* [gentoo-commits] proj/hardened-patchset:master commit in: 3.2.51/, 3.2.50/
@ 2013-09-12 17:30 Anthony G. Basile
0 siblings, 0 replies; only message in thread
From: Anthony G. Basile @ 2013-09-12 17:30 UTC (permalink / raw
To: gentoo-commits
commit: 54161092e44bc640aca2f56b45e4f7455995fb89
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Thu Sep 12 17:29:47 2013 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Thu Sep 12 17:29:47 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=54161092
Grsec/PaX: 2.9.1-3.2.50-201309101928
---
{3.2.50 => 3.2.51}/0000_README | 6 +-
{3.2.50 => 3.2.51}/1021_linux-3.2.22.patch | 0
{3.2.50 => 3.2.51}/1022_linux-3.2.23.patch | 0
{3.2.50 => 3.2.51}/1023_linux-3.2.24.patch | 0
{3.2.50 => 3.2.51}/1024_linux-3.2.25.patch | 0
{3.2.50 => 3.2.51}/1025_linux-3.2.26.patch | 0
{3.2.50 => 3.2.51}/1026_linux-3.2.27.patch | 0
{3.2.50 => 3.2.51}/1027_linux-3.2.28.patch | 0
{3.2.50 => 3.2.51}/1028_linux-3.2.29.patch | 0
{3.2.50 => 3.2.51}/1029_linux-3.2.30.patch | 0
{3.2.50 => 3.2.51}/1030_linux-3.2.31.patch | 0
{3.2.50 => 3.2.51}/1031_linux-3.2.32.patch | 0
{3.2.50 => 3.2.51}/1032_linux-3.2.33.patch | 0
{3.2.50 => 3.2.51}/1033_linux-3.2.34.patch | 0
{3.2.50 => 3.2.51}/1034_linux-3.2.35.patch | 0
{3.2.50 => 3.2.51}/1035_linux-3.2.36.patch | 0
{3.2.50 => 3.2.51}/1036_linux-3.2.37.patch | 0
{3.2.50 => 3.2.51}/1037_linux-3.2.38.patch | 0
{3.2.50 => 3.2.51}/1038_linux-3.2.39.patch | 0
{3.2.50 => 3.2.51}/1039_linux-3.2.40.patch | 0
{3.2.50 => 3.2.51}/1040_linux-3.2.41.patch | 0
{3.2.50 => 3.2.51}/1041_linux-3.2.42.patch | 0
{3.2.50 => 3.2.51}/1042_linux-3.2.43.patch | 0
{3.2.50 => 3.2.51}/1043_linux-3.2.44.patch | 0
{3.2.50 => 3.2.51}/1044_linux-3.2.45.patch | 0
{3.2.50 => 3.2.51}/1045_linux-3.2.46.patch | 0
{3.2.50 => 3.2.51}/1046_linux-3.2.47.patch | 0
{3.2.50 => 3.2.51}/1047_linux-3.2.48.patch | 0
{3.2.50 => 3.2.51}/1048_linux-3.2.49.patch | 0
{3.2.50 => 3.2.51}/1049_linux-3.2.50.patch | 0
3.2.51/1050_linux-3.2.51.patch | 3886 ++++++++++++++++++++
...4420_grsecurity-2.9.1-3.2.51-201309101928.patch | 487 +--
{3.2.50 => 3.2.51}/4425_grsec_remove_EI_PAX.patch | 0
.../4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.2.50 => 3.2.51}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{3.2.50 => 3.2.51}/4470_disable-compat_vdso.patch | 0
{3.2.50 => 3.2.51}/4475_emutramp_default_on.patch | 0
41 files changed, 3992 insertions(+), 387 deletions(-)
diff --git a/3.2.50/0000_README b/3.2.51/0000_README
similarity index 96%
rename from 3.2.50/0000_README
rename to 3.2.51/0000_README
index bbfb98a..84f3d3b 100644
--- a/3.2.50/0000_README
+++ b/3.2.51/0000_README
@@ -118,7 +118,11 @@ Patch: 1049_linux-3.2.50.patch
From: http://www.kernel.org
Desc: Linux 3.2.50
-Patch: 4420_grsecurity-2.9.1-3.2.50-201309081951.patch
+Patch: 1050_linux-3.2.51.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.51
+
+Patch: 4420_grsecurity-2.9.1-3.2.51-201309101928.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.50/1021_linux-3.2.22.patch b/3.2.51/1021_linux-3.2.22.patch
similarity index 100%
rename from 3.2.50/1021_linux-3.2.22.patch
rename to 3.2.51/1021_linux-3.2.22.patch
diff --git a/3.2.50/1022_linux-3.2.23.patch b/3.2.51/1022_linux-3.2.23.patch
similarity index 100%
rename from 3.2.50/1022_linux-3.2.23.patch
rename to 3.2.51/1022_linux-3.2.23.patch
diff --git a/3.2.50/1023_linux-3.2.24.patch b/3.2.51/1023_linux-3.2.24.patch
similarity index 100%
rename from 3.2.50/1023_linux-3.2.24.patch
rename to 3.2.51/1023_linux-3.2.24.patch
diff --git a/3.2.50/1024_linux-3.2.25.patch b/3.2.51/1024_linux-3.2.25.patch
similarity index 100%
rename from 3.2.50/1024_linux-3.2.25.patch
rename to 3.2.51/1024_linux-3.2.25.patch
diff --git a/3.2.50/1025_linux-3.2.26.patch b/3.2.51/1025_linux-3.2.26.patch
similarity index 100%
rename from 3.2.50/1025_linux-3.2.26.patch
rename to 3.2.51/1025_linux-3.2.26.patch
diff --git a/3.2.50/1026_linux-3.2.27.patch b/3.2.51/1026_linux-3.2.27.patch
similarity index 100%
rename from 3.2.50/1026_linux-3.2.27.patch
rename to 3.2.51/1026_linux-3.2.27.patch
diff --git a/3.2.50/1027_linux-3.2.28.patch b/3.2.51/1027_linux-3.2.28.patch
similarity index 100%
rename from 3.2.50/1027_linux-3.2.28.patch
rename to 3.2.51/1027_linux-3.2.28.patch
diff --git a/3.2.50/1028_linux-3.2.29.patch b/3.2.51/1028_linux-3.2.29.patch
similarity index 100%
rename from 3.2.50/1028_linux-3.2.29.patch
rename to 3.2.51/1028_linux-3.2.29.patch
diff --git a/3.2.50/1029_linux-3.2.30.patch b/3.2.51/1029_linux-3.2.30.patch
similarity index 100%
rename from 3.2.50/1029_linux-3.2.30.patch
rename to 3.2.51/1029_linux-3.2.30.patch
diff --git a/3.2.50/1030_linux-3.2.31.patch b/3.2.51/1030_linux-3.2.31.patch
similarity index 100%
rename from 3.2.50/1030_linux-3.2.31.patch
rename to 3.2.51/1030_linux-3.2.31.patch
diff --git a/3.2.50/1031_linux-3.2.32.patch b/3.2.51/1031_linux-3.2.32.patch
similarity index 100%
rename from 3.2.50/1031_linux-3.2.32.patch
rename to 3.2.51/1031_linux-3.2.32.patch
diff --git a/3.2.50/1032_linux-3.2.33.patch b/3.2.51/1032_linux-3.2.33.patch
similarity index 100%
rename from 3.2.50/1032_linux-3.2.33.patch
rename to 3.2.51/1032_linux-3.2.33.patch
diff --git a/3.2.50/1033_linux-3.2.34.patch b/3.2.51/1033_linux-3.2.34.patch
similarity index 100%
rename from 3.2.50/1033_linux-3.2.34.patch
rename to 3.2.51/1033_linux-3.2.34.patch
diff --git a/3.2.50/1034_linux-3.2.35.patch b/3.2.51/1034_linux-3.2.35.patch
similarity index 100%
rename from 3.2.50/1034_linux-3.2.35.patch
rename to 3.2.51/1034_linux-3.2.35.patch
diff --git a/3.2.50/1035_linux-3.2.36.patch b/3.2.51/1035_linux-3.2.36.patch
similarity index 100%
rename from 3.2.50/1035_linux-3.2.36.patch
rename to 3.2.51/1035_linux-3.2.36.patch
diff --git a/3.2.50/1036_linux-3.2.37.patch b/3.2.51/1036_linux-3.2.37.patch
similarity index 100%
rename from 3.2.50/1036_linux-3.2.37.patch
rename to 3.2.51/1036_linux-3.2.37.patch
diff --git a/3.2.50/1037_linux-3.2.38.patch b/3.2.51/1037_linux-3.2.38.patch
similarity index 100%
rename from 3.2.50/1037_linux-3.2.38.patch
rename to 3.2.51/1037_linux-3.2.38.patch
diff --git a/3.2.50/1038_linux-3.2.39.patch b/3.2.51/1038_linux-3.2.39.patch
similarity index 100%
rename from 3.2.50/1038_linux-3.2.39.patch
rename to 3.2.51/1038_linux-3.2.39.patch
diff --git a/3.2.50/1039_linux-3.2.40.patch b/3.2.51/1039_linux-3.2.40.patch
similarity index 100%
rename from 3.2.50/1039_linux-3.2.40.patch
rename to 3.2.51/1039_linux-3.2.40.patch
diff --git a/3.2.50/1040_linux-3.2.41.patch b/3.2.51/1040_linux-3.2.41.patch
similarity index 100%
rename from 3.2.50/1040_linux-3.2.41.patch
rename to 3.2.51/1040_linux-3.2.41.patch
diff --git a/3.2.50/1041_linux-3.2.42.patch b/3.2.51/1041_linux-3.2.42.patch
similarity index 100%
rename from 3.2.50/1041_linux-3.2.42.patch
rename to 3.2.51/1041_linux-3.2.42.patch
diff --git a/3.2.50/1042_linux-3.2.43.patch b/3.2.51/1042_linux-3.2.43.patch
similarity index 100%
rename from 3.2.50/1042_linux-3.2.43.patch
rename to 3.2.51/1042_linux-3.2.43.patch
diff --git a/3.2.50/1043_linux-3.2.44.patch b/3.2.51/1043_linux-3.2.44.patch
similarity index 100%
rename from 3.2.50/1043_linux-3.2.44.patch
rename to 3.2.51/1043_linux-3.2.44.patch
diff --git a/3.2.50/1044_linux-3.2.45.patch b/3.2.51/1044_linux-3.2.45.patch
similarity index 100%
rename from 3.2.50/1044_linux-3.2.45.patch
rename to 3.2.51/1044_linux-3.2.45.patch
diff --git a/3.2.50/1045_linux-3.2.46.patch b/3.2.51/1045_linux-3.2.46.patch
similarity index 100%
rename from 3.2.50/1045_linux-3.2.46.patch
rename to 3.2.51/1045_linux-3.2.46.patch
diff --git a/3.2.50/1046_linux-3.2.47.patch b/3.2.51/1046_linux-3.2.47.patch
similarity index 100%
rename from 3.2.50/1046_linux-3.2.47.patch
rename to 3.2.51/1046_linux-3.2.47.patch
diff --git a/3.2.50/1047_linux-3.2.48.patch b/3.2.51/1047_linux-3.2.48.patch
similarity index 100%
rename from 3.2.50/1047_linux-3.2.48.patch
rename to 3.2.51/1047_linux-3.2.48.patch
diff --git a/3.2.50/1048_linux-3.2.49.patch b/3.2.51/1048_linux-3.2.49.patch
similarity index 100%
rename from 3.2.50/1048_linux-3.2.49.patch
rename to 3.2.51/1048_linux-3.2.49.patch
diff --git a/3.2.50/1049_linux-3.2.50.patch b/3.2.51/1049_linux-3.2.50.patch
similarity index 100%
rename from 3.2.50/1049_linux-3.2.50.patch
rename to 3.2.51/1049_linux-3.2.50.patch
diff --git a/3.2.51/1050_linux-3.2.51.patch b/3.2.51/1050_linux-3.2.51.patch
new file mode 100644
index 0000000..5d5832b
--- /dev/null
+++ b/3.2.51/1050_linux-3.2.51.patch
@@ -0,0 +1,3886 @@
+diff --git a/Makefile b/Makefile
+index 0799e8e..0f11936 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 50
++SUBLEVEL = 51
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/alpha/Makefile b/arch/alpha/Makefile
+index 4759fe7..2cc3cc5 100644
+--- a/arch/alpha/Makefile
++++ b/arch/alpha/Makefile
+@@ -12,7 +12,7 @@ NM := $(NM) -B
+
+ LDFLAGS_vmlinux := -static -N #-relax
+ CHECKFLAGS += -D__alpha__ -m64
+-cflags-y := -pipe -mno-fp-regs -ffixed-8 -msmall-data
++cflags-y := -pipe -mno-fp-regs -ffixed-8
+ cflags-y += $(call cc-option, -fno-jump-tables)
+
+ cpuflags-$(CONFIG_ALPHA_EV4) := -mcpu=ev4
+diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
+index 27bcd12..790ea68 100644
+--- a/arch/arm/Kconfig
++++ b/arch/arm/Kconfig
+@@ -1,7 +1,6 @@
+ config ARM
+ bool
+ default y
+- select HAVE_AOUT
+ select HAVE_DMA_API_DEBUG
+ select HAVE_IDE if PCI || ISA || PCMCIA
+ select HAVE_MEMBLOCK
+diff --git a/arch/arm/include/asm/a.out-core.h b/arch/arm/include/asm/a.out-core.h
+deleted file mode 100644
+index 92f10cb..0000000
+--- a/arch/arm/include/asm/a.out-core.h
++++ /dev/null
+@@ -1,45 +0,0 @@
+-/* a.out coredump register dumper
+- *
+- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
+- * Written by David Howells (dhowells@redhat.com)
+- *
+- * This program is free software; you can redistribute it and/or
+- * modify it under the terms of the GNU General Public Licence
+- * as published by the Free Software Foundation; either version
+- * 2 of the Licence, or (at your option) any later version.
+- */
+-
+-#ifndef _ASM_A_OUT_CORE_H
+-#define _ASM_A_OUT_CORE_H
+-
+-#ifdef __KERNEL__
+-
+-#include <linux/user.h>
+-#include <linux/elfcore.h>
+-
+-/*
+- * fill in the user structure for an a.out core dump
+- */
+-static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
+-{
+- struct task_struct *tsk = current;
+-
+- dump->magic = CMAGIC;
+- dump->start_code = tsk->mm->start_code;
+- dump->start_stack = regs->ARM_sp & ~(PAGE_SIZE - 1);
+-
+- dump->u_tsize = (tsk->mm->end_code - tsk->mm->start_code) >> PAGE_SHIFT;
+- dump->u_dsize = (tsk->mm->brk - tsk->mm->start_data + PAGE_SIZE - 1) >> PAGE_SHIFT;
+- dump->u_ssize = 0;
+-
+- memset(dump->u_debugreg, 0, sizeof(dump->u_debugreg));
+-
+- if (dump->start_stack < 0x04000000)
+- dump->u_ssize = (0x04000000 - dump->start_stack) >> PAGE_SHIFT;
+-
+- dump->regs = *regs;
+- dump->u_fpvalid = dump_fpu (regs, &dump->u_fp);
+-}
+-
+-#endif /* __KERNEL__ */
+-#endif /* _ASM_A_OUT_CORE_H */
+diff --git a/arch/arm/include/asm/a.out.h b/arch/arm/include/asm/a.out.h
+deleted file mode 100644
+index 083894b..0000000
+--- a/arch/arm/include/asm/a.out.h
++++ /dev/null
+@@ -1,34 +0,0 @@
+-#ifndef __ARM_A_OUT_H__
+-#define __ARM_A_OUT_H__
+-
+-#include <linux/personality.h>
+-#include <linux/types.h>
+-
+-struct exec
+-{
+- __u32 a_info; /* Use macros N_MAGIC, etc for access */
+- __u32 a_text; /* length of text, in bytes */
+- __u32 a_data; /* length of data, in bytes */
+- __u32 a_bss; /* length of uninitialized data area for file, in bytes */
+- __u32 a_syms; /* length of symbol table data in file, in bytes */
+- __u32 a_entry; /* start address */
+- __u32 a_trsize; /* length of relocation info for text, in bytes */
+- __u32 a_drsize; /* length of relocation info for data, in bytes */
+-};
+-
+-/*
+- * This is always the same
+- */
+-#define N_TXTADDR(a) (0x00008000)
+-
+-#define N_TRSIZE(a) ((a).a_trsize)
+-#define N_DRSIZE(a) ((a).a_drsize)
+-#define N_SYMSIZE(a) ((a).a_syms)
+-
+-#define M_ARM 103
+-
+-#ifndef LIBRARY_START_TEXT
+-#define LIBRARY_START_TEXT (0x00c00000)
+-#endif
+-
+-#endif /* __A_OUT_GNU_H__ */
+diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
+index b2d9df5..3352451 100644
+--- a/arch/arm/include/asm/processor.h
++++ b/arch/arm/include/asm/processor.h
+@@ -54,7 +54,6 @@ struct thread_struct {
+
+ #define start_thread(regs,pc,sp) \
+ ({ \
+- unsigned long *stack = (unsigned long *)sp; \
+ set_fs(USER_DS); \
+ memset(regs->uregs, 0, sizeof(regs->uregs)); \
+ if (current->personality & ADDR_LIMIT_32BIT) \
+@@ -66,9 +65,6 @@ struct thread_struct {
+ regs->ARM_cpsr |= PSR_ENDSTATE; \
+ regs->ARM_pc = pc & ~1; /* pc */ \
+ regs->ARM_sp = sp; /* sp */ \
+- regs->ARM_r2 = stack[2]; /* r2 (envp) */ \
+- regs->ARM_r1 = stack[1]; /* r1 (argv) */ \
+- regs->ARM_r0 = stack[0]; /* r0 (argc) */ \
+ nommu_start_thread(regs); \
+ })
+
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index 778d248..4a2db48 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -116,7 +116,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
+ static int
+ armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
+ {
+- int mapping = (*event_map)[config];
++ int mapping;
++
++ if (config >= PERF_COUNT_HW_MAX)
++ return -ENOENT;
++
++ mapping = (*event_map)[config];
+ return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
+ }
+
+@@ -326,6 +331,9 @@ validate_event(struct pmu_hw_events *hw_events,
+ struct hw_perf_event fake_event = event->hw;
+ struct pmu *leader_pmu = event->group_leader->pmu;
+
++ if (is_software_event(event))
++ return 1;
++
+ if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
+ return 1;
+
+diff --git a/arch/cris/kernel/vmlinux.lds.S b/arch/cris/kernel/vmlinux.lds.S
+index a6990cb..a68b983 100644
+--- a/arch/cris/kernel/vmlinux.lds.S
++++ b/arch/cris/kernel/vmlinux.lds.S
+@@ -52,6 +52,7 @@ SECTIONS
+
+ EXCEPTION_TABLE(4)
+
++ _sdata = .;
+ RODATA
+
+ . = ALIGN (4);
+diff --git a/arch/hexagon/kernel/dma.c b/arch/hexagon/kernel/dma.c
+index e711ace..54891e1 100644
+--- a/arch/hexagon/kernel/dma.c
++++ b/arch/hexagon/kernel/dma.c
+@@ -22,6 +22,7 @@
+ #include <linux/bootmem.h>
+ #include <linux/genalloc.h>
+ #include <asm/dma-mapping.h>
++#include <linux/module.h>
+
+ struct dma_map_ops *dma_ops;
+ EXPORT_SYMBOL(dma_ops);
+diff --git a/arch/hexagon/kernel/ptrace.c b/arch/hexagon/kernel/ptrace.c
+index bea3f08..8fe0349 100644
+--- a/arch/hexagon/kernel/ptrace.c
++++ b/arch/hexagon/kernel/ptrace.c
+@@ -28,6 +28,7 @@
+ #include <linux/ptrace.h>
+ #include <linux/regset.h>
+ #include <linux/user.h>
++#include <linux/elf.h>
+
+ #include <asm/system.h>
+ #include <asm/user.h>
+diff --git a/arch/hexagon/kernel/time.c b/arch/hexagon/kernel/time.c
+index 6bee15c..5d9b33b 100644
+--- a/arch/hexagon/kernel/time.c
++++ b/arch/hexagon/kernel/time.c
+@@ -28,6 +28,7 @@
+ #include <linux/of.h>
+ #include <linux/of_address.h>
+ #include <linux/of_irq.h>
++#include <linux/module.h>
+
+ #include <asm/timer-regs.h>
+ #include <asm/hexagon_vm.h>
+diff --git a/arch/hexagon/kernel/vdso.c b/arch/hexagon/kernel/vdso.c
+index 16277c3..e4ceedb 100644
+--- a/arch/hexagon/kernel/vdso.c
++++ b/arch/hexagon/kernel/vdso.c
+@@ -21,6 +21,7 @@
+ #include <linux/err.h>
+ #include <linux/mm.h>
+ #include <linux/vmalloc.h>
++#include <linux/binfmts.h>
+
+ #include <asm/vdso.h>
+
+diff --git a/arch/m32r/boot/compressed/Makefile b/arch/m32r/boot/compressed/Makefile
+index 177716b..01729c2 100644
+--- a/arch/m32r/boot/compressed/Makefile
++++ b/arch/m32r/boot/compressed/Makefile
+@@ -43,9 +43,9 @@ endif
+
+ OBJCOPYFLAGS += -R .empty_zero_page
+
+-suffix_$(CONFIG_KERNEL_GZIP) = gz
+-suffix_$(CONFIG_KERNEL_BZIP2) = bz2
+-suffix_$(CONFIG_KERNEL_LZMA) = lzma
++suffix-$(CONFIG_KERNEL_GZIP) = gz
++suffix-$(CONFIG_KERNEL_BZIP2) = bz2
++suffix-$(CONFIG_KERNEL_LZMA) = lzma
+
+ $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix-y) FORCE
+ $(call if_changed,ld)
+diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c
+index 370d608..28a0952 100644
+--- a/arch/m32r/boot/compressed/misc.c
++++ b/arch/m32r/boot/compressed/misc.c
+@@ -28,7 +28,7 @@ static unsigned long free_mem_ptr;
+ static unsigned long free_mem_end_ptr;
+
+ #ifdef CONFIG_KERNEL_BZIP2
+-static void *memset(void *s, int c, size_t n)
++void *memset(void *s, int c, size_t n)
+ {
+ char *ss = s;
+
+@@ -39,6 +39,16 @@ static void *memset(void *s, int c, size_t n)
+ #endif
+
+ #ifdef CONFIG_KERNEL_GZIP
++void *memcpy(void *dest, const void *src, size_t n)
++{
++ char *d = dest;
++ const char *s = src;
++ while (n--)
++ *d++ = *s++;
++
++ return dest;
++}
++
+ #define BOOT_HEAP_SIZE 0x10000
+ #include "../../../../lib/decompress_inflate.c"
+ #endif
+diff --git a/arch/m68k/emu/natfeat.c b/arch/m68k/emu/natfeat.c
+index 2291a7d..fa277ae 100644
+--- a/arch/m68k/emu/natfeat.c
++++ b/arch/m68k/emu/natfeat.c
+@@ -18,9 +18,11 @@
+ #include <asm/machdep.h>
+ #include <asm/natfeat.h>
+
++extern long nf_get_id2(const char *feature_name);
++
+ asm("\n"
+-" .global nf_get_id,nf_call\n"
+-"nf_get_id:\n"
++" .global nf_get_id2,nf_call\n"
++"nf_get_id2:\n"
+ " .short 0x7300\n"
+ " rts\n"
+ "nf_call:\n"
+@@ -29,12 +31,25 @@ asm("\n"
+ "1: moveq.l #0,%d0\n"
+ " rts\n"
+ " .section __ex_table,\"a\"\n"
+-" .long nf_get_id,1b\n"
++" .long nf_get_id2,1b\n"
+ " .long nf_call,1b\n"
+ " .previous");
+-EXPORT_SYMBOL_GPL(nf_get_id);
+ EXPORT_SYMBOL_GPL(nf_call);
+
++long nf_get_id(const char *feature_name)
++{
++ /* feature_name may be in vmalloc()ed memory, so make a copy */
++ char name_copy[32];
++ size_t n;
++
++ n = strlcpy(name_copy, feature_name, sizeof(name_copy));
++ if (n >= sizeof(name_copy))
++ return 0;
++
++ return nf_get_id2(name_copy);
++}
++EXPORT_SYMBOL_GPL(nf_get_id);
++
+ void nfprint(const char *fmt, ...)
+ {
+ static char buf[256];
+diff --git a/arch/m68k/include/asm/div64.h b/arch/m68k/include/asm/div64.h
+index edb6614..7558032 100644
+--- a/arch/m68k/include/asm/div64.h
++++ b/arch/m68k/include/asm/div64.h
+@@ -13,16 +13,17 @@
+ unsigned long long n64; \
+ } __n; \
+ unsigned long __rem, __upper; \
++ unsigned long __base = (base); \
+ \
+ __n.n64 = (n); \
+ if ((__upper = __n.n32[0])) { \
+ asm ("divul.l %2,%1:%0" \
+- : "=d" (__n.n32[0]), "=d" (__upper) \
+- : "d" (base), "0" (__n.n32[0])); \
++ : "=d" (__n.n32[0]), "=d" (__upper) \
++ : "d" (__base), "0" (__n.n32[0])); \
+ } \
+ asm ("divu.l %2,%1:%0" \
+- : "=d" (__n.n32[1]), "=d" (__rem) \
+- : "d" (base), "1" (__upper), "0" (__n.n32[1])); \
++ : "=d" (__n.n32[1]), "=d" (__rem) \
++ : "d" (__base), "1" (__upper), "0" (__n.n32[1])); \
+ (n) = __n.n64; \
+ __rem; \
+ })
+diff --git a/arch/microblaze/configs/mmu_defconfig b/arch/microblaze/configs/mmu_defconfig
+index b3f5eec..a470f57 100644
+--- a/arch/microblaze/configs/mmu_defconfig
++++ b/arch/microblaze/configs/mmu_defconfig
+@@ -1,25 +1,22 @@
+ CONFIG_EXPERIMENTAL=y
+ CONFIG_SYSVIPC=y
++CONFIG_POSIX_MQUEUE=y
++CONFIG_FHANDLE=y
++CONFIG_AUDIT=y
++CONFIG_AUDIT_LOGINUID_IMMUTABLE=y
+ CONFIG_IKCONFIG=y
+ CONFIG_IKCONFIG_PROC=y
++CONFIG_SYSFS_DEPRECATED=y
+ CONFIG_SYSFS_DEPRECATED_V2=y
+-CONFIG_BLK_DEV_INITRD=y
+-CONFIG_INITRAMFS_SOURCE="rootfs.cpio"
+-CONFIG_INITRAMFS_COMPRESSION_GZIP=y
+-# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
+-CONFIG_EXPERT=y
+ CONFIG_KALLSYMS_ALL=y
+-CONFIG_KALLSYMS_EXTRA_PASS=y
+-# CONFIG_HOTPLUG is not set
+ # CONFIG_BASE_FULL is not set
+-# CONFIG_FUTEX is not set
+-# CONFIG_EPOLL is not set
+-# CONFIG_SIGNALFD is not set
+-# CONFIG_SHMEM is not set
++CONFIG_EMBEDDED=y
+ CONFIG_SLAB=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_UNLOAD=y
+ # CONFIG_BLK_DEV_BSG is not set
++CONFIG_PARTITION_ADVANCED=y
++# CONFIG_EFI_PARTITION is not set
+ CONFIG_OPT_LIB_ASM=y
+ CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1
+ CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR=1
+@@ -37,33 +34,53 @@ CONFIG_UNIX=y
+ CONFIG_INET=y
+ # CONFIG_INET_LRO is not set
+ # CONFIG_IPV6 is not set
++CONFIG_MTD=y
+ CONFIG_PROC_DEVICETREE=y
+ CONFIG_BLK_DEV_RAM=y
+ CONFIG_BLK_DEV_RAM_SIZE=8192
+ CONFIG_NETDEVICES=y
+-CONFIG_NET_ETHERNET=y
+ CONFIG_XILINX_EMACLITE=y
++CONFIG_XILINX_LL_TEMAC=y
+ # CONFIG_INPUT is not set
+ # CONFIG_SERIO is not set
+ # CONFIG_VT is not set
++CONFIG_SERIAL_8250=y
++CONFIG_SERIAL_8250_CONSOLE=y
+ CONFIG_SERIAL_UARTLITE=y
+ CONFIG_SERIAL_UARTLITE_CONSOLE=y
+ # CONFIG_HW_RANDOM is not set
++CONFIG_XILINX_HWICAP=y
++CONFIG_I2C=y
++CONFIG_I2C_XILINX=y
++CONFIG_SPI=y
++CONFIG_SPI_XILINX=y
++CONFIG_GPIOLIB=y
++CONFIG_GPIO_SYSFS=y
++CONFIG_GPIO_XILINX=y
+ # CONFIG_HWMON is not set
++CONFIG_WATCHDOG=y
++CONFIG_XILINX_WATCHDOG=y
++CONFIG_FB=y
++CONFIG_FB_XILINX=y
+ # CONFIG_USB_SUPPORT is not set
++CONFIG_UIO=y
++CONFIG_UIO_PDRV=y
++CONFIG_UIO_PDRV_GENIRQ=y
++CONFIG_UIO_DMEM_GENIRQ=y
+ CONFIG_EXT2_FS=y
+ # CONFIG_DNOTIFY is not set
++CONFIG_CRAMFS=y
++CONFIG_ROMFS_FS=y
+ CONFIG_NFS_FS=y
+-CONFIG_NFS_V3=y
+ CONFIG_CIFS=y
+ CONFIG_CIFS_STATS=y
+ CONFIG_CIFS_STATS2=y
+-CONFIG_PARTITION_ADVANCED=y
+-CONFIG_DEBUG_KERNEL=y
+ CONFIG_DETECT_HUNG_TASK=y
+ CONFIG_DEBUG_SLAB=y
+ CONFIG_DEBUG_SPINLOCK=y
+ CONFIG_DEBUG_INFO=y
+-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+ CONFIG_EARLY_PRINTK=y
++CONFIG_KEYS=y
++CONFIG_ENCRYPTED_KEYS=y
++CONFIG_KEYS_DEBUG_PROC_KEYS=y
+ # CONFIG_CRYPTO_ANSI_CPRNG is not set
+diff --git a/arch/microblaze/configs/nommu_defconfig b/arch/microblaze/configs/nommu_defconfig
+index 0249e4b..5454a6d 100644
+--- a/arch/microblaze/configs/nommu_defconfig
++++ b/arch/microblaze/configs/nommu_defconfig
+@@ -1,41 +1,40 @@
+ CONFIG_EXPERIMENTAL=y
+ CONFIG_SYSVIPC=y
+ CONFIG_POSIX_MQUEUE=y
++CONFIG_FHANDLE=y
++CONFIG_AUDIT=y
++CONFIG_AUDIT_LOGINUID_IMMUTABLE=y
+ CONFIG_BSD_PROCESS_ACCT=y
+ CONFIG_BSD_PROCESS_ACCT_V3=y
+ CONFIG_IKCONFIG=y
+ CONFIG_IKCONFIG_PROC=y
++CONFIG_SYSFS_DEPRECATED=y
+ CONFIG_SYSFS_DEPRECATED_V2=y
+-CONFIG_EXPERT=y
+ CONFIG_KALLSYMS_ALL=y
+-CONFIG_KALLSYMS_EXTRA_PASS=y
+-# CONFIG_HOTPLUG is not set
+ # CONFIG_BASE_FULL is not set
++CONFIG_EMBEDDED=y
+ CONFIG_SLAB=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_UNLOAD=y
+ # CONFIG_BLK_DEV_BSG is not set
+-# CONFIG_OPT_LIB_FUNCTION is not set
++CONFIG_PARTITION_ADVANCED=y
++# CONFIG_EFI_PARTITION is not set
+ CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1
+ CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR=1
+ CONFIG_XILINX_MICROBLAZE0_USE_BARREL=1
+ CONFIG_XILINX_MICROBLAZE0_USE_DIV=1
+ CONFIG_XILINX_MICROBLAZE0_USE_HW_MUL=2
+ CONFIG_XILINX_MICROBLAZE0_USE_FPU=2
+-CONFIG_HIGH_RES_TIMERS=y
+ CONFIG_HZ_100=y
+ CONFIG_CMDLINE_BOOL=y
+-CONFIG_BINFMT_FLAT=y
++CONFIG_CMDLINE_FORCE=y
+ CONFIG_NET=y
+ CONFIG_PACKET=y
+ CONFIG_UNIX=y
+ CONFIG_INET=y
+ # CONFIG_INET_LRO is not set
+ # CONFIG_IPV6 is not set
+-# CONFIG_PREVENT_FIRMWARE_BUILD is not set
+ CONFIG_MTD=y
+-CONFIG_MTD_CONCAT=y
+-CONFIG_MTD_PARTITIONS=y
+ CONFIG_MTD_CMDLINE_PARTS=y
+ CONFIG_MTD_CHAR=y
+ CONFIG_MTD_BLOCK=y
+@@ -45,41 +44,55 @@ CONFIG_MTD_CFI_AMDSTD=y
+ CONFIG_MTD_RAM=y
+ CONFIG_MTD_UCLINUX=y
+ CONFIG_PROC_DEVICETREE=y
+-CONFIG_BLK_DEV_NBD=y
+ CONFIG_BLK_DEV_RAM=y
++CONFIG_BLK_DEV_RAM_SIZE=8192
+ CONFIG_NETDEVICES=y
+-CONFIG_NET_ETHERNET=y
++CONFIG_XILINX_EMACLITE=y
++CONFIG_XILINX_LL_TEMAC=y
+ # CONFIG_INPUT is not set
+ # CONFIG_SERIO is not set
+ # CONFIG_VT is not set
++CONFIG_SERIAL_8250=y
++CONFIG_SERIAL_8250_CONSOLE=y
+ CONFIG_SERIAL_UARTLITE=y
+ CONFIG_SERIAL_UARTLITE_CONSOLE=y
+-CONFIG_HW_RANDOM=y
++# CONFIG_HW_RANDOM is not set
++CONFIG_XILINX_HWICAP=y
++CONFIG_I2C=y
++CONFIG_I2C_XILINX=y
++CONFIG_SPI=y
++CONFIG_SPI_XILINX=y
++CONFIG_GPIOLIB=y
++CONFIG_GPIO_SYSFS=y
++CONFIG_GPIO_XILINX=y
+ # CONFIG_HWMON is not set
+-CONFIG_VIDEO_OUTPUT_CONTROL=y
++CONFIG_WATCHDOG=y
++CONFIG_XILINX_WATCHDOG=y
++CONFIG_FB=y
++CONFIG_FB_XILINX=y
++# CONFIG_USB_SUPPORT is not set
++CONFIG_UIO=y
++CONFIG_UIO_PDRV=y
++CONFIG_UIO_PDRV_GENIRQ=y
++CONFIG_UIO_DMEM_GENIRQ=y
+ CONFIG_EXT2_FS=y
+ # CONFIG_DNOTIFY is not set
+ CONFIG_CRAMFS=y
+ CONFIG_ROMFS_FS=y
+ CONFIG_NFS_FS=y
+-CONFIG_NFS_V3=y
+ CONFIG_NFS_V3_ACL=y
+-CONFIG_UNUSED_SYMBOLS=y
+-CONFIG_DEBUG_FS=y
+-CONFIG_DEBUG_KERNEL=y
+-CONFIG_DEBUG_SHIRQ=y
++CONFIG_NLS=y
+ CONFIG_DETECT_HUNG_TASK=y
+-CONFIG_SCHEDSTATS=y
+-CONFIG_TIMER_STATS=y
+-CONFIG_DEBUG_OBJECTS=y
+-CONFIG_DEBUG_OBJECTS_SELFTEST=y
+-CONFIG_DEBUG_OBJECTS_FREE=y
+-CONFIG_DEBUG_OBJECTS_TIMERS=y
++CONFIG_DEBUG_SLAB=y
++CONFIG_DEBUG_SPINLOCK=y
+ CONFIG_DEBUG_INFO=y
+-CONFIG_DEBUG_LIST=y
+-CONFIG_DEBUG_SG=y
+-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+-CONFIG_SYSCTL_SYSCALL_CHECK=y
+ CONFIG_EARLY_PRINTK=y
++CONFIG_KEYS=y
++CONFIG_ENCRYPTED_KEYS=y
++CONFIG_KEYS_DEBUG_PROC_KEYS=y
++CONFIG_CRYPTO_ECB=y
++CONFIG_CRYPTO_MD4=y
++CONFIG_CRYPTO_MD5=y
++CONFIG_CRYPTO_ARC4=y
++CONFIG_CRYPTO_DES=y
+ # CONFIG_CRYPTO_ANSI_CPRNG is not set
+-# CONFIG_CRC32 is not set
+diff --git a/arch/microblaze/include/asm/futex.h b/arch/microblaze/include/asm/futex.h
+index b0526d2..ff8cde1 100644
+--- a/arch/microblaze/include/asm/futex.h
++++ b/arch/microblaze/include/asm/futex.h
+@@ -24,7 +24,7 @@
+ .word 1b,4b,2b,4b; \
+ .previous;" \
+ : "=&r" (oldval), "=&r" (ret) \
+- : "b" (uaddr), "i" (-EFAULT), "r" (oparg) \
++ : "r" (uaddr), "i" (-EFAULT), "r" (oparg) \
+ ); \
+ })
+
+diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
+index 951e18f..16ef838 100644
+--- a/arch/powerpc/Kconfig
++++ b/arch/powerpc/Kconfig
+@@ -937,6 +937,7 @@ config RELOCATABLE
+ must live at a different physical address than the primary
+ kernel.
+
++# This value must have zeroes in the bottom 60 bits otherwise lots will break
+ config PAGE_OFFSET
+ hex
+ default "0xc000000000000000"
+diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
+index dd9c4fd..5b0bde2 100644
+--- a/arch/powerpc/include/asm/page.h
++++ b/arch/powerpc/include/asm/page.h
+@@ -132,9 +132,19 @@ extern phys_addr_t kernstart_addr;
+ #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) - PHYSICAL_START + KERNELBASE))
+ #define __pa(x) ((unsigned long)(x) + PHYSICAL_START - KERNELBASE)
+ #else
++#ifdef CONFIG_PPC64
++/*
++ * gcc miscompiles (unsigned long)(&static_var) - PAGE_OFFSET
++ * with -mcmodel=medium, so we use & and | instead of - and + on 64-bit.
++ */
++#define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) | PAGE_OFFSET))
++#define __pa(x) ((unsigned long)(x) & 0x0fffffffffffffffUL)
++
++#else /* 32-bit, non book E */
+ #define __va(x) ((void *)(unsigned long)((phys_addr_t)(x) + PAGE_OFFSET - MEMORY_START))
+ #define __pa(x) ((unsigned long)(x) - PAGE_OFFSET + MEMORY_START)
+ #endif
++#endif
+
+ /*
+ * Unfortunately the PLT is in the BSS in the PPC32 ELF ABI,
+diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
+index 84daabe..826681d 100644
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -37,7 +37,13 @@
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
+ #include <asm/mmu.h>
++#include <asm/machdep.h>
+
++
++/*
++ * This isn't a module but we expose that to userspace
++ * via /proc so leave the definitions here
++ */
+ #define MODULE_VERS "1.9"
+ #define MODULE_NAME "lparcfg"
+
+@@ -487,7 +493,8 @@ static void parse_em_data(struct seq_file *m)
+ {
+ unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+
+- if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
++ if (firmware_has_feature(FW_FEATURE_LPAR) &&
++ plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+ seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
+ }
+
+@@ -772,7 +779,6 @@ static int lparcfg_open(struct inode *inode, struct file *file)
+ }
+
+ static const struct file_operations lparcfg_fops = {
+- .owner = THIS_MODULE,
+ .read = seq_read,
+ .write = lparcfg_write,
+ .open = lparcfg_open,
+@@ -799,15 +805,4 @@ static int __init lparcfg_init(void)
+ proc_ppc64_lparcfg = ent;
+ return 0;
+ }
+-
+-static void __exit lparcfg_cleanup(void)
+-{
+- if (proc_ppc64_lparcfg)
+- remove_proc_entry("lparcfg", proc_ppc64_lparcfg->parent);
+-}
+-
+-module_init(lparcfg_init);
+-module_exit(lparcfg_cleanup);
+-MODULE_DESCRIPTION("Interface for LPAR configuration data");
+-MODULE_AUTHOR("Dave Engebretsen");
+-MODULE_LICENSE("GPL");
++machine_device_initcall(pseries, lparcfg_init);
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 4db9b1e..dd072b1 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -469,6 +469,8 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
+
+ static void __vcpu_run(struct kvm_vcpu *vcpu)
+ {
++ int rc;
++
+ memcpy(&vcpu->arch.sie_block->gg14, &vcpu->arch.guest_gprs[14], 16);
+
+ if (need_resched())
+@@ -479,21 +481,24 @@ static void __vcpu_run(struct kvm_vcpu *vcpu)
+
+ kvm_s390_deliver_pending_interrupts(vcpu);
+
++ VCPU_EVENT(vcpu, 6, "entering sie flags %x",
++ atomic_read(&vcpu->arch.sie_block->cpuflags));
++
+ vcpu->arch.sie_block->icptcode = 0;
+ local_irq_disable();
+ kvm_guest_enter();
+ local_irq_enable();
+- VCPU_EVENT(vcpu, 6, "entering sie flags %x",
+- atomic_read(&vcpu->arch.sie_block->cpuflags));
+- if (sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs)) {
++ rc = sie64a(vcpu->arch.sie_block, vcpu->arch.guest_gprs);
++ local_irq_disable();
++ kvm_guest_exit();
++ local_irq_enable();
++
++ if (rc) {
+ VCPU_EVENT(vcpu, 3, "%s", "fault in sie instruction");
+ kvm_s390_inject_program_int(vcpu, PGM_ADDRESSING);
+ }
+ VCPU_EVENT(vcpu, 6, "exit sie icptcode %d",
+ vcpu->arch.sie_block->icptcode);
+- local_irq_disable();
+- kvm_guest_exit();
+- local_irq_enable();
+
+ memcpy(&vcpu->arch.guest_gprs[14], &vcpu->arch.sie_block->gg14, 16);
+ }
+diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
+index f210d51..87537e2 100644
+--- a/arch/sparc/Kconfig
++++ b/arch/sparc/Kconfig
+@@ -31,6 +31,7 @@ config SPARC
+
+ config SPARC32
+ def_bool !64BIT
++ select GENERIC_ATOMIC64
+
+ config SPARC64
+ def_bool 64BIT
+diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
+index 5c3c8b6..07dd35e 100644
+--- a/arch/sparc/include/asm/atomic_32.h
++++ b/arch/sparc/include/asm/atomic_32.h
+@@ -15,6 +15,8 @@
+
+ #ifdef __KERNEL__
+
++#include <asm-generic/atomic64.h>
++
+ #include <asm/system.h>
+
+ #define ATOMIC_INIT(i) { (i) }
+diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
+index a3fc437..4961516 100644
+--- a/arch/sparc/lib/Makefile
++++ b/arch/sparc/lib/Makefile
+@@ -40,7 +40,7 @@ lib-$(CONFIG_SPARC64) += copy_in_user.o user_fixup.o memmove.o
+ lib-$(CONFIG_SPARC64) += mcount.o ipcsum.o xor.o hweight.o ffs.o
+
+ obj-y += iomap.o
+-obj-$(CONFIG_SPARC32) += atomic32.o
++obj-$(CONFIG_SPARC32) += atomic32.o ucmpdi2.o
+ obj-y += ksyms.o
+ obj-$(CONFIG_SPARC64) += PeeCeeI.o
+ obj-y += usercopy.o
+diff --git a/arch/sparc/lib/ucmpdi2.c b/arch/sparc/lib/ucmpdi2.c
+new file mode 100644
+index 0000000..1e06ed5
+--- /dev/null
++++ b/arch/sparc/lib/ucmpdi2.c
+@@ -0,0 +1,19 @@
++#include <linux/module.h>
++#include "libgcc.h"
++
++word_type __ucmpdi2(unsigned long long a, unsigned long long b)
++{
++ const DWunion au = {.ll = a};
++ const DWunion bu = {.ll = b};
++
++ if ((unsigned int) au.s.high < (unsigned int) bu.s.high)
++ return 0;
++ else if ((unsigned int) au.s.high > (unsigned int) bu.s.high)
++ return 2;
++ if ((unsigned int) au.s.low < (unsigned int) bu.s.low)
++ return 0;
++ else if ((unsigned int) au.s.low > (unsigned int) bu.s.low)
++ return 2;
++ return 1;
++}
++EXPORT_SYMBOL(__ucmpdi2);
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index 739d859..fa4ea09 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -51,7 +51,7 @@ void __cpuinit mxcsr_feature_mask_init(void)
+ clts();
+ if (cpu_has_fxsr) {
+ memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
+- asm volatile("fxsave %0" : : "m" (fx_scratch));
++ asm volatile("fxsave %0" : "+m" (fx_scratch));
+ mask = fx_scratch.mxcsr_mask;
+ if (mask == 0)
+ mask = 0x0000ffbf;
+diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
+index 0514890..cdb2fc9 100644
+--- a/arch/x86/kernel/sys_x86_64.c
++++ b/arch/x86/kernel/sys_x86_64.c
+@@ -115,7 +115,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
+ *begin = new_begin;
+ }
+ } else {
+- *begin = TASK_UNMAPPED_BASE;
++ *begin = current->mm->mmap_legacy_base;
+ *end = TASK_SIZE;
+ }
+ }
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 845df68..5c1ae28 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -112,12 +112,14 @@ static unsigned long mmap_legacy_base(void)
+ */
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+ {
++ mm->mmap_legacy_base = mmap_legacy_base();
++ mm->mmap_base = mmap_base();
++
+ if (mmap_is_legacy()) {
+- mm->mmap_base = mmap_legacy_base();
++ mm->mmap_base = mm->mmap_legacy_base;
+ mm->get_unmapped_area = arch_get_unmapped_area;
+ mm->unmap_area = arch_unmap_area;
+ } else {
+- mm->mmap_base = mmap_base();
+ mm->get_unmapped_area = arch_get_unmapped_area_topdown;
+ mm->unmap_area = arch_unmap_area_topdown;
+ }
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index 6e5a7f1..4d54b38 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -212,6 +212,17 @@ static void xen_align_and_add_e820_region(u64 start, u64 size, int type)
+ e820_add_region(start, end - start, type);
+ }
+
++void xen_ignore_unusable(struct e820entry *list, size_t map_size)
++{
++ struct e820entry *entry;
++ unsigned int i;
++
++ for (i = 0, entry = list; i < map_size; i++, entry++) {
++ if (entry->type == E820_UNUSABLE)
++ entry->type = E820_RAM;
++ }
++}
++
+ /**
+ * machine_specific_memory_setup - Hook for machine specific memory setup.
+ **/
+@@ -250,6 +261,17 @@ char * __init xen_memory_setup(void)
+ }
+ BUG_ON(rc);
+
++ /*
++ * Xen won't allow a 1:1 mapping to be created to UNUSABLE
++ * regions, so if we're using the machine memory map leave the
++ * region as RAM as it is in the pseudo-physical map.
++ *
++ * UNUSABLE regions in domUs are not handled and will need
++ * a patch in the future.
++ */
++ if (xen_initial_domain())
++ xen_ignore_unusable(map, memmap.nr_entries);
++
+ /* Make sure the Xen-supplied memory map is well-ordered. */
+ sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
+
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index a1a4b8e..c749b93 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -117,6 +117,7 @@ struct acpi_battery {
+ struct acpi_device *device;
+ struct notifier_block pm_nb;
+ unsigned long update_time;
++ int revision;
+ int rate_now;
+ int capacity_now;
+ int voltage_now;
+@@ -350,6 +351,7 @@ static struct acpi_offsets info_offsets[] = {
+ };
+
+ static struct acpi_offsets extended_info_offsets[] = {
++ {offsetof(struct acpi_battery, revision), 0},
+ {offsetof(struct acpi_battery, power_unit), 0},
+ {offsetof(struct acpi_battery, design_capacity), 0},
+ {offsetof(struct acpi_battery, full_charge_capacity), 0},
+diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig
+index cf047c4..e7b3a9e 100644
+--- a/drivers/ata/Kconfig
++++ b/drivers/ata/Kconfig
+@@ -93,7 +93,7 @@ config SATA_FSL
+ If unsure, say N.
+
+ config SATA_INIC162X
+- tristate "Initio 162x SATA support"
++ tristate "Initio 162x SATA support (Very Experimental)"
+ depends on PCI
+ help
+ This option enables support for Initio 162x Serial ATA.
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index f63a588..f5c35be 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -289,24 +289,24 @@ static int sata_pmp_configure(struct ata_device *dev, int print_info)
+
+ /* Disable sending Early R_OK.
+ * With "cached read" HDD testing and multiple ports busy on a SATA
+- * host controller, 3726 PMP will very rarely drop a deferred
++ * host controller, 3x26 PMP will very rarely drop a deferred
+ * R_OK that was intended for the host. Symptom will be all
+ * 5 drives under test will timeout, get reset, and recover.
+ */
+- if (vendor == 0x1095 && devid == 0x3726) {
++ if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
+ u32 reg;
+
+ err_mask = sata_pmp_read(&ap->link, PMP_GSCR_SII_POL, ®);
+ if (err_mask) {
+ rc = -EIO;
+- reason = "failed to read Sil3726 Private Register";
++ reason = "failed to read Sil3x26 Private Register";
+ goto fail;
+ }
+ reg &= ~0x1;
+ err_mask = sata_pmp_write(&ap->link, PMP_GSCR_SII_POL, reg);
+ if (err_mask) {
+ rc = -EIO;
+- reason = "failed to write Sil3726 Private Register";
++ reason = "failed to write Sil3x26 Private Register";
+ goto fail;
+ }
+ }
+@@ -383,8 +383,8 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ u16 devid = sata_pmp_gscr_devid(gscr);
+ struct ata_link *link;
+
+- if (vendor == 0x1095 && devid == 0x3726) {
+- /* sil3726 quirks */
++ if (vendor == 0x1095 && (devid == 0x3726 || devid == 0x3826)) {
++ /* sil3x26 quirks */
+ ata_for_each_link(link, ap, EDGE) {
+ /* link reports offline after LPM */
+ link->flags |= ATA_LFLAG_NO_LPM;
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index 5c7d70c..3a8b55e 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -6,6 +6,18 @@
+ *
+ * This file is released under GPL v2.
+ *
++ * **** WARNING ****
++ *
++ * This driver never worked properly and unfortunately data corruption is
++ * relatively common. There isn't anyone working on the driver and there's
++ * no support from the vendor. Do not use this driver in any production
++ * environment.
++ *
++ * http://thread.gmane.org/gmane.linux.debian.devel.bugs.rc/378525/focus=54491
++ * https://bugzilla.kernel.org/show_bug.cgi?id=60565
++ *
++ * *****************
++ *
+ * This controller is eccentric and easily locks up if something isn't
+ * right. Documentation is available at initio's website but it only
+ * documents registers (not programming model).
+@@ -809,6 +821,8 @@ static int inic_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+
+ ata_print_version_once(&pdev->dev, DRV_VERSION);
+
++ dev_alert(&pdev->dev, "inic162x support is broken with common data corruption issues and will be disabled by default, contact linux-ide@vger.kernel.org if in production use\n");
++
+ /* alloc host */
+ host = ata_host_alloc_pinfo(&pdev->dev, ppi, NR_PORTS);
+ hpriv = devm_kzalloc(&pdev->dev, sizeof(*hpriv), GFP_KERNEL);
+diff --git a/drivers/base/memory.c b/drivers/base/memory.c
+index 8272d92..732ad0d 100644
+--- a/drivers/base/memory.c
++++ b/drivers/base/memory.c
+@@ -172,6 +172,8 @@ static ssize_t show_mem_removable(struct sys_device *dev,
+ container_of(dev, struct memory_block, sysdev);
+
+ for (i = 0; i < sections_per_block; i++) {
++ if (!present_section_nr(mem->start_section_nr + i))
++ continue;
+ pfn = section_nr_to_pfn(mem->start_section_nr + i);
+ ret &= is_mem_section_removable(pfn, PAGES_PER_SECTION);
+ }
+diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c
+index 79038e5..6790cf7 100644
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -751,8 +751,7 @@ static int pm_genpd_resume_noirq(struct device *dev)
+ if (IS_ERR(genpd))
+ return -EINVAL;
+
+- if (genpd->suspend_power_off
+- || (dev->power.wakeup_path && genpd_dev_active_wakeup(genpd, dev)))
++ if (genpd->suspend_power_off)
+ return 0;
+
+ /*
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 853fdf8..bde72f7 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -89,6 +89,11 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3393) },
+ { USB_DEVICE(0x0489, 0xe04e) },
+ { USB_DEVICE(0x0489, 0xe056) },
++ { USB_DEVICE(0x0489, 0xe04d) },
++ { USB_DEVICE(0x04c5, 0x1330) },
++ { USB_DEVICE(0x13d3, 0x3402) },
++ { USB_DEVICE(0x0cf3, 0x3121) },
++ { USB_DEVICE(0x0cf3, 0xe003) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -125,6 +130,11 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 6b784b7..1bd3924 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -63,6 +63,9 @@ static struct usb_device_id btusb_table[] = {
+ /* Apple-specific (Broadcom) devices */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
+
++ /* MediaTek MT76x0E */
++ { USB_DEVICE(0x0e8d, 0x763f) },
++
+ /* Broadcom SoftSailing reporting vendor specific */
+ { USB_DEVICE(0x0a5c, 0x21e1) },
+
+@@ -156,6 +159,11 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index d5ae736..c68b8ad 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -257,9 +257,12 @@ static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev,
+ unsigned long flags;
+
+ spin_lock_irqsave(&portdev->ports_lock, flags);
+- list_for_each_entry(port, &portdev->ports, list)
+- if (port->cdev->dev == dev)
++ list_for_each_entry(port, &portdev->ports, list) {
++ if (port->cdev->dev == dev) {
++ kref_get(&port->kref);
+ goto out;
++ }
++ }
+ port = NULL;
+ out:
+ spin_unlock_irqrestore(&portdev->ports_lock, flags);
+@@ -634,6 +637,10 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
+
+ port = filp->private_data;
+
++ /* Port is hot-unplugged. */
++ if (!port->guest_connected)
++ return -ENODEV;
++
+ if (!port_has_data(port)) {
+ /*
+ * If nothing's connected on the host just return 0 in
+@@ -650,7 +657,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
+ if (ret < 0)
+ return ret;
+ }
+- /* Port got hot-unplugged. */
++ /* Port got hot-unplugged while we were waiting above. */
+ if (!port->guest_connected)
+ return -ENODEV;
+ /*
+@@ -793,14 +800,14 @@ static int port_fops_open(struct inode *inode, struct file *filp)
+ struct port *port;
+ int ret;
+
++ /* We get the port with a kref here */
+ port = find_port_by_devt(cdev->dev);
++ if (!port) {
++ /* Port was unplugged before we could proceed */
++ return -ENXIO;
++ }
+ filp->private_data = port;
+
+- /* Prevent against a port getting hot-unplugged at the same time */
+- spin_lock_irq(&port->portdev->ports_lock);
+- kref_get(&port->kref);
+- spin_unlock_irq(&port->portdev->ports_lock);
+-
+ /*
+ * Don't allow opening of console port devices -- that's done
+ * via /dev/hvc
+@@ -1264,14 +1271,6 @@ static void remove_port(struct kref *kref)
+
+ port = container_of(kref, struct port, kref);
+
+- sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
+- device_destroy(pdrvdata.class, port->dev->devt);
+- cdev_del(port->cdev);
+-
+- kfree(port->name);
+-
+- debugfs_remove(port->debugfs_file);
+-
+ kfree(port);
+ }
+
+@@ -1289,12 +1288,14 @@ static void unplug_port(struct port *port)
+ spin_unlock_irq(&port->portdev->ports_lock);
+
+ if (port->guest_connected) {
++ /* Let the app know the port is going down. */
++ send_sigio_to_port(port);
++
++ /* Do this after sigio is actually sent */
+ port->guest_connected = false;
+ port->host_connected = false;
+- wake_up_interruptible(&port->waitqueue);
+
+- /* Let the app know the port is going down. */
+- send_sigio_to_port(port);
++ wake_up_interruptible(&port->waitqueue);
+ }
+
+ if (is_console_port(port)) {
+@@ -1320,6 +1321,14 @@ static void unplug_port(struct port *port)
+ */
+ port->portdev = NULL;
+
++ sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
++ device_destroy(pdrvdata.class, port->dev->devt);
++ cdev_del(port->cdev);
++
++ kfree(port->name);
++
++ debugfs_remove(port->debugfs_file);
++
+ /*
+ * Locks around here are not necessary - a port can't be
+ * opened after we removed the port struct from ports_list
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 144d37c..61274bf 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -275,6 +275,7 @@ enum intel_pch {
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
+ #define QUIRK_INVERT_BRIGHTNESS (1<<2)
++#define QUIRK_NO_PCH_PWM_ENABLE (1<<3)
+
+ struct intel_fbdev;
+ struct intel_fbc_work;
+diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
+index 124dd87..97a050f 100644
+--- a/drivers/gpu/drm/i915/i915_reg.h
++++ b/drivers/gpu/drm/i915/i915_reg.h
+@@ -362,6 +362,7 @@
+ #define IPEIR_I965 0x02064
+ #define IPEHR_I965 0x02068
+ #define INSTDONE_I965 0x0206c
++#define RING_INSTPM(base) ((base)+0xc0)
+ #define INSTPS 0x02070 /* 965+ only */
+ #define INSTDONE1 0x0207c /* 965+ only */
+ #define ACTHD_I965 0x02074
+@@ -458,6 +459,8 @@
+ will not assert AGPBUSY# and will only
+ be delivered when out of C3. */
+ #define INSTPM_FORCE_ORDERING (1<<7) /* GEN6+ */
++#define INSTPM_TLB_INVALIDATE (1<<9)
++#define INSTPM_SYNC_FLUSH (1<<5)
+ #define ACTHD 0x020c8
+ #define FW_BLC 0x020d8
+ #define FW_BLC2 0x020dc
+@@ -3513,7 +3516,7 @@
+ #define EDP_LINK_TRAIN_600MV_0DB_IVB (0x30 <<22)
+ #define EDP_LINK_TRAIN_600MV_3_5DB_IVB (0x36 <<22)
+ #define EDP_LINK_TRAIN_800MV_0DB_IVB (0x38 <<22)
+-#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x33 <<22)
++#define EDP_LINK_TRAIN_800MV_3_5DB_IVB (0x3e <<22)
+
+ /* legacy values */
+ #define EDP_LINK_TRAIN_500MV_0DB_IVB (0x00 <<22)
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index cfbb893..ee29c1f 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -8842,6 +8842,17 @@ static void quirk_invert_brightness(struct drm_device *dev)
+ dev_priv->quirks |= QUIRK_INVERT_BRIGHTNESS;
+ }
+
++/*
++ * Some machines (Dell XPS13) suffer broken backlight controls if
++ * BLM_PCH_PWM_ENABLE is set.
++ */
++static void quirk_no_pcm_pwm_enable(struct drm_device *dev)
++{
++ struct drm_i915_private *dev_priv = dev->dev_private;
++ dev_priv->quirks |= QUIRK_NO_PCH_PWM_ENABLE;
++ DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
++}
++
+ struct intel_quirk {
+ int device;
+ int subsystem_vendor;
+@@ -8916,6 +8927,11 @@ struct intel_quirk intel_quirks[] = {
+
+ /* Acer/Packard Bell NCL20 */
+ { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
++
++ /* Dell XPS13 HD Sandy Bridge */
++ { 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
++ /* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
++ { 0x0166, 0x1028, 0x058b, quirk_no_pcm_pwm_enable },
+ };
+
+ static void intel_init_quirks(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 2ffa740..74d312f 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -402,13 +402,7 @@ static void intel_lvds_prepare(struct drm_encoder *encoder)
+ {
+ struct intel_lvds *intel_lvds = to_intel_lvds(encoder);
+
+- /*
+- * Prior to Ironlake, we must disable the pipe if we want to adjust
+- * the panel fitter. However at all other times we can just reset
+- * the registers regardless.
+- */
+- if (!HAS_PCH_SPLIT(encoder->dev) && intel_lvds->pfit_dirty)
+- intel_lvds_disable(intel_lvds);
++ intel_lvds_disable(intel_lvds);
+ }
+
+ static void intel_lvds_commit(struct drm_encoder *encoder)
+@@ -1075,7 +1069,8 @@ bool intel_lvds_init(struct drm_device *dev)
+ goto failed;
+
+ out:
+- if (HAS_PCH_SPLIT(dev)) {
++ if (HAS_PCH_SPLIT(dev) &&
++ !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
+ u32 pwm;
+
+ pipe = (I915_READ(PCH_LVDS) & LVDS_PIPEB_SELECT) ? 1 : 0;
+diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
+index 38a7793..3c55cf6 100644
+--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
++++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
+@@ -776,6 +776,18 @@ void intel_ring_setup_status_page(struct intel_ring_buffer *ring)
+
+ I915_WRITE(mmio, (u32)ring->status_page.gfx_addr);
+ POSTING_READ(mmio);
++
++ /* Flush the TLB for this page */
++ if (INTEL_INFO(dev)->gen >= 6) {
++ u32 reg = RING_INSTPM(ring->mmio_base);
++ I915_WRITE(reg,
++ _MASKED_BIT_ENABLE(INSTPM_TLB_INVALIDATE |
++ INSTPM_SYNC_FLUSH));
++ if (wait_for((I915_READ(reg) & INSTPM_SYNC_FLUSH) == 0,
++ 1000))
++ DRM_ERROR("%s: wait for SyncFlush to complete for TLB invalidation timed out\n",
++ ring->name);
++ }
+ }
+
+ static int
+diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
+index d969f3c..afb351a 100644
+--- a/drivers/gpu/drm/radeon/atom.c
++++ b/drivers/gpu/drm/radeon/atom.c
+@@ -1220,12 +1220,17 @@ int atom_execute_table(struct atom_context *ctx, int index, uint32_t * params)
+ int r;
+
+ mutex_lock(&ctx->mutex);
++ /* reset data block */
++ ctx->data_block = 0;
+ /* reset reg block */
+ ctx->reg_block = 0;
+ /* reset fb window */
+ ctx->fb_base = 0;
+ /* reset io mode */
+ ctx->io_mode = ATOM_IO_MM;
++ /* reset divmul */
++ ctx->divmul[0] = 0;
++ ctx->divmul[1] = 0;
+ r = atom_execute_table_locked(ctx, index, params);
+ mutex_unlock(&ctx->mutex);
+ return r;
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 9bea4a6..f5962a0 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -3036,6 +3036,8 @@ static int evergreen_startup(struct radeon_device *rdev)
+ /* enable pcie gen2 link */
+ evergreen_pcie_gen2_enable(rdev);
+
++ evergreen_mc_program(rdev);
++
+ if (ASIC_IS_DCE5(rdev)) {
+ if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
+ r = ni_init_microcode(rdev);
+@@ -3063,7 +3065,6 @@ static int evergreen_startup(struct radeon_device *rdev)
+ if (r)
+ return r;
+
+- evergreen_mc_program(rdev);
+ if (rdev->flags & RADEON_IS_AGP) {
+ evergreen_agp_enable(rdev);
+ } else {
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 3f9705b..77e6fb1 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1353,6 +1353,8 @@ static int cayman_startup(struct radeon_device *rdev)
+ /* enable pcie gen2 link */
+ evergreen_pcie_gen2_enable(rdev);
+
++ evergreen_mc_program(rdev);
++
+ if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw || !rdev->mc_fw) {
+ r = ni_init_microcode(rdev);
+ if (r) {
+@@ -1370,7 +1372,6 @@ static int cayman_startup(struct radeon_device *rdev)
+ if (r)
+ return r;
+
+- evergreen_mc_program(rdev);
+ r = cayman_pcie_gart_enable(rdev);
+ if (r)
+ return r;
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 3d46d7d4..57e45c6 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -2415,6 +2415,8 @@ int r600_startup(struct radeon_device *rdev)
+ /* enable pcie gen2 link */
+ r600_pcie_gen2_enable(rdev);
+
++ r600_mc_program(rdev);
++
+ if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ r = r600_init_microcode(rdev);
+ if (r) {
+@@ -2427,7 +2429,6 @@ int r600_startup(struct radeon_device *rdev)
+ if (r)
+ return r;
+
+- r600_mc_program(rdev);
+ if (rdev->flags & RADEON_IS_AGP) {
+ r600_agp_enable(rdev);
+ } else {
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 63db75d..3e72074 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -1057,6 +1057,8 @@ static int rv770_startup(struct radeon_device *rdev)
+ /* enable pcie gen2 link */
+ rv770_pcie_gen2_enable(rdev);
+
++ rv770_mc_program(rdev);
++
+ if (!rdev->me_fw || !rdev->pfp_fw || !rdev->rlc_fw) {
+ r = r600_init_microcode(rdev);
+ if (r) {
+@@ -1069,7 +1071,6 @@ static int rv770_startup(struct radeon_device *rdev)
+ if (r)
+ return r;
+
+- rv770_mc_program(rdev);
+ if (rdev->flags & RADEON_IS_AGP) {
+ rv770_agp_enable(rdev);
+ } else {
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+index c41226a..2952249 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
+@@ -29,7 +29,9 @@
+ #include "drmP.h"
+ #include "ttm/ttm_bo_driver.h"
+
+-#define VMW_PPN_SIZE sizeof(unsigned long)
++#define VMW_PPN_SIZE (sizeof(unsigned long))
++/* A future safe maximum remap size. */
++#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE)
+
+ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
+ struct page *pages[],
+@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
+ {
+ SVGAFifoCmdDefineGMR2 define_cmd;
+ SVGAFifoCmdRemapGMR2 remap_cmd;
+- uint32_t define_size = sizeof(define_cmd) + 4;
+- uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4;
+ uint32_t *cmd;
+ uint32_t *cmd_orig;
++ uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd);
++ uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0);
++ uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num;
++ uint32_t remap_pos = 0;
++ uint32_t cmd_size = define_size + remap_size;
+ uint32_t i;
+
+- cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size);
++ cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size);
+ if (unlikely(cmd == NULL))
+ return -ENOMEM;
+
+ define_cmd.gmrId = gmr_id;
+ define_cmd.numPages = num_pages;
+
++ *cmd++ = SVGA_CMD_DEFINE_GMR2;
++ memcpy(cmd, &define_cmd, sizeof(define_cmd));
++ cmd += sizeof(define_cmd) / sizeof(*cmd);
++
++ /*
++ * Need to split the command if there are too many
++ * pages that goes into the gmr.
++ */
++
+ remap_cmd.gmrId = gmr_id;
+ remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ?
+ SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32;
+- remap_cmd.offsetPages = 0;
+- remap_cmd.numPages = num_pages;
+
+- *cmd++ = SVGA_CMD_DEFINE_GMR2;
+- memcpy(cmd, &define_cmd, sizeof(define_cmd));
+- cmd += sizeof(define_cmd) / sizeof(uint32);
++ while (num_pages > 0) {
++ unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP);
++
++ remap_cmd.offsetPages = remap_pos;
++ remap_cmd.numPages = nr;
+
+- *cmd++ = SVGA_CMD_REMAP_GMR2;
+- memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
+- cmd += sizeof(remap_cmd) / sizeof(uint32);
++ *cmd++ = SVGA_CMD_REMAP_GMR2;
++ memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
++ cmd += sizeof(remap_cmd) / sizeof(*cmd);
+
+- for (i = 0; i < num_pages; ++i) {
+- if (VMW_PPN_SIZE <= 4)
+- *cmd = page_to_pfn(*pages++);
+- else
+- *((uint64_t *)cmd) = page_to_pfn(*pages++);
++ for (i = 0; i < nr; ++i) {
++ if (VMW_PPN_SIZE <= 4)
++ *cmd = page_to_pfn(*pages++);
++ else
++ *((uint64_t *)cmd) = page_to_pfn(*pages++);
+
+- cmd += VMW_PPN_SIZE / sizeof(*cmd);
++ cmd += VMW_PPN_SIZE / sizeof(*cmd);
++ }
++
++ num_pages -= nr;
++ remap_pos += nr;
+ }
+
+- vmw_fifo_commit(dev_priv, define_size + remap_size);
++ BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd));
++
++ vmw_fifo_commit(dev_priv, cmd_size);
+
+ return 0;
+ }
+diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c
+index c6d1ce0..a9726c1 100644
+--- a/drivers/hwmon/adt7470.c
++++ b/drivers/hwmon/adt7470.c
+@@ -215,7 +215,7 @@ static inline int adt7470_write_word_data(struct i2c_client *client, u8 reg,
+ u16 value)
+ {
+ return i2c_smbus_write_byte_data(client, reg, value & 0xFF)
+- && i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
++ || i2c_smbus_write_byte_data(client, reg + 1, value >> 8);
+ }
+
+ static void adt7470_init_client(struct i2c_client *client)
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 298e02a..c706a7b 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1139,7 +1139,7 @@ read_again:
+ * know the original bi_idx, so we just free
+ * them all
+ */
+- __bio_for_each_segment(bvec, mbio, j, 0)
++ bio_for_each_segment_all(bvec, mbio, j)
+ bvec->bv_page = r1_bio->behind_bvecs[j].bv_page;
+ if (test_bit(WriteMostly, &conf->mirrors[i].rdev->flags))
+ atomic_inc(&r1_bio->behind_remaining);
+diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
+index a746ba2..a956053 100644
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
+
+ soft = &pkt.soft.rfc1201;
+
+- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+ if (pkt.hard.offset[0]) {
+ ofs = pkt.hard.offset[0];
+ length = 256 - ofs;
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+index fcd0e47..2a7d091 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
+@@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
+
+ /* Enable arbiter */
+ reg &= ~IXGBE_DPMCS_ARBDIS;
+- /* Enable DFP and Recycle mode */
+- reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
+ reg |= IXGBE_DPMCS_TSOEF;
++
+ /* Configure Max TSO packet size 34KB including payload and headers */
+ reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
+
+diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
+index b19841a..00f1367 100644
+--- a/drivers/net/ifb.c
++++ b/drivers/net/ifb.c
+@@ -34,6 +34,7 @@
+ #include <linux/init.h>
+ #include <linux/interrupt.h>
+ #include <linux/moduleparam.h>
++#include <linux/sched.h>
+ #include <net/pkt_sched.h>
+ #include <net/net_namespace.h>
+
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index f3d17f8..a8e4640 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -43,7 +43,6 @@
+ #define EEPROM_MAC_OFFSET (0x01)
+ #define DEFAULT_TX_CSUM_ENABLE (true)
+ #define DEFAULT_RX_CSUM_ENABLE (true)
+-#define DEFAULT_TSO_ENABLE (true)
+ #define SMSC75XX_INTERNAL_PHY_ID (1)
+ #define SMSC75XX_TX_OVERHEAD (8)
+ #define MAX_RX_FIFO_SIZE (20 * 1024)
+@@ -1035,17 +1034,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
+
+ INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
+
+- if (DEFAULT_TX_CSUM_ENABLE) {
++ if (DEFAULT_TX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- if (DEFAULT_TSO_ENABLE)
+- dev->net->features |= NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_TSO6;
+- }
++
+ if (DEFAULT_RX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_RXCSUM;
+
+ dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
++ NETIF_F_RXCSUM;
+
+ /* Init all registers */
+ ret = smsc75xx_reset(dev);
+@@ -1170,8 +1166,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
+ {
+ u32 tx_cmd_a, tx_cmd_b;
+
+- skb_linearize(skb);
+-
+ if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+ struct sk_buff *skb2 =
+ skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 84890d5..ef921e1 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -851,6 +851,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
+ if (error != 0)
+ goto err_rx;
+
++ ath9k_hw_disable(priv->ah);
+ #ifdef CONFIG_MAC80211_LEDS
+ /* must be initialized before ieee80211_register_hw */
+ priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+index a48bb83..9a57149 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+@@ -448,6 +448,7 @@ static void ath9k_htc_tx_process(struct ath9k_htc_priv *priv,
+ struct ieee80211_conf *cur_conf = &priv->hw->conf;
+ bool txok;
+ int slot;
++ int hdrlen, padsize;
+
+ slot = strip_drv_header(priv, skb);
+ if (slot < 0) {
+@@ -504,6 +505,15 @@ send_mac80211:
+
+ ath9k_htc_tx_clear_slot(priv, slot);
+
++ /* Remove padding before handing frame back to mac80211 */
++ hdrlen = ieee80211_get_hdrlen_from_skb(skb);
++
++ padsize = hdrlen & 3;
++ if (padsize && skb->len > hdrlen + padsize) {
++ memmove(skb->data + padsize, skb->data, hdrlen);
++ skb_pull(skb, padsize);
++ }
++
+ /* Send status to mac80211 */
+ ieee80211_tx_status(priv->hw, skb);
+ }
+diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
+index 045a936..271e818 100644
+--- a/drivers/net/wireless/hostap/hostap_ioctl.c
++++ b/drivers/net/wireless/hostap/hostap_ioctl.c
+@@ -522,9 +522,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
+
+ data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
+
+- memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
++ memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
+ data->flags = 1; /* has quality information */
+- memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
++ memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
+ sizeof(struct iw_quality) * data->length);
+
+ kfree(addr);
+diff --git a/drivers/net/wireless/iwlegacy/iwl-core.c b/drivers/net/wireless/iwlegacy/iwl-core.c
+index 1bb64c9..09891e5 100644
+--- a/drivers/net/wireless/iwlegacy/iwl-core.c
++++ b/drivers/net/wireless/iwlegacy/iwl-core.c
+@@ -1757,6 +1757,7 @@ int iwl_legacy_force_reset(struct iwl_priv *priv, bool external)
+
+ return 0;
+ }
++EXPORT_SYMBOL(iwl_legacy_force_reset);
+
+ int
+ iwl_legacy_mac_change_interface(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/iwlegacy/iwl4965-base.c b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+index d2fba9e..6e25c7b 100644
+--- a/drivers/net/wireless/iwlegacy/iwl4965-base.c
++++ b/drivers/net/wireless/iwlegacy/iwl4965-base.c
+@@ -868,13 +868,13 @@ static void iwl4965_irq_tasklet(struct iwl_priv *priv)
+ * is killed. Hence update the killswitch state here. The
+ * rfkill handler will care about restarting if needed.
+ */
+- if (!test_bit(STATUS_ALIVE, &priv->status)) {
+- if (hw_rf_kill)
+- set_bit(STATUS_RF_KILL_HW, &priv->status);
+- else
+- clear_bit(STATUS_RF_KILL_HW, &priv->status);
+- wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill);
++ if (hw_rf_kill) {
++ set_bit(STATUS_RF_KILL_HW, &priv->status);
++ } else {
++ clear_bit(STATUS_RF_KILL_HW, &priv->status);
++ iwl_legacy_force_reset(priv, true);
+ }
++ wiphy_rfkill_set_hw_state(priv->hw->wiphy, hw_rf_kill);
+
+ handled |= CSR_INT_BIT_RF_KILL;
+ }
+@@ -1764,6 +1764,9 @@ static void iwl4965_alive_start(struct iwl_priv *priv)
+
+ priv->active_rate = IWL_RATES_MASK;
+
++ iwl_legacy_power_update_mode(priv, true);
++ IWL_DEBUG_INFO(priv, "Updated power mode\n");
++
+ if (iwl_legacy_is_associated_ctx(ctx)) {
+ struct iwl_legacy_rxon_cmd *active_rxon =
+ (struct iwl_legacy_rxon_cmd *)&ctx->active;
+@@ -1796,9 +1799,6 @@ static void iwl4965_alive_start(struct iwl_priv *priv)
+ IWL_DEBUG_INFO(priv, "ALIVE processing complete.\n");
+ wake_up(&priv->wait_command_queue);
+
+- iwl_legacy_power_update_mode(priv, true);
+- IWL_DEBUG_INFO(priv, "Updated power mode\n");
+-
+ return;
+
+ restart:
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
+index 16cdd12..94d35ad 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
+@@ -1297,7 +1297,7 @@ int iwl_alive_start(struct iwl_priv *priv)
+ BT_COEX_PRIO_TBL_EVT_INIT_CALIB2);
+ if (ret)
+ return ret;
+- } else {
++ } else if (priv->cfg->bt_params) {
+ /*
+ * default is 2-wire BT coexexistence support
+ */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
+index 832ec4d..5ef176a 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-core.c
++++ b/drivers/net/wireless/iwlwifi/iwl-core.c
+@@ -808,8 +808,11 @@ void iwl_chswitch_done(struct iwl_priv *priv, bool is_success)
+ if (test_bit(STATUS_EXIT_PENDING, &priv->shrd->status))
+ return;
+
+- if (test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
++ if (!test_and_clear_bit(STATUS_CHANNEL_SWITCH_PENDING,
+ &priv->shrd->status))
++ return;
++
++ if (ctx->vif)
+ ieee80211_chswitch_done(ctx->vif, is_success);
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-pci.c b/drivers/net/wireless/iwlwifi/iwl-pci.c
+index 1800029..346dc9b 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-pci.c
++++ b/drivers/net/wireless/iwlwifi/iwl-pci.c
+@@ -227,6 +227,7 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
+ {IWL_PCI_DEVICE(0x423C, 0x1306, iwl5150_abg_cfg)}, /* Half Mini Card */
+ {IWL_PCI_DEVICE(0x423C, 0x1221, iwl5150_agn_cfg)}, /* Mini Card */
+ {IWL_PCI_DEVICE(0x423C, 0x1321, iwl5150_agn_cfg)}, /* Half Mini Card */
++ {IWL_PCI_DEVICE(0x423C, 0x1326, iwl5150_abg_cfg)}, /* Half Mini Card */
+
+ {IWL_PCI_DEVICE(0x423D, 0x1211, iwl5150_agn_cfg)}, /* Mini Card */
+ {IWL_PCI_DEVICE(0x423D, 0x1311, iwl5150_agn_cfg)}, /* Half Mini Card */
+diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
+index 3579a68..17f8720 100644
+--- a/drivers/net/wireless/mwifiex/sdio.c
++++ b/drivers/net/wireless/mwifiex/sdio.c
+@@ -1429,8 +1429,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
+ /* Allocate buffer and copy payload */
+ blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
+ buf_block_len = (pkt_len + blk_size - 1) / blk_size;
+- *(u16 *) &payload[0] = (u16) pkt_len;
+- *(u16 *) &payload[2] = type;
++ *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
++ *(__le16 *)&payload[2] = cpu_to_le16(type);
+
+ /*
+ * This is SDIO specific header
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 50f92d5..4d792a2 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -856,13 +856,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
+ spin_unlock_irqrestore(&queue->index_lock, irqflags);
+ }
+
+-void rt2x00queue_pause_queue(struct data_queue *queue)
++void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
+ {
+- if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
+- !test_bit(QUEUE_STARTED, &queue->flags) ||
+- test_and_set_bit(QUEUE_PAUSED, &queue->flags))
+- return;
+-
+ switch (queue->qid) {
+ case QID_AC_VO:
+ case QID_AC_VI:
+@@ -878,6 +873,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
+ break;
+ }
+ }
++void rt2x00queue_pause_queue(struct data_queue *queue)
++{
++ if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
++ !test_bit(QUEUE_STARTED, &queue->flags) ||
++ test_and_set_bit(QUEUE_PAUSED, &queue->flags))
++ return;
++
++ rt2x00queue_pause_queue_nocheck(queue);
++}
+ EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
+
+ void rt2x00queue_unpause_queue(struct data_queue *queue)
+@@ -939,7 +943,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
+ return;
+ }
+
+- rt2x00queue_pause_queue(queue);
++ rt2x00queue_pause_queue_nocheck(queue);
+
+ queue->rt2x00dev->ops->lib->stop_queue(queue);
+
+diff --git a/drivers/net/wireless/zd1201.c b/drivers/net/wireless/zd1201.c
+index 8efa2f2..f8c319c 100644
+--- a/drivers/net/wireless/zd1201.c
++++ b/drivers/net/wireless/zd1201.c
+@@ -98,10 +98,12 @@ static int zd1201_fw_upload(struct usb_device *dev, int apfw)
+ goto exit;
+
+ err = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), 0x4,
+- USB_DIR_IN | 0x40, 0,0, &ret, sizeof(ret), ZD1201_FW_TIMEOUT);
++ USB_DIR_IN | 0x40, 0, 0, buf, sizeof(ret), ZD1201_FW_TIMEOUT);
+ if (err < 0)
+ goto exit;
+
++ memcpy(&ret, buf, sizeof(ret));
++
+ if (ret & 0x80) {
+ err = -EIO;
+ goto exit;
+diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
+index fd85fa2..b77808c 100644
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -389,6 +389,8 @@ static void __unflatten_device_tree(struct boot_param_header *blob,
+ mem = (unsigned long)
+ dt_alloc(size + 4, __alignof__(struct device_node));
+
++ memset((void *)mem, 0, size);
++
+ ((__be32 *)mem)[size / 4] = cpu_to_be32(0xdeadbeef);
+
+ pr_debug(" unflattening %lx...\n", mem);
+diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
+index a9c46cc..8c33491 100644
+--- a/drivers/parisc/iommu-helpers.h
++++ b/drivers/parisc/iommu-helpers.h
+@@ -1,3 +1,5 @@
++#include <linux/prefetch.h>
++
+ /**
+ * iommu_fill_pdir - Insert coalesced scatter/gather chunks into the I/O Pdir.
+ * @ioc: The I/O Controller.
+diff --git a/drivers/pci/Makefile b/drivers/pci/Makefile
+index 083a49f..165274c 100644
+--- a/drivers/pci/Makefile
++++ b/drivers/pci/Makefile
+@@ -42,6 +42,7 @@ obj-$(CONFIG_UNICORE32) += setup-bus.o setup-irq.o
+ obj-$(CONFIG_PARISC) += setup-bus.o
+ obj-$(CONFIG_SUPERH) += setup-bus.o setup-irq.o
+ obj-$(CONFIG_PPC) += setup-bus.o
++obj-$(CONFIG_FRV) += setup-bus.o
+ obj-$(CONFIG_MIPS) += setup-bus.o setup-irq.o
+ obj-$(CONFIG_X86_VISWS) += setup-irq.o
+ obj-$(CONFIG_MN10300) += setup-bus.o
+diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c
+index e1b4f80..5c87270 100644
+--- a/drivers/s390/scsi/zfcp_erp.c
++++ b/drivers/s390/scsi/zfcp_erp.c
+@@ -102,10 +102,13 @@ static void zfcp_erp_action_dismiss_port(struct zfcp_port *port)
+
+ if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_INUSE)
+ zfcp_erp_action_dismiss(&port->erp_action);
+- else
+- shost_for_each_device(sdev, port->adapter->scsi_host)
++ else {
++ spin_lock(port->adapter->scsi_host->host_lock);
++ __shost_for_each_device(sdev, port->adapter->scsi_host)
+ if (sdev_to_zfcp(sdev)->port == port)
+ zfcp_erp_action_dismiss_lun(sdev);
++ spin_unlock(port->adapter->scsi_host->host_lock);
++ }
+ }
+
+ static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter)
+@@ -592,9 +595,11 @@ static void _zfcp_erp_lun_reopen_all(struct zfcp_port *port, int clear,
+ {
+ struct scsi_device *sdev;
+
+- shost_for_each_device(sdev, port->adapter->scsi_host)
++ spin_lock(port->adapter->scsi_host->host_lock);
++ __shost_for_each_device(sdev, port->adapter->scsi_host)
+ if (sdev_to_zfcp(sdev)->port == port)
+ _zfcp_erp_lun_reopen(sdev, clear, id, 0);
++ spin_unlock(port->adapter->scsi_host->host_lock);
+ }
+
+ static void zfcp_erp_strategy_followup_failed(struct zfcp_erp_action *act)
+@@ -1435,8 +1440,10 @@ void zfcp_erp_set_adapter_status(struct zfcp_adapter *adapter, u32 mask)
+ atomic_set_mask(common_mask, &port->status);
+ read_unlock_irqrestore(&adapter->port_list_lock, flags);
+
+- shost_for_each_device(sdev, adapter->scsi_host)
++ spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
++ __shost_for_each_device(sdev, adapter->scsi_host)
+ atomic_set_mask(common_mask, &sdev_to_zfcp(sdev)->status);
++ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
+ }
+
+ /**
+@@ -1470,11 +1477,13 @@ void zfcp_erp_clear_adapter_status(struct zfcp_adapter *adapter, u32 mask)
+ }
+ read_unlock_irqrestore(&adapter->port_list_lock, flags);
+
+- shost_for_each_device(sdev, adapter->scsi_host) {
++ spin_lock_irqsave(adapter->scsi_host->host_lock, flags);
++ __shost_for_each_device(sdev, adapter->scsi_host) {
+ atomic_clear_mask(common_mask, &sdev_to_zfcp(sdev)->status);
+ if (clear_counter)
+ atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
+ }
++ spin_unlock_irqrestore(adapter->scsi_host->host_lock, flags);
+ }
+
+ /**
+@@ -1488,16 +1497,19 @@ void zfcp_erp_set_port_status(struct zfcp_port *port, u32 mask)
+ {
+ struct scsi_device *sdev;
+ u32 common_mask = mask & ZFCP_COMMON_FLAGS;
++ unsigned long flags;
+
+ atomic_set_mask(mask, &port->status);
+
+ if (!common_mask)
+ return;
+
+- shost_for_each_device(sdev, port->adapter->scsi_host)
++ spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
++ __shost_for_each_device(sdev, port->adapter->scsi_host)
+ if (sdev_to_zfcp(sdev)->port == port)
+ atomic_set_mask(common_mask,
+ &sdev_to_zfcp(sdev)->status);
++ spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
+ }
+
+ /**
+@@ -1512,6 +1524,7 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
+ struct scsi_device *sdev;
+ u32 common_mask = mask & ZFCP_COMMON_FLAGS;
+ u32 clear_counter = mask & ZFCP_STATUS_COMMON_ERP_FAILED;
++ unsigned long flags;
+
+ atomic_clear_mask(mask, &port->status);
+
+@@ -1521,13 +1534,15 @@ void zfcp_erp_clear_port_status(struct zfcp_port *port, u32 mask)
+ if (clear_counter)
+ atomic_set(&port->erp_counter, 0);
+
+- shost_for_each_device(sdev, port->adapter->scsi_host)
++ spin_lock_irqsave(port->adapter->scsi_host->host_lock, flags);
++ __shost_for_each_device(sdev, port->adapter->scsi_host)
+ if (sdev_to_zfcp(sdev)->port == port) {
+ atomic_clear_mask(common_mask,
+ &sdev_to_zfcp(sdev)->status);
+ if (clear_counter)
+ atomic_set(&sdev_to_zfcp(sdev)->erp_counter, 0);
+ }
++ spin_unlock_irqrestore(port->adapter->scsi_host->host_lock, flags);
+ }
+
+ /**
+diff --git a/drivers/s390/scsi/zfcp_qdio.c b/drivers/s390/scsi/zfcp_qdio.c
+index e76d003..52c6b59 100644
+--- a/drivers/s390/scsi/zfcp_qdio.c
++++ b/drivers/s390/scsi/zfcp_qdio.c
+@@ -224,11 +224,9 @@ int zfcp_qdio_sbals_from_sg(struct zfcp_qdio *qdio, struct zfcp_qdio_req *q_req,
+
+ static int zfcp_qdio_sbal_check(struct zfcp_qdio *qdio)
+ {
+- spin_lock_irq(&qdio->req_q_lock);
+ if (atomic_read(&qdio->req_q_free) ||
+ !(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
+ return 1;
+- spin_unlock_irq(&qdio->req_q_lock);
+ return 0;
+ }
+
+@@ -246,9 +244,8 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
+ {
+ long ret;
+
+- spin_unlock_irq(&qdio->req_q_lock);
+- ret = wait_event_interruptible_timeout(qdio->req_q_wq,
+- zfcp_qdio_sbal_check(qdio), 5 * HZ);
++ ret = wait_event_interruptible_lock_irq_timeout(qdio->req_q_wq,
++ zfcp_qdio_sbal_check(qdio), qdio->req_q_lock, 5 * HZ);
+
+ if (!(atomic_read(&qdio->adapter->status) & ZFCP_STATUS_ADAPTER_QDIOUP))
+ return -EIO;
+@@ -262,7 +259,6 @@ int zfcp_qdio_sbal_get(struct zfcp_qdio *qdio)
+ zfcp_erp_adapter_reopen(qdio->adapter, 0, "qdsbg_1");
+ }
+
+- spin_lock_irq(&qdio->req_q_lock);
+ return -EIO;
+ }
+
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index fc5a2ef..b018997 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3547,11 +3547,21 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ break;
+ }
+
+- /*
+- * We expect the FW state to be READY
+- */
+- if (megasas_transition_to_ready(instance, 0))
+- goto fail_ready_state;
++ if (megasas_transition_to_ready(instance, 0)) {
++ atomic_set(&instance->fw_reset_no_pci_access, 1);
++ instance->instancet->adp_reset
++ (instance, instance->reg_set);
++ atomic_set(&instance->fw_reset_no_pci_access, 0);
++ dev_info(&instance->pdev->dev,
++ "megasas: FW restarted successfully from %s!\n",
++ __func__);
++
++ /*waitting for about 30 second before retry*/
++ ssleep(30);
++
++ if (megasas_transition_to_ready(instance, 0))
++ goto fail_ready_state;
++ }
+
+ /* Check if MSI-X is supported while in ready state */
+ msix_enable = (instance->instancet->read_fw_status_reg(reg_set) &
+diff --git a/drivers/scsi/nsp32.c b/drivers/scsi/nsp32.c
+index f6a50c9..bfb05b8 100644
+--- a/drivers/scsi/nsp32.c
++++ b/drivers/scsi/nsp32.c
+@@ -2927,7 +2927,7 @@ static void nsp32_do_bus_reset(nsp32_hw_data *data)
+ * reset SCSI bus
+ */
+ nsp32_write1(base, SCSI_BUS_CONTROL, BUSCTL_RST);
+- udelay(RESET_HOLD_TIME);
++ mdelay(RESET_HOLD_TIME / 1000);
+ nsp32_write1(base, SCSI_BUS_CONTROL, 0);
+ for(i = 0; i < 5; i++) {
+ intrdat = nsp32_read2(base, IRQ_STATUS); /* dummy read */
+diff --git a/drivers/target/target_core_cdb.c b/drivers/target/target_core_cdb.c
+index 717a8d4..903b2f5 100644
+--- a/drivers/target/target_core_cdb.c
++++ b/drivers/target/target_core_cdb.c
+@@ -127,11 +127,12 @@ target_emulate_inquiry_std(struct se_cmd *cmd)
+ goto out;
+ }
+
+- snprintf((unsigned char *)&buf[8], 8, "LIO-ORG");
+- snprintf((unsigned char *)&buf[16], 16, "%s",
+- &dev->se_sub_dev->t10_wwn.model[0]);
+- snprintf((unsigned char *)&buf[32], 4, "%s",
+- &dev->se_sub_dev->t10_wwn.revision[0]);
++ memcpy(&buf[8], "LIO-ORG ", 8);
++ memset(&buf[16], 0x20, 16);
++ memcpy(&buf[16], dev->se_sub_dev->t10_wwn.model,
++ min_t(size_t, strlen(dev->se_sub_dev->t10_wwn.model), 16));
++ memcpy(&buf[32], dev->se_sub_dev->t10_wwn.revision,
++ min_t(size_t, strlen(dev->se_sub_dev->t10_wwn.revision), 4));
+ buf[4] = 31; /* Set additional length to 31 */
+
+ out:
+diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
+index 6f4dd83..3749688 100644
+--- a/drivers/tty/hvc/hvsi_lib.c
++++ b/drivers/tty/hvc/hvsi_lib.c
+@@ -341,8 +341,8 @@ void hvsilib_establish(struct hvsi_priv *pv)
+
+ pr_devel("HVSI@%x: ... waiting handshake\n", pv->termno);
+
+- /* Try for up to 200s */
+- for (timeout = 0; timeout < 20; timeout++) {
++ /* Try for up to 400ms */
++ for (timeout = 0; timeout < 40; timeout++) {
+ if (pv->established)
+ goto established;
+ if (!hvsi_get_packet(pv))
+diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
+index 5b3d063..ab7d11e 100644
+--- a/drivers/tty/serial/mxs-auart.c
++++ b/drivers/tty/serial/mxs-auart.c
+@@ -374,11 +374,18 @@ static void mxs_auart_settermios(struct uart_port *u,
+
+ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ {
+- u32 istatus, istat;
++ u32 istat;
+ struct mxs_auart_port *s = context;
+ u32 stat = readl(s->port.membase + AUART_STAT);
+
+- istatus = istat = readl(s->port.membase + AUART_INTR);
++ istat = readl(s->port.membase + AUART_INTR);
++
++ /* ack irq */
++ writel(istat & (AUART_INTR_RTIS
++ | AUART_INTR_TXIS
++ | AUART_INTR_RXIS
++ | AUART_INTR_CTSMIS),
++ s->port.membase + AUART_INTR_CLR);
+
+ if (istat & AUART_INTR_CTSMIS) {
+ uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
+@@ -397,12 +404,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
+ istat &= ~AUART_INTR_TXIS;
+ }
+
+- writel(istatus & (AUART_INTR_RTIS
+- | AUART_INTR_TXIS
+- | AUART_INTR_RXIS
+- | AUART_INTR_CTSMIS),
+- s->port.membase + AUART_INTR_CLR);
+-
+ return IRQ_HANDLED;
+ }
+
+@@ -542,7 +543,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+ struct mxs_auart_port *s;
+ struct uart_port *port;
+ unsigned int old_ctrl0, old_ctrl2;
+- unsigned int to = 1000;
++ unsigned int to = 20000;
+
+ if (co->index > MXS_AUART_PORTS || co->index < 0)
+ return;
+@@ -563,18 +564,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
+
+ uart_console_write(port, str, count, mxs_auart_console_putchar);
+
+- /*
+- * Finally, wait for transmitter to become empty
+- * and restore the TCR
+- */
++ /* Finally, wait for transmitter to become empty ... */
+ while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
++ udelay(1);
+ if (!to--)
+ break;
+- udelay(1);
+ }
+
+- writel(old_ctrl0, port->membase + AUART_CTRL0);
+- writel(old_ctrl2, port->membase + AUART_CTRL2);
++ /*
++ * ... and restore the TCR if we waited long enough for the transmitter
++ * to be idle. This might keep the transmitter enabled although it is
++ * unused, but that is better than to disable it while it is still
++ * transmitting.
++ */
++ if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
++ writel(old_ctrl0, port->membase + AUART_CTRL0);
++ writel(old_ctrl2, port->membase + AUART_CTRL2);
++ }
+
+ clk_disable(s->clk);
+ }
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 2fbcb75..f52182d 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -78,6 +78,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x04d8, 0x000c), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ /* CarrolTouch 4000U */
++ { USB_DEVICE(0x04e7, 0x0009), .driver_info = USB_QUIRK_RESET_RESUME },
++
++ /* CarrolTouch 4500U */
++ { USB_DEVICE(0x04e7, 0x0030), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Samsung Android phone modem - ID conflict with SPH-I500 */
+ { USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/misc/adutux.c b/drivers/usb/misc/adutux.c
+index fe85871..db5128b7e 100644
+--- a/drivers/usb/misc/adutux.c
++++ b/drivers/usb/misc/adutux.c
+@@ -829,7 +829,7 @@ static int adu_probe(struct usb_interface *interface,
+
+ /* let the user know what node this device is now attached to */
+ dev_info(&interface->dev, "ADU%d %s now attached to /dev/usb/adutux%d\n",
+- udev->descriptor.idProduct, dev->serial_number,
++ le16_to_cpu(udev->descriptor.idProduct), dev->serial_number,
+ (dev->minor - ADU_MINOR_BASE));
+ exit:
+ dbg(2," %s : leave, return value %p (dev)", __func__, dev);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ce9f87f..a3f6fe0 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -743,9 +743,34 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_SERIAL_VX7_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_CT29B_PID) },
+- { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_RTS01_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29A_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29F_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S01_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_29C_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_81B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_82B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5D_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K4Y_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_K5G_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S05_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_60_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_61_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_62_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_63B_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_64_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_65_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_92D_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_W5R_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_A5R_PID) },
++ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_PW1_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_MAXSTREAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PHI_FISCO_PID) },
+ { USB_DEVICE(TML_VID, TML_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 5d25e26..61685ed 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -815,11 +815,35 @@
+ /*
+ * RT Systems programming cables for various ham radios
+ */
+-#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+-#define RTSYSTEMS_SERIAL_VX7_PID 0x9e52 /* Serial converter for VX-7 Radios using FT232RL */
+-#define RTSYSTEMS_CT29B_PID 0x9e54 /* CT29B Radio Cable */
+-#define RTSYSTEMS_RTS01_PID 0x9e57 /* USB-RTS01 Radio Cable */
+-
++#define RTSYSTEMS_VID 0x2100 /* Vendor ID */
++#define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */
++#define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */
++#define RTSYSTEMS_USB_57A_PID 0x9e51 /* USB-57A USB to 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_57B_PID 0x9e52 /* USB-57B USB to extended 4pin 3.5mm plug */
++#define RTSYSTEMS_USB_29A_PID 0x9e53 /* USB-29A USB to 3.5mm stereo plug */
++#define RTSYSTEMS_USB_29B_PID 0x9e54 /* USB-29B USB to 6 pin mini din */
++#define RTSYSTEMS_USB_29F_PID 0x9e55 /* USB-29F USB to 6 pin modular plug */
++#define RTSYSTEMS_USB_62B_PID 0x9e56 /* USB-62B USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_S01_PID 0x9e57 /* USB-RTS01 USB to 3.5 mm stereo plug*/
++#define RTSYSTEMS_USB_63_PID 0x9e58 /* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_29C_PID 0x9e59 /* USB-29C USB to 4 pin modular plug*/
++#define RTSYSTEMS_USB_81B_PID 0x9e5A /* USB-81 USB to 8 pin mini din plug*/
++#define RTSYSTEMS_USB_82B_PID 0x9e5B /* USB-82 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_K5D_PID 0x9e5C /* USB-K5D USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_K4Y_PID 0x9e5D /* USB-K4Y USB to 2.5/3.5 mm plugs*/
++#define RTSYSTEMS_USB_K5G_PID 0x9e5E /* USB-K5G USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_S05_PID 0x9e5F /* USB-RTS05 USB to 2.5 mm stereo plug*/
++#define RTSYSTEMS_USB_60_PID 0x9e60 /* USB-60 USB to 6 pin din*/
++#define RTSYSTEMS_USB_61_PID 0x9e61 /* USB-61 USB to 6 pin mini din*/
++#define RTSYSTEMS_USB_62_PID 0x9e62 /* USB-62 USB to 8 pin mini din*/
++#define RTSYSTEMS_USB_63B_PID 0x9e63 /* USB-63 USB to 9 pin female*/
++#define RTSYSTEMS_USB_64_PID 0x9e64 /* USB-64 USB to 9 pin male*/
++#define RTSYSTEMS_USB_65_PID 0x9e65 /* USB-65 USB to 9 pin female null modem*/
++#define RTSYSTEMS_USB_92_PID 0x9e66 /* USB-92 USB to 12 pin plug*/
++#define RTSYSTEMS_USB_92D_PID 0x9e67 /* USB-92D USB to 12 pin plug data*/
++#define RTSYSTEMS_USB_W5R_PID 0x9e68 /* USB-W5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_A5R_PID 0x9e69 /* USB-A5R USB to 8 pin modular plug*/
++#define RTSYSTEMS_USB_PW1_PID 0x9e6A /* USB-PW1 USB to 8 pin modular plug*/
+
+ /*
+ * Physik Instrumente
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index 4f415e28..b668069 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -2620,7 +2620,7 @@ static int keyspan_startup(struct usb_serial *serial)
+ if (d_details == NULL) {
+ dev_err(&serial->dev->dev, "%s - unknown product id %x\n",
+ __func__, le16_to_cpu(serial->dev->descriptor.idProduct));
+- return 1;
++ return -ENODEV;
+ }
+
+ /* Setup private data for serial driver */
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index 9580679..9270d5c 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -97,6 +97,7 @@ struct urbtracker {
+ struct list_head urblist_entry;
+ struct kref ref_count;
+ struct urb *urb;
++ struct usb_ctrlrequest *setup;
+ };
+
+ enum mos7715_pp_modes {
+@@ -279,6 +280,7 @@ static void destroy_urbtracker(struct kref *kref)
+ struct mos7715_parport *mos_parport = urbtrack->mos_parport;
+ dbg("%s called", __func__);
+ usb_free_urb(urbtrack->urb);
++ kfree(urbtrack->setup);
+ kfree(urbtrack);
+ kref_put(&mos_parport->ref_count, destroy_mos_parport);
+ }
+@@ -363,7 +365,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ struct urbtracker *urbtrack;
+ int ret_val;
+ unsigned long flags;
+- struct usb_ctrlrequest setup;
+ struct usb_serial *serial = mos_parport->serial;
+ struct usb_device *usbdev = serial->dev;
+ dbg("%s called", __func__);
+@@ -382,14 +383,20 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
+ kfree(urbtrack);
+ return -ENOMEM;
+ }
+- setup.bRequestType = (__u8)0x40;
+- setup.bRequest = (__u8)0x0e;
+- setup.wValue = get_reg_value(reg, dummy);
+- setup.wIndex = get_reg_index(reg);
+- setup.wLength = 0;
++ urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
++ if (!urbtrack->setup) {
++ usb_free_urb(urbtrack->urb);
++ kfree(urbtrack);
++ return -ENOMEM;
++ }
++ urbtrack->setup->bRequestType = (__u8)0x40;
++ urbtrack->setup->bRequest = (__u8)0x0e;
++ urbtrack->setup->wValue = get_reg_value(reg, dummy);
++ urbtrack->setup->wIndex = get_reg_index(reg);
++ urbtrack->setup->wLength = 0;
+ usb_fill_control_urb(urbtrack->urb, usbdev,
+ usb_sndctrlpipe(usbdev, 0),
+- (unsigned char *)&setup,
++ (unsigned char *)urbtrack->setup,
+ NULL, 0, async_complete, urbtrack);
+ kref_init(&urbtrack->ref_count);
+ INIT_LIST_HEAD(&urbtrack->urblist_entry);
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 5e8c736..5d2501e 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -185,6 +185,10 @@
+ #define URB_TRANSFER_BUFFER_SIZE 32 /* URB Size */
+
+
++enum mos7840_flag {
++ MOS7840_FLAG_CTRL_BUSY,
++};
++
+ static const struct usb_device_id moschip_port_id_table[] = {
+ {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7840)},
+ {USB_DEVICE(USB_VENDOR_ID_MOSCHIP, MOSCHIP_DEVICE_ID_7820)},
+@@ -258,6 +262,8 @@ struct moschip_port {
+ struct urb *write_urb_pool[NUM_URBS];
+ char busy[NUM_URBS];
+ bool read_urb_busy;
++
++ unsigned long flags;
+ };
+
+
+@@ -519,11 +525,11 @@ static void mos7840_control_callback(struct urb *urb)
+ /* this urb is terminated, clean up */
+ dbg("%s - urb shutting down with status: %d", __func__,
+ status);
+- return;
++ goto out;
+ default:
+ dbg("%s - nonzero urb status received: %d", __func__,
+ status);
+- return;
++ goto out;
+ }
+
+ dbg("%s urb buffer size is %d", __func__, urb->actual_length);
+@@ -536,6 +542,8 @@ static void mos7840_control_callback(struct urb *urb)
+ mos7840_handle_new_msr(mos7840_port, regval);
+ else if (mos7840_port->MsrLsr == 1)
+ mos7840_handle_new_lsr(mos7840_port, regval);
++out:
++ clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mos7840_port->flags);
+ }
+
+ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+@@ -546,6 +554,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+ unsigned char *buffer = mcs->ctrl_buf;
+ int ret;
+
++ if (test_and_set_bit_lock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags))
++ return -EBUSY;
++
+ dr->bRequestType = MCS_RD_RTYPE;
+ dr->bRequest = MCS_RDREQ;
+ dr->wValue = cpu_to_le16(Wval); /* 0 */
+@@ -557,6 +568,9 @@ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
+ mos7840_control_callback, mcs);
+ mcs->control_urb->transfer_buffer_length = 2;
+ ret = usb_submit_urb(mcs->control_urb, GFP_ATOMIC);
++ if (ret)
++ clear_bit_unlock(MOS7840_FLAG_CTRL_BUSY, &mcs->flags);
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 42038ba..885d15d 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -1713,12 +1713,13 @@ static int ti_download_firmware(struct ti_device *tdev)
+
+ dbg("%s\n", __func__);
+ /* try ID specific firmware first, then try generic firmware */
+- sprintf(buf, "ti_usb-v%04x-p%04x.fw", dev->descriptor.idVendor,
+- dev->descriptor.idProduct);
++ sprintf(buf, "ti_usb-v%04x-p%04x.fw",
++ le16_to_cpu(dev->descriptor.idVendor),
++ le16_to_cpu(dev->descriptor.idProduct));
+ if ((status = request_firmware(&fw_p, buf, &dev->dev)) != 0) {
+ buf[0] = '\0';
+- if (dev->descriptor.idVendor == MTS_VENDOR_ID) {
+- switch (dev->descriptor.idProduct) {
++ if (le16_to_cpu(dev->descriptor.idVendor) == MTS_VENDOR_ID) {
++ switch (le16_to_cpu(dev->descriptor.idProduct)) {
+ case MTS_CDMA_PRODUCT_ID:
+ strcpy(buf, "mts_cdma.fw");
+ break;
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index 11d7b64..f6227cc 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -316,7 +316,7 @@ static void init_evtchn_cpu_bindings(void)
+
+ for_each_possible_cpu(i)
+ memset(per_cpu(cpu_evtchn_mask, i),
+- (i == 0) ? ~0 : 0, sizeof(*per_cpu(cpu_evtchn_mask, i)));
++ (i == 0) ? ~0 : 0, NR_EVENT_CHANNELS/8);
+ }
+
+ static inline void clear_evtchn(int port)
+@@ -1340,8 +1340,10 @@ void rebind_evtchn_irq(int evtchn, int irq)
+ /* Rebind an evtchn so that it gets delivered to a specific cpu */
+ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ {
++ struct shared_info *s = HYPERVISOR_shared_info;
+ struct evtchn_bind_vcpu bind_vcpu;
+ int evtchn = evtchn_from_irq(irq);
++ int masked;
+
+ if (!VALID_EVTCHN(evtchn))
+ return -1;
+@@ -1358,6 +1360,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ bind_vcpu.vcpu = tcpu;
+
+ /*
++ * Mask the event while changing the VCPU binding to prevent
++ * it being delivered on an unexpected VCPU.
++ */
++ masked = sync_test_and_set_bit(evtchn, s->evtchn_mask);
++
++ /*
+ * If this fails, it usually just indicates that we're dealing with a
+ * virq or IPI channel, which don't actually need to be rebound. Ignore
+ * it, but don't do the xenlinux-level rebind in that case.
+@@ -1365,6 +1373,9 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
+ if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
+ bind_evtchn_to_cpu(evtchn, tcpu);
+
++ if (!masked)
++ unmask_evtchn(evtchn);
++
+ return 0;
+ }
+
+diff --git a/fs/bio.c b/fs/bio.c
+index 4fc4dbb..b84d851 100644
+--- a/fs/bio.c
++++ b/fs/bio.c
+@@ -734,7 +734,7 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
+ int iov_idx = 0;
+ unsigned int iov_off = 0;
+
+- __bio_for_each_segment(bvec, bio, i, 0) {
++ bio_for_each_segment_all(bvec, bio, i) {
+ char *bv_addr = page_address(bvec->bv_page);
+ unsigned int bv_len = iovecs[i].bv_len;
+
+@@ -787,12 +787,22 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
+ int bio_uncopy_user(struct bio *bio)
+ {
+ struct bio_map_data *bmd = bio->bi_private;
+- int ret = 0;
++ struct bio_vec *bvec;
++ int ret = 0, i;
+
+- if (!bio_flagged(bio, BIO_NULL_MAPPED))
+- ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
+- bmd->nr_sgvecs, bio_data_dir(bio) == READ,
+- 0, bmd->is_our_pages);
++ if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
++ /*
++ * if we're in a workqueue, the request is orphaned, so
++ * don't copy into a random user address space, just free.
++ */
++ if (current->mm)
++ ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
++ bmd->nr_sgvecs, bio_data_dir(bio) == READ,
++ 0, bmd->is_our_pages);
++ else if (bmd->is_our_pages)
++ bio_for_each_segment_all(bvec, bio, i)
++ __free_page(bvec->bv_page);
++ }
+ bio_free_map_data(bmd);
+ bio_put(bio);
+ return ret;
+@@ -916,7 +926,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+ return bio;
+ cleanup:
+ if (!map_data)
+- bio_for_each_segment(bvec, bio, i)
++ bio_for_each_segment_all(bvec, bio, i)
+ __free_page(bvec->bv_page);
+
+ bio_put(bio);
+@@ -1130,7 +1140,7 @@ static void __bio_unmap_user(struct bio *bio)
+ /*
+ * make sure we dirty pages we wrote to
+ */
+- __bio_for_each_segment(bvec, bio, i, 0) {
++ bio_for_each_segment_all(bvec, bio, i) {
+ if (bio_data_dir(bio) == READ)
+ set_page_dirty_lock(bvec->bv_page);
+
+@@ -1236,7 +1246,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
+ int i;
+ char *p = bmd->sgvecs[0].iov_base;
+
+- __bio_for_each_segment(bvec, bio, i, 0) {
++ bio_for_each_segment_all(bvec, bio, i) {
+ char *addr = page_address(bvec->bv_page);
+ int len = bmd->iovecs[i].bv_len;
+
+@@ -1276,7 +1286,7 @@ struct bio *bio_copy_kern(struct request_queue *q, void *data, unsigned int len,
+ if (!reading) {
+ void *p = data;
+
+- bio_for_each_segment(bvec, bio, i) {
++ bio_for_each_segment_all(bvec, bio, i) {
+ char *addr = page_address(bvec->bv_page);
+
+ memcpy(addr, p, bvec->bv_len);
+@@ -1556,7 +1566,7 @@ sector_t bio_sector_offset(struct bio *bio, unsigned short index,
+ if (index >= bio->bi_idx)
+ index = bio->bi_vcnt - 1;
+
+- __bio_for_each_segment(bv, bio, i, 0) {
++ bio_for_each_segment_all(bv, bio, i) {
+ if (i == index) {
+ if (offset > bv->bv_offset)
+ sectors += (offset - bv->bv_offset) / sector_sz;
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index cdcd665..b4675bd 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -369,7 +369,7 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ if (blobptr + attrsize > blobend)
+ break;
+ if (type == NTLMSSP_AV_NB_DOMAIN_NAME) {
+- if (!attrsize)
++ if (!attrsize || attrsize >= CIFS_MAX_DOMAINNAME_LEN)
+ break;
+ if (!ses->domainName) {
+ ses->domainName =
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 2f3ff59..7b68088 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -38,6 +38,7 @@
+ #define MAX_TREE_SIZE (2 + MAX_SERVER_SIZE + 1 + MAX_SHARE_SIZE + 1)
+ #define MAX_SERVER_SIZE 15
+ #define MAX_SHARE_SIZE 80
++#define CIFS_MAX_DOMAINNAME_LEN 256 /* max domain name length */
+ #define MAX_USERNAME_SIZE 256 /* reasonable maximum for current servers */
+ #define MAX_PASSWORD_SIZE 512 /* max for windows seems to be 256 wide chars */
+
+diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
+index 4c37ed4..52a820a 100644
+--- a/fs/cifs/readdir.c
++++ b/fs/cifs/readdir.c
+@@ -96,6 +96,14 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
+ dput(dentry);
+ }
+
++ /*
++ * If we know that the inode will need to be revalidated immediately,
++ * then don't create a new dentry for it. We'll end up doing an on
++ * the wire call either way and this spares us an invalidation.
++ */
++ if (fattr->cf_flags & CIFS_FATTR_NEED_REVAL)
++ return NULL;
++
+ dentry = d_alloc(parent, name);
+ if (dentry == NULL)
+ return NULL;
+diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c
+index 2504809..d362626 100644
+--- a/fs/cifs/sess.c
++++ b/fs/cifs/sess.c
+@@ -198,7 +198,7 @@ static void unicode_domain_string(char **pbcc_area, struct cifs_ses *ses,
+ bytes_ret = 0;
+ } else
+ bytes_ret = cifs_strtoUCS((__le16 *) bcc_ptr, ses->domainName,
+- 256, nls_cp);
++ CIFS_MAX_DOMAINNAME_LEN, nls_cp);
+ bcc_ptr += 2 * bytes_ret;
+ bcc_ptr += 2; /* account for null terminator */
+
+@@ -256,8 +256,8 @@ static void ascii_ssetup_strings(char **pbcc_area, struct cifs_ses *ses,
+
+ /* copy domain */
+ if (ses->domainName != NULL) {
+- strncpy(bcc_ptr, ses->domainName, 256);
+- bcc_ptr += strnlen(ses->domainName, 256);
++ strncpy(bcc_ptr, ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
++ bcc_ptr += strnlen(ses->domainName, CIFS_MAX_DOMAINNAME_LEN);
+ } /* else we will send a null domain name
+ so the server will default to its own domain */
+ *bcc_ptr = 0;
+diff --git a/fs/exofs/ore.c b/fs/exofs/ore.c
+index 1585db1..26bb512 100644
+--- a/fs/exofs/ore.c
++++ b/fs/exofs/ore.c
+@@ -401,7 +401,7 @@ static void _clear_bio(struct bio *bio)
+ struct bio_vec *bv;
+ unsigned i;
+
+- __bio_for_each_segment(bv, bio, i, 0) {
++ bio_for_each_segment_all(bv, bio, i) {
+ unsigned this_count = bv->bv_len;
+
+ if (likely(PAGE_SIZE == this_count))
+diff --git a/fs/exofs/ore_raid.c b/fs/exofs/ore_raid.c
+index fff2070..2c64826 100644
+--- a/fs/exofs/ore_raid.c
++++ b/fs/exofs/ore_raid.c
+@@ -432,7 +432,7 @@ static void _mark_read4write_pages_uptodate(struct ore_io_state *ios, int ret)
+ if (!bio)
+ continue;
+
+- __bio_for_each_segment(bv, bio, i, 0) {
++ bio_for_each_segment_all(bv, bio, i) {
+ struct page *page = bv->bv_page;
+
+ SetPageUptodate(page);
+diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
+index aca1790..d0b8f98 100644
+--- a/fs/ext4/ext4_jbd2.c
++++ b/fs/ext4/ext4_jbd2.c
+@@ -109,10 +109,10 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
+
+ if (ext4_handle_valid(handle)) {
+ err = jbd2_journal_dirty_metadata(handle, bh);
+- if (err) {
+- /* Errors can only happen if there is a bug */
+- handle->h_err = err;
+- __ext4_journal_stop(where, line, handle);
++ /* Errors can only happen if there is a bug */
++ if (WARN_ON_ONCE(err)) {
++ ext4_journal_abort_handle(where, line, __func__, bh,
++ handle, err);
+ }
+ } else {
+ if (inode)
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 259e950..84f84bf 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -3372,7 +3372,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
+ }
+ if (test_opt(sb, DIOREAD_NOLOCK)) {
+ ext4_msg(sb, KERN_ERR, "can't mount with "
+- "both data=journal and delalloc");
++ "both data=journal and dioread_nolock");
+ goto failed_mount;
+ }
+ if (test_opt(sb, DELALLOC))
+@@ -4539,6 +4539,21 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
+ goto restore_opts;
+ }
+
++ if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) {
++ if (test_opt2(sb, EXPLICIT_DELALLOC)) {
++ ext4_msg(sb, KERN_ERR, "can't mount with "
++ "both data=journal and delalloc");
++ err = -EINVAL;
++ goto restore_opts;
++ }
++ if (test_opt(sb, DIOREAD_NOLOCK)) {
++ ext4_msg(sb, KERN_ERR, "can't mount with "
++ "both data=journal and dioread_nolock");
++ err = -EINVAL;
++ goto restore_opts;
++ }
++ }
++
+ if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED)
+ ext4_abort(sb, "Abort forced by user");
+
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index 9197a1b..9f7c758 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -3047,6 +3047,14 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+
+ dir_index = (u32) filp->f_pos;
+
++ /*
++ * NFSv4 reserves cookies 1 and 2 for . and .. so the value
++ * we return to the vfs is one greater than the one we use
++ * internally.
++ */
++ if (dir_index)
++ dir_index--;
++
+ if (dir_index > 1) {
+ struct dir_table_slot dirtab_slot;
+
+@@ -3086,7 +3094,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ if (p->header.flag & BT_INTERNAL) {
+ jfs_err("jfs_readdir: bad index table");
+ DT_PUTPAGE(mp);
+- filp->f_pos = -1;
++ filp->f_pos = DIREND;
+ return 0;
+ }
+ } else {
+@@ -3094,7 +3102,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ /*
+ * self "."
+ */
+- filp->f_pos = 0;
++ filp->f_pos = 1;
+ if (filldir(dirent, ".", 1, 0, ip->i_ino,
+ DT_DIR))
+ return 0;
+@@ -3102,7 +3110,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ /*
+ * parent ".."
+ */
+- filp->f_pos = 1;
++ filp->f_pos = 2;
+ if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR))
+ return 0;
+
+@@ -3123,24 +3131,25 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ /*
+ * Legacy filesystem - OS/2 & Linux JFS < 0.3.6
+ *
+- * pn = index = 0: First entry "."
+- * pn = 0; index = 1: Second entry ".."
++ * pn = 0; index = 1: First entry "."
++ * pn = 0; index = 2: Second entry ".."
+ * pn > 0: Real entries, pn=1 -> leftmost page
+ * pn = index = -1: No more entries
+ */
+ dtpos = filp->f_pos;
+- if (dtpos == 0) {
++ if (dtpos < 2) {
+ /* build "." entry */
+
++ filp->f_pos = 1;
+ if (filldir(dirent, ".", 1, filp->f_pos, ip->i_ino,
+ DT_DIR))
+ return 0;
+- dtoffset->index = 1;
++ dtoffset->index = 2;
+ filp->f_pos = dtpos;
+ }
+
+ if (dtoffset->pn == 0) {
+- if (dtoffset->index == 1) {
++ if (dtoffset->index == 2) {
+ /* build ".." entry */
+
+ if (filldir(dirent, "..", 2, filp->f_pos,
+@@ -3233,6 +3242,12 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ }
+ jfs_dirent->position = unique_pos++;
+ }
++ /*
++ * We add 1 to the index because we may
++ * use a value of 2 internally, and NFSv4
++ * doesn't like that.
++ */
++ jfs_dirent->position++;
+ } else {
+ jfs_dirent->position = dtpos;
+ len = min(d_namleft, DTLHDRDATALEN_LEGACY);
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 168cb93..3fde055 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -451,9 +451,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
+ args->csa_nrclists = ntohl(*p++);
+ args->csa_rclists = NULL;
+ if (args->csa_nrclists) {
+- args->csa_rclists = kmalloc(args->csa_nrclists *
+- sizeof(*args->csa_rclists),
+- GFP_KERNEL);
++ args->csa_rclists = kmalloc_array(args->csa_nrclists,
++ sizeof(*args->csa_rclists),
++ GFP_KERNEL);
+ if (unlikely(args->csa_rclists == NULL))
+ goto out;
+
+diff --git a/fs/nilfs2/segbuf.c b/fs/nilfs2/segbuf.c
+index 850a7c0..07a666a 100644
+--- a/fs/nilfs2/segbuf.c
++++ b/fs/nilfs2/segbuf.c
+@@ -345,8 +345,7 @@ static void nilfs_end_bio_write(struct bio *bio, int err)
+
+ if (err == -EOPNOTSUPP) {
+ set_bit(BIO_EOPNOTSUPP, &bio->bi_flags);
+- bio_put(bio);
+- /* to be detected by submit_seg_bio() */
++ /* to be detected by nilfs_segbuf_submit_bio() */
+ }
+
+ if (!uptodate)
+@@ -377,12 +376,12 @@ static int nilfs_segbuf_submit_bio(struct nilfs_segment_buffer *segbuf,
+ bio->bi_private = segbuf;
+ bio_get(bio);
+ submit_bio(mode, bio);
++ segbuf->sb_nbio++;
+ if (bio_flagged(bio, BIO_EOPNOTSUPP)) {
+ bio_put(bio);
+ err = -EOPNOTSUPP;
+ goto failed;
+ }
+- segbuf->sb_nbio++;
+ bio_put(bio);
+
+ wi->bio = NULL;
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 3efa725..ef1740d 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -604,7 +604,7 @@ const struct file_operations proc_clear_refs_operations = {
+ };
+
+ struct pagemapread {
+- int pos, len;
++ int pos, len; /* units: PM_ENTRY_BYTES, not bytes */
+ u64 *buffer;
+ };
+
+@@ -792,8 +792,8 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
+ if (!count)
+ goto out_task;
+
+- pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
+- pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
++ pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
++ pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY);
+ ret = -ENOMEM;
+ if (!pm.buffer)
+ goto out_task;
+diff --git a/include/linux/bio.h b/include/linux/bio.h
+index 847994a..e868554 100644
+--- a/include/linux/bio.h
++++ b/include/linux/bio.h
+@@ -135,16 +135,27 @@ static inline int bio_has_allocated_vec(struct bio *bio)
+ #define bio_io_error(bio) bio_endio((bio), -EIO)
+
+ /*
+- * drivers should not use the __ version unless they _really_ want to
+- * run through the entire bio and not just pending pieces
++ * drivers should not use the __ version unless they _really_ know what
++ * they're doing
+ */
+ #define __bio_for_each_segment(bvl, bio, i, start_idx) \
+ for (bvl = bio_iovec_idx((bio), (start_idx)), i = (start_idx); \
+ i < (bio)->bi_vcnt; \
+ bvl++, i++)
+
++/*
++ * drivers should _never_ use the all version - the bio may have been split
++ * before it got to the driver and the driver won't own all of it
++ */
++#define bio_for_each_segment_all(bvl, bio, i) \
++ for (i = 0; \
++ bvl = bio_iovec_idx((bio), (i)), i < (bio)->bi_vcnt; \
++ i++)
++
+ #define bio_for_each_segment(bvl, bio, i) \
+- __bio_for_each_segment(bvl, bio, i, (bio)->bi_idx)
++ for (i = (bio)->bi_idx; \
++ bvl = bio_iovec_idx((bio), (i)), i < (bio)->bi_vcnt; \
++ i++)
+
+ /*
+ * get a reference to a bio, so it won't disappear. the intended use is
+diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
+index c3da42d..82924bf 100644
+--- a/include/linux/ftrace_event.h
++++ b/include/linux/ftrace_event.h
+@@ -71,6 +71,8 @@ struct trace_iterator {
+ /* trace_seq for __print_flags() and __print_symbolic() etc. */
+ struct trace_seq tmp_seq;
+
++ cpumask_var_t started;
++
+ /* The below is zeroed out in pipe_read */
+ struct trace_seq seq;
+ struct trace_entry *ent;
+@@ -83,7 +85,7 @@ struct trace_iterator {
+ loff_t pos;
+ long idx;
+
+- cpumask_var_t started;
++ /* All new field here will be zeroed out in pipe_read */
+ };
+
+
+diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
+index 5b42f1b..de3a321 100644
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -297,6 +297,7 @@ struct mm_struct {
+ void (*unmap_area) (struct mm_struct *mm, unsigned long addr);
+ #endif
+ unsigned long mmap_base; /* base of mmap area */
++ unsigned long mmap_legacy_base; /* base of mmap area in bottom-up allocations */
+ unsigned long task_size; /* size of task vm space */
+ unsigned long cached_hole_size; /* if non-zero, the largest hole below free_area_cache */
+ unsigned long free_area_cache; /* first hole of size cached_hole_size or larger */
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index 573c809..a595dce 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -190,7 +190,7 @@ size_t ksize(const void *);
+ #endif
+
+ /**
+- * kcalloc - allocate memory for an array. The memory is set to zero.
++ * kmalloc_array - allocate memory for an array.
+ * @n: number of elements.
+ * @size: element size.
+ * @flags: the type of memory to allocate.
+@@ -240,11 +240,22 @@ size_t ksize(const void *);
+ * for general use, and so are not documented here. For a full list of
+ * potential flags, always refer to linux/gfp.h.
+ */
+-static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
++static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
+ {
+ if (size != 0 && n > ULONG_MAX / size)
+ return NULL;
+- return __kmalloc(n * size, flags | __GFP_ZERO);
++ return __kmalloc(n * size, flags);
++}
++
++/**
++ * kcalloc - allocate memory for an array. The memory is set to zero.
++ * @n: number of elements.
++ * @size: element size.
++ * @flags: the type of memory to allocate (see kmalloc).
++ */
++static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
++{
++ return kmalloc_array(n, size, flags | __GFP_ZERO);
+ }
+
+ #if !defined(CONFIG_NUMA) && !defined(CONFIG_SLOB)
+diff --git a/include/linux/wait.h b/include/linux/wait.h
+index bea7ad5..e007f76 100644
+--- a/include/linux/wait.h
++++ b/include/linux/wait.h
+@@ -530,6 +530,63 @@ do { \
+ ? 0 : __wait_event_interruptible_locked(wq, condition, 1, 1))
+
+
++#define __wait_event_interruptible_lock_irq_timeout(wq, condition, \
++ lock, ret) \
++do { \
++ DEFINE_WAIT(__wait); \
++ \
++ for (;;) { \
++ prepare_to_wait(&wq, &__wait, TASK_INTERRUPTIBLE); \
++ if (condition) \
++ break; \
++ if (signal_pending(current)) { \
++ ret = -ERESTARTSYS; \
++ break; \
++ } \
++ spin_unlock_irq(&lock); \
++ ret = schedule_timeout(ret); \
++ spin_lock_irq(&lock); \
++ if (!ret) \
++ break; \
++ } \
++ finish_wait(&wq, &__wait); \
++} while (0)
++
++/**
++ * wait_event_interruptible_lock_irq_timeout - sleep until a condition gets true or a timeout elapses.
++ * The condition is checked under the lock. This is expected
++ * to be called with the lock taken.
++ * @wq: the waitqueue to wait on
++ * @condition: a C expression for the event to wait for
++ * @lock: a locked spinlock_t, which will be released before schedule()
++ * and reacquired afterwards.
++ * @timeout: timeout, in jiffies
++ *
++ * The process is put to sleep (TASK_INTERRUPTIBLE) until the
++ * @condition evaluates to true or signal is received. The @condition is
++ * checked each time the waitqueue @wq is woken up.
++ *
++ * wake_up() has to be called after changing any variable that could
++ * change the result of the wait condition.
++ *
++ * This is supposed to be called while holding the lock. The lock is
++ * dropped before going to sleep and is reacquired afterwards.
++ *
++ * The function returns 0 if the @timeout elapsed, -ERESTARTSYS if it
++ * was interrupted by a signal, and the remaining jiffies otherwise
++ * if the condition evaluated to true before the timeout elapsed.
++ */
++#define wait_event_interruptible_lock_irq_timeout(wq, condition, lock, \
++ timeout) \
++({ \
++ int __ret = timeout; \
++ \
++ if (!(condition)) \
++ __wait_event_interruptible_lock_irq_timeout( \
++ wq, condition, lock, __ret); \
++ __ret; \
++})
++
+
+ #define __wait_event_killable(wq, condition, ret) \
+ do { \
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 8be9b746..5bbe443 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -900,6 +900,15 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
+ }
+
+ /*
++ * Initialize event state based on the perf_event_attr::disabled.
++ */
++static inline void perf_event__state_init(struct perf_event *event)
++{
++ event->state = event->attr.disabled ? PERF_EVENT_STATE_OFF :
++ PERF_EVENT_STATE_INACTIVE;
++}
++
++/*
+ * Called at perf_event creation and when events are attached/detached from a
+ * group.
+ */
+@@ -6050,8 +6059,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+ event->overflow_handler = overflow_handler;
+ event->overflow_handler_context = context;
+
+- if (attr->disabled)
+- event->state = PERF_EVENT_STATE_OFF;
++ perf_event__state_init(event);
+
+ pmu = NULL;
+
+@@ -6433,9 +6441,17 @@ SYSCALL_DEFINE5(perf_event_open,
+
+ mutex_lock(&gctx->mutex);
+ perf_remove_from_context(group_leader);
++
++ /*
++ * Removing from the context ends up with disabled
++ * event. What we want here is event in the initial
++ * startup state, ready to be add into new context.
++ */
++ perf_event__state_init(group_leader);
+ list_for_each_entry(sibling, &group_leader->sibling_list,
+ group_entry) {
+ perf_remove_from_context(sibling);
++ perf_event__state_init(sibling);
+ put_ctx(gctx);
+ }
+ mutex_unlock(&gctx->mutex);
+diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
+index 66e4576..59474c5 100644
+--- a/kernel/sched_fair.c
++++ b/kernel/sched_fair.c
+@@ -5033,7 +5033,7 @@ static unsigned int get_rr_interval_fair(struct rq *rq, struct task_struct *task
+ * idle runqueue:
+ */
+ if (rq->cfs.load.weight)
+- rr_interval = NS_TO_JIFFIES(sched_slice(&rq->cfs, se));
++ rr_interval = NS_TO_JIFFIES(sched_slice(cfs_rq_of(se), se));
+
+ return rr_interval;
+ }
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index a584ad9..ce1067f 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3375,6 +3375,7 @@ waitagain:
+ memset(&iter->seq, 0,
+ sizeof(struct trace_iterator) -
+ offsetof(struct trace_iterator, seq));
++ cpumask_clear(iter->started);
+ iter->pos = -1;
+
+ trace_event_read_lock();
+diff --git a/kernel/workqueue.c b/kernel/workqueue.c
+index 0ad2420..0bc9ff0 100644
+--- a/kernel/workqueue.c
++++ b/kernel/workqueue.c
+@@ -1920,6 +1920,15 @@ __acquires(&gcwq->lock)
+ dump_stack();
+ }
+
++ /*
++ * The following prevents a kworker from hogging CPU on !PREEMPT
++ * kernels, where a requeueing work item waiting for something to
++ * happen could deadlock with stop_machine as such work item could
++ * indefinitely requeue itself while all other CPUs are trapped in
++ * stop_machine.
++ */
++ cond_resched();
++
+ spin_lock_irq(&gcwq->lock);
+
+ /* clear cpu intensive status */
+diff --git a/mm/bounce.c b/mm/bounce.c
+index 4e9ae72..f71a3b34 100644
+--- a/mm/bounce.c
++++ b/mm/bounce.c
+@@ -132,7 +132,7 @@ static void bounce_end_io(struct bio *bio, mempool_t *pool, int err)
+ /*
+ * free up bounce indirect pages used
+ */
+- __bio_for_each_segment(bvec, bio, i, 0) {
++ bio_for_each_segment_all(bvec, bio, i) {
+ org_vec = bio_orig->bi_io_vec + i;
+ if (bvec->bv_page == org_vec->bv_page)
+ continue;
+diff --git a/mm/nommu.c b/mm/nommu.c
+index f0cd7ab..1db7971 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1825,6 +1825,16 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
+ }
+ EXPORT_SYMBOL(remap_pfn_range);
+
++int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
++{
++ unsigned long pfn = start >> PAGE_SHIFT;
++ unsigned long vm_len = vma->vm_end - vma->vm_start;
++
++ pfn += vma->vm_pgoff;
++ return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
++}
++EXPORT_SYMBOL(vm_iomap_memory);
++
+ int remap_vmalloc_range(struct vm_area_struct *vma, void *addr,
+ unsigned long pgoff)
+ {
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 5c028e2..b5afea2 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -5777,6 +5777,10 @@ __offline_isolated_pages(unsigned long start_pfn, unsigned long end_pfn)
+ zone->free_area[order].nr_free--;
+ __mod_zone_page_state(zone, NR_FREE_PAGES,
+ - (1UL << order));
++#ifdef CONFIG_HIGHMEM
++ if (PageHighMem(page))
++ totalhigh_pages -= 1 << order;
++#endif
+ for (i = 0; i < (1 << order); i++)
+ SetPageReserved((page+i));
+ pfn += (1 << order);
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 5485077..739b073 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -32,6 +32,8 @@ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
++static int tcp_syn_retries_min = 1;
++static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
+ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+
+@@ -231,7 +233,9 @@ static struct ctl_table ipv4_table[] = {
+ .data = &sysctl_tcp_syn_retries,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &tcp_syn_retries_min,
++ .extra2 = &tcp_syn_retries_max
+ },
+ {
+ .procname = "tcp_synack_retries",
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index 449a918..f5af259 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -257,10 +257,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
+ struct mr6_table *mrt, *next;
+
++ rtnl_lock();
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+ list_del(&mrt->list);
+ ip6mr_free_table(mrt);
+ }
++ rtnl_unlock();
+ fib_rules_unregister(net->ipv6.mr6_rules_ops);
+ }
+ #else
+@@ -287,7 +289,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
+
+ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
++ rtnl_lock();
+ ip6mr_free_table(net->ipv6.mrt6);
++ net->ipv6.mrt6 = NULL;
++ rtnl_unlock();
+ }
+ #endif
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 6fefdfc..8dbdb8e 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2073,6 +2073,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
+ pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
+ }
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
+ pol->sadb_x_policy_priority = xp->priority;
+
+@@ -2686,6 +2687,7 @@ static int key_notify_policy_flush(const struct km_event *c)
+ hdr->sadb_msg_pid = c->pid;
+ hdr->sadb_msg_version = PF_KEY_V2;
+ hdr->sadb_msg_errno = (uint8_t) 0;
++ hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ hdr->sadb_msg_reserved = 0;
+ pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+@@ -3108,7 +3110,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
++ pol->sadb_x_policy_priority = xp->priority;
+
+ /* Set sadb_comb's. */
+ if (x->id.proto == IPPROTO_AH)
+@@ -3496,6 +3500,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = 0;
+ pol->sadb_x_policy_priority = 0;
+
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index cd6cbdb..7d882fc 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -821,8 +821,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
+ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
+ struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
+
+- /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
+- if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
++ /*
++ * Drop duplicate 802.11 retransmissions
++ * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
++ */
++ if (rx->skb->len >= 24 && rx->sta &&
++ !ieee80211_is_ctl(hdr->frame_control) &&
++ !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
++ !is_multicast_ether_addr(hdr->addr1)) {
+ if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
+ rx->sta->last_seq_ctrl[rx->seqno_idx] ==
+ hdr->seq_ctrl)) {
+diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
+index e25e490..6e38ef0 100644
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -606,6 +606,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
+ struct sockaddr_atmpvc pvc;
+ int state;
+
++ memset(&pvc, 0, sizeof(pvc));
+ pvc.sap_family = AF_ATMPVC;
+ pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
+ pvc.sap_addr.vpi = flow->vcc->vpi;
+diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
+index b7cddb9..7f59944 100644
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1467,6 +1467,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
+ unsigned char *b = skb_tail_pointer(skb);
+ struct tc_cbq_wrropt opt;
+
++ memset(&opt, 0, sizeof(opt));
+ opt.flags = 0;
+ opt.allot = cl->allot;
+ opt.priority = cl->priority + 1;
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 96eb168..3dd7207 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -205,6 +205,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
+ */
+ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ {
++ memset(q, 0, sizeof(struct sctp_outq));
++
+ q->asoc = asoc;
+ INIT_LIST_HEAD(&q->out_chunk_list);
+ INIT_LIST_HEAD(&q->control_chunk_list);
+@@ -212,13 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
+ INIT_LIST_HEAD(&q->sacked);
+ INIT_LIST_HEAD(&q->abandoned);
+
+- q->fast_rtx = 0;
+- q->outstanding_bytes = 0;
+ q->empty = 1;
+- q->cork = 0;
+-
+- q->malloced = 0;
+- q->out_qlen = 0;
+ }
+
+ /* Free the outqueue structure and any related pending chunks.
+diff --git a/net/sunrpc/auth_gss/gss_krb5_wrap.c b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+index 2763e3e..38f388c 100644
+--- a/net/sunrpc/auth_gss/gss_krb5_wrap.c
++++ b/net/sunrpc/auth_gss/gss_krb5_wrap.c
+@@ -82,9 +82,9 @@ gss_krb5_remove_padding(struct xdr_buf *buf, int blocksize)
+ >>PAGE_CACHE_SHIFT;
+ unsigned int offset = (buf->page_base + len - 1)
+ & (PAGE_CACHE_SIZE - 1);
+- ptr = kmap_atomic(buf->pages[last], KM_USER0);
++ ptr = kmap_atomic(buf->pages[last]);
+ pad = *(ptr + offset);
+- kunmap_atomic(ptr, KM_USER0);
++ kunmap_atomic(ptr);
+ goto out;
+ } else
+ len -= buf->page_len;
+diff --git a/net/sunrpc/socklib.c b/net/sunrpc/socklib.c
+index 145e6784..0a648c5 100644
+--- a/net/sunrpc/socklib.c
++++ b/net/sunrpc/socklib.c
+@@ -114,7 +114,7 @@ ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, struct
+ }
+
+ len = PAGE_CACHE_SIZE;
+- kaddr = kmap_atomic(*ppage, KM_SKB_SUNRPC_DATA);
++ kaddr = kmap_atomic(*ppage);
+ if (base) {
+ len -= base;
+ if (pglen < len)
+@@ -127,7 +127,7 @@ ssize_t xdr_partial_copy_from_skb(struct xdr_buf *xdr, unsigned int base, struct
+ ret = copy_actor(desc, kaddr, len);
+ }
+ flush_dcache_page(*ppage);
+- kunmap_atomic(kaddr, KM_SKB_SUNRPC_DATA);
++ kunmap_atomic(kaddr);
+ copied += ret;
+ if (ret != len || !desc->count)
+ goto out;
+diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
+index 593f4c6..6997cdd 100644
+--- a/net/sunrpc/xdr.c
++++ b/net/sunrpc/xdr.c
+@@ -122,9 +122,9 @@ xdr_terminate_string(struct xdr_buf *buf, const u32 len)
+ {
+ char *kaddr;
+
+- kaddr = kmap_atomic(buf->pages[0], KM_USER0);
++ kaddr = kmap_atomic(buf->pages[0]);
+ kaddr[buf->page_base + len] = '\0';
+- kunmap_atomic(kaddr, KM_USER0);
++ kunmap_atomic(kaddr);
+ }
+ EXPORT_SYMBOL_GPL(xdr_terminate_string);
+
+@@ -232,12 +232,15 @@ _shift_data_right_pages(struct page **pages, size_t pgto_base,
+ pgto_base -= copy;
+ pgfrom_base -= copy;
+
+- vto = kmap_atomic(*pgto, KM_USER0);
+- vfrom = kmap_atomic(*pgfrom, KM_USER1);
+- memmove(vto + pgto_base, vfrom + pgfrom_base, copy);
++ vto = kmap_atomic(*pgto);
++ if (*pgto != *pgfrom) {
++ vfrom = kmap_atomic(*pgfrom);
++ memcpy(vto + pgto_base, vfrom + pgfrom_base, copy);
++ kunmap_atomic(vfrom);
++ } else
++ memmove(vto + pgto_base, vto + pgfrom_base, copy);
+ flush_dcache_page(*pgto);
+- kunmap_atomic(vfrom, KM_USER1);
+- kunmap_atomic(vto, KM_USER0);
++ kunmap_atomic(vto);
+
+ } while ((len -= copy) != 0);
+ }
+@@ -267,9 +270,9 @@ _copy_to_pages(struct page **pages, size_t pgbase, const char *p, size_t len)
+ if (copy > len)
+ copy = len;
+
+- vto = kmap_atomic(*pgto, KM_USER0);
++ vto = kmap_atomic(*pgto);
+ memcpy(vto + pgbase, p, copy);
+- kunmap_atomic(vto, KM_USER0);
++ kunmap_atomic(vto);
+
+ len -= copy;
+ if (len == 0)
+@@ -311,9 +314,9 @@ _copy_from_pages(char *p, struct page **pages, size_t pgbase, size_t len)
+ if (copy > len)
+ copy = len;
+
+- vfrom = kmap_atomic(*pgfrom, KM_USER0);
++ vfrom = kmap_atomic(*pgfrom);
+ memcpy(p, vfrom + pgbase, copy);
+- kunmap_atomic(vfrom, KM_USER0);
++ kunmap_atomic(vfrom);
+
+ pgbase += copy;
+ if (pgbase == PAGE_CACHE_SIZE) {
+diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c
+index 554d081..1776e57 100644
+--- a/net/sunrpc/xprtrdma/rpc_rdma.c
++++ b/net/sunrpc/xprtrdma/rpc_rdma.c
+@@ -338,9 +338,9 @@ rpcrdma_inline_pullup(struct rpc_rqst *rqst, int pad)
+ curlen = copy_len;
+ dprintk("RPC: %s: page %d destp 0x%p len %d curlen %d\n",
+ __func__, i, destp, copy_len, curlen);
+- srcp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA);
++ srcp = kmap_atomic(ppages[i]);
+ memcpy(destp, srcp+page_base, curlen);
+- kunmap_atomic(srcp, KM_SKB_SUNRPC_DATA);
++ kunmap_atomic(srcp);
+ rqst->rq_svec[0].iov_len += curlen;
+ destp += curlen;
+ copy_len -= curlen;
+@@ -639,10 +639,10 @@ rpcrdma_inline_fixup(struct rpc_rqst *rqst, char *srcp, int copy_len, int pad)
+ dprintk("RPC: %s: page %d"
+ " srcp 0x%p len %d curlen %d\n",
+ __func__, i, srcp, copy_len, curlen);
+- destp = kmap_atomic(ppages[i], KM_SKB_SUNRPC_DATA);
++ destp = kmap_atomic(ppages[i]);
+ memcpy(destp + page_base, srcp, curlen);
+ flush_dcache_page(ppages[i]);
+- kunmap_atomic(destp, KM_SKB_SUNRPC_DATA);
++ kunmap_atomic(destp);
+ srcp += curlen;
+ copy_len -= curlen;
+ if (copy_len == 0)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index c06c365..6d4d263 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4826,12 +4826,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
+
+ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ {
++ struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+- genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
++ nl80211_testmode_mcgrp.id, gfp);
+ }
+ EXPORT_SYMBOL(cfg80211_testmode_event);
+ #endif
+@@ -7282,7 +7284,8 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
+ return;
+ }
+
+- genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
++ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
++ nl80211_mlme_mcgrp.id, gfp);
+ return;
+
+ nla_put_failure:
+diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
+index cef813d..ed726d1 100644
+--- a/sound/i2c/other/ak4xxx-adda.c
++++ b/sound/i2c/other/ak4xxx-adda.c
+@@ -571,7 +571,7 @@ static int ak4xxx_capture_source_info(struct snd_kcontrol *kcontrol,
+ struct snd_akm4xxx *ak = snd_kcontrol_chip(kcontrol);
+ int mixer_ch = AK_GET_SHIFT(kcontrol->private_value);
+ const char **input_names;
+- int num_names, idx;
++ unsigned int num_names, idx;
+
+ num_names = ak4xxx_capture_num_inputs(ak, mixer_ch);
+ if (!num_names)
+diff --git a/sound/isa/opti9xx/opti92x-ad1848.c b/sound/isa/opti9xx/opti92x-ad1848.c
+index 97871be..cba84ef 100644
+--- a/sound/isa/opti9xx/opti92x-ad1848.c
++++ b/sound/isa/opti9xx/opti92x-ad1848.c
+@@ -173,11 +173,7 @@ MODULE_DEVICE_TABLE(pnp_card, snd_opti9xx_pnpids);
+
+ #endif /* CONFIG_PNP */
+
+-#ifdef OPTi93X
+-#define DEV_NAME "opti93x"
+-#else
+-#define DEV_NAME "opti92x"
+-#endif
++#define DEV_NAME KBUILD_MODNAME
+
+ static char * snd_opti9xx_names[] = {
+ "unknown",
+@@ -1126,7 +1122,7 @@ static void __devexit snd_opti9xx_pnp_remove(struct pnp_card_link * pcard)
+
+ static struct pnp_card_driver opti9xx_pnpc_driver = {
+ .flags = PNP_DRIVER_RES_DISABLE,
+- .name = "opti9xx",
++ .name = DEV_NAME,
+ .id_table = snd_opti9xx_pnpids,
+ .probe = snd_opti9xx_pnp_probe,
+ .remove = __devexit_p(snd_opti9xx_pnp_remove),
+diff --git a/sound/oss/Kconfig b/sound/oss/Kconfig
+index 6c9e8e8..1fc28f5 100644
+--- a/sound/oss/Kconfig
++++ b/sound/oss/Kconfig
+@@ -250,6 +250,7 @@ config MSND_FIFOSIZE
+ menuconfig SOUND_OSS
+ tristate "OSS sound modules"
+ depends on ISA_DMA_API && VIRT_TO_BUS
++ depends on !GENERIC_ISA_DMA_SUPPORT_BROKEN
+ help
+ OSS is the Open Sound System suite of sound card drivers. They make
+ sound programming easier since they provide a common API. Say Y or
+diff --git a/sound/usb/6fire/comm.c b/sound/usb/6fire/comm.c
+index c994daa..af6ec8d 100644
+--- a/sound/usb/6fire/comm.c
++++ b/sound/usb/6fire/comm.c
+@@ -111,19 +111,37 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev)
+ static int usb6fire_comm_write8(struct comm_runtime *rt, u8 request,
+ u8 reg, u8 value)
+ {
+- u8 buffer[13]; /* 13: maximum length of message */
++ u8 *buffer;
++ int ret;
++
++ /* 13: maximum length of message */
++ buffer = kmalloc(13, GFP_KERNEL);
++ if (!buffer)
++ return -ENOMEM;
+
+ usb6fire_comm_init_buffer(buffer, 0x00, request, reg, value, 0x00);
+- return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++ ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++
++ kfree(buffer);
++ return ret;
+ }
+
+ static int usb6fire_comm_write16(struct comm_runtime *rt, u8 request,
+ u8 reg, u8 vl, u8 vh)
+ {
+- u8 buffer[13]; /* 13: maximum length of message */
++ u8 *buffer;
++ int ret;
++
++ /* 13: maximum length of message */
++ buffer = kmalloc(13, GFP_KERNEL);
++ if (!buffer)
++ return -ENOMEM;
+
+ usb6fire_comm_init_buffer(buffer, 0x00, request, reg, vl, vh);
+- return usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++ ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);
++
++ kfree(buffer);
++ return ret;
+ }
+
+ int __devinit usb6fire_comm_init(struct sfire_chip *chip)
+@@ -136,6 +154,12 @@ int __devinit usb6fire_comm_init(struct sfire_chip *chip)
+ if (!rt)
+ return -ENOMEM;
+
++ rt->receiver_buffer = kzalloc(COMM_RECEIVER_BUFSIZE, GFP_KERNEL);
++ if (!rt->receiver_buffer) {
++ kfree(rt);
++ return -ENOMEM;
++ }
++
+ rt->serial = 1;
+ rt->chip = chip;
+ usb_init_urb(urb);
+@@ -153,6 +177,7 @@ int __devinit usb6fire_comm_init(struct sfire_chip *chip)
+ urb->interval = 1;
+ ret = usb_submit_urb(urb, GFP_KERNEL);
+ if (ret < 0) {
++ kfree(rt->receiver_buffer);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX "cannot create comm data receiver.");
+ return ret;
+@@ -171,6 +196,9 @@ void usb6fire_comm_abort(struct sfire_chip *chip)
+
+ void usb6fire_comm_destroy(struct sfire_chip *chip)
+ {
+- kfree(chip->comm);
++ struct comm_runtime *rt = chip->comm;
++
++ kfree(rt->receiver_buffer);
++ kfree(rt);
+ chip->comm = NULL;
+ }
+diff --git a/sound/usb/6fire/comm.h b/sound/usb/6fire/comm.h
+index edc5dc8..19e2f92 100644
+--- a/sound/usb/6fire/comm.h
++++ b/sound/usb/6fire/comm.h
+@@ -25,7 +25,7 @@ struct comm_runtime {
+ struct sfire_chip *chip;
+
+ struct urb receiver;
+- u8 receiver_buffer[COMM_RECEIVER_BUFSIZE];
++ u8 *receiver_buffer;
+
+ u8 serial; /* urb serial */
+
+diff --git a/sound/usb/6fire/midi.c b/sound/usb/6fire/midi.c
+index 13f4509..8283c5d 100644
+--- a/sound/usb/6fire/midi.c
++++ b/sound/usb/6fire/midi.c
+@@ -20,6 +20,10 @@
+ #include "chip.h"
+ #include "comm.h"
+
++enum {
++ MIDI_BUFSIZE = 64
++};
++
+ static void usb6fire_midi_out_handler(struct urb *urb)
+ {
+ struct midi_runtime *rt = urb->context;
+@@ -157,6 +161,12 @@ int __devinit usb6fire_midi_init(struct sfire_chip *chip)
+ if (!rt)
+ return -ENOMEM;
+
++ rt->out_buffer = kzalloc(MIDI_BUFSIZE, GFP_KERNEL);
++ if (!rt->out_buffer) {
++ kfree(rt);
++ return -ENOMEM;
++ }
++
+ rt->chip = chip;
+ rt->in_received = usb6fire_midi_in_received;
+ rt->out_buffer[0] = 0x80; /* 'send midi' command */
+@@ -170,6 +180,7 @@ int __devinit usb6fire_midi_init(struct sfire_chip *chip)
+
+ ret = snd_rawmidi_new(chip->card, "6FireUSB", 0, 1, 1, &rt->instance);
+ if (ret < 0) {
++ kfree(rt->out_buffer);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX "unable to create midi.\n");
+ return ret;
+@@ -198,6 +209,9 @@ void usb6fire_midi_abort(struct sfire_chip *chip)
+
+ void usb6fire_midi_destroy(struct sfire_chip *chip)
+ {
+- kfree(chip->midi);
++ struct midi_runtime *rt = chip->midi;
++
++ kfree(rt->out_buffer);
++ kfree(rt);
+ chip->midi = NULL;
+ }
+diff --git a/sound/usb/6fire/midi.h b/sound/usb/6fire/midi.h
+index 97a7bf6..7f8f448 100644
+--- a/sound/usb/6fire/midi.h
++++ b/sound/usb/6fire/midi.h
+@@ -17,10 +17,6 @@
+
+ #include "common.h"
+
+-enum {
+- MIDI_BUFSIZE = 64
+-};
+-
+ struct midi_runtime {
+ struct sfire_chip *chip;
+ struct snd_rawmidi *instance;
+@@ -33,7 +29,7 @@ struct midi_runtime {
+ struct snd_rawmidi_substream *out;
+ struct urb out_urb;
+ u8 out_serial; /* serial number of out packet */
+- u8 out_buffer[MIDI_BUFSIZE];
++ u8 *out_buffer;
+ int buffer_offset;
+
+ void (*in_received)(struct midi_runtime *rt, u8 *data, int length);
+diff --git a/sound/usb/6fire/pcm.c b/sound/usb/6fire/pcm.c
+index 888a7c7..8609c74 100644
+--- a/sound/usb/6fire/pcm.c
++++ b/sound/usb/6fire/pcm.c
+@@ -579,6 +579,33 @@ static void __devinit usb6fire_pcm_init_urb(struct pcm_urb *urb,
+ urb->instance.number_of_packets = PCM_N_PACKETS_PER_URB;
+ }
+
++static int usb6fire_pcm_buffers_init(struct pcm_runtime *rt)
++{
++ int i;
++
++ for (i = 0; i < PCM_N_URBS; i++) {
++ rt->out_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB
++ * PCM_MAX_PACKET_SIZE, GFP_KERNEL);
++ if (!rt->out_urbs[i].buffer)
++ return -ENOMEM;
++ rt->in_urbs[i].buffer = kzalloc(PCM_N_PACKETS_PER_URB
++ * PCM_MAX_PACKET_SIZE, GFP_KERNEL);
++ if (!rt->in_urbs[i].buffer)
++ return -ENOMEM;
++ }
++ return 0;
++}
++
++static void usb6fire_pcm_buffers_destroy(struct pcm_runtime *rt)
++{
++ int i;
++
++ for (i = 0; i < PCM_N_URBS; i++) {
++ kfree(rt->out_urbs[i].buffer);
++ kfree(rt->in_urbs[i].buffer);
++ }
++}
++
+ int __devinit usb6fire_pcm_init(struct sfire_chip *chip)
+ {
+ int i;
+@@ -590,6 +617,13 @@ int __devinit usb6fire_pcm_init(struct sfire_chip *chip)
+ if (!rt)
+ return -ENOMEM;
+
++ ret = usb6fire_pcm_buffers_init(rt);
++ if (ret) {
++ usb6fire_pcm_buffers_destroy(rt);
++ kfree(rt);
++ return ret;
++ }
++
+ rt->chip = chip;
+ rt->stream_state = STREAM_DISABLED;
+ rt->rate = ARRAY_SIZE(rates);
+@@ -611,6 +645,7 @@ int __devinit usb6fire_pcm_init(struct sfire_chip *chip)
+
+ ret = snd_pcm_new(chip->card, "DMX6FireUSB", 0, 1, 1, &pcm);
+ if (ret < 0) {
++ usb6fire_pcm_buffers_destroy(rt);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX "cannot create pcm instance.\n");
+ return ret;
+@@ -626,6 +661,7 @@ int __devinit usb6fire_pcm_init(struct sfire_chip *chip)
+ snd_dma_continuous_data(GFP_KERNEL),
+ MAX_BUFSIZE, MAX_BUFSIZE);
+ if (ret) {
++ usb6fire_pcm_buffers_destroy(rt);
+ kfree(rt);
+ snd_printk(KERN_ERR PREFIX
+ "error preallocating pcm buffers.\n");
+@@ -670,6 +706,9 @@ void usb6fire_pcm_abort(struct sfire_chip *chip)
+
+ void usb6fire_pcm_destroy(struct sfire_chip *chip)
+ {
+- kfree(chip->pcm);
++ struct pcm_runtime *rt = chip->pcm;
++
++ usb6fire_pcm_buffers_destroy(rt);
++ kfree(rt);
+ chip->pcm = NULL;
+ }
+diff --git a/sound/usb/6fire/pcm.h b/sound/usb/6fire/pcm.h
+index 2bee813..a8e8899 100644
+--- a/sound/usb/6fire/pcm.h
++++ b/sound/usb/6fire/pcm.h
+@@ -33,7 +33,7 @@ struct pcm_urb {
+ struct urb instance;
+ struct usb_iso_packet_descriptor packets[PCM_N_PACKETS_PER_URB];
+ /* END DO NOT SEPARATE */
+- u8 buffer[PCM_N_PACKETS_PER_URB * PCM_MAX_PACKET_SIZE];
++ u8 *buffer;
+
+ struct pcm_urb *peer;
+ };
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index aeb26eb..41b9fe0 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -720,8 +720,20 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
+ return 0;
+ }
+ case UAC1_PROCESSING_UNIT:
+- case UAC1_EXTENSION_UNIT: {
++ case UAC1_EXTENSION_UNIT:
++ /* UAC2_PROCESSING_UNIT_V2 */
++ /* UAC2_EFFECT_UNIT */
++ case UAC2_EXTENSION_UNIT_V2: {
+ struct uac_processing_unit_descriptor *d = p1;
++
++ if (state->mixer->protocol == UAC_VERSION_2 &&
++ hdr[2] == UAC2_EFFECT_UNIT) {
++ /* UAC2/UAC1 unit IDs overlap here in an
++ * uncompatible way. Ignore this unit for now.
++ */
++ return 0;
++ }
++
+ if (d->bNrInPins) {
+ id = d->baSourceID[0];
+ break; /* continue to parse */
+@@ -1956,6 +1968,8 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
+ return parse_audio_extension_unit(state, unitid, p1);
+ else /* UAC_VERSION_2 */
+ return parse_audio_processing_unit(state, unitid, p1);
++ case UAC2_EXTENSION_UNIT_V2:
++ return parse_audio_extension_unit(state, unitid, p1);
+ default:
+ snd_printk(KERN_ERR "usbaudio: unit %u: unexpected type 0x%02x\n", unitid, p1[2]);
+ return -EINVAL;
+diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
+index 78284b1..42dffa0 100644
+--- a/tools/perf/util/map.c
++++ b/tools/perf/util/map.c
+@@ -15,7 +15,8 @@ const char *map_type__name[MAP__NR_TYPES] = {
+
+ static inline int is_anon_memory(const char *filename)
+ {
+- return strcmp(filename, "//anon") == 0;
++ return !strcmp(filename, "//anon") ||
++ !strcmp(filename, "/anon_hugepage (deleted)");
+ }
+
+ static inline int is_no_dso_memory(const char *filename)
diff --git a/3.2.50/4420_grsecurity-2.9.1-3.2.50-201309081951.patch b/3.2.51/4420_grsecurity-2.9.1-3.2.51-201309101928.patch
similarity index 99%
rename from 3.2.50/4420_grsecurity-2.9.1-3.2.50-201309081951.patch
rename to 3.2.51/4420_grsecurity-2.9.1-3.2.51-201309101928.patch
index 5b28ef7..04ff2b3 100644
--- a/3.2.50/4420_grsecurity-2.9.1-3.2.50-201309081951.patch
+++ b/3.2.51/4420_grsecurity-2.9.1-3.2.51-201309101928.patch
@@ -270,7 +270,7 @@ index 88fd7f5..b318a78 100644
==============================================================
diff --git a/Makefile b/Makefile
-index 0799e8e..71239c7 100644
+index 0f11936..8f1b567 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1748,24 +1748,6 @@ index 1e9be5d..4e0f470 100644
return __vmalloc_node_range(size, 1, MODULES_VADDR, MODULES_END,
GFP_KERNEL, PAGE_KERNEL_EXEC, -1,
__builtin_return_address(0));
-diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
-index 778d248..692233d 100644
---- a/arch/arm/kernel/perf_event.c
-+++ b/arch/arm/kernel/perf_event.c
-@@ -116,7 +116,12 @@ armpmu_map_cache_event(const unsigned (*cache_map)
- static int
- armpmu_map_event(const unsigned (*event_map)[PERF_COUNT_HW_MAX], u64 config)
- {
-- int mapping = (*event_map)[config];
-+ int mapping;
-+
-+ if (config >= PERF_COUNT_HW_MAX)
-+ return -ENOENT;
-+
-+ mapping = (*event_map)[config];
- return mapping == HW_OP_UNSUPPORTED ? -ENOENT : mapping;
- }
-
diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index e68d251..c5bac2c 100644
--- a/arch/arm/kernel/process.c
@@ -4383,10 +4365,10 @@ index d4a7f64..451de1c 100644
return (vm_flags & VM_SAO) ? __pgprot(_PAGE_SAO) : __pgprot(0);
}
diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h
-index dd9c4fd..a2ced87 100644
+index 5b0bde2..9f83e1a 100644
--- a/arch/powerpc/include/asm/page.h
+++ b/arch/powerpc/include/asm/page.h
-@@ -141,8 +141,9 @@ extern phys_addr_t kernstart_addr;
+@@ -151,8 +151,9 @@ extern phys_addr_t kernstart_addr;
* and needs to be executable. This means the whole heap ends
* up being executable.
*/
@@ -4398,7 +4380,7 @@ index dd9c4fd..a2ced87 100644
#define VM_DATA_DEFAULT_FLAGS64 (VM_READ | VM_WRITE | \
VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-@@ -170,6 +171,9 @@ extern phys_addr_t kernstart_addr;
+@@ -180,6 +181,9 @@ extern phys_addr_t kernstart_addr;
#define is_kernel_addr(x) ((x) >= PAGE_OFFSET)
#endif
@@ -5905,18 +5887,6 @@ index afeb710..8da5c79 100644
bottomup:
/*
-diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index f210d51..87537e2 100644
---- a/arch/sparc/Kconfig
-+++ b/arch/sparc/Kconfig
-@@ -31,6 +31,7 @@ config SPARC
-
- config SPARC32
- def_bool !64BIT
-+ select GENERIC_ATOMIC64
-
- config SPARC64
- def_bool 64BIT
diff --git a/arch/sparc/Makefile b/arch/sparc/Makefile
index eddcfb3..b117d90 100644
--- a/arch/sparc/Makefile
@@ -5931,7 +5901,7 @@ index eddcfb3..b117d90 100644
VMLINUX_MAIN += $(drivers-y) $(net-y)
diff --git a/arch/sparc/include/asm/atomic_32.h b/arch/sparc/include/asm/atomic_32.h
-index 5c3c8b6..ba822fa 100644
+index 07dd35e..2c6f765 100644
--- a/arch/sparc/include/asm/atomic_32.h
+++ b/arch/sparc/include/asm/atomic_32.h
@@ -13,6 +13,8 @@
@@ -5942,7 +5912,7 @@ index 5c3c8b6..ba822fa 100644
+
#ifdef __KERNEL__
- #include <asm/system.h>
+ #include <asm-generic/atomic64.h>
diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h
index 9f421df..b81fc12 100644
--- a/arch/sparc/include/asm/atomic_64.h
@@ -7407,7 +7377,7 @@ index eb1624b..55100de 100644
MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
-index a3fc437..fea9957 100644
+index 4961516..f82ff86 100644
--- a/arch/sparc/lib/Makefile
+++ b/arch/sparc/lib/Makefile
@@ -2,7 +2,7 @@
@@ -21604,7 +21574,7 @@ index 0b0cb5f..560d0df 100644
+ return addr;
}
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
-index 0514890..8efa56b 100644
+index cdb2fc9..a7264e0 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -95,8 +95,8 @@ out:
@@ -21622,8 +21592,8 @@ index 0514890..8efa56b 100644
*begin = new_begin;
}
} else {
-- *begin = TASK_UNMAPPED_BASE;
-+ *begin = mm->mmap_base;
+- *begin = current->mm->mmap_legacy_base;
++ *begin = mm->mmap_legacy_base;
*end = TASK_SIZE;
}
}
@@ -27579,7 +27549,7 @@ index d87dd6d..bf3fa66 100644
pte = kmemcheck_pte_lookup(address);
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 845df68..1d8d29f 100644
+index 5c1ae28..45f4ac9 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -52,7 +52,7 @@ static unsigned int stack_maxrandom_size(void)
@@ -27637,32 +27607,24 @@ index 845df68..1d8d29f 100644
return TASK_UNMAPPED_BASE + mmap_rnd();
}
-@@ -113,11 +126,23 @@ static unsigned long mmap_legacy_base(void)
+@@ -112,8 +125,15 @@ static unsigned long mmap_legacy_base(void)
+ */
void arch_pick_mmap_layout(struct mm_struct *mm)
{
- if (mmap_is_legacy()) {
-- mm->mmap_base = mmap_legacy_base();
-+ mm->mmap_base = mmap_legacy_base(mm);
+- mm->mmap_legacy_base = mmap_legacy_base();
+- mm->mmap_base = mmap_base();
++ mm->mmap_legacy_base = mmap_legacy_base(mm);
++ mm->mmap_base = mmap_base(mm);
+
+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base += mm->delta_mmap;
-+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area;
- mm->unmap_area = arch_unmap_area;
- } else {
-- mm->mmap_base = mmap_base();
-+ mm->mmap_base = mmap_base(mm);
-+
-+#ifdef CONFIG_PAX_RANDMMAP
-+ if (mm->pax_flags & MF_PAX_RANDMMAP)
-+ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++ if (mm->pax_flags & MF_PAX_RANDMMAP) {
++ mm->mmap_legacy_base += mm->delta_mmap;
++ mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
++ }
+#endif
-+
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- mm->unmap_area = arch_unmap_area_topdown;
- }
+
+ if (mmap_is_legacy()) {
+ mm->mmap_base = mm->mmap_legacy_base;
diff --git a/arch/x86/mm/mmio-mod.c b/arch/x86/mm/mmio-mod.c
index de54b9b..935281f 100644
--- a/arch/x86/mm/mmio-mod.c
@@ -33200,10 +33162,10 @@ index 0636520..169c1d0 100644
acpi_os_unmap_memory(virt, len);
return 0;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index d5ae736..67d8598 100644
+index c68b8ad..ef7a702 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
-@@ -567,7 +567,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
+@@ -570,7 +570,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
if (to_user) {
ssize_t ret;
@@ -33212,7 +33174,7 @@ index d5ae736..67d8598 100644
if (ret)
return -EFAULT;
} else {
-@@ -666,7 +666,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
+@@ -673,7 +673,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
if (!port_has_data(port) && !port->host_connected)
return 0;
@@ -34527,10 +34489,10 @@ index ca67338..0003ba7 100644
return can_switch;
}
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 144d37c..bf1110f 100644
+index 61274bf..72cb4a2 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -320,7 +320,7 @@ typedef struct drm_i915_private {
+@@ -321,7 +321,7 @@ typedef struct drm_i915_private {
int current_page;
int page_flipping;
@@ -34539,7 +34501,7 @@ index 144d37c..bf1110f 100644
/* protects the irq masks */
spinlock_t irq_lock;
-@@ -897,7 +897,7 @@ struct drm_i915_gem_object {
+@@ -898,7 +898,7 @@ struct drm_i915_gem_object {
* will be page flipped away on the next vblank. When it
* reaches 0, dev_priv->pending_flip_queue will be woken up.
*/
@@ -34548,7 +34510,7 @@ index 144d37c..bf1110f 100644
};
#define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
-@@ -1274,7 +1274,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
+@@ -1275,7 +1275,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
extern void intel_teardown_gmbus(struct drm_device *dev);
extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
@@ -34676,7 +34638,7 @@ index 93e74fb..4a1182d 100644
INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
INIT_WORK(&dev_priv->error_work, i915_error_work_func);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index cfbb893..982d86d 100644
+index ee29c1f..07609a4 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -2215,7 +2215,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
@@ -34751,7 +34713,7 @@ index cfbb893..982d86d 100644
}
drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs);
-@@ -8847,7 +8856,7 @@ struct intel_quirk {
+@@ -8858,7 +8867,7 @@ struct intel_quirk {
int subsystem_vendor;
int subsystem_device;
void (*hook)(struct drm_device *dev);
@@ -35103,10 +35065,10 @@ index a9e33ce..09edd4b 100644
#endif
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 9bea4a6..31ee257 100644
+index f5962a0..a542c90 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -3076,7 +3076,9 @@ static int evergreen_startup(struct radeon_device *rdev)
+@@ -3077,7 +3077,9 @@ static int evergreen_startup(struct radeon_device *rdev)
r = evergreen_blit_init(rdev);
if (r) {
r600_blit_fini(rdev);
@@ -35139,10 +35101,10 @@ index 5a82b6b..9e69c73 100644
if (regcomp
(&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
-index 3f9705b..5d4f642 100644
+index 77e6fb1..43e5aae 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
-@@ -1379,7 +1379,9 @@ static int cayman_startup(struct radeon_device *rdev)
+@@ -1380,7 +1380,9 @@ static int cayman_startup(struct radeon_device *rdev)
r = evergreen_blit_init(rdev);
if (r) {
r600_blit_fini(rdev);
@@ -35188,10 +35150,10 @@ index 441570b..8896094 100644
}
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 3d46d7d4..82a26ab 100644
+index 57e45c6..73bf8a5 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -2439,7 +2439,9 @@ int r600_startup(struct radeon_device *rdev)
+@@ -2440,7 +2440,9 @@ int r600_startup(struct radeon_device *rdev)
r = r600_blit_init(rdev);
if (r) {
r600_blit_fini(rdev);
@@ -35542,10 +35504,10 @@ index 93bce72..00332c1 100644
if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
rdev->pm.k8_bandwidth.full)
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
-index 63db75d..999004d 100644
+index 3e72074..9fbe45b 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
-@@ -1082,7 +1082,9 @@ static int rv770_startup(struct radeon_device *rdev)
+@@ -1083,7 +1083,9 @@ static int rv770_startup(struct radeon_device *rdev)
r = r600_blit_init(rdev);
if (r) {
r600_blit_fini(rdev);
@@ -35743,101 +35705,6 @@ index a0c2f12..68ae6cb 100644
} while (*seqno == 0);
if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
-index c41226a..2952249 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gmr.c
-@@ -29,7 +29,9 @@
- #include "drmP.h"
- #include "ttm/ttm_bo_driver.h"
-
--#define VMW_PPN_SIZE sizeof(unsigned long)
-+#define VMW_PPN_SIZE (sizeof(unsigned long))
-+/* A future safe maximum remap size. */
-+#define VMW_PPN_PER_REMAP ((31 * 1024) / VMW_PPN_SIZE)
-
- static int vmw_gmr2_bind(struct vmw_private *dev_priv,
- struct page *pages[],
-@@ -38,43 +40,61 @@ static int vmw_gmr2_bind(struct vmw_private *dev_priv,
- {
- SVGAFifoCmdDefineGMR2 define_cmd;
- SVGAFifoCmdRemapGMR2 remap_cmd;
-- uint32_t define_size = sizeof(define_cmd) + 4;
-- uint32_t remap_size = VMW_PPN_SIZE * num_pages + sizeof(remap_cmd) + 4;
- uint32_t *cmd;
- uint32_t *cmd_orig;
-+ uint32_t define_size = sizeof(define_cmd) + sizeof(*cmd);
-+ uint32_t remap_num = num_pages / VMW_PPN_PER_REMAP + ((num_pages % VMW_PPN_PER_REMAP) > 0);
-+ uint32_t remap_size = VMW_PPN_SIZE * num_pages + (sizeof(remap_cmd) + sizeof(*cmd)) * remap_num;
-+ uint32_t remap_pos = 0;
-+ uint32_t cmd_size = define_size + remap_size;
- uint32_t i;
-
-- cmd_orig = cmd = vmw_fifo_reserve(dev_priv, define_size + remap_size);
-+ cmd_orig = cmd = vmw_fifo_reserve(dev_priv, cmd_size);
- if (unlikely(cmd == NULL))
- return -ENOMEM;
-
- define_cmd.gmrId = gmr_id;
- define_cmd.numPages = num_pages;
-
-+ *cmd++ = SVGA_CMD_DEFINE_GMR2;
-+ memcpy(cmd, &define_cmd, sizeof(define_cmd));
-+ cmd += sizeof(define_cmd) / sizeof(*cmd);
-+
-+ /*
-+ * Need to split the command if there are too many
-+ * pages that goes into the gmr.
-+ */
-+
- remap_cmd.gmrId = gmr_id;
- remap_cmd.flags = (VMW_PPN_SIZE > sizeof(*cmd)) ?
- SVGA_REMAP_GMR2_PPN64 : SVGA_REMAP_GMR2_PPN32;
-- remap_cmd.offsetPages = 0;
-- remap_cmd.numPages = num_pages;
-
-- *cmd++ = SVGA_CMD_DEFINE_GMR2;
-- memcpy(cmd, &define_cmd, sizeof(define_cmd));
-- cmd += sizeof(define_cmd) / sizeof(uint32);
-+ while (num_pages > 0) {
-+ unsigned long nr = min(num_pages, (unsigned long)VMW_PPN_PER_REMAP);
-
-- *cmd++ = SVGA_CMD_REMAP_GMR2;
-- memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
-- cmd += sizeof(remap_cmd) / sizeof(uint32);
-+ remap_cmd.offsetPages = remap_pos;
-+ remap_cmd.numPages = nr;
-
-- for (i = 0; i < num_pages; ++i) {
-- if (VMW_PPN_SIZE <= 4)
-- *cmd = page_to_pfn(*pages++);
-- else
-- *((uint64_t *)cmd) = page_to_pfn(*pages++);
-+ *cmd++ = SVGA_CMD_REMAP_GMR2;
-+ memcpy(cmd, &remap_cmd, sizeof(remap_cmd));
-+ cmd += sizeof(remap_cmd) / sizeof(*cmd);
-
-- cmd += VMW_PPN_SIZE / sizeof(*cmd);
-+ for (i = 0; i < nr; ++i) {
-+ if (VMW_PPN_SIZE <= 4)
-+ *cmd = page_to_pfn(*pages++);
-+ else
-+ *((uint64_t *)cmd) = page_to_pfn(*pages++);
-+
-+ cmd += VMW_PPN_SIZE / sizeof(*cmd);
-+ }
-+
-+ num_pages -= nr;
-+ remap_pos += nr;
- }
-
-- vmw_fifo_commit(dev_priv, define_size + remap_size);
-+ BUG_ON(cmd != cmd_orig + cmd_size / sizeof(*cmd));
-+
-+ vmw_fifo_commit(dev_priv, cmd_size);
-
- return 0;
- }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 66917c6..2dcc8ae 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -38911,7 +38778,7 @@ index 1cbfc6b..56e1dbb 100644
/*----------------------------------------------------------------*/
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 298e02a..b7f2f93 100644
+index c706a7b..2cc7511 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1591,7 +1591,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -41575,22 +41442,6 @@ index 62dc461..5250f0b 100644
/* dongle iscan controller */
struct brcmf_cfg80211_iscan_ctrl {
-diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
-index 045a936..271e818 100644
---- a/drivers/net/wireless/hostap/hostap_ioctl.c
-+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
-@@ -522,9 +522,9 @@ static int prism2_ioctl_giwaplist(struct net_device *dev,
-
- data->length = prism2_ap_get_sta_qual(local, addr, qual, IW_MAX_AP, 1);
-
-- memcpy(extra, &addr, sizeof(struct sockaddr) * data->length);
-+ memcpy(extra, addr, sizeof(struct sockaddr) * data->length);
- data->flags = 1; /* has quality information */
-- memcpy(extra + sizeof(struct sockaddr) * data->length, &qual,
-+ memcpy(extra + sizeof(struct sockaddr) * data->length, qual,
- sizeof(struct iw_quality) * data->length);
-
- kfree(addr);
diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c
index b3d9f3f..9931f58 100644
--- a/drivers/net/wireless/iwlegacy/iwl3945-base.c
@@ -44411,7 +44262,7 @@ index cdfa3e0..37fa165 100644
spin_unlock_irqrestore(&hp->lock, flags);
diff --git a/drivers/tty/hvc/hvsi_lib.c b/drivers/tty/hvc/hvsi_lib.c
-index 6f4dd83..84c3f91 100644
+index 3749688..82c91dc 100644
--- a/drivers/tty/hvc/hvsi_lib.c
+++ b/drivers/tty/hvc/hvsi_lib.c
@@ -9,7 +9,7 @@
@@ -50325,38 +50176,10 @@ index 7423cb9..9379ddd 100644
static int __init init_misc_binfmt(void)
{
diff --git a/fs/bio.c b/fs/bio.c
-index 4fc4dbb..0cf9d6d 100644
+index b84d851..0dd5077 100644
--- a/fs/bio.c
+++ b/fs/bio.c
-@@ -787,12 +787,22 @@ static int __bio_copy_iov(struct bio *bio, struct bio_vec *iovecs,
- int bio_uncopy_user(struct bio *bio)
- {
- struct bio_map_data *bmd = bio->bi_private;
-- int ret = 0;
-+ struct bio_vec *bvec;
-+ int ret = 0, i;
-
-- if (!bio_flagged(bio, BIO_NULL_MAPPED))
-- ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
-- bmd->nr_sgvecs, bio_data_dir(bio) == READ,
-- 0, bmd->is_our_pages);
-+ if (!bio_flagged(bio, BIO_NULL_MAPPED)) {
-+ /*
-+ * if we're in a workqueue, the request is orphaned, so
-+ * don't copy into a random user address space, just free.
-+ */
-+ if (current->mm)
-+ ret = __bio_copy_iov(bio, bmd->iovecs, bmd->sgvecs,
-+ bmd->nr_sgvecs, bio_data_dir(bio) == READ,
-+ 0, bmd->is_our_pages);
-+ else if (bmd->is_our_pages)
-+ __bio_for_each_segment(bvec, bio, i, 0)
-+ __free_page(bvec->bv_page);
-+ }
- bio_free_map_data(bmd);
- bio_put(bio);
- return ret;
-@@ -838,7 +848,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+@@ -848,7 +848,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
/*
* Overflow, abort
*/
@@ -50365,7 +50188,7 @@ index 4fc4dbb..0cf9d6d 100644
return ERR_PTR(-EINVAL);
nr_pages += end - start;
-@@ -972,7 +982,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
+@@ -982,7 +982,7 @@ static struct bio *__bio_map_user_iov(struct request_queue *q,
/*
* Overflow, abort
*/
@@ -50374,14 +50197,14 @@ index 4fc4dbb..0cf9d6d 100644
return ERR_PTR(-EINVAL);
nr_pages += end - start;
-@@ -1234,7 +1244,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
+@@ -1244,7 +1244,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
const int read = bio_data_dir(bio) == READ;
struct bio_map_data *bmd = bio->bi_private;
int i;
- char *p = bmd->sgvecs[0].iov_base;
+ char *p = (char __force_kernel *)bmd->sgvecs[0].iov_base;
- __bio_for_each_segment(bvec, bio, i, 0) {
+ bio_for_each_segment_all(bvec, bio, i) {
char *addr = page_address(bvec->bv_page);
diff --git a/fs/block_dev.c b/fs/block_dev.c
index c103267..260cbd9 100644
@@ -50896,10 +50719,10 @@ index 25bb97f..a0095de 100644
atomic_set(&midCount, 0);
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
-index 2f3ff59..719f1cd 100644
+index 7b68088..17a275b 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
-@@ -389,28 +389,28 @@ struct cifs_tcon {
+@@ -390,28 +390,28 @@ struct cifs_tcon {
__u16 Flags; /* optional support bits */
enum statusEnum tidStatus;
#ifdef CONFIG_CIFS_STATS
@@ -50950,7 +50773,7 @@ index 2f3ff59..719f1cd 100644
#ifdef CONFIG_CIFS_STATS2
unsigned long long time_writes;
unsigned long long time_reads;
-@@ -625,7 +625,7 @@ convert_delimiter(char *path, char delim)
+@@ -626,7 +626,7 @@ convert_delimiter(char *path, char delim)
}
#ifdef CONFIG_CIFS_STATS
@@ -50959,7 +50782,7 @@ index 2f3ff59..719f1cd 100644
static inline void cifs_stats_bytes_written(struct cifs_tcon *tcon,
unsigned int bytes)
-@@ -982,8 +982,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
+@@ -983,8 +983,8 @@ GLOBAL_EXTERN atomic_t tconInfoReconnectCount;
/* Various Debug counters */
GLOBAL_EXTERN atomic_t bufAllocCount; /* current number allocated */
#ifdef CONFIG_CIFS_STATS2
@@ -51006,7 +50829,7 @@ index 703ef5c..2a44ed5 100644
}
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
-index 4c37ed4..b722eed 100644
+index 52a820a..1d8ab03 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -86,14 +86,17 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
@@ -51027,7 +50850,7 @@ index 4c37ed4..b722eed 100644
+ return NULL;
}
- dentry = d_alloc(parent, name);
+ /*
diff --git a/fs/coda/cache.c b/fs/coda/cache.c
index 6901578..d402eb5 100644
--- a/fs/coda/cache.c
@@ -52747,7 +52570,7 @@ index f3358ab..fbb1d90 100644
"MMP failure info: last update time: %llu, last update "
"node: %s, last update device: %s\n",
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 259e950..2d40e76 100644
+index 84f84bf..a8770cd 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -92,6 +92,8 @@ static struct file_system_type ext2_fs_type = {
@@ -52794,7 +52617,7 @@ index 259e950..2d40e76 100644
if (!buf)
return -ENOMEM;
-@@ -5037,7 +5040,6 @@ static inline int ext2_feature_set_ok(struct super_block *sb)
+@@ -5052,7 +5055,6 @@ static inline int ext2_feature_set_ok(struct super_block *sb)
return 0;
return 1;
}
@@ -52802,7 +52625,7 @@ index 259e950..2d40e76 100644
#else
static inline void register_as_ext2(void) { }
static inline void unregister_as_ext2(void) { }
-@@ -5070,7 +5072,6 @@ static inline int ext3_feature_set_ok(struct super_block *sb)
+@@ -5085,7 +5087,6 @@ static inline int ext3_feature_set_ok(struct super_block *sb)
return 0;
return 1;
}
@@ -52810,7 +52633,7 @@ index 259e950..2d40e76 100644
#else
static inline void register_as_ext3(void) { }
static inline void unregister_as_ext3(void) { }
-@@ -5084,6 +5085,7 @@ static struct file_system_type ext4_fs_type = {
+@@ -5099,6 +5100,7 @@ static struct file_system_type ext4_fs_type = {
.kill_sb = kill_block_super,
.fs_flags = FS_REQUIRES_DEV,
};
@@ -55628,7 +55451,7 @@ index 516f337..82a82df 100644
ret = PTR_ERR(cb_info->task);
svc_exit_thread(cb_info->rqst);
diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
-index 168cb93..de27202 100644
+index 3fde055..de27202 100644
--- a/fs/nfs/callback_xdr.c
+++ b/fs/nfs/callback_xdr.c
@@ -50,7 +50,7 @@ struct callback_op {
@@ -55640,19 +55463,6 @@ index 168cb93..de27202 100644
static struct callback_op callback_ops[];
-@@ -451,9 +451,9 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
- args->csa_nrclists = ntohl(*p++);
- args->csa_rclists = NULL;
- if (args->csa_nrclists) {
-- args->csa_rclists = kmalloc(args->csa_nrclists *
-- sizeof(*args->csa_rclists),
-- GFP_KERNEL);
-+ args->csa_rclists = kmalloc_array(args->csa_nrclists,
-+ sizeof(*args->csa_rclists),
-+ GFP_KERNEL);
- if (unlikely(args->csa_rclists == NULL))
- goto out;
-
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 756f4df..8bd49ca 100644
--- a/fs/nfs/dir.c
@@ -57674,7 +57484,7 @@ index 03102d9..4ae347e 100644
}
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 3efa725..18a278b 100644
+index ef1740d..9a18b87 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -11,12 +11,19 @@
@@ -57850,15 +57660,7 @@ index 3efa725..18a278b 100644
mss.resident >> 10,
(unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
mss.shared_clean >> 10,
-@@ -792,13 +843,13 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
- if (!count)
- goto out_task;
-
-- pm.len = PM_ENTRY_BYTES * (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
-- pm.buffer = kmalloc(pm.len, GFP_TEMPORARY);
-+ pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
-+ pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY);
- ret = -ENOMEM;
+@@ -798,7 +849,7 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
if (!pm.buffer)
goto out_task;
@@ -71300,10 +71102,10 @@ index 2a53f10..e3cd3e0 100644
/*
diff --git a/include/linux/ftrace_event.h b/include/linux/ftrace_event.h
-index c3da42d..d98b224 100644
+index 82924bf..1aa58e7 100644
--- a/include/linux/ftrace_event.h
+++ b/include/linux/ftrace_event.h
-@@ -254,7 +254,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
+@@ -256,7 +256,7 @@ extern int trace_define_field(struct ftrace_event_call *call, const char *type,
extern int trace_add_event_call(struct ftrace_event_call *call);
extern void trace_remove_event_call(struct ftrace_event_call *call);
@@ -73452,7 +73254,7 @@ index d0493f6..ce3ea0b 100644
#endif /* __KERNEL__ */
#endif /* _LINUX_MM_H */
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
-index 5b42f1b..759e4b4 100644
+index de3a321..8761f4a 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -253,6 +253,8 @@ struct vm_area_struct {
@@ -73464,7 +73266,7 @@ index 5b42f1b..759e4b4 100644
};
struct core_thread {
-@@ -389,6 +391,24 @@ struct mm_struct {
+@@ -390,6 +392,24 @@ struct mm_struct {
#ifdef CONFIG_CPUMASK_OFFSTACK
struct cpumask cpumask_allocation;
#endif
@@ -74817,7 +74619,7 @@ index efe50af..0d0b145 100644
static inline void nf_reset_trace(struct sk_buff *skb)
diff --git a/include/linux/slab.h b/include/linux/slab.h
-index 573c809..36fe1a8 100644
+index a595dce..f8a18ee 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -11,14 +11,29 @@
@@ -74885,42 +74687,7 @@ index 573c809..36fe1a8 100644
/*
* Allocator specific definitions. These are mainly used to establish optimized
-@@ -190,7 +219,7 @@ size_t ksize(const void *);
- #endif
-
- /**
-- * kcalloc - allocate memory for an array. The memory is set to zero.
-+ * kmalloc_array - allocate memory for an array.
- * @n: number of elements.
- * @size: element size.
- * @flags: the type of memory to allocate.
-@@ -240,11 +269,22 @@ size_t ksize(const void *);
- * for general use, and so are not documented here. For a full list of
- * potential flags, always refer to linux/gfp.h.
- */
--static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
-+static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
- {
-- if (size != 0 && n > ULONG_MAX / size)
-+ if (size != 0 && n > SIZE_MAX / size)
- return NULL;
-- return __kmalloc(n * size, flags | __GFP_ZERO);
-+ return __kmalloc(n * size, flags);
-+}
-+
-+/**
-+ * kcalloc - allocate memory for an array. The memory is set to zero.
-+ * @n: number of elements.
-+ * @size: element size.
-+ * @flags: the type of memory to allocate (see kmalloc).
-+ */
-+static inline void *kcalloc(size_t n, size_t size, gfp_t flags)
-+{
-+ return kmalloc_array(n, size, flags | __GFP_ZERO);
- }
-
- #if !defined(CONFIG_NUMA) && !defined(CONFIG_SLOB)
-@@ -287,7 +327,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
+@@ -298,7 +327,7 @@ static inline void *kmem_cache_alloc_node(struct kmem_cache *cachep,
*/
#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
(defined(CONFIG_SLAB) && defined(CONFIG_TRACING))
@@ -74929,7 +74696,7 @@ index 573c809..36fe1a8 100644
#define kmalloc_track_caller(size, flags) \
__kmalloc_track_caller(size, flags, _RET_IP_)
#else
-@@ -306,7 +346,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
+@@ -317,7 +346,7 @@ extern void *__kmalloc_track_caller(size_t, gfp_t, unsigned long);
*/
#if defined(CONFIG_DEBUG_SLAB) || defined(CONFIG_SLUB) || \
(defined(CONFIG_SLAB) && defined(CONFIG_TRACING))
@@ -78105,7 +77872,7 @@ index 63786e7..0780cac 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 8be9b746..cb7b792 100644
+index 5bbe443..c8b6b81 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -145,8 +145,15 @@ static struct srcu_struct pmus_srcu;
@@ -78134,7 +77901,7 @@ index 8be9b746..cb7b792 100644
static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
enum event_type_t event_type);
-@@ -2559,7 +2566,7 @@ static void __perf_event_read(void *info)
+@@ -2568,7 +2575,7 @@ static void __perf_event_read(void *info)
static inline u64 perf_event_count(struct perf_event *event)
{
@@ -78143,7 +77910,7 @@ index 8be9b746..cb7b792 100644
}
static u64 perf_event_read(struct perf_event *event)
-@@ -3105,9 +3112,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -3114,9 +3121,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
mutex_lock(&event->child_mutex);
total += perf_event_read(event);
*enabled += event->total_time_enabled +
@@ -78155,7 +77922,7 @@ index 8be9b746..cb7b792 100644
list_for_each_entry(child, &event->child_list, child_list) {
total += perf_event_read(child);
-@@ -3499,10 +3506,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -3508,10 +3515,10 @@ void perf_event_update_userpage(struct perf_event *event)
userpg->offset -= local64_read(&event->hw.prev_count);
userpg->time_enabled = enabled +
@@ -78168,7 +77935,7 @@ index 8be9b746..cb7b792 100644
barrier();
++userpg->lock;
-@@ -4010,11 +4017,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4019,11 +4026,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -78182,7 +77949,7 @@ index 8be9b746..cb7b792 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -4665,12 +4672,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
+@@ -4674,12 +4681,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
* need to add enough zero bytes after the string to handle
* the 64bit alignment we do later.
*/
@@ -78197,7 +77964,7 @@ index 8be9b746..cb7b792 100644
if (IS_ERR(name)) {
name = strncpy(tmp, "//toolong", sizeof(tmp));
goto got_name;
-@@ -6027,7 +6034,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -6036,7 +6043,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(current->nsproxy->pid_ns);
@@ -78206,7 +77973,7 @@ index 8be9b746..cb7b792 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -6274,6 +6281,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -6282,6 +6289,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -78218,7 +77985,7 @@ index 8be9b746..cb7b792 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -6561,10 +6573,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -6577,10 +6589,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -81489,7 +81256,7 @@ index f280df1..da1281d 100644
#ifdef CONFIG_RT_GROUP_SCHED
/*
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
-index 66e4576..d05c6d5 100644
+index 59474c5..490e67f 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -4801,7 +4801,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
@@ -82983,7 +82750,7 @@ index 6fdc629..55739fe 100644
*data_page = bpage;
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index a584ad9..ba946c6 100644
+index ce1067f..d823ee9 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2653,7 +2653,7 @@ int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
@@ -82995,7 +82762,7 @@ index a584ad9..ba946c6 100644
{
/* do nothing if flag is already set */
if (!!(trace_flags & mask) == !!enabled)
-@@ -4244,10 +4244,9 @@ static const struct file_operations tracing_dyn_info_fops = {
+@@ -4245,10 +4245,9 @@ static const struct file_operations tracing_dyn_info_fops = {
};
#endif
@@ -83007,7 +82774,7 @@ index a584ad9..ba946c6 100644
static int once;
if (d_tracer)
-@@ -4267,10 +4266,9 @@ struct dentry *tracing_init_dentry(void)
+@@ -4268,10 +4267,9 @@ struct dentry *tracing_init_dentry(void)
return d_tracer;
}
@@ -83287,10 +83054,10 @@ index a8bc4d9..eae8357 100644
};
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index 0ad2420..64da53b 100644
+index 0bc9ff0..4722738 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
-@@ -3490,7 +3490,7 @@ static int __cpuinit trustee_thread(void *__gcwq)
+@@ -3499,7 +3499,7 @@ static int __cpuinit trustee_thread(void *__gcwq)
*/
worker_flags |= WORKER_REBIND;
worker_flags &= ~WORKER_ROGUE;
@@ -87249,7 +87016,7 @@ index 07c08c4..8d4ad26 100644
return count;
}
diff --git a/mm/nommu.c b/mm/nommu.c
-index f0cd7ab..9b60530 100644
+index 1db7971..5dba7b6 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
@@ -87284,7 +87051,7 @@ index f0cd7ab..9b60530 100644
*region = *vma->vm_region;
new->vm_region = region;
-@@ -1961,8 +1952,8 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+@@ -1971,8 +1962,8 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
}
EXPORT_SYMBOL(filemap_fault);
@@ -87295,7 +87062,7 @@ index f0cd7ab..9b60530 100644
{
struct vm_area_struct *vma;
-@@ -2003,8 +1994,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -2013,8 +2004,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
*
* The caller must hold a reference on @mm.
*/
@@ -87306,7 +87073,7 @@ index f0cd7ab..9b60530 100644
{
return __access_remote_vm(NULL, mm, addr, buf, len, write);
}
-@@ -2013,7 +2004,7 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -2023,7 +2014,7 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
* Access another process' address space.
* - source/target buffer must be kernel space
*/
@@ -87338,7 +87105,7 @@ index ea3f83b..001a216 100644
.next = NULL,
};
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
-index 5c028e2..a3e026d 100644
+index b5afea2..fb9fd83 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -57,6 +57,7 @@
@@ -91487,10 +91254,10 @@ index 94cdbc5..01d3a77 100644
};
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
-index 5485077..7e37374 100644
+index 739b073..7ac6591 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
-@@ -51,7 +51,7 @@ static int ipv4_local_port_range(ctl_table *table, int write,
+@@ -53,7 +53,7 @@ static int ipv4_local_port_range(ctl_table *table, int write,
{
int ret;
int range[2];
@@ -91499,7 +91266,7 @@ index 5485077..7e37374 100644
.data = &range,
.maxlen = sizeof(range),
.mode = table->mode,
-@@ -102,7 +102,7 @@ static int ipv4_ping_group_range(ctl_table *table, int write,
+@@ -104,7 +104,7 @@ static int ipv4_ping_group_range(ctl_table *table, int write,
{
int ret;
gid_t range[2];
@@ -91508,7 +91275,7 @@ index 5485077..7e37374 100644
.data = &range,
.maxlen = sizeof(range),
.mode = table->mode,
-@@ -123,7 +123,7 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write,
+@@ -125,7 +125,7 @@ static int proc_tcp_congestion_control(ctl_table *ctl, int write,
void __user *buffer, size_t *lenp, loff_t *ppos)
{
char val[TCP_CA_NAME_MAX];
@@ -91517,7 +91284,7 @@ index 5485077..7e37374 100644
.data = val,
.maxlen = TCP_CA_NAME_MAX,
};
-@@ -142,7 +142,7 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
+@@ -144,7 +144,7 @@ static int proc_tcp_available_congestion_control(ctl_table *ctl,
void __user *buffer, size_t *lenp,
loff_t *ppos)
{
@@ -91526,7 +91293,7 @@ index 5485077..7e37374 100644
int ret;
tbl.data = kmalloc(tbl.maxlen, GFP_USER);
-@@ -159,7 +159,7 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
+@@ -161,7 +161,7 @@ static int proc_allowed_congestion_control(ctl_table *ctl,
void __user *buffer, size_t *lenp,
loff_t *ppos)
{
@@ -91535,7 +91302,7 @@ index 5485077..7e37374 100644
int ret;
tbl.data = kmalloc(tbl.maxlen, GFP_USER);
-@@ -357,7 +357,7 @@ static struct ctl_table ipv4_table[] = {
+@@ -361,7 +361,7 @@ static struct ctl_table ipv4_table[] = {
},
{
.procname = "ip_local_reserved_ports",
@@ -91544,7 +91311,7 @@ index 5485077..7e37374 100644
.maxlen = 65536,
.mode = 0644,
.proc_handler = proc_do_large_bitmap,
-@@ -740,11 +740,10 @@ EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
+@@ -744,11 +744,10 @@ EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
static __net_init int ipv4_sysctl_init_net(struct net *net)
{
@@ -91558,7 +91325,7 @@ index 5485077..7e37374 100644
if (table == NULL)
goto err_alloc;
-@@ -776,16 +775,17 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
+@@ -780,16 +779,17 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
net->ipv4.sysctl_rt_cache_rebuild_count = 4;
@@ -91580,7 +91347,7 @@ index 5485077..7e37374 100644
err_alloc:
return -ENOMEM;
}
-@@ -799,7 +799,7 @@ static __net_exit void ipv4_sysctl_exit_net(struct net *net)
+@@ -803,7 +803,7 @@ static __net_exit void ipv4_sysctl_exit_net(struct net *net)
kfree(table);
}
@@ -91589,7 +91356,7 @@ index 5485077..7e37374 100644
.init = ipv4_sysctl_init_net,
.exit = ipv4_sysctl_exit_net,
};
-@@ -807,16 +807,6 @@ static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
+@@ -811,16 +811,6 @@ static __net_initdata struct pernet_operations ipv4_sysctl_ops = {
static __init int sysctl_ipv4_init(void)
{
struct ctl_table_header *hdr;
@@ -92713,7 +92480,7 @@ index 403be43..87f09da 100644
};
diff --git a/net/key/af_key.c b/net/key/af_key.c
-index 6fefdfc..454598b 100644
+index 8dbdb8e..c765b51 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1924,6 +1924,9 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol)
@@ -92726,7 +92493,7 @@ index 6fefdfc..454598b 100644
while (len >= sizeof(struct sadb_x_ipsecrequest)) {
if ((err = parse_ipsecrequest(xp, rq)) < 0)
return err;
-@@ -3018,10 +3021,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
+@@ -3020,10 +3023,10 @@ static int pfkey_send_policy_notify(struct xfrm_policy *xp, int dir, const struc
static u32 get_acqseq(void)
{
u32 res;
@@ -94330,18 +94097,6 @@ index 7635107..4670276 100644
_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
-diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
-index e25e490..6e38ef0 100644
---- a/net/sched/sch_atm.c
-+++ b/net/sched/sch_atm.c
-@@ -606,6 +606,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
- struct sockaddr_atmpvc pvc;
- int state;
-
-+ memset(&pvc, 0, sizeof(pvc));
- pvc.sap_family = AF_ATMPVC;
- pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
- pvc.sap_addr.vpi = flow->vcc->vpi;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 8104278..300d89d 100644
--- a/net/sctp/ipv6.c
@@ -94373,33 +94128,6 @@ index 8104278..300d89d 100644
}
/* Initialize IPv6 support and register with socket layer. */
-diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
-index 96eb168..3dd7207 100644
---- a/net/sctp/outqueue.c
-+++ b/net/sctp/outqueue.c
-@@ -205,6 +205,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
- */
- void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
- {
-+ memset(q, 0, sizeof(struct sctp_outq));
-+
- q->asoc = asoc;
- INIT_LIST_HEAD(&q->out_chunk_list);
- INIT_LIST_HEAD(&q->control_chunk_list);
-@@ -212,13 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
- INIT_LIST_HEAD(&q->sacked);
- INIT_LIST_HEAD(&q->abandoned);
-
-- q->fast_rtx = 0;
-- q->outstanding_bytes = 0;
- q->empty = 1;
-- q->cork = 0;
--
-- q->malloced = 0;
-- q->out_qlen = 0;
- }
-
- /* Free the outqueue structure and any related pending chunks.
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
index bc6cd75..749e4eb 100644
--- a/net/sctp/probe.c
@@ -99265,19 +98993,6 @@ index cd094ec..eca1277 100644
break;
default:
return -EINVAL;
-diff --git a/sound/i2c/other/ak4xxx-adda.c b/sound/i2c/other/ak4xxx-adda.c
-index cef813d..ed726d1 100644
---- a/sound/i2c/other/ak4xxx-adda.c
-+++ b/sound/i2c/other/ak4xxx-adda.c
-@@ -571,7 +571,7 @@ static int ak4xxx_capture_source_info(struct snd_kcontrol *kcontrol,
- struct snd_akm4xxx *ak = snd_kcontrol_chip(kcontrol);
- int mixer_ch = AK_GET_SHIFT(kcontrol->private_value);
- const char **input_names;
-- int num_names, idx;
-+ unsigned int num_names, idx;
-
- num_names = ak4xxx_capture_num_inputs(ak, mixer_ch);
- if (!num_names)
diff --git a/sound/oss/sb_audio.c b/sound/oss/sb_audio.c
index 733b014..56ce96f 100644
--- a/sound/oss/sb_audio.c
diff --git a/3.2.50/4425_grsec_remove_EI_PAX.patch b/3.2.51/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.2.50/4425_grsec_remove_EI_PAX.patch
rename to 3.2.51/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.50/4427_force_XATTR_PAX_tmpfs.patch b/3.2.51/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.2.50/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.2.51/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.50/4430_grsec-remove-localversion-grsec.patch b/3.2.51/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.2.50/4430_grsec-remove-localversion-grsec.patch
rename to 3.2.51/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.50/4435_grsec-mute-warnings.patch b/3.2.51/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.2.50/4435_grsec-mute-warnings.patch
rename to 3.2.51/4435_grsec-mute-warnings.patch
diff --git a/3.2.50/4440_grsec-remove-protected-paths.patch b/3.2.51/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.2.50/4440_grsec-remove-protected-paths.patch
rename to 3.2.51/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.50/4450_grsec-kconfig-default-gids.patch b/3.2.51/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.2.50/4450_grsec-kconfig-default-gids.patch
rename to 3.2.51/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.50/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.51/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.2.50/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.2.51/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.50/4470_disable-compat_vdso.patch b/3.2.51/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.2.50/4470_disable-compat_vdso.patch
rename to 3.2.51/4470_disable-compat_vdso.patch
diff --git a/3.2.50/4475_emutramp_default_on.patch b/3.2.51/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.2.50/4475_emutramp_default_on.patch
rename to 3.2.51/4475_emutramp_default_on.patch
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-09-12 17:30 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-12 17:30 [gentoo-commits] proj/hardened-patchset:master commit in: 3.2.51/, 3.2.50/ Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox