* [gentoo-commits] proj/hardened-patchset:master commit in: 3.8.10/, 2.6.32/, 3.2.44/, 3.2.43/, 3.8.8/
@ 2013-04-28 13:02 Anthony G. Basile
0 siblings, 0 replies; only message in thread
From: Anthony G. Basile @ 2013-04-28 13:02 UTC (permalink / raw
To: gentoo-commits
commit: 6fefc319329e2d1683686cca57fbde4358d3b688
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Sun Apr 28 13:02:13 2013 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Sun Apr 28 13:02:13 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=6fefc319
Grsec/PaX: 2.9.1-{2.6.32.60,3.2.44,3.8.10}-201304271916
---
2.6.32/0000_README | 2 +-
..._grsecurity-2.9.1-2.6.32.60-201304262205.patch} | 53 +-
{3.2.43 => 3.2.44}/0000_README | 6 +-
{3.2.43 => 3.2.44}/1021_linux-3.2.22.patch | 0
{3.2.43 => 3.2.44}/1022_linux-3.2.23.patch | 0
{3.2.43 => 3.2.44}/1023_linux-3.2.24.patch | 0
{3.2.43 => 3.2.44}/1024_linux-3.2.25.patch | 0
{3.2.43 => 3.2.44}/1025_linux-3.2.26.patch | 0
{3.2.43 => 3.2.44}/1026_linux-3.2.27.patch | 0
{3.2.43 => 3.2.44}/1027_linux-3.2.28.patch | 0
{3.2.43 => 3.2.44}/1028_linux-3.2.29.patch | 0
{3.2.43 => 3.2.44}/1029_linux-3.2.30.patch | 0
{3.2.43 => 3.2.44}/1030_linux-3.2.31.patch | 0
{3.2.43 => 3.2.44}/1031_linux-3.2.32.patch | 0
{3.2.43 => 3.2.44}/1032_linux-3.2.33.patch | 0
{3.2.43 => 3.2.44}/1033_linux-3.2.34.patch | 0
{3.2.43 => 3.2.44}/1034_linux-3.2.35.patch | 0
{3.2.43 => 3.2.44}/1035_linux-3.2.36.patch | 0
{3.2.43 => 3.2.44}/1036_linux-3.2.37.patch | 0
{3.2.43 => 3.2.44}/1037_linux-3.2.38.patch | 0
{3.2.43 => 3.2.44}/1038_linux-3.2.39.patch | 0
{3.2.43 => 3.2.44}/1039_linux-3.2.40.patch | 0
{3.2.43 => 3.2.44}/1040_linux-3.2.41.patch | 0
{3.2.43 => 3.2.44}/1041_linux-3.2.42.patch | 0
{3.2.43 => 3.2.44}/1042_linux-3.2.43.patch | 0
3.2.44/1043_linux-3.2.44.patch | 2808 ++++++++++++++++++++
...4420_grsecurity-2.9.1-3.2.44-201304271916.patch | 745 ++----
{3.2.43 => 3.2.44}/4425_grsec_remove_EI_PAX.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.2.43 => 3.2.44}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{3.2.43 => 3.2.44}/4470_disable-compat_vdso.patch | 0
{3.8.8 => 3.8.10}/0000_README | 10 +-
3.8.10/1008_linux-3.8.9.patch | 1649 ++++++++++++
3.8.10/1009_linux-3.8.10.patch | 67 +
...4420_grsecurity-2.9.1-3.8.10-201304262208.patch | 1176 ++++++---
{3.8.8 => 3.8.10}/4425_grsec_remove_EI_PAX.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.8.8 => 3.8.10}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{3.8.8 => 3.8.10}/4470_disable-compat_vdso.patch | 0
3.8.8/1006_linux-3.8.7.patch | 2238 ----------------
3.8.8/1007_linux-3.8.8.patch | 1471 ----------
47 files changed, 5730 insertions(+), 4495 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index d04e223..2b44ed9 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch: 1059_linux-2.6.32.60.patch
From: http://www.kernel.org
Desc: Linux 2.6.32.59
-Patch: 4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch
+Patch: 4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
index 3224566..2f14145 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
@@ -43603,7 +43603,7 @@ index bf2170f..ce8cab9 100644
acpi_os_unmap_memory(virt, len);
return 0;
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index 123cedf..6664cb4 100644
+index 123cedf..f7eebb9 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -146,7 +146,7 @@ static int tty_open(struct inode *, struct file *);
@@ -43615,7 +43615,44 @@ index 123cedf..6664cb4 100644
unsigned long arg);
#else
#define tty_compat_ioctl NULL
-@@ -1774,6 +1774,7 @@ got_driver:
+@@ -856,6 +856,14 @@ void start_tty(struct tty_struct *tty)
+
+ EXPORT_SYMBOL(start_tty);
+
++static void tty_update_time(struct timespec *time)
++{
++ unsigned long sec = get_seconds();
++ sec -= sec % 60;
++ if ((long)(sec - time->tv_sec) > 0)
++ time->tv_sec = sec;
++}
++
+ /**
+ * tty_read - read method for tty device files
+ * @file: pointer to tty file
+@@ -894,8 +902,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ else
+ i = -EIO;
+ tty_ldisc_deref(ld);
++
+ if (i > 0)
+- inode->i_atime = current_fs_time(inode->i_sb);
++ tty_update_time(&inode->i_atime);
++
+ return i;
+ }
+
+@@ -995,8 +1005,7 @@ static inline ssize_t do_tty_write(
+ cond_resched();
+ }
+ if (written) {
+- struct inode *inode = file->f_path.dentry->d_inode;
+- inode->i_mtime = current_fs_time(inode->i_sb);
++ tty_update_time(&file->f_dentry->d_inode->i_mtime);
+ ret = written;
+ }
+ out:
+@@ -1774,6 +1783,7 @@ got_driver:
if (IS_ERR(tty)) {
mutex_unlock(&tty_mutex);
@@ -43623,7 +43660,7 @@ index 123cedf..6664cb4 100644
return PTR_ERR(tty);
}
}
-@@ -2603,8 +2604,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -2603,8 +2613,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
return retval;
}
@@ -43635,7 +43672,7 @@ index 123cedf..6664cb4 100644
unsigned long arg)
{
struct inode *inode = file->f_dentry->d_inode;
-@@ -2628,6 +2631,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+@@ -2628,6 +2640,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
return retval;
}
@@ -43644,7 +43681,7 @@ index 123cedf..6664cb4 100644
#endif
/*
-@@ -3073,7 +3078,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+@@ -3073,7 +3087,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
void tty_default_fops(struct file_operations *fops)
{
@@ -45733,7 +45770,7 @@ index b170071..28ae90e 100644
item->object = NULL;
}
diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
-index 072c281..d8ef483 100644
+index 072c281a..d8ef483 100644
--- a/drivers/gpu/drm/ttm/ttm_memory.c
+++ b/drivers/gpu/drm/ttm/ttm_memory.c
@@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_attrs[] = {
@@ -120907,7 +120944,7 @@ index 2f7ffa6..0455400 100644
};
diff --git a/security/security.c b/security/security.c
-index c4c6732..bc63d84 100644
+index c4c6732..5ee1542 100644
--- a/security/security.c
+++ b/security/security.c
@@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
@@ -120935,7 +120972,7 @@ index c4c6732..bc63d84 100644
+int security_capable_noaudit(int cap)
+{
+ return security_ops->capable(current, current_cred(), cap,
-+ SECURITY_CAP_AUDIT);
++ SECURITY_CAP_NOAUDIT);
+}
+
int security_real_capable(struct task_struct *tsk, int cap)
diff --git a/3.2.43/0000_README b/3.2.44/0000_README
similarity index 95%
rename from 3.2.43/0000_README
rename to 3.2.44/0000_README
index 9450604..91b9efe 100644
--- a/3.2.43/0000_README
+++ b/3.2.44/0000_README
@@ -90,7 +90,11 @@ Patch: 1042_linux-3.2.43.patch
From: http://www.kernel.org
Desc: Linux 3.2.43
-Patch: 4420_grsecurity-2.9.1-3.2.43-201304181907.patch
+Patch: 1043_linux-3.2.44.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.44
+
+Patch: 4420_grsecurity-2.9.1-3.2.44-201304271916.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.43/1021_linux-3.2.22.patch b/3.2.44/1021_linux-3.2.22.patch
similarity index 100%
rename from 3.2.43/1021_linux-3.2.22.patch
rename to 3.2.44/1021_linux-3.2.22.patch
diff --git a/3.2.43/1022_linux-3.2.23.patch b/3.2.44/1022_linux-3.2.23.patch
similarity index 100%
rename from 3.2.43/1022_linux-3.2.23.patch
rename to 3.2.44/1022_linux-3.2.23.patch
diff --git a/3.2.43/1023_linux-3.2.24.patch b/3.2.44/1023_linux-3.2.24.patch
similarity index 100%
rename from 3.2.43/1023_linux-3.2.24.patch
rename to 3.2.44/1023_linux-3.2.24.patch
diff --git a/3.2.43/1024_linux-3.2.25.patch b/3.2.44/1024_linux-3.2.25.patch
similarity index 100%
rename from 3.2.43/1024_linux-3.2.25.patch
rename to 3.2.44/1024_linux-3.2.25.patch
diff --git a/3.2.43/1025_linux-3.2.26.patch b/3.2.44/1025_linux-3.2.26.patch
similarity index 100%
rename from 3.2.43/1025_linux-3.2.26.patch
rename to 3.2.44/1025_linux-3.2.26.patch
diff --git a/3.2.43/1026_linux-3.2.27.patch b/3.2.44/1026_linux-3.2.27.patch
similarity index 100%
rename from 3.2.43/1026_linux-3.2.27.patch
rename to 3.2.44/1026_linux-3.2.27.patch
diff --git a/3.2.43/1027_linux-3.2.28.patch b/3.2.44/1027_linux-3.2.28.patch
similarity index 100%
rename from 3.2.43/1027_linux-3.2.28.patch
rename to 3.2.44/1027_linux-3.2.28.patch
diff --git a/3.2.43/1028_linux-3.2.29.patch b/3.2.44/1028_linux-3.2.29.patch
similarity index 100%
rename from 3.2.43/1028_linux-3.2.29.patch
rename to 3.2.44/1028_linux-3.2.29.patch
diff --git a/3.2.43/1029_linux-3.2.30.patch b/3.2.44/1029_linux-3.2.30.patch
similarity index 100%
rename from 3.2.43/1029_linux-3.2.30.patch
rename to 3.2.44/1029_linux-3.2.30.patch
diff --git a/3.2.43/1030_linux-3.2.31.patch b/3.2.44/1030_linux-3.2.31.patch
similarity index 100%
rename from 3.2.43/1030_linux-3.2.31.patch
rename to 3.2.44/1030_linux-3.2.31.patch
diff --git a/3.2.43/1031_linux-3.2.32.patch b/3.2.44/1031_linux-3.2.32.patch
similarity index 100%
rename from 3.2.43/1031_linux-3.2.32.patch
rename to 3.2.44/1031_linux-3.2.32.patch
diff --git a/3.2.43/1032_linux-3.2.33.patch b/3.2.44/1032_linux-3.2.33.patch
similarity index 100%
rename from 3.2.43/1032_linux-3.2.33.patch
rename to 3.2.44/1032_linux-3.2.33.patch
diff --git a/3.2.43/1033_linux-3.2.34.patch b/3.2.44/1033_linux-3.2.34.patch
similarity index 100%
rename from 3.2.43/1033_linux-3.2.34.patch
rename to 3.2.44/1033_linux-3.2.34.patch
diff --git a/3.2.43/1034_linux-3.2.35.patch b/3.2.44/1034_linux-3.2.35.patch
similarity index 100%
rename from 3.2.43/1034_linux-3.2.35.patch
rename to 3.2.44/1034_linux-3.2.35.patch
diff --git a/3.2.43/1035_linux-3.2.36.patch b/3.2.44/1035_linux-3.2.36.patch
similarity index 100%
rename from 3.2.43/1035_linux-3.2.36.patch
rename to 3.2.44/1035_linux-3.2.36.patch
diff --git a/3.2.43/1036_linux-3.2.37.patch b/3.2.44/1036_linux-3.2.37.patch
similarity index 100%
rename from 3.2.43/1036_linux-3.2.37.patch
rename to 3.2.44/1036_linux-3.2.37.patch
diff --git a/3.2.43/1037_linux-3.2.38.patch b/3.2.44/1037_linux-3.2.38.patch
similarity index 100%
rename from 3.2.43/1037_linux-3.2.38.patch
rename to 3.2.44/1037_linux-3.2.38.patch
diff --git a/3.2.43/1038_linux-3.2.39.patch b/3.2.44/1038_linux-3.2.39.patch
similarity index 100%
rename from 3.2.43/1038_linux-3.2.39.patch
rename to 3.2.44/1038_linux-3.2.39.patch
diff --git a/3.2.43/1039_linux-3.2.40.patch b/3.2.44/1039_linux-3.2.40.patch
similarity index 100%
rename from 3.2.43/1039_linux-3.2.40.patch
rename to 3.2.44/1039_linux-3.2.40.patch
diff --git a/3.2.43/1040_linux-3.2.41.patch b/3.2.44/1040_linux-3.2.41.patch
similarity index 100%
rename from 3.2.43/1040_linux-3.2.41.patch
rename to 3.2.44/1040_linux-3.2.41.patch
diff --git a/3.2.43/1041_linux-3.2.42.patch b/3.2.44/1041_linux-3.2.42.patch
similarity index 100%
rename from 3.2.43/1041_linux-3.2.42.patch
rename to 3.2.44/1041_linux-3.2.42.patch
diff --git a/3.2.43/1042_linux-3.2.43.patch b/3.2.44/1042_linux-3.2.43.patch
similarity index 100%
rename from 3.2.43/1042_linux-3.2.43.patch
rename to 3.2.44/1042_linux-3.2.43.patch
diff --git a/3.2.44/1043_linux-3.2.44.patch b/3.2.44/1043_linux-3.2.44.patch
new file mode 100644
index 0000000..3d5e6ff
--- /dev/null
+++ b/3.2.44/1043_linux-3.2.44.patch
@@ -0,0 +1,2808 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index ddbf18e..897f223 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -948,6 +948,20 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ i8k.restricted [HW] Allow controlling fans only if SYS_ADMIN
+ capability is set.
+
++ i915.invert_brightness=
++ [DRM] Invert the sense of the variable that is used to
++ set the brightness of the panel backlight. Normally a
++ brightness value of 0 indicates backlight switched off,
++ and the maximum of the brightness value sets the backlight
++ to maximum brightness. If this parameter is set to 0
++ (default) and the machine requires it, or this parameter
++ is set to 1, a brightness value of 0 sets the backlight
++ to maximum brightness, and the maximum of the brightness
++ value switches the backlight off.
++ -1 -- never invert brightness
++ 0 -- machine default
++ 1 -- force brightness inversion
++
+ icn= [HW,ISDN]
+ Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]]
+
+diff --git a/Makefile b/Makefile
+index 59130db..566750c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 43
++SUBLEVEL = 44
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
+index 4112200..c52a8ef 100644
+--- a/arch/alpha/kernel/sys_nautilus.c
++++ b/arch/alpha/kernel/sys_nautilus.c
+@@ -189,6 +189,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
+ extern void free_reserved_mem(void *, void *);
+ extern void pcibios_claim_one_bus(struct pci_bus *);
+
++static struct resource irongate_io = {
++ .name = "Irongate PCI IO",
++ .flags = IORESOURCE_IO,
++};
+ static struct resource irongate_mem = {
+ .name = "Irongate PCI MEM",
+ .flags = IORESOURCE_MEM,
+@@ -210,6 +214,7 @@ nautilus_init_pci(void)
+
+ irongate = pci_get_bus_and_slot(0, 0);
+ bus->self = irongate;
++ bus->resource[0] = &irongate_io;
+ bus->resource[1] = &irongate_mem;
+
+ pci_bus_size_bridges(bus);
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index ecebb89..a559ee7 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -326,7 +326,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ struct hw_perf_event fake_event = event->hw;
+ struct pmu *leader_pmu = event->group_leader->pmu;
+
+- if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++ if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++ return 1;
++
++ if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ return 1;
+
+ return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
+diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
+index e0b0e7a..09f8851 100644
+--- a/arch/arm/mm/cache-feroceon-l2.c
++++ b/arch/arm/mm/cache-feroceon-l2.c
+@@ -342,6 +342,7 @@ void __init feroceon_l2_init(int __l2_wt_override)
+ outer_cache.inv_range = feroceon_l2_inv_range;
+ outer_cache.clean_range = feroceon_l2_clean_range;
+ outer_cache.flush_range = feroceon_l2_flush_range;
++ outer_cache.inv_all = l2_inv_all;
+
+ enable_l2();
+
+diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
+index 88fb3d9..927a639 100644
+--- a/arch/arm/mm/proc-arm920.S
++++ b/arch/arm/mm/proc-arm920.S
+@@ -380,7 +380,7 @@ ENTRY(cpu_arm920_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl cpu_arm920_suspend_size
+ .equ cpu_arm920_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm920_do_suspend)
+ stmfd sp!, {r4 - r6, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ PID
+diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
+index 9f8fd91..090f18f 100644
+--- a/arch/arm/mm/proc-arm926.S
++++ b/arch/arm/mm/proc-arm926.S
+@@ -395,7 +395,7 @@ ENTRY(cpu_arm926_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl cpu_arm926_suspend_size
+ .equ cpu_arm926_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm926_do_suspend)
+ stmfd sp!, {r4 - r6, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ PID
+diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
+index 7d91545..6594aef 100644
+--- a/arch/arm/mm/proc-sa1100.S
++++ b/arch/arm/mm/proc-sa1100.S
+@@ -169,7 +169,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
+
+ .globl cpu_sa1100_suspend_size
+ .equ cpu_sa1100_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_sa1100_do_suspend)
+ stmfd sp!, {r4 - r6, lr}
+ mrc p15, 0, r4, c3, c0, 0 @ domain ID
+diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
+index d061d2f..8168d99 100644
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -129,7 +129,7 @@ ENTRY(cpu_v6_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
+ .globl cpu_v6_suspend_size
+ .equ cpu_v6_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_v6_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ FCSE/PID
+diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
+index abf0507..5c4969d 100644
+--- a/arch/arm/mm/proc-xsc3.S
++++ b/arch/arm/mm/proc-xsc3.S
+@@ -407,7 +407,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
+
+ .globl cpu_xsc3_suspend_size
+ .equ cpu_xsc3_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xsc3_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p14, 0, r4, c6, c0, 0 @ clock configuration, for turbo mode
+diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
+index 3277904..b09d036 100644
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -521,7 +521,7 @@ ENTRY(cpu_xscale_set_pte_ext)
+
+ .globl cpu_xscale_suspend_size
+ .equ cpu_xscale_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xscale_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p14, 0, r4, c6, c0, 0 @ clock configuration, for turbo mode
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index dc36ea6..eb19b6c 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
+ (0x1UL << 4), &dummy1, &dummy2);
+ if (lpar_rc == H_SUCCESS)
+ return i;
+- BUG_ON(lpar_rc != H_NOT_FOUND);
++
++ /*
++ * The test for adjunct partition is performed before the
++ * ANDCOND test. H_RESOURCE may be returned, so we need to
++ * check for that as well.
++ */
++ BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
+
+ slot_offset++;
+ slot_offset &= 0x7;
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index b4973f4..cfb5a40 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -393,8 +393,8 @@ struct kvm_vcpu_arch {
+ gpa_t time;
+ struct pvclock_vcpu_time_info hv_clock;
+ unsigned int hw_tsc_khz;
+- unsigned int time_offset;
+- struct page *time_page;
++ struct gfn_to_hva_cache pv_time;
++ bool pv_time_enabled;
+
+ struct {
+ u64 msr_val;
+diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
+index a7d2db9..91e758b 100644
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -740,7 +740,10 @@ static inline void arch_leave_lazy_mmu_mode(void)
+ PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
+ }
+
+-void arch_flush_lazy_mmu_mode(void);
++static inline void arch_flush_lazy_mmu_mode(void)
++{
++ PVOP_VCALL0(pv_mmu_ops.lazy_mode.flush);
++}
+
+ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
+ phys_addr_t phys, pgprot_t flags)
+diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
+index 8e8b9a4..faf2c04 100644
+--- a/arch/x86/include/asm/paravirt_types.h
++++ b/arch/x86/include/asm/paravirt_types.h
+@@ -91,6 +91,7 @@ struct pv_lazy_ops {
+ /* Set deferred update mode, used for batching operations. */
+ void (*enter)(void);
+ void (*leave)(void);
++ void (*flush)(void);
+ };
+
+ struct pv_time_ops {
+@@ -680,6 +681,7 @@ void paravirt_end_context_switch(struct task_struct *next);
+
+ void paravirt_enter_lazy_mmu(void);
+ void paravirt_leave_lazy_mmu(void);
++void paravirt_flush_lazy_mmu(void);
+
+ void _paravirt_nop(void);
+ u32 _paravirt_ident_32(u32);
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index d90272e..84c938f 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -261,6 +261,18 @@ void paravirt_leave_lazy_mmu(void)
+ leave_lazy(PARAVIRT_LAZY_MMU);
+ }
+
++void paravirt_flush_lazy_mmu(void)
++{
++ preempt_disable();
++
++ if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
++ arch_leave_lazy_mmu_mode();
++ arch_enter_lazy_mmu_mode();
++ }
++
++ preempt_enable();
++}
++
+ void paravirt_start_context_switch(struct task_struct *prev)
+ {
+ BUG_ON(preemptible());
+@@ -290,18 +302,6 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
+ return percpu_read(paravirt_lazy_mode);
+ }
+
+-void arch_flush_lazy_mmu_mode(void)
+-{
+- preempt_disable();
+-
+- if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
+- arch_leave_lazy_mmu_mode();
+- arch_enter_lazy_mmu_mode();
+- }
+-
+- preempt_enable();
+-}
+-
+ struct pv_info pv_info = {
+ .name = "bare hardware",
+ .paravirt_enabled = 0,
+@@ -475,6 +475,7 @@ struct pv_mmu_ops pv_mmu_ops = {
+ .lazy_mode = {
+ .enter = paravirt_nop,
+ .leave = paravirt_nop,
++ .flush = paravirt_nop,
+ },
+
+ .set_fixmap = native_set_fixmap,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f4063fd..e82a53a 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1105,7 +1105,6 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ {
+ unsigned long flags;
+ struct kvm_vcpu_arch *vcpu = &v->arch;
+- void *shared_kaddr;
+ unsigned long this_tsc_khz;
+ s64 kernel_ns, max_kernel_ns;
+ u64 tsc_timestamp;
+@@ -1141,7 +1140,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+
+ local_irq_restore(flags);
+
+- if (!vcpu->time_page)
++ if (!vcpu->pv_time_enabled)
+ return 0;
+
+ /*
+@@ -1199,14 +1198,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ */
+ vcpu->hv_clock.version += 2;
+
+- shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0);
+-
+- memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
+- sizeof(vcpu->hv_clock));
+-
+- kunmap_atomic(shared_kaddr, KM_USER0);
+-
+- mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
++ kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
++ &vcpu->hv_clock,
++ sizeof(vcpu->hv_clock));
+ return 0;
+ }
+
+@@ -1486,7 +1480,8 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ return 0;
+ }
+
+- if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa))
++ if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
++ sizeof(u32)))
+ return 1;
+
+ vcpu->arch.apf.send_user_only = !(data & KVM_ASYNC_PF_SEND_ALWAYS);
+@@ -1496,10 +1491,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+
+ static void kvmclock_reset(struct kvm_vcpu *vcpu)
+ {
+- if (vcpu->arch.time_page) {
+- kvm_release_page_dirty(vcpu->arch.time_page);
+- vcpu->arch.time_page = NULL;
+- }
++ vcpu->arch.pv_time_enabled = false;
+ }
+
+ static void accumulate_steal_time(struct kvm_vcpu *vcpu)
+@@ -1591,6 +1583,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ break;
+ case MSR_KVM_SYSTEM_TIME_NEW:
+ case MSR_KVM_SYSTEM_TIME: {
++ u64 gpa_offset;
+ kvmclock_reset(vcpu);
+
+ vcpu->arch.time = data;
+@@ -1600,16 +1593,14 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ if (!(data & 1))
+ break;
+
+- /* ...but clean it before doing the actual write */
+- vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
++ gpa_offset = data & ~(PAGE_MASK | 1);
+
+- vcpu->arch.time_page =
+- gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
+-
+- if (is_error_page(vcpu->arch.time_page)) {
+- kvm_release_page_clean(vcpu->arch.time_page);
+- vcpu->arch.time_page = NULL;
+- }
++ if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
++ &vcpu->arch.pv_time, data & ~1ULL,
++ sizeof(struct pvclock_vcpu_time_info)))
++ vcpu->arch.pv_time_enabled = false;
++ else
++ vcpu->arch.pv_time_enabled = true;
+ break;
+ }
+ case MSR_KVM_ASYNC_PF_EN:
+@@ -1625,7 +1616,8 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ return 1;
+
+ if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
+- data & KVM_STEAL_VALID_BITS))
++ data & KVM_STEAL_VALID_BITS,
++ sizeof(struct kvm_steal_time)))
+ return 1;
+
+ vcpu->arch.st.msr_val = data;
+@@ -6549,6 +6541,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask, GFP_KERNEL))
+ goto fail_free_mce_banks;
+
++ vcpu->arch.pv_time_enabled = false;
+ kvm_async_pf_hash_reset(vcpu);
+
+ return 0;
+diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
+index cf4603b..8f4fda4 100644
+--- a/arch/x86/lguest/boot.c
++++ b/arch/x86/lguest/boot.c
+@@ -1328,6 +1328,7 @@ __init void lguest_init(void)
+ pv_mmu_ops.read_cr3 = lguest_read_cr3;
+ pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
+ pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mmu_mode;
++ pv_mmu_ops.lazy_mode.flush = paravirt_flush_lazy_mmu;
+ pv_mmu_ops.pte_update = lguest_pte_update;
+ pv_mmu_ops.pte_update_defer = lguest_pte_update;
+
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 7b73c88..53a7b69 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -377,10 +377,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
+ if (pgd_none(*pgd_ref))
+ return -1;
+
+- if (pgd_none(*pgd))
++ if (pgd_none(*pgd)) {
+ set_pgd(pgd, *pgd_ref);
+- else
++ arch_flush_lazy_mmu_mode();
++ } else {
+ BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
++ }
+
+ /*
+ * Below here mismatches are bugs because these lower tables
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index 2b8b0de..fe00be6 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -2079,6 +2079,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ .lazy_mode = {
+ .enter = paravirt_enter_lazy_mmu,
+ .leave = xen_leave_lazy_mmu,
++ .flush = paravirt_flush_lazy_mmu,
+ },
+
+ .set_fixmap = xen_set_fixmap,
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index f0b2ca8..1789e7a 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -200,6 +200,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
+ unsigned long val; \
+ ssize_t ret; \
+ ret = queue_var_store(&val, page, count); \
++ if (ret < 0) \
++ return ret; \
+ if (neg) \
+ val = !val; \
+ \
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 1a25263..b97b186 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
+
+ struct crypto_rfc4543_req_ctx {
+ u8 auth_tag[16];
++ u8 assocbuf[32];
+ struct scatterlist cipher[1];
+ struct scatterlist payload[2];
+ struct scatterlist assoc[2];
+@@ -1142,9 +1143,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
+ scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
+ assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
+
+- sg_init_table(assoc, 2);
+- sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
+- req->assoc->offset);
++ if (req->assoc->length == req->assoclen) {
++ sg_init_table(assoc, 2);
++ sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
++ req->assoc->offset);
++ } else {
++ BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
++
++ scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
++ req->assoclen, 0);
++
++ sg_init_table(assoc, 2);
++ sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
++ }
+ scatterwalk_crypto_chain(assoc, payload, 0, 2);
+
+ aead_request_set_tfm(subreq, ctx->child);
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index df47397..ddfc1c1 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -150,6 +150,7 @@ enum piix_controller_ids {
+ tolapai_sata,
+ piix_pata_vmw, /* PIIX4 for VMware, spurious DMA_ERR */
+ ich8_sata_snb,
++ ich8_2port_sata_snb,
+ };
+
+ struct piix_map_db {
+@@ -326,7 +327,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ /* SATA Controller IDE (Lynx Point) */
+ { 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ /* SATA Controller IDE (Lynx Point) */
+- { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++ { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ /* SATA Controller IDE (Lynx Point) */
+ { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ /* SATA Controller IDE (Lynx Point-LP) */
+@@ -519,6 +520,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
+ [ich8m_apple_sata] = &ich8m_apple_map_db,
+ [tolapai_sata] = &tolapai_map_db,
+ [ich8_sata_snb] = &ich8_map_db,
++ [ich8_2port_sata_snb] = &ich8_2port_map_db,
+ };
+
+ static struct ata_port_info piix_port_info[] = {
+@@ -660,6 +662,16 @@ static struct ata_port_info piix_port_info[] = {
+ .port_ops = &piix_sata_ops,
+ },
+
++ [ich8_2port_sata_snb] =
++ {
++ .flags = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
++ | PIIX_FLAG_PIO16,
++ .pio_mask = ATA_PIO4,
++ .mwdma_mask = ATA_MWDMA2,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &piix_sata_ops,
++ },
++
+ };
+
+ static struct pci_bits piix_enable_bits[] = {
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index c9540c0..288b635 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2401,6 +2401,9 @@ int ata_dev_configure(struct ata_device *dev)
+ dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
+ dev->max_sectors);
+
++ if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
++ dev->max_sectors = ATA_MAX_SECTORS_LBA48;
++
+ if (ap->ops->dev_config)
+ ap->ops->dev_config(dev);
+
+@@ -4057,6 +4060,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ /* Weird ATAPI devices */
+ { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 },
+ { "QUANTUM DAT DAT72-000", NULL, ATA_HORKAGE_ATAPI_MOD16_DMA },
++ { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
+
+ /* Devices we expect to fail diagnostics */
+
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 012a9d2..144d37c 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -274,6 +274,7 @@ enum intel_pch {
+
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
++#define QUIRK_INVERT_BRIGHTNESS (1<<2)
+
+ struct intel_fbdev;
+ struct intel_fbc_work;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 17961df..897ca06 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -25,6 +25,7 @@
+ */
+
+ #include <linux/cpufreq.h>
++#include <linux/dmi.h>
+ #include <linux/module.h>
+ #include <linux/input.h>
+ #include <linux/i2c.h>
+@@ -8831,6 +8832,16 @@ static void quirk_ssc_force_disable(struct drm_device *dev)
+ dev_priv->quirks |= QUIRK_LVDS_SSC_DISABLE;
+ }
+
++/*
++ * A machine (e.g. Acer Aspire 5734Z) may need to invert the panel backlight
++ * brightness value
++ */
++static void quirk_invert_brightness(struct drm_device *dev)
++{
++ struct drm_i915_private *dev_priv = dev->dev_private;
++ dev_priv->quirks |= QUIRK_INVERT_BRIGHTNESS;
++}
++
+ struct intel_quirk {
+ int device;
+ int subsystem_vendor;
+@@ -8838,6 +8849,34 @@ struct intel_quirk {
+ void (*hook)(struct drm_device *dev);
+ };
+
++/* For systems that don't have a meaningful PCI subdevice/subvendor ID */
++struct intel_dmi_quirk {
++ void (*hook)(struct drm_device *dev);
++ const struct dmi_system_id (*dmi_id_list)[];
++};
++
++static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
++{
++ DRM_INFO("Backlight polarity reversed on %s\n", id->ident);
++ return 1;
++}
++
++static const struct intel_dmi_quirk intel_dmi_quirks[] = {
++ {
++ .dmi_id_list = &(const struct dmi_system_id[]) {
++ {
++ .callback = intel_dmi_reverse_brightness,
++ .ident = "NCR Corporation",
++ .matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
++ DMI_MATCH(DMI_PRODUCT_NAME, ""),
++ },
++ },
++ { } /* terminating entry */
++ },
++ .hook = quirk_invert_brightness,
++ },
++};
++
+ struct intel_quirk intel_quirks[] = {
+ /* HP Compaq 2730p needs pipe A force quirk (LP: #291555) */
+ { 0x2a42, 0x103c, 0x30eb, quirk_pipea_force },
+@@ -8865,6 +8904,18 @@ struct intel_quirk intel_quirks[] = {
+
+ /* Sony Vaio Y cannot use SSC on LVDS */
+ { 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
++
++ /* Acer Aspire 5734Z must invert backlight brightness */
++ { 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
++
++ /* Acer/eMachines G725 */
++ { 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
++
++ /* Acer/eMachines e725 */
++ { 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
++
++ /* Acer/Packard Bell NCL20 */
++ { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+ };
+
+ static void intel_init_quirks(struct drm_device *dev)
+@@ -8882,6 +8933,10 @@ static void intel_init_quirks(struct drm_device *dev)
+ q->subsystem_device == PCI_ANY_ID))
+ q->hook(dev);
+ }
++ for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
++ if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
++ intel_dmi_quirks[i].hook(dev);
++ }
+ }
+
+ /* Disable the VGA plane that we never use */
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 04d79fd..72b8949 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -28,6 +28,7 @@
+ * Chris Wilson <chris@chris-wilson.co.uk>
+ */
+
++#include <linux/moduleparam.h>
+ #include "intel_drv.h"
+
+ #define PCI_LBPC 0xf4 /* legacy/combination backlight modes */
+@@ -191,6 +192,27 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
+ return max;
+ }
+
++static int i915_panel_invert_brightness;
++MODULE_PARM_DESC(invert_brightness, "Invert backlight brightness "
++ "(-1 force normal, 0 machine defaults, 1 force inversion), please "
++ "report PCI device ID, subsystem vendor and subsystem device ID "
++ "to dri-devel@lists.freedesktop.org, if your machine needs it. "
++ "It will then be included in an upcoming module version.");
++module_param_named(invert_brightness, i915_panel_invert_brightness, int, 0600);
++static u32 intel_panel_compute_brightness(struct drm_device *dev, u32 val)
++{
++ struct drm_i915_private *dev_priv = dev->dev_private;
++
++ if (i915_panel_invert_brightness < 0)
++ return val;
++
++ if (i915_panel_invert_brightness > 0 ||
++ dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS)
++ return intel_panel_get_max_backlight(dev) - val;
++
++ return val;
++}
++
+ u32 intel_panel_get_backlight(struct drm_device *dev)
+ {
+ struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -211,6 +233,7 @@ u32 intel_panel_get_backlight(struct drm_device *dev)
+ }
+ }
+
++ val = intel_panel_compute_brightness(dev, val);
+ DRM_DEBUG_DRIVER("get backlight PWM = %d\n", val);
+ return val;
+ }
+@@ -228,6 +251,7 @@ static void intel_panel_actually_set_backlight(struct drm_device *dev, u32 level
+ u32 tmp;
+
+ DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
++ level = intel_panel_compute_brightness(dev, level);
+
+ if (HAS_PCH_SPLIT(dev))
+ return intel_pch_panel_set_backlight(dev, level);
+diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
+index 58434e8..37fe246 100644
+--- a/drivers/gpu/vga/vga_switcheroo.c
++++ b/drivers/gpu/vga/vga_switcheroo.c
+@@ -26,6 +26,7 @@
+ #include <linux/fb.h>
+
+ #include <linux/pci.h>
++#include <linux/console.h>
+ #include <linux/vga_switcheroo.h>
+
+ struct vga_switcheroo_client {
+@@ -256,8 +257,10 @@ static int vga_switchto_stage2(struct vga_switcheroo_client *new_client)
+
+ if (new_client->fb_info) {
+ struct fb_event event;
++ console_lock();
+ event.info = new_client->fb_info;
+ fb_notifier_call_chain(FB_EVENT_REMAP_ALL_CONSOLE, &event);
++ console_unlock();
+ }
+
+ ret = vgasr_priv.handler->switchto(new_client->id);
+diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
+index 1201a15..08e7e72 100644
+--- a/drivers/hwspinlock/hwspinlock_core.c
++++ b/drivers/hwspinlock/hwspinlock_core.c
+@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
+ ret = pm_runtime_get_sync(dev);
+ if (ret < 0) {
+ dev_err(dev, "%s: can't power on device\n", __func__);
++ pm_runtime_put_noidle(dev);
++ module_put(dev->driver->owner);
+ return ret;
+ }
+
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index e7dc732..1d90e26 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -1154,7 +1154,11 @@ static int mtd_mmap(struct file *file, struct vm_area_struct *vma)
+ unsigned long off;
+ u32 len;
+
+- if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
++ /* This is broken because it assumes the MTD device is map-based
++ and that mtd->priv is a valid struct map_info. It should be
++ replaced with something that uses the mtd_get_unmapped_area()
++ operation properly. */
++ if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
+ off = vma->vm_pgoff << PAGE_SHIFT;
+ start = map->phys;
+ len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
+diff --git a/drivers/net/can/sja1000/sja1000_of_platform.c b/drivers/net/can/sja1000/sja1000_of_platform.c
+index c3dd9d0..1ee5f0c 100644
+--- a/drivers/net/can/sja1000/sja1000_of_platform.c
++++ b/drivers/net/can/sja1000/sja1000_of_platform.c
+@@ -94,8 +94,8 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev)
+ struct net_device *dev;
+ struct sja1000_priv *priv;
+ struct resource res;
+- const u32 *prop;
+- int err, irq, res_size, prop_size;
++ u32 prop;
++ int err, irq, res_size;
+ void __iomem *base;
+
+ err = of_address_to_resource(np, 0, &res);
+@@ -136,27 +136,27 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev)
+ priv->read_reg = sja1000_ofp_read_reg;
+ priv->write_reg = sja1000_ofp_write_reg;
+
+- prop = of_get_property(np, "nxp,external-clock-frequency", &prop_size);
+- if (prop && (prop_size == sizeof(u32)))
+- priv->can.clock.freq = *prop / 2;
++ err = of_property_read_u32(np, "nxp,external-clock-frequency", &prop);
++ if (!err)
++ priv->can.clock.freq = prop / 2;
+ else
+ priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */
+
+- prop = of_get_property(np, "nxp,tx-output-mode", &prop_size);
+- if (prop && (prop_size == sizeof(u32)))
+- priv->ocr |= *prop & OCR_MODE_MASK;
++ err = of_property_read_u32(np, "nxp,tx-output-mode", &prop);
++ if (!err)
++ priv->ocr |= prop & OCR_MODE_MASK;
+ else
+ priv->ocr |= OCR_MODE_NORMAL; /* default */
+
+- prop = of_get_property(np, "nxp,tx-output-config", &prop_size);
+- if (prop && (prop_size == sizeof(u32)))
+- priv->ocr |= (*prop << OCR_TX_SHIFT) & OCR_TX_MASK;
++ err = of_property_read_u32(np, "nxp,tx-output-config", &prop);
++ if (!err)
++ priv->ocr |= (prop << OCR_TX_SHIFT) & OCR_TX_MASK;
+ else
+ priv->ocr |= OCR_TX0_PULLDOWN; /* default */
+
+- prop = of_get_property(np, "nxp,clock-out-frequency", &prop_size);
+- if (prop && (prop_size == sizeof(u32)) && *prop) {
+- u32 divider = priv->can.clock.freq * 2 / *prop;
++ err = of_property_read_u32(np, "nxp,clock-out-frequency", &prop);
++ if (!err && prop) {
++ u32 divider = priv->can.clock.freq * 2 / prop;
+
+ if (divider > 1)
+ priv->cdr |= divider / 2 - 1;
+@@ -166,8 +166,7 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev)
+ priv->cdr |= CDR_CLK_OFF; /* default */
+ }
+
+- prop = of_get_property(np, "nxp,no-comparator-bypass", NULL);
+- if (!prop)
++ if (!of_property_read_bool(np, "nxp,no-comparator-bypass"))
+ priv->cdr |= CDR_CBP; /* default */
+
+ priv->irq_flags = IRQF_SHARED;
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index a6153f1..d812790 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -3516,6 +3516,30 @@ static void __devinit rtl_init_mdio_ops(struct rtl8169_private *tp)
+ }
+ }
+
++static void rtl_speed_down(struct rtl8169_private *tp)
++{
++ u32 adv;
++ int lpa;
++
++ rtl_writephy(tp, 0x1f, 0x0000);
++ lpa = rtl_readphy(tp, MII_LPA);
++
++ if (lpa & (LPA_10HALF | LPA_10FULL))
++ adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full;
++ else if (lpa & (LPA_100HALF | LPA_100FULL))
++ adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
++ ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full;
++ else
++ adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
++ ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full |
++ (tp->mii.supports_gmii ?
++ ADVERTISED_1000baseT_Half |
++ ADVERTISED_1000baseT_Full : 0);
++
++ rtl8169_set_speed(tp->dev, AUTONEG_ENABLE, SPEED_1000, DUPLEX_FULL,
++ adv);
++}
++
+ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+ {
+ void __iomem *ioaddr = tp->mmio_addr;
+@@ -3541,9 +3565,7 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+ if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
+ return false;
+
+- rtl_writephy(tp, 0x1f, 0x0000);
+- rtl_writephy(tp, MII_BMCR, 0x0000);
+-
++ rtl_speed_down(tp);
+ rtl_wol_suspend_quirk(tp);
+
+ return true;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+index 06b3f0d..c16bea4 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+@@ -648,7 +648,7 @@ static const u32 ar9580_1p0_mac_core[][2] = {
+ {0x00008258, 0x00000000},
+ {0x0000825c, 0x40000000},
+ {0x00008260, 0x00080922},
+- {0x00008264, 0x9bc00010},
++ {0x00008264, 0x9d400010},
+ {0x00008268, 0xffffffff},
+ {0x0000826c, 0x0000ffff},
+ {0x00008270, 0x00000000},
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 966661c..84890d5 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -801,7 +801,7 @@ static int ath9k_init_firmware_version(struct ath9k_htc_priv *priv)
+ * required version.
+ */
+ if (priv->fw_version_major != MAJOR_VERSION_REQ ||
+- priv->fw_version_minor != MINOR_VERSION_REQ) {
++ priv->fw_version_minor < MINOR_VERSION_REQ) {
+ dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
+ MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
+ return -EINVAL;
+diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
+index 17148bb..10fe07d 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
++++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
+@@ -52,8 +52,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+ udelay(REGISTER_BUSY_DELAY);
+ }
+
+- ERROR(rt2x00dev, "Indirect register access failed: "
+- "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
++ printk_once(KERN_ERR "%s() Indirect register access failed: "
++ "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
+ *reg = ~0;
+
+ return 0;
+diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
+index 2264331..b96766b 100644
+--- a/drivers/platform/x86/msi-wmi.c
++++ b/drivers/platform/x86/msi-wmi.c
+@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, void *context)
+ pr_debug("Suppressed key event 0x%X - "
+ "Last press was %lld us ago\n",
+ key->code, ktime_to_us(diff));
+- return;
++ goto msi_wmi_notify_exit;
+ }
+ last_pressed[key->code - SCANCODE_BASE] = cur;
+
+@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, void *context)
+ pr_info("Unknown key pressed - %x\n", eventcode);
+ } else
+ pr_info("Unknown event received\n");
++
++msi_wmi_notify_exit:
+ kfree(response.pointer);
+ }
+
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index 0364ca2..d5f4eb8 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -393,8 +393,9 @@ static inline int core_alua_state_standby(
+ case REPORT_LUNS:
+ case RECEIVE_DIAGNOSTIC:
+ case SEND_DIAGNOSTIC:
++ return 0;
+ case MAINTENANCE_IN:
+- switch (cdb[1]) {
++ switch (cdb[1] & 0x1f) {
+ case MI_REPORT_TARGET_PGS:
+ return 0;
+ default:
+@@ -435,8 +436,9 @@ static inline int core_alua_state_unavailable(
+ switch (cdb[0]) {
+ case INQUIRY:
+ case REPORT_LUNS:
++ return 0;
+ case MAINTENANCE_IN:
+- switch (cdb[1]) {
++ switch (cdb[1] & 0x1f) {
+ case MI_REPORT_TARGET_PGS:
+ return 0;
+ default:
+@@ -475,8 +477,9 @@ static inline int core_alua_state_transition(
+ switch (cdb[0]) {
+ case INQUIRY:
+ case REPORT_LUNS:
++ return 0;
+ case MAINTENANCE_IN:
+- switch (cdb[1]) {
++ switch (cdb[1] & 0x1f) {
+ case MI_REPORT_TARGET_PGS:
+ return 0;
+ default:
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 9176b2e..898c1de 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1445,6 +1445,7 @@ static inline void transport_generic_prepare_cdb(
+ case VERIFY_16: /* SBC - VRProtect */
+ case WRITE_VERIFY: /* SBC - VRProtect */
+ case WRITE_VERIFY_12: /* SBC - VRProtect */
++ case MAINTENANCE_IN: /* SPC - Parameter Data Format for SA RTPG */
+ break;
+ default:
+ cdb[1] &= 0x1f; /* clear logical unit number */
+@@ -2683,7 +2684,7 @@ static int transport_generic_cmd_sequencer(
+ /*
+ * Check for emulated MI_REPORT_TARGET_PGS.
+ */
+- if (cdb[1] == MI_REPORT_TARGET_PGS &&
++ if ((cdb[1] & 0x1f) == MI_REPORT_TARGET_PGS &&
+ su_dev->t10_alua.alua_type == SPC3_ALUA_EMULATED) {
+ cmd->execute_task =
+ target_emulate_report_target_port_groups;
+diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
+index dd9a574..f6fb292 100644
+--- a/drivers/thermal/thermal_sys.c
++++ b/drivers/thermal/thermal_sys.c
+@@ -1399,6 +1399,7 @@ static int __init thermal_init(void)
+ idr_destroy(&thermal_cdev_idr);
+ mutex_destroy(&thermal_idr_lock);
+ mutex_destroy(&thermal_list_lock);
++ return result;
+ }
+ result = genetlink_init();
+ return result;
+diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
+index 18e875b..3ca6c0d 100644
+--- a/drivers/usb/serial/ark3116.c
++++ b/drivers/usb/serial/ark3116.c
+@@ -68,7 +68,6 @@ static int is_irda(struct usb_serial *serial)
+ }
+
+ struct ark3116_private {
+- wait_queue_head_t delta_msr_wait;
+ struct async_icount icount;
+ int irda; /* 1 for irda device */
+
+@@ -148,7 +147,6 @@ static int ark3116_attach(struct usb_serial *serial)
+ if (!priv)
+ return -ENOMEM;
+
+- init_waitqueue_head(&priv->delta_msr_wait);
+ mutex_init(&priv->hw_lock);
+ spin_lock_init(&priv->status_lock);
+
+@@ -460,10 +458,14 @@ static int ark3116_ioctl(struct tty_struct *tty,
+ case TIOCMIWAIT:
+ for (;;) {
+ struct async_icount prev = priv->icount;
+- interruptible_sleep_on(&priv->delta_msr_wait);
++ interruptible_sleep_on(&port->delta_msr_wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ if ((prev.rng == priv->icount.rng) &&
+ (prev.dsr == priv->icount.dsr) &&
+ (prev.dcd == priv->icount.dcd) &&
+@@ -584,7 +586,7 @@ static void ark3116_update_msr(struct usb_serial_port *port, __u8 msr)
+ priv->icount.dcd++;
+ if (msr & UART_MSR_TERI)
+ priv->icount.rng++;
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ }
+ }
+
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 6ae1c06..c4d95b0 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -82,7 +82,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
+
+ struct ch341_private {
+ spinlock_t lock; /* access lock */
+- wait_queue_head_t delta_msr_wait; /* wait queue for modem status */
+ unsigned baud_rate; /* set baud rate */
+ u8 line_control; /* set line control value RTS/DTR */
+ u8 line_status; /* active status of modem control inputs */
+@@ -262,7 +261,6 @@ static int ch341_attach(struct usb_serial *serial)
+ return -ENOMEM;
+
+ spin_lock_init(&priv->lock);
+- init_waitqueue_head(&priv->delta_msr_wait);
+ priv->baud_rate = DEFAULT_BAUD_RATE;
+ priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
+
+@@ -299,7 +297,7 @@ static void ch341_dtr_rts(struct usb_serial_port *port, int on)
+ priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
+ spin_unlock_irqrestore(&priv->lock, flags);
+ ch341_set_handshake(port->serial->dev, priv->line_control);
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ }
+
+ static void ch341_close(struct usb_serial_port *port)
+@@ -503,7 +501,7 @@ static void ch341_read_int_callback(struct urb *urb)
+ tty_kref_put(tty);
+ }
+
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ }
+
+ exit:
+@@ -529,11 +527,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ spin_unlock_irqrestore(&priv->lock, flags);
+
+ while (!multi_change) {
+- interruptible_sleep_on(&priv->delta_msr_wait);
++ interruptible_sleep_on(&port->delta_msr_wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+
++ if (port->serial->disconnected)
++ return -EIO;
++
+ spin_lock_irqsave(&priv->lock, flags);
+ status = priv->line_status;
+ multi_change = priv->multi_status_change;
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index d9906eb..01a44d3 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -150,7 +150,6 @@ struct cypress_private {
+ int baud_rate; /* stores current baud rate in
+ integer form */
+ int isthrottled; /* if throttled, discard reads */
+- wait_queue_head_t delta_msr_wait; /* used for TIOCMIWAIT */
+ char prev_status, diff_status; /* used for TIOCMIWAIT */
+ /* we pass a pointer to this as the argument sent to
+ cypress_set_termios old_termios */
+@@ -488,7 +487,6 @@ static int generic_startup(struct usb_serial *serial)
+ kfree(priv);
+ return -ENOMEM;
+ }
+- init_waitqueue_head(&priv->delta_msr_wait);
+
+ usb_reset_configuration(serial->dev);
+
+@@ -928,12 +926,16 @@ static int cypress_ioctl(struct tty_struct *tty,
+ switch (cmd) {
+ /* This code comes from drivers/char/serial.c and ftdi_sio.c */
+ case TIOCMIWAIT:
+- while (priv != NULL) {
+- interruptible_sleep_on(&priv->delta_msr_wait);
++ for (;;) {
++ interruptible_sleep_on(&port->delta_msr_wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+- else {
++
++ if (port->serial->disconnected)
++ return -EIO;
++
++ {
+ char diff = priv->diff_status;
+ if (diff == 0)
+ return -EIO; /* no change => error */
+@@ -1261,7 +1263,7 @@ static void cypress_read_int_callback(struct urb *urb)
+ if (priv->current_status != priv->prev_status) {
+ priv->diff_status |= priv->current_status ^
+ priv->prev_status;
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ priv->prev_status = priv->current_status;
+ }
+ spin_unlock_irqrestore(&priv->lock, flags);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 878ff05..06394e5a 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -74,9 +74,7 @@ struct ftdi_private {
+ int flags; /* some ASYNC_xxxx flags are supported */
+ unsigned long last_dtr_rts; /* saved modem control outputs */
+ struct async_icount icount;
+- wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
+ char prev_status; /* Used for TIOCMIWAIT */
+- bool dev_gone; /* Used to abort TIOCMIWAIT */
+ char transmit_empty; /* If transmitter is empty or not */
+ struct usb_serial_port *port;
+ __u16 interface; /* FT2232C, FT2232H or FT4232H port interface
+@@ -1708,10 +1706,8 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
+ kref_init(&priv->kref);
+ mutex_init(&priv->cfg_lock);
+ memset(&priv->icount, 0x00, sizeof(priv->icount));
+- init_waitqueue_head(&priv->delta_msr_wait);
+
+ priv->flags = ASYNC_LOW_LATENCY;
+- priv->dev_gone = false;
+
+ if (quirk && quirk->port_probe)
+ quirk->port_probe(priv);
+@@ -1869,8 +1865,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
+
+ dbg("%s", __func__);
+
+- priv->dev_gone = true;
+- wake_up_interruptible_all(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+
+ remove_sysfs_attrs(port);
+
+@@ -2025,7 +2020,7 @@ static int ftdi_process_packet(struct tty_struct *tty,
+ if (diff_status & FTDI_RS0_RLSD)
+ priv->icount.dcd++;
+
+- wake_up_interruptible_all(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ priv->prev_status = status;
+ }
+
+@@ -2424,11 +2419,15 @@ static int ftdi_ioctl(struct tty_struct *tty,
+ */
+ case TIOCMIWAIT:
+ cprev = priv->icount;
+- while (!priv->dev_gone) {
+- interruptible_sleep_on(&priv->delta_msr_wait);
++ for (;;) {
++ interruptible_sleep_on(&port->delta_msr_wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ cnow = priv->icount;
+ if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+ ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+@@ -2438,8 +2437,6 @@ static int ftdi_ioctl(struct tty_struct *tty,
+ }
+ cprev = cnow;
+ }
+- return -EIO;
+- break;
+ case TIOCSERGETLSR:
+ return get_lsr_info(port, (struct serial_struct __user *)arg);
+ break;
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index 2ee8075..0af0b41 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -114,7 +114,6 @@ struct edgeport_port {
+ wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */
+ wait_queue_head_t wait_open; /* for handling sleeping while waiting for open to finish */
+ wait_queue_head_t wait_command; /* for handling sleeping while waiting for command to finish */
+- wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */
+
+ struct async_icount icount;
+ struct usb_serial_port *port; /* loop back to the owner of this object */
+@@ -885,7 +884,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
+ /* initialize our wait queues */
+ init_waitqueue_head(&edge_port->wait_open);
+ init_waitqueue_head(&edge_port->wait_chase);
+- init_waitqueue_head(&edge_port->delta_msr_wait);
+ init_waitqueue_head(&edge_port->wait_command);
+
+ /* initialize our icount structure */
+@@ -1703,13 +1701,17 @@ static int edge_ioctl(struct tty_struct *tty,
+ dbg("%s (%d) TIOCMIWAIT", __func__, port->number);
+ cprev = edge_port->icount;
+ while (1) {
+- prepare_to_wait(&edge_port->delta_msr_wait,
++ prepare_to_wait(&port->delta_msr_wait,
+ &wait, TASK_INTERRUPTIBLE);
+ schedule();
+- finish_wait(&edge_port->delta_msr_wait, &wait);
++ finish_wait(&port->delta_msr_wait, &wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ cnow = edge_port->icount;
+ if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+ cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+@@ -2090,7 +2092,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 newMsr)
+ icount->dcd++;
+ if (newMsr & EDGEPORT_MSR_DELTA_RI)
+ icount->rng++;
+- wake_up_interruptible(&edge_port->delta_msr_wait);
++ wake_up_interruptible(&edge_port->port->delta_msr_wait);
+ }
+
+ /* Save the new modem status */
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 1f145bf..f42119d 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -98,9 +98,6 @@ struct edgeport_port {
+ int close_pending;
+ int lsr_event;
+ struct async_icount icount;
+- wait_queue_head_t delta_msr_wait; /* for handling sleeping while
+- waiting for msr change to
+- happen */
+ struct edgeport_serial *edge_serial;
+ struct usb_serial_port *port;
+ __u8 bUartMode; /* Port type, 0: RS232, etc. */
+@@ -1557,7 +1554,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
+ icount->dcd++;
+ if (msr & EDGEPORT_MSR_DELTA_RI)
+ icount->rng++;
+- wake_up_interruptible(&edge_port->delta_msr_wait);
++ wake_up_interruptible(&edge_port->port->delta_msr_wait);
+ }
+
+ /* Save the new modem status */
+@@ -1876,7 +1873,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
+ dev = port->serial->dev;
+
+ memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
+- init_waitqueue_head(&edge_port->delta_msr_wait);
+
+ /* turn off loopback */
+ status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
+@@ -2574,10 +2570,14 @@ static int edge_ioctl(struct tty_struct *tty,
+ dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
+ cprev = edge_port->icount;
+ while (1) {
+- interruptible_sleep_on(&edge_port->delta_msr_wait);
++ interruptible_sleep_on(&port->delta_msr_wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ cnow = edge_port->icount;
+ if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+ cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
+index de0bb8e..96a62dd 100644
+--- a/drivers/usb/serial/mct_u232.c
++++ b/drivers/usb/serial/mct_u232.c
+@@ -168,8 +168,6 @@ struct mct_u232_private {
+ unsigned char last_msr; /* Modem Status Register */
+ unsigned int rx_flags; /* Throttling flags */
+ struct async_icount icount;
+- wait_queue_head_t msr_wait; /* for handling sleeping while waiting
+- for msr change to happen */
+ };
+
+ #define THROTTLED 0x01
+@@ -449,7 +447,6 @@ static int mct_u232_startup(struct usb_serial *serial)
+ if (!priv)
+ return -ENOMEM;
+ spin_lock_init(&priv->lock);
+- init_waitqueue_head(&priv->msr_wait);
+ usb_set_serial_port_data(serial->port[0], priv);
+
+ init_waitqueue_head(&serial->port[0]->write_wait);
+@@ -675,7 +672,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
+ tty_kref_put(tty);
+ }
+ #endif
+- wake_up_interruptible(&priv->msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ spin_unlock_irqrestore(&priv->lock, flags);
+ exit:
+ retval = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -896,13 +893,17 @@ static int mct_u232_ioctl(struct tty_struct *tty,
+ cprev = mct_u232_port->icount;
+ spin_unlock_irqrestore(&mct_u232_port->lock, flags);
+ for ( ; ; ) {
+- prepare_to_wait(&mct_u232_port->msr_wait,
++ prepare_to_wait(&port->delta_msr_wait,
+ &wait, TASK_INTERRUPTIBLE);
+ schedule();
+- finish_wait(&mct_u232_port->msr_wait, &wait);
++ finish_wait(&port->delta_msr_wait, &wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ spin_lock_irqsave(&mct_u232_port->lock, flags);
+ cnow = mct_u232_port->icount;
+ spin_unlock_irqrestore(&mct_u232_port->lock, flags);
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 43a38aa..e89ee48 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -240,7 +240,6 @@ struct moschip_port {
+ char open;
+ char open_ports;
+ wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */
+- wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */
+ int delta_msr_cond;
+ struct async_icount icount;
+ struct usb_serial_port *port; /* loop back to the owner of this object */
+@@ -453,6 +452,9 @@ static void mos7840_handle_new_msr(struct moschip_port *port, __u8 new_msr)
+ icount->rng++;
+ smp_wmb();
+ }
++
++ mos7840_port->delta_msr_cond = 1;
++ wake_up_interruptible(&port->port->delta_msr_wait);
+ }
+ }
+
+@@ -1115,7 +1117,6 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+
+ /* initialize our wait queues */
+ init_waitqueue_head(&mos7840_port->wait_chase);
+- init_waitqueue_head(&mos7840_port->delta_msr_wait);
+
+ /* initialize our icount structure */
+ memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
+@@ -2073,8 +2074,6 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
+ mos7840_port->read_urb_busy = false;
+ }
+ }
+- wake_up(&mos7840_port->delta_msr_wait);
+- mos7840_port->delta_msr_cond = 1;
+ dbg("mos7840_change_port_settings mos7840_port->shadowLCR is End %x",
+ mos7840_port->shadowLCR);
+ }
+@@ -2284,13 +2283,18 @@ static int mos7840_ioctl(struct tty_struct *tty,
+ while (1) {
+ /* interruptible_sleep_on(&mos7840_port->delta_msr_wait); */
+ mos7840_port->delta_msr_cond = 0;
+- wait_event_interruptible(mos7840_port->delta_msr_wait,
+- (mos7840_port->
++ wait_event_interruptible(port->delta_msr_wait,
++ (port->serial->disconnected ||
++ mos7840_port->
+ delta_msr_cond == 1));
+
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ cnow = mos7840_port->icount;
+ smp_rmb();
+ if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
+index 4c29e6c..8ceaa89 100644
+--- a/drivers/usb/serial/oti6858.c
++++ b/drivers/usb/serial/oti6858.c
+@@ -196,7 +196,6 @@ struct oti6858_private {
+ u8 setup_done;
+ struct delayed_work delayed_setup_work;
+
+- wait_queue_head_t intr_wait;
+ struct usb_serial_port *port; /* USB port with which associated */
+ };
+
+@@ -357,7 +356,6 @@ static int oti6858_startup(struct usb_serial *serial)
+ break;
+
+ spin_lock_init(&priv->lock);
+- init_waitqueue_head(&priv->intr_wait);
+ /* INIT_WORK(&priv->setup_work, setup_line, serial->port[i]); */
+ /* INIT_WORK(&priv->write_work, send_data, serial->port[i]); */
+ priv->port = port;
+@@ -705,11 +703,15 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ spin_unlock_irqrestore(&priv->lock, flags);
+
+ while (1) {
+- wait_event_interruptible(priv->intr_wait,
++ wait_event_interruptible(port->delta_msr_wait,
++ port->serial->disconnected ||
+ priv->status.pin_state != prev);
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+
++ if (port->serial->disconnected)
++ return -EIO;
++
+ spin_lock_irqsave(&priv->lock, flags);
+ status = priv->status.pin_state & PIN_MASK;
+ spin_unlock_irqrestore(&priv->lock, flags);
+@@ -821,7 +823,7 @@ static void oti6858_read_int_callback(struct urb *urb)
+
+ if (!priv->transient) {
+ if (xs->pin_state != priv->status.pin_state)
+- wake_up_interruptible(&priv->intr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ memcpy(&priv->status, xs, OTI6858_CTRL_PKT_SIZE);
+ }
+
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 5532ea5..fd86e0e 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -150,7 +150,6 @@ enum pl2303_type {
+
+ struct pl2303_private {
+ spinlock_t lock;
+- wait_queue_head_t delta_msr_wait;
+ u8 line_control;
+ u8 line_status;
+ enum pl2303_type type;
+@@ -204,7 +203,6 @@ static int pl2303_startup(struct usb_serial *serial)
+ if (!priv)
+ goto cleanup;
+ spin_lock_init(&priv->lock);
+- init_waitqueue_head(&priv->delta_msr_wait);
+ priv->type = type;
+ usb_set_serial_port_data(serial->port[i], priv);
+ }
+@@ -599,11 +597,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ spin_unlock_irqrestore(&priv->lock, flags);
+
+ while (1) {
+- interruptible_sleep_on(&priv->delta_msr_wait);
++ interruptible_sleep_on(&port->delta_msr_wait);
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+
++ if (port->serial->disconnected)
++ return -EIO;
++
+ spin_lock_irqsave(&priv->lock, flags);
+ status = priv->line_status;
+ spin_unlock_irqrestore(&priv->lock, flags);
+@@ -725,7 +726,7 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
+ spin_unlock_irqrestore(&priv->lock, flags);
+ if (priv->line_status & UART_BREAK_ERROR)
+ usb_serial_handle_break(port);
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+
+ tty = tty_port_tty_get(&port->port);
+ if (!tty)
+@@ -792,7 +793,7 @@ static void pl2303_process_read_urb(struct urb *urb)
+ line_status = priv->line_status;
+ priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
+ spin_unlock_irqrestore(&priv->lock, flags);
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+
+ if (!urb->actual_length)
+ return;
+diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
+index 180ea6c..ba6b438 100644
+--- a/drivers/usb/serial/spcp8x5.c
++++ b/drivers/usb/serial/spcp8x5.c
+@@ -163,7 +163,6 @@ static struct usb_driver spcp8x5_driver = {
+ struct spcp8x5_private {
+ spinlock_t lock;
+ enum spcp8x5_type type;
+- wait_queue_head_t delta_msr_wait;
+ u8 line_control;
+ u8 line_status;
+ };
+@@ -197,7 +196,6 @@ static int spcp8x5_startup(struct usb_serial *serial)
+ goto cleanup;
+
+ spin_lock_init(&priv->lock);
+- init_waitqueue_head(&priv->delta_msr_wait);
+ priv->type = type;
+ usb_set_serial_port_data(serial->port[i] , priv);
+ }
+@@ -502,7 +500,7 @@ static void spcp8x5_process_read_urb(struct urb *urb)
+ priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
+ spin_unlock_irqrestore(&priv->lock, flags);
+ /* wake up the wait for termios */
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+
+ if (!urb->actual_length)
+ return;
+@@ -552,12 +550,15 @@ static int spcp8x5_wait_modem_info(struct usb_serial_port *port,
+
+ while (1) {
+ /* wake up in bulk read */
+- interruptible_sleep_on(&priv->delta_msr_wait);
++ interruptible_sleep_on(&port->delta_msr_wait);
+
+ /* see if a signal did it */
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+
++ if (port->serial->disconnected)
++ return -EIO;
++
+ spin_lock_irqsave(&priv->lock, flags);
+ status = priv->line_status;
+ spin_unlock_irqrestore(&priv->lock, flags);
+diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
+index fff7f17..bf1f8ea 100644
+--- a/drivers/usb/serial/ssu100.c
++++ b/drivers/usb/serial/ssu100.c
+@@ -78,7 +78,6 @@ struct ssu100_port_private {
+ spinlock_t status_lock;
+ u8 shadowLSR;
+ u8 shadowMSR;
+- wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
+ struct async_icount icount;
+ };
+
+@@ -387,8 +386,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ spin_unlock_irqrestore(&priv->status_lock, flags);
+
+ while (1) {
+- wait_event_interruptible(priv->delta_msr_wait,
+- ((priv->icount.rng != prev.rng) ||
++ wait_event_interruptible(port->delta_msr_wait,
++ (port->serial->disconnected ||
++ (priv->icount.rng != prev.rng) ||
+ (priv->icount.dsr != prev.dsr) ||
+ (priv->icount.dcd != prev.dcd) ||
+ (priv->icount.cts != prev.cts)));
+@@ -396,6 +396,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+
++ if (port->serial->disconnected)
++ return -EIO;
++
+ spin_lock_irqsave(&priv->status_lock, flags);
+ cur = priv->icount;
+ spin_unlock_irqrestore(&priv->status_lock, flags);
+@@ -478,7 +481,6 @@ static int ssu100_attach(struct usb_serial *serial)
+ }
+
+ spin_lock_init(&priv->status_lock);
+- init_waitqueue_head(&priv->delta_msr_wait);
+ usb_set_serial_port_data(port, priv);
+
+ return ssu100_initdevice(serial->dev);
+@@ -564,7 +566,7 @@ static void ssu100_update_msr(struct usb_serial_port *port, u8 msr)
+ priv->icount.dcd++;
+ if (msr & UART_MSR_TERI)
+ priv->icount.rng++;
+- wake_up_interruptible(&priv->delta_msr_wait);
++ wake_up_interruptible(&port->delta_msr_wait);
+ }
+ }
+
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 2856474..4b805be 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -75,7 +75,6 @@ struct ti_port {
+ int tp_flags;
+ int tp_closing_wait;/* in .01 secs */
+ struct async_icount tp_icount;
+- wait_queue_head_t tp_msr_wait; /* wait for msr change */
+ wait_queue_head_t tp_write_wait;
+ struct ti_device *tp_tdev;
+ struct usb_serial_port *tp_port;
+@@ -447,7 +446,6 @@ static int ti_startup(struct usb_serial *serial)
+ tport->tp_uart_base_addr = (i == 0 ?
+ TI_UART1_BASE_ADDR : TI_UART2_BASE_ADDR);
+ tport->tp_closing_wait = closing_wait;
+- init_waitqueue_head(&tport->tp_msr_wait);
+ init_waitqueue_head(&tport->tp_write_wait);
+ if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE,
+ GFP_KERNEL)) {
+@@ -848,9 +846,13 @@ static int ti_ioctl(struct tty_struct *tty,
+ dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
+ cprev = tport->tp_icount;
+ while (1) {
+- interruptible_sleep_on(&tport->tp_msr_wait);
++ interruptible_sleep_on(&port->delta_msr_wait);
+ if (signal_pending(current))
+ return -ERESTARTSYS;
++
++ if (port->serial->disconnected)
++ return -EIO;
++
+ cnow = tport->tp_icount;
+ if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+ cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+@@ -1481,7 +1483,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
+ icount->dcd++;
+ if (msr & TI_MSR_DELTA_RI)
+ icount->rng++;
+- wake_up_interruptible(&tport->tp_msr_wait);
++ wake_up_interruptible(&tport->tp_port->delta_msr_wait);
+ spin_unlock_irqrestore(&tport->tp_lock, flags);
+ }
+
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 2482d5e..850faa4 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -905,6 +905,7 @@ int usb_serial_probe(struct usb_interface *interface,
+ port->port.ops = &serial_port_ops;
+ port->serial = serial;
+ spin_lock_init(&port->lock);
++ init_waitqueue_head(&port->delta_msr_wait);
+ /* Keep this for private driver use for the moment but
+ should probably go away */
+ INIT_WORK(&port->work, usb_serial_port_work);
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index 9b8bcab..7a36dff 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -843,6 +843,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info,
+ *
+ * Maps a virtual console @unit to a frame buffer device
+ * @newidx.
++ *
++ * This should be called with the console lock held.
+ */
+ static int set_con2fb_map(int unit, int newidx, int user)
+ {
+@@ -860,7 +862,7 @@ static int set_con2fb_map(int unit, int newidx, int user)
+
+ if (!search_for_mapped_con() || !con_is_bound(&fb_con)) {
+ info_idx = newidx;
+- return fbcon_takeover(0);
++ return do_fbcon_takeover(0);
+ }
+
+ if (oldidx != -1)
+@@ -868,7 +870,6 @@ static int set_con2fb_map(int unit, int newidx, int user)
+
+ found = search_fb_in_map(newidx);
+
+- console_lock();
+ con2fb_map[unit] = newidx;
+ if (!err && !found)
+ err = con2fb_acquire_newinfo(vc, info, unit, oldidx);
+@@ -895,7 +896,6 @@ static int set_con2fb_map(int unit, int newidx, int user)
+ if (!search_fb_in_map(info_idx))
+ info_idx = newidx;
+
+- console_unlock();
+ return err;
+ }
+
+@@ -3026,6 +3026,7 @@ static inline int fbcon_unbind(void)
+ }
+ #endif /* CONFIG_VT_HW_CONSOLE_BINDING */
+
++/* called with console_lock held */
+ static int fbcon_fb_unbind(int idx)
+ {
+ int i, new_idx = -1, ret = 0;
+@@ -3052,6 +3053,7 @@ static int fbcon_fb_unbind(int idx)
+ return ret;
+ }
+
++/* called with console_lock held */
+ static int fbcon_fb_unregistered(struct fb_info *info)
+ {
+ int i, idx;
+@@ -3089,6 +3091,7 @@ static int fbcon_fb_unregistered(struct fb_info *info)
+ return 0;
+ }
+
++/* called with console_lock held */
+ static void fbcon_remap_all(int idx)
+ {
+ int i;
+@@ -3133,6 +3136,7 @@ static inline void fbcon_select_primary(struct fb_info *info)
+ }
+ #endif /* CONFIG_FRAMEBUFFER_DETECT_PRIMARY */
+
++/* called with console_lock held */
+ static int fbcon_fb_registered(struct fb_info *info)
+ {
+ int ret = 0, i, idx;
+@@ -3285,6 +3289,7 @@ static int fbcon_event_notify(struct notifier_block *self,
+ ret = fbcon_fb_unregistered(info);
+ break;
+ case FB_EVENT_SET_CONSOLE_MAP:
++ /* called with console lock held */
+ con2fb = event->data;
+ ret = set_con2fb_map(con2fb->console - 1,
+ con2fb->framebuffer, 1);
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index c133dde..babbb07 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1154,8 +1154,10 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ event.data = &con2fb;
+ if (!lock_fb_info(info))
+ return -ENODEV;
++ console_lock();
+ event.info = info;
+ ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP, &event);
++ console_unlock();
+ unlock_fb_info(info);
+ break;
+ case FBIOBLANK:
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 49f3c9d..73e4cbc 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1209,6 +1209,39 @@ int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end, gfp_t mask)
+ mask);
+ }
+
++int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end)
++{
++ unsigned long index = start >> PAGE_CACHE_SHIFT;
++ unsigned long end_index = end >> PAGE_CACHE_SHIFT;
++ struct page *page;
++
++ while (index <= end_index) {
++ page = find_get_page(inode->i_mapping, index);
++ BUG_ON(!page); /* Pages should be in the extent_io_tree */
++ clear_page_dirty_for_io(page);
++ page_cache_release(page);
++ index++;
++ }
++ return 0;
++}
++
++int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end)
++{
++ unsigned long index = start >> PAGE_CACHE_SHIFT;
++ unsigned long end_index = end >> PAGE_CACHE_SHIFT;
++ struct page *page;
++
++ while (index <= end_index) {
++ page = find_get_page(inode->i_mapping, index);
++ BUG_ON(!page); /* Pages should be in the extent_io_tree */
++ account_page_redirty(page);
++ __set_page_dirty_nobuffers(page);
++ page_cache_release(page);
++ index++;
++ }
++ return 0;
++}
++
+ /*
+ * helper function to set both pages and extents in the tree writeback
+ */
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index 7604c30..2e32510 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -304,6 +304,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset,
+ unsigned long *map_len);
+ int extent_range_uptodate(struct extent_io_tree *tree,
+ u64 start, u64 end);
++int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end);
++int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end);
+ int extent_clear_unlock_delalloc(struct inode *inode,
+ struct extent_io_tree *tree,
+ u64 start, u64 end, struct page *locked_page,
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index fd1a06d..1372634 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -343,6 +343,7 @@ static noinline int compress_file_range(struct inode *inode,
+ int i;
+ int will_compress;
+ int compress_type = root->fs_info->compress_type;
++ int redirty = 0;
+
+ /* if this is a small write inside eof, kick off a defragbot */
+ if (end <= BTRFS_I(inode)->disk_i_size && (end - start + 1) < 16 * 1024)
+@@ -404,6 +405,17 @@ again:
+ if (BTRFS_I(inode)->force_compress)
+ compress_type = BTRFS_I(inode)->force_compress;
+
++ /*
++ * we need to call clear_page_dirty_for_io on each
++ * page in the range. Otherwise applications with the file
++ * mmap'd can wander in and change the page contents while
++ * we are compressing them.
++ *
++ * If the compression fails for any reason, we set the pages
++ * dirty again later on.
++ */
++ extent_range_clear_dirty_for_io(inode, start, end);
++ redirty = 1;
+ ret = btrfs_compress_pages(compress_type,
+ inode->i_mapping, start,
+ total_compressed, pages,
+@@ -541,6 +553,8 @@ cleanup_and_bail_uncompressed:
+ __set_page_dirty_nobuffers(locked_page);
+ /* unlocked later on in the async handlers */
+ }
++ if (redirty)
++ extent_range_redirty_for_io(inode, start, end);
+ add_async_extent(async_cow, start, end - start + 1,
+ 0, NULL, 0, BTRFS_COMPRESS_NONE);
+ *num_added += 1;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 19b127c..21faa12 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -316,6 +316,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ unsigned long src_ptr;
+ unsigned long dst_ptr;
+ int overwrite_root = 0;
++ bool inode_item = key->type == BTRFS_INODE_ITEM_KEY;
+
+ if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
+ overwrite_root = 1;
+@@ -325,6 +326,9 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+
+ /* look for the key in the destination tree */
+ ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
++ if (ret < 0)
++ return ret;
++
+ if (ret == 0) {
+ char *src_copy;
+ char *dst_copy;
+@@ -366,6 +370,30 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
++ /*
++ * We need to load the old nbytes into the inode so when we
++ * replay the extents we've logged we get the right nbytes.
++ */
++ if (inode_item) {
++ struct btrfs_inode_item *item;
++ u64 nbytes;
++
++ item = btrfs_item_ptr(path->nodes[0], path->slots[0],
++ struct btrfs_inode_item);
++ nbytes = btrfs_inode_nbytes(path->nodes[0], item);
++ item = btrfs_item_ptr(eb, slot,
++ struct btrfs_inode_item);
++ btrfs_set_inode_nbytes(eb, item, nbytes);
++ }
++ } else if (inode_item) {
++ struct btrfs_inode_item *item;
++
++ /*
++ * New inode, set nbytes to 0 so that the nbytes comes out
++ * properly when we replay the extents.
++ */
++ item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
++ btrfs_set_inode_nbytes(eb, item, 0);
+ }
+ insert:
+ btrfs_release_path(path);
+@@ -488,7 +516,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ u64 extent_end;
+ u64 alloc_hint;
+ u64 start = key->offset;
+- u64 saved_nbytes;
++ u64 nbytes = 0;
+ struct btrfs_file_extent_item *item;
+ struct inode *inode = NULL;
+ unsigned long size;
+@@ -498,10 +526,19 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ found_type = btrfs_file_extent_type(eb, item);
+
+ if (found_type == BTRFS_FILE_EXTENT_REG ||
+- found_type == BTRFS_FILE_EXTENT_PREALLOC)
+- extent_end = start + btrfs_file_extent_num_bytes(eb, item);
+- else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
++ found_type == BTRFS_FILE_EXTENT_PREALLOC) {
++ nbytes = btrfs_file_extent_num_bytes(eb, item);
++ extent_end = start + nbytes;
++
++ /*
++ * We don't add to the inodes nbytes if we are prealloc or a
++ * hole.
++ */
++ if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
++ nbytes = 0;
++ } else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
+ size = btrfs_file_extent_inline_len(eb, item);
++ nbytes = btrfs_file_extent_ram_bytes(eb, item);
+ extent_end = (start + size + mask) & ~mask;
+ } else {
+ ret = 0;
+@@ -550,7 +587,6 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ }
+ btrfs_release_path(path);
+
+- saved_nbytes = inode_get_bytes(inode);
+ /* drop any overlapping extents */
+ ret = btrfs_drop_extents(trans, inode, start, extent_end,
+ &alloc_hint, 1);
+@@ -638,7 +674,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ BUG_ON(ret);
+ }
+
+- inode_set_bytes(inode, saved_nbytes);
++ inode_add_bytes(inode, nbytes);
+ btrfs_update_inode(trans, root, inode);
+ out:
+ if (inode)
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index 5849e3e..32b12e5 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -517,7 +517,7 @@ void hfsplus_file_truncate(struct inode *inode)
+ struct address_space *mapping = inode->i_mapping;
+ struct page *page;
+ void *fsdata;
+- u32 size = inode->i_size;
++ loff_t size = inode->i_size;
+
+ res = pagecache_write_begin(NULL, mapping, size, 0,
+ AOP_FLAG_UNINTERRUPTIBLE,
+diff --git a/fs/inode.c b/fs/inode.c
+index ee4e66b..e2d3633 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -634,7 +634,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
+ * inode to the back of the list so we don't spin on it.
+ */
+ if (!spin_trylock(&inode->i_lock)) {
+- list_move_tail(&inode->i_lru, &sb->s_inode_lru);
++ list_move(&inode->i_lru, &sb->s_inode_lru);
+ continue;
+ }
+
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index 32df2b6..5856c9e 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -937,7 +937,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
+ }
+ }
+
+-static inline bool atapi_command_packet_set(const u16 *dev_id)
++static inline int atapi_command_packet_set(const u16 *dev_id)
+ {
+ return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
+ }
+diff --git a/include/linux/kref.h b/include/linux/kref.h
+index d4a62ab..d064502 100644
+--- a/include/linux/kref.h
++++ b/include/linux/kref.h
+@@ -16,6 +16,7 @@
+ #define _KREF_H_
+
+ #include <linux/types.h>
++#include <linux/atomic.h>
+
+ struct kref {
+ atomic_t refcount;
+@@ -27,4 +28,24 @@ int kref_put(struct kref *kref, void (*release) (struct kref *kref));
+ int kref_sub(struct kref *kref, unsigned int count,
+ void (*release) (struct kref *kref));
+
++/**
++ * kref_get_unless_zero - Increment refcount for object unless it is zero.
++ * @kref: object.
++ *
++ * Return non-zero if the increment succeeded. Otherwise return 0.
++ *
++ * This function is intended to simplify locking around refcounting for
++ * objects that can be looked up from a lookup structure, and which are
++ * removed from that lookup structure in the object destructor.
++ * Operations on such objects require at least a read lock around
++ * lookup + kref_get, and a write lock around kref_put + remove from lookup
++ * structure. Furthermore, RCU implementations become extremely tricky.
++ * With a lookup followed by a kref_get_unless_zero *with return value check*
++ * locking in the kref_put path can be deferred to the actual removal from
++ * the lookup structure and RCU lookups become trivial.
++ */
++static inline int __must_check kref_get_unless_zero(struct kref *kref)
++{
++ return atomic_add_unless(&kref->refcount, 1, 0);
++}
+ #endif /* _KREF_H_ */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 6136821..e6796c1 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -396,7 +396,7 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ void *data, unsigned long len);
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+- gpa_t gpa);
++ gpa_t gpa, unsigned long len);
+ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
+ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
+ struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn);
+diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
+index fa7cc72..b0bcce0 100644
+--- a/include/linux/kvm_types.h
++++ b/include/linux/kvm_types.h
+@@ -71,6 +71,7 @@ struct gfn_to_hva_cache {
+ u64 generation;
+ gpa_t gpa;
+ unsigned long hva;
++ unsigned long len;
+ struct kvm_memory_slot *memslot;
+ };
+
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index cafc09a..62467ca 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -392,6 +392,7 @@ enum {
+ ATA_HORKAGE_NOSETXFER = (1 << 14), /* skip SETXFER, SATA only */
+ ATA_HORKAGE_BROKEN_FPDMA_AA = (1 << 15), /* skip AA */
+ ATA_HORKAGE_DUMP_ID = (1 << 16), /* dump IDENTIFY data */
++ ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 4948552..9bf9611 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -336,6 +336,22 @@ static inline int of_machine_is_compatible(const char *compat)
+ #define of_match_node(_matches, _node) NULL
+ #endif /* CONFIG_OF */
+
++/**
++ * of_property_read_bool - Findfrom a property
++ * @np: device node from which the property value is to be read.
++ * @propname: name of the property to be searched.
++ *
++ * Search for a property in a device node.
++ * Returns true if the property exist false otherwise.
++ */
++static inline bool of_property_read_bool(const struct device_node *np,
++ const char *propname)
++{
++ struct property *prop = of_find_property(np, propname, NULL);
++
++ return prop ? true : false;
++}
++
+ static inline int of_property_read_u32(const struct device_node *np,
+ const char *propname,
+ u32 *out_value)
+diff --git a/include/linux/preempt.h b/include/linux/preempt.h
+index 58969b2..e86bf01 100644
+--- a/include/linux/preempt.h
++++ b/include/linux/preempt.h
+@@ -91,13 +91,19 @@ do { \
+
+ #else /* !CONFIG_PREEMPT_COUNT */
+
+-#define preempt_disable() do { } while (0)
+-#define preempt_enable_no_resched() do { } while (0)
+-#define preempt_enable() do { } while (0)
++/*
++ * Even if we don't have any preemption, we need preempt disable/enable
++ * to be barriers, so that we don't have things like get_user/put_user
++ * that can cause faults and scheduling migrate into our preempt-protected
++ * region.
++ */
++#define preempt_disable() barrier()
++#define preempt_enable_no_resched() barrier()
++#define preempt_enable() barrier()
+
+-#define preempt_disable_notrace() do { } while (0)
+-#define preempt_enable_no_resched_notrace() do { } while (0)
+-#define preempt_enable_notrace() do { } while (0)
++#define preempt_disable_notrace() barrier()
++#define preempt_enable_no_resched_notrace() barrier()
++#define preempt_enable_notrace() barrier()
+
+ #endif /* CONFIG_PREEMPT_COUNT */
+
+diff --git a/include/linux/socket.h b/include/linux/socket.h
+index ad919e0..2acd2e2 100644
+--- a/include/linux/socket.h
++++ b/include/linux/socket.h
+@@ -317,6 +317,7 @@ struct ucred {
+ #define IPX_TYPE 1
+
+ extern void cred_to_ucred(struct pid *pid, const struct cred *cred, struct ucred *ucred);
++extern void cred_real_to_ucred(struct pid *pid, const struct cred *cred, struct ucred *ucred);
+
+ extern int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
+ extern int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
+index a26e2fb..e2369c1 100644
+--- a/include/linux/spinlock_up.h
++++ b/include/linux/spinlock_up.h
+@@ -16,7 +16,10 @@
+ * In the debug case, 1 means unlocked, 0 means locked. (the values
+ * are inverted, to catch initialization bugs)
+ *
+- * No atomicity anywhere, we are on UP.
++ * No atomicity anywhere, we are on UP. However, we still need
++ * the compiler barriers, because we do not want the compiler to
++ * move potentially faulting instructions (notably user accesses)
++ * into the locked sequence, resulting in non-atomic execution.
+ */
+
+ #ifdef CONFIG_DEBUG_SPINLOCK
+@@ -25,6 +28,7 @@
+ static inline void arch_spin_lock(arch_spinlock_t *lock)
+ {
+ lock->slock = 0;
++ barrier();
+ }
+
+ static inline void
+@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
+ {
+ local_irq_save(flags);
+ lock->slock = 0;
++ barrier();
+ }
+
+ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+ char oldval = lock->slock;
+
+ lock->slock = 0;
++ barrier();
+
+ return oldval > 0;
+ }
+
+ static inline void arch_spin_unlock(arch_spinlock_t *lock)
+ {
++ barrier();
+ lock->slock = 1;
+ }
+
+ /*
+ * Read-write spinlocks. No debug version.
+ */
+-#define arch_read_lock(lock) do { (void)(lock); } while (0)
+-#define arch_write_lock(lock) do { (void)(lock); } while (0)
+-#define arch_read_trylock(lock) ({ (void)(lock); 1; })
+-#define arch_write_trylock(lock) ({ (void)(lock); 1; })
+-#define arch_read_unlock(lock) do { (void)(lock); } while (0)
+-#define arch_write_unlock(lock) do { (void)(lock); } while (0)
++#define arch_read_lock(lock) do { barrier(); (void)(lock); } while (0)
++#define arch_write_lock(lock) do { barrier(); (void)(lock); } while (0)
++#define arch_read_trylock(lock) ({ barrier(); (void)(lock); 1; })
++#define arch_write_trylock(lock) ({ barrier(); (void)(lock); 1; })
++#define arch_read_unlock(lock) do { barrier(); (void)(lock); } while (0)
++#define arch_write_unlock(lock) do { barrier(); (void)(lock); } while (0)
+
+ #else /* DEBUG_SPINLOCK */
+ #define arch_spin_is_locked(lock) ((void)(lock), 0)
+ /* for sched.c and kernel_lock.c: */
+-# define arch_spin_lock(lock) do { (void)(lock); } while (0)
+-# define arch_spin_lock_flags(lock, flags) do { (void)(lock); } while (0)
+-# define arch_spin_unlock(lock) do { (void)(lock); } while (0)
+-# define arch_spin_trylock(lock) ({ (void)(lock); 1; })
++# define arch_spin_lock(lock) do { barrier(); (void)(lock); } while (0)
++# define arch_spin_lock_flags(lock, flags) do { barrier(); (void)(lock); } while (0)
++# define arch_spin_unlock(lock) do { barrier(); (void)(lock); } while (0)
++# define arch_spin_trylock(lock) ({ barrier(); (void)(lock); 1; })
+ #endif /* DEBUG_SPINLOCK */
+
+ #define arch_spin_is_contended(lock) (((void)(lock), 0))
+diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
+index b29f70b..237d5f8 100644
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -71,6 +71,7 @@ enum port_dev_state {
+ * port.
+ * @flags: usb serial port flags
+ * @write_wait: a wait_queue_head_t used by the port.
++ * @delta_msr_wait: modem-status-change wait queue
+ * @work: work queue entry for the line discipline waking up.
+ * @throttled: nonzero if the read urb is inactive to throttle the device
+ * @throttle_req: nonzero if the tty wants to throttle us
+@@ -114,6 +115,7 @@ struct usb_serial_port {
+
+ unsigned long flags;
+ wait_queue_head_t write_wait;
++ wait_queue_head_t delta_msr_wait;
+ struct work_struct work;
+ char throttled;
+ char throttle_req;
+diff --git a/include/linux/writeback.h b/include/linux/writeback.h
+index a378c29..7e85d45 100644
+--- a/include/linux/writeback.h
++++ b/include/linux/writeback.h
+@@ -195,6 +195,8 @@ void writeback_set_ratelimit(void);
+ void tag_pages_for_writeback(struct address_space *mapping,
+ pgoff_t start, pgoff_t end);
+
++void account_page_redirty(struct page *page);
++
+ /* pdflush.c */
+ extern int nr_pdflush_threads; /* Global so it can be exported to sysctl
+ read-only. */
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 0c0017c..5da0a7b 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -50,7 +50,7 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
+ {
+ scm->pid = get_pid(pid);
+ scm->cred = cred ? get_cred(cred) : NULL;
+- cred_to_ucred(pid, cred, &scm->creds);
++ cred_real_to_ucred(pid, cred, &scm->creds);
+ }
+
+ static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index cdd5607..e4cee8d 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -61,6 +61,7 @@
+ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
+ {
+
++ .lock = __RAW_SPIN_LOCK_UNLOCKED(hrtimer_bases.lock),
+ .clock_base =
+ {
+ {
+@@ -1640,8 +1641,6 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
+ struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
+ int i;
+
+- raw_spin_lock_init(&cpu_base->lock);
+-
+ for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
+ cpu_base->clock_base[i].cpu_base = cpu_base;
+ timerqueue_init_head(&cpu_base->clock_base[i].active);
+diff --git a/kernel/sched.c b/kernel/sched.c
+index eeeec4e..d08c9f4 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -2889,8 +2889,10 @@ static void try_to_wake_up_local(struct task_struct *p)
+ {
+ struct rq *rq = task_rq(p);
+
+- BUG_ON(rq != this_rq());
+- BUG_ON(p == current);
++ if (WARN_ON_ONCE(rq != this_rq()) ||
++ WARN_ON_ONCE(p == current))
++ return;
++
+ lockdep_assert_held(&rq->lock);
+
+ if (!raw_spin_trylock(&p->pi_lock)) {
+diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
+index c685e31..c3ae144 100644
+--- a/kernel/sched_clock.c
++++ b/kernel/sched_clock.c
+@@ -176,10 +176,36 @@ static u64 sched_clock_remote(struct sched_clock_data *scd)
+ u64 this_clock, remote_clock;
+ u64 *ptr, old_val, val;
+
++#if BITS_PER_LONG != 64
++again:
++ /*
++ * Careful here: The local and the remote clock values need to
++ * be read out atomic as we need to compare the values and
++ * then update either the local or the remote side. So the
++ * cmpxchg64 below only protects one readout.
++ *
++ * We must reread via sched_clock_local() in the retry case on
++ * 32bit as an NMI could use sched_clock_local() via the
++ * tracer and hit between the readout of
++ * the low32bit and the high 32bit portion.
++ */
++ this_clock = sched_clock_local(my_scd);
++ /*
++ * We must enforce atomic readout on 32bit, otherwise the
++ * update on the remote cpu can hit inbetween the readout of
++ * the low32bit and the high 32bit portion.
++ */
++ remote_clock = cmpxchg64(&scd->clock, 0, 0);
++#else
++ /*
++ * On 64bit the read of [my]scd->clock is atomic versus the
++ * update, so we can avoid the above 32bit dance.
++ */
+ sched_clock_local(my_scd);
+ again:
+ this_clock = my_scd->clock;
+ remote_clock = scd->clock;
++#endif
+
+ /*
+ * Use the opportunity that we have both locks
+diff --git a/kernel/signal.c b/kernel/signal.c
+index ea76d30..3ecf574 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2790,7 +2790,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+
+ static int do_tkill(pid_t tgid, pid_t pid, int sig)
+ {
+- struct siginfo info;
++ struct siginfo info = {};
+
+ info.si_signo = sig;
+ info.si_errno = 0;
+diff --git a/kernel/sys.c b/kernel/sys.c
+index f5939c2..be5fa8b 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -320,7 +320,6 @@ void kernel_restart_prepare(char *cmd)
+ system_state = SYSTEM_RESTART;
+ usermodehelper_disable();
+ device_shutdown();
+- syscore_shutdown();
+ }
+
+ /**
+@@ -366,6 +365,7 @@ void kernel_restart(char *cmd)
+ {
+ kernel_restart_prepare(cmd);
+ disable_nonboot_cpus();
++ syscore_shutdown();
+ if (!cmd)
+ printk(KERN_EMERG "Restarting system.\n");
+ else
+@@ -391,6 +391,7 @@ static void kernel_shutdown_prepare(enum system_states state)
+ void kernel_halt(void)
+ {
+ kernel_shutdown_prepare(SYSTEM_HALT);
++ disable_nonboot_cpus();
+ syscore_shutdown();
+ printk(KERN_EMERG "System halted.\n");
+ kmsg_dump(KMSG_DUMP_HALT);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 0943d2a..5527211 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -572,7 +572,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
+ free_page(tmp);
+ }
+
+- free_page((unsigned long)stat->pages);
+ stat->pages = NULL;
+ stat->start = NULL;
+
+@@ -2317,7 +2316,7 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
+ }
+
+ static loff_t
+-ftrace_regex_lseek(struct file *file, loff_t offset, int origin)
++ftrace_filter_lseek(struct file *file, loff_t offset, int origin)
+ {
+ loff_t ret;
+
+@@ -3135,7 +3134,7 @@ static const struct file_operations ftrace_filter_fops = {
+ .open = ftrace_filter_open,
+ .read = seq_read,
+ .write = ftrace_filter_write,
+- .llseek = ftrace_regex_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_regex_release,
+ };
+
+@@ -3143,7 +3142,7 @@ static const struct file_operations ftrace_notrace_fops = {
+ .open = ftrace_notrace_open,
+ .read = seq_read,
+ .write = ftrace_notrace_write,
+- .llseek = ftrace_regex_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_regex_release,
+ };
+
+@@ -3351,8 +3350,8 @@ static const struct file_operations ftrace_graph_fops = {
+ .open = ftrace_graph_open,
+ .read = seq_read,
+ .write = ftrace_graph_write,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_graph_release,
+- .llseek = seq_lseek,
+ };
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+
+@@ -3844,7 +3843,7 @@ static const struct file_operations ftrace_pid_fops = {
+ .open = ftrace_pid_open,
+ .write = ftrace_pid_write,
+ .read = seq_read,
+- .llseek = seq_lseek,
++ .llseek = ftrace_filter_lseek,
+ .release = ftrace_pid_release,
+ };
+
+@@ -3964,12 +3963,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+ ftrace_startup_sysctl();
+
+ /* we are starting ftrace again */
+- if (ftrace_ops_list != &ftrace_list_end) {
+- if (ftrace_ops_list->next == &ftrace_list_end)
+- ftrace_trace_function = ftrace_ops_list->func;
+- else
+- ftrace_trace_function = ftrace_ops_list_func;
+- }
++ if (ftrace_ops_list != &ftrace_list_end)
++ update_ftrace_function();
+
+ } else {
+ /* stopping ftrace calls (just send to ftrace_stub) */
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 640bd98..83bd5b3 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -531,6 +531,13 @@ struct kobject *kobject_get(struct kobject *kobj)
+ return kobj;
+ }
+
++static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
++{
++ if (!kref_get_unless_zero(&kobj->kref))
++ kobj = NULL;
++ return kobj;
++}
++
+ /*
+ * kobject_cleanup - free kobject resources.
+ * @kobj: object to cleanup
+@@ -785,7 +792,7 @@ struct kobject *kset_find_obj_hinted(struct kset *kset, const char *name,
+ slow_search:
+ list_for_each_entry(k, &kset->list, entry) {
+ if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
+- ret = kobject_get(k);
++ ret = kobject_get_unless_zero(k);
+ break;
+ }
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 4c7d42a..70b4733 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2889,7 +2889,17 @@ int follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ break;
+ }
+
+- if (absent ||
++ /*
++ * We need call hugetlb_fault for both hugepages under migration
++ * (in which case hugetlb_fault waits for the migration,) and
++ * hwpoisoned hugepages (in which case we need to prevent the
++ * caller from accessing to them.) In order to do this, we use
++ * here is_swap_pte instead of is_hugetlb_entry_migration and
++ * is_hugetlb_entry_hwpoisoned. This is because it simply covers
++ * both cases, and because we can't follow correct pages
++ * directly from any kind of swap entries.
++ */
++ if (absent || is_swap_pte(huge_ptep_get(pte)) ||
+ ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) {
+ int ret;
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 50f0824..ea3f83b 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -1801,6 +1801,24 @@ int __set_page_dirty_nobuffers(struct page *page)
+ EXPORT_SYMBOL(__set_page_dirty_nobuffers);
+
+ /*
++ * Call this whenever redirtying a page, to de-account the dirty counters
++ * (NR_DIRTIED, BDI_DIRTIED, tsk->nr_dirtied), so that they match the written
++ * counters (NR_WRITTEN, BDI_WRITTEN) in long term. The mismatches will lead to
++ * systematic errors in balanced_dirty_ratelimit and the dirty pages position
++ * control.
++ */
++void account_page_redirty(struct page *page)
++{
++ struct address_space *mapping = page->mapping;
++ if (mapping && mapping_cap_account_dirty(mapping)) {
++ current->nr_dirtied--;
++ dec_zone_page_state(page, NR_DIRTIED);
++ dec_bdi_stat(mapping->backing_dev_info, BDI_DIRTIED);
++ }
++}
++EXPORT_SYMBOL(account_page_redirty);
++
++/*
+ * When a writepage implementation decides that it doesn't want to write this
+ * page for some reason, it should redirty the locked page via
+ * redirty_page_for_writepage() and it should then unlock the page and return 0
+@@ -1808,6 +1826,7 @@ EXPORT_SYMBOL(__set_page_dirty_nobuffers);
+ int redirty_page_for_writepage(struct writeback_control *wbc, struct page *page)
+ {
+ wbc->pages_skipped++;
++ account_page_redirty(page);
+ return __set_page_dirty_nobuffers(page);
+ }
+ EXPORT_SYMBOL(redirty_page_for_writepage);
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 3d79b12..f78f898 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -436,7 +436,7 @@ static int cgw_notifier(struct notifier_block *nb,
+ if (gwj->src.dev == dev || gwj->dst.dev == dev) {
+ hlist_del(&gwj->list);
+ cgw_unregister_filter(gwj);
+- kfree(gwj);
++ kmem_cache_free(cgw_cache, gwj);
+ }
+ }
+ }
+@@ -850,7 +850,7 @@ static void cgw_remove_all_jobs(void)
+ hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+ hlist_del(&gwj->list);
+ cgw_unregister_filter(gwj);
+- kfree(gwj);
++ kmem_cache_free(cgw_cache, gwj);
+ }
+ }
+
+@@ -903,7 +903,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+
+ hlist_del(&gwj->list);
+ cgw_unregister_filter(gwj);
+- kfree(gwj);
++ kmem_cache_free(cgw_cache, gwj);
+ err = 0;
+ break;
+ }
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 1e8a882..2c73adf 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -761,6 +761,20 @@ void cred_to_ucred(struct pid *pid, const struct cred *cred,
+ }
+ EXPORT_SYMBOL_GPL(cred_to_ucred);
+
++void cred_real_to_ucred(struct pid *pid, const struct cred *cred,
++ struct ucred *ucred)
++{
++ ucred->pid = pid_vnr(pid);
++ ucred->uid = ucred->gid = -1;
++ if (cred) {
++ struct user_namespace *current_ns = current_user_ns();
++
++ ucred->uid = user_ns_map_uid(current_ns, cred, cred->uid);
++ ucred->gid = user_ns_map_gid(current_ns, cred, cred->gid);
++ }
++}
++EXPORT_SYMBOL_GPL(cred_real_to_ucred);
++
+ int sock_getsockopt(struct socket *sock, int level, int optname,
+ char __user *optval, int __user *optlen)
+ {
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 7747d26..4707b6c 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -163,7 +163,7 @@ const char *snd_hda_get_jack_type(u32 cfg)
+ "Line Out", "Speaker", "HP Out", "CD",
+ "SPDIF Out", "Digital Out", "Modem Line", "Modem Hand",
+ "Line In", "Aux", "Mic", "Telephony",
+- "SPDIF In", "Digitial In", "Reserved", "Other"
++ "SPDIF In", "Digital In", "Reserved", "Other"
+ };
+
+ return jack_types[(cfg & AC_DEFCFG_DEVICE)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f3e0b24..1b43fde 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5595,7 +5595,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec)
+ const hda_nid_t *ssids;
+
+ if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 ||
+- codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670)
++ codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 ||
++ codec->vendor_id == 0x10ec0671)
+ ssids = alc663_ssids;
+ else
+ ssids = alc662_ssids;
+@@ -6045,6 +6046,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
+ { .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
+ { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
++ { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
+ { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
+ { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
+ { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index 4ad8ebd..4352ffb 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -1101,6 +1101,8 @@ static const struct snd_soc_dapm_route wm8903_intercon[] = {
+ { "ROP", NULL, "Right Speaker PGA" },
+ { "RON", NULL, "Right Speaker PGA" },
+
++ { "Charge Pump", NULL, "CLK_DSP" },
++
+ { "Left Headphone Output PGA", NULL, "Charge Pump" },
+ { "Right Headphone Output PGA", NULL, "Charge Pump" },
+ { "Left Line Output PGA", NULL, "Charge Pump" },
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 38a607a..fb95069 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -396,7 +396,7 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
+ else
+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+- 0, cpu_to_le16(wIndex),
++ 0, wIndex,
+ &tmp, sizeof(tmp), 1000);
+ up_read(&mixer->chip->shutdown_rwsem);
+
+@@ -427,7 +427,7 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
+ else
+ ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
+ USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+- cpu_to_le16(wValue), cpu_to_le16(wIndex),
++ wValue, wIndex,
+ NULL, 0, 1000);
+ up_read(&mixer->chip->shutdown_rwsem);
+
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 1b275f0..dfbd65d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -482,7 +482,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
+ {
+ int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+ 0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+- cpu_to_le16(1), 0, NULL, 0, 1000);
++ 1, 0, NULL, 0, 1000);
+
+ if (ret < 0)
+ return ret;
+diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
+index 3eed61e..79647cd 100644
+--- a/virt/kvm/ioapic.c
++++ b/virt/kvm/ioapic.c
+@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
+ u64 redir_content;
+
+- ASSERT(redir_index < IOAPIC_NUM_PINS);
++ if (redir_index < IOAPIC_NUM_PINS)
++ redir_content =
++ ioapic->redirtbl[redir_index].bits;
++ else
++ redir_content = ~0ULL;
+
+- redir_content = ioapic->redirtbl[redir_index].bits;
+ result = (ioapic->ioregsel & 0x1) ?
+ (redir_content >> 32) & 0xffffffff :
+ redir_content & 0xffffffff;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index ec747dc..8bf05f0 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1401,21 +1401,38 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ }
+
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+- gpa_t gpa)
++ gpa_t gpa, unsigned long len)
+ {
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int offset = offset_in_page(gpa);
+- gfn_t gfn = gpa >> PAGE_SHIFT;
++ gfn_t start_gfn = gpa >> PAGE_SHIFT;
++ gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
++ gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
++ gfn_t nr_pages_avail;
+
+ ghc->gpa = gpa;
+ ghc->generation = slots->generation;
+- ghc->memslot = __gfn_to_memslot(slots, gfn);
+- ghc->hva = gfn_to_hva_many(ghc->memslot, gfn, NULL);
+- if (!kvm_is_error_hva(ghc->hva))
++ ghc->len = len;
++ ghc->memslot = __gfn_to_memslot(slots, start_gfn);
++ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
++ if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
+ ghc->hva += offset;
+- else
+- return -EFAULT;
+-
++ } else {
++ /*
++ * If the requested region crosses two memslots, we still
++ * verify that the entire region is valid here.
++ */
++ while (start_gfn <= end_gfn) {
++ ghc->memslot = __gfn_to_memslot(slots, start_gfn);
++ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
++ &nr_pages_avail);
++ if (kvm_is_error_hva(ghc->hva))
++ return -EFAULT;
++ start_gfn += nr_pages_avail;
++ }
++ /* Use the slow path for cross page reads and writes. */
++ ghc->memslot = NULL;
++ }
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
+@@ -1426,8 +1443,13 @@ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int r;
+
++ BUG_ON(len > ghc->len);
++
+ if (slots->generation != ghc->generation)
+- kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++ kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++ if (unlikely(!ghc->memslot))
++ return kvm_write_guest(kvm, ghc->gpa, data, len);
+
+ if (kvm_is_error_hva(ghc->hva))
+ return -EFAULT;
+@@ -1447,8 +1469,13 @@ int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int r;
+
++ BUG_ON(len > ghc->len);
++
+ if (slots->generation != ghc->generation)
+- kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++ kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++ if (unlikely(!ghc->memslot))
++ return kvm_read_guest(kvm, ghc->gpa, data, len);
+
+ if (kvm_is_error_hva(ghc->hva))
+ return -EFAULT;
diff --git a/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304181907.patch b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304271916.patch
similarity index 99%
rename from 3.2.43/4420_grsecurity-2.9.1-3.2.43-201304181907.patch
rename to 3.2.44/4420_grsecurity-2.9.1-3.2.44-201304271916.patch
index 38dc1b4..062dff7 100644
--- a/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304181907.patch
+++ b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304271916.patch
@@ -196,7 +196,7 @@ index dfa6fc6..fad9813 100644
+zconf.lex.c
zoffset.h
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index ddbf18e..53d74a7 100644
+index 897f223..cbe33de 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -853,6 +853,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
@@ -209,7 +209,7 @@ index ddbf18e..53d74a7 100644
hashdist= [KNL,NUMA] Large hashes allocated during boot
are distributed across NUMA nodes. Defaults on
for 64-bit NUMA, off otherwise.
-@@ -1940,6 +1943,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -1954,6 +1957,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
the specified number of seconds. This is to be used if
your oopses keep scrolling off the screen.
@@ -262,7 +262,7 @@ index 88fd7f5..b318a78 100644
==============================================================
diff --git a/Makefile b/Makefile
-index 59130db..6da759d 100644
+index 566750c..8155f8b 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3690,10 +3690,31 @@ index fc987a1..6e068ef 100644
#endif
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 9d35a3e..556001f 100644
+index 9d35a3e..af9b6d3 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
-@@ -216,6 +216,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+@@ -16,6 +16,8 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+
++extern spinlock_t pa_dbit_lock;
++
+ /*
+ * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+ * memory. For the return value to be meaningful, ADDR must be >=
+@@ -44,8 +46,11 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+
+ #define set_pte_at(mm, addr, ptep, pteval) \
+ do { \
++ unsigned long flags; \
++ spin_lock_irqsave(&pa_dbit_lock, flags); \
+ set_pte(ptep, pteval); \
+ purge_tlb_entries(mm, addr); \
++ spin_unlock_irqrestore(&pa_dbit_lock, flags); \
+ } while (0)
+
+ #endif /* !__ASSEMBLY__ */
+@@ -216,6 +221,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
#define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
#define PAGE_COPY PAGE_EXECREAD
#define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -3711,6 +3732,75 @@ index 9d35a3e..556001f 100644
#define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
#define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
#define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
+@@ -433,48 +449,46 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
+
+ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
++ pte_t pte;
++ unsigned long flags;
++
+ if (!pte_young(*ptep))
+ return 0;
+- return test_and_clear_bit(xlate_pabit(_PAGE_ACCESSED_BIT), &pte_val(*ptep));
+-#else
+- pte_t pte = *ptep;
+- if (!pte_young(pte))
++
++ spin_lock_irqsave(&pa_dbit_lock, flags);
++ pte = *ptep;
++ if (!pte_young(pte)) {
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ return 0;
+- set_pte_at(vma->vm_mm, addr, ptep, pte_mkold(pte));
++ }
++ set_pte(ptep, pte_mkold(pte));
++ purge_tlb_entries(vma->vm_mm, addr);
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ return 1;
+-#endif
+ }
+
+-extern spinlock_t pa_dbit_lock;
+-
+ struct mm_struct;
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ pte_t old_pte;
++ unsigned long flags;
+
+- spin_lock(&pa_dbit_lock);
++ spin_lock_irqsave(&pa_dbit_lock, flags);
+ old_pte = *ptep;
+ pte_clear(mm,addr,ptep);
+- spin_unlock(&pa_dbit_lock);
++ purge_tlb_entries(mm, addr);
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+
+ return old_pte;
+ }
+
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
+- unsigned long new, old;
+-
+- do {
+- old = pte_val(*ptep);
+- new = pte_val(pte_wrprotect(__pte (old)));
+- } while (cmpxchg((unsigned long *) ptep, old, new) != old);
++ unsigned long flags;
++ spin_lock_irqsave(&pa_dbit_lock, flags);
++ set_pte(ptep, pte_wrprotect(*ptep));
+ purge_tlb_entries(mm, addr);
+-#else
+- pte_t old_pte = *ptep;
+- set_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+-#endif
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ }
+
+ #define pte_same(A,B) (pte_val(A) == pte_val(B))
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index ff4cf9d..c0564bb 100644
--- a/arch/parisc/include/asm/uaccess.h
@@ -3728,6 +3818,26 @@ index ff4cf9d..c0564bb 100644
ret = __copy_from_user(to, from, n);
else
copy_from_user_overflow();
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 5241698..91dcb12 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -428,14 +428,11 @@ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ /* Note: purge_tlb_entries can be called at startup with
+ no context. */
+
+- /* Disable preemption while we play with %sr1. */
+- preempt_disable();
++ purge_tlb_start(flags);
+ mtsp(mm->context, 1);
+- purge_tlb_start(flags);
+ pdtlb(addr);
+ pitlb(addr);
+ purge_tlb_end(flags);
+- preempt_enable();
+ }
+ EXPORT_SYMBOL(purge_tlb_entries);
+
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 5e34ccf..672bc9c 100644
--- a/arch/parisc/kernel/module.c
@@ -11667,20 +11777,9 @@ index 5478825..839e88c 100644
#define flush_insn_slot(p) do { } while (0)
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index b4973f4..fc8880d 100644
+index cfb5a40..fc8880d 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
-@@ -393,8 +393,8 @@ struct kvm_vcpu_arch {
- gpa_t time;
- struct pvclock_vcpu_time_info hv_clock;
- unsigned int hw_tsc_khz;
-- unsigned int time_offset;
-- struct page *time_page;
-+ struct gfn_to_hva_cache pv_time;
-+ bool pv_time_enabled;
-
- struct {
- u64 msr_val;
@@ -459,7 +459,7 @@ struct kvm_arch {
unsigned int n_requested_mmu_pages;
unsigned int n_max_mmu_pages;
@@ -12159,7 +12258,7 @@ index 7639dbf..e08a58c 100644
extern unsigned long __phys_addr(unsigned long);
#define __phys_reloc_hide(x) (x)
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index a7d2db9..e1f3a6a 100644
+index 91e758b..cac1cd6 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -601,7 +601,7 @@ static inline pmd_t __pmd(pmdval_t val)
@@ -12190,7 +12289,7 @@ index a7d2db9..e1f3a6a 100644
static inline void pgd_clear(pgd_t *pgdp)
{
set_pgd(pgdp, __pgd(0));
-@@ -748,6 +760,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
+@@ -751,6 +763,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
pv_mmu_ops.set_fixmap(idx, phys, flags);
}
@@ -12212,7 +12311,7 @@ index a7d2db9..e1f3a6a 100644
#if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
static inline int arch_spin_is_locked(struct arch_spinlock *lock)
-@@ -964,7 +991,7 @@ extern void default_banner(void);
+@@ -967,7 +994,7 @@ extern void default_banner(void);
#define PARA_PATCH(struct, off) ((PARAVIRT_PATCH_##struct + (off)) / 4)
#define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
@@ -12221,7 +12320,7 @@ index a7d2db9..e1f3a6a 100644
#endif
#define INTERRUPT_RETURN \
-@@ -1041,6 +1068,21 @@ extern void default_banner(void);
+@@ -1044,6 +1071,21 @@ extern void default_banner(void);
PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit), \
CLBR_NONE, \
jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
@@ -12244,7 +12343,7 @@ index a7d2db9..e1f3a6a 100644
#endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 8e8b9a4..74bb422 100644
+index faf2c04..5724dcd 100644
--- a/arch/x86/include/asm/paravirt_types.h
+++ b/arch/x86/include/asm/paravirt_types.h
@@ -84,7 +84,7 @@ struct pv_init_ops {
@@ -12256,7 +12355,7 @@ index 8e8b9a4..74bb422 100644
struct pv_lazy_ops {
-@@ -97,7 +97,7 @@ struct pv_time_ops {
+@@ -98,7 +98,7 @@ struct pv_time_ops {
unsigned long long (*sched_clock)(void);
unsigned long long (*steal_clock)(int cpu);
unsigned long (*get_tsc_khz)(void);
@@ -12265,7 +12364,7 @@ index 8e8b9a4..74bb422 100644
struct pv_cpu_ops {
/* hooks for various privileged instructions */
-@@ -193,7 +193,7 @@ struct pv_cpu_ops {
+@@ -194,7 +194,7 @@ struct pv_cpu_ops {
void (*start_context_switch)(struct task_struct *prev);
void (*end_context_switch)(struct task_struct *next);
@@ -12274,7 +12373,7 @@ index 8e8b9a4..74bb422 100644
struct pv_irq_ops {
/*
-@@ -224,7 +224,7 @@ struct pv_apic_ops {
+@@ -225,7 +225,7 @@ struct pv_apic_ops {
unsigned long start_eip,
unsigned long start_esp);
#endif
@@ -12283,7 +12382,7 @@ index 8e8b9a4..74bb422 100644
struct pv_mmu_ops {
unsigned long (*read_cr2)(void);
-@@ -313,6 +313,7 @@ struct pv_mmu_ops {
+@@ -314,6 +314,7 @@ struct pv_mmu_ops {
struct paravirt_callee_save make_pud;
void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
@@ -12291,7 +12390,7 @@ index 8e8b9a4..74bb422 100644
#endif /* PAGETABLE_LEVELS == 4 */
#endif /* PAGETABLE_LEVELS >= 3 */
-@@ -324,6 +325,12 @@ struct pv_mmu_ops {
+@@ -325,6 +326,12 @@ struct pv_mmu_ops {
an mfn. We can tell which is which from the index. */
void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
phys_addr_t phys, pgprot_t flags);
@@ -12304,7 +12403,7 @@ index 8e8b9a4..74bb422 100644
};
struct arch_spinlock;
-@@ -334,7 +341,7 @@ struct pv_lock_ops {
+@@ -335,7 +342,7 @@ struct pv_lock_ops {
void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
int (*spin_trylock)(struct arch_spinlock *lock);
void (*spin_unlock)(struct arch_spinlock *lock);
@@ -19754,7 +19853,7 @@ index 676b8c7..870ba04 100644
.spin_is_locked = __ticket_spin_is_locked,
.spin_is_contended = __ticket_spin_is_contended,
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index d90272e..1afe104 100644
+index 84c938f..09fb3e0 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
@@ -19799,8 +19898,8 @@ index d90272e..1afe104 100644
return insn_len;
}
-@@ -302,7 +309,7 @@ void arch_flush_lazy_mmu_mode(void)
- preempt_enable();
+@@ -302,7 +309,7 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
+ return percpu_read(paravirt_lazy_mode);
}
-struct pv_info pv_info = {
@@ -19875,7 +19974,7 @@ index d90272e..1afe104 100644
#endif
#endif /* PAGETABLE_LEVELS >= 3 */
-@@ -478,6 +491,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+@@ -479,6 +492,12 @@ struct pv_mmu_ops pv_mmu_ops = {
},
.set_fixmap = native_set_fixmap,
@@ -22248,45 +22347,10 @@ index 407789b..5570a86 100644
vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index f4063fd..8ed079b 100644
+index e82a53a..6b38ed8 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
-@@ -1105,7 +1105,6 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- {
- unsigned long flags;
- struct kvm_vcpu_arch *vcpu = &v->arch;
-- void *shared_kaddr;
- unsigned long this_tsc_khz;
- s64 kernel_ns, max_kernel_ns;
- u64 tsc_timestamp;
-@@ -1141,7 +1140,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
-
- local_irq_restore(flags);
-
-- if (!vcpu->time_page)
-+ if (!vcpu->pv_time_enabled)
- return 0;
-
- /*
-@@ -1199,14 +1198,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- */
- vcpu->hv_clock.version += 2;
-
-- shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0);
--
-- memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
-- sizeof(vcpu->hv_clock));
--
-- kunmap_atomic(shared_kaddr, KM_USER0);
--
-- mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
-+ kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
-+ &vcpu->hv_clock,
-+ sizeof(vcpu->hv_clock));
- return 0;
- }
-
-@@ -1348,8 +1342,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1342,8 +1342,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
{
struct kvm *kvm = vcpu->kvm;
int lm = is_long_mode(vcpu);
@@ -22297,54 +22361,7 @@ index f4063fd..8ed079b 100644
u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
: kvm->arch.xen_hvm_config.blob_size_32;
u32 page_num = data & ~PAGE_MASK;
-@@ -1496,10 +1490,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
-
- static void kvmclock_reset(struct kvm_vcpu *vcpu)
- {
-- if (vcpu->arch.time_page) {
-- kvm_release_page_dirty(vcpu->arch.time_page);
-- vcpu->arch.time_page = NULL;
-- }
-+ vcpu->arch.pv_time_enabled = false;
- }
-
- static void accumulate_steal_time(struct kvm_vcpu *vcpu)
-@@ -1591,6 +1582,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
- break;
- case MSR_KVM_SYSTEM_TIME_NEW:
- case MSR_KVM_SYSTEM_TIME: {
-+ u64 gpa_offset;
- kvmclock_reset(vcpu);
-
- vcpu->arch.time = data;
-@@ -1600,16 +1592,18 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
- if (!(data & 1))
- break;
-
-- /* ...but clean it before doing the actual write */
-- vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-+ gpa_offset = data & ~(PAGE_MASK | 1);
-
-- vcpu->arch.time_page =
-- gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
-+ /* Check that address+len does not cross page boundary */
-+ if ((gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1)
-+ & PAGE_MASK)
-+ break;
-
-- if (is_error_page(vcpu->arch.time_page)) {
-- kvm_release_page_clean(vcpu->arch.time_page);
-- vcpu->arch.time_page = NULL;
-- }
-+ if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
-+ &vcpu->arch.pv_time, data & ~1ULL))
-+ vcpu->arch.pv_time_enabled = false;
-+ else
-+ vcpu->arch.pv_time_enabled = true;
- break;
- }
- case MSR_KVM_ASYNC_PF_EN:
-@@ -2168,6 +2162,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2160,6 +2160,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
if (n < msr_list.nmsrs)
goto out;
r = -EFAULT;
@@ -22353,7 +22370,7 @@ index f4063fd..8ed079b 100644
if (copy_to_user(user_msr_list->indices, &msrs_to_save,
num_msrs_to_save * sizeof(u32)))
goto out;
-@@ -2343,15 +2339,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2335,15 +2337,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
struct kvm_cpuid2 *cpuid,
struct kvm_cpuid_entry2 __user *entries)
{
@@ -22377,7 +22394,7 @@ index f4063fd..8ed079b 100644
vcpu->arch.cpuid_nent = cpuid->nent;
kvm_apic_set_version(vcpu);
kvm_x86_ops->cpuid_update(vcpu);
-@@ -2366,15 +2367,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2358,15 +2365,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
struct kvm_cpuid2 *cpuid,
struct kvm_cpuid_entry2 __user *entries)
{
@@ -22400,7 +22417,7 @@ index f4063fd..8ed079b 100644
return 0;
out:
-@@ -2749,7 +2754,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2741,7 +2752,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
struct kvm_interrupt *irq)
{
@@ -22409,7 +22426,7 @@ index f4063fd..8ed079b 100644
return -EINVAL;
if (irqchip_in_kernel(vcpu->kvm))
return -ENXIO;
-@@ -5191,7 +5196,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5183,7 +5194,7 @@ static void kvm_set_mmio_spte_mask(void)
kvm_mmu_set_mmio_spte_mask(mask);
}
@@ -22418,16 +22435,8 @@ index f4063fd..8ed079b 100644
{
int r;
struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-@@ -6549,6 +6554,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask, GFP_KERNEL))
- goto fail_free_mce_banks;
-
-+ vcpu->arch.pv_time_enabled = false;
- kvm_async_pf_hash_reset(vcpu);
-
- return 0;
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index cf4603b..7cdde38 100644
+index 8f4fda4..353d5cc 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -1195,9 +1195,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
@@ -25416,7 +25425,7 @@ index d0474ad..36e9257 100644
extern u32 pnp_bios_is_utter_crap;
pnp_bios_is_utter_crap = 1;
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 7b73c88..a561402 100644
+index 53a7b69..0b31dac 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -13,11 +13,18 @@
@@ -25572,7 +25581,7 @@ index 7b73c88..a561402 100644
pgd_ref = pgd_offset_k(address);
if (pgd_none(*pgd_ref))
return -1;
-@@ -540,7 +611,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
+@@ -542,7 +613,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
static int is_errata100(struct pt_regs *regs, unsigned long address)
{
#ifdef CONFIG_X86_64
@@ -25581,7 +25590,7 @@ index 7b73c88..a561402 100644
return 1;
#endif
return 0;
-@@ -567,7 +638,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
+@@ -569,7 +640,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
}
static const char nx_warning[] = KERN_CRIT
@@ -25590,7 +25599,7 @@ index 7b73c88..a561402 100644
static void
show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -576,15 +647,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+@@ -578,15 +649,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
if (!oops_may_print())
return;
@@ -25619,7 +25628,7 @@ index 7b73c88..a561402 100644
printk(KERN_ALERT "BUG: unable to handle kernel ");
if (address < PAGE_SIZE)
printk(KERN_CONT "NULL pointer dereference");
-@@ -738,6 +820,22 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
+@@ -740,6 +822,22 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
return;
}
#endif
@@ -25642,7 +25651,7 @@ index 7b73c88..a561402 100644
/* Kernel addresses are always protection faults: */
if (address >= TASK_SIZE)
error_code |= PF_PROT;
-@@ -837,7 +935,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
+@@ -839,7 +937,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
printk(KERN_ERR
"MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
@@ -25651,7 +25660,7 @@ index 7b73c88..a561402 100644
code = BUS_MCEERR_AR;
}
#endif
-@@ -892,6 +990,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
+@@ -894,6 +992,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
return 1;
}
@@ -25751,7 +25760,7 @@ index 7b73c88..a561402 100644
/*
* Handle a spurious fault caused by a stale TLB entry.
*
-@@ -964,6 +1155,9 @@ int show_unhandled_signals = 1;
+@@ -966,6 +1157,9 @@ int show_unhandled_signals = 1;
static inline int
access_error(unsigned long error_code, struct vm_area_struct *vma)
{
@@ -25761,7 +25770,7 @@ index 7b73c88..a561402 100644
if (error_code & PF_WRITE) {
/* write, present and write, not present: */
if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -997,18 +1191,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -999,18 +1193,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
{
struct vm_area_struct *vma;
struct task_struct *tsk;
@@ -25799,7 +25808,7 @@ index 7b73c88..a561402 100644
/*
* Detect and handle instructions that would cause a page fault for
-@@ -1069,7 +1277,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1071,7 +1279,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
* User-mode registers count as a user access even for any
* potential system fault or CPU buglet:
*/
@@ -25808,7 +25817,7 @@ index 7b73c88..a561402 100644
local_irq_enable();
error_code |= PF_USER;
} else {
-@@ -1124,6 +1332,11 @@ retry:
+@@ -1126,6 +1334,11 @@ retry:
might_sleep();
}
@@ -25820,7 +25829,7 @@ index 7b73c88..a561402 100644
vma = find_vma(mm, address);
if (unlikely(!vma)) {
bad_area(regs, error_code, address);
-@@ -1135,18 +1348,24 @@ retry:
+@@ -1137,18 +1350,24 @@ retry:
bad_area(regs, error_code, address);
return;
}
@@ -25856,7 +25865,7 @@ index 7b73c88..a561402 100644
if (unlikely(expand_stack(vma, address))) {
bad_area(regs, error_code, address);
return;
-@@ -1201,3 +1420,292 @@ good_area:
+@@ -1203,3 +1422,292 @@ good_area:
up_read(&mm->mmap_sem);
}
@@ -29500,7 +29509,7 @@ index 69b9ef6..aa929bc 100644
};
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 2b8b0de..0787f8a 100644
+index fe00be69..d2c142a 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -1757,6 +1757,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
@@ -30144,10 +30153,10 @@ index 3c92dbd..008b08b 100644
unsigned long timeout_msec)
{
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index c9540c0..963b068 100644
+index 288b635..455273d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
-@@ -4735,7 +4735,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4739,7 +4739,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
struct ata_port *ap;
unsigned int tag;
@@ -30156,7 +30165,7 @@ index c9540c0..963b068 100644
ap = qc->ap;
qc->flags = 0;
-@@ -4751,7 +4751,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4755,7 +4755,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
struct ata_port *ap;
struct ata_link *link;
@@ -30165,7 +30174,7 @@ index c9540c0..963b068 100644
WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
ap = qc->ap;
link = qc->dev->link;
-@@ -5756,6 +5756,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5760,6 +5760,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
return;
spin_lock(&lock);
@@ -30173,7 +30182,7 @@ index c9540c0..963b068 100644
for (cur = ops->inherits; cur; cur = cur->inherits) {
void **inherit = (void **)cur;
-@@ -5769,8 +5770,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5773,8 +5774,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
if (IS_ERR(*pp))
*pp = NULL;
@@ -33681,10 +33690,10 @@ index ca67338..0003ba7 100644
return can_switch;
}
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 012a9d2..3b2267c 100644
+index 144d37c..bf1110f 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -319,7 +319,7 @@ typedef struct drm_i915_private {
+@@ -320,7 +320,7 @@ typedef struct drm_i915_private {
int current_page;
int page_flipping;
@@ -33693,7 +33702,7 @@ index 012a9d2..3b2267c 100644
/* protects the irq masks */
spinlock_t irq_lock;
-@@ -896,7 +896,7 @@ struct drm_i915_gem_object {
+@@ -897,7 +897,7 @@ struct drm_i915_gem_object {
* will be page flipped away on the next vblank. When it
* reaches 0, dev_priv->pending_flip_queue will be woken up.
*/
@@ -33702,7 +33711,7 @@ index 012a9d2..3b2267c 100644
};
#define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
-@@ -1273,7 +1273,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
+@@ -1274,7 +1274,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
extern void intel_teardown_gmbus(struct drm_device *dev);
extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
@@ -33830,10 +33839,10 @@ index 93e74fb..4a1182d 100644
INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
INIT_WORK(&dev_priv->error_work, i915_error_work_func);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 17961df..8ef9827 100644
+index 897ca06..ea0a32a 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -2214,7 +2214,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
+@@ -2215,7 +2215,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
wait_event(dev_priv->pending_flip_queue,
atomic_read(&dev_priv->mm.wedged) ||
@@ -33842,7 +33851,7 @@ index 17961df..8ef9827 100644
/* Big Hammer, we also need to ensure that any pending
* MI_WAIT_FOR_EVENT inside a user batch buffer on the
-@@ -6986,8 +6986,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+@@ -6987,8 +6987,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
obj = work->old_fb_obj;
@@ -33852,7 +33861,7 @@ index 17961df..8ef9827 100644
wake_up(&dev_priv->pending_flip_queue);
schedule_work(&work->work);
-@@ -7196,7 +7195,13 @@ static int intel_gen6_queue_flip(struct drm_device *dev,
+@@ -7197,7 +7196,13 @@ static int intel_gen6_queue_flip(struct drm_device *dev,
OUT_RING(fb->pitch | obj->tiling_mode);
OUT_RING(obj->gtt_offset);
@@ -33867,7 +33876,7 @@ index 17961df..8ef9827 100644
pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
OUT_RING(pf | pipesrc);
-@@ -7328,7 +7333,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7329,7 +7334,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
/* Block clients from rendering to the new back buffer until
* the flip occurs and the object is no longer visible.
*/
@@ -33876,7 +33885,7 @@ index 17961df..8ef9827 100644
ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
if (ret)
-@@ -7342,7 +7347,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7343,7 +7348,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
return 0;
cleanup_pending:
@@ -33885,7 +33894,7 @@ index 17961df..8ef9827 100644
crtc->fb = old_fb;
drm_gem_object_unreference(&work->old_fb_obj->base);
drm_gem_object_unreference(&obj->base);
-@@ -7477,11 +7482,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
+@@ -7478,11 +7483,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
if (HAS_PCH_SPLIT(dev)) {
if (pipe == 2 && IS_IVYBRIDGE(dev))
intel_crtc->no_pll = true;
@@ -33905,15 +33914,15 @@ index 17961df..8ef9827 100644
}
drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs);
-@@ -8836,7 +8845,7 @@ struct intel_quirk {
+@@ -8847,7 +8856,7 @@ struct intel_quirk {
int subsystem_vendor;
int subsystem_device;
void (*hook)(struct drm_device *dev);
-};
+} __do_const;
- struct intel_quirk intel_quirks[] = {
- /* HP Compaq 2730p needs pipe A force quirk (LP: #291555) */
+ /* For systems that don't have a meaningful PCI subdevice/subvendor ID */
+ struct intel_dmi_quirk {
diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
index 54558a0..2d97005 100644
--- a/drivers/gpu/drm/mga/mga_drv.h
@@ -38605,80 +38614,10 @@ index a3f7a27..234016e 100644
/* Don't allow a single read to cross a 512-byte block boundary */
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
-index e7dc732..58ec627 100644
+index 1d90e26..865d439 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
-@@ -1141,6 +1141,33 @@ static unsigned long mtd_get_unmapped_area(struct file *file,
- }
- #endif
-
-+static inline unsigned long get_vm_size(struct vm_area_struct *vma)
-+{
-+ return vma->vm_end - vma->vm_start;
-+}
-+
-+static inline resource_size_t get_vm_offset(struct vm_area_struct *vma)
-+{
-+ return (resource_size_t) vma->vm_pgoff << PAGE_SHIFT;
-+}
-+
-+/*
-+ * Set a new vm offset.
-+ *
-+ * Verify that the incoming offset really works as a page offset,
-+ * and that the offset and size fit in a resource_size_t.
-+ */
-+static inline int set_vm_offset(struct vm_area_struct *vma, resource_size_t off)
-+{
-+ pgoff_t pgoff = off >> PAGE_SHIFT;
-+ if (off != (resource_size_t) pgoff << PAGE_SHIFT)
-+ return -EINVAL;
-+ if (off + get_vm_size(vma) - 1 < off)
-+ return -EINVAL;
-+ vma->vm_pgoff = pgoff;
-+ return 0;
-+}
-+
- /*
- * set up a mapping for shared memory segments
- */
-@@ -1150,20 +1177,29 @@ static int mtd_mmap(struct file *file, struct vm_area_struct *vma)
- struct mtd_file_info *mfi = file->private_data;
- struct mtd_info *mtd = mfi->mtd;
- struct map_info *map = mtd->priv;
-- unsigned long start;
-- unsigned long off;
-- u32 len;
-+ resource_size_t start, off;
-+ unsigned long len, vma_len;
-
- if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
-- off = vma->vm_pgoff << PAGE_SHIFT;
-+ off = get_vm_offset(vma);
- start = map->phys;
- len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
- start &= PAGE_MASK;
-- if ((vma->vm_end - vma->vm_start + off) > len)
-+ vma_len = get_vm_size(vma);
-+
-+ /* Overflow in off+len? */
-+ if (vma_len + off < off)
-+ return -EINVAL;
-+ /* Does it fit in the mapping? */
-+ if (vma_len + off > len)
- return -EINVAL;
-
- off += start;
-- vma->vm_pgoff = off >> PAGE_SHIFT;
-+ /* Did that overflow? */
-+ if (off < start)
-+ return -EINVAL;
-+ if (set_vm_offset(vma, off) < 0)
-+ return -EINVAL;
- vma->vm_flags |= VM_IO | VM_RESERVED;
-
- #ifdef pgprot_noncached
-@@ -1211,6 +1247,7 @@ static struct file_system_type mtd_inodefs_type = {
+@@ -1215,6 +1215,7 @@ static struct file_system_type mtd_inodefs_type = {
.mount = mtd_inodefs_mount,
.kill_sb = kill_anon_super,
};
@@ -39257,7 +39196,7 @@ index 49b549f..13d648c 100644
mac->phydev = phydev;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index a6153f1..4bdf0c8 100644
+index d812790..d1e0f1a 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -704,17 +704,17 @@ struct rtl8169_private {
@@ -42469,7 +42408,7 @@ index 6845228..df77141 100644
core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 9176b2e..0859fe0 100644
+index 898c1de..b2ca488 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1343,7 +1343,7 @@ struct se_device *transport_add_device_to_core_hba(
@@ -42481,7 +42420,7 @@ index 9176b2e..0859fe0 100644
se_dev_set_default_attribs(dev, dev_limits);
-@@ -1530,7 +1530,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
+@@ -1531,7 +1531,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
* Used to determine when ORDERED commands should go from
* Dormant to Active status.
*/
@@ -42490,7 +42429,7 @@ index 9176b2e..0859fe0 100644
smp_mb__after_atomic_inc();
pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
cmd->se_ordered_id, cmd->sam_task_attr,
-@@ -1800,7 +1800,7 @@ static void transport_generic_request_failure(struct se_cmd *cmd)
+@@ -1801,7 +1801,7 @@ static void transport_generic_request_failure(struct se_cmd *cmd)
" t_transport_active: %d t_transport_stop: %d"
" t_transport_sent: %d\n", cmd->t_task_list_num,
atomic_read(&cmd->t_task_cdbs_left),
@@ -42499,7 +42438,7 @@ index 9176b2e..0859fe0 100644
atomic_read(&cmd->t_task_cdbs_ex_left),
atomic_read(&cmd->t_transport_active),
atomic_read(&cmd->t_transport_stop),
-@@ -2090,9 +2090,9 @@ check_depth:
+@@ -2091,9 +2091,9 @@ check_depth:
spin_lock_irqsave(&cmd->t_state_lock, flags);
task->task_flags |= (TF_ACTIVE | TF_SENT);
@@ -42511,7 +42450,7 @@ index 9176b2e..0859fe0 100644
cmd->t_task_list_num)
atomic_set(&cmd->t_transport_sent, 1);
-@@ -4303,7 +4303,7 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
+@@ -4304,7 +4304,7 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
atomic_set(&cmd->transport_lun_stop, 0);
}
if (!atomic_read(&cmd->t_transport_active) ||
@@ -42520,7 +42459,7 @@ index 9176b2e..0859fe0 100644
spin_unlock_irqrestore(&cmd->t_state_lock, flags);
return false;
}
-@@ -4561,7 +4561,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+@@ -4562,7 +4562,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
{
int ret = 0;
@@ -42529,7 +42468,7 @@ index 9176b2e..0859fe0 100644
if (!send_status ||
(cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
return 1;
-@@ -4598,7 +4598,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
+@@ -4599,7 +4599,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
*/
if (cmd->data_direction == DMA_TO_DEVICE) {
if (cmd->se_tfo->write_pending_status(cmd) != 0) {
@@ -42960,10 +42899,47 @@ index 43db715..82134aa 100644
if (get_user(c, buf))
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index 05085be..67eadb0 100644
+index 05085be..ca1e67e 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
-@@ -3240,7 +3240,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+@@ -940,6 +940,14 @@ void start_tty(struct tty_struct *tty)
+
+ EXPORT_SYMBOL(start_tty);
+
++static void tty_update_time(struct timespec *time)
++{
++ unsigned long sec = get_seconds();
++ sec -= sec % 60;
++ if ((long)(sec - time->tv_sec) > 0)
++ time->tv_sec = sec;
++}
++
+ /**
+ * tty_read - read method for tty device files
+ * @file: pointer to tty file
+@@ -976,8 +984,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ else
+ i = -EIO;
+ tty_ldisc_deref(ld);
++
+ if (i > 0)
+- inode->i_atime = current_fs_time(inode->i_sb);
++ tty_update_time(&inode->i_atime);
++
+ return i;
+ }
+
+@@ -1079,8 +1089,7 @@ static inline ssize_t do_tty_write(
+ cond_resched();
+ }
+ if (written) {
+- struct inode *inode = file->f_path.dentry->d_inode;
+- inode->i_mtime = current_fs_time(inode->i_sb);
++ tty_update_time(&file->f_path.dentry->d_inode->i_mtime);
+ ret = written;
+ }
+ out:
+@@ -3240,7 +3249,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
void tty_default_fops(struct file_operations *fops)
{
@@ -43623,7 +43599,7 @@ index e132157..516db70 100644
return rc;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 9b8bcab..cc61f88 100644
+index 7a36dff..cbe139a 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -450,7 +450,7 @@ static int __init fb_console_setup(char *this_opt)
@@ -43674,7 +43650,7 @@ index 5c3960d..15cf8fc 100644
goto out1;
}
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index c133dde..478888d 100644
+index babbb07..649d8d2 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
@@ -48334,10 +48310,10 @@ index dede441..f2a2507 100644
WARN_ON(trans->transid != btrfs_header_generation(parent));
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index fd1a06d..6e9033d 100644
+index 1372634..f1db831 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
-@@ -6895,7 +6895,7 @@ fail:
+@@ -6909,7 +6909,7 @@ fail:
return -ENOMEM;
}
@@ -48346,7 +48322,7 @@ index fd1a06d..6e9033d 100644
struct dentry *dentry, struct kstat *stat)
{
struct inode *inode = dentry->d_inode;
-@@ -6909,6 +6909,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
+@@ -6923,6 +6923,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
return 0;
}
@@ -52383,19 +52359,6 @@ index 1b55f70..bd6c289 100644
static void hfs_init_once(void *p)
{
-diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
-index 5849e3e..32b12e5 100644
---- a/fs/hfsplus/extents.c
-+++ b/fs/hfsplus/extents.c
-@@ -517,7 +517,7 @@ void hfsplus_file_truncate(struct inode *inode)
- struct address_space *mapping = inode->i_mapping;
- struct page *page;
- void *fsdata;
-- u32 size = inode->i_size;
-+ loff_t size = inode->i_size;
-
- res = pagecache_write_begin(NULL, mapping, size, 0,
- AOP_FLAG_UNINTERRUPTIBLE,
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index d24a9b6..b398147 100644
--- a/fs/hfsplus/super.c
@@ -52514,18 +52477,9 @@ index 0aa424a..332097d8 100644
static int can_do_hugetlb_shm(void)
{
diff --git a/fs/inode.c b/fs/inode.c
-index ee4e66b..e6f3833 100644
+index e2d3633..e6f3833 100644
--- a/fs/inode.c
+++ b/fs/inode.c
-@@ -634,7 +634,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
- * inode to the back of the list so we don't spin on it.
- */
- if (!spin_trylock(&inode->i_lock)) {
-- list_move_tail(&inode->i_lru, &sb->s_inode_lru);
-+ list_move(&inode->i_lru, &sb->s_inode_lru);
- continue;
- }
-
@@ -787,8 +787,8 @@ unsigned int get_next_ino(void)
#ifdef CONFIG_SMP
@@ -69745,45 +69699,8 @@ index f66b065..c2c29b4 100644
int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
int kobj_ns_type_registered(enum kobj_ns_type type);
-diff --git a/include/linux/kref.h b/include/linux/kref.h
-index d4a62ab..d064502 100644
---- a/include/linux/kref.h
-+++ b/include/linux/kref.h
-@@ -16,6 +16,7 @@
- #define _KREF_H_
-
- #include <linux/types.h>
-+#include <linux/atomic.h>
-
- struct kref {
- atomic_t refcount;
-@@ -27,4 +28,24 @@ int kref_put(struct kref *kref, void (*release) (struct kref *kref));
- int kref_sub(struct kref *kref, unsigned int count,
- void (*release) (struct kref *kref));
-
-+/**
-+ * kref_get_unless_zero - Increment refcount for object unless it is zero.
-+ * @kref: object.
-+ *
-+ * Return non-zero if the increment succeeded. Otherwise return 0.
-+ *
-+ * This function is intended to simplify locking around refcounting for
-+ * objects that can be looked up from a lookup structure, and which are
-+ * removed from that lookup structure in the object destructor.
-+ * Operations on such objects require at least a read lock around
-+ * lookup + kref_get, and a write lock around kref_put + remove from lookup
-+ * structure. Furthermore, RCU implementations become extremely tricky.
-+ * With a lookup followed by a kref_get_unless_zero *with return value check*
-+ * locking in the kref_put path can be deferred to the actual removal from
-+ * the lookup structure and RCU lookups become trivial.
-+ */
-+static inline int __must_check kref_get_unless_zero(struct kref *kref)
-+{
-+ return atomic_add_unless(&kref->refcount, 1, 0);
-+}
- #endif /* _KREF_H_ */
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 6136821..da8ced0 100644
+index e6796c1..350d338 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
@@ -69805,10 +69722,10 @@ index 6136821..da8ced0 100644
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
diff --git a/include/linux/libata.h b/include/linux/libata.h
-index cafc09a..d7e7829 100644
+index 62467ca..3d65d7d 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
-@@ -909,7 +909,7 @@ struct ata_port_operations {
+@@ -910,7 +910,7 @@ struct ata_port_operations {
* fields must be pointers.
*/
const struct ata_port_operations *inherits;
@@ -75190,10 +75107,10 @@ index 9b22d03..6295b62 100644
prev->next = info->next;
else
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index cdd5607..c3fc919 100644
+index e4cee8d..f31f503 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
-@@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1408,7 +1408,7 @@ void hrtimer_peek_ahead_timers(void)
local_irq_restore(flags);
}
@@ -75202,7 +75119,7 @@ index cdd5607..c3fc919 100644
{
struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-@@ -1751,7 +1751,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
+@@ -1750,7 +1750,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
return NOTIFY_OK;
}
@@ -77677,10 +77594,10 @@ index 3d9f31c..7fefc9e 100644
default:
diff --git a/kernel/sched.c b/kernel/sched.c
-index eeeec4e..9240d2d 100644
+index d08c9f4..9a9af37 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
-@@ -5044,7 +5044,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
+@@ -5046,7 +5046,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
* The return value is -ERESTARTSYS if interrupted, 0 if timed out,
* positive (at least 1, or number of jiffies left till timeout) if completed.
*/
@@ -77689,7 +77606,7 @@ index eeeec4e..9240d2d 100644
wait_for_completion_interruptible_timeout(struct completion *x,
unsigned long timeout)
{
-@@ -5061,7 +5061,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
+@@ -5063,7 +5063,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
*
* The return value is -ERESTARTSYS if interrupted, 0 if completed.
*/
@@ -77698,7 +77615,7 @@ index eeeec4e..9240d2d 100644
{
long t = wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_KILLABLE);
if (t == -ERESTARTSYS)
-@@ -5082,7 +5082,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
+@@ -5084,7 +5084,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
* The return value is -ERESTARTSYS if interrupted, 0 if timed out,
* positive (at least 1, or number of jiffies left till timeout) if completed.
*/
@@ -77707,7 +77624,7 @@ index eeeec4e..9240d2d 100644
wait_for_completion_killable_timeout(struct completion *x,
unsigned long timeout)
{
-@@ -5291,6 +5291,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -5293,6 +5293,8 @@ int can_nice(const struct task_struct *p, const int nice)
/* convert nice value [19,-20] to rlimit style value [1,40] */
int nice_rlim = 20 - nice;
@@ -77716,7 +77633,7 @@ index eeeec4e..9240d2d 100644
return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
capable(CAP_SYS_NICE));
}
-@@ -5324,7 +5326,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -5326,7 +5328,8 @@ SYSCALL_DEFINE1(nice, int, increment)
if (nice > 19)
nice = 19;
@@ -77726,7 +77643,7 @@ index eeeec4e..9240d2d 100644
return -EPERM;
retval = security_task_setnice(current, nice);
-@@ -5481,6 +5484,7 @@ recheck:
+@@ -5483,6 +5486,7 @@ recheck:
unsigned long rlim_rtprio =
task_rlimit(p, RLIMIT_RTPRIO);
@@ -77734,7 +77651,7 @@ index eeeec4e..9240d2d 100644
/* can't set/change the rt policy */
if (policy != p->policy && !rlim_rtprio)
return -EPERM;
-@@ -6624,7 +6628,7 @@ static void migrate_tasks(unsigned int dead_cpu)
+@@ -6626,7 +6630,7 @@ static void migrate_tasks(unsigned int dead_cpu)
#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
@@ -77743,7 +77660,7 @@ index eeeec4e..9240d2d 100644
{
.procname = "sched_domain",
.mode = 0555,
-@@ -6641,17 +6645,17 @@ static struct ctl_table sd_ctl_root[] = {
+@@ -6643,17 +6647,17 @@ static struct ctl_table sd_ctl_root[] = {
{}
};
@@ -77765,7 +77682,7 @@ index eeeec4e..9240d2d 100644
/*
* In the intermediate directories, both the child directory and
-@@ -6659,19 +6663,22 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -6661,19 +6665,22 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
* will always be set. In the lowest directory the names are
* static strings and all have proc handlers.
*/
@@ -77794,7 +77711,7 @@ index eeeec4e..9240d2d 100644
const char *procname, void *data, int maxlen,
mode_t mode, proc_handler *proc_handler)
{
-@@ -6685,7 +6692,7 @@ set_table_entry(struct ctl_table *entry,
+@@ -6687,7 +6694,7 @@ set_table_entry(struct ctl_table *entry,
static struct ctl_table *
sd_alloc_ctl_domain_table(struct sched_domain *sd)
{
@@ -77803,7 +77720,7 @@ index eeeec4e..9240d2d 100644
if (table == NULL)
return NULL;
-@@ -6720,9 +6727,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -6722,9 +6729,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
return table;
}
@@ -77815,7 +77732,7 @@ index eeeec4e..9240d2d 100644
struct sched_domain *sd;
int domain_num = 0, i;
char buf[32];
-@@ -6749,11 +6756,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -6751,11 +6758,13 @@ static struct ctl_table_header *sd_sysctl_header;
static void register_sched_domain_sysctl(void)
{
int i, cpu_num = num_possible_cpus();
@@ -77830,7 +77747,7 @@ index eeeec4e..9240d2d 100644
if (entry == NULL)
return;
-@@ -6776,8 +6785,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -6778,8 +6787,12 @@ static void unregister_sched_domain_sysctl(void)
if (sd_sysctl_header)
unregister_sysctl_table(sd_sysctl_header);
sd_sysctl_header = NULL;
@@ -77845,7 +77762,7 @@ index eeeec4e..9240d2d 100644
}
#else
static void register_sched_domain_sysctl(void)
-@@ -6875,7 +6888,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+@@ -6877,7 +6890,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
* happens before everything else. This has to be lower priority than
* the notifier in the perf_event subsystem, though.
*/
@@ -77890,7 +77807,7 @@ index 66e4576..d05c6d5 100644
int this_cpu = smp_processor_id();
struct rq *this_rq = cpu_rq(this_cpu);
diff --git a/kernel/signal.c b/kernel/signal.c
-index ea76d30..7b5d245 100644
+index 3ecf574..7b5d245 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -78016,15 +77933,6 @@ index ea76d30..7b5d245 100644
if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
error = check_kill_permission(sig, info, p);
/*
-@@ -2790,7 +2821,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
-
- static int do_tkill(pid_t tgid, pid_t pid, int sig)
- {
-- struct siginfo info;
-+ struct siginfo info = {};
-
- info.si_signo = sig;
- info.si_errno = 0;
diff --git a/kernel/smp.c b/kernel/smp.c
index 9e800b2..1533ba5 100644
--- a/kernel/smp.c
@@ -78151,7 +78059,7 @@ index 2f194e9..2c05ea9 100644
.priority = 10,
};
diff --git a/kernel/sys.c b/kernel/sys.c
-index f5939c2..3084a61 100644
+index be5fa8b..3f10c33 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -158,6 +158,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
@@ -78167,7 +78075,7 @@ index f5939c2..3084a61 100644
no_nice = security_task_setnice(p, niceval);
if (no_nice) {
error = no_nice;
-@@ -573,6 +579,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
+@@ -574,6 +580,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
goto error;
}
@@ -78177,7 +78085,7 @@ index f5939c2..3084a61 100644
if (rgid != (gid_t) -1 ||
(egid != (gid_t) -1 && egid != old->gid))
new->sgid = new->egid;
-@@ -602,6 +611,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+@@ -603,6 +612,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
old = current_cred();
retval = -EPERM;
@@ -78188,7 +78096,7 @@ index f5939c2..3084a61 100644
if (nsown_capable(CAP_SETGID))
new->gid = new->egid = new->sgid = new->fsgid = gid;
else if (gid == old->gid || gid == old->sgid)
-@@ -619,7 +632,7 @@ error:
+@@ -620,7 +633,7 @@ error:
/*
* change the user struct in a credentials set to match the new UID
*/
@@ -78197,7 +78105,7 @@ index f5939c2..3084a61 100644
{
struct user_struct *new_user;
-@@ -689,6 +702,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
+@@ -690,6 +703,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
goto error;
}
@@ -78207,7 +78115,7 @@ index f5939c2..3084a61 100644
if (new->uid != old->uid) {
retval = set_user(new);
if (retval < 0)
-@@ -733,6 +749,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+@@ -734,6 +750,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
old = current_cred();
retval = -EPERM;
@@ -78220,7 +78128,7 @@ index f5939c2..3084a61 100644
if (nsown_capable(CAP_SETUID)) {
new->suid = new->uid = uid;
if (uid != old->uid) {
-@@ -787,6 +809,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+@@ -788,6 +810,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
goto error;
}
@@ -78230,7 +78138,7 @@ index f5939c2..3084a61 100644
if (ruid != (uid_t) -1) {
new->uid = ruid;
if (ruid != old->uid) {
-@@ -851,6 +876,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
+@@ -852,6 +877,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
goto error;
}
@@ -78240,7 +78148,7 @@ index f5939c2..3084a61 100644
if (rgid != (gid_t) -1)
new->gid = rgid;
if (egid != (gid_t) -1)
-@@ -901,12 +929,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+@@ -902,12 +930,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
uid == old->suid || uid == old->fsuid ||
nsown_capable(CAP_SETUID)) {
if (uid != old_fsuid) {
@@ -78257,7 +78165,7 @@ index f5939c2..3084a61 100644
abort_creds(new);
return old_fsuid;
-@@ -933,12 +965,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+@@ -934,12 +966,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
if (gid == old->gid || gid == old->egid ||
gid == old->sgid || gid == old->fsgid ||
nsown_capable(CAP_SETGID)) {
@@ -78274,7 +78182,7 @@ index f5939c2..3084a61 100644
abort_creds(new);
return old_fsgid;
-@@ -1246,19 +1282,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+@@ -1247,19 +1283,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
return -EFAULT;
down_read(&uts_sem);
@@ -78299,7 +78207,7 @@ index f5939c2..3084a61 100644
__OLD_UTS_LEN);
error |= __put_user(0, name->machine + __OLD_UTS_LEN);
up_read(&uts_sem);
-@@ -1723,7 +1759,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+@@ -1724,7 +1760,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
error = get_dumpable(me->mm);
break;
case PR_SET_DUMPABLE:
@@ -78984,18 +78892,10 @@ index 16fc34a..efd8bb8 100644
ret = -EIO;
bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 0943d2a..f1f2d73 100644
+index 5527211..04dce85 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
-@@ -572,7 +572,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
- free_page(tmp);
- }
-
-- free_page((unsigned long)stat->pages);
- stat->pages = NULL;
- stat->start = NULL;
-
-@@ -1587,12 +1586,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+@@ -1586,12 +1586,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
if (unlikely(ftrace_disabled))
return 0;
@@ -79015,7 +78915,7 @@ index 0943d2a..f1f2d73 100644
}
/*
-@@ -2608,7 +2612,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
+@@ -2607,7 +2612,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
int
register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
@@ -79024,7 +78924,7 @@ index 0943d2a..f1f2d73 100644
{
struct ftrace_func_probe *entry;
struct ftrace_page *pg;
-@@ -3986,8 +3990,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+@@ -3981,8 +3986,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
#ifdef CONFIG_FUNCTION_GRAPH_TRACER
static int ftrace_graph_active;
@@ -79033,7 +78933,7 @@ index 0943d2a..f1f2d73 100644
int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
{
return 0;
-@@ -4131,6 +4133,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+@@ -4126,6 +4129,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
return NOTIFY_DONE;
}
@@ -79044,7 +78944,7 @@ index 0943d2a..f1f2d73 100644
int register_ftrace_graph(trace_func_graph_ret_t retfunc,
trace_func_graph_ent_t entryfunc)
{
-@@ -4144,7 +4150,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+@@ -4139,7 +4146,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
goto out;
}
@@ -79889,33 +79789,10 @@ index bd2bea9..6b3c95e 100644
return false;
diff --git a/lib/kobject.c b/lib/kobject.c
-index 640bd98..a0de35f 100644
+index 83bd5b3..a0de35f 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
-@@ -531,6 +531,13 @@ struct kobject *kobject_get(struct kobject *kobj)
- return kobj;
- }
-
-+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
-+{
-+ if (!kref_get_unless_zero(&kobj->kref))
-+ kobj = NULL;
-+ return kobj;
-+}
-+
- /*
- * kobject_cleanup - free kobject resources.
- * @kobj: object to cleanup
-@@ -785,7 +792,7 @@ struct kobject *kset_find_obj_hinted(struct kset *kset, const char *name,
- slow_search:
- list_for_each_entry(k, &kset->list, entry) {
- if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
-- ret = kobject_get(k);
-+ ret = kobject_get_unless_zero(k);
- break;
- }
- }
-@@ -891,9 +898,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
+@@ -898,9 +898,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
static DEFINE_SPINLOCK(kobj_ns_type_lock);
@@ -80365,7 +80242,7 @@ index 470cbb4..8d01b5a 100644
/* if an huge pmd materialized from under us just retry later */
if (unlikely(pmd_trans_huge(*pmd)))
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 4c7d42a..6d2f988 100644
+index 70b4733..ab692a7 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -1973,15 +1973,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
@@ -83518,7 +83395,7 @@ index f0cd7ab..9b60530 100644
struct mm_struct *mm;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 50f0824..0ade43a 100644
+index ea3f83b..001a216 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -85914,7 +85791,7 @@ index 0ce2ad0..cb92a90 100644
};
diff --git a/net/can/gw.c b/net/can/gw.c
-index 3d79b12..d7aa843 100644
+index f78f898..d7aa843 100644
--- a/net/can/gw.c
+++ b/net/can/gw.c
@@ -67,7 +67,6 @@ MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
@@ -85925,33 +85802,6 @@ index 3d79b12..d7aa843 100644
static struct kmem_cache *cgw_cache __read_mostly;
-@@ -436,7 +435,7 @@ static int cgw_notifier(struct notifier_block *nb,
- if (gwj->src.dev == dev || gwj->dst.dev == dev) {
- hlist_del(&gwj->list);
- cgw_unregister_filter(gwj);
-- kfree(gwj);
-+ kmem_cache_free(cgw_cache, gwj);
- }
- }
- }
-@@ -850,7 +849,7 @@ static void cgw_remove_all_jobs(void)
- hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
- hlist_del(&gwj->list);
- cgw_unregister_filter(gwj);
-- kfree(gwj);
-+ kmem_cache_free(cgw_cache, gwj);
- }
- }
-
-@@ -903,7 +902,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
-
- hlist_del(&gwj->list);
- cgw_unregister_filter(gwj);
-- kfree(gwj);
-+ kmem_cache_free(cgw_cache, gwj);
- err = 0;
- break;
- }
@@ -911,6 +910,10 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
return err;
}
@@ -86482,7 +86332,7 @@ index ff52ad0..aff1c0f 100644
{
int new_fd;
diff --git a/net/core/sock.c b/net/core/sock.c
-index 1e8a882..5439005 100644
+index 2c73adf..d7698ef 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -289,7 +289,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -86548,7 +86398,7 @@ index 1e8a882..5439005 100644
goto out;
/* Bind this socket to a particular device like "eth0",
-@@ -772,12 +772,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -786,12 +786,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
struct timeval tm;
} v;
@@ -86564,7 +86414,7 @@ index 1e8a882..5439005 100644
return -EINVAL;
memset(&v, 0, sizeof(v));
-@@ -918,18 +918,18 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -932,18 +932,18 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
if (len > sizeof(peercred))
len = sizeof(peercred);
cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
@@ -86586,7 +86436,7 @@ index 1e8a882..5439005 100644
return -EINVAL;
if (copy_to_user(optval, address, len))
return -EFAULT;
-@@ -964,7 +964,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -978,7 +978,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
if (len > lv)
len = lv;
@@ -86595,7 +86445,7 @@ index 1e8a882..5439005 100644
return -EFAULT;
lenout:
if (put_user(len, optlen))
-@@ -2025,7 +2025,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2039,7 +2039,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
*/
smp_wmb();
atomic_set(&sk->sk_refcnt, 1);
@@ -86604,7 +86454,7 @@ index 1e8a882..5439005 100644
}
EXPORT_SYMBOL(sock_init_data);
-@@ -2562,7 +2562,7 @@ static __net_exit void proto_exit_net(struct net *net)
+@@ -2576,7 +2576,7 @@ static __net_exit void proto_exit_net(struct net *net)
}
@@ -103327,27 +103177,8 @@ index 547628e..74de9f2 100644
+#endif
+
#endif
-diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index 3eed61e..79647cd 100644
---- a/virt/kvm/ioapic.c
-+++ b/virt/kvm/ioapic.c
-@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
- u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
- u64 redir_content;
-
-- ASSERT(redir_index < IOAPIC_NUM_PINS);
-+ if (redir_index < IOAPIC_NUM_PINS)
-+ redir_content =
-+ ioapic->redirtbl[redir_index].bits;
-+ else
-+ redir_content = ~0ULL;
-
-- redir_content = ioapic->redirtbl[redir_index].bits;
- result = (ioapic->ioregsel & 0x1) ?
- (redir_content >> 32) & 0xffffffff :
- redir_content & 0xffffffff;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index ec747dc..38a8e47 100644
+index 8bf05f0..7324a1e 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -75,12 +75,17 @@ LIST_HEAD(vm_list);
@@ -103379,7 +103210,7 @@ index ec747dc..38a8e47 100644
(void __user *)(unsigned long)mem->userspace_addr,
mem->memory_size)))
goto out;
-@@ -1630,7 +1635,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
+@@ -1657,7 +1662,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
return 0;
}
@@ -103388,7 +103219,7 @@ index ec747dc..38a8e47 100644
.release = kvm_vcpu_release,
.unlocked_ioctl = kvm_vcpu_ioctl,
#ifdef CONFIG_COMPAT
-@@ -2150,7 +2155,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
+@@ -2177,7 +2182,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
return 0;
}
@@ -103397,7 +103228,7 @@ index ec747dc..38a8e47 100644
.release = kvm_vm_release,
.unlocked_ioctl = kvm_vm_ioctl,
#ifdef CONFIG_COMPAT
-@@ -2248,7 +2253,7 @@ out:
+@@ -2275,7 +2280,7 @@ out:
return r;
}
@@ -103406,7 +103237,7 @@ index ec747dc..38a8e47 100644
.unlocked_ioctl = kvm_dev_ioctl,
.compat_ioctl = kvm_dev_ioctl,
.llseek = noop_llseek,
-@@ -2274,7 +2279,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2301,7 +2306,7 @@ static void hardware_enable_nolock(void *junk)
if (r) {
cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -103415,7 +103246,7 @@ index ec747dc..38a8e47 100644
printk(KERN_INFO "kvm: enabling virtualization on "
"CPU%d failed\n", cpu);
}
-@@ -2328,10 +2333,10 @@ static int hardware_enable_all(void)
+@@ -2355,10 +2360,10 @@ static int hardware_enable_all(void)
kvm_usage_count++;
if (kvm_usage_count == 1) {
@@ -103428,7 +103259,7 @@ index ec747dc..38a8e47 100644
hardware_disable_all_nolock();
r = -EBUSY;
}
-@@ -2682,7 +2687,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2709,7 +2714,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
kvm_arch_vcpu_put(vcpu);
}
@@ -103437,7 +103268,7 @@ index ec747dc..38a8e47 100644
struct module *module)
{
int r;
-@@ -2745,7 +2750,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2772,7 +2777,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
if (!vcpu_align)
vcpu_align = __alignof__(struct kvm_vcpu);
kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -103446,7 +103277,7 @@ index ec747dc..38a8e47 100644
if (!kvm_vcpu_cache) {
r = -ENOMEM;
goto out_free_3;
-@@ -2755,9 +2760,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2782,9 +2787,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
if (r)
goto out_free;
@@ -103458,7 +103289,7 @@ index ec747dc..38a8e47 100644
r = misc_register(&kvm_dev);
if (r) {
-@@ -2767,9 +2774,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2794,9 +2801,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
register_syscore_ops(&kvm_syscore_ops);
diff --git a/3.2.43/4425_grsec_remove_EI_PAX.patch b/3.2.44/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.2.43/4425_grsec_remove_EI_PAX.patch
rename to 3.2.44/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.43/4430_grsec-remove-localversion-grsec.patch b/3.2.44/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.2.43/4430_grsec-remove-localversion-grsec.patch
rename to 3.2.44/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.43/4435_grsec-mute-warnings.patch b/3.2.44/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.2.43/4435_grsec-mute-warnings.patch
rename to 3.2.44/4435_grsec-mute-warnings.patch
diff --git a/3.2.43/4440_grsec-remove-protected-paths.patch b/3.2.44/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.2.43/4440_grsec-remove-protected-paths.patch
rename to 3.2.44/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.43/4450_grsec-kconfig-default-gids.patch b/3.2.44/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.2.43/4450_grsec-kconfig-default-gids.patch
rename to 3.2.44/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.43/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.44/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.2.43/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.2.44/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.43/4470_disable-compat_vdso.patch b/3.2.44/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.2.43/4470_disable-compat_vdso.patch
rename to 3.2.44/4470_disable-compat_vdso.patch
diff --git a/3.8.8/0000_README b/3.8.10/0000_README
similarity index 90%
rename from 3.8.8/0000_README
rename to 3.8.10/0000_README
index 94354d0..0fb80bd 100644
--- a/3.8.8/0000_README
+++ b/3.8.10/0000_README
@@ -2,15 +2,15 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1006_linux-3.8.7.patch
+Patch: 1008_linux-3.8.9.patch
From: http://www.kernel.org
-Desc: Linux 3.8.7
+Desc: Linux 3.8.9
-Patch: 1007_linux-3.8.8.patch
+Patch: 1009_linux-3.8.10.patch
From: http://www.kernel.org
-Desc: Linux 3.8.8
+Desc: Linux 3.8.10
-Patch: 4420_grsecurity-2.9.1-3.8.8-201304181923.patch
+Patch: 4420_grsecurity-2.9.1-3.8.10-201304262208.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.8.10/1008_linux-3.8.9.patch b/3.8.10/1008_linux-3.8.9.patch
new file mode 100644
index 0000000..6162889
--- /dev/null
+++ b/3.8.10/1008_linux-3.8.9.patch
@@ -0,0 +1,1649 @@
+diff --git a/Makefile b/Makefile
+index 7684f95..3ae4796 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 8
++SUBLEVEL = 9
+ EXTRAVERSION =
+ NAME = Displaced Humerus Anterior
+
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index f9e8657..23fa6a2 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -261,7 +261,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
+ struct pmu *leader_pmu = event->group_leader->pmu;
+
+- if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++ if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++ return 1;
++
++ if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ return 1;
+
+ return armpmu->get_event_idx(hw_events, event) >= 0;
+diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
+index 0edce4b..5e3ca7a 100644
+--- a/arch/arm/mach-imx/clk-imx35.c
++++ b/arch/arm/mach-imx/clk-imx35.c
+@@ -265,6 +265,8 @@ int __init mx35_clocks_init()
+ clk_prepare_enable(clk[gpio3_gate]);
+ clk_prepare_enable(clk[iim_gate]);
+ clk_prepare_enable(clk[emi_gate]);
++ clk_prepare_enable(clk[max_gate]);
++ clk_prepare_enable(clk[iomuxc_gate]);
+
+ /*
+ * SCC is needed to boot via mmc after a watchdog reset. The clock code
+diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
+index dd3d591..48bc3c0 100644
+--- a/arch/arm/mm/cache-feroceon-l2.c
++++ b/arch/arm/mm/cache-feroceon-l2.c
+@@ -343,6 +343,7 @@ void __init feroceon_l2_init(int __l2_wt_override)
+ outer_cache.inv_range = feroceon_l2_inv_range;
+ outer_cache.clean_range = feroceon_l2_clean_range;
+ outer_cache.flush_range = feroceon_l2_flush_range;
++ outer_cache.inv_all = l2_inv_all;
+
+ enable_l2();
+
+diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
+index 2c3b942..2556cf1 100644
+--- a/arch/arm/mm/proc-arm920.S
++++ b/arch/arm/mm/proc-arm920.S
+@@ -387,7 +387,7 @@ ENTRY(cpu_arm920_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl cpu_arm920_suspend_size
+ .equ cpu_arm920_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm920_do_suspend)
+ stmfd sp!, {r4 - r6, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ PID
+diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
+index f1803f7e..344c8a5 100644
+--- a/arch/arm/mm/proc-arm926.S
++++ b/arch/arm/mm/proc-arm926.S
+@@ -402,7 +402,7 @@ ENTRY(cpu_arm926_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl cpu_arm926_suspend_size
+ .equ cpu_arm926_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm926_do_suspend)
+ stmfd sp!, {r4 - r6, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ PID
+diff --git a/arch/arm/mm/proc-mohawk.S b/arch/arm/mm/proc-mohawk.S
+index 82f9cdc..0b60dd3 100644
+--- a/arch/arm/mm/proc-mohawk.S
++++ b/arch/arm/mm/proc-mohawk.S
+@@ -350,7 +350,7 @@ ENTRY(cpu_mohawk_set_pte_ext)
+
+ .globl cpu_mohawk_suspend_size
+ .equ cpu_mohawk_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_mohawk_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p14, 0, r4, c6, c0, 0 @ clock configuration, for turbo mode
+diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
+index 3aa0da1..d92dfd0 100644
+--- a/arch/arm/mm/proc-sa1100.S
++++ b/arch/arm/mm/proc-sa1100.S
+@@ -172,7 +172,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
+
+ .globl cpu_sa1100_suspend_size
+ .equ cpu_sa1100_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_sa1100_do_suspend)
+ stmfd sp!, {r4 - r6, lr}
+ mrc p15, 0, r4, c3, c0, 0 @ domain ID
+diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
+index 09c5233..d222215 100644
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -138,7 +138,7 @@ ENTRY(cpu_v6_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
+ .globl cpu_v6_suspend_size
+ .equ cpu_v6_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_v6_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ FCSE/PID
+diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
+index eb93d64..e8efd83 100644
+--- a/arch/arm/mm/proc-xsc3.S
++++ b/arch/arm/mm/proc-xsc3.S
+@@ -413,7 +413,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
+
+ .globl cpu_xsc3_suspend_size
+ .equ cpu_xsc3_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xsc3_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p14, 0, r4, c6, c0, 0 @ clock configuration, for turbo mode
+diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
+index 2551036..e766f88 100644
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -528,7 +528,7 @@ ENTRY(cpu_xscale_set_pte_ext)
+
+ .globl cpu_xscale_suspend_size
+ .equ cpu_xscale_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xscale_do_suspend)
+ stmfd sp!, {r4 - r9, lr}
+ mrc p14, 0, r4, c6, c0, 0 @ clock configuration, for turbo mode
+diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
+index dbaec94..21bff32 100644
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -31,7 +31,7 @@
+ #define PAGE_SHIFT 16
+ #endif
+ #define PAGE_SIZE (_AC(1,UL) << PAGE_SHIFT)
+-#define PAGE_MASK (~(PAGE_SIZE - 1))
++#define PAGE_MASK (~((1 << PAGE_SHIFT) - 1))
+
+ #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+ #define HPAGE_SHIFT (PAGE_SHIFT + PAGE_SHIFT - 3)
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index 3d990d3..e0822a3 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -634,7 +634,7 @@ resume_kernel:
+ /* Clear _TIF_EMULATE_STACK_STORE flag */
+ lis r11,_TIF_EMULATE_STACK_STORE@h
+ addi r5,r9,TI_FLAGS
+- ldarx r4,0,r5
++0: ldarx r4,0,r5
+ andc r4,r4,r11
+ stdcx. r4,0,r5
+ bne- 0b
+diff --git a/arch/powerpc/kvm/e500mc.c b/arch/powerpc/kvm/e500mc.c
+index 1f89d26..2f4baa0 100644
+--- a/arch/powerpc/kvm/e500mc.c
++++ b/arch/powerpc/kvm/e500mc.c
+@@ -108,6 +108,8 @@ void kvmppc_mmu_msr_notify(struct kvm_vcpu *vcpu, u32 old_msr)
+ {
+ }
+
++static DEFINE_PER_CPU(struct kvm_vcpu *, last_vcpu_on_cpu);
++
+ void kvmppc_core_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ {
+ struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
+@@ -136,8 +138,11 @@ void kvmppc_core_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ mtspr(SPRN_GDEAR, vcpu->arch.shared->dar);
+ mtspr(SPRN_GESR, vcpu->arch.shared->esr);
+
+- if (vcpu->arch.oldpir != mfspr(SPRN_PIR))
++ if (vcpu->arch.oldpir != mfspr(SPRN_PIR) ||
++ __get_cpu_var(last_vcpu_on_cpu) != vcpu) {
+ kvmppc_e500_tlbil_all(vcpu_e500);
++ __get_cpu_var(last_vcpu_on_cpu) = vcpu;
++ }
+
+ kvmppc_load_guest_fp(vcpu);
+ }
+diff --git a/arch/s390/include/asm/io.h b/arch/s390/include/asm/io.h
+index 27cb321..379d96e 100644
+--- a/arch/s390/include/asm/io.h
++++ b/arch/s390/include/asm/io.h
+@@ -50,10 +50,6 @@ void unxlate_dev_mem_ptr(unsigned long phys, void *addr);
+ #define ioremap_nocache(addr, size) ioremap(addr, size)
+ #define ioremap_wc ioremap_nocache
+
+-/* TODO: s390 cannot support io_remap_pfn_range... */
+-#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
+- remap_pfn_range(vma, vaddr, pfn, size, prot)
+-
+ static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
+ {
+ return (void __iomem *) offset;
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 098adbb..1532d7f 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -56,6 +56,10 @@ extern unsigned long zero_page_mask;
+ (((unsigned long)(vaddr)) &zero_page_mask))))
+ #define __HAVE_COLOR_ZERO_PAGE
+
++/* TODO: s390 cannot support io_remap_pfn_range... */
++#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
++ remap_pfn_range(vma, vaddr, pfn, size, prot)
++
+ #endif /* !__ASSEMBLY__ */
+
+ /*
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index dc87b65..85039f9 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -419,8 +419,8 @@ struct kvm_vcpu_arch {
+ gpa_t time;
+ struct pvclock_vcpu_time_info hv_clock;
+ unsigned int hw_tsc_khz;
+- unsigned int time_offset;
+- struct page *time_page;
++ struct gfn_to_hva_cache pv_time;
++ bool pv_time_enabled;
+ /* set guest stopped flag in pvclock flags field */
+ bool pvclock_set_guest_stopped_request;
+
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index 4914e94..70602f8 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -128,8 +128,14 @@ static struct event_constraint intel_gen_event_constraints[] __read_mostly =
+ };
+
+ static struct extra_reg intel_snb_extra_regs[] __read_mostly = {
+- INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0),
+- INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffffffffull, RSP_1),
++ INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
++ INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
++ EVENT_EXTRA_END
++};
++
++static struct extra_reg intel_snbep_extra_regs[] __read_mostly = {
++ INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
++ INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
+ EVENT_EXTRA_END
+ };
+
+@@ -2072,7 +2078,10 @@ __init int intel_pmu_init(void)
+ x86_pmu.event_constraints = intel_snb_event_constraints;
+ x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
+ x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
+- x86_pmu.extra_regs = intel_snb_extra_regs;
++ if (boot_cpu_data.x86_model == 45)
++ x86_pmu.extra_regs = intel_snbep_extra_regs;
++ else
++ x86_pmu.extra_regs = intel_snb_extra_regs;
+ /* all extra regs are per-cpu when HT is on */
+ x86_pmu.er_flags |= ERF_HAS_RSP_1;
+ x86_pmu.er_flags |= ERF_NO_HT_SHARING;
+@@ -2098,7 +2107,10 @@ __init int intel_pmu_init(void)
+ x86_pmu.event_constraints = intel_snb_event_constraints;
+ x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
+ x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
+- x86_pmu.extra_regs = intel_snb_extra_regs;
++ if (boot_cpu_data.x86_model == 62)
++ x86_pmu.extra_regs = intel_snbep_extra_regs;
++ else
++ x86_pmu.extra_regs = intel_snb_extra_regs;
+ /* all extra regs are per-cpu when HT is on */
+ x86_pmu.er_flags |= ERF_HAS_RSP_1;
+ x86_pmu.er_flags |= ERF_NO_HT_SHARING;
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 9392f52..a2f492c 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1781,7 +1781,7 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
+ if (!pv_eoi_enabled(vcpu))
+ return 0;
+ return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
+- addr);
++ addr, sizeof(u8));
+ }
+
+ void kvm_lapic_init(void)
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index c243b81..9a51121 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1408,10 +1408,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ unsigned long flags, this_tsc_khz;
+ struct kvm_vcpu_arch *vcpu = &v->arch;
+ struct kvm_arch *ka = &v->kvm->arch;
+- void *shared_kaddr;
+ s64 kernel_ns, max_kernel_ns;
+ u64 tsc_timestamp, host_tsc;
+- struct pvclock_vcpu_time_info *guest_hv_clock;
++ struct pvclock_vcpu_time_info guest_hv_clock;
+ u8 pvclock_flags;
+ bool use_master_clock;
+
+@@ -1465,7 +1464,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+
+ local_irq_restore(flags);
+
+- if (!vcpu->time_page)
++ if (!vcpu->pv_time_enabled)
+ return 0;
+
+ /*
+@@ -1527,12 +1526,12 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ */
+ vcpu->hv_clock.version += 2;
+
+- shared_kaddr = kmap_atomic(vcpu->time_page);
+-
+- guest_hv_clock = shared_kaddr + vcpu->time_offset;
++ if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
++ &guest_hv_clock, sizeof(guest_hv_clock))))
++ return 0;
+
+ /* retain PVCLOCK_GUEST_STOPPED if set in guest copy */
+- pvclock_flags = (guest_hv_clock->flags & PVCLOCK_GUEST_STOPPED);
++ pvclock_flags = (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
+
+ if (vcpu->pvclock_set_guest_stopped_request) {
+ pvclock_flags |= PVCLOCK_GUEST_STOPPED;
+@@ -1545,12 +1544,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+
+ vcpu->hv_clock.flags = pvclock_flags;
+
+- memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
+- sizeof(vcpu->hv_clock));
+-
+- kunmap_atomic(shared_kaddr);
+-
+- mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
++ kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
++ &vcpu->hv_clock,
++ sizeof(vcpu->hv_clock));
+ return 0;
+ }
+
+@@ -1829,7 +1825,8 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ return 0;
+ }
+
+- if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa))
++ if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
++ sizeof(u32)))
+ return 1;
+
+ vcpu->arch.apf.send_user_only = !(data & KVM_ASYNC_PF_SEND_ALWAYS);
+@@ -1839,10 +1836,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+
+ static void kvmclock_reset(struct kvm_vcpu *vcpu)
+ {
+- if (vcpu->arch.time_page) {
+- kvm_release_page_dirty(vcpu->arch.time_page);
+- vcpu->arch.time_page = NULL;
+- }
++ vcpu->arch.pv_time_enabled = false;
+ }
+
+ static void accumulate_steal_time(struct kvm_vcpu *vcpu)
+@@ -1948,6 +1942,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ break;
+ case MSR_KVM_SYSTEM_TIME_NEW:
+ case MSR_KVM_SYSTEM_TIME: {
++ u64 gpa_offset;
+ kvmclock_reset(vcpu);
+
+ vcpu->arch.time = data;
+@@ -1957,14 +1952,14 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ if (!(data & 1))
+ break;
+
+- /* ...but clean it before doing the actual write */
+- vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
+-
+- vcpu->arch.time_page =
+- gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
++ gpa_offset = data & ~(PAGE_MASK | 1);
+
+- if (is_error_page(vcpu->arch.time_page))
+- vcpu->arch.time_page = NULL;
++ if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
++ &vcpu->arch.pv_time, data & ~1ULL,
++ sizeof(struct pvclock_vcpu_time_info)))
++ vcpu->arch.pv_time_enabled = false;
++ else
++ vcpu->arch.pv_time_enabled = true;
+
+ break;
+ }
+@@ -1981,7 +1976,8 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ return 1;
+
+ if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
+- data & KVM_STEAL_VALID_BITS))
++ data & KVM_STEAL_VALID_BITS,
++ sizeof(struct kvm_steal_time)))
+ return 1;
+
+ vcpu->arch.st.msr_val = data;
+@@ -2967,7 +2963,7 @@ static int kvm_vcpu_ioctl_x86_set_xcrs(struct kvm_vcpu *vcpu,
+ */
+ static int kvm_set_guest_paused(struct kvm_vcpu *vcpu)
+ {
+- if (!vcpu->arch.time_page)
++ if (!vcpu->arch.pv_time_enabled)
+ return -EINVAL;
+ vcpu->arch.pvclock_set_guest_stopped_request = true;
+ kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
+@@ -6661,6 +6657,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ goto fail_free_wbinvd_dirty_mask;
+
+ vcpu->arch.ia32_tsc_adjust_msr = 0x0;
++ vcpu->arch.pv_time_enabled = false;
+ kvm_async_pf_hash_reset(vcpu);
+ kvm_pmu_init(vcpu);
+
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index ef5356c..0262210 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -161,6 +161,8 @@ static int hash_recvmsg(struct kiocb *unused, struct socket *sock,
+ else if (len < ds)
+ msg->msg_flags |= MSG_TRUNC;
+
++ msg->msg_namelen = 0;
++
+ lock_sock(sk);
+ if (ctx->more) {
+ ctx->more = 0;
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 6a6dfc0..a1c4f0a 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -432,6 +432,7 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
+ long copied = 0;
+
+ lock_sock(sk);
++ msg->msg_namelen = 0;
+ for (iov = msg->msg_iov, iovlen = msg->msg_iovlen; iovlen > 0;
+ iovlen--, iov++) {
+ unsigned long seglen = iov->iov_len;
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index fe6d4be..615d262 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -373,26 +373,14 @@ static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
+ struct hpet_dev *devp;
+ unsigned long addr;
+
+- if (((vma->vm_end - vma->vm_start) != PAGE_SIZE) || vma->vm_pgoff)
+- return -EINVAL;
+-
+ devp = file->private_data;
+ addr = devp->hd_hpets->hp_hpet_phys;
+
+ if (addr & (PAGE_SIZE - 1))
+ return -ENOSYS;
+
+- vma->vm_flags |= VM_IO;
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-
+- if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
+- PAGE_SIZE, vma->vm_page_prot)) {
+- printk(KERN_ERR "%s: io_remap_pfn_range failed\n",
+- __func__);
+- return -EAGAIN;
+- }
+-
+- return 0;
++ return vm_iomap_memory(vma, addr, PAGE_SIZE);
+ #else
+ return -ENOSYS;
+ #endif
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 75b1f89..fd86b37 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1001,6 +1001,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
+ const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
+ const unsigned long do_discard = (bio->bi_rw
+ & (REQ_DISCARD | REQ_SECURE));
++ const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
+ struct md_rdev *blocked_rdev;
+ struct blk_plug_cb *cb;
+ struct raid1_plug_cb *plug = NULL;
+@@ -1302,7 +1303,8 @@ read_again:
+ conf->mirrors[i].rdev->data_offset);
+ mbio->bi_bdev = conf->mirrors[i].rdev->bdev;
+ mbio->bi_end_io = raid1_end_write_request;
+- mbio->bi_rw = WRITE | do_flush_fua | do_sync | do_discard;
++ mbio->bi_rw =
++ WRITE | do_flush_fua | do_sync | do_discard | do_same;
+ mbio->bi_private = r1_bio;
+
+ atomic_inc(&r1_bio->remaining);
+@@ -2819,6 +2821,9 @@ static int run(struct mddev *mddev)
+ if (IS_ERR(conf))
+ return PTR_ERR(conf);
+
++ if (mddev->queue)
++ blk_queue_max_write_same_sectors(mddev->queue,
++ mddev->chunk_sectors);
+ rdev_for_each(rdev, mddev) {
+ if (!mddev->gendisk)
+ continue;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 8d925dc..b3898d4 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1106,6 +1106,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
+ const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
+ const unsigned long do_discard = (bio->bi_rw
+ & (REQ_DISCARD | REQ_SECURE));
++ const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
+ unsigned long flags;
+ struct md_rdev *blocked_rdev;
+ struct blk_plug_cb *cb;
+@@ -1461,7 +1462,8 @@ retry_write:
+ rdev));
+ mbio->bi_bdev = rdev->bdev;
+ mbio->bi_end_io = raid10_end_write_request;
+- mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
++ mbio->bi_rw =
++ WRITE | do_sync | do_fua | do_discard | do_same;
+ mbio->bi_private = r10_bio;
+
+ atomic_inc(&r10_bio->remaining);
+@@ -1503,7 +1505,8 @@ retry_write:
+ r10_bio, rdev));
+ mbio->bi_bdev = rdev->bdev;
+ mbio->bi_end_io = raid10_end_write_request;
+- mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
++ mbio->bi_rw =
++ WRITE | do_sync | do_fua | do_discard | do_same;
+ mbio->bi_private = r10_bio;
+
+ atomic_inc(&r10_bio->remaining);
+@@ -3570,6 +3573,8 @@ static int run(struct mddev *mddev)
+ if (mddev->queue) {
+ blk_queue_max_discard_sectors(mddev->queue,
+ mddev->chunk_sectors);
++ blk_queue_max_write_same_sectors(mddev->queue,
++ mddev->chunk_sectors);
+ blk_queue_io_min(mddev->queue, chunk_size);
+ if (conf->geo.raid_disks % conf->geo.near_copies)
+ blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 82c0616..6e3d6dc 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -1159,45 +1159,17 @@ static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
+ struct mtd_file_info *mfi = file->private_data;
+ struct mtd_info *mtd = mfi->mtd;
+ struct map_info *map = mtd->priv;
+- resource_size_t start, off;
+- unsigned long len, vma_len;
+
+ /* This is broken because it assumes the MTD device is map-based
+ and that mtd->priv is a valid struct map_info. It should be
+ replaced with something that uses the mtd_get_unmapped_area()
+ operation properly. */
+ if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
+- off = get_vm_offset(vma);
+- start = map->phys;
+- len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
+- start &= PAGE_MASK;
+- vma_len = get_vm_size(vma);
+-
+- /* Overflow in off+len? */
+- if (vma_len + off < off)
+- return -EINVAL;
+- /* Does it fit in the mapping? */
+- if (vma_len + off > len)
+- return -EINVAL;
+-
+- off += start;
+- /* Did that overflow? */
+- if (off < start)
+- return -EINVAL;
+- if (set_vm_offset(vma, off) < 0)
+- return -EINVAL;
+- vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
+-
+ #ifdef pgprot_noncached
+- if (file->f_flags & O_DSYNC || off >= __pa(high_memory))
++ if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory))
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ #endif
+- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+- vma->vm_end - vma->vm_start,
+- vma->vm_page_prot))
+- return -EAGAIN;
+-
+- return 0;
++ return vm_iomap_memory(vma, map->phys, map->size);
+ }
+ return -ENOSYS;
+ #else
+diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
+index 5eaf47b..42b6d69 100644
+--- a/drivers/net/can/mcp251x.c
++++ b/drivers/net/can/mcp251x.c
+@@ -922,6 +922,7 @@ static int mcp251x_open(struct net_device *net)
+ struct mcp251x_priv *priv = netdev_priv(net);
+ struct spi_device *spi = priv->spi;
+ struct mcp251x_platform_data *pdata = spi->dev.platform_data;
++ unsigned long flags;
+ int ret;
+
+ ret = open_candev(net);
+@@ -938,9 +939,14 @@ static int mcp251x_open(struct net_device *net)
+ priv->tx_skb = NULL;
+ priv->tx_len = 0;
+
++ flags = IRQF_ONESHOT;
++ if (pdata->irq_flags)
++ flags |= pdata->irq_flags;
++ else
++ flags |= IRQF_TRIGGER_FALLING;
++
+ ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
+- pdata->irq_flags ? pdata->irq_flags : IRQF_TRIGGER_FALLING,
+- DEVICE_NAME, priv);
++ flags, DEVICE_NAME, priv);
+ if (ret) {
+ dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
+ if (pdata->transceiver_enable)
+diff --git a/drivers/net/can/sja1000/sja1000_of_platform.c b/drivers/net/can/sja1000/sja1000_of_platform.c
+index 6433b81..8e0c4a0 100644
+--- a/drivers/net/can/sja1000/sja1000_of_platform.c
++++ b/drivers/net/can/sja1000/sja1000_of_platform.c
+@@ -96,8 +96,8 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
+ struct net_device *dev;
+ struct sja1000_priv *priv;
+ struct resource res;
+- const u32 *prop;
+- int err, irq, res_size, prop_size;
++ u32 prop;
++ int err, irq, res_size;
+ void __iomem *base;
+
+ err = of_address_to_resource(np, 0, &res);
+@@ -138,27 +138,27 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
+ priv->read_reg = sja1000_ofp_read_reg;
+ priv->write_reg = sja1000_ofp_write_reg;
+
+- prop = of_get_property(np, "nxp,external-clock-frequency", &prop_size);
+- if (prop && (prop_size == sizeof(u32)))
+- priv->can.clock.freq = *prop / 2;
++ err = of_property_read_u32(np, "nxp,external-clock-frequency", &prop);
++ if (!err)
++ priv->can.clock.freq = prop / 2;
+ else
+ priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */
+
+- prop = of_get_property(np, "nxp,tx-output-mode", &prop_size);
+- if (prop && (prop_size == sizeof(u32)))
+- priv->ocr |= *prop & OCR_MODE_MASK;
++ err = of_property_read_u32(np, "nxp,tx-output-mode", &prop);
++ if (!err)
++ priv->ocr |= prop & OCR_MODE_MASK;
+ else
+ priv->ocr |= OCR_MODE_NORMAL; /* default */
+
+- prop = of_get_property(np, "nxp,tx-output-config", &prop_size);
+- if (prop && (prop_size == sizeof(u32)))
+- priv->ocr |= (*prop << OCR_TX_SHIFT) & OCR_TX_MASK;
++ err = of_property_read_u32(np, "nxp,tx-output-config", &prop);
++ if (!err)
++ priv->ocr |= (prop << OCR_TX_SHIFT) & OCR_TX_MASK;
+ else
+ priv->ocr |= OCR_TX0_PULLDOWN; /* default */
+
+- prop = of_get_property(np, "nxp,clock-out-frequency", &prop_size);
+- if (prop && (prop_size == sizeof(u32)) && *prop) {
+- u32 divider = priv->can.clock.freq * 2 / *prop;
++ err = of_property_read_u32(np, "nxp,clock-out-frequency", &prop);
++ if (!err && prop) {
++ u32 divider = priv->can.clock.freq * 2 / prop;
+
+ if (divider > 1)
+ priv->cdr |= divider / 2 - 1;
+@@ -168,8 +168,7 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
+ priv->cdr |= CDR_CLK_OFF; /* default */
+ }
+
+- prop = of_get_property(np, "nxp,no-comparator-bypass", NULL);
+- if (!prop)
++ if (!of_property_read_bool(np, "nxp,no-comparator-bypass"))
+ priv->cdr |= CDR_CBP; /* default */
+
+ priv->irq_flags = IRQF_SHARED;
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 8a5253c..6917998 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -330,6 +330,7 @@ static DEFINE_PCI_DEVICE_TABLE(tg3_pci_tbl) = {
+ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5719)},
+ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5720)},
+ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57762)},
++ {PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57766)},
+ {PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9DXX)},
+ {PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9MXX)},
+ {PCI_DEVICE(PCI_VENDOR_ID_ALTIMA, PCI_DEVICE_ID_ALTIMA_AC1000)},
+@@ -9103,7 +9104,14 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
+ }
+
+ if (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_57765_AX) {
+- u32 grc_mode = tr32(GRC_MODE);
++ u32 grc_mode;
++
++ /* Fix transmit hangs */
++ val = tr32(TG3_CPMU_PADRNG_CTL);
++ val |= TG3_CPMU_PADRNG_CTL_RDIV2;
++ tw32(TG3_CPMU_PADRNG_CTL, val);
++
++ grc_mode = tr32(GRC_MODE);
+
+ /* Access the lower 1K of DL PCIE block registers. */
+ val = grc_mode & ~GRC_MODE_PCIE_PORT_MASK;
+@@ -9413,6 +9421,14 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
+ if (tg3_flag(tp, PCI_EXPRESS))
+ rdmac_mode |= RDMAC_MODE_FIFO_LONG_BURST;
+
++ if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57766) {
++ tp->dma_limit = 0;
++ if (tp->dev->mtu <= ETH_DATA_LEN) {
++ rdmac_mode |= RDMAC_MODE_JMB_2K_MMRR;
++ tp->dma_limit = TG3_TX_BD_DMA_MAX_2K;
++ }
++ }
++
+ if (tg3_flag(tp, HW_TSO_1) ||
+ tg3_flag(tp, HW_TSO_2) ||
+ tg3_flag(tp, HW_TSO_3))
+diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
+index d330e81..6f9b74c 100644
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -1159,6 +1159,8 @@
+ #define CPMU_MUTEX_GNT_DRIVER 0x00001000
+ #define TG3_CPMU_PHY_STRAP 0x00003664
+ #define TG3_CPMU_PHY_STRAP_IS_SERDES 0x00000020
++#define TG3_CPMU_PADRNG_CTL 0x00003668
++#define TG3_CPMU_PADRNG_CTL_RDIV2 0x00040000
+ /* 0x3664 --> 0x36b0 unused */
+
+ #define TG3_CPMU_EEE_MODE 0x000036b0
+diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+index 6e1915a..c00c13a 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+@@ -519,7 +519,7 @@ static const u32 ar9580_1p0_mac_core[][2] = {
+ {0x00008258, 0x00000000},
+ {0x0000825c, 0x40000000},
+ {0x00008260, 0x00080922},
+- {0x00008264, 0x9bc00010},
++ {0x00008264, 0x9d400010},
+ {0x00008268, 0xffffffff},
+ {0x0000826c, 0x0000ffff},
+ {0x00008270, 0x00000000},
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 05d5ba6..0663653 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -796,7 +796,7 @@ static int ath9k_init_firmware_version(struct ath9k_htc_priv *priv)
+ * required version.
+ */
+ if (priv->fw_version_major != MAJOR_VERSION_REQ ||
+- priv->fw_version_minor != MINOR_VERSION_REQ) {
++ priv->fw_version_minor < MINOR_VERSION_REQ) {
+ dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
+ MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
+ return -EINVAL;
+diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
+index e8486c1..b70f220 100644
+--- a/drivers/net/wireless/b43/phy_n.c
++++ b/drivers/net/wireless/b43/phy_n.c
+@@ -5165,7 +5165,8 @@ static void b43_nphy_pmu_spur_avoid(struct b43_wldev *dev, bool avoid)
+ #endif
+ #ifdef CONFIG_B43_SSB
+ case B43_BUS_SSB:
+- /* FIXME */
++ ssb_pmu_spuravoid_pllupdate(&dev->dev->sdev->bus->chipco,
++ avoid);
+ break;
+ #endif
+ }
+diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
+index a43415a..bc75528 100644
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -675,3 +675,32 @@ u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
+ return 0;
+ }
+ }
++
++void ssb_pmu_spuravoid_pllupdate(struct ssb_chipcommon *cc, int spuravoid)
++{
++ u32 pmu_ctl = 0;
++
++ switch (cc->dev->bus->chip_id) {
++ case 0x4322:
++ ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL0, 0x11100070);
++ ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL1, 0x1014140a);
++ ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL5, 0x88888854);
++ if (spuravoid == 1)
++ ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL2, 0x05201828);
++ else
++ ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL2, 0x05001828);
++ pmu_ctl = SSB_CHIPCO_PMU_CTL_PLL_UPD;
++ break;
++ case 43222:
++ /* TODO: BCM43222 requires updating PLLs too */
++ return;
++ default:
++ ssb_printk(KERN_ERR PFX
++ "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
++ cc->dev->bus->chip_id);
++ return;
++ }
++
++ chipco_set32(cc, SSB_CHIPCO_PMU_CTL, pmu_ctl);
++}
++EXPORT_SYMBOL_GPL(ssb_pmu_spuravoid_pllupdate);
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index dc61c12..0a49456 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1373,15 +1373,12 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
+ {
+ struct fb_info *info = file_fb_info(file);
+ struct fb_ops *fb;
+- unsigned long off;
++ unsigned long mmio_pgoff;
+ unsigned long start;
+ u32 len;
+
+ if (!info)
+ return -ENODEV;
+- if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+- return -EINVAL;
+- off = vma->vm_pgoff << PAGE_SHIFT;
+ fb = info->fbops;
+ if (!fb)
+ return -ENODEV;
+@@ -1393,32 +1390,24 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
+ return res;
+ }
+
+- /* frame buffer memory */
++ /*
++ * Ugh. This can be either the frame buffer mapping, or
++ * if pgoff points past it, the mmio mapping.
++ */
+ start = info->fix.smem_start;
+- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);
+- if (off >= len) {
+- /* memory mapped io */
+- off -= len;
+- if (info->var.accel_flags) {
+- mutex_unlock(&info->mm_lock);
+- return -EINVAL;
+- }
++ len = info->fix.smem_len;
++ mmio_pgoff = PAGE_ALIGN((start & ~PAGE_MASK) + len) >> PAGE_SHIFT;
++ if (vma->vm_pgoff >= mmio_pgoff) {
++ vma->vm_pgoff -= mmio_pgoff;
+ start = info->fix.mmio_start;
+- len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
++ len = info->fix.mmio_len;
+ }
+ mutex_unlock(&info->mm_lock);
+- start &= PAGE_MASK;
+- if ((vma->vm_end - vma->vm_start + off) > len)
+- return -EINVAL;
+- off += start;
+- vma->vm_pgoff = off >> PAGE_SHIFT;
+- /* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by io_remap_pfn_range()*/
++
+ vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+- fb_pgprotect(file, vma, off);
+- if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+- vma->vm_end - vma->vm_start, vma->vm_page_prot))
+- return -EAGAIN;
+- return 0;
++ fb_pgprotect(file, vma, start);
++
++ return vm_iomap_memory(vma, start, len);
+ }
+
+ static int
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 0c42cdb..5843a47 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1132,6 +1132,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+ goto whole;
+ if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
+ goto whole;
++ return 0;
+ }
+
+ /* Do not dump I/O mapped devices or special mappings */
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 744a69b..8a00e2f 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -318,6 +318,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ unsigned long src_ptr;
+ unsigned long dst_ptr;
+ int overwrite_root = 0;
++ bool inode_item = key->type == BTRFS_INODE_ITEM_KEY;
+
+ if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
+ overwrite_root = 1;
+@@ -327,6 +328,9 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+
+ /* look for the key in the destination tree */
+ ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
++ if (ret < 0)
++ return ret;
++
+ if (ret == 0) {
+ char *src_copy;
+ char *dst_copy;
+@@ -368,6 +372,30 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ return 0;
+ }
+
++ /*
++ * We need to load the old nbytes into the inode so when we
++ * replay the extents we've logged we get the right nbytes.
++ */
++ if (inode_item) {
++ struct btrfs_inode_item *item;
++ u64 nbytes;
++
++ item = btrfs_item_ptr(path->nodes[0], path->slots[0],
++ struct btrfs_inode_item);
++ nbytes = btrfs_inode_nbytes(path->nodes[0], item);
++ item = btrfs_item_ptr(eb, slot,
++ struct btrfs_inode_item);
++ btrfs_set_inode_nbytes(eb, item, nbytes);
++ }
++ } else if (inode_item) {
++ struct btrfs_inode_item *item;
++
++ /*
++ * New inode, set nbytes to 0 so that the nbytes comes out
++ * properly when we replay the extents.
++ */
++ item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
++ btrfs_set_inode_nbytes(eb, item, 0);
+ }
+ insert:
+ btrfs_release_path(path);
+@@ -488,7 +516,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ u64 mask = root->sectorsize - 1;
+ u64 extent_end;
+ u64 start = key->offset;
+- u64 saved_nbytes;
++ u64 nbytes = 0;
+ struct btrfs_file_extent_item *item;
+ struct inode *inode = NULL;
+ unsigned long size;
+@@ -498,10 +526,19 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ found_type = btrfs_file_extent_type(eb, item);
+
+ if (found_type == BTRFS_FILE_EXTENT_REG ||
+- found_type == BTRFS_FILE_EXTENT_PREALLOC)
+- extent_end = start + btrfs_file_extent_num_bytes(eb, item);
+- else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
++ found_type == BTRFS_FILE_EXTENT_PREALLOC) {
++ nbytes = btrfs_file_extent_num_bytes(eb, item);
++ extent_end = start + nbytes;
++
++ /*
++ * We don't add to the inodes nbytes if we are prealloc or a
++ * hole.
++ */
++ if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
++ nbytes = 0;
++ } else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
+ size = btrfs_file_extent_inline_len(eb, item);
++ nbytes = btrfs_file_extent_ram_bytes(eb, item);
+ extent_end = (start + size + mask) & ~mask;
+ } else {
+ ret = 0;
+@@ -550,7 +587,6 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ }
+ btrfs_release_path(path);
+
+- saved_nbytes = inode_get_bytes(inode);
+ /* drop any overlapping extents */
+ ret = btrfs_drop_extents(trans, root, inode, start, extent_end, 1);
+ BUG_ON(ret);
+@@ -637,7 +673,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ BUG_ON(ret);
+ }
+
+- inode_set_bytes(inode, saved_nbytes);
++ inode_add_bytes(inode, nbytes);
+ ret = btrfs_update_inode(trans, root, inode);
+ out:
+ if (inode)
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index eba76ea..fc8ddc1 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -533,7 +533,7 @@ void hfsplus_file_truncate(struct inode *inode)
+ struct address_space *mapping = inode->i_mapping;
+ struct page *page;
+ void *fsdata;
+- u32 size = inode->i_size;
++ loff_t size = inode->i_size;
+
+ res = pagecache_write_begin(NULL, mapping, size, 0,
+ AOP_FLAG_UNINTERRUPTIBLE,
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 78bde32..ccee8cc 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -110,7 +110,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ * way when do_mmap_pgoff unwinds (may be important on powerpc
+ * and ia64).
+ */
+- vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND | VM_DONTDUMP;
++ vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
+ vma->vm_ops = &hugetlb_vm_ops;
+
+ if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index 6a91e6f..be3c22f 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -143,6 +143,7 @@ static const char * const task_state_array[] = {
+ "x (dead)", /* 64 */
+ "K (wakekill)", /* 128 */
+ "W (waking)", /* 256 */
++ "P (parked)", /* 512 */
+ };
+
+ static inline const char *get_task_state(struct task_struct *tsk)
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 2c497ab..ffdf8b7 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -511,7 +511,7 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ void *data, unsigned long len);
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+- gpa_t gpa);
++ gpa_t gpa, unsigned long len);
+ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
+ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
+ struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn);
+diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
+index fa7cc72..b0bcce0 100644
+--- a/include/linux/kvm_types.h
++++ b/include/linux/kvm_types.h
+@@ -71,6 +71,7 @@ struct gfn_to_hva_cache {
+ u64 generation;
+ gpa_t gpa;
+ unsigned long hva;
++ unsigned long len;
+ struct kvm_memory_slot *memslot;
+ };
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 66e2f7c..9568b90 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1623,6 +1623,8 @@ int vm_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
+ unsigned long pfn);
+ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+ unsigned long pfn);
++int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len);
++
+
+ struct page *follow_page(struct vm_area_struct *, unsigned long address,
+ unsigned int foll_flags);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index d211247..7e49270 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -163,9 +163,10 @@ print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ #define TASK_DEAD 64
+ #define TASK_WAKEKILL 128
+ #define TASK_WAKING 256
+-#define TASK_STATE_MAX 512
++#define TASK_PARKED 512
++#define TASK_STATE_MAX 1024
+
+-#define TASK_STATE_TO_CHAR_STR "RSDTtZXxKW"
++#define TASK_STATE_TO_CHAR_STR "RSDTtZXxKWP"
+
+ extern char ___assert_task_state[1 - 2*!!(
+ sizeof(TASK_STATE_TO_CHAR_STR)-1 != ilog2(TASK_STATE_MAX)+1)];
+diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
+index 9e492be..6fcfe99 100644
+--- a/include/linux/ssb/ssb_driver_chipcommon.h
++++ b/include/linux/ssb/ssb_driver_chipcommon.h
+@@ -219,6 +219,7 @@
+ #define SSB_CHIPCO_PMU_CTL 0x0600 /* PMU control */
+ #define SSB_CHIPCO_PMU_CTL_ILP_DIV 0xFFFF0000 /* ILP div mask */
+ #define SSB_CHIPCO_PMU_CTL_ILP_DIV_SHIFT 16
++#define SSB_CHIPCO_PMU_CTL_PLL_UPD 0x00000400
+ #define SSB_CHIPCO_PMU_CTL_NOILPONW 0x00000200 /* No ILP on wait */
+ #define SSB_CHIPCO_PMU_CTL_HTREQEN 0x00000100 /* HT req enable */
+ #define SSB_CHIPCO_PMU_CTL_ALPREQEN 0x00000080 /* ALP req enable */
+@@ -667,5 +668,6 @@ enum ssb_pmu_ldo_volt_id {
+ void ssb_pmu_set_ldo_voltage(struct ssb_chipcommon *cc,
+ enum ssb_pmu_ldo_volt_id id, u32 voltage);
+ void ssb_pmu_set_ldo_paref(struct ssb_chipcommon *cc, bool on);
++void ssb_pmu_spuravoid_pllupdate(struct ssb_chipcommon *cc, int spuravoid);
+
+ #endif /* LINUX_SSB_CHIPCO_H_ */
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 5a8671e..e5586ca 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -147,7 +147,7 @@ TRACE_EVENT(sched_switch,
+ __print_flags(__entry->prev_state & (TASK_STATE_MAX-1), "|",
+ { 1, "S"} , { 2, "D" }, { 4, "T" }, { 8, "t" },
+ { 16, "Z" }, { 32, "X" }, { 64, "x" },
+- { 128, "W" }) : "R",
++ { 128, "K" }, { 256, "W" }, { 512, "P" }) : "R",
+ __entry->prev_state & TASK_STATE_MAX ? "+" : "",
+ __entry->next_comm, __entry->next_pid, __entry->next_prio)
+ );
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 7b6646a..0600d3b 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5328,7 +5328,7 @@ static void sw_perf_event_destroy(struct perf_event *event)
+
+ static int perf_swevent_init(struct perf_event *event)
+ {
+- int event_id = event->attr.config;
++ u64 event_id = event->attr.config;
+
+ if (event->attr.type != PERF_TYPE_SOFTWARE)
+ return -ENOENT;
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index cdd5607..e4cee8d 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -61,6 +61,7 @@
+ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
+ {
+
++ .lock = __RAW_SPIN_LOCK_UNLOCKED(hrtimer_bases.lock),
+ .clock_base =
+ {
+ {
+@@ -1640,8 +1641,6 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
+ struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
+ int i;
+
+- raw_spin_lock_init(&cpu_base->lock);
+-
+ for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
+ cpu_base->clock_base[i].cpu_base = cpu_base;
+ timerqueue_init_head(&cpu_base->clock_base[i].active);
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 691dc2e..9eb7fed 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -124,12 +124,12 @@ void *kthread_data(struct task_struct *task)
+
+ static void __kthread_parkme(struct kthread *self)
+ {
+- __set_current_state(TASK_INTERRUPTIBLE);
++ __set_current_state(TASK_PARKED);
+ while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
+ if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
+ complete(&self->parked);
+ schedule();
+- __set_current_state(TASK_INTERRUPTIBLE);
++ __set_current_state(TASK_PARKED);
+ }
+ clear_bit(KTHREAD_IS_PARKED, &self->flags);
+ __set_current_state(TASK_RUNNING);
+@@ -256,8 +256,13 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
+ }
+ EXPORT_SYMBOL(kthread_create_on_node);
+
+-static void __kthread_bind(struct task_struct *p, unsigned int cpu)
++static void __kthread_bind(struct task_struct *p, unsigned int cpu, long state)
+ {
++ /* Must have done schedule() in kthread() before we set_task_cpu */
++ if (!wait_task_inactive(p, state)) {
++ WARN_ON(1);
++ return;
++ }
+ /* It's safe because the task is inactive. */
+ do_set_cpus_allowed(p, cpumask_of(cpu));
+ p->flags |= PF_THREAD_BOUND;
+@@ -274,12 +279,7 @@ static void __kthread_bind(struct task_struct *p, unsigned int cpu)
+ */
+ void kthread_bind(struct task_struct *p, unsigned int cpu)
+ {
+- /* Must have done schedule() in kthread() before we set_task_cpu */
+- if (!wait_task_inactive(p, TASK_UNINTERRUPTIBLE)) {
+- WARN_ON(1);
+- return;
+- }
+- __kthread_bind(p, cpu);
++ __kthread_bind(p, cpu, TASK_UNINTERRUPTIBLE);
+ }
+ EXPORT_SYMBOL(kthread_bind);
+
+@@ -324,6 +324,22 @@ static struct kthread *task_get_live_kthread(struct task_struct *k)
+ return NULL;
+ }
+
++static void __kthread_unpark(struct task_struct *k, struct kthread *kthread)
++{
++ clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
++ /*
++ * We clear the IS_PARKED bit here as we don't wait
++ * until the task has left the park code. So if we'd
++ * park before that happens we'd see the IS_PARKED bit
++ * which might be about to be cleared.
++ */
++ if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
++ if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
++ __kthread_bind(k, kthread->cpu, TASK_PARKED);
++ wake_up_state(k, TASK_PARKED);
++ }
++}
++
+ /**
+ * kthread_unpark - unpark a thread created by kthread_create().
+ * @k: thread created by kthread_create().
+@@ -336,20 +352,8 @@ void kthread_unpark(struct task_struct *k)
+ {
+ struct kthread *kthread = task_get_live_kthread(k);
+
+- if (kthread) {
+- clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+- /*
+- * We clear the IS_PARKED bit here as we don't wait
+- * until the task has left the park code. So if we'd
+- * park before that happens we'd see the IS_PARKED bit
+- * which might be about to be cleared.
+- */
+- if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
+- if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
+- __kthread_bind(k, kthread->cpu);
+- wake_up_process(k);
+- }
+- }
++ if (kthread)
++ __kthread_unpark(k, kthread);
+ put_task_struct(k);
+ }
+
+@@ -407,7 +411,7 @@ int kthread_stop(struct task_struct *k)
+ trace_sched_kthread_stop(k);
+ if (kthread) {
+ set_bit(KTHREAD_SHOULD_STOP, &kthread->flags);
+- clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
++ __kthread_unpark(k, kthread);
+ wake_up_process(k);
+ wait_for_completion(&kthread->exited);
+ }
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 26058d0..5e2f7c3 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1488,8 +1488,10 @@ static void try_to_wake_up_local(struct task_struct *p)
+ {
+ struct rq *rq = task_rq(p);
+
+- BUG_ON(rq != this_rq());
+- BUG_ON(p == current);
++ if (WARN_ON_ONCE(rq != this_rq()) ||
++ WARN_ON_ONCE(p == current))
++ return;
++
+ lockdep_assert_held(&rq->lock);
+
+ if (!raw_spin_trylock(&p->pi_lock)) {
+@@ -4948,7 +4950,7 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+ }
+
+ static int min_load_idx = 0;
+-static int max_load_idx = CPU_LOAD_IDX_MAX;
++static int max_load_idx = CPU_LOAD_IDX_MAX-1;
+
+ static void
+ set_table_entry(struct ctl_table *entry,
+diff --git a/kernel/signal.c b/kernel/signal.c
+index dec9c30..50e425c 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2880,7 +2880,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+
+ static int do_tkill(pid_t tgid, pid_t pid, int sig)
+ {
+- struct siginfo info;
++ struct siginfo info = {};
+
+ info.si_signo = sig;
+ info.si_errno = 0;
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index f45e128..f359dc7 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -25,7 +25,8 @@
+
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+
+-static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
++static bool new_idmap_permitted(const struct file *file,
++ struct user_namespace *ns, int cap_setid,
+ struct uid_gid_map *map);
+
+ static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
+@@ -575,10 +576,10 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ if (map->nr_extents != 0)
+ goto out;
+
+- /* Require the appropriate privilege CAP_SETUID or CAP_SETGID
+- * over the user namespace in order to set the id mapping.
++ /*
++ * Adjusting namespace settings requires capabilities on the target.
+ */
+- if (cap_valid(cap_setid) && !ns_capable(ns, cap_setid))
++ if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
+ goto out;
+
+ /* Get a buffer */
+@@ -666,7 +667,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+
+ ret = -EPERM;
+ /* Validate the user is allowed to use user id's mapped to. */
+- if (!new_idmap_permitted(ns, cap_setid, &new_map))
++ if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
+ goto out;
+
+ /* Map the lower ids from the parent user namespace to the
+@@ -753,7 +754,8 @@ ssize_t proc_projid_map_write(struct file *file, const char __user *buf, size_t
+ &ns->projid_map, &ns->parent->projid_map);
+ }
+
+-static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
++static bool new_idmap_permitted(const struct file *file,
++ struct user_namespace *ns, int cap_setid,
+ struct uid_gid_map *new_map)
+ {
+ /* Allow mapping to your own filesystem ids */
+@@ -761,12 +763,12 @@ static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
+ u32 id = new_map->extent[0].lower_first;
+ if (cap_setid == CAP_SETUID) {
+ kuid_t uid = make_kuid(ns->parent, id);
+- if (uid_eq(uid, current_fsuid()))
++ if (uid_eq(uid, file->f_cred->fsuid))
+ return true;
+ }
+ else if (cap_setid == CAP_SETGID) {
+ kgid_t gid = make_kgid(ns->parent, id);
+- if (gid_eq(gid, current_fsgid()))
++ if (gid_eq(gid, file->f_cred->fsgid))
+ return true;
+ }
+ }
+@@ -777,8 +779,10 @@ static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
+
+ /* Allow the specified ids if we have the appropriate capability
+ * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
++ * And the opener of the id file also had the approprpiate capability.
+ */
+- if (ns_capable(ns->parent, cap_setid))
++ if (ns_capable(ns->parent, cap_setid) &&
++ file_ns_capable(file, ns->parent, cap_setid))
+ return true;
+
+ return false;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d7cec92..88eb939 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2965,7 +2965,17 @@ int follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ break;
+ }
+
+- if (absent ||
++ /*
++ * We need call hugetlb_fault for both hugepages under migration
++ * (in which case hugetlb_fault waits for the migration,) and
++ * hwpoisoned hugepages (in which case we need to prevent the
++ * caller from accessing to them.) In order to do this, we use
++ * here is_swap_pte instead of is_hugetlb_entry_migration and
++ * is_hugetlb_entry_hwpoisoned. This is because it simply covers
++ * both cases, and because we can't follow correct pages
++ * directly from any kind of swap entries.
++ */
++ if (absent || is_swap_pte(huge_ptep_get(pte)) ||
+ ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) {
+ int ret;
+
+diff --git a/mm/memory.c b/mm/memory.c
+index f8b734a..32a495a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2358,6 +2358,53 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
+ }
+ EXPORT_SYMBOL(remap_pfn_range);
+
++/**
++ * vm_iomap_memory - remap memory to userspace
++ * @vma: user vma to map to
++ * @start: start of area
++ * @len: size of area
++ *
++ * This is a simplified io_remap_pfn_range() for common driver use. The
++ * driver just needs to give us the physical memory range to be mapped,
++ * we'll figure out the rest from the vma information.
++ *
++ * NOTE! Some drivers might want to tweak vma->vm_page_prot first to get
++ * whatever write-combining details or similar.
++ */
++int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
++{
++ unsigned long vm_len, pfn, pages;
++
++ /* Check that the physical memory area passed in looks valid */
++ if (start + len < start)
++ return -EINVAL;
++ /*
++ * You *really* shouldn't map things that aren't page-aligned,
++ * but we've historically allowed it because IO memory might
++ * just have smaller alignment.
++ */
++ len += start & ~PAGE_MASK;
++ pfn = start >> PAGE_SHIFT;
++ pages = (len + ~PAGE_MASK) >> PAGE_SHIFT;
++ if (pfn + pages < pfn)
++ return -EINVAL;
++
++ /* We start the mapping 'vm_pgoff' pages into the area */
++ if (vma->vm_pgoff > pages)
++ return -EINVAL;
++ pfn += vma->vm_pgoff;
++ pages -= vma->vm_pgoff;
++
++ /* Can we fit all of the mapping? */
++ vm_len = vma->vm_end - vma->vm_start;
++ if (vm_len >> PAGE_SHIFT > pages)
++ return -EINVAL;
++
++ /* Ok, let it rip */
++ return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
++}
++EXPORT_SYMBOL(vm_iomap_memory);
++
+ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ unsigned long addr, unsigned long end,
+ pte_fn_t fn, void *data)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index e14e676..a1a7997 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3723,8 +3723,16 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+ /* prep auth_data so we don't go into idle on disassoc */
+ ifmgd->auth_data = auth_data;
+
+- if (ifmgd->associated)
+- ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
++ if (ifmgd->associated) {
++ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++
++ ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
++ WLAN_REASON_UNSPECIFIED,
++ false, frame_buf);
++
++ __cfg80211_send_deauth(sdata->dev, frame_buf,
++ sizeof(frame_buf));
++ }
+
+ sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
+
+@@ -3783,8 +3791,16 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+
+ mutex_lock(&ifmgd->mtx);
+
+- if (ifmgd->associated)
+- ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
++ if (ifmgd->associated) {
++ u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++
++ ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
++ WLAN_REASON_UNSPECIFIED,
++ false, frame_buf);
++
++ __cfg80211_send_deauth(sdata->dev, frame_buf,
++ sizeof(frame_buf));
++ }
+
+ if (ifmgd->auth_data && !ifmgd->auth_data->done) {
+ err = -EBUSY;
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 09b4286..f4aaf5a 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3222,18 +3222,10 @@ EXPORT_SYMBOL_GPL(snd_pcm_lib_default_mmap);
+ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream,
+ struct vm_area_struct *area)
+ {
+- long size;
+- unsigned long offset;
++ struct snd_pcm_runtime *runtime = substream->runtime;;
+
+ area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
+- area->vm_flags |= VM_IO;
+- size = area->vm_end - area->vm_start;
+- offset = area->vm_pgoff << PAGE_SHIFT;
+- if (io_remap_pfn_range(area, area->vm_start,
+- (substream->runtime->dma_addr + offset) >> PAGE_SHIFT,
+- size, area->vm_page_prot))
+- return -EAGAIN;
+- return 0;
++ return vm_iomap_memory(area, runtime->dma_addr, runtime->dma_bytes);
+ }
+
+ EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem);
+diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
+index cfb7e4d..52058f0 100644
+--- a/virt/kvm/ioapic.c
++++ b/virt/kvm/ioapic.c
+@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
+ u64 redir_content;
+
+- ASSERT(redir_index < IOAPIC_NUM_PINS);
++ if (redir_index < IOAPIC_NUM_PINS)
++ redir_content =
++ ioapic->redirtbl[redir_index].bits;
++ else
++ redir_content = ~0ULL;
+
+- redir_content = ioapic->redirtbl[redir_index].bits;
+ result = (ioapic->ioregsel & 0x1) ?
+ (redir_content >> 32) & 0xffffffff :
+ redir_content & 0xffffffff;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 1cd693a..10afa34 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1476,21 +1476,38 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ }
+
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+- gpa_t gpa)
++ gpa_t gpa, unsigned long len)
+ {
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int offset = offset_in_page(gpa);
+- gfn_t gfn = gpa >> PAGE_SHIFT;
++ gfn_t start_gfn = gpa >> PAGE_SHIFT;
++ gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
++ gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
++ gfn_t nr_pages_avail;
+
+ ghc->gpa = gpa;
+ ghc->generation = slots->generation;
+- ghc->memslot = gfn_to_memslot(kvm, gfn);
+- ghc->hva = gfn_to_hva_many(ghc->memslot, gfn, NULL);
+- if (!kvm_is_error_hva(ghc->hva))
++ ghc->len = len;
++ ghc->memslot = gfn_to_memslot(kvm, start_gfn);
++ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
++ if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
+ ghc->hva += offset;
+- else
+- return -EFAULT;
+-
++ } else {
++ /*
++ * If the requested region crosses two memslots, we still
++ * verify that the entire region is valid here.
++ */
++ while (start_gfn <= end_gfn) {
++ ghc->memslot = gfn_to_memslot(kvm, start_gfn);
++ ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
++ &nr_pages_avail);
++ if (kvm_is_error_hva(ghc->hva))
++ return -EFAULT;
++ start_gfn += nr_pages_avail;
++ }
++ /* Use the slow path for cross page reads and writes. */
++ ghc->memslot = NULL;
++ }
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
+@@ -1501,8 +1518,13 @@ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int r;
+
++ BUG_ON(len > ghc->len);
++
+ if (slots->generation != ghc->generation)
+- kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++ kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++ if (unlikely(!ghc->memslot))
++ return kvm_write_guest(kvm, ghc->gpa, data, len);
+
+ if (kvm_is_error_hva(ghc->hva))
+ return -EFAULT;
+@@ -1522,8 +1544,13 @@ int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ struct kvm_memslots *slots = kvm_memslots(kvm);
+ int r;
+
++ BUG_ON(len > ghc->len);
++
+ if (slots->generation != ghc->generation)
+- kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++ kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++ if (unlikely(!ghc->memslot))
++ return kvm_read_guest(kvm, ghc->gpa, data, len);
+
+ if (kvm_is_error_hva(ghc->hva))
+ return -EFAULT;
diff --git a/3.8.10/1009_linux-3.8.10.patch b/3.8.10/1009_linux-3.8.10.patch
new file mode 100644
index 0000000..330becd
--- /dev/null
+++ b/3.8.10/1009_linux-3.8.10.patch
@@ -0,0 +1,67 @@
+diff --git a/Makefile b/Makefile
+index 3ae4796..e2b10b9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Displaced Humerus Anterior
+
+diff --git a/include/linux/capability.h b/include/linux/capability.h
+index 98503b7..d9a4f7f4 100644
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -35,6 +35,7 @@ struct cpu_vfs_cap_data {
+ #define _KERNEL_CAP_T_SIZE (sizeof(kernel_cap_t))
+
+
++struct file;
+ struct inode;
+ struct dentry;
+ struct user_namespace;
+@@ -211,6 +212,7 @@ extern bool capable(int cap);
+ extern bool ns_capable(struct user_namespace *ns, int cap);
+ extern bool nsown_capable(int cap);
+ extern bool inode_capable(const struct inode *inode, int cap);
++extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
+
+ /* audit system wants to get cap info from files as well */
+ extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 493d972..f6c2ce5 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -393,6 +393,30 @@ bool ns_capable(struct user_namespace *ns, int cap)
+ EXPORT_SYMBOL(ns_capable);
+
+ /**
++ * file_ns_capable - Determine if the file's opener had a capability in effect
++ * @file: The file we want to check
++ * @ns: The usernamespace we want the capability in
++ * @cap: The capability to be tested for
++ *
++ * Return true if task that opened the file had a capability in effect
++ * when the file was opened.
++ *
++ * This does not set PF_SUPERPRIV because the caller may not
++ * actually be privileged.
++ */
++bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)
++{
++ if (WARN_ON_ONCE(!cap_valid(cap)))
++ return false;
++
++ if (security_capable(file->f_cred, ns, cap) == 0)
++ return true;
++
++ return false;
++}
++EXPORT_SYMBOL(file_ns_capable);
++
++/**
+ * capable - Determine if the current task has a superior capability in effect
+ * @cap: The capability to be tested for
+ *
diff --git a/3.8.8/4420_grsecurity-2.9.1-3.8.8-201304181923.patch b/3.8.10/4420_grsecurity-2.9.1-3.8.10-201304262208.patch
similarity index 99%
rename from 3.8.8/4420_grsecurity-2.9.1-3.8.8-201304181923.patch
rename to 3.8.10/4420_grsecurity-2.9.1-3.8.10-201304262208.patch
index 18ab857..d87332f 100644
--- a/3.8.8/4420_grsecurity-2.9.1-3.8.8-201304181923.patch
+++ b/3.8.10/4420_grsecurity-2.9.1-3.8.10-201304262208.patch
@@ -259,7 +259,7 @@ index 986614d..e8bfedc 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index 7684f95..12f2f86 100644
+index e2b10b9..f916aa5 100644
--- a/Makefile
+++ b/Makefile
@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -5570,7 +5570,7 @@ index c1f6afa..38cc6e9 100644
#endif /* _ASM_EXEC_H */
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
-index dbaec94..6a14935 100644
+index 21bff32..9f0c3b8 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -96,7 +96,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
@@ -6047,10 +6047,31 @@ index fc987a1..6e068ef 100644
#endif
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 7df49fa..38b62bf 100644
+index 7df49fa..a3eb445 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
-@@ -218,6 +218,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+@@ -16,6 +16,8 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+
++extern spinlock_t pa_dbit_lock;
++
+ /*
+ * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+ * memory. For the return value to be meaningful, ADDR must be >=
+@@ -44,8 +46,11 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+
+ #define set_pte_at(mm, addr, ptep, pteval) \
+ do { \
++ unsigned long flags; \
++ spin_lock_irqsave(&pa_dbit_lock, flags); \
+ set_pte(ptep, pteval); \
+ purge_tlb_entries(mm, addr); \
++ spin_unlock_irqrestore(&pa_dbit_lock, flags); \
+ } while (0)
+
+ #endif /* !__ASSEMBLY__ */
+@@ -218,6 +223,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
#define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
#define PAGE_COPY PAGE_EXECREAD
#define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -6068,6 +6089,75 @@ index 7df49fa..38b62bf 100644
#define PAGE_KERNEL __pgprot(_PAGE_KERNEL)
#define PAGE_KERNEL_EXEC __pgprot(_PAGE_KERNEL_EXEC)
#define PAGE_KERNEL_RWX __pgprot(_PAGE_KERNEL_RWX)
+@@ -435,48 +451,46 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
+
+ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
++ pte_t pte;
++ unsigned long flags;
++
+ if (!pte_young(*ptep))
+ return 0;
+- return test_and_clear_bit(xlate_pabit(_PAGE_ACCESSED_BIT), &pte_val(*ptep));
+-#else
+- pte_t pte = *ptep;
+- if (!pte_young(pte))
++
++ spin_lock_irqsave(&pa_dbit_lock, flags);
++ pte = *ptep;
++ if (!pte_young(pte)) {
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ return 0;
+- set_pte_at(vma->vm_mm, addr, ptep, pte_mkold(pte));
++ }
++ set_pte(ptep, pte_mkold(pte));
++ purge_tlb_entries(vma->vm_mm, addr);
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ return 1;
+-#endif
+ }
+
+-extern spinlock_t pa_dbit_lock;
+-
+ struct mm_struct;
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ pte_t old_pte;
++ unsigned long flags;
+
+- spin_lock(&pa_dbit_lock);
++ spin_lock_irqsave(&pa_dbit_lock, flags);
+ old_pte = *ptep;
+ pte_clear(mm,addr,ptep);
+- spin_unlock(&pa_dbit_lock);
++ purge_tlb_entries(mm, addr);
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+
+ return old_pte;
+ }
+
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
+- unsigned long new, old;
+-
+- do {
+- old = pte_val(*ptep);
+- new = pte_val(pte_wrprotect(__pte (old)));
+- } while (cmpxchg((unsigned long *) ptep, old, new) != old);
++ unsigned long flags;
++ spin_lock_irqsave(&pa_dbit_lock, flags);
++ set_pte(ptep, pte_wrprotect(*ptep));
+ purge_tlb_entries(mm, addr);
+-#else
+- pte_t old_pte = *ptep;
+- set_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+-#endif
++ spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ }
+
+ #define pte_same(A,B) (pte_val(A) == pte_val(B))
diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
index 4ba2c93..f5e3974 100644
--- a/arch/parisc/include/asm/uaccess.h
@@ -6085,6 +6175,26 @@ index 4ba2c93..f5e3974 100644
ret = __copy_from_user(to, from, n);
else
copy_from_user_overflow();
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index b89a85a..a9891fa 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -426,14 +426,11 @@ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ /* Note: purge_tlb_entries can be called at startup with
+ no context. */
+
+- /* Disable preemption while we play with %sr1. */
+- preempt_disable();
++ purge_tlb_start(flags);
+ mtsp(mm->context, 1);
+- purge_tlb_start(flags);
+ pdtlb(addr);
+ pitlb(addr);
+ purge_tlb_end(flags);
+- preempt_enable();
+ }
+ EXPORT_SYMBOL(purge_tlb_entries);
+
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index 2a625fb..9908930 100644
--- a/arch/parisc/kernel/module.c
@@ -8246,6 +8356,18 @@ index 6fc1348..390c50a 100644
#define __S100 PAGE_READONLY
#define __S101 PAGE_READONLY
#define __S110 PAGE_SHARED
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index 08fcce9..7619f2f 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -915,6 +915,7 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
+ return remap_pfn_range(vma, from, phys_base >> PAGE_SHIFT, size, prot);
+ }
+
++#include <asm/tlbflush.h>
+ #include <asm-generic/pgtable.h>
+
+ /* We provide our own get_unmapped_area to cope with VA holes and
diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
index 79da178..c2eede8 100644
--- a/arch/sparc/include/asm/pgtsrmmu.h
@@ -8363,6 +8485,20 @@ index 9689176..63c18ea 100644
{
unsigned long mask, tmp1, tmp2, result;
+diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
+index cad36f5..c7de332 100644
+--- a/arch/sparc/include/asm/switch_to_64.h
++++ b/arch/sparc/include/asm/switch_to_64.h
+@@ -18,8 +18,7 @@ do { \
+ * and 2 stores in this critical code path. -DaveM
+ */
+ #define switch_to(prev, next, last) \
+-do { flush_tlb_pending(); \
+- save_and_clear_fpu(); \
++do { save_and_clear_fpu(); \
+ /* If you are tempted to conditionalize the following */ \
+ /* so that ASI is only written if it changes, think again. */ \
+ __asm__ __volatile__("wr %%g0, %0, %%asi" \
diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
index 25849ae..924c54b 100644
--- a/arch/sparc/include/asm/thread_info_32.h
@@ -8421,6 +8557,82 @@ index 269bd92..e46a9b8 100644
/*
* Thread-synchronous status.
*
+diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
+index 2ef4634..f0d6a97 100644
+--- a/arch/sparc/include/asm/tlbflush_64.h
++++ b/arch/sparc/include/asm/tlbflush_64.h
+@@ -11,24 +11,40 @@
+ struct tlb_batch {
+ struct mm_struct *mm;
+ unsigned long tlb_nr;
++ unsigned long active;
+ unsigned long vaddrs[TLB_BATCH_NR];
+ };
+
+ extern void flush_tsb_kernel_range(unsigned long start, unsigned long end);
+ extern void flush_tsb_user(struct tlb_batch *tb);
++extern void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr);
+
+ /* TLB flush operations. */
+
++static inline void flush_tlb_mm(struct mm_struct *mm)
++{
++}
++
++static inline void flush_tlb_page(struct vm_area_struct *vma,
++ unsigned long vmaddr)
++{
++}
++
++static inline void flush_tlb_range(struct vm_area_struct *vma,
++ unsigned long start, unsigned long end)
++{
++}
++
++#define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
++
+ extern void flush_tlb_pending(void);
+-
+-#define flush_tlb_range(vma,start,end) \
+- do { (void)(start); flush_tlb_pending(); } while (0)
+-#define flush_tlb_page(vma,addr) flush_tlb_pending()
+-#define flush_tlb_mm(mm) flush_tlb_pending()
++extern void arch_enter_lazy_mmu_mode(void);
++extern void arch_leave_lazy_mmu_mode(void);
++#define arch_flush_lazy_mmu_mode() do {} while (0)
+
+ /* Local cpu only. */
+ extern void __flush_tlb_all(void);
+-
++extern void __flush_tlb_page(unsigned long context, unsigned long vaddr);
+ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
+
+ #ifndef CONFIG_SMP
+@@ -38,15 +54,24 @@ do { flush_tsb_kernel_range(start,end); \
+ __flush_tlb_kernel_range(start,end); \
+ } while (0)
+
++static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
++{
++ __flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
++}
++
+ #else /* CONFIG_SMP */
+
+ extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
++extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
+
+ #define flush_tlb_kernel_range(start, end) \
+ do { flush_tsb_kernel_range(start,end); \
+ smp_flush_tlb_kernel_range(start, end); \
+ } while (0)
+
++#define global_flush_tlb_page(mm, vaddr) \
++ smp_flush_tlb_page(mm, vaddr)
++
+ #endif /* ! CONFIG_SMP */
+
+ #endif /* _SPARC64_TLBFLUSH_H */
diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
index 0167d26..767bb0c 100644
--- a/arch/sparc/include/asm/uaccess.h
@@ -8667,6 +8879,79 @@ index 7ff45e4..a58f271 100644
audit_syscall_exit(regs);
if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index 537eb66..ca64d2a 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -849,7 +849,7 @@ void smp_tsb_sync(struct mm_struct *mm)
+ }
+
+ extern unsigned long xcall_flush_tlb_mm;
+-extern unsigned long xcall_flush_tlb_pending;
++extern unsigned long xcall_flush_tlb_page;
+ extern unsigned long xcall_flush_tlb_kernel_range;
+ extern unsigned long xcall_fetch_glob_regs;
+ extern unsigned long xcall_fetch_glob_pmu;
+@@ -1074,23 +1074,56 @@ local_flush_and_out:
+ put_cpu();
+ }
+
++struct tlb_pending_info {
++ unsigned long ctx;
++ unsigned long nr;
++ unsigned long *vaddrs;
++};
++
++static void tlb_pending_func(void *info)
++{
++ struct tlb_pending_info *t = info;
++
++ __flush_tlb_pending(t->ctx, t->nr, t->vaddrs);
++}
++
+ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long *vaddrs)
+ {
+ u32 ctx = CTX_HWBITS(mm->context);
++ struct tlb_pending_info info;
+ int cpu = get_cpu();
+
++ info.ctx = ctx;
++ info.nr = nr;
++ info.vaddrs = vaddrs;
++
+ if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
+ cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+ else
+- smp_cross_call_masked(&xcall_flush_tlb_pending,
+- ctx, nr, (unsigned long) vaddrs,
+- mm_cpumask(mm));
++ smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
++ &info, 1);
+
+ __flush_tlb_pending(ctx, nr, vaddrs);
+
+ put_cpu();
+ }
+
++void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
++{
++ unsigned long context = CTX_HWBITS(mm->context);
++ int cpu = get_cpu();
++
++ if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
++ cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
++ else
++ smp_cross_call_masked(&xcall_flush_tlb_page,
++ context, vaddr, 0,
++ mm_cpumask(mm));
++ __flush_tlb_page(context, vaddr);
++
++ put_cpu();
++}
++
+ void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end)
+ {
+ start &= PAGE_MASK;
diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
index 2da0bdc..79128d2 100644
--- a/arch/sparc/kernel/sys_sparc_32.c
@@ -10342,6 +10627,377 @@ index d2b5944..bd813f2 100644
return addr;
}
if (mm->get_unmapped_area == arch_get_unmapped_area)
+diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
+index ba6ae7f..83d89bc 100644
+--- a/arch/sparc/mm/tlb.c
++++ b/arch/sparc/mm/tlb.c
+@@ -24,11 +24,17 @@ static DEFINE_PER_CPU(struct tlb_batch, tlb_batch);
+ void flush_tlb_pending(void)
+ {
+ struct tlb_batch *tb = &get_cpu_var(tlb_batch);
++ struct mm_struct *mm = tb->mm;
+
+- if (tb->tlb_nr) {
+- flush_tsb_user(tb);
++ if (!tb->tlb_nr)
++ goto out;
+
+- if (CTX_VALID(tb->mm->context)) {
++ flush_tsb_user(tb);
++
++ if (CTX_VALID(mm->context)) {
++ if (tb->tlb_nr == 1) {
++ global_flush_tlb_page(mm, tb->vaddrs[0]);
++ } else {
+ #ifdef CONFIG_SMP
+ smp_flush_tlb_pending(tb->mm, tb->tlb_nr,
+ &tb->vaddrs[0]);
+@@ -37,12 +43,30 @@ void flush_tlb_pending(void)
+ tb->tlb_nr, &tb->vaddrs[0]);
+ #endif
+ }
+- tb->tlb_nr = 0;
+ }
+
++ tb->tlb_nr = 0;
++
++out:
+ put_cpu_var(tlb_batch);
+ }
+
++void arch_enter_lazy_mmu_mode(void)
++{
++ struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
++
++ tb->active = 1;
++}
++
++void arch_leave_lazy_mmu_mode(void)
++{
++ struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
++
++ if (tb->tlb_nr)
++ flush_tlb_pending();
++ tb->active = 0;
++}
++
+ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ bool exec)
+ {
+@@ -60,6 +84,12 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ nr = 0;
+ }
+
++ if (!tb->active) {
++ global_flush_tlb_page(mm, vaddr);
++ flush_tsb_user_page(mm, vaddr);
++ goto out;
++ }
++
+ if (nr == 0)
+ tb->mm = mm;
+
+@@ -68,6 +98,7 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ if (nr >= TLB_BATCH_NR)
+ flush_tlb_pending();
+
++out:
+ put_cpu_var(tlb_batch);
+ }
+
+diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
+index 428982b..2cc3bce 100644
+--- a/arch/sparc/mm/tsb.c
++++ b/arch/sparc/mm/tsb.c
+@@ -7,11 +7,10 @@
+ #include <linux/preempt.h>
+ #include <linux/slab.h>
+ #include <asm/page.h>
+-#include <asm/tlbflush.h>
+-#include <asm/tlb.h>
+-#include <asm/mmu_context.h>
+ #include <asm/pgtable.h>
++#include <asm/mmu_context.h>
+ #include <asm/tsb.h>
++#include <asm/tlb.h>
+ #include <asm/oplib.h>
+
+ extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
+@@ -46,23 +45,27 @@ void flush_tsb_kernel_range(unsigned long start, unsigned long end)
+ }
+ }
+
++static void __flush_tsb_one_entry(unsigned long tsb, unsigned long v,
++ unsigned long hash_shift,
++ unsigned long nentries)
++{
++ unsigned long tag, ent, hash;
++
++ v &= ~0x1UL;
++ hash = tsb_hash(v, hash_shift, nentries);
++ ent = tsb + (hash * sizeof(struct tsb));
++ tag = (v >> 22UL);
++
++ tsb_flush(ent, tag);
++}
++
+ static void __flush_tsb_one(struct tlb_batch *tb, unsigned long hash_shift,
+ unsigned long tsb, unsigned long nentries)
+ {
+ unsigned long i;
+
+- for (i = 0; i < tb->tlb_nr; i++) {
+- unsigned long v = tb->vaddrs[i];
+- unsigned long tag, ent, hash;
+-
+- v &= ~0x1UL;
+-
+- hash = tsb_hash(v, hash_shift, nentries);
+- ent = tsb + (hash * sizeof(struct tsb));
+- tag = (v >> 22UL);
+-
+- tsb_flush(ent, tag);
+- }
++ for (i = 0; i < tb->tlb_nr; i++)
++ __flush_tsb_one_entry(tsb, tb->vaddrs[i], hash_shift, nentries);
+ }
+
+ void flush_tsb_user(struct tlb_batch *tb)
+@@ -90,6 +93,30 @@ void flush_tsb_user(struct tlb_batch *tb)
+ spin_unlock_irqrestore(&mm->context.lock, flags);
+ }
+
++void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr)
++{
++ unsigned long nentries, base, flags;
++
++ spin_lock_irqsave(&mm->context.lock, flags);
++
++ base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
++ nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
++ if (tlb_type == cheetah_plus || tlb_type == hypervisor)
++ base = __pa(base);
++ __flush_tsb_one_entry(base, vaddr, PAGE_SHIFT, nentries);
++
++#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
++ if (mm->context.tsb_block[MM_TSB_HUGE].tsb) {
++ base = (unsigned long) mm->context.tsb_block[MM_TSB_HUGE].tsb;
++ nentries = mm->context.tsb_block[MM_TSB_HUGE].tsb_nentries;
++ if (tlb_type == cheetah_plus || tlb_type == hypervisor)
++ base = __pa(base);
++ __flush_tsb_one_entry(base, vaddr, HPAGE_SHIFT, nentries);
++ }
++#endif
++ spin_unlock_irqrestore(&mm->context.lock, flags);
++}
++
+ #define HV_PGSZ_IDX_BASE HV_PGSZ_IDX_8K
+ #define HV_PGSZ_MASK_BASE HV_PGSZ_MASK_8K
+
+diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
+index f8e13d4..432aa0c 100644
+--- a/arch/sparc/mm/ultra.S
++++ b/arch/sparc/mm/ultra.S
+@@ -53,6 +53,33 @@ __flush_tlb_mm: /* 18 insns */
+ nop
+
+ .align 32
++ .globl __flush_tlb_page
++__flush_tlb_page: /* 22 insns */
++ /* %o0 = context, %o1 = vaddr */
++ rdpr %pstate, %g7
++ andn %g7, PSTATE_IE, %g2
++ wrpr %g2, %pstate
++ mov SECONDARY_CONTEXT, %o4
++ ldxa [%o4] ASI_DMMU, %g2
++ stxa %o0, [%o4] ASI_DMMU
++ andcc %o1, 1, %g0
++ andn %o1, 1, %o3
++ be,pn %icc, 1f
++ or %o3, 0x10, %o3
++ stxa %g0, [%o3] ASI_IMMU_DEMAP
++1: stxa %g0, [%o3] ASI_DMMU_DEMAP
++ membar #Sync
++ stxa %g2, [%o4] ASI_DMMU
++ sethi %hi(KERNBASE), %o4
++ flush %o4
++ retl
++ wrpr %g7, 0x0, %pstate
++ nop
++ nop
++ nop
++ nop
++
++ .align 32
+ .globl __flush_tlb_pending
+ __flush_tlb_pending: /* 26 insns */
+ /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+@@ -203,6 +230,31 @@ __cheetah_flush_tlb_mm: /* 19 insns */
+ retl
+ wrpr %g7, 0x0, %pstate
+
++__cheetah_flush_tlb_page: /* 22 insns */
++ /* %o0 = context, %o1 = vaddr */
++ rdpr %pstate, %g7
++ andn %g7, PSTATE_IE, %g2
++ wrpr %g2, 0x0, %pstate
++ wrpr %g0, 1, %tl
++ mov PRIMARY_CONTEXT, %o4
++ ldxa [%o4] ASI_DMMU, %g2
++ srlx %g2, CTX_PGSZ1_NUC_SHIFT, %o3
++ sllx %o3, CTX_PGSZ1_NUC_SHIFT, %o3
++ or %o0, %o3, %o0 /* Preserve nucleus page size fields */
++ stxa %o0, [%o4] ASI_DMMU
++ andcc %o1, 1, %g0
++ be,pn %icc, 1f
++ andn %o1, 1, %o3
++ stxa %g0, [%o3] ASI_IMMU_DEMAP
++1: stxa %g0, [%o3] ASI_DMMU_DEMAP
++ membar #Sync
++ stxa %g2, [%o4] ASI_DMMU
++ sethi %hi(KERNBASE), %o4
++ flush %o4
++ wrpr %g0, 0, %tl
++ retl
++ wrpr %g7, 0x0, %pstate
++
+ __cheetah_flush_tlb_pending: /* 27 insns */
+ /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+ rdpr %pstate, %g7
+@@ -269,6 +321,20 @@ __hypervisor_flush_tlb_mm: /* 10 insns */
+ retl
+ nop
+
++__hypervisor_flush_tlb_page: /* 11 insns */
++ /* %o0 = context, %o1 = vaddr */
++ mov %o0, %g2
++ mov %o1, %o0 /* ARG0: vaddr + IMMU-bit */
++ mov %g2, %o1 /* ARG1: mmu context */
++ mov HV_MMU_ALL, %o2 /* ARG2: flags */
++ srlx %o0, PAGE_SHIFT, %o0
++ sllx %o0, PAGE_SHIFT, %o0
++ ta HV_MMU_UNMAP_ADDR_TRAP
++ brnz,pn %o0, __hypervisor_tlb_tl0_error
++ mov HV_MMU_UNMAP_ADDR_TRAP, %o1
++ retl
++ nop
++
+ __hypervisor_flush_tlb_pending: /* 16 insns */
+ /* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+ sllx %o1, 3, %g1
+@@ -339,6 +405,13 @@ cheetah_patch_cachetlbops:
+ call tlb_patch_one
+ mov 19, %o2
+
++ sethi %hi(__flush_tlb_page), %o0
++ or %o0, %lo(__flush_tlb_page), %o0
++ sethi %hi(__cheetah_flush_tlb_page), %o1
++ or %o1, %lo(__cheetah_flush_tlb_page), %o1
++ call tlb_patch_one
++ mov 22, %o2
++
+ sethi %hi(__flush_tlb_pending), %o0
+ or %o0, %lo(__flush_tlb_pending), %o0
+ sethi %hi(__cheetah_flush_tlb_pending), %o1
+@@ -397,10 +470,9 @@ xcall_flush_tlb_mm: /* 21 insns */
+ nop
+ nop
+
+- .globl xcall_flush_tlb_pending
+-xcall_flush_tlb_pending: /* 21 insns */
+- /* %g5=context, %g1=nr, %g7=vaddrs[] */
+- sllx %g1, 3, %g1
++ .globl xcall_flush_tlb_page
++xcall_flush_tlb_page: /* 17 insns */
++ /* %g5=context, %g1=vaddr */
+ mov PRIMARY_CONTEXT, %g4
+ ldxa [%g4] ASI_DMMU, %g2
+ srlx %g2, CTX_PGSZ1_NUC_SHIFT, %g4
+@@ -408,20 +480,16 @@ xcall_flush_tlb_pending: /* 21 insns */
+ or %g5, %g4, %g5
+ mov PRIMARY_CONTEXT, %g4
+ stxa %g5, [%g4] ASI_DMMU
+-1: sub %g1, (1 << 3), %g1
+- ldx [%g7 + %g1], %g5
+- andcc %g5, 0x1, %g0
++ andcc %g1, 0x1, %g0
+ be,pn %icc, 2f
+-
+- andn %g5, 0x1, %g5
++ andn %g1, 0x1, %g5
+ stxa %g0, [%g5] ASI_IMMU_DEMAP
+ 2: stxa %g0, [%g5] ASI_DMMU_DEMAP
+ membar #Sync
+- brnz,pt %g1, 1b
+- nop
+ stxa %g2, [%g4] ASI_DMMU
+ retry
+ nop
++ nop
+
+ .globl xcall_flush_tlb_kernel_range
+ xcall_flush_tlb_kernel_range: /* 25 insns */
+@@ -656,15 +724,13 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */
+ membar #Sync
+ retry
+
+- .globl __hypervisor_xcall_flush_tlb_pending
+-__hypervisor_xcall_flush_tlb_pending: /* 21 insns */
+- /* %g5=ctx, %g1=nr, %g7=vaddrs[], %g2,%g3,%g4,g6=scratch */
+- sllx %g1, 3, %g1
++ .globl __hypervisor_xcall_flush_tlb_page
++__hypervisor_xcall_flush_tlb_page: /* 17 insns */
++ /* %g5=ctx, %g1=vaddr */
+ mov %o0, %g2
+ mov %o1, %g3
+ mov %o2, %g4
+-1: sub %g1, (1 << 3), %g1
+- ldx [%g7 + %g1], %o0 /* ARG0: virtual address */
++ mov %g1, %o0 /* ARG0: virtual address */
+ mov %g5, %o1 /* ARG1: mmu context */
+ mov HV_MMU_ALL, %o2 /* ARG2: flags */
+ srlx %o0, PAGE_SHIFT, %o0
+@@ -673,8 +739,6 @@ __hypervisor_xcall_flush_tlb_pending: /* 21 insns */
+ mov HV_MMU_UNMAP_ADDR_TRAP, %g6
+ brnz,a,pn %o0, __hypervisor_tlb_xcall_error
+ mov %o0, %g5
+- brnz,pt %g1, 1b
+- nop
+ mov %g2, %o0
+ mov %g3, %o1
+ mov %g4, %o2
+@@ -757,6 +821,13 @@ hypervisor_patch_cachetlbops:
+ call tlb_patch_one
+ mov 10, %o2
+
++ sethi %hi(__flush_tlb_page), %o0
++ or %o0, %lo(__flush_tlb_page), %o0
++ sethi %hi(__hypervisor_flush_tlb_page), %o1
++ or %o1, %lo(__hypervisor_flush_tlb_page), %o1
++ call tlb_patch_one
++ mov 11, %o2
++
+ sethi %hi(__flush_tlb_pending), %o0
+ or %o0, %lo(__flush_tlb_pending), %o0
+ sethi %hi(__hypervisor_flush_tlb_pending), %o1
+@@ -788,12 +859,12 @@ hypervisor_patch_cachetlbops:
+ call tlb_patch_one
+ mov 21, %o2
+
+- sethi %hi(xcall_flush_tlb_pending), %o0
+- or %o0, %lo(xcall_flush_tlb_pending), %o0
+- sethi %hi(__hypervisor_xcall_flush_tlb_pending), %o1
+- or %o1, %lo(__hypervisor_xcall_flush_tlb_pending), %o1
++ sethi %hi(xcall_flush_tlb_page), %o0
++ or %o0, %lo(xcall_flush_tlb_page), %o0
++ sethi %hi(__hypervisor_xcall_flush_tlb_page), %o1
++ or %o1, %lo(__hypervisor_xcall_flush_tlb_page), %o1
+ call tlb_patch_one
+- mov 21, %o2
++ mov 17, %o2
+
+ sethi %hi(xcall_flush_tlb_kernel_range), %o0
+ or %o0, %lo(xcall_flush_tlb_kernel_range), %o0
diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
index f4500c6..889656c 100644
--- a/arch/tile/include/asm/atomic_64.h
@@ -13902,21 +14558,6 @@ index d3ddd17..c9fb0cc 100644
#define flush_insn_slot(p) do { } while (0)
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index dc87b65..85039f9 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -419,8 +419,8 @@ struct kvm_vcpu_arch {
- gpa_t time;
- struct pvclock_vcpu_time_info hv_clock;
- unsigned int hw_tsc_khz;
-- unsigned int time_offset;
-- struct page *time_page;
-+ struct gfn_to_hva_cache pv_time;
-+ bool pv_time_enabled;
- /* set guest stopped flag in pvclock flags field */
- bool pvclock_set_guest_stopped_request;
-
diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
index 2d89e39..baee879 100644
--- a/arch/x86/include/asm/local.h
@@ -17965,10 +18606,10 @@ index 6774c17..72c1b22 100644
}
diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
-index 4914e94..60b06e3 100644
+index 70602f8..9d9edb7 100644
--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
-@@ -1958,10 +1958,10 @@ __init int intel_pmu_init(void)
+@@ -1964,10 +1964,10 @@ __init int intel_pmu_init(void)
* v2 and above have a perf capabilities MSR
*/
if (version > 1) {
@@ -24244,7 +24885,7 @@ index a27e763..54bfe43 100644
case 1: \
____emulate_2op(ctxt,_op,_bx,_by,"b",u8); \
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 9392f52..0e56d77 100644
+index a2f492c..899e107 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -55,7 +55,7 @@
@@ -24413,64 +25054,10 @@ index 9120ae1..238abc0 100644
vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index c243b81..b692af3 100644
+index 9a51121..f739a79 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
-@@ -1408,10 +1408,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- unsigned long flags, this_tsc_khz;
- struct kvm_vcpu_arch *vcpu = &v->arch;
- struct kvm_arch *ka = &v->kvm->arch;
-- void *shared_kaddr;
- s64 kernel_ns, max_kernel_ns;
- u64 tsc_timestamp, host_tsc;
-- struct pvclock_vcpu_time_info *guest_hv_clock;
-+ struct pvclock_vcpu_time_info guest_hv_clock;
- u8 pvclock_flags;
- bool use_master_clock;
-
-@@ -1465,7 +1464,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
-
- local_irq_restore(flags);
-
-- if (!vcpu->time_page)
-+ if (!vcpu->pv_time_enabled)
- return 0;
-
- /*
-@@ -1527,12 +1526,12 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- */
- vcpu->hv_clock.version += 2;
-
-- shared_kaddr = kmap_atomic(vcpu->time_page);
--
-- guest_hv_clock = shared_kaddr + vcpu->time_offset;
-+ if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
-+ &guest_hv_clock, sizeof(guest_hv_clock))))
-+ return 0;
-
- /* retain PVCLOCK_GUEST_STOPPED if set in guest copy */
-- pvclock_flags = (guest_hv_clock->flags & PVCLOCK_GUEST_STOPPED);
-+ pvclock_flags = (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
-
- if (vcpu->pvclock_set_guest_stopped_request) {
- pvclock_flags |= PVCLOCK_GUEST_STOPPED;
-@@ -1545,12 +1544,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
-
- vcpu->hv_clock.flags = pvclock_flags;
-
-- memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
-- sizeof(vcpu->hv_clock));
--
-- kunmap_atomic(shared_kaddr);
--
-- mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
-+ kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
-+ &vcpu->hv_clock,
-+ sizeof(vcpu->hv_clock));
- return 0;
- }
-
-@@ -1692,8 +1688,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1688,8 +1688,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
{
struct kvm *kvm = vcpu->kvm;
int lm = is_long_mode(vcpu);
@@ -24481,51 +25068,7 @@ index c243b81..b692af3 100644
u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
: kvm->arch.xen_hvm_config.blob_size_32;
u32 page_num = data & ~PAGE_MASK;
-@@ -1839,10 +1835,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
-
- static void kvmclock_reset(struct kvm_vcpu *vcpu)
- {
-- if (vcpu->arch.time_page) {
-- kvm_release_page_dirty(vcpu->arch.time_page);
-- vcpu->arch.time_page = NULL;
-- }
-+ vcpu->arch.pv_time_enabled = false;
- }
-
- static void accumulate_steal_time(struct kvm_vcpu *vcpu)
-@@ -1948,6 +1941,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
- break;
- case MSR_KVM_SYSTEM_TIME_NEW:
- case MSR_KVM_SYSTEM_TIME: {
-+ u64 gpa_offset;
- kvmclock_reset(vcpu);
-
- vcpu->arch.time = data;
-@@ -1957,14 +1951,17 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
- if (!(data & 1))
- break;
-
-- /* ...but clean it before doing the actual write */
-- vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-+ gpa_offset = data & ~(PAGE_MASK | 1);
-
-- vcpu->arch.time_page =
-- gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
-+ /* Check that the address is 32-byte aligned. */
-+ if (gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1))
-+ break;
-
-- if (is_error_page(vcpu->arch.time_page))
-- vcpu->arch.time_page = NULL;
-+ if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
-+ &vcpu->arch.pv_time, data & ~1ULL))
-+ vcpu->arch.pv_time_enabled = false;
-+ else
-+ vcpu->arch.pv_time_enabled = true;
-
- break;
- }
-@@ -2571,6 +2568,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2567,6 +2567,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
if (n < msr_list.nmsrs)
goto out;
r = -EFAULT;
@@ -24534,7 +25077,7 @@ index c243b81..b692af3 100644
if (copy_to_user(user_msr_list->indices, &msrs_to_save,
num_msrs_to_save * sizeof(u32)))
goto out;
-@@ -2700,7 +2699,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2696,7 +2698,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
struct kvm_interrupt *irq)
{
@@ -24543,16 +25086,7 @@ index c243b81..b692af3 100644
return -EINVAL;
if (irqchip_in_kernel(vcpu->kvm))
return -ENXIO;
-@@ -2967,7 +2966,7 @@ static int kvm_vcpu_ioctl_x86_set_xcrs(struct kvm_vcpu *vcpu,
- */
- static int kvm_set_guest_paused(struct kvm_vcpu *vcpu)
- {
-- if (!vcpu->arch.time_page)
-+ if (!vcpu->arch.pv_time_enabled)
- return -EINVAL;
- vcpu->arch.pvclock_set_guest_stopped_request = true;
- kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
-@@ -5213,7 +5212,7 @@ static struct notifier_block pvclock_gtod_notifier = {
+@@ -5209,7 +5211,7 @@ static struct notifier_block pvclock_gtod_notifier = {
};
#endif
@@ -24561,14 +25095,6 @@ index c243b81..b692af3 100644
{
int r;
struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-@@ -6661,6 +6660,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- goto fail_free_wbinvd_dirty_mask;
-
- vcpu->arch.ia32_tsc_adjust_msr = 0x0;
-+ vcpu->arch.pv_time_enabled = false;
- kvm_async_pf_hash_reset(vcpu);
- kvm_pmu_init(vcpu);
-
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 20a4fd4..d806083 100644
--- a/arch/x86/lguest/boot.c
@@ -34025,10 +34551,10 @@ index 21cb980..f15107c 100644
return -EINVAL;
else
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
-index fe6d4be..89f32100 100644
+index 615d262..15d5c9d 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
-@@ -571,7 +571,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
+@@ -559,7 +559,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
}
static int
@@ -38428,10 +38954,10 @@ index 1cbfc6b..56e1dbb 100644
/*----------------------------------------------------------------*/
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 75b1f89..00ba344 100644
+index fd86b37..a5389ef 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
-@@ -1819,7 +1819,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
+@@ -1821,7 +1821,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
if (r1_sync_page_io(rdev, sect, s,
bio->bi_io_vec[idx].bv_page,
READ) != 0)
@@ -38440,7 +38966,7 @@ index 75b1f89..00ba344 100644
}
sectors -= s;
sect += s;
-@@ -2041,7 +2041,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
+@@ -2043,7 +2043,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
test_bit(In_sync, &rdev->flags)) {
if (r1_sync_page_io(rdev, sect, s,
conf->tmppage, READ)) {
@@ -38450,10 +38976,10 @@ index 75b1f89..00ba344 100644
"md/raid1:%s: read error corrected "
"(%d sectors at %llu on %s)\n",
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 8d925dc..11d674f 100644
+index b3898d4..23a462b 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
-@@ -1878,7 +1878,7 @@ static void end_sync_read(struct bio *bio, int error)
+@@ -1881,7 +1881,7 @@ static void end_sync_read(struct bio *bio, int error)
/* The write handler will notice the lack of
* R10BIO_Uptodate and record any errors etc
*/
@@ -38462,7 +38988,7 @@ index 8d925dc..11d674f 100644
&conf->mirrors[d].rdev->corrected_errors);
/* for reconstruct, we always reschedule after a read.
-@@ -2227,7 +2227,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
+@@ -2230,7 +2230,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
{
struct timespec cur_time_mon;
unsigned long hours_since_last;
@@ -38471,7 +38997,7 @@ index 8d925dc..11d674f 100644
ktime_get_ts(&cur_time_mon);
-@@ -2249,9 +2249,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
+@@ -2252,9 +2252,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
* overflowing the shift of read_errors by hours_since_last.
*/
if (hours_since_last >= 8 * sizeof(read_errors))
@@ -38483,7 +39009,7 @@ index 8d925dc..11d674f 100644
}
static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector,
-@@ -2305,8 +2305,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2308,8 +2308,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
return;
check_decay_read_errors(mddev, rdev);
@@ -38494,7 +39020,7 @@ index 8d925dc..11d674f 100644
char b[BDEVNAME_SIZE];
bdevname(rdev->bdev, b);
-@@ -2314,7 +2314,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2317,7 +2317,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
"md/raid10:%s: %s: Raid device exceeded "
"read_error threshold [cur %d:max %d]\n",
mdname(mddev), b,
@@ -38503,7 +39029,7 @@ index 8d925dc..11d674f 100644
printk(KERN_NOTICE
"md/raid10:%s: %s: Failing raid device\n",
mdname(mddev), b);
-@@ -2469,7 +2469,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2472,7 +2472,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
sect +
choose_data_offset(r10_bio, rdev)),
bdevname(rdev->bdev, b));
@@ -39854,7 +40380,7 @@ index adbd91b..58ec94a 100644
/**
* bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
-index d330e81..ce1fb9a 100644
+index 6f9b74c..7f219b8 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
+++ b/drivers/net/ethernet/broadcom/tg3.h
@@ -146,6 +146,7 @@
@@ -44342,10 +44868,47 @@ index b3c4a25..723916f 100644
if (get_user(c, buf))
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index da9fde8..c07975f 100644
+index da9fde8..621d6dc 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
-@@ -3391,7 +3391,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+@@ -941,6 +941,14 @@ void start_tty(struct tty_struct *tty)
+
+ EXPORT_SYMBOL(start_tty);
+
++static void tty_update_time(struct timespec *time)
++{
++ unsigned long sec = get_seconds();
++ sec -= sec % 60;
++ if ((long)(sec - time->tv_sec) > 0)
++ time->tv_sec = sec;
++}
++
+ /**
+ * tty_read - read method for tty device files
+ * @file: pointer to tty file
+@@ -977,8 +985,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ else
+ i = -EIO;
+ tty_ldisc_deref(ld);
++
+ if (i > 0)
+- inode->i_atime = current_fs_time(inode->i_sb);
++ tty_update_time(&inode->i_atime);
++
+ return i;
+ }
+
+@@ -1080,8 +1090,7 @@ static inline ssize_t do_tty_write(
+ cond_resched();
+ }
+ if (written) {
+- struct inode *inode = file->f_path.dentry->d_inode;
+- inode->i_mtime = current_fs_time(inode->i_sb);
++ tty_update_time(&file->f_path.dentry->d_inode->i_mtime);
+ ret = written;
+ }
+ out:
+@@ -3391,7 +3400,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
void tty_default_fops(struct file_operations *fops)
{
@@ -45141,7 +45704,7 @@ index 5c3960d..15cf8fc 100644
goto out1;
}
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index dc61c12..e29796e 100644
+index 0a49456..fd5be1b 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
@@ -48413,7 +48976,7 @@ index 0efd152..b5802ad 100644
A.out (Assembler.OUTput) is a set of formats for libraries and
executables used in the earliest versions of UNIX. Linux used
diff --git a/fs/aio.c b/fs/aio.c
-index 71f613c..9d01f1f 100644
+index 71f613c..ee07789 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -111,7 +111,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -48425,6 +48988,17 @@ index 71f613c..9d01f1f 100644
return -EINVAL;
nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
+@@ -1027,9 +1027,9 @@ static int aio_read_evt(struct kioctx *ioctx, struct io_event *ent)
+ spin_unlock(&info->ring_lock);
+
+ out:
+- kunmap_atomic(ring);
+ dprintk("leaving aio_read_evt: %d h%lu t%lu\n", ret,
+ (unsigned long)ring->head, (unsigned long)ring->tail);
++ kunmap_atomic(ring);
+ return ret;
+ }
+
@@ -1373,18 +1373,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
{
@@ -48623,7 +49197,7 @@ index 6043567..16a9239 100644
fd_offset + ex.a_text);
if (error != N_DATADDR(ex)) {
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 0c42cdb..b62581e9 100644
+index 5843a47..160fbe2 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -33,6 +33,7 @@
@@ -49297,7 +49871,7 @@ index 0c42cdb..b62581e9 100644
{
#define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-@@ -1152,7 +1598,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1153,7 +1599,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
if (vma->vm_file == NULL)
return 0;
@@ -49306,7 +49880,7 @@ index 0c42cdb..b62581e9 100644
goto whole;
/*
-@@ -1374,9 +1820,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1375,9 +1821,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
{
elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
int i = 0;
@@ -49318,7 +49892,7 @@ index 0c42cdb..b62581e9 100644
fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
}
-@@ -2006,14 +2452,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -2007,14 +2453,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
}
static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -49335,7 +49909,7 @@ index 0c42cdb..b62581e9 100644
return size;
}
-@@ -2107,7 +2553,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2108,7 +2554,7 @@ static int elf_core_dump(struct coredump_params *cprm)
dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
@@ -49344,7 +49918,7 @@ index 0c42cdb..b62581e9 100644
offset += elf_core_extra_data_size();
e_shoff = offset;
-@@ -2121,10 +2567,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2122,10 +2568,12 @@ static int elf_core_dump(struct coredump_params *cprm)
offset = dataoff;
size += sizeof(*elf);
@@ -49357,7 +49931,7 @@ index 0c42cdb..b62581e9 100644
if (size > cprm->limit
|| !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
goto end_coredump;
-@@ -2138,7 +2586,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2139,7 +2587,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_offset = offset;
phdr.p_vaddr = vma->vm_start;
phdr.p_paddr = 0;
@@ -49366,7 +49940,7 @@ index 0c42cdb..b62581e9 100644
phdr.p_memsz = vma->vm_end - vma->vm_start;
offset += phdr.p_filesz;
phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2149,6 +2597,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2150,6 +2598,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_align = ELF_EXEC_PAGESIZE;
size += sizeof(phdr);
@@ -49374,7 +49948,7 @@ index 0c42cdb..b62581e9 100644
if (size > cprm->limit
|| !dump_write(cprm->file, &phdr, sizeof(phdr)))
goto end_coredump;
-@@ -2173,7 +2622,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2174,7 +2623,7 @@ static int elf_core_dump(struct coredump_params *cprm)
unsigned long addr;
unsigned long end;
@@ -49383,7 +49957,7 @@ index 0c42cdb..b62581e9 100644
for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
struct page *page;
-@@ -2182,6 +2631,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2183,6 +2632,7 @@ static int elf_core_dump(struct coredump_params *cprm)
page = get_dump_page(addr);
if (page) {
void *kaddr = kmap(page);
@@ -49391,7 +49965,7 @@ index 0c42cdb..b62581e9 100644
stop = ((size += PAGE_SIZE) > cprm->limit) ||
!dump_write(cprm->file, kaddr,
PAGE_SIZE);
-@@ -2199,6 +2649,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2200,6 +2650,7 @@ static int elf_core_dump(struct coredump_params *cprm)
if (e_phnum == PN_XNUM) {
size += sizeof(*shdr4extnum);
@@ -49399,7 +49973,7 @@ index 0c42cdb..b62581e9 100644
if (size > cprm->limit
|| !dump_write(cprm->file, shdr4extnum,
sizeof(*shdr4extnum)))
-@@ -2219,6 +2670,97 @@ out:
+@@ -2220,6 +2671,97 @@ out:
#endif /* CONFIG_ELF_CORE */
@@ -53470,21 +54044,8 @@ index 2b6f569..fcb4d1f 100644
if (!IS_ERR(s))
kfree(s);
}
-diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
-index eba76eab..fc8ddc1 100644
---- a/fs/hfsplus/extents.c
-+++ b/fs/hfsplus/extents.c
-@@ -533,7 +533,7 @@ void hfsplus_file_truncate(struct inode *inode)
- struct address_space *mapping = inode->i_mapping;
- struct page *page;
- void *fsdata;
-- u32 size = inode->i_size;
-+ loff_t size = inode->i_size;
-
- res = pagecache_write_begin(NULL, mapping, size, 0,
- AOP_FLAG_UNINTERRUPTIBLE,
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 78bde32..767e906 100644
+index ccee8cc..144b5d7 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -152,6 +152,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
@@ -54993,7 +55554,7 @@ index 15af622..0e9f4467 100644
help
Various /proc files exist to monitor process memory utilization:
diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 6a91e6f..e54dbc14 100644
+index be3c22f..0df1564 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -60,6 +60,7 @@
@@ -55004,7 +55565,7 @@ index 6a91e6f..e54dbc14 100644
#include <linux/proc_fs.h>
#include <linux/ioport.h>
#include <linux/uaccess.h>
-@@ -362,6 +363,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
+@@ -363,6 +364,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
seq_putc(m, '\n');
}
@@ -55026,7 +55587,7 @@ index 6a91e6f..e54dbc14 100644
int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
struct pid *pid, struct task_struct *task)
{
-@@ -380,9 +396,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+@@ -381,9 +397,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
task_cpus_allowed(m, task);
cpuset_task_status_allowed(m, task);
task_context_switch_counts(m, task);
@@ -55051,7 +55612,7 @@ index 6a91e6f..e54dbc14 100644
static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
struct pid *pid, struct task_struct *task, int whole)
{
-@@ -404,6 +435,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -405,6 +436,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
char tcomm[sizeof(task->comm)];
unsigned long flags;
@@ -55065,7 +55626,7 @@ index 6a91e6f..e54dbc14 100644
state = *get_task_state(task);
vsize = eip = esp = 0;
permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
-@@ -475,6 +513,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -476,6 +514,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
gtime = task->gtime;
}
@@ -55085,7 +55646,7 @@ index 6a91e6f..e54dbc14 100644
/* scale priority and nice values from timeslices to -20..20 */
/* to make it look like a "normal" Unix priority/nice value */
priority = task_prio(task);
-@@ -511,9 +562,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -512,9 +563,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
seq_put_decimal_ull(m, ' ', vsize);
seq_put_decimal_ull(m, ' ', mm ? get_mm_rss(mm) : 0);
seq_put_decimal_ull(m, ' ', rsslim);
@@ -55101,7 +55662,7 @@ index 6a91e6f..e54dbc14 100644
seq_put_decimal_ull(m, ' ', esp);
seq_put_decimal_ull(m, ' ', eip);
/* The signal information here is obsolete.
-@@ -535,7 +592,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -536,7 +593,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
seq_put_decimal_ull(m, ' ', cputime_to_clock_t(gtime));
seq_put_decimal_ll(m, ' ', cputime_to_clock_t(cgtime));
@@ -55114,7 +55675,7 @@ index 6a91e6f..e54dbc14 100644
seq_put_decimal_ull(m, ' ', mm->start_data);
seq_put_decimal_ull(m, ' ', mm->end_data);
seq_put_decimal_ull(m, ' ', mm->start_brk);
-@@ -573,8 +634,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+@@ -574,8 +635,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
struct pid *pid, struct task_struct *task)
{
unsigned long size = 0, resident = 0, shared = 0, text = 0, data = 0;
@@ -55131,7 +55692,7 @@ index 6a91e6f..e54dbc14 100644
if (mm) {
size = task_statm(mm, &shared, &text, &data, &resident);
mmput(mm);
-@@ -597,6 +665,13 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+@@ -598,6 +666,13 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
return 0;
}
@@ -67800,13 +68361,13 @@ index 4c57065..4307975 100644
#define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
#endif
diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 98503b7..cc36d18 100644
+index d9a4f7f4..19f77d6 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
-@@ -211,8 +211,13 @@ extern bool capable(int cap);
- extern bool ns_capable(struct user_namespace *ns, int cap);
+@@ -213,8 +213,13 @@ extern bool ns_capable(struct user_namespace *ns, int cap);
extern bool nsown_capable(int cap);
extern bool inode_capable(const struct inode *inode, int cap);
+ extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
+extern bool capable_nolog(int cap);
+extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
+extern bool inode_capable_nolog(const struct inode *inode, int cap);
@@ -70105,7 +70666,7 @@ index 4972e6e..de4d19b 100644
if (atomic_sub_and_test((int) count, &kref->refcount)) {
release(kref);
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 2c497ab..afe32f5 100644
+index ffdf8b7..1f91d0e 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -418,7 +418,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
@@ -70204,7 +70765,7 @@ index b8ba855..0148090 100644
u32 remainder;
return div_u64_rem(dividend, divisor, &remainder);
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 66e2f7c..b916b9a 100644
+index 9568b90..6cc79f9 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -101,6 +101,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -70406,7 +70967,7 @@ index 66e2f7c..b916b9a 100644
#ifdef CONFIG_ARCH_USES_NUMA_PROT_NONE
unsigned long change_prot_numa(struct vm_area_struct *vma,
unsigned long start, unsigned long end);
-@@ -1649,6 +1658,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
+@@ -1651,6 +1660,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
static inline void vm_stat_account(struct mm_struct *mm,
unsigned long flags, struct file *file, long pages)
{
@@ -70418,7 +70979,7 @@ index 66e2f7c..b916b9a 100644
mm->total_vm += pages;
}
#endif /* CONFIG_PROC_FS */
-@@ -1721,7 +1735,7 @@ extern int unpoison_memory(unsigned long pfn);
+@@ -1723,7 +1737,7 @@ extern int unpoison_memory(unsigned long pfn);
extern int sysctl_memory_failure_early_kill;
extern int sysctl_memory_failure_recovery;
extern void shake_page(struct page *p, int access);
@@ -70427,7 +70988,7 @@ index 66e2f7c..b916b9a 100644
extern int soft_offline_page(struct page *page, int flags);
extern void dump_page(struct page *page);
-@@ -1752,5 +1766,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
+@@ -1754,5 +1768,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
static inline bool page_is_guard(struct page *page) { return false; }
#endif /* CONFIG_DEBUG_PAGEALLOC */
@@ -71280,7 +71841,7 @@ index c20635c..2f5def4 100644
static inline void anon_vma_merge(struct vm_area_struct *vma,
struct vm_area_struct *next)
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index d211247..eac6c2c 100644
+index 7e49270..835d8d9 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -61,6 +61,7 @@ struct bio_list;
@@ -71291,7 +71852,7 @@ index d211247..eac6c2c 100644
/*
* List of flags we want to share for kernel threads,
-@@ -327,7 +328,7 @@ extern char __sched_text_start[], __sched_text_end[];
+@@ -328,7 +329,7 @@ extern char __sched_text_start[], __sched_text_end[];
extern int in_sched_functions(unsigned long addr);
#define MAX_SCHEDULE_TIMEOUT LONG_MAX
@@ -71300,7 +71861,7 @@ index d211247..eac6c2c 100644
extern signed long schedule_timeout_interruptible(signed long timeout);
extern signed long schedule_timeout_killable(signed long timeout);
extern signed long schedule_timeout_uninterruptible(signed long timeout);
-@@ -354,10 +355,23 @@ struct user_namespace;
+@@ -355,10 +356,23 @@ struct user_namespace;
#define DEFAULT_MAX_MAP_COUNT (USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
extern int sysctl_max_map_count;
@@ -71324,7 +71885,7 @@ index d211247..eac6c2c 100644
extern void arch_pick_mmap_layout(struct mm_struct *mm);
extern unsigned long
arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
-@@ -639,6 +653,17 @@ struct signal_struct {
+@@ -640,6 +654,17 @@ struct signal_struct {
#ifdef CONFIG_TASKSTATS
struct taskstats *stats;
#endif
@@ -71342,7 +71903,7 @@ index d211247..eac6c2c 100644
#ifdef CONFIG_AUDIT
unsigned audit_tty;
struct tty_audit_buf *tty_audit_buf;
-@@ -717,6 +742,11 @@ struct user_struct {
+@@ -718,6 +743,11 @@ struct user_struct {
struct key *session_keyring; /* UID's default session keyring */
#endif
@@ -71354,7 +71915,7 @@ index d211247..eac6c2c 100644
/* Hash table maintenance information */
struct hlist_node uidhash_node;
kuid_t uid;
-@@ -1116,7 +1146,7 @@ struct sched_class {
+@@ -1117,7 +1147,7 @@ struct sched_class {
#ifdef CONFIG_FAIR_GROUP_SCHED
void (*task_move_group) (struct task_struct *p, int on_rq);
#endif
@@ -71363,7 +71924,7 @@ index d211247..eac6c2c 100644
struct load_weight {
unsigned long weight, inv_weight;
-@@ -1360,8 +1390,8 @@ struct task_struct {
+@@ -1361,8 +1391,8 @@ struct task_struct {
struct list_head thread_group;
struct completion *vfork_done; /* for vfork() */
@@ -71374,7 +71935,7 @@ index d211247..eac6c2c 100644
cputime_t utime, stime, utimescaled, stimescaled;
cputime_t gtime;
-@@ -1377,11 +1407,6 @@ struct task_struct {
+@@ -1378,11 +1408,6 @@ struct task_struct {
struct task_cputime cputime_expires;
struct list_head cpu_timers[3];
@@ -71386,7 +71947,7 @@ index d211247..eac6c2c 100644
char comm[TASK_COMM_LEN]; /* executable name excluding path
- access with [gs]et_task_comm (which lock
it with task_lock())
-@@ -1398,6 +1423,10 @@ struct task_struct {
+@@ -1399,6 +1424,10 @@ struct task_struct {
#endif
/* CPU-specific state of this task */
struct thread_struct thread;
@@ -71397,7 +71958,7 @@ index d211247..eac6c2c 100644
/* filesystem information */
struct fs_struct *fs;
/* open file information */
-@@ -1471,6 +1500,10 @@ struct task_struct {
+@@ -1472,6 +1501,10 @@ struct task_struct {
gfp_t lockdep_reclaim_gfp;
#endif
@@ -71408,7 +71969,7 @@ index d211247..eac6c2c 100644
/* journalling filesystem info */
void *journal_info;
-@@ -1509,6 +1542,10 @@ struct task_struct {
+@@ -1510,6 +1543,10 @@ struct task_struct {
/* cg_list protected by css_set_lock and tsk->alloc_lock */
struct list_head cg_list;
#endif
@@ -71419,7 +71980,7 @@ index d211247..eac6c2c 100644
#ifdef CONFIG_FUTEX
struct robust_list_head __user *robust_list;
#ifdef CONFIG_COMPAT
-@@ -1605,8 +1642,74 @@ struct task_struct {
+@@ -1606,8 +1643,74 @@ struct task_struct {
#ifdef CONFIG_UPROBES
struct uprobe_task *utask;
#endif
@@ -71494,7 +72055,7 @@ index d211247..eac6c2c 100644
/* Future-safe accessor for struct task_struct's cpus_allowed. */
#define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
-@@ -1696,7 +1799,7 @@ struct pid_namespace;
+@@ -1697,7 +1800,7 @@ struct pid_namespace;
pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
struct pid_namespace *ns);
@@ -71503,7 +72064,7 @@ index d211247..eac6c2c 100644
{
return tsk->pid;
}
-@@ -2155,7 +2258,9 @@ void yield(void);
+@@ -2156,7 +2259,9 @@ void yield(void);
extern struct exec_domain default_exec_domain;
union thread_union {
@@ -71513,7 +72074,7 @@ index d211247..eac6c2c 100644
unsigned long stack[THREAD_SIZE/sizeof(long)];
};
-@@ -2188,6 +2293,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2189,6 +2294,7 @@ extern struct pid_namespace init_pid_ns;
*/
extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -71521,7 +72082,7 @@ index d211247..eac6c2c 100644
extern struct task_struct *find_task_by_pid_ns(pid_t nr,
struct pid_namespace *ns);
-@@ -2344,7 +2450,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2345,7 +2451,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
extern void exit_itimers(struct signal_struct *);
extern void flush_itimer_signals(void);
@@ -71530,7 +72091,7 @@ index d211247..eac6c2c 100644
extern int allow_signal(int);
extern int disallow_signal(int);
-@@ -2545,9 +2651,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2546,9 +2652,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
#endif
@@ -73078,6 +73639,21 @@ index 5a15fab..d799ea7 100644
extern int __rtnl_link_register(struct rtnl_link_ops *ops);
extern void __rtnl_link_unregister(struct rtnl_link_ops *ops);
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 975cca0..b117081 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -56,8 +56,8 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
+ scm->pid = get_pid(pid);
+ scm->cred = cred ? get_cred(cred) : NULL;
+ scm->creds.pid = pid_vnr(pid);
+- scm->creds.uid = cred ? cred->euid : INVALID_UID;
+- scm->creds.gid = cred ? cred->egid : INVALID_GID;
++ scm->creds.uid = cred ? cred->uid : INVALID_UID;
++ scm->creds.gid = cred ? cred->gid : INVALID_GID;
+ }
+
+ static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 7fdf298..197e9f7 100644
--- a/include/net/sctp/sctp.h
@@ -74497,7 +75073,7 @@ index a371f85..da826c1 100644
struct audit_buffer *ab;
diff --git a/kernel/capability.c b/kernel/capability.c
-index 493d972..f87dfbd 100644
+index f6c2ce5..982c0f9 100644
--- a/kernel/capability.c
+++ b/kernel/capability.c
@@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
@@ -74566,9 +75142,9 @@ index 493d972..f87dfbd 100644
+EXPORT_SYMBOL(ns_capable_nolog);
+
/**
- * capable - Determine if the current task has a superior capability in effect
- * @cap: The capability to be tested for
-@@ -408,6 +427,12 @@ bool capable(int cap)
+ * file_ns_capable - Determine if the file's opener had a capability in effect
+ * @file: The file we want to check
+@@ -432,6 +451,12 @@ bool capable(int cap)
}
EXPORT_SYMBOL(capable);
@@ -74581,7 +75157,7 @@ index 493d972..f87dfbd 100644
/**
* nsown_capable - Check superior capability to one's own user_ns
* @cap: The capability in question
-@@ -440,3 +465,10 @@ bool inode_capable(const struct inode *inode, int cap)
+@@ -464,3 +489,10 @@ bool inode_capable(const struct inode *inode, int cap)
return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
}
@@ -75016,7 +75592,7 @@ index 8875254..7cf4928 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 7b6646a..3cb1135 100644
+index 0600d3b..742ab1b 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -182,7 +182,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
@@ -75590,10 +76166,10 @@ index 9b22d03..6295b62 100644
prev->next = info->next;
else
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index cdd5607..c3fc919 100644
+index e4cee8d..f31f503 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
-@@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1408,7 +1408,7 @@ void hrtimer_peek_ahead_timers(void)
local_irq_restore(flags);
}
@@ -75602,7 +76178,7 @@ index cdd5607..c3fc919 100644
{
struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
-@@ -1751,7 +1751,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
+@@ -1750,7 +1750,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
return NOTIFY_OK;
}
@@ -78252,10 +78828,10 @@ index 0984a21..939f183 100644
#ifdef CONFIG_RT_GROUP_SCHED
/*
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 26058d0..e315889 100644
+index 5e2f7c3..4002d41 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
-@@ -3367,7 +3367,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
+@@ -3369,7 +3369,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
* The return value is -ERESTARTSYS if interrupted, 0 if timed out,
* positive (at least 1, or number of jiffies left till timeout) if completed.
*/
@@ -78264,7 +78840,7 @@ index 26058d0..e315889 100644
wait_for_completion_interruptible_timeout(struct completion *x,
unsigned long timeout)
{
-@@ -3384,7 +3384,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
+@@ -3386,7 +3386,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
*
* The return value is -ERESTARTSYS if interrupted, 0 if completed.
*/
@@ -78273,7 +78849,7 @@ index 26058d0..e315889 100644
{
long t = wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_KILLABLE);
if (t == -ERESTARTSYS)
-@@ -3405,7 +3405,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
+@@ -3407,7 +3407,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
* The return value is -ERESTARTSYS if interrupted, 0 if timed out,
* positive (at least 1, or number of jiffies left till timeout) if completed.
*/
@@ -78282,7 +78858,7 @@ index 26058d0..e315889 100644
wait_for_completion_killable_timeout(struct completion *x,
unsigned long timeout)
{
-@@ -3631,6 +3631,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -3633,6 +3633,8 @@ int can_nice(const struct task_struct *p, const int nice)
/* convert nice value [19,-20] to rlimit style value [1,40] */
int nice_rlim = 20 - nice;
@@ -78291,7 +78867,7 @@ index 26058d0..e315889 100644
return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
capable(CAP_SYS_NICE));
}
-@@ -3664,7 +3666,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -3666,7 +3668,8 @@ SYSCALL_DEFINE1(nice, int, increment)
if (nice > 19)
nice = 19;
@@ -78301,7 +78877,7 @@ index 26058d0..e315889 100644
return -EPERM;
retval = security_task_setnice(current, nice);
-@@ -3818,6 +3821,7 @@ recheck:
+@@ -3820,6 +3823,7 @@ recheck:
unsigned long rlim_rtprio =
task_rlimit(p, RLIMIT_RTPRIO);
@@ -78309,7 +78885,7 @@ index 26058d0..e315889 100644
/* can't set/change the rt policy */
if (policy != p->policy && !rlim_rtprio)
return -EPERM;
-@@ -4901,7 +4905,7 @@ static void migrate_tasks(unsigned int dead_cpu)
+@@ -4903,7 +4907,7 @@ static void migrate_tasks(unsigned int dead_cpu)
#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
@@ -78318,7 +78894,7 @@ index 26058d0..e315889 100644
{
.procname = "sched_domain",
.mode = 0555,
-@@ -4918,17 +4922,17 @@ static struct ctl_table sd_ctl_root[] = {
+@@ -4920,17 +4924,17 @@ static struct ctl_table sd_ctl_root[] = {
{}
};
@@ -78340,7 +78916,7 @@ index 26058d0..e315889 100644
/*
* In the intermediate directories, both the child directory and
-@@ -4936,22 +4940,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -4938,22 +4942,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
* will always be set. In the lowest directory the names are
* static strings and all have proc handlers.
*/
@@ -78364,7 +78940,7 @@ index 26058d0..e315889 100644
}
static int min_load_idx = 0;
- static int max_load_idx = CPU_LOAD_IDX_MAX;
+ static int max_load_idx = CPU_LOAD_IDX_MAX-1;
static void
-set_table_entry(struct ctl_table *entry,
@@ -78372,7 +78948,7 @@ index 26058d0..e315889 100644
const char *procname, void *data, int maxlen,
umode_t mode, proc_handler *proc_handler,
bool load_idx)
-@@ -4971,7 +4978,7 @@ set_table_entry(struct ctl_table *entry,
+@@ -4973,7 +4980,7 @@ set_table_entry(struct ctl_table *entry,
static struct ctl_table *
sd_alloc_ctl_domain_table(struct sched_domain *sd)
{
@@ -78381,7 +78957,7 @@ index 26058d0..e315889 100644
if (table == NULL)
return NULL;
-@@ -5006,9 +5013,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -5008,9 +5015,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
return table;
}
@@ -78393,7 +78969,7 @@ index 26058d0..e315889 100644
struct sched_domain *sd;
int domain_num = 0, i;
char buf[32];
-@@ -5035,11 +5042,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -5037,11 +5044,13 @@ static struct ctl_table_header *sd_sysctl_header;
static void register_sched_domain_sysctl(void)
{
int i, cpu_num = num_possible_cpus();
@@ -78408,7 +78984,7 @@ index 26058d0..e315889 100644
if (entry == NULL)
return;
-@@ -5062,8 +5071,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -5064,8 +5073,12 @@ static void unregister_sched_domain_sysctl(void)
if (sd_sysctl_header)
unregister_sysctl_table(sd_sysctl_header);
sd_sysctl_header = NULL;
@@ -78423,7 +78999,7 @@ index 26058d0..e315889 100644
}
#else
static void register_sched_domain_sysctl(void)
-@@ -5162,7 +5175,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+@@ -5164,7 +5177,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
* happens before everything else. This has to be lower priority than
* the notifier in the perf_event subsystem, though.
*/
@@ -78496,7 +79072,7 @@ index 81fa536..6ccf96a 100644
int this_cpu = smp_processor_id();
struct rq *this_rq = cpu_rq(this_cpu);
diff --git a/kernel/signal.c b/kernel/signal.c
-index dec9c30..92c8f65 100644
+index 50e425c..92c8f65 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -50,12 +50,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -78622,15 +79198,6 @@ index dec9c30..92c8f65 100644
if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
error = check_kill_permission(sig, info, p);
/*
-@@ -2880,7 +2911,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
-
- static int do_tkill(pid_t tgid, pid_t pid, int sig)
- {
-- struct siginfo info;
-+ struct siginfo info = {};
-
- info.si_signo = sig;
- info.si_errno = 0;
@@ -3138,8 +3169,8 @@ COMPAT_SYSCALL_DEFINE2(sigaltstack,
}
seg = get_fs();
@@ -80032,10 +80599,10 @@ index 7f6ff2b..1ac8f18 100644
.group = GLOBAL_ROOT_GID,
.proc_inum = PROC_USER_INIT_INO,
diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
-index f45e128..a5a5fb6 100644
+index f359dc7..ddc606a 100644
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
-@@ -88,7 +88,7 @@ int create_user_ns(struct cred *new)
+@@ -89,7 +89,7 @@ int create_user_ns(struct cred *new)
return ret;
}
@@ -80044,7 +80611,7 @@ index f45e128..a5a5fb6 100644
/* Leave the new->user_ns reference with the new user namespace. */
ns->parent = parent_ns;
ns->owner = owner;
-@@ -116,15 +116,16 @@ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
+@@ -117,15 +117,16 @@ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
return create_user_ns(cred);
}
@@ -80068,7 +80635,7 @@ index f45e128..a5a5fb6 100644
}
EXPORT_SYMBOL(free_user_ns);
-@@ -815,7 +816,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
+@@ -819,7 +820,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
if (atomic_read(¤t->mm->mm_users) > 1)
return -EINVAL;
@@ -80826,7 +81393,7 @@ index b32b70c..e512eb0 100644
set_page_address(page, (void *)vaddr);
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index d7cec92..b05cc33 100644
+index 88eb939..0bd9e7d 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2008,15 +2008,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
@@ -81191,7 +81758,7 @@ index c6e4dd3..1f41988 100644
/* keep elevated page count for bad page */
return ret;
diff --git a/mm/memory.c b/mm/memory.c
-index f8b734a..38014f5 100644
+index 32a495a..8042dce 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -434,6 +434,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -81325,7 +81892,7 @@ index f8b734a..38014f5 100644
if (addr < vma->vm_start || addr >= vma->vm_end)
return -EFAULT;
-@@ -2402,7 +2414,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -2449,7 +2461,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
BUG_ON(pud_huge(*pud));
@@ -81336,7 +81903,7 @@ index f8b734a..38014f5 100644
if (!pmd)
return -ENOMEM;
do {
-@@ -2422,7 +2436,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -2469,7 +2483,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
unsigned long next;
int err;
@@ -81347,7 +81914,7 @@ index f8b734a..38014f5 100644
if (!pud)
return -ENOMEM;
do {
-@@ -2510,6 +2526,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+@@ -2557,6 +2573,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
copy_user_highpage(dst, src, va, vma);
}
@@ -81534,7 +82101,7 @@ index f8b734a..38014f5 100644
/*
* This routine handles present pages, when users try to write
* to a shared page. It is done by copying the page to a new address
-@@ -2726,6 +2922,12 @@ gotten:
+@@ -2773,6 +2969,12 @@ gotten:
*/
page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
if (likely(pte_same(*page_table, orig_pte))) {
@@ -81547,7 +82114,7 @@ index f8b734a..38014f5 100644
if (old_page) {
if (!PageAnon(old_page)) {
dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2777,6 +2979,10 @@ gotten:
+@@ -2824,6 +3026,10 @@ gotten:
page_remove_rmap(old_page);
}
@@ -81558,7 +82125,7 @@ index f8b734a..38014f5 100644
/* Free the old page.. */
new_page = old_page;
ret |= VM_FAULT_WRITE;
-@@ -3052,6 +3258,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3099,6 +3305,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
swap_free(entry);
if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
try_to_free_swap(page);
@@ -81570,7 +82137,7 @@ index f8b734a..38014f5 100644
unlock_page(page);
if (swapcache) {
/*
-@@ -3075,6 +3286,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3122,6 +3333,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -81582,7 +82149,7 @@ index f8b734a..38014f5 100644
unlock:
pte_unmap_unlock(page_table, ptl);
out:
-@@ -3094,40 +3310,6 @@ out_release:
+@@ -3141,40 +3357,6 @@ out_release:
}
/*
@@ -81623,7 +82190,7 @@ index f8b734a..38014f5 100644
* We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked.
* We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3136,27 +3318,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3183,27 +3365,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long address, pte_t *page_table, pmd_t *pmd,
unsigned int flags)
{
@@ -81656,7 +82223,7 @@ index f8b734a..38014f5 100644
if (unlikely(anon_vma_prepare(vma)))
goto oom;
page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3175,6 +3353,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3222,6 +3400,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (!pte_none(*page_table))
goto release;
@@ -81668,7 +82235,7 @@ index f8b734a..38014f5 100644
inc_mm_counter_fast(mm, MM_ANONPAGES);
page_add_new_anon_rmap(page, vma, address);
setpte:
-@@ -3182,6 +3365,12 @@ setpte:
+@@ -3229,6 +3412,12 @@ setpte:
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -81681,7 +82248,7 @@ index f8b734a..38014f5 100644
unlock:
pte_unmap_unlock(page_table, ptl);
return 0;
-@@ -3325,6 +3514,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3372,6 +3561,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
*/
/* Only go through if we didn't race with anybody else... */
if (likely(pte_same(*page_table, orig_pte))) {
@@ -81694,7 +82261,7 @@ index f8b734a..38014f5 100644
flush_icache_page(vma, page);
entry = mk_pte(page, vma->vm_page_prot);
if (flags & FAULT_FLAG_WRITE)
-@@ -3344,6 +3539,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3391,6 +3586,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
/* no need to invalidate: a not-present page won't be cached */
update_mmu_cache(vma, address, page_table);
@@ -81709,7 +82276,7 @@ index f8b734a..38014f5 100644
} else {
if (cow_page)
mem_cgroup_uncharge_page(cow_page);
-@@ -3665,6 +3868,12 @@ int handle_pte_fault(struct mm_struct *mm,
+@@ -3712,6 +3915,12 @@ int handle_pte_fault(struct mm_struct *mm,
if (flags & FAULT_FLAG_WRITE)
flush_tlb_fix_spurious_fault(vma, address);
}
@@ -81722,7 +82289,7 @@ index f8b734a..38014f5 100644
unlock:
pte_unmap_unlock(pte, ptl);
return 0;
-@@ -3681,6 +3890,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3728,6 +3937,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
pmd_t *pmd;
pte_t *pte;
@@ -81733,7 +82300,7 @@ index f8b734a..38014f5 100644
__set_current_state(TASK_RUNNING);
count_vm_event(PGFAULT);
-@@ -3692,6 +3905,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3739,6 +3952,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
if (unlikely(is_vm_hugetlb_page(vma)))
return hugetlb_fault(mm, vma, address, flags);
@@ -81768,7 +82335,7 @@ index f8b734a..38014f5 100644
retry:
pgd = pgd_offset(mm, address);
pud = pud_alloc(mm, pgd, address);
-@@ -3790,6 +4031,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3837,6 +4078,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -81792,7 +82359,7 @@ index f8b734a..38014f5 100644
#endif /* __PAGETABLE_PUD_FOLDED */
#ifndef __PAGETABLE_PMD_FOLDED
-@@ -3820,11 +4078,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3867,11 +4125,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -81830,7 +82397,7 @@ index f8b734a..38014f5 100644
struct vm_area_struct * vma;
vma = find_vma(current->mm, addr);
-@@ -3857,7 +4139,7 @@ static int __init gate_vma_init(void)
+@@ -3904,7 +4186,7 @@ static int __init gate_vma_init(void)
gate_vma.vm_start = FIXADDR_USER_START;
gate_vma.vm_end = FIXADDR_USER_END;
gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -81839,7 +82406,7 @@ index f8b734a..38014f5 100644
return 0;
}
-@@ -3991,8 +4273,8 @@ out:
+@@ -4038,8 +4320,8 @@ out:
return ret;
}
@@ -81850,7 +82417,7 @@ index f8b734a..38014f5 100644
{
resource_size_t phys_addr;
unsigned long prot = 0;
-@@ -4017,8 +4299,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+@@ -4064,8 +4346,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
* Access another process' address space as given in mm. If non-NULL, use the
* given task for page fault accounting.
*/
@@ -81861,7 +82428,7 @@ index f8b734a..38014f5 100644
{
struct vm_area_struct *vma;
void *old_buf = buf;
-@@ -4026,7 +4308,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4073,7 +4355,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
down_read(&mm->mmap_sem);
/* ignore errors, just check how much was successfully transferred */
while (len) {
@@ -81870,7 +82437,7 @@ index f8b734a..38014f5 100644
void *maddr;
struct page *page = NULL;
-@@ -4085,8 +4367,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4132,8 +4414,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
*
* The caller must hold a reference on @mm.
*/
@@ -81881,7 +82448,7 @@ index f8b734a..38014f5 100644
{
return __access_remote_vm(NULL, mm, addr, buf, len, write);
}
-@@ -4096,11 +4378,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4143,11 +4425,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
* Source/target buffer must be kernel space,
* Do not walk the page table directly, use get_user_pages
*/
@@ -93045,7 +93612,7 @@ index af49721..e85058e 100644
if (err < 0)
return err;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 09b4286..8620fac 100644
+index f4aaf5a..3b04e3b 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2806,11 +2806,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
@@ -104054,27 +104621,8 @@ index 96b919d..c49bb74 100644
+#endif
+
#endif
-diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index cfb7e4d..52058f0 100644
---- a/virt/kvm/ioapic.c
-+++ b/virt/kvm/ioapic.c
-@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
- u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
- u64 redir_content;
-
-- ASSERT(redir_index < IOAPIC_NUM_PINS);
-+ if (redir_index < IOAPIC_NUM_PINS)
-+ redir_content =
-+ ioapic->redirtbl[redir_index].bits;
-+ else
-+ redir_content = ~0ULL;
-
-- redir_content = ioapic->redirtbl[redir_index].bits;
- result = (ioapic->ioregsel & 0x1) ?
- (redir_content >> 32) & 0xffffffff :
- redir_content & 0xffffffff;
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 1cd693a..f4a7b20 100644
+index 10afa34..f29c524 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -75,12 +75,17 @@ LIST_HEAD(vm_list);
@@ -104106,7 +104654,7 @@ index 1cd693a..f4a7b20 100644
(void __user *)(unsigned long)mem->userspace_addr,
mem->memory_size)))
goto out;
-@@ -1783,7 +1788,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
+@@ -1810,7 +1815,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
return 0;
}
@@ -104115,7 +104663,7 @@ index 1cd693a..f4a7b20 100644
.release = kvm_vcpu_release,
.unlocked_ioctl = kvm_vcpu_ioctl,
#ifdef CONFIG_COMPAT
-@@ -2304,7 +2309,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
+@@ -2331,7 +2336,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
return 0;
}
@@ -104124,7 +104672,7 @@ index 1cd693a..f4a7b20 100644
.release = kvm_vm_release,
.unlocked_ioctl = kvm_vm_ioctl,
#ifdef CONFIG_COMPAT
-@@ -2402,7 +2407,7 @@ out:
+@@ -2429,7 +2434,7 @@ out:
return r;
}
@@ -104133,7 +104681,7 @@ index 1cd693a..f4a7b20 100644
.unlocked_ioctl = kvm_dev_ioctl,
.compat_ioctl = kvm_dev_ioctl,
.llseek = noop_llseek,
-@@ -2428,7 +2433,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2455,7 +2460,7 @@ static void hardware_enable_nolock(void *junk)
if (r) {
cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -104142,7 +104690,7 @@ index 1cd693a..f4a7b20 100644
printk(KERN_INFO "kvm: enabling virtualization on "
"CPU%d failed\n", cpu);
}
-@@ -2482,10 +2487,10 @@ static int hardware_enable_all(void)
+@@ -2509,10 +2514,10 @@ static int hardware_enable_all(void)
kvm_usage_count++;
if (kvm_usage_count == 1) {
@@ -104155,7 +104703,7 @@ index 1cd693a..f4a7b20 100644
hardware_disable_all_nolock();
r = -EBUSY;
}
-@@ -2843,7 +2848,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2870,7 +2875,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
kvm_arch_vcpu_put(vcpu);
}
@@ -104164,7 +104712,7 @@ index 1cd693a..f4a7b20 100644
struct module *module)
{
int r;
-@@ -2879,7 +2884,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2906,7 +2911,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
if (!vcpu_align)
vcpu_align = __alignof__(struct kvm_vcpu);
kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -104173,7 +104721,7 @@ index 1cd693a..f4a7b20 100644
if (!kvm_vcpu_cache) {
r = -ENOMEM;
goto out_free_3;
-@@ -2889,9 +2894,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2916,9 +2921,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
if (r)
goto out_free;
@@ -104185,7 +104733,7 @@ index 1cd693a..f4a7b20 100644
r = misc_register(&kvm_dev);
if (r) {
-@@ -2901,9 +2908,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2928,9 +2935,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
register_syscore_ops(&kvm_syscore_ops);
diff --git a/3.8.8/4425_grsec_remove_EI_PAX.patch b/3.8.10/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.8.8/4425_grsec_remove_EI_PAX.patch
rename to 3.8.10/4425_grsec_remove_EI_PAX.patch
diff --git a/3.8.8/4430_grsec-remove-localversion-grsec.patch b/3.8.10/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.8.8/4430_grsec-remove-localversion-grsec.patch
rename to 3.8.10/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.8.8/4435_grsec-mute-warnings.patch b/3.8.10/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.8.8/4435_grsec-mute-warnings.patch
rename to 3.8.10/4435_grsec-mute-warnings.patch
diff --git a/3.8.8/4440_grsec-remove-protected-paths.patch b/3.8.10/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.8.8/4440_grsec-remove-protected-paths.patch
rename to 3.8.10/4440_grsec-remove-protected-paths.patch
diff --git a/3.8.8/4450_grsec-kconfig-default-gids.patch b/3.8.10/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.8.8/4450_grsec-kconfig-default-gids.patch
rename to 3.8.10/4450_grsec-kconfig-default-gids.patch
diff --git a/3.8.8/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.10/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.8.8/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.8.10/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.8.8/4470_disable-compat_vdso.patch b/3.8.10/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.8.8/4470_disable-compat_vdso.patch
rename to 3.8.10/4470_disable-compat_vdso.patch
diff --git a/3.8.8/1006_linux-3.8.7.patch b/3.8.8/1006_linux-3.8.7.patch
deleted file mode 100644
index 99e0538..0000000
--- a/3.8.8/1006_linux-3.8.7.patch
+++ /dev/null
@@ -1,2238 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 10075d6..85204da 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 8
--SUBLEVEL = 6
-+SUBLEVEL = 7
- EXTRAVERSION =
- NAME = Displaced Humerus Anterior
-
-diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
-index 4d4c046..1383f86 100644
---- a/arch/alpha/kernel/sys_nautilus.c
-+++ b/arch/alpha/kernel/sys_nautilus.c
-@@ -188,6 +188,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
- extern void free_reserved_mem(void *, void *);
- extern void pcibios_claim_one_bus(struct pci_bus *);
-
-+static struct resource irongate_io = {
-+ .name = "Irongate PCI IO",
-+ .flags = IORESOURCE_IO,
-+};
- static struct resource irongate_mem = {
- .name = "Irongate PCI MEM",
- .flags = IORESOURCE_MEM,
-@@ -209,6 +213,7 @@ nautilus_init_pci(void)
-
- irongate = pci_get_bus_and_slot(0, 0);
- bus->self = irongate;
-+ bus->resource[0] = &irongate_io;
- bus->resource[1] = &irongate_mem;
-
- pci_bus_size_bridges(bus);
-diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
-index 1a89824..3b6de7a 100644
---- a/arch/arm/mach-exynos/common.c
-+++ b/arch/arm/mach-exynos/common.c
-@@ -299,6 +299,7 @@ void exynos4_restart(char mode, const char *cmd)
-
- void exynos5_restart(char mode, const char *cmd)
- {
-+ struct device_node *np;
- u32 val;
- void __iomem *addr;
-
-@@ -306,8 +307,9 @@ void exynos5_restart(char mode, const char *cmd)
- val = 0x1;
- addr = EXYNOS_SWRESET;
- } else if (of_machine_is_compatible("samsung,exynos5440")) {
-- val = (0x10 << 20) | (0x1 << 16);
-- addr = EXYNOS5440_SWRESET;
-+ np = of_find_compatible_node(NULL, NULL, "samsung,exynos5440-clock");
-+ addr = of_iomap(np, 0) + 0xcc;
-+ val = (0xfff << 20) | (0x1 << 16);
- } else {
- pr_err("%s: cannot support non-DT\n", __func__);
- return;
-diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
-index 1658676..33d0671 100644
---- a/arch/mips/kernel/mcount.S
-+++ b/arch/mips/kernel/mcount.S
-@@ -46,10 +46,9 @@
- PTR_L a5, PT_R9(sp)
- PTR_L a6, PT_R10(sp)
- PTR_L a7, PT_R11(sp)
--#else
-- PTR_ADDIU sp, PT_SIZE
- #endif
--.endm
-+ PTR_ADDIU sp, PT_SIZE
-+ .endm
-
- .macro RETURN_BACK
- jr ra
-@@ -68,7 +67,11 @@ NESTED(ftrace_caller, PT_SIZE, ra)
- .globl _mcount
- _mcount:
- b ftrace_stub
-- addiu sp,sp,8
-+#ifdef CONFIG_32BIT
-+ addiu sp,sp,8
-+#else
-+ nop
-+#endif
-
- /* When tracing is activated, it calls ftrace_caller+8 (aka here) */
- lw t1, function_trace_stop
-diff --git a/arch/mips/lib/bitops.c b/arch/mips/lib/bitops.c
-index 239a9c9..f3f7756 100644
---- a/arch/mips/lib/bitops.c
-+++ b/arch/mips/lib/bitops.c
-@@ -90,12 +90,12 @@ int __mips_test_and_set_bit(unsigned long nr,
- unsigned bit = nr & SZLONG_MASK;
- unsigned long mask;
- unsigned long flags;
-- unsigned long res;
-+ int res;
-
- a += nr >> SZLONG_LOG;
- mask = 1UL << bit;
- raw_local_irq_save(flags);
-- res = (mask & *a);
-+ res = (mask & *a) != 0;
- *a |= mask;
- raw_local_irq_restore(flags);
- return res;
-@@ -116,12 +116,12 @@ int __mips_test_and_set_bit_lock(unsigned long nr,
- unsigned bit = nr & SZLONG_MASK;
- unsigned long mask;
- unsigned long flags;
-- unsigned long res;
-+ int res;
-
- a += nr >> SZLONG_LOG;
- mask = 1UL << bit;
- raw_local_irq_save(flags);
-- res = (mask & *a);
-+ res = (mask & *a) != 0;
- *a |= mask;
- raw_local_irq_restore(flags);
- return res;
-@@ -141,12 +141,12 @@ int __mips_test_and_clear_bit(unsigned long nr, volatile unsigned long *addr)
- unsigned bit = nr & SZLONG_MASK;
- unsigned long mask;
- unsigned long flags;
-- unsigned long res;
-+ int res;
-
- a += nr >> SZLONG_LOG;
- mask = 1UL << bit;
- raw_local_irq_save(flags);
-- res = (mask & *a);
-+ res = (mask & *a) != 0;
- *a &= ~mask;
- raw_local_irq_restore(flags);
- return res;
-@@ -166,12 +166,12 @@ int __mips_test_and_change_bit(unsigned long nr, volatile unsigned long *addr)
- unsigned bit = nr & SZLONG_MASK;
- unsigned long mask;
- unsigned long flags;
-- unsigned long res;
-+ int res;
-
- a += nr >> SZLONG_LOG;
- mask = 1UL << bit;
- raw_local_irq_save(flags);
-- res = (mask & *a);
-+ res = (mask & *a) != 0;
- *a ^= mask;
- raw_local_irq_restore(flags);
- return res;
-diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
-index 0da39fe..299731e 100644
---- a/arch/powerpc/platforms/pseries/lpar.c
-+++ b/arch/powerpc/platforms/pseries/lpar.c
-@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
- (0x1UL << 4), &dummy1, &dummy2);
- if (lpar_rc == H_SUCCESS)
- return i;
-- BUG_ON(lpar_rc != H_NOT_FOUND);
-+
-+ /*
-+ * The test for adjunct partition is performed before the
-+ * ANDCOND test. H_RESOURCE may be returned, so we need to
-+ * check for that as well.
-+ */
-+ BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
-
- slot_offset++;
- slot_offset &= 0x7;
-diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index 8a84501..5ef205c 100644
---- a/arch/x86/boot/compressed/Makefile
-+++ b/arch/x86/boot/compressed/Makefile
-@@ -4,7 +4,7 @@
- # create a compressed vmlinux image from the original vmlinux
- #
-
--targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo head_$(BITS).o misc.o string.o cmdline.o early_serial_console.o piggy.o
-+targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo
-
- KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
- KBUILD_CFLAGS += -fno-strict-aliasing -fPIC
-@@ -29,7 +29,6 @@ VMLINUX_OBJS = $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \
- $(obj)/piggy.o
-
- $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
--$(obj)/efi_stub_$(BITS).o: KBUILD_CLFAGS += -fshort-wchar -mno-red-zone
-
- ifeq ($(CONFIG_EFI_STUB), y)
- VMLINUX_OBJS += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
-@@ -43,7 +42,7 @@ OBJCOPYFLAGS_vmlinux.bin := -R .comment -S
- $(obj)/vmlinux.bin: vmlinux FORCE
- $(call if_changed,objcopy)
-
--targets += vmlinux.bin.all vmlinux.relocs
-+targets += $(patsubst $(obj)/%,%,$(VMLINUX_OBJS)) vmlinux.bin.all vmlinux.relocs
-
- CMD_RELOCS = arch/x86/tools/relocs
- quiet_cmd_relocs = RELOCS $@
-diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
-index 1ace47b..2e188d6 100644
---- a/arch/x86/include/asm/syscall.h
-+++ b/arch/x86/include/asm/syscall.h
-@@ -29,13 +29,13 @@ extern const unsigned long sys_call_table[];
- */
- static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
- {
-- return regs->orig_ax & __SYSCALL_MASK;
-+ return regs->orig_ax;
- }
-
- static inline void syscall_rollback(struct task_struct *task,
- struct pt_regs *regs)
- {
-- regs->ax = regs->orig_ax & __SYSCALL_MASK;
-+ regs->ax = regs->orig_ax;
- }
-
- static inline long syscall_get_error(struct task_struct *task,
-diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
-index 7881477..6d2f7c0 100644
---- a/block/blk-sysfs.c
-+++ b/block/blk-sysfs.c
-@@ -229,6 +229,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
- unsigned long val; \
- ssize_t ret; \
- ret = queue_var_store(&val, page, count); \
-+ if (ret < 0) \
-+ return ret; \
- if (neg) \
- val = !val; \
- \
-diff --git a/crypto/gcm.c b/crypto/gcm.c
-index 1a25263..b97b186 100644
---- a/crypto/gcm.c
-+++ b/crypto/gcm.c
-@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
-
- struct crypto_rfc4543_req_ctx {
- u8 auth_tag[16];
-+ u8 assocbuf[32];
- struct scatterlist cipher[1];
- struct scatterlist payload[2];
- struct scatterlist assoc[2];
-@@ -1142,9 +1143,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
- scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
- assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
-
-- sg_init_table(assoc, 2);
-- sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
-- req->assoc->offset);
-+ if (req->assoc->length == req->assoclen) {
-+ sg_init_table(assoc, 2);
-+ sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
-+ req->assoc->offset);
-+ } else {
-+ BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
-+
-+ scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
-+ req->assoclen, 0);
-+
-+ sg_init_table(assoc, 2);
-+ sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
-+ }
- scatterwalk_crypto_chain(assoc, payload, 0, 2);
-
- aead_request_set_tfm(subreq, ctx->child);
-diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
-index 7928d4d..eb73798 100644
---- a/drivers/acpi/pci_root.c
-+++ b/drivers/acpi/pci_root.c
-@@ -454,7 +454,6 @@ static int acpi_pci_root_add(struct acpi_device *device)
- acpi_handle handle;
- struct acpi_device *child;
- u32 flags, base_flags;
-- bool is_osc_granted = false;
-
- root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
- if (!root)
-@@ -525,60 +524,6 @@ static int acpi_pci_root_add(struct acpi_device *device)
- flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
- acpi_pci_osc_support(root, flags);
-
-- /* Indicate support for various _OSC capabilities. */
-- if (pci_ext_cfg_avail())
-- flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
-- if (pcie_aspm_support_enabled()) {
-- flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
-- OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
-- }
-- if (pci_msi_enabled())
-- flags |= OSC_MSI_SUPPORT;
-- if (flags != base_flags) {
-- status = acpi_pci_osc_support(root, flags);
-- if (ACPI_FAILURE(status)) {
-- dev_info(&device->dev, "ACPI _OSC support "
-- "notification failed, disabling PCIe ASPM\n");
-- pcie_no_aspm();
-- flags = base_flags;
-- }
-- }
-- if (!pcie_ports_disabled
-- && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
-- flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
-- | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
-- | OSC_PCI_EXPRESS_PME_CONTROL;
--
-- if (pci_aer_available()) {
-- if (aer_acpi_firmware_first())
-- dev_dbg(&device->dev,
-- "PCIe errors handled by BIOS.\n");
-- else
-- flags |= OSC_PCI_EXPRESS_AER_CONTROL;
-- }
--
-- dev_info(&device->dev,
-- "Requesting ACPI _OSC control (0x%02x)\n", flags);
--
-- status = acpi_pci_osc_control_set(device->handle, &flags,
-- OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
-- if (ACPI_SUCCESS(status)) {
-- is_osc_granted = true;
-- dev_info(&device->dev,
-- "ACPI _OSC control (0x%02x) granted\n", flags);
-- } else {
-- is_osc_granted = false;
-- dev_info(&device->dev,
-- "ACPI _OSC request failed (%s), "
-- "returned control mask: 0x%02x\n",
-- acpi_format_exception(status), flags);
-- }
-- } else {
-- dev_info(&device->dev,
-- "Unable to request _OSC control "
-- "(_OSC support mask: 0x%02x)\n", flags);
-- }
--
- /*
- * TBD: Need PCI interface for enumeration/configuration of roots.
- */
-@@ -618,14 +563,66 @@ static int acpi_pci_root_add(struct acpi_device *device)
- list_for_each_entry(child, &device->children, node)
- acpi_pci_bridge_scan(child);
-
-- /* ASPM setting */
-- if (is_osc_granted) {
-- if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM)
-- pcie_clear_aspm(root->bus);
-+ /* Indicate support for various _OSC capabilities. */
-+ if (pci_ext_cfg_avail())
-+ flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
-+ if (pcie_aspm_support_enabled())
-+ flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
-+ OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
-+ if (pci_msi_enabled())
-+ flags |= OSC_MSI_SUPPORT;
-+ if (flags != base_flags) {
-+ status = acpi_pci_osc_support(root, flags);
-+ if (ACPI_FAILURE(status)) {
-+ dev_info(root->bus->bridge, "ACPI _OSC support "
-+ "notification failed, disabling PCIe ASPM\n");
-+ pcie_no_aspm();
-+ flags = base_flags;
-+ }
-+ }
-+
-+ if (!pcie_ports_disabled
-+ && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
-+ flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
-+ | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
-+ | OSC_PCI_EXPRESS_PME_CONTROL;
-+
-+ if (pci_aer_available()) {
-+ if (aer_acpi_firmware_first())
-+ dev_dbg(root->bus->bridge,
-+ "PCIe errors handled by BIOS.\n");
-+ else
-+ flags |= OSC_PCI_EXPRESS_AER_CONTROL;
-+ }
-+
-+ dev_info(root->bus->bridge,
-+ "Requesting ACPI _OSC control (0x%02x)\n", flags);
-+
-+ status = acpi_pci_osc_control_set(device->handle, &flags,
-+ OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
-+ if (ACPI_SUCCESS(status)) {
-+ dev_info(root->bus->bridge,
-+ "ACPI _OSC control (0x%02x) granted\n", flags);
-+ if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
-+ /*
-+ * We have ASPM control, but the FADT indicates
-+ * that it's unsupported. Clear it.
-+ */
-+ pcie_clear_aspm(root->bus);
-+ }
-+ } else {
-+ dev_info(root->bus->bridge,
-+ "ACPI _OSC request failed (%s), "
-+ "returned control mask: 0x%02x\n",
-+ acpi_format_exception(status), flags);
-+ pr_info("ACPI _OSC control for PCIe not granted, "
-+ "disabling ASPM\n");
-+ pcie_no_aspm();
-+ }
- } else {
-- pr_info("ACPI _OSC control for PCIe not granted, "
-- "disabling ASPM\n");
-- pcie_no_aspm();
-+ dev_info(root->bus->bridge,
-+ "Unable to request _OSC control "
-+ "(_OSC support mask: 0x%02x)\n", flags);
- }
-
- pci_acpi_add_bus_pm_notifier(device, root->bus);
-diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
-index d2ba439..78283bb 100644
---- a/drivers/ata/ata_piix.c
-+++ b/drivers/ata/ata_piix.c
-@@ -150,6 +150,7 @@ enum piix_controller_ids {
- tolapai_sata,
- piix_pata_vmw, /* PIIX4 for VMware, spurious DMA_ERR */
- ich8_sata_snb,
-+ ich8_2port_sata_snb,
- };
-
- struct piix_map_db {
-@@ -304,7 +305,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
- /* SATA Controller IDE (Lynx Point) */
- { 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
- /* SATA Controller IDE (Lynx Point) */
-- { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
-+ { 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
- /* SATA Controller IDE (Lynx Point) */
- { 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
- /* SATA Controller IDE (Lynx Point-LP) */
-@@ -439,6 +440,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
- [ich8m_apple_sata] = &ich8m_apple_map_db,
- [tolapai_sata] = &tolapai_map_db,
- [ich8_sata_snb] = &ich8_map_db,
-+ [ich8_2port_sata_snb] = &ich8_2port_map_db,
- };
-
- static struct pci_bits piix_enable_bits[] = {
-@@ -1242,6 +1244,16 @@ static struct ata_port_info piix_port_info[] = {
- .udma_mask = ATA_UDMA6,
- .port_ops = &piix_sata_ops,
- },
-+
-+ [ich8_2port_sata_snb] =
-+ {
-+ .flags = PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
-+ | PIIX_FLAG_PIO16,
-+ .pio_mask = ATA_PIO4,
-+ .mwdma_mask = ATA_MWDMA2,
-+ .udma_mask = ATA_UDMA6,
-+ .port_ops = &piix_sata_ops,
-+ },
- };
-
- #define AHCI_PCI_BAR 5
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 46cd3f4..501c209 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -2329,7 +2329,7 @@ int ata_dev_configure(struct ata_device *dev)
- * from SATA Settings page of Identify Device Data Log.
- */
- if (ata_id_has_devslp(dev->id)) {
-- u8 sata_setting[ATA_SECT_SIZE];
-+ u8 *sata_setting = ap->sector_buf;
- int i, j;
-
- dev->flags |= ATA_DFLAG_DEVSLP;
-@@ -2437,6 +2437,9 @@ int ata_dev_configure(struct ata_device *dev)
- dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
- dev->max_sectors);
-
-+ if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
-+ dev->max_sectors = ATA_MAX_SECTORS_LBA48;
-+
- if (ap->ops->dev_config)
- ap->ops->dev_config(dev);
-
-@@ -4098,6 +4101,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- /* Weird ATAPI devices */
- { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 },
- { "QUANTUM DAT DAT72-000", NULL, ATA_HORKAGE_ATAPI_MOD16_DMA },
-+ { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
-
- /* Devices we expect to fail diagnostics */
-
-diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
-index e6732cf..79f4fca 100644
---- a/drivers/base/regmap/regcache-rbtree.c
-+++ b/drivers/base/regmap/regcache-rbtree.c
-@@ -398,7 +398,7 @@ static int regcache_rbtree_sync(struct regmap *map, unsigned int min,
- base = 0;
-
- if (max < rbnode->base_reg + rbnode->blklen)
-- end = rbnode->base_reg + rbnode->blklen - max;
-+ end = max - rbnode->base_reg + 1;
- else
- end = rbnode->blklen;
-
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index f00b059..ab3a020 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -662,12 +662,12 @@ struct regmap *regmap_init(struct device *dev,
- }
- }
-
-+ regmap_debugfs_init(map, config->name);
-+
- ret = regcache_init(map, config);
- if (ret != 0)
- goto err_range;
-
-- regmap_debugfs_init(map, config->name);
--
- /* Add a devres resource for dev_get_regmap() */
- m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
- if (!m) {
-diff --git a/drivers/cpufreq/exynos-cpufreq.c b/drivers/cpufreq/exynos-cpufreq.c
-index 7012ea8..41fc550 100644
---- a/drivers/cpufreq/exynos-cpufreq.c
-+++ b/drivers/cpufreq/exynos-cpufreq.c
-@@ -222,8 +222,6 @@ static int exynos_cpufreq_cpu_init(struct cpufreq_policy *policy)
-
- cpufreq_frequency_table_get_attr(exynos_info->freq_table, policy->cpu);
-
-- locking_frequency = exynos_getspeed(0);
--
- /* set the transition latency value */
- policy->cpuinfo.transition_latency = 100000;
-
-@@ -288,6 +286,8 @@ static int __init exynos_cpufreq_init(void)
- goto err_vdd_arm;
- }
-
-+ locking_frequency = exynos_getspeed(0);
-+
- register_pm_notifier(&exynos_cpufreq_nb);
-
- if (cpufreq_register_driver(&exynos_driver)) {
-diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
-index 8bc5fef..22c9063 100644
---- a/drivers/crypto/ux500/cryp/cryp_core.c
-+++ b/drivers/crypto/ux500/cryp/cryp_core.c
-@@ -1750,7 +1750,7 @@ static struct platform_driver cryp_driver = {
- .shutdown = ux500_cryp_shutdown,
- .driver = {
- .owner = THIS_MODULE,
-- .name = "cryp1"
-+ .name = "cryp1",
- .pm = &ux500_cryp_pm,
- }
- };
-diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
-index cdae207..6c3fca9 100644
---- a/drivers/eisa/pci_eisa.c
-+++ b/drivers/eisa/pci_eisa.c
-@@ -19,10 +19,10 @@
- /* There is only *one* pci_eisa device per machine, right ? */
- static struct eisa_root_device pci_eisa_root;
-
--static int __init pci_eisa_init(struct pci_dev *pdev,
-- const struct pci_device_id *ent)
-+static int __init pci_eisa_init(struct pci_dev *pdev)
- {
-- int rc;
-+ int rc, i;
-+ struct resource *res, *bus_res = NULL;
-
- if ((rc = pci_enable_device (pdev))) {
- printk (KERN_ERR "pci_eisa : Could not enable device %s\n",
-@@ -30,9 +30,30 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
- return rc;
- }
-
-+ /*
-+ * The Intel 82375 PCI-EISA bridge is a subtractive-decode PCI
-+ * device, so the resources available on EISA are the same as those
-+ * available on the 82375 bus. This works the same as a PCI-PCI
-+ * bridge in subtractive-decode mode (see pci_read_bridge_bases()).
-+ * We assume other PCI-EISA bridges are similar.
-+ *
-+ * eisa_root_register() can only deal with a single io port resource,
-+ * so we use the first valid io port resource.
-+ */
-+ pci_bus_for_each_resource(pdev->bus, res, i)
-+ if (res && (res->flags & IORESOURCE_IO)) {
-+ bus_res = res;
-+ break;
-+ }
-+
-+ if (!bus_res) {
-+ dev_err(&pdev->dev, "No resources available\n");
-+ return -1;
-+ }
-+
- pci_eisa_root.dev = &pdev->dev;
-- pci_eisa_root.res = pdev->bus->resource[0];
-- pci_eisa_root.bus_base_addr = pdev->bus->resource[0]->start;
-+ pci_eisa_root.res = bus_res;
-+ pci_eisa_root.bus_base_addr = bus_res->start;
- pci_eisa_root.slots = EISA_MAX_SLOTS;
- pci_eisa_root.dma_mask = pdev->dma_mask;
- dev_set_drvdata(pci_eisa_root.dev, &pci_eisa_root);
-@@ -45,22 +66,26 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
- return 0;
- }
-
--static struct pci_device_id pci_eisa_pci_tbl[] = {
-- { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
-- PCI_CLASS_BRIDGE_EISA << 8, 0xffff00, 0 },
-- { 0, }
--};
-+/*
-+ * We have to call pci_eisa_init_early() before pnpacpi_init()/isapnp_init().
-+ * Otherwise pnp resource will get enabled early and could prevent eisa
-+ * to be initialized.
-+ * Also need to make sure pci_eisa_init_early() is called after
-+ * x86/pci_subsys_init().
-+ * So need to use subsys_initcall_sync with it.
-+ */
-+static int __init pci_eisa_init_early(void)
-+{
-+ struct pci_dev *dev = NULL;
-+ int ret;
-
--static struct pci_driver __refdata pci_eisa_driver = {
-- .name = "pci_eisa",
-- .id_table = pci_eisa_pci_tbl,
-- .probe = pci_eisa_init,
--};
-+ for_each_pci_dev(dev)
-+ if ((dev->class >> 8) == PCI_CLASS_BRIDGE_EISA) {
-+ ret = pci_eisa_init(dev);
-+ if (ret)
-+ return ret;
-+ }
-
--static int __init pci_eisa_init_module (void)
--{
-- return pci_register_driver (&pci_eisa_driver);
-+ return 0;
- }
--
--device_initcall(pci_eisa_init_module);
--MODULE_DEVICE_TABLE(pci, pci_eisa_pci_tbl);
-+subsys_initcall_sync(pci_eisa_init_early);
-diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c
-index 770476a..3ce5bc3 100644
---- a/drivers/gpio/gpio-stmpe.c
-+++ b/drivers/gpio/gpio-stmpe.c
-@@ -307,11 +307,15 @@ static const struct irq_domain_ops stmpe_gpio_irq_simple_ops = {
- .xlate = irq_domain_xlate_twocell,
- };
-
--static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio)
-+static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio,
-+ struct device_node *np)
- {
-- int base = stmpe_gpio->irq_base;
-+ int base = 0;
-
-- stmpe_gpio->domain = irq_domain_add_simple(NULL,
-+ if (!np)
-+ base = stmpe_gpio->irq_base;
-+
-+ stmpe_gpio->domain = irq_domain_add_simple(np,
- stmpe_gpio->chip.ngpio, base,
- &stmpe_gpio_irq_simple_ops, stmpe_gpio);
- if (!stmpe_gpio->domain) {
-@@ -346,6 +350,9 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
- stmpe_gpio->chip = template_chip;
- stmpe_gpio->chip.ngpio = stmpe->num_gpios;
- stmpe_gpio->chip.dev = &pdev->dev;
-+#ifdef CONFIG_OF
-+ stmpe_gpio->chip.of_node = np;
-+#endif
- stmpe_gpio->chip.base = pdata ? pdata->gpio_base : -1;
-
- if (pdata)
-@@ -366,7 +373,7 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
- goto out_free;
-
- if (irq >= 0) {
-- ret = stmpe_gpio_irq_init(stmpe_gpio);
-+ ret = stmpe_gpio_irq_init(stmpe_gpio, np);
- if (ret)
- goto out_disable;
-
-diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index 133b413..32d7775 100644
---- a/drivers/gpu/drm/drm_fops.c
-+++ b/drivers/gpu/drm/drm_fops.c
-@@ -123,6 +123,7 @@ int drm_open(struct inode *inode, struct file *filp)
- int retcode = 0;
- int need_setup = 0;
- struct address_space *old_mapping;
-+ struct address_space *old_imapping;
-
- minor = idr_find(&drm_minors_idr, minor_id);
- if (!minor)
-@@ -137,6 +138,7 @@ int drm_open(struct inode *inode, struct file *filp)
- if (!dev->open_count++)
- need_setup = 1;
- mutex_lock(&dev->struct_mutex);
-+ old_imapping = inode->i_mapping;
- old_mapping = dev->dev_mapping;
- if (old_mapping == NULL)
- dev->dev_mapping = &inode->i_data;
-@@ -159,8 +161,8 @@ int drm_open(struct inode *inode, struct file *filp)
-
- err_undo:
- mutex_lock(&dev->struct_mutex);
-- filp->f_mapping = old_mapping;
-- inode->i_mapping = old_mapping;
-+ filp->f_mapping = old_imapping;
-+ inode->i_mapping = old_imapping;
- iput(container_of(dev->dev_mapping, struct inode, i_data));
- dev->dev_mapping = old_mapping;
- mutex_unlock(&dev->struct_mutex);
-diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index 7adf5a7..ba8805a 100644
---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-@@ -43,7 +43,7 @@ eb_create(int size)
- {
- struct eb_objects *eb;
- int count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
-- BUILD_BUG_ON(!is_power_of_2(PAGE_SIZE / sizeof(struct hlist_head)));
-+ BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head));
- while (count > size)
- count >>= 1;
- eb = kzalloc(count*sizeof(struct hlist_head) +
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index b52ed09..625b091 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -45,6 +45,9 @@
-
- struct intel_crt {
- struct intel_encoder base;
-+ /* DPMS state is stored in the connector, which we need in the
-+ * encoder's enable/disable callbacks */
-+ struct intel_connector *connector;
- bool force_hotplug_required;
- u32 adpa_reg;
- };
-@@ -81,29 +84,6 @@ static bool intel_crt_get_hw_state(struct intel_encoder *encoder,
- return true;
- }
-
--static void intel_disable_crt(struct intel_encoder *encoder)
--{
-- struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
-- struct intel_crt *crt = intel_encoder_to_crt(encoder);
-- u32 temp;
--
-- temp = I915_READ(crt->adpa_reg);
-- temp |= ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE;
-- temp &= ~ADPA_DAC_ENABLE;
-- I915_WRITE(crt->adpa_reg, temp);
--}
--
--static void intel_enable_crt(struct intel_encoder *encoder)
--{
-- struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
-- struct intel_crt *crt = intel_encoder_to_crt(encoder);
-- u32 temp;
--
-- temp = I915_READ(crt->adpa_reg);
-- temp |= ADPA_DAC_ENABLE;
-- I915_WRITE(crt->adpa_reg, temp);
--}
--
- /* Note: The caller is required to filter out dpms modes not supported by the
- * platform. */
- static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
-@@ -135,6 +115,19 @@ static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
- I915_WRITE(crt->adpa_reg, temp);
- }
-
-+static void intel_disable_crt(struct intel_encoder *encoder)
-+{
-+ intel_crt_set_dpms(encoder, DRM_MODE_DPMS_OFF);
-+}
-+
-+static void intel_enable_crt(struct intel_encoder *encoder)
-+{
-+ struct intel_crt *crt = intel_encoder_to_crt(encoder);
-+
-+ intel_crt_set_dpms(encoder, crt->connector->base.dpms);
-+}
-+
-+
- static void intel_crt_dpms(struct drm_connector *connector, int mode)
- {
- struct drm_device *dev = connector->dev;
-@@ -746,6 +739,7 @@ void intel_crt_init(struct drm_device *dev)
- }
-
- connector = &intel_connector->base;
-+ crt->connector = intel_connector;
- drm_connector_init(dev, &intel_connector->base,
- &intel_crt_connector_funcs, DRM_MODE_CONNECTOR_VGA);
-
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index e6e4df7..d3f834a 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -8901,6 +8901,15 @@ static struct intel_quirk intel_quirks[] = {
-
- /* Acer Aspire 4736Z */
- { 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
-+
-+ /* Acer/eMachines G725 */
-+ { 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
-+
-+ /* Acer/eMachines e725 */
-+ { 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
-+
-+ /* Acer/Packard Bell NCL20 */
-+ { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
- };
-
- static void intel_init_quirks(struct drm_device *dev)
-diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
-index 4f50c40..2e7c949 100644
---- a/drivers/gpu/drm/mgag200/mgag200_mode.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
-@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- int i;
- unsigned char misc = 0;
- unsigned char ext_vga[6];
-- unsigned char ext_vga_index24;
-- unsigned char dac_index90 = 0;
- u8 bppshift;
-
- static unsigned char dacvalue[] = {
-@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- option2 = 0x0000b000;
- break;
- case G200_ER:
-- dac_index90 = 0;
- break;
- }
-
-@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- WREG_DAC(i, dacvalue[i]);
- }
-
-- if (mdev->type == G200_ER) {
-- WREG_DAC(0x90, dac_index90);
-- }
--
-+ if (mdev->type == G200_ER)
-+ WREG_DAC(0x90, 0);
-
- if (option)
- pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
-@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- if (mdev->type == G200_WB)
- ext_vga[1] |= 0x88;
-
-- ext_vga_index24 = 0x05;
--
- /* Set pixel clocks */
- misc = 0x2d;
- WREG8(MGA_MISC_OUT, misc);
-@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- }
-
- if (mdev->type == G200_ER)
-- WREG_ECRT(24, ext_vga_index24);
-+ WREG_ECRT(0x24, 0x5);
-
- if (mdev->type == G200_EV) {
- WREG_ECRT(6, 0);
-diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
-index 4124192..b569fe8 100644
---- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
-@@ -386,7 +386,7 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
- struct nouveau_drm *drm = nouveau_drm(dev);
- struct nouveau_device *device = nv_device(drm->device);
- struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
-- struct nouveau_abi16_chan *chan, *temp;
-+ struct nouveau_abi16_chan *chan = NULL, *temp;
- struct nouveau_abi16_ntfy *ntfy;
- struct nouveau_object *object;
- struct nv_dma_class args = {};
-@@ -399,10 +399,11 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
- if (unlikely(nv_device(abi16->device)->card_type >= NV_C0))
- return nouveau_abi16_put(abi16, -EINVAL);
-
-- list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
-- if (chan->chan->handle == (NVDRM_CHAN | info->channel))
-+ list_for_each_entry(temp, &abi16->channels, head) {
-+ if (temp->chan->handle == (NVDRM_CHAN | info->channel)) {
-+ chan = temp;
- break;
-- chan = NULL;
-+ }
- }
-
- if (!chan)
-@@ -454,17 +455,18 @@ nouveau_abi16_ioctl_gpuobj_free(ABI16_IOCTL_ARGS)
- {
- struct drm_nouveau_gpuobj_free *fini = data;
- struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
-- struct nouveau_abi16_chan *chan, *temp;
-+ struct nouveau_abi16_chan *chan = NULL, *temp;
- struct nouveau_abi16_ntfy *ntfy;
- int ret;
-
- if (unlikely(!abi16))
- return -ENOMEM;
-
-- list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
-- if (chan->chan->handle == (NVDRM_CHAN | fini->channel))
-+ list_for_each_entry(temp, &abi16->channels, head) {
-+ if (temp->chan->handle == (NVDRM_CHAN | fini->channel)) {
-+ chan = temp;
- break;
-- chan = NULL;
-+ }
- }
-
- if (!chan)
-diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
-index 25ddf3e..811062c 100644
---- a/drivers/hid/hid-magicmouse.c
-+++ b/drivers/hid/hid-magicmouse.c
-@@ -462,6 +462,21 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
- return 0;
- }
-
-+static void magicmouse_input_configured(struct hid_device *hdev,
-+ struct hid_input *hi)
-+
-+{
-+ struct magicmouse_sc *msc = hid_get_drvdata(hdev);
-+
-+ int ret = magicmouse_setup_input(msc->input, hdev);
-+ if (ret) {
-+ hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
-+ /* clean msc->input to notify probe() of the failure */
-+ msc->input = NULL;
-+ }
-+}
-+
-+
- static int magicmouse_probe(struct hid_device *hdev,
- const struct hid_device_id *id)
- {
-@@ -493,15 +508,10 @@ static int magicmouse_probe(struct hid_device *hdev,
- goto err_free;
- }
-
-- /* We do this after hid-input is done parsing reports so that
-- * hid-input uses the most natural button and axis IDs.
-- */
-- if (msc->input) {
-- ret = magicmouse_setup_input(msc->input, hdev);
-- if (ret) {
-- hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
-- goto err_stop_hw;
-- }
-+ if (!msc->input) {
-+ hid_err(hdev, "magicmouse input not registered\n");
-+ ret = -ENOMEM;
-+ goto err_stop_hw;
- }
-
- if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
-@@ -568,6 +578,7 @@ static struct hid_driver magicmouse_driver = {
- .remove = magicmouse_remove,
- .raw_event = magicmouse_raw_event,
- .input_mapping = magicmouse_input_mapping,
-+ .input_configured = magicmouse_input_configured,
- };
-
- static int __init magicmouse_init(void)
-diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
-index db713c0..461a0d7 100644
---- a/drivers/hwspinlock/hwspinlock_core.c
-+++ b/drivers/hwspinlock/hwspinlock_core.c
-@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
- ret = pm_runtime_get_sync(dev);
- if (ret < 0) {
- dev_err(dev, "%s: can't power on device\n", __func__);
-+ pm_runtime_put_noidle(dev);
-+ module_put(dev->driver->owner);
- return ret;
- }
-
-diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-index b3e3294..0d03d38 100644
---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-@@ -7858,12 +7858,19 @@ static int __init ixgbe_init_module(void)
- ixgbe_dbg_init();
- #endif /* CONFIG_DEBUG_FS */
-
-+ ret = pci_register_driver(&ixgbe_driver);
-+ if (ret) {
-+#ifdef CONFIG_DEBUG_FS
-+ ixgbe_dbg_exit();
-+#endif /* CONFIG_DEBUG_FS */
-+ return ret;
-+ }
-+
- #ifdef CONFIG_IXGBE_DCA
- dca_register_notify(&dca_notifier);
- #endif
-
-- ret = pci_register_driver(&ixgbe_driver);
-- return ret;
-+ return 0;
- }
-
- module_init(ixgbe_init_module);
-diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 998974f..2d849da 100644
---- a/drivers/net/ethernet/realtek/r8169.c
-+++ b/drivers/net/ethernet/realtek/r8169.c
-@@ -3819,6 +3819,30 @@ static void rtl_init_mdio_ops(struct rtl8169_private *tp)
- }
- }
-
-+static void rtl_speed_down(struct rtl8169_private *tp)
-+{
-+ u32 adv;
-+ int lpa;
-+
-+ rtl_writephy(tp, 0x1f, 0x0000);
-+ lpa = rtl_readphy(tp, MII_LPA);
-+
-+ if (lpa & (LPA_10HALF | LPA_10FULL))
-+ adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full;
-+ else if (lpa & (LPA_100HALF | LPA_100FULL))
-+ adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
-+ ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full;
-+ else
-+ adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
-+ ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full |
-+ (tp->mii.supports_gmii ?
-+ ADVERTISED_1000baseT_Half |
-+ ADVERTISED_1000baseT_Full : 0);
-+
-+ rtl8169_set_speed(tp->dev, AUTONEG_ENABLE, SPEED_1000, DUPLEX_FULL,
-+ adv);
-+}
-+
- static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
- {
- void __iomem *ioaddr = tp->mmio_addr;
-@@ -3849,9 +3873,7 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
- if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
- return false;
-
-- rtl_writephy(tp, 0x1f, 0x0000);
-- rtl_writephy(tp, MII_BMCR, 0x0000);
--
-+ rtl_speed_down(tp);
- rtl_wol_suspend_quirk(tp);
-
- return true;
-diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
-index cdb11b3..3eca710 100644
---- a/drivers/net/wireless/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/mwifiex/cfg80211.c
-@@ -1846,7 +1846,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
- }
- }
-
-- for (i = 0; i < request->n_channels; i++) {
-+ for (i = 0; i < min_t(u32, request->n_channels,
-+ MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
- chan = request->channels[i];
- priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
- priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
-diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
-index 8955a0e..771be26 100644
---- a/drivers/net/wireless/mwifiex/scan.c
-+++ b/drivers/net/wireless/mwifiex/scan.c
-@@ -1371,8 +1371,10 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
- queue_work(adapter->workqueue, &adapter->main_work);
-
- /* Perform internal scan synchronously */
-- if (!priv->scan_request)
-+ if (!priv->scan_request) {
-+ dev_dbg(adapter->dev, "wait internal scan\n");
- mwifiex_wait_queue_complete(adapter, cmd_node);
-+ }
- } else {
- spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
- flags);
-@@ -1768,7 +1770,12 @@ check_next_scan:
- /* Need to indicate IOCTL complete */
- if (adapter->curr_cmd->wait_q_enabled) {
- adapter->cmd_wait_q.status = 0;
-- mwifiex_complete_cmd(adapter, adapter->curr_cmd);
-+ if (!priv->scan_request) {
-+ dev_dbg(adapter->dev,
-+ "complete internal scan\n");
-+ mwifiex_complete_cmd(adapter,
-+ adapter->curr_cmd);
-+ }
- }
- if (priv->report_scan_result)
- priv->report_scan_result = false;
-diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
-index a0c8cae..b1c673e 100644
---- a/drivers/net/wireless/rt2x00/rt2x00pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
-@@ -52,8 +52,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
- udelay(REGISTER_BUSY_DELAY);
- }
-
-- ERROR(rt2x00dev, "Indirect register access failed: "
-- "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
-+ printk_once(KERN_ERR "%s() Indirect register access failed: "
-+ "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
- *reg = ~0;
-
- return 0;
-diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
-index 1af4008..21354bf 100644
---- a/drivers/pci/pci-acpi.c
-+++ b/drivers/pci/pci-acpi.c
-@@ -53,14 +53,15 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context)
- return;
- }
-
-- if (!pci_dev->pm_cap || !pci_dev->pme_support
-- || pci_check_pme_status(pci_dev)) {
-- if (pci_dev->pme_poll)
-- pci_dev->pme_poll = false;
-+ /* Clear PME Status if set. */
-+ if (pci_dev->pme_support)
-+ pci_check_pme_status(pci_dev);
-
-- pci_wakeup_event(pci_dev);
-- pm_runtime_resume(&pci_dev->dev);
-- }
-+ if (pci_dev->pme_poll)
-+ pci_dev->pme_poll = false;
-+
-+ pci_wakeup_event(pci_dev);
-+ pm_runtime_resume(&pci_dev->dev);
-
- if (pci_dev->subordinate)
- pci_pme_wakeup_bus(pci_dev->subordinate);
-diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
-index 08c243a..ed4d094 100644
---- a/drivers/pci/pcie/portdrv_pci.c
-+++ b/drivers/pci/pcie/portdrv_pci.c
-@@ -185,14 +185,6 @@ static const struct dev_pm_ops pcie_portdrv_pm_ops = {
- #endif /* !PM */
-
- /*
-- * PCIe port runtime suspend is broken for some chipsets, so use a
-- * black list to disable runtime PM for these chipsets.
-- */
--static const struct pci_device_id port_runtime_pm_black_list[] = {
-- { /* end: all zeroes */ }
--};
--
--/*
- * pcie_portdrv_probe - Probe PCI-Express port devices
- * @dev: PCI-Express port device being probed
- *
-@@ -225,16 +217,11 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
- * it by default.
- */
- dev->d3cold_allowed = false;
-- if (!pci_match_id(port_runtime_pm_black_list, dev))
-- pm_runtime_put_noidle(&dev->dev);
--
- return 0;
- }
-
- static void pcie_portdrv_remove(struct pci_dev *dev)
- {
-- if (!pci_match_id(port_runtime_pm_black_list, dev))
-- pm_runtime_get_noresume(&dev->dev);
- pcie_port_device_remove(dev);
- pci_disable_device(dev);
- }
-diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
-index 2264331..b96766b 100644
---- a/drivers/platform/x86/msi-wmi.c
-+++ b/drivers/platform/x86/msi-wmi.c
-@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, void *context)
- pr_debug("Suppressed key event 0x%X - "
- "Last press was %lld us ago\n",
- key->code, ktime_to_us(diff));
-- return;
-+ goto msi_wmi_notify_exit;
- }
- last_pressed[key->code - SCANCODE_BASE] = cur;
-
-@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, void *context)
- pr_info("Unknown key pressed - %x\n", eventcode);
- } else
- pr_info("Unknown event received\n");
-+
-+msi_wmi_notify_exit:
- kfree(response.pointer);
- }
-
-diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
-index 96ce101..a936efb 100644
---- a/drivers/remoteproc/Kconfig
-+++ b/drivers/remoteproc/Kconfig
-@@ -5,7 +5,7 @@ config REMOTEPROC
- tristate
- depends on EXPERIMENTAL
- depends on HAS_DMA
-- select FW_CONFIG
-+ select FW_LOADER
- select VIRTIO
-
- config OMAP_REMOTEPROC
-diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
-index dd3bfaf..752b507 100644
---- a/drivers/remoteproc/remoteproc_core.c
-+++ b/drivers/remoteproc/remoteproc_core.c
-@@ -370,10 +370,12 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
- /* it is now safe to add the virtio device */
- ret = rproc_add_virtio_dev(rvdev, rsc->id);
- if (ret)
-- goto free_rvdev;
-+ goto remove_rvdev;
-
- return 0;
-
-+remove_rvdev:
-+ list_del(&rvdev->node);
- free_rvdev:
- kfree(rvdev);
- return ret;
-diff --git a/drivers/remoteproc/ste_modem_rproc.c b/drivers/remoteproc/ste_modem_rproc.c
-index a7743c0..fb95c42 100644
---- a/drivers/remoteproc/ste_modem_rproc.c
-+++ b/drivers/remoteproc/ste_modem_rproc.c
-@@ -240,6 +240,8 @@ static int sproc_drv_remove(struct platform_device *pdev)
-
- /* Unregister as remoteproc device */
- rproc_del(sproc->rproc);
-+ dma_free_coherent(sproc->rproc->dev.parent, SPROC_FW_SIZE,
-+ sproc->fw_addr, sproc->fw_dma_addr);
- rproc_put(sproc->rproc);
-
- mdev->drv_data = NULL;
-@@ -297,10 +299,13 @@ static int sproc_probe(struct platform_device *pdev)
- /* Register as a remoteproc device */
- err = rproc_add(rproc);
- if (err)
-- goto free_rproc;
-+ goto free_mem;
-
- return 0;
-
-+free_mem:
-+ dma_free_coherent(rproc->dev.parent, SPROC_FW_SIZE,
-+ sproc->fw_addr, sproc->fw_dma_addr);
- free_rproc:
- /* Reset device data upon error */
- mdev->drv_data = NULL;
-diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
-index d38b267..b6469e2 100644
---- a/drivers/rtc/rtc-at91rm9200.c
-+++ b/drivers/rtc/rtc-at91rm9200.c
-@@ -44,7 +44,6 @@ static DECLARE_COMPLETION(at91_rtc_updated);
- static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
- static void __iomem *at91_rtc_regs;
- static int irq;
--static u32 at91_rtc_imr;
-
- /*
- * Decode time/date into rtc_time structure
-@@ -109,11 +108,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
- cr = at91_rtc_read(AT91_RTC_CR);
- at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
-
-- at91_rtc_imr |= AT91_RTC_ACKUPD;
- at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
- wait_for_completion(&at91_rtc_updated); /* wait for ACKUPD interrupt */
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
-- at91_rtc_imr &= ~AT91_RTC_ACKUPD;
-
- at91_rtc_write(AT91_RTC_TIMR,
- bin2bcd(tm->tm_sec) << 0
-@@ -145,7 +142,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
- tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
- tm->tm_year = at91_alarm_year - 1900;
-
-- alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
-+ alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
- ? 1 : 0;
-
- pr_debug("%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
-@@ -171,7 +168,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
- tm.tm_sec = alrm->time.tm_sec;
-
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
-- at91_rtc_imr &= ~AT91_RTC_ALARM;
- at91_rtc_write(AT91_RTC_TIMALR,
- bin2bcd(tm.tm_sec) << 0
- | bin2bcd(tm.tm_min) << 8
-@@ -184,7 +180,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
-
- if (alrm->enabled) {
- at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-- at91_rtc_imr |= AT91_RTC_ALARM;
- at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
- }
-
-@@ -201,12 +196,9 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
-
- if (enabled) {
- at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-- at91_rtc_imr |= AT91_RTC_ALARM;
- at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
-- } else {
-+ } else
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
-- at91_rtc_imr &= ~AT91_RTC_ALARM;
-- }
-
- return 0;
- }
-@@ -215,10 +207,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
- */
- static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
- {
-+ unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
-+
- seq_printf(seq, "update_IRQ\t: %s\n",
-- (at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
-+ (imr & AT91_RTC_ACKUPD) ? "yes" : "no");
- seq_printf(seq, "periodic_IRQ\t: %s\n",
-- (at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
-+ (imr & AT91_RTC_SECEV) ? "yes" : "no");
-
- return 0;
- }
-@@ -233,7 +227,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
- unsigned int rtsr;
- unsigned long events = 0;
-
-- rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
-+ rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
- if (rtsr) { /* this interrupt is shared! Is it ours? */
- if (rtsr & AT91_RTC_ALARM)
- events |= (RTC_AF | RTC_IRQF);
-@@ -297,7 +291,6 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
- AT91_RTC_SECEV | AT91_RTC_TIMEV |
- AT91_RTC_CALEV);
-- at91_rtc_imr = 0;
-
- ret = request_irq(irq, at91_rtc_interrupt,
- IRQF_SHARED,
-@@ -337,7 +330,6 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
- AT91_RTC_SECEV | AT91_RTC_TIMEV |
- AT91_RTC_CALEV);
-- at91_rtc_imr = 0;
- free_irq(irq, pdev);
-
- rtc_device_unregister(rtc);
-@@ -350,35 +342,31 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
-
- /* AT91RM9200 RTC Power management control */
-
--static u32 at91_rtc_bkpimr;
--
-+static u32 at91_rtc_imr;
-
- static int at91_rtc_suspend(struct device *dev)
- {
- /* this IRQ is shared with DBGU and other hardware which isn't
- * necessarily doing PM like we are...
- */
-- at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-- if (at91_rtc_bkpimr) {
-- if (device_may_wakeup(dev)) {
-+ at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
-+ & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-+ if (at91_rtc_imr) {
-+ if (device_may_wakeup(dev))
- enable_irq_wake(irq);
-- } else {
-- at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
-- at91_rtc_imr &= ~at91_rtc_bkpimr;
-- }
--}
-+ else
-+ at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
-+ }
- return 0;
- }
-
- static int at91_rtc_resume(struct device *dev)
- {
-- if (at91_rtc_bkpimr) {
-- if (device_may_wakeup(dev)) {
-+ if (at91_rtc_imr) {
-+ if (device_may_wakeup(dev))
- disable_irq_wake(irq);
-- } else {
-- at91_rtc_imr |= at91_rtc_bkpimr;
-- at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
-- }
-+ else
-+ at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
- }
- return 0;
- }
-diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
-index 5f940b6..da1945e 100644
---- a/drivers/rtc/rtc-at91rm9200.h
-+++ b/drivers/rtc/rtc-at91rm9200.h
-@@ -64,6 +64,7 @@
- #define AT91_RTC_SCCR 0x1c /* Status Clear Command Register */
- #define AT91_RTC_IER 0x20 /* Interrupt Enable Register */
- #define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */
-+#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */
-
- #define AT91_RTC_VER 0x2c /* Valid Entry Register */
- #define AT91_RTC_NVTIM (1 << 0) /* Non valid Time */
-diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
-index cb3a310..41e21bf 100644
---- a/drivers/spi/spi-mpc512x-psc.c
-+++ b/drivers/spi/spi-mpc512x-psc.c
-@@ -164,7 +164,7 @@ static int mpc512x_psc_spi_transfer_rxtx(struct spi_device *spi,
-
- for (i = count; i > 0; i--) {
- data = tx_buf ? *tx_buf++ : 0;
-- if (len == EOFBYTE)
-+ if (len == EOFBYTE && t->cs_change)
- setbits32(&fifo->txcmd, MPC512x_PSC_FIFO_EOF);
- out_8(&fifo->txdata_8, data);
- len--;
-diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
-index ad93231..6796a25 100644
---- a/drivers/spi/spi-s3c64xx.c
-+++ b/drivers/spi/spi-s3c64xx.c
-@@ -997,25 +997,30 @@ static irqreturn_t s3c64xx_spi_irq(int irq, void *data)
- {
- struct s3c64xx_spi_driver_data *sdd = data;
- struct spi_master *spi = sdd->master;
-- unsigned int val;
-+ unsigned int val, clr = 0;
-
-- val = readl(sdd->regs + S3C64XX_SPI_PENDING_CLR);
-+ val = readl(sdd->regs + S3C64XX_SPI_STATUS);
-
-- val &= S3C64XX_SPI_PND_RX_OVERRUN_CLR |
-- S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
-- S3C64XX_SPI_PND_TX_OVERRUN_CLR |
-- S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
--
-- writel(val, sdd->regs + S3C64XX_SPI_PENDING_CLR);
--
-- if (val & S3C64XX_SPI_PND_RX_OVERRUN_CLR)
-+ if (val & S3C64XX_SPI_ST_RX_OVERRUN_ERR) {
-+ clr = S3C64XX_SPI_PND_RX_OVERRUN_CLR;
- dev_err(&spi->dev, "RX overrun\n");
-- if (val & S3C64XX_SPI_PND_RX_UNDERRUN_CLR)
-+ }
-+ if (val & S3C64XX_SPI_ST_RX_UNDERRUN_ERR) {
-+ clr |= S3C64XX_SPI_PND_RX_UNDERRUN_CLR;
- dev_err(&spi->dev, "RX underrun\n");
-- if (val & S3C64XX_SPI_PND_TX_OVERRUN_CLR)
-+ }
-+ if (val & S3C64XX_SPI_ST_TX_OVERRUN_ERR) {
-+ clr |= S3C64XX_SPI_PND_TX_OVERRUN_CLR;
- dev_err(&spi->dev, "TX overrun\n");
-- if (val & S3C64XX_SPI_PND_TX_UNDERRUN_CLR)
-+ }
-+ if (val & S3C64XX_SPI_ST_TX_UNDERRUN_ERR) {
-+ clr |= S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
- dev_err(&spi->dev, "TX underrun\n");
-+ }
-+
-+ /* Clear the pending irq by setting and then clearing it */
-+ writel(clr, sdd->regs + S3C64XX_SPI_PENDING_CLR);
-+ writel(0, sdd->regs + S3C64XX_SPI_PENDING_CLR);
-
- return IRQ_HANDLED;
- }
-@@ -1039,9 +1044,13 @@ static void s3c64xx_spi_hwinit(struct s3c64xx_spi_driver_data *sdd, int channel)
- writel(0, regs + S3C64XX_SPI_MODE_CFG);
- writel(0, regs + S3C64XX_SPI_PACKET_CNT);
-
-- /* Clear any irq pending bits */
-- writel(readl(regs + S3C64XX_SPI_PENDING_CLR),
-- regs + S3C64XX_SPI_PENDING_CLR);
-+ /* Clear any irq pending bits, should set and clear the bits */
-+ val = S3C64XX_SPI_PND_RX_OVERRUN_CLR |
-+ S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
-+ S3C64XX_SPI_PND_TX_OVERRUN_CLR |
-+ S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
-+ writel(val, regs + S3C64XX_SPI_PENDING_CLR);
-+ writel(0, regs + S3C64XX_SPI_PENDING_CLR);
-
- writel(0, regs + S3C64XX_SPI_SWAP_CFG);
-
-diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
-index 8c8ce80..bfbf9fb 100644
---- a/drivers/thermal/thermal_sys.c
-+++ b/drivers/thermal/thermal_sys.c
-@@ -1807,6 +1807,7 @@ static int __init thermal_init(void)
- idr_destroy(&thermal_cdev_idr);
- mutex_destroy(&thermal_idr_lock);
- mutex_destroy(&thermal_list_lock);
-+ return result;
- }
- result = genetlink_init();
- return result;
-diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
-index b3455a9..35d9ab9 100644
---- a/drivers/tty/serial/8250/8250_pnp.c
-+++ b/drivers/tty/serial/8250/8250_pnp.c
-@@ -429,7 +429,6 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
- {
- struct uart_8250_port uart;
- int ret, line, flags = dev_id->driver_data;
-- struct resource *res = NULL;
-
- if (flags & UNKNOWN_DEV) {
- ret = serial_pnp_guess_board(dev);
-@@ -440,12 +439,11 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
- memset(&uart, 0, sizeof(uart));
- if (pnp_irq_valid(dev, 0))
- uart.port.irq = pnp_irq(dev, 0);
-- if ((flags & CIR_PORT) && pnp_port_valid(dev, 2))
-- res = pnp_get_resource(dev, IORESOURCE_IO, 2);
-- else if (pnp_port_valid(dev, 0))
-- res = pnp_get_resource(dev, IORESOURCE_IO, 0);
-- if (pnp_resource_enabled(res)) {
-- uart.port.iobase = res->start;
-+ if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
-+ uart.port.iobase = pnp_port_start(dev, 2);
-+ uart.port.iotype = UPIO_PORT;
-+ } else if (pnp_port_valid(dev, 0)) {
-+ uart.port.iobase = pnp_port_start(dev, 0);
- uart.port.iotype = UPIO_PORT;
- } else if (pnp_mem_valid(dev, 0)) {
- uart.port.mapbase = pnp_mem_start(dev, 0);
-diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
-index b28e66c..4a62e12 100644
---- a/drivers/vfio/pci/vfio_pci.c
-+++ b/drivers/vfio/pci/vfio_pci.c
-@@ -331,6 +331,7 @@ static long vfio_pci_ioctl(void *device_data,
-
- if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
- size_t size;
-+ int max = vfio_pci_get_irq_count(vdev, hdr.index);
-
- if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
- size = sizeof(uint8_t);
-@@ -340,7 +341,7 @@ static long vfio_pci_ioctl(void *device_data,
- return -EINVAL;
-
- if (hdr.argsz - minsz < hdr.count * size ||
-- hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
-+ hdr.start >= max || hdr.start + hdr.count > max)
- return -EINVAL;
-
- data = memdup_user((void __user *)(arg + minsz),
-diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
-index 2e9779b..c53189d 100644
---- a/fs/nfs/nfs4client.c
-+++ b/fs/nfs/nfs4client.c
-@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
- struct rpc_cred *cred)
- {
- struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
-- struct nfs_client *pos, *n, *prev = NULL;
-+ struct nfs_client *pos, *prev = NULL;
- struct nfs4_setclientid_res clid = {
- .clientid = new->cl_clientid,
- .confirm = new->cl_confirm,
-@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
- int status = -NFS4ERR_STALE_CLIENTID;
-
- spin_lock(&nn->nfs_client_lock);
-- list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
-+ list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
- /* If "pos" isn't marked ready, we can't trust the
- * remaining fields in "pos" */
-- if (pos->cl_cons_state < NFS_CS_READY)
-+ if (pos->cl_cons_state > NFS_CS_READY) {
-+ atomic_inc(&pos->cl_count);
-+ spin_unlock(&nn->nfs_client_lock);
-+
-+ if (prev)
-+ nfs_put_client(prev);
-+ prev = pos;
-+
-+ status = nfs_wait_client_init_complete(pos);
-+ spin_lock(&nn->nfs_client_lock);
-+ if (status < 0)
-+ continue;
-+ }
-+ if (pos->cl_cons_state != NFS_CS_READY)
- continue;
-
- if (pos->rpc_ops != new->rpc_ops)
-@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
- struct rpc_cred *cred)
- {
- struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
-- struct nfs_client *pos, *n, *prev = NULL;
-+ struct nfs_client *pos, *prev = NULL;
- int status = -NFS4ERR_STALE_CLIENTID;
-
- spin_lock(&nn->nfs_client_lock);
-- list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
-+ list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
- /* If "pos" isn't marked ready, we can't trust the
- * remaining fields in "pos", especially the client
- * ID and serverowner fields. Wait for CREATE_SESSION
- * to finish. */
-- if (pos->cl_cons_state < NFS_CS_READY) {
-+ if (pos->cl_cons_state > NFS_CS_READY) {
- atomic_inc(&pos->cl_count);
- spin_unlock(&nn->nfs_client_lock);
-
-@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
- nfs_put_client(prev);
- prev = pos;
-
-- nfs4_schedule_lease_recovery(pos);
- status = nfs_wait_client_init_complete(pos);
-- if (status < 0) {
-- nfs_put_client(pos);
-- spin_lock(&nn->nfs_client_lock);
-- continue;
-+ if (status == 0) {
-+ nfs4_schedule_lease_recovery(pos);
-+ status = nfs4_wait_clnt_recover(pos);
- }
-- status = pos->cl_cons_state;
- spin_lock(&nn->nfs_client_lock);
- if (status < 0)
- continue;
- }
-+ if (pos->cl_cons_state != NFS_CS_READY)
-+ continue;
-
- if (pos->rpc_ops != new->rpc_ops)
- continue;
-@@ -469,17 +481,18 @@ int nfs41_walk_client_list(struct nfs_client *new,
- continue;
-
- atomic_inc(&pos->cl_count);
-- spin_unlock(&nn->nfs_client_lock);
-+ *result = pos;
-+ status = 0;
- dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
- __func__, pos, atomic_read(&pos->cl_count));
--
-- *result = pos;
-- return 0;
-+ break;
- }
-
- /* No matching nfs_client found. */
- spin_unlock(&nn->nfs_client_lock);
- dprintk("NFS: <-- %s status = %d\n", __func__, status);
-+ if (prev)
-+ nfs_put_client(prev);
- return status;
- }
- #endif /* CONFIG_NFS_V4_1 */
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index e61f68d..994fbe2 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1877,7 +1877,13 @@ again:
- status = PTR_ERR(clnt);
- break;
- }
-- clp->cl_rpcclient = clnt;
-+ /* Note: this is safe because we haven't yet marked the
-+ * client as ready, so we are the only user of
-+ * clp->cl_rpcclient
-+ */
-+ clnt = xchg(&clp->cl_rpcclient, clnt);
-+ rpc_shutdown_client(clnt);
-+ clnt = clp->cl_rpcclient;
- goto again;
-
- case -NFS4ERR_MINOR_VERS_MISMATCH:
-diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index c196369..4cce1d9 100644
---- a/fs/reiserfs/xattr.c
-+++ b/fs/reiserfs/xattr.c
-@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
- if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
- return -ENOSPC;
-
-- if (name[0] == '.' && (name[1] == '\0' ||
-- (name[1] == '.' && name[2] == '\0')))
-+ if (name[0] == '.' && (namelen < 2 ||
-+ (namelen == 2 && name[1] == '.')))
- return 0;
-
- dentry = lookup_one_len(name, dbuf->xadir, namelen);
-diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
-index ddc0f6a..97f6875 100644
---- a/fs/ubifs/super.c
-+++ b/fs/ubifs/super.c
-@@ -1568,6 +1568,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
- c->remounting_rw = 1;
- c->ro_mount = 0;
-
-+ if (c->space_fixup) {
-+ err = ubifs_fixup_free_space(c);
-+ if (err)
-+ return err;
-+ }
-+
- err = check_free_space(c);
- if (err)
- goto out;
-@@ -1684,12 +1690,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
- err = dbg_check_space_info(c);
- }
-
-- if (c->space_fixup) {
-- err = ubifs_fixup_free_space(c);
-- if (err)
-- goto out;
-- }
--
- mutex_unlock(&c->umount_mutex);
- return err;
-
-diff --git a/include/linux/ata.h b/include/linux/ata.h
-index 8f7a3d6..ee0bd95 100644
---- a/include/linux/ata.h
-+++ b/include/linux/ata.h
-@@ -954,7 +954,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
- }
- }
-
--static inline bool atapi_command_packet_set(const u16 *dev_id)
-+static inline int atapi_command_packet_set(const u16 *dev_id)
- {
- return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
- }
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 649e5f8..0621bca 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -398,6 +398,7 @@ enum {
- ATA_HORKAGE_NOSETXFER = (1 << 14), /* skip SETXFER, SATA only */
- ATA_HORKAGE_BROKEN_FPDMA_AA = (1 << 15), /* skip AA */
- ATA_HORKAGE_DUMP_ID = (1 << 16), /* dump IDENTIFY data */
-+ ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */
-
- /* DMA mask for user DMA control: User visible values; DO NOT
- renumber */
-diff --git a/include/linux/preempt.h b/include/linux/preempt.h
-index 5a710b9..87a03c7 100644
---- a/include/linux/preempt.h
-+++ b/include/linux/preempt.h
-@@ -93,14 +93,20 @@ do { \
-
- #else /* !CONFIG_PREEMPT_COUNT */
-
--#define preempt_disable() do { } while (0)
--#define sched_preempt_enable_no_resched() do { } while (0)
--#define preempt_enable_no_resched() do { } while (0)
--#define preempt_enable() do { } while (0)
--
--#define preempt_disable_notrace() do { } while (0)
--#define preempt_enable_no_resched_notrace() do { } while (0)
--#define preempt_enable_notrace() do { } while (0)
-+/*
-+ * Even if we don't have any preemption, we need preempt disable/enable
-+ * to be barriers, so that we don't have things like get_user/put_user
-+ * that can cause faults and scheduling migrate into our preempt-protected
-+ * region.
-+ */
-+#define preempt_disable() barrier()
-+#define sched_preempt_enable_no_resched() barrier()
-+#define preempt_enable_no_resched() barrier()
-+#define preempt_enable() barrier()
-+
-+#define preempt_disable_notrace() barrier()
-+#define preempt_enable_no_resched_notrace() barrier()
-+#define preempt_enable_notrace() barrier()
-
- #endif /* CONFIG_PREEMPT_COUNT */
-
-diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
-index a26e2fb..e2369c1 100644
---- a/include/linux/spinlock_up.h
-+++ b/include/linux/spinlock_up.h
-@@ -16,7 +16,10 @@
- * In the debug case, 1 means unlocked, 0 means locked. (the values
- * are inverted, to catch initialization bugs)
- *
-- * No atomicity anywhere, we are on UP.
-+ * No atomicity anywhere, we are on UP. However, we still need
-+ * the compiler barriers, because we do not want the compiler to
-+ * move potentially faulting instructions (notably user accesses)
-+ * into the locked sequence, resulting in non-atomic execution.
- */
-
- #ifdef CONFIG_DEBUG_SPINLOCK
-@@ -25,6 +28,7 @@
- static inline void arch_spin_lock(arch_spinlock_t *lock)
- {
- lock->slock = 0;
-+ barrier();
- }
-
- static inline void
-@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
- {
- local_irq_save(flags);
- lock->slock = 0;
-+ barrier();
- }
-
- static inline int arch_spin_trylock(arch_spinlock_t *lock)
-@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
- char oldval = lock->slock;
-
- lock->slock = 0;
-+ barrier();
-
- return oldval > 0;
- }
-
- static inline void arch_spin_unlock(arch_spinlock_t *lock)
- {
-+ barrier();
- lock->slock = 1;
- }
-
- /*
- * Read-write spinlocks. No debug version.
- */
--#define arch_read_lock(lock) do { (void)(lock); } while (0)
--#define arch_write_lock(lock) do { (void)(lock); } while (0)
--#define arch_read_trylock(lock) ({ (void)(lock); 1; })
--#define arch_write_trylock(lock) ({ (void)(lock); 1; })
--#define arch_read_unlock(lock) do { (void)(lock); } while (0)
--#define arch_write_unlock(lock) do { (void)(lock); } while (0)
-+#define arch_read_lock(lock) do { barrier(); (void)(lock); } while (0)
-+#define arch_write_lock(lock) do { barrier(); (void)(lock); } while (0)
-+#define arch_read_trylock(lock) ({ barrier(); (void)(lock); 1; })
-+#define arch_write_trylock(lock) ({ barrier(); (void)(lock); 1; })
-+#define arch_read_unlock(lock) do { barrier(); (void)(lock); } while (0)
-+#define arch_write_unlock(lock) do { barrier(); (void)(lock); } while (0)
-
- #else /* DEBUG_SPINLOCK */
- #define arch_spin_is_locked(lock) ((void)(lock), 0)
- /* for sched.c and kernel_lock.c: */
--# define arch_spin_lock(lock) do { (void)(lock); } while (0)
--# define arch_spin_lock_flags(lock, flags) do { (void)(lock); } while (0)
--# define arch_spin_unlock(lock) do { (void)(lock); } while (0)
--# define arch_spin_trylock(lock) ({ (void)(lock); 1; })
-+# define arch_spin_lock(lock) do { barrier(); (void)(lock); } while (0)
-+# define arch_spin_lock_flags(lock, flags) do { barrier(); (void)(lock); } while (0)
-+# define arch_spin_unlock(lock) do { barrier(); (void)(lock); } while (0)
-+# define arch_spin_trylock(lock) ({ barrier(); (void)(lock); 1; })
- #endif /* DEBUG_SPINLOCK */
-
- #define arch_spin_is_contended(lock) (((void)(lock), 0))
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index b27052c..64bc5d8 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -4537,12 +4537,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
- ftrace_startup_sysctl();
-
- /* we are starting ftrace again */
-- if (ftrace_ops_list != &ftrace_list_end) {
-- if (ftrace_ops_list->next == &ftrace_list_end)
-- ftrace_trace_function = ftrace_ops_list->func;
-- else
-- ftrace_trace_function = ftrace_ops_list_func;
-- }
-+ if (ftrace_ops_list != &ftrace_list_end)
-+ update_ftrace_function();
-
- } else {
- /* stopping ftrace calls (just send to ftrace_stub) */
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 8832b87..90db251 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -1922,7 +1922,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
-
- /* Check the cache first. */
- /* (Cache hit rate is typically around 35%.) */
-- vma = mm->mmap_cache;
-+ vma = ACCESS_ONCE(mm->mmap_cache);
- if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
- struct rb_node *rb_node;
-
-diff --git a/mm/nommu.c b/mm/nommu.c
-index 79c3cac..bbe1f3f 100644
---- a/mm/nommu.c
-+++ b/mm/nommu.c
-@@ -819,7 +819,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- struct vm_area_struct *vma;
-
- /* check the cache first */
-- vma = mm->mmap_cache;
-+ vma = ACCESS_ONCE(mm->mmap_cache);
- if (vma && vma->vm_start <= addr && vma->vm_end > addr)
- return vma;
-
-diff --git a/net/can/gw.c b/net/can/gw.c
-index 574dda78e..28e7bdc 100644
---- a/net/can/gw.c
-+++ b/net/can/gw.c
-@@ -436,7 +436,7 @@ static int cgw_notifier(struct notifier_block *nb,
- if (gwj->src.dev == dev || gwj->dst.dev == dev) {
- hlist_del(&gwj->list);
- cgw_unregister_filter(gwj);
-- kfree(gwj);
-+ kmem_cache_free(cgw_cache, gwj);
- }
- }
- }
-@@ -829,7 +829,7 @@ static void cgw_remove_all_jobs(void)
- hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
- hlist_del(&gwj->list);
- cgw_unregister_filter(gwj);
-- kfree(gwj);
-+ kmem_cache_free(cgw_cache, gwj);
- }
- }
-
-@@ -885,7 +885,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
-
- hlist_del(&gwj->list);
- cgw_unregister_filter(gwj);
-- kfree(gwj);
-+ kmem_cache_free(cgw_cache, gwj);
- err = 0;
- break;
- }
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 0479c64..49c48c6 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -2499,7 +2499,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- list_del(&dep->list);
- mutex_unlock(&local->mtx);
-
-- ieee80211_roc_notify_destroy(dep);
-+ ieee80211_roc_notify_destroy(dep, true);
- return 0;
- }
-
-@@ -2539,7 +2539,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- ieee80211_start_next_roc(local);
- mutex_unlock(&local->mtx);
-
-- ieee80211_roc_notify_destroy(found);
-+ ieee80211_roc_notify_destroy(found, true);
- } else {
- /* work may be pending so use it all the time */
- found->abort = true;
-@@ -2549,6 +2549,8 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
-
- /* work will clean up etc */
- flush_delayed_work(&found->work);
-+ WARN_ON(!found->to_be_freed);
-+ kfree(found);
- }
-
- return 0;
-diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 2ed065c..55d8f89 100644
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -346,6 +346,7 @@ struct ieee80211_roc_work {
- struct ieee80211_channel *chan;
-
- bool started, abort, hw_begun, notified;
-+ bool to_be_freed;
-
- unsigned long hw_start_time;
-
-@@ -1363,7 +1364,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local);
- void ieee80211_roc_setup(struct ieee80211_local *local);
- void ieee80211_start_next_roc(struct ieee80211_local *local);
- void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
--void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
-+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
- void ieee80211_sw_roc_work(struct work_struct *work);
- void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
-
-diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
-index a3ad4c3..7acbdaa 100644
---- a/net/mac80211/offchannel.c
-+++ b/net/mac80211/offchannel.c
-@@ -299,10 +299,13 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
- }
- }
-
--void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
-+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
- {
- struct ieee80211_roc_work *dep, *tmp;
-
-+ if (WARN_ON(roc->to_be_freed))
-+ return;
-+
- /* was never transmitted */
- if (roc->frame) {
- cfg80211_mgmt_tx_status(&roc->sdata->wdev,
-@@ -318,9 +321,12 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
- GFP_KERNEL);
-
- list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
-- ieee80211_roc_notify_destroy(dep);
-+ ieee80211_roc_notify_destroy(dep, true);
-
-- kfree(roc);
-+ if (free)
-+ kfree(roc);
-+ else
-+ roc->to_be_freed = true;
- }
-
- void ieee80211_sw_roc_work(struct work_struct *work)
-@@ -333,6 +339,9 @@ void ieee80211_sw_roc_work(struct work_struct *work)
-
- mutex_lock(&local->mtx);
-
-+ if (roc->to_be_freed)
-+ goto out_unlock;
-+
- if (roc->abort)
- goto finish;
-
-@@ -372,7 +381,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
- finish:
- list_del(&roc->list);
- started = roc->started;
-- ieee80211_roc_notify_destroy(roc);
-+ ieee80211_roc_notify_destroy(roc, !roc->abort);
-
- if (started) {
- drv_flush(local, false);
-@@ -412,7 +421,7 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
-
- list_del(&roc->list);
-
-- ieee80211_roc_notify_destroy(roc);
-+ ieee80211_roc_notify_destroy(roc, true);
-
- /* if there's another roc, start it now */
- ieee80211_start_next_roc(local);
-@@ -462,12 +471,14 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
- list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
- if (local->ops->remain_on_channel) {
- list_del(&roc->list);
-- ieee80211_roc_notify_destroy(roc);
-+ ieee80211_roc_notify_destroy(roc, true);
- } else {
- ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
-
- /* work will clean up etc */
- flush_delayed_work(&roc->work);
-+ WARN_ON(!roc->to_be_freed);
-+ kfree(roc);
- }
- }
-
-diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index 507b5e8..716aa41 100644
---- a/net/sunrpc/clnt.c
-+++ b/net/sunrpc/clnt.c
-@@ -511,7 +511,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
- new = rpc_new_client(args, xprt);
- if (IS_ERR(new)) {
- err = PTR_ERR(new);
-- goto out_put;
-+ goto out_err;
- }
-
- atomic_inc(&clnt->cl_count);
-@@ -524,8 +524,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
- new->cl_chatty = clnt->cl_chatty;
- return new;
-
--out_put:
-- xprt_put(xprt);
- out_err:
- dprintk("RPC: %s: returned error %d\n", __func__, err);
- return ERR_PTR(err);
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index e46b6a3..622f726 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -173,7 +173,7 @@ const char *snd_hda_get_jack_type(u32 cfg)
- "Line Out", "Speaker", "HP Out", "CD",
- "SPDIF Out", "Digital Out", "Modem Line", "Modem Hand",
- "Line In", "Aux", "Mic", "Telephony",
-- "SPDIF In", "Digitial In", "Reserved", "Other"
-+ "SPDIF In", "Digital In", "Reserved", "Other"
- };
-
- return jack_types[(cfg & AC_DEFCFG_DEVICE)
-diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
-index 4c054f4..86f6468 100644
---- a/sound/pci/hda/hda_eld.c
-+++ b/sound/pci/hda/hda_eld.c
-@@ -322,7 +322,7 @@ int snd_hdmi_get_eld(struct hdmi_eld *eld,
- struct hda_codec *codec, hda_nid_t nid)
- {
- int i;
-- int ret;
-+ int ret = 0;
- int size;
- unsigned char *buf;
-
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 47fb18d..ee975a2 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6720,7 +6720,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec)
- const hda_nid_t *ssids;
-
- if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 ||
-- codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670)
-+ codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 ||
-+ codec->vendor_id == 0x10ec0671)
- ssids = alc663_ssids;
- else
- ssids = alc662_ssids;
-@@ -7173,6 +7174,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
- { .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
- { .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
- { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
-+ { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
- { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
- { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
- { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
-diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
-index 3b48042..63e453f 100644
---- a/sound/soc/fsl/imx-ssi.c
-+++ b/sound/soc/fsl/imx-ssi.c
-@@ -496,6 +496,8 @@ static void imx_ssi_ac97_reset(struct snd_ac97 *ac97)
-
- if (imx_ssi->ac97_reset)
- imx_ssi->ac97_reset(ac97);
-+ /* First read sometimes fails, do a dummy read */
-+ imx_ssi_ac97_read(ac97, 0);
- }
-
- static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
-@@ -504,6 +506,9 @@ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
-
- if (imx_ssi->ac97_warm_reset)
- imx_ssi->ac97_warm_reset(ac97);
-+
-+ /* First read sometimes fails, do a dummy read */
-+ imx_ssi_ac97_read(ac97, 0);
- }
-
- struct snd_ac97_bus_ops soc_ac97_ops = {
-diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
-index 19eff8f..1a8b03e 100644
---- a/sound/soc/sh/dma-sh7760.c
-+++ b/sound/soc/sh/dma-sh7760.c
-@@ -342,8 +342,8 @@ static int camelot_pcm_new(struct snd_soc_pcm_runtime *rtd)
- return 0;
- }
-
--static struct snd_soc_platform sh7760_soc_platform = {
-- .pcm_ops = &camelot_pcm_ops,
-+static struct snd_soc_platform_driver sh7760_soc_platform = {
-+ .ops = &camelot_pcm_ops,
- .pcm_new = camelot_pcm_new,
- .pcm_free = camelot_pcm_free,
- };
-diff --git a/sound/soc/spear/spear_pcm.c b/sound/soc/spear/spear_pcm.c
-index 9b76cc5..5e7aebe 100644
---- a/sound/soc/spear/spear_pcm.c
-+++ b/sound/soc/spear/spear_pcm.c
-@@ -149,9 +149,9 @@ static void spear_pcm_free(struct snd_pcm *pcm)
-
- static u64 spear_pcm_dmamask = DMA_BIT_MASK(32);
-
--static int spear_pcm_new(struct snd_card *card,
-- struct snd_soc_dai *dai, struct snd_pcm *pcm)
-+static int spear_pcm_new(struct snd_soc_pcm_runtime *rtd)
- {
-+ struct snd_card *card = rtd->card->snd_card;
- int ret;
-
- if (!card->dev->dma_mask)
-@@ -159,16 +159,16 @@ static int spear_pcm_new(struct snd_card *card,
- if (!card->dev->coherent_dma_mask)
- card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
-
-- if (dai->driver->playback.channels_min) {
-- ret = spear_pcm_preallocate_dma_buffer(pcm,
-+ if (rtd->cpu_dai->driver->playback.channels_min) {
-+ ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
- SNDRV_PCM_STREAM_PLAYBACK,
- spear_pcm_hardware.buffer_bytes_max);
- if (ret)
- return ret;
- }
-
-- if (dai->driver->capture.channels_min) {
-- ret = spear_pcm_preallocate_dma_buffer(pcm,
-+ if (rtd->cpu_dai->driver->capture.channels_min) {
-+ ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
- SNDRV_PCM_STREAM_CAPTURE,
- spear_pcm_hardware.buffer_bytes_max);
- if (ret)
diff --git a/3.8.8/1007_linux-3.8.8.patch b/3.8.8/1007_linux-3.8.8.patch
deleted file mode 100644
index 8db28d7..0000000
--- a/3.8.8/1007_linux-3.8.8.patch
+++ /dev/null
@@ -1,1471 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 85204da..7684f95 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 8
--SUBLEVEL = 7
-+SUBLEVEL = 8
- EXTRAVERSION =
- NAME = Displaced Humerus Anterior
-
-diff --git a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
-index 93c3afb..3694e94 100644
---- a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
-+++ b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
-@@ -96,11 +96,11 @@
- marvell,function = "gpio";
- };
- pmx_led_rebuild_brt_ctrl_1: pmx-led-rebuild-brt-ctrl-1 {
-- marvell,pins = "mpp44";
-+ marvell,pins = "mpp46";
- marvell,function = "gpio";
- };
- pmx_led_rebuild_brt_ctrl_2: pmx-led-rebuild-brt-ctrl-2 {
-- marvell,pins = "mpp45";
-+ marvell,pins = "mpp47";
- marvell,function = "gpio";
- };
-
-@@ -157,14 +157,14 @@
- gpios = <&gpio0 16 0>;
- linux,default-trigger = "default-on";
- };
-- health_led1 {
-+ rebuild_led {
-+ label = "status:white:rebuild_led";
-+ gpios = <&gpio1 4 0>;
-+ };
-+ health_led {
- label = "status:red:health_led";
- gpios = <&gpio1 5 0>;
- };
-- health_led2 {
-- label = "status:white:health_led";
-- gpios = <&gpio1 4 0>;
-- };
- backup_led {
- label = "status:blue:backup_led";
- gpios = <&gpio0 15 0>;
-diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
-index f0727e8..0edce4b 100644
---- a/arch/arm/mach-imx/clk-imx35.c
-+++ b/arch/arm/mach-imx/clk-imx35.c
-@@ -257,6 +257,7 @@ int __init mx35_clocks_init()
- clk_register_clkdev(clk[wdog_gate], NULL, "imx2-wdt.0");
- clk_register_clkdev(clk[nfc_div], NULL, "imx25-nand.0");
- clk_register_clkdev(clk[csi_gate], NULL, "mx3-camera.0");
-+ clk_register_clkdev(clk[admux_gate], "audmux", NULL);
-
- clk_prepare_enable(clk[spba_gate]);
- clk_prepare_enable(clk[gpio1_gate]);
-diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index 5edd174..7361e47 100644
---- a/arch/x86/include/asm/paravirt.h
-+++ b/arch/x86/include/asm/paravirt.h
-@@ -703,7 +703,10 @@ static inline void arch_leave_lazy_mmu_mode(void)
- PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
- }
-
--void arch_flush_lazy_mmu_mode(void);
-+static inline void arch_flush_lazy_mmu_mode(void)
-+{
-+ PVOP_VCALL0(pv_mmu_ops.lazy_mode.flush);
-+}
-
- static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
- phys_addr_t phys, pgprot_t flags)
-diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 142236e..b3b0ec1 100644
---- a/arch/x86/include/asm/paravirt_types.h
-+++ b/arch/x86/include/asm/paravirt_types.h
-@@ -91,6 +91,7 @@ struct pv_lazy_ops {
- /* Set deferred update mode, used for batching operations. */
- void (*enter)(void);
- void (*leave)(void);
-+ void (*flush)(void);
- };
-
- struct pv_time_ops {
-@@ -679,6 +680,7 @@ void paravirt_end_context_switch(struct task_struct *next);
-
- void paravirt_enter_lazy_mmu(void);
- void paravirt_leave_lazy_mmu(void);
-+void paravirt_flush_lazy_mmu(void);
-
- void _paravirt_nop(void);
- u32 _paravirt_ident_32(u32);
-diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h
-index 4fef207..c779730 100644
---- a/arch/x86/include/asm/tlb.h
-+++ b/arch/x86/include/asm/tlb.h
-@@ -7,7 +7,7 @@
-
- #define tlb_flush(tlb) \
- { \
-- if (tlb->fullmm == 0) \
-+ if (!tlb->fullmm && !tlb->need_flush_all) \
- flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end, 0UL); \
- else \
- flush_tlb_mm_range(tlb->mm, 0UL, TLB_FLUSH_ALL, 0UL); \
-diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 17fff18..8bfb335 100644
---- a/arch/x86/kernel/paravirt.c
-+++ b/arch/x86/kernel/paravirt.c
-@@ -263,6 +263,18 @@ void paravirt_leave_lazy_mmu(void)
- leave_lazy(PARAVIRT_LAZY_MMU);
- }
-
-+void paravirt_flush_lazy_mmu(void)
-+{
-+ preempt_disable();
-+
-+ if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
-+ arch_leave_lazy_mmu_mode();
-+ arch_enter_lazy_mmu_mode();
-+ }
-+
-+ preempt_enable();
-+}
-+
- void paravirt_start_context_switch(struct task_struct *prev)
- {
- BUG_ON(preemptible());
-@@ -292,18 +304,6 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
- return this_cpu_read(paravirt_lazy_mode);
- }
-
--void arch_flush_lazy_mmu_mode(void)
--{
-- preempt_disable();
--
-- if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
-- arch_leave_lazy_mmu_mode();
-- arch_enter_lazy_mmu_mode();
-- }
--
-- preempt_enable();
--}
--
- struct pv_info pv_info = {
- .name = "bare hardware",
- .paravirt_enabled = 0,
-@@ -475,6 +475,7 @@ struct pv_mmu_ops pv_mmu_ops = {
- .lazy_mode = {
- .enter = paravirt_nop,
- .leave = paravirt_nop,
-+ .flush = paravirt_nop,
- },
-
- .set_fixmap = native_set_fixmap,
-diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index df4176c..20a4fd4 100644
---- a/arch/x86/lguest/boot.c
-+++ b/arch/x86/lguest/boot.c
-@@ -1333,6 +1333,7 @@ __init void lguest_init(void)
- pv_mmu_ops.read_cr3 = lguest_read_cr3;
- pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
- pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mmu_mode;
-+ pv_mmu_ops.lazy_mode.flush = paravirt_flush_lazy_mmu;
- pv_mmu_ops.pte_update = lguest_pte_update;
- pv_mmu_ops.pte_update_defer = lguest_pte_update;
-
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index fb674fd..4f7d793 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -378,10 +378,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
- if (pgd_none(*pgd_ref))
- return -1;
-
-- if (pgd_none(*pgd))
-+ if (pgd_none(*pgd)) {
- set_pgd(pgd, *pgd_ref);
-- else
-+ arch_flush_lazy_mmu_mode();
-+ } else {
- BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
-+ }
-
- /*
- * Below here mismatches are bugs because these lower tables
-diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index e27fbf8..395b3b4 100644
---- a/arch/x86/mm/pgtable.c
-+++ b/arch/x86/mm/pgtable.c
-@@ -58,6 +58,13 @@ void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
- void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
- {
- paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
-+ /*
-+ * NOTE! For PAE, any changes to the top page-directory-pointer-table
-+ * entries need a full cr3 reload to flush.
-+ */
-+#ifdef CONFIG_X86_PAE
-+ tlb->need_flush_all = 1;
-+#endif
- tlb_remove_page(tlb, virt_to_page(pmd));
- }
-
-diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 01de35c..cab96b6 100644
---- a/arch/x86/xen/mmu.c
-+++ b/arch/x86/xen/mmu.c
-@@ -2190,6 +2190,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
- .lazy_mode = {
- .enter = paravirt_enter_lazy_mmu,
- .leave = xen_leave_lazy_mmu,
-+ .flush = paravirt_flush_lazy_mmu,
- },
-
- .set_fixmap = xen_set_fixmap,
-diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
-index 5a31264..8607724 100644
---- a/drivers/dma/omap-dma.c
-+++ b/drivers/dma/omap-dma.c
-@@ -276,12 +276,20 @@ static void omap_dma_issue_pending(struct dma_chan *chan)
-
- spin_lock_irqsave(&c->vc.lock, flags);
- if (vchan_issue_pending(&c->vc) && !c->desc) {
-- struct omap_dmadev *d = to_omap_dma_dev(chan->device);
-- spin_lock(&d->lock);
-- if (list_empty(&c->node))
-- list_add_tail(&c->node, &d->pending);
-- spin_unlock(&d->lock);
-- tasklet_schedule(&d->task);
-+ /*
-+ * c->cyclic is used only by audio and in this case the DMA need
-+ * to be started without delay.
-+ */
-+ if (!c->cyclic) {
-+ struct omap_dmadev *d = to_omap_dma_dev(chan->device);
-+ spin_lock(&d->lock);
-+ if (list_empty(&c->node))
-+ list_add_tail(&c->node, &d->pending);
-+ spin_unlock(&d->lock);
-+ tasklet_schedule(&d->task);
-+ } else {
-+ omap_dma_start_desc(c);
-+ }
- }
- spin_unlock_irqrestore(&c->vc.lock, flags);
- }
-diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
-index d542a14..ea537fa 100644
---- a/drivers/gpio/gpiolib-of.c
-+++ b/drivers/gpio/gpiolib-of.c
-@@ -228,7 +228,7 @@ static void of_gpiochip_add_pin_range(struct gpio_chip *chip)
- if (!np)
- return;
-
-- do {
-+ for (;; index++) {
- ret = of_parse_phandle_with_args(np, "gpio-ranges",
- "#gpio-range-cells", index, &pinspec);
- if (ret)
-@@ -257,8 +257,7 @@ static void of_gpiochip_add_pin_range(struct gpio_chip *chip)
-
- if (ret)
- break;
--
-- } while (index++);
-+ }
- }
-
- #else
-diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
-index fe5cdbc..b44d548 100644
---- a/drivers/gpu/drm/udl/udl_connector.c
-+++ b/drivers/gpu/drm/udl/udl_connector.c
-@@ -61,6 +61,10 @@ static int udl_get_modes(struct drm_connector *connector)
- int ret;
-
- edid = (struct edid *)udl_get_edid(udl);
-+ if (!edid) {
-+ drm_mode_connector_update_edid_property(connector, NULL);
-+ return 0;
-+ }
-
- /*
- * We only read the main block, but if the monitor reports extension
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
-index 21a8242..18d3764 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
-@@ -1137,9 +1137,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
- gain0_15 = ((biq1 & 0xf) << 12) |
- ((tia & 0xf) << 8) |
- ((lna2 & 0x3) << 6) |
-- ((lna2 & 0x3) << 4) |
-- ((lna1 & 0x3) << 2) |
-- ((lna1 & 0x3) << 0);
-+ ((lna2 &
-+ 0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
-
- mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
- mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
-@@ -1157,8 +1156,6 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
- }
-
- mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
-- mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
-- mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
-
- }
-
-@@ -1331,43 +1328,6 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
- return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
- }
-
--static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
-- u16 tia_gain, u16 lna2_gain)
--{
-- u32 i_thresh_l, q_thresh_l;
-- u32 i_thresh_h, q_thresh_h;
-- struct lcnphy_iq_est iq_est_h, iq_est_l;
--
-- wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
-- lna2_gain, 0);
--
-- wlc_lcnphy_rx_gain_override_enable(pi, true);
-- wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
-- udelay(500);
-- write_radio_reg(pi, RADIO_2064_REG112, 0);
-- if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
-- return false;
--
-- wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
-- udelay(500);
-- write_radio_reg(pi, RADIO_2064_REG112, 0);
-- if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
-- return false;
--
-- i_thresh_l = (iq_est_l.i_pwr << 1);
-- i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
--
-- q_thresh_l = (iq_est_l.q_pwr << 1);
-- q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
-- if ((iq_est_h.i_pwr > i_thresh_l) &&
-- (iq_est_h.i_pwr < i_thresh_h) &&
-- (iq_est_h.q_pwr > q_thresh_l) &&
-- (iq_est_h.q_pwr < q_thresh_h))
-- return true;
--
-- return false;
--}
--
- static bool
- wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
- const struct lcnphy_rx_iqcomp *iqcomp,
-@@ -1382,8 +1342,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
- RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
- rfoverride3_old, rfoverride3val_old, rfoverride4_old,
- rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
-- int tia_gain, lna2_gain, biq1_gain;
-- bool set_gain;
-+ int tia_gain;
-+ u32 received_power, rx_pwr_threshold;
- u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
- u16 values_to_save[11];
- s16 *ptr;
-@@ -1408,134 +1368,126 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
- goto cal_done;
- }
-
-- WARN_ON(module != 1);
-- tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-- wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
--
-- for (i = 0; i < 11; i++)
-- values_to_save[i] =
-- read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-- Core1TxControl_old = read_phy_reg(pi, 0x631);
--
-- or_phy_reg(pi, 0x631, 0x0015);
--
-- RFOverride0_old = read_phy_reg(pi, 0x44c);
-- RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-- rfoverride2_old = read_phy_reg(pi, 0x4b0);
-- rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-- rfoverride3_old = read_phy_reg(pi, 0x4f9);
-- rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-- rfoverride4_old = read_phy_reg(pi, 0x938);
-- rfoverride4val_old = read_phy_reg(pi, 0x939);
-- afectrlovr_old = read_phy_reg(pi, 0x43b);
-- afectrlovrval_old = read_phy_reg(pi, 0x43c);
-- old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-- old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
--
-- tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-- if (tx_gain_override_old) {
-- wlc_lcnphy_get_tx_gain(pi, &old_gains);
-- tx_gain_index_old = pi_lcn->lcnphy_current_index;
-- }
--
-- wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
-+ if (module == 1) {
-
-- mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-- mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
-+ tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-+ wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
-
-- mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-- mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
-+ for (i = 0; i < 11; i++)
-+ values_to_save[i] =
-+ read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-+ Core1TxControl_old = read_phy_reg(pi, 0x631);
-+
-+ or_phy_reg(pi, 0x631, 0x0015);
-+
-+ RFOverride0_old = read_phy_reg(pi, 0x44c);
-+ RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-+ rfoverride2_old = read_phy_reg(pi, 0x4b0);
-+ rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-+ rfoverride3_old = read_phy_reg(pi, 0x4f9);
-+ rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-+ rfoverride4_old = read_phy_reg(pi, 0x938);
-+ rfoverride4val_old = read_phy_reg(pi, 0x939);
-+ afectrlovr_old = read_phy_reg(pi, 0x43b);
-+ afectrlovrval_old = read_phy_reg(pi, 0x43c);
-+ old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-+ old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-+
-+ tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-+ if (tx_gain_override_old) {
-+ wlc_lcnphy_get_tx_gain(pi, &old_gains);
-+ tx_gain_index_old = pi_lcn->lcnphy_current_index;
-+ }
-
-- write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-- write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-- write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-- write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-- write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-- mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-- write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-- write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-- write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-- write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
--
-- mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-- mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-- mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-- mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-- mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-- mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-- mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-- mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-- mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-- mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
-+ wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
-
-- mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-- mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-+ mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-+ mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
-
-- write_phy_reg(pi, 0x6da, 0xffff);
-- or_phy_reg(pi, 0x6db, 0x3);
-+ mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-+ mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
-
-- wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-- set_gain = false;
--
-- lna2_gain = 3;
-- while ((lna2_gain >= 0) && !set_gain) {
-- tia_gain = 4;
--
-- while ((tia_gain >= 0) && !set_gain) {
-- biq1_gain = 6;
--
-- while ((biq1_gain >= 0) && !set_gain) {
-- set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
-- (u16)
-- biq1_gain,
-- (u16)
-- tia_gain,
-- (u16)
-- lna2_gain);
-- biq1_gain -= 1;
-- }
-+ write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-+ write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-+ write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-+ write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-+ write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-+ mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-+ write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-+ write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-+ write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-+ write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-+
-+ mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-+ mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-+ mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-+ mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-+ mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-+ mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-+ mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-+ mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-+ mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-+ mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
-+
-+ mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-+ mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-+
-+ wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
-+ write_phy_reg(pi, 0x6da, 0xffff);
-+ or_phy_reg(pi, 0x6db, 0x3);
-+ wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-+ wlc_lcnphy_rx_gain_override_enable(pi, true);
-+
-+ tia_gain = 8;
-+ rx_pwr_threshold = 950;
-+ while (tia_gain > 0) {
- tia_gain -= 1;
-+ wlc_lcnphy_set_rx_gain_by_distribution(pi,
-+ 0, 0, 2, 2,
-+ (u16)
-+ tia_gain, 1, 0);
-+ udelay(500);
-+
-+ received_power =
-+ wlc_lcnphy_measure_digital_power(pi, 2000);
-+ if (received_power < rx_pwr_threshold)
-+ break;
- }
-- lna2_gain -= 1;
-- }
-+ result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
-
-- if (set_gain)
-- result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
-- else
-- result = false;
-+ wlc_lcnphy_stop_tx_tone(pi);
-
-- wlc_lcnphy_stop_tx_tone(pi);
-+ write_phy_reg(pi, 0x631, Core1TxControl_old);
-
-- write_phy_reg(pi, 0x631, Core1TxControl_old);
--
-- write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-- write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-- write_phy_reg(pi, 0x4b0, rfoverride2_old);
-- write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-- write_phy_reg(pi, 0x4f9, rfoverride3_old);
-- write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-- write_phy_reg(pi, 0x938, rfoverride4_old);
-- write_phy_reg(pi, 0x939, rfoverride4val_old);
-- write_phy_reg(pi, 0x43b, afectrlovr_old);
-- write_phy_reg(pi, 0x43c, afectrlovrval_old);
-- write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-- write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
-+ write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-+ write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-+ write_phy_reg(pi, 0x4b0, rfoverride2_old);
-+ write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-+ write_phy_reg(pi, 0x4f9, rfoverride3_old);
-+ write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-+ write_phy_reg(pi, 0x938, rfoverride4_old);
-+ write_phy_reg(pi, 0x939, rfoverride4val_old);
-+ write_phy_reg(pi, 0x43b, afectrlovr_old);
-+ write_phy_reg(pi, 0x43c, afectrlovrval_old);
-+ write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-+ write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
-
-- wlc_lcnphy_clear_trsw_override(pi);
-+ wlc_lcnphy_clear_trsw_override(pi);
-
-- mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
-+ mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
-
-- for (i = 0; i < 11; i++)
-- write_radio_reg(pi, rxiq_cal_rf_reg[i],
-- values_to_save[i]);
-+ for (i = 0; i < 11; i++)
-+ write_radio_reg(pi, rxiq_cal_rf_reg[i],
-+ values_to_save[i]);
-
-- if (tx_gain_override_old)
-- wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-- else
-- wlc_lcnphy_disable_tx_gain_override(pi);
-+ if (tx_gain_override_old)
-+ wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-+ else
-+ wlc_lcnphy_disable_tx_gain_override(pi);
-
-- wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-- wlc_lcnphy_rx_gain_override_enable(pi, false);
-+ wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-+ wlc_lcnphy_rx_gain_override_enable(pi, false);
-+ }
-
- cal_done:
- kfree(ptr);
-@@ -1829,17 +1781,6 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
- write_radio_reg(pi, RADIO_2064_REG038, 3);
- write_radio_reg(pi, RADIO_2064_REG091, 7);
- }
--
-- if (!(pi->sh->boardflags & BFL_FEM)) {
-- u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
-- 0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
--
-- write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
-- write_radio_reg(pi, RADIO_2064_REG091, 0x3);
-- write_radio_reg(pi, RADIO_2064_REG038, 0x3);
--
-- write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
-- }
- }
-
- static int
-@@ -2034,16 +1975,6 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
- } else {
- mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
- mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
-- mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
-- mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
-- mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
-- mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
-- mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-- mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
-- mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
-- mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
-- mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
-- mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
- }
- } else {
- mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
-@@ -2130,14 +2061,12 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
- (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
-
- mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
-- mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
- }
-
- static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
- {
- struct phytbl_info tab;
- u32 rfseq, ind;
-- u8 tssi_sel;
-
- tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
- tab.tbl_width = 32;
-@@ -2159,13 +2088,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
-
- mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
-
-- if (pi->sh->boardflags & BFL_FEM) {
-- tssi_sel = 0x1;
-- wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
-- } else {
-- tssi_sel = 0xe;
-- wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
-- }
-+ wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
- mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
-
- mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
-@@ -2201,10 +2124,9 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
- mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
-
- if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
-- mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
-+ mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
- mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
- } else {
-- mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
- mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
- mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
- }
-@@ -2251,10 +2173,6 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
-
- mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
-
-- mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
-- mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
-- mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
--
- wlc_lcnphy_pwrctrl_rssiparams(pi);
- }
-
-@@ -2873,8 +2791,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
- read_radio_reg(pi, RADIO_2064_REG007) & 1;
- u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
- u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
-- u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
--
- idleTssi = read_phy_reg(pi, 0x4ab);
- suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
- MCTL_EN_MAC));
-@@ -2892,12 +2808,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
- mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
- mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
- wlc_lcnphy_tssi_setup(pi);
--
-- mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
-- mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
--
-- wlc_lcnphy_set_bbmult(pi, 0x0);
--
- wlc_phy_do_dummy_tx(pi, true, OFF);
- idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
- >> 0);
-@@ -2919,7 +2829,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
-
- mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
-
-- wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
- wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
- wlc_lcnphy_set_tx_gain(pi, &old_gains);
- wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
-@@ -3133,11 +3042,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
- wlc_lcnphy_write_table(pi, &tab);
- tab.tbl_offset++;
- }
-- mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
-- mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
-- mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
-- mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
-- mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
-
- mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
-
-@@ -3939,6 +3843,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
- target_gains.pad_gain = 21;
- target_gains.dac_gain = 0;
- wlc_lcnphy_set_tx_gain(pi, &target_gains);
-+ wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
-
- if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
-
-@@ -3949,7 +3854,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
- lcnphy_recal ? LCNPHY_CAL_RECAL :
- LCNPHY_CAL_FULL), false);
- } else {
-- wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
- wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
- }
-
-@@ -4374,22 +4278,17 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
- if (CHSPEC_IS5G(pi->radio_chanspec))
- pa_gain = 0x70;
- else
-- pa_gain = 0x60;
-+ pa_gain = 0x70;
-
- if (pi->sh->boardflags & BFL_FEM)
- pa_gain = 0x10;
--
- tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
- tab.tbl_width = 32;
- tab.tbl_len = 1;
- tab.tbl_ptr = &val;
-
- for (j = 0; j < 128; j++) {
-- if (pi->sh->boardflags & BFL_FEM)
-- gm_gain = gain_table[j].gm;
-- else
-- gm_gain = 15;
--
-+ gm_gain = gain_table[j].gm;
- val = (((u32) pa_gain << 24) |
- (gain_table[j].pad << 16) |
- (gain_table[j].pga << 8) | gm_gain);
-@@ -4600,10 +4499,7 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
-
- write_phy_reg(pi, 0x4ea, 0x4688);
-
-- if (pi->sh->boardflags & BFL_FEM)
-- mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
-- else
-- mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
-+ mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
-
- mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
-
-@@ -4614,13 +4510,6 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
- wlc_lcnphy_rcal(pi);
-
- wlc_lcnphy_rc_cal(pi);
--
-- if (!(pi->sh->boardflags & BFL_FEM)) {
-- write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
-- write_radio_reg(pi, RADIO_2064_REG033, 0x19);
-- write_radio_reg(pi, RADIO_2064_REG039, 0xe);
-- }
--
- }
-
- static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
-@@ -4650,20 +4539,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
- wlc_lcnphy_write_table(pi, &tab);
- }
-
-- if (!(pi->sh->boardflags & BFL_FEM)) {
-- tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-- tab.tbl_width = 16;
-- tab.tbl_ptr = &val;
-- tab.tbl_len = 1;
-+ tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-+ tab.tbl_width = 16;
-+ tab.tbl_ptr = &val;
-+ tab.tbl_len = 1;
-
-- val = 150;
-- tab.tbl_offset = 0;
-- wlc_lcnphy_write_table(pi, &tab);
-+ val = 114;
-+ tab.tbl_offset = 0;
-+ wlc_lcnphy_write_table(pi, &tab);
-
-- val = 220;
-- tab.tbl_offset = 1;
-- wlc_lcnphy_write_table(pi, &tab);
-- }
-+ val = 130;
-+ tab.tbl_offset = 1;
-+ wlc_lcnphy_write_table(pi, &tab);
-+
-+ val = 6;
-+ tab.tbl_offset = 8;
-+ wlc_lcnphy_write_table(pi, &tab);
-
- if (CHSPEC_IS2G(pi->radio_chanspec)) {
- if (pi->sh->boardflags & BFL_FEM)
-@@ -5055,7 +4946,6 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
- wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
-
- mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
-- wlc_lcnphy_tssi_setup(pi);
- }
-
- void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
-@@ -5094,7 +4984,8 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
- if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
- return false;
-
-- if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
-+ if ((pi->sh->boardflags & BFL_FEM) &&
-+ (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
- if (pi_lcn->lcnphy_tempsense_option == 3) {
- pi->hwpwrctrl = true;
- pi->hwpwrctrl_capable = true;
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
-index b7e95ac..622c01c 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
-@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
- };
-
- static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
-- 0x0009,
- 0x000a,
-- 0x0005,
-- 0x0006,
- 0x0009,
-- 0x000a,
-- 0x0005,
- 0x0006,
-- 0x0009,
-- 0x000a,
- 0x0005,
-- 0x0006,
-- 0x0009,
- 0x000a,
-- 0x0005,
-- 0x0006,
- 0x0009,
-- 0x000a,
-- 0x0005,
- 0x0006,
-- 0x0009,
-- 0x000a,
- 0x0005,
-- 0x0006,
-- 0x0009,
- 0x000a,
-- 0x0005,
-- 0x0006,
- 0x0009,
-- 0x000a,
-- 0x0005,
- 0x0006,
-- 0x0009,
-- 0x000a,
- 0x0005,
-- 0x0006,
-- 0x0009,
- 0x000a,
-- 0x0005,
-- 0x0006,
- 0x0009,
-- 0x000a,
-- 0x0005,
- 0x0006,
-- 0x0009,
-- 0x000a,
- 0x0005,
-- 0x0006,
-+ 0x000a,
- 0x0009,
-+ 0x0006,
-+ 0x0005,
- 0x000a,
-+ 0x0009,
-+ 0x0006,
- 0x0005,
-+ 0x000a,
-+ 0x0009,
- 0x0006,
-+ 0x0005,
-+ 0x000a,
- 0x0009,
-+ 0x0006,
-+ 0x0005,
- 0x000a,
-+ 0x0009,
-+ 0x0006,
- 0x0005,
-+ 0x000a,
-+ 0x0009,
- 0x0006,
-+ 0x0005,
-+ 0x000a,
- 0x0009,
-+ 0x0006,
-+ 0x0005,
- 0x000a,
-+ 0x0009,
-+ 0x0006,
- 0x0005,
-+ 0x000a,
-+ 0x0009,
- 0x0006,
-+ 0x0005,
-+ 0x000a,
- 0x0009,
-+ 0x0006,
-+ 0x0005,
- 0x000a,
-+ 0x0009,
-+ 0x0006,
- 0x0005,
-+ 0x000a,
-+ 0x0009,
- 0x0006,
-+ 0x0005,
- };
-
- static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
-diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
-index aec2e0d..1924d8b 100644
---- a/drivers/scsi/libsas/sas_expander.c
-+++ b/drivers/scsi/libsas/sas_expander.c
-@@ -235,6 +235,17 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
- linkrate = phy->linkrate;
- memcpy(sas_addr, phy->attached_sas_addr, SAS_ADDR_SIZE);
-
-+ /* Handle vacant phy - rest of dr data is not valid so skip it */
-+ if (phy->phy_state == PHY_VACANT) {
-+ memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
-+ phy->attached_dev_type = NO_DEVICE;
-+ if (!test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state)) {
-+ phy->phy_id = phy_id;
-+ goto skip;
-+ } else
-+ goto out;
-+ }
-+
- phy->attached_dev_type = to_dev_type(dr);
- if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
- goto out;
-@@ -272,6 +283,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
- phy->phy->maximum_linkrate = dr->pmax_linkrate;
- phy->phy->negotiated_linkrate = phy->linkrate;
-
-+ skip:
- if (new_phy)
- if (sas_phy_add(phy->phy)) {
- sas_phy_free(phy->phy);
-diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
-index 7d4ec02..fea564c 100644
---- a/drivers/target/target_core_alua.c
-+++ b/drivers/target/target_core_alua.c
-@@ -408,6 +408,7 @@ static inline int core_alua_state_standby(
- case REPORT_LUNS:
- case RECEIVE_DIAGNOSTIC:
- case SEND_DIAGNOSTIC:
-+ return 0;
- case MAINTENANCE_IN:
- switch (cdb[1] & 0x1f) {
- case MI_REPORT_TARGET_PGS:
-@@ -450,6 +451,7 @@ static inline int core_alua_state_unavailable(
- switch (cdb[0]) {
- case INQUIRY:
- case REPORT_LUNS:
-+ return 0;
- case MAINTENANCE_IN:
- switch (cdb[1] & 0x1f) {
- case MI_REPORT_TARGET_PGS:
-@@ -490,6 +492,7 @@ static inline int core_alua_state_transition(
- switch (cdb[0]) {
- case INQUIRY:
- case REPORT_LUNS:
-+ return 0;
- case MAINTENANCE_IN:
- switch (cdb[1] & 0x1f) {
- case MI_REPORT_TARGET_PGS:
-diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
-index c578229..78f1be2 100644
---- a/drivers/tty/tty_ldisc.c
-+++ b/drivers/tty/tty_ldisc.c
-@@ -934,17 +934,17 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
- * race with the set_ldisc code path.
- */
-
-- tty_lock_pair(tty, o_tty);
- tty_ldisc_halt(tty);
-- tty_ldisc_flush_works(tty);
-- if (o_tty) {
-+ if (o_tty)
- tty_ldisc_halt(o_tty);
-+
-+ tty_ldisc_flush_works(tty);
-+ if (o_tty)
- tty_ldisc_flush_works(o_tty);
-- }
-
-+ tty_lock_pair(tty, o_tty);
- /* This will need doing differently if we need to lock */
- tty_ldisc_kill(tty);
--
- if (o_tty)
- tty_ldisc_kill(o_tty);
-
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index 12b3da3..f7199b9 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -1546,14 +1546,24 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
- }
- break;
- case Opt_blank_pass:
-- vol->password = NULL;
-- break;
-- case Opt_pass:
- /* passwords have to be handled differently
- * to allow the character used for deliminator
- * to be passed within them
- */
-
-+ /*
-+ * Check if this is a case where the password
-+ * starts with a delimiter
-+ */
-+ tmp_end = strchr(data, '=');
-+ tmp_end++;
-+ if (!(tmp_end < end && tmp_end[1] == delim)) {
-+ /* No it is not. Set the password to NULL */
-+ vol->password = NULL;
-+ break;
-+ }
-+ /* Yes it is. Drop down to Opt_pass below.*/
-+ case Opt_pass:
- /* Obtain the value string */
- value = strchr(data, '=');
- value++;
-diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
-index 991ab2d..7af426b 100644
---- a/fs/gfs2/file.c
-+++ b/fs/gfs2/file.c
-@@ -924,8 +924,11 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
- cmd = F_SETLK;
- fl->fl_type = F_UNLCK;
- }
-- if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags)))
-+ if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags))) {
-+ if (fl->fl_type == F_UNLCK)
-+ posix_lock_file_wait(file, fl);
- return -EIO;
-+ }
- if (IS_GETLK(cmd))
- return dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
- else if (fl->fl_type == F_UNLCK)
-diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
-index b7eff07..9afba3d6 100644
---- a/fs/gfs2/rgrp.c
-+++ b/fs/gfs2/rgrp.c
-@@ -576,7 +576,7 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
- RB_CLEAR_NODE(&ip->i_res->rs_node);
- out:
- up_write(&ip->i_rw_mutex);
-- return 0;
-+ return error;
- }
-
- static void dump_rs(struct seq_file *seq, const struct gfs2_blkreserv *rs)
-diff --git a/fs/inode.c b/fs/inode.c
-index 14084b7..b98540e 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -725,7 +725,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
- * inode to the back of the list so we don't spin on it.
- */
- if (!spin_trylock(&inode->i_lock)) {
-- list_move_tail(&inode->i_lru, &sb->s_inode_lru);
-+ list_move(&inode->i_lru, &sb->s_inode_lru);
- continue;
- }
-
-diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
-index 25f01d0..b1b1fa6 100644
---- a/include/asm-generic/tlb.h
-+++ b/include/asm-generic/tlb.h
-@@ -99,7 +99,12 @@ struct mmu_gather {
- unsigned int need_flush : 1, /* Did free PTEs */
- fast_mode : 1; /* No batching */
-
-- unsigned int fullmm;
-+ /* we are in the middle of an operation to clear
-+ * a full mm and can make some optimizations */
-+ unsigned int fullmm : 1,
-+ /* we have performed an operation which
-+ * requires a complete flush of the tlb */
-+ need_flush_all : 1;
-
- struct mmu_gather_batch *active;
- struct mmu_gather_batch local;
-diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
-index 92691d8..616603d 100644
---- a/include/linux/ftrace.h
-+++ b/include/linux/ftrace.h
-@@ -394,7 +394,6 @@ ssize_t ftrace_filter_write(struct file *file, const char __user *ubuf,
- size_t cnt, loff_t *ppos);
- ssize_t ftrace_notrace_write(struct file *file, const char __user *ubuf,
- size_t cnt, loff_t *ppos);
--loff_t ftrace_regex_lseek(struct file *file, loff_t offset, int whence);
- int ftrace_regex_release(struct inode *inode, struct file *file);
-
- void __init
-@@ -567,6 +566,8 @@ static inline int
- ftrace_regex_release(struct inode *inode, struct file *file) { return -ENODEV; }
- #endif /* CONFIG_DYNAMIC_FTRACE */
-
-+loff_t ftrace_filter_lseek(struct file *file, loff_t offset, int whence);
-+
- /* totally disable ftrace - can not re-enable after this */
- void ftrace_kill(void);
-
-diff --git a/ipc/msg.c b/ipc/msg.c
-index 31cd1bf..fede1d0 100644
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -872,6 +872,7 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
- goto out_unlock;
- break;
- }
-+ msg = ERR_PTR(-EAGAIN);
- } else
- break;
- msg_counter++;
-diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
-index c685e31..c3ae144 100644
---- a/kernel/sched/clock.c
-+++ b/kernel/sched/clock.c
-@@ -176,10 +176,36 @@ static u64 sched_clock_remote(struct sched_clock_data *scd)
- u64 this_clock, remote_clock;
- u64 *ptr, old_val, val;
-
-+#if BITS_PER_LONG != 64
-+again:
-+ /*
-+ * Careful here: The local and the remote clock values need to
-+ * be read out atomic as we need to compare the values and
-+ * then update either the local or the remote side. So the
-+ * cmpxchg64 below only protects one readout.
-+ *
-+ * We must reread via sched_clock_local() in the retry case on
-+ * 32bit as an NMI could use sched_clock_local() via the
-+ * tracer and hit between the readout of
-+ * the low32bit and the high 32bit portion.
-+ */
-+ this_clock = sched_clock_local(my_scd);
-+ /*
-+ * We must enforce atomic readout on 32bit, otherwise the
-+ * update on the remote cpu can hit inbetween the readout of
-+ * the low32bit and the high 32bit portion.
-+ */
-+ remote_clock = cmpxchg64(&scd->clock, 0, 0);
-+#else
-+ /*
-+ * On 64bit the read of [my]scd->clock is atomic versus the
-+ * update, so we can avoid the above 32bit dance.
-+ */
- sched_clock_local(my_scd);
- again:
- this_clock = my_scd->clock;
- remote_clock = scd->clock;
-+#endif
-
- /*
- * Use the opportunity that we have both locks
-diff --git a/kernel/sys.c b/kernel/sys.c
-index 265b376..47f1d1b 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -323,7 +323,6 @@ void kernel_restart_prepare(char *cmd)
- system_state = SYSTEM_RESTART;
- usermodehelper_disable();
- device_shutdown();
-- syscore_shutdown();
- }
-
- /**
-@@ -369,6 +368,7 @@ void kernel_restart(char *cmd)
- {
- kernel_restart_prepare(cmd);
- disable_nonboot_cpus();
-+ syscore_shutdown();
- if (!cmd)
- printk(KERN_EMERG "Restarting system.\n");
- else
-@@ -394,6 +394,7 @@ static void kernel_shutdown_prepare(enum system_states state)
- void kernel_halt(void)
- {
- kernel_shutdown_prepare(SYSTEM_HALT);
-+ disable_nonboot_cpus();
- syscore_shutdown();
- printk(KERN_EMERG "System halted.\n");
- kmsg_dump(KMSG_DUMP_HALT);
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 64bc5d8..35cc3a8 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -668,7 +668,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
- free_page(tmp);
- }
-
-- free_page((unsigned long)stat->pages);
- stat->pages = NULL;
- stat->start = NULL;
-
-@@ -1028,6 +1027,19 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
-
- static struct pid * const ftrace_swapper_pid = &init_struct_pid;
-
-+loff_t
-+ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
-+{
-+ loff_t ret;
-+
-+ if (file->f_mode & FMODE_READ)
-+ ret = seq_lseek(file, offset, whence);
-+ else
-+ file->f_pos = ret = 1;
-+
-+ return ret;
-+}
-+
- #ifdef CONFIG_DYNAMIC_FTRACE
-
- #ifndef CONFIG_FTRACE_MCOUNT_RECORD
-@@ -2590,7 +2602,7 @@ static void ftrace_filter_reset(struct ftrace_hash *hash)
- * routine, you can use ftrace_filter_write() for the write
- * routine if @flag has FTRACE_ITER_FILTER set, or
- * ftrace_notrace_write() if @flag has FTRACE_ITER_NOTRACE set.
-- * ftrace_regex_lseek() should be used as the lseek routine, and
-+ * ftrace_filter_lseek() should be used as the lseek routine, and
- * release must call ftrace_regex_release().
- */
- int
-@@ -2674,19 +2686,6 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
- inode, file);
- }
-
--loff_t
--ftrace_regex_lseek(struct file *file, loff_t offset, int whence)
--{
-- loff_t ret;
--
-- if (file->f_mode & FMODE_READ)
-- ret = seq_lseek(file, offset, whence);
-- else
-- file->f_pos = ret = 1;
--
-- return ret;
--}
--
- static int ftrace_match(char *str, char *regex, int len, int type)
- {
- int matched = 0;
-@@ -3549,7 +3548,7 @@ static const struct file_operations ftrace_filter_fops = {
- .open = ftrace_filter_open,
- .read = seq_read,
- .write = ftrace_filter_write,
-- .llseek = ftrace_regex_lseek,
-+ .llseek = ftrace_filter_lseek,
- .release = ftrace_regex_release,
- };
-
-@@ -3557,7 +3556,7 @@ static const struct file_operations ftrace_notrace_fops = {
- .open = ftrace_notrace_open,
- .read = seq_read,
- .write = ftrace_notrace_write,
-- .llseek = ftrace_regex_lseek,
-+ .llseek = ftrace_filter_lseek,
- .release = ftrace_regex_release,
- };
-
-@@ -3762,8 +3761,8 @@ static const struct file_operations ftrace_graph_fops = {
- .open = ftrace_graph_open,
- .read = seq_read,
- .write = ftrace_graph_write,
-+ .llseek = ftrace_filter_lseek,
- .release = ftrace_graph_release,
-- .llseek = seq_lseek,
- };
- #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
-
-@@ -4421,7 +4420,7 @@ static const struct file_operations ftrace_pid_fops = {
- .open = ftrace_pid_open,
- .write = ftrace_pid_write,
- .read = seq_read,
-- .llseek = seq_lseek,
-+ .llseek = ftrace_filter_lseek,
- .release = ftrace_pid_release,
- };
-
-diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
-index 42ca822..83a8b5b 100644
---- a/kernel/trace/trace_stack.c
-+++ b/kernel/trace/trace_stack.c
-@@ -322,7 +322,7 @@ static const struct file_operations stack_trace_filter_fops = {
- .open = stack_trace_filter_open,
- .read = seq_read,
- .write = ftrace_filter_write,
-- .llseek = ftrace_regex_lseek,
-+ .llseek = ftrace_filter_lseek,
- .release = ftrace_regex_release,
- };
-
-diff --git a/lib/kobject.c b/lib/kobject.c
-index e07ee1f..a654866 100644
---- a/lib/kobject.c
-+++ b/lib/kobject.c
-@@ -529,6 +529,13 @@ struct kobject *kobject_get(struct kobject *kobj)
- return kobj;
- }
-
-+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
-+{
-+ if (!kref_get_unless_zero(&kobj->kref))
-+ kobj = NULL;
-+ return kobj;
-+}
-+
- /*
- * kobject_cleanup - free kobject resources.
- * @kobj: object to cleanup
-@@ -751,7 +758,7 @@ struct kobject *kset_find_obj(struct kset *kset, const char *name)
-
- list_for_each_entry(k, &kset->list, entry) {
- if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
-- ret = kobject_get(k);
-+ ret = kobject_get_unless_zero(k);
- break;
- }
- }
-diff --git a/mm/memory.c b/mm/memory.c
-index bb1369f..f8b734a 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -212,6 +212,7 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
- tlb->mm = mm;
-
- tlb->fullmm = fullmm;
-+ tlb->need_flush_all = 0;
- tlb->start = -1UL;
- tlb->end = 0;
- tlb->need_flush = 0;
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index 1440b3f..b54c2e8 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -576,7 +576,7 @@ static int wm5102_sysclk_ev(struct snd_soc_dapm_widget *w,
- struct snd_kcontrol *kcontrol, int event)
- {
- struct snd_soc_codec *codec = w->codec;
-- struct arizona *arizona = dev_get_drvdata(codec->dev);
-+ struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
- struct regmap *regmap = codec->control_data;
- const struct reg_default *patch = NULL;
- int i, patch_size;
-diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
-index 134e41c..f8a31ad 100644
---- a/sound/soc/codecs/wm8903.c
-+++ b/sound/soc/codecs/wm8903.c
-@@ -1083,6 +1083,8 @@ static const struct snd_soc_dapm_route wm8903_intercon[] = {
- { "ROP", NULL, "Right Speaker PGA" },
- { "RON", NULL, "Right Speaker PGA" },
-
-+ { "Charge Pump", NULL, "CLK_DSP" },
-+
- { "Left Headphone Output PGA", NULL, "Charge Pump" },
- { "Right Headphone Output PGA", NULL, "Charge Pump" },
- { "Left Line Output PGA", NULL, "Charge Pump" },
-diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
-index 2370063..f3ab918 100644
---- a/sound/soc/soc-core.c
-+++ b/sound/soc/soc-core.c
-@@ -2959,7 +2959,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
- val = val << shift;
-
- ret = snd_soc_update_bits_locked(codec, reg, val_mask, val);
-- if (ret != 0)
-+ if (ret < 0)
- return ret;
-
- if (snd_soc_volsw_is_stereo(mc)) {
-diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
-index 15520de..190f434 100644
---- a/sound/usb/mixer_quirks.c
-+++ b/sound/usb/mixer_quirks.c
-@@ -509,7 +509,7 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
- else
- ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
- USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
-- 0, cpu_to_le16(wIndex),
-+ 0, wIndex,
- &tmp, sizeof(tmp), 1000);
- up_read(&mixer->chip->shutdown_rwsem);
-
-@@ -540,7 +540,7 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
- else
- ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
- USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
-- cpu_to_le16(wValue), cpu_to_le16(wIndex),
-+ wValue, wIndex,
- NULL, 0, 1000);
- up_read(&mixer->chip->shutdown_rwsem);
-
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 0115289..b9ca776 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -486,7 +486,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
- {
- int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
- 0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-- cpu_to_le16(1), 0, NULL, 0, 1000);
-+ 1, 0, NULL, 0, 1000);
-
- if (ret < 0)
- return ret;
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-04-28 13:03 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-04-28 13:02 [gentoo-commits] proj/hardened-patchset:master commit in: 3.8.10/, 2.6.32/, 3.2.44/, 3.2.43/, 3.8.8/ Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox