Grsec/PaX: 3.1-{3.2.68,3.14.38,3.19.4}-20150414230020150414

28 files changed, 5214 insertions, 7170 deletions

diff --git a/3.14.37/1036_linux-3.14.37.patch b/3.14.37/1036_linux-3.14.37.patch
deleted file mode 100644
index b25a2ef..0000000
--- a/3.14.37/1036_linux-3.14.37.patch
+++ /dev/null
@@ -1,2861 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 4e6537b..c24acc0 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 36
-+SUBLEVEL = 37
- EXTRAVERSION =
- NAME = Remembering Coco
- 
-diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-index e96da9a..f2512e1 100644
---- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-@@ -243,10 +243,18 @@
- 		ti,invert-autoidle-bit;
- 	};
- 
-+	dpll_core_byp_mux: dpll_core_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x012c>;
-+	};
-+
- 	dpll_core_ck: dpll_core_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-core-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
- 		reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
- 	};
- 
-@@ -309,10 +317,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_dsp_byp_mux: dpll_dsp_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x0240>;
-+	};
-+
- 	dpll_dsp_ck: dpll_dsp_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
- 		reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
- 	};
- 
-@@ -335,10 +351,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_iva_byp_mux: dpll_iva_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x01ac>;
-+	};
-+
- 	dpll_iva_ck: dpll_iva_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
- 		reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
- 	};
- 
-@@ -361,10 +385,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_gpu_byp_mux: dpll_gpu_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x02e4>;
-+	};
-+
- 	dpll_gpu_ck: dpll_gpu_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
- 		reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
- 	};
- 
-@@ -398,10 +430,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_ddr_byp_mux: dpll_ddr_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x021c>;
-+	};
-+
- 	dpll_ddr_ck: dpll_ddr_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
- 		reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
- 	};
- 
-@@ -416,10 +456,18 @@
- 		ti,invert-autoidle-bit;
- 	};
- 
-+	dpll_gmac_byp_mux: dpll_gmac_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x02b4>;
-+	};
-+
- 	dpll_gmac_ck: dpll_gmac_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
- 		reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
- 	};
- 
-@@ -482,10 +530,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_eve_byp_mux: dpll_eve_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x0290>;
-+	};
-+
- 	dpll_eve_ck: dpll_eve_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
- 		reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
- 	};
- 
-@@ -1214,10 +1270,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_per_byp_mux: dpll_per_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x014c>;
-+	};
-+
- 	dpll_per_ck: dpll_per_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
- 		reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
- 	};
- 
-@@ -1240,10 +1304,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_usb_byp_mux: dpll_usb_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x018c>;
-+	};
-+
- 	dpll_usb_ck: dpll_usb_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-j-type-clock";
--		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
- 		reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
- 	};
- 
-diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
-index 71e5fc7..1d1800f 100644
---- a/arch/arm/crypto/aesbs-core.S_shipped
-+++ b/arch/arm/crypto/aesbs-core.S_shipped
-@@ -58,14 +58,18 @@
- # define VFP_ABI_FRAME	0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__	7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
- 
- #ifdef __thumb__
- # define adrl adr
- #endif
- 
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch	armv7-a
-+.fpu	neon
-+
- .text
- .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -74,8 +78,6 @@
- .code   32
- #endif
- 
--.fpu	neon
--
- .type	_bsaes_decrypt8,%function
- .align	4
- _bsaes_decrypt8:
-@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
- 	vld1.8	{q8}, [r0]			@ initial tweak
- 	adr	r2, .Lxts_magic
- 
-+#ifndef	XTS_CHAIN_TWEAK
- 	tst	r9, #0xf			@ if not multiple of 16
- 	it	ne				@ Thumb2 thing, sanity check in ARM
- 	subne	r9, #0x10			@ subtract another 16 bytes
-+#endif
- 	subs	r9, #0x80
- 
- 	blo	.Lxts_dec_short
-diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
-index be068db..a4d3856 100644
---- a/arch/arm/crypto/bsaes-armv7.pl
-+++ b/arch/arm/crypto/bsaes-armv7.pl
-@@ -701,14 +701,18 @@ $code.=<<___;
- # define VFP_ABI_FRAME	0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__	7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
- 
- #ifdef __thumb__
- # define adrl adr
- #endif
- 
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch	armv7-a
-+.fpu	neon
-+
- .text
- .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -717,8 +721,6 @@ $code.=<<___;
- .code   32
- #endif
- 
--.fpu	neon
--
- .type	_bsaes_decrypt8,%function
- .align	4
- _bsaes_decrypt8:
-@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
- 	vld1.8	{@XMM[8]}, [r0]			@ initial tweak
- 	adr	$magic, .Lxts_magic
- 
-+#ifndef	XTS_CHAIN_TWEAK
- 	tst	$len, #0xf			@ if not multiple of 16
- 	it	ne				@ Thumb2 thing, sanity check in ARM
- 	subne	$len, #0x10			@ subtract another 16 bytes
-+#endif
- 	subs	$len, #0x80
- 
- 	blo	.Lxts_dec_short
-diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
-index c5101dc..1d4df3b 100644
---- a/arch/arm/mach-at91/pm.h
-+++ b/arch/arm/mach-at91/pm.h
-@@ -45,7 +45,7 @@ static inline void at91rm9200_standby(void)
- 		"    mcr    p15, 0, %0, c7, c0, 4\n\t"
- 		"    str    %5, [%1, %2]"
- 		:
--		: "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
-+		: "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
- 		  "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
- 		  "r" (lpr));
- }
-diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
-index fbd7678..3974881 100644
---- a/arch/arm64/mm/dma-mapping.c
-+++ b/arch/arm64/mm/dma-mapping.c
-@@ -44,6 +44,7 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size,
- 		flags |= GFP_DMA32;
- 	if (IS_ENABLED(CONFIG_DMA_CMA)) {
- 		struct page *page;
-+		void *addr;
- 
- 		size = PAGE_ALIGN(size);
- 		page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
-@@ -52,7 +53,10 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size,
- 			return NULL;
- 
- 		*dma_handle = phys_to_dma(dev, page_to_phys(page));
--		return page_address(page);
-+		addr = page_address(page);
-+		if (flags & __GFP_ZERO)
-+			memset(addr, 0, size);
-+		return addr;
- 	} else {
- 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
- 	}
-diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
-index 617b9fe..3ccb677 100644
---- a/arch/sparc/kernel/perf_event.c
-+++ b/arch/sparc/kernel/perf_event.c
-@@ -960,6 +960,8 @@ out:
- 	cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
- }
- 
-+static void sparc_pmu_start(struct perf_event *event, int flags);
-+
- /* On this PMU each PIC has it's own PCR control register.  */
- static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- {
-@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- 		struct perf_event *cp = cpuc->event[i];
- 		struct hw_perf_event *hwc = &cp->hw;
- 		int idx = hwc->idx;
--		u64 enc;
- 
- 		if (cpuc->current_idx[i] != PIC_NO_INDEX)
- 			continue;
- 
--		sparc_perf_event_set_period(cp, hwc, idx);
- 		cpuc->current_idx[i] = idx;
- 
--		enc = perf_event_get_enc(cpuc->events[i]);
--		cpuc->pcr[idx] &= ~mask_for_index(idx);
--		if (hwc->state & PERF_HES_STOPPED)
--			cpuc->pcr[idx] |= nop_for_index(idx);
--		else
--			cpuc->pcr[idx] |= event_encoding(enc, idx);
-+		sparc_pmu_start(cp, PERF_EF_RELOAD);
- 	}
- out:
- 	for (i = 0; i < cpuc->n_events; i++) {
-@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- 	int i;
- 
- 	local_irq_save(flags);
--	perf_pmu_disable(event->pmu);
- 
- 	for (i = 0; i < cpuc->n_events; i++) {
- 		if (event == cpuc->event[i]) {
-@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- 		}
- 	}
- 
--	perf_pmu_enable(event->pmu);
- 	local_irq_restore(flags);
- }
- 
-@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
- 	unsigned long flags;
- 
- 	local_irq_save(flags);
--	perf_pmu_disable(event->pmu);
- 
- 	n0 = cpuc->n_events;
- 	if (n0 >= sparc_pmu->max_hw_events)
-@@ -1394,7 +1386,6 @@ nocheck:
- 
- 	ret = 0;
- out:
--	perf_pmu_enable(event->pmu);
- 	local_irq_restore(flags);
- 	return ret;
- }
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index c6f7113..1a79d68 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -281,6 +281,8 @@ void arch_trigger_all_cpu_backtrace(void)
- 			printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
- 			       gp->tpc, gp->o7, gp->i7, gp->rpc);
- 		}
-+
-+		touch_nmi_watchdog();
- 	}
- 
- 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-@@ -356,6 +358,8 @@ static void pmu_snapshot_all_cpus(void)
- 		       (cpu == this_cpu ? '*' : ' '), cpu,
- 		       pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
- 		       pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
-+
-+		touch_nmi_watchdog();
- 	}
- 
- 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index beb0b5a..25db14a 100644
---- a/arch/sparc/kernel/sys_sparc_64.c
-+++ b/arch/sparc/kernel/sys_sparc_64.c
-@@ -332,7 +332,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
- 	long err;
- 
- 	/* No need for backward compatibility. We can start fresh... */
--	if (call <= SEMCTL) {
-+	if (call <= SEMTIMEDOP) {
- 		switch (call) {
- 		case SEMOP:
- 			err = sys_semtimedop(first, ptr,
-diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
-index b7f6334..857ad4f 100644
---- a/arch/sparc/lib/memmove.S
-+++ b/arch/sparc/lib/memmove.S
-@@ -8,9 +8,11 @@
- 
- 	.text
- ENTRY(memmove) /* o0=dst o1=src o2=len */
--	mov		%o0, %g1
-+	brz,pn		%o2, 99f
-+	 mov		%o0, %g1
-+
- 	cmp		%o0, %o1
--	bleu,pt		%xcc, memcpy
-+	bleu,pt		%xcc, 2f
- 	 add		%o1, %o2, %g7
- 	cmp		%g7, %o0
- 	bleu,pt		%xcc, memcpy
-@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
- 	stb		%g7, [%o0]
- 	bne,pt		%icc, 1b
- 	 sub		%o0, 1, %o0
--
-+99:
- 	retl
- 	 mov		%g1, %o0
-+
-+	/* We can't just call memcpy for these memmove cases.  On some
-+	 * chips the memcpy uses cache initializing stores and when dst
-+	 * and src are close enough, those can clobber the source data
-+	 * before we've loaded it in.
-+	 */
-+2:	or		%o0, %o1, %g7
-+	or		%o2, %g7, %g7
-+	andcc		%g7, 0x7, %g0
-+	bne,pn		%xcc, 4f
-+	 nop
-+
-+3:	ldx		[%o1], %g7
-+	add		%o1, 8, %o1
-+	subcc		%o2, 8, %o2
-+	add		%o0, 8, %o0
-+	bne,pt		%icc, 3b
-+	 stx		%g7, [%o0 - 0x8]
-+	ba,a,pt		%xcc, 99b
-+
-+4:	ldub		[%o1], %g7
-+	add		%o1, 1, %o1
-+	subcc		%o2, 1, %o2
-+	add		%o0, 1, %o0
-+	bne,pt		%icc, 4b
-+	 stb		%g7, [%o0 - 0x1]
-+	ba,a,pt		%xcc, 99b
- ENDPROC(memmove)
-diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
-index cfbe53c..09daebd 100644
---- a/arch/sparc/mm/srmmu.c
-+++ b/arch/sparc/mm/srmmu.c
-@@ -460,10 +460,12 @@ static void __init sparc_context_init(int numctx)
- void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm,
- 	       struct task_struct *tsk)
- {
-+	unsigned long flags;
-+
- 	if (mm->context == NO_CONTEXT) {
--		spin_lock(&srmmu_context_spinlock);
-+		spin_lock_irqsave(&srmmu_context_spinlock, flags);
- 		alloc_context(old_mm, mm);
--		spin_unlock(&srmmu_context_spinlock);
-+		spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
- 		srmmu_ctxd_set(&srmmu_context_table[mm->context], mm->pgd);
- 	}
- 
-@@ -988,14 +990,15 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
- 
- void destroy_context(struct mm_struct *mm)
- {
-+	unsigned long flags;
- 
- 	if (mm->context != NO_CONTEXT) {
- 		flush_cache_mm(mm);
- 		srmmu_ctxd_set(&srmmu_context_table[mm->context], srmmu_swapper_pg_dir);
- 		flush_tlb_mm(mm);
--		spin_lock(&srmmu_context_spinlock);
-+		spin_lock_irqsave(&srmmu_context_spinlock, flags);
- 		free_context(mm->context);
--		spin_unlock(&srmmu_context_spinlock);
-+		spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
- 		mm->context = NO_CONTEXT;
- 	}
- }
-diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
-index 6dfb7d0..6d4faba 100644
---- a/arch/x86/crypto/aesni-intel_glue.c
-+++ b/arch/x86/crypto/aesni-intel_glue.c
-@@ -1109,7 +1109,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- 		src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
- 		if (!src)
- 			return -ENOMEM;
--		assoc = (src + req->cryptlen + auth_tag_len);
-+		assoc = (src + req->cryptlen);
- 		scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
- 		scatterwalk_map_and_copy(assoc, req->assoc, 0,
- 			req->assoclen, 0);
-@@ -1134,7 +1134,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- 		scatterwalk_done(&src_sg_walk, 0, 0);
- 		scatterwalk_done(&assoc_sg_walk, 0, 0);
- 	} else {
--		scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
-+		scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
- 		kfree(src);
- 	}
- 	return retval;
-diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
-index cea1c76..1ac1c00 100644
---- a/arch/x86/include/asm/fpu-internal.h
-+++ b/arch/x86/include/asm/fpu-internal.h
-@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_struct *tsk)
- 	preempt_disable();
- 	tsk->thread.fpu_counter = 0;
- 	__drop_fpu(tsk);
--	clear_used_math();
-+	clear_stopped_child_used_math(tsk);
- 	preempt_enable();
- }
- 
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index dd50e26..7a09aca 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -375,7 +375,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- 		 * thread's fpu state, reconstruct fxstate from the fsave
- 		 * header. Sanitize the copied state etc.
- 		 */
--		struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
-+		struct fpu *fpu = &tsk->thread.fpu;
- 		struct user_i387_ia32_struct env;
- 		int err = 0;
- 
-@@ -389,14 +389,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- 		 */
- 		drop_fpu(tsk);
- 
--		if (__copy_from_user(xsave, buf_fx, state_size) ||
-+		if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
- 		    __copy_from_user(&env, buf, sizeof(env))) {
-+			fpu_finit(fpu);
- 			err = -1;
- 		} else {
- 			sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
--			set_used_math();
- 		}
- 
-+		set_used_math();
- 		if (use_eager_fpu()) {
- 			preempt_disable();
- 			math_state_restore();
-diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
-index 31776d0..d7ec4e2 100644
---- a/arch/x86/vdso/vdso32/sigreturn.S
-+++ b/arch/x86/vdso/vdso32/sigreturn.S
-@@ -17,6 +17,7 @@
- 	.text
- 	.globl __kernel_sigreturn
- 	.type __kernel_sigreturn,@function
-+	nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
- 	ALIGN
- __kernel_sigreturn:
- .LSTART_sigreturn:
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index eff9d58..102463ba 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- {
- 	struct ibmvtpm_dev *ibmvtpm;
- 	struct ibmvtpm_crq crq;
--	u64 *word = (u64 *) &crq;
-+	__be64 *word = (__be64 *)&crq;
- 	int rc;
- 
- 	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
-@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- 	memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
- 	crq.valid = (u8)IBMVTPM_VALID_CMD;
- 	crq.msg = (u8)VTPM_TPM_COMMAND;
--	crq.len = (u16)count;
--	crq.data = ibmvtpm->rtce_dma_handle;
-+	crq.len = cpu_to_be16(count);
-+	crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
- 
--	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
--			      cpu_to_be64(word[1]));
-+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-+			      be64_to_cpu(word[1]));
- 	if (rc != H_SUCCESS) {
- 		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
- 		rc = 0;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
-index bd82a79..b2c231b 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.h
-+++ b/drivers/char/tpm/tpm_ibmvtpm.h
-@@ -22,9 +22,9 @@
- struct ibmvtpm_crq {
- 	u8 valid;
- 	u8 msg;
--	u16 len;
--	u32 data;
--	u64 reserved;
-+	__be16 len;
-+	__be32 data;
-+	__be64 reserved;
- } __attribute__((packed, aligned(8)));
- 
- struct ibmvtpm_crq_queue {
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index 6928d09..b08eadb 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -142,6 +142,7 @@ struct ports_device {
- 	 * notification
- 	 */
- 	struct work_struct control_work;
-+	struct work_struct config_work;
- 
- 	struct list_head ports;
- 
-@@ -1832,10 +1833,21 @@ static void config_intr(struct virtio_device *vdev)
- 
- 	portdev = vdev->priv;
- 
-+	if (!use_multiport(portdev))
-+		schedule_work(&portdev->config_work);
-+}
-+
-+static void config_work_handler(struct work_struct *work)
-+{
-+	struct ports_device *portdev;
-+
-+	portdev = container_of(work, struct ports_device, control_work);
- 	if (!use_multiport(portdev)) {
-+		struct virtio_device *vdev;
- 		struct port *port;
- 		u16 rows, cols;
- 
-+		vdev = portdev->vdev;
- 		virtio_cread(vdev, struct virtio_console_config, cols, &cols);
- 		virtio_cread(vdev, struct virtio_console_config, rows, &rows);
- 
-@@ -2024,12 +2036,14 @@ static int virtcons_probe(struct virtio_device *vdev)
- 	spin_lock_init(&portdev->ports_lock);
- 	INIT_LIST_HEAD(&portdev->ports);
- 
-+	INIT_WORK(&portdev->config_work, &config_work_handler);
-+	INIT_WORK(&portdev->control_work, &control_work_handler);
-+
- 	if (multiport) {
- 		unsigned int nr_added_bufs;
- 
- 		spin_lock_init(&portdev->c_ivq_lock);
- 		spin_lock_init(&portdev->c_ovq_lock);
--		INIT_WORK(&portdev->control_work, &control_work_handler);
- 
- 		nr_added_bufs = fill_queue(portdev->c_ivq,
- 					   &portdev->c_ivq_lock);
-@@ -2097,6 +2111,8 @@ static void virtcons_remove(struct virtio_device *vdev)
- 	/* Finish up work that's lined up */
- 	if (use_multiport(portdev))
- 		cancel_work_sync(&portdev->control_work);
-+	else
-+		cancel_work_sync(&portdev->config_work);
- 
- 	list_for_each_entry_safe(port, port2, &portdev->ports, list)
- 		unplug_port(port);
-@@ -2148,6 +2164,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
- 
- 	virtqueue_disable_cb(portdev->c_ivq);
- 	cancel_work_sync(&portdev->control_work);
-+	cancel_work_sync(&portdev->config_work);
- 	/*
- 	 * Once more: if control_work_handler() was running, it would
- 	 * enable the cb as the last step.
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index 0cca5f2..663394f 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -1306,6 +1306,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
- 	       (x << 16) | y);
- 	viewport_w = crtc->mode.hdisplay;
- 	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
-+	if ((rdev->family >= CHIP_BONAIRE) &&
-+	    (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
-+		viewport_h *= 2;
- 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
- 	       (viewport_w << 16) | viewport_h);
- 
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index f0ed0ba..c3664bc 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -7069,6 +7069,9 @@ int cik_irq_set(struct radeon_device *rdev)
- 	WREG32(DC_HPD5_INT_CONTROL, hpd5);
- 	WREG32(DC_HPD6_INT_CONTROL, hpd6);
- 
-+	/* posting read */
-+	RREG32(SRBM_STATUS);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 7138f3e..ee9f0b4 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -4596,6 +4596,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
- 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
- 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
- 
-+	/* posting read */
-+	RREG32(SRBM_STATUS);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index 07620e1..e28de20 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -742,6 +742,10 @@ int r100_irq_set(struct radeon_device *rdev)
- 		tmp |= RADEON_FP2_DETECT_MASK;
- 	}
- 	WREG32(RADEON_GEN_INT_CNTL, tmp);
-+
-+	/* read back to post the write */
-+	RREG32(RADEON_GEN_INT_CNTL);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 788f602..74a8a38 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -3647,6 +3647,9 @@ int r600_irq_set(struct radeon_device *rdev)
- 		WREG32(RV770_CG_THERMAL_INT, thermal_int);
- 	}
- 
-+	/* posting read */
-+	RREG32(R_000E50_SRBM_STATUS);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
-index 7f2d6c0..2f2d2ce 100644
---- a/drivers/gpu/drm/radeon/radeon_cs.c
-+++ b/drivers/gpu/drm/radeon/radeon_cs.c
-@@ -179,11 +179,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
- 	u32 ring = RADEON_CS_RING_GFX;
- 	s32 priority = 0;
- 
-+	INIT_LIST_HEAD(&p->validated);
-+
- 	if (!cs->num_chunks) {
- 		return 0;
- 	}
-+
- 	/* get chunks */
--	INIT_LIST_HEAD(&p->validated);
- 	p->idx = 0;
- 	p->ib.sa_bo = NULL;
- 	p->ib.semaphore = NULL;
-diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index e5619d5..4261b38 100644
---- a/drivers/gpu/drm/radeon/rs600.c
-+++ b/drivers/gpu/drm/radeon/rs600.c
-@@ -700,6 +700,10 @@ int rs600_irq_set(struct radeon_device *rdev)
- 	WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
- 	if (ASIC_IS_DCE2(rdev))
- 		WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
-+
-+	/* posting read */
-+	RREG32(R_000040_GEN_INT_CNTL);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index 52b64ad..2f2decc 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -5958,6 +5958,9 @@ int si_irq_set(struct radeon_device *rdev)
- 
- 	WREG32(CG_THERMAL_INT, thermal_int);
- 
-+	/* posting read */
-+	RREG32(SRBM_STATUS);
-+
- 	return 0;
- }
- 
-@@ -6875,8 +6878,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
- 
- 	if (!vclk || !dclk) {
--		/* keep the Bypass mode, put PLL to sleep */
--		WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+		/* keep the Bypass mode */
- 		return 0;
- 	}
- 
-@@ -6892,8 +6894,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- 	/* set VCO_MODE to 1 */
- 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
- 
--	/* toggle UPLL_SLEEP to 1 then back to 0 */
--	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+	/* disable sleep mode */
- 	WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
- 
- 	/* deassert UPLL_RESET */
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index fb7c36e..0771dcb 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -733,32 +733,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- 		goto out_err1;
- 	}
- 
--	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
--			     (dev_priv->vram_size >> PAGE_SHIFT));
--	if (unlikely(ret != 0)) {
--		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
--		goto out_err2;
--	}
--
--	dev_priv->has_gmr = true;
--	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
--	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
--					 VMW_PL_GMR) != 0) {
--		DRM_INFO("No GMR memory available. "
--			 "Graphics memory resources are very limited.\n");
--		dev_priv->has_gmr = false;
--	}
--
--	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
--		dev_priv->has_mob = true;
--		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
--				   VMW_PL_MOB) != 0) {
--			DRM_INFO("No MOB memory available. "
--				 "3D will be disabled.\n");
--			dev_priv->has_mob = false;
--		}
--	}
--
- 	dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
- 					       dev_priv->mmio_size);
- 
-@@ -821,6 +795,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- 		goto out_no_fman;
- 	}
- 
-+
-+	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-+			     (dev_priv->vram_size >> PAGE_SHIFT));
-+	if (unlikely(ret != 0)) {
-+		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-+		goto out_no_vram;
-+	}
-+
-+	dev_priv->has_gmr = true;
-+	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-+	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-+					 VMW_PL_GMR) != 0) {
-+		DRM_INFO("No GMR memory available. "
-+			 "Graphics memory resources are very limited.\n");
-+		dev_priv->has_gmr = false;
-+	}
-+
-+	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-+		dev_priv->has_mob = true;
-+		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-+				   VMW_PL_MOB) != 0) {
-+			DRM_INFO("No MOB memory available. "
-+				 "3D will be disabled.\n");
-+			dev_priv->has_mob = false;
-+		}
-+	}
-+
- 	vmw_kms_save_vga(dev_priv);
- 
- 	/* Start kms and overlay systems, needs fifo. */
-@@ -846,6 +847,12 @@ out_no_fifo:
- 	vmw_kms_close(dev_priv);
- out_no_kms:
- 	vmw_kms_restore_vga(dev_priv);
-+	if (dev_priv->has_mob)
-+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+	if (dev_priv->has_gmr)
-+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+out_no_vram:
- 	vmw_fence_manager_takedown(dev_priv->fman);
- out_no_fman:
- 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-@@ -861,12 +868,6 @@ out_err4:
- 	iounmap(dev_priv->mmio_virt);
- out_err3:
- 	arch_phys_wc_del(dev_priv->mmio_mtrr);
--	if (dev_priv->has_mob)
--		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
--	if (dev_priv->has_gmr)
--		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
--	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
--out_err2:
- 	(void)ttm_bo_device_release(&dev_priv->bdev);
- out_err1:
- 	vmw_ttm_global_release(dev_priv);
-@@ -896,6 +897,13 @@ static int vmw_driver_unload(struct drm_device *dev)
- 	}
- 	vmw_kms_close(dev_priv);
- 	vmw_overlay_close(dev_priv);
-+
-+	if (dev_priv->has_mob)
-+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+	if (dev_priv->has_gmr)
-+		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+
- 	vmw_fence_manager_takedown(dev_priv->fman);
- 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
- 		drm_irq_uninstall(dev_priv->dev);
-@@ -907,11 +915,6 @@ static int vmw_driver_unload(struct drm_device *dev)
- 	ttm_object_device_release(&dev_priv->tdev);
- 	iounmap(dev_priv->mmio_virt);
- 	arch_phys_wc_del(dev_priv->mmio_mtrr);
--	if (dev_priv->has_mob)
--		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
--	if (dev_priv->has_gmr)
--		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
--	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
- 	(void)ttm_bo_device_release(&dev_priv->bdev);
- 	vmw_ttm_global_release(dev_priv);
- 
-diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
-index 51e15fd..d058b00 100644
---- a/drivers/mtd/nand/pxa3xx_nand.c
-+++ b/drivers/mtd/nand/pxa3xx_nand.c
-@@ -481,6 +481,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
- 	nand_writel(info, NDCR, ndcr | int_mask);
- }
- 
-+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
-+{
-+	if (info->ecc_bch) {
-+		int timeout;
-+
-+		/*
-+		 * According to the datasheet, when reading from NDDB
-+		 * with BCH enabled, after each 32 bytes reads, we
-+		 * have to make sure that the NDSR.RDDREQ bit is set.
-+		 *
-+		 * Drain the FIFO 8 32 bits reads at a time, and skip
-+		 * the polling on the last read.
-+		 */
-+		while (len > 8) {
-+			__raw_readsl(info->mmio_base + NDDB, data, 8);
-+
-+			for (timeout = 0;
-+			     !(nand_readl(info, NDSR) & NDSR_RDDREQ);
-+			     timeout++) {
-+				if (timeout >= 5) {
-+					dev_err(&info->pdev->dev,
-+						"Timeout on RDDREQ while draining the FIFO\n");
-+					return;
-+				}
-+
-+				mdelay(1);
-+			}
-+
-+			data += 32;
-+			len -= 8;
-+		}
-+	}
-+
-+	__raw_readsl(info->mmio_base + NDDB, data, len);
-+}
-+
- static void handle_data_pio(struct pxa3xx_nand_info *info)
- {
- 	unsigned int do_bytes = min(info->data_size, info->chunk_size);
-@@ -497,14 +533,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
- 				      DIV_ROUND_UP(info->oob_size, 4));
- 		break;
- 	case STATE_PIO_READING:
--		__raw_readsl(info->mmio_base + NDDB,
--			     info->data_buff + info->data_buff_pos,
--			     DIV_ROUND_UP(do_bytes, 4));
-+		drain_fifo(info,
-+			   info->data_buff + info->data_buff_pos,
-+			   DIV_ROUND_UP(do_bytes, 4));
- 
- 		if (info->oob_size > 0)
--			__raw_readsl(info->mmio_base + NDDB,
--				     info->oob_buff + info->oob_buff_pos,
--				     DIV_ROUND_UP(info->oob_size, 4));
-+			drain_fifo(info,
-+				   info->oob_buff + info->oob_buff_pos,
-+				   DIV_ROUND_UP(info->oob_size, 4));
- 		break;
- 	default:
- 		dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
-diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index 1468c46..84ad2b4 100644
---- a/drivers/net/can/dev.c
-+++ b/drivers/net/can/dev.c
-@@ -502,6 +502,14 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
- 	skb->pkt_type = PACKET_BROADCAST;
- 	skb->ip_summed = CHECKSUM_UNNECESSARY;
- 
-+	skb_reset_mac_header(skb);
-+	skb_reset_network_header(skb);
-+	skb_reset_transport_header(skb);
-+
-+	skb_reset_mac_header(skb);
-+	skb_reset_network_header(skb);
-+	skb_reset_transport_header(skb);
-+
- 	can_skb_reserve(skb);
- 	can_skb_prv(skb)->ifindex = dev->ifindex;
- 
-diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-index 7d43822..2428740 100644
---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-@@ -12395,6 +12395,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
- 	pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
- 			       PCICFG_VENDOR_ID_OFFSET);
- 
-+	/* Set PCIe reset type to fundamental for EEH recovery */
-+	pdev->needs_freset = 1;
-+
- 	/* AER (Advanced Error reporting) configuration */
- 	rc = pci_enable_pcie_error_reporting(pdev);
- 	if (!rc)
-diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
-index 3eed708..fe48f4c 100644
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -300,9 +300,18 @@ static const struct driver_info	cx82310_info = {
- 	.tx_fixup	= cx82310_tx_fixup,
- };
- 
-+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
-+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
-+		       USB_DEVICE_ID_MATCH_DEV_INFO, \
-+	.idVendor = (vend), \
-+	.idProduct = (prod), \
-+	.bDeviceClass = (cl), \
-+	.bDeviceSubClass = (sc), \
-+	.bDeviceProtocol = (pr)
-+
- static const struct usb_device_id products[] = {
- 	{
--		USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
-+		USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
- 		.driver_info = (unsigned long) &cx82310_info
- 	},
- 	{ },
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index b798404..5d8d2dc 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -1764,10 +1764,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
- 	trace_regulator_enable(rdev_get_name(rdev));
- 
- 	if (rdev->ena_pin) {
--		ret = regulator_ena_gpio_ctrl(rdev, true);
--		if (ret < 0)
--			return ret;
--		rdev->ena_gpio_state = 1;
-+		if (!rdev->ena_gpio_state) {
-+			ret = regulator_ena_gpio_ctrl(rdev, true);
-+			if (ret < 0)
-+				return ret;
-+			rdev->ena_gpio_state = 1;
-+		}
- 	} else if (rdev->desc->ops->enable) {
- 		ret = rdev->desc->ops->enable(rdev);
- 		if (ret < 0)
-@@ -1897,10 +1899,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
- 	trace_regulator_disable(rdev_get_name(rdev));
- 
- 	if (rdev->ena_pin) {
--		ret = regulator_ena_gpio_ctrl(rdev, false);
--		if (ret < 0)
--			return ret;
--		rdev->ena_gpio_state = 0;
-+		if (rdev->ena_gpio_state) {
-+			ret = regulator_ena_gpio_ctrl(rdev, false);
-+			if (ret < 0)
-+				return ret;
-+			rdev->ena_gpio_state = 0;
-+		}
- 
- 	} else if (rdev->desc->ops->disable) {
- 		ret = rdev->desc->ops->disable(rdev);
-@@ -3454,12 +3458,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
- 				 config->ena_gpio, ret);
- 			goto wash;
- 		}
--
--		if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
--			rdev->ena_gpio_state = 1;
--
--		if (config->ena_gpio_invert)
--			rdev->ena_gpio_state = !rdev->ena_gpio_state;
- 	}
- 
- 	/* set regulator constraints */
-@@ -3631,9 +3629,11 @@ int regulator_suspend_finish(void)
- 	list_for_each_entry(rdev, &regulator_list, list) {
- 		mutex_lock(&rdev->mutex);
- 		if (rdev->use_count > 0  || rdev->constraints->always_on) {
--			error = _regulator_do_enable(rdev);
--			if (error)
--				ret = error;
-+			if (!_regulator_is_enabled(rdev)) {
-+				error = _regulator_do_enable(rdev);
-+				if (error)
-+					ret = error;
-+			}
- 		} else {
- 			if (!have_full_constraints())
- 				goto unlock;
-diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
-index 62b58d3..60de662 100644
---- a/drivers/scsi/libsas/sas_discover.c
-+++ b/drivers/scsi/libsas/sas_discover.c
-@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
- 	struct sas_discovery_event *ev = to_sas_discovery_event(work);
- 	struct asd_sas_port *port = ev->port;
- 	struct sas_ha_struct *ha = port->ha;
-+	struct domain_device *ddev = port->port_dev;
- 
- 	/* prevent revalidation from finding sata links in recovery */
- 	mutex_lock(&ha->disco_mutex);
-@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
- 	SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
- 		    task_pid_nr(current));
- 
--	if (port->port_dev)
--		res = sas_ex_revalidate_domain(port->port_dev);
-+	if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
-+		     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
-+		res = sas_ex_revalidate_domain(ddev);
- 
- 	SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
- 		    port->id, task_pid_nr(current), res);
-diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
-index 5d7b07f..5f8c6d2 100644
---- a/drivers/spi/spi-atmel.c
-+++ b/drivers/spi/spi-atmel.c
-@@ -781,17 +781,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
- 			(unsigned long long)xfer->rx_dma);
- 	}
- 
--	/* REVISIT: We're waiting for ENDRX before we start the next
-+	/* REVISIT: We're waiting for RXBUFF before we start the next
- 	 * transfer because we need to handle some difficult timing
--	 * issues otherwise. If we wait for ENDTX in one transfer and
--	 * then starts waiting for ENDRX in the next, it's difficult
--	 * to tell the difference between the ENDRX interrupt we're
--	 * actually waiting for and the ENDRX interrupt of the
-+	 * issues otherwise. If we wait for TXBUFE in one transfer and
-+	 * then starts waiting for RXBUFF in the next, it's difficult
-+	 * to tell the difference between the RXBUFF interrupt we're
-+	 * actually waiting for and the RXBUFF interrupt of the
- 	 * previous transfer.
- 	 *
- 	 * It should be doable, though. Just not now...
- 	 */
--	spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
-+	spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
- 	spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
- }
- 
-diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
-index 971855e..fe091a8 100644
---- a/drivers/spi/spi-pl022.c
-+++ b/drivers/spi/spi-pl022.c
-@@ -503,12 +503,12 @@ static void giveback(struct pl022 *pl022)
- 	pl022->cur_msg = NULL;
- 	pl022->cur_transfer = NULL;
- 	pl022->cur_chip = NULL;
--	spi_finalize_current_message(pl022->master);
- 
- 	/* disable the SPI/SSP operation */
- 	writew((readw(SSP_CR1(pl022->virtbase)) &
- 		(~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
- 
-+	spi_finalize_current_message(pl022->master);
- }
- 
- /**
-diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
-index be89260..27e1a6e 100644
---- a/drivers/staging/iio/adc/mxs-lradc.c
-+++ b/drivers/staging/iio/adc/mxs-lradc.c
-@@ -1159,7 +1159,6 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data)
- 				LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2));
- 	}
- 
--	if (iio_buffer_enabled(iio))
- 	if (iio_buffer_enabled(iio)) {
- 		if (reg & lradc->buffer_vchans)
- 			iio_trigger_poll(iio->trig, iio_get_time_ns());
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 104f29e..e168a63 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -4196,11 +4196,17 @@ int iscsit_close_connection(
- 	pr_debug("Closing iSCSI connection CID %hu on SID:"
- 		" %u\n", conn->cid, sess->sid);
- 	/*
--	 * Always up conn_logout_comp just in case the RX Thread is sleeping
--	 * and the logout response never got sent because the connection
--	 * failed.
-+	 * Always up conn_logout_comp for the traditional TCP case just in case
-+	 * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
-+	 * response never got sent because the connection failed.
-+	 *
-+	 * However for iser-target, isert_wait4logout() is using conn_logout_comp
-+	 * to signal logout response TX interrupt completion.  Go ahead and skip
-+	 * this for iser since isert_rx_opcode() does not wait on logout failure,
-+	 * and to avoid iscsi_conn pointer dereference in iser-target code.
- 	 */
--	complete(&conn->conn_logout_comp);
-+	if (conn->conn_transport->transport_type == ISCSI_TCP)
-+		complete(&conn->conn_logout_comp);
- 
- 	iscsi_release_thread_set(conn);
- 
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index 26ae688..093b8cb 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -1591,8 +1591,6 @@ int target_configure_device(struct se_device *dev)
- 	ret = dev->transport->configure_device(dev);
- 	if (ret)
- 		goto out;
--	dev->dev_flags |= DF_CONFIGURED;
--
- 	/*
- 	 * XXX: there is not much point to have two different values here..
- 	 */
-@@ -1654,6 +1652,8 @@ int target_configure_device(struct se_device *dev)
- 	list_add_tail(&dev->g_dev_node, &g_device_list);
- 	mutex_unlock(&g_device_mutex);
- 
-+	dev->dev_flags |= DF_CONFIGURED;
-+
- 	return 0;
- 
- out_free_alua:
-diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
-index 0fccdcf..70cb375 100644
---- a/drivers/target/target_core_pr.c
-+++ b/drivers/target/target_core_pr.c
-@@ -76,7 +76,7 @@ enum preempt_type {
- };
- 
- static void __core_scsi3_complete_pro_release(struct se_device *, struct se_node_acl *,
--			struct t10_pr_registration *, int);
-+					      struct t10_pr_registration *, int, int);
- 
- static sense_reason_t
- target_scsi2_reservation_check(struct se_cmd *cmd)
-@@ -528,6 +528,18 @@ static int core_scsi3_pr_seq_non_holder(
- 
- 			return 0;
- 		}
-+       } else if (we && registered_nexus) {
-+               /*
-+                * Reads are allowed for Write Exclusive locks
-+                * from all registrants.
-+                */
-+               if (cmd->data_direction == DMA_FROM_DEVICE) {
-+                       pr_debug("Allowing READ CDB: 0x%02x for %s"
-+                               " reservation\n", cdb[0],
-+                               core_scsi3_pr_dump_type(pr_reg_type));
-+
-+                       return 0;
-+               }
- 	}
- 	pr_debug("%s Conflict for %sregistered nexus %s CDB: 0x%2x"
- 		" for %s reservation\n", transport_dump_cmd_direction(cmd),
-@@ -1186,7 +1198,7 @@ static int core_scsi3_check_implicit_release(
- 		 *    service action with the SERVICE ACTION RESERVATION KEY
- 		 *    field set to zero (see 5.7.11.3).
- 		 */
--		__core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0);
-+		__core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0, 1);
- 		ret = 1;
- 		/*
- 		 * For 'All Registrants' reservation types, all existing
-@@ -1228,7 +1240,8 @@ static void __core_scsi3_free_registration(
- 
- 	pr_reg->pr_reg_deve->def_pr_registered = 0;
- 	pr_reg->pr_reg_deve->pr_res_key = 0;
--	list_del(&pr_reg->pr_reg_list);
-+	if (!list_empty(&pr_reg->pr_reg_list))
-+		list_del(&pr_reg->pr_reg_list);
- 	/*
- 	 * Caller accessing *pr_reg using core_scsi3_locate_pr_reg(),
- 	 * so call core_scsi3_put_pr_reg() to decrement our reference.
-@@ -1280,6 +1293,7 @@ void core_scsi3_free_pr_reg_from_nacl(
- {
- 	struct t10_reservation *pr_tmpl = &dev->t10_pr;
- 	struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_res_holder;
-+	bool free_reg = false;
- 	/*
- 	 * If the passed se_node_acl matches the reservation holder,
- 	 * release the reservation.
-@@ -1287,13 +1301,18 @@ void core_scsi3_free_pr_reg_from_nacl(
- 	spin_lock(&dev->dev_reservation_lock);
- 	pr_res_holder = dev->dev_pr_res_holder;
- 	if ((pr_res_holder != NULL) &&
--	    (pr_res_holder->pr_reg_nacl == nacl))
--		__core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0);
-+	    (pr_res_holder->pr_reg_nacl == nacl)) {
-+		__core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0, 1);
-+		free_reg = true;
-+	}
- 	spin_unlock(&dev->dev_reservation_lock);
- 	/*
- 	 * Release any registration associated with the struct se_node_acl.
- 	 */
- 	spin_lock(&pr_tmpl->registration_lock);
-+	if (pr_res_holder && free_reg)
-+		__core_scsi3_free_registration(dev, pr_res_holder, NULL, 0);
-+
- 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
- 			&pr_tmpl->registration_list, pr_reg_list) {
- 
-@@ -1316,7 +1335,7 @@ void core_scsi3_free_all_registrations(
- 	if (pr_res_holder != NULL) {
- 		struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
- 		__core_scsi3_complete_pro_release(dev, pr_res_nacl,
--				pr_res_holder, 0);
-+						  pr_res_holder, 0, 0);
- 	}
- 	spin_unlock(&dev->dev_reservation_lock);
- 
-@@ -2126,13 +2145,13 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
- 		/*
- 		 * sa_res_key=0 Unregister Reservation Key for registered I_T Nexus.
- 		 */
--		pr_holder = core_scsi3_check_implicit_release(
--				cmd->se_dev, pr_reg);
-+		type = pr_reg->pr_res_type;
-+		pr_holder = core_scsi3_check_implicit_release(cmd->se_dev,
-+							      pr_reg);
- 		if (pr_holder < 0) {
- 			ret = TCM_RESERVATION_CONFLICT;
- 			goto out;
- 		}
--		type = pr_reg->pr_res_type;
- 
- 		spin_lock(&pr_tmpl->registration_lock);
- 		/*
-@@ -2290,6 +2309,7 @@ core_scsi3_pro_reserve(struct se_cmd *cmd, int type, int scope, u64 res_key)
- 	spin_lock(&dev->dev_reservation_lock);
- 	pr_res_holder = dev->dev_pr_res_holder;
- 	if (pr_res_holder) {
-+		int pr_res_type = pr_res_holder->pr_res_type;
- 		/*
- 		 * From spc4r17 Section 5.7.9: Reserving:
- 		 *
-@@ -2300,7 +2320,9 @@ core_scsi3_pro_reserve(struct se_cmd *cmd, int type, int scope, u64 res_key)
- 		 * the logical unit, then the command shall be completed with
- 		 * RESERVATION CONFLICT status.
- 		 */
--		if (pr_res_holder != pr_reg) {
-+		if ((pr_res_holder != pr_reg) &&
-+		    (pr_res_type != PR_TYPE_WRITE_EXCLUSIVE_ALLREG) &&
-+		    (pr_res_type != PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
- 			struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
- 			pr_err("SPC-3 PR: Attempted RESERVE from"
- 				" [%s]: %s while reservation already held by"
-@@ -2406,23 +2428,59 @@ static void __core_scsi3_complete_pro_release(
- 	struct se_device *dev,
- 	struct se_node_acl *se_nacl,
- 	struct t10_pr_registration *pr_reg,
--	int explicit)
-+	int explicit,
-+	int unreg)
- {
- 	struct target_core_fabric_ops *tfo = se_nacl->se_tpg->se_tpg_tfo;
- 	char i_buf[PR_REG_ISID_ID_LEN];
-+	int pr_res_type = 0, pr_res_scope = 0;
- 
- 	memset(i_buf, 0, PR_REG_ISID_ID_LEN);
- 	core_pr_dump_initiator_port(pr_reg, i_buf, PR_REG_ISID_ID_LEN);
- 	/*
- 	 * Go ahead and release the current PR reservation holder.
-+	 * If an All Registrants reservation is currently active and
-+	 * a unregister operation is requested, replace the current
-+	 * dev_pr_res_holder with another active registration.
- 	 */
--	dev->dev_pr_res_holder = NULL;
-+	if (dev->dev_pr_res_holder) {
-+		pr_res_type = dev->dev_pr_res_holder->pr_res_type;
-+		pr_res_scope = dev->dev_pr_res_holder->pr_res_scope;
-+		dev->dev_pr_res_holder->pr_res_type = 0;
-+		dev->dev_pr_res_holder->pr_res_scope = 0;
-+		dev->dev_pr_res_holder->pr_res_holder = 0;
-+		dev->dev_pr_res_holder = NULL;
-+	}
-+	if (!unreg)
-+		goto out;
- 
--	pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared"
--		" reservation holder TYPE: %s ALL_TG_PT: %d\n",
--		tfo->get_fabric_name(), (explicit) ? "explicit" : "implicit",
--		core_scsi3_pr_dump_type(pr_reg->pr_res_type),
--		(pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
-+	spin_lock(&dev->t10_pr.registration_lock);
-+	list_del_init(&pr_reg->pr_reg_list);
-+	/*
-+	 * If the I_T nexus is a reservation holder, the persistent reservation
-+	 * is of an all registrants type, and the I_T nexus is the last remaining
-+	 * registered I_T nexus, then the device server shall also release the
-+	 * persistent reservation.
-+	 */
-+	if (!list_empty(&dev->t10_pr.registration_list) &&
-+	    ((pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
-+	     (pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG))) {
-+		dev->dev_pr_res_holder =
-+			list_entry(dev->t10_pr.registration_list.next,
-+				   struct t10_pr_registration, pr_reg_list);
-+		dev->dev_pr_res_holder->pr_res_type = pr_res_type;
-+		dev->dev_pr_res_holder->pr_res_scope = pr_res_scope;
-+		dev->dev_pr_res_holder->pr_res_holder = 1;
-+	}
-+	spin_unlock(&dev->t10_pr.registration_lock);
-+out:
-+	if (!dev->dev_pr_res_holder) {
-+		pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared"
-+			" reservation holder TYPE: %s ALL_TG_PT: %d\n",
-+			tfo->get_fabric_name(), (explicit) ? "explicit" :
-+			"implicit", core_scsi3_pr_dump_type(pr_res_type),
-+			(pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
-+	}
- 	pr_debug("SPC-3 PR [%s] RELEASE Node: %s%s\n",
- 		tfo->get_fabric_name(), se_nacl->initiatorname,
- 		i_buf);
-@@ -2553,7 +2611,7 @@ core_scsi3_emulate_pro_release(struct se_cmd *cmd, int type, int scope,
- 	 *    server shall not establish a unit attention condition.
- 	 */
- 	__core_scsi3_complete_pro_release(dev, se_sess->se_node_acl,
--			pr_reg, 1);
-+					  pr_reg, 1, 0);
- 
- 	spin_unlock(&dev->dev_reservation_lock);
- 
-@@ -2641,7 +2699,7 @@ core_scsi3_emulate_pro_clear(struct se_cmd *cmd, u64 res_key)
- 	if (pr_res_holder) {
- 		struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
- 		__core_scsi3_complete_pro_release(dev, pr_res_nacl,
--			pr_res_holder, 0);
-+						  pr_res_holder, 0, 0);
- 	}
- 	spin_unlock(&dev->dev_reservation_lock);
- 	/*
-@@ -2700,7 +2758,7 @@ static void __core_scsi3_complete_pro_preempt(
- 	 */
- 	if (dev->dev_pr_res_holder)
- 		__core_scsi3_complete_pro_release(dev, nacl,
--				dev->dev_pr_res_holder, 0);
-+						  dev->dev_pr_res_holder, 0, 0);
- 
- 	dev->dev_pr_res_holder = pr_reg;
- 	pr_reg->pr_res_holder = 1;
-@@ -2944,8 +3002,8 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
- 	 */
- 	if (pr_reg_n != pr_res_holder)
- 		__core_scsi3_complete_pro_release(dev,
--				pr_res_holder->pr_reg_nacl,
--				dev->dev_pr_res_holder, 0);
-+						  pr_res_holder->pr_reg_nacl,
-+						  dev->dev_pr_res_holder, 0, 0);
- 	/*
- 	 * b) Remove the registrations for all I_T nexuses identified
- 	 *    by the SERVICE ACTION RESERVATION KEY field, except the
-@@ -3415,7 +3473,7 @@ after_iport_check:
- 	 *    holder (i.e., the I_T nexus on which the
- 	 */
- 	__core_scsi3_complete_pro_release(dev, pr_res_nacl,
--			dev->dev_pr_res_holder, 0);
-+					  dev->dev_pr_res_holder, 0, 0);
- 	/*
- 	 * g) Move the persistent reservation to the specified I_T nexus using
- 	 *    the same scope and type as the persistent reservation released in
-@@ -3855,7 +3913,8 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- 	unsigned char *buf;
- 	u32 add_desc_len = 0, add_len = 0, desc_len, exp_desc_len;
- 	u32 off = 8; /* off into first Full Status descriptor */
--	int format_code = 0;
-+	int format_code = 0, pr_res_type = 0, pr_res_scope = 0;
-+	bool all_reg = false;
- 
- 	if (cmd->data_length < 8) {
- 		pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u"
-@@ -3872,6 +3931,19 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- 	buf[2] = ((dev->t10_pr.pr_generation >> 8) & 0xff);
- 	buf[3] = (dev->t10_pr.pr_generation & 0xff);
- 
-+	spin_lock(&dev->dev_reservation_lock);
-+	if (dev->dev_pr_res_holder) {
-+		struct t10_pr_registration *pr_holder = dev->dev_pr_res_holder;
-+
-+		if (pr_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG ||
-+		    pr_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG) {
-+			all_reg = true;
-+			pr_res_type = pr_holder->pr_res_type;
-+			pr_res_scope = pr_holder->pr_res_scope;
-+		}
-+	}
-+	spin_unlock(&dev->dev_reservation_lock);
-+
- 	spin_lock(&pr_tmpl->registration_lock);
- 	list_for_each_entry_safe(pr_reg, pr_reg_tmp,
- 			&pr_tmpl->registration_list, pr_reg_list) {
-@@ -3921,14 +3993,20 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- 		 * reservation holder for PR_HOLDER bit.
- 		 *
- 		 * Also, if this registration is the reservation
--		 * holder, fill in SCOPE and TYPE in the next byte.
-+		 * holder or there is an All Registrants reservation
-+		 * active, fill in SCOPE and TYPE in the next byte.
- 		 */
- 		if (pr_reg->pr_res_holder) {
- 			buf[off++] |= 0x01;
- 			buf[off++] = (pr_reg->pr_res_scope & 0xf0) |
- 				     (pr_reg->pr_res_type & 0x0f);
--		} else
-+		} else if (all_reg) {
-+			buf[off++] |= 0x01;
-+			buf[off++] = (pr_res_scope & 0xf0) |
-+				     (pr_res_type & 0x0f);
-+		} else {
- 			off += 2;
-+		}
- 
- 		off += 4; /* Skip over reserved area */
- 		/*
-diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
-index 0f199f6..29f2880 100644
---- a/drivers/target/target_core_pscsi.c
-+++ b/drivers/target/target_core_pscsi.c
-@@ -1111,7 +1111,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
- 	struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
- 	struct scsi_device *sd = pdv->pdv_sd;
- 
--	return sd->type;
-+	return (sd) ? sd->type : TYPE_NO_LUN;
- }
- 
- static sector_t pscsi_get_blocks(struct se_device *dev)
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index e6463ef..9e54c0f 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2327,6 +2327,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
- 	list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
- out:
- 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+
-+	if (ret && ack_kref)
-+		target_put_sess_cmd(se_sess, se_cmd);
-+
- 	return ret;
- }
- EXPORT_SYMBOL(target_get_sess_cmd);
-diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index feda344..5892eab 100644
---- a/drivers/tty/serial/8250/8250_pci.c
-+++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -66,7 +66,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
- 	       "Please send the output of lspci -vv, this\n"
- 	       "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
- 	       "manufacturer and name of serial board or\n"
--	       "modem board to rmk+serial@arm.linux.org.uk.\n",
-+	       "modem board to <linux-serial@vger.kernel.org>.\n",
- 	       pci_name(dev), str, dev->vendor, dev->device,
- 	       dev->subsystem_vendor, dev->subsystem_device);
- }
-diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
-index f4a9e33..c8860a8 100644
---- a/drivers/xen/events/events_base.c
-+++ b/drivers/xen/events/events_base.c
-@@ -547,20 +547,26 @@ static unsigned int __startup_pirq(unsigned int irq)
- 	pirq_query_unmask(irq);
- 
- 	rc = set_evtchn_to_irq(evtchn, irq);
--	if (rc != 0) {
--		pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
--		       irq, rc);
--		xen_evtchn_close(evtchn);
--		return 0;
--	}
-+	if (rc)
-+		goto err;
-+
- 	bind_evtchn_to_cpu(evtchn, 0);
- 	info->evtchn = evtchn;
- 
-+	rc = xen_evtchn_port_setup(info);
-+	if (rc)
-+		goto err;
-+
- out:
- 	unmask_evtchn(evtchn);
- 	eoi_pirq(irq_get_irq_data(irq));
- 
- 	return 0;
-+
-+err:
-+	pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
-+	xen_evtchn_close(evtchn);
-+	return 0;
- }
- 
- static unsigned int startup_pirq(struct irq_data *data)
-diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
-index 46ae0f9..75fe3d4 100644
---- a/drivers/xen/xen-pciback/conf_space.c
-+++ b/drivers/xen/xen-pciback/conf_space.c
-@@ -16,7 +16,7 @@
- #include "conf_space.h"
- #include "conf_space_quirks.h"
- 
--static bool permissive;
-+bool permissive;
- module_param(permissive, bool, 0644);
- 
- /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
-diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
-index e56c934..2e1d73d 100644
---- a/drivers/xen/xen-pciback/conf_space.h
-+++ b/drivers/xen/xen-pciback/conf_space.h
-@@ -64,6 +64,8 @@ struct config_field_entry {
- 	void *data;
- };
- 
-+extern bool permissive;
-+
- #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
- 
- /* Add fields to a device - the add_fields macro expects to get a pointer to
-diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
-index c5ee825..2d73693 100644
---- a/drivers/xen/xen-pciback/conf_space_header.c
-+++ b/drivers/xen/xen-pciback/conf_space_header.c
-@@ -11,6 +11,10 @@
- #include "pciback.h"
- #include "conf_space.h"
- 
-+struct pci_cmd_info {
-+	u16 val;
-+};
-+
- struct pci_bar_info {
- 	u32 val;
- 	u32 len_val;
-@@ -20,22 +24,36 @@ struct pci_bar_info {
- #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
- #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
- 
--static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+/* Bits guests are allowed to control in permissive mode. */
-+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
-+			   PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
-+			   PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
-+
-+static void *command_init(struct pci_dev *dev, int offset)
- {
--	int i;
--	int ret;
--
--	ret = xen_pcibk_read_config_word(dev, offset, value, data);
--	if (!pci_is_enabled(dev))
--		return ret;
--
--	for (i = 0; i < PCI_ROM_RESOURCE; i++) {
--		if (dev->resource[i].flags & IORESOURCE_IO)
--			*value |= PCI_COMMAND_IO;
--		if (dev->resource[i].flags & IORESOURCE_MEM)
--			*value |= PCI_COMMAND_MEMORY;
-+	struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
-+	int err;
-+
-+	if (!cmd)
-+		return ERR_PTR(-ENOMEM);
-+
-+	err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
-+	if (err) {
-+		kfree(cmd);
-+		return ERR_PTR(err);
- 	}
- 
-+	return cmd;
-+}
-+
-+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+{
-+	int ret = pci_read_config_word(dev, offset, value);
-+	const struct pci_cmd_info *cmd = data;
-+
-+	*value &= PCI_COMMAND_GUEST;
-+	*value |= cmd->val & ~PCI_COMMAND_GUEST;
-+
- 	return ret;
- }
- 
-@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- {
- 	struct xen_pcibk_dev_data *dev_data;
- 	int err;
-+	u16 val;
-+	struct pci_cmd_info *cmd = data;
- 
- 	dev_data = pci_get_drvdata(dev);
- 	if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
-@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- 		}
- 	}
- 
-+	cmd->val = value;
-+
-+	if (!permissive && (!dev_data || !dev_data->permissive))
-+		return 0;
-+
-+	/* Only allow the guest to control certain bits. */
-+	err = pci_read_config_word(dev, offset, &val);
-+	if (err || val == value)
-+		return err;
-+
-+	value &= PCI_COMMAND_GUEST;
-+	value |= val & ~PCI_COMMAND_GUEST;
-+
- 	return pci_write_config_word(dev, offset, value);
- }
- 
-@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
- 	{
- 	 .offset    = PCI_COMMAND,
- 	 .size      = 2,
-+	 .init      = command_init,
-+	 .release   = bar_release,
- 	 .u.w.read  = command_read,
- 	 .u.w.write = command_write,
- 	},
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 6eb13c6..499155c 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -819,8 +819,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
- 
- 	newpage = buf->page;
- 
--	if (WARN_ON(!PageUptodate(newpage)))
--		return -EIO;
-+	if (!PageUptodate(newpage))
-+		SetPageUptodate(newpage);
- 
- 	ClearPageMappedToDisk(newpage);
- 
-@@ -1726,6 +1726,9 @@ copy_finish:
- static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
- 		       unsigned int size, struct fuse_copy_state *cs)
- {
-+	/* Don't try to move pages (yet) */
-+	cs->move_pages = 0;
-+
- 	switch (code) {
- 	case FUSE_NOTIFY_POLL:
- 		return fuse_notify_poll(fc, size, cs);
-diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
-index 5bee816..14538a8 100644
---- a/fs/nilfs2/segment.c
-+++ b/fs/nilfs2/segment.c
-@@ -1906,6 +1906,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- 					     struct the_nilfs *nilfs)
- {
- 	struct nilfs_inode_info *ii, *n;
-+	int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
- 	int defer_iput = false;
- 
- 	spin_lock(&nilfs->ns_inode_lock);
-@@ -1918,10 +1919,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- 		brelse(ii->i_bh);
- 		ii->i_bh = NULL;
- 		list_del_init(&ii->i_dirty);
--		if (!ii->vfs_inode.i_nlink) {
-+		if (!ii->vfs_inode.i_nlink || during_mount) {
- 			/*
--			 * Defer calling iput() to avoid a deadlock
--			 * over I_SYNC flag for inodes with i_nlink == 0
-+			 * Defer calling iput() to avoid deadlocks if
-+			 * i_nlink == 0 or mount is not yet finished.
- 			 */
- 			list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
- 			defer_iput = true;
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index c4b2646..c254671 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -1227,6 +1227,9 @@ out:
- 
- static int pagemap_open(struct inode *inode, struct file *file)
- {
-+	/* do not disclose physical addresses: attack vector */
-+	if (!capable(CAP_SYS_ADMIN))
-+		return -EPERM;
- 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
- 			"to stop being page-shift some time soon. See the "
- 			"linux/Documentation/vm/pagemap.txt for details.\n");
-diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
-index 6c62cfa..bc9d2c2 100644
---- a/include/linux/workqueue.h
-+++ b/include/linux/workqueue.h
-@@ -71,7 +71,8 @@ enum {
- 	/* data contains off-queue information when !WORK_STRUCT_PWQ */
- 	WORK_OFFQ_FLAG_BASE	= WORK_STRUCT_COLOR_SHIFT,
- 
--	WORK_OFFQ_CANCELING	= (1 << WORK_OFFQ_FLAG_BASE),
-+	__WORK_OFFQ_CANCELING	= WORK_OFFQ_FLAG_BASE,
-+	WORK_OFFQ_CANCELING	= (1 << __WORK_OFFQ_CANCELING),
- 
- 	/*
- 	 * When a work item is off queue, its high bits point to the last
-diff --git a/kernel/cpuset.c b/kernel/cpuset.c
-index 2fb2877..7b4530b 100644
---- a/kernel/cpuset.c
-+++ b/kernel/cpuset.c
-@@ -503,9 +503,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
- 
- 	rcu_read_lock();
- 	cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
--		if (cp == root_cs)
--			continue;
--
- 		/* skip the whole subtree if @cp doesn't have any CPU */
- 		if (cpumask_empty(cp->cpus_allowed)) {
- 			pos_css = css_rightmost_descendant(pos_css);
-diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
-index cbd69d8..2ca4a8b 100644
---- a/kernel/printk/console_cmdline.h
-+++ b/kernel/printk/console_cmdline.h
-@@ -3,7 +3,7 @@
- 
- struct console_cmdline
- {
--	char	name[8];			/* Name of the driver	    */
-+	char	name[16];			/* Name of the driver	    */
- 	int	index;				/* Minor dev. to use	    */
- 	char	*options;			/* Options for the driver   */
- #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index 8c086e6..a755ad7 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -2280,6 +2280,7 @@ void register_console(struct console *newcon)
- 	for (i = 0, c = console_cmdline;
- 	     i < MAX_CMDLINECONSOLES && c->name[0];
- 	     i++, c++) {
-+		BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
- 		if (strcmp(c->name, newcon->name) != 0)
- 			continue;
- 		if (newcon->index >= 0 &&
-diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index f6f31d8..423c9e3 100644
---- a/kernel/workqueue.c
-+++ b/kernel/workqueue.c
-@@ -2893,19 +2893,57 @@ bool flush_work(struct work_struct *work)
- }
- EXPORT_SYMBOL_GPL(flush_work);
- 
-+struct cwt_wait {
-+	wait_queue_t		wait;
-+	struct work_struct	*work;
-+};
-+
-+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
-+{
-+	struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
-+
-+	if (cwait->work != key)
-+		return 0;
-+	return autoremove_wake_function(wait, mode, sync, key);
-+}
-+
- static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
- {
-+	static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
- 	unsigned long flags;
- 	int ret;
- 
- 	do {
- 		ret = try_to_grab_pending(work, is_dwork, &flags);
- 		/*
--		 * If someone else is canceling, wait for the same event it
--		 * would be waiting for before retrying.
-+		 * If someone else is already canceling, wait for it to
-+		 * finish.  flush_work() doesn't work for PREEMPT_NONE
-+		 * because we may get scheduled between @work's completion
-+		 * and the other canceling task resuming and clearing
-+		 * CANCELING - flush_work() will return false immediately
-+		 * as @work is no longer busy, try_to_grab_pending() will
-+		 * return -ENOENT as @work is still being canceled and the
-+		 * other canceling task won't be able to clear CANCELING as
-+		 * we're hogging the CPU.
-+		 *
-+		 * Let's wait for completion using a waitqueue.  As this
-+		 * may lead to the thundering herd problem, use a custom
-+		 * wake function which matches @work along with exclusive
-+		 * wait and wakeup.
- 		 */
--		if (unlikely(ret == -ENOENT))
--			flush_work(work);
-+		if (unlikely(ret == -ENOENT)) {
-+			struct cwt_wait cwait;
-+
-+			init_wait(&cwait.wait);
-+			cwait.wait.func = cwt_wakefn;
-+			cwait.work = work;
-+
-+			prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
-+						  TASK_UNINTERRUPTIBLE);
-+			if (work_is_canceling(work))
-+				schedule();
-+			finish_wait(&cancel_waitq, &cwait.wait);
-+		}
- 	} while (unlikely(ret < 0));
- 
- 	/* tell other tasks trying to grab @work to back off */
-@@ -2914,6 +2952,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
- 
- 	flush_work(work);
- 	clear_work_data(work);
-+
-+	/*
-+	 * Paired with prepare_to_wait() above so that either
-+	 * waitqueue_active() is visible here or !work_is_canceling() is
-+	 * visible there.
-+	 */
-+	smp_mb();
-+	if (waitqueue_active(&cancel_waitq))
-+		__wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
-+
- 	return ret;
- }
- 
-diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
-index 7a85967..f0f5c5c 100644
---- a/lib/lz4/lz4_decompress.c
-+++ b/lib/lz4/lz4_decompress.c
-@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
- 			/* Error: request to write beyond destination buffer */
- 			if (cpy > oend)
- 				goto _output_error;
-+			if ((ref + COPYLENGTH) > oend ||
-+					(op + COPYLENGTH) > oend)
-+				goto _output_error;
- 			LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
- 			while (op < cpy)
- 				*op++ = *ref++;
-diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index d6be3ed..526bf56 100644
---- a/net/caif/caif_socket.c
-+++ b/net/caif/caif_socket.c
-@@ -283,7 +283,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
- 	int copylen;
- 
- 	ret = -EOPNOTSUPP;
--	if (m->msg_flags&MSG_OOB)
-+	if (flags & MSG_OOB)
- 		goto read_error;
- 
- 	skb = skb_recv_datagram(sk, flags, 0 , &ret);
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index a27f8aa..5e9a227 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -262,6 +262,9 @@ int can_send(struct sk_buff *skb, int loop)
- 		goto inval_skb;
- 	}
- 
-+	skb->ip_summed = CHECKSUM_UNNECESSARY;
-+
-+	skb_reset_mac_header(skb);
- 	skb_reset_network_header(skb);
- 	skb_reset_transport_header(skb);
- 
-diff --git a/net/compat.c b/net/compat.c
-index 275af79..d125290 100644
---- a/net/compat.c
-+++ b/net/compat.c
-@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
- 	    __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
- 	    __get_user(kmsg->msg_flags, &umsg->msg_flags))
- 		return -EFAULT;
-+
-+	if (!tmp1)
-+		kmsg->msg_namelen = 0;
-+
-+	if (kmsg->msg_namelen < 0)
-+		return -EINVAL;
-+
- 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
- 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
- 	kmsg->msg_name = compat_ptr(tmp1);
-diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
-index cf9cd13..e731c96 100644
---- a/net/core/sysctl_net_core.c
-+++ b/net/core/sysctl_net_core.c
-@@ -25,6 +25,8 @@
- static int zero = 0;
- static int one = 1;
- static int ushort_max = USHRT_MAX;
-+static int min_sndbuf = SOCK_MIN_SNDBUF;
-+static int min_rcvbuf = SOCK_MIN_RCVBUF;
- 
- #ifdef CONFIG_RPS
- static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
-@@ -223,7 +225,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_sndbuf,
- 	},
- 	{
- 		.procname	= "rmem_max",
-@@ -231,7 +233,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_rcvbuf,
- 	},
- 	{
- 		.procname	= "wmem_default",
-@@ -239,7 +241,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_sndbuf,
- 	},
- 	{
- 		.procname	= "rmem_default",
-@@ -247,7 +249,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_rcvbuf,
- 	},
- 	{
- 		.procname	= "dev_weight",
-diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index e34dccb..4eeba4e 100644
---- a/net/ipv4/inet_diag.c
-+++ b/net/ipv4/inet_diag.c
-@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
- 	mutex_unlock(&inet_diag_table_mutex);
- }
- 
-+static size_t inet_sk_attr_size(void)
-+{
-+	return	  nla_total_size(sizeof(struct tcp_info))
-+		+ nla_total_size(1) /* INET_DIAG_SHUTDOWN */
-+		+ nla_total_size(1) /* INET_DIAG_TOS */
-+		+ nla_total_size(1) /* INET_DIAG_TCLASS */
-+		+ nla_total_size(sizeof(struct inet_diag_meminfo))
-+		+ nla_total_size(sizeof(struct inet_diag_msg))
-+		+ nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
-+		+ nla_total_size(TCP_CA_NAME_MAX)
-+		+ nla_total_size(sizeof(struct tcpvegas_info))
-+		+ 64;
-+}
-+
- int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
- 			      struct sk_buff *skb, struct inet_diag_req_v2 *req,
- 			      struct user_namespace *user_ns,		      	
-@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
- 	if (err)
- 		goto out;
- 
--	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
--			sizeof(struct inet_diag_meminfo) +
--			sizeof(struct tcp_info) + 64, GFP_KERNEL);
-+	rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
- 	if (!rep) {
- 		err = -ENOMEM;
- 		goto out;
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 7efa26b..d0c3108 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2617,15 +2617,11 @@ void tcp_send_fin(struct sock *sk)
- 	} else {
- 		/* Socket is locked, keep trying until memory is available. */
- 		for (;;) {
--			skb = alloc_skb_fclone(MAX_TCP_HEADER,
--					       sk->sk_allocation);
-+			skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
- 			if (skb)
- 				break;
- 			yield();
- 		}
--
--		/* Reserve space for headers and prepare control bits. */
--		skb_reserve(skb, MAX_TCP_HEADER);
- 		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
- 		tcp_init_nondata_skb(skb, tp->write_seq,
- 				     TCPHDR_ACK | TCPHDR_FIN);
-@@ -2899,9 +2895,9 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
- {
- 	struct tcp_sock *tp = tcp_sk(sk);
- 	struct tcp_fastopen_request *fo = tp->fastopen_req;
--	int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen;
--	struct sk_buff *syn_data = NULL, *data;
-+	int syn_loss = 0, space, err = 0;
- 	unsigned long last_syn_loss = 0;
-+	struct sk_buff *syn_data;
- 
- 	tp->rx_opt.mss_clamp = tp->advmss;  /* If MSS is not cached */
- 	tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
-@@ -2932,42 +2928,38 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
- 	/* limit to order-0 allocations */
- 	space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
- 
--	syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
--				   sk->sk_allocation);
--	if (syn_data == NULL)
-+	syn_data = sk_stream_alloc_skb(sk, space, sk->sk_allocation);
-+	if (!syn_data)
- 		goto fallback;
-+	syn_data->ip_summed = CHECKSUM_PARTIAL;
-+	memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
-+	if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space),
-+					 fo->data->msg_iov, 0, space))) {
-+		kfree_skb(syn_data);
-+		goto fallback;
-+	}
- 
--	for (i = 0; i < iovlen && syn_data->len < space; ++i) {
--		struct iovec *iov = &fo->data->msg_iov[i];
--		unsigned char __user *from = iov->iov_base;
--		int len = iov->iov_len;
--
--		if (syn_data->len + len > space)
--			len = space - syn_data->len;
--		else if (i + 1 == iovlen)
--			/* No more data pending in inet_wait_for_connect() */
--			fo->data = NULL;
-+	/* No more data pending in inet_wait_for_connect() */
-+	if (space == fo->size)
-+		fo->data = NULL;
-+	fo->copied = space;
- 
--		if (skb_add_data(syn_data, from, len))
--			goto fallback;
--	}
-+	tcp_connect_queue_skb(sk, syn_data);
- 
--	/* Queue a data-only packet after the regular SYN for retransmission */
--	data = pskb_copy(syn_data, sk->sk_allocation);
--	if (data == NULL)
--		goto fallback;
--	TCP_SKB_CB(data)->seq++;
--	TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN;
--	TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH);
--	tcp_connect_queue_skb(sk, data);
--	fo->copied = data->len;
-+	err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation);
- 
--	if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
-+	/* Now full SYN+DATA was cloned and sent (or not),
-+	 * remove the SYN from the original skb (syn_data)
-+	 * we keep in write queue in case of a retransmit, as we
-+	 * also have the SYN packet (with no data) in the same queue.
-+	 */
-+	TCP_SKB_CB(syn_data)->seq++;
-+	TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH;
-+	if (!err) {
- 		tp->syn_data = (fo->copied > 0);
- 		NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE);
- 		goto done;
- 	}
--	syn_data = NULL;
- 
- fallback:
- 	/* Send a regular SYN with Fast Open cookie request option */
-@@ -2976,7 +2968,6 @@ fallback:
- 	err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
- 	if (err)
- 		tp->syn_fastopen = 0;
--	kfree_skb(syn_data);
- done:
- 	fo->cookie.len = -1;  /* Exclude Fast Open option for SYN retries */
- 	return err;
-@@ -2996,13 +2987,10 @@ int tcp_connect(struct sock *sk)
- 		return 0;
- 	}
- 
--	buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
--	if (unlikely(buff == NULL))
-+	buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
-+	if (unlikely(!buff))
- 		return -ENOBUFS;
- 
--	/* Reserve space for headers. */
--	skb_reserve(buff, MAX_TCP_HEADER);
--
- 	tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
- 	tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp;
- 	tcp_connect_queue_skb(sk, buff);
-diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
-index b4d5e1d..27ca796 100644
---- a/net/ipv6/fib6_rules.c
-+++ b/net/ipv6/fib6_rules.c
-@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
- 				goto again;
- 			flp6->saddr = saddr;
- 		}
-+		err = rt->dst.error;
- 		goto out;
- 	}
- again:
-diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index 27d3f40..847d2a2 100644
---- a/net/netfilter/ipvs/ip_vs_core.c
-+++ b/net/netfilter/ipvs/ip_vs_core.c
-@@ -658,16 +658,24 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
- 	return err;
- }
- 
--static int ip_vs_route_me_harder(int af, struct sk_buff *skb)
-+static int ip_vs_route_me_harder(int af, struct sk_buff *skb,
-+				 unsigned int hooknum)
- {
-+	if (!sysctl_snat_reroute(skb))
-+		return 0;
-+	/* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */
-+	if (NF_INET_LOCAL_IN == hooknum)
-+		return 0;
- #ifdef CONFIG_IP_VS_IPV6
- 	if (af == AF_INET6) {
--		if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0)
-+		struct dst_entry *dst = skb_dst(skb);
-+
-+		if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
-+		    ip6_route_me_harder(skb) != 0)
- 			return 1;
- 	} else
- #endif
--		if ((sysctl_snat_reroute(skb) ||
--		     skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
-+		if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
- 		    ip_route_me_harder(skb, RTN_LOCAL) != 0)
- 			return 1;
- 
-@@ -790,7 +798,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
- 				union nf_inet_addr *snet,
- 				__u8 protocol, struct ip_vs_conn *cp,
- 				struct ip_vs_protocol *pp,
--				unsigned int offset, unsigned int ihl)
-+				unsigned int offset, unsigned int ihl,
-+				unsigned int hooknum)
- {
- 	unsigned int verdict = NF_DROP;
- 
-@@ -820,7 +829,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
- #endif
- 		ip_vs_nat_icmp(skb, pp, cp, 1);
- 
--	if (ip_vs_route_me_harder(af, skb))
-+	if (ip_vs_route_me_harder(af, skb, hooknum))
- 		goto out;
- 
- 	/* do the statistics and put it back */
-@@ -915,7 +924,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related,
- 
- 	snet.ip = iph->saddr;
- 	return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
--				    pp, ciph.len, ihl);
-+				    pp, ciph.len, ihl, hooknum);
- }
- 
- #ifdef CONFIG_IP_VS_IPV6
-@@ -980,7 +989,8 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related,
- 	snet.in6 = ciph.saddr.in6;
- 	writable = ciph.len;
- 	return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
--				    pp, writable, sizeof(struct ipv6hdr));
-+				    pp, writable, sizeof(struct ipv6hdr),
-+				    hooknum);
- }
- #endif
- 
-@@ -1039,7 +1049,8 @@ static inline bool is_new_conn(const struct sk_buff *skb,
-  */
- static unsigned int
- handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
--		struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
-+		struct ip_vs_conn *cp, struct ip_vs_iphdr *iph,
-+		unsigned int hooknum)
- {
- 	struct ip_vs_protocol *pp = pd->pp;
- 
-@@ -1077,7 +1088,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
- 	 * if it came from this machine itself.  So re-compute
- 	 * the routing information.
- 	 */
--	if (ip_vs_route_me_harder(af, skb))
-+	if (ip_vs_route_me_harder(af, skb, hooknum))
- 		goto drop;
- 
- 	IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT");
-@@ -1180,7 +1191,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)
- 	cp = pp->conn_out_get(af, skb, &iph, 0);
- 
- 	if (likely(cp))
--		return handle_response(af, skb, pd, cp, &iph);
-+		return handle_response(af, skb, pd, cp, &iph, hooknum);
- 	if (sysctl_nat_icmp_send(net) &&
- 	    (pp->protocol == IPPROTO_TCP ||
- 	     pp->protocol == IPPROTO_UDP ||
-diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
-index db80126..a8027e7 100644
---- a/net/netfilter/ipvs/ip_vs_sync.c
-+++ b/net/netfilter/ipvs/ip_vs_sync.c
-@@ -891,6 +891,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
- 			IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
- 			return;
- 		}
-+		if (!(flags & IP_VS_CONN_F_TEMPLATE))
-+			kfree(param->pe_data);
- 	}
- 
- 	if (opt)
-@@ -1164,6 +1166,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
- 				(opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
- 				);
- #endif
-+	ip_vs_pe_put(param.pe);
- 	return 0;
- 	/* Error exit */
- out:
-diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
-index ad97961..7350723 100644
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -611,8 +611,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
- 		struct xt_match *match = nft_match->ops.data;
- 
- 		if (strcmp(match->name, mt_name) == 0 &&
--		    match->revision == rev && match->family == family)
-+		    match->revision == rev && match->family == family) {
-+			if (!try_module_get(match->me))
-+				return ERR_PTR(-ENOENT);
-+
- 			return &nft_match->ops;
-+		}
- 	}
- 
- 	match = xt_request_find_match(family, mt_name, rev);
-@@ -682,8 +686,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
- 		struct xt_target *target = nft_target->ops.data;
- 
- 		if (strcmp(target->name, tg_name) == 0 &&
--		    target->revision == rev && target->family == family)
-+		    target->revision == rev && target->family == family) {
-+			if (!try_module_get(target->me))
-+				return ERR_PTR(-ENOENT);
-+
- 			return &nft_target->ops;
-+		}
- 	}
- 
- 	target = xt_request_find_target(family, tg_name, rev);
-diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
-index 1ba6793..13332db 100644
---- a/net/netfilter/xt_socket.c
-+++ b/net/netfilter/xt_socket.c
-@@ -243,12 +243,13 @@ static int
- extract_icmp6_fields(const struct sk_buff *skb,
- 		     unsigned int outside_hdrlen,
- 		     int *protocol,
--		     struct in6_addr **raddr,
--		     struct in6_addr **laddr,
-+		     const struct in6_addr **raddr,
-+		     const struct in6_addr **laddr,
- 		     __be16 *rport,
--		     __be16 *lport)
-+		     __be16 *lport,
-+		     struct ipv6hdr *ipv6_var)
- {
--	struct ipv6hdr *inside_iph, _inside_iph;
-+	const struct ipv6hdr *inside_iph;
- 	struct icmp6hdr *icmph, _icmph;
- 	__be16 *ports, _ports[2];
- 	u8 inside_nexthdr;
-@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
- 	if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
- 		return 1;
- 
--	inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
-+	inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
-+					sizeof(*ipv6_var), ipv6_var);
- 	if (inside_iph == NULL)
- 		return 1;
- 	inside_nexthdr = inside_iph->nexthdr;
- 
--	inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
-+	inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
-+					      sizeof(*ipv6_var),
- 					 &inside_nexthdr, &inside_fragoff);
- 	if (inside_hdrlen < 0)
- 		return 1; /* hjm: Packet has no/incomplete transport layer headers. */
-@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
- static bool
- socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
- {
--	struct ipv6hdr *iph = ipv6_hdr(skb);
-+	struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
- 	struct udphdr _hdr, *hp = NULL;
- 	struct sock *sk = skb->sk;
--	struct in6_addr *daddr = NULL, *saddr = NULL;
-+	const struct in6_addr *daddr = NULL, *saddr = NULL;
- 	__be16 uninitialized_var(dport), uninitialized_var(sport);
- 	int thoff = 0, uninitialized_var(tproto);
- 	const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
-@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
- 
- 	} else if (tproto == IPPROTO_ICMPV6) {
- 		if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
--					 &sport, &dport))
-+					 &sport, &dport, &ipv6_var))
- 			return false;
- 	} else {
- 		return false;
-diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
-index a817705..dba8d08 100644
---- a/net/rds/iw_rdma.c
-+++ b/net/rds/iw_rdma.c
-@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
- 			int *unpinned);
- static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
- 
--static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
-+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
-+			     struct rds_iw_device **rds_iwdev,
-+			     struct rdma_cm_id **cm_id)
- {
- 	struct rds_iw_device *iwdev;
- 	struct rds_iw_cm_id *i_cm_id;
-@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- 				src_addr->sin_port,
- 				dst_addr->sin_addr.s_addr,
- 				dst_addr->sin_port,
--				rs->rs_bound_addr,
--				rs->rs_bound_port,
--				rs->rs_conn_addr,
--				rs->rs_conn_port);
-+				src->sin_addr.s_addr,
-+				src->sin_port,
-+				dst->sin_addr.s_addr,
-+				dst->sin_port);
- #ifdef WORKING_TUPLE_DETECTION
--			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
--			    src_addr->sin_port == rs->rs_bound_port &&
--			    dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
--			    dst_addr->sin_port == rs->rs_conn_port) {
-+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
-+			    src_addr->sin_port == src->sin_port &&
-+			    dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
-+			    dst_addr->sin_port == dst->sin_port) {
- #else
- 			/* FIXME - needs to compare the local and remote
- 			 * ipaddr/port tuple, but the ipaddr is the only
-@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- 			 * zero'ed.  It doesn't appear to be properly populated
- 			 * during connection setup...
- 			 */
--			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
-+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
- #endif
- 				spin_unlock_irq(&iwdev->spinlock);
- 				*rds_iwdev = iwdev;
-@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
- {
- 	struct sockaddr_in *src_addr, *dst_addr;
- 	struct rds_iw_device *rds_iwdev_old;
--	struct rds_sock rs;
- 	struct rdma_cm_id *pcm_id;
- 	int rc;
- 
- 	src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- 	dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
- 
--	rs.rs_bound_addr = src_addr->sin_addr.s_addr;
--	rs.rs_bound_port = src_addr->sin_port;
--	rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
--	rs.rs_conn_port = dst_addr->sin_port;
--
--	rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
-+	rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
- 	if (rc)
- 		rds_iw_remove_cm_id(rds_iwdev, cm_id);
- 
-@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
- 	struct rds_iw_device *rds_iwdev;
- 	struct rds_iw_mr *ibmr = NULL;
- 	struct rdma_cm_id *cm_id;
-+	struct sockaddr_in src = {
-+		.sin_addr.s_addr = rs->rs_bound_addr,
-+		.sin_port = rs->rs_bound_port,
-+	};
-+	struct sockaddr_in dst = {
-+		.sin_addr.s_addr = rs->rs_conn_addr,
-+		.sin_port = rs->rs_conn_port,
-+	};
- 	int ret;
- 
--	ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
-+	ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
- 	if (ret || !cm_id) {
- 		ret = -ENODEV;
- 		goto out;
-diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
-index 34b5490..4949f75 100644
---- a/net/rxrpc/ar-recvmsg.c
-+++ b/net/rxrpc/ar-recvmsg.c
-@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
- 		if (!skb) {
- 			/* nothing remains on the queue */
- 			if (copied &&
--			    (msg->msg_flags & MSG_PEEK || timeo == 0))
-+			    (flags & MSG_PEEK || timeo == 0))
- 				goto out;
- 
- 			/* wait for a message to turn up */
-diff --git a/sound/core/control.c b/sound/core/control.c
-index 98a29b2..f2082a3 100644
---- a/sound/core/control.c
-+++ b/sound/core/control.c
-@@ -1168,6 +1168,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
- 
- 	if (info->count < 1)
- 		return -EINVAL;
-+	if (!*info->id.name)
-+		return -EINVAL;
-+	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
-+		return -EINVAL;
- 	access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
- 		(info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
- 				 SNDRV_CTL_ELEM_ACCESS_INACTIVE|
-diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
-index d9a09bd..9a23bde 100644
---- a/sound/pci/hda/hda_generic.c
-+++ b/sound/pci/hda/hda_generic.c
-@@ -653,12 +653,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
- 	return val;
- }
- 
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
-+{
-+	unsigned int wcaps = get_wcaps(codec, nid);
-+	hda_nid_t conn;
-+
-+	if (wcaps & AC_WCAP_STEREO)
-+		return true;
-+	if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+		return false;
-+	if (snd_hda_get_num_conns(codec, nid) != 1)
-+		return false;
-+	if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
-+		return false;
-+	return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
-+}
-+
- /* initialize the amp value (only at the first time) */
- static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
- {
- 	unsigned int caps = query_amp_caps(codec, nid, dir);
- 	int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
--	snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+
-+	if (is_stereo_amps(codec, nid, dir))
-+		snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+	else
-+		snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
-+}
-+
-+/* update the amp, doing in stereo or mono depending on NID */
-+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
-+		      unsigned int mask, unsigned int val)
-+{
-+	if (is_stereo_amps(codec, nid, dir))
-+		return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
-+						mask, val);
-+	else
-+		return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
-+						mask, val);
- }
- 
- /* calculate amp value mask we can modify;
-@@ -698,7 +731,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
- 		return;
- 
- 	val &= mask;
--	snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
-+	update_amp(codec, nid, dir, idx, mask, val);
- }
- 
- static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
-@@ -4337,13 +4370,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
- 	has_amp = nid_has_mute(codec, mix, HDA_INPUT);
- 	for (i = 0; i < nums; i++) {
- 		if (has_amp)
--			snd_hda_codec_amp_stereo(codec, mix,
--						 HDA_INPUT, i,
--						 0xff, HDA_AMP_MUTE);
-+			update_amp(codec, mix, HDA_INPUT, i,
-+				   0xff, HDA_AMP_MUTE);
- 		else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
--			snd_hda_codec_amp_stereo(codec, conn[i],
--						 HDA_OUTPUT, 0,
--						 0xff, HDA_AMP_MUTE);
-+			update_amp(codec, conn[i], HDA_OUTPUT, 0,
-+				   0xff, HDA_AMP_MUTE);
- 	}
- }
- 
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 2f3059b..84e8879 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -959,7 +959,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
- 		}
- 	}
- 
--	if (!bus->no_response_fallback)
-+	if (bus->no_response_fallback)
- 		return -1;
- 
- 	if (!chip->polling_mode && chip->poll_count < 2) {
-diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
-index ce5a6da..05e19f7 100644
---- a/sound/pci/hda/hda_proc.c
-+++ b/sound/pci/hda/hda_proc.c
-@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
- 		    (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
- }
- 
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
-+			   int dir, unsigned int wcaps, int indices)
-+{
-+	hda_nid_t conn;
-+
-+	if (wcaps & AC_WCAP_STEREO)
-+		return true;
-+	/* check for a stereo-to-mono mix; it must be:
-+	 * only a single connection, only for input, and only a mixer widget
-+	 */
-+	if (indices != 1 || dir != HDA_INPUT ||
-+	    get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+		return false;
-+
-+	if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
-+		return false;
-+	/* the connection source is a stereo? */
-+	wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
-+	return !!(wcaps & AC_WCAP_STEREO);
-+}
-+
- static void print_amp_vals(struct snd_info_buffer *buffer,
- 			   struct hda_codec *codec, hda_nid_t nid,
--			   int dir, int stereo, int indices)
-+			   int dir, unsigned int wcaps, int indices)
- {
- 	unsigned int val;
-+	bool stereo;
- 	int i;
- 
-+	stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
-+
- 	dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
- 	for (i = 0; i < indices; i++) {
- 		snd_iprintf(buffer, " [");
-@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- 			    (codec->single_adc_amp &&
- 			     wid_type == AC_WID_AUD_IN))
- 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
--					       wid_caps & AC_WCAP_STEREO,
--					       1);
-+					       wid_caps, 1);
- 			else
- 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
--					       wid_caps & AC_WCAP_STEREO,
--					       conn_len);
-+					       wid_caps, conn_len);
- 		}
- 		if (wid_caps & AC_WCAP_OUT_AMP) {
- 			snd_iprintf(buffer, "  Amp-Out caps: ");
-@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- 			if (wid_type == AC_WID_PIN &&
- 			    codec->pin_amp_workaround)
- 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
--					       wid_caps & AC_WCAP_STEREO,
--					       conn_len);
-+					       wid_caps, conn_len);
- 			else
- 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
--					       wid_caps & AC_WCAP_STEREO, 1);
-+					       wid_caps, 1);
- 		}
- 
- 		switch (wid_type) {
-diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
-index fc492ac..51e2080 100644
---- a/sound/pci/hda/patch_cirrus.c
-+++ b/sound/pci/hda/patch_cirrus.c
-@@ -396,6 +396,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
- 	SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
- 	SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
-+	SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
- 	SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
- 	SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
- 	{} /* terminator */
-@@ -587,6 +588,7 @@ static int patch_cs420x(struct hda_codec *codec)
- 		return -ENOMEM;
- 
- 	spec->gen.automute_hook = cs_automute;
-+	codec->single_adc_amp = 1;
- 
- 	snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
- 			   cs420x_fixups);
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index ffc1946..976493c 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -3232,6 +3232,7 @@ enum {
- 	CXT_PINCFG_LENOVO_TP410,
- 	CXT_PINCFG_LEMOTE_A1004,
- 	CXT_PINCFG_LEMOTE_A1205,
-+	CXT_PINCFG_COMPAQ_CQ60,
- 	CXT_FIXUP_STEREO_DMIC,
- 	CXT_FIXUP_INC_MIC_BOOST,
- 	CXT_FIXUP_HEADPHONE_MIC_PIN,
-@@ -3368,6 +3369,15 @@ static const struct hda_fixup cxt_fixups[] = {
- 		.type = HDA_FIXUP_PINS,
- 		.v.pins = cxt_pincfg_lemote,
- 	},
-+	[CXT_PINCFG_COMPAQ_CQ60] = {
-+		.type = HDA_FIXUP_PINS,
-+		.v.pins = (const struct hda_pintbl[]) {
-+			/* 0x17 was falsely set up as a mic, it should 0x1d */
-+			{ 0x17, 0x400001f0 },
-+			{ 0x1d, 0x97a70120 },
-+			{ }
-+		}
-+	},
- 	[CXT_FIXUP_STEREO_DMIC] = {
- 		.type = HDA_FIXUP_FUNC,
- 		.v.func = cxt_fixup_stereo_dmic,
-@@ -3411,6 +3421,7 @@ static const struct hda_fixup cxt_fixups[] = {
- };
- 
- static const struct snd_pci_quirk cxt5051_fixups[] = {
-+	SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
- 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
- 	{}
- };
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index 83bddbd..5293b5a 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
- 		}
- 	}
- },
-+{
-+	USB_DEVICE(0x0582, 0x0159),
-+	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-+		/* .vendor_name = "Roland", */
-+		/* .product_name = "UA-22", */
-+		.ifnum = QUIRK_ANY_INTERFACE,
-+		.type = QUIRK_COMPOSITE,
-+		.data = (const struct snd_usb_audio_quirk[]) {
-+			{
-+				.ifnum = 0,
-+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-+			},
-+			{
-+				.ifnum = 1,
-+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-+			},
-+			{
-+				.ifnum = 2,
-+				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-+				.data = & (const struct snd_usb_midi_endpoint_info) {
-+					.out_cables = 0x0001,
-+					.in_cables = 0x0001
-+				}
-+			},
-+			{
-+				.ifnum = -1
-+			}
-+		}
-+	}
-+},
- /* this catches most recent vendor-specific Roland devices */
- {
- 	.match_flags = USB_DEVICE_ID_MATCH_VENDOR |
diff --git a/3.14.37/0000_README b/3.14.38/0000_README
index cbf4ba6..de197d5 100644
--- a/3.14.37/0000_README
+++ b/3.14.38/0000_README
@@ -2,11 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1036_linux-3.14.37.patch
+Patch:	1037_linux-3.14.38.patch
 From:	http://www.kernel.org
-Desc:	Linux 3.14.37
+Desc:	Linux 3.14.38
 
-Patch:	4420_grsecurity-3.1-3.14.37-201504051405.patch
+Patch:	4420_grsecurity-3.1-3.14.38-201504142259.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.14.38/1037_linux-3.14.38.patch b/3.14.38/1037_linux-3.14.38.patch
new file mode 100644
index 0000000..261e9f9
--- /dev/null
+++ b/3.14.38/1037_linux-3.14.38.patch
@@ -0,0 +1,1029 @@
+diff --git a/Makefile b/Makefile
+index c24acc0..f09e19d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 37
++SUBLEVEL = 38
+ EXTRAVERSION =
+ NAME = Remembering Coco
+ 
+diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
+index a9eee33..101a42b 100644
+--- a/arch/arm64/include/asm/mmu_context.h
++++ b/arch/arm64/include/asm/mmu_context.h
+@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ {
+ 	unsigned int cpu = smp_processor_id();
+ 
++	/*
++	 * init_mm.pgd does not contain any user mappings and it is always
++	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
++	 */
++	if (next == &init_mm) {
++		cpu_set_reserved_ttbr0();
++		return;
++	}
++
+ 	if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
+ 		check_and_switch_context(next, tsk);
+ }
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+index 1382fec..7fcb1ac 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+@@ -50,6 +50,7 @@ ethernet@b0000 {
+ 	fsl,num_tx_queues = <0x8>;
+ 	fsl,magic-packet;
+ 	local-mac-address = [ 00 00 00 00 00 00 ];
++	ranges;
+ 
+ 	queue-group@b0000 {
+ 		#address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+index 221cd2e..9f25427 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+@@ -50,6 +50,7 @@ ethernet@b1000 {
+ 	fsl,num_tx_queues = <0x8>;
+ 	fsl,magic-packet;
+ 	local-mac-address = [ 00 00 00 00 00 00 ];
++	ranges;
+ 
+ 	queue-group@b1000 {
+ 		#address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+index 61456c3..cd7c318 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+@@ -49,6 +49,7 @@ ethernet@b2000 {
+ 	fsl,num_tx_queues = <0x8>;
+ 	fsl,magic-packet;
+ 	local-mac-address = [ 00 00 00 00 00 00 ];
++	ranges;
+ 
+ 	queue-group@b2000 {
+ 		#address-cells = <1>;
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 38d5073..5193116 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1422,7 +1422,7 @@ machine_check_handle_early:
+ 	bne	9f			/* continue in V mode if we are. */
+ 
+ 5:
+-#ifdef CONFIG_KVM_BOOK3S_64_HV
++#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
+ 	/*
+ 	 * We are coming from kernel context. Check if we are coming from
+ 	 * guest. if yes, then we can continue. We will fall through
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index cde4e0a..bf38292 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -24,10 +24,10 @@
+ static struct kobject *mobility_kobj;
+ 
+ struct update_props_workarea {
+-	u32 phandle;
+-	u32 state;
+-	u64 reserved;
+-	u32 nprops;
++	__be32 phandle;
++	__be32 state;
++	__be64 reserved;
++	__be32 nprops;
+ } __packed;
+ 
+ #define NODE_ACTION_MASK	0xff000000
+@@ -53,11 +53,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ 	return rc;
+ }
+ 
+-static int delete_dt_node(u32 phandle)
++static int delete_dt_node(__be32 phandle)
+ {
+ 	struct device_node *dn;
+ 
+-	dn = of_find_node_by_phandle(phandle);
++	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ 	if (!dn)
+ 		return -ENOENT;
+ 
+@@ -126,7 +126,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
+ 	return 0;
+ }
+ 
+-static int update_dt_node(u32 phandle, s32 scope)
++static int update_dt_node(__be32 phandle, s32 scope)
+ {
+ 	struct update_props_workarea *upwa;
+ 	struct device_node *dn;
+@@ -135,6 +135,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 	char *prop_data;
+ 	char *rtas_buf;
+ 	int update_properties_token;
++	u32 nprops;
+ 	u32 vd;
+ 
+ 	update_properties_token = rtas_token("ibm,update-properties");
+@@ -145,7 +146,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 	if (!rtas_buf)
+ 		return -ENOMEM;
+ 
+-	dn = of_find_node_by_phandle(phandle);
++	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ 	if (!dn) {
+ 		kfree(rtas_buf);
+ 		return -ENOENT;
+@@ -161,6 +162,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 			break;
+ 
+ 		prop_data = rtas_buf + sizeof(*upwa);
++		nprops = be32_to_cpu(upwa->nprops);
+ 
+ 		/* On the first call to ibm,update-properties for a node the
+ 		 * the first property value descriptor contains an empty
+@@ -169,17 +171,17 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 		 */
+ 		if (*prop_data == 0) {
+ 			prop_data++;
+-			vd = *(u32 *)prop_data;
++			vd = be32_to_cpu(*(__be32 *)prop_data);
+ 			prop_data += vd + sizeof(vd);
+-			upwa->nprops--;
++			nprops--;
+ 		}
+ 
+-		for (i = 0; i < upwa->nprops; i++) {
++		for (i = 0; i < nprops; i++) {
+ 			char *prop_name;
+ 
+ 			prop_name = prop_data;
+ 			prop_data += strlen(prop_name) + 1;
+-			vd = *(u32 *)prop_data;
++			vd = be32_to_cpu(*(__be32 *)prop_data);
+ 			prop_data += sizeof(vd);
+ 
+ 			switch (vd) {
+@@ -211,13 +213,13 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 	return 0;
+ }
+ 
+-static int add_dt_node(u32 parent_phandle, u32 drc_index)
++static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ {
+ 	struct device_node *dn;
+ 	struct device_node *parent_dn;
+ 	int rc;
+ 
+-	parent_dn = of_find_node_by_phandle(parent_phandle);
++	parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
+ 	if (!parent_dn)
+ 		return -ENOENT;
+ 
+@@ -236,7 +238,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
+ int pseries_devicetree_update(s32 scope)
+ {
+ 	char *rtas_buf;
+-	u32 *data;
++	__be32 *data;
+ 	int update_nodes_token;
+ 	int rc;
+ 
+@@ -253,17 +255,17 @@ int pseries_devicetree_update(s32 scope)
+ 		if (rc && rc != 1)
+ 			break;
+ 
+-		data = (u32 *)rtas_buf + 4;
+-		while (*data & NODE_ACTION_MASK) {
++		data = (__be32 *)rtas_buf + 4;
++		while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
+ 			int i;
+-			u32 action = *data & NODE_ACTION_MASK;
+-			int node_count = *data & NODE_COUNT_MASK;
++			u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
++			u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
+ 
+ 			data++;
+ 
+ 			for (i = 0; i < node_count; i++) {
+-				u32 phandle = *data++;
+-				u32 drc_index;
++				__be32 phandle = *data++;
++				__be32 drc_index;
+ 
+ 				switch (action) {
+ 				case DELETE_DT_NODE:
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index 930cad4..2b946bc 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -313,7 +313,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ 	if (pos == 0) {
+ 		memmove(blk + offset * map->cache_word_size,
+ 			blk, rbnode->blklen * map->cache_word_size);
+-		bitmap_shift_right(present, present, offset, blklen);
++		bitmap_shift_left(present, present, offset, blklen);
+ 	}
+ 
+ 	/* update the rbnode block, its size and the base register */
+diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
+index 1a6205b..35b0161 100644
+--- a/drivers/clocksource/time-efm32.c
++++ b/drivers/clocksource/time-efm32.c
+@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
+ 	clock_event_ddata.base = base;
+ 	clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
+ 
+-	setup_irq(irq, &efm32_clock_event_irq);
+-
+ 	clockevents_config_and_register(&clock_event_ddata.evtdev,
+ 					DIV_ROUND_CLOSEST(rate, 1024),
+ 					0xf, 0xffff);
+ 
++	setup_irq(irq, &efm32_clock_event_irq);
++
+ 	return 0;
+ 
+ err_get_irq:
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index deebcd6..4f0f361 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -172,10 +172,6 @@ static void __init sun5i_timer_init(struct device_node *node)
+ 
+ 	ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+ 
+-	ret = setup_irq(irq, &sun5i_timer_irq);
+-	if (ret)
+-		pr_warn("failed to setup irq %d\n", irq);
+-
+ 	/* Enable timer0 interrupt */
+ 	val = readl(timer_base + TIMER_IRQ_EN_REG);
+ 	writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+@@ -185,6 +181,10 @@ static void __init sun5i_timer_init(struct device_node *node)
+ 
+ 	clockevents_config_and_register(&sun5i_clockevent, rate,
+ 					TIMER_SYNC_TICKS, 0xffffffff);
++
++	ret = setup_irq(irq, &sun5i_timer_irq);
++	if (ret)
++		pr_warn("failed to setup irq %d\n", irq);
+ }
+ CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
+ 		       sun5i_timer_init);
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 453822c..fe8b0c9 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -48,6 +48,8 @@ static bool dw_dma_of_filter(struct dma_chan *chan, void *param)
+ 	return true;
+ }
+ 
++#define DRV_NAME	"dw_dmac"
++
+ static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
+ 					struct of_dma *ofdma)
+ {
+@@ -293,7 +295,7 @@ static struct platform_driver dw_driver = {
+ 	.remove		= dw_remove,
+ 	.shutdown	= dw_shutdown,
+ 	.driver = {
+-		.name	= "dw_dmac",
++		.name	= DRV_NAME,
+ 		.pm	= &dw_dev_pm_ops,
+ 		.of_match_table = of_match_ptr(dw_dma_of_id_table),
+ 		.acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
+@@ -314,3 +316,4 @@ module_exit(dw_exit);
+ 
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
++MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index d2a8d64..080e767 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -291,9 +291,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ 	struct request_queue *q = bdev_get_queue(where->bdev);
+ 	unsigned short logical_block_size = queue_logical_block_size(q);
+ 	sector_t num_sectors;
++	unsigned int uninitialized_var(special_cmd_max_sectors);
+ 
+-	/* Reject unsupported discard requests */
+-	if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
++	/*
++	 * Reject unsupported discard and write same requests.
++	 */
++	if (rw & REQ_DISCARD)
++		special_cmd_max_sectors = q->limits.max_discard_sectors;
++	else if (rw & REQ_WRITE_SAME)
++		special_cmd_max_sectors = q->limits.max_write_same_sectors;
++	if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+ 		dec_count(io, region, -EOPNOTSUPP);
+ 		return;
+ 	}
+@@ -319,7 +326,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ 		store_io_and_region_in_bio(bio, io, region);
+ 
+ 		if (rw & REQ_DISCARD) {
+-			num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++			num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ 			bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ 			remaining -= num_sectors;
+ 		} else if (rw & REQ_WRITE_SAME) {
+@@ -328,7 +335,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ 			 */
+ 			dp->get_page(dp, &page, &len, &offset);
+ 			bio_add_page(bio, page, logical_block_size, offset);
+-			num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
++			num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ 			bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ 
+ 			offset = 0;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 1582c3da..e400591 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2352,10 +2352,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ 	set_bit(DMF_FREEING, &md->flags);
+ 	spin_unlock(&_minor_lock);
+ 
++	/*
++	 * Take suspend_lock so that presuspend and postsuspend methods
++	 * do not race with internal suspend.
++	 */
++	mutex_lock(&md->suspend_lock);
+ 	if (!dm_suspended_md(md)) {
+ 		dm_table_presuspend_targets(map);
+ 		dm_table_postsuspend_targets(map);
+ 	}
++	mutex_unlock(&md->suspend_lock);
+ 
+ 	/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+ 	dm_put_live_table(md, srcu_idx);
+diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
+index 38917a8..2df3cbc 100644
+--- a/drivers/mfd/kempld-core.c
++++ b/drivers/mfd/kempld-core.c
+@@ -629,7 +629,7 @@ static int __init kempld_init(void)
+ 	if (force_device_id[0]) {
+ 		for (id = kempld_dmi_table; id->matches[0].slot != DMI_NONE; id++)
+ 			if (strstr(id->ident, force_device_id))
+-				if (id->callback && id->callback(id))
++				if (id->callback && !id->callback(id))
+ 					break;
+ 		if (id->matches[0].slot == DMI_NONE)
+ 			return -ENODEV;
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index 9339ccc..ad0e71c 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1516,7 +1516,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ {
+ 	struct pcnet32_private *lp;
+ 	int i, media;
+-	int fdx, mii, fset, dxsuflo;
++	int fdx, mii, fset, dxsuflo, sram;
+ 	int chip_version;
+ 	char *chipname;
+ 	struct net_device *dev;
+@@ -1553,7 +1553,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 	}
+ 
+ 	/* initialize variables */
+-	fdx = mii = fset = dxsuflo = 0;
++	fdx = mii = fset = dxsuflo = sram = 0;
+ 	chip_version = (chip_version >> 12) & 0xffff;
+ 
+ 	switch (chip_version) {
+@@ -1586,6 +1586,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 		chipname = "PCnet/FAST III 79C973";	/* PCI */
+ 		fdx = 1;
+ 		mii = 1;
++		sram = 1;
+ 		break;
+ 	case 0x2626:
+ 		chipname = "PCnet/Home 79C978";	/* PCI */
+@@ -1609,6 +1610,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 		chipname = "PCnet/FAST III 79C975";	/* PCI */
+ 		fdx = 1;
+ 		mii = 1;
++		sram = 1;
+ 		break;
+ 	case 0x2628:
+ 		chipname = "PCnet/PRO 79C976";
+@@ -1637,6 +1639,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 		dxsuflo = 1;
+ 	}
+ 
++	/*
++	 * The Am79C973/Am79C975 controllers come with 12K of SRAM
++	 * which we can use for the Tx/Rx buffers but most importantly,
++	 * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
++	 * Tx fifo underflows.
++	 */
++	if (sram) {
++		/*
++		 * The SRAM is being configured in two steps. First we
++		 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
++		 * to the datasheet, each bit corresponds to a 512-byte
++		 * page so we can have at most 24 pages. The SRAM_SIZE
++		 * holds the value of the upper 8 bits of the 16-bit SRAM size.
++		 * The low 8-bits start at 0x00 and end at 0xff. So the
++		 * address range is from 0x0000 up to 0x17ff. Therefore,
++		 * the SRAM_SIZE is set to 0x17. The next step is to set
++		 * the BCR26:SRAM_BND midway through so the Tx and Rx
++		 * buffers can share the SRAM equally.
++		 */
++		a->write_bcr(ioaddr, 25, 0x17);
++		a->write_bcr(ioaddr, 26, 0xc);
++		/* And finally enable the NOUFLO bit */
++		a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
++	}
++
+ 	dev = alloc_etherdev(sizeof(*lp));
+ 	if (!dev) {
+ 		ret = -ENOMEM;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index a041746..4a3b8b7 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -594,7 +594,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
+ 
+ 	ret = iwl_mvm_mac_ctxt_add(mvm, vif);
+ 	if (ret)
+-		goto out_remove_mac;
++		goto out_release;
+ 
+ 	iwl_mvm_power_disable(mvm, vif);
+ 
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index 48f20ff..bbff99d 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ 	struct device_node *p;
+ 	const __be32 *intspec, *tmp, *addr;
+ 	u32 intsize, intlen;
+-	int i, res = -EINVAL;
++	int i, res;
+ 
+ 	pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
+ 
+@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ 
+ 	/* Get size of interrupt specifier */
+ 	tmp = of_get_property(p, "#interrupt-cells", NULL);
+-	if (tmp == NULL)
++	if (tmp == NULL) {
++		res = -EINVAL;
+ 		goto out;
++	}
+ 	intsize = be32_to_cpu(*tmp);
+ 
+ 	pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
+ 
+ 	/* Check index */
+-	if ((index + 1) * intsize > intlen)
++	if ((index + 1) * intsize > intlen) {
++		res = -EINVAL;
+ 		goto out;
++	}
+ 
+ 	/* Copy intspec into irq structure */
+ 	intspec += index * intsize;
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index 34d56f7..86592dd 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -50,7 +50,9 @@ static void devm_phy_consume(struct device *dev, void *res)
+ 
+ static int devm_phy_match(struct device *dev, void *res, void *match_data)
+ {
+-	return res == match_data;
++	struct phy **phy = res;
++
++	return *phy == match_data;
+ }
+ 
+ static struct phy *phy_lookup(struct device *device, const char *port)
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 9d81f76..1817f3f 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -1515,7 +1515,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
+ 	/*
+ 	 * Finally register the new FC Nexus with TCM
+ 	 */
+-	__transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
++	transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index fbf3b22..d6563ec 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -846,13 +846,14 @@ void spi_finalize_current_message(struct spi_master *master)
+ 				"failed to unprepare message: %d\n", ret);
+ 		}
+ 	}
++
++	trace_spi_message_done(mesg);
++
+ 	master->cur_msg_prepared = false;
+ 
+ 	mesg->state = NULL;
+ 	if (mesg->complete)
+ 		mesg->complete(mesg->context);
+-
+-	trace_spi_message_done(mesg);
+ }
+ EXPORT_SYMBOL_GPL(spi_finalize_current_message);
+ 
+diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
+index edb1b27..dbd9d44 100644
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -936,6 +936,7 @@ bool RFbSetPower(
+ 		break;
+ 	case RATE_6M:
+ 	case RATE_9M:
++	case RATE_12M:
+ 	case RATE_18M:
+ 		byPwr = pDevice->abyOFDMPwrTbl[uCH];
+ 		if (pDevice->byRFType == RF_UW2452) {
+diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
+index 1e8f64b..2dc48d4 100644
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -752,6 +752,7 @@ int RFbSetPower(struct vnt_private *priv, u32 rate, u32 channel)
+ 		break;
+ 	case RATE_6M:
+ 	case RATE_9M:
++	case RATE_12M:
+ 	case RATE_18M:
+ 	case RATE_24M:
+ 	case RATE_36M:
+diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
+index e415af3..c67d379 100644
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -346,7 +346,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ 		ep = fc_seq_exch(seq);
+ 		if (ep) {
+ 			lport = ep->lp;
+-			if (lport && (ep->xid <= lport->lro_xid))
++			if (lport && (ep->xid <= lport->lro_xid)) {
+ 				/*
+ 				 * "ddp_done" trigger invalidation of HW
+ 				 * specific DDP context
+@@ -361,6 +361,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ 				 * identified using ep->xid)
+ 				 */
+ 				cmd->was_ddp_setup = 0;
++			}
+ 		}
+ 	}
+ }
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index 6e560d5..754fdf8 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -131,13 +131,16 @@ skip:
+ 	hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ 	hfs_bnode_dump(node);
+ 
+-	if (new_node) {
+-		/* update parent key if we inserted a key
+-		 * at the start of the first node
+-		 */
+-		if (!rec && new_node != node)
+-			hfs_brec_update_parent(fd);
++	/*
++	 * update parent key if we inserted a key
++	 * at the start of the node and it is not the new node
++	 */
++	if (!rec && new_node != node) {
++		hfs_bnode_read_key(node, fd->search_key, data_off + size);
++		hfs_brec_update_parent(fd);
++	}
+ 
++	if (new_node) {
+ 		hfs_bnode_put(fd->bnode);
+ 		if (!new_node->parent) {
+ 			hfs_btree_inc_height(tree);
+@@ -168,9 +171,6 @@ skip:
+ 		goto again;
+ 	}
+ 
+-	if (!rec)
+-		hfs_brec_update_parent(fd);
+-
+ 	return 0;
+ }
+ 
+@@ -370,6 +370,8 @@ again:
+ 	if (IS_ERR(parent))
+ 		return PTR_ERR(parent);
+ 	__hfs_brec_find(parent, fd, hfs_find_rec_by_key);
++	if (fd->record < 0)
++		return -ENOENT;
+ 	hfs_bnode_dump(parent);
+ 	rec = fd->record;
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 69cffb4..60146fe 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4232,6 +4232,13 @@ static void perf_pending_event(struct irq_work *entry)
+ {
+ 	struct perf_event *event = container_of(entry,
+ 			struct perf_event, pending);
++	int rctx;
++
++	rctx = perf_swevent_get_recursion_context();
++	/*
++	 * If we 'fail' here, that's OK, it means recursion is already disabled
++	 * and we won't recurse 'further'.
++	 */
+ 
+ 	if (event->pending_disable) {
+ 		event->pending_disable = 0;
+@@ -4242,6 +4249,9 @@ static void perf_pending_event(struct irq_work *entry)
+ 		event->pending_wakeup = 0;
+ 		perf_event_wakeup(event);
+ 	}
++
++	if (rctx >= 0)
++		perf_swevent_put_recursion_context(rctx);
+ }
+ 
+ /*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index bf7a1bb..e278c64 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -57,13 +57,24 @@ struct ieee80211_local;
+ #define IEEE80211_UNSET_POWER_LEVEL	INT_MIN
+ 
+ /*
+- * Some APs experience problems when working with U-APSD. Decrease the
+- * probability of that happening by using legacy mode for all ACs but VO.
+- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+- * setting, and always treats non-VO ACs as legacy.
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
+  */
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+-	IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+ 
+ #define IEEE80211_DEFAULT_MAX_SP_LEN		\
+ 	IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 815ca56..9abb445 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2107,6 +2107,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
++	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++		return RX_DROP_MONITOR;
++
+ 	/* frame is in RMC, don't forward */
+ 	if (ieee80211_is_data(hdr->frame_control) &&
+ 	    is_multicast_ether_addr(hdr->addr1) &&
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 18d73df..c260243 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4190,6 +4190,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
+ 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
+ 		return -EINVAL;
+ 
++	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
++	 * as userspace might just pass through the capabilities from the IEs
++	 * directly, rather than enforcing this restriction and returning an
++	 * error in this case.
++	 */
++	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
++		params.ht_capa = NULL;
++		params.vht_capa = NULL;
++	}
++
+ 	/* When you run into this, adjust the code below for the new flag */
+ 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+ 
+diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
+index f78b27a..23454e9 100644
+--- a/sound/soc/codecs/adav80x.c
++++ b/sound/soc/codecs/adav80x.c
+@@ -319,7 +319,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+-	unsigned int deemph = ucontrol->value.enumerated.item[0];
++	unsigned int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+@@ -335,7 +335,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = adav80x->deemph;
++	ucontrol->value.integer.value[0] = adav80x->deemph;
+ 	return 0;
+ };
+ 
+diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
+index 94cbe50..d718472 100644
+--- a/sound/soc/codecs/ak4641.c
++++ b/sound/soc/codecs/ak4641.c
+@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = ak4641->deemph;
++	ucontrol->value.integer.value[0] = ak4641->deemph;
+ 	return 0;
+ };
+ 
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index ce05fd9..a0ad41a 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -288,7 +288,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = cs4271->deemph;
++	ucontrol->value.integer.value[0] = cs4271->deemph;
+ 	return 0;
+ }
+ 
+@@ -298,7 +298,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+ 
+-	cs4271->deemph = ucontrol->value.enumerated.item[0];
++	cs4271->deemph = ucontrol->value.integer.value[0];
+ 	return cs4271_set_deemph(codec);
+ }
+ 
+diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
+index 73f9c36..651e2fe 100644
+--- a/sound/soc/codecs/pcm1681.c
++++ b/sound/soc/codecs/pcm1681.c
+@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = priv->deemph;
++	ucontrol->value.integer.value[0] = priv->deemph;
+ 
+ 	return 0;
+ }
+@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	priv->deemph = ucontrol->value.enumerated.item[0];
++	priv->deemph = ucontrol->value.integer.value[0];
+ 
+ 	return pcm1681_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 715589f..e93c36f 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1198,13 +1198,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ 		/* Enable VDDC charge pump */
+ 		ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+ 	} else if (vddio >= 3100 && vdda >= 3100) {
+-		/*
+-		 * if vddio and vddd > 3.1v,
+-		 * charge pump should be clean before set ana_pwr
+-		 */
+-		snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+-				SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
+-
++		ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+ 		/* VDDC use VDDIO rail */
+ 		lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+ 		lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
+index a895a5e..c6c6500 100644
+--- a/sound/soc/codecs/tas5086.c
++++ b/sound/soc/codecs/tas5086.c
+@@ -275,7 +275,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = priv->deemph;
++	ucontrol->value.integer.value[0] = priv->deemph;
+ 
+ 	return 0;
+ }
+@@ -286,7 +286,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	priv->deemph = ucontrol->value.enumerated.item[0];
++	priv->deemph = ucontrol->value.integer.value[0];
+ 
+ 	return tas5086_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index 8ae5027..1a9f457 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+ 
+-	ucontrol->value.enumerated.item[0] = wm2000->anc_active;
++	ucontrol->value.integer.value[0] = wm2000->anc_active;
+ 
+ 	return 0;
+ }
+@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+-	int anc_active = ucontrol->value.enumerated.item[0];
++	int anc_active = ucontrol->value.integer.value[0];
+ 	int ret;
+ 
+ 	if (anc_active > 1)
+@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+ 
+-	ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
++	ucontrol->value.integer.value[0] = wm2000->spk_ena;
+ 
+ 	return 0;
+ }
+@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+-	int val = ucontrol->value.enumerated.item[0];
++	int val = ucontrol->value.integer.value[0];
+ 	int ret;
+ 
+ 	if (val > 1)
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index 0297203..e593722 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -122,7 +122,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8731->deemph;
++	ucontrol->value.integer.value[0] = wm8731->deemph;
+ 
+ 	return 0;
+ }
+@@ -132,7 +132,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 	int ret = 0;
+ 
+ 	if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index eebcb1d..ae7d76e 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8903->deemph;
++	ucontrol->value.integer.value[0] = wm8903->deemph;
+ 
+ 	return 0;
+ }
+@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 	int ret = 0;
+ 
+ 	if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 53bbfac..66cb9e9 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -523,7 +523,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8904->deemph;
++	ucontrol->value.integer.value[0] = wm8904->deemph;
+ 	return 0;
+ }
+ 
+@@ -532,7 +532,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 82c8ba9..1c1fc61 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8955->deemph;
++	ucontrol->value.integer.value[0] = wm8955->deemph;
+ 	return 0;
+ }
+ 
+@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 942ef84..2a0bfb8 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -181,7 +181,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8960->deemph;
++	ucontrol->value.integer.value[0] = wm8960->deemph;
+ 	return 0;
+ }
+ 
+@@ -190,7 +190,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ 	struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+diff --git a/sound/soc/jz4740/Makefile b/sound/soc/jz4740/Makefile
+index be873c1..d32c540 100644
+--- a/sound/soc/jz4740/Makefile
++++ b/sound/soc/jz4740/Makefile
+@@ -1,10 +1,8 @@
+ #
+ # Jz4740 Platform Support
+ #
+-snd-soc-jz4740-objs := jz4740-pcm.o
+ snd-soc-jz4740-i2s-objs := jz4740-i2s.o
+ 
+-obj-$(CONFIG_SND_JZ4740_SOC) += snd-soc-jz4740.o
+ obj-$(CONFIG_SND_JZ4740_SOC_I2S) += snd-soc-jz4740-i2s.o
+ 
+ # Jz4740 Machine Support
diff --git a/3.14.37/4420_grsecurity-3.1-3.14.37-201504051405.patch b/3.14.38/4420_grsecurity-3.1-3.14.38-201504142259.patch
index b383085..daa158d 100644
--- a/3.14.37/4420_grsecurity-3.1-3.14.37-201504051405.patch
+++ b/3.14.38/4420_grsecurity-3.1-3.14.38-201504142259.patch
@@ -295,7 +295,7 @@ index 5d91ba1..ef1d374 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index c24acc0..eab5b13 100644
+index f09e19d..bfca3b8 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -8621,7 +8621,7 @@ index 063b65d..7a26e9d 100644
  	ld	r4,_DAR(r1)
  	bl	.bad_page_fault
 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 38d5073..f00af8d 100644
+index 5193116..1fed658 100644
 --- a/arch/powerpc/kernel/exceptions-64s.S
 +++ b/arch/powerpc/kernel/exceptions-64s.S
 @@ -1584,10 +1584,10 @@ handle_page_fault:
@@ -45247,7 +45247,7 @@ index e9d33ad..dae9880d 100644
  	pmd->bl_info.value_type.inc = data_block_inc;
  	pmd->bl_info.value_type.dec = data_block_dec;
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 1582c3da..2a5ea0b 100644
+index e400591..a94ae6b 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
 @@ -187,9 +187,9 @@ struct mapped_device {
@@ -45282,7 +45282,7 @@ index 1582c3da..2a5ea0b 100644
  	wake_up(&md->eventq);
  }
  
-@@ -2740,18 +2740,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -2746,18 +2746,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
  
  uint32_t dm_next_uevent_seq(struct mapped_device *md)
  {
@@ -52001,10 +52001,10 @@ index eb81c98..e6716ae 100644
  		return blk_trace_startstop(sdp->device->request_queue, 1);
  	case BLKTRACESTOP:
 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index fbf3b22..f5c8b60 100644
+index d6563ec..a1c5da2 100644
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -1980,7 +1980,7 @@ int spi_bus_unlock(struct spi_master *master)
+@@ -1981,7 +1981,7 @@ int spi_bus_unlock(struct spi_master *master)
  EXPORT_SYMBOL_GPL(spi_bus_unlock);
  
  /* portable code must never pass more than 32 bytes */
@@ -52817,6 +52817,19 @@ index 67ba48b..24e602f 100644
  	pDevice->apdev->netdev_ops = &apdev_netdev_ops;
  
  	pDevice->apdev->type = ARPHRD_IEEE80211;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index e168a63..b61c555 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1165,7 +1165,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * traditional iSCSI block I/O.
+ 	 */
+ 	if (iscsit_allocate_iovecs(cmd) < 0) {
+-		return iscsit_add_reject_cmd(cmd,
++		return iscsit_reject_cmd(cmd,
+ 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 	}
+ 	immed_data = cmd->immediate_data;
 diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
 index 24884ca..26c8220 100644
 --- a/drivers/target/sbp/sbp_target.c
@@ -86077,7 +86090,7 @@ index a964f72..b475afb 100644
  }
  
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 218b058..7a1fb15 100644
+index 218b058..30088db 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -133,6 +133,7 @@ struct fs_struct;
@@ -86332,6 +86345,15 @@ index 218b058..7a1fb15 100644
  {
  	return tsk->pid;
  }
+@@ -1695,7 +1809,7 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+ }
+ 
+ 
+-static int pid_alive(const struct task_struct *p);
++static inline int pid_alive(const struct task_struct *p);
+ static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+ {
+ 	pid_t pid = 0;
 @@ -2015,6 +2129,25 @@ extern u64 sched_clock_cpu(int cpu);
  
  extern void sched_clock_init(void);
@@ -90281,7 +90303,7 @@ index 449518e..2658dd6 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 69cffb4..54dc2d9 100644
+index 60146fe..2e89117 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -159,8 +159,15 @@ static struct srcu_struct pmus_srcu;
@@ -90353,7 +90375,7 @@ index 69cffb4..54dc2d9 100644
  
  	arch_perf_update_userpage(userpg, now);
  
-@@ -4381,7 +4388,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -4391,7 +4398,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
  
  		/* Data. */
  		sp = perf_user_stack_pointer(regs);
@@ -90362,7 +90384,7 @@ index 69cffb4..54dc2d9 100644
  		dyn_size = dump_size - rem;
  
  		perf_output_skip(handle, rem);
-@@ -4472,11 +4479,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4482,11 +4489,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
  	values[n++] = perf_event_count(event);
  	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
  		values[n++] = enabled +
@@ -90376,7 +90398,7 @@ index 69cffb4..54dc2d9 100644
  	}
  	if (read_format & PERF_FORMAT_ID)
  		values[n++] = primary_event_id(event);
-@@ -6755,7 +6762,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -6765,7 +6772,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
  	event->parent		= parent_event;
  
  	event->ns		= get_pid_ns(task_active_pid_ns(current));
@@ -90385,7 +90407,7 @@ index 69cffb4..54dc2d9 100644
  
  	event->state		= PERF_EVENT_STATE_INACTIVE;
  
-@@ -7055,6 +7062,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -7065,6 +7072,11 @@ SYSCALL_DEFINE5(perf_event_open,
  	if (flags & ~PERF_FLAG_ALL)
  		return -EINVAL;
  
@@ -90397,7 +90419,7 @@ index 69cffb4..54dc2d9 100644
  	err = perf_copy_attr(attr_uptr, &attr);
  	if (err)
  		return err;
-@@ -7393,10 +7405,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -7403,10 +7415,10 @@ static void sync_child_event(struct perf_event *child_event,
  	/*
  	 * Add back the child's count to the parent's count:
  	 */
@@ -91320,7 +91342,7 @@ index 18ff0b9..40b0eab 100644
  
  	/* Don't allow clients that don't understand the native
 diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 6b375af..c1c119c 100644
+index 6b375af..d5d59d4 100644
 --- a/kernel/kmod.c
 +++ b/kernel/kmod.c
 @@ -75,7 +75,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -91459,9 +91481,9 @@ index 6b375af..c1c119c 100644
 +	*/
 +	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
 +	     strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
-+	     strncmp(sub_info->path, "/usr/libexec/", 13) &&
++	     strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
 +	     strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
++		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
 +		retval = -EPERM;
 +		goto fail;
 +	}
@@ -106300,7 +106322,7 @@ index 453e974..b3a43a5 100644
  		if (local->use_chanctx)
  			*chandef = local->monitor_chandef;
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index bf7a1bb..1619d8e 100644
+index e278c64..f6d3f3d 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -28,6 +28,7 @@
@@ -106311,7 +106333,7 @@ index bf7a1bb..1619d8e 100644
  #include "key.h"
  #include "sta_info.h"
  #include "debug.h"
-@@ -995,7 +996,7 @@ struct ieee80211_local {
+@@ -1006,7 +1007,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
@@ -107337,6 +107359,18 @@ index e5b65ac..f3b6fb7 100644
  
  	if (likely(*recent == gen))
  		return 0;
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 378c3a6..ba4382c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -193,6 +193,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ 	}
+ 
+ 	atomic_set(&conn->c_state, RDS_CONN_DOWN);
++	conn->c_send_gen = 0;
+ 	conn->c_reconnect_jiffies = 0;
+ 	INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker);
+ 	INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker);
 diff --git a/net/rds/ib.h b/net/rds/ib.h
 index 7280ab8..e04f4ea 100644
 --- a/net/rds/ib.h
@@ -107470,10 +107504,18 @@ index 4e37c1c..40084d8 100644
  		rds_rdma_free_op(op);
  	else
 diff --git a/net/rds/rds.h b/net/rds/rds.h
-index 48f8ffc..0ef3eec 100644
+index 48f8ffc..5c46cac 100644
 --- a/net/rds/rds.h
 +++ b/net/rds/rds.h
-@@ -449,7 +449,7 @@ struct rds_transport {
+@@ -110,6 +110,7 @@ struct rds_connection {
+ 	void			*c_transport_data;
+ 
+ 	atomic_t		c_state;
++	unsigned long		c_send_gen;
+ 	unsigned long		c_flags;
+ 	unsigned long		c_reconnect_jiffies;
+ 	struct delayed_work	c_send_w;
+@@ -449,7 +450,7 @@ struct rds_transport {
  	void (*sync_mr)(void *trans_private, int direction);
  	void (*free_mr)(void *trans_private, int invalidate);
  	void (*flush_mrs)(void);
@@ -107483,10 +107525,85 @@ index 48f8ffc..0ef3eec 100644
  struct rds_sock {
  	struct sock		rs_sk;
 diff --git a/net/rds/send.c b/net/rds/send.c
-index a82fb66..1ea9251 100644
+index a82fb66..54c5c19 100644
 --- a/net/rds/send.c
 +++ b/net/rds/send.c
-@@ -593,8 +593,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
+@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn)
+ 	struct scatterlist *sg;
+ 	int ret = 0;
+ 	LIST_HEAD(to_be_dropped);
++	int batch_count;
++	unsigned long send_gen = 0;
+ 
+ restart:
++	batch_count = 0;
+ 
+ 	/*
+ 	 * sendmsg calls here after having queued its message on the send
+@@ -157,6 +160,17 @@ restart:
+ 	}
+ 
+ 	/*
++	 * we record the send generation after doing the xmit acquire.
++	 * if someone else manages to jump in and do some work, we'll use
++	 * this to avoid a goto restart farther down.
++	 *
++	 * The acquire_in_xmit() check above ensures that only one
++	 * caller can increment c_send_gen at any time.
++	 */
++	conn->c_send_gen++;
++	send_gen = conn->c_send_gen;
++
++	/*
+ 	 * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+ 	 * we do the opposite to avoid races.
+ 	 */
+@@ -202,6 +216,16 @@ restart:
+ 		if (!rm) {
+ 			unsigned int len;
+ 
++			batch_count++;
++
++			/* we want to process as big a batch as we can, but
++			 * we also want to avoid softlockups.  If we've been
++			 * through a lot of messages, lets back off and see
++			 * if anyone else jumps in
++			 */
++			if (batch_count >= 1024)
++				goto over_batch;
++
+ 			spin_lock_irqsave(&conn->c_lock, flags);
+ 
+ 			if (!list_empty(&conn->c_send_queue)) {
+@@ -357,9 +381,9 @@ restart:
+ 		}
+ 	}
+ 
++over_batch:
+ 	if (conn->c_trans->xmit_complete)
+ 		conn->c_trans->xmit_complete(conn);
+-
+ 	release_in_xmit(conn);
+ 
+ 	/* Nuke any messages we decided not to retransmit. */
+@@ -380,10 +404,15 @@ restart:
+ 	 * If the transport cannot continue (i.e ret != 0), then it must
+ 	 * call us when more room is available, such as from the tx
+ 	 * completion handler.
++	 *
++	 * We have an extra generation check here so that if someone manages
++	 * to jump in after our release_in_xmit, we'll see that they have done
++	 * some work and we will skip our goto
+ 	 */
+ 	if (ret == 0) {
+ 		smp_mb();
+-		if (!list_empty(&conn->c_send_queue)) {
++		if (!list_empty(&conn->c_send_queue) &&
++		    send_gen == conn->c_send_gen) {
+ 			rds_stats_inc(s_send_lock_queue_raced);
+ 			goto restart;
+ 		}
+@@ -593,8 +622,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
  				sock_put(rds_rs_to_sk(rs));
  			}
  			rs = rm->m_rs;
@@ -107499,7 +107616,7 @@ index a82fb66..1ea9251 100644
  		spin_lock(&rs->rs_lock);
  
  		if (test_and_clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags)) {
-@@ -638,9 +641,6 @@ unlock_and_drop:
+@@ -638,9 +670,6 @@ unlock_and_drop:
   * queue. This means that in the TCP case, the message may not have been
   * assigned the m_ack_seq yet - but that's fine as long as tcp_is_acked
   * checks the RDS_MSG_HAS_ACK_SEQ bit.
@@ -107509,7 +107626,7 @@ index a82fb66..1ea9251 100644
   */
  void rds_send_drop_acked(struct rds_connection *conn, u64 ack,
  			 is_acked_func is_acked)
-@@ -711,6 +711,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
+@@ -711,6 +740,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
  		 */
  		if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
  			spin_unlock_irqrestore(&conn->c_lock, flags);
@@ -108774,7 +108891,7 @@ index 6424372..afd36e9 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 94404f1..5c1346e 100644
+index 94404f1..ac544a1 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -108855,12 +108972,33 @@ index 94404f1..5c1346e 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2373,8 +2399,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2371,10 +2397,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ 				seq_putc(seq, '@');
+ 				i++;
  			}
- 			for ( ; i < len; i++)
- 				seq_putc(seq, u->addr->name->sun_path[i]);
+-			for ( ; i < len; i++)
+-				seq_putc(seq, u->addr->name->sun_path[i]);
 -		}
 -		unix_state_unlock(s);
++			for ( ; i < len; i++) {
++				char c = u->addr->name->sun_path[i];
++				switch (c) {
++				case '\n':
++					seq_putc(seq, '\\');
++					seq_putc(seq, 'n');
++					break;
++				case '\t':
++					seq_putc(seq, '\\');
++					seq_putc(seq, 't');
++					break;
++				case '\\':
++					seq_putc(seq, '\\');
++					seq_putc(seq, '\\');
++					break;
++				default:
++					seq_putc(seq, c);
++				}
++			}
 +		} else if (peer)
 +			seq_printf(seq, " P%lu", sock_i_ino(peer));
 +
@@ -109406,14 +109544,14 @@ index 078fe1d..fbdb363 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..822fa9e
+index 0000000..eaa4fce
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
 @@ -0,0 +1,51 @@
 +#!/bin/sh
 +srctree=$(dirname "$0")
 +gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
 +#include "gcc-common.h"
 +#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2 CXX
@@ -111278,6 +111416,19 @@ index 9f05847..7933395 100644
  	rtnl_lock();
  	for_each_net(net)
  		rt_genid_bump_all(net);
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index d60c0ee..6c4cbd9 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ 		goto out;
+ 
+ 	/* No partial writes. */
+-	length = EINVAL;
++	length = -EINVAL;
+ 	if (*ppos != 0)
+ 		goto out;
+ 
 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
 index 14f52be..7352368 100644
 --- a/security/smack/smack_lsm.c
@@ -112451,10 +112602,10 @@ index 0000000..5452feea
 +}
 diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
 new file mode 100644
-index 0000000..54461af
+index 0000000..d44bd9f
 --- /dev/null
 +++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,210 @@
+@@ -0,0 +1,215 @@
 +/*
 + * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -112559,7 +112710,8 @@ index 0000000..54461af
 +#if BUILDING_GCC_VERSION >= 4008
 +		.optinfo_flags		= OPTGROUP_NONE,
 +#endif
-+#if BUILDING_GCC_VERSION >= 4009
++#if BUILDING_GCC_VERSION >= 5000
++#elif BUILDING_GCC_VERSION == 4009
 +		.has_gate		= false,
 +		.has_execute		= true,
 +#else
@@ -112585,7 +112737,11 @@ index 0000000..54461af
 +class colorize_rearm_pass : public simple_ipa_opt_pass {
 +public:
 +	colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
++#if BUILDING_GCC_VERSION >= 5000
++	virtual unsigned int execute(function *) { return execute_colorize_rearm(); }
++#else
 +	unsigned int execute() { return execute_colorize_rearm(); }
++#endif
 +};
 +}
 +
diff --git a/3.14.37/4425_grsec_remove_EI_PAX.patch b/3.14.38/4425_grsec_remove_EI_PAX.patch
index 86e242a..86e242a 100644
--- a/3.14.37/4425_grsec_remove_EI_PAX.patch
+++ b/3.14.38/4425_grsec_remove_EI_PAX.patch
diff --git a/3.14.37/4427_force_XATTR_PAX_tmpfs.patch b/3.14.38/4427_force_XATTR_PAX_tmpfs.patch
index 4c236cc..4c236cc 100644
--- a/3.14.37/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.14.38/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.14.37/4430_grsec-remove-localversion-grsec.patch b/3.14.38/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.14.37/4430_grsec-remove-localversion-grsec.patch
+++ b/3.14.38/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.14.37/4435_grsec-mute-warnings.patch b/3.14.38/4435_grsec-mute-warnings.patch
index 392cefb..392cefb 100644
--- a/3.14.37/4435_grsec-mute-warnings.patch
+++ b/3.14.38/4435_grsec-mute-warnings.patch
diff --git a/3.14.37/4440_grsec-remove-protected-paths.patch b/3.14.38/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.14.37/4440_grsec-remove-protected-paths.patch
+++ b/3.14.38/4440_grsec-remove-protected-paths.patch
diff --git a/3.14.37/4450_grsec-kconfig-default-gids.patch b/3.14.38/4450_grsec-kconfig-default-gids.patch
index 8c878fc..8c878fc 100644
--- a/3.14.37/4450_grsec-kconfig-default-gids.patch
+++ b/3.14.38/4450_grsec-kconfig-default-gids.patch
diff --git a/3.14.37/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.38/4465_selinux-avc_audit-log-curr_ip.patch
index bba906e..bba906e 100644
--- a/3.14.37/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.14.38/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.14.37/4470_disable-compat_vdso.patch b/3.14.38/4470_disable-compat_vdso.patch
index 3b3953b..3b3953b 100644
--- a/3.14.37/4470_disable-compat_vdso.patch
+++ b/3.14.38/4470_disable-compat_vdso.patch
diff --git a/3.14.37/4475_emutramp_default_on.patch b/3.14.38/4475_emutramp_default_on.patch
index ad4967a..ad4967a 100644
--- a/3.14.37/4475_emutramp_default_on.patch
+++ b/3.14.38/4475_emutramp_default_on.patch
diff --git a/3.19.3/1002_linux-3.19.3.patch b/3.19.3/1002_linux-3.19.3.patch
deleted file mode 100644
index a17587c..0000000
--- a/3.19.3/1002_linux-3.19.3.patch
+++ /dev/null
@@ -1,4081 +0,0 @@
-diff --git a/Makefile b/Makefile
-index e49665a..713bf26 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 19
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Diseased Newt
- 
-diff --git a/arch/arm/boot/dts/am33xx-clocks.dtsi b/arch/arm/boot/dts/am33xx-clocks.dtsi
-index 712edce..071b56a 100644
---- a/arch/arm/boot/dts/am33xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/am33xx-clocks.dtsi
-@@ -99,7 +99,7 @@
- 	ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <0>;
- 		reg = <0x0664>;
- 	};
-@@ -107,7 +107,7 @@
- 	ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <1>;
- 		reg = <0x0664>;
- 	};
-@@ -115,7 +115,7 @@
- 	ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <2>;
- 		reg = <0x0664>;
- 	};
-diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
-index c7dc9da..cfb4968 100644
---- a/arch/arm/boot/dts/am43xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
-@@ -107,7 +107,7 @@
- 	ehrpwm0_tbclk: ehrpwm0_tbclk {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <0>;
- 		reg = <0x0664>;
- 	};
-@@ -115,7 +115,7 @@
- 	ehrpwm1_tbclk: ehrpwm1_tbclk {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <1>;
- 		reg = <0x0664>;
- 	};
-@@ -123,7 +123,7 @@
- 	ehrpwm2_tbclk: ehrpwm2_tbclk {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <2>;
- 		reg = <0x0664>;
- 	};
-@@ -131,7 +131,7 @@
- 	ehrpwm3_tbclk: ehrpwm3_tbclk {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <4>;
- 		reg = <0x0664>;
- 	};
-@@ -139,7 +139,7 @@
- 	ehrpwm4_tbclk: ehrpwm4_tbclk {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <5>;
- 		reg = <0x0664>;
- 	};
-@@ -147,7 +147,7 @@
- 	ehrpwm5_tbclk: ehrpwm5_tbclk {
- 		#clock-cells = <0>;
- 		compatible = "ti,gate-clock";
--		clocks = <&dpll_per_m2_ck>;
-+		clocks = <&l4ls_gclk>;
- 		ti,bit-shift = <6>;
- 		reg = <0x0664>;
- 	};
-diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-index 4bdcbd6..99b09a4 100644
---- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-@@ -243,10 +243,18 @@
- 		ti,invert-autoidle-bit;
- 	};
- 
-+	dpll_core_byp_mux: dpll_core_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x012c>;
-+	};
-+
- 	dpll_core_ck: dpll_core_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-core-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
- 		reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
- 	};
- 
-@@ -309,10 +317,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_dsp_byp_mux: dpll_dsp_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x0240>;
-+	};
-+
- 	dpll_dsp_ck: dpll_dsp_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
- 		reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
- 	};
- 
-@@ -335,10 +351,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_iva_byp_mux: dpll_iva_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x01ac>;
-+	};
-+
- 	dpll_iva_ck: dpll_iva_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
- 		reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
- 	};
- 
-@@ -361,10 +385,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_gpu_byp_mux: dpll_gpu_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x02e4>;
-+	};
-+
- 	dpll_gpu_ck: dpll_gpu_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
- 		reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
- 	};
- 
-@@ -398,10 +430,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_ddr_byp_mux: dpll_ddr_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x021c>;
-+	};
-+
- 	dpll_ddr_ck: dpll_ddr_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
- 		reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
- 	};
- 
-@@ -416,10 +456,18 @@
- 		ti,invert-autoidle-bit;
- 	};
- 
-+	dpll_gmac_byp_mux: dpll_gmac_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		ti,bit-shift = <23>;
-+		reg = <0x02b4>;
-+	};
-+
- 	dpll_gmac_ck: dpll_gmac_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+		clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
- 		reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
- 	};
- 
-@@ -482,10 +530,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_eve_byp_mux: dpll_eve_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x0290>;
-+	};
-+
- 	dpll_eve_ck: dpll_eve_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
- 		reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
- 	};
- 
-@@ -1249,10 +1305,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_per_byp_mux: dpll_per_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x014c>;
-+	};
-+
- 	dpll_per_ck: dpll_per_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-clock";
--		clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
- 		reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
- 	};
- 
-@@ -1275,10 +1339,18 @@
- 		clock-div = <1>;
- 	};
- 
-+	dpll_usb_byp_mux: dpll_usb_byp_mux {
-+		#clock-cells = <0>;
-+		compatible = "ti,mux-clock";
-+		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+		ti,bit-shift = <23>;
-+		reg = <0x018c>;
-+	};
-+
- 	dpll_usb_ck: dpll_usb_ck {
- 		#clock-cells = <0>;
- 		compatible = "ti,omap4-dpll-j-type-clock";
--		clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+		clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
- 		reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
- 	};
- 
-diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-index f1cd214..a626e6d 100644
---- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-@@ -35,6 +35,7 @@
- 			regulator-max-microvolt = <5000000>;
- 			gpio = <&gpio3 22 0>;
- 			enable-active-high;
-+			vin-supply = <&swbst_reg>;
- 		};
- 
- 		reg_usb_h1_vbus: regulator@1 {
-@@ -45,6 +46,7 @@
- 			regulator-max-microvolt = <5000000>;
- 			gpio = <&gpio1 29 0>;
- 			enable-active-high;
-+			vin-supply = <&swbst_reg>;
- 		};
- 
- 		reg_audio: regulator@2 {
-diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
-index fda4932..945887d 100644
---- a/arch/arm/boot/dts/imx6sl-evk.dts
-+++ b/arch/arm/boot/dts/imx6sl-evk.dts
-@@ -52,6 +52,7 @@
- 			regulator-max-microvolt = <5000000>;
- 			gpio = <&gpio4 0 0>;
- 			enable-active-high;
-+			vin-supply = <&swbst_reg>;
- 		};
- 
- 		reg_usb_otg2_vbus: regulator@1 {
-@@ -62,6 +63,7 @@
- 			regulator-max-microvolt = <5000000>;
- 			gpio = <&gpio4 2 0>;
- 			enable-active-high;
-+			vin-supply = <&swbst_reg>;
- 		};
- 
- 		reg_aud3v: regulator@2 {
-diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
-index 71e5fc7..1d1800f 100644
---- a/arch/arm/crypto/aesbs-core.S_shipped
-+++ b/arch/arm/crypto/aesbs-core.S_shipped
-@@ -58,14 +58,18 @@
- # define VFP_ABI_FRAME	0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__	7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
- 
- #ifdef __thumb__
- # define adrl adr
- #endif
- 
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch	armv7-a
-+.fpu	neon
-+
- .text
- .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -74,8 +78,6 @@
- .code   32
- #endif
- 
--.fpu	neon
--
- .type	_bsaes_decrypt8,%function
- .align	4
- _bsaes_decrypt8:
-@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
- 	vld1.8	{q8}, [r0]			@ initial tweak
- 	adr	r2, .Lxts_magic
- 
-+#ifndef	XTS_CHAIN_TWEAK
- 	tst	r9, #0xf			@ if not multiple of 16
- 	it	ne				@ Thumb2 thing, sanity check in ARM
- 	subne	r9, #0x10			@ subtract another 16 bytes
-+#endif
- 	subs	r9, #0x80
- 
- 	blo	.Lxts_dec_short
-diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
-index be068db..a4d3856 100644
---- a/arch/arm/crypto/bsaes-armv7.pl
-+++ b/arch/arm/crypto/bsaes-armv7.pl
-@@ -701,14 +701,18 @@ $code.=<<___;
- # define VFP_ABI_FRAME	0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__	7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
- 
- #ifdef __thumb__
- # define adrl adr
- #endif
- 
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch	armv7-a
-+.fpu	neon
-+
- .text
- .syntax	unified 	@ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -717,8 +721,6 @@ $code.=<<___;
- .code   32
- #endif
- 
--.fpu	neon
--
- .type	_bsaes_decrypt8,%function
- .align	4
- _bsaes_decrypt8:
-@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
- 	vld1.8	{@XMM[8]}, [r0]			@ initial tweak
- 	adr	$magic, .Lxts_magic
- 
-+#ifndef	XTS_CHAIN_TWEAK
- 	tst	$len, #0xf			@ if not multiple of 16
- 	it	ne				@ Thumb2 thing, sanity check in ARM
- 	subne	$len, #0x10			@ subtract another 16 bytes
-+#endif
- 	subs	$len, #0x80
- 
- 	blo	.Lxts_dec_short
-diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
-index d2c8996..86c0aa8 100644
---- a/arch/arm/mach-at91/pm.h
-+++ b/arch/arm/mach-at91/pm.h
-@@ -44,7 +44,7 @@ static inline void at91rm9200_standby(void)
- 		"    mcr    p15, 0, %0, c7, c0, 4\n\t"
- 		"    str    %5, [%1, %2]"
- 		:
--		: "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
-+		: "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
- 		  "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
- 		  "r" (lpr));
- }
-diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
-index 7a1ebfe..0abb7df 100644
---- a/arch/arm/mach-exynos/platsmp.c
-+++ b/arch/arm/mach-exynos/platsmp.c
-@@ -126,8 +126,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
-  */
- void exynos_cpu_power_down(int cpu)
- {
--	if (cpu == 0 && (of_machine_is_compatible("samsung,exynos5420") ||
--		of_machine_is_compatible("samsung,exynos5800"))) {
-+	if (cpu == 0 && (soc_is_exynos5420() || soc_is_exynos5800())) {
- 		/*
- 		 * Bypass power down for CPU0 during suspend. Check for
- 		 * the SYS_PWR_REG value to decide if we are suspending
-diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
-index c028fe3..53d9c35 100644
---- a/arch/arm64/include/asm/tlb.h
-+++ b/arch/arm64/include/asm/tlb.h
-@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_gather *tlb)
- static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
- 				  unsigned long addr)
- {
-+	__flush_tlb_pgtable(tlb->mm, addr);
- 	pgtable_page_dtor(pte);
- 	tlb_remove_entry(tlb, pte);
- }
-@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
- static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
- 				  unsigned long addr)
- {
-+	__flush_tlb_pgtable(tlb->mm, addr);
- 	tlb_remove_entry(tlb, virt_to_page(pmdp));
- }
- #endif
-@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
- static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
- 				  unsigned long addr)
- {
-+	__flush_tlb_pgtable(tlb->mm, addr);
- 	tlb_remove_entry(tlb, virt_to_page(pudp));
- }
- #endif
-diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
-index 73f0ce5..8b8d8cb 100644
---- a/arch/arm64/include/asm/tlbflush.h
-+++ b/arch/arm64/include/asm/tlbflush.h
-@@ -149,6 +149,19 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end
- }
- 
- /*
-+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
-+ * table levels (pgd/pud/pmd).
-+ */
-+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
-+				       unsigned long uaddr)
-+{
-+	unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
-+
-+	dsb(ishst);
-+	asm("tlbi	vae1is, %0" : : "r" (addr));
-+	dsb(ish);
-+}
-+/*
-  * On AArch64, the cache coherency is handled via the set_pte_at() function.
-  */
- static inline void update_mmu_cache(struct vm_area_struct *vma,
-diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
-index d920942..df34a70 100644
---- a/arch/arm64/mm/dma-mapping.c
-+++ b/arch/arm64/mm/dma-mapping.c
-@@ -51,7 +51,7 @@ static int __init early_coherent_pool(char *p)
- }
- early_param("coherent_pool", early_coherent_pool);
- 
--static void *__alloc_from_pool(size_t size, struct page **ret_page)
-+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
- {
- 	unsigned long val;
- 	void *ptr = NULL;
-@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
- 
- 		*ret_page = phys_to_page(phys);
- 		ptr = (void *)val;
-+		if (flags & __GFP_ZERO)
-+			memset(ptr, 0, size);
- 	}
- 
- 	return ptr;
-@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
- 		flags |= GFP_DMA;
- 	if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
- 		struct page *page;
-+		void *addr;
- 
- 		size = PAGE_ALIGN(size);
- 		page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
-@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
- 			return NULL;
- 
- 		*dma_handle = phys_to_dma(dev, page_to_phys(page));
--		return page_address(page);
-+		addr = page_address(page);
-+		if (flags & __GFP_ZERO)
-+			memset(addr, 0, size);
-+		return addr;
- 	} else {
- 		return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
- 	}
-@@ -145,7 +151,7 @@ static void *__dma_alloc_noncoherent(struct device *dev, size_t size,
- 
- 	if (!(flags & __GFP_WAIT)) {
- 		struct page *page = NULL;
--		void *addr = __alloc_from_pool(size, &page);
-+		void *addr = __alloc_from_pool(size, &page, flags);
- 
- 		if (addr)
- 			*dma_handle = phys_to_dma(dev, page_to_phys(page));
-diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
-index 9cfa370..f1ea597 100644
---- a/arch/powerpc/include/asm/iommu.h
-+++ b/arch/powerpc/include/asm/iommu.h
-@@ -113,6 +113,7 @@ extern void iommu_register_group(struct iommu_table *tbl,
- 				 int pci_domain_number, unsigned long pe_num);
- extern int iommu_add_device(struct device *dev);
- extern void iommu_del_device(struct device *dev);
-+extern int __init tce_iommu_bus_notifier_init(void);
- #else
- static inline void iommu_register_group(struct iommu_table *tbl,
- 					int pci_domain_number,
-@@ -128,6 +129,11 @@ static inline int iommu_add_device(struct device *dev)
- static inline void iommu_del_device(struct device *dev)
- {
- }
-+
-+static inline int __init tce_iommu_bus_notifier_init(void)
-+{
-+        return 0;
-+}
- #endif /* !CONFIG_IOMMU_API */
- 
- static inline void set_iommu_table_base_and_group(struct device *dev,
-diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
-index 5d3968c..b054f33 100644
---- a/arch/powerpc/kernel/iommu.c
-+++ b/arch/powerpc/kernel/iommu.c
-@@ -1175,4 +1175,30 @@ void iommu_del_device(struct device *dev)
- }
- EXPORT_SYMBOL_GPL(iommu_del_device);
- 
-+static int tce_iommu_bus_notifier(struct notifier_block *nb,
-+                unsigned long action, void *data)
-+{
-+        struct device *dev = data;
-+
-+        switch (action) {
-+        case BUS_NOTIFY_ADD_DEVICE:
-+                return iommu_add_device(dev);
-+        case BUS_NOTIFY_DEL_DEVICE:
-+                if (dev->iommu_group)
-+                        iommu_del_device(dev);
-+                return 0;
-+        default:
-+                return 0;
-+        }
-+}
-+
-+static struct notifier_block tce_iommu_bus_nb = {
-+        .notifier_call = tce_iommu_bus_notifier,
-+};
-+
-+int __init tce_iommu_bus_notifier_init(void)
-+{
-+        bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
-+        return 0;
-+}
- #endif /* CONFIG_IOMMU_API */
-diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
-index 8b2d2dc..c68cc9d 100644
---- a/arch/powerpc/kernel/smp.c
-+++ b/arch/powerpc/kernel/smp.c
-@@ -555,8 +555,8 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
- 	if (smp_ops->give_timebase)
- 		smp_ops->give_timebase();
- 
--	/* Wait until cpu puts itself in the online map */
--	while (!cpu_online(cpu))
-+	/* Wait until cpu puts itself in the online & active maps */
-+	while (!cpu_online(cpu) || !cpu_active(cpu))
- 		cpu_relax();
- 
- 	return 0;
-diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
-index 4945e87..3948b8a 100644
---- a/arch/powerpc/platforms/powernv/pci.c
-+++ b/arch/powerpc/platforms/powernv/pci.c
-@@ -866,30 +866,4 @@ void __init pnv_pci_init(void)
- #endif
- }
- 
--static int tce_iommu_bus_notifier(struct notifier_block *nb,
--		unsigned long action, void *data)
--{
--	struct device *dev = data;
--
--	switch (action) {
--	case BUS_NOTIFY_ADD_DEVICE:
--		return iommu_add_device(dev);
--	case BUS_NOTIFY_DEL_DEVICE:
--		if (dev->iommu_group)
--			iommu_del_device(dev);
--		return 0;
--	default:
--		return 0;
--	}
--}
--
--static struct notifier_block tce_iommu_bus_nb = {
--	.notifier_call = tce_iommu_bus_notifier,
--};
--
--static int __init tce_iommu_bus_notifier_init(void)
--{
--	bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
--	return 0;
--}
- machine_subsys_initcall_sync(powernv, tce_iommu_bus_notifier_init);
-diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
-index 1d3d52d..7803a19 100644
---- a/arch/powerpc/platforms/pseries/iommu.c
-+++ b/arch/powerpc/platforms/pseries/iommu.c
-@@ -1340,3 +1340,5 @@ static int __init disable_multitce(char *str)
- }
- 
- __setup("multitce=", disable_multitce);
-+
-+machine_subsys_initcall_sync(pseries, tce_iommu_bus_notifier_init);
-diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
-index 9af01dc..e3bab3a 100644
---- a/arch/s390/kvm/kvm-s390.c
-+++ b/arch/s390/kvm/kvm-s390.c
-@@ -159,7 +159,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
- 	case KVM_CAP_ONE_REG:
- 	case KVM_CAP_ENABLE_CAP:
- 	case KVM_CAP_S390_CSS_SUPPORT:
--	case KVM_CAP_IRQFD:
- 	case KVM_CAP_IOEVENTFD:
- 	case KVM_CAP_DEVICE_CTRL:
- 	case KVM_CAP_ENABLE_CAP_VM:
-diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
-index 62c5ea6..ec86d4f 100644
---- a/arch/s390/pci/pci_mmio.c
-+++ b/arch/s390/pci/pci_mmio.c
-@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
- 	if (copy_from_user(buf, user_buffer, length))
- 		goto out;
- 
--	memcpy_toio(io_addr, buf, length);
--	ret = 0;
-+	ret = zpci_memcpy_toio(io_addr, buf, length);
- out:
- 	if (buf != local_buf)
- 		kfree(buf);
-@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
- 		goto out;
- 	io_addr = (void *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
- 
--	ret = -EFAULT;
--	if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
-+	if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
-+		ret = -EFAULT;
- 		goto out;
--
--	memcpy_fromio(buf, io_addr, length);
--
--	if (copy_to_user(user_buffer, buf, length))
-+	}
-+	ret = zpci_memcpy_fromio(buf, io_addr, length);
-+	if (ret)
- 		goto out;
-+	if (copy_to_user(user_buffer, buf, length))
-+		ret = -EFAULT;
- 
--	ret = 0;
- out:
- 	if (buf != local_buf)
- 		kfree(buf);
-diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
-index 46a5e45..af53c25 100644
---- a/arch/sparc/kernel/perf_event.c
-+++ b/arch/sparc/kernel/perf_event.c
-@@ -960,6 +960,8 @@ out:
- 	cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
- }
- 
-+static void sparc_pmu_start(struct perf_event *event, int flags);
-+
- /* On this PMU each PIC has it's own PCR control register.  */
- static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- {
-@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- 		struct perf_event *cp = cpuc->event[i];
- 		struct hw_perf_event *hwc = &cp->hw;
- 		int idx = hwc->idx;
--		u64 enc;
- 
- 		if (cpuc->current_idx[i] != PIC_NO_INDEX)
- 			continue;
- 
--		sparc_perf_event_set_period(cp, hwc, idx);
- 		cpuc->current_idx[i] = idx;
- 
--		enc = perf_event_get_enc(cpuc->events[i]);
--		cpuc->pcr[idx] &= ~mask_for_index(idx);
--		if (hwc->state & PERF_HES_STOPPED)
--			cpuc->pcr[idx] |= nop_for_index(idx);
--		else
--			cpuc->pcr[idx] |= event_encoding(enc, idx);
-+		sparc_pmu_start(cp, PERF_EF_RELOAD);
- 	}
- out:
- 	for (i = 0; i < cpuc->n_events; i++) {
-@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- 	int i;
- 
- 	local_irq_save(flags);
--	perf_pmu_disable(event->pmu);
- 
- 	for (i = 0; i < cpuc->n_events; i++) {
- 		if (event == cpuc->event[i]) {
-@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- 		}
- 	}
- 
--	perf_pmu_enable(event->pmu);
- 	local_irq_restore(flags);
- }
- 
-@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
- 	unsigned long flags;
- 
- 	local_irq_save(flags);
--	perf_pmu_disable(event->pmu);
- 
- 	n0 = cpuc->n_events;
- 	if (n0 >= sparc_pmu->max_hw_events)
-@@ -1394,7 +1386,6 @@ nocheck:
- 
- 	ret = 0;
- out:
--	perf_pmu_enable(event->pmu);
- 	local_irq_restore(flags);
- 	return ret;
- }
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index 0be7bf9..46a5964 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -287,6 +287,8 @@ void arch_trigger_all_cpu_backtrace(bool include_self)
- 			printk("             TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
- 			       gp->tpc, gp->o7, gp->i7, gp->rpc);
- 		}
-+
-+		touch_nmi_watchdog();
- 	}
- 
- 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-@@ -362,6 +364,8 @@ static void pmu_snapshot_all_cpus(void)
- 		       (cpu == this_cpu ? '*' : ' '), cpu,
- 		       pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
- 		       pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
-+
-+		touch_nmi_watchdog();
- 	}
- 
- 	memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index c85403d..30e7ddb 100644
---- a/arch/sparc/kernel/sys_sparc_64.c
-+++ b/arch/sparc/kernel/sys_sparc_64.c
-@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
- 	long err;
- 
- 	/* No need for backward compatibility. We can start fresh... */
--	if (call <= SEMCTL) {
-+	if (call <= SEMTIMEDOP) {
- 		switch (call) {
- 		case SEMOP:
- 			err = sys_semtimedop(first, ptr,
-diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
-index b7f6334..857ad4f 100644
---- a/arch/sparc/lib/memmove.S
-+++ b/arch/sparc/lib/memmove.S
-@@ -8,9 +8,11 @@
- 
- 	.text
- ENTRY(memmove) /* o0=dst o1=src o2=len */
--	mov		%o0, %g1
-+	brz,pn		%o2, 99f
-+	 mov		%o0, %g1
-+
- 	cmp		%o0, %o1
--	bleu,pt		%xcc, memcpy
-+	bleu,pt		%xcc, 2f
- 	 add		%o1, %o2, %g7
- 	cmp		%g7, %o0
- 	bleu,pt		%xcc, memcpy
-@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
- 	stb		%g7, [%o0]
- 	bne,pt		%icc, 1b
- 	 sub		%o0, 1, %o0
--
-+99:
- 	retl
- 	 mov		%g1, %o0
-+
-+	/* We can't just call memcpy for these memmove cases.  On some
-+	 * chips the memcpy uses cache initializing stores and when dst
-+	 * and src are close enough, those can clobber the source data
-+	 * before we've loaded it in.
-+	 */
-+2:	or		%o0, %o1, %g7
-+	or		%o2, %g7, %g7
-+	andcc		%g7, 0x7, %g0
-+	bne,pn		%xcc, 4f
-+	 nop
-+
-+3:	ldx		[%o1], %g7
-+	add		%o1, 8, %o1
-+	subcc		%o2, 8, %o2
-+	add		%o0, 8, %o0
-+	bne,pt		%icc, 3b
-+	 stx		%g7, [%o0 - 0x8]
-+	ba,a,pt		%xcc, 99b
-+
-+4:	ldub		[%o1], %g7
-+	add		%o1, 1, %o1
-+	subcc		%o2, 1, %o2
-+	add		%o0, 1, %o0
-+	bne,pt		%icc, 4b
-+	 stb		%g7, [%o0 - 0x1]
-+	ba,a,pt		%xcc, 99b
- ENDPROC(memmove)
-diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
-index ae855f4..95ad7ad 100644
---- a/arch/x86/crypto/aesni-intel_glue.c
-+++ b/arch/x86/crypto/aesni-intel_glue.c
-@@ -1133,7 +1133,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- 		src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
- 		if (!src)
- 			return -ENOMEM;
--		assoc = (src + req->cryptlen + auth_tag_len);
-+		assoc = (src + req->cryptlen);
- 		scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
- 		scatterwalk_map_and_copy(assoc, req->assoc, 0,
- 			req->assoclen, 0);
-@@ -1158,7 +1158,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- 		scatterwalk_done(&src_sg_walk, 0, 0);
- 		scatterwalk_done(&assoc_sg_walk, 0, 0);
- 	} else {
--		scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
-+		scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
- 		kfree(src);
- 	}
- 	return retval;
-diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
-index e97622f..f895358 100644
---- a/arch/x86/include/asm/fpu-internal.h
-+++ b/arch/x86/include/asm/fpu-internal.h
-@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_struct *tsk)
- 	preempt_disable();
- 	tsk->thread.fpu_counter = 0;
- 	__drop_fpu(tsk);
--	clear_used_math();
-+	clear_stopped_child_used_math(tsk);
- 	preempt_enable();
- }
- 
-diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
-index c2fd21f..017149c 100644
---- a/arch/x86/kernel/apic/apic_numachip.c
-+++ b/arch/x86/kernel/apic/apic_numachip.c
-@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
- static unsigned int get_apic_id(unsigned long x)
- {
- 	unsigned long value;
--	unsigned int id;
-+	unsigned int id = (x >> 24) & 0xff;
- 
--	rdmsrl(MSR_FAM10H_NODE_ID, value);
--	id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
-+	if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
-+		rdmsrl(MSR_FAM10H_NODE_ID, value);
-+		id |= (value << 2) & 0xff00;
-+	}
- 
- 	return id;
- }
-@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
- 
- static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
- {
--	if (c->phys_proc_id != node) {
--		c->phys_proc_id = node;
--		per_cpu(cpu_llc_id, smp_processor_id()) = node;
-+	u64 val;
-+	u32 nodes = 1;
-+
-+	this_cpu_write(cpu_llc_id, node);
-+
-+	/* Account for nodes per socket in multi-core-module processors */
-+	if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
-+		rdmsrl(MSR_FAM10H_NODE_ID, val);
-+		nodes = ((val >> 3) & 7) + 1;
- 	}
-+
-+	c->phys_proc_id = node / nodes;
- }
- 
- static int __init numachip_system_init(void)
-diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index 88900e2..89f4e64 100644
---- a/arch/x86/kernel/traps.c
-+++ b/arch/x86/kernel/traps.c
-@@ -300,7 +300,7 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
- 		goto exit;
- 	conditional_sti(regs);
- 
--	if (!user_mode(regs))
-+	if (!user_mode_vm(regs))
- 		die("bounds", regs, error_code);
- 
- 	if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
-@@ -566,7 +566,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
- 	 * then it's very likely the result of an icebp/int01 trap.
- 	 * User wants a sigtrap for that.
- 	 */
--	if (!dr6 && user_mode(regs))
-+	if (!dr6 && user_mode_vm(regs))
- 		user_icebp = 1;
- 
- 	/* Catch kmemcheck conditions first of all! */
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index 0de1fae..8be1e17 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -378,7 +378,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- 		 * thread's fpu state, reconstruct fxstate from the fsave
- 		 * header. Sanitize the copied state etc.
- 		 */
--		struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
-+		struct fpu *fpu = &tsk->thread.fpu;
- 		struct user_i387_ia32_struct env;
- 		int err = 0;
- 
-@@ -392,14 +392,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- 		 */
- 		drop_fpu(tsk);
- 
--		if (__copy_from_user(xsave, buf_fx, state_size) ||
-+		if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
- 		    __copy_from_user(&env, buf, sizeof(env))) {
-+			fpu_finit(fpu);
- 			err = -1;
- 		} else {
- 			sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
--			set_used_math();
- 		}
- 
-+		set_used_math();
- 		if (use_eager_fpu()) {
- 			preempt_disable();
- 			math_state_restore();
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index c259814..64d76c1 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -2716,7 +2716,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
- 	case KVM_CAP_USER_NMI:
- 	case KVM_CAP_REINJECT_CONTROL:
- 	case KVM_CAP_IRQ_INJECT_STATUS:
--	case KVM_CAP_IRQFD:
- 	case KVM_CAP_IOEVENTFD:
- 	case KVM_CAP_IOEVENTFD_NO_LENGTH:
- 	case KVM_CAP_PIT2:
-diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
-index 31776d0..d7ec4e2 100644
---- a/arch/x86/vdso/vdso32/sigreturn.S
-+++ b/arch/x86/vdso/vdso32/sigreturn.S
-@@ -17,6 +17,7 @@
- 	.text
- 	.globl __kernel_sigreturn
- 	.type __kernel_sigreturn,@function
-+	nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
- 	ALIGN
- __kernel_sigreturn:
- .LSTART_sigreturn:
-diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
-index 376a0a9..cc45a9f 100644
---- a/arch/x86/xen/p2m.c
-+++ b/arch/x86/xen/p2m.c
-@@ -567,7 +567,7 @@ static bool alloc_p2m(unsigned long pfn)
- 		if (p2m_pfn == PFN_DOWN(__pa(p2m_missing)))
- 			p2m_init(p2m);
- 		else
--			p2m_init_identity(p2m, pfn);
-+			p2m_init_identity(p2m, pfn & ~(P2M_PER_PAGE - 1));
- 
- 		spin_lock_irqsave(&p2m_update_lock, flags);
- 
-diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
-index 7d1c540..3f187a5 100644
---- a/drivers/char/tpm/tpm_i2c_stm_st33.c
-+++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
-@@ -397,7 +397,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
-  */
- static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
- {
--	int size = 0, burstcnt, len;
-+	int size = 0, burstcnt, len, ret;
- 	struct i2c_client *client;
- 
- 	client = (struct i2c_client *)TPM_VPRIV(chip);
-@@ -406,13 +406,15 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
- 	       wait_for_stat(chip,
- 			     TPM_STS_DATA_AVAIL | TPM_STS_VALID,
- 			     chip->vendor.timeout_c,
--			     &chip->vendor.read_queue)
--	       == 0) {
-+			     &chip->vendor.read_queue) == 0) {
- 		burstcnt = get_burstcount(chip);
- 		if (burstcnt < 0)
- 			return burstcnt;
- 		len = min_t(int, burstcnt, count - size);
--		I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
-+		ret = I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
-+		if (ret < 0)
-+			return ret;
-+
- 		size += len;
- 	}
- 	return size;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index eff9d58..102463ba 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- {
- 	struct ibmvtpm_dev *ibmvtpm;
- 	struct ibmvtpm_crq crq;
--	u64 *word = (u64 *) &crq;
-+	__be64 *word = (__be64 *)&crq;
- 	int rc;
- 
- 	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
-@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- 	memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
- 	crq.valid = (u8)IBMVTPM_VALID_CMD;
- 	crq.msg = (u8)VTPM_TPM_COMMAND;
--	crq.len = (u16)count;
--	crq.data = ibmvtpm->rtce_dma_handle;
-+	crq.len = cpu_to_be16(count);
-+	crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
- 
--	rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
--			      cpu_to_be64(word[1]));
-+	rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-+			      be64_to_cpu(word[1]));
- 	if (rc != H_SUCCESS) {
- 		dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
- 		rc = 0;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
-index bd82a79..b2c231b 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.h
-+++ b/drivers/char/tpm/tpm_ibmvtpm.h
-@@ -22,9 +22,9 @@
- struct ibmvtpm_crq {
- 	u8 valid;
- 	u8 msg;
--	u16 len;
--	u32 data;
--	u64 reserved;
-+	__be16 len;
-+	__be32 data;
-+	__be64 reserved;
- } __attribute__((packed, aligned(8)));
- 
- struct ibmvtpm_crq_queue {
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index de03df9..c3aac4c 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -142,6 +142,7 @@ struct ports_device {
- 	 * notification
- 	 */
- 	struct work_struct control_work;
-+	struct work_struct config_work;
- 
- 	struct list_head ports;
- 
-@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
- 
- 	portdev = vdev->priv;
- 
-+	if (!use_multiport(portdev))
-+		schedule_work(&portdev->config_work);
-+}
-+
-+static void config_work_handler(struct work_struct *work)
-+{
-+	struct ports_device *portdev;
-+
-+	portdev = container_of(work, struct ports_device, control_work);
- 	if (!use_multiport(portdev)) {
-+		struct virtio_device *vdev;
- 		struct port *port;
- 		u16 rows, cols;
- 
-+		vdev = portdev->vdev;
- 		virtio_cread(vdev, struct virtio_console_config, cols, &cols);
- 		virtio_cread(vdev, struct virtio_console_config, rows, &rows);
- 
-@@ -2031,12 +2043,14 @@ static int virtcons_probe(struct virtio_device *vdev)
- 
- 	virtio_device_ready(portdev->vdev);
- 
-+	INIT_WORK(&portdev->config_work, &config_work_handler);
-+	INIT_WORK(&portdev->control_work, &control_work_handler);
-+
- 	if (multiport) {
- 		unsigned int nr_added_bufs;
- 
- 		spin_lock_init(&portdev->c_ivq_lock);
- 		spin_lock_init(&portdev->c_ovq_lock);
--		INIT_WORK(&portdev->control_work, &control_work_handler);
- 
- 		nr_added_bufs = fill_queue(portdev->c_ivq,
- 					   &portdev->c_ivq_lock);
-@@ -2104,6 +2118,8 @@ static void virtcons_remove(struct virtio_device *vdev)
- 	/* Finish up work that's lined up */
- 	if (use_multiport(portdev))
- 		cancel_work_sync(&portdev->control_work);
-+	else
-+		cancel_work_sync(&portdev->config_work);
- 
- 	list_for_each_entry_safe(port, port2, &portdev->ports, list)
- 		unplug_port(port);
-@@ -2155,6 +2171,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
- 
- 	virtqueue_disable_cb(portdev->c_ivq);
- 	cancel_work_sync(&portdev->control_work);
-+	cancel_work_sync(&portdev->config_work);
- 	/*
- 	 * Once more: if control_work_handler() was running, it would
- 	 * enable the cb as the last step.
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 5213da4..29168fa 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -42,9 +42,10 @@
- #include "drm_crtc_internal.h"
- #include "drm_internal.h"
- 
--static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
--							struct drm_mode_fb_cmd2 *r,
--							struct drm_file *file_priv);
-+static struct drm_framebuffer *
-+internal_framebuffer_create(struct drm_device *dev,
-+			    struct drm_mode_fb_cmd2 *r,
-+			    struct drm_file *file_priv);
- 
- /* Avoid boilerplate.  I'm tired of typing. */
- #define DRM_ENUM_NAME_FN(fnname, list)				\
-@@ -2817,13 +2818,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
- 	 */
- 	if (req->flags & DRM_MODE_CURSOR_BO) {
- 		if (req->handle) {
--			fb = add_framebuffer_internal(dev, &fbreq, file_priv);
-+			fb = internal_framebuffer_create(dev, &fbreq, file_priv);
- 			if (IS_ERR(fb)) {
- 				DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
- 				return PTR_ERR(fb);
- 			}
--
--			drm_framebuffer_reference(fb);
- 		} else {
- 			fb = NULL;
- 		}
-@@ -3175,9 +3174,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
- 	return 0;
- }
- 
--static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
--							struct drm_mode_fb_cmd2 *r,
--							struct drm_file *file_priv)
-+static struct drm_framebuffer *
-+internal_framebuffer_create(struct drm_device *dev,
-+			    struct drm_mode_fb_cmd2 *r,
-+			    struct drm_file *file_priv)
- {
- 	struct drm_mode_config *config = &dev->mode_config;
- 	struct drm_framebuffer *fb;
-@@ -3209,12 +3209,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
- 		return fb;
- 	}
- 
--	mutex_lock(&file_priv->fbs_lock);
--	r->fb_id = fb->base.id;
--	list_add(&fb->filp_head, &file_priv->fbs);
--	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
--	mutex_unlock(&file_priv->fbs_lock);
--
- 	return fb;
- }
- 
-@@ -3236,15 +3230,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
- int drm_mode_addfb2(struct drm_device *dev,
- 		    void *data, struct drm_file *file_priv)
- {
-+	struct drm_mode_fb_cmd2 *r = data;
- 	struct drm_framebuffer *fb;
- 
- 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
- 		return -EINVAL;
- 
--	fb = add_framebuffer_internal(dev, data, file_priv);
-+	fb = internal_framebuffer_create(dev, r, file_priv);
- 	if (IS_ERR(fb))
- 		return PTR_ERR(fb);
- 
-+	/* Transfer ownership to the filp for reaping on close */
-+
-+	DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-+	mutex_lock(&file_priv->fbs_lock);
-+	r->fb_id = fb->base.id;
-+	list_add(&fb->filp_head, &file_priv->fbs);
-+	mutex_unlock(&file_priv->fbs_lock);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 7643300..4e6405e 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -622,7 +622,7 @@ static int i915_drm_suspend(struct drm_device *dev)
- 	return 0;
- }
- 
--static int i915_drm_suspend_late(struct drm_device *drm_dev)
-+static int i915_drm_suspend_late(struct drm_device *drm_dev, bool hibernation)
- {
- 	struct drm_i915_private *dev_priv = drm_dev->dev_private;
- 	int ret;
-@@ -636,7 +636,17 @@ static int i915_drm_suspend_late(struct drm_device *drm_dev)
- 	}
- 
- 	pci_disable_device(drm_dev->pdev);
--	pci_set_power_state(drm_dev->pdev, PCI_D3hot);
-+	/*
-+	 * During hibernation on some GEN4 platforms the BIOS may try to access
-+	 * the device even though it's already in D3 and hang the machine. So
-+	 * leave the device in D0 on those platforms and hope the BIOS will
-+	 * power down the device properly. Platforms where this was seen:
-+	 * Lenovo Thinkpad X301, X61s
-+	 */
-+	if (!(hibernation &&
-+	      drm_dev->pdev->subsystem_vendor == PCI_VENDOR_ID_LENOVO &&
-+	      INTEL_INFO(dev_priv)->gen == 4))
-+		pci_set_power_state(drm_dev->pdev, PCI_D3hot);
- 
- 	return 0;
- }
-@@ -662,7 +672,7 @@ int i915_suspend_legacy(struct drm_device *dev, pm_message_t state)
- 	if (error)
- 		return error;
- 
--	return i915_drm_suspend_late(dev);
-+	return i915_drm_suspend_late(dev, false);
- }
- 
- static int i915_drm_resume(struct drm_device *dev)
-@@ -934,8 +944,7 @@ static int i915_pm_suspend(struct device *dev)
- 
- static int i915_pm_suspend_late(struct device *dev)
- {
--	struct pci_dev *pdev = to_pci_dev(dev);
--	struct drm_device *drm_dev = pci_get_drvdata(pdev);
-+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
- 
- 	/*
- 	 * We have a suspedn ordering issue with the snd-hda driver also
-@@ -949,13 +958,22 @@ static int i915_pm_suspend_late(struct device *dev)
- 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
- 		return 0;
- 
--	return i915_drm_suspend_late(drm_dev);
-+	return i915_drm_suspend_late(drm_dev, false);
-+}
-+
-+static int i915_pm_poweroff_late(struct device *dev)
-+{
-+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
-+
-+	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
-+		return 0;
-+
-+	return i915_drm_suspend_late(drm_dev, true);
- }
- 
- static int i915_pm_resume_early(struct device *dev)
- {
--	struct pci_dev *pdev = to_pci_dev(dev);
--	struct drm_device *drm_dev = pci_get_drvdata(pdev);
-+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
- 
- 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
- 		return 0;
-@@ -965,8 +983,7 @@ static int i915_pm_resume_early(struct device *dev)
- 
- static int i915_pm_resume(struct device *dev)
- {
--	struct pci_dev *pdev = to_pci_dev(dev);
--	struct drm_device *drm_dev = pci_get_drvdata(pdev);
-+	struct drm_device *drm_dev = dev_to_i915(dev)->dev;
- 
- 	if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
- 		return 0;
-@@ -1517,7 +1534,7 @@ static const struct dev_pm_ops i915_pm_ops = {
- 	.thaw_early = i915_pm_resume_early,
- 	.thaw = i915_pm_resume,
- 	.poweroff = i915_pm_suspend,
--	.poweroff_late = i915_pm_suspend_late,
-+	.poweroff_late = i915_pm_poweroff_late,
- 	.restore_early = i915_pm_resume_early,
- 	.restore = i915_pm_resume,
- 
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 0936b0f..ddd005c 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -1781,6 +1781,11 @@ static inline struct drm_i915_private *to_i915(const struct drm_device *dev)
- 	return dev->dev_private;
- }
- 
-+static inline struct drm_i915_private *dev_to_i915(struct device *dev)
-+{
-+	return to_i915(dev_get_drvdata(dev));
-+}
-+
- /* Iterate over initialised rings */
- #define for_each_ring(ring__, dev_priv__, i__) \
- 	for ((i__) = 0; (i__) < I915_NUM_RINGS; (i__)++) \
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 30d4eb3..c10b52e 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -9702,7 +9702,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
- 	struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
- 	struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
- 
--	WARN_ON(!in_irq());
-+	WARN_ON(!in_interrupt());
- 
- 	if (crtc == NULL)
- 		return;
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index ed644a4..86807ee 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
- 	       (x << 16) | y);
- 	viewport_w = crtc->mode.hdisplay;
- 	viewport_h = (crtc->mode.vdisplay + 1) & ~1;
-+	if ((rdev->family >= CHIP_BONAIRE) &&
-+	    (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
-+		viewport_h *= 2;
- 	WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
- 	       (viewport_w << 16) | viewport_h);
- 
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index de9a562..53b9ac3 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -7526,6 +7526,9 @@ int cik_irq_set(struct radeon_device *rdev)
- 	WREG32(DC_HPD5_INT_CONTROL, hpd5);
- 	WREG32(DC_HPD6_INT_CONTROL, hpd6);
- 
-+	/* posting read */
-+	RREG32(SRBM_STATUS);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 85995b4..c674f63 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -4589,6 +4589,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
- 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
- 	WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
- 
-+	/* posting read */
-+	RREG32(SRBM_STATUS);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index 279801c..04f2514 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -728,6 +728,10 @@ int r100_irq_set(struct radeon_device *rdev)
- 		tmp |= RADEON_FP2_DETECT_MASK;
- 	}
- 	WREG32(RADEON_GEN_INT_CNTL, tmp);
-+
-+	/* read back to post the write */
-+	RREG32(RADEON_GEN_INT_CNTL);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index ef5d606..0e2cf2a 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -3783,6 +3783,9 @@ int r600_irq_set(struct radeon_device *rdev)
- 		WREG32(RV770_CG_THERMAL_INT, thermal_int);
- 	}
- 
-+	/* posting read */
-+	RREG32(R_000E50_SRBM_STATUS);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
-index c830863..26e7d28 100644
---- a/drivers/gpu/drm/radeon/radeon_cs.c
-+++ b/drivers/gpu/drm/radeon/radeon_cs.c
-@@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
- 	u32 ring = RADEON_CS_RING_GFX;
- 	s32 priority = 0;
- 
-+	INIT_LIST_HEAD(&p->validated);
-+
- 	if (!cs->num_chunks) {
- 		return 0;
- 	}
-+
- 	/* get chunks */
--	INIT_LIST_HEAD(&p->validated);
- 	p->idx = 0;
- 	p->ib.sa_bo = NULL;
- 	p->const_ib.sa_bo = NULL;
-diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
-index d13d1b5..df09ca7 100644
---- a/drivers/gpu/drm/radeon/radeon_fence.c
-+++ b/drivers/gpu/drm/radeon/radeon_fence.c
-@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
- 	return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
- }
- 
-+struct radeon_wait_cb {
-+	struct fence_cb base;
-+	struct task_struct *task;
-+};
-+
-+static void
-+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
-+{
-+	struct radeon_wait_cb *wait =
-+		container_of(cb, struct radeon_wait_cb, base);
-+
-+	wake_up_process(wait->task);
-+}
-+
- static signed long radeon_fence_default_wait(struct fence *f, bool intr,
- 					     signed long t)
- {
- 	struct radeon_fence *fence = to_radeon_fence(f);
- 	struct radeon_device *rdev = fence->rdev;
--	bool signaled;
-+	struct radeon_wait_cb cb;
- 
--	fence_enable_sw_signaling(&fence->base);
-+	cb.task = current;
- 
--	/*
--	 * This function has to return -EDEADLK, but cannot hold
--	 * exclusive_lock during the wait because some callers
--	 * may already hold it. This means checking needs_reset without
--	 * lock, and not fiddling with any gpu internals.
--	 *
--	 * The callback installed with fence_enable_sw_signaling will
--	 * run before our wait_event_*timeout call, so we will see
--	 * both the signaled fence and the changes to needs_reset.
--	 */
-+	if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
-+		return t;
-+
-+	while (t > 0) {
-+		if (intr)
-+			set_current_state(TASK_INTERRUPTIBLE);
-+		else
-+			set_current_state(TASK_UNINTERRUPTIBLE);
-+
-+		/*
-+		 * radeon_test_signaled must be called after
-+		 * set_current_state to prevent a race with wake_up_process
-+		 */
-+		if (radeon_test_signaled(fence))
-+			break;
-+
-+		if (rdev->needs_reset) {
-+			t = -EDEADLK;
-+			break;
-+		}
-+
-+		t = schedule_timeout(t);
-+
-+		if (t > 0 && intr && signal_pending(current))
-+			t = -ERESTARTSYS;
-+	}
-+
-+	__set_current_state(TASK_RUNNING);
-+	fence_remove_callback(f, &cb.base);
- 
--	if (intr)
--		t = wait_event_interruptible_timeout(rdev->fence_queue,
--			((signaled = radeon_test_signaled(fence)) ||
--			 rdev->needs_reset), t);
--	else
--		t = wait_event_timeout(rdev->fence_queue,
--			((signaled = radeon_test_signaled(fence)) ||
--			 rdev->needs_reset), t);
--
--	if (t > 0 && !signaled)
--		return -EDEADLK;
- 	return t;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
-index bef9a09..2151cec 100644
---- a/drivers/gpu/drm/radeon/radeon_kfd.c
-+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
-@@ -152,7 +152,7 @@ void radeon_kfd_device_init(struct radeon_device *rdev)
- 			.compute_vmid_bitmap = 0xFF00,
- 
- 			.first_compute_pipe = 1,
--			.compute_pipe_count = 8 - 1,
-+			.compute_pipe_count = 4 - 1,
- 		};
- 
- 		radeon_doorbell_get_kfd_info(rdev,
-diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
-index 040d284..24f7d30 100644
---- a/drivers/gpu/drm/radeon/radeon_object.c
-+++ b/drivers/gpu/drm/radeon/radeon_object.c
-@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
- 		else
- 			rbo->placements[i].lpfn = 0;
- 	}
--
--	/*
--	 * Use two-ended allocation depending on the buffer size to
--	 * improve fragmentation quality.
--	 * 512kb was measured as the most optimal number.
--	 */
--	if (rbo->tbo.mem.size > 512 * 1024) {
--		for (i = 0; i < c; i++) {
--			rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
--		}
--	}
- }
- 
- int radeon_bo_create(struct radeon_device *rdev,
-diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index 74bce91..0396606 100644
---- a/drivers/gpu/drm/radeon/rs600.c
-+++ b/drivers/gpu/drm/radeon/rs600.c
-@@ -693,6 +693,10 @@ int rs600_irq_set(struct radeon_device *rdev)
- 	WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
- 	if (ASIC_IS_DCE2(rdev))
- 		WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
-+
-+	/* posting read */
-+	RREG32(R_000040_GEN_INT_CNTL);
-+
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index 5d89b87..eed21db 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -6198,6 +6198,9 @@ int si_irq_set(struct radeon_device *rdev)
- 
- 	WREG32(CG_THERMAL_INT, thermal_int);
- 
-+	/* posting read */
-+	RREG32(SRBM_STATUS);
-+
- 	return 0;
- }
- 
-@@ -7118,8 +7121,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
- 
- 	if (!vclk || !dclk) {
--		/* keep the Bypass mode, put PLL to sleep */
--		WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+		/* keep the Bypass mode */
- 		return 0;
- 	}
- 
-@@ -7135,8 +7137,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- 	/* set VCO_MODE to 1 */
- 	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
- 
--	/* toggle UPLL_SLEEP to 1 then back to 0 */
--	WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+	/* disable sleep mode */
- 	WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
- 
- 	/* deassert UPLL_RESET */
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index 6c6b655..74a2e23 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- 		goto out_err1;
- 	}
- 
--	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
--			     (dev_priv->vram_size >> PAGE_SHIFT));
--	if (unlikely(ret != 0)) {
--		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
--		goto out_err2;
--	}
--
--	dev_priv->has_gmr = true;
--	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
--	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
--					 VMW_PL_GMR) != 0) {
--		DRM_INFO("No GMR memory available. "
--			 "Graphics memory resources are very limited.\n");
--		dev_priv->has_gmr = false;
--	}
--
--	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
--		dev_priv->has_mob = true;
--		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
--				   VMW_PL_MOB) != 0) {
--			DRM_INFO("No MOB memory available. "
--				 "3D will be disabled.\n");
--			dev_priv->has_mob = false;
--		}
--	}
--
- 	dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
- 					       dev_priv->mmio_size);
- 
-@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- 		goto out_no_fman;
- 	}
- 
-+
-+	ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-+			     (dev_priv->vram_size >> PAGE_SHIFT));
-+	if (unlikely(ret != 0)) {
-+		DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-+		goto out_no_vram;
-+	}
-+
-+	dev_priv->has_gmr = true;
-+	if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-+	    refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-+					 VMW_PL_GMR) != 0) {
-+		DRM_INFO("No GMR memory available. "
-+			 "Graphics memory resources are very limited.\n");
-+		dev_priv->has_gmr = false;
-+	}
-+
-+	if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-+		dev_priv->has_mob = true;
-+		if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-+				   VMW_PL_MOB) != 0) {
-+			DRM_INFO("No MOB memory available. "
-+				 "3D will be disabled.\n");
-+			dev_priv->has_mob = false;
-+		}
-+	}
-+
- 	vmw_kms_save_vga(dev_priv);
- 
- 	/* Start kms and overlay systems, needs fifo. */
-@@ -838,6 +839,12 @@ out_no_fifo:
- 	vmw_kms_close(dev_priv);
- out_no_kms:
- 	vmw_kms_restore_vga(dev_priv);
-+	if (dev_priv->has_mob)
-+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+	if (dev_priv->has_gmr)
-+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+out_no_vram:
- 	vmw_fence_manager_takedown(dev_priv->fman);
- out_no_fman:
- 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-@@ -853,12 +860,6 @@ out_err4:
- 	iounmap(dev_priv->mmio_virt);
- out_err3:
- 	arch_phys_wc_del(dev_priv->mmio_mtrr);
--	if (dev_priv->has_mob)
--		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
--	if (dev_priv->has_gmr)
--		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
--	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
--out_err2:
- 	(void)ttm_bo_device_release(&dev_priv->bdev);
- out_err1:
- 	vmw_ttm_global_release(dev_priv);
-@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
- 	}
- 	vmw_kms_close(dev_priv);
- 	vmw_overlay_close(dev_priv);
-+
-+	if (dev_priv->has_mob)
-+		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+	if (dev_priv->has_gmr)
-+		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+
- 	vmw_fence_manager_takedown(dev_priv->fman);
- 	if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
- 		drm_irq_uninstall(dev_priv->dev);
-@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
- 	ttm_object_device_release(&dev_priv->tdev);
- 	iounmap(dev_priv->mmio_virt);
- 	arch_phys_wc_del(dev_priv->mmio_mtrr);
--	if (dev_priv->has_mob)
--		(void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
--	if (dev_priv->has_gmr)
--		(void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
--	(void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
- 	(void)ttm_bo_device_release(&dev_priv->bdev);
- 	vmw_ttm_global_release(dev_priv);
- 
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-index 33176d0..1e11489 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-@@ -2780,13 +2780,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
- 				  NULL, arg->command_size, arg->throttle_us,
- 				  (void __user *)(unsigned long)arg->fence_rep,
- 				  NULL);
--
-+	ttm_read_unlock(&dev_priv->reservation_sem);
- 	if (unlikely(ret != 0))
--		goto out_unlock;
-+		return ret;
- 
- 	vmw_kms_cursor_post_execbuf(dev_priv);
- 
--out_unlock:
--	ttm_read_unlock(&dev_priv->reservation_sem);
--	return ret;
-+	return 0;
- }
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-index 8725b79..07cda8c 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
- 	int i;
- 	struct drm_mode_config *mode_config = &dev->mode_config;
- 
--	ret = ttm_read_lock(&dev_priv->reservation_sem, true);
--	if (unlikely(ret != 0))
--		return ret;
--
- 	if (!arg->num_outputs) {
- 		struct drm_vmw_rect def_rect = {0, 0, 800, 600};
- 		vmw_du_update_layout(dev_priv, 1, &def_rect);
--		goto out_unlock;
-+		return 0;
- 	}
- 
- 	rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
- 	rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
- 			GFP_KERNEL);
--	if (unlikely(!rects)) {
--		ret = -ENOMEM;
--		goto out_unlock;
--	}
-+	if (unlikely(!rects))
-+		return -ENOMEM;
- 
- 	user_rects = (void __user *)(unsigned long)arg->rects;
- 	ret = copy_from_user(rects, user_rects, rects_size);
-@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
- 
- out_free:
- 	kfree(rects);
--out_unlock:
--	ttm_read_unlock(&dev_priv->reservation_sem);
- 	return ret;
- }
-diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
-index e9eae57..6366333 100644
---- a/drivers/i2c/i2c-core.c
-+++ b/drivers/i2c/i2c-core.c
-@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
- 		status = driver->remove(client);
- 	}
- 
--	if (dev->of_node)
--		irq_dispose_mapping(client->irq);
--
- 	dev_pm_domain_detach(&client->dev, true);
- 	return status;
- }
-diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
-index 463c235..4387dae 100644
---- a/drivers/irqchip/irq-armada-370-xp.c
-+++ b/drivers/irqchip/irq-armada-370-xp.c
-@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
- static void __iomem *main_int_base;
- static struct irq_domain *armada_370_xp_mpic_domain;
- static u32 doorbell_mask_reg;
-+static int parent_irq;
- #ifdef CONFIG_PCI_MSI
- static struct irq_domain *armada_370_xp_msi_domain;
- static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
-@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
- {
- 	if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
- 		armada_xp_mpic_smp_cpu_init();
-+
- 	return NOTIFY_OK;
- }
- 
-@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
- 	.priority = 100,
- };
- 
-+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
-+					unsigned long action, void *hcpu)
-+{
-+	if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
-+		enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
-+
-+	return NOTIFY_OK;
-+}
-+
-+static struct notifier_block mpic_cascaded_cpu_notifier = {
-+	.notifier_call = mpic_cascaded_secondary_init,
-+	.priority = 100,
-+};
-+
- #endif /* CONFIG_SMP */
- 
- static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
-@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
- 					     struct device_node *parent)
- {
- 	struct resource main_int_res, per_cpu_int_res;
--	int parent_irq, nr_irqs, i;
-+	int nr_irqs, i;
- 	u32 control;
- 
- 	BUG_ON(of_address_to_resource(node, 0, &main_int_res));
-@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
- 		register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
- #endif
- 	} else {
-+#ifdef CONFIG_SMP
-+		register_cpu_notifier(&mpic_cascaded_cpu_notifier);
-+#endif
- 		irq_set_chained_handler(parent_irq,
- 					armada_370_xp_mpic_handle_cascade_irq);
- 	}
-diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
-index 96b0b1d..bc67736 100644
---- a/drivers/mtd/nand/pxa3xx_nand.c
-+++ b/drivers/mtd/nand/pxa3xx_nand.c
-@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
- 	nand_writel(info, NDCR, ndcr | int_mask);
- }
- 
-+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
-+{
-+	if (info->ecc_bch) {
-+		int timeout;
-+
-+		/*
-+		 * According to the datasheet, when reading from NDDB
-+		 * with BCH enabled, after each 32 bytes reads, we
-+		 * have to make sure that the NDSR.RDDREQ bit is set.
-+		 *
-+		 * Drain the FIFO 8 32 bits reads at a time, and skip
-+		 * the polling on the last read.
-+		 */
-+		while (len > 8) {
-+			__raw_readsl(info->mmio_base + NDDB, data, 8);
-+
-+			for (timeout = 0;
-+			     !(nand_readl(info, NDSR) & NDSR_RDDREQ);
-+			     timeout++) {
-+				if (timeout >= 5) {
-+					dev_err(&info->pdev->dev,
-+						"Timeout on RDDREQ while draining the FIFO\n");
-+					return;
-+				}
-+
-+				mdelay(1);
-+			}
-+
-+			data += 32;
-+			len -= 8;
-+		}
-+	}
-+
-+	__raw_readsl(info->mmio_base + NDDB, data, len);
-+}
-+
- static void handle_data_pio(struct pxa3xx_nand_info *info)
- {
- 	unsigned int do_bytes = min(info->data_size, info->chunk_size);
-@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
- 				      DIV_ROUND_UP(info->oob_size, 4));
- 		break;
- 	case STATE_PIO_READING:
--		__raw_readsl(info->mmio_base + NDDB,
--			     info->data_buff + info->data_buff_pos,
--			     DIV_ROUND_UP(do_bytes, 4));
-+		drain_fifo(info,
-+			   info->data_buff + info->data_buff_pos,
-+			   DIV_ROUND_UP(do_bytes, 4));
- 
- 		if (info->oob_size > 0)
--			__raw_readsl(info->mmio_base + NDDB,
--				     info->oob_buff + info->oob_buff_pos,
--				     DIV_ROUND_UP(info->oob_size, 4));
-+			drain_fifo(info,
-+				   info->oob_buff + info->oob_buff_pos,
-+				   DIV_ROUND_UP(info->oob_size, 4));
- 		break;
- 	default:
- 		dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
-diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index 847c1f8..62ca0e8 100644
---- a/drivers/net/can/dev.c
-+++ b/drivers/net/can/dev.c
-@@ -578,6 +578,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
- 	skb->pkt_type = PACKET_BROADCAST;
- 	skb->ip_summed = CHECKSUM_UNNECESSARY;
- 
-+	skb_reset_mac_header(skb);
-+	skb_reset_network_header(skb);
-+	skb_reset_transport_header(skb);
-+
- 	can_skb_reserve(skb);
- 	can_skb_prv(skb)->ifindex = dev->ifindex;
- 
-@@ -602,6 +606,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
- 	skb->pkt_type = PACKET_BROADCAST;
- 	skb->ip_summed = CHECKSUM_UNNECESSARY;
- 
-+	skb_reset_mac_header(skb);
-+	skb_reset_network_header(skb);
-+	skb_reset_transport_header(skb);
-+
- 	can_skb_reserve(skb);
- 	can_skb_prv(skb)->ifindex = dev->ifindex;
- 
-diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
-index 7af379c..913a2bc 100644
---- a/drivers/net/can/usb/kvaser_usb.c
-+++ b/drivers/net/can/usb/kvaser_usb.c
-@@ -12,6 +12,7 @@
-  * Copyright (C) 2012 Olivier Sobrie <olivier@sobrie.be>
-  */
- 
-+#include <linux/kernel.h>
- #include <linux/completion.h>
- #include <linux/module.h>
- #include <linux/netdevice.h>
-@@ -403,8 +404,15 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
- 		while (pos <= actual_len - MSG_HEADER_LEN) {
- 			tmp = buf + pos;
- 
--			if (!tmp->len)
--				break;
-+			/* Handle messages crossing the USB endpoint max packet
-+			 * size boundary. Check kvaser_usb_read_bulk_callback()
-+			 * for further details.
-+			 */
-+			if (tmp->len == 0) {
-+				pos = round_up(pos,
-+					       dev->bulk_in->wMaxPacketSize);
-+				continue;
-+			}
- 
- 			if (pos + tmp->len > actual_len) {
- 				dev_err(dev->udev->dev.parent,
-@@ -980,8 +988,19 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
- 	while (pos <= urb->actual_length - MSG_HEADER_LEN) {
- 		msg = urb->transfer_buffer + pos;
- 
--		if (!msg->len)
--			break;
-+		/* The Kvaser firmware can only read and write messages that
-+		 * does not cross the USB's endpoint wMaxPacketSize boundary.
-+		 * If a follow-up command crosses such boundary, firmware puts
-+		 * a placeholder zero-length command in its place then aligns
-+		 * the real command to the next max packet size.
-+		 *
-+		 * Handle such cases or we're going to miss a significant
-+		 * number of events in case of a heavy rx load on the bus.
-+		 */
-+		if (msg->len == 0) {
-+			pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
-+			continue;
-+		}
- 
- 		if (pos + msg->len > urb->actual_length) {
- 			dev_err(dev->udev->dev.parent, "Format error\n");
-@@ -989,7 +1008,6 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
- 		}
- 
- 		kvaser_usb_handle_message(dev, msg);
--
- 		pos += msg->len;
- 	}
- 
-diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-index 72eef9f..ac6a0ef 100644
---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-@@ -12722,6 +12722,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
- 	pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
- 			       PCICFG_VENDOR_ID_OFFSET);
- 
-+	/* Set PCIe reset type to fundamental for EEH recovery */
-+	pdev->needs_freset = 1;
-+
- 	/* AER (Advanced Error reporting) configuration */
- 	rc = pci_enable_pcie_error_reporting(pdev);
- 	if (!rc)
-diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
-index bba8777..fba3c98 100644
---- a/drivers/net/ethernet/freescale/fec_main.c
-+++ b/drivers/net/ethernet/freescale/fec_main.c
-@@ -1448,8 +1448,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
- 
- 			vlan_packet_rcvd = true;
- 
--			skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
--						       data, (2 * ETH_ALEN));
-+			memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
- 			skb_pull(skb, VLAN_HLEN);
- 		}
- 
-@@ -1566,7 +1565,7 @@ fec_enet_interrupt(int irq, void *dev_id)
- 	writel(int_events, fep->hwp + FEC_IEVENT);
- 	fec_enet_collect_events(fep, int_events);
- 
--	if (fep->work_tx || fep->work_rx) {
-+	if ((fep->work_tx || fep->work_rx) && fep->link) {
- 		ret = IRQ_HANDLED;
- 
- 		if (napi_schedule_prep(&fep->napi)) {
-diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
-index 944a112..8805ef1 100644
---- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
-+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
-@@ -451,7 +451,7 @@ struct mlx4_en_port_stats {
- 	unsigned long rx_chksum_none;
- 	unsigned long rx_chksum_complete;
- 	unsigned long tx_chksum_offload;
--#define NUM_PORT_STATS		9
-+#define NUM_PORT_STATS		10
- };
- 
- struct mlx4_en_perf_stats {
-diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
-index 3eed708..fe48f4c 100644
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -300,9 +300,18 @@ static const struct driver_info	cx82310_info = {
- 	.tx_fixup	= cx82310_tx_fixup,
- };
- 
-+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
-+	.match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
-+		       USB_DEVICE_ID_MATCH_DEV_INFO, \
-+	.idVendor = (vend), \
-+	.idProduct = (prod), \
-+	.bDeviceClass = (cl), \
-+	.bDeviceSubClass = (sc), \
-+	.bDeviceProtocol = (pr)
-+
- static const struct usb_device_id products[] = {
- 	{
--		USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
-+		USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
- 		.driver_info = (unsigned long) &cx82310_info
- 	},
- 	{ },
-diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 059fdf1..0ad6c0c 100644
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -1444,8 +1444,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
- {
- 	int i;
- 
--	for (i = 0; i < vi->max_queue_pairs; i++)
-+	for (i = 0; i < vi->max_queue_pairs; i++) {
-+		napi_hash_del(&vi->rq[i].napi);
- 		netif_napi_del(&vi->rq[i].napi);
-+	}
- 
- 	kfree(vi->rq);
- 	kfree(vi->sq);
-@@ -1936,11 +1938,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
- 	cancel_delayed_work_sync(&vi->refill);
- 
- 	if (netif_running(vi->dev)) {
--		for (i = 0; i < vi->max_queue_pairs; i++) {
-+		for (i = 0; i < vi->max_queue_pairs; i++)
- 			napi_disable(&vi->rq[i].napi);
--			napi_hash_del(&vi->rq[i].napi);
--			netif_napi_del(&vi->rq[i].napi);
--		}
- 	}
- 
- 	remove_vq_common(vi);
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 47731cb..2fa0dbb 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -5322,6 +5322,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
- 	case 0x432a: /* BCM4321 */
- 	case 0x432d: /* BCM4322 */
- 	case 0x4352: /* BCM43222 */
-+	case 0x435a: /* BCM43228 */
- 	case 0x4333: /* BCM4331 */
- 	case 0x43a2: /* BCM4360 */
- 	case 0x43b3: /* BCM4352 */
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 36536b6..65a47f4 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -714,16 +714,12 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
- 						const char *path)
- {
- 	struct device_node *child;
--	int len = strchrnul(path, '/') - path;
--	int term;
-+	int len;
- 
-+	len = strcspn(path, "/:");
- 	if (!len)
- 		return NULL;
- 
--	term = strchrnul(path, ':') - path;
--	if (term < len)
--		len = term;
--
- 	__for_each_child_of_node(parent, child) {
- 		const char *name = strrchr(child->full_name, '/');
- 		if (WARN(!name, "malformed device_node %s\n", child->full_name))
-@@ -768,8 +764,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
- 
- 	/* The path could begin with an alias */
- 	if (*path != '/') {
--		char *p = strchrnul(path, '/');
--		int len = separator ? separator - path : p - path;
-+		int len;
-+		const char *p = separator;
-+
-+		if (!p)
-+			p = strchrnul(path, '/');
-+		len = p - path;
- 
- 		/* of_aliases must not be NULL */
- 		if (!of_aliases)
-@@ -794,6 +794,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
- 		path++; /* Increment past '/' delimiter */
- 		np = __of_find_node_by_path(np, path);
- 		path = strchrnul(path, '/');
-+		if (separator && separator < path)
-+			break;
- 	}
- 	raw_spin_unlock_irqrestore(&devtree_lock, flags);
- 	return np;
-diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index aa012fb..312f23a 100644
---- a/drivers/pci/pci-sysfs.c
-+++ b/drivers/pci/pci-sysfs.c
-@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
- 	struct pci_dev *pdev = to_pci_dev(dev);
- 	char *driver_override, *old = pdev->driver_override, *cp;
- 
--	if (count > PATH_MAX)
-+	/* We need to keep extra room for a newline */
-+	if (count >= (PAGE_SIZE - 1))
- 		return -EINVAL;
- 
- 	driver_override = kstrndup(buf, count, GFP_KERNEL);
-@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
- {
- 	struct pci_dev *pdev = to_pci_dev(dev);
- 
--	return sprintf(buf, "%s\n", pdev->driver_override);
-+	return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
- }
- static DEVICE_ATTR_RW(driver_override);
- 
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 9c48fb3..a5761d0 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -1843,10 +1843,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
- 	}
- 
- 	if (rdev->ena_pin) {
--		ret = regulator_ena_gpio_ctrl(rdev, true);
--		if (ret < 0)
--			return ret;
--		rdev->ena_gpio_state = 1;
-+		if (!rdev->ena_gpio_state) {
-+			ret = regulator_ena_gpio_ctrl(rdev, true);
-+			if (ret < 0)
-+				return ret;
-+			rdev->ena_gpio_state = 1;
-+		}
- 	} else if (rdev->desc->ops->enable) {
- 		ret = rdev->desc->ops->enable(rdev);
- 		if (ret < 0)
-@@ -1943,10 +1945,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
- 	trace_regulator_disable(rdev_get_name(rdev));
- 
- 	if (rdev->ena_pin) {
--		ret = regulator_ena_gpio_ctrl(rdev, false);
--		if (ret < 0)
--			return ret;
--		rdev->ena_gpio_state = 0;
-+		if (rdev->ena_gpio_state) {
-+			ret = regulator_ena_gpio_ctrl(rdev, false);
-+			if (ret < 0)
-+				return ret;
-+			rdev->ena_gpio_state = 0;
-+		}
- 
- 	} else if (rdev->desc->ops->disable) {
- 		ret = rdev->desc->ops->disable(rdev);
-@@ -3678,12 +3682,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
- 				 config->ena_gpio, ret);
- 			goto wash;
- 		}
--
--		if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
--			rdev->ena_gpio_state = 1;
--
--		if (config->ena_gpio_invert)
--			rdev->ena_gpio_state = !rdev->ena_gpio_state;
- 	}
- 
- 	/* set regulator constraints */
-@@ -3856,9 +3854,11 @@ int regulator_suspend_finish(void)
- 	list_for_each_entry(rdev, &regulator_list, list) {
- 		mutex_lock(&rdev->mutex);
- 		if (rdev->use_count > 0  || rdev->constraints->always_on) {
--			error = _regulator_do_enable(rdev);
--			if (error)
--				ret = error;
-+			if (!_regulator_is_enabled(rdev)) {
-+				error = _regulator_do_enable(rdev);
-+				if (error)
-+					ret = error;
-+			}
- 		} else {
- 			if (!have_full_constraints())
- 				goto unlock;
-diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
-index c94a3e0..3f67228 100644
---- a/drivers/regulator/rk808-regulator.c
-+++ b/drivers/regulator/rk808-regulator.c
-@@ -235,6 +235,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(0),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG2",
-@@ -249,6 +250,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(1),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG3",
-@@ -263,6 +265,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_BUCK4_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(2),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG4",
-@@ -277,6 +280,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(3),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG5",
-@@ -291,6 +295,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(4),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG6",
-@@ -305,6 +310,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(5),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG7",
-@@ -319,6 +325,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(6),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "LDO_REG8",
-@@ -333,6 +340,7 @@ static const struct regulator_desc rk808_reg[] = {
- 		.vsel_mask = RK808_LDO_VSEL_MASK,
- 		.enable_reg = RK808_LDO_EN_REG,
- 		.enable_mask = BIT(7),
-+		.enable_time = 400,
- 		.owner = THIS_MODULE,
- 	}, {
- 		.name = "SWITCH_REG1",
-diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
-index 4241eea..f4cf685 100644
---- a/drivers/rtc/rtc-s3c.c
-+++ b/drivers/rtc/rtc-s3c.c
-@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
- 
- static struct s3c_rtc_data const s3c6410_rtc_data = {
- 	.max_user_freq		= 32768,
-+	.needs_src_clk		= true,
- 	.irq_handler		= s3c6410_rtc_irq,
- 	.set_freq		= s3c6410_rtc_setfreq,
- 	.enable_tick		= s3c6410_rtc_enable_tick,
-diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
-index 62b58d3..60de662 100644
---- a/drivers/scsi/libsas/sas_discover.c
-+++ b/drivers/scsi/libsas/sas_discover.c
-@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
- 	struct sas_discovery_event *ev = to_sas_discovery_event(work);
- 	struct asd_sas_port *port = ev->port;
- 	struct sas_ha_struct *ha = port->ha;
-+	struct domain_device *ddev = port->port_dev;
- 
- 	/* prevent revalidation from finding sata links in recovery */
- 	mutex_lock(&ha->disco_mutex);
-@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
- 	SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
- 		    task_pid_nr(current));
- 
--	if (port->port_dev)
--		res = sas_ex_revalidate_domain(port->port_dev);
-+	if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
-+		     ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
-+		res = sas_ex_revalidate_domain(ddev);
- 
- 	SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
- 		    port->id, task_pid_nr(current), res);
-diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
-index 23d8f5f5..df93c97 100644
---- a/drivers/spi/spi-atmel.c
-+++ b/drivers/spi/spi-atmel.c
-@@ -764,17 +764,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
- 			(unsigned long long)xfer->rx_dma);
- 	}
- 
--	/* REVISIT: We're waiting for ENDRX before we start the next
-+	/* REVISIT: We're waiting for RXBUFF before we start the next
- 	 * transfer because we need to handle some difficult timing
--	 * issues otherwise. If we wait for ENDTX in one transfer and
--	 * then starts waiting for ENDRX in the next, it's difficult
--	 * to tell the difference between the ENDRX interrupt we're
--	 * actually waiting for and the ENDRX interrupt of the
-+	 * issues otherwise. If we wait for TXBUFE in one transfer and
-+	 * then starts waiting for RXBUFF in the next, it's difficult
-+	 * to tell the difference between the RXBUFF interrupt we're
-+	 * actually waiting for and the RXBUFF interrupt of the
- 	 * previous transfer.
- 	 *
- 	 * It should be doable, though. Just not now...
- 	 */
--	spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
-+	spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
- 	spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
- }
- 
-diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
-index a67d37c..22ca08a 100644
---- a/drivers/spi/spi-dw-mid.c
-+++ b/drivers/spi/spi-dw-mid.c
-@@ -139,6 +139,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws)
- 				1,
- 				DMA_MEM_TO_DEV,
- 				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-+	if (!txdesc)
-+		return NULL;
-+
- 	txdesc->callback = dw_spi_dma_tx_done;
- 	txdesc->callback_param = dws;
- 
-@@ -184,6 +187,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws)
- 				1,
- 				DMA_DEV_TO_MEM,
- 				DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-+	if (!rxdesc)
-+		return NULL;
-+
- 	rxdesc->callback = dw_spi_dma_rx_done;
- 	rxdesc->callback_param = dws;
- 
-diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
-index 89ca162..ee513a8 100644
---- a/drivers/spi/spi-pl022.c
-+++ b/drivers/spi/spi-pl022.c
-@@ -534,12 +534,12 @@ static void giveback(struct pl022 *pl022)
- 	pl022->cur_msg = NULL;
- 	pl022->cur_transfer = NULL;
- 	pl022->cur_chip = NULL;
--	spi_finalize_current_message(pl022->master);
- 
- 	/* disable the SPI/SSP operation */
- 	writew((readw(SSP_CR1(pl022->virtbase)) &
- 		(~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
- 
-+	spi_finalize_current_message(pl022->master);
- }
- 
- /**
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index aebde32..8d27db47 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -4221,11 +4221,17 @@ int iscsit_close_connection(
- 	pr_debug("Closing iSCSI connection CID %hu on SID:"
- 		" %u\n", conn->cid, sess->sid);
- 	/*
--	 * Always up conn_logout_comp just in case the RX Thread is sleeping
--	 * and the logout response never got sent because the connection
--	 * failed.
-+	 * Always up conn_logout_comp for the traditional TCP case just in case
-+	 * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
-+	 * response never got sent because the connection failed.
-+	 *
-+	 * However for iser-target, isert_wait4logout() is using conn_logout_comp
-+	 * to signal logout response TX interrupt completion.  Go ahead and skip
-+	 * this for iser since isert_rx_opcode() does not wait on logout failure,
-+	 * and to avoid iscsi_conn pointer dereference in iser-target code.
- 	 */
--	complete(&conn->conn_logout_comp);
-+	if (conn->conn_transport->transport_type == ISCSI_TCP)
-+		complete(&conn->conn_logout_comp);
- 
- 	iscsi_release_thread_set(conn);
- 
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index 58f49ff..54da2a4 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -1534,8 +1534,6 @@ int target_configure_device(struct se_device *dev)
- 	ret = dev->transport->configure_device(dev);
- 	if (ret)
- 		goto out;
--	dev->dev_flags |= DF_CONFIGURED;
--
- 	/*
- 	 * XXX: there is not much point to have two different values here..
- 	 */
-@@ -1597,6 +1595,8 @@ int target_configure_device(struct se_device *dev)
- 	list_add_tail(&dev->g_dev_node, &g_device_list);
- 	mutex_unlock(&g_device_mutex);
- 
-+	dev->dev_flags |= DF_CONFIGURED;
-+
- 	return 0;
- 
- out_free_alua:
-diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
-index 1045dcd..f6c954c 100644
---- a/drivers/target/target_core_pscsi.c
-+++ b/drivers/target/target_core_pscsi.c
-@@ -1121,7 +1121,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
- 	struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
- 	struct scsi_device *sd = pdv->pdv_sd;
- 
--	return sd->type;
-+	return (sd) ? sd->type : TYPE_NO_LUN;
- }
- 
- static sector_t pscsi_get_blocks(struct se_device *dev)
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 0adc0f6..ac3cbab 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
- 	list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
- out:
- 	spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+
-+	if (ret && ack_kref)
-+		target_put_sess_cmd(se_sess, se_cmd);
-+
- 	return ret;
- }
- EXPORT_SYMBOL(target_get_sess_cmd);
-diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
-index 555de07..7d89da3 100644
---- a/drivers/tty/serial/8250/8250_dw.c
-+++ b/drivers/tty/serial/8250/8250_dw.c
-@@ -111,7 +111,10 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
- 			dw8250_force_idle(p);
- 			writeb(value, p->membase + (UART_LCR << p->regshift));
- 		}
--		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+		/*
-+		 * FIXME: this deadlocks if port->lock is already held
-+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+		 */
- 	}
- }
- 
-@@ -155,7 +158,10 @@ static void dw8250_serial_outq(struct uart_port *p, int offset, int value)
- 			__raw_writeq(value & 0xff,
- 				     p->membase + (UART_LCR << p->regshift));
- 		}
--		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+		/*
-+		 * FIXME: this deadlocks if port->lock is already held
-+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+		 */
- 	}
- }
- #endif /* CONFIG_64BIT */
-@@ -179,7 +185,10 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
- 			dw8250_force_idle(p);
- 			writel(value, p->membase + (UART_LCR << p->regshift));
- 		}
--		dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+		/*
-+		 * FIXME: this deadlocks if port->lock is already held
-+		 * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+		 */
- 	}
- }
- 
-diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index d1f8dc6..1442956 100644
---- a/drivers/tty/serial/8250/8250_pci.c
-+++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -69,7 +69,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
- 	       "Please send the output of lspci -vv, this\n"
- 	       "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
- 	       "manufacturer and name of serial board or\n"
--	       "modem board to rmk+serial@arm.linux.org.uk.\n",
-+	       "modem board to <linux-serial@vger.kernel.org>.\n",
- 	       pci_name(dev), str, dev->vendor, dev->device,
- 	       dev->subsystem_vendor, dev->subsystem_device);
- }
-diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
-index db49ec4..9fbbaa0 100644
---- a/drivers/usb/gadget/legacy/inode.c
-+++ b/drivers/usb/gadget/legacy/inode.c
-@@ -566,7 +566,6 @@ static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
- 		if (total == 0)
- 			break;
- 	}
--
- 	return len;
- }
- 
-@@ -585,6 +584,7 @@ static void ep_user_copy_worker(struct work_struct *work)
- 	aio_complete(iocb, ret, ret);
- 
- 	kfree(priv->buf);
-+	kfree(priv->iv);
- 	kfree(priv);
- }
- 
-@@ -605,6 +605,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
- 	 */
- 	if (priv->iv == NULL || unlikely(req->actual == 0)) {
- 		kfree(req->buf);
-+		kfree(priv->iv);
- 		kfree(priv);
- 		iocb->private = NULL;
- 		/* aio_complete() reports bytes-transferred _and_ faults */
-@@ -640,7 +641,7 @@ ep_aio_rwtail(
- 	struct usb_request	*req;
- 	ssize_t			value;
- 
--	priv = kmalloc(sizeof *priv, GFP_KERNEL);
-+	priv = kzalloc(sizeof *priv, GFP_KERNEL);
- 	if (!priv) {
- 		value = -ENOMEM;
- fail:
-@@ -649,7 +650,14 @@ fail:
- 	}
- 	iocb->private = priv;
- 	priv->iocb = iocb;
--	priv->iv = iv;
-+	if (iv) {
-+		priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
-+				   GFP_KERNEL);
-+		if (!priv->iv) {
-+			kfree(priv);
-+			goto fail;
-+		}
-+	}
- 	priv->nr_segs = nr_segs;
- 	INIT_WORK(&priv->work, ep_user_copy_worker);
- 
-@@ -689,6 +697,7 @@ fail:
- 	mutex_unlock(&epdata->lock);
- 
- 	if (unlikely(value)) {
-+		kfree(priv->iv);
- 		kfree(priv);
- 		put_ep(epdata);
- 	} else
-diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
-index b4bca2d..70fba97 100644
---- a/drivers/xen/events/events_base.c
-+++ b/drivers/xen/events/events_base.c
-@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
- 	pirq_query_unmask(irq);
- 
- 	rc = set_evtchn_to_irq(evtchn, irq);
--	if (rc != 0) {
--		pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
--		       irq, rc);
--		xen_evtchn_close(evtchn);
--		return 0;
--	}
-+	if (rc)
-+		goto err;
-+
- 	bind_evtchn_to_cpu(evtchn, 0);
- 	info->evtchn = evtchn;
- 
-+	rc = xen_evtchn_port_setup(info);
-+	if (rc)
-+		goto err;
-+
- out:
- 	unmask_evtchn(evtchn);
- 	eoi_pirq(irq_get_irq_data(irq));
- 
- 	return 0;
-+
-+err:
-+	pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
-+	xen_evtchn_close(evtchn);
-+	return 0;
- }
- 
- static unsigned int startup_pirq(struct irq_data *data)
-diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
-index 46ae0f9..75fe3d4 100644
---- a/drivers/xen/xen-pciback/conf_space.c
-+++ b/drivers/xen/xen-pciback/conf_space.c
-@@ -16,7 +16,7 @@
- #include "conf_space.h"
- #include "conf_space_quirks.h"
- 
--static bool permissive;
-+bool permissive;
- module_param(permissive, bool, 0644);
- 
- /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
-diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
-index e56c934..2e1d73d 100644
---- a/drivers/xen/xen-pciback/conf_space.h
-+++ b/drivers/xen/xen-pciback/conf_space.h
-@@ -64,6 +64,8 @@ struct config_field_entry {
- 	void *data;
- };
- 
-+extern bool permissive;
-+
- #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
- 
- /* Add fields to a device - the add_fields macro expects to get a pointer to
-diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
-index c5ee825..2d73693 100644
---- a/drivers/xen/xen-pciback/conf_space_header.c
-+++ b/drivers/xen/xen-pciback/conf_space_header.c
-@@ -11,6 +11,10 @@
- #include "pciback.h"
- #include "conf_space.h"
- 
-+struct pci_cmd_info {
-+	u16 val;
-+};
-+
- struct pci_bar_info {
- 	u32 val;
- 	u32 len_val;
-@@ -20,22 +24,36 @@ struct pci_bar_info {
- #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
- #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
- 
--static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+/* Bits guests are allowed to control in permissive mode. */
-+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
-+			   PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
-+			   PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
-+
-+static void *command_init(struct pci_dev *dev, int offset)
- {
--	int i;
--	int ret;
--
--	ret = xen_pcibk_read_config_word(dev, offset, value, data);
--	if (!pci_is_enabled(dev))
--		return ret;
--
--	for (i = 0; i < PCI_ROM_RESOURCE; i++) {
--		if (dev->resource[i].flags & IORESOURCE_IO)
--			*value |= PCI_COMMAND_IO;
--		if (dev->resource[i].flags & IORESOURCE_MEM)
--			*value |= PCI_COMMAND_MEMORY;
-+	struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
-+	int err;
-+
-+	if (!cmd)
-+		return ERR_PTR(-ENOMEM);
-+
-+	err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
-+	if (err) {
-+		kfree(cmd);
-+		return ERR_PTR(err);
- 	}
- 
-+	return cmd;
-+}
-+
-+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+{
-+	int ret = pci_read_config_word(dev, offset, value);
-+	const struct pci_cmd_info *cmd = data;
-+
-+	*value &= PCI_COMMAND_GUEST;
-+	*value |= cmd->val & ~PCI_COMMAND_GUEST;
-+
- 	return ret;
- }
- 
-@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- {
- 	struct xen_pcibk_dev_data *dev_data;
- 	int err;
-+	u16 val;
-+	struct pci_cmd_info *cmd = data;
- 
- 	dev_data = pci_get_drvdata(dev);
- 	if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
-@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- 		}
- 	}
- 
-+	cmd->val = value;
-+
-+	if (!permissive && (!dev_data || !dev_data->permissive))
-+		return 0;
-+
-+	/* Only allow the guest to control certain bits. */
-+	err = pci_read_config_word(dev, offset, &val);
-+	if (err || val == value)
-+		return err;
-+
-+	value &= PCI_COMMAND_GUEST;
-+	value |= val & ~PCI_COMMAND_GUEST;
-+
- 	return pci_write_config_word(dev, offset, value);
- }
- 
-@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
- 	{
- 	 .offset    = PCI_COMMAND,
- 	 .size      = 2,
-+	 .init      = command_init,
-+	 .release   = bar_release,
- 	 .u.w.read  = command_read,
- 	 .u.w.write = command_write,
- 	},
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index ed19a7d..71c4619 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
- 
- 	newpage = buf->page;
- 
--	if (WARN_ON(!PageUptodate(newpage)))
--		return -EIO;
-+	if (!PageUptodate(newpage))
-+		SetPageUptodate(newpage);
- 
- 	ClearPageMappedToDisk(newpage);
- 
-@@ -1797,6 +1797,9 @@ copy_finish:
- static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
- 		       unsigned int size, struct fuse_copy_state *cs)
- {
-+	/* Don't try to move pages (yet) */
-+	cs->move_pages = 0;
-+
- 	switch (code) {
- 	case FUSE_NOTIFY_POLL:
- 		return fuse_notify_poll(fc, size, cs);
-diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
-index 469086b..0c3f303 100644
---- a/fs/nilfs2/segment.c
-+++ b/fs/nilfs2/segment.c
-@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- 					     struct the_nilfs *nilfs)
- {
- 	struct nilfs_inode_info *ii, *n;
-+	int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
- 	int defer_iput = false;
- 
- 	spin_lock(&nilfs->ns_inode_lock);
-@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- 		brelse(ii->i_bh);
- 		ii->i_bh = NULL;
- 		list_del_init(&ii->i_dirty);
--		if (!ii->vfs_inode.i_nlink) {
-+		if (!ii->vfs_inode.i_nlink || during_mount) {
- 			/*
--			 * Defer calling iput() to avoid a deadlock
--			 * over I_SYNC flag for inodes with i_nlink == 0
-+			 * Defer calling iput() to avoid deadlocks if
-+			 * i_nlink == 0 or mount is not yet finished.
- 			 */
- 			list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
- 			defer_iput = true;
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 88f9b83..f86e549 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -1326,6 +1326,9 @@ out:
- 
- static int pagemap_open(struct inode *inode, struct file *file)
- {
-+	/* do not disclose physical addresses: attack vector */
-+	if (!capable(CAP_SYS_ADMIN))
-+		return -EPERM;
- 	pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
- 			"to stop being page-shift some time soon. See the "
- 			"linux/Documentation/vm/pagemap.txt for details.\n");
-diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
-index 057038c..b405a62 100644
---- a/include/linux/serial_core.h
-+++ b/include/linux/serial_core.h
-@@ -146,9 +146,9 @@ struct uart_port {
- #define UPIO_HUB6		(1)			/* Hub6 ISA card */
- #define UPIO_MEM		(2)			/* 8b MMIO access */
- #define UPIO_MEM32		(3)			/* 32b little endian */
--#define UPIO_MEM32BE		(4)			/* 32b big endian */
--#define UPIO_AU			(5)			/* Au1x00 and RT288x type IO */
--#define UPIO_TSI		(6)			/* Tsi108/109 type IO */
-+#define UPIO_AU			(4)			/* Au1x00 and RT288x type IO */
-+#define UPIO_TSI		(5)			/* Tsi108/109 type IO */
-+#define UPIO_MEM32BE		(6)			/* 32b big endian */
- 
- 	unsigned int		read_status_mask;	/* driver specific */
- 	unsigned int		ignore_status_mask;	/* driver specific */
-diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
-index b996e6cd..9eb54f4 100644
---- a/include/linux/workqueue.h
-+++ b/include/linux/workqueue.h
-@@ -70,7 +70,8 @@ enum {
- 	/* data contains off-queue information when !WORK_STRUCT_PWQ */
- 	WORK_OFFQ_FLAG_BASE	= WORK_STRUCT_COLOR_SHIFT,
- 
--	WORK_OFFQ_CANCELING	= (1 << WORK_OFFQ_FLAG_BASE),
-+	__WORK_OFFQ_CANCELING	= WORK_OFFQ_FLAG_BASE,
-+	WORK_OFFQ_CANCELING	= (1 << __WORK_OFFQ_CANCELING),
- 
- 	/*
- 	 * When a work item is off queue, its high bits point to the last
-diff --git a/kernel/cpuset.c b/kernel/cpuset.c
-index 64b257f..9e25599 100644
---- a/kernel/cpuset.c
-+++ b/kernel/cpuset.c
-@@ -548,9 +548,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
- 
- 	rcu_read_lock();
- 	cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
--		if (cp == root_cs)
--			continue;
--
- 		/* skip the whole subtree if @cp doesn't have any CPU */
- 		if (cpumask_empty(cp->cpus_allowed)) {
- 			pos_css = css_rightmost_descendant(pos_css);
-@@ -873,7 +870,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
- 		 * If it becomes empty, inherit the effective mask of the
- 		 * parent, which is guaranteed to have some CPUs.
- 		 */
--		if (cpumask_empty(new_cpus))
-+		if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
- 			cpumask_copy(new_cpus, parent->effective_cpus);
- 
- 		/* Skip the whole subtree if the cpumask remains the same. */
-@@ -1129,7 +1126,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
- 		 * If it becomes empty, inherit the effective mask of the
- 		 * parent, which is guaranteed to have some MEMs.
- 		 */
--		if (nodes_empty(*new_mems))
-+		if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
- 			*new_mems = parent->effective_mems;
- 
- 		/* Skip the whole subtree if the nodemask remains the same. */
-@@ -1992,7 +1989,9 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
- 
- 	spin_lock_irq(&callback_lock);
- 	cs->mems_allowed = parent->mems_allowed;
-+	cs->effective_mems = parent->mems_allowed;
- 	cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
-+	cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
- 	spin_unlock_irq(&callback_lock);
- out_unlock:
- 	mutex_unlock(&cpuset_mutex);
-diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
-index cbd69d8..2ca4a8b 100644
---- a/kernel/printk/console_cmdline.h
-+++ b/kernel/printk/console_cmdline.h
-@@ -3,7 +3,7 @@
- 
- struct console_cmdline
- {
--	char	name[8];			/* Name of the driver	    */
-+	char	name[16];			/* Name of the driver	    */
- 	int	index;				/* Minor dev. to use	    */
- 	char	*options;			/* Options for the driver   */
- #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index fae29e3..2cdd353 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -2464,6 +2464,7 @@ void register_console(struct console *newcon)
- 	for (i = 0, c = console_cmdline;
- 	     i < MAX_CMDLINECONSOLES && c->name[0];
- 	     i++, c++) {
-+		BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
- 		if (strcmp(c->name, newcon->name) != 0)
- 			continue;
- 		if (newcon->index >= 0 &&
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 224e768..af5bffd 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -1059,6 +1059,12 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
- 
- static struct pid * const ftrace_swapper_pid = &init_struct_pid;
- 
-+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-+static int ftrace_graph_active;
-+#else
-+# define ftrace_graph_active 0
-+#endif
-+
- #ifdef CONFIG_DYNAMIC_FTRACE
- 
- static struct ftrace_ops *removed_ops;
-@@ -2041,8 +2047,12 @@ static int ftrace_check_record(struct dyn_ftrace *rec, int enable, int update)
- 		if (!ftrace_rec_count(rec))
- 			rec->flags = 0;
- 		else
--			/* Just disable the record (keep REGS state) */
--			rec->flags &= ~FTRACE_FL_ENABLED;
-+			/*
-+			 * Just disable the record, but keep the ops TRAMP
-+			 * and REGS states. The _EN flags must be disabled though.
-+			 */
-+			rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
-+					FTRACE_FL_REGS_EN);
- 	}
- 
- 	return FTRACE_UPDATE_MAKE_NOP;
-@@ -2688,24 +2698,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
- 
- static void ftrace_startup_sysctl(void)
- {
-+	int command;
-+
- 	if (unlikely(ftrace_disabled))
- 		return;
- 
- 	/* Force update next time */
- 	saved_ftrace_func = NULL;
- 	/* ftrace_start_up is true if we want ftrace running */
--	if (ftrace_start_up)
--		ftrace_run_update_code(FTRACE_UPDATE_CALLS);
-+	if (ftrace_start_up) {
-+		command = FTRACE_UPDATE_CALLS;
-+		if (ftrace_graph_active)
-+			command |= FTRACE_START_FUNC_RET;
-+		ftrace_startup_enable(command);
-+	}
- }
- 
- static void ftrace_shutdown_sysctl(void)
- {
-+	int command;
-+
- 	if (unlikely(ftrace_disabled))
- 		return;
- 
- 	/* ftrace_start_up is true if ftrace is running */
--	if (ftrace_start_up)
--		ftrace_run_update_code(FTRACE_DISABLE_CALLS);
-+	if (ftrace_start_up) {
-+		command = FTRACE_DISABLE_CALLS;
-+		if (ftrace_graph_active)
-+			command |= FTRACE_STOP_FUNC_RET;
-+		ftrace_run_update_code(command);
-+	}
- }
- 
- static cycle_t		ftrace_update_time;
-@@ -5558,12 +5580,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
- 
- 	if (ftrace_enabled) {
- 
--		ftrace_startup_sysctl();
--
- 		/* we are starting ftrace again */
- 		if (ftrace_ops_list != &ftrace_list_end)
- 			update_ftrace_function();
- 
-+		ftrace_startup_sysctl();
-+
- 	} else {
- 		/* stopping ftrace calls (just send to ftrace_stub) */
- 		ftrace_trace_function = ftrace_stub;
-@@ -5590,8 +5612,6 @@ static struct ftrace_ops graph_ops = {
- 	ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
- };
- 
--static int ftrace_graph_active;
--
- int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
- {
- 	return 0;
-diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index beeeac9..82d0c8d 100644
---- a/kernel/workqueue.c
-+++ b/kernel/workqueue.c
-@@ -2728,19 +2728,57 @@ bool flush_work(struct work_struct *work)
- }
- EXPORT_SYMBOL_GPL(flush_work);
- 
-+struct cwt_wait {
-+	wait_queue_t		wait;
-+	struct work_struct	*work;
-+};
-+
-+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
-+{
-+	struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
-+
-+	if (cwait->work != key)
-+		return 0;
-+	return autoremove_wake_function(wait, mode, sync, key);
-+}
-+
- static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
- {
-+	static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
- 	unsigned long flags;
- 	int ret;
- 
- 	do {
- 		ret = try_to_grab_pending(work, is_dwork, &flags);
- 		/*
--		 * If someone else is canceling, wait for the same event it
--		 * would be waiting for before retrying.
-+		 * If someone else is already canceling, wait for it to
-+		 * finish.  flush_work() doesn't work for PREEMPT_NONE
-+		 * because we may get scheduled between @work's completion
-+		 * and the other canceling task resuming and clearing
-+		 * CANCELING - flush_work() will return false immediately
-+		 * as @work is no longer busy, try_to_grab_pending() will
-+		 * return -ENOENT as @work is still being canceled and the
-+		 * other canceling task won't be able to clear CANCELING as
-+		 * we're hogging the CPU.
-+		 *
-+		 * Let's wait for completion using a waitqueue.  As this
-+		 * may lead to the thundering herd problem, use a custom
-+		 * wake function which matches @work along with exclusive
-+		 * wait and wakeup.
- 		 */
--		if (unlikely(ret == -ENOENT))
--			flush_work(work);
-+		if (unlikely(ret == -ENOENT)) {
-+			struct cwt_wait cwait;
-+
-+			init_wait(&cwait.wait);
-+			cwait.wait.func = cwt_wakefn;
-+			cwait.work = work;
-+
-+			prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
-+						  TASK_UNINTERRUPTIBLE);
-+			if (work_is_canceling(work))
-+				schedule();
-+			finish_wait(&cancel_waitq, &cwait.wait);
-+		}
- 	} while (unlikely(ret < 0));
- 
- 	/* tell other tasks trying to grab @work to back off */
-@@ -2749,6 +2787,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
- 
- 	flush_work(work);
- 	clear_work_data(work);
-+
-+	/*
-+	 * Paired with prepare_to_wait() above so that either
-+	 * waitqueue_active() is visible here or !work_is_canceling() is
-+	 * visible there.
-+	 */
-+	smp_mb();
-+	if (waitqueue_active(&cancel_waitq))
-+		__wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
-+
- 	return ret;
- }
- 
-diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
-index 7a85967..f0f5c5c 100644
---- a/lib/lz4/lz4_decompress.c
-+++ b/lib/lz4/lz4_decompress.c
-@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
- 			/* Error: request to write beyond destination buffer */
- 			if (cpy > oend)
- 				goto _output_error;
-+			if ((ref + COPYLENGTH) > oend ||
-+					(op + COPYLENGTH) > oend)
-+				goto _output_error;
- 			LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
- 			while (op < cpy)
- 				*op++ = *ref++;
-diff --git a/lib/seq_buf.c b/lib/seq_buf.c
-index 4eedfed..f25c33b 100644
---- a/lib/seq_buf.c
-+++ b/lib/seq_buf.c
-@@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args)
- 
- 	if (s->len < s->size) {
- 		len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
--		if (seq_buf_can_fit(s, len)) {
-+		if (s->len + len < s->size) {
- 			s->len += len;
- 			return 0;
- 		}
-@@ -154,7 +154,7 @@ int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary)
- 
- 	if (s->len < s->size) {
- 		ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
--		if (seq_buf_can_fit(s, ret)) {
-+		if (s->len + ret < s->size) {
- 			s->len += ret;
- 			return 0;
- 		}
-diff --git a/mm/cma.c b/mm/cma.c
-index a85ae28..f1bbcb6 100644
---- a/mm/cma.c
-+++ b/mm/cma.c
-@@ -64,15 +64,17 @@ static unsigned long cma_bitmap_aligned_mask(struct cma *cma, int align_order)
- 	return (1UL << (align_order - cma->order_per_bit)) - 1;
- }
- 
-+/*
-+ * Find a PFN aligned to the specified order and return an offset represented in
-+ * order_per_bits.
-+ */
- static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
- {
--	unsigned int alignment;
--
- 	if (align_order <= cma->order_per_bit)
- 		return 0;
--	alignment = 1UL << (align_order - cma->order_per_bit);
--	return ALIGN(cma->base_pfn, alignment) -
--		(cma->base_pfn >> cma->order_per_bit);
-+
-+	return (ALIGN(cma->base_pfn, (1UL << align_order))
-+		- cma->base_pfn) >> cma->order_per_bit;
- }
- 
- static unsigned long cma_bitmap_maxno(struct cma *cma)
-diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index 769b185..a6e2da0 100644
---- a/net/caif/caif_socket.c
-+++ b/net/caif/caif_socket.c
-@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
- 	int copylen;
- 
- 	ret = -EOPNOTSUPP;
--	if (m->msg_flags&MSG_OOB)
-+	if (flags & MSG_OOB)
- 		goto read_error;
- 
- 	skb = skb_recv_datagram(sk, flags, 0 , &ret);
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 66e0804..32d710e 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
- 		goto inval_skb;
- 	}
- 
-+	skb->ip_summed = CHECKSUM_UNNECESSARY;
-+
-+	skb_reset_mac_header(skb);
- 	skb_reset_network_header(skb);
- 	skb_reset_transport_header(skb);
- 
-diff --git a/net/compat.c b/net/compat.c
-index 94d3d5e..f7bd286 100644
---- a/net/compat.c
-+++ b/net/compat.c
-@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
- 	    __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
- 	    __get_user(kmsg->msg_flags, &umsg->msg_flags))
- 		return -EFAULT;
-+
-+	if (!uaddr)
-+		kmsg->msg_namelen = 0;
-+
-+	if (kmsg->msg_namelen < 0)
-+		return -EINVAL;
-+
- 	if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
- 		kmsg->msg_namelen = sizeof(struct sockaddr_storage);
- 	kmsg->msg_control = compat_ptr(tmp3);
-diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
-index 31baba2..bbb1d5a 100644
---- a/net/core/sysctl_net_core.c
-+++ b/net/core/sysctl_net_core.c
-@@ -25,6 +25,8 @@
- static int zero = 0;
- static int one = 1;
- static int ushort_max = USHRT_MAX;
-+static int min_sndbuf = SOCK_MIN_SNDBUF;
-+static int min_rcvbuf = SOCK_MIN_RCVBUF;
- 
- static int net_msg_warn;	/* Unused, but still a sysctl */
- 
-@@ -237,7 +239,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_sndbuf,
- 	},
- 	{
- 		.procname	= "rmem_max",
-@@ -245,7 +247,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_rcvbuf,
- 	},
- 	{
- 		.procname	= "wmem_default",
-@@ -253,7 +255,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_sndbuf,
- 	},
- 	{
- 		.procname	= "rmem_default",
-@@ -261,7 +263,7 @@ static struct ctl_table net_core_table[] = {
- 		.maxlen		= sizeof(int),
- 		.mode		= 0644,
- 		.proc_handler	= proc_dointvec_minmax,
--		.extra1		= &one,
-+		.extra1		= &min_rcvbuf,
- 	},
- 	{
- 		.procname	= "dev_weight",
-diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index e34dccb..4eeba4e 100644
---- a/net/ipv4/inet_diag.c
-+++ b/net/ipv4/inet_diag.c
-@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
- 	mutex_unlock(&inet_diag_table_mutex);
- }
- 
-+static size_t inet_sk_attr_size(void)
-+{
-+	return	  nla_total_size(sizeof(struct tcp_info))
-+		+ nla_total_size(1) /* INET_DIAG_SHUTDOWN */
-+		+ nla_total_size(1) /* INET_DIAG_TOS */
-+		+ nla_total_size(1) /* INET_DIAG_TCLASS */
-+		+ nla_total_size(sizeof(struct inet_diag_meminfo))
-+		+ nla_total_size(sizeof(struct inet_diag_msg))
-+		+ nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
-+		+ nla_total_size(TCP_CA_NAME_MAX)
-+		+ nla_total_size(sizeof(struct tcpvegas_info))
-+		+ 64;
-+}
-+
- int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
- 			      struct sk_buff *skb, struct inet_diag_req_v2 *req,
- 			      struct user_namespace *user_ns,		      	
-@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
- 	if (err)
- 		goto out;
- 
--	rep = nlmsg_new(sizeof(struct inet_diag_msg) +
--			sizeof(struct inet_diag_meminfo) +
--			sizeof(struct tcp_info) + 64, GFP_KERNEL);
-+	rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
- 	if (!rep) {
- 		err = -ENOMEM;
- 		goto out;
-diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
-index 8670e68..f2d4097 100644
---- a/net/ipv4/tcp_cong.c
-+++ b/net/ipv4/tcp_cong.c
-@@ -309,6 +309,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
-  */
- void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
- {
-+	/* If credits accumulated at a higher w, apply them gently now. */
-+	if (tp->snd_cwnd_cnt >= w) {
-+		tp->snd_cwnd_cnt = 0;
-+		tp->snd_cwnd++;
-+	}
-+
- 	tp->snd_cwnd_cnt += acked;
- 	if (tp->snd_cwnd_cnt >= w) {
- 		u32 delta = tp->snd_cwnd_cnt / w;
-diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
-index 4b276d1..06d3d66 100644
---- a/net/ipv4/tcp_cubic.c
-+++ b/net/ipv4/tcp_cubic.c
-@@ -306,8 +306,10 @@ tcp_friendliness:
- 		}
- 	}
- 
--	if (ca->cnt == 0)			/* cannot be zero */
--		ca->cnt = 1;
-+	/* The maximum rate of cwnd increase CUBIC allows is 1 packet per
-+	 * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
-+	 */
-+	ca->cnt = max(ca->cnt, 2U);
- }
- 
- static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 65caf8b..9790f39 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2775,15 +2775,11 @@ void tcp_send_fin(struct sock *sk)
- 	} else {
- 		/* Socket is locked, keep trying until memory is available. */
- 		for (;;) {
--			skb = alloc_skb_fclone(MAX_TCP_HEADER,
--					       sk->sk_allocation);
-+			skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
- 			if (skb)
- 				break;
- 			yield();
- 		}
--
--		/* Reserve space for headers and prepare control bits. */
--		skb_reserve(skb, MAX_TCP_HEADER);
- 		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
- 		tcp_init_nondata_skb(skb, tp->write_seq,
- 				     TCPHDR_ACK | TCPHDR_FIN);
-diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
-index b4d5e1d..27ca796 100644
---- a/net/ipv6/fib6_rules.c
-+++ b/net/ipv6/fib6_rules.c
-@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
- 				goto again;
- 			flp6->saddr = saddr;
- 		}
-+		err = rt->dst.error;
- 		goto out;
- 	}
- again:
-diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
-index a562769..4b869d3 100644
---- a/net/ipv6/udp_offload.c
-+++ b/net/ipv6/udp_offload.c
-@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
- 		fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
- 		fptr->nexthdr = nexthdr;
- 		fptr->reserved = 0;
--		if (skb_shinfo(skb)->ip6_frag_id)
--			fptr->identification = skb_shinfo(skb)->ip6_frag_id;
--		else
--			ipv6_select_ident(fptr,
--					  (struct rt6_info *)skb_dst(skb));
-+		if (!skb_shinfo(skb)->ip6_frag_id)
-+			ipv6_proxy_select_ident(skb);
-+		fptr->identification = skb_shinfo(skb)->ip6_frag_id;
- 
- 		/* Fragment the skb. ipv6 header and the remaining fields of the
- 		 * fragment header are updated in ipv6_gso_segment()
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index b8295a4..fdcda8b 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -3399,7 +3399,7 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
- 		if (udest.af == 0)
- 			udest.af = svc->af;
- 
--		if (udest.af != svc->af) {
-+		if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
- 			/* The synchronization protocol is incompatible
- 			 * with mixed family services
- 			 */
-diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
-index c47ffd7..d93ceeb 100644
---- a/net/netfilter/ipvs/ip_vs_sync.c
-+++ b/net/netfilter/ipvs/ip_vs_sync.c
-@@ -896,6 +896,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
- 			IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
- 			return;
- 		}
-+		if (!(flags & IP_VS_CONN_F_TEMPLATE))
-+			kfree(param->pe_data);
- 	}
- 
- 	if (opt)
-@@ -1169,6 +1171,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
- 				(opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
- 				);
- #endif
-+	ip_vs_pe_put(param.pe);
- 	return 0;
- 	/* Error exit */
- out:
-diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
-index 1ff04bc..f77f4cc 100644
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
- 
- static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
- {
--	rule->genmask = 0;
-+	rule->genmask &= ~(1 << gencursor_next(net));
- }
- 
- static int
-@@ -3606,12 +3606,11 @@ static int nf_tables_commit(struct sk_buff *skb)
- 						 &te->elem,
- 						 NFT_MSG_DELSETELEM, 0);
- 			te->set->ops->get(te->set, &te->elem);
--			te->set->ops->remove(te->set, &te->elem);
- 			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
--			if (te->elem.flags & NFT_SET_MAP) {
--				nft_data_uninit(&te->elem.data,
--						te->set->dtype);
--			}
-+			if (te->set->flags & NFT_SET_MAP &&
-+			    !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
-+				nft_data_uninit(&te->elem.data, te->set->dtype);
-+			te->set->ops->remove(te->set, &te->elem);
- 			nft_trans_destroy(trans);
- 			break;
- 		}
-@@ -3652,7 +3651,7 @@ static int nf_tables_abort(struct sk_buff *skb)
- {
- 	struct net *net = sock_net(skb->sk);
- 	struct nft_trans *trans, *next;
--	struct nft_set *set;
-+	struct nft_trans_elem *te;
- 
- 	list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
- 		switch (trans->msg_type) {
-@@ -3713,9 +3712,13 @@ static int nf_tables_abort(struct sk_buff *skb)
- 			break;
- 		case NFT_MSG_NEWSETELEM:
- 			nft_trans_elem_set(trans)->nelems--;
--			set = nft_trans_elem_set(trans);
--			set->ops->get(set, &nft_trans_elem(trans));
--			set->ops->remove(set, &nft_trans_elem(trans));
-+			te = (struct nft_trans_elem *)trans->data;
-+			te->set->ops->get(te->set, &te->elem);
-+			nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-+			if (te->set->flags & NFT_SET_MAP &&
-+			    !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
-+				nft_data_uninit(&te->elem.data, te->set->dtype);
-+			te->set->ops->remove(te->set, &te->elem);
- 			nft_trans_destroy(trans);
- 			break;
- 		case NFT_MSG_DELSETELEM:
-diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
-index 265e190..b636486 100644
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -578,8 +578,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
- 		struct xt_match *match = nft_match->ops.data;
- 
- 		if (strcmp(match->name, mt_name) == 0 &&
--		    match->revision == rev && match->family == family)
-+		    match->revision == rev && match->family == family) {
-+			if (!try_module_get(match->me))
-+				return ERR_PTR(-ENOENT);
-+
- 			return &nft_match->ops;
-+		}
- 	}
- 
- 	match = xt_request_find_match(family, mt_name, rev);
-@@ -648,8 +652,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
- 		struct xt_target *target = nft_target->ops.data;
- 
- 		if (strcmp(target->name, tg_name) == 0 &&
--		    target->revision == rev && target->family == family)
-+		    target->revision == rev && target->family == family) {
-+			if (!try_module_get(target->me))
-+				return ERR_PTR(-ENOENT);
-+
- 			return &nft_target->ops;
-+		}
- 	}
- 
- 	target = xt_request_find_target(family, tg_name, rev);
-diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
-index 1ba6793..13332db 100644
---- a/net/netfilter/xt_socket.c
-+++ b/net/netfilter/xt_socket.c
-@@ -243,12 +243,13 @@ static int
- extract_icmp6_fields(const struct sk_buff *skb,
- 		     unsigned int outside_hdrlen,
- 		     int *protocol,
--		     struct in6_addr **raddr,
--		     struct in6_addr **laddr,
-+		     const struct in6_addr **raddr,
-+		     const struct in6_addr **laddr,
- 		     __be16 *rport,
--		     __be16 *lport)
-+		     __be16 *lport,
-+		     struct ipv6hdr *ipv6_var)
- {
--	struct ipv6hdr *inside_iph, _inside_iph;
-+	const struct ipv6hdr *inside_iph;
- 	struct icmp6hdr *icmph, _icmph;
- 	__be16 *ports, _ports[2];
- 	u8 inside_nexthdr;
-@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
- 	if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
- 		return 1;
- 
--	inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
-+	inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
-+					sizeof(*ipv6_var), ipv6_var);
- 	if (inside_iph == NULL)
- 		return 1;
- 	inside_nexthdr = inside_iph->nexthdr;
- 
--	inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
-+	inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
-+					      sizeof(*ipv6_var),
- 					 &inside_nexthdr, &inside_fragoff);
- 	if (inside_hdrlen < 0)
- 		return 1; /* hjm: Packet has no/incomplete transport layer headers. */
-@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
- static bool
- socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
- {
--	struct ipv6hdr *iph = ipv6_hdr(skb);
-+	struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
- 	struct udphdr _hdr, *hp = NULL;
- 	struct sock *sk = skb->sk;
--	struct in6_addr *daddr = NULL, *saddr = NULL;
-+	const struct in6_addr *daddr = NULL, *saddr = NULL;
- 	__be16 uninitialized_var(dport), uninitialized_var(sport);
- 	int thoff = 0, uninitialized_var(tproto);
- 	const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
-@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
- 
- 	} else if (tproto == IPPROTO_ICMPV6) {
- 		if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
--					 &sport, &dport))
-+					 &sport, &dport, &ipv6_var))
- 			return false;
- 	} else {
- 		return false;
-diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
-index a817705..dba8d08 100644
---- a/net/rds/iw_rdma.c
-+++ b/net/rds/iw_rdma.c
-@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
- 			int *unpinned);
- static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
- 
--static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
-+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
-+			     struct rds_iw_device **rds_iwdev,
-+			     struct rdma_cm_id **cm_id)
- {
- 	struct rds_iw_device *iwdev;
- 	struct rds_iw_cm_id *i_cm_id;
-@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- 				src_addr->sin_port,
- 				dst_addr->sin_addr.s_addr,
- 				dst_addr->sin_port,
--				rs->rs_bound_addr,
--				rs->rs_bound_port,
--				rs->rs_conn_addr,
--				rs->rs_conn_port);
-+				src->sin_addr.s_addr,
-+				src->sin_port,
-+				dst->sin_addr.s_addr,
-+				dst->sin_port);
- #ifdef WORKING_TUPLE_DETECTION
--			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
--			    src_addr->sin_port == rs->rs_bound_port &&
--			    dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
--			    dst_addr->sin_port == rs->rs_conn_port) {
-+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
-+			    src_addr->sin_port == src->sin_port &&
-+			    dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
-+			    dst_addr->sin_port == dst->sin_port) {
- #else
- 			/* FIXME - needs to compare the local and remote
- 			 * ipaddr/port tuple, but the ipaddr is the only
-@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- 			 * zero'ed.  It doesn't appear to be properly populated
- 			 * during connection setup...
- 			 */
--			if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
-+			if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
- #endif
- 				spin_unlock_irq(&iwdev->spinlock);
- 				*rds_iwdev = iwdev;
-@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
- {
- 	struct sockaddr_in *src_addr, *dst_addr;
- 	struct rds_iw_device *rds_iwdev_old;
--	struct rds_sock rs;
- 	struct rdma_cm_id *pcm_id;
- 	int rc;
- 
- 	src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- 	dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
- 
--	rs.rs_bound_addr = src_addr->sin_addr.s_addr;
--	rs.rs_bound_port = src_addr->sin_port;
--	rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
--	rs.rs_conn_port = dst_addr->sin_port;
--
--	rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
-+	rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
- 	if (rc)
- 		rds_iw_remove_cm_id(rds_iwdev, cm_id);
- 
-@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
- 	struct rds_iw_device *rds_iwdev;
- 	struct rds_iw_mr *ibmr = NULL;
- 	struct rdma_cm_id *cm_id;
-+	struct sockaddr_in src = {
-+		.sin_addr.s_addr = rs->rs_bound_addr,
-+		.sin_port = rs->rs_bound_port,
-+	};
-+	struct sockaddr_in dst = {
-+		.sin_addr.s_addr = rs->rs_conn_addr,
-+		.sin_port = rs->rs_conn_port,
-+	};
- 	int ret;
- 
--	ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
-+	ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
- 	if (ret || !cm_id) {
- 		ret = -ENODEV;
- 		goto out;
-diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
-index 4575485..19a5606 100644
---- a/net/rxrpc/ar-recvmsg.c
-+++ b/net/rxrpc/ar-recvmsg.c
-@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
- 		if (!skb) {
- 			/* nothing remains on the queue */
- 			if (copied &&
--			    (msg->msg_flags & MSG_PEEK || timeo == 0))
-+			    (flags & MSG_PEEK || timeo == 0))
- 				goto out;
- 
- 			/* wait for a message to turn up */
-diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
-index 09487af..95fdf4e 100644
---- a/net/sched/cls_u32.c
-+++ b/net/sched/cls_u32.c
-@@ -78,8 +78,11 @@ struct tc_u_hnode {
- 	struct tc_u_common	*tp_c;
- 	int			refcnt;
- 	unsigned int		divisor;
--	struct tc_u_knode __rcu	*ht[1];
- 	struct rcu_head		rcu;
-+	/* The 'ht' field MUST be the last field in structure to allow for
-+	 * more entries allocated at end of structure.
-+	 */
-+	struct tc_u_knode __rcu	*ht[1];
- };
- 
- struct tc_u_common {
-diff --git a/net/socket.c b/net/socket.c
-index 418795c..d50e7ca 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -1765,6 +1765,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
- 
- 	if (len > INT_MAX)
- 		len = INT_MAX;
-+	if (unlikely(!access_ok(VERIFY_READ, buff, len)))
-+		return -EFAULT;
- 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
- 	if (!sock)
- 		goto out;
-@@ -1823,6 +1825,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
- 
- 	if (size > INT_MAX)
- 		size = INT_MAX;
-+	if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
-+		return -EFAULT;
- 	sock = sockfd_lookup_light(fd, &err, &fput_needed);
- 	if (!sock)
- 		goto out;
-diff --git a/sound/core/control.c b/sound/core/control.c
-index bb96a46..23b018b 100644
---- a/sound/core/control.c
-+++ b/sound/core/control.c
-@@ -1168,6 +1168,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
- 
- 	if (info->count < 1)
- 		return -EINVAL;
-+	if (!*info->id.name)
-+		return -EINVAL;
-+	if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
-+		return -EINVAL;
- 	access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
- 		(info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
- 				 SNDRV_CTL_ELEM_ACCESS_INACTIVE|
-diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
-index c2aa3cd..a9536bb 100644
---- a/sound/pci/hda/hda_controller.c
-+++ b/sound/pci/hda/hda_controller.c
-@@ -1160,7 +1160,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
- 		}
- 	}
- 
--	if (!bus->no_response_fallback)
-+	if (bus->no_response_fallback)
- 		return -1;
- 
- 	if (!chip->polling_mode && chip->poll_count < 2) {
-diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
-index b680b4e..8ec5289 100644
---- a/sound/pci/hda/hda_generic.c
-+++ b/sound/pci/hda/hda_generic.c
-@@ -687,12 +687,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
- 	return val;
- }
- 
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
-+{
-+	unsigned int wcaps = get_wcaps(codec, nid);
-+	hda_nid_t conn;
-+
-+	if (wcaps & AC_WCAP_STEREO)
-+		return true;
-+	if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+		return false;
-+	if (snd_hda_get_num_conns(codec, nid) != 1)
-+		return false;
-+	if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
-+		return false;
-+	return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
-+}
-+
- /* initialize the amp value (only at the first time) */
- static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
- {
- 	unsigned int caps = query_amp_caps(codec, nid, dir);
- 	int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
--	snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+
-+	if (is_stereo_amps(codec, nid, dir))
-+		snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+	else
-+		snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
-+}
-+
-+/* update the amp, doing in stereo or mono depending on NID */
-+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
-+		      unsigned int mask, unsigned int val)
-+{
-+	if (is_stereo_amps(codec, nid, dir))
-+		return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
-+						mask, val);
-+	else
-+		return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
-+						mask, val);
- }
- 
- /* calculate amp value mask we can modify;
-@@ -732,7 +765,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
- 		return;
- 
- 	val &= mask;
--	snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
-+	update_amp(codec, nid, dir, idx, mask, val);
- }
- 
- static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
-@@ -4424,13 +4457,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
- 	has_amp = nid_has_mute(codec, mix, HDA_INPUT);
- 	for (i = 0; i < nums; i++) {
- 		if (has_amp)
--			snd_hda_codec_amp_stereo(codec, mix,
--						 HDA_INPUT, i,
--						 0xff, HDA_AMP_MUTE);
-+			update_amp(codec, mix, HDA_INPUT, i,
-+				   0xff, HDA_AMP_MUTE);
- 		else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
--			snd_hda_codec_amp_stereo(codec, conn[i],
--						 HDA_OUTPUT, 0,
--						 0xff, HDA_AMP_MUTE);
-+			update_amp(codec, conn[i], HDA_OUTPUT, 0,
-+				   0xff, HDA_AMP_MUTE);
- 	}
- }
- 
-diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
-index ce5a6da..05e19f7 100644
---- a/sound/pci/hda/hda_proc.c
-+++ b/sound/pci/hda/hda_proc.c
-@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
- 		    (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
- }
- 
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
-+			   int dir, unsigned int wcaps, int indices)
-+{
-+	hda_nid_t conn;
-+
-+	if (wcaps & AC_WCAP_STEREO)
-+		return true;
-+	/* check for a stereo-to-mono mix; it must be:
-+	 * only a single connection, only for input, and only a mixer widget
-+	 */
-+	if (indices != 1 || dir != HDA_INPUT ||
-+	    get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+		return false;
-+
-+	if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
-+		return false;
-+	/* the connection source is a stereo? */
-+	wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
-+	return !!(wcaps & AC_WCAP_STEREO);
-+}
-+
- static void print_amp_vals(struct snd_info_buffer *buffer,
- 			   struct hda_codec *codec, hda_nid_t nid,
--			   int dir, int stereo, int indices)
-+			   int dir, unsigned int wcaps, int indices)
- {
- 	unsigned int val;
-+	bool stereo;
- 	int i;
- 
-+	stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
-+
- 	dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
- 	for (i = 0; i < indices; i++) {
- 		snd_iprintf(buffer, " [");
-@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- 			    (codec->single_adc_amp &&
- 			     wid_type == AC_WID_AUD_IN))
- 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
--					       wid_caps & AC_WCAP_STEREO,
--					       1);
-+					       wid_caps, 1);
- 			else
- 				print_amp_vals(buffer, codec, nid, HDA_INPUT,
--					       wid_caps & AC_WCAP_STEREO,
--					       conn_len);
-+					       wid_caps, conn_len);
- 		}
- 		if (wid_caps & AC_WCAP_OUT_AMP) {
- 			snd_iprintf(buffer, "  Amp-Out caps: ");
-@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- 			if (wid_type == AC_WID_PIN &&
- 			    codec->pin_amp_workaround)
- 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
--					       wid_caps & AC_WCAP_STEREO,
--					       conn_len);
-+					       wid_caps, conn_len);
- 			else
- 				print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
--					       wid_caps & AC_WCAP_STEREO, 1);
-+					       wid_caps, 1);
- 		}
- 
- 		switch (wid_type) {
-diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
-index 1589c9b..dd2b3d9 100644
---- a/sound/pci/hda/patch_cirrus.c
-+++ b/sound/pci/hda/patch_cirrus.c
-@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
- 	SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
- 	SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
-+	SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
- 	SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
- 	SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
- 	{} /* terminator */
-@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec *codec)
- 		return -ENOMEM;
- 
- 	spec->gen.automute_hook = cs_automute;
-+	codec->single_adc_amp = 1;
- 
- 	snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
- 			   cs420x_fixups);
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index fd3ed18..da67ea8 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -223,6 +223,7 @@ enum {
- 	CXT_PINCFG_LENOVO_TP410,
- 	CXT_PINCFG_LEMOTE_A1004,
- 	CXT_PINCFG_LEMOTE_A1205,
-+	CXT_PINCFG_COMPAQ_CQ60,
- 	CXT_FIXUP_STEREO_DMIC,
- 	CXT_FIXUP_INC_MIC_BOOST,
- 	CXT_FIXUP_HEADPHONE_MIC_PIN,
-@@ -660,6 +661,15 @@ static const struct hda_fixup cxt_fixups[] = {
- 		.type = HDA_FIXUP_PINS,
- 		.v.pins = cxt_pincfg_lemote,
- 	},
-+	[CXT_PINCFG_COMPAQ_CQ60] = {
-+		.type = HDA_FIXUP_PINS,
-+		.v.pins = (const struct hda_pintbl[]) {
-+			/* 0x17 was falsely set up as a mic, it should 0x1d */
-+			{ 0x17, 0x400001f0 },
-+			{ 0x1d, 0x97a70120 },
-+			{ }
-+		}
-+	},
- 	[CXT_FIXUP_STEREO_DMIC] = {
- 		.type = HDA_FIXUP_FUNC,
- 		.v.func = cxt_fixup_stereo_dmic,
-@@ -769,6 +779,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = {
- };
- 
- static const struct snd_pci_quirk cxt5051_fixups[] = {
-+	SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
- 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
- 	{}
- };
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index 0a598af..e61c167 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
- 		}
- 	}
- },
-+{
-+	USB_DEVICE(0x0582, 0x0159),
-+	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-+		/* .vendor_name = "Roland", */
-+		/* .product_name = "UA-22", */
-+		.ifnum = QUIRK_ANY_INTERFACE,
-+		.type = QUIRK_COMPOSITE,
-+		.data = (const struct snd_usb_audio_quirk[]) {
-+			{
-+				.ifnum = 0,
-+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-+			},
-+			{
-+				.ifnum = 1,
-+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-+			},
-+			{
-+				.ifnum = 2,
-+				.type = QUIRK_MIDI_FIXED_ENDPOINT,
-+				.data = & (const struct snd_usb_midi_endpoint_info) {
-+					.out_cables = 0x0001,
-+					.in_cables = 0x0001
-+				}
-+			},
-+			{
-+				.ifnum = -1
-+			}
-+		}
-+	}
-+},
- /* this catches most recent vendor-specific Roland devices */
- {
- 	.match_flags = USB_DEVICE_ID_MATCH_VENDOR |
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 1cc6e2e..ec83b11 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -2416,6 +2416,7 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
- 	case KVM_CAP_SIGNAL_MSI:
- #endif
- #ifdef CONFIG_HAVE_KVM_IRQFD
-+	case KVM_CAP_IRQFD:
- 	case KVM_CAP_IRQFD_RESAMPLE:
- #endif
- 	case KVM_CAP_CHECK_EXTENSION_VM:
diff --git a/3.19.3/0000_README b/3.19.4/0000_README
index 571c76c..d6b2506 100644
--- a/3.19.3/0000_README
+++ b/3.19.4/0000_README
@@ -2,11 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1002_linux-3.19.3.patch
+Patch:	1003_linux-3.19.4.patch
 From:	http://www.kernel.org
-Desc:	Linux 3.19.3
+Desc:	Linux 3.19.4
 
-Patch:	4420_grsecurity-3.1-3.19.3-201504021826.patch
+Patch:	4420_grsecurity-3.1-3.19.4-201504142300.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.19.4/1003_linux-3.19.4.patch b/3.19.4/1003_linux-3.19.4.patch
new file mode 100644
index 0000000..4c73b31
--- /dev/null
+++ b/3.19.4/1003_linux-3.19.4.patch
@@ -0,0 +1,3185 @@
+diff --git a/Makefile b/Makefile
+index 713bf26..2ef2078 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 19
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Diseased Newt
+ 
+diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
+index cb95930..d8c25b7 100644
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -246,14 +246,30 @@ static inline unsigned long __cmpxchg_mb(volatile void *ptr, unsigned long old,
+ 	__ret; \
+ })
+ 
+-#define this_cpu_cmpxchg_1(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-#define this_cpu_cmpxchg_2(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-#define this_cpu_cmpxchg_4(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-#define this_cpu_cmpxchg_8(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-
+-#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2) \
+-	cmpxchg_double_local(raw_cpu_ptr(&(ptr1)), raw_cpu_ptr(&(ptr2)), \
+-				o1, o2, n1, n2)
++#define _protect_cmpxchg_local(pcp, o, n)			\
++({								\
++	typeof(*raw_cpu_ptr(&(pcp))) __ret;			\
++	preempt_disable();					\
++	__ret = cmpxchg_local(raw_cpu_ptr(&(pcp)), o, n);	\
++	preempt_enable();					\
++	__ret;							\
++})
++
++#define this_cpu_cmpxchg_1(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++#define this_cpu_cmpxchg_2(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++#define this_cpu_cmpxchg_4(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++#define this_cpu_cmpxchg_8(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++
++#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2)		\
++({									\
++	int __ret;							\
++	preempt_disable();						\
++	__ret = cmpxchg_double_local(	raw_cpu_ptr(&(ptr1)),		\
++					raw_cpu_ptr(&(ptr2)),		\
++					o1, o2, n1, n2);		\
++	preempt_enable();						\
++	__ret;								\
++})
+ 
+ #define cmpxchg64(ptr,o,n)		cmpxchg((ptr),(o),(n))
+ #define cmpxchg64_local(ptr,o,n)	cmpxchg_local((ptr),(o),(n))
+diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
+index a9eee33..101a42b 100644
+--- a/arch/arm64/include/asm/mmu_context.h
++++ b/arch/arm64/include/asm/mmu_context.h
+@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ {
+ 	unsigned int cpu = smp_processor_id();
+ 
++	/*
++	 * init_mm.pgd does not contain any user mappings and it is always
++	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
++	 */
++	if (next == &init_mm) {
++		cpu_set_reserved_ttbr0();
++		return;
++	}
++
+ 	if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
+ 		check_and_switch_context(next, tsk);
+ }
+diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
+index 09da25b..4fde8c1 100644
+--- a/arch/arm64/include/asm/percpu.h
++++ b/arch/arm64/include/asm/percpu.h
+@@ -204,25 +204,47 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+ 	return ret;
+ }
+ 
++#define _percpu_read(pcp)						\
++({									\
++	typeof(pcp) __retval;						\
++	preempt_disable();						\
++	__retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)), 	\
++					      sizeof(pcp));		\
++	preempt_enable();						\
++	__retval;							\
++})
++
++#define _percpu_write(pcp, val)						\
++do {									\
++	preempt_disable();						\
++	__percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val), 	\
++				sizeof(pcp));				\
++	preempt_enable();						\
++} while(0)								\
++
++#define _pcp_protect(operation, pcp, val)			\
++({								\
++	typeof(pcp) __retval;					\
++	preempt_disable();					\
++	__retval = (typeof(pcp))operation(raw_cpu_ptr(&(pcp)),	\
++					  (val), sizeof(pcp));	\
++	preempt_enable();					\
++	__retval;						\
++})
++
+ #define _percpu_add(pcp, val) \
+-	__percpu_add(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
++	_pcp_protect(__percpu_add, pcp, val)
+ 
+-#define _percpu_add_return(pcp, val) (typeof(pcp)) (_percpu_add(pcp, val))
++#define _percpu_add_return(pcp, val) _percpu_add(pcp, val)
+ 
+ #define _percpu_and(pcp, val) \
+-	__percpu_and(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
++	_pcp_protect(__percpu_and, pcp, val)
+ 
+ #define _percpu_or(pcp, val) \
+-	__percpu_or(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+-
+-#define _percpu_read(pcp) (typeof(pcp))	\
+-	(__percpu_read(raw_cpu_ptr(&(pcp)), sizeof(pcp)))
+-
+-#define _percpu_write(pcp, val) \
+-	__percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp))
++	_pcp_protect(__percpu_or, pcp, val)
+ 
+ #define _percpu_xchg(pcp, val) (typeof(pcp)) \
+-	(__percpu_xchg(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp)))
++	_pcp_protect(__percpu_xchg, pcp, (unsigned long)(val))
+ 
+ #define this_cpu_add_1(pcp, val) _percpu_add(pcp, val)
+ #define this_cpu_add_2(pcp, val) _percpu_add(pcp, val)
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+index 1382fec..7fcb1ac 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+@@ -50,6 +50,7 @@ ethernet@b0000 {
+ 	fsl,num_tx_queues = <0x8>;
+ 	fsl,magic-packet;
+ 	local-mac-address = [ 00 00 00 00 00 00 ];
++	ranges;
+ 
+ 	queue-group@b0000 {
+ 		#address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+index 221cd2e..9f25427 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+@@ -50,6 +50,7 @@ ethernet@b1000 {
+ 	fsl,num_tx_queues = <0x8>;
+ 	fsl,magic-packet;
+ 	local-mac-address = [ 00 00 00 00 00 00 ];
++	ranges;
+ 
+ 	queue-group@b1000 {
+ 		#address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+index 61456c3..cd7c318 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+@@ -49,6 +49,7 @@ ethernet@b2000 {
+ 	fsl,num_tx_queues = <0x8>;
+ 	fsl,magic-packet;
+ 	local-mac-address = [ 00 00 00 00 00 00 ];
++	ranges;
+ 
+ 	queue-group@b2000 {
+ 		#address-cells = <1>;
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index c2df815..9519e6b 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1408,7 +1408,7 @@ machine_check_handle_early:
+ 	bne	9f			/* continue in V mode if we are. */
+ 
+ 5:
+-#ifdef CONFIG_KVM_BOOK3S_64_HV
++#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
+ 	/*
+ 	 * We are coming from kernel context. Check if we are coming from
+ 	 * guest. if yes, then we can continue. We will fall through
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index e7cb6d4..f8c9ff7 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -25,10 +25,10 @@
+ static struct kobject *mobility_kobj;
+ 
+ struct update_props_workarea {
+-	u32 phandle;
+-	u32 state;
+-	u64 reserved;
+-	u32 nprops;
++	__be32 phandle;
++	__be32 state;
++	__be64 reserved;
++	__be32 nprops;
+ } __packed;
+ 
+ #define NODE_ACTION_MASK	0xff000000
+@@ -54,11 +54,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ 	return rc;
+ }
+ 
+-static int delete_dt_node(u32 phandle)
++static int delete_dt_node(__be32 phandle)
+ {
+ 	struct device_node *dn;
+ 
+-	dn = of_find_node_by_phandle(phandle);
++	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ 	if (!dn)
+ 		return -ENOENT;
+ 
+@@ -127,7 +127,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
+ 	return 0;
+ }
+ 
+-static int update_dt_node(u32 phandle, s32 scope)
++static int update_dt_node(__be32 phandle, s32 scope)
+ {
+ 	struct update_props_workarea *upwa;
+ 	struct device_node *dn;
+@@ -136,6 +136,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 	char *prop_data;
+ 	char *rtas_buf;
+ 	int update_properties_token;
++	u32 nprops;
+ 	u32 vd;
+ 
+ 	update_properties_token = rtas_token("ibm,update-properties");
+@@ -146,7 +147,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 	if (!rtas_buf)
+ 		return -ENOMEM;
+ 
+-	dn = of_find_node_by_phandle(phandle);
++	dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ 	if (!dn) {
+ 		kfree(rtas_buf);
+ 		return -ENOENT;
+@@ -162,6 +163,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 			break;
+ 
+ 		prop_data = rtas_buf + sizeof(*upwa);
++		nprops = be32_to_cpu(upwa->nprops);
+ 
+ 		/* On the first call to ibm,update-properties for a node the
+ 		 * the first property value descriptor contains an empty
+@@ -170,17 +172,17 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 		 */
+ 		if (*prop_data == 0) {
+ 			prop_data++;
+-			vd = *(u32 *)prop_data;
++			vd = be32_to_cpu(*(__be32 *)prop_data);
+ 			prop_data += vd + sizeof(vd);
+-			upwa->nprops--;
++			nprops--;
+ 		}
+ 
+-		for (i = 0; i < upwa->nprops; i++) {
++		for (i = 0; i < nprops; i++) {
+ 			char *prop_name;
+ 
+ 			prop_name = prop_data;
+ 			prop_data += strlen(prop_name) + 1;
+-			vd = *(u32 *)prop_data;
++			vd = be32_to_cpu(*(__be32 *)prop_data);
+ 			prop_data += sizeof(vd);
+ 
+ 			switch (vd) {
+@@ -212,13 +214,13 @@ static int update_dt_node(u32 phandle, s32 scope)
+ 	return 0;
+ }
+ 
+-static int add_dt_node(u32 parent_phandle, u32 drc_index)
++static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ {
+ 	struct device_node *dn;
+ 	struct device_node *parent_dn;
+ 	int rc;
+ 
+-	parent_dn = of_find_node_by_phandle(parent_phandle);
++	parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
+ 	if (!parent_dn)
+ 		return -ENOENT;
+ 
+@@ -237,7 +239,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
+ int pseries_devicetree_update(s32 scope)
+ {
+ 	char *rtas_buf;
+-	u32 *data;
++	__be32 *data;
+ 	int update_nodes_token;
+ 	int rc;
+ 
+@@ -254,17 +256,17 @@ int pseries_devicetree_update(s32 scope)
+ 		if (rc && rc != 1)
+ 			break;
+ 
+-		data = (u32 *)rtas_buf + 4;
+-		while (*data & NODE_ACTION_MASK) {
++		data = (__be32 *)rtas_buf + 4;
++		while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
+ 			int i;
+-			u32 action = *data & NODE_ACTION_MASK;
+-			int node_count = *data & NODE_COUNT_MASK;
++			u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
++			u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
+ 
+ 			data++;
+ 
+ 			for (i = 0; i < node_count; i++) {
+-				u32 phandle = *data++;
+-				u32 drc_index;
++				__be32 phandle = *data++;
++				__be32 drc_index;
+ 
+ 				switch (action) {
+ 				case DELETE_DT_NODE:
+diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
+index 0da5865..8e1f5f6 100644
+--- a/drivers/base/regmap/internal.h
++++ b/drivers/base/regmap/internal.h
+@@ -237,4 +237,12 @@ extern struct regcache_ops regcache_rbtree_ops;
+ extern struct regcache_ops regcache_lzo_ops;
+ extern struct regcache_ops regcache_flat_ops;
+ 
++static inline const char *regmap_name(const struct regmap *map)
++{
++	if (map->dev)
++		return dev_name(map->dev);
++
++	return map->name;
++}
++
+ #endif
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index d453a2c..81751a4 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ 	if (pos == 0) {
+ 		memmove(blk + offset * map->cache_word_size,
+ 			blk, rbnode->blklen * map->cache_word_size);
+-		bitmap_shift_right(present, present, offset, blklen);
++		bitmap_shift_left(present, present, offset, blklen);
+ 	}
+ 
+ 	/* update the rbnode block, its size and the base register */
+diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
+index f373c35..f5db662 100644
+--- a/drivers/base/regmap/regcache.c
++++ b/drivers/base/regmap/regcache.c
+@@ -218,7 +218,7 @@ int regcache_read(struct regmap *map,
+ 		ret = map->cache_ops->read(map, reg, value);
+ 
+ 		if (ret == 0)
+-			trace_regmap_reg_read_cache(map->dev, reg, *value);
++			trace_regmap_reg_read_cache(map, reg, *value);
+ 
+ 		return ret;
+ 	}
+@@ -311,7 +311,7 @@ int regcache_sync(struct regmap *map)
+ 	dev_dbg(map->dev, "Syncing %s cache\n",
+ 		map->cache_ops->name);
+ 	name = map->cache_ops->name;
+-	trace_regcache_sync(map->dev, name, "start");
++	trace_regcache_sync(map, name, "start");
+ 
+ 	if (!map->cache_dirty)
+ 		goto out;
+@@ -346,7 +346,7 @@ out:
+ 
+ 	regmap_async_complete(map);
+ 
+-	trace_regcache_sync(map->dev, name, "stop");
++	trace_regcache_sync(map, name, "stop");
+ 
+ 	return ret;
+ }
+@@ -381,7 +381,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
+ 	name = map->cache_ops->name;
+ 	dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
+ 
+-	trace_regcache_sync(map->dev, name, "start region");
++	trace_regcache_sync(map, name, "start region");
+ 
+ 	if (!map->cache_dirty)
+ 		goto out;
+@@ -401,7 +401,7 @@ out:
+ 
+ 	regmap_async_complete(map);
+ 
+-	trace_regcache_sync(map->dev, name, "stop region");
++	trace_regcache_sync(map, name, "stop region");
+ 
+ 	return ret;
+ }
+@@ -428,7 +428,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
+ 
+ 	map->lock(map->lock_arg);
+ 
+-	trace_regcache_drop_region(map->dev, min, max);
++	trace_regcache_drop_region(map, min, max);
+ 
+ 	ret = map->cache_ops->drop(map, min, max);
+ 
+@@ -455,7 +455,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
+ 	map->lock(map->lock_arg);
+ 	WARN_ON(map->cache_bypass && enable);
+ 	map->cache_only = enable;
+-	trace_regmap_cache_only(map->dev, enable);
++	trace_regmap_cache_only(map, enable);
+ 	map->unlock(map->lock_arg);
+ }
+ EXPORT_SYMBOL_GPL(regcache_cache_only);
+@@ -493,7 +493,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
+ 	map->lock(map->lock_arg);
+ 	WARN_ON(map->cache_only && enable);
+ 	map->cache_bypass = enable;
+-	trace_regmap_cache_bypass(map->dev, enable);
++	trace_regmap_cache_bypass(map, enable);
+ 	map->unlock(map->lock_arg);
+ }
+ EXPORT_SYMBOL_GPL(regcache_cache_bypass);
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index d2f8a81..ee731bb 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1280,7 +1280,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ 	if (map->async && map->bus->async_write) {
+ 		struct regmap_async *async;
+ 
+-		trace_regmap_async_write_start(map->dev, reg, val_len);
++		trace_regmap_async_write_start(map, reg, val_len);
+ 
+ 		spin_lock_irqsave(&map->async_lock, flags);
+ 		async = list_first_entry_or_null(&map->async_free,
+@@ -1338,8 +1338,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ 		return ret;
+ 	}
+ 
+-	trace_regmap_hw_write_start(map->dev, reg,
+-				    val_len / map->format.val_bytes);
++	trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
+ 
+ 	/* If we're doing a single register write we can probably just
+ 	 * send the work_buf directly, otherwise try to do a gather
+@@ -1371,8 +1370,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ 		kfree(buf);
+ 	}
+ 
+-	trace_regmap_hw_write_done(map->dev, reg,
+-				   val_len / map->format.val_bytes);
++	trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
+ 
+ 	return ret;
+ }
+@@ -1406,12 +1404,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
+ 
+ 	map->format.format_write(map, reg, val);
+ 
+-	trace_regmap_hw_write_start(map->dev, reg, 1);
++	trace_regmap_hw_write_start(map, reg, 1);
+ 
+ 	ret = map->bus->write(map->bus_context, map->work_buf,
+ 			      map->format.buf_size);
+ 
+-	trace_regmap_hw_write_done(map->dev, reg, 1);
++	trace_regmap_hw_write_done(map, reg, 1);
+ 
+ 	return ret;
+ }
+@@ -1469,7 +1467,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
+ 		dev_info(map->dev, "%x <= %x\n", reg, val);
+ #endif
+ 
+-	trace_regmap_reg_write(map->dev, reg, val);
++	trace_regmap_reg_write(map, reg, val);
+ 
+ 	return map->reg_write(context, reg, val);
+ }
+@@ -1772,7 +1770,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
+ 	for (i = 0; i < num_regs; i++) {
+ 		int reg = regs[i].reg;
+ 		int val = regs[i].def;
+-		trace_regmap_hw_write_start(map->dev, reg, 1);
++		trace_regmap_hw_write_start(map, reg, 1);
+ 		map->format.format_reg(u8, reg, map->reg_shift);
+ 		u8 += reg_bytes + pad_bytes;
+ 		map->format.format_val(u8, val, 0);
+@@ -1787,7 +1785,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
+ 
+ 	for (i = 0; i < num_regs; i++) {
+ 		int reg = regs[i].reg;
+-		trace_regmap_hw_write_done(map->dev, reg, 1);
++		trace_regmap_hw_write_done(map, reg, 1);
+ 	}
+ 	return ret;
+ }
+@@ -2058,15 +2056,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+ 	 */
+ 	u8[0] |= map->read_flag_mask;
+ 
+-	trace_regmap_hw_read_start(map->dev, reg,
+-				   val_len / map->format.val_bytes);
++	trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
+ 
+ 	ret = map->bus->read(map->bus_context, map->work_buf,
+ 			     map->format.reg_bytes + map->format.pad_bytes,
+ 			     val, val_len);
+ 
+-	trace_regmap_hw_read_done(map->dev, reg,
+-				  val_len / map->format.val_bytes);
++	trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
+ 
+ 	return ret;
+ }
+@@ -2122,7 +2118,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
+ 			dev_info(map->dev, "%x => %x\n", reg, *val);
+ #endif
+ 
+-		trace_regmap_reg_read(map->dev, reg, *val);
++		trace_regmap_reg_read(map, reg, *val);
+ 
+ 		if (!map->cache_bypass)
+ 			regcache_write(map, reg, *val);
+@@ -2479,7 +2475,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
+ 	struct regmap *map = async->map;
+ 	bool wake;
+ 
+-	trace_regmap_async_io_complete(map->dev);
++	trace_regmap_async_io_complete(map);
+ 
+ 	spin_lock(&map->async_lock);
+ 	list_move(&async->list, &map->async_free);
+@@ -2524,7 +2520,7 @@ int regmap_async_complete(struct regmap *map)
+ 	if (!map->bus || !map->bus->async_write)
+ 		return 0;
+ 
+-	trace_regmap_async_complete_start(map->dev);
++	trace_regmap_async_complete_start(map);
+ 
+ 	wait_event(map->async_waitq, regmap_async_is_done(map));
+ 
+@@ -2533,7 +2529,7 @@ int regmap_async_complete(struct regmap *map)
+ 	map->async_ret = 0;
+ 	spin_unlock_irqrestore(&map->async_lock, flags);
+ 
+-	trace_regmap_async_complete_done(map->dev);
++	trace_regmap_async_complete_done(map);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
+index bba62f9..ec57ba2 100644
+--- a/drivers/clocksource/time-efm32.c
++++ b/drivers/clocksource/time-efm32.c
+@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
+ 	clock_event_ddata.base = base;
+ 	clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
+ 
+-	setup_irq(irq, &efm32_clock_event_irq);
+-
+ 	clockevents_config_and_register(&clock_event_ddata.evtdev,
+ 					DIV_ROUND_CLOSEST(rate, 1024),
+ 					0xf, 0xffff);
+ 
++	setup_irq(irq, &efm32_clock_event_irq);
++
+ 	return 0;
+ 
+ err_get_irq:
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 0226844..5dcbf90 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -178,10 +178,6 @@ static void __init sun5i_timer_init(struct device_node *node)
+ 
+ 	ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+ 
+-	ret = setup_irq(irq, &sun5i_timer_irq);
+-	if (ret)
+-		pr_warn("failed to setup irq %d\n", irq);
+-
+ 	/* Enable timer0 interrupt */
+ 	val = readl(timer_base + TIMER_IRQ_EN_REG);
+ 	writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+@@ -191,6 +187,10 @@ static void __init sun5i_timer_init(struct device_node *node)
+ 
+ 	clockevents_config_and_register(&sun5i_clockevent, rate,
+ 					TIMER_SYNC_TICKS, 0xffffffff);
++
++	ret = setup_irq(irq, &sun5i_timer_irq);
++	if (ret)
++		pr_warn("failed to setup irq %d\n", irq);
+ }
+ CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
+ 		       sun5i_timer_init);
+diff --git a/drivers/cpuidle/cpuidle-mvebu-v7.c b/drivers/cpuidle/cpuidle-mvebu-v7.c
+index 38e6861..cefa074 100644
+--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
++++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
+@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cpuidle_device *dev,
+ 		deepidle = true;
+ 
+ 	ret = mvebu_v7_cpu_suspend(deepidle);
++	cpu_pm_exit();
++
+ 	if (ret)
+ 		return ret;
+ 
+-	cpu_pm_exit();
+-
+ 	return index;
+ }
+ 
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 32ea1ac..272f01f 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -26,6 +26,8 @@
+ 
+ #include "internal.h"
+ 
++#define DRV_NAME	"dw_dmac"
++
+ static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
+ 					struct of_dma *ofdma)
+ {
+@@ -284,7 +286,7 @@ static struct platform_driver dw_driver = {
+ 	.remove		= dw_remove,
+ 	.shutdown       = dw_shutdown,
+ 	.driver = {
+-		.name	= "dw_dmac",
++		.name	= DRV_NAME,
+ 		.pm	= &dw_dev_pm_ops,
+ 		.of_match_table = of_match_ptr(dw_dma_of_id_table),
+ 		.acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
+@@ -305,3 +307,4 @@ module_exit(dw_exit);
+ 
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
++MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 23e26e0..2176874 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -120,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
+ 
+ static bool cr48_profile_sensor;
+ 
++#define ANY_BOARD_ID 0
+ struct min_max_quirk {
+ 	const char * const *pnp_ids;
++	struct {
++		unsigned long int min, max;
++	} board_id;
+ 	int x_min, x_max, y_min, y_max;
+ };
+ 
+ static const struct min_max_quirk min_max_pnpid_table[] = {
+ 	{
+ 		(const char * const []){"LEN0033", NULL},
++		{ANY_BOARD_ID, ANY_BOARD_ID},
+ 		1024, 5052, 2258, 4832
+ 	},
+ 	{
+-		(const char * const []){"LEN0035", "LEN0042", NULL},
++		(const char * const []){"LEN0042", NULL},
++		{ANY_BOARD_ID, ANY_BOARD_ID},
+ 		1232, 5710, 1156, 4696
+ 	},
+ 	{
+ 		(const char * const []){"LEN0034", "LEN0036", "LEN0037",
+ 					"LEN0039", "LEN2002", "LEN2004",
+ 					NULL},
++		{ANY_BOARD_ID, 2961},
+ 		1024, 5112, 2024, 4832
+ 	},
+ 	{
+ 		(const char * const []){"LEN2001", NULL},
++		{ANY_BOARD_ID, ANY_BOARD_ID},
+ 		1024, 5022, 2508, 4832
+ 	},
+ 	{
+ 		(const char * const []){"LEN2006", NULL},
++		{ANY_BOARD_ID, ANY_BOARD_ID},
+ 		1264, 5675, 1171, 4688
+ 	},
+ 	{ }
+@@ -241,6 +250,10 @@ static int synaptics_board_id(struct psmouse *psmouse)
+ 	struct synaptics_data *priv = psmouse->private;
+ 	unsigned char bid[3];
+ 
++	/* firmwares prior 7.5 have no board_id encoded */
++	if (SYN_ID_FULL(priv->identity) < 0x705)
++		return 0;
++
+ 	if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
+ 		return -1;
+ 	priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+@@ -343,7 +356,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ {
+ 	struct synaptics_data *priv = psmouse->private;
+ 	unsigned char resp[3];
+-	int i;
+ 
+ 	if (SYN_ID_MAJOR(priv->identity) < 4)
+ 		return 0;
+@@ -355,17 +367,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ 		}
+ 	}
+ 
+-	for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+-		if (psmouse_matches_pnp_id(psmouse,
+-					   min_max_pnpid_table[i].pnp_ids)) {
+-			priv->x_min = min_max_pnpid_table[i].x_min;
+-			priv->x_max = min_max_pnpid_table[i].x_max;
+-			priv->y_min = min_max_pnpid_table[i].y_min;
+-			priv->y_max = min_max_pnpid_table[i].y_max;
+-			return 0;
+-		}
+-	}
+-
+ 	if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
+ 	    SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
+ 		if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
+@@ -374,23 +375,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ 		} else {
+ 			priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
+ 			priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
++			psmouse_info(psmouse,
++				     "queried max coordinates: x [..%d], y [..%d]\n",
++				     priv->x_max, priv->y_max);
+ 		}
+ 	}
+ 
+-	if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
+-	    SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
++	if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
++	    (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
++	     /*
++	      * Firmware v8.1 does not report proper number of extended
++	      * capabilities, but has been proven to report correct min
++	      * coordinates.
++	      */
++	     SYN_ID_FULL(priv->identity) == 0x801)) {
+ 		if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
+ 			psmouse_warn(psmouse,
+ 				     "device claims to have min coordinates query, but I'm not able to read it.\n");
+ 		} else {
+ 			priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
+ 			priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
++			psmouse_info(psmouse,
++				     "queried min coordinates: x [%d..], y [%d..]\n",
++				     priv->x_min, priv->y_min);
+ 		}
+ 	}
+ 
+ 	return 0;
+ }
+ 
++/*
++ * Apply quirk(s) if the hardware matches
++ */
++
++static void synaptics_apply_quirks(struct psmouse *psmouse)
++{
++	struct synaptics_data *priv = psmouse->private;
++	int i;
++
++	for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
++		if (!psmouse_matches_pnp_id(psmouse,
++					    min_max_pnpid_table[i].pnp_ids))
++			continue;
++
++		if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
++		    priv->board_id < min_max_pnpid_table[i].board_id.min)
++			continue;
++
++		if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
++		    priv->board_id > min_max_pnpid_table[i].board_id.max)
++			continue;
++
++		priv->x_min = min_max_pnpid_table[i].x_min;
++		priv->x_max = min_max_pnpid_table[i].x_max;
++		priv->y_min = min_max_pnpid_table[i].y_min;
++		priv->y_max = min_max_pnpid_table[i].y_max;
++		psmouse_info(psmouse,
++			     "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
++			     priv->x_min, priv->x_max,
++			     priv->y_min, priv->y_max);
++		break;
++	}
++}
++
+ static int synaptics_query_hardware(struct psmouse *psmouse)
+ {
+ 	if (synaptics_identify(psmouse))
+@@ -406,6 +453,8 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
+ 	if (synaptics_resolution(psmouse))
+ 		return -1;
+ 
++	synaptics_apply_quirks(psmouse);
++
+ 	return 0;
+ }
+ 
+@@ -613,6 +662,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
+ 	priv->agm_pending = true;
+ }
+ 
++static void synaptics_parse_ext_buttons(const unsigned char buf[],
++					struct synaptics_data *priv,
++					struct synaptics_hw_state *hw)
++{
++	unsigned int ext_bits =
++		(SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++	unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
++
++	hw->ext_buttons = buf[4] & ext_mask;
++	hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
++}
++
+ static bool is_forcepad;
+ 
+ static int synaptics_parse_hw_state(const unsigned char buf[],
+@@ -699,28 +760,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ 			hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ 		}
+ 
+-		if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
++		if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
+ 		    ((buf[0] ^ buf[3]) & 0x02)) {
+-			switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+-			default:
+-				/*
+-				 * if nExtBtn is greater than 8 it should be
+-				 * considered invalid and treated as 0
+-				 */
+-				break;
+-			case 8:
+-				hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
+-				hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
+-			case 6:
+-				hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
+-				hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
+-			case 4:
+-				hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
+-				hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
+-			case 2:
+-				hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
+-				hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
+-			}
++			synaptics_parse_ext_buttons(buf, priv, hw);
+ 		}
+ 	} else {
+ 		hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
+@@ -782,12 +824,35 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
+ 	}
+ }
+ 
++static void synaptics_report_ext_buttons(struct psmouse *psmouse,
++					 const struct synaptics_hw_state *hw)
++{
++	struct input_dev *dev = psmouse->dev;
++	struct synaptics_data *priv = psmouse->private;
++	int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++	int i;
++
++	if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
++		return;
++
++	/* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
++	if (SYN_ID_FULL(priv->identity) == 0x801 &&
++	    !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
++		return;
++
++	for (i = 0; i < ext_bits; i++) {
++		input_report_key(dev, BTN_0 + 2 * i,
++			hw->ext_buttons & (1 << i));
++		input_report_key(dev, BTN_1 + 2 * i,
++			hw->ext_buttons & (1 << (i + ext_bits)));
++	}
++}
++
+ static void synaptics_report_buttons(struct psmouse *psmouse,
+ 				     const struct synaptics_hw_state *hw)
+ {
+ 	struct input_dev *dev = psmouse->dev;
+ 	struct synaptics_data *priv = psmouse->private;
+-	int i;
+ 
+ 	input_report_key(dev, BTN_LEFT, hw->left);
+ 	input_report_key(dev, BTN_RIGHT, hw->right);
+@@ -800,8 +865,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
+ 		input_report_key(dev, BTN_BACK, hw->down);
+ 	}
+ 
+-	for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+-		input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
++	synaptics_report_ext_buttons(psmouse, hw);
+ }
+ 
+ static void synaptics_report_slot(struct input_dev *dev, int slot,
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index 37de017..74adcd2 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -289,9 +289,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ 	struct request_queue *q = bdev_get_queue(where->bdev);
+ 	unsigned short logical_block_size = queue_logical_block_size(q);
+ 	sector_t num_sectors;
++	unsigned int uninitialized_var(special_cmd_max_sectors);
+ 
+-	/* Reject unsupported discard requests */
+-	if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
++	/*
++	 * Reject unsupported discard and write same requests.
++	 */
++	if (rw & REQ_DISCARD)
++		special_cmd_max_sectors = q->limits.max_discard_sectors;
++	else if (rw & REQ_WRITE_SAME)
++		special_cmd_max_sectors = q->limits.max_write_same_sectors;
++	if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+ 		dec_count(io, region, -EOPNOTSUPP);
+ 		return;
+ 	}
+@@ -317,7 +324,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ 		store_io_and_region_in_bio(bio, io, region);
+ 
+ 		if (rw & REQ_DISCARD) {
+-			num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++			num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ 			bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ 			remaining -= num_sectors;
+ 		} else if (rw & REQ_WRITE_SAME) {
+@@ -326,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ 			 */
+ 			dp->get_page(dp, &page, &len, &offset);
+ 			bio_add_page(bio, page, logical_block_size, offset);
+-			num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
++			num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ 			bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ 
+ 			offset = 0;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 8b204ae2..f83a0f3 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -20,6 +20,8 @@
+ #include <linux/log2.h>
+ #include <linux/dm-kcopyd.h>
+ 
++#include "dm.h"
++
+ #include "dm-exception-store.h"
+ 
+ #define DM_MSG_PREFIX "snapshots"
+@@ -291,12 +293,23 @@ struct origin {
+ };
+ 
+ /*
++ * This structure is allocated for each origin target
++ */
++struct dm_origin {
++	struct dm_dev *dev;
++	struct dm_target *ti;
++	unsigned split_boundary;
++	struct list_head hash_list;
++};
++
++/*
+  * Size of the hash table for origin volumes. If we make this
+  * the size of the minors list then it should be nearly perfect
+  */
+ #define ORIGIN_HASH_SIZE 256
+ #define ORIGIN_MASK      0xFF
+ static struct list_head *_origins;
++static struct list_head *_dm_origins;
+ static struct rw_semaphore _origins_lock;
+ 
+ static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
+@@ -310,12 +323,22 @@ static int init_origin_hash(void)
+ 	_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+ 			   GFP_KERNEL);
+ 	if (!_origins) {
+-		DMERR("unable to allocate memory");
++		DMERR("unable to allocate memory for _origins");
+ 		return -ENOMEM;
+ 	}
+-
+ 	for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+ 		INIT_LIST_HEAD(_origins + i);
++
++	_dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
++			      GFP_KERNEL);
++	if (!_dm_origins) {
++		DMERR("unable to allocate memory for _dm_origins");
++		kfree(_origins);
++		return -ENOMEM;
++	}
++	for (i = 0; i < ORIGIN_HASH_SIZE; i++)
++		INIT_LIST_HEAD(_dm_origins + i);
++
+ 	init_rwsem(&_origins_lock);
+ 
+ 	return 0;
+@@ -324,6 +347,7 @@ static int init_origin_hash(void)
+ static void exit_origin_hash(void)
+ {
+ 	kfree(_origins);
++	kfree(_dm_origins);
+ }
+ 
+ static unsigned origin_hash(struct block_device *bdev)
+@@ -350,6 +374,30 @@ static void __insert_origin(struct origin *o)
+ 	list_add_tail(&o->hash_list, sl);
+ }
+ 
++static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
++{
++	struct list_head *ol;
++	struct dm_origin *o;
++
++	ol = &_dm_origins[origin_hash(origin)];
++	list_for_each_entry (o, ol, hash_list)
++		if (bdev_equal(o->dev->bdev, origin))
++			return o;
++
++	return NULL;
++}
++
++static void __insert_dm_origin(struct dm_origin *o)
++{
++	struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
++	list_add_tail(&o->hash_list, sl);
++}
++
++static void __remove_dm_origin(struct dm_origin *o)
++{
++	list_del(&o->hash_list);
++}
++
+ /*
+  * _origins_lock must be held when calling this function.
+  * Returns number of snapshots registered using the supplied cow device, plus:
+@@ -1840,9 +1888,40 @@ static int snapshot_preresume(struct dm_target *ti)
+ static void snapshot_resume(struct dm_target *ti)
+ {
+ 	struct dm_snapshot *s = ti->private;
+-	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
++	struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
++	struct dm_origin *o;
++	struct mapped_device *origin_md = NULL;
++	bool must_restart_merging = false;
+ 
+ 	down_read(&_origins_lock);
++
++	o = __lookup_dm_origin(s->origin->bdev);
++	if (o)
++		origin_md = dm_table_get_md(o->ti->table);
++	if (!origin_md) {
++		(void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
++		if (snap_merging)
++			origin_md = dm_table_get_md(snap_merging->ti->table);
++	}
++	if (origin_md == dm_table_get_md(ti->table))
++		origin_md = NULL;
++	if (origin_md) {
++		if (dm_hold(origin_md))
++			origin_md = NULL;
++	}
++
++	up_read(&_origins_lock);
++
++	if (origin_md) {
++		dm_internal_suspend_fast(origin_md);
++		if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
++			must_restart_merging = true;
++			stop_merge(snap_merging);
++		}
++	}
++
++	down_read(&_origins_lock);
++
+ 	(void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+ 	if (snap_src && snap_dest) {
+ 		down_write(&snap_src->lock);
+@@ -1851,8 +1930,16 @@ static void snapshot_resume(struct dm_target *ti)
+ 		up_write(&snap_dest->lock);
+ 		up_write(&snap_src->lock);
+ 	}
++
+ 	up_read(&_origins_lock);
+ 
++	if (origin_md) {
++		if (must_restart_merging)
++			start_merge(snap_merging);
++		dm_internal_resume_fast(origin_md);
++		dm_put(origin_md);
++	}
++
+ 	/* Now we have correct chunk size, reregister */
+ 	reregister_snapshot(s);
+ 
+@@ -2133,11 +2220,6 @@ static int origin_write_extent(struct dm_snapshot *merging_snap,
+  * Origin: maps a linear range of a device, with hooks for snapshotting.
+  */
+ 
+-struct dm_origin {
+-	struct dm_dev *dev;
+-	unsigned split_boundary;
+-};
+-
+ /*
+  * Construct an origin mapping: <dev_path>
+  * The context for an origin is merely a 'struct dm_dev *'
+@@ -2166,6 +2248,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 		goto bad_open;
+ 	}
+ 
++	o->ti = ti;
+ 	ti->private = o;
+ 	ti->num_flush_bios = 1;
+ 
+@@ -2180,6 +2263,7 @@ bad_alloc:
+ static void origin_dtr(struct dm_target *ti)
+ {
+ 	struct dm_origin *o = ti->private;
++
+ 	dm_put_device(ti, o->dev);
+ 	kfree(o);
+ }
+@@ -2216,6 +2300,19 @@ static void origin_resume(struct dm_target *ti)
+ 	struct dm_origin *o = ti->private;
+ 
+ 	o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
++
++	down_write(&_origins_lock);
++	__insert_dm_origin(o);
++	up_write(&_origins_lock);
++}
++
++static void origin_postsuspend(struct dm_target *ti)
++{
++	struct dm_origin *o = ti->private;
++
++	down_write(&_origins_lock);
++	__remove_dm_origin(o);
++	up_write(&_origins_lock);
+ }
+ 
+ static void origin_status(struct dm_target *ti, status_type_t type,
+@@ -2258,12 +2355,13 @@ static int origin_iterate_devices(struct dm_target *ti,
+ 
+ static struct target_type origin_target = {
+ 	.name    = "snapshot-origin",
+-	.version = {1, 8, 1},
++	.version = {1, 9, 0},
+ 	.module  = THIS_MODULE,
+ 	.ctr     = origin_ctr,
+ 	.dtr     = origin_dtr,
+ 	.map     = origin_map,
+ 	.resume  = origin_resume,
++	.postsuspend = origin_postsuspend,
+ 	.status  = origin_status,
+ 	.merge	 = origin_merge,
+ 	.iterate_devices = origin_iterate_devices,
+@@ -2271,7 +2369,7 @@ static struct target_type origin_target = {
+ 
+ static struct target_type snapshot_target = {
+ 	.name    = "snapshot",
+-	.version = {1, 12, 0},
++	.version = {1, 13, 0},
+ 	.module  = THIS_MODULE,
+ 	.ctr     = snapshot_ctr,
+ 	.dtr     = snapshot_dtr,
+@@ -2285,7 +2383,7 @@ static struct target_type snapshot_target = {
+ 
+ static struct target_type merge_target = {
+ 	.name    = dm_snapshot_merge_target_name,
+-	.version = {1, 2, 0},
++	.version = {1, 3, 0},
+ 	.module  = THIS_MODULE,
+ 	.ctr     = snapshot_ctr,
+ 	.dtr     = snapshot_dtr,
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 07705ee..159a113 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2357,17 +2357,6 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ 		return DM_MAPIO_REMAPPED;
+ 
+ 	case -ENODATA:
+-		if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
+-			/*
+-			 * This block isn't provisioned, and we have no way
+-			 * of doing so.
+-			 */
+-			handle_unserviceable_bio(tc->pool, bio);
+-			cell_defer_no_holder(tc, virt_cell);
+-			return DM_MAPIO_SUBMITTED;
+-		}
+-		/* fall through */
+-
+ 	case -EWOULDBLOCK:
+ 		thin_defer_cell(tc, virt_cell);
+ 		return DM_MAPIO_SUBMITTED;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 64b10e0..b71c600 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2507,6 +2507,19 @@ void dm_get(struct mapped_device *md)
+ 	BUG_ON(test_bit(DMF_FREEING, &md->flags));
+ }
+ 
++int dm_hold(struct mapped_device *md)
++{
++	spin_lock(&_minor_lock);
++	if (test_bit(DMF_FREEING, &md->flags)) {
++		spin_unlock(&_minor_lock);
++		return -EBUSY;
++	}
++	dm_get(md);
++	spin_unlock(&_minor_lock);
++	return 0;
++}
++EXPORT_SYMBOL_GPL(dm_hold);
++
+ const char *dm_device_name(struct mapped_device *md)
+ {
+ 	return md->name;
+@@ -2526,10 +2539,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ 	set_bit(DMF_FREEING, &md->flags);
+ 	spin_unlock(&_minor_lock);
+ 
++	/*
++	 * Take suspend_lock so that presuspend and postsuspend methods
++	 * do not race with internal suspend.
++	 */
++	mutex_lock(&md->suspend_lock);
+ 	if (!dm_suspended_md(md)) {
+ 		dm_table_presuspend_targets(map);
+ 		dm_table_postsuspend_targets(map);
+ 	}
++	mutex_unlock(&md->suspend_lock);
+ 
+ 	/* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+ 	dm_put_live_table(md, srcu_idx);
+@@ -3001,6 +3020,7 @@ void dm_internal_suspend_fast(struct mapped_device *md)
+ 	flush_workqueue(md->wq);
+ 	dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
+ }
++EXPORT_SYMBOL_GPL(dm_internal_suspend_fast);
+ 
+ void dm_internal_resume_fast(struct mapped_device *md)
+ {
+@@ -3012,6 +3032,7 @@ void dm_internal_resume_fast(struct mapped_device *md)
+ done:
+ 	mutex_unlock(&md->suspend_lock);
+ }
++EXPORT_SYMBOL_GPL(dm_internal_resume_fast);
+ 
+ /*-----------------------------------------------------------------
+  * Event notification.
+diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
+index f38ec42..5615522 100644
+--- a/drivers/mfd/kempld-core.c
++++ b/drivers/mfd/kempld-core.c
+@@ -739,7 +739,7 @@ static int __init kempld_init(void)
+ 		for (id = kempld_dmi_table;
+ 		     id->matches[0].slot != DMI_NONE; id++)
+ 			if (strstr(id->ident, force_device_id))
+-				if (id->callback && id->callback(id))
++				if (id->callback && !id->callback(id))
+ 					break;
+ 		if (id->matches[0].slot == DMI_NONE)
+ 			return -ENODEV;
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index e2e3aaf..30f088b 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ {
+ 	struct pcnet32_private *lp;
+ 	int i, media;
+-	int fdx, mii, fset, dxsuflo;
++	int fdx, mii, fset, dxsuflo, sram;
+ 	int chip_version;
+ 	char *chipname;
+ 	struct net_device *dev;
+@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 	}
+ 
+ 	/* initialize variables */
+-	fdx = mii = fset = dxsuflo = 0;
++	fdx = mii = fset = dxsuflo = sram = 0;
+ 	chip_version = (chip_version >> 12) & 0xffff;
+ 
+ 	switch (chip_version) {
+@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 		chipname = "PCnet/FAST III 79C973";	/* PCI */
+ 		fdx = 1;
+ 		mii = 1;
++		sram = 1;
+ 		break;
+ 	case 0x2626:
+ 		chipname = "PCnet/Home 79C978";	/* PCI */
+@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 		chipname = "PCnet/FAST III 79C975";	/* PCI */
+ 		fdx = 1;
+ 		mii = 1;
++		sram = 1;
+ 		break;
+ 	case 0x2628:
+ 		chipname = "PCnet/PRO 79C976";
+@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ 		dxsuflo = 1;
+ 	}
+ 
++	/*
++	 * The Am79C973/Am79C975 controllers come with 12K of SRAM
++	 * which we can use for the Tx/Rx buffers but most importantly,
++	 * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
++	 * Tx fifo underflows.
++	 */
++	if (sram) {
++		/*
++		 * The SRAM is being configured in two steps. First we
++		 * set the SRAM size in the BCR25:SRAM_SIZE bits. According
++		 * to the datasheet, each bit corresponds to a 512-byte
++		 * page so we can have at most 24 pages. The SRAM_SIZE
++		 * holds the value of the upper 8 bits of the 16-bit SRAM size.
++		 * The low 8-bits start at 0x00 and end at 0xff. So the
++		 * address range is from 0x0000 up to 0x17ff. Therefore,
++		 * the SRAM_SIZE is set to 0x17. The next step is to set
++		 * the BCR26:SRAM_BND midway through so the Tx and Rx
++		 * buffers can share the SRAM equally.
++		 */
++		a->write_bcr(ioaddr, 25, 0x17);
++		a->write_bcr(ioaddr, 26, 0xc);
++		/* And finally enable the NOUFLO bit */
++		a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
++	}
++
+ 	dev = alloc_etherdev(sizeof(*lp));
+ 	if (!dev) {
+ 		ret = -ENOMEM;
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+index 50cdf70..8eff275 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
+ 	void *dcmd_buf = NULL, *wr_pointer;
+ 	u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
+ 
+-	brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
+-		  cmdhdr->len);
++	if (len < sizeof(*cmdhdr)) {
++		brcmf_err("vendor command too short: %d\n", len);
++		return -EINVAL;
++	}
+ 
+ 	vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+ 	ifp = vif->ifp;
+ 
+-	len -= sizeof(struct brcmf_vndr_dcmd_hdr);
++	brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
++
++	if (cmdhdr->offset > len) {
++		brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
++		return -EINVAL;
++	}
++
++	len -= cmdhdr->offset;
+ 	ret_len = cmdhdr->len;
+ 	if (ret_len > 0 || len > 0) {
+ 		if (len > BRCMF_DCMD_MAXLEN) {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
+index c3817fa..06f6cc0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
+@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
+ 	.nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION,	\
+ 	.base_params = &iwl1000_base_params,			\
+ 	.eeprom_params = &iwl1000_eeprom_params,		\
+-	.led_mode = IWL_LED_BLINK
++	.led_mode = IWL_LED_BLINK,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl1000_bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
+@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
+ 	.base_params = &iwl1000_base_params,			\
+ 	.eeprom_params = &iwl1000_eeprom_params,		\
+ 	.led_mode = IWL_LED_RF_STATE,				\
+-	.rx_with_siso_diversity = true
++	.rx_with_siso_diversity = true,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl100_bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
+diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
+index 21e5d08..890b95f 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
+@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
+ 	.nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,		\
+ 	.base_params = &iwl2000_base_params,			\
+ 	.eeprom_params = &iwl20x0_eeprom_params,		\
+-	.led_mode = IWL_LED_RF_STATE
++	.led_mode = IWL_LED_RF_STATE,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
++
+ 
+ const struct iwl_cfg iwl2000_2bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
+@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
+ 	.nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,	\
+ 	.base_params = &iwl2030_base_params,			\
+ 	.eeprom_params = &iwl20x0_eeprom_params,		\
+-	.led_mode = IWL_LED_RF_STATE
++	.led_mode = IWL_LED_RF_STATE,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl2030_2bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
+@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
+ 	.base_params = &iwl2000_base_params,			\
+ 	.eeprom_params = &iwl20x0_eeprom_params,		\
+ 	.led_mode = IWL_LED_RF_STATE,				\
+-	.rx_with_siso_diversity = true
++	.rx_with_siso_diversity = true,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl105_bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
+@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
+ 	.base_params = &iwl2030_base_params,			\
+ 	.eeprom_params = &iwl20x0_eeprom_params,		\
+ 	.led_mode = IWL_LED_RF_STATE,				\
+-	.rx_with_siso_diversity = true
++	.rx_with_siso_diversity = true,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl135_bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 332bbede..724194e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
+ 	.nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION,	\
+ 	.base_params = &iwl5000_base_params,			\
+ 	.eeprom_params = &iwl5000_eeprom_params,		\
+-	.led_mode = IWL_LED_BLINK
++	.led_mode = IWL_LED_BLINK,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl5300_agn_cfg = {
+ 	.name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
+@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
+ 	.base_params = &iwl5000_base_params,			\
+ 	.eeprom_params = &iwl5000_eeprom_params,		\
+ 	.led_mode = IWL_LED_BLINK,				\
+-	.internal_wimax_coex = true
++	.internal_wimax_coex = true,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl5150_agn_cfg = {
+ 	.name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
+diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
+index 8f2c3c8..21b2630 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
+ 	.nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,	\
+ 	.base_params = &iwl6000_g2_base_params,			\
+ 	.eeprom_params = &iwl6000_eeprom_params,		\
+-	.led_mode = IWL_LED_RF_STATE
++	.led_mode = IWL_LED_RF_STATE,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl6005_2agn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
+@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
+ 	.nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,	\
+ 	.base_params = &iwl6000_g2_base_params,			\
+ 	.eeprom_params = &iwl6000_eeprom_params,		\
+-	.led_mode = IWL_LED_RF_STATE
++	.led_mode = IWL_LED_RF_STATE,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl6030_2agn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
+@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
+ 	.nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,	\
+ 	.base_params = &iwl6000_g2_base_params,			\
+ 	.eeprom_params = &iwl6000_eeprom_params,		\
+-	.led_mode = IWL_LED_RF_STATE
++	.led_mode = IWL_LED_RF_STATE,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl6035_2agn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
+@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
+ 	.nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION,	\
+ 	.base_params = &iwl6000_base_params,			\
+ 	.eeprom_params = &iwl6000_eeprom_params,		\
+-	.led_mode = IWL_LED_BLINK
++	.led_mode = IWL_LED_BLINK,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl6000i_2agn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
+@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
+ 	.base_params = &iwl6050_base_params,			\
+ 	.eeprom_params = &iwl6000_eeprom_params,		\
+ 	.led_mode = IWL_LED_BLINK,				\
+-	.internal_wimax_coex = true
++	.internal_wimax_coex = true,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl6050_2agn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
+@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
+ 	.base_params = &iwl6050_base_params,			\
+ 	.eeprom_params = &iwl6000_eeprom_params,		\
+ 	.led_mode = IWL_LED_BLINK,				\
+-	.internal_wimax_coex = true
++	.internal_wimax_coex = true,				\
++	.max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+ 
+ const struct iwl_cfg iwl6150_bgn_cfg = {
+ 	.name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
+diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
+index a3bfda4..ae5a4ec 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
++++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
+@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
+ 	if (!vif->bss_conf.assoc)
+ 		smps_mode = IEEE80211_SMPS_AUTOMATIC;
+ 
+-	if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
++	if (mvmvif->phy_ctxt &&
++	    IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+ 			       mvmvif->phy_ctxt->id))
+ 		smps_mode = IEEE80211_SMPS_AUTOMATIC;
+ 
+diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+index b3210cf..d804585 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
++++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
+ 	if (!vif->bss_conf.assoc)
+ 		smps_mode = IEEE80211_SMPS_AUTOMATIC;
+ 
+-	if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
++	if (mvmvif->phy_ctxt &&
++	    data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+ 		smps_mode = IEEE80211_SMPS_AUTOMATIC;
+ 
+ 	IWL_DEBUG_COEX(data->mvm,
+diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
+index 30ceb67..1a03270 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -146,9 +146,12 @@ enum rs_column_mode {
+ #define MAX_NEXT_COLUMNS 7
+ #define MAX_COLUMN_CHECKS 3
+ 
++struct rs_tx_column;
++
+ typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
+ 				     struct ieee80211_sta *sta,
+-				     struct iwl_scale_tbl_info *tbl);
++				     struct iwl_scale_tbl_info *tbl,
++				     const struct rs_tx_column *next_col);
+ 
+ struct rs_tx_column {
+ 	enum rs_column_mode mode;
+@@ -159,13 +162,15 @@ struct rs_tx_column {
+ };
+ 
+ static bool rs_ant_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+-			 struct iwl_scale_tbl_info *tbl)
++			 struct iwl_scale_tbl_info *tbl,
++			 const struct rs_tx_column *next_col)
+ {
+-	return iwl_mvm_bt_coex_is_ant_avail(mvm, tbl->rate.ant);
++	return iwl_mvm_bt_coex_is_ant_avail(mvm, next_col->ant);
+ }
+ 
+ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+-			  struct iwl_scale_tbl_info *tbl)
++			  struct iwl_scale_tbl_info *tbl,
++			  const struct rs_tx_column *next_col)
+ {
+ 	if (!sta->ht_cap.ht_supported)
+ 		return false;
+@@ -183,7 +188,8 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ }
+ 
+ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+-			  struct iwl_scale_tbl_info *tbl)
++			  struct iwl_scale_tbl_info *tbl,
++			  const struct rs_tx_column *next_col)
+ {
+ 	if (!sta->ht_cap.ht_supported)
+ 		return false;
+@@ -192,7 +198,8 @@ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ }
+ 
+ static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+-			 struct iwl_scale_tbl_info *tbl)
++			 struct iwl_scale_tbl_info *tbl,
++			 const struct rs_tx_column *next_col)
+ {
+ 	struct rs_rate *rate = &tbl->rate;
+ 	struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+@@ -1594,7 +1601,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
+ 
+ 		for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
+ 			allow_func = next_col->checks[j];
+-			if (allow_func && !allow_func(mvm, sta, tbl))
++			if (allow_func && !allow_func(mvm, sta, tbl, next_col))
+ 				break;
+ 		}
+ 
+diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
+index 54fafbf..f8d6f30 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
+@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
+ 	 * request
+ 	 */
+ 	list_for_each_entry(te_data, &mvm->time_event_list, list) {
+-		if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
+-		    te_data->running) {
++		if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
+ 			mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+ 			is_p2p = true;
+ 			goto remove_te;
+@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
+ 	 * request
+ 	 */
+ 	list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
+-		if (te_data->running) {
+-			mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+-			goto remove_te;
+-		}
++		mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
++		goto remove_te;
+ 	}
+ 
+ remove_te:
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index 40b6d1d..af24869 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1314,8 +1314,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ 		}
+ 
+ 		return true;
+-	} else if (0x86DD == ether_type) {
+-		return true;
++	} else if (ETH_P_IPV6 == ether_type) {
++		/* TODO: Handle any IPv6 cases that need special handling.
++		 * For now, always return false
++		 */
++		goto end;
+ 	}
+ 
+ end:
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index 0d77658..1a79806 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ 	struct device_node *p;
+ 	const __be32 *intspec, *tmp, *addr;
+ 	u32 intsize, intlen;
+-	int i, res = -EINVAL;
++	int i, res;
+ 
+ 	pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
+ 
+@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ 
+ 	/* Get size of interrupt specifier */
+ 	tmp = of_get_property(p, "#interrupt-cells", NULL);
+-	if (tmp == NULL)
++	if (tmp == NULL) {
++		res = -EINVAL;
+ 		goto out;
++	}
+ 	intsize = be32_to_cpu(*tmp);
+ 
+ 	pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
+ 
+ 	/* Check index */
+-	if ((index + 1) * intsize > intlen)
++	if ((index + 1) * intsize > intlen) {
++		res = -EINVAL;
+ 		goto out;
++	}
+ 
+ 	/* Copy intspec into irq structure */
+ 	intspec += index * intsize;
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index a12d353..04fc84f 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -52,7 +52,9 @@ static void devm_phy_consume(struct device *dev, void *res)
+ 
+ static int devm_phy_match(struct device *dev, void *res, void *match_data)
+ {
+-	return res == match_data;
++	struct phy **phy = res;
++
++	return *phy == match_data;
+ }
+ 
+ /**
+diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
+index 97b5e4e..63d4033 100644
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -73,7 +73,7 @@
+ 
+ #define TIME_WINDOW_MAX_MSEC 40000
+ #define TIME_WINDOW_MIN_MSEC 250
+-
++#define ENERGY_UNIT_SCALE    1000 /* scale from driver unit to powercap unit */
+ enum unit_type {
+ 	ARBITRARY_UNIT, /* no translation */
+ 	POWER_UNIT,
+@@ -158,6 +158,7 @@ struct rapl_domain {
+ 	struct rapl_power_limit rpl[NR_POWER_LIMITS];
+ 	u64 attr_map; /* track capabilities */
+ 	unsigned int state;
++	unsigned int domain_energy_unit;
+ 	int package_id;
+ };
+ #define power_zone_to_rapl_domain(_zone) \
+@@ -190,6 +191,7 @@ struct rapl_defaults {
+ 	void (*set_floor_freq)(struct rapl_domain *rd, bool mode);
+ 	u64 (*compute_time_window)(struct rapl_package *rp, u64 val,
+ 				bool to_raw);
++	unsigned int dram_domain_energy_unit;
+ };
+ static struct rapl_defaults *rapl_defaults;
+ 
+@@ -227,7 +229,8 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
+ static int rapl_write_data_raw(struct rapl_domain *rd,
+ 			enum rapl_primitives prim,
+ 			unsigned long long value);
+-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
++static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
++			enum unit_type type, u64 value,
+ 			int to_raw);
+ static void package_power_limit_irq_save(int package_id);
+ 
+@@ -305,7 +308,9 @@ static int get_energy_counter(struct powercap_zone *power_zone, u64 *energy_raw)
+ 
+ static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
+ {
+-	*energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
++	struct rapl_domain *rd = power_zone_to_rapl_domain(pcd_dev);
++
++	*energy = rapl_unit_xlate(rd, 0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+ 	return 0;
+ }
+ 
+@@ -639,6 +644,11 @@ static void rapl_init_domains(struct rapl_package *rp)
+ 			rd->msrs[4] = MSR_DRAM_POWER_INFO;
+ 			rd->rpl[0].prim_id = PL1_ENABLE;
+ 			rd->rpl[0].name = pl1_name;
++			rd->domain_energy_unit =
++				rapl_defaults->dram_domain_energy_unit;
++			if (rd->domain_energy_unit)
++				pr_info("DRAM domain energy unit %dpj\n",
++					rd->domain_energy_unit);
+ 			break;
+ 		}
+ 		if (mask) {
+@@ -648,11 +658,13 @@ static void rapl_init_domains(struct rapl_package *rp)
+ 	}
+ }
+ 
+-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
++static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
++			enum unit_type type, u64 value,
+ 			int to_raw)
+ {
+ 	u64 units = 1;
+ 	struct rapl_package *rp;
++	u64 scale = 1;
+ 
+ 	rp = find_package_by_id(package);
+ 	if (!rp)
+@@ -663,7 +675,12 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+ 		units = rp->power_unit;
+ 		break;
+ 	case ENERGY_UNIT:
+-		units = rp->energy_unit;
++		scale = ENERGY_UNIT_SCALE;
++		/* per domain unit takes precedence */
++		if (rd && rd->domain_energy_unit)
++			units = rd->domain_energy_unit;
++		else
++			units = rp->energy_unit;
+ 		break;
+ 	case TIME_UNIT:
+ 		return rapl_defaults->compute_time_window(rp, value, to_raw);
+@@ -673,11 +690,11 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+ 	};
+ 
+ 	if (to_raw)
+-		return div64_u64(value, units);
++		return div64_u64(value, units) * scale;
+ 
+ 	value *= units;
+ 
+-	return value;
++	return div64_u64(value, scale);
+ }
+ 
+ /* in the order of enum rapl_primitives */
+@@ -773,7 +790,7 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
+ 	final = value & rp->mask;
+ 	final = final >> rp->shift;
+ 	if (xlate)
+-		*data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
++		*data = rapl_unit_xlate(rd, rd->package_id, rp->unit, final, 0);
+ 	else
+ 		*data = final;
+ 
+@@ -799,7 +816,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
+ 			"failed to read msr 0x%x on cpu %d\n", msr, cpu);
+ 		return -EIO;
+ 	}
+-	value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
++	value = rapl_unit_xlate(rd, rd->package_id, rp->unit, value, 1);
+ 	msr_val &= ~rp->mask;
+ 	msr_val |= value << rp->shift;
+ 	if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
+@@ -818,7 +835,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
+  * calculate units differ on different CPUs.
+  * We convert the units to below format based on CPUs.
+  * i.e.
+- * energy unit: microJoules : Represented in microJoules by default
++ * energy unit: picoJoules  : Represented in picoJoules by default
+  * power unit : microWatts  : Represented in milliWatts by default
+  * time unit  : microseconds: Represented in seconds by default
+  */
+@@ -834,7 +851,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
+ 	}
+ 
+ 	value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+-	rp->energy_unit = 1000000 / (1 << value);
++	rp->energy_unit = ENERGY_UNIT_SCALE * 1000000 / (1 << value);
+ 
+ 	value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+ 	rp->power_unit = 1000000 / (1 << value);
+@@ -842,7 +859,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
+ 	value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+ 	rp->time_unit = 1000000 / (1 << value);
+ 
+-	pr_debug("Core CPU package %d energy=%duJ, time=%dus, power=%duW\n",
++	pr_debug("Core CPU package %d energy=%dpJ, time=%dus, power=%duW\n",
+ 		rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
+ 
+ 	return 0;
+@@ -859,7 +876,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
+ 		return -ENODEV;
+ 	}
+ 	value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+-	rp->energy_unit = 1 << value;
++	rp->energy_unit = ENERGY_UNIT_SCALE * 1 << value;
+ 
+ 	value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+ 	rp->power_unit = (1 << value) * 1000;
+@@ -867,7 +884,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
+ 	value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+ 	rp->time_unit = 1000000 / (1 << value);
+ 
+-	pr_debug("Atom package %d energy=%duJ, time=%dus, power=%duW\n",
++	pr_debug("Atom package %d energy=%dpJ, time=%dus, power=%duW\n",
+ 		rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
+ 
+ 	return 0;
+@@ -1017,6 +1034,13 @@ static const struct rapl_defaults rapl_defaults_core = {
+ 	.compute_time_window = rapl_compute_time_window_core,
+ };
+ 
++static const struct rapl_defaults rapl_defaults_hsw_server = {
++	.check_unit = rapl_check_unit_core,
++	.set_floor_freq = set_floor_freq_default,
++	.compute_time_window = rapl_compute_time_window_core,
++	.dram_domain_energy_unit = 15300,
++};
++
+ static const struct rapl_defaults rapl_defaults_atom = {
+ 	.check_unit = rapl_check_unit_atom,
+ 	.set_floor_freq = set_floor_freq_atom,
+@@ -1037,7 +1061,7 @@ static const struct x86_cpu_id rapl_ids[] = {
+ 	RAPL_CPU(0x3a, rapl_defaults_core),/* Ivy Bridge */
+ 	RAPL_CPU(0x3c, rapl_defaults_core),/* Haswell */
+ 	RAPL_CPU(0x3d, rapl_defaults_core),/* Broadwell */
+-	RAPL_CPU(0x3f, rapl_defaults_core),/* Haswell */
++	RAPL_CPU(0x3f, rapl_defaults_hsw_server),/* Haswell servers */
+ 	RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
+ 	RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
+ 	RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index 9205f43..1819831 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
+ 	if (!pmic)
+ 		return -ENOMEM;
+ 
++	if (of_device_is_compatible(node, "ti,tps659038-pmic"))
++		palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
++							TPS659038_REGEN2_CTRL;
++
+ 	pmic->dev = &pdev->dev;
+ 	pmic->palmas = palmas;
+ 	palmas->pmic = pmic;
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 73f9fee..272a264 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -1598,7 +1598,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
+ 	/*
+ 	 * Finally register the new FC Nexus with TCM
+ 	 */
+-	__transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
++	transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index 22ca08a..8076e89 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -108,7 +108,8 @@ static void dw_spi_dma_tx_done(void *arg)
+ {
+ 	struct dw_spi *dws = arg;
+ 
+-	if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
++	clear_bit(TX_BUSY, &dws->dma_chan_busy);
++	if (test_bit(RX_BUSY, &dws->dma_chan_busy))
+ 		return;
+ 	dw_spi_xfer_done(dws);
+ }
+@@ -156,7 +157,8 @@ static void dw_spi_dma_rx_done(void *arg)
+ {
+ 	struct dw_spi *dws = arg;
+ 
+-	if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
++	clear_bit(RX_BUSY, &dws->dma_chan_busy);
++	if (test_bit(TX_BUSY, &dws->dma_chan_busy))
+ 		return;
+ 	dw_spi_xfer_done(dws);
+ }
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index e7fb5a0..e27c12a 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -489,7 +489,7 @@ static int spi_qup_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	struct device *dev;
+ 	void __iomem *base;
+-	u32 max_freq, iomode;
++	u32 max_freq, iomode, num_cs;
+ 	int ret, irq, size;
+ 
+ 	dev = &pdev->dev;
+@@ -541,10 +541,11 @@ static int spi_qup_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	/* use num-cs unless not present or out of range */
+-	if (of_property_read_u16(dev->of_node, "num-cs",
+-			&master->num_chipselect) ||
+-			(master->num_chipselect > SPI_NUM_CHIPSELECTS))
++	if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
++	    num_cs > SPI_NUM_CHIPSELECTS)
+ 		master->num_chipselect = SPI_NUM_CHIPSELECTS;
++	else
++		master->num_chipselect = num_cs;
+ 
+ 	master->bus_num = pdev->id;
+ 	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 66a70e9..a17f533 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1073,13 +1073,14 @@ void spi_finalize_current_message(struct spi_master *master)
+ 				"failed to unprepare message: %d\n", ret);
+ 		}
+ 	}
++
++	trace_spi_message_done(mesg);
++
+ 	master->cur_msg_prepared = false;
+ 
+ 	mesg->state = NULL;
+ 	if (mesg->complete)
+ 		mesg->complete(mesg->context);
+-
+-	trace_spi_message_done(mesg);
+ }
+ EXPORT_SYMBOL_GPL(spi_finalize_current_message);
+ 
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index cd1a277..ace0521 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -357,16 +357,6 @@ static void device_init_registers(struct vnt_private *pDevice)
+ 	/* zonetype initial */
+ 	pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
+ 
+-	/* Get RFType */
+-	pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE);
+-
+-	/* force change RevID for VT3253 emu */
+-	if ((pDevice->byRFType & RF_EMU) != 0)
+-			pDevice->byRevId = 0x80;
+-
+-	pDevice->byRFType &= RF_MASK;
+-	pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType);
+-
+ 	if (!pDevice->bZoneRegExist)
+ 		pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
+ 
+@@ -1806,6 +1796,12 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
+ 	MACvInitialize(priv->PortOffset);
+ 	MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr);
+ 
++	/* Get RFType */
++	priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE);
++	priv->byRFType &= RF_MASK;
++
++	dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType);
++
+ 	device_get_options(priv);
+ 	device_set_options(priv);
+ 	/* Mask out the options cannot be set to the chip */
+diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
+index 32ef993..5d65ad0 100644
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -791,6 +791,7 @@ bool RFbSetPower(
+ 		break;
+ 	case RATE_6M:
+ 	case RATE_9M:
++	case RATE_12M:
+ 	case RATE_18M:
+ 		byPwr = priv->abyOFDMPwrTbl[uCH];
+ 		if (priv->byRFType == RF_UW2452)
+diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
+index c42cde5..c4286cc 100644
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
+ 		break;
+ 	case RATE_6M:
+ 	case RATE_9M:
++	case RATE_12M:
+ 	case RATE_18M:
+ 	case RATE_24M:
+ 	case RATE_36M:
+diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
+index 97b486c..583e755 100644
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -359,7 +359,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ 		ep = fc_seq_exch(seq);
+ 		if (ep) {
+ 			lport = ep->lp;
+-			if (lport && (ep->xid <= lport->lro_xid))
++			if (lport && (ep->xid <= lport->lro_xid)) {
+ 				/*
+ 				 * "ddp_done" trigger invalidation of HW
+ 				 * specific DDP context
+@@ -374,6 +374,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ 				 * identified using ep->xid)
+ 				 */
+ 				cmd->was_ddp_setup = 0;
++			}
+ 		}
+ 	}
+ }
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 4fe18ce..7c14565 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -929,6 +929,13 @@ __acquires(hwep->lock)
+ 	return retval;
+ }
+ 
++static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
++{
++	dev_warn(&ci->gadget.dev,
++		"connect the device to an alternate port if you want HNP\n");
++	return isr_setup_status_phase(ci);
++}
++
+ /**
+  * isr_setup_packet_handler: setup packet handler
+  * @ci: UDC descriptor
+@@ -1061,6 +1068,10 @@ __acquires(ci->lock)
+ 							ci);
+ 				}
+ 				break;
++			case USB_DEVICE_A_ALT_HNP_SUPPORT:
++				if (ci_otg_is_fsm_mode(ci))
++					err = otg_a_alt_hnp_support(ci);
++				break;
+ 			default:
+ 				goto delegate;
+ 			}
+diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
+index c6b35b7..61d538a 100644
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+ 		break;
+ 	case OTG_STATE_B_PERIPHERAL:
+ 		otg_chrg_vbus(fsm, 0);
+-		otg_loc_conn(fsm, 1);
+ 		otg_loc_sof(fsm, 0);
+ 		otg_set_protocol(fsm, PROTO_GADGET);
++		otg_loc_conn(fsm, 1);
+ 		break;
+ 	case OTG_STATE_B_WAIT_ACON:
+ 		otg_chrg_vbus(fsm, 0);
+@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+ 
+ 		break;
+ 	case OTG_STATE_A_PERIPHERAL:
+-		otg_loc_conn(fsm, 1);
+ 		otg_loc_sof(fsm, 0);
+ 		otg_set_protocol(fsm, PROTO_GADGET);
+ 		otg_drv_vbus(fsm, 1);
++		otg_loc_conn(fsm, 1);
+ 		otg_add_timer(fsm, A_BIDL_ADIS);
+ 		break;
+ 	case OTG_STATE_A_WAIT_VFALL:
+diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
+index 403fab7..7b3035f 100644
+--- a/drivers/usb/phy/phy-am335x-control.c
++++ b/drivers/usb/phy/phy-am335x-control.c
+@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
+ 		return NULL;
+ 
+ 	dev = bus_find_device(&platform_bus_type, NULL, node, match);
++	if (!dev)
++		return NULL;
++
+ 	ctrl_usb = dev_get_drvdata(dev);
+ 	if (!ctrl_usb)
+ 		return NULL;
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 8257042..c85ea53 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_ATA_1X),
+ 
++/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++		"Initio Corporation",
++		"",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_ATA_1X),
++
+ /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+ 		"JMicron",
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 50c5f42..b8b7a6c 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -29,6 +29,7 @@
+ #include <linux/module.h>
+ #include <linux/balloon_compaction.h>
+ #include <linux/oom.h>
++#include <linux/wait.h>
+ 
+ /*
+  * Balloon device works in 4K page units.  So each page is pointed to by
+@@ -335,17 +336,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
+ static int balloon(void *_vballoon)
+ {
+ 	struct virtio_balloon *vb = _vballoon;
++	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ 
+ 	set_freezable();
+ 	while (!kthread_should_stop()) {
+ 		s64 diff;
+ 
+ 		try_to_freeze();
+-		wait_event_interruptible(vb->config_change,
+-					 (diff = towards_target(vb)) != 0
+-					 || vb->need_stats_update
+-					 || kthread_should_stop()
+-					 || freezing(current));
++
++		add_wait_queue(&vb->config_change, &wait);
++		for (;;) {
++			if ((diff = towards_target(vb)) != 0 ||
++			    vb->need_stats_update ||
++			    kthread_should_stop() ||
++			    freezing(current))
++				break;
++			wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
++		}
++		remove_wait_queue(&vb->config_change, &wait);
++
+ 		if (vb->need_stats_update)
+ 			stats_handle_request(vb);
+ 		if (diff > 0)
+@@ -494,6 +503,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
+ 	if (err < 0)
+ 		goto out_oom_notify;
+ 
++	virtio_device_ready(vdev);
++
+ 	vb->thread = kthread_run(balloon, vb, "vballoon");
+ 	if (IS_ERR(vb->thread)) {
+ 		err = PTR_ERR(vb->thread);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index 6e560d5..754fdf8 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -131,13 +131,16 @@ skip:
+ 	hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ 	hfs_bnode_dump(node);
+ 
+-	if (new_node) {
+-		/* update parent key if we inserted a key
+-		 * at the start of the first node
+-		 */
+-		if (!rec && new_node != node)
+-			hfs_brec_update_parent(fd);
++	/*
++	 * update parent key if we inserted a key
++	 * at the start of the node and it is not the new node
++	 */
++	if (!rec && new_node != node) {
++		hfs_bnode_read_key(node, fd->search_key, data_off + size);
++		hfs_brec_update_parent(fd);
++	}
+ 
++	if (new_node) {
+ 		hfs_bnode_put(fd->bnode);
+ 		if (!new_node->parent) {
+ 			hfs_btree_inc_height(tree);
+@@ -168,9 +171,6 @@ skip:
+ 		goto again;
+ 	}
+ 
+-	if (!rec)
+-		hfs_brec_update_parent(fd);
+-
+ 	return 0;
+ }
+ 
+@@ -370,6 +370,8 @@ again:
+ 	if (IS_ERR(parent))
+ 		return PTR_ERR(parent);
+ 	__hfs_brec_find(parent, fd, hfs_find_rec_by_key);
++	if (fd->record < 0)
++		return -ENOENT;
+ 	hfs_bnode_dump(parent);
+ 	rec = fd->record;
+ 
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index ca6d2acc..f39722b 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -368,6 +368,7 @@ int dm_create(int minor, struct mapped_device **md);
+  */
+ struct mapped_device *dm_get_md(dev_t dev);
+ void dm_get(struct mapped_device *md);
++int dm_hold(struct mapped_device *md);
+ void dm_put(struct mapped_device *md);
+ 
+ /*
+diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
+index fb0390a..ee7b1ce 100644
+--- a/include/linux/mfd/palmas.h
++++ b/include/linux/mfd/palmas.h
+@@ -2999,6 +2999,9 @@ enum usb_irq_events {
+ #define PALMAS_GPADC_TRIM15					0x0E
+ #define PALMAS_GPADC_TRIM16					0x0F
+ 
++/* TPS659038 regen2_ctrl offset iss different from palmas */
++#define TPS659038_REGEN2_CTRL					0x12
++
+ /* TPS65917 Interrupt registers */
+ 
+ /* Registers for function INTERRUPT */
+diff --git a/include/trace/events/regmap.h b/include/trace/events/regmap.h
+index 23d5615..22317d2 100644
+--- a/include/trace/events/regmap.h
++++ b/include/trace/events/regmap.h
+@@ -7,27 +7,26 @@
+ #include <linux/ktime.h>
+ #include <linux/tracepoint.h>
+ 
+-struct device;
+-struct regmap;
++#include "../../../drivers/base/regmap/internal.h"
+ 
+ /*
+  * Log register events
+  */
+ DECLARE_EVENT_CLASS(regmap_reg,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg,
++	TP_PROTO(struct regmap *map, unsigned int reg,
+ 		 unsigned int val),
+ 
+-	TP_ARGS(dev, reg, val),
++	TP_ARGS(map, reg, val),
+ 
+ 	TP_STRUCT__entry(
+-		__string(	name,		dev_name(dev)	)
+-		__field(	unsigned int,	reg		)
+-		__field(	unsigned int,	val		)
++		__string(	name,		regmap_name(map)	)
++		__field(	unsigned int,	reg			)
++		__field(	unsigned int,	val			)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__assign_str(name, dev_name(dev));
++		__assign_str(name, regmap_name(map));
+ 		__entry->reg = reg;
+ 		__entry->val = val;
+ 	),
+@@ -39,45 +38,45 @@ DECLARE_EVENT_CLASS(regmap_reg,
+ 
+ DEFINE_EVENT(regmap_reg, regmap_reg_write,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg,
++	TP_PROTO(struct regmap *map, unsigned int reg,
+ 		 unsigned int val),
+ 
+-	TP_ARGS(dev, reg, val)
++	TP_ARGS(map, reg, val)
+ 
+ );
+ 
+ DEFINE_EVENT(regmap_reg, regmap_reg_read,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg,
++	TP_PROTO(struct regmap *map, unsigned int reg,
+ 		 unsigned int val),
+ 
+-	TP_ARGS(dev, reg, val)
++	TP_ARGS(map, reg, val)
+ 
+ );
+ 
+ DEFINE_EVENT(regmap_reg, regmap_reg_read_cache,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg,
++	TP_PROTO(struct regmap *map, unsigned int reg,
+ 		 unsigned int val),
+ 
+-	TP_ARGS(dev, reg, val)
++	TP_ARGS(map, reg, val)
+ 
+ );
+ 
+ DECLARE_EVENT_CLASS(regmap_block,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg, int count),
++	TP_PROTO(struct regmap *map, unsigned int reg, int count),
+ 
+-	TP_ARGS(dev, reg, count),
++	TP_ARGS(map, reg, count),
+ 
+ 	TP_STRUCT__entry(
+-		__string(	name,		dev_name(dev)	)
+-		__field(	unsigned int,	reg		)
+-		__field(	int,		count		)
++		__string(	name,		regmap_name(map)	)
++		__field(	unsigned int,	reg			)
++		__field(	int,		count			)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__assign_str(name, dev_name(dev));
++		__assign_str(name, regmap_name(map));
+ 		__entry->reg = reg;
+ 		__entry->count = count;
+ 	),
+@@ -89,48 +88,48 @@ DECLARE_EVENT_CLASS(regmap_block,
+ 
+ DEFINE_EVENT(regmap_block, regmap_hw_read_start,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg, int count),
++	TP_PROTO(struct regmap *map, unsigned int reg, int count),
+ 
+-	TP_ARGS(dev, reg, count)
++	TP_ARGS(map, reg, count)
+ );
+ 
+ DEFINE_EVENT(regmap_block, regmap_hw_read_done,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg, int count),
++	TP_PROTO(struct regmap *map, unsigned int reg, int count),
+ 
+-	TP_ARGS(dev, reg, count)
++	TP_ARGS(map, reg, count)
+ );
+ 
+ DEFINE_EVENT(regmap_block, regmap_hw_write_start,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg, int count),
++	TP_PROTO(struct regmap *map, unsigned int reg, int count),
+ 
+-	TP_ARGS(dev, reg, count)
++	TP_ARGS(map, reg, count)
+ );
+ 
+ DEFINE_EVENT(regmap_block, regmap_hw_write_done,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg, int count),
++	TP_PROTO(struct regmap *map, unsigned int reg, int count),
+ 
+-	TP_ARGS(dev, reg, count)
++	TP_ARGS(map, reg, count)
+ );
+ 
+ TRACE_EVENT(regcache_sync,
+ 
+-	TP_PROTO(struct device *dev, const char *type,
++	TP_PROTO(struct regmap *map, const char *type,
+ 		 const char *status),
+ 
+-	TP_ARGS(dev, type, status),
++	TP_ARGS(map, type, status),
+ 
+ 	TP_STRUCT__entry(
+-		__string(       name,           dev_name(dev)   )
+-		__string(	status,		status		)
+-		__string(	type,		type		)
+-		__field(	int,		type		)
++		__string(       name,           regmap_name(map)	)
++		__string(	status,		status			)
++		__string(	type,		type			)
++		__field(	int,		type			)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__assign_str(name, dev_name(dev));
++		__assign_str(name, regmap_name(map));
+ 		__assign_str(status, status);
+ 		__assign_str(type, type);
+ 	),
+@@ -141,17 +140,17 @@ TRACE_EVENT(regcache_sync,
+ 
+ DECLARE_EVENT_CLASS(regmap_bool,
+ 
+-	TP_PROTO(struct device *dev, bool flag),
++	TP_PROTO(struct regmap *map, bool flag),
+ 
+-	TP_ARGS(dev, flag),
++	TP_ARGS(map, flag),
+ 
+ 	TP_STRUCT__entry(
+-		__string(	name,		dev_name(dev)	)
+-		__field(	int,		flag		)
++		__string(	name,		regmap_name(map)	)
++		__field(	int,		flag			)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__assign_str(name, dev_name(dev));
++		__assign_str(name, regmap_name(map));
+ 		__entry->flag = flag;
+ 	),
+ 
+@@ -161,32 +160,32 @@ DECLARE_EVENT_CLASS(regmap_bool,
+ 
+ DEFINE_EVENT(regmap_bool, regmap_cache_only,
+ 
+-	TP_PROTO(struct device *dev, bool flag),
++	TP_PROTO(struct regmap *map, bool flag),
+ 
+-	TP_ARGS(dev, flag)
++	TP_ARGS(map, flag)
+ 
+ );
+ 
+ DEFINE_EVENT(regmap_bool, regmap_cache_bypass,
+ 
+-	TP_PROTO(struct device *dev, bool flag),
++	TP_PROTO(struct regmap *map, bool flag),
+ 
+-	TP_ARGS(dev, flag)
++	TP_ARGS(map, flag)
+ 
+ );
+ 
+ DECLARE_EVENT_CLASS(regmap_async,
+ 
+-	TP_PROTO(struct device *dev),
++	TP_PROTO(struct regmap *map),
+ 
+-	TP_ARGS(dev),
++	TP_ARGS(map),
+ 
+ 	TP_STRUCT__entry(
+-		__string(	name,		dev_name(dev)	)
++		__string(	name,		regmap_name(map)	)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__assign_str(name, dev_name(dev));
++		__assign_str(name, regmap_name(map));
+ 	),
+ 
+ 	TP_printk("%s", __get_str(name))
+@@ -194,50 +193,50 @@ DECLARE_EVENT_CLASS(regmap_async,
+ 
+ DEFINE_EVENT(regmap_block, regmap_async_write_start,
+ 
+-	TP_PROTO(struct device *dev, unsigned int reg, int count),
++	TP_PROTO(struct regmap *map, unsigned int reg, int count),
+ 
+-	TP_ARGS(dev, reg, count)
++	TP_ARGS(map, reg, count)
+ );
+ 
+ DEFINE_EVENT(regmap_async, regmap_async_io_complete,
+ 
+-	TP_PROTO(struct device *dev),
++	TP_PROTO(struct regmap *map),
+ 
+-	TP_ARGS(dev)
++	TP_ARGS(map)
+ 
+ );
+ 
+ DEFINE_EVENT(regmap_async, regmap_async_complete_start,
+ 
+-	TP_PROTO(struct device *dev),
++	TP_PROTO(struct regmap *map),
+ 
+-	TP_ARGS(dev)
++	TP_ARGS(map)
+ 
+ );
+ 
+ DEFINE_EVENT(regmap_async, regmap_async_complete_done,
+ 
+-	TP_PROTO(struct device *dev),
++	TP_PROTO(struct regmap *map),
+ 
+-	TP_ARGS(dev)
++	TP_ARGS(map)
+ 
+ );
+ 
+ TRACE_EVENT(regcache_drop_region,
+ 
+-	TP_PROTO(struct device *dev, unsigned int from,
++	TP_PROTO(struct regmap *map, unsigned int from,
+ 		 unsigned int to),
+ 
+-	TP_ARGS(dev, from, to),
++	TP_ARGS(map, from, to),
+ 
+ 	TP_STRUCT__entry(
+-		__string(       name,           dev_name(dev)   )
+-		__field(	unsigned int,	from		)
+-		__field(	unsigned int,	to		)
++		__string(       name,           regmap_name(map)	)
++		__field(	unsigned int,	from			)
++		__field(	unsigned int,	to			)
+ 	),
+ 
+ 	TP_fast_assign(
+-		__assign_str(name, dev_name(dev));
++		__assign_str(name, regmap_name(map));
+ 		__entry->from = from;
+ 		__entry->to = to;
+ 	),
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 19efcf1..7959624 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4412,6 +4412,13 @@ static void perf_pending_event(struct irq_work *entry)
+ {
+ 	struct perf_event *event = container_of(entry,
+ 			struct perf_event, pending);
++	int rctx;
++
++	rctx = perf_swevent_get_recursion_context();
++	/*
++	 * If we 'fail' here, that's OK, it means recursion is already disabled
++	 * and we won't recurse 'further'.
++	 */
+ 
+ 	if (event->pending_disable) {
+ 		event->pending_disable = 0;
+@@ -4422,6 +4429,9 @@ static void perf_pending_event(struct irq_work *entry)
+ 		event->pending_wakeup = 0;
+ 		perf_event_wakeup(event);
+ 	}
++
++	if (rctx >= 0)
++		perf_swevent_put_recursion_context(rctx);
+ }
+ 
+ /*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index cc6e964..fa7568c 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -58,13 +58,24 @@ struct ieee80211_local;
+ #define IEEE80211_UNSET_POWER_LEVEL	INT_MIN
+ 
+ /*
+- * Some APs experience problems when working with U-APSD. Decrease the
+- * probability of that happening by using legacy mode for all ACs but VO.
+- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+- * setting, and always treats non-VO ACs as legacy.
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
+  */
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+-	IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+ 
+ #define IEEE80211_DEFAULT_MAX_SP_LEN		\
+ 	IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index d69ca51..b448e8f 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2191,6 +2191,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+ 
++	if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++		return RX_DROP_MONITOR;
++
+ 	/* frame is in RMC, don't forward */
+ 	if (ieee80211_is_data(hdr->frame_control) &&
+ 	    is_multicast_ether_addr(hdr->addr1) &&
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 974ebe7..1ce38e7 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3153,7 +3153,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ 		wdev_iter = &sdata_iter->wdev;
+ 
+ 		if (sdata_iter == sdata ||
+-		    rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
++		    !ieee80211_sdata_running(sdata_iter) ||
+ 		    local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+ 			continue;
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 8887c6e..e13325f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4360,6 +4360,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
+ 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
+ 		return -EINVAL;
+ 
++	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
++	 * as userspace might just pass through the capabilities from the IEs
++	 * directly, rather than enforcing this restriction and returning an
++	 * error in this case.
++	 */
++	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
++		params.ht_capa = NULL;
++		params.vht_capa = NULL;
++	}
++
+ 	/* When you run into this, adjust the code below for the new flag */
+ 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+ 
+diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
+index b67480f..4373ada 100644
+--- a/sound/soc/codecs/adav80x.c
++++ b/sound/soc/codecs/adav80x.c
+@@ -317,7 +317,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+-	unsigned int deemph = ucontrol->value.enumerated.item[0];
++	unsigned int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+@@ -333,7 +333,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = adav80x->deemph;
++	ucontrol->value.integer.value[0] = adav80x->deemph;
+ 	return 0;
+ };
+ 
+diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
+index 70861c7..81b54a2 100644
+--- a/sound/soc/codecs/ak4641.c
++++ b/sound/soc/codecs/ak4641.c
+@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = ak4641->deemph;
++	ucontrol->value.integer.value[0] = ak4641->deemph;
+ 	return 0;
+ };
+ 
+diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
+index 686cacb..a981c1e 100644
+--- a/sound/soc/codecs/ak4671.c
++++ b/sound/soc/codecs/ak4671.c
+@@ -343,25 +343,25 @@ static const struct snd_soc_dapm_widget ak4671_dapm_widgets[] = {
+ };
+ 
+ static const struct snd_soc_dapm_route ak4671_intercon[] = {
+-	{"DAC Left", "NULL", "PMPLL"},
+-	{"DAC Right", "NULL", "PMPLL"},
+-	{"ADC Left", "NULL", "PMPLL"},
+-	{"ADC Right", "NULL", "PMPLL"},
++	{"DAC Left", NULL, "PMPLL"},
++	{"DAC Right", NULL, "PMPLL"},
++	{"ADC Left", NULL, "PMPLL"},
++	{"ADC Right", NULL, "PMPLL"},
+ 
+ 	/* Outputs */
+-	{"LOUT1", "NULL", "LOUT1 Mixer"},
+-	{"ROUT1", "NULL", "ROUT1 Mixer"},
+-	{"LOUT2", "NULL", "LOUT2 Mix Amp"},
+-	{"ROUT2", "NULL", "ROUT2 Mix Amp"},
+-	{"LOUT3", "NULL", "LOUT3 Mixer"},
+-	{"ROUT3", "NULL", "ROUT3 Mixer"},
++	{"LOUT1", NULL, "LOUT1 Mixer"},
++	{"ROUT1", NULL, "ROUT1 Mixer"},
++	{"LOUT2", NULL, "LOUT2 Mix Amp"},
++	{"ROUT2", NULL, "ROUT2 Mix Amp"},
++	{"LOUT3", NULL, "LOUT3 Mixer"},
++	{"ROUT3", NULL, "ROUT3 Mixer"},
+ 
+ 	{"LOUT1 Mixer", "DACL", "DAC Left"},
+ 	{"ROUT1 Mixer", "DACR", "DAC Right"},
+ 	{"LOUT2 Mixer", "DACHL", "DAC Left"},
+ 	{"ROUT2 Mixer", "DACHR", "DAC Right"},
+-	{"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
+-	{"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
++	{"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
++	{"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
+ 	{"LOUT3 Mixer", "DACSL", "DAC Left"},
+ 	{"ROUT3 Mixer", "DACSR", "DAC Right"},
+ 
+@@ -381,18 +381,18 @@ static const struct snd_soc_dapm_route ak4671_intercon[] = {
+ 	{"LIN2", NULL, "Mic Bias"},
+ 	{"RIN2", NULL, "Mic Bias"},
+ 
+-	{"ADC Left", "NULL", "LIN MUX"},
+-	{"ADC Right", "NULL", "RIN MUX"},
++	{"ADC Left", NULL, "LIN MUX"},
++	{"ADC Right", NULL, "RIN MUX"},
+ 
+ 	/* Analog Loops */
+-	{"LIN1 Mixing Circuit", "NULL", "LIN1"},
+-	{"RIN1 Mixing Circuit", "NULL", "RIN1"},
+-	{"LIN2 Mixing Circuit", "NULL", "LIN2"},
+-	{"RIN2 Mixing Circuit", "NULL", "RIN2"},
+-	{"LIN3 Mixing Circuit", "NULL", "LIN3"},
+-	{"RIN3 Mixing Circuit", "NULL", "RIN3"},
+-	{"LIN4 Mixing Circuit", "NULL", "LIN4"},
+-	{"RIN4 Mixing Circuit", "NULL", "RIN4"},
++	{"LIN1 Mixing Circuit", NULL, "LIN1"},
++	{"RIN1 Mixing Circuit", NULL, "RIN1"},
++	{"LIN2 Mixing Circuit", NULL, "LIN2"},
++	{"RIN2 Mixing Circuit", NULL, "RIN2"},
++	{"LIN3 Mixing Circuit", NULL, "LIN3"},
++	{"RIN3 Mixing Circuit", NULL, "RIN3"},
++	{"LIN4 Mixing Circuit", NULL, "LIN4"},
++	{"RIN4 Mixing Circuit", NULL, "RIN4"},
+ 
+ 	{"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
+ 	{"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 79a4efc..7d3a6ac 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -286,7 +286,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = cs4271->deemph;
++	ucontrol->value.integer.value[0] = cs4271->deemph;
+ 	return 0;
+ }
+ 
+@@ -296,7 +296,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+ 
+-	cs4271->deemph = ucontrol->value.enumerated.item[0];
++	cs4271->deemph = ucontrol->value.integer.value[0];
+ 	return cs4271_set_deemph(codec);
+ }
+ 
+diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
+index 61b2f9a..e3110c6 100644
+--- a/sound/soc/codecs/da732x.c
++++ b/sound/soc/codecs/da732x.c
+@@ -876,11 +876,11 @@ static const struct snd_soc_dapm_widget da732x_dapm_widgets[] = {
+ 
+ static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
+ 	/* Inputs */
+-	{"AUX1L PGA", "NULL", "AUX1L"},
+-	{"AUX1R PGA", "NULL", "AUX1R"},
++	{"AUX1L PGA", NULL, "AUX1L"},
++	{"AUX1R PGA", NULL, "AUX1R"},
+ 	{"MIC1 PGA", NULL, "MIC1"},
+-	{"MIC2 PGA", "NULL", "MIC2"},
+-	{"MIC3 PGA", "NULL", "MIC3"},
++	{"MIC2 PGA", NULL, "MIC2"},
++	{"MIC3 PGA", NULL, "MIC3"},
+ 
+ 	/* Capture Path */
+ 	{"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index f273251..c5f35a0 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -120,7 +120,7 @@ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = es8328->deemph;
++	ucontrol->value.integer.value[0] = es8328->deemph;
+ 	return 0;
+ }
+ 
+@@ -129,7 +129,7 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 	int ret;
+ 
+ 	if (deemph > 1)
+diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
+index a722a02..477e13d 100644
+--- a/sound/soc/codecs/pcm1681.c
++++ b/sound/soc/codecs/pcm1681.c
+@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = priv->deemph;
++	ucontrol->value.integer.value[0] = priv->deemph;
+ 
+ 	return 0;
+ }
+@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	priv->deemph = ucontrol->value.enumerated.item[0];
++	priv->deemph = ucontrol->value.integer.value[0];
+ 
+ 	return pcm1681_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index aa98be3..10d2415 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1149,13 +1149,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ 		/* Enable VDDC charge pump */
+ 		ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+ 	} else if (vddio >= 3100 && vdda >= 3100) {
+-		/*
+-		 * if vddio and vddd > 3.1v,
+-		 * charge pump should be clean before set ana_pwr
+-		 */
+-		snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+-				SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
+-
++		ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+ 		/* VDDC use VDDIO rail */
+ 		lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+ 		lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
+index 1f451a1..4ff4aa7 100644
+--- a/sound/soc/codecs/sn95031.c
++++ b/sound/soc/codecs/sn95031.c
+@@ -531,8 +531,8 @@ static const struct snd_soc_dapm_route sn95031_audio_map[] = {
+ 	/* speaker map */
+ 	{ "IHFOUTL", NULL, "Speaker Rail"},
+ 	{ "IHFOUTR", NULL, "Speaker Rail"},
+-	{ "IHFOUTL", "NULL", "Speaker Left Playback"},
+-	{ "IHFOUTR", "NULL", "Speaker Right Playback"},
++	{ "IHFOUTL", NULL, "Speaker Left Playback"},
++	{ "IHFOUTR", NULL, "Speaker Right Playback"},
+ 	{ "Speaker Left Playback", NULL, "Speaker Left Filter"},
+ 	{ "Speaker Right Playback", NULL, "Speaker Right Filter"},
+ 	{ "Speaker Left Filter", NULL, "IHFDAC Left"},
+diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
+index 249ef5c..32942be 100644
+--- a/sound/soc/codecs/tas5086.c
++++ b/sound/soc/codecs/tas5086.c
+@@ -281,7 +281,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = priv->deemph;
++	ucontrol->value.integer.value[0] = priv->deemph;
+ 
+ 	return 0;
+ }
+@@ -292,7 +292,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+ 
+-	priv->deemph = ucontrol->value.enumerated.item[0];
++	priv->deemph = ucontrol->value.integer.value[0];
+ 
+ 	return tas5086_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index 34ef65c..8eeab47 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+ 
+-	ucontrol->value.enumerated.item[0] = wm2000->anc_active;
++	ucontrol->value.integer.value[0] = wm2000->anc_active;
+ 
+ 	return 0;
+ }
+@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+-	int anc_active = ucontrol->value.enumerated.item[0];
++	int anc_active = ucontrol->value.integer.value[0];
+ 	int ret;
+ 
+ 	if (anc_active > 1)
+@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+ 
+-	ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
++	ucontrol->value.integer.value[0] = wm2000->spk_ena;
+ 
+ 	return 0;
+ }
+@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+-	int val = ucontrol->value.enumerated.item[0];
++	int val = ucontrol->value.integer.value[0];
+ 	int ret;
+ 
+ 	if (val > 1)
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index b115ed8..391534f 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -125,7 +125,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8731->deemph;
++	ucontrol->value.integer.value[0] = wm8731->deemph;
+ 
+ 	return 0;
+ }
+@@ -135,7 +135,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 	int ret = 0;
+ 
+ 	if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index cc6b0ef..15435c9 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8903->deemph;
++	ucontrol->value.integer.value[0] = wm8903->deemph;
+ 
+ 	return 0;
+ }
+@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 	int ret = 0;
+ 
+ 	if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 75b87c5..b945a3b 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -525,7 +525,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8904->deemph;
++	ucontrol->value.integer.value[0] = wm8904->deemph;
+ 	return 0;
+ }
+ 
+@@ -534,7 +534,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 1173f7f..035bdc4 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8955->deemph;
++	ucontrol->value.integer.value[0] = wm8955->deemph;
+ 	return 0;
+ }
+ 
+@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index a96eb49..0435aeb 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -182,7 +182,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+ 
+-	ucontrol->value.enumerated.item[0] = wm8960->deemph;
++	ucontrol->value.integer.value[0] = wm8960->deemph;
+ 	return 0;
+ }
+ 
+@@ -191,7 +191,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ 	struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ 	struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+-	int deemph = ucontrol->value.enumerated.item[0];
++	int deemph = ucontrol->value.integer.value[0];
+ 
+ 	if (deemph > 1)
+ 		return -EINVAL;
+diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
+index 9517571..98c9525 100644
+--- a/sound/soc/codecs/wm9712.c
++++ b/sound/soc/codecs/wm9712.c
+@@ -180,7 +180,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
+ 	struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
+ 	struct wm9712_priv *wm9712 = snd_soc_codec_get_drvdata(codec);
+-	unsigned int val = ucontrol->value.enumerated.item[0];
++	unsigned int val = ucontrol->value.integer.value[0];
+ 	struct soc_mixer_control *mc =
+ 		(struct soc_mixer_control *)kcontrol->private_value;
+ 	unsigned int mixer, mask, shift, old;
+@@ -193,7 +193,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
+ 
+ 	mutex_lock(&wm9712->lock);
+ 	old = wm9712->hp_mixer[mixer];
+-	if (ucontrol->value.enumerated.item[0])
++	if (ucontrol->value.integer.value[0])
+ 		wm9712->hp_mixer[mixer] |= mask;
+ 	else
+ 		wm9712->hp_mixer[mixer] &= ~mask;
+@@ -231,7 +231,7 @@ static int wm9712_hp_mixer_get(struct snd_kcontrol *kcontrol,
+ 	mixer = mc->shift >> 8;
+ 	shift = mc->shift & 0xff;
+ 
+-	ucontrol->value.enumerated.item[0] =
++	ucontrol->value.integer.value[0] =
+ 		(wm9712->hp_mixer[mixer] >> shift) & 1;
+ 
+ 	return 0;
+diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
+index 6ab1122..db644c6 100644
+--- a/sound/soc/codecs/wm9713.c
++++ b/sound/soc/codecs/wm9713.c
+@@ -255,7 +255,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
+ 	struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
+ 	struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
+ 	struct wm9713_priv *wm9713 = snd_soc_codec_get_drvdata(codec);
+-	unsigned int val = ucontrol->value.enumerated.item[0];
++	unsigned int val = ucontrol->value.integer.value[0];
+ 	struct soc_mixer_control *mc =
+ 		(struct soc_mixer_control *)kcontrol->private_value;
+ 	unsigned int mixer, mask, shift, old;
+@@ -268,7 +268,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
+ 
+ 	mutex_lock(&wm9713->lock);
+ 	old = wm9713->hp_mixer[mixer];
+-	if (ucontrol->value.enumerated.item[0])
++	if (ucontrol->value.integer.value[0])
+ 		wm9713->hp_mixer[mixer] |= mask;
+ 	else
+ 		wm9713->hp_mixer[mixer] &= ~mask;
+@@ -306,7 +306,7 @@ static int wm9713_hp_mixer_get(struct snd_kcontrol *kcontrol,
+ 	mixer = mc->shift >> 8;
+ 	shift = mc->shift & 0xff;
+ 
+-	ucontrol->value.enumerated.item[0] =
++	ucontrol->value.integer.value[0] =
+ 		(wm9713->hp_mixer[mixer] >> shift) & 1;
+ 
+ 	return 0;
diff --git a/3.19.3/4420_grsecurity-3.1-3.19.3-201504021826.patch b/3.19.4/4420_grsecurity-3.1-3.19.4-201504142300.patch
index f16dac3..93459d8 100644
--- a/3.19.3/4420_grsecurity-3.1-3.19.3-201504021826.patch
+++ b/3.19.4/4420_grsecurity-3.1-3.19.4-201504142300.patch
@@ -373,7 +373,7 @@ index 176d4fe..6eabd3c 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 713bf26..9ceae96 100644
+index 2ef2078..dbf475b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -4823,7 +4823,7 @@ index a5abb00..9cbca9a 100644
  
  #define smp_load_acquire(p)						\
 diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
-index 09da25b..3ea0d64 100644
+index 4fde8c1..441f84f 100644
 --- a/arch/arm64/include/asm/percpu.h
 +++ b/arch/arm64/include/asm/percpu.h
 @@ -135,16 +135,16 @@ static inline void __percpu_write(void *ptr, unsigned long val, int size)
@@ -8898,7 +8898,7 @@ index 3e68d1c..72a5ee6 100644
  	ld	r4,_DAR(r1)
  	bl	bad_page_fault
 diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index c2df815..bae3d12 100644
+index 9519e6b..13f6c38 100644
 --- a/arch/powerpc/kernel/exceptions-64s.S
 +++ b/arch/powerpc/kernel/exceptions-64s.S
 @@ -1599,10 +1599,10 @@ handle_page_fault:
@@ -17747,7 +17747,7 @@ index 802dde3..9183e68 100644
  
  #include <asm-generic/memory_model.h>
 diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
-index b3bebf9..e1f5d95 100644
+index b3bebf9..13ac22e 100644
 --- a/arch/x86/include/asm/page_64.h
 +++ b/arch/x86/include/asm/page_64.h
 @@ -7,9 +7,9 @@
@@ -17762,6 +17762,17 @@ index b3bebf9..e1f5d95 100644
  {
  	unsigned long y = x - __START_KERNEL_map;
  
+@@ -20,8 +20,8 @@ static inline unsigned long __phys_addr_nodebug(unsigned long x)
+ }
+ 
+ #ifdef CONFIG_DEBUG_VIRTUAL
+-extern unsigned long __phys_addr(unsigned long);
+-extern unsigned long __phys_addr_symbol(unsigned long);
++extern unsigned long __intentional_overflow(-1) __phys_addr(unsigned long);
++extern unsigned long __intentional_overflow(-1) __phys_addr_symbol(unsigned long);
+ #else
+ #define __phys_addr(x)		__phys_addr_nodebug(x)
+ #define __phys_addr_symbol(x) \
 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
 index 32444ae..1a1624b 100644
 --- a/arch/x86/include/asm/paravirt.h
@@ -19629,7 +19640,7 @@ index 04905bf..1178cdf 100644
  }
  
 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 0d592e0..7430aad 100644
+index 0d592e0..cbc90a3 100644
 --- a/arch/x86/include/asm/uaccess.h
 +++ b/arch/x86/include/asm/uaccess.h
 @@ -7,6 +7,7 @@
@@ -19692,7 +19703,24 @@ index 0d592e0..7430aad 100644
  
  /*
   * The exception table consists of pairs of addresses relative to the
-@@ -176,10 +210,12 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+@@ -134,11 +168,13 @@ extern int __get_user_8(void);
+ extern int __get_user_bad(void);
+ 
+ /*
+- * This is a type: either unsigned long, if the argument fits into
+- * that type, or otherwise unsigned long long.
++ * This is a type: either (un)signed int, if the argument fits into
++ * that type, or otherwise (un)signed long long.
+  */
+ #define __inttype(x) \
+-__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
++__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0U),		\
++	__builtin_choose_expr(__type_is_unsigned(__typeof__(x)), 0ULL, 0LL),\
++	__builtin_choose_expr(__type_is_unsigned(__typeof__(x)), 0U, 0)))
+ 
+ /**
+  * get_user: - Get a simple variable from user space.
+@@ -176,10 +212,12 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
  	register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX);		\
  	__chk_user_ptr(ptr);						\
  	might_fault();							\
@@ -19705,7 +19733,7 @@ index 0d592e0..7430aad 100644
  	__ret_gu;							\
  })
  
-@@ -187,13 +223,21 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+@@ -187,13 +225,21 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
  	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
  		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
  
@@ -19730,7 +19758,7 @@ index 0d592e0..7430aad 100644
  		     "3: " ASM_CLAC "\n"				\
  		     ".section .fixup,\"ax\"\n"				\
  		     "4:	movl %3,%0\n"				\
-@@ -206,8 +250,8 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+@@ -206,8 +252,8 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
  
  #define __put_user_asm_ex_u64(x, addr)					\
  	asm volatile(ASM_STAC "\n"					\
@@ -19741,7 +19769,7 @@ index 0d592e0..7430aad 100644
  		     "3: " ASM_CLAC "\n"				\
  		     _ASM_EXTABLE_EX(1b, 2b)				\
  		     _ASM_EXTABLE_EX(2b, 3b)				\
-@@ -257,7 +301,8 @@ extern void __put_user_8(void);
+@@ -257,7 +303,8 @@ extern void __put_user_8(void);
  	__typeof__(*(ptr)) __pu_val;				\
  	__chk_user_ptr(ptr);					\
  	might_fault();						\
@@ -19751,7 +19779,7 @@ index 0d592e0..7430aad 100644
  	switch (sizeof(*(ptr))) {				\
  	case 1:							\
  		__put_user_x(1, __pu_val, ptr, __ret_pu);	\
-@@ -275,6 +320,7 @@ extern void __put_user_8(void);
+@@ -275,6 +322,7 @@ extern void __put_user_8(void);
  		__put_user_x(X, __pu_val, ptr, __ret_pu);	\
  		break;						\
  	}							\
@@ -19759,7 +19787,7 @@ index 0d592e0..7430aad 100644
  	__ret_pu;						\
  })
  
-@@ -355,8 +401,10 @@ do {									\
+@@ -355,8 +403,10 @@ do {									\
  } while (0)
  
  #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
@@ -19771,7 +19799,7 @@ index 0d592e0..7430aad 100644
  		     "2: " ASM_CLAC "\n"				\
  		     ".section .fixup,\"ax\"\n"				\
  		     "3:	mov %3,%0\n"				\
-@@ -364,8 +412,10 @@ do {									\
+@@ -364,8 +414,10 @@ do {									\
  		     "	jmp 2b\n"					\
  		     ".previous\n"					\
  		     _ASM_EXTABLE(1b, 3b)				\
@@ -19784,7 +19812,7 @@ index 0d592e0..7430aad 100644
  
  #define __get_user_size_ex(x, ptr, size)				\
  do {									\
-@@ -389,7 +439,7 @@ do {									\
+@@ -389,7 +441,7 @@ do {									\
  } while (0)
  
  #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
@@ -19793,7 +19821,7 @@ index 0d592e0..7430aad 100644
  		     "2:\n"						\
  		     _ASM_EXTABLE_EX(1b, 2b)				\
  		     : ltype(x) : "m" (__m(addr)))
-@@ -406,13 +456,24 @@ do {									\
+@@ -406,13 +458,24 @@ do {									\
  	int __gu_err;							\
  	unsigned long __gu_val;						\
  	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
@@ -19820,7 +19848,7 @@ index 0d592e0..7430aad 100644
  
  /*
   * Tell gcc we read from memory instead of writing: this is because
-@@ -420,8 +481,10 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -420,8 +483,10 @@ struct __large_struct { unsigned long buf[100]; };
   * aliasing issues.
   */
  #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
@@ -19832,7 +19860,7 @@ index 0d592e0..7430aad 100644
  		     "2: " ASM_CLAC "\n"				\
  		     ".section .fixup,\"ax\"\n"				\
  		     "3:	mov %3,%0\n"				\
-@@ -429,10 +492,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -429,10 +494,12 @@ struct __large_struct { unsigned long buf[100]; };
  		     ".previous\n"					\
  		     _ASM_EXTABLE(1b, 3b)				\
  		     : "=r"(err)					\
@@ -19847,7 +19875,7 @@ index 0d592e0..7430aad 100644
  		     "2:\n"						\
  		     _ASM_EXTABLE_EX(1b, 2b)				\
  		     : : ltype(x), "m" (__m(addr)))
-@@ -442,11 +507,13 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -442,11 +509,13 @@ struct __large_struct { unsigned long buf[100]; };
   */
  #define uaccess_try	do {						\
  	current_thread_info()->uaccess_err = 0;				\
@@ -19861,7 +19889,7 @@ index 0d592e0..7430aad 100644
  	(err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0);	\
  } while (0)
  
-@@ -471,8 +538,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -471,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
   * On error, the variable @x is set to zero.
   */
  
@@ -19874,7 +19902,7 @@ index 0d592e0..7430aad 100644
  
  /**
   * __put_user: - Write a simple value into user space, with less checking.
-@@ -494,8 +565,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -494,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
   * Returns zero on success, or -EFAULT on error.
   */
  
@@ -19887,7 +19915,7 @@ index 0d592e0..7430aad 100644
  
  #define __get_user_unaligned __get_user
  #define __put_user_unaligned __put_user
-@@ -513,7 +588,7 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -513,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
  #define get_user_ex(x, ptr)	do {					\
  	unsigned long __gue_val;					\
  	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
@@ -19896,7 +19924,7 @@ index 0d592e0..7430aad 100644
  } while (0)
  
  #define put_user_try		uaccess_try
-@@ -531,7 +606,7 @@ extern __must_check long strlen_user(const char __user *str);
+@@ -531,7 +608,7 @@ extern __must_check long strlen_user(const char __user *str);
  extern __must_check long strnlen_user(const char __user *str, long n);
  
  unsigned long __must_check clear_user(void __user *mem, unsigned long len);
@@ -19905,7 +19933,7 @@ index 0d592e0..7430aad 100644
  
  extern void __cmpxchg_wrong_size(void)
  	__compiletime_error("Bad argument size for cmpxchg");
-@@ -542,18 +617,19 @@ extern void __cmpxchg_wrong_size(void)
+@@ -542,18 +619,19 @@ extern void __cmpxchg_wrong_size(void)
  	__typeof__(ptr) __uval = (uval);				\
  	__typeof__(*(ptr)) __old = (old);				\
  	__typeof__(*(ptr)) __new = (new);				\
@@ -19927,7 +19955,7 @@ index 0d592e0..7430aad 100644
  			: "i" (-EFAULT), "q" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -562,14 +638,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -562,14 +640,14 @@ extern void __cmpxchg_wrong_size(void)
  	case 2:								\
  	{								\
  		asm volatile("\t" ASM_STAC "\n"				\
@@ -19944,7 +19972,7 @@ index 0d592e0..7430aad 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -578,14 +654,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -578,14 +656,14 @@ extern void __cmpxchg_wrong_size(void)
  	case 4:								\
  	{								\
  		asm volatile("\t" ASM_STAC "\n"				\
@@ -19961,7 +19989,7 @@ index 0d592e0..7430aad 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -597,14 +673,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -597,14 +675,14 @@ extern void __cmpxchg_wrong_size(void)
  			__cmpxchg_wrong_size();				\
  									\
  		asm volatile("\t" ASM_STAC "\n"				\
@@ -19978,7 +20006,7 @@ index 0d592e0..7430aad 100644
  			: "i" (-EFAULT), "r" (__new), "1" (__old)	\
  			: "memory"					\
  		);							\
-@@ -613,6 +689,7 @@ extern void __cmpxchg_wrong_size(void)
+@@ -613,6 +691,7 @@ extern void __cmpxchg_wrong_size(void)
  	default:							\
  		__cmpxchg_wrong_size();					\
  	}								\
@@ -19986,7 +20014,7 @@ index 0d592e0..7430aad 100644
  	*__uval = __old;						\
  	__ret;								\
  })
-@@ -636,17 +713,6 @@ extern struct movsl_mask {
+@@ -636,17 +715,6 @@ extern struct movsl_mask {
  
  #define ARCH_HAS_NOCACHE_UACCESS 1
  
@@ -20004,7 +20032,7 @@ index 0d592e0..7430aad 100644
  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
  # define copy_user_diag __compiletime_error
  #else
-@@ -656,7 +722,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
+@@ -656,7 +724,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
  extern void copy_user_diag("copy_from_user() buffer size is too small")
  copy_from_user_overflow(void);
  extern void copy_user_diag("copy_to_user() buffer size is too small")
@@ -20013,7 +20041,7 @@ index 0d592e0..7430aad 100644
  
  #undef copy_user_diag
  
-@@ -669,7 +735,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
+@@ -669,7 +737,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
  
  extern void
  __compiletime_warning("copy_to_user() buffer size is not provably correct")
@@ -20022,7 +20050,7 @@ index 0d592e0..7430aad 100644
  #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
  
  #else
-@@ -684,10 +750,16 @@ __copy_from_user_overflow(int size, unsigned long count)
+@@ -684,10 +752,16 @@ __copy_from_user_overflow(int size, unsigned long count)
  
  #endif
  
@@ -20040,7 +20068,7 @@ index 0d592e0..7430aad 100644
  
  	might_fault();
  
-@@ -709,12 +781,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -709,12 +783,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  	 * case, and do only runtime checking for non-constant sizes.
  	 */
  
@@ -20062,7 +20090,7 @@ index 0d592e0..7430aad 100644
  
  	return n;
  }
-@@ -722,17 +797,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -722,17 +799,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
  static inline unsigned long __must_check
  copy_to_user(void __user *to, const void *from, unsigned long n)
  {
@@ -33776,7 +33804,7 @@ index 9f0614d..92ae64a 100644
  	p += get_opcode(p, &opcode);
  	for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
 diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index 6fb6927..4fc13c0 100644
+index 6fb6927..634b0f7 100644
 --- a/arch/x86/mm/pgtable.c
 +++ b/arch/x86/mm/pgtable.c
 @@ -97,10 +97,71 @@ static inline void pgd_list_del(pgd_t *pgd)
@@ -33829,7 +33857,7 @@ index 6fb6927..4fc13c0 100644
 +#define pyd_t				pgd_t
 +#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
 +#define pgtable_pxd_page_ctor(page)	true
-+#define pgtable_pxd_page_dtor(page)
++#define pgtable_pxd_page_dtor(page)	do {} while (0)
 +#define pxd_free(mm, pud)		pud_free((mm), (pud))
 +#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
 +#define pyd_offset(mm, address)		pgd_offset((mm), (address))
@@ -36126,6 +36154,28 @@ index f890d43..97b0482 100644
  	if (do_copy)
  		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
  	else
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 2390c55..e3fefe4 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1456,7 +1456,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
+ 
+ 		do {
+ 			page = alloc_pages_node(set->numa_node,
+-				GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY,
++				GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO,
+ 				this_order);
+ 			if (page)
+ 				break;
+@@ -1478,8 +1478,6 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
+ 		left -= to_do * rq_size;
+ 		for (j = 0; j < to_do; j++) {
+ 			tags->rqs[i] = p;
+-			tags->rqs[i]->atomic_flags = 0;
+-			tags->rqs[i]->cmd_flags = 0;
+ 			if (set->ops->init_request) {
+ 				if (set->ops->init_request(set->driver_data,
+ 						tags->rqs[i], hctx_idx, i,
 diff --git a/block/blk-softirq.c b/block/blk-softirq.c
 index 53b1737..08177d2e 100644
 --- a/block/blk-softirq.c
@@ -36348,6 +36398,23 @@ index c305d41..a96de79 100644
  	if (!ret)
  		kobject_uevent(&pinst->kobj, KOBJ_ADD);
  
+diff --git a/crypto/zlib.c b/crypto/zlib.c
+index 0eefa9d..0fa3d29 100644
+--- a/crypto/zlib.c
++++ b/crypto/zlib.c
+@@ -95,10 +95,10 @@ static int zlib_compress_setup(struct crypto_pcomp *tfm, void *params,
+ 	zlib_comp_exit(ctx);
+ 
+ 	window_bits = tb[ZLIB_COMP_WINDOWBITS]
+-					? nla_get_u32(tb[ZLIB_COMP_WINDOWBITS])
++					? nla_get_s32(tb[ZLIB_COMP_WINDOWBITS])
+ 					: MAX_WBITS;
+ 	mem_level = tb[ZLIB_COMP_MEMLEVEL]
+-					? nla_get_u32(tb[ZLIB_COMP_MEMLEVEL])
++					? nla_get_s32(tb[ZLIB_COMP_MEMLEVEL])
+ 					: DEF_MEM_LEVEL;
+ 
+ 	workspacesize = zlib_deflate_workspacesize(window_bits, mem_level);
 diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
 index 6921c7f..78e1af7 100644
 --- a/drivers/acpi/acpica/hwxfsleep.c
@@ -40675,7 +40742,7 @@ index b250130..98df2a4 100644
  
  	imx_drm_crtc = kzalloc(sizeof(*imx_drm_crtc), GFP_KERNEL);
 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
-index b4a2014..219ab78 100644
+index b4a20149..219ab78 100644
 --- a/drivers/gpu/drm/mga/mga_drv.h
 +++ b/drivers/gpu/drm/mga/mga_drv.h
 @@ -122,9 +122,9 @@ typedef struct drm_mga_private {
@@ -44394,7 +44461,7 @@ index 43adbb8..7b34305 100644
  	pmd->bl_info.value_type.inc = data_block_inc;
  	pmd->bl_info.value_type.dec = data_block_dec;
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 64b10e0..07db8f4 100644
+index b71c600..d0b85b3 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
 @@ -185,9 +185,9 @@ struct mapped_device {
@@ -44429,7 +44496,7 @@ index 64b10e0..07db8f4 100644
  	wake_up(&md->eventq);
  }
  
-@@ -3034,18 +3034,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -3055,18 +3055,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
  
  uint32_t dm_next_uevent_seq(struct mapped_device *md)
  {
@@ -44709,9 +44776,39 @@ index 32e282f..5cec803 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 8577cc7..e80e05d 100644
+index 8577cc7..5779d5b 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
+@@ -950,23 +950,23 @@ async_copy_data(int frombio, struct bio *bio, struct page **page,
+ 	struct bio_vec bvl;
+ 	struct bvec_iter iter;
+ 	struct page *bio_page;
+-	int page_offset;
++	s64 page_offset;
+ 	struct async_submit_ctl submit;
+ 	enum async_tx_flags flags = 0;
+ 
+ 	if (bio->bi_iter.bi_sector >= sector)
+-		page_offset = (signed)(bio->bi_iter.bi_sector - sector) * 512;
++		page_offset = (s64)(bio->bi_iter.bi_sector - sector) * 512;
+ 	else
+-		page_offset = (signed)(sector - bio->bi_iter.bi_sector) * -512;
++		page_offset = (s64)(sector - bio->bi_iter.bi_sector) * -512;
+ 
+ 	if (frombio)
+ 		flags |= ASYNC_TX_FENCE;
+ 	init_async_submit(&submit, flags, tx, NULL, NULL, NULL);
+ 
+ 	bio_for_each_segment(bvl, bio, iter) {
+-		int len = bvl.bv_len;
+-		int clen;
+-		int b_offset = 0;
++		s64 len = bvl.bv_len;
++		s64 clen;
++		s64 b_offset = 0;
+ 
+ 		if (page_offset < 0) {
+ 			b_offset = -page_offset;
 @@ -1730,6 +1730,10 @@ static int grow_one_stripe(struct r5conf *conf, int hash)
  	return 1;
  }
@@ -51832,10 +51929,10 @@ index 011a336..fb2b7a0 100644
  	.read = fuse_read,
  };
 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 66a70e9..f82cea4 100644
+index a17f533..a2ff039 100644
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -2238,7 +2238,7 @@ int spi_bus_unlock(struct spi_master *master)
+@@ -2239,7 +2239,7 @@ int spi_bus_unlock(struct spi_master *master)
  EXPORT_SYMBOL_GPL(spi_bus_unlock);
  
  /* portable code must never pass more than 32 bytes */
@@ -52329,6 +52426,19 @@ index 46dad63..fe4acdc 100644
  
  /** Register functions (in the bus driver) to get called by visorchipset
   *  whenever a bus or device appears for which this service partition is
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 8d27db47..22d67c0 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1185,7 +1185,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ 	 * traditional iSCSI block I/O.
+ 	 */
+ 	if (iscsit_allocate_iovecs(cmd) < 0) {
+-		return iscsit_add_reject_cmd(cmd,
++		return iscsit_reject_cmd(cmd,
+ 				ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ 	}
+ 	immed_data = cmd->immediate_data;
 diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
 index 9512af6..045bf5a 100644
 --- a/drivers/target/sbp/sbp_target.c
@@ -61875,7 +61985,7 @@ index 999ff5c..2281df9 100644
  		retval = -EFAULT;
  		goto out_handle;
 diff --git a/fs/file.c b/fs/file.c
-index ee738ea..f6c1562 100644
+index ee738ea..f6c15629 100644
 --- a/fs/file.c
 +++ b/fs/file.c
 @@ -16,6 +16,7 @@
@@ -80368,7 +80478,7 @@ index c8c5659..d09f2ad 100644
   * Mark a position in code as unreachable.  This can be used to
   * suppress control flow warnings after asm blocks that transfer
 diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index fa6a314..752a6ef 100644
+index fa6a314..a1b01ad 100644
 --- a/include/linux/compiler.h
 +++ b/include/linux/compiler.h
 @@ -5,11 +5,14 @@
@@ -80538,7 +80648,16 @@ index fa6a314..752a6ef 100644
  /* Simple shorthand for a section definition */
  #ifndef __section
  # define __section(S) __attribute__ ((__section__(#S)))
-@@ -462,8 +528,9 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+@@ -383,6 +449,8 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+ # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+ #endif
+ 
++#define __type_is_unsigned(t) (__same_type((t)0, 0UL) || __same_type((t)0, 0U) || __same_type((t)0, (unsigned short)0) || __same_type((t)0, (unsigned char)0))
++
+ /* Is this type a native word size -- useful for atomic operations */
+ #ifndef __native_word
+ # define __native_word(t) (sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
+@@ -462,8 +530,9 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
   */
  #define __ACCESS_ONCE(x) ({ \
  	 __maybe_unused typeof(x) __var = (__force typeof(x)) 0; \
@@ -85467,28 +85586,24 @@ index e7a018e..49f8b17 100644
  extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
  				   unsigned long offset, size_t size,
 diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
-index 85893d7..4923581 100644
+index 85893d7..e78c660 100644
 --- a/include/linux/syscalls.h
 +++ b/include/linux/syscalls.h
-@@ -99,10 +99,16 @@ union bpf_attr;
- #define __MAP(n,...) __MAP##n(__VA_ARGS__)
- 
- #define __SC_DECL(t, a)	t a
-+#define __TYPE_IS_U(t) (__same_type((t)0, 0UL) || __same_type((t)0, 0U) || __same_type((t)0, (unsigned short)0) || __same_type((t)0, (unsigned char)0))
+@@ -102,7 +102,12 @@ union bpf_attr;
  #define __TYPE_IS_L(t)	(__same_type((t)0, 0L))
  #define __TYPE_IS_UL(t)	(__same_type((t)0, 0UL))
  #define __TYPE_IS_LL(t) (__same_type((t)0, 0LL) || __same_type((t)0, 0ULL))
 -#define __SC_LONG(t, a) __typeof(__builtin_choose_expr(__TYPE_IS_LL(t), 0LL, 0L)) a
-+#define __SC_LONG(t, a)	__typeof(				\
++#define __SC_LONG(t, a)	__typeof__(				\
 +	__builtin_choose_expr(					\
 +		sizeof(t) > sizeof(int),			\
 +		(t) 0,						\
-+		__builtin_choose_expr(__TYPE_IS_U(t), 0UL, 0L)	\
++		__builtin_choose_expr(__type_is_unsigned(t), 0UL, 0L)	\
 +	)) a
  #define __SC_CAST(t, a)	(t) a
  #define __SC_ARGS(t, a)	a
  #define __SC_TEST(t, a) (void)BUILD_BUG_ON_ZERO(!__TYPE_IS_LL(t) && sizeof(t) > sizeof(long))
-@@ -384,11 +390,11 @@ asmlinkage long sys_sync(void);
+@@ -384,11 +389,11 @@ asmlinkage long sys_sync(void);
  asmlinkage long sys_fsync(unsigned int fd);
  asmlinkage long sys_fdatasync(unsigned int fd);
  asmlinkage long sys_bdflush(int func, long data);
@@ -85504,7 +85619,7 @@ index 85893d7..4923581 100644
  asmlinkage long sys_truncate(const char __user *path, long length);
  asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length);
  asmlinkage long sys_stat(const char __user *filename,
-@@ -600,7 +606,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
+@@ -600,7 +605,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
  asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *);
  asmlinkage long sys_send(int, void __user *, size_t, unsigned);
  asmlinkage long sys_sendto(int, void __user *, size_t, unsigned,
@@ -88728,7 +88843,7 @@ index 60f6bb8..104bb07 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 19efcf133..7c05c93 100644
+index 7959624..c01b886 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -170,8 +170,15 @@ static struct srcu_struct pmus_srcu;
@@ -88800,7 +88915,7 @@ index 19efcf133..7c05c93 100644
  
  	arch_perf_update_userpage(userpg, now);
  
-@@ -4568,7 +4575,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -4578,7 +4585,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
  
  		/* Data. */
  		sp = perf_user_stack_pointer(regs);
@@ -88809,7 +88924,7 @@ index 19efcf133..7c05c93 100644
  		dyn_size = dump_size - rem;
  
  		perf_output_skip(handle, rem);
-@@ -4659,11 +4666,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4669,11 +4676,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
  	values[n++] = perf_event_count(event);
  	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
  		values[n++] = enabled +
@@ -88823,7 +88938,7 @@ index 19efcf133..7c05c93 100644
  	}
  	if (read_format & PERF_FORMAT_ID)
  		values[n++] = primary_event_id(event);
-@@ -6994,7 +7001,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -7004,7 +7011,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
  	event->parent		= parent_event;
  
  	event->ns		= get_pid_ns(task_active_pid_ns(current));
@@ -88832,7 +88947,7 @@ index 19efcf133..7c05c93 100644
  
  	event->state		= PERF_EVENT_STATE_INACTIVE;
  
-@@ -7275,6 +7282,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -7285,6 +7292,11 @@ SYSCALL_DEFINE5(perf_event_open,
  	if (flags & ~PERF_FLAG_ALL)
  		return -EINVAL;
  
@@ -88844,7 +88959,7 @@ index 19efcf133..7c05c93 100644
  	err = perf_copy_attr(attr_uptr, &attr);
  	if (err)
  		return err;
-@@ -7642,10 +7654,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -7652,10 +7664,10 @@ static void sync_child_event(struct perf_event *child_event,
  	/*
  	 * Add back the child's count to the parent's count:
  	 */
@@ -89707,7 +89822,7 @@ index 9a8a01a..3c35dd6 100644
  
  	/* Don't allow clients that don't understand the native
 diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 2777f40..a26e825 100644
+index 2777f40..a689506 100644
 --- a/kernel/kmod.c
 +++ b/kernel/kmod.c
 @@ -68,7 +68,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -89855,9 +89970,9 @@ index 2777f40..a26e825 100644
 +	*/
 +	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
 +	     strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
-+	     strncmp(sub_info->path, "/usr/libexec/", 13) &&
++	     strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
 +	     strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
++		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
 +		retval = -EPERM;
 +		goto out;
 +	}
@@ -95834,7 +95949,7 @@ index d53adf9..03a24bf 100644
  	set_fs(old_fs);
  
 diff --git a/mm/madvise.c b/mm/madvise.c
-index a271adc..831d82f 100644
+index a271adc..5e1a2b4 100644
 --- a/mm/madvise.c
 +++ b/mm/madvise.c
 @@ -51,6 +51,10 @@ static long madvise_behavior(struct vm_area_struct *vma,
@@ -95887,9 +96002,9 @@ index a271adc..831d82f 100644
 +				.nonlinear_vma = vma_m,
 +				.last_index = ULONG_MAX,
 +			};
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
++			zap_page_range(vma_m, start + SEGMEXEC_TASK_SIZE, end - start, &details);
 +		} else
-+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
++			zap_page_range(vma_m, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
 +	}
 +#endif
 +
@@ -96867,7 +96982,7 @@ index 73cf098..ab547c7 100644
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
 diff --git a/mm/mmap.c b/mm/mmap.c
-index e5cc3ca..bb9333f 100644
+index e5cc3ca..2bfa432 100644
 --- a/mm/mmap.c
 +++ b/mm/mmap.c
 @@ -41,6 +41,7 @@
@@ -96963,7 +97078,19 @@ index e5cc3ca..bb9333f 100644
  			      mm->end_data, mm->start_data))
  		goto out;
  
-@@ -978,6 +1007,12 @@ static int
+@@ -780,10 +809,8 @@ again:			remove_next = 1 + (end > next->vm_end);
+ 
+ 			importer->anon_vma = exporter->anon_vma;
+ 			error = anon_vma_clone(importer, exporter);
+-			if (error) {
+-				importer->anon_vma = NULL;
++			if (error)
+ 				return error;
+-			}
+ 		}
+ 	}
+ 
+@@ -978,6 +1005,12 @@ static int
  can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
  	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
  {
@@ -96976,7 +97103,7 @@ index e5cc3ca..bb9333f 100644
  	if (is_mergeable_vma(vma, file, vm_flags) &&
  	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
  		if (vma->vm_pgoff == vm_pgoff)
-@@ -997,6 +1032,12 @@ static int
+@@ -997,6 +1030,12 @@ static int
  can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
  	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
  {
@@ -96989,7 +97116,7 @@ index e5cc3ca..bb9333f 100644
  	if (is_mergeable_vma(vma, file, vm_flags) &&
  	    is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
  		pgoff_t vm_pglen;
-@@ -1046,6 +1087,13 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1046,6 +1085,13 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  	struct vm_area_struct *area, *next;
  	int err;
  
@@ -97003,7 +97130,7 @@ index e5cc3ca..bb9333f 100644
  	/*
  	 * We later require that vma->vm_flags == vm_flags,
  	 * so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -1061,6 +1109,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1061,6 +1107,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
  		next = next->vm_next;
  
@@ -97019,7 +97146,7 @@ index e5cc3ca..bb9333f 100644
  	/*
  	 * Can it merge with the predecessor?
  	 */
-@@ -1080,9 +1137,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1080,9 +1135,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  							/* cases 1, 6 */
  			err = vma_adjust(prev, prev->vm_start,
  				next->vm_end, prev->vm_pgoff, NULL);
@@ -97045,7 +97172,7 @@ index e5cc3ca..bb9333f 100644
  		if (err)
  			return NULL;
  		khugepaged_enter_vma_merge(prev, vm_flags);
-@@ -1096,12 +1168,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1096,12 +1166,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  			mpol_equal(policy, vma_policy(next)) &&
  			can_vma_merge_before(next, vm_flags,
  					anon_vma, file, pgoff+pglen)) {
@@ -97075,7 +97202,7 @@ index e5cc3ca..bb9333f 100644
  		if (err)
  			return NULL;
  		khugepaged_enter_vma_merge(area, vm_flags);
-@@ -1210,8 +1297,10 @@ none:
+@@ -1210,8 +1295,10 @@ none:
  void vm_stat_account(struct mm_struct *mm, unsigned long flags,
  						struct file *file, long pages)
  {
@@ -97088,7 +97215,7 @@ index e5cc3ca..bb9333f 100644
  
  	mm->total_vm += pages;
  
-@@ -1219,7 +1308,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+@@ -1219,7 +1306,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
  		mm->shared_vm += pages;
  		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
  			mm->exec_vm += pages;
@@ -97097,7 +97224,7 @@ index e5cc3ca..bb9333f 100644
  		mm->stack_vm += pages;
  }
  #endif /* CONFIG_PROC_FS */
-@@ -1249,6 +1338,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
+@@ -1249,6 +1336,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
@@ -97105,7 +97232,7 @@ index e5cc3ca..bb9333f 100644
  		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
  			return -EAGAIN;
  	}
-@@ -1275,7 +1365,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1275,7 +1363,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	 * (the exception is when the underlying filesystem is noexec
  	 *  mounted, in which case we dont add PROT_EXEC.)
  	 */
@@ -97114,7 +97241,7 @@ index e5cc3ca..bb9333f 100644
  		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
  			prot |= PROT_EXEC;
  
-@@ -1301,7 +1391,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1301,7 +1389,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	/* Obtain the address to map to. we verify (or select) it and ensure
  	 * that it represents a valid section of the address space.
  	 */
@@ -97123,7 +97250,7 @@ index e5cc3ca..bb9333f 100644
  	if (addr & ~PAGE_MASK)
  		return addr;
  
-@@ -1312,6 +1402,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1312,6 +1400,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
  			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
  
@@ -97167,7 +97294,7 @@ index e5cc3ca..bb9333f 100644
  	if (flags & MAP_LOCKED)
  		if (!can_do_mlock())
  			return -EPERM;
-@@ -1399,6 +1526,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1399,6 +1524,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
  			vm_flags |= VM_NORESERVE;
  	}
  
@@ -97177,7 +97304,7 @@ index e5cc3ca..bb9333f 100644
  	addr = mmap_region(file, addr, len, vm_flags, pgoff);
  	if (!IS_ERR_VALUE(addr) &&
  	    ((vm_flags & VM_LOCKED) ||
-@@ -1492,7 +1622,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
+@@ -1492,7 +1620,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
  	vm_flags_t vm_flags = vma->vm_flags;
  
  	/* If it was private or non-writable, the write bit is already clear */
@@ -97186,7 +97313,7 @@ index e5cc3ca..bb9333f 100644
  		return 0;
  
  	/* The backer wishes to know when pages are first written to? */
-@@ -1543,7 +1673,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1543,7 +1671,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  	struct rb_node **rb_link, *rb_parent;
  	unsigned long charged = 0;
  
@@ -97209,7 +97336,7 @@ index e5cc3ca..bb9333f 100644
  	if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
  		unsigned long nr_pages;
  
-@@ -1562,11 +1707,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1562,11 +1705,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
  
  	/* Clear old maps */
  	error = -ENOMEM;
@@ -97222,7 +97349,7 @@ index e5cc3ca..bb9333f 100644
  	}
  
  	/*
-@@ -1597,6 +1741,16 @@ munmap_back:
+@@ -1597,6 +1739,16 @@ munmap_back:
  		goto unacct_error;
  	}
  
@@ -97239,7 +97366,7 @@ index e5cc3ca..bb9333f 100644
  	vma->vm_mm = mm;
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
-@@ -1627,6 +1781,13 @@ munmap_back:
+@@ -1627,6 +1779,13 @@ munmap_back:
  		if (error)
  			goto unmap_and_free_vma;
  
@@ -97253,7 +97380,7 @@ index e5cc3ca..bb9333f 100644
  		/* Can addr have changed??
  		 *
  		 * Answer: Yes, several device drivers can do it in their
-@@ -1645,6 +1806,12 @@ munmap_back:
+@@ -1645,6 +1804,12 @@ munmap_back:
  	}
  
  	vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -97266,7 +97393,7 @@ index e5cc3ca..bb9333f 100644
  	/* Once vma denies write, undo our temporary denial count */
  	if (file) {
  		if (vm_flags & VM_SHARED)
-@@ -1657,6 +1824,7 @@ out:
+@@ -1657,6 +1822,7 @@ out:
  	perf_event_mmap(vma);
  
  	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
@@ -97274,7 +97401,7 @@ index e5cc3ca..bb9333f 100644
  	if (vm_flags & VM_LOCKED) {
  		if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
  					vma == get_gate_vma(current->mm)))
-@@ -1694,6 +1862,12 @@ allow_write_and_free_vma:
+@@ -1694,6 +1860,12 @@ allow_write_and_free_vma:
  	if (vm_flags & VM_DENYWRITE)
  		allow_write_access(file);
  free_vma:
@@ -97287,7 +97414,7 @@ index e5cc3ca..bb9333f 100644
  	kmem_cache_free(vm_area_cachep, vma);
  unacct_error:
  	if (charged)
-@@ -1701,7 +1875,63 @@ unacct_error:
+@@ -1701,7 +1873,63 @@ unacct_error:
  	return error;
  }
  
@@ -97352,7 +97479,7 @@ index e5cc3ca..bb9333f 100644
  {
  	/*
  	 * We implement the search by looking for an rbtree node that
-@@ -1749,11 +1979,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+@@ -1749,11 +1977,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
  			}
  		}
  
@@ -97383,7 +97510,7 @@ index e5cc3ca..bb9333f 100644
  		if (gap_end >= low_limit && gap_end - gap_start >= length)
  			goto found;
  
-@@ -1803,7 +2051,7 @@ found:
+@@ -1803,7 +2049,7 @@ found:
  	return gap_start;
  }
  
@@ -97392,7 +97519,7 @@ index e5cc3ca..bb9333f 100644
  {
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
-@@ -1857,6 +2105,24 @@ check_current:
+@@ -1857,6 +2103,24 @@ check_current:
  		gap_end = vma->vm_start;
  		if (gap_end < low_limit)
  			return -ENOMEM;
@@ -97417,7 +97544,7 @@ index e5cc3ca..bb9333f 100644
  		if (gap_start <= high_limit && gap_end - gap_start >= length)
  			goto found;
  
-@@ -1920,6 +2186,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1920,6 +2184,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
  	struct vm_unmapped_area_info info;
@@ -97425,7 +97552,7 @@ index e5cc3ca..bb9333f 100644
  
  	if (len > TASK_SIZE - mmap_min_addr)
  		return -ENOMEM;
-@@ -1927,11 +2194,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1927,11 +2192,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -97442,7 +97569,7 @@ index e5cc3ca..bb9333f 100644
  			return addr;
  	}
  
-@@ -1940,6 +2211,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1940,6 +2209,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
  	info.low_limit = mm->mmap_base;
  	info.high_limit = TASK_SIZE;
  	info.align_mask = 0;
@@ -97450,7 +97577,7 @@ index e5cc3ca..bb9333f 100644
  	return vm_unmapped_area(&info);
  }
  #endif
-@@ -1958,6 +2230,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1958,6 +2228,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	struct mm_struct *mm = current->mm;
  	unsigned long addr = addr0;
  	struct vm_unmapped_area_info info;
@@ -97458,7 +97585,7 @@ index e5cc3ca..bb9333f 100644
  
  	/* requested length too big for entire address space */
  	if (len > TASK_SIZE - mmap_min_addr)
-@@ -1966,12 +2239,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1966,12 +2237,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	if (flags & MAP_FIXED)
  		return addr;
  
@@ -97476,7 +97603,7 @@ index e5cc3ca..bb9333f 100644
  			return addr;
  	}
  
-@@ -1980,6 +2257,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1980,6 +2255,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
  	info.high_limit = mm->mmap_base;
  	info.align_mask = 0;
@@ -97484,7 +97611,7 @@ index e5cc3ca..bb9333f 100644
  	addr = vm_unmapped_area(&info);
  
  	/*
-@@ -1992,6 +2270,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1992,6 +2268,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
  		VM_BUG_ON(addr != -ENOMEM);
  		info.flags = 0;
  		info.low_limit = TASK_UNMAPPED_BASE;
@@ -97497,7 +97624,7 @@ index e5cc3ca..bb9333f 100644
  		info.high_limit = TASK_SIZE;
  		addr = vm_unmapped_area(&info);
  	}
-@@ -2092,6 +2376,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+@@ -2092,6 +2374,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
  	return vma;
  }
  
@@ -97526,7 +97653,7 @@ index e5cc3ca..bb9333f 100644
  /*
   * Verify that the stack growth is acceptable and
   * update accounting. This is shared with both the
-@@ -2109,8 +2415,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2109,8 +2413,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  
  	/* Stack limit test */
  	actual_size = size;
@@ -97536,7 +97663,7 @@ index e5cc3ca..bb9333f 100644
  	if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
  		return -ENOMEM;
  
-@@ -2121,6 +2426,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2121,6 +2424,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
  		locked = mm->locked_vm + grow;
  		limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
  		limit >>= PAGE_SHIFT;
@@ -97544,7 +97671,7 @@ index e5cc3ca..bb9333f 100644
  		if (locked > limit && !capable(CAP_IPC_LOCK))
  			return -ENOMEM;
  	}
-@@ -2150,37 +2456,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2150,37 +2454,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
   * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
   * vma is the last one with address > vma->vm_end.  Have to extend vma.
   */
@@ -97602,7 +97729,7 @@ index e5cc3ca..bb9333f 100644
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -2215,6 +2532,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2215,6 +2530,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
  			}
  		}
  	}
@@ -97611,7 +97738,7 @@ index e5cc3ca..bb9333f 100644
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma, vma->vm_flags);
  	validate_mm(vma->vm_mm);
-@@ -2229,6 +2548,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2229,6 +2546,8 @@ int expand_downwards(struct vm_area_struct *vma,
  				   unsigned long address)
  {
  	int error;
@@ -97620,7 +97747,7 @@ index e5cc3ca..bb9333f 100644
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -2242,6 +2563,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2242,6 +2561,15 @@ int expand_downwards(struct vm_area_struct *vma,
  	if (error)
  		return error;
  
@@ -97636,7 +97763,7 @@ index e5cc3ca..bb9333f 100644
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -2251,9 +2581,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2251,9 +2579,17 @@ int expand_downwards(struct vm_area_struct *vma,
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -97655,7 +97782,7 @@ index e5cc3ca..bb9333f 100644
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -2278,13 +2616,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2278,13 +2614,27 @@ int expand_downwards(struct vm_area_struct *vma,
  				vma->vm_pgoff -= grow;
  				anon_vma_interval_tree_post_update_vma(vma);
  				vma_gap_update(vma);
@@ -97683,7 +97810,7 @@ index e5cc3ca..bb9333f 100644
  	khugepaged_enter_vma_merge(vma, vma->vm_flags);
  	validate_mm(vma->vm_mm);
  	return error;
-@@ -2384,6 +2736,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2384,6 +2734,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -97697,7 +97824,7 @@ index e5cc3ca..bb9333f 100644
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2428,6 +2787,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2428,6 +2785,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -97714,7 +97841,7 @@ index e5cc3ca..bb9333f 100644
  		vma_rb_erase(vma, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -2455,14 +2824,33 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2455,14 +2822,33 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -97748,7 +97875,7 @@ index e5cc3ca..bb9333f 100644
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -2475,6 +2863,22 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2475,6 +2861,22 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -97771,7 +97898,7 @@ index e5cc3ca..bb9333f 100644
  	err = vma_dup_policy(vma, new);
  	if (err)
  		goto out_free_vma;
-@@ -2495,6 +2899,38 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2495,6 +2897,38 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -97810,7 +97937,7 @@ index e5cc3ca..bb9333f 100644
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -2504,10 +2940,18 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2504,10 +2938,18 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  		new->vm_ops->close(new);
  	if (new->vm_file)
  		fput(new->vm_file);
@@ -97830,7 +97957,7 @@ index e5cc3ca..bb9333f 100644
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2520,6 +2964,15 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2520,6 +2962,15 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -97846,7 +97973,7 @@ index e5cc3ca..bb9333f 100644
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2531,11 +2984,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2531,11 +2982,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
@@ -97877,7 +98004,7 @@ index e5cc3ca..bb9333f 100644
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2613,6 +3085,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2613,6 +3083,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -97886,7 +98013,7 @@ index e5cc3ca..bb9333f 100644
  	return 0;
  }
  
-@@ -2621,6 +3095,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2621,6 +3093,13 @@ int vm_munmap(unsigned long start, size_t len)
  	int ret;
  	struct mm_struct *mm = current->mm;
  
@@ -97900,7 +98027,7 @@ index e5cc3ca..bb9333f 100644
  	down_write(&mm->mmap_sem);
  	ret = do_munmap(mm, start, len);
  	up_write(&mm->mmap_sem);
-@@ -2634,16 +3115,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2634,16 +3113,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
  	return vm_munmap(addr, len);
  }
  
@@ -97917,7 +98044,7 @@ index e5cc3ca..bb9333f 100644
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2657,6 +3128,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2657,6 +3126,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	struct rb_node **rb_link, *rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -97925,7 +98052,7 @@ index e5cc3ca..bb9333f 100644
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2664,10 +3136,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2664,10 +3134,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -97950,7 +98077,7 @@ index e5cc3ca..bb9333f 100644
  	error = mlock_future_check(mm, mm->def_flags, len);
  	if (error)
  		return error;
-@@ -2681,21 +3167,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2681,21 +3165,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -97975,7 +98102,7 @@ index e5cc3ca..bb9333f 100644
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2709,7 +3194,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2709,7 +3192,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -97984,7 +98111,7 @@ index e5cc3ca..bb9333f 100644
  		return -ENOMEM;
  	}
  
-@@ -2723,10 +3208,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2723,10 +3206,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -97998,7 +98125,7 @@ index e5cc3ca..bb9333f 100644
  	return addr;
  }
  
-@@ -2788,6 +3274,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2788,6 +3272,7 @@ void exit_mmap(struct mm_struct *mm)
  	while (vma) {
  		if (vma->vm_flags & VM_ACCOUNT)
  			nr_accounted += vma_pages(vma);
@@ -98006,7 +98133,7 @@ index e5cc3ca..bb9333f 100644
  		vma = remove_vma(vma);
  	}
  	vm_unacct_memory(nr_accounted);
-@@ -2805,6 +3292,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2805,6 +3290,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	struct vm_area_struct *prev;
  	struct rb_node **rb_link, *rb_parent;
  
@@ -98020,7 +98147,7 @@ index e5cc3ca..bb9333f 100644
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2828,7 +3322,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2828,7 +3320,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
  
@@ -98042,7 +98169,7 @@ index e5cc3ca..bb9333f 100644
  	return 0;
  }
  
-@@ -2847,6 +3355,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2847,6 +3353,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	struct rb_node **rb_link, *rb_parent;
  	bool faulted_in_anon_vma = true;
  
@@ -98051,7 +98178,7 @@ index e5cc3ca..bb9333f 100644
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2911,6 +3421,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2911,6 +3419,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
  	return NULL;
  }
  
@@ -98091,7 +98218,7 @@ index e5cc3ca..bb9333f 100644
  /*
   * Return true if the calling process may expand its vm space by the passed
   * number of pages
-@@ -2922,6 +3465,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2922,6 +3463,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
  
@@ -98099,7 +98226,7 @@ index e5cc3ca..bb9333f 100644
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -3004,6 +3548,22 @@ static struct vm_area_struct *__install_special_mapping(
+@@ -3004,6 +3546,22 @@ static struct vm_area_struct *__install_special_mapping(
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -98736,7 +98863,7 @@ index 5077afc..846c9ef 100644
  	if (!mm || IS_ERR(mm)) {
  		rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
 diff --git a/mm/rmap.c b/mm/rmap.c
-index 71cd5bd..e259089 100644
+index 71cd5bd..0ff9eb3 100644
 --- a/mm/rmap.c
 +++ b/mm/rmap.c
 @@ -166,6 +166,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
@@ -98817,7 +98944,21 @@ index 71cd5bd..e259089 100644
  {
  	struct anon_vma_chain *avc, *pavc;
  	struct anon_vma *root = NULL;
-@@ -296,7 +331,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+@@ -287,6 +322,13 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ 	return 0;
+ 
+  enomem_failure:
++	/*
++	 * dst->anon_vma is dropped here otherwise its degree can be incorrectly
++	 * decremented in unlink_anon_vmas().
++	 * We can safely do this because callers of anon_vma_clone() don't care
++	 * about dst->anon_vma if anon_vma_clone() failed.
++	 */
++	dst->anon_vma = NULL;
+ 	unlink_anon_vmas(dst);
+ 	return -ENOMEM;
+ }
+@@ -296,7 +338,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
   * the corresponding VMA in the parent process is attached to.
   * Returns 0 on success, non-zero on failure.
   */
@@ -98826,7 +98967,7 @@ index 71cd5bd..e259089 100644
  {
  	struct anon_vma_chain *avc;
  	struct anon_vma *anon_vma;
-@@ -416,8 +451,10 @@ static void anon_vma_ctor(void *data)
+@@ -416,8 +458,10 @@ static void anon_vma_ctor(void *data)
  void __init anon_vma_init(void)
  {
  	anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma),
@@ -102484,6 +102625,25 @@ index f99f41b..1879da9 100644
  
  	return nh->nh_saddr;
  }
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index b986298..7e726da 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -765,12 +765,12 @@ EXPORT_SYMBOL(gue_build_header);
+ 
+ #ifdef CONFIG_NET_FOU_IP_TUNNELS
+ 
+-static const struct ip_tunnel_encap_ops __read_mostly fou_iptun_ops = {
++static const struct ip_tunnel_encap_ops fou_iptun_ops = {
+ 	.encap_hlen = fou_encap_hlen,
+ 	.build_header = fou_build_header,
+ };
+ 
+-static const struct ip_tunnel_encap_ops __read_mostly gue_iptun_ops = {
++static const struct ip_tunnel_encap_ops gue_iptun_ops = {
+ 	.encap_hlen = gue_encap_hlen,
+ 	.build_header = gue_build_header,
+ };
 diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
 index 9111a4e..3576905 100644
 --- a/net/ipv4/inet_hashtables.c
@@ -103300,6 +103460,19 @@ index 63d2680..2db9d6b 100644
  	} else if (fastopen) { /* received a valid RST pkt */
  		reqsk_fastopen_remove(sk, req, true);
  		tcp_reset(sk);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 9790f39..9f29453 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2931,6 +2931,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ 	}
+ #endif
+ 
++	/* Do not fool tcpdump (if any), clean our debris */
++	skb->tstamp.tv64 = 0;
+ 	return skb;
+ }
+ EXPORT_SYMBOL(tcp_make_synack);
 diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
 index ebf5ff5..4d1ff32 100644
 --- a/net/ipv4/tcp_probe.c
@@ -104529,7 +104702,7 @@ index e75d5c5..429fc95 100644
  		if (local->use_chanctx)
  			*chandef = local->monitor_chandef;
 diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index cc6e964..029a3a3 100644
+index fa7568c..74c815c 100644
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
 @@ -29,6 +29,7 @@
@@ -104540,7 +104713,7 @@ index cc6e964..029a3a3 100644
  #include "key.h"
  #include "sta_info.h"
  #include "debug.h"
-@@ -1114,7 +1115,7 @@ struct ieee80211_local {
+@@ -1125,7 +1126,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
@@ -104683,7 +104856,7 @@ index d53355b..21f583a 100644
  
  	if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
 diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 974ebe7..57bcd3c 100644
+index 1ce38e7..77267ad 100644
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
 @@ -1757,7 +1757,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
@@ -105486,6 +105659,18 @@ index e5b65ac..f3b6fb7 100644
  
  	if (likely(*recent == gen))
  		return 0;
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 378c3a6..ba4382c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -193,6 +193,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ 	}
+ 
+ 	atomic_set(&conn->c_state, RDS_CONN_DOWN);
++	conn->c_send_gen = 0;
+ 	conn->c_reconnect_jiffies = 0;
+ 	INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker);
+ 	INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker);
 diff --git a/net/rds/ib.h b/net/rds/ib.h
 index c36d713..af45bf2 100644
 --- a/net/rds/ib.h
@@ -105583,10 +105768,18 @@ index a66d179..cf1e258 100644
  #endif
  
 diff --git a/net/rds/rds.h b/net/rds/rds.h
-index c2a5eef..90ba1fd 100644
+index c2a5eef..87a7460 100644
 --- a/net/rds/rds.h
 +++ b/net/rds/rds.h
-@@ -448,7 +448,7 @@ struct rds_transport {
+@@ -110,6 +110,7 @@ struct rds_connection {
+ 	void			*c_transport_data;
+ 
+ 	atomic_t		c_state;
++	unsigned long		c_send_gen;
+ 	unsigned long		c_flags;
+ 	unsigned long		c_reconnect_jiffies;
+ 	struct delayed_work	c_send_w;
+@@ -448,7 +449,7 @@ struct rds_transport {
  	void (*sync_mr)(void *trans_private, int direction);
  	void (*free_mr)(void *trans_private, int invalidate);
  	void (*flush_mrs)(void);
@@ -105595,6 +105788,85 @@ index c2a5eef..90ba1fd 100644
  
  struct rds_sock {
  	struct sock		rs_sk;
+diff --git a/net/rds/send.c b/net/rds/send.c
+index 42f65d4..49f77ef 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn)
+ 	struct scatterlist *sg;
+ 	int ret = 0;
+ 	LIST_HEAD(to_be_dropped);
++	int batch_count;
++	unsigned long send_gen = 0;
+ 
+ restart:
++	batch_count = 0;
+ 
+ 	/*
+ 	 * sendmsg calls here after having queued its message on the send
+@@ -157,6 +160,17 @@ restart:
+ 	}
+ 
+ 	/*
++	 * we record the send generation after doing the xmit acquire.
++	 * if someone else manages to jump in and do some work, we'll use
++	 * this to avoid a goto restart farther down.
++	 *
++	 * The acquire_in_xmit() check above ensures that only one
++	 * caller can increment c_send_gen at any time.
++	 */
++	conn->c_send_gen++;
++	send_gen = conn->c_send_gen;
++
++	/*
+ 	 * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+ 	 * we do the opposite to avoid races.
+ 	 */
+@@ -202,6 +216,16 @@ restart:
+ 		if (!rm) {
+ 			unsigned int len;
+ 
++			batch_count++;
++
++			/* we want to process as big a batch as we can, but
++			 * we also want to avoid softlockups.  If we've been
++			 * through a lot of messages, lets back off and see
++			 * if anyone else jumps in
++			 */
++			if (batch_count >= 1024)
++				goto over_batch;
++
+ 			spin_lock_irqsave(&conn->c_lock, flags);
+ 
+ 			if (!list_empty(&conn->c_send_queue)) {
+@@ -357,9 +381,9 @@ restart:
+ 		}
+ 	}
+ 
++over_batch:
+ 	if (conn->c_trans->xmit_complete)
+ 		conn->c_trans->xmit_complete(conn);
+-
+ 	release_in_xmit(conn);
+ 
+ 	/* Nuke any messages we decided not to retransmit. */
+@@ -380,10 +404,15 @@ restart:
+ 	 * If the transport cannot continue (i.e ret != 0), then it must
+ 	 * call us when more room is available, such as from the tx
+ 	 * completion handler.
++	 *
++	 * We have an extra generation check here so that if someone manages
++	 * to jump in after our release_in_xmit, we'll see that they have done
++	 * some work and we will skip our goto
+ 	 */
+ 	if (ret == 0) {
+ 		smp_mb();
+-		if (!list_empty(&conn->c_send_queue)) {
++		if (!list_empty(&conn->c_send_queue) &&
++		    send_gen == conn->c_send_gen) {
+ 			rds_stats_inc(s_send_lock_queue_raced);
+ 			goto restart;
+ 		}
 diff --git a/net/rds/tcp.c b/net/rds/tcp.c
 index edac9ef..16bcb98 100644
 --- a/net/rds/tcp.c
@@ -106740,7 +107012,7 @@ index 0344206..bff8abf 100644
  	sub->evt.event = htohl(event, sub->swap);
  	sub->evt.found_lower = htohl(found_lower, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8e1b102..900d70f 100644
+index 8e1b102..20af1b2 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -106821,12 +107093,33 @@ index 8e1b102..900d70f 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2378,8 +2404,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2376,10 +2402,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ 				seq_putc(seq, '@');
+ 				i++;
  			}
- 			for ( ; i < len; i++)
- 				seq_putc(seq, u->addr->name->sun_path[i]);
+-			for ( ; i < len; i++)
+-				seq_putc(seq, u->addr->name->sun_path[i]);
 -		}
 -		unix_state_unlock(s);
++			for ( ; i < len; i++) {
++				char c = u->addr->name->sun_path[i];
++				switch (c) {
++				case '\n':
++					seq_putc(seq, '\\');
++					seq_putc(seq, 'n');
++					break;
++				case '\t':
++					seq_putc(seq, '\\');
++					seq_putc(seq, 't');
++					break;
++				case '\\':
++					seq_putc(seq, '\\');
++					seq_putc(seq, '\\');
++					break;
++				default:
++					seq_putc(seq, c);
++				}
++			}
 +		} else if (peer)
 +			seq_printf(seq, " P%lu", sock_i_ino(peer));
 +
@@ -107371,14 +107664,14 @@ index b304068..462d24e 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..822fa9e
+index 0000000..eaa4fce
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
 @@ -0,0 +1,51 @@
 +#!/bin/sh
 +srctree=$(dirname "$0")
 +gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
 +#include "gcc-common.h"
 +#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2 CXX
@@ -107804,7 +108097,7 @@ index cdb491d..8d32bfc 100755
  # Find all available archs
  find_all_archs()
 diff --git a/security/Kconfig b/security/Kconfig
-index beb86b5..653742f 100644
+index beb86b5..3bc66c1 100644
 --- a/security/Kconfig
 +++ b/security/Kconfig
 @@ -4,6 +4,975 @@
@@ -108122,9 +108415,9 @@ index beb86b5..653742f 100644
 +	bool 'Use filesystem extended attributes marking'
 +	default y if GRKERNSEC_CONFIG_AUTO
 +	select CIFS_XATTR if CIFS
-+	select F2FS_FS_XATTR if F2FS_FS
 +	select EXT2_FS_XATTR if EXT2_FS
 +	select EXT3_FS_XATTR if EXT3_FS
++	select F2FS_FS_XATTR if F2FS_FS
 +	select JFFS2_FS_XATTR if JFFS2_FS
 +	select REISERFS_FS_XATTR if REISERFS_FS
 +	select SQUASHFS_XATTR if SQUASHFS
@@ -109217,6 +109510,19 @@ index 1450f85..a91e0bc 100644
  		rt_genid_bump_all(net);
  	}
  	rtnl_unlock();
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 33db1ad..138949a 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ 		goto out;
+ 
+ 	/* No partial writes. */
+-	length = EINVAL;
++	length = -EINVAL;
+ 	if (*ppos != 0)
+ 		goto out;
+ 
 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
 index a717877..0747450 100644
 --- a/security/smack/smack_lsm.c
@@ -110350,10 +110656,10 @@ index 0000000..5452feea
 +}
 diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
 new file mode 100644
-index 0000000..54461af
+index 0000000..d44bd9f
 --- /dev/null
 +++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,210 @@
+@@ -0,0 +1,215 @@
 +/*
 + * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -110458,7 +110764,8 @@ index 0000000..54461af
 +#if BUILDING_GCC_VERSION >= 4008
 +		.optinfo_flags		= OPTGROUP_NONE,
 +#endif
-+#if BUILDING_GCC_VERSION >= 4009
++#if BUILDING_GCC_VERSION >= 5000
++#elif BUILDING_GCC_VERSION == 4009
 +		.has_gate		= false,
 +		.has_execute		= true,
 +#else
@@ -110484,7 +110791,11 @@ index 0000000..54461af
 +class colorize_rearm_pass : public simple_ipa_opt_pass {
 +public:
 +	colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
++#if BUILDING_GCC_VERSION >= 5000
++	virtual unsigned int execute(function *) { return execute_colorize_rearm(); }
++#else
 +	unsigned int execute() { return execute_colorize_rearm(); }
++#endif
 +};
 +}
 +
@@ -116268,10 +116579,10 @@ index 0000000..b8e7188
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..b125100
+index 0000000..889a054
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,27713 @@
+@@ -0,0 +1,27714 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL nohasharray
 +iwl_set_tx_power_1 iwl_set_tx_power 0 1 &intel_fake_agp_alloc_by_type_1
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
@@ -119979,6 +120290,7 @@ index 0000000..b125100
 +ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 4-3 8785 NULL
 +show_hardware_8789 show_hardware 0 8789 NULL
 +edd_show_sectors_8794 edd_show_sectors 0 8794 NULL
++__bitmap_weight_8796 __bitmap_weight 0 8796 NULL
 +ip_vs_remote_request6_8805 ip_vs_remote_request6 0 8805 NULL
 +gfs2_glock_nq_8808 gfs2_glock_nq 0 8808 NULL nohasharray
 +prod_id2_show_8808 prod_id2_show 0 8808 &gfs2_glock_nq_8808 nohasharray
diff --git a/3.19.3/4425_grsec_remove_EI_PAX.patch b/3.19.4/4425_grsec_remove_EI_PAX.patch
index 86e242a..86e242a 100644
--- a/3.19.3/4425_grsec_remove_EI_PAX.patch
+++ b/3.19.4/4425_grsec_remove_EI_PAX.patch
diff --git a/3.19.3/4427_force_XATTR_PAX_tmpfs.patch b/3.19.4/4427_force_XATTR_PAX_tmpfs.patch
index 22c9273..22c9273 100644
--- a/3.19.3/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.19.4/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.19.3/4430_grsec-remove-localversion-grsec.patch b/3.19.4/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.19.3/4430_grsec-remove-localversion-grsec.patch
+++ b/3.19.4/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.19.3/4435_grsec-mute-warnings.patch b/3.19.4/4435_grsec-mute-warnings.patch
index 0585e08..0585e08 100644
--- a/3.19.3/4435_grsec-mute-warnings.patch
+++ b/3.19.4/4435_grsec-mute-warnings.patch
diff --git a/3.19.3/4440_grsec-remove-protected-paths.patch b/3.19.4/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.19.3/4440_grsec-remove-protected-paths.patch
+++ b/3.19.4/4440_grsec-remove-protected-paths.patch
diff --git a/3.19.3/4450_grsec-kconfig-default-gids.patch b/3.19.4/4450_grsec-kconfig-default-gids.patch
index 5c025da..5c025da 100644
--- a/3.19.3/4450_grsec-kconfig-default-gids.patch
+++ b/3.19.4/4450_grsec-kconfig-default-gids.patch
diff --git a/3.19.3/4465_selinux-avc_audit-log-curr_ip.patch b/3.19.4/4465_selinux-avc_audit-log-curr_ip.patch
index ba89596..ba89596 100644
--- a/3.19.3/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.19.4/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.19.3/4470_disable-compat_vdso.patch b/3.19.4/4470_disable-compat_vdso.patch
index 2192180..2192180 100644
--- a/3.19.3/4470_disable-compat_vdso.patch
+++ b/3.19.4/4470_disable-compat_vdso.patch
diff --git a/3.19.3/4475_emutramp_default_on.patch b/3.19.4/4475_emutramp_default_on.patch
index ad4967a..ad4967a 100644
--- a/3.19.3/4475_emutramp_default_on.patch
+++ b/3.19.4/4475_emutramp_default_on.patch
diff --git a/3.2.68/0000_README b/3.2.68/0000_README
index b13028d..1221adb 100644
--- a/3.2.68/0000_README
+++ b/3.2.68/0000_README
@@ -190,7 +190,7 @@ Patch:	1067_linux-3.2.68.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.68
 
-Patch:	4420_grsecurity-3.1-3.2.68-201504021823.patch
+Patch:	4420_grsecurity-3.1-3.2.68-201504142258.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.68/4420_grsecurity-3.1-3.2.68-201504021823.patch b/3.2.68/4420_grsecurity-3.1-3.2.68-201504142258.patch
index e85b221..6147d13 100644
--- a/3.2.68/4420_grsecurity-3.1-3.2.68-201504021823.patch
+++ b/3.2.68/4420_grsecurity-3.1-3.2.68-201504142258.patch
@@ -4004,7 +4004,7 @@ index e59cd1a..8e329d6 100644
       typedef struct { unsigned long long pte; } pte_t;
       #define pte_val(x)	((x).pte)
 diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
-index 881d18b..cea38bc 100644
+index 881d18b4..cea38bc 100644
 --- a/arch/mips/include/asm/pgalloc.h
 +++ b/arch/mips/include/asm/pgalloc.h
 @@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
@@ -11408,6 +11408,28 @@ index 3470624..9b476a3 100644
  	ret
 +ENDPROC(aesni_ctr_enc)
  #endif
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index 16acf68..3b3a62f 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -1202,7 +1202,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ 		src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
+ 		if (!src)
+ 			return -ENOMEM;
+-		assoc = (src + req->cryptlen + auth_tag_len);
++		assoc = (src + req->cryptlen);
+ 		scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
+ 		scatterwalk_map_and_copy(assoc, req->assoc, 0,
+ 			req->assoclen, 0);
+@@ -1227,7 +1227,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ 		scatterwalk_done(&src_sg_walk, 0, 0);
+ 		scatterwalk_done(&assoc_sg_walk, 0, 0);
+ 	} else {
+-		scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
++		scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
+ 		kfree(src);
+ 	}
+ 	return retval;
 diff --git a/arch/x86/crypto/blowfish-x86_64-asm_64.S b/arch/x86/crypto/blowfish-x86_64-asm_64.S
 index 391d245..c73d634 100644
 --- a/arch/x86/crypto/blowfish-x86_64-asm_64.S
@@ -90544,7 +90566,7 @@ index dc7bc08..4601964 100644
  
  	/* Don't allow clients that don't understand the native
 diff --git a/kernel/kmod.c b/kernel/kmod.c
-index a16dac1..d6f7dbc 100644
+index a16dac1..e744189 100644
 --- a/kernel/kmod.c
 +++ b/kernel/kmod.c
 @@ -64,7 +64,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -90683,9 +90705,9 @@ index a16dac1..d6f7dbc 100644
 +	*/
 +	if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
 +	     strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
-+	     strncmp(sub_info->path, "/usr/libexec/", 13) &&
++	     strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
 +	     strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
++		printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
 +		retval = -EPERM;
 +		goto fail;
 +	}
@@ -108467,6 +108489,18 @@ index e5b65ac..f3b6fb7 100644
  
  	if (likely(*recent == gen))
  		return 0;
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 9e07c75..da1c1fe 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -188,6 +188,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ 	}
+ 
+ 	atomic_set(&conn->c_state, RDS_CONN_DOWN);
++	conn->c_send_gen = 0;
+ 	conn->c_reconnect_jiffies = 0;
+ 	INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker);
+ 	INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker);
 diff --git a/net/rds/ib.h b/net/rds/ib.h
 index edfaaaf..8c89879 100644
 --- a/net/rds/ib.h
@@ -108688,10 +108722,18 @@ index 4e37c1c..40084d8 100644
  		rds_rdma_free_op(op);
  	else
 diff --git a/net/rds/rds.h b/net/rds/rds.h
-index 7eaba18..a3c303f 100644
+index 7eaba18..b322557 100644
 --- a/net/rds/rds.h
 +++ b/net/rds/rds.h
-@@ -449,7 +449,7 @@ struct rds_transport {
+@@ -110,6 +110,7 @@ struct rds_connection {
+ 	void			*c_transport_data;
+ 
+ 	atomic_t		c_state;
++	unsigned long		c_send_gen;
+ 	unsigned long		c_flags;
+ 	unsigned long		c_reconnect_jiffies;
+ 	struct delayed_work	c_send_w;
+@@ -449,7 +450,7 @@ struct rds_transport {
  	void (*sync_mr)(void *trans_private, int direction);
  	void (*free_mr)(void *trans_private, int invalidate);
  	void (*flush_mrs)(void);
@@ -108701,10 +108743,85 @@ index 7eaba18..a3c303f 100644
  struct rds_sock {
  	struct sock		rs_sk;
 diff --git a/net/rds/send.c b/net/rds/send.c
-index 88eace5..b5947e7 100644
+index 88eace5..f33ba5d 100644
 --- a/net/rds/send.c
 +++ b/net/rds/send.c
-@@ -593,8 +593,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
+@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn)
+ 	struct scatterlist *sg;
+ 	int ret = 0;
+ 	LIST_HEAD(to_be_dropped);
++	int batch_count;
++	unsigned long send_gen = 0;
+ 
+ restart:
++	batch_count = 0;
+ 
+ 	/*
+ 	 * sendmsg calls here after having queued its message on the send
+@@ -157,6 +160,17 @@ restart:
+ 	}
+ 
+ 	/*
++	 * we record the send generation after doing the xmit acquire.
++	 * if someone else manages to jump in and do some work, we'll use
++	 * this to avoid a goto restart farther down.
++	 *
++	 * The acquire_in_xmit() check above ensures that only one
++	 * caller can increment c_send_gen at any time.
++	 */
++	conn->c_send_gen++;
++	send_gen = conn->c_send_gen;
++
++	/*
+ 	 * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+ 	 * we do the opposite to avoid races.
+ 	 */
+@@ -202,6 +216,16 @@ restart:
+ 		if (!rm) {
+ 			unsigned int len;
+ 
++			batch_count++;
++
++			/* we want to process as big a batch as we can, but
++			 * we also want to avoid softlockups.  If we've been
++			 * through a lot of messages, lets back off and see
++			 * if anyone else jumps in
++			 */
++			if (batch_count >= 1024)
++				goto over_batch;
++
+ 			spin_lock_irqsave(&conn->c_lock, flags);
+ 
+ 			if (!list_empty(&conn->c_send_queue)) {
+@@ -357,9 +381,9 @@ restart:
+ 		}
+ 	}
+ 
++over_batch:
+ 	if (conn->c_trans->xmit_complete)
+ 		conn->c_trans->xmit_complete(conn);
+-
+ 	release_in_xmit(conn);
+ 
+ 	/* Nuke any messages we decided not to retransmit. */
+@@ -380,10 +404,15 @@ restart:
+ 	 * If the transport cannot continue (i.e ret != 0), then it must
+ 	 * call us when more room is available, such as from the tx
+ 	 * completion handler.
++	 *
++	 * We have an extra generation check here so that if someone manages
++	 * to jump in after our release_in_xmit, we'll see that they have done
++	 * some work and we will skip our goto
+ 	 */
+ 	if (ret == 0) {
+ 		smp_mb();
+-		if (!list_empty(&conn->c_send_queue)) {
++		if (!list_empty(&conn->c_send_queue) &&
++		    send_gen == conn->c_send_gen) {
+ 			rds_stats_inc(s_send_lock_queue_raced);
+ 			goto restart;
+ 		}
+@@ -593,8 +622,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
  				sock_put(rds_rs_to_sk(rs));
  			}
  			rs = rm->m_rs;
@@ -108717,7 +108834,7 @@ index 88eace5..b5947e7 100644
  		spin_lock(&rs->rs_lock);
  
  		if (test_and_clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags)) {
-@@ -638,9 +641,6 @@ unlock_and_drop:
+@@ -638,9 +670,6 @@ unlock_and_drop:
   * queue. This means that in the TCP case, the message may not have been
   * assigned the m_ack_seq yet - but that's fine as long as tcp_is_acked
   * checks the RDS_MSG_HAS_ACK_SEQ bit.
@@ -108727,7 +108844,7 @@ index 88eace5..b5947e7 100644
   */
  void rds_send_drop_acked(struct rds_connection *conn, u64 ack,
  			 is_acked_func is_acked)
-@@ -711,6 +711,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
+@@ -711,6 +740,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
  		 */
  		if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
  			spin_unlock_irqrestore(&conn->c_lock, flags);
@@ -110489,7 +110606,7 @@ index 1983717..4d6102c 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8705ee3..c66fcaa 100644
+index 8705ee3..cf68ef1 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -110570,12 +110687,33 @@ index 8705ee3..c66fcaa 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2305,8 +2332,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2303,10 +2330,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ 				seq_putc(seq, '@');
+ 				i++;
  			}
- 			for ( ; i < len; i++)
- 				seq_putc(seq, u->addr->name->sun_path[i]);
+-			for ( ; i < len; i++)
+-				seq_putc(seq, u->addr->name->sun_path[i]);
 -		}
 -		unix_state_unlock(s);
++			for ( ; i < len; i++) {
++				char c = u->addr->name->sun_path[i];
++				switch (c) {
++				case '\n':
++					seq_putc(seq, '\\');
++					seq_putc(seq, 'n');
++					break;
++				case '\t':
++					seq_putc(seq, '\\');
++					seq_putc(seq, 't');
++					break;
++				case '\\':
++					seq_putc(seq, '\\');
++					seq_putc(seq, '\\');
++					break;
++				default:
++					seq_putc(seq, c);
++				}
++			}
 +		} else if (peer)
 +			seq_printf(seq, " P%lu", sock_i_ino(peer));
 +
@@ -111183,14 +111321,14 @@ index cb1f50c..cef2a7c 100644
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
 diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
 new file mode 100644
-index 0000000..822fa9e
+index 0000000..eaa4fce
 --- /dev/null
 +++ b/scripts/gcc-plugin.sh
 @@ -0,0 +1,51 @@
 +#!/bin/sh
 +srctree=$(dirname "$0")
 +gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
 +#include "gcc-common.h"
 +#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
 +#warning $2 CXX
@@ -114167,6 +114305,19 @@ index b43813c..74be837 100644
  }
  #else
  static inline int selinux_xfrm_enabled(void)
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 4dd8dcf..bac8928 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ 		goto out;
+ 
+ 	/* No partial writes. */
+-	length = EINVAL;
++	length = -EINVAL;
+ 	if (*ppos != 0)
+ 		goto out;
+ 
 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
 index e3adb49..9798c61 100644
 --- a/security/smack/smack_lsm.c
@@ -115021,11 +115172,12 @@ index 0a7ca6c..f4b948c 100644
  };
 diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
 new file mode 100644
-index 0000000..de92ed9
+index 0000000..60e7af2
 --- /dev/null
 +++ b/tools/gcc/.gitignore
-@@ -0,0 +1 @@
+@@ -0,0 +1,2 @@
 +randomize_layout_seed.h
++randomize_layout_hash.h
 diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
 new file mode 100644
 index 0000000..7b8921f
@@ -115242,10 +115394,10 @@ index 0000000..5452feea
 +}
 diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
 new file mode 100644
-index 0000000..54461af
+index 0000000..d44bd9f
 --- /dev/null
 +++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,210 @@
+@@ -0,0 +1,215 @@
 +/*
 + * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -115350,7 +115502,8 @@ index 0000000..54461af
 +#if BUILDING_GCC_VERSION >= 4008
 +		.optinfo_flags		= OPTGROUP_NONE,
 +#endif
-+#if BUILDING_GCC_VERSION >= 4009
++#if BUILDING_GCC_VERSION >= 5000
++#elif BUILDING_GCC_VERSION == 4009
 +		.has_gate		= false,
 +		.has_execute		= true,
 +#else
@@ -115376,7 +115529,11 @@ index 0000000..54461af
 +class colorize_rearm_pass : public simple_ipa_opt_pass {
 +public:
 +	colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
++#if BUILDING_GCC_VERSION >= 5000
++	virtual unsigned int execute(function *) { return execute_colorize_rearm(); }
++#else
 +	unsigned int execute() { return execute_colorize_rearm(); }
++#endif
 +};
 +}
 +
@@ -116022,10 +116179,10 @@ index 0000000..3b5af59
 +}
 diff --git a/tools/gcc/gcc-common.h b/tools/gcc/gcc-common.h
 new file mode 100644
-index 0000000..cd95c07
+index 0000000..14ec226
 --- /dev/null
 +++ b/tools/gcc/gcc-common.h
-@@ -0,0 +1,375 @@
+@@ -0,0 +1,520 @@
 +#ifndef GCC_COMMON_H_INCLUDED
 +#define GCC_COMMON_H_INCLUDED
 +
@@ -116106,6 +116263,10 @@ index 0000000..cd95c07
 +#include "tree-cfgcleanup.h"
 +#endif
 +
++#if BUILDING_GCC_VERSION >= 4008
++#include "is-a.h"
++#endif
++
 +#include "diagnostic.h"
 +//#include "tree-diagnostic.h"
 +#include "tree-dump.h"
@@ -116148,6 +116309,9 @@ index 0000000..cd95c07
 +//#include "lto-streamer.h"
 +#endif
 +//#include "lto-compress.h"
++#if BUILDING_GCC_VERSION >= 5000
++//#include "lto-section-names.h"
++#endif
 +
 +//#include "expr.h" where are you...
 +extern rtx emit_move_insn(rtx x, rtx y);
@@ -116176,11 +116340,11 @@ index 0000000..cd95c07
 +#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
 +
 +#if BUILDING_GCC_VERSION == 4005
-+#define FOR_EACH_VEC_ELT_REVERSE(T,V,I,P) for (I = VEC_length(T, (V)) - 1; VEC_iterate(T, (V), (I), (P)); (I)--)
-+#define FOR_EACH_LOCAL_DECL(FUN, I, D) FOR_EACH_VEC_ELT_REVERSE(tree, (FUN)->local_decls, I, D)
++#define FOR_EACH_LOCAL_DECL(FUN, I, D) for (tree vars = (FUN)->local_decls; vars && (D = TREE_VALUE(vars)); vars = TREE_CHAIN(vars), I)
 +#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
 +#define FOR_EACH_VEC_ELT(T, V, I, P) for (I = 0; VEC_iterate(T, (V), (I), (P)); ++(I))
 +#define TODO_rebuild_cgraph_edges 0
++#define SCOPE_FILE_SCOPE_P(EXP) (!(EXP))
 +
 +#ifndef O_BINARY
 +#define O_BINARY 0
@@ -116324,6 +116488,7 @@ index 0000000..cd95c07
 +#define PROP_loops 0
 +#define NODE_SYMBOL(node) (node)
 +#define NODE_DECL(node) (node)->decl
++#define INSN_LOCATION(INSN) RTL_LOCATION(INSN)
 +
 +static inline int bb_loop_depth(const_basic_block bb)
 +{
@@ -116344,6 +116509,13 @@ index 0000000..cd95c07
 +	cgraph_create_edge_including_clones((caller), (callee), (old_call_stmt), (call_stmt), (count), (freq), (reason))
 +#endif
 +
++#if BUILDING_GCC_VERSION == 4007 || BUILDING_GCC_VERSION == 4008
++static inline struct cgraph_node *cgraph_alias_target(struct cgraph_node *n)
++{
++	return cgraph_alias_aliased_node(n);
++}
++#endif
++
 +#if BUILDING_GCC_VERSION <= 4008
 +#define ENTRY_BLOCK_PTR_FOR_FN(FN)	ENTRY_BLOCK_PTR_FOR_FUNCTION(FN)
 +#define EXIT_BLOCK_PTR_FOR_FN(FN)	EXIT_BLOCK_PTR_FOR_FUNCTION(FN)
@@ -116363,6 +116535,11 @@ index 0000000..cd95c07
 +}
 +
 +#define ipa_remove_stmt_references(cnode, stmt)
++typedef union gimple_statement_d gasm;
++typedef union gimple_statement_d gassign;
++typedef union gimple_statement_d gcall;
++typedef union gimple_statement_d gphi;
++typedef union gimple_statement_d greturn;
 +#endif
 +
 +#if BUILDING_GCC_VERSION == 4008
@@ -116380,6 +116557,29 @@ index 0000000..cd95c07
 +
 +#if BUILDING_GCC_VERSION <= 4009
 +#define TODO_verify_il 0
++#define AVAIL_INTERPOSABLE AVAIL_OVERWRITABLE
++#endif
++
++#if BUILDING_GCC_VERSION == 4009
++typedef struct gimple_statement_base gasm;
++typedef struct gimple_statement_base gassign;
++typedef struct gimple_statement_base gcall;
++typedef struct gimple_statement_base gphi;
++typedef struct gimple_statement_base greturn;
++#endif
++
++#if BUILDING_GCC_VERSION <= 4009
++typedef struct rtx_def rtx_insn;
++
++static inline gasm *as_a_gasm(gimple stmt)
++{
++	return stmt;
++}
++
++static inline gcall *as_a_gcall(gimple stmt)
++{
++	return stmt;
++}
 +#endif
 +
 +#if BUILDING_GCC_VERSION >= 4009
@@ -116396,8 +116596,110 @@ index 0000000..cd95c07
 +#define TODO_verify_stmts TODO_verify_il
 +#define TODO_verify_rtl_sharing TODO_verify_il
 +
++#define TREE_INT_CST_HIGH(NODE) ({ TREE_INT_CST_EXT_NUNITS(NODE) > 1 ? (unsigned HOST_WIDE_INT)TREE_INT_CST_ELT(NODE, 1) : 0; })
++
++#define INSN_DELETED_P(insn) (insn)->deleted()
++
++extern bool is_simple_builtin(tree);
++
++// symtab/cgraph related
 +#define debug_cgraph_node(node) (node)->debug()
 +#define cgraph_get_node(decl) cgraph_node::get(decl)
++#define cgraph_n_nodes symtab->cgraph_count
++#define cgraph_max_uid symtab->cgraph_max_uid
++
++typedef struct cgraph_node *cgraph_node_ptr;
++typedef struct cgraph_edge *cgraph_edge_p;
++
++static inline void change_decl_assembler_name(tree decl, tree name)
++{
++	symtab->change_decl_assembler_name(decl, name);
++}
++
++static inline void varpool_finalize_decl(tree decl)
++{
++	varpool_node::finalize_decl(decl);
++}
++
++static inline cgraph_node_ptr cgraph_function_node(cgraph_node_ptr node, enum availability *availability)
++{
++	return node->function_symbol(availability);
++}
++
++static inline cgraph_node_ptr cgraph_function_or_thunk_node(cgraph_node_ptr node, enum availability *availability = NULL)
++{
++	return node->ultimate_alias_target(availability);
++}
++
++static inline bool cgraph_only_called_directly_p(cgraph_node_ptr node)
++{
++	return node->only_called_directly_p();
++}
++
++static inline enum availability cgraph_function_body_availability(cgraph_node_ptr node)
++{
++	return node->get_availability();
++}
++
++static inline cgraph_node_ptr cgraph_alias_target(cgraph_node_ptr node)
++{
++	return node->get_alias_target();
++}
++
++static inline struct cgraph_node_hook_list *cgraph_add_function_insertion_hook(cgraph_node_hook hook, void *data)
++{
++	return symtab->add_cgraph_insertion_hook(hook, data);
++}
++
++static inline void cgraph_remove_function_insertion_hook(struct cgraph_node_hook_list *entry)
++{
++	symtab->remove_cgraph_insertion_hook(entry);
++}
++
++static inline struct cgraph_node_hook_list *cgraph_add_node_removal_hook(cgraph_node_hook hook, void *data)
++{
++	return symtab->add_cgraph_removal_hook(hook, data);
++}
++
++static inline void cgraph_remove_node_removal_hook(struct cgraph_node_hook_list *entry)
++{
++	symtab->remove_cgraph_removal_hook(entry);
++}
++
++static inline struct cgraph_2node_hook_list *cgraph_add_node_duplication_hook(cgraph_2node_hook hook, void *data)
++{
++	return symtab->add_cgraph_duplication_hook(hook, data);
++}
++
++static inline void cgraph_remove_node_duplication_hook(struct cgraph_2node_hook_list *entry)
++{
++	symtab->remove_cgraph_duplication_hook(entry);
++}
++
++// gimple related
++static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree lhs, tree op1, tree op2 MEM_STAT_DECL)
++{
++	return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT);
++}
++
++static inline gasm *as_a_gasm(gimple stmt)
++{
++	return as_a<gasm *>(stmt);
++}
++
++static inline gcall *as_a_gcall(gimple stmt)
++{
++	return as_a<gcall *>(stmt);
++}
++
++// IPA/LTO related
++#define ipa_ref_list_referring_iterate(L,I,P) (L)->referring.iterate((I), &(P))
++#define ipa_ref_list_reference_iterate(L,I,P) (L)->reference.iterate((I), &(P))
++
++static inline cgraph_node_ptr ipa_ref_referring_node(struct ipa_ref *ref)
++{
++	return dyn_cast<cgraph_node_ptr>(ref->referring);
++}
 +#endif
 +
 +#endif
@@ -117134,10 +117436,10 @@ index 0000000..89f256d
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..e48b323
+index 0000000..2a39357
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,466 @@
+@@ -0,0 +1,467 @@
 +/*
 + * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -117163,7 +117465,7 @@ index 0000000..e48b323
 +
 +int plugin_is_GPL_compatible;
 +
-+static tree latent_entropy_decl;
++static GTY(()) tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
 +	.version	= "201409101820",
@@ -117508,6 +117810,7 @@ index 0000000..e48b323
 +	TREE_STATIC(latent_entropy_decl) = 1;
 +	TREE_PUBLIC(latent_entropy_decl) = 1;
 +	TREE_USED(latent_entropy_decl) = 1;
++	DECL_PRESERVE_P(latent_entropy_decl) = 1;
 +	TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
 +	DECL_EXTERNAL(latent_entropy_decl) = 1;
 +	DECL_ARTIFICIAL(latent_entropy_decl) = 1;
@@ -122614,7 +122917,7 @@ index 0000000..7c9e6d1
 +
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h
 new file mode 100644
-index 0000000..e5b4e50
+index 0000000..37f8fc3
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow.h
 @@ -0,0 +1,127 @@
@@ -122647,11 +122950,11 @@ index 0000000..e5b4e50
 +};
 +
 +// size_overflow_plugin.c
-+extern tree report_size_overflow_decl;
-+extern tree size_overflow_type_HI;
-+extern tree size_overflow_type_SI;
-+extern tree size_overflow_type_DI;
-+extern tree size_overflow_type_TI;
++extern GTY(()) tree report_size_overflow_decl;
++extern GTY(()) tree size_overflow_type_HI;
++extern GTY(()) tree size_overflow_type_SI;
++extern GTY(()) tree size_overflow_type_DI;
++extern GTY(()) tree size_overflow_type_TI;
 +
 +
 +// size_overflow_plugin_hash.c
@@ -128740,10 +129043,10 @@ index 0000000..0888f6c
 +
 diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
 new file mode 100644
-index 0000000..924652b
+index 0000000..90125d6
 --- /dev/null
 +++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,395 @@
+@@ -0,0 +1,396 @@
 +/*
 + * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -128771,7 +129074,8 @@ index 0000000..924652b
 +static int track_frame_size = -1;
 +static const char track_function[] = "pax_track_stack";
 +static const char check_function[] = "pax_check_alloca";
-+static tree track_function_decl, check_function_decl;
++static GTY(()) tree track_function_decl;
++static GTY(()) tree check_function_decl;
 +static bool init_locals;
 +
 +static struct plugin_info stackleak_plugin_info = {