do_spurious_interrupt_bug
  	jmp error_code
  	CFI_ENDPROC
@@ -19103,7 +19085,7 @@ index dd52355..371d3b9 100644
  /*
   * End of kprobes section
   */
-@@ -1115,7 +1380,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
+@@ -1123,7 +1388,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK,
  
  ENTRY(mcount)
  	ret
@@ -19112,7 +19094,7 @@ index dd52355..371d3b9 100644
  
  ENTRY(ftrace_caller)
  	cmpl $0, function_trace_stop
-@@ -1144,7 +1409,7 @@ ftrace_graph_call:
+@@ -1152,7 +1417,7 @@ ftrace_graph_call:
  .globl ftrace_stub
  ftrace_stub:
  	ret
@@ -19121,7 +19103,7 @@ index dd52355..371d3b9 100644
  
  #else /* ! CONFIG_DYNAMIC_FTRACE */
  
-@@ -1180,7 +1445,7 @@ trace:
+@@ -1188,7 +1453,7 @@ trace:
  	popl %ecx
  	popl %eax
  	jmp ftrace_stub
@@ -19130,7 +19112,7 @@ index dd52355..371d3b9 100644
  #endif /* CONFIG_DYNAMIC_FTRACE */
  #endif /* CONFIG_FUNCTION_TRACER */
  
-@@ -1201,7 +1466,7 @@ ENTRY(ftrace_graph_caller)
+@@ -1209,7 +1474,7 @@ ENTRY(ftrace_graph_caller)
  	popl %ecx
  	popl %eax
  	ret
@@ -19139,7 +19121,7 @@ index dd52355..371d3b9 100644
  
  .globl return_to_handler
  return_to_handler:
-@@ -1215,7 +1480,6 @@ return_to_handler:
+@@ -1223,7 +1488,6 @@ return_to_handler:
  	jmp *%ecx
  #endif
  
@@ -19147,7 +19129,7 @@ index dd52355..371d3b9 100644
  #include "syscall_table_32.S"
  
  syscall_table_size=(.-sys_call_table)
-@@ -1261,15 +1525,18 @@ error_code:
+@@ -1269,15 +1533,18 @@ error_code:
  	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
  	REG_TO_PTGS %ecx
  	SET_KERNEL_GS %ecx
@@ -19168,7 +19150,7 @@ index dd52355..371d3b9 100644
  
  /*
   * Debug traps and NMI can happen at the one SYSENTER instruction
-@@ -1311,7 +1578,7 @@ debug_stack_correct:
+@@ -1319,7 +1586,7 @@ debug_stack_correct:
  	call do_debug
  	jmp ret_from_exception
  	CFI_ENDPROC
@@ -19177,7 +19159,7 @@ index dd52355..371d3b9 100644
  
  /*
   * NMI is doubly nasty. It can happen _while_ we're handling
-@@ -1348,6 +1615,9 @@ nmi_stack_correct:
+@@ -1358,6 +1625,9 @@ nmi_stack_correct:
  	xorl %edx,%edx		# zero error code
  	movl %esp,%eax		# pt_regs pointer
  	call do_nmi
@@ -19187,7 +19169,7 @@ index dd52355..371d3b9 100644
  	jmp restore_all_notrace
  	CFI_ENDPROC
  
-@@ -1384,12 +1654,15 @@ nmi_espfix_stack:
+@@ -1395,13 +1665,16 @@ nmi_espfix_stack:
  	FIXUP_ESPFIX_STACK		# %eax == %esp
  	xorl %edx,%edx			# zero error code
  	call do_nmi
@@ -19198,13 +19180,14 @@ index dd52355..371d3b9 100644
  	lss 12+4(%esp), %esp		# back to espfix stack
  	CFI_ADJUST_CFA_OFFSET -24
  	jmp irq_return
+ #endif
  	CFI_ENDPROC
 -END(nmi)
 +ENDPROC(nmi)
  
  ENTRY(int3)
  	RING0_INT_FRAME
-@@ -1401,14 +1674,14 @@ ENTRY(int3)
+@@ -1413,14 +1686,14 @@ ENTRY(int3)
  	call do_int3
  	jmp ret_from_exception
  	CFI_ENDPROC
@@ -19221,7 +19204,7 @@ index dd52355..371d3b9 100644
  
  #ifdef CONFIG_KVM_GUEST
  ENTRY(async_page_fault)
-@@ -1416,7 +1689,7 @@ ENTRY(async_page_fault)
+@@ -1428,7 +1701,7 @@ ENTRY(async_page_fault)
  	pushl_cfi $do_async_page_fault
  	jmp error_code
  	CFI_ENDPROC
@@ -19231,19 +19214,19 @@ index dd52355..371d3b9 100644
  
  /*
 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 6274f5f..7b23dca 100644
+index 4b511ef..29ec529 100644
 --- a/arch/x86/kernel/entry_64.S
 +++ b/arch/x86/kernel/entry_64.S
-@@ -55,6 +55,8 @@
- #include <asm/paravirt.h>
+@@ -56,6 +56,8 @@
  #include <asm/ftrace.h>
  #include <asm/percpu.h>
+ #include <asm/pgtable_types.h>
 +#include <asm/pgtable.h>
 +#include <asm/alternative-asm.h>
  
  /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
  #include <linux/elf-em.h>
-@@ -68,8 +70,9 @@
+@@ -69,8 +71,9 @@
  #ifdef CONFIG_FUNCTION_TRACER
  #ifdef CONFIG_DYNAMIC_FTRACE
  ENTRY(mcount)
@@ -19254,7 +19237,7 @@ index 6274f5f..7b23dca 100644
  
  ENTRY(ftrace_caller)
  	cmpl $0, function_trace_stop
-@@ -92,8 +95,9 @@ GLOBAL(ftrace_graph_call)
+@@ -93,8 +96,9 @@ GLOBAL(ftrace_graph_call)
  #endif
  
  GLOBAL(ftrace_stub)
@@ -19265,7 +19248,7 @@ index 6274f5f..7b23dca 100644
  
  #else /* ! CONFIG_DYNAMIC_FTRACE */
  ENTRY(mcount)
-@@ -112,6 +116,7 @@ ENTRY(mcount)
+@@ -113,6 +117,7 @@ ENTRY(mcount)
  #endif
  
  GLOBAL(ftrace_stub)
@@ -19273,7 +19256,7 @@ index 6274f5f..7b23dca 100644
  	retq
  
  trace:
-@@ -121,12 +126,13 @@ trace:
+@@ -122,12 +127,13 @@ trace:
  	movq 8(%rbp), %rsi
  	subq $MCOUNT_INSN_SIZE, %rdi
  
@@ -19288,7 +19271,7 @@ index 6274f5f..7b23dca 100644
  #endif /* CONFIG_DYNAMIC_FTRACE */
  #endif /* CONFIG_FUNCTION_TRACER */
  
-@@ -146,8 +152,9 @@ ENTRY(ftrace_graph_caller)
+@@ -147,8 +153,9 @@ ENTRY(ftrace_graph_caller)
  
  	MCOUNT_RESTORE_FRAME
  
@@ -19299,7 +19282,7 @@ index 6274f5f..7b23dca 100644
  
  GLOBAL(return_to_handler)
  	subq  $24, %rsp
-@@ -163,6 +170,7 @@ GLOBAL(return_to_handler)
+@@ -164,6 +171,7 @@ GLOBAL(return_to_handler)
  	movq 8(%rsp), %rdx
  	movq (%rsp), %rax
  	addq $24, %rsp
@@ -19307,7 +19290,7 @@ index 6274f5f..7b23dca 100644
  	jmp *%rdi
  #endif
  
-@@ -178,6 +186,285 @@ ENTRY(native_usergs_sysret64)
+@@ -179,6 +187,285 @@ ENTRY(native_usergs_sysret64)
  ENDPROC(native_usergs_sysret64)
  #endif /* CONFIG_PARAVIRT */
  
@@ -19593,7 +19576,7 @@ index 6274f5f..7b23dca 100644
  
  .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
  #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -231,8 +518,8 @@ ENDPROC(native_usergs_sysret64)
+@@ -232,8 +519,8 @@ ENDPROC(native_usergs_sysret64)
  	.endm
  
  	.macro UNFAKE_STACK_FRAME
@@ -19604,7 +19587,7 @@ index 6274f5f..7b23dca 100644
  	.endm
  
  /*
-@@ -301,25 +588,26 @@ ENDPROC(native_usergs_sysret64)
+@@ -302,25 +589,26 @@ ENDPROC(native_usergs_sysret64)
  /* save partial stack frame */
  	.macro SAVE_ARGS_IRQ
  	cld
@@ -19644,7 +19627,7 @@ index 6274f5f..7b23dca 100644
  	je 1f
  	SWAPGS
  	/*
-@@ -340,24 +628,39 @@ ENDPROC(native_usergs_sysret64)
+@@ -341,24 +629,39 @@ ENDPROC(native_usergs_sysret64)
  			0x06 /* DW_OP_deref */, \
  			0x08 /* DW_OP_const1u */, SS+8-RBP, \
  			0x22 /* DW_OP_plus */
@@ -19688,7 +19671,7 @@ index 6274f5f..7b23dca 100644
  
  /* save complete stack frame */
  	.pushsection .kprobes.text, "ax"
-@@ -386,10 +689,21 @@ ENTRY(save_paranoid)
+@@ -387,10 +690,21 @@ ENTRY(save_paranoid)
  	js 1f	/* negative -> in kernel */
  	SWAPGS
  	xorl %ebx,%ebx
@@ -19713,7 +19696,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * A newly forked process directly context switches into this address.
-@@ -410,7 +724,7 @@ ENTRY(ret_from_fork)
+@@ -411,7 +725,7 @@ ENTRY(ret_from_fork)
  
  	RESTORE_REST
  
@@ -19722,7 +19705,7 @@ index 6274f5f..7b23dca 100644
  	je   int_ret_from_sys_call
  
  	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
-@@ -420,7 +734,7 @@ ENTRY(ret_from_fork)
+@@ -421,7 +735,7 @@ ENTRY(ret_from_fork)
  	jmp ret_from_sys_call			# go to the SYSRET fastpath
  
  	CFI_ENDPROC
@@ -19731,7 +19714,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * System call entry. Up to 6 arguments in registers are supported.
-@@ -456,7 +770,7 @@ END(ret_from_fork)
+@@ -457,7 +771,7 @@ END(ret_from_fork)
  ENTRY(system_call)
  	CFI_STARTPROC	simple
  	CFI_SIGNAL_FRAME
@@ -19740,7 +19723,7 @@ index 6274f5f..7b23dca 100644
  	CFI_REGISTER	rip,rcx
  	/*CFI_REGISTER	rflags,r11*/
  	SWAPGS_UNSAFE_STACK
-@@ -469,12 +783,18 @@ ENTRY(system_call_after_swapgs)
+@@ -470,12 +784,18 @@ ENTRY(system_call_after_swapgs)
  
  	movq	%rsp,PER_CPU_VAR(old_rsp)
  	movq	PER_CPU_VAR(kernel_stack),%rsp
@@ -19760,7 +19743,7 @@ index 6274f5f..7b23dca 100644
  	movq  %rax,ORIG_RAX-ARGOFFSET(%rsp)
  	movq  %rcx,RIP-ARGOFFSET(%rsp)
  	CFI_REL_OFFSET rip,RIP-ARGOFFSET
-@@ -503,6 +823,8 @@ sysret_check:
+@@ -504,6 +824,8 @@ sysret_check:
  	andl %edi,%edx
  	jnz  sysret_careful
  	CFI_REMEMBER_STATE
@@ -19769,7 +19752,7 @@ index 6274f5f..7b23dca 100644
  	/*
  	 * sysretq will re-enable interrupts:
  	 */
-@@ -561,6 +883,9 @@ auditsys:
+@@ -562,6 +884,9 @@ auditsys:
  	movq %rax,%rsi			/* 2nd arg: syscall number */
  	movl $AUDIT_ARCH_X86_64,%edi	/* 1st arg: audit arch */
  	call audit_syscall_entry
@@ -19779,7 +19762,7 @@ index 6274f5f..7b23dca 100644
  	LOAD_ARGS 0		/* reload call-clobbered registers */
  	jmp system_call_fastpath
  
-@@ -591,12 +916,15 @@ tracesys:
+@@ -592,12 +917,15 @@ tracesys:
  	FIXUP_TOP_OF_STACK %rdi
  	movq %rsp,%rdi
  	call syscall_trace_enter
@@ -19796,7 +19779,7 @@ index 6274f5f..7b23dca 100644
  	RESTORE_REST
  	cmpq $__NR_syscall_max,%rax
  	ja   int_ret_from_sys_call	/* RAX(%rsp) set to -ENOSYS above */
-@@ -612,7 +940,7 @@ tracesys:
+@@ -613,7 +941,7 @@ tracesys:
  GLOBAL(int_ret_from_sys_call)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF
@@ -19805,7 +19788,7 @@ index 6274f5f..7b23dca 100644
  	je retint_restore_args
  	movl $_TIF_ALLWORK_MASK,%edi
  	/* edi:	mask to check */
-@@ -623,7 +951,9 @@ GLOBAL(int_with_check)
+@@ -624,7 +952,9 @@ GLOBAL(int_with_check)
  	andl %edi,%edx
  	jnz   int_careful
  	andl    $~TS_COMPAT,TI_status(%rcx)
@@ -19816,7 +19799,7 @@ index 6274f5f..7b23dca 100644
  
  	/* Either reschedule or signal or syscall exit tracking needed. */
  	/* First do a reschedule test. */
-@@ -669,7 +999,7 @@ int_restore_rest:
+@@ -670,7 +1000,7 @@ int_restore_rest:
  	TRACE_IRQS_OFF
  	jmp int_with_check
  	CFI_ENDPROC
@@ -19825,7 +19808,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * Certain special system calls that need to save a complete full stack frame.
-@@ -677,15 +1007,13 @@ END(system_call)
+@@ -678,15 +1008,13 @@ END(system_call)
  	.macro PTREGSCALL label,func,arg
  ENTRY(\label)
  	PARTIAL_FRAME 1 8		/* offset 8: return address */
@@ -19842,7 +19825,7 @@ index 6274f5f..7b23dca 100644
  	.endm
  
  	PTREGSCALL stub_clone, sys_clone, %r8
-@@ -700,12 +1028,17 @@ ENTRY(ptregscall_common)
+@@ -701,12 +1029,17 @@ ENTRY(ptregscall_common)
  	movq_cfi_restore R15+8, r15
  	movq_cfi_restore R14+8, r14
  	movq_cfi_restore R13+8, r13
@@ -19862,7 +19845,7 @@ index 6274f5f..7b23dca 100644
  
  ENTRY(stub_execve)
  	CFI_STARTPROC
-@@ -720,7 +1053,7 @@ ENTRY(stub_execve)
+@@ -721,7 +1054,7 @@ ENTRY(stub_execve)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -19871,7 +19854,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * sigreturn is special because it needs to restore all registers on return.
-@@ -738,7 +1071,7 @@ ENTRY(stub_rt_sigreturn)
+@@ -739,7 +1072,7 @@ ENTRY(stub_rt_sigreturn)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -19880,7 +19863,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * Build the entry stubs and pointer table with some assembler magic.
-@@ -773,7 +1106,7 @@ vector=vector+1
+@@ -774,7 +1107,7 @@ vector=vector+1
  2:	jmp common_interrupt
  .endr
  	CFI_ENDPROC
@@ -19889,7 +19872,7 @@ index 6274f5f..7b23dca 100644
  
  .previous
  END(interrupt)
-@@ -790,8 +1123,8 @@ END(interrupt)
+@@ -791,8 +1124,8 @@ END(interrupt)
  /* 0(%rsp): ~(interrupt number) */
  	.macro interrupt func
  	/* reserve pt_regs for scratch regs and rbp */
@@ -19900,7 +19883,7 @@ index 6274f5f..7b23dca 100644
  	SAVE_ARGS_IRQ
  	call \func
  	.endm
-@@ -818,13 +1151,13 @@ ret_from_intr:
+@@ -819,13 +1152,13 @@ ret_from_intr:
  	/* Restore saved previous stack */
  	popq %rsi
  	CFI_DEF_CFA_REGISTER	rsi
@@ -19917,7 +19900,7 @@ index 6274f5f..7b23dca 100644
  	je retint_kernel
  
  	/* Interrupt came from user space */
-@@ -846,12 +1179,16 @@ retint_swapgs:		/* return to user-space */
+@@ -847,12 +1180,16 @@ retint_swapgs:		/* return to user-space */
  	 * The iretq could re-enable interrupts:
  	 */
  	DISABLE_INTERRUPTS(CLBR_ANY)
@@ -19934,16 +19917,32 @@ index 6274f5f..7b23dca 100644
  	/*
  	 * The iretq could re-enable interrupts:
  	 */
-@@ -940,7 +1277,7 @@ ENTRY(retint_kernel)
+@@ -970,7 +1307,7 @@ ENTRY(retint_kernel)
+ 	jmp exit_intr
  #endif
- 
  	CFI_ENDPROC
 -END(common_interrupt)
 +ENDPROC(common_interrupt)
- /*
-  * End of kprobes section
-  */
-@@ -956,7 +1293,7 @@ ENTRY(\sym)
+ 
+ 	/*
+ 	 * If IRET takes a fault on the espfix stack, then we
+@@ -992,13 +1329,13 @@ __do_double_fault:
+ 	cmpq $native_irq_return_iret,%rax
+ 	jne do_double_fault		/* This shouldn't happen... */
+ 	movq PER_CPU_VAR(kernel_stack),%rax
+-	subq $(6*8-KERNEL_STACK_OFFSET),%rax	/* Reset to original stack */
++	subq $(6*8),%rax		/* Reset to original stack */
+ 	movq %rax,RSP(%rdi)
+ 	movq $0,(%rax)			/* Missing (lost) #GP error code */
+ 	movq $general_protection,RIP(%rdi)
+ 	retq
+ 	CFI_ENDPROC
+-END(__do_double_fault)
++ENDPROC(__do_double_fault)
+ #else
+ # define __do_double_fault do_double_fault
+ #endif
+@@ -1018,7 +1355,7 @@ ENTRY(\sym)
  	interrupt \do_sym
  	jmp ret_from_intr
  	CFI_ENDPROC
@@ -19952,7 +19951,7 @@ index 6274f5f..7b23dca 100644
  .endm
  
  #ifdef CONFIG_SMP
-@@ -1026,7 +1363,7 @@ ENTRY(\sym)
+@@ -1088,7 +1425,7 @@ ENTRY(\sym)
  	call \do_sym
  	jmp error_exit		/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -19961,7 +19960,7 @@ index 6274f5f..7b23dca 100644
  .endm
  
  .macro paranoidzeroentry sym do_sym
-@@ -1043,10 +1380,10 @@ ENTRY(\sym)
+@@ -1105,10 +1442,10 @@ ENTRY(\sym)
  	call \do_sym
  	jmp paranoid_exit	/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -19974,7 +19973,7 @@ index 6274f5f..7b23dca 100644
  .macro paranoidzeroentry_ist sym do_sym ist
  ENTRY(\sym)
  	INTR_FRAME
-@@ -1058,12 +1395,18 @@ ENTRY(\sym)
+@@ -1120,12 +1457,18 @@ ENTRY(\sym)
  	TRACE_IRQS_OFF
  	movq %rsp,%rdi		/* pt_regs pointer */
  	xorl %esi,%esi		/* no error code */
@@ -19994,7 +19993,7 @@ index 6274f5f..7b23dca 100644
  .endm
  
  .macro errorentry sym do_sym
-@@ -1080,7 +1423,7 @@ ENTRY(\sym)
+@@ -1142,7 +1485,7 @@ ENTRY(\sym)
  	call \do_sym
  	jmp error_exit			/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -20003,7 +20002,7 @@ index 6274f5f..7b23dca 100644
  .endm
  
  	/* error code is on the stack already */
-@@ -1099,7 +1442,7 @@ ENTRY(\sym)
+@@ -1161,7 +1504,7 @@ ENTRY(\sym)
  	call \do_sym
  	jmp paranoid_exit		/* %ebx: no swapgs flag */
  	CFI_ENDPROC
@@ -20012,7 +20011,7 @@ index 6274f5f..7b23dca 100644
  .endm
  
  zeroentry divide_error do_divide_error
-@@ -1129,9 +1472,10 @@ gs_change:
+@@ -1191,9 +1534,10 @@ gs_change:
  2:	mfence		/* workaround */
  	SWAPGS
  	popfq_cfi
@@ -20024,7 +20023,7 @@ index 6274f5f..7b23dca 100644
  
  	.section __ex_table,"a"
  	.align 8
-@@ -1153,13 +1497,14 @@ ENTRY(kernel_thread_helper)
+@@ -1215,13 +1559,14 @@ ENTRY(kernel_thread_helper)
  	 * Here we are in the child and the registers are set as they were
  	 * at kernel_thread() invocation in the parent.
  	 */
@@ -20040,7 +20039,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * execve(). This function needs to use IRET, not SYSRET, to set up all state properly.
-@@ -1186,11 +1531,11 @@ ENTRY(kernel_execve)
+@@ -1248,11 +1593,11 @@ ENTRY(kernel_execve)
  	RESTORE_REST
  	testq %rax,%rax
  	je int_ret_from_sys_call
@@ -20054,7 +20053,7 @@ index 6274f5f..7b23dca 100644
  
  /* Call softirq on interrupt stack. Interrupts are off. */
  ENTRY(call_softirq)
-@@ -1208,9 +1553,10 @@ ENTRY(call_softirq)
+@@ -1270,9 +1615,10 @@ ENTRY(call_softirq)
  	CFI_DEF_CFA_REGISTER	rsp
  	CFI_ADJUST_CFA_OFFSET   -8
  	decl PER_CPU_VAR(irq_count)
@@ -20066,7 +20065,7 @@ index 6274f5f..7b23dca 100644
  
  #ifdef CONFIG_XEN
  zeroentry xen_hypervisor_callback xen_do_hypervisor_callback
-@@ -1248,7 +1594,7 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
+@@ -1310,7 +1656,7 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
  	decl PER_CPU_VAR(irq_count)
  	jmp  error_exit
  	CFI_ENDPROC
@@ -20075,7 +20074,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * Hypervisor uses this for application faults while it executes.
-@@ -1307,7 +1653,7 @@ ENTRY(xen_failsafe_callback)
+@@ -1369,7 +1715,7 @@ ENTRY(xen_failsafe_callback)
  	SAVE_ALL
  	jmp error_exit
  	CFI_ENDPROC
@@ -20084,7 +20083,7 @@ index 6274f5f..7b23dca 100644
  
  apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
  	xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -1356,16 +1702,31 @@ ENTRY(paranoid_exit)
+@@ -1418,16 +1764,31 @@ ENTRY(paranoid_exit)
  	TRACE_IRQS_OFF
  	testl %ebx,%ebx				/* swapgs needed? */
  	jnz paranoid_restore
@@ -20117,7 +20116,7 @@ index 6274f5f..7b23dca 100644
  	jmp irq_return
  paranoid_userspace:
  	GET_THREAD_INFO(%rcx)
-@@ -1394,7 +1755,7 @@ paranoid_schedule:
+@@ -1456,7 +1817,7 @@ paranoid_schedule:
  	TRACE_IRQS_OFF
  	jmp paranoid_userspace
  	CFI_ENDPROC
@@ -20126,7 +20125,7 @@ index 6274f5f..7b23dca 100644
  
  /*
   * Exception entry point. This expects an error code/orig_rax on the stack.
-@@ -1421,12 +1782,23 @@ ENTRY(error_entry)
+@@ -1483,12 +1844,23 @@ ENTRY(error_entry)
  	movq_cfi r14, R14+8
  	movq_cfi r15, R15+8
  	xorl %ebx,%ebx
@@ -20151,7 +20150,7 @@ index 6274f5f..7b23dca 100644
  	ret
  
  /*
-@@ -1453,7 +1825,7 @@ bstep_iret:
+@@ -1515,7 +1887,7 @@ bstep_iret:
  	movq %rcx,RIP+8(%rsp)
  	jmp error_swapgs
  	CFI_ENDPROC
@@ -20160,7 +20159,7 @@ index 6274f5f..7b23dca 100644
  
  
  /* ebx:	no swapgs flag (1: don't need swapgs, 0: need it) */
-@@ -1473,7 +1845,7 @@ ENTRY(error_exit)
+@@ -1535,7 +1907,7 @@ ENTRY(error_exit)
  	jnz retint_careful
  	jmp retint_swapgs
  	CFI_ENDPROC
@@ -20169,7 +20168,7 @@ index 6274f5f..7b23dca 100644
  
  
  	/* runs on exception stack */
-@@ -1485,6 +1857,7 @@ ENTRY(nmi)
+@@ -1547,6 +1919,7 @@ ENTRY(nmi)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	call save_paranoid
  	DEFAULT_FRAME 0
@@ -20177,7 +20176,7 @@ index 6274f5f..7b23dca 100644
  	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
  	movq %rsp,%rdi
  	movq $-1,%rsi
-@@ -1495,12 +1868,28 @@ ENTRY(nmi)
+@@ -1557,12 +1930,28 @@ ENTRY(nmi)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	testl %ebx,%ebx				/* swapgs needed? */
  	jnz nmi_restore
@@ -20207,7 +20206,7 @@ index 6274f5f..7b23dca 100644
  	jmp irq_return
  nmi_userspace:
  	GET_THREAD_INFO(%rcx)
-@@ -1529,14 +1918,14 @@ nmi_schedule:
+@@ -1591,14 +1980,14 @@ nmi_schedule:
  	jmp paranoid_exit
  	CFI_ENDPROC
  #endif
@@ -20224,6 +20223,19 @@ index 6274f5f..7b23dca 100644
  
  /*
   * End of kprobes section
+diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
+index 94d857f..bf1f0bf 100644
+--- a/arch/x86/kernel/espfix_64.c
++++ b/arch/x86/kernel/espfix_64.c
+@@ -197,7 +197,7 @@ void init_espfix_ap(void)
+ 		set_pte(&pte_p[n*PTE_STRIDE], pte);
+ 
+ 	/* Job is done for this CPU and any CPU which shares this page */
+-	ACCESS_ONCE(espfix_pages[page]) = stack_page;
++	ACCESS_ONCE_RW(espfix_pages[page]) = stack_page;
+ 
+ unlock_done:
+ 	mutex_unlock(&espfix_init_mutex);
 diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
 index c9a281f..3645760 100644
 --- a/arch/x86/kernel/ftrace.c
@@ -21760,10 +21772,10 @@ index a9c2116..94c1e1a 100644
  };
  #endif
 diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
-index 3e0ccbf..d655d56 100644
+index 0a8e65e..288a4b0 100644
 --- a/arch/x86/kernel/ldt.c
 +++ b/arch/x86/kernel/ldt.c
-@@ -69,13 +69,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
+@@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
  	if (reload) {
  #ifdef CONFIG_SMP
  		preempt_disable();
@@ -21779,7 +21791,7 @@ index 3e0ccbf..d655d56 100644
  #endif
  	}
  	if (oldsize) {
-@@ -97,7 +97,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+@@ -95,7 +95,7 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
  		return err;
  
  	for (i = 0; i < old->size; i++)
@@ -21788,7 +21800,7 @@ index 3e0ccbf..d655d56 100644
  	return 0;
  }
  
-@@ -118,6 +118,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+@@ -116,6 +116,24 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
  		retval = copy_ldt(&mm->context, &old_mm->context);
  		mutex_unlock(&old_mm->context.lock);
  	}
@@ -21813,7 +21825,7 @@ index 3e0ccbf..d655d56 100644
  	return retval;
  }
  
-@@ -232,6 +250,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+@@ -230,6 +248,13 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
  		}
  	}
  
@@ -21824,9 +21836,9 @@ index 3e0ccbf..d655d56 100644
 +	}
 +#endif
 +
- 	/*
- 	 * On x86-64 we do not support 16-bit segments due to
- 	 * IRET leaking the high bits of the kernel stack address.
+ 	if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
 diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
 index a3fa43b..8966f4c 100644
 --- a/arch/x86/kernel/machine_kexec_32.c
@@ -23212,7 +23224,7 @@ index 16204dc..0e7d4b7 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index b88eadb..198deca 100644
+index 6e68bd9..facb68a 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -252,11 +252,13 @@ notrace static void __cpuinit start_secondary(void *unused)
@@ -23231,7 +23243,7 @@ index b88eadb..198deca 100644
  
  	/* otherwise gcc will move up smp_processor_id before the cpu_init */
  	barrier();
-@@ -692,7 +694,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
+@@ -699,7 +701,7 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
  	 */
  	if (c_idle.idle) {
  		c_idle.idle->thread.sp = (unsigned long) (((struct pt_regs *)
@@ -23240,7 +23252,7 @@ index b88eadb..198deca 100644
  		init_idle(c_idle.idle, cpu);
  		goto do_rest;
  	}
-@@ -709,17 +711,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
+@@ -716,17 +718,20 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
  	set_idle_for_cpu(cpu, c_idle.idle);
  do_rest:
  	per_cpu(current_task, cpu) = c_idle.idle;
@@ -23264,7 +23276,7 @@ index b88eadb..198deca 100644
  	initial_code = (unsigned long)start_secondary;
  	stack_start  = c_idle.idle->thread.sp;
  
-@@ -861,6 +866,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
+@@ -868,6 +873,12 @@ int __cpuinit native_cpu_up(unsigned int cpu)
  
  	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
  
@@ -24524,7 +24536,7 @@ index 7110911..069da9c 100644
  		/*
  		 * Encountered an error while doing the restore from the
 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index f5302da..6ee193e 100644
+index 638cab5..0a38f1e 100644
 --- a/arch/x86/kvm/emulate.c
 +++ b/arch/x86/kvm/emulate.c
 @@ -249,6 +249,7 @@ struct gprefix {
@@ -31532,7 +31544,7 @@ index 5d17950..2253fc9 100644
  
  #
 diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
-index 51bdc05..8be5888 100644
+index 468d591..8e80a0a 100644
 --- a/arch/x86/vdso/vdso32-setup.c
 +++ b/arch/x86/vdso/vdso32-setup.c
 @@ -25,6 +25,7 @@
@@ -31543,7 +31555,7 @@ index 51bdc05..8be5888 100644
  
  enum {
  	VDSO_DISABLED = 0,
-@@ -227,7 +228,7 @@ static inline void map_compat_vdso(int map)
+@@ -226,7 +227,7 @@ static inline void map_compat_vdso(int map)
  void enable_sep_cpu(void)
  {
  	int cpu = get_cpu();
@@ -31552,7 +31564,7 @@ index 51bdc05..8be5888 100644
  
  	if (!boot_cpu_has(X86_FEATURE_SEP)) {
  		put_cpu();
-@@ -250,7 +251,7 @@ static int __init gate_vma_init(void)
+@@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -31561,7 +31573,7 @@ index 51bdc05..8be5888 100644
  	/*
  	 * Make sure the vDSO gets into every core dump.
  	 * Dumping its contents makes post-mortem fully interpretable later
-@@ -332,14 +333,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  	if (compat)
  		addr = VDSO_HIGH_BASE;
  	else {
@@ -31578,7 +31590,7 @@ index 51bdc05..8be5888 100644
  
  	if (compat_uses_vma || !compat) {
  		/*
-@@ -362,11 +363,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+@@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
  	}
  
  	current_thread_info()->sysenter_return =
@@ -31592,7 +31604,7 @@ index 51bdc05..8be5888 100644
  
  	up_write(&mm->mmap_sem);
  
-@@ -420,8 +421,14 @@ __initcall(ia32_binfmt_init);
+@@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
  
  const char *arch_vma_name(struct vm_area_struct *vma)
  {
@@ -31608,7 +31620,7 @@ index 51bdc05..8be5888 100644
  	return NULL;
  }
  
-@@ -431,7 +438,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
+@@ -423,7 +430,7 @@ struct vm_area_struct *get_gate_vma(struct mm_struct *mm)
  	 * Check to see if the corresponding task was created in compat vdso
  	 * mode.
  	 */
@@ -32259,26 +32271,6 @@ index 9e76a32..a220c64 100644
  	if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
  		goto error;
  
-diff --git a/crypto/af_alg.c b/crypto/af_alg.c
-index ac33d5f..bf948e1 100644
---- a/crypto/af_alg.c
-+++ b/crypto/af_alg.c
-@@ -21,6 +21,7 @@
- #include <linux/module.h>
- #include <linux/net.h>
- #include <linux/rwsem.h>
-+#include <linux/security.h>
- 
- struct alg_type_list {
- 	const struct af_alg_type *type;
-@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
- 
- 	sock_init_data(newsock, sk2);
- 	sock_graft(sk2, newsock);
-+	security_sk_clone(sk, sk2);
- 
- 	err = type->accept(ask->private, sk2);
- 	if (err) {
 diff --git a/crypto/api.c b/crypto/api.c
 index cea3cf6..86a0f6f 100644
 --- a/crypto/api.c
@@ -36374,7 +36366,7 @@ index 1ee8ce7..b778bef 100644
  
  	return 0;
 diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
-index 0d91655..96118e0 100644
+index c234b9e..34c325d 100644
 --- a/drivers/char/tpm/tpm.c
 +++ b/drivers/char/tpm/tpm.c
 @@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
@@ -38375,10 +38367,10 @@ index a9e33ce..09edd4b 100644
  
  #endif
 diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 5efba47..aaaf339 100644
+index 9b3f787..e9ad3ce 100644
 --- a/drivers/gpu/drm/radeon/evergreen.c
 +++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -3094,7 +3094,9 @@ static int evergreen_startup(struct radeon_device *rdev)
+@@ -3095,7 +3095,9 @@ static int evergreen_startup(struct radeon_device *rdev)
  	r = evergreen_blit_init(rdev);
  	if (r) {
  		r600_blit_fini(rdev);
@@ -38460,7 +38452,7 @@ index 441570b..8896094 100644
  }
  
 diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index f7e3cc0..d9878ef 100644
+index ab46a99..5d73299 100644
 --- a/drivers/gpu/drm/radeon/r600.c
 +++ b/drivers/gpu/drm/radeon/r600.c
 @@ -2442,7 +2442,9 @@ int r600_startup(struct radeon_device *rdev)
@@ -38870,22 +38862,6 @@ index e70ddd8..ddfa1cd 100644
  	if (unlikely(ret != 0)) {
  		kobject_put(&zone->kobj);
  		return ret;
-diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
-index 9e4313e..46fad36 100644
---- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
-+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
-@@ -398,9 +398,9 @@ static int ttm_pool_get_num_unused_pages(void)
- static int ttm_pool_mm_shrink(struct shrinker *shrink,
- 			      struct shrink_control *sc)
- {
--	static atomic_t start_pool = ATOMIC_INIT(0);
-+	static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
- 	unsigned i;
--	unsigned pool_offset = atomic_add_return(1, &start_pool);
-+	unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
- 	struct ttm_page_pool *pool;
- 	int shrink_pages = sc->nr_to_scan;
- 
 diff --git a/drivers/gpu/drm/via/via_drv.h b/drivers/gpu/drm/via/via_drv.h
 index 9cf87d9..2000b7d 100644
 --- a/drivers/gpu/drm/via/via_drv.h
@@ -39111,19 +39087,6 @@ index 8a8725c2..afed796 100644
  		else {
  			marker = list_first_entry(&queue->head,
  						 struct vmw_marker, head);
-diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
-index 888ece6..f870bb3 100644
---- a/drivers/hid/hid-cherry.c
-+++ b/drivers/hid/hid-cherry.c
-@@ -29,7 +29,7 @@
- static __u8 *ch_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- 		unsigned int *rsize)
- {
--	if (*rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
-+	if (*rsize >= 18 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
- 		hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");
- 		rdesc[11] = rdesc[16] = 0xff;
- 		rdesc[12] = rdesc[17] = 0x03;
 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
 index 64d79d2..6c83020 100644
 --- a/drivers/hid/hid-core.c
@@ -39146,59 +39109,11 @@ index 64d79d2..6c83020 100644
  
  	hid_debug_register(hdev, dev_name(&hdev->dev));
  	ret = device_add(&hdev->dev);
-diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
-index f2ba9ef..25dfb5f 100644
---- a/drivers/hid/hid-kye.c
-+++ b/drivers/hid/hid-kye.c
-@@ -26,7 +26,7 @@
- static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- 		unsigned int *rsize)
- {
--	if (*rsize >= 74 &&
-+	if (*rsize >= 75 &&
- 		rdesc[61] == 0x05 && rdesc[62] == 0x08 &&
- 		rdesc[63] == 0x19 && rdesc[64] == 0x08 &&
- 		rdesc[65] == 0x29 && rdesc[66] == 0x0f &&
-diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
-index e7a7bd1..3ad6cd4 100644
---- a/drivers/hid/hid-lg.c
-+++ b/drivers/hid/hid-lg.c
-@@ -111,14 +111,14 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- {
- 	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
- 
--	if ((quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
-+	if ((quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
- 			rdesc[84] == 0x8c && rdesc[85] == 0x02) {
- 		hid_info(hdev,
- 			 "fixing up Logitech keyboard report descriptor\n");
- 		rdesc[84] = rdesc[89] = 0x4d;
- 		rdesc[85] = rdesc[90] = 0x10;
- 	}
--	if ((quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&
-+	if ((quirks & LG_RDESC_REL_ABS) && *rsize >= 51 &&
- 			rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
- 			rdesc[49] == 0x81 && rdesc[50] == 0x06) {
- 		hid_info(hdev,
 diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
-index 828a0dd..6efc0ea 100644
+index 488a21a..ab0a415 100644
 --- a/drivers/hid/hid-logitech-dj.c
 +++ b/drivers/hid/hid-logitech-dj.c
-@@ -230,13 +230,6 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
- 		return;
- 	}
- 
--	if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
--	    (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
--		dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n",
--			__func__, dj_report->device_index);
--		return;
--	}
--
- 	if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
- 		/* The device is already known. No need to reallocate it. */
- 		dbg_hid("%s: device is already known\n", __func__);
-@@ -713,6 +706,12 @@ static int logi_dj_raw_event(struct hid_device *hdev,
+@@ -705,6 +705,12 @@ static int logi_dj_raw_event(struct hid_device *hdev,
  	 * device (via hid_input_report() ) and return 1 so hid-core does not do
  	 * anything else with it.
  	 */
@@ -39209,49 +39124,8 @@ index 828a0dd..6efc0ea 100644
 +		return false;
 +	}
  
- 	spin_lock_irqsave(&djrcv_dev->lock, flags);
- 	if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
-diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
-index 7cf3ffe..81356f6 100644
---- a/drivers/hid/hid-magicmouse.c
-+++ b/drivers/hid/hid-magicmouse.c
-@@ -308,6 +308,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
- 		if (size < 4 || ((size - 4) % 9) != 0)
- 			return 0;
- 		npoints = (size - 4) / 9;
-+		if (npoints > 15) {
-+			hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
-+					size);
-+			return 0;
-+		}
- 		msc->ntouches = 0;
- 		for (ii = 0; ii < npoints; ii++)
- 			magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
-@@ -331,6 +336,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
- 		if (size < 6 || ((size - 6) % 8) != 0)
- 			return 0;
- 		npoints = (size - 6) / 8;
-+		if (npoints > 15) {
-+			hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
-+					size);
-+			return 0;
-+		}
- 		msc->ntouches = 0;
- 		for (ii = 0; ii < npoints; ii++)
- 			magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
-diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
-index dedf757..eb0271e 100644
---- a/drivers/hid/hid-monterey.c
-+++ b/drivers/hid/hid-monterey.c
-@@ -25,7 +25,7 @@
- static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- 		unsigned int *rsize)
- {
--	if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
-+	if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
- 		hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
- 		rdesc[30] = 0x0c;
- 	}
+ 	/* case 1) */
+ 	if (data[0] != REPORT_ID_DJ_SHORT)
 diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
 index a605ba1..fb91952 100644
 --- a/drivers/hid/hid-multitouch.c
@@ -39274,32 +39148,6 @@ index a605ba1..fb91952 100644
  	}
  
  	/* we have handled the hidinput part, now remains hiddev */
-diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
-index f1ea3ff..99f317a 100644
---- a/drivers/hid/hid-petalynx.c
-+++ b/drivers/hid/hid-petalynx.c
-@@ -26,7 +26,7 @@
- static __u8 *pl_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- 		unsigned int *rsize)
- {
--	if (*rsize >= 60 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
-+	if (*rsize >= 62 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
- 			rdesc[41] == 0x00 && rdesc[59] == 0x26 &&
- 			rdesc[60] == 0xf9 && rdesc[61] == 0x00) {
- 		hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");
-diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
-index d484a00..3d6ae7b 100644
---- a/drivers/hid/hid-sunplus.c
-+++ b/drivers/hid/hid-sunplus.c
-@@ -25,7 +25,7 @@
- static __u8 *sp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
- 		unsigned int *rsize)
- {
--	if (*rsize >= 107 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
-+	if (*rsize >= 112 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
- 			rdesc[106] == 0x03) {
- 		hid_info(hdev, "fixing up Sunplus Wireless Desktop report descriptor\n");
- 		rdesc[105] = rdesc[110] = 0x03;
 diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
 index 4ef02b2..8a96831 100644
 --- a/drivers/hid/usbhid/hiddev.c
@@ -42290,7 +42138,7 @@ index 1cbfc6b..56e1dbb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index c706a7b..2cc7511 100644
+index aec029a..d2c133e 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
 @@ -1591,7 +1591,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -42312,7 +42160,7 @@ index c706a7b..2cc7511 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 6d05e26..a579e8c 100644
+index abac83a..3652f35 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
 @@ -1465,7 +1465,7 @@ static void end_sync_read(struct bio *bio, int error)
@@ -42375,7 +42223,7 @@ index 6d05e26..a579e8c 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 7c963c4..73e0cd7 100644
+index c293d9c..73e0cd7 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -1364,6 +1364,10 @@ static int grow_one_stripe(struct r5conf *conf)
@@ -42434,15 +42282,6 @@ index 7c963c4..73e0cd7 100644
  			 > conf->max_nr_stripes)
  			printk(KERN_WARNING
  			       "md/raid:%s: Too many read errors, failing device %s.\n",
-@@ -3240,6 +3248,8 @@ static void handle_stripe(struct stripe_head *sh)
- 				set_bit(R5_Wantwrite, &dev->flags);
- 				if (prexor)
- 					continue;
-+				if (s.failed > 1)
-+					continue;
- 				if (!test_bit(R5_Insync, &dev->flags) ||
- 				    ((i == sh->pd_idx || i == sh->qd_idx)  &&
- 				     s.failed == 0))
 diff --git a/drivers/media/dvb/ddbridge/ddbridge-core.c b/drivers/media/dvb/ddbridge/ddbridge-core.c
 index ba9a643..e474ab5 100644
 --- a/drivers/media/dvb/ddbridge/ddbridge-core.c
@@ -44924,10 +44763,10 @@ index d0893e4..14b0d44 100644
         .init = loopback_net_init,
  };
 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index b74cdf6..bed3bf3 100644
+index fed39de..8adf3152 100644
 --- a/drivers/net/macvlan.c
 +++ b/drivers/net/macvlan.c
-@@ -789,13 +789,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
+@@ -790,13 +790,15 @@ static const struct nla_policy macvlan_policy[IFLA_MACVLAN_MAX + 1] = {
  int macvlan_link_register(struct rtnl_link_ops *ops)
  {
  	/* common fields */
@@ -44950,7 +44789,7 @@ index b74cdf6..bed3bf3 100644
  
  	return rtnl_link_register(ops);
  };
-@@ -851,7 +853,7 @@ static int macvlan_device_event(struct notifier_block *unused,
+@@ -852,7 +854,7 @@ static int macvlan_device_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -47295,7 +47134,7 @@ index d4f951f..6081753 100644
  /*
   *  fcs_port_sm FCS logical port state machine
 diff --git a/drivers/scsi/bfa/bfa_ioc.h b/drivers/scsi/bfa/bfa_ioc.h
-index 546d46b..642fa5b 100644
+index 506a3ee..4f85221 100644
 --- a/drivers/scsi/bfa/bfa_ioc.h
 +++ b/drivers/scsi/bfa/bfa_ioc.h
 @@ -258,7 +258,7 @@ struct bfa_ioc_cbfn_s {
@@ -47397,7 +47236,7 @@ index ee77a58..af9d518 100644
  
  	/* These three are default values which can be overridden */
 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index 5b7e1bf..6e5521a 100644
+index 603a2cb..12ece99 100644
 --- a/drivers/scsi/hpsa.c
 +++ b/drivers/scsi/hpsa.c
 @@ -523,7 +523,7 @@ static inline u32 next_command(struct ctlr_info *h)
@@ -48120,25 +47959,10 @@ index 831db24..aef1598 100644
  	/* check if the device is still usable */
  	if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index cd4ac38..89011d6 100644
+index 0bdc4a7..89011d6 100644
 --- a/drivers/scsi/scsi_lib.c
 +++ b/drivers/scsi/scsi_lib.c
-@@ -793,6 +793,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
- 			scsi_next_command(cmd);
- 			return;
- 		}
-+	} else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
-+		/*
-+		 * Certain non BLOCK_PC requests are commands that don't
-+		 * actually transfer anything (FLUSH), so cannot use
-+		 * good_bytes != blk_rq_bytes(req) as the signal for an error.
-+		 * This sets the error explicitly for the problem case.
-+		 */
-+		error = __scsi_error_from_host_byte(cmd, result);
- 	}
- 
- 	/* no bidi support for !REQ_TYPE_BLOCK_PC yet */
-@@ -1427,7 +1435,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
+@@ -1435,7 +1435,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
  	shost = sdev->host;
  	scsi_init_cmd_errh(cmd);
  	cmd->result = DID_NO_CONNECT << 16;
@@ -48147,7 +47971,7 @@ index cd4ac38..89011d6 100644
  
  	/*
  	 * SCSI request completion path will do scsi_device_unbusy(),
-@@ -1453,9 +1461,9 @@ static void scsi_softirq_done(struct request *rq)
+@@ -1461,9 +1461,9 @@ static void scsi_softirq_done(struct request *rq)
  
  	INIT_LIST_HEAD(&cmd->eh_entry);
  
@@ -50849,7 +50673,7 @@ index 032e5a6..bc422e4 100644
  			wake_up(&usb_kill_urb_queue);
  		usb_put_urb(urb);
 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 3807294..cc1fc93 100644
+index f08732b..6338872 100644
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
 @@ -25,6 +25,7 @@
@@ -50860,7 +50684,7 @@ index 3807294..cc1fc93 100644
  
  #include <asm/uaccess.h>
  #include <asm/byteorder.h>
-@@ -3440,6 +3441,9 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
+@@ -3483,6 +3484,9 @@ static void hub_port_connect_change(struct usb_hub *hub, int port1,
  		return;
  	}
  
@@ -57295,7 +57119,7 @@ index d322929..9f4b8167 100644
  	dcache_init();
  	inode_init();
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index fb001cd..95129c3 100644
+index 01951c6b..01de40e 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
 @@ -145,6 +145,7 @@ static struct file_system_type debug_fs_type = {
@@ -58684,7 +58508,7 @@ index 40f4d06..7f3507d 100644
  
  	/* locality groups */
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 7168eeb..caba2335 100644
+index 818b43e..9a76283 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
 @@ -1794,7 +1794,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
@@ -58764,7 +58588,7 @@ index 7168eeb..caba2335 100644
  	}
  
  	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3519,7 +3519,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+@@ -3534,7 +3534,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_inode_pa(ac, pa);
  
  	ext4_mb_use_inode_pa(ac, pa);
@@ -58773,7 +58597,7 @@ index 7168eeb..caba2335 100644
  
  	ei = EXT4_I(ac->ac_inode);
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3579,7 +3579,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+@@ -3594,7 +3594,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_group_pa(ac, pa);
  
  	ext4_mb_use_group_pa(ac, pa);
@@ -58782,7 +58606,7 @@ index 7168eeb..caba2335 100644
  
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
  	lg = ac->ac_lg;
-@@ -3668,7 +3668,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+@@ -3683,7 +3683,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
  		 * from the bitmap and continue.
  		 */
  	}
@@ -58791,7 +58615,7 @@ index 7168eeb..caba2335 100644
  
  	return err;
  }
-@@ -3686,7 +3686,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+@@ -3701,7 +3701,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
  	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
  	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
  	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -60865,60 +60689,10 @@ index e2d3633..da449b7 100644
  	spin_unlock(&inode->i_lock);
  }
 diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
-index a5f25a7..e2f03bf 100644
+index 2f9197f..e2f03bf 100644
 --- a/fs/isofs/inode.c
 +++ b/fs/isofs/inode.c
-@@ -68,7 +68,7 @@ static void isofs_put_super(struct super_block *sb)
- 	return;
- }
- 
--static int isofs_read_inode(struct inode *);
-+static int isofs_read_inode(struct inode *, int relocated);
- static int isofs_statfs (struct dentry *, struct kstatfs *);
- 
- static struct kmem_cache *isofs_inode_cachep;
-@@ -1263,7 +1263,7 @@ out_toomany:
- 	goto out;
- }
- 
--static int isofs_read_inode(struct inode *inode)
-+static int isofs_read_inode(struct inode *inode, int relocated)
- {
- 	struct super_block *sb = inode->i_sb;
- 	struct isofs_sb_info *sbi = ISOFS_SB(sb);
-@@ -1408,7 +1408,7 @@ static int isofs_read_inode(struct inode *inode)
- 	 */
- 
- 	if (!high_sierra) {
--		parse_rock_ridge_inode(de, inode);
-+		parse_rock_ridge_inode(de, inode, relocated);
- 		/* if we want uid/gid set, override the rock ridge setting */
- 		if (sbi->s_uid_set)
- 			inode->i_uid = sbi->s_uid;
-@@ -1487,9 +1487,10 @@ static int isofs_iget5_set(struct inode *ino, void *data)
-  * offset that point to the underlying meta-data for the inode.  The
-  * code below is otherwise similar to the iget() code in
-  * include/linux/fs.h */
--struct inode *isofs_iget(struct super_block *sb,
--			 unsigned long block,
--			 unsigned long offset)
-+struct inode *__isofs_iget(struct super_block *sb,
-+			   unsigned long block,
-+			   unsigned long offset,
-+			   int relocated)
- {
- 	unsigned long hashval;
- 	struct inode *inode;
-@@ -1511,7 +1512,7 @@ struct inode *isofs_iget(struct super_block *sb,
- 		return ERR_PTR(-ENOMEM);
- 
- 	if (inode->i_state & I_NEW) {
--		ret = isofs_read_inode(inode);
-+		ret = isofs_read_inode(inode, relocated);
- 		if (ret < 0) {
- 			iget_failed(inode);
- 			inode = ERR_PTR(ret);
-@@ -1539,6 +1540,8 @@ static struct file_system_type iso9660_fs_type = {
+@@ -1540,6 +1540,8 @@ static struct file_system_type iso9660_fs_type = {
  	.kill_sb	= kill_block_super,
  	.fs_flags	= FS_REQUIRES_DEV,
  };
@@ -60927,137 +60701,12 @@ index a5f25a7..e2f03bf 100644
  
  static int __init init_iso9660_fs(void)
  {
-@@ -1576,5 +1579,3 @@ static void __exit exit_iso9660_fs(void)
+@@ -1577,5 +1579,3 @@ static void __exit exit_iso9660_fs(void)
  module_init(init_iso9660_fs)
  module_exit(exit_iso9660_fs)
  MODULE_LICENSE("GPL");
 -/* Actual filesystem name is iso9660, as requested in filesystems.c */
 -MODULE_ALIAS("iso9660");
-diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
-index 7d33de8..f9c9793 100644
---- a/fs/isofs/isofs.h
-+++ b/fs/isofs/isofs.h
-@@ -107,7 +107,7 @@ extern int iso_date(char *, int);
- 
- struct inode;		/* To make gcc happy */
- 
--extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *);
-+extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *, int relocated);
- extern int get_rock_ridge_filename(struct iso_directory_record *, char *, struct inode *);
- extern int isofs_name_translate(struct iso_directory_record *, char *, struct inode *);
- 
-@@ -118,9 +118,24 @@ extern struct dentry *isofs_lookup(struct inode *, struct dentry *, struct namei
- extern struct buffer_head *isofs_bread(struct inode *, sector_t);
- extern int isofs_get_blocks(struct inode *, sector_t, struct buffer_head **, unsigned long);
- 
--extern struct inode *isofs_iget(struct super_block *sb,
--                                unsigned long block,
--                                unsigned long offset);
-+struct inode *__isofs_iget(struct super_block *sb,
-+			   unsigned long block,
-+			   unsigned long offset,
-+			   int relocated);
-+
-+static inline struct inode *isofs_iget(struct super_block *sb,
-+				       unsigned long block,
-+				       unsigned long offset)
-+{
-+	return __isofs_iget(sb, block, offset, 0);
-+}
-+
-+static inline struct inode *isofs_iget_reloc(struct super_block *sb,
-+					     unsigned long block,
-+					     unsigned long offset)
-+{
-+	return __isofs_iget(sb, block, offset, 1);
-+}
- 
- /* Because the inode number is no longer relevant to finding the
-  * underlying meta-data for an inode, we are free to choose a more
-diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
-index 70e79d0..ee62cc0 100644
---- a/fs/isofs/rock.c
-+++ b/fs/isofs/rock.c
-@@ -288,12 +288,16 @@ eio:
- 	goto out;
- }
- 
-+#define RR_REGARD_XA 1
-+#define RR_RELOC_DE 2
-+
- static int
- parse_rock_ridge_inode_internal(struct iso_directory_record *de,
--				struct inode *inode, int regard_xa)
-+				struct inode *inode, int flags)
- {
- 	int symlink_len = 0;
- 	int cnt, sig;
-+	unsigned int reloc_block;
- 	struct inode *reloc;
- 	struct rock_ridge *rr;
- 	int rootflag;
-@@ -305,7 +309,7 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
- 
- 	init_rock_state(&rs, inode);
- 	setup_rock_ridge(de, inode, &rs);
--	if (regard_xa) {
-+	if (flags & RR_REGARD_XA) {
- 		rs.chr += 14;
- 		rs.len -= 14;
- 		if (rs.len < 0)
-@@ -485,12 +489,22 @@ repeat:
- 					"relocated directory\n");
- 			goto out;
- 		case SIG('C', 'L'):
--			ISOFS_I(inode)->i_first_extent =
--			    isonum_733(rr->u.CL.location);
--			reloc =
--			    isofs_iget(inode->i_sb,
--				       ISOFS_I(inode)->i_first_extent,
--				       0);
-+			if (flags & RR_RELOC_DE) {
-+				printk(KERN_ERR
-+				       "ISOFS: Recursive directory relocation "
-+				       "is not supported\n");
-+				goto eio;
-+			}
-+			reloc_block = isonum_733(rr->u.CL.location);
-+			if (reloc_block == ISOFS_I(inode)->i_iget5_block &&
-+			    ISOFS_I(inode)->i_iget5_offset == 0) {
-+				printk(KERN_ERR
-+				       "ISOFS: Directory relocation points to "
-+				       "itself\n");
-+				goto eio;
-+			}
-+			ISOFS_I(inode)->i_first_extent = reloc_block;
-+			reloc = isofs_iget_reloc(inode->i_sb, reloc_block, 0);
- 			if (IS_ERR(reloc)) {
- 				ret = PTR_ERR(reloc);
- 				goto out;
-@@ -637,9 +651,11 @@ static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
- 	return rpnt;
- }
- 
--int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
-+int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode,
-+			   int relocated)
- {
--	int result = parse_rock_ridge_inode_internal(de, inode, 0);
-+	int flags = relocated ? RR_RELOC_DE : 0;
-+	int result = parse_rock_ridge_inode_internal(de, inode, flags);
- 
- 	/*
- 	 * if rockridge flag was reset and we didn't look for attributes
-@@ -647,7 +663,8 @@ int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
- 	 */
- 	if ((ISOFS_SB(inode->i_sb)->s_rock_offset == -1)
- 	    && (ISOFS_SB(inode->i_sb)->s_rock == 2)) {
--		result = parse_rock_ridge_inode_internal(de, inode, 14);
-+		result = parse_rock_ridge_inode_internal(de, inode,
-+							 flags | RR_REGARD_XA);
- 	}
- 	return result;
- }
 diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
 index e513f19..2ab1351 100644
 --- a/fs/jffs2/erase.c
@@ -61819,7 +61468,7 @@ index 9680cef..36c9152 100644
  out:
  	return len;
 diff --git a/fs/namespace.c b/fs/namespace.c
-index ca4913a..8eb2439 100644
+index a1e663d..83eea6e 100644
 --- a/fs/namespace.c
 +++ b/fs/namespace.c
 @@ -1327,6 +1327,9 @@ static int do_umount(struct vfsmount *mnt, int flags)
@@ -61860,7 +61509,7 @@ index ca4913a..8eb2439 100644
  {
  	return sys_umount(name, 0);
  }
-@@ -2337,6 +2343,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
+@@ -2345,6 +2351,16 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
  		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
  		   MS_STRICTATIME);
  
@@ -61877,7 +61526,7 @@ index ca4913a..8eb2439 100644
  	if (flags & MS_REMOUNT)
  		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
  				    data_page);
-@@ -2351,6 +2367,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
+@@ -2359,6 +2375,9 @@ long do_mount(char *dev_name, char *dir_name, char *type_page,
  				      dev_name, data_page);
  dput_out:
  	path_put(&path);
@@ -61887,7 +61536,7 @@ index ca4913a..8eb2439 100644
  	return retval;
  }
  
-@@ -2389,7 +2408,7 @@ void mnt_make_shortterm(struct vfsmount *mnt)
+@@ -2397,7 +2416,7 @@ void mnt_make_shortterm(struct vfsmount *mnt)
   * Allocate a new namespace structure and populate it with contents
   * copied from the namespace of the passed in task structure.
   */
@@ -61896,7 +61545,7 @@ index ca4913a..8eb2439 100644
  		struct fs_struct *fs)
  {
  	struct mnt_namespace *new_ns;
-@@ -2518,8 +2537,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
+@@ -2526,8 +2545,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
  }
  EXPORT_SYMBOL(mount_subtree);
  
@@ -61907,7 +61556,7 @@ index ca4913a..8eb2439 100644
  {
  	int ret;
  	char *kernel_type;
-@@ -2606,6 +2625,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -2614,6 +2633,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  	if (error)
  		goto out2;
  
@@ -62025,7 +61674,7 @@ index b78b5b6..c64d84f 100644
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 5aea30a..5dcc620 100644
+index c4a2a68..ec7ff6e 100644
 --- a/fs/nfs/nfs4proc.c
 +++ b/fs/nfs/nfs4proc.c
 @@ -1037,7 +1037,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
@@ -81715,10 +81364,10 @@ index 7939f63..c573d38 100644
  	    .ops = &param_ops_##type,					\
  	    .elemsize = sizeof(array[0]), .elem = array };		\
 diff --git a/include/linux/mount.h b/include/linux/mount.h
-index 33fe53d..c54903f 100644
+index fc17c4d..3f48d9a 100644
 --- a/include/linux/mount.h
 +++ b/include/linux/mount.h
-@@ -86,7 +86,7 @@ struct vfsmount {
+@@ -87,7 +87,7 @@ struct vfsmount {
  	int mnt_expiry_mark;		/* true if marked for expiry */
  	int mnt_pinned;
  	int mnt_ghosts;
@@ -84686,31 +84335,20 @@ index ca2755f..85ec88c 100644
  /** inet_connection_sock - INET connection oriented sock
   *
 diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
-index ba0ddb0..9c1d46b 100644
+index 6172a44..d06d507 100644
 --- a/include/net/inetpeer.h
 +++ b/include/net/inetpeer.h
-@@ -52,8 +52,8 @@ struct inet_peer {
+@@ -52,7 +52,7 @@ struct inet_peer {
  	 */
  	union {
  		struct {
 -			atomic_t			rid;		/* Frag reception counter */
--			atomic_t			ip_id_count;	/* IP ID for the next packet */
 +			atomic_unchecked_t		rid;		/* Frag reception counter */
-+			atomic_unchecked_t		ip_id_count;	/* IP ID for the next packet */
  			__u32				tcp_ts;
  			__u32				tcp_ts_stamp;
  		};
-@@ -117,7 +117,7 @@ static inline int inet_getid(struct inet_peer *p, int more)
- {
- 	more++;
- 	inet_peer_refcheck(p);
--	return atomic_add_return(more, &p->ip_id_count) - more;
-+	return atomic_add_return_unchecked(more, &p->ip_id_count) - more;
- }
- 
- #endif /* _NET_INETPEER_H */
 diff --git a/include/net/ip.h b/include/net/ip.h
-index b935e6c..511250f 100644
+index 1ee535b..91976cb1 100644
 --- a/include/net/ip.h
 +++ b/include/net/ip.h
 @@ -214,7 +214,7 @@ extern struct local_ports {
@@ -85113,7 +84751,7 @@ index a15432da..9459dcc 100644
  
  /* Structure to track chunk fragments that have been acked, but peer
 diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
-index c2e542b..6ca975b 100644
+index b1c3d1c..895573a 100644
 --- a/include/net/secure_seq.h
 +++ b/include/net/secure_seq.h
 @@ -3,6 +3,7 @@
@@ -85121,9 +84759,9 @@ index c2e542b..6ca975b 100644
  #include <linux/types.h>
  
 +extern void net_secret_init(void);
- extern __u32 secure_ip_id(__be32 daddr);
- extern __u32 secure_ipv6_id(const __be32 daddr[4]);
  extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+ extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ 				      __be16 dport);
 diff --git a/include/net/sock.h b/include/net/sock.h
 index e6454b6..7a6b6bc 100644
 --- a/include/net/sock.h
@@ -86189,7 +85827,7 @@ index 2531811..4f036c4 100644
  #ifdef CONFIG_BLK_DEV_RAM
  		int fd;
 diff --git a/init/main.c b/init/main.c
-index 7474450..caef7e7 100644
+index e937d9b..d7da1cf 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -97,6 +97,8 @@ static inline void mark_rodata_ro(void) { }
@@ -86266,7 +85904,7 @@ index 7474450..caef7e7 100644
  static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -679,6 +739,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -683,6 +743,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
  {
  	int count = preempt_count();
  	int ret;
@@ -86274,7 +85912,7 @@ index 7474450..caef7e7 100644
  
  	if (initcall_debug)
  		ret = do_one_initcall_debug(fn);
-@@ -691,17 +752,18 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -695,17 +756,18 @@ int __init_or_module do_one_initcall(initcall_t fn)
  		sprintf(msgbuf, "error code %d ", ret);
  
  	if (preempt_count() != count) {
@@ -86297,7 +85935,7 @@ index 7474450..caef7e7 100644
  	return ret;
  }
  
-@@ -750,6 +812,10 @@ static void run_init_process(const char *init_filename)
+@@ -754,6 +816,10 @@ static void run_init_process(const char *init_filename)
  	kernel_execve(init_filename, argv_init, envp_init);
  }
  
@@ -86308,7 +85946,7 @@ index 7474450..caef7e7 100644
  /* This is a non __init function. Force it to be noinline otherwise gcc
   * makes it inline to init() and it becomes part of init.text section
   */
-@@ -771,6 +837,11 @@ static noinline int init_post(void)
+@@ -775,6 +841,11 @@ static noinline int init_post(void)
  				ramdisk_execute_command);
  	}
  
@@ -86320,7 +85958,7 @@ index 7474450..caef7e7 100644
  	/*
  	 * We try each of these until one succeeds.
  	 *
-@@ -823,7 +894,7 @@ static int __init kernel_init(void * unused)
+@@ -827,7 +898,7 @@ static int __init kernel_init(void * unused)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -86329,7 +85967,7 @@ index 7474450..caef7e7 100644
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -836,11 +907,13 @@ static int __init kernel_init(void * unused)
+@@ -840,11 +911,13 @@ static int __init kernel_init(void * unused)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -88093,7 +87731,7 @@ index 13bba30..6557764 100644
  			else
  				new_fs = fs;
 diff --git a/kernel/futex.c b/kernel/futex.c
-index 1bb37d0..14278a3 100644
+index 1bb37d0..29574af 100644
 --- a/kernel/futex.c
 +++ b/kernel/futex.c
 @@ -54,6 +54,7 @@
@@ -88143,7 +87781,15 @@ index 1bb37d0..14278a3 100644
  
  	pagefault_disable();
  	ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
-@@ -2877,6 +2883,7 @@ static int __init futex_init(void)
+@@ -2460,6 +2466,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	 * shared futexes. We need to compare the keys:
+ 	 */
+ 	if (match_futex(&q.key, &key2)) {
++		queue_unlock(&q, hb);
+ 		ret = -EINVAL;
+ 		goto out_put_keys;
+ 	}
+@@ -2877,6 +2884,7 @@ static int __init futex_init(void)
  {
  	u32 curval;
  	int i;
@@ -88151,7 +87797,7 @@ index 1bb37d0..14278a3 100644
  
  	/*
  	 * This will fail and we want it. Some arch implementations do
-@@ -2888,8 +2895,11 @@ static int __init futex_init(void)
+@@ -2888,8 +2896,11 @@ static int __init futex_init(void)
  	 * implementation, the non-functional ones will return
  	 * -ENOSYS.
  	 */
@@ -92595,10 +92241,82 @@ index 73e416d..cfc6f69 100644
  		sys_tz = *tz;
  		update_vsyscall_tz();
 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
-index eb198a3..45909ed 100644
+index eb198a3..42f27b5 100644
 --- a/kernel/time/alarmtimer.c
 +++ b/kernel/time/alarmtimer.c
-@@ -789,7 +789,7 @@ static int __init alarmtimer_init(void)
+@@ -442,18 +442,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
+ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ 							ktime_t now)
+ {
++	unsigned long flags;
+ 	struct k_itimer *ptr = container_of(alarm, struct k_itimer,
+ 						it.alarm.alarmtimer);
+-	if (posix_timer_event(ptr, 0) != 0)
+-		ptr->it_overrun++;
++	enum alarmtimer_restart result = ALARMTIMER_NORESTART;
++
++	spin_lock_irqsave(&ptr->it_lock, flags);
++	if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
++		if (posix_timer_event(ptr, 0) != 0)
++			ptr->it_overrun++;
++	}
+ 
+ 	/* Re-add periodic timers */
+ 	if (ptr->it.alarm.interval.tv64) {
+ 		ptr->it_overrun += alarm_forward(alarm, now,
+ 						ptr->it.alarm.interval);
+-		return ALARMTIMER_RESTART;
++		result = ALARMTIMER_RESTART;
+ 	}
+-	return ALARMTIMER_NORESTART;
++	spin_unlock_irqrestore(&ptr->it_lock, flags);
++
++	return result;
+ }
+ 
+ /**
+@@ -514,23 +522,33 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+ 	return 0;
+ }
+ 
++static ktime_t alarm_expires_remaining(const struct alarm *alarm)
++{
++	struct alarm_base *base = &alarm_bases[alarm->type];
++	return ktime_sub(alarm->node.expires, base->gettime());
++}
++
+ /**
+  * alarm_timer_get - posix timer_get interface
+  * @new_timer: k_itimer pointer
+  * @cur_setting: itimerspec data to fill
+  *
+- * Copies the itimerspec data out from the k_itimer
++ * Copies out the current itimerspec data
+  */
+ static void alarm_timer_get(struct k_itimer *timr,
+ 				struct itimerspec *cur_setting)
+ {
+-	memset(cur_setting, 0, sizeof(struct itimerspec));
++	ktime_t relative_expiry_time =
++		alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
+ 
+-	cur_setting->it_interval =
+-			ktime_to_timespec(timr->it.alarm.interval);
+-	cur_setting->it_value =
+-		ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
+-	return;
++	if (ktime_to_ns(relative_expiry_time) > 0) {
++		cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
++	} else {
++		cur_setting->it_value.tv_sec = 0;
++		cur_setting->it_value.tv_nsec = 0;
++	}
++
++	cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
+ }
+ 
+ /**
+@@ -789,7 +807,7 @@ static int __init alarmtimer_init(void)
  	struct platform_device *pdev;
  	int error = 0;
  	int i;
@@ -92883,7 +92601,7 @@ index dcbafed..9feb3de 100644
  
  	ftrace_graph_active++;
 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 648f25a..5971796 100644
+index 4babd77..3e869fd 100644
 --- a/kernel/trace/ring_buffer.c
 +++ b/kernel/trace/ring_buffer.c
 @@ -376,9 +376,9 @@ struct buffer_data_page {
@@ -93093,7 +92811,7 @@ index 648f25a..5971796 100644
  	}
  
  	return overruns;
-@@ -3003,8 +3003,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -2998,8 +2998,8 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
  	/*
  	 * Reset the reader page to size zero.
  	 */
@@ -93104,7 +92822,7 @@ index 648f25a..5971796 100644
  	local_set(&cpu_buffer->reader_page->page->commit, 0);
  	cpu_buffer->reader_page->real_end = 0;
  
-@@ -3038,7 +3038,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3033,7 +3033,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
  	 * want to compare with the last_overrun.
  	 */
  	smp_mb();
@@ -93113,7 +92831,7 @@ index 648f25a..5971796 100644
  
  	/*
  	 * Here's the tricky part.
-@@ -3586,8 +3586,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3583,8 +3583,8 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
  
  	cpu_buffer->head_page
  		= list_entry(cpu_buffer->pages, struct buffer_page, list);
@@ -93124,7 +92842,7 @@ index 648f25a..5971796 100644
  	local_set(&cpu_buffer->head_page->page->commit, 0);
  
  	cpu_buffer->head_page->read = 0;
-@@ -3596,14 +3596,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
+@@ -3593,14 +3593,14 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
  	cpu_buffer->commit_page = cpu_buffer->head_page;
  
  	INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
@@ -93143,7 +92861,7 @@ index 648f25a..5971796 100644
  	local_set(&cpu_buffer->entries, 0);
  	local_set(&cpu_buffer->committing, 0);
  	local_set(&cpu_buffer->commits, 0);
-@@ -4001,8 +4001,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
+@@ -3998,8 +3998,8 @@ int ring_buffer_read_page(struct ring_buffer *buffer,
  		rb_init_page(bpage);
  		bpage = reader->page;
  		reader->page = *data_page;
@@ -95925,7 +95643,7 @@ index 483e66505..32583a0 100644
  	mm = get_task_mm(tsk);
  	if (!mm)
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index c9f7e6f..45a779e 100644
+index a72fa33..0b12a09 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
 @@ -652,6 +652,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
@@ -98096,7 +97814,7 @@ index d2ac057..aa60e8c 100644
  	.next		= NULL,
  };
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index d8762b2..7c1d26d 100644
+index 62a7fa23..aaa6823 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -57,6 +57,7 @@
@@ -98458,7 +98176,7 @@ index 1371021..c2094c7 100644
  		return -ENOMEM;
  
 diff --git a/mm/slab.c b/mm/slab.c
-index 4c3b671..884702c 100644
+index aea5e42..a3a3241 100644
 --- a/mm/slab.c
 +++ b/mm/slab.c
 @@ -151,7 +151,7 @@
@@ -99117,7 +98835,7 @@ index 8105be4..8c1ce34 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index fc719f7..47b3df4 100644
+index 6a4c2fb..1e9af90 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -186,7 +186,7 @@ static enum {
@@ -100470,7 +100188,7 @@ index dd7c019..9d19c31 100644
  			if (test_bit(CONF_STATE2_DEVICE, &chan->conf_state) &&
  							rfc.mode != chan->mode)
 diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
-index 158887a..1b70c49 100644
+index 74e59cd..cb58017 100644
 --- a/net/bluetooth/l2cap_sock.c
 +++ b/net/bluetooth/l2cap_sock.c
 @@ -484,7 +484,8 @@ static int l2cap_sock_setsockopt_old(struct socket *sock, int optname, char __us
@@ -100521,7 +100239,7 @@ index 158887a..1b70c49 100644
  			err = -EFAULT;
  			break;
 diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
-index 14c4864..77ff888 100644
+index 93a8241..b9ef30c 100644
 --- a/net/bluetooth/rfcomm/sock.c
 +++ b/net/bluetooth/rfcomm/sock.c
 @@ -684,7 +684,7 @@ static int rfcomm_sock_setsockopt(struct socket *sock, int level, int optname, c
@@ -101301,7 +101019,7 @@ index 0b62dea..c2b8d20 100644
  }
  
 diff --git a/net/compat.c b/net/compat.c
-index 41724c9..7cf6606 100644
+index 759e542..7cf6606 100644
 --- a/net/compat.c
 +++ b/net/compat.c
 @@ -73,9 +73,9 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
@@ -101317,28 +101035,17 @@ index 41724c9..7cf6606 100644
  	return 0;
  }
  
-@@ -85,21 +85,22 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
- {
- 	int tot_len;
+@@ -87,7 +87,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
  
--	if (kern_msg->msg_namelen) {
-+	if (kern_msg->msg_name && kern_msg->msg_namelen) {
+ 	if (kern_msg->msg_name && kern_msg->msg_namelen) {
  		if (mode == VERIFY_READ) {
 -			int err = move_addr_to_kernel(kern_msg->msg_name,
 +			int err = move_addr_to_kernel((void __force_user *)kern_msg->msg_name,
  						      kern_msg->msg_namelen,
  						      kern_address);
  			if (err < 0)
- 				return err;
- 		}
--		if (kern_msg->msg_name)
--			kern_msg->msg_name = kern_address;
--	} else
-+		kern_msg->msg_name = kern_address;
-+	} else {
- 		kern_msg->msg_name = NULL;
-+		kern_msg->msg_namelen = 0;
-+	}
+@@ -100,7 +100,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ 	}
  
  	tot_len = iov_from_user_compat_to_kern(kern_iov,
 -					  (struct compat_iovec __user *)kern_msg->msg_iov,
@@ -101346,7 +101053,7 @@ index 41724c9..7cf6606 100644
  					  kern_msg->msg_iovlen);
  	if (tot_len >= 0)
  		kern_msg->msg_iov = kern_iov;
-@@ -119,20 +120,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+@@ -120,20 +120,20 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
  
  #define CMSG_COMPAT_FIRSTHDR(msg)			\
  	(((msg)->msg_controllen) >= sizeof(struct compat_cmsghdr) ?	\
@@ -101370,7 +101077,7 @@ index 41724c9..7cf6606 100644
  			msg->msg_controllen)
  		return NULL;
  	return (struct compat_cmsghdr __user *)ptr;
-@@ -224,7 +225,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
+@@ -225,7 +225,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
  {
  	struct compat_timeval ctv;
  	struct compat_timespec cts[3];
@@ -101379,7 +101086,7 @@ index 41724c9..7cf6606 100644
  	struct compat_cmsghdr cmhdr;
  	int cmlen;
  
-@@ -276,7 +277,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
+@@ -277,7 +277,7 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
  
  void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
  {
@@ -101388,7 +101095,7 @@ index 41724c9..7cf6606 100644
  	int fdmax = (kmsg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
  	int fdnum = scm->fp->count;
  	struct file **fp = scm->fp->fp;
-@@ -329,14 +330,6 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
+@@ -330,14 +330,6 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct scm_cookie *scm)
  	__scm_destroy(scm);
  }
  
@@ -101403,7 +101110,7 @@ index 41724c9..7cf6606 100644
  static int do_set_attach_filter(struct socket *sock, int level, int optname,
  				char __user *optval, unsigned int optlen)
  {
-@@ -373,7 +366,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
+@@ -374,7 +366,7 @@ static int do_set_sock_timeout(struct socket *sock, int level,
  		return -EFAULT;
  	old_fs = get_fs();
  	set_fs(KERNEL_DS);
@@ -101412,7 +101119,7 @@ index 41724c9..7cf6606 100644
  	set_fs(old_fs);
  
  	return err;
-@@ -434,7 +427,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
+@@ -435,7 +427,7 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
  	len = sizeof(ktime);
  	old_fs = get_fs();
  	set_fs(KERNEL_DS);
@@ -101421,7 +101128,7 @@ index 41724c9..7cf6606 100644
  	set_fs(old_fs);
  
  	if (!err) {
-@@ -569,7 +562,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+@@ -570,7 +562,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
  	case MCAST_JOIN_GROUP:
  	case MCAST_LEAVE_GROUP:
  	{
@@ -101430,7 +101137,7 @@ index 41724c9..7cf6606 100644
  		struct group_req __user *kgr =
  			compat_alloc_user_space(sizeof(struct group_req));
  		u32 interface;
-@@ -590,7 +583,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+@@ -591,7 +583,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
  	case MCAST_BLOCK_SOURCE:
  	case MCAST_UNBLOCK_SOURCE:
  	{
@@ -101439,7 +101146,7 @@ index 41724c9..7cf6606 100644
  		struct group_source_req __user *kgsr = compat_alloc_user_space(
  			sizeof(struct group_source_req));
  		u32 interface;
-@@ -611,7 +604,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+@@ -612,7 +604,7 @@ int compat_mc_setsockopt(struct sock *sock, int level, int optname,
  	}
  	case MCAST_MSFILTER:
  	{
@@ -101448,7 +101155,7 @@ index 41724c9..7cf6606 100644
  		struct group_filter __user *kgf;
  		u32 interface, fmode, numsrc;
  
-@@ -649,7 +642,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
+@@ -650,7 +642,7 @@ int compat_mc_getsockopt(struct sock *sock, int level, int optname,
  	char __user *optval, int __user *optlen,
  	int (*getsockopt)(struct sock *, int, int, char __user *, int __user *))
  {
@@ -101457,7 +101164,7 @@ index 41724c9..7cf6606 100644
  	struct group_filter __user *kgf;
  	int __user	*koptlen;
  	u32 interface, fmode, numsrc;
-@@ -802,7 +795,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
+@@ -803,7 +795,7 @@ asmlinkage long compat_sys_socketcall(int call, u32 __user *args)
  
  	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
  		return -EINVAL;
@@ -101844,15 +101551,11 @@ index e318c7e..168b1d0 100644
  			fle->object = flo;
  		else
 diff --git a/net/core/iovec.c b/net/core/iovec.c
-index 139ef93..21a2245 100644
+index 66e3f1f..317ae80 100644
 --- a/net/core/iovec.c
 +++ b/net/core/iovec.c
-@@ -39,23 +39,23 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
- {
- 	int size, ct, err;
- 
--	if (m->msg_namelen) {
-+	if (m->msg_name && m->msg_namelen) {
+@@ -42,7 +42,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
+ 	if (m->msg_name && m->msg_namelen) {
  		if (mode == VERIFY_READ) {
  			void __user *namep;
 -			namep = (void __user __force *) m->msg_name;
@@ -101860,14 +101563,7 @@ index 139ef93..21a2245 100644
  			err = move_addr_to_kernel(namep, m->msg_namelen,
  						  address);
  			if (err < 0)
- 				return err;
- 		}
--		if (m->msg_name)
--			m->msg_name = address;
-+		m->msg_name = address;
- 	} else {
- 		m->msg_name = NULL;
-+		m->msg_namelen = 0;
+@@ -55,7 +55,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
  	}
  
  	size = m->msg_iovlen * sizeof(struct iovec);
@@ -102043,7 +101739,7 @@ index ff52ad0..aff1c0f 100644
  	{
  		int new_fd;
 diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
-index 925991a..209a505 100644
+index fd53919..2b0810e 100644
 --- a/net/core/secure_seq.c
 +++ b/net/core/secure_seq.c
 @@ -12,12 +12,10 @@
@@ -102691,20 +102387,18 @@ index 4afcf31..392d206 100644
  			inet_twsk_deschedule(tw, death_row);
  			while (twrefcnt) {
 diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
-index 58c4e696..4f025f0 100644
+index 9d74cc7..5a73694 100644
 --- a/net/ipv4/inetpeer.c
 +++ b/net/ipv4/inetpeer.c
-@@ -487,8 +487,8 @@ relookup:
+@@ -473,7 +473,7 @@ relookup:
  	if (p) {
  		p->daddr = *daddr;
  		atomic_set(&p->refcnt, 1);
 -		atomic_set(&p->rid, 0);
--		atomic_set(&p->ip_id_count,
 +		atomic_set_unchecked(&p->rid, 0);
-+		atomic_set_unchecked(&p->ip_id_count,
- 				(daddr->family == AF_INET) ?
- 					secure_ip_id(daddr->addr.a4) :
- 					secure_ipv6_id(daddr->addr.a6));
+ 		p->tcp_ts_stamp = 0;
+ 		p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
+ 		p->rate_tokens = 0;
 diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
 index 8f441b2..a56d38e 100644
 --- a/net/ipv4/ip_fragment.c
@@ -102841,7 +102535,7 @@ index 99ec116..c5628fe 100644
  	return res;
  }
 diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
-index 140d377..69801fa 100644
+index 7993d16..8954007 100644
 --- a/net/ipv4/ipmr.c
 +++ b/net/ipv4/ipmr.c
 @@ -1323,6 +1323,10 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
@@ -102993,7 +102687,7 @@ index f7fdbe9..63740b7 100644
  	.exit = ip_proc_exit_net,
  };
 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
-index cfded93..7b72cc0 100644
+index 75fea1f..a26be5a 100644
 --- a/net/ipv4/raw.c
 +++ b/net/ipv4/raw.c
 @@ -305,7 +305,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
@@ -103063,7 +102757,7 @@ index cfded93..7b72cc0 100644
  	.exit = raw_exit_net,
  };
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index 6526110b..e060b32 100644
+index d361dc0..a814666 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
 @@ -313,7 +313,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
@@ -103111,16 +102805,30 @@ index 6526110b..e060b32 100644
  	redirect_genid++;
  	inetpeer_invalidate_tree(AF_INET);
  }
-@@ -3023,7 +3023,7 @@ static int rt_fill_info(struct net *net,
- 	error = rt->dst.error;
- 	if (peer) {
- 		inet_peer_refcheck(rt->peer);
--		id = atomic_read(&peer->ip_id_count) & 0xffff;
-+		id = atomic_read_unchecked(&peer->ip_id_count) & 0xffff;
- 		if (peer->tcp_ts_stamp) {
- 			ts = peer->tcp_ts;
- 			tsage = get_seconds() - peer->tcp_ts_stamp;
-@@ -3222,7 +3222,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
+@@ -1346,11 +1346,11 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
+ 
+ #define IP_IDENTS_SZ 2048u
+ struct ip_ident_bucket {
+-	atomic_t	id;
++	atomic_unchecked_t	id;
+ 	u32		stamp32;
+ };
+ 
+-static struct ip_ident_bucket *ip_idents __read_mostly;
++static struct ip_ident_bucket ip_idents[IP_IDENTS_SZ] __read_mostly;
+ 
+ /* In order to protect privacy, we add a perturbation to identifiers
+  * if one generator is seldom used. This makes hard for an attacker
+@@ -1370,7 +1370,7 @@ u32 ip_idents_reserve(u32 hash, int segs)
+ 		delta = (u32)(x >> 32);
+ 	}
+ 
+-	return atomic_add_return(segs + delta, &bucket->id) - segs;
++	return atomic_add_return_unchecked(segs + delta, &bucket->id) - segs;
+ }
+ EXPORT_SYMBOL(ip_idents_reserve);
+ 
+@@ -3228,7 +3228,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
  {
  	if (write) {
  		int flush_delay;
@@ -103129,7 +102837,7 @@ index 6526110b..e060b32 100644
  		struct net *net;
  
  		memcpy(&ctl, __ctl, sizeof(ctl));
-@@ -3371,6 +3371,7 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -3377,6 +3377,7 @@ static struct ctl_table ipv4_route_flush_table[] = {
  		.maxlen		= sizeof(int),
  		.mode		= 0200,
  		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -103137,7 +102845,7 @@ index 6526110b..e060b32 100644
  	},
  	{ },
  };
-@@ -3384,25 +3385,23 @@ static __net_initdata struct ctl_path ipv4_route_path[] = {
+@@ -3390,25 +3391,23 @@ static __net_initdata struct ctl_path ipv4_route_path[] = {
  
  static __net_init int sysctl_route_net_init(struct net *net)
  {
@@ -103170,7 +102878,7 @@ index 6526110b..e060b32 100644
  err_dup:
  	return -ENOMEM;
  }
-@@ -3417,7 +3416,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
+@@ -3423,7 +3422,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
  	kfree(tbl);
  }
  
@@ -103179,7 +102887,7 @@ index 6526110b..e060b32 100644
  	.init = sysctl_route_net_init,
  	.exit = sysctl_route_net_exit,
  };
-@@ -3432,7 +3431,7 @@ static __net_init int rt_genid_init(struct net *net)
+@@ -3438,7 +3437,7 @@ static __net_init int rt_genid_init(struct net *net)
  	return 0;
  }
  
@@ -103188,6 +102896,19 @@ index 6526110b..e060b32 100644
  	.init = rt_genid_init,
  };
  
+@@ -3461,11 +3460,7 @@ int __init ip_rt_init(void)
+ {
+ 	int rc = 0;
+ 
+-	ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
+-	if (!ip_idents)
+-		panic("IP: failed to allocate ip_idents\n");
+-
+-	get_random_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++	get_random_bytes(ip_idents, sizeof(ip_idents));
+ 
+ #ifdef CONFIG_IP_ROUTE_CLASSID
+ 	ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
 diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
 index 8a1bed2..d41ac11 100644
 --- a/net/ipv4/syncookies.c
@@ -103697,33 +103418,6 @@ index 2e0f0af..e2948bf 100644
  	if (retransmits_timed_out(sk, retry_until,
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
-diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
-index 80fa2bf..c042e52 100644
---- a/net/ipv4/tcp_vegas.c
-+++ b/net/ipv4/tcp_vegas.c
-@@ -218,7 +218,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
- 			 * This is:
- 			 *     (actual rate in segments) * baseRTT
- 			 */
--			target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
-+			target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT;
-+			do_div(target_cwnd, rtt);
- 
- 			/* Calculate the difference between the window we had,
- 			 * and the window we would like to have. This quantity
-diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
-index ac43cd7..b4d1858 100644
---- a/net/ipv4/tcp_veno.c
-+++ b/net/ipv4/tcp_veno.c
-@@ -144,7 +144,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
- 
- 		rtt = veno->minrtt;
- 
--		target_cwnd = (tp->snd_cwnd * veno->basertt);
-+		target_cwnd = (u64)tp->snd_cwnd * veno->basertt;
- 		target_cwnd <<= V_PARAM_SHIFT;
- 		do_div(target_cwnd, rtt);
- 
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
 index 8c2e259..076bc5b 100644
 --- a/net/ipv4/udp.c
@@ -103966,28 +103660,6 @@ index 1567fb1..29af910 100644
  			__sk_dst_reset(sk);
  			dst = NULL;
  		}
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 064b5c9..bd9ff9d 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -600,7 +600,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
- 
- void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
- {
--	static atomic_t ipv6_fragmentation_id;
-+	static atomic_unchecked_t ipv6_fragmentation_id;
- 	int ident;
- 
- 	if (rt && !(rt->dst.flags & DST_NOPEER)) {
-@@ -614,7 +614,7 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
- 			return;
- 		}
- 	}
--	ident = atomic_inc_return(&ipv6_fragmentation_id);
-+	ident = atomic_inc_return_unchecked(&ipv6_fragmentation_id);
- 	fhdr->identification = htonl(ident);
- }
- 
 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
 index b204df8..8f274f4 100644
 --- a/net/ipv6/ipv6_sockglue.c
@@ -105230,7 +104902,7 @@ index 2b6678c0..aaa41fc 100644
  	cp->old_state = cp->state;
  	/*
 diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
-index 38c0813..a29519d 100644
+index cc8f8b4..b22ea63 100644
 --- a/net/netfilter/ipvs/ip_vs_xmit.c
 +++ b/net/netfilter/ipvs/ip_vs_xmit.c
 @@ -1151,7 +1151,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
@@ -106448,18 +106120,6 @@ index 7635107..4670276 100644
  	_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
  
  	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff --git a/net/sctp/associola.c b/net/sctp/associola.c
-index 25b207b..da54d29 100644
---- a/net/sctp/associola.c
-+++ b/net/sctp/associola.c
-@@ -1188,6 +1188,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
- 	asoc->c = new->c;
- 	asoc->peer.rwnd = new->peer.rwnd;
- 	asoc->peer.sack_needed = new->peer.sack_needed;
-+	asoc->peer.auth_capable = new->peer.auth_capable;
- 	asoc->peer.i = new->peer.i;
- 	sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
- 			 asoc->peer.i.initial_tsn, GFP_ATOMIC);
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
 index 0b6a391..febcef2 100644
 --- a/net/sctp/ipv6.c
@@ -111329,7 +110989,7 @@ index b43813c..74be837 100644
  #else
  static inline int selinux_xfrm_enabled(void)
 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index 7db62b4..ee4d949 100644
+index e3adb49..9798c61 100644
 --- a/security/smack/smack_lsm.c
 +++ b/security/smack/smack_lsm.c
 @@ -3481,7 +3481,7 @@ static int smack_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
@@ -119949,10 +119609,10 @@ index 0000000..4378111
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..9eca4c1
+index 0000000..212e4c0
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,5108 @@
+@@ -0,0 +1,5113 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
 +compat_sock_setsockopt_23 compat_sock_setsockopt 5 23 NULL
@@ -120332,6 +119992,7 @@ index 0000000..9eca4c1
 +skb_network_header_len_4971 skb_network_header_len 0 4971 NULL
 +do_mincore_5018 do_mincore 0-2-1 5018 NULL
 +mtd_device_parse_register_5024 mtd_device_parse_register 5 5024 NULL
++__ip_select_ident_5046 __ip_select_ident 2 5046 NULL
 +ocfs2_check_range_for_holes_5066 ocfs2_check_range_for_holes 2-3 5066 NULL
 +__kmalloc_track_caller_5071 __kmalloc_track_caller 1 5071 NULL
 +snd_mixart_BA1_read_5082 snd_mixart_BA1_read 5 5082 NULL
@@ -120457,6 +120118,7 @@ index 0000000..9eca4c1
 +calc_pages_for_6838 calc_pages_for 0-1-2 6838 NULL
 +mon_bin_read_6841 mon_bin_read 3 6841 NULL
 +snd_cs4281_BA0_read_6847 snd_cs4281_BA0_read 5 6847 NULL
++ip_select_ident_segs_6862 ip_select_ident_segs 3 6862 NULL
 +ieee80211_if_fmt_path_refresh_time_6888 ieee80211_if_fmt_path_refresh_time 3 6888 NULL nohasharray
 +raw_seticmpfilter_6888 raw_seticmpfilter 3 6888 &ieee80211_if_fmt_path_refresh_time_6888
 +dlmfs_file_write_6892 dlmfs_file_write 3 6892 NULL
@@ -121552,6 +121214,7 @@ index 0000000..9eca4c1
 +_rtl92s_get_h2c_cmdlen_20312 _rtl92s_get_h2c_cmdlen 0 20312 NULL
 +vx_send_msg_nolock_20322 vx_send_msg_nolock 0 20322 NULL
 +snd_cs4281_BA1_read_20323 snd_cs4281_BA1_read 5 20323 NULL
++ip_idents_reserve_20328 ip_idents_reserve 2 20328 NULL
 +gfs2_glock_nq_m_20347 gfs2_glock_nq_m 1 20347 NULL
 +snd_nm256_readl_20394 snd_nm256_readl 0 20394 NULL
 +__kfifo_from_user_20399 __kfifo_from_user 3 20399 NULL
@@ -122283,6 +121946,7 @@ index 0000000..9eca4c1
 +dbAlloc_29794 dbAlloc 0 29794 NULL
 +tcp_sendpage_29829 tcp_sendpage 4-3 29829 NULL
 +__probe_kernel_write_29842 __probe_kernel_write 3 29842 NULL
++count_partial_29850 count_partial 0 29850 NULL
 +ipv6_setsockopt_29871 ipv6_setsockopt 5 29871 NULL
 +scsi_end_request_29876 scsi_end_request 3 29876 NULL
 +crypto_aead_alignmask_29885 crypto_aead_alignmask 0 29885 NULL
@@ -123298,6 +122962,7 @@ index 0000000..9eca4c1
 +iwl_dbgfs_ucode_bt_stats_read_42820 iwl_dbgfs_ucode_bt_stats_read 3 42820 NULL
 +set_arg_42824 set_arg 3 42824 NULL
 +ocfs2_desc_bitmap_to_cluster_off_42831 ocfs2_desc_bitmap_to_cluster_off 2 42831 NULL
++prandom_u32_42853 prandom_u32 0 42853 NULL
 +ocfs2_clusters_for_bytes_42872 ocfs2_clusters_for_bytes 0-2 42872 NULL
 +pskb_expand_head_42881 pskb_expand_head 2-3 42881 NULL
 +tipc_port_recv_sections_42890 tipc_port_recv_sections 4 42890 NULL
diff --git a/3.2.62/4425_grsec_remove_EI_PAX.patch b/3.2.63/4425_grsec_remove_EI_PAX.patch
index cf65d90..cf65d90 100644
--- a/3.2.62/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.63/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.62/4427_force_XATTR_PAX_tmpfs.patch b/3.2.63/4427_force_XATTR_PAX_tmpfs.patch
index a5527a5..a5527a5 100644
--- a/3.2.62/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.63/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.62/4430_grsec-remove-localversion-grsec.patch b/3.2.63/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.62/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.63/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.62/4435_grsec-mute-warnings.patch b/3.2.63/4435_grsec-mute-warnings.patch
index da01ac7..da01ac7 100644
--- a/3.2.62/4435_grsec-mute-warnings.patch
+++ b/3.2.63/4435_grsec-mute-warnings.patch
diff --git a/3.2.62/4440_grsec-remove-protected-paths.patch b/3.2.63/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.62/4440_grsec-remove-protected-paths.patch
+++ b/3.2.63/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.62/4450_grsec-kconfig-default-gids.patch b/3.2.63/4450_grsec-kconfig-default-gids.patch
index 363dc64..363dc64 100644
--- a/3.2.62/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.63/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.62/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.63/4465_selinux-avc_audit-log-curr_ip.patch
index 3b873e1..3b873e1 100644
--- a/3.2.62/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.63/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.62/4470_disable-compat_vdso.patch b/3.2.63/4470_disable-compat_vdso.patch
index 0aedd26..0aedd26 100644
--- a/3.2.62/4470_disable-compat_vdso.patch
+++ b/3.2.63/4470_disable-compat_vdso.patch
diff --git a/3.2.62/4475_emutramp_default_on.patch b/3.2.63/4475_emutramp_default_on.patch
index 941870b..941870b 100644
--- a/3.2.62/4475_emutramp_default_on.patch
+++ b/3.2.63/4475_emutramp_default_on.patch