Grsec/PaX: 2.2.2-2.6.32.56-201202071726 + 2.2.2-3.2.5-20120208192420120208

16 files changed, 122 insertions, 3872 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 6a881db..4def10d 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -18,7 +18,7 @@ Patch:	1055_linux-2.6.32.56.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.56
 
-Patch:	4420_grsecurity-2.2.2-2.6.32.56-201202051926.patch
+Patch:	4420_grsecurity-2.2.2-2.6.32.56-201202071726.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.2.2-2.6.32.56-201202051926.patch b/2.6.32/4420_grsecurity-2.2.2-2.6.32.56-201202071726.patch
index b3de8e3..f29243f 100644
--- a/2.6.32/4420_grsecurity-2.2.2-2.6.32.56-201202051926.patch
+++ b/2.6.32/4420_grsecurity-2.2.2-2.6.32.56-201202071726.patch
@@ -76129,6 +76129,20 @@ index d102559..4215f31 100644
  #define free(a) kfree(a)
  #endif
  
+diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
+index bd2bea9..6b3c95e 100644
+--- a/lib/is_single_threaded.c
++++ b/lib/is_single_threaded.c
+@@ -22,6 +22,9 @@ bool current_is_single_threaded(void)
+ 	struct task_struct *p, *t;
+ 	bool ret;
+ 
++	if (!mm)
++		return true;
++
+ 	if (atomic_read(&task->signal->live) != 1)
+ 		return false;
+ 
 diff --git a/lib/kobject.c b/lib/kobject.c
 index b512b74..8115eb1 100644
 --- a/lib/kobject.c
diff --git a/3.2.4/1002_linux-3.2.3.patch b/3.2.4/1002_linux-3.2.3.patch
deleted file mode 100644
index 98925b0..0000000
--- a/3.2.4/1002_linux-3.2.3.patch
+++ /dev/null
@@ -1,3760 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 2f684da..d45e887 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 2
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Saber-toothed Squirrel
- 
-diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
-index aa64294..f5bbe0ef 100644
---- a/arch/arm/mach-at91/setup.c
-+++ b/arch/arm/mach-at91/setup.c
-@@ -27,9 +27,12 @@ EXPORT_SYMBOL(at91_soc_initdata);
- void __init at91rm9200_set_type(int type)
- {
- 	if (type == ARCH_REVISON_9200_PQFP)
--		at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
--	else
- 		at91_soc_initdata.subtype = AT91_SOC_RM9200_PQFP;
-+	else
-+		at91_soc_initdata.subtype = AT91_SOC_RM9200_BGA;
-+
-+	pr_info("AT91: filled in soc subtype: %s\n",
-+		at91_get_soc_subtype(&at91_soc_initdata));
- }
- 
- void __init at91_init_irq_default(void)
-diff --git a/arch/arm/mach-ux500/Kconfig b/arch/arm/mach-ux500/Kconfig
-index a3e0c86..52af004 100644
---- a/arch/arm/mach-ux500/Kconfig
-+++ b/arch/arm/mach-ux500/Kconfig
-@@ -7,6 +7,7 @@ config UX500_SOC_COMMON
- 	select HAS_MTU
- 	select ARM_ERRATA_753970
- 	select ARM_ERRATA_754322
-+	select ARM_ERRATA_764369
- 
- menu "Ux500 SoC"
- 
-diff --git a/arch/arm/mach-ux500/board-mop500-sdi.c b/arch/arm/mach-ux500/board-mop500-sdi.c
-index 6826fae..306cff0 100644
---- a/arch/arm/mach-ux500/board-mop500-sdi.c
-+++ b/arch/arm/mach-ux500/board-mop500-sdi.c
-@@ -233,6 +233,8 @@ void __init snowball_sdi_init(void)
- {
- 	u32 periphid = 0x10480180;
- 
-+	/* On Snowball MMC_CAP_SD_HIGHSPEED isn't supported on sdi0 */
-+	mop500_sdi0_data.capabilities &= ~MMC_CAP_SD_HIGHSPEED;
- 	mop500_sdi2_data.capabilities |= MMC_CAP_MMC_HIGHSPEED;
- 
- 	/* On-board eMMC */
-diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
-index e70a737..40cc7aa 100644
---- a/arch/arm/mm/proc-v7.S
-+++ b/arch/arm/mm/proc-v7.S
-@@ -271,10 +271,6 @@ ENDPROC(cpu_v7_do_resume)
-  *	Initialise TLB, Caches, and MMU state ready to switch the MMU
-  *	on.  Return in r0 the new CP15 C1 control register setting.
-  *
-- *	We automatically detect if we have a Harvard cache, and use the
-- *	Harvard cache control instructions insead of the unified cache
-- *	control instructions.
-- *
-  *	This should be able to cover all ARMv7 cores.
-  *
-  *	It is assumed that:
-@@ -373,9 +369,7 @@ __v7_setup:
- #endif
- 
- 3:	mov	r10, #0
--#ifdef HARVARD_CACHE
- 	mcr	p15, 0, r10, c7, c5, 0		@ I+BTB cache invalidate
--#endif
- 	dsb
- #ifdef CONFIG_MMU
- 	mcr	p15, 0, r10, c8, c7, 0		@ invalidate I + D TLBs
-diff --git a/arch/m68k/atari/config.c b/arch/m68k/atari/config.c
-index 4203d10..c4ac15c 100644
---- a/arch/m68k/atari/config.c
-+++ b/arch/m68k/atari/config.c
-@@ -414,9 +414,9 @@ void __init config_atari(void)
- 					 * FDC val = 4 -> Supervisor only */
- 		asm volatile ("\n"
- 			"	.chip	68030\n"
--			"	pmove	%0@,%/tt1\n"
-+			"	pmove	%0,%/tt1\n"
- 			"	.chip	68k"
--			: : "a" (&tt1_val));
-+			: : "m" (tt1_val));
- 	} else {
- 	        asm volatile ("\n"
- 			"	.chip	68040\n"
-@@ -569,10 +569,10 @@ static void atari_reset(void)
- 			: "d0");
- 	} else
- 		asm volatile ("\n"
--			"	pmove	%0@,%%tc\n"
-+			"	pmove	%0,%%tc\n"
- 			"	jmp	%1@"
- 			: /* no outputs */
--			: "a" (&tc_val), "a" (reset_addr));
-+			: "m" (tc_val), "a" (reset_addr));
- }
- 
- 
-diff --git a/arch/m68k/kernel/process_mm.c b/arch/m68k/kernel/process_mm.c
-index 1bc223a..aa4ffb8 100644
---- a/arch/m68k/kernel/process_mm.c
-+++ b/arch/m68k/kernel/process_mm.c
-@@ -189,8 +189,8 @@ void flush_thread(void)
- 	current->thread.fs = __USER_DS;
- 	if (!FPU_IS_EMU)
- 		asm volatile (".chip 68k/68881\n\t"
--			      "frestore %0@\n\t"
--			      ".chip 68k" : : "a" (&zero));
-+			      "frestore %0\n\t"
-+			      ".chip 68k" : : "m" (zero));
- }
- 
- /*
-diff --git a/arch/m68k/kernel/process_no.c b/arch/m68k/kernel/process_no.c
-index 69c1803..5e1078c 100644
---- a/arch/m68k/kernel/process_no.c
-+++ b/arch/m68k/kernel/process_no.c
-@@ -163,8 +163,8 @@ void flush_thread(void)
- #ifdef CONFIG_FPU
- 	if (!FPU_IS_EMU)
- 		asm volatile (".chip 68k/68881\n\t"
--			      "frestore %0@\n\t"
--			      ".chip 68k" : : "a" (&zero));
-+			      "frestore %0\n\t"
-+			      ".chip 68k" : : "m" (zero));
- #endif
- }
- 
-diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
-index 89362f2..eb67469 100644
---- a/arch/m68k/kernel/traps.c
-+++ b/arch/m68k/kernel/traps.c
-@@ -552,13 +552,13 @@ static inline void bus_error030 (struct frame *fp)
- 
- #ifdef DEBUG
- 		asm volatile ("ptestr %3,%2@,#7,%0\n\t"
--			      "pmove %%psr,%1@"
--			      : "=a&" (desc)
--			      : "a" (&temp), "a" (addr), "d" (ssw));
-+			      "pmove %%psr,%1"
-+			      : "=a&" (desc), "=m" (temp)
-+			      : "a" (addr), "d" (ssw));
- #else
- 		asm volatile ("ptestr %2,%1@,#7\n\t"
--			      "pmove %%psr,%0@"
--			      : : "a" (&temp), "a" (addr), "d" (ssw));
-+			      "pmove %%psr,%0"
-+			      : "=m" (temp) : "a" (addr), "d" (ssw));
- #endif
- 		mmusr = temp;
- 
-@@ -605,20 +605,18 @@ static inline void bus_error030 (struct frame *fp)
- 			       !(ssw & RW) ? "write" : "read", addr,
- 			       fp->ptregs.pc, ssw);
- 			asm volatile ("ptestr #1,%1@,#0\n\t"
--				      "pmove %%psr,%0@"
--				      : /* no outputs */
--				      : "a" (&temp), "a" (addr));
-+				      "pmove %%psr,%0"
-+				      : "=m" (temp)
-+				      : "a" (addr));
- 			mmusr = temp;
- 
- 			printk ("level 0 mmusr is %#x\n", mmusr);
- #if 0
--			asm volatile ("pmove %%tt0,%0@"
--				      : /* no outputs */
--				      : "a" (&tlong));
-+			asm volatile ("pmove %%tt0,%0"
-+				      : "=m" (tlong));
- 			printk("tt0 is %#lx, ", tlong);
--			asm volatile ("pmove %%tt1,%0@"
--				      : /* no outputs */
--				      : "a" (&tlong));
-+			asm volatile ("pmove %%tt1,%0"
-+				      : "=m" (tlong));
- 			printk("tt1 is %#lx\n", tlong);
- #endif
- #ifdef DEBUG
-@@ -668,13 +666,13 @@ static inline void bus_error030 (struct frame *fp)
- 
- #ifdef DEBUG
- 	asm volatile ("ptestr #1,%2@,#7,%0\n\t"
--		      "pmove %%psr,%1@"
--		      : "=a&" (desc)
--		      : "a" (&temp), "a" (addr));
-+		      "pmove %%psr,%1"
-+		      : "=a&" (desc), "=m" (temp)
-+		      : "a" (addr));
- #else
- 	asm volatile ("ptestr #1,%1@,#7\n\t"
--		      "pmove %%psr,%0@"
--		      : : "a" (&temp), "a" (addr));
-+		      "pmove %%psr,%0"
-+		      : "=m" (temp) : "a" (addr));
- #endif
- 	mmusr = temp;
- 
-diff --git a/arch/m68k/mm/cache.c b/arch/m68k/mm/cache.c
-index 5437fff..5550aa4 100644
---- a/arch/m68k/mm/cache.c
-+++ b/arch/m68k/mm/cache.c
-@@ -52,9 +52,9 @@ static unsigned long virt_to_phys_slow(unsigned long vaddr)
- 		unsigned long *descaddr;
- 
- 		asm volatile ("ptestr %3,%2@,#7,%0\n\t"
--			      "pmove %%psr,%1@"
--			      : "=a&" (descaddr)
--			      : "a" (&mmusr), "a" (vaddr), "d" (get_fs().seg));
-+			      "pmove %%psr,%1"
-+			      : "=a&" (descaddr), "=m" (mmusr)
-+			      : "a" (vaddr), "d" (get_fs().seg));
- 		if (mmusr & (MMU_I|MMU_B|MMU_L))
- 			return 0;
- 		descaddr = phys_to_virt((unsigned long)descaddr);
-diff --git a/arch/x86/include/asm/uv/uv_hub.h b/arch/x86/include/asm/uv/uv_hub.h
-index 54a13aa..21f7385 100644
---- a/arch/x86/include/asm/uv/uv_hub.h
-+++ b/arch/x86/include/asm/uv/uv_hub.h
-@@ -318,13 +318,13 @@ uv_gpa_in_mmr_space(unsigned long gpa)
- /* UV global physical address --> socket phys RAM */
- static inline unsigned long uv_gpa_to_soc_phys_ram(unsigned long gpa)
- {
--	unsigned long paddr = gpa & uv_hub_info->gpa_mask;
-+	unsigned long paddr;
- 	unsigned long remap_base = uv_hub_info->lowmem_remap_base;
- 	unsigned long remap_top =  uv_hub_info->lowmem_remap_top;
- 
- 	gpa = ((gpa << uv_hub_info->m_shift) >> uv_hub_info->m_shift) |
- 		((gpa >> uv_hub_info->n_lshift) << uv_hub_info->m_val);
--	gpa = gpa & uv_hub_info->gpa_mask;
-+	paddr = gpa & uv_hub_info->gpa_mask;
- 	if (paddr >= remap_base && paddr < remap_base + remap_top)
- 		paddr -= remap_base;
- 	return paddr;
-diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/microcode_amd.c
-index d494799..ac52c15 100644
---- a/arch/x86/kernel/microcode_amd.c
-+++ b/arch/x86/kernel/microcode_amd.c
-@@ -300,13 +300,33 @@ free_table:
- 	return state;
- }
- 
-+/*
-+ * AMD microcode firmware naming convention, up to family 15h they are in
-+ * the legacy file:
-+ *
-+ *    amd-ucode/microcode_amd.bin
-+ *
-+ * This legacy file is always smaller than 2K in size.
-+ *
-+ * Starting at family 15h they are in family specific firmware files:
-+ *
-+ *    amd-ucode/microcode_amd_fam15h.bin
-+ *    amd-ucode/microcode_amd_fam16h.bin
-+ *    ...
-+ *
-+ * These might be larger than 2K.
-+ */
- static enum ucode_state request_microcode_amd(int cpu, struct device *device)
- {
--	const char *fw_name = "amd-ucode/microcode_amd.bin";
-+	char fw_name[36] = "amd-ucode/microcode_amd.bin";
- 	const struct firmware *fw;
- 	enum ucode_state ret = UCODE_NFOUND;
-+	struct cpuinfo_x86 *c = &cpu_data(cpu);
-+
-+	if (c->x86 >= 0x15)
-+		snprintf(fw_name, sizeof(fw_name), "amd-ucode/microcode_amd_fam%.2xh.bin", c->x86);
- 
--	if (request_firmware(&fw, fw_name, device)) {
-+	if (request_firmware(&fw, (const char *)fw_name, device)) {
- 		pr_err("failed to load file %s\n", fw_name);
- 		goto out;
- 	}
-diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 7b65f75..7c1b765 100644
---- a/arch/x86/net/bpf_jit_comp.c
-+++ b/arch/x86/net/bpf_jit_comp.c
-@@ -151,17 +151,18 @@ void bpf_jit_compile(struct sk_filter *fp)
- 	cleanup_addr = proglen; /* epilogue address */
- 
- 	for (pass = 0; pass < 10; pass++) {
-+		u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
- 		/* no prologue/epilogue for trivial filters (RET something) */
- 		proglen = 0;
- 		prog = temp;
- 
--		if (seen) {
-+		if (seen_or_pass0) {
- 			EMIT4(0x55, 0x48, 0x89, 0xe5); /* push %rbp; mov %rsp,%rbp */
- 			EMIT4(0x48, 0x83, 0xec, 96);	/* subq  $96,%rsp	*/
- 			/* note : must save %rbx in case bpf_error is hit */
--			if (seen & (SEEN_XREG | SEEN_DATAREF))
-+			if (seen_or_pass0 & (SEEN_XREG | SEEN_DATAREF))
- 				EMIT4(0x48, 0x89, 0x5d, 0xf8); /* mov %rbx, -8(%rbp) */
--			if (seen & SEEN_XREG)
-+			if (seen_or_pass0 & SEEN_XREG)
- 				CLEAR_X(); /* make sure we dont leek kernel memory */
- 
- 			/*
-@@ -170,7 +171,7 @@ void bpf_jit_compile(struct sk_filter *fp)
- 			 *  r9 = skb->len - skb->data_len
- 			 *  r8 = skb->data
- 			 */
--			if (seen & SEEN_DATAREF) {
-+			if (seen_or_pass0 & SEEN_DATAREF) {
- 				if (offsetof(struct sk_buff, len) <= 127)
- 					/* mov    off8(%rdi),%r9d */
- 					EMIT4(0x44, 0x8b, 0x4f, offsetof(struct sk_buff, len));
-@@ -260,9 +261,14 @@ void bpf_jit_compile(struct sk_filter *fp)
- 			case BPF_S_ALU_DIV_X: /* A /= X; */
- 				seen |= SEEN_XREG;
- 				EMIT2(0x85, 0xdb);	/* test %ebx,%ebx */
--				if (pc_ret0 != -1)
--					EMIT_COND_JMP(X86_JE, addrs[pc_ret0] - (addrs[i] - 4));
--				else {
-+				if (pc_ret0 > 0) {
-+					/* addrs[pc_ret0 - 1] is start address of target
-+					 * (addrs[i] - 4) is the address following this jmp
-+					 * ("xor %edx,%edx; div %ebx" being 4 bytes long)
-+					 */
-+					EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
-+								(addrs[i] - 4));
-+				} else {
- 					EMIT_COND_JMP(X86_JNE, 2 + 5);
- 					CLEAR_A();
- 					EMIT1_off32(0xe9, cleanup_addr - (addrs[i] - 4)); /* jmp .+off32 */
-@@ -335,12 +341,12 @@ void bpf_jit_compile(struct sk_filter *fp)
- 				}
- 				/* fallinto */
- 			case BPF_S_RET_A:
--				if (seen) {
-+				if (seen_or_pass0) {
- 					if (i != flen - 1) {
- 						EMIT_JMP(cleanup_addr - addrs[i]);
- 						break;
- 					}
--					if (seen & SEEN_XREG)
-+					if (seen_or_pass0 & SEEN_XREG)
- 						EMIT4(0x48, 0x8b, 0x5d, 0xf8);  /* mov  -8(%rbp),%rbx */
- 					EMIT1(0xc9);		/* leaveq */
- 				}
-@@ -483,8 +489,9 @@ common_load:			seen |= SEEN_DATAREF;
- 				goto common_load;
- 			case BPF_S_LDX_B_MSH:
- 				if ((int)K < 0) {
--					if (pc_ret0 != -1) {
--						EMIT_JMP(addrs[pc_ret0] - addrs[i]);
-+					if (pc_ret0 > 0) {
-+						/* addrs[pc_ret0 - 1] is the start address */
-+						EMIT_JMP(addrs[pc_ret0 - 1] - addrs[i]);
- 						break;
- 					}
- 					CLEAR_A();
-@@ -599,13 +606,14 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
- 		 * use it to give the cleanup instruction(s) addr
- 		 */
- 		cleanup_addr = proglen - 1; /* ret */
--		if (seen)
-+		if (seen_or_pass0)
- 			cleanup_addr -= 1; /* leaveq */
--		if (seen & SEEN_XREG)
-+		if (seen_or_pass0 & SEEN_XREG)
- 			cleanup_addr -= 4; /* mov  -8(%rbp),%rbx */
- 
- 		if (image) {
--			WARN_ON(proglen != oldproglen);
-+			if (proglen != oldproglen)
-+				pr_err("bpb_jit_compile proglen=%u != oldproglen=%u\n", proglen, oldproglen);
- 			break;
- 		}
- 		if (proglen == oldproglen) {
-diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
-index 9010ca7..81aee5a 100644
---- a/arch/x86/platform/uv/tlb_uv.c
-+++ b/arch/x86/platform/uv/tlb_uv.c
-@@ -1860,6 +1860,8 @@ static void __init init_per_cpu_tunables(void)
- 		bcp->cong_reps			= congested_reps;
- 		bcp->cong_period		= congested_period;
- 		bcp->clocks_per_100_usec =	usec_2_cycles(100);
-+		spin_lock_init(&bcp->queue_lock);
-+		spin_lock_init(&bcp->uvhub_lock);
- 	}
- }
- 
-diff --git a/arch/x86/platform/uv/uv_irq.c b/arch/x86/platform/uv/uv_irq.c
-index 374a05d..f25c276 100644
---- a/arch/x86/platform/uv/uv_irq.c
-+++ b/arch/x86/platform/uv/uv_irq.c
-@@ -25,7 +25,7 @@ struct uv_irq_2_mmr_pnode{
- 	int			irq;
- };
- 
--static spinlock_t		uv_irq_lock;
-+static DEFINE_SPINLOCK(uv_irq_lock);
- static struct rb_root		uv_irq_root;
- 
- static int uv_set_irq_affinity(struct irq_data *, const struct cpumask *, bool);
-diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
-index cc9b1e1..d69cc6c 100644
---- a/arch/x86/xen/spinlock.c
-+++ b/arch/x86/xen/spinlock.c
-@@ -116,9 +116,26 @@ static inline void spin_time_accum_blocked(u64 start)
- }
- #endif  /* CONFIG_XEN_DEBUG_FS */
- 
-+/*
-+ * Size struct xen_spinlock so it's the same as arch_spinlock_t.
-+ */
-+#if NR_CPUS < 256
-+typedef u8 xen_spinners_t;
-+# define inc_spinners(xl) \
-+	asm(LOCK_PREFIX " incb %0" : "+m" ((xl)->spinners) : : "memory");
-+# define dec_spinners(xl) \
-+	asm(LOCK_PREFIX " decb %0" : "+m" ((xl)->spinners) : : "memory");
-+#else
-+typedef u16 xen_spinners_t;
-+# define inc_spinners(xl) \
-+	asm(LOCK_PREFIX " incw %0" : "+m" ((xl)->spinners) : : "memory");
-+# define dec_spinners(xl) \
-+	asm(LOCK_PREFIX " decw %0" : "+m" ((xl)->spinners) : : "memory");
-+#endif
-+
- struct xen_spinlock {
- 	unsigned char lock;		/* 0 -> free; 1 -> locked */
--	unsigned short spinners;	/* count of waiting cpus */
-+	xen_spinners_t spinners;	/* count of waiting cpus */
- };
- 
- static int xen_spin_is_locked(struct arch_spinlock *lock)
-@@ -164,8 +181,7 @@ static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
- 
- 	wmb();			/* set lock of interest before count */
- 
--	asm(LOCK_PREFIX " incw %0"
--	    : "+m" (xl->spinners) : : "memory");
-+	inc_spinners(xl);
- 
- 	return prev;
- }
-@@ -176,8 +192,7 @@ static inline struct xen_spinlock *spinning_lock(struct xen_spinlock *xl)
-  */
- static inline void unspinning_lock(struct xen_spinlock *xl, struct xen_spinlock *prev)
- {
--	asm(LOCK_PREFIX " decw %0"
--	    : "+m" (xl->spinners) : : "memory");
-+	dec_spinners(xl);
- 	wmb();			/* decrement count before restoring lock */
- 	__this_cpu_write(lock_spinners, prev);
- }
-@@ -373,6 +388,8 @@ void xen_uninit_lock_cpu(int cpu)
- 
- void __init xen_init_spinlocks(void)
- {
-+	BUILD_BUG_ON(sizeof(struct xen_spinlock) > sizeof(arch_spinlock_t));
-+
- 	pv_lock_ops.spin_is_locked = xen_spin_is_locked;
- 	pv_lock_ops.spin_is_contended = xen_spin_is_contended;
- 	pv_lock_ops.spin_lock = xen_spin_lock;
-diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
-index 9ed9f60..88f160b 100644
---- a/crypto/sha512_generic.c
-+++ b/crypto/sha512_generic.c
-@@ -21,8 +21,6 @@
- #include <linux/percpu.h>
- #include <asm/byteorder.h>
- 
--static DEFINE_PER_CPU(u64[80], msg_schedule);
--
- static inline u64 Ch(u64 x, u64 y, u64 z)
- {
-         return z ^ (x & (y ^ z));
-@@ -80,7 +78,7 @@ static inline void LOAD_OP(int I, u64 *W, const u8 *input)
- 
- static inline void BLEND_OP(int I, u64 *W)
- {
--	W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
-+	W[I % 16] += s1(W[(I-2) % 16]) + W[(I-7) % 16] + s0(W[(I-15) % 16]);
- }
- 
- static void
-@@ -89,38 +87,48 @@ sha512_transform(u64 *state, const u8 *input)
- 	u64 a, b, c, d, e, f, g, h, t1, t2;
- 
- 	int i;
--	u64 *W = get_cpu_var(msg_schedule);
-+	u64 W[16];
- 
- 	/* load the input */
-         for (i = 0; i < 16; i++)
-                 LOAD_OP(i, W, input);
- 
--        for (i = 16; i < 80; i++) {
--                BLEND_OP(i, W);
--        }
--
- 	/* load the state into our registers */
- 	a=state[0];   b=state[1];   c=state[2];   d=state[3];
- 	e=state[4];   f=state[5];   g=state[6];   h=state[7];
- 
--	/* now iterate */
--	for (i=0; i<80; i+=8) {
--		t1 = h + e1(e) + Ch(e,f,g) + sha512_K[i  ] + W[i  ];
--		t2 = e0(a) + Maj(a,b,c);    d+=t1;    h=t1+t2;
--		t1 = g + e1(d) + Ch(d,e,f) + sha512_K[i+1] + W[i+1];
--		t2 = e0(h) + Maj(h,a,b);    c+=t1;    g=t1+t2;
--		t1 = f + e1(c) + Ch(c,d,e) + sha512_K[i+2] + W[i+2];
--		t2 = e0(g) + Maj(g,h,a);    b+=t1;    f=t1+t2;
--		t1 = e + e1(b) + Ch(b,c,d) + sha512_K[i+3] + W[i+3];
--		t2 = e0(f) + Maj(f,g,h);    a+=t1;    e=t1+t2;
--		t1 = d + e1(a) + Ch(a,b,c) + sha512_K[i+4] + W[i+4];
--		t2 = e0(e) + Maj(e,f,g);    h+=t1;    d=t1+t2;
--		t1 = c + e1(h) + Ch(h,a,b) + sha512_K[i+5] + W[i+5];
--		t2 = e0(d) + Maj(d,e,f);    g+=t1;    c=t1+t2;
--		t1 = b + e1(g) + Ch(g,h,a) + sha512_K[i+6] + W[i+6];
--		t2 = e0(c) + Maj(c,d,e);    f+=t1;    b=t1+t2;
--		t1 = a + e1(f) + Ch(f,g,h) + sha512_K[i+7] + W[i+7];
--		t2 = e0(b) + Maj(b,c,d);    e+=t1;    a=t1+t2;
-+#define SHA512_0_15(i, a, b, c, d, e, f, g, h)			\
-+	t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[i];	\
-+	t2 = e0(a) + Maj(a, b, c);				\
-+	d += t1;						\
-+	h = t1 + t2
-+
-+#define SHA512_16_79(i, a, b, c, d, e, f, g, h)			\
-+	BLEND_OP(i, W);						\
-+	t1 = h + e1(e) + Ch(e, f, g) + sha512_K[i] + W[(i)%16];	\
-+	t2 = e0(a) + Maj(a, b, c);				\
-+	d += t1;						\
-+	h = t1 + t2
-+
-+	for (i = 0; i < 16; i += 8) {
-+		SHA512_0_15(i, a, b, c, d, e, f, g, h);
-+		SHA512_0_15(i + 1, h, a, b, c, d, e, f, g);
-+		SHA512_0_15(i + 2, g, h, a, b, c, d, e, f);
-+		SHA512_0_15(i + 3, f, g, h, a, b, c, d, e);
-+		SHA512_0_15(i + 4, e, f, g, h, a, b, c, d);
-+		SHA512_0_15(i + 5, d, e, f, g, h, a, b, c);
-+		SHA512_0_15(i + 6, c, d, e, f, g, h, a, b);
-+		SHA512_0_15(i + 7, b, c, d, e, f, g, h, a);
-+	}
-+	for (i = 16; i < 80; i += 8) {
-+		SHA512_16_79(i, a, b, c, d, e, f, g, h);
-+		SHA512_16_79(i + 1, h, a, b, c, d, e, f, g);
-+		SHA512_16_79(i + 2, g, h, a, b, c, d, e, f);
-+		SHA512_16_79(i + 3, f, g, h, a, b, c, d, e);
-+		SHA512_16_79(i + 4, e, f, g, h, a, b, c, d);
-+		SHA512_16_79(i + 5, d, e, f, g, h, a, b, c);
-+		SHA512_16_79(i + 6, c, d, e, f, g, h, a, b);
-+		SHA512_16_79(i + 7, b, c, d, e, f, g, h, a);
- 	}
- 
- 	state[0] += a; state[1] += b; state[2] += c; state[3] += d;
-@@ -128,8 +136,6 @@ sha512_transform(u64 *state, const u8 *input)
- 
- 	/* erase our data */
- 	a = b = c = d = e = f = g = h = t1 = t2 = 0;
--	memset(W, 0, sizeof(__get_cpu_var(msg_schedule)));
--	put_cpu_var(msg_schedule);
- }
- 
- static int
-diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
-index 3f4051a..c7e5282 100644
---- a/drivers/char/tpm/tpm_tis.c
-+++ b/drivers/char/tpm/tpm_tis.c
-@@ -432,6 +432,9 @@ static int probe_itpm(struct tpm_chip *chip)
- out:
- 	itpm = rem_itpm;
- 	tpm_tis_ready(chip);
-+	/* some TPMs need a break here otherwise they will not work
-+	 * correctly on the immediately subsequent command */
-+	msleep(chip->vendor.timeout_b);
- 	release_locality(chip, chip->vendor.locality, 0);
- 
- 	return rc;
-diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
-index 3f46772..ba23790 100644
---- a/drivers/gpu/drm/drm_auth.c
-+++ b/drivers/gpu/drm/drm_auth.c
-@@ -101,7 +101,7 @@ static int drm_add_magic(struct drm_master *master, struct drm_file *priv,
-  * Searches and unlinks the entry in drm_device::magiclist with the magic
-  * number hash key, while holding the drm_device::struct_mutex lock.
-  */
--static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
-+int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
- {
- 	struct drm_magic_entry *pt;
- 	struct drm_hash_item *hash;
-@@ -136,6 +136,8 @@ static int drm_remove_magic(struct drm_master *master, drm_magic_t magic)
-  * If there is a magic number in drm_file::magic then use it, otherwise
-  * searches an unique non-zero magic number and add it associating it with \p
-  * file_priv.
-+ * This ioctl needs protection by the drm_global_mutex, which protects
-+ * struct drm_file::magic and struct drm_magic_entry::priv.
-  */
- int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
- {
-@@ -173,6 +175,8 @@ int drm_getmagic(struct drm_device *dev, void *data, struct drm_file *file_priv)
-  * \return zero if authentication successed, or a negative number otherwise.
-  *
-  * Checks if \p file_priv is associated with the magic number passed in \arg.
-+ * This ioctl needs protection by the drm_global_mutex, which protects
-+ * struct drm_file::magic and struct drm_magic_entry::priv.
-  */
- int drm_authmagic(struct drm_device *dev, void *data,
- 		  struct drm_file *file_priv)
-diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index 4911e1d..828bf65 100644
---- a/drivers/gpu/drm/drm_fops.c
-+++ b/drivers/gpu/drm/drm_fops.c
-@@ -487,6 +487,11 @@ int drm_release(struct inode *inode, struct file *filp)
- 		  (long)old_encode_dev(file_priv->minor->device),
- 		  dev->open_count);
- 
-+	/* Release any auth tokens that might point to this file_priv,
-+	   (do that under the drm_global_mutex) */
-+	if (file_priv->magic)
-+		(void) drm_remove_magic(file_priv->master, file_priv->magic);
-+
- 	/* if the master has gone away we can't do anything with the lock */
- 	if (file_priv->minor->master)
- 		drm_master_release(dev, filp);
-diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
-index 7886e4f..43cbafe 100644
---- a/drivers/gpu/drm/i915/i915_suspend.c
-+++ b/drivers/gpu/drm/i915/i915_suspend.c
-@@ -822,7 +822,7 @@ int i915_save_state(struct drm_device *dev)
- 
- 	if (IS_IRONLAKE_M(dev))
- 		ironlake_disable_drps(dev);
--	if (IS_GEN6(dev))
-+	if (INTEL_INFO(dev)->gen >= 6)
- 		gen6_disable_rps(dev);
- 
- 	/* Cache mode state */
-@@ -881,7 +881,7 @@ int i915_restore_state(struct drm_device *dev)
- 		intel_init_emon(dev);
- 	}
- 
--	if (IS_GEN6(dev)) {
-+	if (INTEL_INFO(dev)->gen >= 6) {
- 		gen6_enable_rps(dev_priv);
- 		gen6_update_ring_freq(dev_priv);
- 	}
-diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
-index ca70e2f..30a9af9 100644
---- a/drivers/gpu/drm/i915/intel_ringbuffer.c
-+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
-@@ -631,6 +631,19 @@ render_ring_add_request(struct intel_ring_buffer *ring,
- }
- 
- static u32
-+gen6_ring_get_seqno(struct intel_ring_buffer *ring)
-+{
-+	struct drm_device *dev = ring->dev;
-+
-+	/* Workaround to force correct ordering between irq and seqno writes on
-+	 * ivb (and maybe also on snb) by reading from a CS register (like
-+	 * ACTHD) before reading the status page. */
-+	if (IS_GEN7(dev))
-+		intel_ring_get_active_head(ring);
-+	return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
-+}
-+
-+static u32
- ring_get_seqno(struct intel_ring_buffer *ring)
- {
- 	return intel_read_status_page(ring, I915_GEM_HWS_INDEX);
-@@ -795,6 +808,12 @@ gen6_ring_get_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag)
- 	if (!dev->irq_enabled)
- 	       return false;
- 
-+	/* It looks like we need to prevent the gt from suspending while waiting
-+	 * for an notifiy irq, otherwise irqs seem to get lost on at least the
-+	 * blt/bsd rings on ivb. */
-+	if (IS_GEN7(dev))
-+		gen6_gt_force_wake_get(dev_priv);
-+
- 	spin_lock(&ring->irq_lock);
- 	if (ring->irq_refcount++ == 0) {
- 		ring->irq_mask &= ~rflag;
-@@ -819,6 +838,9 @@ gen6_ring_put_irq(struct intel_ring_buffer *ring, u32 gflag, u32 rflag)
- 		ironlake_disable_irq(dev_priv, gflag);
- 	}
- 	spin_unlock(&ring->irq_lock);
-+
-+	if (IS_GEN7(dev))
-+		gen6_gt_force_wake_put(dev_priv);
- }
- 
- static bool
-@@ -1316,7 +1338,7 @@ static const struct intel_ring_buffer gen6_bsd_ring = {
- 	.write_tail		= gen6_bsd_ring_write_tail,
- 	.flush			= gen6_ring_flush,
- 	.add_request		= gen6_add_request,
--	.get_seqno		= ring_get_seqno,
-+	.get_seqno		= gen6_ring_get_seqno,
- 	.irq_get		= gen6_bsd_ring_get_irq,
- 	.irq_put		= gen6_bsd_ring_put_irq,
- 	.dispatch_execbuffer	= gen6_ring_dispatch_execbuffer,
-@@ -1451,7 +1473,7 @@ static const struct intel_ring_buffer gen6_blt_ring = {
- 	.write_tail		= ring_write_tail,
- 	.flush			= blt_ring_flush,
- 	.add_request		= gen6_add_request,
--	.get_seqno		= ring_get_seqno,
-+	.get_seqno		= gen6_ring_get_seqno,
- 	.irq_get		= blt_ring_get_irq,
- 	.irq_put		= blt_ring_put_irq,
- 	.dispatch_execbuffer	= gen6_ring_dispatch_execbuffer,
-@@ -1474,6 +1496,7 @@ int intel_init_render_ring_buffer(struct drm_device *dev)
- 		ring->flush = gen6_render_ring_flush;
- 		ring->irq_get = gen6_render_ring_get_irq;
- 		ring->irq_put = gen6_render_ring_put_irq;
-+		ring->get_seqno = gen6_ring_get_seqno;
- 	} else if (IS_GEN5(dev)) {
- 		ring->add_request = pc_render_add_request;
- 		ring->get_seqno = pc_render_get_seqno;
-diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
-index f7b9268..e334ec3 100644
---- a/drivers/gpu/drm/i915/intel_sdvo.c
-+++ b/drivers/gpu/drm/i915/intel_sdvo.c
-@@ -1066,15 +1066,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
- 
- 	/* Set the SDVO control regs. */
- 	if (INTEL_INFO(dev)->gen >= 4) {
--		sdvox = 0;
-+		/* The real mode polarity is set by the SDVO commands, using
-+		 * struct intel_sdvo_dtd. */
-+		sdvox = SDVO_VSYNC_ACTIVE_HIGH | SDVO_HSYNC_ACTIVE_HIGH;
- 		if (intel_sdvo->is_hdmi)
- 			sdvox |= intel_sdvo->color_range;
- 		if (INTEL_INFO(dev)->gen < 5)
- 			sdvox |= SDVO_BORDER_ENABLE;
--		if (adjusted_mode->flags & DRM_MODE_FLAG_PVSYNC)
--			sdvox |= SDVO_VSYNC_ACTIVE_HIGH;
--		if (adjusted_mode->flags & DRM_MODE_FLAG_PHSYNC)
--			sdvox |= SDVO_HSYNC_ACTIVE_HIGH;
- 	} else {
- 		sdvox = I915_READ(intel_sdvo->sdvo_reg);
- 		switch (intel_sdvo->sdvo_reg) {
-diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
-index 6fb335a..a71557c 100644
---- a/drivers/gpu/drm/radeon/atombios_dp.c
-+++ b/drivers/gpu/drm/radeon/atombios_dp.c
-@@ -549,8 +549,8 @@ bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector)
- 	return false;
- }
- 
--static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
--				     struct drm_connector *connector)
-+int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
-+			     struct drm_connector *connector)
- {
- 	struct drm_device *dev = encoder->dev;
- 	struct radeon_device *rdev = dev->dev_private;
-@@ -558,7 +558,7 @@ static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
- 	int panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
- 
- 	if (!ASIC_IS_DCE4(rdev))
--		return;
-+		return panel_mode;
- 
- 	if (radeon_connector_encoder_get_dp_bridge_encoder_id(connector) ==
- 	    ENCODER_OBJECT_ID_NUTMEG)
-@@ -572,14 +572,7 @@ static void radeon_dp_set_panel_mode(struct drm_encoder *encoder,
- 			panel_mode = DP_PANEL_MODE_INTERNAL_DP2_MODE;
- 	}
- 
--	atombios_dig_encoder_setup(encoder,
--				   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
--				   panel_mode);
--
--	if ((connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
--	    (panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
--		radeon_write_dpcd_reg(radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
--	}
-+	return panel_mode;
- }
- 
- void radeon_dp_set_link_config(struct drm_connector *connector,
-@@ -717,6 +710,8 @@ static void radeon_dp_set_tp(struct radeon_dp_link_train_info *dp_info, int tp)
- 
- static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
- {
-+	struct radeon_encoder *radeon_encoder = to_radeon_encoder(dp_info->encoder);
-+	struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
- 	u8 tmp;
- 
- 	/* power up the sink */
-@@ -732,7 +727,10 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
- 		radeon_write_dpcd_reg(dp_info->radeon_connector,
- 				      DP_DOWNSPREAD_CTRL, 0);
- 
--	radeon_dp_set_panel_mode(dp_info->encoder, dp_info->connector);
-+	if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
-+	    (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
-+		radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
-+	}
- 
- 	/* set the lane count on the sink */
- 	tmp = dp_info->dp_lane_count;
-diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
-index 39c04c1..0f8eb48 100644
---- a/drivers/gpu/drm/radeon/atombios_encoders.c
-+++ b/drivers/gpu/drm/radeon/atombios_encoders.c
-@@ -1352,7 +1352,8 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
- 	switch (mode) {
- 	case DRM_MODE_DPMS_ON:
- 		/* some early dce3.2 boards have a bug in their transmitter control table */
--		if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730))
-+		if ((rdev->family == CHIP_RV710) || (rdev->family == CHIP_RV730) ||
-+		    ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE, 0, 0);
- 		else
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_ENABLE_OUTPUT, 0, 0);
-@@ -1362,8 +1363,6 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
- 							     ATOM_TRANSMITTER_ACTION_POWER_ON);
- 				radeon_dig_connector->edp_on = true;
- 			}
--			if (ASIC_IS_DCE4(rdev))
--				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
- 			radeon_dp_link_train(encoder, connector);
- 			if (ASIC_IS_DCE4(rdev))
- 				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_ON, 0);
-@@ -1374,7 +1373,10 @@ radeon_atom_encoder_dpms_dig(struct drm_encoder *encoder, int mode)
- 	case DRM_MODE_DPMS_STANDBY:
- 	case DRM_MODE_DPMS_SUSPEND:
- 	case DRM_MODE_DPMS_OFF:
--		atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
-+		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev))
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
-+		else
-+			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE_OUTPUT, 0, 0);
- 		if (ENCODER_MODE_IS_DP(atombios_get_encoder_mode(encoder)) && connector) {
- 			if (ASIC_IS_DCE4(rdev))
- 				atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_DP_VIDEO_OFF, 0);
-@@ -1821,7 +1823,21 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
- 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
- 	case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
- 	case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
--		if (ASIC_IS_DCE4(rdev)) {
-+		if (ASIC_IS_DCE41(rdev) || ASIC_IS_DCE5(rdev)) {
-+			struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
-+			struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
-+
-+			if (!connector)
-+				dig->panel_mode = DP_PANEL_MODE_EXTERNAL_DP_MODE;
-+			else
-+				dig->panel_mode = radeon_dp_get_panel_mode(encoder, connector);
-+
-+			/* setup and enable the encoder */
-+			atombios_dig_encoder_setup(encoder, ATOM_ENCODER_CMD_SETUP, 0);
-+			atombios_dig_encoder_setup(encoder,
-+						   ATOM_ENCODER_CMD_SETUP_PANEL_MODE,
-+						   dig->panel_mode);
-+		} else if (ASIC_IS_DCE4(rdev)) {
- 			/* disable the transmitter */
- 			atombios_dig_transmitter_setup(encoder, ATOM_TRANSMITTER_ACTION_DISABLE, 0, 0);
- 			/* setup and enable the encoder */
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index 8f86aeb..e7ddb49 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -134,6 +134,12 @@ static bool radeon_msi_ok(struct radeon_device *rdev)
- 	/* Dell RS690 only seems to work with MSIs. */
- 	if ((rdev->pdev->device == 0x791f) &&
- 	    (rdev->pdev->subsystem_vendor == 0x1028) &&
-+	    (rdev->pdev->subsystem_device == 0x01fc))
-+		return true;
-+
-+	/* Dell RS690 only seems to work with MSIs. */
-+	if ((rdev->pdev->device == 0x791f) &&
-+	    (rdev->pdev->subsystem_vendor == 0x1028) &&
- 	    (rdev->pdev->subsystem_device == 0x01fd))
- 		return true;
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
-index 2c2e75e..8254d5a 100644
---- a/drivers/gpu/drm/radeon/radeon_mode.h
-+++ b/drivers/gpu/drm/radeon/radeon_mode.h
-@@ -362,6 +362,7 @@ struct radeon_encoder_atom_dig {
- 	struct backlight_device *bl_dev;
- 	int dpms_mode;
- 	uint8_t backlight_level;
-+	int panel_mode;
- };
- 
- struct radeon_encoder_atom_dac {
-@@ -482,6 +483,8 @@ extern void radeon_dp_link_train(struct drm_encoder *encoder,
- extern bool radeon_dp_needs_link_train(struct radeon_connector *radeon_connector);
- extern u8 radeon_dp_getsinktype(struct radeon_connector *radeon_connector);
- extern bool radeon_dp_getdpcd(struct radeon_connector *radeon_connector);
-+extern int radeon_dp_get_panel_mode(struct drm_encoder *encoder,
-+				    struct drm_connector *connector);
- extern void atombios_dig_encoder_setup(struct drm_encoder *encoder, int action, int panel_mode);
- extern void radeon_atom_encoder_init(struct radeon_device *rdev);
- extern void atombios_dig_transmitter_setup(struct drm_encoder *encoder,
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-index f94b33a..7c88f1f 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-@@ -378,7 +378,7 @@ int vmw_framebuffer_create_handle(struct drm_framebuffer *fb,
- 				  unsigned int *handle)
- {
- 	if (handle)
--		handle = 0;
-+		*handle = 0;
- 
- 	return 0;
- }
-diff --git a/drivers/hwmon/f71805f.c b/drivers/hwmon/f71805f.c
-index 92f9497..6dbfd3e 100644
---- a/drivers/hwmon/f71805f.c
-+++ b/drivers/hwmon/f71805f.c
-@@ -283,11 +283,11 @@ static inline long temp_from_reg(u8 reg)
- 
- static inline u8 temp_to_reg(long val)
- {
--	if (val < 0)
--		val = 0;
--	else if (val > 1000 * 0xff)
--		val = 0xff;
--	return ((val + 500) / 1000);
-+	if (val <= 0)
-+		return 0;
-+	if (val >= 1000 * 0xff)
-+		return 0xff;
-+	return (val + 500) / 1000;
- }
- 
- /*
-diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
-index fe4104c..5357925 100644
---- a/drivers/hwmon/sht15.c
-+++ b/drivers/hwmon/sht15.c
-@@ -883,7 +883,7 @@ static int sht15_invalidate_voltage(struct notifier_block *nb,
- 
- static int __devinit sht15_probe(struct platform_device *pdev)
- {
--	int ret = 0;
-+	int ret;
- 	struct sht15_data *data = kzalloc(sizeof(*data), GFP_KERNEL);
- 	u8 status = 0;
- 
-@@ -901,6 +901,7 @@ static int __devinit sht15_probe(struct platform_device *pdev)
- 	init_waitqueue_head(&data->wait_queue);
- 
- 	if (pdev->dev.platform_data == NULL) {
-+		ret = -EINVAL;
- 		dev_err(&pdev->dev, "no platform data supplied\n");
- 		goto err_free_data;
- 	}
-diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
-index 93f5fc7..4b57ab6 100644
---- a/drivers/hwmon/w83627ehf.c
-+++ b/drivers/hwmon/w83627ehf.c
-@@ -1319,6 +1319,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
- {
- 	struct w83627ehf_data *data = dev_get_drvdata(dev);
- 	struct sensor_device_attribute *sensor_attr = to_sensor_dev_attr(attr);
-+	struct w83627ehf_sio_data *sio_data = dev->platform_data;
- 	int nr = sensor_attr->index;
- 	unsigned long val;
- 	int err;
-@@ -1330,6 +1331,11 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr,
- 
- 	if (val > 1)
- 		return -EINVAL;
-+
-+	/* On NCT67766F, DC mode is only supported for pwm1 */
-+	if (sio_data->kind == nct6776 && nr && val != 1)
-+		return -EINVAL;
-+
- 	mutex_lock(&data->update_lock);
- 	reg = w83627ehf_read_value(data, W83627EHF_REG_PWM_ENABLE[nr]);
- 	data->pwm_mode[nr] = val;
-diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
-index 106b88a..30431d8 100644
---- a/drivers/net/bonding/bond_alb.c
-+++ b/drivers/net/bonding/bond_alb.c
-@@ -871,16 +871,12 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[])
- 	}
- }
- 
--/* hw is a boolean parameter that determines whether we should try and
-- * set the hw address of the device as well as the hw address of the
-- * net_device
-- */
--static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[], int hw)
-+static int alb_set_slave_mac_addr(struct slave *slave, u8 addr[])
- {
- 	struct net_device *dev = slave->dev;
- 	struct sockaddr s_addr;
- 
--	if (!hw) {
-+	if (slave->bond->params.mode == BOND_MODE_TLB) {
- 		memcpy(dev->dev_addr, addr, dev->addr_len);
- 		return 0;
- 	}
-@@ -910,8 +906,8 @@ static void alb_swap_mac_addr(struct bonding *bond, struct slave *slave1, struct
- 	u8 tmp_mac_addr[ETH_ALEN];
- 
- 	memcpy(tmp_mac_addr, slave1->dev->dev_addr, ETH_ALEN);
--	alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr, bond->alb_info.rlb_enabled);
--	alb_set_slave_mac_addr(slave2, tmp_mac_addr, bond->alb_info.rlb_enabled);
-+	alb_set_slave_mac_addr(slave1, slave2->dev->dev_addr);
-+	alb_set_slave_mac_addr(slave2, tmp_mac_addr);
- 
- }
- 
-@@ -1058,8 +1054,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
- 
- 		/* Try setting slave mac to bond address and fall-through
- 		   to code handling that situation below... */
--		alb_set_slave_mac_addr(slave, bond->dev->dev_addr,
--				       bond->alb_info.rlb_enabled);
-+		alb_set_slave_mac_addr(slave, bond->dev->dev_addr);
- 	}
- 
- 	/* The slave's address is equal to the address of the bond.
-@@ -1095,8 +1090,7 @@ static int alb_handle_addr_collision_on_attach(struct bonding *bond, struct slav
- 	}
- 
- 	if (free_mac_slave) {
--		alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr,
--				       bond->alb_info.rlb_enabled);
-+		alb_set_slave_mac_addr(slave, free_mac_slave->perm_hwaddr);
- 
- 		pr_warning("%s: Warning: the hw address of slave %s is in use by the bond; giving it the hw address of %s\n",
- 			   bond->dev->name, slave->dev->name,
-@@ -1451,8 +1445,7 @@ int bond_alb_init_slave(struct bonding *bond, struct slave *slave)
- {
- 	int res;
- 
--	res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr,
--				     bond->alb_info.rlb_enabled);
-+	res = alb_set_slave_mac_addr(slave, slave->perm_hwaddr);
- 	if (res) {
- 		return res;
- 	}
-@@ -1603,8 +1596,7 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
- 		alb_swap_mac_addr(bond, swap_slave, new_slave);
- 	} else {
- 		/* set the new_slave to the bond mac address */
--		alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr,
--				       bond->alb_info.rlb_enabled);
-+		alb_set_slave_mac_addr(new_slave, bond->dev->dev_addr);
- 	}
- 
- 	if (swap_slave) {
-@@ -1664,8 +1656,7 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
- 		alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
- 		alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
- 	} else {
--		alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
--				       bond->alb_info.rlb_enabled);
-+		alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr);
- 
- 		read_lock(&bond->lock);
- 		alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
-diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
-index 7413497..959d448 100644
---- a/drivers/net/macvlan.c
-+++ b/drivers/net/macvlan.c
-@@ -172,6 +172,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
- 		skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN);
- 		if (!skb)
- 			return RX_HANDLER_CONSUMED;
-+		eth = eth_hdr(skb);
- 		src = macvlan_hash_lookup(port, eth->h_source);
- 		if (!src)
- 			/* frame comes from an external address */
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-index 510e9bb..453f58e 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -8217,13 +8217,21 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
- 
- void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
- {
-+	int timeout = 20;
-+
- 	/* flush packet queue when requested */
- 	if (drop)
- 		brcmu_pktq_flush(&wlc->pkt_queue->q, false, NULL, NULL);
- 
- 	/* wait for queue and DMA fifos to run dry */
--	while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0)
-+	while (!pktq_empty(&wlc->pkt_queue->q) || brcms_txpktpendtot(wlc) > 0) {
- 		brcms_msleep(wlc->wl, 1);
-+
-+		if (--timeout == 0)
-+			break;
-+	}
-+
-+	WARN_ON_ONCE(timeout == 0);
- }
- 
- void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
-diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
-index 1920237..1daf01e 100644
---- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c
-@@ -957,11 +957,11 @@ void iwl_irq_tasklet(struct iwl_trans *trans)
- 	}
- #endif
- 
--	spin_unlock_irqrestore(&trans->shrd->lock, flags);
--
- 	/* saved interrupt in inta variable now we can reset trans_pcie->inta */
- 	trans_pcie->inta = 0;
- 
-+	spin_unlock_irqrestore(&trans->shrd->lock, flags);
-+
- 	/* Now service all interrupt bits discovered above. */
- 	if (inta & CSR_INT_BIT_HW_ERR) {
- 		IWL_ERR(trans, "Hardware error detected.  Restarting.\n");
-diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
-index 0794c72..b1ddfef 100644
---- a/drivers/scsi/mpt2sas/mpt2sas_base.c
-+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
-@@ -4033,7 +4033,8 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
- 		ioc->reply_free[i] = cpu_to_le32(reply_address);
- 
- 	/* initialize reply queues */
--	_base_assign_reply_queues(ioc);
-+	if (ioc->is_driver_loading)
-+		_base_assign_reply_queues(ioc);
- 
- 	/* initialize Reply Post Free Queue */
- 	reply_post_free = (long)ioc->reply_post_free;
-@@ -4081,24 +4082,17 @@ _base_make_ioc_operational(struct MPT2SAS_ADAPTER *ioc, int sleep_flag)
- 
- 
- 	if (ioc->is_driver_loading) {
--
--
--
--		ioc->wait_for_discovery_to_complete =
--		    _base_determine_wait_on_discovery(ioc);
--		return r; /* scan_start and scan_finished support */
--	}
--
--
--	if (ioc->wait_for_discovery_to_complete && ioc->is_warpdrive) {
--		if (ioc->manu_pg10.OEMIdentifier  == 0x80) {
-+		if (ioc->is_warpdrive && ioc->manu_pg10.OEMIdentifier
-+		    == 0x80) {
- 			hide_flag = (u8) (ioc->manu_pg10.OEMSpecificFlags0 &
- 			    MFG_PAGE10_HIDE_SSDS_MASK);
- 			if (hide_flag != MFG_PAGE10_HIDE_SSDS_MASK)
- 				ioc->mfg_pg10_hide_flag = hide_flag;
- 		}
-+		ioc->wait_for_discovery_to_complete =
-+		    _base_determine_wait_on_discovery(ioc);
-+		return r; /* scan_start and scan_finished support */
- 	}
--
- 	r = _base_send_port_enable(ioc, sleep_flag);
- 	if (r)
- 		return r;
-diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
-index 9bc6fb2..2824a90 100644
---- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
-+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
-@@ -8001,7 +8001,6 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 		goto out_attach_fail;
- 	}
- 
--	scsi_scan_host(shost);
- 	if (ioc->is_warpdrive) {
- 		if (ioc->mfg_pg10_hide_flag ==  MFG_PAGE10_EXPOSE_ALL_DISKS)
- 			ioc->hide_drives = 0;
-@@ -8015,8 +8014,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 		}
- 	} else
- 		ioc->hide_drives = 0;
-+	scsi_scan_host(shost);
- 
--	_scsih_probe_devices(ioc);
- 	return 0;
- 
-  out_attach_fail:
-diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
-index 00233af..8e00926 100644
---- a/drivers/tty/serial/amba-pl011.c
-+++ b/drivers/tty/serial/amba-pl011.c
-@@ -1740,9 +1740,19 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
- {
- 	struct uart_amba_port *uap = amba_ports[co->index];
- 	unsigned int status, old_cr, new_cr;
-+	unsigned long flags;
-+	int locked = 1;
- 
- 	clk_enable(uap->clk);
- 
-+	local_irq_save(flags);
-+	if (uap->port.sysrq)
-+		locked = 0;
-+	else if (oops_in_progress)
-+		locked = spin_trylock(&uap->port.lock);
-+	else
-+		spin_lock(&uap->port.lock);
-+
- 	/*
- 	 *	First save the CR then disable the interrupts
- 	 */
-@@ -1762,6 +1772,10 @@ pl011_console_write(struct console *co, const char *s, unsigned int count)
- 	} while (status & UART01x_FR_BUSY);
- 	writew(old_cr, uap->port.membase + UART011_CR);
- 
-+	if (locked)
-+		spin_unlock(&uap->port.lock);
-+	local_irq_restore(flags);
-+
- 	clk_disable(uap->clk);
- }
- 
-diff --git a/drivers/tty/serial/jsm/jsm_driver.c b/drivers/tty/serial/jsm/jsm_driver.c
-index 7c867a0..7545fe1 100644
---- a/drivers/tty/serial/jsm/jsm_driver.c
-+++ b/drivers/tty/serial/jsm/jsm_driver.c
-@@ -251,6 +251,7 @@ static void jsm_io_resume(struct pci_dev *pdev)
- 	struct jsm_board *brd = pci_get_drvdata(pdev);
- 
- 	pci_restore_state(pdev);
-+	pci_save_state(pdev);
- 
- 	jsm_uart_port_init(brd);
- }
-diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
-index ef9dd62..bf6e238 100644
---- a/drivers/tty/tty_port.c
-+++ b/drivers/tty/tty_port.c
-@@ -227,7 +227,6 @@ int tty_port_block_til_ready(struct tty_port *port,
- 	int do_clocal = 0, retval;
- 	unsigned long flags;
- 	DEFINE_WAIT(wait);
--	int cd;
- 
- 	/* block if port is in the process of being closed */
- 	if (tty_hung_up_p(filp) || port->flags & ASYNC_CLOSING) {
-@@ -284,11 +283,14 @@ int tty_port_block_til_ready(struct tty_port *port,
- 				retval = -ERESTARTSYS;
- 			break;
- 		}
--		/* Probe the carrier. For devices with no carrier detect this
--		   will always return true */
--		cd = tty_port_carrier_raised(port);
-+		/*
-+		 * Probe the carrier. For devices with no carrier detect
-+		 * tty_port_carrier_raised will always return true.
-+		 * Never ask drivers if CLOCAL is set, this causes troubles
-+		 * on some hardware.
-+		 */
- 		if (!(port->flags & ASYNC_CLOSING) &&
--				(do_clocal || cd))
-+				(do_clocal || tty_port_carrier_raised(port)))
- 			break;
- 		if (signal_pending(current)) {
- 			retval = -ERESTARTSYS;
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index efe6849..fd4aee1 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -57,6 +57,8 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
- 
- #define WDM_MAX			16
- 
-+/* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
-+#define WDM_DEFAULT_BUFSIZE	256
- 
- static DEFINE_MUTEX(wdm_mutex);
- 
-@@ -88,7 +90,8 @@ struct wdm_device {
- 	int			count;
- 	dma_addr_t		shandle;
- 	dma_addr_t		ihandle;
--	struct mutex		lock;
-+	struct mutex		wlock;
-+	struct mutex		rlock;
- 	wait_queue_head_t	wait;
- 	struct work_struct	rxwork;
- 	int			werr;
-@@ -323,7 +326,7 @@ static ssize_t wdm_write
- 	}
- 
- 	/* concurrent writes and disconnect */
--	r = mutex_lock_interruptible(&desc->lock);
-+	r = mutex_lock_interruptible(&desc->wlock);
- 	rv = -ERESTARTSYS;
- 	if (r) {
- 		kfree(buf);
-@@ -386,7 +389,7 @@ static ssize_t wdm_write
- out:
- 	usb_autopm_put_interface(desc->intf);
- outnp:
--	mutex_unlock(&desc->lock);
-+	mutex_unlock(&desc->wlock);
- outnl:
- 	return rv < 0 ? rv : count;
- }
-@@ -399,7 +402,7 @@ static ssize_t wdm_read
- 	struct wdm_device *desc = file->private_data;
- 
- 
--	rv = mutex_lock_interruptible(&desc->lock); /*concurrent reads */
-+	rv = mutex_lock_interruptible(&desc->rlock); /*concurrent reads */
- 	if (rv < 0)
- 		return -ERESTARTSYS;
- 
-@@ -467,14 +470,16 @@ retry:
- 	for (i = 0; i < desc->length - cntr; i++)
- 		desc->ubuf[i] = desc->ubuf[i + cntr];
- 
-+	spin_lock_irq(&desc->iuspin);
- 	desc->length -= cntr;
-+	spin_unlock_irq(&desc->iuspin);
- 	/* in case we had outstanding data */
- 	if (!desc->length)
- 		clear_bit(WDM_READ, &desc->flags);
- 	rv = cntr;
- 
- err:
--	mutex_unlock(&desc->lock);
-+	mutex_unlock(&desc->rlock);
- 	return rv;
- }
- 
-@@ -540,7 +545,8 @@ static int wdm_open(struct inode *inode, struct file *file)
- 	}
- 	intf->needs_remote_wakeup = 1;
- 
--	mutex_lock(&desc->lock);
-+	/* using write lock to protect desc->count */
-+	mutex_lock(&desc->wlock);
- 	if (!desc->count++) {
- 		desc->werr = 0;
- 		desc->rerr = 0;
-@@ -553,7 +559,7 @@ static int wdm_open(struct inode *inode, struct file *file)
- 	} else {
- 		rv = 0;
- 	}
--	mutex_unlock(&desc->lock);
-+	mutex_unlock(&desc->wlock);
- 	usb_autopm_put_interface(desc->intf);
- out:
- 	mutex_unlock(&wdm_mutex);
-@@ -565,9 +571,11 @@ static int wdm_release(struct inode *inode, struct file *file)
- 	struct wdm_device *desc = file->private_data;
- 
- 	mutex_lock(&wdm_mutex);
--	mutex_lock(&desc->lock);
-+
-+	/* using write lock to protect desc->count */
-+	mutex_lock(&desc->wlock);
- 	desc->count--;
--	mutex_unlock(&desc->lock);
-+	mutex_unlock(&desc->wlock);
- 
- 	if (!desc->count) {
- 		dev_dbg(&desc->intf->dev, "wdm_release: cleanup");
-@@ -630,7 +638,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
- 	struct usb_cdc_dmm_desc *dmhd;
- 	u8 *buffer = intf->altsetting->extra;
- 	int buflen = intf->altsetting->extralen;
--	u16 maxcom = 0;
-+	u16 maxcom = WDM_DEFAULT_BUFSIZE;
- 
- 	if (!buffer)
- 		goto out;
-@@ -665,7 +673,8 @@ next_desc:
- 	desc = kzalloc(sizeof(struct wdm_device), GFP_KERNEL);
- 	if (!desc)
- 		goto out;
--	mutex_init(&desc->lock);
-+	mutex_init(&desc->rlock);
-+	mutex_init(&desc->wlock);
- 	spin_lock_init(&desc->iuspin);
- 	init_waitqueue_head(&desc->wait);
- 	desc->wMaxCommand = maxcom;
-@@ -716,7 +725,7 @@ next_desc:
- 		goto err;
- 
- 	desc->inbuf = usb_alloc_coherent(interface_to_usbdev(intf),
--					 desc->bMaxPacketSize0,
-+					 desc->wMaxCommand,
- 					 GFP_KERNEL,
- 					 &desc->response->transfer_dma);
- 	if (!desc->inbuf)
-@@ -779,11 +788,13 @@ static void wdm_disconnect(struct usb_interface *intf)
- 	/* to terminate pending flushes */
- 	clear_bit(WDM_IN_USE, &desc->flags);
- 	spin_unlock_irqrestore(&desc->iuspin, flags);
--	mutex_lock(&desc->lock);
-+	wake_up_all(&desc->wait);
-+	mutex_lock(&desc->rlock);
-+	mutex_lock(&desc->wlock);
- 	kill_urbs(desc);
- 	cancel_work_sync(&desc->rxwork);
--	mutex_unlock(&desc->lock);
--	wake_up_all(&desc->wait);
-+	mutex_unlock(&desc->wlock);
-+	mutex_unlock(&desc->rlock);
- 	if (!desc->count)
- 		cleanup(desc);
- 	mutex_unlock(&wdm_mutex);
-@@ -798,8 +809,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
- 	dev_dbg(&desc->intf->dev, "wdm%d_suspend\n", intf->minor);
- 
- 	/* if this is an autosuspend the caller does the locking */
--	if (!PMSG_IS_AUTO(message))
--		mutex_lock(&desc->lock);
-+	if (!PMSG_IS_AUTO(message)) {
-+		mutex_lock(&desc->rlock);
-+		mutex_lock(&desc->wlock);
-+	}
- 	spin_lock_irq(&desc->iuspin);
- 
- 	if (PMSG_IS_AUTO(message) &&
-@@ -815,8 +828,10 @@ static int wdm_suspend(struct usb_interface *intf, pm_message_t message)
- 		kill_urbs(desc);
- 		cancel_work_sync(&desc->rxwork);
- 	}
--	if (!PMSG_IS_AUTO(message))
--		mutex_unlock(&desc->lock);
-+	if (!PMSG_IS_AUTO(message)) {
-+		mutex_unlock(&desc->wlock);
-+		mutex_unlock(&desc->rlock);
-+	}
- 
- 	return rv;
- }
-@@ -854,7 +869,8 @@ static int wdm_pre_reset(struct usb_interface *intf)
- {
- 	struct wdm_device *desc = usb_get_intfdata(intf);
- 
--	mutex_lock(&desc->lock);
-+	mutex_lock(&desc->rlock);
-+	mutex_lock(&desc->wlock);
- 	kill_urbs(desc);
- 
- 	/*
-@@ -876,7 +892,8 @@ static int wdm_post_reset(struct usb_interface *intf)
- 	int rv;
- 
- 	rv = recover_from_urb_loss(desc);
--	mutex_unlock(&desc->lock);
-+	mutex_unlock(&desc->wlock);
-+	mutex_unlock(&desc->rlock);
- 	return 0;
- }
- 
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 69a4e43..27bd50a 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -149,20 +149,14 @@ static int __dwc3_gadget_ep0_queue(struct dwc3_ep *dep,
- 
- 		direction = !!(dep->flags & DWC3_EP0_DIR_IN);
- 
--		if (dwc->ep0state == EP0_STATUS_PHASE) {
--			type = dwc->three_stage_setup
--				? DWC3_TRBCTL_CONTROL_STATUS3
--				: DWC3_TRBCTL_CONTROL_STATUS2;
--		} else if (dwc->ep0state == EP0_DATA_PHASE) {
--			type = DWC3_TRBCTL_CONTROL_DATA;
--		} else {
--			/* should never happen */
--			WARN_ON(1);
-+		if (dwc->ep0state != EP0_DATA_PHASE) {
-+			dev_WARN(dwc->dev, "Unexpected pending request\n");
- 			return 0;
- 		}
- 
- 		ret = dwc3_ep0_start_trans(dwc, direction,
--				req->request.dma, req->request.length, type);
-+				req->request.dma, req->request.length,
-+				DWC3_TRBCTL_CONTROL_DATA);
- 		dep->flags &= ~(DWC3_EP_PENDING_REQUEST |
- 				DWC3_EP0_DIR_IN);
- 	}
-diff --git a/drivers/usb/gadget/langwell_udc.c b/drivers/usb/gadget/langwell_udc.c
-index c9fa3bf..6ad0ad6 100644
---- a/drivers/usb/gadget/langwell_udc.c
-+++ b/drivers/usb/gadget/langwell_udc.c
-@@ -1522,8 +1522,7 @@ static void langwell_udc_stop(struct langwell_udc *dev)
- 
- 
- /* stop all USB activities */
--static void stop_activity(struct langwell_udc *dev,
--		struct usb_gadget_driver *driver)
-+static void stop_activity(struct langwell_udc *dev)
- {
- 	struct langwell_ep	*ep;
- 	dev_dbg(&dev->pdev->dev, "---> %s()\n", __func__);
-@@ -1535,9 +1534,9 @@ static void stop_activity(struct langwell_udc *dev,
- 	}
- 
- 	/* report disconnect; the driver is already quiesced */
--	if (driver) {
-+	if (dev->driver) {
- 		spin_unlock(&dev->lock);
--		driver->disconnect(&dev->gadget);
-+		dev->driver->disconnect(&dev->gadget);
- 		spin_lock(&dev->lock);
- 	}
- 
-@@ -1925,11 +1924,10 @@ static int langwell_stop(struct usb_gadget *g,
- 
- 	/* stop all usb activities */
- 	dev->gadget.speed = USB_SPEED_UNKNOWN;
--	stop_activity(dev, driver);
--	spin_unlock_irqrestore(&dev->lock, flags);
--
- 	dev->gadget.dev.driver = NULL;
- 	dev->driver = NULL;
-+	stop_activity(dev);
-+	spin_unlock_irqrestore(&dev->lock, flags);
- 
- 	device_remove_file(&dev->pdev->dev, &dev_attr_function);
- 
-@@ -2733,7 +2731,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
- 		dev->bus_reset = 1;
- 
- 		/* reset all the queues, stop all USB activities */
--		stop_activity(dev, dev->driver);
-+		stop_activity(dev);
- 		dev->usb_state = USB_STATE_DEFAULT;
- 	} else {
- 		dev_vdbg(&dev->pdev->dev, "device controller reset\n");
-@@ -2741,7 +2739,7 @@ static void handle_usb_reset(struct langwell_udc *dev)
- 		langwell_udc_reset(dev);
- 
- 		/* reset all the queues, stop all USB activities */
--		stop_activity(dev, dev->driver);
-+		stop_activity(dev);
- 
- 		/* reset ep0 dQH and endptctrl */
- 		ep0_reset(dev);
-@@ -3367,7 +3365,7 @@ static int langwell_udc_suspend(struct pci_dev *pdev, pm_message_t state)
- 
- 	spin_lock_irq(&dev->lock);
- 	/* stop all usb activities */
--	stop_activity(dev, dev->driver);
-+	stop_activity(dev);
- 	spin_unlock_irq(&dev->lock);
- 
- 	/* free dTD dma_pool and dQH */
-diff --git a/drivers/usb/gadget/storage_common.c b/drivers/usb/gadget/storage_common.c
-index c7f291a..85ea14e 100644
---- a/drivers/usb/gadget/storage_common.c
-+++ b/drivers/usb/gadget/storage_common.c
-@@ -598,16 +598,16 @@ static __maybe_unused struct usb_ss_cap_descriptor fsg_ss_cap_desc = {
- 		| USB_5GBPS_OPERATION),
- 	.bFunctionalitySupport = USB_LOW_SPEED_OPERATION,
- 	.bU1devExitLat =	USB_DEFAULT_U1_DEV_EXIT_LAT,
--	.bU2DevExitLat =	USB_DEFAULT_U2_DEV_EXIT_LAT,
-+	.bU2DevExitLat =	cpu_to_le16(USB_DEFAULT_U2_DEV_EXIT_LAT),
- };
- 
- static __maybe_unused struct usb_bos_descriptor fsg_bos_desc = {
- 	.bLength =		USB_DT_BOS_SIZE,
- 	.bDescriptorType =	USB_DT_BOS,
- 
--	.wTotalLength =		USB_DT_BOS_SIZE
-+	.wTotalLength =		cpu_to_le16(USB_DT_BOS_SIZE
- 				+ USB_DT_USB_EXT_CAP_SIZE
--				+ USB_DT_USB_SS_CAP_SIZE,
-+				+ USB_DT_USB_SS_CAP_SIZE),
- 
- 	.bNumDeviceCaps =	2,
- };
-diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
-index e90344a..b556a72 100644
---- a/drivers/usb/host/ehci-fsl.c
-+++ b/drivers/usb/host/ehci-fsl.c
-@@ -125,7 +125,7 @@ static int usb_hcd_fsl_probe(const struct hc_driver *driver,
- 	 */
- 	if (pdata->init && pdata->init(pdev)) {
- 		retval = -ENODEV;
--		goto err3;
-+		goto err4;
- 	}
- 
- 	/* Enable USB controller, 83xx or 8536 */
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index d28c586..ae92dc4 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -1215,6 +1215,7 @@ static void handle_vendor_event(struct xhci_hcd *xhci,
-  *
-  * Returns a zero-based port number, which is suitable for indexing into each of
-  * the split roothubs' port arrays and bus state arrays.
-+ * Add one to it in order to call xhci_find_slot_id_by_port.
-  */
- static unsigned int find_faked_portnum_from_hw_portnum(struct usb_hcd *hcd,
- 		struct xhci_hcd *xhci, u32 port_id)
-@@ -1335,7 +1336,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
- 			xhci_set_link_state(xhci, port_array, faked_port_index,
- 						XDEV_U0);
- 			slot_id = xhci_find_slot_id_by_port(hcd, xhci,
--					faked_port_index);
-+					faked_port_index + 1);
- 			if (!slot_id) {
- 				xhci_dbg(xhci, "slot_id is zero\n");
- 				goto cleanup;
-@@ -3372,7 +3373,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
- 		/* Check TD length */
- 		if (running_total != td_len) {
- 			xhci_err(xhci, "ISOC TD length unmatch\n");
--			return -EINVAL;
-+			ret = -EINVAL;
-+			goto cleanup;
- 		}
- 	}
- 
-diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
-index 417b8f2..59689fa 100644
---- a/drivers/usb/misc/usbsevseg.c
-+++ b/drivers/usb/misc/usbsevseg.c
-@@ -24,7 +24,7 @@
- 
- #define VENDOR_ID	0x0fc5
- #define PRODUCT_ID	0x1227
--#define MAXLEN		6
-+#define MAXLEN		8
- 
- /* table of devices that work with this driver */
- static const struct usb_device_id id_table[] = {
-diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
-index f9a3f62..7c569f5 100644
---- a/drivers/usb/musb/davinci.c
-+++ b/drivers/usb/musb/davinci.c
-@@ -33,9 +33,6 @@
- #include <linux/platform_device.h>
- #include <linux/dma-mapping.h>
- 
--#include <mach/hardware.h>
--#include <mach/memory.h>
--#include <asm/gpio.h>
- #include <mach/cputype.h>
- 
- #include <asm/mach-types.h>
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index a1a324b..a515237 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -39,6 +39,8 @@ static void cp210x_get_termios(struct tty_struct *,
- 	struct usb_serial_port *port);
- static void cp210x_get_termios_port(struct usb_serial_port *port,
- 	unsigned int *cflagp, unsigned int *baudp);
-+static void cp210x_change_speed(struct tty_struct *, struct usb_serial_port *,
-+							struct ktermios *);
- static void cp210x_set_termios(struct tty_struct *, struct usb_serial_port *,
- 							struct ktermios*);
- static int cp210x_tiocmget(struct tty_struct *);
-@@ -138,6 +140,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
- 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
- 	{ USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
-+	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- 	{ USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
- 	{ } /* Terminating Entry */
- };
-@@ -201,6 +204,8 @@ static struct usb_serial_driver cp210x_device = {
- #define CP210X_EMBED_EVENTS	0x15
- #define CP210X_GET_EVENTSTATE	0x16
- #define CP210X_SET_CHARS	0x19
-+#define CP210X_GET_BAUDRATE	0x1D
-+#define CP210X_SET_BAUDRATE	0x1E
- 
- /* CP210X_IFC_ENABLE */
- #define UART_ENABLE		0x0001
-@@ -354,8 +359,8 @@ static inline int cp210x_set_config_single(struct usb_serial_port *port,
-  * Quantises the baud rate as per AN205 Table 1
-  */
- static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
--	if      (baud <= 56)       baud = 0;
--	else if (baud <= 300)      baud = 300;
-+	if (baud <= 300)
-+		baud = 300;
- 	else if (baud <= 600)      baud = 600;
- 	else if (baud <= 1200)     baud = 1200;
- 	else if (baud <= 1800)     baud = 1800;
-@@ -383,17 +388,15 @@ static unsigned int cp210x_quantise_baudrate(unsigned int baud) {
- 	else if (baud <= 491520)   baud = 460800;
- 	else if (baud <= 567138)   baud = 500000;
- 	else if (baud <= 670254)   baud = 576000;
--	else if (baud <= 1053257)  baud = 921600;
--	else if (baud <= 1474560)  baud = 1228800;
--	else if (baud <= 2457600)  baud = 1843200;
--	else                       baud = 3686400;
-+	else if (baud < 1000000)
-+		baud = 921600;
-+	else if (baud > 2000000)
-+		baud = 2000000;
- 	return baud;
- }
- 
- static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
- {
--	int result;
--
- 	dbg("%s - port %d", __func__, port->number);
- 
- 	if (cp210x_set_config_single(port, CP210X_IFC_ENABLE, UART_ENABLE)) {
-@@ -402,13 +405,14 @@ static int cp210x_open(struct tty_struct *tty, struct usb_serial_port *port)
- 		return -EPROTO;
- 	}
- 
--	result = usb_serial_generic_open(tty, port);
--	if (result)
--		return result;
--
- 	/* Configure the termios structure */
- 	cp210x_get_termios(tty, port);
--	return 0;
-+
-+	/* The baud rate must be initialised on cp2104 */
-+	if (tty)
-+		cp210x_change_speed(tty, port, NULL);
-+
-+	return usb_serial_generic_open(tty, port);
- }
- 
- static void cp210x_close(struct usb_serial_port *port)
-@@ -460,10 +464,7 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
- 
- 	dbg("%s - port %d", __func__, port->number);
- 
--	cp210x_get_config(port, CP210X_GET_BAUDDIV, &baud, 2);
--	/* Convert to baudrate */
--	if (baud)
--		baud = cp210x_quantise_baudrate((BAUD_RATE_GEN_FREQ + baud/2)/ baud);
-+	cp210x_get_config(port, CP210X_GET_BAUDRATE, &baud, 4);
- 
- 	dbg("%s - baud rate = %d", __func__, baud);
- 	*baudp = baud;
-@@ -577,11 +578,64 @@ static void cp210x_get_termios_port(struct usb_serial_port *port,
- 	*cflagp = cflag;
- }
- 
-+/*
-+ * CP2101 supports the following baud rates:
-+ *
-+ *	300, 600, 1200, 1800, 2400, 4800, 7200, 9600, 14400, 19200, 28800,
-+ *	38400, 56000, 57600, 115200, 128000, 230400, 460800, 921600
-+ *
-+ * CP2102 and CP2103 support the following additional rates:
-+ *
-+ *	4000, 16000, 51200, 64000, 76800, 153600, 250000, 256000, 500000,
-+ *	576000
-+ *
-+ * The device will map a requested rate to a supported one, but the result
-+ * of requests for rates greater than 1053257 is undefined (see AN205).
-+ *
-+ * CP2104, CP2105 and CP2110 support most rates up to 2M, 921k and 1M baud,
-+ * respectively, with an error less than 1%. The actual rates are determined
-+ * by
-+ *
-+ *	div = round(freq / (2 x prescale x request))
-+ *	actual = freq / (2 x prescale x div)
-+ *
-+ * For CP2104 and CP2105 freq is 48Mhz and prescale is 4 for request <= 365bps
-+ * or 1 otherwise.
-+ * For CP2110 freq is 24Mhz and prescale is 4 for request <= 300bps or 1
-+ * otherwise.
-+ */
-+static void cp210x_change_speed(struct tty_struct *tty,
-+		struct usb_serial_port *port, struct ktermios *old_termios)
-+{
-+	u32 baud;
-+
-+	baud = tty->termios->c_ospeed;
-+
-+	/* This maps the requested rate to a rate valid on cp2102 or cp2103,
-+	 * or to an arbitrary rate in [1M,2M].
-+	 *
-+	 * NOTE: B0 is not implemented.
-+	 */
-+	baud = cp210x_quantise_baudrate(baud);
-+
-+	dbg("%s - setting baud rate to %u", __func__, baud);
-+	if (cp210x_set_config(port, CP210X_SET_BAUDRATE, &baud,
-+							sizeof(baud))) {
-+		dev_warn(&port->dev, "failed to set baud rate to %u\n", baud);
-+		if (old_termios)
-+			baud = old_termios->c_ospeed;
-+		else
-+			baud = 9600;
-+	}
-+
-+	tty_encode_baud_rate(tty, baud, baud);
-+}
-+
- static void cp210x_set_termios(struct tty_struct *tty,
- 		struct usb_serial_port *port, struct ktermios *old_termios)
- {
- 	unsigned int cflag, old_cflag;
--	unsigned int baud = 0, bits;
-+	unsigned int bits;
- 	unsigned int modem_ctl[4];
- 
- 	dbg("%s - port %d", __func__, port->number);
-@@ -592,20 +646,9 @@ static void cp210x_set_termios(struct tty_struct *tty,
- 	tty->termios->c_cflag &= ~CMSPAR;
- 	cflag = tty->termios->c_cflag;
- 	old_cflag = old_termios->c_cflag;
--	baud = cp210x_quantise_baudrate(tty_get_baud_rate(tty));
--
--	/* If the baud rate is to be updated*/
--	if (baud != tty_termios_baud_rate(old_termios) && baud != 0) {
--		dbg("%s - Setting baud rate to %d baud", __func__,
--				baud);
--		if (cp210x_set_config_single(port, CP210X_SET_BAUDDIV,
--					((BAUD_RATE_GEN_FREQ + baud/2) / baud))) {
--			dbg("Baud rate requested not supported by device");
--			baud = tty_termios_baud_rate(old_termios);
--		}
--	}
--	/* Report back the resulting baud rate */
--	tty_encode_baud_rate(tty, baud, baud);
-+
-+	if (tty->termios->c_ospeed != old_termios->c_ospeed)
-+		cp210x_change_speed(tty, port, old_termios);
- 
- 	/* If the number of data bits is to be updated */
- 	if ((cflag & CSIZE) != (old_cflag & CSIZE)) {
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index ff3db5d..058b92c 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -797,6 +797,7 @@ static struct usb_device_id id_table_combined [] = {
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(ADI_VID, ADI_GNICEPLUS_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(HORNBY_VID, HORNBY_ELITE_PID) },
- 	{ USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
- 	{ USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-@@ -805,6 +806,8 @@ static struct usb_device_id id_table_combined [] = {
- 	{ USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
- 	{ USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
-+	{ USB_DEVICE(FTDI_VID, TI_XDS100V2_PID),
-+		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(FTDI_VID, HAMEG_HO820_PID) },
- 	{ USB_DEVICE(FTDI_VID, HAMEG_HO720_PID) },
- 	{ USB_DEVICE(FTDI_VID, HAMEG_HO730_PID) },
-@@ -841,6 +844,7 @@ static struct usb_device_id id_table_combined [] = {
- 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
- 	{ USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
- 		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
-+	{ USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
- 	{ },					/* Optional parameter entry */
- 	{ }					/* Terminating entry */
- };
-@@ -1333,8 +1337,7 @@ static int set_serial_info(struct tty_struct *tty,
- 		goto check_and_exit;
- 	}
- 
--	if ((new_serial.baud_base != priv->baud_base) &&
--	    (new_serial.baud_base < 9600)) {
-+	if (new_serial.baud_base != priv->baud_base) {
- 		mutex_unlock(&priv->cfg_lock);
- 		return -EINVAL;
- 	}
-@@ -1824,6 +1827,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
- 
- static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
- {
-+	struct ktermios dummy;
- 	struct usb_device *dev = port->serial->dev;
- 	struct ftdi_private *priv = usb_get_serial_port_data(port);
- 	int result;
-@@ -1842,8 +1846,10 @@ static int ftdi_open(struct tty_struct *tty, struct usb_serial_port *port)
- 	   This is same behaviour as serial.c/rs_open() - Kuba */
- 
- 	/* ftdi_set_termios  will send usb control messages */
--	if (tty)
--		ftdi_set_termios(tty, port, tty->termios);
-+	if (tty) {
-+		memset(&dummy, 0, sizeof(dummy));
-+		ftdi_set_termios(tty, port, &dummy);
-+	}
- 
- 	/* Start reading from the device */
- 	result = usb_serial_generic_open(tty, port);
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index 055b64e..76d4f31 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -39,6 +39,13 @@
- /* www.candapter.com Ewert Energy Systems CANdapter device */
- #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
- 
-+/*
-+ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
-+ * http://processors.wiki.ti.com/index.php/XDS100
-+ * http://beagleboard.org/bone
-+ */
-+#define TI_XDS100V2_PID		0xa6d0
-+
- #define FTDI_NXTCAM_PID		0xABB8 /* NXTCam for Mindstorms NXT */
- 
- /* US Interface Navigator (http://www.usinterface.com/) */
-@@ -525,6 +532,12 @@
- #define ADI_GNICEPLUS_PID	0xF001
- 
- /*
-+ * Hornby Elite
-+ */
-+#define HORNBY_VID		0x04D8
-+#define HORNBY_ELITE_PID	0x000A
-+
-+/*
-  * RATOC REX-USB60F
-  */
- #define RATOC_VENDOR_ID		0x0584
-@@ -1168,3 +1181,9 @@
-  */
- /* TagTracer MIFARE*/
- #define FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID	0xF7C0
-+
-+/*
-+ * Rainforest Automation
-+ */
-+/* ZigBee controller */
-+#define FTDI_RF_R106		0x8A28
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index 0aac00a..8a90d58 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -2677,15 +2677,7 @@ cleanup:
- 
- static void edge_disconnect(struct usb_serial *serial)
- {
--	int i;
--	struct edgeport_port *edge_port;
--
- 	dbg("%s", __func__);
--
--	for (i = 0; i < serial->num_ports; ++i) {
--		edge_port = usb_get_serial_port_data(serial->port[i]);
--		edge_remove_sysfs_attrs(edge_port->port);
--	}
- }
- 
- static void edge_release(struct usb_serial *serial)
-@@ -2764,6 +2756,7 @@ static struct usb_serial_driver edgeport_1port_device = {
- 	.disconnect		= edge_disconnect,
- 	.release		= edge_release,
- 	.port_probe		= edge_create_sysfs_attrs,
-+	.port_remove		= edge_remove_sysfs_attrs,
- 	.ioctl			= edge_ioctl,
- 	.set_termios		= edge_set_termios,
- 	.tiocmget		= edge_tiocmget,
-@@ -2795,6 +2788,7 @@ static struct usb_serial_driver edgeport_2port_device = {
- 	.disconnect		= edge_disconnect,
- 	.release		= edge_release,
- 	.port_probe		= edge_create_sysfs_attrs,
-+	.port_remove		= edge_remove_sysfs_attrs,
- 	.ioctl			= edge_ioctl,
- 	.set_termios		= edge_set_termios,
- 	.tiocmget		= edge_tiocmget,
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index c96b6b6..2a9ed6e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -480,6 +480,10 @@ static void option_instat_callback(struct urb *urb);
- #define ZD_VENDOR_ID				0x0685
- #define ZD_PRODUCT_7000				0x7000
- 
-+/* LG products */
-+#define LG_VENDOR_ID				0x1004
-+#define LG_PRODUCT_L02C				0x618f
-+
- /* some devices interfaces need special handling due to a number of reasons */
- enum option_blacklist_reason {
- 		OPTION_BLACKLIST_NONE = 0,
-@@ -1183,6 +1187,7 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CLU526) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(VIETTEL_VENDOR_ID, VIETTEL_PRODUCT_VT1000, 0xff, 0xff, 0xff) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(ZD_VENDOR_ID, ZD_PRODUCT_7000, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE(LG_VENDOR_ID, LG_PRODUCT_L02C) }, /* docomo L-02C modem */
- 	{ } /* Terminating entry */
- };
- MODULE_DEVICE_TABLE(usb, option_ids);
-diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
-index 30b73e6..a348198 100644
---- a/drivers/usb/serial/qcaux.c
-+++ b/drivers/usb/serial/qcaux.c
-@@ -36,6 +36,7 @@
- #define UTSTARCOM_PRODUCT_UM175_V1		0x3712
- #define UTSTARCOM_PRODUCT_UM175_V2		0x3714
- #define UTSTARCOM_PRODUCT_UM175_ALLTEL		0x3715
-+#define PANTECH_PRODUCT_UML190_VZW		0x3716
- #define PANTECH_PRODUCT_UML290_VZW		0x3718
- 
- /* CMOTECH devices */
-@@ -67,7 +68,11 @@ static struct usb_device_id id_table[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_U520, 0xff, 0x00, 0x00) },
--	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xff, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML190_VZW, 0xff, 0xfe, 0xff) },
-+	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfd, 0xff) },  /* NMEA */
-+	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xfe, 0xff) },  /* WMC */
-+	{ USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, PANTECH_PRODUCT_UML290_VZW, 0xff, 0xff, 0xff) },  /* DIAG */
- 	{ },
- };
- MODULE_DEVICE_TABLE(usb, id_table);
-diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
-index 0ce5f79..32c93d7 100644
---- a/drivers/usb/storage/realtek_cr.c
-+++ b/drivers/usb/storage/realtek_cr.c
-@@ -791,7 +791,7 @@ static void rts51x_suspend_timer_fn(unsigned long data)
- 			rts51x_set_stat(chip, RTS51X_STAT_SS);
- 			/* ignore mass storage interface's children */
- 			pm_suspend_ignore_children(&us->pusb_intf->dev, true);
--			usb_autopm_put_interface(us->pusb_intf);
-+			usb_autopm_put_interface_async(us->pusb_intf);
- 			US_DEBUGP("%s: RTS51X_STAT_SS 01,"
- 				"intf->pm_usage_cnt:%d, power.usage:%d\n",
- 				__func__,
-diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
-index 2a83425..68b19ab 100644
---- a/fs/ecryptfs/crypto.c
-+++ b/fs/ecryptfs/crypto.c
-@@ -417,17 +417,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
- 			(unsigned long long)(extent_base + extent_offset), rc);
- 		goto out;
- 	}
--	if (unlikely(ecryptfs_verbosity > 0)) {
--		ecryptfs_printk(KERN_DEBUG, "Encrypting extent "
--				"with iv:\n");
--		ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
--		ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
--				"encryption:\n");
--		ecryptfs_dump_hex((char *)
--				  (page_address(page)
--				   + (extent_offset * crypt_stat->extent_size)),
--				  8);
--	}
- 	rc = ecryptfs_encrypt_page_offset(crypt_stat, enc_extent_page, 0,
- 					  page, (extent_offset
- 						 * crypt_stat->extent_size),
-@@ -440,14 +429,6 @@ static int ecryptfs_encrypt_extent(struct page *enc_extent_page,
- 		goto out;
- 	}
- 	rc = 0;
--	if (unlikely(ecryptfs_verbosity > 0)) {
--		ecryptfs_printk(KERN_DEBUG, "Encrypt extent [0x%.16llx]; "
--			"rc = [%d]\n",
--			(unsigned long long)(extent_base + extent_offset), rc);
--		ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
--				"encryption:\n");
--		ecryptfs_dump_hex((char *)(page_address(enc_extent_page)), 8);
--	}
- out:
- 	return rc;
- }
-@@ -543,17 +524,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
- 			(unsigned long long)(extent_base + extent_offset), rc);
- 		goto out;
- 	}
--	if (unlikely(ecryptfs_verbosity > 0)) {
--		ecryptfs_printk(KERN_DEBUG, "Decrypting extent "
--				"with iv:\n");
--		ecryptfs_dump_hex(extent_iv, crypt_stat->iv_bytes);
--		ecryptfs_printk(KERN_DEBUG, "First 8 bytes before "
--				"decryption:\n");
--		ecryptfs_dump_hex((char *)
--				  (page_address(enc_extent_page)
--				   + (extent_offset * crypt_stat->extent_size)),
--				  8);
--	}
- 	rc = ecryptfs_decrypt_page_offset(crypt_stat, page,
- 					  (extent_offset
- 					   * crypt_stat->extent_size),
-@@ -567,16 +537,6 @@ static int ecryptfs_decrypt_extent(struct page *page,
- 		goto out;
- 	}
- 	rc = 0;
--	if (unlikely(ecryptfs_verbosity > 0)) {
--		ecryptfs_printk(KERN_DEBUG, "Decrypt extent [0x%.16llx]; "
--			"rc = [%d]\n",
--			(unsigned long long)(extent_base + extent_offset), rc);
--		ecryptfs_printk(KERN_DEBUG, "First 8 bytes after "
--				"decryption:\n");
--		ecryptfs_dump_hex((char *)(page_address(page)
--					   + (extent_offset
--					      * crypt_stat->extent_size)), 8);
--	}
- out:
- 	return rc;
- }
-@@ -1620,7 +1580,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
- 		rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
- 		if (rc) {
- 			printk(KERN_DEBUG "Valid eCryptfs headers not found in "
--			       "file header region or xattr region\n");
-+			       "file header region or xattr region, inode %lu\n",
-+				ecryptfs_inode->i_ino);
- 			rc = -EINVAL;
- 			goto out;
- 		}
-@@ -1629,7 +1590,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
- 						ECRYPTFS_DONT_VALIDATE_HEADER_SIZE);
- 		if (rc) {
- 			printk(KERN_DEBUG "Valid eCryptfs headers not found in "
--			       "file xattr region either\n");
-+			       "file xattr region either, inode %lu\n",
-+				ecryptfs_inode->i_ino);
- 			rc = -EINVAL;
- 		}
- 		if (crypt_stat->mount_crypt_stat->flags
-@@ -1640,7 +1602,8 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
- 			       "crypto metadata only in the extended attribute "
- 			       "region, but eCryptfs was mounted without "
- 			       "xattr support enabled. eCryptfs will not treat "
--			       "this like an encrypted file.\n");
-+			       "this like an encrypted file, inode %lu\n",
-+				ecryptfs_inode->i_ino);
- 			rc = -EINVAL;
- 		}
- 	}
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index 32f90a3..d2039ca 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -841,18 +841,6 @@ static int truncate_upper(struct dentry *dentry, struct iattr *ia,
- 		size_t num_zeros = (PAGE_CACHE_SIZE
- 				    - (ia->ia_size & ~PAGE_CACHE_MASK));
- 
--
--		/*
--		 * XXX(truncate) this should really happen at the begginning
--		 * of ->setattr.  But the code is too messy to that as part
--		 * of a larger patch.  ecryptfs is also totally missing out
--		 * on the inode_change_ok check at the beginning of
--		 * ->setattr while would include this.
--		 */
--		rc = inode_newsize_ok(inode, ia->ia_size);
--		if (rc)
--			goto out;
--
- 		if (!(crypt_stat->flags & ECRYPTFS_ENCRYPTED)) {
- 			truncate_setsize(inode, ia->ia_size);
- 			lower_ia->ia_size = ia->ia_size;
-@@ -902,6 +890,28 @@ out:
- 	return rc;
- }
- 
-+static int ecryptfs_inode_newsize_ok(struct inode *inode, loff_t offset)
-+{
-+	struct ecryptfs_crypt_stat *crypt_stat;
-+	loff_t lower_oldsize, lower_newsize;
-+
-+	crypt_stat = &ecryptfs_inode_to_private(inode)->crypt_stat;
-+	lower_oldsize = upper_size_to_lower_size(crypt_stat,
-+						 i_size_read(inode));
-+	lower_newsize = upper_size_to_lower_size(crypt_stat, offset);
-+	if (lower_newsize > lower_oldsize) {
-+		/*
-+		 * The eCryptfs inode and the new *lower* size are mixed here
-+		 * because we may not have the lower i_mutex held and/or it may
-+		 * not be appropriate to call inode_newsize_ok() with inodes
-+		 * from other filesystems.
-+		 */
-+		return inode_newsize_ok(inode, lower_newsize);
-+	}
-+
-+	return 0;
-+}
-+
- /**
-  * ecryptfs_truncate
-  * @dentry: The ecryptfs layer dentry
-@@ -918,6 +928,10 @@ int ecryptfs_truncate(struct dentry *dentry, loff_t new_length)
- 	struct iattr lower_ia = { .ia_valid = 0 };
- 	int rc;
- 
-+	rc = ecryptfs_inode_newsize_ok(dentry->d_inode, new_length);
-+	if (rc)
-+		return rc;
-+
- 	rc = truncate_upper(dentry, &ia, &lower_ia);
- 	if (!rc && lower_ia.ia_valid & ATTR_SIZE) {
- 		struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
-@@ -997,6 +1011,16 @@ static int ecryptfs_setattr(struct dentry *dentry, struct iattr *ia)
- 		}
- 	}
- 	mutex_unlock(&crypt_stat->cs_mutex);
-+
-+	rc = inode_change_ok(inode, ia);
-+	if (rc)
-+		goto out;
-+	if (ia->ia_valid & ATTR_SIZE) {
-+		rc = ecryptfs_inode_newsize_ok(inode, ia->ia_size);
-+		if (rc)
-+			goto out;
-+	}
-+
- 	if (S_ISREG(inode->i_mode)) {
- 		rc = filemap_write_and_wait(inode->i_mapping);
- 		if (rc)
-diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
-index 940a82e..0dc5a3d 100644
---- a/fs/ecryptfs/miscdev.c
-+++ b/fs/ecryptfs/miscdev.c
-@@ -409,11 +409,47 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
- 	ssize_t sz = 0;
- 	char *data;
- 	uid_t euid = current_euid();
-+	unsigned char packet_size_peek[3];
- 	int rc;
- 
--	if (count == 0)
-+	if (count == 0) {
- 		goto out;
-+	} else if (count == (1 + 4)) {
-+		/* Likely a harmless MSG_HELO or MSG_QUIT - no packet length */
-+		goto memdup;
-+	} else if (count < (1 + 4 + 1)
-+		   || count > (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
-+			       + ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES)) {
-+		printk(KERN_WARNING "%s: Acceptable packet size range is "
-+		       "[%d-%lu], but amount of data written is [%zu].",
-+		       __func__, (1 + 4 + 1),
-+		       (1 + 4 + 2 + sizeof(struct ecryptfs_message) + 4
-+			+ ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES), count);
-+		return -EINVAL;
-+	}
-+
-+	if (copy_from_user(packet_size_peek, (buf + 1 + 4),
-+			   sizeof(packet_size_peek))) {
-+		printk(KERN_WARNING "%s: Error while inspecting packet size\n",
-+		       __func__);
-+		return -EFAULT;
-+	}
-+
-+	rc = ecryptfs_parse_packet_length(packet_size_peek, &packet_size,
-+					  &packet_size_length);
-+	if (rc) {
-+		printk(KERN_WARNING "%s: Error parsing packet length; "
-+		       "rc = [%d]\n", __func__, rc);
-+		return rc;
-+	}
-+
-+	if ((1 + 4 + packet_size_length + packet_size) != count) {
-+		printk(KERN_WARNING "%s: Invalid packet size [%zu]\n", __func__,
-+		       packet_size);
-+		return -EINVAL;
-+	}
- 
-+memdup:
- 	data = memdup_user(buf, count);
- 	if (IS_ERR(data)) {
- 		printk(KERN_ERR "%s: memdup_user returned error [%ld]\n",
-@@ -435,23 +471,7 @@ ecryptfs_miscdev_write(struct file *file, const char __user *buf,
- 		}
- 		memcpy(&counter_nbo, &data[i], 4);
- 		seq = be32_to_cpu(counter_nbo);
--		i += 4;
--		rc = ecryptfs_parse_packet_length(&data[i], &packet_size,
--						  &packet_size_length);
--		if (rc) {
--			printk(KERN_WARNING "%s: Error parsing packet length; "
--			       "rc = [%d]\n", __func__, rc);
--			goto out_free;
--		}
--		i += packet_size_length;
--		if ((1 + 4 + packet_size_length + packet_size) != count) {
--			printk(KERN_WARNING "%s: (1 + packet_size_length([%zd])"
--			       " + packet_size([%zd]))([%zd]) != "
--			       "count([%zd]). Invalid packet format.\n",
--			       __func__, packet_size_length, packet_size,
--			       (1 + packet_size_length + packet_size), count);
--			goto out_free;
--		}
-+		i += 4 + packet_size_length;
- 		rc = ecryptfs_miscdev_response(&data[i], packet_size,
- 					       euid, current_user_ns(),
- 					       task_pid(current), seq);
-diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
-index 3745f7c..54eb14c 100644
---- a/fs/ecryptfs/read_write.c
-+++ b/fs/ecryptfs/read_write.c
-@@ -132,6 +132,11 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
- 		size_t num_bytes = (PAGE_CACHE_SIZE - start_offset_in_page);
- 		size_t total_remaining_bytes = ((offset + size) - pos);
- 
-+		if (fatal_signal_pending(current)) {
-+			rc = -EINTR;
-+			break;
-+		}
-+
- 		if (num_bytes > total_remaining_bytes)
- 			num_bytes = total_remaining_bytes;
- 		if (pos < offset) {
-@@ -193,15 +198,19 @@ int ecryptfs_write(struct inode *ecryptfs_inode, char *data, loff_t offset,
- 		}
- 		pos += num_bytes;
- 	}
--	if ((offset + size) > ecryptfs_file_size) {
--		i_size_write(ecryptfs_inode, (offset + size));
-+	if (pos > ecryptfs_file_size) {
-+		i_size_write(ecryptfs_inode, pos);
- 		if (crypt_stat->flags & ECRYPTFS_ENCRYPTED) {
--			rc = ecryptfs_write_inode_size_to_metadata(
-+			int rc2;
-+
-+			rc2 = ecryptfs_write_inode_size_to_metadata(
- 								ecryptfs_inode);
--			if (rc) {
-+			if (rc2) {
- 				printk(KERN_ERR	"Problem with "
- 				       "ecryptfs_write_inode_size_to_metadata; "
--				       "rc = [%d]\n", rc);
-+				       "rc = [%d]\n", rc2);
-+				if (!rc)
-+					rc = rc2;
- 				goto out;
- 			}
- 		}
-diff --git a/fs/jbd/checkpoint.c b/fs/jbd/checkpoint.c
-index f94fc48..5c93ffc 100644
---- a/fs/jbd/checkpoint.c
-+++ b/fs/jbd/checkpoint.c
-@@ -453,8 +453,6 @@ out:
-  *
-  * Return <0 on error, 0 on success, 1 if there was nothing to clean up.
-  *
-- * Called with the journal lock held.
-- *
-  * This is the only part of the journaling code which really needs to be
-  * aware of transaction aborts.  Checkpointing involves writing to the
-  * main filesystem area rather than to the journal, so it can proceed
-@@ -472,13 +470,14 @@ int cleanup_journal_tail(journal_t *journal)
- 	if (is_journal_aborted(journal))
- 		return 1;
- 
--	/* OK, work out the oldest transaction remaining in the log, and
-+	/*
-+	 * OK, work out the oldest transaction remaining in the log, and
- 	 * the log block it starts at.
- 	 *
- 	 * If the log is now empty, we need to work out which is the
- 	 * next transaction ID we will write, and where it will
--	 * start. */
--
-+	 * start.
-+	 */
- 	spin_lock(&journal->j_state_lock);
- 	spin_lock(&journal->j_list_lock);
- 	transaction = journal->j_checkpoint_transactions;
-@@ -504,7 +503,25 @@ int cleanup_journal_tail(journal_t *journal)
- 		spin_unlock(&journal->j_state_lock);
- 		return 1;
- 	}
-+	spin_unlock(&journal->j_state_lock);
-+
-+	/*
-+	 * We need to make sure that any blocks that were recently written out
-+	 * --- perhaps by log_do_checkpoint() --- are flushed out before we
-+	 * drop the transactions from the journal. It's unlikely this will be
-+	 * necessary, especially with an appropriately sized journal, but we
-+	 * need this to guarantee correctness.  Fortunately
-+	 * cleanup_journal_tail() doesn't get called all that often.
-+	 */
-+	if (journal->j_flags & JFS_BARRIER)
-+		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
- 
-+	spin_lock(&journal->j_state_lock);
-+	if (!tid_gt(first_tid, journal->j_tail_sequence)) {
-+		spin_unlock(&journal->j_state_lock);
-+		/* Someone else cleaned up journal so return 0 */
-+		return 0;
-+	}
- 	/* OK, update the superblock to recover the freed space.
- 	 * Physical blocks come first: have we wrapped beyond the end of
- 	 * the log?  */
-diff --git a/fs/jbd/recovery.c b/fs/jbd/recovery.c
-index 5b43e96..008bf06 100644
---- a/fs/jbd/recovery.c
-+++ b/fs/jbd/recovery.c
-@@ -20,6 +20,7 @@
- #include <linux/fs.h>
- #include <linux/jbd.h>
- #include <linux/errno.h>
-+#include <linux/blkdev.h>
- #endif
- 
- /*
-@@ -263,6 +264,9 @@ int journal_recover(journal_t *journal)
- 	err2 = sync_blockdev(journal->j_fs_dev);
- 	if (!err)
- 		err = err2;
-+	/* Flush disk caches to get replayed data on the permanent storage */
-+	if (journal->j_flags & JFS_BARRIER)
-+		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
- 
- 	return err;
- }
-diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
-index d4e6080b..779789a 100644
---- a/fs/sysfs/file.c
-+++ b/fs/sysfs/file.c
-@@ -493,6 +493,12 @@ int sysfs_attr_ns(struct kobject *kobj, const struct attribute *attr,
- 	const void *ns = NULL;
- 	int err;
- 
-+	if (!dir_sd) {
-+		WARN(1, KERN_ERR "sysfs: kobject %s without dirent\n",
-+			kobject_name(kobj));
-+		return -ENOENT;
-+	}
-+
- 	err = 0;
- 	if (!sysfs_ns_type(dir_sd))
- 		goto out;
-diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
-index c81b22f..deb804b 100644
---- a/fs/sysfs/inode.c
-+++ b/fs/sysfs/inode.c
-@@ -318,8 +318,11 @@ int sysfs_hash_and_remove(struct sysfs_dirent *dir_sd, const void *ns, const cha
- 	struct sysfs_addrm_cxt acxt;
- 	struct sysfs_dirent *sd;
- 
--	if (!dir_sd)
-+	if (!dir_sd) {
-+		WARN(1, KERN_WARNING "sysfs: can not remove '%s', no directory\n",
-+			name);
- 		return -ENOENT;
-+	}
- 
- 	sysfs_addrm_start(&acxt, dir_sd);
- 
-diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c
-index ce9268a..ee98d0b 100644
---- a/fs/xfs/xfs_vnodeops.c
-+++ b/fs/xfs/xfs_vnodeops.c
-@@ -131,7 +131,8 @@ xfs_readlink(
- 			 __func__, (unsigned long long) ip->i_ino,
- 			 (long long) pathlen);
- 		ASSERT(0);
--		return XFS_ERROR(EFSCORRUPTED);
-+		error = XFS_ERROR(EFSCORRUPTED);
-+		goto out;
- 	}
- 
- 
-diff --git a/include/drm/drmP.h b/include/drm/drmP.h
-index 1f9e951..bf4b2dc 100644
---- a/include/drm/drmP.h
-+++ b/include/drm/drmP.h
-@@ -1328,6 +1328,7 @@ extern int drm_getmagic(struct drm_device *dev, void *data,
- 			struct drm_file *file_priv);
- extern int drm_authmagic(struct drm_device *dev, void *data,
- 			 struct drm_file *file_priv);
-+extern int drm_remove_magic(struct drm_master *master, drm_magic_t magic);
- 
- /* Cache management (drm_cache.c) */
- void drm_clflush_pages(struct page *pages[], unsigned long num_pages);
-diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
-index 3419bf5..d55f434 100644
---- a/include/net/netns/generic.h
-+++ b/include/net/netns/generic.h
-@@ -41,6 +41,7 @@ static inline void *net_generic(const struct net *net, int id)
- 	ptr = ng->ptr[id - 1];
- 	rcu_read_unlock();
- 
-+	BUG_ON(!ptr);
- 	return ptr;
- }
- #endif
-diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
-index f1fa1f6..68223e4 100644
---- a/net/caif/caif_dev.c
-+++ b/net/caif/caif_dev.c
-@@ -53,7 +53,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
- 	struct caif_net *caifn;
- 	BUG_ON(!net);
- 	caifn = net_generic(net, caif_net_id);
--	BUG_ON(!caifn);
- 	return caifn->cfg;
- }
- EXPORT_SYMBOL(get_cfcnfg);
-@@ -63,7 +62,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
- 	struct caif_net *caifn;
- 	BUG_ON(!net);
- 	caifn = net_generic(net, caif_net_id);
--	BUG_ON(!caifn);
- 	return &caifn->caifdevs;
- }
- 
-@@ -92,7 +90,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
- 	struct caif_device_entry *caifd;
- 
- 	caifdevs = caif_device_list(dev_net(dev));
--	BUG_ON(!caifdevs);
- 
- 	caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
- 	if (!caifd)
-@@ -112,7 +109,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
- 	struct caif_device_entry_list *caifdevs =
- 	    caif_device_list(dev_net(dev));
- 	struct caif_device_entry *caifd;
--	BUG_ON(!caifdevs);
-+
- 	list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
- 		if (caifd->netdev == dev)
- 			return caifd;
-@@ -353,7 +350,7 @@ static struct notifier_block caif_device_notifier = {
- static int caif_init_net(struct net *net)
- {
- 	struct caif_net *caifn = net_generic(net, caif_net_id);
--	BUG_ON(!caifn);
-+
- 	INIT_LIST_HEAD(&caifn->caifdevs.list);
- 	mutex_init(&caifn->caifdevs.lock);
- 
-@@ -418,7 +415,7 @@ static int __init caif_device_init(void)
- {
- 	int result;
- 
--	result = register_pernet_device(&caif_net_ops);
-+	result = register_pernet_subsys(&caif_net_ops);
- 
- 	if (result)
- 		return result;
-@@ -431,7 +428,7 @@ static int __init caif_device_init(void)
- 
- static void __exit caif_device_exit(void)
- {
--	unregister_pernet_device(&caif_net_ops);
-+	unregister_pernet_subsys(&caif_net_ops);
- 	unregister_netdevice_notifier(&caif_device_notifier);
- 	dev_remove_pack(&caif_packet_type);
- }
-diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
-index 00523ec..86ff37c 100644
---- a/net/caif/cfcnfg.c
-+++ b/net/caif/cfcnfg.c
-@@ -309,7 +309,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
- 	int err;
- 	struct cfctrl_link_param param;
- 	struct cfcnfg *cfg = get_cfcnfg(net);
--	caif_assert(cfg != NULL);
- 
- 	rcu_read_lock();
- 	err = caif_connect_req_to_link_param(cfg, conn_req, &param);
-diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
-index 385aefe..0329404 100644
---- a/net/core/net-sysfs.c
-+++ b/net/core/net-sysfs.c
-@@ -990,9 +990,9 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
- 			nonempty = 1;
- 	}
- 
--	if (nonempty)
--		RCU_INIT_POINTER(dev->xps_maps, new_dev_maps);
--	else {
-+	if (nonempty) {
-+		rcu_assign_pointer(dev->xps_maps, new_dev_maps);
-+	} else {
- 		kfree(new_dev_maps);
- 		RCU_INIT_POINTER(dev->xps_maps, NULL);
- 	}
-diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
-index aefcd7a..0e950fd 100644
---- a/net/core/net_namespace.c
-+++ b/net/core/net_namespace.c
-@@ -30,6 +30,20 @@ EXPORT_SYMBOL(init_net);
- 
- #define INITIAL_NET_GEN_PTRS	13 /* +1 for len +2 for rcu_head */
- 
-+static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
-+
-+static struct net_generic *net_alloc_generic(void)
-+{
-+	struct net_generic *ng;
-+	size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
-+
-+	ng = kzalloc(generic_size, GFP_KERNEL);
-+	if (ng)
-+		ng->len = max_gen_ptrs;
-+
-+	return ng;
-+}
-+
- static int net_assign_generic(struct net *net, int id, void *data)
- {
- 	struct net_generic *ng, *old_ng;
-@@ -43,8 +57,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
- 	if (old_ng->len >= id)
- 		goto assign;
- 
--	ng = kzalloc(sizeof(struct net_generic) +
--			id * sizeof(void *), GFP_KERNEL);
-+	ng = net_alloc_generic();
- 	if (ng == NULL)
- 		return -ENOMEM;
- 
-@@ -59,7 +72,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
- 	 * the old copy for kfree after a grace period.
- 	 */
- 
--	ng->len = id;
- 	memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
- 
- 	rcu_assign_pointer(net->gen, ng);
-@@ -161,18 +173,6 @@ out_undo:
- 	goto out;
- }
- 
--static struct net_generic *net_alloc_generic(void)
--{
--	struct net_generic *ng;
--	size_t generic_size = sizeof(struct net_generic) +
--		INITIAL_NET_GEN_PTRS * sizeof(void *);
--
--	ng = kzalloc(generic_size, GFP_KERNEL);
--	if (ng)
--		ng->len = INITIAL_NET_GEN_PTRS;
--
--	return ng;
--}
- 
- #ifdef CONFIG_NET_NS
- static struct kmem_cache *net_cachep;
-@@ -483,6 +483,7 @@ again:
- 			}
- 			return error;
- 		}
-+		max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
- 	}
- 	error = __register_pernet_operations(list, ops);
- 	if (error) {
-diff --git a/net/core/netpoll.c b/net/core/netpoll.c
-index cf64c1f..5d4d896 100644
---- a/net/core/netpoll.c
-+++ b/net/core/netpoll.c
-@@ -763,7 +763,7 @@ int __netpoll_setup(struct netpoll *np)
- 	}
- 
- 	/* last thing to do is link it to the net device structure */
--	RCU_INIT_POINTER(ndev->npinfo, npinfo);
-+	rcu_assign_pointer(ndev->npinfo, npinfo);
- 
- 	return 0;
- 
-diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
-index 2ab16e1..74d321a 100644
---- a/net/decnet/dn_dev.c
-+++ b/net/decnet/dn_dev.c
-@@ -388,7 +388,7 @@ static int dn_dev_insert_ifa(struct dn_dev *dn_db, struct dn_ifaddr *ifa)
- 	}
- 
- 	ifa->ifa_next = dn_db->ifa_list;
--	RCU_INIT_POINTER(dn_db->ifa_list, ifa);
-+	rcu_assign_pointer(dn_db->ifa_list, ifa);
- 
- 	dn_ifaddr_notify(RTM_NEWADDR, ifa);
- 	blocking_notifier_call_chain(&dnaddr_chain, NETDEV_UP, ifa);
-@@ -1093,7 +1093,7 @@ static struct dn_dev *dn_dev_create(struct net_device *dev, int *err)
- 
- 	memcpy(&dn_db->parms, p, sizeof(struct dn_dev_parms));
- 
--	RCU_INIT_POINTER(dev->dn_ptr, dn_db);
-+	rcu_assign_pointer(dev->dn_ptr, dn_db);
- 	dn_db->dev = dev;
- 	init_timer(&dn_db->timer);
- 
-diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
-index 65f01dc..e41c40f 100644
---- a/net/ipv4/devinet.c
-+++ b/net/ipv4/devinet.c
-@@ -258,7 +258,7 @@ static struct in_device *inetdev_init(struct net_device *dev)
- 		ip_mc_up(in_dev);
- 
- 	/* we can receive as soon as ip_ptr is set -- do this last */
--	RCU_INIT_POINTER(dev->ip_ptr, in_dev);
-+	rcu_assign_pointer(dev->ip_ptr, in_dev);
- out:
- 	return in_dev;
- out_kfree:
-diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
-index 37b6711..3ce23f9 100644
---- a/net/ipv4/fib_trie.c
-+++ b/net/ipv4/fib_trie.c
-@@ -205,7 +205,7 @@ static inline struct tnode *node_parent_rcu(const struct rt_trie_node *node)
- 	return (struct tnode *)(parent & ~NODE_TYPE_MASK);
- }
- 
--/* Same as RCU_INIT_POINTER
-+/* Same as rcu_assign_pointer
-  * but that macro() assumes that value is a pointer.
-  */
- static inline void node_set_parent(struct rt_trie_node *node, struct tnode *ptr)
-@@ -529,7 +529,7 @@ static void tnode_put_child_reorg(struct tnode *tn, int i, struct rt_trie_node *
- 	if (n)
- 		node_set_parent(n, tn);
- 
--	RCU_INIT_POINTER(tn->child[i], n);
-+	rcu_assign_pointer(tn->child[i], n);
- }
- 
- #define MAX_WORK 10
-@@ -1015,7 +1015,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
- 
- 		tp = node_parent((struct rt_trie_node *) tn);
- 		if (!tp)
--			RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
-+			rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
- 
- 		tnode_free_flush();
- 		if (!tp)
-@@ -1027,7 +1027,7 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
- 	if (IS_TNODE(tn))
- 		tn = (struct tnode *)resize(t, (struct tnode *)tn);
- 
--	RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
-+	rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
- 	tnode_free_flush();
- }
- 
-@@ -1164,7 +1164,7 @@ static struct list_head *fib_insert_node(struct trie *t, u32 key, int plen)
- 			put_child(t, (struct tnode *)tp, cindex,
- 				  (struct rt_trie_node *)tn);
- 		} else {
--			RCU_INIT_POINTER(t->trie, (struct rt_trie_node *)tn);
-+			rcu_assign_pointer(t->trie, (struct rt_trie_node *)tn);
- 			tp = tn;
- 		}
- 	}
-diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
-index c3cc64c..c8989a7 100644
---- a/net/ipv4/igmp.c
-+++ b/net/ipv4/igmp.c
-@@ -1244,7 +1244,7 @@ void ip_mc_inc_group(struct in_device *in_dev, __be32 addr)
- 
- 	im->next_rcu = in_dev->mc_list;
- 	in_dev->mc_count++;
--	RCU_INIT_POINTER(in_dev->mc_list, im);
-+	rcu_assign_pointer(in_dev->mc_list, im);
- 
- #ifdef CONFIG_IP_MULTICAST
- 	igmpv3_del_delrec(in_dev, im->multiaddr);
-@@ -1816,7 +1816,7 @@ int ip_mc_join_group(struct sock *sk , struct ip_mreqn *imr)
- 	iml->next_rcu = inet->mc_list;
- 	iml->sflist = NULL;
- 	iml->sfmode = MCAST_EXCLUDE;
--	RCU_INIT_POINTER(inet->mc_list, iml);
-+	rcu_assign_pointer(inet->mc_list, iml);
- 	ip_mc_inc_group(in_dev, addr);
- 	err = 0;
- done:
-@@ -2003,7 +2003,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
- 			atomic_sub(IP_SFLSIZE(psl->sl_max), &sk->sk_omem_alloc);
- 			kfree_rcu(psl, rcu);
- 		}
--		RCU_INIT_POINTER(pmc->sflist, newpsl);
-+		rcu_assign_pointer(pmc->sflist, newpsl);
- 		psl = newpsl;
- 	}
- 	rv = 1;	/* > 0 for insert logic below if sl_count is 0 */
-@@ -2106,7 +2106,7 @@ int ip_mc_msfilter(struct sock *sk, struct ip_msfilter *msf, int ifindex)
- 	} else
- 		(void) ip_mc_del_src(in_dev, &msf->imsf_multiaddr, pmc->sfmode,
- 			0, NULL, 0);
--	RCU_INIT_POINTER(pmc->sflist, newpsl);
-+	rcu_assign_pointer(pmc->sflist, newpsl);
- 	pmc->sfmode = msf->imsf_fmode;
- 	err = 0;
- done:
-diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
-index 0b2e732..17ad951 100644
---- a/net/ipv4/ipip.c
-+++ b/net/ipv4/ipip.c
-@@ -231,7 +231,7 @@ static void ipip_tunnel_unlink(struct ipip_net *ipn, struct ip_tunnel *t)
- 	     (iter = rtnl_dereference(*tp)) != NULL;
- 	     tp = &iter->next) {
- 		if (t == iter) {
--			RCU_INIT_POINTER(*tp, t->next);
-+			rcu_assign_pointer(*tp, t->next);
- 			break;
- 		}
- 	}
-@@ -241,8 +241,8 @@ static void ipip_tunnel_link(struct ipip_net *ipn, struct ip_tunnel *t)
- {
- 	struct ip_tunnel __rcu **tp = ipip_bucket(ipn, t);
- 
--	RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
--	RCU_INIT_POINTER(*tp, t);
-+	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
-+	rcu_assign_pointer(*tp, t);
- }
- 
- static struct ip_tunnel * ipip_tunnel_locate(struct net *net,
-@@ -792,7 +792,7 @@ static int __net_init ipip_fb_tunnel_init(struct net_device *dev)
- 		return -ENOMEM;
- 
- 	dev_hold(dev);
--	RCU_INIT_POINTER(ipn->tunnels_wc[0], tunnel);
-+	rcu_assign_pointer(ipn->tunnels_wc[0], tunnel);
- 	return 0;
- }
- 
-diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
-index 76a7f07..d2aae27 100644
---- a/net/ipv4/ipmr.c
-+++ b/net/ipv4/ipmr.c
-@@ -1225,7 +1225,7 @@ int ip_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, unsi
- 
- 		ret = ip_ra_control(sk, 1, mrtsock_destruct);
- 		if (ret == 0) {
--			RCU_INIT_POINTER(mrt->mroute_sk, sk);
-+			rcu_assign_pointer(mrt->mroute_sk, sk);
- 			IPV4_DEVCONF_ALL(net, MC_FORWARDING)++;
- 		}
- 		rtnl_unlock();
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index a9db4b1..c89e354 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -630,7 +630,7 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
- 	arg.iov[0].iov_len  = sizeof(rep.th);
- 
- #ifdef CONFIG_TCP_MD5SIG
--	key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->daddr) : NULL;
-+	key = sk ? tcp_v4_md5_do_lookup(sk, ip_hdr(skb)->saddr) : NULL;
- 	if (key) {
- 		rep.opt[0] = htonl((TCPOPT_NOP << 24) |
- 				   (TCPOPT_NOP << 16) |
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 63170e2..097e0c7 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1138,11 +1138,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
- 	sk_mem_uncharge(sk, len);
- 	sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
- 
--	/* Any change of skb->len requires recalculation of tso
--	 * factor and mss.
--	 */
-+	/* Any change of skb->len requires recalculation of tso factor. */
- 	if (tcp_skb_pcount(skb) > 1)
--		tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
-+		tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
- 
- 	return 0;
- }
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 36806de..836c4ea 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -429,7 +429,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
- 	ndev->tstamp = jiffies;
- 	addrconf_sysctl_register(ndev);
- 	/* protected by rtnl_lock */
--	RCU_INIT_POINTER(dev->ip6_ptr, ndev);
-+	rcu_assign_pointer(dev->ip6_ptr, ndev);
- 
- 	/* Join all-node multicast group */
- 	ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
-diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 4e2e9ff..d19f499 100644
---- a/net/ipv6/ip6_tunnel.c
-+++ b/net/ipv6/ip6_tunnel.c
-@@ -218,8 +218,8 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
- {
- 	struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
- 
--	RCU_INIT_POINTER(t->next , rtnl_dereference(*tp));
--	RCU_INIT_POINTER(*tp, t);
-+	rcu_assign_pointer(t->next , rtnl_dereference(*tp));
-+	rcu_assign_pointer(*tp, t);
- }
- 
- /**
-@@ -237,7 +237,7 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
- 	     (iter = rtnl_dereference(*tp)) != NULL;
- 	     tp = &iter->next) {
- 		if (t == iter) {
--			RCU_INIT_POINTER(*tp, t->next);
-+			rcu_assign_pointer(*tp, t->next);
- 			break;
- 		}
- 	}
-@@ -1450,7 +1450,7 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
- 
- 	t->parms.proto = IPPROTO_IPV6;
- 	dev_hold(dev);
--	RCU_INIT_POINTER(ip6n->tnls_wc[0], t);
-+	rcu_assign_pointer(ip6n->tnls_wc[0], t);
- 	return 0;
- }
- 
-diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
-index 331af3b..361ebf3 100644
---- a/net/ipv6/raw.c
-+++ b/net/ipv6/raw.c
-@@ -131,7 +131,7 @@ static mh_filter_t __rcu *mh_filter __read_mostly;
- 
- int rawv6_mh_filter_register(mh_filter_t filter)
- {
--	RCU_INIT_POINTER(mh_filter, filter);
-+	rcu_assign_pointer(mh_filter, filter);
- 	return 0;
- }
- EXPORT_SYMBOL(rawv6_mh_filter_register);
-diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
-index 96f3623..72a939d 100644
---- a/net/ipv6/sit.c
-+++ b/net/ipv6/sit.c
-@@ -182,7 +182,7 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
- 	     (iter = rtnl_dereference(*tp)) != NULL;
- 	     tp = &iter->next) {
- 		if (t == iter) {
--			RCU_INIT_POINTER(*tp, t->next);
-+			rcu_assign_pointer(*tp, t->next);
- 			break;
- 		}
- 	}
-@@ -192,8 +192,8 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
- {
- 	struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
- 
--	RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
--	RCU_INIT_POINTER(*tp, t);
-+	rcu_assign_pointer(t->next, rtnl_dereference(*tp));
-+	rcu_assign_pointer(*tp, t);
- }
- 
- static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
-@@ -393,7 +393,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
- 	p->addr = a->addr;
- 	p->flags = a->flags;
- 	t->prl_count++;
--	RCU_INIT_POINTER(t->prl, p);
-+	rcu_assign_pointer(t->prl, p);
- out:
- 	return err;
- }
-@@ -1177,7 +1177,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
- 	if (!dev->tstats)
- 		return -ENOMEM;
- 	dev_hold(dev);
--	RCU_INIT_POINTER(sitn->tunnels_wc[0], tunnel);
-+	rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
- 	return 0;
- }
- 
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 2dea4bb..b859e4a 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -1084,7 +1084,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
- 
- #ifdef CONFIG_TCP_MD5SIG
- 	if (sk)
--		key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
-+		key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
- #endif
- 
- 	if (th->ack)
-diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
-index d21e7eb..55670ec 100644
---- a/net/l2tp/l2tp_ip.c
-+++ b/net/l2tp/l2tp_ip.c
-@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
- {
- 	int rc;
- 
--	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
--		goto drop;
--
--	nf_reset(skb);
--
- 	/* Charge it to the socket, dropping if the queue is full. */
- 	rc = sock_queue_rcv_skb(sk, skb);
- 	if (rc < 0)
-diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
-index 93b2434..41c2310 100644
---- a/net/mac80211/agg-rx.c
-+++ b/net/mac80211/agg-rx.c
-@@ -326,7 +326,7 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
- 	status = WLAN_STATUS_SUCCESS;
- 
- 	/* activate it for RX */
--	RCU_INIT_POINTER(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
-+	rcu_assign_pointer(sta->ampdu_mlme.tid_rx[tid], tid_agg_rx);
- 
- 	if (timeout)
- 		mod_timer(&tid_agg_rx->session_timer, TU_TO_EXP_TIME(timeout));
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index d06c65f..11cee76 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -575,7 +575,7 @@ static int ieee80211_config_beacon(struct ieee80211_sub_if_data *sdata,
- 
- 	sdata->vif.bss_conf.dtim_period = new->dtim_period;
- 
--	RCU_INIT_POINTER(sdata->u.ap.beacon, new);
-+	rcu_assign_pointer(sdata->u.ap.beacon, new);
- 
- 	synchronize_rcu();
- 
-@@ -922,7 +922,7 @@ static int ieee80211_change_station(struct wiphy *wiphy,
- 				return -EBUSY;
- 			}
- 
--			RCU_INIT_POINTER(vlansdata->u.vlan.sta, sta);
-+			rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
- 		}
- 
- 		sta->sdata = vlansdata;
-diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
-index ede9a8b..3ece106 100644
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -184,7 +184,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
- 		*pos++ = 0; /* U-APSD no in use */
- 	}
- 
--	RCU_INIT_POINTER(ifibss->presp, skb);
-+	rcu_assign_pointer(ifibss->presp, skb);
- 
- 	sdata->vif.bss_conf.beacon_int = beacon_int;
- 	sdata->vif.bss_conf.basic_rates = basic_rates;
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index b1b1bb3..9da8626 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -2719,7 +2719,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
- {
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
--	struct ieee80211_work *wk;
- 	u8 bssid[ETH_ALEN];
- 	bool assoc_bss = false;
- 
-@@ -2732,30 +2731,47 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
- 		assoc_bss = true;
- 	} else {
- 		bool not_auth_yet = false;
-+		struct ieee80211_work *tmp, *wk = NULL;
- 
- 		mutex_unlock(&ifmgd->mtx);
- 
- 		mutex_lock(&local->mtx);
--		list_for_each_entry(wk, &local->work_list, list) {
--			if (wk->sdata != sdata)
-+		list_for_each_entry(tmp, &local->work_list, list) {
-+			if (tmp->sdata != sdata)
- 				continue;
- 
--			if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
--			    wk->type != IEEE80211_WORK_AUTH &&
--			    wk->type != IEEE80211_WORK_ASSOC &&
--			    wk->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
-+			if (tmp->type != IEEE80211_WORK_DIRECT_PROBE &&
-+			    tmp->type != IEEE80211_WORK_AUTH &&
-+			    tmp->type != IEEE80211_WORK_ASSOC &&
-+			    tmp->type != IEEE80211_WORK_ASSOC_BEACON_WAIT)
- 				continue;
- 
--			if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
-+			if (memcmp(req->bss->bssid, tmp->filter_ta, ETH_ALEN))
- 				continue;
- 
--			not_auth_yet = wk->type == IEEE80211_WORK_DIRECT_PROBE;
--			list_del_rcu(&wk->list);
--			free_work(wk);
-+			not_auth_yet = tmp->type == IEEE80211_WORK_DIRECT_PROBE;
-+			list_del_rcu(&tmp->list);
-+			synchronize_rcu();
-+			wk = tmp;
- 			break;
- 		}
- 		mutex_unlock(&local->mtx);
- 
-+		if (wk && wk->type == IEEE80211_WORK_ASSOC) {
-+			/* clean up dummy sta & TX sync */
-+			sta_info_destroy_addr(wk->sdata, wk->filter_ta);
-+			if (wk->assoc.synced)
-+				drv_finish_tx_sync(local, wk->sdata,
-+						   wk->filter_ta,
-+						   IEEE80211_TX_SYNC_ASSOC);
-+		} else if (wk && wk->type == IEEE80211_WORK_AUTH) {
-+			if (wk->probe_auth.synced)
-+				drv_finish_tx_sync(local, wk->sdata,
-+						   wk->filter_ta,
-+						   IEEE80211_TX_SYNC_AUTH);
-+		}
-+		kfree(wk);
-+
- 		/*
- 		 * If somebody requests authentication and we haven't
- 		 * sent out an auth frame yet there's no need to send
-diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index 8eaa746..1fdd8ff 100644
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -73,7 +73,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
- 	if (!s)
- 		return -ENOENT;
- 	if (s == sta) {
--		RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)],
-+		rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)],
- 				   s->hnext);
- 		return 0;
- 	}
-@@ -83,7 +83,7 @@ static int sta_info_hash_del(struct ieee80211_local *local,
- 		s = rcu_dereference_protected(s->hnext,
- 					lockdep_is_held(&local->sta_lock));
- 	if (rcu_access_pointer(s->hnext)) {
--		RCU_INIT_POINTER(s->hnext, sta->hnext);
-+		rcu_assign_pointer(s->hnext, sta->hnext);
- 		return 0;
- 	}
- 
-@@ -232,7 +232,7 @@ static void sta_info_hash_add(struct ieee80211_local *local,
- 			      struct sta_info *sta)
- {
- 	sta->hnext = local->sta_hash[STA_HASH(sta->sta.addr)];
--	RCU_INIT_POINTER(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
-+	rcu_assign_pointer(local->sta_hash[STA_HASH(sta->sta.addr)], sta);
- }
- 
- static void sta_unblock(struct work_struct *wk)
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index 7202b06..1d15193 100644
---- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -776,7 +776,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl,
- 		if (exp->helper) {
- 			help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
- 			if (help)
--				RCU_INIT_POINTER(help->helper, exp->helper);
-+				rcu_assign_pointer(help->helper, exp->helper);
- 		}
- 
- #ifdef CONFIG_NF_CONNTRACK_MARK
-diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
-index b62c414..14af632 100644
---- a/net/netfilter/nf_conntrack_ecache.c
-+++ b/net/netfilter/nf_conntrack_ecache.c
-@@ -91,7 +91,7 @@ int nf_conntrack_register_notifier(struct net *net,
- 		ret = -EBUSY;
- 		goto out_unlock;
- 	}
--	RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, new);
-+	rcu_assign_pointer(net->ct.nf_conntrack_event_cb, new);
- 	mutex_unlock(&nf_ct_ecache_mutex);
- 	return ret;
- 
-@@ -128,7 +128,7 @@ int nf_ct_expect_register_notifier(struct net *net,
- 		ret = -EBUSY;
- 		goto out_unlock;
- 	}
--	RCU_INIT_POINTER(net->ct.nf_expect_event_cb, new);
-+	rcu_assign_pointer(net->ct.nf_expect_event_cb, new);
- 	mutex_unlock(&nf_ct_ecache_mutex);
- 	return ret;
- 
-diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
-index 4605c94..641ff5f 100644
---- a/net/netfilter/nf_conntrack_extend.c
-+++ b/net/netfilter/nf_conntrack_extend.c
-@@ -169,7 +169,7 @@ int nf_ct_extend_register(struct nf_ct_ext_type *type)
- 	   before updating alloc_size */
- 	type->alloc_size = ALIGN(sizeof(struct nf_ct_ext), type->align)
- 			   + type->len;
--	RCU_INIT_POINTER(nf_ct_ext_types[type->id], type);
-+	rcu_assign_pointer(nf_ct_ext_types[type->id], type);
- 	update_alloc_size(type);
- out:
- 	mutex_unlock(&nf_ct_ext_type_mutex);
-diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
-index 93c4bdb..bbe23ba 100644
---- a/net/netfilter/nf_conntrack_helper.c
-+++ b/net/netfilter/nf_conntrack_helper.c
-@@ -145,7 +145,7 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
- 		memset(&help->help, 0, sizeof(help->help));
- 	}
- 
--	RCU_INIT_POINTER(help->helper, helper);
-+	rcu_assign_pointer(help->helper, helper);
- out:
- 	return ret;
- }
-diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
-index 257e772..782cdcd 100644
---- a/net/netfilter/nf_conntrack_netlink.c
-+++ b/net/netfilter/nf_conntrack_netlink.c
-@@ -1163,7 +1163,7 @@ ctnetlink_change_helper(struct nf_conn *ct, const struct nlattr * const cda[])
- 		return -EOPNOTSUPP;
- 	}
- 
--	RCU_INIT_POINTER(help->helper, helper);
-+	rcu_assign_pointer(help->helper, helper);
- 
- 	return 0;
- }
-diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
-index ce0c406..957374a 100644
---- a/net/netfilter/nf_log.c
-+++ b/net/netfilter/nf_log.c
-@@ -55,7 +55,7 @@ int nf_log_register(u_int8_t pf, struct nf_logger *logger)
- 		llog = rcu_dereference_protected(nf_loggers[pf],
- 						 lockdep_is_held(&nf_log_mutex));
- 		if (llog == NULL)
--			RCU_INIT_POINTER(nf_loggers[pf], logger);
-+			rcu_assign_pointer(nf_loggers[pf], logger);
- 	}
- 
- 	mutex_unlock(&nf_log_mutex);
-@@ -92,7 +92,7 @@ int nf_log_bind_pf(u_int8_t pf, const struct nf_logger *logger)
- 		mutex_unlock(&nf_log_mutex);
- 		return -ENOENT;
- 	}
--	RCU_INIT_POINTER(nf_loggers[pf], logger);
-+	rcu_assign_pointer(nf_loggers[pf], logger);
- 	mutex_unlock(&nf_log_mutex);
- 	return 0;
- }
-@@ -250,7 +250,7 @@ static int nf_log_proc_dostring(ctl_table *table, int write,
- 			mutex_unlock(&nf_log_mutex);
- 			return -ENOENT;
- 		}
--		RCU_INIT_POINTER(nf_loggers[tindex], logger);
-+		rcu_assign_pointer(nf_loggers[tindex], logger);
- 		mutex_unlock(&nf_log_mutex);
- 	} else {
- 		mutex_lock(&nf_log_mutex);
-diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
-index 99ffd28..b3a7db6 100644
---- a/net/netfilter/nf_queue.c
-+++ b/net/netfilter/nf_queue.c
-@@ -40,7 +40,7 @@ int nf_register_queue_handler(u_int8_t pf, const struct nf_queue_handler *qh)
- 	else if (old)
- 		ret = -EBUSY;
- 	else {
--		RCU_INIT_POINTER(queue_handler[pf], qh);
-+		rcu_assign_pointer(queue_handler[pf], qh);
- 		ret = 0;
- 	}
- 	mutex_unlock(&queue_handler_mutex);
-diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
-index c879c1a..b4f8d84 100644
---- a/net/netfilter/nfnetlink.c
-+++ b/net/netfilter/nfnetlink.c
-@@ -59,7 +59,7 @@ int nfnetlink_subsys_register(const struct nfnetlink_subsystem *n)
- 		nfnl_unlock();
- 		return -EBUSY;
- 	}
--	RCU_INIT_POINTER(subsys_table[n->subsys_id], n);
-+	rcu_assign_pointer(subsys_table[n->subsys_id], n);
- 	nfnl_unlock();
- 
- 	return 0;
-@@ -210,7 +210,7 @@ static int __net_init nfnetlink_net_init(struct net *net)
- 	if (!nfnl)
- 		return -ENOMEM;
- 	net->nfnl_stash = nfnl;
--	RCU_INIT_POINTER(net->nfnl, nfnl);
-+	rcu_assign_pointer(net->nfnl, nfnl);
- 	return 0;
- }
- 
-diff --git a/net/netlabel/netlabel_domainhash.c b/net/netlabel/netlabel_domainhash.c
-index 3f905e5..e5330ed 100644
---- a/net/netlabel/netlabel_domainhash.c
-+++ b/net/netlabel/netlabel_domainhash.c
-@@ -282,7 +282,7 @@ int __init netlbl_domhsh_init(u32 size)
- 		INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
- 
- 	spin_lock(&netlbl_domhsh_lock);
--	RCU_INIT_POINTER(netlbl_domhsh, hsh_tbl);
-+	rcu_assign_pointer(netlbl_domhsh, hsh_tbl);
- 	spin_unlock(&netlbl_domhsh_lock);
- 
- 	return 0;
-@@ -330,7 +330,7 @@ int netlbl_domhsh_add(struct netlbl_dom_map *entry,
- 				    &rcu_dereference(netlbl_domhsh)->tbl[bkt]);
- 		} else {
- 			INIT_LIST_HEAD(&entry->list);
--			RCU_INIT_POINTER(netlbl_domhsh_def, entry);
-+			rcu_assign_pointer(netlbl_domhsh_def, entry);
- 		}
- 
- 		if (entry->type == NETLBL_NLTYPE_ADDRSELECT) {
-diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c
-index e251c2c..d463f5a 100644
---- a/net/netlabel/netlabel_unlabeled.c
-+++ b/net/netlabel/netlabel_unlabeled.c
-@@ -354,7 +354,7 @@ static struct netlbl_unlhsh_iface *netlbl_unlhsh_add_iface(int ifindex)
- 		INIT_LIST_HEAD(&iface->list);
- 		if (netlbl_unlhsh_rcu_deref(netlbl_unlhsh_def) != NULL)
- 			goto add_iface_failure;
--		RCU_INIT_POINTER(netlbl_unlhsh_def, iface);
-+		rcu_assign_pointer(netlbl_unlhsh_def, iface);
- 	}
- 	spin_unlock(&netlbl_unlhsh_lock);
- 
-@@ -1447,11 +1447,9 @@ int __init netlbl_unlabel_init(u32 size)
- 	for (iter = 0; iter < hsh_tbl->size; iter++)
- 		INIT_LIST_HEAD(&hsh_tbl->tbl[iter]);
- 
--	rcu_read_lock();
- 	spin_lock(&netlbl_unlhsh_lock);
--	RCU_INIT_POINTER(netlbl_unlhsh, hsh_tbl);
-+	rcu_assign_pointer(netlbl_unlhsh, hsh_tbl);
- 	spin_unlock(&netlbl_unlhsh_lock);
--	rcu_read_unlock();
- 
- 	register_netdevice_notifier(&netlbl_unlhsh_netdev_notifier);
- 
-diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
-index bf10ea8..d65f699 100644
---- a/net/phonet/af_phonet.c
-+++ b/net/phonet/af_phonet.c
-@@ -480,7 +480,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
- 	if (proto_tab[protocol])
- 		err = -EBUSY;
- 	else
--		RCU_INIT_POINTER(proto_tab[protocol], pp);
-+		rcu_assign_pointer(proto_tab[protocol], pp);
- 	mutex_unlock(&proto_tab_lock);
- 
- 	return err;
-diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
-index c582761..9b9a85e 100644
---- a/net/phonet/pn_dev.c
-+++ b/net/phonet/pn_dev.c
-@@ -390,7 +390,7 @@ int phonet_route_add(struct net_device *dev, u8 daddr)
- 	daddr = daddr >> 2;
- 	mutex_lock(&routes->lock);
- 	if (routes->table[daddr] == NULL) {
--		RCU_INIT_POINTER(routes->table[daddr], dev);
-+		rcu_assign_pointer(routes->table[daddr], dev);
- 		dev_hold(dev);
- 		err = 0;
- 	}
-diff --git a/net/phonet/socket.c b/net/phonet/socket.c
-index 3f8d0b1..4c7eff3 100644
---- a/net/phonet/socket.c
-+++ b/net/phonet/socket.c
-@@ -680,7 +680,7 @@ int pn_sock_bind_res(struct sock *sk, u8 res)
- 	mutex_lock(&resource_mutex);
- 	if (pnres.sk[res] == NULL) {
- 		sock_hold(sk);
--		RCU_INIT_POINTER(pnres.sk[res], sk);
-+		rcu_assign_pointer(pnres.sk[res], sk);
- 		ret = 0;
- 	}
- 	mutex_unlock(&resource_mutex);
-diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
-index bb6ad81..424ff62 100644
---- a/net/rds/af_rds.c
-+++ b/net/rds/af_rds.c
-@@ -68,7 +68,6 @@ static int rds_release(struct socket *sock)
- {
- 	struct sock *sk = sock->sk;
- 	struct rds_sock *rs;
--	unsigned long flags;
- 
- 	if (!sk)
- 		goto out;
-@@ -94,10 +93,10 @@ static int rds_release(struct socket *sock)
- 	rds_rdma_drop_keys(rs);
- 	rds_notify_queue_get(rs, NULL);
- 
--	spin_lock_irqsave(&rds_sock_lock, flags);
-+	spin_lock_bh(&rds_sock_lock);
- 	list_del_init(&rs->rs_item);
- 	rds_sock_count--;
--	spin_unlock_irqrestore(&rds_sock_lock, flags);
-+	spin_unlock_bh(&rds_sock_lock);
- 
- 	rds_trans_put(rs->rs_transport);
- 
-@@ -409,7 +408,6 @@ static const struct proto_ops rds_proto_ops = {
- 
- static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
- {
--	unsigned long flags;
- 	struct rds_sock *rs;
- 
- 	sock_init_data(sock, sk);
-@@ -426,10 +424,10 @@ static int __rds_create(struct socket *sock, struct sock *sk, int protocol)
- 	spin_lock_init(&rs->rs_rdma_lock);
- 	rs->rs_rdma_keys = RB_ROOT;
- 
--	spin_lock_irqsave(&rds_sock_lock, flags);
-+	spin_lock_bh(&rds_sock_lock);
- 	list_add_tail(&rs->rs_item, &rds_sock_list);
- 	rds_sock_count++;
--	spin_unlock_irqrestore(&rds_sock_lock, flags);
-+	spin_unlock_bh(&rds_sock_lock);
- 
- 	return 0;
- }
-@@ -471,12 +469,11 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
- {
- 	struct rds_sock *rs;
- 	struct rds_incoming *inc;
--	unsigned long flags;
- 	unsigned int total = 0;
- 
- 	len /= sizeof(struct rds_info_message);
- 
--	spin_lock_irqsave(&rds_sock_lock, flags);
-+	spin_lock_bh(&rds_sock_lock);
- 
- 	list_for_each_entry(rs, &rds_sock_list, rs_item) {
- 		read_lock(&rs->rs_recv_lock);
-@@ -492,7 +489,7 @@ static void rds_sock_inc_info(struct socket *sock, unsigned int len,
- 		read_unlock(&rs->rs_recv_lock);
- 	}
- 
--	spin_unlock_irqrestore(&rds_sock_lock, flags);
-+	spin_unlock_bh(&rds_sock_lock);
- 
- 	lens->nr = total;
- 	lens->each = sizeof(struct rds_info_message);
-@@ -504,11 +501,10 @@ static void rds_sock_info(struct socket *sock, unsigned int len,
- {
- 	struct rds_info_socket sinfo;
- 	struct rds_sock *rs;
--	unsigned long flags;
- 
- 	len /= sizeof(struct rds_info_socket);
- 
--	spin_lock_irqsave(&rds_sock_lock, flags);
-+	spin_lock_bh(&rds_sock_lock);
- 
- 	if (len < rds_sock_count)
- 		goto out;
-@@ -529,7 +525,7 @@ out:
- 	lens->nr = rds_sock_count;
- 	lens->each = sizeof(struct rds_info_socket);
- 
--	spin_unlock_irqrestore(&rds_sock_lock, flags);
-+	spin_unlock_bh(&rds_sock_lock);
- }
- 
- static void rds_exit(void)
-diff --git a/net/socket.c b/net/socket.c
-index 2877647..2dce67a 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -2472,7 +2472,7 @@ int sock_register(const struct net_proto_family *ops)
- 				      lockdep_is_held(&net_family_lock)))
- 		err = -EEXIST;
- 	else {
--		RCU_INIT_POINTER(net_families[ops->family], ops);
-+		rcu_assign_pointer(net_families[ops->family], ops);
- 		err = 0;
- 	}
- 	spin_unlock(&net_family_lock);
-diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
-index afb5655..db0efde 100644
---- a/net/sunrpc/auth_gss/auth_gss.c
-+++ b/net/sunrpc/auth_gss/auth_gss.c
-@@ -122,7 +122,7 @@ gss_cred_set_ctx(struct rpc_cred *cred, struct gss_cl_ctx *ctx)
- 	if (!test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags))
- 		return;
- 	gss_get_ctx(ctx);
--	RCU_INIT_POINTER(gss_cred->gc_ctx, ctx);
-+	rcu_assign_pointer(gss_cred->gc_ctx, ctx);
- 	set_bit(RPCAUTH_CRED_UPTODATE, &cred->cr_flags);
- 	smp_mb__before_clear_bit();
- 	clear_bit(RPCAUTH_CRED_NEW, &cred->cr_flags);
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index b595a3d..d99678a 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -1915,7 +1915,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
- 		struct sk_buff *skb;
- 
- 		unix_state_lock(sk);
--		skb = skb_dequeue(&sk->sk_receive_queue);
-+		skb = skb_peek(&sk->sk_receive_queue);
- 		if (skb == NULL) {
- 			unix_sk(sk)->recursion_level = 0;
- 			if (copied >= target)
-@@ -1955,11 +1955,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
- 		if (check_creds) {
- 			/* Never glue messages from different writers */
- 			if ((UNIXCB(skb).pid  != siocb->scm->pid) ||
--			    (UNIXCB(skb).cred != siocb->scm->cred)) {
--				skb_queue_head(&sk->sk_receive_queue, skb);
--				sk->sk_data_ready(sk, skb->len);
-+			    (UNIXCB(skb).cred != siocb->scm->cred))
- 				break;
--			}
- 		} else {
- 			/* Copy credentials */
- 			scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
-@@ -1974,8 +1971,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
- 
- 		chunk = min_t(unsigned int, skb->len, size);
- 		if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
--			skb_queue_head(&sk->sk_receive_queue, skb);
--			sk->sk_data_ready(sk, skb->len);
- 			if (copied == 0)
- 				copied = -EFAULT;
- 			break;
-@@ -1990,13 +1985,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
- 			if (UNIXCB(skb).fp)
- 				unix_detach_fds(siocb->scm, skb);
- 
--			/* put the skb back if we didn't use it up.. */
--			if (skb->len) {
--				skb_queue_head(&sk->sk_receive_queue, skb);
--				sk->sk_data_ready(sk, skb->len);
-+			if (skb->len)
- 				break;
--			}
- 
-+			skb_unlink(skb, &sk->sk_receive_queue);
- 			consume_skb(skb);
- 
- 			if (siocb->scm->fp)
-@@ -2007,9 +1999,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
- 			if (UNIXCB(skb).fp)
- 				siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
- 
--			/* put message back and return */
--			skb_queue_head(&sk->sk_receive_queue, skb);
--			sk->sk_data_ready(sk, skb->len);
- 			break;
- 		}
- 	} while (size);
-diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
-index d0a42df..7cae73e 100644
---- a/net/xfrm/xfrm_user.c
-+++ b/net/xfrm/xfrm_user.c
-@@ -2927,7 +2927,7 @@ static int __net_init xfrm_user_net_init(struct net *net)
- 	if (nlsk == NULL)
- 		return -ENOMEM;
- 	net->xfrm.nlsk_stash = nlsk; /* Don't set to NULL */
--	RCU_INIT_POINTER(net->xfrm.nlsk, nlsk);
-+	rcu_assign_pointer(net->xfrm.nlsk, nlsk);
- 	return 0;
- }
- 
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 5b2b75b..192e6c0 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -461,6 +461,7 @@ struct azx {
- 	unsigned int irq_pending_warned :1;
- 	unsigned int probing :1; /* codec probing phase */
- 	unsigned int snoop:1;
-+	unsigned int align_buffer_size:1;
- 
- 	/* for debugging */
- 	unsigned int last_cmd[AZX_MAX_CODECS];
-@@ -1697,7 +1698,7 @@ static int azx_pcm_open(struct snd_pcm_substream *substream)
- 	runtime->hw.rates = hinfo->rates;
- 	snd_pcm_limit_hw_rates(runtime);
- 	snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS);
--	if (align_buffer_size)
-+	if (chip->align_buffer_size)
- 		/* constrain buffer sizes to be multiple of 128
- 		   bytes. This is more efficient in terms of memory
- 		   access but isn't required by the HDA spec and
-@@ -2753,8 +2754,9 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
- 	}
- 
- 	/* disable buffer size rounding to 128-byte multiples if supported */
-+	chip->align_buffer_size = align_buffer_size;
- 	if (chip->driver_caps & AZX_DCAPS_BUFSIZE)
--		align_buffer_size = 0;
-+		chip->align_buffer_size = 0;
- 
- 	/* allow 64bit DMA address if supported by H/W */
- 	if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 1d07e8f..5f03c40 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -5223,6 +5223,7 @@ static const struct hda_amp_list alc861_loopbacks[] = {
- /* Pin config fixes */
- enum {
- 	PINFIX_FSC_AMILO_PI1505,
-+	PINFIX_ASUS_A6RP,
- };
- 
- static const struct alc_fixup alc861_fixups[] = {
-@@ -5234,9 +5235,19 @@ static const struct alc_fixup alc861_fixups[] = {
- 			{ }
- 		}
- 	},
-+	[PINFIX_ASUS_A6RP] = {
-+		.type = ALC_FIXUP_VERBS,
-+		.v.verbs = (const struct hda_verb[]) {
-+			/* node 0x0f VREF seems controlling the master output */
-+			{ 0x0f, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREF50 },
-+			{ }
-+		},
-+	},
- };
- 
- static const struct snd_pci_quirk alc861_fixup_tbl[] = {
-+	SND_PCI_QUIRK(0x1043, 0x1393, "ASUS A6Rp", PINFIX_ASUS_A6RP),
-+	SND_PCI_QUIRK(0x1584, 0x2b01, "Haier W18", PINFIX_ASUS_A6RP),
- 	SND_PCI_QUIRK(0x1734, 0x10c7, "FSC Amilo Pi1505", PINFIX_FSC_AMILO_PI1505),
- 	{}
- };
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index f3c73a9..ccdac27 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -4253,13 +4253,15 @@ static int enable_pin_detect(struct hda_codec *codec, hda_nid_t nid,
- 	return 1;
- }
- 
--static int is_nid_hp_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
-+static int is_nid_out_jack_pin(struct auto_pin_cfg *cfg, hda_nid_t nid)
- {
- 	int i;
- 	for (i = 0; i < cfg->hp_outs; i++)
- 		if (cfg->hp_pins[i] == nid)
- 			return 1; /* nid is a HP-Out */
--
-+	for (i = 0; i < cfg->line_outs; i++)
-+		if (cfg->line_out_pins[i] == nid)
-+			return 1; /* nid is a line-Out */
- 	return 0; /* nid is not a HP-Out */
- };
- 
-@@ -4465,7 +4467,7 @@ static int stac92xx_init(struct hda_codec *codec)
- 			continue;
- 		}
- 
--		if (is_nid_hp_pin(cfg, nid))
-+		if (is_nid_out_jack_pin(cfg, nid))
- 			continue; /* already has an unsol event */
- 
- 		pinctl = snd_hda_codec_read(codec, nid, 0,
-@@ -4950,7 +4952,14 @@ static int find_mute_led_gpio(struct hda_codec *codec, int default_polarity)
- 			/* BIOS bug: unfilled OEM string */
- 			if (strstr(dev->name, "HP_Mute_LED_P_G")) {
- 				set_hp_led_gpio(codec);
--				spec->gpio_led_polarity = 1;
-+				switch (codec->subsystem_id) {
-+				case 0x103c148a:
-+					spec->gpio_led_polarity = 0;
-+					break;
-+				default:
-+					spec->gpio_led_polarity = 1;
-+					break;
-+				}
- 				return 1;
- 			}
- 		}
-diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
-index 42d9039..d0beeec 100644
---- a/sound/soc/codecs/wm5100.c
-+++ b/sound/soc/codecs/wm5100.c
-@@ -1379,6 +1379,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
- 
- 			switch (wm5100->rev) {
- 			case 0:
-+				regcache_cache_bypass(wm5100->regmap, true);
- 				snd_soc_write(codec, 0x11, 0x3);
- 				snd_soc_write(codec, 0x203, 0xc);
- 				snd_soc_write(codec, 0x206, 0);
-@@ -1394,6 +1395,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
- 					snd_soc_write(codec,
- 						      wm5100_reva_patches[i].reg,
- 						      wm5100_reva_patches[i].val);
-+				regcache_cache_bypass(wm5100->regmap, false);
- 				break;
- 			default:
- 				break;
-@@ -1404,6 +1406,7 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
- 		break;
- 
- 	case SND_SOC_BIAS_OFF:
-+		regcache_cache_only(wm5100->regmap, true);
- 		if (wm5100->pdata.ldo_ena)
- 			gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
- 		regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
-diff --git a/sound/soc/codecs/wm8996.c b/sound/soc/codecs/wm8996.c
-index a33b04d..6d98a57 100644
---- a/sound/soc/codecs/wm8996.c
-+++ b/sound/soc/codecs/wm8996.c
-@@ -1049,7 +1049,8 @@ SND_SOC_DAPM_SUPPLY_S("SYSCLK", 1, WM8996_AIF_CLOCKING_1, 0, 0, NULL, 0),
- SND_SOC_DAPM_SUPPLY_S("SYSDSPCLK", 2, WM8996_CLOCKING_1, 1, 0, NULL, 0),
- SND_SOC_DAPM_SUPPLY_S("AIFCLK", 2, WM8996_CLOCKING_1, 2, 0, NULL, 0),
- SND_SOC_DAPM_SUPPLY_S("Charge Pump", 2, WM8996_CHARGE_PUMP_1, 15, 0, cp_event,
--		      SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
-+		      SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMU |
-+		      SND_SOC_DAPM_POST_PMD),
- SND_SOC_DAPM_SUPPLY("Bandgap", SND_SOC_NOPM, 0, 0, bg_event,
- 		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
- SND_SOC_DAPM_SUPPLY("LDO2", WM8996_POWER_MANAGEMENT_2, 1, 0, NULL, 0),
-@@ -1932,6 +1933,7 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
- 	struct wm8996_priv *wm8996 = snd_soc_codec_get_drvdata(codec);
- 	int lfclk = 0;
- 	int ratediv = 0;
-+	int sync = WM8996_REG_SYNC;
- 	int src;
- 	int old;
- 
-@@ -1976,6 +1978,7 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
- 	case 32000:
- 	case 32768:
- 		lfclk = WM8996_LFCLK_ENA;
-+		sync = 0;
- 		break;
- 	default:
- 		dev_warn(codec->dev, "Unsupported clock rate %dHz\n",
-@@ -1989,6 +1992,8 @@ static int wm8996_set_sysclk(struct snd_soc_dai *dai,
- 			    WM8996_SYSCLK_SRC_MASK | WM8996_SYSCLK_DIV_MASK,
- 			    src << WM8996_SYSCLK_SRC_SHIFT | ratediv);
- 	snd_soc_update_bits(codec, WM8996_CLOCKING_1, WM8996_LFCLK_ENA, lfclk);
-+	snd_soc_update_bits(codec, WM8996_CONTROL_INTERFACE_1,
-+			    WM8996_REG_SYNC, sync);
- 	snd_soc_update_bits(codec, WM8996_AIF_CLOCKING_1,
- 			    WM8996_SYSCLK_ENA, old);
- 
-diff --git a/sound/soc/codecs/wm8996.h b/sound/soc/codecs/wm8996.h
-index 0fde643..de9ac3e 100644
---- a/sound/soc/codecs/wm8996.h
-+++ b/sound/soc/codecs/wm8996.h
-@@ -1567,6 +1567,10 @@ int wm8996_detect(struct snd_soc_codec *codec, struct snd_soc_jack *jack,
- /*
-  * R257 (0x101) - Control Interface (1)
-  */
-+#define WM8996_REG_SYNC                         0x8000  /* REG_SYNC */
-+#define WM8996_REG_SYNC_MASK                    0x8000  /* REG_SYNC */
-+#define WM8996_REG_SYNC_SHIFT                       15  /* REG_SYNC */
-+#define WM8996_REG_SYNC_WIDTH                        1  /* REG_SYNC */
- #define WM8996_AUTO_INC                         0x0004  /* AUTO_INC */
- #define WM8996_AUTO_INC_MASK                    0x0004  /* AUTO_INC */
- #define WM8996_AUTO_INC_SHIFT                        2  /* AUTO_INC */
diff --git a/3.2.4/1003_linux-3.2.4.patch b/3.2.4/1003_linux-3.2.4.patch
deleted file mode 100644
index e49de55..0000000
--- a/3.2.4/1003_linux-3.2.4.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-diff --git a/Makefile b/Makefile
-index d45e887..c8e187e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 2
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Saber-toothed Squirrel
- 
-diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
-index d0beeec..42d9039 100644
---- a/sound/soc/codecs/wm5100.c
-+++ b/sound/soc/codecs/wm5100.c
-@@ -1379,7 +1379,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
- 
- 			switch (wm5100->rev) {
- 			case 0:
--				regcache_cache_bypass(wm5100->regmap, true);
- 				snd_soc_write(codec, 0x11, 0x3);
- 				snd_soc_write(codec, 0x203, 0xc);
- 				snd_soc_write(codec, 0x206, 0);
-@@ -1395,7 +1394,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
- 					snd_soc_write(codec,
- 						      wm5100_reva_patches[i].reg,
- 						      wm5100_reva_patches[i].val);
--				regcache_cache_bypass(wm5100->regmap, false);
- 				break;
- 			default:
- 				break;
-@@ -1406,7 +1404,6 @@ static int wm5100_set_bias_level(struct snd_soc_codec *codec,
- 		break;
- 
- 	case SND_SOC_BIAS_OFF:
--		regcache_cache_only(wm5100->regmap, true);
- 		if (wm5100->pdata.ldo_ena)
- 			gpio_set_value_cansleep(wm5100->pdata.ldo_ena, 0);
- 		regulator_bulk_disable(ARRAY_SIZE(wm5100->core_supplies),
diff --git a/3.2.4/0000_README b/3.2.5/0000_README
index 285da06..9573972 100644
--- a/3.2.4/0000_README
+++ b/3.2.5/0000_README
@@ -10,7 +10,7 @@ Patch:	1003_linux-3.2.4.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.4
 
-Patch:	4420_grsecurity-2.2.2-3.2.4-201202051927.patch
+Patch:	4420_grsecurity-2.2.2-3.2.5-201202081924.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.4/4420_grsecurity-2.2.2-3.2.4-201202051927.patch b/3.2.5/4420_grsecurity-2.2.2-3.2.5-201202081924.patch
index b2dcf41..85ac90f 100644
--- a/3.2.4/4420_grsecurity-2.2.2-3.2.4-201202051927.patch
+++ b/3.2.5/4420_grsecurity-2.2.2-3.2.5-201202081924.patch
@@ -186,7 +186,7 @@ index 81c287f..d456d02 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index c8e187e..c445af7 100644
+index e9dd0ff..e4c0733 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -2910,7 +2910,7 @@ index 73709f7..6b90313 100644
  	if (!fixed && addr) {
  		addr = _ALIGN_UP(addr, 1ul << pshift);
 diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h
-index 547f1a6..3fff354 100644
+index 547f1a6..0b22b53 100644
 --- a/arch/s390/include/asm/elf.h
 +++ b/arch/s390/include/asm/elf.h
 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
@@ -2924,8 +2924,8 @@ index 547f1a6..3fff354 100644
 +#ifdef CONFIG_PAX_ASLR
 +#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
 +
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
++#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26)
++#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26)
 +#endif
  
  /* This yields a mask that user programs can use to figure out what
@@ -13486,7 +13486,7 @@ index f3f6f53..0841b66 100644
  
  /*
 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index faf8d5e..f58c441 100644
+index faf8d5e..4f16a68 100644
 --- a/arch/x86/kernel/entry_64.S
 +++ b/arch/x86/kernel/entry_64.S
 @@ -55,6 +55,8 @@
@@ -14001,7 +14001,15 @@ index faf8d5e..f58c441 100644
  	je retint_restore_args
  	movl $_TIF_ALLWORK_MASK,%edi
  	/* edi:	mask to check */
-@@ -669,7 +966,7 @@ int_restore_rest:
+@@ -623,6 +920,7 @@ GLOBAL(int_with_check)
+ 	andl %edi,%edx
+ 	jnz   int_careful
+ 	andl    $~TS_COMPAT,TI_status(%rcx)
++	pax_erase_kstack
+ 	jmp   retint_swapgs
+ 
+ 	/* Either reschedule or signal or syscall exit tracking needed. */
+@@ -669,7 +967,7 @@ int_restore_rest:
  	TRACE_IRQS_OFF
  	jmp int_with_check
  	CFI_ENDPROC
@@ -14010,7 +14018,7 @@ index faf8d5e..f58c441 100644
  
  /*
   * Certain special system calls that need to save a complete full stack frame.
-@@ -685,7 +982,7 @@ ENTRY(\label)
+@@ -685,7 +983,7 @@ ENTRY(\label)
  	call \func
  	jmp ptregscall_common
  	CFI_ENDPROC
@@ -14019,7 +14027,7 @@ index faf8d5e..f58c441 100644
  	.endm
  
  	PTREGSCALL stub_clone, sys_clone, %r8
-@@ -703,9 +1000,10 @@ ENTRY(ptregscall_common)
+@@ -703,9 +1001,10 @@ ENTRY(ptregscall_common)
  	movq_cfi_restore R12+8, r12
  	movq_cfi_restore RBP+8, rbp
  	movq_cfi_restore RBX+8, rbx
@@ -14031,7 +14039,7 @@ index faf8d5e..f58c441 100644
  
  ENTRY(stub_execve)
  	CFI_STARTPROC
-@@ -720,7 +1018,7 @@ ENTRY(stub_execve)
+@@ -720,7 +1019,7 @@ ENTRY(stub_execve)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -14040,7 +14048,7 @@ index faf8d5e..f58c441 100644
  
  /*
   * sigreturn is special because it needs to restore all registers on return.
-@@ -738,7 +1036,7 @@ ENTRY(stub_rt_sigreturn)
+@@ -738,7 +1037,7 @@ ENTRY(stub_rt_sigreturn)
  	RESTORE_REST
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -14049,7 +14057,7 @@ index faf8d5e..f58c441 100644
  
  /*
   * Build the entry stubs and pointer table with some assembler magic.
-@@ -773,7 +1071,7 @@ vector=vector+1
+@@ -773,7 +1072,7 @@ vector=vector+1
  2:	jmp common_interrupt
  .endr
  	CFI_ENDPROC
@@ -14058,7 +14066,7 @@ index faf8d5e..f58c441 100644
  
  .previous
  END(interrupt)
-@@ -793,6 +1091,16 @@ END(interrupt)
+@@ -793,6 +1092,16 @@ END(interrupt)
  	subq $ORIG_RAX-RBP, %rsp
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
  	SAVE_ARGS_IRQ
@@ -14075,7 +14083,7 @@ index faf8d5e..f58c441 100644
  	call \func
  	.endm
  
-@@ -824,7 +1132,7 @@ ret_from_intr:
+@@ -824,7 +1133,7 @@ ret_from_intr:
  
  exit_intr:
  	GET_THREAD_INFO(%rcx)
@@ -14084,12 +14092,11 @@ index faf8d5e..f58c441 100644
  	je retint_kernel
  
  	/* Interrupt came from user space */
-@@ -846,12 +1154,16 @@ retint_swapgs:		/* return to user-space */
+@@ -846,12 +1155,15 @@ retint_swapgs:		/* return to user-space */
  	 * The iretq could re-enable interrupts:
  	 */
  	DISABLE_INTERRUPTS(CLBR_ANY)
 +	pax_exit_kernel_user
-+	pax_erase_kstack
  	TRACE_IRQS_IRETQ
  	SWAPGS
  	jmp restore_args
@@ -21424,7 +21431,7 @@ index d0474ad..36e9257 100644
  		extern u32 pnp_bios_is_utter_crap;
  		pnp_bios_is_utter_crap = 1;
 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 5db0490..13bd09c 100644
+index 5db0490..2ddce45 100644
 --- a/arch/x86/mm/fault.c
 +++ b/arch/x86/mm/fault.c
 @@ -13,11 +13,18 @@
@@ -21528,7 +21535,7 @@ index 5db0490..13bd09c 100644
  		spin_lock(&pgd_lock);
 +
 +#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++		for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
 +			pgd_t *pgd = get_cpu_pgd(cpu);
 +			pmd_t *ret;
 +#else
@@ -22396,7 +22403,7 @@ index f581a18..29efd37 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 87488b9..a55509f 100644
+index 87488b9..399f416 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -15,6 +15,7 @@
@@ -22463,7 +22470,7 @@ index 87488b9..a55509f 100644
 +	limit = (limit - 1UL) >> PAGE_SHIFT;
 +
 +	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++	for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
 +		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
 +		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
 +	}
@@ -22813,7 +22820,7 @@ index 29f7c6d..b46b35b 100644
  	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
  		size >> 10);
 diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
-index bbaaa00..16dffad 100644
+index bbaaa00..796fa65 100644
 --- a/arch/x86/mm/init_64.c
 +++ b/arch/x86/mm/init_64.c
 @@ -75,7 +75,7 @@ early_param("gbpages", parse_direct_gbpages_on);
@@ -22842,7 +22849,7 @@ index bbaaa00..16dffad 100644
  		spin_lock(&pgd_lock);
 +
 +#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++		for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
 +			pgd_t *pgd = pgd_offset_cpu(cpu, address);
 +#else
  		list_for_each_entry(page, &pgd_list, lru) {
@@ -23149,7 +23156,7 @@ index b008656..773eac2 100644
  
  struct split_state {
 diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
-index f9e5267..6f6e27f 100644
+index f9e5267..77b1a40 100644
 --- a/arch/x86/mm/pageattr.c
 +++ b/arch/x86/mm/pageattr.c
 @@ -261,7 +261,7 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
@@ -23213,7 +23220,7 @@ index f9e5267..6f6e27f 100644
 +#endif
  
 +#ifdef CONFIG_PAX_PER_CPU_PGD
-+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
++		for (cpu = 0; cpu < nr_cpu_ids; ++cpu) {
 +			pgd_t *pgd = get_cpu_pgd(cpu);
 +#else
  		list_for_each_entry(page, &pgd_list, lru) {
@@ -23337,7 +23344,7 @@ index 9f0614d..92ae64a 100644
  	p += get_opcode(p, &opcode);
  	for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index 8573b83..6372501 100644
+index 8573b83..c3b1a30 100644
 --- a/arch/x86/mm/pgtable.c
 +++ b/arch/x86/mm/pgtable.c
 @@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *pgd)
@@ -23376,7 +23383,7 @@ index 8573b83..6372501 100644
 +#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
 +#define pxd_free(mm, pud)		pud_free((mm), (pud))
 +#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
++#define pyd_offset(mm, address)		pgd_offset((mm), (address))
 +#define PYD_SIZE			PGDIR_SIZE
 +#else
 +#define pxd_t				pmd_t
@@ -23384,7 +23391,7 @@ index 8573b83..6372501 100644
 +#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
 +#define pxd_free(mm, pud)		pmd_free((mm), (pud))
 +#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
++#define pyd_offset(mm, address)		pud_offset((mm), (address))
 +#define PYD_SIZE			PUD_SIZE
 +#endif
 +
@@ -23734,7 +23741,7 @@ index 6687022..ceabcfa 100644
 +	pax_force_retaddr
  	ret
 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 7c1b765..180e3b2 100644
+index 7c1b765..8c072c6 100644
 --- a/arch/x86/net/bpf_jit_comp.c
 +++ b/arch/x86/net/bpf_jit_comp.c
 @@ -117,6 +117,10 @@ static inline void bpf_flush_icache(void *start, void *end)
@@ -23759,7 +23766,23 @@ index 7c1b765..180e3b2 100644
  	/* Before first pass, make a rough estimation of addrs[]
  	 * each bpf instruction is translated to less than 64 bytes
  	 */
-@@ -592,11 +600,12 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -476,7 +484,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 				func = sk_load_word;
+ common_load:			seen |= SEEN_DATAREF;
+ 				if ((int)K < 0)
+-					goto out;
++					goto error;
+ 				t_offset = func - (image + addrs[i]);
+ 				EMIT1_off32(0xbe, K); /* mov imm32,%esi */
+ 				EMIT1_off32(0xe8, t_offset); /* call */
+@@ -586,17 +594,18 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+ 				break;
+ 			default:
+ 				/* hmm, too complex filter, give up with jit compiler */
+-				goto out;
++				goto error;
+ 			}
+ 			ilen = prog - temp;
  			if (image) {
  				if (unlikely(proglen + ilen > oldproglen)) {
  					pr_err("bpb_jit_compile fatal error\n");
@@ -23767,7 +23790,7 @@ index 7c1b765..180e3b2 100644
 -					module_free(NULL, image);
 -					return;
 +					module_free_exec(NULL, image);
-+					goto out;
++					goto error;
  				}
 +				pax_open_kernel();
  				memcpy(image + proglen, temp, ilen);
@@ -23775,28 +23798,38 @@ index 7c1b765..180e3b2 100644
  			}
  			proglen += ilen;
  			addrs[i] = proglen;
-@@ -617,7 +626,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -617,11 +626,9 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  			break;
  		}
  		if (proglen == oldproglen) {
 -			image = module_alloc(max_t(unsigned int,
-+			image = module_alloc_exec(max_t(unsigned int,
- 						   proglen,
- 						   sizeof(struct work_struct)));
+-						   proglen,
+-						   sizeof(struct work_struct)));
++			image = module_alloc_exec(proglen);
  			if (!image)
-@@ -639,24 +648,27 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
- 		fp->bpf_func = (void *)image;
+-				goto out;
++				goto error;
+ 		}
+ 		oldproglen = proglen;
  	}
+@@ -637,7 +644,10 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+ 		bpf_flush_icache(image, image + proglen);
+ 
+ 		fp->bpf_func = (void *)image;
+-	}
++	} else
++error:
++		kfree(fp->work);
++
  out:
-+	kfree(fp->work);
  	kfree(addrs);
  	return;
- }
+@@ -645,18 +655,20 @@ out:
  
  static void jit_free_defer(struct work_struct *arg)
  {
 -	module_free(NULL, arg);
-+	module_free_exec(NULL, ((struct bpf_jit_work*)arg)->image);
++	module_free_exec(NULL, ((struct bpf_jit_work *)arg)->image);
 +	kfree(arg);
  }
  
@@ -23867,7 +23900,7 @@ index cb29191..036766d 100644
  	return 1;
  }
 diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
-index db0e9a5..8844dea 100644
+index db0e9a5..0372c14 100644
 --- a/arch/x86/pci/pcbios.c
 +++ b/arch/x86/pci/pcbios.c
 @@ -79,50 +79,93 @@ union bios32 {
@@ -23948,7 +23981,7 @@ index db0e9a5..8844dea 100644
 +			flags |= 8;
 +		}
 +
-+		for (cpu = 0; cpu < NR_CPUS; cpu++) {
++		for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
 +			gdt = get_cpu_gdt_table(cpu);
 +			pack_descriptor(&d, address, length, 0x9b, flags);
 +			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
@@ -25025,14 +25058,14 @@ index 5d41894..22021e4 100644
  EXPORT_SYMBOL_GPL(cper_next_record_id);
  
 diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c
-index 6c47ae9..8ab9132 100644
+index 6c47ae9..abfdd63 100644
 --- a/drivers/acpi/ec_sys.c
 +++ b/drivers/acpi/ec_sys.c
 @@ -12,6 +12,7 @@
  #include <linux/acpi.h>
  #include <linux/debugfs.h>
  #include <linux/module.h>
-+#include <asm/uaccess.h>
++#include <linux/uaccess.h>
  #include "internal.h"
  
  MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
@@ -33547,7 +33580,7 @@ index 76ba8a1..20ca857 100644
  
  	/* initialize our int15 lock */
 diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
-index cbfbab1..6a9fced 100644
+index 1cfbf22..be96487 100644
 --- a/drivers/pci/pcie/aspm.c
 +++ b/drivers/pci/pcie/aspm.c
 @@ -27,9 +27,9 @@
@@ -39571,7 +39604,7 @@ index a6395bd..a5b24c4 100644
  				fd_offset + ex.a_text);
  		up_write(&current->mm->mmap_sem);
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 21ac5ee..c1090ea 100644
+index 21ac5ee..31d14e9 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -32,6 +32,7 @@
@@ -39599,7 +39632,7 @@ index 21ac5ee..c1090ea 100644
  	.core_dump	= elf_core_dump,
 +
 +#ifdef CONFIG_PAX_MPROTECT
-+		.handle_mprotect= elf_handle_mprotect,
++	.handle_mprotect= elf_handle_mprotect,
 +#endif
 +
  	.min_coredump	= ELF_EXEC_PAGESIZE,
@@ -39702,7 +39735,7 @@ index 21ac5ee..c1090ea 100644
  				error = -ENOMEM;
  				goto out_close;
  			}
-@@ -528,6 +552,348 @@ out:
+@@ -528,6 +552,351 @@ out:
  	return error;
  }
  
@@ -39891,6 +39924,7 @@ index 21ac5ee..c1090ea 100644
 +	return ~0UL;
 +}
 +
++#ifdef CONFIG_PAX_XATTR_PAX_FLAGS
 +static unsigned long pax_parse_xattr_pax_softmode(unsigned long pax_flags_softmode)
 +{
 +	unsigned long pax_flags = 0UL;
@@ -39972,6 +40006,7 @@ index 21ac5ee..c1090ea 100644
 +
 +	return pax_flags;
 +}
++#endif
 +
 +static unsigned long pax_parse_xattr_pax(struct file * const file)
 +{
@@ -40020,6 +40055,7 @@ index 21ac5ee..c1090ea 100644
 +#else
 +	return ~0UL;
 +#endif
++
 +}
 +
 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_XATTR_PAX_FLAGS)
@@ -40051,7 +40087,7 @@ index 21ac5ee..c1090ea 100644
  /*
   * These are the functions used to load ELF style executables and shared
   * libraries.  There is no binary dependent code anywhere else.
-@@ -544,6 +910,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
+@@ -544,6 +913,11 @@ static unsigned long randomize_stack_top(unsigned long stack_top)
  {
  	unsigned int random_variable = 0;
  
@@ -40063,7 +40099,7 @@ index 21ac5ee..c1090ea 100644
  	if ((current->flags & PF_RANDOMIZE) &&
  		!(current->personality & ADDR_NO_RANDOMIZE)) {
  		random_variable = get_random_int() & STACK_RND_MASK;
-@@ -562,7 +933,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -562,7 +936,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
   	unsigned long load_addr = 0, load_bias = 0;
  	int load_addr_set = 0;
  	char * elf_interpreter = NULL;
@@ -40072,7 +40108,7 @@ index 21ac5ee..c1090ea 100644
  	struct elf_phdr *elf_ppnt, *elf_phdata;
  	unsigned long elf_bss, elf_brk;
  	int retval, i;
-@@ -572,11 +943,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -572,11 +946,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  	unsigned long start_code, end_code, start_data, end_data;
  	unsigned long reloc_func_desc __maybe_unused = 0;
  	int executable_stack = EXSTACK_DEFAULT;
@@ -40085,7 +40121,7 @@ index 21ac5ee..c1090ea 100644
  
  	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
  	if (!loc) {
-@@ -713,11 +1084,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -713,11 +1087,81 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  
  	/* OK, This is the point of no return */
  	current->flags &= ~PF_FORKNOEXEC;
@@ -40168,7 +40204,7 @@ index 21ac5ee..c1090ea 100644
  	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
  		current->personality |= READ_IMPLIES_EXEC;
  
-@@ -808,6 +1249,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -808,6 +1252,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  #else
  			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
  #endif
@@ -40189,7 +40225,7 @@ index 21ac5ee..c1090ea 100644
  		}
  
  		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -840,9 +1295,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -840,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		 * allowed task size. Note that p_filesz must always be
  		 * <= p_memsz so it is only necessary to check p_memsz.
  		 */
@@ -40202,7 +40238,7 @@ index 21ac5ee..c1090ea 100644
  			/* set_brk can never work. Avoid overflows. */
  			send_sig(SIGKILL, current, 0);
  			retval = -EINVAL;
-@@ -870,6 +1325,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -870,6 +1328,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  	start_data += load_bias;
  	end_data += load_bias;
  
@@ -40214,7 +40250,7 @@ index 21ac5ee..c1090ea 100644
  	/* Calling set_brk effectively mmaps the pages that we need
  	 * for the bss and break sections.  We must do this before
  	 * mapping in the interpreter, to make sure it doesn't wind
-@@ -881,9 +1341,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -881,9 +1344,11 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		goto out_free_dentry;
  	}
  	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -40229,7 +40265,7 @@ index 21ac5ee..c1090ea 100644
  	}
  
  	if (elf_interpreter) {
-@@ -1098,7 +1560,7 @@ out:
+@@ -1098,7 +1563,7 @@ out:
   * Decide what to dump of a segment, part, all or none.
   */
  static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -40238,7 +40274,7 @@ index 21ac5ee..c1090ea 100644
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1132,7 +1594,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1132,7 +1597,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -40247,7 +40283,7 @@ index 21ac5ee..c1090ea 100644
  		goto whole;
  
  	/*
-@@ -1354,9 +1816,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1354,9 +1819,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -40259,7 +40295,7 @@ index 21ac5ee..c1090ea 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1862,14 +2324,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1862,14 +2327,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -40276,7 +40312,7 @@ index 21ac5ee..c1090ea 100644
  	return size;
  }
  
-@@ -1963,7 +2425,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1963,7 +2428,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -40285,7 +40321,7 @@ index 21ac5ee..c1090ea 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -1977,10 +2439,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1977,10 +2442,12 @@ static int elf_core_dump(struct coredump_params *cprm)
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -40298,7 +40334,7 @@ index 21ac5ee..c1090ea 100644
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -1994,7 +2458,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1994,7 +2461,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -40307,7 +40343,7 @@ index 21ac5ee..c1090ea 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2005,6 +2469,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2005,6 +2472,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -40315,7 +40351,7 @@ index 21ac5ee..c1090ea 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2029,7 +2494,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2029,7 +2497,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -40324,7 +40360,7 @@ index 21ac5ee..c1090ea 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2038,6 +2503,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2038,6 +2506,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -40332,7 +40368,7 @@ index 21ac5ee..c1090ea 100644
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2055,6 +2521,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2055,6 +2524,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -40340,7 +40376,7 @@ index 21ac5ee..c1090ea 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2075,6 +2542,97 @@ out:
+@@ -2075,6 +2545,97 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -62183,7 +62219,7 @@ index 2531811..040d4d4 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index 217ed23..32e5731 100644
+index 217ed23..ec5406f 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
@@ -62212,7 +62248,7 @@ index 217ed23..32e5731 100644
 +	unsigned int cpu;
 +	struct desc_struct *gdt;
 +
-+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
++	for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
 +		gdt = get_cpu_gdt_table(cpu);
 +		gdt[GDT_ENTRY_KERNEL_DS].type = 3;
 +		gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
@@ -70700,7 +70736,7 @@ index 83311c9a..fcf8f86 100644
   * ksize - get the actual amount of memory allocated for a given object
   * @objp: Pointer to the object
 diff --git a/mm/slob.c b/mm/slob.c
-index 8105be4..579da9d 100644
+index 8105be4..e045f96 100644
 --- a/mm/slob.c
 +++ b/mm/slob.c
 @@ -29,7 +29,7 @@
@@ -70891,7 +70927,7 @@ index 8105be4..579da9d 100644
 +
 +	type = "<process stack>";
 +	sp = slob_page(ptr);
-+	if (!PageSlab((struct page*)sp)) {
++	if (!PageSlab((struct page *)sp)) {
 +		if (object_is_on_stack(ptr, n) == -1)
 +			goto report;
 +		return;
diff --git a/3.2.4/4425_grsec_enable_xtpax.patch b/3.2.5/4425_grsec_enable_xtpax.patch
index 9735ecf..9735ecf 100644
--- a/3.2.4/4425_grsec_enable_xtpax.patch
+++ b/3.2.5/4425_grsec_enable_xtpax.patch
diff --git a/3.2.4/4430_grsec-remove-localversion-grsec.patch b/3.2.5/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.4/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.5/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.4/4435_grsec-mute-warnings.patch b/3.2.5/4435_grsec-mute-warnings.patch
index e85abd6..e85abd6 100644
--- a/3.2.4/4435_grsec-mute-warnings.patch
+++ b/3.2.5/4435_grsec-mute-warnings.patch
diff --git a/3.2.4/4440_grsec-remove-protected-paths.patch b/3.2.5/4440_grsec-remove-protected-paths.patch
index 4afb3e2..4afb3e2 100644
--- a/3.2.4/4440_grsec-remove-protected-paths.patch
+++ b/3.2.5/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.4/4445_grsec-pax-without-grsec.patch b/3.2.5/4445_grsec-pax-without-grsec.patch
index 9992f51..9992f51 100644
--- a/3.2.4/4445_grsec-pax-without-grsec.patch
+++ b/3.2.5/4445_grsec-pax-without-grsec.patch
diff --git a/3.2.4/4450_grsec-kconfig-default-gids.patch b/3.2.5/4450_grsec-kconfig-default-gids.patch
index 0807a4e..0807a4e 100644
--- a/3.2.4/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.5/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.4/4455_grsec-kconfig-gentoo.patch b/3.2.5/4455_grsec-kconfig-gentoo.patch
index 587b7d9..587b7d9 100644
--- a/3.2.4/4455_grsec-kconfig-gentoo.patch
+++ b/3.2.5/4455_grsec-kconfig-gentoo.patch
diff --git a/3.2.4/4460-grsec-kconfig-proc-user.patch b/3.2.5/4460-grsec-kconfig-proc-user.patch
index 72b894a..72b894a 100644
--- a/3.2.4/4460-grsec-kconfig-proc-user.patch
+++ b/3.2.5/4460-grsec-kconfig-proc-user.patch
diff --git a/3.2.4/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.5/4465_selinux-avc_audit-log-curr_ip.patch
index 7c9894c..7c9894c 100644
--- a/3.2.4/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.5/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.4/4470_disable-compat_vdso.patch b/3.2.5/4470_disable-compat_vdso.patch
index 4742d01..4742d01 100644
--- a/3.2.4/4470_disable-compat_vdso.patch
+++ b/3.2.5/4470_disable-compat_vdso.patch