[gentoo-commits] proj/hardened-patchset:master commit in: 3.2.19/, 2.6.32/, 3.3.8/, 3.3.7/, 3.2.18/

[Anthony G. Basile]

commit:     e5f84a20682495175b7fd78f3df6f4c0affb3064
Author:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Jun  6 20:48:42 2012 +0000
Commit:     Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Jun  6 20:48:42 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=e5f84a20

Grsec/PaX: 2.9-{2.6.32.59,3.2.19,3.3.8}-201206042136

---
 2.6.32/0000_README                                 |    2 +-
 ...20_grsecurity-2.9-2.6.32.59-201206042134.patch} |   34 +-
 3.2.18/1016_linux-3.2.17.patch                     | 5695 --------------------
 3.2.18/1017_linux-3.2.18.patch                     | 1791 ------
 {3.2.18 => 3.2.19}/0000_README                     |    2 +-
 .../4420_grsecurity-2.9-3.2.19-201206042135.patch  |  800 ++--
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 {3.2.18 => 3.2.19}/4435_grsec-mute-warnings.patch  |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4445_grsec-pax-without-grsec.patch             |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 {3.2.18 => 3.2.19}/4455_grsec-kconfig-gentoo.patch |    0
 .../4460-grsec-kconfig-proc-user.patch             |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 {3.2.18 => 3.2.19}/4470_disable-compat_vdso.patch  |    0
 {3.3.7 => 3.3.8}/0000_README                       |    2 +-
 .../4420_grsecurity-2.9-3.3.8-201206042136.patch   |  612 ++-
 .../4430_grsec-remove-localversion-grsec.patch     |    0
 {3.3.7 => 3.3.8}/4435_grsec-mute-warnings.patch    |    0
 .../4440_grsec-remove-protected-paths.patch        |    0
 .../4445_grsec-pax-without-grsec.patch             |    0
 .../4450_grsec-kconfig-default-gids.patch          |    0
 {3.3.7 => 3.3.8}/4455_grsec-kconfig-gentoo.patch   |    0
 .../4460-grsec-kconfig-proc-user.patch             |    0
 .../4465_selinux-avc_audit-log-curr_ip.patch       |    0
 {3.3.7 => 3.3.8}/4470_disable-compat_vdso.patch    |    0
 26 files changed, 678 insertions(+), 8260 deletions(-)

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 4b5c6dc..1e75c22 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -30,7 +30,7 @@ Patch:	1058_linux-2.6.32.59.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9-2.6.32.59-201206011934.patch
+Patch:	4420_grsecurity-2.9-2.6.32.59-201206042134.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206042134.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch
rename to 2.6.32/4420_grsecurity-2.9-2.6.32.59-201206042134.patch
index d2b4115..9d85b0d 100644
--- a/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206011934.patch
+++ b/2.6.32/4420_grsecurity-2.9-2.6.32.59-201206042134.patch
@@ -26798,7 +26798,7 @@ index f46c3407..f7e72b0 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 73ffd55..e2f0e1d 100644
+index 73ffd55..2cb04d8 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -13,6 +13,7 @@
@@ -26864,7 +26864,7 @@ index 73ffd55..e2f0e1d 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -377,8 +396,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -377,8 +396,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -26899,14 +26899,13 @@ index 73ffd55..e2f0e1d 100644
 +	unsigned long addr, limit;
 +	struct desc_struct d;
 +	int cpu;
-+#endif
-+#endif
-+#ifndef CONFIG_X86_PAE
++#else
 +	pgd_t *pgd;
 +	pud_t *pud;
 +	pmd_t *pmd;
 +	unsigned long addr, end;
 +#endif
++#endif
 +
 +	gr_init_ebda();
 +
@@ -28968,7 +28967,7 @@ index 21e1aeb..2c0b3c4 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 0087b00..eecb34f 100644
+index 0087b00..ec5c76f 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -71,8 +71,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -28989,7 +28988,18 @@ index 0087b00..eecb34f 100644
  	end = start + __get_cpu_var(idt_desc).size + 1;
  
  	xen_mc_flush();
-@@ -993,7 +991,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
+@@ -945,7 +943,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initdata = {
+ 	.wbinvd = native_wbinvd,
+ 
+ 	.read_msr = native_read_msr_safe,
++	.rdmsr_regs = native_rdmsr_safe_regs,
+ 	.write_msr = xen_write_msr_safe,
++	.wrmsr_regs = native_wrmsr_safe_regs,
++
+ 	.read_tsc = native_read_tsc,
+ 	.read_pmc = native_read_pmc,
+ 
+@@ -993,7 +994,7 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
  #endif
  };
  
@@ -28998,7 +29008,7 @@ index 0087b00..eecb34f 100644
  {
  	struct sched_shutdown r = { .reason = reason };
  
-@@ -1001,17 +999,17 @@ static void xen_reboot(int reason)
+@@ -1001,17 +1002,17 @@ static void xen_reboot(int reason)
  		BUG();
  }
  
@@ -29019,7 +29029,7 @@ index 0087b00..eecb34f 100644
  {
  	xen_reboot(SHUTDOWN_poweroff);
  }
-@@ -1095,9 +1093,20 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1095,9 +1096,20 @@ asmlinkage void __init xen_start_kernel(void)
  	 */
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
@@ -29042,7 +29052,7 @@ index 0087b00..eecb34f 100644
  #endif
  
  	xen_setup_features();
-@@ -1129,13 +1138,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1129,13 +1141,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -101423,14 +101433,14 @@ index f095659..537313b 100644
  		return -EFAULT;
  
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index ce1ce82..8825bcd 100644
+index ce1ce82..218d4fc 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -5632,6 +5632,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
-+			if (th->fin)
++			if (th->fin || th->urg || th->psh)
 +				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;

diff --git a/3.2.18/1016_linux-3.2.17.patch b/3.2.18/1016_linux-3.2.17.patch
deleted file mode 100644
index 5aeed10..0000000
--- a/3.2.18/1016_linux-3.2.17.patch
+++ /dev/null
@@ -1,5695 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 3da29cb..4c4efa3 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 2
--SUBLEVEL = 16
-+SUBLEVEL = 17
- EXTRAVERSION =
- NAME = Saber-toothed Squirrel
- 
-diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
-index ab3740e..ef642a0 100644
---- a/arch/arm/Kconfig
-+++ b/arch/arm/Kconfig
-@@ -1155,6 +1155,15 @@ if !MMU
- source "arch/arm/Kconfig-nommu"
- endif
- 
-+config ARM_ERRATA_326103
-+	bool "ARM errata: FSR write bit incorrect on a SWP to read-only memory"
-+	depends on CPU_V6
-+	help
-+	  Executing a SWP instruction to read-only memory does not set bit 11
-+	  of the FSR on the ARM 1136 prior to r1p0. This causes the kernel to
-+	  treat the access as a read, preventing a COW from occurring and
-+	  causing the faulting task to livelock.
-+
- config ARM_ERRATA_411920
- 	bool "ARM errata: Invalidation of the Instruction Cache operation can fail"
- 	depends on CPU_V6 || CPU_V6K
-diff --git a/arch/arm/include/asm/tls.h b/arch/arm/include/asm/tls.h
-index 60843eb..73409e6 100644
---- a/arch/arm/include/asm/tls.h
-+++ b/arch/arm/include/asm/tls.h
-@@ -7,6 +7,8 @@
- 
- 	.macro set_tls_v6k, tp, tmp1, tmp2
- 	mcr	p15, 0, \tp, c13, c0, 3		@ set TLS register
-+	mov	\tmp1, #0
-+	mcr	p15, 0, \tmp1, c13, c0, 2	@ clear user r/w TLS register
- 	.endm
- 
- 	.macro set_tls_v6, tp, tmp1, tmp2
-@@ -15,6 +17,8 @@
- 	mov	\tmp2, #0xffff0fff
- 	tst	\tmp1, #HWCAP_TLS		@ hardware TLS available?
- 	mcrne	p15, 0, \tp, c13, c0, 3		@ yes, set TLS register
-+	movne	\tmp1, #0
-+	mcrne	p15, 0, \tmp1, c13, c0, 2	@ clear user r/w TLS register
- 	streq	\tp, [\tmp2, #-15]		@ set TLS value at 0xffff0ff0
- 	.endm
- 
-diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
-index 3efd82c..87c8be5 100644
---- a/arch/arm/kernel/irq.c
-+++ b/arch/arm/kernel/irq.c
-@@ -156,10 +156,10 @@ static bool migrate_one_irq(struct irq_desc *desc)
- 	}
- 
- 	c = irq_data_get_irq_chip(d);
--	if (c->irq_set_affinity)
--		c->irq_set_affinity(d, affinity, true);
--	else
-+	if (!c->irq_set_affinity)
- 		pr_debug("IRQ%u: unable to set affinity\n", d->irq);
-+	else if (c->irq_set_affinity(d, affinity, true) == IRQ_SET_MASK_OK && ret)
-+		cpumask_copy(d->affinity, affinity);
- 
- 	return ret;
- }
-diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index ef5640b..e10e59a 100644
---- a/arch/arm/kernel/smp.c
-+++ b/arch/arm/kernel/smp.c
-@@ -297,8 +297,6 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
- 	struct mm_struct *mm = &init_mm;
- 	unsigned int cpu = smp_processor_id();
- 
--	printk("CPU%u: Booted secondary processor\n", cpu);
--
- 	/*
- 	 * All kernel threads share the same mm context; grab a
- 	 * reference and switch to it.
-@@ -310,6 +308,8 @@ asmlinkage void __cpuinit secondary_start_kernel(void)
- 	enter_lazy_tlb(mm, current);
- 	local_flush_tlb_all();
- 
-+	printk("CPU%u: Booted secondary processor\n", cpu);
-+
- 	cpu_init();
- 	preempt_disable();
- 	trace_hardirqs_off();
-diff --git a/arch/arm/kernel/sys_arm.c b/arch/arm/kernel/sys_arm.c
-index d2b1779..76cbb05 100644
---- a/arch/arm/kernel/sys_arm.c
-+++ b/arch/arm/kernel/sys_arm.c
-@@ -115,7 +115,7 @@ int kernel_execve(const char *filename,
- 		  "Ir" (THREAD_START_SP - sizeof(regs)),
- 		  "r" (&regs),
- 		  "Ir" (sizeof(regs))
--		: "r0", "r1", "r2", "r3", "ip", "lr", "memory");
-+		: "r0", "r1", "r2", "r3", "r8", "r9", "ip", "lr", "memory");
- 
-  out:
- 	return ret;
-diff --git a/arch/arm/mach-omap1/timer.c b/arch/arm/mach-omap1/timer.c
-index 6e90665..fb202af 100644
---- a/arch/arm/mach-omap1/timer.c
-+++ b/arch/arm/mach-omap1/timer.c
-@@ -47,9 +47,9 @@ static int omap1_dm_timer_set_src(struct platform_device *pdev,
- 	int n = (pdev->id - 1) << 1;
- 	u32 l;
- 
--	l = __raw_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
-+	l = omap_readl(MOD_CONF_CTRL_1) & ~(0x03 << n);
- 	l |= source << n;
--	__raw_writel(l, MOD_CONF_CTRL_1);
-+	omap_writel(l, MOD_CONF_CTRL_1);
- 
- 	return 0;
- }
-diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
-index ff1f7cc..8074199 100644
---- a/arch/arm/mm/abort-ev6.S
-+++ b/arch/arm/mm/abort-ev6.S
-@@ -26,18 +26,23 @@ ENTRY(v6_early_abort)
- 	mrc	p15, 0, r1, c5, c0, 0		@ get FSR
- 	mrc	p15, 0, r0, c6, c0, 0		@ get FAR
- /*
-- * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR (erratum 326103).
-- * The test below covers all the write situations, including Java bytecodes
-+ * Faulty SWP instruction on 1136 doesn't set bit 11 in DFSR.
-  */
--	bic	r1, r1, #1 << 11		@ clear bit 11 of FSR
-+#ifdef CONFIG_ARM_ERRATA_326103
-+	ldr	ip, =0x4107b36
-+	mrc	p15, 0, r3, c0, c0, 0		@ get processor id
-+	teq	ip, r3, lsr #4			@ r0 ARM1136?
-+	bne	do_DataAbort
- 	tst	r5, #PSR_J_BIT			@ Java?
-+	tsteq	r5, #PSR_T_BIT			@ Thumb?
- 	bne	do_DataAbort
--	do_thumb_abort fsr=r1, pc=r4, psr=r5, tmp=r3
--	ldreq	r3, [r4]			@ read aborted ARM instruction
-+	bic	r1, r1, #1 << 11		@ clear bit 11 of FSR
-+	ldr	r3, [r4]			@ read aborted ARM instruction
- #ifdef CONFIG_CPU_ENDIAN_BE8
--	reveq	r3, r3
-+	rev	r3, r3
- #endif
- 	do_ldrd_abort tmp=ip, insn=r3
- 	tst	r3, #1 << 20			@ L = 0 -> write
- 	orreq	r1, r1, #1 << 11		@ yes.
-+#endif
- 	b	do_DataAbort
-diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
-index b1e192b..db7bcc0 100644
---- a/arch/arm/mm/cache-l2x0.c
-+++ b/arch/arm/mm/cache-l2x0.c
-@@ -32,6 +32,7 @@ static void __iomem *l2x0_base;
- static DEFINE_RAW_SPINLOCK(l2x0_lock);
- static uint32_t l2x0_way_mask;	/* Bitmask of active ways */
- static uint32_t l2x0_size;
-+static unsigned long sync_reg_offset = L2X0_CACHE_SYNC;
- 
- struct l2x0_regs l2x0_saved_regs;
- 
-@@ -61,12 +62,7 @@ static inline void cache_sync(void)
- {
- 	void __iomem *base = l2x0_base;
- 
--#ifdef CONFIG_PL310_ERRATA_753970
--	/* write to an unmmapped register */
--	writel_relaxed(0, base + L2X0_DUMMY_REG);
--#else
--	writel_relaxed(0, base + L2X0_CACHE_SYNC);
--#endif
-+	writel_relaxed(0, base + sync_reg_offset);
- 	cache_wait(base + L2X0_CACHE_SYNC, 1);
- }
- 
-@@ -85,10 +81,13 @@ static inline void l2x0_inv_line(unsigned long addr)
- }
- 
- #if defined(CONFIG_PL310_ERRATA_588369) || defined(CONFIG_PL310_ERRATA_727915)
-+static inline void debug_writel(unsigned long val)
-+{
-+	if (outer_cache.set_debug)
-+		outer_cache.set_debug(val);
-+}
- 
--#define debug_writel(val)	outer_cache.set_debug(val)
--
--static void l2x0_set_debug(unsigned long val)
-+static void pl310_set_debug(unsigned long val)
- {
- 	writel_relaxed(val, l2x0_base + L2X0_DEBUG_CTRL);
- }
-@@ -98,7 +97,7 @@ static inline void debug_writel(unsigned long val)
- {
- }
- 
--#define l2x0_set_debug	NULL
-+#define pl310_set_debug	NULL
- #endif
- 
- #ifdef CONFIG_PL310_ERRATA_588369
-@@ -331,6 +330,11 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
- 		else
- 			ways = 8;
- 		type = "L310";
-+#ifdef CONFIG_PL310_ERRATA_753970
-+		/* Unmapped register. */
-+		sync_reg_offset = L2X0_DUMMY_REG;
-+#endif
-+		outer_cache.set_debug = pl310_set_debug;
- 		break;
- 	case L2X0_CACHE_ID_PART_L210:
- 		ways = (aux >> 13) & 0xf;
-@@ -379,7 +383,6 @@ void __init l2x0_init(void __iomem *base, __u32 aux_val, __u32 aux_mask)
- 	outer_cache.flush_all = l2x0_flush_all;
- 	outer_cache.inv_all = l2x0_inv_all;
- 	outer_cache.disable = l2x0_disable;
--	outer_cache.set_debug = l2x0_set_debug;
- 
- 	printk(KERN_INFO "%s cache controller enabled\n", type);
- 	printk(KERN_INFO "l2x0: %d ways, CACHE_ID 0x%08x, AUX_CTRL 0x%08x, Cache size: %d B\n",
-diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
-index 89bbf4e..e77f4e4 100644
---- a/arch/x86/boot/compressed/relocs.c
-+++ b/arch/x86/boot/compressed/relocs.c
-@@ -402,13 +402,11 @@ static void print_absolute_symbols(void)
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
--		Elf32_Sym *sh_symtab;
- 		int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
- 		}
--		sh_symtab = sec->symtab;
- 		sym_strtab = sec->link->strtab;
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Sym); j++) {
- 			Elf32_Sym *sym;
-diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
-index f98d84c..c4e3581 100644
---- a/arch/x86/kernel/apic/apic.c
-+++ b/arch/x86/kernel/apic/apic.c
-@@ -1577,9 +1577,11 @@ static int __init apic_verify(void)
- 	mp_lapic_addr = APIC_DEFAULT_PHYS_BASE;
- 
- 	/* The BIOS may have set up the APIC at some other address */
--	rdmsr(MSR_IA32_APICBASE, l, h);
--	if (l & MSR_IA32_APICBASE_ENABLE)
--		mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
-+	if (boot_cpu_data.x86 >= 6) {
-+		rdmsr(MSR_IA32_APICBASE, l, h);
-+		if (l & MSR_IA32_APICBASE_ENABLE)
-+			mp_lapic_addr = l & MSR_IA32_APICBASE_BASE;
-+	}
- 
- 	pr_info("Found and enabled local APIC!\n");
- 	return 0;
-@@ -1597,13 +1599,15 @@ int __init apic_force_enable(unsigned long addr)
- 	 * MSR. This can only be done in software for Intel P6 or later
- 	 * and AMD K7 (Model > 1) or later.
- 	 */
--	rdmsr(MSR_IA32_APICBASE, l, h);
--	if (!(l & MSR_IA32_APICBASE_ENABLE)) {
--		pr_info("Local APIC disabled by BIOS -- reenabling.\n");
--		l &= ~MSR_IA32_APICBASE_BASE;
--		l |= MSR_IA32_APICBASE_ENABLE | addr;
--		wrmsr(MSR_IA32_APICBASE, l, h);
--		enabled_via_apicbase = 1;
-+	if (boot_cpu_data.x86 >= 6) {
-+		rdmsr(MSR_IA32_APICBASE, l, h);
-+		if (!(l & MSR_IA32_APICBASE_ENABLE)) {
-+			pr_info("Local APIC disabled by BIOS -- reenabling.\n");
-+			l &= ~MSR_IA32_APICBASE_BASE;
-+			l |= MSR_IA32_APICBASE_ENABLE | addr;
-+			wrmsr(MSR_IA32_APICBASE, l, h);
-+			enabled_via_apicbase = 1;
-+		}
- 	}
- 	return apic_verify();
- }
-@@ -2149,10 +2153,12 @@ static void lapic_resume(void)
- 		 * FIXME! This will be wrong if we ever support suspend on
- 		 * SMP! We'll need to do this as part of the CPU restore!
- 		 */
--		rdmsr(MSR_IA32_APICBASE, l, h);
--		l &= ~MSR_IA32_APICBASE_BASE;
--		l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
--		wrmsr(MSR_IA32_APICBASE, l, h);
-+		if (boot_cpu_data.x86 >= 6) {
-+			rdmsr(MSR_IA32_APICBASE, l, h);
-+			l &= ~MSR_IA32_APICBASE_BASE;
-+			l |= MSR_IA32_APICBASE_ENABLE | mp_lapic_addr;
-+			wrmsr(MSR_IA32_APICBASE, l, h);
-+		}
- 	}
- 
- 	maxlvt = lapic_get_maxlvt();
-diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/microcode_core.c
-index 9d46f5e..563a09d 100644
---- a/arch/x86/kernel/microcode_core.c
-+++ b/arch/x86/kernel/microcode_core.c
-@@ -418,10 +418,8 @@ static int mc_sysdev_add(struct sys_device *sys_dev)
- 	if (err)
- 		return err;
- 
--	if (microcode_init_cpu(cpu) == UCODE_ERROR) {
--		sysfs_remove_group(&sys_dev->kobj, &mc_attr_group);
-+	if (microcode_init_cpu(cpu) == UCODE_ERROR)
- 		return -EINVAL;
--	}
- 
- 	return err;
- }
-diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
-index 71f4727..5a98aa2 100644
---- a/arch/x86/kernel/setup_percpu.c
-+++ b/arch/x86/kernel/setup_percpu.c
-@@ -185,10 +185,22 @@ void __init setup_per_cpu_areas(void)
- #endif
- 	rc = -EINVAL;
- 	if (pcpu_chosen_fc != PCPU_FC_PAGE) {
--		const size_t atom_size = cpu_has_pse ? PMD_SIZE : PAGE_SIZE;
- 		const size_t dyn_size = PERCPU_MODULE_RESERVE +
- 			PERCPU_DYNAMIC_RESERVE - PERCPU_FIRST_CHUNK_RESERVE;
-+		size_t atom_size;
- 
-+		/*
-+		 * On 64bit, use PMD_SIZE for atom_size so that embedded
-+		 * percpu areas are aligned to PMD.  This, in the future,
-+		 * can also allow using PMD mappings in vmalloc area.  Use
-+		 * PAGE_SIZE on 32bit as vmalloc space is highly contended
-+		 * and large vmalloc area allocs can easily fail.
-+		 */
-+#ifdef CONFIG_X86_64
-+		atom_size = PMD_SIZE;
-+#else
-+		atom_size = PAGE_SIZE;
-+#endif
- 		rc = pcpu_embed_first_chunk(PERCPU_FIRST_CHUNK_RESERVE,
- 					    dyn_size, atom_size,
- 					    pcpu_cpu_distance,
-diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 1f92865..e7c920b 100644
---- a/arch/x86/xen/enlighten.c
-+++ b/arch/x86/xen/enlighten.c
-@@ -62,6 +62,7 @@
- #include <asm/reboot.h>
- #include <asm/stackprotector.h>
- #include <asm/hypervisor.h>
-+#include <asm/pci_x86.h>
- 
- #include "xen-ops.h"
- #include "mmu.h"
-@@ -1278,8 +1279,10 @@ asmlinkage void __init xen_start_kernel(void)
- 		/* Make sure ACS will be enabled */
- 		pci_request_acs();
- 	}
--		
--
-+#ifdef CONFIG_PCI
-+	/* PCI BIOS service won't work from a PV guest. */
-+	pci_probe &= ~PCI_PROBE_BIOS;
-+#endif
- 	xen_raw_console_write("about to get started...\n");
- 
- 	xen_setup_runstate_info(0);
-diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 87f6673..ec3d603 100644
---- a/arch/x86/xen/mmu.c
-+++ b/arch/x86/xen/mmu.c
-@@ -353,8 +353,13 @@ static pteval_t pte_mfn_to_pfn(pteval_t val)
- {
- 	if (val & _PAGE_PRESENT) {
- 		unsigned long mfn = (val & PTE_PFN_MASK) >> PAGE_SHIFT;
-+		unsigned long pfn = mfn_to_pfn(mfn);
-+
- 		pteval_t flags = val & PTE_FLAGS_MASK;
--		val = ((pteval_t)mfn_to_pfn(mfn) << PAGE_SHIFT) | flags;
-+		if (unlikely(pfn == ~0))
-+			val = flags & ~_PAGE_PRESENT;
-+		else
-+			val = ((pteval_t)pfn << PAGE_SHIFT) | flags;
- 	}
- 
- 	return val;
-diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
-index 041d4fe..9a23fff 100644
---- a/arch/x86/xen/smp.c
-+++ b/arch/x86/xen/smp.c
-@@ -172,6 +172,7 @@ static void __init xen_fill_possible_map(void)
- static void __init xen_filter_cpu_maps(void)
- {
- 	int i, rc;
-+	unsigned int subtract = 0;
- 
- 	if (!xen_initial_domain())
- 		return;
-@@ -186,8 +187,22 @@ static void __init xen_filter_cpu_maps(void)
- 		} else {
- 			set_cpu_possible(i, false);
- 			set_cpu_present(i, false);
-+			subtract++;
- 		}
- 	}
-+#ifdef CONFIG_HOTPLUG_CPU
-+	/* This is akin to using 'nr_cpus' on the Linux command line.
-+	 * Which is OK as when we use 'dom0_max_vcpus=X' we can only
-+	 * have up to X, while nr_cpu_ids is greater than X. This
-+	 * normally is not a problem, except when CPU hotplugging
-+	 * is involved and then there might be more than X CPUs
-+	 * in the guest - which will not work as there is no
-+	 * hypercall to expand the max number of VCPUs an already
-+	 * running guest has. So cap it up to X. */
-+	if (subtract)
-+		nr_cpu_ids = nr_cpu_ids - subtract;
-+#endif
-+
- }
- 
- static void __init xen_smp_prepare_boot_cpu(void)
-diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
-index 79d7362..3e45aa0 100644
---- a/arch/x86/xen/xen-asm.S
-+++ b/arch/x86/xen/xen-asm.S
-@@ -96,7 +96,7 @@ ENTRY(xen_restore_fl_direct)
- 
- 	/* check for unmasked and pending */
- 	cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
--	jz 1f
-+	jnz 1f
- 2:	call check_events
- 1:
- ENDPATCH(xen_restore_fl_direct)
-diff --git a/crypto/sha512_generic.c b/crypto/sha512_generic.c
-index 107f6f7..dd30f40 100644
---- a/crypto/sha512_generic.c
-+++ b/crypto/sha512_generic.c
-@@ -174,7 +174,7 @@ sha512_update(struct shash_desc *desc, const u8 *data, unsigned int len)
- 	index = sctx->count[0] & 0x7f;
- 
- 	/* Update number of bytes */
--	if (!(sctx->count[0] += len))
-+	if ((sctx->count[0] += len) < len)
- 		sctx->count[1]++;
- 
-         part_len = 128 - index;
-diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
-index a9b2820..58db834 100644
---- a/drivers/ata/libata-eh.c
-+++ b/drivers/ata/libata-eh.c
-@@ -3500,7 +3500,8 @@ static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg
- 	u64 now = get_jiffies_64();
- 	int *trials = void_arg;
- 
--	if (ent->timestamp < now - min(now, interval))
-+	if ((ent->eflags & ATA_EFLAG_OLD_ER) ||
-+	    (ent->timestamp < now - min(now, interval)))
- 		return -1;
- 
- 	(*trials)++;
-diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
-index 003cd8d..99fefbd 100644
---- a/drivers/bluetooth/ath3k.c
-+++ b/drivers/bluetooth/ath3k.c
-@@ -73,6 +73,7 @@ static struct usb_device_id ath3k_table[] = {
- 	{ USB_DEVICE(0x0CF3, 0x3004) },
- 	{ USB_DEVICE(0x0CF3, 0x311D) },
- 	{ USB_DEVICE(0x13d3, 0x3375) },
-+	{ USB_DEVICE(0x04CA, 0x3005) },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xE02C) },
-@@ -91,6 +92,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
- 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
- 
- 	{ }	/* Terminating entry */
- };
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index db44ad5..e56da6a 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -129,6 +129,7 @@ static struct usb_device_id blacklist_table[] = {
- 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
- 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
-+	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
- 
- 	/* Atheros AR5BBU12 with sflash firmware */
- 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
-diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
-index a60adbf..79dcf6e 100644
---- a/drivers/dma/at_hdmac.c
-+++ b/drivers/dma/at_hdmac.c
-@@ -239,10 +239,6 @@ static void atc_dostart(struct at_dma_chan *atchan, struct at_desc *first)
- 
- 	vdbg_dump_regs(atchan);
- 
--	/* clear any pending interrupt */
--	while (dma_readl(atdma, EBCISR))
--		cpu_relax();
--
- 	channel_writel(atchan, SADDR, 0);
- 	channel_writel(atchan, DADDR, 0);
- 	channel_writel(atchan, CTRLA, 0);
-diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
-index b0a8117..0535c21 100644
---- a/drivers/firmware/efivars.c
-+++ b/drivers/firmware/efivars.c
-@@ -191,6 +191,190 @@ utf16_strncmp(const efi_char16_t *a, const efi_char16_t *b, size_t len)
- 	}
- }
- 
-+static bool
-+validate_device_path(struct efi_variable *var, int match, u8 *buffer,
-+		     unsigned long len)
-+{
-+	struct efi_generic_dev_path *node;
-+	int offset = 0;
-+
-+	node = (struct efi_generic_dev_path *)buffer;
-+
-+	if (len < sizeof(*node))
-+		return false;
-+
-+	while (offset <= len - sizeof(*node) &&
-+	       node->length >= sizeof(*node) &&
-+		node->length <= len - offset) {
-+		offset += node->length;
-+
-+		if ((node->type == EFI_DEV_END_PATH ||
-+		     node->type == EFI_DEV_END_PATH2) &&
-+		    node->sub_type == EFI_DEV_END_ENTIRE)
-+			return true;
-+
-+		node = (struct efi_generic_dev_path *)(buffer + offset);
-+	}
-+
-+	/*
-+	 * If we're here then either node->length pointed past the end
-+	 * of the buffer or we reached the end of the buffer without
-+	 * finding a device path end node.
-+	 */
-+	return false;
-+}
-+
-+static bool
-+validate_boot_order(struct efi_variable *var, int match, u8 *buffer,
-+		    unsigned long len)
-+{
-+	/* An array of 16-bit integers */
-+	if ((len % 2) != 0)
-+		return false;
-+
-+	return true;
-+}
-+
-+static bool
-+validate_load_option(struct efi_variable *var, int match, u8 *buffer,
-+		     unsigned long len)
-+{
-+	u16 filepathlength;
-+	int i, desclength = 0, namelen;
-+
-+	namelen = utf16_strnlen(var->VariableName, sizeof(var->VariableName));
-+
-+	/* Either "Boot" or "Driver" followed by four digits of hex */
-+	for (i = match; i < match+4; i++) {
-+		if (var->VariableName[i] > 127 ||
-+		    hex_to_bin(var->VariableName[i] & 0xff) < 0)
-+			return true;
-+	}
-+
-+	/* Reject it if there's 4 digits of hex and then further content */
-+	if (namelen > match + 4)
-+		return false;
-+
-+	/* A valid entry must be at least 8 bytes */
-+	if (len < 8)
-+		return false;
-+
-+	filepathlength = buffer[4] | buffer[5] << 8;
-+
-+	/*
-+	 * There's no stored length for the description, so it has to be
-+	 * found by hand
-+	 */
-+	desclength = utf16_strsize((efi_char16_t *)(buffer + 6), len - 6) + 2;
-+
-+	/* Each boot entry must have a descriptor */
-+	if (!desclength)
-+		return false;
-+
-+	/*
-+	 * If the sum of the length of the description, the claimed filepath
-+	 * length and the original header are greater than the length of the
-+	 * variable, it's malformed
-+	 */
-+	if ((desclength + filepathlength + 6) > len)
-+		return false;
-+
-+	/*
-+	 * And, finally, check the filepath
-+	 */
-+	return validate_device_path(var, match, buffer + desclength + 6,
-+				    filepathlength);
-+}
-+
-+static bool
-+validate_uint16(struct efi_variable *var, int match, u8 *buffer,
-+		unsigned long len)
-+{
-+	/* A single 16-bit integer */
-+	if (len != 2)
-+		return false;
-+
-+	return true;
-+}
-+
-+static bool
-+validate_ascii_string(struct efi_variable *var, int match, u8 *buffer,
-+		      unsigned long len)
-+{
-+	int i;
-+
-+	for (i = 0; i < len; i++) {
-+		if (buffer[i] > 127)
-+			return false;
-+
-+		if (buffer[i] == 0)
-+			return true;
-+	}
-+
-+	return false;
-+}
-+
-+struct variable_validate {
-+	char *name;
-+	bool (*validate)(struct efi_variable *var, int match, u8 *data,
-+			 unsigned long len);
-+};
-+
-+static const struct variable_validate variable_validate[] = {
-+	{ "BootNext", validate_uint16 },
-+	{ "BootOrder", validate_boot_order },
-+	{ "DriverOrder", validate_boot_order },
-+	{ "Boot*", validate_load_option },
-+	{ "Driver*", validate_load_option },
-+	{ "ConIn", validate_device_path },
-+	{ "ConInDev", validate_device_path },
-+	{ "ConOut", validate_device_path },
-+	{ "ConOutDev", validate_device_path },
-+	{ "ErrOut", validate_device_path },
-+	{ "ErrOutDev", validate_device_path },
-+	{ "Timeout", validate_uint16 },
-+	{ "Lang", validate_ascii_string },
-+	{ "PlatformLang", validate_ascii_string },
-+	{ "", NULL },
-+};
-+
-+static bool
-+validate_var(struct efi_variable *var, u8 *data, unsigned long len)
-+{
-+	int i;
-+	u16 *unicode_name = var->VariableName;
-+
-+	for (i = 0; variable_validate[i].validate != NULL; i++) {
-+		const char *name = variable_validate[i].name;
-+		int match;
-+
-+		for (match = 0; ; match++) {
-+			char c = name[match];
-+			u16 u = unicode_name[match];
-+
-+			/* All special variables are plain ascii */
-+			if (u > 127)
-+				return true;
-+
-+			/* Wildcard in the matching name means we've matched */
-+			if (c == '*')
-+				return variable_validate[i].validate(var,
-+							     match, data, len);
-+
-+			/* Case sensitive match */
-+			if (c != u)
-+				break;
-+
-+			/* Reached the end of the string while matching */
-+			if (!c)
-+				return variable_validate[i].validate(var,
-+							     match, data, len);
-+		}
-+	}
-+
-+	return true;
-+}
-+
- static efi_status_t
- get_var_data_locked(struct efivars *efivars, struct efi_variable *var)
- {
-@@ -324,6 +508,12 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count)
- 		return -EINVAL;
- 	}
- 
-+	if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
-+	    validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
-+		printk(KERN_ERR "efivars: Malformed variable content\n");
-+		return -EINVAL;
-+	}
-+
- 	spin_lock(&efivars->lock);
- 	status = efivars->ops->set_variable(new_var->VariableName,
- 					    &new_var->VendorGuid,
-@@ -624,6 +814,12 @@ static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
- 	if (!capable(CAP_SYS_ADMIN))
- 		return -EACCES;
- 
-+	if ((new_var->Attributes & ~EFI_VARIABLE_MASK) != 0 ||
-+	    validate_var(new_var, new_var->Data, new_var->DataSize) == false) {
-+		printk(KERN_ERR "efivars: Malformed variable content\n");
-+		return -EINVAL;
-+	}
-+
- 	spin_lock(&efivars->lock);
- 
- 	/*
-diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index b9da890..a6c2f7a 100644
---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-@@ -984,6 +984,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- 	struct intel_ring_buffer *ring;
- 	u32 exec_start, exec_len;
- 	u32 seqno;
-+	u32 mask;
- 	int ret, mode, i;
- 
- 	if (!i915_gem_check_execbuffer(args)) {
-@@ -1021,6 +1022,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- 	}
- 
- 	mode = args->flags & I915_EXEC_CONSTANTS_MASK;
-+	mask = I915_EXEC_CONSTANTS_MASK;
- 	switch (mode) {
- 	case I915_EXEC_CONSTANTS_REL_GENERAL:
- 	case I915_EXEC_CONSTANTS_ABSOLUTE:
-@@ -1034,18 +1036,9 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- 			    mode == I915_EXEC_CONSTANTS_REL_SURFACE)
- 				return -EINVAL;
- 
--			ret = intel_ring_begin(ring, 4);
--			if (ret)
--				return ret;
--
--			intel_ring_emit(ring, MI_NOOP);
--			intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
--			intel_ring_emit(ring, INSTPM);
--			intel_ring_emit(ring,
--					I915_EXEC_CONSTANTS_MASK << 16 | mode);
--			intel_ring_advance(ring);
--
--			dev_priv->relative_constants_mode = mode;
-+			/* The HW changed the meaning on this bit on gen6 */
-+			if (INTEL_INFO(dev)->gen >= 6)
-+				mask &= ~I915_EXEC_CONSTANTS_REL_SURFACE;
- 		}
- 		break;
- 	default:
-@@ -1064,6 +1057,11 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- 			return -EINVAL;
- 		}
- 
-+		if (args->num_cliprects > UINT_MAX / sizeof(*cliprects)) {
-+			DRM_DEBUG("execbuf with %u cliprects\n",
-+				  args->num_cliprects);
-+			return -EINVAL;
-+		}
- 		cliprects = kmalloc(args->num_cliprects * sizeof(*cliprects),
- 				    GFP_KERNEL);
- 		if (cliprects == NULL) {
-@@ -1176,6 +1174,21 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
- 		}
- 	}
- 
-+	if (ring == &dev_priv->ring[RCS] &&
-+	    mode != dev_priv->relative_constants_mode) {
-+		ret = intel_ring_begin(ring, 4);
-+		if (ret)
-+				goto err;
-+
-+		intel_ring_emit(ring, MI_NOOP);
-+		intel_ring_emit(ring, MI_LOAD_REGISTER_IMM(1));
-+		intel_ring_emit(ring, INSTPM);
-+		intel_ring_emit(ring, mask << 16 | mode);
-+		intel_ring_advance(ring);
-+
-+		dev_priv->relative_constants_mode = mode;
-+	}
-+
- 	trace_i915_gem_ring_dispatch(ring, seqno);
- 
- 	exec_start = batch_obj->gtt_offset + args->batch_start_offset;
-@@ -1314,7 +1327,8 @@ i915_gem_execbuffer2(struct drm_device *dev, void *data,
- 	struct drm_i915_gem_exec_object2 *exec2_list = NULL;
- 	int ret;
- 
--	if (args->buffer_count < 1) {
-+	if (args->buffer_count < 1 ||
-+	    args->buffer_count > UINT_MAX / sizeof(*exec2_list)) {
- 		DRM_ERROR("execbuf2 with %d buffers\n", args->buffer_count);
- 		return -EINVAL;
- 	}
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 2f99fd4..cbe5a88 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -442,6 +442,7 @@
- #define   INSTPM_AGPBUSY_DIS (1<<11) /* gen3: when disabled, pending interrupts
- 					will not assert AGPBUSY# and will only
- 					be delivered when out of C3. */
-+#define   INSTPM_FORCE_ORDERING				(1<<7) /* GEN6+ */
- #define ACTHD	        0x020c8
- #define FW_BLC		0x020d8
- #define FW_BLC2		0x020dc
-@@ -522,6 +523,7 @@
- #define   CM0_MASK_SHIFT          16
- #define   CM0_IZ_OPT_DISABLE      (1<<6)
- #define   CM0_ZR_OPT_DISABLE      (1<<5)
-+#define	  CM0_STC_EVICT_DISABLE_LRA_SNB	(1<<5)
- #define   CM0_DEPTH_EVICT_DISABLE (1<<4)
- #define   CM0_COLOR_EVICT_DISABLE (1<<3)
- #define   CM0_DEPTH_WRITE_DISABLE (1<<1)
-diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
-index 64541f7..9cd81ba 100644
---- a/drivers/gpu/drm/i915/intel_hdmi.c
-+++ b/drivers/gpu/drm/i915/intel_hdmi.c
-@@ -136,7 +136,7 @@ static void i9xx_write_infoframe(struct drm_encoder *encoder,
- 
- 	val &= ~VIDEO_DIP_SELECT_MASK;
- 
--	I915_WRITE(VIDEO_DIP_CTL, val | port | flags);
-+	I915_WRITE(VIDEO_DIP_CTL, VIDEO_DIP_ENABLE | val | port | flags);
- 
- 	for (i = 0; i < len; i += 4) {
- 		I915_WRITE(VIDEO_DIP_DATA, *data);
-diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
-index 8673581..62f9ac5 100644
---- a/drivers/gpu/drm/i915/intel_ringbuffer.c
-+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
-@@ -414,6 +414,22 @@ static int init_render_ring(struct intel_ring_buffer *ring)
- 			return ret;
- 	}
- 
-+
-+	if (IS_GEN6(dev)) {
-+		/* From the Sandybridge PRM, volume 1 part 3, page 24:
-+		 * "If this bit is set, STCunit will have LRA as replacement
-+		 *  policy. [...] This bit must be reset.  LRA replacement
-+		 *  policy is not supported."
-+		 */
-+		I915_WRITE(CACHE_MODE_0,
-+			   CM0_STC_EVICT_DISABLE_LRA_SNB << CM0_MASK_SHIFT);
-+	}
-+
-+	if (INTEL_INFO(dev)->gen >= 6) {
-+		I915_WRITE(INSTPM,
-+			   INSTPM_FORCE_ORDERING << 16 | INSTPM_FORCE_ORDERING);
-+	}
-+
- 	return ret;
- }
- 
-diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
-index e334ec3..8eddcca 100644
---- a/drivers/gpu/drm/i915/intel_sdvo.c
-+++ b/drivers/gpu/drm/i915/intel_sdvo.c
-@@ -731,6 +731,7 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
- 	uint16_t width, height;
- 	uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
- 	uint16_t h_sync_offset, v_sync_offset;
-+	int mode_clock;
- 
- 	width = mode->crtc_hdisplay;
- 	height = mode->crtc_vdisplay;
-@@ -745,7 +746,11 @@ static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
- 	h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
- 	v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
- 
--	dtd->part1.clock = mode->clock / 10;
-+	mode_clock = mode->clock;
-+	mode_clock /= intel_mode_get_pixel_multiplier(mode) ?: 1;
-+	mode_clock /= 10;
-+	dtd->part1.clock = mode_clock;
-+
- 	dtd->part1.h_active = width & 0xff;
- 	dtd->part1.h_blank = h_blank_len & 0xff;
- 	dtd->part1.h_high = (((width >> 8) & 0xf) << 4) |
-@@ -997,7 +1002,7 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
- 	struct intel_sdvo *intel_sdvo = to_intel_sdvo(encoder);
- 	u32 sdvox;
- 	struct intel_sdvo_in_out_map in_out;
--	struct intel_sdvo_dtd input_dtd;
-+	struct intel_sdvo_dtd input_dtd, output_dtd;
- 	int pixel_multiplier = intel_mode_get_pixel_multiplier(adjusted_mode);
- 	int rate;
- 
-@@ -1022,20 +1027,13 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
- 					  intel_sdvo->attached_output))
- 		return;
- 
--	/* We have tried to get input timing in mode_fixup, and filled into
--	 * adjusted_mode.
--	 */
--	if (intel_sdvo->is_tv || intel_sdvo->is_lvds) {
--		input_dtd = intel_sdvo->input_dtd;
--	} else {
--		/* Set the output timing to the screen */
--		if (!intel_sdvo_set_target_output(intel_sdvo,
--						  intel_sdvo->attached_output))
--			return;
--
--		intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
--		(void) intel_sdvo_set_output_timing(intel_sdvo, &input_dtd);
--	}
-+	/* lvds has a special fixed output timing. */
-+	if (intel_sdvo->is_lvds)
-+		intel_sdvo_get_dtd_from_mode(&output_dtd,
-+					     intel_sdvo->sdvo_lvds_fixed_mode);
-+	else
-+		intel_sdvo_get_dtd_from_mode(&output_dtd, mode);
-+	(void) intel_sdvo_set_output_timing(intel_sdvo, &output_dtd);
- 
- 	/* Set the input timing to the screen. Assume always input 0. */
- 	if (!intel_sdvo_set_target_input(intel_sdvo))
-@@ -1053,6 +1051,10 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
- 	    !intel_sdvo_set_tv_format(intel_sdvo))
- 		return;
- 
-+	/* We have tried to get input timing in mode_fixup, and filled into
-+	 * adjusted_mode.
-+	 */
-+	intel_sdvo_get_dtd_from_mode(&input_dtd, adjusted_mode);
- 	(void) intel_sdvo_set_input_timing(intel_sdvo, &input_dtd);
- 
- 	switch (pixel_multiplier) {
-@@ -1219,8 +1221,14 @@ static bool intel_sdvo_get_capabilities(struct intel_sdvo *intel_sdvo, struct in
- 
- static int intel_sdvo_supports_hotplug(struct intel_sdvo *intel_sdvo)
- {
-+	struct drm_device *dev = intel_sdvo->base.base.dev;
- 	u8 response[2];
- 
-+	/* HW Erratum: SDVO Hotplug is broken on all i945G chips, there's noise
-+	 * on the line. */
-+	if (IS_I945G(dev) || IS_I945GM(dev))
-+		return false;
-+
- 	return intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_HOT_PLUG_SUPPORT,
- 				    &response, 2) && response[0];
- }
-diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
-index 525744d..3df56c7 100644
---- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
-@@ -245,7 +245,7 @@ static bool nouveau_dsm_detect(void)
- 	struct acpi_buffer buffer = {sizeof(acpi_method_name), acpi_method_name};
- 	struct pci_dev *pdev = NULL;
- 	int has_dsm = 0;
--	int has_optimus;
-+	int has_optimus = 0;
- 	int vga_count = 0;
- 	bool guid_valid;
- 	int retval;
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index b30081f..757c549 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -917,8 +917,8 @@ static void atombios_crtc_set_pll(struct drm_crtc *crtc, struct drm_display_mode
- 		break;
- 	}
- 
--	if (radeon_encoder->active_device &
--	    (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) {
-+	if ((radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT | ATOM_DEVICE_DFP_SUPPORT)) ||
-+	    (radeon_encoder_get_dp_bridge_encoder_id(encoder) != ENCODER_OBJECT_ID_NONE)) {
- 		struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
- 		struct drm_connector *connector =
- 			radeon_get_connector_for_encoder(encoder);
-diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
-index 104b376..427468f 100644
---- a/drivers/hwmon/coretemp.c
-+++ b/drivers/hwmon/coretemp.c
-@@ -51,7 +51,7 @@ module_param_named(tjmax, force_tjmax, int, 0444);
- MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
- 
- #define BASE_SYSFS_ATTR_NO	2	/* Sysfs Base attr no for coretemp */
--#define NUM_REAL_CORES		16	/* Number of Real cores per cpu */
-+#define NUM_REAL_CORES		32	/* Number of Real cores per cpu */
- #define CORETEMP_NAME_LENGTH	17	/* String Length of attrs */
- #define MAX_CORE_ATTRS		4	/* Maximum no of basic attrs */
- #define TOTAL_ATTRS		(MAX_CORE_ATTRS + 1)
-@@ -705,6 +705,10 @@ static void __cpuinit put_core_offline(unsigned int cpu)
- 
- 	indx = TO_ATTR_NO(cpu);
- 
-+	/* The core id is too big, just return */
-+	if (indx > MAX_CORE_DATA - 1)
-+		return;
-+
- 	if (pdata->core_data[indx] && pdata->core_data[indx]->cpu == cpu)
- 		coretemp_remove_core(pdata, &pdev->dev, indx);
- 
-diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
-index 930370d..9a4c3ab 100644
---- a/drivers/hwmon/fam15h_power.c
-+++ b/drivers/hwmon/fam15h_power.c
-@@ -122,6 +122,41 @@ static bool __devinit fam15h_power_is_internal_node0(struct pci_dev *f4)
- 	return true;
- }
- 
-+/*
-+ * Newer BKDG versions have an updated recommendation on how to properly
-+ * initialize the running average range (was: 0xE, now: 0x9). This avoids
-+ * counter saturations resulting in bogus power readings.
-+ * We correct this value ourselves to cope with older BIOSes.
-+ */
-+static DEFINE_PCI_DEVICE_TABLE(affected_device) = {
-+	{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
-+	{ 0 }
-+};
-+
-+static void __devinit tweak_runavg_range(struct pci_dev *pdev)
-+{
-+	u32 val;
-+
-+	/*
-+	 * let this quirk apply only to the current version of the
-+	 * northbridge, since future versions may change the behavior
-+	 */
-+	if (!pci_match_id(affected_device, pdev))
-+		return;
-+
-+	pci_bus_read_config_dword(pdev->bus,
-+		PCI_DEVFN(PCI_SLOT(pdev->devfn), 5),
-+		REG_TDP_RUNNING_AVERAGE, &val);
-+	if ((val & 0xf) != 0xe)
-+		return;
-+
-+	val &= ~0xf;
-+	val |=  0x9;
-+	pci_bus_write_config_dword(pdev->bus,
-+		PCI_DEVFN(PCI_SLOT(pdev->devfn), 5),
-+		REG_TDP_RUNNING_AVERAGE, val);
-+}
-+
- static void __devinit fam15h_power_init_data(struct pci_dev *f4,
- 					     struct fam15h_power_data *data)
- {
-@@ -155,6 +190,13 @@ static int __devinit fam15h_power_probe(struct pci_dev *pdev,
- 	struct device *dev;
- 	int err;
- 
-+	/*
-+	 * though we ignore every other northbridge, we still have to
-+	 * do the tweaking on _each_ node in MCM processors as the counters
-+	 * are working hand-in-hand
-+	 */
-+	tweak_runavg_range(pdev);
-+
- 	if (!fam15h_power_is_internal_node0(pdev)) {
- 		err = -ENODEV;
- 		goto exit;
-diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
-index 04be9f8..eb8ad53 100644
---- a/drivers/i2c/busses/i2c-pnx.c
-+++ b/drivers/i2c/busses/i2c-pnx.c
-@@ -546,8 +546,7 @@ static int i2c_pnx_controller_suspend(struct platform_device *pdev,
- {
- 	struct i2c_pnx_algo_data *alg_data = platform_get_drvdata(pdev);
- 
--	/* FIXME: shouldn't this be clk_disable? */
--	clk_enable(alg_data->clk);
-+	clk_disable(alg_data->clk);
- 
- 	return 0;
- }
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 6f37aa4..065ab4f 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -8100,7 +8100,8 @@ static int md_notify_reboot(struct notifier_block *this,
- 
- 	for_each_mddev(mddev, tmp) {
- 		if (mddev_trylock(mddev)) {
--			__md_stop_writes(mddev);
-+			if (mddev->pers)
-+				__md_stop_writes(mddev);
- 			mddev->safemode = 2;
- 			mddev_unlock(mddev);
- 		}
-diff --git a/drivers/media/dvb/frontends/drxk_hard.c b/drivers/media/dvb/frontends/drxk_hard.c
-index f6431ef..a1f5e3d 100644
---- a/drivers/media/dvb/frontends/drxk_hard.c
-+++ b/drivers/media/dvb/frontends/drxk_hard.c
-@@ -1523,8 +1523,10 @@ static int scu_command(struct drxk_state *state,
- 	dprintk(1, "\n");
- 
- 	if ((cmd == 0) || ((parameterLen > 0) && (parameter == NULL)) ||
--	    ((resultLen > 0) && (result == NULL)))
--		goto error;
-+	    ((resultLen > 0) && (result == NULL))) {
-+		printk(KERN_ERR "drxk: Error %d on %s\n", status, __func__);
-+		return status;
-+	}
- 
- 	mutex_lock(&state->mutex);
- 
-diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
-index 13f54b5..a7e7d6f 100644
---- a/drivers/media/rc/winbond-cir.c
-+++ b/drivers/media/rc/winbond-cir.c
-@@ -1046,6 +1046,7 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
- 		goto exit_unregister_led;
- 	}
- 
-+	data->dev->driver_type = RC_DRIVER_IR_RAW;
- 	data->dev->driver_name = WBCIR_NAME;
- 	data->dev->input_name = WBCIR_NAME;
- 	data->dev->input_phys = "wbcir/cir0";
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index e15e47d..34416d4 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -799,7 +799,7 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
- {
- 	struct mmc_blk_data *md = mq->data;
- 	struct mmc_card *card = md->queue.card;
--	unsigned int from, nr, arg;
-+	unsigned int from, nr, arg, trim_arg, erase_arg;
- 	int err = 0, type = MMC_BLK_SECDISCARD;
- 
- 	if (!(mmc_can_secure_erase_trim(card) || mmc_can_sanitize(card))) {
-@@ -807,20 +807,26 @@ static int mmc_blk_issue_secdiscard_rq(struct mmc_queue *mq,
- 		goto out;
- 	}
- 
-+	from = blk_rq_pos(req);
-+	nr = blk_rq_sectors(req);
-+
- 	/* The sanitize operation is supported at v4.5 only */
- 	if (mmc_can_sanitize(card)) {
--		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
--				EXT_CSD_SANITIZE_START, 1, 0);
--		goto out;
-+		erase_arg = MMC_ERASE_ARG;
-+		trim_arg = MMC_TRIM_ARG;
-+	} else {
-+		erase_arg = MMC_SECURE_ERASE_ARG;
-+		trim_arg = MMC_SECURE_TRIM1_ARG;
- 	}
- 
--	from = blk_rq_pos(req);
--	nr = blk_rq_sectors(req);
--
--	if (mmc_can_trim(card) && !mmc_erase_group_aligned(card, from, nr))
--		arg = MMC_SECURE_TRIM1_ARG;
--	else
--		arg = MMC_SECURE_ERASE_ARG;
-+	if (mmc_erase_group_aligned(card, from, nr))
-+		arg = erase_arg;
-+	else if (mmc_can_trim(card))
-+		arg = trim_arg;
-+	else {
-+		err = -EINVAL;
-+		goto out;
-+	}
- retry:
- 	if (card->quirks & MMC_QUIRK_INAND_CMD38) {
- 		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
-@@ -830,25 +836,41 @@ retry:
- 				 INAND_CMD38_ARG_SECERASE,
- 				 0);
- 		if (err)
--			goto out;
-+			goto out_retry;
- 	}
-+
- 	err = mmc_erase(card, from, nr, arg);
--	if (!err && arg == MMC_SECURE_TRIM1_ARG) {
-+	if (err == -EIO)
-+		goto out_retry;
-+	if (err)
-+		goto out;
-+
-+	if (arg == MMC_SECURE_TRIM1_ARG) {
- 		if (card->quirks & MMC_QUIRK_INAND_CMD38) {
- 			err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
- 					 INAND_CMD38_ARG_EXT_CSD,
- 					 INAND_CMD38_ARG_SECTRIM2,
- 					 0);
- 			if (err)
--				goto out;
-+				goto out_retry;
- 		}
-+
- 		err = mmc_erase(card, from, nr, MMC_SECURE_TRIM2_ARG);
-+		if (err == -EIO)
-+			goto out_retry;
-+		if (err)
-+			goto out;
- 	}
--out:
--	if (err == -EIO && !mmc_blk_reset(md, card->host, type))
-+
-+	if (mmc_can_sanitize(card))
-+		err = mmc_switch(card, EXT_CSD_CMD_SET_NORMAL,
-+				 EXT_CSD_SANITIZE_START, 1, 0);
-+out_retry:
-+	if (err && !mmc_blk_reset(md, card->host, type))
- 		goto retry;
- 	if (!err)
- 		mmc_blk_reset_success(md, type);
-+out:
- 	spin_lock_irq(&md->lock);
- 	__blk_end_request(req, err, blk_rq_bytes(req));
- 	spin_unlock_irq(&md->lock);
-diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
-index dcad59c..78690f2 100644
---- a/drivers/mmc/card/queue.c
-+++ b/drivers/mmc/card/queue.c
-@@ -134,7 +134,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
- 
- 	queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, q);
- 	q->limits.max_discard_sectors = max_discard;
--	if (card->erased_byte == 0)
-+	if (card->erased_byte == 0 && !mmc_can_discard(card))
- 		q->limits.discard_zeroes_data = 1;
- 	q->limits.discard_granularity = card->pref_erase << 9;
- 	/* granularity must not be greater than max. discard */
-diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
-index 950b97d..411a994 100644
---- a/drivers/mmc/core/core.c
-+++ b/drivers/mmc/core/core.c
-@@ -1516,7 +1516,10 @@ static unsigned int mmc_mmc_erase_timeout(struct mmc_card *card,
- {
- 	unsigned int erase_timeout;
- 
--	if (card->ext_csd.erase_group_def & 1) {
-+	if (arg == MMC_DISCARD_ARG ||
-+	    (arg == MMC_TRIM_ARG && card->ext_csd.rev >= 6)) {
-+		erase_timeout = card->ext_csd.trim_timeout;
-+	} else if (card->ext_csd.erase_group_def & 1) {
- 		/* High Capacity Erase Group Size uses HC timeouts */
- 		if (arg == MMC_TRIM_ARG)
- 			erase_timeout = card->ext_csd.trim_timeout;
-@@ -1788,8 +1791,6 @@ int mmc_can_trim(struct mmc_card *card)
- {
- 	if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_GB_CL_EN)
- 		return 1;
--	if (mmc_can_discard(card))
--		return 1;
- 	return 0;
- }
- EXPORT_SYMBOL(mmc_can_trim);
-@@ -1808,6 +1809,8 @@ EXPORT_SYMBOL(mmc_can_discard);
- 
- int mmc_can_sanitize(struct mmc_card *card)
- {
-+	if (!mmc_can_trim(card) && !mmc_can_erase(card))
-+		return 0;
- 	if (card->ext_csd.sec_feature_support & EXT_CSD_SEC_SANITIZE)
- 		return 1;
- 	return 0;
-diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
-index 4540e37..1b47937 100644
---- a/drivers/mmc/host/sdhci-esdhc-imx.c
-+++ b/drivers/mmc/host/sdhci-esdhc-imx.c
-@@ -467,8 +467,7 @@ static int __devinit sdhci_esdhc_imx_probe(struct platform_device *pdev)
- 	clk_enable(clk);
- 	pltfm_host->clk = clk;
- 
--	if (!is_imx25_esdhc(imx_data))
--		host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
-+	host->quirks |= SDHCI_QUIRK_BROKEN_TIMEOUT_VAL;
- 
- 	if (is_imx25_esdhc(imx_data) || is_imx35_esdhc(imx_data))
- 		/* Fix errata ENGcm07207 present on i.MX25 and i.MX35 */
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index e58aa2b..f65e0b9 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -2982,7 +2982,11 @@ static void bond_ab_arp_commit(struct bonding *bond, int delta_in_ticks)
- 					   trans_start + delta_in_ticks)) ||
- 			    bond->curr_active_slave != slave) {
- 				slave->link = BOND_LINK_UP;
--				bond->current_arp_slave = NULL;
-+				if (bond->current_arp_slave) {
-+					bond_set_slave_inactive_flags(
-+						bond->current_arp_slave);
-+					bond->current_arp_slave = NULL;
-+				}
- 
- 				pr_info("%s: link status definitely up for interface %s.\n",
- 					bond->dev->name, slave->dev->name);
-diff --git a/drivers/net/dummy.c b/drivers/net/dummy.c
-index a7c5e88..eeac9ca 100644
---- a/drivers/net/dummy.c
-+++ b/drivers/net/dummy.c
-@@ -106,14 +106,14 @@ static int dummy_dev_init(struct net_device *dev)
- 	return 0;
- }
- 
--static void dummy_dev_free(struct net_device *dev)
-+static void dummy_dev_uninit(struct net_device *dev)
- {
- 	free_percpu(dev->dstats);
--	free_netdev(dev);
- }
- 
- static const struct net_device_ops dummy_netdev_ops = {
- 	.ndo_init		= dummy_dev_init,
-+	.ndo_uninit		= dummy_dev_uninit,
- 	.ndo_start_xmit		= dummy_xmit,
- 	.ndo_validate_addr	= eth_validate_addr,
- 	.ndo_set_rx_mode	= set_multicast_list,
-@@ -127,7 +127,7 @@ static void dummy_setup(struct net_device *dev)
- 
- 	/* Initialize the device structure. */
- 	dev->netdev_ops = &dummy_netdev_ops;
--	dev->destructor = dummy_dev_free;
-+	dev->destructor = free_netdev;
- 
- 	/* Fill in device structure with ethernet-generic values. */
- 	dev->tx_queue_len = 0;
-diff --git a/drivers/net/ethernet/atheros/atlx/atl1.c b/drivers/net/ethernet/atheros/atlx/atl1.c
-index 33a4e35..ee532e1 100644
---- a/drivers/net/ethernet/atheros/atlx/atl1.c
-+++ b/drivers/net/ethernet/atheros/atlx/atl1.c
-@@ -2473,7 +2473,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
- 					"pcie phy link down %x\n", status);
- 			if (netif_running(adapter->netdev)) {	/* reset MAC */
- 				iowrite32(0, adapter->hw.hw_addr + REG_IMR);
--				schedule_work(&adapter->pcie_dma_to_rst_task);
-+				schedule_work(&adapter->reset_dev_task);
- 				return IRQ_HANDLED;
- 			}
- 		}
-@@ -2485,7 +2485,7 @@ static irqreturn_t atl1_intr(int irq, void *data)
- 					"pcie DMA r/w error (status = 0x%x)\n",
- 					status);
- 			iowrite32(0, adapter->hw.hw_addr + REG_IMR);
--			schedule_work(&adapter->pcie_dma_to_rst_task);
-+			schedule_work(&adapter->reset_dev_task);
- 			return IRQ_HANDLED;
- 		}
- 
-@@ -2630,10 +2630,10 @@ static void atl1_down(struct atl1_adapter *adapter)
- 	atl1_clean_rx_ring(adapter);
- }
- 
--static void atl1_tx_timeout_task(struct work_struct *work)
-+static void atl1_reset_dev_task(struct work_struct *work)
- {
- 	struct atl1_adapter *adapter =
--		container_of(work, struct atl1_adapter, tx_timeout_task);
-+		container_of(work, struct atl1_adapter, reset_dev_task);
- 	struct net_device *netdev = adapter->netdev;
- 
- 	netif_device_detach(netdev);
-@@ -3032,12 +3032,10 @@ static int __devinit atl1_probe(struct pci_dev *pdev,
- 		    (unsigned long)adapter);
- 	adapter->phy_timer_pending = false;
- 
--	INIT_WORK(&adapter->tx_timeout_task, atl1_tx_timeout_task);
-+	INIT_WORK(&adapter->reset_dev_task, atl1_reset_dev_task);
- 
- 	INIT_WORK(&adapter->link_chg_task, atlx_link_chg_task);
- 
--	INIT_WORK(&adapter->pcie_dma_to_rst_task, atl1_tx_timeout_task);
--
- 	err = register_netdev(netdev);
- 	if (err)
- 		goto err_common;
-diff --git a/drivers/net/ethernet/atheros/atlx/atl1.h b/drivers/net/ethernet/atheros/atlx/atl1.h
-index 109d6da..e04bf4d 100644
---- a/drivers/net/ethernet/atheros/atlx/atl1.h
-+++ b/drivers/net/ethernet/atheros/atlx/atl1.h
-@@ -758,9 +758,8 @@ struct atl1_adapter {
- 	u16 link_speed;
- 	u16 link_duplex;
- 	spinlock_t lock;
--	struct work_struct tx_timeout_task;
-+	struct work_struct reset_dev_task;
- 	struct work_struct link_chg_task;
--	struct work_struct pcie_dma_to_rst_task;
- 
- 	struct timer_list phy_config_timer;
- 	bool phy_timer_pending;
-diff --git a/drivers/net/ethernet/atheros/atlx/atlx.c b/drivers/net/ethernet/atheros/atlx/atlx.c
-index aabcf4b..41c6d83 100644
---- a/drivers/net/ethernet/atheros/atlx/atlx.c
-+++ b/drivers/net/ethernet/atheros/atlx/atlx.c
-@@ -193,7 +193,7 @@ static void atlx_tx_timeout(struct net_device *netdev)
- {
- 	struct atlx_adapter *adapter = netdev_priv(netdev);
- 	/* Do the reset outside of interrupt context */
--	schedule_work(&adapter->tx_timeout_task);
-+	schedule_work(&adapter->reset_dev_task);
- }
- 
- /*
-diff --git a/drivers/net/ethernet/micrel/ks8851_mll.c b/drivers/net/ethernet/micrel/ks8851_mll.c
-index d19c849..77241b6 100644
---- a/drivers/net/ethernet/micrel/ks8851_mll.c
-+++ b/drivers/net/ethernet/micrel/ks8851_mll.c
-@@ -40,7 +40,7 @@
- #define	DRV_NAME	"ks8851_mll"
- 
- static u8 KS_DEFAULT_MAC_ADDRESS[] = { 0x00, 0x10, 0xA1, 0x86, 0x95, 0x11 };
--#define MAX_RECV_FRAMES			32
-+#define MAX_RECV_FRAMES			255
- #define MAX_BUF_SIZE			2048
- #define TX_BUF_SIZE			2000
- #define RX_BUF_SIZE			2000
-diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
-index 7ece990..4b9f4bd 100644
---- a/drivers/net/ethernet/micrel/ksz884x.c
-+++ b/drivers/net/ethernet/micrel/ksz884x.c
-@@ -5679,7 +5679,7 @@ static int netdev_set_mac_address(struct net_device *dev, void *addr)
- 		memcpy(hw->override_addr, mac->sa_data, MAC_ADDR_LEN);
- 	}
- 
--	memcpy(dev->dev_addr, mac->sa_data, MAX_ADDR_LEN);
-+	memcpy(dev->dev_addr, mac->sa_data, ETH_ALEN);
- 
- 	interrupt = hw_block_intr(hw);
- 
-diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
-index aba4f67..8f47907 100644
---- a/drivers/net/ethernet/realtek/8139cp.c
-+++ b/drivers/net/ethernet/realtek/8139cp.c
-@@ -961,6 +961,11 @@ static inline void cp_start_hw (struct cp_private *cp)
- 	cpw8(Cmd, RxOn | TxOn);
- }
- 
-+static void cp_enable_irq(struct cp_private *cp)
-+{
-+	cpw16_f(IntrMask, cp_intr_mask);
-+}
-+
- static void cp_init_hw (struct cp_private *cp)
- {
- 	struct net_device *dev = cp->dev;
-@@ -1000,8 +1005,6 @@ static void cp_init_hw (struct cp_private *cp)
- 
- 	cpw16(MultiIntr, 0);
- 
--	cpw16_f(IntrMask, cp_intr_mask);
--
- 	cpw8_f(Cfg9346, Cfg9346_Lock);
- }
- 
-@@ -1133,6 +1136,8 @@ static int cp_open (struct net_device *dev)
- 	if (rc)
- 		goto err_out_hw;
- 
-+	cp_enable_irq(cp);
-+
- 	netif_carrier_off(dev);
- 	mii_check_media(&cp->mii_if, netif_msg_link(cp), true);
- 	netif_start_queue(dev);
-@@ -2034,6 +2039,7 @@ static int cp_resume (struct pci_dev *pdev)
- 	/* FIXME: sh*t may happen if the Rx ring buffer is depleted */
- 	cp_init_rings_index (cp);
- 	cp_init_hw (cp);
-+	cp_enable_irq(cp);
- 	netif_start_queue (dev);
- 
- 	spin_lock_irqsave (&cp->lock, flags);
-diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c
-index 8843071..8c7dd21 100644
---- a/drivers/net/ethernet/smsc/smsc911x.c
-+++ b/drivers/net/ethernet/smsc/smsc911x.c
-@@ -1089,10 +1089,8 @@ smsc911x_rx_counterrors(struct net_device *dev, unsigned int rxstat)
- 
- /* Quickly dumps bad packets */
- static void
--smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
-+smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktwords)
- {
--	unsigned int pktwords = (pktbytes + NET_IP_ALIGN + 3) >> 2;
--
- 	if (likely(pktwords >= 4)) {
- 		unsigned int timeout = 500;
- 		unsigned int val;
-@@ -1156,7 +1154,7 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
- 			continue;
- 		}
- 
--		skb = netdev_alloc_skb(dev, pktlength + NET_IP_ALIGN);
-+		skb = netdev_alloc_skb(dev, pktwords << 2);
- 		if (unlikely(!skb)) {
- 			SMSC_WARN(pdata, rx_err,
- 				  "Unable to allocate skb for rx packet");
-@@ -1166,14 +1164,12 @@ static int smsc911x_poll(struct napi_struct *napi, int budget)
- 			break;
- 		}
- 
--		skb->data = skb->head;
--		skb_reset_tail_pointer(skb);
-+		pdata->ops->rx_readfifo(pdata,
-+				 (unsigned int *)skb->data, pktwords);
- 
- 		/* Align IP on 16B boundary */
- 		skb_reserve(skb, NET_IP_ALIGN);
- 		skb_put(skb, pktlength - 4);
--		pdata->ops->rx_readfifo(pdata,
--				 (unsigned int *)skb->head, pktwords);
- 		skb->protocol = eth_type_trans(skb, dev);
- 		skb_checksum_none_assert(skb);
- 		netif_receive_skb(skb);
-@@ -1396,7 +1392,7 @@ static int smsc911x_open(struct net_device *dev)
- 	smsc911x_reg_write(pdata, FIFO_INT, temp);
- 
- 	/* set RX Data offset to 2 bytes for alignment */
--	smsc911x_reg_write(pdata, RX_CFG, (2 << 8));
-+	smsc911x_reg_write(pdata, RX_CFG, (NET_IP_ALIGN << 8));
- 
- 	/* enable NAPI polling before enabling RX interrupts */
- 	napi_enable(&pdata->napi);
-diff --git a/drivers/net/ethernet/ti/davinci_mdio.c b/drivers/net/ethernet/ti/davinci_mdio.c
-index 7615040..f470ab6 100644
---- a/drivers/net/ethernet/ti/davinci_mdio.c
-+++ b/drivers/net/ethernet/ti/davinci_mdio.c
-@@ -181,6 +181,11 @@ static inline int wait_for_user_access(struct davinci_mdio_data *data)
- 		__davinci_mdio_reset(data);
- 		return -EAGAIN;
- 	}
-+
-+	reg = __raw_readl(&regs->user[0].access);
-+	if ((reg & USERACCESS_GO) == 0)
-+		return 0;
-+
- 	dev_err(data->dev, "timed out waiting for user access\n");
- 	return -ETIMEDOUT;
- }
-diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
-index 486b404..3ed983c 100644
---- a/drivers/net/ppp/ppp_generic.c
-+++ b/drivers/net/ppp/ppp_generic.c
-@@ -968,7 +968,6 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev)
- 	proto = npindex_to_proto[npi];
- 	put_unaligned_be16(proto, pp);
- 
--	netif_stop_queue(dev);
- 	skb_queue_tail(&ppp->file.xq, skb);
- 	ppp_xmit_process(ppp);
- 	return NETDEV_TX_OK;
-@@ -1063,6 +1062,8 @@ ppp_xmit_process(struct ppp *ppp)
- 		   code that we can accept some more. */
- 		if (!ppp->xmit_pending && !skb_peek(&ppp->file.xq))
- 			netif_wake_queue(ppp->dev);
-+		else
-+			netif_stop_queue(ppp->dev);
- 	}
- 	ppp_xmit_unlock(ppp);
- }
-diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
-index a5b9b12..7bd219b 100644
---- a/drivers/net/usb/smsc75xx.c
-+++ b/drivers/net/usb/smsc75xx.c
-@@ -1050,6 +1050,7 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
- 	dev->net->ethtool_ops = &smsc75xx_ethtool_ops;
- 	dev->net->flags |= IFF_MULTICAST;
- 	dev->net->hard_header_len += SMSC75XX_TX_OVERHEAD;
-+	dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
- 	return 0;
- }
- 
-diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
-index eff6767..55b3218 100644
---- a/drivers/net/usb/smsc95xx.c
-+++ b/drivers/net/usb/smsc95xx.c
-@@ -1190,7 +1190,7 @@ static const struct driver_info smsc95xx_info = {
- 	.rx_fixup	= smsc95xx_rx_fixup,
- 	.tx_fixup	= smsc95xx_tx_fixup,
- 	.status		= smsc95xx_status,
--	.flags		= FLAG_ETHER | FLAG_SEND_ZLP,
-+	.flags		= FLAG_ETHER | FLAG_SEND_ZLP | FLAG_LINK_INTR,
- };
- 
- static const struct usb_device_id products[] = {
-diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
-index 64a1106..4697cf3 100644
---- a/drivers/net/wimax/i2400m/netdev.c
-+++ b/drivers/net/wimax/i2400m/netdev.c
-@@ -607,7 +607,8 @@ static void i2400m_get_drvinfo(struct net_device *net_dev,
- 	struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
- 
- 	strncpy(info->driver, KBUILD_MODNAME, sizeof(info->driver) - 1);
--	strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1);
-+	strncpy(info->fw_version,
-+	        i2400m->fw_name ? : "", sizeof(info->fw_version) - 1);
- 	if (net_dev->dev.parent)
- 		strncpy(info->bus_info, dev_name(net_dev->dev.parent),
- 			sizeof(info->bus_info) - 1);
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 5634d9a..680709c 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -4820,8 +4820,14 @@ static int b43_op_start(struct ieee80211_hw *hw)
-  out_mutex_unlock:
- 	mutex_unlock(&wl->mutex);
- 
--	/* reload configuration */
--	b43_op_config(hw, ~0);
-+	/*
-+	 * Configuration may have been overwritten during initialization.
-+	 * Reload the configuration, but only if initialization was
-+	 * successful. Reloading the configuration after a failed init
-+	 * may hang the system.
-+	 */
-+	if (!err)
-+		b43_op_config(hw, ~0);
- 
- 	return err;
- }
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-index 453f58e..f98becc 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -7865,6 +7865,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
- {
- 	int len_mpdu;
- 	struct ieee80211_rx_status rx_status;
-+	struct ieee80211_hdr *hdr;
- 
- 	memset(&rx_status, 0, sizeof(rx_status));
- 	prep_mac80211_status(wlc, rxh, p, &rx_status);
-@@ -7874,6 +7875,13 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
- 	skb_pull(p, D11_PHY_HDR_LEN);
- 	__skb_trim(p, len_mpdu);
- 
-+	/* unmute transmit */
-+	if (wlc->hw->suspended_fifos) {
-+		hdr = (struct ieee80211_hdr *)p->data;
-+		if (ieee80211_is_beacon(hdr->frame_control))
-+			brcms_b_mute(wlc->hw, false);
-+	}
-+
- 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
- 	ieee80211_rx_irqsafe(wlc->pub->ieee_hw, p);
- }
-diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
-index 99a710d..827889b 100644
---- a/drivers/net/wireless/ipw2x00/ipw2200.c
-+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
-@@ -2183,6 +2183,7 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
- {
- 	int rc = 0;
- 	unsigned long flags;
-+	unsigned long now, end;
- 
- 	spin_lock_irqsave(&priv->lock, flags);
- 	if (priv->status & STATUS_HCMD_ACTIVE) {
-@@ -2224,10 +2225,20 @@ static int __ipw_send_cmd(struct ipw_priv *priv, struct host_cmd *cmd)
- 	}
- 	spin_unlock_irqrestore(&priv->lock, flags);
- 
-+	now = jiffies;
-+	end = now + HOST_COMPLETE_TIMEOUT;
-+again:
- 	rc = wait_event_interruptible_timeout(priv->wait_command_queue,
- 					      !(priv->
- 						status & STATUS_HCMD_ACTIVE),
--					      HOST_COMPLETE_TIMEOUT);
-+					      end - now);
-+	if (rc < 0) {
-+		now = jiffies;
-+		if (time_before(now, end))
-+			goto again;
-+		rc = 0;
-+	}
-+
- 	if (rc == 0) {
- 		spin_lock_irqsave(&priv->lock, flags);
- 		if (priv->status & STATUS_HCMD_ACTIVE) {
-diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
-index dd008b0..1e6c8cc 100644
---- a/drivers/net/wireless/iwlwifi/iwl-1000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
-@@ -45,8 +45,8 @@
- #include "iwl-cfg.h"
- 
- /* Highest firmware API version supported */
--#define IWL1000_UCODE_API_MAX 6
--#define IWL100_UCODE_API_MAX 6
-+#define IWL1000_UCODE_API_MAX 5
-+#define IWL100_UCODE_API_MAX 5
- 
- /* Oldest version we won't warn about */
- #define IWL1000_UCODE_API_OK 5
-@@ -244,5 +244,5 @@ struct iwl_cfg iwl100_bg_cfg = {
- 	IWL_DEVICE_100,
- };
- 
--MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_MAX));
-+MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL100_MODULE_FIRMWARE(IWL100_UCODE_API_OK));
-diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
-index 7943197..9823e41 100644
---- a/drivers/net/wireless/iwlwifi/iwl-2000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
-@@ -51,10 +51,10 @@
- #define IWL135_UCODE_API_MAX 6
- 
- /* Oldest version we won't warn about */
--#define IWL2030_UCODE_API_OK 5
--#define IWL2000_UCODE_API_OK 5
--#define IWL105_UCODE_API_OK 5
--#define IWL135_UCODE_API_OK 5
-+#define IWL2030_UCODE_API_OK 6
-+#define IWL2000_UCODE_API_OK 6
-+#define IWL105_UCODE_API_OK 6
-+#define IWL135_UCODE_API_OK 6
- 
- /* Lowest firmware API version supported */
- #define IWL2030_UCODE_API_MIN 5
-@@ -372,7 +372,7 @@ struct iwl_cfg iwl135_bgn_cfg = {
- 	.ht_params = &iwl2000_ht_params,
- };
- 
--MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_MAX));
-+MODULE_FIRMWARE(IWL2000_MODULE_FIRMWARE(IWL2000_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL2030_MODULE_FIRMWARE(IWL2030_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL105_MODULE_FIRMWARE(IWL105_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL135_MODULE_FIRMWARE(IWL135_UCODE_API_OK));
-diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
-index f55fb2d..606213f 100644
---- a/drivers/net/wireless/iwlwifi/iwl-5000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
-@@ -50,6 +50,10 @@
- #define IWL5000_UCODE_API_MAX 5
- #define IWL5150_UCODE_API_MAX 2
- 
-+/* Oldest version we won't warn about */
-+#define IWL5000_UCODE_API_OK 5
-+#define IWL5150_UCODE_API_OK 2
-+
- /* Lowest firmware API version supported */
- #define IWL5000_UCODE_API_MIN 1
- #define IWL5150_UCODE_API_MIN 1
-@@ -373,6 +377,7 @@ static struct iwl_ht_params iwl5000_ht_params = {
- #define IWL_DEVICE_5000						\
- 	.fw_name_pre = IWL5000_FW_PRE,				\
- 	.ucode_api_max = IWL5000_UCODE_API_MAX,			\
-+	.ucode_api_ok = IWL5000_UCODE_API_OK,			\
- 	.ucode_api_min = IWL5000_UCODE_API_MIN,			\
- 	.eeprom_ver = EEPROM_5000_EEPROM_VERSION,		\
- 	.eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,	\
-@@ -416,6 +421,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
- 	.name = "Intel(R) WiMAX/WiFi Link 5350 AGN",
- 	.fw_name_pre = IWL5000_FW_PRE,
- 	.ucode_api_max = IWL5000_UCODE_API_MAX,
-+	.ucode_api_ok = IWL5000_UCODE_API_OK,
- 	.ucode_api_min = IWL5000_UCODE_API_MIN,
- 	.eeprom_ver = EEPROM_5050_EEPROM_VERSION,
- 	.eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,
-@@ -429,6 +435,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
- #define IWL_DEVICE_5150						\
- 	.fw_name_pre = IWL5150_FW_PRE,				\
- 	.ucode_api_max = IWL5150_UCODE_API_MAX,			\
-+	.ucode_api_ok = IWL5150_UCODE_API_OK,			\
- 	.ucode_api_min = IWL5150_UCODE_API_MIN,			\
- 	.eeprom_ver = EEPROM_5050_EEPROM_VERSION,		\
- 	.eeprom_calib_ver = EEPROM_5050_TX_POWER_VERSION,	\
-@@ -450,5 +457,5 @@ struct iwl_cfg iwl5150_abg_cfg = {
- 	IWL_DEVICE_5150,
- };
- 
--MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_MAX));
-+MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL5150_MODULE_FIRMWARE(IWL5150_UCODE_API_OK));
-diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
-index c840c78..b4f809c 100644
---- a/drivers/net/wireless/iwlwifi/iwl-6000.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
-@@ -46,12 +46,15 @@
- #include "iwl-cfg.h"
- 
- /* Highest firmware API version supported */
--#define IWL6000_UCODE_API_MAX 4
-+#define IWL6000_UCODE_API_MAX 6
- #define IWL6050_UCODE_API_MAX 5
- #define IWL6000G2_UCODE_API_MAX 6
- 
- /* Oldest version we won't warn about */
-+#define IWL6000_UCODE_API_OK 4
- #define IWL6000G2_UCODE_API_OK 5
-+#define IWL6050_UCODE_API_OK 5
-+#define IWL6000G2B_UCODE_API_OK 6
- 
- /* Lowest firmware API version supported */
- #define IWL6000_UCODE_API_MIN 4
-@@ -399,7 +402,7 @@ struct iwl_cfg iwl6005_2agn_d_cfg = {
- #define IWL_DEVICE_6030						\
- 	.fw_name_pre = IWL6030_FW_PRE,				\
- 	.ucode_api_max = IWL6000G2_UCODE_API_MAX,		\
--	.ucode_api_ok = IWL6000G2_UCODE_API_OK,			\
-+	.ucode_api_ok = IWL6000G2B_UCODE_API_OK,		\
- 	.ucode_api_min = IWL6000G2_UCODE_API_MIN,		\
- 	.eeprom_ver = EEPROM_6030_EEPROM_VERSION,		\
- 	.eeprom_calib_ver = EEPROM_6030_TX_POWER_VERSION,	\
-@@ -479,6 +482,7 @@ struct iwl_cfg iwl130_bg_cfg = {
- #define IWL_DEVICE_6000i					\
- 	.fw_name_pre = IWL6000_FW_PRE,				\
- 	.ucode_api_max = IWL6000_UCODE_API_MAX,			\
-+	.ucode_api_ok = IWL6000_UCODE_API_OK,			\
- 	.ucode_api_min = IWL6000_UCODE_API_MIN,			\
- 	.valid_tx_ant = ANT_BC,		/* .cfg overwrite */	\
- 	.valid_rx_ant = ANT_BC,		/* .cfg overwrite */	\
-@@ -559,6 +563,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
- 	.name = "Intel(R) Centrino(R) Ultimate-N 6300 AGN",
- 	.fw_name_pre = IWL6000_FW_PRE,
- 	.ucode_api_max = IWL6000_UCODE_API_MAX,
-+	.ucode_api_ok = IWL6000_UCODE_API_OK,
- 	.ucode_api_min = IWL6000_UCODE_API_MIN,
- 	.eeprom_ver = EEPROM_6000_EEPROM_VERSION,
- 	.eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
-@@ -569,7 +574,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
- 	.led_mode = IWL_LED_BLINK,
- };
- 
--MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
--MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
-+MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL6005_MODULE_FIRMWARE(IWL6000G2_UCODE_API_OK));
-+MODULE_FIRMWARE(IWL6030_MODULE_FIRMWARE(IWL6000G2B_UCODE_API_OK));
-diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
-index e0e9a3d..d7d2512 100644
---- a/drivers/net/wireless/iwlwifi/iwl-agn.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
-@@ -1504,7 +1504,6 @@ static void iwl_bg_run_time_calib_work(struct work_struct *work)
- 
- static void iwlagn_prepare_restart(struct iwl_priv *priv)
- {
--	struct iwl_rxon_context *ctx;
- 	bool bt_full_concurrent;
- 	u8 bt_ci_compliance;
- 	u8 bt_load;
-@@ -1513,8 +1512,6 @@ static void iwlagn_prepare_restart(struct iwl_priv *priv)
- 
- 	lockdep_assert_held(&priv->shrd->mutex);
- 
--	for_each_context(priv, ctx)
--		ctx->vif = NULL;
- 	priv->is_open = 0;
- 
- 	/*
-diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
-index 3d75d4c..832ec4d 100644
---- a/drivers/net/wireless/iwlwifi/iwl-core.c
-+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
-@@ -1228,6 +1228,7 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
- 	struct iwl_rxon_context *tmp, *ctx = NULL;
- 	int err;
- 	enum nl80211_iftype viftype = ieee80211_vif_type_p2p(vif);
-+	bool reset = false;
- 
- 	IWL_DEBUG_MAC80211(priv, "enter: type %d, addr %pM\n",
- 			   viftype, vif->addr);
-@@ -1249,6 +1250,13 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
- 			tmp->interface_modes | tmp->exclusive_interface_modes;
- 
- 		if (tmp->vif) {
-+			/* On reset we need to add the same interface again */
-+			if (tmp->vif == vif) {
-+				reset = true;
-+				ctx = tmp;
-+				break;
-+			}
-+
- 			/* check if this busy context is exclusive */
- 			if (tmp->exclusive_interface_modes &
- 						BIT(tmp->vif->type)) {
-@@ -1275,7 +1283,7 @@ int iwlagn_mac_add_interface(struct ieee80211_hw *hw,
- 	ctx->vif = vif;
- 
- 	err = iwl_setup_interface(priv, ctx);
--	if (!err)
-+	if (!err || reset)
- 		goto out;
- 
- 	ctx->vif = NULL;
-diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
-index 5bede9d..aae992a 100644
---- a/drivers/net/wireless/iwlwifi/iwl-fh.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
-@@ -104,15 +104,29 @@
-  * (see struct iwl_tfd_frame).  These 16 pointer registers are offset by 0x04
-  * bytes from one another.  Each TFD circular buffer in DRAM must be 256-byte
-  * aligned (address bits 0-7 must be 0).
-+ * Later devices have 20 (5000 series) or 30 (higher) queues, but the registers
-+ * for them are in different places.
-  *
-  * Bit fields in each pointer register:
-  *  27-0: TFD CB physical base address [35:8], must be 256-byte aligned
-  */
--#define FH_MEM_CBBC_LOWER_BOUND          (FH_MEM_LOWER_BOUND + 0x9D0)
--#define FH_MEM_CBBC_UPPER_BOUND          (FH_MEM_LOWER_BOUND + 0xA10)
--
--/* Find TFD CB base pointer for given queue (range 0-15). */
--#define FH_MEM_CBBC_QUEUE(x)  (FH_MEM_CBBC_LOWER_BOUND + (x) * 0x4)
-+#define FH_MEM_CBBC_0_15_LOWER_BOUND		(FH_MEM_LOWER_BOUND + 0x9D0)
-+#define FH_MEM_CBBC_0_15_UPPER_BOUND		(FH_MEM_LOWER_BOUND + 0xA10)
-+#define FH_MEM_CBBC_16_19_LOWER_BOUND		(FH_MEM_LOWER_BOUND + 0xBF0)
-+#define FH_MEM_CBBC_16_19_UPPER_BOUND		(FH_MEM_LOWER_BOUND + 0xC00)
-+#define FH_MEM_CBBC_20_31_LOWER_BOUND		(FH_MEM_LOWER_BOUND + 0xB20)
-+#define FH_MEM_CBBC_20_31_UPPER_BOUND		(FH_MEM_LOWER_BOUND + 0xB80)
-+
-+/* Find TFD CB base pointer for given queue */
-+static inline unsigned int FH_MEM_CBBC_QUEUE(unsigned int chnl)
-+{
-+	if (chnl < 16)
-+		return FH_MEM_CBBC_0_15_LOWER_BOUND + 4 * chnl;
-+	if (chnl < 20)
-+		return FH_MEM_CBBC_16_19_LOWER_BOUND + 4 * (chnl - 16);
-+	WARN_ON_ONCE(chnl >= 32);
-+	return FH_MEM_CBBC_20_31_LOWER_BOUND + 4 * (chnl - 20);
-+}
- 
- 
- /**
-diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
-index bebdd82..d9b089e 100644
---- a/drivers/net/wireless/iwlwifi/iwl-prph.h
-+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
-@@ -227,12 +227,33 @@
- #define SCD_AIT			(SCD_BASE + 0x0c)
- #define SCD_TXFACT		(SCD_BASE + 0x10)
- #define SCD_ACTIVE		(SCD_BASE + 0x14)
--#define SCD_QUEUE_WRPTR(x)	(SCD_BASE + 0x18 + (x) * 4)
--#define SCD_QUEUE_RDPTR(x)	(SCD_BASE + 0x68 + (x) * 4)
- #define SCD_QUEUECHAIN_SEL	(SCD_BASE + 0xe8)
- #define SCD_AGGR_SEL		(SCD_BASE + 0x248)
- #define SCD_INTERRUPT_MASK	(SCD_BASE + 0x108)
--#define SCD_QUEUE_STATUS_BITS(x)	(SCD_BASE + 0x10c + (x) * 4)
-+
-+static inline unsigned int SCD_QUEUE_WRPTR(unsigned int chnl)
-+{
-+	if (chnl < 20)
-+		return SCD_BASE + 0x18 + chnl * 4;
-+	WARN_ON_ONCE(chnl >= 32);
-+	return SCD_BASE + 0x284 + (chnl - 20) * 4;
-+}
-+
-+static inline unsigned int SCD_QUEUE_RDPTR(unsigned int chnl)
-+{
-+	if (chnl < 20)
-+		return SCD_BASE + 0x68 + chnl * 4;
-+	WARN_ON_ONCE(chnl >= 32);
-+	return SCD_BASE + 0x2B4 + (chnl - 20) * 4;
-+}
-+
-+static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
-+{
-+	if (chnl < 20)
-+		return SCD_BASE + 0x10c + chnl * 4;
-+	WARN_ON_ONCE(chnl >= 32);
-+	return SCD_BASE + 0x384 + (chnl - 20) * 4;
-+}
- 
- /*********************** END TX SCHEDULER *************************************/
- 
-diff --git a/drivers/net/wireless/mwifiex/pcie.h b/drivers/net/wireless/mwifiex/pcie.h
-index 445ff21..2f218f9 100644
---- a/drivers/net/wireless/mwifiex/pcie.h
-+++ b/drivers/net/wireless/mwifiex/pcie.h
-@@ -48,15 +48,15 @@
- #define PCIE_HOST_INT_STATUS_MASK			0xC3C
- #define PCIE_SCRATCH_2_REG				0xC40
- #define PCIE_SCRATCH_3_REG				0xC44
--#define PCIE_SCRATCH_4_REG				0xCC0
--#define PCIE_SCRATCH_5_REG				0xCC4
--#define PCIE_SCRATCH_6_REG				0xCC8
--#define PCIE_SCRATCH_7_REG				0xCCC
--#define PCIE_SCRATCH_8_REG				0xCD0
--#define PCIE_SCRATCH_9_REG				0xCD4
--#define PCIE_SCRATCH_10_REG				0xCD8
--#define PCIE_SCRATCH_11_REG				0xCDC
--#define PCIE_SCRATCH_12_REG				0xCE0
-+#define PCIE_SCRATCH_4_REG				0xCD0
-+#define PCIE_SCRATCH_5_REG				0xCD4
-+#define PCIE_SCRATCH_6_REG				0xCD8
-+#define PCIE_SCRATCH_7_REG				0xCDC
-+#define PCIE_SCRATCH_8_REG				0xCE0
-+#define PCIE_SCRATCH_9_REG				0xCE4
-+#define PCIE_SCRATCH_10_REG				0xCE8
-+#define PCIE_SCRATCH_11_REG				0xCEC
-+#define PCIE_SCRATCH_12_REG				0xCF0
- 
- #define CPU_INTR_DNLD_RDY				BIT(0)
- #define CPU_INTR_DOOR_BELL				BIT(1)
-diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
-index cb71e88..0ffa111 100644
---- a/drivers/net/wireless/rt2x00/rt2800usb.c
-+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
-@@ -914,12 +914,14 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x050d, 0x8053) },
- 	{ USB_DEVICE(0x050d, 0x805c) },
- 	{ USB_DEVICE(0x050d, 0x815c) },
-+	{ USB_DEVICE(0x050d, 0x825a) },
- 	{ USB_DEVICE(0x050d, 0x825b) },
- 	{ USB_DEVICE(0x050d, 0x935a) },
- 	{ USB_DEVICE(0x050d, 0x935b) },
- 	/* Buffalo */
- 	{ USB_DEVICE(0x0411, 0x00e8) },
- 	{ USB_DEVICE(0x0411, 0x0158) },
-+	{ USB_DEVICE(0x0411, 0x015d) },
- 	{ USB_DEVICE(0x0411, 0x016f) },
- 	{ USB_DEVICE(0x0411, 0x01a2) },
- 	/* Corega */
-@@ -934,6 +936,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x07d1, 0x3c0e) },
- 	{ USB_DEVICE(0x07d1, 0x3c0f) },
- 	{ USB_DEVICE(0x07d1, 0x3c11) },
-+	{ USB_DEVICE(0x07d1, 0x3c13) },
-+	{ USB_DEVICE(0x07d1, 0x3c15) },
- 	{ USB_DEVICE(0x07d1, 0x3c16) },
- 	{ USB_DEVICE(0x2001, 0x3c1b) },
- 	/* Draytek */
-@@ -944,6 +948,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x7392, 0x7711) },
- 	{ USB_DEVICE(0x7392, 0x7717) },
- 	{ USB_DEVICE(0x7392, 0x7718) },
-+	{ USB_DEVICE(0x7392, 0x7722) },
- 	/* Encore */
- 	{ USB_DEVICE(0x203d, 0x1480) },
- 	{ USB_DEVICE(0x203d, 0x14a9) },
-@@ -978,6 +983,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x1737, 0x0070) },
- 	{ USB_DEVICE(0x1737, 0x0071) },
- 	{ USB_DEVICE(0x1737, 0x0077) },
-+	{ USB_DEVICE(0x1737, 0x0078) },
- 	/* Logitec */
- 	{ USB_DEVICE(0x0789, 0x0162) },
- 	{ USB_DEVICE(0x0789, 0x0163) },
-@@ -1001,9 +1007,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x0db0, 0x871b) },
- 	{ USB_DEVICE(0x0db0, 0x871c) },
- 	{ USB_DEVICE(0x0db0, 0x899a) },
-+	/* Ovislink */
-+	{ USB_DEVICE(0x1b75, 0x3071) },
-+	{ USB_DEVICE(0x1b75, 0x3072) },
- 	/* Para */
- 	{ USB_DEVICE(0x20b8, 0x8888) },
- 	/* Pegatron */
-+	{ USB_DEVICE(0x1d4d, 0x0002) },
- 	{ USB_DEVICE(0x1d4d, 0x000c) },
- 	{ USB_DEVICE(0x1d4d, 0x000e) },
- 	{ USB_DEVICE(0x1d4d, 0x0011) },
-@@ -1056,7 +1066,9 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	/* Sparklan */
- 	{ USB_DEVICE(0x15a9, 0x0006) },
- 	/* Sweex */
-+	{ USB_DEVICE(0x177f, 0x0153) },
- 	{ USB_DEVICE(0x177f, 0x0302) },
-+	{ USB_DEVICE(0x177f, 0x0313) },
- 	/* U-Media */
- 	{ USB_DEVICE(0x157e, 0x300e) },
- 	{ USB_DEVICE(0x157e, 0x3013) },
-@@ -1140,27 +1152,24 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x13d3, 0x3322) },
- 	/* Belkin */
- 	{ USB_DEVICE(0x050d, 0x1003) },
--	{ USB_DEVICE(0x050d, 0x825a) },
- 	/* Buffalo */
- 	{ USB_DEVICE(0x0411, 0x012e) },
- 	{ USB_DEVICE(0x0411, 0x0148) },
- 	{ USB_DEVICE(0x0411, 0x0150) },
--	{ USB_DEVICE(0x0411, 0x015d) },
- 	/* Corega */
- 	{ USB_DEVICE(0x07aa, 0x0041) },
- 	{ USB_DEVICE(0x07aa, 0x0042) },
- 	{ USB_DEVICE(0x18c5, 0x0008) },
- 	/* D-Link */
- 	{ USB_DEVICE(0x07d1, 0x3c0b) },
--	{ USB_DEVICE(0x07d1, 0x3c13) },
--	{ USB_DEVICE(0x07d1, 0x3c15) },
- 	{ USB_DEVICE(0x07d1, 0x3c17) },
- 	{ USB_DEVICE(0x2001, 0x3c17) },
- 	/* Edimax */
- 	{ USB_DEVICE(0x7392, 0x4085) },
--	{ USB_DEVICE(0x7392, 0x7722) },
- 	/* Encore */
- 	{ USB_DEVICE(0x203d, 0x14a1) },
-+	/* Fujitsu Stylistic 550 */
-+	{ USB_DEVICE(0x1690, 0x0761) },
- 	/* Gemtek */
- 	{ USB_DEVICE(0x15a9, 0x0010) },
- 	/* Gigabyte */
-@@ -1172,19 +1181,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	/* LevelOne */
- 	{ USB_DEVICE(0x1740, 0x0605) },
- 	{ USB_DEVICE(0x1740, 0x0615) },
--	/* Linksys */
--	{ USB_DEVICE(0x1737, 0x0078) },
- 	/* Logitec */
- 	{ USB_DEVICE(0x0789, 0x0168) },
- 	{ USB_DEVICE(0x0789, 0x0169) },
- 	/* Motorola */
- 	{ USB_DEVICE(0x100d, 0x9032) },
--	/* Ovislink */
--	{ USB_DEVICE(0x1b75, 0x3071) },
--	{ USB_DEVICE(0x1b75, 0x3072) },
- 	/* Pegatron */
- 	{ USB_DEVICE(0x05a6, 0x0101) },
--	{ USB_DEVICE(0x1d4d, 0x0002) },
- 	{ USB_DEVICE(0x1d4d, 0x0010) },
- 	/* Planex */
- 	{ USB_DEVICE(0x2019, 0x5201) },
-@@ -1203,9 +1206,6 @@ static struct usb_device_id rt2800usb_device_table[] = {
- 	{ USB_DEVICE(0x083a, 0xc522) },
- 	{ USB_DEVICE(0x083a, 0xd522) },
- 	{ USB_DEVICE(0x083a, 0xf511) },
--	/* Sweex */
--	{ USB_DEVICE(0x177f, 0x0153) },
--	{ USB_DEVICE(0x177f, 0x0313) },
- 	/* Zyxel */
- 	{ USB_DEVICE(0x0586, 0x341a) },
- #endif
-diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
-index d44d398..47ba0f7 100644
---- a/drivers/net/wireless/rtlwifi/pci.c
-+++ b/drivers/net/wireless/rtlwifi/pci.c
-@@ -1961,6 +1961,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev)
- 		rtl_deinit_deferred_work(hw);
- 		rtlpriv->intf_ops->adapter_stop(hw);
- 	}
-+	rtlpriv->cfg->ops->disable_interrupt(hw);
- 
- 	/*deinit rfkill */
- 	rtl_deinit_rfkill(hw);
-diff --git a/drivers/net/wireless/wl1251/main.c b/drivers/net/wireless/wl1251/main.c
-index ba3268e..40c1574 100644
---- a/drivers/net/wireless/wl1251/main.c
-+++ b/drivers/net/wireless/wl1251/main.c
-@@ -479,6 +479,7 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
- 	cancel_work_sync(&wl->irq_work);
- 	cancel_work_sync(&wl->tx_work);
- 	cancel_work_sync(&wl->filter_work);
-+	cancel_delayed_work_sync(&wl->elp_work);
- 
- 	mutex_lock(&wl->mutex);
- 
-diff --git a/drivers/net/wireless/wl1251/sdio.c b/drivers/net/wireless/wl1251/sdio.c
-index f786942..1b851f6 100644
---- a/drivers/net/wireless/wl1251/sdio.c
-+++ b/drivers/net/wireless/wl1251/sdio.c
-@@ -315,8 +315,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
- 
- 	if (wl->irq)
- 		free_irq(wl->irq, wl);
--	kfree(wl_sdio);
- 	wl1251_free_hw(wl);
-+	kfree(wl_sdio);
- 
- 	sdio_claim_host(func);
- 	sdio_release_irq(func);
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 6476547..78fda9c 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -2906,6 +2906,40 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f8, quirk_intel_mc_errata);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65f9, quirk_intel_mc_errata);
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x65fa, quirk_intel_mc_errata);
- 
-+/*
-+ * Some BIOS implementations leave the Intel GPU interrupts enabled,
-+ * even though no one is handling them (f.e. i915 driver is never loaded).
-+ * Additionally the interrupt destination is not set up properly
-+ * and the interrupt ends up -somewhere-.
-+ *
-+ * These spurious interrupts are "sticky" and the kernel disables
-+ * the (shared) interrupt line after 100.000+ generated interrupts.
-+ *
-+ * Fix it by disabling the still enabled interrupts.
-+ * This resolves crashes often seen on monitor unplug.
-+ */
-+#define I915_DEIER_REG 0x4400c
-+static void __devinit disable_igfx_irq(struct pci_dev *dev)
-+{
-+	void __iomem *regs = pci_iomap(dev, 0, 0);
-+	if (regs == NULL) {
-+		dev_warn(&dev->dev, "igfx quirk: Can't iomap PCI device\n");
-+		return;
-+	}
-+
-+	/* Check if any interrupt line is still enabled */
-+	if (readl(regs + I915_DEIER_REG) != 0) {
-+		dev_warn(&dev->dev, "BIOS left Intel GPU interrupts enabled; "
-+			"disabling\n");
-+
-+		writel(0, regs + I915_DEIER_REG);
-+	}
-+
-+	pci_iounmap(dev, regs);
-+}
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
-+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
-+
- static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
- 			  struct pci_fixup *end)
- {
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index d93e962..1d3bcce 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -184,6 +184,34 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
- 		},
- 		.driver_data = &quirk_dell_vostro_v130,
- 	},
-+	{
-+		.callback = dmi_matched,
-+		.ident = "Dell Vostro 3555",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3555"),
-+		},
-+		.driver_data = &quirk_dell_vostro_v130,
-+	},
-+	{
-+		.callback = dmi_matched,
-+		.ident = "Dell Inspiron N311z",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron N311z"),
-+		},
-+		.driver_data = &quirk_dell_vostro_v130,
-+	},
-+	{
-+		.callback = dmi_matched,
-+		.ident = "Dell Inspiron M5110",
-+		.matches = {
-+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
-+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron M5110"),
-+		},
-+		.driver_data = &quirk_dell_vostro_v130,
-+	},
-+	{ }
- };
- 
- static struct calling_interface_buffer *buffer;
-@@ -615,6 +643,7 @@ static void touchpad_led_set(struct led_classdev *led_cdev,
- static struct led_classdev touchpad_led = {
- 	.name = "dell-laptop::touchpad",
- 	.brightness_set = touchpad_led_set,
-+	.flags = LED_CORE_SUSPENDRESUME,
- };
- 
- static int __devinit touchpad_led_init(struct device *dev)
-diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
-index 1b831c5..e48ba4b 100644
---- a/drivers/scsi/libsas/sas_expander.c
-+++ b/drivers/scsi/libsas/sas_expander.c
-@@ -192,7 +192,14 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id,
- 	phy->attached_sata_ps   = dr->attached_sata_ps;
- 	phy->attached_iproto = dr->iproto << 1;
- 	phy->attached_tproto = dr->tproto << 1;
--	memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
-+	/* help some expanders that fail to zero sas_address in the 'no
-+	 * device' case
-+	 */
-+	if (phy->attached_dev_type == NO_DEVICE ||
-+	    phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
-+		memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
-+	else
-+		memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);
- 	phy->attached_phy_id = dr->attached_phy_id;
- 	phy->phy_change_count = dr->change_count;
- 	phy->routing_attr = dr->routing_attr;
-@@ -1643,9 +1650,17 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
- 		int phy_change_count = 0;
- 
- 		res = sas_get_phy_change_count(dev, i, &phy_change_count);
--		if (res)
--			goto out;
--		else if (phy_change_count != ex->ex_phy[i].phy_change_count) {
-+		switch (res) {
-+		case SMP_RESP_PHY_VACANT:
-+		case SMP_RESP_NO_PHY:
-+			continue;
-+		case SMP_RESP_FUNC_ACC:
-+			break;
-+		default:
-+			return res;
-+		}
-+
-+		if (phy_change_count != ex->ex_phy[i].phy_change_count) {
- 			if (update)
- 				ex->ex_phy[i].phy_change_count =
- 					phy_change_count;
-@@ -1653,8 +1668,7 @@ static int sas_find_bcast_phy(struct domain_device *dev, int *phy_id,
- 			return 0;
- 		}
- 	}
--out:
--	return res;
-+	return 0;
- }
- 
- static int sas_get_ex_change_count(struct domain_device *dev, int *ecc)
-diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c
-index 24cacff..5f748c0 100644
---- a/drivers/spi/spi-fsl-spi.c
-+++ b/drivers/spi/spi-fsl-spi.c
-@@ -139,10 +139,12 @@ static void fsl_spi_change_mode(struct spi_device *spi)
- static void fsl_spi_chipselect(struct spi_device *spi, int value)
- {
- 	struct mpc8xxx_spi *mpc8xxx_spi = spi_master_get_devdata(spi->master);
--	struct fsl_spi_platform_data *pdata = spi->dev.parent->platform_data;
-+	struct fsl_spi_platform_data *pdata;
- 	bool pol = spi->mode & SPI_CS_HIGH;
- 	struct spi_mpc8xxx_cs	*cs = spi->controller_state;
- 
-+	pdata = spi->dev.parent->parent->platform_data;
-+
- 	if (value == BITBANG_CS_INACTIVE) {
- 		if (pdata->cs_control)
- 			pdata->cs_control(spi, !pol);
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 77eae99..b2ccdea 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -319,7 +319,7 @@ struct spi_device *spi_alloc_device(struct spi_master *master)
- 	}
- 
- 	spi->master = master;
--	spi->dev.parent = dev;
-+	spi->dev.parent = &master->dev;
- 	spi->dev.bus = &spi_bus_type;
- 	spi->dev.release = spidev_release;
- 	device_initialize(&spi->dev);
-diff --git a/drivers/staging/rtl8712/os_intfs.c b/drivers/staging/rtl8712/os_intfs.c
-index fb11743..4bb2797 100644
---- a/drivers/staging/rtl8712/os_intfs.c
-+++ b/drivers/staging/rtl8712/os_intfs.c
-@@ -476,9 +476,6 @@ static int netdev_close(struct net_device *pnetdev)
- 	r8712_free_assoc_resources(padapter);
- 	/*s2-4.*/
- 	r8712_free_network_queue(padapter);
--	release_firmware(padapter->fw);
--	/* never exit with a firmware callback pending */
--	wait_for_completion(&padapter->rtl8712_fw_ready);
- 	return 0;
- }
- 
-diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
-index 9bade18..ec41d38 100644
---- a/drivers/staging/rtl8712/usb_intf.c
-+++ b/drivers/staging/rtl8712/usb_intf.c
-@@ -30,6 +30,7 @@
- 
- #include <linux/usb.h>
- #include <linux/module.h>
-+#include <linux/firmware.h>
- 
- #include "osdep_service.h"
- #include "drv_types.h"
-@@ -621,6 +622,10 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
- 	struct _adapter *padapter = netdev_priv(pnetdev);
- 	struct usb_device *udev = interface_to_usbdev(pusb_intf);
- 
-+	if (padapter->fw_found)
-+		release_firmware(padapter->fw);
-+	/* never exit with a firmware callback pending */
-+	wait_for_completion(&padapter->rtl8712_fw_ready);
- 	usb_set_intfdata(pusb_intf, NULL);
- 	if (padapter) {
- 		if (drvpriv.drv_registered == true)
-diff --git a/drivers/tty/amiserial.c b/drivers/tty/amiserial.c
-index b84c834..8daf073 100644
---- a/drivers/tty/amiserial.c
-+++ b/drivers/tty/amiserial.c
-@@ -1113,8 +1113,10 @@ static int set_serial_info(struct async_struct * info,
- 		    (new_serial.close_delay != state->close_delay) ||
- 		    (new_serial.xmit_fifo_size != state->xmit_fifo_size) ||
- 		    ((new_serial.flags & ~ASYNC_USR_MASK) !=
--		     (state->flags & ~ASYNC_USR_MASK)))
-+		     (state->flags & ~ASYNC_USR_MASK))) {
-+			tty_unlock();
- 			return -EPERM;
-+		}
- 		state->flags = ((state->flags & ~ASYNC_USR_MASK) |
- 			       (new_serial.flags & ASYNC_USR_MASK));
- 		info->flags = ((info->flags & ~ASYNC_USR_MASK) |
-diff --git a/drivers/tty/serial/clps711x.c b/drivers/tty/serial/clps711x.c
-index e6c3dbd..836fe273 100644
---- a/drivers/tty/serial/clps711x.c
-+++ b/drivers/tty/serial/clps711x.c
-@@ -154,10 +154,9 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
- 		port->x_char = 0;
- 		return IRQ_HANDLED;
- 	}
--	if (uart_circ_empty(xmit) || uart_tx_stopped(port)) {
--		clps711xuart_stop_tx(port);
--		return IRQ_HANDLED;
--	}
-+
-+	if (uart_circ_empty(xmit) || uart_tx_stopped(port))
-+		goto disable_tx_irq;
- 
- 	count = port->fifosize >> 1;
- 	do {
-@@ -171,8 +170,11 @@ static irqreturn_t clps711xuart_int_tx(int irq, void *dev_id)
- 	if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
- 		uart_write_wakeup(port);
- 
--	if (uart_circ_empty(xmit))
--		clps711xuart_stop_tx(port);
-+	if (uart_circ_empty(xmit)) {
-+	disable_tx_irq:
-+		disable_irq_nosync(TX_IRQ(port));
-+		tx_enabled(port) = 0;
-+	}
- 
- 	return IRQ_HANDLED;
- }
-diff --git a/drivers/tty/serial/pch_uart.c b/drivers/tty/serial/pch_uart.c
-index da776a0..a4b192d 100644
---- a/drivers/tty/serial/pch_uart.c
-+++ b/drivers/tty/serial/pch_uart.c
-@@ -1356,9 +1356,11 @@ static int pch_uart_verify_port(struct uart_port *port,
- 			__func__);
- 		return -EOPNOTSUPP;
- #endif
--		priv->use_dma = 1;
- 		priv->use_dma_flag = 1;
- 		dev_info(priv->port.dev, "PCH UART : Use DMA Mode\n");
-+		if (!priv->use_dma)
-+			pch_request_dma(port);
-+		priv->use_dma = 1;
- 	}
- 
- 	return 0;
-diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
-index 9eb71d8..2db0327 100644
---- a/drivers/usb/class/cdc-wdm.c
-+++ b/drivers/usb/class/cdc-wdm.c
-@@ -108,8 +108,9 @@ static void wdm_out_callback(struct urb *urb)
- 	spin_lock(&desc->iuspin);
- 	desc->werr = urb->status;
- 	spin_unlock(&desc->iuspin);
--	clear_bit(WDM_IN_USE, &desc->flags);
- 	kfree(desc->outbuf);
-+	desc->outbuf = NULL;
-+	clear_bit(WDM_IN_USE, &desc->flags);
- 	wake_up(&desc->wait);
- }
- 
-@@ -312,7 +313,7 @@ static ssize_t wdm_write
- 	if (we < 0)
- 		return -EIO;
- 
--	desc->outbuf = buf = kmalloc(count, GFP_KERNEL);
-+	buf = kmalloc(count, GFP_KERNEL);
- 	if (!buf) {
- 		rv = -ENOMEM;
- 		goto outnl;
-@@ -376,10 +377,12 @@ static ssize_t wdm_write
- 	req->wIndex = desc->inum;
- 	req->wLength = cpu_to_le16(count);
- 	set_bit(WDM_IN_USE, &desc->flags);
-+	desc->outbuf = buf;
- 
- 	rv = usb_submit_urb(desc->command, GFP_KERNEL);
- 	if (rv < 0) {
- 		kfree(buf);
-+		desc->outbuf = NULL;
- 		clear_bit(WDM_IN_USE, &desc->flags);
- 		dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
- 	} else {
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 61d08dd..5f1404a 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -495,6 +495,15 @@ static int hcd_pci_suspend_noirq(struct device *dev)
- 
- 	pci_save_state(pci_dev);
- 
-+	/*
-+	 * Some systems crash if an EHCI controller is in D3 during
-+	 * a sleep transition.  We have to leave such controllers in D0.
-+	 */
-+	if (hcd->broken_pci_sleep) {
-+		dev_dbg(dev, "Staying in PCI D0\n");
-+		return retval;
-+	}
-+
- 	/* If the root hub is dead rather than suspended, disallow remote
- 	 * wakeup.  usb_hc_died() should ensure that both hosts are marked as
- 	 * dying, so we only need to check the primary roothub.
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index e238b3b..2b0a341 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -1644,7 +1644,6 @@ void usb_disconnect(struct usb_device **pdev)
- {
- 	struct usb_device	*udev = *pdev;
- 	int			i;
--	struct usb_hcd		*hcd = bus_to_hcd(udev->bus);
- 
- 	/* mark the device as inactive, so any further urb submissions for
- 	 * this device (and any of its children) will fail immediately.
-@@ -1667,9 +1666,7 @@ void usb_disconnect(struct usb_device **pdev)
- 	 * so that the hardware is now fully quiesced.
- 	 */
- 	dev_dbg (&udev->dev, "unregistering device\n");
--	mutex_lock(hcd->bandwidth_mutex);
- 	usb_disable_device(udev, 0);
--	mutex_unlock(hcd->bandwidth_mutex);
- 	usb_hcd_synchronize_unlinks(udev);
- 
- 	usb_remove_ep_devs(&udev->ep0);
-diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
-index aed3e07..ca717da 100644
---- a/drivers/usb/core/message.c
-+++ b/drivers/usb/core/message.c
-@@ -1136,8 +1136,6 @@ void usb_disable_interface(struct usb_device *dev, struct usb_interface *intf,
-  * Deallocates hcd/hardware state for the endpoints (nuking all or most
-  * pending urbs) and usbcore state for the interfaces, so that usbcore
-  * must usb_set_configuration() before any interfaces could be used.
-- *
-- * Must be called with hcd->bandwidth_mutex held.
-  */
- void usb_disable_device(struct usb_device *dev, int skip_ep0)
- {
-@@ -1190,7 +1188,9 @@ void usb_disable_device(struct usb_device *dev, int skip_ep0)
- 			usb_disable_endpoint(dev, i + USB_DIR_IN, false);
- 		}
- 		/* Remove endpoints from the host controller internal state */
-+		mutex_lock(hcd->bandwidth_mutex);
- 		usb_hcd_alloc_bandwidth(dev, NULL, NULL, NULL);
-+		mutex_unlock(hcd->bandwidth_mutex);
- 		/* Second pass: remove endpoint pointers */
- 	}
- 	for (i = skip_ep0; i < 16; ++i) {
-@@ -1750,7 +1750,6 @@ free_interfaces:
- 	/* if it's already configured, clear out old state first.
- 	 * getting rid of old interfaces means unbinding their drivers.
- 	 */
--	mutex_lock(hcd->bandwidth_mutex);
- 	if (dev->state != USB_STATE_ADDRESS)
- 		usb_disable_device(dev, 1);	/* Skip ep0 */
- 
-@@ -1763,6 +1762,7 @@ free_interfaces:
- 	 * host controller will not allow submissions to dropped endpoints.  If
- 	 * this call fails, the device state is unchanged.
- 	 */
-+	mutex_lock(hcd->bandwidth_mutex);
- 	ret = usb_hcd_alloc_bandwidth(dev, cp, NULL, NULL);
- 	if (ret < 0) {
- 		mutex_unlock(hcd->bandwidth_mutex);
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 27bd50a..c0dcf69 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -572,9 +572,10 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
- 		dwc->ep0_bounced = false;
- 	} else {
- 		transferred = ur->length - trb.length;
--		ur->actual += transferred;
- 	}
- 
-+	ur->actual += transferred;
-+
- 	if ((epnum & 1) && ur->actual < ur->length) {
- 		/* for some reason we did not get everything out */
- 
-diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
-index ab8f1b4..527736e 100644
---- a/drivers/usb/gadget/dummy_hcd.c
-+++ b/drivers/usb/gadget/dummy_hcd.c
-@@ -925,7 +925,6 @@ static int dummy_udc_stop(struct usb_gadget *g,
- 
- 	dum->driver = NULL;
- 
--	dummy_pullup(&dum->gadget, 0);
- 	return 0;
- }
- 
-diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
-index acb3800..0e641a1 100644
---- a/drivers/usb/gadget/f_fs.c
-+++ b/drivers/usb/gadget/f_fs.c
-@@ -712,7 +712,7 @@ static long ffs_ep0_ioctl(struct file *file, unsigned code, unsigned long value)
- 	if (code == FUNCTIONFS_INTERFACE_REVMAP) {
- 		struct ffs_function *func = ffs->func;
- 		ret = func ? ffs_func_revmap_intf(func, value) : -ENODEV;
--	} else if (gadget->ops->ioctl) {
-+	} else if (gadget && gadget->ops->ioctl) {
- 		ret = gadget->ops->ioctl(gadget, code, value);
- 	} else {
- 		ret = -ENOTTY;
-diff --git a/drivers/usb/gadget/f_mass_storage.c b/drivers/usb/gadget/f_mass_storage.c
-index 1a6f415..a5570b6 100644
---- a/drivers/usb/gadget/f_mass_storage.c
-+++ b/drivers/usb/gadget/f_mass_storage.c
-@@ -2182,7 +2182,7 @@ unknown_cmnd:
- 		common->data_size_from_cmnd = 0;
- 		sprintf(unknown, "Unknown x%02x", common->cmnd[0]);
- 		reply = check_command(common, common->cmnd_size,
--				      DATA_DIR_UNKNOWN, 0xff, 0, unknown);
-+				      DATA_DIR_UNKNOWN, ~0, 0, unknown);
- 		if (reply == 0) {
- 			common->curlun->sense_data = SS_INVALID_COMMAND;
- 			reply = -EINVAL;
-diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
-index 11b5196..db2d607 100644
---- a/drivers/usb/gadget/file_storage.c
-+++ b/drivers/usb/gadget/file_storage.c
-@@ -2569,7 +2569,7 @@ static int do_scsi_command(struct fsg_dev *fsg)
- 		fsg->data_size_from_cmnd = 0;
- 		sprintf(unknown, "Unknown x%02x", fsg->cmnd[0]);
- 		if ((reply = check_command(fsg, fsg->cmnd_size,
--				DATA_DIR_UNKNOWN, 0xff, 0, unknown)) == 0) {
-+				DATA_DIR_UNKNOWN, ~0, 0, unknown)) == 0) {
- 			fsg->curlun->sense_data = SS_INVALID_COMMAND;
- 			reply = -EINVAL;
- 		}
-diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
-index 6939e17..901924a 100644
---- a/drivers/usb/gadget/udc-core.c
-+++ b/drivers/usb/gadget/udc-core.c
-@@ -211,9 +211,9 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
- 
- 	if (udc_is_newstyle(udc)) {
- 		udc->driver->disconnect(udc->gadget);
-+		usb_gadget_disconnect(udc->gadget);
- 		udc->driver->unbind(udc->gadget);
- 		usb_gadget_udc_stop(udc->gadget, udc->driver);
--		usb_gadget_disconnect(udc->gadget);
- 	} else {
- 		usb_gadget_stop(udc->gadget, udc->driver);
- 	}
-@@ -359,9 +359,13 @@ static ssize_t usb_udc_softconn_store(struct device *dev,
- 	struct usb_udc		*udc = container_of(dev, struct usb_udc, dev);
- 
- 	if (sysfs_streq(buf, "connect")) {
-+		if (udc_is_newstyle(udc))
-+			usb_gadget_udc_start(udc->gadget, udc->driver);
- 		usb_gadget_connect(udc->gadget);
- 	} else if (sysfs_streq(buf, "disconnect")) {
- 		usb_gadget_disconnect(udc->gadget);
-+		if (udc_is_newstyle(udc))
-+			usb_gadget_udc_stop(udc->gadget, udc->driver);
- 	} else {
- 		dev_err(dev, "unsupported command '%s'\n", buf);
- 		return -EINVAL;
-diff --git a/drivers/usb/gadget/uvc.h b/drivers/usb/gadget/uvc.h
-index bc78c60..ca4e03a 100644
---- a/drivers/usb/gadget/uvc.h
-+++ b/drivers/usb/gadget/uvc.h
-@@ -28,7 +28,7 @@
- 
- struct uvc_request_data
- {
--	unsigned int length;
-+	__s32 length;
- 	__u8 data[60];
- };
- 
-diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
-index f6e083b..54d7ca5 100644
---- a/drivers/usb/gadget/uvc_v4l2.c
-+++ b/drivers/usb/gadget/uvc_v4l2.c
-@@ -39,7 +39,7 @@ uvc_send_response(struct uvc_device *uvc, struct uvc_request_data *data)
- 	if (data->length < 0)
- 		return usb_ep_set_halt(cdev->gadget->ep0);
- 
--	req->length = min(uvc->event_length, data->length);
-+	req->length = min_t(unsigned int, uvc->event_length, data->length);
- 	req->zero = data->length < uvc->event_length;
- 	req->dma = DMA_ADDR_INVALID;
- 
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index 3ff9f82..da2f711 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -815,8 +815,13 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
- 		goto dead;
- 	}
- 
-+	/*
-+	 * We don't use STS_FLR, but some controllers don't like it to
-+	 * remain on, so mask it out along with the other status bits.
-+	 */
-+	masked_status = status & (INTR_MASK | STS_FLR);
-+
- 	/* Shared IRQ? */
--	masked_status = status & INTR_MASK;
- 	if (!masked_status || unlikely(ehci->rh_state == EHCI_RH_HALTED)) {
- 		spin_unlock(&ehci->lock);
- 		return IRQ_NONE;
-@@ -867,7 +872,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
- 		pcd_status = status;
- 
- 		/* resume root hub? */
--		if (!(cmd & CMD_RUN))
-+		if (ehci->rh_state == EHCI_RH_SUSPENDED)
- 			usb_hcd_resume_root_hub(hcd);
- 
- 		/* get per-port change detect bits */
-diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
-index f4b627d..971d312 100644
---- a/drivers/usb/host/ehci-pci.c
-+++ b/drivers/usb/host/ehci-pci.c
-@@ -144,6 +144,14 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
- 			hcd->has_tt = 1;
- 			tdi_reset(ehci);
- 		}
-+		if (pdev->subsystem_vendor == PCI_VENDOR_ID_ASUSTEK) {
-+			/* EHCI #1 or #2 on 6 Series/C200 Series chipset */
-+			if (pdev->device == 0x1c26 || pdev->device == 0x1c2d) {
-+				ehci_info(ehci, "broken D3 during system sleep on ASUS\n");
-+				hcd->broken_pci_sleep = 1;
-+				device_set_wakeup_capable(&pdev->dev, false);
-+			}
-+		}
- 		break;
- 	case PCI_VENDOR_ID_TDI:
- 		if (pdev->device == PCI_DEVICE_ID_TDI_EHCI) {
-diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c
-index ac5bfd6..2504694 100644
---- a/drivers/usb/misc/yurex.c
-+++ b/drivers/usb/misc/yurex.c
-@@ -99,9 +99,7 @@ static void yurex_delete(struct kref *kref)
- 	usb_put_dev(dev->udev);
- 	if (dev->cntl_urb) {
- 		usb_kill_urb(dev->cntl_urb);
--		if (dev->cntl_req)
--			usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
--				dev->cntl_req, dev->cntl_urb->setup_dma);
-+		kfree(dev->cntl_req);
- 		if (dev->cntl_buffer)
- 			usb_free_coherent(dev->udev, YUREX_BUF_SIZE,
- 				dev->cntl_buffer, dev->cntl_urb->transfer_dma);
-@@ -234,9 +232,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
- 	}
- 
- 	/* allocate buffer for control req */
--	dev->cntl_req = usb_alloc_coherent(dev->udev, YUREX_BUF_SIZE,
--					   GFP_KERNEL,
--					   &dev->cntl_urb->setup_dma);
-+	dev->cntl_req = kmalloc(YUREX_BUF_SIZE, GFP_KERNEL);
- 	if (!dev->cntl_req) {
- 		err("Could not allocate cntl_req");
- 		goto error;
-@@ -286,7 +282,7 @@ static int yurex_probe(struct usb_interface *interface, const struct usb_device_
- 			 usb_rcvintpipe(dev->udev, dev->int_in_endpointAddr),
- 			 dev->int_buffer, YUREX_BUF_SIZE, yurex_interrupt,
- 			 dev, 1);
--	dev->cntl_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
-+	dev->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
- 	if (usb_submit_urb(dev->urb, GFP_KERNEL)) {
- 		retval = -EIO;
- 		err("Could not submitting URB");
-diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
-index ba85f27..a8f0c09 100644
---- a/drivers/usb/musb/omap2430.c
-+++ b/drivers/usb/musb/omap2430.c
-@@ -282,7 +282,8 @@ static int musb_otg_notifications(struct notifier_block *nb,
- 
- static int omap2430_musb_init(struct musb *musb)
- {
--	u32 l, status = 0;
-+	u32 l;
-+	int status = 0;
- 	struct device *dev = musb->controller;
- 	struct musb_hdrc_platform_data *plat = dev->platform_data;
- 	struct omap_musb_board_data *data = plat->board_data;
-@@ -299,7 +300,7 @@ static int omap2430_musb_init(struct musb *musb)
- 
- 	status = pm_runtime_get_sync(dev);
- 	if (status < 0) {
--		dev_err(dev, "pm_runtime_get_sync FAILED");
-+		dev_err(dev, "pm_runtime_get_sync FAILED %d\n", status);
- 		goto err1;
- 	}
- 
-@@ -451,14 +452,14 @@ static int __init omap2430_probe(struct platform_device *pdev)
- 		goto err2;
- 	}
- 
-+	pm_runtime_enable(&pdev->dev);
-+
- 	ret = platform_device_add(musb);
- 	if (ret) {
- 		dev_err(&pdev->dev, "failed to register musb device\n");
- 		goto err2;
- 	}
- 
--	pm_runtime_enable(&pdev->dev);
--
- 	return 0;
- 
- err2:
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 4c12404..f2c57e0 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -285,7 +285,8 @@ static int cp210x_get_config(struct usb_serial_port *port, u8 request,
- 	/* Issue the request, attempting to read 'size' bytes */
- 	result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
- 				request, REQTYPE_DEVICE_TO_HOST, 0x0000,
--				port_priv->bInterfaceNumber, buf, size, 300);
-+				port_priv->bInterfaceNumber, buf, size,
-+				USB_CTRL_GET_TIMEOUT);
- 
- 	/* Convert data into an array of integers */
- 	for (i = 0; i < length; i++)
-@@ -335,12 +336,14 @@ static int cp210x_set_config(struct usb_serial_port *port, u8 request,
- 		result = usb_control_msg(serial->dev,
- 				usb_sndctrlpipe(serial->dev, 0),
- 				request, REQTYPE_HOST_TO_DEVICE, 0x0000,
--				port_priv->bInterfaceNumber, buf, size, 300);
-+				port_priv->bInterfaceNumber, buf, size,
-+				USB_CTRL_SET_TIMEOUT);
- 	} else {
- 		result = usb_control_msg(serial->dev,
- 				usb_sndctrlpipe(serial->dev, 0),
- 				request, REQTYPE_HOST_TO_DEVICE, data[0],
--				port_priv->bInterfaceNumber, NULL, 0, 300);
-+				port_priv->bInterfaceNumber, NULL, 0,
-+				USB_CTRL_SET_TIMEOUT);
- 	}
- 
- 	kfree(buf);
-diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
-index 7c3ec9e..e093585 100644
---- a/drivers/usb/serial/sierra.c
-+++ b/drivers/usb/serial/sierra.c
-@@ -221,7 +221,7 @@ static const struct sierra_iface_info typeB_interface_list = {
- };
- 
- /* 'blacklist' of interfaces not served by this driver */
--static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11 };
-+static const u8 direct_ip_non_serial_ifaces[] = { 7, 8, 9, 10, 11, 19, 20 };
- static const struct sierra_iface_info direct_ip_interface_blacklist = {
- 	.infolen = ARRAY_SIZE(direct_ip_non_serial_ifaces),
- 	.ifaceinfo = direct_ip_non_serial_ifaces,
-@@ -289,7 +289,6 @@ static const struct usb_device_id id_table[] = {
- 	{ USB_DEVICE(0x1199, 0x6856) },	/* Sierra Wireless AirCard 881 U */
- 	{ USB_DEVICE(0x1199, 0x6859) },	/* Sierra Wireless AirCard 885 E */
- 	{ USB_DEVICE(0x1199, 0x685A) },	/* Sierra Wireless AirCard 885 E */
--	{ USB_DEVICE(0x1199, 0x68A2) }, /* Sierra Wireless MC7710 */
- 	/* Sierra Wireless C885 */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6880, 0xFF, 0xFF, 0xFF)},
- 	/* Sierra Wireless C888, Air Card 501, USB 303, USB 304 */
-@@ -299,6 +298,9 @@ static const struct usb_device_id id_table[] = {
- 	/* Sierra Wireless HSPA Non-Composite Device */
- 	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x6892, 0xFF, 0xFF, 0xFF)},
- 	{ USB_DEVICE(0x1199, 0x6893) },	/* Sierra Wireless Device */
-+	{ USB_DEVICE(0x1199, 0x68A2),   /* Sierra Wireless MC77xx in QMI mode */
-+	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
-+	},
- 	{ USB_DEVICE(0x1199, 0x68A3), 	/* Sierra Wireless Direct IP modems */
- 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
- 	},
-diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
-index 2babcd4..86685e9 100644
---- a/drivers/uwb/hwa-rc.c
-+++ b/drivers/uwb/hwa-rc.c
-@@ -645,7 +645,8 @@ void hwarc_neep_cb(struct urb *urb)
- 		dev_err(dev, "NEEP: URB error %d\n", urb->status);
- 	}
- 	result = usb_submit_urb(urb, GFP_ATOMIC);
--	if (result < 0) {
-+	if (result < 0 && result != -ENODEV && result != -EPERM) {
-+		/* ignoring unrecoverable errors */
- 		dev_err(dev, "NEEP: Can't resubmit URB (%d) resetting device\n",
- 			result);
- 		goto error;
-diff --git a/drivers/uwb/neh.c b/drivers/uwb/neh.c
-index a269937..8cb71bb 100644
---- a/drivers/uwb/neh.c
-+++ b/drivers/uwb/neh.c
-@@ -107,6 +107,7 @@ struct uwb_rc_neh {
- 	u8 evt_type;
- 	__le16 evt;
- 	u8 context;
-+	u8 completed;
- 	uwb_rc_cmd_cb_f cb;
- 	void *arg;
- 
-@@ -409,6 +410,7 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
- 	struct device *dev = &rc->uwb_dev.dev;
- 	struct uwb_rc_neh *neh;
- 	struct uwb_rceb *notif;
-+	unsigned long flags;
- 
- 	if (rceb->bEventContext == 0) {
- 		notif = kmalloc(size, GFP_ATOMIC);
-@@ -422,7 +424,11 @@ static void uwb_rc_neh_grok_event(struct uwb_rc *rc, struct uwb_rceb *rceb, size
- 	} else {
- 		neh = uwb_rc_neh_lookup(rc, rceb);
- 		if (neh) {
--			del_timer_sync(&neh->timer);
-+			spin_lock_irqsave(&rc->neh_lock, flags);
-+			/* to guard against a timeout */
-+			neh->completed = 1;
-+			del_timer(&neh->timer);
-+			spin_unlock_irqrestore(&rc->neh_lock, flags);
- 			uwb_rc_neh_cb(neh, rceb, size);
- 		} else
- 			dev_warn(dev, "event 0x%02x/%04x/%02x (%zu bytes): nobody cared\n",
-@@ -568,6 +574,10 @@ static void uwb_rc_neh_timer(unsigned long arg)
- 	unsigned long flags;
- 
- 	spin_lock_irqsave(&rc->neh_lock, flags);
-+	if (neh->completed) {
-+		spin_unlock_irqrestore(&rc->neh_lock, flags);
-+		return;
-+	}
- 	if (neh->context)
- 		__uwb_rc_neh_rm(rc, neh);
- 	else
-diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
-index afca14d..625890c 100644
---- a/drivers/xen/gntdev.c
-+++ b/drivers/xen/gntdev.c
-@@ -692,7 +692,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma)
- 	vma->vm_flags |= VM_RESERVED|VM_DONTEXPAND;
- 
- 	if (use_ptemod)
--		vma->vm_flags |= VM_DONTCOPY|VM_PFNMAP;
-+		vma->vm_flags |= VM_DONTCOPY;
- 
- 	vma->vm_private_data = map;
- 
-diff --git a/drivers/xen/xenbus/xenbus_probe_frontend.c b/drivers/xen/xenbus/xenbus_probe_frontend.c
-index 2f73195..2ce95c0 100644
---- a/drivers/xen/xenbus/xenbus_probe_frontend.c
-+++ b/drivers/xen/xenbus/xenbus_probe_frontend.c
-@@ -129,7 +129,7 @@ static int read_backend_details(struct xenbus_device *xendev)
- 	return xenbus_read_otherend_details(xendev, "backend-id", "backend");
- }
- 
--static int is_device_connecting(struct device *dev, void *data)
-+static int is_device_connecting(struct device *dev, void *data, bool ignore_nonessential)
- {
- 	struct xenbus_device *xendev = to_xenbus_device(dev);
- 	struct device_driver *drv = data;
-@@ -146,16 +146,41 @@ static int is_device_connecting(struct device *dev, void *data)
- 	if (drv && (dev->driver != drv))
- 		return 0;
- 
-+	if (ignore_nonessential) {
-+		/* With older QEMU, for PVonHVM guests the guest config files
-+		 * could contain: vfb = [ 'vnc=1, vnclisten=0.0.0.0']
-+		 * which is nonsensical as there is no PV FB (there can be
-+		 * a PVKB) running as HVM guest. */
-+
-+		if ((strncmp(xendev->nodename, "device/vkbd", 11) == 0))
-+			return 0;
-+
-+		if ((strncmp(xendev->nodename, "device/vfb", 10) == 0))
-+			return 0;
-+	}
- 	xendrv = to_xenbus_driver(dev->driver);
- 	return (xendev->state < XenbusStateConnected ||
- 		(xendev->state == XenbusStateConnected &&
- 		 xendrv->is_ready && !xendrv->is_ready(xendev)));
- }
-+static int essential_device_connecting(struct device *dev, void *data)
-+{
-+	return is_device_connecting(dev, data, true /* ignore PV[KBB+FB] */);
-+}
-+static int non_essential_device_connecting(struct device *dev, void *data)
-+{
-+	return is_device_connecting(dev, data, false);
-+}
- 
--static int exists_connecting_device(struct device_driver *drv)
-+static int exists_essential_connecting_device(struct device_driver *drv)
- {
- 	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
--				is_device_connecting);
-+				essential_device_connecting);
-+}
-+static int exists_non_essential_connecting_device(struct device_driver *drv)
-+{
-+	return bus_for_each_dev(&xenbus_frontend.bus, NULL, drv,
-+				non_essential_device_connecting);
- }
- 
- static int print_device_status(struct device *dev, void *data)
-@@ -186,6 +211,23 @@ static int print_device_status(struct device *dev, void *data)
- /* We only wait for device setup after most initcalls have run. */
- static int ready_to_wait_for_devices;
- 
-+static bool wait_loop(unsigned long start, unsigned int max_delay,
-+		     unsigned int *seconds_waited)
-+{
-+	if (time_after(jiffies, start + (*seconds_waited+5)*HZ)) {
-+		if (!*seconds_waited)
-+			printk(KERN_WARNING "XENBUS: Waiting for "
-+			       "devices to initialise: ");
-+		*seconds_waited += 5;
-+		printk("%us...", max_delay - *seconds_waited);
-+		if (*seconds_waited == max_delay)
-+			return true;
-+	}
-+
-+	schedule_timeout_interruptible(HZ/10);
-+
-+	return false;
-+}
- /*
-  * On a 5-minute timeout, wait for all devices currently configured.  We need
-  * to do this to guarantee that the filesystems and / or network devices
-@@ -209,19 +251,14 @@ static void wait_for_devices(struct xenbus_driver *xendrv)
- 	if (!ready_to_wait_for_devices || !xen_domain())
- 		return;
- 
--	while (exists_connecting_device(drv)) {
--		if (time_after(jiffies, start + (seconds_waited+5)*HZ)) {
--			if (!seconds_waited)
--				printk(KERN_WARNING "XENBUS: Waiting for "
--				       "devices to initialise: ");
--			seconds_waited += 5;
--			printk("%us...", 300 - seconds_waited);
--			if (seconds_waited == 300)
--				break;
--		}
--
--		schedule_timeout_interruptible(HZ/10);
--	}
-+	while (exists_non_essential_connecting_device(drv))
-+		if (wait_loop(start, 30, &seconds_waited))
-+			break;
-+
-+	/* Skips PVKB and PVFB check.*/
-+	while (exists_essential_connecting_device(drv))
-+		if (wait_loop(start, 270, &seconds_waited))
-+			break;
- 
- 	if (seconds_waited)
- 		printk("\n");
-diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
-index 308a98b..650d520 100644
---- a/fs/autofs4/autofs_i.h
-+++ b/fs/autofs4/autofs_i.h
-@@ -110,7 +110,6 @@ struct autofs_sb_info {
- 	int sub_version;
- 	int min_proto;
- 	int max_proto;
--	int compat_daemon;
- 	unsigned long exp_timeout;
- 	unsigned int type;
- 	int reghost_enabled;
-@@ -269,6 +268,17 @@ int autofs4_fill_super(struct super_block *, void *, int);
- struct autofs_info *autofs4_new_ino(struct autofs_sb_info *);
- void autofs4_clean_ino(struct autofs_info *);
- 
-+static inline int autofs_prepare_pipe(struct file *pipe)
-+{
-+	if (!pipe->f_op || !pipe->f_op->write)
-+		return -EINVAL;
-+	if (!S_ISFIFO(pipe->f_dentry->d_inode->i_mode))
-+		return -EINVAL;
-+	/* We want a packet pipe */
-+	pipe->f_flags |= O_DIRECT;
-+	return 0;
-+}
-+
- /* Queue management functions */
- 
- int autofs4_wait(struct autofs_sb_info *,struct dentry *, enum autofs_notify);
-diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
-index 56bac70..de54271 100644
---- a/fs/autofs4/dev-ioctl.c
-+++ b/fs/autofs4/dev-ioctl.c
-@@ -376,7 +376,7 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
- 			err = -EBADF;
- 			goto out;
- 		}
--		if (!pipe->f_op || !pipe->f_op->write) {
-+		if (autofs_prepare_pipe(pipe) < 0) {
- 			err = -EPIPE;
- 			fput(pipe);
- 			goto out;
-@@ -385,7 +385,6 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
- 		sbi->pipefd = pipefd;
- 		sbi->pipe = pipe;
- 		sbi->catatonic = 0;
--		sbi->compat_daemon = is_compat_task();
- 	}
- out:
- 	mutex_unlock(&sbi->wq_mutex);
-diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
-index 98a5695..7b5293e 100644
---- a/fs/autofs4/inode.c
-+++ b/fs/autofs4/inode.c
-@@ -19,7 +19,6 @@
- #include <linux/parser.h>
- #include <linux/bitops.h>
- #include <linux/magic.h>
--#include <linux/compat.h>
- #include "autofs_i.h"
- #include <linux/module.h>
- 
-@@ -225,7 +224,6 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
- 	set_autofs_type_indirect(&sbi->type);
- 	sbi->min_proto = 0;
- 	sbi->max_proto = 0;
--	sbi->compat_daemon = is_compat_task();
- 	mutex_init(&sbi->wq_mutex);
- 	spin_lock_init(&sbi->fs_lock);
- 	sbi->queues = NULL;
-@@ -294,7 +292,7 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent)
- 		printk("autofs: could not open pipe file descriptor\n");
- 		goto fail_dput;
- 	}
--	if (!pipe->f_op || !pipe->f_op->write)
-+	if (autofs_prepare_pipe(pipe) < 0)
- 		goto fail_fput;
- 	sbi->pipe = pipe;
- 	sbi->pipefd = pipefd;
-diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
-index 6861f61..e1fbdee 100644
---- a/fs/autofs4/waitq.c
-+++ b/fs/autofs4/waitq.c
-@@ -90,24 +90,7 @@ static int autofs4_write(struct file *file, const void *addr, int bytes)
- 
- 	return (bytes > 0);
- }
--
--/*
-- * The autofs_v5 packet was misdesigned.
-- *
-- * The packets are identical on x86-32 and x86-64, but have different
-- * alignment. Which means that 'sizeof()' will give different results.
-- * Fix it up for the case of running 32-bit user mode on a 64-bit kernel.
-- */
--static noinline size_t autofs_v5_packet_size(struct autofs_sb_info *sbi)
--{
--	size_t pktsz = sizeof(struct autofs_v5_packet);
--#if defined(CONFIG_X86_64) && defined(CONFIG_COMPAT)
--	if (sbi->compat_daemon > 0)
--		pktsz -= 4;
--#endif
--	return pktsz;
--}
--
-+	
- static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
- 				 struct autofs_wait_queue *wq,
- 				 int type)
-@@ -164,7 +147,8 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
- 	{
- 		struct autofs_v5_packet *packet = &pkt.v5_pkt.v5_packet;
- 
--		pktsz = autofs_v5_packet_size(sbi);
-+		pktsz = sizeof(*packet);
-+
- 		packet->wait_queue_token = wq->wait_queue_token;
- 		packet->len = wq->name.len;
- 		memcpy(packet->name, wq->name.name, wq->name.len);
-diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
-index 6738503..83a871f 100644
---- a/fs/btrfs/ctree.h
-+++ b/fs/btrfs/ctree.h
-@@ -2025,7 +2025,7 @@ BTRFS_SETGET_STACK_FUNCS(root_last_snapshot, struct btrfs_root_item,
- 
- static inline bool btrfs_root_readonly(struct btrfs_root *root)
- {
--	return root->root_item.flags & BTRFS_ROOT_SUBVOL_RDONLY;
-+	return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
- }
- 
- /* struct btrfs_root_backup */
-diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
-index 0e6adac..e89803b 100644
---- a/fs/cifs/cifssmb.c
-+++ b/fs/cifs/cifssmb.c
-@@ -4826,8 +4826,12 @@ parse_DFS_referrals(TRANSACTION2_GET_DFS_REFER_RSP *pSMBr,
- 		max_len = data_end - temp;
- 		node->node_name = cifs_strndup_from_ucs(temp, max_len,
- 						      is_unicode, nls_codepage);
--		if (!node->node_name)
-+		if (!node->node_name) {
- 			rc = -ENOMEM;
-+			goto parse_DFS_referrals_exit;
-+		}
-+
-+		ref++;
- 	}
- 
- parse_DFS_referrals_exit:
-diff --git a/fs/eventpoll.c b/fs/eventpoll.c
-index ea54cde..4d9d3a4 100644
---- a/fs/eventpoll.c
-+++ b/fs/eventpoll.c
-@@ -988,6 +988,10 @@ static int path_count[PATH_ARR_SIZE];
- 
- static int path_count_inc(int nests)
- {
-+	/* Allow an arbitrary number of depth 1 paths */
-+	if (nests == 0)
-+		return 0;
-+
- 	if (++path_count[nests] > path_limits[nests])
- 		return -1;
- 	return 0;
-diff --git a/fs/exec.c b/fs/exec.c
-index 3625464..160cd2f 100644
---- a/fs/exec.c
-+++ b/fs/exec.c
-@@ -973,6 +973,9 @@ static int de_thread(struct task_struct *tsk)
- 	sig->notify_count = 0;
- 
- no_thread_group:
-+	/* we have changed execution domain */
-+	tsk->exit_signal = SIGCHLD;
-+
- 	if (current->mm)
- 		setmax_mm_hiwater_rss(&sig->maxrss, current->mm);
- 
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index c2a2012..54f2bdc 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -2812,7 +2812,7 @@ static int ext4_split_extent_at(handle_t *handle,
- 		if (err)
- 			goto fix_extent_len;
- 		/* update the extent length and mark as initialized */
--		ex->ee_len = cpu_to_le32(ee_len);
-+		ex->ee_len = cpu_to_le16(ee_len);
- 		ext4_ext_try_to_merge(inode, path, ex);
- 		err = ext4_ext_dirty(handle, inode, path + depth);
- 		goto out;
-diff --git a/fs/hfsplus/catalog.c b/fs/hfsplus/catalog.c
-index 4dfbfec..ec2a9c2 100644
---- a/fs/hfsplus/catalog.c
-+++ b/fs/hfsplus/catalog.c
-@@ -366,6 +366,10 @@ int hfsplus_rename_cat(u32 cnid,
- 	err = hfs_brec_find(&src_fd);
- 	if (err)
- 		goto out;
-+	if (src_fd.entrylength > sizeof(entry) || src_fd.entrylength < 0) {
-+		err = -EIO;
-+		goto out;
-+	}
- 
- 	hfs_bnode_read(src_fd.bnode, &entry, src_fd.entryoffset,
- 				src_fd.entrylength);
-diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
-index 4536cd3..5adb740 100644
---- a/fs/hfsplus/dir.c
-+++ b/fs/hfsplus/dir.c
-@@ -150,6 +150,11 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- 		filp->f_pos++;
- 		/* fall through */
- 	case 1:
-+		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
-+			err = -EIO;
-+			goto out;
-+		}
-+
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 			fd.entrylength);
- 		if (be16_to_cpu(entry.type) != HFSPLUS_FOLDER_THREAD) {
-@@ -181,6 +186,12 @@ static int hfsplus_readdir(struct file *filp, void *dirent, filldir_t filldir)
- 			err = -EIO;
- 			goto out;
- 		}
-+
-+		if (fd.entrylength > sizeof(entry) || fd.entrylength < 0) {
-+			err = -EIO;
-+			goto out;
-+		}
-+
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 			fd.entrylength);
- 		type = be16_to_cpu(entry.type);
-diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
-index 68d704d..d751f04 100644
---- a/fs/jbd2/commit.c
-+++ b/fs/jbd2/commit.c
-@@ -683,7 +683,7 @@ start_journal_io:
- 	if (commit_transaction->t_need_data_flush &&
- 	    (journal->j_fs_dev != journal->j_dev) &&
- 	    (journal->j_flags & JBD2_BARRIER))
--		blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+		blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
- 
- 	/* Done it all: now write the commit record asynchronously. */
- 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
-@@ -819,7 +819,7 @@ wait_for_iobuf:
- 	if (JBD2_HAS_INCOMPAT_FEATURE(journal,
- 				      JBD2_FEATURE_INCOMPAT_ASYNC_COMMIT) &&
- 	    journal->j_flags & JBD2_BARRIER) {
--		blkdev_issue_flush(journal->j_dev, GFP_KERNEL, NULL);
-+		blkdev_issue_flush(journal->j_dev, GFP_NOFS, NULL);
- 	}
- 
- 	if (err)
-diff --git a/fs/lockd/clnt4xdr.c b/fs/lockd/clnt4xdr.c
-index f848b52..046bb77 100644
---- a/fs/lockd/clnt4xdr.c
-+++ b/fs/lockd/clnt4xdr.c
-@@ -241,7 +241,7 @@ static int decode_nlm4_stat(struct xdr_stream *xdr, __be32 *stat)
- 	p = xdr_inline_decode(xdr, 4);
- 	if (unlikely(p == NULL))
- 		goto out_overflow;
--	if (unlikely(*p > nlm4_failed))
-+	if (unlikely(ntohl(*p) > ntohl(nlm4_failed)))
- 		goto out_bad_xdr;
- 	*stat = *p;
- 	return 0;
-diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c
-index 180ac34..36057ce 100644
---- a/fs/lockd/clntxdr.c
-+++ b/fs/lockd/clntxdr.c
-@@ -236,7 +236,7 @@ static int decode_nlm_stat(struct xdr_stream *xdr,
- 	p = xdr_inline_decode(xdr, 4);
- 	if (unlikely(p == NULL))
- 		goto out_overflow;
--	if (unlikely(*p > nlm_lck_denied_grace_period))
-+	if (unlikely(ntohl(*p) > ntohl(nlm_lck_denied_grace_period)))
- 		goto out_enum;
- 	*stat = *p;
- 	return 0;
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 757293b..51f6a40 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -4453,7 +4453,9 @@ static int _nfs4_do_setlk(struct nfs4_state *state, int cmd, struct file_lock *f
- static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {
-+		.inode = state->inode,
-+	};
- 	int err;
- 
- 	do {
-@@ -4471,7 +4473,9 @@ static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request
- static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {
-+		.inode = state->inode,
-+	};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, request);
-@@ -4551,6 +4555,7 @@ static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *
- {
- 	struct nfs4_exception exception = {
- 		.state = state,
-+		.inode = state->inode,
- 	};
- 	int err;
- 
-@@ -4596,6 +4601,20 @@ nfs4_proc_lock(struct file *filp, int cmd, struct file_lock *request)
- 
- 	if (state == NULL)
- 		return -ENOLCK;
-+	/*
-+	 * Don't rely on the VFS having checked the file open mode,
-+	 * since it won't do this for flock() locks.
-+	 */
-+	switch (request->fl_type & (F_RDLCK|F_WRLCK|F_UNLCK)) {
-+	case F_RDLCK:
-+		if (!(filp->f_mode & FMODE_READ))
-+			return -EBADF;
-+		break;
-+	case F_WRLCK:
-+		if (!(filp->f_mode & FMODE_WRITE))
-+			return -EBADF;
-+	}
-+
- 	do {
- 		status = nfs4_proc_setlk(state, cmd, request);
- 		if ((status != -EAGAIN) || IS_SETLK(cmd))
-diff --git a/fs/nfs/read.c b/fs/nfs/read.c
-index cfa175c..41bae32 100644
---- a/fs/nfs/read.c
-+++ b/fs/nfs/read.c
-@@ -324,7 +324,7 @@ out_bad:
- 	while (!list_empty(res)) {
- 		data = list_entry(res->next, struct nfs_read_data, list);
- 		list_del(&data->list);
--		nfs_readdata_free(data);
-+		nfs_readdata_release(data);
- 	}
- 	nfs_readpage_release(req);
- 	return -ENOMEM;
-diff --git a/fs/nfs/super.c b/fs/nfs/super.c
-index 3ada13c..376cd65 100644
---- a/fs/nfs/super.c
-+++ b/fs/nfs/super.c
-@@ -2708,11 +2708,15 @@ static struct vfsmount *nfs_do_root_mount(struct file_system_type *fs_type,
- 	char *root_devname;
- 	size_t len;
- 
--	len = strlen(hostname) + 3;
-+	len = strlen(hostname) + 5;
- 	root_devname = kmalloc(len, GFP_KERNEL);
- 	if (root_devname == NULL)
- 		return ERR_PTR(-ENOMEM);
--	snprintf(root_devname, len, "%s:/", hostname);
-+	/* Does hostname needs to be enclosed in brackets? */
-+	if (strchr(hostname, ':'))
-+		snprintf(root_devname, len, "[%s]:/", hostname);
-+	else
-+		snprintf(root_devname, len, "%s:/", hostname);
- 	root_mnt = vfs_kern_mount(fs_type, flags, root_devname, data);
- 	kfree(root_devname);
- 	return root_mnt;
-diff --git a/fs/nfs/write.c b/fs/nfs/write.c
-index 1dda78d..4efd421 100644
---- a/fs/nfs/write.c
-+++ b/fs/nfs/write.c
-@@ -974,7 +974,7 @@ out_bad:
- 	while (!list_empty(res)) {
- 		data = list_entry(res->next, struct nfs_write_data, list);
- 		list_del(&data->list);
--		nfs_writedata_free(data);
-+		nfs_writedata_release(data);
- 	}
- 	nfs_redirty_request(req);
- 	return -ENOMEM;
-diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
-index 08c6e36..43f46cd 100644
---- a/fs/nfsd/nfs3xdr.c
-+++ b/fs/nfsd/nfs3xdr.c
-@@ -803,13 +803,13 @@ encode_entry_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name,
- 	return p;
- }
- 
--static int
-+static __be32
- compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
- 		const char *name, int namlen)
- {
- 	struct svc_export	*exp;
- 	struct dentry		*dparent, *dchild;
--	int rv = 0;
-+	__be32 rv = nfserr_noent;
- 
- 	dparent = cd->fh.fh_dentry;
- 	exp  = cd->fh.fh_export;
-@@ -817,26 +817,20 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
- 	if (isdotent(name, namlen)) {
- 		if (namlen == 2) {
- 			dchild = dget_parent(dparent);
--			if (dchild == dparent) {
--				/* filesystem root - cannot return filehandle for ".." */
--				dput(dchild);
--				return -ENOENT;
--			}
-+			/* filesystem root - cannot return filehandle for ".." */
-+			if (dchild == dparent)
-+				goto out;
- 		} else
- 			dchild = dget(dparent);
- 	} else
- 		dchild = lookup_one_len(name, dparent, namlen);
- 	if (IS_ERR(dchild))
--		return -ENOENT;
--	rv = -ENOENT;
-+		return rv;
- 	if (d_mountpoint(dchild))
- 		goto out;
--	rv = fh_compose(fhp, exp, dchild, &cd->fh);
--	if (rv)
--		goto out;
- 	if (!dchild->d_inode)
- 		goto out;
--	rv = 0;
-+	rv = fh_compose(fhp, exp, dchild, &cd->fh);
- out:
- 	dput(dchild);
- 	return rv;
-@@ -845,7 +839,7 @@ out:
- static __be32 *encode_entryplus_baggage(struct nfsd3_readdirres *cd, __be32 *p, const char *name, int namlen)
- {
- 	struct svc_fh	fh;
--	int err;
-+	__be32 err;
- 
- 	fh_init(&fh, NFS3_FHSIZE);
- 	err = compose_entry_fh(cd, &fh, name, namlen);
-diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
-index fa38336..b8c5538 100644
---- a/fs/nfsd/nfs4proc.c
-+++ b/fs/nfsd/nfs4proc.c
-@@ -231,17 +231,17 @@ do_open_lookup(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_o
- 		 */
- 		if (open->op_createmode == NFS4_CREATE_EXCLUSIVE && status == 0)
- 			open->op_bmval[1] = (FATTR4_WORD1_TIME_ACCESS |
--						FATTR4_WORD1_TIME_MODIFY);
-+							FATTR4_WORD1_TIME_MODIFY);
- 	} else {
- 		status = nfsd_lookup(rqstp, current_fh,
- 				     open->op_fname.data, open->op_fname.len, &resfh);
- 		fh_unlock(current_fh);
--		if (status)
--			goto out;
--		status = nfsd_check_obj_isreg(&resfh);
- 	}
- 	if (status)
- 		goto out;
-+	status = nfsd_check_obj_isreg(&resfh);
-+	if (status)
-+		goto out;
- 
- 	if (is_create_with_attrs(open) && open->op_acl != NULL)
- 		do_set_nfs4_acl(rqstp, &resfh, open->op_acl, open->op_bmval);
-@@ -827,6 +827,7 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 	      struct nfsd4_setattr *setattr)
- {
- 	__be32 status = nfs_ok;
-+	int err;
- 
- 	if (setattr->sa_iattr.ia_valid & ATTR_SIZE) {
- 		nfs4_lock_state();
-@@ -838,9 +839,9 @@ nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 			return status;
- 		}
- 	}
--	status = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
--	if (status)
--		return status;
-+	err = mnt_want_write(cstate->current_fh.fh_export->ex_path.mnt);
-+	if (err)
-+		return nfserrno(err);
- 	status = nfs_ok;
- 
- 	status = check_attr_support(rqstp, cstate, setattr->sa_bmval,
-diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
-index 5abced7..4cfe260 100644
---- a/fs/nfsd/nfs4state.c
-+++ b/fs/nfsd/nfs4state.c
-@@ -4080,16 +4080,14 @@ out:
-  * vfs_test_lock.  (Arguably perhaps test_lock should be done with an
-  * inode operation.)
-  */
--static int nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
-+static __be32 nfsd_test_lock(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file_lock *lock)
- {
- 	struct file *file;
--	int err;
--
--	err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
--	if (err)
--		return err;
--	err = vfs_test_lock(file, lock);
--	nfsd_close(file);
-+	__be32 err = nfsd_open(rqstp, fhp, S_IFREG, NFSD_MAY_READ, &file);
-+	if (!err) {
-+		err = nfserrno(vfs_test_lock(file, lock));
-+		nfsd_close(file);
-+	}
- 	return err;
- }
- 
-@@ -4103,7 +4101,6 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 	struct inode *inode;
- 	struct file_lock file_lock;
- 	struct nfs4_lockowner *lo;
--	int error;
- 	__be32 status;
- 
- 	if (locks_in_grace())
-@@ -4149,12 +4146,10 @@ nfsd4_lockt(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
- 
- 	nfs4_transform_lock_offset(&file_lock);
- 
--	status = nfs_ok;
--	error = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
--	if (error) {
--		status = nfserrno(error);
-+	status = nfsd_test_lock(rqstp, &cstate->current_fh, &file_lock);
-+	if (status)
- 		goto out;
--	}
-+
- 	if (file_lock.fl_type != F_UNLCK) {
- 		status = nfserr_denied;
- 		nfs4_set_lock_denied(&file_lock, &lockt->lt_denied);
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index b6fa792..9cfa60a 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -3411,7 +3411,7 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr,
- 		nfsd4_decode_stateid(argp, &si);
- 		valid = nfs4_validate_stateid(cl, &si);
- 		RESERVE_SPACE(4);
--		*p++ = htonl(valid);
-+		*p++ = valid;
- 		resp->p = p;
- 	}
- 	nfs4_unlock_state();
-diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index 7a2e442..5c3cd82 100644
---- a/fs/nfsd/vfs.c
-+++ b/fs/nfsd/vfs.c
-@@ -1439,7 +1439,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp,
- 		switch (createmode) {
- 		case NFS3_CREATE_UNCHECKED:
- 			if (! S_ISREG(dchild->d_inode->i_mode))
--				err = nfserr_exist;
-+				goto out;
- 			else if (truncp) {
- 				/* in nfsv4, we need to treat this case a little
- 				 * differently.  we don't want to truncate the
-diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
-index 3165aeb..31b9463 100644
---- a/fs/ocfs2/alloc.c
-+++ b/fs/ocfs2/alloc.c
-@@ -1134,7 +1134,7 @@ static int ocfs2_adjust_rightmost_branch(handle_t *handle,
- 	}
- 
- 	el = path_leaf_el(path);
--	rec = &el->l_recs[le32_to_cpu(el->l_next_free_rec) - 1];
-+	rec = &el->l_recs[le16_to_cpu(el->l_next_free_rec) - 1];
- 
- 	ocfs2_adjust_rightmost_records(handle, et, path, rec);
- 
-diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c
-index cf78233..9f32d7c 100644
---- a/fs/ocfs2/refcounttree.c
-+++ b/fs/ocfs2/refcounttree.c
-@@ -1036,14 +1036,14 @@ static int ocfs2_get_refcount_cpos_end(struct ocfs2_caching_info *ci,
- 
- 	tmp_el = left_path->p_node[subtree_root].el;
- 	blkno = left_path->p_node[subtree_root+1].bh->b_blocknr;
--	for (i = 0; i < le32_to_cpu(tmp_el->l_next_free_rec); i++) {
-+	for (i = 0; i < le16_to_cpu(tmp_el->l_next_free_rec); i++) {
- 		if (le64_to_cpu(tmp_el->l_recs[i].e_blkno) == blkno) {
- 			*cpos_end = le32_to_cpu(tmp_el->l_recs[i+1].e_cpos);
- 			break;
- 		}
- 	}
- 
--	BUG_ON(i == le32_to_cpu(tmp_el->l_next_free_rec));
-+	BUG_ON(i == le16_to_cpu(tmp_el->l_next_free_rec));
- 
- out:
- 	ocfs2_free_path(left_path);
-@@ -1468,7 +1468,7 @@ static int ocfs2_divide_leaf_refcount_block(struct buffer_head *ref_leaf_bh,
- 
- 	trace_ocfs2_divide_leaf_refcount_block(
- 		(unsigned long long)ref_leaf_bh->b_blocknr,
--		le32_to_cpu(rl->rl_count), le32_to_cpu(rl->rl_used));
-+		le16_to_cpu(rl->rl_count), le16_to_cpu(rl->rl_used));
- 
- 	/*
- 	 * XXX: Improvement later.
-@@ -2411,7 +2411,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
- 				rb = (struct ocfs2_refcount_block *)
- 							prev_bh->b_data;
- 
--				if (le64_to_cpu(rb->rf_records.rl_used) +
-+				if (le16_to_cpu(rb->rf_records.rl_used) +
- 				    recs_add >
- 				    le16_to_cpu(rb->rf_records.rl_count))
- 					ref_blocks++;
-@@ -2476,7 +2476,7 @@ static int ocfs2_calc_refcount_meta_credits(struct super_block *sb,
- 	if (prev_bh) {
- 		rb = (struct ocfs2_refcount_block *)prev_bh->b_data;
- 
--		if (le64_to_cpu(rb->rf_records.rl_used) + recs_add >
-+		if (le16_to_cpu(rb->rf_records.rl_used) + recs_add >
- 		    le16_to_cpu(rb->rf_records.rl_count))
- 			ref_blocks++;
- 
-@@ -3629,7 +3629,7 @@ int ocfs2_refcounted_xattr_delete_need(struct inode *inode,
- 			 * one will split a refcount rec, so totally we need
- 			 * clusters * 2 new refcount rec.
- 			 */
--			if (le64_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
-+			if (le16_to_cpu(rb->rf_records.rl_used) + clusters * 2 >
- 			    le16_to_cpu(rb->rf_records.rl_count))
- 				ref_blocks++;
- 
-diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
-index ba5d97e..f169da4 100644
---- a/fs/ocfs2/suballoc.c
-+++ b/fs/ocfs2/suballoc.c
-@@ -600,7 +600,7 @@ static void ocfs2_bg_alloc_cleanup(handle_t *handle,
- 		ret = ocfs2_free_clusters(handle, cluster_ac->ac_inode,
- 					  cluster_ac->ac_bh,
- 					  le64_to_cpu(rec->e_blkno),
--					  le32_to_cpu(rec->e_leaf_clusters));
-+					  le16_to_cpu(rec->e_leaf_clusters));
- 		if (ret)
- 			mlog_errno(ret);
- 		/* Try all the clusters to free */
-@@ -1628,7 +1628,7 @@ static int ocfs2_bg_discontig_fix_by_rec(struct ocfs2_suballoc_result *res,
- {
- 	unsigned int bpc = le16_to_cpu(cl->cl_bpc);
- 	unsigned int bitoff = le32_to_cpu(rec->e_cpos) * bpc;
--	unsigned int bitcount = le32_to_cpu(rec->e_leaf_clusters) * bpc;
-+	unsigned int bitcount = le16_to_cpu(rec->e_leaf_clusters) * bpc;
- 
- 	if (res->sr_bit_offset < bitoff)
- 		return 0;
-diff --git a/fs/pipe.c b/fs/pipe.c
-index 4065f07..05ed5ca 100644
---- a/fs/pipe.c
-+++ b/fs/pipe.c
-@@ -345,6 +345,16 @@ static const struct pipe_buf_operations anon_pipe_buf_ops = {
- 	.get = generic_pipe_buf_get,
- };
- 
-+static const struct pipe_buf_operations packet_pipe_buf_ops = {
-+	.can_merge = 0,
-+	.map = generic_pipe_buf_map,
-+	.unmap = generic_pipe_buf_unmap,
-+	.confirm = generic_pipe_buf_confirm,
-+	.release = anon_pipe_buf_release,
-+	.steal = generic_pipe_buf_steal,
-+	.get = generic_pipe_buf_get,
-+};
-+
- static ssize_t
- pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- 	   unsigned long nr_segs, loff_t pos)
-@@ -406,6 +416,13 @@ redo:
- 			ret += chars;
- 			buf->offset += chars;
- 			buf->len -= chars;
-+
-+			/* Was it a packet buffer? Clean up and exit */
-+			if (buf->flags & PIPE_BUF_FLAG_PACKET) {
-+				total_len = chars;
-+				buf->len = 0;
-+			}
-+
- 			if (!buf->len) {
- 				buf->ops = NULL;
- 				ops->release(pipe, buf);
-@@ -458,6 +475,11 @@ redo:
- 	return ret;
- }
- 
-+static inline int is_packetized(struct file *file)
-+{
-+	return (file->f_flags & O_DIRECT) != 0;
-+}
-+
- static ssize_t
- pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- 	    unsigned long nr_segs, loff_t ppos)
-@@ -592,6 +614,11 @@ redo2:
- 			buf->ops = &anon_pipe_buf_ops;
- 			buf->offset = 0;
- 			buf->len = chars;
-+			buf->flags = 0;
-+			if (is_packetized(filp)) {
-+				buf->ops = &packet_pipe_buf_ops;
-+				buf->flags = PIPE_BUF_FLAG_PACKET;
-+			}
- 			pipe->nrbufs = ++bufs;
- 			pipe->tmp_page = NULL;
- 
-@@ -1012,7 +1039,7 @@ struct file *create_write_pipe(int flags)
- 		goto err_dentry;
- 	f->f_mapping = inode->i_mapping;
- 
--	f->f_flags = O_WRONLY | (flags & O_NONBLOCK);
-+	f->f_flags = O_WRONLY | (flags & (O_NONBLOCK | O_DIRECT));
- 	f->f_version = 0;
- 
- 	return f;
-@@ -1056,7 +1083,7 @@ int do_pipe_flags(int *fd, int flags)
- 	int error;
- 	int fdw, fdr;
- 
--	if (flags & ~(O_CLOEXEC | O_NONBLOCK))
-+	if (flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT))
- 		return -EINVAL;
- 
- 	fw = create_write_pipe(flags);
-diff --git a/fs/splice.c b/fs/splice.c
-index fa2defa..6d0dfb8 100644
---- a/fs/splice.c
-+++ b/fs/splice.c
-@@ -31,6 +31,7 @@
- #include <linux/uio.h>
- #include <linux/security.h>
- #include <linux/gfp.h>
-+#include <linux/socket.h>
- 
- /*
-  * Attempt to steal a page from a pipe buffer. This should perhaps go into
-@@ -691,7 +692,9 @@ static int pipe_to_sendpage(struct pipe_inode_info *pipe,
- 	if (!likely(file->f_op && file->f_op->sendpage))
- 		return -EINVAL;
- 
--	more = (sd->flags & SPLICE_F_MORE) || sd->len < sd->total_len;
-+	more = (sd->flags & SPLICE_F_MORE) ? MSG_MORE : 0;
-+	if (sd->len < sd->total_len)
-+		more |= MSG_SENDPAGE_NOTLAST;
- 	return file->f_op->sendpage(file, buf->page, buf->offset,
- 				    sd->len, &pos, more);
- }
-diff --git a/include/asm-generic/statfs.h b/include/asm-generic/statfs.h
-index 0fd28e0..c749af9 100644
---- a/include/asm-generic/statfs.h
-+++ b/include/asm-generic/statfs.h
-@@ -15,7 +15,7 @@ typedef __kernel_fsid_t	fsid_t;
-  * with a 10' pole.
-  */
- #ifndef __statfs_word
--#if BITS_PER_LONG == 64
-+#if __BITS_PER_LONG == 64
- #define __statfs_word long
- #else
- #define __statfs_word __u32
-diff --git a/include/linux/efi.h b/include/linux/efi.h
-index 2362a0b..1328d8c 100644
---- a/include/linux/efi.h
-+++ b/include/linux/efi.h
-@@ -383,7 +383,18 @@ extern int __init efi_setup_pcdp_console(char *);
- #define EFI_VARIABLE_NON_VOLATILE       0x0000000000000001
- #define EFI_VARIABLE_BOOTSERVICE_ACCESS 0x0000000000000002
- #define EFI_VARIABLE_RUNTIME_ACCESS     0x0000000000000004
--
-+#define EFI_VARIABLE_HARDWARE_ERROR_RECORD 0x0000000000000008
-+#define EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS 0x0000000000000010
-+#define EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS 0x0000000000000020
-+#define EFI_VARIABLE_APPEND_WRITE	0x0000000000000040
-+
-+#define EFI_VARIABLE_MASK 	(EFI_VARIABLE_NON_VOLATILE | \
-+				EFI_VARIABLE_BOOTSERVICE_ACCESS | \
-+				EFI_VARIABLE_RUNTIME_ACCESS | \
-+				EFI_VARIABLE_HARDWARE_ERROR_RECORD | \
-+				EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \
-+				EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \
-+				EFI_VARIABLE_APPEND_WRITE)
- /*
-  * EFI Device Path information
-  */
-diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index d526231..35410ef 100644
---- a/include/linux/kvm_host.h
-+++ b/include/linux/kvm_host.h
-@@ -562,6 +562,7 @@ void kvm_free_irq_source_id(struct kvm *kvm, int irq_source_id);
- 
- #ifdef CONFIG_IOMMU_API
- int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
-+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot);
- int kvm_iommu_map_guest(struct kvm *kvm);
- int kvm_iommu_unmap_guest(struct kvm *kvm);
- int kvm_assign_device(struct kvm *kvm,
-@@ -575,6 +576,11 @@ static inline int kvm_iommu_map_pages(struct kvm *kvm,
- 	return 0;
- }
- 
-+static inline void kvm_iommu_unmap_pages(struct kvm *kvm,
-+					 struct kvm_memory_slot *slot)
-+{
-+}
-+
- static inline int kvm_iommu_map_guest(struct kvm *kvm)
- {
- 	return -ENODEV;
-diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index a82ad4d..cbeb586 100644
---- a/include/linux/netdevice.h
-+++ b/include/linux/netdevice.h
-@@ -2536,8 +2536,6 @@ extern void		net_disable_timestamp(void);
- extern void *dev_seq_start(struct seq_file *seq, loff_t *pos);
- extern void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos);
- extern void dev_seq_stop(struct seq_file *seq, void *v);
--extern int dev_seq_open_ops(struct inode *inode, struct file *file,
--			    const struct seq_operations *ops);
- #endif
- 
- extern int netdev_class_create_file(struct class_attribute *class_attr);
-diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
-index 77257c9..0072a53 100644
---- a/include/linux/pipe_fs_i.h
-+++ b/include/linux/pipe_fs_i.h
-@@ -8,6 +8,7 @@
- #define PIPE_BUF_FLAG_LRU	0x01	/* page is on the LRU */
- #define PIPE_BUF_FLAG_ATOMIC	0x02	/* was atomically mapped */
- #define PIPE_BUF_FLAG_GIFT	0x04	/* page is a gift */
-+#define PIPE_BUF_FLAG_PACKET	0x08	/* read() as a packet */
- 
- /**
-  *	struct pipe_buffer - a linux kernel pipe buffer
-diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
-index c6db9fb..bb1fac5 100644
---- a/include/linux/seqlock.h
-+++ b/include/linux/seqlock.h
-@@ -141,7 +141,7 @@ static inline unsigned __read_seqcount_begin(const seqcount_t *s)
- 	unsigned ret;
- 
- repeat:
--	ret = s->sequence;
-+	ret = ACCESS_ONCE(s->sequence);
- 	if (unlikely(ret & 1)) {
- 		cpu_relax();
- 		goto repeat;
-diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index 6cf8b53..e689b47 100644
---- a/include/linux/skbuff.h
-+++ b/include/linux/skbuff.h
-@@ -458,6 +458,7 @@ struct sk_buff {
- 	union {
- 		__u32		mark;
- 		__u32		dropcount;
-+		__u32		avail_size;
- 	};
- 
- 	__u16			vlan_tci;
-@@ -1326,6 +1327,18 @@ static inline int skb_tailroom(const struct sk_buff *skb)
- }
- 
- /**
-+ *	skb_availroom - bytes at buffer end
-+ *	@skb: buffer to check
-+ *
-+ *	Return the number of bytes of free space at the tail of an sk_buff
-+ *	allocated by sk_stream_alloc()
-+ */
-+static inline int skb_availroom(const struct sk_buff *skb)
-+{
-+	return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
-+}
-+
-+/**
-  *	skb_reserve - adjust headroom
-  *	@skb: buffer to alter
-  *	@len: bytes to move
-diff --git a/include/linux/socket.h b/include/linux/socket.h
-index d0e77f6..ad919e0 100644
---- a/include/linux/socket.h
-+++ b/include/linux/socket.h
-@@ -265,7 +265,7 @@ struct ucred {
- #define MSG_NOSIGNAL	0x4000	/* Do not generate SIGPIPE */
- #define MSG_MORE	0x8000	/* Sender will send more */
- #define MSG_WAITFORONE	0x10000	/* recvmmsg(): block until 1+ packets avail */
--
-+#define MSG_SENDPAGE_NOTLAST 0x20000 /* sendpage() internal : not the last page */
- #define MSG_EOF         MSG_FIN
- 
- #define MSG_CMSG_CLOEXEC 0x40000000	/* Set close_on_exit for file
-diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
-index 03354d5..64cec8d 100644
---- a/include/linux/usb/hcd.h
-+++ b/include/linux/usb/hcd.h
-@@ -128,6 +128,8 @@ struct usb_hcd {
- 	unsigned		wireless:1;	/* Wireless USB HCD */
- 	unsigned		authorized_default:1;
- 	unsigned		has_tt:1;	/* Integrated TT in root hub */
-+	unsigned		broken_pci_sleep:1;	/* Don't put the
-+			controller in PCI-D3 for system sleep */
- 
- 	int			irq;		/* irq allocated */
- 	void __iomem		*regs;		/* device memory/io */
-diff --git a/kernel/exit.c b/kernel/exit.c
-index e6e01b9..5a8a66e 100644
---- a/kernel/exit.c
-+++ b/kernel/exit.c
-@@ -819,25 +819,6 @@ static void exit_notify(struct task_struct *tsk, int group_dead)
- 	if (group_dead)
- 		kill_orphaned_pgrp(tsk->group_leader, NULL);
- 
--	/* Let father know we died
--	 *
--	 * Thread signals are configurable, but you aren't going to use
--	 * that to send signals to arbitrary processes.
--	 * That stops right now.
--	 *
--	 * If the parent exec id doesn't match the exec id we saved
--	 * when we started then we know the parent has changed security
--	 * domain.
--	 *
--	 * If our self_exec id doesn't match our parent_exec_id then
--	 * we have changed execution domain as these two values started
--	 * the same after a fork.
--	 */
--	if (thread_group_leader(tsk) && tsk->exit_signal != SIGCHLD &&
--	    (tsk->parent_exec_id != tsk->real_parent->self_exec_id ||
--	     tsk->self_exec_id != tsk->parent_exec_id))
--		tsk->exit_signal = SIGCHLD;
--
- 	if (unlikely(tsk->ptrace)) {
- 		int sig = thread_group_leader(tsk) &&
- 				thread_group_empty(tsk) &&
-diff --git a/kernel/power/swap.c b/kernel/power/swap.c
-index 11a594c..b313086 100644
---- a/kernel/power/swap.c
-+++ b/kernel/power/swap.c
-@@ -52,6 +52,23 @@
- 
- #define MAP_PAGE_ENTRIES	(PAGE_SIZE / sizeof(sector_t) - 1)
- 
-+/*
-+ * Number of free pages that are not high.
-+ */
-+static inline unsigned long low_free_pages(void)
-+{
-+	return nr_free_pages() - nr_free_highpages();
-+}
-+
-+/*
-+ * Number of pages required to be kept free while writing the image. Always
-+ * half of all available low pages before the writing starts.
-+ */
-+static inline unsigned long reqd_free_pages(void)
-+{
-+	return low_free_pages() / 2;
-+}
-+
- struct swap_map_page {
- 	sector_t entries[MAP_PAGE_ENTRIES];
- 	sector_t next_swap;
-@@ -73,7 +90,7 @@ struct swap_map_handle {
- 	sector_t cur_swap;
- 	sector_t first_sector;
- 	unsigned int k;
--	unsigned long nr_free_pages, written;
-+	unsigned long reqd_free_pages;
- 	u32 crc32;
- };
- 
-@@ -317,8 +334,7 @@ static int get_swap_writer(struct swap_map_handle *handle)
- 		goto err_rel;
- 	}
- 	handle->k = 0;
--	handle->nr_free_pages = nr_free_pages() >> 1;
--	handle->written = 0;
-+	handle->reqd_free_pages = reqd_free_pages();
- 	handle->first_sector = handle->cur_swap;
- 	return 0;
- err_rel:
-@@ -353,11 +369,11 @@ static int swap_write_page(struct swap_map_handle *handle, void *buf,
- 		handle->cur_swap = offset;
- 		handle->k = 0;
- 	}
--	if (bio_chain && ++handle->written > handle->nr_free_pages) {
-+	if (bio_chain && low_free_pages() <= handle->reqd_free_pages) {
- 		error = hib_wait_on_bio_chain(bio_chain);
- 		if (error)
- 			goto out;
--		handle->written = 0;
-+		handle->reqd_free_pages = reqd_free_pages();
- 	}
-  out:
- 	return error;
-@@ -619,7 +635,7 @@ static int save_image_lzo(struct swap_map_handle *handle,
- 	 * Adjust number of free pages after all allocations have been done.
- 	 * We don't want to run out of pages when writing.
- 	 */
--	handle->nr_free_pages = nr_free_pages() >> 1;
-+	handle->reqd_free_pages = reqd_free_pages();
- 
- 	/*
- 	 * Start the CRC32 thread.
-diff --git a/kernel/sched.c b/kernel/sched.c
-index d6b149c..299f55c 100644
---- a/kernel/sched.c
-+++ b/kernel/sched.c
-@@ -3538,13 +3538,10 @@ calc_load_n(unsigned long load, unsigned long exp,
-  * Once we've updated the global active value, we need to apply the exponential
-  * weights adjusted to the number of cycles missed.
-  */
--static void calc_global_nohz(unsigned long ticks)
-+static void calc_global_nohz(void)
- {
- 	long delta, active, n;
- 
--	if (time_before(jiffies, calc_load_update))
--		return;
--
- 	/*
- 	 * If we crossed a calc_load_update boundary, make sure to fold
- 	 * any pending idle changes, the respective CPUs might have
-@@ -3556,31 +3553,25 @@ static void calc_global_nohz(unsigned long ticks)
- 		atomic_long_add(delta, &calc_load_tasks);
- 
- 	/*
--	 * If we were idle for multiple load cycles, apply them.
-+	 * It could be the one fold was all it took, we done!
- 	 */
--	if (ticks >= LOAD_FREQ) {
--		n = ticks / LOAD_FREQ;
-+	if (time_before(jiffies, calc_load_update + 10))
-+		return;
- 
--		active = atomic_long_read(&calc_load_tasks);
--		active = active > 0 ? active * FIXED_1 : 0;
-+	/*
-+	 * Catch-up, fold however many we are behind still
-+	 */
-+	delta = jiffies - calc_load_update - 10;
-+	n = 1 + (delta / LOAD_FREQ);
- 
--		avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
--		avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
--		avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
-+	active = atomic_long_read(&calc_load_tasks);
-+	active = active > 0 ? active * FIXED_1 : 0;
- 
--		calc_load_update += n * LOAD_FREQ;
--	}
-+	avenrun[0] = calc_load_n(avenrun[0], EXP_1, active, n);
-+	avenrun[1] = calc_load_n(avenrun[1], EXP_5, active, n);
-+	avenrun[2] = calc_load_n(avenrun[2], EXP_15, active, n);
- 
--	/*
--	 * Its possible the remainder of the above division also crosses
--	 * a LOAD_FREQ period, the regular check in calc_global_load()
--	 * which comes after this will take care of that.
--	 *
--	 * Consider us being 11 ticks before a cycle completion, and us
--	 * sleeping for 4*LOAD_FREQ + 22 ticks, then the above code will
--	 * age us 4 cycles, and the test in calc_global_load() will
--	 * pick up the final one.
--	 */
-+	calc_load_update += n * LOAD_FREQ;
- }
- #else
- static void calc_load_account_idle(struct rq *this_rq)
-@@ -3592,7 +3583,7 @@ static inline long calc_load_fold_idle(void)
- 	return 0;
- }
- 
--static void calc_global_nohz(unsigned long ticks)
-+static void calc_global_nohz(void)
- {
- }
- #endif
-@@ -3620,8 +3611,6 @@ void calc_global_load(unsigned long ticks)
- {
- 	long active;
- 
--	calc_global_nohz(ticks);
--
- 	if (time_before(jiffies, calc_load_update + 10))
- 		return;
- 
-@@ -3633,6 +3622,16 @@ void calc_global_load(unsigned long ticks)
- 	avenrun[2] = calc_load(avenrun[2], EXP_15, active);
- 
- 	calc_load_update += LOAD_FREQ;
-+
-+	/*
-+	 * Account one period with whatever state we found before
-+	 * folding in the nohz state and ageing the entire idle period.
-+	 *
-+	 * This avoids loosing a sample when we go idle between 
-+	 * calc_load_account_active() (10 ticks ago) and now and thus
-+	 * under-accounting.
-+	 */
-+	calc_global_nohz();
- }
- 
- /*
-@@ -7605,16 +7604,26 @@ static void __sdt_free(const struct cpumask *cpu_map)
- 		struct sd_data *sdd = &tl->data;
- 
- 		for_each_cpu(j, cpu_map) {
--			struct sched_domain *sd = *per_cpu_ptr(sdd->sd, j);
--			if (sd && (sd->flags & SD_OVERLAP))
--				free_sched_groups(sd->groups, 0);
--			kfree(*per_cpu_ptr(sdd->sd, j));
--			kfree(*per_cpu_ptr(sdd->sg, j));
--			kfree(*per_cpu_ptr(sdd->sgp, j));
-+			struct sched_domain *sd;
-+
-+			if (sdd->sd) {
-+				sd = *per_cpu_ptr(sdd->sd, j);
-+				if (sd && (sd->flags & SD_OVERLAP))
-+					free_sched_groups(sd->groups, 0);
-+				kfree(*per_cpu_ptr(sdd->sd, j));
-+			}
-+
-+			if (sdd->sg)
-+				kfree(*per_cpu_ptr(sdd->sg, j));
-+			if (sdd->sgp)
-+				kfree(*per_cpu_ptr(sdd->sgp, j));
- 		}
- 		free_percpu(sdd->sd);
-+		sdd->sd = NULL;
- 		free_percpu(sdd->sg);
-+		sdd->sg = NULL;
- 		free_percpu(sdd->sgp);
-+		sdd->sgp = NULL;
- 	}
- }
- 
-diff --git a/kernel/signal.c b/kernel/signal.c
-index 2065515..08e0b97 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -1610,6 +1610,15 @@ bool do_notify_parent(struct task_struct *tsk, int sig)
- 	BUG_ON(!tsk->ptrace &&
- 	       (tsk->group_leader != tsk || !thread_group_empty(tsk)));
- 
-+	if (sig != SIGCHLD) {
-+		/*
-+		 * This is only possible if parent == real_parent.
-+		 * Check if it has changed security domain.
-+		 */
-+		if (tsk->parent_exec_id != tsk->parent->self_exec_id)
-+			sig = SIGCHLD;
-+	}
-+
- 	info.si_signo = sig;
- 	info.si_errno = 0;
- 	/*
-diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
-index 5199930..1dcf253 100644
---- a/kernel/trace/trace_output.c
-+++ b/kernel/trace/trace_output.c
-@@ -638,6 +638,8 @@ int trace_print_lat_context(struct trace_iterator *iter)
- {
- 	u64 next_ts;
- 	int ret;
-+	/* trace_find_next_entry will reset ent_size */
-+	int ent_size = iter->ent_size;
- 	struct trace_seq *s = &iter->seq;
- 	struct trace_entry *entry = iter->ent,
- 			   *next_entry = trace_find_next_entry(iter, NULL,
-@@ -646,6 +648,9 @@ int trace_print_lat_context(struct trace_iterator *iter)
- 	unsigned long abs_usecs = ns2usecs(iter->ts - iter->tr->time_start);
- 	unsigned long rel_usecs;
- 
-+	/* Restore the original ent_size */
-+	iter->ent_size = ent_size;
-+
- 	if (!next_entry)
- 		next_ts = iter->ts;
- 	rel_usecs = ns2usecs(next_ts - iter->ts);
-diff --git a/mm/swap_state.c b/mm/swap_state.c
-index 78cc4d1..7704d9c 100644
---- a/mm/swap_state.c
-+++ b/mm/swap_state.c
-@@ -27,7 +27,7 @@
-  */
- static const struct address_space_operations swap_aops = {
- 	.writepage	= swap_writepage,
--	.set_page_dirty	= __set_page_dirty_nobuffers,
-+	.set_page_dirty	= __set_page_dirty_no_writeback,
- 	.migratepage	= migrate_page,
- };
- 
-diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
-index e7c69f4..b04a6ef 100644
---- a/net/ax25/af_ax25.c
-+++ b/net/ax25/af_ax25.c
-@@ -2006,16 +2006,17 @@ static void __exit ax25_exit(void)
- 	proc_net_remove(&init_net, "ax25_route");
- 	proc_net_remove(&init_net, "ax25");
- 	proc_net_remove(&init_net, "ax25_calls");
--	ax25_rt_free();
--	ax25_uid_free();
--	ax25_dev_free();
- 
--	ax25_unregister_sysctl();
- 	unregister_netdevice_notifier(&ax25_dev_notifier);
-+	ax25_unregister_sysctl();
- 
- 	dev_remove_pack(&ax25_packet_type);
- 
- 	sock_unregister(PF_AX25);
- 	proto_unregister(&ax25_proto);
-+
-+	ax25_rt_free();
-+	ax25_uid_free();
-+	ax25_dev_free();
- }
- module_exit(ax25_exit);
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 8eb6b15..5ac1811 100644
---- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
- 	hlist_del_rcu(&mp->hlist[mdb->ver]);
- 	mdb->size--;
- 
--	del_timer(&mp->query_timer);
- 	call_rcu_bh(&mp->rcu, br_multicast_free_group);
- 
- out:
-@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
- 		rcu_assign_pointer(*pp, p->next);
- 		hlist_del_init(&p->mglist);
- 		del_timer(&p->timer);
--		del_timer(&p->query_timer);
- 		call_rcu_bh(&p->rcu, br_multicast_free_pg);
- 
- 		if (!mp->ports && !mp->mglist &&
-@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
- 	return NULL;
- }
- 
--static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
--{
--	struct net_bridge *br = mp->br;
--	struct sk_buff *skb;
--
--	skb = br_multicast_alloc_query(br, &mp->addr);
--	if (!skb)
--		goto timer;
--
--	netif_rx(skb);
--
--timer:
--	if (++mp->queries_sent < br->multicast_last_member_count)
--		mod_timer(&mp->query_timer,
--			  jiffies + br->multicast_last_member_interval);
--}
--
--static void br_multicast_group_query_expired(unsigned long data)
--{
--	struct net_bridge_mdb_entry *mp = (void *)data;
--	struct net_bridge *br = mp->br;
--
--	spin_lock(&br->multicast_lock);
--	if (!netif_running(br->dev) || !mp->mglist ||
--	    mp->queries_sent >= br->multicast_last_member_count)
--		goto out;
--
--	br_multicast_send_group_query(mp);
--
--out:
--	spin_unlock(&br->multicast_lock);
--}
--
--static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
--{
--	struct net_bridge_port *port = pg->port;
--	struct net_bridge *br = port->br;
--	struct sk_buff *skb;
--
--	skb = br_multicast_alloc_query(br, &pg->addr);
--	if (!skb)
--		goto timer;
--
--	br_deliver(port, skb);
--
--timer:
--	if (++pg->queries_sent < br->multicast_last_member_count)
--		mod_timer(&pg->query_timer,
--			  jiffies + br->multicast_last_member_interval);
--}
--
--static void br_multicast_port_group_query_expired(unsigned long data)
--{
--	struct net_bridge_port_group *pg = (void *)data;
--	struct net_bridge_port *port = pg->port;
--	struct net_bridge *br = port->br;
--
--	spin_lock(&br->multicast_lock);
--	if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
--	    pg->queries_sent >= br->multicast_last_member_count)
--		goto out;
--
--	br_multicast_send_port_group_query(pg);
--
--out:
--	spin_unlock(&br->multicast_lock);
--}
--
- static struct net_bridge_mdb_entry *br_multicast_get_group(
- 	struct net_bridge *br, struct net_bridge_port *port,
- 	struct br_ip *group, int hash)
-@@ -690,8 +620,6 @@ rehash:
- 	mp->addr = *group;
- 	setup_timer(&mp->timer, br_multicast_group_expired,
- 		    (unsigned long)mp);
--	setup_timer(&mp->query_timer, br_multicast_group_query_expired,
--		    (unsigned long)mp);
- 
- 	hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
- 	mdb->size++;
-@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
- 	hlist_add_head(&p->mglist, &port->mglist);
- 	setup_timer(&p->timer, br_multicast_port_group_expired,
- 		    (unsigned long)p);
--	setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
--		    (unsigned long)p);
- 
- 	rcu_assign_pointer(*pp, p);
- 
-@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
- 		     time_after(mp->timer.expires, time) :
- 		     try_to_del_timer_sync(&mp->timer) >= 0)) {
- 			mod_timer(&mp->timer, time);
--
--			mp->queries_sent = 0;
--			mod_timer(&mp->query_timer, now);
- 		}
- 
- 		goto out;
-@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
- 		     time_after(p->timer.expires, time) :
- 		     try_to_del_timer_sync(&p->timer) >= 0)) {
- 			mod_timer(&p->timer, time);
--
--			p->queries_sent = 0;
--			mod_timer(&p->query_timer, now);
- 		}
- 
- 		break;
-@@ -1680,7 +1600,6 @@ void br_multicast_stop(struct net_bridge *br)
- 		hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
- 					  hlist[ver]) {
- 			del_timer(&mp->timer);
--			del_timer(&mp->query_timer);
- 			call_rcu_bh(&mp->rcu, br_multicast_free_group);
- 		}
- 	}
-diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
-index d7d6fb0..93264df 100644
---- a/net/bridge/br_private.h
-+++ b/net/bridge/br_private.h
-@@ -82,9 +82,7 @@ struct net_bridge_port_group {
- 	struct hlist_node		mglist;
- 	struct rcu_head			rcu;
- 	struct timer_list		timer;
--	struct timer_list		query_timer;
- 	struct br_ip			addr;
--	u32				queries_sent;
- };
- 
- struct net_bridge_mdb_entry
-@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
- 	struct net_bridge_port_group __rcu *ports;
- 	struct rcu_head			rcu;
- 	struct timer_list		timer;
--	struct timer_list		query_timer;
- 	struct br_ip			addr;
- 	bool				mglist;
--	u32				queries_sent;
- };
- 
- struct net_bridge_mdb_htable
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 55cd370..cd5050e 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -4102,54 +4102,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
- 
- #ifdef CONFIG_PROC_FS
- 
--#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
--
--struct dev_iter_state {
--	struct seq_net_private p;
--	unsigned int pos; /* bucket << BUCKET_SPACE + offset */
--};
-+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
- 
- #define get_bucket(x) ((x) >> BUCKET_SPACE)
- #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
- #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
- 
--static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
-+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
- {
--	struct dev_iter_state *state = seq->private;
- 	struct net *net = seq_file_net(seq);
- 	struct net_device *dev;
- 	struct hlist_node *p;
- 	struct hlist_head *h;
--	unsigned int count, bucket, offset;
-+	unsigned int count = 0, offset = get_offset(*pos);
- 
--	bucket = get_bucket(state->pos);
--	offset = get_offset(state->pos);
--	h = &net->dev_name_head[bucket];
--	count = 0;
-+	h = &net->dev_name_head[get_bucket(*pos)];
- 	hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
--		if (count++ == offset) {
--			state->pos = set_bucket_offset(bucket, count);
-+		if (++count == offset)
- 			return dev;
--		}
- 	}
- 
- 	return NULL;
- }
- 
--static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
-+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
- {
--	struct dev_iter_state *state = seq->private;
- 	struct net_device *dev;
- 	unsigned int bucket;
- 
--	bucket = get_bucket(state->pos);
- 	do {
--		dev = dev_from_same_bucket(seq);
-+		dev = dev_from_same_bucket(seq, pos);
- 		if (dev)
- 			return dev;
- 
--		bucket++;
--		state->pos = set_bucket_offset(bucket, 0);
-+		bucket = get_bucket(*pos) + 1;
-+		*pos = set_bucket_offset(bucket, 1);
- 	} while (bucket < NETDEV_HASHENTRIES);
- 
- 	return NULL;
-@@ -4162,33 +4149,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
- void *dev_seq_start(struct seq_file *seq, loff_t *pos)
- 	__acquires(RCU)
- {
--	struct dev_iter_state *state = seq->private;
--
- 	rcu_read_lock();
- 	if (!*pos)
- 		return SEQ_START_TOKEN;
- 
--	/* check for end of the hash */
--	if (state->pos == 0 && *pos > 1)
-+	if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
- 		return NULL;
- 
--	return dev_from_new_bucket(seq);
-+	return dev_from_bucket(seq, pos);
- }
- 
- void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
- {
--	struct net_device *dev;
--
- 	++*pos;
--
--	if (v == SEQ_START_TOKEN)
--		return dev_from_new_bucket(seq);
--
--	dev = dev_from_same_bucket(seq);
--	if (dev)
--		return dev;
--
--	return dev_from_new_bucket(seq);
-+	return dev_from_bucket(seq, pos);
- }
- 
- void dev_seq_stop(struct seq_file *seq, void *v)
-@@ -4287,13 +4261,7 @@ static const struct seq_operations dev_seq_ops = {
- static int dev_seq_open(struct inode *inode, struct file *file)
- {
- 	return seq_open_net(inode, file, &dev_seq_ops,
--			    sizeof(struct dev_iter_state));
--}
--
--int dev_seq_open_ops(struct inode *inode, struct file *file,
--		     const struct seq_operations *ops)
--{
--	return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
-+			    sizeof(struct seq_net_private));
- }
- 
- static const struct file_operations dev_seq_fops = {
-diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
-index febba51..277faef 100644
---- a/net/core/dev_addr_lists.c
-+++ b/net/core/dev_addr_lists.c
-@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
- 
- static int dev_mc_seq_open(struct inode *inode, struct file *file)
- {
--	return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
-+	return seq_open_net(inode, file, &dev_mc_seq_ops,
-+			    sizeof(struct seq_net_private));
- }
- 
- static const struct file_operations dev_mc_seq_fops = {
-diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
-index 0e950fd..31a5ae5 100644
---- a/net/core/net_namespace.c
-+++ b/net/core/net_namespace.c
-@@ -83,21 +83,29 @@ assign:
- 
- static int ops_init(const struct pernet_operations *ops, struct net *net)
- {
--	int err;
-+	int err = -ENOMEM;
-+	void *data = NULL;
-+
- 	if (ops->id && ops->size) {
--		void *data = kzalloc(ops->size, GFP_KERNEL);
-+		data = kzalloc(ops->size, GFP_KERNEL);
- 		if (!data)
--			return -ENOMEM;
-+			goto out;
- 
- 		err = net_assign_generic(net, *ops->id, data);
--		if (err) {
--			kfree(data);
--			return err;
--		}
-+		if (err)
-+			goto cleanup;
- 	}
-+	err = 0;
- 	if (ops->init)
--		return ops->init(net);
--	return 0;
-+		err = ops->init(net);
-+	if (!err)
-+		return 0;
-+
-+cleanup:
-+	kfree(data);
-+
-+out:
-+	return err;
- }
- 
- static void ops_free(const struct pernet_operations *ops, struct net *net)
-@@ -448,12 +456,7 @@ static void __unregister_pernet_operations(struct pernet_operations *ops)
- static int __register_pernet_operations(struct list_head *list,
- 					struct pernet_operations *ops)
- {
--	int err = 0;
--	err = ops_init(ops, &init_net);
--	if (err)
--		ops_free(ops, &init_net);
--	return err;
--	
-+	return ops_init(ops, &init_net);
- }
- 
- static void __unregister_pernet_operations(struct pernet_operations *ops)
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 3c30ee4..2ec200de 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -903,9 +903,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
- 		goto adjust_others;
- 	}
- 
--	data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask);
-+	data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
-+		       gfp_mask);
- 	if (!data)
- 		goto nodata;
-+	size = SKB_WITH_OVERHEAD(ksize(data));
- 
- 	/* Copy only real data... and, alas, header. This should be
- 	 * optimized for the cases when header is void.
-@@ -3111,6 +3113,8 @@ static void sock_rmem_free(struct sk_buff *skb)
-  */
- int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
- {
-+	int len = skb->len;
-+
- 	if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
- 	    (unsigned)sk->sk_rcvbuf)
- 		return -ENOMEM;
-@@ -3125,7 +3129,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
- 
- 	skb_queue_tail(&sk->sk_error_queue, skb);
- 	if (!sock_flag(sk, SOCK_DEAD))
--		sk->sk_data_ready(sk, skb->len);
-+		sk->sk_data_ready(sk, len);
- 	return 0;
- }
- EXPORT_SYMBOL(sock_queue_err_skb);
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 34f5db1..7904db4 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
- 	skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
- 	if (skb) {
- 		if (sk_wmem_schedule(sk, skb->truesize)) {
-+			skb_reserve(skb, sk->sk_prot->max_header);
- 			/*
- 			 * Make sure that we have exactly size bytes
- 			 * available to the caller, no more, no less.
- 			 */
--			skb_reserve(skb, skb_tailroom(skb) - size);
-+			skb->avail_size = size;
- 			return skb;
- 		}
- 		__kfree_skb(skb);
-@@ -860,7 +861,7 @@ wait_for_memory:
- 	}
- 
- out:
--	if (copied)
-+	if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
- 		tcp_push(sk, flags, mss_now, tp->nonagle);
- 	return copied;
- 
-@@ -995,10 +996,9 @@ new_segment:
- 				copy = seglen;
- 
- 			/* Where to copy to? */
--			if (skb_tailroom(skb) > 0) {
-+			if (skb_availroom(skb) > 0) {
- 				/* We have some space in skb head. Superb! */
--				if (copy > skb_tailroom(skb))
--					copy = skb_tailroom(skb);
-+				copy = min_t(int, copy, skb_availroom(skb));
- 				err = skb_add_data_nocache(sk, skb, from, copy);
- 				if (err)
- 					goto do_fault;
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index e4d1e4a..daedc07 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -334,6 +334,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
- 			incr = __tcp_grow_window(sk, skb);
- 
- 		if (incr) {
-+			incr = max_t(int, incr, 2 * skb->len);
- 			tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
- 					       tp->window_clamp);
- 			inet_csk(sk)->icsk_ack.quick |= 1;
-@@ -473,8 +474,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
- 		if (!win_dep) {
- 			m -= (new_sample >> 3);
- 			new_sample += m;
--		} else if (m < new_sample)
--			new_sample = m << 3;
-+		} else {
-+			m <<= 3;
-+			if (m < new_sample)
-+				new_sample = m;
-+		}
- 	} else {
- 		/* No previous measure. */
- 		new_sample = m << 3;
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 097e0c7..c51dd5b 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1093,6 +1093,14 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
- {
- 	int i, k, eat;
- 
-+	eat = min_t(int, len, skb_headlen(skb));
-+	if (eat) {
-+		__skb_pull(skb, eat);
-+		skb->avail_size -= eat;
-+		len -= eat;
-+		if (!len)
-+			return;
-+	}
- 	eat = len;
- 	k = 0;
- 	for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
-@@ -1124,11 +1132,7 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
- 	if (skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
- 		return -ENOMEM;
- 
--	/* If len == headlen, we avoid __skb_pull to preserve alignment. */
--	if (unlikely(len < skb_headlen(skb)))
--		__skb_pull(skb, len);
--	else
--		__pskb_trim_head(skb, len - skb_headlen(skb));
-+	__pskb_trim_head(skb, len);
- 
- 	TCP_SKB_CB(skb)->seq += len;
- 	skb->ip_summed = CHECKSUM_PARTIAL;
-@@ -2057,7 +2061,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
- 		/* Punt if not enough space exists in the first SKB for
- 		 * the data in the second
- 		 */
--		if (skb->len > skb_tailroom(to))
-+		if (skb->len > skb_availroom(to))
- 			break;
- 
- 		if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
-diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
-index 2257366..f2d74ea 100644
---- a/net/ipv6/mcast.c
-+++ b/net/ipv6/mcast.c
-@@ -2054,7 +2054,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
- 		if (!delta)
- 			pmc->mca_sfcount[sfmode]--;
- 		for (j=0; j<i; j++)
--			(void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
-+			ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
- 	} else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
- 		struct ip6_sf_list *psf;
- 
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index b859e4a..4a56574 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -1494,6 +1494,10 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
- 	tcp_mtup_init(newsk);
- 	tcp_sync_mss(newsk, dst_mtu(dst));
- 	newtp->advmss = dst_metric_advmss(dst);
-+	if (tcp_sk(sk)->rx_opt.user_mss &&
-+	    tcp_sk(sk)->rx_opt.user_mss < newtp->advmss)
-+		newtp->advmss = tcp_sk(sk)->rx_opt.user_mss;
-+
- 	tcp_initialize_rcv_mss(newsk);
- 	if (tcp_rsk(req)->snt_synack)
- 		tcp_valid_rtt_meas(newsk,
-diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
-index eff1f4e..4ff35bf 100644
---- a/net/mac80211/tx.c
-+++ b/net/mac80211/tx.c
-@@ -1121,7 +1121,8 @@ ieee80211_tx_prepare(struct ieee80211_sub_if_data *sdata,
- 		tx->sta = rcu_dereference(sdata->u.vlan.sta);
- 		if (!tx->sta && sdata->dev->ieee80211_ptr->use_4addr)
- 			return TX_DROP;
--	} else if (info->flags & IEEE80211_TX_CTL_INJECTED) {
-+	} else if (info->flags & IEEE80211_TX_CTL_INJECTED ||
-+		   tx->sdata->control_port_protocol == tx->skb->protocol) {
- 		tx->sta = sta_info_get_bss(sdata, hdr->addr1);
- 	}
- 	if (!tx->sta)
-diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
-index 1201b6d..a99fb41 100644
---- a/net/netlink/af_netlink.c
-+++ b/net/netlink/af_netlink.c
-@@ -830,12 +830,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
- 	return 0;
- }
- 
--int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
-+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
- {
- 	int len = skb->len;
- 
- 	skb_queue_tail(&sk->sk_receive_queue, skb);
- 	sk->sk_data_ready(sk, len);
-+	return len;
-+}
-+
-+int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
-+{
-+	int len = __netlink_sendskb(sk, skb);
-+
- 	sock_put(sk);
- 	return len;
- }
-@@ -960,8 +967,7 @@ static inline int netlink_broadcast_deliver(struct sock *sk,
- 	if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
- 	    !test_bit(0, &nlk->state)) {
- 		skb_set_owner_r(skb, sk);
--		skb_queue_tail(&sk->sk_receive_queue, skb);
--		sk->sk_data_ready(sk, skb->len);
-+		__netlink_sendskb(sk, skb);
- 		return atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf;
- 	}
- 	return -1;
-@@ -1684,10 +1690,8 @@ static int netlink_dump(struct sock *sk)
- 
- 		if (sk_filter(sk, skb))
- 			kfree_skb(skb);
--		else {
--			skb_queue_tail(&sk->sk_receive_queue, skb);
--			sk->sk_data_ready(sk, skb->len);
--		}
-+		else
-+			__netlink_sendskb(sk, skb);
- 		return 0;
- 	}
- 
-@@ -1701,10 +1705,8 @@ static int netlink_dump(struct sock *sk)
- 
- 	if (sk_filter(sk, skb))
- 		kfree_skb(skb);
--	else {
--		skb_queue_tail(&sk->sk_receive_queue, skb);
--		sk->sk_data_ready(sk, skb->len);
--	}
-+	else
-+		__netlink_sendskb(sk, skb);
- 
- 	if (cb->done)
- 		cb->done(cb);
-diff --git a/net/phonet/pep.c b/net/phonet/pep.c
-index 2ba6e9f..007546d 100644
---- a/net/phonet/pep.c
-+++ b/net/phonet/pep.c
-@@ -1046,6 +1046,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
- 	int flags = msg->msg_flags;
- 	int err, done;
- 
-+	if (len > USHRT_MAX)
-+		return -EMSGSIZE;
-+
- 	if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
- 				MSG_CMSG_COMPAT)) ||
- 			!(msg->msg_flags & MSG_EOR))
-diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
-index 6cd8ddf..e1afe0c 100644
---- a/net/sched/sch_gred.c
-+++ b/net/sched/sch_gred.c
-@@ -544,11 +544,8 @@ static int gred_dump(struct Qdisc *sch, struct sk_buff *skb)
- 		opt.packets	= q->packetsin;
- 		opt.bytesin	= q->bytesin;
- 
--		if (gred_wred_mode(table)) {
--			q->parms.qidlestart =
--				table->tab[table->def]->parms.qidlestart;
--			q->parms.qavg = table->tab[table->def]->parms.qavg;
--		}
-+		if (gred_wred_mode(table))
-+			gred_load_wred_set(table, q);
- 
- 		opt.qave = red_calc_qavg(&q->parms, q->parms.qavg);
- 
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 54a7cd2..0075554 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
- static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
- 				  int __user *optlen)
- {
--	if (len < sizeof(struct sctp_event_subscribe))
-+	if (len <= 0)
- 		return -EINVAL;
--	len = sizeof(struct sctp_event_subscribe);
-+	if (len > sizeof(struct sctp_event_subscribe))
-+		len = sizeof(struct sctp_event_subscribe);
- 	if (put_user(len, optlen))
- 		return -EFAULT;
- 	if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
-diff --git a/net/socket.c b/net/socket.c
-index 2dce67a..273cbce 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -791,9 +791,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
- 
- 	sock = file->private_data;
- 
--	flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
--	if (more)
--		flags |= MSG_MORE;
-+	flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
-+	/* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
-+	flags |= more;
- 
- 	return kernel_sendpage(sock, page, offset, size, flags);
- }
-diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
-index ffafda5..c06c365 100644
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -1258,6 +1258,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
- 			goto bad_res;
- 		}
- 
-+		if (!netif_running(netdev)) {
-+			result = -ENETDOWN;
-+			goto bad_res;
-+		}
-+
- 		nla_for_each_nested(nl_txq_params,
- 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
- 				    rem_txq_params) {
-@@ -5944,7 +5949,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_get_key,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -5976,7 +5981,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
- 		.doit = nl80211_addset_beacon,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -5984,7 +5989,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
- 		.doit = nl80211_addset_beacon,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6008,7 +6013,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_set_station,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6024,7 +6029,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_del_station,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6057,7 +6062,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_del_mpath,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6065,7 +6070,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_set_bss,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6091,7 +6096,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_get_mesh_config,
- 		.policy = nl80211_policy,
- 		/* can be retrieved by unprivileged users */
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6224,7 +6229,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_setdel_pmksa,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6232,7 +6237,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_setdel_pmksa,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6240,7 +6245,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_flush_pmksa,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-@@ -6328,7 +6333,7 @@ static struct genl_ops nl80211_ops[] = {
- 		.doit = nl80211_set_wds_peer,
- 		.policy = nl80211_policy,
- 		.flags = GENL_ADMIN_PERM,
--		.internal_flags = NL80211_FLAG_NEED_NETDEV |
-+		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
- 				  NL80211_FLAG_NEED_RTNL,
- 	},
- 	{
-diff --git a/net/wireless/util.c b/net/wireless/util.c
-index 4dde429..8bf8902 100644
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -996,7 +996,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
- 			if (rdev->wiphy.software_iftypes & BIT(iftype))
- 				continue;
- 			for (j = 0; j < c->n_limits; j++) {
--				if (!(limits[j].types & iftype))
-+				if (!(limits[j].types & BIT(iftype)))
- 					continue;
- 				if (limits[j].max < num[iftype])
- 					goto cont;
-diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
-index f936d1f..d1d0ae8 100644
---- a/scripts/mod/file2alias.c
-+++ b/scripts/mod/file2alias.c
-@@ -926,6 +926,10 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
- 	if (!sym->st_shndx || get_secindex(info, sym) >= info->num_sections)
- 		return;
- 
-+	/* We're looking for an object */
-+	if (ELF_ST_TYPE(sym->st_info) != STT_OBJECT)
-+		return;
-+
- 	/* Handle all-NULL symbols allocated into .bss */
- 	if (info->sechdrs[get_secindex(info, sym)].sh_type & SHT_NOBITS) {
- 		zeros = calloc(1, sym->st_size);
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index ae94929..51a1afc 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -4003,9 +4003,14 @@ static void cx_auto_init_output(struct hda_codec *codec)
- 	int i;
- 
- 	mute_outputs(codec, spec->multiout.num_dacs, spec->multiout.dac_nids);
--	for (i = 0; i < cfg->hp_outs; i++)
-+	for (i = 0; i < cfg->hp_outs; i++) {
-+		unsigned int val = PIN_OUT;
-+		if (snd_hda_query_pin_caps(codec, cfg->hp_pins[i]) &
-+		    AC_PINCAP_HP_DRV)
-+			val |= AC_PINCTL_HP_EN;
- 		snd_hda_codec_write(codec, cfg->hp_pins[i], 0,
--				    AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP);
-+				    AC_VERB_SET_PIN_WIDGET_CONTROL, val);
-+	}
- 	mute_outputs(codec, cfg->hp_outs, cfg->hp_pins);
- 	mute_outputs(codec, cfg->line_outs, cfg->line_out_pins);
- 	mute_outputs(codec, cfg->speaker_outs, cfg->speaker_pins);
-@@ -4408,8 +4413,10 @@ static void apply_pin_fixup(struct hda_codec *codec,
- 
- enum {
- 	CXT_PINCFG_LENOVO_X200,
-+	CXT_PINCFG_LENOVO_TP410,
- };
- 
-+/* ThinkPad X200 & co with cxt5051 */
- static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
- 	{ 0x16, 0x042140ff }, /* HP (seq# overridden) */
- 	{ 0x17, 0x21a11000 }, /* dock-mic */
-@@ -4417,15 +4424,33 @@ static const struct cxt_pincfg cxt_pincfg_lenovo_x200[] = {
- 	{}
- };
- 
-+/* ThinkPad 410/420/510/520, X201 & co with cxt5066 */
-+static const struct cxt_pincfg cxt_pincfg_lenovo_tp410[] = {
-+	{ 0x19, 0x042110ff }, /* HP (seq# overridden) */
-+	{ 0x1a, 0x21a190f0 }, /* dock-mic */
-+	{ 0x1c, 0x212140ff }, /* dock-HP */
-+	{}
-+};
-+
- static const struct cxt_pincfg *cxt_pincfg_tbl[] = {
- 	[CXT_PINCFG_LENOVO_X200] = cxt_pincfg_lenovo_x200,
-+	[CXT_PINCFG_LENOVO_TP410] = cxt_pincfg_lenovo_tp410,
- };
- 
--static const struct snd_pci_quirk cxt_fixups[] = {
-+static const struct snd_pci_quirk cxt5051_fixups[] = {
- 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
- 	{}
- };
- 
-+static const struct snd_pci_quirk cxt5066_fixups[] = {
-+	SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
-+	SND_PCI_QUIRK(0x17aa, 0x215e, "Lenovo T410", CXT_PINCFG_LENOVO_TP410),
-+	SND_PCI_QUIRK(0x17aa, 0x215f, "Lenovo T510", CXT_PINCFG_LENOVO_TP410),
-+	SND_PCI_QUIRK(0x17aa, 0x21ce, "Lenovo T420", CXT_PINCFG_LENOVO_TP410),
-+	SND_PCI_QUIRK(0x17aa, 0x21cf, "Lenovo T520", CXT_PINCFG_LENOVO_TP410),
-+	{}
-+};
-+
- /* add "fake" mute amp-caps to DACs on cx5051 so that mixer mute switches
-  * can be created (bko#42825)
-  */
-@@ -4462,11 +4487,13 @@ static int patch_conexant_auto(struct hda_codec *codec)
- 		break;
- 	case 0x14f15051:
- 		add_cx5051_fake_mutes(codec);
-+		apply_pin_fixup(codec, cxt5051_fixups, cxt_pincfg_tbl);
-+		break;
-+	default:
-+		apply_pin_fixup(codec, cxt5066_fixups, cxt_pincfg_tbl);
- 		break;
- 	}
- 
--	apply_pin_fixup(codec, cxt_fixups, cxt_pincfg_tbl);
--
- 	err = cx_auto_search_adcs(codec);
- 	if (err < 0)
- 		return err;
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index dc8a6fc..0bc5a46 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -5032,6 +5032,7 @@ static const struct alc_fixup alc269_fixups[] = {
- };
- 
- static const struct snd_pci_quirk alc269_fixup_tbl[] = {
-+	SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_DMIC),
- 	SND_PCI_QUIRK(0x1043, 0x1a13, "Asus G73Jw", ALC269_FIXUP_ASUS_G73JW),
- 	SND_PCI_QUIRK(0x1043, 0x16e3, "ASUS UX50", ALC269_FIXUP_STEREO_DMIC),
- 	SND_PCI_QUIRK(0x1043, 0x831a, "ASUS P901", ALC269_FIXUP_STEREO_DMIC),
-diff --git a/sound/soc/codecs/tlv320aic23.c b/sound/soc/codecs/tlv320aic23.c
-index 336de8f..0e7e26e 100644
---- a/sound/soc/codecs/tlv320aic23.c
-+++ b/sound/soc/codecs/tlv320aic23.c
-@@ -473,7 +473,7 @@ static int tlv320aic23_set_dai_sysclk(struct snd_soc_dai *codec_dai,
- static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
- 				      enum snd_soc_bias_level level)
- {
--	u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0xff7f;
-+	u16 reg = snd_soc_read(codec, TLV320AIC23_PWR) & 0x17f;
- 
- 	switch (level) {
- 	case SND_SOC_BIAS_ON:
-@@ -492,7 +492,7 @@ static int tlv320aic23_set_bias_level(struct snd_soc_codec *codec,
- 	case SND_SOC_BIAS_OFF:
- 		/* everything off, dac mute, inactive */
- 		snd_soc_write(codec, TLV320AIC23_ACTIVE, 0x0);
--		snd_soc_write(codec, TLV320AIC23_PWR, 0xffff);
-+		snd_soc_write(codec, TLV320AIC23_PWR, 0x1ff);
- 		break;
- 	}
- 	codec->dapm.bias_level = level;
-diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
-index 2f1f5f8..7806301 100644
---- a/sound/soc/codecs/wm8994.c
-+++ b/sound/soc/codecs/wm8994.c
-@@ -883,61 +883,170 @@ static void wm8994_update_class_w(struct snd_soc_codec *codec)
- 	}
- }
- 
--static int late_enable_ev(struct snd_soc_dapm_widget *w,
--			  struct snd_kcontrol *kcontrol, int event)
-+static int aif1clk_ev(struct snd_soc_dapm_widget *w,
-+		      struct snd_kcontrol *kcontrol, int event)
- {
- 	struct snd_soc_codec *codec = w->codec;
--	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
-+	struct wm8994 *control = codec->control_data;
-+	int mask = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC1R_ENA;
-+	int dac;
-+	int adc;
-+	int val;
-+
-+	switch (control->type) {
-+	case WM8994:
-+	case WM8958:
-+		mask |= WM8994_AIF1DAC2L_ENA | WM8994_AIF1DAC2R_ENA;
-+		break;
-+	default:
-+		break;
-+	}
- 
- 	switch (event) {
- 	case SND_SOC_DAPM_PRE_PMU:
--		if (wm8994->aif1clk_enable) {
--			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
--					    WM8994_AIF1CLK_ENA_MASK,
--					    WM8994_AIF1CLK_ENA);
--			wm8994->aif1clk_enable = 0;
--		}
--		if (wm8994->aif2clk_enable) {
--			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
--					    WM8994_AIF2CLK_ENA_MASK,
--					    WM8994_AIF2CLK_ENA);
--			wm8994->aif2clk_enable = 0;
--		}
-+		val = snd_soc_read(codec, WM8994_AIF1_CONTROL_1);
-+		if ((val & WM8994_AIF1ADCL_SRC) &&
-+		    (val & WM8994_AIF1ADCR_SRC))
-+			adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA;
-+		else if (!(val & WM8994_AIF1ADCL_SRC) &&
-+			 !(val & WM8994_AIF1ADCR_SRC))
-+			adc = WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
-+		else
-+			adc = WM8994_AIF1ADC1R_ENA | WM8994_AIF1ADC2R_ENA |
-+				WM8994_AIF1ADC1L_ENA | WM8994_AIF1ADC2L_ENA;
-+
-+		val = snd_soc_read(codec, WM8994_AIF1_CONTROL_2);
-+		if ((val & WM8994_AIF1DACL_SRC) &&
-+		    (val & WM8994_AIF1DACR_SRC))
-+			dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA;
-+		else if (!(val & WM8994_AIF1DACL_SRC) &&
-+			 !(val & WM8994_AIF1DACR_SRC))
-+			dac = WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
-+		else
-+			dac = WM8994_AIF1DAC1R_ENA | WM8994_AIF1DAC2R_ENA |
-+				WM8994_AIF1DAC1L_ENA | WM8994_AIF1DAC2L_ENA;
-+
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
-+				    mask, adc);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+				    mask, dac);
-+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
-+				    WM8994_AIF1DSPCLK_ENA |
-+				    WM8994_SYSDSPCLK_ENA,
-+				    WM8994_AIF1DSPCLK_ENA |
-+				    WM8994_SYSDSPCLK_ENA);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4, mask,
-+				    WM8994_AIF1ADC1R_ENA |
-+				    WM8994_AIF1ADC1L_ENA |
-+				    WM8994_AIF1ADC2R_ENA |
-+				    WM8994_AIF1ADC2L_ENA);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5, mask,
-+				    WM8994_AIF1DAC1R_ENA |
-+				    WM8994_AIF1DAC1L_ENA |
-+				    WM8994_AIF1DAC2R_ENA |
-+				    WM8994_AIF1DAC2L_ENA);
-+		break;
-+
-+	case SND_SOC_DAPM_PRE_PMD:
-+	case SND_SOC_DAPM_POST_PMD:
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+				    mask, 0);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
-+				    mask, 0);
-+
-+		val = snd_soc_read(codec, WM8994_CLOCKING_1);
-+		if (val & WM8994_AIF2DSPCLK_ENA)
-+			val = WM8994_SYSDSPCLK_ENA;
-+		else
-+			val = 0;
-+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
-+				    WM8994_SYSDSPCLK_ENA |
-+				    WM8994_AIF1DSPCLK_ENA, val);
- 		break;
- 	}
- 
--	/* We may also have postponed startup of DSP, handle that. */
--	wm8958_aif_ev(w, kcontrol, event);
--
- 	return 0;
- }
- 
--static int late_disable_ev(struct snd_soc_dapm_widget *w,
--			   struct snd_kcontrol *kcontrol, int event)
-+static int aif2clk_ev(struct snd_soc_dapm_widget *w,
-+		      struct snd_kcontrol *kcontrol, int event)
- {
- 	struct snd_soc_codec *codec = w->codec;
--	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
-+	int dac;
-+	int adc;
-+	int val;
- 
- 	switch (event) {
-+	case SND_SOC_DAPM_PRE_PMU:
-+		val = snd_soc_read(codec, WM8994_AIF2_CONTROL_1);
-+		if ((val & WM8994_AIF2ADCL_SRC) &&
-+		    (val & WM8994_AIF2ADCR_SRC))
-+			adc = WM8994_AIF2ADCR_ENA;
-+		else if (!(val & WM8994_AIF2ADCL_SRC) &&
-+			 !(val & WM8994_AIF2ADCR_SRC))
-+			adc = WM8994_AIF2ADCL_ENA;
-+		else
-+			adc = WM8994_AIF2ADCL_ENA | WM8994_AIF2ADCR_ENA;
-+
-+
-+		val = snd_soc_read(codec, WM8994_AIF2_CONTROL_2);
-+		if ((val & WM8994_AIF2DACL_SRC) &&
-+		    (val & WM8994_AIF2DACR_SRC))
-+			dac = WM8994_AIF2DACR_ENA;
-+		else if (!(val & WM8994_AIF2DACL_SRC) &&
-+			 !(val & WM8994_AIF2DACR_SRC))
-+			dac = WM8994_AIF2DACL_ENA;
-+		else
-+			dac = WM8994_AIF2DACL_ENA | WM8994_AIF2DACR_ENA;
-+
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
-+				    WM8994_AIF2ADCL_ENA |
-+				    WM8994_AIF2ADCR_ENA, adc);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+				    WM8994_AIF2DACL_ENA |
-+				    WM8994_AIF2DACR_ENA, dac);
-+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
-+				    WM8994_AIF2DSPCLK_ENA |
-+				    WM8994_SYSDSPCLK_ENA,
-+				    WM8994_AIF2DSPCLK_ENA |
-+				    WM8994_SYSDSPCLK_ENA);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
-+				    WM8994_AIF2ADCL_ENA |
-+				    WM8994_AIF2ADCR_ENA,
-+				    WM8994_AIF2ADCL_ENA |
-+				    WM8994_AIF2ADCR_ENA);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+				    WM8994_AIF2DACL_ENA |
-+				    WM8994_AIF2DACR_ENA,
-+				    WM8994_AIF2DACL_ENA |
-+				    WM8994_AIF2DACR_ENA);
-+		break;
-+
-+	case SND_SOC_DAPM_PRE_PMD:
- 	case SND_SOC_DAPM_POST_PMD:
--		if (wm8994->aif1clk_disable) {
--			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
--					    WM8994_AIF1CLK_ENA_MASK, 0);
--			wm8994->aif1clk_disable = 0;
--		}
--		if (wm8994->aif2clk_disable) {
--			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
--					    WM8994_AIF2CLK_ENA_MASK, 0);
--			wm8994->aif2clk_disable = 0;
--		}
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+				    WM8994_AIF2DACL_ENA |
-+				    WM8994_AIF2DACR_ENA, 0);
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+				    WM8994_AIF2ADCL_ENA |
-+				    WM8994_AIF2ADCR_ENA, 0);
-+
-+		val = snd_soc_read(codec, WM8994_CLOCKING_1);
-+		if (val & WM8994_AIF1DSPCLK_ENA)
-+			val = WM8994_SYSDSPCLK_ENA;
-+		else
-+			val = 0;
-+		snd_soc_update_bits(codec, WM8994_CLOCKING_1,
-+				    WM8994_SYSDSPCLK_ENA |
-+				    WM8994_AIF2DSPCLK_ENA, val);
- 		break;
- 	}
- 
- 	return 0;
- }
- 
--static int aif1clk_ev(struct snd_soc_dapm_widget *w,
--		      struct snd_kcontrol *kcontrol, int event)
-+static int aif1clk_late_ev(struct snd_soc_dapm_widget *w,
-+			   struct snd_kcontrol *kcontrol, int event)
- {
- 	struct snd_soc_codec *codec = w->codec;
- 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
-@@ -954,8 +1063,8 @@ static int aif1clk_ev(struct snd_soc_dapm_widget *w,
- 	return 0;
- }
- 
--static int aif2clk_ev(struct snd_soc_dapm_widget *w,
--		      struct snd_kcontrol *kcontrol, int event)
-+static int aif2clk_late_ev(struct snd_soc_dapm_widget *w,
-+			   struct snd_kcontrol *kcontrol, int event)
- {
- 	struct snd_soc_codec *codec = w->codec;
- 	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
-@@ -972,6 +1081,63 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
- 	return 0;
- }
- 
-+static int late_enable_ev(struct snd_soc_dapm_widget *w,
-+			  struct snd_kcontrol *kcontrol, int event)
-+{
-+	struct snd_soc_codec *codec = w->codec;
-+	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
-+
-+	switch (event) {
-+	case SND_SOC_DAPM_PRE_PMU:
-+		if (wm8994->aif1clk_enable) {
-+			aif1clk_ev(w, kcontrol, event);
-+			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
-+					    WM8994_AIF1CLK_ENA_MASK,
-+					    WM8994_AIF1CLK_ENA);
-+			wm8994->aif1clk_enable = 0;
-+		}
-+		if (wm8994->aif2clk_enable) {
-+			aif2clk_ev(w, kcontrol, event);
-+			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
-+					    WM8994_AIF2CLK_ENA_MASK,
-+					    WM8994_AIF2CLK_ENA);
-+			wm8994->aif2clk_enable = 0;
-+		}
-+		break;
-+	}
-+
-+	/* We may also have postponed startup of DSP, handle that. */
-+	wm8958_aif_ev(w, kcontrol, event);
-+
-+	return 0;
-+}
-+
-+static int late_disable_ev(struct snd_soc_dapm_widget *w,
-+			   struct snd_kcontrol *kcontrol, int event)
-+{
-+	struct snd_soc_codec *codec = w->codec;
-+	struct wm8994_priv *wm8994 = snd_soc_codec_get_drvdata(codec);
-+
-+	switch (event) {
-+	case SND_SOC_DAPM_POST_PMD:
-+		if (wm8994->aif1clk_disable) {
-+			snd_soc_update_bits(codec, WM8994_AIF1_CLOCKING_1,
-+					    WM8994_AIF1CLK_ENA_MASK, 0);
-+			aif1clk_ev(w, kcontrol, event);
-+			wm8994->aif1clk_disable = 0;
-+		}
-+		if (wm8994->aif2clk_disable) {
-+			snd_soc_update_bits(codec, WM8994_AIF2_CLOCKING_1,
-+					    WM8994_AIF2CLK_ENA_MASK, 0);
-+			aif2clk_ev(w, kcontrol, event);
-+			wm8994->aif2clk_disable = 0;
-+		}
-+		break;
-+	}
-+
-+	return 0;
-+}
-+
- static int adc_mux_ev(struct snd_soc_dapm_widget *w,
- 		      struct snd_kcontrol *kcontrol, int event)
- {
-@@ -1268,9 +1434,9 @@ static const struct snd_kcontrol_new aif2dacr_src_mux =
- 	SOC_DAPM_ENUM("AIF2DACR Mux", aif2dacr_src_enum);
- 
- static const struct snd_soc_dapm_widget wm8994_lateclk_revd_widgets[] = {
--SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_ev,
-+SND_SOC_DAPM_SUPPLY("AIF1CLK", SND_SOC_NOPM, 0, 0, aif1clk_late_ev,
- 	SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
--SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_ev,
-+SND_SOC_DAPM_SUPPLY("AIF2CLK", SND_SOC_NOPM, 0, 0, aif2clk_late_ev,
- 	SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD),
- 
- SND_SOC_DAPM_PGA_E("Late DAC1L Enable PGA", SND_SOC_NOPM, 0, 0, NULL, 0,
-@@ -1299,8 +1465,10 @@ SND_SOC_DAPM_POST("Late Disable PGA", late_disable_ev)
- };
- 
- static const struct snd_soc_dapm_widget wm8994_lateclk_widgets[] = {
--SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, NULL, 0),
--SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, NULL, 0),
-+SND_SOC_DAPM_SUPPLY("AIF1CLK", WM8994_AIF1_CLOCKING_1, 0, 0, aif1clk_ev,
-+		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
-+SND_SOC_DAPM_SUPPLY("AIF2CLK", WM8994_AIF2_CLOCKING_1, 0, 0, aif2clk_ev,
-+		    SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_PRE_PMD),
- SND_SOC_DAPM_PGA("Direct Voice", SND_SOC_NOPM, 0, 0, NULL, 0),
- SND_SOC_DAPM_MIXER("SPKL", WM8994_POWER_MANAGEMENT_3, 8, 0,
- 		   left_speaker_mixer, ARRAY_SIZE(left_speaker_mixer)),
-@@ -1353,30 +1521,30 @@ SND_SOC_DAPM_SUPPLY("VMID", SND_SOC_NOPM, 0, 0, vmid_event,
- SND_SOC_DAPM_SUPPLY("CLK_SYS", SND_SOC_NOPM, 0, 0, clk_sys_event,
- 		    SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
- 
--SND_SOC_DAPM_SUPPLY("DSP1CLK", WM8994_CLOCKING_1, 3, 0, NULL, 0),
--SND_SOC_DAPM_SUPPLY("DSP2CLK", WM8994_CLOCKING_1, 2, 0, NULL, 0),
--SND_SOC_DAPM_SUPPLY("DSPINTCLK", WM8994_CLOCKING_1, 1, 0, NULL, 0),
-+SND_SOC_DAPM_SUPPLY("DSP1CLK", SND_SOC_NOPM, 3, 0, NULL, 0),
-+SND_SOC_DAPM_SUPPLY("DSP2CLK", SND_SOC_NOPM, 2, 0, NULL, 0),
-+SND_SOC_DAPM_SUPPLY("DSPINTCLK", SND_SOC_NOPM, 1, 0, NULL, 0),
- 
- SND_SOC_DAPM_AIF_OUT("AIF1ADC1L", NULL,
--		     0, WM8994_POWER_MANAGEMENT_4, 9, 0),
-+		     0, SND_SOC_NOPM, 9, 0),
- SND_SOC_DAPM_AIF_OUT("AIF1ADC1R", NULL,
--		     0, WM8994_POWER_MANAGEMENT_4, 8, 0),
-+		     0, SND_SOC_NOPM, 8, 0),
- SND_SOC_DAPM_AIF_IN_E("AIF1DAC1L", NULL, 0,
--		      WM8994_POWER_MANAGEMENT_5, 9, 0, wm8958_aif_ev,
-+		      SND_SOC_NOPM, 9, 0, wm8958_aif_ev,
- 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- SND_SOC_DAPM_AIF_IN_E("AIF1DAC1R", NULL, 0,
--		      WM8994_POWER_MANAGEMENT_5, 8, 0, wm8958_aif_ev,
-+		      SND_SOC_NOPM, 8, 0, wm8958_aif_ev,
- 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- 
- SND_SOC_DAPM_AIF_OUT("AIF1ADC2L", NULL,
--		     0, WM8994_POWER_MANAGEMENT_4, 11, 0),
-+		     0, SND_SOC_NOPM, 11, 0),
- SND_SOC_DAPM_AIF_OUT("AIF1ADC2R", NULL,
--		     0, WM8994_POWER_MANAGEMENT_4, 10, 0),
-+		     0, SND_SOC_NOPM, 10, 0),
- SND_SOC_DAPM_AIF_IN_E("AIF1DAC2L", NULL, 0,
--		      WM8994_POWER_MANAGEMENT_5, 11, 0, wm8958_aif_ev,
-+		      SND_SOC_NOPM, 11, 0, wm8958_aif_ev,
- 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- SND_SOC_DAPM_AIF_IN_E("AIF1DAC2R", NULL, 0,
--		      WM8994_POWER_MANAGEMENT_5, 10, 0, wm8958_aif_ev,
-+		      SND_SOC_NOPM, 10, 0, wm8958_aif_ev,
- 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_POST_PMD),
- 
- SND_SOC_DAPM_MIXER("AIF1ADC1L Mixer", SND_SOC_NOPM, 0, 0,
-@@ -1403,14 +1571,14 @@ SND_SOC_DAPM_MIXER("DAC1R Mixer", SND_SOC_NOPM, 0, 0,
- 		   dac1r_mix, ARRAY_SIZE(dac1r_mix)),
- 
- SND_SOC_DAPM_AIF_OUT("AIF2ADCL", NULL, 0,
--		     WM8994_POWER_MANAGEMENT_4, 13, 0),
-+		     SND_SOC_NOPM, 13, 0),
- SND_SOC_DAPM_AIF_OUT("AIF2ADCR", NULL, 0,
--		     WM8994_POWER_MANAGEMENT_4, 12, 0),
-+		     SND_SOC_NOPM, 12, 0),
- SND_SOC_DAPM_AIF_IN_E("AIF2DACL", NULL, 0,
--		      WM8994_POWER_MANAGEMENT_5, 13, 0, wm8958_aif_ev,
-+		      SND_SOC_NOPM, 13, 0, wm8958_aif_ev,
- 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
- SND_SOC_DAPM_AIF_IN_E("AIF2DACR", NULL, 0,
--		      WM8994_POWER_MANAGEMENT_5, 12, 0, wm8958_aif_ev,
-+		      SND_SOC_NOPM, 12, 0, wm8958_aif_ev,
- 		      SND_SOC_DAPM_POST_PMU | SND_SOC_DAPM_PRE_PMD),
- 
- SND_SOC_DAPM_AIF_IN("AIF1DACDAT", "AIF1 Playback", 0, SND_SOC_NOPM, 0, 0),
-diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
-index ea909c5..90e93bf 100644
---- a/sound/soc/soc-dapm.c
-+++ b/sound/soc/soc-dapm.c
-@@ -69,6 +69,7 @@ static int dapm_up_seq[] = {
- 	[snd_soc_dapm_out_drv] = 10,
- 	[snd_soc_dapm_hp] = 10,
- 	[snd_soc_dapm_spk] = 10,
-+	[snd_soc_dapm_line] = 10,
- 	[snd_soc_dapm_post] = 11,
- };
- 
-@@ -77,6 +78,7 @@ static int dapm_down_seq[] = {
- 	[snd_soc_dapm_adc] = 1,
- 	[snd_soc_dapm_hp] = 2,
- 	[snd_soc_dapm_spk] = 2,
-+	[snd_soc_dapm_line] = 2,
- 	[snd_soc_dapm_out_drv] = 2,
- 	[snd_soc_dapm_pga] = 4,
- 	[snd_soc_dapm_mixer_named_ctl] = 5,
-diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
-index adb372d..e0a0970 100644
---- a/tools/perf/util/hist.c
-+++ b/tools/perf/util/hist.c
-@@ -237,8 +237,8 @@ struct hist_entry *__hists__add_entry(struct hists *hists,
- 			 * mis-adjust symbol addresses when computing
- 			 * the history counter to increment.
- 			 */
--			if (he->ms.map != entry->ms.map) {
--				he->ms.map = entry->ms.map;
-+			if (he->ms.map != entry.ms.map) {
-+				he->ms.map = entry.ms.map;
- 				if (he->ms.map)
- 					he->ms.map->referenced = true;
- 			}
-diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
-index a195c07..fd817a2 100644
---- a/virt/kvm/iommu.c
-+++ b/virt/kvm/iommu.c
-@@ -309,6 +309,11 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
- 	}
- }
- 
-+void kvm_iommu_unmap_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
-+{
-+	kvm_iommu_put_pages(kvm, slot->base_gfn, slot->npages);
-+}
-+
- static int kvm_iommu_unmap_memslots(struct kvm *kvm)
- {
- 	int i, idx;
-@@ -317,10 +322,9 @@ static int kvm_iommu_unmap_memslots(struct kvm *kvm)
- 	idx = srcu_read_lock(&kvm->srcu);
- 	slots = kvm_memslots(kvm);
- 
--	for (i = 0; i < slots->nmemslots; i++) {
--		kvm_iommu_put_pages(kvm, slots->memslots[i].base_gfn,
--				    slots->memslots[i].npages);
--	}
-+	for (i = 0; i < slots->nmemslots; i++)
-+		kvm_iommu_unmap_pages(kvm, &slots->memslots[i]);
-+
- 	srcu_read_unlock(&kvm->srcu, idx);
- 
- 	return 0;
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index d9cfb78..e401c1b 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -802,12 +802,13 @@ skip_lpage:
- 	if (r)
- 		goto out_free;
- 
--	/* map the pages in iommu page table */
-+	/* map/unmap the pages in iommu page table */
- 	if (npages) {
- 		r = kvm_iommu_map_pages(kvm, &new);
- 		if (r)
- 			goto out_free;
--	}
-+	} else
-+		kvm_iommu_unmap_pages(kvm, &old);
- 
- 	r = -ENOMEM;
- 	slots = kzalloc(sizeof(struct kvm_memslots), GFP_KERNEL);

diff --git a/3.2.18/1017_linux-3.2.18.patch b/3.2.18/1017_linux-3.2.18.patch
deleted file mode 100644
index 7a64c07..0000000
--- a/3.2.18/1017_linux-3.2.18.patch
+++ /dev/null
@@ -1,1791 +0,0 @@
-diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
-index 589f2da..a4399f5 100644
---- a/Documentation/networking/ip-sysctl.txt
-+++ b/Documentation/networking/ip-sysctl.txt
-@@ -137,7 +137,7 @@ tcp_adv_win_scale - INTEGER
- 	(if tcp_adv_win_scale > 0) or bytes-bytes/2^(-tcp_adv_win_scale),
- 	if it is <= 0.
- 	Possible values are [-31, 31], inclusive.
--	Default: 2
-+	Default: 1
- 
- tcp_allowed_congestion_control - STRING
- 	Show/set the congestion control choices available to non-privileged
-@@ -397,7 +397,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max
- 	net.core.rmem_max.  Calling setsockopt() with SO_RCVBUF disables
- 	automatic tuning of that socket's receive buffer size, in which
- 	case this value is ignored.
--	Default: between 87380B and 4MB, depending on RAM size.
-+	Default: between 87380B and 6MB, depending on RAM size.
- 
- tcp_sack - BOOLEAN
- 	Enable select acknowledgments (SACKS).
-diff --git a/Makefile b/Makefile
-index 4c4efa3..add68f1 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 2
--SUBLEVEL = 17
-+SUBLEVEL = 18
- EXTRAVERSION =
- NAME = Saber-toothed Squirrel
- 
-diff --git a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
-index 1e2d332..c88420d 100644
---- a/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
-+++ b/arch/arm/mach-omap2/include/mach/ctrl_module_pad_core_44xx.h
-@@ -941,10 +941,10 @@
- #define OMAP4_DSI2_LANEENABLE_MASK				(0x7 << 29)
- #define OMAP4_DSI1_LANEENABLE_SHIFT				24
- #define OMAP4_DSI1_LANEENABLE_MASK				(0x1f << 24)
--#define OMAP4_DSI2_PIPD_SHIFT					19
--#define OMAP4_DSI2_PIPD_MASK					(0x1f << 19)
--#define OMAP4_DSI1_PIPD_SHIFT					14
--#define OMAP4_DSI1_PIPD_MASK					(0x1f << 14)
-+#define OMAP4_DSI1_PIPD_SHIFT					19
-+#define OMAP4_DSI1_PIPD_MASK					(0x1f << 19)
-+#define OMAP4_DSI2_PIPD_SHIFT					14
-+#define OMAP4_DSI2_PIPD_MASK					(0x1f << 14)
- 
- /* CONTROL_MCBSPLP */
- #define OMAP4_ALBCTRLRX_FSX_SHIFT				31
-diff --git a/arch/arm/mach-orion5x/mpp.h b/arch/arm/mach-orion5x/mpp.h
-index eac6897..db70e79 100644
---- a/arch/arm/mach-orion5x/mpp.h
-+++ b/arch/arm/mach-orion5x/mpp.h
-@@ -65,8 +65,8 @@
- #define MPP8_GIGE               MPP(8,  0x1, 0, 0, 1,   1,   1)
- 
- #define MPP9_UNUSED		MPP(9,  0x0, 0, 0, 1,   1,   1)
--#define MPP9_GPIO		MPP(9,  0x0, 0, 0, 1,   1,   1)
--#define MPP9_GIGE               MPP(9,  0x1, 1, 1, 1,   1,   1)
-+#define MPP9_GPIO		MPP(9,  0x0, 1, 1, 1,   1,   1)
-+#define MPP9_GIGE               MPP(9,  0x1, 0, 0, 1,   1,   1)
- 
- #define MPP10_UNUSED		MPP(10, 0x0, 0, 0, 1,   1,   1)
- #define MPP10_GPIO		MPP(10, 0x0, 1, 1, 1,   1,   1)
-diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c
-index aa33949..4b0bc37 100644
---- a/arch/arm/mm/fault.c
-+++ b/arch/arm/mm/fault.c
-@@ -267,7 +267,9 @@ good_area:
- 	return fault;
- 
- check_stack:
--	if (vma->vm_flags & VM_GROWSDOWN && !expand_stack(vma, addr))
-+	/* Don't allow expansion below FIRST_USER_ADDRESS */
-+	if (vma->vm_flags & VM_GROWSDOWN &&
-+	    addr >= FIRST_USER_ADDRESS && !expand_stack(vma, addr))
- 		goto good_area;
- out:
- 	return fault;
-diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
-index 8f3ccdd..8ea07e4 100644
---- a/arch/arm/vfp/vfpmodule.c
-+++ b/arch/arm/vfp/vfpmodule.c
-@@ -11,6 +11,7 @@
- #include <linux/types.h>
- #include <linux/cpu.h>
- #include <linux/cpu_pm.h>
-+#include <linux/hardirq.h>
- #include <linux/kernel.h>
- #include <linux/notifier.h>
- #include <linux/signal.h>
-@@ -428,7 +429,10 @@ void VFP_bounce(u32 trigger, u32 fpexc, struct pt_regs *regs)
- 
- static void vfp_enable(void *unused)
- {
--	u32 access = get_copro_access();
-+	u32 access;
-+
-+	BUG_ON(preemptible());
-+	access = get_copro_access();
- 
- 	/*
- 	 * Enable full access to VFP (cp10 and cp11)
-@@ -556,7 +560,7 @@ static int __init vfp_init(void)
- 	unsigned int cpu_arch = cpu_architecture();
- 
- 	if (cpu_arch >= CPU_ARCH_ARMv6)
--		vfp_enable(NULL);
-+		on_each_cpu(vfp_enable, NULL, 1);
- 
- 	/*
- 	 * First check that there is a VFP that we can use.
-@@ -577,8 +581,6 @@ static int __init vfp_init(void)
- 	} else {
- 		hotcpu_notifier(vfp_hotplug, 0);
- 
--		smp_call_function(vfp_enable, NULL, 1);
--
- 		VFP_arch = (vfpsid & FPSID_ARCH_MASK) >> FPSID_ARCH_BIT;  /* Extract the architecture version */
- 		printk("implementor %02x architecture %d part %02x variant %x rev %x\n",
- 			(vfpsid & FPSID_IMPLEMENTER_MASK) >> FPSID_IMPLEMENTER_BIT,
-diff --git a/arch/ia64/include/asm/unistd.h b/arch/ia64/include/asm/unistd.h
-index 7617248..7a3bd25 100644
---- a/arch/ia64/include/asm/unistd.h
-+++ b/arch/ia64/include/asm/unistd.h
-@@ -323,11 +323,12 @@
- #define __NR_sendmmsg			1331
- #define __NR_process_vm_readv		1332
- #define __NR_process_vm_writev		1333
-+#define __NR_accept4			1334
- 
- #ifdef __KERNEL__
- 
- 
--#define NR_syscalls			310 /* length of syscall table */
-+#define NR_syscalls			311 /* length of syscall table */
- 
- /*
-  * The following defines stop scripts/checksyscalls.sh from complaining about
-diff --git a/arch/ia64/kernel/entry.S b/arch/ia64/kernel/entry.S
-index 5b31d46..1ccbe12 100644
---- a/arch/ia64/kernel/entry.S
-+++ b/arch/ia64/kernel/entry.S
-@@ -1779,6 +1779,7 @@ sys_call_table:
- 	data8 sys_sendmmsg
- 	data8 sys_process_vm_readv
- 	data8 sys_process_vm_writev
-+	data8 sys_accept4
- 
- 	.org sys_call_table + 8*NR_syscalls	// guard against failures to increase NR_syscalls
- #endif /* __IA64_ASM_PARAVIRTUALIZED_NATIVE */
-diff --git a/arch/sparc/kernel/central.c b/arch/sparc/kernel/central.c
-index 38d48a5..9708851 100644
---- a/arch/sparc/kernel/central.c
-+++ b/arch/sparc/kernel/central.c
-@@ -269,4 +269,4 @@ static int __init sunfire_init(void)
- 	return 0;
- }
- 
--subsys_initcall(sunfire_init);
-+fs_initcall(sunfire_init);
-diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
-index b57a594..874162a 100644
---- a/arch/sparc/mm/ultra.S
-+++ b/arch/sparc/mm/ultra.S
-@@ -495,11 +495,11 @@ xcall_fetch_glob_regs:
- 	stx		%o7, [%g1 + GR_SNAP_O7]
- 	stx		%i7, [%g1 + GR_SNAP_I7]
- 	/* Don't try this at home kids... */
--	rdpr		%cwp, %g2
--	sub		%g2, 1, %g7
-+	rdpr		%cwp, %g3
-+	sub		%g3, 1, %g7
- 	wrpr		%g7, %cwp
- 	mov		%i7, %g7
--	wrpr		%g2, %cwp
-+	wrpr		%g3, %cwp
- 	stx		%g7, [%g1 + GR_SNAP_RPC]
- 	sethi		%hi(trap_block), %g7
- 	or		%g7, %lo(trap_block), %g7
-diff --git a/arch/tile/kernel/compat_signal.c b/arch/tile/kernel/compat_signal.c
-index a7869ad..41459d8 100644
---- a/arch/tile/kernel/compat_signal.c
-+++ b/arch/tile/kernel/compat_signal.c
-@@ -406,19 +406,17 @@ int compat_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
- 	 * Set up registers for signal handler.
- 	 * Registers that we don't modify keep the value they had from
- 	 * user-space at the time we took the signal.
-+	 * We always pass siginfo and mcontext, regardless of SA_SIGINFO,
-+	 * since some things rely on this (e.g. glibc's debug/segfault.c).
- 	 */
- 	regs->pc = ptr_to_compat_reg(ka->sa.sa_handler);
- 	regs->ex1 = PL_ICS_EX1(USER_PL, 1); /* set crit sec in handler */
- 	regs->sp = ptr_to_compat_reg(frame);
- 	regs->lr = restorer;
- 	regs->regs[0] = (unsigned long) usig;
--
--	if (ka->sa.sa_flags & SA_SIGINFO) {
--		/* Need extra arguments, so mark to restore caller-saves. */
--		regs->regs[1] = ptr_to_compat_reg(&frame->info);
--		regs->regs[2] = ptr_to_compat_reg(&frame->uc);
--		regs->flags |= PT_FLAGS_CALLER_SAVES;
--	}
-+	regs->regs[1] = ptr_to_compat_reg(&frame->info);
-+	regs->regs[2] = ptr_to_compat_reg(&frame->uc);
-+	regs->flags |= PT_FLAGS_CALLER_SAVES;
- 
- 	/*
- 	 * Notify any tracer that was single-stepping it.
-diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig
-index 6d16b4b..7e3002b 100644
---- a/drivers/crypto/Kconfig
-+++ b/drivers/crypto/Kconfig
-@@ -173,6 +173,7 @@ config CRYPTO_DEV_MV_CESA
- 	select CRYPTO_ALGAPI
- 	select CRYPTO_AES
- 	select CRYPTO_BLKCIPHER2
-+	select CRYPTO_HASH
- 	help
- 	  This driver allows you to utilize the Cryptographic Engines and
- 	  Security Accelerator (CESA) which can be found on the Marvell Orion
-diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
-index 461958f..271fd49 100644
---- a/drivers/gpio/gpio-ml-ioh.c
-+++ b/drivers/gpio/gpio-ml-ioh.c
-@@ -448,6 +448,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
- 		chip->reg = chip->base;
- 		chip->ch = i;
- 		mutex_init(&chip->lock);
-+		spin_lock_init(&chip->spinlock);
- 		ioh_gpio_setup(chip, num_ports[i]);
- 		ret = gpiochip_add(&chip->gpio);
- 		if (ret) {
-diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
-index 801d92d..a417f94 100644
---- a/drivers/md/dm-mpath.c
-+++ b/drivers/md/dm-mpath.c
-@@ -698,8 +698,8 @@ static int parse_hw_handler(struct dm_arg_set *as, struct multipath *m)
- 		return 0;
- 
- 	m->hw_handler_name = kstrdup(dm_shift_arg(as), GFP_KERNEL);
--	request_module("scsi_dh_%s", m->hw_handler_name);
--	if (scsi_dh_handler_exist(m->hw_handler_name) == 0) {
-+	if (!try_then_request_module(scsi_dh_handler_exist(m->hw_handler_name),
-+				     "scsi_dh_%s", m->hw_handler_name)) {
- 		ti->error = "unknown hardware handler type";
- 		ret = -EINVAL;
- 		goto fail;
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 065ab4f..adcd850 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -392,6 +392,8 @@ void mddev_suspend(struct mddev *mddev)
- 	synchronize_rcu();
- 	wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0);
- 	mddev->pers->quiesce(mddev, 1);
-+
-+	del_timer_sync(&mddev->safemode_timer);
- }
- EXPORT_SYMBOL_GPL(mddev_suspend);
- 
-diff --git a/drivers/media/rc/ene_ir.c b/drivers/media/rc/ene_ir.c
-index cf10ecf..ed77c6d 100644
---- a/drivers/media/rc/ene_ir.c
-+++ b/drivers/media/rc/ene_ir.c
-@@ -1018,22 +1018,6 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
- 
- 	spin_lock_init(&dev->hw_lock);
- 
--	/* claim the resources */
--	error = -EBUSY;
--	dev->hw_io = pnp_port_start(pnp_dev, 0);
--	if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
--		dev->hw_io = -1;
--		dev->irq = -1;
--		goto error;
--	}
--
--	dev->irq = pnp_irq(pnp_dev, 0);
--	if (request_irq(dev->irq, ene_isr,
--			IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
--		dev->irq = -1;
--		goto error;
--	}
--
- 	pnp_set_drvdata(pnp_dev, dev);
- 	dev->pnp_dev = pnp_dev;
- 
-@@ -1086,6 +1070,22 @@ static int ene_probe(struct pnp_dev *pnp_dev, const struct pnp_device_id *id)
- 	device_set_wakeup_capable(&pnp_dev->dev, true);
- 	device_set_wakeup_enable(&pnp_dev->dev, true);
- 
-+	/* claim the resources */
-+	error = -EBUSY;
-+	dev->hw_io = pnp_port_start(pnp_dev, 0);
-+	if (!request_region(dev->hw_io, ENE_IO_SIZE, ENE_DRIVER_NAME)) {
-+		dev->hw_io = -1;
-+		dev->irq = -1;
-+		goto error;
-+	}
-+
-+	dev->irq = pnp_irq(pnp_dev, 0);
-+	if (request_irq(dev->irq, ene_isr,
-+			IRQF_SHARED, ENE_DRIVER_NAME, (void *)dev)) {
-+		dev->irq = -1;
-+		goto error;
-+	}
-+
- 	error = rc_register_device(rdev);
- 	if (error < 0)
- 		goto error;
-diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
-index 7f7079b..4218f73 100644
---- a/drivers/media/rc/fintek-cir.c
-+++ b/drivers/media/rc/fintek-cir.c
-@@ -504,16 +504,6 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
- 
- 	spin_lock_init(&fintek->fintek_lock);
- 
--	ret = -EBUSY;
--	/* now claim resources */
--	if (!request_region(fintek->cir_addr,
--			    fintek->cir_port_len, FINTEK_DRIVER_NAME))
--		goto failure;
--
--	if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
--			FINTEK_DRIVER_NAME, (void *)fintek))
--		goto failure;
--
- 	pnp_set_drvdata(pdev, fintek);
- 	fintek->pdev = pdev;
- 
-@@ -548,6 +538,16 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
- 	/* rx resolution is hardwired to 50us atm, 1, 25, 100 also possible */
- 	rdev->rx_resolution = US_TO_NS(CIR_SAMPLE_PERIOD);
- 
-+	ret = -EBUSY;
-+	/* now claim resources */
-+	if (!request_region(fintek->cir_addr,
-+			    fintek->cir_port_len, FINTEK_DRIVER_NAME))
-+		goto failure;
-+
-+	if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
-+			FINTEK_DRIVER_NAME, (void *)fintek))
-+		goto failure;
-+
- 	ret = rc_register_device(rdev);
- 	if (ret)
- 		goto failure;
-diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
-index 682009d..0e49c99 100644
---- a/drivers/media/rc/ite-cir.c
-+++ b/drivers/media/rc/ite-cir.c
-@@ -1515,16 +1515,6 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
- 	/* initialize raw event */
- 	init_ir_raw_event(&itdev->rawir);
- 
--	ret = -EBUSY;
--	/* now claim resources */
--	if (!request_region(itdev->cir_addr,
--				dev_desc->io_region_size, ITE_DRIVER_NAME))
--		goto failure;
--
--	if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
--			ITE_DRIVER_NAME, (void *)itdev))
--		goto failure;
--
- 	/* set driver data into the pnp device */
- 	pnp_set_drvdata(pdev, itdev);
- 	itdev->pdev = pdev;
-@@ -1600,6 +1590,16 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
- 	rdev->driver_name = ITE_DRIVER_NAME;
- 	rdev->map_name = RC_MAP_RC6_MCE;
- 
-+	ret = -EBUSY;
-+	/* now claim resources */
-+	if (!request_region(itdev->cir_addr,
-+				dev_desc->io_region_size, ITE_DRIVER_NAME))
-+		goto failure;
-+
-+	if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
-+			ITE_DRIVER_NAME, (void *)itdev))
-+		goto failure;
-+
- 	ret = rc_register_device(rdev);
- 	if (ret)
- 		goto failure;
-diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
-index 144f3f5..8b2c071 100644
---- a/drivers/media/rc/nuvoton-cir.c
-+++ b/drivers/media/rc/nuvoton-cir.c
-@@ -1021,24 +1021,6 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
- 	spin_lock_init(&nvt->nvt_lock);
- 	spin_lock_init(&nvt->tx.lock);
- 
--	ret = -EBUSY;
--	/* now claim resources */
--	if (!request_region(nvt->cir_addr,
--			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
--		goto failure;
--
--	if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
--			NVT_DRIVER_NAME, (void *)nvt))
--		goto failure;
--
--	if (!request_region(nvt->cir_wake_addr,
--			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
--		goto failure;
--
--	if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
--			NVT_DRIVER_NAME, (void *)nvt))
--		goto failure;
--
- 	pnp_set_drvdata(pdev, nvt);
- 	nvt->pdev = pdev;
- 
-@@ -1085,6 +1067,24 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
- 	rdev->tx_resolution = XYZ;
- #endif
- 
-+	ret = -EBUSY;
-+	/* now claim resources */
-+	if (!request_region(nvt->cir_addr,
-+			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
-+		goto failure;
-+
-+	if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
-+			NVT_DRIVER_NAME, (void *)nvt))
-+		goto failure;
-+
-+	if (!request_region(nvt->cir_wake_addr,
-+			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
-+		goto failure;
-+
-+	if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
-+			NVT_DRIVER_NAME, (void *)nvt))
-+		goto failure;
-+
- 	ret = rc_register_device(rdev);
- 	if (ret)
- 		goto failure;
-diff --git a/drivers/media/rc/winbond-cir.c b/drivers/media/rc/winbond-cir.c
-index a7e7d6f..4591770 100644
---- a/drivers/media/rc/winbond-cir.c
-+++ b/drivers/media/rc/winbond-cir.c
-@@ -991,39 +991,10 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
- 		"(w: 0x%lX, e: 0x%lX, s: 0x%lX, i: %u)\n",
- 		data->wbase, data->ebase, data->sbase, data->irq);
- 
--	if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
--		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
--			data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
--		err = -EBUSY;
--		goto exit_free_data;
--	}
--
--	if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
--		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
--			data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
--		err = -EBUSY;
--		goto exit_release_wbase;
--	}
--
--	if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
--		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
--			data->sbase, data->sbase + SP_IOMEM_LEN - 1);
--		err = -EBUSY;
--		goto exit_release_ebase;
--	}
--
--	err = request_irq(data->irq, wbcir_irq_handler,
--			  IRQF_DISABLED, DRVNAME, device);
--	if (err) {
--		dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
--		err = -EBUSY;
--		goto exit_release_sbase;
--	}
--
- 	led_trigger_register_simple("cir-tx", &data->txtrigger);
- 	if (!data->txtrigger) {
- 		err = -ENOMEM;
--		goto exit_free_irq;
-+		goto exit_free_data;
- 	}
- 
- 	led_trigger_register_simple("cir-rx", &data->rxtrigger);
-@@ -1062,9 +1033,38 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
- 	data->dev->priv = data;
- 	data->dev->dev.parent = &device->dev;
- 
-+	if (!request_region(data->wbase, WAKEUP_IOMEM_LEN, DRVNAME)) {
-+		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-+			data->wbase, data->wbase + WAKEUP_IOMEM_LEN - 1);
-+		err = -EBUSY;
-+		goto exit_free_rc;
-+	}
-+
-+	if (!request_region(data->ebase, EHFUNC_IOMEM_LEN, DRVNAME)) {
-+		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-+			data->ebase, data->ebase + EHFUNC_IOMEM_LEN - 1);
-+		err = -EBUSY;
-+		goto exit_release_wbase;
-+	}
-+
-+	if (!request_region(data->sbase, SP_IOMEM_LEN, DRVNAME)) {
-+		dev_err(dev, "Region 0x%lx-0x%lx already in use!\n",
-+			data->sbase, data->sbase + SP_IOMEM_LEN - 1);
-+		err = -EBUSY;
-+		goto exit_release_ebase;
-+	}
-+
-+	err = request_irq(data->irq, wbcir_irq_handler,
-+			  IRQF_DISABLED, DRVNAME, device);
-+	if (err) {
-+		dev_err(dev, "Failed to claim IRQ %u\n", data->irq);
-+		err = -EBUSY;
-+		goto exit_release_sbase;
-+	}
-+
- 	err = rc_register_device(data->dev);
- 	if (err)
--		goto exit_free_rc;
-+		goto exit_free_irq;
- 
- 	device_init_wakeup(&device->dev, 1);
- 
-@@ -1072,14 +1072,6 @@ wbcir_probe(struct pnp_dev *device, const struct pnp_device_id *dev_id)
- 
- 	return 0;
- 
--exit_free_rc:
--	rc_free_device(data->dev);
--exit_unregister_led:
--	led_classdev_unregister(&data->led);
--exit_unregister_rxtrigger:
--	led_trigger_unregister_simple(data->rxtrigger);
--exit_unregister_txtrigger:
--	led_trigger_unregister_simple(data->txtrigger);
- exit_free_irq:
- 	free_irq(data->irq, device);
- exit_release_sbase:
-@@ -1088,6 +1080,14 @@ exit_release_ebase:
- 	release_region(data->ebase, EHFUNC_IOMEM_LEN);
- exit_release_wbase:
- 	release_region(data->wbase, WAKEUP_IOMEM_LEN);
-+exit_free_rc:
-+	rc_free_device(data->dev);
-+exit_unregister_led:
-+	led_classdev_unregister(&data->led);
-+exit_unregister_rxtrigger:
-+	led_trigger_unregister_simple(data->rxtrigger);
-+exit_unregister_txtrigger:
-+	led_trigger_unregister_simple(data->txtrigger);
- exit_free_data:
- 	kfree(data);
- 	pnp_set_drvdata(device, NULL);
-diff --git a/drivers/media/video/marvell-ccic/mmp-driver.c b/drivers/media/video/marvell-ccic/mmp-driver.c
-index fb0b124..a6b7657 100644
---- a/drivers/media/video/marvell-ccic/mmp-driver.c
-+++ b/drivers/media/video/marvell-ccic/mmp-driver.c
-@@ -175,7 +175,6 @@ static int mmpcam_probe(struct platform_device *pdev)
- 	INIT_LIST_HEAD(&cam->devlist);
- 
- 	mcam = &cam->mcam;
--	mcam->platform = MHP_Armada610;
- 	mcam->plat_power_up = mmpcam_power_up;
- 	mcam->plat_power_down = mmpcam_power_down;
- 	mcam->dev = &pdev->dev;
-diff --git a/drivers/media/video/s5p-fimc/fimc-capture.c b/drivers/media/video/s5p-fimc/fimc-capture.c
-index 2cc3b91..327a81f 100644
---- a/drivers/media/video/s5p-fimc/fimc-capture.c
-+++ b/drivers/media/video/s5p-fimc/fimc-capture.c
-@@ -1304,7 +1304,7 @@ static int fimc_subdev_set_crop(struct v4l2_subdev *sd,
- 	fimc_capture_try_crop(ctx, r, crop->pad);
- 
- 	if (crop->which == V4L2_SUBDEV_FORMAT_TRY) {
--		mutex_lock(&fimc->lock);
-+		mutex_unlock(&fimc->lock);
- 		*v4l2_subdev_get_try_crop(fh, crop->pad) = *r;
- 		return 0;
- 	}
-diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
-index 3d55883..2dcac28 100644
---- a/drivers/net/ethernet/broadcom/tg3.c
-+++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -879,8 +879,13 @@ static inline unsigned int tg3_has_work(struct tg3_napi *tnapi)
- 		if (sblk->status & SD_STATUS_LINK_CHG)
- 			work_exists = 1;
- 	}
--	/* check for RX/TX work to do */
--	if (sblk->idx[0].tx_consumer != tnapi->tx_cons ||
-+
-+	/* check for TX work to do */
-+	if (sblk->idx[0].tx_consumer != tnapi->tx_cons)
-+		work_exists = 1;
-+
-+	/* check for RX work to do */
-+	if (tnapi->rx_rcb_prod_idx &&
- 	    *(tnapi->rx_rcb_prod_idx) != tnapi->rx_rcb_ptr)
- 		work_exists = 1;
- 
-@@ -5895,6 +5900,9 @@ static int tg3_poll_work(struct tg3_napi *tnapi, int work_done, int budget)
- 			return work_done;
- 	}
- 
-+	if (!tnapi->rx_rcb_prod_idx)
-+		return work_done;
-+
- 	/* run RX thread, within the bounds set by NAPI.
- 	 * All RX "locking" is done by ensuring outside
- 	 * code synchronizes with tg3->napi.poll()
-@@ -7448,6 +7456,12 @@ static int tg3_alloc_consistent(struct tg3 *tp)
- 		 */
- 		switch (i) {
- 		default:
-+			if (tg3_flag(tp, ENABLE_RSS)) {
-+				tnapi->rx_rcb_prod_idx = NULL;
-+				break;
-+			}
-+			/* Fall through */
-+		case 1:
- 			tnapi->rx_rcb_prod_idx = &sblk->idx[0].rx_producer;
- 			break;
- 		case 2:
-diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
-index cf480b5..de00805 100644
---- a/drivers/net/ethernet/intel/e1000/e1000_main.c
-+++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
-@@ -494,7 +494,11 @@ out:
- static void e1000_down_and_stop(struct e1000_adapter *adapter)
- {
- 	set_bit(__E1000_DOWN, &adapter->flags);
--	cancel_work_sync(&adapter->reset_task);
-+
-+	/* Only kill reset task if adapter is not resetting */
-+	if (!test_bit(__E1000_RESETTING, &adapter->flags))
-+		cancel_work_sync(&adapter->reset_task);
-+
- 	cancel_delayed_work_sync(&adapter->watchdog_task);
- 	cancel_delayed_work_sync(&adapter->phy_info_task);
- 	cancel_delayed_work_sync(&adapter->fifo_stall_task);
-diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
-index 7eb8a00..65c51ff 100644
---- a/drivers/net/ethernet/marvell/sky2.c
-+++ b/drivers/net/ethernet/marvell/sky2.c
-@@ -2475,8 +2475,13 @@ static struct sk_buff *receive_copy(struct sky2_port *sky2,
- 		skb_copy_from_linear_data(re->skb, skb->data, length);
- 		skb->ip_summed = re->skb->ip_summed;
- 		skb->csum = re->skb->csum;
-+		skb->rxhash = re->skb->rxhash;
-+		skb->vlan_tci = re->skb->vlan_tci;
-+
- 		pci_dma_sync_single_for_device(sky2->hw->pdev, re->data_addr,
- 					       length, PCI_DMA_FROMDEVICE);
-+		re->skb->vlan_tci = 0;
-+		re->skb->rxhash = 0;
- 		re->skb->ip_summed = CHECKSUM_NONE;
- 		skb_put(skb, length);
- 	}
-@@ -2561,9 +2566,6 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
- 	struct sk_buff *skb = NULL;
- 	u16 count = (status & GMR_FS_LEN) >> 16;
- 
--	if (status & GMR_FS_VLAN)
--		count -= VLAN_HLEN;	/* Account for vlan tag */
--
- 	netif_printk(sky2, rx_status, KERN_DEBUG, dev,
- 		     "rx slot %u status 0x%x len %d\n",
- 		     sky2->rx_next, status, length);
-@@ -2571,6 +2573,9 @@ static struct sk_buff *sky2_receive(struct net_device *dev,
- 	sky2->rx_next = (sky2->rx_next + 1) % sky2->rx_pending;
- 	prefetch(sky2->rx_ring + sky2->rx_next);
- 
-+	if (vlan_tx_tag_present(re->skb))
-+		count -= VLAN_HLEN;	/* Account for vlan tag */
-+
- 	/* This chip has hardware problems that generates bogus status.
- 	 * So do only marginal checking and expect higher level protocols
- 	 * to handle crap frames.
-@@ -2628,11 +2633,8 @@ static inline void sky2_tx_done(struct net_device *dev, u16 last)
- }
- 
- static inline void sky2_skb_rx(const struct sky2_port *sky2,
--			       u32 status, struct sk_buff *skb)
-+			       struct sk_buff *skb)
- {
--	if (status & GMR_FS_VLAN)
--		__vlan_hwaccel_put_tag(skb, be16_to_cpu(sky2->rx_tag));
--
- 	if (skb->ip_summed == CHECKSUM_NONE)
- 		netif_receive_skb(skb);
- 	else
-@@ -2686,6 +2688,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status)
- 	}
- }
- 
-+static void sky2_rx_tag(struct sky2_port *sky2, u16 length)
-+{
-+	struct sk_buff *skb;
-+
-+	skb = sky2->rx_ring[sky2->rx_next].skb;
-+	__vlan_hwaccel_put_tag(skb, be16_to_cpu(length));
-+}
-+
- static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
- {
- 	struct sk_buff *skb;
-@@ -2744,8 +2754,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
- 			}
- 
- 			skb->protocol = eth_type_trans(skb, dev);
--
--			sky2_skb_rx(sky2, status, skb);
-+			sky2_skb_rx(sky2, skb);
- 
- 			/* Stop after net poll weight */
- 			if (++work_done >= to_do)
-@@ -2753,11 +2762,11 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
- 			break;
- 
- 		case OP_RXVLAN:
--			sky2->rx_tag = length;
-+			sky2_rx_tag(sky2, length);
- 			break;
- 
- 		case OP_RXCHKSVLAN:
--			sky2->rx_tag = length;
-+			sky2_rx_tag(sky2, length);
- 			/* fall through */
- 		case OP_RXCHKS:
- 			if (likely(dev->features & NETIF_F_RXCSUM))
-diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
-index ff6f58b..3c896ce 100644
---- a/drivers/net/ethernet/marvell/sky2.h
-+++ b/drivers/net/ethernet/marvell/sky2.h
-@@ -2241,7 +2241,6 @@ struct sky2_port {
- 	u16		     rx_pending;
- 	u16		     rx_data_size;
- 	u16		     rx_nfrags;
--	u16		     rx_tag;
- 
- 	struct {
- 		unsigned long last;
-diff --git a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
-index 41e6b33..c07cfe9 100644
---- a/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
-+++ b/drivers/net/ethernet/stmicro/stmmac/mmc_core.c
-@@ -22,6 +22,7 @@
-   Author: Giuseppe Cavallaro <peppe.cavallaro@××.com>
- *******************************************************************************/
- 
-+#include <linux/kernel.h>
- #include <linux/io.h>
- #include "mmc.h"
- 
-diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
-index ceab215..c508d6a 100644
---- a/drivers/net/ethernet/sun/sungem.c
-+++ b/drivers/net/ethernet/sun/sungem.c
-@@ -2340,7 +2340,7 @@ static int gem_suspend(struct pci_dev *pdev, pm_message_t state)
- 	netif_device_detach(dev);
- 
- 	/* Switch off chip, remember WOL setting */
--	gp->asleep_wol = gp->wake_on_lan;
-+	gp->asleep_wol = !!gp->wake_on_lan;
- 	gem_do_stop(dev, gp->asleep_wol);
- 
- 	/* Unlock the network stack */
-diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
-index c81f136..b142300 100644
---- a/drivers/net/phy/icplus.c
-+++ b/drivers/net/phy/icplus.c
-@@ -150,7 +150,8 @@ static int ip101a_config_init(struct phy_device *phydev)
- 	/* Enable Auto Power Saving mode */
- 	c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
- 	c |= IP101A_APS_ON;
--	return c;
-+
-+	return phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
- }
- 
- static int ip175c_read_status(struct phy_device *phydev)
-diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
-index fda4be2..a9abee8 100644
---- a/drivers/net/usb/asix.c
-+++ b/drivers/net/usb/asix.c
-@@ -403,7 +403,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
- 	u32 packet_len;
- 	u32 padbytes = 0xffff0000;
- 
--	padlen = ((skb->len + 4) % 512) ? 0 : 4;
-+	padlen = ((skb->len + 4) & (dev->maxpacket - 1)) ? 0 : 4;
- 
- 	if ((!skb_cloned(skb)) &&
- 	    ((headroom + tailroom) >= (4 + padlen))) {
-@@ -425,7 +425,7 @@ static struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
- 	cpu_to_le32s(&packet_len);
- 	skb_copy_to_linear_data(skb, &packet_len, sizeof(packet_len));
- 
--	if ((skb->len % 512) == 0) {
-+	if (padlen) {
- 		cpu_to_le32s(&padbytes);
- 		memcpy(skb_tail_pointer(skb), &padbytes, sizeof(padbytes));
- 		skb_put(skb, sizeof(padbytes));
-diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
-index 4fd4144..2ba40cf 100644
---- a/drivers/net/usb/cdc_ether.c
-+++ b/drivers/net/usb/cdc_ether.c
-@@ -83,6 +83,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
- 	struct cdc_state		*info = (void *) &dev->data;
- 	int				status;
- 	int				rndis;
-+	bool				android_rndis_quirk = false;
- 	struct usb_driver		*driver = driver_of(intf);
- 	struct usb_cdc_mdlm_desc	*desc = NULL;
- 	struct usb_cdc_mdlm_detail_desc *detail = NULL;
-@@ -195,6 +196,11 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
- 					info->control,
- 					info->u->bSlaveInterface0,
- 					info->data);
-+				/* fall back to hard-wiring for RNDIS */
-+				if (rndis) {
-+					android_rndis_quirk = true;
-+					goto next_desc;
-+				}
- 				goto bad_desc;
- 			}
- 			if (info->control != intf) {
-@@ -271,11 +277,15 @@ next_desc:
- 	/* Microsoft ActiveSync based and some regular RNDIS devices lack the
- 	 * CDC descriptors, so we'll hard-wire the interfaces and not check
- 	 * for descriptors.
-+	 *
-+	 * Some Android RNDIS devices have a CDC Union descriptor pointing
-+	 * to non-existing interfaces.  Ignore that and attempt the same
-+	 * hard-wired 0 and 1 interfaces.
- 	 */
--	if (rndis && !info->u) {
-+	if (rndis && (!info->u || android_rndis_quirk)) {
- 		info->control = usb_ifnum_to_if(dev->udev, 0);
- 		info->data = usb_ifnum_to_if(dev->udev, 1);
--		if (!info->control || !info->data) {
-+		if (!info->control || !info->data || info->control != intf) {
- 			dev_dbg(&intf->dev,
- 				"rndis: master #0/%p slave #1/%p\n",
- 				info->control,
-@@ -472,6 +482,7 @@ static const struct driver_info wwan_info = {
- /*-------------------------------------------------------------------------*/
- 
- #define HUAWEI_VENDOR_ID	0x12D1
-+#define NOVATEL_VENDOR_ID	0x1410
- 
- static const struct usb_device_id	products [] = {
- /*
-@@ -589,6 +600,21 @@ static const struct usb_device_id	products [] = {
-  * because of bugs/quirks in a given product (like Zaurus, above).
-  */
- {
-+	/* Novatel USB551L */
-+	/* This match must come *before* the generic CDC-ETHER match so that
-+	 * we get FLAG_WWAN set on the device, since it's descriptors are
-+	 * generic CDC-ETHER.
-+	 */
-+	.match_flags    =   USB_DEVICE_ID_MATCH_VENDOR
-+		 | USB_DEVICE_ID_MATCH_PRODUCT
-+		 | USB_DEVICE_ID_MATCH_INT_INFO,
-+	.idVendor               = NOVATEL_VENDOR_ID,
-+	.idProduct		= 0xB001,
-+	.bInterfaceClass	= USB_CLASS_COMM,
-+	.bInterfaceSubClass	= USB_CDC_SUBCLASS_ETHERNET,
-+	.bInterfaceProtocol	= USB_CDC_PROTO_NONE,
-+	.driver_info = (unsigned long)&wwan_info,
-+}, {
- 	USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
- 			USB_CDC_PROTO_NONE),
- 	.driver_info = (unsigned long) &cdc_info,
-diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
-index 750e330..b873b5d 100644
---- a/drivers/net/usb/usbnet.c
-+++ b/drivers/net/usb/usbnet.c
-@@ -281,17 +281,32 @@ int usbnet_change_mtu (struct net_device *net, int new_mtu)
- }
- EXPORT_SYMBOL_GPL(usbnet_change_mtu);
- 
-+/* The caller must hold list->lock */
-+static void __usbnet_queue_skb(struct sk_buff_head *list,
-+			struct sk_buff *newsk, enum skb_state state)
-+{
-+	struct skb_data *entry = (struct skb_data *) newsk->cb;
-+
-+	__skb_queue_tail(list, newsk);
-+	entry->state = state;
-+}
-+
- /*-------------------------------------------------------------------------*/
- 
- /* some LK 2.4 HCDs oopsed if we freed or resubmitted urbs from
-  * completion callbacks.  2.5 should have fixed those bugs...
-  */
- 
--static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_head *list)
-+static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
-+		struct sk_buff_head *list, enum skb_state state)
- {
- 	unsigned long		flags;
-+	enum skb_state 		old_state;
-+	struct skb_data *entry = (struct skb_data *) skb->cb;
- 
- 	spin_lock_irqsave(&list->lock, flags);
-+	old_state = entry->state;
-+	entry->state = state;
- 	__skb_unlink(skb, list);
- 	spin_unlock(&list->lock);
- 	spin_lock(&dev->done.lock);
-@@ -299,6 +314,7 @@ static void defer_bh(struct usbnet *dev, struct sk_buff *skb, struct sk_buff_hea
- 	if (dev->done.qlen == 1)
- 		tasklet_schedule(&dev->bh);
- 	spin_unlock_irqrestore(&dev->done.lock, flags);
-+	return old_state;
- }
- 
- /* some work can't be done in tasklets, so we use keventd
-@@ -339,7 +355,6 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
- 	entry = (struct skb_data *) skb->cb;
- 	entry->urb = urb;
- 	entry->dev = dev;
--	entry->state = rx_start;
- 	entry->length = 0;
- 
- 	usb_fill_bulk_urb (urb, dev->udev, dev->in,
-@@ -371,7 +386,7 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
- 			tasklet_schedule (&dev->bh);
- 			break;
- 		case 0:
--			__skb_queue_tail (&dev->rxq, skb);
-+			__usbnet_queue_skb(&dev->rxq, skb, rx_start);
- 		}
- 	} else {
- 		netif_dbg(dev, ifdown, dev->net, "rx: stopped\n");
-@@ -422,16 +437,17 @@ static void rx_complete (struct urb *urb)
- 	struct skb_data		*entry = (struct skb_data *) skb->cb;
- 	struct usbnet		*dev = entry->dev;
- 	int			urb_status = urb->status;
-+	enum skb_state		state;
- 
- 	skb_put (skb, urb->actual_length);
--	entry->state = rx_done;
-+	state = rx_done;
- 	entry->urb = NULL;
- 
- 	switch (urb_status) {
- 	/* success */
- 	case 0:
- 		if (skb->len < dev->net->hard_header_len) {
--			entry->state = rx_cleanup;
-+			state = rx_cleanup;
- 			dev->net->stats.rx_errors++;
- 			dev->net->stats.rx_length_errors++;
- 			netif_dbg(dev, rx_err, dev->net,
-@@ -470,7 +486,7 @@ static void rx_complete (struct urb *urb)
- 				  "rx throttle %d\n", urb_status);
- 		}
- block:
--		entry->state = rx_cleanup;
-+		state = rx_cleanup;
- 		entry->urb = urb;
- 		urb = NULL;
- 		break;
-@@ -481,17 +497,18 @@ block:
- 		// FALLTHROUGH
- 
- 	default:
--		entry->state = rx_cleanup;
-+		state = rx_cleanup;
- 		dev->net->stats.rx_errors++;
- 		netif_dbg(dev, rx_err, dev->net, "rx status %d\n", urb_status);
- 		break;
- 	}
- 
--	defer_bh(dev, skb, &dev->rxq);
-+	state = defer_bh(dev, skb, &dev->rxq, state);
- 
- 	if (urb) {
- 		if (netif_running (dev->net) &&
--		    !test_bit (EVENT_RX_HALT, &dev->flags)) {
-+		    !test_bit (EVENT_RX_HALT, &dev->flags) &&
-+		    state != unlink_start) {
- 			rx_submit (dev, urb, GFP_ATOMIC);
- 			return;
- 		}
-@@ -577,16 +594,23 @@ EXPORT_SYMBOL_GPL(usbnet_purge_paused_rxq);
- static int unlink_urbs (struct usbnet *dev, struct sk_buff_head *q)
- {
- 	unsigned long		flags;
--	struct sk_buff		*skb, *skbnext;
-+	struct sk_buff		*skb;
- 	int			count = 0;
- 
- 	spin_lock_irqsave (&q->lock, flags);
--	skb_queue_walk_safe(q, skb, skbnext) {
-+	while (!skb_queue_empty(q)) {
- 		struct skb_data		*entry;
- 		struct urb		*urb;
- 		int			retval;
- 
--		entry = (struct skb_data *) skb->cb;
-+		skb_queue_walk(q, skb) {
-+			entry = (struct skb_data *) skb->cb;
-+			if (entry->state != unlink_start)
-+				goto found;
-+		}
-+		break;
-+found:
-+		entry->state = unlink_start;
- 		urb = entry->urb;
- 
- 		/*
-@@ -1037,8 +1061,7 @@ static void tx_complete (struct urb *urb)
- 	}
- 
- 	usb_autopm_put_interface_async(dev->intf);
--	entry->state = tx_done;
--	defer_bh(dev, skb, &dev->txq);
-+	(void) defer_bh(dev, skb, &dev->txq, tx_done);
- }
- 
- /*-------------------------------------------------------------------------*/
-@@ -1094,7 +1117,6 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
- 	entry = (struct skb_data *) skb->cb;
- 	entry->urb = urb;
- 	entry->dev = dev;
--	entry->state = tx_start;
- 	entry->length = length;
- 
- 	usb_fill_bulk_urb (urb, dev->udev, dev->out,
-@@ -1153,7 +1175,7 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
- 		break;
- 	case 0:
- 		net->trans_start = jiffies;
--		__skb_queue_tail (&dev->txq, skb);
-+		__usbnet_queue_skb(&dev->txq, skb, tx_start);
- 		if (dev->txq.qlen >= TX_QLEN (dev))
- 			netif_stop_queue (net);
- 	}
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
-index 7f27dbd..0515862 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
-@@ -1053,17 +1053,13 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
- 		}
- 		/* either retransmit or send bar if ack not recd */
- 		if (!ack_recd) {
--			struct ieee80211_tx_rate *txrate =
--			    tx_info->status.rates;
--			if (retry && (txrate[0].count < (int)retry_limit)) {
-+			if (retry && (ini->txretry[index] < (int)retry_limit)) {
- 				ini->txretry[index]++;
- 				ini->tx_in_transit--;
- 				/*
- 				 * Use high prededence for retransmit to
- 				 * give some punch
- 				 */
--				/* brcms_c_txq_enq(wlc, scb, p,
--				 * BRCMS_PRIO_TO_PREC(tid)); */
- 				brcms_c_txq_enq(wlc, scb, p,
- 						BRCMS_PRIO_TO_HI_PREC(tid));
- 			} else {
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-index f98becc..833cbef 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
-@@ -7879,7 +7879,7 @@ brcms_c_recvctl(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
- 	if (wlc->hw->suspended_fifos) {
- 		hdr = (struct ieee80211_hdr *)p->data;
- 		if (ieee80211_is_beacon(hdr->frame_control))
--			brcms_b_mute(wlc->hw, false);
-+			brcms_b_mute(wlc->hw, false, 0);
- 	}
- 
- 	memcpy(IEEE80211_SKB_RXCB(p), &rx_status, sizeof(rx_status));
-diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
-index 6176129..8cba82d 100644
---- a/drivers/regulator/max8997.c
-+++ b/drivers/regulator/max8997.c
-@@ -689,7 +689,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
- 		}
- 
- 		new_val++;
--	} while (desc->min + desc->step + new_val <= desc->max);
-+	} while (desc->min + desc->step * new_val <= desc->max);
- 
- 	new_idx = tmp_idx;
- 	new_val = tmp_val;
-diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
-index 54b9d2e..1590dbd 100644
---- a/drivers/spi/spi-topcliff-pch.c
-+++ b/drivers/spi/spi-topcliff-pch.c
-@@ -196,6 +196,7 @@ struct pch_spi_data {
- 	struct pch_spi_dma_ctrl dma;
- 	int use_dma;
- 	u8 irq_reg_sts;
-+	int save_total_len;
- };
- 
- /**
-@@ -823,11 +824,13 @@ static void pch_spi_copy_rx_data_for_dma(struct pch_spi_data *data, int bpw)
- 		rx_dma_buf = data->dma.rx_buf_virt;
- 		for (j = 0; j < data->bpw_len; j++)
- 			*rx_buf++ = *rx_dma_buf++ & 0xFF;
-+		data->cur_trans->rx_buf = rx_buf;
- 	} else {
- 		rx_sbuf = data->cur_trans->rx_buf;
- 		rx_dma_sbuf = data->dma.rx_buf_virt;
- 		for (j = 0; j < data->bpw_len; j++)
- 			*rx_sbuf++ = *rx_dma_sbuf++;
-+		data->cur_trans->rx_buf = rx_sbuf;
- 	}
- }
- 
-@@ -853,6 +856,9 @@ static int pch_spi_start_transfer(struct pch_spi_data *data)
- 	rtn = wait_event_interruptible_timeout(data->wait,
- 					       data->transfer_complete,
- 					       msecs_to_jiffies(2 * HZ));
-+	if (!rtn)
-+		dev_err(&data->master->dev,
-+			"%s wait-event timeout\n", __func__);
- 
- 	dma_sync_sg_for_cpu(&data->master->dev, dma->sg_rx_p, dma->nent,
- 			    DMA_FROM_DEVICE);
-@@ -924,7 +930,8 @@ static void pch_spi_request_dma(struct pch_spi_data *data, int bpw)
- 	dma_cap_set(DMA_SLAVE, mask);
- 
- 	/* Get DMA's dev information */
--	dma_dev = pci_get_bus_and_slot(2, PCI_DEVFN(12, 0));
-+	dma_dev = pci_get_bus_and_slot(data->board_dat->pdev->bus->number,
-+				       PCI_DEVFN(12, 0));
- 
- 	/* Set Tx DMA */
- 	param = &dma->param_tx;
-@@ -988,6 +995,7 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
- 	int i;
- 	int size;
- 	int rem;
-+	int head;
- 	unsigned long flags;
- 	struct pch_spi_dma_ctrl *dma;
- 
-@@ -1016,6 +1024,11 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
- 	}
- 	data->bpw_len = data->cur_trans->len / (*bpw / 8);
- 
-+	if (data->bpw_len > PCH_BUF_SIZE) {
-+		data->bpw_len = PCH_BUF_SIZE;
-+		data->cur_trans->len -= PCH_BUF_SIZE;
-+	}
-+
- 	/* copy Tx Data */
- 	if (data->cur_trans->tx_buf != NULL) {
- 		if (*bpw == 8) {
-@@ -1030,10 +1043,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
- 				*tx_dma_sbuf++ = *tx_sbuf++;
- 		}
- 	}
-+
-+	/* Calculate Rx parameter for DMA transmitting */
- 	if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
--		num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
-+		if (data->bpw_len % PCH_DMA_TRANS_SIZE) {
-+			num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
-+			rem = data->bpw_len % PCH_DMA_TRANS_SIZE;
-+		} else {
-+			num = data->bpw_len / PCH_DMA_TRANS_SIZE;
-+			rem = PCH_DMA_TRANS_SIZE;
-+		}
- 		size = PCH_DMA_TRANS_SIZE;
--		rem = data->bpw_len % PCH_DMA_TRANS_SIZE;
- 	} else {
- 		num = 1;
- 		size = data->bpw_len;
-@@ -1093,15 +1113,23 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
- 	dma->nent = num;
- 	dma->desc_rx = desc_rx;
- 
--	/* TX */
--	if (data->bpw_len > PCH_DMA_TRANS_SIZE) {
--		num = data->bpw_len / PCH_DMA_TRANS_SIZE;
-+	/* Calculate Tx parameter for DMA transmitting */
-+	if (data->bpw_len > PCH_MAX_FIFO_DEPTH) {
-+		head = PCH_MAX_FIFO_DEPTH - PCH_DMA_TRANS_SIZE;
-+		if (data->bpw_len % PCH_DMA_TRANS_SIZE > 4) {
-+			num = data->bpw_len / PCH_DMA_TRANS_SIZE + 1;
-+			rem = data->bpw_len % PCH_DMA_TRANS_SIZE - head;
-+		} else {
-+			num = data->bpw_len / PCH_DMA_TRANS_SIZE;
-+			rem = data->bpw_len % PCH_DMA_TRANS_SIZE +
-+			      PCH_DMA_TRANS_SIZE - head;
-+		}
- 		size = PCH_DMA_TRANS_SIZE;
--		rem = 16;
- 	} else {
- 		num = 1;
- 		size = data->bpw_len;
- 		rem = data->bpw_len;
-+		head = 0;
- 	}
- 
- 	dma->sg_tx_p = kzalloc(sizeof(struct scatterlist)*num, GFP_ATOMIC);
-@@ -1111,11 +1139,17 @@ static void pch_spi_handle_dma(struct pch_spi_data *data, int *bpw)
- 	for (i = 0; i < num; i++, sg++) {
- 		if (i == 0) {
- 			sg->offset = 0;
-+			sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size + head,
-+				    sg->offset);
-+			sg_dma_len(sg) = size + head;
-+		} else if (i == (num - 1)) {
-+			sg->offset = head + size * i;
-+			sg->offset = sg->offset * (*bpw / 8);
- 			sg_set_page(sg, virt_to_page(dma->tx_buf_virt), rem,
- 				    sg->offset);
- 			sg_dma_len(sg) = rem;
- 		} else {
--			sg->offset = rem + size * (i - 1);
-+			sg->offset = head + size * i;
- 			sg->offset = sg->offset * (*bpw / 8);
- 			sg_set_page(sg, virt_to_page(dma->tx_buf_virt), size,
- 				    sg->offset);
-@@ -1203,6 +1237,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
- 				    data->current_msg->spi->bits_per_word);
- 	pch_spi_writereg(data->master, PCH_SSNXCR, SSN_NO_CONTROL);
- 	do {
-+		int cnt;
- 		/* If we are already processing a message get the next
- 		transfer structure from the message otherwise retrieve
- 		the 1st transfer request from the message. */
-@@ -1222,11 +1257,28 @@ static void pch_spi_process_messages(struct work_struct *pwork)
- 		}
- 		spin_unlock(&data->lock);
- 
-+		if (!data->cur_trans->len)
-+			goto out;
-+		cnt = (data->cur_trans->len - 1) / PCH_BUF_SIZE + 1;
-+		data->save_total_len = data->cur_trans->len;
- 		if (data->use_dma) {
--			pch_spi_handle_dma(data, &bpw);
--			if (!pch_spi_start_transfer(data))
--				goto out;
--			pch_spi_copy_rx_data_for_dma(data, bpw);
-+			int i;
-+			char *save_rx_buf = data->cur_trans->rx_buf;
-+			for (i = 0; i < cnt; i ++) {
-+				pch_spi_handle_dma(data, &bpw);
-+				if (!pch_spi_start_transfer(data)) {
-+					data->transfer_complete = true;
-+					data->current_msg->status = -EIO;
-+					data->current_msg->complete
-+						   (data->current_msg->context);
-+					data->bcurrent_msg_processing = false;
-+					data->current_msg = NULL;
-+					data->cur_trans = NULL;
-+					goto out;
-+				}
-+				pch_spi_copy_rx_data_for_dma(data, bpw);
-+			}
-+			data->cur_trans->rx_buf = save_rx_buf;
- 		} else {
- 			pch_spi_set_tx(data, &bpw);
- 			pch_spi_set_ir(data);
-@@ -1237,6 +1289,7 @@ static void pch_spi_process_messages(struct work_struct *pwork)
- 			data->pkt_tx_buff = NULL;
- 		}
- 		/* increment message count */
-+		data->cur_trans->len = data->save_total_len;
- 		data->current_msg->actual_length += data->cur_trans->len;
- 
- 		dev_dbg(&data->master->dev,
-@@ -1389,6 +1442,7 @@ static int __devinit pch_spi_pd_probe(struct platform_device *plat_dev)
- 	master->num_chipselect = PCH_MAX_CS;
- 	master->setup = pch_spi_setup;
- 	master->transfer = pch_spi_transfer;
-+	master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_LSB_FIRST;
- 
- 	data->board_dat = board_dat;
- 	data->plat_dev = plat_dev;
-diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
-index b4864fb..cad8b92 100644
---- a/drivers/target/target_core_file.c
-+++ b/drivers/target/target_core_file.c
-@@ -170,6 +170,7 @@ static struct se_device *fd_create_virtdevice(
- 	inode = file->f_mapping->host;
- 	if (S_ISBLK(inode->i_mode)) {
- 		struct request_queue *q;
-+		unsigned long long dev_size;
- 		/*
- 		 * Setup the local scope queue_limits from struct request_queue->limits
- 		 * to pass into transport_add_device_to_core_hba() as struct se_dev_limits.
-@@ -184,13 +185,12 @@ static struct se_device *fd_create_virtdevice(
- 		 * one (1) logical sector from underlying struct block_device
- 		 */
- 		fd_dev->fd_block_size = bdev_logical_block_size(inode->i_bdev);
--		fd_dev->fd_dev_size = (i_size_read(file->f_mapping->host) -
-+		dev_size = (i_size_read(file->f_mapping->host) -
- 				       fd_dev->fd_block_size);
- 
- 		pr_debug("FILEIO: Using size: %llu bytes from struct"
- 			" block_device blocks: %llu logical_block_size: %d\n",
--			fd_dev->fd_dev_size,
--			div_u64(fd_dev->fd_dev_size, fd_dev->fd_block_size),
-+			dev_size, div_u64(dev_size, fd_dev->fd_block_size),
- 			fd_dev->fd_block_size);
- 	} else {
- 		if (!(fd_dev->fbd_flags & FBDF_HAS_SIZE)) {
-@@ -606,10 +606,20 @@ static u32 fd_get_device_type(struct se_device *dev)
- static sector_t fd_get_blocks(struct se_device *dev)
- {
- 	struct fd_dev *fd_dev = dev->dev_ptr;
--	unsigned long long blocks_long = div_u64(fd_dev->fd_dev_size,
--			dev->se_sub_dev->se_dev_attrib.block_size);
-+	struct file *f = fd_dev->fd_file;
-+	struct inode *i = f->f_mapping->host;
-+	unsigned long long dev_size;
-+	/*
-+	 * When using a file that references an underlying struct block_device,
-+	 * ensure dev_size is always based on the current inode size in order
-+	 * to handle underlying block_device resize operations.
-+	 */
-+	if (S_ISBLK(i->i_mode))
-+		dev_size = (i_size_read(i) - fd_dev->fd_block_size);
-+	else
-+		dev_size = fd_dev->fd_dev_size;
- 
--	return blocks_long;
-+	return div_u64(dev_size, dev->se_sub_dev->se_dev_attrib.block_size);
- }
- 
- static struct se_subsystem_api fileio_template = {
-diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
-index 6cf6ff4..b75bc92 100644
---- a/drivers/target/target_core_pr.c
-+++ b/drivers/target/target_core_pr.c
-@@ -223,6 +223,9 @@ int target_scsi2_reservation_release(struct se_task *task)
- 	if (dev->dev_reserved_node_acl != sess->se_node_acl)
- 		goto out_unlock;
- 
-+	if (dev->dev_res_bin_isid != sess->sess_bin_isid)
-+		goto out_unlock;
-+
- 	dev->dev_reserved_node_acl = NULL;
- 	dev->dev_flags &= ~DF_SPC2_RESERVATIONS;
- 	if (dev->dev_flags & DF_SPC2_RESERVATIONS_WITH_ISID) {
-diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c
-index 8ddd133..d91fe44 100644
---- a/drivers/target/target_core_tpg.c
-+++ b/drivers/target/target_core_tpg.c
-@@ -63,7 +63,6 @@ static void core_clear_initiator_node_from_tpg(
- 	int i;
- 	struct se_dev_entry *deve;
- 	struct se_lun *lun;
--	struct se_lun_acl *acl, *acl_tmp;
- 
- 	spin_lock_irq(&nacl->device_list_lock);
- 	for (i = 0; i < TRANSPORT_MAX_LUNS_PER_TPG; i++) {
-@@ -84,28 +83,7 @@ static void core_clear_initiator_node_from_tpg(
- 		core_update_device_list_for_node(lun, NULL, deve->mapped_lun,
- 			TRANSPORT_LUNFLAGS_NO_ACCESS, nacl, tpg, 0);
- 
--		spin_lock(&lun->lun_acl_lock);
--		list_for_each_entry_safe(acl, acl_tmp,
--					&lun->lun_acl_list, lacl_list) {
--			if (!strcmp(acl->initiatorname, nacl->initiatorname) &&
--			    (acl->mapped_lun == deve->mapped_lun))
--				break;
--		}
--
--		if (!acl) {
--			pr_err("Unable to locate struct se_lun_acl for %s,"
--				" mapped_lun: %u\n", nacl->initiatorname,
--				deve->mapped_lun);
--			spin_unlock(&lun->lun_acl_lock);
--			spin_lock_irq(&nacl->device_list_lock);
--			continue;
--		}
--
--		list_del(&acl->lacl_list);
--		spin_unlock(&lun->lun_acl_lock);
--
- 		spin_lock_irq(&nacl->device_list_lock);
--		kfree(acl);
- 	}
- 	spin_unlock_irq(&nacl->device_list_lock);
- }
-diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
-index 93a00d8..4410ae7 100644
---- a/fs/ext4/xattr.c
-+++ b/fs/ext4/xattr.c
-@@ -487,18 +487,19 @@ ext4_xattr_release_block(handle_t *handle, struct inode *inode,
- 		ext4_free_blocks(handle, inode, bh, 0, 1,
- 				 EXT4_FREE_BLOCKS_METADATA |
- 				 EXT4_FREE_BLOCKS_FORGET);
-+		unlock_buffer(bh);
- 	} else {
- 		le32_add_cpu(&BHDR(bh)->h_refcount, -1);
-+		if (ce)
-+			mb_cache_entry_release(ce);
-+		unlock_buffer(bh);
- 		error = ext4_handle_dirty_metadata(handle, inode, bh);
- 		if (IS_SYNC(inode))
- 			ext4_handle_sync(handle);
- 		dquot_free_block(inode, 1);
- 		ea_bdebug(bh, "refcount now=%d; releasing",
- 			  le32_to_cpu(BHDR(bh)->h_refcount));
--		if (ce)
--			mb_cache_entry_release(ce);
- 	}
--	unlock_buffer(bh);
- out:
- 	ext4_std_error(inode->i_sb, error);
- 	return;
-diff --git a/fs/jffs2/gc.c b/fs/jffs2/gc.c
-index 31dce61..4bbd521 100644
---- a/fs/jffs2/gc.c
-+++ b/fs/jffs2/gc.c
-@@ -225,8 +225,8 @@ int jffs2_garbage_collect_pass(struct jffs2_sb_info *c)
- 			return 0;
- 
- 		D1(printk(KERN_DEBUG "No progress from erasing blocks; doing GC anyway\n"));
--		spin_lock(&c->erase_completion_lock);
- 		mutex_lock(&c->alloc_sem);
-+		spin_lock(&c->erase_completion_lock);
- 	}
- 
- 	/* First, work out which block we're garbage-collecting */
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 51f6a40..bab7c58 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -1802,6 +1802,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, fmode_t fmode
- 			nfs_setattr_update_inode(state->inode, sattr);
- 		nfs_post_op_update_inode(state->inode, opendata->o_res.f_attr);
- 	}
-+	nfs_revalidate_inode(server, state->inode);
- 	nfs4_opendata_put(opendata);
- 	nfs4_put_state_owner(sp);
- 	*res = state;
-diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
-index a9e6ba4..daad4e6 100644
---- a/include/linux/mtd/map.h
-+++ b/include/linux/mtd/map.h
-@@ -26,7 +26,7 @@
- #include <linux/list.h>
- #include <linux/string.h>
- #include <linux/bug.h>
--
-+#include <linux/kernel.h>
- 
- #include <asm/unaligned.h>
- #include <asm/system.h>
-diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
-index 605b0aa..76f4396 100644
---- a/include/linux/usb/usbnet.h
-+++ b/include/linux/usb/usbnet.h
-@@ -191,7 +191,8 @@ extern void usbnet_cdc_status(struct usbnet *, struct urb *);
- enum skb_state {
- 	illegal = 0,
- 	tx_start, tx_done,
--	rx_start, rx_done, rx_cleanup
-+	rx_start, rx_done, rx_cleanup,
-+	unlink_start
- };
- 
- struct skb_data {	/* skb->cb is one of these */
-diff --git a/kernel/fork.c b/kernel/fork.c
-index 0acf42c0..26f1ab0 100644
---- a/kernel/fork.c
-+++ b/kernel/fork.c
-@@ -47,6 +47,7 @@
- #include <linux/audit.h>
- #include <linux/memcontrol.h>
- #include <linux/ftrace.h>
-+#include <linux/proc_fs.h>
- #include <linux/profile.h>
- #include <linux/rmap.h>
- #include <linux/ksm.h>
-@@ -1387,6 +1388,8 @@ bad_fork_cleanup_io:
- 	if (p->io_context)
- 		exit_io_context(p);
- bad_fork_cleanup_namespaces:
-+	if (unlikely(clone_flags & CLONE_NEWPID))
-+		pid_ns_release_proc(p->nsproxy->pid_ns);
- 	exit_task_namespaces(p);
- bad_fork_cleanup_mm:
- 	if (p->mm)
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index bd936ed..7120c2e 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2405,7 +2405,6 @@ retry_avoidcopy:
- 		if (outside_reserve) {
- 			BUG_ON(huge_pte_none(pte));
- 			if (unmap_ref_private(mm, vma, old_page, address)) {
--				BUG_ON(page_count(old_page) != 1);
- 				BUG_ON(huge_pte_none(pte));
- 				spin_lock(&mm->page_table_lock);
- 				goto retry_avoidcopy;
-diff --git a/mm/nobootmem.c b/mm/nobootmem.c
-index 7fa41b4..07c08c4 100644
---- a/mm/nobootmem.c
-+++ b/mm/nobootmem.c
-@@ -83,8 +83,7 @@ void __init free_bootmem_late(unsigned long addr, unsigned long size)
- 
- static void __init __free_pages_memory(unsigned long start, unsigned long end)
- {
--	int i;
--	unsigned long start_aligned, end_aligned;
-+	unsigned long i, start_aligned, end_aligned;
- 	int order = ilog2(BITS_PER_LONG);
- 
- 	start_aligned = (start + (BITS_PER_LONG - 1)) & ~(BITS_PER_LONG - 1);
-diff --git a/mm/percpu.c b/mm/percpu.c
-index 716eb4a..5c29750 100644
---- a/mm/percpu.c
-+++ b/mm/percpu.c
-@@ -1642,6 +1642,16 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
- 		areas[group] = ptr;
- 
- 		base = min(ptr, base);
-+	}
-+
-+	/*
-+	 * Copy data and free unused parts.  This should happen after all
-+	 * allocations are complete; otherwise, we may end up with
-+	 * overlapping groups.
-+	 */
-+	for (group = 0; group < ai->nr_groups; group++) {
-+		struct pcpu_group_info *gi = &ai->groups[group];
-+		void *ptr = areas[group];
- 
- 		for (i = 0; i < gi->nr_units; i++, ptr += ai->unit_size) {
- 			if (gi->cpu_map[i] == NR_CPUS) {
-diff --git a/net/core/dev.c b/net/core/dev.c
-index cd5050e..61a7baa 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1421,14 +1421,34 @@ EXPORT_SYMBOL(register_netdevice_notifier);
-  *	register_netdevice_notifier(). The notifier is unlinked into the
-  *	kernel structures and may then be reused. A negative errno code
-  *	is returned on a failure.
-+ *
-+ * 	After unregistering unregister and down device events are synthesized
-+ *	for all devices on the device list to the removed notifier to remove
-+ *	the need for special case cleanup code.
-  */
- 
- int unregister_netdevice_notifier(struct notifier_block *nb)
- {
-+	struct net_device *dev;
-+	struct net *net;
- 	int err;
- 
- 	rtnl_lock();
- 	err = raw_notifier_chain_unregister(&netdev_chain, nb);
-+	if (err)
-+		goto unlock;
-+
-+	for_each_net(net) {
-+		for_each_netdev(net, dev) {
-+			if (dev->flags & IFF_UP) {
-+				nb->notifier_call(nb, NETDEV_GOING_DOWN, dev);
-+				nb->notifier_call(nb, NETDEV_DOWN, dev);
-+			}
-+			nb->notifier_call(nb, NETDEV_UNREGISTER, dev);
-+			nb->notifier_call(nb, NETDEV_UNREGISTER_BATCH, dev);
-+		}
-+	}
-+unlock:
- 	rtnl_unlock();
- 	return err;
- }
-diff --git a/net/core/pktgen.c b/net/core/pktgen.c
-index 0001c24..df878de 100644
---- a/net/core/pktgen.c
-+++ b/net/core/pktgen.c
-@@ -1932,7 +1932,7 @@ static int pktgen_device_event(struct notifier_block *unused,
- {
- 	struct net_device *dev = ptr;
- 
--	if (!net_eq(dev_net(dev), &init_net))
-+	if (!net_eq(dev_net(dev), &init_net) || pktgen_exiting)
- 		return NOTIFY_DONE;
- 
- 	/* It is OK that we do not hold the group lock right now,
-@@ -3758,12 +3758,18 @@ static void __exit pg_cleanup(void)
- {
- 	struct pktgen_thread *t;
- 	struct list_head *q, *n;
-+	LIST_HEAD(list);
- 
- 	/* Stop all interfaces & threads */
- 	pktgen_exiting = true;
- 
--	list_for_each_safe(q, n, &pktgen_threads) {
-+	mutex_lock(&pktgen_thread_lock);
-+	list_splice_init(&pktgen_threads, &list);
-+	mutex_unlock(&pktgen_thread_lock);
-+
-+	list_for_each_safe(q, n, &list) {
- 		t = list_entry(q, struct pktgen_thread, th_list);
-+		list_del(&t->th_list);
- 		kthread_stop(t->tsk);
- 		kfree(t);
- 	}
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 7904db4..11ba922 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -851,8 +851,7 @@ new_segment:
- wait_for_sndbuf:
- 		set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
- wait_for_memory:
--		if (copied)
--			tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
-+		tcp_push(sk, flags & ~MSG_MORE, mss_now, TCP_NAGLE_PUSH);
- 
- 		if ((err = sk_stream_wait_memory(sk, &timeo)) != 0)
- 			goto do_error;
-@@ -3216,7 +3215,7 @@ void __init tcp_init(void)
- {
- 	struct sk_buff *skb = NULL;
- 	unsigned long limit;
--	int i, max_share, cnt;
-+	int i, max_rshare, max_wshare, cnt;
- 	unsigned long jiffy = jiffies;
- 
- 	BUILD_BUG_ON(sizeof(struct tcp_skb_cb) > sizeof(skb->cb));
-@@ -3280,15 +3279,16 @@ void __init tcp_init(void)
- 
- 	/* Set per-socket limits to no more than 1/128 the pressure threshold */
- 	limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
--	max_share = min(4UL*1024*1024, limit);
-+	max_wshare = min(4UL*1024*1024, limit);
-+	max_rshare = min(6UL*1024*1024, limit);
- 
- 	sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
- 	sysctl_tcp_wmem[1] = 16*1024;
--	sysctl_tcp_wmem[2] = max(64*1024, max_share);
-+	sysctl_tcp_wmem[2] = max(64*1024, max_wshare);
- 
- 	sysctl_tcp_rmem[0] = SK_MEM_QUANTUM;
- 	sysctl_tcp_rmem[1] = 87380;
--	sysctl_tcp_rmem[2] = max(87380, max_share);
-+	sysctl_tcp_rmem[2] = max(87380, max_rshare);
- 
- 	printk(KERN_INFO "TCP: Hash tables configured "
- 	       "(established %u bind %u)\n",
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index daedc07..9726927 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -83,7 +83,7 @@ int sysctl_tcp_ecn __read_mostly = 2;
- EXPORT_SYMBOL(sysctl_tcp_ecn);
- int sysctl_tcp_dsack __read_mostly = 1;
- int sysctl_tcp_app_win __read_mostly = 31;
--int sysctl_tcp_adv_win_scale __read_mostly = 2;
-+int sysctl_tcp_adv_win_scale __read_mostly = 1;
- EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
- 
- int sysctl_tcp_stdurg __read_mostly;
-@@ -2868,11 +2868,14 @@ static inline void tcp_complete_cwr(struct sock *sk)
- 
- 	/* Do not moderate cwnd if it's already undone in cwr or recovery. */
- 	if (tp->undo_marker) {
--		if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR)
-+		if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR) {
- 			tp->snd_cwnd = min(tp->snd_cwnd, tp->snd_ssthresh);
--		else /* PRR */
-+			tp->snd_cwnd_stamp = tcp_time_stamp;
-+		} else if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH) {
-+			/* PRR algorithm. */
- 			tp->snd_cwnd = tp->snd_ssthresh;
--		tp->snd_cwnd_stamp = tcp_time_stamp;
-+			tp->snd_cwnd_stamp = tcp_time_stamp;
-+		}
- 	}
- 	tcp_ca_event(sk, CA_EVENT_COMPLETE_CWR);
- }
-diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
-index 55670ec..2a2a3e7 100644
---- a/net/l2tp/l2tp_ip.c
-+++ b/net/l2tp/l2tp_ip.c
-@@ -441,8 +441,9 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
- 
- 		daddr = lip->l2tp_addr.s_addr;
- 	} else {
-+		rc = -EDESTADDRREQ;
- 		if (sk->sk_state != TCP_ESTABLISHED)
--			return -EDESTADDRREQ;
-+			goto out;
- 
- 		daddr = inet->inet_daddr;
- 		connected = 1;
-diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
-index 7801b15..a489d8b 100644
---- a/net/sched/sch_netem.c
-+++ b/net/sched/sch_netem.c
-@@ -351,10 +351,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
- 	if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
- 		if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
- 		    (skb->ip_summed == CHECKSUM_PARTIAL &&
--		     skb_checksum_help(skb))) {
--			sch->qstats.drops++;
--			return NET_XMIT_DROP;
--		}
-+		     skb_checksum_help(skb)))
-+			return qdisc_drop(skb, sch);
- 
- 		skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
- 	}
-diff --git a/sound/pci/echoaudio/echoaudio_dsp.c b/sound/pci/echoaudio/echoaudio_dsp.c
-index 64417a7..d8c670c 100644
---- a/sound/pci/echoaudio/echoaudio_dsp.c
-+++ b/sound/pci/echoaudio/echoaudio_dsp.c
-@@ -475,7 +475,7 @@ static int load_firmware(struct echoaudio *chip)
- 	const struct firmware *fw;
- 	int box_type, err;
- 
--	if (snd_BUG_ON(!chip->dsp_code_to_load || !chip->comm_page))
-+	if (snd_BUG_ON(!chip->comm_page))
- 		return -EPERM;
- 
- 	/* See if the ASIC is present and working - only if the DSP is already loaded */
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 192e6c0..53345bc 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -769,11 +769,13 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
- {
- 	struct azx *chip = bus->private_data;
- 	unsigned long timeout;
-+	unsigned long loopcounter;
- 	int do_poll = 0;
- 
-  again:
- 	timeout = jiffies + msecs_to_jiffies(1000);
--	for (;;) {
-+
-+	for (loopcounter = 0;; loopcounter++) {
- 		if (chip->polling_mode || do_poll) {
- 			spin_lock_irq(&chip->reg_lock);
- 			azx_update_rirb(chip);
-@@ -789,7 +791,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
- 		}
- 		if (time_after(jiffies, timeout))
- 			break;
--		if (bus->needs_damn_long_delay)
-+		if (bus->needs_damn_long_delay || loopcounter > 3000)
- 			msleep(2); /* temporary workaround */
- 		else {
- 			udelay(10);
-diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
-index ed67698..7b7a516 100644
---- a/sound/pci/hda/patch_sigmatel.c
-+++ b/sound/pci/hda/patch_sigmatel.c
-@@ -4484,9 +4484,9 @@ static int stac92xx_init(struct hda_codec *codec)
- 		def_conf = get_defcfg_connect(def_conf);
- 		/* skip any ports that don't have jacks since presence
-  		 * detection is useless */
--		if (def_conf != AC_JACK_PORT_COMPLEX) {
--			if (def_conf != AC_JACK_PORT_NONE)
--				stac_toggle_power_map(codec, nid, 1);
-+		if (def_conf != AC_JACK_PORT_NONE &&
-+		    !is_jack_detectable(codec, nid)) {
-+			stac_toggle_power_map(codec, nid, 1);
- 			continue;
- 		}
- 		if (enable_pin_detect(codec, nid, STAC_PWR_EVENT)) {
-diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
-index 7806301..3e7aa22 100644
---- a/sound/soc/codecs/wm8994.c
-+++ b/sound/soc/codecs/wm8994.c
-@@ -1027,7 +1027,7 @@ static int aif2clk_ev(struct snd_soc_dapm_widget *w,
- 		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
- 				    WM8994_AIF2DACL_ENA |
- 				    WM8994_AIF2DACR_ENA, 0);
--		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_5,
-+		snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_4,
- 				    WM8994_AIF2ADCL_ENA |
- 				    WM8994_AIF2ADCR_ENA, 0);
- 

diff --git a/3.2.18/0000_README b/3.2.19/0000_README
similarity index 97%
rename from 3.2.18/0000_README
rename to 3.2.19/0000_README
index 9daad3a..d244990 100644
--- a/3.2.18/0000_README
+++ b/3.2.19/0000_README
@@ -10,7 +10,7 @@ Patch:	1017_linux-3.2.18.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.18
 
-Patch:	4420_grsecurity-2.9-3.2.18-201206011935.patch
+Patch:	4420_grsecurity-2.9-3.2.19-201206042135.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch b/3.2.19/4420_grsecurity-2.9-3.2.19-201206042135.patch
similarity index 99%
rename from 3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch
rename to 3.2.19/4420_grsecurity-2.9-3.2.19-201206042135.patch
index e73e583..b4e3cb9 100644
--- a/3.2.18/4420_grsecurity-2.9-3.2.18-201206011935.patch
+++ b/3.2.19/4420_grsecurity-2.9-3.2.19-201206042135.patch
@@ -195,7 +195,7 @@ index 81c287f..d456d02 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index add68f1..3fac8b3 100644
+index c291184..347a3de 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -312,7 +312,7 @@ index add68f1..3fac8b3 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1086,6 +1139,8 @@ all: modules
+@@ -1089,6 +1142,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -321,7 +321,7 @@ index add68f1..3fac8b3 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1101,7 +1156,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1104,7 +1159,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -330,7 +330,7 @@ index add68f1..3fac8b3 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1198,6 +1253,7 @@ distclean: mrproper
+@@ -1201,6 +1256,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -338,7 +338,7 @@ index add68f1..3fac8b3 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1358,6 +1414,8 @@ PHONY += $(module-dirs) modules
+@@ -1361,6 +1417,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -347,7 +347,7 @@ index add68f1..3fac8b3 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1484,17 +1542,21 @@ else
+@@ -1487,17 +1545,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -373,7 +373,7 @@ index add68f1..3fac8b3 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1504,11 +1566,15 @@ endif
+@@ -1507,11 +1569,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -1325,7 +1325,7 @@ index 75fe66b..2255c86 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index d5d8d5c..ad92c96 100644
+index 1252a26..9dc17b5 100644
 --- a/arch/arm/include/asm/cacheflush.h
 +++ b/arch/arm/include/asm/cacheflush.h
 @@ -108,7 +108,7 @@ struct cpu_cache_fns {
@@ -1675,7 +1675,7 @@ index 8fc2c8f..064c150 100644
  #endif
  
 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index 99a5727..a3d5bb1 100644
+index 160cb16..c3261f6 100644
 --- a/arch/arm/kernel/traps.c
 +++ b/arch/arm/kernel/traps.c
 @@ -259,6 +259,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
@@ -5053,7 +5053,7 @@ index afeb710..d1d1289 100644
  bottomup:
  	/*
 diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index f92602e..27060b2 100644
+index f210d51..87537e2 100644
 --- a/arch/sparc/Kconfig
 +++ b/arch/sparc/Kconfig
 @@ -31,6 +31,7 @@ config SPARC
@@ -7752,7 +7752,7 @@ index bf56e17..05f9891 100644
  	  This option helps catch unintended modifications to loadable
  	  kernel module's text and read-only data. It also prevents execution
 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index b02e509..2631e48 100644
+index 03dbc7f5b..4d12eea 100644
 --- a/arch/x86/Makefile
 +++ b/arch/x86/Makefile
 @@ -46,6 +46,7 @@ else
@@ -7763,7 +7763,7 @@ index b02e509..2631e48 100644
          KBUILD_AFLAGS += -m64
          KBUILD_CFLAGS += -m64
  
-@@ -195,3 +196,12 @@ define archhelp
+@@ -199,3 +200,12 @@ define archhelp
    echo  '                  FDARGS="..."  arguments for the booted kernel'
    echo  '                  FDINITRD=file initrd for the booted kernel'
  endef
@@ -7835,7 +7835,7 @@ index c7093bd..d4247ffe0 100644
  	return diff;
  }
 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index 09664ef..edc5d03 100644
+index 77453c6..2c6cd1b 100644
 --- a/arch/x86/boot/compressed/Makefile
 +++ b/arch/x86/boot/compressed/Makefile
 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
@@ -7924,201 +7924,6 @@ index 3a19d04..7c1d55a 100644
  		error("Wrong destination address");
  #endif
  
-diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
-index e77f4e4..17e511f 100644
---- a/arch/x86/boot/compressed/relocs.c
-+++ b/arch/x86/boot/compressed/relocs.c
-@@ -13,8 +13,11 @@
- 
- static void die(char *fmt, ...);
- 
-+#include "../../../../include/generated/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
- 
-@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
- 	}
- }
- 
-+static void read_phdrs(FILE *fp)
-+{
-+	unsigned int i;
-+
-+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+	if (!phdr) {
-+		die("Unable to allocate %d program headers\n",
-+		    ehdr.e_phnum);
-+	}
-+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+		die("Seek to %d failed: %s\n",
-+			ehdr.e_phoff, strerror(errno));
-+	}
-+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+		die("Cannot read ELF program headers: %s\n",
-+			strerror(errno));
-+	}
-+	for(i = 0; i < ehdr.e_phnum; i++) {
-+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
-+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
-+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
-+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
-+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
-+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
-+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
-+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
-+	}
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	Elf32_Shdr shdr;
- 
- 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
- 
- static void read_strtabs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
- 
- static void read_symtabs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
- 
- static void read_relocs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
-+	uint32_t base;
-+
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
- 			die("Cannot read symbol table: %s\n",
- 				strerror(errno));
- 		}
-+		base = 0;
-+		for (j = 0; j < ehdr.e_phnum; j++) {
-+			if (phdr[j].p_type != PT_LOAD )
-+				continue;
-+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+				continue;
-+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+			break;
-+		}
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- 			Elf32_Rel *rel = &sec->reltab[j];
--			rel->r_offset = elf32_to_cpu(rel->r_offset);
-+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- 			rel->r_info   = elf32_to_cpu(rel->r_info);
- 		}
- 	}
-@@ -396,13 +440,13 @@ static void read_relocs(FILE *fp)
- 
- static void print_absolute_symbols(void)
- {
--	int i;
-+	unsigned int i;
- 	printf("Absolute symbols\n");
- 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
--		int j;
-+		unsigned int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
-@@ -429,14 +473,14 @@ static void print_absolute_symbols(void)
- 
- static void print_absolute_relocs(void)
- {
--	int i, printed = 0;
-+	unsigned int i, printed = 0;
- 
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		struct section *sec_applies, *sec_symtab;
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 		if (sec->shdr.sh_type != SHT_REL) {
- 			continue;
- 		}
-@@ -497,13 +541,13 @@ static void print_absolute_relocs(void)
- 
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
--	int i;
-+	unsigned int i;
- 	/* Walk through the relocations */
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
- 		struct section *sec_applies, *sec_symtab;
--		int j;
-+		unsigned int j;
- 		struct section *sec = &secs[i];
- 
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -528,6 +572,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- 			    !is_rel_reloc(sym_name(sym_strtab, sym))) {
- 				continue;
- 			}
-+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+				continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+				continue;
-+#endif
-+
- 			switch (r_type) {
- 			case R_386_NONE:
- 			case R_386_PC32:
-@@ -569,7 +629,7 @@ static int cmp_relocs(const void *va, const void *vb)
- 
- static void emit_relocs(int as_text)
- {
--	int i;
-+	unsigned int i;
- 	/* Count how many relocations I have and allocate space for them. */
- 	reloc_count = 0;
- 	walk_relocs(count_reloc);
-@@ -663,6 +723,7 @@ int main(int argc, char **argv)
- 			fname, strerror(errno));
- 	}
- 	read_ehdr(fp);
-+	read_phdrs(fp);
- 	read_shdrs(fp);
- 	read_strtabs(fp);
- 	read_symtabs(fp);
 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
 index 4d3ff03..e4972ff 100644
 --- a/arch/x86/boot/cpucheck.c
@@ -14351,7 +14156,7 @@ index 5231312..a78a987 100644
  }
  #endif
 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 2af127d..8ff7ac0 100644
+index b0f1271..1158227 100644
 --- a/arch/x86/kernel/cpu/mcheck/mce.c
 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
 @@ -42,6 +42,7 @@
@@ -14402,7 +14207,7 @@ index 2af127d..8ff7ac0 100644
  			return;
  	}
  	/* First print corrected ones that are still unlogged */
-@@ -610,7 +611,7 @@ static int mce_timed_out(u64 *t)
+@@ -618,7 +619,7 @@ static int mce_timed_out(u64 *t)
  	 * might have been modified by someone else.
  	 */
  	rmb();
@@ -14411,7 +14216,7 @@ index 2af127d..8ff7ac0 100644
  		wait_for_panic();
  	if (!monarch_timeout)
  		goto out;
-@@ -1398,7 +1399,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
+@@ -1406,7 +1407,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
  }
  
  /* Call the installed machine check handler for this CPU setup. */
@@ -14420,7 +14225,7 @@ index 2af127d..8ff7ac0 100644
  						unexpected_machine_check;
  
  /*
-@@ -1421,7 +1422,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1429,7 +1430,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
  		return;
  	}
  
@@ -14430,7 +14235,7 @@ index 2af127d..8ff7ac0 100644
  
  	__mcheck_cpu_init_generic();
  	__mcheck_cpu_init_vendor(c);
-@@ -1435,7 +1438,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1443,7 +1446,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
   */
  
  static DEFINE_SPINLOCK(mce_chrdev_state_lock);
@@ -14439,7 +14244,7 @@ index 2af127d..8ff7ac0 100644
  static int mce_chrdev_open_exclu;	/* already open exclusive? */
  
  static int mce_chrdev_open(struct inode *inode, struct file *file)
-@@ -1443,7 +1446,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1451,7 +1454,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  	spin_lock(&mce_chrdev_state_lock);
  
  	if (mce_chrdev_open_exclu ||
@@ -14448,7 +14253,7 @@ index 2af127d..8ff7ac0 100644
  		spin_unlock(&mce_chrdev_state_lock);
  
  		return -EBUSY;
-@@ -1451,7 +1454,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1459,7 +1462,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  
  	if (file->f_flags & O_EXCL)
  		mce_chrdev_open_exclu = 1;
@@ -14457,7 +14262,7 @@ index 2af127d..8ff7ac0 100644
  
  	spin_unlock(&mce_chrdev_state_lock);
  
-@@ -1462,7 +1465,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
+@@ -1470,7 +1473,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
  {
  	spin_lock(&mce_chrdev_state_lock);
  
@@ -14466,7 +14271,7 @@ index 2af127d..8ff7ac0 100644
  	mce_chrdev_open_exclu = 0;
  
  	spin_unlock(&mce_chrdev_state_lock);
-@@ -2171,7 +2174,7 @@ struct dentry *mce_get_debugfs_dir(void)
+@@ -2179,7 +2182,7 @@ struct dentry *mce_get_debugfs_dir(void)
  static void mce_reset(void)
  {
  	cpu_missing = 0;
@@ -20589,7 +20394,7 @@ index 94a4672..5c6b853 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 4ea7678..b3a7084 100644
+index 7315488..187fb78 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
 @@ -1305,7 +1305,11 @@ static void reload_tss(void)
@@ -20627,7 +20432,7 @@ index 4ea7678..b3a7084 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6169,6 +6176,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6171,6 +6178,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp .Lkvm_vmx_return \n\t"
  		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		".Lkvm_vmx_return: "
@@ -20640,7 +20445,7 @@ index 4ea7678..b3a7084 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%"R"sp) \n\t"
  		"pop %0 \n\t"
-@@ -6217,6 +6230,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6219,6 +6232,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -20652,7 +20457,7 @@ index 4ea7678..b3a7084 100644
  	      : "cc", "memory"
  		, R"ax", R"bx", R"di", R"si"
  #ifdef CONFIG_X86_64
-@@ -6245,7 +6263,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6247,7 +6265,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		}
  	}
  
@@ -20671,7 +20476,7 @@ index 4ea7678..b3a7084 100644
  
  	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index e04cae1..b37d0dd 100644
+index 4fc5323..59b259b 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
 @@ -1345,8 +1345,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
@@ -20750,7 +20555,7 @@ index e04cae1..b37d0dd 100644
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -5185,7 +5196,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5188,7 +5199,7 @@ static void kvm_set_mmio_spte_mask(void)
  	kvm_mmu_set_mmio_spte_mask(mask);
  }
  
@@ -24733,7 +24538,7 @@ index f581a18..a269cab 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 87488b9..f6222dc 100644
+index 87488b9..a06f559 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -15,6 +15,8 @@
@@ -24793,7 +24598,7 @@ index 87488b9..f6222dc 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -370,8 +399,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -370,8 +399,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -24828,14 +24633,13 @@ index 87488b9..f6222dc 100644
 +	unsigned long addr, limit;
 +	struct desc_struct d;
 +	int cpu;
-+#endif
-+#endif
-+#ifndef CONFIG_X86_PAE
++#else
 +	pgd_t *pgd;
 +	pud_t *pud;
 +	pmd_t *pmd;
 +	unsigned long addr, end;
 +#endif
++#endif
 +
 +	gr_init_ebda();
 +
@@ -26905,6 +26709,206 @@ index f10c0af..3ec1f95 100644
  
  	syscall_init();				/* This sets MSR_*STAR and related */
  #endif
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index e529730..dccc321 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -13,8 +13,16 @@
+ 
+ static void die(char *fmt, ...);
+ 
++#include "../../../include/generated/autoconf.h"
++#ifdef CONFIG_X86_32
++#define __PAGE_OFFSET CONFIG_PAGE_OFFSET
++#else
++#define __PAGE_OFFSET 0
++#endif
++
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr *phdr;
+ static unsigned long reloc_count, reloc_idx;
+ static unsigned long *relocs;
+ static unsigned long reloc16_count, reloc16_idx;
+@@ -322,9 +330,39 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	unsigned int i;
++
++	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
++	if (!phdr) {
++		die("Unable to allocate %d program headers\n",
++		    ehdr.e_phnum);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	Elf32_Shdr shdr;
+ 
+ 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+@@ -359,7 +397,7 @@ static void read_shdrs(FILE *fp)
+ 
+ static void read_strtabs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_STRTAB) {
+@@ -384,7 +422,7 @@ static void read_strtabs(FILE *fp)
+ 
+ static void read_symtabs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+@@ -417,7 +455,9 @@ static void read_symtabs(FILE *fp)
+ 
+ static void read_relocs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
++	uint32_t base;
++
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -437,9 +477,18 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = __PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+ 			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
+ 			rel->r_info   = elf32_to_cpu(rel->r_info);
+ 		}
+ 	}
+@@ -448,13 +497,13 @@ static void read_relocs(FILE *fp)
+ 
+ static void print_absolute_symbols(void)
+ {
+-	int i;
++	unsigned int i;
+ 	printf("Absolute symbols\n");
+ 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+-		int j;
++		unsigned int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+@@ -481,14 +530,14 @@ static void print_absolute_symbols(void)
+ 
+ static void print_absolute_relocs(void)
+ {
+-	int i, printed = 0;
++	unsigned int i, printed = 0;
+ 
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		struct section *sec_applies, *sec_symtab;
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 		if (sec->shdr.sh_type != SHT_REL) {
+ 			continue;
+ 		}
+@@ -550,13 +599,13 @@ static void print_absolute_relocs(void)
+ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
+ 			int use_real_mode)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Walk through the relocations */
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+ 		struct section *sec_applies, *sec_symtab;
+-		int j;
++		unsigned int j;
+ 		struct section *sec = &secs[i];
+ 
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -582,6 +631,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
+ 
+ 			shn_abs = sym->st_shndx == SHN_ABS;
+ 
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
++				continue;
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
++				continue;
++#endif
++
+ 			switch (r_type) {
+ 			case R_386_NONE:
+ 			case R_386_PC32:
+@@ -676,7 +741,7 @@ static int write32(unsigned int v, FILE *f)
+ 
+ static void emit_relocs(int as_text, int use_real_mode)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Count how many relocations I have and allocate space for them. */
+ 	reloc_count = 0;
+ 	walk_relocs(count_reloc, use_real_mode);
+@@ -803,6 +868,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
 index 5d17950..2253fc9 100644
 --- a/arch/x86/vdso/Makefile
@@ -27078,7 +27082,7 @@ index 153407c..611cba9 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index e7c920b..c9bdcf7 100644
+index e7c920b..4413fbf 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -27090,7 +27094,18 @@ index e7c920b..c9bdcf7 100644
  RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
  __read_mostly int xen_have_vector_callback;
  EXPORT_SYMBOL_GPL(xen_have_vector_callback);
-@@ -1030,7 +1028,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
+@@ -982,7 +980,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
+ 	.wbinvd = native_wbinvd,
+ 
+ 	.read_msr = native_read_msr_safe,
++	.rdmsr_regs = native_rdmsr_safe_regs,
+ 	.write_msr = xen_write_msr_safe,
++	.wrmsr_regs = native_wrmsr_safe_regs,
++
+ 	.read_tsc = native_read_tsc,
+ 	.read_pmc = native_read_pmc,
+ 
+@@ -1030,7 +1031,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
  #endif
  };
  
@@ -27099,7 +27114,7 @@ index e7c920b..c9bdcf7 100644
  {
  	struct sched_shutdown r = { .reason = reason };
  
-@@ -1038,17 +1036,17 @@ static void xen_reboot(int reason)
+@@ -1038,17 +1039,17 @@ static void xen_reboot(int reason)
  		BUG();
  }
  
@@ -27120,7 +27135,7 @@ index e7c920b..c9bdcf7 100644
  {
  	xen_reboot(SHUTDOWN_poweroff);
  }
-@@ -1154,7 +1152,17 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1154,7 +1155,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -27139,7 +27154,7 @@ index e7c920b..c9bdcf7 100644
  
  	xen_setup_features();
  
-@@ -1185,13 +1193,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1185,13 +1196,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -30773,10 +30788,10 @@ index a6c2f7a..0eea25d 100644
  	for (i = 0; i < count; i++) {
  		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index d47a53b..61154c2 100644
+index d3820c2..23c575f 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+@@ -472,7 +472,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
  	u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
  	struct drm_i915_master_private *master_priv;
  
@@ -30785,7 +30800,7 @@ index d47a53b..61154c2 100644
  
  	/* disable master interrupt before clearing iir  */
  	de_ier = I915_READ(DEIER);
-@@ -566,7 +566,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+@@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
  	struct drm_i915_master_private *master_priv;
  	u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
  
@@ -30794,7 +30809,7 @@ index d47a53b..61154c2 100644
  
  	if (IS_GEN6(dev))
  		bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
-@@ -1231,7 +1231,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -1228,7 +1228,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
  	int ret = IRQ_NONE, pipe;
  	bool blc_event = false;
  
@@ -30803,7 +30818,7 @@ index d47a53b..61154c2 100644
  
  	iir = I915_READ(IIR);
  
-@@ -1750,7 +1750,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
+@@ -1747,7 +1747,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
  {
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  
@@ -30812,7 +30827,7 @@ index d47a53b..61154c2 100644
  
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-@@ -1938,7 +1938,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
+@@ -1935,7 +1935,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -30822,7 +30837,7 @@ index d47a53b..61154c2 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 390768f..172aa06 100644
+index 3ff980d..6efde22 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2230,7 +2230,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
@@ -33765,7 +33780,7 @@ index 4720f68..78d1df7 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index adcd850..e29654d 100644
+index 700ecae..2e5a31a 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -278,10 +278,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
@@ -34189,7 +34204,7 @@ index 0564192..75b16f5 100644
  	NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
  	NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
-index 16a089f..ab1667d 100644
+index 16a089f..1661b11 100644
 --- a/drivers/media/radio/radio-cadet.c
 +++ b/drivers/media/radio/radio-cadet.c
 @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
@@ -34201,6 +34216,15 @@ index 16a089f..ab1667d 100644
  	mutex_lock(&dev->lock);
  	if (dev->rdsstat == 0) {
  		dev->rdsstat = 1;
+@@ -347,7 +349,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
+ 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+ 	mutex_unlock(&dev->lock);
+ 
+-	if (copy_to_user(data, readbuf, i))
++	if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i))
+ 		return -EFAULT;
+ 	return i;
+ }
 diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
 index 61287fc..8b08712 100644
 --- a/drivers/media/rc/redrat3.c
@@ -35063,93 +35087,6 @@ index 4d01219..b58d26d 100644
  	{ 				/* Sometime a Level-One switch card. */
  	  "Winbond W89c840",	CanHaveMII | HasBrokenTx | FDXOnNoMII},
  	{ "Winbond W89c840",	CanHaveMII | HasBrokenTx},
-diff --git a/drivers/net/ethernet/dlink/dl2k.c b/drivers/net/ethernet/dlink/dl2k.c
-index b2dc2c8..2e09edb 100644
---- a/drivers/net/ethernet/dlink/dl2k.c
-+++ b/drivers/net/ethernet/dlink/dl2k.c
-@@ -1259,55 +1259,21 @@ rio_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
- {
- 	int phy_addr;
- 	struct netdev_private *np = netdev_priv(dev);
--	struct mii_data *miidata = (struct mii_data *) &rq->ifr_ifru;
--
--	struct netdev_desc *desc;
--	int i;
-+	struct mii_ioctl_data *miidata = if_mii(rq);
- 
- 	phy_addr = np->phy_addr;
- 	switch (cmd) {
--	case SIOCDEVPRIVATE:
-+	case SIOCGMIIPHY:
-+		miidata->phy_id = phy_addr;
- 		break;
--
--	case SIOCDEVPRIVATE + 1:
--		miidata->out_value = mii_read (dev, phy_addr, miidata->reg_num);
-+	case SIOCGMIIREG:
-+		miidata->val_out = mii_read (dev, phy_addr, miidata->reg_num);
- 		break;
--	case SIOCDEVPRIVATE + 2:
--		mii_write (dev, phy_addr, miidata->reg_num, miidata->in_value);
-+	case SIOCSMIIREG:
-+		if (!capable(CAP_NET_ADMIN))
-+			return -EPERM;
-+		mii_write (dev, phy_addr, miidata->reg_num, miidata->val_in);
- 		break;
--	case SIOCDEVPRIVATE + 3:
--		break;
--	case SIOCDEVPRIVATE + 4:
--		break;
--	case SIOCDEVPRIVATE + 5:
--		netif_stop_queue (dev);
--		break;
--	case SIOCDEVPRIVATE + 6:
--		netif_wake_queue (dev);
--		break;
--	case SIOCDEVPRIVATE + 7:
--		printk
--		    ("tx_full=%x cur_tx=%lx old_tx=%lx cur_rx=%lx old_rx=%lx\n",
--		     netif_queue_stopped(dev), np->cur_tx, np->old_tx, np->cur_rx,
--		     np->old_rx);
--		break;
--	case SIOCDEVPRIVATE + 8:
--		printk("TX ring:\n");
--		for (i = 0; i < TX_RING_SIZE; i++) {
--			desc = &np->tx_ring[i];
--			printk
--			    ("%02x:cur:%08x next:%08x status:%08x frag1:%08x frag0:%08x",
--			     i,
--			     (u32) (np->tx_ring_dma + i * sizeof (*desc)),
--			     (u32)le64_to_cpu(desc->next_desc),
--			     (u32)le64_to_cpu(desc->status),
--			     (u32)(le64_to_cpu(desc->fraginfo) >> 32),
--			     (u32)le64_to_cpu(desc->fraginfo));
--			printk ("\n");
--		}
--		printk ("\n");
--		break;
--
- 	default:
- 		return -EOPNOTSUPP;
- 	}
-diff --git a/drivers/net/ethernet/dlink/dl2k.h b/drivers/net/ethernet/dlink/dl2k.h
-index ba0adca..30c2da3 100644
---- a/drivers/net/ethernet/dlink/dl2k.h
-+++ b/drivers/net/ethernet/dlink/dl2k.h
-@@ -365,13 +365,6 @@ struct ioctl_data {
- 	char *data;
- };
- 
--struct mii_data {
--	__u16 reserved;
--	__u16 reg_num;
--	__u16 in_value;
--	__u16 out_value;
--};
--
- /* The Rx and Tx buffer descriptors. */
- struct netdev_desc {
- 	__le64 next_desc;
 diff --git a/drivers/net/ethernet/dlink/sundance.c b/drivers/net/ethernet/dlink/sundance.c
 index dcd7f7a..ecb7fb3 100644
 --- a/drivers/net/ethernet/dlink/sundance.c
@@ -36891,7 +36828,7 @@ index 351dc0b..951dc32 100644
  
  	/* These three are default values which can be overridden */
 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index 865d452..e9b7fa7 100644
+index b4d2c86..094a532 100644
 --- a/drivers/scsi/hpsa.c
 +++ b/drivers/scsi/hpsa.c
 @@ -505,7 +505,7 @@ static inline u32 next_command(struct ctlr_info *h)
@@ -36903,7 +36840,7 @@ index 865d452..e9b7fa7 100644
  
  	if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
  		a = *(h->reply_pool_head); /* Next cmd in ring buffer */
-@@ -2989,7 +2989,7 @@ static void start_io(struct ctlr_info *h)
+@@ -2985,7 +2985,7 @@ static void start_io(struct ctlr_info *h)
  	while (!list_empty(&h->reqQ)) {
  		c = list_entry(h->reqQ.next, struct CommandList, list);
  		/* can't do anything if fifo is full */
@@ -36912,7 +36849,7 @@ index 865d452..e9b7fa7 100644
  			dev_warn(&h->pdev->dev, "fifo full\n");
  			break;
  		}
-@@ -2999,7 +2999,7 @@ static void start_io(struct ctlr_info *h)
+@@ -2995,7 +2995,7 @@ static void start_io(struct ctlr_info *h)
  		h->Qdepth--;
  
  		/* Tell the controller execute command */
@@ -36921,7 +36858,7 @@ index 865d452..e9b7fa7 100644
  
  		/* Put job onto the completed Q */
  		addQ(&h->cmpQ, c);
-@@ -3008,17 +3008,17 @@ static void start_io(struct ctlr_info *h)
+@@ -3004,17 +3004,17 @@ static void start_io(struct ctlr_info *h)
  
  static inline unsigned long get_next_completion(struct ctlr_info *h)
  {
@@ -36942,7 +36879,7 @@ index 865d452..e9b7fa7 100644
  		(h->interrupts_enabled == 0);
  }
  
-@@ -3917,7 +3917,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
+@@ -3913,7 +3913,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
  	if (prod_index < 0)
  		return -ENODEV;
  	h->product_name = products[prod_index].product_name;
@@ -36951,7 +36888,7 @@ index 865d452..e9b7fa7 100644
  
  	if (hpsa_board_disabled(h->pdev)) {
  		dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
-@@ -4162,7 +4162,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
+@@ -4158,7 +4158,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
  
  	assert_spin_locked(&lockup_detector_lock);
  	remove_ctlr_from_lockup_detector_list(h);
@@ -36960,7 +36897,7 @@ index 865d452..e9b7fa7 100644
  	spin_lock_irqsave(&h->lock, flags);
  	h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
  	spin_unlock_irqrestore(&h->lock, flags);
-@@ -4340,7 +4340,7 @@ reinit_after_soft_reset:
+@@ -4336,7 +4336,7 @@ reinit_after_soft_reset:
  	}
  
  	/* make sure the board interrupts are off */
@@ -36969,7 +36906,7 @@ index 865d452..e9b7fa7 100644
  
  	if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
  		goto clean2;
-@@ -4374,7 +4374,7 @@ reinit_after_soft_reset:
+@@ -4370,7 +4370,7 @@ reinit_after_soft_reset:
  		 * fake ones to scoop up any residual completions.
  		 */
  		spin_lock_irqsave(&h->lock, flags);
@@ -36978,7 +36915,7 @@ index 865d452..e9b7fa7 100644
  		spin_unlock_irqrestore(&h->lock, flags);
  		free_irq(h->intr[h->intr_mode], h);
  		rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
-@@ -4393,9 +4393,9 @@ reinit_after_soft_reset:
+@@ -4389,9 +4389,9 @@ reinit_after_soft_reset:
  		dev_info(&h->pdev->dev, "Board READY.\n");
  		dev_info(&h->pdev->dev,
  			"Waiting for stale completions to drain.\n");
@@ -36990,7 +36927,7 @@ index 865d452..e9b7fa7 100644
  
  		rc = controller_reset_failed(h->cfgtable);
  		if (rc)
-@@ -4416,7 +4416,7 @@ reinit_after_soft_reset:
+@@ -4412,7 +4412,7 @@ reinit_after_soft_reset:
  	}
  
  	/* Turn the interrupts on so we can service requests */
@@ -36999,7 +36936,7 @@ index 865d452..e9b7fa7 100644
  
  	hpsa_hba_inquiry(h);
  	hpsa_register_scsi(h);	/* hook ourselves into SCSI subsystem */
-@@ -4468,7 +4468,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
+@@ -4464,7 +4464,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
  	 * To write all data in the battery backed cache to disks
  	 */
  	hpsa_flush_cache(h);
@@ -37008,7 +36945,7 @@ index 865d452..e9b7fa7 100644
  	free_irq(h->intr[h->intr_mode], h);
  #ifdef CONFIG_PCI_MSI
  	if (h->msix_vector)
-@@ -4632,7 +4632,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
+@@ -4628,7 +4628,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
  		return;
  	}
  	/* Change the access methods to the performant access methods */
@@ -42317,7 +42254,7 @@ index 79e2ca7..5828ad1 100644
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
 diff --git a/fs/aio.c b/fs/aio.c
-index b9d64d8..86cb1d5 100644
+index 3b65ee7..aa6ec34 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -42329,7 +42266,7 @@ index b9d64d8..86cb1d5 100644
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1461,22 +1461,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
  static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  {
  	ssize_t ret;
@@ -42351,11 +42288,15 @@ index b9d64d8..86cb1d5 100644
  				&kiocb->ki_iovec, 1);
  	if (ret < 0)
  		goto out;
+@@ -1481,6 +1482,11 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ 	if (ret < 0)
+ 		goto out;
  
 +	if (kiocb->ki_iovec == &iovstack) {
 +		kiocb->ki_inline_vec = iovstack;
 +		kiocb->ki_iovec = &kiocb->ki_inline_vec;
 +	}
++
  	kiocb->ki_nr_segs = kiocb->ki_nbytes;
  	kiocb->ki_cur_seg = 0;
  	/* ki_nbytes/left now reflect bytes instead of segs */
@@ -43426,10 +43367,10 @@ index 1bffbe0..c8c283e 100644
  			goto err;
  		}
 diff --git a/fs/bio.c b/fs/bio.c
-index b1fe82c..08e2e2e 100644
+index 4fc4dbb..d3a5b93 100644
 --- a/fs/bio.c
 +++ b/fs/bio.c
-@@ -837,7 +837,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
  		/*
  		 * Overflow, abort
  		 */
@@ -43438,7 +43379,7 @@ index b1fe82c..08e2e2e 100644
  			return ERR_PTR(-EINVAL);
  
  		nr_pages += end - start;
-@@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
+@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
  	const int read = bio_data_dir(bio) == READ;
  	struct bio_map_data *bmd = bio->bi_private;
  	int i;
@@ -43448,7 +43389,7 @@ index b1fe82c..08e2e2e 100644
  	__bio_for_each_segment(bvec, bio, i, 0) {
  		char *addr = page_address(bvec->bv_page);
 diff --git a/fs/block_dev.c b/fs/block_dev.c
-index abe9b48..5df59e8 100644
+index 9b98987..fd211e3 100644
 --- a/fs/block_dev.c
 +++ b/fs/block_dev.c
 @@ -681,7 +681,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
@@ -43865,7 +43806,7 @@ index 84e8c07..6170d31 100644
  		}
  	}
 diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index b4c2c99..50f8767 100644
+index b1451af..9a30647 100644
 --- a/fs/cifs/cifsfs.c
 +++ b/fs/cifs/cifsfs.c
 @@ -989,7 +989,7 @@ cifs_init_request_bufs(void)
@@ -47759,96 +47700,6 @@ index 50a15fa..ca113f9 100644
  }
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index bab7c58..38bd5f2 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -3582,19 +3582,23 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
- 	if (npages == 0)
- 		npages = 1;
- 
-+	/* Add an extra page to handle the bitmap returned */
-+	npages++;
-+
- 	for (i = 0; i < npages; i++) {
- 		pages[i] = alloc_page(GFP_KERNEL);
- 		if (!pages[i])
- 			goto out_free;
- 	}
--	if (npages > 1) {
--		/* for decoding across pages */
--		res.acl_scratch = alloc_page(GFP_KERNEL);
--		if (!res.acl_scratch)
--			goto out_free;
--	}
-+
-+	/* for decoding across pages */
-+	res.acl_scratch = alloc_page(GFP_KERNEL);
-+	if (!res.acl_scratch)
-+		goto out_free;
-+
- 	args.acl_len = npages * PAGE_SIZE;
- 	args.acl_pgbase = 0;
-+
- 	/* Let decode_getfacl know not to fail if the ACL data is larger than
- 	 * the page we send as a guess */
- 	if (buf == NULL)
-diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
-index 68adab4..d7e6f7b 100644
---- a/fs/nfs/nfs4xdr.c
-+++ b/fs/nfs/nfs4xdr.c
-@@ -4965,11 +4965,19 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
- 		 bitmap[3] = {0};
- 	struct kvec *iov = req->rq_rcv_buf.head;
- 	int status;
-+	size_t page_len = xdr->buf->page_len;
- 
- 	res->acl_len = 0;
- 	if ((status = decode_op_hdr(xdr, OP_GETATTR)) != 0)
- 		goto out;
-+
- 	bm_p = xdr->p;
-+	res->acl_data_offset = be32_to_cpup(bm_p) + 2;
-+	res->acl_data_offset <<= 2;
-+	/* Check if the acl data starts beyond the allocated buffer */
-+	if (res->acl_data_offset > page_len)
-+		return -ERANGE;
-+
- 	if ((status = decode_attr_bitmap(xdr, bitmap)) != 0)
- 		goto out;
- 	if ((status = decode_attr_length(xdr, &attrlen, &savep)) != 0)
-@@ -4979,28 +4987,24 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
- 		return -EIO;
- 	if (likely(bitmap[0] & FATTR4_WORD0_ACL)) {
- 		size_t hdrlen;
--		u32 recvd;
- 
- 		/* The bitmap (xdr len + bitmaps) and the attr xdr len words
- 		 * are stored with the acl data to handle the problem of
- 		 * variable length bitmaps.*/
- 		xdr->p = bm_p;
--		res->acl_data_offset = be32_to_cpup(bm_p) + 2;
--		res->acl_data_offset <<= 2;
- 
- 		/* We ignore &savep and don't do consistency checks on
- 		 * the attr length.  Let userspace figure it out.... */
- 		hdrlen = (u8 *)xdr->p - (u8 *)iov->iov_base;
- 		attrlen += res->acl_data_offset;
--		recvd = req->rq_rcv_buf.len - hdrlen;
--		if (attrlen > recvd) {
-+		if (attrlen > page_len) {
- 			if (res->acl_flags & NFS4_ACL_LEN_REQUEST) {
- 				/* getxattr interface called with a NULL buf */
- 				res->acl_len = attrlen;
- 				goto out;
- 			}
--			dprintk("NFS: acl reply: attrlen %u > recvd %u\n",
--					attrlen, recvd);
-+			dprintk("NFS: acl reply: attrlen %zu > page_len %u\n",
-+					attrlen, page_len);
- 			return -EINVAL;
- 		}
- 		xdr_read_pages(xdr, attrlen);
 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
 index 5c3cd82..ed535e5 100644
 --- a/fs/nfsd/vfs.c
@@ -61356,7 +61207,7 @@ index 84ccf8e..2e9b14c 100644
  };
  
 diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 11f1951..e3c18da 100644
+index 43d36b7..e5575ee 100644
 --- a/include/linux/fs.h
 +++ b/include/linux/fs.h
 @@ -1614,7 +1614,8 @@ struct file_operations {
@@ -61452,7 +61303,7 @@ index c3da42d..c70e0df 100644
  int trace_set_clr_event(const char *system, const char *event, int set);
  
 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
-index c6f7f6a..aa0f7d3 100644
+index 4eec461..84c73cf 100644
 --- a/include/linux/genhd.h
 +++ b/include/linux/genhd.h
 @@ -185,7 +185,7 @@ struct gendisk {
@@ -62775,7 +62626,7 @@ index b16f653..eb908f4 100644
  #define request_module_nowait(mod...) __request_module(false, mod)
  #define try_then_request_module(x, mod...) \
 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 35410ef..9f98b23 100644
+index 6136821..b3ba6ba 100644
 --- a/include/linux/kvm_host.h
 +++ b/include/linux/kvm_host.h
 @@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
@@ -65410,7 +65261,7 @@ index 43298f9..2f56c12 100644
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
 diff --git a/init/do_mounts.c b/init/do_mounts.c
-index db6e5ee..7677ff7 100644
+index d6c229f..4746631 100644
 --- a/init/do_mounts.c
 +++ b/init/do_mounts.c
 @@ -325,11 +325,11 @@ static void __init get_fs_names(char *page)
@@ -65712,7 +65563,7 @@ index 2531811..040d4d4 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index 217ed23..ec5406f 100644
+index cb08fea2..f5b850d 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
@@ -65774,7 +65625,7 @@ index 217ed23..ec5406f 100644
  static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -681,6 +726,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -678,6 +723,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
  {
  	int count = preempt_count();
  	int ret;
@@ -65782,7 +65633,7 @@ index 217ed23..ec5406f 100644
  
  	if (initcall_debug)
  		ret = do_one_initcall_debug(fn);
-@@ -693,15 +739,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -690,15 +736,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
  		sprintf(msgbuf, "error code %d ", ret);
  
  	if (preempt_count() != count) {
@@ -65802,7 +65653,7 @@ index 217ed23..ec5406f 100644
  	}
  
  	return ret;
-@@ -820,7 +866,7 @@ static int __init kernel_init(void * unused)
+@@ -821,7 +867,7 @@ static int __init kernel_init(void * unused)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -65811,7 +65662,7 @@ index 217ed23..ec5406f 100644
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -833,11 +879,13 @@ static int __init kernel_init(void * unused)
+@@ -834,11 +880,13 @@ static int __init kernel_init(void * unused)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -66160,7 +66011,7 @@ index b463871..fa3ea1f 100644
   * nsown_capable - Check superior capability to one's own user_ns
   * @cap: The capability in question
 diff --git a/kernel/compat.c b/kernel/compat.c
-index f346ced..aa2b1f4 100644
+index a6d0649..f44fb27 100644
 --- a/kernel/compat.c
 +++ b/kernel/compat.c
 @@ -13,6 +13,7 @@
@@ -66198,18 +66049,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(old_fs);
  	if (ret == 0)
  		ret = put_user(s, set);
-@@ -332,8 +333,8 @@ asmlinkage long compat_sys_sigprocmask(int how, compat_old_sigset_t __user *set,
- 	old_fs = get_fs();
- 	set_fs(KERNEL_DS);
- 	ret = sys_sigprocmask(how,
--			      set ? (old_sigset_t __user *) &s : NULL,
--			      oset ? (old_sigset_t __user *) &s : NULL);
-+			      set ? (old_sigset_t __force_user *) &s : NULL,
-+			      oset ? (old_sigset_t __force_user *) &s : NULL);
- 	set_fs(old_fs);
- 	if (ret == 0)
- 		if (oset)
-@@ -370,7 +371,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
+@@ -399,7 +400,7 @@ asmlinkage long compat_sys_old_getrlimit(unsigned int resource,
  	mm_segment_t old_fs = get_fs();
  
  	set_fs(KERNEL_DS);
@@ -66218,7 +66058,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(old_fs);
  
  	if (!ret) {
-@@ -442,7 +443,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
+@@ -471,7 +472,7 @@ asmlinkage long compat_sys_getrusage(int who, struct compat_rusage __user *ru)
  	mm_segment_t old_fs = get_fs();
  
  	set_fs(KERNEL_DS);
@@ -66227,7 +66067,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(old_fs);
  
  	if (ret)
-@@ -469,8 +470,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
+@@ -498,8 +499,8 @@ compat_sys_wait4(compat_pid_t pid, compat_uint_t __user *stat_addr, int options,
  		set_fs (KERNEL_DS);
  		ret = sys_wait4(pid,
  				(stat_addr ?
@@ -66238,7 +66078,7 @@ index f346ced..aa2b1f4 100644
  		set_fs (old_fs);
  
  		if (ret > 0) {
-@@ -495,8 +496,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
+@@ -524,8 +525,8 @@ asmlinkage long compat_sys_waitid(int which, compat_pid_t pid,
  	memset(&info, 0, sizeof(info));
  
  	set_fs(KERNEL_DS);
@@ -66249,7 +66089,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(old_fs);
  
  	if ((ret < 0) || (info.si_signo == 0))
-@@ -626,8 +627,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
+@@ -655,8 +656,8 @@ long compat_sys_timer_settime(timer_t timer_id, int flags,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = sys_timer_settime(timer_id, flags,
@@ -66260,7 +66100,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(oldfs);
  	if (!err && old && put_compat_itimerspec(old, &oldts))
  		return -EFAULT;
-@@ -644,7 +645,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
+@@ -673,7 +674,7 @@ long compat_sys_timer_gettime(timer_t timer_id,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = sys_timer_gettime(timer_id,
@@ -66269,7 +66109,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(oldfs);
  	if (!err && put_compat_itimerspec(setting, &ts))
  		return -EFAULT;
-@@ -663,7 +664,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
+@@ -692,7 +693,7 @@ long compat_sys_clock_settime(clockid_t which_clock,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = sys_clock_settime(which_clock,
@@ -66278,7 +66118,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(oldfs);
  	return err;
  }
-@@ -678,7 +679,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
+@@ -707,7 +708,7 @@ long compat_sys_clock_gettime(clockid_t which_clock,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = sys_clock_gettime(which_clock,
@@ -66287,7 +66127,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(oldfs);
  	if (!err && put_compat_timespec(&ts, tp))
  		return -EFAULT;
-@@ -698,7 +699,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
+@@ -727,7 +728,7 @@ long compat_sys_clock_adjtime(clockid_t which_clock,
  
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
@@ -66296,7 +66136,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(oldfs);
  
  	err = compat_put_timex(utp, &txc);
-@@ -718,7 +719,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
+@@ -747,7 +748,7 @@ long compat_sys_clock_getres(clockid_t which_clock,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = sys_clock_getres(which_clock,
@@ -66305,7 +66145,7 @@ index f346ced..aa2b1f4 100644
  	set_fs(oldfs);
  	if (!err && tp && put_compat_timespec(&ts, tp))
  		return -EFAULT;
-@@ -730,9 +731,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
+@@ -759,9 +760,9 @@ static long compat_clock_nanosleep_restart(struct restart_block *restart)
  	long err;
  	mm_segment_t oldfs;
  	struct timespec tu;
@@ -66317,7 +66157,7 @@ index f346ced..aa2b1f4 100644
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = clock_nanosleep_restart(restart);
-@@ -764,8 +765,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
+@@ -793,8 +794,8 @@ long compat_sys_clock_nanosleep(clockid_t which_clock, int flags,
  	oldfs = get_fs();
  	set_fs(KERNEL_DS);
  	err = sys_clock_nanosleep(which_clock, flags,
@@ -75100,7 +74940,7 @@ index 55b266d..a532537 100644
  }
  
 diff --git a/mm/swapfile.c b/mm/swapfile.c
-index 2015a1e..8a602e9 100644
+index d3955f2..75db55c 100644
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
 @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
@@ -76711,14 +76551,14 @@ index 94cdbc5..0cb0063 100644
  			ts = peer->tcp_ts;
  			tsage = get_seconds() - peer->tcp_ts_stamp;
 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 9726927..32e6ca2 100644
+index 9726927..436489e 100644
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
 @@ -5836,6 +5836,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
  			goto discard;
  
  		if (th->syn) {
-+			if (th->fin)
++			if (th->fin || th->urg || th->psh)
 +				goto discard;
  			if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
  				return 1;
@@ -97832,7 +97672,7 @@ index af0f22f..9a7d479 100644
                         break;
         }
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index e401c1b..8d4d5fa 100644
+index ec747dc..da361c4 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
 @@ -75,7 +75,7 @@ LIST_HEAD(vm_list);
@@ -97844,7 +97684,7 @@ index e401c1b..8d4d5fa 100644
  
  struct kmem_cache *kvm_vcpu_cache;
  EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
-@@ -2269,7 +2269,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2274,7 +2274,7 @@ static void hardware_enable_nolock(void *junk)
  
  	if (r) {
  		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -97853,7 +97693,7 @@ index e401c1b..8d4d5fa 100644
  		printk(KERN_INFO "kvm: enabling virtualization on "
  				 "CPU%d failed\n", cpu);
  	}
-@@ -2323,10 +2323,10 @@ static int hardware_enable_all(void)
+@@ -2328,10 +2328,10 @@ static int hardware_enable_all(void)
  
  	kvm_usage_count++;
  	if (kvm_usage_count == 1) {
@@ -97866,7 +97706,7 @@ index e401c1b..8d4d5fa 100644
  			hardware_disable_all_nolock();
  			r = -EBUSY;
  		}
-@@ -2677,7 +2677,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2682,7 +2682,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
  	kvm_arch_vcpu_put(vcpu);
  }
  
@@ -97875,7 +97715,7 @@ index e401c1b..8d4d5fa 100644
  		  struct module *module)
  {
  	int r;
-@@ -2740,7 +2740,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2745,7 +2745,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (!vcpu_align)
  		vcpu_align = __alignof__(struct kvm_vcpu);
  	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -97884,7 +97724,7 @@ index e401c1b..8d4d5fa 100644
  	if (!kvm_vcpu_cache) {
  		r = -ENOMEM;
  		goto out_free_3;
-@@ -2750,9 +2750,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2755,9 +2755,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (r)
  		goto out_free;
  

diff --git a/3.2.18/4430_grsec-remove-localversion-grsec.patch b/3.2.19/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.2.18/4430_grsec-remove-localversion-grsec.patch
rename to 3.2.19/4430_grsec-remove-localversion-grsec.patch

diff --git a/3.2.18/4435_grsec-mute-warnings.patch b/3.2.19/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.2.18/4435_grsec-mute-warnings.patch
rename to 3.2.19/4435_grsec-mute-warnings.patch

diff --git a/3.2.18/4440_grsec-remove-protected-paths.patch b/3.2.19/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.2.18/4440_grsec-remove-protected-paths.patch
rename to 3.2.19/4440_grsec-remove-protected-paths.patch

diff --git a/3.2.18/4445_grsec-pax-without-grsec.patch b/3.2.19/4445_grsec-pax-without-grsec.patch
similarity index 100%
rename from 3.2.18/4445_grsec-pax-without-grsec.patch
rename to 3.2.19/4445_grsec-pax-without-grsec.patch

diff --git a/3.2.18/4450_grsec-kconfig-default-gids.patch b/3.2.19/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.2.18/4450_grsec-kconfig-default-gids.patch
rename to 3.2.19/4450_grsec-kconfig-default-gids.patch

diff --git a/3.2.18/4455_grsec-kconfig-gentoo.patch b/3.2.19/4455_grsec-kconfig-gentoo.patch
similarity index 100%
rename from 3.2.18/4455_grsec-kconfig-gentoo.patch
rename to 3.2.19/4455_grsec-kconfig-gentoo.patch

diff --git a/3.2.18/4460-grsec-kconfig-proc-user.patch b/3.2.19/4460-grsec-kconfig-proc-user.patch
similarity index 100%
rename from 3.2.18/4460-grsec-kconfig-proc-user.patch
rename to 3.2.19/4460-grsec-kconfig-proc-user.patch

diff --git a/3.2.18/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.19/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.2.18/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.2.19/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/3.2.18/4470_disable-compat_vdso.patch b/3.2.19/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.2.18/4470_disable-compat_vdso.patch
rename to 3.2.19/4470_disable-compat_vdso.patch

diff --git a/3.3.7/0000_README b/3.3.8/0000_README
similarity index 97%
rename from 3.3.7/0000_README
rename to 3.3.8/0000_README
index 4499d08..c4356e4 100644
--- a/3.3.7/0000_README
+++ b/3.3.8/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.9-3.3.7-201206011935.patch
+Patch:	4420_grsecurity-2.9-3.3.8-201206042136.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 

diff --git a/3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch b/3.3.8/4420_grsecurity-2.9-3.3.8-201206042136.patch
similarity index 99%
rename from 3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch
rename to 3.3.8/4420_grsecurity-2.9-3.3.8-201206042136.patch
index 8787b62..e7f177d 100644
--- a/3.3.7/4420_grsecurity-2.9-3.3.7-201206011935.patch
+++ b/3.3.8/4420_grsecurity-2.9-3.3.8-201206042136.patch
@@ -195,7 +195,7 @@ index d99fd9c..8689fef 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 073f74f..02aebe9 100644
+index db96149..f101728 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -312,7 +312,7 @@ index 073f74f..02aebe9 100644
  prepare: prepare0
  
  # Generate some files
-@@ -1089,6 +1142,8 @@ all: modules
+@@ -1092,6 +1145,8 @@ all: modules
  #	using awk while concatenating to the final file.
  
  PHONY += modules
@@ -321,7 +321,7 @@ index 073f74f..02aebe9 100644
  modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
  	$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
  	@$(kecho) '  Building modules, stage 2.';
-@@ -1104,7 +1159,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1107,7 +1162,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
  
  # Target to prepare building external modules
  PHONY += modules_prepare
@@ -330,7 +330,7 @@ index 073f74f..02aebe9 100644
  
  # Target to install modules
  PHONY += modules_install
-@@ -1201,6 +1256,7 @@ distclean: mrproper
+@@ -1204,6 +1259,7 @@ distclean: mrproper
  		\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
  		-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
  		-o -name '.*.rej' \
@@ -338,7 +338,7 @@ index 073f74f..02aebe9 100644
  		-o -name '*%' -o -name '.*.cmd' -o -name 'core' \) \
  		-type f -print | xargs rm -f
  
-@@ -1361,6 +1417,8 @@ PHONY += $(module-dirs) modules
+@@ -1364,6 +1420,8 @@ PHONY += $(module-dirs) modules
  $(module-dirs): crmodverdir $(objtree)/Module.symvers
  	$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
  
@@ -347,7 +347,7 @@ index 073f74f..02aebe9 100644
  modules: $(module-dirs)
  	@$(kecho) '  Building modules, stage 2.';
  	$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1487,17 +1545,21 @@ else
+@@ -1490,17 +1548,21 @@ else
          target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
  endif
  
@@ -373,7 +373,7 @@ index 073f74f..02aebe9 100644
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
  %.symtypes: %.c prepare scripts FORCE
  	$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1507,11 +1569,15 @@ endif
+@@ -1510,11 +1572,15 @@ endif
  	$(cmd_crmodverdir)
  	$(Q)$(MAKE) KBUILD_MODULES=$(if $(CONFIG_MODULES),1) \
  	$(build)=$(build-dir)
@@ -1325,7 +1325,7 @@ index 75fe66b..2255c86 100644
  /*
   * Memory returned by kmalloc() may be used for DMA, so we must make
 diff --git a/arch/arm/include/asm/cacheflush.h b/arch/arm/include/asm/cacheflush.h
-index d5d8d5c..ad92c96 100644
+index 1252a26..9dc17b5 100644
 --- a/arch/arm/include/asm/cacheflush.h
 +++ b/arch/arm/include/asm/cacheflush.h
 @@ -108,7 +108,7 @@ struct cpu_cache_fns {
@@ -1644,7 +1644,7 @@ index a255c39..4a19b25 100644
  #endif
  
 diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
-index f84dfe6..13e94f7 100644
+index 504b28a..62f7a7d 100644
 --- a/arch/arm/kernel/traps.c
 +++ b/arch/arm/kernel/traps.c
 @@ -259,6 +259,8 @@ static int __die(const char *str, int err, struct thread_info *thread, struct pt
@@ -7706,7 +7706,7 @@ index e46c214..7c72b55 100644
  	  This option helps catch unintended modifications to loadable
  	  kernel module's text and read-only data. It also prevents execution
 diff --git a/arch/x86/Makefile b/arch/x86/Makefile
-index 209ba12..15140db 100644
+index 015f0c5..b405802 100644
 --- a/arch/x86/Makefile
 +++ b/arch/x86/Makefile
 @@ -46,6 +46,7 @@ else
@@ -7717,7 +7717,7 @@ index 209ba12..15140db 100644
          KBUILD_AFLAGS += -m64
          KBUILD_CFLAGS += -m64
  
-@@ -201,3 +202,12 @@ define archhelp
+@@ -205,3 +206,12 @@ define archhelp
    echo  '                  FDARGS="..."  arguments for the booted kernel'
    echo  '                  FDINITRD=file initrd for the booted kernel'
  endef
@@ -7789,7 +7789,7 @@ index c7093bd..d4247ffe0 100644
  	return diff;
  }
 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index fd55a2f..217b501 100644
+index e398bb5..3a382ca 100644
 --- a/arch/x86/boot/compressed/Makefile
 +++ b/arch/x86/boot/compressed/Makefile
 @@ -14,6 +14,9 @@ cflags-$(CONFIG_X86_64) := -mcmodel=small
@@ -7898,201 +7898,6 @@ index 7116dcb..d9ae1d7 100644
  		error("Wrong destination address");
  #endif
  
-diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
-index e77f4e4..17e511f 100644
---- a/arch/x86/boot/compressed/relocs.c
-+++ b/arch/x86/boot/compressed/relocs.c
-@@ -13,8 +13,11 @@
- 
- static void die(char *fmt, ...);
- 
-+#include "../../../../include/generated/autoconf.h"
-+
- #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
- static Elf32_Ehdr ehdr;
-+static Elf32_Phdr *phdr;
- static unsigned long reloc_count, reloc_idx;
- static unsigned long *relocs;
- 
-@@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
- 	}
- }
- 
-+static void read_phdrs(FILE *fp)
-+{
-+	unsigned int i;
-+
-+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
-+	if (!phdr) {
-+		die("Unable to allocate %d program headers\n",
-+		    ehdr.e_phnum);
-+	}
-+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
-+		die("Seek to %d failed: %s\n",
-+			ehdr.e_phoff, strerror(errno));
-+	}
-+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
-+		die("Cannot read ELF program headers: %s\n",
-+			strerror(errno));
-+	}
-+	for(i = 0; i < ehdr.e_phnum; i++) {
-+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
-+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
-+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
-+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
-+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
-+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
-+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
-+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
-+	}
-+
-+}
-+
- static void read_shdrs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	Elf32_Shdr shdr;
- 
- 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
-@@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
- 
- static void read_strtabs(FILE *fp)
- {
--	int i;
-+	unsigned int i;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_STRTAB) {
-@@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
- 
- static void read_symtabs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
-@@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
- 
- static void read_relocs(FILE *fp)
- {
--	int i,j;
-+	unsigned int i,j;
-+	uint32_t base;
-+
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
- 			die("Cannot read symbol table: %s\n",
- 				strerror(errno));
- 		}
-+		base = 0;
-+		for (j = 0; j < ehdr.e_phnum; j++) {
-+			if (phdr[j].p_type != PT_LOAD )
-+				continue;
-+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
-+				continue;
-+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
-+			break;
-+		}
- 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
- 			Elf32_Rel *rel = &sec->reltab[j];
--			rel->r_offset = elf32_to_cpu(rel->r_offset);
-+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
- 			rel->r_info   = elf32_to_cpu(rel->r_info);
- 		}
- 	}
-@@ -396,13 +440,13 @@ static void read_relocs(FILE *fp)
- 
- static void print_absolute_symbols(void)
- {
--	int i;
-+	unsigned int i;
- 	printf("Absolute symbols\n");
- 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		char *sym_strtab;
--		int j;
-+		unsigned int j;
- 
- 		if (sec->shdr.sh_type != SHT_SYMTAB) {
- 			continue;
-@@ -429,14 +473,14 @@ static void print_absolute_symbols(void)
- 
- static void print_absolute_relocs(void)
- {
--	int i, printed = 0;
-+	unsigned int i, printed = 0;
- 
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		struct section *sec = &secs[i];
- 		struct section *sec_applies, *sec_symtab;
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
--		int j;
-+		unsigned int j;
- 		if (sec->shdr.sh_type != SHT_REL) {
- 			continue;
- 		}
-@@ -497,13 +541,13 @@ static void print_absolute_relocs(void)
- 
- static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- {
--	int i;
-+	unsigned int i;
- 	/* Walk through the relocations */
- 	for (i = 0; i < ehdr.e_shnum; i++) {
- 		char *sym_strtab;
- 		Elf32_Sym *sh_symtab;
- 		struct section *sec_applies, *sec_symtab;
--		int j;
-+		unsigned int j;
- 		struct section *sec = &secs[i];
- 
- 		if (sec->shdr.sh_type != SHT_REL) {
-@@ -528,6 +572,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
- 			    !is_rel_reloc(sym_name(sym_strtab, sym))) {
- 				continue;
- 			}
-+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
-+			if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
-+				continue;
-+
-+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
-+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
-+			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
-+				continue;
-+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
-+				continue;
-+#endif
-+
- 			switch (r_type) {
- 			case R_386_NONE:
- 			case R_386_PC32:
-@@ -569,7 +629,7 @@ static int cmp_relocs(const void *va, const void *vb)
- 
- static void emit_relocs(int as_text)
- {
--	int i;
-+	unsigned int i;
- 	/* Count how many relocations I have and allocate space for them. */
- 	reloc_count = 0;
- 	walk_relocs(count_reloc);
-@@ -663,6 +723,7 @@ int main(int argc, char **argv)
- 			fname, strerror(errno));
- 	}
- 	read_ehdr(fp);
-+	read_phdrs(fp);
- 	read_shdrs(fp);
- 	read_strtabs(fp);
- 	read_symtabs(fp);
 diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
 index 4d3ff03..e4972ff 100644
 --- a/arch/x86/boot/cpucheck.c
@@ -14346,7 +14151,7 @@ index 3e6ff6c..54b4992 100644
  }
  #endif
 diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
-index 5a11ae2..a1a1c8a 100644
+index dee004f..327a57e 100644
 --- a/arch/x86/kernel/cpu/mcheck/mce.c
 +++ b/arch/x86/kernel/cpu/mcheck/mce.c
 @@ -42,6 +42,7 @@
@@ -14397,7 +14202,7 @@ index 5a11ae2..a1a1c8a 100644
  			return;
  	}
  	/* First print corrected ones that are still unlogged */
-@@ -658,7 +659,7 @@ static int mce_timed_out(u64 *t)
+@@ -666,7 +667,7 @@ static int mce_timed_out(u64 *t)
  	 * might have been modified by someone else.
  	 */
  	rmb();
@@ -14406,7 +14211,7 @@ index 5a11ae2..a1a1c8a 100644
  		wait_for_panic();
  	if (!monarch_timeout)
  		goto out;
-@@ -1446,7 +1447,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
+@@ -1454,7 +1455,7 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code)
  }
  
  /* Call the installed machine check handler for this CPU setup. */
@@ -14415,7 +14220,7 @@ index 5a11ae2..a1a1c8a 100644
  						unexpected_machine_check;
  
  /*
-@@ -1469,7 +1470,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1477,7 +1478,9 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
  		return;
  	}
  
@@ -14425,7 +14230,7 @@ index 5a11ae2..a1a1c8a 100644
  
  	__mcheck_cpu_init_generic();
  	__mcheck_cpu_init_vendor(c);
-@@ -1483,7 +1486,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
+@@ -1491,7 +1494,7 @@ void __cpuinit mcheck_cpu_init(struct cpuinfo_x86 *c)
   */
  
  static DEFINE_SPINLOCK(mce_chrdev_state_lock);
@@ -14434,7 +14239,7 @@ index 5a11ae2..a1a1c8a 100644
  static int mce_chrdev_open_exclu;	/* already open exclusive? */
  
  static int mce_chrdev_open(struct inode *inode, struct file *file)
-@@ -1491,7 +1494,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1499,7 +1502,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  	spin_lock(&mce_chrdev_state_lock);
  
  	if (mce_chrdev_open_exclu ||
@@ -14443,7 +14248,7 @@ index 5a11ae2..a1a1c8a 100644
  		spin_unlock(&mce_chrdev_state_lock);
  
  		return -EBUSY;
-@@ -1499,7 +1502,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
+@@ -1507,7 +1510,7 @@ static int mce_chrdev_open(struct inode *inode, struct file *file)
  
  	if (file->f_flags & O_EXCL)
  		mce_chrdev_open_exclu = 1;
@@ -14452,7 +14257,7 @@ index 5a11ae2..a1a1c8a 100644
  
  	spin_unlock(&mce_chrdev_state_lock);
  
-@@ -1510,7 +1513,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
+@@ -1518,7 +1521,7 @@ static int mce_chrdev_release(struct inode *inode, struct file *file)
  {
  	spin_lock(&mce_chrdev_state_lock);
  
@@ -14461,7 +14266,7 @@ index 5a11ae2..a1a1c8a 100644
  	mce_chrdev_open_exclu = 0;
  
  	spin_unlock(&mce_chrdev_state_lock);
-@@ -2229,7 +2232,7 @@ struct dentry *mce_get_debugfs_dir(void)
+@@ -2237,7 +2240,7 @@ struct dentry *mce_get_debugfs_dir(void)
  static void mce_reset(void)
  {
  	cpu_missing = 0;
@@ -24674,7 +24479,7 @@ index 8ecbb4b..a269cab 100644
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
 diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
-index 6cabf65..9976a56 100644
+index 6cabf65..74565da 100644
 --- a/arch/x86/mm/init.c
 +++ b/arch/x86/mm/init.c
 @@ -17,6 +17,8 @@
@@ -24734,7 +24539,7 @@ index 6cabf65..9976a56 100644
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
  	if (!page_is_ram(pagenr))
-@@ -372,8 +401,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
+@@ -372,8 +401,116 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end)
  #endif
  }
  
@@ -24769,14 +24574,13 @@ index 6cabf65..9976a56 100644
 +	unsigned long addr, limit;
 +	struct desc_struct d;
 +	int cpu;
-+#endif
-+#endif
-+#ifndef CONFIG_X86_PAE
++#else
 +	pgd_t *pgd;
 +	pud_t *pud;
 +	pmd_t *pmd;
 +	unsigned long addr, end;
 +#endif
++#endif
 +
 +	gr_init_ebda();
 +
@@ -26846,6 +26650,206 @@ index f10c0af..3ec1f95 100644
  
  	syscall_init();				/* This sets MSR_*STAR and related */
  #endif
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index b685296..5cdc8ad 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -14,8 +14,16 @@
+ 
+ static void die(char *fmt, ...);
+ 
++#include "../../../include/generated/autoconf.h"
++#ifdef CONFIG_X86_32
++#define __PAGE_OFFSET CONFIG_PAGE_OFFSET
++#else
++#define __PAGE_OFFSET 0
++#endif
++
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr *phdr;
+ static unsigned long reloc_count, reloc_idx;
+ static unsigned long *relocs;
+ static unsigned long reloc16_count, reloc16_idx;
+@@ -323,9 +331,39 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	unsigned int i;
++
++	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
++	if (!phdr) {
++		die("Unable to allocate %d program headers\n",
++		    ehdr.e_phnum);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	Elf32_Shdr shdr;
+ 
+ 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
+@@ -360,7 +398,7 @@ static void read_shdrs(FILE *fp)
+ 
+ static void read_strtabs(FILE *fp)
+ {
+-	int i;
++	unsigned int i;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_STRTAB) {
+@@ -385,7 +423,7 @@ static void read_strtabs(FILE *fp)
+ 
+ static void read_symtabs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+@@ -418,7 +456,9 @@ static void read_symtabs(FILE *fp)
+ 
+ static void read_relocs(FILE *fp)
+ {
+-	int i,j;
++	unsigned int i,j;
++	uint32_t base;
++
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -438,9 +478,18 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = __PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
+ 			Elf32_Rel *rel = &sec->reltab[j];
+-			rel->r_offset = elf32_to_cpu(rel->r_offset);
++			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
+ 			rel->r_info   = elf32_to_cpu(rel->r_info);
+ 		}
+ 	}
+@@ -449,13 +498,13 @@ static void read_relocs(FILE *fp)
+ 
+ static void print_absolute_symbols(void)
+ {
+-	int i;
++	unsigned int i;
+ 	printf("Absolute symbols\n");
+ 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		char *sym_strtab;
+-		int j;
++		unsigned int j;
+ 
+ 		if (sec->shdr.sh_type != SHT_SYMTAB) {
+ 			continue;
+@@ -482,14 +531,14 @@ static void print_absolute_symbols(void)
+ 
+ static void print_absolute_relocs(void)
+ {
+-	int i, printed = 0;
++	unsigned int i, printed = 0;
+ 
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		struct section *sec = &secs[i];
+ 		struct section *sec_applies, *sec_symtab;
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+-		int j;
++		unsigned int j;
+ 		if (sec->shdr.sh_type != SHT_REL) {
+ 			continue;
+ 		}
+@@ -551,13 +600,13 @@ static void print_absolute_relocs(void)
+ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
+ 			int use_real_mode)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Walk through the relocations */
+ 	for (i = 0; i < ehdr.e_shnum; i++) {
+ 		char *sym_strtab;
+ 		Elf32_Sym *sh_symtab;
+ 		struct section *sec_applies, *sec_symtab;
+-		int j;
++		unsigned int j;
+ 		struct section *sec = &secs[i];
+ 
+ 		if (sec->shdr.sh_type != SHT_REL) {
+@@ -583,6 +632,22 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym),
+ 
+ 			shn_abs = sym->st_shndx == SHN_ABS;
+ 
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data..percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
++				continue;
++
++#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
++				continue;
++			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
++				continue;
++#endif
++
+ 			switch (r_type) {
+ 			case R_386_NONE:
+ 			case R_386_PC32:
+@@ -674,7 +739,7 @@ static int write32(unsigned int v, FILE *f)
+ 
+ static void emit_relocs(int as_text, int use_real_mode)
+ {
+-	int i;
++	unsigned int i;
+ 	/* Count how many relocations I have and allocate space for them. */
+ 	reloc_count = 0;
+ 	walk_relocs(count_reloc, use_real_mode);
+@@ -801,6 +866,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
 diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
 index 5d17950..2253fc9 100644
 --- a/arch/x86/vdso/Makefile
@@ -27019,7 +27023,7 @@ index 153407c..611cba9 100644
 -}
 -__setup("vdso=", vdso_setup);
 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
-index 4e517d4..68a48f5 100644
+index 4e517d4..8426127 100644
 --- a/arch/x86/xen/enlighten.c
 +++ b/arch/x86/xen/enlighten.c
 @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
@@ -27031,7 +27035,18 @@ index 4e517d4..68a48f5 100644
  RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
  __read_mostly int xen_have_vector_callback;
  EXPORT_SYMBOL_GPL(xen_have_vector_callback);
-@@ -1030,30 +1028,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
+@@ -982,7 +980,10 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = {
+ 	.wbinvd = native_wbinvd,
+ 
+ 	.read_msr = native_read_msr_safe,
++	.rdmsr_regs = native_rdmsr_safe_regs,
+ 	.write_msr = xen_write_msr_safe,
++	.wrmsr_regs = native_wrmsr_safe_regs,
++
+ 	.read_tsc = native_read_tsc,
+ 	.read_pmc = native_read_pmc,
+ 
+@@ -1030,30 +1031,30 @@ static const struct pv_apic_ops xen_apic_ops __initconst = {
  #endif
  };
  
@@ -27069,7 +27084,7 @@ index 4e517d4..68a48f5 100644
  {
  	if (pm_power_off)
  		pm_power_off();
-@@ -1156,7 +1154,17 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1156,7 +1157,17 @@ asmlinkage void __init xen_start_kernel(void)
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
  	/* Work out if we support NX */
@@ -27088,7 +27103,7 @@ index 4e517d4..68a48f5 100644
  
  	xen_setup_features();
  
-@@ -1187,13 +1195,6 @@ asmlinkage void __init xen_start_kernel(void)
+@@ -1187,13 +1198,6 @@ asmlinkage void __init xen_start_kernel(void)
  
  	machine_ops = xen_machine_ops;
  
@@ -30642,10 +30657,10 @@ index e159e33..cdcc663 100644
  	for (i = 0; i < count; i++) {
  		char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
 diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 5bd4361..0241a42 100644
+index 307c5e6..a1e4216 100644
 --- a/drivers/gpu/drm/i915/i915_irq.c
 +++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -475,7 +475,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
+@@ -472,7 +472,7 @@ static irqreturn_t ivybridge_irq_handler(DRM_IRQ_ARGS)
  	u32 de_iir, gt_iir, de_ier, pch_iir, pm_iir;
  	struct drm_i915_master_private *master_priv;
  
@@ -30654,7 +30669,7 @@ index 5bd4361..0241a42 100644
  
  	/* disable master interrupt before clearing iir  */
  	de_ier = I915_READ(DEIER);
-@@ -566,7 +566,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
+@@ -563,7 +563,7 @@ static irqreturn_t ironlake_irq_handler(DRM_IRQ_ARGS)
  	struct drm_i915_master_private *master_priv;
  	u32 bsd_usr_interrupt = GT_BSD_USER_INTERRUPT;
  
@@ -30663,7 +30678,7 @@ index 5bd4361..0241a42 100644
  
  	if (IS_GEN6(dev))
  		bsd_usr_interrupt = GT_GEN6_BSD_USER_INTERRUPT;
-@@ -1231,7 +1231,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -1228,7 +1228,7 @@ static irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
  	int ret = IRQ_NONE, pipe;
  	bool blc_event = false;
  
@@ -30672,7 +30687,7 @@ index 5bd4361..0241a42 100644
  
  	iir = I915_READ(IIR);
  
-@@ -1743,7 +1743,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
+@@ -1740,7 +1740,7 @@ static void ironlake_irq_preinstall(struct drm_device *dev)
  {
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  
@@ -30681,7 +30696,7 @@ index 5bd4361..0241a42 100644
  
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
-@@ -1932,7 +1932,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
+@@ -1929,7 +1929,7 @@ static void i915_driver_irq_preinstall(struct drm_device * dev)
  	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
  	int pipe;
  
@@ -30691,7 +30706,7 @@ index 5bd4361..0241a42 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 2163818..cede019 100644
+index 9ab9b16..e5b1b8d 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
 @@ -2238,7 +2238,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
@@ -31446,6 +31461,19 @@ index 75dbe34..f9204a8 100644
  
  	hid_debug_register(hdev, dev_name(&hdev->dev));
  	ret = device_add(&hdev->dev);
+diff --git a/drivers/hid/hid-wiimote-debug.c b/drivers/hid/hid-wiimote-debug.c
+index 17dabc1..bf248eb 100644
+--- a/drivers/hid/hid-wiimote-debug.c
++++ b/drivers/hid/hid-wiimote-debug.c
+@@ -72,7 +72,7 @@ static ssize_t wiidebug_eeprom_read(struct file *f, char __user *u, size_t s,
+ 	else if (size == 0)
+ 		return -EIO;
+ 
+-	if (copy_to_user(u, buf, size))
++	if (size > sizeof(buf) || copy_to_user(u, buf, size))
+ 		return -EFAULT;
+ 
+ 	*off += size;
 diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c
 index b1ec0e2..c295a61 100644
 --- a/drivers/hid/usbhid/hiddev.c
@@ -33618,7 +33646,7 @@ index b89c548..2af3ce4 100644
  
  void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
 diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 363aaf4..d875264 100644
+index 1ae4327..4ecabb5 100644
 --- a/drivers/md/md.c
 +++ b/drivers/md/md.c
 @@ -277,10 +277,10 @@ EXPORT_SYMBOL_GPL(md_trim_bio);
@@ -34028,7 +34056,7 @@ index 8418c02..8555013 100644
  	NGENE_ID(0x18c3, 0xabc4, ngene_info_cineS2),
  	NGENE_ID(0x18c3, 0xdb01, ngene_info_satixS2),
 diff --git a/drivers/media/radio/radio-cadet.c b/drivers/media/radio/radio-cadet.c
-index 16a089f..ab1667d 100644
+index 16a089f..1661b11 100644
 --- a/drivers/media/radio/radio-cadet.c
 +++ b/drivers/media/radio/radio-cadet.c
 @@ -326,6 +326,8 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
@@ -34040,6 +34068,15 @@ index 16a089f..ab1667d 100644
  	mutex_lock(&dev->lock);
  	if (dev->rdsstat == 0) {
  		dev->rdsstat = 1;
+@@ -347,7 +349,7 @@ static ssize_t cadet_read(struct file *file, char __user *data, size_t count, lo
+ 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
+ 	mutex_unlock(&dev->lock);
+ 
+-	if (copy_to_user(data, readbuf, i))
++	if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i))
+ 		return -EFAULT;
+ 	return i;
+ }
 diff --git a/drivers/media/video/au0828/au0828.h b/drivers/media/video/au0828/au0828.h
 index 9cde353..8c6a1c3 100644
 --- a/drivers/media/video/au0828/au0828.h
@@ -36571,7 +36608,7 @@ index 351dc0b..951dc32 100644
  
  	/* These three are default values which can be overridden */
 diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
-index b96962c..0c82ec2 100644
+index e640b73..2f68432 100644
 --- a/drivers/scsi/hpsa.c
 +++ b/drivers/scsi/hpsa.c
 @@ -507,7 +507,7 @@ static inline u32 next_command(struct ctlr_info *h)
@@ -36583,7 +36620,7 @@ index b96962c..0c82ec2 100644
  
  	if ((*(h->reply_pool_head) & 1) == (h->reply_pool_wraparound)) {
  		a = *(h->reply_pool_head); /* Next cmd in ring buffer */
-@@ -2991,7 +2991,7 @@ static void start_io(struct ctlr_info *h)
+@@ -2987,7 +2987,7 @@ static void start_io(struct ctlr_info *h)
  	while (!list_empty(&h->reqQ)) {
  		c = list_entry(h->reqQ.next, struct CommandList, list);
  		/* can't do anything if fifo is full */
@@ -36592,7 +36629,7 @@ index b96962c..0c82ec2 100644
  			dev_warn(&h->pdev->dev, "fifo full\n");
  			break;
  		}
-@@ -3001,7 +3001,7 @@ static void start_io(struct ctlr_info *h)
+@@ -2997,7 +2997,7 @@ static void start_io(struct ctlr_info *h)
  		h->Qdepth--;
  
  		/* Tell the controller execute command */
@@ -36601,7 +36638,7 @@ index b96962c..0c82ec2 100644
  
  		/* Put job onto the completed Q */
  		addQ(&h->cmpQ, c);
-@@ -3010,17 +3010,17 @@ static void start_io(struct ctlr_info *h)
+@@ -3006,17 +3006,17 @@ static void start_io(struct ctlr_info *h)
  
  static inline unsigned long get_next_completion(struct ctlr_info *h)
  {
@@ -36622,7 +36659,7 @@ index b96962c..0c82ec2 100644
  		(h->interrupts_enabled == 0);
  }
  
-@@ -3919,7 +3919,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
+@@ -3915,7 +3915,7 @@ static int __devinit hpsa_pci_init(struct ctlr_info *h)
  	if (prod_index < 0)
  		return -ENODEV;
  	h->product_name = products[prod_index].product_name;
@@ -36631,7 +36668,7 @@ index b96962c..0c82ec2 100644
  
  	if (hpsa_board_disabled(h->pdev)) {
  		dev_warn(&h->pdev->dev, "controller appears to be disabled\n");
-@@ -4164,7 +4164,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
+@@ -4160,7 +4160,7 @@ static void controller_lockup_detected(struct ctlr_info *h)
  
  	assert_spin_locked(&lockup_detector_lock);
  	remove_ctlr_from_lockup_detector_list(h);
@@ -36640,7 +36677,7 @@ index b96962c..0c82ec2 100644
  	spin_lock_irqsave(&h->lock, flags);
  	h->lockup_detected = readl(h->vaddr + SA5_SCRATCHPAD_OFFSET);
  	spin_unlock_irqrestore(&h->lock, flags);
-@@ -4344,7 +4344,7 @@ reinit_after_soft_reset:
+@@ -4340,7 +4340,7 @@ reinit_after_soft_reset:
  	}
  
  	/* make sure the board interrupts are off */
@@ -36649,7 +36686,7 @@ index b96962c..0c82ec2 100644
  
  	if (hpsa_request_irq(h, do_hpsa_intr_msi, do_hpsa_intr_intx))
  		goto clean2;
-@@ -4378,7 +4378,7 @@ reinit_after_soft_reset:
+@@ -4374,7 +4374,7 @@ reinit_after_soft_reset:
  		 * fake ones to scoop up any residual completions.
  		 */
  		spin_lock_irqsave(&h->lock, flags);
@@ -36658,7 +36695,7 @@ index b96962c..0c82ec2 100644
  		spin_unlock_irqrestore(&h->lock, flags);
  		free_irq(h->intr[h->intr_mode], h);
  		rc = hpsa_request_irq(h, hpsa_msix_discard_completions,
-@@ -4397,9 +4397,9 @@ reinit_after_soft_reset:
+@@ -4393,9 +4393,9 @@ reinit_after_soft_reset:
  		dev_info(&h->pdev->dev, "Board READY.\n");
  		dev_info(&h->pdev->dev,
  			"Waiting for stale completions to drain.\n");
@@ -36670,7 +36707,7 @@ index b96962c..0c82ec2 100644
  
  		rc = controller_reset_failed(h->cfgtable);
  		if (rc)
-@@ -4420,7 +4420,7 @@ reinit_after_soft_reset:
+@@ -4416,7 +4416,7 @@ reinit_after_soft_reset:
  	}
  
  	/* Turn the interrupts on so we can service requests */
@@ -36679,7 +36716,7 @@ index b96962c..0c82ec2 100644
  
  	hpsa_hba_inquiry(h);
  	hpsa_register_scsi(h);	/* hook ourselves into SCSI subsystem */
-@@ -4472,7 +4472,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
+@@ -4468,7 +4468,7 @@ static void hpsa_shutdown(struct pci_dev *pdev)
  	 * To write all data in the battery backed cache to disks
  	 */
  	hpsa_flush_cache(h);
@@ -36688,7 +36725,7 @@ index b96962c..0c82ec2 100644
  	free_irq(h->intr[h->intr_mode], h);
  #ifdef CONFIG_PCI_MSI
  	if (h->msix_vector)
-@@ -4636,7 +4636,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
+@@ -4632,7 +4632,7 @@ static __devinit void hpsa_enter_performant_mode(struct ctlr_info *h,
  		return;
  	}
  	/* Change the access methods to the performant access methods */
@@ -41515,7 +41552,7 @@ index 3c14e43..eafa544 100644
 [phone]  4 4 4
 +4 4 4  4 4 4
 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c
-index a40c05e..785c583 100644
+index 5fd95e0..b4a96f8 100644
 --- a/drivers/video/udlfb.c
 +++ b/drivers/video/udlfb.c
 @@ -619,11 +619,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y,
@@ -41550,7 +41587,7 @@ index a40c05e..785c583 100644
  		    >> 10)), /* Kcycles */
  		   &dev->cpu_kcycles_used);
  }
-@@ -1368,7 +1368,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
+@@ -1371,7 +1371,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41559,7 +41596,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t metrics_bytes_identical_show(struct device *fbdev,
-@@ -1376,7 +1376,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
+@@ -1379,7 +1379,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41568,7 +41605,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t metrics_bytes_sent_show(struct device *fbdev,
-@@ -1384,7 +1384,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
+@@ -1387,7 +1387,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41577,7 +41614,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
-@@ -1392,7 +1392,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
+@@ -1395,7 +1395,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  	return snprintf(buf, PAGE_SIZE, "%u\n",
@@ -41586,7 +41623,7 @@ index a40c05e..785c583 100644
  }
  
  static ssize_t edid_show(
-@@ -1449,10 +1449,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
+@@ -1452,10 +1452,10 @@ static ssize_t metrics_reset_store(struct device *fbdev,
  	struct fb_info *fb_info = dev_get_drvdata(fbdev);
  	struct dlfb_data *dev = fb_info->par;
  
@@ -41875,7 +41912,7 @@ index e95d1b6..3454244 100644
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
 diff --git a/fs/aio.c b/fs/aio.c
-index b9d64d8..86cb1d5 100644
+index 3b65ee7..aa6ec34 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -41887,7 +41924,7 @@ index b9d64d8..86cb1d5 100644
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1461,22 +1461,27 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
  static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  {
  	ssize_t ret;
@@ -41909,11 +41946,15 @@ index b9d64d8..86cb1d5 100644
  				&kiocb->ki_iovec, 1);
  	if (ret < 0)
  		goto out;
+@@ -1481,6 +1482,11 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+ 	if (ret < 0)
+ 		goto out;
  
 +	if (kiocb->ki_iovec == &iovstack) {
 +		kiocb->ki_inline_vec = iovstack;
 +		kiocb->ki_iovec = &kiocb->ki_inline_vec;
 +	}
++
  	kiocb->ki_nr_segs = kiocb->ki_nbytes;
  	kiocb->ki_cur_seg = 0;
  	/* ki_nbytes/left now reflect bytes instead of segs */
@@ -42960,10 +43001,10 @@ index 1bffbe0..c8c283e 100644
  			goto err;
  		}
 diff --git a/fs/bio.c b/fs/bio.c
-index b980ecd..74800bf 100644
+index 4fc4dbb..d3a5b93 100644
 --- a/fs/bio.c
 +++ b/fs/bio.c
-@@ -833,7 +833,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
+@@ -838,7 +838,7 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
  		/*
  		 * Overflow, abort
  		 */
@@ -42972,7 +43013,7 @@ index b980ecd..74800bf 100644
  			return ERR_PTR(-EINVAL);
  
  		nr_pages += end - start;
-@@ -1229,7 +1229,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
+@@ -1234,7 +1234,7 @@ static void bio_copy_kern_endio(struct bio *bio, int err)
  	const int read = bio_data_dir(bio) == READ;
  	struct bio_map_data *bmd = bio->bi_private;
  	int i;
@@ -42982,7 +43023,7 @@ index b980ecd..74800bf 100644
  	__bio_for_each_segment(bvec, bio, i, 0) {
  		char *addr = page_address(bvec->bv_page);
 diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 5e9f198..6bf9b1c 100644
+index 236dd6c..46c6530 100644
 --- a/fs/block_dev.c
 +++ b/fs/block_dev.c
 @@ -703,7 +703,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
@@ -44860,6 +44901,19 @@ index cb990b2..4820141 100644
  	trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
  
  	return 0;
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index f9d948f..8601f4b 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -161,6 +161,8 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size)
+ 	if (flex_gd == NULL)
+ 		goto out3;
+ 
++	if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data))
++		goto out2;
+ 	flex_gd->count = flexbg_size;
+ 
+ 	flex_gd->groups = kmalloc(sizeof(struct ext4_new_group_data) *
 diff --git a/fs/fcntl.c b/fs/fcntl.c
 index 22764c7..86372c9 100644
 --- a/fs/fcntl.c
@@ -60634,7 +60688,7 @@ index 84ccf8e..2e9b14c 100644
  };
  
 diff --git a/include/linux/fs.h b/include/linux/fs.h
-index f4b6e06..d6ba573 100644
+index fd65e0d..7232c62 100644
 --- a/include/linux/fs.h
 +++ b/include/linux/fs.h
 @@ -1628,7 +1628,8 @@ struct file_operations {
@@ -60730,7 +60784,7 @@ index c3da42d..c70e0df 100644
  int trace_set_clr_event(const char *system, const char *event, int set);
  
 diff --git a/include/linux/genhd.h b/include/linux/genhd.h
-index e61d319..0da8505 100644
+index 017a7fb..33a8507 100644
 --- a/include/linux/genhd.h
 +++ b/include/linux/genhd.h
 @@ -185,7 +185,7 @@ struct gendisk {
@@ -64527,10 +64581,10 @@ index 1c09820..7f5ec79 100644
  	TP_ARGS(irq, action, ret),
  
 diff --git a/include/video/udlfb.h b/include/video/udlfb.h
-index c41f308..6918de3 100644
+index f9466fa..f4e2b81 100644
 --- a/include/video/udlfb.h
 +++ b/include/video/udlfb.h
-@@ -52,10 +52,10 @@ struct dlfb_data {
+@@ -53,10 +53,10 @@ struct dlfb_data {
  	u32 pseudo_palette[256];
  	int blank_mode; /*one of FB_BLANK_ */
  	/* blit-only rendering path metrics, exposed through sysfs */
@@ -64881,7 +64935,7 @@ index 8216c30..25e8e32 100644
  	next_state = Reset;
  	return 0;
 diff --git a/init/main.c b/init/main.c
-index ff49a6d..5fa0429 100644
+index 45a7bf5..7ba1b61 100644
 --- a/init/main.c
 +++ b/init/main.c
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { }
@@ -64943,7 +64997,7 @@ index ff49a6d..5fa0429 100644
  static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -675,6 +720,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -672,6 +717,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
  {
  	int count = preempt_count();
  	int ret;
@@ -64951,7 +65005,7 @@ index ff49a6d..5fa0429 100644
  
  	if (initcall_debug)
  		ret = do_one_initcall_debug(fn);
-@@ -687,15 +733,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -684,15 +730,15 @@ int __init_or_module do_one_initcall(initcall_t fn)
  		sprintf(msgbuf, "error code %d ", ret);
  
  	if (preempt_count() != count) {
@@ -64971,7 +65025,7 @@ index ff49a6d..5fa0429 100644
  	}
  
  	return ret;
-@@ -814,7 +860,7 @@ static int __init kernel_init(void * unused)
+@@ -815,7 +861,7 @@ static int __init kernel_init(void * unused)
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -64980,7 +65034,7 @@ index ff49a6d..5fa0429 100644
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -827,11 +873,13 @@ static int __init kernel_init(void * unused)
+@@ -828,11 +874,13 @@ static int __init kernel_init(void * unused)
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -71159,10 +71213,10 @@ index 10b4dda..06857f3 100644
  	 * Make sure the vDSO gets into every core dump.
  	 * Dumping its contents makes post-mortem fully interpretable later
 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
-index 0a37570..2048346 100644
+index a8f97d5..e2ed444 100644
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
-@@ -640,6 +640,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+@@ -619,6 +619,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
  	unsigned long vmstart;
  	unsigned long vmend;
  
@@ -71173,15 +71227,15 @@ index 0a37570..2048346 100644
  	vma = find_vma(mm, start);
  	if (!vma || vma->vm_start > start)
  		return -EFAULT;
-@@ -679,6 +683,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
- 		err = policy_vma(vma, new_pol);
- 		if (err)
- 			goto out;
+@@ -672,6 +676,16 @@ static int mbind_range(struct mm_struct *mm, unsigned long start,
+ 			if (err)
+ 				goto out;
+ 		}
 +
 +#ifdef CONFIG_PAX_SEGMEXEC
 +		vma_m = pax_find_mirror_vma(vma);
-+		if (vma_m) {
-+			err = policy_vma(vma_m, new_pol);
++		if (vma_m && vma_m->vm_ops && vma_m->vm_ops->set_policy) {
++			err = vma_m->vm_ops->set_policy(vma_m, new_pol);
 +			if (err)
 +				goto out;
 +		}
@@ -71190,7 +71244,7 @@ index 0a37570..2048346 100644
  	}
  
   out:
-@@ -1112,6 +1126,17 @@ static long do_mbind(unsigned long start, unsigned long len,
+@@ -1105,6 +1119,17 @@ static long do_mbind(unsigned long start, unsigned long len,
  
  	if (end < start)
  		return -EINVAL;
@@ -71208,7 +71262,7 @@ index 0a37570..2048346 100644
  	if (end == start)
  		return 0;
  
-@@ -1330,6 +1355,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+@@ -1323,6 +1348,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
  	if (!mm)
  		goto out;
  
@@ -71223,7 +71277,7 @@ index 0a37570..2048346 100644
  	/*
  	 * Check if this process has the right to modify the specified
  	 * process. The right exists if the process has administrative
-@@ -1339,8 +1372,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
+@@ -1332,8 +1365,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode,
  	rcu_read_lock();
  	tcred = __task_cred(task);
  	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
@@ -74032,7 +74086,7 @@ index 14380e9..e244704 100644
  }
  
 diff --git a/mm/swapfile.c b/mm/swapfile.c
-index f31b29d..8bdcae2 100644
+index 099c209..7db7b6f 100644
 --- a/mm/swapfile.c
 +++ b/mm/swapfile.c
 @@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);

diff --git a/3.3.7/4430_grsec-remove-localversion-grsec.patch b/3.3.8/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.3.7/4430_grsec-remove-localversion-grsec.patch
rename to 3.3.8/4430_grsec-remove-localversion-grsec.patch

diff --git a/3.3.7/4435_grsec-mute-warnings.patch b/3.3.8/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.3.7/4435_grsec-mute-warnings.patch
rename to 3.3.8/4435_grsec-mute-warnings.patch

diff --git a/3.3.7/4440_grsec-remove-protected-paths.patch b/3.3.8/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.3.7/4440_grsec-remove-protected-paths.patch
rename to 3.3.8/4440_grsec-remove-protected-paths.patch

diff --git a/3.3.7/4445_grsec-pax-without-grsec.patch b/3.3.8/4445_grsec-pax-without-grsec.patch
similarity index 100%
rename from 3.3.7/4445_grsec-pax-without-grsec.patch
rename to 3.3.8/4445_grsec-pax-without-grsec.patch

diff --git a/3.3.7/4450_grsec-kconfig-default-gids.patch b/3.3.8/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.3.7/4450_grsec-kconfig-default-gids.patch
rename to 3.3.8/4450_grsec-kconfig-default-gids.patch

diff --git a/3.3.7/4455_grsec-kconfig-gentoo.patch b/3.3.8/4455_grsec-kconfig-gentoo.patch
similarity index 100%
rename from 3.3.7/4455_grsec-kconfig-gentoo.patch
rename to 3.3.8/4455_grsec-kconfig-gentoo.patch

diff --git a/3.3.7/4460-grsec-kconfig-proc-user.patch b/3.3.8/4460-grsec-kconfig-proc-user.patch
similarity index 100%
rename from 3.3.7/4460-grsec-kconfig-proc-user.patch
rename to 3.3.8/4460-grsec-kconfig-proc-user.patch

diff --git a/3.3.7/4465_selinux-avc_audit-log-curr_ip.patch b/3.3.8/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.3.7/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.3.8/4465_selinux-avc_audit-log-curr_ip.patch

diff --git a/3.3.7/4470_disable-compat_vdso.patch b/3.3.8/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.3.7/4470_disable-compat_vdso.patch
rename to 3.3.8/4470_disable-compat_vdso.patch