Grsec/PaX: 2.9.1-{2.6.32.60,3.2.44,3.8.12}-20130508221520130508

15 files changed, 3547 insertions, 173 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 3b25af8..ec404fe 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch:	1059_linux-2.6.32.60.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch
index 31c0020..08033a1 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304292054.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201305082213.patch
@@ -85406,10 +85406,10 @@ index e89734e..5e84d8d 100644
  			return 0;
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..23e4fc1
+index 0000000..9351296
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1003 @@
+@@ -0,0 +1,1013 @@
 +#
 +# grecurity configuration
 +#
@@ -85956,6 +85956,16 @@ index 0000000..23e4fc1
 +	  tasks.  If the sysctl option is enabled, a sysctl option with
 +	  name "chroot_caps" is created.
 +
++config GRKERNSEC_CHROOT_INITRD
++	bool "Exempt initrd tasks from restrictions"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GRKERNSEC_CHROOT && BLK_DEV_RAM
++	help
++	  If you say Y here, tasks started prior to init will be exempted from
++	  grsecurity's chroot restrictions.  This option is mainly meant to
++	  resolve Plymouth's performing privileged operations unnecessarily
++	  in a chroot.
++
 +endmenu
 +menu "Kernel Auditing"
 +depends on GRKERNSEC
@@ -92363,10 +92373,10 @@ index 0000000..bc0be01
 +}
 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
 new file mode 100644
-index 0000000..80a3a4b
+index 0000000..bc7b363
 --- /dev/null
 +++ b/grsecurity/grsec_chroot.c
-@@ -0,0 +1,375 @@
+@@ -0,0 +1,388 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -92378,14 +92388,27 @@ index 0000000..80a3a4b
 +#include <linux/grsecurity.h>
 +#include <linux/grinternal.h>
 +
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++static int gr_init_ran;
++#endif
++
 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
 +{
 +#ifdef CONFIG_GRKERNSEC
 +	if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
-+	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
++	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt_root
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++			     && gr_init_ran
++#endif
++	   )
 +		task->gr_is_chrooted = 1;
-+	else
++	else {
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++		if (task->pid == 1 && !gr_init_ran)
++			gr_init_ran = 1;
++#endif
 +		task->gr_is_chrooted = 0;
++	}
 +
 +	task->gr_chroot_dentry = path->dentry;
 +#endif
@@ -107819,7 +107842,7 @@ index 04a0252..4ee2bbb 100644
  	struct tasklet_struct *list;
  
 diff --git a/kernel/sys.c b/kernel/sys.c
-index e9512b1..b436660 100644
+index e9512b1..b6c0a2e 100644
 --- a/kernel/sys.c
 +++ b/kernel/sys.c
 @@ -133,6 +133,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
@@ -107981,7 +108004,22 @@ index e9512b1..b436660 100644
  		if (gid != old_fsgid) {
  			new->fsgid = gid;
  			goto change_okay;
-@@ -1282,7 +1323,7 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
+@@ -1273,6 +1314,14 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
+ 	if (resource != RLIMIT_CPU)
+ 		goto out;
+ 
++	/* Handle the case where a fork and setuid occur and then RLIMIT_NPROC
++	   is changed to a lower value.  Since tasks can be created by the same
++	   user in between this limit change and an execve by this task, force
++	   a recheck only for this task by setting PF_NPROC_EXCEEDED
++	*/
++	if (resource == RLIMIT_NPROC)
++		current->flags |= PF_NPROC_EXCEEDED;
++
+ 	/*
+ 	 * RLIMIT_CPU handling.   Note that the kernel fails to return an error
+ 	 * code if it rejected the user's attempt to set RLIMIT_CPU.  This is a
+@@ -1282,7 +1331,7 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
  	if (new_rlim.rlim_cur == RLIM_INFINITY)
  		goto out;
  
@@ -107990,7 +108028,7 @@ index e9512b1..b436660 100644
  out:
  	return 0;
  }
-@@ -1454,7 +1495,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+@@ -1454,7 +1503,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
  			error = get_dumpable(me->mm);
  			break;
  		case PR_SET_DUMPABLE:
diff --git a/3.2.44/0000_README b/3.2.44/0000_README
index 1b7cbd6..cc13ddf 100644
--- a/3.2.44/0000_README
+++ b/3.2.44/0000_README
@@ -94,7 +94,7 @@ Patch:	1043_linux-3.2.44.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.44
 
-Patch:	4420_grsecurity-2.9.1-3.2.44-201304292055.patch
+Patch:	4420_grsecurity-2.9.1-3.2.44-201305082214.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304292055.patch b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201305082214.patch
index 258f868..b2ac53e 100644
--- a/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304292055.patch
+++ b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201305082214.patch
@@ -5713,7 +5713,7 @@ index ef9e555..331bd29 100644
  #define __read_mostly __attribute__((__section__(".data..read_mostly")))
  
 diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
-index 03f2b55..b027032 100644
+index 03f2b55..b0270327 100644
 --- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c
 +++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
 @@ -143,7 +143,7 @@ shx3_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
@@ -56585,10 +56585,10 @@ index 8a89949..6776861 100644
  xfs_init_zones(void)
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..52786fd
+index 0000000..aef8e91
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1021 @@
+@@ -0,0 +1,1031 @@
 +#
 +# grecurity configuration
 +#
@@ -57153,6 +57153,16 @@ index 0000000..52786fd
 +	  tasks.  If the sysctl option is enabled, a sysctl option with
 +	  name "chroot_caps" is created.
 +
++config GRKERNSEC_CHROOT_INITRD
++	bool "Exempt initrd tasks from restrictions"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GRKERNSEC_CHROOT && BLK_DEV_RAM
++	help
++	  If you say Y here, tasks started prior to init will be exempted from
++	  grsecurity's chroot restrictions.  This option is mainly meant to
++	  resolve Plymouth's performing privileged operations unnecessarily
++	  in a chroot.
++
 +endmenu
 +menu "Kernel Auditing"
 +depends on GRKERNSEC
@@ -63589,10 +63599,10 @@ index 0000000..bc0be01
 +}
 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
 new file mode 100644
-index 0000000..9ab3ba3
+index 0000000..8124c0d
 --- /dev/null
 +++ b/grsecurity/grsec_chroot.c
-@@ -0,0 +1,340 @@
+@@ -0,0 +1,353 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -63604,14 +63614,27 @@ index 0000000..9ab3ba3
 +#include <linux/grsecurity.h>
 +#include <linux/grinternal.h>
 +
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++static int gr_init_ran;
++#endif
++
 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
 +{
 +#ifdef CONFIG_GRKERNSEC
 +	if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
-+	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
++	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt_root
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++			     && gr_init_ran
++#endif
++	   )
 +		task->gr_is_chrooted = 1;
-+	else
++	else {
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++		if (task->pid == 1 && !gr_init_ran)
++			gr_init_ran = 1;
++#endif
 +		task->gr_is_chrooted = 0;
++	}
 +
 +	task->gr_chroot_dentry = path->dentry;
 +#endif
@@ -72956,6 +72979,18 @@ index a15432da..9459dcc 100644
  
  
  /* Structure to track chunk fragments that have been acked, but peer
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index c2e542b..6ca975b 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/types.h>
+ 
++extern void net_secret_init(void);
+ extern __u32 secure_ip_id(__be32 daddr);
+ extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+ extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
 diff --git a/include/net/sock.h b/include/net/sock.h
 index ddf523c..1f06685 100644
 --- a/include/net/sock.h
@@ -78156,7 +78191,7 @@ index 2f194e9..2c05ea9 100644
  	.priority	= 10,
  };
 diff --git a/kernel/sys.c b/kernel/sys.c
-index be5fa8b..3f10c33 100644
+index be5fa8b..bb69d33 100644
 --- a/kernel/sys.c
 +++ b/kernel/sys.c
 @@ -158,6 +158,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
@@ -78304,7 +78339,21 @@ index be5fa8b..3f10c33 100644
  				__OLD_UTS_LEN);
  	error |= __put_user(0, name->machine + __OLD_UTS_LEN);
  	up_read(&uts_sem);
-@@ -1724,7 +1760,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+@@ -1461,6 +1497,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+ 			 */
+ 			new_rlim->rlim_cur = 1;
+ 		}
++		/* Handle the case where a fork and setuid occur and then RLIMIT_NPROC
++		   is changed to a lower value.  Since tasks can be created by the same
++		   user in between this limit change and an execve by this task, force
++		   a recheck only for this task by setting PF_NPROC_EXCEEDED
++		*/
++		if (resource == RLIMIT_NPROC)
++			tsk->flags |= PF_NPROC_EXCEEDED;
+ 	}
+ 	if (!retval) {
+ 		if (old_rlim)
+@@ -1724,7 +1767,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
  			error = get_dumpable(me->mm);
  			break;
  		case PR_SET_DUMPABLE:
@@ -83536,7 +83585,7 @@ index ea3f83b..001a216 100644
  	.next		= NULL,
  };
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 5c028e2..83e69ea 100644
+index 5c028e2..a3e026d 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -57,6 +57,7 @@
@@ -83631,20 +83680,6 @@ index 5c028e2..83e69ea 100644
  
  	if (order && (gfp_flags & __GFP_COMP))
  		prep_compound_page(page, order);
-@@ -3395,7 +3434,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
- 	unsigned long pfn;
- 
- 	for (pfn = start_pfn; pfn < end_pfn; pfn++) {
-+#ifdef CONFIG_X86_32
-+		/* boot failures in VMware 8 on 32bit vanilla since
-+		   this change */
-+		if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
-+#else
- 		if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
-+#endif
- 			return 1;
- 	}
- 	return 0;
 diff --git a/mm/percpu.c b/mm/percpu.c
 index 5c29750..99f6386 100644
 --- a/mm/percpu.c
@@ -86450,6 +86485,24 @@ index ff52ad0..aff1c0f 100644
  	     i++, cmfptr++)
  	{
  		int new_fd;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index 925991a..209a505 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -12,12 +12,10 @@
+ 
+ static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+ 
+-static int __init net_secret_init(void)
++void net_secret_init(void)
+ {
+ 	get_random_bytes(net_secret, sizeof(net_secret));
+-	return 0;
+ }
+-late_initcall(net_secret_init);
+ 
+ #ifdef CONFIG_INET
+ static u32 seq_scale(u32 seq)
 diff --git a/net/core/sock.c b/net/core/sock.c
 index 2c73adf..d7698ef 100644
 --- a/net/core/sock.c
@@ -86688,10 +86741,30 @@ index 39a2d29..f39c0fe 100644
  	  Econet is a fairly old and slow networking protocol mainly used by
  	  Acorn computers to access file and print servers. It uses native
 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 5d228de..27dfa3c 100644
+index 5d228de..91bdee5 100644
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1612,7 +1612,7 @@ static __net_exit void ipv4_mib_exit_net(struct net *net)
+@@ -114,6 +114,7 @@
+ #include <net/inet_common.h>
+ #include <net/xfrm.h>
+ #include <net/net_namespace.h>
++#include <net/secure_seq.h>
+ #ifdef CONFIG_IP_MROUTE
+ #include <linux/mroute.h>
+ #endif
+@@ -241,8 +242,10 @@ void build_ehash_secret(void)
+ 		get_random_bytes(&rnd, sizeof(rnd));
+ 	} while (rnd == 0);
+ 
+-	if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
++	if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
+ 		get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
++		net_secret_init();
++	}
+ }
+ EXPORT_SYMBOL(build_ehash_secret);
+ 
+@@ -1612,7 +1615,7 @@ static __net_exit void ipv4_mib_exit_net(struct net *net)
  	snmp_mib_free((void __percpu **)net->mib.tcp_statistics);
  }
  
@@ -86700,7 +86773,7 @@ index 5d228de..27dfa3c 100644
  	.init = ipv4_mib_init_net,
  	.exit = ipv4_mib_exit_net,
  };
-@@ -1646,13 +1646,9 @@ static int __init inet_init(void)
+@@ -1646,13 +1649,9 @@ static int __init inet_init(void)
  
  	BUILD_BUG_ON(sizeof(struct inet_skb_parm) > sizeof(dummy_skb->cb));
  
@@ -86715,7 +86788,7 @@ index 5d228de..27dfa3c 100644
  
  	rc = proto_register(&udp_prot, 1);
  	if (rc)
-@@ -1759,8 +1755,6 @@ out_unregister_udp_proto:
+@@ -1759,8 +1758,6 @@ out_unregister_udp_proto:
  	proto_unregister(&udp_prot);
  out_unregister_tcp_proto:
  	proto_unregister(&tcp_prot);
@@ -89533,18 +89606,9 @@ index 835fcea..d9fb2db 100644
  	return 0;
  }
 diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
-index d65f699..05aa6ce 100644
+index d65f699..855d175 100644
 --- a/net/phonet/af_phonet.c
 +++ b/net/phonet/af_phonet.c
-@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
- {
- 	struct phonet_protocol *pp;
- 
--	if (protocol >= PHONET_NPROTO)
-+	if (protocol < 0 || protocol >= PHONET_NPROTO)
- 		return NULL;
- 
- 	rcu_read_lock();
 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
  {
  	int err = 0;
@@ -90110,6 +90174,19 @@ index 8104278..300d89d 100644
  }
  
  /* Initialize IPv6 support and register with socket layer.  */
+diff --git a/net/sctp/probe.c b/net/sctp/probe.c
+index bc6cd75..749e4eb 100644
+--- a/net/sctp/probe.c
++++ b/net/sctp/probe.c
+@@ -63,7 +63,7 @@ static struct {
+ 	struct timespec	  tstart;
+ } sctpw;
+ 
+-static void printl(const char *fmt, ...)
++static __printf(1, 2) void printl(const char *fmt, ...)
+ {
+ 	va_list args;
+ 	int len;
 diff --git a/net/sctp/proc.c b/net/sctp/proc.c
 index 1e2eee8..ce3967e 100644
 --- a/net/sctp/proc.c
diff --git a/3.8.11/0000_README b/3.8.12/0000_README
index 40dc014..00ed718 100644
--- a/3.8.11/0000_README
+++ b/3.8.12/0000_README
@@ -6,7 +6,11 @@ Patch:	1010_linux-3.8.11.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.8.11
 
-Patch:	4420_grsecurity-2.9.1-3.8.11-201305011917.patch
+Patch:	1011_linux-3.8.12.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.8.12
+
+Patch:	4420_grsecurity-2.9.1-3.8.12-201305082215.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.8.11/1010_linux-3.8.11.patch b/3.8.12/1010_linux-3.8.11.patch
index 244c734..244c734 100644
--- a/3.8.11/1010_linux-3.8.11.patch
+++ b/3.8.12/1010_linux-3.8.11.patch
diff --git a/3.8.12/1011_linux-3.8.12.patch b/3.8.12/1011_linux-3.8.12.patch
new file mode 100644
index 0000000..4fb38f8
--- /dev/null
+++ b/3.8.12/1011_linux-3.8.12.patch
@@ -0,0 +1,3136 @@
+diff --git a/Makefile b/Makefile
+index 7e4eee5..902974f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 11
++SUBLEVEL = 12
+ EXTRAVERSION =
+ NAME = Displaced Humerus Anterior
+ 
+diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
+index cb7bcc5..02b70a4 100644
+--- a/arch/arm/boot/dts/at91sam9260.dtsi
++++ b/arch/arm/boot/dts/at91sam9260.dtsi
+@@ -158,8 +158,8 @@
+ 				usart1 {
+ 					pinctrl_usart1: usart1-0 {
+ 						atmel,pins =
+-							<2 6 0x1 0x1	/* PB6 periph A with pullup */
+-							 2 7 0x1 0x0>;	/* PB7 periph A */
++							<1 6 0x1 0x1	/* PB6 periph A with pullup */
++							 1 7 0x1 0x0>;	/* PB7 periph A */
+ 					};
+ 
+ 					pinctrl_usart1_rts: usart1_rts-0 {
+@@ -194,18 +194,18 @@
+ 				usart3 {
+ 					pinctrl_usart3: usart3-0 {
+ 						atmel,pins =
+-							<2 10 0x1 0x1	/* PB10 periph A with pullup */
+-							 2 11 0x1 0x0>;	/* PB11 periph A */
++							<1 10 0x1 0x1	/* PB10 periph A with pullup */
++							 1 11 0x1 0x0>;	/* PB11 periph A */
+ 					};
+ 
+ 					pinctrl_usart3_rts: usart3_rts-0 {
+ 						atmel,pins =
+-							<3 8 0x2 0x0>;	/* PB8 periph B */
++							<2 8 0x2 0x0>;	/* PC8 periph B */
+ 					};
+ 
+ 					pinctrl_usart3_cts: usart3_cts-0 {
+ 						atmel,pins =
+-							<3 10 0x2 0x0>;	/* PB10 periph B */
++							<2 10 0x2 0x0>;	/* PC10 periph B */
+ 					};
+ 				};
+ 
+@@ -220,8 +220,8 @@
+ 				uart1 {
+ 					pinctrl_uart1: uart1-0 {
+ 						atmel,pins =
+-							<2 12 0x1 0x1	/* PB12 periph A with pullup */
+-							 2 13 0x1 0x0>;	/* PB13 periph A */
++							<1 12 0x1 0x1	/* PB12 periph A with pullup */
++							 1 13 0x1 0x0>;	/* PB13 periph A */
+ 					};
+ 				};
+ 
+diff --git a/arch/arm/boot/dts/at91sam9g15.dtsi b/arch/arm/boot/dts/at91sam9g15.dtsi
+index fbe7a70..28467fd 100644
+--- a/arch/arm/boot/dts/at91sam9g15.dtsi
++++ b/arch/arm/boot/dts/at91sam9g15.dtsi
+@@ -10,7 +10,7 @@
+ 
+ / {
+ 	model = "Atmel AT91SAM9G15 SoC";
+-	compatible = "atmel, at91sam9g15, atmel,at91sam9x5";
++	compatible = "atmel,at91sam9g15", "atmel,at91sam9x5";
+ 
+ 	ahb {
+ 		apb {
+diff --git a/arch/arm/boot/dts/at91sam9g15ek.dts b/arch/arm/boot/dts/at91sam9g15ek.dts
+index 86dd3f6..5427b2d 100644
+--- a/arch/arm/boot/dts/at91sam9g15ek.dts
++++ b/arch/arm/boot/dts/at91sam9g15ek.dts
+@@ -11,6 +11,6 @@
+ /include/ "at91sam9x5ek.dtsi"
+ 
+ / {
+-	model = "Atmel AT91SAM9G25-EK";
++	model = "Atmel AT91SAM9G15-EK";
+ 	compatible = "atmel,at91sam9g15ek", "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
+ };
+diff --git a/arch/arm/boot/dts/at91sam9g25.dtsi b/arch/arm/boot/dts/at91sam9g25.dtsi
+index 05a718f..5fd32df 100644
+--- a/arch/arm/boot/dts/at91sam9g25.dtsi
++++ b/arch/arm/boot/dts/at91sam9g25.dtsi
+@@ -10,7 +10,7 @@
+ 
+ / {
+ 	model = "Atmel AT91SAM9G25 SoC";
+-	compatible = "atmel, at91sam9g25, atmel,at91sam9x5";
++	compatible = "atmel,at91sam9g25", "atmel,at91sam9x5";
+ 
+ 	ahb {
+ 		apb {
+diff --git a/arch/arm/boot/dts/at91sam9g35.dtsi b/arch/arm/boot/dts/at91sam9g35.dtsi
+index f9d14a7..d6fa8af 100644
+--- a/arch/arm/boot/dts/at91sam9g35.dtsi
++++ b/arch/arm/boot/dts/at91sam9g35.dtsi
+@@ -10,7 +10,7 @@
+ 
+ / {
+ 	model = "Atmel AT91SAM9G35 SoC";
+-	compatible = "atmel, at91sam9g35, atmel,at91sam9x5";
++	compatible = "atmel,at91sam9g35", "atmel,at91sam9x5";
+ 
+ 	ahb {
+ 		apb {
+diff --git a/arch/arm/boot/dts/at91sam9x25.dtsi b/arch/arm/boot/dts/at91sam9x25.dtsi
+index 54eb33b..9ac2bc2 100644
+--- a/arch/arm/boot/dts/at91sam9x25.dtsi
++++ b/arch/arm/boot/dts/at91sam9x25.dtsi
+@@ -10,7 +10,7 @@
+ 
+ / {
+ 	model = "Atmel AT91SAM9X25 SoC";
+-	compatible = "atmel, at91sam9x25, atmel,at91sam9x5";
++	compatible = "atmel,at91sam9x25", "atmel,at91sam9x5";
+ 
+ 	ahb {
+ 		apb {
+diff --git a/arch/arm/boot/dts/at91sam9x35.dtsi b/arch/arm/boot/dts/at91sam9x35.dtsi
+index fb102d6..ba67d83 100644
+--- a/arch/arm/boot/dts/at91sam9x35.dtsi
++++ b/arch/arm/boot/dts/at91sam9x35.dtsi
+@@ -10,7 +10,7 @@
+ 
+ / {
+ 	model = "Atmel AT91SAM9X35 SoC";
+-	compatible = "atmel, at91sam9x35, atmel,at91sam9x5";
++	compatible = "atmel,at91sam9x35", "atmel,at91sam9x5";
+ 
+ 	ahb {
+ 		apb {
+diff --git a/arch/arm/boot/dts/at91sam9x5ek.dtsi b/arch/arm/boot/dts/at91sam9x5ek.dtsi
+index 8a7cf1d..ccab256 100644
+--- a/arch/arm/boot/dts/at91sam9x5ek.dtsi
++++ b/arch/arm/boot/dts/at91sam9x5ek.dtsi
+@@ -13,7 +13,7 @@
+ 	compatible = "atmel,at91sam9x5ek", "atmel,at91sam9x5", "atmel,at91sam9";
+ 
+ 	chosen {
+-		bootargs = "128M console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
++		bootargs = "console=ttyS0,115200 root=/dev/mtdblock1 rw rootfstype=ubifs ubi.mtd=1 root=ubi0:rootfs";
+ 	};
+ 
+ 	ahb {
+diff --git a/arch/arm/configs/at91sam9g45_defconfig b/arch/arm/configs/at91sam9g45_defconfig
+index 606d48f..8aab786 100644
+--- a/arch/arm/configs/at91sam9g45_defconfig
++++ b/arch/arm/configs/at91sam9g45_defconfig
+@@ -173,7 +173,6 @@ CONFIG_MMC=y
+ # CONFIG_MMC_BLOCK_BOUNCE is not set
+ CONFIG_SDIO_UART=m
+ CONFIG_MMC_ATMELMCI=y
+-CONFIG_MMC_ATMELMCI_DMA=y
+ CONFIG_LEDS_ATMEL_PWM=y
+ CONFIG_LEDS_GPIO=y
+ CONFIG_LEDS_TRIGGER_TIMER=y
+diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
+index c094749..26e9ce4 100644
+--- a/arch/arm/include/asm/pgtable.h
++++ b/arch/arm/include/asm/pgtable.h
+@@ -61,6 +61,15 @@ extern void __pgd_error(const char *file, int line, pgd_t);
+ #define FIRST_USER_ADDRESS	PAGE_SIZE
+ 
+ /*
++ * Use TASK_SIZE as the ceiling argument for free_pgtables() and
++ * free_pgd_range() to avoid freeing the modules pmd when LPAE is enabled (pmd
++ * page shared between user and kernel).
++ */
++#ifdef CONFIG_ARM_LPAE
++#define USER_PGTABLES_CEILING	TASK_SIZE
++#endif
++
++/*
+  * The pgprot_* and protection_map entries will be fixed up in runtime
+  * to include the cachable and bufferable bits based on memory policy,
+  * as well as any architecture dependent bits like global/ASID and SMP
+diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c
+index 4b67847..6b4608d 100644
+--- a/arch/arm/mach-at91/setup.c
++++ b/arch/arm/mach-at91/setup.c
+@@ -333,7 +333,7 @@ static void at91_dt_rstc(void)
+ 
+ 	of_id = of_match_node(rstc_ids, np);
+ 	if (!of_id)
+-		panic("AT91: rtsc no restart function availlable\n");
++		panic("AT91: rtsc no restart function available\n");
+ 
+ 	arm_pm_restart = of_id->data;
+ 
+diff --git a/arch/arm/mach-omap2/cpuidle34xx.c b/arch/arm/mach-omap2/cpuidle34xx.c
+index 22590db..aa20002 100644
+--- a/arch/arm/mach-omap2/cpuidle34xx.c
++++ b/arch/arm/mach-omap2/cpuidle34xx.c
+@@ -265,8 +265,9 @@ static int omap3_enter_idle_bm(struct cpuidle_device *dev,
+ static DEFINE_PER_CPU(struct cpuidle_device, omap3_idle_dev);
+ 
+ static struct cpuidle_driver omap3_idle_driver = {
+-	.name =		"omap3_idle",
+-	.owner =	THIS_MODULE,
++	.name             = "omap3_idle",
++	.owner            = THIS_MODULE,
++	.en_core_tk_irqen = 1,
+ 	.states = {
+ 		{
+ 			.enter		  = omap3_enter_idle_bm,
+diff --git a/arch/arm/mach-u300/include/mach/u300-regs.h b/arch/arm/mach-u300/include/mach/u300-regs.h
+index 1e49d90..0320495 100644
+--- a/arch/arm/mach-u300/include/mach/u300-regs.h
++++ b/arch/arm/mach-u300/include/mach/u300-regs.h
+@@ -95,7 +95,7 @@
+ #define U300_SPI_BASE			(U300_FAST_PER_PHYS_BASE+0x6000)
+ 
+ /* Fast UART1 on U335 only */
+-#define U300_UART1_BASE			(U300_SLOW_PER_PHYS_BASE+0x7000)
++#define U300_UART1_BASE			(U300_FAST_PER_PHYS_BASE+0x7000)
+ 
+ /*
+  * SLOW peripherals
+diff --git a/arch/avr32/configs/favr-32_defconfig b/arch/avr32/configs/favr-32_defconfig
+index 0421498..9791820 100644
+--- a/arch/avr32/configs/favr-32_defconfig
++++ b/arch/avr32/configs/favr-32_defconfig
+@@ -122,7 +122,6 @@ CONFIG_USB_G_SERIAL=m
+ CONFIG_USB_CDC_COMPOSITE=m
+ CONFIG_MMC=y
+ CONFIG_MMC_ATMELMCI=y
+-CONFIG_MMC_ATMELMCI_DMA=y
+ CONFIG_NEW_LEDS=y
+ CONFIG_LEDS_CLASS=y
+ CONFIG_LEDS_ATMEL_PWM=m
+diff --git a/arch/avr32/configs/merisc_defconfig b/arch/avr32/configs/merisc_defconfig
+index 3befab9..65de443 100644
+--- a/arch/avr32/configs/merisc_defconfig
++++ b/arch/avr32/configs/merisc_defconfig
+@@ -102,7 +102,6 @@ CONFIG_FRAMEBUFFER_CONSOLE=y
+ CONFIG_LOGO=y
+ CONFIG_MMC=y
+ CONFIG_MMC_ATMELMCI=y
+-CONFIG_MMC_ATMELMCI_DMA=y
+ CONFIG_NEW_LEDS=y
+ CONFIG_LEDS_CLASS=y
+ CONFIG_LEDS_ATMEL_PWM=y
+diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h
+index d2bf1fd..76acbcd 100644
+--- a/arch/ia64/include/asm/futex.h
++++ b/arch/ia64/include/asm/futex.h
+@@ -106,16 +106,15 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
+ 		return -EFAULT;
+ 
+ 	{
+-		register unsigned long r8 __asm ("r8");
++		register unsigned long r8 __asm ("r8") = 0;
+ 		unsigned long prev;
+ 		__asm__ __volatile__(
+ 			"	mf;;					\n"
+-			"	mov %0=r0				\n"
+ 			"	mov ar.ccv=%4;;				\n"
+ 			"[1:]	cmpxchg4.acq %1=[%2],%3,ar.ccv		\n"
+ 			"	.xdata4 \"__ex_table\", 1b-., 2f-.	\n"
+ 			"[2:]"
+-			: "=r" (r8), "=r" (prev)
++			: "+r" (r8), "=&r" (prev)
+ 			: "r" (uaddr), "r" (newval),
+ 			  "rO" ((long) (unsigned) oldval)
+ 			: "memory");
+diff --git a/arch/ia64/include/asm/mca.h b/arch/ia64/include/asm/mca.h
+index 43f96ab..8c70961 100644
+--- a/arch/ia64/include/asm/mca.h
++++ b/arch/ia64/include/asm/mca.h
+@@ -143,6 +143,7 @@ extern unsigned long __per_cpu_mca[NR_CPUS];
+ extern int cpe_vector;
+ extern int ia64_cpe_irq;
+ extern void ia64_mca_init(void);
++extern void ia64_mca_irq_init(void);
+ extern void ia64_mca_cpu_init(void *);
+ extern void ia64_os_mca_dispatch(void);
+ extern void ia64_os_mca_dispatch_end(void);
+diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
+index ad69606..f2c41828 100644
+--- a/arch/ia64/kernel/irq.c
++++ b/arch/ia64/kernel/irq.c
+@@ -23,6 +23,8 @@
+ #include <linux/interrupt.h>
+ #include <linux/kernel_stat.h>
+ 
++#include <asm/mca.h>
++
+ /*
+  * 'what should we do if we get a hw irq event on an illegal vector'.
+  * each architecture has to answer this themselves.
+@@ -83,6 +85,12 @@ bool is_affinity_mask_valid(const struct cpumask *cpumask)
+ 
+ #endif /* CONFIG_SMP */
+ 
++int __init arch_early_irq_init(void)
++{
++	ia64_mca_irq_init();
++	return 0;
++}
++
+ #ifdef CONFIG_HOTPLUG_CPU
+ unsigned int vectors_in_migration[NR_IRQS];
+ 
+diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
+index 65bf9cd..d7396db 100644
+--- a/arch/ia64/kernel/mca.c
++++ b/arch/ia64/kernel/mca.c
+@@ -2074,22 +2074,16 @@ ia64_mca_init(void)
+ 	printk(KERN_INFO "MCA related initialization done\n");
+ }
+ 
++
+ /*
+- * ia64_mca_late_init
+- *
+- *	Opportunity to setup things that require initialization later
+- *	than ia64_mca_init.  Setup a timer to poll for CPEs if the
+- *	platform doesn't support an interrupt driven mechanism.
+- *
+- *  Inputs  :   None
+- *  Outputs :   Status
++ * These pieces cannot be done in ia64_mca_init() because it is called before
++ * early_irq_init() which would wipe out our percpu irq registrations. But we
++ * cannot leave them until ia64_mca_late_init() because by then all the other
++ * processors have been brought online and have set their own CMC vectors to
++ * point at a non-existant action. Called from arch_early_irq_init().
+  */
+-static int __init
+-ia64_mca_late_init(void)
++void __init ia64_mca_irq_init(void)
+ {
+-	if (!mca_init)
+-		return 0;
+-
+ 	/*
+ 	 *  Configure the CMCI/P vector and handler. Interrupts for CMC are
+ 	 *  per-processor, so AP CMC interrupts are setup in smp_callin() (smpboot.c).
+@@ -2108,6 +2102,23 @@ ia64_mca_late_init(void)
+ 	/* Setup the CPEI/P handler */
+ 	register_percpu_irq(IA64_CPEP_VECTOR, &mca_cpep_irqaction);
+ #endif
++}
++
++/*
++ * ia64_mca_late_init
++ *
++ *	Opportunity to setup things that require initialization later
++ *	than ia64_mca_init.  Setup a timer to poll for CPEs if the
++ *	platform doesn't support an interrupt driven mechanism.
++ *
++ *  Inputs  :   None
++ *  Outputs :   Status
++ */
++static int __init
++ia64_mca_late_init(void)
++{
++	if (!mca_init)
++		return 0;
+ 
+ 	register_hotcpu_notifier(&mca_cpu_notifier);
+ 
+diff --git a/arch/ia64/kvm/vtlb.c b/arch/ia64/kvm/vtlb.c
+index 4332f7e..a7869f8 100644
+--- a/arch/ia64/kvm/vtlb.c
++++ b/arch/ia64/kvm/vtlb.c
+@@ -256,7 +256,7 @@ u64 guest_vhpt_lookup(u64 iha, u64 *pte)
+ 			"srlz.d;;"
+ 			"ssm psr.i;;"
+ 			"srlz.d;;"
+-			: "=r"(ret) : "r"(iha), "r"(pte):"memory");
++			: "=&r"(ret) : "r"(iha), "r"(pte) : "memory");
+ 
+ 	return ret;
+ }
+diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
+index 57cf140..0c0fc7b 100644
+--- a/arch/powerpc/kernel/cpu_setup_power.S
++++ b/arch/powerpc/kernel/cpu_setup_power.S
+@@ -64,6 +64,7 @@ _GLOBAL(__restore_cpu_power8)
+ 	mflr	r11
+ 	mfmsr	r3
+ 	rldicl.	r0,r3,4,63
++	mtlr	r11
+ 	beqlr
+ 	li	r0,0
+ 	mtspr	SPRN_LPID,r0
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 3684cbd..bb11075 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -740,7 +740,7 @@ hardware_interrupt_relon_hv:
+ 		_MASKABLE_RELON_EXCEPTION_PSERIES(0x502, hardware_interrupt, EXC_HV, SOFTEN_TEST_HV)
+ 	FTR_SECTION_ELSE
+ 		_MASKABLE_RELON_EXCEPTION_PSERIES(0x500, hardware_interrupt, EXC_STD, SOFTEN_TEST_PR)
+-	ALT_FTR_SECTION_END_IFSET(CPU_FTR_ARCH_206)
++	ALT_FTR_SECTION_END_IFSET(CPU_FTR_HVMODE)
+ 	STD_RELON_EXCEPTION_PSERIES(0x4600, 0x600, alignment)
+ 	STD_RELON_EXCEPTION_PSERIES(0x4700, 0x700, program_check)
+ 	STD_RELON_EXCEPTION_PSERIES(0x4800, 0x800, fp_unavailable)
+diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
+index 116f086..1a63feb 100644
+--- a/arch/powerpc/kernel/head_64.S
++++ b/arch/powerpc/kernel/head_64.S
+@@ -490,6 +490,7 @@ _GLOBAL(copy_and_flush)
+ 	sync
+ 	addi	r5,r5,8
+ 	addi	r6,r6,8
++	isync
+ 	blr
+ 
+ .align 8
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index dba1ce2..506dc9f 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -99,6 +99,7 @@ spufs_new_inode(struct super_block *sb, umode_t mode)
+ 	if (!inode)
+ 		goto out;
+ 
++	inode->i_ino = get_next_ino();
+ 	inode->i_mode = mode;
+ 	inode->i_uid = current_fsuid();
+ 	inode->i_gid = current_fsgid();
+diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+index 93c6d39..b0f7d39 100644
+--- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
++++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S
+@@ -42,6 +42,8 @@
+  * SOFTWARE.
+  */
+ 
++#include <asm/inst.h>
++
+ ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction
+ 
+ .macro LABEL prefix n
+@@ -224,10 +226,10 @@ LABEL crc_ %i
+ 	movdqa  (bufp), %xmm0			# 2 consts: K1:K2
+ 
+ 	movq    crc_init, %xmm1			# CRC for block 1
+-	pclmulqdq $0x00,%xmm0,%xmm1		# Multiply by K2
++	PCLMULQDQ 0x00,%xmm0,%xmm1		# Multiply by K2
+ 
+ 	movq    crc1, %xmm2			# CRC for block 2
+-	pclmulqdq $0x10, %xmm0, %xmm2		# Multiply by K1
++	PCLMULQDQ 0x10, %xmm0, %xmm2		# Multiply by K1
+ 
+ 	pxor    %xmm2,%xmm1
+ 	movq    %xmm1, %rax
+diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
+index e4595f1..84b7789 100644
+--- a/arch/x86/kernel/irq.c
++++ b/arch/x86/kernel/irq.c
+@@ -165,10 +165,6 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
+ u64 arch_irq_stat(void)
+ {
+ 	u64 sum = atomic_read(&irq_err_count);
+-
+-#ifdef CONFIG_X86_IO_APIC
+-	sum += atomic_read(&irq_mis_count);
+-#endif
+ 	return sum;
+ }
+ 
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index a27e763..d330b3c 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -4030,6 +4030,10 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
+ 		break;
+ 	case OpMem8:
+ 		ctxt->memop.bytes = 1;
++		if (ctxt->memop.type == OP_REG) {
++			ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1);
++			fetch_register_operand(&ctxt->memop);
++		}
+ 		goto mem_common;
+ 	case OpMem16:
+ 		ctxt->memop.bytes = 2;
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 2262003..08c6511 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -1589,8 +1589,11 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
+ 	switch (action) {
+ 	case CPU_UP_PREPARE:
+ 		xen_vcpu_setup(cpu);
+-		if (xen_have_vector_callback)
++		if (xen_have_vector_callback) {
+ 			xen_init_lock_cpu(cpu);
++			if (xen_feature(XENFEAT_hvm_safe_pvclock))
++				xen_setup_timer(cpu);
++		}
+ 		break;
+ 	default:
+ 		break;
+diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
+index 34bc4ce..48d7b2c 100644
+--- a/arch/x86/xen/smp.c
++++ b/arch/x86/xen/smp.c
+@@ -658,6 +658,8 @@ static void xen_hvm_cpu_die(unsigned int cpu)
+ 	unbind_from_irqhandler(per_cpu(xen_debug_irq, cpu), NULL);
+ 	unbind_from_irqhandler(per_cpu(xen_callfuncsingle_irq, cpu), NULL);
+ 	unbind_from_irqhandler(per_cpu(xen_irq_work, cpu), NULL);
++	xen_uninit_lock_cpu(cpu);
++	xen_teardown_timer(cpu);
+ 	native_cpu_die(cpu);
+ }
+ 
+diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c
+index 0296a95..054cc01 100644
+--- a/arch/x86/xen/time.c
++++ b/arch/x86/xen/time.c
+@@ -497,7 +497,11 @@ static void xen_hvm_setup_cpu_clockevents(void)
+ {
+ 	int cpu = smp_processor_id();
+ 	xen_setup_runstate_info(cpu);
+-	xen_setup_timer(cpu);
++	/*
++	 * xen_setup_timer(cpu) - snprintf is bad in atomic context. Hence
++	 * doing it xen_hvm_cpu_notify (which gets called by smp_init during
++	 * early bootup and also during CPU hotplug events).
++	 */
+ 	xen_setup_cpu_clockevents();
+ }
+ 
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index bd22f86..2999966 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -642,7 +642,7 @@ void __init acpi_initrd_override(void *data, size_t size)
+ 	 * Both memblock_reserve and e820_add_region (via arch_reserve_mem_area)
+ 	 * works fine.
+ 	 */
+-	memblock_reserve(acpi_tables_addr, acpi_tables_addr + all_tables_size);
++	memblock_reserve(acpi_tables_addr, all_tables_size);
+ 	arch_reserve_mem_area(acpi_tables_addr, all_tables_size);
+ 
+ 	p = early_ioremap(acpi_tables_addr, all_tables_size);
+diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
+index eb73798..77c9a92 100644
+--- a/drivers/acpi/pci_root.c
++++ b/drivers/acpi/pci_root.c
+@@ -240,8 +240,8 @@ static acpi_status acpi_pci_query_osc(struct acpi_pci_root *root,
+ 		*control &= OSC_PCI_CONTROL_MASKS;
+ 		capbuf[OSC_CONTROL_TYPE] = *control | root->osc_control_set;
+ 	} else {
+-		/* Run _OSC query for all possible controls. */
+-		capbuf[OSC_CONTROL_TYPE] = OSC_PCI_CONTROL_MASKS;
++		/* Run _OSC query only with existing controls. */
++		capbuf[OSC_CONTROL_TYPE] = root->osc_control_set;
+ 	}
+ 
+ 	status = acpi_pci_run_osc(root->device->handle, capbuf, &result);
+diff --git a/drivers/acpi/thermal.c b/drivers/acpi/thermal.c
+index 506fbd4..25246e8 100644
+--- a/drivers/acpi/thermal.c
++++ b/drivers/acpi/thermal.c
+@@ -719,9 +719,19 @@ static int thermal_get_trend(struct thermal_zone_device *thermal,
+ 		return -EINVAL;
+ 
+ 	if (type == THERMAL_TRIP_ACTIVE) {
+-		/* aggressive active cooling */
+-		*trend = THERMAL_TREND_RAISING;
+-		return 0;
++		unsigned long trip_temp;
++		unsigned long temp = KELVIN_TO_MILLICELSIUS(tz->temperature,
++							tz->kelvin_offset);
++		if (thermal_get_trip_temp(thermal, trip, &trip_temp))
++			return -EINVAL;
++
++		if (temp > trip_temp) {
++			*trend = THERMAL_TREND_RAISING;
++			return 0;
++		} else {
++			/* Fall back on default trend */
++			return -EINVAL;
++		}
+ 	}
+ 
+ 	/*
+diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
+index ef01ac0..cc8aa9e 100644
+--- a/drivers/ata/libata-acpi.c
++++ b/drivers/ata/libata-acpi.c
+@@ -60,7 +60,8 @@ acpi_handle ata_ap_acpi_handle(struct ata_port *ap)
+ 	if (ap->flags & ATA_FLAG_ACPI_SATA)
+ 		return NULL;
+ 
+-	return acpi_get_child(DEVICE_ACPI_HANDLE(ap->host->dev), ap->port_no);
++	return ap->scsi_host ?
++		DEVICE_ACPI_HANDLE(&ap->scsi_host->shost_gendev) : NULL;
+ }
+ EXPORT_SYMBOL(ata_ap_acpi_handle);
+ 
+@@ -239,28 +240,15 @@ void ata_acpi_dissociate(struct ata_host *host)
+ 	}
+ }
+ 
+-/**
+- * ata_acpi_gtm - execute _GTM
+- * @ap: target ATA port
+- * @gtm: out parameter for _GTM result
+- *
+- * Evaluate _GTM and store the result in @gtm.
+- *
+- * LOCKING:
+- * EH context.
+- *
+- * RETURNS:
+- * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure.
+- */
+-int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
++static int __ata_acpi_gtm(struct ata_port *ap, acpi_handle handle,
++			  struct ata_acpi_gtm *gtm)
+ {
+ 	struct acpi_buffer output = { .length = ACPI_ALLOCATE_BUFFER };
+ 	union acpi_object *out_obj;
+ 	acpi_status status;
+ 	int rc = 0;
+ 
+-	status = acpi_evaluate_object(ata_ap_acpi_handle(ap), "_GTM", NULL,
+-				      &output);
++	status = acpi_evaluate_object(handle, "_GTM", NULL, &output);
+ 
+ 	rc = -ENOENT;
+ 	if (status == AE_NOT_FOUND)
+@@ -294,6 +282,27 @@ int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
+ 	return rc;
+ }
+ 
++/**
++ * ata_acpi_gtm - execute _GTM
++ * @ap: target ATA port
++ * @gtm: out parameter for _GTM result
++ *
++ * Evaluate _GTM and store the result in @gtm.
++ *
++ * LOCKING:
++ * EH context.
++ *
++ * RETURNS:
++ * 0 on success, -ENOENT if _GTM doesn't exist, -errno on failure.
++ */
++int ata_acpi_gtm(struct ata_port *ap, struct ata_acpi_gtm *gtm)
++{
++	if (ata_ap_acpi_handle(ap))
++		return __ata_acpi_gtm(ap, ata_ap_acpi_handle(ap), gtm);
++	else
++		return -EINVAL;
++}
++
+ EXPORT_SYMBOL_GPL(ata_acpi_gtm);
+ 
+ /**
+@@ -1095,7 +1104,7 @@ static int ata_acpi_bind_host(struct ata_port *ap, acpi_handle *handle)
+ 	if (!*handle)
+ 		return -ENODEV;
+ 
+-	if (ata_acpi_gtm(ap, &ap->__acpi_init_gtm) == 0)
++	if (__ata_acpi_gtm(ap, *handle, &ap->__acpi_init_gtm) == 0)
+ 		ap->pflags |= ATA_PFLAG_INIT_GTM_VALID;
+ 
+ 	return 0;
+diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c
+index 5dba77c..b1a664a 100644
+--- a/drivers/ata/sata_highbank.c
++++ b/drivers/ata/sata_highbank.c
+@@ -251,7 +251,7 @@ static const struct ata_port_info ahci_highbank_port_info = {
+ };
+ 
+ static struct scsi_host_template ahci_highbank_platform_sht = {
+-	AHCI_SHT("highbank-ahci"),
++	AHCI_SHT("sata_highbank"),
+ };
+ 
+ static const struct of_device_id ahci_of_match[] = {
+diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
+index 93211df..ba780b7 100644
+--- a/drivers/char/tpm/tpm.c
++++ b/drivers/char/tpm/tpm.c
+@@ -1291,7 +1291,7 @@ int tpm_pm_suspend(struct device *dev)
+ {
+ 	struct tpm_chip *chip = dev_get_drvdata(dev);
+ 	struct tpm_cmd_t cmd;
+-	int rc;
++	int rc, try;
+ 
+ 	u8 dummy_hash[TPM_DIGEST_SIZE] = { 0 };
+ 
+@@ -1309,9 +1309,32 @@ int tpm_pm_suspend(struct device *dev)
+ 	}
+ 
+ 	/* now do the actual savestate */
+-	cmd.header.in = savestate_header;
+-	rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE,
+-			  "sending savestate before suspend");
++	for (try = 0; try < TPM_RETRY; try++) {
++		cmd.header.in = savestate_header;
++		rc = transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, NULL);
++
++		/*
++		 * If the TPM indicates that it is too busy to respond to
++		 * this command then retry before giving up.  It can take
++		 * several seconds for this TPM to be ready.
++		 *
++		 * This can happen if the TPM has already been sent the
++		 * SaveState command before the driver has loaded.  TCG 1.2
++		 * specification states that any communication after SaveState
++		 * may cause the TPM to invalidate previously saved state.
++		 */
++		if (rc != TPM_WARN_RETRY)
++			break;
++		msleep(TPM_TIMEOUT_RETRY);
++	}
++
++	if (rc)
++		dev_err(chip->dev,
++			"Error (%d) sending savestate before suspend\n", rc);
++	else if (try > 0)
++		dev_warn(chip->dev, "TPM savestate took %dms\n",
++			 try * TPM_TIMEOUT_RETRY);
++
+ 	return rc;
+ }
+ EXPORT_SYMBOL_GPL(tpm_pm_suspend);
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index 8ef7649..9c12a52 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -32,10 +32,12 @@ enum tpm_const {
+ 	TPM_MINOR = 224,	/* officially assigned */
+ 	TPM_BUFSIZE = 4096,
+ 	TPM_NUM_DEVICES = 256,
++	TPM_RETRY = 50,		/* 5 seconds */
+ };
+ 
+ enum tpm_timeout {
+ 	TPM_TIMEOUT = 5,	/* msecs */
++	TPM_TIMEOUT_RETRY = 100 /* msecs */
+ };
+ 
+ /* TPM addresses */
+@@ -44,6 +46,7 @@ enum tpm_addr {
+ 	TPM_ADDR = 0x4E,
+ };
+ 
++#define TPM_WARN_RETRY          0x800
+ #define TPM_WARN_DOING_SELFTEST 0x802
+ #define TPM_ERR_DEACTIVATED     0x6
+ #define TPM_ERR_DISABLED        0x7
+diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
+index f042f6d..fd7d66d 100644
+--- a/drivers/i2c/busses/i2c-xiic.c
++++ b/drivers/i2c/busses/i2c-xiic.c
+@@ -312,10 +312,8 @@ static void xiic_fill_tx_fifo(struct xiic_i2c *i2c)
+ 			/* last message in transfer -> STOP */
+ 			data |= XIIC_TX_DYN_STOP_MASK;
+ 			dev_dbg(i2c->adap.dev.parent, "%s TX STOP\n", __func__);
+-
+-			xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data);
+-		} else
+-			xiic_setreg8(i2c, XIIC_DTR_REG_OFFSET, data);
++		}
++		xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET, data);
+ 	}
+ }
+ 
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index f363135..0411bde 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -1564,8 +1564,8 @@ static int super_1_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor_
+ 					     sector, count, 1) == 0)
+ 				return -EINVAL;
+ 		}
+-	} else if (sb->bblog_offset == 0)
+-		rdev->badblocks.shift = -1;
++	} else if (sb->bblog_offset != 0)
++		rdev->badblocks.shift = 0;
+ 
+ 	if (!refdev) {
+ 		ret = 1;
+@@ -3221,7 +3221,7 @@ int md_rdev_init(struct md_rdev *rdev)
+ 	 * be used - I wonder if that matters
+ 	 */
+ 	rdev->badblocks.count = 0;
+-	rdev->badblocks.shift = 0;
++	rdev->badblocks.shift = -1; /* disabled until explicitly enabled */
+ 	rdev->badblocks.page = kmalloc(PAGE_SIZE, GFP_KERNEL);
+ 	seqlock_init(&rdev->badblocks.lock);
+ 	if (rdev->badblocks.page == NULL)
+@@ -3293,9 +3293,6 @@ static struct md_rdev *md_import_device(dev_t newdev, int super_format, int supe
+ 			goto abort_free;
+ 		}
+ 	}
+-	if (super_format == -1)
+-		/* hot-add for 0.90, or non-persistent: so no badblocks */
+-		rdev->badblocks.shift = -1;
+ 
+ 	return rdev;
+ 
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index fd86b37..6af167f 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -981,7 +981,12 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
+ 	while (bio) { /* submit pending writes */
+ 		struct bio *next = bio->bi_next;
+ 		bio->bi_next = NULL;
+-		generic_make_request(bio);
++		if (unlikely((bio->bi_rw & REQ_DISCARD) &&
++		    !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
++			/* Just ignore it */
++			bio_endio(bio, 0);
++		else
++			generic_make_request(bio);
+ 		bio = next;
+ 	}
+ 	kfree(plug);
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index b3898d4..61ab219 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1087,7 +1087,12 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
+ 	while (bio) { /* submit pending writes */
+ 		struct bio *next = bio->bi_next;
+ 		bio->bi_next = NULL;
+-		generic_make_request(bio);
++		if (unlikely((bio->bi_rw & REQ_DISCARD) &&
++		    !blk_queue_discard(bdev_get_queue(bio->bi_bdev))))
++			/* Just ignore it */
++			bio_endio(bio, 0);
++		else
++			generic_make_request(bio);
+ 		bio = next;
+ 	}
+ 	kfree(plug);
+diff --git a/drivers/mfd/adp5520.c b/drivers/mfd/adp5520.c
+index 210dd03..6b40e0c 100644
+--- a/drivers/mfd/adp5520.c
++++ b/drivers/mfd/adp5520.c
+@@ -36,6 +36,7 @@ struct adp5520_chip {
+ 	struct blocking_notifier_head notifier_list;
+ 	int irq;
+ 	unsigned long id;
++	uint8_t mode;
+ };
+ 
+ static int __adp5520_read(struct i2c_client *client,
+@@ -326,7 +327,10 @@ static int adp5520_suspend(struct device *dev)
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
+ 
+-	adp5520_clr_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
++	adp5520_read(chip->dev, ADP5520_MODE_STATUS, &chip->mode);
++	/* All other bits are W1C */
++	chip->mode &= ADP5520_BL_EN | ADP5520_DIM_EN | ADP5520_nSTNBY;
++	adp5520_write(chip->dev, ADP5520_MODE_STATUS, 0);
+ 	return 0;
+ }
+ 
+@@ -335,7 +339,7 @@ static int adp5520_resume(struct device *dev)
+ 	struct i2c_client *client = to_i2c_client(dev);
+ 	struct adp5520_chip *chip = dev_get_drvdata(&client->dev);
+ 
+-	adp5520_set_bits(chip->dev, ADP5520_MODE_STATUS, ADP5520_nSTNBY);
++	adp5520_write(chip->dev, ADP5520_MODE_STATUS, chip->mode);
+ 	return 0;
+ }
+ #endif
+diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
+index 089e8ea..2743b7d 100644
+--- a/drivers/mmc/core/mmc.c
++++ b/drivers/mmc/core/mmc.c
+@@ -368,13 +368,13 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd)
+ 		ext_csd[EXT_CSD_SEC_FEATURE_SUPPORT];
+ 	card->ext_csd.raw_trim_mult =
+ 		ext_csd[EXT_CSD_TRIM_MULT];
++	card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT];
+ 	if (card->ext_csd.rev >= 4) {
+ 		/*
+ 		 * Enhanced area feature support -- check whether the eMMC
+ 		 * card has the Enhanced area enabled.  If so, export enhanced
+ 		 * area offset and size to user by adding sysfs interface.
+ 		 */
+-		card->ext_csd.raw_partition_support = ext_csd[EXT_CSD_PARTITION_SUPPORT];
+ 		if ((ext_csd[EXT_CSD_PARTITION_SUPPORT] & 0x2) &&
+ 		    (ext_csd[EXT_CSD_PARTITION_ATTRIBUTE] & 0x1)) {
+ 			hc_erase_grp_sz =
+diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
+index 8d13c65..009dabd 100644
+--- a/drivers/mmc/host/Kconfig
++++ b/drivers/mmc/host/Kconfig
+@@ -292,16 +292,6 @@ config MMC_ATMELMCI
+ 
+ 	  If unsure, say N.
+ 
+-config MMC_ATMELMCI_DMA
+-	bool "Atmel MCI DMA support"
+-	depends on MMC_ATMELMCI && (AVR32 || ARCH_AT91SAM9G45) && DMA_ENGINE
+-	help
+-	  Say Y here to have the Atmel MCI driver use a DMA engine to
+-	  do data transfers and thus increase the throughput and
+-	  reduce the CPU utilization.
+-
+-	  If unsure, say N.
+-
+ config MMC_MSM
+ 	tristate "Qualcomm SDCC Controller Support"
+ 	depends on MMC && ARCH_MSM
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index 722af1d..e75774f 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -178,6 +178,7 @@ struct atmel_mci {
+ 	void __iomem		*regs;
+ 
+ 	struct scatterlist	*sg;
++	unsigned int		sg_len;
+ 	unsigned int		pio_offset;
+ 	unsigned int		*buffer;
+ 	unsigned int		buf_size;
+@@ -892,6 +893,7 @@ static u32 atmci_prepare_data(struct atmel_mci *host, struct mmc_data *data)
+ 	data->error = -EINPROGRESS;
+ 
+ 	host->sg = data->sg;
++	host->sg_len = data->sg_len;
+ 	host->data = data;
+ 	host->data_chan = NULL;
+ 
+@@ -1826,7 +1828,8 @@ static void atmci_read_data_pio(struct atmel_mci *host)
+ 			if (offset == sg->length) {
+ 				flush_dcache_page(sg_page(sg));
+ 				host->sg = sg = sg_next(sg);
+-				if (!sg)
++				host->sg_len--;
++				if (!sg || !host->sg_len)
+ 					goto done;
+ 
+ 				offset = 0;
+@@ -1839,7 +1842,8 @@ static void atmci_read_data_pio(struct atmel_mci *host)
+ 
+ 			flush_dcache_page(sg_page(sg));
+ 			host->sg = sg = sg_next(sg);
+-			if (!sg)
++			host->sg_len--;
++			if (!sg || !host->sg_len)
+ 				goto done;
+ 
+ 			offset = 4 - remaining;
+@@ -1890,7 +1894,8 @@ static void atmci_write_data_pio(struct atmel_mci *host)
+ 			nbytes += 4;
+ 			if (offset == sg->length) {
+ 				host->sg = sg = sg_next(sg);
+-				if (!sg)
++				host->sg_len--;
++				if (!sg || !host->sg_len)
+ 					goto done;
+ 
+ 				offset = 0;
+@@ -1904,7 +1909,8 @@ static void atmci_write_data_pio(struct atmel_mci *host)
+ 			nbytes += remaining;
+ 
+ 			host->sg = sg = sg_next(sg);
+-			if (!sg) {
++			host->sg_len--;
++			if (!sg || !host->sg_len) {
+ 				atmci_writel(host, ATMCI_TDR, value);
+ 				goto done;
+ 			}
+@@ -2487,10 +2493,8 @@ static int __exit atmci_remove(struct platform_device *pdev)
+ 	atmci_readl(host, ATMCI_SR);
+ 	clk_disable(host->mck);
+ 
+-#ifdef CONFIG_MMC_ATMELMCI_DMA
+ 	if (host->dma.chan)
+ 		dma_release_channel(host->dma.chan);
+-#endif
+ 
+ 	free_irq(platform_get_irq(pdev, 0), host);
+ 	iounmap(host->regs);
+diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c
+index 2e5daee..a3f8a25 100644
+--- a/drivers/net/ethernet/freescale/gianfar_ptp.c
++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c
+@@ -127,7 +127,6 @@ struct gianfar_ptp_registers {
+ 
+ #define DRIVER		"gianfar_ptp"
+ #define DEFAULT_CKSEL	1
+-#define N_ALARM		1 /* first alarm is used internally to reset fipers */
+ #define N_EXT_TS	2
+ #define REG_SIZE	sizeof(struct gianfar_ptp_registers)
+ 
+@@ -410,7 +409,7 @@ static struct ptp_clock_info ptp_gianfar_caps = {
+ 	.owner		= THIS_MODULE,
+ 	.name		= "gianfar clock",
+ 	.max_adj	= 512000,
+-	.n_alarm	= N_ALARM,
++	.n_alarm	= 0,
+ 	.n_ext_ts	= N_EXT_TS,
+ 	.n_per_out	= 0,
+ 	.pps		= 1,
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index 0d03d38..911956e 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -2407,6 +2407,16 @@ static irqreturn_t ixgbe_msix_other(int irq, void *data)
+ 	 * with the write to EICR.
+ 	 */
+ 	eicr = IXGBE_READ_REG(hw, IXGBE_EICS);
++
++	/* The lower 16bits of the EICR register are for the queue interrupts
++	 * which should be masked here in order to not accidently clear them if
++	 * the bits are high when ixgbe_msix_other is called. There is a race
++	 * condition otherwise which results in possible performance loss
++	 * especially if the ixgbe_msix_other interrupt is triggering
++	 * consistently (as it would when PPS is turned on for the X540 device)
++	 */
++	eicr &= 0xFFFF0000;
++
+ 	IXGBE_WRITE_REG(hw, IXGBE_EICR, eicr);
+ 
+ 	if (eicr & IXGBE_EICR_LSC)
+diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+index 5b9533e..2c056b1 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
++++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+@@ -2237,15 +2237,15 @@ static ssize_t iwl_dbgfs_log_event_read(struct file *file,
+ 					 size_t count, loff_t *ppos)
+ {
+ 	struct iwl_priv *priv = file->private_data;
+-	char *buf;
+-	int pos = 0;
+-	ssize_t ret = -ENOMEM;
++	char *buf = NULL;
++	ssize_t ret;
+ 
+-	ret = pos = iwl_dump_nic_event_log(priv, true, &buf, true);
+-	if (buf) {
+-		ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+-		kfree(buf);
+-	}
++	ret = iwl_dump_nic_event_log(priv, true, &buf, true);
++	if (ret < 0)
++		goto err;
++	ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
++err:
++	kfree(buf);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
+index bdba954..a8632a4 100644
+--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
++++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
+@@ -707,6 +707,7 @@ void iwl_clear_ucode_stations(struct iwl_priv *priv,
+ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ {
+ 	struct iwl_addsta_cmd sta_cmd;
++	static const struct iwl_link_quality_cmd zero_lq = {};
+ 	struct iwl_link_quality_cmd lq;
+ 	int i;
+ 	bool found = false;
+@@ -745,7 +746,9 @@ void iwl_restore_stations(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 				else
+ 					memcpy(&lq, priv->stations[i].lq,
+ 					       sizeof(struct iwl_link_quality_cmd));
+-				send_lq = true;
++
++				if (!memcmp(&lq, &zero_lq, sizeof(lq)))
++					send_lq = true;
+ 			}
+ 			spin_unlock_bh(&priv->sta_lock);
+ 			ret = iwl_send_add_sta(priv, &sta_cmd, CMD_SYNC);
+diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
+index 0bbea88..b7a5387 100644
+--- a/drivers/net/wireless/mwifiex/pcie.c
++++ b/drivers/net/wireless/mwifiex/pcie.c
+@@ -1831,9 +1831,9 @@ static void mwifiex_pcie_cleanup(struct mwifiex_adapter *adapter)
+ 	if (pdev) {
+ 		pci_iounmap(pdev, card->pci_mmap);
+ 		pci_iounmap(pdev, card->pci_mmap1);
+-
+-		pci_release_regions(pdev);
+ 		pci_disable_device(pdev);
++		pci_release_region(pdev, 2);
++		pci_release_region(pdev, 0);
+ 		pci_set_drvdata(pdev, NULL);
+ 	}
+ }
+diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
+index 197b446..0b55706 100644
+--- a/drivers/net/wireless/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/rt2x00/rt2800lib.c
+@@ -4386,6 +4386,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+ 
+ 	if (!rt2x00_rt(rt2x00dev, RT5390) &&
+ 	    !rt2x00_rt(rt2x00dev, RT5392)) {
++		u8 min_gain = rt2x00_rt(rt2x00dev, RT3070) ? 1 : 2;
++
+ 		rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
+ 		rt2x00_set_field8(&rfcsr, RFCSR17_TX_LO1_EN, 0);
+ 		if (rt2x00_rt(rt2x00dev, RT3070) ||
+@@ -4396,8 +4398,10 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
+ 				      &rt2x00dev->cap_flags))
+ 				rt2x00_set_field8(&rfcsr, RFCSR17_R, 1);
+ 		}
+-		rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN,
+-				  drv_data->txmixer_gain_24g);
++		if (drv_data->txmixer_gain_24g >= min_gain) {
++			rt2x00_set_field8(&rfcsr, RFCSR17_TXMIXER_GAIN,
++					  drv_data->txmixer_gain_24g);
++		}
+ 		rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+ 	}
+ 
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 5cb5820..d1b4e00 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -651,15 +651,11 @@ static int pci_platform_power_transition(struct pci_dev *dev, pci_power_t state)
+ 		error = platform_pci_set_power_state(dev, state);
+ 		if (!error)
+ 			pci_update_current_state(dev, state);
+-		/* Fall back to PCI_D0 if native PM is not supported */
+-		if (!dev->pm_cap)
+-			dev->current_state = PCI_D0;
+-	} else {
++	} else
+ 		error = -ENODEV;
+-		/* Fall back to PCI_D0 if native PM is not supported */
+-		if (!dev->pm_cap)
+-			dev->current_state = PCI_D0;
+-	}
++
++	if (error && !dev->pm_cap) /* Fall back to PCI_D0 */
++		dev->current_state = PCI_D0;
+ 
+ 	return error;
+ }
+diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
+index 16630aa..1c77423 100644
+--- a/drivers/rtc/rtc-cmos.c
++++ b/drivers/rtc/rtc-cmos.c
+@@ -805,9 +805,8 @@ static int cmos_suspend(struct device *dev)
+ 			mask = RTC_IRQMASK;
+ 		tmp &= ~mask;
+ 		CMOS_WRITE(tmp, RTC_CONTROL);
++		hpet_mask_rtc_irq_bit(mask);
+ 
+-		/* shut down hpet emulation - we don't need it for alarm */
+-		hpet_mask_rtc_irq_bit(RTC_PIE|RTC_AIE|RTC_UIE);
+ 		cmos_checkintr(cmos, tmp);
+ 	}
+ 	spin_unlock_irq(&rtc_lock);
+@@ -872,6 +871,7 @@ static int cmos_resume(struct device *dev)
+ 			rtc_update_irq(cmos->rtc, 1, mask);
+ 			tmp &= ~RTC_AIE;
+ 			hpet_mask_rtc_irq_bit(RTC_AIE);
++			hpet_rtc_timer_init();
+ 		} while (mask & RTC_AIE);
+ 		spin_unlock_irq(&rtc_lock);
+ 	}
+diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
+index c44d13f..56dcd7c 100644
+--- a/drivers/s390/char/sclp_cmd.c
++++ b/drivers/s390/char/sclp_cmd.c
+@@ -567,6 +567,8 @@ static void __init sclp_add_standby_memory(void)
+ 	add_memory_merged(0);
+ }
+ 
++#define MEM_SCT_SIZE (1UL << SECTION_SIZE_BITS)
++
+ static void __init insert_increment(u16 rn, int standby, int assigned)
+ {
+ 	struct memory_increment *incr, *new_incr;
+@@ -579,7 +581,7 @@ static void __init insert_increment(u16 rn, int standby, int assigned)
+ 	new_incr->rn = rn;
+ 	new_incr->standby = standby;
+ 	if (!standby)
+-		new_incr->usecount = 1;
++		new_incr->usecount = rzm > MEM_SCT_SIZE ? rzm/MEM_SCT_SIZE : 1;
+ 	last_rn = 0;
+ 	prev = &sclp_mem_list;
+ 	list_for_each_entry(incr, &sclp_mem_list, list) {
+diff --git a/drivers/staging/zsmalloc/Kconfig b/drivers/staging/zsmalloc/Kconfig
+index 9084565..7fab032 100644
+--- a/drivers/staging/zsmalloc/Kconfig
++++ b/drivers/staging/zsmalloc/Kconfig
+@@ -1,5 +1,5 @@
+ config ZSMALLOC
+-	tristate "Memory allocator for compressed pages"
++	bool "Memory allocator for compressed pages"
+ 	default n
+ 	help
+ 	  zsmalloc is a slab-based memory allocator designed to store
+diff --git a/drivers/staging/zsmalloc/zsmalloc-main.c b/drivers/staging/zsmalloc/zsmalloc-main.c
+index 223c736..851a2ff 100644
+--- a/drivers/staging/zsmalloc/zsmalloc-main.c
++++ b/drivers/staging/zsmalloc/zsmalloc-main.c
+@@ -657,11 +657,8 @@ static inline void __zs_unmap_object(struct mapping_area *area,
+ 				struct page *pages[2], int off, int size)
+ {
+ 	unsigned long addr = (unsigned long)area->vm_addr;
+-	unsigned long end = addr + (PAGE_SIZE * 2);
+ 
+-	flush_cache_vunmap(addr, end);
+-	unmap_kernel_range_noflush(addr, PAGE_SIZE * 2);
+-	flush_tlb_kernel_range(addr, end);
++	unmap_kernel_range(addr, PAGE_SIZE * 2);
+ }
+ 
+ #else /* USE_PGTABLE_MAPPING */
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index ac35c90..c830b60 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -675,6 +675,9 @@ static int ptmx_open(struct inode *inode, struct file *filp)
+ 
+ 	nonseekable_open(inode, filp);
+ 
++	/* We refuse fsnotify events on ptmx, since it's a shared resource */
++	filp->f_mode |= FMODE_NONOTIFY;
++
+ 	retval = tty_alloc_file(filp);
+ 	if (retval)
+ 		return retval;
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 2c7230a..4293a3e 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1940,6 +1940,8 @@ int uart_suspend_port(struct uart_driver *drv, struct uart_port *uport)
+ 		mutex_unlock(&port->mutex);
+ 		return 0;
+ 	}
++	put_device(tty_dev);
++
+ 	if (console_suspend_enabled || !uart_console(uport))
+ 		uport->suspended = 1;
+ 
+@@ -2005,9 +2007,11 @@ int uart_resume_port(struct uart_driver *drv, struct uart_port *uport)
+ 			disable_irq_wake(uport->irq);
+ 			uport->irq_wake = 0;
+ 		}
++		put_device(tty_dev);
+ 		mutex_unlock(&port->mutex);
+ 		return 0;
+ 	}
++	put_device(tty_dev);
+ 	uport->suspended = 0;
+ 
+ 	/*
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 892ecda..f34f98d 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -941,10 +941,10 @@ void start_tty(struct tty_struct *tty)
+ 
+ EXPORT_SYMBOL(start_tty);
+ 
++/* We limit tty time update visibility to every 8 seconds or so. */
+ static void tty_update_time(struct timespec *time)
+ {
+-	unsigned long sec = get_seconds();
+-	sec -= sec % 60;
++	unsigned long sec = get_seconds() & ~7;
+ 	if ((long)(sec - time->tv_sec) > 0)
+ 		time->tv_sec = sec;
+ }
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 2f45bba..c0f4066 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -461,6 +461,8 @@ static int _hardware_enqueue(struct ci13xxx_ep *mEp, struct ci13xxx_req *mReq)
+ 		mReq->ptr->page[i] =
+ 			(mReq->req.dma + i * CI13XXX_PAGE_SIZE) & ~TD_RESERVED_MASK;
+ 
++	wmb();
++
+ 	if (!list_empty(&mEp->qh.queue)) {
+ 		struct ci13xxx_req *mReqPrev;
+ 		int n = hw_ep_bit(mEp->num, mEp->dir);
+@@ -561,6 +563,12 @@ __acquires(mEp->lock)
+ 		struct ci13xxx_req *mReq = \
+ 			list_entry(mEp->qh.queue.next,
+ 				   struct ci13xxx_req, queue);
++
++		if (mReq->zptr) {
++			dma_pool_free(mEp->td_pool, mReq->zptr, mReq->zdma);
++			mReq->zptr = NULL;
++		}
++
+ 		list_del_init(&mReq->queue);
+ 		mReq->req.status = -ESHUTDOWN;
+ 
+diff --git a/drivers/usb/chipidea/udc.h b/drivers/usb/chipidea/udc.h
+index 4ff2384d..d12e8b5 100644
+--- a/drivers/usb/chipidea/udc.h
++++ b/drivers/usb/chipidea/udc.h
+@@ -40,7 +40,7 @@ struct ci13xxx_td {
+ #define TD_CURR_OFFSET        (0x0FFFUL <<  0)
+ #define TD_FRAME_NUM          (0x07FFUL <<  0)
+ #define TD_RESERVED_MASK      (0x0FFFUL <<  0)
+-} __attribute__ ((packed));
++} __attribute__ ((packed, aligned(4)));
+ 
+ /* DMA layout of queue heads */
+ struct ci13xxx_qh {
+@@ -57,7 +57,7 @@ struct ci13xxx_qh {
+ 	/* 9 */
+ 	u32 RESERVED;
+ 	struct usb_ctrlrequest   setup;
+-} __attribute__ ((packed));
++} __attribute__ ((packed, aligned(4)));
+ 
+ /**
+  * struct ci13xxx_req - usb request representation
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index b78fbe2..ea0a9a1 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -738,6 +738,8 @@ static int check_ctrlrecip(struct dev_state *ps, unsigned int requesttype,
+ 	index &= 0xff;
+ 	switch (requesttype & USB_RECIP_MASK) {
+ 	case USB_RECIP_ENDPOINT:
++		if ((index & ~USB_DIR_IN) == 0)
++			return 0;
+ 		ret = findintfep(ps->dev, index);
+ 		if (ret >= 0)
+ 			ret = checkintf(ps, ret);
+diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
+index 416a6dc..83b5a172 100644
+--- a/drivers/usb/host/ehci-hcd.c
++++ b/drivers/usb/host/ehci-hcd.c
+@@ -670,9 +670,6 @@ int ehci_setup(struct usb_hcd *hcd)
+ 	if (retval)
+ 		return retval;
+ 
+-	if (ehci_is_TDI(ehci))
+-		tdi_reset(ehci);
+-
+ 	ehci_reset(ehci);
+ 
+ 	return 0;
+diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
+index 0fc6e5f..ba6a5d6 100644
+--- a/drivers/usb/misc/appledisplay.c
++++ b/drivers/usb/misc/appledisplay.c
+@@ -63,6 +63,7 @@ static const struct usb_device_id appledisplay_table[] = {
+ 	{ APPLEDISPLAY_DEVICE(0x9219) },
+ 	{ APPLEDISPLAY_DEVICE(0x921c) },
+ 	{ APPLEDISPLAY_DEVICE(0x921d) },
++	{ APPLEDISPLAY_DEVICE(0x9236) },
+ 
+ 	/* Terminating entry */
+ 	{ }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 8e4f40b..77f78ad 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -189,6 +189,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_THROTTLE_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GATEWAY_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_PID) },
++	{ USB_DEVICE(FTDI_VID, FTDI_OPENDCC_GBM_BOOST_PID) },
+ 	{ USB_DEVICE(NEWPORT_VID, NEWPORT_AGILIS_PID) },
+ 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_IOBOARD_PID) },
+ 	{ USB_DEVICE(INTERBIOMETRICS_VID, INTERBIOMETRICS_MINI_IOBOARD_PID) },
+@@ -870,7 +871,9 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) },
+ 	{ USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+-	{ USB_DEVICE(ST_VID, ST_STMCLT1030_PID),
++	{ USB_DEVICE(ST_VID, ST_STMCLT_2232_PID),
++		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++	{ USB_DEVICE(ST_VID, ST_STMCLT_4232_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_stmclite_quirk },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_RF_R106) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID),
+@@ -1792,20 +1795,24 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
+ }
+ 
+ /*
+- * First and second port on STMCLiteadaptors is reserved for JTAG interface
+- * and the forth port for pio
++ * First two ports on JTAG adaptors using an FT4232 such as STMicroelectronics's
++ * ST Micro Connect Lite are reserved for JTAG or other non-UART interfaces and
++ * can be accessed from userspace.
++ * The next two ports are enabled as UARTs by default, where port 2 is
++ * a conventional RS-232 UART.
+  */
+ static int ftdi_stmclite_probe(struct usb_serial *serial)
+ {
+ 	struct usb_device *udev = serial->dev;
+ 	struct usb_interface *interface = serial->interface;
+ 
+-	if (interface == udev->actconfig->interface[2])
+-		return 0;
+-
+-	dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
++	if (interface == udev->actconfig->interface[0] ||
++	    interface == udev->actconfig->interface[1]) {
++		dev_info(&udev->dev, "Ignoring serial port reserved for JTAG\n");
++		return -ENODEV;
++	}
+ 
+-	return -ENODEV;
++	return 0;
+ }
+ 
+ /*
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index e79861e..9852827 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -74,6 +74,7 @@
+ #define FTDI_OPENDCC_THROTTLE_PID	0xBFDA
+ #define FTDI_OPENDCC_GATEWAY_PID	0xBFDB
+ #define FTDI_OPENDCC_GBM_PID	0xBFDC
++#define FTDI_OPENDCC_GBM_BOOST_PID	0xBFDD
+ 
+ /* NZR SEM 16+ USB (http://www.nzr.de) */
+ #define FTDI_NZR_SEM_USB_PID	0xC1E0	/* NZR SEM-LOG16+ */
+@@ -1150,7 +1151,8 @@
+  * STMicroelectonics
+  */
+ #define ST_VID			0x0483
+-#define ST_STMCLT1030_PID	0x3747 /* ST Micro Connect Lite STMCLT1030 */
++#define ST_STMCLT_2232_PID	0x3746
++#define ST_STMCLT_4232_PID	0x3747
+ 
+ /*
+  * Papouch products (http://www.papouch.com/)
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 558adfc..bff059a 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -347,6 +347,7 @@ static void option_instat_callback(struct urb *urb);
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID			0x0b3c
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
++#define OLIVETTI_PRODUCT_OLICARD145		0xc003
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+@@ -1273,6 +1274,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ 
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE(ONDA_VENDOR_ID, ONDA_MT825UP) }, /* ONDA MT825UP modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+@@ -1350,6 +1352,12 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) },	/* D-Link DWM-156 (variant) */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) },	/* D-Link DWM-156 (variant) */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x02, 0x01) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+ 	{ } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/storage/cypress_atacb.c b/drivers/usb/storage/cypress_atacb.c
+index 070b5c0..d944088 100644
+--- a/drivers/usb/storage/cypress_atacb.c
++++ b/drivers/usb/storage/cypress_atacb.c
+@@ -248,14 +248,26 @@ static int cypress_probe(struct usb_interface *intf,
+ {
+ 	struct us_data *us;
+ 	int result;
++	struct usb_device *device;
+ 
+ 	result = usb_stor_probe1(&us, intf, id,
+ 			(id - cypress_usb_ids) + cypress_unusual_dev_list);
+ 	if (result)
+ 		return result;
+ 
+-	us->protocol_name = "Transparent SCSI with Cypress ATACB";
+-	us->proto_handler = cypress_atacb_passthrough;
++	/* Among CY7C68300 chips, the A revision does not support Cypress ATACB
++	 * Filter out this revision from EEPROM default descriptor values
++	 */
++	device = interface_to_usbdev(intf);
++	if (device->descriptor.iManufacturer != 0x38 ||
++	    device->descriptor.iProduct != 0x4e ||
++	    device->descriptor.iSerialNumber != 0x64) {
++		us->protocol_name = "Transparent SCSI with Cypress ATACB";
++		us->proto_handler = cypress_atacb_passthrough;
++	} else {
++		us->protocol_name = "Transparent SCSI";
++		us->proto_handler = usb_stor_transparent_scsi_command;
++	}
+ 
+ 	result = usb_stor_probe2(us);
+ 	return result;
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index 501c599..6e696e6 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -1228,6 +1228,8 @@ static void fbcon_deinit(struct vc_data *vc)
+ finished:
+ 
+ 	fbcon_free_font(p, free_font);
++	if (free_font)
++		vc->vc_font.data = NULL;
+ 
+ 	if (!con_is_bound(&fb_con))
+ 		fbcon_exit();
+diff --git a/fs/dcache.c b/fs/dcache.c
+index c3bbf85..de73da2 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1232,8 +1232,10 @@ void shrink_dcache_parent(struct dentry * parent)
+ 	LIST_HEAD(dispose);
+ 	int found;
+ 
+-	while ((found = select_parent(parent, &dispose)) != 0)
++	while ((found = select_parent(parent, &dispose)) != 0) {
+ 		shrink_dentry_list(&dispose);
++		cond_resched();
++	}
+ }
+ EXPORT_SYMBOL(shrink_dcache_parent);
+ 
+diff --git a/fs/exec.c b/fs/exec.c
+index 20df02c..ac014f1 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -613,7 +613,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+ 		 * when the old and new regions overlap clear from new_end.
+ 		 */
+ 		free_pgd_range(&tlb, new_end, old_end, new_end,
+-			vma->vm_next ? vma->vm_next->vm_start : 0);
++			vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
+ 	} else {
+ 		/*
+ 		 * otherwise, clean from old_start; this is done to not touch
+@@ -622,7 +622,7 @@ static int shift_arg_pages(struct vm_area_struct *vma, unsigned long shift)
+ 		 * for the others its just a little faster.
+ 		 */
+ 		free_pgd_range(&tlb, old_start, old_end, new_end,
+-			vma->vm_next ? vma->vm_next->vm_start : 0);
++			vma->vm_next ? vma->vm_next->vm_start : USER_PGTABLES_CEILING);
+ 	}
+ 	tlb_finish_mmu(&tlb, new_end, old_end);
+ 
+@@ -898,11 +898,13 @@ static int de_thread(struct task_struct *tsk)
+ 
+ 		sig->notify_count = -1;	/* for exit_notify() */
+ 		for (;;) {
++			threadgroup_change_begin(tsk);
+ 			write_lock_irq(&tasklist_lock);
+ 			if (likely(leader->exit_state))
+ 				break;
+ 			__set_current_state(TASK_KILLABLE);
+ 			write_unlock_irq(&tasklist_lock);
++			threadgroup_change_end(tsk);
+ 			schedule();
+ 			if (unlikely(__fatal_signal_pending(tsk)))
+ 				goto killed;
+@@ -960,6 +962,7 @@ static int de_thread(struct task_struct *tsk)
+ 		if (unlikely(leader->ptrace))
+ 			__wake_up_parent(leader, leader->parent);
+ 		write_unlock_irq(&tasklist_lock);
++		threadgroup_change_end(tsk);
+ 
+ 		release_task(leader);
+ 	}
+diff --git a/fs/ext4/Kconfig b/fs/ext4/Kconfig
+index 9873587..efea5d5 100644
+--- a/fs/ext4/Kconfig
++++ b/fs/ext4/Kconfig
+@@ -71,4 +71,5 @@ config EXT4_DEBUG
+ 	  Enables run-time debugging support for the ext4 filesystem.
+ 
+ 	  If you select Y here, then you will be able to turn on debugging
+-	  with a command such as "echo 1 > /sys/kernel/debug/ext4/mballoc-debug"
++	  with a command such as:
++		echo 1 > /sys/module/ext4/parameters/mballoc_debug
+diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h
+index 7177f9b..dbd9ae1 100644
+--- a/fs/ext4/ext4_jbd2.h
++++ b/fs/ext4/ext4_jbd2.h
+@@ -170,16 +170,20 @@ static inline void ext4_journal_callback_add(handle_t *handle,
+  * ext4_journal_callback_del: delete a registered callback
+  * @handle: active journal transaction handle on which callback was registered
+  * @jce: registered journal callback entry to unregister
++ * Return true if object was sucessfully removed
+  */
+-static inline void ext4_journal_callback_del(handle_t *handle,
++static inline bool ext4_journal_callback_try_del(handle_t *handle,
+ 					     struct ext4_journal_cb_entry *jce)
+ {
++	bool deleted;
+ 	struct ext4_sb_info *sbi =
+ 			EXT4_SB(handle->h_transaction->t_journal->j_private);
+ 
+ 	spin_lock(&sbi->s_md_lock);
++	deleted = !list_empty(&jce->jce_list);
+ 	list_del_init(&jce->jce_list);
+ 	spin_unlock(&sbi->s_md_lock);
++	return deleted;
+ }
+ 
+ int
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index 3278e64..e0ba8a4 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -166,8 +166,7 @@ int ext4_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ 	if (journal->j_flags & JBD2_BARRIER &&
+ 	    !jbd2_trans_will_send_data_barrier(journal, commit_tid))
+ 		needs_barrier = true;
+-	jbd2_log_start_commit(journal, commit_tid);
+-	ret = jbd2_log_wait_commit(journal, commit_tid);
++	ret = jbd2_complete_transaction(journal, commit_tid);
+ 	if (needs_barrier) {
+ 		err = blkdev_issue_flush(inode->i_sb->s_bdev, GFP_KERNEL, NULL);
+ 		if (!ret)
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 22c5c67..c0fbd96 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -55,21 +55,21 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw,
+ 	__u16 csum_hi = 0;
+ 	__u32 csum;
+ 
+-	csum_lo = raw->i_checksum_lo;
++	csum_lo = le16_to_cpu(raw->i_checksum_lo);
+ 	raw->i_checksum_lo = 0;
+ 	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
+ 	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi)) {
+-		csum_hi = raw->i_checksum_hi;
++		csum_hi = le16_to_cpu(raw->i_checksum_hi);
+ 		raw->i_checksum_hi = 0;
+ 	}
+ 
+ 	csum = ext4_chksum(sbi, ei->i_csum_seed, (__u8 *)raw,
+ 			   EXT4_INODE_SIZE(inode->i_sb));
+ 
+-	raw->i_checksum_lo = csum_lo;
++	raw->i_checksum_lo = cpu_to_le16(csum_lo);
+ 	if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE &&
+ 	    EXT4_FITS_IN_INODE(raw, ei, i_checksum_hi))
+-		raw->i_checksum_hi = csum_hi;
++		raw->i_checksum_hi = cpu_to_le16(csum_hi);
+ 
+ 	return csum;
+ }
+@@ -216,8 +216,7 @@ void ext4_evict_inode(struct inode *inode)
+ 			journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
+ 			tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
+ 
+-			jbd2_log_start_commit(journal, commit_tid);
+-			jbd2_log_wait_commit(journal, commit_tid);
++			jbd2_complete_transaction(journal, commit_tid);
+ 			filemap_write_and_wait(&inode->i_data);
+ 		}
+ 		truncate_inode_pages(&inode->i_data, 0);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 82f8c2d..b443e62 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4449,11 +4449,11 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
+ 	node = rb_prev(new_node);
+ 	if (node) {
+ 		entry = rb_entry(node, struct ext4_free_data, efd_node);
+-		if (can_merge(entry, new_entry)) {
++		if (can_merge(entry, new_entry) &&
++		    ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
+ 			new_entry->efd_start_cluster = entry->efd_start_cluster;
+ 			new_entry->efd_count += entry->efd_count;
+ 			rb_erase(node, &(db->bb_free_root));
+-			ext4_journal_callback_del(handle, &entry->efd_jce);
+ 			kmem_cache_free(ext4_free_data_cachep, entry);
+ 		}
+ 	}
+@@ -4461,10 +4461,10 @@ ext4_mb_free_metadata(handle_t *handle, struct ext4_buddy *e4b,
+ 	node = rb_next(new_node);
+ 	if (node) {
+ 		entry = rb_entry(node, struct ext4_free_data, efd_node);
+-		if (can_merge(new_entry, entry)) {
++		if (can_merge(new_entry, entry) &&
++		    ext4_journal_callback_try_del(handle, &entry->efd_jce)) {
+ 			new_entry->efd_count += entry->efd_count;
+ 			rb_erase(node, &(db->bb_free_root));
+-			ext4_journal_callback_del(handle, &entry->efd_jce);
+ 			kmem_cache_free(ext4_free_data_cachep, entry);
+ 		}
+ 	}
+diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
+index 44734f1..fe201c6 100644
+--- a/fs/ext4/mmp.c
++++ b/fs/ext4/mmp.c
+@@ -7,7 +7,7 @@
+ #include "ext4.h"
+ 
+ /* Checksumming functions */
+-static __u32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
++static __le32 ext4_mmp_csum(struct super_block *sb, struct mmp_struct *mmp)
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	int offset = offsetof(struct mmp_struct, mmp_checksum);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 9eace36..a2fe9f5 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -1341,6 +1341,8 @@ static void ext4_update_super(struct super_block *sb,
+ 
+ 	/* Update the global fs size fields */
+ 	sbi->s_groups_count += flex_gd->count;
++	sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count,
++			(EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb)));
+ 
+ 	/* Update the reserved block counts only once the new group is
+ 	 * active. */
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 24c767d..5575a45 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -452,10 +452,13 @@ static void ext4_journal_commit_callback(journal_t *journal, transaction_t *txn)
+ 	struct super_block		*sb = journal->j_private;
+ 	struct ext4_sb_info		*sbi = EXT4_SB(sb);
+ 	int				error = is_journal_aborted(journal);
+-	struct ext4_journal_cb_entry	*jce, *tmp;
++	struct ext4_journal_cb_entry	*jce;
+ 
++	BUG_ON(txn->t_state == T_FINISHED);
+ 	spin_lock(&sbi->s_md_lock);
+-	list_for_each_entry_safe(jce, tmp, &txn->t_private_list, jce_list) {
++	while (!list_empty(&txn->t_private_list)) {
++		jce = list_entry(txn->t_private_list.next,
++				 struct ext4_journal_cb_entry, jce_list);
+ 		list_del_init(&jce->jce_list);
+ 		spin_unlock(&sbi->s_md_lock);
+ 		jce->jce_func(sb, jce, error);
+diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
+index 8179e8b..40d13c7 100644
+--- a/fs/fscache/stats.c
++++ b/fs/fscache/stats.c
+@@ -287,5 +287,5 @@ const struct file_operations fscache_stats_fops = {
+ 	.open		= fscache_stats_open,
+ 	.read		= seq_read,
+ 	.llseek		= seq_lseek,
+-	.release	= seq_release,
++	.release        = single_release,
+ };
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index 3091d42..069bf58 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -382,7 +382,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
+ 	int space_left = 0;
+ 	int first_tag = 0;
+ 	int tag_flag;
+-	int i, to_free = 0;
++	int i;
+ 	int tag_bytes = journal_tag_bytes(journal);
+ 	struct buffer_head *cbh = NULL; /* For transactional checksums */
+ 	__u32 crc32_sum = ~0;
+@@ -1126,7 +1126,7 @@ restart_loop:
+ 	journal->j_stats.run.rs_blocks_logged += stats.run.rs_blocks_logged;
+ 	spin_unlock(&journal->j_history_lock);
+ 
+-	commit_transaction->t_state = T_FINISHED;
++	commit_transaction->t_state = T_COMMIT_CALLBACK;
+ 	J_ASSERT(commit_transaction == journal->j_committing_transaction);
+ 	journal->j_commit_sequence = commit_transaction->t_tid;
+ 	journal->j_committing_transaction = NULL;
+@@ -1141,38 +1141,44 @@ restart_loop:
+ 				journal->j_average_commit_time*3) / 4;
+ 	else
+ 		journal->j_average_commit_time = commit_time;
++
+ 	write_unlock(&journal->j_state_lock);
+ 
+-	if (commit_transaction->t_checkpoint_list == NULL &&
+-	    commit_transaction->t_checkpoint_io_list == NULL) {
+-		__jbd2_journal_drop_transaction(journal, commit_transaction);
+-		to_free = 1;
++	if (journal->j_checkpoint_transactions == NULL) {
++		journal->j_checkpoint_transactions = commit_transaction;
++		commit_transaction->t_cpnext = commit_transaction;
++		commit_transaction->t_cpprev = commit_transaction;
+ 	} else {
+-		if (journal->j_checkpoint_transactions == NULL) {
+-			journal->j_checkpoint_transactions = commit_transaction;
+-			commit_transaction->t_cpnext = commit_transaction;
+-			commit_transaction->t_cpprev = commit_transaction;
+-		} else {
+-			commit_transaction->t_cpnext =
+-				journal->j_checkpoint_transactions;
+-			commit_transaction->t_cpprev =
+-				commit_transaction->t_cpnext->t_cpprev;
+-			commit_transaction->t_cpnext->t_cpprev =
+-				commit_transaction;
+-			commit_transaction->t_cpprev->t_cpnext =
++		commit_transaction->t_cpnext =
++			journal->j_checkpoint_transactions;
++		commit_transaction->t_cpprev =
++			commit_transaction->t_cpnext->t_cpprev;
++		commit_transaction->t_cpnext->t_cpprev =
++			commit_transaction;
++		commit_transaction->t_cpprev->t_cpnext =
+ 				commit_transaction;
+-		}
+ 	}
+ 	spin_unlock(&journal->j_list_lock);
+-
++	/* Drop all spin_locks because commit_callback may be block.
++	 * __journal_remove_checkpoint() can not destroy transaction
++	 * under us because it is not marked as T_FINISHED yet */
+ 	if (journal->j_commit_callback)
+ 		journal->j_commit_callback(journal, commit_transaction);
+ 
+ 	trace_jbd2_end_commit(journal, commit_transaction);
+ 	jbd_debug(1, "JBD2: commit %d complete, head %d\n",
+ 		  journal->j_commit_sequence, journal->j_tail_sequence);
+-	if (to_free)
+-		jbd2_journal_free_transaction(commit_transaction);
+ 
++	write_lock(&journal->j_state_lock);
++	spin_lock(&journal->j_list_lock);
++	commit_transaction->t_state = T_FINISHED;
++	/* Recheck checkpoint lists after j_list_lock was dropped */
++	if (commit_transaction->t_checkpoint_list == NULL &&
++	    commit_transaction->t_checkpoint_io_list == NULL) {
++		__jbd2_journal_drop_transaction(journal, commit_transaction);
++		jbd2_journal_free_transaction(commit_transaction);
++	}
++	spin_unlock(&journal->j_list_lock);
++	write_unlock(&journal->j_state_lock);
+ 	wake_up(&journal->j_wait_done_commit);
+ }
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index dbf41f9..42f8cf6c 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -698,6 +698,37 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
+ }
+ 
+ /*
++ * When this function returns the transaction corresponding to tid
++ * will be completed.  If the transaction has currently running, start
++ * committing that transaction before waiting for it to complete.  If
++ * the transaction id is stale, it is by definition already completed,
++ * so just return SUCCESS.
++ */
++int jbd2_complete_transaction(journal_t *journal, tid_t tid)
++{
++	int	need_to_wait = 1;
++
++	read_lock(&journal->j_state_lock);
++	if (journal->j_running_transaction &&
++	    journal->j_running_transaction->t_tid == tid) {
++		if (journal->j_commit_request != tid) {
++			/* transaction not yet started, so request it */
++			read_unlock(&journal->j_state_lock);
++			jbd2_log_start_commit(journal, tid);
++			goto wait_commit;
++		}
++	} else if (!(journal->j_committing_transaction &&
++		     journal->j_committing_transaction->t_tid == tid))
++		need_to_wait = 0;
++	read_unlock(&journal->j_state_lock);
++	if (!need_to_wait)
++		return 0;
++wait_commit:
++	return jbd2_log_wait_commit(journal, tid);
++}
++EXPORT_SYMBOL(jbd2_complete_transaction);
++
++/*
+  * Log buffer allocation routines:
+  */
+ 
+diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
+index ca0a080..193f04c 100644
+--- a/fs/lockd/clntlock.c
++++ b/fs/lockd/clntlock.c
+@@ -144,6 +144,9 @@ int nlmclnt_block(struct nlm_wait *block, struct nlm_rqst *req, long timeout)
+ 			timeout);
+ 	if (ret < 0)
+ 		return -ERESTARTSYS;
++	/* Reset the lock status after a server reboot so we resend */
++	if (block->b_status == nlm_lck_denied_grace_period)
++		block->b_status = nlm_lck_blocked;
+ 	req->a_res.status = block->b_status;
+ 	return 0;
+ }
+diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
+index 52e5120..54f9e6c 100644
+--- a/fs/lockd/clntproc.c
++++ b/fs/lockd/clntproc.c
+@@ -550,9 +550,6 @@ again:
+ 		status = nlmclnt_block(block, req, NLMCLNT_POLL_TIMEOUT);
+ 		if (status < 0)
+ 			break;
+-		/* Resend the blocking lock request after a server reboot */
+-		if (resp->status ==  nlm_lck_denied_grace_period)
+-			continue;
+ 		if (resp->status != nlm_lck_blocked)
+ 			break;
+ 	}
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3d905e3..51d53a4 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1374,6 +1374,12 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state
+ 			case -ENOMEM:
+ 				err = 0;
+ 				goto out;
++			case -NFS4ERR_DELAY:
++			case -NFS4ERR_GRACE:
++				set_bit(NFS_DELEGATED_STATE, &state->flags);
++				ssleep(1);
++				err = -EAGAIN;
++				goto out;
+ 		}
+ 		err = nfs4_handle_exception(server, err, &exception);
+ 	} while (exception.retry);
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 9d1c5db..ec668e1 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -931,14 +931,14 @@ nfsd4_write(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+ 	nfs4_lock_state();
+ 	status = nfs4_preprocess_stateid_op(SVC_NET(rqstp),
+ 					cstate, stateid, WR_STATE, &filp);
+-	if (filp)
+-		get_file(filp);
+-	nfs4_unlock_state();
+-
+ 	if (status) {
++		nfs4_unlock_state();
+ 		dprintk("NFSD: nfsd4_write: couldn't process stateid!\n");
+ 		return status;
+ 	}
++	if (filp)
++		get_file(filp);
++	nfs4_unlock_state();
+ 
+ 	cnt = write->wr_buflen;
+ 	write->wr_how_written = write->wr_stable_how;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index a8309c6..53a7c64 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -210,13 +210,7 @@ static void __nfs4_file_put_access(struct nfs4_file *fp, int oflag)
+ {
+ 	if (atomic_dec_and_test(&fp->fi_access[oflag])) {
+ 		nfs4_file_put_fd(fp, oflag);
+-		/*
+-		 * It's also safe to get rid of the RDWR open *if*
+-		 * we no longer have need of the other kind of access
+-		 * or if we already have the other kind of open:
+-		 */
+-		if (fp->fi_fds[1-oflag]
+-			|| atomic_read(&fp->fi_access[1 - oflag]) == 0)
++		if (atomic_read(&fp->fi_access[1 - oflag]) == 0)
+ 			nfs4_file_put_fd(fp, O_RDWR);
+ 	}
+ }
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index d1dd710..cd5e6c1 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -344,10 +344,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ 			   all 32 bits of 'nseconds'. */
+ 			READ_BUF(12);
+ 			len += 12;
+-			READ32(dummy32);
+-			if (dummy32)
+-				return nfserr_inval;
+-			READ32(iattr->ia_atime.tv_sec);
++			READ64(iattr->ia_atime.tv_sec);
+ 			READ32(iattr->ia_atime.tv_nsec);
+ 			if (iattr->ia_atime.tv_nsec >= (u32)1000000000)
+ 				return nfserr_inval;
+@@ -370,10 +367,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ 			   all 32 bits of 'nseconds'. */
+ 			READ_BUF(12);
+ 			len += 12;
+-			READ32(dummy32);
+-			if (dummy32)
+-				return nfserr_inval;
+-			READ32(iattr->ia_mtime.tv_sec);
++			READ64(iattr->ia_mtime.tv_sec);
+ 			READ32(iattr->ia_mtime.tv_nsec);
+ 			if (iattr->ia_mtime.tv_nsec >= (u32)1000000000)
+ 				return nfserr_inval;
+@@ -2386,8 +2380,7 @@ out_acl:
+ 	if (bmval1 & FATTR4_WORD1_TIME_ACCESS) {
+ 		if ((buflen -= 12) < 0)
+ 			goto out_resource;
+-		WRITE32(0);
+-		WRITE32(stat.atime.tv_sec);
++		WRITE64((s64)stat.atime.tv_sec);
+ 		WRITE32(stat.atime.tv_nsec);
+ 	}
+ 	if (bmval1 & FATTR4_WORD1_TIME_DELTA) {
+@@ -2400,15 +2393,13 @@ out_acl:
+ 	if (bmval1 & FATTR4_WORD1_TIME_METADATA) {
+ 		if ((buflen -= 12) < 0)
+ 			goto out_resource;
+-		WRITE32(0);
+-		WRITE32(stat.ctime.tv_sec);
++		WRITE64((s64)stat.ctime.tv_sec);
+ 		WRITE32(stat.ctime.tv_nsec);
+ 	}
+ 	if (bmval1 & FATTR4_WORD1_TIME_MODIFY) {
+ 		if ((buflen -= 12) < 0)
+ 			goto out_resource;
+-		WRITE32(0);
+-		WRITE32(stat.mtime.tv_sec);
++		WRITE64((s64)stat.mtime.tv_sec);
+ 		WRITE32(stat.mtime.tv_nsec);
+ 	}
+ 	if (bmval1 & FATTR4_WORD1_MOUNTED_ON_FILEID) {
+diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
+index 07f7a92..595343e 100644
+--- a/fs/notify/inotify/inotify_user.c
++++ b/fs/notify/inotify/inotify_user.c
+@@ -574,7 +574,6 @@ static int inotify_update_existing_watch(struct fsnotify_group *group,
+ 	int add = (arg & IN_MASK_ADD);
+ 	int ret;
+ 
+-	/* don't allow invalid bits: we don't want flags set */
+ 	mask = inotify_arg_to_mask(arg);
+ 
+ 	fsn_mark = fsnotify_find_inode_mark(group, inode);
+@@ -625,7 +624,6 @@ static int inotify_new_watch(struct fsnotify_group *group,
+ 	struct idr *idr = &group->inotify_data.idr;
+ 	spinlock_t *idr_lock = &group->inotify_data.idr_lock;
+ 
+-	/* don't allow invalid bits: we don't want flags set */
+ 	mask = inotify_arg_to_mask(arg);
+ 
+ 	tmp_i_mark = kmem_cache_alloc(inotify_inode_mark_cachep, GFP_KERNEL);
+@@ -753,6 +751,10 @@ SYSCALL_DEFINE3(inotify_add_watch, int, fd, const char __user *, pathname,
+ 	int ret;
+ 	unsigned flags = 0;
+ 
++	/* don't allow invalid bits: we don't want flags set */
++	if (unlikely(!(mask & ALL_INOTIFY_BITS)))
++		return -EINVAL;
++
+ 	f = fdget(fd);
+ 	if (unlikely(!f.file))
+ 		return -EBADF;
+diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
+index 1f8c823..d924812 100644
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -1012,6 +1012,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ 	enum kobj_ns_type type;
+ 	const void *ns;
+ 	ino_t ino;
++	loff_t off;
+ 
+ 	type = sysfs_ns_type(parent_sd);
+ 	ns = sysfs_info(dentry->d_sb)->ns[type];
+@@ -1034,6 +1035,7 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ 			return 0;
+ 	}
+ 	mutex_lock(&sysfs_mutex);
++	off = filp->f_pos;
+ 	for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
+ 	     pos;
+ 	     pos = sysfs_dir_next_pos(ns, parent_sd, filp->f_pos, pos)) {
+@@ -1045,19 +1047,24 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ 		len = strlen(name);
+ 		ino = pos->s_ino;
+ 		type = dt_type(pos);
+-		filp->f_pos = pos->s_hash;
++		off = filp->f_pos = pos->s_hash;
+ 		filp->private_data = sysfs_get(pos);
+ 
+ 		mutex_unlock(&sysfs_mutex);
+-		ret = filldir(dirent, name, len, filp->f_pos, ino, type);
++		ret = filldir(dirent, name, len, off, ino, type);
+ 		mutex_lock(&sysfs_mutex);
+ 		if (ret < 0)
+ 			break;
+ 	}
+ 	mutex_unlock(&sysfs_mutex);
+-	if ((filp->f_pos > 1) && !pos) { /* EOF */
+-		filp->f_pos = INT_MAX;
++
++	/* don't reference last entry if its refcount is dropped */
++	if (!pos) {
+ 		filp->private_data = NULL;
++
++		/* EOF and not changed as 0 or 1 in read/write path */
++		if (off == filp->f_pos && off > 1)
++			filp->f_pos = INT_MAX;
+ 	}
+ 	return 0;
+ }
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 5cf680a..f50a87d 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -7,6 +7,16 @@
+ #include <linux/mm_types.h>
+ #include <linux/bug.h>
+ 
++/*
++ * On almost all architectures and configurations, 0 can be used as the
++ * upper ceiling to free_pgtables(): on many architectures it has the same
++ * effect as using TASK_SIZE.  However, there is one configuration which
++ * must impose a more careful limit, to avoid freeing kernel pgtables.
++ */
++#ifndef USER_PGTABLES_CEILING
++#define USER_PGTABLES_CEILING	0UL
++#endif
++
+ #ifndef __HAVE_ARCH_PTEP_SET_ACCESS_FLAGS
+ extern int ptep_set_access_flags(struct vm_area_struct *vma,
+ 				 unsigned long address, pte_t *ptep,
+diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
+index 7d73905..2322df7 100644
+--- a/include/linux/cgroup.h
++++ b/include/linux/cgroup.h
+@@ -303,9 +303,6 @@ struct cftype {
+ 	/* CFTYPE_* flags */
+ 	unsigned int flags;
+ 
+-	/* file xattrs */
+-	struct simple_xattrs xattrs;
+-
+ 	int (*open)(struct inode *inode, struct file *file);
+ 	ssize_t (*read)(struct cgroup *cgrp, struct cftype *cft,
+ 			struct file *file,
+diff --git a/include/linux/ipc_namespace.h b/include/linux/ipc_namespace.h
+index ae221a7..c4d870b 100644
+--- a/include/linux/ipc_namespace.h
++++ b/include/linux/ipc_namespace.h
+@@ -43,8 +43,8 @@ struct ipc_namespace {
+ 
+ 	size_t		shm_ctlmax;
+ 	size_t		shm_ctlall;
++	unsigned long	shm_tot;
+ 	int		shm_ctlmni;
+-	int		shm_tot;
+ 	/*
+ 	 * Defines whether IPC_RMID is forced for _all_ shm segments regardless
+ 	 * of shmctl()
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index e30b663..383bef0 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -498,6 +498,7 @@ struct transaction_s
+ 		T_COMMIT,
+ 		T_COMMIT_DFLUSH,
+ 		T_COMMIT_JFLUSH,
++		T_COMMIT_CALLBACK,
+ 		T_FINISHED
+ 	}			t_state;
+ 
+@@ -1210,6 +1211,7 @@ int __jbd2_log_start_commit(journal_t *journal, tid_t tid);
+ int jbd2_journal_start_commit(journal_t *journal, tid_t *tid);
+ int jbd2_journal_force_commit_nested(journal_t *journal);
+ int jbd2_log_wait_commit(journal_t *journal, tid_t tid);
++int jbd2_complete_transaction(journal_t *journal, tid_t tid);
+ int jbd2_log_do_checkpoint(journal_t *journal);
+ int jbd2_trans_will_send_data_barrier(journal_t *journal, tid_t tid);
+ 
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 7e49270..f5ad26e 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2486,27 +2486,18 @@ static inline void threadgroup_change_end(struct task_struct *tsk)
+  *
+  * Lock the threadgroup @tsk belongs to.  No new task is allowed to enter
+  * and member tasks aren't allowed to exit (as indicated by PF_EXITING) or
+- * perform exec.  This is useful for cases where the threadgroup needs to
+- * stay stable across blockable operations.
++ * change ->group_leader/pid.  This is useful for cases where the threadgroup
++ * needs to stay stable across blockable operations.
+  *
+  * fork and exit paths explicitly call threadgroup_change_{begin|end}() for
+  * synchronization.  While held, no new task will be added to threadgroup
+  * and no existing live task will have its PF_EXITING set.
+  *
+- * During exec, a task goes and puts its thread group through unusual
+- * changes.  After de-threading, exclusive access is assumed to resources
+- * which are usually shared by tasks in the same group - e.g. sighand may
+- * be replaced with a new one.  Also, the exec'ing task takes over group
+- * leader role including its pid.  Exclude these changes while locked by
+- * grabbing cred_guard_mutex which is used to synchronize exec path.
++ * de_thread() does threadgroup_change_{begin|end}() when a non-leader
++ * sub-thread becomes a new leader.
+  */
+ static inline void threadgroup_lock(struct task_struct *tsk)
+ {
+-	/*
+-	 * exec uses exit for de-threading nesting group_rwsem inside
+-	 * cred_guard_mutex. Grab cred_guard_mutex first.
+-	 */
+-	mutex_lock(&tsk->signal->cred_guard_mutex);
+ 	down_write(&tsk->signal->group_rwsem);
+ }
+ 
+@@ -2519,7 +2510,6 @@ static inline void threadgroup_lock(struct task_struct *tsk)
+ static inline void threadgroup_unlock(struct task_struct *tsk)
+ {
+ 	up_write(&tsk->signal->group_rwsem);
+-	mutex_unlock(&tsk->signal->cred_guard_mutex);
+ }
+ #else
+ static inline void threadgroup_change_begin(struct task_struct *tsk) {}
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index f841ba4..dfb42ca 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -1787,6 +1787,7 @@ struct snd_emu10k1 {
+ 	unsigned int next_free_voice;
+ 
+ 	const struct firmware *firmware;
++	const struct firmware *dock_fw;
+ 
+ #ifdef CONFIG_PM_SLEEP
+ 	unsigned int *saved_ptr;
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 4fa6d8f..9bab650 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -462,7 +462,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ 	size_t size = params->u.size;
+ 	int error;
+ 	struct shmid_kernel *shp;
+-	int numpages = (size + PAGE_SIZE -1) >> PAGE_SHIFT;
++	size_t numpages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ 	struct file * file;
+ 	char name[13];
+ 	int id;
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 1e23664..cddf1d9 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -162,6 +162,9 @@ struct cfent {
+ 	struct list_head		node;
+ 	struct dentry			*dentry;
+ 	struct cftype			*type;
++
++	/* file xattrs */
++	struct simple_xattrs		xattrs;
+ };
+ 
+ /*
+@@ -908,13 +911,12 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
+ 	} else {
+ 		struct cfent *cfe = __d_cfe(dentry);
+ 		struct cgroup *cgrp = dentry->d_parent->d_fsdata;
+-		struct cftype *cft = cfe->type;
+ 
+ 		WARN_ONCE(!list_empty(&cfe->node) &&
+ 			  cgrp != &cgrp->root->top_cgroup,
+ 			  "cfe still linked for %s\n", cfe->type->name);
++		simple_xattrs_free(&cfe->xattrs);
+ 		kfree(cfe);
+-		simple_xattrs_free(&cft->xattrs);
+ 	}
+ 	iput(inode);
+ }
+@@ -2066,7 +2068,7 @@ static int cgroup_attach_proc(struct cgroup *cgrp, struct task_struct *leader)
+ 	if (!group)
+ 		return -ENOMEM;
+ 	/* pre-allocate to guarantee space while iterating in rcu read-side. */
+-	retval = flex_array_prealloc(group, 0, group_size - 1, GFP_KERNEL);
++	retval = flex_array_prealloc(group, 0, group_size, GFP_KERNEL);
+ 	if (retval)
+ 		goto out_free_group_list;
+ 
+@@ -2553,7 +2555,7 @@ static struct simple_xattrs *__d_xattrs(struct dentry *dentry)
+ 	if (S_ISDIR(dentry->d_inode->i_mode))
+ 		return &__d_cgrp(dentry)->xattrs;
+ 	else
+-		return &__d_cft(dentry)->xattrs;
++		return &__d_cfe(dentry)->xattrs;
+ }
+ 
+ static inline int xattr_enabled(struct dentry *dentry)
+@@ -2729,8 +2731,6 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys,
+ 	umode_t mode;
+ 	char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };
+ 
+-	simple_xattrs_init(&cft->xattrs);
+-
+ 	if (subsys && !test_bit(ROOT_NOPREFIX, &cgrp->root->flags)) {
+ 		strcpy(name, subsys->name);
+ 		strcat(name, ".");
+@@ -2755,6 +2755,7 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys,
+ 		cfe->type = (void *)cft;
+ 		cfe->dentry = dentry;
+ 		dentry->d_fsdata = cfe;
++		simple_xattrs_init(&cfe->xattrs);
+ 		list_add_tail(&cfe->node, &parent->files);
+ 		cfe = NULL;
+ 	}
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index e4cee8d..60f7e32 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -298,6 +298,10 @@ ktime_t ktime_sub_ns(const ktime_t kt, u64 nsec)
+ 	} else {
+ 		unsigned long rem = do_div(nsec, NSEC_PER_SEC);
+ 
++		/* Make sure nsec fits into long */
++		if (unlikely(nsec > KTIME_SEC_MAX))
++			return (ktime_t){ .tv64 = KTIME_MAX };
++
+ 		tmp = ktime_set((long)nsec, rem);
+ 	}
+ 
+@@ -1308,6 +1312,8 @@ retry:
+ 
+ 				expires = ktime_sub(hrtimer_get_expires(timer),
+ 						    base->offset);
++				if (expires.tv64 < 0)
++					expires.tv64 = KTIME_MAX;
+ 				if (expires.tv64 < expires_next.tv64)
+ 					expires_next = expires;
+ 				break;
+diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
+index 0d095dc..93f8e8f 100644
+--- a/kernel/rcutree_trace.c
++++ b/kernel/rcutree_trace.c
+@@ -97,7 +97,7 @@ static const struct file_operations rcubarrier_fops = {
+ 	.open = rcubarrier_open,
+ 	.read = seq_read,
+ 	.llseek = no_llseek,
+-	.release = seq_release,
++	.release = single_release,
+ };
+ 
+ #ifdef CONFIG_RCU_BOOST
+@@ -208,7 +208,7 @@ static const struct file_operations rcuexp_fops = {
+ 	.open = rcuexp_open,
+ 	.read = seq_read,
+ 	.llseek = no_llseek,
+-	.release = seq_release,
++	.release = single_release,
+ };
+ 
+ #ifdef CONFIG_RCU_BOOST
+@@ -308,7 +308,7 @@ static const struct file_operations rcuhier_fops = {
+ 	.open = rcuhier_open,
+ 	.read = seq_read,
+ 	.llseek = no_llseek,
+-	.release = seq_release,
++	.release = single_release,
+ };
+ 
+ static void show_one_rcugp(struct seq_file *m, struct rcu_state *rsp)
+@@ -350,7 +350,7 @@ static const struct file_operations rcugp_fops = {
+ 	.open = rcugp_open,
+ 	.read = seq_read,
+ 	.llseek = no_llseek,
+-	.release = seq_release,
++	.release = single_release,
+ };
+ 
+ static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp)
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index a13987a..239a323 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -66,6 +66,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
+  */
+ int tick_check_broadcast_device(struct clock_event_device *dev)
+ {
++	struct clock_event_device *cur = tick_broadcast_device.evtdev;
++
+ 	if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
+ 	    (tick_broadcast_device.evtdev &&
+ 	     tick_broadcast_device.evtdev->rating >= dev->rating) ||
+@@ -73,6 +75,8 @@ int tick_check_broadcast_device(struct clock_event_device *dev)
+ 		return 0;
+ 
+ 	clockevents_exchange_device(tick_broadcast_device.evtdev, dev);
++	if (cur)
++		cur->event_handler = clockevents_handle_noop;
+ 	tick_broadcast_device.evtdev = dev;
+ 	if (!cpumask_empty(tick_get_broadcast_mask()))
+ 		tick_broadcast_start_periodic(dev);
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index b1600a6..7076b3f 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -323,6 +323,7 @@ static void tick_shutdown(unsigned int *cpup)
+ 		 */
+ 		dev->mode = CLOCK_EVT_MODE_UNUSED;
+ 		clockevents_exchange_device(dev, NULL);
++		dev->event_handler = clockevents_handle_noop;
+ 		td->evtdev = NULL;
+ 	}
+ 	raw_spin_unlock_irqrestore(&tick_device_lock, flags);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 35cc3a8..03dbc77 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -650,7 +650,7 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
+ 
+ 	pages = DIV_ROUND_UP(functions, PROFILES_PER_PAGE);
+ 
+-	for (i = 0; i < pages; i++) {
++	for (i = 1; i < pages; i++) {
+ 		pg->next = (void *)get_zeroed_page(GFP_KERNEL);
+ 		if (!pg->next)
+ 			goto out_free;
+@@ -3714,7 +3714,8 @@ out:
+ 	if (fail)
+ 		return -EINVAL;
+ 
+-	ftrace_graph_filter_enabled = 1;
++	ftrace_graph_filter_enabled = !!(*idx);
++
+ 	return 0;
+ }
+ 
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index fe1d581..1c82852 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -4885,6 +4885,8 @@ static __init int tracer_init_debugfs(void)
+ 	trace_access_lock_init();
+ 
+ 	d_tracer = tracing_init_dentry();
++	if (!d_tracer)
++		return 0;
+ 
+ 	trace_create_file("trace_options", 0644, d_tracer,
+ 			NULL, &tracing_iter_fops);
+diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
+index 83a8b5b..b20428c 100644
+--- a/kernel/trace/trace_stack.c
++++ b/kernel/trace/trace_stack.c
+@@ -20,13 +20,24 @@
+ 
+ #define STACK_TRACE_ENTRIES 500
+ 
++#ifdef CC_USING_FENTRY
++# define fentry		1
++#else
++# define fentry		0
++#endif
++
+ static unsigned long stack_dump_trace[STACK_TRACE_ENTRIES+1] =
+ 	 { [0 ... (STACK_TRACE_ENTRIES)] = ULONG_MAX };
+ static unsigned stack_dump_index[STACK_TRACE_ENTRIES];
+ 
++/*
++ * Reserve one entry for the passed in ip. This will allow
++ * us to remove most or all of the stack size overhead
++ * added by the stack tracer itself.
++ */
+ static struct stack_trace max_stack_trace = {
+-	.max_entries		= STACK_TRACE_ENTRIES,
+-	.entries		= stack_dump_trace,
++	.max_entries		= STACK_TRACE_ENTRIES - 1,
++	.entries		= &stack_dump_trace[1],
+ };
+ 
+ static unsigned long max_stack_size;
+@@ -39,25 +50,34 @@ static DEFINE_MUTEX(stack_sysctl_mutex);
+ int stack_tracer_enabled;
+ static int last_stack_tracer_enabled;
+ 
+-static inline void check_stack(void)
++static inline void
++check_stack(unsigned long ip, unsigned long *stack)
+ {
+ 	unsigned long this_size, flags;
+ 	unsigned long *p, *top, *start;
++	static int tracer_frame;
++	int frame_size = ACCESS_ONCE(tracer_frame);
+ 	int i;
+ 
+-	this_size = ((unsigned long)&this_size) & (THREAD_SIZE-1);
++	this_size = ((unsigned long)stack) & (THREAD_SIZE-1);
+ 	this_size = THREAD_SIZE - this_size;
++	/* Remove the frame of the tracer */
++	this_size -= frame_size;
+ 
+ 	if (this_size <= max_stack_size)
+ 		return;
+ 
+ 	/* we do not handle interrupt stacks yet */
+-	if (!object_is_on_stack(&this_size))
++	if (!object_is_on_stack(stack))
+ 		return;
+ 
+ 	local_irq_save(flags);
+ 	arch_spin_lock(&max_stack_lock);
+ 
++	/* In case another CPU set the tracer_frame on us */
++	if (unlikely(!frame_size))
++		this_size -= tracer_frame;
++
+ 	/* a race could have already updated it */
+ 	if (this_size <= max_stack_size)
+ 		goto out;
+@@ -70,10 +90,18 @@ static inline void check_stack(void)
+ 	save_stack_trace(&max_stack_trace);
+ 
+ 	/*
++	 * Add the passed in ip from the function tracer.
++	 * Searching for this on the stack will skip over
++	 * most of the overhead from the stack tracer itself.
++	 */
++	stack_dump_trace[0] = ip;
++	max_stack_trace.nr_entries++;
++
++	/*
+ 	 * Now find where in the stack these are.
+ 	 */
+ 	i = 0;
+-	start = &this_size;
++	start = stack;
+ 	top = (unsigned long *)
+ 		(((unsigned long)start & ~(THREAD_SIZE-1)) + THREAD_SIZE);
+ 
+@@ -97,6 +125,18 @@ static inline void check_stack(void)
+ 				found = 1;
+ 				/* Start the search from here */
+ 				start = p + 1;
++				/*
++				 * We do not want to show the overhead
++				 * of the stack tracer stack in the
++				 * max stack. If we haven't figured
++				 * out what that is, then figure it out
++				 * now.
++				 */
++				if (unlikely(!tracer_frame) && i == 1) {
++					tracer_frame = (p - stack) *
++						sizeof(unsigned long);
++					max_stack_size -= tracer_frame;
++				}
+ 			}
+ 		}
+ 
+@@ -113,6 +153,7 @@ static void
+ stack_trace_call(unsigned long ip, unsigned long parent_ip,
+ 		 struct ftrace_ops *op, struct pt_regs *pt_regs)
+ {
++	unsigned long stack;
+ 	int cpu;
+ 
+ 	preempt_disable_notrace();
+@@ -122,7 +163,26 @@ stack_trace_call(unsigned long ip, unsigned long parent_ip,
+ 	if (per_cpu(trace_active, cpu)++ != 0)
+ 		goto out;
+ 
+-	check_stack();
++	/*
++	 * When fentry is used, the traced function does not get
++	 * its stack frame set up, and we lose the parent.
++	 * The ip is pretty useless because the function tracer
++	 * was called before that function set up its stack frame.
++	 * In this case, we use the parent ip.
++	 *
++	 * By adding the return address of either the parent ip
++	 * or the current ip we can disregard most of the stack usage
++	 * caused by the stack tracer itself.
++	 *
++	 * The function tracer always reports the address of where the
++	 * mcount call was, but the stack will hold the return address.
++	 */
++	if (fentry)
++		ip = parent_ip;
++	else
++		ip += MCOUNT_INSN_SIZE;
++
++	check_stack(ip, &stack);
+ 
+  out:
+ 	per_cpu(trace_active, cpu)--;
+@@ -371,6 +431,8 @@ static __init int stack_trace_init(void)
+ 	struct dentry *d_tracer;
+ 
+ 	d_tracer = tracing_init_dentry();
++	if (!d_tracer)
++		return 0;
+ 
+ 	trace_create_file("stack_max_size", 0644, d_tracer,
+ 			&max_stack_size, &stack_max_size_fops);
+diff --git a/kernel/trace/trace_stat.c b/kernel/trace/trace_stat.c
+index 96cffb2..847f88a 100644
+--- a/kernel/trace/trace_stat.c
++++ b/kernel/trace/trace_stat.c
+@@ -307,6 +307,8 @@ static int tracing_stat_init(void)
+ 	struct dentry *d_tracing;
+ 
+ 	d_tracing = tracing_init_dentry();
++	if (!d_tracing)
++		return 0;
+ 
+ 	stat_dir = debugfs_create_dir("trace_stat", d_tracing);
+ 	if (!stat_dir)
+diff --git a/lib/oid_registry.c b/lib/oid_registry.c
+index d8de11f..318f382 100644
+--- a/lib/oid_registry.c
++++ b/lib/oid_registry.c
+@@ -9,6 +9,7 @@
+  * 2 of the Licence, or (at your option) any later version.
+  */
+ 
++#include <linux/module.h>
+ #include <linux/export.h>
+ #include <linux/oid_registry.h>
+ #include <linux/kernel.h>
+@@ -16,6 +17,10 @@
+ #include <linux/bug.h>
+ #include "oid_registry_data.c"
+ 
++MODULE_DESCRIPTION("OID Registry");
++MODULE_AUTHOR("Red Hat, Inc.");
++MODULE_LICENSE("GPL");
++
+ /**
+  * look_up_OID - Find an OID registration for the specified data
+  * @data: Binary representation of the OID
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 90db251..32f3372 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -2289,7 +2289,7 @@ static void unmap_region(struct mm_struct *mm,
+ 	update_hiwater_rss(mm);
+ 	unmap_vmas(&tlb, vma, start, end);
+ 	free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS,
+-				 next ? next->vm_start : 0);
++				 next ? next->vm_start : USER_PGTABLES_CEILING);
+ 	tlb_finish_mmu(&tlb, start, end);
+ }
+ 
+@@ -2667,7 +2667,7 @@ void exit_mmap(struct mm_struct *mm)
+ 	/* Use -1 here to ensure all VMAs in the mm are unmapped */
+ 	unmap_vmas(&tlb, vma, 0, -1);
+ 
+-	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, 0);
++	free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING);
+ 	tlb_finish_mmu(&tlb, 0, -1);
+ 
+ 	/*
+diff --git a/mm/page_io.c b/mm/page_io.c
+index 78eee32..6182870 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -214,6 +214,7 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
+ 		kiocb.ki_left = PAGE_SIZE;
+ 		kiocb.ki_nbytes = PAGE_SIZE;
+ 
++		set_page_writeback(page);
+ 		unlock_page(page);
+ 		ret = mapping->a_ops->direct_IO(KERNEL_WRITE,
+ 						&kiocb, &iov,
+@@ -222,7 +223,23 @@ int swap_writepage(struct page *page, struct writeback_control *wbc)
+ 		if (ret == PAGE_SIZE) {
+ 			count_vm_event(PSWPOUT);
+ 			ret = 0;
++		} else {
++			/*
++			 * In the case of swap-over-nfs, this can be a
++			 * temporary failure if the system has limited
++			 * memory for allocating transmit buffers.
++			 * Mark the page dirty and avoid
++			 * rotate_reclaimable_page but rate-limit the
++			 * messages but do not flag PageError like
++			 * the normal direct-to-bio case as it could
++			 * be temporary.
++			 */
++			set_page_dirty(page);
++			ClearPageReclaim(page);
++			pr_err_ratelimited("Write error on dio swapfile (%Lu)\n",
++				page_file_offset(page));
+ 		}
++		end_page_writeback(page);
+ 		return ret;
+ 	}
+ 
+diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
+index 79a48f3..64619f4 100644
+--- a/net/mac80211/pm.c
++++ b/net/mac80211/pm.c
+@@ -52,8 +52,8 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+ 	ieee80211_stop_queues_by_reason(hw,
+ 			IEEE80211_QUEUE_STOP_REASON_SUSPEND);
+ 
+-	/* flush out all packets */
+-	synchronize_net();
++	/* flush out all packets and station cleanup call_rcu()s */
++	rcu_barrier();
+ 
+ 	drv_flush(local, false);
+ 
+diff --git a/net/wireless/reg.c b/net/wireless/reg.c
+index 82c4fc7..91ef82b 100644
+--- a/net/wireless/reg.c
++++ b/net/wireless/reg.c
+@@ -883,7 +883,7 @@ static void handle_channel(struct wiphy *wiphy,
+ 			return;
+ 
+ 		REG_DBG_PRINT("Disabling freq %d MHz\n", chan->center_freq);
+-		chan->flags = IEEE80211_CHAN_DISABLED;
++		chan->flags |= IEEE80211_CHAN_DISABLED;
+ 		return;
+ 	}
+ 
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index 3368939..68b85e1 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -156,7 +156,6 @@ sub read_kconfig {
+ 
+     my $state = "NONE";
+     my $config;
+-    my @kconfigs;
+ 
+     my $cont = 0;
+     my $line;
+@@ -190,7 +189,13 @@ sub read_kconfig {
+ 
+ 	# collect any Kconfig sources
+ 	if (/^source\s*"(.*)"/) {
+-	    $kconfigs[$#kconfigs+1] = $1;
++	    my $kconfig = $1;
++	    # prevent reading twice.
++	    if (!defined($read_kconfigs{$kconfig})) {
++		$read_kconfigs{$kconfig} = 1;
++		read_kconfig($kconfig);
++	    }
++	    next;
+ 	}
+ 
+ 	# configs found
+@@ -250,14 +255,6 @@ sub read_kconfig {
+ 	}
+     }
+     close($kinfile);
+-
+-    # read in any configs that were found.
+-    foreach my $kconfig (@kconfigs) {
+-	if (!defined($read_kconfigs{$kconfig})) {
+-	    $read_kconfigs{$kconfig} = 1;
+-	    read_kconfig($kconfig);
+-	}
+-    }
+ }
+ 
+ if ($kconfig) {
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index e6b0166..bdd888e 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -657,14 +657,14 @@ static int snd_emu10k1_cardbus_init(struct snd_emu10k1 *emu)
+ 	return 0;
+ }
+ 
+-static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu)
++static int snd_emu1010_load_firmware(struct snd_emu10k1 *emu,
++				     const struct firmware *fw_entry)
+ {
+ 	int n, i;
+ 	int reg;
+ 	int value;
+ 	unsigned int write_post;
+ 	unsigned long flags;
+-	const struct firmware *fw_entry = emu->firmware;
+ 
+ 	if (!fw_entry)
+ 		return -EIO;
+@@ -725,9 +725,34 @@ static int emu1010_firmware_thread(void *data)
+ 			/* Return to Audio Dock programming mode */
+ 			snd_printk(KERN_INFO "emu1010: Loading Audio Dock Firmware\n");
+ 			snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, EMU_HANA_FPGA_CONFIG_AUDIODOCK);
+-			err = snd_emu1010_load_firmware(emu);
+-			if (err != 0)
+-				continue;
++
++			if (!emu->dock_fw) {
++				const char *filename = NULL;
++				switch (emu->card_capabilities->emu_model) {
++				case EMU_MODEL_EMU1010:
++					filename = DOCK_FILENAME;
++					break;
++				case EMU_MODEL_EMU1010B:
++					filename = MICRO_DOCK_FILENAME;
++					break;
++				case EMU_MODEL_EMU1616:
++					filename = MICRO_DOCK_FILENAME;
++					break;
++				}
++				if (filename) {
++					err = request_firmware(&emu->dock_fw,
++							       filename,
++							       &emu->pci->dev);
++					if (err)
++						continue;
++				}
++			}
++
++			if (emu->dock_fw) {
++				err = snd_emu1010_load_firmware(emu, emu->dock_fw);
++				if (err)
++					continue;
++			}
+ 
+ 			snd_emu1010_fpga_write(emu, EMU_HANA_FPGA_CONFIG, 0);
+ 			snd_emu1010_fpga_read(emu, EMU_HANA_IRQ_STATUS, &reg);
+@@ -862,7 +887,7 @@ static int snd_emu10k1_emu1010_init(struct snd_emu10k1 *emu)
+ 			   filename, emu->firmware->size);
+ 	}
+ 
+-	err = snd_emu1010_load_firmware(emu);
++	err = snd_emu1010_load_firmware(emu, emu->firmware);
+ 	if (err != 0) {
+ 		snd_printk(KERN_INFO "emu1010: Loading Firmware failed\n");
+ 		return err;
+@@ -1253,6 +1278,8 @@ static int snd_emu10k1_free(struct snd_emu10k1 *emu)
+ 		kthread_stop(emu->emu1010.firmware_thread);
+ 	if (emu->firmware)
+ 		release_firmware(emu->firmware);
++	if (emu->dock_fw)
++		release_firmware(emu->dock_fw);
+ 	if (emu->irq >= 0)
+ 		free_irq(emu->irq, emu);
+ 	/* remove reserved page */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index ee975a2..7f45d48 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5823,6 +5823,7 @@ enum {
+ 	ALC269_TYPE_ALC280,
+ 	ALC269_TYPE_ALC282,
+ 	ALC269_TYPE_ALC284,
++	ALC269_TYPE_ALC286,
+ };
+ 
+ /*
+@@ -5846,6 +5847,7 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ 	case ALC269_TYPE_ALC269VB:
+ 	case ALC269_TYPE_ALC269VD:
+ 	case ALC269_TYPE_ALC282:
++	case ALC269_TYPE_ALC286:
+ 		ssids = alc269_ssids;
+ 		break;
+ 	default:
+@@ -6451,6 +6453,9 @@ static int patch_alc269(struct hda_codec *codec)
+ 	case 0x10ec0292:
+ 		spec->codec_variant = ALC269_TYPE_ALC284;
+ 		break;
++	case 0x10ec0286:
++		spec->codec_variant = ALC269_TYPE_ALC286;
++		break;
+ 	}
+ 
+ 	/* automatic parse from the BIOS config */
+@@ -7157,6 +7162,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
++	{ .id = 0x10ec0286, .name = "ALC286", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
+ 	{ .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
+diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c
+index a4c16fd..5d36319 100644
+--- a/sound/soc/codecs/max98088.c
++++ b/sound/soc/codecs/max98088.c
+@@ -2006,7 +2006,7 @@ static int max98088_probe(struct snd_soc_codec *codec)
+                        ret);
+                goto err_access;
+        }
+-       dev_info(codec->dev, "revision %c\n", ret + 'A');
++       dev_info(codec->dev, "revision %c\n", ret - 0x40 + 'A');
+ 
+        snd_soc_write(codec, M98088_REG_51_PWR_SYS, M98088_PWRSV);
+ 
+diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
+index e2ca12f..40dd50a 100644
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -575,7 +575,6 @@ static void usb6fire_pcm_init_urb(struct pcm_urb *urb,
+ 	urb->instance.pipe = in ? usb_rcvisocpipe(chip->dev, ep)
+ 			: usb_sndisocpipe(chip->dev, ep);
+ 	urb->instance.interval = 1;
+-	urb->instance.transfer_flags = URB_ISO_ASAP;
+ 	urb->instance.complete = handler;
+ 	urb->instance.context = urb;
+ 	urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB;
+diff --git a/sound/usb/caiaq/audio.c b/sound/usb/caiaq/audio.c
+index fde9a7a..b45e29b 100644
+--- a/sound/usb/caiaq/audio.c
++++ b/sound/usb/caiaq/audio.c
+@@ -670,7 +670,6 @@ static void read_completed(struct urb *urb)
+ 
+ 	if (send_it) {
+ 		out->number_of_packets = outframe;
+-		out->transfer_flags = URB_ISO_ASAP;
+ 		usb_submit_urb(out, GFP_ATOMIC);
+ 	} else {
+ 		struct snd_usb_caiaq_cb_info *oinfo = out->context;
+@@ -686,7 +685,6 @@ requeue:
+ 	}
+ 
+ 	urb->number_of_packets = FRAMES_PER_URB;
+-	urb->transfer_flags = URB_ISO_ASAP;
+ 	usb_submit_urb(urb, GFP_ATOMIC);
+ }
+ 
+@@ -751,7 +749,6 @@ static struct urb **alloc_urbs(struct snd_usb_caiaqdev *dev, int dir, int *ret)
+ 						* BYTES_PER_FRAME;
+ 		urbs[i]->context = &dev->data_cb_info[i];
+ 		urbs[i]->interval = 1;
+-		urbs[i]->transfer_flags = URB_ISO_ASAP;
+ 		urbs[i]->number_of_packets = FRAMES_PER_URB;
+ 		urbs[i]->complete = (dir == SNDRV_PCM_STREAM_CAPTURE) ?
+ 					read_completed : write_completed;
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index ccf95cf..a9d5779 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -612,7 +612,9 @@ int snd_usb_autoresume(struct snd_usb_audio *chip)
+ 	int err = -ENODEV;
+ 
+ 	down_read(&chip->shutdown_rwsem);
+-	if (!chip->shutdown && !chip->probing)
++	if (chip->probing)
++		err = 0;
++	else if (!chip->shutdown)
+ 		err = usb_autopm_get_interface(chip->pm_intf);
+ 	up_read(&chip->shutdown_rwsem);
+ 
+diff --git a/sound/usb/card.h b/sound/usb/card.h
+index 8a751b4..d32ea41 100644
+--- a/sound/usb/card.h
++++ b/sound/usb/card.h
+@@ -116,6 +116,7 @@ struct snd_usb_substream {
+ 	unsigned int altset_idx;     /* USB data format: index of alternate setting */
+ 	unsigned int txfr_quirk:1;	/* allow sub-frame alignment */
+ 	unsigned int fmt_type;		/* USB audio format type (1-3) */
++	unsigned int pkt_offset_adj;	/* Bytes to drop from beginning of packets (for non-compliant devices) */
+ 
+ 	unsigned int running: 1;	/* running status */
+ 
+diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c
+index 21049b8..63cca3a 100644
+--- a/sound/usb/endpoint.c
++++ b/sound/usb/endpoint.c
+@@ -677,7 +677,7 @@ static int data_ep_set_params(struct snd_usb_endpoint *ep,
+ 		if (!u->urb->transfer_buffer)
+ 			goto out_of_memory;
+ 		u->urb->pipe = ep->pipe;
+-		u->urb->transfer_flags = URB_ISO_ASAP | URB_NO_TRANSFER_DMA_MAP;
++		u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
+ 		u->urb->interval = 1 << ep->datainterval;
+ 		u->urb->context = u;
+ 		u->urb->complete = snd_complete_urb;
+@@ -716,8 +716,7 @@ static int sync_ep_set_params(struct snd_usb_endpoint *ep,
+ 		u->urb->transfer_dma = ep->sync_dma + i * 4;
+ 		u->urb->transfer_buffer_length = 4;
+ 		u->urb->pipe = ep->pipe;
+-		u->urb->transfer_flags = URB_ISO_ASAP |
+-					 URB_NO_TRANSFER_DMA_MAP;
++		u->urb->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
+ 		u->urb->number_of_packets = 1;
+ 		u->urb->interval = 1 << ep->syncinterval;
+ 		u->urb->context = u;
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 34b9bb7..e5fee18 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -126,7 +126,6 @@ struct snd_usb_midi {
+ 		struct snd_usb_midi_in_endpoint *in;
+ 	} endpoints[MIDI_MAX_ENDPOINTS];
+ 	unsigned long input_triggered;
+-	bool autopm_reference;
+ 	unsigned int opened[2];
+ 	unsigned char disconnected;
+ 	unsigned char input_running;
+@@ -1040,7 +1039,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir,
+ {
+ 	struct snd_usb_midi* umidi = substream->rmidi->private_data;
+ 	struct snd_kcontrol *ctl;
+-	int err;
+ 
+ 	down_read(&umidi->disc_rwsem);
+ 	if (umidi->disconnected) {
+@@ -1051,13 +1049,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir,
+ 	mutex_lock(&umidi->mutex);
+ 	if (open) {
+ 		if (!umidi->opened[0] && !umidi->opened[1]) {
+-			err = usb_autopm_get_interface(umidi->iface);
+-			umidi->autopm_reference = err >= 0;
+-			if (err < 0 && err != -EACCES) {
+-				mutex_unlock(&umidi->mutex);
+-				up_read(&umidi->disc_rwsem);
+-				return -EIO;
+-			}
+ 			if (umidi->roland_load_ctl) {
+ 				ctl = umidi->roland_load_ctl;
+ 				ctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_INACTIVE;
+@@ -1080,8 +1071,6 @@ static int substream_open(struct snd_rawmidi_substream *substream, int dir,
+ 				snd_ctl_notify(umidi->card,
+ 				       SNDRV_CTL_EVENT_MASK_INFO, &ctl->id);
+ 			}
+-			if (umidi->autopm_reference)
+-				usb_autopm_put_interface(umidi->iface);
+ 		}
+ 	}
+ 	mutex_unlock(&umidi->mutex);
+@@ -2256,6 +2245,8 @@ int snd_usbmidi_create(struct snd_card *card,
+ 		return err;
+ 	}
+ 
++	usb_autopm_get_interface_no_resume(umidi->iface);
++
+ 	list_add_tail(&umidi->list, midi_list);
+ 	return 0;
+ }
+diff --git a/sound/usb/misc/ua101.c b/sound/usb/misc/ua101.c
+index 8b81cb5..6ad617b 100644
+--- a/sound/usb/misc/ua101.c
++++ b/sound/usb/misc/ua101.c
+@@ -1120,8 +1120,7 @@ static int alloc_stream_urbs(struct ua101 *ua, struct ua101_stream *stream,
+ 			usb_init_urb(&urb->urb);
+ 			urb->urb.dev = ua->dev;
+ 			urb->urb.pipe = stream->usb_pipe;
+-			urb->urb.transfer_flags = URB_ISO_ASAP |
+-					URB_NO_TRANSFER_DMA_MAP;
++			urb->urb.transfer_flags = URB_NO_TRANSFER_DMA_MAP;
+ 			urb->urb.transfer_buffer = addr;
+ 			urb->urb.transfer_dma = dma;
+ 			urb->urb.transfer_buffer_length = max_packet_size;
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index d82e378..bcc50ed 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1161,7 +1161,7 @@ static void retire_capture_urb(struct snd_usb_substream *subs,
+ 	stride = runtime->frame_bits >> 3;
+ 
+ 	for (i = 0; i < urb->number_of_packets; i++) {
+-		cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset;
++		cp = (unsigned char *)urb->transfer_buffer + urb->iso_frame_desc[i].offset + subs->pkt_offset_adj;
+ 		if (urb->iso_frame_desc[i].status && printk_ratelimit()) {
+ 			snd_printdd(KERN_ERR "frame %d active: %d\n", i, urb->iso_frame_desc[i].status);
+ 			// continue;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index b9ca776..f581c3e 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -837,6 +837,7 @@ static void set_format_emu_quirk(struct snd_usb_substream *subs,
+ 		break;
+ 	}
+ 	snd_emuusb_set_samplerate(subs->stream->chip, emu_samplerate_id);
++	subs->pkt_offset_adj = (emu_samplerate_id >= EMU_QUIRK_SR_176400HZ) ? 4 : 0;
+ }
+ 
+ void snd_usb_set_format_quirk(struct snd_usb_substream *subs,
+diff --git a/sound/usb/stream.c b/sound/usb/stream.c
+index ad181d5..cfc4d4e 100644
+--- a/sound/usb/stream.c
++++ b/sound/usb/stream.c
+@@ -94,6 +94,7 @@ static void snd_usb_init_substream(struct snd_usb_stream *as,
+ 	subs->dev = as->chip->dev;
+ 	subs->txfr_quirk = as->chip->txfr_quirk;
+ 	subs->speed = snd_usb_get_speed(subs->dev);
++	subs->pkt_offset_adj = 0;
+ 
+ 	snd_usb_set_pcm_ops(as->pcm, stream);
+ 
+@@ -396,6 +397,14 @@ static int parse_uac_endpoint_attributes(struct snd_usb_audio *chip,
+ 	if (!csep && altsd->bNumEndpoints >= 2)
+ 		csep = snd_usb_find_desc(alts->endpoint[1].extra, alts->endpoint[1].extralen, NULL, USB_DT_CS_ENDPOINT);
+ 
++	/*
++	 * If we can't locate the USB_DT_CS_ENDPOINT descriptor in the extra
++	 * bytes after the first endpoint, go search the entire interface.
++	 * Some devices have it directly *before* the standard endpoint.
++	 */
++	if (!csep)
++		csep = snd_usb_find_desc(alts->extra, alts->extralen, NULL, USB_DT_CS_ENDPOINT);
++
+ 	if (!csep || csep->bLength < 7 ||
+ 	    csep->bDescriptorSubtype != UAC_EP_GENERAL) {
+ 		snd_printk(KERN_WARNING "%d:%u:%d : no or invalid"
+diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c
+index 1e7a47a..bf618e1 100644
+--- a/sound/usb/usx2y/usb_stream.c
++++ b/sound/usb/usx2y/usb_stream.c
+@@ -69,7 +69,6 @@ static void init_pipe_urbs(struct usb_stream_kernel *sk, unsigned use_packsize,
+ 	     ++u, transfer += transfer_length) {
+ 		struct urb *urb = urbs[u];
+ 		struct usb_iso_packet_descriptor *desc;
+-		urb->transfer_flags = URB_ISO_ASAP;
+ 		urb->transfer_buffer = transfer;
+ 		urb->dev = dev;
+ 		urb->pipe = pipe;
+diff --git a/sound/usb/usx2y/usbusx2yaudio.c b/sound/usb/usx2y/usbusx2yaudio.c
+index 520ef96..b376532 100644
+--- a/sound/usb/usx2y/usbusx2yaudio.c
++++ b/sound/usb/usx2y/usbusx2yaudio.c
+@@ -503,7 +503,6 @@ static int usX2Y_urbs_start(struct snd_usX2Y_substream *subs)
+ 			if (0 == i)
+ 				atomic_set(&subs->state, state_STARTING3);
+ 			urb->dev = usX2Y->dev;
+-			urb->transfer_flags = URB_ISO_ASAP;
+ 			for (pack = 0; pack < nr_of_packs(); pack++) {
+ 				urb->iso_frame_desc[pack].offset = subs->maxpacksize * pack;
+ 				urb->iso_frame_desc[pack].length = subs->maxpacksize;
+diff --git a/sound/usb/usx2y/usx2yhwdeppcm.c b/sound/usb/usx2y/usx2yhwdeppcm.c
+index cc56007..f2a1acd 100644
+--- a/sound/usb/usx2y/usx2yhwdeppcm.c
++++ b/sound/usb/usx2y/usx2yhwdeppcm.c
+@@ -443,7 +443,6 @@ static int usX2Y_usbpcm_urbs_start(struct snd_usX2Y_substream *subs)
+ 					if (0 == u)
+ 						atomic_set(&subs->state, state_STARTING3);
+ 					urb->dev = usX2Y->dev;
+-					urb->transfer_flags = URB_ISO_ASAP;
+ 					for (pack = 0; pack < nr_of_packs(); pack++) {
+ 						urb->iso_frame_desc[pack].offset = subs->maxpacksize * (pack + u * nr_of_packs());
+ 						urb->iso_frame_desc[pack].length = subs->maxpacksize;
diff --git a/3.8.11/4420_grsecurity-2.9.1-3.8.11-201305011917.patch b/3.8.12/4420_grsecurity-2.9.1-3.8.12-201305082215.patch
index 3b5ee11..7f22cfc 100644
--- a/3.8.11/4420_grsecurity-2.9.1-3.8.11-201305011917.patch
+++ b/3.8.12/4420_grsecurity-2.9.1-3.8.12-201305082215.patch
@@ -259,7 +259,7 @@ index 986614d..e8bfedc 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 7e4eee5..271e75e 100644
+index 902974f..3a7c75c 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -2001,7 +2001,7 @@ index a3f3792..7b932a6 100644
  #define L_PTE_DIRTY_HIGH	(1 << (55 - 32))
  
 diff --git a/arch/arm/include/asm/pgtable.h b/arch/arm/include/asm/pgtable.h
-index c094749..a6ff605 100644
+index 26e9ce4..461ed7f 100644
 --- a/arch/arm/include/asm/pgtable.h
 +++ b/arch/arm/include/asm/pgtable.h
 @@ -30,6 +30,9 @@
@@ -2075,7 +2075,7 @@ index c094749..a6ff605 100644
  /*
   * This is the lowest virtual address we can permit any user space
   * mapping to be mapped at.  This is particularly important for
-@@ -63,8 +113,8 @@ extern void __pgd_error(const char *file, int line, pgd_t);
+@@ -72,8 +122,8 @@ extern void __pgd_error(const char *file, int line, pgd_t);
  /*
   * The pgprot_* and protection_map entries will be fixed up in runtime
   * to include the cachable and bufferable bits based on memory policy,
@@ -2086,7 +2086,7 @@ index c094749..a6ff605 100644
   */
  #define _L_PTE_DEFAULT	L_PTE_PRESENT | L_PTE_YOUNG
  
-@@ -241,7 +291,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
+@@ -250,7 +300,7 @@ static inline pte_t pte_mkspecial(pte_t pte) { return pte; }
  static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
  {
  	const pteval_t mask = L_PTE_XN | L_PTE_RDONLY | L_PTE_USER |
@@ -5042,7 +5042,7 @@ index 2d67317..07d8bfa 100644
  	.notifier_call = err_inject_cpu_callback,
  };
 diff --git a/arch/ia64/kernel/mca.c b/arch/ia64/kernel/mca.c
-index 65bf9cd..794f06b 100644
+index d7396db..b33e873 100644
 --- a/arch/ia64/kernel/mca.c
 +++ b/arch/ia64/kernel/mca.c
 @@ -1922,7 +1922,7 @@ static int __cpuinit mca_cpu_callback(struct notifier_block *nfb,
@@ -6972,7 +6972,7 @@ index 4684e33..acc4d19e 100644
  	ld	r4,_DAR(r1)
  	bl	.bad_page_fault
 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 3684cbd..bc89eab 100644
+index bb11075..2d00a2a 100644
 --- a/arch/powerpc/kernel/exceptions-64s.S
 +++ b/arch/powerpc/kernel/exceptions-64s.S
 @@ -1206,10 +1206,10 @@ handle_page_fault:
@@ -7894,7 +7894,7 @@ index ef9e555..331bd29 100644
  #define __read_mostly __attribute__((__section__(".data..read_mostly")))
  
 diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
-index 03f2b55..b027032 100644
+index 03f2b55..b0270327 100644
 --- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c
 +++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c
 @@ -143,7 +143,7 @@ shx3_cpu_callback(struct notifier_block *nfb, unsigned long action, void *hcpu)
@@ -18028,6 +18028,52 @@ index 70602f8..9d9edb7 100644
  	}
  
  	intel_ds_init();
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+index da02e9c..94db951 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c
+@@ -310,7 +310,7 @@ void intel_pmu_lbr_read(void)
+  * - in case there is no HW filter
+  * - in case the HW filter has errata or limitations
+  */
+-static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
++static int intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
+ {
+ 	u64 br_type = event->attr.branch_sample_type;
+ 	int mask = 0;
+@@ -318,8 +318,11 @@ static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
+ 	if (br_type & PERF_SAMPLE_BRANCH_USER)
+ 		mask |= X86_BR_USER;
+ 
+-	if (br_type & PERF_SAMPLE_BRANCH_KERNEL)
++	if (br_type & PERF_SAMPLE_BRANCH_KERNEL) {
++		if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN))
++			return -EACCES;
+ 		mask |= X86_BR_KERNEL;
++	}
+ 
+ 	/* we ignore BRANCH_HV here */
+ 
+@@ -339,6 +342,8 @@ static void intel_pmu_setup_sw_lbr_filter(struct perf_event *event)
+ 	 * be used by fixup code for some CPU
+ 	 */
+ 	event->hw.branch_reg.reg = mask;
++
++	return 0;
+ }
+ 
+ /*
+@@ -386,7 +391,9 @@ int intel_pmu_setup_lbr_filter(struct perf_event *event)
+ 	/*
+ 	 * setup SW LBR filter
+ 	 */
+-	intel_pmu_setup_sw_lbr_filter(event);
++	ret = intel_pmu_setup_sw_lbr_filter(event);
++	if (ret)
++		return ret;
+ 
+ 	/*
+ 	 * setup HW LBR filter, if any
 diff --git a/arch/x86/kernel/cpu/perf_event_intel_uncore.c b/arch/x86/kernel/cpu/perf_event_intel_uncore.c
 index b43200d..d235b3e 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel_uncore.c
@@ -21290,7 +21336,7 @@ index 8c96897..be66bfa 100644
  			return -EPERM;
  	}
 diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
-index e4595f1..ee3bfb8 100644
+index 84b7789..e65e8be 100644
 --- a/arch/x86/kernel/irq.c
 +++ b/arch/x86/kernel/irq.c
 @@ -18,7 +18,7 @@
@@ -21314,19 +21360,15 @@ index e4595f1..ee3bfb8 100644
  #endif
  	return 0;
  }
-@@ -164,10 +164,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
+@@ -164,7 +164,7 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
  
  u64 arch_irq_stat(void)
  {
 -	u64 sum = atomic_read(&irq_err_count);
 +	u64 sum = atomic_read_unchecked(&irq_err_count);
- 
- #ifdef CONFIG_X86_IO_APIC
--	sum += atomic_read(&irq_mis_count);
-+	sum += atomic_read_unchecked(&irq_mis_count);
- #endif
  	return sum;
  }
+ 
 diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
 index 344faf8..355f60d 100644
 --- a/arch/x86/kernel/irq_32.c
@@ -24285,7 +24327,7 @@ index a20ecb5..d0e2194 100644
  
  out:
 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index a27e763..54bfe43 100644
+index d330b3c..101a42b 100644
 --- a/arch/x86/kvm/emulate.c
 +++ b/arch/x86/kvm/emulate.c
 @@ -292,6 +292,7 @@ static void invalidate_registers(struct x86_emulate_ctxt *ctxt)
@@ -31441,7 +31483,7 @@ index 431e875..cbb23f3 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 2262003..3ee61cf 100644
+index 08c6511..d946c4a 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -100,8 +100,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -31562,7 +31604,7 @@ index 2262003..3ee61cf 100644
  	xen_smp_init();
  
  #ifdef CONFIG_ACPI_NUMA
-@@ -1598,7 +1597,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
+@@ -1601,7 +1600,7 @@ static int __cpuinit xen_hvm_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -31651,7 +31693,7 @@ index cab96b6..8c629ba 100644
  	.alloc_pud = xen_alloc_pmd_init,
  	.release_pud = xen_release_pmd_init,
 diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 34bc4ce..c34aa24 100644
+index 48d7b2c..20fed27 100644
 --- a/arch/x86/xen/smp.c
 +++ b/arch/x86/xen/smp.c
 @@ -229,11 +229,6 @@ static void __init xen_smp_prepare_boot_cpu(void)
@@ -34429,7 +34471,7 @@ index d780295..b29f3a8 100644
  
  	return 0;
 diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
-index 93211df..c7805f7 100644
+index ba780b7..cdb8a9c 100644
 --- a/drivers/char/tpm/tpm.c
 +++ b/drivers/char/tpm/tpm.c
 @@ -410,7 +410,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
@@ -38261,7 +38303,7 @@ index 0d8f086..f5a91d5 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index f363135..9b38815 100644
+index 0411bde..5a023ff 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -240,10 +240,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
@@ -38333,7 +38375,7 @@ index f363135..9b38815 100644
  
  	INIT_LIST_HEAD(&rdev->same_set);
  	init_waitqueue_head(&rdev->blocked_wait);
-@@ -6987,7 +6987,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
+@@ -6984,7 +6984,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
  
  		spin_unlock(&pers_lock);
  		seq_printf(seq, "\n");
@@ -38342,7 +38384,7 @@ index f363135..9b38815 100644
  		return 0;
  	}
  	if (v == (void*)2) {
-@@ -7090,7 +7090,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
+@@ -7087,7 +7087,7 @@ static int md_seq_open(struct inode *inode, struct file *file)
  		return error;
  
  	seq = file->private_data;
@@ -38351,7 +38393,7 @@ index f363135..9b38815 100644
  	return error;
  }
  
-@@ -7104,7 +7104,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
+@@ -7101,7 +7101,7 @@ static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
  	/* always allow read */
  	mask = POLLIN | POLLRDNORM;
  
@@ -38360,7 +38402,7 @@ index f363135..9b38815 100644
  		mask |= POLLERR | POLLPRI;
  	return mask;
  }
-@@ -7148,7 +7148,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
+@@ -7145,7 +7145,7 @@ static int is_mddev_idle(struct mddev *mddev, int init)
  		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
  		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
  			      (int)part_stat_read(&disk->part0, sectors[1]) -
@@ -38411,10 +38453,10 @@ index 1cbfc6b..56e1dbb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index fd86b37..a5389ef 100644
+index 6af167f..40c25a1 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
-@@ -1821,7 +1821,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
+@@ -1826,7 +1826,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
  			if (r1_sync_page_io(rdev, sect, s,
  					    bio->bi_io_vec[idx].bv_page,
  					    READ) != 0)
@@ -38423,7 +38465,7 @@ index fd86b37..a5389ef 100644
  		}
  		sectors -= s;
  		sect += s;
-@@ -2043,7 +2043,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
+@@ -2048,7 +2048,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
  			    test_bit(In_sync, &rdev->flags)) {
  				if (r1_sync_page_io(rdev, sect, s,
  						    conf->tmppage, READ)) {
@@ -38433,10 +38475,10 @@ index fd86b37..a5389ef 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index b3898d4..23a462b 100644
+index 61ab219..7b232b3 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
-@@ -1881,7 +1881,7 @@ static void end_sync_read(struct bio *bio, int error)
+@@ -1886,7 +1886,7 @@ static void end_sync_read(struct bio *bio, int error)
  		/* The write handler will notice the lack of
  		 * R10BIO_Uptodate and record any errors etc
  		 */
@@ -38445,7 +38487,7 @@ index b3898d4..23a462b 100644
  			   &conf->mirrors[d].rdev->corrected_errors);
  
  	/* for reconstruct, we always reschedule after a read.
-@@ -2230,7 +2230,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
+@@ -2235,7 +2235,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
  {
  	struct timespec cur_time_mon;
  	unsigned long hours_since_last;
@@ -38454,7 +38496,7 @@ index b3898d4..23a462b 100644
  
  	ktime_get_ts(&cur_time_mon);
  
-@@ -2252,9 +2252,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
+@@ -2257,9 +2257,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
  	 * overflowing the shift of read_errors by hours_since_last.
  	 */
  	if (hours_since_last >= 8 * sizeof(read_errors))
@@ -38466,7 +38508,7 @@ index b3898d4..23a462b 100644
  }
  
  static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector,
-@@ -2308,8 +2308,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2313,8 +2313,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
  		return;
  
  	check_decay_read_errors(mddev, rdev);
@@ -38477,7 +38519,7 @@ index b3898d4..23a462b 100644
  		char b[BDEVNAME_SIZE];
  		bdevname(rdev->bdev, b);
  
-@@ -2317,7 +2317,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2322,7 +2322,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
  		       "md/raid10:%s: %s: Raid device exceeded "
  		       "read_error threshold [cur %d:max %d]\n",
  		       mdname(mddev), b,
@@ -38486,7 +38528,7 @@ index b3898d4..23a462b 100644
  		printk(KERN_NOTICE
  		       "md/raid10:%s: %s: Failing raid device\n",
  		       mdname(mddev), b);
-@@ -2472,7 +2472,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2477,7 +2477,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
  					       sect +
  					       choose_data_offset(r10_bio, rdev)),
  				       bdevname(rdev->bdev, b));
@@ -40716,7 +40758,7 @@ index 3726cd6..b655808 100644
  
  	D_INFO("*** LOAD DRIVER ***\n");
 diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
-index 5b9533e..7733880 100644
+index 2c056b1..698efa9 100644
 --- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
 +++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
 @@ -203,7 +203,7 @@ static ssize_t iwl_dbgfs_sram_write(struct file *file,
@@ -41828,7 +41870,7 @@ index 0d84b1f..c2da6ac 100644
  	mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators,
  					ARRAY_SIZE(mc13892_regulators));
 diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
-index 16630aa..6afc992 100644
+index 1c77423..2971d18 100644
 --- a/drivers/rtc/rtc-cmos.c
 +++ b/drivers/rtc/rtc-cmos.c
 @@ -724,7 +724,9 @@ cmos_do_probe(struct device *dev, struct resource *ports, int rtc_irq)
@@ -43685,10 +43727,10 @@ index 19083ef..6e34e97 100644
  }
  EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
 diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
-index ac35c90..c47deac 100644
+index c830b60..b239698 100644
 --- a/drivers/tty/pty.c
 +++ b/drivers/tty/pty.c
-@@ -790,8 +790,10 @@ static void __init unix98_pty_init(void)
+@@ -793,8 +793,10 @@ static void __init unix98_pty_init(void)
  		panic("Couldn't register Unix98 pts driver");
  
  	/* Now create the /dev/ptmx special device */
@@ -43870,7 +43912,7 @@ index e514b3a..c73d614 100644
  
  	if (cfg->uart_flags & UPF_CONS_FLOW) {
 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index 2c7230a..2104f16 100644
+index 4293a3e..7227e42 100644
 --- a/drivers/tty/serial/serial_core.c
 +++ b/drivers/tty/serial/serial_core.c
 @@ -1455,7 +1455,7 @@ static void uart_hangup(struct tty_struct *tty)
@@ -44312,7 +44354,7 @@ index b3c4a25..723916f 100644
  
  		if (get_user(c, buf))
 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index 892ecda..90cbf36 100644
+index f34f98d..73c6c42 100644
 --- a/drivers/tty/tty_io.c
 +++ b/drivers/tty/tty_io.c
 @@ -3401,7 +3401,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
@@ -50661,10 +50703,10 @@ index 1774932..5812106 100644
  EXPORT_SYMBOL(dump_write);
  
 diff --git a/fs/dcache.c b/fs/dcache.c
-index c3bbf85..5b71101 100644
+index de73da2..2ed907b 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
-@@ -3139,7 +3139,7 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3141,7 +3141,7 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -50796,7 +50838,7 @@ index b2a34a1..162fa69 100644
  	return rc;
  }
 diff --git a/fs/exec.c b/fs/exec.c
-index 20df02c..9a87617 100644
+index ac014f1..0bfe729 100644
 --- a/fs/exec.c
 +++ b/fs/exec.c
 @@ -55,8 +55,20 @@
@@ -51098,7 +51140,7 @@ index 20df02c..9a87617 100644
  	set_fs(old_fs);
  	return result;
  }
-@@ -1247,7 +1322,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+@@ -1250,7 +1325,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
  	}
  	rcu_read_unlock();
  
@@ -51107,7 +51149,7 @@ index 20df02c..9a87617 100644
  		bprm->unsafe |= LSM_UNSAFE_SHARE;
  	} else {
  		res = -EAGAIN;
-@@ -1447,6 +1522,31 @@ int search_binary_handler(struct linux_binprm *bprm)
+@@ -1450,6 +1525,31 @@ int search_binary_handler(struct linux_binprm *bprm)
  
  EXPORT_SYMBOL(search_binary_handler);
  
@@ -51139,7 +51181,7 @@ index 20df02c..9a87617 100644
  /*
   * sys_execve() executes a new program.
   */
-@@ -1454,6 +1554,11 @@ static int do_execve_common(const char *filename,
+@@ -1457,6 +1557,11 @@ static int do_execve_common(const char *filename,
  				struct user_arg_ptr argv,
  				struct user_arg_ptr envp)
  {
@@ -51151,7 +51193,7 @@ index 20df02c..9a87617 100644
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1461,6 +1566,8 @@ static int do_execve_common(const char *filename,
+@@ -1464,6 +1569,8 @@ static int do_execve_common(const char *filename,
  	int retval;
  	const struct cred *cred = current_cred();
  
@@ -51160,7 +51202,7 @@ index 20df02c..9a87617 100644
  	/*
  	 * We move the actual failure in case of RLIMIT_NPROC excess from
  	 * set*uid() to execve() because too many poorly written programs
-@@ -1501,12 +1608,27 @@ static int do_execve_common(const char *filename,
+@@ -1504,12 +1611,27 @@ static int do_execve_common(const char *filename,
  	if (IS_ERR(file))
  		goto out_unmark;
  
@@ -51188,7 +51230,7 @@ index 20df02c..9a87617 100644
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1523,24 +1645,65 @@ static int do_execve_common(const char *filename,
+@@ -1526,24 +1648,65 @@ static int do_execve_common(const char *filename,
  	if (retval < 0)
  		goto out;
  
@@ -51258,7 +51300,7 @@ index 20df02c..9a87617 100644
  	current->fs->in_exec = 0;
  	current->in_execve = 0;
  	acct_update_integrals(current);
-@@ -1549,6 +1712,14 @@ static int do_execve_common(const char *filename,
+@@ -1552,6 +1715,14 @@ static int do_execve_common(const char *filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -51273,7 +51315,7 @@ index 20df02c..9a87617 100644
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1697,3 +1868,278 @@ asmlinkage long compat_sys_execve(const char __user * filename,
+@@ -1700,3 +1871,278 @@ asmlinkage long compat_sys_execve(const char __user * filename,
  	return error;
  }
  #endif
@@ -51636,7 +51678,7 @@ index bbcd6a0..2824592 100644
  
  	/* locality groups */
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 82f8c2d..ce7c889 100644
+index b443e62..a2109f6 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
 @@ -1747,7 +1747,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
@@ -51753,10 +51795,10 @@ index 82f8c2d..ce7c889 100644
  
  	return 0;
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 24c767d..893aa55 100644
+index 5575a45..12f7424 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
-@@ -2429,7 +2429,7 @@ struct ext4_attr {
+@@ -2432,7 +2432,7 @@ struct ext4_attr {
  	ssize_t (*store)(struct ext4_attr *, struct ext4_sb_info *,
  			 const char *, size_t);
  	int offset;
@@ -53020,7 +53062,7 @@ index ff000e5..c44ec6d 100644
  
  	_debug("- mark %p{%lx}", page, page->index);
 diff --git a/fs/fscache/stats.c b/fs/fscache/stats.c
-index 8179e8b..5072cc7 100644
+index 40d13c7..ddf52b9 100644
 --- a/fs/fscache/stats.c
 +++ b/fs/fscache/stats.c
 @@ -18,99 +18,99 @@
@@ -53614,7 +53656,7 @@ index 916da8c..1588998 100644
  					    next->d_inode->i_ino, 
  					    dt_type(next->d_inode)) < 0)
 diff --git a/fs/lockd/clntproc.c b/fs/lockd/clntproc.c
-index 52e5120..808936e 100644
+index 54f9e6c..9ed908c 100644
 --- a/fs/lockd/clntproc.c
 +++ b/fs/lockd/clntproc.c
 @@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt_cancel_ops;
@@ -54349,7 +54391,7 @@ index ebeb94c..ff35337 100644
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
-index 9d1c5db..1e13db8 100644
+index ec668e1..831ae05 100644
 --- a/fs/nfsd/nfs4proc.c
 +++ b/fs/nfsd/nfs4proc.c
 @@ -1097,7 +1097,7 @@ struct nfsd4_operation {
@@ -54362,10 +54404,10 @@ index 9d1c5db..1e13db8 100644
  static struct nfsd4_operation nfsd4_ops[];
  
 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index d1dd710..32ac0e8 100644
+index cd5e6c1..4183d56 100644
 --- a/fs/nfsd/nfs4xdr.c
 +++ b/fs/nfsd/nfs4xdr.c
-@@ -1456,7 +1456,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
+@@ -1450,7 +1450,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
  
  typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, void *);
  
@@ -54374,7 +54416,7 @@ index d1dd710..32ac0e8 100644
  	[OP_ACCESS]		= (nfsd4_dec)nfsd4_decode_access,
  	[OP_CLOSE]		= (nfsd4_dec)nfsd4_decode_close,
  	[OP_COMMIT]		= (nfsd4_dec)nfsd4_decode_commit,
-@@ -1496,7 +1496,7 @@ static nfsd4_dec nfsd4_dec_ops[] = {
+@@ -1490,7 +1490,7 @@ static nfsd4_dec nfsd4_dec_ops[] = {
  	[OP_RELEASE_LOCKOWNER]	= (nfsd4_dec)nfsd4_decode_release_lockowner,
  };
  
@@ -54383,7 +54425,7 @@ index d1dd710..32ac0e8 100644
  	[OP_ACCESS]		= (nfsd4_dec)nfsd4_decode_access,
  	[OP_CLOSE]		= (nfsd4_dec)nfsd4_decode_close,
  	[OP_COMMIT]		= (nfsd4_dec)nfsd4_decode_commit,
-@@ -1558,7 +1558,7 @@ static nfsd4_dec nfsd41_dec_ops[] = {
+@@ -1552,7 +1552,7 @@ static nfsd4_dec nfsd41_dec_ops[] = {
  };
  
  struct nfsd4_minorversion_ops {
@@ -56733,7 +56775,7 @@ index 614b2b5..4d321e6 100644
  	if (!bb->vm_ops)
  		return -EINVAL;
 diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index 1f8c823..ed57cfe 100644
+index d924812..97a74e3 100644
 --- a/fs/sysfs/dir.c
 +++ b/fs/sysfs/dir.c
 @@ -40,7 +40,7 @@ static DEFINE_IDA(sysfs_ino_ida);
@@ -57053,10 +57095,10 @@ index d82efaa..0904a8e 100644
  		kfree(s);
 diff --git a/grsecurity/Kconfig b/grsecurity/Kconfig
 new file mode 100644
-index 0000000..92247e4
+index 0000000..829d8fb
 --- /dev/null
 +++ b/grsecurity/Kconfig
-@@ -0,0 +1,1021 @@
+@@ -0,0 +1,1031 @@
 +#
 +# grecurity configuration
 +#
@@ -57621,6 +57663,16 @@ index 0000000..92247e4
 +	  tasks.  If the sysctl option is enabled, a sysctl option with
 +	  name "chroot_caps" is created.
 +
++config GRKERNSEC_CHROOT_INITRD
++	bool "Exempt initrd tasks from restrictions"
++	default y if GRKERNSEC_CONFIG_AUTO
++	depends on GRKERNSEC_CHROOT && BLK_DEV_RAM
++	help
++	  If you say Y here, tasks started prior to init will be exempted from
++	  grsecurity's chroot restrictions.  This option is mainly meant to
++	  resolve Plymouth's performing privileged operations unnecessarily
++	  in a chroot.
++
 +endmenu
 +menu "Kernel Auditing"
 +depends on GRKERNSEC
@@ -63925,10 +63977,10 @@ index 0000000..bc0be01
 +}
 diff --git a/grsecurity/grsec_chroot.c b/grsecurity/grsec_chroot.c
 new file mode 100644
-index 0000000..6d2de57
+index 0000000..8b4c803
 --- /dev/null
 +++ b/grsecurity/grsec_chroot.c
-@@ -0,0 +1,357 @@
+@@ -0,0 +1,370 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -63940,14 +63992,27 @@ index 0000000..6d2de57
 +#include <linux/grsecurity.h>
 +#include <linux/grinternal.h>
 +
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++static int gr_init_ran;
++#endif
++
 +void gr_set_chroot_entries(struct task_struct *task, struct path *path)
 +{
 +#ifdef CONFIG_GRKERNSEC
 +	if (task_pid_nr(task) > 1 && path->dentry != init_task.fs->root.dentry &&
-+	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt.mnt_root)
++	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt.mnt_root
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++			     && gr_init_ran
++#endif
++	   )
 +		task->gr_is_chrooted = 1;
-+	else
++	else {
++#ifdef CONFIG_GRKERNSEC_CHROOT_INITRD
++		if (task_pid_nr(task) == 1 && !gr_init_ran)
++			gr_init_ran = 1;
++#endif
 +		task->gr_is_chrooted = 0;
++	}
 +
 +	task->gr_chroot_dentry = path->dentry;
 +#endif
@@ -67545,10 +67610,10 @@ index 810431d..0ec4804f 100644
   * (puds are folded into pgds so this doesn't get actually called,
   * but the define is needed for a generic inline function.)
 diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
-index 5cf680a..4b74d62 100644
+index f50a87d..3860a22 100644
 --- a/include/asm-generic/pgtable.h
 +++ b/include/asm-generic/pgtable.h
-@@ -688,6 +688,14 @@ static inline pmd_t pmd_mknuma(pmd_t pmd)
+@@ -698,6 +698,14 @@ static inline pmd_t pmd_mknuma(pmd_t pmd)
  }
  #endif /* CONFIG_NUMA_BALANCING */
  
@@ -71275,7 +71340,7 @@ index c20635c..2f5def4 100644
  static inline void anon_vma_merge(struct vm_area_struct *vma,
  				  struct vm_area_struct *next)
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 7e49270..835d8d9 100644
+index f5ad26e..aa97a06 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -61,6 +61,7 @@ struct bio_list;
@@ -71525,7 +71590,7 @@ index 7e49270..835d8d9 100644
  
  extern int allow_signal(int);
  extern int disallow_signal(int);
-@@ -2546,9 +2652,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2536,9 +2642,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
  
  #endif
  
@@ -73125,6 +73190,18 @@ index fdeb85a..1329d95 100644
  
  
  /* Structure to track chunk fragments that have been acked, but peer
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index c2e542b..6ca975b 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/types.h>
+ 
++extern void net_secret_init(void);
+ extern __u32 secure_ip_id(__be32 daddr);
+ extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+ extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
 diff --git a/include/net/sock.h b/include/net/sock.h
 index 25afaa0..8bb0070 100644
 --- a/include/net/sock.h
@@ -74323,7 +74400,7 @@ index 58d31f1..cce7a55 100644
  	sem_params.flg = semflg;
  	sem_params.u.nsems = nsems;
 diff --git a/ipc/shm.c b/ipc/shm.c
-index 4fa6d8f..55cff14 100644
+index 9bab650..1ce68a5 100644
 --- a/ipc/shm.c
 +++ b/ipc/shm.c
 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_namespace *ns, struct shmid_kernel *shp);
@@ -74588,10 +74665,10 @@ index f6c2ce5..982c0f9 100644
 +	return ns_capable_nolog(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
 +}
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 1e23664..570a83d 100644
+index cddf1d9..34e9721 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -5543,7 +5543,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
+@@ -5544,7 +5544,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
  		struct css_set *cg = link->cg;
  		struct task_struct *task;
  		int count = 0;
@@ -75585,10 +75662,10 @@ index 9b22d03..6295b62 100644
  				prev->next = info->next;
  			else
 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index e4cee8d..f31f503 100644
+index 60f7e32..76ccd96 100644
 --- a/kernel/hrtimer.c
 +++ b/kernel/hrtimer.c
-@@ -1408,7 +1408,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1414,7 +1414,7 @@ void hrtimer_peek_ahead_timers(void)
  	local_irq_restore(flags);
  }
  
@@ -75597,7 +75674,7 @@ index e4cee8d..f31f503 100644
  {
  	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
  
-@@ -1750,7 +1750,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
+@@ -1756,7 +1756,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -78067,7 +78144,7 @@ index c1cc7e1..f62e436 100644
  }
  
 diff --git a/kernel/rcutree_trace.c b/kernel/rcutree_trace.c
-index 0d095dc..1985b19 100644
+index 93f8e8f..cf812ae 100644
 --- a/kernel/rcutree_trace.c
 +++ b/kernel/rcutree_trace.c
 @@ -123,7 +123,7 @@ static void print_one_rcu_data(struct seq_file *m, struct rcu_data *rdp)
@@ -78779,7 +78856,7 @@ index 2f194e9..2c05ea9 100644
  	.priority	= 10,
  };
 diff --git a/kernel/sys.c b/kernel/sys.c
-index 47f1d1b..04c769e 100644
+index 47f1d1b..8651bd9 100644
 --- a/kernel/sys.c
 +++ b/kernel/sys.c
 @@ -157,6 +157,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
@@ -78927,7 +79004,21 @@ index 47f1d1b..04c769e 100644
  				__OLD_UTS_LEN);
  	error |= __put_user(0, name->machine + __OLD_UTS_LEN);
  	up_read(&uts_sem);
-@@ -2027,7 +2063,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+@@ -1555,6 +1591,13 @@ int do_prlimit(struct task_struct *tsk, unsigned int resource,
+ 			 */
+ 			new_rlim->rlim_cur = 1;
+ 		}
++		/* Handle the case where a fork and setuid occur and then RLIMIT_NPROC
++		   is changed to a lower value.  Since tasks can be created by the same
++		   user in between this limit change and an execve by this task, force
++		   a recheck only for this task by setting PF_NPROC_EXCEEDED
++		*/
++		if (resource == RLIMIT_NPROC)
++			tsk->flags |= PF_NPROC_EXCEEDED;
+ 	}
+ 	if (!retval) {
+ 		if (old_rlim)
+@@ -2027,7 +2070,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
  			error = get_dumpable(me->mm);
  			break;
  		case PR_SET_DUMPABLE:
@@ -79274,10 +79365,10 @@ index f11d83b..d016d91 100644
  		.clock_get	= alarm_clock_get,
  		.timer_create	= alarm_timer_create,
 diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index a13987a..36cd791 100644
+index 239a323..2c78cf0 100644
 --- a/kernel/time/tick-broadcast.c
 +++ b/kernel/time/tick-broadcast.c
-@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
+@@ -120,7 +120,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
  		 * then clear the broadcast bit.
  		 */
  		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
@@ -79488,7 +79579,7 @@ index c0bd030..62a1927 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 35cc3a8..2a47da3 100644
+index 03dbc77..e6bd484 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
 @@ -1886,12 +1886,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
@@ -79520,7 +79611,7 @@ index 35cc3a8..2a47da3 100644
  {
  	struct ftrace_func_probe *entry;
  	struct ftrace_page *pg;
-@@ -3831,8 +3836,10 @@ static int ftrace_process_locs(struct module *mod,
+@@ -3832,8 +3837,10 @@ static int ftrace_process_locs(struct module *mod,
  	if (!count)
  		return 0;
  
@@ -79531,7 +79622,7 @@ index 35cc3a8..2a47da3 100644
  
  	start_pg = ftrace_allocate_pages(count);
  	if (!start_pg)
-@@ -4554,8 +4561,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+@@ -4555,8 +4562,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  
  static int ftrace_graph_active;
@@ -79540,7 +79631,7 @@ index 35cc3a8..2a47da3 100644
  int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
  {
  	return 0;
-@@ -4699,6 +4704,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+@@ -4700,6 +4705,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
  	return NOTIFY_DONE;
  }
  
@@ -79551,7 +79642,7 @@ index 35cc3a8..2a47da3 100644
  int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  			trace_func_graph_ent_t entryfunc)
  {
-@@ -4712,7 +4721,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+@@ -4713,7 +4722,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  		goto out;
  	}
  
@@ -79838,7 +79929,7 @@ index ce8514f..8233573 100644
  		*data_page = bpage;
  
 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index fe1d581..ea543f1b 100644
+index 1c82852..1cd5af2 100644
 --- a/kernel/trace/trace.c
 +++ b/kernel/trace/trace.c
 @@ -2845,7 +2845,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -80012,15 +80103,15 @@ index 194d796..76edb8f 100644
  	key = event->type & (EVENT_HASHSIZE - 1);
  
 diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
-index 83a8b5b..0bf39a9 100644
+index b20428c..4845a10 100644
 --- a/kernel/trace/trace_stack.c
 +++ b/kernel/trace/trace_stack.c
-@@ -52,7 +52,7 @@ static inline void check_stack(void)
+@@ -68,7 +68,7 @@ check_stack(unsigned long ip, unsigned long *stack)
  		return;
  
  	/* we do not handle interrupt stacks yet */
--	if (!object_is_on_stack(&this_size))
-+	if (!object_starts_on_stack(&this_size))
+-	if (!object_is_on_stack(stack))
++	if (!object_starts_on_stack(stack))
  		return;
  
  	local_irq_save(flags);
@@ -82071,7 +82162,7 @@ index c9bd528..da8d069 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index 90db251..04240d1 100644
+index 32f3372..254d5f3 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -32,6 +32,7 @@
@@ -83702,7 +83793,7 @@ index 0713bfb..b95bb87 100644
  	.next		= NULL,
  };
 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 6a83cd3..3ab04ef 100644
+index 6a83cd3..4cc7b16 100644
 --- a/mm/page_alloc.c
 +++ b/mm/page_alloc.c
 @@ -58,6 +58,7 @@
@@ -83797,20 +83888,6 @@ index 6a83cd3..3ab04ef 100644
  
  	if (order && (gfp_flags & __GFP_COMP))
  		prep_compound_page(page, order);
-@@ -3752,7 +3791,13 @@ static int pageblock_is_reserved(unsigned long start_pfn, unsigned long end_pfn)
- 	unsigned long pfn;
- 
- 	for (pfn = start_pfn; pfn < end_pfn; pfn++) {
-+#ifdef CONFIG_X86_32
-+		/* boot failures in VMware 8 on 32bit vanilla since
-+		   this change */
-+		if (!pfn_valid(pfn) || PageReserved(pfn_to_page(pfn)))
-+#else
- 		if (!pfn_valid_within(pfn) || PageReserved(pfn_to_page(pfn)))
-+#endif
- 			return 1;
- 	}
- 	return 0;
 diff --git a/mm/percpu.c b/mm/percpu.c
 index 8c8e08f..73a5cda 100644
 --- a/mm/percpu.c
@@ -86372,6 +86449,24 @@ index 2dc6cda..2159524 100644
  	     i++, cmfptr++)
  	{
  		struct socket *sock;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index e61a8bb..6a2f13c 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -12,12 +12,10 @@
+ 
+ static u32 net_secret[MD5_MESSAGE_BYTES / 4] ____cacheline_aligned;
+ 
+-static int __init net_secret_init(void)
++void net_secret_init(void)
+ {
+ 	get_random_bytes(net_secret, sizeof(net_secret));
+-	return 0;
+ }
+-late_initcall(net_secret_init);
+ 
+ #ifdef CONFIG_INET
+ static u32 seq_scale(u32 seq)
 diff --git a/net/core/sock.c b/net/core/sock.c
 index bc131d4..029e378 100644
 --- a/net/core/sock.c
@@ -86665,10 +86760,30 @@ index a55eecc..dd8428c 100644
  
  	*lenp = len;
 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index fcf104e..95552d4 100644
+index fcf104e..6b748ea 100644
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1717,13 +1717,9 @@ static int __init inet_init(void)
+@@ -115,6 +115,7 @@
+ #include <net/inet_common.h>
+ #include <net/xfrm.h>
+ #include <net/net_namespace.h>
++#include <net/secure_seq.h>
+ #ifdef CONFIG_IP_MROUTE
+ #include <linux/mroute.h>
+ #endif
+@@ -263,8 +264,10 @@ void build_ehash_secret(void)
+ 		get_random_bytes(&rnd, sizeof(rnd));
+ 	} while (rnd == 0);
+ 
+-	if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
++	if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
+ 		get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
++		net_secret_init();
++	}
+ }
+ EXPORT_SYMBOL(build_ehash_secret);
+ 
+@@ -1717,13 +1720,9 @@ static int __init inet_init(void)
  
  	BUILD_BUG_ON(sizeof(struct inet_skb_parm) > sizeof(dummy_skb->cb));
  
@@ -86683,7 +86798,7 @@ index fcf104e..95552d4 100644
  
  	rc = proto_register(&udp_prot, 1);
  	if (rc)
-@@ -1832,8 +1828,6 @@ out_unregister_udp_proto:
+@@ -1832,8 +1831,6 @@ out_unregister_udp_proto:
  	proto_unregister(&udp_prot);
  out_unregister_tcp_proto:
  	proto_unregister(&tcp_prot);
@@ -88491,7 +88606,7 @@ index 1b087ff..bf600e9 100644
  		/*
  		 * Goal:
 diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
-index 79a48f3..5e185c9 100644
+index 64619f4..c497f0f 100644
 --- a/net/mac80211/pm.c
 +++ b/net/mac80211/pm.c
 @@ -35,7 +35,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
@@ -89251,18 +89366,9 @@ index c111bd0..7788ff7 100644
  	return 0;
  }
 diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
-index 5a940db..f0b9c12 100644
+index 5a940db..d6a502d 100644
 --- a/net/phonet/af_phonet.c
 +++ b/net/phonet/af_phonet.c
-@@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_proto_get(unsigned int protocol)
- {
- 	struct phonet_protocol *pp;
- 
--	if (protocol >= PHONET_NPROTO)
-+	if (protocol < 0 || protocol >= PHONET_NPROTO)
- 		return NULL;
- 
- 	rcu_read_lock();
 @@ -469,7 +469,7 @@ int __init_or_module phonet_proto_register(unsigned int protocol,
  {
  	int err = 0;
@@ -89786,6 +89892,19 @@ index 391a245..296b3d7 100644
  }
  
  /* Initialize IPv6 support and register with socket layer.  */
+diff --git a/net/sctp/probe.c b/net/sctp/probe.c
+index 5f7518d..9b91f6c 100644
+--- a/net/sctp/probe.c
++++ b/net/sctp/probe.c
+@@ -63,7 +63,7 @@ static struct {
+ 	struct timespec	  tstart;
+ } sctpw;
+ 
+-static void printl(const char *fmt, ...)
++static __printf(1, 2) void printl(const char *fmt, ...)
+ {
+ 	va_list args;
+ 	int len;
 diff --git a/net/sctp/proc.c b/net/sctp/proc.c
 index 8c19e97..16264b8 100644
 --- a/net/sctp/proc.c
diff --git a/3.8.11/4425_grsec_remove_EI_PAX.patch b/3.8.12/4425_grsec_remove_EI_PAX.patch
index 7d06ac2..7d06ac2 100644
--- a/3.8.11/4425_grsec_remove_EI_PAX.patch
+++ b/3.8.12/4425_grsec_remove_EI_PAX.patch
diff --git a/3.8.11/4430_grsec-remove-localversion-grsec.patch b/3.8.12/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.8.11/4430_grsec-remove-localversion-grsec.patch
+++ b/3.8.12/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.8.11/4435_grsec-mute-warnings.patch b/3.8.12/4435_grsec-mute-warnings.patch
index ed941d5..ed941d5 100644
--- a/3.8.11/4435_grsec-mute-warnings.patch
+++ b/3.8.12/4435_grsec-mute-warnings.patch
diff --git a/3.8.11/4440_grsec-remove-protected-paths.patch b/3.8.12/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.8.11/4440_grsec-remove-protected-paths.patch
+++ b/3.8.12/4440_grsec-remove-protected-paths.patch
diff --git a/3.8.11/4450_grsec-kconfig-default-gids.patch b/3.8.12/4450_grsec-kconfig-default-gids.patch
index 7c20c40..7c20c40 100644
--- a/3.8.11/4450_grsec-kconfig-default-gids.patch
+++ b/3.8.12/4450_grsec-kconfig-default-gids.patch
diff --git a/3.8.11/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.12/4465_selinux-avc_audit-log-curr_ip.patch
index 0a309c8..0a309c8 100644
--- a/3.8.11/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.8.12/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.8.11/4470_disable-compat_vdso.patch b/3.8.12/4470_disable-compat_vdso.patch
index 3ef36aa..3ef36aa 100644
--- a/3.8.11/4470_disable-compat_vdso.patch
+++ b/3.8.12/4470_disable-compat_vdso.patch