grsecurity-{3.2.70,3.14.50,4.1.5}-20150810212920150810

87 files changed, 13527 insertions, 17543 deletions

diff --git a/3.14.49/1047_linux-3.14.48.patch b/3.14.49/1047_linux-3.14.48.patch
deleted file mode 100644
index 3a7169d..0000000
--- a/3.14.49/1047_linux-3.14.48.patch
+++ /dev/null
@@ -1,1019 +0,0 @@
-diff --git a/Makefile b/Makefile
-index f9041e6..25393e8 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 47
-+SUBLEVEL = 48
- EXTRAVERSION =
- NAME = Remembering Coco
- 
-diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
-index 9f79231..7d35af3 100644
---- a/arch/arm/include/asm/kvm_mmu.h
-+++ b/arch/arm/include/asm/kvm_mmu.h
-@@ -117,13 +117,14 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
- 	(__boundary - 1 < (end) - 1)? __boundary: (end);		\
- })
- 
-+#define kvm_pgd_index(addr)                    pgd_index(addr)
-+
- static inline bool kvm_page_empty(void *ptr)
- {
- 	struct page *ptr_page = virt_to_page(ptr);
- 	return page_count(ptr_page) == 1;
- }
- 
--
- #define kvm_pte_table_empty(ptep) kvm_page_empty(ptep)
- #define kvm_pmd_table_empty(pmdp) kvm_page_empty(pmdp)
- #define kvm_pud_table_empty(pudp) (0)
-diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index 2e74a61..f6a52a2 100644
---- a/arch/arm/kvm/arm.c
-+++ b/arch/arm/kvm/arm.c
-@@ -441,6 +441,7 @@ static void update_vttbr(struct kvm *kvm)
- 
- static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- {
-+	struct kvm *kvm = vcpu->kvm;
- 	int ret;
- 
- 	if (likely(vcpu->arch.has_run_once))
-@@ -452,12 +453,20 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- 	 * Initialize the VGIC before running a vcpu the first time on
- 	 * this VM.
- 	 */
--	if (unlikely(!vgic_initialized(vcpu->kvm))) {
--		ret = kvm_vgic_init(vcpu->kvm);
-+	if (unlikely(!vgic_initialized(kvm))) {
-+		ret = kvm_vgic_init(kvm);
- 		if (ret)
- 			return ret;
- 	}
- 
-+	/*
-+	 * Enable the arch timers only if we have an in-kernel VGIC
-+	 * and it has been properly initialized, since we cannot handle
-+	 * interrupts from the virtual timer with a userspace gic.
-+	 */
-+	if (irqchip_in_kernel(kvm) && vgic_initialized(kvm))
-+		kvm_timer_enable(kvm);
-+
- 	return 0;
- }
- 
-diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
-index 0d68d40..a1467e7 100644
---- a/arch/arm/kvm/interrupts.S
-+++ b/arch/arm/kvm/interrupts.S
-@@ -159,13 +159,9 @@ __kvm_vcpu_return:
- 	@ Don't trap coprocessor accesses for host kernel
- 	set_hstr vmexit
- 	set_hdcr vmexit
--	set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
-+	set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore
- 
- #ifdef CONFIG_VFPv3
--	@ Save floating point registers we if let guest use them.
--	tst	r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
--	bne	after_vfp_restore
--
- 	@ Switch VFP/NEON hardware state to the host's
- 	add	r7, vcpu, #VCPU_VFP_GUEST
- 	store_vfp_state r7
-@@ -177,6 +173,8 @@ after_vfp_restore:
- 	@ Restore FPEXC_EN which we clobbered on entry
- 	pop	{r2}
- 	VFPFMXR FPEXC, r2
-+#else
-+after_vfp_restore:
- #endif
- 
- 	@ Reset Hyp-role
-@@ -467,7 +465,7 @@ switch_to_guest_vfp:
- 	push	{r3-r7}
- 
- 	@ NEON/VFP used.  Turn on VFP access.
--	set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
-+	set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))
- 
- 	@ Switch VFP/NEON hardware state to the guest's
- 	add	r7, r0, #VCPU_VFP_HOST
-diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
-index 76af9302..2973b2d 100644
---- a/arch/arm/kvm/interrupts_head.S
-+++ b/arch/arm/kvm/interrupts_head.S
-@@ -578,8 +578,13 @@ vcpu	.req	r0		@ vcpu pointer always in r0
- .endm
- 
- /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return
-- * (hardware reset value is 0). Keep previous value in r2. */
--.macro set_hcptr operation, mask
-+ * (hardware reset value is 0). Keep previous value in r2.
-+ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if
-+ * VFP wasn't already enabled (always executed on vmtrap).
-+ * If a label is specified with vmexit, it is branched to if VFP wasn't
-+ * enabled.
-+ */
-+.macro set_hcptr operation, mask, label = none
- 	mrc	p15, 4, r2, c1, c1, 2
- 	ldr	r3, =\mask
- 	.if \operation == vmentry
-@@ -588,6 +593,17 @@ vcpu	.req	r0		@ vcpu pointer always in r0
- 	bic	r3, r2, r3		@ Don't trap defined coproc-accesses
- 	.endif
- 	mcr	p15, 4, r3, c1, c1, 2
-+	.if \operation != vmentry
-+	.if \operation == vmexit
-+	tst	r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
-+	beq	1f
-+	.endif
-+	isb
-+	.if \label != none
-+	b	\label
-+	.endif
-+1:
-+	.endif
- .endm
- 
- /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return
-diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
-index 524b4b5..c612e37 100644
---- a/arch/arm/kvm/mmu.c
-+++ b/arch/arm/kvm/mmu.c
-@@ -194,7 +194,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
- 	phys_addr_t addr = start, end = start + size;
- 	phys_addr_t next;
- 
--	pgd = pgdp + pgd_index(addr);
-+	pgd = pgdp + kvm_pgd_index(addr);
- 	do {
- 		next = kvm_pgd_addr_end(addr, end);
- 		if (!pgd_none(*pgd))
-@@ -264,7 +264,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
- 	phys_addr_t next;
- 	pgd_t *pgd;
- 
--	pgd = kvm->arch.pgd + pgd_index(addr);
-+	pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- 	do {
- 		next = kvm_pgd_addr_end(addr, end);
- 		stage2_flush_puds(kvm, pgd, addr, next);
-@@ -649,7 +649,7 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
- 	pud_t *pud;
- 	pmd_t *pmd;
- 
--	pgd = kvm->arch.pgd + pgd_index(addr);
-+	pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- 	pud = pud_offset(pgd, addr);
- 	if (pud_none(*pud)) {
- 		if (!cache)
-diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
-index 681cb90..91f33c2 100644
---- a/arch/arm64/include/asm/kvm_emulate.h
-+++ b/arch/arm64/include/asm/kvm_emulate.h
-@@ -41,6 +41,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
- static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
- {
- 	vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
-+	if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features))
-+		vcpu->arch.hcr_el2 &= ~HCR_RW;
- }
- 
- static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
-diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
-index 0d51874..15a8a86 100644
---- a/arch/arm64/include/asm/kvm_mmu.h
-+++ b/arch/arm64/include/asm/kvm_mmu.h
-@@ -69,6 +69,8 @@
- #define PTRS_PER_S2_PGD (1 << (KVM_PHYS_SHIFT - PGDIR_SHIFT))
- #define S2_PGD_ORDER	get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
- 
-+#define kvm_pgd_index(addr)    (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
-+
- int create_hyp_mappings(void *from, void *to);
- int create_hyp_io_mappings(void *from, void *to, phys_addr_t);
- void free_boot_hyp_pgd(void);
-diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
-index 5dfc8331..3aaf3bc 100644
---- a/arch/arm64/kvm/hyp.S
-+++ b/arch/arm64/kvm/hyp.S
-@@ -629,6 +629,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
- 	 * Instead, we invalidate Stage-2 for this IPA, and the
- 	 * whole of Stage-1. Weep...
- 	 */
-+	lsr	x1, x1, #12
- 	tlbi	ipas2e1is, x1
- 	/*
- 	 * We have to ensure completion of the invalidation at Stage-2,
-diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
-index 70a7816..0b43265 100644
---- a/arch/arm64/kvm/reset.c
-+++ b/arch/arm64/kvm/reset.c
-@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
- 			if (!cpu_has_32bit_el1())
- 				return -EINVAL;
- 			cpu_reset = &default_regs_reset32;
--			vcpu->arch.hcr_el2 &= ~HCR_RW;
- 		} else {
- 			cpu_reset = &default_regs_reset;
- 		}
-diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
-index 9488fa5..afc96ec 100644
---- a/arch/mips/include/asm/mach-generic/spaces.h
-+++ b/arch/mips/include/asm/mach-generic/spaces.h
-@@ -94,7 +94,11 @@
- #endif
- 
- #ifndef FIXADDR_TOP
-+#ifdef CONFIG_KVM_GUEST
-+#define FIXADDR_TOP		((unsigned long)(long)(int)0x7ffe0000)
-+#else
- #define FIXADDR_TOP		((unsigned long)(long)(int)0xfffe0000)
- #endif
-+#endif
- 
- #endif /* __ASM_MACH_GENERIC_SPACES_H */
-diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
-index 38265dc..65dfbd0 100644
---- a/arch/powerpc/perf/core-book3s.c
-+++ b/arch/powerpc/perf/core-book3s.c
-@@ -124,7 +124,16 @@ static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {}
- 
- static bool regs_use_siar(struct pt_regs *regs)
- {
--	return !!regs->result;
-+	/*
-+	 * When we take a performance monitor exception the regs are setup
-+	 * using perf_read_regs() which overloads some fields, in particular
-+	 * regs->result to tell us whether to use SIAR.
-+	 *
-+	 * However if the regs are from another exception, eg. a syscall, then
-+	 * they have not been setup using perf_read_regs() and so regs->result
-+	 * is something random.
-+	 */
-+	return ((TRAP(regs) == 0xf00) && regs->result);
- }
- 
- /*
-diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
-index 27bb554..7ef2862 100644
---- a/arch/sparc/kernel/ldc.c
-+++ b/arch/sparc/kernel/ldc.c
-@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len,
- 	if (len & (8UL - 1))
- 		return ERR_PTR(-EINVAL);
- 
--	buf = kzalloc(len, GFP_KERNEL);
-+	buf = kzalloc(len, GFP_ATOMIC);
- 	if (!buf)
- 		return ERR_PTR(-ENOMEM);
- 
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 5dab54a..96e743a 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -2440,9 +2440,19 @@ config X86_DMA_REMAP
- 	depends on STA2X11
- 
- config IOSF_MBI
--	tristate
--	default m
-+	tristate "Intel System On Chip IOSF Sideband support"
- 	depends on PCI
-+	---help---
-+	  Enables sideband access to mailbox registers on SoC's. The sideband is
-+	  available on the following platforms. This list is not meant to be
-+	  exclusive.
-+	   - BayTrail
-+	   - Cherryview
-+	   - Braswell
-+	   - Quark
-+
-+	  You should say Y if you are running a kernel on one of these
-+	  platforms.
- 
- source "net/Kconfig"
- 
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index e9dc029..ac03bd7 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -571,7 +571,7 @@ struct kvm_arch {
- 	struct kvm_pic *vpic;
- 	struct kvm_ioapic *vioapic;
- 	struct kvm_pit *vpit;
--	int vapics_in_nmi_mode;
-+	atomic_t vapics_in_nmi_mode;
- 	struct mutex apic_map_lock;
- 	struct kvm_apic_map *apic_map;
- 
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 298781d..1406ffd 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work)
- 		 * LVT0 to NMI delivery. Other PIC interrupts are just sent to
- 		 * VCPU0, and only if its LVT0 is in EXTINT mode.
- 		 */
--		if (kvm->arch.vapics_in_nmi_mode > 0)
-+		if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
- 			kvm_for_each_vcpu(i, vcpu, kvm)
- 				kvm_apic_nmi_wd_deliver(vcpu);
- 	}
-diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 453e5fb..6456734 100644
---- a/arch/x86/kvm/lapic.c
-+++ b/arch/x86/kvm/lapic.c
-@@ -1109,10 +1109,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
- 		if (!nmi_wd_enabled) {
- 			apic_debug("Receive NMI setting on APIC_LVT0 "
- 				   "for cpu %d\n", apic->vcpu->vcpu_id);
--			apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
-+			atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- 		}
- 	} else if (nmi_wd_enabled)
--		apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
-+		atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- }
- 
- static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
-diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
-index 4f25ec0..bf00138 100644
---- a/arch/x86/pci/acpi.c
-+++ b/arch/x86/pci/acpi.c
-@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
- 			DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
- 		},
- 	},
-+	/* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
-+	/* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
-+	{
-+		.callback = set_use_crs,
-+		.ident = "Foxconn K8M890-8237A",
-+		.matches = {
-+			DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
-+			DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
-+			DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
-+		},
-+	},
- 
- 	/* Now for the blacklist.. */
- 
-@@ -124,8 +135,10 @@ void __init pci_acpi_crs_quirks(void)
- {
- 	int year;
- 
--	if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008)
--		pci_use_crs = false;
-+	if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) {
-+		if (iomem_resource.end <= 0xffffffff)
-+			pci_use_crs = false;
-+	}
- 
- 	dmi_check_system(pci_crs_quirks);
- 
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 533a509..fbc693b 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -417,7 +417,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
- 
- 	val |= vid;
- 
--	wrmsrl(MSR_IA32_PERF_CTL, val);
-+	wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
- }
- 
- #define BYT_BCLK_FREQS 5
-diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
-index 5967667..1f35487 100644
---- a/drivers/crypto/talitos.c
-+++ b/drivers/crypto/talitos.c
-@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count,
- 		sg_count--;
- 		link_tbl_ptr--;
- 	}
--	be16_add_cpu(&link_tbl_ptr->len, cryptlen);
-+	link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len)
-+					+ cryptlen);
- 
- 	/* tag end of link table */
- 	link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN;
-@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
- 		break;
- 	default:
- 		dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
-+		kfree(t_alg);
- 		return ERR_PTR(-EINVAL);
- 	}
- 
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 9cbef59..9359740 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -1922,9 +1922,15 @@ static void free_pt_##LVL (unsigned long __pt)			\
- 	pt = (u64 *)__pt;					\
- 								\
- 	for (i = 0; i < 512; ++i) {				\
-+		/* PTE present? */				\
- 		if (!IOMMU_PTE_PRESENT(pt[i]))			\
- 			continue;				\
- 								\
-+		/* Large PTE? */				\
-+		if (PM_PTE_LEVEL(pt[i]) == 0 ||			\
-+		    PM_PTE_LEVEL(pt[i]) == 7)			\
-+			continue;				\
-+								\
- 		p = (unsigned long)IOMMU_PTE_PAGE(pt[i]);	\
- 		FN(p);						\
- 	}							\
-diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 25f7419..62c3fb9 100644
---- a/drivers/net/phy/phy_device.c
-+++ b/drivers/net/phy/phy_device.c
-@@ -765,10 +765,11 @@ static int genphy_config_advert(struct phy_device *phydev)
- 	if (phydev->supported & (SUPPORTED_1000baseT_Half |
- 				 SUPPORTED_1000baseT_Full)) {
- 		adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
--		if (adv != oldadv)
--			changed = 1;
- 	}
- 
-+	if (adv != oldadv)
-+		changed = 1;
-+
- 	err = phy_write(phydev, MII_CTRL1000, adv);
- 	if (err < 0)
- 		return err;
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 1d7e8a3..aa24f7d 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2905,17 +2905,6 @@ restart:
- 				vfsmnt = &mnt->mnt;
- 				continue;
- 			}
--			/*
--			 * Filesystems needing to implement special "root names"
--			 * should do so with ->d_dname()
--			 */
--			if (IS_ROOT(dentry) &&
--			   (dentry->d_name.len != 1 ||
--			    dentry->d_name.name[0] != '/')) {
--				WARN(1, "Root dentry has weird name <%.*s>\n",
--				     (int) dentry->d_name.len,
--				     dentry->d_name.name);
--			}
- 			if (!error)
- 				error = is_mounted(vfsmnt) ? 1 : 2;
- 			break;
-diff --git a/fs/inode.c b/fs/inode.c
-index e846a32..644875b 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -1631,8 +1631,8 @@ int file_remove_suid(struct file *file)
- 		error = security_inode_killpriv(dentry);
- 	if (!error && killsuid)
- 		error = __remove_suid(dentry, killsuid);
--	if (!error && (inode->i_sb->s_flags & MS_NOSEC))
--		inode->i_flags |= S_NOSEC;
-+	if (!error)
-+		inode_has_no_xattr(inode);
- 
- 	return error;
- }
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 2faa7ea..fc99d18 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -3031,11 +3031,15 @@ bool fs_fully_visible(struct file_system_type *type)
- 		if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
- 			continue;
- 
--		/* This mount is not fully visible if there are any child mounts
--		 * that cover anything except for empty directories.
-+		/* This mount is not fully visible if there are any
-+		 * locked child mounts that cover anything except for
-+		 * empty directories.
- 		 */
- 		list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
- 			struct inode *inode = child->mnt_mountpoint->d_inode;
-+			/* Only worry about locked mounts */
-+			if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
-+				continue;
- 			if (!S_ISDIR(inode->i_mode))
- 				goto next;
- 			if (inode->i_nlink > 2)
-diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
-index 6d9aedd..327b155 100644
---- a/include/kvm/arm_arch_timer.h
-+++ b/include/kvm/arm_arch_timer.h
-@@ -60,7 +60,8 @@ struct arch_timer_cpu {
- 
- #ifdef CONFIG_KVM_ARM_TIMER
- int kvm_timer_hyp_init(void);
--int kvm_timer_init(struct kvm *kvm);
-+void kvm_timer_enable(struct kvm *kvm);
-+void kvm_timer_init(struct kvm *kvm);
- void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- 			  const struct kvm_irq_level *irq);
- void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu);
-@@ -73,11 +74,8 @@ static inline int kvm_timer_hyp_init(void)
- 	return 0;
- };
- 
--static inline int kvm_timer_init(struct kvm *kvm)
--{
--	return 0;
--}
--
-+static inline void kvm_timer_enable(struct kvm *kvm) {}
-+static inline void kvm_timer_init(struct kvm *kvm) {}
- static inline void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- 					const struct kvm_irq_level *irq) {}
- static inline void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu) {}
-diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
-index 3573a81..8ba379f 100644
---- a/include/net/netns/sctp.h
-+++ b/include/net/netns/sctp.h
-@@ -31,6 +31,7 @@ struct netns_sctp {
- 	struct list_head addr_waitq;
- 	struct timer_list addr_wq_timer;
- 	struct list_head auto_asconf_splist;
-+	/* Lock that protects both addr_waitq and auto_asconf_splist */
- 	spinlock_t addr_wq_lock;
- 
- 	/* Lock that protects the local_addr_list writers */
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 0dfcc92..2c2d388 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -219,6 +219,10 @@ struct sctp_sock {
- 	atomic_t pd_mode;
- 	/* Receive to here while partial delivery is in effect. */
- 	struct sk_buff_head pd_lobby;
-+
-+	/* These must be the last fields, as they will skipped on copies,
-+	 * like on accept and peeloff operations
-+	 */
- 	struct list_head auto_asconf_list;
- 	int do_auto_asconf;
- };
-diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
-index a9a4a1b..8d423bc 100644
---- a/net/bridge/br_ioctl.c
-+++ b/net/bridge/br_ioctl.c
-@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- 		if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
- 			return -EPERM;
- 
--		spin_lock_bh(&br->lock);
- 		br_stp_set_bridge_priority(br, args[1]);
--		spin_unlock_bh(&br->lock);
- 		return 0;
- 
- 	case BRCTL_SET_PORT_PRIORITY:
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 11a2e6c..7bbc8fe 100644
---- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -1086,6 +1086,9 @@ static void br_multicast_add_router(struct net_bridge *br,
- 	struct net_bridge_port *p;
- 	struct hlist_node *slot = NULL;
- 
-+	if (!hlist_unhashed(&port->rlist))
-+		return;
-+
- 	hlist_for_each_entry(p, &br->router_list, rlist) {
- 		if ((unsigned long) port >= (unsigned long) p)
- 			break;
-@@ -1113,12 +1116,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
- 	if (port->multicast_router != 1)
- 		return;
- 
--	if (!hlist_unhashed(&port->rlist))
--		goto timer;
--
- 	br_multicast_add_router(br, port);
- 
--timer:
- 	mod_timer(&port->multicast_router_timer,
- 		  now + br->multicast_querier_interval);
- }
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 189ba1e..9a0005a 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
- 	return true;
- }
- 
--/* called under bridge lock */
-+/* Acquires and releases bridge lock */
- void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- {
- 	struct net_bridge_port *p;
- 	int wasroot;
- 
-+	spin_lock_bh(&br->lock);
- 	wasroot = br_is_root_bridge(br);
- 
- 	list_for_each_entry(p, &br->port_list, list) {
-@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- 	br_port_state_selection(br);
- 	if (br_is_root_bridge(br) && !wasroot)
- 		br_become_root_bridge(br);
-+	spin_unlock_bh(&br->lock);
- }
- 
- /* called under bridge lock */
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 7d95f69..0f062c6 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -976,6 +976,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
- 	rc = 0;
- 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
- 		goto out_unlock_bh;
-+	if (neigh->dead)
-+		goto out_dead;
- 
- 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
- 		if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
-@@ -1032,6 +1034,13 @@ out_unlock_bh:
- 		write_unlock(&neigh->lock);
- 	local_bh_enable();
- 	return rc;
-+
-+out_dead:
-+	if (neigh->nud_state & NUD_STALE)
-+		goto out_unlock_bh;
-+	write_unlock_bh(&neigh->lock);
-+	kfree_skb(skb);
-+	return 1;
- }
- EXPORT_SYMBOL(__neigh_event_send);
- 
-@@ -1095,6 +1104,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
- 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
- 	    (old & (NUD_NOARP | NUD_PERMANENT)))
- 		goto out;
-+	if (neigh->dead)
-+		goto out;
- 
- 	if (!(new & NUD_VALID)) {
- 		neigh_del_timer(neigh);
-@@ -1244,6 +1255,8 @@ EXPORT_SYMBOL(neigh_update);
-  */
- void __neigh_set_probe_once(struct neighbour *neigh)
- {
-+	if (neigh->dead)
-+		return;
- 	neigh->updated = jiffies;
- 	if (!(neigh->nud_state & NUD_FAILED))
- 		return;
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 69ec61a..8207f8d 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -368,9 +368,11 @@ refill:
- 		for (order = NETDEV_FRAG_PAGE_MAX_ORDER; ;) {
- 			gfp_t gfp = gfp_mask;
- 
--			if (order)
-+			if (order) {
- 				gfp |= __GFP_COMP | __GFP_NOWARN |
- 				       __GFP_NOMEMALLOC;
-+				gfp &= ~__GFP_WAIT;
-+			}
- 			nc->frag.page = alloc_pages(gfp, order);
- 			if (likely(nc->frag.page))
- 				break;
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 650dd58..8ebfa52 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1914,8 +1914,10 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
- 	do {
- 		gfp_t gfp = prio;
- 
--		if (order)
-+		if (order) {
- 			gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
-+			gfp &= ~__GFP_WAIT;
-+		}
- 		pfrag->page = alloc_pages(gfp, order);
- 		if (likely(pfrag->page)) {
- 			pfrag->offset = 0;
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 07bd8ed..951fe55 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog)
- 				err = 0;
- 			if (err)
- 				goto out;
-+
-+			tcp_fastopen_init_key_once(true);
- 		}
- 		err = inet_csk_listen_start(sk, backlog);
- 		if (err)
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 29d240b..dc45221 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2684,10 +2684,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
- 
- 	case TCP_FASTOPEN:
- 		if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
--		    TCPF_LISTEN)))
-+		    TCPF_LISTEN))) {
-+			tcp_fastopen_init_key_once(true);
-+
- 			err = fastopen_init_queue(sk, val);
--		else
-+		} else {
- 			err = -EINVAL;
-+		}
- 		break;
- 	case TCP_TIMESTAMP:
- 		if (!tp->repair)
-diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
-index f195d93..ee6518d 100644
---- a/net/ipv4/tcp_fastopen.c
-+++ b/net/ipv4/tcp_fastopen.c
-@@ -84,8 +84,6 @@ void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
- 	__be32 path[4] = { src, dst, 0, 0 };
- 	struct tcp_fastopen_context *ctx;
- 
--	tcp_fastopen_init_key_once(true);
--
- 	rcu_read_lock();
- 	ctx = rcu_dereference(tcp_fastopen_ctx);
- 	if (ctx) {
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 48b1817..84a60b8 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct sock *sk)
- 	sk_refcnt_debug_dec(sk);
- }
- 
--static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
--{
--	int x = atomic_read(&f->rr_cur) + 1;
--
--	if (x >= num)
--		x = 0;
--
--	return x;
--}
--
- static unsigned int fanout_demux_hash(struct packet_fanout *f,
- 				      struct sk_buff *skb,
- 				      unsigned int num)
-@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
- 				    struct sk_buff *skb,
- 				    unsigned int num)
- {
--	int cur, old;
-+	unsigned int val = atomic_inc_return(&f->rr_cur);
- 
--	cur = atomic_read(&f->rr_cur);
--	while ((old = atomic_cmpxchg(&f->rr_cur, cur,
--				     fanout_rr_next(f, num))) != cur)
--		cur = old;
--	return cur;
-+	return val % num;
- }
- 
- static unsigned int fanout_demux_cpu(struct packet_fanout *f,
-@@ -1345,7 +1331,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
- 			     struct packet_type *pt, struct net_device *orig_dev)
- {
- 	struct packet_fanout *f = pt->af_packet_priv;
--	unsigned int num = f->num_members;
-+	unsigned int num = ACCESS_ONCE(f->num_members);
- 	struct packet_sock *po;
- 	unsigned int idx;
- 
-diff --git a/net/sctp/output.c b/net/sctp/output.c
-index 740ca5f..e39e6d5 100644
---- a/net/sctp/output.c
-+++ b/net/sctp/output.c
-@@ -599,7 +599,9 @@ out:
- 	return err;
- no_route:
- 	kfree_skb(nskb);
--	IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
-+
-+	if (asoc)
-+		IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
- 
- 	/* FIXME: Returning the 'err' will effect all the associations
- 	 * associated with a socket, although only one of the paths of the
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 604a6ac..f940fdc 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -1532,8 +1532,10 @@ static void sctp_close(struct sock *sk, long timeout)
- 
- 	/* Supposedly, no process has access to the socket, but
- 	 * the net layers still may.
-+	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
-+	 * held and that should be grabbed before socket lock.
- 	 */
--	local_bh_disable();
-+	spin_lock_bh(&net->sctp.addr_wq_lock);
- 	bh_lock_sock(sk);
- 
- 	/* Hold the sock, since sk_common_release() will put sock_put()
-@@ -1543,7 +1545,7 @@ static void sctp_close(struct sock *sk, long timeout)
- 	sk_common_release(sk);
- 
- 	bh_unlock_sock(sk);
--	local_bh_enable();
-+	spin_unlock_bh(&net->sctp.addr_wq_lock);
- 
- 	sock_put(sk);
- 
-@@ -3511,6 +3513,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- 	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
- 		return 0;
- 
-+	spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- 	if (val == 0 && sp->do_auto_asconf) {
- 		list_del(&sp->auto_asconf_list);
- 		sp->do_auto_asconf = 0;
-@@ -3519,6 +3522,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- 		    &sock_net(sk)->sctp.auto_asconf_splist);
- 		sp->do_auto_asconf = 1;
- 	}
-+	spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- 	return 0;
- }
- 
-@@ -4009,18 +4013,28 @@ static int sctp_init_sock(struct sock *sk)
- 	local_bh_disable();
- 	percpu_counter_inc(&sctp_sockets_allocated);
- 	sock_prot_inuse_add(net, sk->sk_prot, 1);
-+
-+	/* Nothing can fail after this block, otherwise
-+	 * sctp_destroy_sock() will be called without addr_wq_lock held
-+	 */
- 	if (net->sctp.default_auto_asconf) {
-+		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
- 		list_add_tail(&sp->auto_asconf_list,
- 		    &net->sctp.auto_asconf_splist);
- 		sp->do_auto_asconf = 1;
--	} else
-+		spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
-+	} else {
- 		sp->do_auto_asconf = 0;
-+	}
-+
- 	local_bh_enable();
- 
- 	return 0;
- }
- 
--/* Cleanup any SCTP per socket resources.  */
-+/* Cleanup any SCTP per socket resources. Must be called with
-+ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
-+ */
- static void sctp_destroy_sock(struct sock *sk)
- {
- 	struct sctp_sock *sp;
-@@ -6973,6 +6987,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
- 	newinet->mc_list = NULL;
- }
- 
-+static inline void sctp_copy_descendant(struct sock *sk_to,
-+					const struct sock *sk_from)
-+{
-+	int ancestor_size = sizeof(struct inet_sock) +
-+			    sizeof(struct sctp_sock) -
-+			    offsetof(struct sctp_sock, auto_asconf_list);
-+
-+	if (sk_from->sk_family == PF_INET6)
-+		ancestor_size += sizeof(struct ipv6_pinfo);
-+
-+	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
-+}
-+
- /* Populate the fields of the newsk from the oldsk and migrate the assoc
-  * and its messages to the newsk.
-  */
-@@ -6987,7 +7014,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- 	struct sk_buff *skb, *tmp;
- 	struct sctp_ulpevent *event;
- 	struct sctp_bind_hashbucket *head;
--	struct list_head tmplist;
- 
- 	/* Migrate socket buffer sizes and all the socket level options to the
- 	 * new socket.
-@@ -6995,12 +7021,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- 	newsk->sk_sndbuf = oldsk->sk_sndbuf;
- 	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
- 	/* Brute force copy old sctp opt. */
--	if (oldsp->do_auto_asconf) {
--		memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
--		inet_sk_copy_descendant(newsk, oldsk);
--		memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
--	} else
--		inet_sk_copy_descendant(newsk, oldsk);
-+	sctp_copy_descendant(newsk, oldsk);
- 
- 	/* Restore the ep value that was overwritten with the above structure
- 	 * copy.
-diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
-index 5081e80..c6fe405 100644
---- a/virt/kvm/arm/arch_timer.c
-+++ b/virt/kvm/arm/arch_timer.c
-@@ -61,12 +61,14 @@ static void timer_disarm(struct arch_timer_cpu *timer)
- 
- static void kvm_timer_inject_irq(struct kvm_vcpu *vcpu)
- {
-+	int ret;
- 	struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
- 
- 	timer->cntv_ctl |= ARCH_TIMER_CTRL_IT_MASK;
--	kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
--			    timer->irq->irq,
--			    timer->irq->level);
-+	ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
-+				  timer->irq->irq,
-+				  timer->irq->level);
-+	WARN_ON(ret);
- }
- 
- static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
-@@ -307,12 +309,24 @@ void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu)
- 	timer_disarm(timer);
- }
- 
--int kvm_timer_init(struct kvm *kvm)
-+void kvm_timer_enable(struct kvm *kvm)
- {
--	if (timecounter && wqueue) {
--		kvm->arch.timer.cntvoff = kvm_phys_timer_read();
-+	if (kvm->arch.timer.enabled)
-+		return;
-+
-+	/*
-+	 * There is a potential race here between VCPUs starting for the first
-+	 * time, which may be enabling the timer multiple times.  That doesn't
-+	 * hurt though, because we're just setting a variable to the same
-+	 * variable that it already was.  The important thing is that all
-+	 * VCPUs have the enabled variable set, before entering the guest, if
-+	 * the arch timers are enabled.
-+	 */
-+	if (timecounter && wqueue)
- 		kvm->arch.timer.enabled = 1;
--	}
-+}
- 
--	return 0;
-+void kvm_timer_init(struct kvm *kvm)
-+{
-+	kvm->arch.timer.cntvoff = kvm_phys_timer_read();
- }
-diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
-index c324a52..152ec76 100644
---- a/virt/kvm/arm/vgic.c
-+++ b/virt/kvm/arm/vgic.c
-@@ -1042,6 +1042,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- 			  lr, irq, vgic_cpu->vgic_lr[lr]);
- 		BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
- 		vgic_cpu->vgic_lr[lr] |= GICH_LR_PENDING_BIT;
-+		__clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
- 		return true;
- 	}
- 
-@@ -1055,6 +1056,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- 	vgic_cpu->vgic_lr[lr] = MK_LR_PEND(sgi_source_id, irq);
- 	vgic_cpu->vgic_irq_lr_map[irq] = lr;
- 	set_bit(lr, vgic_cpu->lr_used);
-+	__clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
- 
- 	if (!vgic_irq_is_edge(vcpu, irq))
- 		vgic_cpu->vgic_lr[lr] |= GICH_LR_EOI;
-@@ -1209,6 +1211,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
- 	if (vgic_cpu->vgic_misr & GICH_MISR_U)
- 		vgic_cpu->vgic_hcr &= ~GICH_HCR_UIE;
- 
-+	/*
-+	 * In the next iterations of the vcpu loop, if we sync the vgic state
-+	 * after flushing it, but before entering the guest (this happens for
-+	 * pending signals and vmid rollovers), then make sure we don't pick
-+	 * up any old maintenance interrupts here.
-+	 */
-+	memset(vgic_cpu->vgic_eisr, 0, sizeof(vgic_cpu->vgic_eisr[0]) * 2);
-+
- 	return level_pending;
- }
- 
diff --git a/3.14.49/1048_linux-3.14.49.patch b/3.14.49/1048_linux-3.14.49.patch
deleted file mode 100644
index a202904..0000000
--- a/3.14.49/1048_linux-3.14.49.patch
+++ /dev/null
@@ -1,4039 +0,0 @@
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index 01ef408..8faff12 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -91,5 +91,5 @@ mpp61         61       gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62         62       gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
-                        audio(mclk), uart0(cts)
- mpp63         63       gpo, spi0(sck), tclk
--mpp64         64       gpio, spi0(miso), spi0-1(cs1)
--mpp65         65       gpio, spi0(mosi), spi0-1(cs2)
-+mpp64         64       gpio, spi0(miso), spi0(cs1)
-+mpp65         65       gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index bfa0a2e..86dec67 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -41,15 +41,15 @@ mpp20         20       gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21         21       gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22         22       gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23         23       gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24         24       gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25         25       gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26         26       gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24         24       gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25         25       gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26         26       gpio, lcd(clk), tdm(fsync)
- mpp27         27       gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28         28       gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30         30       gpio, tdm(int1), sd0(clk)
--mpp31         31       gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32         32       gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31         31       gpio, tdm(int2), sd0(cmd)
-+mpp32         32       gpio, tdm(int3), sd0(d0)
- mpp33         33       gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34         34       gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35         35       gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -57,21 +57,18 @@ mpp36         36       gpio, spi(mosi)
- mpp37         37       gpio, spi(miso)
- mpp38         38       gpio, spi(sck)
- mpp39         39       gpio, spi(cs0)
--mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
--                       pcie(clkreq0)
-+mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41         41       gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
-                        pcie(clkreq1)
--mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
--                       vdd(cpu0-pd)
--mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
--                       vdd(cpu2-3-pd){1}
-+mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44         44       gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
-                        mem(bat)
- mpp45         45       gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46         46       gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47         47       gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
-                        ref(clkout)
--mpp48         48       gpio, tclk, dev(burst/last)
-+mpp48         48       gpio, dev(clkout), dev(burst/last)
- 
- * Marvell Armada XP (mv78260 and mv78460 only)
- 
-@@ -83,9 +80,9 @@ mpp51         51       gpio, dev(ad16)
- mpp52         52       gpio, dev(ad17)
- mpp53         53       gpio, dev(ad18)
- mpp54         54       gpio, dev(ad19)
--mpp55         55       gpio, dev(ad20), vdd(cpu0-pd)
--mpp56         56       gpio, dev(ad21), vdd(cpu1-pd)
--mpp57         57       gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55         55       gpio, dev(ad20)
-+mpp56         56       gpio, dev(ad21)
-+mpp57         57       gpio, dev(ad22)
- mpp58         58       gpio, dev(ad23)
- mpp59         59       gpio, dev(ad24)
- mpp60         60       gpio, dev(ad25)
-@@ -95,6 +92,3 @@ mpp63         63       gpio, dev(ad28)
- mpp64         64       gpio, dev(ad29)
- mpp65         65       gpio, dev(ad30)
- mpp66         66       gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-index 22ed679..4d1673c 100644
---- a/Documentation/devicetree/bindings/spi/spi_pl022.txt
-+++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-@@ -4,9 +4,9 @@ Required properties:
- - compatible : "arm,pl022", "arm,primecell"
- - reg : Offset and length of the register set for the device
- - interrupts : Should contain SPI controller interrupt
-+- num-cs : total number of chipselects
- 
- Optional properties:
--- num-cs : total number of chipselects
- - cs-gpios : should specify GPIOs used for chipselects.
-   The gpios will be referred to as reg = <index> in the SPI child nodes.
-   If unspecified, a single SPI device without a chip select can be used.
-diff --git a/Makefile b/Makefile
-index 25393e8..fee8460 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 48
-+SUBLEVEL = 49
- EXTRAVERSION =
- NAME = Remembering Coco
- 
-diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
-index 03cd689..90de5c5 100644
---- a/arch/arc/include/asm/cmpxchg.h
-+++ b/arch/arc/include/asm/cmpxchg.h
-@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
- 	"	scond   %3, [%1]	\n"
- 	"	bnz     1b		\n"
- 	"2:				\n"
--	: "=&r"(prev)
--	: "r"(ptr), "ir"(expected),
--	  "r"(new) /* can't be "ir". scond can't take limm for "b" */
--	: "cc");
-+	: "=&r"(prev)	/* Early clobber, to prevent reg reuse */
-+	: "r"(ptr),	/* Not "m": llock only supports reg direct addr mode */
-+	  "ir"(expected),
-+	  "r"(new)	/* can't be "ir". scond can't take LIMM for "b" */
-+	: "cc", "memory"); /* so that gcc knows memory is being written here */
- 
- 	return prev;
- }
-diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
-index a268a9a..a622dd0 100644
---- a/arch/arm64/kernel/vdso/Makefile
-+++ b/arch/arm64/kernel/vdso/Makefile
-@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin
- ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
- 		$(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
- 
-+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
-+# down to collect2, resulting in silent corruption of the vDSO image.
-+ccflags-y += -Wl,-shared
-+
- obj-y += vdso.o
- extra-y += vdso.lds vdso-offsets.h
- CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
-diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
-index baa758d..76c1e6c 100644
---- a/arch/arm64/mm/context.c
-+++ b/arch/arm64/mm/context.c
-@@ -92,6 +92,14 @@ static void reset_context(void *info)
- 	unsigned int cpu = smp_processor_id();
- 	struct mm_struct *mm = current->active_mm;
- 
-+	/*
-+	 * current->active_mm could be init_mm for the idle thread immediately
-+	 * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to
-+	 * the reserved value, so no need to reset any context.
-+	 */
-+	if (mm == &init_mm)
-+		return;
-+
- 	smp_rmb();
- 	asid = cpu_last_asid + cpu;
- 
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 023747b..e3a24b7 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
- 
- int pmd_huge(pmd_t pmd)
- {
--	return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
- 
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
--	return !(pud_val(pud) & PUD_TABLE_BIT);
-+	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- 	return 0;
- #endif
-diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
-index d0b4c2e..aeb95a1 100644
---- a/arch/arm64/mm/init.c
-+++ b/arch/arm64/mm/init.c
-@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void)
- 		 * memmap entries are valid from the bank end aligned to
- 		 * MAX_ORDER_NR_PAGES.
- 		 */
--		prev_end = ALIGN(start + __phys_to_pfn(reg->size),
-+		prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size),
- 				 MAX_ORDER_NR_PAGES);
- 	}
- 
-diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c
-index e75ef82..c76f297 100644
---- a/arch/mips/kvm/kvm_mips_emul.c
-+++ b/arch/mips/kvm/kvm_mips_emul.c
-@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run)
- 		if (vcpu->mmio_needed == 2)
- 			*gpr = *(int16_t *) run->mmio.data;
- 		else
--			*gpr = *(int16_t *) run->mmio.data;
-+			*gpr = *(uint16_t *)run->mmio.data;
- 
- 		break;
- 	case 1:
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 246ef68..2c3c578 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- 	 * Obtain a permanent mapping for the FACS. This is required for the
- 	 * Global Lock and the Firmware Waking Vector
- 	 */
--	status = acpi_tb_initialize_facs();
--	if (ACPI_FAILURE(status)) {
--		ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
--		return_ACPI_STATUS(status);
-+	if (!(flags & ACPI_NO_FACS_INIT)) {
-+		status = acpi_tb_initialize_facs();
-+		if (ACPI_FAILURE(status)) {
-+			ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+			return_ACPI_STATUS(status);
-+		}
- 	}
- #endif				/* !ACPI_REDUCED_HARDWARE */
- 
-diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
-index b48aefa..60be8d0 100644
---- a/drivers/acpi/bus.c
-+++ b/drivers/acpi/bus.c
-@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void)
- u8 acpi_gbl_permanent_mmap;
- 
- 
-+/**
-+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace.
-+ *
-+ * The ACPI tables are accessible after this, but the handling of events has not
-+ * been initialized and the global lock is not available yet, so AML should not
-+ * be executed at this point.
-+ *
-+ * Doing this before switching the EFI runtime services to virtual mode allows
-+ * the EfiBootServices memory to be freed slightly earlier on boot.
-+ */
- void __init acpi_early_init(void)
- {
- 	acpi_status status;
-@@ -510,26 +520,42 @@ void __init acpi_early_init(void)
- 		acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi;
- 	}
- #endif
-+	return;
-+
-+ error0:
-+	disable_acpi();
-+}
-+
-+/**
-+ * acpi_subsystem_init - Finalize the early initialization of ACPI.
-+ *
-+ * Switch over the platform to the ACPI mode (if possible), initialize the
-+ * handling of ACPI events, install the interrupt and global lock handlers.
-+ *
-+ * Doing this too early is generally unsafe, but at the same time it needs to be
-+ * done before all things that really depend on ACPI.  The right spot appears to
-+ * be before finalizing the EFI initialization.
-+ */
-+void __init acpi_subsystem_init(void)
-+{
-+	acpi_status status;
-+
-+	if (acpi_disabled)
-+		return;
- 
- 	status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE);
- 	if (ACPI_FAILURE(status)) {
- 		printk(KERN_ERR PREFIX "Unable to enable ACPI\n");
--		goto error0;
-+		disable_acpi();
-+	} else {
-+		/*
-+		 * If the system is using ACPI then we can be reasonably
-+		 * confident that any regulators are managed by the firmware
-+		 * so tell the regulator core it has everything it needs to
-+		 * know.
-+		 */
-+		regulator_has_full_constraints();
- 	}
--
--	/*
--	 * If the system is using ACPI then we can be reasonably
--	 * confident that any regulators are managed by the firmware
--	 * so tell the regulator core it has everything it needs to
--	 * know.
--	 */
--	regulator_has_full_constraints();
--
--	return;
--
--      error0:
--	disable_acpi();
--	return;
- }
- 
- static int __init acpi_bus_init(void)
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index b1c0fcd..b0e6691 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "ST3320[68]13AS",	"SD1[5-9]",	ATA_HORKAGE_NONCQ |
- 						ATA_HORKAGE_FIRMWARE_WARN },
- 
--	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
-+	/* drives which fail FPDMA_AA activation (some may freeze afterwards) */
- 	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
- 	{ "ST1000LM024 HN-M101MBB", "2BA30001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
-+	{ "VB0250EAVER",	"HPG7",		ATA_HORKAGE_BROKEN_FPDMA_AA },
- 
- 	/* Blacklist entries taken from Silicon Image 3124/3132
- 	   Windows driver .inf file - also several Linux problem reports */
-@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "Micron_M550*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
- 	{ "Crucial_CT*M550SSD*",	NULL,	ATA_HORKAGE_NO_NCQ_TRIM, },
- 
-+	/* devices that don't properly handle TRIM commands */
-+	{ "SuperSSpeed S238*",		NULL,	ATA_HORKAGE_NOTRIM, },
-+
- 	/*
- 	 * Some WD SATA-I drives spin up and down erratically when the link
- 	 * is put into the slumber mode.  We don't have full list of the
-@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
- 	else /* In the ancient relic department - skip all of this */
- 		return 0;
- 
--	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
-+	/* On some disks, this command causes spin-up, so we need longer timeout */
-+	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
- 
- 	DPRINTK("EXIT, err_mask=%x\n", err_mask);
- 	return err_mask;
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index ef8567d..6fecf0b 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
- 		rbuf[14] = (lowest_aligned >> 8) & 0x3f;
- 		rbuf[15] = lowest_aligned;
- 
--		if (ata_id_has_trim(args->id)) {
-+		if (ata_id_has_trim(args->id) &&
-+		    !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
- 			rbuf[14] |= 0x80; /* TPE */
- 
- 			if (ata_id_has_zero_after_trim(args->id))
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 2495ee5..f0c15f9 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
- 	kfree(fw_priv);
- }
- 
--static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
- {
--	struct firmware_priv *fw_priv = to_firmware_priv(dev);
--
- 	if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
- 		return -ENOMEM;
- 	if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
-@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
- 	return 0;
- }
- 
-+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+	struct firmware_priv *fw_priv = to_firmware_priv(dev);
-+	int err = 0;
-+
-+	mutex_lock(&fw_lock);
-+	if (fw_priv->buf)
-+		err = do_firmware_uevent(fw_priv, env);
-+	mutex_unlock(&fw_lock);
-+	return err;
-+}
-+
- static struct class firmware_class = {
- 	.name		= "firmware",
- 	.class_attrs	= firmware_class_attrs,
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 2f9a3d8..58559d7 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
- static void regmap_field_init(struct regmap_field *rm_field,
- 	struct regmap *regmap, struct reg_field reg_field)
- {
--	int field_bits = reg_field.msb - reg_field.lsb + 1;
- 	rm_field->regmap = regmap;
- 	rm_field->reg = reg_field.reg;
- 	rm_field->shift = reg_field.lsb;
--	rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
-+	rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
- 	rm_field->id_size = reg_field.id_size;
- 	rm_field->id_offset = reg_field.id_offset;
- }
-@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
- 					  &ival);
- 			if (ret != 0)
- 				return ret;
--			memcpy(val + (i * val_bytes), &ival, val_bytes);
-+			map->format.format_val(val + (i * val_bytes), ival, 0);
- 		}
- 	}
- 
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index 63688d3..12be7cb 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
- 	rbd_assert(obj_request_type_valid(type));
- 
- 	size = strlen(object_name) + 1;
--	name = kmalloc(size, GFP_KERNEL);
-+	name = kmalloc(size, GFP_NOIO);
- 	if (!name)
- 		return NULL;
- 
--	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
-+	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
- 	if (!obj_request) {
- 		kfree(name);
- 		return NULL;
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index c0e7a9aa9..c23658e 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
- 	}
- 	fw_ptr = fw->data;
- 
-+	kfree_skb(skb);
-+
- 	/* This Intel specific command enables the manufacturer mode of the
- 	 * controller.
- 	 *
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index 5c85350..19e301f 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void)
- 	/* Query intel_iommu to see if we need the workaround. Presumably that
- 	 * was loaded first.
- 	 */
--	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
-+	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
- 	     gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
- 	     intel_iommu_gfx_mapped)
- 		return 1;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index 102463ba..643bba7 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- 		goto cleanup;
- 	}
- 
-+	ibmvtpm->dev = dev;
-+	ibmvtpm->vdev = vio_dev;
-+
- 	crq_q = &ibmvtpm->crq_queue;
- 	crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
- 	if (!crq_q->crq_addr) {
-@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- 
- 	crq_q->index = 0;
- 
--	ibmvtpm->dev = dev;
--	ibmvtpm->vdev = vio_dev;
- 	TPM_VPRIV(chip) = (void *)ibmvtpm;
- 
- 	spin_lock_init(&ibmvtpm->rtce_lock);
-diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
-index 831b482..ddd03f8 100644
---- a/drivers/clocksource/exynos_mct.c
-+++ b/drivers/clocksource/exynos_mct.c
-@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
- 
- 	if (mct_int_type == MCT_INT_SPI) {
--		evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
--		if (request_irq(evt->irq, exynos4_mct_tick_isr,
--				IRQF_TIMER | IRQF_NOBALANCING,
--				evt->name, mevt)) {
--			pr_err("exynos-mct: cannot register IRQ %d\n",
--				evt->irq);
-+
-+		if (evt->irq == -1)
- 			return -EIO;
--		}
--		irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
-+
-+		irq_force_affinity(evt->irq, cpumask_of(cpu));
-+		enable_irq(evt->irq);
- 	} else {
- 		enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
- 	}
-@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- static void exynos4_local_timer_stop(struct clock_event_device *evt)
- {
- 	evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
--	if (mct_int_type == MCT_INT_SPI)
--		free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
--	else
-+	if (mct_int_type == MCT_INT_SPI) {
-+		if (evt->irq != -1)
-+			disable_irq_nosync(evt->irq);
-+	} else {
- 		disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
-+	}
- }
- 
- static int exynos4_mct_cpu_notify(struct notifier_block *self,
-@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
- 
- static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
- {
--	int err;
-+	int err, cpu;
- 	struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
- 	struct clk *mct_clk, *tick_clk;
- 
-@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
- 		WARN(err, "MCT: can't request IRQ %d (%d)\n",
- 		     mct_irqs[MCT_L0_IRQ], err);
- 	} else {
--		irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
-+		for_each_possible_cpu(cpu) {
-+			int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
-+			struct mct_clock_event_device *pcpu_mevt =
-+				per_cpu_ptr(&percpu_mct_tick, cpu);
-+
-+			pcpu_mevt->evt.irq = -1;
-+
-+			irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
-+			if (request_irq(mct_irq,
-+					exynos4_mct_tick_isr,
-+					IRQF_TIMER | IRQF_NOBALANCING,
-+					pcpu_mevt->name, pcpu_mevt)) {
-+				pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
-+									cpu);
-+
-+				continue;
-+			}
-+			pcpu_mevt->evt.irq = mct_irq;
-+		}
- 	}
- 
- 	err = register_cpu_notifier(&exynos4_mct_cpu_nb);
-diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
-index e3d2052..1adc039 100644
---- a/drivers/cpuidle/cpuidle.c
-+++ b/drivers/cpuidle/cpuidle.c
-@@ -131,6 +131,9 @@ int cpuidle_idle_call(void)
- 
- 	/* ask the governor for the next state */
- 	next_state = cpuidle_curr_governor->select(drv, dev);
-+	if (next_state < 0)
-+		return -EBUSY;
-+
- 	if (need_resched()) {
- 		dev->last_residency = 0;
- 		/* give the governor an opportunity to reflect on the outcome */
-diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
-index cf7f2f0..027c484 100644
---- a/drivers/cpuidle/governors/menu.c
-+++ b/drivers/cpuidle/governors/menu.c
-@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
- 		data->needs_update = 0;
- 	}
- 
--	data->last_state_idx = 0;
-+	data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1;
- 	data->exit_us = 0;
- 
- 	/* Special case when user has set very strict latency requirement */
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index 394cbc5..6b2f01d 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- 	dma_cookie_t cookie = 0;
- 	int busy = mv_chan_is_busy(mv_chan);
- 	u32 current_desc = mv_chan_get_current_desc(mv_chan);
--	int seen_current = 0;
-+	int current_cleaned = 0;
-+	struct mv_xor_desc *hw_desc;
- 
- 	dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
- 	dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
-@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- 
- 	list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
- 					chain_node) {
--		prefetch(_iter);
--		prefetch(&_iter->async_tx);
- 
--		/* do not advance past the current descriptor loaded into the
--		 * hardware channel, subsequent descriptors are either in
--		 * process or have not been submitted
--		 */
--		if (seen_current)
--			break;
-+		/* clean finished descriptors */
-+		hw_desc = iter->hw_desc;
-+		if (hw_desc->status & XOR_DESC_SUCCESS) {
-+			cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
-+								cookie);
- 
--		/* stop the search if we reach the current descriptor and the
--		 * channel is busy
--		 */
--		if (iter->async_tx.phys == current_desc) {
--			seen_current = 1;
--			if (busy)
-+			/* done processing desc, clean slot */
-+			mv_xor_clean_slot(iter, mv_chan);
-+
-+			/* break if we did cleaned the current */
-+			if (iter->async_tx.phys == current_desc) {
-+				current_cleaned = 1;
-+				break;
-+			}
-+		} else {
-+			if (iter->async_tx.phys == current_desc) {
-+				current_cleaned = 0;
- 				break;
-+			}
- 		}
--
--		cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
--
--		if (mv_xor_clean_slot(iter, mv_chan))
--			break;
- 	}
- 
- 	if ((busy == 0) && !list_empty(&mv_chan->chain)) {
--		struct mv_xor_desc_slot *chain_head;
--		chain_head = list_entry(mv_chan->chain.next,
--					struct mv_xor_desc_slot,
--					chain_node);
--
--		mv_xor_start_new_chain(mv_chan, chain_head);
-+		if (current_cleaned) {
-+			/*
-+			 * current descriptor cleaned and removed, run
-+			 * from list head
-+			 */
-+			iter = list_entry(mv_chan->chain.next,
-+					  struct mv_xor_desc_slot,
-+					  chain_node);
-+			mv_xor_start_new_chain(mv_chan, iter);
-+		} else {
-+			if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
-+				/*
-+				 * descriptors are still waiting after
-+				 * current, trigger them
-+				 */
-+				iter = list_entry(iter->chain_node.next,
-+						  struct mv_xor_desc_slot,
-+						  chain_node);
-+				mv_xor_start_new_chain(mv_chan, iter);
-+			} else {
-+				/*
-+				 * some descriptors are still waiting
-+				 * to be cleaned
-+				 */
-+				tasklet_schedule(&mv_chan->irq_tasklet);
-+			}
-+		}
- 	}
- 
- 	if (cookie > 0)
-diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
-index d074922..5d14e4b 100644
---- a/drivers/dma/mv_xor.h
-+++ b/drivers/dma/mv_xor.h
-@@ -33,6 +33,7 @@
- #define XOR_OPERATION_MODE_XOR		0
- #define XOR_OPERATION_MODE_MEMCPY	2
- #define XOR_DESCRIPTOR_SWAP		BIT(14)
-+#define XOR_DESC_SUCCESS		0x40000000
- 
- #define XOR_CURR_DESC(chan)	(chan->mmr_high_base + 0x10 + (chan->idx * 4))
- #define XOR_NEXT_DESC(chan)	(chan->mmr_high_base + 0x00 + (chan->idx * 4))
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3b7d32d..903db3c 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
- 		return -EINVAL;
- 
--	/* For some reason crtc x/y offsets are signed internally. */
--	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
-+	/*
-+	 * Universal plane src offsets are only 16.16, prevent havoc for
-+	 * drivers using universal plane code internally.
-+	 */
-+	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
- 		return -ERANGE;
- 
- 	drm_modeset_lock_all(dev);
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index eb89653..c5e96a3 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
- 
- 	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
- 	cmd->type = QXL_SURFACE_CMD_CREATE;
-+	cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
- 	cmd->u.surface_create.format = surf->surf.format;
- 	cmd->u.surface_create.width = surf->surf.width;
- 	cmd->u.surface_create.height = surf->surf.height;
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index 0bb86e6..56a13a9 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- 	qobj = gem_to_qxl_bo(gobj);
- 
- 	ret = qxl_release_list_add(release, qobj);
--	if (ret)
-+	if (ret) {
-+		drm_gem_object_unreference_unlocked(gobj);
- 		return NULL;
-+	}
- 
- 	return qobj;
- }
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index c4558bd..2fd2fb3 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
- 	WDOORBELL32(ring->doorbell_index, ring->wptr);
- }
- 
-+static void cik_compute_stop(struct radeon_device *rdev,
-+			     struct radeon_ring *ring)
-+{
-+	u32 j, tmp;
-+
-+	cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
-+	/* Disable wptr polling. */
-+	tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
-+	tmp &= ~WPTR_POLL_EN;
-+	WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
-+	/* Disable HQD. */
-+	if (RREG32(CP_HQD_ACTIVE) & 1) {
-+		WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
-+		for (j = 0; j < rdev->usec_timeout; j++) {
-+			if (!(RREG32(CP_HQD_ACTIVE) & 1))
-+				break;
-+			udelay(1);
-+		}
-+		WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
-+		WREG32(CP_HQD_PQ_RPTR, 0);
-+		WREG32(CP_HQD_PQ_WPTR, 0);
-+	}
-+	cik_srbm_select(rdev, 0, 0, 0, 0);
-+}
-+
- /**
-  * cik_cp_compute_enable - enable/disable the compute CP MEs
-  *
-@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
- 	if (enable)
- 		WREG32(CP_MEC_CNTL, 0);
- 	else {
-+		/*
-+		 * To make hibernation reliable we need to clear compute ring
-+		 * configuration before halting the compute ring.
-+		 */
-+		mutex_lock(&rdev->srbm_mutex);
-+		cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
-+		cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
-+		mutex_unlock(&rdev->srbm_mutex);
-+
- 		WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
- 		rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
- 		rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
-diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
-index 66ba713..e590aec 100644
---- a/drivers/gpu/drm/radeon/cik_sdma.c
-+++ b/drivers/gpu/drm/radeon/cik_sdma.c
-@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
- 	}
- 	rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
- 	rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
-+
-+	/* FIXME use something else than big hammer but after few days can not
-+	 * seem to find good combination so reset SDMA blocks as it seems we
-+	 * do not shut them down properly. This fix hibernation and does not
-+	 * affect suspend to ram.
-+	 */
-+	WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
-+	(void)RREG32(SRBM_SOFT_RESET);
-+	udelay(50);
-+	WREG32(SRBM_SOFT_RESET, 0);
-+	(void)RREG32(SRBM_SOFT_RESET);
- }
- 
- /**
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index a8f9b46..e609722 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
- 			}
- 		}
- 	}
--	mb();
--	radeon_gart_tlb_flush(rdev);
-+	if (rdev->gart.ptr) {
-+		mb();
-+		radeon_gart_tlb_flush(rdev);
-+	}
- }
- 
- /**
-@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
- 			}
- 		}
- 	}
--	mb();
--	radeon_gart_tlb_flush(rdev);
-+	if (rdev->gart.ptr) {
-+		mb();
-+		radeon_gart_tlb_flush(rdev);
-+	}
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index b3f0293..f8b20e1 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- 	struct drm_mode_config *mode_config = &dev->mode_config;
- 	struct drm_connector *connector;
- 
-+	mutex_lock(&mode_config->mutex);
- 	if (mode_config->num_connector) {
- 		list_for_each_entry(connector, &mode_config->connector_list, head)
- 			radeon_connector_hotplug(connector);
- 	}
-+	mutex_unlock(&mode_config->mutex);
- 	/* Just fire off a uevent and let userspace tell us what to do */
- 	drm_helper_hpd_irq_event(dev);
- }
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index 11804cc..c9053f7 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- 	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- 	{ 0, 0, 0, 0 },
- };
- 
-diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
-index d219c06..972444a 100644
---- a/drivers/hwmon/mcp3021.c
-+++ b/drivers/hwmon/mcp3021.c
-@@ -31,14 +31,11 @@
- /* output format */
- #define MCP3021_SAR_SHIFT	2
- #define MCP3021_SAR_MASK	0x3ff
--
- #define MCP3021_OUTPUT_RES	10	/* 10-bit resolution */
--#define MCP3021_OUTPUT_SCALE	4
- 
- #define MCP3221_SAR_SHIFT	0
- #define MCP3221_SAR_MASK	0xfff
- #define MCP3221_OUTPUT_RES	12	/* 12-bit resolution */
--#define MCP3221_OUTPUT_SCALE	1
- 
- enum chips {
- 	mcp3021,
-@@ -54,7 +51,6 @@ struct mcp3021_data {
- 	u16 sar_shift;
- 	u16 sar_mask;
- 	u8 output_res;
--	u8 output_scale;
- };
- 
- static int mcp3021_read16(struct i2c_client *client)
-@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
- 
- static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
- {
--	if (val == 0)
--		return 0;
--
--	val = val * data->output_scale - data->output_scale / 2;
--
--	return val * DIV_ROUND_CLOSEST(data->vdd,
--			(1 << data->output_res) * data->output_scale);
-+	return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
- }
- 
- static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
-@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
- 		data->sar_shift = MCP3021_SAR_SHIFT;
- 		data->sar_mask = MCP3021_SAR_MASK;
- 		data->output_res = MCP3021_OUTPUT_RES;
--		data->output_scale = MCP3021_OUTPUT_SCALE;
- 		break;
- 
- 	case mcp3221:
- 		data->sar_shift = MCP3221_SAR_SHIFT;
- 		data->sar_mask = MCP3221_SAR_MASK;
- 		data->output_res = MCP3221_OUTPUT_RES;
--		data->output_scale = MCP3221_OUTPUT_SCALE;
- 		break;
- 	}
- 
-diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
-index 8873d84..50862c9 100644
---- a/drivers/i2c/busses/i2c-at91.c
-+++ b/drivers/i2c/busses/i2c-at91.c
-@@ -62,6 +62,9 @@
- #define	AT91_TWI_UNRE		0x0080	/* Underrun Error */
- #define	AT91_TWI_NACK		0x0100	/* Not Acknowledged */
- 
-+#define	AT91_TWI_INT_MASK \
-+	(AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
-+
- #define	AT91_TWI_IER		0x0024	/* Interrupt Enable Register */
- #define	AT91_TWI_IDR		0x0028	/* Interrupt Disable Register */
- #define	AT91_TWI_IMR		0x002c	/* Interrupt Mask Register */
-@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
- 
- static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
- {
--	at91_twi_write(dev, AT91_TWI_IDR,
--		       AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
-+	at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
- }
- 
- static void at91_twi_irq_save(struct at91_twi_dev *dev)
- {
--	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
-+	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
- 	at91_disable_twi_interrupts(dev);
- }
- 
-@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data)
- 	dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
- 			 dev->buf_len, DMA_TO_DEVICE);
- 
-+	/*
-+	 * When this callback is called, THR/TX FIFO is likely not to be empty
-+	 * yet. So we have to wait for TXCOMP or NACK bits to be set into the
-+	 * Status Register to be sure that the STOP bit has been sent and the
-+	 * transfer is completed. The NACK interrupt has already been enabled,
-+	 * we just have to enable TXCOMP one.
-+	 */
-+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- 	at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
- }
- 
-@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data)
- 	/* The last two bytes have to be read without using dma */
- 	dev->buf += dev->buf_len - 2;
- 	dev->buf_len = 2;
--	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
-+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
- }
- 
- static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
-@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
- 	/* catch error flags */
- 	dev->transfer_status |= status;
- 
--	if (irqstatus & AT91_TWI_TXCOMP) {
-+	if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
- 		at91_disable_twi_interrupts(dev);
- 		complete(&dev->cmd_complete);
- 	}
-@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- 	int ret;
- 	bool has_unre_flag = dev->pdata->has_unre_flag;
- 
-+	/*
-+	 * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
-+	 * read flag but shows the state of the transmission at the time the
-+	 * Status Register is read. According to the programmer datasheet,
-+	 * TXCOMP is set when both holding register and internal shifter are
-+	 * empty and STOP condition has been sent.
-+	 * Consequently, we should enable NACK interrupt rather than TXCOMP to
-+	 * detect transmission failure.
-+	 *
-+	 * Besides, the TXCOMP bit is already set before the i2c transaction
-+	 * has been started. For read transactions, this bit is cleared when
-+	 * writing the START bit into the Control Register. So the
-+	 * corresponding interrupt can safely be enabled just after.
-+	 * However for write transactions managed by the CPU, we first write
-+	 * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
-+	 * interrupt. If TXCOMP interrupt were enabled before writing into THR,
-+	 * the interrupt handler would be called immediately and the i2c command
-+	 * would be reported as completed.
-+	 * Also when a write transaction is managed by the DMA controller,
-+	 * enabling the TXCOMP interrupt in this function may lead to a race
-+	 * condition since we don't know whether the TXCOMP interrupt is enabled
-+	 * before or after the DMA has started to write into THR. So the TXCOMP
-+	 * interrupt is enabled later by at91_twi_write_data_dma_callback().
-+	 * Immediately after in that DMA callback, we still need to send the
-+	 * STOP condition manually writing the corresponding bit into the
-+	 * Control Register.
-+	 */
-+
- 	dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
- 		(dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
- 
-@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- 		 * seems to be the best solution.
- 		 */
- 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- 			at91_twi_read_data_dma(dev);
--			/*
--			 * It is important to enable TXCOMP irq here because
--			 * doing it only when transferring the last two bytes
--			 * will mask NACK errors since TXCOMP is set when a
--			 * NACK occurs.
--			 */
--			at91_twi_write(dev, AT91_TWI_IER,
--			       AT91_TWI_TXCOMP);
--		} else
-+		} else {
- 			at91_twi_write(dev, AT91_TWI_IER,
--			       AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
-+				       AT91_TWI_TXCOMP |
-+				       AT91_TWI_NACK |
-+				       AT91_TWI_RXRDY);
-+		}
- 	} else {
- 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- 			at91_twi_write_data_dma(dev);
--			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- 		} else {
- 			at91_twi_write_next_byte(dev);
- 			at91_twi_write(dev, AT91_TWI_IER,
--				AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
-+				       AT91_TWI_TXCOMP |
-+				       AT91_TWI_NACK |
-+				       AT91_TWI_TXRDY);
- 		}
- 	}
- 
-diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
-index e6bf77d..ed4e45f 100644
---- a/drivers/iio/adc/at91_adc.c
-+++ b/drivers/iio/adc/at91_adc.c
-@@ -58,7 +58,7 @@ struct at91_adc_caps {
- 	u8	ts_pen_detect_sensitivity;
- 
- 	/* startup time calculate function */
--	u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
-+	u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
- 
- 	u8	num_channels;
- 	struct at91_adc_reg_desc registers;
-@@ -82,7 +82,7 @@ struct at91_adc_state {
- 	u8			num_channels;
- 	void __iomem		*reg_base;
- 	struct at91_adc_reg_desc *registers;
--	u8			startup_time;
-+	u32			startup_time;
- 	u8			sample_hold_time;
- 	bool			sleep_mode;
- 	struct iio_trigger	**trig;
-@@ -590,7 +590,7 @@ ret:
- 	return ret;
- }
- 
--static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
- {
- 	/*
- 	 * Number of ticks needed to cover the startup time of the ADC
-@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
- 	return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
- }
- 
--static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
- {
- 	/*
- 	 * For sama5d3x and at91sam9x5, the formula changes to:
-diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
-index e8199cc..1e66651 100644
---- a/drivers/iio/dac/ad5624r_spi.c
-+++ b/drivers/iio/dac/ad5624r_spi.c
-@@ -22,7 +22,7 @@
- #include "ad5624r.h"
- 
- static int ad5624r_spi_write(struct spi_device *spi,
--			     u8 cmd, u8 addr, u16 val, u8 len)
-+			     u8 cmd, u8 addr, u16 val, u8 shift)
- {
- 	u32 data;
- 	u8 msg[3];
-@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
- 	 * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
- 	 * for the AD5664R, AD5644R, and AD5624R, respectively.
- 	 */
--	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
-+	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
- 	msg[0] = data >> 16;
- 	msg[1] = data >> 8;
- 	msg[2] = data;
-diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
-index 84a0789..7a80509 100644
---- a/drivers/iio/temperature/tmp006.c
-+++ b/drivers/iio/temperature/tmp006.c
-@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
- 	struct tmp006_data *data = iio_priv(indio_dev);
- 	int i;
- 
-+	if (mask != IIO_CHAN_INFO_SAMP_FREQ)
-+		return -EINVAL;
-+
- 	for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
- 		if ((val == tmp006_freqs[i][0]) &&
- 		    (val2 == tmp006_freqs[i][1])) {
-diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
-index 6014227..dd2b610 100644
---- a/drivers/infiniband/ulp/isert/ib_isert.c
-+++ b/drivers/infiniband/ulp/isert/ib_isert.c
-@@ -59,6 +59,8 @@ static int
- isert_rdma_accept(struct isert_conn *isert_conn);
- struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
- 
-+static void isert_release_work(struct work_struct *work);
-+
- static void
- isert_qp_event_callback(struct ib_event *e, void *context)
- {
-@@ -206,7 +208,7 @@ fail:
- static void
- isert_free_rx_descriptors(struct isert_conn *isert_conn)
- {
--	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
-+	struct ib_device *ib_dev = isert_conn->conn_device->ib_device;
- 	struct iser_rx_desc *rx_desc;
- 	int i;
- 
-@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- 	mutex_init(&isert_conn->conn_mutex);
- 	spin_lock_init(&isert_conn->conn_lock);
- 	INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
-+	INIT_WORK(&isert_conn->release_work, isert_release_work);
- 
- 	isert_conn->conn_cm_id = cma_id;
- 	isert_conn->responder_resources = event->param.conn.responder_resources;
-@@ -647,9 +650,9 @@ out:
- static void
- isert_connect_release(struct isert_conn *isert_conn)
- {
--	struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
- 	struct isert_device *device = isert_conn->conn_device;
- 	int cq_index;
-+	struct ib_device *ib_dev = device->ib_device;
- 
- 	pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
- 
-@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn)
- 		isert_conn_free_fastreg_pool(isert_conn);
- 
- 	isert_free_rx_descriptors(isert_conn);
--	rdma_destroy_id(isert_conn->conn_cm_id);
-+	if (isert_conn->conn_cm_id)
-+		rdma_destroy_id(isert_conn->conn_cm_id);
- 
- 	if (isert_conn->conn_qp) {
- 		cq_index = ((struct isert_cq_desc *)
-@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- {
- 	struct isert_np *isert_np = cma_id->context;
- 	struct isert_conn *isert_conn;
-+	bool terminating = false;
- 
- 	if (isert_np->np_cm_id == cma_id)
- 		return isert_np_cma_handler(cma_id->context, event);
-@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- 	isert_conn = cma_id->qp->qp_context;
- 
- 	mutex_lock(&isert_conn->conn_mutex);
-+	terminating = (isert_conn->state == ISER_CONN_TERMINATING);
- 	isert_conn_terminate(isert_conn);
- 	mutex_unlock(&isert_conn->conn_mutex);
- 
- 	pr_info("conn %p completing conn_wait\n", isert_conn);
- 	complete(&isert_conn->conn_wait);
- 
-+	if (terminating)
-+		goto out;
-+
-+	mutex_lock(&isert_np->np_accept_mutex);
-+	if (!list_empty(&isert_conn->conn_accept_node)) {
-+		list_del_init(&isert_conn->conn_accept_node);
-+		isert_put_conn(isert_conn);
-+		queue_work(isert_release_wq, &isert_conn->release_work);
-+	}
-+	mutex_unlock(&isert_np->np_accept_mutex);
-+
-+out:
- 	return 0;
- }
- 
--static void
-+static int
- isert_connect_error(struct rdma_cm_id *cma_id)
- {
- 	struct isert_conn *isert_conn = cma_id->qp->qp_context;
- 
-+	isert_conn->conn_cm_id = NULL;
- 	isert_put_conn(isert_conn);
-+
-+	return -1;
- }
- 
- static int
-@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- 	case RDMA_CM_EVENT_REJECTED:       /* FALLTHRU */
- 	case RDMA_CM_EVENT_UNREACHABLE:    /* FALLTHRU */
- 	case RDMA_CM_EVENT_CONNECT_ERROR:
--		isert_connect_error(cma_id);
-+		ret = isert_connect_error(cma_id);
- 		break;
- 	default:
- 		pr_err("Unhandled RDMA CMA event: %d\n", event->event);
-@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
- 
- 	wait_for_completion(&isert_conn->conn_wait_comp_err);
- 
--	INIT_WORK(&isert_conn->release_work, isert_release_work);
- 	queue_work(isert_release_wq, &isert_conn->release_work);
- }
- 
-diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
-index f37d63c..825545c 100644
---- a/drivers/leds/led-class.c
-+++ b/drivers/leds/led-class.c
-@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev)
- }
- EXPORT_SYMBOL_GPL(led_classdev_resume);
- 
-+#ifdef CONFIG_PM_SLEEP
- static int led_suspend(struct device *dev)
- {
- 	struct led_classdev *led_cdev = dev_get_drvdata(dev);
-@@ -197,11 +198,9 @@ static int led_resume(struct device *dev)
- 
- 	return 0;
- }
-+#endif
- 
--static const struct dev_pm_ops leds_class_dev_pm_ops = {
--	.suspend        = led_suspend,
--	.resume         = led_resume,
--};
-+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
- 
- /**
-  * led_classdev_register - register a new object of led_classdev class.
-diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
-index 28a9012..b3b0697 100644
---- a/drivers/md/dm-stats.c
-+++ b/drivers/md/dm-stats.c
-@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
- 		return -EINVAL;
- 
- 	if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
-+		if (!divisor)
-+			return -EINVAL;
- 		step = end - start;
- 		if (do_div(step, divisor))
- 			step++;
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 40959ee..b4067b9 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
- 	    mddev->ctime         != info->ctime         ||
- 	    mddev->level         != info->level         ||
- /*	    mddev->layout        != info->layout        || */
--	    !mddev->persistent	 != info->not_persistent||
-+	    mddev->persistent	 != !info->not_persistent ||
- 	    mddev->chunk_sectors != info->chunk_size >> 9 ||
- 	    /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
- 	    ((state^info->state) & 0xfffffe00)
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index b88757c..a03178e 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- 
- 		if (s < 0 && nr_center < -s) {
- 			/* not enough in central node */
--			shift(left, center, nr_center);
--			s = nr_center - target;
-+			shift(left, center, -nr_center);
-+			s += nr_center;
- 			shift(left, right, s);
- 			nr_right += s;
- 		} else
-@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- 		if (s > 0 && nr_center < s) {
- 			/* not enough in central node */
- 			shift(center, right, nr_center);
--			s = target - nr_center;
-+			s -= nr_center;
- 			shift(left, right, s);
- 			nr_left -= s;
- 		} else
-diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
-index 200ac12..fdd3793 100644
---- a/drivers/md/persistent-data/dm-btree.c
-+++ b/drivers/md/persistent-data/dm-btree.c
-@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
- 	int r;
- 	struct del_stack *s;
- 
--	s = kmalloc(sizeof(*s), GFP_KERNEL);
-+	s = kmalloc(sizeof(*s), GFP_NOIO);
- 	if (!s)
- 		return -ENOMEM;
- 	s->info = info;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index f4e22bc..199c9cc 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
- 	smm->recursion_count++;
- }
- 
-+static int apply_bops(struct sm_metadata *smm)
-+{
-+	int r = 0;
-+
-+	while (!brb_empty(&smm->uncommitted)) {
-+		struct block_op bop;
-+
-+		r = brb_pop(&smm->uncommitted, &bop);
-+		if (r) {
-+			DMERR("bug in bop ring buffer");
-+			break;
-+		}
-+
-+		r = commit_bop(smm, &bop);
-+		if (r)
-+			break;
-+	}
-+
-+	return r;
-+}
-+
- static int out(struct sm_metadata *smm)
- {
- 	int r = 0;
-@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
- 		return -ENOMEM;
- 	}
- 
--	if (smm->recursion_count == 1) {
--		while (!brb_empty(&smm->uncommitted)) {
--			struct block_op bop;
--
--			r = brb_pop(&smm->uncommitted, &bop);
--			if (r) {
--				DMERR("bug in bop ring buffer");
--				break;
--			}
--
--			r = commit_bop(smm, &bop);
--			if (r)
--				break;
--		}
--	}
-+	if (smm->recursion_count == 1)
-+		apply_bops(smm);
- 
- 	smm->recursion_count--;
- 
-@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
- 		}
- 		old_len = smm->begin;
- 
-+		r = apply_bops(smm);
-+		if (r) {
-+			DMERR("%s: apply_bops failed", __func__);
-+			goto out;
-+		}
-+
- 		r = sm_ll_commit(&smm->ll);
- 		if (r)
- 			goto out;
-@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
- 	if (r)
- 		return r;
- 
-+	r = apply_bops(smm);
-+	if (r) {
-+		DMERR("%s: apply_bops failed", __func__);
-+		return r;
-+	}
-+
- 	return sm_metadata_commit(sm);
- }
- 
-diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
-index fb504f1..5930aee 100644
---- a/drivers/media/dvb-frontends/af9013.c
-+++ b/drivers/media/dvb-frontends/af9013.c
-@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
- 			}
- 		}
- 
-+		/* Return an error if can't find bandwidth or the right clock */
-+		if (i == ARRAY_SIZE(coeff_lut))
-+			return -EINVAL;
-+
- 		ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
- 			sizeof(coeff_lut[i].val));
- 	}
-diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
-index 2916d7c..7bc68b3 100644
---- a/drivers/media/dvb-frontends/cx24116.c
-+++ b/drivers/media/dvb-frontends/cx24116.c
-@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- 	struct cx24116_state *state = fe->demodulator_priv;
- 	int i, ret;
- 
-+	/* Validate length */
-+	if (d->msg_len > sizeof(d->msg))
-+                return -EINVAL;
-+
- 	/* Dump DiSEqC message */
- 	if (debug) {
- 		printk(KERN_INFO "cx24116: %s(", __func__);
-@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- 		printk(") toneburst=%d\n", toneburst);
- 	}
- 
--	/* Validate length */
--	if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
--		return -EINVAL;
--
- 	/* DiSEqC message */
- 	for (i = 0; i < d->msg_len; i++)
- 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
-diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
-index a6c3c9e..d2eab06 100644
---- a/drivers/media/dvb-frontends/cx24117.c
-+++ b/drivers/media/dvb-frontends/cx24117.c
-@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
- 	dev_dbg(&state->priv->i2c->dev, ")\n");
- 
- 	/* Validate length */
--	if (d->msg_len > 15)
-+	if (d->msg_len > sizeof(d->msg))
- 		return -EINVAL;
- 
- 	/* DiSEqC message */
-diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
-index 93eeaf7..0b4f8fe 100644
---- a/drivers/media/dvb-frontends/s5h1420.c
-+++ b/drivers/media/dvb-frontends/s5h1420.c
-@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
- 	int result = 0;
- 
- 	dprintk("enter %s\n", __func__);
--	if (cmd->msg_len > 8)
-+	if (cmd->msg_len > sizeof(cmd->msg))
- 		return -EINVAL;
- 
- 	/* setup for DISEQC */
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index b1e21fc..d71f5ef 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
- 
- 	ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
- 
-+	mmc_blk_put(md);
-+
- 	return ret;
- }
- 
-@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- 			break;
- 		case MMC_BLK_CMD_ERR:
- 			ret = mmc_blk_cmd_err(md, card, brq, req, ret);
--			if (!mmc_blk_reset(md, card->host, type))
--				break;
--			goto cmd_abort;
-+			if (mmc_blk_reset(md, card->host, type))
-+				goto cmd_abort;
-+			if (!ret)
-+				goto start_new_req;
-+			break;
- 		case MMC_BLK_RETRY:
- 			if (retry++ < 5)
- 				break;
-diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
-index f8a7dd1..70a3db3 100644
---- a/drivers/mtd/maps/dc21285.c
-+++ b/drivers/mtd/maps/dc21285.c
-@@ -38,9 +38,9 @@ static void nw_en_write(void)
- 	 * we want to write a bit pattern XXX1 to Xilinx to enable
- 	 * the write gate, which will be open for about the next 2ms.
- 	 */
--	spin_lock_irqsave(&nw_gpio_lock, flags);
-+	raw_spin_lock_irqsave(&nw_gpio_lock, flags);
- 	nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
--	spin_unlock_irqrestore(&nw_gpio_lock, flags);
-+	raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
- 
- 	/*
- 	 * let the ISA bus to catch on...
-diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
-index 5073cbc..32d5e40 100644
---- a/drivers/mtd/mtd_blkdevs.c
-+++ b/drivers/mtd/mtd_blkdevs.c
-@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
- 		return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
- 
- 	mutex_lock(&dev->lock);
-+	mutex_lock(&mtd_table_mutex);
- 
- 	if (dev->open)
- 		goto unlock;
-@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
- 
- unlock:
- 	dev->open++;
-+	mutex_unlock(&mtd_table_mutex);
- 	mutex_unlock(&dev->lock);
- 	blktrans_dev_put(dev);
- 	return ret;
-@@ -232,6 +234,7 @@ error_release:
- error_put:
- 	module_put(dev->tr->owner);
- 	kref_put(&dev->ref, blktrans_dev_release);
-+	mutex_unlock(&mtd_table_mutex);
- 	mutex_unlock(&dev->lock);
- 	blktrans_dev_put(dev);
- 	return ret;
-@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- 		return;
- 
- 	mutex_lock(&dev->lock);
-+	mutex_lock(&mtd_table_mutex);
- 
- 	if (--dev->open)
- 		goto unlock;
-@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- 		__put_mtd_device(dev->mtd);
- 	}
- unlock:
-+	mutex_unlock(&mtd_table_mutex);
- 	mutex_unlock(&dev->lock);
- 	blktrans_dev_put(dev);
- }
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 9715a7b..efc542d 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd,
- 			oob += chip->ecc.prepad;
- 		}
- 
--		chip->read_buf(mtd, oob, eccbytes);
-+		chip->write_buf(mtd, oob, eccbytes);
- 		oob += eccbytes;
- 
- 		if (chip->ecc.postpad) {
-@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- 					int *busw)
- {
- 	struct nand_onfi_params *p = &chip->onfi_params;
--	int i;
-+	int i, j;
- 	int val;
- 
- 	/* Try ONFI for unknown chip or LP */
-@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- 		chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I')
- 		return 0;
- 
--	/*
--	 * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not
--	 * with NAND_BUSWIDTH_16
--	 */
--	if (chip->options & NAND_BUSWIDTH_16) {
--		pr_err("ONFI cannot be probed in 16-bit mode; aborting\n");
--		return 0;
--	}
--
- 	chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
- 	for (i = 0; i < 3; i++) {
--		chip->read_buf(mtd, (uint8_t *)p, sizeof(*p));
-+		for (j = 0; j < sizeof(*p); j++)
-+			((uint8_t *)p)[j] = chip->read_byte(mtd);
- 		if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
- 				le16_to_cpu(p->crc)) {
- 			break;
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 5924f72..f35ce8e 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
- 	ath_stop_ani(sc);
- 	ath9k_hw_disable_interrupts(ah);
- 
--	if (!ath_drain_all_txq(sc))
--		ret = false;
--
--	if (!ath_stoprecv(sc))
--		ret = false;
-+	if (AR_SREV_9300_20_OR_LATER(ah)) {
-+		ret &= ath_stoprecv(sc);
-+		ret &= ath_drain_all_txq(sc);
-+	} else {
-+		ret &= ath_drain_all_txq(sc);
-+		ret &= ath_stoprecv(sc);
-+	}
- 
- 	return ret;
- }
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 3935614..e99f329 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells);
- #ifdef CONFIG_NUMA
- int __weak of_node_to_nid(struct device_node *np)
- {
--	return numa_node_id();
-+	return NUMA_NO_NODE;
- }
- #endif
- 
-diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
-index 615a45a..582688fe 100644
---- a/drivers/pcmcia/topic.h
-+++ b/drivers/pcmcia/topic.h
-@@ -104,6 +104,9 @@
- #define TOPIC_EXCA_IF_CONTROL		0x3e	/* 8 bit */
- #define TOPIC_EXCA_IFC_33V_ENA		0x01
- 
-+#define TOPIC_PCI_CFG_PPBCN		0x3e	/* 16-bit */
-+#define TOPIC_PCI_CFG_PPBCN_WBEN	0x0400
-+
- static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
- {
- 	struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
-@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
- static int topic95_override(struct yenta_socket *socket)
- {
- 	u8 fctrl;
-+	u16 ppbcn;
- 
- 	/* enable 3.3V support for 16bit cards */
- 	fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
-@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
- 	/* tell yenta to use exca registers to power 16bit cards */
- 	socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
- 
-+	/* Disable write buffers to prevent lockups under load with numerous
-+	   Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
-+	   net.  This is not a power-on default according to the datasheet
-+	   but some BIOSes seem to set it. */
-+	if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
-+	    && socket->dev->revision <= 7
-+	    && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
-+		ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
-+		pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
-+		dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
-+	}
-+
- 	return 0;
- }
- 
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-index ae1f760..bb525b1 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
- 	MPP_MODE(64,
- 	   MPP_FUNCTION(0x0, "gpio", NULL),
- 	   MPP_FUNCTION(0x1, "spi0", "miso"),
--	   MPP_FUNCTION(0x2, "spi0-1", "cs1")),
-+	   MPP_FUNCTION(0x2, "spi0", "cs1")),
- 	MPP_MODE(65,
- 	   MPP_FUNCTION(0x0, "gpio", NULL),
- 	   MPP_FUNCTION(0x1, "spi0", "mosi"),
--	   MPP_FUNCTION(0x2, "spi0-1", "cs2")),
-+	   MPP_FUNCTION(0x2, "spi0", "cs2")),
- };
- 
- static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-index 843a51f..d918c51 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-@@ -14,10 +14,7 @@
-  * available: mv78230, mv78260 and mv78460. From a pin muxing
-  * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
-  * both have 67 MPP pins (more GPIOs and address lines for the memory
-- * bus mainly). The only difference between the mv78260 and the
-- * mv78460 in terms of pin muxing is the addition of two functions on
-- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
-- * cores, mv78460 has four cores).
-+ * bus mainly).
-  */
- 
- #include <linux/err.h>
-@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 	MPP_MODE(24,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sata1", "prsnt",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re",   V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "rst",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "hsync",      V_MV78230_PLUS)),
- 	MPP_MODE(25,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sata0", "prsnt",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we",   V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "pclk",       V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "vsync",      V_MV78230_PLUS)),
- 	MPP_MODE(26,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "fsync",      V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS)),
- 	MPP_MODE(27,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "ptp", "trig",       V_MV78230_PLUS),
-@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "ptp", "clk",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "int0",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS)),
- 	MPP_MODE(30,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "clk",        V_MV78230_PLUS),
-@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 	MPP_MODE(31,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "cmd",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS)),
- 	MPP_MODE(32,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "d0",         V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS)),
- 	MPP_MODE(33,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "d1",         V_MV78230_PLUS),
-@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "spi", "cs1",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart2", "cts",      V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd",    V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync",  V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0",   V_MV78230_PLUS)),
- 	MPP_MODE(41,
-@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "rxd",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart0", "cts",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "int7",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS)),
- 	MPP_MODE(43,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "txd",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart0", "rts",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "spi", "cs3",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd",  V_MV78460)),
-+		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS)),
- 	MPP_MODE(44,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "cts",      V_MV78230_PLUS),
-@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3",   V_MV78230_PLUS)),
- 	MPP_MODE(48,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "tclk", NULL,        V_MV78230_PLUS),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "clkout",     V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
- 	MPP_MODE(49,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
-@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x1, "dev", "ad19",       V_MV78260_PLUS)),
- 	MPP_MODE(55,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd",    V_MV78260_PLUS)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS)),
- 	MPP_MODE(56,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd",    V_MV78260_PLUS)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS)),
- 	MPP_MODE(57,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd",  V_MV78460)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS)),
- 	MPP_MODE(58,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "dev", "ad23",       V_MV78260_PLUS)),
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index fed4111..1beb232 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = {
- };
- 
- static struct calling_interface_buffer *buffer;
--static struct page *bufferpage;
- static DEFINE_MUTEX(buffer_mutex);
- 
- static int hwswitch_state;
-@@ -825,12 +824,11 @@ static int __init dell_init(void)
- 	 * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
- 	 * is passed to SMI handler.
- 	 */
--	bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
--	if (!bufferpage) {
-+	buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
-+	if (!buffer) {
- 		ret = -ENOMEM;
- 		goto fail_buffer;
- 	}
--	buffer = page_address(bufferpage);
- 
- 	ret = dell_setup_rfkill();
- 
-@@ -892,7 +890,7 @@ fail_backlight:
- 	cancel_delayed_work_sync(&dell_rfkill_work);
- 	dell_cleanup_rfkill();
- fail_rfkill:
--	free_page((unsigned long)bufferpage);
-+	free_page((unsigned long)buffer);
- fail_buffer:
- 	platform_device_del(platform_device);
- fail_platform_device2:
-diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
-index 6dd060a..0d1a5d4 100644
---- a/drivers/platform/x86/ideapad-laptop.c
-+++ b/drivers/platform/x86/ideapad-laptop.c
-@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
- static int ideapad_rfk_set(void *data, bool blocked)
- {
- 	struct ideapad_rfk_priv *priv = data;
-+	int opcode = ideapad_rfk_data[priv->dev].opcode;
- 
--	return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
-+	return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
- }
- 
- static struct rfkill_ops ideapad_rfk_ops = {
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 5d8d2dc..427cb62 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
- static void print_constraints(struct regulator_dev *rdev)
- {
- 	struct regulation_constraints *constraints = rdev->constraints;
--	char buf[80] = "";
-+	char buf[160] = "";
- 	int count = 0;
- 	int ret;
- 
-diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
-index 0801f3d..02edae7 100644
---- a/drivers/scsi/ipr.h
-+++ b/drivers/scsi/ipr.h
-@@ -264,7 +264,7 @@
- #define IPR_RUNTIME_RESET				0x40000000
- 
- #define IPR_IPL_INIT_MIN_STAGE_TIME			5
--#define IPR_IPL_INIT_DEFAULT_STAGE_TIME                 15
-+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME                 30
- #define IPR_IPL_INIT_STAGE_UNKNOWN			0x0
- #define IPR_IPL_INIT_STAGE_TRANSOP			0xB0000000
- #define IPR_IPL_INIT_STAGE_MASK				0xff000000
-diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
-index 0a1dcb4..13f4bef 100644
---- a/drivers/scsi/qla2xxx/qla_isr.c
-+++ b/drivers/scsi/qla2xxx/qla_isr.c
-@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
- 	struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
- 	struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
- 	struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
--	uint32_t	rscn_entry, host_pid;
-+	uint32_t	rscn_entry, host_pid, tmp_pid;
- 	unsigned long	flags;
-+	fc_port_t	*fcport = NULL;
- 
- 	/* Setup to process RIO completion. */
- 	handle_cnt = 0;
-@@ -968,6 +969,20 @@ skip_rio:
- 		if (qla2x00_is_a_vp_did(vha, rscn_entry))
- 			break;
- 
-+		/*
-+		 * Search for the rport related to this RSCN entry and mark it
-+		 * as lost.
-+		 */
-+		list_for_each_entry(fcport, &vha->vp_fcports, list) {
-+			if (atomic_read(&fcport->state) != FCS_ONLINE)
-+				continue;
-+			tmp_pid = fcport->d_id.b24;
-+			if (fcport->d_id.b24 == rscn_entry) {
-+				qla2x00_mark_device_lost(vha, fcport, 0, 0);
-+				break;
-+			}
-+		}
-+
- 		atomic_set(&vha->loop_down_timer, 0);
- 		vha->flags.management_server_logged_in = 0;
- 
-diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
-index e3e794e..b85eaa0 100644
---- a/drivers/scsi/scsi_transport_srp.c
-+++ b/drivers/scsi/scsi_transport_srp.c
-@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work)
- 	}
- }
- 
-+/**
-+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-+ *
-+ * To do: add support for scsi-mq in this function.
-+ */
-+static int scsi_request_fn_active(struct Scsi_Host *shost)
-+{
-+	struct scsi_device *sdev;
-+	struct request_queue *q;
-+	int request_fn_active = 0;
-+
-+	shost_for_each_device(sdev, shost) {
-+		q = sdev->request_queue;
-+
-+		spin_lock_irq(q->queue_lock);
-+		request_fn_active += q->request_fn_active;
-+		spin_unlock_irq(q->queue_lock);
-+	}
-+
-+	return request_fn_active;
-+}
-+
-+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
-+static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
-+{
-+	while (scsi_request_fn_active(shost))
-+		msleep(20);
-+}
-+
- static void __rport_fail_io_fast(struct srp_rport *rport)
- {
- 	struct Scsi_Host *shost = rport_to_shost(rport);
-@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport)
- 
- 	/* Involve the LLD if possible to terminate all I/O on the rport. */
- 	i = to_srp_internal(shost->transportt);
--	if (i->f->terminate_rport_io)
-+	if (i->f->terminate_rport_io) {
-+		srp_wait_for_queuecommand(shost);
- 		i->f->terminate_rport_io(rport);
-+	}
- }
- 
- /**
-@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport)
- EXPORT_SYMBOL(srp_start_tl_fail_timers);
- 
- /**
-- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-- */
--static int scsi_request_fn_active(struct Scsi_Host *shost)
--{
--	struct scsi_device *sdev;
--	struct request_queue *q;
--	int request_fn_active = 0;
--
--	shost_for_each_device(sdev, shost) {
--		q = sdev->request_queue;
--
--		spin_lock_irq(q->queue_lock);
--		request_fn_active += q->request_fn_active;
--		spin_unlock_irq(q->queue_lock);
--	}
--
--	return request_fn_active;
--}
--
--/**
-  * srp_reconnect_rport() - reconnect to an SRP target port
-  * @rport: SRP target port.
-  *
-@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
- 	if (res)
- 		goto out;
- 	scsi_target_block(&shost->shost_gendev);
--	while (scsi_request_fn_active(shost))
--		msleep(20);
-+	srp_wait_for_queuecommand(shost);
- 	res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
- 	pr_debug("%s (state %d): transport.reconnect() returned %d\n",
- 		 dev_name(&shost->shost_gendev), rport->state, res);
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index d6563ec..f3e3ae8 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master)
- 
- 	spin_lock_irqsave(&master->queue_lock, flags);
- 	mesg = master->cur_msg;
--	master->cur_msg = NULL;
--
--	queue_kthread_work(&master->kworker, &master->pump_messages);
- 	spin_unlock_irqrestore(&master->queue_lock, flags);
- 
- 	if (master->cur_msg_prepared && master->unprepare_message) {
-@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master)
- 		}
- 	}
- 
--	trace_spi_message_done(mesg);
--
-+	spin_lock_irqsave(&master->queue_lock, flags);
-+	master->cur_msg = NULL;
- 	master->cur_msg_prepared = false;
-+	queue_kthread_work(&master->kworker, &master->pump_messages);
-+	spin_unlock_irqrestore(&master->queue_lock, flags);
-+
-+	trace_spi_message_done(mesg);
- 
- 	mesg->state = NULL;
- 	if (mesg->complete)
-diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
-index ea96537..d060b1f 100644
---- a/drivers/staging/rtl8712/rtl8712_recv.c
-+++ b/drivers/staging/rtl8712/rtl8712_recv.c
-@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
- 		/* for first fragment packet, driver need allocate 1536 +
- 		 * drvinfo_sz + RXDESC_SIZE to defrag packet. */
- 		if ((mf == 1) && (frag == 0))
--			alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
-+			/*1658+6=1664, 1664 is 128 alignment.*/
-+			alloc_sz = max_t(u16, tmp_len, 1658);
- 		else
- 			alloc_sz = tmp_len;
- 		/* 2 is for IP header 4 bytes alignment in QoS packet case.
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index b61c555..c8d7b30 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = {
- 
- static int __init iscsi_target_init_module(void)
- {
--	int ret = 0;
-+	int ret = 0, size;
- 
- 	pr_debug("iSCSI-Target "ISCSIT_VERSION"\n");
- 
-@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void)
- 		pr_err("Unable to allocate memory for iscsit_global\n");
- 		return -1;
- 	}
-+	spin_lock_init(&iscsit_global->ts_bitmap_lock);
- 	mutex_init(&auth_id_lock);
- 	spin_lock_init(&sess_idr_lock);
- 	idr_init(&tiqn_idr);
-@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void)
- 	if (ret < 0)
- 		goto out;
- 
--	ret = iscsi_thread_set_init();
--	if (ret < 0)
-+	size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long);
-+	iscsit_global->ts_bitmap = vzalloc(size);
-+	if (!iscsit_global->ts_bitmap) {
-+		pr_err("Unable to allocate iscsit_global->ts_bitmap\n");
- 		goto configfs_out;
--
--	if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) !=
--			TARGET_THREAD_SET_COUNT) {
--		pr_err("iscsi_allocate_thread_sets() returned"
--			" unexpected value!\n");
--		goto ts_out1;
- 	}
- 
- 	lio_qr_cache = kmem_cache_create("lio_qr_cache",
-@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void)
- 	if (!lio_qr_cache) {
- 		pr_err("nable to kmem_cache_create() for"
- 				" lio_qr_cache\n");
--		goto ts_out2;
-+		goto bitmap_out;
- 	}
- 
- 	lio_dr_cache = kmem_cache_create("lio_dr_cache",
-@@ -597,10 +594,8 @@ dr_out:
- 	kmem_cache_destroy(lio_dr_cache);
- qr_out:
- 	kmem_cache_destroy(lio_qr_cache);
--ts_out2:
--	iscsi_deallocate_thread_sets();
--ts_out1:
--	iscsi_thread_set_free();
-+bitmap_out:
-+	vfree(iscsit_global->ts_bitmap);
- configfs_out:
- 	iscsi_target_deregister_configfs();
- out:
-@@ -610,8 +605,6 @@ out:
- 
- static void __exit iscsi_target_cleanup_module(void)
- {
--	iscsi_deallocate_thread_sets();
--	iscsi_thread_set_free();
- 	iscsit_release_discovery_tpg();
- 	iscsit_unregister_transport(&iscsi_target_transport);
- 	kmem_cache_destroy(lio_qr_cache);
-@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void)
- 
- 	iscsi_target_deregister_configfs();
- 
-+	vfree(iscsit_global->ts_bitmap);
- 	kfree(iscsit_global);
- }
- 
-@@ -3653,17 +3647,16 @@ static int iscsit_send_reject(
- 
- void iscsit_thread_get_cpumask(struct iscsi_conn *conn)
- {
--	struct iscsi_thread_set *ts = conn->thread_set;
- 	int ord, cpu;
- 	/*
--	 * thread_id is assigned from iscsit_global->ts_bitmap from
--	 * within iscsi_thread_set.c:iscsi_allocate_thread_sets()
-+	 * bitmap_id is assigned from iscsit_global->ts_bitmap from
-+	 * within iscsit_start_kthreads()
- 	 *
--	 * Here we use thread_id to determine which CPU that this
--	 * iSCSI connection's iscsi_thread_set will be scheduled to
-+	 * Here we use bitmap_id to determine which CPU that this
-+	 * iSCSI connection's RX/TX threads will be scheduled to
- 	 * execute upon.
- 	 */
--	ord = ts->thread_id % cpumask_weight(cpu_online_mask);
-+	ord = conn->bitmap_id % cpumask_weight(cpu_online_mask);
- 	for_each_online_cpu(cpu) {
- 		if (ord-- == 0) {
- 			cpumask_set_cpu(cpu, conn->conn_cpumask);
-@@ -3855,7 +3848,7 @@ check_rsp_state:
- 	switch (state) {
- 	case ISTATE_SEND_LOGOUTRSP:
- 		if (!iscsit_logout_post_handler(cmd, conn))
--			goto restart;
-+			return -ECONNRESET;
- 		/* fall through */
- 	case ISTATE_SEND_STATUS:
- 	case ISTATE_SEND_ASYNCMSG:
-@@ -3883,8 +3876,6 @@ check_rsp_state:
- 
- err:
- 	return -1;
--restart:
--	return -EAGAIN;
- }
- 
- static int iscsit_handle_response_queue(struct iscsi_conn *conn)
-@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn)
- int iscsi_target_tx_thread(void *arg)
- {
- 	int ret = 0;
--	struct iscsi_conn *conn;
--	struct iscsi_thread_set *ts = arg;
-+	struct iscsi_conn *conn = arg;
- 	/*
- 	 * Allow ourselves to be interrupted by SIGINT so that a
- 	 * connection recovery / failure event can be triggered externally.
- 	 */
- 	allow_signal(SIGINT);
- 
--restart:
--	conn = iscsi_tx_thread_pre_handler(ts);
--	if (!conn)
--		goto out;
--
--	ret = 0;
--
- 	while (!kthread_should_stop()) {
- 		/*
- 		 * Ensure that both TX and RX per connection kthreads
-@@ -3934,11 +3917,9 @@ restart:
- 		iscsit_thread_check_cpumask(conn, current, 1);
- 
- 		wait_event_interruptible(conn->queues_wq,
--					 !iscsit_conn_all_queues_empty(conn) ||
--					 ts->status == ISCSI_THREAD_SET_RESET);
-+					 !iscsit_conn_all_queues_empty(conn));
- 
--		if ((ts->status == ISCSI_THREAD_SET_RESET) ||
--		     signal_pending(current))
-+		if (signal_pending(current))
- 			goto transport_err;
- 
- get_immediate:
-@@ -3949,15 +3930,14 @@ get_immediate:
- 		ret = iscsit_handle_response_queue(conn);
- 		if (ret == 1)
- 			goto get_immediate;
--		else if (ret == -EAGAIN)
--			goto restart;
-+		else if (ret == -ECONNRESET)
-+			goto out;
- 		else if (ret < 0)
- 			goto transport_err;
- 	}
- 
- transport_err:
- 	iscsit_take_action_for_connection_exit(conn);
--	goto restart;
- out:
- 	return 0;
- }
-@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg)
- 	int ret;
- 	u8 buffer[ISCSI_HDR_LEN], opcode;
- 	u32 checksum = 0, digest = 0;
--	struct iscsi_conn *conn = NULL;
--	struct iscsi_thread_set *ts = arg;
-+	struct iscsi_conn *conn = arg;
- 	struct kvec iov;
- 	/*
- 	 * Allow ourselves to be interrupted by SIGINT so that a
-@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg)
- 	 */
- 	allow_signal(SIGINT);
- 
--restart:
--	conn = iscsi_rx_thread_pre_handler(ts);
--	if (!conn)
--		goto out;
--
- 	if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
- 		struct completion comp;
- 		int rc;
-@@ -4069,7 +4043,7 @@ restart:
- 		if (rc < 0)
- 			goto transport_err;
- 
--		goto out;
-+		goto transport_err;
- 	}
- 
- 	while (!kthread_should_stop()) {
-@@ -4145,8 +4119,6 @@ transport_err:
- 	if (!signal_pending(current))
- 		atomic_set(&conn->transport_failed, 1);
- 	iscsit_take_action_for_connection_exit(conn);
--	goto restart;
--out:
- 	return 0;
- }
- 
-@@ -4208,7 +4180,24 @@ int iscsit_close_connection(
- 	if (conn->conn_transport->transport_type == ISCSI_TCP)
- 		complete(&conn->conn_logout_comp);
- 
--	iscsi_release_thread_set(conn);
-+	if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) {
-+		if (conn->tx_thread &&
-+		    cmpxchg(&conn->tx_thread_active, true, false)) {
-+			send_sig(SIGINT, conn->tx_thread, 1);
-+			kthread_stop(conn->tx_thread);
-+		}
-+	} else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) {
-+		if (conn->rx_thread &&
-+		    cmpxchg(&conn->rx_thread_active, true, false)) {
-+			send_sig(SIGINT, conn->rx_thread, 1);
-+			kthread_stop(conn->rx_thread);
-+		}
-+	}
-+
-+	spin_lock(&iscsit_global->ts_bitmap_lock);
-+	bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+			      get_order(1));
-+	spin_unlock(&iscsit_global->ts_bitmap_lock);
- 
- 	iscsit_stop_timers_for_cmds(conn);
- 	iscsit_stop_nopin_response_timer(conn);
-@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession(
- 	struct iscsi_conn *conn)
- {
- 	struct iscsi_session *sess = conn->sess;
--
--	iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
--	iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
- 
- 	atomic_set(&conn->conn_logout_remove, 0);
- 	complete(&conn->conn_logout_comp);
- 
- 	iscsit_dec_conn_usage_count(conn);
--	iscsit_stop_session(sess, 1, 1);
-+	iscsit_stop_session(sess, sleep, sleep);
- 	iscsit_dec_session_usage_count(sess);
- 	target_put_session(sess->se_sess);
- }
-@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession(
- static void iscsit_logout_post_handler_samecid(
- 	struct iscsi_conn *conn)
- {
--	iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
--	iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
- 
- 	atomic_set(&conn->conn_logout_remove, 0);
- 	complete(&conn->conn_logout_comp);
- 
--	iscsit_cause_connection_reinstatement(conn, 1);
-+	iscsit_cause_connection_reinstatement(conn, sleep);
- 	iscsit_dec_conn_usage_count(conn);
- }
- 
-diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
-index 1d4a8c8..825b579 100644
---- a/drivers/target/iscsi/iscsi_target_core.h
-+++ b/drivers/target/iscsi/iscsi_target_core.h
-@@ -601,6 +601,11 @@ struct iscsi_conn {
- 	struct iscsi_session	*sess;
- 	/* Pointer to thread_set in use for this conn's threads */
- 	struct iscsi_thread_set	*thread_set;
-+	int			bitmap_id;
-+	int			rx_thread_active;
-+	struct task_struct	*rx_thread;
-+	int			tx_thread_active;
-+	struct task_struct	*tx_thread;
- 	/* list_head for session connection list */
- 	struct list_head	conn_list;
- } ____cacheline_aligned;
-@@ -869,10 +874,12 @@ struct iscsit_global {
- 	/* Unique identifier used for the authentication daemon */
- 	u32			auth_id;
- 	u32			inactive_ts;
-+#define ISCSIT_BITMAP_BITS	262144
- 	/* Thread Set bitmap count */
- 	int			ts_bitmap_count;
- 	/* Thread Set bitmap pointer */
- 	unsigned long		*ts_bitmap;
-+	spinlock_t		ts_bitmap_lock;
- 	/* Used for iSCSI discovery session authentication */
- 	struct iscsi_node_acl	discovery_acl;
- 	struct iscsi_portal_group	*discovery_tpg;
-diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
-index 0d1e6ee..7396d90 100644
---- a/drivers/target/iscsi/iscsi_target_erl0.c
-+++ b/drivers/target/iscsi/iscsi_target_erl0.c
-@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn)
- 	}
- 	spin_unlock_bh(&conn->state_lock);
- 
--	iscsi_thread_set_force_reinstatement(conn);
-+	if (conn->tx_thread && conn->tx_thread_active)
-+		send_sig(SIGINT, conn->tx_thread, 1);
-+	if (conn->rx_thread && conn->rx_thread_active)
-+		send_sig(SIGINT, conn->rx_thread, 1);
- 
- sleep:
- 	wait_for_completion(&conn->conn_wait_rcfr_comp);
-@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep)
- 		return;
- 	}
- 
--	if (iscsi_thread_set_force_reinstatement(conn) < 0) {
--		spin_unlock_bh(&conn->state_lock);
--		return;
--	}
-+	if (conn->tx_thread && conn->tx_thread_active)
-+		send_sig(SIGINT, conn->tx_thread, 1);
-+	if (conn->rx_thread && conn->rx_thread_active)
-+		send_sig(SIGINT, conn->rx_thread, 1);
- 
- 	atomic_set(&conn->connection_reinstatement, 1);
- 	if (!sleep) {
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index c5d3811..449df09 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
- 		iscsit_start_nopin_timer(conn);
- }
- 
-+int iscsit_start_kthreads(struct iscsi_conn *conn)
-+{
-+	int ret = 0;
-+
-+	spin_lock(&iscsit_global->ts_bitmap_lock);
-+	conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap,
-+					ISCSIT_BITMAP_BITS, get_order(1));
-+	spin_unlock(&iscsit_global->ts_bitmap_lock);
-+
-+	if (conn->bitmap_id < 0) {
-+		pr_err("bitmap_find_free_region() failed for"
-+		       " iscsit_start_kthreads()\n");
-+		return -ENOMEM;
-+	}
-+
-+	conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn,
-+				      "%s", ISCSI_TX_THREAD_NAME);
-+	if (IS_ERR(conn->tx_thread)) {
-+		pr_err("Unable to start iscsi_target_tx_thread\n");
-+		ret = PTR_ERR(conn->tx_thread);
-+		goto out_bitmap;
-+	}
-+	conn->tx_thread_active = true;
-+
-+	conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn,
-+				      "%s", ISCSI_RX_THREAD_NAME);
-+	if (IS_ERR(conn->rx_thread)) {
-+		pr_err("Unable to start iscsi_target_rx_thread\n");
-+		ret = PTR_ERR(conn->rx_thread);
-+		goto out_tx;
-+	}
-+	conn->rx_thread_active = true;
-+
-+	return 0;
-+out_tx:
-+	kthread_stop(conn->tx_thread);
-+	conn->tx_thread_active = false;
-+out_bitmap:
-+	spin_lock(&iscsit_global->ts_bitmap_lock);
-+	bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+			      get_order(1));
-+	spin_unlock(&iscsit_global->ts_bitmap_lock);
-+	return ret;
-+}
-+
- int iscsi_post_login_handler(
- 	struct iscsi_np *np,
- 	struct iscsi_conn *conn,
-@@ -691,7 +736,7 @@ int iscsi_post_login_handler(
- 	struct se_session *se_sess = sess->se_sess;
- 	struct iscsi_portal_group *tpg = sess->tpg;
- 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
--	struct iscsi_thread_set *ts;
-+	int rc;
- 
- 	iscsit_inc_conn_usage_count(conn);
- 
-@@ -706,7 +751,6 @@ int iscsi_post_login_handler(
- 	/*
- 	 * SCSI Initiator -> SCSI Target Port Mapping
- 	 */
--	ts = iscsi_get_thread_set();
- 	if (!zero_tsih) {
- 		iscsi_set_session_parameters(sess->sess_ops,
- 				conn->param_list, 0);
-@@ -733,9 +777,11 @@ int iscsi_post_login_handler(
- 			sess->sess_ops->InitiatorName);
- 		spin_unlock_bh(&sess->conn_lock);
- 
--		iscsi_post_login_start_timers(conn);
-+		rc = iscsit_start_kthreads(conn);
-+		if (rc)
-+			return rc;
- 
--		iscsi_activate_thread_set(conn, ts);
-+		iscsi_post_login_start_timers(conn);
- 		/*
- 		 * Determine CPU mask to ensure connection's RX and TX kthreads
- 		 * are scheduled on the same CPU.
-@@ -792,8 +838,11 @@ int iscsi_post_login_handler(
- 		" iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
- 	spin_unlock_bh(&se_tpg->session_lock);
- 
-+	rc = iscsit_start_kthreads(conn);
-+	if (rc)
-+		return rc;
-+
- 	iscsi_post_login_start_timers(conn);
--	iscsi_activate_thread_set(conn, ts);
- 	/*
- 	 * Determine CPU mask to ensure connection's RX and TX kthreads
- 	 * are scheduled on the same CPU.
-diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
-index ee52ab7..c501eba 100644
---- a/drivers/thermal/step_wise.c
-+++ b/drivers/thermal/step_wise.c
-@@ -76,7 +76,7 @@ static unsigned long get_target_state(struct thermal_instance *instance,
- 			next_target = instance->upper;
- 		break;
- 	case THERMAL_TREND_DROPPING:
--		if (cur_state == instance->lower) {
-+		if (cur_state <= instance->lower) {
- 			if (!throttle)
- 				next_target = THERMAL_NO_TARGET;
- 		} else {
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 45b7b96..8016aaa 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
- 	snoop(&urb->dev->dev, "urb complete\n");
- 	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
- 			as->status, COMPLETE, NULL, 0);
--	if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
-+	if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
- 		snoop_urb_data(urb, urb->actual_length);
- 
- 	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
-@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps)
- 	for (;;) {
- 		__set_current_state(TASK_INTERRUPTIBLE);
- 		as = async_getcompleted(ps);
--		if (as)
-+		if (as || !connected(ps))
- 			break;
- 		if (signal_pending(current))
- 			break;
-@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
- 	}
- 	if (signal_pending(current))
- 		return -EINTR;
--	return -EIO;
-+	return -ENODEV;
- }
- 
- static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
-@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
- 	struct async *as;
- 
- 	as = async_getcompleted(ps);
--	retval = -EAGAIN;
- 	if (as) {
- 		retval = processcompl(as, (void __user * __user *)arg);
- 		free_async(as);
-+	} else {
-+		retval = (connected(ps) ? -EAGAIN : -ENODEV);
- 	}
- 	return retval;
- }
-@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
- 	}
- 	if (signal_pending(current))
- 		return -EINTR;
--	return -EIO;
-+	return -ENODEV;
- }
- 
- static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
-@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
- 	int retval;
- 	struct async *as;
- 
--	retval = -EAGAIN;
- 	as = async_getcompleted(ps);
- 	if (as) {
- 		retval = processcompl_compat(as, (void __user * __user *)arg);
- 		free_async(as);
-+	} else {
-+		retval = (connected(ps) ? -EAGAIN : -ENODEV);
- 	}
- 	return retval;
- }
-@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg)
- {
- 	__u32 caps;
- 
--	caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM;
-+	caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
-+			USBDEVFS_CAP_REAP_AFTER_DISCONNECT;
- 	if (!ps->dev->bus->no_stop_on_short)
- 		caps |= USBDEVFS_CAP_BULK_CONTINUATION;
- 	if (ps->dev->bus->sg_tablesize)
-@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 		return -EPERM;
- 
- 	usb_lock_device(dev);
-+
-+	/* Reap operations are allowed even after disconnection */
-+	switch (cmd) {
-+	case USBDEVFS_REAPURB:
-+		snoop(&dev->dev, "%s: REAPURB\n", __func__);
-+		ret = proc_reapurb(ps, p);
-+		goto done;
-+
-+	case USBDEVFS_REAPURBNDELAY:
-+		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
-+		ret = proc_reapurbnonblock(ps, p);
-+		goto done;
-+
-+#ifdef CONFIG_COMPAT
-+	case USBDEVFS_REAPURB32:
-+		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
-+		ret = proc_reapurb_compat(ps, p);
-+		goto done;
-+
-+	case USBDEVFS_REAPURBNDELAY32:
-+		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
-+		ret = proc_reapurbnonblock_compat(ps, p);
-+		goto done;
-+#endif
-+	}
-+
- 	if (!connected(ps)) {
- 		usb_unlock_device(dev);
- 		return -ENODEV;
-@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 			inode->i_mtime = CURRENT_TIME;
- 		break;
- 
--	case USBDEVFS_REAPURB32:
--		snoop(&dev->dev, "%s: REAPURB32\n", __func__);
--		ret = proc_reapurb_compat(ps, p);
--		break;
--
--	case USBDEVFS_REAPURBNDELAY32:
--		snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
--		ret = proc_reapurbnonblock_compat(ps, p);
--		break;
--
- 	case USBDEVFS_IOCTL32:
- 		snoop(&dev->dev, "%s: IOCTL32\n", __func__);
- 		ret = proc_ioctl_compat(ps, ptr_to_compat(p));
-@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 		ret = proc_unlinkurb(ps, p);
- 		break;
- 
--	case USBDEVFS_REAPURB:
--		snoop(&dev->dev, "%s: REAPURB\n", __func__);
--		ret = proc_reapurb(ps, p);
--		break;
--
--	case USBDEVFS_REAPURBNDELAY:
--		snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
--		ret = proc_reapurbnonblock(ps, p);
--		break;
--
- 	case USBDEVFS_DISCSIGNAL:
- 		snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
- 		ret = proc_disconnectsignal(ps, p);
-@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- 		ret = proc_disconnect_claim(ps, p);
- 		break;
- 	}
-+
-+ done:
- 	usb_unlock_device(dev);
- 	if (ret >= 0)
- 		inode->i_atime = CURRENT_TIME;
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 0985ff7..a05fc58 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
- 		dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n");
- 		ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
- 		break;
-+	case USB_REQ_SET_INTERFACE:
-+		dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
-+		dwc->start_config_issued = false;
-+		/* Fall through */
- 	default:
- 		dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
- 		ret = dwc3_ep0_delegate_req(dwc, ctrl);
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 8f6738d..a57ad1f 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param)
- 		if (!(reg & DWC3_DGCMD_CMDACT)) {
- 			dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- 					DWC3_DGCMD_STATUS(reg));
-+			if (DWC3_DGCMD_STATUS(reg))
-+				return -EINVAL;
- 			return 0;
- 		}
- 
-@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- 		if (!(reg & DWC3_DEPCMD_CMDACT)) {
- 			dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- 					DWC3_DEPCMD_STATUS(reg));
-+			if (DWC3_DEPCMD_STATUS(reg))
-+				return -EINVAL;
- 			return 0;
- 		}
- 
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 9bce4f0..f8893b3 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 		/* Attempt to use the ring cache */
- 		if (virt_dev->num_rings_cached == 0)
- 			return -ENOMEM;
-+		virt_dev->num_rings_cached--;
- 		virt_dev->eps[ep_index].new_ring =
- 			virt_dev->ring_cache[virt_dev->num_rings_cached];
- 		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
--		virt_dev->num_rings_cached--;
- 		xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
- 					1, type);
- 	}
-diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
-index 0241a3a..1e9bde4 100644
---- a/drivers/usb/musb/musb_virthub.c
-+++ b/drivers/usb/musb/musb_virthub.c
-@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
- #ifdef CONFIG_USB_MUSB_HOST
- 	return 1;
- #else
--	if (musb->port_mode == MUSB_PORT_MODE_HOST)
--		return 1;
--	return musb->g.dev.driver != NULL;
-+	return musb->port_mode == MUSB_PORT_MODE_HOST;
- #endif
- }
- 
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 73c7292..d11335d 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
- 	{ USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
- 	{ USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
-+	{ USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
- 	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- 	{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
- 	{ USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 8b34841..096438e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
- 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- 	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
- 	{ } /* Terminating entry */
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 9a08e18..3d66e9c 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void)
- 	tty_unregister_driver(usb_serial_tty_driver);
- 	put_tty_driver(usb_serial_tty_driver);
- 	bus_unregister(&usb_serial_bus_type);
-+	idr_destroy(&serial_minors);
- }
- 
- 
-diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
-index 09cf013..90a6406 100644
---- a/drivers/watchdog/omap_wdt.c
-+++ b/drivers/watchdog/omap_wdt.c
-@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
- 
- 	pm_runtime_get_sync(wdev->dev);
- 
-+	/*
-+	 * Make sure the watchdog is disabled. This is unfortunately required
-+	 * because writing to various registers with the watchdog running has no
-+	 * effect.
-+	 */
-+	omap_wdt_disable(wdev);
-+
- 	/* initialize prescaler */
- 	while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
- 		cpu_relax();
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index bb7991c..bfdeadb 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
- 	unlock_new_inode(inode);
- 	return inode;
- error:
--	unlock_new_inode(inode);
--	iput(inode);
-+	iget_failed(inode);
- 	return ERR_PTR(retval);
- 
- }
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
-index 59dc8e8..de8606c 100644
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
- 	unlock_new_inode(inode);
- 	return inode;
- error:
--	unlock_new_inode(inode);
--	iput(inode);
-+	iget_failed(inode);
- 	return ERR_PTR(retval);
- 
- }
-diff --git a/fs/bio.c b/fs/bio.c
-index 8754e7b..b2b1451 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
-  * Allocates and returns a new bio which represents @sectors from the start of
-  * @bio, and updates @bio to represent the remaining sectors.
-  *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
-  */
- struct bio *bio_split(struct bio *bio, int sectors,
- 		      gfp_t gfp, struct bio_set *bs)
-@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- 	BUG_ON(sectors <= 0);
- 	BUG_ON(sectors >= bio_sectors(bio));
- 
--	split = bio_clone_fast(bio, gfp, bs);
-+	/*
-+	 * Discards need a mutable bio_vec to accommodate the payload
-+	 * required by the DSM TRIM and UNMAP commands.
-+	 */
-+	if (bio->bi_rw & REQ_DISCARD)
-+		split = bio_clone_bioset(bio, gfp, bs);
-+	else
-+		split = bio_clone_fast(bio, gfp, bs);
-+
- 	if (!split)
- 		return NULL;
- 
-diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
-index ab485e5..644942a 100644
---- a/fs/btrfs/inode-map.c
-+++ b/fs/btrfs/inode-map.c
-@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- 		__btrfs_add_free_space(ctl, info->offset, count);
- free:
- 		rb_erase(&info->offset_index, rbroot);
--		kfree(info);
-+		kmem_cache_free(btrfs_free_space_cachep, info);
- 	}
- }
- 
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 3e16042..d40ae42 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -2743,7 +2743,7 @@ out_unlock:
- static long btrfs_ioctl_file_extent_same(struct file *file,
- 			struct btrfs_ioctl_same_args __user *argp)
- {
--	struct btrfs_ioctl_same_args *same;
-+	struct btrfs_ioctl_same_args *same = NULL;
- 	struct btrfs_ioctl_same_extent_info *info;
- 	struct inode *src = file_inode(file);
- 	u64 off;
-@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
- 
- 	if (IS_ERR(same)) {
- 		ret = PTR_ERR(same);
-+		same = NULL;
- 		goto out;
- 	}
- 
-@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
- 
- out:
- 	mnt_drop_write_file(file);
-+	kfree(same);
- 	return ret;
- }
- 
-diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
-index e6574d7..a7c5277 100644
---- a/fs/ext4/indirect.c
-+++ b/fs/ext4/indirect.c
-@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
- 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
- 		EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
- 				 "non-extent mapped inodes with bigalloc");
--		return -ENOSPC;
-+		return -EUCLEAN;
- 	}
- 
- 	goal = ext4_find_goal(inode, map->m_lblk, partial);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index da03340..f9c63ae 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page,
- 					     unsigned int offset,
- 					     unsigned int length)
- {
--	int to_release = 0;
-+	int to_release = 0, contiguous_blks = 0;
- 	struct buffer_head *head, *bh;
- 	unsigned int curr_off = 0;
- 	struct inode *inode = page->mapping->host;
-@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page,
- 
- 		if ((offset <= curr_off) && (buffer_delay(bh))) {
- 			to_release++;
-+			contiguous_blks++;
- 			clear_buffer_delay(bh);
-+		} else if (contiguous_blks) {
-+			lblk = page->index <<
-+			       (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+			lblk += (curr_off >> inode->i_blkbits) -
-+				contiguous_blks;
-+			ext4_es_remove_extent(inode, lblk, contiguous_blks);
-+			contiguous_blks = 0;
- 		}
- 		curr_off = next_off;
- 	} while ((bh = bh->b_this_page) != head);
- 
--	if (to_release) {
-+	if (contiguous_blks) {
- 		lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
--		ext4_es_remove_extent(inode, lblk, to_release);
-+		lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
-+		ext4_es_remove_extent(inode, lblk, contiguous_blks);
- 	}
- 
- 	/* If we have released all the blocks belonging to a cluster, then we
-@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page,
- 		ext4_walk_page_buffers(handle, page_bufs, 0, len,
- 				       NULL, bget_one);
- 	}
--	/* As soon as we unlock the page, it can go away, but we have
--	 * references to buffers so we are safe */
-+	/*
-+	 * We need to release the page lock before we start the
-+	 * journal, so grab a reference so the page won't disappear
-+	 * out from under us.
-+	 */
-+	get_page(page);
- 	unlock_page(page);
- 
- 	handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
- 				    ext4_writepage_trans_blocks(inode));
- 	if (IS_ERR(handle)) {
- 		ret = PTR_ERR(handle);
--		goto out;
-+		put_page(page);
-+		goto out_no_pagelock;
- 	}
--
- 	BUG_ON(!ext4_handle_valid(handle));
- 
-+	lock_page(page);
-+	put_page(page);
-+	if (page->mapping != mapping) {
-+		/* The page got truncated from under us */
-+		ext4_journal_stop(handle);
-+		ret = 0;
-+		goto out;
-+	}
-+
- 	if (inline_data) {
- 		ret = ext4_journal_get_write_access(handle, inode_bh);
- 
-@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page,
- 				       NULL, bput_one);
- 	ext4_set_inode_state(inode, EXT4_STATE_JDATA);
- out:
-+	unlock_page(page);
-+out_no_pagelock:
- 	brelse(inode_bh);
- 	return ret;
- }
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 7620133..c4a5e4d 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4793,18 +4793,12 @@ do_more:
- 		/*
- 		 * blocks being freed are metadata. these blocks shouldn't
- 		 * be used until this transaction is committed
-+		 *
-+		 * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
-+		 * to fail.
- 		 */
--	retry:
--		new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
--		if (!new_entry) {
--			/*
--			 * We use a retry loop because
--			 * ext4_free_blocks() is not allowed to fail.
--			 */
--			cond_resched();
--			congestion_wait(BLK_RW_ASYNC, HZ/50);
--			goto retry;
--		}
-+		new_entry = kmem_cache_alloc(ext4_free_data_cachep,
-+				GFP_NOFS|__GFP_NOFAIL);
- 		new_entry->efd_start_cluster = bit;
- 		new_entry->efd_group = block_group;
- 		new_entry->efd_count = count_clusters;
-diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
-index 2ae73a8..be92ed2 100644
---- a/fs/ext4/migrate.c
-+++ b/fs/ext4/migrate.c
-@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode)
- 	struct ext4_inode_info		*ei = EXT4_I(inode);
- 	struct ext4_extent		*ex;
- 	unsigned int			i, len;
-+	ext4_lblk_t			start, end;
- 	ext4_fsblk_t			blk;
- 	handle_t			*handle;
- 	int				ret;
-@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode)
- 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC))
- 		return -EOPNOTSUPP;
- 
-+	/*
-+	 * In order to get correct extent info, force all delayed allocation
-+	 * blocks to be allocated, otherwise delayed allocation blocks may not
-+	 * be reflected and bypass the checks on extent header.
-+	 */
-+	if (test_opt(inode->i_sb, DELALLOC))
-+		ext4_alloc_da_blocks(inode);
-+
- 	handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
- 	if (IS_ERR(handle))
- 		return PTR_ERR(handle);
-@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode)
- 		goto errout;
- 	}
- 	if (eh->eh_entries == 0)
--		blk = len = 0;
-+		blk = len = start = end = 0;
- 	else {
- 		len = le16_to_cpu(ex->ee_len);
- 		blk = ext4_ext_pblock(ex);
--		if (len > EXT4_NDIR_BLOCKS) {
-+		start = le32_to_cpu(ex->ee_block);
-+		end = start + len - 1;
-+		if (end >= EXT4_NDIR_BLOCKS) {
- 			ret = -EOPNOTSUPP;
- 			goto errout;
- 		}
-@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode)
- 
- 	ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
- 	memset(ei->i_data, 0, sizeof(ei->i_data));
--	for (i=0; i < len; i++)
-+	for (i = start; i <= end; i++)
- 		ei->i_data[i] = cpu_to_le32(blk++);
- 	ext4_mark_inode_dirty(handle, inode);
- errout:
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 9fb3e6c..a07af5b 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb)
- 		dump_orphan_list(sb, sbi);
- 	J_ASSERT(list_empty(&sbi->s_orphan));
- 
-+	sync_blockdev(sb->s_bdev);
- 	invalidate_bdev(sb->s_bdev);
- 	if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
- 		/*
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 73f6bcb..faf00af 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- 		goto err_fput;
- 
- 	fuse_conn_init(fc);
-+	fc->release = fuse_free_conn;
- 
- 	fc->dev = sb->s_dev;
- 	fc->sb = sb;
-@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- 		fc->dont_mask = 1;
- 	sb->s_flags |= MS_POSIXACL;
- 
--	fc->release = fuse_free_conn;
- 	fc->flags = d.flags;
- 	fc->user_id = d.user_id;
- 	fc->group_id = d.group_id;
-diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index 4534ff6..77b583d 100644
---- a/fs/hpfs/super.c
-+++ b/fs/hpfs/super.c
-@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
- }
- 
- /* Filesystem error... */
--static char err_buf[1024];
--
- void hpfs_error(struct super_block *s, const char *fmt, ...)
- {
-+	struct va_format vaf;
- 	va_list args;
- 
- 	va_start(args, fmt);
--	vsnprintf(err_buf, sizeof(err_buf), fmt, args);
-+
-+	vaf.fmt = fmt;
-+	vaf.va = &args;
-+
-+	pr_err("filesystem error: %pV", &vaf);
-+
- 	va_end(args);
- 
--	printk("HPFS: filesystem error: %s", err_buf);
- 	if (!hpfs_sb(s)->sb_was_error) {
- 		if (hpfs_sb(s)->sb_err == 2) {
- 			printk("; crashing the system because you wanted it\n");
-diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
-index 7f34f47..b892355 100644
---- a/fs/jbd2/checkpoint.c
-+++ b/fs/jbd2/checkpoint.c
-@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- 	unsigned long	blocknr;
- 
- 	if (is_journal_aborted(journal))
--		return 1;
-+		return -EIO;
- 
- 	if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
- 		return 1;
-@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- 	 * jbd2_cleanup_journal_tail() doesn't get called all that often.
- 	 */
- 	if (journal->j_flags & JBD2_BARRIER)
--		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
- 
--	__jbd2_update_log_tail(journal, first_tid, blocknr);
--	return 0;
-+	return __jbd2_update_log_tail(journal, first_tid, blocknr);
- }
- 
- 
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index f2d78a3..e8d62d7 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
-  *
-  * Requires j_checkpoint_mutex
-  */
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- {
- 	unsigned long freed;
-+	int ret;
- 
- 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- 
-@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- 	 * space and if we lose sb update during power failure we'd replay
- 	 * old transaction with possibly newly overwritten data.
- 	 */
--	jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+	ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+	if (ret)
-+		goto out;
-+
- 	write_lock(&journal->j_state_lock);
- 	freed = block - journal->j_tail;
- 	if (block < journal->j_tail)
-@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- 	journal->j_tail_sequence = tid;
- 	journal->j_tail = block;
- 	write_unlock(&journal->j_state_lock);
-+
-+out:
-+	return ret;
- }
- 
- /*
-@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
- 	return jbd2_journal_start_thread(journal);
- }
- 
--static void jbd2_write_superblock(journal_t *journal, int write_op)
-+static int jbd2_write_superblock(journal_t *journal, int write_op)
- {
- 	struct buffer_head *bh = journal->j_sb_buffer;
- 	journal_superblock_t *sb = journal->j_superblock;
-@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- 		printk(KERN_ERR "JBD2: Error %d detected when updating "
- 		       "journal superblock for %s.\n", ret,
- 		       journal->j_devname);
-+		jbd2_journal_abort(journal, ret);
- 	}
-+
-+	return ret;
- }
- 
- /**
-@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
-  * Update a journal's superblock information about log tail and write it to
-  * disk, waiting for the IO to complete.
-  */
--void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
-+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- 				     unsigned long tail_block, int write_op)
- {
- 	journal_superblock_t *sb = journal->j_superblock;
-+	int ret;
- 
- 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- 	jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
-@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- 	sb->s_sequence = cpu_to_be32(tail_tid);
- 	sb->s_start    = cpu_to_be32(tail_block);
- 
--	jbd2_write_superblock(journal, write_op);
-+	ret = jbd2_write_superblock(journal, write_op);
-+	if (ret)
-+		goto out;
- 
- 	/* Log is no longer empty */
- 	write_lock(&journal->j_state_lock);
- 	WARN_ON(!sb->s_sequence);
- 	journal->j_flags &= ~JBD2_FLUSHED;
- 	write_unlock(&journal->j_state_lock);
-+
-+out:
-+	return ret;
- }
- 
- /**
-@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal)
- 		return -EIO;
- 
- 	mutex_lock(&journal->j_checkpoint_mutex);
--	jbd2_cleanup_journal_tail(journal);
-+	if (!err) {
-+		err = jbd2_cleanup_journal_tail(journal);
-+		if (err < 0) {
-+			mutex_unlock(&journal->j_checkpoint_mutex);
-+			goto out;
-+		}
-+		err = 0;
-+	}
- 
- 	/* Finally, mark the journal as really needing no recovery.
- 	 * This sets s_start==0 in the underlying superblock, which is
-@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal)
- 	J_ASSERT(journal->j_head == journal->j_tail);
- 	J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
- 	write_unlock(&journal->j_state_lock);
--	return 0;
-+out:
-+	return err;
- }
- 
- /**
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index fa6d721..4495cad 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
- 	if (args->npages != 0)
- 		xdr_write_pages(xdr, args->pages, 0, args->len);
- 	else
--		xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
-+		xdr_reserve_space(xdr, args->len);
- 
- 	error = nfsacl_encode(xdr->buf, base, args->inode,
- 			    (args->mask & NFS_ACL) ?
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index b4f177f..c402b67 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1482,6 +1482,8 @@ restart:
- 					spin_unlock(&state->state_lock);
- 				}
- 				nfs4_put_open_state(state);
-+				clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
-+					&state->flags);
- 				spin_lock(&sp->so_lock);
- 				goto restart;
- 			}
-diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
-index 14e58f2..98d4948 100644
---- a/fs/xfs/xfs_symlink.c
-+++ b/fs/xfs/xfs_symlink.c
-@@ -102,7 +102,7 @@ xfs_readlink_bmap(
- 			cur_chunk += sizeof(struct xfs_dsymlink_hdr);
- 		}
- 
--		memcpy(link + offset, bp->b_addr, byte_cnt);
-+		memcpy(link + offset, cur_chunk, byte_cnt);
- 
- 		pathlen -= byte_cnt;
- 		offset += byte_cnt;
-diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
-index 8fc12f8..69afb57 100644
---- a/include/acpi/actypes.h
-+++ b/include/acpi/actypes.h
-@@ -561,6 +561,7 @@ typedef u64 acpi_integer;
- #define ACPI_NO_ACPI_ENABLE             0x10
- #define ACPI_NO_DEVICE_INIT             0x20
- #define ACPI_NO_OBJECT_INIT             0x40
-+#define ACPI_NO_FACS_INIT               0x80
- 
- /*
-  * Initialization state
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index cd80aa8..77af621 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
- #define ACPI_OST_SC_INSERT_NOT_SUPPORTED	0x82
- 
- extern void acpi_early_init(void);
-+extern void acpi_subsystem_init(void);
- 
- extern int acpi_nvs_register(__u64 start, __u64 size);
- 
-@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev)
- }
- 
- static inline void acpi_early_init(void) { }
-+static inline void acpi_subsystem_init(void) { }
- 
- static inline int early_acpi_boot_init(void)
- {
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 0dae71e..e1fb0f6 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
- int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
- int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- 			      unsigned long *block);
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- 
- /* Commit management */
-@@ -1157,7 +1157,7 @@ extern int	   jbd2_journal_recover    (journal_t *journal);
- extern int	   jbd2_journal_wipe       (journal_t *, int);
- extern int	   jbd2_journal_skip_recovery	(journal_t *);
- extern void	   jbd2_journal_update_sb_errno(journal_t *);
--extern void	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
-+extern int	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
- 				unsigned long, int);
- extern void	   __jbd2_journal_abort_hard	(journal_t *);
- extern void	   jbd2_journal_abort      (journal_t *, int);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index b84e786..189c9ff 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -428,6 +428,7 @@ enum {
- 	ATA_HORKAGE_NO_NCQ_TRIM	= (1 << 19),	/* don't use queued TRIM */
- 	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
- 	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
-+	ATA_HORKAGE_NOTRIM = (1 << 24),		/* don't use TRIM */
- 
- 	 /* DMA mask for user DMA control: User visible values; DO NOT
- 	    renumber */
-diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
-index 53988cb..3a36a2c 100644
---- a/include/linux/nfs_xdr.h
-+++ b/include/linux/nfs_xdr.h
-@@ -1155,7 +1155,7 @@ struct nfs41_state_protection {
- 	struct nfs4_op_map allow;
- };
- 
--#define NFS4_EXCHANGE_ID_LEN	(48)
-+#define NFS4_EXCHANGE_ID_LEN	(127)
- struct nfs41_exchange_id_args {
- 	struct nfs_client		*client;
- 	nfs4_verifier			*verifier;
-diff --git a/include/linux/of.h b/include/linux/of.h
-index 3f8144d..9f2698d 100644
---- a/include/linux/of.h
-+++ b/include/linux/of.h
-@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop,
- #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
- extern int of_node_to_nid(struct device_node *np);
- #else
--static inline int of_node_to_nid(struct device_node *device) { return 0; }
-+static inline int of_node_to_nid(struct device_node *device)
-+{
-+	return NUMA_NO_NODE;
-+}
- #endif
- 
- static inline struct device_node *of_find_matching_node(
-diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h
-index 0c65e4b..ef29266 100644
---- a/include/uapi/linux/usbdevice_fs.h
-+++ b/include/uapi/linux/usbdevice_fs.h
-@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo {
- 	char port [127];	/* e.g. port 3 connects to device 27 */
- };
- 
--/* Device capability flags */
-+/* System and bus capability flags */
- #define USBDEVFS_CAP_ZERO_PACKET		0x01
- #define USBDEVFS_CAP_BULK_CONTINUATION		0x02
- #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM		0x04
- #define USBDEVFS_CAP_BULK_SCATTER_GATHER	0x08
-+#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT	0x10
- 
- /* USBDEVFS_DISCONNECT_CLAIM flags & struct */
- 
-diff --git a/init/main.c b/init/main.c
-index 58c132d..008edce 100644
---- a/init/main.c
-+++ b/init/main.c
-@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void)
- 
- 	check_bugs();
- 
-+	acpi_subsystem_init();
- 	sfi_init_late();
- 
- 	if (efi_enabled(EFI_RUNTIME_SERVICES)) {
-diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
-index 1ef0606..0296d6f 100644
---- a/kernel/irq/devres.c
-+++ b/kernel/irq/devres.c
-@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- 		return -ENOMEM;
- 
- 	rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
--	if (rc) {
-+	if (rc < 0) {
- 		devres_free(dr);
- 		return rc;
- 	}
-@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- 	dr->dev_id = dev_id;
- 	devres_add(dev, dr);
- 
--	return 0;
-+	return rc;
- }
- EXPORT_SYMBOL(devm_request_any_context_irq);
- 
-diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 2fac9cc..9d18628 100644
---- a/kernel/power/Kconfig
-+++ b/kernel/power/Kconfig
-@@ -191,7 +191,7 @@ config DPM_WATCHDOG
- config DPM_WATCHDOG_TIMEOUT
- 	int "Watchdog timeout in seconds"
- 	range 1 120
--	default 12
-+	default 60
- 	depends on DPM_WATCHDOG
- 
- config PM_TRACE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index a755ad7..02e7fb4 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file)
- 	 * already done the capabilities checks at open time.
- 	 */
- 	if (from_file && type != SYSLOG_ACTION_OPEN)
--		return 0;
-+		goto ok;
- 
- 	if (syslog_action_restricted(type)) {
- 		if (capable(CAP_SYSLOG))
--			return 0;
-+			goto ok;
- 		/*
- 		 * For historical reasons, accept CAP_SYS_ADMIN too, with
- 		 * a warning.
-@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file)
- 				     "CAP_SYS_ADMIN but no CAP_SYSLOG "
- 				     "(deprecated).\n",
- 				 current->comm, task_pid_nr(current));
--			return 0;
-+			goto ok;
- 		}
- 		return -EPERM;
- 	}
-+ok:
- 	return security_syslog(type);
- }
- 
-@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
- 	if (error)
- 		goto out;
- 
--	error = security_syslog(type);
--	if (error)
--		return error;
--
- 	switch (type) {
- 	case SYSLOG_ACTION_CLOSE:	/* Close log */
- 		break;
-diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
-index 1254f31..ae359f0 100644
---- a/kernel/rcu/tiny.c
-+++ b/kernel/rcu/tiny.c
-@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
- 
- 	/* Move the ready-to-invoke callbacks to a local list. */
- 	local_irq_save(flags);
-+	if (rcp->donetail == &rcp->rcucblist) {
-+		/* No callbacks ready, so just leave. */
-+		local_irq_restore(flags);
-+		return;
-+	}
- 	RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
- 	list = rcp->rcucblist;
- 	rcp->rcucblist = *rcp->donetail;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index c8bd809..c1be95c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -422,6 +422,7 @@ enum {
- 
- 	TRACE_CONTROL_BIT,
- 
-+	TRACE_BRANCH_BIT,
- /*
-  * Abuse of the trace_recursion.
-  * As we need a way to maintain state if we are tracing the function
-diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
-index 697fb9b..60850b4 100644
---- a/kernel/trace/trace_branch.c
-+++ b/kernel/trace/trace_branch.c
-@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 	struct trace_branch *entry;
- 	struct ring_buffer *buffer;
- 	unsigned long flags;
--	int cpu, pc;
-+	int pc;
- 	const char *p;
- 
-+	if (current->trace_recursion & TRACE_BRANCH_BIT)
-+		return;
-+
- 	/*
- 	 * I would love to save just the ftrace_likely_data pointer, but
- 	 * this code can also be used by modules. Ugly things can happen
-@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 	if (unlikely(!tr))
- 		return;
- 
--	local_irq_save(flags);
--	cpu = raw_smp_processor_id();
--	data = per_cpu_ptr(tr->trace_buffer.data, cpu);
--	if (atomic_inc_return(&data->disabled) != 1)
-+	raw_local_irq_save(flags);
-+	current->trace_recursion |= TRACE_BRANCH_BIT;
-+	data = this_cpu_ptr(tr->trace_buffer.data);
-+	if (atomic_read(&data->disabled))
- 		goto out;
- 
- 	pc = preempt_count();
-@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 		__buffer_unlock_commit(buffer, event);
- 
-  out:
--	atomic_dec(&data->disabled);
--	local_irq_restore(flags);
-+	current->trace_recursion &= ~TRACE_BRANCH_BIT;
-+	raw_local_irq_restore(flags);
- }
- 
- static inline
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index cb347e8..7b244d0 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps,
- 
- static char infix_next(struct filter_parse_state *ps)
- {
-+	if (!ps->infix.cnt)
-+		return 0;
-+
- 	ps->infix.cnt--;
- 
- 	return ps->infix.string[ps->infix.tail++];
-@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps)
- 
- static void infix_advance(struct filter_parse_state *ps)
- {
-+	if (!ps->infix.cnt)
-+		return;
-+
- 	ps->infix.cnt--;
- 	ps->infix.tail++;
- }
-@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps)
- 			continue;
- 		}
- 		n_normal_preds++;
--		WARN_ON_ONCE(cnt < 0);
-+		/* all ops should have operands */
-+		if (cnt < 0)
-+			break;
- 	}
- 
- 	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index e5c4ebe..c0634aa 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 	unsigned a, b;
- 	int c, old_c, totaldigits;
- 	const char __user __force *ubuf = (const char __user __force *)buf;
--	int exp_digit, in_range;
-+	int at_start, in_range;
- 
- 	totaldigits = c = 0;
- 	bitmap_zero(maskp, nmaskbits);
- 	do {
--		exp_digit = 1;
-+		at_start = 1;
- 		in_range = 0;
- 		a = b = 0;
- 
-@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 				break;
- 
- 			if (c == '-') {
--				if (exp_digit || in_range)
-+				if (at_start || in_range)
- 					return -EINVAL;
- 				b = 0;
- 				in_range = 1;
--				exp_digit = 1;
- 				continue;
- 			}
- 
-@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 			b = b * 10 + (c - '0');
- 			if (!in_range)
- 				a = b;
--			exp_digit = 0;
-+			at_start = 0;
- 			totaldigits++;
- 		}
- 		if (!(a <= b))
- 			return -EINVAL;
- 		if (b >= nmaskbits)
- 			return -ERANGE;
--		while (a <= b) {
--			set_bit(a, maskp);
--			a++;
-+		if (!at_start) {
-+			while (a <= b) {
-+				set_bit(a, maskp);
-+				a++;
-+			}
- 		}
- 	} while (buflen && c == ',');
- 	return 0;
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 9186550..08046f3 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
- 	if (err < 0) {
- 		if (err == -EIO)
- 			c->status = Disconnected;
--		goto reterr;
-+		if (err != -ERESTARTSYS)
-+			goto reterr;
- 	}
- 	if (req->status == REQ_STATUS_ERROR) {
- 		p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
-diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
-index aade4a5..bde94d8 100644
---- a/net/ceph/osdmap.c
-+++ b/net/ceph/osdmap.c
-@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
- {
- 	int j;
- 	dout("crush_decode_tree_bucket %p to %p\n", *p, end);
--	ceph_decode_32_safe(p, end, b->num_nodes, bad);
-+	ceph_decode_8_safe(p, end, b->num_nodes, bad);
- 	b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
- 	if (b->node_weights == NULL)
- 		return -ENOMEM;
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index c7a7a86..9e58c99 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
- {
- 	struct ieee80211_local *local =
- 		container_of(work, struct ieee80211_local, restart_work);
-+	struct ieee80211_sub_if_data *sdata;
- 
- 	/* wait for scan work complete */
- 	flush_workqueue(local->workqueue);
-@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work)
- 	     "%s called with hardware scan in progress\n", __func__);
- 
- 	rtnl_lock();
-+	list_for_each_entry(sdata, &local->interfaces, list)
-+		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
- 	ieee80211_scan_cancel(local);
- 	ieee80211_reconfig(local);
- 	rtnl_unlock();
-diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
-index e860d4f..ab21968 100644
---- a/net/sunrpc/backchannel_rqst.c
-+++ b/net/sunrpc/backchannel_rqst.c
-@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
- 
- 	dprintk("RPC:        free allocations for req= %p\n", req);
- 	WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
--	xbufp = &req->rq_private_buf;
-+	xbufp = &req->rq_rcv_buf;
- 	free_page((unsigned long)xbufp->head[0].iov_base);
- 	xbufp = &req->rq_snd_buf;
- 	free_page((unsigned long)xbufp->head[0].iov_base);
-diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
-index 7e71e06..048550a 100644
---- a/security/integrity/evm/evm_main.c
-+++ b/security/integrity/evm/evm_main.c
-@@ -20,6 +20,7 @@
- #include <linux/xattr.h>
- #include <linux/integrity.h>
- #include <linux/evm.h>
-+#include <linux/magic.h>
- #include <crypto/hash.h>
- #include "evm.h"
- 
-@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
- 		iint = integrity_iint_find(dentry->d_inode);
- 		if (iint && (iint->flags & IMA_NEW_FILE))
- 			return 0;
-+
-+		/* exception for pseudo filesystems */
-+		if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
-+		    || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
-+			return 0;
-+
-+		integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
-+				    dentry->d_inode, dentry->d_name.name,
-+				    "update_metadata",
-+				    integrity_status_msg[evm_status],
-+				    -EPERM, 0);
- 	}
- out:
- 	if (evm_status != INTEGRITY_PASS)
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index f79fa8b..5cb7de9 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- 		       const char *op, const char *cause);
- int ima_init_crypto(void);
- void ima_putc(struct seq_file *m, void *data, int datalen);
--void ima_print_digest(struct seq_file *m, u8 *digest, int size);
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
- struct ima_template_desc *ima_template_desc_current(void);
- int ima_init_template(void);
- 
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 468a3ba..35f3c90 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = {
- 	.release = seq_release,
- };
- 
--void ima_print_digest(struct seq_file *m, u8 *digest, int size)
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
- {
--	int i;
-+	u32 i;
- 
- 	for (i = 0; i < size; i++)
- 		seq_printf(m, "%02x", *(digest + i));
-diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
-index e8592e7..dcf77b7 100644
---- a/security/integrity/ima/ima_template_lib.c
-+++ b/security/integrity/ima/ima_template_lib.c
-@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
- 					 enum data_formats datafmt,
- 					 struct ima_field_data *field_data)
- {
--	u8 *buf_ptr = field_data->data, buflen = field_data->len;
-+	u8 *buf_ptr = field_data->data;
-+	u32 buflen = field_data->len;
- 
- 	switch (datafmt) {
- 	case DATA_FMT_DIGEST_WITH_ALGO:
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index 2fb2576..04d0d7c 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring,
- 	if (index_key->type == &key_type_keyring)
- 		up_write(&keyring_serialise_link_sem);
- 
--	if (edit && !edit->dead_leaf) {
--		key_payload_reserve(keyring,
--				    keyring->datalen - KEYQUOTA_LINK_BYTES);
-+	if (edit) {
-+		if (!edit->dead_leaf) {
-+			key_payload_reserve(keyring,
-+				keyring->datalen - KEYQUOTA_LINK_BYTES);
-+		}
- 		assoc_array_cancel_edit(edit);
- 	}
- 	up_write(&keyring->sem);
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index ba17522..2f503c0 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -3955,6 +3955,7 @@ enum {
- 	ALC269_FIXUP_LIFEBOOK,
- 	ALC269_FIXUP_LIFEBOOK_EXTMIC,
- 	ALC269_FIXUP_LIFEBOOK_HP_PIN,
-+	ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
- 	ALC269_FIXUP_AMIC,
- 	ALC269_FIXUP_DMIC,
- 	ALC269VB_FIXUP_AMIC,
-@@ -3973,6 +3974,7 @@ enum {
- 	ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
- 	ALC269_FIXUP_HEADSET_MODE,
- 	ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
-+	ALC269_FIXUP_ASPIRE_HEADSET_MIC,
- 	ALC269_FIXUP_ASUS_X101_FUNC,
- 	ALC269_FIXUP_ASUS_X101_VERB,
- 	ALC269_FIXUP_ASUS_X101,
-@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = {
- 			{ }
- 		},
- 	},
-+	[ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = {
-+		.type = HDA_FIXUP_FUNC,
-+		.v.func = alc269_fixup_pincfg_no_hp_to_lineout,
-+	},
- 	[ALC269_FIXUP_AMIC] = {
- 		.type = HDA_FIXUP_PINS,
- 		.v.pins = (const struct hda_pintbl[]) {
-@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = {
- 		.type = HDA_FIXUP_FUNC,
- 		.v.func = alc_fixup_headset_mode_no_hp_mic,
- 	},
-+	[ALC269_FIXUP_ASPIRE_HEADSET_MIC] = {
-+		.type = HDA_FIXUP_PINS,
-+		.v.pins = (const struct hda_pintbl[]) {
-+			{ 0x19, 0x01a1913c }, /* headset mic w/o jack detect */
-+			{ }
-+		},
-+		.chained = true,
-+		.chain_id = ALC269_FIXUP_HEADSET_MODE,
-+	},
- 	[ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
- 		.type = HDA_FIXUP_PINS,
- 		.v.pins = (const struct hda_pintbl[]) {
-@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
- 	SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
-+	SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
-+	SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
- 	SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
- 	SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
- 	SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
-@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
- 	SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
- 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
-+	SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
- 	SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- 	SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- 	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index ce9c8e1..fbee45c 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -41,7 +41,7 @@ struct wm5102_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- static const struct wm_adsp_region wm5102_dsp1_regions[] = {
-diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
-index 2c3c962..0fce853 100644
---- a/sound/soc/codecs/wm5110.c
-+++ b/sound/soc/codecs/wm5110.c
-@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- #define WM5110_NG_SRC(name, base) \
-diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
-index 2f167a8..62bacb8 100644
---- a/sound/soc/codecs/wm8737.c
-+++ b/sound/soc/codecs/wm8737.c
-@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
- 
- 			/* Fast VMID ramp at 2*2.5k */
- 			snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
--					    WM8737_VMIDSEL_MASK, 0x4);
-+					    WM8737_VMIDSEL_MASK,
-+					    2 << WM8737_VMIDSEL_SHIFT);
- 
- 			/* Bring VMID up */
- 			snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
-@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
- 
- 		/* VMID at 2*300k */
- 		snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
--				    WM8737_VMIDSEL_MASK, 2);
-+				    WM8737_VMIDSEL_MASK,
-+				    1 << WM8737_VMIDSEL_SHIFT);
- 
- 		break;
- 
-diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
-index db94931..0bb4a64 100644
---- a/sound/soc/codecs/wm8903.h
-+++ b/sound/soc/codecs/wm8903.h
-@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
- #define WM8903_VMID_BUF_ENA_WIDTH                    1  /* VMID_BUF_ENA */
- 
- #define WM8903_VMID_RES_50K                          2
--#define WM8903_VMID_RES_250K                         3
-+#define WM8903_VMID_RES_250K                         4
- #define WM8903_VMID_RES_5K                           6
- 
- /*
-diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
-index 1c1fc61..475fc24 100644
---- a/sound/soc/codecs/wm8955.c
-+++ b/sound/soc/codecs/wm8955.c
-@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
- 		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
- 				    WM8955_K_17_9_MASK,
- 				    (pll.k >> 9) & WM8955_K_17_9_MASK);
--		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
-+		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
- 				    WM8955_K_8_0_MASK,
- 				    pll.k & WM8955_K_8_0_MASK);
- 		if (pll.k)
-diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
-index edfd4ed..e04dbaa 100644
---- a/sound/soc/codecs/wm8960.c
-+++ b/sound/soc/codecs/wm8960.c
-@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
- SOC_ENUM("ADC Polarity", wm8960_enum[0]),
- SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
- 
--SOC_ENUM("DAC Polarity", wm8960_enum[2]),
-+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
- SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
- 		    wm8960_get_deemph, wm8960_put_deemph),
- 
-diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
-index 555115e..1461ae61 100644
---- a/sound/soc/codecs/wm8997.c
-+++ b/sound/soc/codecs/wm8997.c
-@@ -40,7 +40,7 @@ struct wm8997_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- static const struct reg_default wm8997_sysclk_reva_patch[] = {
-diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
-index 3a3d17c..6644525 100644
---- a/sound/soc/fsl/imx-wm8962.c
-+++ b/sound/soc/fsl/imx-wm8962.c
-@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
- 		dev_err(&pdev->dev, "audmux internal port setup failed\n");
- 		return ret;
- 	}
--	imx_audmux_v2_configure_port(ext_port,
-+	ret = imx_audmux_v2_configure_port(ext_port,
- 			IMX_AUDMUX_V2_PTCR_SYN,
- 			IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
- 	if (ret) {
diff --git a/3.14.49/0000_README b/3.14.50/0000_README
index eb9a47e..5416cb6 100644
--- a/3.14.49/0000_README
+++ b/3.14.50/0000_README
@@ -2,15 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1047_linux-3.14.48.patch
+Patch:	1049_linux-3.14.50.patch
 From:	http://www.kernel.org
-Desc:	Linux 3.14.48
+Desc:	Linux 3.14.50
 
-Patch:	1048_linux-3.14.49.patch
-From:	http://www.kernel.org
-Desc:	Linux 3.14.49
-
-Patch:	4420_grsecurity-3.1-3.14.49-201508032312.patch
+Patch:	4420_grsecurity-3.1-3.14.50-201508102128.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.14.50/1049_linux-3.14.50.patch b/3.14.50/1049_linux-3.14.50.patch
new file mode 100644
index 0000000..bd7d238
--- /dev/null
+++ b/3.14.50/1049_linux-3.14.50.patch
@@ -0,0 +1,700 @@
+diff --git a/Makefile b/Makefile
+index fee8460..d71c40a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 49
++SUBLEVEL = 50
+ EXTRAVERSION =
+ NAME = Remembering Coco
+ 
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2..2a58af7 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ 	long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+ 
+-#define instruction_pointer(regs)	((regs)->ret)
++#define instruction_pointer(regs)	(unsigned long)((regs)->ret)
+ #define profile_pc(regs)		instruction_pointer(regs)
+ 
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97..52c179b 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_enable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (IS_ERR_OR_NULL(clk))
++		return;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_disable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ 	unsigned long flags;
+ 	unsigned long rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	rate = clk->get_rate(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ 	unsigned long flags, actual_rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ 	unsigned long flags;
+ 	long ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ 	unsigned long flags;
+ 	int ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_parent)
+ 		return -ENOSYS;
+ 
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+ 
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+-	return clk->parent;
++	return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+ 
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 29bd7be..1ecd47b 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early)
+ 	jno	.Lesa2
+ 	ahi	%r15,-80
+ 	stmh	%r6,%r15,96(%r15)		# store upper register halves
++	basr	%r13,0
++	lmh	%r0,%r15,.Lzeroes-.(%r13)	# clear upper register halves
+ .Lesa2:
+ #endif
+ 	lr	%r10,%r2			# save string pointer
+@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early)
+ #endif
+ 	lm	%r6,%r15,120(%r15)		# restore registers
+ 	br	%r14
++.Lzeroes:
++	.fill	64,4,0
+ 
+ .LwritedataS4:
+ 	.long	0x00760005			# SCLP command for write data
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index 74c9172..bdb3ecf 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1146,7 +1146,7 @@ static void __init load_hv_initrd(void)
+ 
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+-	free_bootmem(__pa(begin), end - begin);
++	free_bootmem_late(__pa(begin), end - begin);
+ }
+ 
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 78cbb2d..ec5a3c7 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ 		unsigned int e820_type = 0;
+ 		unsigned long m = efi->efi_memmap;
+ 
++#ifdef CONFIG_X86_64
++		m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ 		switch (d->type) {
+ 		case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index c5b56ed..a814c80 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -54,7 +54,7 @@ ENTRY(efi_pe_entry)
+ 	call	reloc
+ reloc:
+ 	popl	%ecx
+-	subl	reloc, %ecx
++	subl	$reloc, %ecx
+ 	movl	%ecx, BP_code32_start(%eax)
+ 
+ 	sub	$0x4, %esp
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index d8f80e7..a717585 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -703,8 +703,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		return -EINVAL;
+ 
+ 	disk = get_gendisk(MKDEV(major, minor), &part);
+-	if (!disk || part)
++	if (!disk)
+ 		return -EINVAL;
++	if (part) {
++		put_disk(disk);
++		return -EINVAL;
++	}
+ 
+ 	rcu_read_lock();
+ 	spin_lock_irq(disk->queue->queue_lock);
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084..85aa761 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 				       ATA_LFLAG_NO_SRST |
+ 				       ATA_LFLAG_ASSUME_ATA;
+ 		}
++	} else if (vendor == 0x11ab && devid == 0x4140) {
++		/* Marvell 4140 quirks */
++		ata_for_each_link(link, ap, EDGE) {
++			/* port 4 is for SEMB device and it doesn't like SRST */
++			if (link->pmp == 4)
++				link->flags |= ATA_LFLAG_DISABLED;
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index a096633..c6f7e91 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ 		goto err_out;
+ 	}
+ 
++	/* TSC-25 data sheet specifies a delay after the RESET command */
++	msleep(150);
++
+ 	/* set coordinate output rate */
+ 	buf[0] = buf[1] = 0xFF;
+ 	ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index b96ee9d..9be97e0 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ 		spin_lock_irqsave(&conf->device_lock, flags);
+ 		if (r1_bio->mddev->degraded == conf->raid_disks ||
+ 		    (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+-		     !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++		     test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ 			uptodate = 1;
+ 		spin_unlock_irqrestore(&conf->device_lock, flags);
+ 	}
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index a7d9f95..7fd86be 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -47,6 +47,6 @@
+ #define ESDHC_DMA_SYSCTL	0x40c
+ #define ESDHC_DMA_SNOOP		0x00000040
+ 
+-#define ESDHC_HOST_CONTROL_RES	0x05
++#define ESDHC_HOST_CONTROL_RES	0x01
+ 
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 561c6b4..b807666 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -257,6 +257,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ 			goto err_of_parse;
+ 		sdhci_get_of_property(pdev);
+ 		pdata = pxav3_get_mmc_pdata(dev);
++		pdev->dev.platform_data = pdata;
+ 	} else if (pdata) {
+ 		/* on-chip device */
+ 		if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index a1d6986..f310982 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ 	spin_lock(&st_use_lock);
+ 	STp->in_use = 0;
+ 	spin_unlock(&st_use_lock);
+-	scsi_tape_put(STp);
+ 	if (resumed)
+ 		scsi_autopm_put_device(STp->device);
++	scsi_tape_put(STp);
+ 	return retval;
+ 
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index c8d7b30..55ec9b4 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4476,7 +4476,18 @@ static void iscsit_logout_post_handler_closesession(
+ 	struct iscsi_conn *conn)
+ {
+ 	struct iscsi_session *sess = conn->sess;
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++	/*
++	 * Traditional iscsi/tcp will invoke this logic from TX thread
++	 * context during session logout, so clear tx_thread_active and
++	 * sleep if iscsit_close_connection() has not already occured.
++	 *
++	 * Since iser-target invokes this logic from it's own workqueue,
++	 * always sleep waiting for RX/TX thread shutdown to complete
++	 * within iscsit_close_connection().
++	 */
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4490,7 +4501,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ 	struct iscsi_conn *conn)
+ {
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4709,6 +4723,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 	struct iscsi_session *sess;
+ 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ 	struct se_session *se_sess, *se_sess_tmp;
++	LIST_HEAD(free_list);
+ 	int session_count = 0;
+ 
+ 	spin_lock_bh(&se_tpg->session_lock);
+@@ -4730,14 +4745,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 		}
+ 		atomic_set(&sess->session_reinstatement, 1);
+ 		spin_unlock(&sess->conn_lock);
+-		spin_unlock_bh(&se_tpg->session_lock);
+ 
+-		iscsit_free_session(sess);
+-		spin_lock_bh(&se_tpg->session_lock);
++		list_move_tail(&se_sess->sess_list, &free_list);
++	}
++	spin_unlock_bh(&se_tpg->session_lock);
+ 
++	list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++		sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
++
++		iscsit_free_session(sess);
+ 		session_count++;
+ 	}
+-	spin_unlock_bh(&se_tpg->session_lock);
+ 
+ 	pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ 			" Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b9e16abb..5c95765 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -480,10 +480,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ 	u32 pls = status_reg & PORT_PLS_MASK;
+ 
+ 	/* resume state is a xHCI internal state.
+-	 * Do not report it to usb core.
++	 * Do not report it to usb core, instead, pretend to be U3,
++	 * thus usb core knows it's not ready for transfer
+ 	 */
+-	if (pls == XDEV_RESUME)
++	if (pls == XDEV_RESUME) {
++		*status |= USB_SS_PORT_LS_U3;
+ 		return;
++	}
+ 
+ 	/* When the CAS bit is set then warm reset
+ 	 * should be performed on port
+@@ -584,7 +587,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ 		status |= USB_PORT_STAT_C_RESET << 16;
+ 	/* USB3.0 only */
+ 	if (hcd->speed == HCD_USB3) {
+-		if ((raw_port_status & PORT_PLC))
++		/* Port link change with port in resume state should not be
++		 * reported to usbcore, as this is an internal state to be
++		 * handled by xhci driver. Reporting PLC to usbcore may
++		 * cause usbcore clearing PLC first and port change event
++		 * irq won't be generated.
++		 */
++		if ((raw_port_status & PORT_PLC) &&
++			(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ 			status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ 		if ((raw_port_status & PORT_WRC))
+ 			status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1114,10 +1124,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
+ 	if (hcd->self.root_hub->do_remote_wakeup) {
+-		if (bus_state->resuming_ports) {
++		if (bus_state->resuming_ports ||	/* USB2 */
++		    bus_state->port_remote_wakeup) {	/* USB3 */
+ 			spin_unlock_irqrestore(&xhci->lock, flags);
+-			xhci_dbg(xhci, "suspend failed because "
+-						"a port is resuming\n");
++			xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ 			return -EBUSY;
+ 		}
+ 	}
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f615712..bcc43a2 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1740,6 +1740,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 		usb_hcd_resume_root_hub(hcd);
+ 	}
+ 
++	if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++		bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ 	if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ 		xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 16f4f8d..fc61e663b 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3424,6 +3424,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ 			return -EINVAL;
+ 	}
+ 
++	if (virt_dev->tt_info)
++		old_active_eps = virt_dev->tt_info->active_eps;
++
+ 	if (virt_dev->udev != udev) {
+ 		/* If the virt_dev and the udev does not match, this virt_dev
+ 		 * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 70facb7..c167485 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0		(0x0 << 5)
+ #define XDEV_U2		(0x2 << 5)
+ #define XDEV_U3		(0x3 << 5)
++#define XDEV_INACTIVE	(0x6 << 5)
+ #define XDEV_RESUME	(0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER	(1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 821e1e2..da380a9 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2032,6 +2032,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_READ_DISC_INFO ),
+ 
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++		"ZTE,Incorporated",
++		"ZTE WCDMA Technologies MSM",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+  * This encrypted pen drive returns bogus data for the initial READ(10).
+  */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 78987e4..85095d7 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -876,6 +876,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ 		}
+ 		if (eventfp != d->log_file) {
+ 			filep = d->log_file;
++			d->log_file = eventfp;
+ 			ctx = d->log_ctx;
+ 			d->log_ctx = eventfp ?
+ 				eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index aa24f7d..3d2f27b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -587,6 +587,9 @@ repeat:
+ 	if (unlikely(d_unhashed(dentry)))
+ 		goto kill_it;
+ 
++	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++		goto kill_it;
++
+ 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ 		if (dentry->d_op->d_delete(dentry))
+ 			goto kill_it;
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107..7a5237a 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ 		    !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ 			/*
+-			 * If the interrupt has a parent irq and runs
+-			 * in the thread context of the parent irq,
+-			 * retrigger the parent.
++			 * If the interrupt is running in the thread
++			 * context of the parent irq we need to be
++			 * careful, because we cannot trigger it
++			 * directly.
+ 			 */
+-			if (desc->parent_irq &&
+-			    irq_settings_is_nested_thread(desc))
++			if (irq_settings_is_nested_thread(desc)) {
++				/*
++				 * If the parent_irq is valid, we
++				 * retrigger the parent, otherwise we
++				 * do nothing.
++				 */
++				if (!desc->parent_irq)
++					return;
+ 				irq = desc->parent_irq;
++			}
+ 			/* Set it pending and activate the softirq: */
+ 			set_bit(irq, irqs_resend);
+ 			tasklet_schedule(&resend_tasklet);
+diff --git a/mm/memory.c b/mm/memory.c
+index 749e1c6..e9ddc7a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3234,6 +3234,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 
+ 	pte_unmap(page_table);
+ 
++	/* File mapping without ->vm_ops ? */
++	if (vma->vm_flags & VM_SHARED)
++		return VM_FAULT_SIGBUS;
++
+ 	/* Check if we need to add a guard page to the stack */
+ 	if (check_stack_guard_page(vma, address) < 0)
+ 		return VM_FAULT_SIGSEGV;
+@@ -3502,6 +3506,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+ 
+ 	pte_unmap(page_table);
++	/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
++	if (!vma->vm_ops->fault)
++		return VM_FAULT_SIGBUS;
+ 	return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
+ }
+ 
+@@ -3650,11 +3657,9 @@ static int handle_pte_fault(struct mm_struct *mm,
+ 	entry = ACCESS_ONCE(*pte);
+ 	if (!pte_present(entry)) {
+ 		if (pte_none(entry)) {
+-			if (vma->vm_ops) {
+-				if (likely(vma->vm_ops->fault))
+-					return do_linear_fault(mm, vma, address,
++			if (vma->vm_ops)
++				return do_linear_fault(mm, vma, address,
+ 						pte, pmd, flags, entry);
+-			}
+ 			return do_anonymous_page(mm, vma, address,
+ 						 pte, pmd, flags);
+ 		}
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 653ce5d..5d8bc1f 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -712,6 +712,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+ 
+ 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ 	sdata->vif.debugfs_dir = NULL;
++	sdata->debugfs.subdir_stations = NULL;
+ }
+ 
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index e8fdb17..a985158 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ 	}
+ 
+ 	ibmr = rds_ib_alloc_fmr(rds_ibdev);
+-	if (IS_ERR(ibmr))
++	if (IS_ERR(ibmr)) {
++		rds_ib_dev_put(rds_ibdev);
+ 		return ibmr;
++	}
+ 
+ 	ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ 	if (ret == 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2f503c0..907371d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2282,7 +2282,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+-	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+ 
+ 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ 	SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index b16be39..9a3e107 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ 	{ 0 }
+ };
+ 
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++	{ 3, NULL, .dB = &bose_companion5_dB },
++	{ 0 }	/* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++	{ 7, NULL, .dB = &dragonfly_1_2_dB },
++	{ 0 }	/* terminator */
++};
++
+ /*
+  * Control map entries
+  */
+@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.id = USB_ID(0x25c4, 0x0003),
+ 		.map = scms_usb3318_map,
+ 	},
++	{
++		/* Bose Companion 5 */
++		.id = USB_ID(0x05a7, 0x1020),
++		.map = bose_companion5_map,
++	},
++	{
++		/* Dragonfly DAC 1.2 */
++		.id = USB_ID(0x21b4, 0x0081),
++		.map = dragonfly_1_2_map,
++	},
+ 	{ 0 } /* terminator */
+ };
+ 
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 5293b5a..7c24088 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ 	}
+ },
+ 
++/* Steinberg devices */
++{
++	/* Steinberg MI2 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++{
++	/* Steinberg MI4 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++
+ /* TerraTec devices */
+ {
+ 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
diff --git a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
index 75ba2f6..1086c4e 100644
--- a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch
+++ b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
@@ -328,7 +328,7 @@ index 855d9b3..154c500 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index fee8460..5d81b33 100644
+index d71c40a..4d15036 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -10431,6 +10431,40 @@ index ad7e178..26cd4a7 100644
  	if (unlikely(ret))
  		ret = copy_to_user_fixup(to, from, size);
  	return ret;
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 11fdf0e..50d6f16 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+  * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+ 
+ #define VISEntryHalf					\
+-	rd		%fprs, %o5;			\
+-	andcc		%o5, FPRS_FEF, %g0;		\
+-	be,pt		%icc, 297f;			\
+-	 sethi		%hi(298f), %g7;			\
+-	sethi		%hi(VISenterhalf), %g1;		\
+-	jmpl		%g1 + %lo(VISenterhalf), %g0;	\
+-	 or		%g7, %lo(298f), %g7;		\
+-	clr		%o5;				\
+-297:	wr		%o5, FPRS_FEF, %fprs;		\
+-298:
++	VISEntry
++
++#define VISExitHalf					\
++	VISExit
+ 
+ #define VISEntryHalfFast(fail_label)			\
+ 	rd		%fprs, %o5;			\
+@@ -47,7 +41,7 @@
+ 	ba,a,pt		%xcc, fail_label;		\
+ 297:	wr		%o5, FPRS_FEF, %fprs;
+ 
+-#define VISExitHalf					\
++#define VISExitHalfFast					\
+ 	wr		%o5, 0, %fprs;
+ 
+ #ifndef __ASSEMBLY__
 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
 index d15cc17..d0ae796 100644
 --- a/arch/sparc/kernel/Makefile
@@ -11092,6 +11126,105 @@ index dbe119b..089c7c1 100644
  
  lib-$(CONFIG_SPARC32) += ashrdi3.o
  lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a..83aeeb1 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
+ 	add		%o0, 0x40, %o0
+ 	bne,pt		%icc, 1b
+ 	 LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++	VISExitHalfFast
++#else
+ 	VISExitHalf
+-
++#endif
+ 	brz,pn		%o2, .Lexit
+ 	 cmp		%o2, 19
+ 	ble,pn		%icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9..a063d84 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
+ 
+ 	 stx		%g3, [%g6 + TI_GSR]
+ 2:	add		%g6, %g1, %g3
+-	cmp		%o5, FPRS_DU
+-	be,pn		%icc, 6f
+-	 sll		%g1, 3, %g1
++	mov		FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++	sll		%g1, 3, %g1
+ 	stb		%o5, [%g3 + TI_FPSAVED]
+ 	rd		%gsr, %g2
+ 	add		%g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
+ 	.align		32
+ 80:	jmpl		%g7 + %g0, %g0
+ 	 nop
+-
+-6:	ldub		[%g3 + TI_FPSAVED], %o5
+-	or		%o5, FPRS_DU, %o5
+-	add		%g6, TI_FPREGS+0x80, %g2
+-	stb		%o5, [%g3 + TI_FPSAVED]
+-
+-	sll		%g1, 5, %g1
+-	add		%g6, TI_FPREGS+0xc0, %g3
+-	wr		%g0, FPRS_FEF, %fprs
+-	membar		#Sync
+-	stda		%f32, [%g2 + %g1] ASI_BLK_P
+-	stda		%f48, [%g3 + %g1] ASI_BLK_P
+-	membar		#Sync
+-	ba,pt		%xcc, 80f
+-	 nop
+-
+-	.align		32
+-80:	jmpl		%g7 + %g0, %g0
+-	 nop
+-
+-	.align		32
+-VISenterhalf:
+-	ldub		[%g6 + TI_FPDEPTH], %g1
+-	brnz,a,pn	%g1, 1f
+-	 cmp		%g1, 1
+-	stb		%g0, [%g6 + TI_FPSAVED]
+-	stx		%fsr, [%g6 + TI_XFSR]
+-	clr		%o5
+-	jmpl		%g7 + %g0, %g0
+-	 wr		%g0, FPRS_FEF, %fprs
+-
+-1:	bne,pn		%icc, 2f
+-	 srl		%g1, 1, %g1
+-	ba,pt		%xcc, vis1
+-	 sub		%g7, 8, %g7
+-2:	addcc		%g6, %g1, %g3
+-	sll		%g1, 3, %g1
+-	andn		%o5, FPRS_DU, %g2
+-	stb		%g2, [%g3 + TI_FPSAVED]
+-
+-	rd		%gsr, %g2
+-	add		%g6, %g1, %g3
+-	stx		%g2, [%g3 + TI_GSR]
+-	add		%g6, %g1, %g2
+-	stx		%fsr, [%g2 + TI_XFSR]
+-	sll		%g1, 5, %g1
+-3:	andcc		%o5, FPRS_DL, %g0
+-	be,pn		%icc, 4f
+-	 add		%g6, TI_FPREGS, %g2
+-
+-	add		%g6, TI_FPREGS+0x40, %g3
+-	membar		#Sync
+-	stda		%f0, [%g2 + %g1] ASI_BLK_P
+-	stda		%f16, [%g3 + %g1] ASI_BLK_P
+-	membar		#Sync
+-	ba,pt		%xcc, 4f
+-	 nop
+-
+-	.align		32
+-4:	and		%o5, FPRS_DU, %o5
+-	jmpl		%g7 + %g0, %g0
+-	 wr		%o5, FPRS_FEF, %fprs
 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
 index 85c233d..68500e0 100644
 --- a/arch/sparc/lib/atomic_64.S
@@ -11307,7 +11440,7 @@ index 85c233d..68500e0 100644
  	cmp	%g1, %g7
  	bne,pn	%xcc, BACKOFF_LABEL(2f, 1b)
 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 323335b..ed85ea2 100644
+index 323335b..e8ee09d 100644
 --- a/arch/sparc/lib/ksyms.c
 +++ b/arch/sparc/lib/ksyms.c
 @@ -100,12 +100,18 @@ EXPORT_SYMBOL(__clear_user);
@@ -11329,6 +11462,17 @@ index 323335b..ed85ea2 100644
  EXPORT_SYMBOL(atomic64_sub_ret);
  EXPORT_SYMBOL(atomic64_dec_if_positive);
  
+@@ -126,10 +132,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+ 
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ 		unsigned long *);
 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
 index 30c3ecc..736f015 100644
 --- a/arch/sparc/mm/Makefile
@@ -12816,21 +12960,6 @@ index 67e9f5c..2af15db 100644
  
  KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
  GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 78cbb2d..ec5a3c7 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
- 		unsigned int e820_type = 0;
- 		unsigned long m = efi->efi_memmap;
- 
-+#ifdef CONFIG_X86_64
-+		m |= (u64)efi->efi_memmap_hi << 32;
-+#endif
-+
- 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
- 		switch (d->type) {
- 		case EFI_RESERVED_TYPE:
 diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
 index a53440e..c3dbf1e 100644
 --- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -12874,7 +13003,7 @@ index a53440e..c3dbf1e 100644
  .previous
  
 diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index c5b56ed..9f79ed3 100644
+index a814c80..5df45f6 100644
 --- a/arch/x86/boot/compressed/head_32.S
 +++ b/arch/x86/boot/compressed/head_32.S
 @@ -119,10 +119,10 @@ preferred_addr:
@@ -36926,10 +37055,10 @@ index af00795..2bb8105 100644
  #define XCHAL_ICACHE_SIZE		32768	/* I-cache size in bytes or 0 */
  #define XCHAL_DCACHE_SIZE		32768	/* D-cache size in bytes or 0 */
 diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index d8f80e7..5f41702 100644
+index a717585..11de03b 100644
 --- a/block/blk-cgroup.c
 +++ b/block/blk-cgroup.c
-@@ -809,7 +809,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
+@@ -813,7 +813,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
  static struct cgroup_subsys_state *
  blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
  {
@@ -36938,7 +37067,7 @@ index d8f80e7..5f41702 100644
  	struct blkcg *blkcg;
  
  	if (!parent_css) {
-@@ -823,7 +823,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
+@@ -827,7 +827,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
  
  	blkcg->cfq_weight = CFQ_WEIGHT_DEFAULT;
  	blkcg->cfq_leaf_weight = CFQ_WEIGHT_DEFAULT;
@@ -46093,7 +46222,7 @@ index 3e6d115..ffecdeb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index b96ee9d..1d38b21 100644
+index 9be97e0..71b21b0 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
 @@ -1937,7 +1937,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -49509,7 +49638,7 @@ index f9e96c4..6b1faeb 100644
  deferred:
  #endif
 diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 841b608..198a8b7 100644
+index 841b608..1f38243 100644
 --- a/drivers/net/virtio_net.c
 +++ b/drivers/net/virtio_net.c
 @@ -47,7 +47,7 @@ module_param(gso, bool, 0444);
@@ -49521,6 +49650,18 @@ index 841b608..198a8b7 100644
  
  #define VIRTNET_DRIVER_VERSION "1.0.0"
  
+@@ -1652,9 +1652,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* Do we support "hardware" checksums? */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ 		/* This opens up the world of extra features. */
+-		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 		if (csum)
+-			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 
+ 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
 index 0fa3b44..e913fc9 100644
 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -53028,21 +53169,6 @@ index 40d8592..8e89146 100644
  	int block_sectors = 0;
  	long error_sector;
  	struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
-diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
-index a1d6986..f310982 100644
---- a/drivers/scsi/st.c
-+++ b/drivers/scsi/st.c
-@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
- 	spin_lock(&st_use_lock);
- 	STp->in_use = 0;
- 	spin_unlock(&st_use_lock);
--	scsi_tape_put(STp);
- 	if (resumed)
- 		scsi_autopm_put_device(STp->device);
-+	scsi_tape_put(STp);
- 	return retval;
- 
- }
 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
 index f3e3ae8..f876b14 100644
 --- a/drivers/spi/spi.c
@@ -74381,7 +74507,7 @@ index a93f7e6..d58bcbe 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index aa24f7d..8f1bf8c 100644
+index 3d2f27b..8f1bf8c 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -250,7 +250,7 @@ static void __d_free(struct rcu_head *head)
@@ -74393,17 +74519,7 @@ index aa24f7d..8f1bf8c 100644
  	this_cpu_dec(nr_dentry);
  	if (dentry->d_op && dentry->d_op->d_release)
  		dentry->d_op->d_release(dentry);
-@@ -587,6 +587,9 @@ repeat:
- 	if (unlikely(d_unhashed(dentry)))
- 		goto kill_it;
- 
-+	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
-+		goto kill_it;
-+
- 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
- 		if (dentry->d_op->d_delete(dentry))
- 			goto kill_it;
-@@ -596,7 +599,7 @@ repeat:
+@@ -599,7 +599,7 @@ repeat:
  		dentry->d_flags |= DCACHE_REFERENCED;
  	dentry_lru_add(dentry);
  
@@ -74412,7 +74528,7 @@ index aa24f7d..8f1bf8c 100644
  	spin_unlock(&dentry->d_lock);
  	return;
  
-@@ -651,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
+@@ -654,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
  	 * We also need to leave mountpoints alone,
  	 * directory or not.
  	 */
@@ -74421,7 +74537,7 @@ index aa24f7d..8f1bf8c 100644
  		if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
  			spin_unlock(&dentry->d_lock);
  			return -EBUSY;
-@@ -667,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
+@@ -670,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
  /* This must be called with d_lock held */
  static inline void __dget_dlock(struct dentry *dentry)
  {
@@ -74430,7 +74546,7 @@ index aa24f7d..8f1bf8c 100644
  }
  
  static inline void __dget(struct dentry *dentry)
-@@ -708,8 +711,8 @@ repeat:
+@@ -711,8 +711,8 @@ repeat:
  		goto repeat;
  	}
  	rcu_read_unlock();
@@ -74441,7 +74557,7 @@ index aa24f7d..8f1bf8c 100644
  	spin_unlock(&ret->d_lock);
  	return ret;
  }
-@@ -792,7 +795,7 @@ restart:
+@@ -795,7 +795,7 @@ restart:
  	spin_lock(&inode->i_lock);
  	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
  		spin_lock(&dentry->d_lock);
@@ -74450,7 +74566,7 @@ index aa24f7d..8f1bf8c 100644
  			/*
  			 * inform the fs via d_prune that this dentry
  			 * is about to be unhashed and destroyed.
-@@ -884,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -887,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
  		 * We found an inuse dentry which was not removed from
  		 * the LRU because of laziness during lookup. Do not free it.
  		 */
@@ -74459,7 +74575,7 @@ index aa24f7d..8f1bf8c 100644
  			spin_unlock(&dentry->d_lock);
  			continue;
  		}
-@@ -930,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
+@@ -933,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
  	 * counts, just remove them from the LRU. Otherwise give them
  	 * another pass through the LRU.
  	 */
@@ -74468,7 +74584,7 @@ index aa24f7d..8f1bf8c 100644
  		d_lru_isolate(dentry);
  		spin_unlock(&dentry->d_lock);
  		return LRU_REMOVED;
-@@ -1269,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+@@ -1272,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
  	 * loop in shrink_dcache_parent() might not make any progress
  	 * and loop forever.
  	 */
@@ -74477,7 +74593,7 @@ index aa24f7d..8f1bf8c 100644
  		dentry_lru_del(dentry);
  	} else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
  		/*
-@@ -1323,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1326,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
  	struct select_data *data = _data;
  	enum d_walk_ret ret = D_WALK_CONTINUE;
  
@@ -74491,7 +74607,7 @@ index aa24f7d..8f1bf8c 100644
  			goto out;
  		printk(KERN_ERR
  		       "BUG: Dentry %p{i=%lx,n=%s}"
-@@ -1337,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1340,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
  		       dentry->d_inode ?
  		       dentry->d_inode->i_ino : 0UL,
  		       dentry->d_name.name,
@@ -74500,7 +74616,7 @@ index aa24f7d..8f1bf8c 100644
  		       dentry->d_sb->s_type->name,
  		       dentry->d_sb->s_id);
  		BUG();
-@@ -1495,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1498,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	 */
  	dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
  	if (name->len > DNAME_INLINE_LEN-1) {
@@ -74509,7 +74625,7 @@ index aa24f7d..8f1bf8c 100644
  		if (!dname) {
  			kmem_cache_free(dentry_cache, dentry); 
  			return NULL;
-@@ -1513,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1516,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	smp_wmb();
  	dentry->d_name.name = dname;
  
@@ -74518,7 +74634,7 @@ index aa24f7d..8f1bf8c 100644
  	dentry->d_flags = 0;
  	spin_lock_init(&dentry->d_lock);
  	seqcount_init(&dentry->d_seq);
-@@ -1522,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1525,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	dentry->d_sb = sb;
  	dentry->d_op = NULL;
  	dentry->d_fsdata = NULL;
@@ -74528,7 +74644,7 @@ index aa24f7d..8f1bf8c 100644
  	INIT_HLIST_BL_NODE(&dentry->d_hash);
  	INIT_LIST_HEAD(&dentry->d_lru);
  	INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2276,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2279,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
  				goto next;
  		}
  
@@ -74537,7 +74653,7 @@ index aa24f7d..8f1bf8c 100644
  		found = dentry;
  		spin_unlock(&dentry->d_lock);
  		break;
-@@ -2375,7 +2381,7 @@ again:
+@@ -2378,7 +2381,7 @@ again:
  	spin_lock(&dentry->d_lock);
  	inode = dentry->d_inode;
  	isdir = S_ISDIR(inode->i_mode);
@@ -74546,7 +74662,7 @@ index aa24f7d..8f1bf8c 100644
  		if (!spin_trylock(&inode->i_lock)) {
  			spin_unlock(&dentry->d_lock);
  			cpu_relax();
-@@ -3308,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3311,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
  
  		if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
  			dentry->d_flags |= DCACHE_GENOCIDE;
@@ -74555,7 +74671,7 @@ index aa24f7d..8f1bf8c 100644
  		}
  	}
  	return D_WALK_CONTINUE;
-@@ -3424,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3427,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -77944,7 +78060,7 @@ index b29e42f..5ea7fdf 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index ccb8000..ac58c5a 100644
+index ccb8000..02d506e 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -331,17 +331,34 @@ int generic_permission(struct inode *inode, int mask)
@@ -78000,6 +78116,15 @@ index ccb8000..ac58c5a 100644
  	return -EACCES;
  }
  
+@@ -733,7 +742,7 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
+ 		return 0;
+ 
+ 	/* Allowed if parent directory not sticky and world-writable. */
+-	parent = nd->path.dentry->d_inode;
++	parent = nd->inode;
+ 	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
+ 		return 0;
+ 
 @@ -821,7 +830,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  {
  	struct dentry *dentry = link->dentry;
@@ -111608,7 +111733,7 @@ index 9502057..a83c0d4 100644
  	}
  	unset_migratetype_isolate(page, MIGRATE_MOVABLE);
 diff --git a/mm/memory.c b/mm/memory.c
-index 749e1c6..f7fbc29 100644
+index e9ddc7a..f465481 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -112065,7 +112190,7 @@ index 749e1c6..f7fbc29 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3228,27 +3412,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3228,31 +3412,29 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -112076,6 +112201,13 @@ index 749e1c6..f7fbc29 100644
  
 -	pte_unmap(page_table);
 -
+ 	/* File mapping without ->vm_ops ? */
+-	if (vma->vm_flags & VM_SHARED)
++	if (vma->vm_flags & VM_SHARED) {
++		pte_unmap(page_table);
+ 		return VM_FAULT_SIGBUS;
++	}
+ 
 -	/* Check if we need to add a guard page to the stack */
 -	if (check_stack_guard_page(vma, address) < 0)
 -		return VM_FAULT_SIGSEGV;
@@ -112098,7 +112230,7 @@ index 749e1c6..f7fbc29 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3272,6 +3452,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3276,6 +3458,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -112110,7 +112242,7 @@ index 749e1c6..f7fbc29 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3279,6 +3464,12 @@ setpte:
+@@ -3283,6 +3470,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -112123,7 +112255,7 @@ index 749e1c6..f7fbc29 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3423,6 +3614,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3427,6 +3620,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -112136,7 +112268,7 @@ index 749e1c6..f7fbc29 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3444,6 +3641,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3448,6 +3647,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -112151,7 +112283,7 @@ index 749e1c6..f7fbc29 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3691,6 +3896,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3696,6 +3903,12 @@ static int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -112164,7 +112296,7 @@ index 749e1c6..f7fbc29 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3707,9 +3918,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3712,9 +3925,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -112206,7 +112338,7 @@ index 749e1c6..f7fbc29 100644
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
  	if (!pud)
-@@ -3837,6 +4080,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3842,6 +4087,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -112230,7 +112362,7 @@ index 749e1c6..f7fbc29 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3867,6 +4127,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3872,6 +4134,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -112261,7 +112393,7 @@ index 749e1c6..f7fbc29 100644
  #endif /* __PAGETABLE_PMD_FOLDED */
  
  #if !defined(__HAVE_ARCH_GATE_AREA)
-@@ -3880,7 +4164,7 @@ static int __init gate_vma_init(void)
+@@ -3885,7 +4171,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -112270,7 +112402,7 @@ index 749e1c6..f7fbc29 100644
  
  	return 0;
  }
-@@ -4014,8 +4298,8 @@ out:
+@@ -4019,8 +4305,8 @@ out:
  	return ret;
  }
  
@@ -112281,7 +112413,7 @@ index 749e1c6..f7fbc29 100644
  {
  	resource_size_t phys_addr;
  	unsigned long prot = 0;
-@@ -4041,8 +4325,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -4046,8 +4332,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
   * Access another process' address space as given in mm.  If non-NULL, use the
   * given task for page fault accounting.
   */
@@ -112292,7 +112424,7 @@ index 749e1c6..f7fbc29 100644
  {
  	struct vm_area_struct *vma;
  	void *old_buf = buf;
-@@ -4050,7 +4334,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4055,7 +4341,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
  	down_read(&mm->mmap_sem);
  	/* ignore errors, just check how much was successfully transferred */
  	while (len) {
@@ -112301,7 +112433,7 @@ index 749e1c6..f7fbc29 100644
  		void *maddr;
  		struct page *page = NULL;
  
-@@ -4109,8 +4393,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4114,8 +4400,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
   *
   * The caller must hold a reference on @mm.
   */
@@ -112312,7 +112444,7 @@ index 749e1c6..f7fbc29 100644
  {
  	return __access_remote_vm(NULL, mm, addr, buf, len, write);
  }
-@@ -4120,11 +4404,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4125,11 +4411,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
   * Source/target buffer must be kernel space,
   * Do not walk the page table directly, use get_user_pages
   */
@@ -117100,19 +117232,19 @@ index d125290..e86e034 100644
  	a0 = a[0];
  	a1 = a[1];
 diff --git a/net/core/datagram.c b/net/core/datagram.c
-index a16ed7b..689402b 100644
+index a16ed7b..a334f7d 100644
 --- a/net/core/datagram.c
 +++ b/net/core/datagram.c
 @@ -130,6 +130,35 @@ out_noerr:
  	goto out;
  }
  
-+static int skb_set_peeked(struct sk_buff *skb)
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
 +{
 +	struct sk_buff *nskb;
 +
 +	if (skb->peeked)
-+		return 0;
++		return skb;
 +
 +	/* We have to unshare an skb before modifying it. */
 +	if (!skb_shared(skb))
@@ -117120,7 +117252,7 @@ index a16ed7b..689402b 100644
 +
 +	nskb = skb_clone(skb, GFP_ATOMIC);
 +	if (!nskb)
-+		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
 +
 +	skb->prev->next = nskb;
 +	skb->next->prev = nskb;
@@ -117133,7 +117265,7 @@ index a16ed7b..689402b 100644
 +done:
 +	skb->peeked = 1;
 +
-+	return 0;
++	return skb;
 +}
 +
  /**
@@ -117158,20 +117290,21 @@ index a16ed7b..689402b 100644
  		int _off = *off;
  
  		last = (struct sk_buff *)queue;
-@@ -198,7 +227,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -198,7 +227,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
  					_off -= skb->len;
  					continue;
  				}
 -				skb->peeked = 1;
 +
-+				error = skb_set_peeked(skb);
-+				if (error)
++				skb = skb_set_peeked(skb);
++				error = PTR_ERR(skb);
++				if (IS_ERR(skb))
 +					goto unlock_err;
 +
  				atomic_inc(&skb->users);
  			} else
  				__skb_unlink(skb, queue);
-@@ -222,6 +255,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -222,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
  
  	return NULL;
  
@@ -117180,7 +117313,7 @@ index a16ed7b..689402b 100644
  no_packet:
  	*err = error;
  	return NULL;
-@@ -301,7 +336,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+@@ -301,7 +337,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
  	}
  
  	kfree_skb(skb);
@@ -121788,6 +121921,19 @@ index b7ebe23..b6352f6 100644
  }
  #endif
  
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f6..140a44a 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+ 
+ 	/* check for all kinds of wrapping and the like */
+ 	start = (unsigned long)optval;
+-	if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++	if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
 diff --git a/net/rds/iw.h b/net/rds/iw.h
 index 04ce3b1..48119a6 100644
 --- a/net/rds/iw.h
@@ -135209,10 +135355,10 @@ index 0000000..176c32f
 +#endif
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..51560ee
+index 0000000..b5dfeff
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6061 @@
+@@ -0,0 +1,6092 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
 +storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -135517,6 +135663,7 @@ index 0000000..51560ee
 +_iwl_dbgfs_d3_sram_write_3315 _iwl_dbgfs_d3_sram_write 3 3315 NULL
 +dbDiscardAG_3322 dbDiscardAG 3 3322 NULL
 +compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
++ocfs2_extend_xattr_bucket_3328 ocfs2_extend_xattr_bucket 4 3328 NULL
 +read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
 +sysfs_create_group_3339 sysfs_create_group 0 3339 NULL
 +tty_port_register_device_attr_3341 tty_port_register_device_attr 3 3341 NULL
@@ -135611,7 +135758,7 @@ index 0000000..51560ee
 +__copy_from_user_inatomic_4365 __copy_from_user_inatomic 0-3 4365 NULL nohasharray
 +lookup_string_4365 lookup_string 0 4365 &__copy_from_user_inatomic_4365
 +irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
-+access_process_vm_4412 access_process_vm 0 4412 NULL nohasharray
++access_process_vm_4412 access_process_vm 0-2-4 4412 NULL nohasharray
 +cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 &access_process_vm_4412
 +libfc_vport_create_4415 libfc_vport_create 2 4415 NULL
 +rtw_android_get_rssi_4421 rtw_android_get_rssi 0 4421 NULL
@@ -135967,6 +136114,7 @@ index 0000000..51560ee
 +ocfs2_find_path_8754 ocfs2_find_path 0 8754 NULL
 +yurex_write_8761 yurex_write 3 8761 NULL
 +joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
++x32_arch_ptrace_8767 x32_arch_ptrace 3 8767 NULL
 +kstrtoint_from_user_8778 kstrtoint_from_user 2 8778 NULL
 +paging32_prefetch_gpte_8783 paging32_prefetch_gpte 4 8783 NULL
 +ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 3-4 8785 NULL
@@ -136209,6 +136357,7 @@ index 0000000..51560ee
 +insert_inline_extent_backref_11063 insert_inline_extent_backref 8 11063 NULL
 +tcp_send_mss_11079 tcp_send_mss 0 11079 NULL
 +count_argc_11083 count_argc 0 11083 NULL
++ocfs2_blocks_per_xattr_bucket_11099 ocfs2_blocks_per_xattr_bucket 0 11099 NULL
 +kvm_write_guest_cached_11106 kvm_write_guest_cached 4 11106 NULL
 +tw_change_queue_depth_11116 tw_change_queue_depth 2 11116 NULL
 +page_offset_11120 page_offset 0 11120 NULL
@@ -136405,6 +136554,7 @@ index 0000000..51560ee
 +snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
 +bfad_debugfs_read_13119 bfad_debugfs_read 3 13119 NULL
 +blk_update_request_13146 blk_update_request 3 13146 NULL
++ocfs2_quota_trans_credits_13150 ocfs2_quota_trans_credits 0 13150 NULL
 +caif_stream_recvmsg_13173 caif_stream_recvmsg 4 13173 NULL
 +pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
 +ucs2_strlen_13178 ucs2_strlen 0 13178 NULL
@@ -136774,7 +136924,7 @@ index 0000000..51560ee
 +befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
 +tx_tx_start_templates_read_17164 tx_tx_start_templates_read 3 17164 NULL
 +UniStrnlen_17169 UniStrnlen 0 17169 NULL
-+access_remote_vm_17189 access_remote_vm 0 17189 NULL nohasharray
++access_remote_vm_17189 access_remote_vm 0-2-4 17189 NULL nohasharray
 +iwl_dbgfs_txfifo_flush_write_17189 iwl_dbgfs_txfifo_flush_write 3 17189 &access_remote_vm_17189 nohasharray
 +ocfs2_flock_handle_signal_17189 ocfs2_flock_handle_signal 0 17189 &iwl_dbgfs_txfifo_flush_write_17189
 +iscsit_find_cmd_from_itt_or_dump_17194 iscsit_find_cmd_from_itt_or_dump 3 17194 NULL nohasharray
@@ -136814,6 +136964,7 @@ index 0000000..51560ee
 +osst_execute_17607 osst_execute 7-6 17607 NULL
 +ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout_17618 ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout 3 17618 NULL
 +dma_map_page_17628 dma_map_page 0 17628 NULL
++ocfs2_rotate_subtree_left_17634 ocfs2_rotate_subtree_left 5 17634 NULL
 +twl4030_set_gpio_direction_17645 twl4030_set_gpio_direction 1 17645 NULL
 +SYSC_migrate_pages_17657 SYSC_migrate_pages 2 17657 NULL
 +packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
@@ -137164,6 +137315,7 @@ index 0000000..51560ee
 +bl_add_page_to_bio_21094 bl_add_page_to_bio 2 21094 NULL nohasharray
 +multipath_status_21094 multipath_status 5 21094 &bl_add_page_to_bio_21094
 +rate_control_pid_events_read_21099 rate_control_pid_events_read 3 21099 NULL
++ocfs2_extend_meta_needed_21104 ocfs2_extend_meta_needed 0 21104 NULL
 +ath6kl_send_go_probe_resp_21113 ath6kl_send_go_probe_resp 3 21113 NULL
 +_efx_mcdi_rpc_async_21119 _efx_mcdi_rpc_async 4-5 21119 NULL
 +i2400m_rx_trace_21127 i2400m_rx_trace 3 21127 NULL
@@ -137183,6 +137335,7 @@ index 0000000..51560ee
 +get_zeroed_page_21322 get_zeroed_page 0 21322 NULL
 +ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
 +read_file_bool_bmps_21344 read_file_bool_bmps 3 21344 NULL
++ocfs2_find_subtree_root_21351 ocfs2_find_subtree_root 0 21351 NULL
 +gfs2_ea_get_copy_21353 gfs2_ea_get_copy 0 21353 NULL
 +alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
 +SYSC_rt_sigpending_21379 SYSC_rt_sigpending 2 21379 NULL
@@ -137360,6 +137513,7 @@ index 0000000..51560ee
 +usblp_write_23178 usblp_write 3 23178 NULL
 +gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
 +mpi_alloc_limb_space_23190 mpi_alloc_limb_space 1 23190 NULL
++convert_ip_to_linear_23198 convert_ip_to_linear 0 23198 NULL
 +tty_buffer_request_room_23228 tty_buffer_request_room 2-0 23228 NULL
 +xlog_get_bp_23229 xlog_get_bp 2 23229 NULL nohasharray
 +__read_status_pci_23229 __read_status_pci 0 23229 &xlog_get_bp_23229
@@ -137776,6 +137930,7 @@ index 0000000..51560ee
 +sky2_pci_read16_27863 sky2_pci_read16 0 27863 NULL
 +ieee80211_if_read_dot11MeshHWMProotInterval_27873 ieee80211_if_read_dot11MeshHWMProotInterval 3 27873 NULL
 +unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
++SyS_ptrace_27924 SyS_ptrace 3 27924 NULL
 +check_mapped_name_27943 check_mapped_name 3 27943 NULL
 +bio_next_split_27961 bio_next_split 2 27961 NULL nohasharray
 +tracing_clock_write_27961 tracing_clock_write 3 27961 &bio_next_split_27961
@@ -137996,6 +138151,7 @@ index 0000000..51560ee
 +read_4k_modal_eeprom_30212 read_4k_modal_eeprom 3 30212 NULL
 +SyS_semop_30227 SyS_semop 3 30227 NULL
 +bitmap_file_set_bit_30228 bitmap_file_set_bit 2 30228 NULL
++ocfs2_calc_bg_discontig_credits_30230 ocfs2_calc_bg_discontig_credits 0 30230 NULL
 +shmem_unuse_inode_30263 shmem_unuse_inode 0 30263 NULL
 +rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
 +try_break_deleg_30271 try_break_deleg 0 30271 NULL nohasharray
@@ -138007,6 +138163,7 @@ index 0000000..51560ee
 +osc_contention_seconds_seq_write_30305 osc_contention_seconds_seq_write 3 30305 NULL
 +ext4_acl_from_disk_30320 ext4_acl_from_disk 2 30320 NULL
 +i8254_read_30330 i8254_read 0 30330 NULL
++generic_ptrace_pokedata_30338 generic_ptrace_pokedata 2 30338 NULL
 +resource_from_user_30341 resource_from_user 3 30341 NULL
 +o2nm_this_node_30342 o2nm_this_node 0 30342 NULL
 +gfs2_trans_begin_30359 gfs2_trans_begin 0 30359 NULL
@@ -138081,6 +138238,7 @@ index 0000000..51560ee
 +size_inside_page_31141 size_inside_page 0 31141 NULL
 +w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
 +ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
++crypto_rng_seedsize_31196 crypto_rng_seedsize 0 31196 NULL
 +r592_read_fifo_pio_31198 r592_read_fifo_pio 3 31198 NULL
 +mtdchar_readoob_31200 mtdchar_readoob 4 31200 NULL
 +__btrfs_free_reserved_extent_31207 __btrfs_free_reserved_extent 2 31207 NULL
@@ -138177,6 +138335,7 @@ index 0000000..51560ee
 +calc_hmac_32010 calc_hmac 3 32010 NULL
 +aead_len_32021 aead_len 0 32021 NULL
 +stk_read_32038 stk_read 3 32038 NULL
++ocfs2_update_edge_lengths_32046 ocfs2_update_edge_lengths 3 32046 NULL
 +SYSC_llistxattr_32061 SYSC_llistxattr 3 32061 NULL
 +proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
 +xfs_buf_iowait_32068 xfs_buf_iowait 0 32068 NULL
@@ -138258,6 +138417,7 @@ index 0000000..51560ee
 +zlib_inflate_workspacesize_32927 zlib_inflate_workspacesize 0 32927 NULL
 +rmap_recycle_32938 rmap_recycle 3 32938 NULL
 +xfs_log_reserve_32959 xfs_log_reserve 0 32959 NULL
++arch_ptrace_32981 arch_ptrace 3 32981 NULL
 +compat_filldir_32999 compat_filldir 3 32999 NULL
 +SyS_syslog_33007 SyS_syslog 3 33007 NULL
 +br_multicast_set_hash_max_33012 br_multicast_set_hash_max 2 33012 NULL
@@ -138389,6 +138549,7 @@ index 0000000..51560ee
 +mwifiex_regrdwr_read_34472 mwifiex_regrdwr_read 3 34472 NULL
 +skcipher_sndbuf_34476 skcipher_sndbuf 0 34476 NULL
 +i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
++ocfs2_mv_xattr_buckets_34484 ocfs2_mv_xattr_buckets 6 34484 NULL
 +security_inode_permission_34488 security_inode_permission 0 34488 NULL
 +SyS_pwritev_34494 SyS_pwritev 3 34494 NULL
 +qp_alloc_res_34496 qp_alloc_res 5 34496 NULL
@@ -138510,6 +138671,7 @@ index 0000000..51560ee
 +SYSC_pwritev_35690 SYSC_pwritev 3 35690 NULL
 +rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
 +md_super_write_35703 md_super_write 4 35703 NULL
++ocfs2_extent_recs_per_gd_35710 ocfs2_extent_recs_per_gd 0 35710 NULL
 +iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
 +udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
 +pvr2_hdw_cpufw_get_35824 pvr2_hdw_cpufw_get 0-4-2 35824 NULL
@@ -138546,6 +138708,7 @@ index 0000000..51560ee
 +mtip_hw_read_device_status_36082 mtip_hw_read_device_status 3 36082 NULL
 +vga_arb_write_36112 vga_arb_write 3 36112 NULL
 +simple_xattr_alloc_36118 simple_xattr_alloc 2 36118 NULL
++compat_ptrace_request_36131 compat_ptrace_request 3 36131 NULL
 +ext3_readpages_36144 ext3_readpages 4 36144 NULL
 +twl_set_36154 twl_set 2 36154 NULL
 +b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
@@ -138663,6 +138826,7 @@ index 0000000..51560ee
 +_iwl_dbgfs_fw_restart_write_37270 _iwl_dbgfs_fw_restart_write 3 37270 NULL
 +ieee80211_if_read_power_mode_37305 ieee80211_if_read_power_mode 3 37305 NULL
 +ext3_direct_IO_37308 ext3_direct_IO 4 37308 NULL
++ocfs2_calc_extend_credits_37310 ocfs2_calc_extend_credits 0 37310 NULL
 +jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
 +send_msg_37323 send_msg 4 37323 NULL
 +l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL nohasharray
@@ -138791,6 +138955,7 @@ index 0000000..51560ee
 +_ipw_read32_38565 _ipw_read32 0 38565 NULL
 +snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5-3 38567 NULL
 +copy_ctl_value_to_user_38587 copy_ctl_value_to_user 4 38587 NULL
++compat_sys_ptrace_38595 compat_sys_ptrace 3 38595 NULL
 +rd_allocate_sgl_table_38607 rd_allocate_sgl_table 3 38607 NULL
 +icn_writecmd_38629 icn_writecmd 2 38629 NULL
 +write_enabled_file_bool_38630 write_enabled_file_bool 3 38630 NULL
@@ -139011,6 +139176,7 @@ index 0000000..51560ee
 +provide_user_output_41105 provide_user_output 3 41105 NULL
 +f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
 +ath10k_read_wmi_services_41112 ath10k_read_wmi_services 3 41112 NULL
++ocfs2_extend_trans_41116 ocfs2_extend_trans 2 41116 NULL
 +v4l2_ctrl_new_int_menu_41151 v4l2_ctrl_new_int_menu 4 41151 NULL
 +tx_frag_mpdu_alloc_failed_read_41167 tx_frag_mpdu_alloc_failed_read 3 41167 NULL
 +dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
@@ -139331,6 +139497,7 @@ index 0000000..51560ee
 +sysfs_create_link_44685 sysfs_create_link 0 44685 NULL
 +ts_read_44687 ts_read 3 44687 NULL
 +lov_emerg_alloc_44698 lov_emerg_alloc 1 44698 NULL
++__ocfs2_rotate_tree_left_44705 __ocfs2_rotate_tree_left 3 44705 NULL
 +xfer_to_user_44713 xfer_to_user 3 44713 NULL nohasharray
 +__generic_block_fiemap_44713 __generic_block_fiemap 4 44713 &xfer_to_user_44713
 +_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
@@ -139360,7 +139527,7 @@ index 0000000..51560ee
 +regmap_spi_read_44921 regmap_spi_read 3-5 44921 NULL
 +tx_queue_status_read_44978 tx_queue_status_read 3 44978 NULL
 +bytepos_delta_45017 bytepos_delta 0-2 45017 NULL
-+ptrace_writedata_45021 ptrace_writedata 4 45021 NULL
++ptrace_writedata_45021 ptrace_writedata 4-3 45021 NULL
 +dm_kvzalloc_45025 dm_kvzalloc 1 45025 NULL
 +sysfs_do_create_link_sd_45057 sysfs_do_create_link_sd 0 45057 NULL
 +sel_write_user_45060 sel_write_user 3 45060 NULL
@@ -139452,7 +139619,7 @@ index 0000000..51560ee
 +sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
 +fnic_reset_stats_read_46030 fnic_reset_stats_read 3 46030 NULL nohasharray
 +get_free_entries_46030 get_free_entries 1 46030 &fnic_reset_stats_read_46030
-+__access_remote_vm_46031 __access_remote_vm 0 46031 NULL
++__access_remote_vm_46031 __access_remote_vm 0-3-5 46031 NULL
 +snd_emu10k1x_ptr_read_46049 snd_emu10k1x_ptr_read 0 46049 NULL
 +__ocfs2_move_extent_46060 __ocfs2_move_extent 3-4 46060 NULL nohasharray
 +dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 &__ocfs2_move_extent_46060
@@ -139578,6 +139745,7 @@ index 0000000..51560ee
 +sta_vht_capa_read_47409 sta_vht_capa_read 3 47409 NULL
 +crypto_ablkcipher_alignmask_47410 crypto_ablkcipher_alignmask 0 47410 NULL
 +lbs_wrrf_write_47418 lbs_wrrf_write 3 47418 NULL
++environ_read_47451 environ_read 3 47451 NULL
 +nvme_trans_send_fw_cmd_47479 nvme_trans_send_fw_cmd 4 47479 NULL
 +newpart_47485 newpart 6-4 47485 NULL
 +core_sys_select_47494 core_sys_select 1 47494 NULL
@@ -139817,6 +139985,7 @@ index 0000000..51560ee
 +dn_mss_from_pmtu_50011 dn_mss_from_pmtu 0-2 50011 NULL
 +xfs_ialloc_inode_init_50015 xfs_ialloc_inode_init 0 50015 NULL
 +security_context_to_sid_50019 security_context_to_sid 2 50019 NULL
++ptrace_readdata_50020 ptrace_readdata 2-4 50020 NULL
 +isdn_read_50021 isdn_read 3 50021 NULL
 +mdc_rename_pack_50023 mdc_rename_pack 4-6 50023 NULL
 +brcmf_debugfs_chipinfo_read_50033 brcmf_debugfs_chipinfo_read 3 50033 NULL
@@ -139951,7 +140120,8 @@ index 0000000..51560ee
 +init_map_ipmac_51317 init_map_ipmac 5 51317 NULL
 +alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
 +ext2_xattr_get_51327 ext2_xattr_get 0 51327 NULL
-+alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
++alloc_smp_req_51337 alloc_smp_req 1 51337 NULL nohasharray
++compat_arch_ptrace_51337 compat_arch_ptrace 3 51337 &alloc_smp_req_51337
 +ipw_get_event_log_len_51341 ipw_get_event_log_len 0 51341 NULL
 +ieee80211_if_fmt_estab_plinks_51370 ieee80211_if_fmt_estab_plinks 3 51370 NULL
 +radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
@@ -140334,6 +140504,7 @@ index 0000000..51560ee
 +memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
 +lbs_failcount_write_55276 lbs_failcount_write 3 55276 NULL
 +persistent_ram_new_55286 persistent_ram_new 2-1 55286 NULL
++ptrace_request_55288 ptrace_request 3 55288 NULL
 +rx_streaming_interval_read_55291 rx_streaming_interval_read 3 55291 NULL nohasharray
 +xd_read_cis_55291 xd_read_cis 4 55291 &rx_streaming_interval_read_55291
 +lov_get_stripecnt_55297 lov_get_stripecnt 0-3 55297 NULL
@@ -140590,6 +140761,7 @@ index 0000000..51560ee
 +ld2_57794 ld2 0 57794 NULL
 +ivtv_read_57796 ivtv_read 3 57796 NULL
 +ion_test_ioctl_57799 ion_test_ioctl 2 57799 NULL
++generic_ptrace_peekdata_57806 generic_ptrace_peekdata 2 57806 NULL
 +bfad_debugfs_read_regrd_57830 bfad_debugfs_read_regrd 3 57830 NULL
 +copy_to_user_57835 copy_to_user 3-0 57835 NULL
 +xfs_rtpick_extent_57843 xfs_rtpick_extent 0 57843 NULL nohasharray
@@ -140691,6 +140863,7 @@ index 0000000..51560ee
 +ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout_58965 ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout 3 58965 NULL
 +crypto_aead_ivsize_58970 crypto_aead_ivsize 0 58970 NULL
 +__mem_cgroup_try_charge_58976 __mem_cgroup_try_charge 0 58976 NULL
++bch_extent_to_text_58987 bch_extent_to_text 2 58987 NULL
 +init_list_set_59005 init_list_set 3 59005 NULL
 +ep_write_59008 ep_write 3 59008 NULL
 +lpfc_idiag_baracc_write_59014 lpfc_idiag_baracc_write 3 59014 NULL
@@ -140777,6 +140950,7 @@ index 0000000..51560ee
 +pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
 +l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
 +ffs_prepare_buffer_59892 ffs_prepare_buffer 2 59892 NULL
++ocfs2_extend_rotate_transaction_59894 ocfs2_extend_rotate_transaction 2-3 59894 NULL
 +kvm_mmu_notifier_invalidate_range_start_59944 kvm_mmu_notifier_invalidate_range_start 3-4 59944 NULL
 +ath10k_read_dfs_stats_59949 ath10k_read_dfs_stats 3 59949 NULL
 +dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL nohasharray
@@ -140997,10 +141171,12 @@ index 0000000..51560ee
 +nfsd_read_file_62241 nfsd_read_file 6 62241 NULL
 +subtract_dirty_62242 subtract_dirty 2-3 62242 NULL
 +ion_handle_test_dma_62262 ion_handle_test_dma 4-5 62262 NULL
++get_random_int_62279 get_random_int 0 62279 NULL
 +il_dbgfs_sram_read_62296 il_dbgfs_sram_read 3 62296 NULL
 +sparse_early_usemaps_alloc_pgdat_section_62304 sparse_early_usemaps_alloc_pgdat_section 2 62304 NULL
 +subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
 +Wb35Reg_BurstWrite_62327 Wb35Reg_BurstWrite 4 62327 NULL
++ocfs2_xattr_buckets_per_cluster_62330 ocfs2_xattr_buckets_per_cluster 0 62330 NULL
 +subseq_list_62332 subseq_list 3-0 62332 NULL
 +ll_statahead_max_seq_write_62333 ll_statahead_max_seq_write 3 62333 NULL
 +flash_write_62354 flash_write 3 62354 NULL
@@ -141145,6 +141321,7 @@ index 0000000..51560ee
 +bypass_wd_write_64120 bypass_wd_write 3 64120 NULL
 +ext4_prepare_inline_data_64124 ext4_prepare_inline_data 3 64124 NULL
 +init_bch_64130 init_bch 1-2 64130 NULL
++SYSC_ptrace_64136 SYSC_ptrace 3 64136 NULL
 +ablkcipher_copy_iv_64140 ablkcipher_copy_iv 3 64140 NULL
 +dlfb_ops_write_64150 dlfb_ops_write 3 64150 NULL
 +cpumask_scnprintf_64170 cpumask_scnprintf 0-2 64170 NULL
@@ -141374,7 +141551,7 @@ index 0000000..560cd7b
 +zpios_read_64734 zpios_read 3 64734 NULL
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 new file mode 100644
-index 0000000..7e07890
+index 0000000..2133228
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
 @@ -0,0 +1,260 @@
@@ -141411,7 +141588,7 @@ index 0000000..7e07890
 +tree size_overflow_type_TI;
 +
 +static struct plugin_info size_overflow_plugin_info = {
-+	.version	= "20140725_01",
++	.version	= "20140725_02",
 +	.help		= "no-size-overflow\tturn off size overflow checking\n",
 +};
 +
diff --git a/3.14.49/4425_grsec_remove_EI_PAX.patch b/3.14.50/4425_grsec_remove_EI_PAX.patch
index a80a5d7..a80a5d7 100644
--- a/3.14.49/4425_grsec_remove_EI_PAX.patch
+++ b/3.14.50/4425_grsec_remove_EI_PAX.patch
diff --git a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
index 4c236cc..4c236cc 100644
--- a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.14.49/4430_grsec-remove-localversion-grsec.patch b/3.14.50/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.14.49/4430_grsec-remove-localversion-grsec.patch
+++ b/3.14.50/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.14.49/4435_grsec-mute-warnings.patch b/3.14.50/4435_grsec-mute-warnings.patch
index 2c2d463..2c2d463 100644
--- a/3.14.49/4435_grsec-mute-warnings.patch
+++ b/3.14.50/4435_grsec-mute-warnings.patch
diff --git a/3.14.49/4440_grsec-remove-protected-paths.patch b/3.14.50/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.14.49/4440_grsec-remove-protected-paths.patch
+++ b/3.14.50/4440_grsec-remove-protected-paths.patch
diff --git a/3.14.49/4450_grsec-kconfig-default-gids.patch b/3.14.50/4450_grsec-kconfig-default-gids.patch
index b96defc..b96defc 100644
--- a/3.14.49/4450_grsec-kconfig-default-gids.patch
+++ b/3.14.50/4450_grsec-kconfig-default-gids.patch
diff --git a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
index bba906e..bba906e 100644
--- a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.14.49/4470_disable-compat_vdso.patch b/3.14.50/4470_disable-compat_vdso.patch
index 3b3953b..3b3953b 100644
--- a/3.14.49/4470_disable-compat_vdso.patch
+++ b/3.14.50/4470_disable-compat_vdso.patch
diff --git a/3.14.49/4475_emutramp_default_on.patch b/3.14.50/4475_emutramp_default_on.patch
index a128205..a128205 100644
--- a/3.14.49/4475_emutramp_default_on.patch
+++ b/3.14.50/4475_emutramp_default_on.patch
diff --git a/3.2.69/0000_README b/3.2.70/0000_README
index 96cd54d..52d8c39 100644
--- a/3.2.69/0000_README
+++ b/3.2.70/0000_README
@@ -194,7 +194,11 @@ Patch:	1068_linux-3.2.69.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.69
 
-Patch:	4420_grsecurity-3.1-3.2.69-201508020900.patch
+Patch:	1069_linux-3.2.70.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.70
+
+Patch:	4420_grsecurity-3.1-3.2.70-201508102127.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.69/1021_linux-3.2.22.patch b/3.2.70/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.69/1021_linux-3.2.22.patch
+++ b/3.2.70/1021_linux-3.2.22.patch
diff --git a/3.2.69/1022_linux-3.2.23.patch b/3.2.70/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.69/1022_linux-3.2.23.patch
+++ b/3.2.70/1022_linux-3.2.23.patch
diff --git a/3.2.69/1023_linux-3.2.24.patch b/3.2.70/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.69/1023_linux-3.2.24.patch
+++ b/3.2.70/1023_linux-3.2.24.patch
diff --git a/3.2.69/1024_linux-3.2.25.patch b/3.2.70/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.69/1024_linux-3.2.25.patch
+++ b/3.2.70/1024_linux-3.2.25.patch
diff --git a/3.2.69/1025_linux-3.2.26.patch b/3.2.70/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.69/1025_linux-3.2.26.patch
+++ b/3.2.70/1025_linux-3.2.26.patch
diff --git a/3.2.69/1026_linux-3.2.27.patch b/3.2.70/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.69/1026_linux-3.2.27.patch
+++ b/3.2.70/1026_linux-3.2.27.patch
diff --git a/3.2.69/1027_linux-3.2.28.patch b/3.2.70/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.69/1027_linux-3.2.28.patch
+++ b/3.2.70/1027_linux-3.2.28.patch
diff --git a/3.2.69/1028_linux-3.2.29.patch b/3.2.70/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.69/1028_linux-3.2.29.patch
+++ b/3.2.70/1028_linux-3.2.29.patch
diff --git a/3.2.69/1029_linux-3.2.30.patch b/3.2.70/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.69/1029_linux-3.2.30.patch
+++ b/3.2.70/1029_linux-3.2.30.patch
diff --git a/3.2.69/1030_linux-3.2.31.patch b/3.2.70/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.69/1030_linux-3.2.31.patch
+++ b/3.2.70/1030_linux-3.2.31.patch
diff --git a/3.2.69/1031_linux-3.2.32.patch b/3.2.70/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.69/1031_linux-3.2.32.patch
+++ b/3.2.70/1031_linux-3.2.32.patch
diff --git a/3.2.69/1032_linux-3.2.33.patch b/3.2.70/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.69/1032_linux-3.2.33.patch
+++ b/3.2.70/1032_linux-3.2.33.patch
diff --git a/3.2.69/1033_linux-3.2.34.patch b/3.2.70/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.69/1033_linux-3.2.34.patch
+++ b/3.2.70/1033_linux-3.2.34.patch
diff --git a/3.2.69/1034_linux-3.2.35.patch b/3.2.70/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.69/1034_linux-3.2.35.patch
+++ b/3.2.70/1034_linux-3.2.35.patch
diff --git a/3.2.69/1035_linux-3.2.36.patch b/3.2.70/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.69/1035_linux-3.2.36.patch
+++ b/3.2.70/1035_linux-3.2.36.patch
diff --git a/3.2.69/1036_linux-3.2.37.patch b/3.2.70/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.69/1036_linux-3.2.37.patch
+++ b/3.2.70/1036_linux-3.2.37.patch
diff --git a/3.2.69/1037_linux-3.2.38.patch b/3.2.70/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.69/1037_linux-3.2.38.patch
+++ b/3.2.70/1037_linux-3.2.38.patch
diff --git a/3.2.69/1038_linux-3.2.39.patch b/3.2.70/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.69/1038_linux-3.2.39.patch
+++ b/3.2.70/1038_linux-3.2.39.patch
diff --git a/3.2.69/1039_linux-3.2.40.patch b/3.2.70/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.69/1039_linux-3.2.40.patch
+++ b/3.2.70/1039_linux-3.2.40.patch
diff --git a/3.2.69/1040_linux-3.2.41.patch b/3.2.70/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.69/1040_linux-3.2.41.patch
+++ b/3.2.70/1040_linux-3.2.41.patch
diff --git a/3.2.69/1041_linux-3.2.42.patch b/3.2.70/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.69/1041_linux-3.2.42.patch
+++ b/3.2.70/1041_linux-3.2.42.patch
diff --git a/3.2.69/1042_linux-3.2.43.patch b/3.2.70/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.69/1042_linux-3.2.43.patch
+++ b/3.2.70/1042_linux-3.2.43.patch
diff --git a/3.2.69/1043_linux-3.2.44.patch b/3.2.70/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.69/1043_linux-3.2.44.patch
+++ b/3.2.70/1043_linux-3.2.44.patch
diff --git a/3.2.69/1044_linux-3.2.45.patch b/3.2.70/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.69/1044_linux-3.2.45.patch
+++ b/3.2.70/1044_linux-3.2.45.patch
diff --git a/3.2.69/1045_linux-3.2.46.patch b/3.2.70/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.69/1045_linux-3.2.46.patch
+++ b/3.2.70/1045_linux-3.2.46.patch
diff --git a/3.2.69/1046_linux-3.2.47.patch b/3.2.70/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.69/1046_linux-3.2.47.patch
+++ b/3.2.70/1046_linux-3.2.47.patch
diff --git a/3.2.69/1047_linux-3.2.48.patch b/3.2.70/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.69/1047_linux-3.2.48.patch
+++ b/3.2.70/1047_linux-3.2.48.patch
diff --git a/3.2.69/1048_linux-3.2.49.patch b/3.2.70/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.69/1048_linux-3.2.49.patch
+++ b/3.2.70/1048_linux-3.2.49.patch
diff --git a/3.2.69/1049_linux-3.2.50.patch b/3.2.70/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.69/1049_linux-3.2.50.patch
+++ b/3.2.70/1049_linux-3.2.50.patch
diff --git a/3.2.69/1050_linux-3.2.51.patch b/3.2.70/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.69/1050_linux-3.2.51.patch
+++ b/3.2.70/1050_linux-3.2.51.patch
diff --git a/3.2.69/1051_linux-3.2.52.patch b/3.2.70/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.69/1051_linux-3.2.52.patch
+++ b/3.2.70/1051_linux-3.2.52.patch
diff --git a/3.2.69/1052_linux-3.2.53.patch b/3.2.70/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.69/1052_linux-3.2.53.patch
+++ b/3.2.70/1052_linux-3.2.53.patch
diff --git a/3.2.69/1053_linux-3.2.54.patch b/3.2.70/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.69/1053_linux-3.2.54.patch
+++ b/3.2.70/1053_linux-3.2.54.patch
diff --git a/3.2.69/1054_linux-3.2.55.patch b/3.2.70/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.69/1054_linux-3.2.55.patch
+++ b/3.2.70/1054_linux-3.2.55.patch
diff --git a/3.2.69/1055_linux-3.2.56.patch b/3.2.70/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.69/1055_linux-3.2.56.patch
+++ b/3.2.70/1055_linux-3.2.56.patch
diff --git a/3.2.69/1056_linux-3.2.57.patch b/3.2.70/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.69/1056_linux-3.2.57.patch
+++ b/3.2.70/1056_linux-3.2.57.patch
diff --git a/3.2.69/1057_linux-3.2.58.patch b/3.2.70/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.69/1057_linux-3.2.58.patch
+++ b/3.2.70/1057_linux-3.2.58.patch
diff --git a/3.2.69/1058_linux-3.2.59.patch b/3.2.70/1058_linux-3.2.59.patch
index cd59fe9..cd59fe9 100644
--- a/3.2.69/1058_linux-3.2.59.patch
+++ b/3.2.70/1058_linux-3.2.59.patch
diff --git a/3.2.69/1059_linux-3.2.60.patch b/3.2.70/1059_linux-3.2.60.patch
index c5a9389..c5a9389 100644
--- a/3.2.69/1059_linux-3.2.60.patch
+++ b/3.2.70/1059_linux-3.2.60.patch
diff --git a/3.2.69/1060_linux-3.2.61.patch b/3.2.70/1060_linux-3.2.61.patch
index a1bf580..a1bf580 100644
--- a/3.2.69/1060_linux-3.2.61.patch
+++ b/3.2.70/1060_linux-3.2.61.patch
diff --git a/3.2.69/1061_linux-3.2.62.patch b/3.2.70/1061_linux-3.2.62.patch
index 34217f0..34217f0 100644
--- a/3.2.69/1061_linux-3.2.62.patch
+++ b/3.2.70/1061_linux-3.2.62.patch
diff --git a/3.2.69/1062_linux-3.2.63.patch b/3.2.70/1062_linux-3.2.63.patch
index f7c7415..f7c7415 100644
--- a/3.2.69/1062_linux-3.2.63.patch
+++ b/3.2.70/1062_linux-3.2.63.patch
diff --git a/3.2.69/1063_linux-3.2.64.patch b/3.2.70/1063_linux-3.2.64.patch
index 862b4f0..862b4f0 100644
--- a/3.2.69/1063_linux-3.2.64.patch
+++ b/3.2.70/1063_linux-3.2.64.patch
diff --git a/3.2.69/1064_linux-3.2.65.patch b/3.2.70/1064_linux-3.2.65.patch
index c3ae4fa..c3ae4fa 100644
--- a/3.2.69/1064_linux-3.2.65.patch
+++ b/3.2.70/1064_linux-3.2.65.patch
diff --git a/3.2.69/1065_linux-3.2.66.patch b/3.2.70/1065_linux-3.2.66.patch
index 73fa646..73fa646 100644
--- a/3.2.69/1065_linux-3.2.66.patch
+++ b/3.2.70/1065_linux-3.2.66.patch
diff --git a/3.2.69/1066_linux-3.2.67.patch b/3.2.70/1066_linux-3.2.67.patch
index c0a9278..c0a9278 100644
--- a/3.2.69/1066_linux-3.2.67.patch
+++ b/3.2.70/1066_linux-3.2.67.patch
diff --git a/3.2.69/1067_linux-3.2.68.patch b/3.2.70/1067_linux-3.2.68.patch
index 200e8b8..200e8b8 100644
--- a/3.2.69/1067_linux-3.2.68.patch
+++ b/3.2.70/1067_linux-3.2.68.patch
diff --git a/3.2.69/1068_linux-3.2.69.patch b/3.2.70/1068_linux-3.2.69.patch
index 8848e8e..8848e8e 100644
--- a/3.2.69/1068_linux-3.2.69.patch
+++ b/3.2.70/1068_linux-3.2.69.patch
diff --git a/3.2.70/1069_linux-3.2.70.patch b/3.2.70/1069_linux-3.2.70.patch
new file mode 100644
index 0000000..b694627
--- /dev/null
+++ b/3.2.70/1069_linux-3.2.70.patch
@@ -0,0 +1,5879 @@
+diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
+index c67077c..e1a3d59 100644
+--- a/Documentation/networking/rds.txt
++++ b/Documentation/networking/rds.txt
+@@ -62,11 +62,10 @@ Socket Interface
+ ================
+ 
+   AF_RDS, PF_RDS, SOL_RDS
+-        These constants haven't been assigned yet, because RDS isn't in
+-        mainline yet. Currently, the kernel module assigns some constant
+-        and publishes it to user space through two sysctl files
+-                /proc/sys/net/rds/pf_rds
+-                /proc/sys/net/rds/sol_rds
++	AF_RDS and PF_RDS are the domain type to be used with socket(2)
++	to create RDS sockets. SOL_RDS is the socket-level to be used
++	with setsockopt(2) and getsockopt(2) for RDS specific socket
++	options.
+ 
+   fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
+         This creates a new, unbound RDS socket.
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index b04cb7d..074da62 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -164,8 +164,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
+ }
+ 
+ static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
+-			       unsigned ** const pins,
+-			       unsigned * const num_pins)
++			       const unsigned **pins,
++			       unsigned *num_pins)
+ {
+ 	*pins = (unsigned *) foo_groups[selector].pins;
+ 	*num_pins = foo_groups[selector].num_pins;
+diff --git a/Makefile b/Makefile
+index 8071888..41a626b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 0e9ce8d..a4b1186 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
+    the loader.  We need to make sure that it is out of the way of the program
+    that it will "exec", and that there is sufficient room for the brk.  */
+ 
+-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE	(TASK_SIZE / 3 * 2)
+ 
+ /* When the program starts, a1 contains a pointer to a function to be 
+    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
+diff --git a/arch/mips/include/asm/cacheflush.h b/arch/mips/include/asm/cacheflush.h
+index 69468de..484c5bc 100644
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -29,6 +29,20 @@
+  *  - flush_icache_all() flush the entire instruction cache
+  *  - flush_data_cache_page() flushes a page from the data cache
+  */
++
++ /*
++ * This flag is used to indicate that the page pointed to by a pte
++ * is dirty and requires cleaning before returning it to the user.
++ */
++#define PG_dcache_dirty			PG_arch_1
++
++#define Page_dcache_dirty(page)		\
++	test_bit(PG_dcache_dirty, &(page)->flags)
++#define SetPageDcacheDirty(page)	\
++	set_bit(PG_dcache_dirty, &(page)->flags)
++#define ClearPageDcacheDirty(page)	\
++	clear_bit(PG_dcache_dirty, &(page)->flags)
++
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+@@ -37,13 +51,15 @@ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ 	unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
+ extern void __flush_dcache_page(struct page *page);
++extern void __flush_icache_page(struct vm_area_struct *vma, struct page *page);
+ 
+ #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1
+ static inline void flush_dcache_page(struct page *page)
+ {
+-	if (cpu_has_dc_aliases || !cpu_has_ic_fills_f_dc)
++	if (cpu_has_dc_aliases)
+ 		__flush_dcache_page(page);
+-
++	else if (!cpu_has_ic_fills_f_dc)
++		SetPageDcacheDirty(page);
+ }
+ 
+ #define flush_dcache_mmap_lock(mapping)		do { } while (0)
+@@ -61,6 +77,11 @@ static inline void flush_anon_page(struct vm_area_struct *vma,
+ static inline void flush_icache_page(struct vm_area_struct *vma,
+ 	struct page *page)
+ {
++	if (!cpu_has_ic_fills_f_dc && (vma->vm_flags & VM_EXEC) &&
++	    Page_dcache_dirty(page)) {
++		__flush_icache_page(vma, page);
++		ClearPageDcacheDirty(page);
++	}
+ }
+ 
+ extern void (*flush_icache_range)(unsigned long start, unsigned long end);
+@@ -95,19 +116,6 @@ extern void (*flush_icache_all)(void);
+ extern void (*local_flush_data_cache_page)(void * addr);
+ extern void (*flush_data_cache_page)(unsigned long addr);
+ 
+-/*
+- * This flag is used to indicate that the page pointed to by a pte
+- * is dirty and requires cleaning before returning it to the user.
+- */
+-#define PG_dcache_dirty			PG_arch_1
+-
+-#define Page_dcache_dirty(page)		\
+-	test_bit(PG_dcache_dirty, &(page)->flags)
+-#define SetPageDcacheDirty(page)	\
+-	set_bit(PG_dcache_dirty, &(page)->flags)
+-#define ClearPageDcacheDirty(page)	\
+-	clear_bit(PG_dcache_dirty, &(page)->flags)
+-
+ /* Run kernel code uncached, useful for cache probing functions. */
+ unsigned long run_uncached(void *func);
+ 
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index ca400f7..0f4991b 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -153,8 +153,32 @@
+ #define cpu_has_mips_r	(cpu_has_mips32r1 | cpu_has_mips32r2 | \
+ 			 cpu_has_mips64r1 | cpu_has_mips64r2)
+ 
++/*
++ * cpu_has_mips_r2_exec_hazard - return if IHB is required on current processor
++ *
++ * Returns non-zero value if the current processor implementation requires
++ * an IHB instruction to deal with an instruction hazard as per MIPS R2
++ * architecture specification, zero otherwise.
++ */
+ #ifndef cpu_has_mips_r2_exec_hazard
+-#define cpu_has_mips_r2_exec_hazard cpu_has_mips_r2
++#define cpu_has_mips_r2_exec_hazard					\
++({									\
++	int __res;							\
++									\
++	switch (current_cpu_type()) {					\
++	case CPU_74K:							\
++	case CPU_CAVIUM_OCTEON:						\
++	case CPU_CAVIUM_OCTEON_PLUS:					\
++	case CPU_CAVIUM_OCTEON2:					\
++		__res = 0;						\
++		break;							\
++									\
++	default:							\
++		__res = 1;						\
++	}								\
++									\
++	__res;								\
++})
+ #endif
+ 
+ /*
+diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+index a58addb..6ae8e3c 100644
+--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+@@ -51,7 +51,6 @@
+ #define cpu_has_mips32r2	0
+ #define cpu_has_mips64r1	0
+ #define cpu_has_mips64r2	1
+-#define cpu_has_mips_r2_exec_hazard 0
+ #define cpu_has_dsp		0
+ #define cpu_has_mipsmt		0
+ #define cpu_has_vint		0
+diff --git a/arch/mips/include/asm/octeon/pci-octeon.h b/arch/mips/include/asm/octeon/pci-octeon.h
+index fba2ba2..ac83283 100644
+--- a/arch/mips/include/asm/octeon/pci-octeon.h
++++ b/arch/mips/include/asm/octeon/pci-octeon.h
+@@ -11,9 +11,6 @@
+ 
+ #include <linux/pci.h>
+ 
+-/* Some PCI cards require delays when accessing config space. */
+-#define PCI_CONFIG_SPACE_DELAY 10000
+-
+ /*
+  * The physical memory base mapped by BAR1.  256MB at the end of the
+  * first 4GB.
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index 7f50318..6e489e5 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -111,7 +111,7 @@ void __init init_IRQ(void)
+ #endif
+ }
+ 
+-#ifdef DEBUG_STACKOVERFLOW
++#ifdef CONFIG_DEBUG_STACKOVERFLOW
+ static inline void check_stack_overflow(void)
+ {
+ 	unsigned long sp;
+diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
+index 829320c..0f8839b 100644
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -118,6 +118,18 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr)
+ 
+ EXPORT_SYMBOL(__flush_anon_page);
+ 
++void __flush_icache_page(struct vm_area_struct *vma, struct page *page)
++{
++	unsigned long addr;
++
++	if (PageHighMem(page))
++		return;
++
++	addr = (unsigned long) page_address(page);
++	flush_data_cache_page(addr);
++}
++EXPORT_SYMBOL_GPL(__flush_icache_page);
++
+ void __update_cache(struct vm_area_struct *vma, unsigned long address,
+ 	pte_t pte)
+ {
+diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
+index ed1c542..66d3c38 100644
+--- a/arch/mips/pci/pci-octeon.c
++++ b/arch/mips/pci/pci-octeon.c
+@@ -279,9 +279,6 @@ static int octeon_read_config(struct pci_bus *bus, unsigned int devfn,
+ 	pci_addr.s.func = devfn & 0x7;
+ 	pci_addr.s.reg = reg;
+ 
+-#if PCI_CONFIG_SPACE_DELAY
+-	udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ 	switch (size) {
+ 	case 4:
+ 		*val = le32_to_cpu(cvmx_read64_uint32(pci_addr.u64));
+@@ -316,9 +313,6 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+ 	pci_addr.s.func = devfn & 0x7;
+ 	pci_addr.s.reg = reg;
+ 
+-#if PCI_CONFIG_SPACE_DELAY
+-	udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ 	switch (size) {
+ 	case 4:
+ 		cvmx_write64_uint32(pci_addr.u64, cpu_to_le32(val));
+diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
+index 0583c463..37a8790 100644
+--- a/arch/mips/pci/pcie-octeon.c
++++ b/arch/mips/pci/pcie-octeon.c
+@@ -1219,9 +1219,6 @@ static inline int octeon_pcie_write_config(int pcie_port, struct pci_bus *bus,
+ 					devfn & 0x7, reg, val);
+ 		return PCIBIOS_SUCCESSFUL;
+ 	}
+-#if PCI_CONFIG_SPACE_DELAY
+-	udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ 	return PCIBIOS_FUNC_NOT_SUPPORTED;
+ }
+ 
+diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
+index 5bf34ec..2ca1735 100644
+--- a/arch/mips/power/hibernate.S
++++ b/arch/mips/power/hibernate.S
+@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend)
+ END(swsusp_arch_suspend)
+ 
+ LEAF(swsusp_arch_resume)
++	/* Avoid TLB mismatch during and after kernel resume */
++	jal local_flush_tlb_all
+ 	PTR_L t0, restore_pblist
+ 0:
+ 	PTR_L t1, PBE_ADDRESS(t0)   /* source */
+@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume)
+ 	bne t1, t3, 1b
+ 	PTR_L t0, PBE_NEXT(t0)
+ 	bnez t0, 0b
+-	jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
+ 	PTR_LA t0, saved_regs
+ 	PTR_L ra, PT_R31(t0)
+ 	PTR_L sp, PT_R29(t0)
+diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
+index a7bb757..c3f1be95 100644
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -121,11 +121,13 @@ extern void __ashrdi3(void);
+ extern void __ashldi3(void);
+ extern void __lshrdi3(void);
+ extern void __muldi3(void);
++extern void __ucmpdi2(void);
+ 
+ EXPORT_SYMBOL(__ashrdi3);
+ EXPORT_SYMBOL(__ashldi3);
+ EXPORT_SYMBOL(__lshrdi3);
+ EXPORT_SYMBOL(__muldi3);
++EXPORT_SYMBOL(__ucmpdi2);
+ 
+ asmlinkage void * __canonicalize_funcptr_for_compare(void *);
+ EXPORT_SYMBOL(__canonicalize_funcptr_for_compare);
+diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
+index 5f2e690..5651536 100644
+--- a/arch/parisc/lib/Makefile
++++ b/arch/parisc/lib/Makefile
+@@ -2,6 +2,7 @@
+ # Makefile for parisc-specific library files
+ #
+ 
+-lib-y	:= lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o
++lib-y	:= lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
++	   ucmpdi2.o
+ 
+ obj-y	:= iomap.o
+diff --git a/arch/parisc/lib/ucmpdi2.c b/arch/parisc/lib/ucmpdi2.c
+new file mode 100644
+index 0000000..149c016
+--- /dev/null
++++ b/arch/parisc/lib/ucmpdi2.c
+@@ -0,0 +1,25 @@
++#include <linux/module.h>
++
++union ull_union {
++	unsigned long long ull;
++	struct {
++		unsigned int high;
++		unsigned int low;
++	} ui;
++};
++
++int __ucmpdi2(unsigned long long a, unsigned long long b)
++{
++	union ull_union au = {.ull = a};
++	union ull_union bu = {.ull = b};
++
++	if (au.ui.high < bu.ui.high)
++		return 0;
++	else if (au.ui.high > bu.ui.high)
++		return 2;
++	if (au.ui.low < bu.ui.low)
++		return 0;
++	else if (au.ui.low > bu.ui.low)
++		return 2;
++	return 1;
++}
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 02ebe1a..4f15565 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -62,12 +62,22 @@ struct cache_type_info {
+ };
+ 
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED     0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA        2
++#define CACHE_TYPE_UNIFIED     0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D   1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA        3
+ 
+ static const struct cache_type_info cache_type_info[] = {
+ 	{
++		/* Embedded systems that use cache-size, cache-block-size,
++		 * etc. for the Unified (typically L2) cache. */
++		.name            = "Unified",
++		.size_prop       = "cache-size",
++		.line_size_props = { "cache-line-size",
++				     "cache-block-size", },
++		.nr_sets_prop    = "cache-sets",
++	},
++	{
+ 		/* PowerPC Processor binding says the [di]-cache-*
+ 		 * must be equal on unified caches, so just use
+ 		 * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
+ {
+ 	struct cache *iter;
+ 
+-	if (cache->type == CACHE_TYPE_UNIFIED)
++	if (cache->type == CACHE_TYPE_UNIFIED ||
++	    cache->type == CACHE_TYPE_UNIFIED_D)
+ 		return cache;
+ 
+ 	list_for_each_entry(iter, &cache_list, list)
+@@ -324,15 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np)
+ 	return of_get_property(np, "cache-unified", NULL);
+ }
+ 
+-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++/*
++ * Unified caches can have two different sets of tags.  Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc.   Check on initialization for which type we have, and
++ * return the appropriate structure type.  Assume it's embedded if it isn't
++ * open firmware.  If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+-	struct cache *cache;
++	return of_get_property(np,
++		cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++		CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+ 
++/*
++ */
++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ 	pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+ 
+-	cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+-	return cache;
++	return new_cache(cache_is_unified_d(node), level, node);
+ }
+ 
+ static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
+diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c
+index 564c1d8..e80026c 100644
+--- a/arch/powerpc/kernel/perf_callchain.c
++++ b/arch/powerpc/kernel/perf_callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
+ 	sp = regs->gpr[1];
+ 	perf_callchain_store(entry, next_ip);
+ 
+-	for (;;) {
++	while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ 		fp = (unsigned long __user *) sp;
+ 		if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ 			return;
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 82288e9..83940d7 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -428,7 +428,7 @@ void __init smp_setup_cpu_maps(void)
+ 	DBG("smp_setup_cpu_maps()\n");
+ 
+ 	while ((dn = of_find_node_by_type(dn, "cpu")) && cpu < nr_cpu_ids) {
+-		const int *intserv;
++		const __be32 *intserv;
+ 		int j, len;
+ 
+ 		DBG("  * %s...\n", dn->full_name);
+@@ -447,10 +447,18 @@ void __init smp_setup_cpu_maps(void)
+ 		}
+ 
+ 		for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
++			bool avail;
++
+ 			DBG("    thread %d -> cpu %d (hard id %d)\n",
+-			    j, cpu, intserv[j]);
+-			set_cpu_present(cpu, of_device_is_available(dn));
+-			set_hard_smp_processor_id(cpu, intserv[j]);
++			    j, cpu, be32_to_cpu(intserv[j]));
++
++			avail = of_device_is_available(dn);
++			if (!avail)
++				avail = !of_property_match_string(dn,
++						"enable-method", "spin-table");
++
++			set_cpu_present(cpu, avail);
++			set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
+ 			set_cpu_possible(cpu, true);
+ 			cpu++;
+ 		}
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 3e8fe4b..cec664a 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -212,6 +212,7 @@ SECTIONS
+ 		*(.opd)
+ 	}
+ 
++	. = ALIGN(256);
+ 	.got : AT(ADDR(.got) - LOAD_OFFSET) {
+ 		__toc_start = .;
+ 		*(.got)
+diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
+index 5a783d8..67a42ed 100644
+--- a/arch/powerpc/mm/mmap_64.c
++++ b/arch/powerpc/mm/mmap_64.c
+@@ -53,14 +53,6 @@ static inline int mmap_is_legacy(void)
+ 	return sysctl_legacy_va_layout;
+ }
+ 
+-/*
+- * Since get_random_int() returns the same value within a 1 jiffy window,
+- * we will almost always get the same randomisation for the stack and mmap
+- * region. This will mean the relative distance between stack and mmap will
+- * be the same.
+- *
+- * To avoid this we can shift the randomness by 1 bit.
+- */
+ static unsigned long mmap_rnd(void)
+ {
+ 	unsigned long rnd = 0;
+@@ -68,11 +60,11 @@ static unsigned long mmap_rnd(void)
+ 	if (current->flags & PF_RANDOMIZE) {
+ 		/* 8MB for 32bit, 1GB for 64bit */
+ 		if (is_32bit_task())
+-			rnd = (long)(get_random_int() % (1<<(22-PAGE_SHIFT)));
++			rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+ 		else
+-			rnd = (long)(get_random_int() % (1<<(29-PAGE_SHIFT)));
++			rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+ 	}
+-	return (rnd << PAGE_SHIFT) * 2;
++	return rnd << PAGE_SHIFT;
+ }
+ 
+ static inline unsigned long mmap_base(void)
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 0f1b706..2767276 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ 		goto out;
+ 	}
+ 
++	rc = dlpar_acquire_drc(drc_index);
++	if (rc) {
++		rc = -EINVAL;
++		goto out;
++	}
++
+ 	dn = dlpar_configure_connector(drc_index);
+ 	if (!dn) {
+ 		rc = -EINVAL;
+@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ 	kfree(dn->full_name);
+ 	dn->full_name = cpu_name;
+ 
+-	rc = dlpar_acquire_drc(drc_index);
+-	if (rc) {
+-		dlpar_free_cc_nodes(dn);
+-		rc = -EINVAL;
+-		goto out;
+-	}
+-
+ 	rc = dlpar_attach_node(dn);
+ 	if (rc) {
+ 		dlpar_release_drc(drc_index);
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index 31086ea..568521a 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -16,11 +16,12 @@
+ #define GHASH_DIGEST_SIZE	16
+ 
+ struct ghash_ctx {
+-	u8 icv[16];
+-	u8 key[16];
++	u8 key[GHASH_BLOCK_SIZE];
+ };
+ 
+ struct ghash_desc_ctx {
++	u8 icv[GHASH_BLOCK_SIZE];
++	u8 key[GHASH_BLOCK_SIZE];
+ 	u8 buffer[GHASH_BLOCK_SIZE];
+ 	u32 bytes;
+ };
+@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
+ static int ghash_init(struct shash_desc *desc)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ 
+ 	memset(dctx, 0, sizeof(*dctx));
++	memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
+ 
+ 	return 0;
+ }
+@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ 	}
+ 
+ 	memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
+-	memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
+ 
+ 	return 0;
+ }
+@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
+ 			 const u8 *src, unsigned int srclen)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+-	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ 	unsigned int n;
+ 	u8 *buf = dctx->buffer;
+ 	int ret;
+@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
+ 		src += n;
+ 
+ 		if (!dctx->bytes) {
+-			ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
++			ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
+ 					      GHASH_BLOCK_SIZE);
+ 			if (ret != GHASH_BLOCK_SIZE)
+ 				return -EIO;
+@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc,
+ 
+ 	n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ 	if (n) {
+-		ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
++		ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
+ 		if (ret != n)
+ 			return -EIO;
+ 		src += n;
+@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc,
+ 	return 0;
+ }
+ 
+-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_desc_ctx *dctx)
+ {
+ 	u8 *buf = dctx->buffer;
+ 	int ret;
+@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+ 
+ 		memset(pos, 0, dctx->bytes);
+ 
+-		ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
++		ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
+ 		if (ret != GHASH_BLOCK_SIZE)
+ 			return -EIO;
++
++		dctx->bytes = 0;
+ 	}
+ 
+-	dctx->bytes = 0;
+ 	return 0;
+ }
+ 
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ 	struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+-	struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ 	int ret;
+ 
+-	ret = ghash_flush(ctx, dctx);
++	ret = ghash_flush(dctx);
+ 	if (!ret)
+-		memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++		memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
+ 	return ret;
+ }
+ 
+diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
+index 47df775..ba17092 100644
+--- a/arch/s390/kernel/suspend.c
++++ b/arch/s390/kernel/suspend.c
+@@ -9,6 +9,8 @@
+ #include <linux/pfn.h>
+ #include <linux/suspend.h>
+ #include <linux/mm.h>
++#include <asm/ipl.h>
++#include <asm/sections.h>
+ #include <asm/system.h>
+ 
+ /*
+@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn)
+ {
+ 	unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
+ 	unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
++	unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
++	unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
+ 
+ 	/* Always save lowcore pages (LC protection might be enabled). */
+ 	if (pfn <= LC_PAGES)
+@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn)
+ 	if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
+ 		return 1;
+ 	/* Skip memory holes and read-only pages (NSS, DCSS, ...). */
++	if (pfn >= stext_pfn && pfn <= eshared_pfn)
++		return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
+ 	if (tprot(PFN_PHYS(pfn)))
+ 		return 1;
+ 	return 0;
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index d026389..c593e1e 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -219,6 +219,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
+ 	for (n = mem->count - 1; n > 0 ; n--)
+ 		memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
+ 
++	memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
+ 	mem->vm[0].cpus_total = cpus;
+ 	mem->vm[0].cpus_configured = cpus;
+ 	mem->vm[0].cpus_standby = 0;
+diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c
+index f1cf6ef..a0ef32e 100644
+--- a/arch/sparc/kernel/leon_pci.c
++++ b/arch/sparc/kernel/leon_pci.c
+@@ -78,7 +78,6 @@ EXPORT_SYMBOL(pcibios_bus_to_resource);
+ 
+ void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
+ {
+-	struct leon_pci_info *info = pbus->sysdata;
+ 	struct pci_dev *dev;
+ 	int i, has_io, has_mem;
+ 	u16 cmd;
+@@ -153,18 +152,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
+ 	return pci_enable_resources(dev, mask);
+ }
+ 
+-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev)
+-{
+-	/*
+-	 * Currently the OpenBoot nodes are not connected with the PCI device,
+-	 * this is because the LEON PROM does not create PCI nodes. Eventually
+-	 * this will change and the same approach as pcic.c can be used to
+-	 * match PROM nodes with pci devices.
+-	 */
+-	return NULL;
+-}
+-EXPORT_SYMBOL(pci_device_to_OF_node);
+-
+ void __devinit pcibios_update_irq(struct pci_dev *dev, int irq)
+ {
+ #ifdef CONFIG_PCI_DEBUG
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 5e4252b..0ff682d 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -368,11 +368,11 @@ static unsigned long mmap_rnd(void)
+ 	if (current->flags & PF_RANDOMIZE) {
+ 		unsigned long val = get_random_int();
+ 		if (test_thread_flag(TIF_32BIT))
+-			rnd = (val % (1UL << (22UL-PAGE_SHIFT)));
++			rnd = (val % (1UL << (23UL-PAGE_SHIFT)));
+ 		else
+-			rnd = (val % (1UL << (29UL-PAGE_SHIFT)));
++			rnd = (val % (1UL << (30UL-PAGE_SHIFT)));
+ 	}
+-	return (rnd << PAGE_SHIFT) * 2;
++	return rnd << PAGE_SHIFT;
+ }
+ 
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 28a1bca..d720208 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -133,7 +133,8 @@ config SBUS
+ 	bool
+ 
+ config NEED_DMA_MAP_STATE
+-       def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG)
++	def_bool y
++	depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
+ 
+ config NEED_SG_DMA_LENGTH
+ 	def_bool y
+diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
+index f229b13..0c54822 100644
+--- a/arch/x86/include/asm/iommu_table.h
++++ b/arch/x86/include/asm/iommu_table.h
+@@ -79,11 +79,12 @@ struct iommu_table_entry {
+  *  d). Similar to the 'init', except that this gets called from pci_iommu_init
+  *      where we do have a memory allocator.
+  *
+- * The standard vs the _FINISH differs in that the _FINISH variant will
+- * continue detecting other IOMMUs in the call list after the
+- * the detection routine returns a positive number. The _FINISH will
+- * stop the execution chain. Both will still call the 'init' and
+- * 'late_init' functions if they are set.
++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
++ * in that the former will continue detecting other IOMMUs in the call
++ * list after the detection routine returns a positive number, while the
++ * latter will stop the execution chain upon first successful detection.
++ * Both variants will still call the 'init' and 'late_init' functions if
++ * they are set.
+  */
+ #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init)		\
+ 	__IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 41b2f57..78842ce 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -700,9 +700,12 @@ void native_machine_shutdown(void)
+ 	/* Make certain I only run on the appropriate processor */
+ 	set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
+ 
+-	/* O.K Now that I'm on the appropriate processor,
+-	 * stop all of the others.
++	/*
++	 * O.K Now that I'm on the appropriate processor, stop all of the
++	 * others. Also disable the local irq to not receive the per-cpu
++	 * timer interrupt which may trigger scheduler's load balance.
+ 	 */
++	local_irq_disable();
+ 	stop_other_cpus();
+ #endif
+ 
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index bfc9507..4a949c7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3609,7 +3609,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ 		}
+ 	}
+ 
+-	mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
++	mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
+ 	for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+ 		pte_size = sp->role.cr4_pae ? 8 : 4;
+ 		misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 8831c43..421958f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3032,8 +3032,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+ 
+ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+-	unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
+-		    KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
++	/*
++	 * Pass through host's Machine Check Enable value to hw_cr4, which
++	 * is in force while we are in guest mode.  Do not let guests control
++	 * this bit, even if host CR4.MCE == 0.
++	 */
++	unsigned long hw_cr4 =
++		(read_cr4() & X86_CR4_MCE) |
++		(cr4 & ~X86_CR4_MCE) |
++		(to_vmx(vcpu)->rmode.vm86_active ?
++		 KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
+ 
+ 	if (cr4 & X86_CR4_VMXE) {
+ 		/*
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 554b7b5..433b21d 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n)
+ 	char c;
+ 
+ 	while (1) {
+-		if (res>n)
++		if (res >= n)
+ 			return n+1;
+ 		if (__get_user(c, s))
+ 			return 0;
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 5a5b6e4..11e3100 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -150,7 +150,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 	}
+ 	cleanup_addr = proglen; /* epilogue address */
+ 
+-	for (pass = 0; pass < 10; pass++) {
++	/* JITed image shrinks with every pass and the loop iterates
++	 * until the image stops shrinking. Very large bpf programs
++	 * may converge on the last pass. In such case do one more
++	 * pass to emit the final image
++	 */
++	for (pass = 0; pass < 10 || image; pass++) {
+ 		u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ 		/* no prologue/epilogue for trivial filters (RET something) */
+ 		proglen = 0;
+diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
+index b7491ee..6454fe6 100644
+--- a/drivers/acpi/acpica/acmacros.h
++++ b/drivers/acpi/acpica/acmacros.h
+@@ -59,19 +59,15 @@
+ #define ACPI_SET64(ptr)                 *ACPI_CAST_PTR (u64, ptr)
+ 
+ /*
+- * printf() format helpers
++ * printf() format helper. This macros is a workaround for the difficulties
++ * with emitting 64-bit integers and 64-bit pointers with the same code
++ * for both 32-bit and 64-bit hosts.
+  */
+ 
+ /* Split 64-bit integer into two 32-bit values. Use with %8.8_x%8.8_x */
+ 
+ #define ACPI_FORMAT_UINT64(i)           ACPI_HIDWORD(i), ACPI_LODWORD(i)
+ 
+-#if ACPI_MACHINE_WIDTH == 64
+-#define ACPI_FORMAT_NATIVE_UINT(i)      ACPI_FORMAT_UINT64(i)
+-#else
+-#define ACPI_FORMAT_NATIVE_UINT(i)      0, (i)
+-#endif
+-
+ /*
+  * Macros for moving data around to/from buffers that are possibly unaligned.
+  * If the hardware supports the transfer of unaligned data, just do the store.
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index c627a28..9d19587 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ 			  obj_desc,
+-			  ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++			  ACPI_FORMAT_UINT64(obj_desc->region.address),
+ 			  obj_desc->region.length));
+ 
+ 	/* Now the address and length are valid for this opregion */
+@@ -545,7 +545,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ 			  obj_desc,
+-			  ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++			  ACPI_FORMAT_UINT64(obj_desc->region.address),
+ 			  obj_desc->region.length));
+ 
+ 	/* Now the address and length are valid for this opregion */
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index f0edf5c..cb18ab4 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -450,8 +450,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
+ 	ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ 			  "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ 			  &region_obj->region.handler->address_space, handler,
+-			  ACPI_FORMAT_NATIVE_UINT(region_obj->region.address +
+-						  region_offset),
++			  ACPI_FORMAT_UINT64(region_obj->region.address +
++					     region_offset),
+ 			  acpi_ut_get_region_name(region_obj->region.
+ 						  space_id)));
+ 
+diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
+index 61b8c0e..c572fa0 100644
+--- a/drivers/acpi/acpica/exdump.c
++++ b/drivers/acpi/acpica/exdump.c
+@@ -613,8 +613,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)
+ 			acpi_os_printf("\n");
+ 		} else {
+ 			acpi_os_printf(" base %8.8X%8.8X Length %X\n",
+-				       ACPI_FORMAT_NATIVE_UINT(obj_desc->region.
+-							       address),
++				       ACPI_FORMAT_UINT64(obj_desc->region.
++							  address),
+ 				       obj_desc->region.length);
+ 		}
+ 		break;
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index b334f54..be22142 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -257,17 +257,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc,
+ 	}
+ 
+ 	ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD,
+-			      " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n",
++			      " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n",
+ 			      acpi_ut_get_region_name(rgn_desc->region.
+ 						      space_id),
+ 			      rgn_desc->region.space_id,
+ 			      obj_desc->common_field.access_byte_width,
+ 			      obj_desc->common_field.base_byte_offset,
+-			      field_datum_byte_offset, ACPI_CAST_PTR(void,
+-								     (rgn_desc->
+-								      region.
+-								      address +
+-								      region_offset))));
++			      field_datum_byte_offset,
++			      ACPI_FORMAT_UINT64(rgn_desc->region.address +
++						 region_offset)));
+ 
+ 	/* Invoke the appropriate address_space/op_region handler */
+ 
+diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
+index f0d5e14..dd5e930 100644
+--- a/drivers/acpi/acpica/exregion.c
++++ b/drivers/acpi/acpica/exregion.c
+@@ -174,7 +174,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ 		if (!mem_info->mapped_logical_address) {
+ 			ACPI_ERROR((AE_INFO,
+ 				    "Could not map memory at 0x%8.8X%8.8X, size %u",
+-				    ACPI_FORMAT_NATIVE_UINT(address),
++				    ACPI_FORMAT_UINT64(address),
+ 				    (u32) map_length));
+ 			mem_info->mapped_length = 0;
+ 			return_ACPI_STATUS(AE_NO_MEMORY);
+@@ -195,8 +195,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ 			  "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n",
+-			  bit_width, function,
+-			  ACPI_FORMAT_NATIVE_UINT(address)));
++			  bit_width, function, ACPI_FORMAT_UINT64(address)));
+ 
+ 	/*
+ 	 * Perform the memory read or write
+@@ -298,8 +297,7 @@ acpi_ex_system_io_space_handler(u32 function,
+ 
+ 	ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ 			  "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n",
+-			  bit_width, function,
+-			  ACPI_FORMAT_NATIVE_UINT(address)));
++			  bit_width, function, ACPI_FORMAT_UINT64(address)));
+ 
+ 	/* Decode the function parameter */
+ 
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 5f16058..d43b8af 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -141,17 +141,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ 	byte_width = ACPI_DIV_8(bit_width);
+ 	last_address = address + byte_width - 1;
+ 
+-	ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X",
+-			  ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void,
+-								      last_address),
+-			  byte_width));
++	ACPI_DEBUG_PRINT((ACPI_DB_IO,
++			  "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X",
++			  ACPI_FORMAT_UINT64(address),
++			  ACPI_FORMAT_UINT64(last_address), byte_width));
+ 
+ 	/* Maximum 16-bit address in I/O space */
+ 
+ 	if (last_address > ACPI_UINT16_MAX) {
+ 		ACPI_ERROR((AE_INFO,
+-			    "Illegal I/O port address/length above 64K: %p/0x%X",
+-			    ACPI_CAST_PTR(void, address), byte_width));
++			    "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X",
++			    ACPI_FORMAT_UINT64(address), byte_width));
+ 		return_ACPI_STATUS(AE_LIMIT);
+ 	}
+ 
+@@ -180,8 +180,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ 
+ 			if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ 				ACPI_DEBUG_PRINT((ACPI_DB_IO,
+-						  "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)",
+-						  ACPI_CAST_PTR(void, address),
++						  "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)",
++						  ACPI_FORMAT_UINT64(address),
+ 						  byte_width, port_info->name,
+ 						  port_info->start,
+ 						  port_info->end));
+diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
+index b683cc2..0a68c73 100644
+--- a/drivers/acpi/acpica/nsdump.c
++++ b/drivers/acpi/acpica/nsdump.c
+@@ -251,12 +251,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ 		switch (type) {
+ 		case ACPI_TYPE_PROCESSOR:
+ 
+-			acpi_os_printf("ID %X Len %.4X Addr %p\n",
++			acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n",
+ 				       obj_desc->processor.proc_id,
+ 				       obj_desc->processor.length,
+-				       ACPI_CAST_PTR(void,
+-						     obj_desc->processor.
+-						     address));
++				       ACPI_FORMAT_UINT64(obj_desc->processor.
++							  address));
+ 			break;
+ 
+ 		case ACPI_TYPE_DEVICE:
+@@ -327,8 +326,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ 							       space_id));
+ 			if (obj_desc->region.flags & AOPOBJ_DATA_VALID) {
+ 				acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n",
+-					       ACPI_FORMAT_NATIVE_UINT
+-					       (obj_desc->region.address),
++					       ACPI_FORMAT_UINT64(obj_desc->
++								  region.
++								  address),
+ 					       obj_desc->region.length);
+ 			} else {
+ 				acpi_os_printf
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index 62365f6..08a3380 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -228,9 +228,9 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index)
+ 	status = acpi_os_table_override(table_desc->pointer, &override_table);
+ 	if (ACPI_SUCCESS(status) && override_table) {
+ 		ACPI_INFO((AE_INFO,
+-			   "%4.4s @ 0x%p Table override, replaced with:",
++			   "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
+ 			   table_desc->pointer->signature,
+-			   ACPI_CAST_PTR(void, table_desc->address)));
++			   ACPI_FORMAT_UINT64(table_desc->address)));
+ 
+ 		/* We can delete the table that was passed as a parameter */
+ 
+diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
+index 0f2d395..24de78fe 100644
+--- a/drivers/acpi/acpica/tbutils.c
++++ b/drivers/acpi/acpica/tbutils.c
+@@ -237,16 +237,12 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ {
+ 	struct acpi_table_header local_header;
+ 
+-	/*
+-	 * The reason that the Address is cast to a void pointer is so that we
+-	 * can use %p which will work properly on both 32-bit and 64-bit hosts.
+-	 */
+ 	if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) {
+ 
+ 		/* FACS only has signature and length fields */
+ 
+-		ACPI_INFO((AE_INFO, "%4.4s %p %05X",
+-			   header->signature, ACPI_CAST_PTR(void, address),
++		ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X %05X",
++			   header->signature, ACPI_FORMAT_UINT64(address),
+ 			   header->length));
+ 	} else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) {
+ 
+@@ -257,8 +253,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ 					  header)->oem_id, ACPI_OEM_ID_SIZE);
+ 		acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
+ 
+-		ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)",
+-			   ACPI_CAST_PTR (void, address),
++		ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %6.6s)",
++			   ACPI_FORMAT_UINT64(address),
+ 			   (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
+ 			    revision >
+ 			    0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
+@@ -272,8 +268,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ 		acpi_tb_cleanup_table_header(&local_header, header);
+ 
+ 		ACPI_INFO((AE_INFO,
+-			   "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)",
+-			   local_header.signature, ACPI_CAST_PTR(void, address),
++			   "%-4.4s 0x%8.8X%8.8X %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
++			   local_header.signature, ACPI_FORMAT_UINT64(address),
+ 			   local_header.length, local_header.revision,
+ 			   local_header.oem_id, local_header.oem_table_id,
+ 			   local_header.oem_revision,
+@@ -488,9 +484,8 @@ acpi_tb_install_table(acpi_physical_address address,
+ 	status = acpi_os_table_override(mapped_table, &override_table);
+ 	if (ACPI_SUCCESS(status) && override_table) {
+ 		ACPI_INFO((AE_INFO,
+-			   "%4.4s @ 0x%p Table override, replaced with:",
+-			   mapped_table->signature, ACPI_CAST_PTR(void,
+-								  address)));
++			   "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
++			   mapped_table->signature, ACPI_FORMAT_UINT64(address)));
+ 
+ 		acpi_gbl_root_table_list.tables[table_index].pointer =
+ 		    override_table;
+diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
+index 7eb6c6c..0272fbe 100644
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -119,7 +119,7 @@ static acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
+  *
+  ******************************************************************************/
+ 
+-acpi_status acpi_find_root_pointer(acpi_size *table_address)
++acpi_status acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+ 	u8 *table_ptr;
+ 	u8 *mem_rover;
+@@ -177,7 +177,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ 			physical_address +=
+ 			    (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+ 
+-			*table_address = physical_address;
++			*table_address =
++			    (acpi_physical_address) physical_address;
+ 			return_ACPI_STATUS(AE_OK);
+ 		}
+ 	}
+@@ -210,7 +211,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ 		    (ACPI_HI_RSDP_WINDOW_BASE +
+ 		     ACPI_PTR_DIFF(mem_rover, table_ptr));
+ 
+-		*table_address = physical_address;
++		*table_address = (acpi_physical_address) physical_address;
+ 		return_ACPI_STATUS(AE_OK);
+ 	}
+ 
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index a6664d2..7be7aa6 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -179,7 +179,7 @@ static void __init acpi_request_region (struct acpi_generic_address *addr,
+ 		request_mem_region(addr->address, length, desc);
+ }
+ 
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ 	acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ 		"ACPI PM1a_EVT_BLK");
+@@ -208,10 +208,7 @@ static int __init acpi_reserve_resources(void)
+ 	if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ 		acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ 			       acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+-	return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+ 
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1630,6 +1627,7 @@ acpi_status __init acpi_os_initialize(void)
+ 
+ acpi_status __init acpi_os_initialize1(void)
+ {
++	acpi_reserve_resources();
+ 	kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ 	kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ 	kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1);
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 81f32e5..e2958aa 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -67,6 +67,7 @@ enum board_ids {
+ 	board_ahci_yes_fbs,
+ 
+ 	/* board IDs for specific chipsets in alphabetical order */
++	board_ahci_avn,
+ 	board_ahci_mcp65,
+ 	board_ahci_mcp77,
+ 	board_ahci_mcp89,
+@@ -85,6 +86,8 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ 				 unsigned long deadline);
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++			      unsigned long deadline);
+ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ 				unsigned long deadline);
+ #ifdef CONFIG_PM
+@@ -108,6 +111,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
+ 
+ #define AHCI_HFLAGS(flags)	.private_data	= (void *)(flags)
+ 
++static struct ata_port_operations ahci_avn_ops = {
++	.inherits		= &ahci_ops,
++	.hardreset		= ahci_avn_hardreset,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ 	/* by features */
+ 	[board_ahci] =
+@@ -156,6 +164,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ 		.port_ops	= &ahci_ops,
+ 	},
+ 	/* by chipsets */
++	[board_ahci_avn] = {
++		.flags		= AHCI_FLAG_COMMON,
++		.pio_mask	= ATA_PIO4,
++		.udma_mask	= ATA_UDMA6,
++		.port_ops	= &ahci_avn_ops,
++	},
+ 	[board_ahci_mcp65] =
+ 	{
+ 		AHCI_HFLAGS	(AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+@@ -302,14 +316,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
+-	{ PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
+-	{ PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
+-	{ PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
++	{ PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
++	{ PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
++	{ PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
+ 	{ PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
+@@ -680,6 +694,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ 	return rc;
+ }
+ 
++/*
++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
++ *
++ * It has been observed with some SSDs that the timing of events in the
++ * link synchronization phase can leave the port in a state that can not
++ * be recovered by a SATA-hard-reset alone.  The failing signature is
++ * SStatus.DET stuck at 1 ("Device presence detected but Phy
++ * communication not established").  It was found that unloading and
++ * reloading the driver when this problem occurs allows the drive
++ * connection to be recovered (DET advanced to 0x3).  The critical
++ * component of reloading the driver is that the port state machines are
++ * reset by bouncing "port enable" in the AHCI PCS configuration
++ * register.  So, reproduce that effect by bouncing a port whenever we
++ * see DET==1 after a reset.
++ */
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++			      unsigned long deadline)
++{
++	const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++	struct ata_port *ap = link->ap;
++	struct ahci_port_priv *pp = ap->private_data;
++	u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++	unsigned long tmo = deadline - jiffies;
++	struct ata_taskfile tf;
++	bool online;
++	int rc, i;
++
++	DPRINTK("ENTER\n");
++
++	ahci_stop_engine(ap);
++
++	for (i = 0; i < 2; i++) {
++		u16 val;
++		u32 sstatus;
++		int port = ap->port_no;
++		struct ata_host *host = ap->host;
++		struct pci_dev *pdev = to_pci_dev(host->dev);
++
++		/* clear D2H reception area to properly wait for D2H FIS */
++		ata_tf_init(link->device, &tf);
++		tf.command = ATA_BUSY;
++		ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++		rc = sata_link_hardreset(link, timing, deadline, &online,
++				ahci_check_ready);
++
++		if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
++				(sstatus & 0xf) != 1)
++			break;
++
++		ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
++				port);
++
++		pci_read_config_word(pdev, 0x92, &val);
++		val &= ~(1 << port);
++		pci_write_config_word(pdev, 0x92, val);
++		ata_msleep(ap, 1000);
++		val |= 1 << port;
++		pci_write_config_word(pdev, 0x92, val);
++		deadline += tmo;
++	}
++
++	ahci_start_engine(ap);
++
++	if (online)
++		*class = ahci_dev_classify(ap);
++
++	DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
++	return rc;
++}
++
++
+ #ifdef CONFIG_PM
+ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
+ {
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index b175000..cdf58f7 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -314,6 +314,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
+ extern struct ata_port_operations ahci_ops;
+ extern struct ata_port_operations ahci_pmp_retry_srst_ops;
+ 
++unsigned int ahci_dev_classify(struct ata_port *ap);
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ 			u32 opts);
+ void ahci_save_initial_config(struct device *dev,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index de2802c..41ffb8c 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1137,7 +1137,7 @@ static void ahci_dev_config(struct ata_device *dev)
+ 	}
+ }
+ 
+-static unsigned int ahci_dev_classify(struct ata_port *ap)
++unsigned int ahci_dev_classify(struct ata_port *ap)
+ {
+ 	void __iomem *port_mmio = ahci_port_base(ap);
+ 	struct ata_taskfile tf;
+@@ -1151,6 +1151,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)
+ 
+ 	return ata_dev_classify(&tf);
+ }
++EXPORT_SYMBOL_GPL(ahci_dev_classify);
+ 
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ 			u32 opts)
+@@ -1668,8 +1669,7 @@ static void ahci_port_intr(struct ata_port *ap)
+ 	if (unlikely(resetting))
+ 		status &= ~PORT_IRQ_BAD_PMP;
+ 
+-	/* if LPM is enabled, PHYRDY doesn't mean anything */
+-	if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
++	if (sata_lpm_ignore_phy_events(&ap->link)) {
+ 		status &= ~PORT_IRQ_PHYRDY;
+ 		ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
+ 	}
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 5d8fc3d..fcd8586 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6615,6 +6615,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
+ 	return tmp;
+ }
+ 
++/**
++ *	sata_lpm_ignore_phy_events - test if PHY event should be ignored
++ *	@link: Link receiving the event
++ *
++ *	Test whether the received PHY event has to be ignored or not.
++ *
++ *	LOCKING:
++ *	None:
++ *
++ *	RETURNS:
++ *	True if the event has to be ignored.
++ */
++bool sata_lpm_ignore_phy_events(struct ata_link *link)
++{
++	unsigned long lpm_timeout = link->last_lpm_change +
++				    msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
++
++	/* if LPM is enabled, PHYRDY doesn't mean anything */
++	if (link->lpm_policy > ATA_LPM_MAX_POWER)
++		return true;
++
++	/* ignore the first PHY event after the LPM policy changed
++	 * as it is might be spurious
++	 */
++	if ((link->flags & ATA_LFLAG_CHANGED) &&
++	    time_before(jiffies, lpm_timeout))
++		return true;
++
++	return false;
++}
++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
++
+ /*
+  * Dummy port_ops
+  */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 7d1a478..f54b0775 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3423,6 +3423,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ 		}
+ 	}
+ 
++	link->last_lpm_change = jiffies;
++	link->flags |= ATA_LFLAG_CHANGED;
++
+ 	return 0;
+ 
+ fail:
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 3eb6ad2..9f32f43 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	/* Atheros AR3011 with sflash firmware*/
+ 	{ USB_DEVICE(0x0489, 0xE027) },
+ 	{ USB_DEVICE(0x0489, 0xE03D) },
++	{ USB_DEVICE(0x04F2, 0xAFF1) },
+ 	{ USB_DEVICE(0x0930, 0x0215) },
+ 	{ USB_DEVICE(0x0CF3, 0x3002) },
+ 	{ USB_DEVICE(0x0CF3, 0xE019) },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 5c385e5..92973a3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -148,6 +148,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	/* Atheros 3011 with sflash firmware */
+ 	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
+index 5948a21..203361e 100644
+--- a/drivers/edac/Kconfig
++++ b/drivers/edac/Kconfig
+@@ -214,7 +214,7 @@ config EDAC_I7300
+ 
+ config EDAC_SBRIDGE
+ 	tristate "Intel Sandy-Bridge Integrated MC"
+-	depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
++	depends on EDAC_MM_EDAC && PCI && X86 && X86_MCE_INTEL
+ 	depends on EXPERIMENTAL
+ 	help
+ 	  Support for error detection and correction the Intel
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index da71881..f8f790c 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -20,6 +20,7 @@
+ #include <linux/mmzone.h>
+ #include <linux/smp.h>
+ #include <linux/bitmap.h>
++#include <linux/math64.h>
+ #include <asm/processor.h>
+ #include <asm/mce.h>
+ 
+@@ -671,6 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 	u32 reg;
+ 	u64 limit, prv = 0;
+ 	u64 tmp_mb;
++	u32 gb, mb;
+ 	u32 rir_way;
+ 
+ 	/*
+@@ -683,8 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 	pvt->tolm = GET_TOLM(reg);
+ 	tmp_mb = (1 + pvt->tolm) >> 20;
+ 
+-	debugf0("TOLM: %Lu.%03Lu GB (0x%016Lx)\n",
+-		tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tolm);
++	gb = div_u64_rem(tmp_mb, 1024, &mb);
++	debugf0("TOHM: %u.%03u GB (0x%016Lx)\n",
++		gb, (mb*1000)/1024, (u64)pvt->tohm);
+ 
+ 	/* Address range is already 45:25 */
+ 	pci_read_config_dword(pvt->pci_sad1, TOHM,
+@@ -692,8 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 	pvt->tohm = GET_TOHM(reg);
+ 	tmp_mb = (1 + pvt->tohm) >> 20;
+ 
+-	debugf0("TOHM: %Lu.%03Lu GB (0x%016Lx)",
+-		tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tohm);
++	gb = div_u64_rem(tmp_mb, 1024, &mb);
++	debugf0("TOHM: %u.%03u GB (0x%016Lx)",
++		gb, (mb*1000)/1024, (u64)pvt->tohm);
+ 
+ 	/*
+ 	 * Step 2) Get SAD range and SAD Interleave list
+@@ -715,10 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 			break;
+ 
+ 		tmp_mb = (limit + 1) >> 20;
+-		debugf0("SAD#%d %s up to %Lu.%03Lu GB (0x%016Lx) %s reg=0x%08x\n",
++		gb = div_u64_rem(tmp_mb, 1000, &mb);
++		debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n",
+ 			n_sads,
+ 			get_dram_attr(reg),
+-			tmp_mb / 1000, tmp_mb % 1000,
++			gb, (mb*1000)/1024,
+ 			((u64)tmp_mb) << 20L,
+ 			INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]",
+ 			reg);
+@@ -748,8 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 			break;
+ 		tmp_mb = (limit + 1) >> 20;
+ 
+-		debugf0("TAD#%d: up to %Lu.%03Lu GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+-			n_tads, tmp_mb / 1000, tmp_mb % 1000,
++		gb = div_u64_rem(tmp_mb, 1000, &mb);
++		debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
++			n_tads, gb, (mb*1000)/1024,
+ 			((u64)tmp_mb) << 20L,
+ 			(u32)TAD_SOCK(reg),
+ 			(u32)TAD_CH(reg),
+@@ -772,9 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 					      tad_ch_nilv_offset[j],
+ 					      &reg);
+ 			tmp_mb = TAD_OFFSET(reg) >> 20;
+-			debugf0("TAD CH#%d, offset #%d: %Lu.%03Lu GB (0x%016Lx), reg=0x%08x\n",
++			gb = div_u64_rem(tmp_mb, 1024, &mb);
++			debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
+ 				i, j,
+-				tmp_mb / 1000, tmp_mb % 1000,
++				gb, (mb*1000)/1024,
+ 				((u64)tmp_mb) << 20L,
+ 				reg);
+ 		}
+@@ -796,9 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 
+ 			tmp_mb = RIR_LIMIT(reg) >> 20;
+ 			rir_way = 1 << RIR_WAY(reg);
+-			debugf0("CH#%d RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d, reg=0x%08x\n",
++			gb = div_u64_rem(tmp_mb, 1024, &mb);
++			debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
+ 				i, j,
+-				tmp_mb / 1000, tmp_mb % 1000,
++				gb, (mb*1000)/1024,
+ 				((u64)tmp_mb) << 20L,
+ 				rir_way,
+ 				reg);
+@@ -809,9 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ 						      &reg);
+ 				tmp_mb = RIR_OFFSET(reg) << 6;
+ 
+-				debugf0("CH#%d RIR#%d INTL#%d, offset %Lu.%03Lu GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
++				gb = div_u64_rem(tmp_mb, 1024, &mb);
++				debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
+ 					i, j, k,
+-					tmp_mb / 1000, tmp_mb % 1000,
++					gb, (mb*1000)/1024,
+ 					((u64)tmp_mb) << 20L,
+ 					(u32)RIR_RNK_TGT(reg),
+ 					reg);
+@@ -849,6 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	u8			ch_way,sck_way;
+ 	u32			tad_offset;
+ 	u32			rir_way;
++	u32			gb, mb;
+ 	u64			ch_addr, offset, limit, prv = 0;
+ 
+ 
+@@ -859,7 +869,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	 * range (e. g. VGA addresses). It is unlikely, however, that the
+ 	 * memory controller would generate an error on that range.
+ 	 */
+-	if ((addr > (u64) pvt->tolm) && (addr < (1L << 32))) {
++	if ((addr > (u64) pvt->tolm) && (addr < (1LL << 32))) {
+ 		sprintf(msg, "Error at TOLM area, on addr 0x%08Lx", addr);
+ 		edac_mc_handle_ce_no_info(mci, msg);
+ 		return -EINVAL;
+@@ -1054,7 +1064,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 	ch_addr = addr & 0x7f;
+ 	/* Remove socket wayness and remove 6 bits */
+ 	addr >>= 6;
+-	addr /= sck_xch;
++	addr = div_u64(addr, sck_xch);
+ #if 0
+ 	/* Divide by channel way */
+ 	addr = addr / ch_way;
+@@ -1074,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ 			continue;
+ 
+ 		limit = RIR_LIMIT(reg);
+-
+-		debugf0("RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d\n",
++		gb = div_u64_rem(limit >> 20, 1024, &mb);
++		debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
+ 			n_rir,
+-			(limit >> 20) / 1000, (limit >> 20) % 1000,
++			gb, (mb*1000)/1024,
+ 			limit,
+ 			1 << RIR_WAY(reg));
+ 		if  (ch_addr <= limit)
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 2861ef4..20f7daa 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -410,24 +410,48 @@ static void __init dmi_dump_ids(void)
+ 	printk(KERN_CONT "\n");
+ }
+ 
+-static int __init dmi_present(const char __iomem *p)
++static int __init dmi_present(const u8 *buf)
+ {
+-	u8 buf[15];
++	int smbios_ver;
+ 
+-	memcpy_fromio(buf, p, 15);
+-	if (dmi_checksum(buf, 15)) {
++	if (memcmp(buf, "_SM_", 4) == 0 &&
++	    buf[5] < 32 && dmi_checksum(buf, buf[5])) {
++		smbios_ver = (buf[6] << 8) + buf[7];
++
++		/* Some BIOS report weird SMBIOS version, fix that up */
++		switch (smbios_ver) {
++		case 0x021F:
++		case 0x0221:
++			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
++				 smbios_ver & 0xFF, 3);
++			smbios_ver = 0x0203;
++			break;
++		case 0x0233:
++			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
++			smbios_ver = 0x0206;
++			break;
++		}
++	} else {
++		smbios_ver = 0;
++	}
++
++	buf += 16;
++
++	if (memcmp(buf, "_DMI_", 5) == 0 && dmi_checksum(buf, 15)) {
++		if (smbios_ver)
++			dmi_ver = smbios_ver;
++		else
++			dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
+ 		dmi_num = (buf[13] << 8) | buf[12];
+ 		dmi_len = (buf[7] << 8) | buf[6];
+ 		dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+ 			(buf[9] << 8) | buf[8];
+ 
+ 		if (dmi_walk_early(dmi_decode) == 0) {
+-			if (dmi_ver)
++			if (smbios_ver) {
+ 				pr_info("SMBIOS %d.%d present.\n",
+ 				       dmi_ver >> 8, dmi_ver & 0xFF);
+-			else {
+-				dmi_ver = (buf[14] & 0xF0) << 4 |
+-					   (buf[14] & 0x0F);
++			} else {
+ 				pr_info("Legacy DMI %d.%d present.\n",
+ 				       dmi_ver >> 8, dmi_ver & 0xFF);
+ 			}
+@@ -435,40 +459,14 @@ static int __init dmi_present(const char __iomem *p)
+ 			return 0;
+ 		}
+ 	}
+-	dmi_ver = 0;
+-	return 1;
+-}
+ 
+-static int __init smbios_present(const char __iomem *p)
+-{
+-	u8 buf[32];
+-
+-	memcpy_fromio(buf, p, 32);
+-	if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+-		dmi_ver = (buf[6] << 8) + buf[7];
+-
+-		/* Some BIOS report weird SMBIOS version, fix that up */
+-		switch (dmi_ver) {
+-		case 0x021F:
+-		case 0x0221:
+-			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
+-			       dmi_ver & 0xFF, 3);
+-			dmi_ver = 0x0203;
+-			break;
+-		case 0x0233:
+-			pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
+-			dmi_ver = 0x0206;
+-			break;
+-		}
+-		return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+-	}
+ 	return 1;
+ }
+ 
+ void __init dmi_scan_machine(void)
+ {
+ 	char __iomem *p, *q;
+-	int rc;
++	char buf[32];
+ 
+ 	if (efi_enabled(EFI_CONFIG_TABLES)) {
+ 		if (efi.smbios == EFI_INVALID_TABLE_ADDR)
+@@ -481,10 +479,10 @@ void __init dmi_scan_machine(void)
+ 		p = dmi_ioremap(efi.smbios, 32);
+ 		if (p == NULL)
+ 			goto error;
+-
+-		rc = smbios_present(p);
++		memcpy_fromio(buf, p, 32);
+ 		dmi_iounmap(p, 32);
+-		if (!rc) {
++
++		if (!dmi_present(buf)) {
+ 			dmi_available = 1;
+ 			goto out;
+ 		}
+@@ -499,18 +497,15 @@ void __init dmi_scan_machine(void)
+ 		if (p == NULL)
+ 			goto error;
+ 
++		memset(buf, 0, 16);
+ 		for (q = p; q < p + 0x10000; q += 16) {
+-			if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
+-				rc = smbios_present(q);
+-			else if (memcmp(q, "_DMI_", 5) == 0)
+-				rc = dmi_present(q);
+-			else
+-				continue;
+-			if (!rc) {
++			memcpy_fromio(buf + 16, q, 16);
++			if (!dmi_present(buf)) {
+ 				dmi_available = 1;
+ 				dmi_iounmap(p, 0x10000);
+ 				goto out;
+ 			}
++			memcpy(buf, buf + 16, 16);
+ 		}
+ 		dmi_iounmap(p, 0x10000);
+ 	}
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 36ae055..e901fef 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -726,6 +726,7 @@ static struct class gpio_class = {
+  */
+ int gpio_export(unsigned gpio, bool direction_may_change)
+ {
++	struct gpio_chip	*chip;
+ 	unsigned long		flags;
+ 	struct gpio_desc	*desc;
+ 	int			status;
+@@ -743,10 +744,18 @@ int gpio_export(unsigned gpio, bool direction_may_change)
+ 		return -EINVAL;
+ 	}
+ 
++	desc = &gpio_desc[gpio];
++	chip = desc->chip;
++
+ 	mutex_lock(&sysfs_lock);
+ 
++	/* check if chip is being removed */
++	if (!chip || !chip->exported) {
++		status = -ENODEV;
++		goto fail_unlock;
++	}
++
+ 	spin_lock_irqsave(&gpio_lock, flags);
+-	desc = &gpio_desc[gpio];
+ 	if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
+ 	     test_bit(FLAG_EXPORT, &desc->flags)) {
+ 		spin_unlock_irqrestore(&gpio_lock, flags);
+@@ -973,12 +982,15 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ {
+ 	int			status;
+ 	struct device		*dev;
++	struct gpio_desc *desc;
++	unsigned int i;
+ 
+ 	mutex_lock(&sysfs_lock);
+ 	dev = class_find_device(&gpio_class, NULL, chip, match_export);
+ 	if (dev) {
+ 		put_device(dev);
+ 		device_unregister(dev);
++		/* prevent further gpiod exports */
+ 		chip->exported = 0;
+ 		status = 0;
+ 	} else
+@@ -988,6 +1000,13 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ 	if (status)
+ 		pr_debug("%s: chip %s status %d\n", __func__,
+ 				chip->label, status);
++
++	/* unregister gpio class devices owned by sysfs */
++	for (i = 0; i < chip->ngpio; i++) {
++		desc = &gpio_desc[chip->base + i];
++		if (test_and_clear_bit(FLAG_SYSFS, &desc->flags))
++			gpio_free(chip->base + i);
++	}
+ }
+ 
+ static int __init gpiolib_sysfs_init(void)
+@@ -1137,6 +1156,8 @@ int gpiochip_remove(struct gpio_chip *chip)
+ 	int		status = 0;
+ 	unsigned	id;
+ 
++	gpiochip_unexport(chip);
++
+ 	spin_lock_irqsave(&gpio_lock, flags);
+ 
+ 	of_gpiochip_remove(chip);
+@@ -1154,9 +1175,6 @@ int gpiochip_remove(struct gpio_chip *chip)
+ 
+ 	spin_unlock_irqrestore(&gpio_lock, flags);
+ 
+-	if (status == 0)
+-		gpiochip_unexport(chip);
+-
+ 	return status;
+ }
+ EXPORT_SYMBOL_GPL(gpiochip_remove);
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 927d170..76c4f2a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -302,8 +302,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
+ 		misc |= ATOM_COMPOSITESYNC;
+ 	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ 		misc |= ATOM_INTERLACE;
+-	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ 		misc |= ATOM_DOUBLE_CLOCK_MODE;
++	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++		misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+ 
+ 	args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ 	args.ucCRTC = radeon_crtc->crtc_id;
+@@ -346,8 +348,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ 		misc |= ATOM_COMPOSITESYNC;
+ 	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ 		misc |= ATOM_INTERLACE;
+-	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++	if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ 		misc |= ATOM_DOUBLE_CLOCK_MODE;
++	if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++		misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+ 
+ 	args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ 	args.ucCRTC = radeon_crtc->crtc_id;
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 44a1ea4..a7e6f03 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ 			   GFP_KERNEL);
+ 	if (!open_info) {
+ 		err = -ENOMEM;
+-		goto error0;
++		goto error_gpadl;
+ 	}
+ 
+ 	init_completion(&open_info->waitevent);
+@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ 
+ 	if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ 		err = -EINVAL;
+-		goto error0;
++		goto error_gpadl;
+ 	}
+ 
+ 	if (userdatalen)
+@@ -234,6 +234,9 @@ error1:
+ 	list_del(&open_info->msglistentry);
+ 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+ 
++error_gpadl:
++	vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ 	free_pages((unsigned long)out,
+ 		get_order(send_ringbuffer_size + recv_ringbuffer_size));
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 12b85ff..7f963328b 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,7 +606,7 @@ int vmbus_request_offers(void)
+ {
+ 	struct vmbus_channel_message_header *msg;
+ 	struct vmbus_channel_msginfo *msginfo;
+-	int ret, t;
++	int ret;
+ 
+ 	msginfo = kmalloc(sizeof(*msginfo) +
+ 			  sizeof(struct vmbus_channel_message_header),
+@@ -614,8 +614,6 @@ int vmbus_request_offers(void)
+ 	if (!msginfo)
+ 		return -ENOMEM;
+ 
+-	init_completion(&msginfo->waitevent);
+-
+ 	msg = (struct vmbus_channel_message_header *)msginfo->msg;
+ 
+ 	msg->msgtype = CHANNELMSG_REQUESTOFFERS;
+@@ -629,14 +627,6 @@ int vmbus_request_offers(void)
+ 		goto cleanup;
+ 	}
+ 
+-	t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+-	if (t == 0) {
+-		ret = -ETIMEDOUT;
+-		goto cleanup;
+-	}
+-
+-
+-
+ cleanup:
+ 	kfree(msginfo);
+ 
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 055ebeb..c1fef27 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ 	if (dmasync)
+ 		dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+ 
++	if (!size)
++		return ERR_PTR(-EINVAL);
++
+ 	/*
+ 	 * If the combination of the addr and size requested for this memory
+ 	 * region causes an integer overflow, return error.
+ 	 */
+-	if ((PAGE_ALIGN(addr + size) <= size) ||
+-	    (PAGE_ALIGN(addr + size) <= addr))
++	if (((addr + size) < addr) ||
++	    PAGE_ALIGN(addr + size) < (addr + size))
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	if (!can_do_mlock())
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index a16f0c8..2ed14a7 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
+ 
+ 	memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+ 
+-	*lso_hdr_sz  = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+-				   wr->wr.ud.hlen);
++	*lso_hdr_sz  = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ 	*lso_seg_len = halign;
+ 	return 0;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 2d5bb5b..548ea99 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -296,7 +296,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev,
+ 					 unsigned int x2, unsigned int y2)
+ {
+ 	elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+-	elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++	elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+ 
+ /*
+@@ -692,18 +692,18 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
+ static int elantech_packet_check_v4(struct psmouse *psmouse)
+ {
+ 	unsigned char *packet = psmouse->packet;
++	unsigned char packet_type = packet[3] & 0x03;
+ 
+-	if ((packet[0] & 0x0c) == 0x04 &&
+-	    (packet[3] & 0x1f) == 0x11)
++	switch (packet_type) {
++	case 0:
++		return PACKET_V4_STATUS;
++
++	case 1:
+ 		return PACKET_V4_HEAD;
+ 
+-	if ((packet[0] & 0x0c) == 0x04 &&
+-	    (packet[3] & 0x1f) == 0x12)
++	case 2:
+ 		return PACKET_V4_MOTION;
+-
+-	if ((packet[0] & 0x0c) == 0x04 &&
+-	    (packet[3] & 0x1f) == 0x10)
+-		return PACKET_V4_STATUS;
++	}
+ 
+ 	return PACKET_UNKNOWN;
+ }
+@@ -766,6 +766,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
+ }
+ 
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++		unsigned int rate)
++{
++	struct elantech_data *etd = psmouse->private;
++
++	etd->original_set_rate(psmouse, rate);
++	if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++		psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+  * Put the touchpad into absolute mode
+  */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -1131,10 +1146,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ 		return true;
+ 
+ 	/*
+-	 * Some models have a revision higher then 20. Meaning param[2] may
+-	 * be 10 or 20, skip the rates check for these.
++	 * Some hw_version >= 4 models have a revision higher then 20. Meaning
++	 * that param[2] may be 10 or 20, skip the rates check for these.
+ 	 */
+-	if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++	if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
++	    param[2] < 40)
+ 		return true;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(rates); i++)
+@@ -1269,6 +1285,12 @@ static int elantech_set_properties(struct elantech_data *etd)
+ 			etd->hw_version = 3;
+ 			break;
+ 		case 6:
++		case 7:
++		case 8:
++		case 9:
++		case 10:
++		case 13:
++		case 14:
+ 			etd->hw_version = 4;
+ 			break;
+ 		default:
+@@ -1353,6 +1375,11 @@ int elantech_init(struct psmouse *psmouse)
+ 		goto init_fail;
+ 	}
+ 
++	if (etd->fw_version == 0x381f17) {
++		etd->original_set_rate = psmouse->set_rate;
++		psmouse->set_rate = elantech_set_rate_restore_reg_07;
++	}
++
+ 	if (elantech_set_input_params(psmouse)) {
+ 		psmouse_err(psmouse, "failed to query touchpad range.\n");
+ 		goto init_fail;
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 3569bed..092ac72 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -136,6 +136,7 @@ struct elantech_data {
+ 	unsigned int width;
+ 	struct finger_pos mt[ETP_MAX_FINGERS];
+ 	unsigned char parity[256];
++	void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+ 
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index b5fdcb7..34842e5 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -171,7 +171,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ 		       unsigned long addr, unsigned long len)
+ {
+-	return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++	return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+ 
+ /*
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c293d9c..6056ee7 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1554,7 +1554,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+ 
+ 	conf->slab_cache = sc;
+ 	conf->active_name = 1-conf->active_name;
+-	conf->pool_size = newsize;
++	if (!err)
++		conf->pool_size = newsize;
+ 	return err;
+ }
+ 
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index 9729b92..f8449d5 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ 
+ 		if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
+ 			if (msb->data_dir == READ) {
+-				for (cnt = 0; cnt < msb->current_seg; cnt++)
++				for (cnt = 0; cnt < msb->current_seg; cnt++) {
+ 					t_len += msb->req_sg[cnt].length
+ 						 / msb->page_size;
+ 
+@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ 						t_len += msb->current_page - 1;
+ 
+ 					t_len *= msb->page_size;
++				}
+ 			}
+ 		} else
+ 			t_len = blk_rq_bytes(msb->block_req);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 411a994..fc7386e 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2424,6 +2424,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ 	switch (mode) {
+ 	case PM_HIBERNATION_PREPARE:
+ 	case PM_SUSPEND_PREPARE:
++	case PM_RESTORE_PREPARE:
+ 
+ 		spin_lock_irqsave(&host->lock, flags);
+ 		host->rescan_disable = 1;
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index ad76592..7ac2c05 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ 		/* Validate the request */
+ 		err = -EINVAL;
+ 		if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+-		    req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++		    req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ 			break;
+ 		if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM &&
+ 		    req.dtype != UBI_UNKNOWN)
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index cd26da8..22b3636 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
+ 				 * during re-size.
+ 				 */
+ 				ubi_scan_move_to_list(sv, seb, &si->erase);
+-			vol->eba_tbl[seb->lnum] = seb->pnum;
++			else
++				vol->eba_tbl[seb->lnum] = seb->pnum;
+ 		}
+ 	}
+ 
+diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
+index f6a7d7a..b14ab43 100644
+--- a/drivers/mtd/ubi/misc.c
++++ b/drivers/mtd/ubi/misc.c
+@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
+ 	for (i = 0; i < vol->used_ebs; i++) {
+ 		int size;
+ 
++		cond_resched();
++
+ 		if (i == vol->used_ebs - 1)
+ 			size = vol->last_eb_bytes;
+ 		else
+diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
+index b2b62de..c5b2357 100644
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -408,7 +408,7 @@ static int compare_lebs(struct ubi_device *ubi, const struct ubi_scan_leb *seb,
+ 		second_is_newer = !second_is_newer;
+ 	} else {
+ 		dbg_bld("PEB %d CRC is OK", pnum);
+-		bitflips = !!err;
++		bitflips |= !!err;
+ 	}
+ 
+ 	vfree(buf);
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index cf42971..422e5be 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -665,7 +665,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ 				int cancel)
+ {
+ 	int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+-	int vol_id = -1, uninitialized_var(lnum);
++	int vol_id = -1, lnum = -1;
+ 	struct ubi_wl_entry *e1, *e2;
+ 	struct ubi_vid_hdr *vid_hdr;
+ 
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 6546191..bd4e598 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -149,6 +149,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
+ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
+ 				     struct e1000_rx_ring *rx_ring,
+ 				     int *work_done, int work_to_do);
++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
++					 struct e1000_rx_ring *rx_ring,
++					 int cleaned_count)
++{
++}
+ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
+ 				   struct e1000_rx_ring *rx_ring,
+ 				   int cleaned_count);
+@@ -3322,8 +3327,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ 		msleep(1);
+ 	/* e1000_down has a dependency on max_frame_size */
+ 	hw->max_frame_size = max_frame;
+-	if (netif_running(netdev))
++	if (netif_running(netdev)) {
++		/* prevent buffers from being reallocated */
++		adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
+ 		e1000_down(adapter);
++	}
+ 
+ 	/* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+ 	 * means we reserve 2 more, this pushes us to allocate from the next
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 9663e0b..bb335ab 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -42,7 +42,7 @@
+ #define PSF_TX		0x1000
+ #define EXT_EVENT	1
+ #define CAL_EVENT	7
+-#define CAL_TRIGGER	7
++#define CAL_TRIGGER	1
+ #define PER_TRIGGER	6
+ 
+ /* phyter seems to miss the mark by 16 ns */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 1644b1f..ec347d2 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -367,6 +367,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ 	{RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ 	{RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++	{RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ 	{RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ 	{RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ 	{RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index e5fe956..17e6429 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -117,7 +117,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+ 	reqtype =  REALTEK_USB_VENQT_READ;
+ 
+ 	status = usb_control_msg(udev, pipe, request, reqtype, value, index,
+-				 pdata, len, 0); /* max. timeout */
++				 pdata, len, 1000);
+ 
+ 	if (status < 0)
+ 		pr_err("reg 0x%x, usbctrl_vendorreq TimeOut! status:0x%x value=0x%x\n",
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 1ce729d..b7d782f 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -27,6 +27,8 @@ struct backend_info {
+ 	enum xenbus_state frontend_state;
+ 	struct xenbus_watch hotplug_status_watch;
+ 	u8 have_hotplug_status_watch:1;
++
++	const char *hotplug_script;
+ };
+ 
+ static int connect_rings(struct backend_info *);
+@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev)
+ 		xenvif_disconnect(be->vif);
+ 		be->vif = NULL;
+ 	}
++	kfree(be->hotplug_script);
+ 	kfree(be);
+ 	dev_set_drvdata(&dev->dev, NULL);
+ 	return 0;
+@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev,
+ 	struct xenbus_transaction xbt;
+ 	int err;
+ 	int sg;
++	const char *script;
+ 	struct backend_info *be = kzalloc(sizeof(struct backend_info),
+ 					  GFP_KERNEL);
+ 	if (!be) {
+@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev,
+ 		goto fail;
+ 	}
+ 
++	script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
++	if (IS_ERR(script)) {
++		err = PTR_ERR(script);
++		xenbus_dev_fatal(dev, err, "reading script");
++		goto fail;
++	}
++
++	be->hotplug_script = script;
++
+ 	err = xenbus_switch_state(dev, XenbusStateInitWait);
+ 	if (err)
+ 		goto fail;
+@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev,
+ 			  struct kobj_uevent_env *env)
+ {
+ 	struct backend_info *be = dev_get_drvdata(&xdev->dev);
+-	char *val;
+ 
+-	val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+-	if (IS_ERR(val)) {
+-		int err = PTR_ERR(val);
+-		xenbus_dev_fatal(xdev, err, "reading script");
+-		return err;
+-	} else {
+-		if (add_uevent_var(env, "script=%s", val)) {
+-			kfree(val);
+-			return -ENOMEM;
+-		}
+-		kfree(val);
+-	}
++	if (!be)
++		return 0;
++
++	if (add_uevent_var(env, "script=%s", be->hotplug_script))
++		return -ENOMEM;
+ 
+-	if (!be || !be->vif)
++	if (!be->vif)
+ 		return 0;
+ 
+ 	return add_uevent_var(env, "vif=%s", be->vif->dev->name);
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 37639a6..21935580 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -761,6 +761,42 @@ int of_property_read_string_index(struct device_node *np, const char *propname,
+ }
+ EXPORT_SYMBOL_GPL(of_property_read_string_index);
+ 
++/**
++ * of_property_match_string() - Find string in a list and return index
++ * @np: pointer to node containing string list property
++ * @propname: string list property name
++ * @string: pointer to string to search for in string list
++ *
++ * This function searches a string list property and returns the index
++ * of a specific string value.
++ */
++int of_property_match_string(struct device_node *np, const char *propname,
++			     const char *string)
++{
++	struct property *prop = of_find_property(np, propname, NULL);
++	size_t l;
++	int i;
++	const char *p, *end;
++
++	if (!prop)
++		return -EINVAL;
++	if (!prop->value)
++		return -ENODATA;
++
++	p = prop->value;
++	end = p + prop->length;
++
++	for (i = 0; p < end; i++, p += l) {
++		l = strlen(p) + 1;
++		if (p + l > end)
++			return -EILSEQ;
++		pr_debug("comparing %s with %s\n", string, p);
++		if (strcmp(string, p) == 0)
++			return i; /* Found it; return index */
++	}
++	return -ENODATA;
++}
++EXPORT_SYMBOL_GPL(of_property_match_string);
+ 
+ /**
+  * of_property_count_strings - Find and return the number of strings from a
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 8877b83..ba3638e 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -1046,7 +1046,14 @@ static int __devinit compal_probe(struct platform_device *pdev)
+ 
+ 	/* Power supply */
+ 	initialize_power_supply_data(data);
+-	power_supply_register(&compal_device->dev, &data->psy);
++	err = power_supply_register(&compal_device->dev, &data->psy);
++	if (err < 0) {
++		hwmon_device_unregister(data->hwmon_dev);
++		sysfs_remove_group(&pdev->dev.kobj,
++				&compal_attribute_group);
++		kfree(data);
++		return err;
++	}
+ 
+ 	platform_set_drvdata(pdev, data);
+ 
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 3868ab2..fb37df6 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
+ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
+ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
+ static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
+ 
+ /* Functions */
+ 
+@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ 				}
+ 
+ 				/* Now complete the io */
++				scsi_dma_unmap(cmd);
++				cmd->scsi_done(cmd);
+ 				tw_dev->state[request_id] = TW_S_COMPLETED;
+ 				twa_free_request_id(tw_dev, request_id);
+ 				tw_dev->posted_request_count--;
+-				tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-				twa_unmap_scsi_data(tw_dev, request_id);
+ 			}
+ 
+ 			/* Check for valid status after each drain */
+@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
+ 	}
+ } /* End twa_load_sgl() */
+ 
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	int use_sg;
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	use_sg = scsi_dma_map(cmd);
+-	if (!use_sg)
+-		return 0;
+-	else if (use_sg < 0) {
+-		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
+-		return 0;
+-	}
+-
+-	cmd->SCp.phase = TW_PHASE_SGLIST;
+-	cmd->SCp.have_data_in = use_sg;
+-
+-	return use_sg;
+-} /* End twa_map_scsi_sg_data() */
+-
+ /* This function will poll for a response interrupt of a request */
+ static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+ {
+@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ 		    (tw_dev->state[i] != TW_S_INITIAL) &&
+ 		    (tw_dev->state[i] != TW_S_COMPLETED)) {
+ 			if (tw_dev->srb[i]) {
+-				tw_dev->srb[i]->result = (DID_RESET << 16);
+-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+-				twa_unmap_scsi_data(tw_dev, i);
++				struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++				cmd->result = (DID_RESET << 16);
++				scsi_dma_unmap(cmd);
++				cmd->scsi_done(cmd);
+ 			}
+ 		}
+ 	}
+@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ 	/* Save the scsi command for use by the ISR */
+ 	tw_dev->srb[request_id] = SCpnt;
+ 
+-	/* Initialize phase to zero */
+-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ 	retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ 	switch (retval) {
+ 	case SCSI_MLQUEUE_HOST_BUSY:
++		scsi_dma_unmap(SCpnt);
+ 		twa_free_request_id(tw_dev, request_id);
+-		twa_unmap_scsi_data(tw_dev, request_id);
+ 		break;
+ 	case 1:
+-		tw_dev->state[request_id] = TW_S_COMPLETED;
+-		twa_free_request_id(tw_dev, request_id);
+-		twa_unmap_scsi_data(tw_dev, request_id);
+ 		SCpnt->result = (DID_ERROR << 16);
++		scsi_dma_unmap(SCpnt);
+ 		done(SCpnt);
++		tw_dev->state[request_id] = TW_S_COMPLETED;
++		twa_free_request_id(tw_dev, request_id);
+ 		retval = 0;
+ 	}
+ out:
+@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ 				command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+ 				command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
+ 			} else {
+-				sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
+-				if (sg_count == 0)
++				sg_count = scsi_dma_map(srb);
++				if (sg_count < 0)
+ 					goto out;
+ 
+ 				scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
+ 	return(table[index].text);
+ } /* End twa_string_lookup() */
+ 
+-/* This function will perform a pci-dma unmap */
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+-		scsi_dma_unmap(cmd);
+-} /* End twa_unmap_scsi_data() */
+-
+ /* This function gets called when a disk is coming on-line */
+ static int twa_slave_configure(struct scsi_device *sdev)
+ {
+diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
+index 040f721..0fdc83c 100644
+--- a/drivers/scsi/3w-9xxx.h
++++ b/drivers/scsi/3w-9xxx.h
+@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+ 
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE  1
+-#define TW_PHASE_SGLIST  2
+-
+ /* Misc defines */
+ #define TW_9550SX_DRAIN_COMPLETED	      0xFFFF
+ #define TW_SECTOR_SIZE                        512
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+index 13e39e1..c555ccb 100644
+--- a/drivers/scsi/3w-sas.c
++++ b/drivers/scsi/3w-sas.c
+@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+ 	return 0;
+ } /* End twl_post_command_packet() */
+ 
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	int use_sg;
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	use_sg = scsi_dma_map(cmd);
+-	if (!use_sg)
+-		return 0;
+-	else if (use_sg < 0) {
+-		TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+-		return 0;
+-	}
+-
+-	cmd->SCp.phase = TW_PHASE_SGLIST;
+-	cmd->SCp.have_data_in = use_sg;
+-
+-	return use_sg;
+-} /* End twl_map_scsi_sg_data() */
+-
+ /* This function hands scsi cdb's to the firmware */
+ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+ {
+@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ 	if (!sglistarg) {
+ 		/* Map sglist from scsi layer to cmd packet */
+ 		if (scsi_sg_count(srb)) {
+-			sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+-			if (sg_count == 0)
++			sg_count = scsi_dma_map(srb);
++			if (sg_count <= 0)
+ 				goto out;
+ 
+ 			scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1116,15 +1096,6 @@ out:
+ 	return retval;
+ } /* End twl_initialize_device_extension() */
+ 
+-/* This function will perform a pci-dma unmap */
+-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+-	struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+-		scsi_dma_unmap(cmd);
+-} /* End twl_unmap_scsi_data() */
+-
+ /* This function will handle attention interrupts */
+ static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+ {
+@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+ 			}
+ 
+ 			/* Now complete the io */
++			scsi_dma_unmap(cmd);
++			cmd->scsi_done(cmd);
+ 			tw_dev->state[request_id] = TW_S_COMPLETED;
+ 			twl_free_request_id(tw_dev, request_id);
+ 			tw_dev->posted_request_count--;
+-			tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-			twl_unmap_scsi_data(tw_dev, request_id);
+ 		}
+ 
+ 		/* Check for another response interrupt */
+@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
+ 		if ((tw_dev->state[i] != TW_S_FINISHED) &&
+ 		    (tw_dev->state[i] != TW_S_INITIAL) &&
+ 		    (tw_dev->state[i] != TW_S_COMPLETED)) {
+-			if (tw_dev->srb[i]) {
+-				tw_dev->srb[i]->result = (DID_RESET << 16);
+-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+-				twl_unmap_scsi_data(tw_dev, i);
++			struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++			if (cmd) {
++				cmd->result = (DID_RESET << 16);
++				scsi_dma_unmap(cmd);
++				cmd->scsi_done(cmd);
+ 			}
+ 		}
+ 	}
+@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ 	/* Save the scsi command for use by the ISR */
+ 	tw_dev->srb[request_id] = SCpnt;
+ 
+-	/* Initialize phase to zero */
+-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ 	retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ 	if (retval) {
+ 		tw_dev->state[request_id] = TW_S_COMPLETED;
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+index d474892..fec6449 100644
+--- a/drivers/scsi/3w-sas.h
++++ b/drivers/scsi/3w-sas.h
+@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+ 
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SGLIST  2
+-
+ /* Misc defines */
+ #define TW_SECTOR_SIZE                        512
+ #define TW_MAX_UNITS			      32
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 7fe96ff..86bc5f9 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
+ 	return 0;
+ } /* End tw_initialize_device_extension() */
+ 
+-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+-	int use_sg;
+-
+-	dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
+-
+-	use_sg = scsi_dma_map(cmd);
+-	if (use_sg < 0) {
+-		printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
+-		return 0;
+-	}
+-
+-	cmd->SCp.phase = TW_PHASE_SGLIST;
+-	cmd->SCp.have_data_in = use_sg;
+-
+-	return use_sg;
+-} /* End tw_map_scsi_sg_data() */
+-
+-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+-	dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
+-
+-	if (cmd->SCp.phase == TW_PHASE_SGLIST)
+-		scsi_dma_unmap(cmd);
+-} /* End tw_unmap_scsi_data() */
+-
+ /* This function will reset a device extension */
+ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ {
+@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ 			srb = tw_dev->srb[i];
+ 			if (srb != NULL) {
+ 				srb->result = (DID_RESET << 16);
+-				tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+-				tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
++				scsi_dma_unmap(srb);
++				srb->scsi_done(srb);
+ 			}
+ 		}
+ 	}
+@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
+ 	command_packet->byte8.io.lba = lba;
+ 	command_packet->byte6.block_count = num_sectors;
+ 
+-	use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+-	if (!use_sg)
++	use_sg = scsi_dma_map(srb);
++	if (use_sg <= 0)
+ 		return 1;
+ 
+ 	scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
+@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
+ 	/* Save the scsi command for use by the ISR */
+ 	tw_dev->srb[request_id] = SCpnt;
+ 
+-	/* Initialize phase to zero */
+-	SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ 	switch (*command) {
+ 		case READ_10:
+ 		case READ_6:
+@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
+ 
+ 				/* Now complete the io */
+ 				if ((error != TW_ISR_DONT_COMPLETE)) {
++					scsi_dma_unmap(tw_dev->srb[request_id]);
++					tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+ 					tw_dev->state[request_id] = TW_S_COMPLETED;
+ 					tw_state_request_finish(tw_dev, request_id);
+ 					tw_dev->posted_request_count--;
+-					tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-					
+-					tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+ 				}
+ 			}
+ 				
+diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
+index 49dcf03..1d31858 100644
+--- a/drivers/scsi/3w-xxxx.h
++++ b/drivers/scsi/3w-xxxx.h
+@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
+ #define TW_AEN_SMART_FAIL        0x000F
+ #define TW_AEN_SBUF_FAIL         0x0024
+ 
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_ALIGNMENT_6000		      64 /* 64 bytes */
+ #define TW_ALIGNMENT_7000                     4  /* 4 bytes */
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index bfd87fa..3e0f71c 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
+ 			fp_possible = io_info.fpOkForIo;
+ 	}
+ 
+-	/* Use smp_processor_id() for now until cmd->request->cpu is CPU
++	/* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
+ 	   id by default, not CPU group id, otherwise all MSI-X queues won't
+ 	   be utilized */
+ 	cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
+-		smp_processor_id() % instance->msix_vectors : 0;
++		raw_smp_processor_id() % instance->msix_vectors : 0;
+ 
+ 	if (fp_possible) {
+ 		megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp,
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 5c6b5f5..a50825b 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1338,6 +1338,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ {
+ 	u64 start_lba = blk_rq_pos(scmd->request);
+ 	u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++	u64 factor = scmd->device->sector_size / 512;
+ 	u64 bad_lba;
+ 	int info_valid;
+ 	/*
+@@ -1359,16 +1360,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ 	if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ 		return 0;
+ 
+-	if (scmd->device->sector_size < 512) {
+-		/* only legitimate sector_size here is 256 */
+-		start_lba <<= 1;
+-		end_lba <<= 1;
+-	} else {
+-		/* be careful ... don't want any overflows */
+-		u64 factor = scmd->device->sector_size / 512;
+-		do_div(start_lba, factor);
+-		do_div(end_lba, factor);
+-	}
++	/* be careful ... don't want any overflows */
++	do_div(start_lba, factor);
++	do_div(end_lba, factor);
+ 
+ 	/* The bad lba was reported incorrectly, we have no idea where
+ 	 * the error is.
+@@ -1895,8 +1889,7 @@ got_data:
+ 	if (sector_size != 512 &&
+ 	    sector_size != 1024 &&
+ 	    sector_size != 2048 &&
+-	    sector_size != 4096 &&
+-	    sector_size != 256) {
++	    sector_size != 4096) {
+ 		sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ 			  sector_size);
+ 		/*
+@@ -1945,8 +1938,6 @@ got_data:
+ 		sdkp->capacity <<= 2;
+ 	else if (sector_size == 1024)
+ 		sdkp->capacity <<= 1;
+-	else if (sector_size == 256)
+-		sdkp->capacity >>= 1;
+ 
+ 	blk_queue_physical_block_size(sdp->request_queue,
+ 				      sdkp->physical_block_size);
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 2d25616..b4cac39 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
+ 			md->from_user = 0;
+ 	}
+ 
++	if (unlikely(iov_count > UIO_MAXIOV))
++		return -EINVAL;
++
+ 	if (iov_count) {
+ 		int len, size = sizeof(struct sg_iovec) * iov_count;
+ 		struct iovec *iov;
+diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
+index c43a9e8..54ef3d4 100644
+--- a/drivers/staging/hv/storvsc_drv.c
++++ b/drivers/staging/hv/storvsc_drv.c
+@@ -940,23 +940,24 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
+ 			if (bounce_sgl[j].length == PAGE_SIZE) {
+ 				/* full..move to next entry */
+ 				kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++				bounce_addr = 0;
+ 				j++;
++			}
+ 
+-				/* if we need to use another bounce buffer */
+-				if (srclen || i != orig_sgl_count - 1)
+-					bounce_addr =
++			/* if we need to use another bounce buffer */
++			if (srclen && bounce_addr == 0)
++				bounce_addr =
+ 					(unsigned long)kmap_atomic(
+ 					sg_page((&bounce_sgl[j])), KM_IRQ0);
+ 
+-			} else if (srclen == 0 && i == orig_sgl_count - 1) {
+-				/* unmap the last bounce that is < PAGE_SIZE */
+-				kunmap_atomic((void *)bounce_addr, KM_IRQ0);
+-			}
+ 		}
+ 
+ 		kunmap_atomic((void *)(src_addr - orig_sgl[i].offset), KM_IRQ0);
+ 	}
+ 
++	if (bounce_addr)
++		kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++
+ 	local_irq_restore(flags);
+ 
+ 	return total_copied;
+diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
+index 2d3a420..955c6de 100644
+--- a/drivers/staging/line6/pcm.c
++++ b/drivers/staging/line6/pcm.c
+@@ -88,10 +88,13 @@ static DEVICE_ATTR(impulse_period, S_IWUSR | S_IRUGO, pcm_get_impulse_period,
+ 
+ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ {
+-	unsigned long flags_old =
+-	    __sync_fetch_and_or(&line6pcm->flags, channels);
+-	unsigned long flags_new = flags_old | channels;
+-	int err = 0;
++	unsigned long flags_old, flags_new;
++	int err;
++
++	do {
++		flags_old = ACCESS_ONCE(line6pcm->flags);
++		flags_new = flags_old | channels;
++	} while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+ 
+ #if LINE6_BACKUP_MONITOR_SIGNAL
+ 	if (!(line6pcm->line6->properties->capabilities & LINE6_BIT_HWMON)) {
+@@ -133,10 +136,8 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ 		line6pcm->prev_fsize = 0;
+ 		err = line6_submit_audio_in_all_urbs(line6pcm);
+ 
+-		if (err < 0) {
+-			__sync_fetch_and_and(&line6pcm->flags, ~channels);
+-			return err;
+-		}
++		if (err < 0)
++			goto fail;
+ 	}
+ 
+ 	if (((flags_old & MASK_PLAYBACK) == 0) &&
+@@ -160,20 +161,29 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ 		line6pcm->count_out = 0;
+ 		err = line6_submit_audio_out_all_urbs(line6pcm);
+ 
+-		if (err < 0) {
+-			__sync_fetch_and_and(&line6pcm->flags, ~channels);
+-			return err;
+-		}
++		if (err < 0)
++			goto fail;
+ 	}
+ 
+ 	return 0;
++
++fail:
++	do {
++		flags_old = ACCESS_ONCE(line6pcm->flags);
++		flags_new = flags_old & ~channels;
++	} while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
++
++	return err;
+ }
+ 
+ int line6_pcm_stop(struct snd_line6_pcm *line6pcm, int channels)
+ {
+-	unsigned long flags_old =
+-	    __sync_fetch_and_and(&line6pcm->flags, ~channels);
+-	unsigned long flags_new = flags_old & ~channels;
++	unsigned long flags_old, flags_new;
++
++	do {
++		flags_old = ACCESS_ONCE(line6pcm->flags);
++		flags_new = flags_old & ~channels;
++	} while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+ 
+ 	if (((flags_old & MASK_CAPTURE) != 0) &&
+ 	    ((flags_new & MASK_CAPTURE) == 0)) {
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index 4683d5f..9a584da 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -274,11 +274,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
+  * LCD types
+  */
+ #define LCD_TYPE_NONE		0
+-#define LCD_TYPE_OLD		1
+-#define LCD_TYPE_KS0074		2
+-#define LCD_TYPE_HANTRONIX	3
+-#define LCD_TYPE_NEXCOM		4
+-#define LCD_TYPE_CUSTOM		5
++#define LCD_TYPE_CUSTOM		1
++#define LCD_TYPE_OLD		2
++#define LCD_TYPE_KS0074		3
++#define LCD_TYPE_HANTRONIX	4
++#define LCD_TYPE_NEXCOM		5
+ 
+ /*
+  * keypad types
+@@ -456,8 +456,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");
+ static int lcd_type = -1;
+ module_param(lcd_type, int, 0000);
+ MODULE_PARM_DESC(lcd_type,
+-		 "LCD type: 0=none, 1=old //, 2=serial ks0074, "
+-		 "3=hantronix //, 4=nexcom //, 5=compiled-in");
++		 "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom");
+ 
+ static int lcd_proto = -1;
+ module_param(lcd_proto, int, 0000);
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index ebf9b60..1fb9e58 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -569,6 +569,7 @@ static struct se_device *pscsi_create_virtdevice(
+ 					" pdv_host_id: %d\n", pdv->pdv_host_id);
+ 				return ERR_PTR(-EINVAL);
+ 			}
++			pdv->pdv_lld_host = sh;
+ 		}
+ 	} else {
+ 		if (phv->phv_mode == PHV_VIRUTAL_HOST_ID) {
+@@ -655,6 +656,8 @@ static void pscsi_free_device(void *p)
+ 		if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
+ 		    (phv->phv_lld_host != NULL))
+ 			scsi_host_put(phv->phv_lld_host);
++		else if (pdv->pdv_lld_host)
++			scsi_host_put(pdv->pdv_lld_host);
+ 
+ 		if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
+ 			scsi_device_put(sd);
+diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
+index fdc17b6..8b0a336 100644
+--- a/drivers/target/target_core_pscsi.h
++++ b/drivers/target/target_core_pscsi.h
+@@ -46,6 +46,7 @@ struct pscsi_dev_virt {
+ 	struct block_device *pdv_bd;
+ 	struct scsi_device *pdv_sd;
+ 	struct se_hba *pdv_se_hba;
++	struct Scsi_Host *pdv_lld_host;
+ } ____cacheline_aligned;
+ 
+ typedef enum phv_modes {
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 52fdf60..df8f8e0 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -167,7 +167,7 @@ static int __init xen_hvc_init(void)
+ 
+ 	if (xen_initial_domain()) {
+ 		ops = &dom0_hvc_ops;
+-		xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++		xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ 	} else {
+ 		if (!xen_start_info->console.domU.evtchn)
+ 			return -ENODEV;
+diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
+index 6563cad..746e771 100644
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ 	{ .compatible = "ibm,qpace-nwp-serial",
+ 		.data = (void *)PORT_NWPSERIAL, },
+ #endif
+-	{ .type = "serial",         .data = (void *)PORT_UNKNOWN, },
+ 	{ /* end of list */ },
+ };
+ 
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 6cd4143..d9706e7 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+ 
+ static int __devinit ulite_probe(struct platform_device *pdev)
+ {
+-	struct resource *res, *res2;
++	struct resource *res;
++	int irq;
+ 	int id = pdev->id;
+ #ifdef CONFIG_OF
+ 	const __be32 *prop;
+@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
+ 	if (!res)
+ 		return -ENODEV;
+ 
+-	res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!res2)
+-		return -ENODEV;
++	irq = platform_get_irq(pdev, 0);
++	if (irq <= 0)
++		return -ENXIO;
+ 
+-	return ulite_assign(&pdev->dev, id, res->start, res2->start);
++	return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+ 
+ static int __devexit ulite_remove(struct platform_device *pdev)
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b627363..778c39a 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
+  **/
+ static int __devinit xuartps_probe(struct platform_device *pdev)
+ {
+-	int rc;
++	int rc, irq;
+ 	struct uart_port *port;
+-	struct resource *res, *res2;
++	struct resource *res;
+ 	int clk = 0;
+ 
+ #ifdef CONFIG_OF
+@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ 	if (!res)
+ 		return -ENODEV;
+ 
+-	res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+-	if (!res2)
+-		return -ENODEV;
++	irq = platform_get_irq(pdev, 0);
++	if (irq <= 0)
++		return -ENXIO;
+ 
+ 	/* Initialize the port structure */
+ 	port = xuartps_get_port();
+@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ 		 * and triggers invocation of the config_port() entry point.
+ 		 */
+ 		port->mapbase = res->start;
+-		port->irq = res2->start;
++		port->irq = irq;
+ 		port->dev = &pdev->dev;
+ 		port->uartclk = clk;
+ 		dev_set_drvdata(&pdev->dev, port);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 360ddb5..57d6302 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -947,11 +947,16 @@ static int acm_probe(struct usb_interface *intf,
+ 	}
+ 
+ 	while (buflen > 0) {
++		elength = buffer[0];
++		if (!elength) {
++			dev_err(&intf->dev, "skipping garbage byte\n");
++			elength = 1;
++			goto next_desc;
++		}
+ 		if (buffer[1] != USB_DT_CS_INTERFACE) {
+ 			dev_err(&intf->dev, "skipping garbage\n");
+ 			goto next_desc;
+ 		}
+-		elength = buffer[0];
+ 
+ 		switch (buffer[2]) {
+ 		case USB_CDC_UNION_TYPE: /* we've found it */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 06dfb4f..d34005b 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -224,7 +224,7 @@ static void wdm_int_callback(struct urb *urb)
+ 	case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+ 		dev_dbg(&desc->intf->dev,
+ 			"NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
+-			dr->wIndex, dr->wLength);
++			le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
+ 		break;
+ 
+ 	case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+@@ -237,14 +237,16 @@ static void wdm_int_callback(struct urb *urb)
+ 		clear_bit(WDM_POLL_RUNNING, &desc->flags);
+ 		dev_err(&desc->intf->dev,
+ 			"unknown notification %d received: index %d len %d\n",
+-			dr->bNotificationType, dr->wIndex, dr->wLength);
++			dr->bNotificationType,
++			le16_to_cpu(dr->wIndex),
++			le16_to_cpu(dr->wLength));
+ 		goto exit;
+ 	}
+ 
+ 	req->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
+ 	req->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+ 	req->wValue = 0;
+-	req->wIndex = desc->inum;
++	req->wIndex = desc->inum; /* already converted */
+ 	req->wLength = cpu_to_le16(desc->wMaxCommand);
+ 
+ 	usb_fill_control_urb(
+@@ -401,7 +403,7 @@ static ssize_t wdm_write
+ 			     USB_RECIP_INTERFACE);
+ 	req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
+ 	req->wValue = 0;
+-	req->wIndex = desc->inum;
++	req->wIndex = desc->inum; /* already converted */
+ 	req->wLength = cpu_to_le16(count);
+ 	set_bit(WDM_IN_USE, &desc->flags);
+ 	desc->outbuf = buf;
+@@ -414,7 +416,7 @@ static ssize_t wdm_write
+ 		dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ 	} else {
+ 		dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
+-			req->wIndex);
++			le16_to_cpu(req->wIndex));
+ 	}
+ out:
+ 	usb_autopm_put_interface(desc->intf);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 25e9eb4..a47e29a 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2060,8 +2060,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		break;
+ 	case COMP_DEV_ERR:
+ 	case COMP_STALL:
++		frame->status = -EPROTO;
++		skip_td = true;
++		break;
+ 	case COMP_TX_ERR:
+ 		frame->status = -EPROTO;
++		if (event_trb != td->last_trb)
++			return 0;
+ 		skip_td = true;
+ 		break;
+ 	case COMP_STOP:
+@@ -2646,7 +2651,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ 		xhci_halt(xhci);
+ hw_died:
+ 		spin_unlock(&xhci->lock);
+-		return -ESHUTDOWN;
++		return IRQ_HANDLED;
+ 	}
+ 
+ 	/*
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index efbdf83..d676ae0 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1231,7 +1231,7 @@ union xhci_trb {
+  * since the command ring is 64-byte aligned.
+  * It must also be greater than 16.
+  */
+-#define TRBS_PER_SEGMENT	64
++#define TRBS_PER_SEGMENT	256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS	(TRBS_PER_SEGMENT - 3)
+ #define SEGMENT_SIZE		(TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 641caf8..6f7d84e 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1524,16 +1524,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ 		(devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
+ 		musb->int_usb, musb->int_tx, musb->int_rx);
+ 
+-	/* the core can interrupt us for multiple reasons; docs have
+-	 * a generic interrupt flowchart to follow
++	/**
++	 * According to Mentor Graphics' documentation, flowchart on page 98,
++	 * IRQ should be handled as follows:
++	 *
++	 * . Resume IRQ
++	 * . Session Request IRQ
++	 * . VBUS Error IRQ
++	 * . Suspend IRQ
++	 * . Connect IRQ
++	 * . Disconnect IRQ
++	 * . Reset/Babble IRQ
++	 * . SOF IRQ (we're not using this one)
++	 * . Endpoint 0 IRQ
++	 * . TX Endpoints
++	 * . RX Endpoints
++	 *
++	 * We will be following that flowchart in order to avoid any problems
++	 * that might arise with internal Finite State Machine.
+ 	 */
++
+ 	if (musb->int_usb)
+ 		retval |= musb_stage0_irq(musb, musb->int_usb,
+ 				devctl, power);
+ 
+-	/* "stage 1" is handling endpoint irqs */
+-
+-	/* handle endpoint 0 first */
+ 	if (musb->int_tx & 1) {
+ 		if (devctl & MUSB_DEVCTL_HM)
+ 			retval |= musb_h_ep0_irq(musb);
+@@ -1541,43 +1555,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ 			retval |= musb_g_ep0_irq(musb);
+ 	}
+ 
+-	/* RX on endpoints 1-15 */
+-	reg = musb->int_rx >> 1;
++	reg = musb->int_tx >> 1;
+ 	ep_num = 1;
+ 	while (reg) {
+ 		if (reg & 1) {
+-			/* musb_ep_select(musb->mregs, ep_num); */
+-			/* REVISIT just retval = ep->rx_irq(...) */
+ 			retval = IRQ_HANDLED;
+ 			if (devctl & MUSB_DEVCTL_HM) {
+ 				if (is_host_capable())
+-					musb_host_rx(musb, ep_num);
++					musb_host_tx(musb, ep_num);
+ 			} else {
+ 				if (is_peripheral_capable())
+-					musb_g_rx(musb, ep_num);
++					musb_g_tx(musb, ep_num);
+ 			}
+ 		}
+-
+ 		reg >>= 1;
+ 		ep_num++;
+ 	}
+ 
+-	/* TX on endpoints 1-15 */
+-	reg = musb->int_tx >> 1;
++	reg = musb->int_rx >> 1;
+ 	ep_num = 1;
+ 	while (reg) {
+ 		if (reg & 1) {
+-			/* musb_ep_select(musb->mregs, ep_num); */
+-			/* REVISIT just retval |= ep->tx_irq(...) */
+ 			retval = IRQ_HANDLED;
+ 			if (devctl & MUSB_DEVCTL_HM) {
+ 				if (is_host_capable())
+-					musb_host_tx(musb, ep_num);
++					musb_host_rx(musb, ep_num);
+ 			} else {
+ 				if (is_peripheral_capable())
+-					musb_g_tx(musb, ep_num);
++					musb_g_rx(musb, ep_num);
+ 			}
+ 		}
++
+ 		reg >>= 1;
+ 		ep_num++;
+ 	}
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7f32c74..073a0f98 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ 	{ USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ 	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
++	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
++	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e13ebb0..8257d3b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+ 	{ USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ 	{ USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++	{ USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+ 	{ USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ 	{ USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ 	{ USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 361192c..e4a57bb 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -155,6 +155,7 @@
+ #define XSENS_AWINDA_STATION_PID 0x0101
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID		0x0200	/* Xsens MTw */
++#define XSENS_MTDEVBOARD_PID	0x0300	/* Motion Tracker Development Board */
+ #define XSENS_CONVERTER_PID	0xD00D	/* Xsens USB-serial converter */
+ 
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7ba38ea..a440387 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
+ 	{ USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
+-	{ USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 71fd9da..e3b7af8 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -62,10 +62,6 @@
+ #define ALCATEL_VENDOR_ID	0x11f7
+ #define ALCATEL_PRODUCT_ID	0x02df
+ 
+-/* Samsung I330 phone cradle */
+-#define SAMSUNG_VENDOR_ID	0x04e8
+-#define SAMSUNG_PRODUCT_ID	0x8001
+-
+ #define SIEMENS_VENDOR_ID	0x11f5
+ #define SIEMENS_PRODUCT_ID_SX1	0x0001
+ #define SIEMENS_PRODUCT_ID_X65	0x0003
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 0e2c2de..68e8552 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -752,6 +752,13 @@ UNUSUAL_DEV(  0x059f, 0x0643, 0x0000, 0x0000,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_GO_SLOW ),
+ 
++/* Reported by Christian Schaller <cschalle@redhat.com> */
++UNUSUAL_DEV(  0x059f, 0x0651, 0x0000, 0x0000,
++		"LaCie",
++		"External HDD",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_WP_DETECT ),
++
+ /* Submitted by Joel Bourquard <numlock@freesurf.ch>
+  * Some versions of this device need the SubClass and Protocol overrides
+  * while others don't.
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index f6227cc..bcf7711 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -895,7 +895,7 @@ static int find_virq(unsigned int virq, unsigned int cpu)
+ 	return rc;
+ }
+ 
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ 	struct evtchn_bind_virq bind_virq;
+ 	int evtchn, irq, ret;
+@@ -909,8 +909,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+ 		if (irq == -1)
+ 			goto out;
+ 
+-		irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+-					      handle_percpu_irq, "virq");
++		if (percpu)
++			irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++						      handle_percpu_irq, "virq");
++		else
++			irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++						      handle_edge_irq, "virq");
+ 
+ 		bind_virq.virq = virq;
+ 		bind_virq.vcpu = cpu;
+@@ -1023,7 +1027,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ {
+ 	int irq, retval;
+ 
+-	irq = bind_virq_to_irq(virq, cpu);
++	irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ 	if (irq < 0)
+ 		return irq;
+ 	retval = request_irq(irq, handler, irqflags, devname, dev_id);
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 82ab1c3..bb8cb69 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+ 
+-bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+ 
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+  * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ 		 * This means that some fields may still be read-only because
+ 		 * they have entries in the config_field list that intercept
+ 		 * the write and do nothing. */
+-		if (dev_data->permissive || permissive) {
++		if (dev_data->permissive || xen_pcibk_permissive) {
+ 			switch (size) {
+ 			case 1:
+ 				err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index 2e1d73d..62461a8 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,7 +64,7 @@ struct config_field_entry {
+ 	void *data;
+ };
+ 
+-extern bool permissive;
++extern bool xen_pcibk_permissive;
+ 
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+ 
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index a5bb81a..1667a90 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ 
+ 	cmd->val = value;
+ 
+-	if (!permissive && (!dev_data || !dev_data->permissive))
++	if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
+ 		return 0;
+ 
+ 	/* Only allow the guest to control certain bits. */
+diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
+index cf38e15..08d90e2 100644
+--- a/firmware/ihex2fw.c
++++ b/firmware/ihex2fw.c
+@@ -86,6 +86,7 @@ int main(int argc, char **argv)
+ 		case 'j':
+ 			include_jump = 1;
+ 			break;
++		default:
+ 			return usage();
+ 		}
+ 	}
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 2aed667..d252462 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -746,6 +746,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 	    i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ 		int elf_prot = 0, elf_flags;
+ 		unsigned long k, vaddr;
++		unsigned long total_size = 0;
+ 
+ 		if (elf_ppnt->p_type != PT_LOAD)
+ 			continue;
+@@ -809,10 +810,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ #else
+ 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++			total_size = total_mapping_size(elf_phdata,
++							loc->elf_ex.e_phnum);
++			if (!total_size) {
++				retval = -EINVAL;
++				goto out_free_dentry;
++			}
+ 		}
+ 
+ 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+-				elf_prot, elf_flags, 0);
++				elf_prot, elf_flags, total_size);
+ 		if (BAD_ADDR(error)) {
+ 			send_sig(SIGKILL, current, 0);
+ 			retval = IS_ERR((void *)error) ?
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index a694317..da528f8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5678,12 +5678,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
+ 		return -ENOSPC;
+ 	}
+ 
+-	if (btrfs_test_opt(root, DISCARD))
+-		ret = btrfs_discard_extent(root, start, len, NULL);
+-
+ 	if (pin)
+ 		pin_down_extent(root, cache, start, len, 1);
+ 	else {
++		if (btrfs_test_opt(root, DISCARD))
++			ret = btrfs_discard_extent(root, start, len, NULL);
+ 		btrfs_add_free_space(cache, start, len);
+ 		btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
+ 	}
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7cbe2f8..52bacff 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2263,6 +2263,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ 	if (off + len == src->i_size)
+ 		len = ALIGN(src->i_size, bs) - off;
+ 
++	if (len == 0) {
++		ret = 0;
++		goto out_unlock;
++	}
++
+ 	/* verify the end result is block aligned */
+ 	if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
+ 	    !IS_ALIGNED(destoff, bs))
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index 3848b04..60ff45e 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
+ /*
+  * Check if the attribute is in a supported namespace.
+  *
+- * This applied after the check for the synthetic attributes in the system
++ * This is applied after the check for the synthetic attributes in the system
+  * namespace.
+  */
+-static bool btrfs_is_valid_xattr(const char *name)
++static int btrfs_is_valid_xattr(const char *name)
+ {
+-	return !strncmp(name, XATTR_SECURITY_PREFIX,
+-			XATTR_SECURITY_PREFIX_LEN) ||
+-	       !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
+-	       !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+-	       !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
++	int len = strlen(name);
++	int prefixlen = 0;
++
++	if (!strncmp(name, XATTR_SECURITY_PREFIX,
++			XATTR_SECURITY_PREFIX_LEN))
++		prefixlen = XATTR_SECURITY_PREFIX_LEN;
++	else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
++		prefixlen = XATTR_SYSTEM_PREFIX_LEN;
++	else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++		prefixlen = XATTR_TRUSTED_PREFIX_LEN;
++	else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
++		prefixlen = XATTR_USER_PREFIX_LEN;
++	else
++		return -EOPNOTSUPP;
++
++	/*
++	 * The name cannot consist of just prefix
++	 */
++	if (len <= prefixlen)
++		return -EINVAL;
++
++	return 0;
+ }
+ 
+ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ 		       void *buffer, size_t size)
+ {
++	int ret;
++
+ 	/*
+ 	 * If this is a request for a synthetic attribute in the system.*
+ 	 * namespace use the generic infrastructure to resolve a handler
+@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ 		return generic_getxattr(dentry, name, buffer, size);
+ 
+-	if (!btrfs_is_valid_xattr(name))
+-		return -EOPNOTSUPP;
++	ret = btrfs_is_valid_xattr(name);
++	if (ret)
++		return ret;
+ 	return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
+ }
+ 
+@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ 		   size_t size, int flags)
+ {
+ 	struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++	int ret;
+ 
+ 	/*
+ 	 * The permission on security.* and system.* is not checked
+@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ 		return generic_setxattr(dentry, name, value, size, flags);
+ 
+-	if (!btrfs_is_valid_xattr(name))
+-		return -EOPNOTSUPP;
++	ret = btrfs_is_valid_xattr(name);
++	if (ret)
++		return ret;
+ 
+ 	if (size == 0)
+ 		value = "";  /* empty EA, do not remove */
+@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ {
+ 	struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++	int ret;
+ 
+ 	/*
+ 	 * The permission on security.* and system.* is not checked
+@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ 	if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ 		return generic_removexattr(dentry, name);
+ 
+-	if (!btrfs_is_valid_xattr(name))
+-		return -EOPNOTSUPP;
++	ret = btrfs_is_valid_xattr(name);
++	if (ret)
++		return ret;
+ 
+ 	return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0,
+ 				XATTR_REPLACE);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 8bc98af..8a35300 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1016,13 +1016,13 @@ ascend:
+ 		/* might go back up the wrong parent if we have had a rename */
+ 		if (!locked && read_seqretry(&rename_lock, seq))
+ 			goto rename_retry;
+-		next = child->d_child.next;
+-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++		/* go into the first sibling still alive */
++		do {
++			next = child->d_child.next;
+ 			if (next == &this_parent->d_subdirs)
+ 				goto ascend;
+ 			child = list_entry(next, struct dentry, d_child);
+-			next = next->next;
+-		}
++		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ 		rcu_read_unlock();
+ 		goto resume;
+ 	}
+@@ -1142,13 +1142,13 @@ ascend:
+ 		/* might go back up the wrong parent if we have had a rename */
+ 		if (!locked && read_seqretry(&rename_lock, seq))
+ 			goto rename_retry;
+-		next = child->d_child.next;
+-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++		/* go into the first sibling still alive */
++		do {
++			next = child->d_child.next;
+ 			if (next == &this_parent->d_subdirs)
+ 				goto ascend;
+ 			child = list_entry(next, struct dentry, d_child);
+-			next = next->next;
+-		}
++		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ 		rcu_read_unlock();
+ 		goto resume;
+ 	}
+@@ -2938,13 +2938,13 @@ ascend:
+ 		/* might go back up the wrong parent if we have had a rename */
+ 		if (!locked && read_seqretry(&rename_lock, seq))
+ 			goto rename_retry;
+-		next = child->d_child.next;
+-		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++		/* go into the first sibling still alive */
++		do {
++			next = child->d_child.next;
+ 			if (next == &this_parent->d_subdirs)
+ 				goto ascend;
+ 			child = list_entry(next, struct dentry, d_child);
+-			next = next->next;
+-		}
++		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ 		rcu_read_unlock();
+ 		goto resume;
+ 	}
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index a15f1e2..74f03b5 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -135,6 +135,7 @@ static void debugfs_evict_inode(struct inode *inode)
+ 
+ static const struct super_operations debugfs_super_operations = {
+ 	.evict_inode	= debugfs_evict_inode,
++	.statfs		= simple_statfs,
+ };
+ 
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 834d9a1..2da63ab 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -321,7 +321,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ 	ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+ 	ext4_lblk_t last = lblock + len - 1;
+ 
+-	if (lblock > last)
++	if (len == 0 || lblock > last)
+ 		return 0;
+ 	return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+@@ -4470,13 +4470,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ 	struct ext4_map_blocks map;
+ 	unsigned int credits, blkbits = inode->i_blkbits;
+ 
+-	/*
+-	 * currently supporting (pre)allocate mode for extent-based
+-	 * files _only_
+-	 */
+-	if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+-		return -EOPNOTSUPP;
+-
+ 	/* Return error if mode is not supported */
+ 	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ 		return -EOPNOTSUPP;
+@@ -4497,6 +4490,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ 	 */
+ 	credits = ext4_chunk_trans_blocks(inode, max_blocks);
+ 	mutex_lock(&inode->i_mutex);
++
++	/*
++	 * We only support preallocation for extent-based files only
++	 */
++	if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++		ret = -EOPNOTSUPP;
++		goto out;
++	}
++
+ 	ret = inode_newsize_ok(inode, (len + offset));
+ 	if (ret) {
+ 		mutex_unlock(&inode->i_mutex);
+@@ -4553,6 +4555,7 @@ retry:
+ 		ret = 0;
+ 		goto retry;
+ 	}
++out:
+ 	mutex_unlock(&inode->i_mutex);
+ 	trace_ext4_fallocate_exit(inode, offset, max_blocks,
+ 				ret > 0 ? ret2 : ret);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index c9f2e3d..cd1dd49 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1456,7 +1456,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 			  struct inode *inode)
+ {
+ 	struct inode *dir = dentry->d_parent->d_inode;
+-	struct buffer_head *bh;
++	struct buffer_head *bh = NULL;
+ 	struct ext4_dir_entry_2 *de;
+ 	struct super_block *sb;
+ 	int	retval;
+@@ -1471,7 +1471,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 	if (is_dx(dir)) {
+ 		retval = ext4_dx_add_entry(handle, dentry, inode);
+ 		if (!retval || (retval != ERR_BAD_DX_DIR))
+-			return retval;
++			goto out;
+ 		ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ 		dx_fallback++;
+ 		ext4_mark_inode_dirty(handle, dir);
+@@ -1482,14 +1482,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 		if(!bh)
+ 			return retval;
+ 		retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+-		if (retval != -ENOSPC) {
+-			brelse(bh);
+-			return retval;
+-		}
++		if (retval != -ENOSPC)
++			goto out;
+ 
+ 		if (blocks == 1 && !dx_fallback &&
+-		    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+-			return make_indexed_dir(handle, dentry, inode, bh);
++		    EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++			retval = make_indexed_dir(handle, dentry, inode, bh);
++			bh = NULL; /* make_indexed_dir releases bh */
++			goto out;
++		}
+ 		brelse(bh);
+ 	}
+ 	bh = ext4_append(handle, dir, &block, &retval);
+@@ -1499,6 +1500,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ 	de->inode = 0;
+ 	de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
+ 	retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ 	brelse(bh);
+ 	if (retval == 0)
+ 		ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 6b08864..c9e18f3 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -196,8 +196,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ 		goto out_err;
+ 	}
+ 	/* copy the full handle */
+-	if (copy_from_user(handle, ufh,
+-			   sizeof(struct file_handle) +
++	*handle = f_handle;
++	if (copy_from_user(&handle->f_handle,
++			   &ufh->f_handle,
+ 			   f_handle.handle_bytes)) {
+ 		retval = -EFAULT;
+ 		goto out_handle;
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index da6d7ba..421834b 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -711,11 +711,16 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
+ {
+ 	jbd2_journal_revoke_header_t *header;
+ 	int offset, max;
++	__u32 rcount;
+ 	int record_len = 4;
+ 
+ 	header = (jbd2_journal_revoke_header_t *) bh->b_data;
+ 	offset = sizeof(jbd2_journal_revoke_header_t);
+-	max = be32_to_cpu(header->r_count);
++	rcount = be32_to_cpu(header->r_count);
++
++	if (rcount > journal->j_blocksize)
++		return -EINVAL;
++	max = rcount;
+ 
+ 	if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+ 		record_len = 8;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 6e91f8b..d455ea0 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3272,10 +3272,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess
+ 	return nfserr_old_stateid;
+ }
+ 
++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
++{
++	if (ols->st_stateowner->so_is_open_owner &&
++	    !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++		return nfserr_bad_stateid;
++	return nfs_ok;
++}
++
+ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ {
+ 	struct nfs4_stid *s;
+-	struct nfs4_ol_stateid *ols;
+ 	__be32 status;
+ 
+ 	if (STALE_STATEID(stateid))
+@@ -3289,11 +3296,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ 		return status;
+ 	if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
+ 		return nfs_ok;
+-	ols = openlockstateid(s);
+-	if (ols->st_stateowner->so_is_open_owner
+-	    && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
+-		return nfserr_bad_stateid;
+-	return nfs_ok;
++	return nfsd4_check_openowner_confirmed(openlockstateid(s));
+ }
+ 
+ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
+@@ -3360,8 +3363,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
+ 		status = nfs4_check_fh(current_fh, stp);
+ 		if (status)
+ 			goto out;
+-		if (stp->st_stateowner->so_is_open_owner
+-		    && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++		status = nfsd4_check_openowner_confirmed(stp);
++		if (status)
+ 			goto out;
+ 		status = nfs4_check_openmode(stp, flags);
+ 		if (status)
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae1..090d8ce 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ 	nchildren = nilfs_btree_node_get_nchildren(node);
+ 
+ 	if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+-		     level > NILFS_BTREE_LEVEL_MAX ||
++		     level >= NILFS_BTREE_LEVEL_MAX ||
+ 		     nchildren < 0 ||
+ 		     nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ 		pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index dbc372e..7ba6ac1 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -729,6 +729,19 @@ lookup:
+ 	if (tmpres) {
+ 		spin_unlock(&dlm->spinlock);
+ 		spin_lock(&tmpres->spinlock);
++
++		/*
++		 * Right after dlm spinlock was released, dlm_thread could have
++		 * purged the lockres. Check if lockres got unhashed. If so
++		 * start over.
++		 */
++		if (hlist_unhashed(&tmpres->hash_node)) {
++			spin_unlock(&tmpres->spinlock);
++			dlm_lockres_put(tmpres);
++			tmpres = NULL;
++			goto lookup;
++		}
++
+ 		/* Wait on the thread that is mastering the resource */
+ 		if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ 			__dlm_wait_on_lockres(tmpres);
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index e043c4c..f58f1c4 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -361,7 +361,7 @@ nomem:
+ }
+ 
+ enum {
+-	Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++	Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+ 
+ static const match_table_t tokens = {
+@@ -370,6 +370,7 @@ static const match_table_t tokens = {
+ 	{Opt_umask, "umask=%o"},
+ 	{Opt_dmask, "dmask=%o"},
+ 	{Opt_fmask, "fmask=%o"},
++	{Opt_err, NULL},
+ };
+ 
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8ca88fc..d2cbeff 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
+ }
+ 
+ static int
+-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+-			int atomic)
++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
++			size_t *remaining, int atomic)
+ {
+ 	unsigned long copy;
+ 
+-	while (len > 0) {
++	while (*remaining > 0) {
+ 		while (!iov->iov_len)
+ 			iov++;
+-		copy = min_t(unsigned long, len, iov->iov_len);
++		copy = min_t(unsigned long, *remaining, iov->iov_len);
+ 
+ 		if (atomic) {
+-			if (__copy_from_user_inatomic(to, iov->iov_base, copy))
++			if (__copy_from_user_inatomic(addr + *offset,
++						      iov->iov_base, copy))
+ 				return -EFAULT;
+ 		} else {
+-			if (copy_from_user(to, iov->iov_base, copy))
++			if (copy_from_user(addr + *offset,
++					   iov->iov_base, copy))
+ 				return -EFAULT;
+ 		}
+-		to += copy;
+-		len -= copy;
++		*offset += copy;
++		*remaining -= copy;
+ 		iov->iov_base += copy;
+ 		iov->iov_len -= copy;
+ 	}
+@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+ }
+ 
+ static int
+-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
+-		      int atomic)
++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
++		      size_t *remaining, int atomic)
+ {
+ 	unsigned long copy;
+ 
+-	while (len > 0) {
++	while (*remaining > 0) {
+ 		while (!iov->iov_len)
+ 			iov++;
+-		copy = min_t(unsigned long, len, iov->iov_len);
++		copy = min_t(unsigned long, *remaining, iov->iov_len);
+ 
+ 		if (atomic) {
+-			if (__copy_to_user_inatomic(iov->iov_base, from, copy))
++			if (__copy_to_user_inatomic(iov->iov_base,
++						    addr + *offset, copy))
+ 				return -EFAULT;
+ 		} else {
+-			if (copy_to_user(iov->iov_base, from, copy))
++			if (copy_to_user(iov->iov_base,
++					 addr + *offset, copy))
+ 				return -EFAULT;
+ 		}
+-		from += copy;
+-		len -= copy;
++		*offset += copy;
++		*remaining -= copy;
+ 		iov->iov_base += copy;
+ 		iov->iov_len -= copy;
+ 	}
+@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ 			struct pipe_buffer *buf = pipe->bufs + curbuf;
+ 			const struct pipe_buf_operations *ops = buf->ops;
+ 			void *addr;
+-			size_t chars = buf->len;
++			size_t chars = buf->len, remaining;
+ 			int error, atomic;
+ 
+ 			if (chars > total_len)
+@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ 			}
+ 
+ 			atomic = !iov_fault_in_pages_write(iov, chars);
++			remaining = chars;
+ redo:
+ 			addr = ops->map(pipe, buf, atomic);
+-			error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
++			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
++						      &remaining, atomic);
+ 			ops->unmap(pipe, buf, addr);
+ 			if (unlikely(error)) {
+ 				/*
+@@ -414,7 +420,6 @@ redo:
+ 				break;
+ 			}
+ 			ret += chars;
+-			buf->offset += chars;
+ 			buf->len -= chars;
+ 
+ 			/* Was it a packet buffer? Clean up and exit */
+@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ 		if (ops->can_merge && offset + chars <= PAGE_SIZE) {
+ 			int error, atomic = 1;
+ 			void *addr;
++			size_t remaining = chars;
+ 
+ 			error = ops->confirm(pipe, buf);
+ 			if (error)
+@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ 			iov_fault_in_pages_read(iov, chars);
+ redo1:
+ 			addr = ops->map(pipe, buf, atomic);
+-			error = pipe_iov_copy_from_user(offset + addr, iov,
+-							chars, atomic);
++			error = pipe_iov_copy_from_user(addr, &offset, iov,
++							&remaining, atomic);
+ 			ops->unmap(pipe, buf, addr);
+ 			ret = error;
+ 			do_wakeup = 1;
+@@ -565,6 +571,8 @@ redo1:
+ 			struct page *page = pipe->tmp_page;
+ 			char *src;
+ 			int error, atomic = 1;
++			int offset = 0;
++			size_t remaining;
+ 
+ 			if (!page) {
+ 				page = alloc_page(GFP_HIGHUSER);
+@@ -585,14 +593,15 @@ redo1:
+ 				chars = total_len;
+ 
+ 			iov_fault_in_pages_read(iov, chars);
++			remaining = chars;
+ redo2:
+ 			if (atomic)
+ 				src = kmap_atomic(page, KM_USER0);
+ 			else
+ 				src = kmap(page);
+ 
+-			error = pipe_iov_copy_from_user(src, iov, chars,
+-							atomic);
++			error = pipe_iov_copy_from_user(src, &offset, iov,
++							&remaining, atomic);
+ 			if (atomic)
+ 				kunmap_atomic(src, KM_USER0);
+ 			else
+diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
+index f554a93..2ba218e 100644
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -125,7 +125,7 @@ void acpi_free(void *address);
+  */
+ acpi_status acpi_reallocate_root_table(void);
+ 
+-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address);
++acpi_status acpi_find_root_pointer(acpi_physical_address *rsdp_address);
+ 
+ acpi_status acpi_load_tables(void);
+ 
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index ed73f67..b0d7ef8 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -198,9 +198,29 @@ typedef int INT32;
+ typedef s32 acpi_native_int;
+ 
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+ 
++#else				/* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif				/* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR                    ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX                   ACPI_UINT32_MAX
+ 
+diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
+index 5af3ed5..b9f9210 100644
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -75,6 +75,7 @@
+ #define ACPI_CONSTANT_EVAL_ONLY
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+ 
+ #ifdef ACPI_EXEC_APP
+diff --git a/include/linux/jhash.h b/include/linux/jhash.h
+index 47cb09e..348c6f4 100644
+--- a/include/linux/jhash.h
++++ b/include/linux/jhash.h
+@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
+ }
+ 
+ 
+-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
+-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
+ {
+-	a += JHASH_INITVAL;
+-	b += JHASH_INITVAL;
++	a += initval;
++	b += initval;
+ 	c += initval;
+ 
+ 	__jhash_final(a, b, c);
+@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
+ 	return c;
+ }
+ 
++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++{
++	return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
++}
++
+ static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
+ {
+-	return jhash_3words(a, b, 0, initval);
++	return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
+ }
+ 
+ static inline u32 jhash_1word(u32 a, u32 initval)
+ {
+-	return jhash_3words(a, 0, 0, initval);
++	return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
+ }
+ 
+ #endif /* _LINUX_JHASH_H */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 42ac6ad..3d4b5b6 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -182,6 +182,7 @@ enum {
+ 	ATA_LFLAG_DISABLED	= (1 << 6), /* link is disabled */
+ 	ATA_LFLAG_SW_ACTIVITY	= (1 << 7), /* keep activity stats */
+ 	ATA_LFLAG_NO_LPM	= (1 << 8), /* disable LPM on this link */
++	ATA_LFLAG_CHANGED	= (1 << 10), /* LPM state changed on this link */
+ 
+ 	/* struct ata_port flags */
+ 	ATA_FLAG_SLAVE_POSS	= (1 << 0), /* host supports slave dev */
+@@ -284,6 +285,12 @@ enum {
+ 	 */
+ 	ATA_TMOUT_PMP_SRST_WAIT	= 5000,
+ 
++	/* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
++	 * be a spurious PHY event, so ignore the first PHY event that
++	 * occurs within 10s after the policy change.
++	 */
++	ATA_TMOUT_SPURIOUS_PHY	= 10000,
++
+ 	/* ATA bus states */
+ 	BUS_UNKNOWN		= 0,
+ 	BUS_DMA			= 1,
+@@ -728,6 +735,8 @@ struct ata_link {
+ 	struct ata_eh_context	eh_context;
+ 
+ 	struct ata_device	device[ATA_MAX_DEVICES];
++
++	unsigned long		last_lpm_change; /* when last LPM change happened */
+ };
+ #define ATA_LINK_CLEAR_BEGIN		offsetof(struct ata_link, active_tag)
+ #define ATA_LINK_CLEAR_END		offsetof(struct ata_link, device[0])
+@@ -1064,6 +1073,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
+ extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
+ extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
+ extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
++extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
+ 
+ extern int ata_cable_40wire(struct ata_port *ap);
+ extern int ata_cable_80wire(struct ata_port *ap);
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index 7454ad7..d4d512f 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -457,7 +457,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA          0
+ #define NILFS_BTREE_LEVEL_NODE_MIN      (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX           14
++#define NILFS_BTREE_LEVEL_MAX           14	/* Max level (exclusive) */
+ 
+ /**
+  * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 9bf9611..c81ef31 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -211,6 +211,9 @@ extern int of_property_read_string(struct device_node *np,
+ extern int of_property_read_string_index(struct device_node *np,
+ 					 const char *propname,
+ 					 int index, const char **output);
++extern int of_property_match_string(struct device_node *np,
++				    const char *propname,
++				    const char *string);
+ extern int of_property_count_strings(struct device_node *np,
+ 				     const char *propname);
+ extern int of_device_is_compatible(const struct device_node *device,
+@@ -315,6 +318,13 @@ static inline int of_property_read_u64(const struct device_node *np,
+ 	return -ENOSYS;
+ }
+ 
++static inline int of_property_match_string(struct device_node *np,
++					   const char *propname,
++					   const char *string)
++{
++	return -ENOSYS;
++}
++
+ static inline struct device_node *of_parse_phandle(struct device_node *np,
+ 						   const char *phandle_name,
+ 						   int index)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index cb34ff4..44e5f47 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2347,15 +2347,15 @@ static inline bool thread_group_leader(struct task_struct *p)
+  * all we care about is that we have a task with the appropriate
+  * pid, we don't actually care if we have the right task.
+  */
+-static inline int has_group_leader_pid(struct task_struct *p)
++static inline bool has_group_leader_pid(struct task_struct *p)
+ {
+-	return p->pid == p->tgid;
++	return task_pid(p) == p->signal->leader_pid;
+ }
+ 
+ static inline
+-int same_thread_group(struct task_struct *p1, struct task_struct *p2)
++bool same_thread_group(struct task_struct *p1, struct task_struct *p2)
+ {
+-	return p1->tgid == p2->tgid;
++	return p1->signal == p2->signal;
+ }
+ 
+ static inline struct task_struct *next_thread(const struct task_struct *p)
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 416dcb0..b8b2e50 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1202,6 +1202,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
+ 
+ extern int ip_vs_use_count_inc(void);
+ extern void ip_vs_use_count_dec(void);
++extern int ip_vs_register_nl_ioctl(void);
++extern void ip_vs_unregister_nl_ioctl(void);
+ extern int ip_vs_control_init(void);
+ extern void ip_vs_control_cleanup(void);
+ extern struct ip_vs_dest *
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index a15432da..2cccd82 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -209,6 +209,7 @@ extern struct sctp_globals {
+ 	struct list_head addr_waitq;
+ 	struct timer_list addr_wq_timer;
+ 	struct list_head auto_asconf_splist;
++	/* Lock that protects both addr_waitq and auto_asconf_splist */
+ 	spinlock_t addr_wq_lock;
+ 
+ 	/* Lock that protects the local_addr_list writers */
+@@ -355,6 +356,10 @@ struct sctp_sock {
+ 	atomic_t pd_mode;
+ 	/* Receive to here while partial delivery is in effect. */
+ 	struct sk_buff_head pd_lobby;
++
++	/* These must be the last fields, as they will skipped on copies,
++	 * like on accept and peeloff operations
++	 */
+ 	struct list_head auto_asconf_list;
+ 	int do_auto_asconf;
+ };
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index 4f865df..7ee55e3 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -43,7 +43,8 @@
+ 
+ #define EMUPAGESIZE     4096
+ #define MAXREQVOICES    8
+-#define MAXPAGES        8192
++#define MAXPAGES0       4096	/* 32 bit mode */
++#define MAXPAGES1       8192	/* 31 bit mode */
+ #define RESERVED        0
+ #define NUM_MIDI        16
+ #define NUM_G           64              /* use all channels */
+@@ -52,8 +53,7 @@
+ 
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK	0x7fffffffUL	/* 31bit */
+-#define AUDIGY_DMA_MASK		0x7fffffffUL	/* 31bit FIXME - 32 should work? */
+-						/* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK		0xffffffffUL	/* 32bit mode */
+ 
+ #define TMEMSIZE        256*1024
+ #define TMEMSIZEREG     4
+@@ -470,8 +470,11 @@
+ 
+ #define MAPB			0x0d		/* Cache map B						*/
+ 
+-#define MAP_PTE_MASK		0xffffe000	/* The 19 MSBs of the PTE indexed by the PTI		*/
+-#define MAP_PTI_MASK		0x00001fff	/* The 13 bit index to one of the 8192 PTE dwords      	*/
++#define MAP_PTE_MASK0		0xfffff000	/* The 20 MSBs of the PTE indexed by the PTI		*/
++#define MAP_PTI_MASK0		0x00000fff	/* The 12 bit index to one of the 4096 PTE dwords      	*/
++
++#define MAP_PTE_MASK1		0xffffe000	/* The 19 MSBs of the PTE indexed by the PTI		*/
++#define MAP_PTI_MASK1		0x00001fff	/* The 13 bit index to one of the 8192 PTE dwords      	*/
+ 
+ /* 0x0e, 0x0f: Not used */
+ 
+@@ -1708,6 +1711,7 @@ struct snd_emu10k1 {
+ 	unsigned short model;			/* subsystem id */
+ 	unsigned int card_type;			/* EMU10K1_CARD_* */
+ 	unsigned int ecard_ctrl;		/* ecard control bits */
++	unsigned int address_mode;		/* address mode */
+ 	unsigned long dma_mask;			/* PCI DMA mask */
+ 	unsigned int delay_pcm_irq;		/* in samples */
+ 	int max_cache_pages;			/* max memory size / PAGE_SIZE */
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 8f3d622..89b672d 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+ 			      irq_handler_t handler,
+ 			      unsigned long irqflags, const char *devname,
+ 			      void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ 			    irq_handler_t handler,
+ 			    unsigned long irqflags, const char *devname,
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index f79803a..f07c144 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -225,7 +225,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ 	 */
+ 	int dumpable = 0;
+ 	/* Don't let security modules deny introspection */
+-	if (task == current)
++	if (same_thread_group(task, current))
+ 		return 0;
+ 	rcu_read_lock();
+ 	tcred = __task_cred(task);
+@@ -640,6 +640,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
+ static int ptrace_resume(struct task_struct *child, long request,
+ 			 unsigned long data)
+ {
++	bool need_siglock;
++
+ 	if (!valid_signal(data))
+ 		return -EIO;
+ 
+@@ -667,8 +669,26 @@ static int ptrace_resume(struct task_struct *child, long request,
+ 		user_disable_single_step(child);
+ 	}
+ 
++	/*
++	 * Change ->exit_code and ->state under siglock to avoid the race
++	 * with wait_task_stopped() in between; a non-zero ->exit_code will
++	 * wrongly look like another report from tracee.
++	 *
++	 * Note that we need siglock even if ->exit_code == data and/or this
++	 * status was not reported yet, the new status must not be cleared by
++	 * wait_task_stopped() after resume.
++	 *
++	 * If data == 0 we do not care if wait_task_stopped() reports the old
++	 * status and clears the code too; this can't race with the tracee, it
++	 * takes siglock after resume.
++	 */
++	need_siglock = data && !thread_group_empty(current);
++	if (need_siglock)
++		spin_lock_irq(&child->sighand->siglock);
+ 	child->exit_code = data;
+ 	wake_up_state(child, __TASK_TRACED);
++	if (need_siglock)
++		spin_unlock_irq(&child->sighand->siglock);
+ 
+ 	return 0;
+ }
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 2c71d91..44bc103 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip)
+ EXPORT_SYMBOL(local_bh_enable_ip);
+ 
+ /*
+- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+- * and we fall back to softirqd after that.
++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
++ * but break the loop if need_resched() is set or after 2 ms.
++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
++ * certain cases, such as stop_machine(), jiffies may cease to
++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
++ * well to make sure we eventually return from this method.
+  *
+- * This number has been established via experimentation.
++ * These limits have been established via experimentation.
+  * The two things to balance is latency against fairness -
+  * we want to handle softirqs as soon as possible, but they
+  * should not be able to lock up the box.
+  */
++#define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
+ #define MAX_SOFTIRQ_RESTART 10
+ 
+ asmlinkage void __do_softirq(void)
+ {
+ 	struct softirq_action *h;
+ 	__u32 pending;
+-	int max_restart = MAX_SOFTIRQ_RESTART;
++	unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
+ 	int cpu;
++	int max_restart = MAX_SOFTIRQ_RESTART;
+ 
+ 	pending = local_softirq_pending();
+ 	account_system_vtime(current);
+@@ -255,11 +261,13 @@ restart:
+ 	local_irq_disable();
+ 
+ 	pending = local_softirq_pending();
+-	if (pending && --max_restart)
+-		goto restart;
++	if (pending) {
++		if (time_before(jiffies, end) && !need_resched() &&
++		    --max_restart)
++			goto restart;
+ 
+-	if (pending)
+ 		wakeup_softirqd();
++	}
+ 
+ 	lockdep_softirq_exit();
+ 
+diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
+index a5457d5..6ad2e2d 100644
+--- a/kernel/trace/ring_buffer_benchmark.c
++++ b/kernel/trace/ring_buffer_benchmark.c
+@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)
+ 
+ 	if (producer_fifo >= 0) {
+ 		struct sched_param param = {
+-			.sched_priority = consumer_fifo
++			.sched_priority = producer_fifo
+ 		};
+ 		sched_setscheduler(producer, SCHED_FIFO, &param);
+ 	} else
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index b0996c1..47343cc 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1343,19 +1343,25 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ 	int n_normal_preds = 0, n_logical_preds = 0;
+ 	struct postfix_elt *elt;
++	int cnt = 0;
+ 
+ 	list_for_each_entry(elt, &ps->postfix, list) {
+-		if (elt->op == OP_NONE)
++		if (elt->op == OP_NONE) {
++			cnt++;
+ 			continue;
++		}
+ 
+ 		if (elt->op == OP_AND || elt->op == OP_OR) {
+ 			n_logical_preds++;
++			cnt--;
+ 			continue;
+ 		}
++		cnt--;
+ 		n_normal_preds++;
++		WARN_ON_ONCE(cnt < 0);
+ 	}
+ 
+-	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ 		return -EINVAL;
+ 	}
+diff --git a/lib/string.c b/lib/string.c
+index 40136f6..dcbe695 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -595,7 +595,7 @@ EXPORT_SYMBOL(memset);
+ void memzero_explicit(void *s, size_t count)
+ {
+ 	memset(s, 0, count);
+-	OPTIMIZER_HIDE_VAR(s);
++	barrier();
+ }
+ EXPORT_SYMBOL(memzero_explicit);
+ 
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 1bf1f74..62bfbd9 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -560,7 +560,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	 */
+ 	setpoint = (freerun + limit) / 2;
+ 	x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+-		    limit - setpoint + 1);
++		      (limit - setpoint) | 1);
+ 	pos_ratio = x;
+ 	pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+ 	pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -611,7 +611,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	 * scale global setpoint to bdi's:
+ 	 *	bdi_setpoint = setpoint * bdi_thresh / thresh
+ 	 */
+-	x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++	x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ 	bdi_setpoint = setpoint * (u64)x >> 16;
+ 	/*
+ 	 * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -626,7 +626,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 
+ 	if (bdi_dirty < x_intercept - span / 4) {
+ 		pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+-				    x_intercept - bdi_setpoint + 1);
++				      (x_intercept - bdi_setpoint) | 1);
+ 	} else
+ 		pos_ratio /= 4;
+ 
+diff --git a/mm/slub.c b/mm/slub.c
+index 6a4c2fb..60c6969 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1873,18 +1873,24 @@ redo:
+ /* Unfreeze all the cpu partial slabs */
+ static void unfreeze_partials(struct kmem_cache *s)
+ {
+-	struct kmem_cache_node *n = NULL;
++	struct kmem_cache_node *n = NULL, *n2 = NULL;
+ 	struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
+ 	struct page *page, *discard_page = NULL;
+ 
+ 	while ((page = c->partial)) {
+-		enum slab_modes { M_PARTIAL, M_FREE };
+-		enum slab_modes l, m;
+ 		struct page new;
+ 		struct page old;
+ 
+ 		c->partial = page->next;
+-		l = M_FREE;
++
++		n2 = get_node(s, page_to_nid(page));
++		if (n != n2) {
++			if (n)
++				spin_unlock(&n->list_lock);
++
++			n = n2;
++			spin_lock(&n->list_lock);
++		}
+ 
+ 		do {
+ 
+@@ -1897,40 +1903,17 @@ static void unfreeze_partials(struct kmem_cache *s)
+ 
+ 			new.frozen = 0;
+ 
+-			if (!new.inuse && (!n || n->nr_partial > s->min_partial))
+-				m = M_FREE;
+-			else {
+-				struct kmem_cache_node *n2 = get_node(s,
+-							page_to_nid(page));
+-
+-				m = M_PARTIAL;
+-				if (n != n2) {
+-					if (n)
+-						spin_unlock(&n->list_lock);
+-
+-					n = n2;
+-					spin_lock(&n->list_lock);
+-				}
+-			}
+-
+-			if (l != m) {
+-				if (l == M_PARTIAL)
+-					remove_partial(n, page);
+-				else
+-					add_partial(n, page,
+-						DEACTIVATE_TO_TAIL);
+-
+-				l = m;
+-			}
+-
+ 		} while (!cmpxchg_double_slab(s, page,
+ 				old.freelist, old.counters,
+ 				new.freelist, new.counters,
+ 				"unfreezing slab"));
+ 
+-		if (m == M_FREE) {
++		if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
+ 			page->next = discard_page;
+ 			discard_page = page;
++		} else {
++			add_partial(n, page, DEACTIVATE_TO_TAIL);
++			stat(s, FREE_ADD_PARTIAL);
+ 		}
+ 	}
+ 
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 7222fe1..ea0e15c 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ 		if (!capable(CAP_NET_ADMIN))
+ 			return -EPERM;
+ 
+-		spin_lock_bh(&br->lock);
+ 		br_stp_set_bridge_priority(br, args[1]);
+-		spin_unlock_bh(&br->lock);
+ 		return 0;
+ 
+ 	case BRCTL_SET_PORT_PRIORITY:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 398a297..1bd197f 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ 		}
+ 
+ 		err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+-		if (!err)
++		if (err)
+ 			break;
+ 	}
+ 
+@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br,
+ 	struct net_bridge_port *p;
+ 	struct hlist_node *n, *slot = NULL;
+ 
++	if (!hlist_unhashed(&port->rlist))
++		return;
++
+ 	hlist_for_each_entry(p, n, &br->router_list, rlist) {
+ 		if ((unsigned long) port >= (unsigned long) p)
+ 			break;
+@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
+ 	if (port->multicast_router != 1)
+ 		return;
+ 
+-	if (!hlist_unhashed(&port->rlist))
+-		goto timer;
+-
+ 	br_multicast_add_router(br, port);
+ 
+-timer:
+ 	mod_timer(&port->multicast_router_timer,
+ 		  now + br->multicast_querier_interval);
+ }
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 19308e3..0f7dc60 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -235,12 +235,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+ 	return true;
+ }
+ 
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ 	struct net_bridge_port *p;
+ 	int wasroot;
+ 
++	spin_lock_bh(&br->lock);
+ 	wasroot = br_is_root_bridge(br);
+ 
+ 	list_for_each_entry(p, &br->port_list, list) {
+@@ -258,6 +259,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ 	br_port_state_selection(br);
+ 	if (br_is_root_bridge(br) && !wasroot)
+ 		br_become_root_bridge(br);
++	spin_unlock_bh(&br->lock);
+ }
+ 
+ /* called under bridge lock */
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 7eed9eb..7e4b4b4 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -366,6 +366,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
+ 		release_sock(sk);
+ 		timeo = schedule_timeout(timeo);
+ 		lock_sock(sk);
++
++		if (sock_flag(sk, SOCK_DEAD))
++			break;
++
+ 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ 	}
+ 
+@@ -410,6 +414,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		struct sk_buff *skb;
+ 
+ 		lock_sock(sk);
++		if (sock_flag(sk, SOCK_DEAD)) {
++			err = -ECONNRESET;
++			goto unlock;
++		}
+ 		skb = skb_dequeue(&sk->sk_receive_queue);
+ 		caif_check_flow_release(sk);
+ 
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 0ea3fd3..c8c2645 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -955,6 +955,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ 	rc = 0;
+ 	if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ 		goto out_unlock_bh;
++	if (neigh->dead)
++		goto out_dead;
+ 
+ 	if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ 		if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+@@ -1003,6 +1005,13 @@ out_unlock_bh:
+ 		write_unlock(&neigh->lock);
+ 	local_bh_enable();
+ 	return rc;
++
++out_dead:
++	if (neigh->nud_state & NUD_STALE)
++		goto out_unlock_bh;
++	write_unlock_bh(&neigh->lock);
++	kfree_skb(skb);
++	return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+ 
+@@ -1066,6 +1075,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 	if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ 	    (old & (NUD_NOARP | NUD_PERMANENT)))
+ 		goto out;
++	if (neigh->dead)
++		goto out;
+ 
+ 	if (!(new & NUD_VALID)) {
+ 		neigh_del_timer(neigh);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 8c2e259..5e92043 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1248,10 +1248,8 @@ csum_copy_err:
+ 		UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+ 	unlock_sock_fast(sk, slow);
+ 
+-	if (noblock)
+-		return -EAGAIN;
+-
+-	/* starting over for a new packet */
++	/* starting over for a new packet, but check if we need to yield */
++	cond_resched();
+ 	msg->msg_flags &= ~MSG_TRUNC;
+ 	goto try_again;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d131a95..dc08afd 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -451,10 +451,8 @@ csum_copy_err:
+ 	}
+ 	unlock_sock_fast(sk, slow);
+ 
+-	if (noblock)
+-		return -EAGAIN;
+-
+-	/* starting over for a new packet */
++	/* starting over for a new packet, but check if we need to yield */
++	cond_resched();
+ 	msg->msg_flags &= ~MSG_TRUNC;
+ 	goto try_again;
+ }
+diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
+index a1c6bfd..34583c5 100644
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+ 
+ 	hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+ 
+-	if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+-		    skb_headroom(skb) < WEP_IV_LEN))
++	if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
+ 		return NULL;
+ 
+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ 	size_t len;
+ 	u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+ 
++	if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
++		return -1;
++
+ 	iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+ 	if (!iv)
+ 		return -1;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index d864aaf..197ed93 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2003,10 +2003,18 @@ static int __init ip_vs_init(void)
+ 		goto cleanup_dev;
+ 	}
+ 
++	ret = ip_vs_register_nl_ioctl();
++	if (ret < 0) {
++		pr_err("can't register netlink/ioctl.\n");
++		goto cleanup_hooks;
++	}
++
+ 	pr_info("ipvs loaded.\n");
+ 
+ 	return ret;
+ 
++cleanup_hooks:
++	nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ cleanup_dev:
+ 	unregister_pernet_device(&ipvs_core_dev_ops);
+ cleanup_sub:
+@@ -2022,6 +2030,7 @@ exit:
+ 
+ static void __exit ip_vs_cleanup(void)
+ {
++	ip_vs_unregister_nl_ioctl();
+ 	nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ 	unregister_pernet_device(&ipvs_core_dev_ops);
+ 	unregister_pernet_subsys(&ipvs_core_ops);	/* free ip_vs struct */
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 93acfa1..1e27a1f 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3689,6 +3689,9 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+ 	cancel_work_sync(&ipvs->defense_work.work);
+ 	unregister_net_sysctl_table(ipvs->sysctl_hdr);
+ 	ip_vs_stop_estimator(net, &ipvs->tot_stats);
++
++	if (!net_eq(net, &init_net))
++		kfree(ipvs->sysctl_tbl);
+ }
+ 
+ #else
+@@ -3751,21 +3754,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
+ 	free_percpu(ipvs->tot_stats.cpustats);
+ }
+ 
+-int __init ip_vs_control_init(void)
++int __init ip_vs_register_nl_ioctl(void)
+ {
+-	int idx;
+ 	int ret;
+ 
+-	EnterFunction(2);
+-
+-	/* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+-	for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++)  {
+-		INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+-		INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+-	}
+-
+-	smp_wmb();	/* Do we really need it now ? */
+-
+ 	ret = nf_register_sockopt(&ip_vs_sockopts);
+ 	if (ret) {
+ 		pr_err("cannot register sockopt.\n");
+@@ -3777,28 +3769,47 @@ int __init ip_vs_control_init(void)
+ 		pr_err("cannot register Generic Netlink interface.\n");
+ 		goto err_genl;
+ 	}
+-
+-	ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+-	if (ret < 0)
+-		goto err_notf;
+-
+-	LeaveFunction(2);
+ 	return 0;
+ 
+-err_notf:
+-	ip_vs_genl_unregister();
+ err_genl:
+ 	nf_unregister_sockopt(&ip_vs_sockopts);
+ err_sock:
+ 	return ret;
+ }
+ 
++void ip_vs_unregister_nl_ioctl(void)
++{
++	ip_vs_genl_unregister();
++	nf_unregister_sockopt(&ip_vs_sockopts);
++}
++
++int __init ip_vs_control_init(void)
++{
++	int idx;
++	int ret;
++
++	EnterFunction(2);
++
++	/* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
++	for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
++		INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
++		INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
++	}
++
++	smp_wmb();	/* Do we really need it now ? */
++
++	ret = register_netdevice_notifier(&ip_vs_dst_notifier);
++	if (ret < 0)
++		return ret;
++
++	LeaveFunction(2);
++	return 0;
++}
++
+ 
+ void ip_vs_control_cleanup(void)
+ {
+ 	EnterFunction(2);
+ 	unregister_netdevice_notifier(&ip_vs_dst_notifier);
+-	ip_vs_genl_unregister();
+-	nf_unregister_sockopt(&ip_vs_sockopts);
+ 	LeaveFunction(2);
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 4f19bf2..0c21f06 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1170,16 +1170,6 @@ static void packet_sock_destruct(struct sock *sk)
+ 	sk_refcnt_debug_dec(sk);
+ }
+ 
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+-	int x = atomic_read(&f->rr_cur) + 1;
+-
+-	if (x >= num)
+-		x = 0;
+-
+-	return x;
+-}
+-
+ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+ 	u32 idx, hash = skb->rxhash;
+@@ -1191,13 +1181,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s
+ 
+ static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+-	int cur, old;
++	unsigned int val = atomic_inc_return(&f->rr_cur);
+ 
+-	cur = atomic_read(&f->rr_cur);
+-	while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+-				     fanout_rr_next(f, num))) != cur)
+-		cur = old;
+-	return f->arr[cur];
++	return f->arr[val % num];
+ }
+ 
+ static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+@@ -1211,7 +1197,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ 			     struct packet_type *pt, struct net_device *orig_dev)
+ {
+ 	struct packet_fanout *f = pt->af_packet_priv;
+-	unsigned int num = f->num_members;
++	unsigned int num = ACCESS_ONCE(f->num_members);
+ 	struct packet_sock *po;
+ 	struct sock *sk;
+ 
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index c3b8549..6d56eec 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,9 @@ out:
+ 	return err;
+ no_route:
+ 	kfree_skb(nskb);
+-	IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
++
++	if (asoc)
++		IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+ 
+ 	/* FIXME: Returning the 'err' will effect all the associations
+ 	 * associated with a socket, although only one of the paths of the
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index fc63664..24e88af 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ 
+ 	/* Supposedly, no process has access to the socket, but
+ 	 * the net layers still may.
++	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++	 * held and that should be grabbed before socket lock.
+ 	 */
+-	sctp_local_bh_disable();
++	spin_lock_bh(&sctp_globals.addr_wq_lock);
+ 	sctp_bh_lock_sock(sk);
+ 
+ 	/* Hold the sock, since sk_common_release() will put sock_put()
+@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ 	sk_common_release(sk);
+ 
+ 	sctp_bh_unlock_sock(sk);
+-	sctp_local_bh_enable();
++	spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ 
+ 	sock_put(sk);
+ 
+@@ -3499,6 +3501,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ 	if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+ 		return 0;
+ 
++	spin_lock_bh(&sctp_globals.addr_wq_lock);
+ 	if (val == 0 && sp->do_auto_asconf) {
+ 		list_del(&sp->auto_asconf_list);
+ 		sp->do_auto_asconf = 0;
+@@ -3507,6 +3510,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ 		    &sctp_auto_asconf_splist);
+ 		sp->do_auto_asconf = 1;
+ 	}
++	spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ 	return 0;
+ }
+ 
+@@ -3942,18 +3946,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ 	local_bh_disable();
+ 	percpu_counter_inc(&sctp_sockets_allocated);
+ 	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++
++	/* Nothing can fail after this block, otherwise
++	 * sctp_destroy_sock() will be called without addr_wq_lock held
++	 */
+ 	if (sctp_default_auto_asconf) {
++		spin_lock(&sctp_globals.addr_wq_lock);
+ 		list_add_tail(&sp->auto_asconf_list,
+ 		    &sctp_auto_asconf_splist);
+ 		sp->do_auto_asconf = 1;
+-	} else
++		spin_unlock(&sctp_globals.addr_wq_lock);
++	} else {
+ 		sp->do_auto_asconf = 0;
++	}
++
+ 	local_bh_enable();
+ 
+ 	return 0;
+ }
+ 
+-/* Cleanup any SCTP per socket resources.  */
++/* Cleanup any SCTP per socket resources. Must be called with
++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true
++ */
+ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+ {
+ 	struct sctp_sock *sp;
+@@ -6719,6 +6733,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ 	newinet->mc_list = NULL;
+ }
+ 
++static inline void sctp_copy_descendant(struct sock *sk_to,
++					const struct sock *sk_from)
++{
++	int ancestor_size = sizeof(struct inet_sock) +
++			    sizeof(struct sctp_sock) -
++			    offsetof(struct sctp_sock, auto_asconf_list);
++
++	if (sk_from->sk_family == PF_INET6)
++		ancestor_size += sizeof(struct ipv6_pinfo);
++
++	__inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
++}
++
+ /* Populate the fields of the newsk from the oldsk and migrate the assoc
+  * and its messages to the newsk.
+  */
+@@ -6733,7 +6760,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ 	struct sk_buff *skb, *tmp;
+ 	struct sctp_ulpevent *event;
+ 	struct sctp_bind_hashbucket *head;
+-	struct list_head tmplist;
+ 
+ 	/* Migrate socket buffer sizes and all the socket level options to the
+ 	 * new socket.
+@@ -6741,12 +6767,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ 	newsk->sk_sndbuf = oldsk->sk_sndbuf;
+ 	newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
+ 	/* Brute force copy old sctp opt. */
+-	if (oldsp->do_auto_asconf) {
+-		memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+-		inet_sk_copy_descendant(newsk, oldsk);
+-		memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+-	} else
+-		inet_sk_copy_descendant(newsk, oldsk);
++	sctp_copy_descendant(newsk, oldsk);
+ 
+ 	/* Restore the ep value that was overwritten with the above structure
+ 	 * copy.
+diff --git a/net/socket.c b/net/socket.c
+index 116cf9d..10ea25a 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1911,14 +1911,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+ 	int err, ctl_len, iov_size, total_len;
+ 
+ 	err = -EFAULT;
+-	if (MSG_CMSG_COMPAT & flags) {
+-		if (get_compat_msghdr(msg_sys, msg_compat))
+-			return -EFAULT;
+-	} else {
++	if (MSG_CMSG_COMPAT & flags)
++		err = get_compat_msghdr(msg_sys, msg_compat);
++	else
+ 		err = copy_msghdr_from_user(msg_sys, msg);
+-		if (err)
+-			return err;
+-	}
++	if (err)
++		return err;
+ 
+ 	/* do not move before msg_sys is valid */
+ 	err = -EMSGSIZE;
+@@ -2130,14 +2128,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+ 	struct sockaddr __user *uaddr;
+ 	int __user *uaddr_len;
+ 
+-	if (MSG_CMSG_COMPAT & flags) {
+-		if (get_compat_msghdr(msg_sys, msg_compat))
+-			return -EFAULT;
+-	} else {
++	if (MSG_CMSG_COMPAT & flags)
++		err = get_compat_msghdr(msg_sys, msg_compat);
++	else
+ 		err = copy_msghdr_from_user(msg_sys, msg);
+-		if (err)
+-			return err;
+-	}
++	if (err)
++		return err;
+ 
+ 	err = -EMSGSIZE;
+ 	if (msg_sys->msg_iovlen > UIO_MAXIOV)
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 8705ee3..9b1f371 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1870,6 +1870,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
+ 		unix_state_unlock(sk);
+ 		timeo = schedule_timeout(timeo);
+ 		unix_state_lock(sk);
++
++		if (sock_flag(sk, SOCK_DEAD))
++			break;
++
+ 		clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ 	}
+ 
+@@ -1930,6 +1934,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ 		struct sk_buff *skb;
+ 
+ 		unix_state_lock(sk);
++		if (sock_flag(sk, SOCK_DEAD)) {
++			err = -ECONNRESET;
++			goto unlock;
++		}
+ 		skb = skb_peek(&sk->sk_receive_queue);
+ 		if (skb == NULL) {
+ 			unix_sk(sk)->recursion_level = 0;
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 0920ea3..5776921 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
+ 	{ XFRM_MSG_FLUSHPOLICY,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ 	{ XFRM_MSG_NEWAE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ 	{ XFRM_MSG_GETAE,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_REPORT,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_MIGRATE,	NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++	{ XFRM_MSG_NEWSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_GETSADINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_GETSPDINFO,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
++	{ XFRM_MSG_MAPPING,	NETLINK_XFRM_SOCKET__NLMSG_READ  },
+ };
+ 
+ static struct nlmsg_perm nlmsg_audit_perms[] =
+diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
+index eaa198e..f33e3cc 100644
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
+ 	}
+ #endif
+  
+-	strcpy(card->driver, emu->card_capabilities->driver);
+-	strcpy(card->shortname, emu->card_capabilities->name);
++	strlcpy(card->driver, emu->card_capabilities->driver,
++		sizeof(card->driver));
++	strlcpy(card->shortname, emu->card_capabilities->name,
++		sizeof(card->shortname));
+ 	snprintf(card->longname, sizeof(card->longname),
+ 		 "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ 		 card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index f35284b..8295950 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ 	snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+ 
+ 	/* invalidate maps */
+-	temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++	temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 	snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ 	snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ 		snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+ 
+ 		/* invalidate maps */
+-		temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++		temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 		snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ 		snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ 		
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index d37b946..705e73e 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ 	snd_emu10k1_ptr_write(emu, TCB, 0, 0);	/* taken from original driver */
+ 	snd_emu10k1_ptr_write(emu, TCBS, 0, 4);	/* taken from original driver */
+ 
+-	silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++	silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 	for (ch = 0; ch < NUM_G; ch++) {
+ 		snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ 		snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ 		outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ 	}
+ 
++	if (emu->address_mode == 0) {
++		/* use 16M in 4G */
++		outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++	}
++
+ 	return 0;
+ }
+ 
+@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ 	 *
+ 	 */
+ 	{.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+-	 .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++	 .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ 	 .id = "Audigy2",
+ 	 .emu10k2_chip = 1,
+ 	 .ca0108_chip = 1,
+@@ -1528,7 +1533,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ 	 .adc_1361t = 1,  /* 24 bit capture instead of 16bit */
+ 	 .ac97_chip = 1} ,
+ 	{.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+-	 .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++	 .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ 	 .id = "Audigy2",
+ 	 .emu10k2_chip = 1,
+ 	 .ca0102_chip = 1,
+@@ -1832,8 +1837,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ 
+ 	is_audigy = emu->audigy = c->emu10k2_chip;
+ 
++	/* set addressing mode */
++	emu->address_mode = is_audigy ? 0 : 1;
+ 	/* set the DMA transfer mask */
+-	emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++	emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ 	if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ 	    pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ 		snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);
+@@ -1856,7 +1863,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ 
+ 	emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ 	if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+-				32 * 1024, &emu->ptb_pages) < 0) {
++				(emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ 		err = -ENOMEM;
+ 		goto error;
+ 	}
+@@ -1955,8 +1962,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+ 
+ 	/* Clear silent pages and set up pointers */
+ 	memset(emu->silent_page.area, 0, PAGE_SIZE);
+-	silent_page = emu->silent_page.addr << 1;
+-	for (idx = 0; idx < MAXPAGES; idx++)
++	silent_page = emu->silent_page.addr << emu->address_mode;
++	for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ 		((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+ 
+ 	/* set up voice indices */
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index e22b8e2..c673d2b 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
+ 	snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ 	snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ 	/* invalidate maps */
+-	silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++	silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ 	snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ 	snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ 	/* modulation envelope */
+diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
+index bc38dd4..9c499e6 100644
+--- a/sound/pci/emu10k1/emuproc.c
++++ b/sound/pci/emu10k1/emuproc.c
+@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
+ 	struct snd_emu10k1 *emu = entry->private_data;
+ 	u32 value;
+ 	u32 value2;
+-	unsigned long flags;
+ 	u32 rate;
+ 
+ 	if (emu->card_capabilities->emu_model) {
+-		spin_lock_irqsave(&emu->emu_lock, flags);
+ 		snd_emu1010_fpga_read(emu, 0x38, &value);
+-		spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 		if ((value & 0x1) == 0) {
+-			spin_lock_irqsave(&emu->emu_lock, flags);
+ 			snd_emu1010_fpga_read(emu, 0x2a, &value);
+ 			snd_emu1010_fpga_read(emu, 0x2b, &value2);
+-			spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 			rate = 0x1770000 / (((value << 5) | value2)+1);	
+ 			snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
+ 		} else {
+ 			snd_iprintf(buffer, "ADAT Unlocked\n");
+ 		}
+-		spin_lock_irqsave(&emu->emu_lock, flags);
+ 		snd_emu1010_fpga_read(emu, 0x20, &value);
+-		spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 		if ((value & 0x4) == 0) {
+-			spin_lock_irqsave(&emu->emu_lock, flags);
+ 			snd_emu1010_fpga_read(emu, 0x28, &value);
+ 			snd_emu1010_fpga_read(emu, 0x29, &value2);
+-			spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 			rate = 0x1770000 / (((value << 5) | value2)+1);	
+ 			snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
+ 		} else {
+@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
+ {
+ 	struct snd_emu10k1 *emu = entry->private_data;
+ 	u32 value;
+-	unsigned long flags;
+ 	int i;
+ 	snd_iprintf(buffer, "EMU1010 Registers:\n\n");
+ 
+ 	for(i = 0; i < 0x40; i+=1) {
+-		spin_lock_irqsave(&emu->emu_lock, flags);
+ 		snd_emu1010_fpga_read(emu, i, &value);
+-		spin_unlock_irqrestore(&emu->emu_lock, flags);
+ 		snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
+ 	}
+ }
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index 4f502a2..87b7c65 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+  * aligned pages in others
+  */
+ #define __set_ptb_entry(emu,page,addr) \
+-	(((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++	(((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+ 
+ #define UNIT_PAGES		(PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES		(MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0		(MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1		(MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset)	((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
+ 		}
+ 		page = blk->mapped_page + blk->pages;
+ 	}
+-	size = MAX_ALIGN_PAGES - page;
++	size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ 	if (size >= max_size) {
+ 		*nextp = pos;
+ 		return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
+ 		q = get_emu10k1_memblk(p, mapped_link);
+ 		end_page = q->mapped_page;
+ 	} else
+-		end_page = MAX_ALIGN_PAGES;
++		end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+ 
+ 	/* remove links */
+ 	list_del(&blk->mapped_link);
+@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ 	if (snd_BUG_ON(!emu))
+ 		return NULL;
+ 	if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+-		       runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++		       runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ 		return NULL;
+ 	hdr = emu->memhdr;
+ 	if (snd_BUG_ON(!hdr))
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 843d9f3..6a524fb 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4598,6 +4598,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f150b9, .name = "CX20665",
+ 	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f1, .name = "CX20721",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f2, .name = "CX20722",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f3, .name = "CX20723",
++	  .patch = patch_conexant_auto },
++	{ .id = 0x14f150f4, .name = "CX20724",
++	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f1510f, .name = "CX20751/2",
+ 	  .patch = patch_conexant_auto },
+ 	{ .id = 0x14f15110, .name = "CX20751/2",
+@@ -4632,6 +4640,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 561d5e0..e99c10b 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
+ 	if (gpio_nreset >= 0) {
+ 		/* Reset codec */
+ 		gpio_direction_output(gpio_nreset, 0);
+-		udelay(1);
++		mdelay(1);
+ 		gpio_set_value(gpio_nreset, 1);
+ 		/* Give the codec time to wake up */
+-		udelay(1);
++		mdelay(1);
+ 	}
+ 
+ 	cs4271->gpio_nreset = gpio_nreset;
+diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
+index 57ad22a..6ab4f27 100644
+--- a/sound/soc/codecs/wm8741.c
++++ b/sound/soc/codecs/wm8741.c
+@@ -117,7 +117,7 @@ static struct {
+ };
+ 
+ static unsigned int rates_11289[] = {
+-	44100, 88235,
++	44100, 88200,
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_11289 = {
+@@ -144,7 +144,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = {
+ };
+ 
+ static unsigned int rates_16934[] = {
+-	44100, 88235,
++	44100, 88200,
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_16934 = {
+@@ -162,7 +162,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = {
+ };
+ 
+ static unsigned int rates_22579[] = {
+-	44100, 88235, 1764000
++	44100, 88200, 176400
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_22579 = {
+@@ -180,7 +180,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = {
+ };
+ 
+ static unsigned int rates_36864[] = {
+-	48000, 96000, 19200
++	48000, 96000, 192000
+ };
+ 
+ static struct snd_pcm_hw_constraint_list constraints_36864 = {
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index b2abe93..8d26104 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -336,7 +336,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
+ 	{ "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ 	{ "Right Input Mixer", NULL, "RINPUT1", },  /* Really Boost Switch */
+ 	{ "Right Input Mixer", NULL, "RINPUT2" },
+-	{ "Right Input Mixer", NULL, "LINPUT3" },
++	{ "Right Input Mixer", NULL, "RINPUT3" },
+ 
+ 	{ "Left ADC", NULL, "Left Input Mixer" },
+ 	{ "Right ADC", NULL, "Right Input Mixer" },
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index b73f226..9a56798 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2449,7 +2449,7 @@ static struct {
+ };
+ 
+ static int fs_ratios[] = {
+-	64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++	64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+ 
+ static int bclk_divs[] = {
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 1d83a40..3dc1b8a 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2675,12 +2675,18 @@ int snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ 		kfree(w);
+ 		return -ENOMEM;
+ 	}
+-	if (dapm->codec && dapm->codec->name_prefix)
++	if (dapm->codec && dapm->codec->name_prefix) {
+ 		snprintf(w->name, name_len, "%s %s",
+ 			dapm->codec->name_prefix, widget->name);
+-	else
++		if (widget->sname)
++			w->sname = kasprintf(GFP_KERNEL, "%s %s",
++					     dapm->codec->name_prefix,
++					     widget->sname);
++	} else {
+ 		snprintf(w->name, name_len, "%s", widget->name);
+-
++		if (widget->sname)
++			w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
++	}
+ 	switch (w->id) {
+ 	case snd_soc_dapm_switch:
+ 	case snd_soc_dapm_mixer:
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index 319754c..daf61ab 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ 	if (snd_BUG_ON(!arg || !emu))
+ 		return -ENXIO;
+ 
+-	mutex_lock(&emu->register_mutex);
+-
+-	if (!snd_emux_inc_count(emu)) {
+-		mutex_unlock(&emu->register_mutex);
++	if (!snd_emux_inc_count(emu))
+ 		return -EFAULT;
+-	}
+ 
+ 	memset(&callback, 0, sizeof(callback));
+ 	callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ 	if (p == NULL) {
+ 		snd_printk(KERN_ERR "can't create port\n");
+ 		snd_emux_dec_count(emu);
+-		mutex_unlock(&emu->register_mutex);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ 	reset_port_mode(p, arg->seq_mode);
+ 
+ 	snd_emux_reset_port(p);
+-
+-	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+ 
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
+ 	if (snd_BUG_ON(!emu))
+ 		return -ENXIO;
+ 
+-	mutex_lock(&emu->register_mutex);
+ 	snd_emux_sounds_off_all(p);
+ 	snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ 	snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ 	snd_emux_dec_count(emu);
+ 
+-	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+ 
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index 7778b8e..a020920 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
+ 	if (emu->voices)
+ 		snd_emux_terminate_all(emu);
+ 		
+-	mutex_lock(&emu->register_mutex);
+ 	if (emu->client >= 0) {
+ 		snd_seq_delete_kernel_client(emu->client);
+ 		emu->client = -1;
+ 	}
+-	mutex_unlock(&emu->register_mutex);
+ }
+ 
+ 
+@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
+ /*
+  * increment usage count
+  */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ 	emu->used++;
+ 	if (!try_module_get(emu->ops.owner))
+@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ 	return 1;
+ }
+ 
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++	int ret;
++
++	mutex_lock(&emu->register_mutex);
++	ret = __snd_emux_inc_count(emu);
++	mutex_unlock(&emu->register_mutex);
++	return ret;
++}
+ 
+ /*
+  * decrease usage count
+  */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ 	module_put(emu->card->module);
+ 	emu->used--;
+@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ 	module_put(emu->ops.owner);
+ }
+ 
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++	mutex_lock(&emu->register_mutex);
++	__snd_emux_dec_count(emu);
++	mutex_unlock(&emu->register_mutex);
++}
+ 
+ /*
+  * Routine that is called upon a first use of a particular port
+@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)
+ 
+ 	mutex_lock(&emu->register_mutex);
+ 	snd_emux_init_port(p);
+-	snd_emux_inc_count(emu);
++	__snd_emux_inc_count(emu);
+ 	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+ 
+ 	mutex_lock(&emu->register_mutex);
+ 	snd_emux_sounds_off_all(p);
+-	snd_emux_dec_count(emu);
++	__snd_emux_dec_count(emu);
+ 	mutex_unlock(&emu->register_mutex);
+ 	return 0;
+ }
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 88160b7..488e531 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -838,6 +838,8 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ 	case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ 	case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ 	case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
++	case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
++	case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+ 	case USB_ID(0x046d, 0x0991):
+ 	/* Most audio usb devices lie about volume resolution.
+ 	 * Most Logitech webcams have res = 384.
+@@ -1423,11 +1425,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ 		snd_printk(KERN_ERR "invalid MIXER UNIT descriptor %d\n", unitid);
+ 		return -EINVAL;
+ 	}
+-	/* no bmControls field (e.g. Maya44) -> ignore */
+-	if (desc->bLength <= 10 + input_pins) {
+-		snd_printdd(KERN_INFO "MU %d has no bmControls field\n", unitid);
+-		return 0;
+-	}
+ 
+ 	num_ins = 0;
+ 	ich = 0;
+@@ -1435,6 +1432,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ 		err = parse_audio_unit(state, desc->baSourceID[pin]);
+ 		if (err < 0)
+ 			return err;
++		/* no bmControls field (e.g. Maya44) -> ignore */
++		if (desc->bLength <= 10 + input_pins)
++			continue;
+ 		err = check_input_term(state, desc->baSourceID[pin], &iterm);
+ 		if (err < 0)
+ 			return err;
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 1e0798f..851786f 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.ignore_ctl_error = 1,
+ 	},
+ 	{
++		/* MAYA44 USB+ */
++		.id = USB_ID(0x2573, 0x0008),
++		.map = maya44_map,
++	},
++	{
+ 		/* KEF X300A */
+ 		.id = USB_ID(0x27ac, 0x1000),
+ 		.map = scms_usb3318_map,
diff --git a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
index e361065..9aaf5cc 100644
--- a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch
+++ b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
@@ -315,7 +315,7 @@ index 2a68089..b3300e1 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 8071888..b024b7b 100644
+index 41a626b..31e889e 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1693,14 +1693,14 @@ index af18cea..b5dc173 100644
  
  #endif /* __ASSEMBLY__ */
 diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 0e9ce8d..6ef1e03 100644
+index a4b1186..6ef1e03 100644
 --- a/arch/arm/include/asm/elf.h
 +++ b/arch/arm/include/asm/elf.h
 @@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
  
--#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
+-#define ELF_ET_DYN_BASE	(TASK_SIZE / 3 * 2)
 +#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
 +
 +#ifdef CONFIG_PAX_ASLR
@@ -4188,21 +4188,19 @@ index 883fc6c..28c0acd 100644
  
  void __init gt641xx_irq_init(void)
 diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index 7f50318..20685b9 100644
+index 6e489e5..79e10cb 100644
 --- a/arch/mips/kernel/irq.c
 +++ b/arch/mips/kernel/irq.c
-@@ -111,7 +111,10 @@ void __init init_IRQ(void)
- #endif
+@@ -112,6 +112,8 @@ void __init init_IRQ(void)
  }
  
+ #ifdef CONFIG_DEBUG_STACKOVERFLOW
 +
- #ifdef DEBUG_STACKOVERFLOW
 +extern void gr_handle_kernel_exploit(void);
-+
  static inline void check_stack_overflow(void)
  {
  	unsigned long sp;
-@@ -127,6 +130,7 @@ static inline void check_stack_overflow(void)
+@@ -127,6 +129,7 @@ static inline void check_stack_overflow(void)
  		printk("do_IRQ: stack overflow: %ld\n",
  		       sp - sizeof(struct thread_info));
  		dump_stack();
@@ -4472,10 +4470,10 @@ index 302d779..b8b4e97 100644
 -	return ret;
 -}
 diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
-index ed1c542..88552ac 100644
+index 66d3c38..fed57fa 100644
 --- a/arch/mips/pci/pci-octeon.c
 +++ b/arch/mips/pci/pci-octeon.c
-@@ -335,8 +335,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -329,8 +329,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
  
  
  static struct pci_ops octeon_pci_ops = {
@@ -4487,10 +4485,10 @@ index ed1c542..88552ac 100644
  
  static struct resource octeon_pci_mem_resource = {
 diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
-index 0583c463..c07a38e 100644
+index 37a8790..dd636c1 100644
 --- a/arch/mips/pci/pcie-octeon.c
 +++ b/arch/mips/pci/pcie-octeon.c
-@@ -1238,8 +1238,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -1235,8 +1235,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
  }
  
  static struct pci_ops octeon_pcie0_ops = {
@@ -4501,7 +4499,7 @@ index 0583c463..c07a38e 100644
  };
  
  static struct resource octeon_pcie0_mem_resource = {
-@@ -1259,8 +1259,8 @@ static struct pci_controller octeon_pcie0_controller = {
+@@ -1256,8 +1256,8 @@ static struct pci_controller octeon_pcie0_controller = {
  };
  
  static struct pci_ops octeon_pcie1_ops = {
@@ -6337,13 +6335,13 @@ index 7450843..9f8cfc7 100644
  		return 0;
  	}
 diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 5a783d8..522eb00 100644
+index 67a42ed..333731a 100644
 --- a/arch/powerpc/mm/mmap_64.c
 +++ b/arch/powerpc/mm/mmap_64.c
-@@ -61,10 +61,14 @@ static inline int mmap_is_legacy(void)
-  *
-  * To avoid this we can shift the randomness by 1 bit.
-  */
+@@ -53,10 +53,14 @@ static inline int mmap_is_legacy(void)
+ 	return sysctl_legacy_va_layout;
+ }
+ 
 -static unsigned long mmap_rnd(void)
 +static unsigned long mmap_rnd(struct mm_struct *mm)
  {
@@ -6356,8 +6354,8 @@ index 5a783d8..522eb00 100644
  	if (current->flags & PF_RANDOMIZE) {
  		/* 8MB for 32bit, 1GB for 64bit */
  		if (is_32bit_task())
-@@ -75,7 +79,7 @@ static unsigned long mmap_rnd(void)
- 	return (rnd << PAGE_SHIFT) * 2;
+@@ -67,7 +71,7 @@ static unsigned long mmap_rnd(void)
+ 	return rnd << PAGE_SHIFT;
  }
  
 -static inline unsigned long mmap_base(void)
@@ -6365,7 +6363,7 @@ index 5a783d8..522eb00 100644
  {
  	unsigned long gap = rlimit(RLIMIT_STACK);
  
-@@ -84,7 +88,7 @@ static inline unsigned long mmap_base(void)
+@@ -76,7 +80,7 @@ static inline unsigned long mmap_base(void)
  	else if (gap > MAX_GAP)
  		gap = MAX_GAP;
  
@@ -6374,7 +6372,7 @@ index 5a783d8..522eb00 100644
  }
  
  /*
-@@ -99,10 +103,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -91,10 +95,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
  	 */
  	if (mmap_is_legacy()) {
  		mm->mmap_base = TASK_UNMAPPED_BASE;
@@ -8258,7 +8256,7 @@ index 42b282f..408977c 100644
  		addr = vmm->vm_end;
  		if (flags & MAP_SHARED)
 diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index 5e4252b..379f84f 100644
+index 0ff682d..60e979d 100644
 --- a/arch/sparc/kernel/sys_sparc_64.c
 +++ b/arch/sparc/kernel/sys_sparc_64.c
 @@ -119,12 +119,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
@@ -10487,7 +10485,7 @@ index ad8f795..2c7eec6 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 28a1bca..0443883 100644
+index d720208..5653761 100644
 --- a/arch/x86/Kconfig
 +++ b/arch/x86/Kconfig
 @@ -75,6 +75,7 @@ config X86
@@ -10498,7 +10496,7 @@ index 28a1bca..0443883 100644
  	select ARCH_SUPPORTS_ATOMIC_RMW
  
  config INSTRUCTION_DECODER
-@@ -236,7 +237,7 @@ config X86_HT
+@@ -237,7 +238,7 @@ config X86_HT
  
  config X86_32_LAZY_GS
  	def_bool y
@@ -10507,7 +10505,7 @@ index 28a1bca..0443883 100644
  
  config ARCH_HWEIGHT_CFLAGS
  	string
-@@ -526,6 +527,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -527,6 +528,7 @@ config SCHED_OMIT_FRAME_POINTER
  
  menuconfig PARAVIRT_GUEST
  	bool "Paravirtualized guest support"
@@ -10515,7 +10513,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Say Y here to get to see options related to running Linux under
  	  various hypervisors.  This option alone does not add any kernel code.
-@@ -903,6 +905,7 @@ config VM86
+@@ -904,6 +906,7 @@ config VM86
  
  config X86_16BIT
  	bool "Enable support for 16-bit segments" if EXPERT
@@ -10523,7 +10521,7 @@ index 28a1bca..0443883 100644
  	default y
  	---help---
  	  This option is required by programs like Wine to run 16-bit
-@@ -1040,7 +1043,7 @@ choice
+@@ -1041,7 +1044,7 @@ choice
  
  config NOHIGHMEM
  	bool "off"
@@ -10532,7 +10530,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
  	  However, the address space of 32-bit x86 processors is only 4
-@@ -1077,7 +1080,7 @@ config NOHIGHMEM
+@@ -1078,7 +1081,7 @@ config NOHIGHMEM
  
  config HIGHMEM4G
  	bool "4GB"
@@ -10541,7 +10539,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Select this if you have a 32-bit processor and between 1 and 4
  	  gigabytes of physical RAM.
-@@ -1131,7 +1134,7 @@ config PAGE_OFFSET
+@@ -1132,7 +1135,7 @@ config PAGE_OFFSET
  	hex
  	default 0xB0000000 if VMSPLIT_3G_OPT
  	default 0x80000000 if VMSPLIT_2G
@@ -10550,7 +10548,7 @@ index 28a1bca..0443883 100644
  	default 0x40000000 if VMSPLIT_1G
  	default 0xC0000000
  	depends on X86_32
-@@ -1514,6 +1517,7 @@ config SECCOMP
+@@ -1515,6 +1518,7 @@ config SECCOMP
  
  config CC_STACKPROTECTOR
  	bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
@@ -10558,7 +10556,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  This option turns on the -fstack-protector GCC feature. This
  	  feature puts, at the beginning of functions, a canary value on
-@@ -1532,6 +1536,7 @@ source kernel/Kconfig.hz
+@@ -1533,6 +1537,7 @@ source kernel/Kconfig.hz
  
  config KEXEC
  	bool "kexec system call"
@@ -10566,7 +10564,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  kexec is a system call that implements the ability to shutdown your
  	  current kernel, and to start another kernel.  It is like a reboot
-@@ -1634,6 +1639,8 @@ config X86_NEED_RELOCS
+@@ -1635,6 +1640,8 @@ config X86_NEED_RELOCS
  config PHYSICAL_ALIGN
  	hex "Alignment value to which kernel should be aligned" if X86_32
  	default "0x1000000"
@@ -10575,7 +10573,7 @@ index 28a1bca..0443883 100644
  	range 0x2000 0x1000000
  	---help---
  	  This value puts the alignment restrictions on physical address
-@@ -1665,9 +1672,10 @@ config HOTPLUG_CPU
+@@ -1666,9 +1673,10 @@ config HOTPLUG_CPU
  	  Say N if you want to disable CPU hotplug.
  
  config COMPAT_VDSO
@@ -10587,7 +10585,7 @@ index 28a1bca..0443883 100644
  	---help---
  	  Map the 32-bit VDSO to the predictable old-style address too.
  
-@@ -1720,6 +1728,22 @@ config CMDLINE_OVERRIDE
+@@ -1721,6 +1729,22 @@ config CMDLINE_OVERRIDE
  	  This is used to work around broken boot loaders.  This should
  	  be set to 'N' under normal conditions.
  
@@ -23597,7 +23595,7 @@ index 42eb330..139955c 100644
  
  	return ret;
 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index 41b2f57..9dd7145 100644
+index 78842ce..2e4b56d 100644
 --- a/arch/x86/kernel/reboot.c
 +++ b/arch/x86/kernel/reboot.c
 @@ -35,7 +35,7 @@ void (*pm_power_off)(void);
@@ -23700,7 +23698,7 @@ index 41b2f57..9dd7145 100644
  {
  	int i;
  	int attempt = 0;
-@@ -717,13 +749,13 @@ void native_machine_shutdown(void)
+@@ -720,13 +752,13 @@ void native_machine_shutdown(void)
  #endif
  }
  
@@ -23716,7 +23714,7 @@ index 41b2f57..9dd7145 100644
  {
  	printk("machine restart\n");
  
-@@ -732,7 +764,7 @@ static void native_machine_restart(char *__unused)
+@@ -735,7 +767,7 @@ static void native_machine_restart(char *__unused)
  	__machine_emergency_restart(0);
  }
  
@@ -23725,7 +23723,7 @@ index 41b2f57..9dd7145 100644
  {
  	/* stop other cpus and apics */
  	machine_shutdown();
-@@ -743,7 +775,7 @@ static void native_machine_halt(void)
+@@ -746,7 +778,7 @@ static void native_machine_halt(void)
  	stop_this_cpu(NULL);
  }
  
@@ -23734,7 +23732,7 @@ index 41b2f57..9dd7145 100644
  {
  	if (pm_power_off) {
  		if (!reboot_force)
-@@ -752,9 +784,10 @@ static void native_machine_power_off(void)
+@@ -755,9 +787,10 @@ static void native_machine_power_off(void)
  	}
  	/* a fallback in case there is no PM info available */
  	tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -25424,7 +25422,7 @@ index 176205a..920cd58 100644
  #define APIC_LVT_NUM			6
  /* 14 is the version for Xeon and Pentium 8.4.8*/
 diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index bfc9507..bf85b38 100644
+index 4a949c7..a1e965f 100644
 --- a/arch/x86/kvm/mmu.c
 +++ b/arch/x86/kvm/mmu.c
 @@ -3558,7 +3558,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
@@ -25495,7 +25493,7 @@ index 7a2d9d6..0e8286c 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 8831c43..98f1a3e 100644
+index 421958f..79e1420 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1100,12 +1100,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -25550,7 +25548,7 @@ index 8831c43..98f1a3e 100644
  
  	if (enable_ept && !cpu_has_vmx_ept_2m_page())
  		kvm_disable_largepages();
-@@ -3638,7 +3649,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3646,7 +3657,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	unsigned long cr4;
  
  	vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS);  /* 22.2.3 */
@@ -25561,7 +25559,7 @@ index 8831c43..98f1a3e 100644
  
  	/* Save the most likely value for this task's CR4 in the VMCS. */
  	cr4 = read_cr4();
-@@ -3655,7 +3669,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3663,7 +3677,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	vmcs_writel(HOST_IDTR_BASE, dt.address);   /* 22.2.4 */
  
  	asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
@@ -25570,7 +25568,7 @@ index 8831c43..98f1a3e 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6206,6 +6220,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6214,6 +6228,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp .Lkvm_vmx_return \n\t"
  		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		".Lkvm_vmx_return: "
@@ -25583,7 +25581,7 @@ index 8831c43..98f1a3e 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%"R"sp) \n\t"
  		"pop %0 \n\t"
-@@ -6254,6 +6274,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6262,6 +6282,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -25595,7 +25593,7 @@ index 8831c43..98f1a3e 100644
  	      : "cc", "memory"
  		, R"ax", R"bx", R"di", R"si"
  #ifdef CONFIG_X86_64
-@@ -6282,7 +6307,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6290,7 +6315,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		}
  	}
  
@@ -28443,7 +28441,7 @@ index e218d5d..3966c85 100644
 +EXPORT_SYMBOL(set_fs);
 +#endif
 diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index 554b7b5..4027e2c 100644
+index 433b21d..466fd0c 100644
 --- a/arch/x86/lib/usercopy_64.c
 +++ b/arch/x86/lib/usercopy_64.c
 @@ -42,6 +42,12 @@ long
@@ -31046,7 +31044,7 @@ index 6687022..ceabcfa 100644
 +	pax_force_retaddr
  	ret
 diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 5a5b6e4..07b4acb 100644
+index 11e3100..db113e1 100644
 --- a/arch/x86/net/bpf_jit_comp.c
 +++ b/arch/x86/net/bpf_jit_comp.c
 @@ -11,6 +11,7 @@
@@ -31241,7 +31239,7 @@ index 5a5b6e4..07b4acb 100644
  		addrs[i] = proglen;
  	}
  	cleanup_addr = proglen; /* epilogue address */
-@@ -221,6 +337,10 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -226,6 +342,10 @@ void bpf_jit_compile(struct sk_filter *fp)
  		for (i = 0; i < flen; i++) {
  			unsigned int K = filter[i].k;
  
@@ -31252,7 +31250,7 @@ index 5a5b6e4..07b4acb 100644
  			switch (filter[i].code) {
  			case BPF_S_ALU_ADD_X: /* A += X; */
  				seen |= SEEN_XREG;
-@@ -253,10 +373,8 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -258,10 +378,8 @@ void bpf_jit_compile(struct sk_filter *fp)
  			case BPF_S_ALU_MUL_K: /* A *= K */
  				if (is_imm8(K))
  					EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */
@@ -31265,7 +31263,7 @@ index 5a5b6e4..07b4acb 100644
  				break;
  			case BPF_S_ALU_DIV_X: /* A /= X; */
  				seen |= SEEN_XREG;
-@@ -269,15 +387,21 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -274,15 +392,21 @@ void bpf_jit_compile(struct sk_filter *fp)
  					EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
  								(addrs[i] - 4));
  				} else {
@@ -31288,7 +31286,7 @@ index 5a5b6e4..07b4acb 100644
  				EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
  				break;
  			case BPF_S_ALU_AND_X:
-@@ -477,7 +601,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -482,7 +606,7 @@ void bpf_jit_compile(struct sk_filter *fp)
  common_load:			seen |= SEEN_DATAREF;
  				if ((int)K < 0) {
  					/* Abort the JIT because __load_pointer() is needed. */
@@ -31297,7 +31295,7 @@ index 5a5b6e4..07b4acb 100644
  				}
  				t_offset = func - (image + addrs[i]);
  				EMIT1_off32(0xbe, K); /* mov imm32,%esi */
-@@ -492,7 +616,7 @@ common_load:			seen |= SEEN_DATAREF;
+@@ -497,7 +621,7 @@ common_load:			seen |= SEEN_DATAREF;
  			case BPF_S_LDX_B_MSH:
  				if ((int)K < 0) {
  					/* Abort the JIT because __load_pointer() is needed. */
@@ -31306,7 +31304,7 @@ index 5a5b6e4..07b4acb 100644
  				}
  				seen |= SEEN_DATAREF | SEEN_XREG;
  				t_offset = sk_load_byte_msh - (image + addrs[i]);
-@@ -572,7 +696,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -577,7 +701,7 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  				}
  				if (filter[i].jt != 0) {
  					if (filter[i].jf && f_offset)
@@ -31315,7 +31313,7 @@ index 5a5b6e4..07b4acb 100644
  					EMIT_COND_JMP(t_op, t_offset);
  					if (filter[i].jf)
  						EMIT_JMP(f_offset);
-@@ -582,17 +706,18 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -587,17 +711,18 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  				break;
  			default:
  				/* hmm, too complex filter, give up with jit compiler */
@@ -31338,7 +31336,7 @@ index 5a5b6e4..07b4acb 100644
  			}
  			proglen += ilen;
  			addrs[i] = proglen;
-@@ -613,11 +738,9 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -618,11 +743,9 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  			break;
  		}
  		if (proglen == oldproglen) {
@@ -31352,7 +31350,7 @@ index 5a5b6e4..07b4acb 100644
  		}
  		oldproglen = proglen;
  	}
-@@ -633,7 +756,10 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -638,7 +761,10 @@ cond_branch:			f_offset = addrs[i + filter[i].jf] - addrs[i];
  		bpf_flush_icache(image, image + proglen);
  
  		fp->bpf_func = (void *)image;
@@ -31364,7 +31362,7 @@ index 5a5b6e4..07b4acb 100644
  out:
  	kfree(addrs);
  	return;
-@@ -641,18 +767,20 @@ out:
+@@ -646,18 +772,20 @@ out:
  
  static void jit_free_defer(struct work_struct *arg)
  {
@@ -33729,10 +33727,10 @@ index cb842a8..6688e24 100644
  	 * Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
  	 */
 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
-index de2802c..2260da9 100644
+index 41ffb8c..2afaff8 100644
 --- a/drivers/ata/libahci.c
 +++ b/drivers/ata/libahci.c
-@@ -1211,7 +1211,7 @@ int ahci_kick_engine(struct ata_port *ap)
+@@ -1212,7 +1212,7 @@ int ahci_kick_engine(struct ata_port *ap)
  }
  EXPORT_SYMBOL_GPL(ahci_kick_engine);
  
@@ -33742,7 +33740,7 @@ index de2802c..2260da9 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 5d8fc3d..d537f03 100644
+index fcd8586..19ba966 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
 @@ -4790,7 +4790,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
@@ -38367,10 +38365,10 @@ index b153674..ad2ba9b 100644
  	 PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
  	 },
 diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index da71881..8d7d62c 100644
+index f8f790c..b43f147 100644
 --- a/drivers/edac/sb_edac.c
 +++ b/drivers/edac/sb_edac.c
-@@ -367,7 +367,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
+@@ -368,7 +368,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
  /*
   *	pci_device_id	table for which devices we are looking for
   */
@@ -38482,10 +38480,10 @@ index 94a58a0..f5eba42 100644
  	container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
  
 diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 2861ef4..9e90c69 100644
+index 20f7daa..91678be 100644
 --- a/drivers/firmware/dmi_scan.c
 +++ b/drivers/firmware/dmi_scan.c
-@@ -490,11 +490,6 @@ void __init dmi_scan_machine(void)
+@@ -488,11 +488,6 @@ void __init dmi_scan_machine(void)
  		}
  	}
  	else {
@@ -38497,7 +38495,7 @@ index 2861ef4..9e90c69 100644
  		p = dmi_ioremap(0xF0000, 0x10000);
  		if (p == NULL)
  			goto error;
-@@ -775,7 +770,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -770,7 +765,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
  	if (buf == NULL)
  		return -1;
  
@@ -40584,10 +40582,10 @@ index 4ef02b2..8a96831 100644
  
  		for (i = 0; i < hid->maxcollection; i++)
 diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 44a1ea4..21cce84 100644
+index a7e6f03..a2b6d86 100644
 --- a/drivers/hv/channel.c
 +++ b/drivers/hv/channel.c
-@@ -403,8 +403,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -406,8 +406,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
  	unsigned long flags;
  	int ret = 0;
  
@@ -43051,7 +43049,7 @@ index 614ebeb..ce439fd 100644
  		.callback = ss4200_led_dmi_callback,
  		.ident = "Intel SS4200-E",
 diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index b5fdcb7..3cb34b8 100644
+index 34842e5..3cb34b8 100644
 --- a/drivers/lguest/core.c
 +++ b/drivers/lguest/core.c
 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
@@ -43081,15 +43079,6 @@ index b5fdcb7..3cb34b8 100644
  	       end_switcher_text - start_switcher_text);
  
  	printk(KERN_INFO "lguest: mapped switcher at %p\n",
-@@ -171,7 +179,7 @@ static void unmap_switcher(void)
- bool lguest_address_ok(const struct lguest *lg,
- 		       unsigned long addr, unsigned long len)
- {
--	return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
-+	return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
- }
- 
- /*
 diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
 index 3b62be16..e33134a 100644
 --- a/drivers/lguest/page_tables.c
@@ -43750,7 +43739,7 @@ index abac83a..3652f35 100644
  
  			rdev_dec_pending(rdev, mddev);
 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index c293d9c..808ae97 100644
+index 6056ee7..a4c3ba4 100644
 --- a/drivers/md/raid5.c
 +++ b/drivers/md/raid5.c
 @@ -598,23 +598,23 @@ async_copy_data(int frombio, struct bio *bio, struct page *page,
@@ -43806,7 +43795,7 @@ index c293d9c..808ae97 100644
  	sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
  
  	conf->active_name = 0;
-@@ -1618,19 +1626,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1619,19 +1627,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdevname(rdev->bdev, b));
@@ -43830,7 +43819,7 @@ index c293d9c..808ae97 100644
  		if (conf->mddev->degraded >= conf->max_degraded)
  			printk_ratelimited(
  				KERN_WARNING
-@@ -1650,7 +1658,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1651,7 +1659,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
  				(unsigned long long)(sh->sector
  						     + rdev->data_offset),
  				bdn);
@@ -46997,6 +46986,22 @@ index 3d21742..b8e03e7 100644
  	// waiting for all pending urbs to complete?
  	if (dev->wait) {
  		if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index f13a673..218ebf0 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -981,9 +981,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* Do we support "hardware" checksums? */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ 		/* This opens up the world of extra features. */
+-		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 		if (csum)
+-			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 
+ 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
 index 28ceef2..655b059 100644
 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -48357,7 +48362,7 @@ index 26fba2d..693b4d3 100644
  				     1, asus->debug.method_id,
  				     &input, &output);
 diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 8877b83..024cf2c 100644
+index ba3638e..70e74af 100644
 --- a/drivers/platform/x86/compal-laptop.c
 +++ b/drivers/platform/x86/compal-laptop.c
 @@ -775,7 +775,7 @@ static int dmi_check_cb_extra(const struct dmi_system_id *id)
@@ -50086,7 +50091,7 @@ index 21a045e..ec89e03 100644
  
  	transport_setup_device(&rport->dev);
 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 5c6b5f5..015ec9d 100644
+index a50825b..7995f6ea 100644
 --- a/drivers/scsi/sd.c
 +++ b/drivers/scsi/sd.c
 @@ -105,7 +105,7 @@ static void sd_shutdown(struct device *);
@@ -50098,7 +50103,7 @@ index 5c6b5f5..015ec9d 100644
  static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer);
  static void scsi_disk_release(struct device *cdev);
  static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
-@@ -1390,7 +1390,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+@@ -1384,7 +1384,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
   *
   *	Note: potentially run from within an ISR. Must not block.
   **/
@@ -50107,7 +50112,7 @@ index 5c6b5f5..015ec9d 100644
  {
  	int result = SCpnt->result;
  	unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
-@@ -2635,7 +2635,7 @@ static int sd_probe(struct device *dev)
+@@ -2626,7 +2626,7 @@ static int sd_probe(struct device *dev)
  	device_initialize(&sdkp->dev);
  	sdkp->dev.parent = dev;
  	sdkp->dev.class = &sd_disk_class;
@@ -50117,7 +50122,7 @@ index 5c6b5f5..015ec9d 100644
  	if (device_add(&sdkp->dev))
  		goto out_free_index;
 diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 2d25616..c464bcf 100644
+index b4cac39..c464bcf 100644
 --- a/drivers/scsi/sg.c
 +++ b/drivers/scsi/sg.c
 @@ -1077,7 +1077,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
@@ -50129,17 +50134,7 @@ index 2d25616..c464bcf 100644
  	case BLKTRACESTART:
  		return blk_trace_startstop(sdp->device->request_queue, 1);
  	case BLKTRACESTOP:
-@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
- 			md->from_user = 0;
- 	}
- 
-+	if (unlikely(iov_count > UIO_MAXIOV))
-+		return -EINVAL;
-+
- 	if (iov_count) {
- 		int len, size = sizeof(struct sg_iovec) * iov_count;
- 		struct iovec *iov;
-@@ -2312,7 +2315,7 @@ struct sg_proc_leaf {
+@@ -2315,7 +2315,7 @@ struct sg_proc_leaf {
  	const struct file_operations * fops;
  };
  
@@ -50148,7 +50143,7 @@ index 2d25616..c464bcf 100644
  	{"allow_dio", &adio_fops},
  	{"debug", &debug_fops},
  	{"def_reserved_size", &dressz_fops},
-@@ -2327,7 +2330,7 @@ sg_proc_init(void)
+@@ -2330,7 +2330,7 @@ sg_proc_init(void)
  {
  	int k, mask;
  	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
@@ -56912,10 +56907,10 @@ index 4a88ac3..d2e1657 100644
  EXPORT_SYMBOL_GPL(virtqueue_kick);
  
 diff --git a/drivers/xen/events.c b/drivers/xen/events.c
-index f6227cc..3e22fab 100644
+index bcf7711..98a489c 100644
 --- a/drivers/xen/events.c
 +++ b/drivers/xen/events.c
-@@ -1632,7 +1632,7 @@ void xen_irq_resume(void)
+@@ -1636,7 +1636,7 @@ void xen_irq_resume(void)
  	restore_pirqs();
  }
  
@@ -56924,7 +56919,7 @@ index f6227cc..3e22fab 100644
  	.name			= "xen-dyn",
  
  	.irq_disable		= disable_dynirq,
-@@ -1646,7 +1646,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
+@@ -1650,7 +1650,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
  	.irq_retrigger		= retrigger_dynirq,
  };
  
@@ -56933,7 +56928,7 @@ index f6227cc..3e22fab 100644
  	.name			= "xen-pirq",
  
  	.irq_startup		= startup_pirq,
-@@ -1666,7 +1666,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
+@@ -1670,7 +1670,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
  	.irq_retrigger		= retrigger_dynirq,
  };
  
@@ -57368,7 +57363,7 @@ index a6395bd..f1e376a 100644
  		(unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
  #ifdef __alpha__
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 2aed667..52b96fd 100644
+index d252462..ebd7fd4 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -32,6 +32,7 @@
@@ -58005,10 +58000,12 @@ index 2aed667..52b96fd 100644
  	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
  		current->personality |= READ_IMPLIES_EXEC;
  
-@@ -809,6 +1246,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -810,8 +1247,21 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  #else
  			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
  #endif
+-			total_size = total_mapping_size(elf_phdata,
+-							loc->elf_ex.e_phnum);
 +
 +#ifdef CONFIG_PAX_RANDMMAP
 +			/* PaX: randomize base address at the default exe base if requested */
@@ -58023,10 +58020,11 @@ index 2aed667..52b96fd 100644
 +			}
 +#endif
 +
- 		}
- 
- 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -841,9 +1292,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
++			total_size = total_mapping_size(elf_phdata, loc->elf_ex.e_phnum);
+ 			if (!total_size) {
+ 				retval = -EINVAL;
+ 				goto out_free_dentry;
+@@ -848,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		 * allowed task size. Note that p_filesz must always be
  		 * <= p_memsz so it is only necessary to check p_memsz.
  		 */
@@ -58039,7 +58037,7 @@ index 2aed667..52b96fd 100644
  			/* set_brk can never work. Avoid overflows. */
  			send_sig(SIGKILL, current, 0);
  			retval = -EINVAL;
-@@ -882,17 +1333,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -889,17 +1339,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
  		goto out_free_dentry;
  	}
  	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -58090,7 +58088,7 @@ index 2aed667..52b96fd 100644
  					    load_bias);
  		if (!IS_ERR((void *)elf_entry)) {
  			/*
-@@ -1099,7 +1577,7 @@ out:
+@@ -1106,7 +1583,7 @@ out:
   * Decide what to dump of a segment, part, all or none.
   */
  static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -58099,7 +58097,7 @@ index 2aed667..52b96fd 100644
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1133,7 +1611,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1140,7 +1617,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -58108,7 +58106,7 @@ index 2aed667..52b96fd 100644
  		goto whole;
  
  	/*
-@@ -1355,9 +1833,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1362,9 +1839,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -58120,7 +58118,7 @@ index 2aed667..52b96fd 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1852,14 +2330,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1859,14 +2336,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -58137,7 +58135,7 @@ index 2aed667..52b96fd 100644
  	return size;
  }
  
-@@ -1953,7 +2431,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1960,7 +2437,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -58146,7 +58144,7 @@ index 2aed667..52b96fd 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -1967,10 +2445,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1974,10 +2451,12 @@ static int elf_core_dump(struct coredump_params *cprm)
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -58159,7 +58157,7 @@ index 2aed667..52b96fd 100644
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -1984,7 +2464,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1991,7 +2470,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -58168,7 +58166,7 @@ index 2aed667..52b96fd 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -1995,6 +2475,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2002,6 +2481,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -58176,7 +58174,7 @@ index 2aed667..52b96fd 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2019,7 +2500,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2026,7 +2506,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -58185,7 +58183,7 @@ index 2aed667..52b96fd 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2028,6 +2509,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2035,6 +2515,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -58193,7 +58191,7 @@ index 2aed667..52b96fd 100644
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2045,6 +2527,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2052,6 +2533,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -58201,7 +58199,7 @@ index 2aed667..52b96fd 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2065,6 +2548,167 @@ out:
+@@ -2072,6 +2554,167 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -58482,7 +58480,7 @@ index dede441..f2a2507 100644
  
  		WARN_ON(trans->transid != btrfs_header_generation(parent));
 diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index a694317..dc698a1 100644
+index da528f8..97002a3 100644
 --- a/fs/btrfs/extent-tree.c
 +++ b/fs/btrfs/extent-tree.c
 @@ -5644,7 +5644,7 @@ again:
@@ -58495,10 +58493,10 @@ index a694317..dc698a1 100644
  		do_chunk_alloc(trans, root->fs_info->extent_root,
  			       num_bytes, data, CHUNK_ALLOC_FORCE);
 diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 7cbe2f8..20cc43f 100644
+index 52bacff..a4b7f29 100644
 --- a/fs/btrfs/ioctl.c
 +++ b/fs/btrfs/ioctl.c
-@@ -2770,7 +2770,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+@@ -2775,7 +2775,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
  		up_read(&info->groups_sem);
  	}
  
@@ -59438,7 +59436,7 @@ index 739fb59..5385976 100644
  static int __init init_cramfs_fs(void)
  {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 8bc98af..68601d9 100644
+index 8a35300..aee4955 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -103,11 +103,11 @@ static unsigned int d_hash_shift __read_mostly;
@@ -59481,24 +59479,6 @@ index 8bc98af..68601d9 100644
  	/*
  	 * If this dentry needs lookup, don't set the referenced flag so that it
  	 * is more likely to be cleaned up by the dcache shrinker in case of
-@@ -1016,13 +1019,13 @@ ascend:
- 		/* might go back up the wrong parent if we have had a rename */
- 		if (!locked && read_seqretry(&rename_lock, seq))
- 			goto rename_retry;
--		next = child->d_child.next;
--		while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
-+		/* go into the first sibling still alive */
-+		do {
-+			next = child->d_child.next;
- 			if (next == &this_parent->d_subdirs)
- 				goto ascend;
- 			child = list_entry(next, struct dentry, d_child);
--			next = next->next;
--		}
-+		} while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
- 		rcu_read_unlock();
- 		goto resume;
- 	}
 @@ -1235,6 +1238,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	dentry->d_sb = sb;
  	dentry->d_op = NULL;
@@ -59520,10 +59500,10 @@ index 8bc98af..68601d9 100644
  	dcache_init();
  	inode_init();
 diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index a15f1e2..3077628 100644
+index 74f03b5..c4a9396 100644
 --- a/fs/debugfs/inode.c
 +++ b/fs/debugfs/inode.c
-@@ -164,6 +164,7 @@ static struct file_system_type debug_fs_type = {
+@@ -165,6 +165,7 @@ static struct file_system_type debug_fs_type = {
  	.mount =	debug_mount,
  	.kill_sb =	kill_litter_super,
  };
@@ -59531,7 +59511,7 @@ index a15f1e2..3077628 100644
  
  static int debugfs_create_by_name(const char *name, mode_t mode,
  				  struct dentry *parent,
-@@ -277,11 +278,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+@@ -278,11 +279,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
   * If debugfs is not enabled in the kernel, the value -%ENODEV will be
   * returned.
   */
@@ -61286,7 +61266,7 @@ index 22764c7..86372c9 100644
  			break;
  		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
 diff --git a/fs/fhandle.c b/fs/fhandle.c
-index 6b08864..030db71 100644
+index c9e18f3..030db71 100644
 --- a/fs/fhandle.c
 +++ b/fs/fhandle.c
 @@ -8,6 +8,7 @@
@@ -61306,18 +61286,6 @@ index 6b08864..030db71 100644
  		retval = -EPERM;
  		goto out_err;
  	}
-@@ -196,8 +197,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
- 		goto out_err;
- 	}
- 	/* copy the full handle */
--	if (copy_from_user(handle, ufh,
--			   sizeof(struct file_handle) +
-+	*handle = f_handle;
-+	if (copy_from_user(&handle->f_handle,
-+			   &ufh->f_handle,
- 			   f_handle.handle_bytes)) {
- 		retval = -EFAULT;
- 		goto out_handle;
 diff --git a/fs/fifo.c b/fs/fifo.c
 index cf6f434..3d7942c 100644
 --- a/fs/fifo.c
@@ -64749,10 +64717,10 @@ index 5d22872..523db20 100644
  		kfree(link);
  }
 diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
-index e043c4c..f99d456 100644
+index f58f1c4..7aed9d4 100644
 --- a/fs/omfs/inode.c
 +++ b/fs/omfs/inode.c
-@@ -570,6 +570,7 @@ static struct file_system_type omfs_fs_type = {
+@@ -571,6 +571,7 @@ static struct file_system_type omfs_fs_type = {
  	.kill_sb = kill_block_super,
  	.fs_flags = FS_REQUIRES_DEV,
  };
@@ -64917,7 +64885,7 @@ index bd8ae78..539d250 100644
  		ldm_crit ("Out of memory.");
  		return false;
 diff --git a/fs/pipe.c b/fs/pipe.c
-index 8ca88fc..db6ce82 100644
+index d2cbeff..db6ce82 100644
 --- a/fs/pipe.c
 +++ b/fs/pipe.c
 @@ -33,7 +33,7 @@ unsigned int pipe_max_size = 1048576;
@@ -64929,109 +64897,7 @@ index 8ca88fc..db6ce82 100644
  
  /*
   * We use a start+len construction, which provides full use of the 
-@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
- }
- 
- static int
--pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
--			int atomic)
-+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
-+			size_t *remaining, int atomic)
- {
- 	unsigned long copy;
- 
--	while (len > 0) {
-+	while (*remaining > 0) {
- 		while (!iov->iov_len)
- 			iov++;
--		copy = min_t(unsigned long, len, iov->iov_len);
-+		copy = min_t(unsigned long, *remaining, iov->iov_len);
- 
- 		if (atomic) {
--			if (__copy_from_user_inatomic(to, iov->iov_base, copy))
-+			if (__copy_from_user_inatomic(addr + *offset,
-+						      iov->iov_base, copy))
- 				return -EFAULT;
- 		} else {
--			if (copy_from_user(to, iov->iov_base, copy))
-+			if (copy_from_user(addr + *offset,
-+					   iov->iov_base, copy))
- 				return -EFAULT;
- 		}
--		to += copy;
--		len -= copy;
-+		*offset += copy;
-+		*remaining -= copy;
- 		iov->iov_base += copy;
- 		iov->iov_len -= copy;
- 	}
-@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
- }
- 
- static int
--pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
--		      int atomic)
-+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
-+		      size_t *remaining, int atomic)
- {
- 	unsigned long copy;
- 
--	while (len > 0) {
-+	while (*remaining > 0) {
- 		while (!iov->iov_len)
- 			iov++;
--		copy = min_t(unsigned long, len, iov->iov_len);
-+		copy = min_t(unsigned long, *remaining, iov->iov_len);
- 
- 		if (atomic) {
--			if (__copy_to_user_inatomic(iov->iov_base, from, copy))
-+			if (__copy_to_user_inatomic(iov->iov_base,
-+						    addr + *offset, copy))
- 				return -EFAULT;
- 		} else {
--			if (copy_to_user(iov->iov_base, from, copy))
-+			if (copy_to_user(iov->iov_base,
-+					 addr + *offset, copy))
- 				return -EFAULT;
- 		}
--		from += copy;
--		len -= copy;
-+		*offset += copy;
-+		*remaining -= copy;
- 		iov->iov_base += copy;
- 		iov->iov_len -= copy;
- 	}
-@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- 			struct pipe_buffer *buf = pipe->bufs + curbuf;
- 			const struct pipe_buf_operations *ops = buf->ops;
- 			void *addr;
--			size_t chars = buf->len;
-+			size_t chars = buf->len, remaining;
- 			int error, atomic;
- 
- 			if (chars > total_len)
-@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- 			}
- 
- 			atomic = !iov_fault_in_pages_write(iov, chars);
-+			remaining = chars;
- redo:
- 			addr = ops->map(pipe, buf, atomic);
--			error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
-+			error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
-+						      &remaining, atomic);
- 			ops->unmap(pipe, buf, addr);
- 			if (unlikely(error)) {
- 				/*
-@@ -414,7 +420,6 @@ redo:
- 				break;
- 			}
- 			ret += chars;
--			buf->offset += chars;
- 			buf->len -= chars;
- 
- 			/* Was it a packet buffer? Clean up and exit */
-@@ -437,9 +442,9 @@ redo:
+@@ -442,9 +442,9 @@ redo:
  		}
  		if (bufs)	/* More to do? */
  			continue;
@@ -65043,7 +64909,7 @@ index 8ca88fc..db6ce82 100644
  			/* syscall merging: Usually we must not sleep
  			 * if O_NONBLOCK is set, or if we got some data.
  			 * But if a writer sleeps in kernel space, then
-@@ -503,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+@@ -508,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
  	mutex_lock(&inode->i_mutex);
  	pipe = inode->i_pipe;
  
@@ -65052,26 +64918,7 @@ index 8ca88fc..db6ce82 100644
  		send_sig(SIGPIPE, current, 0);
  		ret = -EPIPE;
  		goto out;
-@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- 		if (ops->can_merge && offset + chars <= PAGE_SIZE) {
- 			int error, atomic = 1;
- 			void *addr;
-+			size_t remaining = chars;
- 
- 			error = ops->confirm(pipe, buf);
- 			if (error)
-@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- 			iov_fault_in_pages_read(iov, chars);
- redo1:
- 			addr = ops->map(pipe, buf, atomic);
--			error = pipe_iov_copy_from_user(offset + addr, iov,
--							chars, atomic);
-+			error = pipe_iov_copy_from_user(addr, &offset, iov,
-+							&remaining, atomic);
- 			ops->unmap(pipe, buf, addr);
- 			ret = error;
- 			do_wakeup = 1;
-@@ -552,7 +558,7 @@ redo1:
+@@ -558,7 +558,7 @@ redo1:
  	for (;;) {
  		int bufs;
  
@@ -65080,34 +64927,7 @@ index 8ca88fc..db6ce82 100644
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -565,6 +571,8 @@ redo1:
- 			struct page *page = pipe->tmp_page;
- 			char *src;
- 			int error, atomic = 1;
-+			int offset = 0;
-+			size_t remaining;
- 
- 			if (!page) {
- 				page = alloc_page(GFP_HIGHUSER);
-@@ -585,14 +593,15 @@ redo1:
- 				chars = total_len;
- 
- 			iov_fault_in_pages_read(iov, chars);
-+			remaining = chars;
- redo2:
- 			if (atomic)
- 				src = kmap_atomic(page, KM_USER0);
- 			else
- 				src = kmap(page);
- 
--			error = pipe_iov_copy_from_user(src, iov, chars,
--							atomic);
-+			error = pipe_iov_copy_from_user(src, &offset, iov,
-+							&remaining, atomic);
- 			if (atomic)
- 				kunmap_atomic(src, KM_USER0);
- 			else
-@@ -643,9 +652,9 @@ redo2:
+@@ -652,9 +652,9 @@ redo2:
  			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
  			do_wakeup = 0;
  		}
@@ -65119,7 +64939,7 @@ index 8ca88fc..db6ce82 100644
  	}
  out:
  	mutex_unlock(&inode->i_mutex);
-@@ -712,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -721,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
  	mask = 0;
  	if (filp->f_mode & FMODE_READ) {
  		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
@@ -65128,7 +64948,7 @@ index 8ca88fc..db6ce82 100644
  			mask |= POLLHUP;
  	}
  
-@@ -722,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -731,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
  		 * Most Unices do not set POLLERR for FIFOs but on Linux they
  		 * behave exactly like pipes for poll().
  		 */
@@ -65137,7 +64957,7 @@ index 8ca88fc..db6ce82 100644
  			mask |= POLLERR;
  	}
  
-@@ -736,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
+@@ -745,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
  
  	mutex_lock(&inode->i_mutex);
  	pipe = inode->i_pipe;
@@ -65151,7 +64971,7 @@ index 8ca88fc..db6ce82 100644
  		free_pipe_info(inode);
  	} else {
  		wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
-@@ -829,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -838,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
  
  	if (inode->i_pipe) {
  		ret = 0;
@@ -65160,7 +64980,7 @@ index 8ca88fc..db6ce82 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -846,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -855,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
  
  	if (inode->i_pipe) {
  		ret = 0;
@@ -65169,7 +64989,7 @@ index 8ca88fc..db6ce82 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -867,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -876,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
  	if (inode->i_pipe) {
  		ret = 0;
  		if (filp->f_mode & FMODE_READ)
@@ -65181,7 +65001,7 @@ index 8ca88fc..db6ce82 100644
  	}
  
  	mutex_unlock(&inode->i_mutex);
-@@ -961,7 +970,7 @@ void free_pipe_info(struct inode *inode)
+@@ -970,7 +970,7 @@ void free_pipe_info(struct inode *inode)
  	inode->i_pipe = NULL;
  }
  
@@ -65190,7 +65010,7 @@ index 8ca88fc..db6ce82 100644
  
  /*
   * pipefs_dname() is called from d_path().
-@@ -991,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
+@@ -1000,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
  		goto fail_iput;
  	inode->i_pipe = pipe;
  
@@ -65200,7 +65020,7 @@ index 8ca88fc..db6ce82 100644
  	inode->i_fop = &rdwr_pipefifo_fops;
  
  	/*
-@@ -1203,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
+@@ -1212,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
   * Currently we rely on the pipe array holding a power-of-2 number
   * of pages.
   */
@@ -65209,7 +65029,7 @@ index 8ca88fc..db6ce82 100644
  {
  	unsigned long nr_pages;
  
-@@ -1253,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -1262,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
  
  	switch (cmd) {
  	case F_SETPIPE_SZ: {
@@ -84014,10 +83834,10 @@ index f93d8c1..71244f6 100644
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 42ac6ad..703f223 100644
+index 3d4b5b6..3648fe8 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -915,7 +915,7 @@ struct ata_port_operations {
+@@ -924,7 +924,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -85621,7 +85441,7 @@ index 9aaf5bf..d5ee2a5 100644
  }
  
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index cb34ff4..c086c98 100644
+index 44e5f47..bf5c1f5 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -101,6 +101,7 @@ struct bio_list;
@@ -87830,7 +87650,7 @@ index 6e4569f..0c8aa25 100644
  	 fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
  #define FIB_RES_GW(res)			(FIB_RES_NH(res).nh_gw)
 diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 416dcb0..e203877 100644
+index b8b2e50..91489a1 100644
 --- a/include/net/ip_vs.h
 +++ b/include/net/ip_vs.h
 @@ -509,7 +509,7 @@ struct ip_vs_conn {
@@ -88203,10 +88023,10 @@ index 4d1be75..a54d29e 100644
  
  /* Get the size of a DATA chunk payload. */
 diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index a15432da..9459dcc 100644
+index 2cccd82..03b6412 100644
 --- a/include/net/sctp/structs.h
 +++ b/include/net/sctp/structs.h
-@@ -644,7 +644,7 @@ struct sctp_pf {
+@@ -649,7 +649,7 @@ struct sctp_pf {
  					  struct sctp_association *asoc);
  	void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
  	struct sctp_af *af;
@@ -96335,7 +96155,7 @@ index 76b8e77..a2930e8 100644
  }
  
 diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index f79803a..0dcc1be 100644
+index f07c144..d2ad3b0 100644
 --- a/kernel/ptrace.c
 +++ b/kernel/ptrace.c
 @@ -211,7 +211,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
@@ -96428,7 +96248,7 @@ index f79803a..0dcc1be 100644
  	return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
  }
  
-@@ -720,7 +740,7 @@ int ptrace_request(struct task_struct *child, long request,
+@@ -740,7 +760,7 @@ int ptrace_request(struct task_struct *child, long request,
  	bool seized = child->ptrace & PT_SEIZED;
  	int ret = -EIO;
  	siginfo_t siginfo, *si;
@@ -96437,7 +96257,7 @@ index f79803a..0dcc1be 100644
  	unsigned long __user *datalp = datavp;
  	unsigned long flags;
  
-@@ -922,14 +942,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+@@ -942,14 +962,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
  		goto out;
  	}
  
@@ -96460,7 +96280,7 @@ index f79803a..0dcc1be 100644
  		goto out_put_task_struct;
  	}
  
-@@ -957,7 +984,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
+@@ -977,7 +1004,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
  	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
  	if (copied != sizeof(tmp))
  		return -EIO;
@@ -96469,7 +96289,7 @@ index f79803a..0dcc1be 100644
  }
  
  int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
-@@ -1051,7 +1078,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
+@@ -1071,7 +1098,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
  }
  
  asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
@@ -96478,7 +96298,7 @@ index f79803a..0dcc1be 100644
  {
  	struct task_struct *child;
  	long ret;
-@@ -1067,14 +1094,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+@@ -1087,14 +1114,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
  		goto out;
  	}
  
@@ -97949,7 +97769,7 @@ index 9e800b2..1533ba5 100644
  	raw_spin_unlock_irq(&call_function.lock);
  }
 diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 2c71d91..6b690a4 100644
+index 44bc103..c131116 100644
 --- a/kernel/softirq.c
 +++ b/kernel/softirq.c
 @@ -52,11 +52,11 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
@@ -97966,7 +97786,7 @@ index 2c71d91..6b690a4 100644
  	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
  	"TASKLET", "SCHED", "HRTIMER", "RCU"
  };
-@@ -235,7 +235,7 @@ restart:
+@@ -241,7 +241,7 @@ restart:
  			kstat_incr_softirqs_this_cpu(vec_nr);
  
  			trace_softirq_entry(vec_nr);
@@ -97975,7 +97795,7 @@ index 2c71d91..6b690a4 100644
  			trace_softirq_exit(vec_nr);
  			if (unlikely(prev_count != preempt_count())) {
  				printk(KERN_ERR "huh, entered softirq %u %s %p"
-@@ -385,7 +385,7 @@ void raise_softirq(unsigned int nr)
+@@ -393,7 +393,7 @@ void raise_softirq(unsigned int nr)
  	local_irq_restore(flags);
  }
  
@@ -97984,7 +97804,7 @@ index 2c71d91..6b690a4 100644
  {
  	softirq_vec[nr].action = action;
  }
-@@ -441,7 +441,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
+@@ -449,7 +449,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
  
  EXPORT_SYMBOL(__tasklet_hi_schedule_first);
  
@@ -97993,7 +97813,7 @@ index 2c71d91..6b690a4 100644
  {
  	struct tasklet_struct *list;
  
-@@ -476,7 +476,7 @@ static void tasklet_action(struct softirq_action *a)
+@@ -484,7 +484,7 @@ static void tasklet_action(struct softirq_action *a)
  	}
  }
  
@@ -98002,7 +97822,7 @@ index 2c71d91..6b690a4 100644
  {
  	struct tasklet_struct *list;
  
-@@ -712,7 +712,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
+@@ -720,7 +720,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -98011,7 +97831,7 @@ index 2c71d91..6b690a4 100644
  	.notifier_call	= remote_softirq_cpu_notify,
  };
  
-@@ -894,7 +894,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
+@@ -902,7 +902,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
  	return NOTIFY_OK;
  }
  
@@ -99610,7 +99430,7 @@ index 875fed4..7a76cbb 100644
  }
  
 diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index b0996c1..9c39703 100644
+index 47343cc..9c39703 100644
 --- a/kernel/trace/trace_events_filter.c
 +++ b/kernel/trace/trace_events_filter.c
 @@ -1027,6 +1027,9 @@ static void parse_init(struct filter_parse_state *ps,
@@ -99633,36 +99453,15 @@ index b0996c1..9c39703 100644
  	ps->infix.cnt--;
  	ps->infix.tail++;
  }
-@@ -1343,19 +1349,27 @@ static int check_preds(struct filter_parse_state *ps)
- {
- 	int n_normal_preds = 0, n_logical_preds = 0;
- 	struct postfix_elt *elt;
-+	int cnt = 0;
- 
- 	list_for_each_entry(elt, &ps->postfix, list) {
--		if (elt->op == OP_NONE)
-+		if (elt->op == OP_NONE) {
-+			cnt++;
- 			continue;
-+		}
- 
- 		if (elt->op == OP_AND || elt->op == OP_OR) {
- 			n_logical_preds++;
-+			cnt--;
+@@ -1356,6 +1362,8 @@ static int check_preds(struct filter_parse_state *ps)
+ 			cnt--;
  			continue;
  		}
 +		// OP_NOT is not supported in this kernel, will get
 +		// a reject here when it's backported
-+		cnt--;
+ 		cnt--;
  		n_normal_preds++;
-+		WARN_ON_ONCE(cnt < 0);
- 	}
- 
--	if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
-+	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
- 		parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
- 		return -EINVAL;
- 	}
+ 		WARN_ON_ONCE(cnt < 0);
 diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
 index a7d2a4c..b034c76 100644
 --- a/kernel/trace/trace_functions_graph.c
@@ -104650,7 +104449,7 @@ index d0cb11f..e0a7fea 100644
  	struct mm_struct *mm;
  
 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 1bf1f74..5e27559 100644
+index 62bfbd9..bfd70ee 100644
 --- a/mm/page-writeback.c
 +++ b/mm/page-writeback.c
 @@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -105763,7 +105562,7 @@ index 8105be4..93fb21c 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 6a4c2fb..18d36e8 100644
+index 60c6969..dd5e22f 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -186,7 +186,7 @@ static enum {
@@ -105793,7 +105592,7 @@ index 6a4c2fb..18d36e8 100644
  		s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
  #ifdef CONFIG_STACKTRACE
  	{
-@@ -2537,6 +2537,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
+@@ -2520,6 +2520,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
  
  	slab_free_hook(s, x);
  
@@ -105808,7 +105607,7 @@ index 6a4c2fb..18d36e8 100644
  redo:
  	/*
  	 * Determine the currently cpus per cpu slab.
-@@ -2572,6 +2580,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
+@@ -2555,6 +2563,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
  
  	page = virt_to_head_page(x);
  
@@ -105817,7 +105616,7 @@ index 6a4c2fb..18d36e8 100644
  	slab_free(s, page, x, _RET_IP_);
  
  	trace_kmem_cache_free(_RET_IP_, x);
-@@ -2605,7 +2615,7 @@ static int slub_min_objects;
+@@ -2588,7 +2598,7 @@ static int slub_min_objects;
   * Merge control. If this is set then no merging of slab caches will occur.
   * (Could be removed. This was introduced to pacify the merge skeptics.)
   */
@@ -105826,7 +105625,7 @@ index 6a4c2fb..18d36e8 100644
  
  /*
   * Calculate the order of allocation given an slab object size.
-@@ -2909,6 +2919,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+@@ -2892,6 +2902,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
  	s->inuse = size;
  
  	if (((flags & (SLAB_DESTROY_BY_RCU | SLAB_POISON)) ||
@@ -105836,7 +105635,7 @@ index 6a4c2fb..18d36e8 100644
  		s->ctor)) {
  		/*
  		 * Relocate free pointer after the object if it is not
-@@ -3055,7 +3068,7 @@ static int kmem_cache_open(struct kmem_cache *s,
+@@ -3038,7 +3051,7 @@ static int kmem_cache_open(struct kmem_cache *s,
  	else
  		s->cpu_partial = 30;
  
@@ -105845,7 +105644,7 @@ index 6a4c2fb..18d36e8 100644
  #ifdef CONFIG_NUMA
  	s->remote_node_defrag_ratio = 1000;
  #endif
-@@ -3159,8 +3172,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
+@@ -3142,8 +3155,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
  void kmem_cache_destroy(struct kmem_cache *s)
  {
  	down_write(&slub_lock);
@@ -105855,7 +105654,7 @@ index 6a4c2fb..18d36e8 100644
  		list_del(&s->list);
  		up_write(&slub_lock);
  		if (kmem_cache_close(s)) {
-@@ -3189,6 +3201,10 @@ static struct kmem_cache *kmem_cache;
+@@ -3172,6 +3184,10 @@ static struct kmem_cache *kmem_cache;
  static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT];
  #endif
  
@@ -105866,7 +105665,7 @@ index 6a4c2fb..18d36e8 100644
  static int __init setup_slub_min_order(char *str)
  {
  	get_option(&str, &slub_min_order);
-@@ -3303,6 +3319,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
+@@ -3286,6 +3302,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
  		return kmalloc_dma_caches[index];
  
  #endif
@@ -105880,7 +105679,7 @@ index 6a4c2fb..18d36e8 100644
  	return kmalloc_caches[index];
  }
  
-@@ -3371,6 +3394,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3354,6 +3377,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
  EXPORT_SYMBOL(__kmalloc_node);
  #endif
  
@@ -105940,7 +105739,7 @@ index 6a4c2fb..18d36e8 100644
  size_t ksize(const void *object)
  {
  	struct page *page;
-@@ -3435,6 +3511,7 @@ void kfree(const void *x)
+@@ -3418,6 +3494,7 @@ void kfree(const void *x)
  	if (unlikely(ZERO_OR_NULL_PTR(x)))
  		return;
  
@@ -105948,7 +105747,7 @@ index 6a4c2fb..18d36e8 100644
  	page = virt_to_head_page(x);
  	if (unlikely(!PageSlab(page))) {
  		BUG_ON(!PageCompound(page));
-@@ -3645,7 +3722,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
+@@ -3628,7 +3705,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
  	int node;
  
  	list_add(&s->list, &slab_caches);
@@ -105957,7 +105756,7 @@ index 6a4c2fb..18d36e8 100644
  
  	for_each_node_state(node, N_NORMAL_MEMORY) {
  		struct kmem_cache_node *n = get_node(s, node);
-@@ -3762,17 +3839,17 @@ void __init kmem_cache_init(void)
+@@ -3745,17 +3822,17 @@ void __init kmem_cache_init(void)
  
  	/* Caches that are not of the two-to-the-power-of size */
  	if (KMALLOC_MIN_SIZE <= 32) {
@@ -105978,7 +105777,7 @@ index 6a4c2fb..18d36e8 100644
  		caches++;
  	}
  
-@@ -3814,6 +3891,22 @@ void __init kmem_cache_init(void)
+@@ -3797,6 +3874,22 @@ void __init kmem_cache_init(void)
  		}
  	}
  #endif
@@ -106001,7 +105800,7 @@ index 6a4c2fb..18d36e8 100644
  	printk(KERN_INFO
  		"SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
  		" CPUs=%d, Nodes=%d\n",
-@@ -3840,7 +3933,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+@@ -3823,7 +3916,7 @@ static int slab_unmergeable(struct kmem_cache *s)
  	/*
  	 * We may have set a slab to be unmergeable during bootstrap.
  	 */
@@ -106010,7 +105809,7 @@ index 6a4c2fb..18d36e8 100644
  		return 1;
  
  	return 0;
-@@ -3897,9 +3990,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3880,9 +3973,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
  		return NULL;
  
  	down_write(&slub_lock);
@@ -106029,7 +105828,7 @@ index 6a4c2fb..18d36e8 100644
  		/*
  		 * Adjust the object sizes so that we clear
  		 * the complete object on kzalloc.
-@@ -3908,7 +4009,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3891,7 +3992,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
  		s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
  
  		if (sysfs_slab_alias(s, name)) {
@@ -106038,7 +105837,7 @@ index 6a4c2fb..18d36e8 100644
  			goto err;
  		}
  		up_write(&slub_lock);
-@@ -3979,7 +4080,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
+@@ -3962,7 +4063,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
  	return NOTIFY_OK;
  }
  
@@ -106047,7 +105846,7 @@ index 6a4c2fb..18d36e8 100644
  	.notifier_call = slab_cpuup_callback
  };
  
-@@ -4037,7 +4138,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4020,7 +4121,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
  }
  #endif
  
@@ -106056,7 +105855,7 @@ index 6a4c2fb..18d36e8 100644
  static int count_inuse(struct page *page)
  {
  	return page->inuse;
-@@ -4424,12 +4525,12 @@ static void resiliency_test(void)
+@@ -4407,12 +4508,12 @@ static void resiliency_test(void)
  	validate_slab_cache(kmalloc_caches[9]);
  }
  #else
@@ -106071,7 +105870,7 @@ index 6a4c2fb..18d36e8 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4676,7 +4777,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4659,7 +4760,7 @@ SLAB_ATTR_RO(ctor);
  
  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
  {
@@ -106080,7 +105879,7 @@ index 6a4c2fb..18d36e8 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -5243,6 +5344,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5226,6 +5327,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -106088,7 +105887,7 @@ index 6a4c2fb..18d36e8 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5271,7 +5373,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
+@@ -5254,7 +5356,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
  	}
  
  	s->kobj.kset = slab_kset;
@@ -106097,7 +105896,7 @@ index 6a4c2fb..18d36e8 100644
  	if (err) {
  		kobject_put(&s->kobj);
  		return err;
-@@ -5305,6 +5407,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5288,6 +5390,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -106105,7 +105904,7 @@ index 6a4c2fb..18d36e8 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5318,6 +5421,7 @@ struct saved_alias {
+@@ -5301,6 +5404,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -106113,7 +105912,7 @@ index 6a4c2fb..18d36e8 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5340,6 +5444,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5323,6 +5427,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -107247,10 +107046,10 @@ index f20c4fd..73aee41 100644
  	if (err < 0) {
  		pr_err("bridge: can't register sap for STP\n");
 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 398a297..83fc29c 100644
+index 1bd197f..1119378 100644
 --- a/net/bridge/br_multicast.c
 +++ b/net/bridge/br_multicast.c
-@@ -1416,7 +1416,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+@@ -1415,7 +1415,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
  	nexthdr = ip6h->nexthdr;
  	offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
  
@@ -107344,7 +107143,7 @@ index 45f93f8..550f429 100644
  			break;
  		}
 diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index 7eed9eb..fd7291e 100644
+index 7e4b4b4..6c8ce35 100644
 --- a/net/caif/caif_socket.c
 +++ b/net/caif/caif_socket.c
 @@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
@@ -107449,7 +107248,7 @@ index 7eed9eb..fd7291e 100644
  			set_rx_flow_on(cf_sk);
  			caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
  	}
-@@ -852,7 +853,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
+@@ -860,7 +861,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
  	/*ifindex = id of the interface.*/
  	cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
  
@@ -107458,7 +107257,7 @@ index 7eed9eb..fd7291e 100644
  	cf_sk->layer.receive = caif_sktrecv_cb;
  
  	err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
-@@ -941,7 +942,7 @@ static int caif_release(struct socket *sock)
+@@ -949,7 +950,7 @@ static int caif_release(struct socket *sock)
  	spin_unlock_bh(&sk->sk_receive_queue.lock);
  	sock->sk = NULL;
  
@@ -107467,7 +107266,7 @@ index 7eed9eb..fd7291e 100644
  
  	WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
  	if (cf_sk->debugfs_socket_dir != NULL)
-@@ -1120,7 +1121,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
+@@ -1128,7 +1129,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
  	cf_sk->conn_req.protocol = protocol;
  	/* Increase the number of sockets created. */
  	dbfs_atomic_inc(&cnt.caif_nr_socks);
@@ -108245,10 +108044,10 @@ index 66e3f1f..317ae80 100644
  
  	m->msg_iov = iov;
 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 0ea3fd3..d87fef1 100644
+index c8c2645..e503d27 100644
 --- a/net/core/neighbour.c
 +++ b/net/core/neighbour.c
-@@ -2803,11 +2803,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
+@@ -2814,11 +2814,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
  		/* Terminate the table early */
  		memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
  	} else {
@@ -110199,7 +109998,7 @@ index 2e0f0af..e2948bf 100644
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 8c2e259..90d7b4e 100644
+index 5e92043..90d7b4e 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
 @@ -86,6 +86,7 @@
@@ -110270,20 +110069,7 @@ index 8c2e259..90d7b4e 100644
  	ulen = skb->len - sizeof(struct udphdr);
  	copied = len;
  	if (copied > ulen)
-@@ -1248,10 +1269,8 @@ csum_copy_err:
- 		UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -1486,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+@@ -1484,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
  
  drop:
  	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -110292,7 +110078,7 @@ index 8c2e259..90d7b4e 100644
  	kfree_skb(skb);
  	return -1;
  }
-@@ -1505,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -1503,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
  
  		if (!skb1) {
@@ -110301,7 +110087,7 @@ index 8c2e259..90d7b4e 100644
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					 IS_UDPLITE(sk));
  			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -1674,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -1672,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -110311,7 +110097,7 @@ index 8c2e259..90d7b4e 100644
  	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
  
  	/*
-@@ -2097,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2095,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
  		sk_wmem_alloc_get(sp),
  		sk_rmem_alloc_get(sp),
  		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
@@ -110906,7 +110692,7 @@ index 655cc60..c49497a 100644
  
  static int tcp6_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d131a95..59d5161 100644
+index dc08afd..59d5161 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -50,6 +50,10 @@
@@ -110920,20 +110706,7 @@ index d131a95..59d5161 100644
  int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
  {
  	const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -451,10 +455,8 @@ csum_copy_err:
- 	}
- 	unlock_sock_fast(sk, slow);
- 
--	if (noblock)
--		return -EAGAIN;
--
--	/* starting over for a new packet */
-+	/* starting over for a new packet, but check if we need to yield */
-+	cond_resched();
- 	msg->msg_flags &= ~MSG_TRUNC;
- 	goto try_again;
- }
-@@ -546,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+@@ -544,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
  
  	return 0;
  drop:
@@ -110942,7 +110715,7 @@ index d131a95..59d5161 100644
  drop_no_sk_drops_inc:
  	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
  	kfree_skb(skb);
-@@ -622,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -620,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
  			continue;
  		}
  drop:
@@ -110951,7 +110724,7 @@ index d131a95..59d5161 100644
  		UDP6_INC_STATS_BH(sock_net(sk),
  				UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
  		UDP6_INC_STATS_BH(sock_net(sk),
-@@ -777,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -775,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
  				proto == IPPROTO_UDPLITE);
  
@@ -110961,7 +110734,7 @@ index d131a95..59d5161 100644
  		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
  
  		kfree_skb(skb);
-@@ -793,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -791,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  	if (!sock_owned_by_user(sk))
  		udpv6_queue_rcv_skb(sk, skb);
  	else if (sk_add_backlog(sk, skb)) {
@@ -110970,7 +110743,7 @@ index d131a95..59d5161 100644
  		bh_unlock_sock(sk);
  		sock_put(sk);
  		goto discard;
-@@ -1409,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
+@@ -1407,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
  		   0, 0L, 0,
  		   sock_i_uid(sp), 0,
  		   sock_i_ino(sp),
@@ -111640,7 +111413,7 @@ index 6422845..2c19968 100644
  
  	if (!todrop_rate[i]) return 0;
 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index d864aaf..d6afbda 100644
+index 197ed93..49519a9 100644
 --- a/net/netfilter/ipvs/ip_vs_core.c
 +++ b/net/netfilter/ipvs/ip_vs_core.c
 @@ -562,7 +562,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
@@ -111662,7 +111435,7 @@ index d864aaf..d6afbda 100644
  	if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
  	    cp->protocol == IPPROTO_SCTP) {
 diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 93acfa1..e846c43 100644
+index 1e27a1f..9774f6b 100644
 --- a/net/netfilter/ipvs/ip_vs_ctl.c
 +++ b/net/netfilter/ipvs/ip_vs_ctl.c
 @@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
@@ -112385,7 +112158,7 @@ index b4d889b..bb33240 100644
  		*uaddr_len = sizeof(struct sockaddr_ax25);
  	}
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 4f19bf2..e3a2b51 100644
+index 0c21f06..0f53a06 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
 @@ -195,6 +195,7 @@ struct tpacket_kbdq_core {
@@ -112404,7 +112177,7 @@ index 4f19bf2..e3a2b51 100644
  	prb_init_ft_ops(p1, req_u);
  	prb_setup_retire_blk_timer(po, tx_ring);
  	prb_open_block(p1, pbd);
-@@ -1678,7 +1680,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1664,7 +1666,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.tp_packets++;
@@ -112413,7 +112186,7 @@ index 4f19bf2..e3a2b51 100644
  	__skb_queue_tail(&sk->sk_receive_queue, skb);
  	spin_unlock(&sk->sk_receive_queue.lock);
  	sk->sk_data_ready(sk, skb->len);
-@@ -1687,7 +1689,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1673,7 +1675,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  drop_n_acct:
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.tp_drops++;
@@ -112422,7 +112195,7 @@ index 4f19bf2..e3a2b51 100644
  	spin_unlock(&sk->sk_receive_queue.lock);
  
  drop_n_restore:
-@@ -1778,6 +1780,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1764,6 +1766,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
  			if ((int)snaplen < 0)
  				snaplen = 0;
  		}
@@ -112441,7 +112214,7 @@ index 4f19bf2..e3a2b51 100644
  	}
  	spin_lock(&sk->sk_receive_queue.lock);
  	h.raw = packet_current_rx_frame(po, skb,
-@@ -2623,6 +2637,7 @@ out:
+@@ -2609,6 +2623,7 @@ out:
  
  static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
  {
@@ -112449,7 +112222,7 @@ index 4f19bf2..e3a2b51 100644
  	struct sock_exterr_skb *serr;
  	struct sk_buff *skb, *skb2;
  	int copied, err;
-@@ -2644,8 +2659,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+@@ -2630,8 +2645,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
  	sock_recv_timestamp(msg, sk, skb);
  
  	serr = SKB_EXT_ERR(skb);
@@ -112460,7 +112233,7 @@ index 4f19bf2..e3a2b51 100644
  
  	msg->msg_flags |= MSG_ERRQUEUE;
  	err = copied;
-@@ -3273,7 +3289,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3259,7 +3275,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
  			len = sizeof(int);
@@ -112469,7 +112242,7 @@ index 4f19bf2..e3a2b51 100644
  			return -EFAULT;
  		switch (val) {
  		case TPACKET_V1:
-@@ -3323,7 +3339,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3309,7 +3325,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -112482,7 +112255,7 @@ index 4f19bf2..e3a2b51 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -3614,6 +3634,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+@@ -3600,6 +3620,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
  			goto out;
  		if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
  			goto out;
@@ -112661,6 +112434,19 @@ index e29e0ca..fa3a6a3 100644
  }
  #endif
  
+diff --git a/net/rds/info.c b/net/rds/info.c
+index f1c016c..a4adb39 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+ 
+ 	/* check for all kinds of wrapping and the like */
+ 	start = (unsigned long)optval;
+-	if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++	if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
 diff --git a/net/rds/iw.h b/net/rds/iw.h
 index 04ce3b1..48119a6 100644
 --- a/net/rds/iw.h
@@ -113310,10 +113096,10 @@ index 76388b0..a967f68 100644
  	sctp_generate_t1_cookie_event,
  	sctp_generate_t1_init_event,
 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index fc63664..832978a 100644
+index 24e88af..047e703 100644
 --- a/net/sctp/socket.c
 +++ b/net/sctp/socket.c
-@@ -2190,11 +2190,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
+@@ -2192,11 +2192,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
  {
  	struct sctp_association *asoc;
  	struct sctp_ulpevent *event;
@@ -113328,7 +113114,7 @@ index fc63664..832978a 100644
  
  	/*
  	 * At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
-@@ -4180,13 +4182,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4194,13 +4196,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
  static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
  				  int __user *optlen)
  {
@@ -113346,7 +113132,7 @@ index fc63664..832978a 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4204,6 +4209,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4218,6 +4223,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
   */
  static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -113355,7 +113141,7 @@ index fc63664..832978a 100644
  	/* Applicable to UDP-style socket only */
  	if (sctp_style(sk, TCP))
  		return -EOPNOTSUPP;
-@@ -4212,7 +4219,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4226,7 +4233,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
  	len = sizeof(int);
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -113365,7 +113151,7 @@ index fc63664..832978a 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4576,12 +4584,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4590,12 +4598,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
   */
  static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
  {
@@ -113382,7 +113168,7 @@ index fc63664..832978a 100644
  		return -EFAULT;
  	return 0;
  }
-@@ -4622,6 +4633,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4636,6 +4647,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
  		addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
  		if (space_left < addrlen)
  			return -ENOMEM;
@@ -113445,7 +113231,7 @@ index 8da4481..d02565e 100644
  			+ (rtt >> sctp_rto_alpha);
  	} else {
 diff --git a/net/socket.c b/net/socket.c
-index 116cf9d..a13ae17 100644
+index 10ea25a..e5f6b01 100644
 --- a/net/socket.c
 +++ b/net/socket.c
 @@ -88,6 +88,7 @@
@@ -113629,7 +113415,7 @@ index 116cf9d..a13ae17 100644
  	int err, err2;
  	int fput_needed;
  
-@@ -1973,7 +2039,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -1971,7 +2037,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
  		 * checking falls down on this.
  		 */
  		if (copy_from_user(ctl_buf,
@@ -113638,7 +113424,7 @@ index 116cf9d..a13ae17 100644
  				   ctl_len))
  			goto out_freectl;
  		msg_sys->msg_control = ctl_buf;
-@@ -2124,7 +2190,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2122,7 +2188,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
  	int err, iov_size, total_len, len;
  
  	/* kernel mode address */
@@ -113647,7 +113433,7 @@ index 116cf9d..a13ae17 100644
  
  	/* user mode address pointers */
  	struct sockaddr __user *uaddr;
-@@ -2155,7 +2221,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2151,7 +2217,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
  	/* Save the user-mode address (verify_iovec will change the
  	 * kernel msghdr to use the kernel address space)
  	 */
@@ -113657,7 +113443,7 @@ index 116cf9d..a13ae17 100644
  	uaddr_len = COMPAT_NAMELEN(msg);
  	if (MSG_CMSG_COMPAT & flags)
  		err = verify_compat_iovec(msg_sys, iov,
-@@ -2799,9 +2866,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2795,9 +2862,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  	}
  
  	ifr = compat_alloc_user_space(buf_size);
@@ -113669,7 +113455,7 @@ index 116cf9d..a13ae17 100644
  		return -EFAULT;
  
  	if (put_user(convert_in ? rxnfc : compat_ptr(data),
-@@ -2823,12 +2890,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2819,12 +2886,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  			offsetof(struct ethtool_rxnfc, fs.ring_cookie));
  
  		if (copy_in_user(rxnfc, compat_rxnfc,
@@ -113686,7 +113472,7 @@ index 116cf9d..a13ae17 100644
  		    copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
  				 sizeof(rxnfc->rule_cnt)))
  			return -EFAULT;
-@@ -2840,12 +2907,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2836,12 +2903,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
  
  	if (convert_out) {
  		if (copy_in_user(compat_rxnfc, rxnfc,
@@ -113703,7 +113489,7 @@ index 116cf9d..a13ae17 100644
  		    copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
  				 sizeof(rxnfc->rule_cnt)))
  			return -EFAULT;
-@@ -2915,14 +2982,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -2911,14 +2978,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
  		old_fs = get_fs();
  		set_fs(KERNEL_DS);
  		err = dev_ioctl(net, cmd,
@@ -113720,7 +113506,7 @@ index 116cf9d..a13ae17 100644
  			return -EFAULT;
  
  		if (get_user(data, &ifr32->ifr_ifru.ifru_data))
-@@ -3024,7 +3091,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -3020,7 +3087,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
  
  	old_fs = get_fs();
  	set_fs(KERNEL_DS);
@@ -113729,7 +113515,7 @@ index 116cf9d..a13ae17 100644
  	set_fs(old_fs);
  
  	if (cmd == SIOCGIFMAP && !err) {
-@@ -3129,7 +3196,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3125,7 +3192,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
  		ret |= __get_user(rtdev, &(ur4->rt_dev));
  		if (rtdev) {
  			ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -113738,7 +113524,7 @@ index 116cf9d..a13ae17 100644
  			devname[15] = 0;
  		} else
  			r4.rt_dev = NULL;
-@@ -3369,8 +3436,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3365,8 +3432,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
  	int __user *uoptlen;
  	int err;
  
@@ -113749,7 +113535,7 @@ index 116cf9d..a13ae17 100644
  
  	set_fs(KERNEL_DS);
  	if (level == SOL_SOCKET)
-@@ -3390,7 +3457,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3386,7 +3453,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
  	char __user *uoptval;
  	int err;
  
@@ -114590,7 +114376,7 @@ index 1983717..4d6102c 100644
  
  	sub->evt.event = htohl(event, sub->swap);
 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8705ee3..cf68ef1 100644
+index 9b1f371..ff529bf 100644
 --- a/net/unix/af_unix.c
 +++ b/net/unix/af_unix.c
 @@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -114639,7 +114425,7 @@ index 8705ee3..cf68ef1 100644
  		mutex_unlock(&path.dentry->d_inode->i_mutex);
  		dput(path.dentry);
  		path.dentry = dentry;
-@@ -2180,11 +2200,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2188,11 +2208,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
  	writable = unix_writable(sk);
  	other = unix_peer_get(sk);
  	if (other) {
@@ -114656,7 +114442,7 @@ index 8705ee3..cf68ef1 100644
  		sock_put(other);
  	}
  
-@@ -2276,9 +2299,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2284,9 +2307,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  		seq_puts(seq, "Num       RefCount Protocol Flags    Type St "
  			 "Inode Path\n");
  	else {
@@ -114671,7 +114457,7 @@ index 8705ee3..cf68ef1 100644
  
  		seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
  			s,
-@@ -2303,10 +2330,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2311,10 +2338,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
  				seq_putc(seq, '@');
  				i++;
  			}
@@ -119101,7 +118887,7 @@ index 6ce2778..f25c378 100644
  
  fail:
 diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
-index 7778b8e..3d619fc 100644
+index a020920..55579f6 100644
 --- a/sound/synth/emux/emux_seq.c
 +++ b/sound/synth/emux/emux_seq.c
 @@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
diff --git a/3.2.69/4425_grsec_remove_EI_PAX.patch b/3.2.70/4425_grsec_remove_EI_PAX.patch
index ba92792..ba92792 100644
--- a/3.2.69/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.70/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
index caaeed1..caaeed1 100644
--- a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.69/4430_grsec-remove-localversion-grsec.patch b/3.2.70/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.69/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.70/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.69/4435_grsec-mute-warnings.patch b/3.2.70/4435_grsec-mute-warnings.patch
index baa71cb..baa71cb 100644
--- a/3.2.69/4435_grsec-mute-warnings.patch
+++ b/3.2.70/4435_grsec-mute-warnings.patch
diff --git a/3.2.69/4440_grsec-remove-protected-paths.patch b/3.2.70/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.69/4440_grsec-remove-protected-paths.patch
+++ b/3.2.70/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.69/4450_grsec-kconfig-default-gids.patch b/3.2.70/4450_grsec-kconfig-default-gids.patch
index 5e1cb04..5e1cb04 100644
--- a/3.2.69/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.70/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
index f73d198..f73d198 100644
--- a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.69/4470_disable-compat_vdso.patch b/3.2.70/4470_disable-compat_vdso.patch
index 34d46de..34d46de 100644
--- a/3.2.69/4470_disable-compat_vdso.patch
+++ b/3.2.70/4470_disable-compat_vdso.patch
diff --git a/3.2.69/4475_emutramp_default_on.patch b/3.2.70/4475_emutramp_default_on.patch
index 2db58ab..2db58ab 100644
--- a/3.2.69/4475_emutramp_default_on.patch
+++ b/3.2.70/4475_emutramp_default_on.patch
diff --git a/4.1.4/1003_linux-4.1.4.patch b/4.1.4/1003_linux-4.1.4.patch
deleted file mode 100644
index d9bc159..0000000
--- a/4.1.4/1003_linux-4.1.4.patch
+++ /dev/null
@@ -1,11078 +0,0 @@
-diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
-index d0d0c57..0a378a8 100644
---- a/Documentation/ABI/testing/ima_policy
-+++ b/Documentation/ABI/testing/ima_policy
-@@ -20,17 +20,19 @@ Description:
- 		action: measure | dont_measure | appraise | dont_appraise | audit
- 		condition:= base | lsm  [option]
- 			base:	[[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
--				 [fowner]]
-+				[euid=] [fowner=]]
- 			lsm:	[[subj_user=] [subj_role=] [subj_type=]
- 				 [obj_user=] [obj_role=] [obj_type=]]
- 			option:	[[appraise_type=]] [permit_directio]
- 
- 		base: 	func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
- 				[FIRMWARE_CHECK]
--			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
-+			mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
-+			       [[^]MAY_EXEC]
- 			fsmagic:= hex value
- 			fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
- 			uid:= decimal value
-+			euid:= decimal value
- 			fowner:=decimal value
- 		lsm:  	are LSM specific
- 		option:	appraise_type:= [imasig]
-@@ -49,11 +51,25 @@ Description:
- 			dont_measure fsmagic=0x01021994
- 			dont_appraise fsmagic=0x01021994
- 			# RAMFS_MAGIC
--			dont_measure fsmagic=0x858458f6
- 			dont_appraise fsmagic=0x858458f6
-+			# DEVPTS_SUPER_MAGIC
-+			dont_measure fsmagic=0x1cd1
-+			dont_appraise fsmagic=0x1cd1
-+			# BINFMTFS_MAGIC
-+			dont_measure fsmagic=0x42494e4d
-+			dont_appraise fsmagic=0x42494e4d
- 			# SECURITYFS_MAGIC
- 			dont_measure fsmagic=0x73636673
- 			dont_appraise fsmagic=0x73636673
-+			# SELINUX_MAGIC
-+			dont_measure fsmagic=0xf97cff8c
-+			dont_appraise fsmagic=0xf97cff8c
-+			# CGROUP_SUPER_MAGIC
-+			dont_measure fsmagic=0x27e0eb
-+			dont_appraise fsmagic=0x27e0eb
-+			# NSFS_MAGIC
-+			dont_measure fsmagic=0x6e736673
-+			dont_appraise fsmagic=0x6e736673
- 
- 			measure func=BPRM_CHECK
- 			measure func=FILE_MMAP mask=MAY_EXEC
-@@ -70,10 +86,6 @@ Description:
- 		Examples of LSM specific definitions:
- 
- 		SELinux:
--			# SELINUX_MAGIC
--			dont_measure fsmagic=0xf97cff8c
--			dont_appraise fsmagic=0xf97cff8c
--
- 			dont_measure obj_type=var_log_t
- 			dont_appraise obj_type=var_log_t
- 			dont_measure obj_type=auditd_log_t
-diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
-index 0a93215..9231dae 100644
---- a/Documentation/ABI/testing/sysfs-ata
-+++ b/Documentation/ABI/testing/sysfs-ata
-@@ -90,6 +90,17 @@ gscr
- 	130:	SATA_PMP_GSCR_SII_GPIO
- 	Only valid if the device is a PM.
- 
-+trim
-+
-+	Shows the DSM TRIM mode currently used by the device. Valid
-+	values are:
-+	unsupported:		Drive does not support DSM TRIM
-+	unqueued:		Drive supports unqueued DSM TRIM only
-+	queued:			Drive supports queued DSM TRIM
-+	forced_unqueued:	Drive's unqueued DSM support is known to be
-+				buggy and only unqueued TRIM commands
-+				are sent
-+
- spdn_cnt
- 
- 	Number of time libata decided to lower the speed of link due to errors.
-diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
-index 3befcb1..1fbdd79 100644
---- a/Documentation/ABI/testing/sysfs-bus-iio
-+++ b/Documentation/ABI/testing/sysfs-bus-iio
-@@ -1165,10 +1165,8 @@ Description:
- 		object is near the sensor, usually be observing
- 		reflectivity of infrared or ultrasound emitted.
- 		Often these sensors are unit less and as such conversion
--		to SI units is not possible.  Where it is, the units should
--		be meters.  If such a conversion is not possible, the reported
--		values should behave in the same way as a distance, i.e. lower
--		values indicate something is closer to the sensor.
-+		to SI units is not possible. Higher proximity measurements
-+		indicate closer objects, and vice versa.
- 
- What:		/sys/.../iio:deviceX/in_illuminance_input
- What:		/sys/.../iio:deviceX/in_illuminance_raw
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index adda2a8..e357b02 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -92,5 +92,5 @@ mpp61         61       gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62         62       gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
-                        audio(mclk), uart0(cts)
- mpp63         63       gpo, spi0(sck), tclk
--mpp64         64       gpio, spi0(miso), spi0-1(cs1)
--mpp65         65       gpio, spi0(mosi), spi0-1(cs2)
-+mpp64         64       gpio, spi0(miso), spi0(cs1)
-+mpp65         65       gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-index 7de0cda..bedbe42 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-@@ -22,8 +22,8 @@ mpp5          5        gpio, dev(ad7), spi0(cs2), spi1(cs2)
- mpp6          6        gpio, dev(ad0), led(p1), audio(rclk)
- mpp7          7        gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
- mpp8          8        gpio, dev (bootcs), spi0(cs0), spi1(cs0)
--mpp9          9        gpio, nf(wen), spi0(sck), spi1(sck)
--mpp10        10        gpio, nf(ren), dram(vttctrl), led(c1)
-+mpp9          9        gpio, spi0(sck), spi1(sck), nand(we)
-+mpp10        10        gpio, dram(vttctrl), led(c1), nand(re)
- mpp11        11        gpio, dev(a0), led(c2), audio(sdo)
- mpp12        12        gpio, dev(a1), audio(bclk)
- mpp13        13        gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-index b17c968..4ac138a 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-@@ -27,15 +27,15 @@ mpp8          8        gpio, ge0(txd1), dev(ad10)
- mpp9          9        gpio, ge0(txd2), dev(ad11)
- mpp10         10       gpio, ge0(txd3), dev(ad12)
- mpp11         11       gpio, ge0(txctl), dev(ad13)
--mpp12         12       gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
--mpp13         13       gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
--mpp14         14       gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
--mpp15         15       gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
--mpp16         16       gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
-+mpp12         12       gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
-+mpp13         13       gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
-+mpp14         14       gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
-+mpp15         15       gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
-+mpp16         16       gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
- mpp17         17       gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
--mpp18         18       gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
--mpp19         19       gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
--mpp20         20       gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
-+mpp18         18       gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
-+mpp19         19       gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
-+mpp20         20       gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
- mpp21         21       gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
- mpp22         22       gpio, spi0(mosi), dev(ad0)
- mpp23         23       gpio, spi0(sck), dev(ad2)
-@@ -58,23 +58,23 @@ mpp39         39       gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2)
- mpp40         40       gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
- mpp41         41       gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
- mpp42         42       gpio, ua1(txd), ua0(rts), dev(ad7)
--mpp43         43       gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
--mpp44         44       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
--mpp45         45       gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp46         46       gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp47         47       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
--mpp48         48       gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
--mpp49         49       gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
--mpp50         50       gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
-+mpp43         43       gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
-+mpp44         44       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
-+mpp45         45       gpio, ref(clk_out0), pcie0(rstout)
-+mpp46         46       gpio, ref(clk_out1), pcie0(rstout)
-+mpp47         47       gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
-+mpp48         48       gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
-+mpp49         49       gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
-+mpp50         50       gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
- mpp51         51       gpio, tdm2c(dtx), audio(sdo), m(decc_err)
--mpp52         52       gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
-+mpp52         52       gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
- mpp53         53       gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
--mpp54         54       gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
-+mpp54         54       gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
- mpp55         55       gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
- mpp56         56       gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
- mpp57         57       gpio, spi1(sck), sd0(clk)
- mpp58         58       gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
--mpp59         59       gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
-+mpp59         59       gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
- 
- [1]: only available on 88F6820 and 88F6828
- [2]: only available on 88F6828
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index 373dbccd..96e7744 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -42,15 +42,15 @@ mpp20         20       gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21         21       gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22         22       gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23         23       gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24         24       gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25         25       gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26         26       gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24         24       gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25         25       gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26         26       gpio, lcd(clk), tdm(fsync)
- mpp27         27       gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28         28       gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29         29       gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30         30       gpio, tdm(int1), sd0(clk)
--mpp31         31       gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32         32       gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31         31       gpio, tdm(int2), sd0(cmd)
-+mpp32         32       gpio, tdm(int3), sd0(d0)
- mpp33         33       gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34         34       gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35         35       gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -58,21 +58,18 @@ mpp36         36       gpio, spi(mosi)
- mpp37         37       gpio, spi(miso)
- mpp38         38       gpio, spi(sck)
- mpp39         39       gpio, spi(cs0)
--mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
--                       pcie(clkreq0)
-+mpp40         40       gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41         41       gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
-                        pcie(clkreq1)
--mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
--                       vdd(cpu0-pd)
--mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
--                       vdd(cpu2-3-pd){1}
-+mpp42         42       gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43         43       gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44         44       gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
-                        mem(bat)
- mpp45         45       gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46         46       gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47         47       gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
-                        ref(clkout)
--mpp48         48       gpio, tclk, dev(burst/last)
-+mpp48         48       gpio, dev(clkout), dev(burst/last)
- 
- * Marvell Armada XP (mv78260 and mv78460 only)
- 
-@@ -84,9 +81,9 @@ mpp51         51       gpio, dev(ad16)
- mpp52         52       gpio, dev(ad17)
- mpp53         53       gpio, dev(ad18)
- mpp54         54       gpio, dev(ad19)
--mpp55         55       gpio, dev(ad20), vdd(cpu0-pd)
--mpp56         56       gpio, dev(ad21), vdd(cpu1-pd)
--mpp57         57       gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55         55       gpio, dev(ad20)
-+mpp56         56       gpio, dev(ad21)
-+mpp57         57       gpio, dev(ad22)
- mpp58         58       gpio, dev(ad23)
- mpp59         59       gpio, dev(ad24)
- mpp60         60       gpio, dev(ad25)
-@@ -96,6 +93,3 @@ mpp63         63       gpio, dev(ad28)
- mpp64         64       gpio, dev(ad29)
- mpp65         65       gpio, dev(ad30)
- mpp66         66       gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/usb/atmel-usb.txt b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-index e180d56..de773a0 100644
---- a/Documentation/devicetree/bindings/usb/atmel-usb.txt
-+++ b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-@@ -60,9 +60,9 @@ Atmel High-Speed USB device controller
- 
- Required properties:
-  - compatible: Should be one of the following
--	       "at91sam9rl-udc"
--	       "at91sam9g45-udc"
--	       "sama5d3-udc"
-+	       "atmel,at91sam9rl-udc"
-+	       "atmel,at91sam9g45-udc"
-+	       "atmel,sama5d3-udc"
-  - reg: Address and length of the register set for the device
-  - interrupts: Should contain usba interrupt
-  - ep childnode: To specify the number of endpoints and their properties.
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 6726139..cd03a0f 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -1398,7 +1398,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
- 			The list of supported hash algorithms is defined
- 			in crypto/hash_info.h.
- 
--	ima_tcb		[IMA]
-+	ima_policy=	[IMA]
-+			The builtin measurement policy to load during IMA
-+			setup.  Specyfing "tcb" as the value, measures all
-+			programs exec'd, files mmap'd for exec, and all files
-+			opened with the read mode bit set by either the
-+			effective uid (euid=0) or uid=0.
-+			Format: "tcb"
-+
-+	ima_tcb		[IMA] Deprecated.  Use ima_policy= instead.
- 			Load a policy which meets the needs of the Trusted
- 			Computing Base.  This means IMA will measure all
- 			programs exec'd, files mmap'd for exec, and all files
-diff --git a/Makefile b/Makefile
-index e3cdec4..36f3225 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 1
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Series 4800
- 
-diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
-index 89ef4a5..45e7761 100644
---- a/arch/arm/boot/dts/at91-sama5d4ek.dts
-+++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
-@@ -108,8 +108,8 @@
- 			mmc0: mmc@f8000000 {
- 				pinctrl-names = "default";
- 				pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>;
--				slot@1 {
--					reg = <1>;
-+				slot@0 {
-+					reg = <0>;
- 					bus-width = <4>;
- 					cd-gpios = <&pioE 5 0>;
- 				};
-diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
-index 70e59c5..e544211 100644
---- a/arch/arm/boot/dts/at91sam9g45.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
-@@ -1148,7 +1148,7 @@
- 			usb2: gadget@fff78000 {
- 				#address-cells = <1>;
- 				#size-cells = <0>;
--				compatible = "atmel,at91sam9rl-udc";
-+				compatible = "atmel,at91sam9g45-udc";
- 				reg = <0x00600000 0x80000
- 				       0xfff78000 0x400>;
- 				interrupts = <27 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
-index 3aa56ae..3314a73 100644
---- a/arch/arm/boot/dts/at91sam9x5.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
-@@ -1062,7 +1062,7 @@
- 			usb2: gadget@f803c000 {
- 				#address-cells = <1>;
- 				#size-cells = <0>;
--				compatible = "atmel,at91sam9rl-udc";
-+				compatible = "atmel,at91sam9g45-udc";
- 				reg = <0x00500000 0x80000
- 				       0xf803c000 0x400>;
- 				interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
-index bbcfb5a..0cb8b0b 100644
---- a/arch/arm/boot/dts/imx23.dtsi
-+++ b/arch/arm/boot/dts/imx23.dtsi
-@@ -435,6 +435,7 @@
- 				interrupts = <36 37 38 39 40 41 42 43 44>;
- 				status = "disabled";
- 				clocks = <&clks 26>;
-+				#io-channel-cells = <1>;
- 			};
- 
- 			spdif@80054000 {
-diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
-index 57ab858..37e6182 100644
---- a/arch/arm/boot/dts/sama5d3.dtsi
-+++ b/arch/arm/boot/dts/sama5d3.dtsi
-@@ -1321,7 +1321,7 @@
- 		usb0: gadget@00500000 {
- 			#address-cells = <1>;
- 			#size-cells = <0>;
--			compatible = "atmel,at91sam9rl-udc";
-+			compatible = "atmel,sama5d3-udc";
- 			reg = <0x00500000 0x100000
- 			       0xf8030000 0x4000>;
- 			interrupts = <33 IRQ_TYPE_LEVEL_HIGH 2>;
-diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
-index 6b1bb58..a5f5f40 100644
---- a/arch/arm/boot/dts/sama5d4.dtsi
-+++ b/arch/arm/boot/dts/sama5d4.dtsi
-@@ -123,7 +123,7 @@
- 		usb0: gadget@00400000 {
- 			#address-cells = <1>;
- 			#size-cells = <0>;
--			compatible = "atmel,at91sam9rl-udc";
-+			compatible = "atmel,sama5d3-udc";
- 			reg = <0x00400000 0x100000
- 			       0xfc02c000 0x4000>;
- 			interrupts = <47 IRQ_TYPE_LEVEL_HIGH 2>;
-@@ -1125,10 +1125,10 @@
- 				compatible = "atmel,at91sam9g46-aes";
- 				reg = <0xfc044000 0x100>;
- 				interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
--				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(41)>,
--				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(40)>;
-+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(41))>,
-+				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(40))>;
- 				dma-names = "tx", "rx";
- 				clocks = <&aes_clk>;
- 				clock-names = "aes_clk";
-@@ -1139,10 +1139,10 @@
- 				compatible = "atmel,at91sam9g46-tdes";
- 				reg = <0xfc04c000 0x100>;
- 				interrupts = <14 IRQ_TYPE_LEVEL_HIGH 0>;
--				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(42)>,
--				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(43)>;
-+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(42))>,
-+				       <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(43))>;
- 				dma-names = "tx", "rx";
- 				clocks = <&tdes_clk>;
- 				clock-names = "tdes_clk";
-@@ -1153,8 +1153,8 @@
- 				compatible = "atmel,at91sam9g46-sha";
- 				reg = <0xfc050000 0x100>;
- 				interrupts = <15 IRQ_TYPE_LEVEL_HIGH 0>;
--				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
--					AT91_XDMAC_DT_PERID(44)>;
-+				dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+					| AT91_XDMAC_DT_PERID(44))>;
- 				dma-names = "tx";
- 				clocks = <&sha_clk>;
- 				clock-names = "sha_clk";
-diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index cca5b87..f11d825 100644
---- a/arch/arm/kernel/smp.c
-+++ b/arch/arm/kernel/smp.c
-@@ -576,7 +576,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	struct pt_regs *old_regs = set_irq_regs(regs);
- 
- 	if ((unsigned)ipinr < NR_IPI) {
--		trace_ipi_entry(ipi_types[ipinr]);
-+		trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- 		__inc_irq_stat(cpu, ipi_irqs[ipinr]);
- 	}
- 
-@@ -635,7 +635,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	}
- 
- 	if ((unsigned)ipinr < NR_IPI)
--		trace_ipi_exit(ipi_types[ipinr]);
-+		trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- 	set_irq_regs(old_regs);
- }
- 
-diff --git a/arch/arm/mach-dove/include/mach/irqs.h b/arch/arm/mach-dove/include/mach/irqs.h
-index 03d401d..3f29e6bc 100644
---- a/arch/arm/mach-dove/include/mach/irqs.h
-+++ b/arch/arm/mach-dove/include/mach/irqs.h
-@@ -14,73 +14,73 @@
- /*
-  * Dove Low Interrupt Controller
-  */
--#define IRQ_DOVE_BRIDGE		0
--#define IRQ_DOVE_H2C		1
--#define IRQ_DOVE_C2H		2
--#define IRQ_DOVE_NAND		3
--#define IRQ_DOVE_PDMA		4
--#define IRQ_DOVE_SPI1		5
--#define IRQ_DOVE_SPI0		6
--#define IRQ_DOVE_UART_0		7
--#define IRQ_DOVE_UART_1		8
--#define IRQ_DOVE_UART_2		9
--#define IRQ_DOVE_UART_3		10
--#define IRQ_DOVE_I2C		11
--#define IRQ_DOVE_GPIO_0_7	12
--#define IRQ_DOVE_GPIO_8_15	13
--#define IRQ_DOVE_GPIO_16_23	14
--#define IRQ_DOVE_PCIE0_ERR	15
--#define IRQ_DOVE_PCIE0		16
--#define IRQ_DOVE_PCIE1_ERR	17
--#define IRQ_DOVE_PCIE1		18
--#define IRQ_DOVE_I2S0		19
--#define IRQ_DOVE_I2S0_ERR	20
--#define IRQ_DOVE_I2S1		21
--#define IRQ_DOVE_I2S1_ERR	22
--#define IRQ_DOVE_USB_ERR	23
--#define IRQ_DOVE_USB0		24
--#define IRQ_DOVE_USB1		25
--#define IRQ_DOVE_GE00_RX	26
--#define IRQ_DOVE_GE00_TX	27
--#define IRQ_DOVE_GE00_MISC	28
--#define IRQ_DOVE_GE00_SUM	29
--#define IRQ_DOVE_GE00_ERR	30
--#define IRQ_DOVE_CRYPTO		31
-+#define IRQ_DOVE_BRIDGE		(1 + 0)
-+#define IRQ_DOVE_H2C		(1 + 1)
-+#define IRQ_DOVE_C2H		(1 + 2)
-+#define IRQ_DOVE_NAND		(1 + 3)
-+#define IRQ_DOVE_PDMA		(1 + 4)
-+#define IRQ_DOVE_SPI1		(1 + 5)
-+#define IRQ_DOVE_SPI0		(1 + 6)
-+#define IRQ_DOVE_UART_0		(1 + 7)
-+#define IRQ_DOVE_UART_1		(1 + 8)
-+#define IRQ_DOVE_UART_2		(1 + 9)
-+#define IRQ_DOVE_UART_3		(1 + 10)
-+#define IRQ_DOVE_I2C		(1 + 11)
-+#define IRQ_DOVE_GPIO_0_7	(1 + 12)
-+#define IRQ_DOVE_GPIO_8_15	(1 + 13)
-+#define IRQ_DOVE_GPIO_16_23	(1 + 14)
-+#define IRQ_DOVE_PCIE0_ERR	(1 + 15)
-+#define IRQ_DOVE_PCIE0		(1 + 16)
-+#define IRQ_DOVE_PCIE1_ERR	(1 + 17)
-+#define IRQ_DOVE_PCIE1		(1 + 18)
-+#define IRQ_DOVE_I2S0		(1 + 19)
-+#define IRQ_DOVE_I2S0_ERR	(1 + 20)
-+#define IRQ_DOVE_I2S1		(1 + 21)
-+#define IRQ_DOVE_I2S1_ERR	(1 + 22)
-+#define IRQ_DOVE_USB_ERR	(1 + 23)
-+#define IRQ_DOVE_USB0		(1 + 24)
-+#define IRQ_DOVE_USB1		(1 + 25)
-+#define IRQ_DOVE_GE00_RX	(1 + 26)
-+#define IRQ_DOVE_GE00_TX	(1 + 27)
-+#define IRQ_DOVE_GE00_MISC	(1 + 28)
-+#define IRQ_DOVE_GE00_SUM	(1 + 29)
-+#define IRQ_DOVE_GE00_ERR	(1 + 30)
-+#define IRQ_DOVE_CRYPTO		(1 + 31)
- 
- /*
-  * Dove High Interrupt Controller
-  */
--#define IRQ_DOVE_AC97		32
--#define IRQ_DOVE_PMU		33
--#define IRQ_DOVE_CAM		34
--#define IRQ_DOVE_SDIO0		35
--#define IRQ_DOVE_SDIO1		36
--#define IRQ_DOVE_SDIO0_WAKEUP	37
--#define IRQ_DOVE_SDIO1_WAKEUP	38
--#define IRQ_DOVE_XOR_00		39
--#define IRQ_DOVE_XOR_01		40
--#define IRQ_DOVE_XOR0_ERR	41
--#define IRQ_DOVE_XOR_10		42
--#define IRQ_DOVE_XOR_11		43
--#define IRQ_DOVE_XOR1_ERR	44
--#define IRQ_DOVE_LCD_DCON	45
--#define IRQ_DOVE_LCD1		46
--#define IRQ_DOVE_LCD0		47
--#define IRQ_DOVE_GPU		48
--#define IRQ_DOVE_PERFORM_MNTR	49
--#define IRQ_DOVE_VPRO_DMA1	51
--#define IRQ_DOVE_SSP_TIMER	54
--#define IRQ_DOVE_SSP		55
--#define IRQ_DOVE_MC_L2_ERR	56
--#define IRQ_DOVE_CRYPTO_ERR	59
--#define IRQ_DOVE_GPIO_24_31	60
--#define IRQ_DOVE_HIGH_GPIO	61
--#define IRQ_DOVE_SATA		62
-+#define IRQ_DOVE_AC97		(1 + 32)
-+#define IRQ_DOVE_PMU		(1 + 33)
-+#define IRQ_DOVE_CAM		(1 + 34)
-+#define IRQ_DOVE_SDIO0		(1 + 35)
-+#define IRQ_DOVE_SDIO1		(1 + 36)
-+#define IRQ_DOVE_SDIO0_WAKEUP	(1 + 37)
-+#define IRQ_DOVE_SDIO1_WAKEUP	(1 + 38)
-+#define IRQ_DOVE_XOR_00		(1 + 39)
-+#define IRQ_DOVE_XOR_01		(1 + 40)
-+#define IRQ_DOVE_XOR0_ERR	(1 + 41)
-+#define IRQ_DOVE_XOR_10		(1 + 42)
-+#define IRQ_DOVE_XOR_11		(1 + 43)
-+#define IRQ_DOVE_XOR1_ERR	(1 + 44)
-+#define IRQ_DOVE_LCD_DCON	(1 + 45)
-+#define IRQ_DOVE_LCD1		(1 + 46)
-+#define IRQ_DOVE_LCD0		(1 + 47)
-+#define IRQ_DOVE_GPU		(1 + 48)
-+#define IRQ_DOVE_PERFORM_MNTR	(1 + 49)
-+#define IRQ_DOVE_VPRO_DMA1	(1 + 51)
-+#define IRQ_DOVE_SSP_TIMER	(1 + 54)
-+#define IRQ_DOVE_SSP		(1 + 55)
-+#define IRQ_DOVE_MC_L2_ERR	(1 + 56)
-+#define IRQ_DOVE_CRYPTO_ERR	(1 + 59)
-+#define IRQ_DOVE_GPIO_24_31	(1 + 60)
-+#define IRQ_DOVE_HIGH_GPIO	(1 + 61)
-+#define IRQ_DOVE_SATA		(1 + 62)
- 
- /*
-  * DOVE General Purpose Pins
-  */
--#define IRQ_DOVE_GPIO_START	64
-+#define IRQ_DOVE_GPIO_START	65
- #define NR_GPIO_IRQS		64
- 
- /*
-diff --git a/arch/arm/mach-dove/irq.c b/arch/arm/mach-dove/irq.c
-index 4a5a7ae..df0223f 100644
---- a/arch/arm/mach-dove/irq.c
-+++ b/arch/arm/mach-dove/irq.c
-@@ -126,14 +126,14 @@ __exception_irq_entry dove_legacy_handle_irq(struct pt_regs *regs)
- 	stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_LOW_OFF);
- 	stat &= readl_relaxed(dove_irq_base + IRQ_MASK_LOW_OFF);
- 	if (stat) {
--		unsigned int hwirq = __fls(stat);
-+		unsigned int hwirq = 1 + __fls(stat);
- 		handle_IRQ(hwirq, regs);
- 		return;
- 	}
- 	stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_HIGH_OFF);
- 	stat &= readl_relaxed(dove_irq_base + IRQ_MASK_HIGH_OFF);
- 	if (stat) {
--		unsigned int hwirq = 32 + __fls(stat);
-+		unsigned int hwirq = 33 + __fls(stat);
- 		handle_IRQ(hwirq, regs);
- 		return;
- 	}
-@@ -144,8 +144,8 @@ void __init dove_init_irq(void)
- {
- 	int i;
- 
--	orion_irq_init(0, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
--	orion_irq_init(32, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
-+	orion_irq_init(1, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-+	orion_irq_init(33, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
- 
- #ifdef CONFIG_MULTI_IRQ_HANDLER
- 	set_handle_irq(dove_legacy_handle_irq);
-diff --git a/arch/arm/vdso/vdsomunge.c b/arch/arm/vdso/vdsomunge.c
-index 9005b07..aedec81 100644
---- a/arch/arm/vdso/vdsomunge.c
-+++ b/arch/arm/vdso/vdsomunge.c
-@@ -45,13 +45,11 @@
-  * it does.
-  */
- 
--#define _GNU_SOURCE
--
- #include <byteswap.h>
- #include <elf.h>
- #include <errno.h>
--#include <error.h>
- #include <fcntl.h>
-+#include <stdarg.h>
- #include <stdbool.h>
- #include <stdio.h>
- #include <stdlib.h>
-@@ -82,11 +80,25 @@
- #define EF_ARM_ABI_FLOAT_HARD 0x400
- #endif
- 
-+static int failed;
-+static const char *argv0;
- static const char *outfile;
- 
-+static void fail(const char *fmt, ...)
-+{
-+	va_list ap;
-+
-+	failed = 1;
-+	fprintf(stderr, "%s: ", argv0);
-+	va_start(ap, fmt);
-+	vfprintf(stderr, fmt, ap);
-+	va_end(ap);
-+	exit(EXIT_FAILURE);
-+}
-+
- static void cleanup(void)
- {
--	if (error_message_count > 0 && outfile != NULL)
-+	if (failed && outfile != NULL)
- 		unlink(outfile);
- }
- 
-@@ -119,68 +131,66 @@ int main(int argc, char **argv)
- 	int infd;
- 
- 	atexit(cleanup);
-+	argv0 = argv[0];
- 
- 	if (argc != 3)
--		error(EXIT_FAILURE, 0, "Usage: %s [infile] [outfile]", argv[0]);
-+		fail("Usage: %s [infile] [outfile]\n", argv[0]);
- 
- 	infile = argv[1];
- 	outfile = argv[2];
- 
- 	infd = open(infile, O_RDONLY);
- 	if (infd < 0)
--		error(EXIT_FAILURE, errno, "Cannot open %s", infile);
-+		fail("Cannot open %s: %s\n", infile, strerror(errno));
- 
- 	if (fstat(infd, &stat) != 0)
--		error(EXIT_FAILURE, errno, "Failed stat for %s", infile);
-+		fail("Failed stat for %s: %s\n", infile, strerror(errno));
- 
- 	inbuf = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, infd, 0);
- 	if (inbuf == MAP_FAILED)
--		error(EXIT_FAILURE, errno, "Failed to map %s", infile);
-+		fail("Failed to map %s: %s\n", infile, strerror(errno));
- 
- 	close(infd);
- 
- 	inhdr = inbuf;
- 
- 	if (memcmp(&inhdr->e_ident, ELFMAG, SELFMAG) != 0)
--		error(EXIT_FAILURE, 0, "Not an ELF file");
-+		fail("Not an ELF file\n");
- 
- 	if (inhdr->e_ident[EI_CLASS] != ELFCLASS32)
--		error(EXIT_FAILURE, 0, "Unsupported ELF class");
-+		fail("Unsupported ELF class\n");
- 
- 	swap = inhdr->e_ident[EI_DATA] != HOST_ORDER;
- 
- 	if (read_elf_half(inhdr->e_type, swap) != ET_DYN)
--		error(EXIT_FAILURE, 0, "Not a shared object");
-+		fail("Not a shared object\n");
- 
--	if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) {
--		error(EXIT_FAILURE, 0, "Unsupported architecture %#x",
--		      inhdr->e_machine);
--	}
-+	if (read_elf_half(inhdr->e_machine, swap) != EM_ARM)
-+		fail("Unsupported architecture %#x\n", inhdr->e_machine);
- 
- 	e_flags = read_elf_word(inhdr->e_flags, swap);
- 
- 	if (EF_ARM_EABI_VERSION(e_flags) != EF_ARM_EABI_VER5) {
--		error(EXIT_FAILURE, 0, "Unsupported EABI version %#x",
--		      EF_ARM_EABI_VERSION(e_flags));
-+		fail("Unsupported EABI version %#x\n",
-+		     EF_ARM_EABI_VERSION(e_flags));
- 	}
- 
- 	if (e_flags & EF_ARM_ABI_FLOAT_HARD)
--		error(EXIT_FAILURE, 0,
--		      "Unexpected hard-float flag set in e_flags");
-+		fail("Unexpected hard-float flag set in e_flags\n");
- 
- 	clear_soft_float = !!(e_flags & EF_ARM_ABI_FLOAT_SOFT);
- 
- 	outfd = open(outfile, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
- 	if (outfd < 0)
--		error(EXIT_FAILURE, errno, "Cannot open %s", outfile);
-+		fail("Cannot open %s: %s\n", outfile, strerror(errno));
- 
- 	if (ftruncate(outfd, stat.st_size) != 0)
--		error(EXIT_FAILURE, errno, "Cannot truncate %s", outfile);
-+		fail("Cannot truncate %s: %s\n", outfile, strerror(errno));
- 
- 	outbuf = mmap(NULL, stat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
- 		      outfd, 0);
- 	if (outbuf == MAP_FAILED)
--		error(EXIT_FAILURE, errno, "Failed to map %s", outfile);
-+		fail("Failed to map %s: %s\n", outfile, strerror(errno));
- 
- 	close(outfd);
- 
-@@ -195,7 +205,7 @@ int main(int argc, char **argv)
- 	}
- 
- 	if (msync(outbuf, stat.st_size, MS_SYNC) != 0)
--		error(EXIT_FAILURE, errno, "Failed to sync %s", outfile);
-+		fail("Failed to sync %s: %s\n", outfile, strerror(errno));
- 
- 	return EXIT_SUCCESS;
- }
-diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
-index 2cb0081..d3a202b 100644
---- a/arch/arm64/kernel/smp.c
-+++ b/arch/arm64/kernel/smp.c
-@@ -569,7 +569,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	struct pt_regs *old_regs = set_irq_regs(regs);
- 
- 	if ((unsigned)ipinr < NR_IPI) {
--		trace_ipi_entry(ipi_types[ipinr]);
-+		trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- 		__inc_irq_stat(cpu, ipi_irqs[ipinr]);
- 	}
- 
-@@ -612,7 +612,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- 	}
- 
- 	if ((unsigned)ipinr < NR_IPI)
--		trace_ipi_exit(ipi_types[ipinr]);
-+		trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- 	set_irq_regs(old_regs);
- }
- 
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 2de9d2e..0eeb4f09 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
- 
- int pmd_huge(pmd_t pmd)
- {
--	return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+	return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
- 
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
--	return !(pud_val(pud) & PUD_TABLE_BIT);
-+	return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- 	return 0;
- #endif
-diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
-index de0a81a..98a26ce 100644
---- a/arch/arm64/net/bpf_jit.h
-+++ b/arch/arm64/net/bpf_jit.h
-@@ -110,6 +110,10 @@
- /* Rd = Rn >> shift; signed */
- #define A64_ASR(sf, Rd, Rn, shift) A64_SBFM(sf, Rd, Rn, shift, (sf) ? 63 : 31)
- 
-+/* Zero extend */
-+#define A64_UXTH(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 15)
-+#define A64_UXTW(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 31)
-+
- /* Move wide (immediate) */
- #define A64_MOVEW(sf, Rd, imm16, shift, type) \
- 	aarch64_insn_gen_movewide(Rd, imm16, shift, \
-diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
-index dc6a484..c047598 100644
---- a/arch/arm64/net/bpf_jit_comp.c
-+++ b/arch/arm64/net/bpf_jit_comp.c
-@@ -113,9 +113,9 @@ static inline void emit_a64_mov_i(const int is64, const int reg,
- static inline int bpf2a64_offset(int bpf_to, int bpf_from,
- 				 const struct jit_ctx *ctx)
- {
--	int to = ctx->offset[bpf_to + 1];
-+	int to = ctx->offset[bpf_to];
- 	/* -1 to account for the Branch instruction */
--	int from = ctx->offset[bpf_from + 1] - 1;
-+	int from = ctx->offset[bpf_from] - 1;
- 
- 	return to - from;
- }
-@@ -289,23 +289,41 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
- 	case BPF_ALU | BPF_END | BPF_FROM_BE:
- #ifdef CONFIG_CPU_BIG_ENDIAN
- 		if (BPF_SRC(code) == BPF_FROM_BE)
--			break;
-+			goto emit_bswap_uxt;
- #else /* !CONFIG_CPU_BIG_ENDIAN */
- 		if (BPF_SRC(code) == BPF_FROM_LE)
--			break;
-+			goto emit_bswap_uxt;
- #endif
- 		switch (imm) {
- 		case 16:
- 			emit(A64_REV16(is64, dst, dst), ctx);
-+			/* zero-extend 16 bits into 64 bits */
-+			emit(A64_UXTH(is64, dst, dst), ctx);
- 			break;
- 		case 32:
- 			emit(A64_REV32(is64, dst, dst), ctx);
-+			/* upper 32 bits already cleared */
- 			break;
- 		case 64:
- 			emit(A64_REV64(dst, dst), ctx);
- 			break;
- 		}
- 		break;
-+emit_bswap_uxt:
-+		switch (imm) {
-+		case 16:
-+			/* zero-extend 16 bits into 64 bits */
-+			emit(A64_UXTH(is64, dst, dst), ctx);
-+			break;
-+		case 32:
-+			/* zero-extend 32 bits into 64 bits */
-+			emit(A64_UXTW(is64, dst, dst), ctx);
-+			break;
-+		case 64:
-+			/* nop */
-+			break;
-+		}
-+		break;
- 	/* dst = imm */
- 	case BPF_ALU | BPF_MOV | BPF_K:
- 	case BPF_ALU64 | BPF_MOV | BPF_K:
-@@ -640,10 +658,11 @@ static int build_body(struct jit_ctx *ctx)
- 		const struct bpf_insn *insn = &prog->insnsi[i];
- 		int ret;
- 
-+		ret = build_insn(insn, ctx);
-+
- 		if (ctx->image == NULL)
- 			ctx->offset[i] = ctx->idx;
- 
--		ret = build_insn(insn, ctx);
- 		if (ret > 0) {
- 			i++;
- 			continue;
-diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
-index 33013df..5c68c85 100644
---- a/arch/m68k/Kconfig.cpu
-+++ b/arch/m68k/Kconfig.cpu
-@@ -125,6 +125,13 @@ endif # M68KCLASSIC
- 
- if COLDFIRE
- 
-+choice
-+	prompt "ColdFire SoC type"
-+	default M520x
-+	help
-+	  Select the type of ColdFire System-on-Chip (SoC) that you want
-+	  to build for.
-+
- config M5206
- 	bool "MCF5206"
- 	depends on !MMU
-@@ -174,9 +181,6 @@ config M525x
- 	help
- 	  Freescale (Motorola) Coldfire 5251/5253 processor support.
- 
--config M527x
--	bool
--
- config M5271
- 	bool "MCF5271"
- 	depends on !MMU
-@@ -223,9 +227,6 @@ config M5307
- 	help
- 	  Motorola ColdFire 5307 processor support.
- 
--config M53xx
--	bool
--
- config M532x
- 	bool "MCF532x"
- 	depends on !MMU
-@@ -251,9 +252,6 @@ config M5407
- 	help
- 	  Motorola ColdFire 5407 processor support.
- 
--config M54xx
--	bool
--
- config M547x
- 	bool "MCF547x"
- 	select M54xx
-@@ -280,6 +278,17 @@ config M5441x
- 	help
- 	  Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
- 
-+endchoice
-+
-+config M527x
-+	bool
-+
-+config M53xx
-+	bool
-+
-+config M54xx
-+	bool
-+
- endif # COLDFIRE
- 
- 
-@@ -416,22 +425,10 @@ config HAVE_MBAR
- config HAVE_IPSBAR
- 	bool
- 
--config CLOCK_SET
--	bool "Enable setting the CPU clock frequency"
--	depends on COLDFIRE
--	default n
--	help
--	  On some CPU's you do not need to know what the core CPU clock
--	  frequency is. On these you can disable clock setting. On some
--	  traditional 68K parts, and on all ColdFire parts you need to set
--	  the appropriate CPU clock frequency. On these devices many of the
--	  onboard peripherals derive their timing from the master CPU clock
--	  frequency.
--
- config CLOCK_FREQ
- 	int "Set the core clock frequency"
- 	default "66666666"
--	depends on CLOCK_SET
-+	depends on COLDFIRE
- 	help
- 	  Define the CPU clock frequency in use. This is the core clock
- 	  frequency, it may or may not be the same as the external clock
-diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h
-index c94557b..50aa4da 100644
---- a/arch/m68k/include/asm/coldfire.h
-+++ b/arch/m68k/include/asm/coldfire.h
-@@ -19,7 +19,7 @@
-  *	in any case new boards come along from time to time that have yet
-  *	another different clocking frequency.
-  */
--#ifdef CONFIG_CLOCK_SET
-+#ifdef CONFIG_CLOCK_FREQ
- #define	MCF_CLK		CONFIG_CLOCK_FREQ
- #else
- #error "Don't know what your ColdFire CPU clock frequency is??"
-diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
-index e5a693b..443f44d 100644
---- a/arch/openrisc/Kconfig
-+++ b/arch/openrisc/Kconfig
-@@ -17,6 +17,7 @@ config OPENRISC
- 	select GENERIC_IRQ_SHOW
- 	select GENERIC_IOMAP
- 	select GENERIC_CPU_DEVICES
-+	select HAVE_UID16
- 	select GENERIC_ATOMIC64
- 	select GENERIC_CLOCKEVENTS
- 	select GENERIC_STRNCPY_FROM_USER
-@@ -31,9 +32,6 @@ config MMU
- config HAVE_DMA_ATTRS
- 	def_bool y
- 
--config UID16
--	def_bool y
--
- config RWSEM_GENERIC_SPINLOCK
- 	def_bool y
- 
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 9d518d6..844b06d 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- 	}
- }
-+
-+const char *arch_vma_name(struct vm_area_struct *vma)
-+{
-+	if (vma->vm_flags & VM_MPX)
-+		return "[mpx]";
-+	return NULL;
-+}
-diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
-index c439ec4..4d1c11c 100644
---- a/arch/x86/mm/mpx.c
-+++ b/arch/x86/mm/mpx.c
-@@ -18,26 +18,9 @@
- #include <asm/processor.h>
- #include <asm/fpu-internal.h>
- 
--static const char *mpx_mapping_name(struct vm_area_struct *vma)
--{
--	return "[mpx]";
--}
--
--static struct vm_operations_struct mpx_vma_ops = {
--	.name = mpx_mapping_name,
--};
--
--static int is_mpx_vma(struct vm_area_struct *vma)
--{
--	return (vma->vm_ops == &mpx_vma_ops);
--}
--
- /*
-  * This is really a simplified "vm_mmap". it only handles MPX
-  * bounds tables (the bounds directory is user-allocated).
-- *
-- * Later on, we use the vma->vm_ops to uniquely identify these
-- * VMAs.
-  */
- static unsigned long mpx_mmap(unsigned long len)
- {
-@@ -83,7 +66,6 @@ static unsigned long mpx_mmap(unsigned long len)
- 		ret = -ENOMEM;
- 		goto out;
- 	}
--	vma->vm_ops = &mpx_vma_ops;
- 
- 	if (vm_flags & VM_LOCKED) {
- 		up_write(&mm->mmap_sem);
-@@ -661,7 +643,7 @@ static int zap_bt_entries(struct mm_struct *mm,
- 		 * so stop immediately and return an error.  This
- 		 * probably results in a SIGSEGV.
- 		 */
--		if (!is_mpx_vma(vma))
-+		if (!(vma->vm_flags & VM_MPX))
- 			return -EINVAL;
- 
- 		len = min(vma->vm_end, end) - addr;
-diff --git a/block/bio.c b/block/bio.c
-index f66a4ea..4441522 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -1814,8 +1814,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
-  * Allocates and returns a new bio which represents @sectors from the start of
-  * @bio, and updates @bio to represent the remaining sectors.
-  *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
-  */
- struct bio *bio_split(struct bio *bio, int sectors,
- 		      gfp_t gfp, struct bio_set *bs)
-@@ -1825,7 +1826,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- 	BUG_ON(sectors <= 0);
- 	BUG_ON(sectors >= bio_sectors(bio));
- 
--	split = bio_clone_fast(bio, gfp, bs);
-+	/*
-+	 * Discards need a mutable bio_vec to accommodate the payload
-+	 * required by the DSM TRIM and UNMAP commands.
-+	 */
-+	if (bio->bi_rw & REQ_DISCARD)
-+		split = bio_clone_bioset(bio, gfp, bs);
-+	else
-+		split = bio_clone_fast(bio, gfp, bs);
-+
- 	if (!split)
- 		return NULL;
- 
-diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
-index f973308..3f5b537 100644
---- a/crypto/asymmetric_keys/asymmetric_keys.h
-+++ b/crypto/asymmetric_keys/asymmetric_keys.h
-@@ -11,6 +11,9 @@
- 
- extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
- 
-+extern int __asymmetric_key_hex_to_key_id(const char *id,
-+					  struct asymmetric_key_id *match_id,
-+					  size_t hexlen);
- static inline
- const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
- {
-diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
-index bcbbbd7..b0e4ed2 100644
---- a/crypto/asymmetric_keys/asymmetric_type.c
-+++ b/crypto/asymmetric_keys/asymmetric_type.c
-@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids(
- 	return false;
- }
- 
-+/* helper function can be called directly with pre-allocated memory */
-+inline int __asymmetric_key_hex_to_key_id(const char *id,
-+				   struct asymmetric_key_id *match_id,
-+				   size_t hexlen)
-+{
-+	match_id->len = hexlen;
-+	return hex2bin(match_id->data, id, hexlen);
-+}
-+
- /**
-  * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
-  * @id: The ID as a hex string.
-@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids(
- struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
- {
- 	struct asymmetric_key_id *match_id;
--	size_t hexlen;
-+	size_t asciihexlen;
- 	int ret;
- 
- 	if (!*id)
- 		return ERR_PTR(-EINVAL);
--	hexlen = strlen(id);
--	if (hexlen & 1)
-+	asciihexlen = strlen(id);
-+	if (asciihexlen & 1)
- 		return ERR_PTR(-EINVAL);
- 
--	match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
-+	match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
- 			   GFP_KERNEL);
- 	if (!match_id)
- 		return ERR_PTR(-ENOMEM);
--	match_id->len = hexlen / 2;
--	ret = hex2bin(match_id->data, id, hexlen / 2);
-+	ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
- 	if (ret < 0) {
- 		kfree(match_id);
- 		return ERR_PTR(-EINVAL);
-diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
-index a6c4203..24f17e6 100644
---- a/crypto/asymmetric_keys/x509_public_key.c
-+++ b/crypto/asymmetric_keys/x509_public_key.c
-@@ -28,17 +28,30 @@ static bool use_builtin_keys;
- static struct asymmetric_key_id *ca_keyid;
- 
- #ifndef MODULE
-+static struct {
-+	struct asymmetric_key_id id;
-+	unsigned char data[10];
-+} cakey;
-+
- static int __init ca_keys_setup(char *str)
- {
- 	if (!str)		/* default system keyring */
- 		return 1;
- 
- 	if (strncmp(str, "id:", 3) == 0) {
--		struct asymmetric_key_id *p;
--		p = asymmetric_key_hex_to_key_id(str + 3);
--		if (p == ERR_PTR(-EINVAL))
--			pr_err("Unparsable hex string in ca_keys\n");
--		else if (!IS_ERR(p))
-+		struct asymmetric_key_id *p = &cakey.id;
-+		size_t hexlen = (strlen(str) - 3) / 2;
-+		int ret;
-+
-+		if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
-+			pr_err("Missing or invalid ca_keys id\n");
-+			return 1;
-+		}
-+
-+		ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
-+		if (ret < 0)
-+			pr_err("Unparsable ca_keys id hex string\n");
-+		else
- 			ca_keyid = p;	/* owner key 'id:xxxxxx' */
- 	} else if (strcmp(str, "builtin") == 0) {
- 		use_builtin_keys = true;
-diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
-index 37fb190..73f056a 100644
---- a/drivers/acpi/acpi_lpss.c
-+++ b/drivers/acpi/acpi_lpss.c
-@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
- 				pdata->mmio_size = resource_size(rentry->res);
- 			pdata->mmio_base = ioremap(rentry->res->start,
- 						   pdata->mmio_size);
--			if (!pdata->mmio_base)
--				goto err_out;
- 			break;
- 		}
- 
- 	acpi_dev_free_resource_list(&resource_list);
- 
-+	if (!pdata->mmio_base) {
-+		ret = -ENOMEM;
-+		goto err_out;
-+	}
-+
- 	pdata->dev_desc = dev_desc;
- 
- 	if (dev_desc->setup)
-diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
-index 87b2752..7f50dd9 100644
---- a/drivers/acpi/acpica/aclocal.h
-+++ b/drivers/acpi/acpica/aclocal.h
-@@ -213,6 +213,7 @@ struct acpi_table_list {
- 
- #define ACPI_TABLE_INDEX_DSDT           (0)
- #define ACPI_TABLE_INDEX_FACS           (1)
-+#define ACPI_TABLE_INDEX_X_FACS         (2)
- 
- struct acpi_find_context {
- 	char *search_for;
-diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
-index 7d24860..05be59c 100644
---- a/drivers/acpi/acpica/tbfadt.c
-+++ b/drivers/acpi/acpica/tbfadt.c
-@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
- 	/* If Hardware Reduced flag is set, there is no FACS */
- 
- 	if (!acpi_gbl_reduced_hardware) {
--		acpi_tb_install_fixed_table((acpi_physical_address)
--					    acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
--					    ACPI_TABLE_INDEX_FACS);
-+		if (acpi_gbl_FADT.facs) {
-+			acpi_tb_install_fixed_table((acpi_physical_address)
-+						    acpi_gbl_FADT.facs,
-+						    ACPI_SIG_FACS,
-+						    ACPI_TABLE_INDEX_FACS);
-+		}
-+		if (acpi_gbl_FADT.Xfacs) {
-+			acpi_tb_install_fixed_table((acpi_physical_address)
-+						    acpi_gbl_FADT.Xfacs,
-+						    ACPI_SIG_FACS,
-+						    ACPI_TABLE_INDEX_X_FACS);
-+		}
- 	}
- }
- 
-@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
- 	acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
- 
- 	/*
--	 * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
-+	 * Expand the 32-bit DSDT addresses to 64-bit as necessary.
- 	 * Later ACPICA code will always use the X 64-bit field.
- 	 */
--	acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
--						     acpi_gbl_FADT.facs,
--						     acpi_gbl_FADT.Xfacs);
--
- 	acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
- 						     acpi_gbl_FADT.dsdt,
- 						     acpi_gbl_FADT.Xdsdt);
-diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
-index 6559a58..2fb1afa 100644
---- a/drivers/acpi/acpica/tbutils.c
-+++ b/drivers/acpi/acpica/tbutils.c
-@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
- 
- acpi_status acpi_tb_initialize_facs(void)
- {
--	acpi_status status;
-+	struct acpi_table_facs *facs32;
-+	struct acpi_table_facs *facs64;
- 
- 	/* If Hardware Reduced flag is set, there is no FACS */
- 
-@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void)
- 		return (AE_OK);
- 	}
- 
--	status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
--					 ACPI_CAST_INDIRECT_PTR(struct
--								acpi_table_header,
--								&acpi_gbl_FACS));
--	return (status);
-+	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-+				      ACPI_CAST_INDIRECT_PTR(struct
-+							     acpi_table_header,
-+							     &facs32));
-+	(void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
-+				      ACPI_CAST_INDIRECT_PTR(struct
-+							     acpi_table_header,
-+							     &facs64));
-+
-+	if (acpi_gbl_use32_bit_facs_addresses) {
-+		acpi_gbl_FACS = facs32 ? facs32 : facs64;
-+	} else {
-+		acpi_gbl_FACS = facs64 ? facs64 : facs32;
-+	}
-+
-+	return (AE_OK);
- }
- #endif				/* !ACPI_REDUCED_HARDWARE */
- 
-@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void)
- u8 acpi_tb_tables_loaded(void)
- {
- 
--	if (acpi_gbl_root_table_list.current_table_count >= 3) {
-+	if (acpi_gbl_root_table_list.current_table_count >= 4) {
- 		return (TRUE);
- 	}
- 
-@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
- 	table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
- 
- 	/*
--	 * First two entries in the table array are reserved for the DSDT
--	 * and FACS, which are not actually present in the RSDT/XSDT - they
--	 * come from the FADT
-+	 * First three entries in the table array are reserved for the DSDT
-+	 * and 32bit/64bit FACS, which are not actually present in the
-+	 * RSDT/XSDT - they come from the FADT
- 	 */
--	acpi_gbl_root_table_list.current_table_count = 2;
-+	acpi_gbl_root_table_list.current_table_count = 3;
- 
- 	/* Initialize the root table array from the RSDT/XSDT */
- 
-diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
-index aadb300..b63e35d 100644
---- a/drivers/acpi/acpica/tbxfload.c
-+++ b/drivers/acpi/acpica/tbxfload.c
-@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespace(void)
- 
- 	(void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
- 	for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
--		if ((!ACPI_COMPARE_NAME
-+		if (!acpi_gbl_root_table_list.tables[i].address ||
-+		    (!ACPI_COMPARE_NAME
- 		     (&(acpi_gbl_root_table_list.tables[i].signature),
- 		      ACPI_SIG_SSDT)
- 		     &&
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 083a768..42a32a6 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -179,10 +179,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- 	 * Obtain a permanent mapping for the FACS. This is required for the
- 	 * Global Lock and the Firmware Waking Vector
- 	 */
--	status = acpi_tb_initialize_facs();
--	if (ACPI_FAILURE(status)) {
--		ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
--		return_ACPI_STATUS(status);
-+	if (!(flags & ACPI_NO_FACS_INIT)) {
-+		status = acpi_tb_initialize_facs();
-+		if (ACPI_FAILURE(status)) {
-+			ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+			return_ACPI_STATUS(status);
-+		}
- 	}
- #endif				/* !ACPI_REDUCED_HARDWARE */
- 
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 5226a8b..98f5316 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -175,10 +175,14 @@ static void __init acpi_request_region (struct acpi_generic_address *gas,
- 	if (!addr || !length)
- 		return;
- 
--	acpi_reserve_region(addr, length, gas->space_id, 0, desc);
-+	/* Resources are never freed */
-+	if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO)
-+		request_region(addr, length, desc);
-+	else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
-+		request_mem_region(addr, length, desc);
- }
- 
--static void __init acpi_reserve_resources(void)
-+static int __init acpi_reserve_resources(void)
- {
- 	acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
- 		"ACPI PM1a_EVT_BLK");
-@@ -207,7 +211,10 @@ static void __init acpi_reserve_resources(void)
- 	if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
- 		acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
- 			       acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
-+
-+	return 0;
- }
-+fs_initcall_sync(acpi_reserve_resources);
- 
- void acpi_os_printf(const char *fmt, ...)
- {
-@@ -1838,7 +1845,6 @@ acpi_status __init acpi_os_initialize(void)
- 
- acpi_status __init acpi_os_initialize1(void)
- {
--	acpi_reserve_resources();
- 	kacpid_wq = alloc_workqueue("kacpid", 0, 1);
- 	kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
- 	kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
-diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
-index fcb7807..f1c966e 100644
---- a/drivers/acpi/resource.c
-+++ b/drivers/acpi/resource.c
-@@ -26,7 +26,6 @@
- #include <linux/device.h>
- #include <linux/export.h>
- #include <linux/ioport.h>
--#include <linux/list.h>
- #include <linux/slab.h>
- 
- #ifdef CONFIG_X86
-@@ -194,6 +193,7 @@ static bool acpi_decode_space(struct resource_win *win,
- 	u8 iodec = attr->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16;
- 	bool wp = addr->info.mem.write_protect;
- 	u64 len = attr->address_length;
-+	u64 start, end, offset = 0;
- 	struct resource *res = &win->res;
- 
- 	/*
-@@ -205,9 +205,6 @@ static bool acpi_decode_space(struct resource_win *win,
- 		pr_debug("ACPI: Invalid address space min_addr_fix %d, max_addr_fix %d, len %llx\n",
- 			 addr->min_address_fixed, addr->max_address_fixed, len);
- 
--	res->start = attr->minimum;
--	res->end = attr->maximum;
--
- 	/*
- 	 * For bridges that translate addresses across the bridge,
- 	 * translation_offset is the offset that must be added to the
-@@ -215,12 +212,22 @@ static bool acpi_decode_space(struct resource_win *win,
- 	 * primary side. Non-bridge devices must list 0 for all Address
- 	 * Translation offset bits.
- 	 */
--	if (addr->producer_consumer == ACPI_PRODUCER) {
--		res->start += attr->translation_offset;
--		res->end += attr->translation_offset;
--	} else if (attr->translation_offset) {
-+	if (addr->producer_consumer == ACPI_PRODUCER)
-+		offset = attr->translation_offset;
-+	else if (attr->translation_offset)
- 		pr_debug("ACPI: translation_offset(%lld) is invalid for non-bridge device.\n",
- 			 attr->translation_offset);
-+	start = attr->minimum + offset;
-+	end = attr->maximum + offset;
-+
-+	win->offset = offset;
-+	res->start = start;
-+	res->end = end;
-+	if (sizeof(resource_size_t) < sizeof(u64) &&
-+	    (offset != win->offset || start != res->start || end != res->end)) {
-+		pr_warn("acpi resource window ([%#llx-%#llx] ignored, not CPU addressable)\n",
-+			attr->minimum, attr->maximum);
-+		return false;
- 	}
- 
- 	switch (addr->resource_type) {
-@@ -237,8 +244,6 @@ static bool acpi_decode_space(struct resource_win *win,
- 		return false;
- 	}
- 
--	win->offset = attr->translation_offset;
--
- 	if (addr->producer_consumer == ACPI_PRODUCER)
- 		res->flags |= IORESOURCE_WINDOW;
- 
-@@ -622,162 +627,3 @@ int acpi_dev_filter_resource_type(struct acpi_resource *ares,
- 	return (type & types) ? 0 : 1;
- }
- EXPORT_SYMBOL_GPL(acpi_dev_filter_resource_type);
--
--struct reserved_region {
--	struct list_head node;
--	u64 start;
--	u64 end;
--};
--
--static LIST_HEAD(reserved_io_regions);
--static LIST_HEAD(reserved_mem_regions);
--
--static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags,
--			 char *desc)
--{
--	unsigned int length = end - start + 1;
--	struct resource *res;
--
--	res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ?
--		request_region(start, length, desc) :
--		request_mem_region(start, length, desc);
--	if (!res)
--		return -EIO;
--
--	res->flags &= ~flags;
--	return 0;
--}
--
--static int add_region_before(u64 start, u64 end, u8 space_id,
--			     unsigned long flags, char *desc,
--			     struct list_head *head)
--{
--	struct reserved_region *reg;
--	int error;
--
--	reg = kmalloc(sizeof(*reg), GFP_KERNEL);
--	if (!reg)
--		return -ENOMEM;
--
--	error = request_range(start, end, space_id, flags, desc);
--	if (error)
--		return error;
--
--	reg->start = start;
--	reg->end = end;
--	list_add_tail(&reg->node, head);
--	return 0;
--}
--
--/**
-- * acpi_reserve_region - Reserve an I/O or memory region as a system resource.
-- * @start: Starting address of the region.
-- * @length: Length of the region.
-- * @space_id: Identifier of address space to reserve the region from.
-- * @flags: Resource flags to clear for the region after requesting it.
-- * @desc: Region description (for messages).
-- *
-- * Reserve an I/O or memory region as a system resource to prevent others from
-- * using it.  If the new region overlaps with one of the regions (in the given
-- * address space) already reserved by this routine, only the non-overlapping
-- * parts of it will be reserved.
-- *
-- * Returned is either 0 (success) or a negative error code indicating a resource
-- * reservation problem.  It is the code of the first encountered error, but the
-- * routine doesn't abort until it has attempted to request all of the parts of
-- * the new region that don't overlap with other regions reserved previously.
-- *
-- * The resources requested by this routine are never released.
-- */
--int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
--			unsigned long flags, char *desc)
--{
--	struct list_head *regions;
--	struct reserved_region *reg;
--	u64 end = start + length - 1;
--	int ret = 0, error = 0;
--
--	if (space_id == ACPI_ADR_SPACE_SYSTEM_IO)
--		regions = &reserved_io_regions;
--	else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
--		regions = &reserved_mem_regions;
--	else
--		return -EINVAL;
--
--	if (list_empty(regions))
--		return add_region_before(start, end, space_id, flags, desc, regions);
--
--	list_for_each_entry(reg, regions, node)
--		if (reg->start == end + 1) {
--			/* The new region can be prepended to this one. */
--			ret = request_range(start, end, space_id, flags, desc);
--			if (!ret)
--				reg->start = start;
--
--			return ret;
--		} else if (reg->start > end) {
--			/* No overlap.  Add the new region here and get out. */
--			return add_region_before(start, end, space_id, flags,
--						 desc, &reg->node);
--		} else if (reg->end == start - 1) {
--			goto combine;
--		} else if (reg->end >= start) {
--			goto overlap;
--		}
--
--	/* The new region goes after the last existing one. */
--	return add_region_before(start, end, space_id, flags, desc, regions);
--
-- overlap:
--	/*
--	 * The new region overlaps an existing one.
--	 *
--	 * The head part of the new region immediately preceding the existing
--	 * overlapping one can be combined with it right away.
--	 */
--	if (reg->start > start) {
--		error = request_range(start, reg->start - 1, space_id, flags, desc);
--		if (error)
--			ret = error;
--		else
--			reg->start = start;
--	}
--
-- combine:
--	/*
--	 * The new region is adjacent to an existing one.  If it extends beyond
--	 * that region all the way to the next one, it is possible to combine
--	 * all three of them.
--	 */
--	while (reg->end < end) {
--		struct reserved_region *next = NULL;
--		u64 a = reg->end + 1, b = end;
--
--		if (!list_is_last(&reg->node, regions)) {
--			next = list_next_entry(reg, node);
--			if (next->start <= end)
--				b = next->start - 1;
--		}
--		error = request_range(a, b, space_id, flags, desc);
--		if (!error) {
--			if (next && next->start == b + 1) {
--				reg->end = next->end;
--				list_del(&next->node);
--				kfree(next);
--			} else {
--				reg->end = end;
--				break;
--			}
--		} else if (next) {
--			if (!ret)
--				ret = error;
--
--			reg = next;
--		} else {
--			break;
--		}
--	}
--
--	return ret ? ret : error;
--}
--EXPORT_SYMBOL_GPL(acpi_reserve_region);
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 577849c..41c99be 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device *dev)
- 		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
- 					 dev->max_sectors);
- 
-+	if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024)
-+		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024,
-+					 dev->max_sectors);
-+
- 	if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
- 		dev->max_sectors = ATA_MAX_SECTORS_LBA48;
- 
-@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
- 	{ "Slimtype DVD A  DS8A9SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
- 
-+	/*
-+	 * Causes silent data corruption with higher max sects.
-+	 * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com
-+	 */
-+	{ "ST380013AS",		"3.20",		ATA_HORKAGE_MAX_SEC_1024 },
-+
- 	/* Devices we expect to fail diagnostics */
- 
- 	/* Devices where NCQ should be avoided */
-@@ -4174,9 +4184,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "ST3320[68]13AS",	"SD1[5-9]",	ATA_HORKAGE_NONCQ |
- 						ATA_HORKAGE_FIRMWARE_WARN },
- 
--	/* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
-+	/* drives which fail FPDMA_AA activation (some may freeze afterwards) */
- 	{ "ST1000LM024 HN-M101MBB", "2AR10001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
- 	{ "ST1000LM024 HN-M101MBB", "2BA30001",	ATA_HORKAGE_BROKEN_FPDMA_AA },
-+	{ "VB0250EAVER",	"HPG7",		ATA_HORKAGE_BROKEN_FPDMA_AA },
- 
- 	/* Blacklist entries taken from Silicon Image 3124/3132
- 	   Windows driver .inf file - also several Linux problem reports */
-@@ -4225,11 +4236,11 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "PIONEER DVD-RW  DVR-216D",	NULL,	ATA_HORKAGE_NOSETXFER },
- 
- 	/* devices that don't properly handle queued TRIM commands */
--	{ "Micron_M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
-+	{ "Micron_M500_*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
- 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
- 	{ "Crucial_CT*M500*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
- 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
--	{ "Micron_M5[15]0*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
-+	{ "Micron_M5[15]0_*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
- 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
- 	{ "Crucial_CT*M550*",		"MU01",	ATA_HORKAGE_NO_NCQ_TRIM |
- 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
-@@ -4238,6 +4249,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	{ "Samsung SSD 8*",		NULL,	ATA_HORKAGE_NO_NCQ_TRIM |
- 						ATA_HORKAGE_ZERO_AFTER_TRIM, },
- 
-+	/* devices that don't properly handle TRIM commands */
-+	{ "SuperSSpeed S238*",		NULL,	ATA_HORKAGE_NOTRIM, },
-+
- 	/*
- 	 * As defined, the DRAT (Deterministic Read After Trim) and RZAT
- 	 * (Return Zero After Trim) flags in the ATA Command Set are
-@@ -4501,7 +4515,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
- 	else /* In the ancient relic department - skip all of this */
- 		return 0;
- 
--	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
-+	/* On some disks, this command causes spin-up, so we need longer timeout */
-+	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
- 
- 	DPRINTK("EXIT, err_mask=%x\n", err_mask);
- 	return err_mask;
-diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
-index cf0022e..7465031 100644
---- a/drivers/ata/libata-eh.c
-+++ b/drivers/ata/libata-eh.c
-@@ -1507,16 +1507,21 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
- {
- 	struct ata_taskfile tf;
- 	unsigned int err_mask;
-+	bool dma = false;
- 
- 	DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page);
- 
-+retry:
- 	ata_tf_init(dev, &tf);
--	if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id)) {
-+	if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
-+	    !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) {
- 		tf.command = ATA_CMD_READ_LOG_DMA_EXT;
- 		tf.protocol = ATA_PROT_DMA;
-+		dma = true;
- 	} else {
- 		tf.command = ATA_CMD_READ_LOG_EXT;
- 		tf.protocol = ATA_PROT_PIO;
-+		dma = false;
- 	}
- 	tf.lbal = log;
- 	tf.lbam = page;
-@@ -1527,6 +1532,12 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
- 	err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE,
- 				     buf, sectors * ATA_SECT_SIZE, 0);
- 
-+	if (err_mask && dma) {
-+		dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG;
-+		ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n");
-+		goto retry;
-+	}
-+
- 	DPRINTK("EXIT, err_mask=%x\n", err_mask);
- 	return err_mask;
- }
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index 3131adc..641a61a 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
- 		rbuf[14] = (lowest_aligned >> 8) & 0x3f;
- 		rbuf[15] = lowest_aligned;
- 
--		if (ata_id_has_trim(args->id)) {
-+		if (ata_id_has_trim(args->id) &&
-+		    !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
- 			rbuf[14] |= 0x80; /* LBPME */
- 
- 			if (ata_id_has_zero_after_trim(args->id) &&
-diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
-index 3227b7c..e2d9497 100644
---- a/drivers/ata/libata-transport.c
-+++ b/drivers/ata/libata-transport.c
-@@ -560,6 +560,29 @@ show_ata_dev_gscr(struct device *dev,
- 
- static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL);
- 
-+static ssize_t
-+show_ata_dev_trim(struct device *dev,
-+		  struct device_attribute *attr, char *buf)
-+{
-+	struct ata_device *ata_dev = transport_class_to_dev(dev);
-+	unsigned char *mode;
-+
-+	if (!ata_id_has_trim(ata_dev->id))
-+		mode = "unsupported";
-+	else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
-+		mode = "forced_unsupported";
-+	else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
-+			mode = "forced_unqueued";
-+	else if (ata_fpdma_dsm_supported(ata_dev))
-+		mode = "queued";
-+	else
-+		mode = "unqueued";
-+
-+	return snprintf(buf, 20, "%s\n", mode);
-+}
-+
-+static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL);
-+
- static DECLARE_TRANSPORT_CLASS(ata_dev_class,
- 			       "ata_device", NULL, NULL, NULL);
- 
-@@ -733,6 +756,7 @@ struct scsi_transport_template *ata_attach_transport(void)
- 	SETUP_DEV_ATTRIBUTE(ering);
- 	SETUP_DEV_ATTRIBUTE(id);
- 	SETUP_DEV_ATTRIBUTE(gscr);
-+	SETUP_DEV_ATTRIBUTE(trim);
- 	BUG_ON(count > ATA_DEV_ATTRS);
- 	i->dev_attrs[count] = NULL;
- 
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 171841a..4d1d9de 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
- 	kfree(fw_priv);
- }
- 
--static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
- {
--	struct firmware_priv *fw_priv = to_firmware_priv(dev);
--
- 	if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
- 		return -ENOMEM;
- 	if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
-@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
- 	return 0;
- }
- 
-+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+	struct firmware_priv *fw_priv = to_firmware_priv(dev);
-+	int err = 0;
-+
-+	mutex_lock(&fw_lock);
-+	if (fw_priv->buf)
-+		err = do_firmware_uevent(fw_priv, env);
-+	mutex_unlock(&fw_lock);
-+	return err;
-+}
-+
- static struct class firmware_class = {
- 	.name		= "firmware",
- 	.class_attrs	= firmware_class_attrs,
-diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
-index 7fdd017..c7b0fce 100644
---- a/drivers/base/power/clock_ops.c
-+++ b/drivers/base/power/clock_ops.c
-@@ -93,7 +93,7 @@ static int __pm_clk_add(struct device *dev, const char *con_id,
- 			return -ENOMEM;
- 		}
- 	} else {
--		if (IS_ERR(ce->clk) || !__clk_get(clk)) {
-+		if (IS_ERR(clk) || !__clk_get(clk)) {
- 			kfree(ce);
- 			return -ENOENT;
- 		}
-diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index d7173cb..cef6fa8 100644
---- a/drivers/block/loop.c
-+++ b/drivers/block/loop.c
-@@ -86,8 +86,6 @@ static DEFINE_MUTEX(loop_index_mutex);
- static int max_part;
- static int part_shift;
- 
--static struct workqueue_struct *loop_wq;
--
- static int transfer_xor(struct loop_device *lo, int cmd,
- 			struct page *raw_page, unsigned raw_off,
- 			struct page *loop_page, unsigned loop_off,
-@@ -725,6 +723,12 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
- 	size = get_loop_size(lo, file);
- 	if ((loff_t)(sector_t)size != size)
- 		goto out_putf;
-+	error = -ENOMEM;
-+	lo->wq = alloc_workqueue("kloopd%d",
-+			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 16,
-+			lo->lo_number);
-+	if (!lo->wq)
-+		goto out_putf;
- 
- 	error = 0;
- 
-@@ -872,6 +876,8 @@ static int loop_clr_fd(struct loop_device *lo)
- 	lo->lo_flags = 0;
- 	if (!part_shift)
- 		lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
-+	destroy_workqueue(lo->wq);
-+	lo->wq = NULL;
- 	mutex_unlock(&lo->lo_ctl_mutex);
- 	/*
- 	 * Need not hold lo_ctl_mutex to fput backing file.
-@@ -1425,9 +1431,13 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx,
- 		const struct blk_mq_queue_data *bd)
- {
- 	struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
-+	struct loop_device *lo = cmd->rq->q->queuedata;
- 
- 	blk_mq_start_request(bd->rq);
- 
-+	if (lo->lo_state != Lo_bound)
-+		return -EIO;
-+
- 	if (cmd->rq->cmd_flags & REQ_WRITE) {
- 		struct loop_device *lo = cmd->rq->q->queuedata;
- 		bool need_sched = true;
-@@ -1441,9 +1451,9 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx,
- 		spin_unlock_irq(&lo->lo_lock);
- 
- 		if (need_sched)
--			queue_work(loop_wq, &lo->write_work);
-+			queue_work(lo->wq, &lo->write_work);
- 	} else {
--		queue_work(loop_wq, &cmd->read_work);
-+		queue_work(lo->wq, &cmd->read_work);
- 	}
- 
- 	return BLK_MQ_RQ_QUEUE_OK;
-@@ -1455,9 +1465,6 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
- 	struct loop_device *lo = cmd->rq->q->queuedata;
- 	int ret = -EIO;
- 
--	if (lo->lo_state != Lo_bound)
--		goto failed;
--
- 	if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY))
- 		goto failed;
- 
-@@ -1806,13 +1813,6 @@ static int __init loop_init(void)
- 		goto misc_out;
- 	}
- 
--	loop_wq = alloc_workqueue("kloopd",
--			WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 0);
--	if (!loop_wq) {
--		err = -ENOMEM;
--		goto misc_out;
--	}
--
- 	blk_register_region(MKDEV(LOOP_MAJOR, 0), range,
- 				  THIS_MODULE, loop_probe, NULL, NULL);
- 
-@@ -1850,8 +1850,6 @@ static void __exit loop_exit(void)
- 	blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
- 	unregister_blkdev(LOOP_MAJOR, "loop");
- 
--	destroy_workqueue(loop_wq);
--
- 	misc_deregister(&loop_misc);
- }
- 
-diff --git a/drivers/block/loop.h b/drivers/block/loop.h
-index 301c27f..49564ed 100644
---- a/drivers/block/loop.h
-+++ b/drivers/block/loop.h
-@@ -54,6 +54,7 @@ struct loop_device {
- 	gfp_t		old_gfp_mask;
- 
- 	spinlock_t		lo_lock;
-+	struct workqueue_struct *wq;
- 	struct list_head	write_cmd_head;
- 	struct work_struct	write_work;
- 	bool			write_started;
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index ec6c5c6..53f2535 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -2001,11 +2001,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
- 	rbd_assert(obj_request_type_valid(type));
- 
- 	size = strlen(object_name) + 1;
--	name = kmalloc(size, GFP_KERNEL);
-+	name = kmalloc(size, GFP_NOIO);
- 	if (!name)
- 		return NULL;
- 
--	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
-+	obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
- 	if (!obj_request) {
- 		kfree(name);
- 		return NULL;
-diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
-index 4bba866..3f146c9 100644
---- a/drivers/bluetooth/btbcm.c
-+++ b/drivers/bluetooth/btbcm.c
-@@ -378,12 +378,11 @@ int btbcm_setup_apple(struct hci_dev *hdev)
- 
- 	/* Read Verbose Config Version Info */
- 	skb = btbcm_read_verbose_config(hdev);
--	if (IS_ERR(skb))
--		return PTR_ERR(skb);
--
--	BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
--		get_unaligned_le16(skb->data + 5));
--	kfree_skb(skb);
-+	if (!IS_ERR(skb)) {
-+		BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
-+			get_unaligned_le16(skb->data + 5));
-+		kfree_skb(skb);
-+	}
- 
- 	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
- 
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 420cc9f..c655015 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -268,7 +268,7 @@ static const struct usb_device_id blacklist_table[] = {
- 	{ USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
- 
- 	/* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
--	{ USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE },
-+	{ USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
- 
- 	/* Digianswer devices */
- 	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
-@@ -1993,6 +1993,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
- 	}
- 	fw_ptr = fw->data;
- 
-+	kfree_skb(skb);
-+
- 	/* This Intel specific command enables the manufacturer mode of the
- 	 * controller.
- 	 *
-@@ -2334,6 +2336,7 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
- 	struct intel_boot_params *params;
- 	const struct firmware *fw;
- 	const u8 *fw_ptr;
-+	u32 frag_len;
- 	char fwname[64];
- 	ktime_t calltime, delta, rettime;
- 	unsigned long long duration;
-@@ -2540,24 +2543,33 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
- 	}
- 
- 	fw_ptr = fw->data + 644;
-+	frag_len = 0;
- 
- 	while (fw_ptr - fw->data < fw->size) {
--		struct hci_command_hdr *cmd = (void *)fw_ptr;
--		u8 cmd_len;
-+		struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
- 
--		cmd_len = sizeof(*cmd) + cmd->plen;
-+		frag_len += sizeof(*cmd) + cmd->plen;
- 
--		/* Send each command from the firmware data buffer as
--		 * a single Data fragment.
-+		/* The paramter length of the secure send command requires
-+		 * a 4 byte alignment. It happens so that the firmware file
-+		 * contains proper Intel_NOP commands to align the fragments
-+		 * as needed.
-+		 *
-+		 * Send set of commands with 4 byte alignment from the
-+		 * firmware data buffer as a single Data fragement.
- 		 */
--		err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr);
--		if (err < 0) {
--			BT_ERR("%s: Failed to send firmware data (%d)",
--			       hdev->name, err);
--			goto done;
--		}
-+		if (!(frag_len % 4)) {
-+			err = btusb_intel_secure_send(hdev, 0x01, frag_len,
-+						      fw_ptr);
-+			if (err < 0) {
-+				BT_ERR("%s: Failed to send firmware data (%d)",
-+				       hdev->name, err);
-+				goto done;
-+			}
- 
--		fw_ptr += cmd_len;
-+			fw_ptr += frag_len;
-+			frag_len = 0;
-+		}
- 	}
- 
- 	set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
-diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
-index aaa0f2a..60397ec 100644
---- a/drivers/bus/arm-ccn.c
-+++ b/drivers/bus/arm-ccn.c
-@@ -212,7 +212,7 @@ static int arm_ccn_node_to_xp_port(int node)
- 
- static void arm_ccn_pmu_config_set(u64 *config, u32 node_xp, u32 type, u32 port)
- {
--	*config &= ~((0xff << 0) | (0xff << 8) | (0xff << 24));
-+	*config &= ~((0xff << 0) | (0xff << 8) | (0x3 << 24));
- 	*config |= (node_xp << 0) | (type << 8) | (port << 24);
- }
- 
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index 0b4188b..c6dea3f 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -581,7 +581,7 @@ static inline int needs_ilk_vtd_wa(void)
- 	/* Query intel_iommu to see if we need the workaround. Presumably that
- 	 * was loaded first.
- 	 */
--	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
-+	if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
- 	     gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
- 	     intel_iommu_gfx_mapped)
- 		return 1;
-diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
-index 283f00a..1082d4b 100644
---- a/drivers/char/tpm/tpm-chip.c
-+++ b/drivers/char/tpm/tpm-chip.c
-@@ -129,8 +129,9 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
- 
- 	device_initialize(&chip->dev);
- 
--	chip->cdev.owner = chip->pdev->driver->owner;
- 	cdev_init(&chip->cdev, &tpm_fops);
-+	chip->cdev.owner = chip->pdev->driver->owner;
-+	chip->cdev.kobj.parent = &chip->dev.kobj;
- 
- 	return chip;
- }
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index b26ceee..1267322 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -233,6 +233,14 @@ static int crb_acpi_add(struct acpi_device *device)
- 		return -ENODEV;
- 	}
- 
-+	/* At least some versions of AMI BIOS have a bug that TPM2 table has
-+	 * zero address for the control area and therefore we must fail.
-+	*/
-+	if (!buf->control_area_pa) {
-+		dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
-+		return -EINVAL;
-+	}
-+
- 	if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
- 		dev_err(dev, "TPM2 ACPI table has wrong size");
- 		return -EINVAL;
-@@ -267,7 +275,7 @@ static int crb_acpi_add(struct acpi_device *device)
- 
- 	memcpy_fromio(&pa, &priv->cca->cmd_pa, 8);
- 	pa = le64_to_cpu(pa);
--	priv->cmd = devm_ioremap_nocache(dev, le64_to_cpu(pa),
-+	priv->cmd = devm_ioremap_nocache(dev, pa,
- 					 ioread32(&priv->cca->cmd_size));
- 	if (!priv->cmd) {
- 		dev_err(dev, "ioremap of the command buffer failed\n");
-@@ -276,7 +284,7 @@ static int crb_acpi_add(struct acpi_device *device)
- 
- 	memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
- 	pa = le64_to_cpu(pa);
--	priv->rsp = devm_ioremap_nocache(dev, le64_to_cpu(pa),
-+	priv->rsp = devm_ioremap_nocache(dev, pa,
- 					 ioread32(&priv->cca->rsp_size));
- 	if (!priv->rsp) {
- 		dev_err(dev, "ioremap of the response buffer failed\n");
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index 42ffa5e..27ebf95 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -578,6 +578,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- 		goto cleanup;
- 	}
- 
-+	ibmvtpm->dev = dev;
-+	ibmvtpm->vdev = vio_dev;
-+
- 	crq_q = &ibmvtpm->crq_queue;
- 	crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
- 	if (!crq_q->crq_addr) {
-@@ -622,8 +625,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- 
- 	crq_q->index = 0;
- 
--	ibmvtpm->dev = dev;
--	ibmvtpm->vdev = vio_dev;
- 	TPM_VPRIV(chip) = (void *)ibmvtpm;
- 
- 	spin_lock_init(&ibmvtpm->rtce_lock);
-diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
-index 5b0f418..9f9cadd 100644
---- a/drivers/clk/clk.c
-+++ b/drivers/clk/clk.c
-@@ -230,11 +230,12 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
- 	if (!c)
- 		return;
- 
-+	/* This should be JSON format, i.e. elements separated with a comma */
- 	seq_printf(s, "\"%s\": { ", c->name);
- 	seq_printf(s, "\"enable_count\": %d,", c->enable_count);
- 	seq_printf(s, "\"prepare_count\": %d,", c->prepare_count);
--	seq_printf(s, "\"rate\": %lu", clk_core_get_rate(c));
--	seq_printf(s, "\"accuracy\": %lu", clk_core_get_accuracy(c));
-+	seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
-+	seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
- 	seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
- }
- 
-diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
-index b95d17f..92936f0 100644
---- a/drivers/clk/qcom/clk-rcg2.c
-+++ b/drivers/clk/qcom/clk-rcg2.c
-@@ -530,19 +530,16 @@ static int clk_pixel_set_rate(struct clk_hw *hw, unsigned long rate,
- 	struct clk_rcg2 *rcg = to_clk_rcg2(hw);
- 	struct freq_tbl f = *rcg->freq_tbl;
- 	const struct frac_entry *frac = frac_table_pixel;
--	unsigned long request, src_rate;
-+	unsigned long request;
- 	int delta = 100000;
- 	u32 mask = BIT(rcg->hid_width) - 1;
- 	u32 hid_div;
--	int index = qcom_find_src_index(hw, rcg->parent_map, f.src);
--	struct clk *parent = clk_get_parent_by_index(hw->clk, index);
- 
- 	for (; frac->num; frac++) {
- 		request = (rate * frac->den) / frac->num;
- 
--		src_rate = __clk_round_rate(parent, request);
--		if ((src_rate < (request - delta)) ||
--			(src_rate > (request + delta)))
-+		if ((parent_rate < (request - delta)) ||
-+			(parent_rate > (request + delta)))
- 			continue;
- 
- 		regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG,
-diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
-index d86bc46..0a1df82 100644
---- a/drivers/clk/ti/clk-dra7-atl.c
-+++ b/drivers/clk/ti/clk-dra7-atl.c
-@@ -252,6 +252,11 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
- 		}
- 
- 		clk = of_clk_get_from_provider(&clkspec);
-+		if (IS_ERR(clk)) {
-+			pr_err("%s: failed to get atl clock %d from provider\n",
-+			       __func__, i);
-+			return PTR_ERR(clk);
-+		}
- 
- 		cdesc = to_atl_desc(__clk_get_hw(clk));
- 		cdesc->cinfo = cinfo;
-diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
-index 83564c9..c844616 100644
---- a/drivers/clocksource/exynos_mct.c
-+++ b/drivers/clocksource/exynos_mct.c
-@@ -466,15 +466,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- 	exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
- 
- 	if (mct_int_type == MCT_INT_SPI) {
--		evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
--		if (request_irq(evt->irq, exynos4_mct_tick_isr,
--				IRQF_TIMER | IRQF_NOBALANCING,
--				evt->name, mevt)) {
--			pr_err("exynos-mct: cannot register IRQ %d\n",
--				evt->irq);
-+
-+		if (evt->irq == -1)
- 			return -EIO;
--		}
--		irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
-+
-+		irq_force_affinity(evt->irq, cpumask_of(cpu));
-+		enable_irq(evt->irq);
- 	} else {
- 		enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
- 	}
-@@ -487,10 +484,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- static void exynos4_local_timer_stop(struct clock_event_device *evt)
- {
- 	evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
--	if (mct_int_type == MCT_INT_SPI)
--		free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
--	else
-+	if (mct_int_type == MCT_INT_SPI) {
-+		if (evt->irq != -1)
-+			disable_irq_nosync(evt->irq);
-+	} else {
- 		disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
-+	}
- }
- 
- static int exynos4_mct_cpu_notify(struct notifier_block *self,
-@@ -522,7 +521,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
- 
- static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
- {
--	int err;
-+	int err, cpu;
- 	struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
- 	struct clk *mct_clk, *tick_clk;
- 
-@@ -549,7 +548,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
- 		WARN(err, "MCT: can't request IRQ %d (%d)\n",
- 		     mct_irqs[MCT_L0_IRQ], err);
- 	} else {
--		irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
-+		for_each_possible_cpu(cpu) {
-+			int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
-+			struct mct_clock_event_device *pcpu_mevt =
-+				per_cpu_ptr(&percpu_mct_tick, cpu);
-+
-+			pcpu_mevt->evt.irq = -1;
-+
-+			irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
-+			if (request_irq(mct_irq,
-+					exynos4_mct_tick_isr,
-+					IRQF_TIMER | IRQF_NOBALANCING,
-+					pcpu_mevt->name, pcpu_mevt)) {
-+				pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
-+									cpu);
-+
-+				continue;
-+			}
-+			pcpu_mevt->evt.irq = mct_irq;
-+		}
- 	}
- 
- 	err = register_cpu_notifier(&exynos4_mct_cpu_nb);
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index 1c56001..50f1b42 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -273,7 +273,8 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- 	dma_cookie_t cookie = 0;
- 	int busy = mv_chan_is_busy(mv_chan);
- 	u32 current_desc = mv_chan_get_current_desc(mv_chan);
--	int seen_current = 0;
-+	int current_cleaned = 0;
-+	struct mv_xor_desc *hw_desc;
- 
- 	dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
- 	dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
-@@ -285,38 +286,57 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- 
- 	list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
- 					chain_node) {
--		prefetch(_iter);
--		prefetch(&_iter->async_tx);
- 
--		/* do not advance past the current descriptor loaded into the
--		 * hardware channel, subsequent descriptors are either in
--		 * process or have not been submitted
--		 */
--		if (seen_current)
--			break;
-+		/* clean finished descriptors */
-+		hw_desc = iter->hw_desc;
-+		if (hw_desc->status & XOR_DESC_SUCCESS) {
-+			cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
-+								cookie);
- 
--		/* stop the search if we reach the current descriptor and the
--		 * channel is busy
--		 */
--		if (iter->async_tx.phys == current_desc) {
--			seen_current = 1;
--			if (busy)
-+			/* done processing desc, clean slot */
-+			mv_xor_clean_slot(iter, mv_chan);
-+
-+			/* break if we did cleaned the current */
-+			if (iter->async_tx.phys == current_desc) {
-+				current_cleaned = 1;
-+				break;
-+			}
-+		} else {
-+			if (iter->async_tx.phys == current_desc) {
-+				current_cleaned = 0;
- 				break;
-+			}
- 		}
--
--		cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
--
--		if (mv_xor_clean_slot(iter, mv_chan))
--			break;
- 	}
- 
- 	if ((busy == 0) && !list_empty(&mv_chan->chain)) {
--		struct mv_xor_desc_slot *chain_head;
--		chain_head = list_entry(mv_chan->chain.next,
--					struct mv_xor_desc_slot,
--					chain_node);
--
--		mv_xor_start_new_chain(mv_chan, chain_head);
-+		if (current_cleaned) {
-+			/*
-+			 * current descriptor cleaned and removed, run
-+			 * from list head
-+			 */
-+			iter = list_entry(mv_chan->chain.next,
-+					  struct mv_xor_desc_slot,
-+					  chain_node);
-+			mv_xor_start_new_chain(mv_chan, iter);
-+		} else {
-+			if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
-+				/*
-+				 * descriptors are still waiting after
-+				 * current, trigger them
-+				 */
-+				iter = list_entry(iter->chain_node.next,
-+						  struct mv_xor_desc_slot,
-+						  chain_node);
-+				mv_xor_start_new_chain(mv_chan, iter);
-+			} else {
-+				/*
-+				 * some descriptors are still waiting
-+				 * to be cleaned
-+				 */
-+				tasklet_schedule(&mv_chan->irq_tasklet);
-+			}
-+		}
- 	}
- 
- 	if (cookie > 0)
-diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
-index 91958db..0e302b3 100644
---- a/drivers/dma/mv_xor.h
-+++ b/drivers/dma/mv_xor.h
-@@ -31,6 +31,7 @@
- #define XOR_OPERATION_MODE_XOR		0
- #define XOR_OPERATION_MODE_MEMCPY	2
- #define XOR_DESCRIPTOR_SWAP		BIT(14)
-+#define XOR_DESC_SUCCESS		0x40000000
- 
- #define XOR_DESC_DMA_OWNED		BIT(31)
- #define XOR_DESC_EOD_INT_EN		BIT(31)
-diff --git a/drivers/edac/octeon_edac-l2c.c b/drivers/edac/octeon_edac-l2c.c
-index 7e98084..afea7fc 100644
---- a/drivers/edac/octeon_edac-l2c.c
-+++ b/drivers/edac/octeon_edac-l2c.c
-@@ -151,7 +151,7 @@ static int octeon_l2c_probe(struct platform_device *pdev)
- 	l2c->ctl_name = "octeon_l2c_err";
- 
- 
--	if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) {
-+	if (OCTEON_IS_OCTEON1PLUS()) {
- 		union cvmx_l2t_err l2t_err;
- 		union cvmx_l2d_err l2d_err;
- 
-diff --git a/drivers/edac/octeon_edac-lmc.c b/drivers/edac/octeon_edac-lmc.c
-index bb19e07..cda6dab 100644
---- a/drivers/edac/octeon_edac-lmc.c
-+++ b/drivers/edac/octeon_edac-lmc.c
-@@ -234,7 +234,7 @@ static int octeon_lmc_edac_probe(struct platform_device *pdev)
- 	layers[0].size = 1;
- 	layers[0].is_virt_csrow = false;
- 
--	if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) {
-+	if (OCTEON_IS_OCTEON1PLUS()) {
- 		union cvmx_lmcx_mem_cfg0 cfg0;
- 
- 		cfg0.u64 = cvmx_read_csr(CVMX_LMCX_MEM_CFG0(0));
-diff --git a/drivers/edac/octeon_edac-pc.c b/drivers/edac/octeon_edac-pc.c
-index 0f83c33..2ab6cf2 100644
---- a/drivers/edac/octeon_edac-pc.c
-+++ b/drivers/edac/octeon_edac-pc.c
-@@ -73,7 +73,7 @@ static int  co_cache_error_event(struct notifier_block *this,
- 			edac_device_handle_ce(p->ed, cpu, 0, "dcache");
- 
- 		/* Clear the error indication */
--		if (OCTEON_IS_MODEL(OCTEON_FAM_2))
-+		if (OCTEON_IS_OCTEON2())
- 			write_octeon_c0_dcacheerr(1);
- 		else
- 			write_octeon_c0_dcacheerr(0);
-diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 97b1616..bba843c 100644
---- a/drivers/firmware/dmi_scan.c
-+++ b/drivers/firmware/dmi_scan.c
-@@ -89,9 +89,9 @@ static void dmi_table(u8 *buf,
- 
- 	/*
- 	 * Stop when we have seen all the items the table claimed to have
--	 * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
--	 * off the end of the table (should never happen but sometimes does
--	 * on bogus implementations.)
-+	 * (SMBIOS < 3.0 only) OR we reach an end-of-table marker (SMBIOS
-+	 * >= 3.0 only) OR we run off the end of the table (should never
-+	 * happen but sometimes does on bogus implementations.)
- 	 */
- 	while ((!dmi_num || i < dmi_num) &&
- 	       (data - buf + sizeof(struct dmi_header)) <= dmi_len) {
-@@ -110,8 +110,13 @@ static void dmi_table(u8 *buf,
- 
- 		/*
- 		 * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
-+		 * For tables behind a 64-bit entry point, we have no item
-+		 * count and no exact table length, so stop on end-of-table
-+		 * marker. For tables behind a 32-bit entry point, we have
-+		 * seen OEM structures behind the end-of-table marker on
-+		 * some systems, so don't trust it.
- 		 */
--		if (dm->type == DMI_ENTRY_END_OF_TABLE)
-+		if (!dmi_num && dm->type == DMI_ENTRY_END_OF_TABLE)
- 			break;
- 
- 		data += 2;
-diff --git a/drivers/gpu/drm/bridge/ptn3460.c b/drivers/gpu/drm/bridge/ptn3460.c
-index 9d2f053..63a09e4 100644
---- a/drivers/gpu/drm/bridge/ptn3460.c
-+++ b/drivers/gpu/drm/bridge/ptn3460.c
-@@ -15,6 +15,7 @@
- 
- #include <linux/delay.h>
- #include <linux/gpio.h>
-+#include <linux/gpio/consumer.h>
- #include <linux/i2c.h>
- #include <linux/module.h>
- #include <linux/of.h>
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3007b44..800a025 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -2749,8 +2749,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
- 		return -EINVAL;
- 
--	/* For some reason crtc x/y offsets are signed internally. */
--	if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
-+	/*
-+	 * Universal plane src offsets are only 16.16, prevent havoc for
-+	 * drivers using universal plane code internally.
-+	 */
-+	if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
- 		return -ERANGE;
- 
- 	drm_modeset_lock_all(dev);
-@@ -5048,12 +5051,9 @@ void drm_mode_config_reset(struct drm_device *dev)
- 		if (encoder->funcs->reset)
- 			encoder->funcs->reset(encoder);
- 
--	list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
--		connector->status = connector_status_unknown;
--
-+	list_for_each_entry(connector, &dev->mode_config.connector_list, head)
- 		if (connector->funcs->reset)
- 			connector->funcs->reset(connector);
--	}
- }
- EXPORT_SYMBOL(drm_mode_config_reset);
- 
-diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
-index 132581c..778bbb6 100644
---- a/drivers/gpu/drm/drm_dp_mst_topology.c
-+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
-@@ -867,8 +867,16 @@ static void drm_dp_destroy_port(struct kref *kref)
- 		port->vcpi.num_slots = 0;
- 
- 		kfree(port->cached_edid);
--		if (port->connector)
--			(*port->mgr->cbs->destroy_connector)(mgr, port->connector);
-+
-+		/* we can't destroy the connector here, as
-+		   we might be holding the mode_config.mutex
-+		   from an EDID retrieval */
-+		if (port->connector) {
-+			mutex_lock(&mgr->destroy_connector_lock);
-+			list_add(&port->connector->destroy_list, &mgr->destroy_connector_list);
-+			mutex_unlock(&mgr->destroy_connector_lock);
-+			schedule_work(&mgr->destroy_connector_work);
-+		}
- 		drm_dp_port_teardown_pdt(port, port->pdt);
- 
- 		if (!port->input && port->vcpi.vcpi > 0)
-@@ -1163,6 +1171,8 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
- 	struct drm_dp_mst_port *port;
- 	int i;
- 	/* find the port by iterating down */
-+
-+	mutex_lock(&mgr->lock);
- 	mstb = mgr->mst_primary;
- 
- 	for (i = 0; i < lct - 1; i++) {
-@@ -1182,6 +1192,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
- 		}
- 	}
- 	kref_get(&mstb->kref);
-+	mutex_unlock(&mgr->lock);
- 	return mstb;
- }
- 
-@@ -1189,7 +1200,7 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
- 					       struct drm_dp_mst_branch *mstb)
- {
- 	struct drm_dp_mst_port *port;
--
-+	struct drm_dp_mst_branch *mstb_child;
- 	if (!mstb->link_address_sent) {
- 		drm_dp_send_link_address(mgr, mstb);
- 		mstb->link_address_sent = true;
-@@ -1204,17 +1215,31 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
- 		if (!port->available_pbn)
- 			drm_dp_send_enum_path_resources(mgr, mstb, port);
- 
--		if (port->mstb)
--			drm_dp_check_and_send_link_address(mgr, port->mstb);
-+		if (port->mstb) {
-+			mstb_child = drm_dp_get_validated_mstb_ref(mgr, port->mstb);
-+			if (mstb_child) {
-+				drm_dp_check_and_send_link_address(mgr, mstb_child);
-+				drm_dp_put_mst_branch_device(mstb_child);
-+			}
-+		}
- 	}
- }
- 
- static void drm_dp_mst_link_probe_work(struct work_struct *work)
- {
- 	struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work);
-+	struct drm_dp_mst_branch *mstb;
- 
--	drm_dp_check_and_send_link_address(mgr, mgr->mst_primary);
--
-+	mutex_lock(&mgr->lock);
-+	mstb = mgr->mst_primary;
-+	if (mstb) {
-+		kref_get(&mstb->kref);
-+	}
-+	mutex_unlock(&mgr->lock);
-+	if (mstb) {
-+		drm_dp_check_and_send_link_address(mgr, mstb);
-+		drm_dp_put_mst_branch_device(mstb);
-+	}
- }
- 
- static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
-@@ -2632,6 +2657,30 @@ static void drm_dp_tx_work(struct work_struct *work)
- 	mutex_unlock(&mgr->qlock);
- }
- 
-+static void drm_dp_destroy_connector_work(struct work_struct *work)
-+{
-+	struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, destroy_connector_work);
-+	struct drm_connector *connector;
-+
-+	/*
-+	 * Not a regular list traverse as we have to drop the destroy
-+	 * connector lock before destroying the connector, to avoid AB->BA
-+	 * ordering between this lock and the config mutex.
-+	 */
-+	for (;;) {
-+		mutex_lock(&mgr->destroy_connector_lock);
-+		connector = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_connector, destroy_list);
-+		if (!connector) {
-+			mutex_unlock(&mgr->destroy_connector_lock);
-+			break;
-+		}
-+		list_del(&connector->destroy_list);
-+		mutex_unlock(&mgr->destroy_connector_lock);
-+
-+		mgr->cbs->destroy_connector(mgr, connector);
-+	}
-+}
-+
- /**
-  * drm_dp_mst_topology_mgr_init - initialise a topology manager
-  * @mgr: manager struct to initialise
-@@ -2651,10 +2700,13 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
- 	mutex_init(&mgr->lock);
- 	mutex_init(&mgr->qlock);
- 	mutex_init(&mgr->payload_lock);
-+	mutex_init(&mgr->destroy_connector_lock);
- 	INIT_LIST_HEAD(&mgr->tx_msg_upq);
- 	INIT_LIST_HEAD(&mgr->tx_msg_downq);
-+	INIT_LIST_HEAD(&mgr->destroy_connector_list);
- 	INIT_WORK(&mgr->work, drm_dp_mst_link_probe_work);
- 	INIT_WORK(&mgr->tx_work, drm_dp_tx_work);
-+	INIT_WORK(&mgr->destroy_connector_work, drm_dp_destroy_connector_work);
- 	init_waitqueue_head(&mgr->tx_waitq);
- 	mgr->dev = dev;
- 	mgr->aux = aux;
-@@ -2679,6 +2731,7 @@ EXPORT_SYMBOL(drm_dp_mst_topology_mgr_init);
-  */
- void drm_dp_mst_topology_mgr_destroy(struct drm_dp_mst_topology_mgr *mgr)
- {
-+	flush_work(&mgr->destroy_connector_work);
- 	mutex_lock(&mgr->payload_lock);
- 	kfree(mgr->payloads);
- 	mgr->payloads = NULL;
-diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index aa8bbb4..9cfcd0a 100644
---- a/drivers/gpu/drm/drm_ioc32.c
-+++ b/drivers/gpu/drm/drm_ioc32.c
-@@ -70,6 +70,8 @@
- 
- #define DRM_IOCTL_WAIT_VBLANK32		DRM_IOWR(0x3a, drm_wait_vblank32_t)
- 
-+#define DRM_IOCTL_MODE_ADDFB232		DRM_IOWR(0xb8, drm_mode_fb_cmd232_t)
-+
- typedef struct drm_version_32 {
- 	int version_major;	  /**< Major version */
- 	int version_minor;	  /**< Minor version */
-@@ -1016,6 +1018,63 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
- 	return 0;
- }
- 
-+typedef struct drm_mode_fb_cmd232 {
-+	u32 fb_id;
-+	u32 width;
-+	u32 height;
-+	u32 pixel_format;
-+	u32 flags;
-+	u32 handles[4];
-+	u32 pitches[4];
-+	u32 offsets[4];
-+	u64 modifier[4];
-+} __attribute__((packed)) drm_mode_fb_cmd232_t;
-+
-+static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
-+				  unsigned long arg)
-+{
-+	struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg;
-+	struct drm_mode_fb_cmd232 req32;
-+	struct drm_mode_fb_cmd2 __user *req64;
-+	int i;
-+	int err;
-+
-+	if (copy_from_user(&req32, argp, sizeof(req32)))
-+		return -EFAULT;
-+
-+	req64 = compat_alloc_user_space(sizeof(*req64));
-+
-+	if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64))
-+	    || __put_user(req32.width, &req64->width)
-+	    || __put_user(req32.height, &req64->height)
-+	    || __put_user(req32.pixel_format, &req64->pixel_format)
-+	    || __put_user(req32.flags, &req64->flags))
-+		return -EFAULT;
-+
-+	for (i = 0; i < 4; i++) {
-+		if (__put_user(req32.handles[i], &req64->handles[i]))
-+			return -EFAULT;
-+		if (__put_user(req32.pitches[i], &req64->pitches[i]))
-+			return -EFAULT;
-+		if (__put_user(req32.offsets[i], &req64->offsets[i]))
-+			return -EFAULT;
-+		if (__put_user(req32.modifier[i], &req64->modifier[i]))
-+			return -EFAULT;
-+	}
-+
-+	err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64);
-+	if (err)
-+		return err;
-+
-+	if (__get_user(req32.fb_id, &req64->fb_id))
-+		return -EFAULT;
-+
-+	if (copy_to_user(argp, &req32, sizeof(req32)))
-+		return -EFAULT;
-+
-+	return 0;
-+}
-+
- static drm_ioctl_compat_t *drm_compat_ioctls[] = {
- 	[DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
- 	[DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
-@@ -1048,6 +1107,7 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
- 	[DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
- #endif
- 	[DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
-+	[DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
- };
- 
- /**
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 2d0995e..596bce5 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -2401,6 +2401,7 @@ int __i915_add_request(struct intel_engine_cs *ring,
- 	}
- 
- 	request->emitted_jiffies = jiffies;
-+	ring->last_submitted_seqno = request->seqno;
- 	list_add_tail(&request->list, &ring->request_list);
- 	request->file_priv = NULL;
- 
-diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
-index 0239fbf..ad90fa3 100644
---- a/drivers/gpu/drm/i915/i915_gem_gtt.c
-+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
-@@ -502,17 +502,17 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm,
- 		struct page *page_table;
- 
- 		if (WARN_ON(!ppgtt->pdp.page_directory[pdpe]))
--			continue;
-+			break;
- 
- 		pd = ppgtt->pdp.page_directory[pdpe];
- 
- 		if (WARN_ON(!pd->page_table[pde]))
--			continue;
-+			break;
- 
- 		pt = pd->page_table[pde];
- 
- 		if (WARN_ON(!pt->page))
--			continue;
-+			break;
- 
- 		page_table = pt->page;
- 
-diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
-index 176de63..23aa04c 100644
---- a/drivers/gpu/drm/i915/i915_ioc32.c
-+++ b/drivers/gpu/drm/i915/i915_ioc32.c
-@@ -204,7 +204,7 @@ long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
- 	drm_ioctl_compat_t *fn = NULL;
- 	int ret;
- 
--	if (nr < DRM_COMMAND_BASE)
-+	if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END)
- 		return drm_compat_ioctl(filp, cmd, arg);
- 
- 	if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls))
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 6d49443..b0df8d1 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -2650,18 +2650,11 @@ static void gen8_disable_vblank(struct drm_device *dev, int pipe)
- 	spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
- }
- 
--static struct drm_i915_gem_request *
--ring_last_request(struct intel_engine_cs *ring)
--{
--	return list_entry(ring->request_list.prev,
--			  struct drm_i915_gem_request, list);
--}
--
- static bool
--ring_idle(struct intel_engine_cs *ring)
-+ring_idle(struct intel_engine_cs *ring, u32 seqno)
- {
- 	return (list_empty(&ring->request_list) ||
--		i915_gem_request_completed(ring_last_request(ring), false));
-+		i915_seqno_passed(seqno, ring->last_submitted_seqno));
- }
- 
- static bool
-@@ -2883,7 +2876,7 @@ static void i915_hangcheck_elapsed(struct work_struct *work)
- 		acthd = intel_ring_get_active_head(ring);
- 
- 		if (ring->hangcheck.seqno == seqno) {
--			if (ring_idle(ring)) {
-+			if (ring_idle(ring, seqno)) {
- 				ring->hangcheck.action = HANGCHECK_IDLE;
- 
- 				if (waitqueue_active(&ring->irq_queue)) {
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 773d1d2..a30db4b 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -3209,6 +3209,7 @@ enum skl_disp_power_wells {
- #define   BLM_POLARITY_PNV			(1 << 0) /* pnv only */
- 
- #define BLC_HIST_CTL	(dev_priv->info.display_mmio_offset + 0x61260)
-+#define  BLM_HISTOGRAM_ENABLE			(1 << 31)
- 
- /* New registers for PCH-split platforms. Safe where new bits show up, the
-  * register layout machtes with gen4 BLC_PWM_CTL[12]. */
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index d0f3cbc..57c8878 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -12499,6 +12499,16 @@ intel_check_primary_plane(struct drm_plane *plane,
- 				intel_crtc->atomic.wait_vblank = true;
- 		}
- 
-+		/*
-+		 * FIXME: Actually if we will still have any other plane enabled
-+		 * on the pipe we could let IPS enabled still, but for
-+		 * now lets consider that when we make primary invisible
-+		 * by setting DSPCNTR to 0 on update_primary_plane function
-+		 * IPS needs to be disable.
-+		 */
-+		if (!state->visible || !fb)
-+			intel_crtc->atomic.disable_ips = true;
-+
- 		intel_crtc->atomic.fb_bits |=
- 			INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe);
- 
-@@ -12590,6 +12600,9 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc)
- 	if (intel_crtc->atomic.disable_fbc)
- 		intel_fbc_disable(dev);
- 
-+	if (intel_crtc->atomic.disable_ips)
-+		hsw_disable_ips(intel_crtc);
-+
- 	if (intel_crtc->atomic.pre_disable_primary)
- 		intel_pre_disable_primary(crtc);
- 
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index 897f17d..68d1f74 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -424,6 +424,7 @@ struct intel_crtc_atomic_commit {
- 	/* Sleepable operations to perform before commit */
- 	bool wait_for_flips;
- 	bool disable_fbc;
-+	bool disable_ips;
- 	bool pre_disable_primary;
- 	bool update_wm;
- 	unsigned disabled_planes;
-diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
-index 08532d4..2bf92cb 100644
---- a/drivers/gpu/drm/i915/intel_panel.c
-+++ b/drivers/gpu/drm/i915/intel_panel.c
-@@ -879,6 +879,14 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
- 
- 	/* XXX: combine this into above write? */
- 	intel_panel_actually_set_backlight(connector, panel->backlight.level);
-+
-+	/*
-+	 * Needed to enable backlight on some 855gm models. BLC_HIST_CTL is
-+	 * 855gm only, but checking for gen2 is safe, as 855gm is the only gen2
-+	 * that has backlight.
-+	 */
-+	if (IS_GEN2(dev))
-+		I915_WRITE(BLC_HIST_CTL, BLM_HISTOGRAM_ENABLE);
- }
- 
- static void i965_enable_backlight(struct intel_connector *connector)
-diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
-index c761fe0..94514d3 100644
---- a/drivers/gpu/drm/i915/intel_ringbuffer.h
-+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
-@@ -266,6 +266,13 @@ struct  intel_engine_cs {
- 	 * Do we have some not yet emitted requests outstanding?
- 	 */
- 	struct drm_i915_gem_request *outstanding_lazy_request;
-+	/**
-+	 * Seqno of request most recently submitted to request_list.
-+	 * Used exclusively by hang checker to avoid grabbing lock while
-+	 * inspecting request list.
-+	 */
-+	u32 last_submitted_seqno;
-+
- 	bool gpu_caches_dirty;
- 
- 	wait_queue_head_t irq_queue;
-diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
-index ff2a746..a18807e 100644
---- a/drivers/gpu/drm/i915/intel_uncore.c
-+++ b/drivers/gpu/drm/i915/intel_uncore.c
-@@ -1220,10 +1220,12 @@ int i915_reg_read_ioctl(struct drm_device *dev,
- 	struct drm_i915_private *dev_priv = dev->dev_private;
- 	struct drm_i915_reg_read *reg = data;
- 	struct register_whitelist const *entry = whitelist;
-+	unsigned size;
-+	u64 offset;
- 	int i, ret = 0;
- 
- 	for (i = 0; i < ARRAY_SIZE(whitelist); i++, entry++) {
--		if (entry->offset == reg->offset &&
-+		if (entry->offset == (reg->offset & -entry->size) &&
- 		    (1 << INTEL_INFO(dev)->gen & entry->gen_bitmask))
- 			break;
- 	}
-@@ -1231,23 +1233,33 @@ int i915_reg_read_ioctl(struct drm_device *dev,
- 	if (i == ARRAY_SIZE(whitelist))
- 		return -EINVAL;
- 
-+	/* We use the low bits to encode extra flags as the register should
-+	 * be naturally aligned (and those that are not so aligned merely
-+	 * limit the available flags for that register).
-+	 */
-+	offset = entry->offset;
-+	size = entry->size;
-+	size |= reg->offset ^ offset;
-+
- 	intel_runtime_pm_get(dev_priv);
- 
--	switch (entry->size) {
-+	switch (size) {
-+	case 8 | 1:
-+		reg->val = I915_READ64_2x32(offset, offset+4);
-+		break;
- 	case 8:
--		reg->val = I915_READ64(reg->offset);
-+		reg->val = I915_READ64(offset);
- 		break;
- 	case 4:
--		reg->val = I915_READ(reg->offset);
-+		reg->val = I915_READ(offset);
- 		break;
- 	case 2:
--		reg->val = I915_READ16(reg->offset);
-+		reg->val = I915_READ16(offset);
- 		break;
- 	case 1:
--		reg->val = I915_READ8(reg->offset);
-+		reg->val = I915_READ8(offset);
- 		break;
- 	default:
--		MISSING_CASE(entry->size);
- 		ret = -EINVAL;
- 		goto out;
- 	}
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index 9782364..f33251d 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
- 
- 	cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
- 	cmd->type = QXL_SURFACE_CMD_CREATE;
-+	cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
- 	cmd->u.surface_create.format = surf->surf.format;
- 	cmd->u.surface_create.width = surf->surf.width;
- 	cmd->u.surface_create.height = surf->surf.height;
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index b110883..7354a4c 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- 	qobj = gem_to_qxl_bo(gobj);
- 
- 	ret = qxl_release_list_add(release, qobj);
--	if (ret)
-+	if (ret) {
-+		drm_gem_object_unreference_unlocked(gobj);
- 		return NULL;
-+	}
- 
- 	return qobj;
- }
-diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
-index 8730562..4a09947 100644
---- a/drivers/gpu/drm/radeon/ci_dpm.c
-+++ b/drivers/gpu/drm/radeon/ci_dpm.c
-@@ -5818,7 +5818,7 @@ int ci_dpm_init(struct radeon_device *rdev)
- 			tmp |= DPM_ENABLED;
- 			break;
- 		default:
--			DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift);
-+			DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift);
- 			break;
- 		}
- 		WREG32_SMC(CNB_PWRMGT_CNTL, tmp);
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index ba50f3c..8456653 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -4579,6 +4579,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
- 	WDOORBELL32(ring->doorbell_index, ring->wptr);
- }
- 
-+static void cik_compute_stop(struct radeon_device *rdev,
-+			     struct radeon_ring *ring)
-+{
-+	u32 j, tmp;
-+
-+	cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
-+	/* Disable wptr polling. */
-+	tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
-+	tmp &= ~WPTR_POLL_EN;
-+	WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
-+	/* Disable HQD. */
-+	if (RREG32(CP_HQD_ACTIVE) & 1) {
-+		WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
-+		for (j = 0; j < rdev->usec_timeout; j++) {
-+			if (!(RREG32(CP_HQD_ACTIVE) & 1))
-+				break;
-+			udelay(1);
-+		}
-+		WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
-+		WREG32(CP_HQD_PQ_RPTR, 0);
-+		WREG32(CP_HQD_PQ_WPTR, 0);
-+	}
-+	cik_srbm_select(rdev, 0, 0, 0, 0);
-+}
-+
- /**
-  * cik_cp_compute_enable - enable/disable the compute CP MEs
-  *
-@@ -4592,6 +4617,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
- 	if (enable)
- 		WREG32(CP_MEC_CNTL, 0);
- 	else {
-+		/*
-+		 * To make hibernation reliable we need to clear compute ring
-+		 * configuration before halting the compute ring.
-+		 */
-+		mutex_lock(&rdev->srbm_mutex);
-+		cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
-+		cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
-+		mutex_unlock(&rdev->srbm_mutex);
-+
- 		WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
- 		rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
- 		rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
-@@ -7905,23 +7939,27 @@ restart_ih:
- 		case 1: /* D1 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D1 vblank */
--				if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[0]) {
--						drm_handle_vblank(rdev->ddev, 0);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[0]))
--						radeon_crtc_handle_vblank(rdev, 0);
--					rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D1 vblank\n");
-+				if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[0]) {
-+					drm_handle_vblank(rdev->ddev, 0);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[0]))
-+					radeon_crtc_handle_vblank(rdev, 0);
-+				rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vblank\n");
-+
- 				break;
- 			case 1: /* D1 vline */
--				if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D1 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -7931,23 +7969,27 @@ restart_ih:
- 		case 2: /* D2 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D2 vblank */
--				if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[1]) {
--						drm_handle_vblank(rdev->ddev, 1);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[1]))
--						radeon_crtc_handle_vblank(rdev, 1);
--					rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D2 vblank\n");
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[1]) {
-+					drm_handle_vblank(rdev->ddev, 1);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[1]))
-+					radeon_crtc_handle_vblank(rdev, 1);
-+				rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vblank\n");
-+
- 				break;
- 			case 1: /* D2 vline */
--				if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D2 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -7957,23 +7999,27 @@ restart_ih:
- 		case 3: /* D3 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D3 vblank */
--				if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[2]) {
--						drm_handle_vblank(rdev->ddev, 2);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[2]))
--						radeon_crtc_handle_vblank(rdev, 2);
--					rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D3 vblank\n");
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[2]) {
-+					drm_handle_vblank(rdev->ddev, 2);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[2]))
-+					radeon_crtc_handle_vblank(rdev, 2);
-+				rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D3 vblank\n");
-+
- 				break;
- 			case 1: /* D3 vline */
--				if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D3 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D3 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -7983,23 +8029,27 @@ restart_ih:
- 		case 4: /* D4 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D4 vblank */
--				if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[3]) {
--						drm_handle_vblank(rdev->ddev, 3);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[3]))
--						radeon_crtc_handle_vblank(rdev, 3);
--					rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D4 vblank\n");
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[3]) {
-+					drm_handle_vblank(rdev->ddev, 3);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[3]))
-+					radeon_crtc_handle_vblank(rdev, 3);
-+				rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D4 vblank\n");
-+
- 				break;
- 			case 1: /* D4 vline */
--				if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D4 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D4 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -8009,23 +8059,27 @@ restart_ih:
- 		case 5: /* D5 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D5 vblank */
--				if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[4]) {
--						drm_handle_vblank(rdev->ddev, 4);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[4]))
--						radeon_crtc_handle_vblank(rdev, 4);
--					rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D5 vblank\n");
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[4]) {
-+					drm_handle_vblank(rdev->ddev, 4);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[4]))
-+					radeon_crtc_handle_vblank(rdev, 4);
-+				rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D5 vblank\n");
-+
- 				break;
- 			case 1: /* D5 vline */
--				if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D5 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D5 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -8035,23 +8089,27 @@ restart_ih:
- 		case 6: /* D6 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D6 vblank */
--				if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[5]) {
--						drm_handle_vblank(rdev->ddev, 5);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[5]))
--						radeon_crtc_handle_vblank(rdev, 5);
--					rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D6 vblank\n");
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[5]) {
-+					drm_handle_vblank(rdev->ddev, 5);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[5]))
-+					radeon_crtc_handle_vblank(rdev, 5);
-+				rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D6 vblank\n");
-+
- 				break;
- 			case 1: /* D6 vline */
--				if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D6 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D6 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -8071,88 +8129,112 @@ restart_ih:
- 		case 42: /* HPD hotplug */
- 			switch (src_data) {
- 			case 0:
--				if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD1\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD1\n");
-+
- 				break;
- 			case 1:
--				if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD2\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD2\n");
-+
- 				break;
- 			case 2:
--				if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD3\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD3\n");
-+
- 				break;
- 			case 3:
--				if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD4\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD4\n");
-+
- 				break;
- 			case 4:
--				if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD5\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD5\n");
-+
- 				break;
- 			case 5:
--				if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD6\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD6\n");
-+
- 				break;
- 			case 6:
--				if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 1\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 1\n");
-+
- 				break;
- 			case 7:
--				if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 2\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 2\n");
-+
- 				break;
- 			case 8:
--				if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 3\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 3\n");
-+
- 				break;
- 			case 9:
--				if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 4\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 4\n");
-+
- 				break;
- 			case 10:
--				if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 5\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 5\n");
-+
- 				break;
- 			case 11:
--				if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
--					rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 6\n");
--				}
-+				if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 6\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
-index f86eb54..d16f2ee 100644
---- a/drivers/gpu/drm/radeon/cik_sdma.c
-+++ b/drivers/gpu/drm/radeon/cik_sdma.c
-@@ -268,6 +268,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
- 	}
- 	rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
- 	rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
-+
-+	/* FIXME use something else than big hammer but after few days can not
-+	 * seem to find good combination so reset SDMA blocks as it seems we
-+	 * do not shut them down properly. This fix hibernation and does not
-+	 * affect suspend to ram.
-+	 */
-+	WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
-+	(void)RREG32(SRBM_SOFT_RESET);
-+	udelay(50);
-+	WREG32(SRBM_SOFT_RESET, 0);
-+	(void)RREG32(SRBM_SOFT_RESET);
- }
- 
- /**
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index f848acf..feef136 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -4855,7 +4855,7 @@ restart_ih:
- 		return IRQ_NONE;
- 
- 	rptr = rdev->ih.rptr;
--	DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
-+	DRM_DEBUG("evergreen_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
- 
- 	/* Order reading of wptr vs. reading of IH ring data */
- 	rmb();
-@@ -4873,23 +4873,27 @@ restart_ih:
- 		case 1: /* D1 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D1 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[0]) {
--						drm_handle_vblank(rdev->ddev, 0);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[0]))
--						radeon_crtc_handle_vblank(rdev, 0);
--					rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D1 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[0]) {
-+					drm_handle_vblank(rdev->ddev, 0);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[0]))
-+					radeon_crtc_handle_vblank(rdev, 0);
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vblank\n");
-+
- 				break;
- 			case 1: /* D1 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D1 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4899,23 +4903,27 @@ restart_ih:
- 		case 2: /* D2 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D2 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[1]) {
--						drm_handle_vblank(rdev->ddev, 1);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[1]))
--						radeon_crtc_handle_vblank(rdev, 1);
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D2 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[1]) {
-+					drm_handle_vblank(rdev->ddev, 1);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[1]))
-+					radeon_crtc_handle_vblank(rdev, 1);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vblank\n");
-+
- 				break;
- 			case 1: /* D2 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D2 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4925,23 +4933,27 @@ restart_ih:
- 		case 3: /* D3 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D3 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[2]) {
--						drm_handle_vblank(rdev->ddev, 2);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[2]))
--						radeon_crtc_handle_vblank(rdev, 2);
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D3 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D3 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[2]) {
-+					drm_handle_vblank(rdev->ddev, 2);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[2]))
-+					radeon_crtc_handle_vblank(rdev, 2);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D3 vblank\n");
-+
- 				break;
- 			case 1: /* D3 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D3 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D3 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D3 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4951,23 +4963,27 @@ restart_ih:
- 		case 4: /* D4 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D4 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[3]) {
--						drm_handle_vblank(rdev->ddev, 3);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[3]))
--						radeon_crtc_handle_vblank(rdev, 3);
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D4 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D4 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[3]) {
-+					drm_handle_vblank(rdev->ddev, 3);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[3]))
-+					radeon_crtc_handle_vblank(rdev, 3);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D4 vblank\n");
-+
- 				break;
- 			case 1: /* D4 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D4 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D4 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D4 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4977,23 +4993,27 @@ restart_ih:
- 		case 5: /* D5 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D5 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[4]) {
--						drm_handle_vblank(rdev->ddev, 4);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[4]))
--						radeon_crtc_handle_vblank(rdev, 4);
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D5 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D5 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[4]) {
-+					drm_handle_vblank(rdev->ddev, 4);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[4]))
-+					radeon_crtc_handle_vblank(rdev, 4);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D5 vblank\n");
-+
- 				break;
- 			case 1: /* D5 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D5 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D5 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D5 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -5003,23 +5023,27 @@ restart_ih:
- 		case 6: /* D6 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D6 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[5]) {
--						drm_handle_vblank(rdev->ddev, 5);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[5]))
--						radeon_crtc_handle_vblank(rdev, 5);
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D6 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D6 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[5]) {
-+					drm_handle_vblank(rdev->ddev, 5);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[5]))
-+					radeon_crtc_handle_vblank(rdev, 5);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D6 vblank\n");
-+
- 				break;
- 			case 1: /* D6 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D6 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D6 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D6 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -5039,88 +5063,100 @@ restart_ih:
- 		case 42: /* HPD hotplug */
- 			switch (src_data) {
- 			case 0:
--				if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD1\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD1\n");
- 				break;
- 			case 1:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD2\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD2\n");
- 				break;
- 			case 2:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD3\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD3\n");
- 				break;
- 			case 3:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD4\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD4\n");
- 				break;
- 			case 4:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD5\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD5\n");
- 				break;
- 			case 5:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD6\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD6\n");
- 				break;
- 			case 6:
--				if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 1\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 1\n");
- 				break;
- 			case 7:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 2\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 2\n");
- 				break;
- 			case 8:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 3\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 3\n");
- 				break;
- 			case 9:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 4\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 4\n");
- 				break;
- 			case 10:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 5\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 5\n");
- 				break;
- 			case 11:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 6\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 6\n");
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -5130,46 +5166,52 @@ restart_ih:
- 		case 44: /* hdmi */
- 			switch (src_data) {
- 			case 0:
--				if (rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI0\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI0\n");
- 				break;
- 			case 1:
--				if (rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI1\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI1\n");
- 				break;
- 			case 2:
--				if (rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI2\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI2\n");
- 				break;
- 			case 3:
--				if (rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI3\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI3\n");
- 				break;
- 			case 4:
--				if (rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI4\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI4\n");
- 				break;
- 			case 5:
--				if (rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI5\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI5\n");
- 				break;
- 			default:
- 				DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 8f6d862..21e479f 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -4039,23 +4039,27 @@ restart_ih:
- 		case 1: /* D1 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D1 vblank */
--				if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[0]) {
--						drm_handle_vblank(rdev->ddev, 0);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[0]))
--						radeon_crtc_handle_vblank(rdev, 0);
--					rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D1 vblank\n");
-+				if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[0]) {
-+					drm_handle_vblank(rdev->ddev, 0);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[0]))
-+					radeon_crtc_handle_vblank(rdev, 0);
-+				rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vblank\n");
-+
- 				break;
- 			case 1: /* D1 vline */
--				if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D1 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT))
-+				    DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4065,23 +4069,27 @@ restart_ih:
- 		case 5: /* D2 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D2 vblank */
--				if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[1]) {
--						drm_handle_vblank(rdev->ddev, 1);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[1]))
--						radeon_crtc_handle_vblank(rdev, 1);
--					rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D2 vblank\n");
-+				if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[1]) {
-+					drm_handle_vblank(rdev->ddev, 1);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[1]))
-+					radeon_crtc_handle_vblank(rdev, 1);
-+				rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vblank\n");
-+
- 				break;
- 			case 1: /* D1 vline */
--				if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D2 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4101,46 +4109,53 @@ restart_ih:
- 		case 19: /* HPD/DAC hotplug */
- 			switch (src_data) {
- 			case 0:
--				if (rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD1\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT))
-+					DRM_DEBUG("IH: HPD1 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD1\n");
- 				break;
- 			case 1:
--				if (rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD2\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT))
-+					DRM_DEBUG("IH: HPD2 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD2\n");
- 				break;
- 			case 4:
--				if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD3\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT))
-+					DRM_DEBUG("IH: HPD3 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD3\n");
- 				break;
- 			case 5:
--				if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD4\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT))
-+					DRM_DEBUG("IH: HPD4 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD4\n");
- 				break;
- 			case 10:
--				if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD5\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT))
-+					DRM_DEBUG("IH: HPD5 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD5\n");
- 				break;
- 			case 12:
--				if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
--					rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD6\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT))
-+					DRM_DEBUG("IH: HPD6 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD6\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4150,18 +4165,22 @@ restart_ih:
- 		case 21: /* hdmi */
- 			switch (src_data) {
- 			case 4:
--				if (rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI0\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: HDMI0 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI0\n");
-+
- 				break;
- 			case 5:
--				if (rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG) {
--					rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG;
--					queue_hdmi = true;
--					DRM_DEBUG("IH: HDMI1\n");
--				}
-+				if (!(rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG))
-+					DRM_DEBUG("IH: HDMI1 - IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-+				queue_hdmi = true;
-+				DRM_DEBUG("IH: HDMI1\n");
-+
- 				break;
- 			default:
- 				DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
-index 25191f1..fa719c5 100644
---- a/drivers/gpu/drm/radeon/radeon_audio.c
-+++ b/drivers/gpu/drm/radeon/radeon_audio.c
-@@ -242,6 +242,13 @@ static struct radeon_audio_funcs dce6_dp_funcs = {
- 	.dpms = evergreen_dp_enable,
- };
- 
-+static void radeon_audio_enable(struct radeon_device *rdev,
-+				struct r600_audio_pin *pin, u8 enable_mask)
-+{
-+	if (rdev->audio.funcs->enable)
-+		rdev->audio.funcs->enable(rdev, pin, enable_mask);
-+}
-+
- static void radeon_audio_interface_init(struct radeon_device *rdev)
- {
- 	if (ASIC_IS_DCE6(rdev)) {
-@@ -307,7 +314,7 @@ int radeon_audio_init(struct radeon_device *rdev)
- 
- 	/* disable audio.  it will be set up later */
- 	for (i = 0; i < rdev->audio.num_pins; i++)
--		radeon_audio_enable(rdev, &rdev->audio.pin[i], false);
-+		radeon_audio_enable(rdev, &rdev->audio.pin[i], 0);
- 
- 	return 0;
- }
-@@ -443,13 +450,6 @@ static void radeon_audio_select_pin(struct drm_encoder *encoder)
- 		radeon_encoder->audio->select_pin(encoder);
- }
- 
--void radeon_audio_enable(struct radeon_device *rdev,
--	struct r600_audio_pin *pin, u8 enable_mask)
--{
--	if (rdev->audio.funcs->enable)
--		rdev->audio.funcs->enable(rdev, pin, enable_mask);
--}
--
- void radeon_audio_detect(struct drm_connector *connector,
- 			 enum drm_connector_status status)
- {
-@@ -469,22 +469,22 @@ void radeon_audio_detect(struct drm_connector *connector,
- 	dig = radeon_encoder->enc_priv;
- 
- 	if (status == connector_status_connected) {
--		struct radeon_connector *radeon_connector;
--		int sink_type;
--
- 		if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) {
- 			radeon_encoder->audio = NULL;
- 			return;
- 		}
- 
--		radeon_connector = to_radeon_connector(connector);
--		sink_type = radeon_dp_getsinktype(radeon_connector);
-+		if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
-+			struct radeon_connector *radeon_connector = to_radeon_connector(connector);
- 
--		if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort &&
--			sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT)
--			radeon_encoder->audio = rdev->audio.dp_funcs;
--		else
-+			if (radeon_dp_getsinktype(radeon_connector) ==
-+			    CONNECTOR_OBJECT_ID_DISPLAYPORT)
-+				radeon_encoder->audio = rdev->audio.dp_funcs;
-+			else
-+				radeon_encoder->audio = rdev->audio.hdmi_funcs;
-+		} else {
- 			radeon_encoder->audio = rdev->audio.hdmi_funcs;
-+		}
- 
- 		dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
- 		radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
-@@ -502,7 +502,7 @@ void radeon_audio_fini(struct radeon_device *rdev)
- 		return;
- 
- 	for (i = 0; i < rdev->audio.num_pins; i++)
--		radeon_audio_enable(rdev, &rdev->audio.pin[i], false);
-+		radeon_audio_enable(rdev, &rdev->audio.pin[i], 0);
- 
- 	rdev->audio.enabled = false;
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_audio.h b/drivers/gpu/drm/radeon/radeon_audio.h
-index c92d059..8438304 100644
---- a/drivers/gpu/drm/radeon/radeon_audio.h
-+++ b/drivers/gpu/drm/radeon/radeon_audio.h
-@@ -74,8 +74,6 @@ u32 radeon_audio_endpoint_rreg(struct radeon_device *rdev,
- void radeon_audio_endpoint_wreg(struct radeon_device *rdev,
- 	u32 offset,	u32 reg, u32 v);
- struct r600_audio_pin *radeon_audio_get_pin(struct drm_encoder *encoder);
--void radeon_audio_enable(struct radeon_device *rdev,
--	struct r600_audio_pin *pin, u8 enable_mask);
- void radeon_audio_fini(struct radeon_device *rdev);
- void radeon_audio_mode_set(struct drm_encoder *encoder,
- 	struct drm_display_mode *mode);
-diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
-index 45e5406..fa66174 100644
---- a/drivers/gpu/drm/radeon/radeon_cursor.c
-+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
-@@ -205,8 +205,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
- 			| (x << 16)
- 			| y));
- 		/* offset is from DISP(2)_BASE_ADDRESS */
--		WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset +
--								      (yorigin * 256)));
-+		WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset,
-+		       radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr +
-+		       yorigin * 256);
- 	}
- 
- 	radeon_crtc->cursor_x = x;
-@@ -227,51 +228,32 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
- 	return ret;
- }
- 
--static int radeon_set_cursor(struct drm_crtc *crtc, struct drm_gem_object *obj)
-+static void radeon_set_cursor(struct drm_crtc *crtc)
- {
- 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
- 	struct radeon_device *rdev = crtc->dev->dev_private;
--	struct radeon_bo *robj = gem_to_radeon_bo(obj);
--	uint64_t gpu_addr;
--	int ret;
--
--	ret = radeon_bo_reserve(robj, false);
--	if (unlikely(ret != 0))
--		goto fail;
--	/* Only 27 bit offset for legacy cursor */
--	ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM,
--				       ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27,
--				       &gpu_addr);
--	radeon_bo_unreserve(robj);
--	if (ret)
--		goto fail;
- 
- 	if (ASIC_IS_DCE4(rdev)) {
- 		WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
--		       upper_32_bits(gpu_addr));
-+		       upper_32_bits(radeon_crtc->cursor_addr));
- 		WREG32(EVERGREEN_CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
--		       gpu_addr & 0xffffffff);
-+		       lower_32_bits(radeon_crtc->cursor_addr));
- 	} else if (ASIC_IS_AVIVO(rdev)) {
- 		if (rdev->family >= CHIP_RV770) {
- 			if (radeon_crtc->crtc_id)
--				WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr));
-+				WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH,
-+				       upper_32_bits(radeon_crtc->cursor_addr));
- 			else
--				WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr));
-+				WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH,
-+				       upper_32_bits(radeon_crtc->cursor_addr));
- 		}
- 		WREG32(AVIVO_D1CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
--		       gpu_addr & 0xffffffff);
-+		       lower_32_bits(radeon_crtc->cursor_addr));
- 	} else {
--		radeon_crtc->legacy_cursor_offset = gpu_addr - radeon_crtc->legacy_display_base_addr;
- 		/* offset is from DISP(2)_BASE_ADDRESS */
--		WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, radeon_crtc->legacy_cursor_offset);
-+		WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset,
-+		       radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr);
- 	}
--
--	return 0;
--
--fail:
--	drm_gem_object_unreference_unlocked(obj);
--
--	return ret;
- }
- 
- int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
-@@ -283,7 +265,9 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
- 			    int32_t hot_y)
- {
- 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-+	struct radeon_device *rdev = crtc->dev->dev_private;
- 	struct drm_gem_object *obj;
-+	struct radeon_bo *robj;
- 	int ret;
- 
- 	if (!handle) {
-@@ -305,6 +289,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
- 		return -ENOENT;
- 	}
- 
-+	robj = gem_to_radeon_bo(obj);
-+	ret = radeon_bo_reserve(robj, false);
-+	if (ret != 0) {
-+		drm_gem_object_unreference_unlocked(obj);
-+		return ret;
-+	}
-+	/* Only 27 bit offset for legacy cursor */
-+	ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM,
-+				       ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27,
-+				       &radeon_crtc->cursor_addr);
-+	radeon_bo_unreserve(robj);
-+	if (ret) {
-+		DRM_ERROR("Failed to pin new cursor BO (%d)\n", ret);
-+		drm_gem_object_unreference_unlocked(obj);
-+		return ret;
-+	}
-+
- 	radeon_crtc->cursor_width = width;
- 	radeon_crtc->cursor_height = height;
- 
-@@ -323,13 +324,8 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
- 		radeon_crtc->cursor_hot_y = hot_y;
- 	}
- 
--	ret = radeon_set_cursor(crtc, obj);
--
--	if (ret)
--		DRM_ERROR("radeon_set_cursor returned %d, not changing cursor\n",
--			  ret);
--	else
--		radeon_show_cursor(crtc);
-+	radeon_set_cursor(crtc);
-+	radeon_show_cursor(crtc);
- 
- 	radeon_lock_cursor(crtc, false);
- 
-@@ -341,8 +337,7 @@ unpin:
- 			radeon_bo_unpin(robj);
- 			radeon_bo_unreserve(robj);
- 		}
--		if (radeon_crtc->cursor_bo != obj)
--			drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo);
-+		drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo);
- 	}
- 
- 	radeon_crtc->cursor_bo = obj;
-@@ -360,7 +355,6 @@ unpin:
- void radeon_cursor_reset(struct drm_crtc *crtc)
- {
- 	struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
--	int ret;
- 
- 	if (radeon_crtc->cursor_bo) {
- 		radeon_lock_cursor(crtc, true);
-@@ -368,12 +362,8 @@ void radeon_cursor_reset(struct drm_crtc *crtc)
- 		radeon_cursor_move_locked(crtc, radeon_crtc->cursor_x,
- 					  radeon_crtc->cursor_y);
- 
--		ret = radeon_set_cursor(crtc, radeon_crtc->cursor_bo);
--		if (ret)
--			DRM_ERROR("radeon_set_cursor returned %d, not showing "
--				  "cursor\n", ret);
--		else
--			radeon_show_cursor(crtc);
-+		radeon_set_cursor(crtc);
-+		radeon_show_cursor(crtc);
- 
- 		radeon_lock_cursor(crtc, false);
- 	}
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index a7fdfa4..604c44d 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -1572,11 +1572,21 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
- 		drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
- 	}
- 
--	/* unpin the front buffers */
-+	/* unpin the front buffers and cursors */
- 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-+		struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
- 		struct radeon_framebuffer *rfb = to_radeon_framebuffer(crtc->primary->fb);
- 		struct radeon_bo *robj;
- 
-+		if (radeon_crtc->cursor_bo) {
-+			struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo);
-+			r = radeon_bo_reserve(robj, false);
-+			if (r == 0) {
-+				radeon_bo_unpin(robj);
-+				radeon_bo_unreserve(robj);
-+			}
-+		}
-+
- 		if (rfb == NULL || rfb->obj == NULL) {
- 			continue;
- 		}
-@@ -1639,6 +1649,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
- {
- 	struct drm_connector *connector;
- 	struct radeon_device *rdev = dev->dev_private;
-+	struct drm_crtc *crtc;
- 	int r;
- 
- 	if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
-@@ -1678,6 +1689,27 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
- 
- 	radeon_restore_bios_scratch_regs(rdev);
- 
-+	/* pin cursors */
-+	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-+		struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-+
-+		if (radeon_crtc->cursor_bo) {
-+			struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo);
-+			r = radeon_bo_reserve(robj, false);
-+			if (r == 0) {
-+				/* Only 27 bit offset for legacy cursor */
-+				r = radeon_bo_pin_restricted(robj,
-+							     RADEON_GEM_DOMAIN_VRAM,
-+							     ASIC_IS_AVIVO(rdev) ?
-+							     0 : 1 << 27,
-+							     &radeon_crtc->cursor_addr);
-+				if (r != 0)
-+					DRM_ERROR("Failed to pin cursor BO (%d)\n", r);
-+				radeon_bo_unreserve(robj);
-+			}
-+		}
-+	}
-+
- 	/* init dig PHYs, disp eng pll */
- 	if (rdev->is_atom_bios) {
- 		radeon_atom_encoder_init(rdev);
-diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
-index aeb6767..634793e 100644
---- a/drivers/gpu/drm/radeon/radeon_fb.c
-+++ b/drivers/gpu/drm/radeon/radeon_fb.c
-@@ -257,7 +257,6 @@ static int radeonfb_create(struct drm_fb_helper *helper,
- 	}
- 
- 	info->par = rfbdev;
--	info->skip_vt_switch = true;
- 
- 	ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
- 	if (ret) {
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index 5450fa9..c4777c8 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -260,8 +260,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
- 			}
- 		}
- 	}
--	mb();
--	radeon_gart_tlb_flush(rdev);
-+	if (rdev->gart.ptr) {
-+		mb();
-+		radeon_gart_tlb_flush(rdev);
-+	}
- }
- 
- /**
-@@ -306,8 +308,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
- 			page_base += RADEON_GPU_PAGE_SIZE;
- 		}
- 	}
--	mb();
--	radeon_gart_tlb_flush(rdev);
-+	if (rdev->gart.ptr) {
-+		mb();
-+		radeon_gart_tlb_flush(rdev);
-+	}
- 	return 0;
- }
- 
-diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
-index ac3c131..186d0b7 100644
---- a/drivers/gpu/drm/radeon/radeon_gem.c
-+++ b/drivers/gpu/drm/radeon/radeon_gem.c
-@@ -36,6 +36,7 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
- 	if (robj) {
- 		if (robj->gem_base.import_attach)
- 			drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
-+		radeon_mn_unregister(robj);
- 		radeon_bo_unref(&robj);
- 	}
- }
-@@ -471,6 +472,7 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
- 		r = ret;
- 
- 	/* Flush HDP cache via MMIO if necessary */
-+	cur_placement = ACCESS_ONCE(robj->tbo.mem.mem_type);
- 	if (rdev->asic->mmio_hdp_flush &&
- 	    radeon_mem_type_to_domain(cur_placement) == RADEON_GEM_DOMAIN_VRAM)
- 		robj->rdev->asic->mmio_hdp_flush(rdev);
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index 7162c93..f682e53 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- 	struct drm_mode_config *mode_config = &dev->mode_config;
- 	struct drm_connector *connector;
- 
-+	mutex_lock(&mode_config->mutex);
- 	if (mode_config->num_connector) {
- 		list_for_each_entry(connector, &mode_config->connector_list, head)
- 			radeon_connector_hotplug(connector);
- 	}
-+	mutex_unlock(&mode_config->mutex);
- 	/* Just fire off a uevent and let userspace tell us what to do */
- 	drm_helper_hpd_irq_event(dev);
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
-index fa91a17..f01c797 100644
---- a/drivers/gpu/drm/radeon/radeon_mode.h
-+++ b/drivers/gpu/drm/radeon/radeon_mode.h
-@@ -343,7 +343,6 @@ struct radeon_crtc {
- 	int max_cursor_width;
- 	int max_cursor_height;
- 	uint32_t legacy_display_base_addr;
--	uint32_t legacy_cursor_offset;
- 	enum radeon_rmx_type rmx_type;
- 	u8 h_border;
- 	u8 v_border;
-diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
-index 318165d..6763627 100644
---- a/drivers/gpu/drm/radeon/radeon_object.c
-+++ b/drivers/gpu/drm/radeon/radeon_object.c
-@@ -75,7 +75,6 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
- 	bo = container_of(tbo, struct radeon_bo, tbo);
- 
- 	radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1);
--	radeon_mn_unregister(bo);
- 
- 	mutex_lock(&bo->rdev->gem.mutex);
- 	list_del_init(&bo->list);
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index 4c679b8..e15185b 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -6466,23 +6466,27 @@ restart_ih:
- 		case 1: /* D1 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D1 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[0]) {
--						drm_handle_vblank(rdev->ddev, 0);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[0]))
--						radeon_crtc_handle_vblank(rdev, 0);
--					rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D1 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[0]) {
-+					drm_handle_vblank(rdev->ddev, 0);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[0]))
-+					radeon_crtc_handle_vblank(rdev, 0);
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vblank\n");
-+
- 				break;
- 			case 1: /* D1 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D1 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D1 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6492,23 +6496,27 @@ restart_ih:
- 		case 2: /* D2 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D2 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[1]) {
--						drm_handle_vblank(rdev->ddev, 1);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[1]))
--						radeon_crtc_handle_vblank(rdev, 1);
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D2 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[1]) {
-+					drm_handle_vblank(rdev->ddev, 1);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[1]))
-+					radeon_crtc_handle_vblank(rdev, 1);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vblank\n");
-+
- 				break;
- 			case 1: /* D2 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D2 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D2 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6518,23 +6526,27 @@ restart_ih:
- 		case 3: /* D3 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D3 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[2]) {
--						drm_handle_vblank(rdev->ddev, 2);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[2]))
--						radeon_crtc_handle_vblank(rdev, 2);
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D3 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[2]) {
-+					drm_handle_vblank(rdev->ddev, 2);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[2]))
-+					radeon_crtc_handle_vblank(rdev, 2);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D3 vblank\n");
-+
- 				break;
- 			case 1: /* D3 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D3 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D3 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6544,23 +6556,27 @@ restart_ih:
- 		case 4: /* D4 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D4 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[3]) {
--						drm_handle_vblank(rdev->ddev, 3);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[3]))
--						radeon_crtc_handle_vblank(rdev, 3);
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D4 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[3]) {
-+					drm_handle_vblank(rdev->ddev, 3);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[3]))
-+					radeon_crtc_handle_vblank(rdev, 3);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D4 vblank\n");
-+
- 				break;
- 			case 1: /* D4 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D4 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D4 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6570,23 +6586,27 @@ restart_ih:
- 		case 5: /* D5 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D5 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[4]) {
--						drm_handle_vblank(rdev->ddev, 4);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[4]))
--						radeon_crtc_handle_vblank(rdev, 4);
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D5 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[4]) {
-+					drm_handle_vblank(rdev->ddev, 4);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[4]))
-+					radeon_crtc_handle_vblank(rdev, 4);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D5 vblank\n");
-+
- 				break;
- 			case 1: /* D5 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D5 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D5 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6596,23 +6616,27 @@ restart_ih:
- 		case 6: /* D6 vblank/vline */
- 			switch (src_data) {
- 			case 0: /* D6 vblank */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
--					if (rdev->irq.crtc_vblank_int[5]) {
--						drm_handle_vblank(rdev->ddev, 5);
--						rdev->pm.vblank_sync = true;
--						wake_up(&rdev->irq.vblank_queue);
--					}
--					if (atomic_read(&rdev->irq.pflip[5]))
--						radeon_crtc_handle_vblank(rdev, 5);
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
--					DRM_DEBUG("IH: D6 vblank\n");
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				if (rdev->irq.crtc_vblank_int[5]) {
-+					drm_handle_vblank(rdev->ddev, 5);
-+					rdev->pm.vblank_sync = true;
-+					wake_up(&rdev->irq.vblank_queue);
- 				}
-+				if (atomic_read(&rdev->irq.pflip[5]))
-+					radeon_crtc_handle_vblank(rdev, 5);
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-+				DRM_DEBUG("IH: D6 vblank\n");
-+
- 				break;
- 			case 1: /* D6 vline */
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
--					DRM_DEBUG("IH: D6 vline\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-+				DRM_DEBUG("IH: D6 vline\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6632,88 +6656,112 @@ restart_ih:
- 		case 42: /* HPD hotplug */
- 			switch (src_data) {
- 			case 0:
--				if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD1\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD1\n");
-+
- 				break;
- 			case 1:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD2\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD2\n");
-+
- 				break;
- 			case 2:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD3\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD3\n");
-+
- 				break;
- 			case 3:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD4\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD4\n");
-+
- 				break;
- 			case 4:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD5\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD5\n");
-+
- 				break;
- 			case 5:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
--					queue_hotplug = true;
--					DRM_DEBUG("IH: HPD6\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-+				queue_hotplug = true;
-+				DRM_DEBUG("IH: HPD6\n");
-+
- 				break;
- 			case 6:
--				if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 1\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 1\n");
-+
- 				break;
- 			case 7:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 2\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 2\n");
-+
- 				break;
- 			case 8:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 3\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 3\n");
-+
- 				break;
- 			case 9:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 4\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 4\n");
-+
- 				break;
- 			case 10:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 5\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 5\n");
-+
- 				break;
- 			case 11:
--				if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
--					rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
--					queue_dp = true;
--					DRM_DEBUG("IH: HPD_RX 6\n");
--				}
-+				if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
-+					DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+				rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-+				queue_dp = true;
-+				DRM_DEBUG("IH: HPD_RX 6\n");
-+
- 				break;
- 			default:
- 				DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index ff8b83f..9dfcede 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2925,6 +2925,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- 	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- 	{ 0, 0, 0, 0 },
- };
- 
-diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
-index eb2282c..eba5f8a 100644
---- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
-+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
-@@ -54,55 +54,56 @@ static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj)
- 		       &rk_obj->dma_attrs);
- }
- 
--int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
--			  struct vm_area_struct *vma)
-+static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
-+					struct vm_area_struct *vma)
-+
- {
-+	int ret;
- 	struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj);
- 	struct drm_device *drm = obj->dev;
--	unsigned long vm_size;
- 
--	vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
--	vm_size = vma->vm_end - vma->vm_start;
--
--	if (vm_size > obj->size)
--		return -EINVAL;
-+	/*
-+	 * dma_alloc_attrs() allocated a struct page table for rk_obj, so clear
-+	 * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
-+	 */
-+	vma->vm_flags &= ~VM_PFNMAP;
- 
--	return dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
-+	ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
- 			     obj->size, &rk_obj->dma_attrs);
-+	if (ret)
-+		drm_gem_vm_close(vma);
-+
-+	return ret;
- }
- 
--/* drm driver mmap file operations */
--int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
-+int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
-+			  struct vm_area_struct *vma)
- {
--	struct drm_file *priv = filp->private_data;
--	struct drm_device *dev = priv->minor->dev;
--	struct drm_gem_object *obj;
--	struct drm_vma_offset_node *node;
-+	struct drm_device *drm = obj->dev;
- 	int ret;
- 
--	if (drm_device_is_unplugged(dev))
--		return -ENODEV;
-+	mutex_lock(&drm->struct_mutex);
-+	ret = drm_gem_mmap_obj(obj, obj->size, vma);
-+	mutex_unlock(&drm->struct_mutex);
-+	if (ret)
-+		return ret;
- 
--	mutex_lock(&dev->struct_mutex);
-+	return rockchip_drm_gem_object_mmap(obj, vma);
-+}
- 
--	node = drm_vma_offset_exact_lookup(dev->vma_offset_manager,
--					   vma->vm_pgoff,
--					   vma_pages(vma));
--	if (!node) {
--		mutex_unlock(&dev->struct_mutex);
--		DRM_ERROR("failed to find vma node.\n");
--		return -EINVAL;
--	} else if (!drm_vma_node_is_allowed(node, filp)) {
--		mutex_unlock(&dev->struct_mutex);
--		return -EACCES;
--	}
-+/* drm driver mmap file operations */
-+int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
-+{
-+	struct drm_gem_object *obj;
-+	int ret;
- 
--	obj = container_of(node, struct drm_gem_object, vma_node);
--	ret = rockchip_gem_mmap_buf(obj, vma);
-+	ret = drm_gem_mmap(filp, vma);
-+	if (ret)
-+		return ret;
- 
--	mutex_unlock(&dev->struct_mutex);
-+	obj = vma->vm_private_data;
- 
--	return ret;
-+	return rockchip_drm_gem_object_mmap(obj, vma);
- }
- 
- struct rockchip_gem_object *
-diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
-index d6b55e3..a43a836 100644
---- a/drivers/gpu/drm/tegra/dpaux.c
-+++ b/drivers/gpu/drm/tegra/dpaux.c
-@@ -72,34 +72,32 @@ static inline void tegra_dpaux_writel(struct tegra_dpaux *dpaux,
- static void tegra_dpaux_write_fifo(struct tegra_dpaux *dpaux, const u8 *buffer,
- 				   size_t size)
- {
--	unsigned long offset = DPAUX_DP_AUXDATA_WRITE(0);
- 	size_t i, j;
- 
--	for (i = 0; i < size; i += 4) {
--		size_t num = min_t(size_t, size - i, 4);
-+	for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
-+		size_t num = min_t(size_t, size - i * 4, 4);
- 		unsigned long value = 0;
- 
- 		for (j = 0; j < num; j++)
--			value |= buffer[i + j] << (j * 8);
-+			value |= buffer[i * 4 + j] << (j * 8);
- 
--		tegra_dpaux_writel(dpaux, value, offset++);
-+		tegra_dpaux_writel(dpaux, value, DPAUX_DP_AUXDATA_WRITE(i));
- 	}
- }
- 
- static void tegra_dpaux_read_fifo(struct tegra_dpaux *dpaux, u8 *buffer,
- 				  size_t size)
- {
--	unsigned long offset = DPAUX_DP_AUXDATA_READ(0);
- 	size_t i, j;
- 
--	for (i = 0; i < size; i += 4) {
--		size_t num = min_t(size_t, size - i, 4);
-+	for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
-+		size_t num = min_t(size_t, size - i * 4, 4);
- 		unsigned long value;
- 
--		value = tegra_dpaux_readl(dpaux, offset++);
-+		value = tegra_dpaux_readl(dpaux, DPAUX_DP_AUXDATA_READ(i));
- 
- 		for (j = 0; j < num; j++)
--			buffer[i + j] = value >> (j * 8);
-+			buffer[i * 4 + j] = value >> (j * 8);
- 	}
- }
- 
-diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
-index 7a207ca..6394547 100644
---- a/drivers/gpu/drm/vgem/vgem_drv.c
-+++ b/drivers/gpu/drm/vgem/vgem_drv.c
-@@ -328,6 +328,8 @@ static int __init vgem_init(void)
- 		goto out;
- 	}
- 
-+	drm_dev_set_unique(vgem_device, "vgem");
-+
- 	ret  = drm_dev_register(vgem_device, 0);
- 
- 	if (ret)
-diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
-index d219c06..972444a 100644
---- a/drivers/hwmon/mcp3021.c
-+++ b/drivers/hwmon/mcp3021.c
-@@ -31,14 +31,11 @@
- /* output format */
- #define MCP3021_SAR_SHIFT	2
- #define MCP3021_SAR_MASK	0x3ff
--
- #define MCP3021_OUTPUT_RES	10	/* 10-bit resolution */
--#define MCP3021_OUTPUT_SCALE	4
- 
- #define MCP3221_SAR_SHIFT	0
- #define MCP3221_SAR_MASK	0xfff
- #define MCP3221_OUTPUT_RES	12	/* 12-bit resolution */
--#define MCP3221_OUTPUT_SCALE	1
- 
- enum chips {
- 	mcp3021,
-@@ -54,7 +51,6 @@ struct mcp3021_data {
- 	u16 sar_shift;
- 	u16 sar_mask;
- 	u8 output_res;
--	u8 output_scale;
- };
- 
- static int mcp3021_read16(struct i2c_client *client)
-@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
- 
- static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
- {
--	if (val == 0)
--		return 0;
--
--	val = val * data->output_scale - data->output_scale / 2;
--
--	return val * DIV_ROUND_CLOSEST(data->vdd,
--			(1 << data->output_res) * data->output_scale);
-+	return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
- }
- 
- static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
-@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
- 		data->sar_shift = MCP3021_SAR_SHIFT;
- 		data->sar_mask = MCP3021_SAR_MASK;
- 		data->output_res = MCP3021_OUTPUT_RES;
--		data->output_scale = MCP3021_OUTPUT_SCALE;
- 		break;
- 
- 	case mcp3221:
- 		data->sar_shift = MCP3221_SAR_SHIFT;
- 		data->sar_mask = MCP3221_SAR_MASK;
- 		data->output_res = MCP3221_OUTPUT_RES;
--		data->output_scale = MCP3221_OUTPUT_SCALE;
- 		break;
- 	}
- 
-diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
-index 5576579..28fcb2e 100644
---- a/drivers/hwmon/nct7802.c
-+++ b/drivers/hwmon/nct7802.c
-@@ -547,7 +547,7 @@ static umode_t nct7802_temp_is_visible(struct kobject *kobj,
- 	if (index >= 9 && index < 18 &&
- 	    (reg & 0x0c) != 0x04 && (reg & 0x0c) != 0x08)	/* RD2 */
- 		return 0;
--	if (index >= 18 && index < 27 && (reg & 0x30) != 0x10)	/* RD3 */
-+	if (index >= 18 && index < 27 && (reg & 0x30) != 0x20)	/* RD3 */
- 		return 0;
- 	if (index >= 27 && index < 35)				/* local */
- 		return attr->mode;
-diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
-index ff23d1b..9bd10a9 100644
---- a/drivers/i2c/busses/i2c-at91.c
-+++ b/drivers/i2c/busses/i2c-at91.c
-@@ -65,6 +65,9 @@
- #define	AT91_TWI_UNRE		0x0080	/* Underrun Error */
- #define	AT91_TWI_NACK		0x0100	/* Not Acknowledged */
- 
-+#define	AT91_TWI_INT_MASK \
-+	(AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
-+
- #define	AT91_TWI_IER		0x0024	/* Interrupt Enable Register */
- #define	AT91_TWI_IDR		0x0028	/* Interrupt Disable Register */
- #define	AT91_TWI_IMR		0x002c	/* Interrupt Mask Register */
-@@ -119,13 +122,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
- 
- static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
- {
--	at91_twi_write(dev, AT91_TWI_IDR,
--		       AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
-+	at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
- }
- 
- static void at91_twi_irq_save(struct at91_twi_dev *dev)
- {
--	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
-+	dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
- 	at91_disable_twi_interrupts(dev);
- }
- 
-@@ -215,6 +217,14 @@ static void at91_twi_write_data_dma_callback(void *data)
- 	dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
- 			 dev->buf_len, DMA_TO_DEVICE);
- 
-+	/*
-+	 * When this callback is called, THR/TX FIFO is likely not to be empty
-+	 * yet. So we have to wait for TXCOMP or NACK bits to be set into the
-+	 * Status Register to be sure that the STOP bit has been sent and the
-+	 * transfer is completed. The NACK interrupt has already been enabled,
-+	 * we just have to enable TXCOMP one.
-+	 */
-+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- 	at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
- }
- 
-@@ -309,7 +319,7 @@ static void at91_twi_read_data_dma_callback(void *data)
- 	/* The last two bytes have to be read without using dma */
- 	dev->buf += dev->buf_len - 2;
- 	dev->buf_len = 2;
--	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
-+	at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
- }
- 
- static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
-@@ -370,7 +380,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
- 	/* catch error flags */
- 	dev->transfer_status |= status;
- 
--	if (irqstatus & AT91_TWI_TXCOMP) {
-+	if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
- 		at91_disable_twi_interrupts(dev);
- 		complete(&dev->cmd_complete);
- 	}
-@@ -384,6 +394,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- 	unsigned long time_left;
- 	bool has_unre_flag = dev->pdata->has_unre_flag;
- 
-+	/*
-+	 * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
-+	 * read flag but shows the state of the transmission at the time the
-+	 * Status Register is read. According to the programmer datasheet,
-+	 * TXCOMP is set when both holding register and internal shifter are
-+	 * empty and STOP condition has been sent.
-+	 * Consequently, we should enable NACK interrupt rather than TXCOMP to
-+	 * detect transmission failure.
-+	 *
-+	 * Besides, the TXCOMP bit is already set before the i2c transaction
-+	 * has been started. For read transactions, this bit is cleared when
-+	 * writing the START bit into the Control Register. So the
-+	 * corresponding interrupt can safely be enabled just after.
-+	 * However for write transactions managed by the CPU, we first write
-+	 * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
-+	 * interrupt. If TXCOMP interrupt were enabled before writing into THR,
-+	 * the interrupt handler would be called immediately and the i2c command
-+	 * would be reported as completed.
-+	 * Also when a write transaction is managed by the DMA controller,
-+	 * enabling the TXCOMP interrupt in this function may lead to a race
-+	 * condition since we don't know whether the TXCOMP interrupt is enabled
-+	 * before or after the DMA has started to write into THR. So the TXCOMP
-+	 * interrupt is enabled later by at91_twi_write_data_dma_callback().
-+	 * Immediately after in that DMA callback, we still need to send the
-+	 * STOP condition manually writing the corresponding bit into the
-+	 * Control Register.
-+	 */
-+
- 	dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
- 		(dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
- 
-@@ -414,26 +452,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- 		 * seems to be the best solution.
- 		 */
- 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- 			at91_twi_read_data_dma(dev);
--			/*
--			 * It is important to enable TXCOMP irq here because
--			 * doing it only when transferring the last two bytes
--			 * will mask NACK errors since TXCOMP is set when a
--			 * NACK occurs.
--			 */
--			at91_twi_write(dev, AT91_TWI_IER,
--			       AT91_TWI_TXCOMP);
--		} else
-+		} else {
- 			at91_twi_write(dev, AT91_TWI_IER,
--			       AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
-+				       AT91_TWI_TXCOMP |
-+				       AT91_TWI_NACK |
-+				       AT91_TWI_RXRDY);
-+		}
- 	} else {
- 		if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- 			at91_twi_write_data_dma(dev);
--			at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- 		} else {
- 			at91_twi_write_next_byte(dev);
- 			at91_twi_write(dev, AT91_TWI_IER,
--				AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
-+				       AT91_TWI_TXCOMP |
-+				       AT91_TWI_NACK |
-+				       AT91_TWI_TXRDY);
- 		}
- 	}
- 
-diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
-index 06cc1ff..2ba7c0f 100644
---- a/drivers/i2c/i2c-mux.c
-+++ b/drivers/i2c/i2c-mux.c
-@@ -51,7 +51,7 @@ static int i2c_mux_master_xfer(struct i2c_adapter *adap,
- 
- 	ret = priv->select(parent, priv->mux_priv, priv->chan_id);
- 	if (ret >= 0)
--		ret = parent->algo->master_xfer(parent, msgs, num);
-+		ret = __i2c_transfer(parent, msgs, num);
- 	if (priv->deselect)
- 		priv->deselect(parent, priv->mux_priv, priv->chan_id);
- 
-@@ -144,6 +144,7 @@ struct i2c_adapter *i2c_add_mux_adapter(struct i2c_adapter *parent,
- 	priv->adap.dev.parent = &parent->dev;
- 	priv->adap.retries = parent->retries;
- 	priv->adap.timeout = parent->timeout;
-+	priv->adap.quirks = parent->quirks;
- 
- 	/* Sanity check on class */
- 	if (i2c_mux_parent_classes(parent) & class)
-diff --git a/drivers/i2c/muxes/i2c-mux-pca9541.c b/drivers/i2c/muxes/i2c-mux-pca9541.c
-index cb77277..0c8d4d2 100644
---- a/drivers/i2c/muxes/i2c-mux-pca9541.c
-+++ b/drivers/i2c/muxes/i2c-mux-pca9541.c
-@@ -104,7 +104,7 @@ static int pca9541_reg_write(struct i2c_client *client, u8 command, u8 val)
- 		buf[0] = command;
- 		buf[1] = val;
- 		msg.buf = buf;
--		ret = adap->algo->master_xfer(adap, &msg, 1);
-+		ret = __i2c_transfer(adap, &msg, 1);
- 	} else {
- 		union i2c_smbus_data data;
- 
-@@ -144,7 +144,7 @@ static int pca9541_reg_read(struct i2c_client *client, u8 command)
- 				.buf = &val
- 			}
- 		};
--		ret = adap->algo->master_xfer(adap, msg, 2);
-+		ret = __i2c_transfer(adap, msg, 2);
- 		if (ret == 2)
- 			ret = val;
- 		else if (ret >= 0)
-diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
-index bea0d2d..ea4aa9d 100644
---- a/drivers/i2c/muxes/i2c-mux-pca954x.c
-+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
-@@ -134,7 +134,7 @@ static int pca954x_reg_write(struct i2c_adapter *adap,
- 		msg.len = 1;
- 		buf[0] = val;
- 		msg.buf = buf;
--		ret = adap->algo->master_xfer(adap, &msg, 1);
-+		ret = __i2c_transfer(adap, &msg, 1);
- 	} else {
- 		union i2c_smbus_data data;
- 		ret = adap->algo->smbus_xfer(adap, client->addr,
-diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
-index 73e8773..bf827d0 100644
---- a/drivers/iio/accel/bmc150-accel.c
-+++ b/drivers/iio/accel/bmc150-accel.c
-@@ -1465,7 +1465,7 @@ static void bmc150_accel_unregister_triggers(struct bmc150_accel_data *data,
- {
- 	int i;
- 
--	for (i = from; i >= 0; i++) {
-+	for (i = from; i >= 0; i--) {
- 		if (data->triggers[i].indio_trig) {
- 			iio_trigger_unregister(data->triggers[i].indio_trig);
- 			data->triggers[i].indio_trig = NULL;
-diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
-index e36a73e..1bcb65b 100644
---- a/drivers/iio/adc/Kconfig
-+++ b/drivers/iio/adc/Kconfig
-@@ -146,8 +146,7 @@ config DA9150_GPADC
- 
- config CC10001_ADC
- 	tristate "Cosmic Circuits 10001 ADC driver"
--	depends on HAVE_CLK || REGULATOR
--	depends on HAS_IOMEM
-+	depends on HAS_IOMEM && HAVE_CLK && REGULATOR
- 	select IIO_BUFFER
- 	select IIO_TRIGGERED_BUFFER
- 	help
-diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
-index 8a0eb4a..7b40925 100644
---- a/drivers/iio/adc/at91_adc.c
-+++ b/drivers/iio/adc/at91_adc.c
-@@ -182,7 +182,7 @@ struct at91_adc_caps {
- 	u8	ts_pen_detect_sensitivity;
- 
- 	/* startup time calculate function */
--	u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
-+	u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
- 
- 	u8	num_channels;
- 	struct at91_adc_reg_desc registers;
-@@ -201,7 +201,7 @@ struct at91_adc_state {
- 	u8			num_channels;
- 	void __iomem		*reg_base;
- 	struct at91_adc_reg_desc *registers;
--	u8			startup_time;
-+	u32			startup_time;
- 	u8			sample_hold_time;
- 	bool			sleep_mode;
- 	struct iio_trigger	**trig;
-@@ -779,7 +779,7 @@ ret:
- 	return ret;
- }
- 
--static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
- {
- 	/*
- 	 * Number of ticks needed to cover the startup time of the ADC
-@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
- 	return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
- }
- 
--static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
- {
- 	/*
- 	 * For sama5d3x and at91sam9x5, the formula changes to:
-diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
-index 8d4e019..9c311c1 100644
---- a/drivers/iio/adc/rockchip_saradc.c
-+++ b/drivers/iio/adc/rockchip_saradc.c
-@@ -349,3 +349,7 @@ static struct platform_driver rockchip_saradc_driver = {
- };
- 
- module_platform_driver(rockchip_saradc_driver);
-+
-+MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>");
-+MODULE_DESCRIPTION("Rockchip SARADC driver");
-+MODULE_LICENSE("GPL v2");
-diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
-index 94c5f05..4caecbe 100644
---- a/drivers/iio/adc/twl4030-madc.c
-+++ b/drivers/iio/adc/twl4030-madc.c
-@@ -835,7 +835,8 @@ static int twl4030_madc_probe(struct platform_device *pdev)
- 	irq = platform_get_irq(pdev, 0);
- 	ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
- 				   twl4030_madc_threaded_irq_handler,
--				   IRQF_TRIGGER_RISING, "twl4030_madc", madc);
-+				   IRQF_TRIGGER_RISING | IRQF_ONESHOT,
-+				   "twl4030_madc", madc);
- 	if (ret) {
- 		dev_err(&pdev->dev, "could not request irq\n");
- 		goto err_i2c;
-diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
-index 610fc98..5955110 100644
---- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
-+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
-@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
- 	s32 poll_value = 0;
- 
- 	if (state) {
-+		if (!atomic_read(&st->user_requested_state))
-+			return 0;
- 		if (sensor_hub_device_open(st->hsdev))
- 			return -EIO;
- 
-@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
- 
- 		poll_value = hid_sensor_read_poll_value(st);
- 	} else {
--		if (!atomic_dec_and_test(&st->data_ready))
-+		int val;
-+
-+		val = atomic_dec_if_positive(&st->data_ready);
-+		if (val < 0)
- 			return 0;
-+
- 		sensor_hub_device_close(st->hsdev);
- 		state_val = hid_sensor_get_usage_index(st->hsdev,
- 			st->power_state.report_id,
-@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state);
- 
- int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
- {
-+
- #ifdef CONFIG_PM
- 	int ret;
- 
-+	atomic_set(&st->user_requested_state, state);
- 	if (state)
- 		ret = pm_runtime_get_sync(&st->pdev->dev);
- 	else {
-@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
- 
-  	return 0;
- #else
-+	atomic_set(&st->user_requested_state, state);
- 	return _hid_sensor_power_state(st, state);
- #endif
- }
-diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
-index 61bb9d4..e98428d 100644
---- a/drivers/iio/dac/ad5624r_spi.c
-+++ b/drivers/iio/dac/ad5624r_spi.c
-@@ -22,7 +22,7 @@
- #include "ad5624r.h"
- 
- static int ad5624r_spi_write(struct spi_device *spi,
--			     u8 cmd, u8 addr, u16 val, u8 len)
-+			     u8 cmd, u8 addr, u16 val, u8 shift)
- {
- 	u32 data;
- 	u8 msg[3];
-@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
- 	 * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
- 	 * for the AD5664R, AD5644R, and AD5624R, respectively.
- 	 */
--	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
-+	data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
- 	msg[0] = data >> 16;
- 	msg[1] = data >> 8;
- 	msg[2] = data;
-diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
-index 17d4bb1..65ce868 100644
---- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
-+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
-@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
- 	return -EINVAL;
- }
- 
-+static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
-+				 struct iio_chan_spec const *chan, long mask)
-+{
-+	switch (mask) {
-+	case IIO_CHAN_INFO_SCALE:
-+		switch (chan->type) {
-+		case IIO_ANGL_VEL:
-+			return IIO_VAL_INT_PLUS_NANO;
-+		default:
-+			return IIO_VAL_INT_PLUS_MICRO;
-+		}
-+	default:
-+		return IIO_VAL_INT_PLUS_MICRO;
-+	}
-+
-+	return -EINVAL;
-+}
- static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
- {
- 	int result, i;
-@@ -696,6 +713,7 @@ static const struct iio_info mpu_info = {
- 	.driver_module = THIS_MODULE,
- 	.read_raw = &inv_mpu6050_read_raw,
- 	.write_raw = &inv_mpu6050_write_raw,
-+	.write_raw_get_fmt = &inv_write_raw_get_fmt,
- 	.attrs = &inv_attribute_group,
- 	.validate_trigger = inv_mpu6050_validate_trigger,
- };
-diff --git a/drivers/iio/light/cm3323.c b/drivers/iio/light/cm3323.c
-index 869033e..a1d4905 100644
---- a/drivers/iio/light/cm3323.c
-+++ b/drivers/iio/light/cm3323.c
-@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3323_data *data, int val, int val2)
- 	for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) {
- 		if (val == cm3323_int_time[i].val &&
- 		    val2 == cm3323_int_time[i].val2) {
--			reg_conf = data->reg_conf;
-+			reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK;
- 			reg_conf |= i << CM3323_CONF_IT_SHIFT;
- 
- 			ret = i2c_smbus_write_word_data(data->client,
-diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c
-index 71c2bde..f8b1df0 100644
---- a/drivers/iio/light/tcs3414.c
-+++ b/drivers/iio/light/tcs3414.c
-@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_dev *indio_dev,
- 		if (val != 0)
- 			return -EINVAL;
- 		for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) {
--			if (val == tcs3414_times[i] * 1000) {
-+			if (val2 == tcs3414_times[i] * 1000) {
- 				data->timing &= ~TCS3414_INTEG_MASK;
- 				data->timing |= i;
- 				return i2c_smbus_write_byte_data(
-diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
-index fa40f6d..bd26a48 100644
---- a/drivers/iio/proximity/sx9500.c
-+++ b/drivers/iio/proximity/sx9500.c
-@@ -206,7 +206,7 @@ static int sx9500_read_proximity(struct sx9500_data *data,
- 	if (ret < 0)
- 		return ret;
- 
--	*val = 32767 - (s16)be16_to_cpu(regval);
-+	*val = be16_to_cpu(regval);
- 
- 	return IIO_VAL_INT;
- }
-diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
-index 84a0789..7a80509 100644
---- a/drivers/iio/temperature/tmp006.c
-+++ b/drivers/iio/temperature/tmp006.c
-@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
- 	struct tmp006_data *data = iio_priv(indio_dev);
- 	int i;
- 
-+	if (mask != IIO_CHAN_INFO_SAMP_FREQ)
-+		return -EINVAL;
-+
- 	for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
- 		if ((val == tmp006_freqs[i][0]) &&
- 		    (val2 == tmp006_freqs[i][1])) {
-diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
-index 9dcb660..219f212 100644
---- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
-+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
-@@ -679,7 +679,6 @@ err:
- 		ocrdma_release_ucontext_pd(uctx);
- 	} else {
- 		status = _ocrdma_dealloc_pd(dev, pd);
--		kfree(pd);
- 	}
- exit:
- 	return ERR_PTR(status);
-diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
-index 135a090..c90118e 100644
---- a/drivers/md/bitmap.c
-+++ b/drivers/md/bitmap.c
-@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
- 	bitmap_super_t *sb;
- 	unsigned long chunksize, daemon_sleep, write_behind;
- 
--	bitmap->storage.sb_page = alloc_page(GFP_KERNEL);
-+	bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
- 	if (bitmap->storage.sb_page == NULL)
- 		return -ENOMEM;
- 	bitmap->storage.sb_page->index = 0;
-@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
- 	sb->state = cpu_to_le32(bitmap->flags);
- 	bitmap->events_cleared = bitmap->mddev->events;
- 	sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
-+	bitmap->mddev->bitmap_info.nodes = 0;
- 
- 	kunmap_atomic(sb);
- 
-@@ -611,8 +612,16 @@ re_read:
- 	daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
- 	write_behind = le32_to_cpu(sb->write_behind);
- 	sectors_reserved = le32_to_cpu(sb->sectors_reserved);
--	nodes = le32_to_cpu(sb->nodes);
--	strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64);
-+	/* XXX: This is a hack to ensure that we don't use clustering
-+	 *  in case:
-+	 *	- dm-raid is in use and
-+	 *	- the nodes written in bitmap_sb is erroneous.
-+	 */
-+	if (!bitmap->mddev->sync_super) {
-+		nodes = le32_to_cpu(sb->nodes);
-+		strlcpy(bitmap->mddev->bitmap_info.cluster_name,
-+				sb->cluster_name, 64);
-+	}
- 
- 	/* verify that the bitmap-specific fields are valid */
- 	if (sb->magic != cpu_to_le32(BITMAP_MAGIC))
-diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
-index b04d1f9..004e463 100644
---- a/drivers/md/dm-cache-policy-cleaner.c
-+++ b/drivers/md/dm-cache-policy-cleaner.c
-@@ -171,7 +171,8 @@ static void remove_cache_hash_entry(struct wb_cache_entry *e)
- /* Public interface (see dm-cache-policy.h */
- static int wb_map(struct dm_cache_policy *pe, dm_oblock_t oblock,
- 		  bool can_block, bool can_migrate, bool discarded_oblock,
--		  struct bio *bio, struct policy_result *result)
-+		  struct bio *bio, struct policy_locker *locker,
-+		  struct policy_result *result)
- {
- 	struct policy *p = to_policy(pe);
- 	struct wb_cache_entry *e;
-diff --git a/drivers/md/dm-cache-policy-internal.h b/drivers/md/dm-cache-policy-internal.h
-index 2256a1f..c198e6d 100644
---- a/drivers/md/dm-cache-policy-internal.h
-+++ b/drivers/md/dm-cache-policy-internal.h
-@@ -16,9 +16,10 @@
-  */
- static inline int policy_map(struct dm_cache_policy *p, dm_oblock_t oblock,
- 			     bool can_block, bool can_migrate, bool discarded_oblock,
--			     struct bio *bio, struct policy_result *result)
-+			     struct bio *bio, struct policy_locker *locker,
-+			     struct policy_result *result)
- {
--	return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, result);
-+	return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, locker, result);
- }
- 
- static inline int policy_lookup(struct dm_cache_policy *p, dm_oblock_t oblock, dm_cblock_t *cblock)
-diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
-index 3ddd116..515d44b 100644
---- a/drivers/md/dm-cache-policy-mq.c
-+++ b/drivers/md/dm-cache-policy-mq.c
-@@ -693,9 +693,10 @@ static void requeue(struct mq_policy *mq, struct entry *e)
-  * - set the hit count to a hard coded value other than 1, eg, is it better
-  *   if it goes in at level 2?
-  */
--static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock)
-+static int demote_cblock(struct mq_policy *mq,
-+			 struct policy_locker *locker, dm_oblock_t *oblock)
- {
--	struct entry *demoted = pop(mq, &mq->cache_clean);
-+	struct entry *demoted = peek(&mq->cache_clean);
- 
- 	if (!demoted)
- 		/*
-@@ -707,6 +708,13 @@ static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock)
- 		 */
- 		return -ENOSPC;
- 
-+	if (locker->fn(locker, demoted->oblock))
-+		/*
-+		 * We couldn't lock the demoted block.
-+		 */
-+		return -EBUSY;
-+
-+	del(mq, demoted);
- 	*oblock = demoted->oblock;
- 	free_entry(&mq->cache_pool, demoted);
- 
-@@ -795,6 +803,7 @@ static int cache_entry_found(struct mq_policy *mq,
-  * finding which cache block to use.
-  */
- static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
-+			      struct policy_locker *locker,
- 			      struct policy_result *result)
- {
- 	int r;
-@@ -803,11 +812,12 @@ static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
- 	/* Ensure there's a free cblock in the cache */
- 	if (epool_empty(&mq->cache_pool)) {
- 		result->op = POLICY_REPLACE;
--		r = demote_cblock(mq, &result->old_oblock);
-+		r = demote_cblock(mq, locker, &result->old_oblock);
- 		if (r) {
- 			result->op = POLICY_MISS;
- 			return 0;
- 		}
-+
- 	} else
- 		result->op = POLICY_NEW;
- 
-@@ -829,7 +839,8 @@ static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
- 
- static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
- 				 bool can_migrate, bool discarded_oblock,
--				 int data_dir, struct policy_result *result)
-+				 int data_dir, struct policy_locker *locker,
-+				 struct policy_result *result)
- {
- 	int r = 0;
- 
-@@ -842,7 +853,7 @@ static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
- 
- 	else {
- 		requeue(mq, e);
--		r = pre_cache_to_cache(mq, e, result);
-+		r = pre_cache_to_cache(mq, e, locker, result);
- 	}
- 
- 	return r;
-@@ -872,6 +883,7 @@ static void insert_in_pre_cache(struct mq_policy *mq,
- }
- 
- static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
-+			    struct policy_locker *locker,
- 			    struct policy_result *result)
- {
- 	int r;
-@@ -879,7 +891,7 @@ static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
- 
- 	if (epool_empty(&mq->cache_pool)) {
- 		result->op = POLICY_REPLACE;
--		r = demote_cblock(mq, &result->old_oblock);
-+		r = demote_cblock(mq, locker, &result->old_oblock);
- 		if (unlikely(r)) {
- 			result->op = POLICY_MISS;
- 			insert_in_pre_cache(mq, oblock);
-@@ -907,11 +919,12 @@ static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
- 
- static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock,
- 			  bool can_migrate, bool discarded_oblock,
--			  int data_dir, struct policy_result *result)
-+			  int data_dir, struct policy_locker *locker,
-+			  struct policy_result *result)
- {
- 	if (adjusted_promote_threshold(mq, discarded_oblock, data_dir) <= 1) {
- 		if (can_migrate)
--			insert_in_cache(mq, oblock, result);
-+			insert_in_cache(mq, oblock, locker, result);
- 		else
- 			return -EWOULDBLOCK;
- 	} else {
-@@ -928,7 +941,8 @@ static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock,
-  */
- static int map(struct mq_policy *mq, dm_oblock_t oblock,
- 	       bool can_migrate, bool discarded_oblock,
--	       int data_dir, struct policy_result *result)
-+	       int data_dir, struct policy_locker *locker,
-+	       struct policy_result *result)
- {
- 	int r = 0;
- 	struct entry *e = hash_lookup(mq, oblock);
-@@ -942,11 +956,11 @@ static int map(struct mq_policy *mq, dm_oblock_t oblock,
- 
- 	else if (e)
- 		r = pre_cache_entry_found(mq, e, can_migrate, discarded_oblock,
--					  data_dir, result);
-+					  data_dir, locker, result);
- 
- 	else
- 		r = no_entry_found(mq, oblock, can_migrate, discarded_oblock,
--				   data_dir, result);
-+				   data_dir, locker, result);
- 
- 	if (r == -EWOULDBLOCK)
- 		result->op = POLICY_MISS;
-@@ -1012,7 +1026,8 @@ static void copy_tick(struct mq_policy *mq)
- 
- static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock,
- 		  bool can_block, bool can_migrate, bool discarded_oblock,
--		  struct bio *bio, struct policy_result *result)
-+		  struct bio *bio, struct policy_locker *locker,
-+		  struct policy_result *result)
- {
- 	int r;
- 	struct mq_policy *mq = to_mq_policy(p);
-@@ -1028,7 +1043,7 @@ static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock,
- 
- 	iot_examine_bio(&mq->tracker, bio);
- 	r = map(mq, oblock, can_migrate, discarded_oblock,
--		bio_data_dir(bio), result);
-+		bio_data_dir(bio), locker, result);
- 
- 	mutex_unlock(&mq->lock);
- 
-diff --git a/drivers/md/dm-cache-policy.h b/drivers/md/dm-cache-policy.h
-index f50fe36..5524e21 100644
---- a/drivers/md/dm-cache-policy.h
-+++ b/drivers/md/dm-cache-policy.h
-@@ -70,6 +70,18 @@ enum policy_operation {
- };
- 
- /*
-+ * When issuing a POLICY_REPLACE the policy needs to make a callback to
-+ * lock the block being demoted.  This doesn't need to occur during a
-+ * writeback operation since the block remains in the cache.
-+ */
-+struct policy_locker;
-+typedef int (*policy_lock_fn)(struct policy_locker *l, dm_oblock_t oblock);
-+
-+struct policy_locker {
-+	policy_lock_fn fn;
-+};
-+
-+/*
-  * This is the instruction passed back to the core target.
-  */
- struct policy_result {
-@@ -122,7 +134,8 @@ struct dm_cache_policy {
- 	 */
- 	int (*map)(struct dm_cache_policy *p, dm_oblock_t oblock,
- 		   bool can_block, bool can_migrate, bool discarded_oblock,
--		   struct bio *bio, struct policy_result *result);
-+		   struct bio *bio, struct policy_locker *locker,
-+		   struct policy_result *result);
- 
- 	/*
- 	 * Sometimes we want to see if a block is in the cache, without
-diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
-index 7755af3..e049bec 100644
---- a/drivers/md/dm-cache-target.c
-+++ b/drivers/md/dm-cache-target.c
-@@ -1445,16 +1445,43 @@ static void inc_miss_counter(struct cache *cache, struct bio *bio)
- 		   &cache->stats.read_miss : &cache->stats.write_miss);
- }
- 
-+/*----------------------------------------------------------------*/
-+
-+struct old_oblock_lock {
-+	struct policy_locker locker;
-+	struct cache *cache;
-+	struct prealloc *structs;
-+	struct dm_bio_prison_cell *cell;
-+};
-+
-+static int null_locker(struct policy_locker *locker, dm_oblock_t b)
-+{
-+	/* This should never be called */
-+	BUG();
-+	return 0;
-+}
-+
-+static int cell_locker(struct policy_locker *locker, dm_oblock_t b)
-+{
-+	struct old_oblock_lock *l = container_of(locker, struct old_oblock_lock, locker);
-+	struct dm_bio_prison_cell *cell_prealloc = prealloc_get_cell(l->structs);
-+
-+	return bio_detain(l->cache, b, NULL, cell_prealloc,
-+			  (cell_free_fn) prealloc_put_cell,
-+			  l->structs, &l->cell);
-+}
-+
- static void process_bio(struct cache *cache, struct prealloc *structs,
- 			struct bio *bio)
- {
- 	int r;
- 	bool release_cell = true;
- 	dm_oblock_t block = get_bio_block(cache, bio);
--	struct dm_bio_prison_cell *cell_prealloc, *old_ocell, *new_ocell;
-+	struct dm_bio_prison_cell *cell_prealloc, *new_ocell;
- 	struct policy_result lookup_result;
- 	bool passthrough = passthrough_mode(&cache->features);
- 	bool discarded_block, can_migrate;
-+	struct old_oblock_lock ool;
- 
- 	/*
- 	 * Check to see if that block is currently migrating.
-@@ -1469,8 +1496,12 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
- 	discarded_block = is_discarded_oblock(cache, block);
- 	can_migrate = !passthrough && (discarded_block || spare_migration_bandwidth(cache));
- 
-+	ool.locker.fn = cell_locker;
-+	ool.cache = cache;
-+	ool.structs = structs;
-+	ool.cell = NULL;
- 	r = policy_map(cache->policy, block, true, can_migrate, discarded_block,
--		       bio, &lookup_result);
-+		       bio, &ool.locker, &lookup_result);
- 
- 	if (r == -EWOULDBLOCK)
- 		/* migration has been denied */
-@@ -1527,27 +1558,11 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
- 		break;
- 
- 	case POLICY_REPLACE:
--		cell_prealloc = prealloc_get_cell(structs);
--		r = bio_detain(cache, lookup_result.old_oblock, bio, cell_prealloc,
--			       (cell_free_fn) prealloc_put_cell,
--			       structs, &old_ocell);
--		if (r > 0) {
--			/*
--			 * We have to be careful to avoid lock inversion of
--			 * the cells.  So we back off, and wait for the
--			 * old_ocell to become free.
--			 */
--			policy_force_mapping(cache->policy, block,
--					     lookup_result.old_oblock);
--			atomic_inc(&cache->stats.cache_cell_clash);
--			break;
--		}
- 		atomic_inc(&cache->stats.demotion);
- 		atomic_inc(&cache->stats.promotion);
--
- 		demote_then_promote(cache, structs, lookup_result.old_oblock,
- 				    block, lookup_result.cblock,
--				    old_ocell, new_ocell);
-+				    ool.cell, new_ocell);
- 		release_cell = false;
- 		break;
- 
-@@ -2595,6 +2610,9 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso
- 	bool discarded_block;
- 	struct policy_result lookup_result;
- 	struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
-+	struct old_oblock_lock ool;
-+
-+	ool.locker.fn = null_locker;
- 
- 	if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
- 		/*
-@@ -2633,7 +2651,7 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso
- 	discarded_block = is_discarded_oblock(cache, block);
- 
- 	r = policy_map(cache->policy, block, false, can_migrate, discarded_block,
--		       bio, &lookup_result);
-+		       bio, &ool.locker, &lookup_result);
- 	if (r == -EWOULDBLOCK) {
- 		cell_defer(cache, *cell, true);
- 		return DM_MAPIO_SUBMITTED;
-diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
-index f478a4c..419bdd4 100644
---- a/drivers/md/dm-stats.c
-+++ b/drivers/md/dm-stats.c
-@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
- 		return -EINVAL;
- 
- 	if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
-+		if (!divisor)
-+			return -EINVAL;
- 		step = end - start;
- 		if (do_div(step, divisor))
- 			step++;
-diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
-index 921aafd..e22e6c8 100644
---- a/drivers/md/dm-thin.c
-+++ b/drivers/md/dm-thin.c
-@@ -18,6 +18,7 @@
- #include <linux/init.h>
- #include <linux/module.h>
- #include <linux/slab.h>
-+#include <linux/vmalloc.h>
- #include <linux/sort.h>
- #include <linux/rbtree.h>
- 
-@@ -260,7 +261,7 @@ struct pool {
- 	process_mapping_fn process_prepared_mapping;
- 	process_mapping_fn process_prepared_discard;
- 
--	struct dm_bio_prison_cell *cell_sort_array[CELL_SORT_ARRAY_SIZE];
-+	struct dm_bio_prison_cell **cell_sort_array;
- };
- 
- static enum pool_mode get_pool_mode(struct pool *pool);
-@@ -2499,6 +2500,7 @@ static void __pool_destroy(struct pool *pool)
- {
- 	__pool_table_remove(pool);
- 
-+	vfree(pool->cell_sort_array);
- 	if (dm_pool_metadata_close(pool->pmd) < 0)
- 		DMWARN("%s: dm_pool_metadata_close() failed.", __func__);
- 
-@@ -2611,6 +2613,13 @@ static struct pool *pool_create(struct mapped_device *pool_md,
- 		goto bad_mapping_pool;
- 	}
- 
-+	pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
-+	if (!pool->cell_sort_array) {
-+		*error = "Error allocating cell sort array";
-+		err_p = ERR_PTR(-ENOMEM);
-+		goto bad_sort_array;
-+	}
-+
- 	pool->ref_count = 1;
- 	pool->last_commit_jiffies = jiffies;
- 	pool->pool_md = pool_md;
-@@ -2619,6 +2628,8 @@ static struct pool *pool_create(struct mapped_device *pool_md,
- 
- 	return pool;
- 
-+bad_sort_array:
-+	mempool_destroy(pool->mapping_pool);
- bad_mapping_pool:
- 	dm_deferred_set_destroy(pool->all_io_ds);
- bad_all_io_ds:
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 4dbed4a..b920028 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -4005,8 +4005,10 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
- 	else
- 		rdev = md_import_device(dev, -1, -1);
- 
--	if (IS_ERR(rdev))
-+	if (IS_ERR(rdev)) {
-+		mddev_unlock(mddev);
- 		return PTR_ERR(rdev);
-+	}
- 	err = bind_rdev_to_array(rdev, mddev);
-  out:
- 	if (err)
-@@ -5159,6 +5161,7 @@ int md_run(struct mddev *mddev)
- 		mddev_detach(mddev);
- 		if (mddev->private)
- 			pers->free(mddev, mddev->private);
-+		mddev->private = NULL;
- 		module_put(pers->owner);
- 		bitmap_destroy(mddev);
- 		return err;
-@@ -5294,6 +5297,7 @@ static void md_clean(struct mddev *mddev)
- 	mddev->changed = 0;
- 	mddev->degraded = 0;
- 	mddev->safemode = 0;
-+	mddev->private = NULL;
- 	mddev->merge_check_needed = 0;
- 	mddev->bitmap_info.offset = 0;
- 	mddev->bitmap_info.default_offset = 0;
-@@ -5366,6 +5370,7 @@ static void __md_stop(struct mddev *mddev)
- 	mddev->pers = NULL;
- 	spin_unlock(&mddev->lock);
- 	pers->free(mddev, mddev->private);
-+	mddev->private = NULL;
- 	if (pers->sync_request && mddev->to_remove == NULL)
- 		mddev->to_remove = &md_redundancy_group;
- 	module_put(pers->owner);
-@@ -6375,7 +6380,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
- 	    mddev->ctime         != info->ctime         ||
- 	    mddev->level         != info->level         ||
- /*	    mddev->layout        != info->layout        || */
--	    !mddev->persistent	 != info->not_persistent||
-+	    mddev->persistent	 != !info->not_persistent ||
- 	    mddev->chunk_sectors != info->chunk_size >> 9 ||
- 	    /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
- 	    ((state^info->state) & 0xfffffe00)
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index b88757c..a03178e 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- 
- 		if (s < 0 && nr_center < -s) {
- 			/* not enough in central node */
--			shift(left, center, nr_center);
--			s = nr_center - target;
-+			shift(left, center, -nr_center);
-+			s += nr_center;
- 			shift(left, right, s);
- 			nr_right += s;
- 		} else
-@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- 		if (s > 0 && nr_center < s) {
- 			/* not enough in central node */
- 			shift(center, right, nr_center);
--			s = target - nr_center;
-+			s -= nr_center;
- 			shift(left, right, s);
- 			nr_left -= s;
- 		} else
-diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
-index 200ac12..fdd3793 100644
---- a/drivers/md/persistent-data/dm-btree.c
-+++ b/drivers/md/persistent-data/dm-btree.c
-@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
- 	int r;
- 	struct del_stack *s;
- 
--	s = kmalloc(sizeof(*s), GFP_KERNEL);
-+	s = kmalloc(sizeof(*s), GFP_NOIO);
- 	if (!s)
- 		return -ENOMEM;
- 	s->info = info;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index e8a9042..5309129 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
- 	smm->recursion_count++;
- }
- 
-+static int apply_bops(struct sm_metadata *smm)
-+{
-+	int r = 0;
-+
-+	while (!brb_empty(&smm->uncommitted)) {
-+		struct block_op bop;
-+
-+		r = brb_pop(&smm->uncommitted, &bop);
-+		if (r) {
-+			DMERR("bug in bop ring buffer");
-+			break;
-+		}
-+
-+		r = commit_bop(smm, &bop);
-+		if (r)
-+			break;
-+	}
-+
-+	return r;
-+}
-+
- static int out(struct sm_metadata *smm)
- {
- 	int r = 0;
-@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
- 		return -ENOMEM;
- 	}
- 
--	if (smm->recursion_count == 1) {
--		while (!brb_empty(&smm->uncommitted)) {
--			struct block_op bop;
--
--			r = brb_pop(&smm->uncommitted, &bop);
--			if (r) {
--				DMERR("bug in bop ring buffer");
--				break;
--			}
--
--			r = commit_bop(smm, &bop);
--			if (r)
--				break;
--		}
--	}
-+	if (smm->recursion_count == 1)
-+		apply_bops(smm);
- 
- 	smm->recursion_count--;
- 
-@@ -704,6 +712,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
- 		}
- 		old_len = smm->begin;
- 
-+		r = apply_bops(smm);
-+		if (r) {
-+			DMERR("%s: apply_bops failed", __func__);
-+			goto out;
-+		}
-+
- 		r = sm_ll_commit(&smm->ll);
- 		if (r)
- 			goto out;
-@@ -773,6 +787,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
- 	if (r)
- 		return r;
- 
-+	r = apply_bops(smm);
-+	if (r) {
-+		DMERR("%s: apply_bops failed", __func__);
-+		return r;
-+	}
-+
- 	return sm_metadata_commit(sm);
- }
- 
-diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
-index 8001690..ba6c8f6 100644
---- a/drivers/media/dvb-frontends/af9013.c
-+++ b/drivers/media/dvb-frontends/af9013.c
-@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
- 			}
- 		}
- 
-+		/* Return an error if can't find bandwidth or the right clock */
-+		if (i == ARRAY_SIZE(coeff_lut))
-+			return -EINVAL;
-+
- 		ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
- 			sizeof(coeff_lut[i].val));
- 	}
-diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
-index 2916d7c..7bc68b3 100644
---- a/drivers/media/dvb-frontends/cx24116.c
-+++ b/drivers/media/dvb-frontends/cx24116.c
-@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- 	struct cx24116_state *state = fe->demodulator_priv;
- 	int i, ret;
- 
-+	/* Validate length */
-+	if (d->msg_len > sizeof(d->msg))
-+                return -EINVAL;
-+
- 	/* Dump DiSEqC message */
- 	if (debug) {
- 		printk(KERN_INFO "cx24116: %s(", __func__);
-@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- 		printk(") toneburst=%d\n", toneburst);
- 	}
- 
--	/* Validate length */
--	if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
--		return -EINVAL;
--
- 	/* DiSEqC message */
- 	for (i = 0; i < d->msg_len; i++)
- 		state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
-diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
-index acb965c..af63635 100644
---- a/drivers/media/dvb-frontends/cx24117.c
-+++ b/drivers/media/dvb-frontends/cx24117.c
-@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
- 	dev_dbg(&state->priv->i2c->dev, ")\n");
- 
- 	/* Validate length */
--	if (d->msg_len > 15)
-+	if (d->msg_len > sizeof(d->msg))
- 		return -EINVAL;
- 
- 	/* DiSEqC message */
-diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
-index 93eeaf7..0b4f8fe 100644
---- a/drivers/media/dvb-frontends/s5h1420.c
-+++ b/drivers/media/dvb-frontends/s5h1420.c
-@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
- 	int result = 0;
- 
- 	dprintk("enter %s\n", __func__);
--	if (cmd->msg_len > 8)
-+	if (cmd->msg_len > sizeof(cmd->msg))
- 		return -EINVAL;
- 
- 	/* setup for DISEQC */
-diff --git a/drivers/media/pci/cx18/cx18-streams.c b/drivers/media/pci/cx18/cx18-streams.c
-index c82d25d..c986084 100644
---- a/drivers/media/pci/cx18/cx18-streams.c
-+++ b/drivers/media/pci/cx18/cx18-streams.c
-@@ -90,6 +90,7 @@ static struct {
- 		"encoder PCM audio",
- 		VFL_TYPE_GRABBER, CX18_V4L2_ENC_PCM_OFFSET,
- 		PCI_DMA_FROMDEVICE,
-+		V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_READWRITE,
- 	},
- 	{	/* CX18_ENC_STREAM_TYPE_IDX */
- 		"encoder IDX",
-diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c
-index 9266965..7a0a651 100644
---- a/drivers/media/pci/saa7164/saa7164-encoder.c
-+++ b/drivers/media/pci/saa7164/saa7164-encoder.c
-@@ -721,13 +721,14 @@ static int vidioc_querycap(struct file *file, void  *priv,
- 		sizeof(cap->card));
- 	sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
- 
--	cap->capabilities =
-+	cap->device_caps =
- 		V4L2_CAP_VIDEO_CAPTURE |
--		V4L2_CAP_READWRITE     |
--		0;
-+		V4L2_CAP_READWRITE |
-+		V4L2_CAP_TUNER;
- 
--	cap->capabilities |= V4L2_CAP_TUNER;
--	cap->version = 0;
-+	cap->capabilities = cap->device_caps |
-+		V4L2_CAP_VBI_CAPTURE |
-+		V4L2_CAP_DEVICE_CAPS;
- 
- 	return 0;
- }
-diff --git a/drivers/media/pci/saa7164/saa7164-vbi.c b/drivers/media/pci/saa7164/saa7164-vbi.c
-index 6e025fe..06117e6 100644
---- a/drivers/media/pci/saa7164/saa7164-vbi.c
-+++ b/drivers/media/pci/saa7164/saa7164-vbi.c
-@@ -660,13 +660,14 @@ static int vidioc_querycap(struct file *file, void  *priv,
- 		sizeof(cap->card));
- 	sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
- 
--	cap->capabilities =
-+	cap->device_caps =
- 		V4L2_CAP_VBI_CAPTURE |
--		V4L2_CAP_READWRITE     |
--		0;
-+		V4L2_CAP_READWRITE |
-+		V4L2_CAP_TUNER;
- 
--	cap->capabilities |= V4L2_CAP_TUNER;
--	cap->version = 0;
-+	cap->capabilities = cap->device_caps |
-+		V4L2_CAP_VIDEO_CAPTURE |
-+		V4L2_CAP_DEVICE_CAPS;
- 
- 	return 0;
- }
-diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
-index 2b40393..0d248ce 100644
---- a/drivers/media/usb/dvb-usb/dib0700_core.c
-+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
-@@ -655,10 +655,20 @@ out:
- struct dib0700_rc_response {
- 	u8 report_id;
- 	u8 data_state;
--	u8 system;
--	u8 not_system;
--	u8 data;
--	u8 not_data;
-+	union {
-+		struct {
-+			u8 system;
-+			u8 not_system;
-+			u8 data;
-+			u8 not_data;
-+		} nec;
-+		struct {
-+			u8 not_used;
-+			u8 system;
-+			u8 data;
-+			u8 not_data;
-+		} rc5;
-+	};
- };
- #define RC_MSG_SIZE_V1_20 6
- 
-@@ -694,8 +704,8 @@ static void dib0700_rc_urb_completion(struct urb *purb)
- 
- 	deb_data("IR ID = %02X state = %02X System = %02X %02X Cmd = %02X %02X (len %d)\n",
- 		 poll_reply->report_id, poll_reply->data_state,
--		 poll_reply->system, poll_reply->not_system,
--		 poll_reply->data, poll_reply->not_data,
-+		 poll_reply->nec.system, poll_reply->nec.not_system,
-+		 poll_reply->nec.data, poll_reply->nec.not_data,
- 		 purb->actual_length);
- 
- 	switch (d->props.rc.core.protocol) {
-@@ -704,30 +714,30 @@ static void dib0700_rc_urb_completion(struct urb *purb)
- 		toggle = 0;
- 
- 		/* NEC protocol sends repeat code as 0 0 0 FF */
--		if (poll_reply->system     == 0x00 &&
--		    poll_reply->not_system == 0x00 &&
--		    poll_reply->data       == 0x00 &&
--		    poll_reply->not_data   == 0xff) {
-+		if (poll_reply->nec.system     == 0x00 &&
-+		    poll_reply->nec.not_system == 0x00 &&
-+		    poll_reply->nec.data       == 0x00 &&
-+		    poll_reply->nec.not_data   == 0xff) {
- 			poll_reply->data_state = 2;
- 			break;
- 		}
- 
--		if ((poll_reply->data ^ poll_reply->not_data) != 0xff) {
-+		if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
- 			deb_data("NEC32 protocol\n");
--			keycode = RC_SCANCODE_NEC32(poll_reply->system     << 24 |
--						     poll_reply->not_system << 16 |
--						     poll_reply->data       << 8  |
--						     poll_reply->not_data);
--		} else if ((poll_reply->system ^ poll_reply->not_system) != 0xff) {
-+			keycode = RC_SCANCODE_NEC32(poll_reply->nec.system     << 24 |
-+						     poll_reply->nec.not_system << 16 |
-+						     poll_reply->nec.data       << 8  |
-+						     poll_reply->nec.not_data);
-+		} else if ((poll_reply->nec.system ^ poll_reply->nec.not_system) != 0xff) {
- 			deb_data("NEC extended protocol\n");
--			keycode = RC_SCANCODE_NECX(poll_reply->system << 8 |
--						    poll_reply->not_system,
--						    poll_reply->data);
-+			keycode = RC_SCANCODE_NECX(poll_reply->nec.system << 8 |
-+						    poll_reply->nec.not_system,
-+						    poll_reply->nec.data);
- 
- 		} else {
- 			deb_data("NEC normal protocol\n");
--			keycode = RC_SCANCODE_NEC(poll_reply->system,
--						   poll_reply->data);
-+			keycode = RC_SCANCODE_NEC(poll_reply->nec.system,
-+						   poll_reply->nec.data);
- 		}
- 
- 		break;
-@@ -735,19 +745,19 @@ static void dib0700_rc_urb_completion(struct urb *purb)
- 		deb_data("RC5 protocol\n");
- 		protocol = RC_TYPE_RC5;
- 		toggle = poll_reply->report_id;
--		keycode = RC_SCANCODE_RC5(poll_reply->system, poll_reply->data);
-+		keycode = RC_SCANCODE_RC5(poll_reply->rc5.system, poll_reply->rc5.data);
-+
-+		if ((poll_reply->rc5.data ^ poll_reply->rc5.not_data) != 0xff) {
-+			/* Key failed integrity check */
-+			err("key failed integrity check: %02x %02x %02x %02x",
-+			    poll_reply->rc5.not_used, poll_reply->rc5.system,
-+			    poll_reply->rc5.data, poll_reply->rc5.not_data);
-+			goto resubmit;
-+		}
- 
- 		break;
- 	}
- 
--	if ((poll_reply->data + poll_reply->not_data) != 0xff) {
--		/* Key failed integrity check */
--		err("key failed integrity check: %02x %02x %02x %02x",
--		    poll_reply->system,  poll_reply->not_system,
--		    poll_reply->data, poll_reply->not_data);
--		goto resubmit;
--	}
--
- 	rc_keydown(d->rc_dev, protocol, keycode, toggle);
- 
- resubmit:
-diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
-index d7d55a2..c170523 100644
---- a/drivers/media/usb/dvb-usb/dib0700_devices.c
-+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
-@@ -3944,6 +3944,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 
- 				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
- 			}},
-+				.size_of_priv = sizeof(struct
-+						dib0700_adapter_state),
- 			}, {
- 			.num_frontends = 1,
- 			.fe = {{
-@@ -3956,6 +3958,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 
- 				DIB0700_DEFAULT_STREAMING_CONFIG(0x03),
- 			}},
-+				.size_of_priv = sizeof(struct
-+						dib0700_adapter_state),
- 			}
- 		},
- 
-@@ -4009,6 +4013,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
- 
- 				DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
- 			}},
-+				.size_of_priv = sizeof(struct
-+						dib0700_adapter_state),
- 			},
- 		},
- 
-diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
-index 66ada01..cf9d644 100644
---- a/drivers/media/v4l2-core/videobuf2-core.c
-+++ b/drivers/media/v4l2-core/videobuf2-core.c
-@@ -1237,6 +1237,23 @@ void vb2_discard_done(struct vb2_queue *q)
- }
- EXPORT_SYMBOL_GPL(vb2_discard_done);
- 
-+static void vb2_warn_zero_bytesused(struct vb2_buffer *vb)
-+{
-+	static bool __check_once __read_mostly;
-+
-+	if (__check_once)
-+		return;
-+
-+	__check_once = true;
-+	__WARN();
-+
-+	pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
-+	if (vb->vb2_queue->allow_zero_bytesused)
-+		pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
-+	else
-+		pr_warn_once("use the actual size instead.\n");
-+}
-+
- /**
-  * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
-  * v4l2_buffer by the userspace. The caller has already verified that struct
-@@ -1247,16 +1264,6 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
- {
- 	unsigned int plane;
- 
--	if (V4L2_TYPE_IS_OUTPUT(b->type)) {
--		if (WARN_ON_ONCE(b->bytesused == 0)) {
--			pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
--			if (vb->vb2_queue->allow_zero_bytesused)
--				pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
--			else
--				pr_warn_once("use the actual size instead.\n");
--		}
--	}
--
- 	if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
- 		if (b->memory == V4L2_MEMORY_USERPTR) {
- 			for (plane = 0; plane < vb->num_planes; ++plane) {
-@@ -1297,6 +1304,9 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
- 				struct v4l2_plane *pdst = &v4l2_planes[plane];
- 				struct v4l2_plane *psrc = &b->m.planes[plane];
- 
-+				if (psrc->bytesused == 0)
-+					vb2_warn_zero_bytesused(vb);
-+
- 				if (vb->vb2_queue->allow_zero_bytesused)
- 					pdst->bytesused = psrc->bytesused;
- 				else
-@@ -1331,6 +1341,9 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
- 		}
- 
- 		if (V4L2_TYPE_IS_OUTPUT(b->type)) {
-+			if (b->bytesused == 0)
-+				vb2_warn_zero_bytesused(vb);
-+
- 			if (vb->vb2_queue->allow_zero_bytesused)
- 				v4l2_planes[0].bytesused = b->bytesused;
- 			else
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 60f7141..31d2627 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -208,6 +208,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
- 
- 	ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
- 
-+	mmc_blk_put(md);
-+
- 	return ret;
- }
- 
-@@ -1910,9 +1912,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- 			break;
- 		case MMC_BLK_CMD_ERR:
- 			ret = mmc_blk_cmd_err(md, card, brq, req, ret);
--			if (!mmc_blk_reset(md, card->host, type))
--				break;
--			goto cmd_abort;
-+			if (mmc_blk_reset(md, card->host, type))
-+				goto cmd_abort;
-+			if (!ret)
-+				goto start_new_req;
-+			break;
- 		case MMC_BLK_RETRY:
- 			if (retry++ < 5)
- 				break;
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index 9231cdf..d3dbb28 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -3315,13 +3315,14 @@ int sdhci_add_host(struct sdhci_host *host)
- 				   SDHCI_MAX_CURRENT_MULTIPLIER;
- 	}
- 
--	/* If OCR set by external regulators, use it instead */
-+	/* If OCR set by host, use it instead. */
-+	if (host->ocr_mask)
-+		ocr_avail = host->ocr_mask;
-+
-+	/* If OCR set by external regulators, give it highest prio. */
- 	if (mmc->ocr_avail)
- 		ocr_avail = mmc->ocr_avail;
- 
--	if (host->ocr_mask)
--		ocr_avail &= host->ocr_mask;
--
- 	mmc->ocr_avail = ocr_avail;
- 	mmc->ocr_avail_sdio = ocr_avail;
- 	if (host->ocr_avail_sdio)
-diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
-index dc79ed8..32e7775 100644
---- a/drivers/net/ethernet/intel/e1000e/82571.c
-+++ b/drivers/net/ethernet/intel/e1000e/82571.c
-@@ -2010,7 +2010,7 @@ const struct e1000_info e1000_82573_info = {
- 	.flags2			= FLAG2_DISABLE_ASPM_L1
- 				  | FLAG2_DISABLE_ASPM_L0S,
- 	.pba			= 20,
--	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
-+	.max_hw_frame_size	= VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
- 	.get_variants		= e1000_get_variants_82571,
- 	.mac_ops		= &e82571_mac_ops,
- 	.phy_ops		= &e82_phy_ops_m88,
-diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
-index 9d81c03..e2498db 100644
---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
-+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
-@@ -1563,7 +1563,7 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
- 	    ((adapter->hw.mac.type >= e1000_pch2lan) &&
- 	     (!(er32(CTRL_EXT) & E1000_CTRL_EXT_LSECCK)))) {
- 		adapter->flags &= ~FLAG_HAS_JUMBO_FRAMES;
--		adapter->max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN;
-+		adapter->max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
- 
- 		hw->mac.ops.blink_led = NULL;
- 	}
-@@ -5681,7 +5681,7 @@ const struct e1000_info e1000_ich8_info = {
- 				  | FLAG_HAS_FLASH
- 				  | FLAG_APME_IN_WUC,
- 	.pba			= 8,
--	.max_hw_frame_size	= ETH_FRAME_LEN + ETH_FCS_LEN,
-+	.max_hw_frame_size	= VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
- 	.get_variants		= e1000_get_variants_ich8lan,
- 	.mac_ops		= &ich8_mac_ops,
- 	.phy_ops		= &ich8_phy_ops,
-@@ -5754,7 +5754,7 @@ const struct e1000_info e1000_pch2_info = {
- 	.flags2			= FLAG2_HAS_PHY_STATS
- 				  | FLAG2_HAS_EEE,
- 	.pba			= 26,
--	.max_hw_frame_size	= 9018,
-+	.max_hw_frame_size	= 9022,
- 	.get_variants		= e1000_get_variants_ich8lan,
- 	.mac_ops		= &ich8_mac_ops,
- 	.phy_ops		= &ich8_phy_ops,
-@@ -5774,7 +5774,7 @@ const struct e1000_info e1000_pch_lpt_info = {
- 	.flags2			= FLAG2_HAS_PHY_STATS
- 				  | FLAG2_HAS_EEE,
- 	.pba			= 26,
--	.max_hw_frame_size	= 9018,
-+	.max_hw_frame_size	= 9022,
- 	.get_variants		= e1000_get_variants_ich8lan,
- 	.mac_ops		= &ich8_mac_ops,
- 	.phy_ops		= &ich8_phy_ops,
-@@ -5794,7 +5794,7 @@ const struct e1000_info e1000_pch_spt_info = {
- 	.flags2			= FLAG2_HAS_PHY_STATS
- 				  | FLAG2_HAS_EEE,
- 	.pba			= 26,
--	.max_hw_frame_size	= 9018,
-+	.max_hw_frame_size	= 9022,
- 	.get_variants		= e1000_get_variants_ich8lan,
- 	.mac_ops		= &ich8_mac_ops,
- 	.phy_ops		= &ich8_phy_ops,
-diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
-index c509a5c..68913d1 100644
---- a/drivers/net/ethernet/intel/e1000e/netdev.c
-+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
-@@ -3807,7 +3807,7 @@ void e1000e_reset(struct e1000_adapter *adapter)
- 	/* reset Packet Buffer Allocation to default */
- 	ew32(PBA, pba);
- 
--	if (adapter->max_frame_size > ETH_FRAME_LEN + ETH_FCS_LEN) {
-+	if (adapter->max_frame_size > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) {
- 		/* To maintain wire speed transmits, the Tx FIFO should be
- 		 * large enough to accommodate two full transmit packets,
- 		 * rounded up to the next 1KB and expressed in KB.  Likewise,
-@@ -4196,9 +4196,9 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
- {
- 	struct net_device *netdev = adapter->netdev;
- 
--	adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN;
-+	adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
- 	adapter->rx_ps_bsize0 = 128;
--	adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
-+	adapter->max_frame_size = netdev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
- 	adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
- 	adapter->tx_ring_count = E1000_DEFAULT_TXD;
- 	adapter->rx_ring_count = E1000_DEFAULT_RXD;
-@@ -5781,17 +5781,17 @@ struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
- static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
- {
- 	struct e1000_adapter *adapter = netdev_priv(netdev);
--	int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN;
-+	int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
- 
- 	/* Jumbo frame support */
--	if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
-+	if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) &&
- 	    !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
- 		e_err("Jumbo Frames not supported.\n");
- 		return -EINVAL;
- 	}
- 
- 	/* Supported frame sizes */
--	if ((new_mtu < ETH_ZLEN + ETH_FCS_LEN + VLAN_HLEN) ||
-+	if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) ||
- 	    (max_frame > adapter->max_hw_frame_size)) {
- 		e_err("Unsupported MTU setting\n");
- 		return -EINVAL;
-@@ -5831,10 +5831,8 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
- 		adapter->rx_buffer_len = 4096;
- 
- 	/* adjust allocation if LPE protects us, and we aren't using SBP */
--	if ((max_frame == ETH_FRAME_LEN + ETH_FCS_LEN) ||
--	    (max_frame == ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN))
--		adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN
--		    + ETH_FCS_LEN;
-+	if (max_frame <= (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN))
-+		adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
- 
- 	if (netif_running(netdev))
- 		e1000e_up(adapter);
-diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
-index e82a0d4..5dbc617 100644
---- a/drivers/net/wireless/ath/ath9k/htc.h
-+++ b/drivers/net/wireless/ath/ath9k/htc.h
-@@ -440,9 +440,9 @@ static inline void ath9k_htc_stop_btcoex(struct ath9k_htc_priv *priv)
- }
- #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
- 
--#define OP_BT_PRIORITY_DETECTED    BIT(3)
--#define OP_BT_SCAN                 BIT(4)
--#define OP_TSF_RESET               BIT(6)
-+#define OP_BT_PRIORITY_DETECTED    3
-+#define OP_BT_SCAN                 4
-+#define OP_TSF_RESET               6
- 
- enum htc_op_flags {
- 	HTC_FWFLAG_NO_RMW,
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index b0badef..d5f2fbf 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
- 	ath_stop_ani(sc);
- 	ath9k_hw_disable_interrupts(ah);
- 
--	if (!ath_drain_all_txq(sc))
--		ret = false;
--
--	if (!ath_stoprecv(sc))
--		ret = false;
-+	if (AR_SREV_9300_20_OR_LATER(ah)) {
-+		ret &= ath_stoprecv(sc);
-+		ret &= ath_drain_all_txq(sc);
-+	} else {
-+		ret &= ath_drain_all_txq(sc);
-+		ret &= ath_stoprecv(sc);
-+	}
- 
- 	return ret;
- }
-diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
-index 9ac04c1..8c17b94 100644
---- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
-+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
-@@ -6,7 +6,7 @@
-  * GPL LICENSE SUMMARY
-  *
-  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of version 2 of the GNU General Public License as
-@@ -32,7 +32,7 @@
-  * BSD LICENSE
-  *
-  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-@@ -1356,6 +1356,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file,
- 	PRINT_MVM_REF(IWL_MVM_REF_UCODE_DOWN);
- 	PRINT_MVM_REF(IWL_MVM_REF_SCAN);
- 	PRINT_MVM_REF(IWL_MVM_REF_ROC);
-+	PRINT_MVM_REF(IWL_MVM_REF_ROC_AUX);
- 	PRINT_MVM_REF(IWL_MVM_REF_P2P_CLIENT);
- 	PRINT_MVM_REF(IWL_MVM_REF_AP_IBSS);
- 	PRINT_MVM_REF(IWL_MVM_REF_USER);
-diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
-index dda9f7b..60c138a 100644
---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
-+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
-@@ -1404,7 +1404,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
- 	 * The work item could be running or queued if the
- 	 * ROC time event stops just as we get here.
- 	 */
--	cancel_work_sync(&mvm->roc_done_wk);
-+	flush_work(&mvm->roc_done_wk);
- 
- 	iwl_trans_stop_device(mvm->trans);
- 
-diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
-index cf70f68..6af21da 100644
---- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
-+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
-@@ -275,6 +275,7 @@ enum iwl_mvm_ref_type {
- 	IWL_MVM_REF_UCODE_DOWN,
- 	IWL_MVM_REF_SCAN,
- 	IWL_MVM_REF_ROC,
-+	IWL_MVM_REF_ROC_AUX,
- 	IWL_MVM_REF_P2P_CLIENT,
- 	IWL_MVM_REF_AP_IBSS,
- 	IWL_MVM_REF_USER,
-diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
-index fd7b0d3..a7448cf 100644
---- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
-+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
-@@ -6,7 +6,7 @@
-  * GPL LICENSE SUMMARY
-  *
-  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
-  *
-  * This program is free software; you can redistribute it and/or modify
-  * it under the terms of version 2 of the GNU General Public License as
-@@ -32,7 +32,7 @@
-  * BSD LICENSE
-  *
-  * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
-  * All rights reserved.
-  *
-  * Redistribution and use in source and binary forms, with or without
-@@ -108,12 +108,14 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk)
- 	 * in the case that the time event actually completed in the firmware
- 	 * (which is handled in iwl_mvm_te_handle_notif).
- 	 */
--	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
-+	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) {
- 		queues |= BIT(IWL_MVM_OFFCHANNEL_QUEUE);
--	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
-+		iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
-+	}
-+	if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) {
- 		queues |= BIT(mvm->aux_queue);
--
--	iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
-+		iwl_mvm_unref(mvm, IWL_MVM_REF_ROC_AUX);
-+	}
- 
- 	synchronize_net();
- 
-@@ -393,6 +395,7 @@ static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
- 	} else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
- 		set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
- 		te_data->running = true;
-+		iwl_mvm_ref(mvm, IWL_MVM_REF_ROC_AUX);
- 		ieee80211_ready_on_channel(mvm->hw); /* Start TE */
- 	} else {
- 		IWL_DEBUG_TE(mvm,
-diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
-index 86ce5b1..e5d8108f 100644
---- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
-@@ -1354,27 +1354,11 @@ void rtl88ee_set_qos(struct ieee80211_hw *hw, int aci)
- 	}
- }
- 
--static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw)
--{
--	struct rtl_priv *rtlpriv = rtl_priv(hw);
--	u32 tmp;
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISR);
--	rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
--	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
--	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl88ee_enable_interrupt(struct ieee80211_hw *hw)
- {
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
- 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
- 
--	rtl88ee_clear_interrupt(hw);/*clear it here first*/
- 	rtl_write_dword(rtlpriv, REG_HIMR,
- 			rtlpci->irq_mask[0] & 0xFFFFFFFF);
- 	rtl_write_dword(rtlpriv, REG_HIMRE,
-diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
-index da0a612..cbf2ca7 100644
---- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
-@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw *hw, int aci)
- 	}
- }
- 
--static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw)
--{
--	struct rtl_priv *rtlpriv = rtl_priv(hw);
--	u32 tmp;
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISR);
--	rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
--	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
--	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl92ee_enable_interrupt(struct ieee80211_hw *hw)
- {
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
- 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
- 
--	rtl92ee_clear_interrupt(hw);/*clear it here first*/
--
- 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
- 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
- 	rtlpci->irq_enabled = true;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
-index 67bb47d..a4b7eac 100644
---- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
-@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_hw *hw, int aci)
- 	}
- }
- 
--static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw)
--{
--	struct rtl_priv *rtlpriv = rtl_priv(hw);
--	u32 tmp;
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISR);
--	rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
--	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--}
--
- void rtl8723e_enable_interrupt(struct ieee80211_hw *hw)
- {
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
-@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct ieee80211_hw *hw)
- {
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
- 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
--	rtl8723e_clear_interrupt(hw);/*clear it here first*/
- 	rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED);
- 	rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED);
- 	rtlpci->irq_enabled = false;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
-index b681af3..b941726 100644
---- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
-@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_hw *hw, int aci)
- 	}
- }
- 
--static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw)
--{
--	struct rtl_priv *rtlpriv = rtl_priv(hw);
--	u32 tmp;
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISR);
--	rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
--	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
--	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl8723be_enable_interrupt(struct ieee80211_hw *hw)
- {
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
- 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
- 
--	rtl8723be_clear_interrupt(hw);/*clear it here first*/
--
- 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
- 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
- 	rtlpci->irq_enabled = true;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
-index 8704eee..57966e3 100644
---- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
-@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci)
- 	}
- }
- 
--static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
--{
--	struct rtl_priv *rtlpriv = rtl_priv(hw);
--	u32 tmp;
--	tmp = rtl_read_dword(rtlpriv, REG_HISR);
--	/*printk("clear interrupt first:\n");
--	printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/
--	rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HISRE);
--	/*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/
--	rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
--	tmp = rtl_read_dword(rtlpriv, REG_HSISR);
--	/*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/
--	rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
- {
- 	struct rtl_priv *rtlpriv = rtl_priv(hw);
- 	struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
- 
--	rtl8821ae_clear_interrupt(hw);/*clear it here first*/
--
- 	rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
- 	rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
- 	rtlpci->irq_enabled = true;
-diff --git a/drivers/nfc/st21nfcb/i2c.c b/drivers/nfc/st21nfcb/i2c.c
-index 76a4cad..c44f8cf 100644
---- a/drivers/nfc/st21nfcb/i2c.c
-+++ b/drivers/nfc/st21nfcb/i2c.c
-@@ -87,11 +87,6 @@ static void st21nfcb_nci_i2c_disable(void *phy_id)
- 	gpio_set_value(phy->gpio_reset, 1);
- }
- 
--static void st21nfcb_nci_remove_header(struct sk_buff *skb)
--{
--	skb_pull(skb, ST21NFCB_FRAME_HEADROOM);
--}
--
- /*
-  * Writing a frame must not return the number of written bytes.
-  * It must return either zero for success, or <0 for error.
-@@ -121,8 +116,6 @@ static int st21nfcb_nci_i2c_write(void *phy_id, struct sk_buff *skb)
- 			r = 0;
- 	}
- 
--	st21nfcb_nci_remove_header(skb);
--
- 	return r;
- }
- 
-@@ -366,9 +359,6 @@ static int st21nfcb_nci_i2c_remove(struct i2c_client *client)
- 
- 	ndlc_remove(phy->ndlc);
- 
--	if (phy->powered)
--		st21nfcb_nci_i2c_disable(phy);
--
- 	return 0;
- }
- 
-diff --git a/drivers/nfc/st21nfcb/st21nfcb.c b/drivers/nfc/st21nfcb/st21nfcb.c
-index ca9871a..c7dc282 100644
---- a/drivers/nfc/st21nfcb/st21nfcb.c
-+++ b/drivers/nfc/st21nfcb/st21nfcb.c
-@@ -131,11 +131,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);
- 
- void st21nfcb_nci_remove(struct nci_dev *ndev)
- {
--	struct st21nfcb_nci_info *info = nci_get_drvdata(ndev);
--
- 	nci_unregister_device(ndev);
- 	nci_free_device(ndev);
--	kfree(info);
- }
- EXPORT_SYMBOL_GPL(st21nfcb_nci_remove);
- 
-diff --git a/drivers/of/address.c b/drivers/of/address.c
-index 6906a3f..8bfda6a 100644
---- a/drivers/of/address.c
-+++ b/drivers/of/address.c
-@@ -712,7 +712,7 @@ int __weak pci_register_io_range(phys_addr_t addr, resource_size_t size)
- 	}
- 
- 	/* add the range to the list */
--	range = kzalloc(sizeof(*range), GFP_KERNEL);
-+	range = kzalloc(sizeof(*range), GFP_ATOMIC);
- 	if (!range) {
- 		err = -ENOMEM;
- 		goto end_register;
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index f065026..5ed9724 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -89,7 +89,7 @@ EXPORT_SYMBOL(of_n_size_cells);
- #ifdef CONFIG_NUMA
- int __weak of_node_to_nid(struct device_node *np)
- {
--	return numa_node_id();
-+	return NUMA_NO_NODE;
- }
- #endif
- 
-diff --git a/drivers/phy/phy-berlin-usb.c b/drivers/phy/phy-berlin-usb.c
-index c6fc95b..ab54f28 100644
---- a/drivers/phy/phy-berlin-usb.c
-+++ b/drivers/phy/phy-berlin-usb.c
-@@ -106,8 +106,8 @@
- static const u32 phy_berlin_pll_dividers[] = {
- 	/* Berlin 2 */
- 	CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
--	/* Berlin 2CD */
--	CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55),
-+	/* Berlin 2CD/Q */
-+	CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
- };
- 
- struct phy_berlin_usb_priv {
-diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
-index bc42d6a..8882afb 100644
---- a/drivers/phy/phy-twl4030-usb.c
-+++ b/drivers/phy/phy-twl4030-usb.c
-@@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
- 	pm_runtime_use_autosuspend(&pdev->dev);
- 	pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
- 	pm_runtime_enable(&pdev->dev);
--	pm_runtime_get_sync(&pdev->dev);
- 
- 	/* Our job is to use irqs and status from the power module
- 	 * to keep the transceiver disabled when nothing's connected.
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-index 03aa58c..1eb084c 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-@@ -370,11 +370,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
- 	MPP_MODE(64,
- 	   MPP_FUNCTION(0x0, "gpio", NULL),
- 	   MPP_FUNCTION(0x1, "spi0", "miso"),
--	   MPP_FUNCTION(0x2, "spi0-1", "cs1")),
-+	   MPP_FUNCTION(0x2, "spi0", "cs1")),
- 	MPP_MODE(65,
- 	   MPP_FUNCTION(0x0, "gpio", NULL),
- 	   MPP_FUNCTION(0x1, "spi0", "mosi"),
--	   MPP_FUNCTION(0x2, "spi0-1", "cs2")),
-+	   MPP_FUNCTION(0x2, "spi0", "cs2")),
- };
- 
- static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-375.c b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
-index ca1e757..203291b 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
-@@ -92,19 +92,17 @@ static struct mvebu_mpp_mode mv88f6720_mpp_modes[] = {
- 		 MPP_FUNCTION(0x5, "nand", "io1")),
- 	MPP_MODE(8,
- 		 MPP_FUNCTION(0x0, "gpio", NULL),
--		 MPP_FUNCTION(0x1, "dev ", "bootcs"),
-+		 MPP_FUNCTION(0x1, "dev", "bootcs"),
- 		 MPP_FUNCTION(0x2, "spi0", "cs0"),
- 		 MPP_FUNCTION(0x3, "spi1", "cs0"),
- 		 MPP_FUNCTION(0x5, "nand", "ce")),
- 	MPP_MODE(9,
- 		 MPP_FUNCTION(0x0, "gpio", NULL),
--		 MPP_FUNCTION(0x1, "nf", "wen"),
- 		 MPP_FUNCTION(0x2, "spi0", "sck"),
- 		 MPP_FUNCTION(0x3, "spi1", "sck"),
- 		 MPP_FUNCTION(0x5, "nand", "we")),
- 	MPP_MODE(10,
- 		 MPP_FUNCTION(0x0, "gpio", NULL),
--		 MPP_FUNCTION(0x1, "nf", "ren"),
- 		 MPP_FUNCTION(0x2, "dram", "vttctrl"),
- 		 MPP_FUNCTION(0x3, "led", "c1"),
- 		 MPP_FUNCTION(0x5, "nand", "re"),
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
-index 83bbcc7..ff411a5 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
-@@ -94,37 +94,39 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd0",       V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
- 		 MPP_VAR_FUNCTION(4, "spi0",  "cs1",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "dev",   "ad14",       V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(5, "dev",   "ad14",       V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(6, "pcie3", "clkreq",     V_88F6810_PLUS)),
- 	MPP_MODE(13,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd1",       V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "pcie0", "clkreq",     V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "pcie1", "clkreq",     V_88F6820_PLUS),
- 		 MPP_VAR_FUNCTION(4, "spi0",  "cs2",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "dev",   "ad15",       V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(5, "dev",   "ad15",       V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(6, "pcie2", "clkreq",     V_88F6810_PLUS)),
- 	MPP_MODE(14,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd2",       V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "ptp",   "clk",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "m",     "vtt_ctrl",   V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "spi0",  "cs3",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "dev",   "wen1",       V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(5, "dev",   "wen1",       V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(6, "pcie3", "clkreq",     V_88F6810_PLUS)),
- 	MPP_MODE(15,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxd3",       V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "ge",    "mdc slave",  V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(4, "spi0",  "mosi",       V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "pcie1", "rstout",     V_88F6820_PLUS)),
-+		 MPP_VAR_FUNCTION(4, "spi0",  "mosi",       V_88F6810_PLUS)),
- 	MPP_MODE(16,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxctl",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "ge",    "mdio slave", V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "m",     "decc_err",   V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "spi0",  "miso",       V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "pcie0", "clkreq",     V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(5, "pcie0", "clkreq",     V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(6, "pcie1", "clkreq",     V_88F6820_PLUS)),
- 	MPP_MODE(17,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxclk",      V_88F6810_PLUS),
-@@ -137,13 +139,12 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(1, "ge0",   "rxerr",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "ptp",   "trig_gen",   V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "ua1",   "txd",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(4, "spi0",  "cs0",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "pcie1", "rstout",     V_88F6820_PLUS)),
-+		 MPP_VAR_FUNCTION(4, "spi0",  "cs0",        V_88F6810_PLUS)),
- 	MPP_MODE(19,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "col",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "ptp",   "event_req",  V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(3, "pcie0", "clkreq",     V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(3, "ge0",   "txerr",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "sata1", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "ua0",   "cts",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(6, "ua1",   "rxd",        V_88F6810_PLUS)),
-@@ -151,7 +152,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ge0",   "txclk",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "ptp",   "clk",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
- 		 MPP_VAR_FUNCTION(4, "sata0", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "ua0",   "rts",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(6, "ua1",   "txd",        V_88F6810_PLUS)),
-@@ -277,35 +277,27 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(1, "pcie0", "clkreq",     V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "m",     "vtt_ctrl",   V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "m",     "decc_err",   V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(4, "pcie0", "rstout",     V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(4, "spi1",  "cs2",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "dev",   "clkout",     V_88F6810_PLUS)),
- 	MPP_MODE(44,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "sata0", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "sata1", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "sata2", "prsnt",      V_88F6828),
--		 MPP_VAR_FUNCTION(4, "sata3", "prsnt",      V_88F6828),
--		 MPP_VAR_FUNCTION(5, "pcie0", "rstout",     V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(4, "sata3", "prsnt",      V_88F6828)),
- 	MPP_MODE(45,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ref",   "clk_out0",   V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
--		 MPP_VAR_FUNCTION(4, "pcie2", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "pcie3", "rstout",     V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS)),
- 	MPP_MODE(46,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "ref",   "clk_out1",   V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
--		 MPP_VAR_FUNCTION(4, "pcie2", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "pcie3", "rstout",     V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(2, "pcie0", "rstout",     V_88F6810_PLUS)),
- 	MPP_MODE(47,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "sata0", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "sata1", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "sata2", "prsnt",      V_88F6828),
--		 MPP_VAR_FUNCTION(4, "spi1",  "cs2",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "sata3", "prsnt",      V_88F6828)),
- 	MPP_MODE(48,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
-@@ -313,18 +305,19 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(2, "m",     "vtt_ctrl",   V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "tdm2c", "pclk",       V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "audio", "mclk",       V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "sd0",   "d4",         V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(5, "sd0",   "d4",         V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(6, "pcie0", "clkreq",     V_88F6810_PLUS)),
- 	MPP_MODE(49,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "sata2", "prsnt",      V_88F6828),
- 		 MPP_VAR_FUNCTION(2, "sata3", "prsnt",      V_88F6828),
- 		 MPP_VAR_FUNCTION(3, "tdm2c", "fsync",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "audio", "lrclk",      V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(5, "sd0",   "d5",         V_88F6810_PLUS)),
-+		 MPP_VAR_FUNCTION(5, "sd0",   "d5",         V_88F6810_PLUS),
-+		 MPP_VAR_FUNCTION(6, "pcie1", "clkreq",     V_88F6820_PLUS)),
- 	MPP_MODE(50,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(2, "pcie1", "rstout",     V_88F6820_PLUS),
- 		 MPP_VAR_FUNCTION(3, "tdm2c", "drx",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "audio", "extclk",     V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "sd0",   "cmd",        V_88F6810_PLUS)),
-@@ -336,7 +329,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 	MPP_MODE(52,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(2, "pcie1", "rstout",     V_88F6820_PLUS),
- 		 MPP_VAR_FUNCTION(3, "tdm2c", "intn",       V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(4, "audio", "sdi",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "sd0",   "d6",         V_88F6810_PLUS)),
-@@ -352,7 +344,7 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(1, "sata0", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "sata1", "prsnt",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(3, "pcie0", "rstout",     V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(4, "pcie1", "rstout",     V_88F6820_PLUS),
-+		 MPP_VAR_FUNCTION(4, "ge0",   "txerr",      V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "sd0",   "d3",         V_88F6810_PLUS)),
- 	MPP_MODE(55,
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
-@@ -382,7 +374,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0, "gpio",  NULL,         V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(1, "pcie0", "rstout",     V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(2, "i2c1",  "sda",        V_88F6810_PLUS),
--		 MPP_VAR_FUNCTION(3, "pcie1", "rstout",     V_88F6820_PLUS),
- 		 MPP_VAR_FUNCTION(4, "spi1",  "cs0",        V_88F6810_PLUS),
- 		 MPP_VAR_FUNCTION(5, "sd0",   "d2",         V_88F6810_PLUS)),
- };
-@@ -411,7 +402,7 @@ static struct mvebu_mpp_ctrl armada_38x_mpp_controls[] = {
- 
- static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = {
- 	MPP_GPIO_RANGE(0,   0,  0, 32),
--	MPP_GPIO_RANGE(1,  32, 32, 27),
-+	MPP_GPIO_RANGE(1,  32, 32, 28),
- };
- 
- static int armada_38x_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
-index 4249162..2dcf9b4 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
-@@ -380,7 +380,7 @@ static struct mvebu_mpp_ctrl armada_39x_mpp_controls[] = {
- 
- static struct pinctrl_gpio_range armada_39x_mpp_gpio_ranges[] = {
- 	MPP_GPIO_RANGE(0,   0,  0, 32),
--	MPP_GPIO_RANGE(1,  32, 32, 27),
-+	MPP_GPIO_RANGE(1,  32, 32, 28),
- };
- 
- static int armada_39x_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-index 578db9f..d7cdb14 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-@@ -14,10 +14,7 @@
-  * available: mv78230, mv78260 and mv78460. From a pin muxing
-  * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
-  * both have 67 MPP pins (more GPIOs and address lines for the memory
-- * bus mainly). The only difference between the mv78260 and the
-- * mv78460 in terms of pin muxing is the addition of two functions on
-- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
-- * cores, mv78460 has four cores).
-+ * bus mainly).
-  */
- 
- #include <linux/err.h>
-@@ -172,20 +169,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 	MPP_MODE(24,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sata1", "prsnt",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re",   V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "rst",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "hsync",      V_MV78230_PLUS)),
- 	MPP_MODE(25,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sata0", "prsnt",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we",   V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "pclk",       V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "vsync",      V_MV78230_PLUS)),
- 	MPP_MODE(26,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "fsync",      V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "lcd", "clk",        V_MV78230_PLUS)),
- 	MPP_MODE(27,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "ptp", "trig",       V_MV78230_PLUS),
-@@ -200,8 +194,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "ptp", "clk",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "int0",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk",    V_MV78230_PLUS)),
- 	MPP_MODE(30,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "clk",        V_MV78230_PLUS),
-@@ -209,13 +202,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 	MPP_MODE(31,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "cmd",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x3, "tdm", "int2",       V_MV78230_PLUS)),
- 	MPP_MODE(32,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "d0",         V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x3, "tdm", "int3",       V_MV78230_PLUS)),
- 	MPP_MODE(33,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "sd0", "d1",         V_MV78230_PLUS),
-@@ -247,7 +238,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "spi", "cs1",        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart2", "cts",      V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd",    V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync",  V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0",   V_MV78230_PLUS)),
- 	MPP_MODE(41,
-@@ -262,15 +252,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "rxd",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart0", "cts",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "tdm", "int7",       V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd",    V_MV78230_PLUS)),
-+		 MPP_VAR_FUNCTION(0x4, "tdm-1", "timer",    V_MV78230_PLUS)),
- 	MPP_MODE(43,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "txd",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "uart0", "rts",      V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x3, "spi", "cs3",        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd",  V_MV78460)),
-+		 MPP_VAR_FUNCTION(0x4, "pcie", "rstout",    V_MV78230_PLUS)),
- 	MPP_MODE(44,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "uart2", "cts",      V_MV78230_PLUS),
-@@ -299,7 +287,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3",   V_MV78230_PLUS)),
- 	MPP_MODE(48,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78230_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "tclk", NULL,        V_MV78230_PLUS),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "clkout",     V_MV78230_PLUS),
- 		 MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
- 	MPP_MODE(49,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
-@@ -321,16 +309,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- 		 MPP_VAR_FUNCTION(0x1, "dev", "ad19",       V_MV78260_PLUS)),
- 	MPP_MODE(55,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd",    V_MV78260_PLUS)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad20",       V_MV78260_PLUS)),
- 	MPP_MODE(56,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd",    V_MV78260_PLUS)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad21",       V_MV78260_PLUS)),
- 	MPP_MODE(57,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS),
--		 MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd",  V_MV78460)),
-+		 MPP_VAR_FUNCTION(0x1, "dev", "ad22",       V_MV78260_PLUS)),
- 	MPP_MODE(58,
- 		 MPP_VAR_FUNCTION(0x0, "gpio", NULL,        V_MV78260_PLUS),
- 		 MPP_VAR_FUNCTION(0x1, "dev", "ad23",       V_MV78260_PLUS)),
-diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c
-index 22280bd..8c51a3c 100644
---- a/drivers/pinctrl/pinctrl-zynq.c
-+++ b/drivers/pinctrl/pinctrl-zynq.c
-@@ -714,12 +714,13 @@ static const char * const gpio0_groups[] = {"gpio0_0_grp",
- 		.mux_val = mval,			\
- 	}
- 
--#define DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(fname, mval, mux, mask, shift)	\
-+#define DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(fname, mval, offset, mask, shift)\
- 	[ZYNQ_PMUX_##fname] = {				\
- 		.name = #fname,				\
- 		.groups = fname##_groups,		\
- 		.ngroups = ARRAY_SIZE(fname##_groups),	\
- 		.mux_val = mval,			\
-+		.mux = offset,				\
- 		.mux_mask = mask,			\
- 		.mux_shift = shift,			\
- 	}
-@@ -744,15 +745,15 @@ static const struct zynq_pinmux_function zynq_pmux_functions[] = {
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(spi1, 0x50),
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(sdio0, 0x40),
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(sdio0_pc, 0xc),
--	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_wp, 0, 130, ZYNQ_SDIO_WP_MASK,
-+	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_wp, 0, 0x130, ZYNQ_SDIO_WP_MASK,
- 					ZYNQ_SDIO_WP_SHIFT),
--	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_cd, 0, 130, ZYNQ_SDIO_CD_MASK,
-+	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_cd, 0, 0x130, ZYNQ_SDIO_CD_MASK,
- 					ZYNQ_SDIO_CD_SHIFT),
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(sdio1, 0x40),
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(sdio1_pc, 0xc),
--	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_wp, 0, 134, ZYNQ_SDIO_WP_MASK,
-+	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_wp, 0, 0x134, ZYNQ_SDIO_WP_MASK,
- 					ZYNQ_SDIO_WP_SHIFT),
--	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_cd, 0, 134, ZYNQ_SDIO_CD_MASK,
-+	DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_cd, 0, 0x134, ZYNQ_SDIO_CD_MASK,
- 					ZYNQ_SDIO_CD_SHIFT),
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(smc0_nor, 4),
- 	DEFINE_ZYNQ_PINMUX_FUNCTION(smc0_nor_cs1, 8),
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index d688d80..2c1d5f5 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -305,7 +305,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
- };
- 
- static struct calling_interface_buffer *buffer;
--static struct page *bufferpage;
- static DEFINE_MUTEX(buffer_mutex);
- 
- static int hwswitch_state;
-@@ -1896,12 +1895,11 @@ static int __init dell_init(void)
- 	 * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
- 	 * is passed to SMI handler.
- 	 */
--	bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
--	if (!bufferpage) {
-+	buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
-+	if (!buffer) {
- 		ret = -ENOMEM;
- 		goto fail_buffer;
- 	}
--	buffer = page_address(bufferpage);
- 
- 	ret = dell_setup_rfkill();
- 
-@@ -1965,7 +1963,7 @@ fail_backlight:
- 	cancel_delayed_work_sync(&dell_rfkill_work);
- 	dell_cleanup_rfkill();
- fail_rfkill:
--	free_page((unsigned long)bufferpage);
-+	free_page((unsigned long)buffer);
- fail_buffer:
- 	platform_device_del(platform_device);
- fail_platform_device2:
-diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
-index b496db8..cb7cd8d 100644
---- a/drivers/platform/x86/ideapad-laptop.c
-+++ b/drivers/platform/x86/ideapad-laptop.c
-@@ -464,8 +464,9 @@ static const struct ideapad_rfk_data ideapad_rfk_data[] = {
- static int ideapad_rfk_set(void *data, bool blocked)
- {
- 	struct ideapad_rfk_priv *priv = data;
-+	int opcode = ideapad_rfk_data[priv->dev].opcode;
- 
--	return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
-+	return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
- }
- 
- static struct rfkill_ops ideapad_rfk_ops = {
-@@ -837,6 +838,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
- 		},
- 	},
- 	{
-+		.ident = "Lenovo G50-30",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo G50-30"),
-+		},
-+	},
-+	{
- 		.ident = "Lenovo Yoga 2 11 / 13 / Pro",
- 		.matches = {
- 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
-index 515f338..49c1720 100644
---- a/drivers/pnp/system.c
-+++ b/drivers/pnp/system.c
-@@ -7,7 +7,6 @@
-  *	Bjorn Helgaas <bjorn.helgaas@hp.com>
-  */
- 
--#include <linux/acpi.h>
- #include <linux/pnp.h>
- #include <linux/device.h>
- #include <linux/init.h>
-@@ -23,41 +22,25 @@ static const struct pnp_device_id pnp_dev_table[] = {
- 	{"", 0}
- };
- 
--#ifdef CONFIG_ACPI
--static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
--{
--	u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY;
--	return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc);
--}
--#else
--static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
--{
--	struct resource *res;
--
--	res = io ? request_region(start, length, desc) :
--		request_mem_region(start, length, desc);
--	if (res) {
--		res->flags &= ~IORESOURCE_BUSY;
--		return true;
--	}
--	return false;
--}
--#endif
--
- static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
- {
- 	char *regionid;
- 	const char *pnpid = dev_name(&dev->dev);
- 	resource_size_t start = r->start, end = r->end;
--	bool reserved;
-+	struct resource *res;
- 
- 	regionid = kmalloc(16, GFP_KERNEL);
- 	if (!regionid)
- 		return;
- 
- 	snprintf(regionid, 16, "pnp %s", pnpid);
--	reserved = __reserve_range(start, end - start + 1, !!port, regionid);
--	if (!reserved)
-+	if (port)
-+		res = request_region(start, end - start + 1, regionid);
-+	else
-+		res = request_mem_region(start, end - start + 1, regionid);
-+	if (res)
-+		res->flags &= ~IORESOURCE_BUSY;
-+	else
- 		kfree(regionid);
- 
- 	/*
-@@ -66,7 +49,7 @@ static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
- 	 * have double reservations.
- 	 */
- 	dev_info(&dev->dev, "%pR %s reserved\n", r,
--		 reserved ? "has been" : "could not be");
-+		 res ? "has been" : "could not be");
- }
- 
- static void reserve_resources_of_dev(struct pnp_dev *dev)
-diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
-index 0479e80..d87a85c 100644
---- a/drivers/rtc/rtc-snvs.c
-+++ b/drivers/rtc/rtc-snvs.c
-@@ -322,6 +322,13 @@ static int snvs_rtc_suspend(struct device *dev)
- 	if (device_may_wakeup(dev))
- 		enable_irq_wake(data->irq);
- 
-+	return 0;
-+}
-+
-+static int snvs_rtc_suspend_noirq(struct device *dev)
-+{
-+	struct snvs_rtc_data *data = dev_get_drvdata(dev);
-+
- 	if (data->clk)
- 		clk_disable_unprepare(data->clk);
- 
-@@ -331,23 +338,28 @@ static int snvs_rtc_suspend(struct device *dev)
- static int snvs_rtc_resume(struct device *dev)
- {
- 	struct snvs_rtc_data *data = dev_get_drvdata(dev);
--	int ret;
- 
- 	if (device_may_wakeup(dev))
--		disable_irq_wake(data->irq);
-+		return disable_irq_wake(data->irq);
- 
--	if (data->clk) {
--		ret = clk_prepare_enable(data->clk);
--		if (ret)
--			return ret;
--	}
-+	return 0;
-+}
-+
-+static int snvs_rtc_resume_noirq(struct device *dev)
-+{
-+	struct snvs_rtc_data *data = dev_get_drvdata(dev);
-+
-+	if (data->clk)
-+		return clk_prepare_enable(data->clk);
- 
- 	return 0;
- }
- 
- static const struct dev_pm_ops snvs_rtc_pm_ops = {
--	.suspend_noirq = snvs_rtc_suspend,
--	.resume_noirq = snvs_rtc_resume,
-+	.suspend = snvs_rtc_suspend,
-+	.suspend_noirq = snvs_rtc_suspend_noirq,
-+	.resume = snvs_rtc_resume,
-+	.resume_noirq = snvs_rtc_resume_noirq,
- };
- 
- #define SNVS_RTC_PM_OPS	(&snvs_rtc_pm_ops)
-diff --git a/drivers/staging/comedi/drivers/cb_pcimdas.c b/drivers/staging/comedi/drivers/cb_pcimdas.c
-index c458e50..4ebf5aa 100644
---- a/drivers/staging/comedi/drivers/cb_pcimdas.c
-+++ b/drivers/staging/comedi/drivers/cb_pcimdas.c
-@@ -243,7 +243,7 @@ static int cb_pcimdas_ao_insn_write(struct comedi_device *dev,
- 	return insn->n;
- }
- 
--static int cb_pcimdas_di_insn_read(struct comedi_device *dev,
-+static int cb_pcimdas_di_insn_bits(struct comedi_device *dev,
- 				   struct comedi_subdevice *s,
- 				   struct comedi_insn *insn,
- 				   unsigned int *data)
-@@ -258,7 +258,7 @@ static int cb_pcimdas_di_insn_read(struct comedi_device *dev,
- 	return insn->n;
- }
- 
--static int cb_pcimdas_do_insn_write(struct comedi_device *dev,
-+static int cb_pcimdas_do_insn_bits(struct comedi_device *dev,
- 				    struct comedi_subdevice *s,
- 				    struct comedi_insn *insn,
- 				    unsigned int *data)
-@@ -424,7 +424,7 @@ static int cb_pcimdas_auto_attach(struct comedi_device *dev,
- 	s->n_chan	= 4;
- 	s->maxdata	= 1;
- 	s->range_table	= &range_digital;
--	s->insn_read	= cb_pcimdas_di_insn_read;
-+	s->insn_bits	= cb_pcimdas_di_insn_bits;
- 
- 	/* Digital Output subdevice (main connector) */
- 	s = &dev->subdevices[4];
-@@ -433,7 +433,7 @@ static int cb_pcimdas_auto_attach(struct comedi_device *dev,
- 	s->n_chan	= 4;
- 	s->maxdata	= 1;
- 	s->range_table	= &range_digital;
--	s->insn_write	= cb_pcimdas_do_insn_write;
-+	s->insn_bits	= cb_pcimdas_do_insn_bits;
- 
- 	/* Counter subdevice (8254) */
- 	s = &dev->subdevices[5];
-diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
-index 50227b5..fcb8c61 100644
---- a/drivers/staging/rtl8712/rtl8712_recv.c
-+++ b/drivers/staging/rtl8712/rtl8712_recv.c
-@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
- 		/* for first fragment packet, driver need allocate 1536 +
- 		 * drvinfo_sz + RXDESC_SIZE to defrag packet. */
- 		if ((mf == 1) && (frag == 0))
--			alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
-+			/*1658+6=1664, 1664 is 128 alignment.*/
-+			alloc_sz = max_t(u16, tmp_len, 1658);
- 		else
- 			alloc_sz = tmp_len;
- 		/* 2 is for IP header 4 bytes alignment in QoS packet case.
-diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
-index 0343ae3..15baacb 100644
---- a/drivers/staging/vt6655/device_main.c
-+++ b/drivers/staging/vt6655/device_main.c
-@@ -807,6 +807,10 @@ static int device_rx_srv(struct vnt_private *pDevice, unsigned int uIdx)
- 	     pRD = pRD->next) {
- 		if (works++ > 15)
- 			break;
-+
-+		if (!pRD->pRDInfo->skb)
-+			break;
-+
- 		if (vnt_receive_frame(pDevice, pRD)) {
- 			if (!device_alloc_rx_buf(pDevice, pRD)) {
- 				dev_err(&pDevice->pcid->dev,
-@@ -1417,7 +1421,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
- 
- 	priv->current_aid = conf->aid;
- 
--	if (changed & BSS_CHANGED_BSSID) {
-+	if (changed & BSS_CHANGED_BSSID && conf->bssid) {
- 		unsigned long flags;
- 
- 		spin_lock_irqsave(&priv->lock, flags);
-diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
-index ab3ab84..766fdce 100644
---- a/drivers/staging/vt6656/main_usb.c
-+++ b/drivers/staging/vt6656/main_usb.c
-@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
- 
- 	priv->current_aid = conf->aid;
- 
--	if (changed & BSS_CHANGED_BSSID)
-+	if (changed & BSS_CHANGED_BSSID && conf->bssid)
- 		vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid);
- 
- 
-diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
-index f8120c1..8cd3534 100644
---- a/drivers/tty/serial/Kconfig
-+++ b/drivers/tty/serial/Kconfig
-@@ -241,7 +241,6 @@ config SERIAL_SAMSUNG
- 	tristate "Samsung SoC serial support"
- 	depends on PLAT_SAMSUNG || ARCH_EXYNOS
- 	select SERIAL_CORE
--	select SERIAL_EARLYCON
- 	help
- 	  Support for the on-chip UARTs on the Samsung S3C24XX series CPUs,
- 	  providing /dev/ttySAC0, 1 and 2 (note, some machines may not
-@@ -277,6 +276,7 @@ config SERIAL_SAMSUNG_CONSOLE
- 	bool "Support for console on Samsung SoC serial port"
- 	depends on SERIAL_SAMSUNG=y
- 	select SERIAL_CORE_CONSOLE
-+	select SERIAL_EARLYCON
- 	help
- 	  Allow selection of the S3C24XX on-board serial ports for use as
- 	  an virtual console.
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 27dade2..5ca1dfb 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -315,8 +315,7 @@ static int atmel_config_rs485(struct uart_port *port,
- 	if (rs485conf->flags & SER_RS485_ENABLED) {
- 		dev_dbg(port->dev, "Setting UART to RS485\n");
- 		atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
--		if ((rs485conf->delay_rts_after_send) > 0)
--			UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
-+		UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
- 		mode |= ATMEL_US_USMODE_RS485;
- 	} else {
- 		dev_dbg(port->dev, "Setting UART to RS232\n");
-@@ -354,8 +353,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
- 
- 	/* override mode to RS485 if needed, otherwise keep the current mode */
- 	if (port->rs485.flags & SER_RS485_ENABLED) {
--		if ((port->rs485.delay_rts_after_send) > 0)
--			UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
-+		UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
- 		mode &= ~ATMEL_US_USMODE;
- 		mode |= ATMEL_US_USMODE_RS485;
- 	}
-@@ -2061,8 +2059,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
- 
- 	/* mode */
- 	if (port->rs485.flags & SER_RS485_ENABLED) {
--		if ((port->rs485.delay_rts_after_send) > 0)
--			UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
-+		UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
- 		mode |= ATMEL_US_USMODE_RS485;
- 	} else if (termios->c_cflag & CRTSCTS) {
- 		/* RS232 with hardware handshake (RTS/CTS) */
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index 843f2cd..9ffdfcf 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -55,9 +55,6 @@
- static int __read_mostly sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE;
- static bool __read_mostly sysrq_always_enabled;
- 
--unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED };
--int sysrq_reset_downtime_ms __weak;
--
- static bool sysrq_on(void)
- {
- 	return sysrq_enabled || sysrq_always_enabled;
-@@ -569,6 +566,7 @@ void handle_sysrq(int key)
- EXPORT_SYMBOL(handle_sysrq);
- 
- #ifdef CONFIG_INPUT
-+static int sysrq_reset_downtime_ms;
- 
- /* Simple translation table for the SysRq keys */
- static const unsigned char sysrq_xlate[KEY_CNT] =
-@@ -949,23 +947,8 @@ static bool sysrq_handler_registered;
- 
- static inline void sysrq_register_handler(void)
- {
--	unsigned short key;
- 	int error;
--	int i;
--
--	/* First check if a __weak interface was instantiated. */
--	for (i = 0; i < ARRAY_SIZE(sysrq_reset_seq); i++) {
--		key = platform_sysrq_reset_seq[i];
--		if (key == KEY_RESERVED || key > KEY_MAX)
--			break;
--
--		sysrq_reset_seq[sysrq_reset_seq_len++] = key;
--	}
- 
--	/*
--	 * DT configuration takes precedence over anything that would
--	 * have been defined via the __weak interface.
--	 */
- 	sysrq_of_get_keyreset_config();
- 
- 	error = input_register_handler(&sysrq_handler);
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 4b0448c..986abde 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
- 	snoop(&urb->dev->dev, "urb complete\n");
- 	snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
- 			as->status, COMPLETE, NULL, 0);
--	if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
-+	if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
- 		snoop_urb_data(urb, urb->actual_length);
- 
- 	if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
-diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index 45a915c..1c1385e 100644
---- a/drivers/usb/core/hcd.c
-+++ b/drivers/usb/core/hcd.c
-@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_hcd *hcd)
- 				dev_name(&usb_dev->dev), retval);
- 		return (retval < 0) ? retval : -EMSGSIZE;
- 	}
--	if (usb_dev->speed == USB_SPEED_SUPER) {
-+
-+	if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
- 		retval = usb_get_bos_descriptor(usb_dev);
--		if (retval < 0) {
-+		if (!retval) {
-+			usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
-+		} else if (usb_dev->speed == USB_SPEED_SUPER) {
- 			mutex_unlock(&usb_bus_list_lock);
- 			dev_dbg(parent_dev, "can't read %s bos descriptor %d\n",
- 					dev_name(&usb_dev->dev), retval);
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 3b71516..1e9a8c9 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
- 	return usb_get_intfdata(hdev->actconfig->interface[0]);
- }
- 
--static int usb_device_supports_lpm(struct usb_device *udev)
-+int usb_device_supports_lpm(struct usb_device *udev)
- {
- 	/* USB 2.1 (and greater) devices indicate LPM support through
- 	 * their USB 2.0 Extended Capabilities BOS descriptor.
-@@ -2616,9 +2616,6 @@ static bool use_new_scheme(struct usb_device *udev, int retry)
- 	return USE_NEW_SCHEME(retry);
- }
- 
--static int hub_port_reset(struct usb_hub *hub, int port1,
--			struct usb_device *udev, unsigned int delay, bool warm);
--
- /* Is a USB 3.0 port in the Inactive or Compliance Mode state?
-  * Port worm reset is required to recover
-  */
-@@ -2706,44 +2703,6 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
- 	return 0;
- }
- 
--static void hub_port_finish_reset(struct usb_hub *hub, int port1,
--			struct usb_device *udev, int *status)
--{
--	switch (*status) {
--	case 0:
--		/* TRSTRCY = 10 ms; plus some extra */
--		msleep(10 + 40);
--		if (udev) {
--			struct usb_hcd *hcd = bus_to_hcd(udev->bus);
--
--			update_devnum(udev, 0);
--			/* The xHC may think the device is already reset,
--			 * so ignore the status.
--			 */
--			if (hcd->driver->reset_device)
--				hcd->driver->reset_device(hcd, udev);
--		}
--		/* FALL THROUGH */
--	case -ENOTCONN:
--	case -ENODEV:
--		usb_clear_port_feature(hub->hdev,
--				port1, USB_PORT_FEAT_C_RESET);
--		if (hub_is_superspeed(hub->hdev)) {
--			usb_clear_port_feature(hub->hdev, port1,
--					USB_PORT_FEAT_C_BH_PORT_RESET);
--			usb_clear_port_feature(hub->hdev, port1,
--					USB_PORT_FEAT_C_PORT_LINK_STATE);
--			usb_clear_port_feature(hub->hdev, port1,
--					USB_PORT_FEAT_C_CONNECTION);
--		}
--		if (udev)
--			usb_set_device_state(udev, *status
--					? USB_STATE_NOTATTACHED
--					: USB_STATE_DEFAULT);
--		break;
--	}
--}
--
- /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
- static int hub_port_reset(struct usb_hub *hub, int port1,
- 			struct usb_device *udev, unsigned int delay, bool warm)
-@@ -2767,13 +2726,10 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
- 		 * If the caller hasn't explicitly requested a warm reset,
- 		 * double check and see if one is needed.
- 		 */
--		status = hub_port_status(hub, port1,
--					&portstatus, &portchange);
--		if (status < 0)
--			goto done;
--
--		if (hub_port_warm_reset_required(hub, port1, portstatus))
--			warm = true;
-+		if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
-+			if (hub_port_warm_reset_required(hub, port1,
-+							portstatus))
-+				warm = true;
- 	}
- 	clear_bit(port1, hub->warm_reset_bits);
- 
-@@ -2799,11 +2755,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
- 
- 		/* Check for disconnect or reset */
- 		if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
--			hub_port_finish_reset(hub, port1, udev, &status);
-+			usb_clear_port_feature(hub->hdev, port1,
-+					USB_PORT_FEAT_C_RESET);
- 
- 			if (!hub_is_superspeed(hub->hdev))
- 				goto done;
- 
-+			usb_clear_port_feature(hub->hdev, port1,
-+					USB_PORT_FEAT_C_BH_PORT_RESET);
-+			usb_clear_port_feature(hub->hdev, port1,
-+					USB_PORT_FEAT_C_PORT_LINK_STATE);
-+			usb_clear_port_feature(hub->hdev, port1,
-+					USB_PORT_FEAT_C_CONNECTION);
-+
- 			/*
- 			 * If a USB 3.0 device migrates from reset to an error
- 			 * state, re-issue the warm reset.
-@@ -2836,6 +2800,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
- 	dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n");
- 
- done:
-+	if (status == 0) {
-+		/* TRSTRCY = 10 ms; plus some extra */
-+		msleep(10 + 40);
-+		if (udev) {
-+			struct usb_hcd *hcd = bus_to_hcd(udev->bus);
-+
-+			update_devnum(udev, 0);
-+			/* The xHC may think the device is already reset,
-+			 * so ignore the status.
-+			 */
-+			if (hcd->driver->reset_device)
-+				hcd->driver->reset_device(hcd, udev);
-+
-+			usb_set_device_state(udev, USB_STATE_DEFAULT);
-+		}
-+	} else {
-+		if (udev)
-+			usb_set_device_state(udev, USB_STATE_NOTATTACHED);
-+	}
-+
- 	if (!hub_is_superspeed(hub->hdev))
- 		up_read(&ehci_cf_port_reset_rwsem);
- 
-diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
-index 7eb1e26..457255a 100644
---- a/drivers/usb/core/usb.h
-+++ b/drivers/usb/core/usb.h
-@@ -65,6 +65,7 @@ extern int  usb_hub_init(void);
- extern void usb_hub_cleanup(void);
- extern int usb_major_init(void);
- extern void usb_major_cleanup(void);
-+extern int usb_device_supports_lpm(struct usb_device *udev);
- 
- #ifdef	CONFIG_PM
- 
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 2ef3c8d..69e769c 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
- 		dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
- 		ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
- 		break;
-+	case USB_REQ_SET_INTERFACE:
-+		dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
-+		dwc->start_config_issued = false;
-+		/* Fall through */
- 	default:
- 		dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
- 		ret = dwc3_ep0_delegate_req(dwc, ctrl);
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 8946c32..333a7c0 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -291,6 +291,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, unsigned cmd, u32 param)
- 			dwc3_trace(trace_dwc3_gadget,
- 					"Command Complete --> %d",
- 					DWC3_DGCMD_STATUS(reg));
-+			if (DWC3_DGCMD_STATUS(reg))
-+				return -EINVAL;
- 			return 0;
- 		}
- 
-@@ -328,6 +330,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- 			dwc3_trace(trace_dwc3_gadget,
- 					"Command Complete --> %d",
- 					DWC3_DEPCMD_STATUS(reg));
-+			if (DWC3_DEPCMD_STATUS(reg))
-+				return -EINVAL;
- 			return 0;
- 		}
- 
-@@ -1902,12 +1906,16 @@ static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
- {
- 	unsigned		status = 0;
- 	int			clean_busy;
-+	u32			is_xfer_complete;
-+
-+	is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE);
- 
- 	if (event->status & DEPEVT_STATUS_BUSERR)
- 		status = -ECONNRESET;
- 
- 	clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
--	if (clean_busy)
-+	if (clean_busy && (is_xfer_complete ||
-+				usb_endpoint_xfer_isoc(dep->endpoint.desc)))
- 		dep->flags &= ~DWC3_EP_BUSY;
- 
- 	/*
-diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
-index 4e3447b..58b4657 100644
---- a/drivers/usb/gadget/composite.c
-+++ b/drivers/usb/gadget/composite.c
-@@ -1758,10 +1758,13 @@ unknown:
- 		 * take such requests too, if that's ever needed:  to work
- 		 * in config 0, etc.
- 		 */
--		list_for_each_entry(f, &cdev->config->functions, list)
--			if (f->req_match && f->req_match(f, ctrl))
--				goto try_fun_setup;
--		f = NULL;
-+		if (cdev->config) {
-+			list_for_each_entry(f, &cdev->config->functions, list)
-+				if (f->req_match && f->req_match(f, ctrl))
-+					goto try_fun_setup;
-+			f = NULL;
-+		}
-+
- 		switch (ctrl->bRequestType & USB_RECIP_MASK) {
- 		case USB_RECIP_INTERFACE:
- 			if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
-diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
-index 45b8c8b..6e7be91 100644
---- a/drivers/usb/gadget/function/f_fs.c
-+++ b/drivers/usb/gadget/function/f_fs.c
-@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
- 
- 	kiocb->private = p;
- 
--	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-+	if (p->aio)
-+		kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
- 
- 	res = ffs_epfile_io(kiocb->ki_filp, p);
- 	if (res == -EIOCBQUEUED)
-@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
- 
- 	kiocb->private = p;
- 
--	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-+	if (p->aio)
-+		kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
- 
- 	res = ffs_epfile_io(kiocb->ki_filp, p);
- 	if (res == -EIOCBQUEUED)
-diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
-index 3cc109f..15c3071 100644
---- a/drivers/usb/gadget/function/f_mass_storage.c
-+++ b/drivers/usb/gadget/function/f_mass_storage.c
-@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
- 		return -EINVAL;
- 	}
- 
--	curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
-+	curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
- 	if (unlikely(!curlun))
- 		return -ENOMEM;
- 
-@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
- 	common->luns = curlun;
- 	common->nluns = nluns;
- 
--	pr_info("Number of LUNs=%d\n", common->nluns);
--
- 	return 0;
- }
- EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
-@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
- 	struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
- 	struct fsg_common *common = opts->common;
- 	struct fsg_dev *fsg;
-+	unsigned nluns, i;
- 
- 	fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
- 	if (unlikely(!fsg))
- 		return ERR_PTR(-ENOMEM);
- 
- 	mutex_lock(&opts->lock);
-+	if (!opts->refcnt) {
-+		for (nluns = i = 0; i < FSG_MAX_LUNS; ++i)
-+			if (common->luns[i])
-+				nluns = i + 1;
-+		if (!nluns)
-+			pr_warn("No LUNS defined, continuing anyway\n");
-+		else
-+			common->nluns = nluns;
-+		pr_info("Number of LUNs=%u\n", common->nluns);
-+	}
- 	opts->refcnt++;
- 	mutex_unlock(&opts->lock);
-+
- 	fsg->function.name	= FSG_DRIVER_DESC;
- 	fsg->function.bind	= fsg_bind;
- 	fsg->function.unbind	= fsg_unbind;
-diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
-index d32160d..5da37c9 100644
---- a/drivers/usb/gadget/udc/mv_udc_core.c
-+++ b/drivers/usb/gadget/udc/mv_udc_core.c
-@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_device *pdev)
- 		return -ENODEV;
- 	}
- 
--	udc->phy_regs = ioremap(r->start, resource_size(r));
-+	udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r));
- 	if (udc->phy_regs == NULL) {
- 		dev_err(&pdev->dev, "failed to map phy I/O memory\n");
- 		return -EBUSY;
-diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
-index 1463c39..fe1d5fc 100644
---- a/drivers/usb/host/ohci-q.c
-+++ b/drivers/usb/host/ohci-q.c
-@@ -980,10 +980,6 @@ rescan_all:
- 		int			completed, modified;
- 		__hc32			*prev;
- 
--		/* Is this ED already invisible to the hardware? */
--		if (ed->state == ED_IDLE)
--			goto ed_idle;
--
- 		/* only take off EDs that the HC isn't using, accounting for
- 		 * frame counter wraps and EDs with partially retired TDs
- 		 */
-@@ -1011,12 +1007,10 @@ skip_ed:
- 		}
- 
- 		/* ED's now officially unlinked, hc doesn't see */
--		ed->state = ED_IDLE;
- 		ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
- 		ed->hwNextED = 0;
- 		wmb();
- 		ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
--ed_idle:
- 
- 		/* reentrancy:  if we drop the schedule lock, someone might
- 		 * have modified this list.  normally it's just prepending
-@@ -1087,6 +1081,7 @@ rescan_this:
- 		if (list_empty(&ed->td_list)) {
- 			*last = ed->ed_next;
- 			ed->ed_next = NULL;
-+			ed->state = ED_IDLE;
- 			list_del(&ed->in_use_list);
- 		} else if (ohci->rh_state == OHCI_RH_RUNNING) {
- 			*last = ed->ed_next;
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index f833640..3e442f7 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 		/* Attempt to use the ring cache */
- 		if (virt_dev->num_rings_cached == 0)
- 			return -ENOMEM;
-+		virt_dev->num_rings_cached--;
- 		virt_dev->eps[ep_index].new_ring =
- 			virt_dev->ring_cache[virt_dev->num_rings_cached];
- 		virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
--		virt_dev->num_rings_cached--;
- 		xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
- 					1, type);
- 	}
-diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
-index 86c4b53..4731bac 100644
---- a/drivers/usb/musb/musb_virthub.c
-+++ b/drivers/usb/musb/musb_virthub.c
-@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
- #ifdef CONFIG_USB_MUSB_HOST
- 	return 1;
- #else
--	if (musb->port_mode == MUSB_PORT_MODE_HOST)
--		return 1;
--	return musb->g.dev.driver != NULL;
-+	return musb->port_mode == MUSB_PORT_MODE_HOST;
- #endif
- }
- 
-diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
-index 8f7cb06..3fcc048 100644
---- a/drivers/usb/phy/phy-mxs-usb.c
-+++ b/drivers/usb/phy/phy-mxs-usb.c
-@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(struct mxs_phy *mxs_phy)
- {
- 	unsigned int vbus_value;
- 
-+	if (!mxs_phy->regmap_anatop)
-+		return false;
-+
- 	if (mxs_phy->port_id == 0)
- 		regmap_read(mxs_phy->regmap_anatop,
- 			ANADIG_USB1_VBUS_DET_STAT,
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index ffd739e..eac7cca 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
- 	{ USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
- 	{ USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
-+	{ USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
- 	{ USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- 	{ USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
- 	{ USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index f0c0c53..19b85ee 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1765,6 +1765,7 @@ static const struct usb_device_id option_ids[] = {
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+	{ USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) },                /* OLICARD300 - MT6225 */
- 	{ USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- 	{ USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
- 	{ } /* Terminating entry */
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 529066b..46f1f13 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void)
- 	tty_unregister_driver(usb_serial_tty_driver);
- 	put_tty_driver(usb_serial_tty_driver);
- 	bus_unregister(&usb_serial_bus_type);
-+	idr_destroy(&serial_minors);
- }
- 
- 
-diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
-index 1f11a20..55eb86c 100644
---- a/drivers/w1/slaves/w1_therm.c
-+++ b/drivers/w1/slaves/w1_therm.c
-@@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1_THERM_DS28EA00));
- static int w1_strong_pullup = 1;
- module_param_named(strong_pullup, w1_strong_pullup, int, 0);
- 
-+struct w1_therm_family_data {
-+	uint8_t rom[9];
-+	atomic_t refcnt;
-+};
-+
-+/* return the address of the refcnt in the family data */
-+#define THERM_REFCNT(family_data) \
-+	(&((struct w1_therm_family_data*)family_data)->refcnt)
-+
- static int w1_therm_add_slave(struct w1_slave *sl)
- {
--	sl->family_data = kzalloc(9, GFP_KERNEL);
-+	sl->family_data = kzalloc(sizeof(struct w1_therm_family_data),
-+		GFP_KERNEL);
- 	if (!sl->family_data)
- 		return -ENOMEM;
-+	atomic_set(THERM_REFCNT(sl->family_data), 1);
- 	return 0;
- }
- 
- static void w1_therm_remove_slave(struct w1_slave *sl)
- {
-+	int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data));
-+	while(refcnt) {
-+		msleep(1000);
-+		refcnt = atomic_read(THERM_REFCNT(sl->family_data));
-+	}
- 	kfree(sl->family_data);
- 	sl->family_data = NULL;
- }
-@@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct device *device,
- 	struct w1_slave *sl = dev_to_w1_slave(device);
- 	struct w1_master *dev = sl->master;
- 	u8 rom[9], crc, verdict, external_power;
--	int i, max_trying = 10;
-+	int i, ret, max_trying = 10;
- 	ssize_t c = PAGE_SIZE;
-+	u8 *family_data = sl->family_data;
-+
-+	ret = mutex_lock_interruptible(&dev->bus_mutex);
-+	if (ret != 0)
-+		goto post_unlock;
- 
--	i = mutex_lock_interruptible(&dev->bus_mutex);
--	if (i != 0)
--		return i;
-+	if(!sl->family_data)
-+	{
-+		ret = -ENODEV;
-+		goto pre_unlock;
-+	}
- 
-+	/* prevent the slave from going away in sleep */
-+	atomic_inc(THERM_REFCNT(family_data));
- 	memset(rom, 0, sizeof(rom));
- 
- 	while (max_trying--) {
-@@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct device *device,
- 				mutex_unlock(&dev->bus_mutex);
- 
- 				sleep_rem = msleep_interruptible(tm);
--				if (sleep_rem != 0)
--					return -EINTR;
-+				if (sleep_rem != 0) {
-+					ret = -EINTR;
-+					goto post_unlock;
-+				}
- 
--				i = mutex_lock_interruptible(&dev->bus_mutex);
--				if (i != 0)
--					return i;
-+				ret = mutex_lock_interruptible(&dev->bus_mutex);
-+				if (ret != 0)
-+					goto post_unlock;
- 			} else if (!w1_strong_pullup) {
- 				sleep_rem = msleep_interruptible(tm);
- 				if (sleep_rem != 0) {
--					mutex_unlock(&dev->bus_mutex);
--					return -EINTR;
-+					ret = -EINTR;
-+					goto pre_unlock;
- 				}
- 			}
- 
-@@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct device *device,
- 	c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
- 			   crc, (verdict) ? "YES" : "NO");
- 	if (verdict)
--		memcpy(sl->family_data, rom, sizeof(rom));
-+		memcpy(family_data, rom, sizeof(rom));
- 	else
- 		dev_warn(device, "Read failed CRC check\n");
- 
- 	for (i = 0; i < 9; ++i)
- 		c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
--			      ((u8 *)sl->family_data)[i]);
-+			      ((u8 *)family_data)[i]);
- 
- 	c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
- 		w1_convert_temp(rom, sl->family->fid));
-+	ret = PAGE_SIZE - c;
-+
-+pre_unlock:
- 	mutex_unlock(&dev->bus_mutex);
- 
--	return PAGE_SIZE - c;
-+post_unlock:
-+	atomic_dec(THERM_REFCNT(family_data));
-+	return ret;
- }
- 
- static int __init w1_therm_init(void)
-diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
-index 1e6be9e..c9c97da 100644
---- a/drivers/watchdog/omap_wdt.c
-+++ b/drivers/watchdog/omap_wdt.c
-@@ -132,6 +132,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
- 
- 	pm_runtime_get_sync(wdev->dev);
- 
-+	/*
-+	 * Make sure the watchdog is disabled. This is unfortunately required
-+	 * because writing to various registers with the watchdog running has no
-+	 * effect.
-+	 */
-+	omap_wdt_disable(wdev);
-+
- 	/* initialize prescaler */
- 	while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
- 		cpu_relax();
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index 703342e..53f1e8a 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
- 	unlock_new_inode(inode);
- 	return inode;
- error:
--	unlock_new_inode(inode);
--	iput(inode);
-+	iget_failed(inode);
- 	return ERR_PTR(retval);
- 
- }
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
-index 9861c7c..4d3ecfb 100644
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
- 	unlock_new_inode(inode);
- 	return inode;
- error:
--	unlock_new_inode(inode);
--	iput(inode);
-+	iget_failed(inode);
- 	return ERR_PTR(retval);
- 
- }
-diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
-index f6a596d..d4a582a 100644
---- a/fs/btrfs/inode-map.c
-+++ b/fs/btrfs/inode-map.c
-@@ -246,6 +246,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- {
- 	struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
- 	struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset;
-+	spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock;
- 	struct btrfs_free_space *info;
- 	struct rb_node *n;
- 	u64 count;
-@@ -254,24 +255,30 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- 		return;
- 
- 	while (1) {
-+		bool add_to_ctl = true;
-+
-+		spin_lock(rbroot_lock);
- 		n = rb_first(rbroot);
--		if (!n)
-+		if (!n) {
-+			spin_unlock(rbroot_lock);
- 			break;
-+		}
- 
- 		info = rb_entry(n, struct btrfs_free_space, offset_index);
- 		BUG_ON(info->bitmap); /* Logic error */
- 
- 		if (info->offset > root->ino_cache_progress)
--			goto free;
-+			add_to_ctl = false;
- 		else if (info->offset + info->bytes > root->ino_cache_progress)
- 			count = root->ino_cache_progress - info->offset + 1;
- 		else
- 			count = info->bytes;
- 
--		__btrfs_add_free_space(ctl, info->offset, count);
--free:
- 		rb_erase(&info->offset_index, rbroot);
--		kfree(info);
-+		spin_unlock(rbroot_lock);
-+		if (add_to_ctl)
-+			__btrfs_add_free_space(ctl, info->offset, count);
-+		kmem_cache_free(btrfs_free_space_cachep, info);
- 	}
- }
- 
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 1c22c65..37d456a 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -2413,8 +2413,6 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
- 		goto out_unlock_inode;
- 	}
- 
--	d_invalidate(dentry);
--
- 	down_write(&root->fs_info->subvol_sem);
- 
- 	err = may_destroy_subvol(dest);
-@@ -2508,7 +2506,7 @@ out_up_write:
- out_unlock_inode:
- 	mutex_unlock(&inode->i_mutex);
- 	if (!err) {
--		shrink_dcache_sb(root->fs_info->sb);
-+		d_invalidate(dentry);
- 		btrfs_invalidate_inodes(dest);
- 		d_delete(dentry);
- 		ASSERT(dest->send_in_progress == 0);
-@@ -2940,7 +2938,7 @@ out_unlock:
- static long btrfs_ioctl_file_extent_same(struct file *file,
- 			struct btrfs_ioctl_same_args __user *argp)
- {
--	struct btrfs_ioctl_same_args *same;
-+	struct btrfs_ioctl_same_args *same = NULL;
- 	struct btrfs_ioctl_same_extent_info *info;
- 	struct inode *src = file_inode(file);
- 	u64 off;
-@@ -2970,6 +2968,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
- 
- 	if (IS_ERR(same)) {
- 		ret = PTR_ERR(same);
-+		same = NULL;
- 		goto out;
- 	}
- 
-@@ -3040,6 +3039,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
- 
- out:
- 	mnt_drop_write_file(file);
-+	kfree(same);
- 	return ret;
- }
- 
-@@ -3434,6 +3434,20 @@ process_slot:
- 				u64 trim = 0;
- 				u64 aligned_end = 0;
- 
-+				/*
-+				 * Don't copy an inline extent into an offset
-+				 * greater than zero. Having an inline extent
-+				 * at such an offset results in chaos as btrfs
-+				 * isn't prepared for such cases. Just skip
-+				 * this case for the same reasons as commented
-+				 * at btrfs_ioctl_clone().
-+				 */
-+				if (last_dest_end > 0) {
-+					ret = -EOPNOTSUPP;
-+					btrfs_end_transaction(trans, root);
-+					goto out;
-+				}
-+
- 				if (off > key.offset) {
- 					skip = off - key.offset;
- 					new_key.offset += skip;
-diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
-index 5628e25..94e909c 100644
---- a/fs/btrfs/transaction.c
-+++ b/fs/btrfs/transaction.c
-@@ -758,7 +758,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
- 
- 	if (!list_empty(&trans->ordered)) {
- 		spin_lock(&info->trans_lock);
--		list_splice(&trans->ordered, &cur_trans->pending_ordered);
-+		list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
- 		spin_unlock(&info->trans_lock);
- 	}
- 
-@@ -1848,7 +1848,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
- 	}
- 
- 	spin_lock(&root->fs_info->trans_lock);
--	list_splice(&trans->ordered, &cur_trans->pending_ordered);
-+	list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
- 	if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
- 		spin_unlock(&root->fs_info->trans_lock);
- 		atomic_inc(&cur_trans->use_count);
-diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index d049683..4920fce 100644
---- a/fs/btrfs/tree-log.c
-+++ b/fs/btrfs/tree-log.c
-@@ -4161,6 +4161,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
- 	u64 ino = btrfs_ino(inode);
- 	struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
- 	u64 logged_isize = 0;
-+	bool need_log_inode_item = true;
- 
- 	path = btrfs_alloc_path();
- 	if (!path)
-@@ -4269,11 +4270,6 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
- 		} else {
- 			if (inode_only == LOG_INODE_ALL)
- 				fast_search = true;
--			ret = log_inode_item(trans, log, dst_path, inode);
--			if (ret) {
--				err = ret;
--				goto out_unlock;
--			}
- 			goto log_extents;
- 		}
- 
-@@ -4296,6 +4292,9 @@ again:
- 		if (min_key.type > max_key.type)
- 			break;
- 
-+		if (min_key.type == BTRFS_INODE_ITEM_KEY)
-+			need_log_inode_item = false;
-+
- 		src = path->nodes[0];
- 		if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) {
- 			ins_nr++;
-@@ -4366,6 +4365,11 @@ next_slot:
- log_extents:
- 	btrfs_release_path(path);
- 	btrfs_release_path(dst_path);
-+	if (need_log_inode_item) {
-+		err = log_inode_item(trans, log, dst_path, inode);
-+		if (err)
-+			goto out_unlock;
-+	}
- 	if (fast_search) {
- 		/*
- 		 * Some ordered extents started by fsync might have completed
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index e003a1e..87ba10d 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -503,7 +503,7 @@ __read_extent_tree_block(const char *function, unsigned int line,
- 	struct buffer_head		*bh;
- 	int				err;
- 
--	bh = sb_getblk(inode->i_sb, pblk);
-+	bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS);
- 	if (unlikely(!bh))
- 		return ERR_PTR(-ENOMEM);
- 
-@@ -1088,7 +1088,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
- 		err = -EIO;
- 		goto cleanup;
- 	}
--	bh = sb_getblk(inode->i_sb, newblock);
-+	bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
- 	if (unlikely(!bh)) {
- 		err = -ENOMEM;
- 		goto cleanup;
-@@ -1282,7 +1282,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
- 	if (newblock == 0)
- 		return err;
- 
--	bh = sb_getblk(inode->i_sb, newblock);
-+	bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
- 	if (unlikely(!bh))
- 		return -ENOMEM;
- 	lock_buffer(bh);
-diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
-index 9588240..94ae687 100644
---- a/fs/ext4/indirect.c
-+++ b/fs/ext4/indirect.c
-@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
- 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
- 		EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
- 				 "non-extent mapped inodes with bigalloc");
--		return -ENOSPC;
-+		return -EUCLEAN;
- 	}
- 
- 	/* Set up for the direct block allocation */
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index 0554b0b..966c614 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1342,7 +1342,7 @@ static void ext4_da_page_release_reservation(struct page *page,
- 					     unsigned int offset,
- 					     unsigned int length)
- {
--	int to_release = 0;
-+	int to_release = 0, contiguous_blks = 0;
- 	struct buffer_head *head, *bh;
- 	unsigned int curr_off = 0;
- 	struct inode *inode = page->mapping->host;
-@@ -1363,14 +1363,23 @@ static void ext4_da_page_release_reservation(struct page *page,
- 
- 		if ((offset <= curr_off) && (buffer_delay(bh))) {
- 			to_release++;
-+			contiguous_blks++;
- 			clear_buffer_delay(bh);
-+		} else if (contiguous_blks) {
-+			lblk = page->index <<
-+			       (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+			lblk += (curr_off >> inode->i_blkbits) -
-+				contiguous_blks;
-+			ext4_es_remove_extent(inode, lblk, contiguous_blks);
-+			contiguous_blks = 0;
- 		}
- 		curr_off = next_off;
- 	} while ((bh = bh->b_this_page) != head);
- 
--	if (to_release) {
-+	if (contiguous_blks) {
- 		lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
--		ext4_es_remove_extent(inode, lblk, to_release);
-+		lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
-+		ext4_es_remove_extent(inode, lblk, contiguous_blks);
- 	}
- 
- 	/* If we have released all the blocks belonging to a cluster, then we
-@@ -1701,19 +1710,32 @@ static int __ext4_journalled_writepage(struct page *page,
- 		ext4_walk_page_buffers(handle, page_bufs, 0, len,
- 				       NULL, bget_one);
- 	}
--	/* As soon as we unlock the page, it can go away, but we have
--	 * references to buffers so we are safe */
-+	/*
-+	 * We need to release the page lock before we start the
-+	 * journal, so grab a reference so the page won't disappear
-+	 * out from under us.
-+	 */
-+	get_page(page);
- 	unlock_page(page);
- 
- 	handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
- 				    ext4_writepage_trans_blocks(inode));
- 	if (IS_ERR(handle)) {
- 		ret = PTR_ERR(handle);
--		goto out;
-+		put_page(page);
-+		goto out_no_pagelock;
- 	}
--
- 	BUG_ON(!ext4_handle_valid(handle));
- 
-+	lock_page(page);
-+	put_page(page);
-+	if (page->mapping != mapping) {
-+		/* The page got truncated from under us */
-+		ext4_journal_stop(handle);
-+		ret = 0;
-+		goto out;
-+	}
-+
- 	if (inline_data) {
- 		BUFFER_TRACE(inode_bh, "get write access");
- 		ret = ext4_journal_get_write_access(handle, inode_bh);
-@@ -1739,6 +1761,8 @@ static int __ext4_journalled_writepage(struct page *page,
- 				       NULL, bput_one);
- 	ext4_set_inode_state(inode, EXT4_STATE_JDATA);
- out:
-+	unlock_page(page);
-+out_no_pagelock:
- 	brelse(inode_bh);
- 	return ret;
- }
-@@ -4345,7 +4369,12 @@ static void ext4_update_other_inodes_time(struct super_block *sb,
- 	int inode_size = EXT4_INODE_SIZE(sb);
- 
- 	oi.orig_ino = orig_ino;
--	ino = (orig_ino & ~(inodes_per_block - 1)) + 1;
-+	/*
-+	 * Calculate the first inode in the inode table block.  Inode
-+	 * numbers are one-based.  That is, the first inode in a block
-+	 * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1).
-+	 */
-+	ino = ((orig_ino - 1) & ~(inodes_per_block - 1)) + 1;
- 	for (i = 0; i < inodes_per_block; i++, ino++, buf += inode_size) {
- 		if (ino == orig_ino)
- 			continue;
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 8d1e602..4126048 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4800,18 +4800,12 @@ do_more:
- 		/*
- 		 * blocks being freed are metadata. these blocks shouldn't
- 		 * be used until this transaction is committed
-+		 *
-+		 * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
-+		 * to fail.
- 		 */
--	retry:
--		new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
--		if (!new_entry) {
--			/*
--			 * We use a retry loop because
--			 * ext4_free_blocks() is not allowed to fail.
--			 */
--			cond_resched();
--			congestion_wait(BLK_RW_ASYNC, HZ/50);
--			goto retry;
--		}
-+		new_entry = kmem_cache_alloc(ext4_free_data_cachep,
-+				GFP_NOFS|__GFP_NOFAIL);
- 		new_entry->efd_start_cluster = bit;
- 		new_entry->efd_group = block_group;
- 		new_entry->efd_count = count_clusters;
-diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
-index b52374e..6163ad2 100644
---- a/fs/ext4/migrate.c
-+++ b/fs/ext4/migrate.c
-@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode)
- 	struct ext4_inode_info		*ei = EXT4_I(inode);
- 	struct ext4_extent		*ex;
- 	unsigned int			i, len;
-+	ext4_lblk_t			start, end;
- 	ext4_fsblk_t			blk;
- 	handle_t			*handle;
- 	int				ret;
-@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode)
- 				       EXT4_FEATURE_RO_COMPAT_BIGALLOC))
- 		return -EOPNOTSUPP;
- 
-+	/*
-+	 * In order to get correct extent info, force all delayed allocation
-+	 * blocks to be allocated, otherwise delayed allocation blocks may not
-+	 * be reflected and bypass the checks on extent header.
-+	 */
-+	if (test_opt(inode->i_sb, DELALLOC))
-+		ext4_alloc_da_blocks(inode);
-+
- 	handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
- 	if (IS_ERR(handle))
- 		return PTR_ERR(handle);
-@@ -650,11 +659,13 @@ int ext4_ind_migrate(struct inode *inode)
- 		goto errout;
- 	}
- 	if (eh->eh_entries == 0)
--		blk = len = 0;
-+		blk = len = start = end = 0;
- 	else {
- 		len = le16_to_cpu(ex->ee_len);
- 		blk = ext4_ext_pblock(ex);
--		if (len > EXT4_NDIR_BLOCKS) {
-+		start = le32_to_cpu(ex->ee_block);
-+		end = start + len - 1;
-+		if (end >= EXT4_NDIR_BLOCKS) {
- 			ret = -EOPNOTSUPP;
- 			goto errout;
- 		}
-@@ -662,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode)
- 
- 	ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
- 	memset(ei->i_data, 0, sizeof(ei->i_data));
--	for (i=0; i < len; i++)
-+	for (i = start; i <= end; i++)
- 		ei->i_data[i] = cpu_to_le32(blk++);
- 	ext4_mark_inode_dirty(handle, inode);
- errout:
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index ca9d4a2..ca12affd 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -807,6 +807,7 @@ static void ext4_put_super(struct super_block *sb)
- 		dump_orphan_list(sb, sbi);
- 	J_ASSERT(list_empty(&sbi->s_orphan));
- 
-+	sync_blockdev(sb->s_bdev);
- 	invalidate_bdev(sb->s_bdev);
- 	if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
- 		/*
-@@ -4943,6 +4944,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
- 		set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
- 	}
- 
-+	if (*flags & MS_LAZYTIME)
-+		sb->s_flags |= MS_LAZYTIME;
-+
- 	if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) {
- 		if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
- 			err = -EROFS;
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 18dacf9..708d697 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- 		goto err_fput;
- 
- 	fuse_conn_init(fc);
-+	fc->release = fuse_free_conn;
- 
- 	fc->dev = sb->s_dev;
- 	fc->sb = sb;
-@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- 		fc->dont_mask = 1;
- 	sb->s_flags |= MS_POSIXACL;
- 
--	fc->release = fuse_free_conn;
- 	fc->flags = d.flags;
- 	fc->user_id = d.user_id;
- 	fc->group_id = d.group_id;
-diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index 7cd00d3..8685c65 100644
---- a/fs/hpfs/super.c
-+++ b/fs/hpfs/super.c
-@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
- }
- 
- /* Filesystem error... */
--static char err_buf[1024];
--
- void hpfs_error(struct super_block *s, const char *fmt, ...)
- {
-+	struct va_format vaf;
- 	va_list args;
- 
- 	va_start(args, fmt);
--	vsnprintf(err_buf, sizeof(err_buf), fmt, args);
-+
-+	vaf.fmt = fmt;
-+	vaf.va = &args;
-+
-+	pr_err("filesystem error: %pV", &vaf);
-+
- 	va_end(args);
- 
--	pr_err("filesystem error: %s", err_buf);
- 	if (!hpfs_sb(s)->sb_was_error) {
- 		if (hpfs_sb(s)->sb_err == 2) {
- 			pr_cont("; crashing the system because you wanted it\n");
-@@ -424,11 +427,14 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
- 	int o;
- 	struct hpfs_sb_info *sbi = hpfs_sb(s);
- 	char *new_opts = kstrdup(data, GFP_KERNEL);
--	
-+
-+	if (!new_opts)
-+		return -ENOMEM;
-+
- 	sync_filesystem(s);
- 
- 	*flags |= MS_NOATIME;
--	
-+
- 	hpfs_lock(s);
- 	uid = sbi->sb_uid; gid = sbi->sb_gid;
- 	umask = 0777 & ~sbi->sb_mode;
-diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
-index 988b32e..4227dc4 100644
---- a/fs/jbd2/checkpoint.c
-+++ b/fs/jbd2/checkpoint.c
-@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- 	unsigned long	blocknr;
- 
- 	if (is_journal_aborted(journal))
--		return 1;
-+		return -EIO;
- 
- 	if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
- 		return 1;
-@@ -405,10 +405,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- 	 * jbd2_cleanup_journal_tail() doesn't get called all that often.
- 	 */
- 	if (journal->j_flags & JBD2_BARRIER)
--		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
- 
--	__jbd2_update_log_tail(journal, first_tid, blocknr);
--	return 0;
-+	return __jbd2_update_log_tail(journal, first_tid, blocknr);
- }
- 
- 
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index b96bd80..112fad9 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
-  *
-  * Requires j_checkpoint_mutex
-  */
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- {
- 	unsigned long freed;
-+	int ret;
- 
- 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- 
-@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- 	 * space and if we lose sb update during power failure we'd replay
- 	 * old transaction with possibly newly overwritten data.
- 	 */
--	jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+	ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+	if (ret)
-+		goto out;
-+
- 	write_lock(&journal->j_state_lock);
- 	freed = block - journal->j_tail;
- 	if (block < journal->j_tail)
-@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- 	journal->j_tail_sequence = tid;
- 	journal->j_tail = block;
- 	write_unlock(&journal->j_state_lock);
-+
-+out:
-+	return ret;
- }
- 
- /*
-@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
- 	return jbd2_journal_start_thread(journal);
- }
- 
--static void jbd2_write_superblock(journal_t *journal, int write_op)
-+static int jbd2_write_superblock(journal_t *journal, int write_op)
- {
- 	struct buffer_head *bh = journal->j_sb_buffer;
- 	journal_superblock_t *sb = journal->j_superblock;
-@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- 		printk(KERN_ERR "JBD2: Error %d detected when updating "
- 		       "journal superblock for %s.\n", ret,
- 		       journal->j_devname);
-+		jbd2_journal_abort(journal, ret);
- 	}
-+
-+	return ret;
- }
- 
- /**
-@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
-  * Update a journal's superblock information about log tail and write it to
-  * disk, waiting for the IO to complete.
-  */
--void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
-+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- 				     unsigned long tail_block, int write_op)
- {
- 	journal_superblock_t *sb = journal->j_superblock;
-+	int ret;
- 
- 	BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- 	jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
-@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- 	sb->s_sequence = cpu_to_be32(tail_tid);
- 	sb->s_start    = cpu_to_be32(tail_block);
- 
--	jbd2_write_superblock(journal, write_op);
-+	ret = jbd2_write_superblock(journal, write_op);
-+	if (ret)
-+		goto out;
- 
- 	/* Log is no longer empty */
- 	write_lock(&journal->j_state_lock);
- 	WARN_ON(!sb->s_sequence);
- 	journal->j_flags &= ~JBD2_FLUSHED;
- 	write_unlock(&journal->j_state_lock);
-+
-+out:
-+	return ret;
- }
- 
- /**
-@@ -1950,7 +1966,14 @@ int jbd2_journal_flush(journal_t *journal)
- 		return -EIO;
- 
- 	mutex_lock(&journal->j_checkpoint_mutex);
--	jbd2_cleanup_journal_tail(journal);
-+	if (!err) {
-+		err = jbd2_cleanup_journal_tail(journal);
-+		if (err < 0) {
-+			mutex_unlock(&journal->j_checkpoint_mutex);
-+			goto out;
-+		}
-+		err = 0;
-+	}
- 
- 	/* Finally, mark the journal as really needing no recovery.
- 	 * This sets s_start==0 in the underlying superblock, which is
-@@ -1966,7 +1989,8 @@ int jbd2_journal_flush(journal_t *journal)
- 	J_ASSERT(journal->j_head == journal->j_tail);
- 	J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
- 	write_unlock(&journal->j_state_lock);
--	return 0;
-+out:
-+	return err;
- }
- 
- /**
-diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
-index 7d05089..6f5f0f4 100644
---- a/fs/nfs/flexfilelayout/flexfilelayout.c
-+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
-@@ -631,7 +631,7 @@ static void ff_layout_reset_write(struct nfs_pgio_header *hdr, bool retry_pnfs)
- 			nfs_direct_set_resched_writes(hdr->dreq);
- 			/* fake unstable write to let common nfs resend pages */
- 			hdr->verf.committed = NFS_UNSTABLE;
--			hdr->good_bytes = 0;
-+			hdr->good_bytes = hdr->args.count;
- 		}
- 		return;
- 	}
-diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
-index 77a2d02..f13e196 100644
---- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
-+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
-@@ -324,7 +324,8 @@ static int ff_layout_update_mirror_cred(struct nfs4_ff_layout_mirror *mirror,
- 				__func__, PTR_ERR(cred));
- 			return PTR_ERR(cred);
- 		} else {
--			mirror->cred = cred;
-+			if (cmpxchg(&mirror->cred, NULL, cred))
-+				put_rpccred(cred);
- 		}
- 	}
- 	return 0;
-@@ -386,7 +387,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
- 	/* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
- 	smp_rmb();
- 	if (ds->ds_clp)
--		goto out;
-+		goto out_update_creds;
- 
- 	flavor = nfs4_ff_layout_choose_authflavor(mirror);
- 
-@@ -430,7 +431,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
- 			}
- 		}
- 	}
--
-+out_update_creds:
- 	if (ff_layout_update_mirror_cred(mirror, ds))
- 		ds = NULL;
- out:
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index 53852a4..9b04c2e 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
- 	if (args->npages != 0)
- 		xdr_write_pages(xdr, args->pages, 0, args->len);
- 	else
--		xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
-+		xdr_reserve_space(xdr, args->len);
- 
- 	error = nfsacl_encode(xdr->buf, base, args->inode,
- 			    (args->mask & NFS_ACL) ?
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index 2782cfc..ddef1dc 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1482,6 +1482,8 @@ restart:
- 					spin_unlock(&state->state_lock);
- 				}
- 				nfs4_put_open_state(state);
-+				clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
-+					&state->flags);
- 				spin_lock(&sp->so_lock);
- 				goto restart;
- 			}
-diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
-index 2306062..d47c188 100644
---- a/fs/nfs/pnfs.c
-+++ b/fs/nfs/pnfs.c
-@@ -1821,6 +1821,7 @@ int pnfs_write_done_resend_to_mds(struct nfs_pgio_header *hdr)
- 	/* Resend all requests through the MDS */
- 	nfs_pageio_init_write(&pgio, hdr->inode, FLUSH_STABLE, true,
- 			      hdr->completion_ops);
-+	set_bit(NFS_CONTEXT_RESEND_WRITES, &hdr->args.context->flags);
- 	return nfs_pageio_resend(&pgio, hdr);
- }
- EXPORT_SYMBOL_GPL(pnfs_write_done_resend_to_mds);
-@@ -1865,6 +1866,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc,
- 		mirror->pg_recoalesce = 1;
- 	}
- 	nfs_pgio_data_destroy(hdr);
-+	hdr->release(hdr);
- }
- 
- static enum pnfs_try_status
-@@ -1979,6 +1981,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc,
- 		mirror->pg_recoalesce = 1;
- 	}
- 	nfs_pgio_data_destroy(hdr);
-+	hdr->release(hdr);
- }
- 
- /*
-diff --git a/fs/nfs/write.c b/fs/nfs/write.c
-index dfc19f1..daf3556 100644
---- a/fs/nfs/write.c
-+++ b/fs/nfs/write.c
-@@ -1289,6 +1289,7 @@ static void nfs_initiate_write(struct nfs_pgio_header *hdr,
- static void nfs_redirty_request(struct nfs_page *req)
- {
- 	nfs_mark_request_dirty(req);
-+	set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags);
- 	nfs_unlock_request(req);
- 	nfs_end_page_writeback(req);
- 	nfs_release_request(req);
-diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
-index 907870e..70e9af5 100644
---- a/fs/overlayfs/readdir.c
-+++ b/fs/overlayfs/readdir.c
-@@ -23,6 +23,7 @@ struct ovl_cache_entry {
- 	u64 ino;
- 	struct list_head l_node;
- 	struct rb_node node;
-+	struct ovl_cache_entry *next_maybe_whiteout;
- 	bool is_whiteout;
- 	char name[];
- };
-@@ -39,7 +40,7 @@ struct ovl_readdir_data {
- 	struct rb_root root;
- 	struct list_head *list;
- 	struct list_head middle;
--	struct dentry *dir;
-+	struct ovl_cache_entry *first_maybe_whiteout;
- 	int count;
- 	int err;
- };
-@@ -79,7 +80,7 @@ static struct ovl_cache_entry *ovl_cache_entry_find(struct rb_root *root,
- 	return NULL;
- }
- 
--static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir,
-+static struct ovl_cache_entry *ovl_cache_entry_new(struct ovl_readdir_data *rdd,
- 						   const char *name, int len,
- 						   u64 ino, unsigned int d_type)
- {
-@@ -98,29 +99,8 @@ static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir,
- 	p->is_whiteout = false;
- 
- 	if (d_type == DT_CHR) {
--		struct dentry *dentry;
--		const struct cred *old_cred;
--		struct cred *override_cred;
--
--		override_cred = prepare_creds();
--		if (!override_cred) {
--			kfree(p);
--			return NULL;
--		}
--
--		/*
--		 * CAP_DAC_OVERRIDE for lookup
--		 */
--		cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
--		old_cred = override_creds(override_cred);
--
--		dentry = lookup_one_len(name, dir, len);
--		if (!IS_ERR(dentry)) {
--			p->is_whiteout = ovl_is_whiteout(dentry);
--			dput(dentry);
--		}
--		revert_creds(old_cred);
--		put_cred(override_cred);
-+		p->next_maybe_whiteout = rdd->first_maybe_whiteout;
-+		rdd->first_maybe_whiteout = p;
- 	}
- 	return p;
- }
-@@ -148,7 +128,7 @@ static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd,
- 			return 0;
- 	}
- 
--	p = ovl_cache_entry_new(rdd->dir, name, len, ino, d_type);
-+	p = ovl_cache_entry_new(rdd, name, len, ino, d_type);
- 	if (p == NULL)
- 		return -ENOMEM;
- 
-@@ -169,7 +149,7 @@ static int ovl_fill_lower(struct ovl_readdir_data *rdd,
- 	if (p) {
- 		list_move_tail(&p->l_node, &rdd->middle);
- 	} else {
--		p = ovl_cache_entry_new(rdd->dir, name, namelen, ino, d_type);
-+		p = ovl_cache_entry_new(rdd, name, namelen, ino, d_type);
- 		if (p == NULL)
- 			rdd->err = -ENOMEM;
- 		else
-@@ -219,6 +199,43 @@ static int ovl_fill_merge(struct dir_context *ctx, const char *name,
- 		return ovl_fill_lower(rdd, name, namelen, offset, ino, d_type);
- }
- 
-+static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
-+{
-+	int err;
-+	struct ovl_cache_entry *p;
-+	struct dentry *dentry;
-+	const struct cred *old_cred;
-+	struct cred *override_cred;
-+
-+	override_cred = prepare_creds();
-+	if (!override_cred)
-+		return -ENOMEM;
-+
-+	/*
-+	 * CAP_DAC_OVERRIDE for lookup
-+	 */
-+	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
-+	old_cred = override_creds(override_cred);
-+
-+	err = mutex_lock_killable(&dir->d_inode->i_mutex);
-+	if (!err) {
-+		while (rdd->first_maybe_whiteout) {
-+			p = rdd->first_maybe_whiteout;
-+			rdd->first_maybe_whiteout = p->next_maybe_whiteout;
-+			dentry = lookup_one_len(p->name, dir, p->len);
-+			if (!IS_ERR(dentry)) {
-+				p->is_whiteout = ovl_is_whiteout(dentry);
-+				dput(dentry);
-+			}
-+		}
-+		mutex_unlock(&dir->d_inode->i_mutex);
-+	}
-+	revert_creds(old_cred);
-+	put_cred(override_cred);
-+
-+	return err;
-+}
-+
- static inline int ovl_dir_read(struct path *realpath,
- 			       struct ovl_readdir_data *rdd)
- {
-@@ -229,7 +246,7 @@ static inline int ovl_dir_read(struct path *realpath,
- 	if (IS_ERR(realfile))
- 		return PTR_ERR(realfile);
- 
--	rdd->dir = realpath->dentry;
-+	rdd->first_maybe_whiteout = NULL;
- 	rdd->ctx.pos = 0;
- 	do {
- 		rdd->count = 0;
-@@ -238,6 +255,10 @@ static inline int ovl_dir_read(struct path *realpath,
- 		if (err >= 0)
- 			err = rdd->err;
- 	} while (!err && rdd->count);
-+
-+	if (!err && rdd->first_maybe_whiteout)
-+		err = ovl_check_whiteouts(realpath->dentry, rdd);
-+
- 	fput(realfile);
- 
- 	return err;
-diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
-index 3fbf167..73e75a8 100644
---- a/fs/xfs/xfs_attr_inactive.c
-+++ b/fs/xfs/xfs_attr_inactive.c
-@@ -435,8 +435,14 @@ xfs_attr_inactive(
- 	 */
- 	xfs_trans_ijoin(trans, dp, 0);
- 
--	/* invalidate and truncate the attribute fork extents */
--	if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
-+	/*
-+	 * Invalidate and truncate the attribute fork extents. Make sure the
-+	 * fork actually has attributes as otherwise the invalidation has no
-+	 * blocks to read and returns an error. In this case, just do the fork
-+	 * removal below.
-+	 */
-+	if (xfs_inode_hasattr(dp) &&
-+	    dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
- 		error = xfs_attr3_root_inactive(&trans, dp);
- 		if (error)
- 			goto out_cancel;
-diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
-index 3df411e..40c0765 100644
---- a/fs/xfs/xfs_symlink.c
-+++ b/fs/xfs/xfs_symlink.c
-@@ -104,7 +104,7 @@ xfs_readlink_bmap(
- 			cur_chunk += sizeof(struct xfs_dsymlink_hdr);
- 		}
- 
--		memcpy(link + offset, bp->b_addr, byte_cnt);
-+		memcpy(link + offset, cur_chunk, byte_cnt);
- 
- 		pathlen -= byte_cnt;
- 		offset += byte_cnt;
-diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
-index 08ef57b..f5ed1f1 100644
---- a/include/acpi/acpixf.h
-+++ b/include/acpi/acpixf.h
-@@ -195,9 +195,18 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
-  * address. Although ACPICA adheres to the ACPI specification which
-  * requires the use of the corresponding 64-bit address if it is non-zero,
-  * some machines have been found to have a corrupted non-zero 64-bit
-- * address. Default is TRUE, favor the 32-bit addresses.
-+ * address. Default is FALSE, do not favor the 32-bit addresses.
-  */
--ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
-+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE);
-+
-+/*
-+ * Optionally use 32-bit FACS table addresses.
-+ * It is reported that some platforms fail to resume from system suspending
-+ * if 64-bit FACS table address is selected:
-+ * https://bugzilla.kernel.org/show_bug.cgi?id=74021
-+ * Default is TRUE, favor the 32-bit addresses.
-+ */
-+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_facs_addresses, TRUE);
- 
- /*
-  * Optionally truncate I/O addresses to 16 bits. Provides compatibility
-diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
-index 1c3002e..181427e 100644
---- a/include/acpi/actypes.h
-+++ b/include/acpi/actypes.h
-@@ -572,6 +572,7 @@ typedef u64 acpi_integer;
- #define ACPI_NO_ACPI_ENABLE             0x10
- #define ACPI_NO_DEVICE_INIT             0x20
- #define ACPI_NO_OBJECT_INIT             0x40
-+#define ACPI_NO_FACS_INIT               0x80
- 
- /*
-  * Initialization state
-diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
-index c1571034..3f13b91 100644
---- a/include/drm/drm_atomic.h
-+++ b/include/drm/drm_atomic.h
-@@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state);
- 
- #define for_each_connector_in_state(state, connector, connector_state, __i) \
- 	for ((__i) = 0;							\
--	     (connector) = (state)->connectors[__i],			\
--	     (connector_state) = (state)->connector_states[__i],	\
--	     (__i) < (state)->num_connector;				\
-+	     (__i) < (state)->num_connector &&				\
-+	     ((connector) = (state)->connectors[__i],			\
-+	     (connector_state) = (state)->connector_states[__i], 1); 	\
- 	     (__i)++)							\
- 		if (connector)
- 
- #define for_each_crtc_in_state(state, crtc, crtc_state, __i)	\
- 	for ((__i) = 0;						\
--	     (crtc) = (state)->crtcs[__i],			\
--	     (crtc_state) = (state)->crtc_states[__i],		\
--	     (__i) < (state)->dev->mode_config.num_crtc;	\
-+	     (__i) < (state)->dev->mode_config.num_crtc &&	\
-+	     ((crtc) = (state)->crtcs[__i],			\
-+	     (crtc_state) = (state)->crtc_states[__i], 1);	\
- 	     (__i)++)						\
- 		if (crtc_state)
- 
--#define for_each_plane_in_state(state, plane, plane_state, __i)	\
--	for ((__i) = 0;						\
--	     (plane) = (state)->planes[__i],			\
--	     (plane_state) = (state)->plane_states[__i],	\
--	     (__i) < (state)->dev->mode_config.num_total_plane;	\
--	     (__i)++)						\
-+#define for_each_plane_in_state(state, plane, plane_state, __i)		\
-+	for ((__i) = 0;							\
-+	     (__i) < (state)->dev->mode_config.num_total_plane &&	\
-+	     ((plane) = (state)->planes[__i],				\
-+	     (plane_state) = (state)->plane_states[__i], 1);		\
-+	     (__i)++)							\
- 		if (plane_state)
- 
- #endif /* DRM_ATOMIC_H_ */
-diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
-index ca71c03..5423358 100644
---- a/include/drm/drm_crtc.h
-+++ b/include/drm/drm_crtc.h
-@@ -731,6 +731,8 @@ struct drm_connector {
- 	uint8_t num_h_tile, num_v_tile;
- 	uint8_t tile_h_loc, tile_v_loc;
- 	uint16_t tile_h_size, tile_v_size;
-+
-+	struct list_head destroy_list;
- };
- 
- /**
-diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
-index a250781..86d0b25 100644
---- a/include/drm/drm_dp_mst_helper.h
-+++ b/include/drm/drm_dp_mst_helper.h
-@@ -463,6 +463,10 @@ struct drm_dp_mst_topology_mgr {
- 	struct work_struct work;
- 
- 	struct work_struct tx_work;
-+
-+	struct list_head destroy_connector_list;
-+	struct mutex destroy_connector_lock;
-+	struct work_struct destroy_connector_work;
- };
- 
- int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, struct device *dev, struct drm_dp_aux *aux, int max_dpcd_transaction_bytes, int max_payloads, int conn_base_id);
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index 5da2d2e..4550be3 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -332,9 +332,6 @@ int acpi_check_region(resource_size_t start, resource_size_t n,
- 
- int acpi_resources_are_enforced(void);
- 
--int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
--			unsigned long flags, char *desc);
--
- #ifdef CONFIG_HIBERNATION
- void __init acpi_no_s4_hw_signature(void);
- #endif
-@@ -530,13 +527,6 @@ static inline int acpi_check_region(resource_size_t start, resource_size_t n,
- 	return 0;
- }
- 
--static inline int acpi_reserve_region(u64 start, unsigned int length,
--				      u8 space_id, unsigned long flags,
--				      char *desc)
--{
--	return -ENXIO;
--}
--
- struct acpi_table_header;
- static inline int acpi_table_parse(char *id,
- 				int (*handler)(struct acpi_table_header *))
-diff --git a/include/linux/ata.h b/include/linux/ata.h
-index b666b77..533dbb6 100644
---- a/include/linux/ata.h
-+++ b/include/linux/ata.h
-@@ -45,6 +45,7 @@ enum {
- 	ATA_SECT_SIZE		= 512,
- 	ATA_MAX_SECTORS_128	= 128,
- 	ATA_MAX_SECTORS		= 256,
-+	ATA_MAX_SECTORS_1024    = 1024,
- 	ATA_MAX_SECTORS_LBA48	= 65535,/* TODO: 65536? */
- 	ATA_MAX_SECTORS_TAPE	= 65535,
- 
-diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
-index 73b4522..e6797de 100644
---- a/include/linux/buffer_head.h
-+++ b/include/linux/buffer_head.h
-@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector_t block)
- 	return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
- }
- 
-+
-+static inline struct buffer_head *
-+sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
-+{
-+	return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
-+}
-+
- static inline struct buffer_head *
- sb_find_get_block(struct super_block *sb, sector_t block)
- {
-diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
-index 0c9a2f2..d4c7113 100644
---- a/include/linux/compiler-intel.h
-+++ b/include/linux/compiler-intel.h
-@@ -13,10 +13,12 @@
- /* Intel ECC compiler doesn't support gcc specific asm stmts.
-  * It uses intrinsics to do the equivalent things.
-  */
-+#undef barrier
- #undef barrier_data
- #undef RELOC_HIDE
- #undef OPTIMIZER_HIDE_VAR
- 
-+#define barrier() __memory_barrier()
- #define barrier_data(ptr) barrier()
- 
- #define RELOC_HIDE(ptr, off)					\
-diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
-index 3a7c9ff..da04265 100644
---- a/include/linux/gpio/consumer.h
-+++ b/include/linux/gpio/consumer.h
-@@ -406,6 +406,21 @@ static inline int desc_to_gpio(const struct gpio_desc *desc)
- 	return -EINVAL;
- }
- 
-+/* Child properties interface */
-+struct fwnode_handle;
-+
-+static inline struct gpio_desc *fwnode_get_named_gpiod(
-+	struct fwnode_handle *fwnode, const char *propname)
-+{
-+	return ERR_PTR(-ENOSYS);
-+}
-+
-+static inline struct gpio_desc *devm_get_gpiod_from_child(
-+	struct device *dev, const char *con_id, struct fwnode_handle *child)
-+{
-+	return ERR_PTR(-ENOSYS);
-+}
-+
- #endif /* CONFIG_GPIOLIB */
- 
- /*
-diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
-index 0042bf3..c02b5ce 100644
---- a/include/linux/hid-sensor-hub.h
-+++ b/include/linux/hid-sensor-hub.h
-@@ -230,6 +230,7 @@ struct hid_sensor_common {
- 	struct platform_device *pdev;
- 	unsigned usage_id;
- 	atomic_t data_ready;
-+	atomic_t user_requested_state;
- 	struct iio_trigger *trigger;
- 	struct hid_sensor_hub_attribute_info poll;
- 	struct hid_sensor_hub_attribute_info report_state;
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 20e7f78..edb640a 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
- int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
- int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- 			      unsigned long *block);
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- 
- /* Commit management */
-@@ -1157,7 +1157,7 @@ extern int	   jbd2_journal_recover    (journal_t *journal);
- extern int	   jbd2_journal_wipe       (journal_t *, int);
- extern int	   jbd2_journal_skip_recovery	(journal_t *);
- extern void	   jbd2_journal_update_sb_errno(journal_t *);
--extern void	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
-+extern int	   jbd2_journal_update_sb_log_tail	(journal_t *, tid_t,
- 				unsigned long, int);
- extern void	   __jbd2_journal_abort_hard	(journal_t *);
- extern void	   jbd2_journal_abort      (journal_t *, int);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 28aeae4..e0e3378 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -431,6 +431,9 @@ enum {
- 	ATA_HORKAGE_NOLPM	= (1 << 20),	/* don't use LPM */
- 	ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21),	/* some WDs have broken LPM */
- 	ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
-+	ATA_HORKAGE_NO_NCQ_LOG	= (1 << 23),	/* don't use NCQ for log read */
-+	ATA_HORKAGE_NOTRIM	= (1 << 24),	/* don't use TRIM */
-+	ATA_HORKAGE_MAX_SEC_1024 = (1 << 25),	/* Limit max sects to 1024 */
- 
- 	 /* DMA mask for user DMA control: User visible values; DO NOT
- 	    renumber */
-diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
-index 93ab607..e9e9a8d 100644
---- a/include/linux/nfs_xdr.h
-+++ b/include/linux/nfs_xdr.h
-@@ -1142,7 +1142,7 @@ struct nfs41_state_protection {
- 	struct nfs4_op_map allow;
- };
- 
--#define NFS4_EXCHANGE_ID_LEN	(48)
-+#define NFS4_EXCHANGE_ID_LEN	(127)
- struct nfs41_exchange_id_args {
- 	struct nfs_client		*client;
- 	nfs4_verifier			*verifier;
-diff --git a/include/linux/of.h b/include/linux/of.h
-index b871ff9..8135d50 100644
---- a/include/linux/of.h
-+++ b/include/linux/of.h
-@@ -673,7 +673,10 @@ static inline void of_property_clear_flag(struct property *p, unsigned long flag
- #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
- extern int of_node_to_nid(struct device_node *np);
- #else
--static inline int of_node_to_nid(struct device_node *device) { return 0; }
-+static inline int of_node_to_nid(struct device_node *device)
-+{
-+	return NUMA_NO_NODE;
-+}
- #endif
- 
- static inline struct device_node *of_find_matching_node(
-diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
-index 551b673..a7e41fb 100644
---- a/include/uapi/drm/i915_drm.h
-+++ b/include/uapi/drm/i915_drm.h
-@@ -1065,6 +1065,14 @@ struct drm_i915_reg_read {
- 	__u64 offset;
- 	__u64 val; /* Return value */
- };
-+/* Known registers:
-+ *
-+ * Render engine timestamp - 0x2358 + 64bit - gen7+
-+ * - Note this register returns an invalid value if using the default
-+ *   single instruction 8byte read, in order to workaround that use
-+ *   offset (0x2538 | 1) instead.
-+ *
-+ */
- 
- struct drm_i915_reset_stats {
- 	__u32 ctx_id;
-diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 7e01f78..9e30231 100644
---- a/kernel/power/Kconfig
-+++ b/kernel/power/Kconfig
-@@ -187,7 +187,7 @@ config DPM_WATCHDOG
- config DPM_WATCHDOG_TIMEOUT
- 	int "Watchdog timeout in seconds"
- 	range 1 120
--	default 12
-+	default 60
- 	depends on DPM_WATCHDOG
- 
- config PM_TRACE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index c099b08..bff0169 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -484,11 +484,11 @@ int check_syslog_permissions(int type, bool from_file)
- 	 * already done the capabilities checks at open time.
- 	 */
- 	if (from_file && type != SYSLOG_ACTION_OPEN)
--		return 0;
-+		goto ok;
- 
- 	if (syslog_action_restricted(type)) {
- 		if (capable(CAP_SYSLOG))
--			return 0;
-+			goto ok;
- 		/*
- 		 * For historical reasons, accept CAP_SYS_ADMIN too, with
- 		 * a warning.
-@@ -498,10 +498,11 @@ int check_syslog_permissions(int type, bool from_file)
- 				     "CAP_SYS_ADMIN but no CAP_SYSLOG "
- 				     "(deprecated).\n",
- 				 current->comm, task_pid_nr(current));
--			return 0;
-+			goto ok;
- 		}
- 		return -EPERM;
- 	}
-+ok:
- 	return security_syslog(type);
- }
- 
-@@ -1263,10 +1264,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
- 	if (error)
- 		goto out;
- 
--	error = security_syslog(type);
--	if (error)
--		return error;
--
- 	switch (type) {
- 	case SYSLOG_ACTION_CLOSE:	/* Close log */
- 		break;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index d261201..921691c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -444,6 +444,7 @@ enum {
- 
- 	TRACE_CONTROL_BIT,
- 
-+	TRACE_BRANCH_BIT,
- /*
-  * Abuse of the trace_recursion.
-  * As we need a way to maintain state if we are tracing the function
-@@ -1312,7 +1313,7 @@ void trace_event_init(void);
- void trace_event_enum_update(struct trace_enum_map **map, int len);
- #else
- static inline void __init trace_event_init(void) { }
--static inlin void trace_event_enum_update(struct trace_enum_map **map, int len) { }
-+static inline void trace_event_enum_update(struct trace_enum_map **map, int len) { }
- #endif
- 
- extern struct trace_iterator *tracepoint_print_iter;
-diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
-index 57cbf1e..1879980 100644
---- a/kernel/trace/trace_branch.c
-+++ b/kernel/trace/trace_branch.c
-@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 	struct trace_branch *entry;
- 	struct ring_buffer *buffer;
- 	unsigned long flags;
--	int cpu, pc;
-+	int pc;
- 	const char *p;
- 
-+	if (current->trace_recursion & TRACE_BRANCH_BIT)
-+		return;
-+
- 	/*
- 	 * I would love to save just the ftrace_likely_data pointer, but
- 	 * this code can also be used by modules. Ugly things can happen
-@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 	if (unlikely(!tr))
- 		return;
- 
--	local_irq_save(flags);
--	cpu = raw_smp_processor_id();
--	data = per_cpu_ptr(tr->trace_buffer.data, cpu);
--	if (atomic_inc_return(&data->disabled) != 1)
-+	raw_local_irq_save(flags);
-+	current->trace_recursion |= TRACE_BRANCH_BIT;
-+	data = this_cpu_ptr(tr->trace_buffer.data);
-+	if (atomic_read(&data->disabled))
- 		goto out;
- 
- 	pc = preempt_count();
-@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- 		__buffer_unlock_commit(buffer, event);
- 
-  out:
--	atomic_dec(&data->disabled);
--	local_irq_restore(flags);
-+	current->trace_recursion &= ~TRACE_BRANCH_BIT;
-+	raw_local_irq_restore(flags);
- }
- 
- static inline
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index 7f2e97c..52adf02 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_parse_state *ps,
- 
- static char infix_next(struct filter_parse_state *ps)
- {
-+	if (!ps->infix.cnt)
-+		return 0;
-+
- 	ps->infix.cnt--;
- 
- 	return ps->infix.string[ps->infix.tail++];
-@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_parse_state *ps)
- 
- static void infix_advance(struct filter_parse_state *ps)
- {
-+	if (!ps->infix.cnt)
-+		return;
-+
- 	ps->infix.cnt--;
- 	ps->infix.tail++;
- }
-@@ -1385,7 +1391,9 @@ static int check_preds(struct filter_parse_state *ps)
- 		if (elt->op != OP_NOT)
- 			cnt--;
- 		n_normal_preds++;
--		WARN_ON_ONCE(cnt < 0);
-+		/* all ops should have operands */
-+		if (cnt < 0)
-+			break;
- 	}
- 
- 	if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index 64c0926..40162f8 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -506,12 +506,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 	unsigned a, b;
- 	int c, old_c, totaldigits;
- 	const char __user __force *ubuf = (const char __user __force *)buf;
--	int exp_digit, in_range;
-+	int at_start, in_range;
- 
- 	totaldigits = c = 0;
- 	bitmap_zero(maskp, nmaskbits);
- 	do {
--		exp_digit = 1;
-+		at_start = 1;
- 		in_range = 0;
- 		a = b = 0;
- 
-@@ -540,11 +540,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 				break;
- 
- 			if (c == '-') {
--				if (exp_digit || in_range)
-+				if (at_start || in_range)
- 					return -EINVAL;
- 				b = 0;
- 				in_range = 1;
--				exp_digit = 1;
- 				continue;
- 			}
- 
-@@ -554,16 +553,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- 			b = b * 10 + (c - '0');
- 			if (!in_range)
- 				a = b;
--			exp_digit = 0;
-+			at_start = 0;
- 			totaldigits++;
- 		}
- 		if (!(a <= b))
- 			return -EINVAL;
- 		if (b >= nmaskbits)
- 			return -ERANGE;
--		while (a <= b) {
--			set_bit(a, maskp);
--			a++;
-+		if (!at_start) {
-+			while (a <= b) {
-+				set_bit(a, maskp);
-+				a++;
-+			}
- 		}
- 	} while (buflen && c == ',');
- 	return 0;
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 271e443..8c4c1f9 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -40,6 +40,11 @@ int hugepages_treat_as_movable;
- int hugetlb_max_hstate __read_mostly;
- unsigned int default_hstate_idx;
- struct hstate hstates[HUGE_MAX_HSTATE];
-+/*
-+ * Minimum page order among possible hugepage sizes, set to a proper value
-+ * at boot time.
-+ */
-+static unsigned int minimum_order __read_mostly = UINT_MAX;
- 
- __initdata LIST_HEAD(huge_boot_pages);
- 
-@@ -1188,19 +1193,13 @@ static void dissolve_free_huge_page(struct page *page)
-  */
- void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
- {
--	unsigned int order = 8 * sizeof(void *);
- 	unsigned long pfn;
--	struct hstate *h;
- 
- 	if (!hugepages_supported())
- 		return;
- 
--	/* Set scan step to minimum hugepage size */
--	for_each_hstate(h)
--		if (order > huge_page_order(h))
--			order = huge_page_order(h);
--	VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << order));
--	for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << order)
-+	VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
-+	for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
- 		dissolve_free_huge_page(pfn_to_page(pfn));
- }
- 
-@@ -1627,10 +1626,14 @@ static void __init hugetlb_init_hstates(void)
- 	struct hstate *h;
- 
- 	for_each_hstate(h) {
-+		if (minimum_order > huge_page_order(h))
-+			minimum_order = huge_page_order(h);
-+
- 		/* oversize hugepages were init'ed in early boot */
- 		if (!hstate_is_gigantic(h))
- 			hugetlb_hstate_alloc_pages(h);
- 	}
-+	VM_BUG_ON(minimum_order == UINT_MAX);
- }
- 
- static char * __init memfmt(char *buf, unsigned long n)
-diff --git a/mm/memory.c b/mm/memory.c
-index 22e037e..2a9e098 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2669,6 +2669,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
- 
- 	pte_unmap(page_table);
- 
-+	/* File mapping without ->vm_ops ? */
-+	if (vma->vm_flags & VM_SHARED)
-+		return VM_FAULT_SIGBUS;
-+
- 	/* Check if we need to add a guard page to the stack */
- 	if (check_stack_guard_page(vma, address) < 0)
- 		return VM_FAULT_SIGSEGV;
-@@ -3097,6 +3101,9 @@ static int do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- 			- vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
- 
- 	pte_unmap(page_table);
-+	/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
-+	if (!vma->vm_ops->fault)
-+		return VM_FAULT_SIGBUS;
- 	if (!(flags & FAULT_FLAG_WRITE))
- 		return do_read_fault(mm, vma, address, pmd, pgoff, flags,
- 				orig_pte);
-@@ -3242,13 +3249,12 @@ static int handle_pte_fault(struct mm_struct *mm,
- 	barrier();
- 	if (!pte_present(entry)) {
- 		if (pte_none(entry)) {
--			if (vma->vm_ops) {
--				if (likely(vma->vm_ops->fault))
--					return do_fault(mm, vma, address, pte,
--							pmd, flags, entry);
--			}
--			return do_anonymous_page(mm, vma, address,
--						 pte, pmd, flags);
-+			if (vma->vm_ops)
-+				return do_fault(mm, vma, address, pte, pmd,
-+						flags, entry);
-+
-+			return do_anonymous_page(mm, vma, address, pte, pmd,
-+					flags);
- 		}
- 		return do_swap_page(mm, vma, address,
- 					pte, pmd, flags, entry);
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 6f4c4c8..81925b9 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -843,7 +843,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
- 	if (err < 0) {
- 		if (err == -EIO)
- 			c->status = Disconnected;
--		goto reterr;
-+		if (err != -ERESTARTSYS)
-+			goto reterr;
- 	}
- 	if (req->status == REQ_STATUS_ERROR) {
- 		p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
-@@ -1647,6 +1648,7 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err)
- 		if (*err) {
- 			trace_9p_protocol_dump(clnt, req->rc);
- 			p9_free_req(clnt, req);
-+			break;
- 		}
- 
- 		p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count);
-diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 56f9edb..e11a5cf 100644
---- a/net/bluetooth/hci_sock.c
-+++ b/net/bluetooth/hci_sock.c
-@@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
- 			goto done;
- 		}
- 
--		if (test_bit(HCI_UP, &hdev->flags) ||
--		    test_bit(HCI_INIT, &hdev->flags) ||
-+		if (test_bit(HCI_INIT, &hdev->flags) ||
- 		    hci_dev_test_flag(hdev, HCI_SETUP) ||
--		    hci_dev_test_flag(hdev, HCI_CONFIG)) {
-+		    hci_dev_test_flag(hdev, HCI_CONFIG) ||
-+		    (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
-+		     test_bit(HCI_UP, &hdev->flags))) {
- 			err = -EBUSY;
- 			hci_dev_put(hdev);
- 			goto done;
-@@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
- 
- 		err = hci_dev_open(hdev->id);
- 		if (err) {
--			hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
--			mgmt_index_added(hdev);
--			hci_dev_put(hdev);
--			goto done;
-+			if (err == -EALREADY) {
-+				/* In case the transport is already up and
-+				 * running, clear the error here.
-+				 *
-+				 * This can happen when opening an user
-+				 * channel and HCI_AUTO_OFF grace period
-+				 * is still active.
-+				 */
-+				err = 0;
-+			} else {
-+				hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
-+				mgmt_index_added(hdev);
-+				hci_dev_put(hdev);
-+				goto done;
-+			}
- 		}
- 
- 		atomic_inc(&hdev->promisc);
-diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
-index 1579669..4a31258 100644
---- a/net/ceph/osdmap.c
-+++ b/net/ceph/osdmap.c
-@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
- {
- 	int j;
- 	dout("crush_decode_tree_bucket %p to %p\n", *p, end);
--	ceph_decode_32_safe(p, end, b->num_nodes, bad);
-+	ceph_decode_8_safe(p, end, b->num_nodes, bad);
- 	b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
- 	if (b->node_weights == NULL)
- 		return -ENOMEM;
-diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
-index b60c65f..627a253 100644
---- a/net/ieee802154/socket.c
-+++ b/net/ieee802154/socket.c
-@@ -739,6 +739,12 @@ static int dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
- 	sock_recv_ts_and_drops(msg, sk, skb);
- 
- 	if (saddr) {
-+		/* Clear the implicit padding in struct sockaddr_ieee802154
-+		 * (16 bits between 'family' and 'addr') and in struct
-+		 * ieee802154_addr_sa (16 bits at the end of the structure).
-+		 */
-+		memset(saddr, 0, sizeof(*saddr));
-+
- 		saddr->family = AF_IEEE802154;
- 		ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source);
- 		*addr_len = sizeof(*saddr);
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index ff347a0..f06d422 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3356,6 +3356,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
- 	/* Update CSA counters */
- 	if (sdata->vif.csa_active &&
- 	    (sdata->vif.type == NL80211_IFTYPE_AP ||
-+	     sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
- 	     sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
- 	    params->n_csa_offsets) {
- 		int i;
-diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
-index bfef1b2..a9c9d96 100644
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -146,6 +146,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
- 				csa_settings->chandef.chan->center_freq);
- 		presp->csa_counter_offsets[0] = (pos - presp->head);
- 		*pos++ = csa_settings->count;
-+		presp->csa_current_counter = csa_settings->count;
- 	}
- 
- 	/* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index df3051d..e86daed 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -249,6 +249,7 @@ static void ieee80211_restart_work(struct work_struct *work)
- {
- 	struct ieee80211_local *local =
- 		container_of(work, struct ieee80211_local, restart_work);
-+	struct ieee80211_sub_if_data *sdata;
- 
- 	/* wait for scan work complete */
- 	flush_workqueue(local->workqueue);
-@@ -257,6 +258,8 @@ static void ieee80211_restart_work(struct work_struct *work)
- 	     "%s called with hardware scan in progress\n", __func__);
- 
- 	rtnl_lock();
-+	list_for_each_entry(sdata, &local->interfaces, list)
-+		flush_delayed_work(&sdata->dec_tailroom_needed_wk);
- 	ieee80211_scan_cancel(local);
- 	ieee80211_reconfig(local);
- 	rtnl_unlock();
-diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
-index d468424..817098a 100644
---- a/net/mac80211/mesh.c
-+++ b/net/mac80211/mesh.c
-@@ -680,6 +680,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
- 		*pos++ = 0x0;
- 		*pos++ = ieee80211_frequency_to_channel(
- 				csa->settings.chandef.chan->center_freq);
-+		bcn->csa_current_counter = csa->settings.count;
- 		bcn->csa_counter_offsets[0] = hdr_len + 6;
- 		*pos++ = csa->settings.count;
- 		*pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
-diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
-index 9dd0ea8d..28504df 100644
---- a/net/sunrpc/backchannel_rqst.c
-+++ b/net/sunrpc/backchannel_rqst.c
-@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
- 
- 	dprintk("RPC:        free allocations for req= %p\n", req);
- 	WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
--	xbufp = &req->rq_private_buf;
-+	xbufp = &req->rq_rcv_buf;
- 	free_page((unsigned long)xbufp->head[0].iov_base);
- 	xbufp = &req->rq_snd_buf;
- 	free_page((unsigned long)xbufp->head[0].iov_base);
-diff --git a/net/wireless/util.c b/net/wireless/util.c
-index 70051ab..7e4e3ff 100644
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -944,7 +944,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
- 	     ntype == NL80211_IFTYPE_P2P_CLIENT))
- 		return -EBUSY;
- 
--	if (ntype != otype && netif_running(dev)) {
-+	if (ntype != otype) {
- 		dev->ieee80211_ptr->use_4addr = false;
- 		dev->ieee80211_ptr->mesh_id_up_len = 0;
- 		wdev_lock(dev->ieee80211_ptr);
-diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
-index 8965d1b..125d640 100644
---- a/samples/trace_events/trace-events-sample.h
-+++ b/samples/trace_events/trace-events-sample.h
-@@ -168,7 +168,10 @@
-  *
-  *      For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo)
-  *            Use __get_dynamic_array_len(foo) to get the length of the array
-- *            saved.
-+ *            saved. Note, __get_dynamic_array_len() returns the total allocated
-+ *            length of the dynamic array; __print_array() expects the second
-+ *            parameter to be the number of elements. To get that, the array length
-+ *            needs to be divided by the element size.
-  *
-  *      For __string(foo, bar) use __get_str(foo)
-  *
-@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar,
-  *    This prints out the array that is defined by __array in a nice format.
-  */
- 		  __print_array(__get_dynamic_array(list),
--				__get_dynamic_array_len(list),
-+				__get_dynamic_array_len(list) / sizeof(int),
- 				sizeof(int)),
- 		  __get_str(str), __get_bitmask(cpus))
- );
-diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
-index 10f9943..5820914 100644
---- a/security/integrity/evm/evm_main.c
-+++ b/security/integrity/evm/evm_main.c
-@@ -296,6 +296,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
- 		iint = integrity_iint_find(d_backing_inode(dentry));
- 		if (iint && (iint->flags & IMA_NEW_FILE))
- 			return 0;
-+
-+		/* exception for pseudo filesystems */
-+		if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
-+		    || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
-+			return 0;
-+
-+		integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
-+				    dentry->d_inode, dentry->d_name.name,
-+				    "update_metadata",
-+				    integrity_status_msg[evm_status],
-+				    -EPERM, 0);
- 	}
- out:
- 	if (evm_status != INTEGRITY_PASS)
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index 8ee997d..fc56d4d 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- 		       const char *op, const char *cause);
- int ima_init_crypto(void);
- void ima_putc(struct seq_file *m, void *data, int datalen);
--void ima_print_digest(struct seq_file *m, u8 *digest, int size);
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
- struct ima_template_desc *ima_template_desc_current(void);
- int ima_init_template(void);
- 
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 461215e..816d175 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -190,9 +190,9 @@ static const struct file_operations ima_measurements_ops = {
- 	.release = seq_release,
- };
- 
--void ima_print_digest(struct seq_file *m, u8 *digest, int size)
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
- {
--	int i;
-+	u32 i;
- 
- 	for (i = 0; i < size; i++)
- 		seq_printf(m, "%02x", *(digest + i));
-diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
-index d1eefb9..3997e20 100644
---- a/security/integrity/ima/ima_policy.c
-+++ b/security/integrity/ima/ima_policy.c
-@@ -27,6 +27,8 @@
- #define IMA_UID		0x0008
- #define IMA_FOWNER	0x0010
- #define IMA_FSUUID	0x0020
-+#define IMA_INMASK	0x0040
-+#define IMA_EUID	0x0080
- 
- #define UNKNOWN		0
- #define MEASURE		0x0001	/* same as IMA_MEASURE */
-@@ -42,6 +44,8 @@ enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
- 	LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
- };
- 
-+enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
-+
- struct ima_rule_entry {
- 	struct list_head list;
- 	int action;
-@@ -70,7 +74,7 @@ struct ima_rule_entry {
-  * normal users can easily run the machine out of memory simply building
-  * and running executables.
-  */
--static struct ima_rule_entry default_rules[] = {
-+static struct ima_rule_entry dont_measure_rules[] = {
- 	{.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
-@@ -79,12 +83,31 @@ static struct ima_rule_entry default_rules[] = {
- 	{.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
-+	{.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
-+	 .flags = IMA_FSMAGIC},
-+	{.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
-+};
-+
-+static struct ima_rule_entry original_measurement_rules[] = {
- 	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
- 	 .flags = IMA_FUNC | IMA_MASK},
- 	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
- 	 .flags = IMA_FUNC | IMA_MASK},
--	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, .uid = GLOBAL_ROOT_UID,
--	 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
-+	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
-+	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
-+	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
-+	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
-+};
-+
-+static struct ima_rule_entry default_measurement_rules[] = {
-+	{.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
-+	 .flags = IMA_FUNC | IMA_MASK},
-+	{.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
-+	 .flags = IMA_FUNC | IMA_MASK},
-+	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
-+	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
-+	{.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
-+	 .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
- 	{.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
- 	{.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
- };
-@@ -99,6 +122,7 @@ static struct ima_rule_entry default_appraise_rules[] = {
- 	{.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
-+	{.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
- 	{.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
- #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
- 	{.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
-@@ -115,14 +139,29 @@ static struct list_head *ima_rules;
- 
- static DEFINE_MUTEX(ima_rules_mutex);
- 
--static bool ima_use_tcb __initdata;
-+static int ima_policy __initdata;
- static int __init default_measure_policy_setup(char *str)
- {
--	ima_use_tcb = 1;
-+	if (ima_policy)
-+		return 1;
-+
-+	ima_policy = ORIGINAL_TCB;
- 	return 1;
- }
- __setup("ima_tcb", default_measure_policy_setup);
- 
-+static int __init policy_setup(char *str)
-+{
-+	if (ima_policy)
-+		return 1;
-+
-+	if (strcmp(str, "tcb") == 0)
-+		ima_policy = DEFAULT_TCB;
-+
-+	return 1;
-+}
-+__setup("ima_policy=", policy_setup);
-+
- static bool ima_use_appraise_tcb __initdata;
- static int __init default_appraise_policy_setup(char *str)
- {
-@@ -182,6 +221,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
- 	if ((rule->flags & IMA_MASK) &&
- 	    (rule->mask != mask && func != POST_SETATTR))
- 		return false;
-+	if ((rule->flags & IMA_INMASK) &&
-+	    (!(rule->mask & mask) && func != POST_SETATTR))
-+		return false;
- 	if ((rule->flags & IMA_FSMAGIC)
- 	    && rule->fsmagic != inode->i_sb->s_magic)
- 		return false;
-@@ -190,6 +232,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
- 		return false;
- 	if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
- 		return false;
-+	if (rule->flags & IMA_EUID) {
-+		if (has_capability_noaudit(current, CAP_SETUID)) {
-+			if (!uid_eq(rule->uid, cred->euid)
-+			    && !uid_eq(rule->uid, cred->suid)
-+			    && !uid_eq(rule->uid, cred->uid))
-+				return false;
-+		} else if (!uid_eq(rule->uid, cred->euid))
-+			return false;
-+	}
-+
- 	if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
- 		return false;
- 	for (i = 0; i < MAX_LSM_RULES; i++) {
-@@ -333,21 +385,31 @@ void __init ima_init_policy(void)
- {
- 	int i, measure_entries, appraise_entries;
- 
--	/* if !ima_use_tcb set entries = 0 so we load NO default rules */
--	measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0;
-+	/* if !ima_policy set entries = 0 so we load NO default rules */
-+	measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
- 	appraise_entries = ima_use_appraise_tcb ?
- 			 ARRAY_SIZE(default_appraise_rules) : 0;
- 
--	for (i = 0; i < measure_entries + appraise_entries; i++) {
--		if (i < measure_entries)
--			list_add_tail(&default_rules[i].list,
--				      &ima_default_rules);
--		else {
--			int j = i - measure_entries;
-+	for (i = 0; i < measure_entries; i++)
-+		list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
- 
--			list_add_tail(&default_appraise_rules[j].list,
-+	switch (ima_policy) {
-+	case ORIGINAL_TCB:
-+		for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
-+			list_add_tail(&original_measurement_rules[i].list,
- 				      &ima_default_rules);
--		}
-+		break;
-+	case DEFAULT_TCB:
-+		for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
-+			list_add_tail(&default_measurement_rules[i].list,
-+				      &ima_default_rules);
-+	default:
-+		break;
-+	}
-+
-+	for (i = 0; i < appraise_entries; i++) {
-+		list_add_tail(&default_appraise_rules[i].list,
-+			      &ima_default_rules);
- 	}
- 
- 	ima_rules = &ima_default_rules;
-@@ -373,7 +435,8 @@ enum {
- 	Opt_audit,
- 	Opt_obj_user, Opt_obj_role, Opt_obj_type,
- 	Opt_subj_user, Opt_subj_role, Opt_subj_type,
--	Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
-+	Opt_func, Opt_mask, Opt_fsmagic,
-+	Opt_uid, Opt_euid, Opt_fowner,
- 	Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
- };
- 
-@@ -394,6 +457,7 @@ static match_table_t policy_tokens = {
- 	{Opt_fsmagic, "fsmagic=%s"},
- 	{Opt_fsuuid, "fsuuid=%s"},
- 	{Opt_uid, "uid=%s"},
-+	{Opt_euid, "euid=%s"},
- 	{Opt_fowner, "fowner=%s"},
- 	{Opt_appraise_type, "appraise_type=%s"},
- 	{Opt_permit_directio, "permit_directio"},
-@@ -435,6 +499,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
- static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- {
- 	struct audit_buffer *ab;
-+	char *from;
- 	char *p;
- 	int result = 0;
- 
-@@ -525,18 +590,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- 			if (entry->mask)
- 				result = -EINVAL;
- 
--			if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
-+			from = args[0].from;
-+			if (*from == '^')
-+				from++;
-+
-+			if ((strcmp(from, "MAY_EXEC")) == 0)
- 				entry->mask = MAY_EXEC;
--			else if (strcmp(args[0].from, "MAY_WRITE") == 0)
-+			else if (strcmp(from, "MAY_WRITE") == 0)
- 				entry->mask = MAY_WRITE;
--			else if (strcmp(args[0].from, "MAY_READ") == 0)
-+			else if (strcmp(from, "MAY_READ") == 0)
- 				entry->mask = MAY_READ;
--			else if (strcmp(args[0].from, "MAY_APPEND") == 0)
-+			else if (strcmp(from, "MAY_APPEND") == 0)
- 				entry->mask = MAY_APPEND;
- 			else
- 				result = -EINVAL;
- 			if (!result)
--				entry->flags |= IMA_MASK;
-+				entry->flags |= (*args[0].from == '^')
-+				     ? IMA_INMASK : IMA_MASK;
- 			break;
- 		case Opt_fsmagic:
- 			ima_log_string(ab, "fsmagic", args[0].from);
-@@ -566,6 +636,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- 			break;
- 		case Opt_uid:
- 			ima_log_string(ab, "uid", args[0].from);
-+		case Opt_euid:
-+			if (token == Opt_euid)
-+				ima_log_string(ab, "euid", args[0].from);
- 
- 			if (uid_valid(entry->uid)) {
- 				result = -EINVAL;
-@@ -574,11 +647,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- 
- 			result = kstrtoul(args[0].from, 10, &lnum);
- 			if (!result) {
--				entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
--				if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum))
-+				entry->uid = make_kuid(current_user_ns(),
-+						       (uid_t) lnum);
-+				if (!uid_valid(entry->uid) ||
-+				    (uid_t)lnum != lnum)
- 					result = -EINVAL;
- 				else
--					entry->flags |= IMA_UID;
-+					entry->flags |= (token == Opt_uid)
-+					    ? IMA_UID : IMA_EUID;
- 			}
- 			break;
- 		case Opt_fowner:
-diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
-index bcfc36c..61fbd0c 100644
---- a/security/integrity/ima/ima_template_lib.c
-+++ b/security/integrity/ima/ima_template_lib.c
-@@ -70,7 +70,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
- 					 enum data_formats datafmt,
- 					 struct ima_field_data *field_data)
- {
--	u8 *buf_ptr = field_data->data, buflen = field_data->len;
-+	u8 *buf_ptr = field_data->data;
-+	u32 buflen = field_data->len;
- 
- 	switch (datafmt) {
- 	case DATA_FMT_DIGEST_WITH_ALGO:
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index e72548b..d334370 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
- 	if (index_key->type == &key_type_keyring)
- 		up_write(&keyring_serialise_link_sem);
- 
--	if (edit && !edit->dead_leaf) {
--		key_payload_reserve(keyring,
--				    keyring->datalen - KEYQUOTA_LINK_BYTES);
-+	if (edit) {
-+		if (!edit->dead_leaf) {
-+			key_payload_reserve(keyring,
-+				keyring->datalen - KEYQUOTA_LINK_BYTES);
-+		}
- 		assoc_array_cancel_edit(edit);
- 	}
- 	up_write(&keyring->sem);
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index 212070e..7f8d7f1 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -3288,7 +3288,8 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
- 	int rc = 0;
- 
- 	if (default_noexec &&
--	    (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
-+	    (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
-+				   (!shared && (prot & PROT_WRITE)))) {
- 		/*
- 		 * We are making executable an anonymous mapping or a
- 		 * private file mapping that will also be writable.
-diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
-index afe6a26..57644b1 100644
---- a/security/selinux/ss/ebitmap.c
-+++ b/security/selinux/ss/ebitmap.c
-@@ -153,6 +153,12 @@ int ebitmap_netlbl_import(struct ebitmap *ebmap,
- 		if (offset == (u32)-1)
- 			return 0;
- 
-+		/* don't waste ebitmap space if the netlabel bitmap is empty */
-+		if (bitmap == 0) {
-+			offset += EBITMAP_UNIT_SIZE;
-+			continue;
-+		}
-+
- 		if (e_iter == NULL ||
- 		    offset >= e_iter->startbit + EBITMAP_SIZE) {
- 			e_prev = e_iter;
-diff --git a/sound/soc/codecs/max98925.c b/sound/soc/codecs/max98925.c
-index 9b5a17d..aad6642 100644
---- a/sound/soc/codecs/max98925.c
-+++ b/sound/soc/codecs/max98925.c
-@@ -346,7 +346,7 @@ static int max98925_dai_set_fmt(struct snd_soc_dai *codec_dai,
- 	}
- 
- 	regmap_update_bits(max98925->regmap, MAX98925_FORMAT,
--			M98925_DAI_BCI_MASK, invert);
-+			M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK, invert);
- 	return 0;
- }
- 
-diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
-index be4d741..2ee44ab 100644
---- a/sound/soc/codecs/rt5645.c
-+++ b/sound/soc/codecs/rt5645.c
-@@ -2837,6 +2837,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
- 		}
- 	}
- 
-+	INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
-+
- 	if (rt5645->i2c->irq) {
- 		ret = request_threaded_irq(rt5645->i2c->irq, NULL, rt5645_irq,
- 			IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
-@@ -2855,8 +2857,6 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
- 			dev_err(&i2c->dev, "Fail gpio_direction hp_det_gpio\n");
- 	}
- 
--	INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
--
- 	return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5645,
- 				      rt5645_dai, ARRAY_SIZE(rt5645_dai));
- }
-diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
-index dfb4ff5..1855859 100644
---- a/sound/soc/codecs/tas2552.c
-+++ b/sound/soc/codecs/tas2552.c
-@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct tas2552_data *tas_data, int sw_shutdown)
- {
- 	u8 cfg1_reg;
- 
-+	if (!tas_data->codec)
-+		return;
-+
- 	if (sw_shutdown)
- 		cfg1_reg = 0;
- 	else
-@@ -335,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 24);
- static const struct snd_kcontrol_new tas2552_snd_controls[] = {
- 	SOC_SINGLE_TLV("Speaker Driver Playback Volume",
- 			 TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv),
--	SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0),
- };
- 
- static const struct reg_default tas2552_init_regs[] = {
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index 0c6d1bc..d476221 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -42,7 +42,7 @@ struct wm5102_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- static const struct wm_adsp_region wm5102_dsp1_regions[] = {
-diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
-index fbaeddb..3ee6cfd 100644
---- a/sound/soc/codecs/wm5110.c
-+++ b/sound/soc/codecs/wm5110.c
-@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- #define WM5110_NG_SRC(name, base) \
-diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
-index ada9ac1..51171e4 100644
---- a/sound/soc/codecs/wm8737.c
-+++ b/sound/soc/codecs/wm8737.c
-@@ -483,7 +483,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
- 
- 			/* Fast VMID ramp at 2*2.5k */
- 			snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
--					    WM8737_VMIDSEL_MASK, 0x4);
-+					    WM8737_VMIDSEL_MASK,
-+					    2 << WM8737_VMIDSEL_SHIFT);
- 
- 			/* Bring VMID up */
- 			snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
-@@ -497,7 +498,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
- 
- 		/* VMID at 2*300k */
- 		snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
--				    WM8737_VMIDSEL_MASK, 2);
-+				    WM8737_VMIDSEL_MASK,
-+				    1 << WM8737_VMIDSEL_SHIFT);
- 
- 		break;
- 
-diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
-index db94931..0bb4a64 100644
---- a/sound/soc/codecs/wm8903.h
-+++ b/sound/soc/codecs/wm8903.h
-@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
- #define WM8903_VMID_BUF_ENA_WIDTH                    1  /* VMID_BUF_ENA */
- 
- #define WM8903_VMID_RES_50K                          2
--#define WM8903_VMID_RES_250K                         3
-+#define WM8903_VMID_RES_250K                         4
- #define WM8903_VMID_RES_5K                           6
- 
- /*
-diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
-index 00bec91..03e04bf 100644
---- a/sound/soc/codecs/wm8955.c
-+++ b/sound/soc/codecs/wm8955.c
-@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
- 		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
- 				    WM8955_K_17_9_MASK,
- 				    (pll.k >> 9) & WM8955_K_17_9_MASK);
--		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
-+		snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
- 				    WM8955_K_8_0_MASK,
- 				    pll.k & WM8955_K_8_0_MASK);
- 		if (pll.k)
-diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
-index e97a761..8d7f632 100644
---- a/sound/soc/codecs/wm8960.c
-+++ b/sound/soc/codecs/wm8960.c
-@@ -245,7 +245,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
- SOC_ENUM("ADC Polarity", wm8960_enum[0]),
- SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
- 
--SOC_ENUM("DAC Polarity", wm8960_enum[2]),
-+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
- SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
- 		    wm8960_get_deemph, wm8960_put_deemph),
- 
-diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
-index a4d1177..e7c81ba 100644
---- a/sound/soc/codecs/wm8997.c
-+++ b/sound/soc/codecs/wm8997.c
-@@ -40,7 +40,7 @@ struct wm8997_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
- 
- static const struct reg_default wm8997_sysclk_reva_patch[] = {
-diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
-index cd146d4..b38b98c 100644
---- a/sound/soc/fsl/imx-wm8962.c
-+++ b/sound/soc/fsl/imx-wm8962.c
-@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
- 		dev_err(&pdev->dev, "audmux internal port setup failed\n");
- 		return ret;
- 	}
--	imx_audmux_v2_configure_port(ext_port,
-+	ret = imx_audmux_v2_configure_port(ext_port,
- 			IMX_AUDMUX_V2_PTCR_SYN,
- 			IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
- 	if (ret) {
-diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
-index 6768e4f..30d0109 100644
---- a/sound/soc/omap/Kconfig
-+++ b/sound/soc/omap/Kconfig
-@@ -100,12 +100,13 @@ config SND_OMAP_SOC_OMAP_TWL4030
- 
- config SND_OMAP_SOC_OMAP_ABE_TWL6040
- 	tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec"
--	depends on TWL6040_CORE && SND_OMAP_SOC && (ARCH_OMAP4 || SOC_OMAP5 || COMPILE_TEST)
-+	depends on TWL6040_CORE && SND_OMAP_SOC
-+	depends on ARCH_OMAP4 || (SOC_OMAP5 && MFD_PALMAS) || COMPILE_TEST
- 	select SND_OMAP_SOC_DMIC
- 	select SND_OMAP_SOC_MCPDM
- 	select SND_SOC_TWL6040
- 	select SND_SOC_DMIC
--	select COMMON_CLK_PALMAS if MFD_PALMAS
-+	select COMMON_CLK_PALMAS if (SOC_OMAP5 && MFD_PALMAS)
- 	help
- 	  Say Y if you want to add support for SoC audio on OMAP boards using
- 	  ABE and twl6040 codec. This driver currently supports:
-diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig
-index 5f58e4f..b07f183 100644
---- a/sound/soc/qcom/Kconfig
-+++ b/sound/soc/qcom/Kconfig
-@@ -6,12 +6,10 @@ config SND_SOC_QCOM
- 
- config SND_SOC_LPASS_CPU
- 	tristate
--	depends on SND_SOC_QCOM
- 	select REGMAP_MMIO
- 
- config SND_SOC_LPASS_PLATFORM
- 	tristate
--	depends on SND_SOC_QCOM
- 	select REGMAP_MMIO
- 
- config SND_SOC_STORM
-diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
-index 85b5238..2babdda 100644
---- a/tools/perf/util/cloexec.c
-+++ b/tools/perf/util/cloexec.c
-@@ -7,11 +7,15 @@
- 
- static unsigned long flag = PERF_FLAG_FD_CLOEXEC;
- 
-+#ifdef __GLIBC_PREREQ
-+#if !__GLIBC_PREREQ(2, 6)
- int __weak sched_getcpu(void)
- {
- 	errno = ENOSYS;
- 	return -1;
- }
-+#endif
-+#endif
- 
- static int perf_flag_probe(void)
- {
diff --git a/4.1.4/0000_README b/4.1.5/0000_README
index 9d09b8e..ec1dd3d 100644
--- a/4.1.4/0000_README
+++ b/4.1.5/0000_README
@@ -2,11 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1003_linux-4.1.4.patch
+Patch:	1004_linux-4.1.5.patch
 From:	http://www.kernel.org
-Desc:	Linux 4.1.4
+Desc:	Linux 4.1.5
 
-Patch:	4420_grsecurity-3.1-4.1.4-201508032312.patch
+Patch:	4420_grsecurity-3.1-4.1.5-201508102129.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.1.5/1004_linux-4.1.5.patch b/4.1.5/1004_linux-4.1.5.patch
new file mode 100644
index 0000000..cb5d5d6
--- /dev/null
+++ b/4.1.5/1004_linux-4.1.5.patch
@@ -0,0 +1,5750 @@
+diff --git a/Documentation/hwmon/nct7904 b/Documentation/hwmon/nct7904
+index 014f112..57fffe3 100644
+--- a/Documentation/hwmon/nct7904
++++ b/Documentation/hwmon/nct7904
+@@ -35,11 +35,11 @@ temp1_input		Local temperature (1/1000 degree,
+ temp[2-9]_input		CPU temperatures (1/1000 degree,
+ 			0.125 degree resolution)
+ 
+-fan[1-4]_mode		R/W, 0/1 for manual or SmartFan mode
++pwm[1-4]_enable		R/W, 1/2 for manual or SmartFan mode
+ 			Setting SmartFan mode is supported only if it has been
+ 			previously configured by BIOS (or configuration EEPROM)
+ 
+-fan[1-4]_pwm		R/O in SmartFan mode, R/W in manual control mode
++pwm[1-4]		R/O in SmartFan mode, R/W in manual control mode
+ 
+ The driver checks sensor control registers and does not export the sensors
+ that are not enabled. Anyway, a sensor that is enabled may actually be not
+diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
+index 74b6c6d..d2b1c40 100644
+--- a/Documentation/kbuild/makefiles.txt
++++ b/Documentation/kbuild/makefiles.txt
+@@ -952,6 +952,14 @@ When kbuild executes, the following steps are followed (roughly):
+ 	$(KBUILD_ARFLAGS) set by the top level Makefile to "D" (deterministic
+ 	mode) if this option is supported by $(AR).
+ 
++    ARCH_CPPFLAGS, ARCH_AFLAGS, ARCH_CFLAGS   Overrides the kbuild defaults
++
++	These variables are appended to the KBUILD_CPPFLAGS,
++	KBUILD_AFLAGS, and KBUILD_CFLAGS, respectively, after the
++	top-level Makefile has set any other flags. This provides a
++	means for an architecture to override the defaults.
++
++
+ --- 6.2 Add prerequisites to archheaders:
+ 
+ 	The archheaders: rule is used to generate header files that
+diff --git a/Makefile b/Makefile
+index 36f3225..068dd69 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 1
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Series 4800
+ 
+@@ -783,10 +783,11 @@ endif
+ include scripts/Makefile.kasan
+ include scripts/Makefile.extrawarn
+ 
+-# Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
+-KBUILD_CPPFLAGS += $(KCPPFLAGS)
+-KBUILD_AFLAGS += $(KAFLAGS)
+-KBUILD_CFLAGS += $(KCFLAGS)
++# Add any arch overrides and user supplied CPPFLAGS, AFLAGS and CFLAGS as the
++# last assignments
++KBUILD_CPPFLAGS += $(ARCH_CPPFLAGS) $(KCPPFLAGS)
++KBUILD_AFLAGS   += $(ARCH_AFLAGS)   $(KAFLAGS)
++KBUILD_CFLAGS   += $(ARCH_CFLAGS)   $(KCFLAGS)
+ 
+ # Use --build-id when available.
+ LDFLAGS_BUILD_ID = $(patsubst -Wl$(comma)%,%,\
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index db72fec..2f21e1e 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -43,7 +43,8 @@ endif
+ 
+ ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ # Generic build system uses -O2, we want -O3
+-cflags-y  += -O3
++# Note: No need to add to cflags-y as that happens anyways
++ARCH_CFLAGS += -O3
+ endif
+ 
+ # small data is default for elf32 tool-chain. If not usable, disable it
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 624a9d0..dae03e6 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -18,83 +18,49 @@
+ #include <linux/types.h>
+ #include <linux/compiler.h>
+ #include <asm/barrier.h>
++#ifndef CONFIG_ARC_HAS_LLSC
++#include <asm/smp.h>
++#endif
+ 
+-/*
+- * Hardware assisted read-modify-write using ARC700 LLOCK/SCOND insns.
+- * The Kconfig glue ensures that in SMP, this is only set if the container
+- * SoC/platform has cross-core coherent LLOCK/SCOND
+- */
+ #if defined(CONFIG_ARC_HAS_LLSC)
+ 
+-static inline void set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int temp;
+-
+-	m += nr >> 5;
+-
+-	/*
+-	 * ARC ISA micro-optimization:
+-	 *
+-	 * Instructions dealing with bitpos only consider lower 5 bits (0-31)
+-	 * e.g (x << 33) is handled like (x << 1) by ASL instruction
+-	 *  (mem pointer still needs adjustment to point to next word)
+-	 *
+-	 * Hence the masking to clamp @nr arg can be elided in general.
+-	 *
+-	 * However if @nr is a constant (above assumed it in a register),
+-	 * and greater than 31, gcc can optimize away (x << 33) to 0,
+-	 * as overflow, given the 32-bit ISA. Thus masking needs to be done
+-	 * for constant @nr, but no code is generated due to const prop.
+-	 */
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%1]	\n"
+-	"	bset    %0, %0, %2	\n"
+-	"	scond   %0, [%1]	\n"
+-	"	bnz     1b	\n"
+-	: "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-}
+-
+-static inline void clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%1]	\n"
+-	"	bclr    %0, %0, %2	\n"
+-	"	scond   %0, [%1]	\n"
+-	"	bnz     1b	\n"
+-	: "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-}
+-
+-static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
++/*
++ * Hardware assisted Atomic-R-M-W
++ */
+ 
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%1]	\n"
+-	"	bxor    %0, %0, %2	\n"
+-	"	scond   %0, [%1]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
++#define BIT_OP(op, c_op, asm_op)					\
++static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned int temp;						\
++									\
++	m += nr >> 5;							\
++									\
++	/*								\
++	 * ARC ISA micro-optimization:					\
++	 *								\
++	 * Instructions dealing with bitpos only consider lower 5 bits	\
++	 * e.g (x << 33) is handled like (x << 1) by ASL instruction	\
++	 *  (mem pointer still needs adjustment to point to next word)	\
++	 *								\
++	 * Hence the masking to clamp @nr arg can be elided in general.	\
++	 *								\
++	 * However if @nr is a constant (above assumed in a register),	\
++	 * and greater than 31, gcc can optimize away (x << 33) to 0,	\
++	 * as overflow, given the 32-bit ISA. Thus masking needs to be	\
++	 * done for const @nr, but no code is generated due to gcc	\
++	 * const prop.							\
++	 */								\
++	nr &= 0x1f;							\
++									\
++	__asm__ __volatile__(						\
++	"1:	llock       %0, [%1]		\n"			\
++	"	" #asm_op " %0, %0, %2	\n"				\
++	"	scond       %0, [%1]		\n"			\
++	"	bnz         1b			\n"			\
++	: "=&r"(temp)	/* Early clobber, to prevent reg reuse */	\
++	: "r"(m),	/* Not "m": llock only supports reg direct addr mode */	\
++	  "ir"(nr)							\
++	: "cc");							\
+ }
+ 
+ /*
+@@ -108,91 +74,37 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+  * Since ARC lacks a equivalent h/w primitive, the bit is set unconditionally
+  * and the old value of bit is returned
+  */
+-static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	/*
+-	 * Explicit full memory barrier needed before/after as
+-	 * LLOCK/SCOND themselves don't provide any such semantics
+-	 */
+-	smp_mb();
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%2]	\n"
+-	"	bset    %1, %0, %3	\n"
+-	"	scond   %1, [%2]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(old), "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-
+-	smp_mb();
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int old, temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	smp_mb();
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%2]	\n"
+-	"	bclr    %1, %0, %3	\n"
+-	"	scond   %1, [%2]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(old), "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-
+-	smp_mb();
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned int old, temp;
+-
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	smp_mb();
+-
+-	__asm__ __volatile__(
+-	"1:	llock   %0, [%2]	\n"
+-	"	bxor    %1, %0, %3	\n"
+-	"	scond   %1, [%2]	\n"
+-	"	bnz     1b		\n"
+-	: "=&r"(old), "=&r"(temp)
+-	: "r"(m), "ir"(nr)
+-	: "cc");
+-
+-	smp_mb();
+-
+-	return (old & (1 << nr)) != 0;
++#define TEST_N_BIT_OP(op, c_op, asm_op)					\
++static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long old, temp;					\
++									\
++	m += nr >> 5;							\
++									\
++	nr &= 0x1f;							\
++									\
++	/*								\
++	 * Explicit full memory barrier needed before/after as		\
++	 * LLOCK/SCOND themselves don't provide any such smenatic	\
++	 */								\
++	smp_mb();							\
++									\
++	__asm__ __volatile__(						\
++	"1:	llock       %0, [%2]	\n"				\
++	"	" #asm_op " %1, %0, %3	\n"				\
++	"	scond       %1, [%2]	\n"				\
++	"	bnz         1b		\n"				\
++	: "=&r"(old), "=&r"(temp)					\
++	: "r"(m), "ir"(nr)						\
++	: "cc");							\
++									\
++	smp_mb();							\
++									\
++	return (old & (1 << nr)) != 0;					\
+ }
+ 
+ #else	/* !CONFIG_ARC_HAS_LLSC */
+ 
+-#include <asm/smp.h>
+-
+ /*
+  * Non hardware assisted Atomic-R-M-W
+  * Locking would change to irq-disabling only (UP) and spinlocks (SMP)
+@@ -209,111 +121,37 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+  *             at compile time)
+  */
+ 
+-static inline void set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	temp = *m;
+-	*m = temp | (1UL << nr);
+-
+-	bitops_unlock(flags);
++#define BIT_OP(op, c_op, asm_op)					\
++static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long temp, flags;					\
++	m += nr >> 5;							\
++									\
++	/*								\
++	 * spin lock/unlock provide the needed smp_mb() before/after	\
++	 */								\
++	bitops_lock(flags);						\
++									\
++	temp = *m;							\
++	*m = temp c_op (1UL << (nr & 0x1f));					\
++									\
++	bitops_unlock(flags);						\
+ }
+ 
+-static inline void clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	temp = *m;
+-	*m = temp & ~(1UL << nr);
+-
+-	bitops_unlock(flags);
+-}
+-
+-static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	temp = *m;
+-	*m = temp ^ (1UL << nr);
+-
+-	bitops_unlock(flags);
+-}
+-
+-static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	/*
+-	 * spin lock/unlock provide the needed smp_mb() before/after
+-	 */
+-	bitops_lock(flags);
+-
+-	old = *m;
+-	*m = old | (1 << nr);
+-
+-	bitops_unlock(flags);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	old = *m;
+-	*m = old & ~(1 << nr);
+-
+-	bitops_unlock(flags);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old, flags;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	bitops_lock(flags);
+-
+-	old = *m;
+-	*m = old ^ (1 << nr);
+-
+-	bitops_unlock(flags);
+-
+-	return (old & (1 << nr)) != 0;
++#define TEST_N_BIT_OP(op, c_op, asm_op)					\
++static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long old, flags;					\
++	m += nr >> 5;							\
++									\
++	bitops_lock(flags);						\
++									\
++	old = *m;							\
++	*m = old c_op (1UL << (nr & 0x1f));				\
++									\
++	bitops_unlock(flags);						\
++									\
++	return (old & (1UL << (nr & 0x1f))) != 0;			\
+ }
+ 
+ #endif /* CONFIG_ARC_HAS_LLSC */
+@@ -322,86 +160,45 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+  * Non atomic variants
+  **************************************/
+ 
+-static inline void __set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	temp = *m;
+-	*m = temp | (1UL << nr);
++#define __BIT_OP(op, c_op, asm_op)					\
++static inline void __##op##_bit(unsigned long nr, volatile unsigned long *m)	\
++{									\
++	unsigned long temp;						\
++	m += nr >> 5;							\
++									\
++	temp = *m;							\
++	*m = temp c_op (1UL << (nr & 0x1f));				\
+ }
+ 
+-static inline void __clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	temp = *m;
+-	*m = temp & ~(1UL << nr);
++#define __TEST_N_BIT_OP(op, c_op, asm_op)				\
++static inline int __test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{									\
++	unsigned long old;						\
++	m += nr >> 5;							\
++									\
++	old = *m;							\
++	*m = old c_op (1UL << (nr & 0x1f));				\
++									\
++	return (old & (1UL << (nr & 0x1f))) != 0;			\
+ }
+ 
+-static inline void __change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long temp;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	temp = *m;
+-	*m = temp ^ (1UL << nr);
+-}
+-
+-static inline int
+-__test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	old = *m;
+-	*m = old | (1 << nr);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-__test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	old = *m;
+-	*m = old & ~(1 << nr);
+-
+-	return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-__test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+-	unsigned long old;
+-	m += nr >> 5;
+-
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	old = *m;
+-	*m = old ^ (1 << nr);
+-
+-	return (old & (1 << nr)) != 0;
+-}
++#define BIT_OPS(op, c_op, asm_op)					\
++									\
++	/* set_bit(), clear_bit(), change_bit() */			\
++	BIT_OP(op, c_op, asm_op)					\
++									\
++	/* test_and_set_bit(), test_and_clear_bit(), test_and_change_bit() */\
++	TEST_N_BIT_OP(op, c_op, asm_op)					\
++									\
++	/* __set_bit(), __clear_bit(), __change_bit() */		\
++	__BIT_OP(op, c_op, asm_op)					\
++									\
++	/* __test_and_set_bit(), __test_and_clear_bit(), __test_and_change_bit() */\
++	__TEST_N_BIT_OP(op, c_op, asm_op)
++
++BIT_OPS(set, |, bset)
++BIT_OPS(clear, & ~, bclr)
++BIT_OPS(change, ^, bxor)
+ 
+ /*
+  * This routine doesn't need to be atomic.
+@@ -413,10 +210,7 @@ test_bit(unsigned int nr, const volatile unsigned long *addr)
+ 
+ 	addr += nr >> 5;
+ 
+-	if (__builtin_constant_p(nr))
+-		nr &= 0x1f;
+-
+-	mask = 1 << nr;
++	mask = 1UL << (nr & 0x1f);
+ 
+ 	return ((mask & *addr) != 0);
+ }
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2..2a58af7 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ 	long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+ 
+-#define instruction_pointer(regs)	((regs)->ret)
++#define instruction_pointer(regs)	(unsigned long)((regs)->ret)
+ #define profile_pc(regs)		instruction_pointer(regs)
+ 
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
+index 7128fad..c9df40e 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
++++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
+@@ -544,6 +544,10 @@
+ 	phy-supply = <&ldousb_reg>;
+ };
+ 
++&usb2_phy2 {
++	phy-supply = <&ldousb_reg>;
++};
++
+ &usb1 {
+ 	dr_mode = "host";
+ 	pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
+index aa46590..096f68b 100644
+--- a/arch/arm/boot/dts/dra7-evm.dts
++++ b/arch/arm/boot/dts/dra7-evm.dts
+@@ -686,7 +686,8 @@
+ 
+ &dcan1 {
+ 	status = "ok";
+-	pinctrl-names = "default", "sleep";
+-	pinctrl-0 = <&dcan1_pins_default>;
++	pinctrl-names = "default", "sleep", "active";
++	pinctrl-0 = <&dcan1_pins_sleep>;
+ 	pinctrl-1 = <&dcan1_pins_sleep>;
++	pinctrl-2 = <&dcan1_pins_default>;
+ };
+diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
+index ce0390f..6b05f6a 100644
+--- a/arch/arm/boot/dts/dra72-evm.dts
++++ b/arch/arm/boot/dts/dra72-evm.dts
+@@ -497,9 +497,10 @@
+ 
+ &dcan1 {
+ 	status = "ok";
+-	pinctrl-names = "default", "sleep";
+-	pinctrl-0 = <&dcan1_pins_default>;
++	pinctrl-names = "default", "sleep", "active";
++	pinctrl-0 = <&dcan1_pins_sleep>;
+ 	pinctrl-1 = <&dcan1_pins_sleep>;
++	pinctrl-2 = <&dcan1_pins_default>;
+ };
+ 
+ &qspi {
+diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
+index 6d0893a..78b6fd0 100644
+--- a/arch/arm/mach-imx/gpc.c
++++ b/arch/arm/mach-imx/gpc.c
+@@ -291,8 +291,6 @@ void __init imx_gpc_check_dt(void)
+ 	}
+ }
+ 
+-#ifdef CONFIG_PM_GENERIC_DOMAINS
+-
+ static void _imx6q_pm_pu_power_off(struct generic_pm_domain *genpd)
+ {
+ 	int iso, iso2sw;
+@@ -399,7 +397,6 @@ static struct genpd_onecell_data imx_gpc_onecell_data = {
+ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
+ {
+ 	struct clk *clk;
+-	bool is_off;
+ 	int i;
+ 
+ 	imx6q_pu_domain.reg = pu_reg;
+@@ -416,18 +413,13 @@ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
+ 	}
+ 	imx6q_pu_domain.num_clks = i;
+ 
+-	is_off = IS_ENABLED(CONFIG_PM);
+-	if (is_off) {
+-		_imx6q_pm_pu_power_off(&imx6q_pu_domain.base);
+-	} else {
+-		/*
+-		 * Enable power if compiled without CONFIG_PM in case the
+-		 * bootloader disabled it.
+-		 */
+-		imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
+-	}
++	/* Enable power always in case bootloader disabled it. */
++	imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
++
++	if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS))
++		return 0;
+ 
+-	pm_genpd_init(&imx6q_pu_domain.base, NULL, is_off);
++	pm_genpd_init(&imx6q_pu_domain.base, NULL, false);
+ 	return of_genpd_add_provider_onecell(dev->of_node,
+ 					     &imx_gpc_onecell_data);
+ 
+@@ -437,13 +429,6 @@ clk_err:
+ 	return -EINVAL;
+ }
+ 
+-#else
+-static inline int imx_gpc_genpd_init(struct device *dev, struct regulator *reg)
+-{
+-	return 0;
+-}
+-#endif /* CONFIG_PM_GENERIC_DOMAINS */
+-
+ static int imx_gpc_probe(struct platform_device *pdev)
+ {
+ 	struct regulator *pu_reg;
+diff --git a/arch/arm/mach-pxa/capc7117.c b/arch/arm/mach-pxa/capc7117.c
+index c092730..bf366b3 100644
+--- a/arch/arm/mach-pxa/capc7117.c
++++ b/arch/arm/mach-pxa/capc7117.c
+@@ -24,6 +24,7 @@
+ #include <linux/ata_platform.h>
+ #include <linux/serial_8250.h>
+ #include <linux/gpio.h>
++#include <linux/regulator/machine.h>
+ 
+ #include <asm/mach-types.h>
+ #include <asm/mach/arch.h>
+@@ -144,6 +145,8 @@ static void __init capc7117_init(void)
+ 
+ 	capc7117_uarts_init();
+ 	capc7117_ide_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(CAPC7117,
+diff --git a/arch/arm/mach-pxa/cm-x2xx.c b/arch/arm/mach-pxa/cm-x2xx.c
+index bb99f59..a17a91e 100644
+--- a/arch/arm/mach-pxa/cm-x2xx.c
++++ b/arch/arm/mach-pxa/cm-x2xx.c
+@@ -13,6 +13,7 @@
+ #include <linux/syscore_ops.h>
+ #include <linux/irq.h>
+ #include <linux/gpio.h>
++#include <linux/regulator/machine.h>
+ 
+ #include <linux/dm9000.h>
+ #include <linux/leds.h>
+@@ -466,6 +467,8 @@ static void __init cmx2xx_init(void)
+ 	cmx2xx_init_ac97();
+ 	cmx2xx_init_touchscreen();
+ 	cmx2xx_init_leds();
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init cmx2xx_init_irq(void)
+diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
+index 4d3588d..5851f4c 100644
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -835,6 +835,8 @@ static void __init cm_x300_init(void)
+ 	cm_x300_init_ac97();
+ 	cm_x300_init_wi2wi();
+ 	cm_x300_init_bl();
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init cm_x300_fixup(struct tag *tags, char **cmdline)
+diff --git a/arch/arm/mach-pxa/colibri-pxa270.c b/arch/arm/mach-pxa/colibri-pxa270.c
+index 5f9d930..3503826 100644
+--- a/arch/arm/mach-pxa/colibri-pxa270.c
++++ b/arch/arm/mach-pxa/colibri-pxa270.c
+@@ -18,6 +18,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/machine.h>
+ #include <linux/ucb1400.h>
+ 
+ #include <asm/mach/arch.h>
+@@ -294,6 +295,8 @@ static void __init colibri_pxa270_init(void)
+ 		printk(KERN_ERR "Illegal colibri_pxa270_baseboard type %d\n",
+ 				colibri_pxa270_baseboard);
+ 	}
++
++	regulator_has_full_constraints();
+ }
+ 
+ /* The "Income s.r.o. SH-Dmaster PXA270 SBC" board can be booted either
+diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
+index 51531ec..9d7072b 100644
+--- a/arch/arm/mach-pxa/em-x270.c
++++ b/arch/arm/mach-pxa/em-x270.c
+@@ -1306,6 +1306,8 @@ static void __init em_x270_init(void)
+ 	em_x270_init_i2c();
+ 	em_x270_init_camera();
+ 	em_x270_userspace_consumers_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(EM_X270, "Compulab EM-X270")
+diff --git a/arch/arm/mach-pxa/icontrol.c b/arch/arm/mach-pxa/icontrol.c
+index c98511c..9b0eb02 100644
+--- a/arch/arm/mach-pxa/icontrol.c
++++ b/arch/arm/mach-pxa/icontrol.c
+@@ -26,6 +26,7 @@
+ #include <linux/spi/spi.h>
+ #include <linux/spi/pxa2xx_spi.h>
+ #include <linux/can/platform/mcp251x.h>
++#include <linux/regulator/machine.h>
+ 
+ #include "generic.h"
+ 
+@@ -185,6 +186,8 @@ static void __init icontrol_init(void)
+ 	mxm_8x10_mmc_init();
+ 
+ 	icontrol_can_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(ICONTROL, "iControl/SafeTcam boards using Embedian MXM-8x10 CoM")
+diff --git a/arch/arm/mach-pxa/trizeps4.c b/arch/arm/mach-pxa/trizeps4.c
+index 872dcb2..066e3a2 100644
+--- a/arch/arm/mach-pxa/trizeps4.c
++++ b/arch/arm/mach-pxa/trizeps4.c
+@@ -26,6 +26,7 @@
+ #include <linux/dm9000.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/regulator/machine.h>
+ #include <linux/i2c/pxa-i2c.h>
+ 
+ #include <asm/types.h>
+@@ -534,6 +535,8 @@ static void __init trizeps4_init(void)
+ 
+ 	BCR_writew(trizeps_conxs_bcr);
+ 	board_backlight_power(1);
++
++	regulator_has_full_constraints();
+ }
+ 
+ static void __init trizeps4_map_io(void)
+diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
+index aa89488..54122a9 100644
+--- a/arch/arm/mach-pxa/vpac270.c
++++ b/arch/arm/mach-pxa/vpac270.c
+@@ -24,6 +24,7 @@
+ #include <linux/dm9000.h>
+ #include <linux/ucb1400.h>
+ #include <linux/ata_platform.h>
++#include <linux/regulator/machine.h>
+ #include <linux/regulator/max1586.h>
+ #include <linux/i2c/pxa-i2c.h>
+ 
+@@ -711,6 +712,8 @@ static void __init vpac270_init(void)
+ 	vpac270_ts_init();
+ 	vpac270_rtc_init();
+ 	vpac270_ide_init();
++
++	regulator_has_full_constraints();
+ }
+ 
+ MACHINE_START(VPAC270, "Voipac PXA270")
+diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
+index ac2ae5c..6158566f 100644
+--- a/arch/arm/mach-pxa/zeus.c
++++ b/arch/arm/mach-pxa/zeus.c
+@@ -868,6 +868,8 @@ static void __init zeus_init(void)
+ 	i2c_register_board_info(0, ARRAY_AND_SIZE(zeus_i2c_devices));
+ 	pxa2xx_set_spi_info(3, &pxa2xx_spi_ssp3_master_info);
+ 	spi_register_board_info(zeus_spi_board_info, ARRAY_SIZE(zeus_spi_board_info));
++
++	regulator_has_full_constraints();
+ }
+ 
+ static struct map_desc zeus_io_desc[] __initdata = {
+diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
+index 7e7583d..6e4b9ff 100644
+--- a/arch/arm/mm/dma-mapping.c
++++ b/arch/arm/mm/dma-mapping.c
+@@ -1953,7 +1953,7 @@ static int extend_iommu_mapping(struct dma_iommu_mapping *mapping)
+ {
+ 	int next_bitmap;
+ 
+-	if (mapping->nr_bitmaps > mapping->extensions)
++	if (mapping->nr_bitmaps >= mapping->extensions)
+ 		return -EINVAL;
+ 
+ 	next_bitmap = mapping->nr_bitmaps;
+diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
+index ab21e0d..352962b 100644
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -122,12 +122,12 @@ static int __init uefi_init(void)
+ 
+ 	/* Show what we know for posterity */
+ 	c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
+-			     sizeof(vendor));
++			     sizeof(vendor) * sizeof(efi_char16_t));
+ 	if (c16) {
+ 		for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
+ 			vendor[i] = c16[i];
+ 		vendor[i] = '\0';
+-		early_memunmap(c16, sizeof(vendor));
++		early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
+ 	}
+ 
+ 	pr_info("EFI v%u.%.02u by %s\n",
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97..52c179b 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_enable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ 	unsigned long flags;
+ 
++	if (IS_ERR_OR_NULL(clk))
++		return;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	__clk_disable(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ 	unsigned long flags;
+ 	unsigned long rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	spin_lock_irqsave(&clk_lock, flags);
+ 	rate = clk->get_rate(clk);
+ 	spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ 	unsigned long flags, actual_rate;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ 	unsigned long flags;
+ 	long ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_rate)
+ 		return -ENOSYS;
+ 
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ 	unsigned long flags;
+ 	int ret;
+ 
++	if (!clk)
++		return 0;
++
+ 	if (!clk->set_parent)
+ 		return -ENOSYS;
+ 
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+ 
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+-	return clk->parent;
++	return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+ 
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index f501665..a3b1ffe 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1417,6 +1417,7 @@ config CPU_MIPS64_R6
+ 	select CPU_SUPPORTS_HIGHMEM
+ 	select CPU_SUPPORTS_MSA
+ 	select GENERIC_CSUM
++	select MIPS_O32_FP64_SUPPORT if MIPS32_O32
+ 	help
+ 	  Choose this option to build a kernel for release 6 or later of the
+ 	  MIPS64 architecture.  New MIPS processors, starting with the Warrior
+diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
+index 084780b..1b06251 100644
+--- a/arch/mips/include/asm/fpu.h
++++ b/arch/mips/include/asm/fpu.h
+@@ -74,7 +74,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
+ 		goto fr_common;
+ 
+ 	case FPU_64BIT:
+-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_CPU_MIPS32_R6) \
++#if !(defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) \
+       || defined(CONFIG_64BIT))
+ 		/* we only have a 32-bit FPU */
+ 		return SIGFPE;
+diff --git a/arch/mips/include/asm/smp.h b/arch/mips/include/asm/smp.h
+index 2b25d1b..16f1ea9 100644
+--- a/arch/mips/include/asm/smp.h
++++ b/arch/mips/include/asm/smp.h
+@@ -23,6 +23,7 @@
+ extern int smp_num_siblings;
+ extern cpumask_t cpu_sibling_map[];
+ extern cpumask_t cpu_core_map[];
++extern cpumask_t cpu_foreign_map;
+ 
+ #define raw_smp_processor_id() (current_thread_info()->cpu)
+ 
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index faa46eb..d0744cc 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -63,6 +63,13 @@ EXPORT_SYMBOL(cpu_sibling_map);
+ cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
+ EXPORT_SYMBOL(cpu_core_map);
+ 
++/*
++ * A logcal cpu mask containing only one VPE per core to
++ * reduce the number of IPIs on large MT systems.
++ */
++cpumask_t cpu_foreign_map __read_mostly;
++EXPORT_SYMBOL(cpu_foreign_map);
++
+ /* representing cpus for which sibling maps can be computed */
+ static cpumask_t cpu_sibling_setup_map;
+ 
+@@ -103,6 +110,29 @@ static inline void set_cpu_core_map(int cpu)
+ 	}
+ }
+ 
++/*
++ * Calculate a new cpu_foreign_map mask whenever a
++ * new cpu appears or disappears.
++ */
++static inline void calculate_cpu_foreign_map(void)
++{
++	int i, k, core_present;
++	cpumask_t temp_foreign_map;
++
++	/* Re-calculate the mask */
++	for_each_online_cpu(i) {
++		core_present = 0;
++		for_each_cpu(k, &temp_foreign_map)
++			if (cpu_data[i].package == cpu_data[k].package &&
++			    cpu_data[i].core == cpu_data[k].core)
++				core_present = 1;
++		if (!core_present)
++			cpumask_set_cpu(i, &temp_foreign_map);
++	}
++
++	cpumask_copy(&cpu_foreign_map, &temp_foreign_map);
++}
++
+ struct plat_smp_ops *mp_ops;
+ EXPORT_SYMBOL(mp_ops);
+ 
+@@ -146,6 +176,8 @@ asmlinkage void start_secondary(void)
+ 	set_cpu_sibling_map(cpu);
+ 	set_cpu_core_map(cpu);
+ 
++	calculate_cpu_foreign_map();
++
+ 	cpumask_set_cpu(cpu, &cpu_callin_map);
+ 
+ 	synchronise_count_slave(cpu);
+@@ -173,9 +205,18 @@ void __irq_entry smp_call_function_interrupt(void)
+ static void stop_this_cpu(void *dummy)
+ {
+ 	/*
+-	 * Remove this CPU:
++	 * Remove this CPU. Be a bit slow here and
++	 * set the bits for every online CPU so we don't miss
++	 * any IPI whilst taking this VPE down.
+ 	 */
++
++	cpumask_copy(&cpu_foreign_map, cpu_online_mask);
++
++	/* Make it visible to every other CPU */
++	smp_mb();
++
+ 	set_cpu_online(smp_processor_id(), false);
++	calculate_cpu_foreign_map();
+ 	local_irq_disable();
+ 	while (1);
+ }
+@@ -197,6 +238,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ 	mp_ops->prepare_cpus(max_cpus);
+ 	set_cpu_sibling_map(0);
+ 	set_cpu_core_map(0);
++	calculate_cpu_foreign_map();
+ #ifndef CONFIG_HOTPLUG_CPU
+ 	init_cpu_present(cpu_possible_mask);
+ #endif
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index 22b9b2c..6983fcd 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -451,7 +451,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
+ 			/* Fall through */
+ 		case jr_op:
+ 			/* For R6, JR already emulated in jalr_op */
+-			if (NO_R6EMU && insn.r_format.opcode == jr_op)
++			if (NO_R6EMU && insn.r_format.func == jr_op)
+ 				break;
+ 			*contpc = regs->regs[insn.r_format.rs];
+ 			return 1;
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 2e03ab1..dca0efc 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -37,6 +37,7 @@
+ #include <asm/cacheflush.h> /* for run_uncached() */
+ #include <asm/traps.h>
+ #include <asm/dma-coherence.h>
++#include <asm/mips-cm.h>
+ 
+ /*
+  * Special Variant of smp_call_function for use by cache functions:
+@@ -51,9 +52,16 @@ static inline void r4k_on_each_cpu(void (*func) (void *info), void *info)
+ {
+ 	preempt_disable();
+ 
+-#ifndef CONFIG_MIPS_MT_SMP
+-	smp_call_function(func, info, 1);
+-#endif
++	/*
++	 * The Coherent Manager propagates address-based cache ops to other
++	 * cores but not index-based ops. However, r4k_on_each_cpu is used
++	 * in both cases so there is no easy way to tell what kind of op is
++	 * executed to the other cores. The best we can probably do is
++	 * to restrict that call when a CM is not present because both
++	 * CM-based SMP protocols (CMP & CPS) restrict index-based cache ops.
++	 */
++	if (!mips_cm_present())
++		smp_call_function_many(&cpu_foreign_map, func, info, 1);
+ 	func(info);
+ 	preempt_enable();
+ }
+diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
+index 3a08eae..3edbb9f 100644
+--- a/arch/parisc/include/asm/pgalloc.h
++++ b/arch/parisc/include/asm/pgalloc.h
+@@ -72,7 +72,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+ 
+ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ {
+-	if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
++	if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
+ 		/*
+ 		 * This is the permanent pmd attached to the pgd;
+ 		 * cannot free it.
+@@ -81,6 +81,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ 		 */
+ 		mm_inc_nr_pmds(mm);
+ 		return;
++	}
+ 	free_pages((unsigned long)pmd, PMD_ORDER);
+ }
+ 
+diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
+index 0a18375..f93c4a4 100644
+--- a/arch/parisc/include/asm/pgtable.h
++++ b/arch/parisc/include/asm/pgtable.h
+@@ -16,7 +16,7 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+ 
+-extern spinlock_t pa_dbit_lock;
++extern spinlock_t pa_tlb_lock;
+ 
+ /*
+  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+@@ -33,6 +33,19 @@ extern spinlock_t pa_dbit_lock;
+  */
+ #define kern_addr_valid(addr)	(1)
+ 
++/* Purge data and instruction TLB entries.  Must be called holding
++ * the pa_tlb_lock.  The TLB purge instructions are slow on SMP
++ * machines since the purge must be broadcast to all CPUs.
++ */
++
++static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
++{
++	mtsp(mm->context, 1);
++	pdtlb(addr);
++	if (unlikely(split_tlb))
++		pitlb(addr);
++}
++
+ /* Certain architectures need to do special things when PTEs
+  * within a page table are directly modified.  Thus, the following
+  * hook is made available.
+@@ -42,15 +55,20 @@ extern spinlock_t pa_dbit_lock;
+                 *(pteptr) = (pteval);                           \
+         } while(0)
+ 
+-extern void purge_tlb_entries(struct mm_struct *, unsigned long);
++#define pte_inserted(x)						\
++	((pte_val(x) & (_PAGE_PRESENT|_PAGE_ACCESSED))		\
++	 == (_PAGE_PRESENT|_PAGE_ACCESSED))
+ 
+-#define set_pte_at(mm, addr, ptep, pteval)                      \
+-	do {                                                    \
++#define set_pte_at(mm, addr, ptep, pteval)			\
++	do {							\
++		pte_t old_pte;					\
+ 		unsigned long flags;				\
+-		spin_lock_irqsave(&pa_dbit_lock, flags);	\
+-		set_pte(ptep, pteval);                          \
+-		purge_tlb_entries(mm, addr);                    \
+-		spin_unlock_irqrestore(&pa_dbit_lock, flags);	\
++		spin_lock_irqsave(&pa_tlb_lock, flags);		\
++		old_pte = *ptep;				\
++		set_pte(ptep, pteval);				\
++		if (pte_inserted(old_pte))			\
++			purge_tlb_entries(mm, addr);		\
++		spin_unlock_irqrestore(&pa_tlb_lock, flags);	\
+ 	} while (0)
+ 
+ #endif /* !__ASSEMBLY__ */
+@@ -268,7 +286,7 @@ extern unsigned long *empty_zero_page;
+ 
+ #define pte_none(x)     (pte_val(x) == 0)
+ #define pte_present(x)	(pte_val(x) & _PAGE_PRESENT)
+-#define pte_clear(mm,addr,xp)	do { pte_val(*(xp)) = 0; } while (0)
++#define pte_clear(mm, addr, xp)  set_pte_at(mm, addr, xp, __pte(0))
+ 
+ #define pmd_flag(x)	(pmd_val(x) & PxD_FLAG_MASK)
+ #define pmd_address(x)	((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
+@@ -435,15 +453,15 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
+ 	if (!pte_young(*ptep))
+ 		return 0;
+ 
+-	spin_lock_irqsave(&pa_dbit_lock, flags);
++	spin_lock_irqsave(&pa_tlb_lock, flags);
+ 	pte = *ptep;
+ 	if (!pte_young(pte)) {
+-		spin_unlock_irqrestore(&pa_dbit_lock, flags);
++		spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ 		return 0;
+ 	}
+ 	set_pte(ptep, pte_mkold(pte));
+ 	purge_tlb_entries(vma->vm_mm, addr);
+-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
++	spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ 	return 1;
+ }
+ 
+@@ -453,11 +471,12 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ 	pte_t old_pte;
+ 	unsigned long flags;
+ 
+-	spin_lock_irqsave(&pa_dbit_lock, flags);
++	spin_lock_irqsave(&pa_tlb_lock, flags);
+ 	old_pte = *ptep;
+-	pte_clear(mm,addr,ptep);
+-	purge_tlb_entries(mm, addr);
+-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
++	set_pte(ptep, __pte(0));
++	if (pte_inserted(old_pte))
++		purge_tlb_entries(mm, addr);
++	spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ 
+ 	return old_pte;
+ }
+@@ -465,10 +484,10 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ 	unsigned long flags;
+-	spin_lock_irqsave(&pa_dbit_lock, flags);
++	spin_lock_irqsave(&pa_tlb_lock, flags);
+ 	set_pte(ptep, pte_wrprotect(*ptep));
+ 	purge_tlb_entries(mm, addr);
+-	spin_unlock_irqrestore(&pa_dbit_lock, flags);
++	spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ }
+ 
+ #define pte_same(A,B)	(pte_val(A) == pte_val(B))
+diff --git a/arch/parisc/include/asm/tlbflush.h b/arch/parisc/include/asm/tlbflush.h
+index 9d086a5..e84b964 100644
+--- a/arch/parisc/include/asm/tlbflush.h
++++ b/arch/parisc/include/asm/tlbflush.h
+@@ -13,6 +13,9 @@
+  * active at any one time on the Merced bus.  This tlb purge
+  * synchronisation is fairly lightweight and harmless so we activate
+  * it on all systems not just the N class.
++
++ * It is also used to ensure PTE updates are atomic and consistent
++ * with the TLB.
+  */
+ extern spinlock_t pa_tlb_lock;
+ 
+@@ -24,20 +27,24 @@ extern void flush_tlb_all_local(void *);
+ 
+ #define smp_flush_tlb_all()	flush_tlb_all()
+ 
++int __flush_tlb_range(unsigned long sid,
++	unsigned long start, unsigned long end);
++
++#define flush_tlb_range(vma, start, end) \
++	__flush_tlb_range((vma)->vm_mm->context, start, end)
++
++#define flush_tlb_kernel_range(start, end) \
++	__flush_tlb_range(0, start, end)
++
+ /*
+  * flush_tlb_mm()
+  *
+- * XXX This code is NOT valid for HP-UX compatibility processes,
+- * (although it will probably work 99% of the time). HP-UX
+- * processes are free to play with the space id's and save them
+- * over long periods of time, etc. so we have to preserve the
+- * space and just flush the entire tlb. We need to check the
+- * personality in order to do that, but the personality is not
+- * currently being set correctly.
+- *
+- * Of course, Linux processes could do the same thing, but
+- * we don't support that (and the compilers, dynamic linker,
+- * etc. do not do that).
++ * The code to switch to a new context is NOT valid for processes
++ * which play with the space id's.  Thus, we have to preserve the
++ * space and just flush the entire tlb.  However, the compilers,
++ * dynamic linker, etc, do not manipulate space id's, so there
++ * could be a significant performance benefit in switching contexts
++ * and not flushing the whole tlb.
+  */
+ 
+ static inline void flush_tlb_mm(struct mm_struct *mm)
+@@ -45,10 +52,18 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
+ 	BUG_ON(mm == &init_mm); /* Should never happen */
+ 
+ #if 1 || defined(CONFIG_SMP)
++	/* Except for very small threads, flushing the whole TLB is
++	 * faster than using __flush_tlb_range.  The pdtlb and pitlb
++	 * instructions are very slow because of the TLB broadcast.
++	 * It might be faster to do local range flushes on all CPUs
++	 * on PA 2.0 systems.
++	 */
+ 	flush_tlb_all();
+ #else
+ 	/* FIXME: currently broken, causing space id and protection ids
+-	 *  to go out of sync, resulting in faults on userspace accesses.
++	 * to go out of sync, resulting in faults on userspace accesses.
++	 * This approach needs further investigation since running many
++	 * small applications (e.g., GCC testsuite) is faster on HP-UX.
+ 	 */
+ 	if (mm) {
+ 		if (mm->context != 0)
+@@ -65,22 +80,12 @@ static inline void flush_tlb_page(struct vm_area_struct *vma,
+ {
+ 	unsigned long flags, sid;
+ 
+-	/* For one page, it's not worth testing the split_tlb variable */
+-
+-	mb();
+ 	sid = vma->vm_mm->context;
+ 	purge_tlb_start(flags);
+ 	mtsp(sid, 1);
+ 	pdtlb(addr);
+-	pitlb(addr);
++	if (unlikely(split_tlb))
++		pitlb(addr);
+ 	purge_tlb_end(flags);
+ }
+-
+-void __flush_tlb_range(unsigned long sid,
+-	unsigned long start, unsigned long end);
+-
+-#define flush_tlb_range(vma,start,end) __flush_tlb_range((vma)->vm_mm->context,start,end)
+-
+-#define flush_tlb_kernel_range(start, end) __flush_tlb_range(0,start,end)
+-
+ #endif
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index f6448c7..cda6dbb 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -342,12 +342,15 @@ EXPORT_SYMBOL(flush_data_cache_local);
+ EXPORT_SYMBOL(flush_kernel_icache_range_asm);
+ 
+ #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */
+-int parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
++static unsigned long parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
++
++#define FLUSH_TLB_THRESHOLD (2*1024*1024) /* 2MB initial TLB threshold */
++static unsigned long parisc_tlb_flush_threshold __read_mostly = FLUSH_TLB_THRESHOLD;
+ 
+ void __init parisc_setup_cache_timing(void)
+ {
+ 	unsigned long rangetime, alltime;
+-	unsigned long size;
++	unsigned long size, start;
+ 
+ 	alltime = mfctl(16);
+ 	flush_data_cache();
+@@ -364,14 +367,43 @@ void __init parisc_setup_cache_timing(void)
+ 	/* Racy, but if we see an intermediate value, it's ok too... */
+ 	parisc_cache_flush_threshold = size * alltime / rangetime;
+ 
+-	parisc_cache_flush_threshold = (parisc_cache_flush_threshold + L1_CACHE_BYTES - 1) &~ (L1_CACHE_BYTES - 1); 
++	parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold);
+ 	if (!parisc_cache_flush_threshold)
+ 		parisc_cache_flush_threshold = FLUSH_THRESHOLD;
+ 
+ 	if (parisc_cache_flush_threshold > cache_info.dc_size)
+ 		parisc_cache_flush_threshold = cache_info.dc_size;
+ 
+-	printk(KERN_INFO "Setting cache flush threshold to %x (%d CPUs online)\n", parisc_cache_flush_threshold, num_online_cpus());
++	printk(KERN_INFO "Setting cache flush threshold to %lu kB\n",
++		parisc_cache_flush_threshold/1024);
++
++	/* calculate TLB flush threshold */
++
++	alltime = mfctl(16);
++	flush_tlb_all();
++	alltime = mfctl(16) - alltime;
++
++	size = PAGE_SIZE;
++	start = (unsigned long) _text;
++	rangetime = mfctl(16);
++	while (start < (unsigned long) _end) {
++		flush_tlb_kernel_range(start, start + PAGE_SIZE);
++		start += PAGE_SIZE;
++		size += PAGE_SIZE;
++	}
++	rangetime = mfctl(16) - rangetime;
++
++	printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n",
++		alltime, size, rangetime);
++
++	parisc_tlb_flush_threshold = size * alltime / rangetime;
++	parisc_tlb_flush_threshold *= num_online_cpus();
++	parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold);
++	if (!parisc_tlb_flush_threshold)
++		parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD;
++
++	printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n",
++		parisc_tlb_flush_threshold/1024);
+ }
+ 
+ extern void purge_kernel_dcache_page_asm(unsigned long);
+@@ -403,48 +435,45 @@ void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+ }
+ EXPORT_SYMBOL(copy_user_page);
+ 
+-void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+-{
+-	unsigned long flags;
+-
+-	/* Note: purge_tlb_entries can be called at startup with
+-	   no context.  */
+-
+-	purge_tlb_start(flags);
+-	mtsp(mm->context, 1);
+-	pdtlb(addr);
+-	pitlb(addr);
+-	purge_tlb_end(flags);
+-}
+-EXPORT_SYMBOL(purge_tlb_entries);
+-
+-void __flush_tlb_range(unsigned long sid, unsigned long start,
+-		       unsigned long end)
++/* __flush_tlb_range()
++ *
++ * returns 1 if all TLBs were flushed.
++ */
++int __flush_tlb_range(unsigned long sid, unsigned long start,
++		      unsigned long end)
+ {
+-	unsigned long npages;
++	unsigned long flags, size;
+ 
+-	npages = ((end - (start & PAGE_MASK)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+-	if (npages >= 512)  /* 2MB of space: arbitrary, should be tuned */
++	size = (end - start);
++	if (size >= parisc_tlb_flush_threshold) {
+ 		flush_tlb_all();
+-	else {
+-		unsigned long flags;
++		return 1;
++	}
+ 
++	/* Purge TLB entries for small ranges using the pdtlb and
++	   pitlb instructions.  These instructions execute locally
++	   but cause a purge request to be broadcast to other TLBs.  */
++	if (likely(!split_tlb)) {
++		while (start < end) {
++			purge_tlb_start(flags);
++			mtsp(sid, 1);
++			pdtlb(start);
++			purge_tlb_end(flags);
++			start += PAGE_SIZE;
++		}
++		return 0;
++	}
++
++	/* split TLB case */
++	while (start < end) {
+ 		purge_tlb_start(flags);
+ 		mtsp(sid, 1);
+-		if (split_tlb) {
+-			while (npages--) {
+-				pdtlb(start);
+-				pitlb(start);
+-				start += PAGE_SIZE;
+-			}
+-		} else {
+-			while (npages--) {
+-				pdtlb(start);
+-				start += PAGE_SIZE;
+-			}
+-		}
++		pdtlb(start);
++		pitlb(start);
+ 		purge_tlb_end(flags);
++		start += PAGE_SIZE;
+ 	}
++	return 0;
+ }
+ 
+ static void cacheflush_h_tmp_function(void *dummy)
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 7581961..c5ef408 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -45,7 +45,7 @@
+ 	.level 2.0
+ #endif
+ 
+-	.import         pa_dbit_lock,data
++	.import		pa_tlb_lock,data
+ 
+ 	/* space_to_prot macro creates a prot id from a space id */
+ 
+@@ -420,8 +420,8 @@
+ 	SHLREG		%r9,PxD_VALUE_SHIFT,\pmd
+ 	extru		\va,31-PAGE_SHIFT,ASM_BITS_PER_PTE,\index
+ 	dep		%r0,31,PAGE_SHIFT,\pmd  /* clear offset */
+-	shladd		\index,BITS_PER_PTE_ENTRY,\pmd,\pmd
+-	LDREG		%r0(\pmd),\pte		/* pmd is now pte */
++	shladd		\index,BITS_PER_PTE_ENTRY,\pmd,\pmd /* pmd is now pte */
++	LDREG		%r0(\pmd),\pte
+ 	bb,>=,n		\pte,_PAGE_PRESENT_BIT,\fault
+ 	.endm
+ 
+@@ -453,57 +453,53 @@
+ 	L2_ptep		\pgd,\pte,\index,\va,\fault
+ 	.endm
+ 
+-	/* Acquire pa_dbit_lock lock. */
+-	.macro		dbit_lock	spc,tmp,tmp1
++	/* Acquire pa_tlb_lock lock and recheck page is still present. */
++	.macro		tlb_lock	spc,ptp,pte,tmp,tmp1,fault
+ #ifdef CONFIG_SMP
+ 	cmpib,COND(=),n	0,\spc,2f
+-	load32		PA(pa_dbit_lock),\tmp
++	load32		PA(pa_tlb_lock),\tmp
+ 1:	LDCW		0(\tmp),\tmp1
+ 	cmpib,COND(=)	0,\tmp1,1b
+ 	nop
++	LDREG		0(\ptp),\pte
++	bb,<,n		\pte,_PAGE_PRESENT_BIT,2f
++	b		\fault
++	stw		 \spc,0(\tmp)
+ 2:
+ #endif
+ 	.endm
+ 
+-	/* Release pa_dbit_lock lock without reloading lock address. */
+-	.macro		dbit_unlock0	spc,tmp
++	/* Release pa_tlb_lock lock without reloading lock address. */
++	.macro		tlb_unlock0	spc,tmp
+ #ifdef CONFIG_SMP
+ 	or,COND(=)	%r0,\spc,%r0
+ 	stw             \spc,0(\tmp)
+ #endif
+ 	.endm
+ 
+-	/* Release pa_dbit_lock lock. */
+-	.macro		dbit_unlock1	spc,tmp
++	/* Release pa_tlb_lock lock. */
++	.macro		tlb_unlock1	spc,tmp
+ #ifdef CONFIG_SMP
+-	load32		PA(pa_dbit_lock),\tmp
+-	dbit_unlock0	\spc,\tmp
++	load32		PA(pa_tlb_lock),\tmp
++	tlb_unlock0	\spc,\tmp
+ #endif
+ 	.endm
+ 
+ 	/* Set the _PAGE_ACCESSED bit of the PTE.  Be clever and
+ 	 * don't needlessly dirty the cache line if it was already set */
+-	.macro		update_ptep	spc,ptep,pte,tmp,tmp1
+-#ifdef CONFIG_SMP
+-	or,COND(=)	%r0,\spc,%r0
+-	LDREG		0(\ptep),\pte
+-#endif
++	.macro		update_accessed	ptp,pte,tmp,tmp1
+ 	ldi		_PAGE_ACCESSED,\tmp1
+ 	or		\tmp1,\pte,\tmp
+ 	and,COND(<>)	\tmp1,\pte,%r0
+-	STREG		\tmp,0(\ptep)
++	STREG		\tmp,0(\ptp)
+ 	.endm
+ 
+ 	/* Set the dirty bit (and accessed bit).  No need to be
+ 	 * clever, this is only used from the dirty fault */
+-	.macro		update_dirty	spc,ptep,pte,tmp
+-#ifdef CONFIG_SMP
+-	or,COND(=)	%r0,\spc,%r0
+-	LDREG		0(\ptep),\pte
+-#endif
++	.macro		update_dirty	ptp,pte,tmp
+ 	ldi		_PAGE_ACCESSED|_PAGE_DIRTY,\tmp
+ 	or		\tmp,\pte,\pte
+-	STREG		\pte,0(\ptep)
++	STREG		\pte,0(\ptp)
+ 	.endm
+ 
+ 	/* bitshift difference between a PFN (based on kernel's PAGE_SIZE)
+@@ -1148,14 +1144,14 @@ dtlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,dtlb_check_alias_20w
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20w
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 	
+ 	idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1174,14 +1170,14 @@ nadtlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,nadtlb_check_alias_20w
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+ 	idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1202,20 +1198,20 @@ dtlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_11
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_11
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	idtlba		pte,(%sr1,va)
+ 	idtlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1235,21 +1231,20 @@ nadtlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_11
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_11
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	idtlba		pte,(%sr1,va)
+ 	idtlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1269,16 +1264,16 @@ dtlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dtlb_check_alias_20
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dtlb_check_alias_20
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0
++	f_extend	pte,t1
+ 
+ 	idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1297,16 +1292,16 @@ nadtlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,nadtlb_check_alias_20
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,nadtlb_check_alias_20
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0
++	f_extend	pte,t1
+ 	
+-        idtlbt          pte,prot
+-	dbit_unlock1	spc,t0
++	idtlbt		pte,prot
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1406,14 +1401,14 @@ itlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 	
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1430,14 +1425,14 @@ naitlb_miss_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,naitlb_check_alias_20w
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20w
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1458,20 +1453,20 @@ itlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	iitlba		pte,(%sr1,va)
+ 	iitlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1482,20 +1477,20 @@ naitlb_miss_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_11
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_11
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+-	mfsp		%sr1,t0  /* Save sr1 so we can use it in tlb inserts */
++	mfsp		%sr1,t1  /* Save sr1 so we can use it in tlb inserts */
+ 	mtsp		spc,%sr1
+ 
+ 	iitlba		pte,(%sr1,va)
+ 	iitlbp		prot,(%sr1,va)
+ 
+-	mtsp		t0, %sr1	/* Restore sr1 */
+-	dbit_unlock1	spc,t0
++	mtsp		t1, %sr1	/* Restore sr1 */
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1516,16 +1511,16 @@ itlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,itlb_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,itlb_fault
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0	
++	f_extend	pte,t1
+ 
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1536,16 +1531,16 @@ naitlb_miss_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,naitlb_check_alias_20
+ 
+-	dbit_lock	spc,t0,t1
+-	update_ptep	spc,ptp,pte,t0,t1
++	tlb_lock	spc,ptp,pte,t0,t1,naitlb_check_alias_20
++	update_accessed	ptp,pte,t0,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+-	f_extend	pte,t0
++	f_extend	pte,t1
+ 
+ 	iitlbt          pte,prot
+-	dbit_unlock1	spc,t0
+ 
++	tlb_unlock1	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1568,14 +1563,14 @@ dbit_trap_20w:
+ 
+ 	L3_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_dirty	spc,ptp,pte,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 		
+ 	idtlbt          pte,prot
+-	dbit_unlock0	spc,t0
+ 
++	tlb_unlock0	spc,t0
+ 	rfir
+ 	nop
+ #else
+@@ -1588,8 +1583,8 @@ dbit_trap_11:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_dirty	spc,ptp,pte,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb_11	spc,pte,prot
+ 
+@@ -1600,8 +1595,8 @@ dbit_trap_11:
+ 	idtlbp		prot,(%sr1,va)
+ 
+ 	mtsp            t1, %sr1     /* Restore sr1 */
+-	dbit_unlock0	spc,t0
+ 
++	tlb_unlock0	spc,t0
+ 	rfir
+ 	nop
+ 
+@@ -1612,16 +1607,16 @@ dbit_trap_20:
+ 
+ 	L2_ptep		ptp,pte,t0,va,dbit_fault
+ 
+-	dbit_lock	spc,t0,t1
+-	update_dirty	spc,ptp,pte,t1
++	tlb_lock	spc,ptp,pte,t0,t1,dbit_fault
++	update_dirty	ptp,pte,t1
+ 
+ 	make_insert_tlb	spc,pte,prot
+ 
+ 	f_extend	pte,t1
+ 	
+-        idtlbt          pte,prot
+-	dbit_unlock0	spc,t0
++	idtlbt		pte,prot
+ 
++	tlb_unlock0	spc,t0
+ 	rfir
+ 	nop
+ #endif
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 47ee620..7f67c4c 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -43,10 +43,6 @@
+ 
+ #include "../math-emu/math-emu.h"	/* for handle_fpe() */
+ 
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+-DEFINE_SPINLOCK(pa_dbit_lock);
+-#endif
+-
+ static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
+ 	struct pt_regs *regs);
+ 
+diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
+index ccde8f0..112ccf4 100644
+--- a/arch/powerpc/kernel/idle_power7.S
++++ b/arch/powerpc/kernel/idle_power7.S
+@@ -52,6 +52,22 @@
+ 	.text
+ 
+ /*
++ * Used by threads when the lock bit of core_idle_state is set.
++ * Threads will spin in HMT_LOW until the lock bit is cleared.
++ * r14 - pointer to core_idle_state
++ * r15 - used to load contents of core_idle_state
++ */
++
++core_idle_lock_held:
++	HMT_LOW
++3:	lwz	r15,0(r14)
++	andi.   r15,r15,PNV_CORE_IDLE_LOCK_BIT
++	bne	3b
++	HMT_MEDIUM
++	lwarx	r15,0,r14
++	blr
++
++/*
+  * Pass requested state in r3:
+  *	r3 - PNV_THREAD_NAP/SLEEP/WINKLE
+  *
+@@ -150,6 +166,10 @@ power7_enter_nap_mode:
+ 	ld	r14,PACA_CORE_IDLE_STATE_PTR(r13)
+ lwarx_loop1:
+ 	lwarx	r15,0,r14
++
++	andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
++	bnel	core_idle_lock_held
++
+ 	andc	r15,r15,r7			/* Clear thread bit */
+ 
+ 	andi.	r15,r15,PNV_CORE_IDLE_THREAD_BITS
+@@ -294,7 +314,7 @@ lwarx_loop2:
+ 	 * workaround undo code or resyncing timebase or restoring context
+ 	 * In either case loop until the lock bit is cleared.
+ 	 */
+-	bne	core_idle_lock_held
++	bnel	core_idle_lock_held
+ 
+ 	cmpwi	cr2,r15,0
+ 	lbz	r4,PACA_SUBCORE_SIBLING_MASK(r13)
+@@ -319,15 +339,6 @@ lwarx_loop2:
+ 	isync
+ 	b	common_exit
+ 
+-core_idle_lock_held:
+-	HMT_LOW
+-core_idle_lock_loop:
+-	lwz	r15,0(14)
+-	andi.   r9,r15,PNV_CORE_IDLE_LOCK_BIT
+-	bne	core_idle_lock_loop
+-	HMT_MEDIUM
+-	b	lwarx_loop2
+-
+ first_thread_in_subcore:
+ 	/* First thread in subcore to wakeup */
+ 	ori	r15,r15,PNV_CORE_IDLE_LOCK_BIT
+diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
+index cfad7fca..d7697ab 100644
+--- a/arch/s390/include/asm/ctl_reg.h
++++ b/arch/s390/include/asm/ctl_reg.h
+@@ -57,7 +57,10 @@ union ctlreg0 {
+ 		unsigned long lap  : 1; /* Low-address-protection control */
+ 		unsigned long	   : 4;
+ 		unsigned long edat : 1; /* Enhanced-DAT-enablement control */
+-		unsigned long	   : 23;
++		unsigned long	   : 4;
++		unsigned long afp  : 1; /* AFP-register control */
++		unsigned long vx   : 1; /* Vector enablement control */
++		unsigned long	   : 17;
+ 	};
+ };
+ 
+diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
+index bff5e3b..8ba3243 100644
+--- a/arch/s390/kernel/cache.c
++++ b/arch/s390/kernel/cache.c
+@@ -138,6 +138,8 @@ int init_cache_level(unsigned int cpu)
+ 	union cache_topology ct;
+ 	enum cache_type ctype;
+ 
++	if (!test_facility(34))
++		return -EOPNOTSUPP;
+ 	if (!this_cpu_ci)
+ 		return -EINVAL;
+ 	ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);
+diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
+index 505c17c..56b5508 100644
+--- a/arch/s390/kernel/nmi.c
++++ b/arch/s390/kernel/nmi.c
+@@ -21,6 +21,7 @@
+ #include <asm/nmi.h>
+ #include <asm/crw.h>
+ #include <asm/switch_to.h>
++#include <asm/ctl_reg.h>
+ 
+ struct mcck_struct {
+ 	int kill_task;
+@@ -129,26 +130,30 @@ static int notrace s390_revalidate_registers(struct mci *mci)
+ 	} else
+ 		asm volatile("lfpc 0(%0)" : : "a" (fpt_creg_save_area));
+ 
+-	asm volatile(
+-		"	ld	0,0(%0)\n"
+-		"	ld	1,8(%0)\n"
+-		"	ld	2,16(%0)\n"
+-		"	ld	3,24(%0)\n"
+-		"	ld	4,32(%0)\n"
+-		"	ld	5,40(%0)\n"
+-		"	ld	6,48(%0)\n"
+-		"	ld	7,56(%0)\n"
+-		"	ld	8,64(%0)\n"
+-		"	ld	9,72(%0)\n"
+-		"	ld	10,80(%0)\n"
+-		"	ld	11,88(%0)\n"
+-		"	ld	12,96(%0)\n"
+-		"	ld	13,104(%0)\n"
+-		"	ld	14,112(%0)\n"
+-		"	ld	15,120(%0)\n"
+-		: : "a" (fpt_save_area));
+-	/* Revalidate vector registers */
+-	if (MACHINE_HAS_VX && current->thread.vxrs) {
++	if (!MACHINE_HAS_VX) {
++		/* Revalidate floating point registers */
++		asm volatile(
++			"	ld	0,0(%0)\n"
++			"	ld	1,8(%0)\n"
++			"	ld	2,16(%0)\n"
++			"	ld	3,24(%0)\n"
++			"	ld	4,32(%0)\n"
++			"	ld	5,40(%0)\n"
++			"	ld	6,48(%0)\n"
++			"	ld	7,56(%0)\n"
++			"	ld	8,64(%0)\n"
++			"	ld	9,72(%0)\n"
++			"	ld	10,80(%0)\n"
++			"	ld	11,88(%0)\n"
++			"	ld	12,96(%0)\n"
++			"	ld	13,104(%0)\n"
++			"	ld	14,112(%0)\n"
++			"	ld	15,120(%0)\n"
++			: : "a" (fpt_save_area));
++	} else {
++		/* Revalidate vector registers */
++		union ctlreg0 cr0;
++
+ 		if (!mci->vr) {
+ 			/*
+ 			 * Vector registers can't be restored and therefore
+@@ -156,8 +161,12 @@ static int notrace s390_revalidate_registers(struct mci *mci)
+ 			 */
+ 			kill_task = 1;
+ 		}
++		cr0.val = S390_lowcore.cregs_save_area[0];
++		cr0.afp = cr0.vx = 1;
++		__ctl_load(cr0.val, 0, 0);
+ 		restore_vx_regs((__vector128 *)
+-				S390_lowcore.vector_save_area_addr);
++				&S390_lowcore.vector_save_area);
++		__ctl_load(S390_lowcore.cregs_save_area[0], 0, 0);
+ 	}
+ 	/* Revalidate access registers */
+ 	asm volatile(
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index dc5edc2..8f587d8 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -163,7 +163,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
+ asmlinkage void execve_tail(void)
+ {
+ 	current->thread.fp_regs.fpc = 0;
+-	asm volatile("sfpc %0,%0" : : "d" (0));
++	asm volatile("sfpc %0" : : "d" (0));
+ }
+ 
+ /*
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 43c3169..ada0c07 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
+ 	jno	.Lesa2
+ 	ahi	%r15,-80
+ 	stmh	%r6,%r15,96(%r15)		# store upper register halves
++	basr	%r13,0
++	lmh	%r0,%r15,.Lzeroes-.(%r13)	# clear upper register halves
+ .Lesa2:
+ 	lr	%r10,%r2			# save string pointer
+ 	lhi	%r2,0
+@@ -291,6 +293,8 @@ ENTRY(_sclp_print_early)
+ .Lesa3:
+ 	lm	%r6,%r15,120(%r15)		# restore registers
+ 	br	%r14
++.Lzeroes:
++	.fill	64,4,0
+ 
+ .LwritedataS4:
+ 	.long	0x00760005			# SCLP command for write data
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 9afb9d6..dc2d7aa 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -415,13 +415,13 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
+ 		EMIT6_DISP_LH(0xe3000000, 0x0004, REG_SKB_DATA, REG_0,
+ 			      BPF_REG_1, offsetof(struct sk_buff, data));
+ 	}
+-	/* BPF compatibility: clear A (%b7) and X (%b8) registers */
+-	if (REG_SEEN(BPF_REG_7))
+-		/* lghi %b7,0 */
+-		EMIT4_IMM(0xa7090000, BPF_REG_7, 0);
+-	if (REG_SEEN(BPF_REG_8))
+-		/* lghi %b8,0 */
+-		EMIT4_IMM(0xa7090000, BPF_REG_8, 0);
++	/* BPF compatibility: clear A (%b0) and X (%b7) registers */
++	if (REG_SEEN(BPF_REG_A))
++		/* lghi %ba,0 */
++		EMIT4_IMM(0xa7090000, BPF_REG_A, 0);
++	if (REG_SEEN(BPF_REG_X))
++		/* lghi %bx,0 */
++		EMIT4_IMM(0xa7090000, BPF_REG_X, 0);
+ }
+ 
+ /*
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index d366675..396b5c9 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void)
+ 
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+-	free_bootmem(__pa(begin), end - begin);
++	free_bootmem_late(__pa(begin), end - begin);
+ }
+ 
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 48304b8..0cdc154 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ 		unsigned int e820_type = 0;
+ 		unsigned long m = efi->efi_memmap;
+ 
++#ifdef CONFIG_X86_64
++		m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ 		switch (d->type) {
+ 		case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
+index 8b22422..74a2a8d 100644
+--- a/arch/x86/include/asm/kasan.h
++++ b/arch/x86/include/asm/kasan.h
+@@ -14,15 +14,11 @@
+ 
+ #ifndef __ASSEMBLY__
+ 
+-extern pte_t kasan_zero_pte[];
+-extern pte_t kasan_zero_pmd[];
+-extern pte_t kasan_zero_pud[];
+-
+ #ifdef CONFIG_KASAN
+-void __init kasan_map_early_shadow(pgd_t *pgd);
++void __init kasan_early_init(void);
+ void __init kasan_init(void);
+ #else
+-static inline void kasan_map_early_shadow(pgd_t *pgd) { }
++static inline void kasan_early_init(void) { }
+ static inline void kasan_init(void) { }
+ #endif
+ 
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 883f6b9..e997f70 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -23,7 +23,7 @@ extern struct static_key rdpmc_always_available;
+ 
+ static inline void load_mm_cr4(struct mm_struct *mm)
+ {
+-	if (static_key_true(&rdpmc_always_available) ||
++	if (static_key_false(&rdpmc_always_available) ||
+ 	    atomic_read(&mm->context.perf_rdpmc_allowed))
+ 		cr4_set_bits(X86_CR4_PCE);
+ 	else
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+index e4d1b8b..cb77b11 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+@@ -934,6 +934,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
+ 		return 0;
+ 
+ 	/*
++	 * Getting up-to-date values requires an SMP IPI which is not
++	 * possible if we're being called in interrupt context. Return
++	 * the cached values instead.
++	 */
++	if (unlikely(in_interrupt()))
++		goto out;
++
++	/*
+ 	 * Notice that we don't perform the reading of an RMID
+ 	 * atomically, because we can't hold a spin lock across the
+ 	 * IPIs.
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 5a46681..f129a9a 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -161,11 +161,12 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ 	/* Kill off the identity-map trampoline */
+ 	reset_early_page_tables();
+ 
+-	kasan_map_early_shadow(early_level4_pgt);
+-
+-	/* clear bss before set_intr_gate with early_idt_handler */
+ 	clear_bss();
+ 
++	clear_page(init_level4_pgt);
++
++	kasan_early_init();
++
+ 	for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
+ 		set_intr_gate(i, early_idt_handler_array[i]);
+ 	load_idt((const struct desc_ptr *)&idt_descr);
+@@ -177,12 +178,9 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ 	 */
+ 	load_ucode_bsp();
+ 
+-	clear_page(init_level4_pgt);
+ 	/* set init_level4_pgt kernel high mapping*/
+ 	init_level4_pgt[511] = early_level4_pgt[511];
+ 
+-	kasan_map_early_shadow(init_level4_pgt);
+-
+ 	x86_64_start_reservations(real_mode_data);
+ }
+ 
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index df7e780..7e5da2c 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -516,38 +516,9 @@ ENTRY(phys_base)
+ 	/* This must match the first entry in level2_kernel_pgt */
+ 	.quad   0x0000000000000000
+ 
+-#ifdef CONFIG_KASAN
+-#define FILL(VAL, COUNT)				\
+-	.rept (COUNT) ;					\
+-	.quad	(VAL) ;					\
+-	.endr
+-
+-NEXT_PAGE(kasan_zero_pte)
+-	FILL(kasan_zero_page - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-NEXT_PAGE(kasan_zero_pmd)
+-	FILL(kasan_zero_pte - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-NEXT_PAGE(kasan_zero_pud)
+-	FILL(kasan_zero_pmd - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-
+-#undef FILL
+-#endif
+-
+-
+ #include "../../x86/xen/xen-head.S"
+ 	
+ 	__PAGE_ALIGNED_BSS
+ NEXT_PAGE(empty_zero_page)
+ 	.skip PAGE_SIZE
+ 
+-#ifdef CONFIG_KASAN
+-/*
+- * This page used as early shadow. We don't use empty_zero_page
+- * at early stages, stack instrumentation could write some garbage
+- * to this page.
+- * Latter we reuse it as zero shadow for large ranges of memory
+- * that allowed to access, but not instrumented by kasan
+- * (vmalloc/vmemmap ...).
+- */
+-NEXT_PAGE(kasan_zero_page)
+-	.skip PAGE_SIZE
+-#endif
+diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
+index 4860906..9a54dbe 100644
+--- a/arch/x86/mm/kasan_init_64.c
++++ b/arch/x86/mm/kasan_init_64.c
+@@ -11,7 +11,19 @@
+ extern pgd_t early_level4_pgt[PTRS_PER_PGD];
+ extern struct range pfn_mapped[E820_X_MAX];
+ 
+-extern unsigned char kasan_zero_page[PAGE_SIZE];
++static pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
++static pmd_t kasan_zero_pmd[PTRS_PER_PMD] __page_aligned_bss;
++static pte_t kasan_zero_pte[PTRS_PER_PTE] __page_aligned_bss;
++
++/*
++ * This page used as early shadow. We don't use empty_zero_page
++ * at early stages, stack instrumentation could write some garbage
++ * to this page.
++ * Latter we reuse it as zero shadow for large ranges of memory
++ * that allowed to access, but not instrumented by kasan
++ * (vmalloc/vmemmap ...).
++ */
++static unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
+ 
+ static int __init map_range(struct range *range)
+ {
+@@ -36,7 +48,7 @@ static void __init clear_pgds(unsigned long start,
+ 		pgd_clear(pgd_offset_k(start));
+ }
+ 
+-void __init kasan_map_early_shadow(pgd_t *pgd)
++static void __init kasan_map_early_shadow(pgd_t *pgd)
+ {
+ 	int i;
+ 	unsigned long start = KASAN_SHADOW_START;
+@@ -73,7 +85,7 @@ static int __init zero_pmd_populate(pud_t *pud, unsigned long addr,
+ 	while (IS_ALIGNED(addr, PMD_SIZE) && addr + PMD_SIZE <= end) {
+ 		WARN_ON(!pmd_none(*pmd));
+ 		set_pmd(pmd, __pmd(__pa_nodebug(kasan_zero_pte)
+-					| __PAGE_KERNEL_RO));
++					| _KERNPG_TABLE));
+ 		addr += PMD_SIZE;
+ 		pmd = pmd_offset(pud, addr);
+ 	}
+@@ -99,7 +111,7 @@ static int __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
+ 	while (IS_ALIGNED(addr, PUD_SIZE) && addr + PUD_SIZE <= end) {
+ 		WARN_ON(!pud_none(*pud));
+ 		set_pud(pud, __pud(__pa_nodebug(kasan_zero_pmd)
+-					| __PAGE_KERNEL_RO));
++					| _KERNPG_TABLE));
+ 		addr += PUD_SIZE;
+ 		pud = pud_offset(pgd, addr);
+ 	}
+@@ -124,7 +136,7 @@ static int __init zero_pgd_populate(unsigned long addr, unsigned long end)
+ 	while (IS_ALIGNED(addr, PGDIR_SIZE) && addr + PGDIR_SIZE <= end) {
+ 		WARN_ON(!pgd_none(*pgd));
+ 		set_pgd(pgd, __pgd(__pa_nodebug(kasan_zero_pud)
+-					| __PAGE_KERNEL_RO));
++					| _KERNPG_TABLE));
+ 		addr += PGDIR_SIZE;
+ 		pgd = pgd_offset_k(addr);
+ 	}
+@@ -166,6 +178,26 @@ static struct notifier_block kasan_die_notifier = {
+ };
+ #endif
+ 
++void __init kasan_early_init(void)
++{
++	int i;
++	pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL;
++	pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
++	pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
++
++	for (i = 0; i < PTRS_PER_PTE; i++)
++		kasan_zero_pte[i] = __pte(pte_val);
++
++	for (i = 0; i < PTRS_PER_PMD; i++)
++		kasan_zero_pmd[i] = __pmd(pmd_val);
++
++	for (i = 0; i < PTRS_PER_PUD; i++)
++		kasan_zero_pud[i] = __pud(pud_val);
++
++	kasan_map_early_shadow(early_level4_pgt);
++	kasan_map_early_shadow(init_level4_pgt);
++}
++
+ void __init kasan_init(void)
+ {
+ 	int i;
+@@ -176,6 +208,7 @@ void __init kasan_init(void)
+ 
+ 	memcpy(early_level4_pgt, init_level4_pgt, sizeof(early_level4_pgt));
+ 	load_cr3(early_level4_pgt);
++	__flush_tlb_all();
+ 
+ 	clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
+ 
+@@ -202,5 +235,6 @@ void __init kasan_init(void)
+ 	memset(kasan_zero_page, 0, PAGE_SIZE);
+ 
+ 	load_cr3(init_level4_pgt);
++	__flush_tlb_all();
+ 	init_task.kasan_depth = 0;
+ }
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 3250f23..90b924a 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info)
+ 		} else {
+ 			unsigned long addr;
+ 			unsigned long nr_pages =
+-				f->flush_end - f->flush_start / PAGE_SIZE;
++				(f->flush_end - f->flush_start) / PAGE_SIZE;
+ 			addr = f->flush_start;
+ 			while (addr < f->flush_end) {
+ 				__flush_tlb_single(addr);
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 02744df..841ea05 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phys_addr)
+ 
+ static int __init arch_parse_efi_cmdline(char *str)
+ {
++	if (!str) {
++		pr_warn("need at least one option\n");
++		return -EINVAL;
++	}
++
+ 	if (parse_option_str(str, "old_map"))
+ 		set_bit(EFI_OLD_MEMMAP, &efi.flags);
+ 	if (parse_option_str(str, "debug"))
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 5cbd5d9..39ce74d 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -51,7 +51,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
+ 	unsigned long idx = BIO_POOL_NONE;
+ 	unsigned inline_vecs;
+ 
+-	if (!bs) {
++	if (!bs || !bs->bio_integrity_pool) {
+ 		bip = kmalloc(sizeof(struct bio_integrity_payload) +
+ 			      sizeof(struct bio_vec) * nr_vecs, gfp_mask);
+ 		inline_vecs = nr_vecs;
+@@ -104,7 +104,7 @@ void bio_integrity_free(struct bio *bio)
+ 		kfree(page_address(bip->bip_vec->bv_page) +
+ 		      bip->bip_vec->bv_offset);
+ 
+-	if (bs) {
++	if (bs && bs->bio_integrity_pool) {
+ 		if (bip->bip_slab != BIO_POOL_NONE)
+ 			bvec_free(bs->bvec_integrity_pool, bip->bip_vec,
+ 				  bip->bip_slab);
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 0ac817b..6817e28 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 		return -EINVAL;
+ 
+ 	disk = get_gendisk(MKDEV(major, minor), &part);
+-	if (!disk || part)
++	if (!disk)
+ 		return -EINVAL;
++	if (part) {
++		put_disk(disk);
++		return -EINVAL;
++	}
+ 
+ 	rcu_read_lock();
+ 	spin_lock_irq(disk->queue->queue_lock);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 594eea0..2dc1fd6 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1968,7 +1968,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
+ 		goto err_hctxs;
+ 
+ 	setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
+-	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
++	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
+ 
+ 	q->nr_queues = nr_cpu_ids;
+ 	q->nr_hw_queues = set->nr_hw_queues;
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084..85aa761 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ 				       ATA_LFLAG_NO_SRST |
+ 				       ATA_LFLAG_ASSUME_ATA;
+ 		}
++	} else if (vendor == 0x11ab && devid == 0x4140) {
++		/* Marvell 4140 quirks */
++		ata_for_each_link(link, ap, EDGE) {
++			/* port 4 is for SEMB device and it doesn't like SRST */
++			if (link->pmp == 4)
++				link->flags |= ATA_LFLAG_DISABLED;
++		}
+ 	}
+ }
+ 
+diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c
+index bf12a25..0f8db28 100644
+--- a/drivers/clk/st/clk-flexgen.c
++++ b/drivers/clk/st/clk-flexgen.c
+@@ -303,6 +303,8 @@ void __init st_of_flexgen_setup(struct device_node *np)
+ 	if (!rlock)
+ 		goto err;
+ 
++	spin_lock_init(rlock);
++
+ 	for (i = 0; i < clk_data->clk_num; i++) {
+ 		struct clk *clk;
+ 		const char *clk_name;
+diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
+index a917c4c..6ae068a 100644
+--- a/drivers/clk/st/clkgen-fsyn.c
++++ b/drivers/clk/st/clkgen-fsyn.c
+@@ -340,7 +340,7 @@ static const struct clkgen_quadfs_data st_fs660c32_C_407 = {
+ 		    CLKGEN_FIELD(0x30c, 0xf, 20),
+ 		    CLKGEN_FIELD(0x310, 0xf, 20) },
+ 	.lockstatus_present = true,
+-	.lock_status = CLKGEN_FIELD(0x2A0, 0x1, 24),
++	.lock_status = CLKGEN_FIELD(0x2f0, 0x1, 24),
+ 	.powerup_polarity = 1,
+ 	.standby_polarity = 1,
+ 	.pll_ops	= &st_quadfs_pll_c32_ops,
+diff --git a/drivers/clk/st/clkgen-mux.c b/drivers/clk/st/clkgen-mux.c
+index fdcff10..ef65146 100644
+--- a/drivers/clk/st/clkgen-mux.c
++++ b/drivers/clk/st/clkgen-mux.c
+@@ -582,7 +582,7 @@ static struct clkgen_mux_data stih416_a9_mux_data = {
+ };
+ static struct clkgen_mux_data stih407_a9_mux_data = {
+ 	.offset = 0x1a4,
+-	.shift = 1,
++	.shift = 0,
+ 	.width = 2,
+ };
+ 
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index c45d274..6f9d27f 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -678,6 +678,7 @@ static struct cpu_defaults knl_params = {
+ 		.get_max = core_get_max_pstate,
+ 		.get_min = core_get_min_pstate,
+ 		.get_turbo = knl_get_turbo_pstate,
++		.get_scaling = core_get_scaling,
+ 		.set = core_set_pstate,
+ 	},
+ };
+diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
+index 4630709..0a70e46 100644
+--- a/drivers/crypto/omap-des.c
++++ b/drivers/crypto/omap-des.c
+@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
+ 	dmaengine_terminate_all(dd->dma_lch_in);
+ 	dmaengine_terminate_all(dd->dma_lch_out);
+ 
+-	dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
+-	dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
+-
+ 	return err;
+ }
+ 
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 4fd9961..d425374 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
+ 	return ret;
+ }
+ 
+-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem)
++static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
++	int len)
+ {
+ 	struct cper_mem_err_compact cmem;
+ 
++	/* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
++	if (len == sizeof(struct cper_sec_mem_err_old) &&
++	    (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) {
++		pr_err(FW_WARN "valid bits set for fields beyond structure\n");
++		return;
++	}
+ 	if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS)
+ 		printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status);
+ 	if (mem->validation_bits & CPER_MEM_VALID_PA)
+@@ -405,8 +412,10 @@ static void cper_estatus_print_section(
+ 	} else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) {
+ 		struct cper_sec_mem_err *mem_err = (void *)(gdata + 1);
+ 		printk("%s""section_type: memory error\n", newpfx);
+-		if (gdata->error_data_length >= sizeof(*mem_err))
+-			cper_print_mem(newpfx, mem_err);
++		if (gdata->error_data_length >=
++		    sizeof(struct cper_sec_mem_err_old))
++			cper_print_mem(newpfx, mem_err,
++				       gdata->error_data_length);
+ 		else
+ 			goto err_section_too_small;
+ 	} else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) {
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index e14363d..63226e9 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void)
+ 
+ static int __init parse_efi_cmdline(char *str)
+ {
++	if (!str) {
++		pr_warn("need at least one option\n");
++		return -EINVAL;
++	}
++
+ 	if (parse_option_str(str, "noruntime"))
+ 		disable_runtime = true;
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 8904933..cd6dae0 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -863,8 +863,10 @@ nouveau_drm_preclose(struct drm_device *dev, struct drm_file *fpriv)
+ 
+ 	pm_runtime_get_sync(dev->dev);
+ 
++	mutex_lock(&cli->mutex);
+ 	if (cli->abi16)
+ 		nouveau_abi16_fini(cli->abi16);
++	mutex_unlock(&cli->mutex);
+ 
+ 	mutex_lock(&drm->client.mutex);
+ 	list_del(&cli->head);
+diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+index 4ef602c..495c576 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+@@ -203,7 +203,7 @@ nv04_fbcon_accel_init(struct fb_info *info)
+ 	if (ret)
+ 		return ret;
+ 
+-	if (RING_SPACE(chan, 49)) {
++	if (RING_SPACE(chan, 49 + (device->info.chipset >= 0x11 ? 4 : 0))) {
+ 		nouveau_fbcon_gpu_lockup(info);
+ 		return 0;
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
+index 7da7958..981342d 100644
+--- a/drivers/gpu/drm/nouveau/nv50_display.c
++++ b/drivers/gpu/drm/nouveau/nv50_display.c
+@@ -979,7 +979,7 @@ nv50_crtc_cursor_show_hide(struct nouveau_crtc *nv_crtc, bool show, bool update)
+ {
+ 	struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
+ 
+-	if (show && nv_crtc->cursor.nvbo)
++	if (show && nv_crtc->cursor.nvbo && nv_crtc->base.enabled)
+ 		nv50_crtc_cursor_show(nv_crtc);
+ 	else
+ 		nv50_crtc_cursor_hide(nv_crtc);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+index 80614f1..282143f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+@@ -50,7 +50,12 @@ nv04_instobj_dtor(struct nvkm_object *object)
+ {
+ 	struct nv04_instmem_priv *priv = (void *)nvkm_instmem(object);
+ 	struct nv04_instobj_priv *node = (void *)object;
++	struct nvkm_subdev *subdev = (void *)priv;
++
++	mutex_lock(&subdev->mutex);
+ 	nvkm_mm_free(&priv->heap, &node->mem);
++	mutex_unlock(&subdev->mutex);
++
+ 	nvkm_instobj_destroy(&node->base);
+ }
+ 
+@@ -62,6 +67,7 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
+ 	struct nv04_instmem_priv *priv = (void *)nvkm_instmem(parent);
+ 	struct nv04_instobj_priv *node;
+ 	struct nvkm_instobj_args *args = data;
++	struct nvkm_subdev *subdev = (void *)priv;
+ 	int ret;
+ 
+ 	if (!args->align)
+@@ -72,8 +78,10 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_lock(&subdev->mutex);
+ 	ret = nvkm_mm_head(&priv->heap, 0, 1, args->size, args->size,
+ 			   args->align, &node->mem);
++	mutex_unlock(&subdev->mutex);
+ 	if (ret)
+ 		return ret;
+ 
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 3318de6..a2dbbbe 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -356,6 +356,8 @@ static int cp2112_read(struct cp2112_device *dev, u8 *data, size_t size)
+ 	struct cp2112_force_read_report report;
+ 	int ret;
+ 
++	if (size > sizeof(dev->read_data))
++		size = sizeof(dev->read_data);
+ 	report.report = CP2112_DATA_READ_FORCE_SEND;
+ 	report.length = cpu_to_be16(size);
+ 
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index 28fcb2e..fbfc02b 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -195,7 +195,7 @@ abort:
+ }
+ 
+ static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
+-				 unsigned int voltage)
++				 unsigned long voltage)
+ {
+ 	int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
+ 	int err;
+diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
+index b77b82f..6153df73 100644
+--- a/drivers/hwmon/nct7904.c
++++ b/drivers/hwmon/nct7904.c
+@@ -412,8 +412,9 @@ static ssize_t show_pwm(struct device *dev,
+ 	return sprintf(buf, "%d\n", val);
+ }
+ 
+-static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+-			  const char *buf, size_t count)
++static ssize_t store_enable(struct device *dev,
++			    struct device_attribute *devattr,
++			    const char *buf, size_t count)
+ {
+ 	int index = to_sensor_dev_attr(devattr)->index;
+ 	struct nct7904_data *data = dev_get_drvdata(dev);
+@@ -422,18 +423,18 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+ 
+ 	if (kstrtoul(buf, 10, &val) < 0)
+ 		return -EINVAL;
+-	if (val > 1 || (val && !data->fan_mode[index]))
++	if (val < 1 || val > 2 || (val == 2 && !data->fan_mode[index]))
+ 		return -EINVAL;
+ 
+ 	ret = nct7904_write_reg(data, BANK_3, FANCTL1_FMR_REG + index,
+-				val ? data->fan_mode[index] : 0);
++				val == 2 ? data->fan_mode[index] : 0);
+ 
+ 	return ret ? ret : count;
+ }
+ 
+-/* Return 0 for manual mode or 1 for SmartFan mode */
+-static ssize_t show_mode(struct device *dev,
+-			 struct device_attribute *devattr, char *buf)
++/* Return 1 for manual mode or 2 for SmartFan mode */
++static ssize_t show_enable(struct device *dev,
++			   struct device_attribute *devattr, char *buf)
+ {
+ 	int index = to_sensor_dev_attr(devattr)->index;
+ 	struct nct7904_data *data = dev_get_drvdata(dev);
+@@ -443,36 +444,36 @@ static ssize_t show_mode(struct device *dev,
+ 	if (val < 0)
+ 		return val;
+ 
+-	return sprintf(buf, "%d\n", val ? 1 : 0);
++	return sprintf(buf, "%d\n", val ? 2 : 1);
+ }
+ 
+ /* 2 attributes per channel: pwm and mode */
+-static SENSOR_DEVICE_ATTR(fan1_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm1, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 0);
+-static SENSOR_DEVICE_ATTR(fan1_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 0);
+-static SENSOR_DEVICE_ATTR(fan2_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm1_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 0);
++static SENSOR_DEVICE_ATTR(pwm2, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 1);
+-static SENSOR_DEVICE_ATTR(fan2_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 1);
+-static SENSOR_DEVICE_ATTR(fan3_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm2_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 1);
++static SENSOR_DEVICE_ATTR(pwm3, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 2);
+-static SENSOR_DEVICE_ATTR(fan3_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 2);
+-static SENSOR_DEVICE_ATTR(fan4_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm3_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 2);
++static SENSOR_DEVICE_ATTR(pwm4, S_IRUGO | S_IWUSR,
+ 			show_pwm, store_pwm, 3);
+-static SENSOR_DEVICE_ATTR(fan4_mode, S_IRUGO | S_IWUSR,
+-			show_mode, store_mode, 3);
++static SENSOR_DEVICE_ATTR(pwm4_enable, S_IRUGO | S_IWUSR,
++			show_enable, store_enable, 3);
+ 
+ static struct attribute *nct7904_fanctl_attrs[] = {
+-	&sensor_dev_attr_fan1_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan1_mode.dev_attr.attr,
+-	&sensor_dev_attr_fan2_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan2_mode.dev_attr.attr,
+-	&sensor_dev_attr_fan3_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan3_mode.dev_attr.attr,
+-	&sensor_dev_attr_fan4_pwm.dev_attr.attr,
+-	&sensor_dev_attr_fan4_mode.dev_attr.attr,
++	&sensor_dev_attr_pwm1.dev_attr.attr,
++	&sensor_dev_attr_pwm1_enable.dev_attr.attr,
++	&sensor_dev_attr_pwm2.dev_attr.attr,
++	&sensor_dev_attr_pwm2_enable.dev_attr.attr,
++	&sensor_dev_attr_pwm3.dev_attr.attr,
++	&sensor_dev_attr_pwm3_enable.dev_attr.attr,
++	&sensor_dev_attr_pwm4.dev_attr.attr,
++	&sensor_dev_attr_pwm4_enable.dev_attr.attr,
+ 	NULL
+ };
+ 
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+index e5cc430..2d13fd0 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+@@ -176,7 +176,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
+ 		else
+ 			size += ipoib_recvq_size * ipoib_max_conn_qp;
+ 	} else
+-		goto out_free_wq;
++		if (ret != -ENOSYS)
++			goto out_free_wq;
+ 
+ 	priv->recv_cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev, size, 0);
+ 	if (IS_ERR(priv->recv_cq)) {
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 35c8d0c..3a32caf 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1199,7 +1199,7 @@ static void set_input_params(struct psmouse *psmouse,
+ 					ABS_MT_POSITION_Y);
+ 		/* Image sensors can report per-contact pressure */
+ 		input_set_abs_params(dev, ABS_MT_PRESSURE, 0, 255, 0, 0);
+-		input_mt_init_slots(dev, 3, INPUT_MT_POINTER | INPUT_MT_TRACK);
++		input_mt_init_slots(dev, 2, INPUT_MT_POINTER | INPUT_MT_TRACK);
+ 
+ 		/* Image sensors can signal 4 and 5 finger clicks */
+ 		__set_bit(BTN_TOOL_QUADTAP, dev->keybit);
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index f2c6c35..2c41107 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ 		goto err_out;
+ 	}
+ 
++	/* TSC-25 data sheet specifies a delay after the RESET command */
++	msleep(150);
++
+ 	/* set coordinate output rate */
+ 	buf[0] = buf[1] = 0xFF;
+ 	ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 5ecfaf2..c87c4b1 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1756,8 +1756,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
+ 
+ static void domain_exit(struct dmar_domain *domain)
+ {
++	struct dmar_drhd_unit *drhd;
++	struct intel_iommu *iommu;
+ 	struct page *freelist = NULL;
+-	int i;
+ 
+ 	/* Domain 0 is reserved, so dont process it */
+ 	if (!domain)
+@@ -1777,8 +1778,10 @@ static void domain_exit(struct dmar_domain *domain)
+ 
+ 	/* clear attached or cached domains */
+ 	rcu_read_lock();
+-	for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+-		iommu_detach_domain(domain, g_iommus[i]);
++	for_each_active_iommu(iommu, drhd)
++		if (domain_type_is_vm(domain) ||
++		    test_bit(iommu->seq_id, domain->iommu_bmp))
++			iommu_detach_domain(domain, iommu);
+ 	rcu_read_unlock();
+ 
+ 	dma_free_pagelist(freelist);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 1b7e155..c00e2db 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -75,6 +75,13 @@ struct its_node {
+ 
+ #define ITS_ITT_ALIGN		SZ_256
+ 
++struct event_lpi_map {
++	unsigned long		*lpi_map;
++	u16			*col_map;
++	irq_hw_number_t		lpi_base;
++	int			nr_lpis;
++};
++
+ /*
+  * The ITS view of a device - belongs to an ITS, a collection, owns an
+  * interrupt translation table, and a list of interrupts.
+@@ -82,11 +89,8 @@ struct its_node {
+ struct its_device {
+ 	struct list_head	entry;
+ 	struct its_node		*its;
+-	struct its_collection	*collection;
++	struct event_lpi_map	event_map;
+ 	void			*itt;
+-	unsigned long		*lpi_map;
+-	irq_hw_number_t		lpi_base;
+-	int			nr_lpis;
+ 	u32			nr_ites;
+ 	u32			device_id;
+ };
+@@ -99,6 +103,14 @@ static struct rdists *gic_rdists;
+ #define gic_data_rdist()		(raw_cpu_ptr(gic_rdists->rdist))
+ #define gic_data_rdist_rd_base()	(gic_data_rdist()->rd_base)
+ 
++static struct its_collection *dev_event_to_col(struct its_device *its_dev,
++					       u32 event)
++{
++	struct its_node *its = its_dev->its;
++
++	return its->collections + its_dev->event_map.col_map[event];
++}
++
+ /*
+  * ITS command descriptors - parameters to be encoded in a command
+  * block.
+@@ -134,7 +146,7 @@ struct its_cmd_desc {
+ 		struct {
+ 			struct its_device *dev;
+ 			struct its_collection *col;
+-			u32 id;
++			u32 event_id;
+ 		} its_movi_cmd;
+ 
+ 		struct {
+@@ -241,7 +253,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_cmd_block *cmd,
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_mapd_cmd.dev->collection;
++	return NULL;
+ }
+ 
+ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
+@@ -260,52 +272,72 @@ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
+ static struct its_collection *its_build_mapvi_cmd(struct its_cmd_block *cmd,
+ 						  struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_mapvi_cmd.dev,
++			       desc->its_mapvi_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_MAPVI);
+ 	its_encode_devid(cmd, desc->its_mapvi_cmd.dev->device_id);
+ 	its_encode_event_id(cmd, desc->its_mapvi_cmd.event_id);
+ 	its_encode_phys_id(cmd, desc->its_mapvi_cmd.phys_id);
+-	its_encode_collection(cmd, desc->its_mapvi_cmd.dev->collection->col_id);
++	its_encode_collection(cmd, col->col_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_mapvi_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_movi_cmd(struct its_cmd_block *cmd,
+ 						 struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_movi_cmd.dev,
++			       desc->its_movi_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_MOVI);
+ 	its_encode_devid(cmd, desc->its_movi_cmd.dev->device_id);
+-	its_encode_event_id(cmd, desc->its_movi_cmd.id);
++	its_encode_event_id(cmd, desc->its_movi_cmd.event_id);
+ 	its_encode_collection(cmd, desc->its_movi_cmd.col->col_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_movi_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_discard_cmd(struct its_cmd_block *cmd,
+ 						    struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_discard_cmd.dev,
++			       desc->its_discard_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_DISCARD);
+ 	its_encode_devid(cmd, desc->its_discard_cmd.dev->device_id);
+ 	its_encode_event_id(cmd, desc->its_discard_cmd.event_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_discard_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_inv_cmd(struct its_cmd_block *cmd,
+ 						struct its_cmd_desc *desc)
+ {
++	struct its_collection *col;
++
++	col = dev_event_to_col(desc->its_inv_cmd.dev,
++			       desc->its_inv_cmd.event_id);
++
+ 	its_encode_cmd(cmd, GITS_CMD_INV);
+ 	its_encode_devid(cmd, desc->its_inv_cmd.dev->device_id);
+ 	its_encode_event_id(cmd, desc->its_inv_cmd.event_id);
+ 
+ 	its_fixup_cmd(cmd);
+ 
+-	return desc->its_inv_cmd.dev->collection;
++	return col;
+ }
+ 
+ static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd,
+@@ -497,7 +529,7 @@ static void its_send_movi(struct its_device *dev,
+ 
+ 	desc.its_movi_cmd.dev = dev;
+ 	desc.its_movi_cmd.col = col;
+-	desc.its_movi_cmd.id = id;
++	desc.its_movi_cmd.event_id = id;
+ 
+ 	its_send_single_command(dev->its, its_build_movi_cmd, &desc);
+ }
+@@ -528,7 +560,7 @@ static void its_send_invall(struct its_node *its, struct its_collection *col)
+ static inline u32 its_get_event_id(struct irq_data *d)
+ {
+ 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+-	return d->hwirq - its_dev->lpi_base;
++	return d->hwirq - its_dev->event_map.lpi_base;
+ }
+ 
+ static void lpi_set_config(struct irq_data *d, bool enable)
+@@ -583,7 +615,7 @@ static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+ 
+ 	target_col = &its_dev->its->collections[cpu];
+ 	its_send_movi(its_dev, target_col, id);
+-	its_dev->collection = target_col;
++	its_dev->event_map.col_map[id] = cpu;
+ 
+ 	return IRQ_SET_MASK_OK_DONE;
+ }
+@@ -713,8 +745,10 @@ out:
+ 	return bitmap;
+ }
+ 
+-static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
++static void its_lpi_free(struct event_lpi_map *map)
+ {
++	int base = map->lpi_base;
++	int nr_ids = map->nr_lpis;
+ 	int lpi;
+ 
+ 	spin_lock(&lpi_lock);
+@@ -731,7 +765,8 @@ static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
+ 
+ 	spin_unlock(&lpi_lock);
+ 
+-	kfree(bitmap);
++	kfree(map->lpi_map);
++	kfree(map->col_map);
+ }
+ 
+ /*
+@@ -1099,11 +1134,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ 	struct its_device *dev;
+ 	unsigned long *lpi_map;
+ 	unsigned long flags;
++	u16 *col_map = NULL;
+ 	void *itt;
+ 	int lpi_base;
+ 	int nr_lpis;
+ 	int nr_ites;
+-	int cpu;
+ 	int sz;
+ 
+ 	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+@@ -1117,20 +1152,24 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ 	sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
+ 	itt = kzalloc(sz, GFP_KERNEL);
+ 	lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
++	if (lpi_map)
++		col_map = kzalloc(sizeof(*col_map) * nr_lpis, GFP_KERNEL);
+ 
+-	if (!dev || !itt || !lpi_map) {
++	if (!dev || !itt || !lpi_map || !col_map) {
+ 		kfree(dev);
+ 		kfree(itt);
+ 		kfree(lpi_map);
++		kfree(col_map);
+ 		return NULL;
+ 	}
+ 
+ 	dev->its = its;
+ 	dev->itt = itt;
+ 	dev->nr_ites = nr_ites;
+-	dev->lpi_map = lpi_map;
+-	dev->lpi_base = lpi_base;
+-	dev->nr_lpis = nr_lpis;
++	dev->event_map.lpi_map = lpi_map;
++	dev->event_map.col_map = col_map;
++	dev->event_map.lpi_base = lpi_base;
++	dev->event_map.nr_lpis = nr_lpis;
+ 	dev->device_id = dev_id;
+ 	INIT_LIST_HEAD(&dev->entry);
+ 
+@@ -1138,10 +1177,6 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ 	list_add(&dev->entry, &its->its_device_list);
+ 	raw_spin_unlock_irqrestore(&its->lock, flags);
+ 
+-	/* Bind the device to the first possible CPU */
+-	cpu = cpumask_first(cpu_online_mask);
+-	dev->collection = &its->collections[cpu];
+-
+ 	/* Map device to its ITT */
+ 	its_send_mapd(dev, 1);
+ 
+@@ -1163,12 +1198,13 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
+ {
+ 	int idx;
+ 
+-	idx = find_first_zero_bit(dev->lpi_map, dev->nr_lpis);
+-	if (idx == dev->nr_lpis)
++	idx = find_first_zero_bit(dev->event_map.lpi_map,
++				  dev->event_map.nr_lpis);
++	if (idx == dev->event_map.nr_lpis)
+ 		return -ENOSPC;
+ 
+-	*hwirq = dev->lpi_base + idx;
+-	set_bit(idx, dev->lpi_map);
++	*hwirq = dev->event_map.lpi_base + idx;
++	set_bit(idx, dev->event_map.lpi_map);
+ 
+ 	return 0;
+ }
+@@ -1288,7 +1324,8 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ 		irq_domain_set_hwirq_and_chip(domain, virq + i,
+ 					      hwirq, &its_irq_chip, its_dev);
+ 		dev_dbg(info->scratchpad[1].ptr, "ID:%d pID:%d vID:%d\n",
+-			(int)(hwirq - its_dev->lpi_base), (int)hwirq, virq + i);
++			(int)(hwirq - its_dev->event_map.lpi_base),
++			(int)hwirq, virq + i);
+ 	}
+ 
+ 	return 0;
+@@ -1300,6 +1337,9 @@ static void its_irq_domain_activate(struct irq_domain *domain,
+ 	struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+ 	u32 event = its_get_event_id(d);
+ 
++	/* Bind the LPI to the first possible CPU */
++	its_dev->event_map.col_map[event] = cpumask_first(cpu_online_mask);
++
+ 	/* Map the GIC IRQ and event to the device */
+ 	its_send_mapvi(its_dev, d->hwirq, event);
+ }
+@@ -1327,17 +1367,16 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ 		u32 event = its_get_event_id(data);
+ 
+ 		/* Mark interrupt index as unused */
+-		clear_bit(event, its_dev->lpi_map);
++		clear_bit(event, its_dev->event_map.lpi_map);
+ 
+ 		/* Nuke the entry in the domain */
+ 		irq_domain_reset_irq_data(data);
+ 	}
+ 
+ 	/* If all interrupts have been freed, start mopping the floor */
+-	if (bitmap_empty(its_dev->lpi_map, its_dev->nr_lpis)) {
+-		its_lpi_free(its_dev->lpi_map,
+-			     its_dev->lpi_base,
+-			     its_dev->nr_lpis);
++	if (bitmap_empty(its_dev->event_map.lpi_map,
++			 its_dev->event_map.nr_lpis)) {
++		its_lpi_free(&its_dev->event_map);
+ 
+ 		/* Unmap device/itt */
+ 		its_send_mapd(its_dev, 0);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 2caf492..e8d8456 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1053,13 +1053,10 @@ static struct dm_rq_target_io *tio_from_request(struct request *rq)
+  */
+ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
+ {
+-	int nr_requests_pending;
+-
+ 	atomic_dec(&md->pending[rw]);
+ 
+ 	/* nudge anyone waiting on suspend queue */
+-	nr_requests_pending = md_in_flight(md);
+-	if (!nr_requests_pending)
++	if (!md_in_flight(md))
+ 		wake_up(&md->wait);
+ 
+ 	/*
+@@ -1071,8 +1068,7 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
+ 	if (run_queue) {
+ 		if (md->queue->mq_ops)
+ 			blk_mq_run_hw_queues(md->queue, true);
+-		else if (!nr_requests_pending ||
+-			 (nr_requests_pending >= md->queue->nr_congestion_on))
++		else
+ 			blk_run_queue_async(md->queue);
+ 	}
+ 
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 9157a29..cd7b0c1 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ 		spin_lock_irqsave(&conf->device_lock, flags);
+ 		if (r1_bio->mddev->degraded == conf->raid_disks ||
+ 		    (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+-		     !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++		     test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ 			uptodate = 1;
+ 		spin_unlock_irqrestore(&conf->device_lock, flags);
+ 	}
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index d1b55fe..e4dc8cd 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -113,11 +113,11 @@ static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ 
+ 	if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+ 		area = ctx->afu->psn_phys;
+-		if (offset > ctx->afu->adapter->ps_size)
++		if (offset >= ctx->afu->adapter->ps_size)
+ 			return VM_FAULT_SIGBUS;
+ 	} else {
+ 		area = ctx->psn_phys;
+-		if (offset > ctx->psn_size)
++		if (offset >= ctx->psn_size)
+ 			return VM_FAULT_SIGBUS;
+ 	}
+ 
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index 8ccddce..de350dd 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
+ 		spin_lock(&adapter->afu_list_lock);
+ 		for (slice = 0; slice < adapter->slices; slice++) {
+ 			afu = adapter->afu[slice];
+-			if (!afu->enabled)
++			if (!afu || !afu->enabled)
+ 				continue;
+ 			rcu_read_lock();
+ 			idr_for_each_entry(&afu->contexts_idr, ctx, id)
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 3e29681..e40bcd03 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
+ 	/* Fill in the data structures */
+ 	devno = MKDEV(MAJOR(mei_devt), dev->minor);
+ 	cdev_init(&dev->cdev, &mei_fops);
+-	dev->cdev.owner = mei_fops.owner;
++	dev->cdev.owner = parent->driver->owner;
+ 
+ 	/* Add the device */
+ 	ret = cdev_add(&dev->cdev, devno, 1);
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 9df2b68..d0abdffb 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1062,6 +1062,10 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
+ 
+ 		if (status & (CTO_EN | CCRC_EN))
+ 			end_cmd = 1;
++		if (host->data || host->response_busy) {
++			end_trans = !end_cmd;
++			host->response_busy = 0;
++		}
+ 		if (status & (CTO_EN | DTO_EN))
+ 			hsmmc_command_incomplete(host, -ETIMEDOUT, end_cmd);
+ 		else if (status & (CCRC_EN | DCRC_EN))
+@@ -1081,10 +1085,6 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
+ 			}
+ 			dev_dbg(mmc_dev(host->mmc), "AC12 err: 0x%x\n", ac12);
+ 		}
+-		if (host->data || host->response_busy) {
+-			end_trans = !end_cmd;
+-			host->response_busy = 0;
+-		}
+ 	}
+ 
+ 	OMAP_HSMMC_WRITE(host->base, STAT, status);
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index 3497cfa..a870c42 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -45,6 +45,6 @@
+ #define ESDHC_DMA_SYSCTL	0x40c
+ #define ESDHC_DMA_SNOOP		0x00000040
+ 
+-#define ESDHC_HOST_CONTROL_RES	0x05
++#define ESDHC_HOST_CONTROL_RES	0x01
+ 
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index b5103a2..065dc70 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -411,6 +411,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ 			goto err_of_parse;
+ 		sdhci_get_of_property(pdev);
+ 		pdata = pxav3_get_mmc_pdata(dev);
++		pdev->dev.platform_data = pdata;
+ 	} else if (pdata) {
+ 		/* on-chip device */
+ 		if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index d3dbb28..bec8a30 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3037,8 +3037,11 @@ int sdhci_add_host(struct sdhci_host *host)
+ 						      GFP_KERNEL);
+ 		host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL);
+ 		if (!host->adma_table || !host->align_buffer) {
+-			dma_free_coherent(mmc_dev(mmc), host->adma_table_sz,
+-					  host->adma_table, host->adma_addr);
++			if (host->adma_table)
++				dma_free_coherent(mmc_dev(mmc),
++						  host->adma_table_sz,
++						  host->adma_table,
++						  host->adma_addr);
+ 			kfree(host->align_buffer);
+ 			pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n",
+ 				mmc_hostname(mmc));
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 041525d..5d214d1 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -592,6 +592,7 @@ static int c_can_start(struct net_device *dev)
+ {
+ 	struct c_can_priv *priv = netdev_priv(dev);
+ 	int err;
++	struct pinctrl *p;
+ 
+ 	/* basic c_can configuration */
+ 	err = c_can_chip_config(dev);
+@@ -604,8 +605,13 @@ static int c_can_start(struct net_device *dev)
+ 
+ 	priv->can.state = CAN_STATE_ERROR_ACTIVE;
+ 
+-	/* activate pins */
+-	pinctrl_pm_select_default_state(dev->dev.parent);
++	/* Attempt to use "active" if available else use "default" */
++	p = pinctrl_get_select(priv->device, "active");
++	if (!IS_ERR(p))
++		pinctrl_put(p);
++	else
++		pinctrl_pm_select_default_state(priv->device);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index e9b1810..aede704 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -440,9 +440,6 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ 		struct can_frame *cf = (struct can_frame *)skb->data;
+ 		u8 dlc = cf->can_dlc;
+ 
+-		if (!(skb->tstamp.tv64))
+-			__net_timestamp(skb);
+-
+ 		netif_rx(priv->echo_skb[idx]);
+ 		priv->echo_skb[idx] = NULL;
+ 
+@@ -578,7 +575,6 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	__net_timestamp(skb);
+ 	skb->protocol = htons(ETH_P_CAN);
+ 	skb->pkt_type = PACKET_BROADCAST;
+ 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -589,6 +585,7 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	*cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
+ 	memset(*cf, 0, sizeof(struct can_frame));
+@@ -607,7 +604,6 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ 	if (unlikely(!skb))
+ 		return NULL;
+ 
+-	__net_timestamp(skb);
+ 	skb->protocol = htons(ETH_P_CANFD);
+ 	skb->pkt_type = PACKET_BROADCAST;
+ 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -618,6 +614,7 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	*cfd = (struct canfd_frame *)skb_put(skb, sizeof(struct canfd_frame));
+ 	memset(*cfd, 0, sizeof(struct canfd_frame));
+diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
+index 7deb80d..2f9ebad 100644
+--- a/drivers/net/can/rcar_can.c
++++ b/drivers/net/can/rcar_can.c
+@@ -526,7 +526,7 @@ static int rcar_can_open(struct net_device *ndev)
+ 	napi_enable(&priv->napi);
+ 	err = request_irq(ndev->irq, rcar_can_interrupt, 0, ndev->name, ndev);
+ 	if (err) {
+-		netdev_err(ndev, "error requesting interrupt %x\n", ndev->irq);
++		netdev_err(ndev, "error requesting interrupt %d\n", ndev->irq);
+ 		goto out_close;
+ 	}
+ 	can_led_event(ndev, CAN_LED_EVENT_OPEN);
+@@ -758,8 +758,9 @@ static int rcar_can_probe(struct platform_device *pdev)
+ 	}
+ 
+ 	irq = platform_get_irq(pdev, 0);
+-	if (!irq) {
++	if (irq < 0) {
+ 		dev_err(&pdev->dev, "No IRQ resource\n");
++		err = irq;
+ 		goto fail;
+ 	}
+ 
+@@ -823,7 +824,7 @@ static int rcar_can_probe(struct platform_device *pdev)
+ 
+ 	devm_can_led_init(ndev);
+ 
+-	dev_info(&pdev->dev, "device registered (reg_base=%p, irq=%u)\n",
++	dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
+ 		 priv->regs, ndev->irq);
+ 
+ 	return 0;
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index f64f529..a23a7af 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -207,7 +207,6 @@ static void slc_bump(struct slcan *sl)
+ 	if (!skb)
+ 		return;
+ 
+-	__net_timestamp(skb);
+ 	skb->dev = sl->dev;
+ 	skb->protocol = htons(ETH_P_CAN);
+ 	skb->pkt_type = PACKET_BROADCAST;
+@@ -215,6 +214,7 @@ static void slc_bump(struct slcan *sl)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = sl->dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	memcpy(skb_put(skb, sizeof(struct can_frame)),
+ 	       &cf, sizeof(struct can_frame));
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index bf63fee..34c625e 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -1221,17 +1221,16 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev)
+ 	struct spi_device *spi = to_spi_device(dev);
+ 	struct mcp251x_priv *priv = spi_get_drvdata(spi);
+ 
+-	if (priv->after_suspend & AFTER_SUSPEND_POWER) {
++	if (priv->after_suspend & AFTER_SUSPEND_POWER)
+ 		mcp251x_power_enable(priv->power, 1);
++
++	if (priv->after_suspend & AFTER_SUSPEND_UP) {
++		mcp251x_power_enable(priv->transceiver, 1);
+ 		queue_work(priv->wq, &priv->restart_work);
+ 	} else {
+-		if (priv->after_suspend & AFTER_SUSPEND_UP) {
+-			mcp251x_power_enable(priv->transceiver, 1);
+-			queue_work(priv->wq, &priv->restart_work);
+-		} else {
+-			priv->after_suspend = 0;
+-		}
++		priv->after_suspend = 0;
+ 	}
++
+ 	priv->force_quit = 0;
+ 	enable_irq(spi->irq);
+ 	return 0;
+diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
+index 0ce868d..674f367 100644
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -78,9 +78,6 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
+ 	skb->dev       = dev;
+ 	skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 
+-	if (!(skb->tstamp.tv64))
+-		__net_timestamp(skb);
+-
+ 	netif_rx_ni(skb);
+ }
+ 
+diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+index 8e604a3..ef20be0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
+ 		hw_addr = (const u8 *)(mac_override +
+ 				 MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+ 
+-		/* The byte order is little endian 16 bit, meaning 214365 */
+-		data->hw_addr[0] = hw_addr[1];
+-		data->hw_addr[1] = hw_addr[0];
+-		data->hw_addr[2] = hw_addr[3];
+-		data->hw_addr[3] = hw_addr[2];
+-		data->hw_addr[4] = hw_addr[5];
+-		data->hw_addr[5] = hw_addr[4];
++		/*
++		 * Store the MAC address from MAO section.
++		 * No byte swapping is required in MAO section
++		 */
++		memcpy(data->hw_addr, hw_addr, ETH_ALEN);
+ 
+ 		/*
+ 		 * Force the use of the OTP MAC address in case of reserved MAC
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index ef32e17..281451c 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -225,7 +225,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
+ 
+ 	if (info->band == IEEE80211_BAND_2GHZ &&
+ 	    !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
+-		rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS;
++		rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
+ 	else
+ 		rate_flags =
+ 			BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index dc17909..37e6a6f 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -2515,6 +2515,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ 		trans->hw_rev = (trans->hw_rev & 0xfff0) |
+ 				(CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
+ 
++		ret = iwl_pcie_prepare_card_hw(trans);
++		if (ret) {
++			IWL_WARN(trans, "Exit HW not ready\n");
++			goto out_pci_disable_msi;
++		}
++
+ 		/*
+ 		 * in-order to recognize C step driver should read chip version
+ 		 * id located at the AUX bus MISC address space.
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+index 5ac59fb..d3a3be7 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+@@ -403,14 +403,13 @@ static int imx1_pinconf_set(struct pinctrl_dev *pctldev,
+ 			     unsigned num_configs)
+ {
+ 	struct imx1_pinctrl *ipctl = pinctrl_dev_get_drvdata(pctldev);
+-	const struct imx1_pinctrl_soc_info *info = ipctl->info;
+ 	int i;
+ 
+ 	for (i = 0; i != num_configs; ++i) {
+ 		imx1_write_bit(ipctl, pin_id, configs[i] & 0x01, MX1_PUEN);
+ 
+ 		dev_dbg(ipctl->dev, "pinconf set pullup pin %s\n",
+-			info->pins[pin_id].name);
++			pin_desc_get(pctldev, pin_id)->name);
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index ff82811..8de1351 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -34,6 +34,8 @@
+ #include <linux/mfd/samsung/s2mps14.h>
+ #include <linux/mfd/samsung/s2mpu02.h>
+ 
++/* The highest number of possible regulators for supported devices. */
++#define S2MPS_REGULATOR_MAX		S2MPS13_REGULATOR_MAX
+ struct s2mps11_info {
+ 	unsigned int rdev_num;
+ 	int ramp_delay2;
+@@ -49,7 +51,7 @@ struct s2mps11_info {
+ 	 * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether
+ 	 * the suspend mode was enabled.
+ 	 */
+-	unsigned long long s2mps14_suspend_state:50;
++	DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX);
+ 
+ 	/* Array of size rdev_num with GPIO-s for external sleep control */
+ 	int *ext_control_gpio;
+@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+ 	switch (s2mps11->dev_type) {
+ 	case S2MPS13X:
+ 	case S2MPS14X:
+-		if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++		if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ 			val = S2MPS14_ENABLE_SUSPEND;
+ 		else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)]))
+ 			val = S2MPS14_ENABLE_EXT_CONTROL;
+@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+ 			val = rdev->desc->enable_mask;
+ 		break;
+ 	case S2MPU02:
+-		if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++		if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ 			val = S2MPU02_ENABLE_SUSPEND;
+ 		else
+ 			val = rdev->desc->enable_mask;
+@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend_disable(struct regulator_dev *rdev)
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev));
++	set_bit(rdev_get_id(rdev), s2mps11->suspend_state);
+ 	/*
+ 	 * Don't enable suspend mode if regulator is already disabled because
+ 	 * this would effectively for a short time turn on the regulator after
+@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
+ 	case S2MPS11X:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators);
+ 		regulators = s2mps11_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	case S2MPS13X:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators);
+ 		regulators = s2mps13_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	case S2MPS14X:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators);
+ 		regulators = s2mps14_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	case S2MPU02:
+ 		s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators);
+ 		regulators = s2mpu02_regulators;
++		BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ 		break;
+ 	default:
+ 		dev_err(&pdev->dev, "Invalid device type: %u\n",
+diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
+index 0e6ee3c..e9ae6b9 100644
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -68,7 +68,7 @@
+  * |                              |                    | 0xd101-0xd1fe	|
+  * |                              |                    | 0xd214-0xd2fe	|
+  * | Target Mode		  |	  0xe079       |		|
+- * | Target Mode Management	  |	  0xf072       | 0xf002		|
++ * | Target Mode Management	  |	  0xf080       | 0xf002		|
+  * |                              |                    | 0xf046-0xf049  |
+  * | Target Mode Task Management  |	  0x1000b      |		|
+  * ----------------------------------------------------------------------
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 285cb20..998498e 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2924,6 +2924,7 @@ qla2x00_rport_del(void *data)
+ 	struct fc_rport *rport;
+ 	scsi_qla_host_t *vha = fcport->vha;
+ 	unsigned long flags;
++	unsigned long vha_flags;
+ 
+ 	spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+ 	rport = fcport->drport ? fcport->drport: fcport->rport;
+@@ -2935,7 +2936,9 @@ qla2x00_rport_del(void *data)
+ 		 * Release the target mode FC NEXUS in qla_target.c code
+ 		 * if target mod is enabled.
+ 		 */
++		spin_lock_irqsave(&vha->hw->hardware_lock, vha_flags);
+ 		qlt_fc_port_deleted(vha, fcport);
++		spin_unlock_irqrestore(&vha->hw->hardware_lock, vha_flags);
+ 	}
+ }
+ 
+@@ -3303,6 +3306,7 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
+ 	 * Create target mode FC NEXUS in qla_target.c if target mode is
+ 	 * enabled..
+ 	 */
++
+ 	qlt_fc_port_added(vha, fcport);
+ 
+ 	spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+@@ -3460,20 +3464,43 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ 			if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
+ 				continue;
+ 
+-			if (fcport->scan_state == QLA_FCPORT_SCAN &&
+-			    atomic_read(&fcport->state) == FCS_ONLINE) {
+-				qla2x00_mark_device_lost(vha, fcport,
+-				    ql2xplogiabsentdevice, 0);
+-				if (fcport->loop_id != FC_NO_LOOP_ID &&
+-				    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
+-				    fcport->port_type != FCT_INITIATOR &&
+-				    fcport->port_type != FCT_BROADCAST) {
+-					ha->isp_ops->fabric_logout(vha,
+-					    fcport->loop_id,
+-					    fcport->d_id.b.domain,
+-					    fcport->d_id.b.area,
+-					    fcport->d_id.b.al_pa);
+-					qla2x00_clear_loop_id(fcport);
++			if (fcport->scan_state == QLA_FCPORT_SCAN) {
++				if (qla_ini_mode_enabled(base_vha) &&
++				    atomic_read(&fcport->state) == FCS_ONLINE) {
++					qla2x00_mark_device_lost(vha, fcport,
++					    ql2xplogiabsentdevice, 0);
++					if (fcport->loop_id != FC_NO_LOOP_ID &&
++					    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
++					    fcport->port_type != FCT_INITIATOR &&
++					    fcport->port_type != FCT_BROADCAST) {
++						ha->isp_ops->fabric_logout(vha,
++						    fcport->loop_id,
++						    fcport->d_id.b.domain,
++						    fcport->d_id.b.area,
++						    fcport->d_id.b.al_pa);
++						qla2x00_clear_loop_id(fcport);
++					}
++				} else if (!qla_ini_mode_enabled(base_vha)) {
++					/*
++					 * In target mode, explicitly kill
++					 * sessions and log out of devices
++					 * that are gone, so that we don't
++					 * end up with an initiator using the
++					 * wrong ACL (if the fabric recycles
++					 * an FC address and we have a stale
++					 * session around) and so that we don't
++					 * report initiators that are no longer
++					 * on the fabric.
++					 */
++					ql_dbg(ql_dbg_tgt_mgt, vha, 0xf077,
++					    "port gone, logging out/killing session: "
++					    "%8phC state 0x%x flags 0x%x fc4_type 0x%x "
++					    "scan_state %d\n",
++					    fcport->port_name,
++					    atomic_read(&fcport->state),
++					    fcport->flags, fcport->fc4_type,
++					    fcport->scan_state);
++					qlt_fc_port_deleted(vha, fcport);
+ 				}
+ 			}
+ 		}
+@@ -3494,6 +3521,28 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ 			    (fcport->flags & FCF_LOGIN_NEEDED) == 0)
+ 				continue;
+ 
++			/*
++			 * If we're not an initiator, skip looking for devices
++			 * and logging in.  There's no reason for us to do it,
++			 * and it seems to actively cause problems in target
++			 * mode if we race with the initiator logging into us
++			 * (we might get the "port ID used" status back from
++			 * our login command and log out the initiator, which
++			 * seems to cause havoc).
++			 */
++			if (!qla_ini_mode_enabled(base_vha)) {
++				if (fcport->scan_state == QLA_FCPORT_FOUND) {
++					ql_dbg(ql_dbg_tgt_mgt, vha, 0xf078,
++					    "port %8phC state 0x%x flags 0x%x fc4_type 0x%x "
++					    "scan_state %d (initiator mode disabled; skipping "
++					    "login)\n", fcport->port_name,
++					    atomic_read(&fcport->state),
++					    fcport->flags, fcport->fc4_type,
++					    fcport->scan_state);
++				}
++				continue;
++			}
++
+ 			if (fcport->loop_id == FC_NO_LOOP_ID) {
+ 				fcport->loop_id = next_loopid;
+ 				rval = qla2x00_find_new_loop_id(
+@@ -3520,16 +3569,38 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ 			    test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
+ 				break;
+ 
+-			/* Find a new loop ID to use. */
+-			fcport->loop_id = next_loopid;
+-			rval = qla2x00_find_new_loop_id(base_vha, fcport);
+-			if (rval != QLA_SUCCESS) {
+-				/* Ran out of IDs to use */
+-				break;
+-			}
++			/*
++			 * If we're not an initiator, skip looking for devices
++			 * and logging in.  There's no reason for us to do it,
++			 * and it seems to actively cause problems in target
++			 * mode if we race with the initiator logging into us
++			 * (we might get the "port ID used" status back from
++			 * our login command and log out the initiator, which
++			 * seems to cause havoc).
++			 */
++			if (qla_ini_mode_enabled(base_vha)) {
++				/* Find a new loop ID to use. */
++				fcport->loop_id = next_loopid;
++				rval = qla2x00_find_new_loop_id(base_vha,
++				    fcport);
++				if (rval != QLA_SUCCESS) {
++					/* Ran out of IDs to use */
++					break;
++				}
+ 
+-			/* Login and update database */
+-			qla2x00_fabric_dev_login(vha, fcport, &next_loopid);
++				/* Login and update database */
++				qla2x00_fabric_dev_login(vha, fcport,
++				    &next_loopid);
++			} else {
++				ql_dbg(ql_dbg_tgt_mgt, vha, 0xf079,
++					"new port %8phC state 0x%x flags 0x%x fc4_type "
++					"0x%x scan_state %d (initiator mode disabled; "
++					"skipping login)\n",
++					fcport->port_name,
++					atomic_read(&fcport->state),
++					fcport->flags, fcport->fc4_type,
++					fcport->scan_state);
++			}
+ 
+ 			list_move_tail(&fcport->list, &vha->vp_fcports);
+ 		}
+@@ -3725,11 +3796,12 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ 			fcport->fp_speed = new_fcport->fp_speed;
+ 
+ 			/*
+-			 * If address the same and state FCS_ONLINE, nothing
+-			 * changed.
++			 * If address the same and state FCS_ONLINE
++			 * (or in target mode), nothing changed.
+ 			 */
+ 			if (fcport->d_id.b24 == new_fcport->d_id.b24 &&
+-			    atomic_read(&fcport->state) == FCS_ONLINE) {
++			    (atomic_read(&fcport->state) == FCS_ONLINE ||
++			     !qla_ini_mode_enabled(base_vha))) {
+ 				break;
+ 			}
+ 
+@@ -3749,6 +3821,22 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ 			 * Log it out if still logged in and mark it for
+ 			 * relogin later.
+ 			 */
++			if (!qla_ini_mode_enabled(base_vha)) {
++				ql_dbg(ql_dbg_tgt_mgt, vha, 0xf080,
++					 "port changed FC ID, %8phC"
++					 " old %x:%x:%x (loop_id 0x%04x)-> new %x:%x:%x\n",
++					 fcport->port_name,
++					 fcport->d_id.b.domain,
++					 fcport->d_id.b.area,
++					 fcport->d_id.b.al_pa,
++					 fcport->loop_id,
++					 new_fcport->d_id.b.domain,
++					 new_fcport->d_id.b.area,
++					 new_fcport->d_id.b.al_pa);
++				fcport->d_id.b24 = new_fcport->d_id.b24;
++				break;
++			}
++
+ 			fcport->d_id.b24 = new_fcport->d_id.b24;
+ 			fcport->flags |= FCF_LOGIN_NEEDED;
+ 			if (fcport->loop_id != FC_NO_LOOP_ID &&
+@@ -3768,6 +3856,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ 		if (found)
+ 			continue;
+ 		/* If device was not in our fcports list, then add it. */
++		new_fcport->scan_state = QLA_FCPORT_FOUND;
+ 		list_add_tail(&new_fcport->list, new_fcports);
+ 
+ 		/* Allocate a new replacement fcport. */
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index fe8a8d1..496a733 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -113,6 +113,7 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
+ static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ 	struct atio_from_isp *atio, uint16_t status, int qfull);
+ static void qlt_disable_vha(struct scsi_qla_host *vha);
++static void qlt_clear_tgt_db(struct qla_tgt *tgt);
+ /*
+  * Global Variables
+  */
+@@ -431,10 +432,10 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
+ 
+ 	loop_id = le16_to_cpu(n->u.isp24.nport_handle);
+ 	if (loop_id == 0xFFFF) {
+-#if 0 /* FIXME: Re-enable Global event handling.. */
+ 		/* Global event */
+-		atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
+-		qlt_clear_tgt_db(ha->tgt.qla_tgt);
++		atomic_inc(&vha->vha_tgt.qla_tgt->tgt_global_resets_count);
++		qlt_clear_tgt_db(vha->vha_tgt.qla_tgt);
++#if 0 /* FIXME: do we need to choose a session here? */
+ 		if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
+ 			sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
+ 			    typeof(*sess), sess_list_entry);
+@@ -782,25 +783,20 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 
+ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+ {
+-	struct qla_hw_data *ha = vha->hw;
+ 	struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+ 	struct qla_tgt_sess *sess;
+-	unsigned long flags;
+ 
+ 	if (!vha->hw->tgt.tgt_ops)
+ 		return;
+ 
+-	if (!tgt || (fcport->port_type != FCT_INITIATOR))
++	if (!tgt)
+ 		return;
+ 
+-	spin_lock_irqsave(&ha->hardware_lock, flags);
+ 	if (tgt->tgt_stop) {
+-		spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ 		return;
+ 	}
+ 	sess = qlt_find_sess_by_port_name(tgt, fcport->port_name);
+ 	if (!sess) {
+-		spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ 		return;
+ 	}
+ 
+@@ -808,7 +804,6 @@ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+ 
+ 	sess->local = 1;
+ 	qlt_schedule_sess_for_deletion(sess, false);
+-	spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ }
+ 
+ static inline int test_tgt_sess_count(struct qla_tgt *tgt)
+@@ -2347,9 +2342,10 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ 		res = qlt_build_ctio_crc2_pkt(&prm, vha);
+ 	else
+ 		res = qlt_24xx_build_ctio_pkt(&prm, vha);
+-	if (unlikely(res != 0))
++	if (unlikely(res != 0)) {
++		vha->req->cnt += full_req_cnt;
+ 		goto out_unmap_unlock;
+-
++	}
+ 
+ 	pkt = (struct ctio7_to_24xx *)prm.pkt;
+ 
+@@ -2487,8 +2483,11 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ 	else
+ 		res = qlt_24xx_build_ctio_pkt(&prm, vha);
+ 
+-	if (unlikely(res != 0))
++	if (unlikely(res != 0)) {
++		vha->req->cnt += prm.req_cnt;
+ 		goto out_unlock_free_unmap;
++	}
++
+ 	pkt = (struct ctio7_to_24xx *)prm.pkt;
+ 	pkt->u.status0.flags |= __constant_cpu_to_le16(CTIO7_FLAGS_DATA_OUT |
+ 	    CTIO7_FLAGS_STATUS_MODE_0);
+@@ -2717,7 +2716,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
+ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
+ 	struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
+ {
+-	unsigned long flags;
++	unsigned long flags = 0;
+ 	int rc;
+ 
+ 	if (qlt_issue_marker(vha, ha_locked) < 0)
+@@ -2733,17 +2732,18 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
+ 	rc = __qlt_send_term_exchange(vha, cmd, atio);
+ 	if (rc == -ENOMEM)
+ 		qlt_alloc_qfull_cmd(vha, atio, 0, 0);
+-	spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+ 
+ done:
+ 	if (cmd && ((cmd->state != QLA_TGT_STATE_ABORTED) ||
+ 	    !cmd->cmd_sent_to_fw)) {
+-		if (!ha_locked && !in_interrupt())
+-			msleep(250); /* just in case */
+-
+-		qlt_unmap_sg(vha, cmd);
++		if (cmd->sg_mapped)
++			qlt_unmap_sg(vha, cmd);
+ 		vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ 	}
++
++	if (!ha_locked)
++		spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
++
+ 	return;
+ }
+ 
+@@ -3347,6 +3347,11 @@ static struct qla_tgt_cmd *qlt_get_tag(scsi_qla_host_t *vha,
+ 	cmd->loop_id = sess->loop_id;
+ 	cmd->conf_compl_supported = sess->conf_compl_supported;
+ 
++	cmd->cmd_flags = 0;
++	cmd->jiffies_at_alloc = get_jiffies_64();
++
++	cmd->reset_count = vha->hw->chip_reset;
++
+ 	return cmd;
+ }
+ 
+@@ -3453,11 +3458,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
+ 		return -ENOMEM;
+ 	}
+ 
+-	cmd->cmd_flags = 0;
+-	cmd->jiffies_at_alloc = get_jiffies_64();
+-
+-	cmd->reset_count = vha->hw->chip_reset;
+-
+ 	cmd->cmd_in_wq = 1;
+ 	cmd->cmd_flags |= BIT_0;
+ 	INIT_WORK(&cmd->work, qlt_do_work);
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index c95a4e9..59c31bf 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ 			    scmd->sdb.length);
+ 		scmd->sdb.table.sgl = &ses->sense_sgl;
+ 		scmd->sc_data_direction = DMA_FROM_DEVICE;
+-		scmd->sdb.table.nents = 1;
++		scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1;
+ 		scmd->cmnd[0] = REQUEST_SENSE;
+ 		scmd->cmnd[4] = scmd->sdb.length;
+ 		scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index b1a2631..448ebda 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc(unsigned int nents, gfp_t gfp_mask)
+ 
+ static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
+ {
+-	if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS)
++	if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS)
+ 		return;
+ 	__sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free);
+ }
+@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
+ 
+ 	if (mq) {
+ 		if (nents <= SCSI_MAX_SG_SEGMENTS) {
+-			sdb->table.nents = nents;
+-			sg_init_table(sdb->table.sgl, sdb->table.nents);
++			sdb->table.nents = sdb->table.orig_nents = nents;
++			sg_init_table(sdb->table.sgl, nents);
+ 			return 0;
+ 		}
+ 		first_chunk = sdb->table.sgl;
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 1ac38e7..9ad4116 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *dev, struct device_attribute *attr,
+ 
+ 	depth = simple_strtoul(buf, NULL, 0);
+ 
+-	if (depth < 1 || depth > sht->can_queue)
++	if (depth < 1 || depth > sdev->host->can_queue)
+ 		return -EINVAL;
+ 
+ 	retval = sht->change_queue_depth(sdev, depth);
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 9a1c342..525ab4c 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1274,9 +1274,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ 	spin_lock(&st_use_lock);
+ 	STp->in_use = 0;
+ 	spin_unlock(&st_use_lock);
+-	scsi_tape_put(STp);
+ 	if (resumed)
+ 		scsi_autopm_put_device(STp->device);
++	scsi_tape_put(STp);
+ 	return retval;
+ 
+ }
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index 788e2b1..acce90a 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -40,6 +40,7 @@
+ #define SPFI_CONTROL_SOFT_RESET			BIT(11)
+ #define SPFI_CONTROL_SEND_DMA			BIT(10)
+ #define SPFI_CONTROL_GET_DMA			BIT(9)
++#define SPFI_CONTROL_SE			BIT(8)
+ #define SPFI_CONTROL_TMODE_SHIFT		5
+ #define SPFI_CONTROL_TMODE_MASK			0x7
+ #define SPFI_CONTROL_TMODE_SINGLE		0
+@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
+ 	else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
+ 		 xfer->rx_nbits == SPI_NBITS_QUAD)
+ 		val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
++	val |= SPFI_CONTROL_SE;
+ 	spfi_writel(spfi, val, SPFI_CONTROL);
+ }
+ 
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index f08e812..412b9c8 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
+ {
+ 	struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+ 
+-	if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml)
+-	    && (transfer->len > spi_imx->tx_wml))
++	if (spi_imx->dma_is_inited
++	    && transfer->len > spi_imx->rx_wml * sizeof(u32)
++	    && transfer->len > spi_imx->tx_wml * sizeof(u32))
+ 		return true;
+ 	return false;
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 74e6114f..305a5cb 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4001,7 +4001,13 @@ get_immediate:
+ 	}
+ 
+ transport_err:
+-	iscsit_take_action_for_connection_exit(conn);
++	/*
++	 * Avoid the normal connection failure code-path if this connection
++	 * is still within LOGIN mode, and iscsi_np process context is
++	 * responsible for cleaning up the early connection failure.
++	 */
++	if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
++		iscsit_take_action_for_connection_exit(conn);
+ out:
+ 	return 0;
+ }
+@@ -4093,7 +4099,7 @@ reject:
+ 
+ int iscsi_target_rx_thread(void *arg)
+ {
+-	int ret;
++	int ret, rc;
+ 	u8 buffer[ISCSI_HDR_LEN], opcode;
+ 	u32 checksum = 0, digest = 0;
+ 	struct iscsi_conn *conn = arg;
+@@ -4103,10 +4109,16 @@ int iscsi_target_rx_thread(void *arg)
+ 	 * connection recovery / failure event can be triggered externally.
+ 	 */
+ 	allow_signal(SIGINT);
++	/*
++	 * Wait for iscsi_post_login_handler() to complete before allowing
++	 * incoming iscsi/tcp socket I/O, and/or failing the connection.
++	 */
++	rc = wait_for_completion_interruptible(&conn->rx_login_comp);
++	if (rc < 0)
++		return 0;
+ 
+ 	if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+ 		struct completion comp;
+-		int rc;
+ 
+ 		init_completion(&comp);
+ 		rc = wait_for_completion_interruptible(&comp);
+@@ -4543,7 +4555,18 @@ static void iscsit_logout_post_handler_closesession(
+ 	struct iscsi_conn *conn)
+ {
+ 	struct iscsi_session *sess = conn->sess;
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++	/*
++	 * Traditional iscsi/tcp will invoke this logic from TX thread
++	 * context during session logout, so clear tx_thread_active and
++	 * sleep if iscsit_close_connection() has not already occured.
++	 *
++	 * Since iser-target invokes this logic from it's own workqueue,
++	 * always sleep waiting for RX/TX thread shutdown to complete
++	 * within iscsit_close_connection().
++	 */
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4557,7 +4580,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ 	struct iscsi_conn *conn)
+ {
+-	int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++	int sleep = 1;
++
++	if (conn->conn_transport->transport_type == ISCSI_TCP)
++		sleep = cmpxchg(&conn->tx_thread_active, true, false);
+ 
+ 	atomic_set(&conn->conn_logout_remove, 0);
+ 	complete(&conn->conn_logout_comp);
+@@ -4776,6 +4802,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 	struct iscsi_session *sess;
+ 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ 	struct se_session *se_sess, *se_sess_tmp;
++	LIST_HEAD(free_list);
+ 	int session_count = 0;
+ 
+ 	spin_lock_bh(&se_tpg->session_lock);
+@@ -4797,14 +4824,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ 		}
+ 		atomic_set(&sess->session_reinstatement, 1);
+ 		spin_unlock(&sess->conn_lock);
+-		spin_unlock_bh(&se_tpg->session_lock);
+ 
+-		iscsit_free_session(sess);
+-		spin_lock_bh(&se_tpg->session_lock);
++		list_move_tail(&se_sess->sess_list, &free_list);
++	}
++	spin_unlock_bh(&se_tpg->session_lock);
++
++	list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++		sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+ 
++		iscsit_free_session(sess);
+ 		session_count++;
+ 	}
+-	spin_unlock_bh(&se_tpg->session_lock);
+ 
+ 	pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ 			" Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 70d799d..c3bccad 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -82,6 +82,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
+ 	init_completion(&conn->conn_logout_comp);
+ 	init_completion(&conn->rx_half_close_comp);
+ 	init_completion(&conn->tx_half_close_comp);
++	init_completion(&conn->rx_login_comp);
+ 	spin_lock_init(&conn->cmd_lock);
+ 	spin_lock_init(&conn->conn_usage_lock);
+ 	spin_lock_init(&conn->immed_queue_lock);
+@@ -699,7 +700,7 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
+ 		iscsit_start_nopin_timer(conn);
+ }
+ 
+-static int iscsit_start_kthreads(struct iscsi_conn *conn)
++int iscsit_start_kthreads(struct iscsi_conn *conn)
+ {
+ 	int ret = 0;
+ 
+@@ -734,6 +735,7 @@ static int iscsit_start_kthreads(struct iscsi_conn *conn)
+ 
+ 	return 0;
+ out_tx:
++	send_sig(SIGINT, conn->tx_thread, 1);
+ 	kthread_stop(conn->tx_thread);
+ 	conn->tx_thread_active = false;
+ out_bitmap:
+@@ -744,7 +746,7 @@ out_bitmap:
+ 	return ret;
+ }
+ 
+-int iscsi_post_login_handler(
++void iscsi_post_login_handler(
+ 	struct iscsi_np *np,
+ 	struct iscsi_conn *conn,
+ 	u8 zero_tsih)
+@@ -754,7 +756,6 @@ int iscsi_post_login_handler(
+ 	struct se_session *se_sess = sess->se_sess;
+ 	struct iscsi_portal_group *tpg = sess->tpg;
+ 	struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+-	int rc;
+ 
+ 	iscsit_inc_conn_usage_count(conn);
+ 
+@@ -795,10 +796,6 @@ int iscsi_post_login_handler(
+ 			sess->sess_ops->InitiatorName);
+ 		spin_unlock_bh(&sess->conn_lock);
+ 
+-		rc = iscsit_start_kthreads(conn);
+-		if (rc)
+-			return rc;
+-
+ 		iscsi_post_login_start_timers(conn);
+ 		/*
+ 		 * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -807,15 +804,20 @@ int iscsi_post_login_handler(
+ 		iscsit_thread_get_cpumask(conn);
+ 		conn->conn_rx_reset_cpumask = 1;
+ 		conn->conn_tx_reset_cpumask = 1;
+-
++		/*
++		 * Wakeup the sleeping iscsi_target_rx_thread() now that
++		 * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++		 */
++		complete(&conn->rx_login_comp);
+ 		iscsit_dec_conn_usage_count(conn);
++
+ 		if (stop_timer) {
+ 			spin_lock_bh(&se_tpg->session_lock);
+ 			iscsit_stop_time2retain_timer(sess);
+ 			spin_unlock_bh(&se_tpg->session_lock);
+ 		}
+ 		iscsit_dec_session_usage_count(sess);
+-		return 0;
++		return;
+ 	}
+ 
+ 	iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1);
+@@ -856,10 +858,6 @@ int iscsi_post_login_handler(
+ 		" iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
+ 	spin_unlock_bh(&se_tpg->session_lock);
+ 
+-	rc = iscsit_start_kthreads(conn);
+-	if (rc)
+-		return rc;
+-
+ 	iscsi_post_login_start_timers(conn);
+ 	/*
+ 	 * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -868,10 +866,12 @@ int iscsi_post_login_handler(
+ 	iscsit_thread_get_cpumask(conn);
+ 	conn->conn_rx_reset_cpumask = 1;
+ 	conn->conn_tx_reset_cpumask = 1;
+-
++	/*
++	 * Wakeup the sleeping iscsi_target_rx_thread() now that
++	 * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++	 */
++	complete(&conn->rx_login_comp);
+ 	iscsit_dec_conn_usage_count(conn);
+-
+-	return 0;
+ }
+ 
+ static void iscsi_handle_login_thread_timeout(unsigned long data)
+@@ -1436,23 +1436,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ 	if (ret < 0)
+ 		goto new_sess_out;
+ 
+-	if (!conn->sess) {
+-		pr_err("struct iscsi_conn session pointer is NULL!\n");
+-		goto new_sess_out;
+-	}
+-
+ 	iscsi_stop_login_thread_timer(np);
+ 
+-	if (signal_pending(current))
+-		goto new_sess_out;
+-
+ 	if (ret == 1) {
+ 		tpg_np = conn->tpg_np;
+ 
+-		ret = iscsi_post_login_handler(np, conn, zero_tsih);
+-		if (ret < 0)
+-			goto new_sess_out;
+-
++		iscsi_post_login_handler(np, conn, zero_tsih);
+ 		iscsit_deaccess_np(np, tpg, tpg_np);
+ 	}
+ 
+diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
+index 29d0983..55cbf45 100644
+--- a/drivers/target/iscsi/iscsi_target_login.h
++++ b/drivers/target/iscsi/iscsi_target_login.h
+@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
+ extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
+ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
+ extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
++extern int iscsit_start_kthreads(struct iscsi_conn *);
++extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+ extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
+ 				bool, bool);
+ extern int iscsi_target_login_thread(void *);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 8c02fa3..f9cde91 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -17,6 +17,7 @@
+  ******************************************************************************/
+ 
+ #include <linux/ctype.h>
++#include <linux/kthread.h>
+ #include <scsi/iscsi_proto.h>
+ #include <target/target_core_base.h>
+ #include <target/target_core_fabric.h>
+@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ 		ntohl(login_rsp->statsn), login->rsp_length);
+ 
+ 	padding = ((-login->rsp_length) & 3);
++	/*
++	 * Before sending the last login response containing the transition
++	 * bit for full-feature-phase, go ahead and start up TX/RX threads
++	 * now to avoid potential resource allocation failures after the
++	 * final login response has been sent.
++	 */
++	if (login->login_complete) {
++		int rc = iscsit_start_kthreads(conn);
++		if (rc) {
++			iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++					    ISCSI_LOGIN_STATUS_NO_RESOURCES);
++			return -1;
++		}
++	}
+ 
+ 	if (conn->conn_transport->iscsit_put_login_tx(conn, login,
+ 					login->rsp_length + padding) < 0)
+-		return -1;
++		goto err;
+ 
+ 	login->rsp_length		= 0;
+ 	mutex_lock(&sess->cmdsn_mutex);
+@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ 	mutex_unlock(&sess->cmdsn_mutex);
+ 
+ 	return 0;
++
++err:
++	if (login->login_complete) {
++		if (conn->rx_thread && conn->rx_thread_active) {
++			send_sig(SIGINT, conn->rx_thread, 1);
++			kthread_stop(conn->rx_thread);
++		}
++		if (conn->tx_thread && conn->tx_thread_active) {
++			send_sig(SIGINT, conn->tx_thread, 1);
++			kthread_stop(conn->tx_thread);
++		}
++		spin_lock(&iscsit_global->ts_bitmap_lock);
++		bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
++				      get_order(1));
++		spin_unlock(&iscsit_global->ts_bitmap_lock);
++	}
++	return -1;
+ }
+ 
+ static void iscsi_target_sk_data_ready(struct sock *sk)
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 396344c..16ed0b6 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1108,19 +1108,29 @@ static void eraser(unsigned char c, struct tty_struct *tty)
+  *	Locking: ctrl_lock
+  */
+ 
+-static void isig(int sig, struct tty_struct *tty)
++static void __isig(int sig, struct tty_struct *tty)
+ {
+-	struct n_tty_data *ldata = tty->disc_data;
+ 	struct pid *tty_pgrp = tty_get_pgrp(tty);
+ 	if (tty_pgrp) {
+ 		kill_pgrp(tty_pgrp, sig, 1);
+ 		put_pid(tty_pgrp);
+ 	}
++}
+ 
+-	if (!L_NOFLSH(tty)) {
++static void isig(int sig, struct tty_struct *tty)
++{
++	struct n_tty_data *ldata = tty->disc_data;
++
++	if (L_NOFLSH(tty)) {
++		/* signal only */
++		__isig(sig, tty);
++
++	} else { /* signal and flush */
+ 		up_read(&tty->termios_rwsem);
+ 		down_write(&tty->termios_rwsem);
+ 
++		__isig(sig, tty);
++
+ 		/* clear echo buffer */
+ 		mutex_lock(&ldata->output_lock);
+ 		ldata->echo_head = ldata->echo_tail = 0;
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 8825039..01aa52f 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1132,11 +1132,6 @@ static int imx_startup(struct uart_port *port)
+ 	while (!(readl(sport->port.membase + UCR2) & UCR2_SRST) && (--i > 0))
+ 		udelay(1);
+ 
+-	/* Can we enable the DMA support? */
+-	if (is_imx6q_uart(sport) && !uart_console(port) &&
+-	    !sport->dma_is_inited)
+-		imx_uart_dma_init(sport);
+-
+ 	spin_lock_irqsave(&sport->port.lock, flags);
+ 
+ 	/*
+@@ -1145,9 +1140,6 @@ static int imx_startup(struct uart_port *port)
+ 	writel(USR1_RTSD, sport->port.membase + USR1);
+ 	writel(USR2_ORE, sport->port.membase + USR2);
+ 
+-	if (sport->dma_is_inited && !sport->dma_is_enabled)
+-		imx_enable_dma(sport);
+-
+ 	temp = readl(sport->port.membase + UCR1);
+ 	temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
+ 
+@@ -1318,6 +1310,11 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
+ 			} else {
+ 				ucr2 |= UCR2_CTSC;
+ 			}
++
++			/* Can we enable the DMA support? */
++			if (is_imx6q_uart(sport) && !uart_console(port)
++				&& !sport->dma_is_inited)
++				imx_uart_dma_init(sport);
+ 		} else {
+ 			termios->c_cflag &= ~CRTSCTS;
+ 		}
+@@ -1434,6 +1431,8 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
+ 		imx_enable_ms(&sport->port);
+ 
++	if (sport->dma_is_inited && !sport->dma_is_enabled)
++		imx_enable_dma(sport);
+ 	spin_unlock_irqrestore(&sport->port.lock, flags);
+ }
+ 
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 0b7bb12..ec54044 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1409,7 +1409,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
+ 	mutex_lock(&port->mutex);
+ 	uart_shutdown(tty, state);
+ 	tty_port_tty_set(port, NULL);
+-	tty->closing = 0;
++
+ 	spin_lock_irqsave(&port->lock, flags);
+ 
+ 	if (port->blocked_open) {
+@@ -1435,6 +1435,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
+ 	mutex_unlock(&port->mutex);
+ 
+ 	tty_ldisc_flush(tty);
++	tty->closing = 0;
+ }
+ 
+ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 0827d7c..ee07ba4 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ 	u32 pls = status_reg & PORT_PLS_MASK;
+ 
+ 	/* resume state is a xHCI internal state.
+-	 * Do not report it to usb core.
++	 * Do not report it to usb core, instead, pretend to be U3,
++	 * thus usb core knows it's not ready for transfer
+ 	 */
+-	if (pls == XDEV_RESUME)
++	if (pls == XDEV_RESUME) {
++		*status |= USB_SS_PORT_LS_U3;
+ 		return;
++	}
+ 
+ 	/* When the CAS bit is set then warm reset
+ 	 * should be performed on port
+@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ 		status |= USB_PORT_STAT_C_RESET << 16;
+ 	/* USB3.0 only */
+ 	if (hcd->speed == HCD_USB3) {
+-		if ((raw_port_status & PORT_PLC))
++		/* Port link change with port in resume state should not be
++		 * reported to usbcore, as this is an internal state to be
++		 * handled by xhci driver. Reporting PLC to usbcore may
++		 * cause usbcore clearing PLC first and port change event
++		 * irq won't be generated.
++		 */
++		if ((raw_port_status & PORT_PLC) &&
++			(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ 			status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ 		if ((raw_port_status & PORT_WRC))
+ 			status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1120,10 +1130,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 	spin_lock_irqsave(&xhci->lock, flags);
+ 
+ 	if (hcd->self.root_hub->do_remote_wakeup) {
+-		if (bus_state->resuming_ports) {
++		if (bus_state->resuming_ports ||	/* USB2 */
++		    bus_state->port_remote_wakeup) {	/* USB3 */
+ 			spin_unlock_irqrestore(&xhci->lock, flags);
+-			xhci_dbg(xhci, "suspend failed because "
+-						"a port is resuming\n");
++			xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ 			return -EBUSY;
+ 		}
+ 	}
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 7d34cbf..d095677 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ 		usb_hcd_resume_root_hub(hcd);
+ 	}
+ 
++	if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++		bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ 	if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ 		xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+ 
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36bf089..c502c22 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ 			return -EINVAL;
+ 	}
+ 
++	if (virt_dev->tt_info)
++		old_active_eps = virt_dev->tt_info->active_eps;
++
+ 	if (virt_dev->udev != udev) {
+ 		/* If the virt_dev and the udev does not match, this virt_dev
+ 		 * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6977f84..0f26dd2 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0		(0x0 << 5)
+ #define XDEV_U2		(0x2 << 5)
+ #define XDEV_U3		(0x3 << 5)
++#define XDEV_INACTIVE	(0x6 << 5)
+ #define XDEV_RESUME	(0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER	(1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index caf1888..87898ca 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_READ_DISC_INFO ),
+ 
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++		"ZTE,Incorporated",
++		"ZTE WCDMA Technologies MSM",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+  * This encrypted pen drive returns bogus data for the initial READ(10).
+  */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 2ee2826..fa49d329 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -886,6 +886,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ 		}
+ 		if (eventfp != d->log_file) {
+ 			filep = d->log_file;
++			d->log_file = eventfp;
+ 			ctx = d->log_ctx;
+ 			d->log_ctx = eventfp ?
+ 				eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 50bb3c2..5d03eb0 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
+ 
+ 	/*
+ 	 * If we have a d_op->d_delete() operation, we sould not
+-	 * let the dentry count go to zero, so use "put__or_lock".
++	 * let the dentry count go to zero, so use "put_or_lock".
+ 	 */
+ 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
+ 		return lockref_put_or_lock(&dentry->d_lockref);
+@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
+ 	 */
+ 	smp_rmb();
+ 	d_flags = ACCESS_ONCE(dentry->d_flags);
+-	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
++	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
+ 
+ 	/* Nothing to do? Dropping the reference was all we needed? */
+ 	if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
+@@ -776,6 +776,9 @@ repeat:
+ 	if (unlikely(d_unhashed(dentry)))
+ 		goto kill_it;
+ 
++	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++		goto kill_it;
++
+ 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ 		if (dentry->d_op->d_delete(dentry))
+ 			goto kill_it;
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 02c6875..fce3cc1 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1350,6 +1350,36 @@ enum umount_tree_flags {
+ 	UMOUNT_PROPAGATE = 2,
+ 	UMOUNT_CONNECTED = 4,
+ };
++
++static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
++{
++	/* Leaving mounts connected is only valid for lazy umounts */
++	if (how & UMOUNT_SYNC)
++		return true;
++
++	/* A mount without a parent has nothing to be connected to */
++	if (!mnt_has_parent(mnt))
++		return true;
++
++	/* Because the reference counting rules change when mounts are
++	 * unmounted and connected, umounted mounts may not be
++	 * connected to mounted mounts.
++	 */
++	if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
++		return true;
++
++	/* Has it been requested that the mount remain connected? */
++	if (how & UMOUNT_CONNECTED)
++		return false;
++
++	/* Is the mount locked such that it needs to remain connected? */
++	if (IS_MNT_LOCKED(mnt))
++		return false;
++
++	/* By default disconnect the mount */
++	return true;
++}
++
+ /*
+  * mount_lock must be held
+  * namespace_sem must be held for write
+@@ -1387,10 +1417,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
+ 		if (how & UMOUNT_SYNC)
+ 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
+ 
+-		disconnect = !(((how & UMOUNT_CONNECTED) &&
+-				mnt_has_parent(p) &&
+-				(p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
+-			       IS_MNT_LOCKED_AND_LAZY(p));
++		disconnect = disconnect_mount(p, how);
+ 
+ 		pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
+ 				 disconnect ? &unmounted : NULL);
+@@ -1527,11 +1554,8 @@ void __detach_mounts(struct dentry *dentry)
+ 	while (!hlist_empty(&mp->m_list)) {
+ 		mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
+ 		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
+-			struct mount *p, *tmp;
+-			list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
+-				hlist_add_head(&p->mnt_umount.s_list, &unmounted);
+-				umount_mnt(p);
+-			}
++			hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
++			umount_mnt(mnt);
+ 		}
+ 		else umount_tree(mnt, UMOUNT_CONNECTED);
+ 	}
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index f734562..5d25b9d 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1242,9 +1242,11 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
+ 	if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
+ 		cur_size = i_size_read(inode);
+ 		new_isize = nfs_size_to_loff_t(fattr->size);
+-		if (cur_size != new_isize && nfsi->nrequests == 0)
++		if (cur_size != new_isize)
+ 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
+ 	}
++	if (nfsi->nrequests != 0)
++		invalid &= ~NFS_INO_REVAL_PAGECACHE;
+ 
+ 	/* Have any file permissions changed? */
+ 	if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
+@@ -1682,8 +1684,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 			invalid |= NFS_INO_INVALID_ATTR
+ 				| NFS_INO_INVALID_DATA
+ 				| NFS_INO_INVALID_ACCESS
+-				| NFS_INO_INVALID_ACL
+-				| NFS_INO_REVAL_PAGECACHE;
++				| NFS_INO_INVALID_ACL;
+ 			if (S_ISDIR(inode->i_mode))
+ 				nfs_force_lookup_revalidate(inode);
+ 			inode->i_version = fattr->change_attr;
+@@ -1715,7 +1716,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ 			if ((nfsi->nrequests == 0) || new_isize > cur_isize) {
+ 				i_size_write(inode, new_isize);
+ 				invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+-				invalid &= ~NFS_INO_REVAL_PAGECACHE;
+ 			}
+ 			dprintk("NFS: isize change on server for file %s/%ld "
+ 					"(%Ld to %Ld)\n",
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 55e1e3a..d3f2051 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1204,12 +1204,15 @@ static bool nfs_need_update_open_stateid(struct nfs4_state *state,
+ 
+ static void nfs_resync_open_stateid_locked(struct nfs4_state *state)
+ {
++	if (!(state->n_wronly || state->n_rdonly || state->n_rdwr))
++		return;
+ 	if (state->n_wronly)
+ 		set_bit(NFS_O_WRONLY_STATE, &state->flags);
+ 	if (state->n_rdonly)
+ 		set_bit(NFS_O_RDONLY_STATE, &state->flags);
+ 	if (state->n_rdwr)
+ 		set_bit(NFS_O_RDWR_STATE, &state->flags);
++	set_bit(NFS_OPEN_STATE, &state->flags);
+ }
+ 
+ static void nfs_clear_open_stateid_locked(struct nfs4_state *state,
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 282b393..7b45526 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1110,8 +1110,11 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+ 			nfs_list_remove_request(req);
+ 			if (__nfs_pageio_add_request(desc, req))
+ 				continue;
+-			if (desc->pg_error < 0)
++			if (desc->pg_error < 0) {
++				list_splice_tail(&head, &mirror->pg_list);
++				mirror->pg_recoalesce = 1;
+ 				return 0;
++			}
+ 			break;
+ 		}
+ 	} while (mirror->pg_recoalesce);
+diff --git a/fs/pnode.h b/fs/pnode.h
+index 7114ce6..0fcdbe7 100644
+--- a/fs/pnode.h
++++ b/fs/pnode.h
+@@ -20,8 +20,6 @@
+ #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
+ #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
+ #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
+-#define IS_MNT_LOCKED_AND_LAZY(m) \
+-	(((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
+ 
+ #define CL_EXPIRE    		0x01
+ #define CL_SLAVE     		0x02
+diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
+index 20de88d..dd71403 100644
+--- a/fs/xfs/libxfs/xfs_attr_remote.c
++++ b/fs/xfs/libxfs/xfs_attr_remote.c
+@@ -159,11 +159,10 @@ xfs_attr3_rmt_write_verify(
+ 	struct xfs_buf	*bp)
+ {
+ 	struct xfs_mount *mp = bp->b_target->bt_mount;
+-	struct xfs_buf_log_item	*bip = bp->b_fspriv;
++	int		blksize = mp->m_attr_geo->blksize;
+ 	char		*ptr;
+ 	int		len;
+ 	xfs_daddr_t	bno;
+-	int		blksize = mp->m_attr_geo->blksize;
+ 
+ 	/* no verification of non-crc buffers */
+ 	if (!xfs_sb_version_hascrc(&mp->m_sb))
+@@ -175,16 +174,22 @@ xfs_attr3_rmt_write_verify(
+ 	ASSERT(len >= blksize);
+ 
+ 	while (len > 0) {
++		struct xfs_attr3_rmt_hdr *rmt = (struct xfs_attr3_rmt_hdr *)ptr;
++
+ 		if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
+ 			xfs_buf_ioerror(bp, -EFSCORRUPTED);
+ 			xfs_verifier_error(bp);
+ 			return;
+ 		}
+-		if (bip) {
+-			struct xfs_attr3_rmt_hdr *rmt;
+ 
+-			rmt = (struct xfs_attr3_rmt_hdr *)ptr;
+-			rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
++		/*
++		 * Ensure we aren't writing bogus LSNs to disk. See
++		 * xfs_attr3_rmt_hdr_set() for the explanation.
++		 */
++		if (rmt->rm_lsn != cpu_to_be64(NULLCOMMITLSN)) {
++			xfs_buf_ioerror(bp, -EFSCORRUPTED);
++			xfs_verifier_error(bp);
++			return;
+ 		}
+ 		xfs_update_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF);
+ 
+@@ -221,6 +226,18 @@ xfs_attr3_rmt_hdr_set(
+ 	rmt->rm_owner = cpu_to_be64(ino);
+ 	rmt->rm_blkno = cpu_to_be64(bno);
+ 
++	/*
++	 * Remote attribute blocks are written synchronously, so we don't
++	 * have an LSN that we can stamp in them that makes any sense to log
++	 * recovery. To ensure that log recovery handles overwrites of these
++	 * blocks sanely (i.e. once they've been freed and reallocated as some
++	 * other type of metadata) we need to ensure that the LSN has a value
++	 * that tells log recovery to ignore the LSN and overwrite the buffer
++	 * with whatever is in it's log. To do this, we use the magic
++	 * NULLCOMMITLSN to indicate that the LSN is invalid.
++	 */
++	rmt->rm_lsn = cpu_to_be64(NULLCOMMITLSN);
++
+ 	return sizeof(struct xfs_attr3_rmt_hdr);
+ }
+ 
+@@ -434,14 +451,21 @@ xfs_attr_rmtval_set(
+ 
+ 		/*
+ 		 * Allocate a single extent, up to the size of the value.
++		 *
++		 * Note that we have to consider this a data allocation as we
++		 * write the remote attribute without logging the contents.
++		 * Hence we must ensure that we aren't using blocks that are on
++		 * the busy list so that we don't overwrite blocks which have
++		 * recently been freed but their transactions are not yet
++		 * committed to disk. If we overwrite the contents of a busy
++		 * extent and then crash then the block may not contain the
++		 * correct metadata after log recovery occurs.
+ 		 */
+ 		xfs_bmap_init(args->flist, args->firstblock);
+ 		nmap = 1;
+ 		error = xfs_bmapi_write(args->trans, dp, (xfs_fileoff_t)lblkno,
+-				  blkcnt,
+-				  XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA,
+-				  args->firstblock, args->total, &map, &nmap,
+-				  args->flist);
++				  blkcnt, XFS_BMAPI_ATTRFORK, args->firstblock,
++				  args->total, &map, &nmap, args->flist);
+ 		if (!error) {
+ 			error = xfs_bmap_finish(&args->trans, args->flist,
+ 						&committed);
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 4f5784f..a5d0339 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -1887,9 +1887,14 @@ xlog_recover_get_buf_lsn(
+ 		uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
+ 		break;
+ 	case XFS_ATTR3_RMT_MAGIC:
+-		lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+-		uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
+-		break;
++		/*
++		 * Remote attr blocks are written synchronously, rather than
++		 * being logged. That means they do not contain a valid LSN
++		 * (i.e. transactionally ordered) in them, and hence any time we
++		 * see a buffer to replay over the top of a remote attribute
++		 * block we should simply do so.
++		 */
++		goto recover_immediately;
+ 	case XFS_SB_MAGIC:
+ 		lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+ 		uuid = &((struct xfs_dsb *)blk)->sb_uuid;
+diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
+index b6a52a4..51bb653 100644
+--- a/include/linux/can/skb.h
++++ b/include/linux/can/skb.h
+@@ -27,10 +27,12 @@
+ /**
+  * struct can_skb_priv - private additional data inside CAN sk_buffs
+  * @ifindex:	ifindex of the first interface the CAN frame appeared on
++ * @skbcnt:	atomic counter to have an unique id together with skb pointer
+  * @cf:		align to the following CAN frame at skb->data
+  */
+ struct can_skb_priv {
+ 	int ifindex;
++	int skbcnt;
+ 	struct can_frame cf[0];
+ };
+ 
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index 76abba4..dcacb1a 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx {
+ 	__u64	mm_reg_addr;
+ };
+ 
+-/* Memory Error Section */
++/* Old Memory Error Section UEFI 2.1, 2.2 */
++struct cper_sec_mem_err_old {
++	__u64	validation_bits;
++	__u64	error_status;
++	__u64	physical_addr;
++	__u64	physical_addr_mask;
++	__u16	node;
++	__u16	card;
++	__u16	module;
++	__u16	bank;
++	__u16	device;
++	__u16	row;
++	__u16	column;
++	__u16	bit_pos;
++	__u64	requestor_id;
++	__u64	responder_id;
++	__u64	target_id;
++	__u8	error_type;
++};
++
++/* Memory Error Section UEFI >= 2.3 */
+ struct cper_sec_mem_err {
+ 	__u64	validation_bits;
+ 	__u64	error_status;
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index 1da6029..6cd8c0e 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
+  *            SAVE_REGS. If another ops with this flag set is already registered
+  *            for any of the functions that this ops will be registered for, then
+  *            this ops will fail to register or set_filter_ip.
++ * PID     - Is affected by set_ftrace_pid (allows filtering on those pids)
+  */
+ enum {
+ 	FTRACE_OPS_FL_ENABLED			= 1 << 0,
+@@ -132,6 +133,7 @@ enum {
+ 	FTRACE_OPS_FL_MODIFYING			= 1 << 11,
+ 	FTRACE_OPS_FL_ALLOC_TRAMP		= 1 << 12,
+ 	FTRACE_OPS_FL_IPMODIFY			= 1 << 13,
++	FTRACE_OPS_FL_PID			= 1 << 14,
+ };
+ 
+ #ifdef CONFIG_DYNAMIC_FTRACE
+@@ -159,6 +161,7 @@ struct ftrace_ops {
+ 	struct ftrace_ops		*next;
+ 	unsigned long			flags;
+ 	void				*private;
++	ftrace_func_t			saved_func;
+ 	int __percpu			*disabled;
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ 	int				nr_trampolines;
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index 54e7af3..73abbc5 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -606,6 +606,7 @@ struct iscsi_conn {
+ 	int			bitmap_id;
+ 	int			rx_thread_active;
+ 	struct task_struct	*rx_thread;
++	struct completion	rx_login_comp;
+ 	int			tx_thread_active;
+ 	struct task_struct	*tx_thread;
+ 	/* list_head for session connection list */
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107..7a5237a 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ 		    !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ 			/*
+-			 * If the interrupt has a parent irq and runs
+-			 * in the thread context of the parent irq,
+-			 * retrigger the parent.
++			 * If the interrupt is running in the thread
++			 * context of the parent irq we need to be
++			 * careful, because we cannot trigger it
++			 * directly.
+ 			 */
+-			if (desc->parent_irq &&
+-			    irq_settings_is_nested_thread(desc))
++			if (irq_settings_is_nested_thread(desc)) {
++				/*
++				 * If the parent_irq is valid, we
++				 * retrigger the parent, otherwise we
++				 * do nothing.
++				 */
++				if (!desc->parent_irq)
++					return;
+ 				irq = desc->parent_irq;
++			}
+ 			/* Set it pending and activate the softirq: */
+ 			set_bit(irq, irqs_resend);
+ 			tasklet_schedule(&resend_tasklet);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 02bece4..eb11011 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -98,6 +98,13 @@ struct ftrace_pid {
+ 	struct pid *pid;
+ };
+ 
++static bool ftrace_pids_enabled(void)
++{
++	return !list_empty(&ftrace_pids);
++}
++
++static void ftrace_update_trampoline(struct ftrace_ops *ops);
++
+ /*
+  * ftrace_disabled is set when an anomaly is discovered.
+  * ftrace_disabled is much stronger than ftrace_enabled.
+@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
+ static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
+ static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
+ ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
+-ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
+ static struct ftrace_ops global_ops;
+ static struct ftrace_ops control_ops;
+ 
+@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
+ 	if (!test_tsk_trace_trace(current))
+ 		return;
+ 
+-	ftrace_pid_function(ip, parent_ip, op, regs);
+-}
+-
+-static void set_ftrace_pid_function(ftrace_func_t func)
+-{
+-	/* do not set ftrace_pid_function to itself! */
+-	if (func != ftrace_pid_func)
+-		ftrace_pid_function = func;
++	op->saved_func(ip, parent_ip, op, regs);
+ }
+ 
+ /**
+@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
+ void clear_ftrace_function(void)
+ {
+ 	ftrace_trace_function = ftrace_stub;
+-	ftrace_pid_function = ftrace_stub;
+ }
+ 
+ static void control_ops_disable_all(struct ftrace_ops *ops)
+@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
+ 	} else
+ 		add_ftrace_ops(&ftrace_ops_list, ops);
+ 
++	/* Always save the function, and reset at unregistering */
++	ops->saved_func = ops->func;
++
++	if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
++		ops->func = ftrace_pid_func;
++
+ 	ftrace_update_trampoline(ops);
+ 
+ 	if (ftrace_enabled)
+@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ 	if (ftrace_enabled)
+ 		update_ftrace_function();
+ 
++	ops->func = ops->saved_func;
++
+ 	return 0;
+ }
+ 
+ static void ftrace_update_pid_func(void)
+ {
++	bool enabled = ftrace_pids_enabled();
++	struct ftrace_ops *op;
++
+ 	/* Only do something if we are tracing something */
+ 	if (ftrace_trace_function == ftrace_stub)
+ 		return;
+ 
++	do_for_each_ftrace_op(op, ftrace_ops_list) {
++		if (op->flags & FTRACE_OPS_FL_PID) {
++			op->func = enabled ? ftrace_pid_func :
++				op->saved_func;
++			ftrace_update_trampoline(op);
++		}
++	} while_for_each_ftrace_op(op);
++
+ 	update_ftrace_function();
+ }
+ 
+@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
+ 	.local_hash.filter_hash		= EMPTY_HASH,
+ 	INIT_OPS_HASH(global_ops)
+ 	.flags				= FTRACE_OPS_FL_RECURSION_SAFE |
+-					  FTRACE_OPS_FL_INITIALIZED,
++					  FTRACE_OPS_FL_INITIALIZED |
++					  FTRACE_OPS_FL_PID,
+ };
+ 
+ /*
+@@ -5023,7 +5041,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
+ 
+ static struct ftrace_ops global_ops = {
+ 	.func			= ftrace_stub,
+-	.flags			= FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
++	.flags			= FTRACE_OPS_FL_RECURSION_SAFE |
++				  FTRACE_OPS_FL_INITIALIZED |
++				  FTRACE_OPS_FL_PID,
+ };
+ 
+ static int __init ftrace_nodyn_init(void)
+@@ -5080,11 +5100,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
+ 		if (WARN_ON(tr->ops->func != ftrace_stub))
+ 			printk("ftrace ops had %pS for function\n",
+ 			       tr->ops->func);
+-		/* Only the top level instance does pid tracing */
+-		if (!list_empty(&ftrace_pids)) {
+-			set_ftrace_pid_function(func);
+-			func = ftrace_pid_func;
+-		}
+ 	}
+ 	tr->ops->func = func;
+ 	tr->ops->private = tr;
+@@ -5371,7 +5386,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
+ {
+ 	mutex_lock(&ftrace_lock);
+ 
+-	if (list_empty(&ftrace_pids) && (!*pos))
++	if (!ftrace_pids_enabled() && (!*pos))
+ 		return (void *) 1;
+ 
+ 	return seq_list_start(&ftrace_pids, *pos);
+@@ -5610,6 +5625,7 @@ static struct ftrace_ops graph_ops = {
+ 	.func			= ftrace_stub,
+ 	.flags			= FTRACE_OPS_FL_RECURSION_SAFE |
+ 				   FTRACE_OPS_FL_INITIALIZED |
++				   FTRACE_OPS_FL_PID |
+ 				   FTRACE_OPS_FL_STUB,
+ #ifdef FTRACE_GRAPH_TRAMP_ADDR
+ 	.trampoline		= FTRACE_GRAPH_TRAMP_ADDR,
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index ae4b65e..dace71f 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -574,6 +574,9 @@ void debug_dma_assert_idle(struct page *page)
+ 	unsigned long flags;
+ 	phys_addr_t cln;
+ 
++	if (dma_debug_disabled())
++		return;
++
+ 	if (!page)
+ 		return;
+ 
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 689c818..62c635f 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -89,6 +89,8 @@ struct timer_list can_stattimer;   /* timer for statistics update */
+ struct s_stats    can_stats;       /* packet statistics */
+ struct s_pstats   can_pstats;      /* receive list statistics */
+ 
++static atomic_t skbcounter = ATOMIC_INIT(0);
++
+ /*
+  * af_can socket functions
+  */
+@@ -310,12 +312,8 @@ int can_send(struct sk_buff *skb, int loop)
+ 		return err;
+ 	}
+ 
+-	if (newskb) {
+-		if (!(newskb->tstamp.tv64))
+-			__net_timestamp(newskb);
+-
++	if (newskb)
+ 		netif_rx_ni(newskb);
+-	}
+ 
+ 	/* update statistics */
+ 	can_stats.tx_frames++;
+@@ -683,6 +681,10 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
+ 	can_stats.rx_frames++;
+ 	can_stats.rx_frames_delta++;
+ 
++	/* create non-zero unique skb identifier together with *skb */
++	while (!(can_skb_prv(skb)->skbcnt))
++		can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
++
+ 	rcu_read_lock();
+ 
+ 	/* deliver the packet to sockets listening on all devices */
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index b523453..a1ba687 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -261,6 +261,7 @@ static void bcm_can_tx(struct bcm_op *op)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	memcpy(skb_put(skb, CFSIZ), cf, CFSIZ);
+ 
+@@ -1217,6 +1218,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
+ 	}
+ 
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 	skb->dev = dev;
+ 	can_skb_set_owner(skb, sk);
+ 	err = can_send(skb, 1); /* send with loopback */
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 31b9748..2e67b14 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -75,7 +75,7 @@ MODULE_ALIAS("can-proto-1");
+  */
+ 
+ struct uniqframe {
+-	ktime_t tstamp;
++	int skbcnt;
+ 	const struct sk_buff *skb;
+ 	unsigned int join_rx_count;
+ };
+@@ -133,7 +133,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+ 
+ 	/* eliminate multiple filter matches for the same skb */
+ 	if (this_cpu_ptr(ro->uniq)->skb == oskb &&
+-	    ktime_equal(this_cpu_ptr(ro->uniq)->tstamp, oskb->tstamp)) {
++	    this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
+ 		if (ro->join_filters) {
+ 			this_cpu_inc(ro->uniq->join_rx_count);
+ 			/* drop frame until all enabled filters matched */
+@@ -144,7 +144,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+ 		}
+ 	} else {
+ 		this_cpu_ptr(ro->uniq)->skb = oskb;
+-		this_cpu_ptr(ro->uniq)->tstamp = oskb->tstamp;
++		this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
+ 		this_cpu_ptr(ro->uniq)->join_rx_count = 1;
+ 		/* drop first frame to check all enabled filters? */
+ 		if (ro->join_filters && ro->count > 1)
+@@ -749,6 +749,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+ 
+ 	can_skb_reserve(skb);
+ 	can_skb_prv(skb)->ifindex = dev->ifindex;
++	can_skb_prv(skb)->skbcnt = 0;
+ 
+ 	err = memcpy_from_msg(skb_put(skb, size), msg, size);
+ 	if (err < 0)
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 29236e8..c09c013 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+ 
+ 	debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ 	sdata->vif.debugfs_dir = NULL;
++	sdata->debugfs.subdir_stations = NULL;
+ }
+ 
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index 273b8bf..657ba9f 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ 	}
+ 
+ 	ibmr = rds_ib_alloc_fmr(rds_ibdev);
+-	if (IS_ERR(ibmr))
++	if (IS_ERR(ibmr)) {
++		rds_ib_dev_put(rds_ibdev);
+ 		return ibmr;
++	}
+ 
+ 	ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ 	if (ret == 0)
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index d126c03..75888dd 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -85,7 +85,7 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
+ void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
+ {
+ 	if (substream->pcm->nonatomic) {
+-		down_read(&snd_pcm_link_rwsem);
++		down_read_nested(&snd_pcm_link_rwsem, SINGLE_DEPTH_NESTING);
+ 		mutex_lock(&substream->self_group.mutex);
+ 	} else {
+ 		read_lock(&snd_pcm_link_rwlock);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c403dd1..44dfc7b 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2056,6 +2056,8 @@ static const struct pci_device_id azx_ids[] = {
+ 	/* ATI HDMI */
+ 	{ PCI_DEVICE(0x1002, 0x1308),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0x157a),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	{ PCI_DEVICE(0x1002, 0x793b),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ 	{ PCI_DEVICE(0x1002, 0x7919),
+@@ -2110,8 +2112,14 @@ static const struct pci_device_id azx_ids[] = {
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	{ PCI_DEVICE(0x1002, 0xaab0),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0xaac0),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	{ PCI_DEVICE(0x1002, 0xaac8),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0xaad8),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++	{ PCI_DEVICE(0x1002, 0xaae8),
++	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ 	/* VIA VT8251/VT8237A */
+ 	{ PCI_DEVICE(0x1106, 0x3288),
+ 	  .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 5f44f60..225b78b 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3333,6 +3333,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0070, .name = "GPU 70 HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de0071, .name = "GPU 71 HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de0072, .name = "GPU 72 HDMI/DP",	.patch = patch_nvhdmi },
++{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP",	.patch = patch_nvhdmi },
+ { .id = 0x10de8001, .name = "MCP73 HDMI",	.patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+ { .id = 0x11069f81, .name = "VX900 HDMI/DP",	.patch = patch_via_hdmi },
+@@ -3396,6 +3397,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de0070");
+ MODULE_ALIAS("snd-hda-codec-id:10de0071");
+ MODULE_ALIAS("snd-hda-codec-id:10de0072");
++MODULE_ALIAS("snd-hda-codec-id:10de007d");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
+ MODULE_ALIAS("snd-hda-codec-id:11069f81");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0e75998..590bcfb0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2224,7 +2224,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ 	SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+-	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++	SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+ 
+ 	SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ 	SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+@@ -5004,7 +5004,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ 			{ 0x14, 0x90170110 },
+ 			{ 0x17, 0x40000008 },
+ 			{ 0x18, 0x411111f0 },
+-			{ 0x19, 0x411111f0 },
++			{ 0x19, 0x01a1913c },
+ 			{ 0x1a, 0x411111f0 },
+ 			{ 0x1b, 0x411111f0 },
+ 			{ 0x1d, 0x40f89b2d },
+@@ -5114,6 +5114,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
++	SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ 	SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -5382,6 +5383,17 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ 		{0x1d, 0x40700001},
+ 		{0x21, 0x02211030}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++		{0x12, 0x40000000},
++		{0x14, 0x90170130},
++		{0x17, 0x411111f0},
++		{0x18, 0x411111f0},
++		{0x19, 0x411111f0},
++		{0x1a, 0x411111f0},
++		{0x1b, 0x01014020},
++		{0x1d, 0x4054c029},
++		{0x1e, 0x411111f0},
++		{0x21, 0x0221103f}),
++	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		{0x12, 0x90a60160},
+ 		{0x14, 0x90170120},
+ 		{0x17, 0x90170140},
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 6c66d7e..25f0f45 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2920,7 +2920,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
+ 		      "HP Mini", STAC_92HD83XXX_HP_LED),
+ 	SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
+-	SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
++	/* match both for 0xfa91 and 0xfa93 */
++	SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_TOSHIBA, 0xfffd, 0xfa91,
+ 		      "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
+ 	{} /* terminator */
+ };
+diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
+index 8461d6b..204cc07 100644
+--- a/sound/usb/line6/pcm.c
++++ b/sound/usb/line6/pcm.c
+@@ -186,12 +186,8 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
+ 	int ret = 0;
+ 
+ 	spin_lock_irqsave(&pstr->lock, flags);
+-	if (!test_and_set_bit(type, &pstr->running)) {
+-		if (pstr->active_urbs || pstr->unlink_urbs) {
+-			ret = -EBUSY;
+-			goto error;
+-		}
+-
++	if (!test_and_set_bit(type, &pstr->running) &&
++	    !(pstr->active_urbs || pstr->unlink_urbs)) {
+ 		pstr->count = 0;
+ 		/* Submit all currently available URBs */
+ 		if (direction == SNDRV_PCM_STREAM_PLAYBACK)
+@@ -199,7 +195,6 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
+ 		else
+ 			ret = line6_submit_audio_in_all_urbs(line6pcm);
+ 	}
+- error:
+ 	if (ret < 0)
+ 		clear_bit(type, &pstr->running);
+ 	spin_unlock_irqrestore(&pstr->lock, flags);
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index e5000da..6a803ef 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -341,6 +341,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ 	{ 0 }
+ };
+ 
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++	{ 3, NULL, .dB = &bose_companion5_dB },
++	{ 0 }	/* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++	{ 7, NULL, .dB = &dragonfly_1_2_dB },
++	{ 0 }	/* terminator */
++};
++
+ /*
+  * Control map entries
+  */
+@@ -451,6 +465,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.id = USB_ID(0x25c4, 0x0003),
+ 		.map = scms_usb3318_map,
+ 	},
++	{
++		/* Bose Companion 5 */
++		.id = USB_ID(0x05a7, 0x1020),
++		.map = bose_companion5_map,
++	},
++	{
++		/* Dragonfly DAC 1.2 */
++		.id = USB_ID(0x21b4, 0x0081),
++		.map = dragonfly_1_2_map,
++	},
+ 	{ 0 } /* terminator */
+ };
+ 
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 2f6d3e9..e475665 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2512,6 +2512,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ 	}
+ },
+ 
++/* Steinberg devices */
++{
++	/* Steinberg MI2 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++{
++	/* Steinberg MI4 */
++	USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++		.ifnum = QUIRK_ANY_INTERFACE,
++		.type = QUIRK_COMPOSITE,
++		.data = & (const struct snd_usb_audio_quirk[]) {
++			{
++				.ifnum = 0,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 1,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 2,
++				.type = QUIRK_AUDIO_STANDARD_INTERFACE
++			},
++			{
++				.ifnum = 3,
++				.type = QUIRK_MIDI_FIXED_ENDPOINT,
++				.data = &(const struct snd_usb_midi_endpoint_info) {
++					.out_cables = 0x0001,
++					.in_cables  = 0x0001
++				}
++			},
++			{
++				.ifnum = -1
++			}
++		}
++	}
++},
++
+ /* TerraTec devices */
+ {
+ 	USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index 995b7a8..658b0a8 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -45,7 +45,7 @@ static struct rb_node *hists__filter_entries(struct rb_node *nd,
+ 
+ static bool hist_browser__has_filter(struct hist_browser *hb)
+ {
+-	return hists__has_filter(hb->hists) || hb->min_pcnt;
++	return hists__has_filter(hb->hists) || hb->min_pcnt || symbol_conf.has_filter;
+ }
+ 
+ static int hist_browser__get_folding(struct hist_browser *browser)
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 201f6c4c..99378a5 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1893,6 +1893,8 @@ int setup_intlist(struct intlist **list, const char *list_str,
+ 		pr_err("problems parsing %s list\n", list_name);
+ 		return -1;
+ 	}
++
++	symbol_conf.has_filter = true;
+ 	return 0;
+ }
+ 
+diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
+index 0956150..be02179 100644
+--- a/tools/perf/util/symbol.h
++++ b/tools/perf/util/symbol.h
+@@ -105,7 +105,8 @@ struct symbol_conf {
+ 			demangle_kernel,
+ 			filter_relative,
+ 			show_hist_headers,
+-			branch_callstack;
++			branch_callstack,
++			has_filter;
+ 	const char	*vmlinux_name,
+ 			*kallsyms_name,
+ 			*source_prefix,
diff --git a/4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch b/4.1.5/4420_grsecurity-3.1-4.1.5-201508102129.patch
index 95b7d51..c6671a0 100644
--- a/4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch
+++ b/4.1.5/4420_grsecurity-3.1-4.1.5-201508102129.patch
@@ -235,7 +235,7 @@ index 9de9813..1462492 100644
 +zconf.lex.c
  zoffset.h
 diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
-index 74b6c6d..eac0e77 100644
+index d2b1c40..3e90a74 100644
 --- a/Documentation/kbuild/makefiles.txt
 +++ b/Documentation/kbuild/makefiles.txt
 @@ -23,10 +23,11 @@ This document describes the Linux kernel Makefiles.
@@ -406,7 +406,7 @@ index c831001..1bfbbf6 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 36f3225..414e93e 100644
+index 068dd69..e4ad6b7 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -299,7 +299,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -515,7 +515,7 @@ index 36f3225..414e93e 100644
  endif
  ifdef CONFIG_DEBUG_INFO_DWARF4
  KBUILD_CFLAGS	+= $(call cc-option, -gdwarf-4,)
-@@ -883,7 +953,7 @@ export mod_sign_cmd
+@@ -884,7 +954,7 @@ export mod_sign_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -524,7 +524,7 @@ index 36f3225..414e93e 100644
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -933,6 +1003,8 @@ endif
+@@ -934,6 +1004,8 @@ endif
  
  # The actual objects are generated when descending,
  # make sure no implicit rule kicks in
@@ -533,7 +533,7 @@ index 36f3225..414e93e 100644
  $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
  
  # Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -942,7 +1014,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
+@@ -943,7 +1015,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
  # Error messages still appears in the original language
  
  PHONY += $(vmlinux-dirs)
@@ -542,7 +542,7 @@ index 36f3225..414e93e 100644
  	$(Q)$(MAKE) $(build)=$@
  
  define filechk_kernel.release
-@@ -985,10 +1057,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
+@@ -986,10 +1058,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
  
  archprepare: archheaders archscripts prepare1 scripts_basic
  
@@ -556,7 +556,7 @@ index 36f3225..414e93e 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1096,6 +1171,8 @@ all: modules
+@@ -1097,6 +1172,8 @@ all: modules
  # using awk while concatenating to the final file.
  
  PHONY += modules
@@ -565,7 +565,7 @@ index 36f3225..414e93e 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1111,7 +1188,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1112,7 +1189,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -574,7 +574,7 @@ index 36f3225..414e93e 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1177,7 +1254,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
+@@ -1178,7 +1255,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
  		  Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
  		  signing_key.priv signing_key.x509 x509.genkey		\
  		  extra_certificates signing_key.x509.keyid		\
@@ -586,7 +586,7 @@ index 36f3225..414e93e 100644
  
  # clean - Delete most, but leave enough to build external modules
  #
-@@ -1216,7 +1296,7 @@ distclean: mrproper
+@@ -1217,7 +1297,7 @@ distclean: mrproper
  	@find $(srctree) $(RCS_FIND_IGNORE) \
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -595,7 +595,7 @@ index 36f3225..414e93e 100644
  		-type f -print | xargs rm -f
  
  
-@@ -1382,6 +1462,8 @@ PHONY += $(module-dirs) modules
+@@ -1383,6 +1463,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -604,7 +604,7 @@ index 36f3225..414e93e 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1522,17 +1604,21 @@ else
+@@ -1523,17 +1605,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -630,7 +630,7 @@ index 36f3225..414e93e 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1544,11 +1630,15 @@ endif
+@@ -1545,11 +1631,15 @@ endif
  	$(build)=$(build-dir)
  # Make sure the latest headers are built for Documentation
  Documentation/: headers_install
@@ -5845,10 +5845,10 @@ index 4efe96a..60e8699 100644
  #define SMP_CACHE_BYTES	L1_CACHE_BYTES
  
 diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index f501665..b107753 100644
+index a3b1ffe..7d61ca6 100644
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -2585,6 +2585,7 @@ source "kernel/Kconfig.preempt"
+@@ -2586,6 +2586,7 @@ source "kernel/Kconfig.preempt"
  
  config KEXEC
  	bool "Kexec system call"
@@ -7355,7 +7355,7 @@ index 78c9fd3..42fa66a 100644
     instruction set this CPU supports.  This could be done in user space,
     but it's not easy, and we've already done it here.  */
 diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
-index 3a08eae..08fef28 100644
+index 3edbb9f..08fef28 100644
 --- a/arch/parisc/include/asm/pgalloc.h
 +++ b/arch/parisc/include/asm/pgalloc.h
 @@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
@@ -7370,24 +7370,7 @@ index 3a08eae..08fef28 100644
  static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
  {
  	pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
-@@ -72,7 +77,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
- 
- static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- {
--	if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
-+	if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
- 		/*
- 		 * This is the permanent pmd attached to the pgd;
- 		 * cannot free it.
-@@ -81,6 +86,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- 		 */
- 		mm_inc_nr_pmds(mm);
- 		return;
-+	}
- 	free_pages((unsigned long)pmd, PMD_ORDER);
- }
- 
-@@ -96,6 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+@@ -97,6 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
  #define pmd_alloc_one(mm, addr)		({ BUG(); ((pmd_t *)2); })
  #define pmd_free(mm, x)			do { } while (0)
  #define pgd_populate(mm, pmd, pte)	BUG()
@@ -7396,10 +7379,10 @@ index 3a08eae..08fef28 100644
  #endif
  
 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 0a18375..d613939 100644
+index f93c4a4..cfd5663 100644
 --- a/arch/parisc/include/asm/pgtable.h
 +++ b/arch/parisc/include/asm/pgtable.h
-@@ -213,6 +213,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+@@ -231,6 +231,17 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
  #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
  #define PAGE_COPY       PAGE_EXECREAD
  #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -7610,10 +7593,10 @@ index 5aba01a..47cdd5a 100644
  		mm->mmap_base = mm->mmap_legacy_base;
  		mm->get_unmapped_area = arch_get_unmapped_area;
 diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 47ee620..1107387 100644
+index 7f67c4c..d85c11d 100644
 --- a/arch/parisc/kernel/traps.c
 +++ b/arch/parisc/kernel/traps.c
-@@ -726,9 +726,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+@@ -722,9 +722,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
  
  			down_read(&current->mm->mmap_sem);
  			vma = find_vma(current->mm,regs->iaoq[0]);
@@ -9699,7 +9682,7 @@ index 0c1a679..e1df357 100644
  		if (r_type == R_390_GOTPC)
  			rc = apply_rela_bits(loc, val, 1, 32, 0);
 diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
-index dc5edc2..7d34ae3 100644
+index 8f587d8..0642516b 100644
 --- a/arch/s390/kernel/process.c
 +++ b/arch/s390/kernel/process.c
 @@ -200,27 +200,3 @@ unsigned long get_wchan(struct task_struct *p)
@@ -10567,6 +10550,40 @@ index a35194b..47dabc0d 100644
  	if (unlikely(ret))
  		ret = copy_to_user_fixup(to, from, size);
  	return ret;
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 1f0aa20..6424249 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+  * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+ 
+ #define VISEntryHalf					\
+-	rd		%fprs, %o5;			\
+-	andcc		%o5, FPRS_FEF, %g0;		\
+-	be,pt		%icc, 297f;			\
+-	 sethi		%hi(298f), %g7;			\
+-	sethi		%hi(VISenterhalf), %g1;		\
+-	jmpl		%g1 + %lo(VISenterhalf), %g0;	\
+-	 or		%g7, %lo(298f), %g7;		\
+-	clr		%o5;				\
+-297:	wr		%o5, FPRS_FEF, %fprs;		\
+-298:
++	VISEntry
++
++#define VISExitHalf					\
++	VISExit
+ 
+ #define VISEntryHalfFast(fail_label)			\
+ 	rd		%fprs, %o5;			\
+@@ -47,7 +41,7 @@
+ 	ba,a,pt		%xcc, fail_label;		\
+ 297:	wr		%o5, FPRS_FEF, %fprs;
+ 
+-#define VISExitHalf					\
++#define VISExitHalfFast					\
+ 	wr		%o5, 0, %fprs;
+ 
+ #ifndef __ASSEMBLY__
 diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
 index 7cf9c6e..6206648 100644
 --- a/arch/sparc/kernel/Makefile
@@ -11217,6 +11234,105 @@ index 3269b02..64f5231 100644
  
  lib-$(CONFIG_SPARC32) += ashrdi3.o
  lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a..83aeeb1 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
+ 	add		%o0, 0x40, %o0
+ 	bne,pt		%icc, 1b
+ 	 LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++	VISExitHalfFast
++#else
+ 	VISExitHalf
+-
++#endif
+ 	brz,pn		%o2, .Lexit
+ 	 cmp		%o2, 19
+ 	ble,pn		%icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9..a063d84 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
+ 
+ 	 stx		%g3, [%g6 + TI_GSR]
+ 2:	add		%g6, %g1, %g3
+-	cmp		%o5, FPRS_DU
+-	be,pn		%icc, 6f
+-	 sll		%g1, 3, %g1
++	mov		FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++	sll		%g1, 3, %g1
+ 	stb		%o5, [%g3 + TI_FPSAVED]
+ 	rd		%gsr, %g2
+ 	add		%g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1:	ldub		[%g6 + TI_FPSAVED], %g3
+ 	.align		32
+ 80:	jmpl		%g7 + %g0, %g0
+ 	 nop
+-
+-6:	ldub		[%g3 + TI_FPSAVED], %o5
+-	or		%o5, FPRS_DU, %o5
+-	add		%g6, TI_FPREGS+0x80, %g2
+-	stb		%o5, [%g3 + TI_FPSAVED]
+-
+-	sll		%g1, 5, %g1
+-	add		%g6, TI_FPREGS+0xc0, %g3
+-	wr		%g0, FPRS_FEF, %fprs
+-	membar		#Sync
+-	stda		%f32, [%g2 + %g1] ASI_BLK_P
+-	stda		%f48, [%g3 + %g1] ASI_BLK_P
+-	membar		#Sync
+-	ba,pt		%xcc, 80f
+-	 nop
+-
+-	.align		32
+-80:	jmpl		%g7 + %g0, %g0
+-	 nop
+-
+-	.align		32
+-VISenterhalf:
+-	ldub		[%g6 + TI_FPDEPTH], %g1
+-	brnz,a,pn	%g1, 1f
+-	 cmp		%g1, 1
+-	stb		%g0, [%g6 + TI_FPSAVED]
+-	stx		%fsr, [%g6 + TI_XFSR]
+-	clr		%o5
+-	jmpl		%g7 + %g0, %g0
+-	 wr		%g0, FPRS_FEF, %fprs
+-
+-1:	bne,pn		%icc, 2f
+-	 srl		%g1, 1, %g1
+-	ba,pt		%xcc, vis1
+-	 sub		%g7, 8, %g7
+-2:	addcc		%g6, %g1, %g3
+-	sll		%g1, 3, %g1
+-	andn		%o5, FPRS_DU, %g2
+-	stb		%g2, [%g3 + TI_FPSAVED]
+-
+-	rd		%gsr, %g2
+-	add		%g6, %g1, %g3
+-	stx		%g2, [%g3 + TI_GSR]
+-	add		%g6, %g1, %g2
+-	stx		%fsr, [%g2 + TI_XFSR]
+-	sll		%g1, 5, %g1
+-3:	andcc		%o5, FPRS_DL, %g0
+-	be,pn		%icc, 4f
+-	 add		%g6, TI_FPREGS, %g2
+-
+-	add		%g6, TI_FPREGS+0x40, %g3
+-	membar		#Sync
+-	stda		%f0, [%g2 + %g1] ASI_BLK_P
+-	stda		%f16, [%g3 + %g1] ASI_BLK_P
+-	membar		#Sync
+-	ba,pt		%xcc, 4f
+-	 nop
+-
+-	.align		32
+-4:	and		%o5, FPRS_DU, %o5
+-	jmpl		%g7 + %g0, %g0
+-	 wr		%o5, FPRS_FEF, %fprs
 diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
 index 05dac43..76f8ed4 100644
 --- a/arch/sparc/lib/atomic_64.S
@@ -11339,7 +11455,7 @@ index 05dac43..76f8ed4 100644
  ENTRY(atomic64_dec_if_positive) /* %o0 = atomic_ptr */
  	BACKOFF_SETUP(%o2)
 diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 1d649a9..fbc5bfc 100644
+index 1d649a9..c2e23c4 100644
 --- a/arch/sparc/lib/ksyms.c
 +++ b/arch/sparc/lib/ksyms.c
 @@ -101,7 +101,9 @@ EXPORT_SYMBOL(__clear_user);
@@ -11362,6 +11478,17 @@ index 1d649a9..fbc5bfc 100644
  ATOMIC_OPS(sub)
  
  #undef ATOMIC_OPS
+@@ -135,10 +139,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+ 
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ 		unsigned long *);
 diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
 index 30c3ecc..736f015 100644
 --- a/arch/sparc/mm/Makefile
@@ -12840,21 +12967,6 @@ index 0a291cd..9686efc 100644
  
  KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
  GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 48304b8..0cdc154 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct boot_params *params,
- 		unsigned int e820_type = 0;
- 		unsigned long m = efi->efi_memmap;
- 
-+#ifdef CONFIG_X86_64
-+		m |= (u64)efi->efi_memmap_hi << 32;
-+#endif
-+
- 		d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
- 		switch (d->type) {
- 		case EFI_RESERVED_TYPE:
 diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
 index a53440e..c3dbf1e 100644
 --- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -16540,19 +16652,20 @@ index acdee09..a553db3 100644
  struct compat_timespec {
  	compat_time_t	tv_sec;
 diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 3d6606f..91703f1 100644
+index 3d6606f..300641d 100644
 --- a/arch/x86/include/asm/cpufeature.h
 +++ b/arch/x86/include/asm/cpufeature.h
-@@ -214,7 +214,7 @@
+@@ -214,7 +214,8 @@
  #define X86_FEATURE_PAUSEFILTER ( 8*32+13) /* AMD filtered pause intercept */
  #define X86_FEATURE_PFTHRESHOLD ( 8*32+14) /* AMD pause filter threshold */
  #define X86_FEATURE_VMMCALL     ( 8*32+15) /* Prefer vmmcall to vmcall */
 -
++#define X86_FEATURE_PCIDUDEREF	( 8*32+30) /* PaX PCID based UDEREF */
 +#define X86_FEATURE_STRONGUDEREF (8*32+31) /* PaX PCID based strong UDEREF */
  
  /* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
  #define X86_FEATURE_FSGSBASE	( 9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/
-@@ -222,7 +222,7 @@
+@@ -222,7 +223,7 @@
  #define X86_FEATURE_BMI1	( 9*32+ 3) /* 1st group bit manipulation extensions */
  #define X86_FEATURE_HLE		( 9*32+ 4) /* Hardware Lock Elision */
  #define X86_FEATURE_AVX2	( 9*32+ 5) /* AVX2 instructions */
@@ -16561,7 +16674,7 @@ index 3d6606f..91703f1 100644
  #define X86_FEATURE_BMI2	( 9*32+ 8) /* 2nd group bit manipulation extensions */
  #define X86_FEATURE_ERMS	( 9*32+ 9) /* Enhanced REP MOVSB/STOSB */
  #define X86_FEATURE_INVPCID	( 9*32+10) /* Invalidate Processor Context ID */
-@@ -401,6 +401,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
+@@ -401,6 +402,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
  #define cpu_has_eager_fpu	boot_cpu_has(X86_FEATURE_EAGER_FPU)
  #define cpu_has_topoext		boot_cpu_has(X86_FEATURE_TOPOEXT)
  #define cpu_has_bpext		boot_cpu_has(X86_FEATURE_BPEXT)
@@ -16569,17 +16682,17 @@ index 3d6606f..91703f1 100644
  
  #if __GNUC__ >= 4
  extern void warn_pre_alternatives(void);
-@@ -454,7 +455,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
+@@ -454,7 +456,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
  
  #ifdef CONFIG_X86_DEBUG_STATIC_CPU_HAS
  	t_warn:
 -		warn_pre_alternatives();
-+		if (bit != X86_FEATURE_PCID && bit != X86_FEATURE_INVPCID)
++		if (bit != X86_FEATURE_PCID && bit != X86_FEATURE_INVPCID && bit != X86_FEATURE_PCIDUDEREF)
 +			warn_pre_alternatives();
  		return false;
  #endif
  
-@@ -475,7 +477,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
+@@ -475,7 +478,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
  			     ".section .discard,\"aw\",@progbits\n"
  			     " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
  			     ".previous\n"
@@ -16588,7 +16701,7 @@ index 3d6606f..91703f1 100644
  			     "3: movb $1,%0\n"
  			     "4:\n"
  			     ".previous\n"
-@@ -510,7 +512,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
+@@ -510,7 +513,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
  			 " .byte 5f - 4f\n"		/* repl len */
  			 " .byte 3b - 2b\n"		/* pad len */
  			 ".previous\n"
@@ -16597,7 +16710,7 @@ index 3d6606f..91703f1 100644
  			 "4: jmp %l[t_no]\n"
  			 "5:\n"
  			 ".previous\n"
-@@ -545,7 +547,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
+@@ -545,7 +548,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
  			     ".section .discard,\"aw\",@progbits\n"
  			     " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
  			     ".previous\n"
@@ -16606,7 +16719,7 @@ index 3d6606f..91703f1 100644
  			     "3: movb $0,%0\n"
  			     "4:\n"
  			     ".previous\n"
-@@ -560,7 +562,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
+@@ -560,7 +563,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
  			     ".section .discard,\"aw\",@progbits\n"
  			     " .byte 0xff + (6f-5f) - (4b-3b)\n" /* size check */
  			     ".previous\n"
@@ -17453,7 +17566,7 @@ index 09b9620..923aecd 100644
  	atomic_t perf_rdpmc_allowed;	/* nonzero if rdpmc is allowed */
  } mm_context_t;
 diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
-index 883f6b93..bb405b5 100644
+index e997f70..5d819f7 100644
 --- a/arch/x86/include/asm/mmu_context.h
 +++ b/arch/x86/include/asm/mmu_context.h
 @@ -42,6 +42,20 @@ void destroy_context(struct mm_struct *mm);
@@ -17462,7 +17575,7 @@ index 883f6b93..bb405b5 100644
  {
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if (!(static_cpu_has(X86_FEATURE_PCID))) {
++	if (!(static_cpu_has(X86_FEATURE_PCIDUDEREF))) {
 +		unsigned int i;
 +		pgd_t *pgd;
 +
@@ -17500,7 +17613,7 @@ index 883f6b93..bb405b5 100644
 +		pax_open_kernel();
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		if (static_cpu_has(X86_FEATURE_PCID))
++		if (static_cpu_has(X86_FEATURE_PCIDUDEREF))
 +			__clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
 +		else
 +#endif
@@ -17511,7 +17624,7 @@ index 883f6b93..bb405b5 100644
 +		BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		if (static_cpu_has(X86_FEATURE_PCID)) {
++		if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
 +			if (static_cpu_has(X86_FEATURE_INVPCID)) {
 +				u64 descriptor[2];
 +				descriptor[0] = PCID_USER;
@@ -17568,7 +17681,7 @@ index 883f6b93..bb405b5 100644
 +		pax_open_kernel();
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		if (static_cpu_has(X86_FEATURE_PCID))
++		if (static_cpu_has(X86_FEATURE_PCIDUDEREF))
 +			__clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
 +		else
 +#endif
@@ -17579,7 +17692,7 @@ index 883f6b93..bb405b5 100644
 +		BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		if (static_cpu_has(X86_FEATURE_PCID)) {
++		if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
 +			if (static_cpu_has(X86_FEATURE_INVPCID)) {
 +				u64 descriptor[2];
 +				descriptor[0] = PCID_USER;
@@ -19416,10 +19529,10 @@ index b4bdec3..e8af9bc 100644
  #endif
  #endif /* _ASM_X86_THREAD_INFO_H */
 diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index cd79194..e7a9491 100644
+index cd79194..c72ad3f 100644
 --- a/arch/x86/include/asm/tlbflush.h
 +++ b/arch/x86/include/asm/tlbflush.h
-@@ -86,18 +86,44 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
+@@ -86,18 +86,45 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
  
  static inline void __native_flush_tlb(void)
  {
@@ -19432,7 +19545,7 @@ index cd79194..e7a9491 100644
 +	}
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if (static_cpu_has(X86_FEATURE_PCID)) {
++	if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
 +		unsigned int cpu = raw_get_cpu();
 +
 +		native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
@@ -19442,6 +19555,7 @@ index cd79194..e7a9491 100644
 +	}
 +#endif
 +
++
  	native_write_cr3(native_read_cr3());
  }
  
@@ -19470,7 +19584,7 @@ index cd79194..e7a9491 100644
  }
  
  static inline void __native_flush_tlb_global(void)
-@@ -118,6 +144,41 @@ static inline void __native_flush_tlb_global(void)
+@@ -118,6 +145,43 @@ static inline void __native_flush_tlb_global(void)
  
  static inline void __native_flush_tlb_single(unsigned long addr)
  {
@@ -19481,14 +19595,16 @@ index cd79194..e7a9491 100644
 +		descriptor[1] = addr;
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+		if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
-+			if (addr < TASK_SIZE_MAX)
-+				descriptor[1] += pax_user_shadow_base;
-+			asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
-+		}
++		if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
++			if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
++				if (addr < TASK_SIZE_MAX)
++					descriptor[1] += pax_user_shadow_base;
++				asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
++			}
 +
-+		descriptor[0] = PCID_USER;
-+		descriptor[1] = addr;
++			descriptor[0] = PCID_USER;
++			descriptor[1] = addr;
++		}
 +#endif
 +
 +		asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
@@ -19496,7 +19612,7 @@ index cd79194..e7a9491 100644
 +	}
 +
 +#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+	if (static_cpu_has(X86_FEATURE_PCID)) {
++	if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
 +		unsigned int cpu = raw_get_cpu();
 +
 +		native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER | PCID_NOFLUSH);
@@ -21143,7 +21259,7 @@ index e4cf633..941f450 100644
  		if (c->x86_model == 3 && c->x86_mask == 0)
  			size = 64;
 diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index a62cf04..041e39c 100644
+index a62cf04..a55415c 100644
 --- a/arch/x86/kernel/cpu/common.c
 +++ b/arch/x86/kernel/cpu/common.c
 @@ -91,60 +91,6 @@ static const struct cpu_dev default_cpu = {
@@ -21207,10 +21323,57 @@ index a62cf04..041e39c 100644
  static int __init x86_xsave_setup(char *s)
  {
  	if (strlen(s))
-@@ -306,6 +252,59 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+@@ -306,6 +252,109 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
  	}
  }
  
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#ifdef CONFIG_X86_64
++static bool uderef_enabled __read_only = true;
++unsigned long pax_user_shadow_base __read_only;
++EXPORT_SYMBOL(pax_user_shadow_base);
++extern char pax_enter_kernel_user[];
++extern char pax_exit_kernel_user[];
++
++static int __init setup_pax_weakuderef(char *str)
++{
++	if (uderef_enabled)
++		pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
++	return 1;
++}
++__setup("pax_weakuderef", setup_pax_weakuderef);
++#endif
++
++static int __init setup_pax_nouderef(char *str)
++{
++#ifdef CONFIG_X86_32
++	unsigned int cpu;
++	struct desc_struct *gdt;
++
++	for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
++		gdt = get_cpu_gdt_table(cpu);
++		gdt[GDT_ENTRY_KERNEL_DS].type = 3;
++		gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++		gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
++		gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
++	}
++	loadsegment(ds, __KERNEL_DS);
++	loadsegment(es, __KERNEL_DS);
++	loadsegment(ss, __KERNEL_DS);
++#else
++	memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
++	memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
++	clone_pgd_mask = ~(pgdval_t)0UL;
++	pax_user_shadow_base = 0UL;
++	setup_clear_cpu_cap(X86_FEATURE_PCIDUDEREF);
++	uderef_enabled = false;
++#endif
++
++	return 0;
++}
++early_param("pax_nouderef", setup_pax_nouderef);
++#endif
++
 +#ifdef CONFIG_X86_64
 +static __init int setup_disable_pcid(char *arg)
 +{
@@ -21218,7 +21381,7 @@ index a62cf04..041e39c 100644
 +	setup_clear_cpu_cap(X86_FEATURE_INVPCID);
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	if (clone_pgd_mask != ~(pgdval_t)0UL)
++	if (uderef_enabled)
 +		pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
 +#endif
 +
@@ -21228,26 +21391,31 @@ index a62cf04..041e39c 100644
 +
 +static void setup_pcid(struct cpuinfo_x86 *c)
 +{
-+	if (!cpu_has(c, X86_FEATURE_PCID)) {
++	if (cpu_has(c, X86_FEATURE_PCID)) {
++		printk("PAX: PCID detected\n");
++		cr4_set_bits(X86_CR4_PCIDE);
++	} else
 +		clear_cpu_cap(c, X86_FEATURE_INVPCID);
 +
++	if (cpu_has(c, X86_FEATURE_INVPCID))
++		printk("PAX: INVPCID detected\n");
++
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		if (clone_pgd_mask != ~(pgdval_t)0UL) {
-+			pax_open_kernel();
-+			pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
-+			pax_close_kernel();
-+			printk("PAX: slow and weak UDEREF enabled\n");
-+		} else
-+			printk("PAX: UDEREF disabled\n");
-+#endif
++	if (!uderef_enabled) {
++		printk("PAX: UDEREF disabled\n");
++		return;
++	}
 +
++	if (!cpu_has(c, X86_FEATURE_PCID)) {
++		pax_open_kernel();
++		pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
++		pax_close_kernel();
++		printk("PAX: slow and weak UDEREF enabled\n");
 +		return;
 +	}
 +
-+	printk("PAX: PCID detected\n");
-+	cr4_set_bits(X86_CR4_PCIDE);
++	set_cpu_cap(c, X86_FEATURE_PCIDUDEREF);
 +
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	pax_open_kernel();
 +	clone_pgd_mask = ~(pgdval_t)0UL;
 +	pax_close_kernel();
@@ -21259,15 +21427,13 @@ index a62cf04..041e39c 100644
 +	}
 +#endif
 +
-+	if (cpu_has(c, X86_FEATURE_INVPCID))
-+		printk("PAX: INVPCID detected\n");
 +}
 +#endif
 +
  /*
   * Some CPU features depend on higher CPUID levels, which may not always
   * be available due to CPUID level capping or broken virtualization
-@@ -406,7 +405,7 @@ void switch_to_new_gdt(int cpu)
+@@ -406,7 +455,7 @@ void switch_to_new_gdt(int cpu)
  {
  	struct desc_ptr gdt_descr;
  
@@ -21276,7 +21442,7 @@ index a62cf04..041e39c 100644
  	gdt_descr.size = GDT_SIZE - 1;
  	load_gdt(&gdt_descr);
  	/* Reload the per-cpu base */
-@@ -935,6 +934,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -935,6 +984,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
  	setup_smep(c);
  	setup_smap(c);
  
@@ -21297,7 +21463,7 @@ index a62cf04..041e39c 100644
  	/*
  	 * The vendor-specific functions might have changed features.
  	 * Now we do "generic changes."
-@@ -1009,7 +1022,7 @@ void enable_sep_cpu(void)
+@@ -1009,7 +1072,7 @@ void enable_sep_cpu(void)
  	int cpu;
  
  	cpu = get_cpu();
@@ -21306,7 +21472,7 @@ index a62cf04..041e39c 100644
  
  	if (!boot_cpu_has(X86_FEATURE_SEP))
  		goto out;
-@@ -1155,14 +1168,16 @@ static __init int setup_disablecpuid(char *arg)
+@@ -1155,14 +1218,16 @@ static __init int setup_disablecpuid(char *arg)
  }
  __setup("clearcpuid=", setup_disablecpuid);
  
@@ -21327,7 +21493,7 @@ index a62cf04..041e39c 100644
  
  DEFINE_PER_CPU_FIRST(union irq_stack_union,
  		     irq_stack_union) __aligned(PAGE_SIZE) __visible;
-@@ -1367,7 +1382,7 @@ void cpu_init(void)
+@@ -1367,7 +1432,7 @@ void cpu_init(void)
  	 */
  	load_ucode_ap();
  
@@ -21336,7 +21502,7 @@ index a62cf04..041e39c 100644
  	oist = &per_cpu(orig_ist, cpu);
  
  #ifdef CONFIG_NUMA
-@@ -1399,7 +1414,6 @@ void cpu_init(void)
+@@ -1399,7 +1464,6 @@ void cpu_init(void)
  	wrmsrl(MSR_KERNEL_GS_BASE, 0);
  	barrier();
  
@@ -21344,7 +21510,7 @@ index a62cf04..041e39c 100644
  	x2apic_setup();
  
  	/*
-@@ -1451,7 +1465,7 @@ void cpu_init(void)
+@@ -1451,7 +1515,7 @@ void cpu_init(void)
  {
  	int cpu = smp_processor_id();
  	struct task_struct *curr = current;
@@ -21754,25 +21920,10 @@ index 7795f3f..3535b76 100644
  	__bts_event_stop(event);
  
 diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
-index e4d1b8b..8867302 100644
+index cb77b11..8867302 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
 +++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
-@@ -934,6 +934,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
- 		return 0;
- 
- 	/*
-+	 * Getting up-to-date values requires an SMP IPI which is not
-+	 * possible if we're being called in interrupt context. Return
-+	 * the cached values instead.
-+	 */
-+	if (unlikely(in_interrupt()))
-+		goto out;
-+
-+	/*
- 	 * Notice that we don't perform the reading of an RMID
- 	 * atomically, because we can't hold a spin lock across the
- 	 * IPIs.
-@@ -1352,7 +1360,9 @@ static int __init intel_cqm_init(void)
+@@ -1360,7 +1360,9 @@ static int __init intel_cqm_init(void)
  		goto out;
  	}
  
@@ -23102,7 +23253,7 @@ index 1c30976..71b41b9 100644
  #endif
  
 diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 02c2eff..a13739f 100644
+index 02c2eff..9c9ea72 100644
 --- a/arch/x86/kernel/entry_64.S
 +++ b/arch/x86/kernel/entry_64.S
 @@ -46,6 +46,8 @@
@@ -23114,7 +23265,7 @@ index 02c2eff..a13739f 100644
  
  /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
  #include <linux/elf-em.h>
-@@ -64,6 +66,401 @@ ENTRY(native_usergs_sysret64)
+@@ -64,6 +66,402 @@ ENTRY(native_usergs_sysret64)
  ENDPROC(native_usergs_sysret64)
  #endif /* CONFIG_PARAVIRT */
  
@@ -23444,6 +23595,7 @@ index 02c2eff..a13739f 100644
 +#endif
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
++	ALTERNATIVE "jmp 111f", "", X86_FEATURE_PCID
 +	btr $2,%ebx
 +	jnc 111f
 +	GET_CR3_INTO_RDI
@@ -23516,7 +23668,7 @@ index 02c2eff..a13739f 100644
  
  .macro TRACE_IRQS_IRETQ
  #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -100,7 +497,7 @@ ENDPROC(native_usergs_sysret64)
+@@ -100,7 +498,7 @@ ENDPROC(native_usergs_sysret64)
  .endm
  
  .macro TRACE_IRQS_IRETQ_DEBUG
@@ -23525,7 +23677,7 @@ index 02c2eff..a13739f 100644
  	jnc  1f
  	TRACE_IRQS_ON_DEBUG
  1:
-@@ -221,14 +618,6 @@ GLOBAL(system_call_after_swapgs)
+@@ -221,14 +619,6 @@ GLOBAL(system_call_after_swapgs)
  	/* Construct struct pt_regs on stack */
  	pushq_cfi $__USER_DS			/* pt_regs->ss */
  	pushq_cfi PER_CPU_VAR(rsp_scratch)	/* pt_regs->sp */
@@ -23540,7 +23692,7 @@ index 02c2eff..a13739f 100644
  	pushq_cfi	%r11			/* pt_regs->flags */
  	pushq_cfi	$__USER_CS		/* pt_regs->cs */
  	pushq_cfi	%rcx			/* pt_regs->ip */
-@@ -246,7 +635,27 @@ GLOBAL(system_call_after_swapgs)
+@@ -246,7 +636,27 @@ GLOBAL(system_call_after_swapgs)
  	sub	$(6*8),%rsp /* pt_regs->bp,bx,r12-15 not saved */
  	CFI_ADJUST_CFA_OFFSET 6*8
  
@@ -23569,7 +23721,7 @@ index 02c2eff..a13739f 100644
  	jnz tracesys
  system_call_fastpath:
  #if __SYSCALL_MASK == ~0
-@@ -279,10 +688,13 @@ system_call_fastpath:
+@@ -279,10 +689,13 @@ system_call_fastpath:
  	 * flags (TIF_NOTIFY_RESUME, TIF_USER_RETURN_NOTIFY, etc) set is
  	 * very bad.
  	 */
@@ -23584,7 +23736,7 @@ index 02c2eff..a13739f 100644
  
  	RESTORE_C_REGS_EXCEPT_RCX_R11
  	movq	RIP(%rsp),%rcx
-@@ -316,6 +728,9 @@ tracesys:
+@@ -316,6 +729,9 @@ tracesys:
  	call syscall_trace_enter_phase1
  	test %rax, %rax
  	jnz tracesys_phase2		/* if needed, run the slow path */
@@ -23594,7 +23746,7 @@ index 02c2eff..a13739f 100644
  	RESTORE_C_REGS_EXCEPT_RAX	/* else restore clobbered regs */
  	movq ORIG_RAX(%rsp), %rax
  	jmp system_call_fastpath	/*      and return to the fast path */
-@@ -327,6 +742,8 @@ tracesys_phase2:
+@@ -327,6 +743,8 @@ tracesys_phase2:
  	movq %rax,%rdx
  	call syscall_trace_enter_phase2
  
@@ -23603,7 +23755,7 @@ index 02c2eff..a13739f 100644
  	/*
  	 * Reload registers from stack in case ptrace changed them.
  	 * We don't reload %rax because syscall_trace_entry_phase2() returned
-@@ -364,6 +781,8 @@ GLOBAL(int_with_check)
+@@ -364,6 +782,8 @@ GLOBAL(int_with_check)
  	andl %edi,%edx
  	jnz   int_careful
  	andl	$~TS_COMPAT,TI_status(%rcx)
@@ -23612,7 +23764,7 @@ index 02c2eff..a13739f 100644
  	jmp	syscall_return
  
  	/* Either reschedule or signal or syscall exit tracking needed. */
-@@ -485,7 +904,7 @@ opportunistic_sysret_failed:
+@@ -485,7 +905,7 @@ opportunistic_sysret_failed:
  	SWAPGS
  	jmp	restore_c_regs_and_iret
  	CFI_ENDPROC
@@ -23621,7 +23773,7 @@ index 02c2eff..a13739f 100644
  
  
  	.macro FORK_LIKE func
-@@ -495,7 +914,7 @@ ENTRY(stub_\func)
+@@ -495,7 +915,7 @@ ENTRY(stub_\func)
  	SAVE_EXTRA_REGS 8
  	jmp sys_\func
  	CFI_ENDPROC
@@ -23630,7 +23782,7 @@ index 02c2eff..a13739f 100644
  	.endm
  
  	FORK_LIKE  clone
-@@ -519,7 +938,7 @@ return_from_execve:
+@@ -519,7 +939,7 @@ return_from_execve:
  	movq	%rax,RAX(%rsp)
  	jmp	int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23639,7 +23791,7 @@ index 02c2eff..a13739f 100644
  /*
   * Remaining execve stubs are only 7 bytes long.
   * ENTRY() often aligns to 16 bytes, which in this case has no benefits.
-@@ -531,7 +950,7 @@ GLOBAL(stub_execveat)
+@@ -531,7 +951,7 @@ GLOBAL(stub_execveat)
  	call	sys_execveat
  	jmp	return_from_execve
  	CFI_ENDPROC
@@ -23648,7 +23800,7 @@ index 02c2eff..a13739f 100644
  
  #ifdef CONFIG_X86_X32_ABI
  	.align	8
-@@ -541,7 +960,7 @@ GLOBAL(stub_x32_execve)
+@@ -541,7 +961,7 @@ GLOBAL(stub_x32_execve)
  	call	compat_sys_execve
  	jmp	return_from_execve
  	CFI_ENDPROC
@@ -23657,7 +23809,7 @@ index 02c2eff..a13739f 100644
  	.align	8
  GLOBAL(stub_x32_execveat)
  	CFI_STARTPROC
-@@ -549,7 +968,7 @@ GLOBAL(stub_x32_execveat)
+@@ -549,7 +969,7 @@ GLOBAL(stub_x32_execveat)
  	call	compat_sys_execveat
  	jmp	return_from_execve
  	CFI_ENDPROC
@@ -23666,7 +23818,7 @@ index 02c2eff..a13739f 100644
  #endif
  
  #ifdef CONFIG_IA32_EMULATION
-@@ -592,7 +1011,7 @@ return_from_stub:
+@@ -592,7 +1012,7 @@ return_from_stub:
  	movq %rax,RAX(%rsp)
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23675,7 +23827,7 @@ index 02c2eff..a13739f 100644
  
  #ifdef CONFIG_X86_X32_ABI
  ENTRY(stub_x32_rt_sigreturn)
-@@ -602,7 +1021,7 @@ ENTRY(stub_x32_rt_sigreturn)
+@@ -602,7 +1022,7 @@ ENTRY(stub_x32_rt_sigreturn)
  	call sys32_x32_rt_sigreturn
  	jmp  return_from_stub
  	CFI_ENDPROC
@@ -23684,7 +23836,7 @@ index 02c2eff..a13739f 100644
  #endif
  
  /*
-@@ -622,7 +1041,7 @@ ENTRY(ret_from_fork)
+@@ -622,7 +1042,7 @@ ENTRY(ret_from_fork)
  
  	RESTORE_EXTRA_REGS
  
@@ -23693,7 +23845,7 @@ index 02c2eff..a13739f 100644
  
  	/*
  	 * By the time we get here, we have no idea whether our pt_regs,
-@@ -641,7 +1060,7 @@ ENTRY(ret_from_fork)
+@@ -641,7 +1061,7 @@ ENTRY(ret_from_fork)
  	RESTORE_EXTRA_REGS
  	jmp int_ret_from_sys_call
  	CFI_ENDPROC
@@ -23702,7 +23854,7 @@ index 02c2eff..a13739f 100644
  
  /*
   * Build the entry stubs with some assembler magic.
-@@ -659,7 +1078,7 @@ ENTRY(irq_entries_start)
+@@ -659,7 +1079,7 @@ ENTRY(irq_entries_start)
  	.align	8
      .endr
  	CFI_ENDPROC
@@ -23711,7 +23863,7 @@ index 02c2eff..a13739f 100644
  
  /*
   * Interrupt entry/exit.
-@@ -672,21 +1091,13 @@ END(irq_entries_start)
+@@ -672,21 +1092,13 @@ END(irq_entries_start)
  /* 0(%rsp): ~(interrupt number) */
  	.macro interrupt func
  	cld
@@ -23738,7 +23890,7 @@ index 02c2eff..a13739f 100644
  	je 1f
  	SWAPGS
  1:
-@@ -709,8 +1120,20 @@ END(irq_entries_start)
+@@ -709,8 +1121,20 @@ END(irq_entries_start)
  	CFI_ESCAPE	0x0f /* DW_CFA_def_cfa_expression */, 6, \
  			0x77 /* DW_OP_breg7 (rsp) */, 0, \
  			0x06 /* DW_OP_deref */, \
@@ -23760,7 +23912,7 @@ index 02c2eff..a13739f 100644
  	/* We entered an interrupt context - irqs are off: */
  	TRACE_IRQS_OFF
  
-@@ -735,13 +1158,12 @@ ret_from_intr:
+@@ -735,13 +1159,12 @@ ret_from_intr:
  
  	/* Restore saved previous stack */
  	popq %rsi
@@ -23778,7 +23930,7 @@ index 02c2eff..a13739f 100644
  	je retint_kernel
  	/* Interrupt came from user space */
  
-@@ -763,6 +1185,8 @@ retint_swapgs:		/* return to user-space */
+@@ -763,6 +1186,8 @@ retint_swapgs:		/* return to user-space */
  	 * The iretq could re-enable interrupts:
  	 */
  	DISABLE_INTERRUPTS(CLBR_ANY)
@@ -23787,7 +23939,7 @@ index 02c2eff..a13739f 100644
  	TRACE_IRQS_IRETQ
  
  	SWAPGS
-@@ -781,6 +1205,21 @@ retint_kernel:
+@@ -781,6 +1206,21 @@ retint_kernel:
  	jmp	0b
  1:
  #endif
@@ -23809,7 +23961,7 @@ index 02c2eff..a13739f 100644
  	/*
  	 * The iretq could re-enable interrupts:
  	 */
-@@ -793,8 +1232,6 @@ retint_kernel:
+@@ -793,8 +1233,6 @@ retint_kernel:
  restore_c_regs_and_iret:
  	RESTORE_C_REGS
  	REMOVE_PT_GPREGS_FROM_STACK 8
@@ -23818,7 +23970,7 @@ index 02c2eff..a13739f 100644
  	INTERRUPT_RETURN
  
  ENTRY(native_iret)
-@@ -824,15 +1261,15 @@ native_irq_return_ldt:
+@@ -824,15 +1262,15 @@ native_irq_return_ldt:
  	SWAPGS
  	movq PER_CPU_VAR(espfix_waddr),%rdi
  	movq %rax,(0*8)(%rdi)	/* RAX */
@@ -23839,7 +23991,7 @@ index 02c2eff..a13739f 100644
  	movq %rax,(4*8)(%rdi)
  	andl $0xffff0000,%eax
  	popq_cfi %rdi
-@@ -875,7 +1312,7 @@ retint_signal:
+@@ -875,7 +1313,7 @@ retint_signal:
  	jmp retint_with_reschedule
  
  	CFI_ENDPROC
@@ -23848,7 +24000,7 @@ index 02c2eff..a13739f 100644
  
  /*
   * APIC interrupts.
-@@ -889,7 +1326,7 @@ ENTRY(\sym)
+@@ -889,7 +1327,7 @@ ENTRY(\sym)
  	interrupt \do_sym
  	jmp ret_from_intr
  	CFI_ENDPROC
@@ -23857,7 +24009,7 @@ index 02c2eff..a13739f 100644
  .endm
  
  #ifdef CONFIG_TRACING
-@@ -962,7 +1399,7 @@ apicinterrupt IRQ_WORK_VECTOR \
+@@ -962,7 +1400,7 @@ apicinterrupt IRQ_WORK_VECTOR \
  /*
   * Exception entry points.
   */
@@ -23866,7 +24018,7 @@ index 02c2eff..a13739f 100644
  
  .macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
  ENTRY(\sym)
-@@ -1018,6 +1455,12 @@ ENTRY(\sym)
+@@ -1018,6 +1456,12 @@ ENTRY(\sym)
  	.endif
  
  	.if \shift_ist != -1
@@ -23879,7 +24031,7 @@ index 02c2eff..a13739f 100644
  	subq $EXCEPTION_STKSZ, CPU_TSS_IST(\shift_ist)
  	.endif
  
-@@ -1065,7 +1508,7 @@ ENTRY(\sym)
+@@ -1065,7 +1509,7 @@ ENTRY(\sym)
  	.endif
  
  	CFI_ENDPROC
@@ -23888,7 +24040,7 @@ index 02c2eff..a13739f 100644
  .endm
  
  #ifdef CONFIG_TRACING
-@@ -1106,9 +1549,10 @@ gs_change:
+@@ -1106,9 +1550,10 @@ gs_change:
  2:	mfence		/* workaround */
  	SWAPGS
  	popfq_cfi
@@ -23900,7 +24052,7 @@ index 02c2eff..a13739f 100644
  
  	_ASM_EXTABLE(gs_change,bad_gs)
  	.section .fixup,"ax"
-@@ -1136,9 +1580,10 @@ ENTRY(do_softirq_own_stack)
+@@ -1136,9 +1581,10 @@ ENTRY(do_softirq_own_stack)
  	CFI_DEF_CFA_REGISTER	rsp
  	CFI_ADJUST_CFA_OFFSET   -8
  	decl PER_CPU_VAR(irq_count)
@@ -23912,7 +24064,7 @@ index 02c2eff..a13739f 100644
  
  #ifdef CONFIG_XEN
  idtentry xen_hypervisor_callback xen_do_hypervisor_callback has_error_code=0
-@@ -1179,7 +1624,7 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
+@@ -1179,7 +1625,7 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
  #endif
  	jmp  error_exit
  	CFI_ENDPROC
@@ -23921,7 +24073,7 @@ index 02c2eff..a13739f 100644
  
  /*
   * Hypervisor uses this for application faults while it executes.
-@@ -1240,7 +1685,7 @@ ENTRY(xen_failsafe_callback)
+@@ -1240,7 +1686,7 @@ ENTRY(xen_failsafe_callback)
  	SAVE_EXTRA_REGS
  	jmp error_exit
  	CFI_ENDPROC
@@ -23930,7 +24082,7 @@ index 02c2eff..a13739f 100644
  
  apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
  	xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -1286,9 +1731,39 @@ ENTRY(paranoid_entry)
+@@ -1286,9 +1732,39 @@ ENTRY(paranoid_entry)
  	js 1f	/* negative -> in kernel */
  	SWAPGS
  	xorl %ebx,%ebx
@@ -23972,7 +24124,7 @@ index 02c2eff..a13739f 100644
  
  /*
   * "Paranoid" exit path from exception stack.  This is invoked
-@@ -1305,20 +1780,27 @@ ENTRY(paranoid_exit)
+@@ -1305,20 +1781,27 @@ ENTRY(paranoid_exit)
  	DEFAULT_FRAME
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF_DEBUG
@@ -24002,7 +24154,7 @@ index 02c2eff..a13739f 100644
  
  /*
   * Save all registers in pt_regs, and switch gs if needed.
-@@ -1330,12 +1812,23 @@ ENTRY(error_entry)
+@@ -1330,12 +1813,23 @@ ENTRY(error_entry)
  	SAVE_C_REGS 8
  	SAVE_EXTRA_REGS 8
  	xorl %ebx,%ebx
@@ -24027,7 +24179,7 @@ index 02c2eff..a13739f 100644
  	ret
  
  	/*
-@@ -1370,7 +1863,7 @@ error_bad_iret:
+@@ -1370,7 +1864,7 @@ error_bad_iret:
  	decl %ebx	/* Return to usergs */
  	jmp error_sti
  	CFI_ENDPROC
@@ -24036,7 +24188,7 @@ index 02c2eff..a13739f 100644
  
  
  /* On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it) */
-@@ -1381,7 +1874,7 @@ ENTRY(error_exit)
+@@ -1381,7 +1875,7 @@ ENTRY(error_exit)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF
  	GET_THREAD_INFO(%rcx)
@@ -24045,7 +24197,7 @@ index 02c2eff..a13739f 100644
  	jne retint_kernel
  	LOCKDEP_SYS_EXIT_IRQ
  	movl TI_flags(%rcx),%edx
-@@ -1390,7 +1883,7 @@ ENTRY(error_exit)
+@@ -1390,7 +1884,7 @@ ENTRY(error_exit)
  	jnz retint_careful
  	jmp retint_swapgs
  	CFI_ENDPROC
@@ -24054,7 +24206,7 @@ index 02c2eff..a13739f 100644
  
  /* Runs on exception stack */
  ENTRY(nmi)
-@@ -1413,11 +1906,12 @@ ENTRY(nmi)
+@@ -1413,11 +1907,12 @@ ENTRY(nmi)
  	 *  If the variable is not set and the stack is not the NMI
  	 *  stack then:
  	 *    o Set the special variable on the stack
@@ -24070,7 +24222,7 @@ index 02c2eff..a13739f 100644
  	 *    o return back to the first NMI
  	 *
  	 * Now on exit of the first NMI, we first clear the stack variable
-@@ -1426,32 +1920,185 @@ ENTRY(nmi)
+@@ -1426,32 +1921,185 @@ ENTRY(nmi)
  	 * a nested NMI that updated the copy interrupt stack frame, a
  	 * jump will be made to the repeat_nmi code that will handle the second
  	 * NMI.
@@ -24267,7 +24419,7 @@ index 02c2eff..a13739f 100644
  	 */
  	lea	6*8(%rsp), %rdx
  	/* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
-@@ -1462,27 +2109,22 @@ ENTRY(nmi)
+@@ -1462,27 +2110,22 @@ ENTRY(nmi)
  	cmpq	%rdx, 4*8(%rsp)
  	/* If it is below the NMI stack, it is a normal NMI */
  	jb	first_nmi
@@ -24305,7 +24457,7 @@ index 02c2eff..a13739f 100644
  	CFI_ADJUST_CFA_OFFSET 1*8
  	leaq -10*8(%rsp), %rdx
  	pushq_cfi $__KERNEL_DS
-@@ -1499,60 +2141,24 @@ nested_nmi_out:
+@@ -1499,60 +2142,24 @@ nested_nmi_out:
  	popq_cfi %rdx
  	CFI_RESTORE rdx
  
@@ -24371,7 +24523,7 @@ index 02c2eff..a13739f 100644
  	.rept 5
  	pushq_cfi 11*8(%rsp)
  	.endr
-@@ -1560,6 +2166,7 @@ first_nmi:
+@@ -1560,6 +2167,7 @@ first_nmi:
  
  	/* Everything up to here is safe from nested NMIs */
  
@@ -24379,7 +24531,7 @@ index 02c2eff..a13739f 100644
  	/*
  	 * If there was a nested NMI, the first NMI's iret will return
  	 * here. But NMIs are still enabled and we can take another
-@@ -1568,16 +2175,21 @@ first_nmi:
+@@ -1568,16 +2176,21 @@ first_nmi:
  	 * it will just return, as we are about to repeat an NMI anyway.
  	 * This makes it safe to copy to the stack frame that a nested
  	 * NMI will update.
@@ -24408,7 +24560,7 @@ index 02c2eff..a13739f 100644
  	addq $(10*8), %rsp
  	CFI_ADJUST_CFA_OFFSET -10*8
  	.rept 5
-@@ -1588,66 +2200,65 @@ repeat_nmi:
+@@ -1588,66 +2201,66 @@ repeat_nmi:
  end_repeat_nmi:
  
  	/*
@@ -24458,12 +24610,13 @@ index 02c2eff..a13739f 100644
 -1:
 -	
 -	testl %ebx,%ebx				/* swapgs needed? */
++	pax_exit_kernel_nmi
++
 +	testl $1,%ebx				/* swapgs needed? */
  	jnz nmi_restore
  nmi_swapgs:
  	SWAPGS_UNSAFE_STACK
  nmi_restore:
-+	pax_exit_kernel_nmi
  	RESTORE_EXTRA_REGS
  	RESTORE_C_REGS
 -	/* Pop the extra iret frame at once */
@@ -24637,7 +24790,7 @@ index 8b7b0a5..02219db 100644
  	/* ALLOC_TRAMP flags lets us know we created it */
  	ops->flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
 diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index 5a46681..1ef7ffa 100644
+index f129a9a..af8f6da 100644
 --- a/arch/x86/kernel/head64.c
 +++ b/arch/x86/kernel/head64.c
 @@ -68,12 +68,12 @@ again:
@@ -24681,14 +24834,15 @@ index 5a46681..1ef7ffa 100644
  	}
  	pmd = (physaddr & PMD_MASK) + early_pmd_flags;
  	pmd_p[pmd_index(address)] = pmd;
-@@ -177,7 +177,6 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
- 	 */
- 	load_ucode_bsp();
+@@ -163,8 +163,6 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ 
+ 	clear_bss();
  
 -	clear_page(init_level4_pgt);
- 	/* set init_level4_pgt kernel high mapping*/
- 	init_level4_pgt[511] = early_level4_pgt[511];
+-
+ 	kasan_early_init();
  
+ 	for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
 diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
 index 7e429c9..7244a52 100644
 --- a/arch/x86/kernel/head_32.S
@@ -25113,7 +25267,7 @@ index 7e429c9..7244a52 100644
 +	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
 +	.endr
 diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index df7e780..e97a497 100644
+index 7e5da2c..761adf1 100644
 --- a/arch/x86/kernel/head_64.S
 +++ b/arch/x86/kernel/head_64.S
 @@ -20,6 +20,8 @@
@@ -25311,7 +25465,7 @@ index df7e780..e97a497 100644
  NEXT_PAGE(level2_kernel_pgt)
  	/*
  	 * 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -494,23 +557,61 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -494,31 +557,69 @@ NEXT_PAGE(level2_kernel_pgt)
  		KERNEL_IMAGE_SIZE/PMD_SIZE)
  
  NEXT_PAGE(level2_fixmap_pgt)
@@ -25379,8 +25533,7 @@ index df7e780..e97a497 100644
  
  ENTRY(phys_base)
  	/* This must match the first entry in level2_kernel_pgt */
-@@ -534,8 +635,8 @@ NEXT_PAGE(kasan_zero_pud)
- 
+ 	.quad   0x0000000000000000
  
  #include "../../x86/xen/xen-head.S"
 -	
@@ -34475,7 +34628,7 @@ index 90555bf..f5f1828 100644
  }
  
 diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
-index 3250f23..4197ac2 100644
+index 90b924a..4197ac2 100644
 --- a/arch/x86/mm/tlb.c
 +++ b/arch/x86/mm/tlb.c
 @@ -45,7 +45,11 @@ void leave_mm(int cpu)
@@ -34490,15 +34643,6 @@ index 3250f23..4197ac2 100644
  		/*
  		 * This gets called in the idle path where RCU
  		 * functions differently.  Tracing normally
-@@ -117,7 +121,7 @@ static void flush_tlb_func(void *info)
- 		} else {
- 			unsigned long addr;
- 			unsigned long nr_pages =
--				f->flush_end - f->flush_start / PAGE_SIZE;
-+				(f->flush_end - f->flush_start) / PAGE_SIZE;
- 			addr = f->flush_start;
- 			while (addr < f->flush_end) {
- 				__flush_tlb_single(addr);
 diff --git a/arch/x86/mm/uderef_64.c b/arch/x86/mm/uderef_64.c
 new file mode 100644
 index 0000000..3fda3f3
@@ -35155,22 +35299,6 @@ index 9b83b90..4112152 100644
  	return !(ret & 0xff00);
  }
  EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
-index 02744df..841ea05 100644
---- a/arch/x86/platform/efi/efi.c
-+++ b/arch/x86/platform/efi/efi.c
-@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phys_addr)
- 
- static int __init arch_parse_efi_cmdline(char *str)
- {
-+	if (!str) {
-+		pr_warn("need at least one option\n");
-+		return -EINVAL;
-+	}
-+
- 	if (parse_option_str(str, "old_map"))
- 		set_bit(EFI_OLD_MEMMAP, &efi.flags);
- 	if (parse_option_str(str, "debug"))
 diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
 index ed5b673..24d2d53 100644
 --- a/arch/x86/platform/efi/efi_32.c
@@ -36559,19 +36687,6 @@ index da310a1..213b5c9 100644
  	if (do_copy)
  		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
  	else
-diff --git a/block/blk-mq.c b/block/blk-mq.c
-index 594eea0..2dc1fd6 100644
---- a/block/blk-mq.c
-+++ b/block/blk-mq.c
-@@ -1968,7 +1968,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
- 		goto err_hctxs;
- 
- 	setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
--	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
-+	blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
- 
- 	q->nr_queues = nr_cpu_ids;
- 	q->nr_hw_queues = set->nr_hw_queues;
 diff --git a/block/blk-softirq.c b/block/blk-softirq.c
 index 53b1737..08177d2e 100644
 --- a/block/blk-softirq.c
@@ -40082,7 +40197,7 @@ index ad3f38f..8f086cd 100644
  }
  EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
 diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index c45d274..0f469f7 100644
+index 6f9d27f..14385d1 100644
 --- a/drivers/cpufreq/intel_pstate.c
 +++ b/drivers/cpufreq/intel_pstate.c
 @@ -134,10 +134,10 @@ struct pstate_funcs {
@@ -40098,7 +40213,7 @@ index c45d274..0f469f7 100644
  static int hwp_active;
  
  struct perf_limits {
-@@ -721,18 +721,18 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
+@@ -722,18 +722,18 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
  
  	cpu->pstate.current_pstate = pstate;
  
@@ -40124,7 +40239,7 @@ index c45d274..0f469f7 100644
  	intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
  }
  
-@@ -1056,15 +1056,15 @@ static unsigned int force_load;
+@@ -1057,15 +1057,15 @@ static unsigned int force_load;
  
  static int intel_pstate_msrs_not_valid(void)
  {
@@ -40144,7 +40259,7 @@ index c45d274..0f469f7 100644
  {
  	pid_params.sample_rate_ms = policy->sample_rate_ms;
  	pid_params.p_gain_pct = policy->p_gain_pct;
-@@ -1076,12 +1076,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
+@@ -1077,12 +1077,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
  
  static void copy_cpu_funcs(struct pstate_funcs *funcs)
  {
@@ -40379,20 +40494,6 @@ index 8d2a772..33826c9 100644
  
  	err = pci_request_regions(pdev, name);
  	if (err)
-diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
-index 4630709..0a70e46 100644
---- a/drivers/crypto/omap-des.c
-+++ b/drivers/crypto/omap-des.c
-@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
- 	dmaengine_terminate_all(dd->dma_lch_in);
- 	dmaengine_terminate_all(dd->dma_lch_out);
- 
--	dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
--	dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
--
- 	return err;
- }
- 
 diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
 index ca1b362..01cae6a 100644
 --- a/drivers/devfreq/devfreq.c
@@ -40707,7 +40808,7 @@ index 94a58a0..f5eba42 100644
  	container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
  
 diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
-index 4fd9961..52d60ce 100644
+index d425374..1da1716 100644
 --- a/drivers/firmware/efi/cper.c
 +++ b/drivers/firmware/efi/cper.c
 @@ -44,12 +44,12 @@ static char rcd_decode_str[CPER_REC_LEN];
@@ -40728,22 +40829,10 @@ index 4fd9961..52d60ce 100644
  EXPORT_SYMBOL_GPL(cper_next_record_id);
  
 diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
-index e14363d..302716e 100644
+index 63226e9..302716e 100644
 --- a/drivers/firmware/efi/efi.c
 +++ b/drivers/firmware/efi/efi.c
-@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void)
- 
- static int __init parse_efi_cmdline(char *str)
- {
-+	if (!str) {
-+		pr_warn("need at least one option\n");
-+		return -EINVAL;
-+	}
-+
- 	if (parse_option_str(str, "noruntime"))
- 		disable_runtime = true;
- 
-@@ -159,14 +164,16 @@ static struct attribute_group efi_subsys_attr_group = {
+@@ -164,14 +164,16 @@ static struct attribute_group efi_subsys_attr_group = {
  };
  
  static struct efivars generic_efivars;
@@ -41314,7 +41403,7 @@ index cbb4fc0..5c756cb9 100644
  		else
  			type = types[map->type];
 diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index 9cfcd0a..97778c5 100644
+index 9cfcd0a..7142a7f 100644
 --- a/drivers/gpu/drm/drm_ioc32.c
 +++ b/drivers/gpu/drm/drm_ioc32.c
 @@ -459,7 +459,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
@@ -41352,11 +41441,8 @@ index 9cfcd0a..97778c5 100644
  	int ret;
  
  	/* Assume that ioctls without an explicit compat routine will just
-@@ -1130,12 +1129,11 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
- 	 * than always failing.
- 	 */
+@@ -1132,10 +1131,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
  	if (nr >= ARRAY_SIZE(drm_compat_ioctls))
-+
  		return drm_ioctl(filp, cmd, arg);
  
 -	fn = drm_compat_ioctls[nr];
@@ -41728,10 +41814,10 @@ index 0190b69..60c3eaf 100644
  #define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
  
 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
-index 8904933..9624b38 100644
+index cd6dae0..f25eb48 100644
 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c
 +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
-@@ -941,7 +941,8 @@ static struct drm_driver
+@@ -943,7 +943,8 @@ static struct drm_driver
  driver_stub = {
  	.driver_features =
  		DRIVER_USE_AGP |
@@ -42854,6 +42940,28 @@ index 722a925..594c312 100644
  
  	hid_debug_register(hdev, dev_name(&hdev->dev));
  	ret = device_add(&hdev->dev);
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 008e89b..32d52d2 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -462,12 +462,15 @@ out:
+ 
+ static void hidinput_cleanup_battery(struct hid_device *dev)
+ {
++	const struct power_supply_desc *psy_desc;
++
+ 	if (!dev->battery)
+ 		return;
+ 
++	psy_desc = dev->battery->desc;
+ 	power_supply_unregister(dev->battery);
+-	kfree(dev->battery->desc->name);
+-	kfree(dev->battery->desc);
++	kfree(psy_desc->name);
++	kfree(psy_desc);
+ 	dev->battery = NULL;
+ }
+ #else  /* !CONFIG_HID_BATTERY_STRENGTH */
 diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
 index 5614fee..8301fbf 100644
 --- a/drivers/hid/hid-sensor-custom.c
@@ -43170,19 +43278,6 @@ index bd1c99d..2fa55ad 100644
  	struct attribute **attrs;
  	struct sensor_device_template **t;
  	int i, count;
-diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
-index 28fcb2e..fbfc02b 100644
---- a/drivers/hwmon/nct7802.c
-+++ b/drivers/hwmon/nct7802.c
-@@ -195,7 +195,7 @@ abort:
- }
- 
- static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
--				 unsigned int voltage)
-+				 unsigned long voltage)
- {
- 	int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
- 	int err;
 diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
 index f2e47c7..45d7941 100644
 --- a/drivers/hwmon/pmbus/pmbus_core.c
@@ -44634,34 +44729,6 @@ index 65075ef..53823f9 100644
  	dev_notice(smmu->dev, "\tSupported page sizes: 0x%08lx\n", size);
  
  	if (smmu->features & ARM_SMMU_FEAT_TRANS_S1)
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index 5ecfaf2..c87c4b1 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -1756,8 +1756,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
- 
- static void domain_exit(struct dmar_domain *domain)
- {
-+	struct dmar_drhd_unit *drhd;
-+	struct intel_iommu *iommu;
- 	struct page *freelist = NULL;
--	int i;
- 
- 	/* Domain 0 is reserved, so dont process it */
- 	if (!domain)
-@@ -1777,8 +1778,10 @@ static void domain_exit(struct dmar_domain *domain)
- 
- 	/* clear attached or cached domains */
- 	rcu_read_lock();
--	for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
--		iommu_detach_domain(domain, g_iommus[i]);
-+	for_each_active_iommu(iommu, drhd)
-+		if (domain_type_is_vm(domain) ||
-+		    test_bit(iommu->seq_id, domain->iommu_bmp))
-+			iommu_detach_domain(domain, iommu);
- 	rcu_read_unlock();
- 
- 	dma_free_pagelist(freelist);
 diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
 index 4e46021..f0a24fef 100644
 --- a/drivers/iommu/io-pgtable-arm.c
@@ -45877,7 +45944,7 @@ index 79f6941..b33b4e0 100644
  	pmd->bl_info.value_type.inc = data_block_inc;
  	pmd->bl_info.value_type.dec = data_block_dec;
 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 2caf492..0c0dcac 100644
+index e8d8456..d04a41a 100644
 --- a/drivers/md/dm.c
 +++ b/drivers/md/dm.c
 @@ -191,9 +191,9 @@ struct mapped_device {
@@ -45892,7 +45959,7 @@ index 2caf492..0c0dcac 100644
  	struct list_head uevent_list;
  	spinlock_t uevent_lock; /* Protect access to uevent_list */
  
-@@ -2298,8 +2298,8 @@ static struct mapped_device *alloc_dev(int minor)
+@@ -2294,8 +2294,8 @@ static struct mapped_device *alloc_dev(int minor)
  	spin_lock_init(&md->deferred_lock);
  	atomic_set(&md->holders, 1);
  	atomic_set(&md->open_count, 0);
@@ -45903,7 +45970,7 @@ index 2caf492..0c0dcac 100644
  	INIT_LIST_HEAD(&md->uevent_list);
  	INIT_LIST_HEAD(&md->table_devices);
  	spin_lock_init(&md->uevent_lock);
-@@ -2466,7 +2466,7 @@ static void event_callback(void *context)
+@@ -2462,7 +2462,7 @@ static void event_callback(void *context)
  
  	dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
  
@@ -45912,7 +45979,7 @@ index 2caf492..0c0dcac 100644
  	wake_up(&md->eventq);
  }
  
-@@ -3465,18 +3465,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -3461,18 +3461,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
  
  uint32_t dm_next_uevent_seq(struct mapped_device *md)
  {
@@ -46141,7 +46208,7 @@ index 3e6d115..ffecdeb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 9157a29..0d462f0 100644
+index cd7b0c1..377cd70 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
 @@ -1934,7 +1934,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -47906,19 +47973,6 @@ index c439c82..1f20f57 100644
  	union axis_conversion	ac;        /* hw -> logical axis */
  	int			mapped_btns[3];
  
-diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
-index 3e29681..e40bcd03 100644
---- a/drivers/misc/mei/main.c
-+++ b/drivers/misc/mei/main.c
-@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
- 	/* Fill in the data structures */
- 	devno = MKDEV(MAJOR(mei_devt), dev->minor);
- 	cdev_init(&dev->cdev, &mei_fops);
--	dev->cdev.owner = mei_fops.owner;
-+	dev->cdev.owner = parent->driver->owner;
- 
- 	/* Add the device */
- 	ret = cdev_add(&dev->cdev, devno, 1);
 diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
 index 2f30bad..c4c13d0 100644
 --- a/drivers/misc/sgi-gru/gruhandles.c
@@ -48253,7 +48307,7 @@ index fb26674..3172c2b 100644
  		mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
  		mmc->max_busy_timeout = 0;
 diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
-index 9df2b68..6d5ed1a 100644
+index d0abdffb..bb1f8d7 100644
 --- a/drivers/mmc/host/omap_hsmmc.c
 +++ b/drivers/mmc/host/omap_hsmmc.c
 @@ -2004,7 +2004,9 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
@@ -48408,10 +48462,10 @@ index e8c96b8..516a96c 100644
  	  Say Y here if you want to support for Freescale FlexCAN.
  
 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index e9b1810..5c2f3f9 100644
+index aede704..b516b4d 100644
 --- a/drivers/net/can/dev.c
 +++ b/drivers/net/can/dev.c
-@@ -964,7 +964,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
+@@ -961,7 +961,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
  	return -EOPNOTSUPP;
  }
  
@@ -48421,10 +48475,10 @@ index e9b1810..5c2f3f9 100644
  	.maxtype	= IFLA_CAN_MAX,
  	.policy		= can_policy,
 diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
-index 0ce868d..e5dc8bd 100644
+index 674f367..ec3a31f 100644
 --- a/drivers/net/can/vcan.c
 +++ b/drivers/net/can/vcan.c
-@@ -166,7 +166,7 @@ static void vcan_setup(struct net_device *dev)
+@@ -163,7 +163,7 @@ static void vcan_setup(struct net_device *dev)
  	dev->destructor		= free_netdev;
  }
  
@@ -50016,7 +50070,7 @@ index a2515887..6d13233 100644
  
  	/* we will have to manufacture ethernet headers, prepare template */
 diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 63c7810..4ad33aa 100644
+index 63c7810..a694d2b 100644
 --- a/drivers/net/virtio_net.c
 +++ b/drivers/net/virtio_net.c
 @@ -48,7 +48,7 @@ module_param(gso, bool, 0444);
@@ -50028,6 +50082,18 @@ index 63c7810..4ad33aa 100644
  
  #define VIRTNET_DRIVER_VERSION "1.0.0"
  
+@@ -1756,9 +1756,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ 	/* Do we support "hardware" checksums? */
+ 	if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ 		/* This opens up the world of extra features. */
+-		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++		dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 		if (csum)
+-			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++			dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ 
+ 		if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ 			dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
 diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
 index 61c0840..92e7f7e 100644
 --- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -50790,7 +50856,7 @@ index 0ffb6ff..c0b7f0e 100644
  	memset(buf, 0, sizeof(buf));
  	buf_size = min(count, sizeof(buf) - 1);
 diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
-index dc17909..989c9fb 100644
+index 37e6a6f..b3b0369 100644
 --- a/drivers/net/wireless/iwlwifi/pcie/trans.c
 +++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
 @@ -1919,7 +1919,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
@@ -53416,7 +53482,7 @@ index 3833bf5..95feaf1 100644
  		if (drv->done)
  			good_bytes = drv->done(cmd);
 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index b1a2631..5bcd9c8 100644
+index 448ebda..9bd345f 100644
 --- a/drivers/scsi/scsi_lib.c
 +++ b/drivers/scsi/scsi_lib.c
 @@ -1597,7 +1597,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
@@ -53450,7 +53516,7 @@ index b1a2631..5bcd9c8 100644
  	/* check if the device is still usable */
  	if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index 1ac38e7..6acc656 100644
+index 9ad4116..4e736fc 100644
 --- a/drivers/scsi/scsi_sysfs.c
 +++ b/drivers/scsi/scsi_sysfs.c
 @@ -788,7 +788,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr,	\
@@ -53636,21 +53702,6 @@ index 8bd54a6..dd037a5 100644
  	int block_sectors = 0;
  	long error_sector;
  	struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
-diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
-index 9a1c342..525ab4c 100644
---- a/drivers/scsi/st.c
-+++ b/drivers/scsi/st.c
-@@ -1274,9 +1274,9 @@ static int st_open(struct inode *inode, struct file *filp)
- 	spin_lock(&st_use_lock);
- 	STp->in_use = 0;
- 	spin_unlock(&st_use_lock);
--	scsi_tape_put(STp);
- 	if (resumed)
- 		scsi_autopm_put_device(STp->device);
-+	scsi_tape_put(STp);
- 	return retval;
- 
- }
 diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c
 index c0d660f..24a5854 100644
 --- a/drivers/soc/tegra/fuse/fuse-tegra.c
@@ -54904,7 +54955,7 @@ index 2c34c32..81d10e1 100644
  
  	dlci->modem_rx = 0;
 diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 396344c..875c1d6 100644
+index 16ed0b6..7d944b4 100644
 --- a/drivers/tty/n_tty.c
 +++ b/drivers/tty/n_tty.c
 @@ -116,7 +116,7 @@ struct n_tty_data {
@@ -54916,7 +54967,7 @@ index 396344c..875c1d6 100644
  	size_t line_start;
  
  	/* protected by output lock */
-@@ -2572,6 +2572,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2582,6 +2582,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
  {
  	*ops = tty_ldisc_N_TTY;
  	ops->owner = NULL;
@@ -55208,7 +55259,7 @@ index a0ae942..befa48d 100644
  
  	if (cfg->uart_flags & UPF_CONS_FLOW) {
 diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index 0b7bb12..ebe191a 100644
+index ec54044..fc93d3f 100644
 --- a/drivers/tty/serial/serial_core.c
 +++ b/drivers/tty/serial/serial_core.c
 @@ -1376,7 +1376,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
@@ -55229,7 +55280,7 @@ index 0b7bb12..ebe191a 100644
  		return;
  
  	/*
-@@ -1510,7 +1510,7 @@ static void uart_hangup(struct tty_struct *tty)
+@@ -1511,7 +1511,7 @@ static void uart_hangup(struct tty_struct *tty)
  		uart_flush_buffer(tty);
  		uart_shutdown(tty, state);
  		spin_lock_irqsave(&port->lock, flags);
@@ -55238,7 +55289,7 @@ index 0b7bb12..ebe191a 100644
  		clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
  		spin_unlock_irqrestore(&port->lock, flags);
  		tty_port_tty_set(port, NULL);
-@@ -1597,7 +1597,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
+@@ -1598,7 +1598,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
  	pr_debug("uart_open(%d) called\n", line);
  
  	spin_lock_irq(&port->lock);
@@ -74864,7 +74915,7 @@ index bbbe139..b76fae5 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 50bb3c2..d874b57 100644
+index 5d03eb0..d874b57 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -545,7 +545,7 @@ static void __dentry_kill(struct dentry *dentry)
@@ -74885,15 +74936,6 @@ index 50bb3c2..d874b57 100644
  		return NULL;
  	if (likely(spin_trylock(&parent->d_lock)))
  		return parent;
-@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
- 
- 	/*
- 	 * If we have a d_op->d_delete() operation, we sould not
--	 * let the dentry count go to zero, so use "put__or_lock".
-+	 * let the dentry count go to zero, so use "put_or_lock".
- 	 */
- 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
- 		return lockref_put_or_lock(&dentry->d_lockref);
 @@ -660,8 +660,8 @@ static inline bool fast_dput(struct dentry *dentry)
  	 */
  	if (unlikely(ret < 0)) {
@@ -74905,15 +74947,6 @@ index 50bb3c2..d874b57 100644
  			spin_unlock(&dentry->d_lock);
  			return 1;
  		}
-@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
- 	 */
- 	smp_rmb();
- 	d_flags = ACCESS_ONCE(dentry->d_flags);
--	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
-+	d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
- 
- 	/* Nothing to do? Dropping the reference was all we needed? */
- 	if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
 @@ -716,7 +716,7 @@ static inline bool fast_dput(struct dentry *dentry)
  	 * else could have killed it and marked it dead. Either way, we
  	 * don't need to do anything else.
@@ -74932,17 +74965,7 @@ index 50bb3c2..d874b57 100644
  	return 0;
  }
  
-@@ -776,6 +776,9 @@ repeat:
- 	if (unlikely(d_unhashed(dentry)))
- 		goto kill_it;
- 
-+	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
-+		goto kill_it;
-+
- 	if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
- 		if (dentry->d_op->d_delete(dentry))
- 			goto kill_it;
-@@ -785,7 +788,7 @@ repeat:
+@@ -788,7 +788,7 @@ repeat:
  		dentry->d_flags |= DCACHE_REFERENCED;
  	dentry_lru_add(dentry);
  
@@ -74951,7 +74974,7 @@ index 50bb3c2..d874b57 100644
  	spin_unlock(&dentry->d_lock);
  	return;
  
-@@ -800,7 +803,7 @@ EXPORT_SYMBOL(dput);
+@@ -803,7 +803,7 @@ EXPORT_SYMBOL(dput);
  /* This must be called with d_lock held */
  static inline void __dget_dlock(struct dentry *dentry)
  {
@@ -74960,7 +74983,7 @@ index 50bb3c2..d874b57 100644
  }
  
  static inline void __dget(struct dentry *dentry)
-@@ -841,8 +844,8 @@ repeat:
+@@ -844,8 +844,8 @@ repeat:
  		goto repeat;
  	}
  	rcu_read_unlock();
@@ -74971,7 +74994,7 @@ index 50bb3c2..d874b57 100644
  	spin_unlock(&ret->d_lock);
  	return ret;
  }
-@@ -920,9 +923,9 @@ restart:
+@@ -923,9 +923,9 @@ restart:
  	spin_lock(&inode->i_lock);
  	hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
  		spin_lock(&dentry->d_lock);
@@ -74983,7 +75006,7 @@ index 50bb3c2..d874b57 100644
  				__dentry_kill(dentry);
  				dput(parent);
  				goto restart;
-@@ -957,7 +960,7 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -960,7 +960,7 @@ static void shrink_dentry_list(struct list_head *list)
  		 * We found an inuse dentry which was not removed from
  		 * the LRU because of laziness during lookup. Do not free it.
  		 */
@@ -74992,7 +75015,7 @@ index 50bb3c2..d874b57 100644
  			spin_unlock(&dentry->d_lock);
  			if (parent)
  				spin_unlock(&parent->d_lock);
-@@ -995,8 +998,8 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -998,8 +998,8 @@ static void shrink_dentry_list(struct list_head *list)
  		dentry = parent;
  		while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) {
  			parent = lock_parent(dentry);
@@ -75003,7 +75026,7 @@ index 50bb3c2..d874b57 100644
  				spin_unlock(&dentry->d_lock);
  				if (parent)
  					spin_unlock(&parent->d_lock);
-@@ -1036,7 +1039,7 @@ static enum lru_status dentry_lru_isolate(struct list_head *item,
+@@ -1039,7 +1039,7 @@ static enum lru_status dentry_lru_isolate(struct list_head *item,
  	 * counts, just remove them from the LRU. Otherwise give them
  	 * another pass through the LRU.
  	 */
@@ -75012,7 +75035,7 @@ index 50bb3c2..d874b57 100644
  		d_lru_isolate(lru, dentry);
  		spin_unlock(&dentry->d_lock);
  		return LRU_REMOVED;
-@@ -1370,7 +1373,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+@@ -1373,7 +1373,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
  	} else {
  		if (dentry->d_flags & DCACHE_LRU_LIST)
  			d_lru_del(dentry);
@@ -75021,7 +75044,7 @@ index 50bb3c2..d874b57 100644
  			d_shrink_add(dentry, &data->dispose);
  			data->found++;
  		}
-@@ -1418,7 +1421,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
+@@ -1421,7 +1421,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
  		return D_WALK_CONTINUE;
  
  	/* root with refcount 1 is fine */
@@ -75030,7 +75053,7 @@ index 50bb3c2..d874b57 100644
  		return D_WALK_CONTINUE;
  
  	printk(KERN_ERR "BUG: Dentry %p{i=%lx,n=%pd} "
-@@ -1427,7 +1430,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
+@@ -1430,7 +1430,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
  		       dentry->d_inode ?
  		       dentry->d_inode->i_ino : 0UL,
  		       dentry,
@@ -75039,7 +75062,7 @@ index 50bb3c2..d874b57 100644
  		       dentry->d_sb->s_type->name,
  		       dentry->d_sb->s_id);
  	WARN_ON(1);
-@@ -1568,7 +1571,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1571,7 +1571,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
  	if (name->len > DNAME_INLINE_LEN-1) {
  		size_t size = offsetof(struct external_name, name[1]);
@@ -75048,7 +75071,7 @@ index 50bb3c2..d874b57 100644
  		if (!p) {
  			kmem_cache_free(dentry_cache, dentry); 
  			return NULL;
-@@ -1591,7 +1594,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1594,7 +1594,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	smp_wmb();
  	dentry->d_name.name = dname;
  
@@ -75057,7 +75080,7 @@ index 50bb3c2..d874b57 100644
  	dentry->d_flags = 0;
  	spin_lock_init(&dentry->d_lock);
  	seqcount_init(&dentry->d_seq);
-@@ -1600,6 +1603,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1603,6 +1603,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
  	dentry->d_sb = sb;
  	dentry->d_op = NULL;
  	dentry->d_fsdata = NULL;
@@ -75067,7 +75090,7 @@ index 50bb3c2..d874b57 100644
  	INIT_HLIST_BL_NODE(&dentry->d_hash);
  	INIT_LIST_HEAD(&dentry->d_lru);
  	INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2321,7 +2327,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2324,7 +2327,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
  				goto next;
  		}
  
@@ -75076,7 +75099,7 @@ index 50bb3c2..d874b57 100644
  		found = dentry;
  		spin_unlock(&dentry->d_lock);
  		break;
-@@ -2389,7 +2395,7 @@ again:
+@@ -2392,7 +2395,7 @@ again:
  	spin_lock(&dentry->d_lock);
  	inode = dentry->d_inode;
  	isdir = S_ISDIR(inode->i_mode);
@@ -75085,7 +75108,7 @@ index 50bb3c2..d874b57 100644
  		if (!spin_trylock(&inode->i_lock)) {
  			spin_unlock(&dentry->d_lock);
  			cpu_relax();
-@@ -3331,7 +3337,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3334,7 +3337,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
  
  		if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
  			dentry->d_flags |= DCACHE_GENOCIDE;
@@ -75094,7 +75117,7 @@ index 50bb3c2..d874b57 100644
  		}
  	}
  	return D_WALK_CONTINUE;
-@@ -3447,7 +3453,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3450,7 +3453,8 @@ void __init vfs_caches_init(unsigned long mempages)
  	mempages -= reserve;
  
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -78505,7 +78528,7 @@ index 6a61c2b..bd79179 100644
  #define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
  
 diff --git a/fs/namei.c b/fs/namei.c
-index fe30d3b..cf767ae 100644
+index fe30d3b..57656a7 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -336,17 +336,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -78585,6 +78608,15 @@ index fe30d3b..cf767ae 100644
  {
  	return nd->saved_names[nd->depth];
  }
+@@ -766,7 +773,7 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
+ 		return 0;
+ 
+ 	/* Allowed if parent directory not sticky and world-writable. */
+-	parent = nd->path.dentry->d_inode;
++	parent = nd->inode;
+ 	if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
+ 		return 0;
+ 
 @@ -854,7 +861,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  {
  	struct dentry *dentry = link->dentry;
@@ -79098,59 +79130,10 @@ index fe30d3b..cf767ae 100644
  out:
  	return len;
 diff --git a/fs/namespace.c b/fs/namespace.c
-index 02c6875..ac3626c 100644
+index fce3cc1..ac3626c 100644
 --- a/fs/namespace.c
 +++ b/fs/namespace.c
-@@ -1350,6 +1350,36 @@ enum umount_tree_flags {
- 	UMOUNT_PROPAGATE = 2,
- 	UMOUNT_CONNECTED = 4,
- };
-+
-+static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
-+{
-+	/* Leaving mounts connected is only valid for lazy umounts */
-+	if (how & UMOUNT_SYNC)
-+		return true;
-+
-+	/* A mount without a parent has nothing to be connected to */
-+	if (!mnt_has_parent(mnt))
-+		return true;
-+
-+	/* Because the reference counting rules change when mounts are
-+	 * unmounted and connected, umounted mounts may not be
-+	 * connected to mounted mounts.
-+	 */
-+	if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
-+		return true;
-+
-+	/* Has it been requested that the mount remain connected? */
-+	if (how & UMOUNT_CONNECTED)
-+		return false;
-+
-+	/* Is the mount locked such that it needs to remain connected? */
-+	if (IS_MNT_LOCKED(mnt))
-+		return false;
-+
-+	/* By default disconnect the mount */
-+	return true;
-+}
-+
- /*
-  * mount_lock must be held
-  * namespace_sem must be held for write
-@@ -1387,10 +1417,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
- 		if (how & UMOUNT_SYNC)
- 			p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
- 
--		disconnect = !(((how & UMOUNT_CONNECTED) &&
--				mnt_has_parent(p) &&
--				(p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
--			       IS_MNT_LOCKED_AND_LAZY(p));
-+		disconnect = disconnect_mount(p, how);
- 
- 		pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
- 				 disconnect ? &unmounted : NULL);
-@@ -1478,6 +1505,9 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -1505,6 +1505,9 @@ static int do_umount(struct mount *mnt, int flags)
  		if (!(sb->s_flags & MS_RDONLY))
  			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
  		up_write(&sb->s_umount);
@@ -79160,7 +79143,7 @@ index 02c6875..ac3626c 100644
  		return retval;
  	}
  
-@@ -1500,6 +1530,9 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -1527,6 +1530,9 @@ static int do_umount(struct mount *mnt, int flags)
  	}
  	unlock_mount_hash();
  	namespace_unlock();
@@ -79170,21 +79153,7 @@ index 02c6875..ac3626c 100644
  	return retval;
  }
  
-@@ -1527,11 +1560,8 @@ void __detach_mounts(struct dentry *dentry)
- 	while (!hlist_empty(&mp->m_list)) {
- 		mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
- 		if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
--			struct mount *p, *tmp;
--			list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts,  mnt_child) {
--				hlist_add_head(&p->mnt_umount.s_list, &unmounted);
--				umount_mnt(p);
--			}
-+			hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
-+			umount_mnt(mnt);
- 		}
- 		else umount_tree(mnt, UMOUNT_CONNECTED);
- 	}
-@@ -1557,7 +1587,7 @@ static inline bool may_mount(void)
+@@ -1581,7 +1587,7 @@ static inline bool may_mount(void)
   * unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
   */
  
@@ -79193,7 +79162,7 @@ index 02c6875..ac3626c 100644
  {
  	struct path path;
  	struct mount *mnt;
-@@ -1602,7 +1632,7 @@ out:
+@@ -1626,7 +1632,7 @@ out:
  /*
   *	The 2.0 compatible umount. No flags.
   */
@@ -79202,7 +79171,7 @@ index 02c6875..ac3626c 100644
  {
  	return sys_umount(name, 0);
  }
-@@ -2677,6 +2707,16 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+@@ -2701,6 +2707,16 @@ long do_mount(const char *dev_name, const char __user *dir_name,
  		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
  		   MS_STRICTATIME);
  
@@ -79219,7 +79188,7 @@ index 02c6875..ac3626c 100644
  	if (flags & MS_REMOUNT)
  		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
  				    data_page);
-@@ -2690,7 +2730,10 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+@@ -2714,7 +2730,10 @@ long do_mount(const char *dev_name, const char __user *dir_name,
  		retval = do_new_mount(&path, type_page, flags, mnt_flags,
  				      dev_name, data_page);
  dput_out:
@@ -79230,7 +79199,7 @@ index 02c6875..ac3626c 100644
  	return retval;
  }
  
-@@ -2708,7 +2751,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
+@@ -2732,7 +2751,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
   * number incrementing at 10Ghz will take 12,427 years to wrap which
   * is effectively never, so we can ignore the possibility.
   */
@@ -79239,7 +79208,7 @@ index 02c6875..ac3626c 100644
  
  static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
  {
-@@ -2724,7 +2767,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
+@@ -2748,7 +2767,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
  		return ERR_PTR(ret);
  	}
  	new_ns->ns.ops = &mntns_operations;
@@ -79248,7 +79217,7 @@ index 02c6875..ac3626c 100644
  	atomic_set(&new_ns->count, 1);
  	new_ns->root = NULL;
  	INIT_LIST_HEAD(&new_ns->list);
-@@ -2734,7 +2777,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
+@@ -2758,7 +2777,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
  	return new_ns;
  }
  
@@ -79257,7 +79226,7 @@ index 02c6875..ac3626c 100644
  		struct user_namespace *user_ns, struct fs_struct *new_fs)
  {
  	struct mnt_namespace *new_ns;
-@@ -2855,8 +2898,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
+@@ -2879,8 +2898,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
  }
  EXPORT_SYMBOL(mount_subtree);
  
@@ -79268,7 +79237,7 @@ index 02c6875..ac3626c 100644
  {
  	int ret;
  	char *kernel_type;
-@@ -2962,6 +3005,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -2986,6 +3005,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
  	if (error)
  		goto out2;
  
@@ -79280,7 +79249,7 @@ index 02c6875..ac3626c 100644
  	get_fs_root(current->fs, &root);
  	old_mp = lock_mount(&old);
  	error = PTR_ERR(old_mp);
-@@ -3263,7 +3311,7 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
+@@ -3287,7 +3311,7 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
  	    !ns_capable(current_user_ns(), CAP_SYS_ADMIN))
  		return -EPERM;
  
@@ -79303,10 +79272,10 @@ index 19ca95c..b28702c 100644
  static struct callback_op callback_ops[];
  
 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index f734562..3fd6c4e 100644
+index 5d25b9d..765fc0f 100644
 --- a/fs/nfs/inode.c
 +++ b/fs/nfs/inode.c
-@@ -1275,16 +1275,16 @@ static int nfs_ctime_need_update(const struct inode *inode, const struct nfs_fat
+@@ -1277,16 +1277,16 @@ static int nfs_ctime_need_update(const struct inode *inode, const struct nfs_fat
  	return timespec_compare(&fattr->ctime, &inode->i_ctime) > 0;
  }
  
@@ -79366,7 +79335,7 @@ index 9e6475b..7970138 100644
  
  /* proc.c */
 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 55e1e3a..3886f50 100644
+index d3f2051..dd338dc 100644
 --- a/fs/nfs/nfs4proc.c
 +++ b/fs/nfs/nfs4proc.c
 @@ -916,6 +916,7 @@ struct nfs4_opendata {
@@ -80226,19 +80195,6 @@ index 8865f79..bd2c79b 100644
  			goto out;
  
  		if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
-diff --git a/fs/pnode.h b/fs/pnode.h
-index 7114ce6..0fcdbe7 100644
---- a/fs/pnode.h
-+++ b/fs/pnode.h
-@@ -20,8 +20,6 @@
- #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
- #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
- #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
--#define IS_MNT_LOCKED_AND_LAZY(m) \
--	(((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
- 
- #define CL_EXPIRE    		0x01
- #define CL_SLAVE     		0x02
 diff --git a/fs/posix_acl.c b/fs/posix_acl.c
 index 84bb65b8..4270e47 100644
 --- a/fs/posix_acl.c
@@ -82259,7 +82215,7 @@ index f684c75..4117611 100644
  		return -EINVAL;
  
 diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 555f821..34684d7 100644
+index 555f821..02a990b 100644
 --- a/fs/seq_file.c
 +++ b/fs/seq_file.c
 @@ -12,6 +12,8 @@
@@ -82271,25 +82227,19 @@ index 555f821..34684d7 100644
  
  #include <asm/uaccess.h>
  #include <asm/page.h>
-@@ -23,16 +25,7 @@ static void seq_set_overflow(struct seq_file *m)
- 
- static void *seq_buf_alloc(unsigned long size)
- {
--	void *buf;
--
--	/*
--	 * __GFP_NORETRY to avoid oom-killings with high-order allocations -
--	 * it's better to fall back to vmalloc() than to kill things.
--	 */
+@@ -29,9 +31,9 @@ static void *seq_buf_alloc(unsigned long size)
+ 	 * __GFP_NORETRY to avoid oom-killings with high-order allocations -
+ 	 * it's better to fall back to vmalloc() than to kill things.
+ 	 */
 -	buf = kmalloc(size, GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
--	if (!buf && size > PAGE_SIZE)
++	buf = kmalloc(size, GFP_KERNEL | GFP_USERCOPY | __GFP_NORETRY | __GFP_NOWARN);
+ 	if (!buf && size > PAGE_SIZE)
 -		buf = vmalloc(size);
--	return buf;
-+	return kmalloc(size, GFP_KERNEL | GFP_USERCOPY);
++		buf = vmalloc_usercopy(size);
+ 	return buf;
  }
  
- /**
-@@ -65,6 +58,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
+@@ -65,6 +67,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
  #ifdef CONFIG_USER_NS
  	p->user_ns = file->f_cred->user_ns;
  #endif
@@ -82299,7 +82249,7 @@ index 555f821..34684d7 100644
  
  	/*
  	 * Wrappers around seq_open(e.g. swaps_open) need to be
-@@ -87,6 +83,16 @@ int seq_open(struct file *file, const struct seq_operations *op)
+@@ -87,6 +92,16 @@ int seq_open(struct file *file, const struct seq_operations *op)
  }
  EXPORT_SYMBOL(seq_open);
  
@@ -82316,7 +82266,7 @@ index 555f821..34684d7 100644
  static int traverse(struct seq_file *m, loff_t offset)
  {
  	loff_t pos = 0, index;
-@@ -158,7 +164,7 @@ Eoverflow:
+@@ -158,7 +173,7 @@ Eoverflow:
  ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
  {
  	struct seq_file *m = file->private_data;
@@ -82325,7 +82275,7 @@ index 555f821..34684d7 100644
  	loff_t pos;
  	size_t n;
  	void *p;
-@@ -557,7 +563,7 @@ static void single_stop(struct seq_file *p, void *v)
+@@ -557,7 +572,7 @@ static void single_stop(struct seq_file *p, void *v)
  int single_open(struct file *file, int (*show)(struct seq_file *, void *),
  		void *data)
  {
@@ -82334,7 +82284,7 @@ index 555f821..34684d7 100644
  	int res = -ENOMEM;
  
  	if (op) {
-@@ -593,6 +599,17 @@ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
+@@ -593,6 +608,17 @@ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
  }
  EXPORT_SYMBOL(single_open_size);
  
@@ -96393,34 +96343,6 @@ index 7ee1774..72505b8 100644
  }
  
  /*
-diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
-index 1da6029..6cd8c0e 100644
---- a/include/linux/ftrace.h
-+++ b/include/linux/ftrace.h
-@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
-  *            SAVE_REGS. If another ops with this flag set is already registered
-  *            for any of the functions that this ops will be registered for, then
-  *            this ops will fail to register or set_filter_ip.
-+ * PID     - Is affected by set_ftrace_pid (allows filtering on those pids)
-  */
- enum {
- 	FTRACE_OPS_FL_ENABLED			= 1 << 0,
-@@ -132,6 +133,7 @@ enum {
- 	FTRACE_OPS_FL_MODIFYING			= 1 << 11,
- 	FTRACE_OPS_FL_ALLOC_TRAMP		= 1 << 12,
- 	FTRACE_OPS_FL_IPMODIFY			= 1 << 13,
-+	FTRACE_OPS_FL_PID			= 1 << 14,
- };
- 
- #ifdef CONFIG_DYNAMIC_FTRACE
-@@ -159,6 +161,7 @@ struct ftrace_ops {
- 	struct ftrace_ops		*next;
- 	unsigned long			flags;
- 	void				*private;
-+	ftrace_func_t			saved_func;
- 	int __percpu			*disabled;
- #ifdef CONFIG_DYNAMIC_FTRACE
- 	int				nr_trampolines;
 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
 index ec274e0..e678159 100644
 --- a/include/linux/genhd.h
@@ -101323,10 +101245,10 @@ index b483abd..af305ad 100644
  #endif
  #endif /* _LINUX_VGA_SWITCHEROO_H_ */
 diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
-index 0ec5983..cc61051 100644
+index 0ec5983..d5888bb 100644
 --- a/include/linux/vmalloc.h
 +++ b/include/linux/vmalloc.h
-@@ -18,6 +18,11 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
+@@ -18,6 +18,14 @@ struct vm_area_struct;		/* vma defining user mapping in mm_types.h */
  #define VM_UNINITIALIZED	0x00000020	/* vm_struct is not fully initialized */
  #define VM_NO_GUARD		0x00000040      /* don't add guard page */
  #define VM_KASAN		0x00000080      /* has allocated kasan shadow memory */
@@ -101335,10 +101257,21 @@ index 0ec5983..cc61051 100644
 +#define VM_KERNEXEC		0x00000100	/* allocate from executable kernel memory range */
 +#endif
 +
++#define VM_USERCOPY		0x00000200	/* allocation intended for copies to userland */
++
++
  /* bits [20..32] reserved for arch specific ioremap internals */
  
  /*
-@@ -86,6 +91,10 @@ extern void *vmap(struct page **pages, unsigned int count,
+@@ -67,6 +75,7 @@ static inline void vmalloc_init(void)
+ #endif
+ 
+ extern void *vmalloc(unsigned long size);
++extern void *vmalloc_usercopy(unsigned long size);
+ extern void *vzalloc(unsigned long size);
+ extern void *vmalloc_user(unsigned long size);
+ extern void *vmalloc_node(unsigned long size, int node);
+@@ -86,6 +95,10 @@ extern void *vmap(struct page **pages, unsigned int count,
  			unsigned long flags, pgprot_t prot);
  extern void vunmap(const void *addr);
  
@@ -101349,7 +101282,7 @@ index 0ec5983..cc61051 100644
  extern int remap_vmalloc_range_partial(struct vm_area_struct *vma,
  				       unsigned long uaddr, void *kaddr,
  				       unsigned long size);
-@@ -150,7 +159,7 @@ extern void free_vm_area(struct vm_struct *area);
+@@ -150,7 +163,7 @@ extern void free_vm_area(struct vm_struct *area);
  
  /* for /dev/kmem */
  extern long vread(char *buf, char *addr, unsigned long count);
@@ -103163,7 +103096,7 @@ index ad1bd77..dca2c1b 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index 2a89545..449eca2 100644
+index 2a89545..58711ee 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -97,6 +97,8 @@ extern void radix_tree_init(void);
@@ -103175,7 +103108,7 @@ index 2a89545..449eca2 100644
  /*
   * Debug helper: via this flag we know that we are in 'early bootup code'
   * where only the boot processor is running with IRQ disabled.  This means
-@@ -158,6 +160,85 @@ static int __init set_reset_devices(char *str)
+@@ -158,6 +160,37 @@ static int __init set_reset_devices(char *str)
  
  __setup("reset_devices", set_reset_devices);
  
@@ -103199,54 +103132,6 @@ index 2a89545..449eca2 100644
 +__setup("grsec_sysfs_restrict", setup_grsec_sysfs_restrict);
 +#endif
 +
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+unsigned long pax_user_shadow_base __read_only;
-+EXPORT_SYMBOL(pax_user_shadow_base);
-+extern char pax_enter_kernel_user[];
-+extern char pax_exit_kernel_user[];
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+	unsigned int cpu;
-+	struct desc_struct *gdt;
-+
-+	for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+		gdt = get_cpu_gdt_table(cpu);
-+		gdt[GDT_ENTRY_KERNEL_DS].type = 3;
-+		gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+		gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
-+		gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
-+	}
-+	loadsegment(ds, __KERNEL_DS);
-+	loadsegment(es, __KERNEL_DS);
-+	loadsegment(ss, __KERNEL_DS);
-+#else
-+	memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
-+	memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
-+	clone_pgd_mask = ~(pgdval_t)0UL;
-+	pax_user_shadow_base = 0UL;
-+	setup_clear_cpu_cap(X86_FEATURE_PCID);
-+	setup_clear_cpu_cap(X86_FEATURE_INVPCID);
-+#endif
-+
-+	return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+
-+#ifdef CONFIG_X86_64
-+static int __init setup_pax_weakuderef(char *str)
-+{
-+	if (clone_pgd_mask != ~(pgdval_t)0UL)
-+		pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
-+	return 1;
-+}
-+__setup("pax_weakuderef", setup_pax_weakuderef);
-+#endif
-+#endif
-+
 +#ifdef CONFIG_PAX_SOFTMODE
 +int pax_softmode;
 +
@@ -103261,7 +103146,7 @@ index 2a89545..449eca2 100644
  static const char *argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char *envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -726,7 +807,7 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
+@@ -726,7 +759,7 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
  	struct blacklist_entry *entry;
  	char *fn_name;
  
@@ -103270,7 +103155,7 @@ index 2a89545..449eca2 100644
  	if (!fn_name)
  		return false;
  
-@@ -778,7 +859,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -778,7 +811,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
  {
  	int count = preempt_count();
  	int ret;
@@ -103279,7 +103164,7 @@ index 2a89545..449eca2 100644
  
  	if (initcall_blacklisted(fn))
  		return -EPERM;
-@@ -788,18 +869,17 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -788,18 +821,17 @@ int __init_or_module do_one_initcall(initcall_t fn)
  	else
  		ret = fn();
  
@@ -103302,7 +103187,7 @@ index 2a89545..449eca2 100644
  	return ret;
  }
  
-@@ -905,8 +985,8 @@ static int run_init_process(const char *init_filename)
+@@ -905,8 +937,8 @@ static int run_init_process(const char *init_filename)
  {
  	argv_init[0] = init_filename;
  	return do_execve(getname_kernel(init_filename),
@@ -103313,7 +103198,7 @@ index 2a89545..449eca2 100644
  }
  
  static int try_to_run_init_process(const char *init_filename)
-@@ -923,6 +1003,10 @@ static int try_to_run_init_process(const char *init_filename)
+@@ -923,6 +955,10 @@ static int try_to_run_init_process(const char *init_filename)
  	return ret;
  }
  
@@ -103324,7 +103209,7 @@ index 2a89545..449eca2 100644
  static noinline void __init kernel_init_freeable(void);
  
  static int __ref kernel_init(void *unused)
-@@ -947,6 +1031,11 @@ static int __ref kernel_init(void *unused)
+@@ -947,6 +983,11 @@ static int __ref kernel_init(void *unused)
  		       ramdisk_execute_command, ret);
  	}
  
@@ -103336,7 +103221,7 @@ index 2a89545..449eca2 100644
  	/*
  	 * We try each of these until one succeeds.
  	 *
-@@ -1002,7 +1091,7 @@ static noinline void __init kernel_init_freeable(void)
+@@ -1002,7 +1043,7 @@ static noinline void __init kernel_init_freeable(void)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -103345,7 +103230,7 @@ index 2a89545..449eca2 100644
  		pr_err("Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -1015,11 +1104,13 @@ static noinline void __init kernel_init_freeable(void)
+@@ -1015,11 +1056,13 @@ static noinline void __init kernel_init_freeable(void)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -109623,108 +109508,10 @@ index 483cecf..ac46091 100644
  
  	ret = -EIO;
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 02bece4..43adc29 100644
+index eb11011..43adc29 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
-@@ -98,6 +98,13 @@ struct ftrace_pid {
- 	struct pid *pid;
- };
- 
-+static bool ftrace_pids_enabled(void)
-+{
-+	return !list_empty(&ftrace_pids);
-+}
-+
-+static void ftrace_update_trampoline(struct ftrace_ops *ops);
-+
- /*
-  * ftrace_disabled is set when an anomaly is discovered.
-  * ftrace_disabled is much stronger than ftrace_enabled.
-@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
- static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
- static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
- ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
--ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
- static struct ftrace_ops global_ops;
- static struct ftrace_ops control_ops;
- 
-@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
- 	if (!test_tsk_trace_trace(current))
- 		return;
- 
--	ftrace_pid_function(ip, parent_ip, op, regs);
--}
--
--static void set_ftrace_pid_function(ftrace_func_t func)
--{
--	/* do not set ftrace_pid_function to itself! */
--	if (func != ftrace_pid_func)
--		ftrace_pid_function = func;
-+	op->saved_func(ip, parent_ip, op, regs);
- }
- 
- /**
-@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
- void clear_ftrace_function(void)
- {
- 	ftrace_trace_function = ftrace_stub;
--	ftrace_pid_function = ftrace_stub;
- }
- 
- static void control_ops_disable_all(struct ftrace_ops *ops)
-@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
- 	} else
- 		add_ftrace_ops(&ftrace_ops_list, ops);
- 
-+	/* Always save the function, and reset at unregistering */
-+	ops->saved_func = ops->func;
-+
-+	if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
-+		ops->func = ftrace_pid_func;
-+
- 	ftrace_update_trampoline(ops);
- 
- 	if (ftrace_enabled)
-@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
- 	if (ftrace_enabled)
- 		update_ftrace_function();
- 
-+	ops->func = ops->saved_func;
-+
- 	return 0;
- }
- 
- static void ftrace_update_pid_func(void)
- {
-+	bool enabled = ftrace_pids_enabled();
-+	struct ftrace_ops *op;
-+
- 	/* Only do something if we are tracing something */
- 	if (ftrace_trace_function == ftrace_stub)
- 		return;
- 
-+	do_for_each_ftrace_op(op, ftrace_ops_list) {
-+		if (op->flags & FTRACE_OPS_FL_PID) {
-+			op->func = enabled ? ftrace_pid_func :
-+				op->saved_func;
-+			ftrace_update_trampoline(op);
-+		}
-+	} while_for_each_ftrace_op(op);
-+
- 	update_ftrace_function();
- }
- 
-@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
- 	.local_hash.filter_hash		= EMPTY_HASH,
- 	INIT_OPS_HASH(global_ops)
- 	.flags				= FTRACE_OPS_FL_RECURSION_SAFE |
--					  FTRACE_OPS_FL_INITIALIZED,
-+					  FTRACE_OPS_FL_INITIALIZED |
-+					  FTRACE_OPS_FL_PID,
- };
- 
- /*
-@@ -2395,12 +2413,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+@@ -2413,12 +2413,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
  	if (unlikely(ftrace_disabled))
  		return 0;
  
@@ -109744,7 +109531,7 @@ index 02bece4..43adc29 100644
  }
  
  /*
-@@ -4789,8 +4812,10 @@ static int ftrace_process_locs(struct module *mod,
+@@ -4807,8 +4812,10 @@ static int ftrace_process_locs(struct module *mod,
  	if (!count)
  		return 0;
  
@@ -109755,47 +109542,7 @@ index 02bece4..43adc29 100644
  
  	start_pg = ftrace_allocate_pages(count);
  	if (!start_pg)
-@@ -5023,7 +5048,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
- 
- static struct ftrace_ops global_ops = {
- 	.func			= ftrace_stub,
--	.flags			= FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
-+	.flags			= FTRACE_OPS_FL_RECURSION_SAFE |
-+				  FTRACE_OPS_FL_INITIALIZED |
-+				  FTRACE_OPS_FL_PID,
- };
- 
- static int __init ftrace_nodyn_init(void)
-@@ -5080,11 +5107,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
- 		if (WARN_ON(tr->ops->func != ftrace_stub))
- 			printk("ftrace ops had %pS for function\n",
- 			       tr->ops->func);
--		/* Only the top level instance does pid tracing */
--		if (!list_empty(&ftrace_pids)) {
--			set_ftrace_pid_function(func);
--			func = ftrace_pid_func;
--		}
- 	}
- 	tr->ops->func = func;
- 	tr->ops->private = tr;
-@@ -5371,7 +5393,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
- {
- 	mutex_lock(&ftrace_lock);
- 
--	if (list_empty(&ftrace_pids) && (!*pos))
-+	if (!ftrace_pids_enabled() && (!*pos))
- 		return (void *) 1;
- 
- 	return seq_list_start(&ftrace_pids, *pos);
-@@ -5610,6 +5632,7 @@ static struct ftrace_ops graph_ops = {
- 	.func			= ftrace_stub,
- 	.flags			= FTRACE_OPS_FL_RECURSION_SAFE |
- 				   FTRACE_OPS_FL_INITIALIZED |
-+				   FTRACE_OPS_FL_PID |
- 				   FTRACE_OPS_FL_STUB,
- #ifdef FTRACE_GRAPH_TRAMP_ADDR
- 	.trampoline		= FTRACE_GRAPH_TRAMP_ADDR,
-@@ -5659,7 +5682,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+@@ -5675,7 +5682,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
  
  		if (t->ret_stack == NULL) {
  			atomic_set(&t->tracing_graph_pause, 0);
@@ -109804,7 +109551,7 @@ index 02bece4..43adc29 100644
  			t->curr_ret_stack = -1;
  			/* Make sure the tasks see the -1 first: */
  			smp_wmb();
-@@ -5882,7 +5905,7 @@ static void
+@@ -5898,7 +5905,7 @@ static void
  graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
  {
  	atomic_set(&t->tracing_graph_pause, 0);
@@ -110662,10 +110409,10 @@ index 19ea7ed..20cac21 100644
  	u32 high = divisor >> 32;
  	u64 quot;
 diff --git a/lib/dma-debug.c b/lib/dma-debug.c
-index ae4b65e..daf0230 100644
+index dace71f..13da37b 100644
 --- a/lib/dma-debug.c
 +++ b/lib/dma-debug.c
-@@ -979,7 +979,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
+@@ -982,7 +982,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
  
  void dma_debug_add_bus(struct bus_type *bus)
  {
@@ -110674,7 +110421,7 @@ index ae4b65e..daf0230 100644
  
  	if (dma_debug_disabled())
  		return;
-@@ -1161,7 +1161,7 @@ static void check_unmap(struct dma_debug_entry *ref)
+@@ -1164,7 +1164,7 @@ static void check_unmap(struct dma_debug_entry *ref)
  
  static void check_for_stack(struct device *dev, void *addr)
  {
@@ -112024,7 +111771,7 @@ index 501820c..9612bcf 100644
  	}
  	unset_migratetype_isolate(page, MIGRATE_MOVABLE);
 diff --git a/mm/memory.c b/mm/memory.c
-index 2a9e098..f5d6859 100644
+index 2a9e098..4574079 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -414,6 +414,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -112407,7 +112154,7 @@ index 2a9e098..f5d6859 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2663,31 +2854,30 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2663,31 +2854,29 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned int flags)
  {
  	struct mem_cgroup *memcg;
@@ -112423,13 +112170,13 @@ index 2a9e098..f5d6859 100644
 +	if (vma->vm_flags & VM_SHARED) {
 +		pte_unmap(page_table);
  		return VM_FAULT_SIGBUS;
--
++	}
+ 
 -	/* Check if we need to add a guard page to the stack */
 -	if (check_stack_guard_page(vma, address) < 0)
 -		return VM_FAULT_SIGSEGV;
-+	}
- 
- 	/* Use the zero-page for reads */
+-
+-	/* Use the zero-page for reads */
  	if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) {
  		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
  						vma->vm_page_prot));
@@ -112447,7 +112194,7 @@ index 2a9e098..f5d6859 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2711,6 +2901,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2711,6 +2900,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -112459,7 +112206,7 @@ index 2a9e098..f5d6859 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  	mem_cgroup_commit_charge(page, memcg, false);
-@@ -2720,6 +2915,12 @@ setpte:
+@@ -2720,6 +2914,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -112472,7 +112219,7 @@ index 2a9e098..f5d6859 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -2952,6 +3153,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2952,6 +3152,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  		return ret;
  	}
  	do_set_pte(vma, address, fault_page, pte, false, false);
@@ -112484,7 +112231,7 @@ index 2a9e098..f5d6859 100644
  	unlock_page(fault_page);
  unlock_out:
  	pte_unmap_unlock(pte, ptl);
-@@ -3003,7 +3209,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3003,7 +3208,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  		}
  		goto uncharge_out;
  	}
@@ -112503,7 +112250,7 @@ index 2a9e098..f5d6859 100644
  	mem_cgroup_commit_charge(new_page, memcg, false);
  	lru_cache_add_active_or_unevictable(new_page, vma);
  	pte_unmap_unlock(pte, ptl);
-@@ -3061,6 +3278,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3061,6 +3277,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  		return ret;
  	}
  	do_set_pte(vma, address, fault_page, pte, true, false);
@@ -112515,7 +112262,7 @@ index 2a9e098..f5d6859 100644
  	pte_unmap_unlock(pte, ptl);
  
  	if (set_page_dirty(fault_page))
-@@ -3286,6 +3508,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3286,6 +3507,12 @@ static int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -112528,7 +112275,7 @@ index 2a9e098..f5d6859 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3305,9 +3533,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3305,9 +3532,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -112570,7 +112317,7 @@ index 2a9e098..f5d6859 100644
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
  	if (!pud)
-@@ -3442,6 +3702,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3442,6 +3701,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -112594,7 +112341,7 @@ index 2a9e098..f5d6859 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3474,6 +3751,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3474,6 +3750,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -112627,7 +112374,7 @@ index 2a9e098..f5d6859 100644
  #endif /* __PAGETABLE_PMD_FOLDED */
  
  static int __follow_pte(struct mm_struct *mm, unsigned long address,
-@@ -3583,8 +3886,8 @@ out:
+@@ -3583,8 +3885,8 @@ out:
  	return ret;
  }
  
@@ -112638,7 +112385,7 @@ index 2a9e098..f5d6859 100644
  {
  	resource_size_t phys_addr;
  	unsigned long prot = 0;
-@@ -3610,8 +3913,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -3610,8 +3912,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
   * Access another process' address space as given in mm.  If non-NULL, use the
   * given task for page fault accounting.
   */
@@ -112649,7 +112396,7 @@ index 2a9e098..f5d6859 100644
  {
  	struct vm_area_struct *vma;
  	void *old_buf = buf;
-@@ -3619,7 +3922,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3619,7 +3921,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
  	down_read(&mm->mmap_sem);
  	/* ignore errors, just check how much was successfully transferred */
  	while (len) {
@@ -112658,7 +112405,7 @@ index 2a9e098..f5d6859 100644
  		void *maddr;
  		struct page *page = NULL;
  
-@@ -3680,8 +3983,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3680,8 +3982,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
   *
   * The caller must hold a reference on @mm.
   */
@@ -112669,7 +112416,7 @@ index 2a9e098..f5d6859 100644
  {
  	return __access_remote_vm(NULL, mm, addr, buf, len, write);
  }
-@@ -3691,11 +3994,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -3691,11 +3993,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
   * Source/target buffer must be kernel space,
   * Do not walk the page table directly, use get_user_pages
   */
@@ -114916,7 +114663,7 @@ index 47d536e..8321b4e 100644
  		return -ENOMEM;
  
 diff --git a/mm/slab.c b/mm/slab.c
-index 7eb38dd..a5172b1 100644
+index 7eb38dd..5dee2c4 100644
 --- a/mm/slab.c
 +++ b/mm/slab.c
 @@ -314,10 +314,12 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)
@@ -115046,7 +114793,7 @@ index 7eb38dd..a5172b1 100644
  #endif
  }
  
-@@ -4210,13 +4237,69 @@ static const struct file_operations proc_slabstats_operations = {
+@@ -4210,13 +4237,80 @@ static const struct file_operations proc_slabstats_operations = {
  static int __init slab_proc_init(void)
  {
  #ifdef CONFIG_DEBUG_SLAB_LEAK
@@ -115069,6 +114816,17 @@ index 7eb38dd..a5172b1 100644
 +	if (!slab_is_available())
 +		return false;
 +
++	if (is_vmalloc_addr(ptr)
++#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
++	    && !object_starts_on_stack(ptr)
++#endif
++	) {
++		struct vm_struct *vm = find_vm_area(ptr);
++		if (vm && (vm->flags & VM_USERCOPY))
++			return true;
++		return false;
++	}
++
 +	if (!virt_addr_valid(ptr))
 +		return false;
 +
@@ -115382,7 +115140,7 @@ index 999bb34..9843aea 100644
  {
  	void *ret;
 diff --git a/mm/slob.c b/mm/slob.c
-index 4765f65..fafa9d5 100644
+index 4765f65..f17284d 100644
 --- a/mm/slob.c
 +++ b/mm/slob.c
 @@ -157,7 +157,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
@@ -115556,7 +115314,7 @@ index 4765f65..fafa9d5 100644
  {
  	return __do_kmalloc_node(size, gfp, NUMA_NO_NODE, _RET_IP_);
  }
-@@ -491,34 +515,112 @@ void kfree(const void *block)
+@@ -491,34 +515,123 @@ void kfree(const void *block)
  		return;
  	kmemleak_free(block);
  
@@ -115585,6 +115343,17 @@ index 4765f65..fafa9d5 100644
 +	if (!slab_is_available())
 +		return false;
 +
++	if (is_vmalloc_addr(ptr)
++#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
++	    && !object_starts_on_stack(ptr)
++#endif
++	) {
++		struct vm_struct *vm = find_vm_area(ptr);
++		if (vm && (vm->flags & VM_USERCOPY))
++			return true;
++		return false;
++	}
++
 +	// PAX: TODO
 +
 +	return false;
@@ -115678,7 +115447,7 @@ index 4765f65..fafa9d5 100644
  }
  EXPORT_SYMBOL(ksize);
  
-@@ -534,23 +636,33 @@ int __kmem_cache_create(struct kmem_cache *c, unsigned long flags)
+@@ -534,23 +647,33 @@ int __kmem_cache_create(struct kmem_cache *c, unsigned long flags)
  
  static void *slob_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
  {
@@ -115714,7 +115483,7 @@ index 4765f65..fafa9d5 100644
  
  	if (b && c->ctor)
  		c->ctor(b);
-@@ -566,7 +678,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
+@@ -566,7 +689,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
  EXPORT_SYMBOL(kmem_cache_alloc);
  
  #ifdef CONFIG_NUMA
@@ -115723,7 +115492,7 @@ index 4765f65..fafa9d5 100644
  {
  	return __do_kmalloc_node(size, gfp, node, _RET_IP_);
  }
-@@ -579,12 +691,16 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t gfp, int node)
+@@ -579,12 +702,16 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t gfp, int node)
  EXPORT_SYMBOL(kmem_cache_alloc_node);
  #endif
  
@@ -115744,7 +115513,7 @@ index 4765f65..fafa9d5 100644
  }
  
  static void kmem_rcu_free(struct rcu_head *head)
-@@ -592,22 +708,36 @@ static void kmem_rcu_free(struct rcu_head *head)
+@@ -592,22 +719,36 @@ static void kmem_rcu_free(struct rcu_head *head)
  	struct slob_rcu *slob_rcu = (struct slob_rcu *)head;
  	void *b = (void *)slob_rcu - (slob_rcu->size - sizeof(struct slob_rcu));
  
@@ -115786,7 +115555,7 @@ index 4765f65..fafa9d5 100644
  EXPORT_SYMBOL(kmem_cache_free);
  
 diff --git a/mm/slub.c b/mm/slub.c
-index 54c0876..31383a1 100644
+index 54c0876..9fb1661 100644
 --- a/mm/slub.c
 +++ b/mm/slub.c
 @@ -198,7 +198,7 @@ struct track {
@@ -115850,7 +115619,7 @@ index 54c0876..31383a1 100644
  {
  	struct kmem_cache *s;
  	void *ret;
-@@ -3388,6 +3399,59 @@ static size_t __ksize(const void *object)
+@@ -3388,6 +3399,70 @@ static size_t __ksize(const void *object)
  	return slab_ksize(page->slab_cache);
  }
  
@@ -115865,6 +115634,17 @@ index 54c0876..31383a1 100644
 +	if (!slab_is_available())
 +		return false;
 +
++	if (is_vmalloc_addr(ptr)
++#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
++	    && !object_starts_on_stack(ptr)
++#endif
++	) {
++		struct vm_struct *vm = find_vm_area(ptr);
++		if (vm && (vm->flags & VM_USERCOPY))
++			return true;
++		return false;
++	}
++
 +	if (!virt_addr_valid(ptr))
 +		return false;
 +
@@ -115910,7 +115690,7 @@ index 54c0876..31383a1 100644
  size_t ksize(const void *object)
  {
  	size_t size = __ksize(object);
-@@ -3408,6 +3472,7 @@ void kfree(const void *x)
+@@ -3408,6 +3483,7 @@ void kfree(const void *x)
  	if (unlikely(ZERO_OR_NULL_PTR(x)))
  		return;
  
@@ -115918,7 +115698,7 @@ index 54c0876..31383a1 100644
  	page = virt_to_head_page(x);
  	if (unlikely(!PageSlab(page))) {
  		BUG_ON(!PageCompound(page));
-@@ -3724,7 +3789,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -3724,7 +3800,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
  
  	s = find_mergeable(size, align, flags, name, ctor);
  	if (s) {
@@ -115927,7 +115707,7 @@ index 54c0876..31383a1 100644
  
  		/*
  		 * Adjust the object sizes so that we clear
-@@ -3740,7 +3805,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -3740,7 +3816,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
  		}
  
  		if (sysfs_slab_alias(s, name)) {
@@ -115936,7 +115716,7 @@ index 54c0876..31383a1 100644
  			s = NULL;
  		}
  	}
-@@ -3857,7 +3922,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -3857,7 +3933,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
  }
  #endif
  
@@ -115945,7 +115725,7 @@ index 54c0876..31383a1 100644
  static int count_inuse(struct page *page)
  {
  	return page->inuse;
-@@ -4138,7 +4203,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
+@@ -4138,7 +4214,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
  		len += sprintf(buf + len, "%7ld ", l->count);
  
  		if (l->addr)
@@ -115957,7 +115737,7 @@ index 54c0876..31383a1 100644
  		else
  			len += sprintf(buf + len, "<not-available>");
  
-@@ -4236,12 +4305,12 @@ static void __init resiliency_test(void)
+@@ -4236,12 +4316,12 @@ static void __init resiliency_test(void)
  	validate_slab_cache(kmalloc_caches[9]);
  }
  #else
@@ -115972,7 +115752,7 @@ index 54c0876..31383a1 100644
  enum slab_stat_type {
  	SL_ALL,			/* All slabs */
  	SL_PARTIAL,		/* Only partially allocated slabs */
-@@ -4478,13 +4547,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
+@@ -4478,13 +4558,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
  {
  	if (!s->ctor)
  		return 0;
@@ -115991,7 +115771,7 @@ index 54c0876..31383a1 100644
  }
  SLAB_ATTR_RO(aliases);
  
-@@ -4572,6 +4645,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
+@@ -4572,6 +4656,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
  SLAB_ATTR_RO(cache_dma);
  #endif
  
@@ -116014,7 +115794,7 @@ index 54c0876..31383a1 100644
  static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
  {
  	return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
-@@ -4627,7 +4716,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
+@@ -4627,7 +4727,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
  	 * as well as cause other issues like converting a mergeable
  	 * cache into an umergeable one.
  	 */
@@ -116023,7 +115803,7 @@ index 54c0876..31383a1 100644
  		return -EINVAL;
  
  	s->flags &= ~SLAB_TRACE;
-@@ -4747,7 +4836,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
+@@ -4747,7 +4847,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
  static ssize_t failslab_store(struct kmem_cache *s, const char *buf,
  							size_t length)
  {
@@ -116032,7 +115812,7 @@ index 54c0876..31383a1 100644
  		return -EINVAL;
  
  	s->flags &= ~SLAB_FAILSLAB;
-@@ -4914,6 +5003,12 @@ static struct attribute *slab_attrs[] = {
+@@ -4914,6 +5014,12 @@ static struct attribute *slab_attrs[] = {
  #ifdef CONFIG_ZONE_DMA
  	&cache_dma_attr.attr,
  #endif
@@ -116045,7 +115825,7 @@ index 54c0876..31383a1 100644
  #ifdef CONFIG_NUMA
  	&remote_node_defrag_ratio_attr.attr,
  #endif
-@@ -5155,6 +5250,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5155,6 +5261,7 @@ static char *create_unique_id(struct kmem_cache *s)
  	return name;
  }
  
@@ -116053,7 +115833,7 @@ index 54c0876..31383a1 100644
  static int sysfs_slab_add(struct kmem_cache *s)
  {
  	int err;
-@@ -5228,6 +5324,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5228,6 +5335,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
  	kobject_del(&s->kobj);
  	kobject_put(&s->kobj);
  }
@@ -116061,7 +115841,7 @@ index 54c0876..31383a1 100644
  
  /*
   * Need to buffer aliases during bootup until sysfs becomes
-@@ -5241,6 +5338,7 @@ struct saved_alias {
+@@ -5241,6 +5349,7 @@ struct saved_alias {
  
  static struct saved_alias *alias_list;
  
@@ -116069,7 +115849,7 @@ index 54c0876..31383a1 100644
  static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  {
  	struct saved_alias *al;
-@@ -5263,6 +5361,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5263,6 +5372,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
  	alias_list = al;
  	return 0;
  }
@@ -116204,7 +115984,7 @@ index 68ff8a5..40c7a70 100644
  
  	if (len > buflen)
 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 2faaa29..9744185 100644
+index 2faaa29..37314a8 100644
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
 @@ -40,20 +40,65 @@ struct vfree_deferred {
@@ -116498,7 +116278,22 @@ index 2faaa29..9744185 100644
  	area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNINITIALIZED |
  				vm_flags, start, end, node, gfp_mask, caller);
  	if (!area)
-@@ -1838,10 +1979,9 @@ EXPORT_SYMBOL(vzalloc_node);
+@@ -1715,6 +1856,14 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
+ 				gfp_mask, prot, 0, node, caller);
+ }
+ 
++void *vmalloc_usercopy(unsigned long size)
++{
++	return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END,
++				    GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
++				    VM_USERCOPY, NUMA_NO_NODE,
++				    __builtin_return_address(0));
++}
++
+ void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
+ {
+ 	return __vmalloc_node(size, 1, gfp_mask, prot, NUMA_NO_NODE,
+@@ -1838,10 +1987,9 @@ EXPORT_SYMBOL(vzalloc_node);
   *	For tight control over page level allocator and protection flags
   *	use __vmalloc() instead.
   */
@@ -116510,7 +116305,7 @@ index 2faaa29..9744185 100644
  			      NUMA_NO_NODE, __builtin_return_address(0));
  }
  
-@@ -2148,6 +2288,8 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
+@@ -2148,6 +2296,8 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
  {
  	struct vm_struct *area;
  
@@ -116519,7 +116314,7 @@ index 2faaa29..9744185 100644
  	size = PAGE_ALIGN(size);
  
  	if (!PAGE_ALIGNED(uaddr) || !PAGE_ALIGNED(kaddr))
-@@ -2630,7 +2772,11 @@ static int s_show(struct seq_file *m, void *p)
+@@ -2630,7 +2780,11 @@ static int s_show(struct seq_file *m, void *p)
  		v->addr, v->addr + v->size, v->size);
  
  	if (v->caller)
@@ -117188,10 +116983,28 @@ index e29ad70b..cc00066 100644
  	if (ip.proto == htons(ETH_P_IP)) {
  		if (timer_pending(&br->ip4_other_query.timer))
 diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
-index 4b5c236..0627070 100644
+index 4b5c236..f303683 100644
 --- a/net/bridge/br_netlink.c
 +++ b/net/bridge/br_netlink.c
-@@ -841,7 +841,7 @@ static struct rtnl_af_ops br_af_ops __read_mostly = {
+@@ -112,6 +112,8 @@ static inline size_t br_port_info_size(void)
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_FAST_LEAVE */
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_LEARNING */
+ 		+ nla_total_size(1)	/* IFLA_BRPORT_UNICAST_FLOOD */
++		+ nla_total_size(1)	/* IFLA_BRPORT_PROXYARP */
++		+ nla_total_size(1)	/* IFLA_BRPORT_PROXYARP_WIFI */
+ 		+ 0;
+ }
+ 
+@@ -504,6 +506,8 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
+ 	[IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
+ 	[IFLA_BRPORT_LEARNING]	= { .type = NLA_U8 },
+ 	[IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
++	[IFLA_BRPORT_PROXYARP]	= { .type = NLA_U8 },
++	[IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 },
+ };
+ 
+ /* Change the state of the port and notify spanning tree */
+@@ -841,7 +845,7 @@ static struct rtnl_af_ops br_af_ops __read_mostly = {
  	.get_link_af_size	= br_get_link_af_size,
  };
  
@@ -117288,10 +117101,10 @@ index 67a4a36..8d28068 100644
  	.priv_size	= sizeof(struct chnl_net),
  	.setup		= ipcaif_net_setup,
 diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 689c818..6323851 100644
+index 62c635f..0b59618 100644
 --- a/net/can/af_can.c
 +++ b/net/can/af_can.c
-@@ -888,7 +888,7 @@ static const struct net_proto_family can_family_ops = {
+@@ -890,7 +890,7 @@ static const struct net_proto_family can_family_ops = {
  };
  
  /* notifier block for netdevice event */
@@ -117301,10 +117114,10 @@ index 689c818..6323851 100644
  };
  
 diff --git a/net/can/bcm.c b/net/can/bcm.c
-index b523453..f96e639 100644
+index a1ba687..aafaec5 100644
 --- a/net/can/bcm.c
 +++ b/net/can/bcm.c
-@@ -1618,7 +1618,7 @@ static int __init bcm_module_init(void)
+@@ -1620,7 +1620,7 @@ static int __init bcm_module_init(void)
  	}
  
  	/* create /proc/net/can-bcm directory */
@@ -117489,19 +117302,19 @@ index 5cfd26a..7e43828 100644
  	a0 = a[0];
  	a1 = a[1];
 diff --git a/net/core/datagram.c b/net/core/datagram.c
-index b80fb91..d9f4ea5 100644
+index b80fb91..0364f4f 100644
 --- a/net/core/datagram.c
 +++ b/net/core/datagram.c
 @@ -131,6 +131,35 @@ out_noerr:
  	goto out;
  }
  
-+static int skb_set_peeked(struct sk_buff *skb)
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
 +{
 +	struct sk_buff *nskb;
 +
 +	if (skb->peeked)
-+		return 0;
++		return skb;
 +
 +	/* We have to unshare an skb before modifying it. */
 +	if (!skb_shared(skb))
@@ -117509,7 +117322,7 @@ index b80fb91..d9f4ea5 100644
 +
 +	nskb = skb_clone(skb, GFP_ATOMIC);
 +	if (!nskb)
-+		return -ENOMEM;
++		return ERR_PTR(-ENOMEM);
 +
 +	skb->prev->next = nskb;
 +	skb->next->prev = nskb;
@@ -117522,7 +117335,7 @@ index b80fb91..d9f4ea5 100644
 +done:
 +	skb->peeked = 1;
 +
-+	return 0;
++	return skb;
 +}
 +
  /**
@@ -117547,20 +117360,21 @@ index b80fb91..d9f4ea5 100644
  		int _off = *off;
  
  		last = (struct sk_buff *)queue;
-@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -199,7 +228,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
  					_off -= skb->len;
  					continue;
  				}
 -				skb->peeked = 1;
 +
-+				error = skb_set_peeked(skb);
-+				if (error)
++				skb = skb_set_peeked(skb);
++				error = PTR_ERR(skb);
++				if (IS_ERR(skb))
 +					goto unlock_err;
 +
  				atomic_inc(&skb->users);
  			} else
  				__skb_unlink(skb, queue);
-@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -223,6 +257,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
  
  	return NULL;
  
@@ -117569,7 +117383,7 @@ index b80fb91..d9f4ea5 100644
  no_packet:
  	*err = error;
  	return NULL;
-@@ -302,7 +337,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+@@ -302,7 +338,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
  	}
  
  	kfree_skb(skb);
@@ -117578,7 +117392,7 @@ index b80fb91..d9f4ea5 100644
  	sk_mem_reclaim_partial(sk);
  
  	return err;
-@@ -622,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
+@@ -622,7 +658,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
  		    !skb->csum_complete_sw)
  			netdev_rx_csum_fault(skb->dev);
  	}
@@ -117588,7 +117402,7 @@ index b80fb91..d9f4ea5 100644
  	return sum;
  }
  EXPORT_SYMBOL(__skb_checksum_complete_head);
-@@ -642,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
+@@ -642,11 +679,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
  			netdev_rx_csum_fault(skb->dev);
  	}
  
@@ -122031,6 +121845,19 @@ index 1b981a4..ae44b0c 100644
  }
  #endif
  
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f6..140a44a 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+ 
+ 	/* check for all kinds of wrapping and the like */
+ 	start = (unsigned long)optval;
+-	if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++	if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ 		ret = -EINVAL;
+ 		goto out;
+ 	}
 diff --git a/net/rds/iw.h b/net/rds/iw.h
 index cbe6674..dc9eb89 100644
 --- a/net/rds/iw.h
@@ -126162,7 +125989,7 @@ index b48b434..e2ba787 100644
  	if (err < 0)
  		return err;
 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index d126c03..5d84d1cf 100644
+index 75888dd..c940854 100644
 --- a/sound/core/pcm_native.c
 +++ b/sound/core/pcm_native.c
 @@ -3004,11 +3004,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
@@ -133745,10 +133572,10 @@ index 0000000..b8e7188
 +}
 diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
 new file mode 100644
-index 0000000..e445f02
+index 0000000..ed2d97b
 --- /dev/null
 +++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,28384 @@
+@@ -0,0 +1,28385 @@
 +intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL nohasharray
 +iwl_set_tx_power_1 iwl_set_tx_power 0 1 &intel_fake_agp_alloc_by_type_1
 +ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
@@ -137372,6 +137199,7 @@ index 0000000..e445f02
 +generic_write_sync_8358 generic_write_sync 0 8358 NULL
 +qlcnic_open_8359 qlcnic_open 0 8359 NULL
 +isku_sysfs_write_talk_8360 isku_sysfs_write_talk 6-0-5 8360 NULL
++vmalloc_usercopy_8361 vmalloc_usercopy 1 8361 NULL
 +ath6kl_lrssi_roam_write_8362 ath6kl_lrssi_roam_write 3-0 8362 NULL nohasharray
 +batadv_sysfs_add_vlan_8362 batadv_sysfs_add_vlan 0 8362 &ath6kl_lrssi_roam_write_8362
 +alloc_sleep_millisecs_store_8364 alloc_sleep_millisecs_store 0-4 8364 NULL
diff --git a/4.1.4/4425_grsec_remove_EI_PAX.patch b/4.1.5/4425_grsec_remove_EI_PAX.patch
index a80a5d7..a80a5d7 100644
--- a/4.1.4/4425_grsec_remove_EI_PAX.patch
+++ b/4.1.5/4425_grsec_remove_EI_PAX.patch
diff --git a/4.1.4/4427_force_XATTR_PAX_tmpfs.patch b/4.1.5/4427_force_XATTR_PAX_tmpfs.patch
index a789f0b..a789f0b 100644
--- a/4.1.4/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.1.5/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.1.4/4430_grsec-remove-localversion-grsec.patch b/4.1.5/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.1.4/4430_grsec-remove-localversion-grsec.patch
+++ b/4.1.5/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.1.4/4435_grsec-mute-warnings.patch b/4.1.5/4435_grsec-mute-warnings.patch
index b7564e4..b7564e4 100644
--- a/4.1.4/4435_grsec-mute-warnings.patch
+++ b/4.1.5/4435_grsec-mute-warnings.patch
diff --git a/4.1.4/4440_grsec-remove-protected-paths.patch b/4.1.5/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.1.4/4440_grsec-remove-protected-paths.patch
+++ b/4.1.5/4440_grsec-remove-protected-paths.patch
diff --git a/4.1.4/4450_grsec-kconfig-default-gids.patch b/4.1.5/4450_grsec-kconfig-default-gids.patch
index 61d903e..61d903e 100644
--- a/4.1.4/4450_grsec-kconfig-default-gids.patch
+++ b/4.1.5/4450_grsec-kconfig-default-gids.patch
diff --git a/4.1.4/4465_selinux-avc_audit-log-curr_ip.patch b/4.1.5/4465_selinux-avc_audit-log-curr_ip.patch
index ba89596..ba89596 100644
--- a/4.1.4/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.1.5/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.1.4/4470_disable-compat_vdso.patch b/4.1.5/4470_disable-compat_vdso.patch
index 7aefa02..7aefa02 100644
--- a/4.1.4/4470_disable-compat_vdso.patch
+++ b/4.1.5/4470_disable-compat_vdso.patch
diff --git a/4.1.4/4475_emutramp_default_on.patch b/4.1.5/4475_emutramp_default_on.patch
index a128205..a128205 100644
--- a/4.1.4/4475_emutramp_default_on.patch
+++ b/4.1.5/4475_emutramp_default_on.patch