Grsec/PaX: 2.9.1-{2.6.32.60,3.2.44,3.8.10}-20130427191620130427

47 files changed, 5730 insertions, 4495 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index d04e223..2b44ed9 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch:	1059_linux-2.6.32.60.patch
 From:	http://www.kernel.org
 Desc:	Linux 2.6.32.59
 
-Patch:	4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch
+Patch:	4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
index 3224566..2f14145 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304181846.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304262205.patch
@@ -43603,7 +43603,7 @@ index bf2170f..ce8cab9 100644
  	acpi_os_unmap_memory(virt, len);
  	return 0;
 diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
-index 123cedf..6664cb4 100644
+index 123cedf..f7eebb9 100644
 --- a/drivers/char/tty_io.c
 +++ b/drivers/char/tty_io.c
 @@ -146,7 +146,7 @@ static int tty_open(struct inode *, struct file *);
@@ -43615,7 +43615,44 @@ index 123cedf..6664cb4 100644
  				unsigned long arg);
  #else
  #define tty_compat_ioctl NULL
-@@ -1774,6 +1774,7 @@ got_driver:
+@@ -856,6 +856,14 @@ void start_tty(struct tty_struct *tty)
+ 
+ EXPORT_SYMBOL(start_tty);
+ 
++static void tty_update_time(struct timespec *time)
++{
++	unsigned long sec = get_seconds();
++	sec -= sec % 60;
++	if ((long)(sec - time->tv_sec) > 0)
++		time->tv_sec = sec;
++}
++
+ /**
+  *	tty_read	-	read method for tty device files
+  *	@file: pointer to tty file
+@@ -894,8 +902,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ 	else
+ 		i = -EIO;
+ 	tty_ldisc_deref(ld);
++
+ 	if (i > 0)
+-		inode->i_atime = current_fs_time(inode->i_sb);
++		tty_update_time(&inode->i_atime);
++
+ 	return i;
+ }
+ 
+@@ -995,8 +1005,7 @@ static inline ssize_t do_tty_write(
+ 		cond_resched();
+ 	}
+ 	if (written) {
+-		struct inode *inode = file->f_path.dentry->d_inode;
+-		inode->i_mtime = current_fs_time(inode->i_sb);
++		tty_update_time(&file->f_dentry->d_inode->i_mtime);
+ 		ret = written;
+ 	}
+ out:
+@@ -1774,6 +1783,7 @@ got_driver:
  
  		if (IS_ERR(tty)) {
  			mutex_unlock(&tty_mutex);
@@ -43623,7 +43660,7 @@ index 123cedf..6664cb4 100644
  			return PTR_ERR(tty);
  		}
  	}
-@@ -2603,8 +2604,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -2603,8 +2613,10 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
  	return retval;
  }
  
@@ -43635,7 +43672,7 @@ index 123cedf..6664cb4 100644
  				unsigned long arg)
  {
  	struct inode *inode = file->f_dentry->d_inode;
-@@ -2628,6 +2631,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+@@ -2628,6 +2640,8 @@ static long tty_compat_ioctl(struct file *file, unsigned int cmd,
  
  	return retval;
  }
@@ -43644,7 +43681,7 @@ index 123cedf..6664cb4 100644
  #endif
  
  /*
-@@ -3073,7 +3078,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+@@ -3073,7 +3087,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
  
  void tty_default_fops(struct file_operations *fops)
  {
@@ -45733,7 +45770,7 @@ index b170071..28ae90e 100644
  		item->object = NULL;
  	}
 diff --git a/drivers/gpu/drm/ttm/ttm_memory.c b/drivers/gpu/drm/ttm/ttm_memory.c
-index 072c281..d8ef483 100644
+index 072c281a..d8ef483 100644
 --- a/drivers/gpu/drm/ttm/ttm_memory.c
 +++ b/drivers/gpu/drm/ttm/ttm_memory.c
 @@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_attrs[] = {
@@ -120907,7 +120944,7 @@ index 2f7ffa6..0455400 100644
  };
  
 diff --git a/security/security.c b/security/security.c
-index c4c6732..bc63d84 100644
+index c4c6732..5ee1542 100644
 --- a/security/security.c
 +++ b/security/security.c
 @@ -24,7 +24,7 @@ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1];
@@ -120935,7 +120972,7 @@ index c4c6732..bc63d84 100644
 +int security_capable_noaudit(int cap)
 +{
 +	return security_ops->capable(current, current_cred(), cap,
-+				     SECURITY_CAP_AUDIT);
++				     SECURITY_CAP_NOAUDIT);
 +}
 +
  int security_real_capable(struct task_struct *tsk, int cap)
diff --git a/3.2.43/0000_README b/3.2.44/0000_README
index 9450604..91b9efe 100644
--- a/3.2.43/0000_README
+++ b/3.2.44/0000_README
@@ -90,7 +90,11 @@ Patch:	1042_linux-3.2.43.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.43
 
-Patch:	4420_grsecurity-2.9.1-3.2.43-201304181907.patch
+Patch:	1043_linux-3.2.44.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.44
+
+Patch:	4420_grsecurity-2.9.1-3.2.44-201304271916.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.43/1021_linux-3.2.22.patch b/3.2.44/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.43/1021_linux-3.2.22.patch
+++ b/3.2.44/1021_linux-3.2.22.patch
diff --git a/3.2.43/1022_linux-3.2.23.patch b/3.2.44/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.43/1022_linux-3.2.23.patch
+++ b/3.2.44/1022_linux-3.2.23.patch
diff --git a/3.2.43/1023_linux-3.2.24.patch b/3.2.44/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.43/1023_linux-3.2.24.patch
+++ b/3.2.44/1023_linux-3.2.24.patch
diff --git a/3.2.43/1024_linux-3.2.25.patch b/3.2.44/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.43/1024_linux-3.2.25.patch
+++ b/3.2.44/1024_linux-3.2.25.patch
diff --git a/3.2.43/1025_linux-3.2.26.patch b/3.2.44/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.43/1025_linux-3.2.26.patch
+++ b/3.2.44/1025_linux-3.2.26.patch
diff --git a/3.2.43/1026_linux-3.2.27.patch b/3.2.44/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.43/1026_linux-3.2.27.patch
+++ b/3.2.44/1026_linux-3.2.27.patch
diff --git a/3.2.43/1027_linux-3.2.28.patch b/3.2.44/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.43/1027_linux-3.2.28.patch
+++ b/3.2.44/1027_linux-3.2.28.patch
diff --git a/3.2.43/1028_linux-3.2.29.patch b/3.2.44/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.43/1028_linux-3.2.29.patch
+++ b/3.2.44/1028_linux-3.2.29.patch
diff --git a/3.2.43/1029_linux-3.2.30.patch b/3.2.44/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.43/1029_linux-3.2.30.patch
+++ b/3.2.44/1029_linux-3.2.30.patch
diff --git a/3.2.43/1030_linux-3.2.31.patch b/3.2.44/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.43/1030_linux-3.2.31.patch
+++ b/3.2.44/1030_linux-3.2.31.patch
diff --git a/3.2.43/1031_linux-3.2.32.patch b/3.2.44/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.43/1031_linux-3.2.32.patch
+++ b/3.2.44/1031_linux-3.2.32.patch
diff --git a/3.2.43/1032_linux-3.2.33.patch b/3.2.44/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.43/1032_linux-3.2.33.patch
+++ b/3.2.44/1032_linux-3.2.33.patch
diff --git a/3.2.43/1033_linux-3.2.34.patch b/3.2.44/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.43/1033_linux-3.2.34.patch
+++ b/3.2.44/1033_linux-3.2.34.patch
diff --git a/3.2.43/1034_linux-3.2.35.patch b/3.2.44/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.43/1034_linux-3.2.35.patch
+++ b/3.2.44/1034_linux-3.2.35.patch
diff --git a/3.2.43/1035_linux-3.2.36.patch b/3.2.44/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.43/1035_linux-3.2.36.patch
+++ b/3.2.44/1035_linux-3.2.36.patch
diff --git a/3.2.43/1036_linux-3.2.37.patch b/3.2.44/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.43/1036_linux-3.2.37.patch
+++ b/3.2.44/1036_linux-3.2.37.patch
diff --git a/3.2.43/1037_linux-3.2.38.patch b/3.2.44/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.43/1037_linux-3.2.38.patch
+++ b/3.2.44/1037_linux-3.2.38.patch
diff --git a/3.2.43/1038_linux-3.2.39.patch b/3.2.44/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.43/1038_linux-3.2.39.patch
+++ b/3.2.44/1038_linux-3.2.39.patch
diff --git a/3.2.43/1039_linux-3.2.40.patch b/3.2.44/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.43/1039_linux-3.2.40.patch
+++ b/3.2.44/1039_linux-3.2.40.patch
diff --git a/3.2.43/1040_linux-3.2.41.patch b/3.2.44/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.43/1040_linux-3.2.41.patch
+++ b/3.2.44/1040_linux-3.2.41.patch
diff --git a/3.2.43/1041_linux-3.2.42.patch b/3.2.44/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.43/1041_linux-3.2.42.patch
+++ b/3.2.44/1041_linux-3.2.42.patch
diff --git a/3.2.43/1042_linux-3.2.43.patch b/3.2.44/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.43/1042_linux-3.2.43.patch
+++ b/3.2.44/1042_linux-3.2.43.patch
diff --git a/3.2.44/1043_linux-3.2.44.patch b/3.2.44/1043_linux-3.2.44.patch
new file mode 100644
index 0000000..3d5e6ff
--- /dev/null
+++ b/3.2.44/1043_linux-3.2.44.patch
@@ -0,0 +1,2808 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index ddbf18e..897f223 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -948,6 +948,20 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 	i8k.restricted	[HW] Allow controlling fans only if SYS_ADMIN
+ 			capability is set.
+ 
++	i915.invert_brightness=
++			[DRM] Invert the sense of the variable that is used to
++			set the brightness of the panel backlight. Normally a
++			brightness value of 0 indicates backlight switched off,
++			and the maximum of the brightness value sets the backlight
++			to maximum brightness. If this parameter is set to 0
++			(default) and the machine requires it, or this parameter
++			is set to 1, a brightness value of 0 sets the backlight
++			to maximum brightness, and the maximum of the brightness
++			value switches the backlight off.
++			-1 -- never invert brightness
++			 0 -- machine default
++			 1 -- force brightness inversion
++
+ 	icn=		[HW,ISDN]
+ 			Format: <io>[,<membase>[,<icn_id>[,<icn_id2>]]]
+ 
+diff --git a/Makefile b/Makefile
+index 59130db..566750c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 43
++SUBLEVEL = 44
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
+index 4112200..c52a8ef 100644
+--- a/arch/alpha/kernel/sys_nautilus.c
++++ b/arch/alpha/kernel/sys_nautilus.c
+@@ -189,6 +189,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
+ extern void free_reserved_mem(void *, void *);
+ extern void pcibios_claim_one_bus(struct pci_bus *);
+ 
++static struct resource irongate_io = {
++	.name	= "Irongate PCI IO",
++	.flags	= IORESOURCE_IO,
++};
+ static struct resource irongate_mem = {
+ 	.name	= "Irongate PCI MEM",
+ 	.flags	= IORESOURCE_MEM,
+@@ -210,6 +214,7 @@ nautilus_init_pci(void)
+ 
+ 	irongate = pci_get_bus_and_slot(0, 0);
+ 	bus->self = irongate;
++	bus->resource[0] = &irongate_io;
+ 	bus->resource[1] = &irongate_mem;
+ 
+ 	pci_bus_size_bridges(bus);
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index ecebb89..a559ee7 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -326,7 +326,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ 	struct hw_perf_event fake_event = event->hw;
+ 	struct pmu *leader_pmu = event->group_leader->pmu;
+ 
+-	if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++		return 1;
++
++	if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ 		return 1;
+ 
+ 	return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
+diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
+index e0b0e7a..09f8851 100644
+--- a/arch/arm/mm/cache-feroceon-l2.c
++++ b/arch/arm/mm/cache-feroceon-l2.c
+@@ -342,6 +342,7 @@ void __init feroceon_l2_init(int __l2_wt_override)
+ 	outer_cache.inv_range = feroceon_l2_inv_range;
+ 	outer_cache.clean_range = feroceon_l2_clean_range;
+ 	outer_cache.flush_range = feroceon_l2_flush_range;
++	outer_cache.inv_all = l2_inv_all;
+ 
+ 	enable_l2();
+ 
+diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
+index 88fb3d9..927a639 100644
+--- a/arch/arm/mm/proc-arm920.S
++++ b/arch/arm/mm/proc-arm920.S
+@@ -380,7 +380,7 @@ ENTRY(cpu_arm920_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl	cpu_arm920_suspend_size
+ .equ	cpu_arm920_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm920_do_suspend)
+ 	stmfd	sp!, {r4 - r6, lr}
+ 	mrc	p15, 0, r4, c13, c0, 0	@ PID
+diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
+index 9f8fd91..090f18f 100644
+--- a/arch/arm/mm/proc-arm926.S
++++ b/arch/arm/mm/proc-arm926.S
+@@ -395,7 +395,7 @@ ENTRY(cpu_arm926_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl	cpu_arm926_suspend_size
+ .equ	cpu_arm926_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm926_do_suspend)
+ 	stmfd	sp!, {r4 - r6, lr}
+ 	mrc	p15, 0, r4, c13, c0, 0	@ PID
+diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
+index 7d91545..6594aef 100644
+--- a/arch/arm/mm/proc-sa1100.S
++++ b/arch/arm/mm/proc-sa1100.S
+@@ -169,7 +169,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
+ 
+ .globl	cpu_sa1100_suspend_size
+ .equ	cpu_sa1100_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_sa1100_do_suspend)
+ 	stmfd	sp!, {r4 - r6, lr}
+ 	mrc	p15, 0, r4, c3, c0, 0		@ domain ID
+diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
+index d061d2f..8168d99 100644
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -129,7 +129,7 @@ ENTRY(cpu_v6_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
+ .globl	cpu_v6_suspend_size
+ .equ	cpu_v6_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_v6_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p15, 0, r4, c13, c0, 0	@ FCSE/PID
+diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
+index abf0507..5c4969d 100644
+--- a/arch/arm/mm/proc-xsc3.S
++++ b/arch/arm/mm/proc-xsc3.S
+@@ -407,7 +407,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
+ 
+ .globl	cpu_xsc3_suspend_size
+ .equ	cpu_xsc3_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xsc3_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
+diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
+index 3277904..b09d036 100644
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -521,7 +521,7 @@ ENTRY(cpu_xscale_set_pte_ext)
+ 
+ .globl	cpu_xscale_suspend_size
+ .equ	cpu_xscale_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xscale_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
+diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
+index dc36ea6..eb19b6c 100644
+--- a/arch/powerpc/platforms/pseries/lpar.c
++++ b/arch/powerpc/platforms/pseries/lpar.c
+@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
+ 					   (0x1UL << 4), &dummy1, &dummy2);
+ 		if (lpar_rc == H_SUCCESS)
+ 			return i;
+-		BUG_ON(lpar_rc != H_NOT_FOUND);
++
++		/*
++		 * The test for adjunct partition is performed before the
++		 * ANDCOND test.  H_RESOURCE may be returned, so we need to
++		 * check for that as well.
++		 */
++		BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
+ 
+ 		slot_offset++;
+ 		slot_offset &= 0x7;
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index b4973f4..cfb5a40 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -393,8 +393,8 @@ struct kvm_vcpu_arch {
+ 	gpa_t time;
+ 	struct pvclock_vcpu_time_info hv_clock;
+ 	unsigned int hw_tsc_khz;
+-	unsigned int time_offset;
+-	struct page *time_page;
++	struct gfn_to_hva_cache pv_time;
++	bool pv_time_enabled;
+ 
+ 	struct {
+ 		u64 msr_val;
+diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
+index a7d2db9..91e758b 100644
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -740,7 +740,10 @@ static inline void arch_leave_lazy_mmu_mode(void)
+ 	PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
+ }
+ 
+-void arch_flush_lazy_mmu_mode(void);
++static inline void arch_flush_lazy_mmu_mode(void)
++{
++	PVOP_VCALL0(pv_mmu_ops.lazy_mode.flush);
++}
+ 
+ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
+ 				phys_addr_t phys, pgprot_t flags)
+diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
+index 8e8b9a4..faf2c04 100644
+--- a/arch/x86/include/asm/paravirt_types.h
++++ b/arch/x86/include/asm/paravirt_types.h
+@@ -91,6 +91,7 @@ struct pv_lazy_ops {
+ 	/* Set deferred update mode, used for batching operations. */
+ 	void (*enter)(void);
+ 	void (*leave)(void);
++	void (*flush)(void);
+ };
+ 
+ struct pv_time_ops {
+@@ -680,6 +681,7 @@ void paravirt_end_context_switch(struct task_struct *next);
+ 
+ void paravirt_enter_lazy_mmu(void);
+ void paravirt_leave_lazy_mmu(void);
++void paravirt_flush_lazy_mmu(void);
+ 
+ void _paravirt_nop(void);
+ u32 _paravirt_ident_32(u32);
+diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
+index d90272e..84c938f 100644
+--- a/arch/x86/kernel/paravirt.c
++++ b/arch/x86/kernel/paravirt.c
+@@ -261,6 +261,18 @@ void paravirt_leave_lazy_mmu(void)
+ 	leave_lazy(PARAVIRT_LAZY_MMU);
+ }
+ 
++void paravirt_flush_lazy_mmu(void)
++{
++	preempt_disable();
++
++	if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
++		arch_leave_lazy_mmu_mode();
++		arch_enter_lazy_mmu_mode();
++	}
++
++	preempt_enable();
++}
++
+ void paravirt_start_context_switch(struct task_struct *prev)
+ {
+ 	BUG_ON(preemptible());
+@@ -290,18 +302,6 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
+ 	return percpu_read(paravirt_lazy_mode);
+ }
+ 
+-void arch_flush_lazy_mmu_mode(void)
+-{
+-	preempt_disable();
+-
+-	if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
+-		arch_leave_lazy_mmu_mode();
+-		arch_enter_lazy_mmu_mode();
+-	}
+-
+-	preempt_enable();
+-}
+-
+ struct pv_info pv_info = {
+ 	.name = "bare hardware",
+ 	.paravirt_enabled = 0,
+@@ -475,6 +475,7 @@ struct pv_mmu_ops pv_mmu_ops = {
+ 	.lazy_mode = {
+ 		.enter = paravirt_nop,
+ 		.leave = paravirt_nop,
++		.flush = paravirt_nop,
+ 	},
+ 
+ 	.set_fixmap = native_set_fixmap,
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f4063fd..e82a53a 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1105,7 +1105,6 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ {
+ 	unsigned long flags;
+ 	struct kvm_vcpu_arch *vcpu = &v->arch;
+-	void *shared_kaddr;
+ 	unsigned long this_tsc_khz;
+ 	s64 kernel_ns, max_kernel_ns;
+ 	u64 tsc_timestamp;
+@@ -1141,7 +1140,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ 
+ 	local_irq_restore(flags);
+ 
+-	if (!vcpu->time_page)
++	if (!vcpu->pv_time_enabled)
+ 		return 0;
+ 
+ 	/*
+@@ -1199,14 +1198,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ 	 */
+ 	vcpu->hv_clock.version += 2;
+ 
+-	shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0);
+-
+-	memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
+-	       sizeof(vcpu->hv_clock));
+-
+-	kunmap_atomic(shared_kaddr, KM_USER0);
+-
+-	mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
++	kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
++				&vcpu->hv_clock,
++				sizeof(vcpu->hv_clock));
+ 	return 0;
+ }
+ 
+@@ -1486,7 +1480,8 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ 		return 0;
+ 	}
+ 
+-	if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa))
++	if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
++					sizeof(u32)))
+ 		return 1;
+ 
+ 	vcpu->arch.apf.send_user_only = !(data & KVM_ASYNC_PF_SEND_ALWAYS);
+@@ -1496,10 +1491,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ 
+ static void kvmclock_reset(struct kvm_vcpu *vcpu)
+ {
+-	if (vcpu->arch.time_page) {
+-		kvm_release_page_dirty(vcpu->arch.time_page);
+-		vcpu->arch.time_page = NULL;
+-	}
++	vcpu->arch.pv_time_enabled = false;
+ }
+ 
+ static void accumulate_steal_time(struct kvm_vcpu *vcpu)
+@@ -1591,6 +1583,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ 		break;
+ 	case MSR_KVM_SYSTEM_TIME_NEW:
+ 	case MSR_KVM_SYSTEM_TIME: {
++		u64 gpa_offset;
+ 		kvmclock_reset(vcpu);
+ 
+ 		vcpu->arch.time = data;
+@@ -1600,16 +1593,14 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ 		if (!(data & 1))
+ 			break;
+ 
+-		/* ...but clean it before doing the actual write */
+-		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
++		gpa_offset = data & ~(PAGE_MASK | 1);
+ 
+-		vcpu->arch.time_page =
+-				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
+-
+-		if (is_error_page(vcpu->arch.time_page)) {
+-			kvm_release_page_clean(vcpu->arch.time_page);
+-			vcpu->arch.time_page = NULL;
+-		}
++		if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
++		     &vcpu->arch.pv_time, data & ~1ULL,
++		     sizeof(struct pvclock_vcpu_time_info)))
++			vcpu->arch.pv_time_enabled = false;
++		else
++			vcpu->arch.pv_time_enabled = true;
+ 		break;
+ 	}
+ 	case MSR_KVM_ASYNC_PF_EN:
+@@ -1625,7 +1616,8 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ 			return 1;
+ 
+ 		if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
+-							data & KVM_STEAL_VALID_BITS))
++						data & KVM_STEAL_VALID_BITS,
++						sizeof(struct kvm_steal_time)))
+ 			return 1;
+ 
+ 		vcpu->arch.st.msr_val = data;
+@@ -6549,6 +6541,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ 	if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask, GFP_KERNEL))
+ 		goto fail_free_mce_banks;
+ 
++	vcpu->arch.pv_time_enabled = false;
+ 	kvm_async_pf_hash_reset(vcpu);
+ 
+ 	return 0;
+diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
+index cf4603b..8f4fda4 100644
+--- a/arch/x86/lguest/boot.c
++++ b/arch/x86/lguest/boot.c
+@@ -1328,6 +1328,7 @@ __init void lguest_init(void)
+ 	pv_mmu_ops.read_cr3 = lguest_read_cr3;
+ 	pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
+ 	pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mmu_mode;
++	pv_mmu_ops.lazy_mode.flush = paravirt_flush_lazy_mmu;
+ 	pv_mmu_ops.pte_update = lguest_pte_update;
+ 	pv_mmu_ops.pte_update_defer = lguest_pte_update;
+ 
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 7b73c88..53a7b69 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -377,10 +377,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
+ 	if (pgd_none(*pgd_ref))
+ 		return -1;
+ 
+-	if (pgd_none(*pgd))
++	if (pgd_none(*pgd)) {
+ 		set_pgd(pgd, *pgd_ref);
+-	else
++		arch_flush_lazy_mmu_mode();
++	} else {
+ 		BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
++	}
+ 
+ 	/*
+ 	 * Below here mismatches are bugs because these lower tables
+diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
+index 2b8b0de..fe00be6 100644
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -2079,6 +2079,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
+ 	.lazy_mode = {
+ 		.enter = paravirt_enter_lazy_mmu,
+ 		.leave = xen_leave_lazy_mmu,
++		.flush = paravirt_flush_lazy_mmu,
+ 	},
+ 
+ 	.set_fixmap = xen_set_fixmap,
+diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
+index f0b2ca8..1789e7a 100644
+--- a/block/blk-sysfs.c
++++ b/block/blk-sysfs.c
+@@ -200,6 +200,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
+ 	unsigned long val;						\
+ 	ssize_t ret;							\
+ 	ret = queue_var_store(&val, page, count);			\
++	if (ret < 0)							\
++		 return ret;						\
+ 	if (neg)							\
+ 		val = !val;						\
+ 									\
+diff --git a/crypto/gcm.c b/crypto/gcm.c
+index 1a25263..b97b186 100644
+--- a/crypto/gcm.c
++++ b/crypto/gcm.c
+@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
+ 
+ struct crypto_rfc4543_req_ctx {
+ 	u8 auth_tag[16];
++	u8 assocbuf[32];
+ 	struct scatterlist cipher[1];
+ 	struct scatterlist payload[2];
+ 	struct scatterlist assoc[2];
+@@ -1142,9 +1143,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
+ 	scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
+ 	assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
+ 
+-	sg_init_table(assoc, 2);
+-	sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
+-		    req->assoc->offset);
++	if (req->assoc->length == req->assoclen) {
++		sg_init_table(assoc, 2);
++		sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
++			    req->assoc->offset);
++	} else {
++		BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
++
++		scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
++					 req->assoclen, 0);
++
++		sg_init_table(assoc, 2);
++		sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
++	}
+ 	scatterwalk_crypto_chain(assoc, payload, 0, 2);
+ 
+ 	aead_request_set_tfm(subreq, ctx->child);
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index df47397..ddfc1c1 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -150,6 +150,7 @@ enum piix_controller_ids {
+ 	tolapai_sata,
+ 	piix_pata_vmw,			/* PIIX4 for VMware, spurious DMA_ERR */
+ 	ich8_sata_snb,
++	ich8_2port_sata_snb,
+ };
+ 
+ struct piix_map_db {
+@@ -326,7 +327,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ 	/* SATA Controller IDE (Lynx Point) */
+ 	{ 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ 	/* SATA Controller IDE (Lynx Point) */
+-	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
+ 	/* SATA Controller IDE (Lynx Point) */
+ 	{ 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
+ 	/* SATA Controller IDE (Lynx Point-LP) */
+@@ -519,6 +520,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
+ 	[ich8m_apple_sata]	= &ich8m_apple_map_db,
+ 	[tolapai_sata]		= &tolapai_map_db,
+ 	[ich8_sata_snb]		= &ich8_map_db,
++	[ich8_2port_sata_snb]	= &ich8_2port_map_db,
+ };
+ 
+ static struct ata_port_info piix_port_info[] = {
+@@ -660,6 +662,16 @@ static struct ata_port_info piix_port_info[] = {
+ 		.port_ops	= &piix_sata_ops,
+ 	},
+ 
++	[ich8_2port_sata_snb] =
++	{
++		.flags		= PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
++					| PIIX_FLAG_PIO16,
++		.pio_mask	= ATA_PIO4,
++		.mwdma_mask	= ATA_MWDMA2,
++		.udma_mask	= ATA_UDMA6,
++		.port_ops	= &piix_sata_ops,
++	},
++
+ };
+ 
+ static struct pci_bits piix_enable_bits[] = {
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index c9540c0..288b635 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -2401,6 +2401,9 @@ int ata_dev_configure(struct ata_device *dev)
+ 		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
+ 					 dev->max_sectors);
+ 
++	if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
++		dev->max_sectors = ATA_MAX_SECTORS_LBA48;
++
+ 	if (ap->ops->dev_config)
+ 		ap->ops->dev_config(dev);
+ 
+@@ -4057,6 +4060,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ 	/* Weird ATAPI devices */
+ 	{ "TORiSAN DVD-ROM DRD-N216", NULL,	ATA_HORKAGE_MAX_SEC_128 },
+ 	{ "QUANTUM DAT    DAT72-000", NULL,	ATA_HORKAGE_ATAPI_MOD16_DMA },
++	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
+ 
+ 	/* Devices we expect to fail diagnostics */
+ 
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index 012a9d2..144d37c 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -274,6 +274,7 @@ enum intel_pch {
+ 
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
++#define QUIRK_INVERT_BRIGHTNESS (1<<2)
+ 
+ struct intel_fbdev;
+ struct intel_fbc_work;
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 17961df..897ca06 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -25,6 +25,7 @@
+  */
+ 
+ #include <linux/cpufreq.h>
++#include <linux/dmi.h>
+ #include <linux/module.h>
+ #include <linux/input.h>
+ #include <linux/i2c.h>
+@@ -8831,6 +8832,16 @@ static void quirk_ssc_force_disable(struct drm_device *dev)
+ 	dev_priv->quirks |= QUIRK_LVDS_SSC_DISABLE;
+ }
+ 
++/*
++ * A machine (e.g. Acer Aspire 5734Z) may need to invert the panel backlight
++ * brightness value
++ */
++static void quirk_invert_brightness(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	dev_priv->quirks |= QUIRK_INVERT_BRIGHTNESS;
++}
++
+ struct intel_quirk {
+ 	int device;
+ 	int subsystem_vendor;
+@@ -8838,6 +8849,34 @@ struct intel_quirk {
+ 	void (*hook)(struct drm_device *dev);
+ };
+ 
++/* For systems that don't have a meaningful PCI subdevice/subvendor ID */
++struct intel_dmi_quirk {
++	void (*hook)(struct drm_device *dev);
++	const struct dmi_system_id (*dmi_id_list)[];
++};
++
++static int intel_dmi_reverse_brightness(const struct dmi_system_id *id)
++{
++	DRM_INFO("Backlight polarity reversed on %s\n", id->ident);
++	return 1;
++}
++
++static const struct intel_dmi_quirk intel_dmi_quirks[] = {
++	{
++		.dmi_id_list = &(const struct dmi_system_id[]) {
++			{
++				.callback = intel_dmi_reverse_brightness,
++				.ident = "NCR Corporation",
++				.matches = {DMI_MATCH(DMI_SYS_VENDOR, "NCR Corporation"),
++					    DMI_MATCH(DMI_PRODUCT_NAME, ""),
++				},
++			},
++			{ }  /* terminating entry */
++		},
++		.hook = quirk_invert_brightness,
++	},
++};
++
+ struct intel_quirk intel_quirks[] = {
+ 	/* HP Compaq 2730p needs pipe A force quirk (LP: #291555) */
+ 	{ 0x2a42, 0x103c, 0x30eb, quirk_pipea_force },
+@@ -8865,6 +8904,18 @@ struct intel_quirk intel_quirks[] = {
+ 
+ 	/* Sony Vaio Y cannot use SSC on LVDS */
+ 	{ 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
++
++	/* Acer Aspire 5734Z must invert backlight brightness */
++	{ 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
++
++	/* Acer/eMachines G725 */
++	{ 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
++
++	/* Acer/eMachines e725 */
++	{ 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
++
++	/* Acer/Packard Bell NCL20 */
++	{ 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+ };
+ 
+ static void intel_init_quirks(struct drm_device *dev)
+@@ -8882,6 +8933,10 @@ static void intel_init_quirks(struct drm_device *dev)
+ 		     q->subsystem_device == PCI_ANY_ID))
+ 			q->hook(dev);
+ 	}
++	for (i = 0; i < ARRAY_SIZE(intel_dmi_quirks); i++) {
++		if (dmi_check_system(*intel_dmi_quirks[i].dmi_id_list) != 0)
++			intel_dmi_quirks[i].hook(dev);
++	}
+ }
+ 
+ /* Disable the VGA plane that we never use */
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 04d79fd..72b8949 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -28,6 +28,7 @@
+  *      Chris Wilson <chris@chris-wilson.co.uk>
+  */
+ 
++#include <linux/moduleparam.h>
+ #include "intel_drv.h"
+ 
+ #define PCI_LBPC 0xf4 /* legacy/combination backlight modes */
+@@ -191,6 +192,27 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
+ 	return max;
+ }
+ 
++static int i915_panel_invert_brightness;
++MODULE_PARM_DESC(invert_brightness, "Invert backlight brightness "
++	"(-1 force normal, 0 machine defaults, 1 force inversion), please "
++	"report PCI device ID, subsystem vendor and subsystem device ID "
++	"to dri-devel@lists.freedesktop.org, if your machine needs it. "
++	"It will then be included in an upcoming module version.");
++module_param_named(invert_brightness, i915_panel_invert_brightness, int, 0600);
++static u32 intel_panel_compute_brightness(struct drm_device *dev, u32 val)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++
++	if (i915_panel_invert_brightness < 0)
++		return val;
++
++	if (i915_panel_invert_brightness > 0 ||
++	    dev_priv->quirks & QUIRK_INVERT_BRIGHTNESS)
++		return intel_panel_get_max_backlight(dev) - val;
++
++	return val;
++}
++
+ u32 intel_panel_get_backlight(struct drm_device *dev)
+ {
+ 	struct drm_i915_private *dev_priv = dev->dev_private;
+@@ -211,6 +233,7 @@ u32 intel_panel_get_backlight(struct drm_device *dev)
+ 		}
+ 	}
+ 
++	val = intel_panel_compute_brightness(dev, val);
+ 	DRM_DEBUG_DRIVER("get backlight PWM = %d\n", val);
+ 	return val;
+ }
+@@ -228,6 +251,7 @@ static void intel_panel_actually_set_backlight(struct drm_device *dev, u32 level
+ 	u32 tmp;
+ 
+ 	DRM_DEBUG_DRIVER("set backlight PWM = %d\n", level);
++	level = intel_panel_compute_brightness(dev, level);
+ 
+ 	if (HAS_PCH_SPLIT(dev))
+ 		return intel_pch_panel_set_backlight(dev, level);
+diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
+index 58434e8..37fe246 100644
+--- a/drivers/gpu/vga/vga_switcheroo.c
++++ b/drivers/gpu/vga/vga_switcheroo.c
+@@ -26,6 +26,7 @@
+ #include <linux/fb.h>
+ 
+ #include <linux/pci.h>
++#include <linux/console.h>
+ #include <linux/vga_switcheroo.h>
+ 
+ struct vga_switcheroo_client {
+@@ -256,8 +257,10 @@ static int vga_switchto_stage2(struct vga_switcheroo_client *new_client)
+ 
+ 	if (new_client->fb_info) {
+ 		struct fb_event event;
++		console_lock();
+ 		event.info = new_client->fb_info;
+ 		fb_notifier_call_chain(FB_EVENT_REMAP_ALL_CONSOLE, &event);
++		console_unlock();
+ 	}
+ 
+ 	ret = vgasr_priv.handler->switchto(new_client->id);
+diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
+index 1201a15..08e7e72 100644
+--- a/drivers/hwspinlock/hwspinlock_core.c
++++ b/drivers/hwspinlock/hwspinlock_core.c
+@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
+ 	ret = pm_runtime_get_sync(dev);
+ 	if (ret < 0) {
+ 		dev_err(dev, "%s: can't power on device\n", __func__);
++		pm_runtime_put_noidle(dev);
++		module_put(dev->driver->owner);
+ 		return ret;
+ 	}
+ 
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index e7dc732..1d90e26 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -1154,7 +1154,11 @@ static int mtd_mmap(struct file *file, struct vm_area_struct *vma)
+ 	unsigned long off;
+ 	u32 len;
+ 
+-	if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
++        /* This is broken because it assumes the MTD device is map-based
++	   and that mtd->priv is a valid struct map_info.  It should be
++	   replaced with something that uses the mtd_get_unmapped_area()
++	   operation properly. */
++	if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
+ 		off = vma->vm_pgoff << PAGE_SHIFT;
+ 		start = map->phys;
+ 		len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
+diff --git a/drivers/net/can/sja1000/sja1000_of_platform.c b/drivers/net/can/sja1000/sja1000_of_platform.c
+index c3dd9d0..1ee5f0c 100644
+--- a/drivers/net/can/sja1000/sja1000_of_platform.c
++++ b/drivers/net/can/sja1000/sja1000_of_platform.c
+@@ -94,8 +94,8 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev)
+ 	struct net_device *dev;
+ 	struct sja1000_priv *priv;
+ 	struct resource res;
+-	const u32 *prop;
+-	int err, irq, res_size, prop_size;
++	u32 prop;
++	int err, irq, res_size;
+ 	void __iomem *base;
+ 
+ 	err = of_address_to_resource(np, 0, &res);
+@@ -136,27 +136,27 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev)
+ 	priv->read_reg = sja1000_ofp_read_reg;
+ 	priv->write_reg = sja1000_ofp_write_reg;
+ 
+-	prop = of_get_property(np, "nxp,external-clock-frequency", &prop_size);
+-	if (prop && (prop_size ==  sizeof(u32)))
+-		priv->can.clock.freq = *prop / 2;
++	err = of_property_read_u32(np, "nxp,external-clock-frequency", &prop);
++	if (!err)
++		priv->can.clock.freq = prop / 2;
+ 	else
+ 		priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */
+ 
+-	prop = of_get_property(np, "nxp,tx-output-mode", &prop_size);
+-	if (prop && (prop_size == sizeof(u32)))
+-		priv->ocr |= *prop & OCR_MODE_MASK;
++	err = of_property_read_u32(np, "nxp,tx-output-mode", &prop);
++	if (!err)
++		priv->ocr |= prop & OCR_MODE_MASK;
+ 	else
+ 		priv->ocr |= OCR_MODE_NORMAL; /* default */
+ 
+-	prop = of_get_property(np, "nxp,tx-output-config", &prop_size);
+-	if (prop && (prop_size == sizeof(u32)))
+-		priv->ocr |= (*prop << OCR_TX_SHIFT) & OCR_TX_MASK;
++	err = of_property_read_u32(np, "nxp,tx-output-config", &prop);
++	if (!err)
++		priv->ocr |= (prop << OCR_TX_SHIFT) & OCR_TX_MASK;
+ 	else
+ 		priv->ocr |= OCR_TX0_PULLDOWN; /* default */
+ 
+-	prop = of_get_property(np, "nxp,clock-out-frequency", &prop_size);
+-	if (prop && (prop_size == sizeof(u32)) && *prop) {
+-		u32 divider = priv->can.clock.freq * 2 / *prop;
++	err = of_property_read_u32(np, "nxp,clock-out-frequency", &prop);
++	if (!err && prop) {
++		u32 divider = priv->can.clock.freq * 2 / prop;
+ 
+ 		if (divider > 1)
+ 			priv->cdr |= divider / 2 - 1;
+@@ -166,8 +166,7 @@ static int __devinit sja1000_ofp_probe(struct platform_device *ofdev)
+ 		priv->cdr |= CDR_CLK_OFF; /* default */
+ 	}
+ 
+-	prop = of_get_property(np, "nxp,no-comparator-bypass", NULL);
+-	if (!prop)
++	if (!of_property_read_bool(np, "nxp,no-comparator-bypass"))
+ 		priv->cdr |= CDR_CBP; /* default */
+ 
+ 	priv->irq_flags = IRQF_SHARED;
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index a6153f1..d812790 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -3516,6 +3516,30 @@ static void __devinit rtl_init_mdio_ops(struct rtl8169_private *tp)
+ 	}
+ }
+ 
++static void rtl_speed_down(struct rtl8169_private *tp)
++{
++	u32 adv;
++	int lpa;
++
++	rtl_writephy(tp, 0x1f, 0x0000);
++	lpa = rtl_readphy(tp, MII_LPA);
++
++	if (lpa & (LPA_10HALF | LPA_10FULL))
++		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full;
++	else if (lpa & (LPA_100HALF | LPA_100FULL))
++		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
++		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full;
++	else
++		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
++		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full |
++		      (tp->mii.supports_gmii ?
++		       ADVERTISED_1000baseT_Half |
++		       ADVERTISED_1000baseT_Full : 0);
++
++	rtl8169_set_speed(tp->dev, AUTONEG_ENABLE, SPEED_1000, DUPLEX_FULL,
++			  adv);
++}
++
+ static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+ {
+ 	void __iomem *ioaddr = tp->mmio_addr;
+@@ -3541,9 +3565,7 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+ 	if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
+ 		return false;
+ 
+-	rtl_writephy(tp, 0x1f, 0x0000);
+-	rtl_writephy(tp, MII_BMCR, 0x0000);
+-
++	rtl_speed_down(tp);
+ 	rtl_wol_suspend_quirk(tp);
+ 
+ 	return true;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+index 06b3f0d..c16bea4 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+@@ -648,7 +648,7 @@ static const u32 ar9580_1p0_mac_core[][2] = {
+ 	{0x00008258, 0x00000000},
+ 	{0x0000825c, 0x40000000},
+ 	{0x00008260, 0x00080922},
+-	{0x00008264, 0x9bc00010},
++	{0x00008264, 0x9d400010},
+ 	{0x00008268, 0xffffffff},
+ 	{0x0000826c, 0x0000ffff},
+ 	{0x00008270, 0x00000000},
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 966661c..84890d5 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -801,7 +801,7 @@ static int ath9k_init_firmware_version(struct ath9k_htc_priv *priv)
+ 	 * required version.
+ 	 */
+ 	if (priv->fw_version_major != MAJOR_VERSION_REQ ||
+-	    priv->fw_version_minor != MINOR_VERSION_REQ) {
++	    priv->fw_version_minor < MINOR_VERSION_REQ) {
+ 		dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
+ 			MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
+ 		return -EINVAL;
+diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
+index 17148bb..10fe07d 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
++++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
+@@ -52,8 +52,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
+ 		udelay(REGISTER_BUSY_DELAY);
+ 	}
+ 
+-	ERROR(rt2x00dev, "Indirect register access failed: "
+-	      "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
++	printk_once(KERN_ERR "%s() Indirect register access failed: "
++	      "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
+ 	*reg = ~0;
+ 
+ 	return 0;
+diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
+index 2264331..b96766b 100644
+--- a/drivers/platform/x86/msi-wmi.c
++++ b/drivers/platform/x86/msi-wmi.c
+@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, void *context)
+ 				pr_debug("Suppressed key event 0x%X - "
+ 					 "Last press was %lld us ago\n",
+ 					 key->code, ktime_to_us(diff));
+-				return;
++				goto msi_wmi_notify_exit;
+ 			}
+ 			last_pressed[key->code - SCANCODE_BASE] = cur;
+ 
+@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, void *context)
+ 			pr_info("Unknown key pressed - %x\n", eventcode);
+ 	} else
+ 		pr_info("Unknown event received\n");
++
++msi_wmi_notify_exit:
+ 	kfree(response.pointer);
+ }
+ 
+diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
+index 0364ca2..d5f4eb8 100644
+--- a/drivers/target/target_core_alua.c
++++ b/drivers/target/target_core_alua.c
+@@ -393,8 +393,9 @@ static inline int core_alua_state_standby(
+ 	case REPORT_LUNS:
+ 	case RECEIVE_DIAGNOSTIC:
+ 	case SEND_DIAGNOSTIC:
++		return 0;
+ 	case MAINTENANCE_IN:
+-		switch (cdb[1]) {
++		switch (cdb[1] & 0x1f) {
+ 		case MI_REPORT_TARGET_PGS:
+ 			return 0;
+ 		default:
+@@ -435,8 +436,9 @@ static inline int core_alua_state_unavailable(
+ 	switch (cdb[0]) {
+ 	case INQUIRY:
+ 	case REPORT_LUNS:
++		return 0;
+ 	case MAINTENANCE_IN:
+-		switch (cdb[1]) {
++		switch (cdb[1] & 0x1f) {
+ 		case MI_REPORT_TARGET_PGS:
+ 			return 0;
+ 		default:
+@@ -475,8 +477,9 @@ static inline int core_alua_state_transition(
+ 	switch (cdb[0]) {
+ 	case INQUIRY:
+ 	case REPORT_LUNS:
++		return 0;
+ 	case MAINTENANCE_IN:
+-		switch (cdb[1]) {
++		switch (cdb[1] & 0x1f) {
+ 		case MI_REPORT_TARGET_PGS:
+ 			return 0;
+ 		default:
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 9176b2e..898c1de 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -1445,6 +1445,7 @@ static inline void transport_generic_prepare_cdb(
+ 	case VERIFY_16: /* SBC - VRProtect */
+ 	case WRITE_VERIFY: /* SBC - VRProtect */
+ 	case WRITE_VERIFY_12: /* SBC - VRProtect */
++	case MAINTENANCE_IN: /* SPC - Parameter Data Format for SA RTPG */
+ 		break;
+ 	default:
+ 		cdb[1] &= 0x1f; /* clear logical unit number */
+@@ -2683,7 +2684,7 @@ static int transport_generic_cmd_sequencer(
+ 			/*
+ 			 * Check for emulated MI_REPORT_TARGET_PGS.
+ 			 */
+-			if (cdb[1] == MI_REPORT_TARGET_PGS &&
++			if ((cdb[1] & 0x1f) == MI_REPORT_TARGET_PGS &&
+ 			    su_dev->t10_alua.alua_type == SPC3_ALUA_EMULATED) {
+ 				cmd->execute_task =
+ 					target_emulate_report_target_port_groups;
+diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
+index dd9a574..f6fb292 100644
+--- a/drivers/thermal/thermal_sys.c
++++ b/drivers/thermal/thermal_sys.c
+@@ -1399,6 +1399,7 @@ static int __init thermal_init(void)
+ 		idr_destroy(&thermal_cdev_idr);
+ 		mutex_destroy(&thermal_idr_lock);
+ 		mutex_destroy(&thermal_list_lock);
++		return result;
+ 	}
+ 	result = genetlink_init();
+ 	return result;
+diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
+index 18e875b..3ca6c0d 100644
+--- a/drivers/usb/serial/ark3116.c
++++ b/drivers/usb/serial/ark3116.c
+@@ -68,7 +68,6 @@ static int is_irda(struct usb_serial *serial)
+ }
+ 
+ struct ark3116_private {
+-	wait_queue_head_t       delta_msr_wait;
+ 	struct async_icount	icount;
+ 	int			irda;	/* 1 for irda device */
+ 
+@@ -148,7 +147,6 @@ static int ark3116_attach(struct usb_serial *serial)
+ 	if (!priv)
+ 		return -ENOMEM;
+ 
+-	init_waitqueue_head(&priv->delta_msr_wait);
+ 	mutex_init(&priv->hw_lock);
+ 	spin_lock_init(&priv->status_lock);
+ 
+@@ -460,10 +458,14 @@ static int ark3116_ioctl(struct tty_struct *tty,
+ 	case TIOCMIWAIT:
+ 		for (;;) {
+ 			struct async_icount prev = priv->icount;
+-			interruptible_sleep_on(&priv->delta_msr_wait);
++			interruptible_sleep_on(&port->delta_msr_wait);
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			if ((prev.rng == priv->icount.rng) &&
+ 			    (prev.dsr == priv->icount.dsr) &&
+ 			    (prev.dcd == priv->icount.dcd) &&
+@@ -584,7 +586,7 @@ static void ark3116_update_msr(struct usb_serial_port *port, __u8 msr)
+ 			priv->icount.dcd++;
+ 		if (msr & UART_MSR_TERI)
+ 			priv->icount.rng++;
+-		wake_up_interruptible(&priv->delta_msr_wait);
++		wake_up_interruptible(&port->delta_msr_wait);
+ 	}
+ }
+ 
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 6ae1c06..c4d95b0 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -82,7 +82,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
+ 
+ struct ch341_private {
+ 	spinlock_t lock; /* access lock */
+-	wait_queue_head_t delta_msr_wait; /* wait queue for modem status */
+ 	unsigned baud_rate; /* set baud rate */
+ 	u8 line_control; /* set line control value RTS/DTR */
+ 	u8 line_status; /* active status of modem control inputs */
+@@ -262,7 +261,6 @@ static int ch341_attach(struct usb_serial *serial)
+ 		return -ENOMEM;
+ 
+ 	spin_lock_init(&priv->lock);
+-	init_waitqueue_head(&priv->delta_msr_wait);
+ 	priv->baud_rate = DEFAULT_BAUD_RATE;
+ 	priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
+ 
+@@ -299,7 +297,7 @@ static void ch341_dtr_rts(struct usb_serial_port *port, int on)
+ 		priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 	ch341_set_handshake(port->serial->dev, priv->line_control);
+-	wake_up_interruptible(&priv->delta_msr_wait);
++	wake_up_interruptible(&port->delta_msr_wait);
+ }
+ 
+ static void ch341_close(struct usb_serial_port *port)
+@@ -503,7 +501,7 @@ static void ch341_read_int_callback(struct urb *urb)
+ 			tty_kref_put(tty);
+ 		}
+ 
+-		wake_up_interruptible(&priv->delta_msr_wait);
++		wake_up_interruptible(&port->delta_msr_wait);
+ 	}
+ 
+ exit:
+@@ -529,11 +527,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+ 	while (!multi_change) {
+-		interruptible_sleep_on(&priv->delta_msr_wait);
++		interruptible_sleep_on(&port->delta_msr_wait);
+ 		/* see if a signal did it */
+ 		if (signal_pending(current))
+ 			return -ERESTARTSYS;
+ 
++		if (port->serial->disconnected)
++			return -EIO;
++
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		status = priv->line_status;
+ 		multi_change = priv->multi_status_change;
+diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
+index d9906eb..01a44d3 100644
+--- a/drivers/usb/serial/cypress_m8.c
++++ b/drivers/usb/serial/cypress_m8.c
+@@ -150,7 +150,6 @@ struct cypress_private {
+ 	int baud_rate;			   /* stores current baud rate in
+ 					      integer form */
+ 	int isthrottled;		   /* if throttled, discard reads */
+-	wait_queue_head_t delta_msr_wait;  /* used for TIOCMIWAIT */
+ 	char prev_status, diff_status;	   /* used for TIOCMIWAIT */
+ 	/* we pass a pointer to this as the argument sent to
+ 	   cypress_set_termios old_termios */
+@@ -488,7 +487,6 @@ static int generic_startup(struct usb_serial *serial)
+ 		kfree(priv);
+ 		return -ENOMEM;
+ 	}
+-	init_waitqueue_head(&priv->delta_msr_wait);
+ 
+ 	usb_reset_configuration(serial->dev);
+ 
+@@ -928,12 +926,16 @@ static int cypress_ioctl(struct tty_struct *tty,
+ 	switch (cmd) {
+ 	/* This code comes from drivers/char/serial.c and ftdi_sio.c */
+ 	case TIOCMIWAIT:
+-		while (priv != NULL) {
+-			interruptible_sleep_on(&priv->delta_msr_wait);
++		for (;;) {
++			interruptible_sleep_on(&port->delta_msr_wait);
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
+-			else {
++
++			if (port->serial->disconnected)
++				return -EIO;
++
++			{
+ 				char diff = priv->diff_status;
+ 				if (diff == 0)
+ 					return -EIO; /* no change => error */
+@@ -1261,7 +1263,7 @@ static void cypress_read_int_callback(struct urb *urb)
+ 	if (priv->current_status != priv->prev_status) {
+ 		priv->diff_status |= priv->current_status ^
+ 			priv->prev_status;
+-		wake_up_interruptible(&priv->delta_msr_wait);
++		wake_up_interruptible(&port->delta_msr_wait);
+ 		priv->prev_status = priv->current_status;
+ 	}
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 878ff05..06394e5a 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -74,9 +74,7 @@ struct ftdi_private {
+ 	int flags;		/* some ASYNC_xxxx flags are supported */
+ 	unsigned long last_dtr_rts;	/* saved modem control outputs */
+ 	struct async_icount	icount;
+-	wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
+ 	char prev_status;        /* Used for TIOCMIWAIT */
+-	bool dev_gone;        /* Used to abort TIOCMIWAIT */
+ 	char transmit_empty;	/* If transmitter is empty or not */
+ 	struct usb_serial_port *port;
+ 	__u16 interface;	/* FT2232C, FT2232H or FT4232H port interface
+@@ -1708,10 +1706,8 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
+ 	kref_init(&priv->kref);
+ 	mutex_init(&priv->cfg_lock);
+ 	memset(&priv->icount, 0x00, sizeof(priv->icount));
+-	init_waitqueue_head(&priv->delta_msr_wait);
+ 
+ 	priv->flags = ASYNC_LOW_LATENCY;
+-	priv->dev_gone = false;
+ 
+ 	if (quirk && quirk->port_probe)
+ 		quirk->port_probe(priv);
+@@ -1869,8 +1865,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
+ 
+ 	dbg("%s", __func__);
+ 
+-	priv->dev_gone = true;
+-	wake_up_interruptible_all(&priv->delta_msr_wait);
++	wake_up_interruptible(&port->delta_msr_wait);
+ 
+ 	remove_sysfs_attrs(port);
+ 
+@@ -2025,7 +2020,7 @@ static int ftdi_process_packet(struct tty_struct *tty,
+ 		if (diff_status & FTDI_RS0_RLSD)
+ 			priv->icount.dcd++;
+ 
+-		wake_up_interruptible_all(&priv->delta_msr_wait);
++		wake_up_interruptible(&port->delta_msr_wait);
+ 		priv->prev_status = status;
+ 	}
+ 
+@@ -2424,11 +2419,15 @@ static int ftdi_ioctl(struct tty_struct *tty,
+ 	 */
+ 	case TIOCMIWAIT:
+ 		cprev = priv->icount;
+-		while (!priv->dev_gone) {
+-			interruptible_sleep_on(&priv->delta_msr_wait);
++		for (;;) {
++			interruptible_sleep_on(&port->delta_msr_wait);
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			cnow = priv->icount;
+ 			if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
+ 			    ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
+@@ -2438,8 +2437,6 @@ static int ftdi_ioctl(struct tty_struct *tty,
+ 			}
+ 			cprev = cnow;
+ 		}
+-		return -EIO;
+-		break;
+ 	case TIOCSERGETLSR:
+ 		return get_lsr_info(port, (struct serial_struct __user *)arg);
+ 		break;
+diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
+index 2ee8075..0af0b41 100644
+--- a/drivers/usb/serial/io_edgeport.c
++++ b/drivers/usb/serial/io_edgeport.c
+@@ -114,7 +114,6 @@ struct edgeport_port {
+ 	wait_queue_head_t	wait_chase;		/* for handling sleeping while waiting for chase to finish */
+ 	wait_queue_head_t	wait_open;		/* for handling sleeping while waiting for open to finish */
+ 	wait_queue_head_t	wait_command;		/* for handling sleeping while waiting for command to finish */
+-	wait_queue_head_t	delta_msr_wait;		/* for handling sleeping while waiting for msr change to happen */
+ 
+ 	struct async_icount	icount;
+ 	struct usb_serial_port	*port;			/* loop back to the owner of this object */
+@@ -885,7 +884,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	/* initialize our wait queues */
+ 	init_waitqueue_head(&edge_port->wait_open);
+ 	init_waitqueue_head(&edge_port->wait_chase);
+-	init_waitqueue_head(&edge_port->delta_msr_wait);
+ 	init_waitqueue_head(&edge_port->wait_command);
+ 
+ 	/* initialize our icount structure */
+@@ -1703,13 +1701,17 @@ static int edge_ioctl(struct tty_struct *tty,
+ 		dbg("%s (%d) TIOCMIWAIT", __func__,  port->number);
+ 		cprev = edge_port->icount;
+ 		while (1) {
+-			prepare_to_wait(&edge_port->delta_msr_wait,
++			prepare_to_wait(&port->delta_msr_wait,
+ 						&wait, TASK_INTERRUPTIBLE);
+ 			schedule();
+-			finish_wait(&edge_port->delta_msr_wait, &wait);
++			finish_wait(&port->delta_msr_wait, &wait);
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			cnow = edge_port->icount;
+ 			if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+ 			    cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+@@ -2090,7 +2092,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 newMsr)
+ 			icount->dcd++;
+ 		if (newMsr & EDGEPORT_MSR_DELTA_RI)
+ 			icount->rng++;
+-		wake_up_interruptible(&edge_port->delta_msr_wait);
++		wake_up_interruptible(&edge_port->port->delta_msr_wait);
+ 	}
+ 
+ 	/* Save the new modem status */
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index 1f145bf..f42119d 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -98,9 +98,6 @@ struct edgeport_port {
+ 	int close_pending;
+ 	int lsr_event;
+ 	struct async_icount	icount;
+-	wait_queue_head_t	delta_msr_wait;	/* for handling sleeping while
+-						   waiting for msr change to
+-						   happen */
+ 	struct edgeport_serial	*edge_serial;
+ 	struct usb_serial_port	*port;
+ 	__u8 bUartMode;		/* Port type, 0: RS232, etc. */
+@@ -1557,7 +1554,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
+ 			icount->dcd++;
+ 		if (msr & EDGEPORT_MSR_DELTA_RI)
+ 			icount->rng++;
+-		wake_up_interruptible(&edge_port->delta_msr_wait);
++		wake_up_interruptible(&edge_port->port->delta_msr_wait);
+ 	}
+ 
+ 	/* Save the new modem status */
+@@ -1876,7 +1873,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	dev = port->serial->dev;
+ 
+ 	memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
+-	init_waitqueue_head(&edge_port->delta_msr_wait);
+ 
+ 	/* turn off loopback */
+ 	status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
+@@ -2574,10 +2570,14 @@ static int edge_ioctl(struct tty_struct *tty,
+ 		dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
+ 		cprev = edge_port->icount;
+ 		while (1) {
+-			interruptible_sleep_on(&edge_port->delta_msr_wait);
++			interruptible_sleep_on(&port->delta_msr_wait);
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			cnow = edge_port->icount;
+ 			if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+ 			    cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
+index de0bb8e..96a62dd 100644
+--- a/drivers/usb/serial/mct_u232.c
++++ b/drivers/usb/serial/mct_u232.c
+@@ -168,8 +168,6 @@ struct mct_u232_private {
+ 	unsigned char	     last_msr;      /* Modem Status Register */
+ 	unsigned int	     rx_flags;      /* Throttling flags */
+ 	struct async_icount  icount;
+-	wait_queue_head_t    msr_wait;	/* for handling sleeping while waiting
+-						for msr change to happen */
+ };
+ 
+ #define THROTTLED		0x01
+@@ -449,7 +447,6 @@ static int mct_u232_startup(struct usb_serial *serial)
+ 	if (!priv)
+ 		return -ENOMEM;
+ 	spin_lock_init(&priv->lock);
+-	init_waitqueue_head(&priv->msr_wait);
+ 	usb_set_serial_port_data(serial->port[0], priv);
+ 
+ 	init_waitqueue_head(&serial->port[0]->write_wait);
+@@ -675,7 +672,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
+ 		tty_kref_put(tty);
+ 	}
+ #endif
+-	wake_up_interruptible(&priv->msr_wait);
++	wake_up_interruptible(&port->delta_msr_wait);
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ exit:
+ 	retval = usb_submit_urb(urb, GFP_ATOMIC);
+@@ -896,13 +893,17 @@ static int  mct_u232_ioctl(struct tty_struct *tty,
+ 		cprev = mct_u232_port->icount;
+ 		spin_unlock_irqrestore(&mct_u232_port->lock, flags);
+ 		for ( ; ; ) {
+-			prepare_to_wait(&mct_u232_port->msr_wait,
++			prepare_to_wait(&port->delta_msr_wait,
+ 					&wait, TASK_INTERRUPTIBLE);
+ 			schedule();
+-			finish_wait(&mct_u232_port->msr_wait, &wait);
++			finish_wait(&port->delta_msr_wait, &wait);
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			spin_lock_irqsave(&mct_u232_port->lock, flags);
+ 			cnow = mct_u232_port->icount;
+ 			spin_unlock_irqrestore(&mct_u232_port->lock, flags);
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index 43a38aa..e89ee48 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -240,7 +240,6 @@ struct moschip_port {
+ 	char open;
+ 	char open_ports;
+ 	wait_queue_head_t wait_chase;	/* for handling sleeping while waiting for chase to finish */
+-	wait_queue_head_t delta_msr_wait;	/* for handling sleeping while waiting for msr change to happen */
+ 	int delta_msr_cond;
+ 	struct async_icount icount;
+ 	struct usb_serial_port *port;	/* loop back to the owner of this object */
+@@ -453,6 +452,9 @@ static void mos7840_handle_new_msr(struct moschip_port *port, __u8 new_msr)
+ 			icount->rng++;
+ 			smp_wmb();
+ 		}
++
++		mos7840_port->delta_msr_cond = 1;
++		wake_up_interruptible(&port->port->delta_msr_wait);
+ 	}
+ }
+ 
+@@ -1115,7 +1117,6 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 
+ 	/* initialize our wait queues */
+ 	init_waitqueue_head(&mos7840_port->wait_chase);
+-	init_waitqueue_head(&mos7840_port->delta_msr_wait);
+ 
+ 	/* initialize our icount structure */
+ 	memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
+@@ -2073,8 +2074,6 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
+ 			mos7840_port->read_urb_busy = false;
+ 		}
+ 	}
+-	wake_up(&mos7840_port->delta_msr_wait);
+-	mos7840_port->delta_msr_cond = 1;
+ 	dbg("mos7840_change_port_settings mos7840_port->shadowLCR is End %x",
+ 	    mos7840_port->shadowLCR);
+ }
+@@ -2284,13 +2283,18 @@ static int mos7840_ioctl(struct tty_struct *tty,
+ 		while (1) {
+ 			/* interruptible_sleep_on(&mos7840_port->delta_msr_wait); */
+ 			mos7840_port->delta_msr_cond = 0;
+-			wait_event_interruptible(mos7840_port->delta_msr_wait,
+-						 (mos7840_port->
++			wait_event_interruptible(port->delta_msr_wait,
++						 (port->serial->disconnected ||
++						  mos7840_port->
+ 						  delta_msr_cond == 1));
+ 
+ 			/* see if a signal did it */
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			cnow = mos7840_port->icount;
+ 			smp_rmb();
+ 			if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
+index 4c29e6c..8ceaa89 100644
+--- a/drivers/usb/serial/oti6858.c
++++ b/drivers/usb/serial/oti6858.c
+@@ -196,7 +196,6 @@ struct oti6858_private {
+ 	u8 setup_done;
+ 	struct delayed_work delayed_setup_work;
+ 
+-	wait_queue_head_t intr_wait;
+ 	struct usb_serial_port *port;   /* USB port with which associated */
+ };
+ 
+@@ -357,7 +356,6 @@ static int oti6858_startup(struct usb_serial *serial)
+ 			break;
+ 
+ 		spin_lock_init(&priv->lock);
+-		init_waitqueue_head(&priv->intr_wait);
+ /*		INIT_WORK(&priv->setup_work, setup_line, serial->port[i]); */
+ /*		INIT_WORK(&priv->write_work, send_data, serial->port[i]); */
+ 		priv->port = port;
+@@ -705,11 +703,15 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+ 	while (1) {
+-		wait_event_interruptible(priv->intr_wait,
++		wait_event_interruptible(port->delta_msr_wait,
++					port->serial->disconnected ||
+ 					priv->status.pin_state != prev);
+ 		if (signal_pending(current))
+ 			return -ERESTARTSYS;
+ 
++		if (port->serial->disconnected)
++			return -EIO;
++
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		status = priv->status.pin_state & PIN_MASK;
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+@@ -821,7 +823,7 @@ static void oti6858_read_int_callback(struct urb *urb)
+ 
+ 		if (!priv->transient) {
+ 			if (xs->pin_state != priv->status.pin_state)
+-				wake_up_interruptible(&priv->intr_wait);
++				wake_up_interruptible(&port->delta_msr_wait);
+ 			memcpy(&priv->status, xs, OTI6858_CTRL_PKT_SIZE);
+ 		}
+ 
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 5532ea5..fd86e0e 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -150,7 +150,6 @@ enum pl2303_type {
+ 
+ struct pl2303_private {
+ 	spinlock_t lock;
+-	wait_queue_head_t delta_msr_wait;
+ 	u8 line_control;
+ 	u8 line_status;
+ 	enum pl2303_type type;
+@@ -204,7 +203,6 @@ static int pl2303_startup(struct usb_serial *serial)
+ 		if (!priv)
+ 			goto cleanup;
+ 		spin_lock_init(&priv->lock);
+-		init_waitqueue_head(&priv->delta_msr_wait);
+ 		priv->type = type;
+ 		usb_set_serial_port_data(serial->port[i], priv);
+ 	}
+@@ -599,11 +597,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
+ 	while (1) {
+-		interruptible_sleep_on(&priv->delta_msr_wait);
++		interruptible_sleep_on(&port->delta_msr_wait);
+ 		/* see if a signal did it */
+ 		if (signal_pending(current))
+ 			return -ERESTARTSYS;
+ 
++		if (port->serial->disconnected)
++			return -EIO;
++
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		status = priv->line_status;
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+@@ -725,7 +726,7 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 	if (priv->line_status & UART_BREAK_ERROR)
+ 		usb_serial_handle_break(port);
+-	wake_up_interruptible(&priv->delta_msr_wait);
++	wake_up_interruptible(&port->delta_msr_wait);
+ 
+ 	tty = tty_port_tty_get(&port->port);
+ 	if (!tty)
+@@ -792,7 +793,7 @@ static void pl2303_process_read_urb(struct urb *urb)
+ 	line_status = priv->line_status;
+ 	priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+-	wake_up_interruptible(&priv->delta_msr_wait);
++	wake_up_interruptible(&port->delta_msr_wait);
+ 
+ 	if (!urb->actual_length)
+ 		return;
+diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
+index 180ea6c..ba6b438 100644
+--- a/drivers/usb/serial/spcp8x5.c
++++ b/drivers/usb/serial/spcp8x5.c
+@@ -163,7 +163,6 @@ static struct usb_driver spcp8x5_driver = {
+ struct spcp8x5_private {
+ 	spinlock_t 	lock;
+ 	enum spcp8x5_type	type;
+-	wait_queue_head_t	delta_msr_wait;
+ 	u8 			line_control;
+ 	u8 			line_status;
+ };
+@@ -197,7 +196,6 @@ static int spcp8x5_startup(struct usb_serial *serial)
+ 			goto cleanup;
+ 
+ 		spin_lock_init(&priv->lock);
+-		init_waitqueue_head(&priv->delta_msr_wait);
+ 		priv->type = type;
+ 		usb_set_serial_port_data(serial->port[i] , priv);
+ 	}
+@@ -502,7 +500,7 @@ static void spcp8x5_process_read_urb(struct urb *urb)
+ 	priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 	/* wake up the wait for termios */
+-	wake_up_interruptible(&priv->delta_msr_wait);
++	wake_up_interruptible(&port->delta_msr_wait);
+ 
+ 	if (!urb->actual_length)
+ 		return;
+@@ -552,12 +550,15 @@ static int spcp8x5_wait_modem_info(struct usb_serial_port *port,
+ 
+ 	while (1) {
+ 		/* wake up in bulk read */
+-		interruptible_sleep_on(&priv->delta_msr_wait);
++		interruptible_sleep_on(&port->delta_msr_wait);
+ 
+ 		/* see if a signal did it */
+ 		if (signal_pending(current))
+ 			return -ERESTARTSYS;
+ 
++		if (port->serial->disconnected)
++			return -EIO;
++
+ 		spin_lock_irqsave(&priv->lock, flags);
+ 		status = priv->line_status;
+ 		spin_unlock_irqrestore(&priv->lock, flags);
+diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
+index fff7f17..bf1f8ea 100644
+--- a/drivers/usb/serial/ssu100.c
++++ b/drivers/usb/serial/ssu100.c
+@@ -78,7 +78,6 @@ struct ssu100_port_private {
+ 	spinlock_t status_lock;
+ 	u8 shadowLSR;
+ 	u8 shadowMSR;
+-	wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
+ 	struct async_icount icount;
+ };
+ 
+@@ -387,8 +386,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ 	spin_unlock_irqrestore(&priv->status_lock, flags);
+ 
+ 	while (1) {
+-		wait_event_interruptible(priv->delta_msr_wait,
+-					 ((priv->icount.rng != prev.rng) ||
++		wait_event_interruptible(port->delta_msr_wait,
++					 (port->serial->disconnected ||
++					  (priv->icount.rng != prev.rng) ||
+ 					  (priv->icount.dsr != prev.dsr) ||
+ 					  (priv->icount.dcd != prev.dcd) ||
+ 					  (priv->icount.cts != prev.cts)));
+@@ -396,6 +396,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
+ 		if (signal_pending(current))
+ 			return -ERESTARTSYS;
+ 
++		if (port->serial->disconnected)
++			return -EIO;
++
+ 		spin_lock_irqsave(&priv->status_lock, flags);
+ 		cur = priv->icount;
+ 		spin_unlock_irqrestore(&priv->status_lock, flags);
+@@ -478,7 +481,6 @@ static int ssu100_attach(struct usb_serial *serial)
+ 	}
+ 
+ 	spin_lock_init(&priv->status_lock);
+-	init_waitqueue_head(&priv->delta_msr_wait);
+ 	usb_set_serial_port_data(port, priv);
+ 
+ 	return ssu100_initdevice(serial->dev);
+@@ -564,7 +566,7 @@ static void ssu100_update_msr(struct usb_serial_port *port, u8 msr)
+ 			priv->icount.dcd++;
+ 		if (msr & UART_MSR_TERI)
+ 			priv->icount.rng++;
+-		wake_up_interruptible(&priv->delta_msr_wait);
++		wake_up_interruptible(&port->delta_msr_wait);
+ 	}
+ }
+ 
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 2856474..4b805be 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -75,7 +75,6 @@ struct ti_port {
+ 	int			tp_flags;
+ 	int			tp_closing_wait;/* in .01 secs */
+ 	struct async_icount	tp_icount;
+-	wait_queue_head_t	tp_msr_wait;	/* wait for msr change */
+ 	wait_queue_head_t	tp_write_wait;
+ 	struct ti_device	*tp_tdev;
+ 	struct usb_serial_port	*tp_port;
+@@ -447,7 +446,6 @@ static int ti_startup(struct usb_serial *serial)
+ 		tport->tp_uart_base_addr = (i == 0 ?
+ 				TI_UART1_BASE_ADDR : TI_UART2_BASE_ADDR);
+ 		tport->tp_closing_wait = closing_wait;
+-		init_waitqueue_head(&tport->tp_msr_wait);
+ 		init_waitqueue_head(&tport->tp_write_wait);
+ 		if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE,
+ 								GFP_KERNEL)) {
+@@ -848,9 +846,13 @@ static int ti_ioctl(struct tty_struct *tty,
+ 		dbg("%s - (%d) TIOCMIWAIT", __func__, port->number);
+ 		cprev = tport->tp_icount;
+ 		while (1) {
+-			interruptible_sleep_on(&tport->tp_msr_wait);
++			interruptible_sleep_on(&port->delta_msr_wait);
+ 			if (signal_pending(current))
+ 				return -ERESTARTSYS;
++
++			if (port->serial->disconnected)
++				return -EIO;
++
+ 			cnow = tport->tp_icount;
+ 			if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
+ 			    cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
+@@ -1481,7 +1483,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
+ 			icount->dcd++;
+ 		if (msr & TI_MSR_DELTA_RI)
+ 			icount->rng++;
+-		wake_up_interruptible(&tport->tp_msr_wait);
++		wake_up_interruptible(&tport->tp_port->delta_msr_wait);
+ 		spin_unlock_irqrestore(&tport->tp_lock, flags);
+ 	}
+ 
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 2482d5e..850faa4 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -905,6 +905,7 @@ int usb_serial_probe(struct usb_interface *interface,
+ 		port->port.ops = &serial_port_ops;
+ 		port->serial = serial;
+ 		spin_lock_init(&port->lock);
++		init_waitqueue_head(&port->delta_msr_wait);
+ 		/* Keep this for private driver use for the moment but
+ 		   should probably go away */
+ 		INIT_WORK(&port->work, usb_serial_port_work);
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index 9b8bcab..7a36dff 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -843,6 +843,8 @@ static void con2fb_init_display(struct vc_data *vc, struct fb_info *info,
+  *
+  *	Maps a virtual console @unit to a frame buffer device
+  *	@newidx.
++ *
++ *	This should be called with the console lock held.
+  */
+ static int set_con2fb_map(int unit, int newidx, int user)
+ {
+@@ -860,7 +862,7 @@ static int set_con2fb_map(int unit, int newidx, int user)
+ 
+ 	if (!search_for_mapped_con() || !con_is_bound(&fb_con)) {
+ 		info_idx = newidx;
+-		return fbcon_takeover(0);
++		return do_fbcon_takeover(0);
+ 	}
+ 
+ 	if (oldidx != -1)
+@@ -868,7 +870,6 @@ static int set_con2fb_map(int unit, int newidx, int user)
+ 
+ 	found = search_fb_in_map(newidx);
+ 
+-	console_lock();
+ 	con2fb_map[unit] = newidx;
+ 	if (!err && !found)
+  		err = con2fb_acquire_newinfo(vc, info, unit, oldidx);
+@@ -895,7 +896,6 @@ static int set_con2fb_map(int unit, int newidx, int user)
+ 	if (!search_fb_in_map(info_idx))
+ 		info_idx = newidx;
+ 
+-	console_unlock();
+  	return err;
+ }
+ 
+@@ -3026,6 +3026,7 @@ static inline int fbcon_unbind(void)
+ }
+ #endif /* CONFIG_VT_HW_CONSOLE_BINDING */
+ 
++/* called with console_lock held */
+ static int fbcon_fb_unbind(int idx)
+ {
+ 	int i, new_idx = -1, ret = 0;
+@@ -3052,6 +3053,7 @@ static int fbcon_fb_unbind(int idx)
+ 	return ret;
+ }
+ 
++/* called with console_lock held */
+ static int fbcon_fb_unregistered(struct fb_info *info)
+ {
+ 	int i, idx;
+@@ -3089,6 +3091,7 @@ static int fbcon_fb_unregistered(struct fb_info *info)
+ 	return 0;
+ }
+ 
++/* called with console_lock held */
+ static void fbcon_remap_all(int idx)
+ {
+ 	int i;
+@@ -3133,6 +3136,7 @@ static inline void fbcon_select_primary(struct fb_info *info)
+ }
+ #endif /* CONFIG_FRAMEBUFFER_DETECT_PRIMARY */
+ 
++/* called with console_lock held */
+ static int fbcon_fb_registered(struct fb_info *info)
+ {
+ 	int ret = 0, i, idx;
+@@ -3285,6 +3289,7 @@ static int fbcon_event_notify(struct notifier_block *self,
+ 		ret = fbcon_fb_unregistered(info);
+ 		break;
+ 	case FB_EVENT_SET_CONSOLE_MAP:
++		/* called with console lock held */
+ 		con2fb = event->data;
+ 		ret = set_con2fb_map(con2fb->console - 1,
+ 				     con2fb->framebuffer, 1);
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index c133dde..babbb07 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1154,8 +1154,10 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
+ 		event.data = &con2fb;
+ 		if (!lock_fb_info(info))
+ 			return -ENODEV;
++		console_lock();
+ 		event.info = info;
+ 		ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP, &event);
++		console_unlock();
+ 		unlock_fb_info(info);
+ 		break;
+ 	case FBIOBLANK:
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 49f3c9d..73e4cbc 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1209,6 +1209,39 @@ int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end, gfp_t mask)
+ 				mask);
+ }
+ 
++int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end)
++{
++	unsigned long index = start >> PAGE_CACHE_SHIFT;
++	unsigned long end_index = end >> PAGE_CACHE_SHIFT;
++	struct page *page;
++
++	while (index <= end_index) {
++		page = find_get_page(inode->i_mapping, index);
++		BUG_ON(!page); /* Pages should be in the extent_io_tree */
++		clear_page_dirty_for_io(page);
++		page_cache_release(page);
++		index++;
++	}
++	return 0;
++}
++
++int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end)
++{
++	unsigned long index = start >> PAGE_CACHE_SHIFT;
++	unsigned long end_index = end >> PAGE_CACHE_SHIFT;
++	struct page *page;
++
++	while (index <= end_index) {
++		page = find_get_page(inode->i_mapping, index);
++		BUG_ON(!page); /* Pages should be in the extent_io_tree */
++		account_page_redirty(page);
++		__set_page_dirty_nobuffers(page);
++		page_cache_release(page);
++		index++;
++	}
++	return 0;
++}
++
+ /*
+  * helper function to set both pages and extents in the tree writeback
+  */
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index 7604c30..2e32510 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -304,6 +304,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset,
+ 		      unsigned long *map_len);
+ int extent_range_uptodate(struct extent_io_tree *tree,
+ 			  u64 start, u64 end);
++int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end);
++int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end);
+ int extent_clear_unlock_delalloc(struct inode *inode,
+ 				struct extent_io_tree *tree,
+ 				u64 start, u64 end, struct page *locked_page,
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index fd1a06d..1372634 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -343,6 +343,7 @@ static noinline int compress_file_range(struct inode *inode,
+ 	int i;
+ 	int will_compress;
+ 	int compress_type = root->fs_info->compress_type;
++	int redirty = 0;
+ 
+ 	/* if this is a small write inside eof, kick off a defragbot */
+ 	if (end <= BTRFS_I(inode)->disk_i_size && (end - start + 1) < 16 * 1024)
+@@ -404,6 +405,17 @@ again:
+ 		if (BTRFS_I(inode)->force_compress)
+ 			compress_type = BTRFS_I(inode)->force_compress;
+ 
++		/*
++		 * we need to call clear_page_dirty_for_io on each
++		 * page in the range.  Otherwise applications with the file
++		 * mmap'd can wander in and change the page contents while
++		 * we are compressing them.
++		 *
++		 * If the compression fails for any reason, we set the pages
++		 * dirty again later on.
++		 */
++		extent_range_clear_dirty_for_io(inode, start, end);
++		redirty = 1;
+ 		ret = btrfs_compress_pages(compress_type,
+ 					   inode->i_mapping, start,
+ 					   total_compressed, pages,
+@@ -541,6 +553,8 @@ cleanup_and_bail_uncompressed:
+ 			__set_page_dirty_nobuffers(locked_page);
+ 			/* unlocked later on in the async handlers */
+ 		}
++		if (redirty)
++			extent_range_redirty_for_io(inode, start, end);
+ 		add_async_extent(async_cow, start, end - start + 1,
+ 				 0, NULL, 0, BTRFS_COMPRESS_NONE);
+ 		*num_added += 1;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 19b127c..21faa12 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -316,6 +316,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ 	unsigned long src_ptr;
+ 	unsigned long dst_ptr;
+ 	int overwrite_root = 0;
++	bool inode_item = key->type == BTRFS_INODE_ITEM_KEY;
+ 
+ 	if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
+ 		overwrite_root = 1;
+@@ -325,6 +326,9 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ 
+ 	/* look for the key in the destination tree */
+ 	ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
++	if (ret < 0)
++		return ret;
++
+ 	if (ret == 0) {
+ 		char *src_copy;
+ 		char *dst_copy;
+@@ -366,6 +370,30 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ 			return 0;
+ 		}
+ 
++		/*
++		 * We need to load the old nbytes into the inode so when we
++		 * replay the extents we've logged we get the right nbytes.
++		 */
++		if (inode_item) {
++			struct btrfs_inode_item *item;
++			u64 nbytes;
++
++			item = btrfs_item_ptr(path->nodes[0], path->slots[0],
++					      struct btrfs_inode_item);
++			nbytes = btrfs_inode_nbytes(path->nodes[0], item);
++			item = btrfs_item_ptr(eb, slot,
++					      struct btrfs_inode_item);
++			btrfs_set_inode_nbytes(eb, item, nbytes);
++		}
++	} else if (inode_item) {
++		struct btrfs_inode_item *item;
++
++		/*
++		 * New inode, set nbytes to 0 so that the nbytes comes out
++		 * properly when we replay the extents.
++		 */
++		item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
++		btrfs_set_inode_nbytes(eb, item, 0);
+ 	}
+ insert:
+ 	btrfs_release_path(path);
+@@ -488,7 +516,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 	u64 extent_end;
+ 	u64 alloc_hint;
+ 	u64 start = key->offset;
+-	u64 saved_nbytes;
++	u64 nbytes = 0;
+ 	struct btrfs_file_extent_item *item;
+ 	struct inode *inode = NULL;
+ 	unsigned long size;
+@@ -498,10 +526,19 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 	found_type = btrfs_file_extent_type(eb, item);
+ 
+ 	if (found_type == BTRFS_FILE_EXTENT_REG ||
+-	    found_type == BTRFS_FILE_EXTENT_PREALLOC)
+-		extent_end = start + btrfs_file_extent_num_bytes(eb, item);
+-	else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
++	    found_type == BTRFS_FILE_EXTENT_PREALLOC) {
++		nbytes = btrfs_file_extent_num_bytes(eb, item);
++		extent_end = start + nbytes;
++
++		/*
++		 * We don't add to the inodes nbytes if we are prealloc or a
++		 * hole.
++		 */
++		if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
++			nbytes = 0;
++	} else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
+ 		size = btrfs_file_extent_inline_len(eb, item);
++		nbytes = btrfs_file_extent_ram_bytes(eb, item);
+ 		extent_end = (start + size + mask) & ~mask;
+ 	} else {
+ 		ret = 0;
+@@ -550,7 +587,6 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 	}
+ 	btrfs_release_path(path);
+ 
+-	saved_nbytes = inode_get_bytes(inode);
+ 	/* drop any overlapping extents */
+ 	ret = btrfs_drop_extents(trans, inode, start, extent_end,
+ 				 &alloc_hint, 1);
+@@ -638,7 +674,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 		BUG_ON(ret);
+ 	}
+ 
+-	inode_set_bytes(inode, saved_nbytes);
++	inode_add_bytes(inode, nbytes);
+ 	btrfs_update_inode(trans, root, inode);
+ out:
+ 	if (inode)
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index 5849e3e..32b12e5 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -517,7 +517,7 @@ void hfsplus_file_truncate(struct inode *inode)
+ 		struct address_space *mapping = inode->i_mapping;
+ 		struct page *page;
+ 		void *fsdata;
+-		u32 size = inode->i_size;
++		loff_t size = inode->i_size;
+ 
+ 		res = pagecache_write_begin(NULL, mapping, size, 0,
+ 						AOP_FLAG_UNINTERRUPTIBLE,
+diff --git a/fs/inode.c b/fs/inode.c
+index ee4e66b..e2d3633 100644
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -634,7 +634,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
+ 		 * inode to the back of the list so we don't spin on it.
+ 		 */
+ 		if (!spin_trylock(&inode->i_lock)) {
+-			list_move_tail(&inode->i_lru, &sb->s_inode_lru);
++			list_move(&inode->i_lru, &sb->s_inode_lru);
+ 			continue;
+ 		}
+ 
+diff --git a/include/linux/ata.h b/include/linux/ata.h
+index 32df2b6..5856c9e 100644
+--- a/include/linux/ata.h
++++ b/include/linux/ata.h
+@@ -937,7 +937,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
+ 	}
+ }
+ 
+-static inline bool atapi_command_packet_set(const u16 *dev_id)
++static inline int atapi_command_packet_set(const u16 *dev_id)
+ {
+ 	return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
+ }
+diff --git a/include/linux/kref.h b/include/linux/kref.h
+index d4a62ab..d064502 100644
+--- a/include/linux/kref.h
++++ b/include/linux/kref.h
+@@ -16,6 +16,7 @@
+ #define _KREF_H_
+ 
+ #include <linux/types.h>
++#include <linux/atomic.h>
+ 
+ struct kref {
+ 	atomic_t refcount;
+@@ -27,4 +28,24 @@ int kref_put(struct kref *kref, void (*release) (struct kref *kref));
+ int kref_sub(struct kref *kref, unsigned int count,
+ 	     void (*release) (struct kref *kref));
+ 
++/**
++ * kref_get_unless_zero - Increment refcount for object unless it is zero.
++ * @kref: object.
++ *
++ * Return non-zero if the increment succeeded. Otherwise return 0.
++ *
++ * This function is intended to simplify locking around refcounting for
++ * objects that can be looked up from a lookup structure, and which are
++ * removed from that lookup structure in the object destructor.
++ * Operations on such objects require at least a read lock around
++ * lookup + kref_get, and a write lock around kref_put + remove from lookup
++ * structure. Furthermore, RCU implementations become extremely tricky.
++ * With a lookup followed by a kref_get_unless_zero *with return value check*
++ * locking in the kref_put path can be deferred to the actual removal from
++ * the lookup structure and RCU lookups become trivial.
++ */
++static inline int __must_check kref_get_unless_zero(struct kref *kref)
++{
++	return atomic_add_unless(&kref->refcount, 1, 0);
++}
+ #endif /* _KREF_H_ */
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 6136821..e6796c1 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -396,7 +396,7 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 			   void *data, unsigned long len);
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+-			      gpa_t gpa);
++			      gpa_t gpa, unsigned long len);
+ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
+ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
+ struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn);
+diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
+index fa7cc72..b0bcce0 100644
+--- a/include/linux/kvm_types.h
++++ b/include/linux/kvm_types.h
+@@ -71,6 +71,7 @@ struct gfn_to_hva_cache {
+ 	u64 generation;
+ 	gpa_t gpa;
+ 	unsigned long hva;
++	unsigned long len;
+ 	struct kvm_memory_slot *memslot;
+ };
+ 
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index cafc09a..62467ca 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -392,6 +392,7 @@ enum {
+ 	ATA_HORKAGE_NOSETXFER	= (1 << 14),	/* skip SETXFER, SATA only */
+ 	ATA_HORKAGE_BROKEN_FPDMA_AA	= (1 << 15),	/* skip AA */
+ 	ATA_HORKAGE_DUMP_ID	= (1 << 16),	/* dump IDENTIFY data */
++	ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),	/* Set max sects to 65535 */
+ 
+ 	 /* DMA mask for user DMA control: User visible values; DO NOT
+ 	    renumber */
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 4948552..9bf9611 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -336,6 +336,22 @@ static inline int of_machine_is_compatible(const char *compat)
+ #define of_match_node(_matches, _node)	NULL
+ #endif /* CONFIG_OF */
+ 
++/**
++ * of_property_read_bool - Findfrom a property
++ * @np:		device node from which the property value is to be read.
++ * @propname:	name of the property to be searched.
++ *
++ * Search for a property in a device node.
++ * Returns true if the property exist false otherwise.
++ */
++static inline bool of_property_read_bool(const struct device_node *np,
++					 const char *propname)
++{
++	struct property *prop = of_find_property(np, propname, NULL);
++
++	return prop ? true : false;
++}
++
+ static inline int of_property_read_u32(const struct device_node *np,
+ 				       const char *propname,
+ 				       u32 *out_value)
+diff --git a/include/linux/preempt.h b/include/linux/preempt.h
+index 58969b2..e86bf01 100644
+--- a/include/linux/preempt.h
++++ b/include/linux/preempt.h
+@@ -91,13 +91,19 @@ do { \
+ 
+ #else /* !CONFIG_PREEMPT_COUNT */
+ 
+-#define preempt_disable()		do { } while (0)
+-#define preempt_enable_no_resched()	do { } while (0)
+-#define preempt_enable()		do { } while (0)
++/*
++ * Even if we don't have any preemption, we need preempt disable/enable
++ * to be barriers, so that we don't have things like get_user/put_user
++ * that can cause faults and scheduling migrate into our preempt-protected
++ * region.
++ */
++#define preempt_disable()		barrier()
++#define preempt_enable_no_resched()	barrier()
++#define preempt_enable()		barrier()
+ 
+-#define preempt_disable_notrace()		do { } while (0)
+-#define preempt_enable_no_resched_notrace()	do { } while (0)
+-#define preempt_enable_notrace()		do { } while (0)
++#define preempt_disable_notrace()		barrier()
++#define preempt_enable_no_resched_notrace()	barrier()
++#define preempt_enable_notrace()		barrier()
+ 
+ #endif /* CONFIG_PREEMPT_COUNT */
+ 
+diff --git a/include/linux/socket.h b/include/linux/socket.h
+index ad919e0..2acd2e2 100644
+--- a/include/linux/socket.h
++++ b/include/linux/socket.h
+@@ -317,6 +317,7 @@ struct ucred {
+ #define IPX_TYPE	1
+ 
+ extern void cred_to_ucred(struct pid *pid, const struct cred *cred, struct ucred *ucred);
++extern void cred_real_to_ucred(struct pid *pid, const struct cred *cred, struct ucred *ucred);
+ 
+ extern int memcpy_fromiovec(unsigned char *kdata, struct iovec *iov, int len);
+ extern int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
+index a26e2fb..e2369c1 100644
+--- a/include/linux/spinlock_up.h
++++ b/include/linux/spinlock_up.h
+@@ -16,7 +16,10 @@
+  * In the debug case, 1 means unlocked, 0 means locked. (the values
+  * are inverted, to catch initialization bugs)
+  *
+- * No atomicity anywhere, we are on UP.
++ * No atomicity anywhere, we are on UP. However, we still need
++ * the compiler barriers, because we do not want the compiler to
++ * move potentially faulting instructions (notably user accesses)
++ * into the locked sequence, resulting in non-atomic execution.
+  */
+ 
+ #ifdef CONFIG_DEBUG_SPINLOCK
+@@ -25,6 +28,7 @@
+ static inline void arch_spin_lock(arch_spinlock_t *lock)
+ {
+ 	lock->slock = 0;
++	barrier();
+ }
+ 
+ static inline void
+@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
+ {
+ 	local_irq_save(flags);
+ 	lock->slock = 0;
++	barrier();
+ }
+ 
+ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
+ 	char oldval = lock->slock;
+ 
+ 	lock->slock = 0;
++	barrier();
+ 
+ 	return oldval > 0;
+ }
+ 
+ static inline void arch_spin_unlock(arch_spinlock_t *lock)
+ {
++	barrier();
+ 	lock->slock = 1;
+ }
+ 
+ /*
+  * Read-write spinlocks. No debug version.
+  */
+-#define arch_read_lock(lock)		do { (void)(lock); } while (0)
+-#define arch_write_lock(lock)		do { (void)(lock); } while (0)
+-#define arch_read_trylock(lock)	({ (void)(lock); 1; })
+-#define arch_write_trylock(lock)	({ (void)(lock); 1; })
+-#define arch_read_unlock(lock)		do { (void)(lock); } while (0)
+-#define arch_write_unlock(lock)	do { (void)(lock); } while (0)
++#define arch_read_lock(lock)		do { barrier(); (void)(lock); } while (0)
++#define arch_write_lock(lock)		do { barrier(); (void)(lock); } while (0)
++#define arch_read_trylock(lock)	({ barrier(); (void)(lock); 1; })
++#define arch_write_trylock(lock)	({ barrier(); (void)(lock); 1; })
++#define arch_read_unlock(lock)		do { barrier(); (void)(lock); } while (0)
++#define arch_write_unlock(lock)	do { barrier(); (void)(lock); } while (0)
+ 
+ #else /* DEBUG_SPINLOCK */
+ #define arch_spin_is_locked(lock)	((void)(lock), 0)
+ /* for sched.c and kernel_lock.c: */
+-# define arch_spin_lock(lock)		do { (void)(lock); } while (0)
+-# define arch_spin_lock_flags(lock, flags)	do { (void)(lock); } while (0)
+-# define arch_spin_unlock(lock)	do { (void)(lock); } while (0)
+-# define arch_spin_trylock(lock)	({ (void)(lock); 1; })
++# define arch_spin_lock(lock)		do { barrier(); (void)(lock); } while (0)
++# define arch_spin_lock_flags(lock, flags)	do { barrier(); (void)(lock); } while (0)
++# define arch_spin_unlock(lock)	do { barrier(); (void)(lock); } while (0)
++# define arch_spin_trylock(lock)	({ barrier(); (void)(lock); 1; })
+ #endif /* DEBUG_SPINLOCK */
+ 
+ #define arch_spin_is_contended(lock)	(((void)(lock), 0))
+diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
+index b29f70b..237d5f8 100644
+--- a/include/linux/usb/serial.h
++++ b/include/linux/usb/serial.h
+@@ -71,6 +71,7 @@ enum port_dev_state {
+  *	port.
+  * @flags: usb serial port flags
+  * @write_wait: a wait_queue_head_t used by the port.
++ * @delta_msr_wait: modem-status-change wait queue
+  * @work: work queue entry for the line discipline waking up.
+  * @throttled: nonzero if the read urb is inactive to throttle the device
+  * @throttle_req: nonzero if the tty wants to throttle us
+@@ -114,6 +115,7 @@ struct usb_serial_port {
+ 
+ 	unsigned long		flags;
+ 	wait_queue_head_t	write_wait;
++	wait_queue_head_t	delta_msr_wait;
+ 	struct work_struct	work;
+ 	char			throttled;
+ 	char			throttle_req;
+diff --git a/include/linux/writeback.h b/include/linux/writeback.h
+index a378c29..7e85d45 100644
+--- a/include/linux/writeback.h
++++ b/include/linux/writeback.h
+@@ -195,6 +195,8 @@ void writeback_set_ratelimit(void);
+ void tag_pages_for_writeback(struct address_space *mapping,
+ 			     pgoff_t start, pgoff_t end);
+ 
++void account_page_redirty(struct page *page);
++
+ /* pdflush.c */
+ extern int nr_pdflush_threads;	/* Global so it can be exported to sysctl
+ 				   read-only. */
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 0c0017c..5da0a7b 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -50,7 +50,7 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
+ {
+ 	scm->pid  = get_pid(pid);
+ 	scm->cred = cred ? get_cred(cred) : NULL;
+-	cred_to_ucred(pid, cred, &scm->creds);
++	cred_real_to_ucred(pid, cred, &scm->creds);
+ }
+ 
+ static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index cdd5607..e4cee8d 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -61,6 +61,7 @@
+ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
+ {
+ 
++	.lock = __RAW_SPIN_LOCK_UNLOCKED(hrtimer_bases.lock),
+ 	.clock_base =
+ 	{
+ 		{
+@@ -1640,8 +1641,6 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
+ 	struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
+ 	int i;
+ 
+-	raw_spin_lock_init(&cpu_base->lock);
+-
+ 	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
+ 		cpu_base->clock_base[i].cpu_base = cpu_base;
+ 		timerqueue_init_head(&cpu_base->clock_base[i].active);
+diff --git a/kernel/sched.c b/kernel/sched.c
+index eeeec4e..d08c9f4 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -2889,8 +2889,10 @@ static void try_to_wake_up_local(struct task_struct *p)
+ {
+ 	struct rq *rq = task_rq(p);
+ 
+-	BUG_ON(rq != this_rq());
+-	BUG_ON(p == current);
++	if (WARN_ON_ONCE(rq != this_rq()) ||
++	    WARN_ON_ONCE(p == current))
++		return;
++
+ 	lockdep_assert_held(&rq->lock);
+ 
+ 	if (!raw_spin_trylock(&p->pi_lock)) {
+diff --git a/kernel/sched_clock.c b/kernel/sched_clock.c
+index c685e31..c3ae144 100644
+--- a/kernel/sched_clock.c
++++ b/kernel/sched_clock.c
+@@ -176,10 +176,36 @@ static u64 sched_clock_remote(struct sched_clock_data *scd)
+ 	u64 this_clock, remote_clock;
+ 	u64 *ptr, old_val, val;
+ 
++#if BITS_PER_LONG != 64
++again:
++	/*
++	 * Careful here: The local and the remote clock values need to
++	 * be read out atomic as we need to compare the values and
++	 * then update either the local or the remote side. So the
++	 * cmpxchg64 below only protects one readout.
++	 *
++	 * We must reread via sched_clock_local() in the retry case on
++	 * 32bit as an NMI could use sched_clock_local() via the
++	 * tracer and hit between the readout of
++	 * the low32bit and the high 32bit portion.
++	 */
++	this_clock = sched_clock_local(my_scd);
++	/*
++	 * We must enforce atomic readout on 32bit, otherwise the
++	 * update on the remote cpu can hit inbetween the readout of
++	 * the low32bit and the high 32bit portion.
++	 */
++	remote_clock = cmpxchg64(&scd->clock, 0, 0);
++#else
++	/*
++	 * On 64bit the read of [my]scd->clock is atomic versus the
++	 * update, so we can avoid the above 32bit dance.
++	 */
+ 	sched_clock_local(my_scd);
+ again:
+ 	this_clock = my_scd->clock;
+ 	remote_clock = scd->clock;
++#endif
+ 
+ 	/*
+ 	 * Use the opportunity that we have both locks
+diff --git a/kernel/signal.c b/kernel/signal.c
+index ea76d30..3ecf574 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2790,7 +2790,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+ 
+ static int do_tkill(pid_t tgid, pid_t pid, int sig)
+ {
+-	struct siginfo info;
++	struct siginfo info = {};
+ 
+ 	info.si_signo = sig;
+ 	info.si_errno = 0;
+diff --git a/kernel/sys.c b/kernel/sys.c
+index f5939c2..be5fa8b 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -320,7 +320,6 @@ void kernel_restart_prepare(char *cmd)
+ 	system_state = SYSTEM_RESTART;
+ 	usermodehelper_disable();
+ 	device_shutdown();
+-	syscore_shutdown();
+ }
+ 
+ /**
+@@ -366,6 +365,7 @@ void kernel_restart(char *cmd)
+ {
+ 	kernel_restart_prepare(cmd);
+ 	disable_nonboot_cpus();
++	syscore_shutdown();
+ 	if (!cmd)
+ 		printk(KERN_EMERG "Restarting system.\n");
+ 	else
+@@ -391,6 +391,7 @@ static void kernel_shutdown_prepare(enum system_states state)
+ void kernel_halt(void)
+ {
+ 	kernel_shutdown_prepare(SYSTEM_HALT);
++	disable_nonboot_cpus();
+ 	syscore_shutdown();
+ 	printk(KERN_EMERG "System halted.\n");
+ 	kmsg_dump(KMSG_DUMP_HALT);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 0943d2a..5527211 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -572,7 +572,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
+ 		free_page(tmp);
+ 	}
+ 
+-	free_page((unsigned long)stat->pages);
+ 	stat->pages = NULL;
+ 	stat->start = NULL;
+ 
+@@ -2317,7 +2316,7 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
+ }
+ 
+ static loff_t
+-ftrace_regex_lseek(struct file *file, loff_t offset, int origin)
++ftrace_filter_lseek(struct file *file, loff_t offset, int origin)
+ {
+ 	loff_t ret;
+ 
+@@ -3135,7 +3134,7 @@ static const struct file_operations ftrace_filter_fops = {
+ 	.open = ftrace_filter_open,
+ 	.read = seq_read,
+ 	.write = ftrace_filter_write,
+-	.llseek = ftrace_regex_lseek,
++	.llseek = ftrace_filter_lseek,
+ 	.release = ftrace_regex_release,
+ };
+ 
+@@ -3143,7 +3142,7 @@ static const struct file_operations ftrace_notrace_fops = {
+ 	.open = ftrace_notrace_open,
+ 	.read = seq_read,
+ 	.write = ftrace_notrace_write,
+-	.llseek = ftrace_regex_lseek,
++	.llseek = ftrace_filter_lseek,
+ 	.release = ftrace_regex_release,
+ };
+ 
+@@ -3351,8 +3350,8 @@ static const struct file_operations ftrace_graph_fops = {
+ 	.open		= ftrace_graph_open,
+ 	.read		= seq_read,
+ 	.write		= ftrace_graph_write,
++	.llseek		= ftrace_filter_lseek,
+ 	.release	= ftrace_graph_release,
+-	.llseek		= seq_lseek,
+ };
+ #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
+ 
+@@ -3844,7 +3843,7 @@ static const struct file_operations ftrace_pid_fops = {
+ 	.open		= ftrace_pid_open,
+ 	.write		= ftrace_pid_write,
+ 	.read		= seq_read,
+-	.llseek		= seq_lseek,
++	.llseek		= ftrace_filter_lseek,
+ 	.release	= ftrace_pid_release,
+ };
+ 
+@@ -3964,12 +3963,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+ 		ftrace_startup_sysctl();
+ 
+ 		/* we are starting ftrace again */
+-		if (ftrace_ops_list != &ftrace_list_end) {
+-			if (ftrace_ops_list->next == &ftrace_list_end)
+-				ftrace_trace_function = ftrace_ops_list->func;
+-			else
+-				ftrace_trace_function = ftrace_ops_list_func;
+-		}
++		if (ftrace_ops_list != &ftrace_list_end)
++			update_ftrace_function();
+ 
+ 	} else {
+ 		/* stopping ftrace calls (just send to ftrace_stub) */
+diff --git a/lib/kobject.c b/lib/kobject.c
+index 640bd98..83bd5b3 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -531,6 +531,13 @@ struct kobject *kobject_get(struct kobject *kobj)
+ 	return kobj;
+ }
+ 
++static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
++{
++	if (!kref_get_unless_zero(&kobj->kref))
++		kobj = NULL;
++	return kobj;
++}
++
+ /*
+  * kobject_cleanup - free kobject resources.
+  * @kobj: object to cleanup
+@@ -785,7 +792,7 @@ struct kobject *kset_find_obj_hinted(struct kset *kset, const char *name,
+ slow_search:
+ 	list_for_each_entry(k, &kset->list, entry) {
+ 		if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
+-			ret = kobject_get(k);
++			ret = kobject_get_unless_zero(k);
+ 			break;
+ 		}
+ 	}
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 4c7d42a..70b4733 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2889,7 +2889,17 @@ int follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			break;
+ 		}
+ 
+-		if (absent ||
++		/*
++		 * We need call hugetlb_fault for both hugepages under migration
++		 * (in which case hugetlb_fault waits for the migration,) and
++		 * hwpoisoned hugepages (in which case we need to prevent the
++		 * caller from accessing to them.) In order to do this, we use
++		 * here is_swap_pte instead of is_hugetlb_entry_migration and
++		 * is_hugetlb_entry_hwpoisoned. This is because it simply covers
++		 * both cases, and because we can't follow correct pages
++		 * directly from any kind of swap entries.
++		 */
++		if (absent || is_swap_pte(huge_ptep_get(pte)) ||
+ 		    ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) {
+ 			int ret;
+ 
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 50f0824..ea3f83b 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -1801,6 +1801,24 @@ int __set_page_dirty_nobuffers(struct page *page)
+ EXPORT_SYMBOL(__set_page_dirty_nobuffers);
+ 
+ /*
++ * Call this whenever redirtying a page, to de-account the dirty counters
++ * (NR_DIRTIED, BDI_DIRTIED, tsk->nr_dirtied), so that they match the written
++ * counters (NR_WRITTEN, BDI_WRITTEN) in long term. The mismatches will lead to
++ * systematic errors in balanced_dirty_ratelimit and the dirty pages position
++ * control.
++ */
++void account_page_redirty(struct page *page)
++{
++	struct address_space *mapping = page->mapping;
++	if (mapping && mapping_cap_account_dirty(mapping)) {
++		current->nr_dirtied--;
++		dec_zone_page_state(page, NR_DIRTIED);
++		dec_bdi_stat(mapping->backing_dev_info, BDI_DIRTIED);
++	}
++}
++EXPORT_SYMBOL(account_page_redirty);
++
++/*
+  * When a writepage implementation decides that it doesn't want to write this
+  * page for some reason, it should redirty the locked page via
+  * redirty_page_for_writepage() and it should then unlock the page and return 0
+@@ -1808,6 +1826,7 @@ EXPORT_SYMBOL(__set_page_dirty_nobuffers);
+ int redirty_page_for_writepage(struct writeback_control *wbc, struct page *page)
+ {
+ 	wbc->pages_skipped++;
++	account_page_redirty(page);
+ 	return __set_page_dirty_nobuffers(page);
+ }
+ EXPORT_SYMBOL(redirty_page_for_writepage);
+diff --git a/net/can/gw.c b/net/can/gw.c
+index 3d79b12..f78f898 100644
+--- a/net/can/gw.c
++++ b/net/can/gw.c
+@@ -436,7 +436,7 @@ static int cgw_notifier(struct notifier_block *nb,
+ 			if (gwj->src.dev == dev || gwj->dst.dev == dev) {
+ 				hlist_del(&gwj->list);
+ 				cgw_unregister_filter(gwj);
+-				kfree(gwj);
++				kmem_cache_free(cgw_cache, gwj);
+ 			}
+ 		}
+ 	}
+@@ -850,7 +850,7 @@ static void cgw_remove_all_jobs(void)
+ 	hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
+ 		hlist_del(&gwj->list);
+ 		cgw_unregister_filter(gwj);
+-		kfree(gwj);
++		kmem_cache_free(cgw_cache, gwj);
+ 	}
+ }
+ 
+@@ -903,7 +903,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
+ 
+ 		hlist_del(&gwj->list);
+ 		cgw_unregister_filter(gwj);
+-		kfree(gwj);
++		kmem_cache_free(cgw_cache, gwj);
+ 		err = 0;
+ 		break;
+ 	}
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 1e8a882..2c73adf 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -761,6 +761,20 @@ void cred_to_ucred(struct pid *pid, const struct cred *cred,
+ }
+ EXPORT_SYMBOL_GPL(cred_to_ucred);
+ 
++void cred_real_to_ucred(struct pid *pid, const struct cred *cred,
++			struct ucred *ucred)
++{
++	ucred->pid = pid_vnr(pid);
++	ucred->uid = ucred->gid = -1;
++	if (cred) {
++		struct user_namespace *current_ns = current_user_ns();
++
++		ucred->uid = user_ns_map_uid(current_ns, cred, cred->uid);
++		ucred->gid = user_ns_map_gid(current_ns, cred, cred->gid);
++	}
++}
++EXPORT_SYMBOL_GPL(cred_real_to_ucred);
++
+ int sock_getsockopt(struct socket *sock, int level, int optname,
+ 		    char __user *optval, int __user *optlen)
+ {
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 7747d26..4707b6c 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -163,7 +163,7 @@ const char *snd_hda_get_jack_type(u32 cfg)
+ 		"Line Out", "Speaker", "HP Out", "CD",
+ 		"SPDIF Out", "Digital Out", "Modem Line", "Modem Hand",
+ 		"Line In", "Aux", "Mic", "Telephony",
+-		"SPDIF In", "Digitial In", "Reserved", "Other"
++		"SPDIF In", "Digital In", "Reserved", "Other"
+ 	};
+ 
+ 	return jack_types[(cfg & AC_DEFCFG_DEVICE)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index f3e0b24..1b43fde 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5595,7 +5595,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec)
+ 	const hda_nid_t *ssids;
+ 
+ 	if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 ||
+-	    codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670)
++	    codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 ||
++	    codec->vendor_id == 0x10ec0671)
+ 		ssids = alc663_ssids;
+ 	else
+ 		ssids = alc662_ssids;
+@@ -6045,6 +6046,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
++	{ .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
+ 	{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
+ 	{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index 4ad8ebd..4352ffb 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -1101,6 +1101,8 @@ static const struct snd_soc_dapm_route wm8903_intercon[] = {
+ 	{ "ROP", NULL, "Right Speaker PGA" },
+ 	{ "RON", NULL, "Right Speaker PGA" },
+ 
++	{ "Charge Pump", NULL, "CLK_DSP" },
++
+ 	{ "Left Headphone Output PGA", NULL, "Charge Pump" },
+ 	{ "Right Headphone Output PGA", NULL, "Charge Pump" },
+ 	{ "Left Line Output PGA", NULL, "Charge Pump" },
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 38a607a..fb95069 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -396,7 +396,7 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
+ 	else
+ 		ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
+ 				  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
+-				  0, cpu_to_le16(wIndex),
++				  0, wIndex,
+ 				  &tmp, sizeof(tmp), 1000);
+ 	up_read(&mixer->chip->shutdown_rwsem);
+ 
+@@ -427,7 +427,7 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
+ 	else
+ 		ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
+ 				  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
+-				  cpu_to_le16(wValue), cpu_to_le16(wIndex),
++				  wValue, wIndex,
+ 				  NULL, 0, 1000);
+ 	up_read(&mixer->chip->shutdown_rwsem);
+ 
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 1b275f0..dfbd65d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -482,7 +482,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
+ {
+ 	int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+ 				  0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+-				  cpu_to_le16(1), 0, NULL, 0, 1000);
++				  1, 0, NULL, 0, 1000);
+ 
+ 	if (ret < 0)
+ 		return ret;
+diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
+index 3eed61e..79647cd 100644
+--- a/virt/kvm/ioapic.c
++++ b/virt/kvm/ioapic.c
+@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
+ 			u64 redir_content;
+ 
+-			ASSERT(redir_index < IOAPIC_NUM_PINS);
++			if (redir_index < IOAPIC_NUM_PINS)
++				redir_content =
++					ioapic->redirtbl[redir_index].bits;
++			else
++				redir_content = ~0ULL;
+ 
+-			redir_content = ioapic->redirtbl[redir_index].bits;
+ 			result = (ioapic->ioregsel & 0x1) ?
+ 			    (redir_content >> 32) & 0xffffffff :
+ 			    redir_content & 0xffffffff;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index ec747dc..8bf05f0 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1401,21 +1401,38 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ }
+ 
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+-			      gpa_t gpa)
++			      gpa_t gpa, unsigned long len)
+ {
+ 	struct kvm_memslots *slots = kvm_memslots(kvm);
+ 	int offset = offset_in_page(gpa);
+-	gfn_t gfn = gpa >> PAGE_SHIFT;
++	gfn_t start_gfn = gpa >> PAGE_SHIFT;
++	gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
++	gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
++	gfn_t nr_pages_avail;
+ 
+ 	ghc->gpa = gpa;
+ 	ghc->generation = slots->generation;
+-	ghc->memslot = __gfn_to_memslot(slots, gfn);
+-	ghc->hva = gfn_to_hva_many(ghc->memslot, gfn, NULL);
+-	if (!kvm_is_error_hva(ghc->hva))
++	ghc->len = len;
++	ghc->memslot = __gfn_to_memslot(slots, start_gfn);
++	ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
++	if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
+ 		ghc->hva += offset;
+-	else
+-		return -EFAULT;
+-
++	} else {
++		/*
++		 * If the requested region crosses two memslots, we still
++		 * verify that the entire region is valid here.
++		 */
++		while (start_gfn <= end_gfn) {
++			ghc->memslot = __gfn_to_memslot(slots, start_gfn);
++			ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
++						   &nr_pages_avail);
++			if (kvm_is_error_hva(ghc->hva))
++				return -EFAULT;
++			start_gfn += nr_pages_avail;
++		}
++		/* Use the slow path for cross page reads and writes. */
++		ghc->memslot = NULL;
++	}
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
+@@ -1426,8 +1443,13 @@ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 	struct kvm_memslots *slots = kvm_memslots(kvm);
+ 	int r;
+ 
++	BUG_ON(len > ghc->len);
++
+ 	if (slots->generation != ghc->generation)
+-		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++	if (unlikely(!ghc->memslot))
++		return kvm_write_guest(kvm, ghc->gpa, data, len);
+ 
+ 	if (kvm_is_error_hva(ghc->hva))
+ 		return -EFAULT;
+@@ -1447,8 +1469,13 @@ int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 	struct kvm_memslots *slots = kvm_memslots(kvm);
+ 	int r;
+ 
++	BUG_ON(len > ghc->len);
++
+ 	if (slots->generation != ghc->generation)
+-		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++	if (unlikely(!ghc->memslot))
++		return kvm_read_guest(kvm, ghc->gpa, data, len);
+ 
+ 	if (kvm_is_error_hva(ghc->hva))
+ 		return -EFAULT;
diff --git a/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304181907.patch b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304271916.patch
index 38dc1b4..062dff7 100644
--- a/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304181907.patch
+++ b/3.2.44/4420_grsecurity-2.9.1-3.2.44-201304271916.patch
@@ -196,7 +196,7 @@ index dfa6fc6..fad9813 100644
 +zconf.lex.c
  zoffset.h
 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index ddbf18e..53d74a7 100644
+index 897f223..cbe33de 100644
 --- a/Documentation/kernel-parameters.txt
 +++ b/Documentation/kernel-parameters.txt
 @@ -853,6 +853,9 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
@@ -209,7 +209,7 @@ index ddbf18e..53d74a7 100644
  	hashdist=	[KNL,NUMA] Large hashes allocated during boot
  			are distributed across NUMA nodes.  Defaults on
  			for 64-bit NUMA, off otherwise.
-@@ -1940,6 +1943,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+@@ -1954,6 +1957,18 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
  			the specified number of seconds.  This is to be used if
  			your oopses keep scrolling off the screen.
  
@@ -262,7 +262,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 59130db..6da759d 100644
+index 566750c..8155f8b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -3690,10 +3690,31 @@ index fc987a1..6e068ef 100644
  #endif
  
 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 9d35a3e..556001f 100644
+index 9d35a3e..af9b6d3 100644
 --- a/arch/parisc/include/asm/pgtable.h
 +++ b/arch/parisc/include/asm/pgtable.h
-@@ -216,6 +216,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+@@ -16,6 +16,8 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+ 
++extern spinlock_t pa_dbit_lock;
++
+ /*
+  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+  * memory.  For the return value to be meaningful, ADDR must be >=
+@@ -44,8 +46,11 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+ 
+ #define set_pte_at(mm, addr, ptep, pteval)                      \
+ 	do {                                                    \
++		unsigned long flags;				\
++		spin_lock_irqsave(&pa_dbit_lock, flags);	\
+ 		set_pte(ptep, pteval);                          \
+ 		purge_tlb_entries(mm, addr);                    \
++		spin_unlock_irqrestore(&pa_dbit_lock, flags);	\
+ 	} while (0)
+ 
+ #endif /* !__ASSEMBLY__ */
+@@ -216,6 +221,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
  #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
  #define PAGE_COPY       PAGE_EXECREAD
  #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -3711,6 +3732,75 @@ index 9d35a3e..556001f 100644
  #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
  #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL_EXEC)
  #define PAGE_KERNEL_RWX	__pgprot(_PAGE_KERNEL_RWX)
+@@ -433,48 +449,46 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
+ 
+ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
++	pte_t pte;
++	unsigned long flags;
++
+ 	if (!pte_young(*ptep))
+ 		return 0;
+-	return test_and_clear_bit(xlate_pabit(_PAGE_ACCESSED_BIT), &pte_val(*ptep));
+-#else
+-	pte_t pte = *ptep;
+-	if (!pte_young(pte))
++
++	spin_lock_irqsave(&pa_dbit_lock, flags);
++	pte = *ptep;
++	if (!pte_young(pte)) {
++		spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ 		return 0;
+-	set_pte_at(vma->vm_mm, addr, ptep, pte_mkold(pte));
++	}
++	set_pte(ptep, pte_mkold(pte));
++	purge_tlb_entries(vma->vm_mm, addr);
++	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ 	return 1;
+-#endif
+ }
+ 
+-extern spinlock_t pa_dbit_lock;
+-
+ struct mm_struct;
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ 	pte_t old_pte;
++	unsigned long flags;
+ 
+-	spin_lock(&pa_dbit_lock);
++	spin_lock_irqsave(&pa_dbit_lock, flags);
+ 	old_pte = *ptep;
+ 	pte_clear(mm,addr,ptep);
+-	spin_unlock(&pa_dbit_lock);
++	purge_tlb_entries(mm, addr);
++	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ 
+ 	return old_pte;
+ }
+ 
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
+-	unsigned long new, old;
+-
+-	do {
+-		old = pte_val(*ptep);
+-		new = pte_val(pte_wrprotect(__pte (old)));
+-	} while (cmpxchg((unsigned long *) ptep, old, new) != old);
++	unsigned long flags;
++	spin_lock_irqsave(&pa_dbit_lock, flags);
++	set_pte(ptep, pte_wrprotect(*ptep));
+ 	purge_tlb_entries(mm, addr);
+-#else
+-	pte_t old_pte = *ptep;
+-	set_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+-#endif
++	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ }
+ 
+ #define pte_same(A,B)	(pte_val(A) == pte_val(B))
 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
 index ff4cf9d..c0564bb 100644
 --- a/arch/parisc/include/asm/uaccess.h
@@ -3728,6 +3818,26 @@ index ff4cf9d..c0564bb 100644
                  ret = __copy_from_user(to, from, n);
          else
                  copy_from_user_overflow();
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index 5241698..91dcb12 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -428,14 +428,11 @@ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ 	/* Note: purge_tlb_entries can be called at startup with
+ 	   no context.  */
+ 
+-	/* Disable preemption while we play with %sr1.  */
+-	preempt_disable();
++	purge_tlb_start(flags);
+ 	mtsp(mm->context, 1);
+-	purge_tlb_start(flags);
+ 	pdtlb(addr);
+ 	pitlb(addr);
+ 	purge_tlb_end(flags);
+-	preempt_enable();
+ }
+ EXPORT_SYMBOL(purge_tlb_entries);
+ 
 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
 index 5e34ccf..672bc9c 100644
 --- a/arch/parisc/kernel/module.c
@@ -11667,20 +11777,9 @@ index 5478825..839e88c 100644
  #define flush_insn_slot(p)	do { } while (0)
  
 diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index b4973f4..fc8880d 100644
+index cfb5a40..fc8880d 100644
 --- a/arch/x86/include/asm/kvm_host.h
 +++ b/arch/x86/include/asm/kvm_host.h
-@@ -393,8 +393,8 @@ struct kvm_vcpu_arch {
- 	gpa_t time;
- 	struct pvclock_vcpu_time_info hv_clock;
- 	unsigned int hw_tsc_khz;
--	unsigned int time_offset;
--	struct page *time_page;
-+	struct gfn_to_hva_cache pv_time;
-+	bool pv_time_enabled;
- 
- 	struct {
- 		u64 msr_val;
 @@ -459,7 +459,7 @@ struct kvm_arch {
  	unsigned int n_requested_mmu_pages;
  	unsigned int n_max_mmu_pages;
@@ -12159,7 +12258,7 @@ index 7639dbf..e08a58c 100644
  extern unsigned long __phys_addr(unsigned long);
  #define __phys_reloc_hide(x)	(x)
 diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index a7d2db9..e1f3a6a 100644
+index 91e758b..cac1cd6 100644
 --- a/arch/x86/include/asm/paravirt.h
 +++ b/arch/x86/include/asm/paravirt.h
 @@ -601,7 +601,7 @@ static inline pmd_t __pmd(pmdval_t val)
@@ -12190,7 +12289,7 @@ index a7d2db9..e1f3a6a 100644
  static inline void pgd_clear(pgd_t *pgdp)
  {
  	set_pgd(pgdp, __pgd(0));
-@@ -748,6 +760,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
+@@ -751,6 +763,21 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
  	pv_mmu_ops.set_fixmap(idx, phys, flags);
  }
  
@@ -12212,7 +12311,7 @@ index a7d2db9..e1f3a6a 100644
  #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
  
  static inline int arch_spin_is_locked(struct arch_spinlock *lock)
-@@ -964,7 +991,7 @@ extern void default_banner(void);
+@@ -967,7 +994,7 @@ extern void default_banner(void);
  
  #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
  #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
@@ -12221,7 +12320,7 @@ index a7d2db9..e1f3a6a 100644
  #endif
  
  #define INTERRUPT_RETURN						\
-@@ -1041,6 +1068,21 @@ extern void default_banner(void);
+@@ -1044,6 +1071,21 @@ extern void default_banner(void);
  	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
  		  CLBR_NONE,						\
  		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
@@ -12244,7 +12343,7 @@ index a7d2db9..e1f3a6a 100644
  
  #endif /* __ASSEMBLY__ */
 diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 8e8b9a4..74bb422 100644
+index faf2c04..5724dcd 100644
 --- a/arch/x86/include/asm/paravirt_types.h
 +++ b/arch/x86/include/asm/paravirt_types.h
 @@ -84,7 +84,7 @@ struct pv_init_ops {
@@ -12256,7 +12355,7 @@ index 8e8b9a4..74bb422 100644
  
  
  struct pv_lazy_ops {
-@@ -97,7 +97,7 @@ struct pv_time_ops {
+@@ -98,7 +98,7 @@ struct pv_time_ops {
  	unsigned long long (*sched_clock)(void);
  	unsigned long long (*steal_clock)(int cpu);
  	unsigned long (*get_tsc_khz)(void);
@@ -12265,7 +12364,7 @@ index 8e8b9a4..74bb422 100644
  
  struct pv_cpu_ops {
  	/* hooks for various privileged instructions */
-@@ -193,7 +193,7 @@ struct pv_cpu_ops {
+@@ -194,7 +194,7 @@ struct pv_cpu_ops {
  
  	void (*start_context_switch)(struct task_struct *prev);
  	void (*end_context_switch)(struct task_struct *next);
@@ -12274,7 +12373,7 @@ index 8e8b9a4..74bb422 100644
  
  struct pv_irq_ops {
  	/*
-@@ -224,7 +224,7 @@ struct pv_apic_ops {
+@@ -225,7 +225,7 @@ struct pv_apic_ops {
  				 unsigned long start_eip,
  				 unsigned long start_esp);
  #endif
@@ -12283,7 +12382,7 @@ index 8e8b9a4..74bb422 100644
  
  struct pv_mmu_ops {
  	unsigned long (*read_cr2)(void);
-@@ -313,6 +313,7 @@ struct pv_mmu_ops {
+@@ -314,6 +314,7 @@ struct pv_mmu_ops {
  	struct paravirt_callee_save make_pud;
  
  	void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
@@ -12291,7 +12390,7 @@ index 8e8b9a4..74bb422 100644
  #endif	/* PAGETABLE_LEVELS == 4 */
  #endif	/* PAGETABLE_LEVELS >= 3 */
  
-@@ -324,6 +325,12 @@ struct pv_mmu_ops {
+@@ -325,6 +326,12 @@ struct pv_mmu_ops {
  	   an mfn.  We can tell which is which from the index. */
  	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
  			   phys_addr_t phys, pgprot_t flags);
@@ -12304,7 +12403,7 @@ index 8e8b9a4..74bb422 100644
  };
  
  struct arch_spinlock;
-@@ -334,7 +341,7 @@ struct pv_lock_ops {
+@@ -335,7 +342,7 @@ struct pv_lock_ops {
  	void (*spin_lock_flags)(struct arch_spinlock *lock, unsigned long flags);
  	int (*spin_trylock)(struct arch_spinlock *lock);
  	void (*spin_unlock)(struct arch_spinlock *lock);
@@ -19754,7 +19853,7 @@ index 676b8c7..870ba04 100644
  	.spin_is_locked = __ticket_spin_is_locked,
  	.spin_is_contended = __ticket_spin_is_contended,
 diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index d90272e..1afe104 100644
+index 84c938f..09fb3e0 100644
 --- a/arch/x86/kernel/paravirt.c
 +++ b/arch/x86/kernel/paravirt.c
 @@ -53,6 +53,9 @@ u64 _paravirt_ident_64(u64 x)
@@ -19799,8 +19898,8 @@ index d90272e..1afe104 100644
  
  	return insn_len;
  }
-@@ -302,7 +309,7 @@ void arch_flush_lazy_mmu_mode(void)
- 	preempt_enable();
+@@ -302,7 +309,7 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
+ 	return percpu_read(paravirt_lazy_mode);
  }
  
 -struct pv_info pv_info = {
@@ -19875,7 +19974,7 @@ index d90272e..1afe104 100644
  #endif
  #endif /* PAGETABLE_LEVELS >= 3 */
  
-@@ -478,6 +491,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+@@ -479,6 +492,12 @@ struct pv_mmu_ops pv_mmu_ops = {
  	},
  
  	.set_fixmap = native_set_fixmap,
@@ -22248,45 +22347,10 @@ index 407789b..5570a86 100644
  
  	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index f4063fd..8ed079b 100644
+index e82a53a..6b38ed8 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
-@@ -1105,7 +1105,6 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- {
- 	unsigned long flags;
- 	struct kvm_vcpu_arch *vcpu = &v->arch;
--	void *shared_kaddr;
- 	unsigned long this_tsc_khz;
- 	s64 kernel_ns, max_kernel_ns;
- 	u64 tsc_timestamp;
-@@ -1141,7 +1140,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- 
- 	local_irq_restore(flags);
- 
--	if (!vcpu->time_page)
-+	if (!vcpu->pv_time_enabled)
- 		return 0;
- 
- 	/*
-@@ -1199,14 +1198,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- 	 */
- 	vcpu->hv_clock.version += 2;
- 
--	shared_kaddr = kmap_atomic(vcpu->time_page, KM_USER0);
--
--	memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
--	       sizeof(vcpu->hv_clock));
--
--	kunmap_atomic(shared_kaddr, KM_USER0);
--
--	mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
-+	kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
-+				&vcpu->hv_clock,
-+				sizeof(vcpu->hv_clock));
- 	return 0;
- }
- 
-@@ -1348,8 +1342,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1342,8 +1342,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
  {
  	struct kvm *kvm = vcpu->kvm;
  	int lm = is_long_mode(vcpu);
@@ -22297,54 +22361,7 @@ index f4063fd..8ed079b 100644
  	u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
  		: kvm->arch.xen_hvm_config.blob_size_32;
  	u32 page_num = data & ~PAGE_MASK;
-@@ -1496,10 +1490,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
- 
- static void kvmclock_reset(struct kvm_vcpu *vcpu)
- {
--	if (vcpu->arch.time_page) {
--		kvm_release_page_dirty(vcpu->arch.time_page);
--		vcpu->arch.time_page = NULL;
--	}
-+	vcpu->arch.pv_time_enabled = false;
- }
- 
- static void accumulate_steal_time(struct kvm_vcpu *vcpu)
-@@ -1591,6 +1582,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
- 		break;
- 	case MSR_KVM_SYSTEM_TIME_NEW:
- 	case MSR_KVM_SYSTEM_TIME: {
-+		u64 gpa_offset;
- 		kvmclock_reset(vcpu);
- 
- 		vcpu->arch.time = data;
-@@ -1600,16 +1592,18 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
- 		if (!(data & 1))
- 			break;
- 
--		/* ...but clean it before doing the actual write */
--		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-+		gpa_offset = data & ~(PAGE_MASK | 1);
- 
--		vcpu->arch.time_page =
--				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
-+		/* Check that address+len does not cross page boundary */
-+		if ((gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1)
-+		    & PAGE_MASK)
-+			break;
- 
--		if (is_error_page(vcpu->arch.time_page)) {
--			kvm_release_page_clean(vcpu->arch.time_page);
--			vcpu->arch.time_page = NULL;
--		}
-+		if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
-+		     &vcpu->arch.pv_time, data & ~1ULL))
-+			vcpu->arch.pv_time_enabled = false;
-+		else
-+			vcpu->arch.pv_time_enabled = true;
- 		break;
- 	}
- 	case MSR_KVM_ASYNC_PF_EN:
-@@ -2168,6 +2162,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2160,6 +2160,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
  		if (n < msr_list.nmsrs)
  			goto out;
  		r = -EFAULT;
@@ -22353,7 +22370,7 @@ index f4063fd..8ed079b 100644
  		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
  				 num_msrs_to_save * sizeof(u32)))
  			goto out;
-@@ -2343,15 +2339,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2335,15 +2337,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
  				     struct kvm_cpuid2 *cpuid,
  				     struct kvm_cpuid_entry2 __user *entries)
  {
@@ -22377,7 +22394,7 @@ index f4063fd..8ed079b 100644
  	vcpu->arch.cpuid_nent = cpuid->nent;
  	kvm_apic_set_version(vcpu);
  	kvm_x86_ops->cpuid_update(vcpu);
-@@ -2366,15 +2367,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2358,15 +2365,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
  				     struct kvm_cpuid2 *cpuid,
  				     struct kvm_cpuid_entry2 __user *entries)
  {
@@ -22400,7 +22417,7 @@ index f4063fd..8ed079b 100644
  	return 0;
  
  out:
-@@ -2749,7 +2754,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2741,7 +2752,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
  static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
  				    struct kvm_interrupt *irq)
  {
@@ -22409,7 +22426,7 @@ index f4063fd..8ed079b 100644
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -5191,7 +5196,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5183,7 +5194,7 @@ static void kvm_set_mmio_spte_mask(void)
  	kvm_mmu_set_mmio_spte_mask(mask);
  }
  
@@ -22418,16 +22435,8 @@ index f4063fd..8ed079b 100644
  {
  	int r;
  	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-@@ -6549,6 +6554,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- 	if (!zalloc_cpumask_var(&vcpu->arch.wbinvd_dirty_mask, GFP_KERNEL))
- 		goto fail_free_mce_banks;
- 
-+	vcpu->arch.pv_time_enabled = false;
- 	kvm_async_pf_hash_reset(vcpu);
- 
- 	return 0;
 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index cf4603b..7cdde38 100644
+index 8f4fda4..353d5cc 100644
 --- a/arch/x86/lguest/boot.c
 +++ b/arch/x86/lguest/boot.c
 @@ -1195,9 +1195,10 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
@@ -25416,7 +25425,7 @@ index d0474ad..36e9257 100644
  		extern u32 pnp_bios_is_utter_crap;
  		pnp_bios_is_utter_crap = 1;
 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index 7b73c88..a561402 100644
+index 53a7b69..0b31dac 100644
 --- a/arch/x86/mm/fault.c
 +++ b/arch/x86/mm/fault.c
 @@ -13,11 +13,18 @@
@@ -25572,7 +25581,7 @@ index 7b73c88..a561402 100644
  	pgd_ref = pgd_offset_k(address);
  	if (pgd_none(*pgd_ref))
  		return -1;
-@@ -540,7 +611,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
+@@ -542,7 +613,7 @@ static int is_errata93(struct pt_regs *regs, unsigned long address)
  static int is_errata100(struct pt_regs *regs, unsigned long address)
  {
  #ifdef CONFIG_X86_64
@@ -25581,7 +25590,7 @@ index 7b73c88..a561402 100644
  		return 1;
  #endif
  	return 0;
-@@ -567,7 +638,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
+@@ -569,7 +640,7 @@ static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
  }
  
  static const char nx_warning[] = KERN_CRIT
@@ -25590,7 +25599,7 @@ index 7b73c88..a561402 100644
  
  static void
  show_fault_oops(struct pt_regs *regs, unsigned long error_code,
-@@ -576,15 +647,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
+@@ -578,15 +649,26 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code,
  	if (!oops_may_print())
  		return;
  
@@ -25619,7 +25628,7 @@ index 7b73c88..a561402 100644
  	printk(KERN_ALERT "BUG: unable to handle kernel ");
  	if (address < PAGE_SIZE)
  		printk(KERN_CONT "NULL pointer dereference");
-@@ -738,6 +820,22 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
+@@ -740,6 +822,22 @@ __bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
  				return;
  		}
  #endif
@@ -25642,7 +25651,7 @@ index 7b73c88..a561402 100644
  		/* Kernel addresses are always protection faults: */
  		if (address >= TASK_SIZE)
  			error_code |= PF_PROT;
-@@ -837,7 +935,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
+@@ -839,7 +937,7 @@ do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
  	if (fault & (VM_FAULT_HWPOISON|VM_FAULT_HWPOISON_LARGE)) {
  		printk(KERN_ERR
  	"MCE: Killing %s:%d due to hardware memory corruption fault at %lx\n",
@@ -25651,7 +25660,7 @@ index 7b73c88..a561402 100644
  		code = BUS_MCEERR_AR;
  	}
  #endif
-@@ -892,6 +990,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
+@@ -894,6 +992,99 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
  	return 1;
  }
  
@@ -25751,7 +25760,7 @@ index 7b73c88..a561402 100644
  /*
   * Handle a spurious fault caused by a stale TLB entry.
   *
-@@ -964,6 +1155,9 @@ int show_unhandled_signals = 1;
+@@ -966,6 +1157,9 @@ int show_unhandled_signals = 1;
  static inline int
  access_error(unsigned long error_code, struct vm_area_struct *vma)
  {
@@ -25761,7 +25770,7 @@ index 7b73c88..a561402 100644
  	if (error_code & PF_WRITE) {
  		/* write, present and write, not present: */
  		if (unlikely(!(vma->vm_flags & VM_WRITE)))
-@@ -997,18 +1191,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -999,18 +1193,32 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
  {
  	struct vm_area_struct *vma;
  	struct task_struct *tsk;
@@ -25799,7 +25808,7 @@ index 7b73c88..a561402 100644
  
  	/*
  	 * Detect and handle instructions that would cause a page fault for
-@@ -1069,7 +1277,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
+@@ -1071,7 +1279,7 @@ do_page_fault(struct pt_regs *regs, unsigned long error_code)
  	 * User-mode registers count as a user access even for any
  	 * potential system fault or CPU buglet:
  	 */
@@ -25808,7 +25817,7 @@ index 7b73c88..a561402 100644
  		local_irq_enable();
  		error_code |= PF_USER;
  	} else {
-@@ -1124,6 +1332,11 @@ retry:
+@@ -1126,6 +1334,11 @@ retry:
  		might_sleep();
  	}
  
@@ -25820,7 +25829,7 @@ index 7b73c88..a561402 100644
  	vma = find_vma(mm, address);
  	if (unlikely(!vma)) {
  		bad_area(regs, error_code, address);
-@@ -1135,18 +1348,24 @@ retry:
+@@ -1137,18 +1350,24 @@ retry:
  		bad_area(regs, error_code, address);
  		return;
  	}
@@ -25856,7 +25865,7 @@ index 7b73c88..a561402 100644
  	if (unlikely(expand_stack(vma, address))) {
  		bad_area(regs, error_code, address);
  		return;
-@@ -1201,3 +1420,292 @@ good_area:
+@@ -1203,3 +1422,292 @@ good_area:
  
  	up_read(&mm->mmap_sem);
  }
@@ -29500,7 +29509,7 @@ index 69b9ef6..aa929bc 100644
  };
  
 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 2b8b0de..0787f8a 100644
+index fe00be69..d2c142a 100644
 --- a/arch/x86/xen/mmu.c
 +++ b/arch/x86/xen/mmu.c
 @@ -1757,6 +1757,9 @@ pgd_t * __init xen_setup_kernel_pagetable(pgd_t *pgd,
@@ -30144,10 +30153,10 @@ index 3c92dbd..008b08b 100644
  				unsigned long timeout_msec)
  {
 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index c9540c0..963b068 100644
+index 288b635..455273d 100644
 --- a/drivers/ata/libata-core.c
 +++ b/drivers/ata/libata-core.c
-@@ -4735,7 +4735,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
+@@ -4739,7 +4739,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	unsigned int tag;
  
@@ -30156,7 +30165,7 @@ index c9540c0..963b068 100644
  	ap = qc->ap;
  
  	qc->flags = 0;
-@@ -4751,7 +4751,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
+@@ -4755,7 +4755,7 @@ void __ata_qc_complete(struct ata_queued_cmd *qc)
  	struct ata_port *ap;
  	struct ata_link *link;
  
@@ -30165,7 +30174,7 @@ index c9540c0..963b068 100644
  	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
  	ap = qc->ap;
  	link = qc->dev->link;
-@@ -5756,6 +5756,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5760,6 +5760,7 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		return;
  
  	spin_lock(&lock);
@@ -30173,7 +30182,7 @@ index c9540c0..963b068 100644
  
  	for (cur = ops->inherits; cur; cur = cur->inherits) {
  		void **inherit = (void **)cur;
-@@ -5769,8 +5770,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
+@@ -5773,8 +5774,9 @@ static void ata_finalize_port_ops(struct ata_port_operations *ops)
  		if (IS_ERR(*pp))
  			*pp = NULL;
  
@@ -33681,10 +33690,10 @@ index ca67338..0003ba7 100644
  	return can_switch;
  }
 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 012a9d2..3b2267c 100644
+index 144d37c..bf1110f 100644
 --- a/drivers/gpu/drm/i915/i915_drv.h
 +++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -319,7 +319,7 @@ typedef struct drm_i915_private {
+@@ -320,7 +320,7 @@ typedef struct drm_i915_private {
  	int current_page;
  	int page_flipping;
  
@@ -33693,7 +33702,7 @@ index 012a9d2..3b2267c 100644
  
  	/* protects the irq masks */
  	spinlock_t irq_lock;
-@@ -896,7 +896,7 @@ struct drm_i915_gem_object {
+@@ -897,7 +897,7 @@ struct drm_i915_gem_object {
  	 * will be page flipped away on the next vblank.  When it
  	 * reaches 0, dev_priv->pending_flip_queue will be woken up.
  	 */
@@ -33702,7 +33711,7 @@ index 012a9d2..3b2267c 100644
  };
  
  #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
-@@ -1273,7 +1273,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
+@@ -1274,7 +1274,7 @@ extern int intel_setup_gmbus(struct drm_device *dev);
  extern void intel_teardown_gmbus(struct drm_device *dev);
  extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
  extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
@@ -33830,10 +33839,10 @@ index 93e74fb..4a1182d 100644
  	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
  	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 17961df..8ef9827 100644
+index 897ca06..ea0a32a 100644
 --- a/drivers/gpu/drm/i915/intel_display.c
 +++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -2214,7 +2214,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
+@@ -2215,7 +2215,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb)
  
  	wait_event(dev_priv->pending_flip_queue,
  		   atomic_read(&dev_priv->mm.wedged) ||
@@ -33842,7 +33851,7 @@ index 17961df..8ef9827 100644
  
  	/* Big Hammer, we also need to ensure that any pending
  	 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
-@@ -6986,8 +6986,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
+@@ -6987,8 +6987,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev,
  
  	obj = work->old_fb_obj;
  
@@ -33852,7 +33861,7 @@ index 17961df..8ef9827 100644
  
  	wake_up(&dev_priv->pending_flip_queue);
  	schedule_work(&work->work);
-@@ -7196,7 +7195,13 @@ static int intel_gen6_queue_flip(struct drm_device *dev,
+@@ -7197,7 +7196,13 @@ static int intel_gen6_queue_flip(struct drm_device *dev,
  	OUT_RING(fb->pitch | obj->tiling_mode);
  	OUT_RING(obj->gtt_offset);
  
@@ -33867,7 +33876,7 @@ index 17961df..8ef9827 100644
  	pipesrc = I915_READ(PIPESRC(intel_crtc->pipe)) & 0x0fff0fff;
  	OUT_RING(pf | pipesrc);
  
-@@ -7328,7 +7333,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7329,7 +7334,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	/* Block clients from rendering to the new back buffer until
  	 * the flip occurs and the object is no longer visible.
  	 */
@@ -33876,7 +33885,7 @@ index 17961df..8ef9827 100644
  
  	ret = dev_priv->display.queue_flip(dev, crtc, fb, obj);
  	if (ret)
-@@ -7342,7 +7347,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
+@@ -7343,7 +7348,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
  	return 0;
  
  cleanup_pending:
@@ -33885,7 +33894,7 @@ index 17961df..8ef9827 100644
  	crtc->fb = old_fb;
  	drm_gem_object_unreference(&work->old_fb_obj->base);
  	drm_gem_object_unreference(&obj->base);
-@@ -7477,11 +7482,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
+@@ -7478,11 +7483,15 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
  	if (HAS_PCH_SPLIT(dev)) {
  		if (pipe == 2 && IS_IVYBRIDGE(dev))
  			intel_crtc->no_pll = true;
@@ -33905,15 +33914,15 @@ index 17961df..8ef9827 100644
  	}
  
  	drm_crtc_helper_add(&intel_crtc->base, &intel_helper_funcs);
-@@ -8836,7 +8845,7 @@ struct intel_quirk {
+@@ -8847,7 +8856,7 @@ struct intel_quirk {
  	int subsystem_vendor;
  	int subsystem_device;
  	void (*hook)(struct drm_device *dev);
 -};
 +} __do_const;
  
- struct intel_quirk intel_quirks[] = {
- 	/* HP Compaq 2730p needs pipe A force quirk (LP: #291555) */
+ /* For systems that don't have a meaningful PCI subdevice/subvendor ID */
+ struct intel_dmi_quirk {
 diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
 index 54558a0..2d97005 100644
 --- a/drivers/gpu/drm/mga/mga_drv.h
@@ -38605,80 +38614,10 @@ index a3f7a27..234016e 100644
  
  	/* Don't allow a single read to cross a 512-byte block boundary */
 diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
-index e7dc732..58ec627 100644
+index 1d90e26..865d439 100644
 --- a/drivers/mtd/mtdchar.c
 +++ b/drivers/mtd/mtdchar.c
-@@ -1141,6 +1141,33 @@ static unsigned long mtd_get_unmapped_area(struct file *file,
- }
- #endif
- 
-+static inline unsigned long get_vm_size(struct vm_area_struct *vma)
-+{
-+	return vma->vm_end - vma->vm_start;
-+}
-+
-+static inline resource_size_t get_vm_offset(struct vm_area_struct *vma)
-+{
-+	return (resource_size_t) vma->vm_pgoff << PAGE_SHIFT;
-+}
-+
-+/*
-+ * Set a new vm offset.
-+ *
-+ * Verify that the incoming offset really works as a page offset,
-+ * and that the offset and size fit in a resource_size_t.
-+ */
-+static inline int set_vm_offset(struct vm_area_struct *vma, resource_size_t off)
-+{
-+	pgoff_t pgoff = off >> PAGE_SHIFT;
-+	if (off != (resource_size_t) pgoff << PAGE_SHIFT)
-+		return -EINVAL;
-+	if (off + get_vm_size(vma) - 1 < off)
-+		return -EINVAL;
-+	vma->vm_pgoff = pgoff;
-+	return 0;
-+}
-+
- /*
-  * set up a mapping for shared memory segments
-  */
-@@ -1150,20 +1177,29 @@ static int mtd_mmap(struct file *file, struct vm_area_struct *vma)
- 	struct mtd_file_info *mfi = file->private_data;
- 	struct mtd_info *mtd = mfi->mtd;
- 	struct map_info *map = mtd->priv;
--	unsigned long start;
--	unsigned long off;
--	u32 len;
-+	resource_size_t start, off;
-+	unsigned long len, vma_len;
- 
- 	if (mtd->type == MTD_RAM || mtd->type == MTD_ROM) {
--		off = vma->vm_pgoff << PAGE_SHIFT;
-+		off = get_vm_offset(vma);
- 		start = map->phys;
- 		len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
- 		start &= PAGE_MASK;
--		if ((vma->vm_end - vma->vm_start + off) > len)
-+		vma_len = get_vm_size(vma);
-+
-+		/* Overflow in off+len? */
-+		if (vma_len + off < off)
-+			return -EINVAL;
-+		/* Does it fit in the mapping? */
-+		if (vma_len + off > len)
- 			return -EINVAL;
- 
- 		off += start;
--		vma->vm_pgoff = off >> PAGE_SHIFT;
-+		/* Did that overflow? */
-+		if (off < start)
-+			return -EINVAL;
-+		if (set_vm_offset(vma, off) < 0)
-+			return -EINVAL;
- 		vma->vm_flags |= VM_IO | VM_RESERVED;
- 
- #ifdef pgprot_noncached
-@@ -1211,6 +1247,7 @@ static struct file_system_type mtd_inodefs_type = {
+@@ -1215,6 +1215,7 @@ static struct file_system_type mtd_inodefs_type = {
         .mount = mtd_inodefs_mount,
         .kill_sb = kill_anon_super,
  };
@@ -39257,7 +39196,7 @@ index 49b549f..13d648c 100644
  
  	mac->phydev = phydev;
 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index a6153f1..4bdf0c8 100644
+index d812790..d1e0f1a 100644
 --- a/drivers/net/ethernet/realtek/r8169.c
 +++ b/drivers/net/ethernet/realtek/r8169.c
 @@ -704,17 +704,17 @@ struct rtl8169_private {
@@ -42469,7 +42408,7 @@ index 6845228..df77141 100644
  
  		core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 9176b2e..0859fe0 100644
+index 898c1de..b2ca488 100644
 --- a/drivers/target/target_core_transport.c
 +++ b/drivers/target/target_core_transport.c
 @@ -1343,7 +1343,7 @@ struct se_device *transport_add_device_to_core_hba(
@@ -42481,7 +42420,7 @@ index 9176b2e..0859fe0 100644
  
  	se_dev_set_default_attribs(dev, dev_limits);
  
-@@ -1530,7 +1530,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
+@@ -1531,7 +1531,7 @@ static int transport_check_alloc_task_attr(struct se_cmd *cmd)
  	 * Used to determine when ORDERED commands should go from
  	 * Dormant to Active status.
  	 */
@@ -42490,7 +42429,7 @@ index 9176b2e..0859fe0 100644
  	smp_mb__after_atomic_inc();
  	pr_debug("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
  			cmd->se_ordered_id, cmd->sam_task_attr,
-@@ -1800,7 +1800,7 @@ static void transport_generic_request_failure(struct se_cmd *cmd)
+@@ -1801,7 +1801,7 @@ static void transport_generic_request_failure(struct se_cmd *cmd)
  		" t_transport_active: %d t_transport_stop: %d"
  		" t_transport_sent: %d\n", cmd->t_task_list_num,
  		atomic_read(&cmd->t_task_cdbs_left),
@@ -42499,7 +42438,7 @@ index 9176b2e..0859fe0 100644
  		atomic_read(&cmd->t_task_cdbs_ex_left),
  		atomic_read(&cmd->t_transport_active),
  		atomic_read(&cmd->t_transport_stop),
-@@ -2090,9 +2090,9 @@ check_depth:
+@@ -2091,9 +2091,9 @@ check_depth:
  
  	spin_lock_irqsave(&cmd->t_state_lock, flags);
  	task->task_flags |= (TF_ACTIVE | TF_SENT);
@@ -42511,7 +42450,7 @@ index 9176b2e..0859fe0 100644
  	    cmd->t_task_list_num)
  		atomic_set(&cmd->t_transport_sent, 1);
  
-@@ -4303,7 +4303,7 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
+@@ -4304,7 +4304,7 @@ bool transport_wait_for_tasks(struct se_cmd *cmd)
  		atomic_set(&cmd->transport_lun_stop, 0);
  	}
  	if (!atomic_read(&cmd->t_transport_active) ||
@@ -42520,7 +42459,7 @@ index 9176b2e..0859fe0 100644
  		spin_unlock_irqrestore(&cmd->t_state_lock, flags);
  		return false;
  	}
-@@ -4561,7 +4561,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
+@@ -4562,7 +4562,7 @@ int transport_check_aborted_status(struct se_cmd *cmd, int send_status)
  {
  	int ret = 0;
  
@@ -42529,7 +42468,7 @@ index 9176b2e..0859fe0 100644
  		if (!send_status ||
  		     (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
  			return 1;
-@@ -4598,7 +4598,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
+@@ -4599,7 +4599,7 @@ void transport_send_task_abort(struct se_cmd *cmd)
  	 */
  	if (cmd->data_direction == DMA_TO_DEVICE) {
  		if (cmd->se_tfo->write_pending_status(cmd) != 0) {
@@ -42960,10 +42899,47 @@ index 43db715..82134aa 100644
  
  		if (get_user(c, buf))
 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index 05085be..67eadb0 100644
+index 05085be..ca1e67e 100644
 --- a/drivers/tty/tty_io.c
 +++ b/drivers/tty/tty_io.c
-@@ -3240,7 +3240,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+@@ -940,6 +940,14 @@ void start_tty(struct tty_struct *tty)
+ 
+ EXPORT_SYMBOL(start_tty);
+ 
++static void tty_update_time(struct timespec *time)
++{
++	unsigned long sec = get_seconds();
++	sec -= sec % 60;
++	if ((long)(sec - time->tv_sec) > 0)
++		time->tv_sec = sec;
++}
++
+ /**
+  *	tty_read	-	read method for tty device files
+  *	@file: pointer to tty file
+@@ -976,8 +984,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ 	else
+ 		i = -EIO;
+ 	tty_ldisc_deref(ld);
++
+ 	if (i > 0)
+-		inode->i_atime = current_fs_time(inode->i_sb);
++		tty_update_time(&inode->i_atime);
++
+ 	return i;
+ }
+ 
+@@ -1079,8 +1089,7 @@ static inline ssize_t do_tty_write(
+ 		cond_resched();
+ 	}
+ 	if (written) {
+-		struct inode *inode = file->f_path.dentry->d_inode;
+-		inode->i_mtime = current_fs_time(inode->i_sb);
++		tty_update_time(&file->f_path.dentry->d_inode->i_mtime);
+ 		ret = written;
+ 	}
+ out:
+@@ -3240,7 +3249,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
  
  void tty_default_fops(struct file_operations *fops)
  {
@@ -43623,7 +43599,7 @@ index e132157..516db70 100644
  		return rc;
  
 diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
-index 9b8bcab..cc61f88 100644
+index 7a36dff..cbe139a 100644
 --- a/drivers/video/console/fbcon.c
 +++ b/drivers/video/console/fbcon.c
 @@ -450,7 +450,7 @@ static int __init fb_console_setup(char *this_opt)
@@ -43674,7 +43650,7 @@ index 5c3960d..15cf8fc 100644
  		goto out1;
  	}
 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index c133dde..478888d 100644
+index babbb07..649d8d2 100644
 --- a/drivers/video/fbmem.c
 +++ b/drivers/video/fbmem.c
 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
@@ -48334,10 +48310,10 @@ index dede441..f2a2507 100644
  
  		WARN_ON(trans->transid != btrfs_header_generation(parent));
 diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index fd1a06d..6e9033d 100644
+index 1372634..f1db831 100644
 --- a/fs/btrfs/inode.c
 +++ b/fs/btrfs/inode.c
-@@ -6895,7 +6895,7 @@ fail:
+@@ -6909,7 +6909,7 @@ fail:
  	return -ENOMEM;
  }
  
@@ -48346,7 +48322,7 @@ index fd1a06d..6e9033d 100644
  			 struct dentry *dentry, struct kstat *stat)
  {
  	struct inode *inode = dentry->d_inode;
-@@ -6909,6 +6909,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
+@@ -6923,6 +6923,14 @@ static int btrfs_getattr(struct vfsmount *mnt,
  	return 0;
  }
  
@@ -52383,19 +52359,6 @@ index 1b55f70..bd6c289 100644
  
  static void hfs_init_once(void *p)
  {
-diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
-index 5849e3e..32b12e5 100644
---- a/fs/hfsplus/extents.c
-+++ b/fs/hfsplus/extents.c
-@@ -517,7 +517,7 @@ void hfsplus_file_truncate(struct inode *inode)
- 		struct address_space *mapping = inode->i_mapping;
- 		struct page *page;
- 		void *fsdata;
--		u32 size = inode->i_size;
-+		loff_t size = inode->i_size;
- 
- 		res = pagecache_write_begin(NULL, mapping, size, 0,
- 						AOP_FLAG_UNINTERRUPTIBLE,
 diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
 index d24a9b6..b398147 100644
 --- a/fs/hfsplus/super.c
@@ -52514,18 +52477,9 @@ index 0aa424a..332097d8 100644
  static int can_do_hugetlb_shm(void)
  {
 diff --git a/fs/inode.c b/fs/inode.c
-index ee4e66b..e6f3833 100644
+index e2d3633..e6f3833 100644
 --- a/fs/inode.c
 +++ b/fs/inode.c
-@@ -634,7 +634,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
- 		 * inode to the back of the list so we don't spin on it.
- 		 */
- 		if (!spin_trylock(&inode->i_lock)) {
--			list_move_tail(&inode->i_lru, &sb->s_inode_lru);
-+			list_move(&inode->i_lru, &sb->s_inode_lru);
- 			continue;
- 		}
- 
 @@ -787,8 +787,8 @@ unsigned int get_next_ino(void)
  
  #ifdef CONFIG_SMP
@@ -69745,45 +69699,8 @@ index f66b065..c2c29b4 100644
  
  int kobj_ns_type_register(const struct kobj_ns_type_operations *ops);
  int kobj_ns_type_registered(enum kobj_ns_type type);
-diff --git a/include/linux/kref.h b/include/linux/kref.h
-index d4a62ab..d064502 100644
---- a/include/linux/kref.h
-+++ b/include/linux/kref.h
-@@ -16,6 +16,7 @@
- #define _KREF_H_
- 
- #include <linux/types.h>
-+#include <linux/atomic.h>
- 
- struct kref {
- 	atomic_t refcount;
-@@ -27,4 +28,24 @@ int kref_put(struct kref *kref, void (*release) (struct kref *kref));
- int kref_sub(struct kref *kref, unsigned int count,
- 	     void (*release) (struct kref *kref));
- 
-+/**
-+ * kref_get_unless_zero - Increment refcount for object unless it is zero.
-+ * @kref: object.
-+ *
-+ * Return non-zero if the increment succeeded. Otherwise return 0.
-+ *
-+ * This function is intended to simplify locking around refcounting for
-+ * objects that can be looked up from a lookup structure, and which are
-+ * removed from that lookup structure in the object destructor.
-+ * Operations on such objects require at least a read lock around
-+ * lookup + kref_get, and a write lock around kref_put + remove from lookup
-+ * structure. Furthermore, RCU implementations become extremely tricky.
-+ * With a lookup followed by a kref_get_unless_zero *with return value check*
-+ * locking in the kref_put path can be deferred to the actual removal from
-+ * the lookup structure and RCU lookups become trivial.
-+ */
-+static inline int __must_check kref_get_unless_zero(struct kref *kref)
-+{
-+	return atomic_add_unless(&kref->refcount, 1, 0);
-+}
- #endif /* _KREF_H_ */
 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 6136821..da8ced0 100644
+index e6796c1..350d338 100644
 --- a/include/linux/kvm_host.h
 +++ b/include/linux/kvm_host.h
 @@ -308,7 +308,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
@@ -69805,10 +69722,10 @@ index 6136821..da8ced0 100644
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
 diff --git a/include/linux/libata.h b/include/linux/libata.h
-index cafc09a..d7e7829 100644
+index 62467ca..3d65d7d 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
-@@ -909,7 +909,7 @@ struct ata_port_operations {
+@@ -910,7 +910,7 @@ struct ata_port_operations {
  	 * fields must be pointers.
  	 */
  	const struct ata_port_operations	*inherits;
@@ -75190,10 +75107,10 @@ index 9b22d03..6295b62 100644
  				prev->next = info->next;
  			else
 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index cdd5607..c3fc919 100644
+index e4cee8d..f31f503 100644
 --- a/kernel/hrtimer.c
 +++ b/kernel/hrtimer.c
-@@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1408,7 +1408,7 @@ void hrtimer_peek_ahead_timers(void)
  	local_irq_restore(flags);
  }
  
@@ -75202,7 +75119,7 @@ index cdd5607..c3fc919 100644
  {
  	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
  
-@@ -1751,7 +1751,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
+@@ -1750,7 +1750,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -77677,10 +77594,10 @@ index 3d9f31c..7fefc9e 100644
  
  	default:
 diff --git a/kernel/sched.c b/kernel/sched.c
-index eeeec4e..9240d2d 100644
+index d08c9f4..9a9af37 100644
 --- a/kernel/sched.c
 +++ b/kernel/sched.c
-@@ -5044,7 +5044,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
+@@ -5046,7 +5046,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
   * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
   * positive (at least 1, or number of jiffies left till timeout) if completed.
   */
@@ -77689,7 +77606,7 @@ index eeeec4e..9240d2d 100644
  wait_for_completion_interruptible_timeout(struct completion *x,
  					  unsigned long timeout)
  {
-@@ -5061,7 +5061,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
+@@ -5063,7 +5063,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
   *
   * The return value is -ERESTARTSYS if interrupted, 0 if completed.
   */
@@ -77698,7 +77615,7 @@ index eeeec4e..9240d2d 100644
  {
  	long t = wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_KILLABLE);
  	if (t == -ERESTARTSYS)
-@@ -5082,7 +5082,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
+@@ -5084,7 +5084,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
   * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
   * positive (at least 1, or number of jiffies left till timeout) if completed.
   */
@@ -77707,7 +77624,7 @@ index eeeec4e..9240d2d 100644
  wait_for_completion_killable_timeout(struct completion *x,
  				     unsigned long timeout)
  {
-@@ -5291,6 +5291,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -5293,6 +5293,8 @@ int can_nice(const struct task_struct *p, const int nice)
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = 20 - nice;
  
@@ -77716,7 +77633,7 @@ index eeeec4e..9240d2d 100644
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -5324,7 +5326,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -5326,7 +5328,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (nice > 19)
  		nice = 19;
  
@@ -77726,7 +77643,7 @@ index eeeec4e..9240d2d 100644
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -5481,6 +5484,7 @@ recheck:
+@@ -5483,6 +5486,7 @@ recheck:
  			unsigned long rlim_rtprio =
  					task_rlimit(p, RLIMIT_RTPRIO);
  
@@ -77734,7 +77651,7 @@ index eeeec4e..9240d2d 100644
  			/* can't set/change the rt policy */
  			if (policy != p->policy && !rlim_rtprio)
  				return -EPERM;
-@@ -6624,7 +6628,7 @@ static void migrate_tasks(unsigned int dead_cpu)
+@@ -6626,7 +6630,7 @@ static void migrate_tasks(unsigned int dead_cpu)
  
  #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
  
@@ -77743,7 +77660,7 @@ index eeeec4e..9240d2d 100644
  	{
  		.procname	= "sched_domain",
  		.mode		= 0555,
-@@ -6641,17 +6645,17 @@ static struct ctl_table sd_ctl_root[] = {
+@@ -6643,17 +6647,17 @@ static struct ctl_table sd_ctl_root[] = {
  	{}
  };
  
@@ -77765,7 +77682,7 @@ index eeeec4e..9240d2d 100644
  
  	/*
  	 * In the intermediate directories, both the child directory and
-@@ -6659,19 +6663,22 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -6661,19 +6665,22 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
  	 * will always be set. In the lowest directory the names are
  	 * static strings and all have proc handlers.
  	 */
@@ -77794,7 +77711,7 @@ index eeeec4e..9240d2d 100644
  		const char *procname, void *data, int maxlen,
  		mode_t mode, proc_handler *proc_handler)
  {
-@@ -6685,7 +6692,7 @@ set_table_entry(struct ctl_table *entry,
+@@ -6687,7 +6694,7 @@ set_table_entry(struct ctl_table *entry,
  static struct ctl_table *
  sd_alloc_ctl_domain_table(struct sched_domain *sd)
  {
@@ -77803,7 +77720,7 @@ index eeeec4e..9240d2d 100644
  
  	if (table == NULL)
  		return NULL;
-@@ -6720,9 +6727,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -6722,9 +6729,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
  	return table;
  }
  
@@ -77815,7 +77732,7 @@ index eeeec4e..9240d2d 100644
  	struct sched_domain *sd;
  	int domain_num = 0, i;
  	char buf[32];
-@@ -6749,11 +6756,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -6751,11 +6758,13 @@ static struct ctl_table_header *sd_sysctl_header;
  static void register_sched_domain_sysctl(void)
  {
  	int i, cpu_num = num_possible_cpus();
@@ -77830,7 +77747,7 @@ index eeeec4e..9240d2d 100644
  
  	if (entry == NULL)
  		return;
-@@ -6776,8 +6785,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -6778,8 +6787,12 @@ static void unregister_sched_domain_sysctl(void)
  	if (sd_sysctl_header)
  		unregister_sysctl_table(sd_sysctl_header);
  	sd_sysctl_header = NULL;
@@ -77845,7 +77762,7 @@ index eeeec4e..9240d2d 100644
  }
  #else
  static void register_sched_domain_sysctl(void)
-@@ -6875,7 +6888,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+@@ -6877,7 +6890,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
   * happens before everything else.  This has to be lower priority than
   * the notifier in the perf_event subsystem, though.
   */
@@ -77890,7 +77807,7 @@ index 66e4576..d05c6d5 100644
  	int this_cpu = smp_processor_id();
  	struct rq *this_rq = cpu_rq(this_cpu);
 diff --git a/kernel/signal.c b/kernel/signal.c
-index ea76d30..7b5d245 100644
+index 3ecf574..7b5d245 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
 @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -78016,15 +77933,6 @@ index ea76d30..7b5d245 100644
  	if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
  		error = check_kill_permission(sig, info, p);
  		/*
-@@ -2790,7 +2821,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
- 
- static int do_tkill(pid_t tgid, pid_t pid, int sig)
- {
--	struct siginfo info;
-+	struct siginfo info = {};
- 
- 	info.si_signo = sig;
- 	info.si_errno = 0;
 diff --git a/kernel/smp.c b/kernel/smp.c
 index 9e800b2..1533ba5 100644
 --- a/kernel/smp.c
@@ -78151,7 +78059,7 @@ index 2f194e9..2c05ea9 100644
  	.priority	= 10,
  };
 diff --git a/kernel/sys.c b/kernel/sys.c
-index f5939c2..3084a61 100644
+index be5fa8b..3f10c33 100644
 --- a/kernel/sys.c
 +++ b/kernel/sys.c
 @@ -158,6 +158,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error)
@@ -78167,7 +78075,7 @@ index f5939c2..3084a61 100644
  	no_nice = security_task_setnice(p, niceval);
  	if (no_nice) {
  		error = no_nice;
-@@ -573,6 +579,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
+@@ -574,6 +580,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, gid_t, egid)
  			goto error;
  	}
  
@@ -78177,7 +78085,7 @@ index f5939c2..3084a61 100644
  	if (rgid != (gid_t) -1 ||
  	    (egid != (gid_t) -1 && egid != old->gid))
  		new->sgid = new->egid;
-@@ -602,6 +611,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
+@@ -603,6 +612,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
  	old = current_cred();
  
  	retval = -EPERM;
@@ -78188,7 +78096,7 @@ index f5939c2..3084a61 100644
  	if (nsown_capable(CAP_SETGID))
  		new->gid = new->egid = new->sgid = new->fsgid = gid;
  	else if (gid == old->gid || gid == old->sgid)
-@@ -619,7 +632,7 @@ error:
+@@ -620,7 +633,7 @@ error:
  /*
   * change the user struct in a credentials set to match the new UID
   */
@@ -78197,7 +78105,7 @@ index f5939c2..3084a61 100644
  {
  	struct user_struct *new_user;
  
-@@ -689,6 +702,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
+@@ -690,6 +703,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, uid_t, euid)
  			goto error;
  	}
  
@@ -78207,7 +78115,7 @@ index f5939c2..3084a61 100644
  	if (new->uid != old->uid) {
  		retval = set_user(new);
  		if (retval < 0)
-@@ -733,6 +749,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
+@@ -734,6 +750,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
  	old = current_cred();
  
  	retval = -EPERM;
@@ -78220,7 +78128,7 @@ index f5939c2..3084a61 100644
  	if (nsown_capable(CAP_SETUID)) {
  		new->suid = new->uid = uid;
  		if (uid != old->uid) {
-@@ -787,6 +809,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
+@@ -788,6 +810,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid, uid_t, euid, uid_t, suid)
  			goto error;
  	}
  
@@ -78230,7 +78138,7 @@ index f5939c2..3084a61 100644
  	if (ruid != (uid_t) -1) {
  		new->uid = ruid;
  		if (ruid != old->uid) {
-@@ -851,6 +876,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
+@@ -852,6 +877,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid, gid_t, egid, gid_t, sgid)
  			goto error;
  	}
  
@@ -78240,7 +78148,7 @@ index f5939c2..3084a61 100644
  	if (rgid != (gid_t) -1)
  		new->gid = rgid;
  	if (egid != (gid_t) -1)
-@@ -901,12 +929,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
+@@ -902,12 +930,16 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
  	    uid == old->suid || uid == old->fsuid ||
  	    nsown_capable(CAP_SETUID)) {
  		if (uid != old_fsuid) {
@@ -78257,7 +78165,7 @@ index f5939c2..3084a61 100644
  	abort_creds(new);
  	return old_fsuid;
  
-@@ -933,12 +965,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
+@@ -934,12 +966,16 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
  	if (gid == old->gid  || gid == old->egid  ||
  	    gid == old->sgid || gid == old->fsgid ||
  	    nsown_capable(CAP_SETGID)) {
@@ -78274,7 +78182,7 @@ index f5939c2..3084a61 100644
  	abort_creds(new);
  	return old_fsgid;
  
-@@ -1246,19 +1282,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+@@ -1247,19 +1283,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
  		return -EFAULT;
  
  	down_read(&uts_sem);
@@ -78299,7 +78207,7 @@ index f5939c2..3084a61 100644
  				__OLD_UTS_LEN);
  	error |= __put_user(0, name->machine + __OLD_UTS_LEN);
  	up_read(&uts_sem);
-@@ -1723,7 +1759,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
+@@ -1724,7 +1760,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3,
  			error = get_dumpable(me->mm);
  			break;
  		case PR_SET_DUMPABLE:
@@ -78984,18 +78892,10 @@ index 16fc34a..efd8bb8 100644
  	ret = -EIO;
  	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 0943d2a..f1f2d73 100644
+index 5527211..04dce85 100644
 --- a/kernel/trace/ftrace.c
 +++ b/kernel/trace/ftrace.c
-@@ -572,7 +572,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
- 		free_page(tmp);
- 	}
- 
--	free_page((unsigned long)stat->pages);
- 	stat->pages = NULL;
- 	stat->start = NULL;
- 
-@@ -1587,12 +1586,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+@@ -1586,12 +1586,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
  	if (unlikely(ftrace_disabled))
  		return 0;
  
@@ -79015,7 +78915,7 @@ index 0943d2a..f1f2d73 100644
  }
  
  /*
-@@ -2608,7 +2612,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
+@@ -2607,7 +2612,7 @@ static void ftrace_free_entry_rcu(struct rcu_head *rhp)
  
  int
  register_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
@@ -79024,7 +78924,7 @@ index 0943d2a..f1f2d73 100644
  {
  	struct ftrace_func_probe *entry;
  	struct ftrace_page *pg;
-@@ -3986,8 +3990,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+@@ -3981,8 +3986,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  
  static int ftrace_graph_active;
@@ -79033,7 +78933,7 @@ index 0943d2a..f1f2d73 100644
  int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
  {
  	return 0;
-@@ -4131,6 +4133,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+@@ -4126,6 +4129,10 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
  	return NOTIFY_DONE;
  }
  
@@ -79044,7 +78944,7 @@ index 0943d2a..f1f2d73 100644
  int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  			trace_func_graph_ent_t entryfunc)
  {
-@@ -4144,7 +4150,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
+@@ -4139,7 +4146,6 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
  		goto out;
  	}
  
@@ -79889,33 +79789,10 @@ index bd2bea9..6b3c95e 100644
  		return false;
  
 diff --git a/lib/kobject.c b/lib/kobject.c
-index 640bd98..a0de35f 100644
+index 83bd5b3..a0de35f 100644
 --- a/lib/kobject.c
 +++ b/lib/kobject.c
-@@ -531,6 +531,13 @@ struct kobject *kobject_get(struct kobject *kobj)
- 	return kobj;
- }
- 
-+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
-+{
-+	if (!kref_get_unless_zero(&kobj->kref))
-+		kobj = NULL;
-+	return kobj;
-+}
-+
- /*
-  * kobject_cleanup - free kobject resources.
-  * @kobj: object to cleanup
-@@ -785,7 +792,7 @@ struct kobject *kset_find_obj_hinted(struct kset *kset, const char *name,
- slow_search:
- 	list_for_each_entry(k, &kset->list, entry) {
- 		if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
--			ret = kobject_get(k);
-+			ret = kobject_get_unless_zero(k);
- 			break;
- 		}
- 	}
-@@ -891,9 +898,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
+@@ -898,9 +898,9 @@ EXPORT_SYMBOL_GPL(kset_create_and_add);
  
  
  static DEFINE_SPINLOCK(kobj_ns_type_lock);
@@ -80365,7 +80242,7 @@ index 470cbb4..8d01b5a 100644
  	/* if an huge pmd materialized from under us just retry later */
  	if (unlikely(pmd_trans_huge(*pmd)))
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 4c7d42a..6d2f988 100644
+index 70b4733..ab692a7 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -1973,15 +1973,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
@@ -83518,7 +83395,7 @@ index f0cd7ab..9b60530 100644
  	struct mm_struct *mm;
  
 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 50f0824..0ade43a 100644
+index ea3f83b..001a216 100644
 --- a/mm/page-writeback.c
 +++ b/mm/page-writeback.c
 @@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -85914,7 +85791,7 @@ index 0ce2ad0..cb92a90 100644
  };
  
 diff --git a/net/can/gw.c b/net/can/gw.c
-index 3d79b12..d7aa843 100644
+index f78f898..d7aa843 100644
 --- a/net/can/gw.c
 +++ b/net/can/gw.c
 @@ -67,7 +67,6 @@ MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
@@ -85925,33 +85802,6 @@ index 3d79b12..d7aa843 100644
  
  static struct kmem_cache *cgw_cache __read_mostly;
  
-@@ -436,7 +435,7 @@ static int cgw_notifier(struct notifier_block *nb,
- 			if (gwj->src.dev == dev || gwj->dst.dev == dev) {
- 				hlist_del(&gwj->list);
- 				cgw_unregister_filter(gwj);
--				kfree(gwj);
-+				kmem_cache_free(cgw_cache, gwj);
- 			}
- 		}
- 	}
-@@ -850,7 +849,7 @@ static void cgw_remove_all_jobs(void)
- 	hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
- 		hlist_del(&gwj->list);
- 		cgw_unregister_filter(gwj);
--		kfree(gwj);
-+		kmem_cache_free(cgw_cache, gwj);
- 	}
- }
- 
-@@ -903,7 +902,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
- 
- 		hlist_del(&gwj->list);
- 		cgw_unregister_filter(gwj);
--		kfree(gwj);
-+		kmem_cache_free(cgw_cache, gwj);
- 		err = 0;
- 		break;
- 	}
 @@ -911,6 +910,10 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
  	return err;
  }
@@ -86482,7 +86332,7 @@ index ff52ad0..aff1c0f 100644
  	{
  		int new_fd;
 diff --git a/net/core/sock.c b/net/core/sock.c
-index 1e8a882..5439005 100644
+index 2c73adf..d7698ef 100644
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
 @@ -289,7 +289,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
@@ -86548,7 +86398,7 @@ index 1e8a882..5439005 100644
  		goto out;
  
  	/* Bind this socket to a particular device like "eth0",
-@@ -772,12 +772,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -786,12 +786,12 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  		struct timeval tm;
  	} v;
  
@@ -86564,7 +86414,7 @@ index 1e8a882..5439005 100644
  		return -EINVAL;
  
  	memset(&v, 0, sizeof(v));
-@@ -918,18 +918,18 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -932,18 +932,18 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  		if (len > sizeof(peercred))
  			len = sizeof(peercred);
  		cred_to_ucred(sk->sk_peer_pid, sk->sk_peer_cred, &peercred);
@@ -86586,7 +86436,7 @@ index 1e8a882..5439005 100644
  			return -EINVAL;
  		if (copy_to_user(optval, address, len))
  			return -EFAULT;
-@@ -964,7 +964,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
+@@ -978,7 +978,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
  
  	if (len > lv)
  		len = lv;
@@ -86595,7 +86445,7 @@ index 1e8a882..5439005 100644
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-@@ -2025,7 +2025,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
+@@ -2039,7 +2039,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
  	 */
  	smp_wmb();
  	atomic_set(&sk->sk_refcnt, 1);
@@ -86604,7 +86454,7 @@ index 1e8a882..5439005 100644
  }
  EXPORT_SYMBOL(sock_init_data);
  
-@@ -2562,7 +2562,7 @@ static __net_exit void proto_exit_net(struct net *net)
+@@ -2576,7 +2576,7 @@ static __net_exit void proto_exit_net(struct net *net)
  }
  
  
@@ -103327,27 +103177,8 @@ index 547628e..74de9f2 100644
 +#endif
 +
  #endif
-diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index 3eed61e..79647cd 100644
---- a/virt/kvm/ioapic.c
-+++ b/virt/kvm/ioapic.c
-@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
- 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
- 			u64 redir_content;
- 
--			ASSERT(redir_index < IOAPIC_NUM_PINS);
-+			if (redir_index < IOAPIC_NUM_PINS)
-+				redir_content =
-+					ioapic->redirtbl[redir_index].bits;
-+			else
-+				redir_content = ~0ULL;
- 
--			redir_content = ioapic->redirtbl[redir_index].bits;
- 			result = (ioapic->ioregsel & 0x1) ?
- 			    (redir_content >> 32) & 0xffffffff :
- 			    redir_content & 0xffffffff;
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index ec747dc..38a8e47 100644
+index 8bf05f0..7324a1e 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
 @@ -75,12 +75,17 @@ LIST_HEAD(vm_list);
@@ -103379,7 +103210,7 @@ index ec747dc..38a8e47 100644
  			(void __user *)(unsigned long)mem->userspace_addr,
  			mem->memory_size)))
  		goto out;
-@@ -1630,7 +1635,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
+@@ -1657,7 +1662,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
  	return 0;
  }
  
@@ -103388,7 +103219,7 @@ index ec747dc..38a8e47 100644
  	.release        = kvm_vcpu_release,
  	.unlocked_ioctl = kvm_vcpu_ioctl,
  #ifdef CONFIG_COMPAT
-@@ -2150,7 +2155,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
+@@ -2177,7 +2182,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
  	return 0;
  }
  
@@ -103397,7 +103228,7 @@ index ec747dc..38a8e47 100644
  	.release        = kvm_vm_release,
  	.unlocked_ioctl = kvm_vm_ioctl,
  #ifdef CONFIG_COMPAT
-@@ -2248,7 +2253,7 @@ out:
+@@ -2275,7 +2280,7 @@ out:
  	return r;
  }
  
@@ -103406,7 +103237,7 @@ index ec747dc..38a8e47 100644
  	.unlocked_ioctl = kvm_dev_ioctl,
  	.compat_ioctl   = kvm_dev_ioctl,
  	.llseek		= noop_llseek,
-@@ -2274,7 +2279,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2301,7 +2306,7 @@ static void hardware_enable_nolock(void *junk)
  
  	if (r) {
  		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -103415,7 +103246,7 @@ index ec747dc..38a8e47 100644
  		printk(KERN_INFO "kvm: enabling virtualization on "
  				 "CPU%d failed\n", cpu);
  	}
-@@ -2328,10 +2333,10 @@ static int hardware_enable_all(void)
+@@ -2355,10 +2360,10 @@ static int hardware_enable_all(void)
  
  	kvm_usage_count++;
  	if (kvm_usage_count == 1) {
@@ -103428,7 +103259,7 @@ index ec747dc..38a8e47 100644
  			hardware_disable_all_nolock();
  			r = -EBUSY;
  		}
-@@ -2682,7 +2687,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2709,7 +2714,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
  	kvm_arch_vcpu_put(vcpu);
  }
  
@@ -103437,7 +103268,7 @@ index ec747dc..38a8e47 100644
  		  struct module *module)
  {
  	int r;
-@@ -2745,7 +2750,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2772,7 +2777,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (!vcpu_align)
  		vcpu_align = __alignof__(struct kvm_vcpu);
  	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -103446,7 +103277,7 @@ index ec747dc..38a8e47 100644
  	if (!kvm_vcpu_cache) {
  		r = -ENOMEM;
  		goto out_free_3;
-@@ -2755,9 +2760,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2782,9 +2787,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (r)
  		goto out_free;
  
@@ -103458,7 +103289,7 @@ index ec747dc..38a8e47 100644
  
  	r = misc_register(&kvm_dev);
  	if (r) {
-@@ -2767,9 +2774,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2794,9 +2801,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  
  	register_syscore_ops(&kvm_syscore_ops);
  
diff --git a/3.2.43/4425_grsec_remove_EI_PAX.patch b/3.2.44/4425_grsec_remove_EI_PAX.patch
index 7d06ac2..7d06ac2 100644
--- a/3.2.43/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.44/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.43/4430_grsec-remove-localversion-grsec.patch b/3.2.44/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.43/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.44/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.43/4435_grsec-mute-warnings.patch b/3.2.44/4435_grsec-mute-warnings.patch
index f099757..f099757 100644
--- a/3.2.43/4435_grsec-mute-warnings.patch
+++ b/3.2.44/4435_grsec-mute-warnings.patch
diff --git a/3.2.43/4440_grsec-remove-protected-paths.patch b/3.2.44/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.2.43/4440_grsec-remove-protected-paths.patch
+++ b/3.2.44/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.43/4450_grsec-kconfig-default-gids.patch b/3.2.44/4450_grsec-kconfig-default-gids.patch
index 7c20c40..7c20c40 100644
--- a/3.2.43/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.44/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.43/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.44/4465_selinux-avc_audit-log-curr_ip.patch
index 70cc565..70cc565 100644
--- a/3.2.43/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.44/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.43/4470_disable-compat_vdso.patch b/3.2.44/4470_disable-compat_vdso.patch
index 99c691b..99c691b 100644
--- a/3.2.43/4470_disable-compat_vdso.patch
+++ b/3.2.44/4470_disable-compat_vdso.patch
diff --git a/3.8.8/0000_README b/3.8.10/0000_README
index 94354d0..0fb80bd 100644
--- a/3.8.8/0000_README
+++ b/3.8.10/0000_README
@@ -2,15 +2,15 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1006_linux-3.8.7.patch
+Patch:	1008_linux-3.8.9.patch
 From:	http://www.kernel.org
-Desc:	Linux 3.8.7
+Desc:	Linux 3.8.9
 
-Patch:	1007_linux-3.8.8.patch
+Patch:	1009_linux-3.8.10.patch
 From:	http://www.kernel.org
-Desc:	Linux 3.8.8
+Desc:	Linux 3.8.10
 
-Patch:	4420_grsecurity-2.9.1-3.8.8-201304181923.patch
+Patch:	4420_grsecurity-2.9.1-3.8.10-201304262208.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.8.10/1008_linux-3.8.9.patch b/3.8.10/1008_linux-3.8.9.patch
new file mode 100644
index 0000000..6162889
--- /dev/null
+++ b/3.8.10/1008_linux-3.8.9.patch
@@ -0,0 +1,1649 @@
+diff --git a/Makefile b/Makefile
+index 7684f95..3ae4796 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 8
++SUBLEVEL = 9
+ EXTRAVERSION =
+ NAME = Displaced Humerus Anterior
+ 
+diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
+index f9e8657..23fa6a2 100644
+--- a/arch/arm/kernel/perf_event.c
++++ b/arch/arm/kernel/perf_event.c
+@@ -261,7 +261,10 @@ validate_event(struct pmu_hw_events *hw_events,
+ 	struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
+ 	struct pmu *leader_pmu = event->group_leader->pmu;
+ 
+-	if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
++	if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
++		return 1;
++
++	if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
+ 		return 1;
+ 
+ 	return armpmu->get_event_idx(hw_events, event) >= 0;
+diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
+index 0edce4b..5e3ca7a 100644
+--- a/arch/arm/mach-imx/clk-imx35.c
++++ b/arch/arm/mach-imx/clk-imx35.c
+@@ -265,6 +265,8 @@ int __init mx35_clocks_init()
+ 	clk_prepare_enable(clk[gpio3_gate]);
+ 	clk_prepare_enable(clk[iim_gate]);
+ 	clk_prepare_enable(clk[emi_gate]);
++	clk_prepare_enable(clk[max_gate]);
++	clk_prepare_enable(clk[iomuxc_gate]);
+ 
+ 	/*
+ 	 * SCC is needed to boot via mmc after a watchdog reset. The clock code
+diff --git a/arch/arm/mm/cache-feroceon-l2.c b/arch/arm/mm/cache-feroceon-l2.c
+index dd3d591..48bc3c0 100644
+--- a/arch/arm/mm/cache-feroceon-l2.c
++++ b/arch/arm/mm/cache-feroceon-l2.c
+@@ -343,6 +343,7 @@ void __init feroceon_l2_init(int __l2_wt_override)
+ 	outer_cache.inv_range = feroceon_l2_inv_range;
+ 	outer_cache.clean_range = feroceon_l2_clean_range;
+ 	outer_cache.flush_range = feroceon_l2_flush_range;
++	outer_cache.inv_all = l2_inv_all;
+ 
+ 	enable_l2();
+ 
+diff --git a/arch/arm/mm/proc-arm920.S b/arch/arm/mm/proc-arm920.S
+index 2c3b942..2556cf1 100644
+--- a/arch/arm/mm/proc-arm920.S
++++ b/arch/arm/mm/proc-arm920.S
+@@ -387,7 +387,7 @@ ENTRY(cpu_arm920_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl	cpu_arm920_suspend_size
+ .equ	cpu_arm920_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm920_do_suspend)
+ 	stmfd	sp!, {r4 - r6, lr}
+ 	mrc	p15, 0, r4, c13, c0, 0	@ PID
+diff --git a/arch/arm/mm/proc-arm926.S b/arch/arm/mm/proc-arm926.S
+index f1803f7e..344c8a5 100644
+--- a/arch/arm/mm/proc-arm926.S
++++ b/arch/arm/mm/proc-arm926.S
+@@ -402,7 +402,7 @@ ENTRY(cpu_arm926_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/plat-s3c24xx/sleep.S */
+ .globl	cpu_arm926_suspend_size
+ .equ	cpu_arm926_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_arm926_do_suspend)
+ 	stmfd	sp!, {r4 - r6, lr}
+ 	mrc	p15, 0, r4, c13, c0, 0	@ PID
+diff --git a/arch/arm/mm/proc-mohawk.S b/arch/arm/mm/proc-mohawk.S
+index 82f9cdc..0b60dd3 100644
+--- a/arch/arm/mm/proc-mohawk.S
++++ b/arch/arm/mm/proc-mohawk.S
+@@ -350,7 +350,7 @@ ENTRY(cpu_mohawk_set_pte_ext)
+ 
+ .globl	cpu_mohawk_suspend_size
+ .equ	cpu_mohawk_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_mohawk_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
+diff --git a/arch/arm/mm/proc-sa1100.S b/arch/arm/mm/proc-sa1100.S
+index 3aa0da1..d92dfd0 100644
+--- a/arch/arm/mm/proc-sa1100.S
++++ b/arch/arm/mm/proc-sa1100.S
+@@ -172,7 +172,7 @@ ENTRY(cpu_sa1100_set_pte_ext)
+ 
+ .globl	cpu_sa1100_suspend_size
+ .equ	cpu_sa1100_suspend_size, 4 * 3
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_sa1100_do_suspend)
+ 	stmfd	sp!, {r4 - r6, lr}
+ 	mrc	p15, 0, r4, c3, c0, 0		@ domain ID
+diff --git a/arch/arm/mm/proc-v6.S b/arch/arm/mm/proc-v6.S
+index 09c5233..d222215 100644
+--- a/arch/arm/mm/proc-v6.S
++++ b/arch/arm/mm/proc-v6.S
+@@ -138,7 +138,7 @@ ENTRY(cpu_v6_set_pte_ext)
+ /* Suspend/resume support: taken from arch/arm/mach-s3c64xx/sleep.S */
+ .globl	cpu_v6_suspend_size
+ .equ	cpu_v6_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_v6_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p15, 0, r4, c13, c0, 0	@ FCSE/PID
+diff --git a/arch/arm/mm/proc-xsc3.S b/arch/arm/mm/proc-xsc3.S
+index eb93d64..e8efd83 100644
+--- a/arch/arm/mm/proc-xsc3.S
++++ b/arch/arm/mm/proc-xsc3.S
+@@ -413,7 +413,7 @@ ENTRY(cpu_xsc3_set_pte_ext)
+ 
+ .globl	cpu_xsc3_suspend_size
+ .equ	cpu_xsc3_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xsc3_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
+diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
+index 2551036..e766f88 100644
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -528,7 +528,7 @@ ENTRY(cpu_xscale_set_pte_ext)
+ 
+ .globl	cpu_xscale_suspend_size
+ .equ	cpu_xscale_suspend_size, 4 * 6
+-#ifdef CONFIG_PM_SLEEP
++#ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_xscale_do_suspend)
+ 	stmfd	sp!, {r4 - r9, lr}
+ 	mrc	p14, 0, r4, c6, c0, 0	@ clock configuration, for turbo mode
+diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
+index dbaec94..21bff32 100644
+--- a/arch/mips/include/asm/page.h
++++ b/arch/mips/include/asm/page.h
+@@ -31,7 +31,7 @@
+ #define PAGE_SHIFT	16
+ #endif
+ #define PAGE_SIZE	(_AC(1,UL) << PAGE_SHIFT)
+-#define PAGE_MASK       (~(PAGE_SIZE - 1))
++#define PAGE_MASK	(~((1 << PAGE_SHIFT) - 1))
+ 
+ #ifdef CONFIG_MIPS_HUGE_TLB_SUPPORT
+ #define HPAGE_SHIFT	(PAGE_SHIFT + PAGE_SHIFT - 3)
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index 3d990d3..e0822a3 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -634,7 +634,7 @@ resume_kernel:
+ 	/* Clear _TIF_EMULATE_STACK_STORE flag */
+ 	lis	r11,_TIF_EMULATE_STACK_STORE@h
+ 	addi	r5,r9,TI_FLAGS
+-	ldarx	r4,0,r5
++0:	ldarx	r4,0,r5
+ 	andc	r4,r4,r11
+ 	stdcx.	r4,0,r5
+ 	bne-	0b
+diff --git a/arch/powerpc/kvm/e500mc.c b/arch/powerpc/kvm/e500mc.c
+index 1f89d26..2f4baa0 100644
+--- a/arch/powerpc/kvm/e500mc.c
++++ b/arch/powerpc/kvm/e500mc.c
+@@ -108,6 +108,8 @@ void kvmppc_mmu_msr_notify(struct kvm_vcpu *vcpu, u32 old_msr)
+ {
+ }
+ 
++static DEFINE_PER_CPU(struct kvm_vcpu *, last_vcpu_on_cpu);
++
+ void kvmppc_core_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ {
+ 	struct kvmppc_vcpu_e500 *vcpu_e500 = to_e500(vcpu);
+@@ -136,8 +138,11 @@ void kvmppc_core_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ 	mtspr(SPRN_GDEAR, vcpu->arch.shared->dar);
+ 	mtspr(SPRN_GESR, vcpu->arch.shared->esr);
+ 
+-	if (vcpu->arch.oldpir != mfspr(SPRN_PIR))
++	if (vcpu->arch.oldpir != mfspr(SPRN_PIR) ||
++	    __get_cpu_var(last_vcpu_on_cpu) != vcpu) {
+ 		kvmppc_e500_tlbil_all(vcpu_e500);
++		__get_cpu_var(last_vcpu_on_cpu) = vcpu;
++	}
+ 
+ 	kvmppc_load_guest_fp(vcpu);
+ }
+diff --git a/arch/s390/include/asm/io.h b/arch/s390/include/asm/io.h
+index 27cb321..379d96e 100644
+--- a/arch/s390/include/asm/io.h
++++ b/arch/s390/include/asm/io.h
+@@ -50,10 +50,6 @@ void unxlate_dev_mem_ptr(unsigned long phys, void *addr);
+ #define ioremap_nocache(addr, size)	ioremap(addr, size)
+ #define ioremap_wc			ioremap_nocache
+ 
+-/* TODO: s390 cannot support io_remap_pfn_range... */
+-#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) 	       \
+-	remap_pfn_range(vma, vaddr, pfn, size, prot)
+-
+ static inline void __iomem *ioremap(unsigned long offset, unsigned long size)
+ {
+ 	return (void __iomem *) offset;
+diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
+index 098adbb..1532d7f 100644
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@ -56,6 +56,10 @@ extern unsigned long zero_page_mask;
+ 	 (((unsigned long)(vaddr)) &zero_page_mask))))
+ #define __HAVE_COLOR_ZERO_PAGE
+ 
++/* TODO: s390 cannot support io_remap_pfn_range... */
++#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) 	       \
++	remap_pfn_range(vma, vaddr, pfn, size, prot)
++
+ #endif /* !__ASSEMBLY__ */
+ 
+ /*
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index dc87b65..85039f9 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -419,8 +419,8 @@ struct kvm_vcpu_arch {
+ 	gpa_t time;
+ 	struct pvclock_vcpu_time_info hv_clock;
+ 	unsigned int hw_tsc_khz;
+-	unsigned int time_offset;
+-	struct page *time_page;
++	struct gfn_to_hva_cache pv_time;
++	bool pv_time_enabled;
+ 	/* set guest stopped flag in pvclock flags field */
+ 	bool pvclock_set_guest_stopped_request;
+ 
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index 4914e94..70602f8 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -128,8 +128,14 @@ static struct event_constraint intel_gen_event_constraints[] __read_mostly =
+ };
+ 
+ static struct extra_reg intel_snb_extra_regs[] __read_mostly = {
+-	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffffffffull, RSP_0),
+-	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffffffffull, RSP_1),
++	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3f807f8fffull, RSP_0),
++	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3f807f8fffull, RSP_1),
++	EVENT_EXTRA_END
++};
++
++static struct extra_reg intel_snbep_extra_regs[] __read_mostly = {
++	INTEL_EVENT_EXTRA_REG(0xb7, MSR_OFFCORE_RSP_0, 0x3fffff8fffull, RSP_0),
++	INTEL_EVENT_EXTRA_REG(0xbb, MSR_OFFCORE_RSP_1, 0x3fffff8fffull, RSP_1),
+ 	EVENT_EXTRA_END
+ };
+ 
+@@ -2072,7 +2078,10 @@ __init int intel_pmu_init(void)
+ 		x86_pmu.event_constraints = intel_snb_event_constraints;
+ 		x86_pmu.pebs_constraints = intel_snb_pebs_event_constraints;
+ 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
+-		x86_pmu.extra_regs = intel_snb_extra_regs;
++		if (boot_cpu_data.x86_model == 45)
++			x86_pmu.extra_regs = intel_snbep_extra_regs;
++		else
++			x86_pmu.extra_regs = intel_snb_extra_regs;
+ 		/* all extra regs are per-cpu when HT is on */
+ 		x86_pmu.er_flags |= ERF_HAS_RSP_1;
+ 		x86_pmu.er_flags |= ERF_NO_HT_SHARING;
+@@ -2098,7 +2107,10 @@ __init int intel_pmu_init(void)
+ 		x86_pmu.event_constraints = intel_snb_event_constraints;
+ 		x86_pmu.pebs_constraints = intel_ivb_pebs_event_constraints;
+ 		x86_pmu.pebs_aliases = intel_pebs_aliases_snb;
+-		x86_pmu.extra_regs = intel_snb_extra_regs;
++		if (boot_cpu_data.x86_model == 62)
++			x86_pmu.extra_regs = intel_snbep_extra_regs;
++		else
++			x86_pmu.extra_regs = intel_snb_extra_regs;
+ 		/* all extra regs are per-cpu when HT is on */
+ 		x86_pmu.er_flags |= ERF_HAS_RSP_1;
+ 		x86_pmu.er_flags |= ERF_NO_HT_SHARING;
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 9392f52..a2f492c 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -1781,7 +1781,7 @@ int kvm_lapic_enable_pv_eoi(struct kvm_vcpu *vcpu, u64 data)
+ 	if (!pv_eoi_enabled(vcpu))
+ 		return 0;
+ 	return kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.pv_eoi.data,
+-					 addr);
++					 addr, sizeof(u8));
+ }
+ 
+ void kvm_lapic_init(void)
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index c243b81..9a51121 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1408,10 +1408,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ 	unsigned long flags, this_tsc_khz;
+ 	struct kvm_vcpu_arch *vcpu = &v->arch;
+ 	struct kvm_arch *ka = &v->kvm->arch;
+-	void *shared_kaddr;
+ 	s64 kernel_ns, max_kernel_ns;
+ 	u64 tsc_timestamp, host_tsc;
+-	struct pvclock_vcpu_time_info *guest_hv_clock;
++	struct pvclock_vcpu_time_info guest_hv_clock;
+ 	u8 pvclock_flags;
+ 	bool use_master_clock;
+ 
+@@ -1465,7 +1464,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ 
+ 	local_irq_restore(flags);
+ 
+-	if (!vcpu->time_page)
++	if (!vcpu->pv_time_enabled)
+ 		return 0;
+ 
+ 	/*
+@@ -1527,12 +1526,12 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ 	 */
+ 	vcpu->hv_clock.version += 2;
+ 
+-	shared_kaddr = kmap_atomic(vcpu->time_page);
+-
+-	guest_hv_clock = shared_kaddr + vcpu->time_offset;
++	if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
++		&guest_hv_clock, sizeof(guest_hv_clock))))
++		return 0;
+ 
+ 	/* retain PVCLOCK_GUEST_STOPPED if set in guest copy */
+-	pvclock_flags = (guest_hv_clock->flags & PVCLOCK_GUEST_STOPPED);
++	pvclock_flags = (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
+ 
+ 	if (vcpu->pvclock_set_guest_stopped_request) {
+ 		pvclock_flags |= PVCLOCK_GUEST_STOPPED;
+@@ -1545,12 +1544,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
+ 
+ 	vcpu->hv_clock.flags = pvclock_flags;
+ 
+-	memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
+-	       sizeof(vcpu->hv_clock));
+-
+-	kunmap_atomic(shared_kaddr);
+-
+-	mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
++	kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
++				&vcpu->hv_clock,
++				sizeof(vcpu->hv_clock));
+ 	return 0;
+ }
+ 
+@@ -1829,7 +1825,8 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ 		return 0;
+ 	}
+ 
+-	if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa))
++	if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.apf.data, gpa,
++					sizeof(u32)))
+ 		return 1;
+ 
+ 	vcpu->arch.apf.send_user_only = !(data & KVM_ASYNC_PF_SEND_ALWAYS);
+@@ -1839,10 +1836,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
+ 
+ static void kvmclock_reset(struct kvm_vcpu *vcpu)
+ {
+-	if (vcpu->arch.time_page) {
+-		kvm_release_page_dirty(vcpu->arch.time_page);
+-		vcpu->arch.time_page = NULL;
+-	}
++	vcpu->arch.pv_time_enabled = false;
+ }
+ 
+ static void accumulate_steal_time(struct kvm_vcpu *vcpu)
+@@ -1948,6 +1942,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 		break;
+ 	case MSR_KVM_SYSTEM_TIME_NEW:
+ 	case MSR_KVM_SYSTEM_TIME: {
++		u64 gpa_offset;
+ 		kvmclock_reset(vcpu);
+ 
+ 		vcpu->arch.time = data;
+@@ -1957,14 +1952,14 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 		if (!(data & 1))
+ 			break;
+ 
+-		/* ...but clean it before doing the actual write */
+-		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
+-
+-		vcpu->arch.time_page =
+-				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
++		gpa_offset = data & ~(PAGE_MASK | 1);
+ 
+-		if (is_error_page(vcpu->arch.time_page))
+-			vcpu->arch.time_page = NULL;
++		if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
++		     &vcpu->arch.pv_time, data & ~1ULL,
++		     sizeof(struct pvclock_vcpu_time_info)))
++			vcpu->arch.pv_time_enabled = false;
++		else
++			vcpu->arch.pv_time_enabled = true;
+ 
+ 		break;
+ 	}
+@@ -1981,7 +1976,8 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
+ 			return 1;
+ 
+ 		if (kvm_gfn_to_hva_cache_init(vcpu->kvm, &vcpu->arch.st.stime,
+-							data & KVM_STEAL_VALID_BITS))
++						data & KVM_STEAL_VALID_BITS,
++						sizeof(struct kvm_steal_time)))
+ 			return 1;
+ 
+ 		vcpu->arch.st.msr_val = data;
+@@ -2967,7 +2963,7 @@ static int kvm_vcpu_ioctl_x86_set_xcrs(struct kvm_vcpu *vcpu,
+  */
+ static int kvm_set_guest_paused(struct kvm_vcpu *vcpu)
+ {
+-	if (!vcpu->arch.time_page)
++	if (!vcpu->arch.pv_time_enabled)
+ 		return -EINVAL;
+ 	vcpu->arch.pvclock_set_guest_stopped_request = true;
+ 	kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
+@@ -6661,6 +6657,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
+ 		goto fail_free_wbinvd_dirty_mask;
+ 
+ 	vcpu->arch.ia32_tsc_adjust_msr = 0x0;
++	vcpu->arch.pv_time_enabled = false;
+ 	kvm_async_pf_hash_reset(vcpu);
+ 	kvm_pmu_init(vcpu);
+ 
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index ef5356c..0262210 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -161,6 +161,8 @@ static int hash_recvmsg(struct kiocb *unused, struct socket *sock,
+ 	else if (len < ds)
+ 		msg->msg_flags |= MSG_TRUNC;
+ 
++	msg->msg_namelen = 0;
++
+ 	lock_sock(sk);
+ 	if (ctx->more) {
+ 		ctx->more = 0;
+diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
+index 6a6dfc0..a1c4f0a 100644
+--- a/crypto/algif_skcipher.c
++++ b/crypto/algif_skcipher.c
+@@ -432,6 +432,7 @@ static int skcipher_recvmsg(struct kiocb *unused, struct socket *sock,
+ 	long copied = 0;
+ 
+ 	lock_sock(sk);
++	msg->msg_namelen = 0;
+ 	for (iov = msg->msg_iov, iovlen = msg->msg_iovlen; iovlen > 0;
+ 	     iovlen--, iov++) {
+ 		unsigned long seglen = iov->iov_len;
+diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
+index fe6d4be..615d262 100644
+--- a/drivers/char/hpet.c
++++ b/drivers/char/hpet.c
+@@ -373,26 +373,14 @@ static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
+ 	struct hpet_dev *devp;
+ 	unsigned long addr;
+ 
+-	if (((vma->vm_end - vma->vm_start) != PAGE_SIZE) || vma->vm_pgoff)
+-		return -EINVAL;
+-
+ 	devp = file->private_data;
+ 	addr = devp->hd_hpets->hp_hpet_phys;
+ 
+ 	if (addr & (PAGE_SIZE - 1))
+ 		return -ENOSYS;
+ 
+-	vma->vm_flags |= VM_IO;
+ 	vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-
+-	if (io_remap_pfn_range(vma, vma->vm_start, addr >> PAGE_SHIFT,
+-					PAGE_SIZE, vma->vm_page_prot)) {
+-		printk(KERN_ERR "%s: io_remap_pfn_range failed\n",
+-			__func__);
+-		return -EAGAIN;
+-	}
+-
+-	return 0;
++	return vm_iomap_memory(vma, addr, PAGE_SIZE);
+ #else
+ 	return -ENOSYS;
+ #endif
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 75b1f89..fd86b37 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1001,6 +1001,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
+ 	const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
+ 	const unsigned long do_discard = (bio->bi_rw
+ 					  & (REQ_DISCARD | REQ_SECURE));
++	const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
+ 	struct md_rdev *blocked_rdev;
+ 	struct blk_plug_cb *cb;
+ 	struct raid1_plug_cb *plug = NULL;
+@@ -1302,7 +1303,8 @@ read_again:
+ 				   conf->mirrors[i].rdev->data_offset);
+ 		mbio->bi_bdev = conf->mirrors[i].rdev->bdev;
+ 		mbio->bi_end_io	= raid1_end_write_request;
+-		mbio->bi_rw = WRITE | do_flush_fua | do_sync | do_discard;
++		mbio->bi_rw =
++			WRITE | do_flush_fua | do_sync | do_discard | do_same;
+ 		mbio->bi_private = r1_bio;
+ 
+ 		atomic_inc(&r1_bio->remaining);
+@@ -2819,6 +2821,9 @@ static int run(struct mddev *mddev)
+ 	if (IS_ERR(conf))
+ 		return PTR_ERR(conf);
+ 
++	if (mddev->queue)
++		blk_queue_max_write_same_sectors(mddev->queue,
++						 mddev->chunk_sectors);
+ 	rdev_for_each(rdev, mddev) {
+ 		if (!mddev->gendisk)
+ 			continue;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 8d925dc..b3898d4 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1106,6 +1106,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
+ 	const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
+ 	const unsigned long do_discard = (bio->bi_rw
+ 					  & (REQ_DISCARD | REQ_SECURE));
++	const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
+ 	unsigned long flags;
+ 	struct md_rdev *blocked_rdev;
+ 	struct blk_plug_cb *cb;
+@@ -1461,7 +1462,8 @@ retry_write:
+ 							      rdev));
+ 			mbio->bi_bdev = rdev->bdev;
+ 			mbio->bi_end_io	= raid10_end_write_request;
+-			mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
++			mbio->bi_rw =
++				WRITE | do_sync | do_fua | do_discard | do_same;
+ 			mbio->bi_private = r10_bio;
+ 
+ 			atomic_inc(&r10_bio->remaining);
+@@ -1503,7 +1505,8 @@ retry_write:
+ 						   r10_bio, rdev));
+ 			mbio->bi_bdev = rdev->bdev;
+ 			mbio->bi_end_io	= raid10_end_write_request;
+-			mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
++			mbio->bi_rw =
++				WRITE | do_sync | do_fua | do_discard | do_same;
+ 			mbio->bi_private = r10_bio;
+ 
+ 			atomic_inc(&r10_bio->remaining);
+@@ -3570,6 +3573,8 @@ static int run(struct mddev *mddev)
+ 	if (mddev->queue) {
+ 		blk_queue_max_discard_sectors(mddev->queue,
+ 					      mddev->chunk_sectors);
++		blk_queue_max_write_same_sectors(mddev->queue,
++						 mddev->chunk_sectors);
+ 		blk_queue_io_min(mddev->queue, chunk_size);
+ 		if (conf->geo.raid_disks % conf->geo.near_copies)
+ 			blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index 82c0616..6e3d6dc 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -1159,45 +1159,17 @@ static int mtdchar_mmap(struct file *file, struct vm_area_struct *vma)
+ 	struct mtd_file_info *mfi = file->private_data;
+ 	struct mtd_info *mtd = mfi->mtd;
+ 	struct map_info *map = mtd->priv;
+-	resource_size_t start, off;
+-	unsigned long len, vma_len;
+ 
+         /* This is broken because it assumes the MTD device is map-based
+ 	   and that mtd->priv is a valid struct map_info.  It should be
+ 	   replaced with something that uses the mtd_get_unmapped_area()
+ 	   operation properly. */
+ 	if (0 /*mtd->type == MTD_RAM || mtd->type == MTD_ROM*/) {
+-		off = get_vm_offset(vma);
+-		start = map->phys;
+-		len = PAGE_ALIGN((start & ~PAGE_MASK) + map->size);
+-		start &= PAGE_MASK;
+-		vma_len = get_vm_size(vma);
+-
+-		/* Overflow in off+len? */
+-		if (vma_len + off < off)
+-			return -EINVAL;
+-		/* Does it fit in the mapping? */
+-		if (vma_len + off > len)
+-			return -EINVAL;
+-
+-		off += start;
+-		/* Did that overflow? */
+-		if (off < start)
+-			return -EINVAL;
+-		if (set_vm_offset(vma, off) < 0)
+-			return -EINVAL;
+-		vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
+-
+ #ifdef pgprot_noncached
+-		if (file->f_flags & O_DSYNC || off >= __pa(high_memory))
++		if (file->f_flags & O_DSYNC || map->phys >= __pa(high_memory))
+ 			vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ #endif
+-		if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+-				       vma->vm_end - vma->vm_start,
+-				       vma->vm_page_prot))
+-			return -EAGAIN;
+-
+-		return 0;
++		return vm_iomap_memory(vma, map->phys, map->size);
+ 	}
+ 	return -ENOSYS;
+ #else
+diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
+index 5eaf47b..42b6d69 100644
+--- a/drivers/net/can/mcp251x.c
++++ b/drivers/net/can/mcp251x.c
+@@ -922,6 +922,7 @@ static int mcp251x_open(struct net_device *net)
+ 	struct mcp251x_priv *priv = netdev_priv(net);
+ 	struct spi_device *spi = priv->spi;
+ 	struct mcp251x_platform_data *pdata = spi->dev.platform_data;
++	unsigned long flags;
+ 	int ret;
+ 
+ 	ret = open_candev(net);
+@@ -938,9 +939,14 @@ static int mcp251x_open(struct net_device *net)
+ 	priv->tx_skb = NULL;
+ 	priv->tx_len = 0;
+ 
++	flags = IRQF_ONESHOT;
++	if (pdata->irq_flags)
++		flags |= pdata->irq_flags;
++	else
++		flags |= IRQF_TRIGGER_FALLING;
++
+ 	ret = request_threaded_irq(spi->irq, NULL, mcp251x_can_ist,
+-		  pdata->irq_flags ? pdata->irq_flags : IRQF_TRIGGER_FALLING,
+-		  DEVICE_NAME, priv);
++				   flags, DEVICE_NAME, priv);
+ 	if (ret) {
+ 		dev_err(&spi->dev, "failed to acquire irq %d\n", spi->irq);
+ 		if (pdata->transceiver_enable)
+diff --git a/drivers/net/can/sja1000/sja1000_of_platform.c b/drivers/net/can/sja1000/sja1000_of_platform.c
+index 6433b81..8e0c4a0 100644
+--- a/drivers/net/can/sja1000/sja1000_of_platform.c
++++ b/drivers/net/can/sja1000/sja1000_of_platform.c
+@@ -96,8 +96,8 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
+ 	struct net_device *dev;
+ 	struct sja1000_priv *priv;
+ 	struct resource res;
+-	const u32 *prop;
+-	int err, irq, res_size, prop_size;
++	u32 prop;
++	int err, irq, res_size;
+ 	void __iomem *base;
+ 
+ 	err = of_address_to_resource(np, 0, &res);
+@@ -138,27 +138,27 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
+ 	priv->read_reg = sja1000_ofp_read_reg;
+ 	priv->write_reg = sja1000_ofp_write_reg;
+ 
+-	prop = of_get_property(np, "nxp,external-clock-frequency", &prop_size);
+-	if (prop && (prop_size ==  sizeof(u32)))
+-		priv->can.clock.freq = *prop / 2;
++	err = of_property_read_u32(np, "nxp,external-clock-frequency", &prop);
++	if (!err)
++		priv->can.clock.freq = prop / 2;
+ 	else
+ 		priv->can.clock.freq = SJA1000_OFP_CAN_CLOCK; /* default */
+ 
+-	prop = of_get_property(np, "nxp,tx-output-mode", &prop_size);
+-	if (prop && (prop_size == sizeof(u32)))
+-		priv->ocr |= *prop & OCR_MODE_MASK;
++	err = of_property_read_u32(np, "nxp,tx-output-mode", &prop);
++	if (!err)
++		priv->ocr |= prop & OCR_MODE_MASK;
+ 	else
+ 		priv->ocr |= OCR_MODE_NORMAL; /* default */
+ 
+-	prop = of_get_property(np, "nxp,tx-output-config", &prop_size);
+-	if (prop && (prop_size == sizeof(u32)))
+-		priv->ocr |= (*prop << OCR_TX_SHIFT) & OCR_TX_MASK;
++	err = of_property_read_u32(np, "nxp,tx-output-config", &prop);
++	if (!err)
++		priv->ocr |= (prop << OCR_TX_SHIFT) & OCR_TX_MASK;
+ 	else
+ 		priv->ocr |= OCR_TX0_PULLDOWN; /* default */
+ 
+-	prop = of_get_property(np, "nxp,clock-out-frequency", &prop_size);
+-	if (prop && (prop_size == sizeof(u32)) && *prop) {
+-		u32 divider = priv->can.clock.freq * 2 / *prop;
++	err = of_property_read_u32(np, "nxp,clock-out-frequency", &prop);
++	if (!err && prop) {
++		u32 divider = priv->can.clock.freq * 2 / prop;
+ 
+ 		if (divider > 1)
+ 			priv->cdr |= divider / 2 - 1;
+@@ -168,8 +168,7 @@ static int sja1000_ofp_probe(struct platform_device *ofdev)
+ 		priv->cdr |= CDR_CLK_OFF; /* default */
+ 	}
+ 
+-	prop = of_get_property(np, "nxp,no-comparator-bypass", NULL);
+-	if (!prop)
++	if (!of_property_read_bool(np, "nxp,no-comparator-bypass"))
+ 		priv->cdr |= CDR_CBP; /* default */
+ 
+ 	priv->irq_flags = IRQF_SHARED;
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 8a5253c..6917998 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -330,6 +330,7 @@ static DEFINE_PCI_DEVICE_TABLE(tg3_pci_tbl) = {
+ 	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5719)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_5720)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57762)},
++	{PCI_DEVICE(PCI_VENDOR_ID_BROADCOM, TG3PCI_DEVICE_TIGON3_57766)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9DXX)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_SYSKONNECT, PCI_DEVICE_ID_SYSKONNECT_9MXX)},
+ 	{PCI_DEVICE(PCI_VENDOR_ID_ALTIMA, PCI_DEVICE_ID_ALTIMA_AC1000)},
+@@ -9103,7 +9104,14 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
+ 		}
+ 
+ 		if (GET_CHIP_REV(tp->pci_chip_rev_id) != CHIPREV_57765_AX) {
+-			u32 grc_mode = tr32(GRC_MODE);
++			u32 grc_mode;
++
++			/* Fix transmit hangs */
++			val = tr32(TG3_CPMU_PADRNG_CTL);
++			val |= TG3_CPMU_PADRNG_CTL_RDIV2;
++			tw32(TG3_CPMU_PADRNG_CTL, val);
++
++			grc_mode = tr32(GRC_MODE);
+ 
+ 			/* Access the lower 1K of DL PCIE block registers. */
+ 			val = grc_mode & ~GRC_MODE_PCIE_PORT_MASK;
+@@ -9413,6 +9421,14 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy)
+ 	if (tg3_flag(tp, PCI_EXPRESS))
+ 		rdmac_mode |= RDMAC_MODE_FIFO_LONG_BURST;
+ 
++	if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_57766) {
++		tp->dma_limit = 0;
++		if (tp->dev->mtu <= ETH_DATA_LEN) {
++			rdmac_mode |= RDMAC_MODE_JMB_2K_MMRR;
++			tp->dma_limit = TG3_TX_BD_DMA_MAX_2K;
++		}
++	}
++
+ 	if (tg3_flag(tp, HW_TSO_1) ||
+ 	    tg3_flag(tp, HW_TSO_2) ||
+ 	    tg3_flag(tp, HW_TSO_3))
+diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
+index d330e81..6f9b74c 100644
+--- a/drivers/net/ethernet/broadcom/tg3.h
++++ b/drivers/net/ethernet/broadcom/tg3.h
+@@ -1159,6 +1159,8 @@
+ #define  CPMU_MUTEX_GNT_DRIVER		 0x00001000
+ #define TG3_CPMU_PHY_STRAP		0x00003664
+ #define TG3_CPMU_PHY_STRAP_IS_SERDES	 0x00000020
++#define TG3_CPMU_PADRNG_CTL		0x00003668
++#define  TG3_CPMU_PADRNG_CTL_RDIV2	 0x00040000
+ /* 0x3664 --> 0x36b0 unused */
+ 
+ #define TG3_CPMU_EEE_MODE		0x000036b0
+diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+index 6e1915a..c00c13a 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
++++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+@@ -519,7 +519,7 @@ static const u32 ar9580_1p0_mac_core[][2] = {
+ 	{0x00008258, 0x00000000},
+ 	{0x0000825c, 0x40000000},
+ 	{0x00008260, 0x00080922},
+-	{0x00008264, 0x9bc00010},
++	{0x00008264, 0x9d400010},
+ 	{0x00008268, 0xffffffff},
+ 	{0x0000826c, 0x0000ffff},
+ 	{0x00008270, 0x00000000},
+diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+index 05d5ba6..0663653 100644
+--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
++++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+@@ -796,7 +796,7 @@ static int ath9k_init_firmware_version(struct ath9k_htc_priv *priv)
+ 	 * required version.
+ 	 */
+ 	if (priv->fw_version_major != MAJOR_VERSION_REQ ||
+-	    priv->fw_version_minor != MINOR_VERSION_REQ) {
++	    priv->fw_version_minor < MINOR_VERSION_REQ) {
+ 		dev_err(priv->dev, "ath9k_htc: Please upgrade to FW version %d.%d\n",
+ 			MAJOR_VERSION_REQ, MINOR_VERSION_REQ);
+ 		return -EINVAL;
+diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
+index e8486c1..b70f220 100644
+--- a/drivers/net/wireless/b43/phy_n.c
++++ b/drivers/net/wireless/b43/phy_n.c
+@@ -5165,7 +5165,8 @@ static void b43_nphy_pmu_spur_avoid(struct b43_wldev *dev, bool avoid)
+ #endif
+ #ifdef CONFIG_B43_SSB
+ 	case B43_BUS_SSB:
+-		/* FIXME */
++		ssb_pmu_spuravoid_pllupdate(&dev->dev->sdev->bus->chipco,
++					    avoid);
+ 		break;
+ #endif
+ 	}
+diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
+index a43415a..bc75528 100644
+--- a/drivers/ssb/driver_chipcommon_pmu.c
++++ b/drivers/ssb/driver_chipcommon_pmu.c
+@@ -675,3 +675,32 @@ u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
+ 		return 0;
+ 	}
+ }
++
++void ssb_pmu_spuravoid_pllupdate(struct ssb_chipcommon *cc, int spuravoid)
++{
++	u32 pmu_ctl = 0;
++
++	switch (cc->dev->bus->chip_id) {
++	case 0x4322:
++		ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL0, 0x11100070);
++		ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL1, 0x1014140a);
++		ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL5, 0x88888854);
++		if (spuravoid == 1)
++			ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL2, 0x05201828);
++		else
++			ssb_chipco_pll_write(cc, SSB_PMU1_PLLCTL2, 0x05001828);
++		pmu_ctl = SSB_CHIPCO_PMU_CTL_PLL_UPD;
++		break;
++	case 43222:
++		/* TODO: BCM43222 requires updating PLLs too */
++		return;
++	default:
++		ssb_printk(KERN_ERR PFX
++			   "Unknown spuravoidance settings for chip 0x%04X, not changing PLL\n",
++			   cc->dev->bus->chip_id);
++		return;
++	}
++
++	chipco_set32(cc, SSB_CHIPCO_PMU_CTL, pmu_ctl);
++}
++EXPORT_SYMBOL_GPL(ssb_pmu_spuravoid_pllupdate);
+diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
+index dc61c12..0a49456 100644
+--- a/drivers/video/fbmem.c
++++ b/drivers/video/fbmem.c
+@@ -1373,15 +1373,12 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
+ {
+ 	struct fb_info *info = file_fb_info(file);
+ 	struct fb_ops *fb;
+-	unsigned long off;
++	unsigned long mmio_pgoff;
+ 	unsigned long start;
+ 	u32 len;
+ 
+ 	if (!info)
+ 		return -ENODEV;
+-	if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT))
+-		return -EINVAL;
+-	off = vma->vm_pgoff << PAGE_SHIFT;
+ 	fb = info->fbops;
+ 	if (!fb)
+ 		return -ENODEV;
+@@ -1393,32 +1390,24 @@ fb_mmap(struct file *file, struct vm_area_struct * vma)
+ 		return res;
+ 	}
+ 
+-	/* frame buffer memory */
++	/*
++	 * Ugh. This can be either the frame buffer mapping, or
++	 * if pgoff points past it, the mmio mapping.
++	 */
+ 	start = info->fix.smem_start;
+-	len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);
+-	if (off >= len) {
+-		/* memory mapped io */
+-		off -= len;
+-		if (info->var.accel_flags) {
+-			mutex_unlock(&info->mm_lock);
+-			return -EINVAL;
+-		}
++	len = info->fix.smem_len;
++	mmio_pgoff = PAGE_ALIGN((start & ~PAGE_MASK) + len) >> PAGE_SHIFT;
++	if (vma->vm_pgoff >= mmio_pgoff) {
++		vma->vm_pgoff -= mmio_pgoff;
+ 		start = info->fix.mmio_start;
+-		len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
++		len = info->fix.mmio_len;
+ 	}
+ 	mutex_unlock(&info->mm_lock);
+-	start &= PAGE_MASK;
+-	if ((vma->vm_end - vma->vm_start + off) > len)
+-		return -EINVAL;
+-	off += start;
+-	vma->vm_pgoff = off >> PAGE_SHIFT;
+-	/* VM_IO | VM_DONTEXPAND | VM_DONTDUMP are set by io_remap_pfn_range()*/
++
+ 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+-	fb_pgprotect(file, vma, off);
+-	if (io_remap_pfn_range(vma, vma->vm_start, off >> PAGE_SHIFT,
+-			     vma->vm_end - vma->vm_start, vma->vm_page_prot))
+-		return -EAGAIN;
+-	return 0;
++	fb_pgprotect(file, vma, start);
++
++	return vm_iomap_memory(vma, start, len);
+ }
+ 
+ static int
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 0c42cdb..5843a47 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -1132,6 +1132,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+ 			goto whole;
+ 		if (!(vma->vm_flags & VM_SHARED) && FILTER(HUGETLB_PRIVATE))
+ 			goto whole;
++		return 0;
+ 	}
+ 
+ 	/* Do not dump I/O mapped devices or special mappings */
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 744a69b..8a00e2f 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -318,6 +318,7 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ 	unsigned long src_ptr;
+ 	unsigned long dst_ptr;
+ 	int overwrite_root = 0;
++	bool inode_item = key->type == BTRFS_INODE_ITEM_KEY;
+ 
+ 	if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID)
+ 		overwrite_root = 1;
+@@ -327,6 +328,9 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ 
+ 	/* look for the key in the destination tree */
+ 	ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
++	if (ret < 0)
++		return ret;
++
+ 	if (ret == 0) {
+ 		char *src_copy;
+ 		char *dst_copy;
+@@ -368,6 +372,30 @@ static noinline int overwrite_item(struct btrfs_trans_handle *trans,
+ 			return 0;
+ 		}
+ 
++		/*
++		 * We need to load the old nbytes into the inode so when we
++		 * replay the extents we've logged we get the right nbytes.
++		 */
++		if (inode_item) {
++			struct btrfs_inode_item *item;
++			u64 nbytes;
++
++			item = btrfs_item_ptr(path->nodes[0], path->slots[0],
++					      struct btrfs_inode_item);
++			nbytes = btrfs_inode_nbytes(path->nodes[0], item);
++			item = btrfs_item_ptr(eb, slot,
++					      struct btrfs_inode_item);
++			btrfs_set_inode_nbytes(eb, item, nbytes);
++		}
++	} else if (inode_item) {
++		struct btrfs_inode_item *item;
++
++		/*
++		 * New inode, set nbytes to 0 so that the nbytes comes out
++		 * properly when we replay the extents.
++		 */
++		item = btrfs_item_ptr(eb, slot, struct btrfs_inode_item);
++		btrfs_set_inode_nbytes(eb, item, 0);
+ 	}
+ insert:
+ 	btrfs_release_path(path);
+@@ -488,7 +516,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 	u64 mask = root->sectorsize - 1;
+ 	u64 extent_end;
+ 	u64 start = key->offset;
+-	u64 saved_nbytes;
++	u64 nbytes = 0;
+ 	struct btrfs_file_extent_item *item;
+ 	struct inode *inode = NULL;
+ 	unsigned long size;
+@@ -498,10 +526,19 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 	found_type = btrfs_file_extent_type(eb, item);
+ 
+ 	if (found_type == BTRFS_FILE_EXTENT_REG ||
+-	    found_type == BTRFS_FILE_EXTENT_PREALLOC)
+-		extent_end = start + btrfs_file_extent_num_bytes(eb, item);
+-	else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
++	    found_type == BTRFS_FILE_EXTENT_PREALLOC) {
++		nbytes = btrfs_file_extent_num_bytes(eb, item);
++		extent_end = start + nbytes;
++
++		/*
++		 * We don't add to the inodes nbytes if we are prealloc or a
++		 * hole.
++		 */
++		if (btrfs_file_extent_disk_bytenr(eb, item) == 0)
++			nbytes = 0;
++	} else if (found_type == BTRFS_FILE_EXTENT_INLINE) {
+ 		size = btrfs_file_extent_inline_len(eb, item);
++		nbytes = btrfs_file_extent_ram_bytes(eb, item);
+ 		extent_end = (start + size + mask) & ~mask;
+ 	} else {
+ 		ret = 0;
+@@ -550,7 +587,6 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 	}
+ 	btrfs_release_path(path);
+ 
+-	saved_nbytes = inode_get_bytes(inode);
+ 	/* drop any overlapping extents */
+ 	ret = btrfs_drop_extents(trans, root, inode, start, extent_end, 1);
+ 	BUG_ON(ret);
+@@ -637,7 +673,7 @@ static noinline int replay_one_extent(struct btrfs_trans_handle *trans,
+ 		BUG_ON(ret);
+ 	}
+ 
+-	inode_set_bytes(inode, saved_nbytes);
++	inode_add_bytes(inode, nbytes);
+ 	ret = btrfs_update_inode(trans, root, inode);
+ out:
+ 	if (inode)
+diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
+index eba76ea..fc8ddc1 100644
+--- a/fs/hfsplus/extents.c
++++ b/fs/hfsplus/extents.c
+@@ -533,7 +533,7 @@ void hfsplus_file_truncate(struct inode *inode)
+ 		struct address_space *mapping = inode->i_mapping;
+ 		struct page *page;
+ 		void *fsdata;
+-		u32 size = inode->i_size;
++		loff_t size = inode->i_size;
+ 
+ 		res = pagecache_write_begin(NULL, mapping, size, 0,
+ 						AOP_FLAG_UNINTERRUPTIBLE,
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 78bde32..ccee8cc 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -110,7 +110,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ 	 * way when do_mmap_pgoff unwinds (may be important on powerpc
+ 	 * and ia64).
+ 	 */
+-	vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND | VM_DONTDUMP;
++	vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
+ 	vma->vm_ops = &hugetlb_vm_ops;
+ 
+ 	if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
+diff --git a/fs/proc/array.c b/fs/proc/array.c
+index 6a91e6f..be3c22f 100644
+--- a/fs/proc/array.c
++++ b/fs/proc/array.c
+@@ -143,6 +143,7 @@ static const char * const task_state_array[] = {
+ 	"x (dead)",		/*  64 */
+ 	"K (wakekill)",		/* 128 */
+ 	"W (waking)",		/* 256 */
++	"P (parked)",		/* 512 */
+ };
+ 
+ static inline const char *get_task_state(struct task_struct *tsk)
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index 2c497ab..ffdf8b7 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -511,7 +511,7 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 			   void *data, unsigned long len);
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+-			      gpa_t gpa);
++			      gpa_t gpa, unsigned long len);
+ int kvm_clear_guest_page(struct kvm *kvm, gfn_t gfn, int offset, int len);
+ int kvm_clear_guest(struct kvm *kvm, gpa_t gpa, unsigned long len);
+ struct kvm_memory_slot *gfn_to_memslot(struct kvm *kvm, gfn_t gfn);
+diff --git a/include/linux/kvm_types.h b/include/linux/kvm_types.h
+index fa7cc72..b0bcce0 100644
+--- a/include/linux/kvm_types.h
++++ b/include/linux/kvm_types.h
+@@ -71,6 +71,7 @@ struct gfn_to_hva_cache {
+ 	u64 generation;
+ 	gpa_t gpa;
+ 	unsigned long hva;
++	unsigned long len;
+ 	struct kvm_memory_slot *memslot;
+ };
+ 
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 66e2f7c..9568b90 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1623,6 +1623,8 @@ int vm_insert_pfn(struct vm_area_struct *vma, unsigned long addr,
+ 			unsigned long pfn);
+ int vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr,
+ 			unsigned long pfn);
++int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len);
++
+ 
+ struct page *follow_page(struct vm_area_struct *, unsigned long address,
+ 			unsigned int foll_flags);
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index d211247..7e49270 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -163,9 +163,10 @@ print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq)
+ #define TASK_DEAD		64
+ #define TASK_WAKEKILL		128
+ #define TASK_WAKING		256
+-#define TASK_STATE_MAX		512
++#define TASK_PARKED		512
++#define TASK_STATE_MAX		1024
+ 
+-#define TASK_STATE_TO_CHAR_STR "RSDTtZXxKW"
++#define TASK_STATE_TO_CHAR_STR "RSDTtZXxKWP"
+ 
+ extern char ___assert_task_state[1 - 2*!!(
+ 		sizeof(TASK_STATE_TO_CHAR_STR)-1 != ilog2(TASK_STATE_MAX)+1)];
+diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
+index 9e492be..6fcfe99 100644
+--- a/include/linux/ssb/ssb_driver_chipcommon.h
++++ b/include/linux/ssb/ssb_driver_chipcommon.h
+@@ -219,6 +219,7 @@
+ #define SSB_CHIPCO_PMU_CTL			0x0600 /* PMU control */
+ #define  SSB_CHIPCO_PMU_CTL_ILP_DIV		0xFFFF0000 /* ILP div mask */
+ #define  SSB_CHIPCO_PMU_CTL_ILP_DIV_SHIFT	16
++#define  SSB_CHIPCO_PMU_CTL_PLL_UPD		0x00000400
+ #define  SSB_CHIPCO_PMU_CTL_NOILPONW		0x00000200 /* No ILP on wait */
+ #define  SSB_CHIPCO_PMU_CTL_HTREQEN		0x00000100 /* HT req enable */
+ #define  SSB_CHIPCO_PMU_CTL_ALPREQEN		0x00000080 /* ALP req enable */
+@@ -667,5 +668,6 @@ enum ssb_pmu_ldo_volt_id {
+ void ssb_pmu_set_ldo_voltage(struct ssb_chipcommon *cc,
+ 			     enum ssb_pmu_ldo_volt_id id, u32 voltage);
+ void ssb_pmu_set_ldo_paref(struct ssb_chipcommon *cc, bool on);
++void ssb_pmu_spuravoid_pllupdate(struct ssb_chipcommon *cc, int spuravoid);
+ 
+ #endif /* LINUX_SSB_CHIPCO_H_ */
+diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h
+index 5a8671e..e5586ca 100644
+--- a/include/trace/events/sched.h
++++ b/include/trace/events/sched.h
+@@ -147,7 +147,7 @@ TRACE_EVENT(sched_switch,
+ 		  __print_flags(__entry->prev_state & (TASK_STATE_MAX-1), "|",
+ 				{ 1, "S"} , { 2, "D" }, { 4, "T" }, { 8, "t" },
+ 				{ 16, "Z" }, { 32, "X" }, { 64, "x" },
+-				{ 128, "W" }) : "R",
++				{ 128, "K" }, { 256, "W" }, { 512, "P" }) : "R",
+ 		__entry->prev_state & TASK_STATE_MAX ? "+" : "",
+ 		__entry->next_comm, __entry->next_pid, __entry->next_prio)
+ );
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 7b6646a..0600d3b 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5328,7 +5328,7 @@ static void sw_perf_event_destroy(struct perf_event *event)
+ 
+ static int perf_swevent_init(struct perf_event *event)
+ {
+-	int event_id = event->attr.config;
++	u64 event_id = event->attr.config;
+ 
+ 	if (event->attr.type != PERF_TYPE_SOFTWARE)
+ 		return -ENOENT;
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index cdd5607..e4cee8d 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -61,6 +61,7 @@
+ DEFINE_PER_CPU(struct hrtimer_cpu_base, hrtimer_bases) =
+ {
+ 
++	.lock = __RAW_SPIN_LOCK_UNLOCKED(hrtimer_bases.lock),
+ 	.clock_base =
+ 	{
+ 		{
+@@ -1640,8 +1641,6 @@ static void __cpuinit init_hrtimers_cpu(int cpu)
+ 	struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
+ 	int i;
+ 
+-	raw_spin_lock_init(&cpu_base->lock);
+-
+ 	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
+ 		cpu_base->clock_base[i].cpu_base = cpu_base;
+ 		timerqueue_init_head(&cpu_base->clock_base[i].active);
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index 691dc2e..9eb7fed 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -124,12 +124,12 @@ void *kthread_data(struct task_struct *task)
+ 
+ static void __kthread_parkme(struct kthread *self)
+ {
+-	__set_current_state(TASK_INTERRUPTIBLE);
++	__set_current_state(TASK_PARKED);
+ 	while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) {
+ 		if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags))
+ 			complete(&self->parked);
+ 		schedule();
+-		__set_current_state(TASK_INTERRUPTIBLE);
++		__set_current_state(TASK_PARKED);
+ 	}
+ 	clear_bit(KTHREAD_IS_PARKED, &self->flags);
+ 	__set_current_state(TASK_RUNNING);
+@@ -256,8 +256,13 @@ struct task_struct *kthread_create_on_node(int (*threadfn)(void *data),
+ }
+ EXPORT_SYMBOL(kthread_create_on_node);
+ 
+-static void __kthread_bind(struct task_struct *p, unsigned int cpu)
++static void __kthread_bind(struct task_struct *p, unsigned int cpu, long state)
+ {
++	/* Must have done schedule() in kthread() before we set_task_cpu */
++	if (!wait_task_inactive(p, state)) {
++		WARN_ON(1);
++		return;
++	}
+ 	/* It's safe because the task is inactive. */
+ 	do_set_cpus_allowed(p, cpumask_of(cpu));
+ 	p->flags |= PF_THREAD_BOUND;
+@@ -274,12 +279,7 @@ static void __kthread_bind(struct task_struct *p, unsigned int cpu)
+  */
+ void kthread_bind(struct task_struct *p, unsigned int cpu)
+ {
+-	/* Must have done schedule() in kthread() before we set_task_cpu */
+-	if (!wait_task_inactive(p, TASK_UNINTERRUPTIBLE)) {
+-		WARN_ON(1);
+-		return;
+-	}
+-	__kthread_bind(p, cpu);
++	__kthread_bind(p, cpu, TASK_UNINTERRUPTIBLE);
+ }
+ EXPORT_SYMBOL(kthread_bind);
+ 
+@@ -324,6 +324,22 @@ static struct kthread *task_get_live_kthread(struct task_struct *k)
+ 	return NULL;
+ }
+ 
++static void __kthread_unpark(struct task_struct *k, struct kthread *kthread)
++{
++	clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
++	/*
++	 * We clear the IS_PARKED bit here as we don't wait
++	 * until the task has left the park code. So if we'd
++	 * park before that happens we'd see the IS_PARKED bit
++	 * which might be about to be cleared.
++	 */
++	if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
++		if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
++			__kthread_bind(k, kthread->cpu, TASK_PARKED);
++		wake_up_state(k, TASK_PARKED);
++	}
++}
++
+ /**
+  * kthread_unpark - unpark a thread created by kthread_create().
+  * @k:		thread created by kthread_create().
+@@ -336,20 +352,8 @@ void kthread_unpark(struct task_struct *k)
+ {
+ 	struct kthread *kthread = task_get_live_kthread(k);
+ 
+-	if (kthread) {
+-		clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
+-		/*
+-		 * We clear the IS_PARKED bit here as we don't wait
+-		 * until the task has left the park code. So if we'd
+-		 * park before that happens we'd see the IS_PARKED bit
+-		 * which might be about to be cleared.
+-		 */
+-		if (test_and_clear_bit(KTHREAD_IS_PARKED, &kthread->flags)) {
+-			if (test_bit(KTHREAD_IS_PER_CPU, &kthread->flags))
+-				__kthread_bind(k, kthread->cpu);
+-			wake_up_process(k);
+-		}
+-	}
++	if (kthread)
++		__kthread_unpark(k, kthread);
+ 	put_task_struct(k);
+ }
+ 
+@@ -407,7 +411,7 @@ int kthread_stop(struct task_struct *k)
+ 	trace_sched_kthread_stop(k);
+ 	if (kthread) {
+ 		set_bit(KTHREAD_SHOULD_STOP, &kthread->flags);
+-		clear_bit(KTHREAD_SHOULD_PARK, &kthread->flags);
++		__kthread_unpark(k, kthread);
+ 		wake_up_process(k);
+ 		wait_for_completion(&kthread->exited);
+ 	}
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 26058d0..5e2f7c3 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1488,8 +1488,10 @@ static void try_to_wake_up_local(struct task_struct *p)
+ {
+ 	struct rq *rq = task_rq(p);
+ 
+-	BUG_ON(rq != this_rq());
+-	BUG_ON(p == current);
++	if (WARN_ON_ONCE(rq != this_rq()) ||
++	    WARN_ON_ONCE(p == current))
++		return;
++
+ 	lockdep_assert_held(&rq->lock);
+ 
+ 	if (!raw_spin_trylock(&p->pi_lock)) {
+@@ -4948,7 +4950,7 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+ }
+ 
+ static int min_load_idx = 0;
+-static int max_load_idx = CPU_LOAD_IDX_MAX;
++static int max_load_idx = CPU_LOAD_IDX_MAX-1;
+ 
+ static void
+ set_table_entry(struct ctl_table *entry,
+diff --git a/kernel/signal.c b/kernel/signal.c
+index dec9c30..50e425c 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -2880,7 +2880,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
+ 
+ static int do_tkill(pid_t tgid, pid_t pid, int sig)
+ {
+-	struct siginfo info;
++	struct siginfo info = {};
+ 
+ 	info.si_signo = sig;
+ 	info.si_errno = 0;
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index f45e128..f359dc7 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -25,7 +25,8 @@
+ 
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ 
+-static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
++static bool new_idmap_permitted(const struct file *file,
++				struct user_namespace *ns, int cap_setid,
+ 				struct uid_gid_map *map);
+ 
+ static void set_cred_user_ns(struct cred *cred, struct user_namespace *user_ns)
+@@ -575,10 +576,10 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ 	if (map->nr_extents != 0)
+ 		goto out;
+ 
+-	/* Require the appropriate privilege CAP_SETUID or CAP_SETGID
+-	 * over the user namespace in order to set the id mapping.
++	/*
++	 * Adjusting namespace settings requires capabilities on the target.
+ 	 */
+-	if (cap_valid(cap_setid) && !ns_capable(ns, cap_setid))
++	if (cap_valid(cap_setid) && !file_ns_capable(file, ns, CAP_SYS_ADMIN))
+ 		goto out;
+ 
+ 	/* Get a buffer */
+@@ -666,7 +667,7 @@ static ssize_t map_write(struct file *file, const char __user *buf,
+ 
+ 	ret = -EPERM;
+ 	/* Validate the user is allowed to use user id's mapped to. */
+-	if (!new_idmap_permitted(ns, cap_setid, &new_map))
++	if (!new_idmap_permitted(file, ns, cap_setid, &new_map))
+ 		goto out;
+ 
+ 	/* Map the lower ids from the parent user namespace to the
+@@ -753,7 +754,8 @@ ssize_t proc_projid_map_write(struct file *file, const char __user *buf, size_t
+ 			 &ns->projid_map, &ns->parent->projid_map);
+ }
+ 
+-static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
++static bool new_idmap_permitted(const struct file *file,
++				struct user_namespace *ns, int cap_setid,
+ 				struct uid_gid_map *new_map)
+ {
+ 	/* Allow mapping to your own filesystem ids */
+@@ -761,12 +763,12 @@ static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
+ 		u32 id = new_map->extent[0].lower_first;
+ 		if (cap_setid == CAP_SETUID) {
+ 			kuid_t uid = make_kuid(ns->parent, id);
+-			if (uid_eq(uid, current_fsuid()))
++			if (uid_eq(uid, file->f_cred->fsuid))
+ 				return true;
+ 		}
+ 		else if (cap_setid == CAP_SETGID) {
+ 			kgid_t gid = make_kgid(ns->parent, id);
+-			if (gid_eq(gid, current_fsgid()))
++			if (gid_eq(gid, file->f_cred->fsgid))
+ 				return true;
+ 		}
+ 	}
+@@ -777,8 +779,10 @@ static bool new_idmap_permitted(struct user_namespace *ns, int cap_setid,
+ 
+ 	/* Allow the specified ids if we have the appropriate capability
+ 	 * (CAP_SETUID or CAP_SETGID) over the parent user namespace.
++	 * And the opener of the id file also had the approprpiate capability.
+ 	 */
+-	if (ns_capable(ns->parent, cap_setid))
++	if (ns_capable(ns->parent, cap_setid) &&
++	    file_ns_capable(file, ns->parent, cap_setid))
+ 		return true;
+ 
+ 	return false;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d7cec92..88eb939 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2965,7 +2965,17 @@ int follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 			break;
+ 		}
+ 
+-		if (absent ||
++		/*
++		 * We need call hugetlb_fault for both hugepages under migration
++		 * (in which case hugetlb_fault waits for the migration,) and
++		 * hwpoisoned hugepages (in which case we need to prevent the
++		 * caller from accessing to them.) In order to do this, we use
++		 * here is_swap_pte instead of is_hugetlb_entry_migration and
++		 * is_hugetlb_entry_hwpoisoned. This is because it simply covers
++		 * both cases, and because we can't follow correct pages
++		 * directly from any kind of swap entries.
++		 */
++		if (absent || is_swap_pte(huge_ptep_get(pte)) ||
+ 		    ((flags & FOLL_WRITE) && !pte_write(huge_ptep_get(pte)))) {
+ 			int ret;
+ 
+diff --git a/mm/memory.c b/mm/memory.c
+index f8b734a..32a495a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -2358,6 +2358,53 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
+ }
+ EXPORT_SYMBOL(remap_pfn_range);
+ 
++/**
++ * vm_iomap_memory - remap memory to userspace
++ * @vma: user vma to map to
++ * @start: start of area
++ * @len: size of area
++ *
++ * This is a simplified io_remap_pfn_range() for common driver use. The
++ * driver just needs to give us the physical memory range to be mapped,
++ * we'll figure out the rest from the vma information.
++ *
++ * NOTE! Some drivers might want to tweak vma->vm_page_prot first to get
++ * whatever write-combining details or similar.
++ */
++int vm_iomap_memory(struct vm_area_struct *vma, phys_addr_t start, unsigned long len)
++{
++	unsigned long vm_len, pfn, pages;
++
++	/* Check that the physical memory area passed in looks valid */
++	if (start + len < start)
++		return -EINVAL;
++	/*
++	 * You *really* shouldn't map things that aren't page-aligned,
++	 * but we've historically allowed it because IO memory might
++	 * just have smaller alignment.
++	 */
++	len += start & ~PAGE_MASK;
++	pfn = start >> PAGE_SHIFT;
++	pages = (len + ~PAGE_MASK) >> PAGE_SHIFT;
++	if (pfn + pages < pfn)
++		return -EINVAL;
++
++	/* We start the mapping 'vm_pgoff' pages into the area */
++	if (vma->vm_pgoff > pages)
++		return -EINVAL;
++	pfn += vma->vm_pgoff;
++	pages -= vma->vm_pgoff;
++
++	/* Can we fit all of the mapping? */
++	vm_len = vma->vm_end - vma->vm_start;
++	if (vm_len >> PAGE_SHIFT > pages)
++		return -EINVAL;
++
++	/* Ok, let it rip */
++	return io_remap_pfn_range(vma, vma->vm_start, pfn, vm_len, vma->vm_page_prot);
++}
++EXPORT_SYMBOL(vm_iomap_memory);
++
+ static int apply_to_pte_range(struct mm_struct *mm, pmd_t *pmd,
+ 				     unsigned long addr, unsigned long end,
+ 				     pte_fn_t fn, void *data)
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index e14e676..a1a7997 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3723,8 +3723,16 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
+ 	/* prep auth_data so we don't go into idle on disassoc */
+ 	ifmgd->auth_data = auth_data;
+ 
+-	if (ifmgd->associated)
+-		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
++	if (ifmgd->associated) {
++		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++
++		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
++				       WLAN_REASON_UNSPECIFIED,
++				       false, frame_buf);
++
++		__cfg80211_send_deauth(sdata->dev, frame_buf,
++				       sizeof(frame_buf));
++	}
+ 
+ 	sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
+ 
+@@ -3783,8 +3791,16 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
+ 
+ 	mutex_lock(&ifmgd->mtx);
+ 
+-	if (ifmgd->associated)
+-		ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
++	if (ifmgd->associated) {
++		u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
++
++		ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
++				       WLAN_REASON_UNSPECIFIED,
++				       false, frame_buf);
++
++		__cfg80211_send_deauth(sdata->dev, frame_buf,
++				       sizeof(frame_buf));
++	}
+ 
+ 	if (ifmgd->auth_data && !ifmgd->auth_data->done) {
+ 		err = -EBUSY;
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 09b4286..f4aaf5a 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3222,18 +3222,10 @@ EXPORT_SYMBOL_GPL(snd_pcm_lib_default_mmap);
+ int snd_pcm_lib_mmap_iomem(struct snd_pcm_substream *substream,
+ 			   struct vm_area_struct *area)
+ {
+-	long size;
+-	unsigned long offset;
++	struct snd_pcm_runtime *runtime = substream->runtime;;
+ 
+ 	area->vm_page_prot = pgprot_noncached(area->vm_page_prot);
+-	area->vm_flags |= VM_IO;
+-	size = area->vm_end - area->vm_start;
+-	offset = area->vm_pgoff << PAGE_SHIFT;
+-	if (io_remap_pfn_range(area, area->vm_start,
+-				(substream->runtime->dma_addr + offset) >> PAGE_SHIFT,
+-				size, area->vm_page_prot))
+-		return -EAGAIN;
+-	return 0;
++	return vm_iomap_memory(area, runtime->dma_addr, runtime->dma_bytes);
+ }
+ 
+ EXPORT_SYMBOL(snd_pcm_lib_mmap_iomem);
+diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
+index cfb7e4d..52058f0 100644
+--- a/virt/kvm/ioapic.c
++++ b/virt/kvm/ioapic.c
+@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
+ 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
+ 			u64 redir_content;
+ 
+-			ASSERT(redir_index < IOAPIC_NUM_PINS);
++			if (redir_index < IOAPIC_NUM_PINS)
++				redir_content =
++					ioapic->redirtbl[redir_index].bits;
++			else
++				redir_content = ~0ULL;
+ 
+-			redir_content = ioapic->redirtbl[redir_index].bits;
+ 			result = (ioapic->ioregsel & 0x1) ?
+ 			    (redir_content >> 32) & 0xffffffff :
+ 			    redir_content & 0xffffffff;
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 1cd693a..10afa34 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -1476,21 +1476,38 @@ int kvm_write_guest(struct kvm *kvm, gpa_t gpa, const void *data,
+ }
+ 
+ int kvm_gfn_to_hva_cache_init(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+-			      gpa_t gpa)
++			      gpa_t gpa, unsigned long len)
+ {
+ 	struct kvm_memslots *slots = kvm_memslots(kvm);
+ 	int offset = offset_in_page(gpa);
+-	gfn_t gfn = gpa >> PAGE_SHIFT;
++	gfn_t start_gfn = gpa >> PAGE_SHIFT;
++	gfn_t end_gfn = (gpa + len - 1) >> PAGE_SHIFT;
++	gfn_t nr_pages_needed = end_gfn - start_gfn + 1;
++	gfn_t nr_pages_avail;
+ 
+ 	ghc->gpa = gpa;
+ 	ghc->generation = slots->generation;
+-	ghc->memslot = gfn_to_memslot(kvm, gfn);
+-	ghc->hva = gfn_to_hva_many(ghc->memslot, gfn, NULL);
+-	if (!kvm_is_error_hva(ghc->hva))
++	ghc->len = len;
++	ghc->memslot = gfn_to_memslot(kvm, start_gfn);
++	ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn, &nr_pages_avail);
++	if (!kvm_is_error_hva(ghc->hva) && nr_pages_avail >= nr_pages_needed) {
+ 		ghc->hva += offset;
+-	else
+-		return -EFAULT;
+-
++	} else {
++		/*
++		 * If the requested region crosses two memslots, we still
++		 * verify that the entire region is valid here.
++		 */
++		while (start_gfn <= end_gfn) {
++			ghc->memslot = gfn_to_memslot(kvm, start_gfn);
++			ghc->hva = gfn_to_hva_many(ghc->memslot, start_gfn,
++						   &nr_pages_avail);
++			if (kvm_is_error_hva(ghc->hva))
++				return -EFAULT;
++			start_gfn += nr_pages_avail;
++		}
++		/* Use the slow path for cross page reads and writes. */
++		ghc->memslot = NULL;
++	}
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(kvm_gfn_to_hva_cache_init);
+@@ -1501,8 +1518,13 @@ int kvm_write_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 	struct kvm_memslots *slots = kvm_memslots(kvm);
+ 	int r;
+ 
++	BUG_ON(len > ghc->len);
++
+ 	if (slots->generation != ghc->generation)
+-		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++	if (unlikely(!ghc->memslot))
++		return kvm_write_guest(kvm, ghc->gpa, data, len);
+ 
+ 	if (kvm_is_error_hva(ghc->hva))
+ 		return -EFAULT;
+@@ -1522,8 +1544,13 @@ int kvm_read_guest_cached(struct kvm *kvm, struct gfn_to_hva_cache *ghc,
+ 	struct kvm_memslots *slots = kvm_memslots(kvm);
+ 	int r;
+ 
++	BUG_ON(len > ghc->len);
++
+ 	if (slots->generation != ghc->generation)
+-		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa);
++		kvm_gfn_to_hva_cache_init(kvm, ghc, ghc->gpa, ghc->len);
++
++	if (unlikely(!ghc->memslot))
++		return kvm_read_guest(kvm, ghc->gpa, data, len);
+ 
+ 	if (kvm_is_error_hva(ghc->hva))
+ 		return -EFAULT;
diff --git a/3.8.10/1009_linux-3.8.10.patch b/3.8.10/1009_linux-3.8.10.patch
new file mode 100644
index 0000000..330becd
--- /dev/null
+++ b/3.8.10/1009_linux-3.8.10.patch
@@ -0,0 +1,67 @@
+diff --git a/Makefile b/Makefile
+index 3ae4796..e2b10b9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 8
+-SUBLEVEL = 9
++SUBLEVEL = 10
+ EXTRAVERSION =
+ NAME = Displaced Humerus Anterior
+ 
+diff --git a/include/linux/capability.h b/include/linux/capability.h
+index 98503b7..d9a4f7f4 100644
+--- a/include/linux/capability.h
++++ b/include/linux/capability.h
+@@ -35,6 +35,7 @@ struct cpu_vfs_cap_data {
+ #define _KERNEL_CAP_T_SIZE     (sizeof(kernel_cap_t))
+ 
+ 
++struct file;
+ struct inode;
+ struct dentry;
+ struct user_namespace;
+@@ -211,6 +212,7 @@ extern bool capable(int cap);
+ extern bool ns_capable(struct user_namespace *ns, int cap);
+ extern bool nsown_capable(int cap);
+ extern bool inode_capable(const struct inode *inode, int cap);
++extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
+ 
+ /* audit system wants to get cap info from files as well */
+ extern int get_vfs_caps_from_disk(const struct dentry *dentry, struct cpu_vfs_cap_data *cpu_caps);
+diff --git a/kernel/capability.c b/kernel/capability.c
+index 493d972..f6c2ce5 100644
+--- a/kernel/capability.c
++++ b/kernel/capability.c
+@@ -393,6 +393,30 @@ bool ns_capable(struct user_namespace *ns, int cap)
+ EXPORT_SYMBOL(ns_capable);
+ 
+ /**
++ * file_ns_capable - Determine if the file's opener had a capability in effect
++ * @file:  The file we want to check
++ * @ns:  The usernamespace we want the capability in
++ * @cap: The capability to be tested for
++ *
++ * Return true if task that opened the file had a capability in effect
++ * when the file was opened.
++ *
++ * This does not set PF_SUPERPRIV because the caller may not
++ * actually be privileged.
++ */
++bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap)
++{
++	if (WARN_ON_ONCE(!cap_valid(cap)))
++		return false;
++
++	if (security_capable(file->f_cred, ns, cap) == 0)
++		return true;
++
++	return false;
++}
++EXPORT_SYMBOL(file_ns_capable);
++
++/**
+  * capable - Determine if the current task has a superior capability in effect
+  * @cap: The capability to be tested for
+  *
diff --git a/3.8.8/4420_grsecurity-2.9.1-3.8.8-201304181923.patch b/3.8.10/4420_grsecurity-2.9.1-3.8.10-201304262208.patch
index 18ab857..d87332f 100644
--- a/3.8.8/4420_grsecurity-2.9.1-3.8.8-201304181923.patch
+++ b/3.8.10/4420_grsecurity-2.9.1-3.8.10-201304262208.patch
@@ -259,7 +259,7 @@ index 986614d..e8bfedc 100644
  
  	pcd.		[PARIDE]
 diff --git a/Makefile b/Makefile
-index 7684f95..12f2f86 100644
+index e2b10b9..f916aa5 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -5570,7 +5570,7 @@ index c1f6afa..38cc6e9 100644
  
  #endif /* _ASM_EXEC_H */
 diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
-index dbaec94..6a14935 100644
+index 21bff32..9f0c3b8 100644
 --- a/arch/mips/include/asm/page.h
 +++ b/arch/mips/include/asm/page.h
 @@ -96,7 +96,7 @@ extern void copy_user_highpage(struct page *to, struct page *from,
@@ -6047,10 +6047,31 @@ index fc987a1..6e068ef 100644
  #endif
  
 diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 7df49fa..38b62bf 100644
+index 7df49fa..a3eb445 100644
 --- a/arch/parisc/include/asm/pgtable.h
 +++ b/arch/parisc/include/asm/pgtable.h
-@@ -218,6 +218,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+@@ -16,6 +16,8 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+ 
++extern spinlock_t pa_dbit_lock;
++
+ /*
+  * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+  * memory.  For the return value to be meaningful, ADDR must be >=
+@@ -44,8 +46,11 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+ 
+ #define set_pte_at(mm, addr, ptep, pteval)                      \
+ 	do {                                                    \
++		unsigned long flags;				\
++		spin_lock_irqsave(&pa_dbit_lock, flags);	\
+ 		set_pte(ptep, pteval);                          \
+ 		purge_tlb_entries(mm, addr);                    \
++		spin_unlock_irqrestore(&pa_dbit_lock, flags);	\
+ 	} while (0)
+ 
+ #endif /* !__ASSEMBLY__ */
+@@ -218,6 +223,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
  #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
  #define PAGE_COPY       PAGE_EXECREAD
  #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -6068,6 +6089,75 @@ index 7df49fa..38b62bf 100644
  #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
  #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL_EXEC)
  #define PAGE_KERNEL_RWX	__pgprot(_PAGE_KERNEL_RWX)
+@@ -435,48 +451,46 @@ extern void update_mmu_cache(struct vm_area_struct *, unsigned long, pte_t *);
+ 
+ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
++	pte_t pte;
++	unsigned long flags;
++
+ 	if (!pte_young(*ptep))
+ 		return 0;
+-	return test_and_clear_bit(xlate_pabit(_PAGE_ACCESSED_BIT), &pte_val(*ptep));
+-#else
+-	pte_t pte = *ptep;
+-	if (!pte_young(pte))
++
++	spin_lock_irqsave(&pa_dbit_lock, flags);
++	pte = *ptep;
++	if (!pte_young(pte)) {
++		spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ 		return 0;
+-	set_pte_at(vma->vm_mm, addr, ptep, pte_mkold(pte));
++	}
++	set_pte(ptep, pte_mkold(pte));
++	purge_tlb_entries(vma->vm_mm, addr);
++	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ 	return 1;
+-#endif
+ }
+ 
+-extern spinlock_t pa_dbit_lock;
+-
+ struct mm_struct;
+ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ 	pte_t old_pte;
++	unsigned long flags;
+ 
+-	spin_lock(&pa_dbit_lock);
++	spin_lock_irqsave(&pa_dbit_lock, flags);
+ 	old_pte = *ptep;
+ 	pte_clear(mm,addr,ptep);
+-	spin_unlock(&pa_dbit_lock);
++	purge_tlb_entries(mm, addr);
++	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ 
+ 	return old_pte;
+ }
+ 
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+-#ifdef CONFIG_SMP
+-	unsigned long new, old;
+-
+-	do {
+-		old = pte_val(*ptep);
+-		new = pte_val(pte_wrprotect(__pte (old)));
+-	} while (cmpxchg((unsigned long *) ptep, old, new) != old);
++	unsigned long flags;
++	spin_lock_irqsave(&pa_dbit_lock, flags);
++	set_pte(ptep, pte_wrprotect(*ptep));
+ 	purge_tlb_entries(mm, addr);
+-#else
+-	pte_t old_pte = *ptep;
+-	set_pte_at(mm, addr, ptep, pte_wrprotect(old_pte));
+-#endif
++	spin_unlock_irqrestore(&pa_dbit_lock, flags);
+ }
+ 
+ #define pte_same(A,B)	(pte_val(A) == pte_val(B))
 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
 index 4ba2c93..f5e3974 100644
 --- a/arch/parisc/include/asm/uaccess.h
@@ -6085,6 +6175,26 @@ index 4ba2c93..f5e3974 100644
                  ret = __copy_from_user(to, from, n);
          else
                  copy_from_user_overflow();
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index b89a85a..a9891fa 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -426,14 +426,11 @@ void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+ 	/* Note: purge_tlb_entries can be called at startup with
+ 	   no context.  */
+ 
+-	/* Disable preemption while we play with %sr1.  */
+-	preempt_disable();
++	purge_tlb_start(flags);
+ 	mtsp(mm->context, 1);
+-	purge_tlb_start(flags);
+ 	pdtlb(addr);
+ 	pitlb(addr);
+ 	purge_tlb_end(flags);
+-	preempt_enable();
+ }
+ EXPORT_SYMBOL(purge_tlb_entries);
+ 
 diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
 index 2a625fb..9908930 100644
 --- a/arch/parisc/kernel/module.c
@@ -8246,6 +8356,18 @@ index 6fc1348..390c50a 100644
  #define __S100	PAGE_READONLY
  #define __S101	PAGE_READONLY
  #define __S110	PAGE_SHARED
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index 08fcce9..7619f2f 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -915,6 +915,7 @@ static inline int io_remap_pfn_range(struct vm_area_struct *vma,
+ 	return remap_pfn_range(vma, from, phys_base >> PAGE_SHIFT, size, prot);
+ }
+ 
++#include <asm/tlbflush.h>
+ #include <asm-generic/pgtable.h>
+ 
+ /* We provide our own get_unmapped_area to cope with VA holes and
 diff --git a/arch/sparc/include/asm/pgtsrmmu.h b/arch/sparc/include/asm/pgtsrmmu.h
 index 79da178..c2eede8 100644
 --- a/arch/sparc/include/asm/pgtsrmmu.h
@@ -8363,6 +8485,20 @@ index 9689176..63c18ea 100644
  {
  	unsigned long mask, tmp1, tmp2, result;
  
+diff --git a/arch/sparc/include/asm/switch_to_64.h b/arch/sparc/include/asm/switch_to_64.h
+index cad36f5..c7de332 100644
+--- a/arch/sparc/include/asm/switch_to_64.h
++++ b/arch/sparc/include/asm/switch_to_64.h
+@@ -18,8 +18,7 @@ do {						\
+ 	 * and 2 stores in this critical code path.  -DaveM
+ 	 */
+ #define switch_to(prev, next, last)					\
+-do {	flush_tlb_pending();						\
+-	save_and_clear_fpu();						\
++do {	save_and_clear_fpu();						\
+ 	/* If you are tempted to conditionalize the following */	\
+ 	/* so that ASI is only written if it changes, think again. */	\
+ 	__asm__ __volatile__("wr %%g0, %0, %%asi"			\
 diff --git a/arch/sparc/include/asm/thread_info_32.h b/arch/sparc/include/asm/thread_info_32.h
 index 25849ae..924c54b 100644
 --- a/arch/sparc/include/asm/thread_info_32.h
@@ -8421,6 +8557,82 @@ index 269bd92..e46a9b8 100644
  /*
   * Thread-synchronous status.
   *
+diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
+index 2ef4634..f0d6a97 100644
+--- a/arch/sparc/include/asm/tlbflush_64.h
++++ b/arch/sparc/include/asm/tlbflush_64.h
+@@ -11,24 +11,40 @@
+ struct tlb_batch {
+ 	struct mm_struct *mm;
+ 	unsigned long tlb_nr;
++	unsigned long active;
+ 	unsigned long vaddrs[TLB_BATCH_NR];
+ };
+ 
+ extern void flush_tsb_kernel_range(unsigned long start, unsigned long end);
+ extern void flush_tsb_user(struct tlb_batch *tb);
++extern void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr);
+ 
+ /* TLB flush operations. */
+ 
++static inline void flush_tlb_mm(struct mm_struct *mm)
++{
++}
++
++static inline void flush_tlb_page(struct vm_area_struct *vma,
++				  unsigned long vmaddr)
++{
++}
++
++static inline void flush_tlb_range(struct vm_area_struct *vma,
++				   unsigned long start, unsigned long end)
++{
++}
++
++#define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
++
+ extern void flush_tlb_pending(void);
+-
+-#define flush_tlb_range(vma,start,end)	\
+-	do { (void)(start); flush_tlb_pending(); } while (0)
+-#define flush_tlb_page(vma,addr)	flush_tlb_pending()
+-#define flush_tlb_mm(mm)		flush_tlb_pending()
++extern void arch_enter_lazy_mmu_mode(void);
++extern void arch_leave_lazy_mmu_mode(void);
++#define arch_flush_lazy_mmu_mode()      do {} while (0)
+ 
+ /* Local cpu only.  */
+ extern void __flush_tlb_all(void);
+-
++extern void __flush_tlb_page(unsigned long context, unsigned long vaddr);
+ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
+ 
+ #ifndef CONFIG_SMP
+@@ -38,15 +54,24 @@ do {	flush_tsb_kernel_range(start,end); \
+ 	__flush_tlb_kernel_range(start,end); \
+ } while (0)
+ 
++static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
++{
++	__flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
++}
++
+ #else /* CONFIG_SMP */
+ 
+ extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
++extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
+ 
+ #define flush_tlb_kernel_range(start, end) \
+ do {	flush_tsb_kernel_range(start,end); \
+ 	smp_flush_tlb_kernel_range(start, end); \
+ } while (0)
+ 
++#define global_flush_tlb_page(mm, vaddr) \
++	smp_flush_tlb_page(mm, vaddr)
++
+ #endif /* ! CONFIG_SMP */
+ 
+ #endif /* _SPARC64_TLBFLUSH_H */
 diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
 index 0167d26..767bb0c 100644
 --- a/arch/sparc/include/asm/uaccess.h
@@ -8667,6 +8879,79 @@ index 7ff45e4..a58f271 100644
  	audit_syscall_exit(regs);
  
  	if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT)))
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index 537eb66..ca64d2a 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -849,7 +849,7 @@ void smp_tsb_sync(struct mm_struct *mm)
+ }
+ 
+ extern unsigned long xcall_flush_tlb_mm;
+-extern unsigned long xcall_flush_tlb_pending;
++extern unsigned long xcall_flush_tlb_page;
+ extern unsigned long xcall_flush_tlb_kernel_range;
+ extern unsigned long xcall_fetch_glob_regs;
+ extern unsigned long xcall_fetch_glob_pmu;
+@@ -1074,23 +1074,56 @@ local_flush_and_out:
+ 	put_cpu();
+ }
+ 
++struct tlb_pending_info {
++	unsigned long ctx;
++	unsigned long nr;
++	unsigned long *vaddrs;
++};
++
++static void tlb_pending_func(void *info)
++{
++	struct tlb_pending_info *t = info;
++
++	__flush_tlb_pending(t->ctx, t->nr, t->vaddrs);
++}
++
+ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long *vaddrs)
+ {
+ 	u32 ctx = CTX_HWBITS(mm->context);
++	struct tlb_pending_info info;
+ 	int cpu = get_cpu();
+ 
++	info.ctx = ctx;
++	info.nr = nr;
++	info.vaddrs = vaddrs;
++
+ 	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
+ 		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
+ 	else
+-		smp_cross_call_masked(&xcall_flush_tlb_pending,
+-				      ctx, nr, (unsigned long) vaddrs,
+-				      mm_cpumask(mm));
++		smp_call_function_many(mm_cpumask(mm), tlb_pending_func,
++				       &info, 1);
+ 
+ 	__flush_tlb_pending(ctx, nr, vaddrs);
+ 
+ 	put_cpu();
+ }
+ 
++void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
++{
++	unsigned long context = CTX_HWBITS(mm->context);
++	int cpu = get_cpu();
++
++	if (mm == current->mm && atomic_read(&mm->mm_users) == 1)
++		cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
++	else
++		smp_cross_call_masked(&xcall_flush_tlb_page,
++				      context, vaddr, 0,
++				      mm_cpumask(mm));
++	__flush_tlb_page(context, vaddr);
++
++	put_cpu();
++}
++
+ void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end)
+ {
+ 	start &= PAGE_MASK;
 diff --git a/arch/sparc/kernel/sys_sparc_32.c b/arch/sparc/kernel/sys_sparc_32.c
 index 2da0bdc..79128d2 100644
 --- a/arch/sparc/kernel/sys_sparc_32.c
@@ -10342,6 +10627,377 @@ index d2b5944..bd813f2 100644
  			return addr;
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
+diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c
+index ba6ae7f..83d89bc 100644
+--- a/arch/sparc/mm/tlb.c
++++ b/arch/sparc/mm/tlb.c
+@@ -24,11 +24,17 @@ static DEFINE_PER_CPU(struct tlb_batch, tlb_batch);
+ void flush_tlb_pending(void)
+ {
+ 	struct tlb_batch *tb = &get_cpu_var(tlb_batch);
++	struct mm_struct *mm = tb->mm;
+ 
+-	if (tb->tlb_nr) {
+-		flush_tsb_user(tb);
++	if (!tb->tlb_nr)
++		goto out;
+ 
+-		if (CTX_VALID(tb->mm->context)) {
++	flush_tsb_user(tb);
++
++	if (CTX_VALID(mm->context)) {
++		if (tb->tlb_nr == 1) {
++			global_flush_tlb_page(mm, tb->vaddrs[0]);
++		} else {
+ #ifdef CONFIG_SMP
+ 			smp_flush_tlb_pending(tb->mm, tb->tlb_nr,
+ 					      &tb->vaddrs[0]);
+@@ -37,12 +43,30 @@ void flush_tlb_pending(void)
+ 					    tb->tlb_nr, &tb->vaddrs[0]);
+ #endif
+ 		}
+-		tb->tlb_nr = 0;
+ 	}
+ 
++	tb->tlb_nr = 0;
++
++out:
+ 	put_cpu_var(tlb_batch);
+ }
+ 
++void arch_enter_lazy_mmu_mode(void)
++{
++	struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
++
++	tb->active = 1;
++}
++
++void arch_leave_lazy_mmu_mode(void)
++{
++	struct tlb_batch *tb = &__get_cpu_var(tlb_batch);
++
++	if (tb->tlb_nr)
++		flush_tlb_pending();
++	tb->active = 0;
++}
++
+ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ 			      bool exec)
+ {
+@@ -60,6 +84,12 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ 		nr = 0;
+ 	}
+ 
++	if (!tb->active) {
++		global_flush_tlb_page(mm, vaddr);
++		flush_tsb_user_page(mm, vaddr);
++		goto out;
++	}
++
+ 	if (nr == 0)
+ 		tb->mm = mm;
+ 
+@@ -68,6 +98,7 @@ static void tlb_batch_add_one(struct mm_struct *mm, unsigned long vaddr,
+ 	if (nr >= TLB_BATCH_NR)
+ 		flush_tlb_pending();
+ 
++out:
+ 	put_cpu_var(tlb_batch);
+ }
+ 
+diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
+index 428982b..2cc3bce 100644
+--- a/arch/sparc/mm/tsb.c
++++ b/arch/sparc/mm/tsb.c
+@@ -7,11 +7,10 @@
+ #include <linux/preempt.h>
+ #include <linux/slab.h>
+ #include <asm/page.h>
+-#include <asm/tlbflush.h>
+-#include <asm/tlb.h>
+-#include <asm/mmu_context.h>
+ #include <asm/pgtable.h>
++#include <asm/mmu_context.h>
+ #include <asm/tsb.h>
++#include <asm/tlb.h>
+ #include <asm/oplib.h>
+ 
+ extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
+@@ -46,23 +45,27 @@ void flush_tsb_kernel_range(unsigned long start, unsigned long end)
+ 	}
+ }
+ 
++static void __flush_tsb_one_entry(unsigned long tsb, unsigned long v,
++				  unsigned long hash_shift,
++				  unsigned long nentries)
++{
++	unsigned long tag, ent, hash;
++
++	v &= ~0x1UL;
++	hash = tsb_hash(v, hash_shift, nentries);
++	ent = tsb + (hash * sizeof(struct tsb));
++	tag = (v >> 22UL);
++
++	tsb_flush(ent, tag);
++}
++
+ static void __flush_tsb_one(struct tlb_batch *tb, unsigned long hash_shift,
+ 			    unsigned long tsb, unsigned long nentries)
+ {
+ 	unsigned long i;
+ 
+-	for (i = 0; i < tb->tlb_nr; i++) {
+-		unsigned long v = tb->vaddrs[i];
+-		unsigned long tag, ent, hash;
+-
+-		v &= ~0x1UL;
+-
+-		hash = tsb_hash(v, hash_shift, nentries);
+-		ent = tsb + (hash * sizeof(struct tsb));
+-		tag = (v >> 22UL);
+-
+-		tsb_flush(ent, tag);
+-	}
++	for (i = 0; i < tb->tlb_nr; i++)
++		__flush_tsb_one_entry(tsb, tb->vaddrs[i], hash_shift, nentries);
+ }
+ 
+ void flush_tsb_user(struct tlb_batch *tb)
+@@ -90,6 +93,30 @@ void flush_tsb_user(struct tlb_batch *tb)
+ 	spin_unlock_irqrestore(&mm->context.lock, flags);
+ }
+ 
++void flush_tsb_user_page(struct mm_struct *mm, unsigned long vaddr)
++{
++	unsigned long nentries, base, flags;
++
++	spin_lock_irqsave(&mm->context.lock, flags);
++
++	base = (unsigned long) mm->context.tsb_block[MM_TSB_BASE].tsb;
++	nentries = mm->context.tsb_block[MM_TSB_BASE].tsb_nentries;
++	if (tlb_type == cheetah_plus || tlb_type == hypervisor)
++		base = __pa(base);
++	__flush_tsb_one_entry(base, vaddr, PAGE_SHIFT, nentries);
++
++#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
++	if (mm->context.tsb_block[MM_TSB_HUGE].tsb) {
++		base = (unsigned long) mm->context.tsb_block[MM_TSB_HUGE].tsb;
++		nentries = mm->context.tsb_block[MM_TSB_HUGE].tsb_nentries;
++		if (tlb_type == cheetah_plus || tlb_type == hypervisor)
++			base = __pa(base);
++		__flush_tsb_one_entry(base, vaddr, HPAGE_SHIFT, nentries);
++	}
++#endif
++	spin_unlock_irqrestore(&mm->context.lock, flags);
++}
++
+ #define HV_PGSZ_IDX_BASE	HV_PGSZ_IDX_8K
+ #define HV_PGSZ_MASK_BASE	HV_PGSZ_MASK_8K
+ 
+diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S
+index f8e13d4..432aa0c 100644
+--- a/arch/sparc/mm/ultra.S
++++ b/arch/sparc/mm/ultra.S
+@@ -53,6 +53,33 @@ __flush_tlb_mm:		/* 18 insns */
+ 	nop
+ 
+ 	.align		32
++	.globl		__flush_tlb_page
++__flush_tlb_page:	/* 22 insns */
++	/* %o0 = context, %o1 = vaddr */
++	rdpr		%pstate, %g7
++	andn		%g7, PSTATE_IE, %g2
++	wrpr		%g2, %pstate
++	mov		SECONDARY_CONTEXT, %o4
++	ldxa		[%o4] ASI_DMMU, %g2
++	stxa		%o0, [%o4] ASI_DMMU
++	andcc		%o1, 1, %g0
++	andn		%o1, 1, %o3
++	be,pn		%icc, 1f
++	 or		%o3, 0x10, %o3
++	stxa		%g0, [%o3] ASI_IMMU_DEMAP
++1:	stxa		%g0, [%o3] ASI_DMMU_DEMAP
++	membar		#Sync
++	stxa		%g2, [%o4] ASI_DMMU
++	sethi		%hi(KERNBASE), %o4
++	flush		%o4
++	retl
++	 wrpr		%g7, 0x0, %pstate
++	nop
++	nop
++	nop
++	nop
++
++	.align		32
+ 	.globl		__flush_tlb_pending
+ __flush_tlb_pending:	/* 26 insns */
+ 	/* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+@@ -203,6 +230,31 @@ __cheetah_flush_tlb_mm: /* 19 insns */
+ 	retl
+ 	 wrpr		%g7, 0x0, %pstate
+ 
++__cheetah_flush_tlb_page:	/* 22 insns */
++	/* %o0 = context, %o1 = vaddr */
++	rdpr		%pstate, %g7
++	andn		%g7, PSTATE_IE, %g2
++	wrpr		%g2, 0x0, %pstate
++	wrpr		%g0, 1, %tl
++	mov		PRIMARY_CONTEXT, %o4
++	ldxa		[%o4] ASI_DMMU, %g2
++	srlx		%g2, CTX_PGSZ1_NUC_SHIFT, %o3
++	sllx		%o3, CTX_PGSZ1_NUC_SHIFT, %o3
++	or		%o0, %o3, %o0	/* Preserve nucleus page size fields */
++	stxa		%o0, [%o4] ASI_DMMU
++	andcc		%o1, 1, %g0
++	be,pn		%icc, 1f
++	 andn		%o1, 1, %o3
++	stxa		%g0, [%o3] ASI_IMMU_DEMAP
++1:	stxa		%g0, [%o3] ASI_DMMU_DEMAP	
++	membar		#Sync
++	stxa		%g2, [%o4] ASI_DMMU
++	sethi		%hi(KERNBASE), %o4
++	flush		%o4
++	wrpr		%g0, 0, %tl
++	retl
++	 wrpr		%g7, 0x0, %pstate
++
+ __cheetah_flush_tlb_pending:	/* 27 insns */
+ 	/* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+ 	rdpr		%pstate, %g7
+@@ -269,6 +321,20 @@ __hypervisor_flush_tlb_mm: /* 10 insns */
+ 	retl
+ 	 nop
+ 
++__hypervisor_flush_tlb_page: /* 11 insns */
++	/* %o0 = context, %o1 = vaddr */
++	mov		%o0, %g2
++	mov		%o1, %o0              /* ARG0: vaddr + IMMU-bit */
++	mov		%g2, %o1	      /* ARG1: mmu context */
++	mov		HV_MMU_ALL, %o2	      /* ARG2: flags */
++	srlx		%o0, PAGE_SHIFT, %o0
++	sllx		%o0, PAGE_SHIFT, %o0
++	ta		HV_MMU_UNMAP_ADDR_TRAP
++	brnz,pn		%o0, __hypervisor_tlb_tl0_error
++	 mov		HV_MMU_UNMAP_ADDR_TRAP, %o1
++	retl
++	 nop
++
+ __hypervisor_flush_tlb_pending: /* 16 insns */
+ 	/* %o0 = context, %o1 = nr, %o2 = vaddrs[] */
+ 	sllx		%o1, 3, %g1
+@@ -339,6 +405,13 @@ cheetah_patch_cachetlbops:
+ 	call		tlb_patch_one
+ 	 mov		19, %o2
+ 
++	sethi		%hi(__flush_tlb_page), %o0
++	or		%o0, %lo(__flush_tlb_page), %o0
++	sethi		%hi(__cheetah_flush_tlb_page), %o1
++	or		%o1, %lo(__cheetah_flush_tlb_page), %o1
++	call		tlb_patch_one
++	 mov		22, %o2
++
+ 	sethi		%hi(__flush_tlb_pending), %o0
+ 	or		%o0, %lo(__flush_tlb_pending), %o0
+ 	sethi		%hi(__cheetah_flush_tlb_pending), %o1
+@@ -397,10 +470,9 @@ xcall_flush_tlb_mm:	/* 21 insns */
+ 	nop
+ 	nop
+ 
+-	.globl		xcall_flush_tlb_pending
+-xcall_flush_tlb_pending:	/* 21 insns */
+-	/* %g5=context, %g1=nr, %g7=vaddrs[] */
+-	sllx		%g1, 3, %g1
++	.globl		xcall_flush_tlb_page
++xcall_flush_tlb_page:	/* 17 insns */
++	/* %g5=context, %g1=vaddr */
+ 	mov		PRIMARY_CONTEXT, %g4
+ 	ldxa		[%g4] ASI_DMMU, %g2
+ 	srlx		%g2, CTX_PGSZ1_NUC_SHIFT, %g4
+@@ -408,20 +480,16 @@ xcall_flush_tlb_pending:	/* 21 insns */
+ 	or		%g5, %g4, %g5
+ 	mov		PRIMARY_CONTEXT, %g4
+ 	stxa		%g5, [%g4] ASI_DMMU
+-1:	sub		%g1, (1 << 3), %g1
+-	ldx		[%g7 + %g1], %g5
+-	andcc		%g5, 0x1, %g0
++	andcc		%g1, 0x1, %g0
+ 	be,pn		%icc, 2f
+-
+-	 andn		%g5, 0x1, %g5
++	 andn		%g1, 0x1, %g5
+ 	stxa		%g0, [%g5] ASI_IMMU_DEMAP
+ 2:	stxa		%g0, [%g5] ASI_DMMU_DEMAP
+ 	membar		#Sync
+-	brnz,pt		%g1, 1b
+-	 nop
+ 	stxa		%g2, [%g4] ASI_DMMU
+ 	retry
+ 	nop
++	nop
+ 
+ 	.globl		xcall_flush_tlb_kernel_range
+ xcall_flush_tlb_kernel_range:	/* 25 insns */
+@@ -656,15 +724,13 @@ __hypervisor_xcall_flush_tlb_mm: /* 21 insns */
+ 	membar		#Sync
+ 	retry
+ 
+-	.globl		__hypervisor_xcall_flush_tlb_pending
+-__hypervisor_xcall_flush_tlb_pending: /* 21 insns */
+-	/* %g5=ctx, %g1=nr, %g7=vaddrs[], %g2,%g3,%g4,g6=scratch */
+-	sllx		%g1, 3, %g1
++	.globl		__hypervisor_xcall_flush_tlb_page
++__hypervisor_xcall_flush_tlb_page: /* 17 insns */
++	/* %g5=ctx, %g1=vaddr */
+ 	mov		%o0, %g2
+ 	mov		%o1, %g3
+ 	mov		%o2, %g4
+-1:	sub		%g1, (1 << 3), %g1
+-	ldx		[%g7 + %g1], %o0	/* ARG0: virtual address */
++	mov		%g1, %o0	        /* ARG0: virtual address */
+ 	mov		%g5, %o1		/* ARG1: mmu context */
+ 	mov		HV_MMU_ALL, %o2		/* ARG2: flags */
+ 	srlx		%o0, PAGE_SHIFT, %o0
+@@ -673,8 +739,6 @@ __hypervisor_xcall_flush_tlb_pending: /* 21 insns */
+ 	mov		HV_MMU_UNMAP_ADDR_TRAP, %g6
+ 	brnz,a,pn	%o0, __hypervisor_tlb_xcall_error
+ 	 mov		%o0, %g5
+-	brnz,pt		%g1, 1b
+-	 nop
+ 	mov		%g2, %o0
+ 	mov		%g3, %o1
+ 	mov		%g4, %o2
+@@ -757,6 +821,13 @@ hypervisor_patch_cachetlbops:
+ 	call		tlb_patch_one
+ 	 mov		10, %o2
+ 
++	sethi		%hi(__flush_tlb_page), %o0
++	or		%o0, %lo(__flush_tlb_page), %o0
++	sethi		%hi(__hypervisor_flush_tlb_page), %o1
++	or		%o1, %lo(__hypervisor_flush_tlb_page), %o1
++	call		tlb_patch_one
++	 mov		11, %o2
++
+ 	sethi		%hi(__flush_tlb_pending), %o0
+ 	or		%o0, %lo(__flush_tlb_pending), %o0
+ 	sethi		%hi(__hypervisor_flush_tlb_pending), %o1
+@@ -788,12 +859,12 @@ hypervisor_patch_cachetlbops:
+ 	call		tlb_patch_one
+ 	 mov		21, %o2
+ 
+-	sethi		%hi(xcall_flush_tlb_pending), %o0
+-	or		%o0, %lo(xcall_flush_tlb_pending), %o0
+-	sethi		%hi(__hypervisor_xcall_flush_tlb_pending), %o1
+-	or		%o1, %lo(__hypervisor_xcall_flush_tlb_pending), %o1
++	sethi		%hi(xcall_flush_tlb_page), %o0
++	or		%o0, %lo(xcall_flush_tlb_page), %o0
++	sethi		%hi(__hypervisor_xcall_flush_tlb_page), %o1
++	or		%o1, %lo(__hypervisor_xcall_flush_tlb_page), %o1
+ 	call		tlb_patch_one
+-	 mov		21, %o2
++	 mov		17, %o2
+ 
+ 	sethi		%hi(xcall_flush_tlb_kernel_range), %o0
+ 	or		%o0, %lo(xcall_flush_tlb_kernel_range), %o0
 diff --git a/arch/tile/include/asm/atomic_64.h b/arch/tile/include/asm/atomic_64.h
 index f4500c6..889656c 100644
 --- a/arch/tile/include/asm/atomic_64.h
@@ -13902,21 +14558,6 @@ index d3ddd17..c9fb0cc 100644
  
  #define flush_insn_slot(p)	do { } while (0)
  
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index dc87b65..85039f9 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -419,8 +419,8 @@ struct kvm_vcpu_arch {
- 	gpa_t time;
- 	struct pvclock_vcpu_time_info hv_clock;
- 	unsigned int hw_tsc_khz;
--	unsigned int time_offset;
--	struct page *time_page;
-+	struct gfn_to_hva_cache pv_time;
-+	bool pv_time_enabled;
- 	/* set guest stopped flag in pvclock flags field */
- 	bool pvclock_set_guest_stopped_request;
- 
 diff --git a/arch/x86/include/asm/local.h b/arch/x86/include/asm/local.h
 index 2d89e39..baee879 100644
 --- a/arch/x86/include/asm/local.h
@@ -17965,10 +18606,10 @@ index 6774c17..72c1b22 100644
  }
  
 diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
-index 4914e94..60b06e3 100644
+index 70602f8..9d9edb7 100644
 --- a/arch/x86/kernel/cpu/perf_event_intel.c
 +++ b/arch/x86/kernel/cpu/perf_event_intel.c
-@@ -1958,10 +1958,10 @@ __init int intel_pmu_init(void)
+@@ -1964,10 +1964,10 @@ __init int intel_pmu_init(void)
  	 * v2 and above have a perf capabilities MSR
  	 */
  	if (version > 1) {
@@ -24244,7 +24885,7 @@ index a27e763..54bfe43 100644
  		case 1:							     \
  			____emulate_2op(ctxt,_op,_bx,_by,"b",u8);	     \
 diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 9392f52..0e56d77 100644
+index a2f492c..899e107 100644
 --- a/arch/x86/kvm/lapic.c
 +++ b/arch/x86/kvm/lapic.c
 @@ -55,7 +55,7 @@
@@ -24413,64 +25054,10 @@ index 9120ae1..238abc0 100644
  
  	vcpu->arch.regs_avail = ~((1 << VCPU_REGS_RIP) | (1 << VCPU_REGS_RSP)
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index c243b81..b692af3 100644
+index 9a51121..f739a79 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
-@@ -1408,10 +1408,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- 	unsigned long flags, this_tsc_khz;
- 	struct kvm_vcpu_arch *vcpu = &v->arch;
- 	struct kvm_arch *ka = &v->kvm->arch;
--	void *shared_kaddr;
- 	s64 kernel_ns, max_kernel_ns;
- 	u64 tsc_timestamp, host_tsc;
--	struct pvclock_vcpu_time_info *guest_hv_clock;
-+	struct pvclock_vcpu_time_info guest_hv_clock;
- 	u8 pvclock_flags;
- 	bool use_master_clock;
- 
-@@ -1465,7 +1464,7 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- 
- 	local_irq_restore(flags);
- 
--	if (!vcpu->time_page)
-+	if (!vcpu->pv_time_enabled)
- 		return 0;
- 
- 	/*
-@@ -1527,12 +1526,12 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- 	 */
- 	vcpu->hv_clock.version += 2;
- 
--	shared_kaddr = kmap_atomic(vcpu->time_page);
--
--	guest_hv_clock = shared_kaddr + vcpu->time_offset;
-+	if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
-+		&guest_hv_clock, sizeof(guest_hv_clock))))
-+		return 0;
- 
- 	/* retain PVCLOCK_GUEST_STOPPED if set in guest copy */
--	pvclock_flags = (guest_hv_clock->flags & PVCLOCK_GUEST_STOPPED);
-+	pvclock_flags = (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
- 
- 	if (vcpu->pvclock_set_guest_stopped_request) {
- 		pvclock_flags |= PVCLOCK_GUEST_STOPPED;
-@@ -1545,12 +1544,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v)
- 
- 	vcpu->hv_clock.flags = pvclock_flags;
- 
--	memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
--	       sizeof(vcpu->hv_clock));
--
--	kunmap_atomic(shared_kaddr);
--
--	mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
-+	kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
-+				&vcpu->hv_clock,
-+				sizeof(vcpu->hv_clock));
- 	return 0;
- }
- 
-@@ -1692,8 +1688,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1688,8 +1688,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
  {
  	struct kvm *kvm = vcpu->kvm;
  	int lm = is_long_mode(vcpu);
@@ -24481,51 +25068,7 @@ index c243b81..b692af3 100644
  	u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
  		: kvm->arch.xen_hvm_config.blob_size_32;
  	u32 page_num = data & ~PAGE_MASK;
-@@ -1839,10 +1835,7 @@ static int kvm_pv_enable_async_pf(struct kvm_vcpu *vcpu, u64 data)
- 
- static void kvmclock_reset(struct kvm_vcpu *vcpu)
- {
--	if (vcpu->arch.time_page) {
--		kvm_release_page_dirty(vcpu->arch.time_page);
--		vcpu->arch.time_page = NULL;
--	}
-+	vcpu->arch.pv_time_enabled = false;
- }
- 
- static void accumulate_steal_time(struct kvm_vcpu *vcpu)
-@@ -1948,6 +1941,7 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
- 		break;
- 	case MSR_KVM_SYSTEM_TIME_NEW:
- 	case MSR_KVM_SYSTEM_TIME: {
-+		u64 gpa_offset;
- 		kvmclock_reset(vcpu);
- 
- 		vcpu->arch.time = data;
-@@ -1957,14 +1951,17 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
- 		if (!(data & 1))
- 			break;
- 
--		/* ...but clean it before doing the actual write */
--		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
-+		gpa_offset = data & ~(PAGE_MASK | 1);
- 
--		vcpu->arch.time_page =
--				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);
-+		/* Check that the address is 32-byte aligned. */
-+		if (gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1))
-+			break;
- 
--		if (is_error_page(vcpu->arch.time_page))
--			vcpu->arch.time_page = NULL;
-+		if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
-+		     &vcpu->arch.pv_time, data & ~1ULL))
-+			vcpu->arch.pv_time_enabled = false;
-+		else
-+			vcpu->arch.pv_time_enabled = true;
- 
- 		break;
- 	}
-@@ -2571,6 +2568,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2567,6 +2567,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
  		if (n < msr_list.nmsrs)
  			goto out;
  		r = -EFAULT;
@@ -24534,7 +25077,7 @@ index c243b81..b692af3 100644
  		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
  				 num_msrs_to_save * sizeof(u32)))
  			goto out;
-@@ -2700,7 +2699,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2696,7 +2698,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
  static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
  				    struct kvm_interrupt *irq)
  {
@@ -24543,16 +25086,7 @@ index c243b81..b692af3 100644
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -2967,7 +2966,7 @@ static int kvm_vcpu_ioctl_x86_set_xcrs(struct kvm_vcpu *vcpu,
-  */
- static int kvm_set_guest_paused(struct kvm_vcpu *vcpu)
- {
--	if (!vcpu->arch.time_page)
-+	if (!vcpu->arch.pv_time_enabled)
- 		return -EINVAL;
- 	vcpu->arch.pvclock_set_guest_stopped_request = true;
- 	kvm_make_request(KVM_REQ_CLOCK_UPDATE, vcpu);
-@@ -5213,7 +5212,7 @@ static struct notifier_block pvclock_gtod_notifier = {
+@@ -5209,7 +5211,7 @@ static struct notifier_block pvclock_gtod_notifier = {
  };
  #endif
  
@@ -24561,14 +25095,6 @@ index c243b81..b692af3 100644
  {
  	int r;
  	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
-@@ -6661,6 +6660,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu)
- 		goto fail_free_wbinvd_dirty_mask;
- 
- 	vcpu->arch.ia32_tsc_adjust_msr = 0x0;
-+	vcpu->arch.pv_time_enabled = false;
- 	kvm_async_pf_hash_reset(vcpu);
- 	kvm_pmu_init(vcpu);
- 
 diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
 index 20a4fd4..d806083 100644
 --- a/arch/x86/lguest/boot.c
@@ -34025,10 +34551,10 @@ index 21cb980..f15107c 100644
  	 	    return -EINVAL;
  	    else
 diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
-index fe6d4be..89f32100 100644
+index 615d262..15d5c9d 100644
 --- a/drivers/char/hpet.c
 +++ b/drivers/char/hpet.c
-@@ -571,7 +571,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
+@@ -559,7 +559,7 @@ static inline unsigned long hpet_time_div(struct hpets *hpets,
  }
  
  static int
@@ -38428,10 +38954,10 @@ index 1cbfc6b..56e1dbb 100644
  /*----------------------------------------------------------------*/
  
 diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 75b1f89..00ba344 100644
+index fd86b37..a5389ef 100644
 --- a/drivers/md/raid1.c
 +++ b/drivers/md/raid1.c
-@@ -1819,7 +1819,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
+@@ -1821,7 +1821,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
  			if (r1_sync_page_io(rdev, sect, s,
  					    bio->bi_io_vec[idx].bv_page,
  					    READ) != 0)
@@ -38440,7 +38966,7 @@ index 75b1f89..00ba344 100644
  		}
  		sectors -= s;
  		sect += s;
-@@ -2041,7 +2041,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
+@@ -2043,7 +2043,7 @@ static void fix_read_error(struct r1conf *conf, int read_disk,
  			    test_bit(In_sync, &rdev->flags)) {
  				if (r1_sync_page_io(rdev, sect, s,
  						    conf->tmppage, READ)) {
@@ -38450,10 +38976,10 @@ index 75b1f89..00ba344 100644
  					       "md/raid1:%s: read error corrected "
  					       "(%d sectors at %llu on %s)\n",
 diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
-index 8d925dc..11d674f 100644
+index b3898d4..23a462b 100644
 --- a/drivers/md/raid10.c
 +++ b/drivers/md/raid10.c
-@@ -1878,7 +1878,7 @@ static void end_sync_read(struct bio *bio, int error)
+@@ -1881,7 +1881,7 @@ static void end_sync_read(struct bio *bio, int error)
  		/* The write handler will notice the lack of
  		 * R10BIO_Uptodate and record any errors etc
  		 */
@@ -38462,7 +38988,7 @@ index 8d925dc..11d674f 100644
  			   &conf->mirrors[d].rdev->corrected_errors);
  
  	/* for reconstruct, we always reschedule after a read.
-@@ -2227,7 +2227,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
+@@ -2230,7 +2230,7 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
  {
  	struct timespec cur_time_mon;
  	unsigned long hours_since_last;
@@ -38471,7 +38997,7 @@ index 8d925dc..11d674f 100644
  
  	ktime_get_ts(&cur_time_mon);
  
-@@ -2249,9 +2249,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
+@@ -2252,9 +2252,9 @@ static void check_decay_read_errors(struct mddev *mddev, struct md_rdev *rdev)
  	 * overflowing the shift of read_errors by hours_since_last.
  	 */
  	if (hours_since_last >= 8 * sizeof(read_errors))
@@ -38483,7 +39009,7 @@ index 8d925dc..11d674f 100644
  }
  
  static int r10_sync_page_io(struct md_rdev *rdev, sector_t sector,
-@@ -2305,8 +2305,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2308,8 +2308,8 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
  		return;
  
  	check_decay_read_errors(mddev, rdev);
@@ -38494,7 +39020,7 @@ index 8d925dc..11d674f 100644
  		char b[BDEVNAME_SIZE];
  		bdevname(rdev->bdev, b);
  
-@@ -2314,7 +2314,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2317,7 +2317,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
  		       "md/raid10:%s: %s: Raid device exceeded "
  		       "read_error threshold [cur %d:max %d]\n",
  		       mdname(mddev), b,
@@ -38503,7 +39029,7 @@ index 8d925dc..11d674f 100644
  		printk(KERN_NOTICE
  		       "md/raid10:%s: %s: Failing raid device\n",
  		       mdname(mddev), b);
-@@ -2469,7 +2469,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
+@@ -2472,7 +2472,7 @@ static void fix_read_error(struct r10conf *conf, struct mddev *mddev, struct r10
  					       sect +
  					       choose_data_offset(r10_bio, rdev)),
  				       bdevname(rdev->bdev, b));
@@ -39854,7 +40380,7 @@ index adbd91b..58ec94a 100644
  /**
   * bnx2x_config_rx_mode - Send and RX_MODE ramrod according to the provided parameters.
 diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
-index d330e81..ce1fb9a 100644
+index 6f9b74c..7f219b8 100644
 --- a/drivers/net/ethernet/broadcom/tg3.h
 +++ b/drivers/net/ethernet/broadcom/tg3.h
 @@ -146,6 +146,7 @@
@@ -44342,10 +44868,47 @@ index b3c4a25..723916f 100644
  
  		if (get_user(c, buf))
 diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
-index da9fde8..c07975f 100644
+index da9fde8..621d6dc 100644
 --- a/drivers/tty/tty_io.c
 +++ b/drivers/tty/tty_io.c
-@@ -3391,7 +3391,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
+@@ -941,6 +941,14 @@ void start_tty(struct tty_struct *tty)
+ 
+ EXPORT_SYMBOL(start_tty);
+ 
++static void tty_update_time(struct timespec *time)
++{
++	unsigned long sec = get_seconds();
++	sec -= sec % 60;
++	if ((long)(sec - time->tv_sec) > 0)
++		time->tv_sec = sec;
++}
++
+ /**
+  *	tty_read	-	read method for tty device files
+  *	@file: pointer to tty file
+@@ -977,8 +985,10 @@ static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ 	else
+ 		i = -EIO;
+ 	tty_ldisc_deref(ld);
++
+ 	if (i > 0)
+-		inode->i_atime = current_fs_time(inode->i_sb);
++		tty_update_time(&inode->i_atime);
++
+ 	return i;
+ }
+ 
+@@ -1080,8 +1090,7 @@ static inline ssize_t do_tty_write(
+ 		cond_resched();
+ 	}
+ 	if (written) {
+-		struct inode *inode = file->f_path.dentry->d_inode;
+-		inode->i_mtime = current_fs_time(inode->i_sb);
++		tty_update_time(&file->f_path.dentry->d_inode->i_mtime);
+ 		ret = written;
+ 	}
+ out:
+@@ -3391,7 +3400,7 @@ EXPORT_SYMBOL_GPL(get_current_tty);
  
  void tty_default_fops(struct file_operations *fops)
  {
@@ -45141,7 +45704,7 @@ index 5c3960d..15cf8fc 100644
  		goto out1;
  	}
 diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
-index dc61c12..e29796e 100644
+index 0a49456..fd5be1b 100644
 --- a/drivers/video/fbmem.c
 +++ b/drivers/video/fbmem.c
 @@ -428,7 +428,7 @@ static void fb_do_show_logo(struct fb_info *info, struct fb_image *image,
@@ -48413,7 +48976,7 @@ index 0efd152..b5802ad 100644
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
 diff --git a/fs/aio.c b/fs/aio.c
-index 71f613c..9d01f1f 100644
+index 71f613c..ee07789 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
 @@ -111,7 +111,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -48425,6 +48988,17 @@ index 71f613c..9d01f1f 100644
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
+@@ -1027,9 +1027,9 @@ static int aio_read_evt(struct kioctx *ioctx, struct io_event *ent)
+ 	spin_unlock(&info->ring_lock);
+ 
+ out:
+-	kunmap_atomic(ring);
+ 	dprintk("leaving aio_read_evt: %d  h%lu t%lu\n", ret,
+ 		 (unsigned long)ring->head, (unsigned long)ring->tail);
++	kunmap_atomic(ring);
+ 	return ret;
+ }
+ 
 @@ -1373,18 +1373,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
  static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  {
@@ -48623,7 +49197,7 @@ index 6043567..16a9239 100644
  				fd_offset + ex.a_text);
  		if (error != N_DATADDR(ex)) {
 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 0c42cdb..b62581e9 100644
+index 5843a47..160fbe2 100644
 --- a/fs/binfmt_elf.c
 +++ b/fs/binfmt_elf.c
 @@ -33,6 +33,7 @@
@@ -49297,7 +49871,7 @@ index 0c42cdb..b62581e9 100644
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1152,7 +1598,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1153,7 +1599,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -49306,7 +49880,7 @@ index 0c42cdb..b62581e9 100644
  		goto whole;
  
  	/*
-@@ -1374,9 +1820,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1375,9 +1821,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -49318,7 +49892,7 @@ index 0c42cdb..b62581e9 100644
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -2006,14 +2452,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -2007,14 +2453,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -49335,7 +49909,7 @@ index 0c42cdb..b62581e9 100644
  	return size;
  }
  
-@@ -2107,7 +2553,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2108,7 +2554,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -49344,7 +49918,7 @@ index 0c42cdb..b62581e9 100644
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -2121,10 +2567,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2122,10 +2568,12 @@ static int elf_core_dump(struct coredump_params *cprm)
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -49357,7 +49931,7 @@ index 0c42cdb..b62581e9 100644
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -2138,7 +2586,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2139,7 +2587,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -49366,7 +49940,7 @@ index 0c42cdb..b62581e9 100644
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -2149,6 +2597,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2150,6 +2598,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -49374,7 +49948,7 @@ index 0c42cdb..b62581e9 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2173,7 +2622,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2174,7 +2623,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  		unsigned long addr;
  		unsigned long end;
  
@@ -49383,7 +49957,7 @@ index 0c42cdb..b62581e9 100644
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2182,6 +2631,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2183,6 +2632,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -49391,7 +49965,7 @@ index 0c42cdb..b62581e9 100644
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2199,6 +2649,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2200,6 +2650,7 @@ static int elf_core_dump(struct coredump_params *cprm)
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -49399,7 +49973,7 @@ index 0c42cdb..b62581e9 100644
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2219,6 +2670,97 @@ out:
+@@ -2220,6 +2671,97 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -53470,21 +54044,8 @@ index 2b6f569..fcb4d1f 100644
  	if (!IS_ERR(s))
  		kfree(s);
  }
-diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
-index eba76eab..fc8ddc1 100644
---- a/fs/hfsplus/extents.c
-+++ b/fs/hfsplus/extents.c
-@@ -533,7 +533,7 @@ void hfsplus_file_truncate(struct inode *inode)
- 		struct address_space *mapping = inode->i_mapping;
- 		struct page *page;
- 		void *fsdata;
--		u32 size = inode->i_size;
-+		loff_t size = inode->i_size;
- 
- 		res = pagecache_write_begin(NULL, mapping, size, 0,
- 						AOP_FLAG_UNINTERRUPTIBLE,
 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
-index 78bde32..767e906 100644
+index ccee8cc..144b5d7 100644
 --- a/fs/hugetlbfs/inode.c
 +++ b/fs/hugetlbfs/inode.c
 @@ -152,6 +152,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
@@ -54993,7 +55554,7 @@ index 15af622..0e9f4467 100644
   	help
  	  Various /proc files exist to monitor process memory utilization:
 diff --git a/fs/proc/array.c b/fs/proc/array.c
-index 6a91e6f..e54dbc14 100644
+index be3c22f..0df1564 100644
 --- a/fs/proc/array.c
 +++ b/fs/proc/array.c
 @@ -60,6 +60,7 @@
@@ -55004,7 +55565,7 @@ index 6a91e6f..e54dbc14 100644
  #include <linux/proc_fs.h>
  #include <linux/ioport.h>
  #include <linux/uaccess.h>
-@@ -362,6 +363,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
+@@ -363,6 +364,21 @@ static void task_cpus_allowed(struct seq_file *m, struct task_struct *task)
  	seq_putc(m, '\n');
  }
  
@@ -55026,7 +55587,7 @@ index 6a91e6f..e54dbc14 100644
  int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
  			struct pid *pid, struct task_struct *task)
  {
-@@ -380,9 +396,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
+@@ -381,9 +397,24 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
  	task_cpus_allowed(m, task);
  	cpuset_task_status_allowed(m, task);
  	task_context_switch_counts(m, task);
@@ -55051,7 +55612,7 @@ index 6a91e6f..e54dbc14 100644
  static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
  			struct pid *pid, struct task_struct *task, int whole)
  {
-@@ -404,6 +435,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -405,6 +436,13 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
  	char tcomm[sizeof(task->comm)];
  	unsigned long flags;
  
@@ -55065,7 +55626,7 @@ index 6a91e6f..e54dbc14 100644
  	state = *get_task_state(task);
  	vsize = eip = esp = 0;
  	permitted = ptrace_may_access(task, PTRACE_MODE_READ | PTRACE_MODE_NOAUDIT);
-@@ -475,6 +513,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -476,6 +514,19 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
  		gtime = task->gtime;
  	}
  
@@ -55085,7 +55646,7 @@ index 6a91e6f..e54dbc14 100644
  	/* scale priority and nice values from timeslices to -20..20 */
  	/* to make it look like a "normal" Unix priority/nice value  */
  	priority = task_prio(task);
-@@ -511,9 +562,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -512,9 +563,15 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
  	seq_put_decimal_ull(m, ' ', vsize);
  	seq_put_decimal_ull(m, ' ', mm ? get_mm_rss(mm) : 0);
  	seq_put_decimal_ull(m, ' ', rsslim);
@@ -55101,7 +55662,7 @@ index 6a91e6f..e54dbc14 100644
  	seq_put_decimal_ull(m, ' ', esp);
  	seq_put_decimal_ull(m, ' ', eip);
  	/* The signal information here is obsolete.
-@@ -535,7 +592,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
+@@ -536,7 +593,11 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
  	seq_put_decimal_ull(m, ' ', cputime_to_clock_t(gtime));
  	seq_put_decimal_ll(m, ' ', cputime_to_clock_t(cgtime));
  
@@ -55114,7 +55675,7 @@ index 6a91e6f..e54dbc14 100644
  		seq_put_decimal_ull(m, ' ', mm->start_data);
  		seq_put_decimal_ull(m, ' ', mm->end_data);
  		seq_put_decimal_ull(m, ' ', mm->start_brk);
-@@ -573,8 +634,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+@@ -574,8 +635,15 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
  			struct pid *pid, struct task_struct *task)
  {
  	unsigned long size = 0, resident = 0, shared = 0, text = 0, data = 0;
@@ -55131,7 +55692,7 @@ index 6a91e6f..e54dbc14 100644
  	if (mm) {
  		size = task_statm(mm, &shared, &text, &data, &resident);
  		mmput(mm);
-@@ -597,6 +665,13 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
+@@ -598,6 +666,13 @@ int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
  	return 0;
  }
  
@@ -67800,13 +68361,13 @@ index 4c57065..4307975 100644
  #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
  #endif
 diff --git a/include/linux/capability.h b/include/linux/capability.h
-index 98503b7..cc36d18 100644
+index d9a4f7f4..19f77d6 100644
 --- a/include/linux/capability.h
 +++ b/include/linux/capability.h
-@@ -211,8 +211,13 @@ extern bool capable(int cap);
- extern bool ns_capable(struct user_namespace *ns, int cap);
+@@ -213,8 +213,13 @@ extern bool ns_capable(struct user_namespace *ns, int cap);
  extern bool nsown_capable(int cap);
  extern bool inode_capable(const struct inode *inode, int cap);
+ extern bool file_ns_capable(const struct file *file, struct user_namespace *ns, int cap);
 +extern bool capable_nolog(int cap);
 +extern bool ns_capable_nolog(struct user_namespace *ns, int cap);
 +extern bool inode_capable_nolog(const struct inode *inode, int cap);
@@ -70105,7 +70666,7 @@ index 4972e6e..de4d19b 100644
  	if (atomic_sub_and_test((int) count, &kref->refcount)) {
  		release(kref);
 diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
-index 2c497ab..afe32f5 100644
+index ffdf8b7..1f91d0e 100644
 --- a/include/linux/kvm_host.h
 +++ b/include/linux/kvm_host.h
 @@ -418,7 +418,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vcpu);
@@ -70204,7 +70765,7 @@ index b8ba855..0148090 100644
  	u32 remainder;
  	return div_u64_rem(dividend, divisor, &remainder);
 diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 66e2f7c..b916b9a 100644
+index 9568b90..6cc79f9 100644
 --- a/include/linux/mm.h
 +++ b/include/linux/mm.h
 @@ -101,6 +101,11 @@ extern unsigned int kobjsize(const void *objp);
@@ -70406,7 +70967,7 @@ index 66e2f7c..b916b9a 100644
  #ifdef CONFIG_ARCH_USES_NUMA_PROT_NONE
  unsigned long change_prot_numa(struct vm_area_struct *vma,
  			unsigned long start, unsigned long end);
-@@ -1649,6 +1658,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
+@@ -1651,6 +1660,11 @@ void vm_stat_account(struct mm_struct *, unsigned long, struct file *, long);
  static inline void vm_stat_account(struct mm_struct *mm,
  			unsigned long flags, struct file *file, long pages)
  {
@@ -70418,7 +70979,7 @@ index 66e2f7c..b916b9a 100644
  	mm->total_vm += pages;
  }
  #endif /* CONFIG_PROC_FS */
-@@ -1721,7 +1735,7 @@ extern int unpoison_memory(unsigned long pfn);
+@@ -1723,7 +1737,7 @@ extern int unpoison_memory(unsigned long pfn);
  extern int sysctl_memory_failure_early_kill;
  extern int sysctl_memory_failure_recovery;
  extern void shake_page(struct page *p, int access);
@@ -70427,7 +70988,7 @@ index 66e2f7c..b916b9a 100644
  extern int soft_offline_page(struct page *page, int flags);
  
  extern void dump_page(struct page *page);
-@@ -1752,5 +1766,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
+@@ -1754,5 +1768,11 @@ static inline unsigned int debug_guardpage_minorder(void) { return 0; }
  static inline bool page_is_guard(struct page *page) { return false; }
  #endif /* CONFIG_DEBUG_PAGEALLOC */
  
@@ -71280,7 +71841,7 @@ index c20635c..2f5def4 100644
  static inline void anon_vma_merge(struct vm_area_struct *vma,
  				  struct vm_area_struct *next)
 diff --git a/include/linux/sched.h b/include/linux/sched.h
-index d211247..eac6c2c 100644
+index 7e49270..835d8d9 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
 @@ -61,6 +61,7 @@ struct bio_list;
@@ -71291,7 +71852,7 @@ index d211247..eac6c2c 100644
  
  /*
   * List of flags we want to share for kernel threads,
-@@ -327,7 +328,7 @@ extern char __sched_text_start[], __sched_text_end[];
+@@ -328,7 +329,7 @@ extern char __sched_text_start[], __sched_text_end[];
  extern int in_sched_functions(unsigned long addr);
  
  #define	MAX_SCHEDULE_TIMEOUT	LONG_MAX
@@ -71300,7 +71861,7 @@ index d211247..eac6c2c 100644
  extern signed long schedule_timeout_interruptible(signed long timeout);
  extern signed long schedule_timeout_killable(signed long timeout);
  extern signed long schedule_timeout_uninterruptible(signed long timeout);
-@@ -354,10 +355,23 @@ struct user_namespace;
+@@ -355,10 +356,23 @@ struct user_namespace;
  #define DEFAULT_MAX_MAP_COUNT	(USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
  
  extern int sysctl_max_map_count;
@@ -71324,7 +71885,7 @@ index d211247..eac6c2c 100644
  extern void arch_pick_mmap_layout(struct mm_struct *mm);
  extern unsigned long
  arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
-@@ -639,6 +653,17 @@ struct signal_struct {
+@@ -640,6 +654,17 @@ struct signal_struct {
  #ifdef CONFIG_TASKSTATS
  	struct taskstats *stats;
  #endif
@@ -71342,7 +71903,7 @@ index d211247..eac6c2c 100644
  #ifdef CONFIG_AUDIT
  	unsigned audit_tty;
  	struct tty_audit_buf *tty_audit_buf;
-@@ -717,6 +742,11 @@ struct user_struct {
+@@ -718,6 +743,11 @@ struct user_struct {
  	struct key *session_keyring;	/* UID's default session keyring */
  #endif
  
@@ -71354,7 +71915,7 @@ index d211247..eac6c2c 100644
  	/* Hash table maintenance information */
  	struct hlist_node uidhash_node;
  	kuid_t uid;
-@@ -1116,7 +1146,7 @@ struct sched_class {
+@@ -1117,7 +1147,7 @@ struct sched_class {
  #ifdef CONFIG_FAIR_GROUP_SCHED
  	void (*task_move_group) (struct task_struct *p, int on_rq);
  #endif
@@ -71363,7 +71924,7 @@ index d211247..eac6c2c 100644
  
  struct load_weight {
  	unsigned long weight, inv_weight;
-@@ -1360,8 +1390,8 @@ struct task_struct {
+@@ -1361,8 +1391,8 @@ struct task_struct {
  	struct list_head thread_group;
  
  	struct completion *vfork_done;		/* for vfork() */
@@ -71374,7 +71935,7 @@ index d211247..eac6c2c 100644
  
  	cputime_t utime, stime, utimescaled, stimescaled;
  	cputime_t gtime;
-@@ -1377,11 +1407,6 @@ struct task_struct {
+@@ -1378,11 +1408,6 @@ struct task_struct {
  	struct task_cputime cputime_expires;
  	struct list_head cpu_timers[3];
  
@@ -71386,7 +71947,7 @@ index d211247..eac6c2c 100644
  	char comm[TASK_COMM_LEN]; /* executable name excluding path
  				     - access with [gs]et_task_comm (which lock
  				       it with task_lock())
-@@ -1398,6 +1423,10 @@ struct task_struct {
+@@ -1399,6 +1424,10 @@ struct task_struct {
  #endif
  /* CPU-specific state of this task */
  	struct thread_struct thread;
@@ -71397,7 +71958,7 @@ index d211247..eac6c2c 100644
  /* filesystem information */
  	struct fs_struct *fs;
  /* open file information */
-@@ -1471,6 +1500,10 @@ struct task_struct {
+@@ -1472,6 +1501,10 @@ struct task_struct {
  	gfp_t lockdep_reclaim_gfp;
  #endif
  
@@ -71408,7 +71969,7 @@ index d211247..eac6c2c 100644
  /* journalling filesystem info */
  	void *journal_info;
  
-@@ -1509,6 +1542,10 @@ struct task_struct {
+@@ -1510,6 +1543,10 @@ struct task_struct {
  	/* cg_list protected by css_set_lock and tsk->alloc_lock */
  	struct list_head cg_list;
  #endif
@@ -71419,7 +71980,7 @@ index d211247..eac6c2c 100644
  #ifdef CONFIG_FUTEX
  	struct robust_list_head __user *robust_list;
  #ifdef CONFIG_COMPAT
-@@ -1605,8 +1642,74 @@ struct task_struct {
+@@ -1606,8 +1643,74 @@ struct task_struct {
  #ifdef CONFIG_UPROBES
  	struct uprobe_task *utask;
  #endif
@@ -71494,7 +72055,7 @@ index d211247..eac6c2c 100644
  /* Future-safe accessor for struct task_struct's cpus_allowed. */
  #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
  
-@@ -1696,7 +1799,7 @@ struct pid_namespace;
+@@ -1697,7 +1800,7 @@ struct pid_namespace;
  pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
  			struct pid_namespace *ns);
  
@@ -71503,7 +72064,7 @@ index d211247..eac6c2c 100644
  {
  	return tsk->pid;
  }
-@@ -2155,7 +2258,9 @@ void yield(void);
+@@ -2156,7 +2259,9 @@ void yield(void);
  extern struct exec_domain	default_exec_domain;
  
  union thread_union {
@@ -71513,7 +72074,7 @@ index d211247..eac6c2c 100644
  	unsigned long stack[THREAD_SIZE/sizeof(long)];
  };
  
-@@ -2188,6 +2293,7 @@ extern struct pid_namespace init_pid_ns;
+@@ -2189,6 +2294,7 @@ extern struct pid_namespace init_pid_ns;
   */
  
  extern struct task_struct *find_task_by_vpid(pid_t nr);
@@ -71521,7 +72082,7 @@ index d211247..eac6c2c 100644
  extern struct task_struct *find_task_by_pid_ns(pid_t nr,
  		struct pid_namespace *ns);
  
-@@ -2344,7 +2450,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
+@@ -2345,7 +2451,7 @@ extern void __cleanup_sighand(struct sighand_struct *);
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -71530,7 +72091,7 @@ index d211247..eac6c2c 100644
  
  extern int allow_signal(int);
  extern int disallow_signal(int);
-@@ -2545,9 +2651,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
+@@ -2546,9 +2652,9 @@ static inline unsigned long *end_of_stack(struct task_struct *p)
  
  #endif
  
@@ -73078,6 +73639,21 @@ index 5a15fab..d799ea7 100644
  
  extern int	__rtnl_link_register(struct rtnl_link_ops *ops);
  extern void	__rtnl_link_unregister(struct rtnl_link_ops *ops);
+diff --git a/include/net/scm.h b/include/net/scm.h
+index 975cca0..b117081 100644
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -56,8 +56,8 @@ static __inline__ void scm_set_cred(struct scm_cookie *scm,
+ 	scm->pid  = get_pid(pid);
+ 	scm->cred = cred ? get_cred(cred) : NULL;
+ 	scm->creds.pid = pid_vnr(pid);
+-	scm->creds.uid = cred ? cred->euid : INVALID_UID;
+-	scm->creds.gid = cred ? cred->egid : INVALID_GID;
++	scm->creds.uid = cred ? cred->uid : INVALID_UID;
++	scm->creds.gid = cred ? cred->gid : INVALID_GID;
+ }
+ 
+ static __inline__ void scm_destroy_cred(struct scm_cookie *scm)
 diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
 index 7fdf298..197e9f7 100644
 --- a/include/net/sctp/sctp.h
@@ -74497,7 +75073,7 @@ index a371f85..da826c1 100644
  		struct audit_buffer *ab;
  
 diff --git a/kernel/capability.c b/kernel/capability.c
-index 493d972..f87dfbd 100644
+index f6c2ce5..982c0f9 100644
 --- a/kernel/capability.c
 +++ b/kernel/capability.c
 @@ -202,6 +202,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_t, header, cap_user_data_t, dataptr)
@@ -74566,9 +75142,9 @@ index 493d972..f87dfbd 100644
 +EXPORT_SYMBOL(ns_capable_nolog);
 +
  /**
-  * capable - Determine if the current task has a superior capability in effect
-  * @cap: The capability to be tested for
-@@ -408,6 +427,12 @@ bool capable(int cap)
+  * file_ns_capable - Determine if the file's opener had a capability in effect
+  * @file:  The file we want to check
+@@ -432,6 +451,12 @@ bool capable(int cap)
  }
  EXPORT_SYMBOL(capable);
  
@@ -74581,7 +75157,7 @@ index 493d972..f87dfbd 100644
  /**
   * nsown_capable - Check superior capability to one's own user_ns
   * @cap: The capability in question
-@@ -440,3 +465,10 @@ bool inode_capable(const struct inode *inode, int cap)
+@@ -464,3 +489,10 @@ bool inode_capable(const struct inode *inode, int cap)
  
  	return ns_capable(ns, cap) && kuid_has_mapping(ns, inode->i_uid);
  }
@@ -75016,7 +75592,7 @@ index 8875254..7cf4928 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 7b6646a..3cb1135 100644
+index 0600d3b..742ab1b 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -182,7 +182,7 @@ int perf_proc_update_handler(struct ctl_table *table, int write,
@@ -75590,10 +76166,10 @@ index 9b22d03..6295b62 100644
  				prev->next = info->next;
  			else
 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
-index cdd5607..c3fc919 100644
+index e4cee8d..f31f503 100644
 --- a/kernel/hrtimer.c
 +++ b/kernel/hrtimer.c
-@@ -1407,7 +1407,7 @@ void hrtimer_peek_ahead_timers(void)
+@@ -1408,7 +1408,7 @@ void hrtimer_peek_ahead_timers(void)
  	local_irq_restore(flags);
  }
  
@@ -75602,7 +76178,7 @@ index cdd5607..c3fc919 100644
  {
  	struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
  
-@@ -1751,7 +1751,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
+@@ -1750,7 +1750,7 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
  	return NOTIFY_OK;
  }
  
@@ -78252,10 +78828,10 @@ index 0984a21..939f183 100644
  #ifdef CONFIG_RT_GROUP_SCHED
  	/*
 diff --git a/kernel/sched/core.c b/kernel/sched/core.c
-index 26058d0..e315889 100644
+index 5e2f7c3..4002d41 100644
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -3367,7 +3367,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
+@@ -3369,7 +3369,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible);
   * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
   * positive (at least 1, or number of jiffies left till timeout) if completed.
   */
@@ -78264,7 +78840,7 @@ index 26058d0..e315889 100644
  wait_for_completion_interruptible_timeout(struct completion *x,
  					  unsigned long timeout)
  {
-@@ -3384,7 +3384,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
+@@ -3386,7 +3386,7 @@ EXPORT_SYMBOL(wait_for_completion_interruptible_timeout);
   *
   * The return value is -ERESTARTSYS if interrupted, 0 if completed.
   */
@@ -78273,7 +78849,7 @@ index 26058d0..e315889 100644
  {
  	long t = wait_for_common(x, MAX_SCHEDULE_TIMEOUT, TASK_KILLABLE);
  	if (t == -ERESTARTSYS)
-@@ -3405,7 +3405,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
+@@ -3407,7 +3407,7 @@ EXPORT_SYMBOL(wait_for_completion_killable);
   * The return value is -ERESTARTSYS if interrupted, 0 if timed out,
   * positive (at least 1, or number of jiffies left till timeout) if completed.
   */
@@ -78282,7 +78858,7 @@ index 26058d0..e315889 100644
  wait_for_completion_killable_timeout(struct completion *x,
  				     unsigned long timeout)
  {
-@@ -3631,6 +3631,8 @@ int can_nice(const struct task_struct *p, const int nice)
+@@ -3633,6 +3633,8 @@ int can_nice(const struct task_struct *p, const int nice)
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = 20 - nice;
  
@@ -78291,7 +78867,7 @@ index 26058d0..e315889 100644
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -3664,7 +3666,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -3666,7 +3668,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (nice > 19)
  		nice = 19;
  
@@ -78301,7 +78877,7 @@ index 26058d0..e315889 100644
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -3818,6 +3821,7 @@ recheck:
+@@ -3820,6 +3823,7 @@ recheck:
  			unsigned long rlim_rtprio =
  					task_rlimit(p, RLIMIT_RTPRIO);
  
@@ -78309,7 +78885,7 @@ index 26058d0..e315889 100644
  			/* can't set/change the rt policy */
  			if (policy != p->policy && !rlim_rtprio)
  				return -EPERM;
-@@ -4901,7 +4905,7 @@ static void migrate_tasks(unsigned int dead_cpu)
+@@ -4903,7 +4907,7 @@ static void migrate_tasks(unsigned int dead_cpu)
  
  #if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_SYSCTL)
  
@@ -78318,7 +78894,7 @@ index 26058d0..e315889 100644
  	{
  		.procname	= "sched_domain",
  		.mode		= 0555,
-@@ -4918,17 +4922,17 @@ static struct ctl_table sd_ctl_root[] = {
+@@ -4920,17 +4924,17 @@ static struct ctl_table sd_ctl_root[] = {
  	{}
  };
  
@@ -78340,7 +78916,7 @@ index 26058d0..e315889 100644
  
  	/*
  	 * In the intermediate directories, both the child directory and
-@@ -4936,22 +4940,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
+@@ -4938,22 +4942,25 @@ static void sd_free_ctl_entry(struct ctl_table **tablep)
  	 * will always be set. In the lowest directory the names are
  	 * static strings and all have proc handlers.
  	 */
@@ -78364,7 +78940,7 @@ index 26058d0..e315889 100644
  }
  
  static int min_load_idx = 0;
- static int max_load_idx = CPU_LOAD_IDX_MAX;
+ static int max_load_idx = CPU_LOAD_IDX_MAX-1;
  
  static void
 -set_table_entry(struct ctl_table *entry,
@@ -78372,7 +78948,7 @@ index 26058d0..e315889 100644
  		const char *procname, void *data, int maxlen,
  		umode_t mode, proc_handler *proc_handler,
  		bool load_idx)
-@@ -4971,7 +4978,7 @@ set_table_entry(struct ctl_table *entry,
+@@ -4973,7 +4980,7 @@ set_table_entry(struct ctl_table *entry,
  static struct ctl_table *
  sd_alloc_ctl_domain_table(struct sched_domain *sd)
  {
@@ -78381,7 +78957,7 @@ index 26058d0..e315889 100644
  
  	if (table == NULL)
  		return NULL;
-@@ -5006,9 +5013,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
+@@ -5008,9 +5015,9 @@ sd_alloc_ctl_domain_table(struct sched_domain *sd)
  	return table;
  }
  
@@ -78393,7 +78969,7 @@ index 26058d0..e315889 100644
  	struct sched_domain *sd;
  	int domain_num = 0, i;
  	char buf[32];
-@@ -5035,11 +5042,13 @@ static struct ctl_table_header *sd_sysctl_header;
+@@ -5037,11 +5044,13 @@ static struct ctl_table_header *sd_sysctl_header;
  static void register_sched_domain_sysctl(void)
  {
  	int i, cpu_num = num_possible_cpus();
@@ -78408,7 +78984,7 @@ index 26058d0..e315889 100644
  
  	if (entry == NULL)
  		return;
-@@ -5062,8 +5071,12 @@ static void unregister_sched_domain_sysctl(void)
+@@ -5064,8 +5073,12 @@ static void unregister_sched_domain_sysctl(void)
  	if (sd_sysctl_header)
  		unregister_sysctl_table(sd_sysctl_header);
  	sd_sysctl_header = NULL;
@@ -78423,7 +78999,7 @@ index 26058d0..e315889 100644
  }
  #else
  static void register_sched_domain_sysctl(void)
-@@ -5162,7 +5175,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
+@@ -5164,7 +5177,7 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu)
   * happens before everything else.  This has to be lower priority than
   * the notifier in the perf_event subsystem, though.
   */
@@ -78496,7 +79072,7 @@ index 81fa536..6ccf96a 100644
  	int this_cpu = smp_processor_id();
  	struct rq *this_rq = cpu_rq(this_cpu);
 diff --git a/kernel/signal.c b/kernel/signal.c
-index dec9c30..92c8f65 100644
+index 50e425c..92c8f65 100644
 --- a/kernel/signal.c
 +++ b/kernel/signal.c
 @@ -50,12 +50,12 @@ static struct kmem_cache *sigqueue_cachep;
@@ -78622,15 +79198,6 @@ index dec9c30..92c8f65 100644
  	if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
  		error = check_kill_permission(sig, info, p);
  		/*
-@@ -2880,7 +2911,7 @@ do_send_specific(pid_t tgid, pid_t pid, int sig, struct siginfo *info)
- 
- static int do_tkill(pid_t tgid, pid_t pid, int sig)
- {
--	struct siginfo info;
-+	struct siginfo info = {};
- 
- 	info.si_signo = sig;
- 	info.si_errno = 0;
 @@ -3138,8 +3169,8 @@ COMPAT_SYSCALL_DEFINE2(sigaltstack,
  	}
  	seg = get_fs();
@@ -80032,10 +80599,10 @@ index 7f6ff2b..1ac8f18 100644
  	.group = GLOBAL_ROOT_GID,
  	.proc_inum = PROC_USER_INIT_INO,
 diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
-index f45e128..a5a5fb6 100644
+index f359dc7..ddc606a 100644
 --- a/kernel/user_namespace.c
 +++ b/kernel/user_namespace.c
-@@ -88,7 +88,7 @@ int create_user_ns(struct cred *new)
+@@ -89,7 +89,7 @@ int create_user_ns(struct cred *new)
  		return ret;
  	}
  
@@ -80044,7 +80611,7 @@ index f45e128..a5a5fb6 100644
  	/* Leave the new->user_ns reference with the new user namespace. */
  	ns->parent = parent_ns;
  	ns->owner = owner;
-@@ -116,15 +116,16 @@ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
+@@ -117,15 +117,16 @@ int unshare_userns(unsigned long unshare_flags, struct cred **new_cred)
  	return create_user_ns(cred);
  }
  
@@ -80068,7 +80635,7 @@ index f45e128..a5a5fb6 100644
  }
  EXPORT_SYMBOL(free_user_ns);
  
-@@ -815,7 +816,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
+@@ -819,7 +820,7 @@ static int userns_install(struct nsproxy *nsproxy, void *ns)
  	if (atomic_read(&current->mm->mm_users) > 1)
  		return -EINVAL;
  
@@ -80826,7 +81393,7 @@ index b32b70c..e512eb0 100644
  	set_page_address(page, (void *)vaddr);
  
 diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index d7cec92..b05cc33 100644
+index 88eb939..0bd9e7d 100644
 --- a/mm/hugetlb.c
 +++ b/mm/hugetlb.c
 @@ -2008,15 +2008,17 @@ static int hugetlb_sysctl_handler_common(bool obey_mempolicy,
@@ -81191,7 +81758,7 @@ index c6e4dd3..1f41988 100644
  	/* keep elevated page count for bad page */
  	return ret;
 diff --git a/mm/memory.c b/mm/memory.c
-index f8b734a..38014f5 100644
+index 32a495a..8042dce 100644
 --- a/mm/memory.c
 +++ b/mm/memory.c
 @@ -434,6 +434,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -81325,7 +81892,7 @@ index f8b734a..38014f5 100644
  
  	if (addr < vma->vm_start || addr >= vma->vm_end)
  		return -EFAULT;
-@@ -2402,7 +2414,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
+@@ -2449,7 +2461,9 @@ static int apply_to_pmd_range(struct mm_struct *mm, pud_t *pud,
  
  	BUG_ON(pud_huge(*pud));
  
@@ -81336,7 +81903,7 @@ index f8b734a..38014f5 100644
  	if (!pmd)
  		return -ENOMEM;
  	do {
-@@ -2422,7 +2436,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
+@@ -2469,7 +2483,9 @@ static int apply_to_pud_range(struct mm_struct *mm, pgd_t *pgd,
  	unsigned long next;
  	int err;
  
@@ -81347,7 +81914,7 @@ index f8b734a..38014f5 100644
  	if (!pud)
  		return -ENOMEM;
  	do {
-@@ -2510,6 +2526,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
+@@ -2557,6 +2573,186 @@ static inline void cow_user_page(struct page *dst, struct page *src, unsigned lo
  		copy_user_highpage(dst, src, va, vma);
  }
  
@@ -81534,7 +82101,7 @@ index f8b734a..38014f5 100644
  /*
   * This routine handles present pages, when users try to write
   * to a shared page. It is done by copying the page to a new address
-@@ -2726,6 +2922,12 @@ gotten:
+@@ -2773,6 +2969,12 @@ gotten:
  	 */
  	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -81547,7 +82114,7 @@ index f8b734a..38014f5 100644
  		if (old_page) {
  			if (!PageAnon(old_page)) {
  				dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2777,6 +2979,10 @@ gotten:
+@@ -2824,6 +3026,10 @@ gotten:
  			page_remove_rmap(old_page);
  		}
  
@@ -81558,7 +82125,7 @@ index f8b734a..38014f5 100644
  		/* Free the old page.. */
  		new_page = old_page;
  		ret |= VM_FAULT_WRITE;
-@@ -3052,6 +3258,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3099,6 +3305,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	swap_free(entry);
  	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
  		try_to_free_swap(page);
@@ -81570,7 +82137,7 @@ index f8b734a..38014f5 100644
  	unlock_page(page);
  	if (swapcache) {
  		/*
-@@ -3075,6 +3286,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3122,6 +3333,11 @@ static int do_swap_page(struct mm_struct *mm, struct vm_area_struct *vma,
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -81582,7 +82149,7 @@ index f8b734a..38014f5 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  out:
-@@ -3094,40 +3310,6 @@ out_release:
+@@ -3141,40 +3357,6 @@ out_release:
  }
  
  /*
@@ -81623,7 +82190,7 @@ index f8b734a..38014f5 100644
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3136,27 +3318,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3183,27 +3365,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -81656,7 +82223,7 @@ index f8b734a..38014f5 100644
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3175,6 +3353,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3222,6 +3400,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -81668,7 +82235,7 @@ index f8b734a..38014f5 100644
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -3182,6 +3365,12 @@ setpte:
+@@ -3229,6 +3412,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -81681,7 +82248,7 @@ index f8b734a..38014f5 100644
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3325,6 +3514,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3372,6 +3561,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -81694,7 +82261,7 @@ index f8b734a..38014f5 100644
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3344,6 +3539,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3391,6 +3586,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -81709,7 +82276,7 @@ index f8b734a..38014f5 100644
  	} else {
  		if (cow_page)
  			mem_cgroup_uncharge_page(cow_page);
-@@ -3665,6 +3868,12 @@ int handle_pte_fault(struct mm_struct *mm,
+@@ -3712,6 +3915,12 @@ int handle_pte_fault(struct mm_struct *mm,
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -81722,7 +82289,7 @@ index f8b734a..38014f5 100644
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3681,6 +3890,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3728,6 +3937,10 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -81733,7 +82300,7 @@ index f8b734a..38014f5 100644
  	__set_current_state(TASK_RUNNING);
  
  	count_vm_event(PGFAULT);
-@@ -3692,6 +3905,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3739,6 +3952,34 @@ int handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
  	if (unlikely(is_vm_hugetlb_page(vma)))
  		return hugetlb_fault(mm, vma, address, flags);
  
@@ -81768,7 +82335,7 @@ index f8b734a..38014f5 100644
  retry:
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
-@@ -3790,6 +4031,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3837,6 +4078,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -81792,7 +82359,7 @@ index f8b734a..38014f5 100644
  #endif /* __PAGETABLE_PUD_FOLDED */
  
  #ifndef __PAGETABLE_PMD_FOLDED
-@@ -3820,11 +4078,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3867,11 +4125,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
  	spin_unlock(&mm->page_table_lock);
  	return 0;
  }
@@ -81830,7 +82397,7 @@ index f8b734a..38014f5 100644
  	struct vm_area_struct * vma;
  
  	vma = find_vma(current->mm, addr);
-@@ -3857,7 +4139,7 @@ static int __init gate_vma_init(void)
+@@ -3904,7 +4186,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -81839,7 +82406,7 @@ index f8b734a..38014f5 100644
  
  	return 0;
  }
-@@ -3991,8 +4273,8 @@ out:
+@@ -4038,8 +4320,8 @@ out:
  	return ret;
  }
  
@@ -81850,7 +82417,7 @@ index f8b734a..38014f5 100644
  {
  	resource_size_t phys_addr;
  	unsigned long prot = 0;
-@@ -4017,8 +4299,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+@@ -4064,8 +4346,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
   * Access another process' address space as given in mm.  If non-NULL, use the
   * given task for page fault accounting.
   */
@@ -81861,7 +82428,7 @@ index f8b734a..38014f5 100644
  {
  	struct vm_area_struct *vma;
  	void *old_buf = buf;
-@@ -4026,7 +4308,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4073,7 +4355,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
  	down_read(&mm->mmap_sem);
  	/* ignore errors, just check how much was successfully transferred */
  	while (len) {
@@ -81870,7 +82437,7 @@ index f8b734a..38014f5 100644
  		void *maddr;
  		struct page *page = NULL;
  
-@@ -4085,8 +4367,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4132,8 +4414,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
   *
   * The caller must hold a reference on @mm.
   */
@@ -81881,7 +82448,7 @@ index f8b734a..38014f5 100644
  {
  	return __access_remote_vm(NULL, mm, addr, buf, len, write);
  }
-@@ -4096,11 +4378,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4143,11 +4425,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
   * Source/target buffer must be kernel space,
   * Do not walk the page table directly, use get_user_pages
   */
@@ -93045,7 +93612,7 @@ index af49721..e85058e 100644
  	if (err < 0)
  		return err;
 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 09b4286..8620fac 100644
+index f4aaf5a..3b04e3b 100644
 --- a/sound/core/pcm_native.c
 +++ b/sound/core/pcm_native.c
 @@ -2806,11 +2806,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
@@ -104054,27 +104621,8 @@ index 96b919d..c49bb74 100644
 +#endif
 +
  #endif
-diff --git a/virt/kvm/ioapic.c b/virt/kvm/ioapic.c
-index cfb7e4d..52058f0 100644
---- a/virt/kvm/ioapic.c
-+++ b/virt/kvm/ioapic.c
-@@ -73,9 +73,12 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
- 			u32 redir_index = (ioapic->ioregsel - 0x10) >> 1;
- 			u64 redir_content;
- 
--			ASSERT(redir_index < IOAPIC_NUM_PINS);
-+			if (redir_index < IOAPIC_NUM_PINS)
-+				redir_content =
-+					ioapic->redirtbl[redir_index].bits;
-+			else
-+				redir_content = ~0ULL;
- 
--			redir_content = ioapic->redirtbl[redir_index].bits;
- 			result = (ioapic->ioregsel & 0x1) ?
- 			    (redir_content >> 32) & 0xffffffff :
- 			    redir_content & 0xffffffff;
 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 1cd693a..f4a7b20 100644
+index 10afa34..f29c524 100644
 --- a/virt/kvm/kvm_main.c
 +++ b/virt/kvm/kvm_main.c
 @@ -75,12 +75,17 @@ LIST_HEAD(vm_list);
@@ -104106,7 +104654,7 @@ index 1cd693a..f4a7b20 100644
  			(void __user *)(unsigned long)mem->userspace_addr,
  			mem->memory_size)))
  		goto out;
-@@ -1783,7 +1788,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
+@@ -1810,7 +1815,7 @@ static int kvm_vcpu_release(struct inode *inode, struct file *filp)
  	return 0;
  }
  
@@ -104115,7 +104663,7 @@ index 1cd693a..f4a7b20 100644
  	.release        = kvm_vcpu_release,
  	.unlocked_ioctl = kvm_vcpu_ioctl,
  #ifdef CONFIG_COMPAT
-@@ -2304,7 +2309,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
+@@ -2331,7 +2336,7 @@ static int kvm_vm_mmap(struct file *file, struct vm_area_struct *vma)
  	return 0;
  }
  
@@ -104124,7 +104672,7 @@ index 1cd693a..f4a7b20 100644
  	.release        = kvm_vm_release,
  	.unlocked_ioctl = kvm_vm_ioctl,
  #ifdef CONFIG_COMPAT
-@@ -2402,7 +2407,7 @@ out:
+@@ -2429,7 +2434,7 @@ out:
  	return r;
  }
  
@@ -104133,7 +104681,7 @@ index 1cd693a..f4a7b20 100644
  	.unlocked_ioctl = kvm_dev_ioctl,
  	.compat_ioctl   = kvm_dev_ioctl,
  	.llseek		= noop_llseek,
-@@ -2428,7 +2433,7 @@ static void hardware_enable_nolock(void *junk)
+@@ -2455,7 +2460,7 @@ static void hardware_enable_nolock(void *junk)
  
  	if (r) {
  		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
@@ -104142,7 +104690,7 @@ index 1cd693a..f4a7b20 100644
  		printk(KERN_INFO "kvm: enabling virtualization on "
  				 "CPU%d failed\n", cpu);
  	}
-@@ -2482,10 +2487,10 @@ static int hardware_enable_all(void)
+@@ -2509,10 +2514,10 @@ static int hardware_enable_all(void)
  
  	kvm_usage_count++;
  	if (kvm_usage_count == 1) {
@@ -104155,7 +104703,7 @@ index 1cd693a..f4a7b20 100644
  			hardware_disable_all_nolock();
  			r = -EBUSY;
  		}
-@@ -2843,7 +2848,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
+@@ -2870,7 +2875,7 @@ static void kvm_sched_out(struct preempt_notifier *pn,
  	kvm_arch_vcpu_put(vcpu);
  }
  
@@ -104164,7 +104712,7 @@ index 1cd693a..f4a7b20 100644
  		  struct module *module)
  {
  	int r;
-@@ -2879,7 +2884,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2906,7 +2911,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (!vcpu_align)
  		vcpu_align = __alignof__(struct kvm_vcpu);
  	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
@@ -104173,7 +104721,7 @@ index 1cd693a..f4a7b20 100644
  	if (!kvm_vcpu_cache) {
  		r = -ENOMEM;
  		goto out_free_3;
-@@ -2889,9 +2894,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2916,9 +2921,11 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  	if (r)
  		goto out_free;
  
@@ -104185,7 +104733,7 @@ index 1cd693a..f4a7b20 100644
  
  	r = misc_register(&kvm_dev);
  	if (r) {
-@@ -2901,9 +2908,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
+@@ -2928,9 +2935,6 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
  
  	register_syscore_ops(&kvm_syscore_ops);
  
diff --git a/3.8.8/4425_grsec_remove_EI_PAX.patch b/3.8.10/4425_grsec_remove_EI_PAX.patch
index 7d06ac2..7d06ac2 100644
--- a/3.8.8/4425_grsec_remove_EI_PAX.patch
+++ b/3.8.10/4425_grsec_remove_EI_PAX.patch
diff --git a/3.8.8/4430_grsec-remove-localversion-grsec.patch b/3.8.10/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.8.8/4430_grsec-remove-localversion-grsec.patch
+++ b/3.8.10/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.8.8/4435_grsec-mute-warnings.patch b/3.8.10/4435_grsec-mute-warnings.patch
index ed941d5..ed941d5 100644
--- a/3.8.8/4435_grsec-mute-warnings.patch
+++ b/3.8.10/4435_grsec-mute-warnings.patch
diff --git a/3.8.8/4440_grsec-remove-protected-paths.patch b/3.8.10/4440_grsec-remove-protected-paths.patch
index 637934a..637934a 100644
--- a/3.8.8/4440_grsec-remove-protected-paths.patch
+++ b/3.8.10/4440_grsec-remove-protected-paths.patch
diff --git a/3.8.8/4450_grsec-kconfig-default-gids.patch b/3.8.10/4450_grsec-kconfig-default-gids.patch
index 7c20c40..7c20c40 100644
--- a/3.8.8/4450_grsec-kconfig-default-gids.patch
+++ b/3.8.10/4450_grsec-kconfig-default-gids.patch
diff --git a/3.8.8/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.10/4465_selinux-avc_audit-log-curr_ip.patch
index 0a309c8..0a309c8 100644
--- a/3.8.8/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.8.10/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.8.8/4470_disable-compat_vdso.patch b/3.8.10/4470_disable-compat_vdso.patch
index 3ef36aa..3ef36aa 100644
--- a/3.8.8/4470_disable-compat_vdso.patch
+++ b/3.8.10/4470_disable-compat_vdso.patch
diff --git a/3.8.8/1006_linux-3.8.7.patch b/3.8.8/1006_linux-3.8.7.patch
deleted file mode 100644
index 99e0538..0000000
--- a/3.8.8/1006_linux-3.8.7.patch
+++ /dev/null
@@ -1,2238 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 10075d6..85204da 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 8
--SUBLEVEL = 6
-+SUBLEVEL = 7
- EXTRAVERSION =
- NAME = Displaced Humerus Anterior
- 
-diff --git a/arch/alpha/kernel/sys_nautilus.c b/arch/alpha/kernel/sys_nautilus.c
-index 4d4c046..1383f86 100644
---- a/arch/alpha/kernel/sys_nautilus.c
-+++ b/arch/alpha/kernel/sys_nautilus.c
-@@ -188,6 +188,10 @@ nautilus_machine_check(unsigned long vector, unsigned long la_ptr)
- extern void free_reserved_mem(void *, void *);
- extern void pcibios_claim_one_bus(struct pci_bus *);
- 
-+static struct resource irongate_io = {
-+	.name	= "Irongate PCI IO",
-+	.flags	= IORESOURCE_IO,
-+};
- static struct resource irongate_mem = {
- 	.name	= "Irongate PCI MEM",
- 	.flags	= IORESOURCE_MEM,
-@@ -209,6 +213,7 @@ nautilus_init_pci(void)
- 
- 	irongate = pci_get_bus_and_slot(0, 0);
- 	bus->self = irongate;
-+	bus->resource[0] = &irongate_io;
- 	bus->resource[1] = &irongate_mem;
- 
- 	pci_bus_size_bridges(bus);
-diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c
-index 1a89824..3b6de7a 100644
---- a/arch/arm/mach-exynos/common.c
-+++ b/arch/arm/mach-exynos/common.c
-@@ -299,6 +299,7 @@ void exynos4_restart(char mode, const char *cmd)
- 
- void exynos5_restart(char mode, const char *cmd)
- {
-+	struct device_node *np;
- 	u32 val;
- 	void __iomem *addr;
- 
-@@ -306,8 +307,9 @@ void exynos5_restart(char mode, const char *cmd)
- 		val = 0x1;
- 		addr = EXYNOS_SWRESET;
- 	} else if (of_machine_is_compatible("samsung,exynos5440")) {
--		val = (0x10 << 20) | (0x1 << 16);
--		addr = EXYNOS5440_SWRESET;
-+		np = of_find_compatible_node(NULL, NULL, "samsung,exynos5440-clock");
-+		addr = of_iomap(np, 0) + 0xcc;
-+		val = (0xfff << 20) | (0x1 << 16);
- 	} else {
- 		pr_err("%s: cannot support non-DT\n", __func__);
- 		return;
-diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
-index 1658676..33d0671 100644
---- a/arch/mips/kernel/mcount.S
-+++ b/arch/mips/kernel/mcount.S
-@@ -46,10 +46,9 @@
- 	PTR_L	a5, PT_R9(sp)
- 	PTR_L	a6, PT_R10(sp)
- 	PTR_L	a7, PT_R11(sp)
--#else
--	PTR_ADDIU	sp, PT_SIZE
- #endif
--.endm
-+	PTR_ADDIU	sp, PT_SIZE
-+	.endm
- 
- 	.macro RETURN_BACK
- 	jr ra
-@@ -68,7 +67,11 @@ NESTED(ftrace_caller, PT_SIZE, ra)
- 	.globl _mcount
- _mcount:
- 	b	ftrace_stub
--	addiu sp,sp,8
-+#ifdef CONFIG_32BIT
-+	 addiu sp,sp,8
-+#else
-+	 nop
-+#endif
- 
- 	/* When tracing is activated, it calls ftrace_caller+8 (aka here) */
- 	lw	t1, function_trace_stop
-diff --git a/arch/mips/lib/bitops.c b/arch/mips/lib/bitops.c
-index 239a9c9..f3f7756 100644
---- a/arch/mips/lib/bitops.c
-+++ b/arch/mips/lib/bitops.c
-@@ -90,12 +90,12 @@ int __mips_test_and_set_bit(unsigned long nr,
- 	unsigned bit = nr & SZLONG_MASK;
- 	unsigned long mask;
- 	unsigned long flags;
--	unsigned long res;
-+	int res;
- 
- 	a += nr >> SZLONG_LOG;
- 	mask = 1UL << bit;
- 	raw_local_irq_save(flags);
--	res = (mask & *a);
-+	res = (mask & *a) != 0;
- 	*a |= mask;
- 	raw_local_irq_restore(flags);
- 	return res;
-@@ -116,12 +116,12 @@ int __mips_test_and_set_bit_lock(unsigned long nr,
- 	unsigned bit = nr & SZLONG_MASK;
- 	unsigned long mask;
- 	unsigned long flags;
--	unsigned long res;
-+	int res;
- 
- 	a += nr >> SZLONG_LOG;
- 	mask = 1UL << bit;
- 	raw_local_irq_save(flags);
--	res = (mask & *a);
-+	res = (mask & *a) != 0;
- 	*a |= mask;
- 	raw_local_irq_restore(flags);
- 	return res;
-@@ -141,12 +141,12 @@ int __mips_test_and_clear_bit(unsigned long nr, volatile unsigned long *addr)
- 	unsigned bit = nr & SZLONG_MASK;
- 	unsigned long mask;
- 	unsigned long flags;
--	unsigned long res;
-+	int res;
- 
- 	a += nr >> SZLONG_LOG;
- 	mask = 1UL << bit;
- 	raw_local_irq_save(flags);
--	res = (mask & *a);
-+	res = (mask & *a) != 0;
- 	*a &= ~mask;
- 	raw_local_irq_restore(flags);
- 	return res;
-@@ -166,12 +166,12 @@ int __mips_test_and_change_bit(unsigned long nr, volatile unsigned long *addr)
- 	unsigned bit = nr & SZLONG_MASK;
- 	unsigned long mask;
- 	unsigned long flags;
--	unsigned long res;
-+	int res;
- 
- 	a += nr >> SZLONG_LOG;
- 	mask = 1UL << bit;
- 	raw_local_irq_save(flags);
--	res = (mask & *a);
-+	res = (mask & *a) != 0;
- 	*a ^= mask;
- 	raw_local_irq_restore(flags);
- 	return res;
-diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
-index 0da39fe..299731e 100644
---- a/arch/powerpc/platforms/pseries/lpar.c
-+++ b/arch/powerpc/platforms/pseries/lpar.c
-@@ -186,7 +186,13 @@ static long pSeries_lpar_hpte_remove(unsigned long hpte_group)
- 					   (0x1UL << 4), &dummy1, &dummy2);
- 		if (lpar_rc == H_SUCCESS)
- 			return i;
--		BUG_ON(lpar_rc != H_NOT_FOUND);
-+
-+		/*
-+		 * The test for adjunct partition is performed before the
-+		 * ANDCOND test.  H_RESOURCE may be returned, so we need to
-+		 * check for that as well.
-+		 */
-+		BUG_ON(lpar_rc != H_NOT_FOUND && lpar_rc != H_RESOURCE);
- 
- 		slot_offset++;
- 		slot_offset &= 0x7;
-diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
-index 8a84501..5ef205c 100644
---- a/arch/x86/boot/compressed/Makefile
-+++ b/arch/x86/boot/compressed/Makefile
-@@ -4,7 +4,7 @@
- # create a compressed vmlinux image from the original vmlinux
- #
- 
--targets := vmlinux.lds vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo head_$(BITS).o misc.o string.o cmdline.o early_serial_console.o piggy.o
-+targets := vmlinux vmlinux.bin vmlinux.bin.gz vmlinux.bin.bz2 vmlinux.bin.lzma vmlinux.bin.xz vmlinux.bin.lzo
- 
- KBUILD_CFLAGS := -m$(BITS) -D__KERNEL__ $(LINUX_INCLUDE) -O2
- KBUILD_CFLAGS += -fno-strict-aliasing -fPIC
-@@ -29,7 +29,6 @@ VMLINUX_OBJS = $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \
- 	$(obj)/piggy.o
- 
- $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
--$(obj)/efi_stub_$(BITS).o: KBUILD_CLFAGS += -fshort-wchar -mno-red-zone
- 
- ifeq ($(CONFIG_EFI_STUB), y)
- 	VMLINUX_OBJS += $(obj)/eboot.o $(obj)/efi_stub_$(BITS).o
-@@ -43,7 +42,7 @@ OBJCOPYFLAGS_vmlinux.bin :=  -R .comment -S
- $(obj)/vmlinux.bin: vmlinux FORCE
- 	$(call if_changed,objcopy)
- 
--targets += vmlinux.bin.all vmlinux.relocs
-+targets += $(patsubst $(obj)/%,%,$(VMLINUX_OBJS)) vmlinux.bin.all vmlinux.relocs
- 
- CMD_RELOCS = arch/x86/tools/relocs
- quiet_cmd_relocs = RELOCS  $@
-diff --git a/arch/x86/include/asm/syscall.h b/arch/x86/include/asm/syscall.h
-index 1ace47b..2e188d6 100644
---- a/arch/x86/include/asm/syscall.h
-+++ b/arch/x86/include/asm/syscall.h
-@@ -29,13 +29,13 @@ extern const unsigned long sys_call_table[];
-  */
- static inline int syscall_get_nr(struct task_struct *task, struct pt_regs *regs)
- {
--	return regs->orig_ax & __SYSCALL_MASK;
-+	return regs->orig_ax;
- }
- 
- static inline void syscall_rollback(struct task_struct *task,
- 				    struct pt_regs *regs)
- {
--	regs->ax = regs->orig_ax & __SYSCALL_MASK;
-+	regs->ax = regs->orig_ax;
- }
- 
- static inline long syscall_get_error(struct task_struct *task,
-diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
-index 7881477..6d2f7c0 100644
---- a/block/blk-sysfs.c
-+++ b/block/blk-sysfs.c
-@@ -229,6 +229,8 @@ queue_store_##name(struct request_queue *q, const char *page, size_t count) \
- 	unsigned long val;						\
- 	ssize_t ret;							\
- 	ret = queue_var_store(&val, page, count);			\
-+	if (ret < 0)							\
-+		 return ret;						\
- 	if (neg)							\
- 		val = !val;						\
- 									\
-diff --git a/crypto/gcm.c b/crypto/gcm.c
-index 1a25263..b97b186 100644
---- a/crypto/gcm.c
-+++ b/crypto/gcm.c
-@@ -44,6 +44,7 @@ struct crypto_rfc4543_ctx {
- 
- struct crypto_rfc4543_req_ctx {
- 	u8 auth_tag[16];
-+	u8 assocbuf[32];
- 	struct scatterlist cipher[1];
- 	struct scatterlist payload[2];
- 	struct scatterlist assoc[2];
-@@ -1142,9 +1143,19 @@ static struct aead_request *crypto_rfc4543_crypt(struct aead_request *req,
- 	scatterwalk_crypto_chain(payload, dst, vdst == req->iv + 8, 2);
- 	assoclen += 8 + req->cryptlen - (enc ? 0 : authsize);
- 
--	sg_init_table(assoc, 2);
--	sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
--		    req->assoc->offset);
-+	if (req->assoc->length == req->assoclen) {
-+		sg_init_table(assoc, 2);
-+		sg_set_page(assoc, sg_page(req->assoc), req->assoc->length,
-+			    req->assoc->offset);
-+	} else {
-+		BUG_ON(req->assoclen > sizeof(rctx->assocbuf));
-+
-+		scatterwalk_map_and_copy(rctx->assocbuf, req->assoc, 0,
-+					 req->assoclen, 0);
-+
-+		sg_init_table(assoc, 2);
-+		sg_set_buf(assoc, rctx->assocbuf, req->assoclen);
-+	}
- 	scatterwalk_crypto_chain(assoc, payload, 0, 2);
- 
- 	aead_request_set_tfm(subreq, ctx->child);
-diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
-index 7928d4d..eb73798 100644
---- a/drivers/acpi/pci_root.c
-+++ b/drivers/acpi/pci_root.c
-@@ -454,7 +454,6 @@ static int acpi_pci_root_add(struct acpi_device *device)
- 	acpi_handle handle;
- 	struct acpi_device *child;
- 	u32 flags, base_flags;
--	bool is_osc_granted = false;
- 
- 	root = kzalloc(sizeof(struct acpi_pci_root), GFP_KERNEL);
- 	if (!root)
-@@ -525,60 +524,6 @@ static int acpi_pci_root_add(struct acpi_device *device)
- 	flags = base_flags = OSC_PCI_SEGMENT_GROUPS_SUPPORT;
- 	acpi_pci_osc_support(root, flags);
- 
--	/* Indicate support for various _OSC capabilities. */
--	if (pci_ext_cfg_avail())
--		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
--	if (pcie_aspm_support_enabled()) {
--		flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
--		OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
--	}
--	if (pci_msi_enabled())
--		flags |= OSC_MSI_SUPPORT;
--	if (flags != base_flags) {
--		status = acpi_pci_osc_support(root, flags);
--		if (ACPI_FAILURE(status)) {
--			dev_info(&device->dev, "ACPI _OSC support "
--				"notification failed, disabling PCIe ASPM\n");
--			pcie_no_aspm();
--			flags = base_flags;
--		}
--	}
--	if (!pcie_ports_disabled
--	    && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
--		flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
--			| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
--			| OSC_PCI_EXPRESS_PME_CONTROL;
--
--		if (pci_aer_available()) {
--			if (aer_acpi_firmware_first())
--				dev_dbg(&device->dev,
--					"PCIe errors handled by BIOS.\n");
--			else
--				flags |= OSC_PCI_EXPRESS_AER_CONTROL;
--		}
--
--		dev_info(&device->dev,
--			"Requesting ACPI _OSC control (0x%02x)\n", flags);
--
--		status = acpi_pci_osc_control_set(device->handle, &flags,
--				       OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
--		if (ACPI_SUCCESS(status)) {
--			is_osc_granted = true;
--			dev_info(&device->dev,
--				"ACPI _OSC control (0x%02x) granted\n", flags);
--		} else {
--			is_osc_granted = false;
--			dev_info(&device->dev,
--				"ACPI _OSC request failed (%s), "
--				"returned control mask: 0x%02x\n",
--				acpi_format_exception(status), flags);
--		}
--	} else {
--		dev_info(&device->dev,
--			"Unable to request _OSC control "
--			"(_OSC support mask: 0x%02x)\n", flags);
--	}
--
- 	/*
- 	 * TBD: Need PCI interface for enumeration/configuration of roots.
- 	 */
-@@ -618,14 +563,66 @@ static int acpi_pci_root_add(struct acpi_device *device)
- 	list_for_each_entry(child, &device->children, node)
- 		acpi_pci_bridge_scan(child);
- 
--	/* ASPM setting */
--	if (is_osc_granted) {
--		if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM)
--			pcie_clear_aspm(root->bus);
-+	/* Indicate support for various _OSC capabilities. */
-+	if (pci_ext_cfg_avail())
-+		flags |= OSC_EXT_PCI_CONFIG_SUPPORT;
-+	if (pcie_aspm_support_enabled())
-+		flags |= OSC_ACTIVE_STATE_PWR_SUPPORT |
-+			OSC_CLOCK_PWR_CAPABILITY_SUPPORT;
-+	if (pci_msi_enabled())
-+		flags |= OSC_MSI_SUPPORT;
-+	if (flags != base_flags) {
-+		status = acpi_pci_osc_support(root, flags);
-+		if (ACPI_FAILURE(status)) {
-+			dev_info(root->bus->bridge, "ACPI _OSC support "
-+				"notification failed, disabling PCIe ASPM\n");
-+			pcie_no_aspm();
-+			flags = base_flags;
-+		}
-+	}
-+
-+	if (!pcie_ports_disabled
-+	    && (flags & ACPI_PCIE_REQ_SUPPORT) == ACPI_PCIE_REQ_SUPPORT) {
-+		flags = OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL
-+			| OSC_PCI_EXPRESS_NATIVE_HP_CONTROL
-+			| OSC_PCI_EXPRESS_PME_CONTROL;
-+
-+		if (pci_aer_available()) {
-+			if (aer_acpi_firmware_first())
-+				dev_dbg(root->bus->bridge,
-+					"PCIe errors handled by BIOS.\n");
-+			else
-+				flags |= OSC_PCI_EXPRESS_AER_CONTROL;
-+		}
-+
-+		dev_info(root->bus->bridge,
-+			"Requesting ACPI _OSC control (0x%02x)\n", flags);
-+
-+		status = acpi_pci_osc_control_set(device->handle, &flags,
-+					OSC_PCI_EXPRESS_CAP_STRUCTURE_CONTROL);
-+		if (ACPI_SUCCESS(status)) {
-+			dev_info(root->bus->bridge,
-+				"ACPI _OSC control (0x%02x) granted\n", flags);
-+			if (acpi_gbl_FADT.boot_flags & ACPI_FADT_NO_ASPM) {
-+				/*
-+				 * We have ASPM control, but the FADT indicates
-+				 * that it's unsupported. Clear it.
-+				 */
-+				pcie_clear_aspm(root->bus);
-+			}
-+		} else {
-+			dev_info(root->bus->bridge,
-+				"ACPI _OSC request failed (%s), "
-+				"returned control mask: 0x%02x\n",
-+				acpi_format_exception(status), flags);
-+			pr_info("ACPI _OSC control for PCIe not granted, "
-+				"disabling ASPM\n");
-+			pcie_no_aspm();
-+		}
- 	} else {
--		pr_info("ACPI _OSC control for PCIe not granted, "
--			"disabling ASPM\n");
--		pcie_no_aspm();
-+		dev_info(root->bus->bridge,
-+			 "Unable to request _OSC control "
-+			 "(_OSC support mask: 0x%02x)\n", flags);
- 	}
- 
- 	pci_acpi_add_bus_pm_notifier(device, root->bus);
-diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
-index d2ba439..78283bb 100644
---- a/drivers/ata/ata_piix.c
-+++ b/drivers/ata/ata_piix.c
-@@ -150,6 +150,7 @@ enum piix_controller_ids {
- 	tolapai_sata,
- 	piix_pata_vmw,			/* PIIX4 for VMware, spurious DMA_ERR */
- 	ich8_sata_snb,
-+	ich8_2port_sata_snb,
- };
- 
- struct piix_map_db {
-@@ -304,7 +305,7 @@ static const struct pci_device_id piix_pci_tbl[] = {
- 	/* SATA Controller IDE (Lynx Point) */
- 	{ 0x8086, 0x8c01, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
- 	/* SATA Controller IDE (Lynx Point) */
--	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
-+	{ 0x8086, 0x8c08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
- 	/* SATA Controller IDE (Lynx Point) */
- 	{ 0x8086, 0x8c09, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
- 	/* SATA Controller IDE (Lynx Point-LP) */
-@@ -439,6 +440,7 @@ static const struct piix_map_db *piix_map_db_table[] = {
- 	[ich8m_apple_sata]	= &ich8m_apple_map_db,
- 	[tolapai_sata]		= &tolapai_map_db,
- 	[ich8_sata_snb]		= &ich8_map_db,
-+	[ich8_2port_sata_snb]	= &ich8_2port_map_db,
- };
- 
- static struct pci_bits piix_enable_bits[] = {
-@@ -1242,6 +1244,16 @@ static struct ata_port_info piix_port_info[] = {
- 		.udma_mask	= ATA_UDMA6,
- 		.port_ops	= &piix_sata_ops,
- 	},
-+
-+	[ich8_2port_sata_snb] =
-+	{
-+		.flags		= PIIX_SATA_FLAGS | PIIX_FLAG_SIDPR
-+					| PIIX_FLAG_PIO16,
-+		.pio_mask	= ATA_PIO4,
-+		.mwdma_mask	= ATA_MWDMA2,
-+		.udma_mask	= ATA_UDMA6,
-+		.port_ops	= &piix_sata_ops,
-+	},
- };
- 
- #define AHCI_PCI_BAR 5
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 46cd3f4..501c209 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -2329,7 +2329,7 @@ int ata_dev_configure(struct ata_device *dev)
- 		 * from SATA Settings page of Identify Device Data Log.
- 		 */
- 		if (ata_id_has_devslp(dev->id)) {
--			u8 sata_setting[ATA_SECT_SIZE];
-+			u8 *sata_setting = ap->sector_buf;
- 			int i, j;
- 
- 			dev->flags |= ATA_DFLAG_DEVSLP;
-@@ -2437,6 +2437,9 @@ int ata_dev_configure(struct ata_device *dev)
- 		dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
- 					 dev->max_sectors);
- 
-+	if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
-+		dev->max_sectors = ATA_MAX_SECTORS_LBA48;
-+
- 	if (ap->ops->dev_config)
- 		ap->ops->dev_config(dev);
- 
-@@ -4098,6 +4101,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- 	/* Weird ATAPI devices */
- 	{ "TORiSAN DVD-ROM DRD-N216", NULL,	ATA_HORKAGE_MAX_SEC_128 },
- 	{ "QUANTUM DAT    DAT72-000", NULL,	ATA_HORKAGE_ATAPI_MOD16_DMA },
-+	{ "Slimtype DVD A  DS8A8SH", NULL,	ATA_HORKAGE_MAX_SEC_LBA48 },
- 
- 	/* Devices we expect to fail diagnostics */
- 
-diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
-index e6732cf..79f4fca 100644
---- a/drivers/base/regmap/regcache-rbtree.c
-+++ b/drivers/base/regmap/regcache-rbtree.c
-@@ -398,7 +398,7 @@ static int regcache_rbtree_sync(struct regmap *map, unsigned int min,
- 			base = 0;
- 
- 		if (max < rbnode->base_reg + rbnode->blklen)
--			end = rbnode->base_reg + rbnode->blklen - max;
-+			end = max - rbnode->base_reg + 1;
- 		else
- 			end = rbnode->blklen;
- 
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index f00b059..ab3a020 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -662,12 +662,12 @@ struct regmap *regmap_init(struct device *dev,
- 		}
- 	}
- 
-+	regmap_debugfs_init(map, config->name);
-+
- 	ret = regcache_init(map, config);
- 	if (ret != 0)
- 		goto err_range;
- 
--	regmap_debugfs_init(map, config->name);
--
- 	/* Add a devres resource for dev_get_regmap() */
- 	m = devres_alloc(dev_get_regmap_release, sizeof(*m), GFP_KERNEL);
- 	if (!m) {
-diff --git a/drivers/cpufreq/exynos-cpufreq.c b/drivers/cpufreq/exynos-cpufreq.c
-index 7012ea8..41fc550 100644
---- a/drivers/cpufreq/exynos-cpufreq.c
-+++ b/drivers/cpufreq/exynos-cpufreq.c
-@@ -222,8 +222,6 @@ static int exynos_cpufreq_cpu_init(struct cpufreq_policy *policy)
- 
- 	cpufreq_frequency_table_get_attr(exynos_info->freq_table, policy->cpu);
- 
--	locking_frequency = exynos_getspeed(0);
--
- 	/* set the transition latency value */
- 	policy->cpuinfo.transition_latency = 100000;
- 
-@@ -288,6 +286,8 @@ static int __init exynos_cpufreq_init(void)
- 		goto err_vdd_arm;
- 	}
- 
-+	locking_frequency = exynos_getspeed(0);
-+
- 	register_pm_notifier(&exynos_cpufreq_nb);
- 
- 	if (cpufreq_register_driver(&exynos_driver)) {
-diff --git a/drivers/crypto/ux500/cryp/cryp_core.c b/drivers/crypto/ux500/cryp/cryp_core.c
-index 8bc5fef..22c9063 100644
---- a/drivers/crypto/ux500/cryp/cryp_core.c
-+++ b/drivers/crypto/ux500/cryp/cryp_core.c
-@@ -1750,7 +1750,7 @@ static struct platform_driver cryp_driver = {
- 	.shutdown = ux500_cryp_shutdown,
- 	.driver = {
- 		.owner = THIS_MODULE,
--		.name  = "cryp1"
-+		.name  = "cryp1",
- 		.pm    = &ux500_cryp_pm,
- 	}
- };
-diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
-index cdae207..6c3fca9 100644
---- a/drivers/eisa/pci_eisa.c
-+++ b/drivers/eisa/pci_eisa.c
-@@ -19,10 +19,10 @@
- /* There is only *one* pci_eisa device per machine, right ? */
- static struct eisa_root_device pci_eisa_root;
- 
--static int __init pci_eisa_init(struct pci_dev *pdev,
--				const struct pci_device_id *ent)
-+static int __init pci_eisa_init(struct pci_dev *pdev)
- {
--	int rc;
-+	int rc, i;
-+	struct resource *res, *bus_res = NULL;
- 
- 	if ((rc = pci_enable_device (pdev))) {
- 		printk (KERN_ERR "pci_eisa : Could not enable device %s\n",
-@@ -30,9 +30,30 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
- 		return rc;
- 	}
- 
-+	/*
-+	 * The Intel 82375 PCI-EISA bridge is a subtractive-decode PCI
-+	 * device, so the resources available on EISA are the same as those
-+	 * available on the 82375 bus.  This works the same as a PCI-PCI
-+	 * bridge in subtractive-decode mode (see pci_read_bridge_bases()).
-+	 * We assume other PCI-EISA bridges are similar.
-+	 *
-+	 * eisa_root_register() can only deal with a single io port resource,
-+	*  so we use the first valid io port resource.
-+	 */
-+	pci_bus_for_each_resource(pdev->bus, res, i)
-+		if (res && (res->flags & IORESOURCE_IO)) {
-+			bus_res = res;
-+			break;
-+		}
-+
-+	if (!bus_res) {
-+		dev_err(&pdev->dev, "No resources available\n");
-+		return -1;
-+	}
-+
- 	pci_eisa_root.dev              = &pdev->dev;
--	pci_eisa_root.res	       = pdev->bus->resource[0];
--	pci_eisa_root.bus_base_addr    = pdev->bus->resource[0]->start;
-+	pci_eisa_root.res	       = bus_res;
-+	pci_eisa_root.bus_base_addr    = bus_res->start;
- 	pci_eisa_root.slots	       = EISA_MAX_SLOTS;
- 	pci_eisa_root.dma_mask         = pdev->dma_mask;
- 	dev_set_drvdata(pci_eisa_root.dev, &pci_eisa_root);
-@@ -45,22 +66,26 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
- 	return 0;
- }
- 
--static struct pci_device_id pci_eisa_pci_tbl[] = {
--	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
--	  PCI_CLASS_BRIDGE_EISA << 8, 0xffff00, 0 },
--	{ 0, }
--};
-+/*
-+ * We have to call pci_eisa_init_early() before pnpacpi_init()/isapnp_init().
-+ *   Otherwise pnp resource will get enabled early and could prevent eisa
-+ *   to be initialized.
-+ * Also need to make sure pci_eisa_init_early() is called after
-+ * x86/pci_subsys_init().
-+ * So need to use subsys_initcall_sync with it.
-+ */
-+static int __init pci_eisa_init_early(void)
-+{
-+	struct pci_dev *dev = NULL;
-+	int ret;
- 
--static struct pci_driver __refdata pci_eisa_driver = {
--	.name		= "pci_eisa",
--	.id_table	= pci_eisa_pci_tbl,
--	.probe		= pci_eisa_init,
--};
-+	for_each_pci_dev(dev)
-+		if ((dev->class >> 8) == PCI_CLASS_BRIDGE_EISA) {
-+			ret = pci_eisa_init(dev);
-+			if (ret)
-+				return ret;
-+		}
- 
--static int __init pci_eisa_init_module (void)
--{
--	return pci_register_driver (&pci_eisa_driver);
-+	return 0;
- }
--
--device_initcall(pci_eisa_init_module);
--MODULE_DEVICE_TABLE(pci, pci_eisa_pci_tbl);
-+subsys_initcall_sync(pci_eisa_init_early);
-diff --git a/drivers/gpio/gpio-stmpe.c b/drivers/gpio/gpio-stmpe.c
-index 770476a..3ce5bc3 100644
---- a/drivers/gpio/gpio-stmpe.c
-+++ b/drivers/gpio/gpio-stmpe.c
-@@ -307,11 +307,15 @@ static const struct irq_domain_ops stmpe_gpio_irq_simple_ops = {
- 	.xlate = irq_domain_xlate_twocell,
- };
- 
--static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio)
-+static int stmpe_gpio_irq_init(struct stmpe_gpio *stmpe_gpio,
-+		struct device_node *np)
- {
--	int base = stmpe_gpio->irq_base;
-+	int base = 0;
- 
--	stmpe_gpio->domain = irq_domain_add_simple(NULL,
-+	if (!np)
-+		base = stmpe_gpio->irq_base;
-+
-+	stmpe_gpio->domain = irq_domain_add_simple(np,
- 				stmpe_gpio->chip.ngpio, base,
- 				&stmpe_gpio_irq_simple_ops, stmpe_gpio);
- 	if (!stmpe_gpio->domain) {
-@@ -346,6 +350,9 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
- 	stmpe_gpio->chip = template_chip;
- 	stmpe_gpio->chip.ngpio = stmpe->num_gpios;
- 	stmpe_gpio->chip.dev = &pdev->dev;
-+#ifdef CONFIG_OF
-+	stmpe_gpio->chip.of_node = np;
-+#endif
- 	stmpe_gpio->chip.base = pdata ? pdata->gpio_base : -1;
- 
- 	if (pdata)
-@@ -366,7 +373,7 @@ static int stmpe_gpio_probe(struct platform_device *pdev)
- 		goto out_free;
- 
- 	if (irq >= 0) {
--		ret = stmpe_gpio_irq_init(stmpe_gpio);
-+		ret = stmpe_gpio_irq_init(stmpe_gpio, np);
- 		if (ret)
- 			goto out_disable;
- 
-diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
-index 133b413..32d7775 100644
---- a/drivers/gpu/drm/drm_fops.c
-+++ b/drivers/gpu/drm/drm_fops.c
-@@ -123,6 +123,7 @@ int drm_open(struct inode *inode, struct file *filp)
- 	int retcode = 0;
- 	int need_setup = 0;
- 	struct address_space *old_mapping;
-+	struct address_space *old_imapping;
- 
- 	minor = idr_find(&drm_minors_idr, minor_id);
- 	if (!minor)
-@@ -137,6 +138,7 @@ int drm_open(struct inode *inode, struct file *filp)
- 	if (!dev->open_count++)
- 		need_setup = 1;
- 	mutex_lock(&dev->struct_mutex);
-+	old_imapping = inode->i_mapping;
- 	old_mapping = dev->dev_mapping;
- 	if (old_mapping == NULL)
- 		dev->dev_mapping = &inode->i_data;
-@@ -159,8 +161,8 @@ int drm_open(struct inode *inode, struct file *filp)
- 
- err_undo:
- 	mutex_lock(&dev->struct_mutex);
--	filp->f_mapping = old_mapping;
--	inode->i_mapping = old_mapping;
-+	filp->f_mapping = old_imapping;
-+	inode->i_mapping = old_imapping;
- 	iput(container_of(dev->dev_mapping, struct inode, i_data));
- 	dev->dev_mapping = old_mapping;
- 	mutex_unlock(&dev->struct_mutex);
-diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index 7adf5a7..ba8805a 100644
---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-@@ -43,7 +43,7 @@ eb_create(int size)
- {
- 	struct eb_objects *eb;
- 	int count = PAGE_SIZE / sizeof(struct hlist_head) / 2;
--	BUILD_BUG_ON(!is_power_of_2(PAGE_SIZE / sizeof(struct hlist_head)));
-+	BUILD_BUG_ON_NOT_POWER_OF_2(PAGE_SIZE / sizeof(struct hlist_head));
- 	while (count > size)
- 		count >>= 1;
- 	eb = kzalloc(count*sizeof(struct hlist_head) +
-diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
-index b52ed09..625b091 100644
---- a/drivers/gpu/drm/i915/intel_crt.c
-+++ b/drivers/gpu/drm/i915/intel_crt.c
-@@ -45,6 +45,9 @@
- 
- struct intel_crt {
- 	struct intel_encoder base;
-+	/* DPMS state is stored in the connector, which we need in the
-+	 * encoder's enable/disable callbacks */
-+	struct intel_connector *connector;
- 	bool force_hotplug_required;
- 	u32 adpa_reg;
- };
-@@ -81,29 +84,6 @@ static bool intel_crt_get_hw_state(struct intel_encoder *encoder,
- 	return true;
- }
- 
--static void intel_disable_crt(struct intel_encoder *encoder)
--{
--	struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
--	struct intel_crt *crt = intel_encoder_to_crt(encoder);
--	u32 temp;
--
--	temp = I915_READ(crt->adpa_reg);
--	temp |= ADPA_HSYNC_CNTL_DISABLE | ADPA_VSYNC_CNTL_DISABLE;
--	temp &= ~ADPA_DAC_ENABLE;
--	I915_WRITE(crt->adpa_reg, temp);
--}
--
--static void intel_enable_crt(struct intel_encoder *encoder)
--{
--	struct drm_i915_private *dev_priv = encoder->base.dev->dev_private;
--	struct intel_crt *crt = intel_encoder_to_crt(encoder);
--	u32 temp;
--
--	temp = I915_READ(crt->adpa_reg);
--	temp |= ADPA_DAC_ENABLE;
--	I915_WRITE(crt->adpa_reg, temp);
--}
--
- /* Note: The caller is required to filter out dpms modes not supported by the
-  * platform. */
- static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
-@@ -135,6 +115,19 @@ static void intel_crt_set_dpms(struct intel_encoder *encoder, int mode)
- 	I915_WRITE(crt->adpa_reg, temp);
- }
- 
-+static void intel_disable_crt(struct intel_encoder *encoder)
-+{
-+	intel_crt_set_dpms(encoder, DRM_MODE_DPMS_OFF);
-+}
-+
-+static void intel_enable_crt(struct intel_encoder *encoder)
-+{
-+	struct intel_crt *crt = intel_encoder_to_crt(encoder);
-+
-+	intel_crt_set_dpms(encoder, crt->connector->base.dpms);
-+}
-+
-+
- static void intel_crt_dpms(struct drm_connector *connector, int mode)
- {
- 	struct drm_device *dev = connector->dev;
-@@ -746,6 +739,7 @@ void intel_crt_init(struct drm_device *dev)
- 	}
- 
- 	connector = &intel_connector->base;
-+	crt->connector = intel_connector;
- 	drm_connector_init(dev, &intel_connector->base,
- 			   &intel_crt_connector_funcs, DRM_MODE_CONNECTOR_VGA);
- 
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index e6e4df7..d3f834a 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -8901,6 +8901,15 @@ static struct intel_quirk intel_quirks[] = {
- 
- 	/* Acer Aspire 4736Z */
- 	{ 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
-+
-+	/* Acer/eMachines G725 */
-+	{ 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
-+
-+	/* Acer/eMachines e725 */
-+	{ 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
-+
-+	/* Acer/Packard Bell NCL20 */
-+	{ 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
- };
- 
- static void intel_init_quirks(struct drm_device *dev)
-diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
-index 4f50c40..2e7c949 100644
---- a/drivers/gpu/drm/mgag200/mgag200_mode.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
-@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 	int i;
- 	unsigned char misc = 0;
- 	unsigned char ext_vga[6];
--	unsigned char ext_vga_index24;
--	unsigned char dac_index90 = 0;
- 	u8 bppshift;
- 
- 	static unsigned char dacvalue[] = {
-@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 		option2 = 0x0000b000;
- 		break;
- 	case G200_ER:
--		dac_index90 = 0;
- 		break;
- 	}
- 
-@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 		WREG_DAC(i, dacvalue[i]);
- 	}
- 
--	if (mdev->type == G200_ER) {
--		WREG_DAC(0x90, dac_index90);
--	}
--
-+	if (mdev->type == G200_ER)
-+		WREG_DAC(0x90, 0);
- 
- 	if (option)
- 		pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
-@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 	if (mdev->type == G200_WB)
- 		ext_vga[1] |= 0x88;
- 
--	ext_vga_index24 = 0x05;
--
- 	/* Set pixel clocks */
- 	misc = 0x2d;
- 	WREG8(MGA_MISC_OUT, misc);
-@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
- 	}
- 
- 	if (mdev->type == G200_ER)
--		WREG_ECRT(24, ext_vga_index24);
-+		WREG_ECRT(0x24, 0x5);
- 
- 	if (mdev->type == G200_EV) {
- 		WREG_ECRT(6, 0);
-diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
-index 4124192..b569fe8 100644
---- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
-+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
-@@ -386,7 +386,7 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
- 	struct nouveau_drm *drm = nouveau_drm(dev);
- 	struct nouveau_device *device = nv_device(drm->device);
- 	struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
--	struct nouveau_abi16_chan *chan, *temp;
-+	struct nouveau_abi16_chan *chan = NULL, *temp;
- 	struct nouveau_abi16_ntfy *ntfy;
- 	struct nouveau_object *object;
- 	struct nv_dma_class args = {};
-@@ -399,10 +399,11 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
- 	if (unlikely(nv_device(abi16->device)->card_type >= NV_C0))
- 		return nouveau_abi16_put(abi16, -EINVAL);
- 
--	list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
--		if (chan->chan->handle == (NVDRM_CHAN | info->channel))
-+	list_for_each_entry(temp, &abi16->channels, head) {
-+		if (temp->chan->handle == (NVDRM_CHAN | info->channel)) {
-+			chan = temp;
- 			break;
--		chan = NULL;
-+		}
- 	}
- 
- 	if (!chan)
-@@ -454,17 +455,18 @@ nouveau_abi16_ioctl_gpuobj_free(ABI16_IOCTL_ARGS)
- {
- 	struct drm_nouveau_gpuobj_free *fini = data;
- 	struct nouveau_abi16 *abi16 = nouveau_abi16_get(file_priv, dev);
--	struct nouveau_abi16_chan *chan, *temp;
-+	struct nouveau_abi16_chan *chan = NULL, *temp;
- 	struct nouveau_abi16_ntfy *ntfy;
- 	int ret;
- 
- 	if (unlikely(!abi16))
- 		return -ENOMEM;
- 
--	list_for_each_entry_safe(chan, temp, &abi16->channels, head) {
--		if (chan->chan->handle == (NVDRM_CHAN | fini->channel))
-+	list_for_each_entry(temp, &abi16->channels, head) {
-+		if (temp->chan->handle == (NVDRM_CHAN | fini->channel)) {
-+			chan = temp;
- 			break;
--		chan = NULL;
-+		}
- 	}
- 
- 	if (!chan)
-diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
-index 25ddf3e..811062c 100644
---- a/drivers/hid/hid-magicmouse.c
-+++ b/drivers/hid/hid-magicmouse.c
-@@ -462,6 +462,21 @@ static int magicmouse_input_mapping(struct hid_device *hdev,
- 	return 0;
- }
- 
-+static void magicmouse_input_configured(struct hid_device *hdev,
-+		struct hid_input *hi)
-+
-+{
-+	struct magicmouse_sc *msc = hid_get_drvdata(hdev);
-+
-+	int ret = magicmouse_setup_input(msc->input, hdev);
-+	if (ret) {
-+		hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
-+		/* clean msc->input to notify probe() of the failure */
-+		msc->input = NULL;
-+	}
-+}
-+
-+
- static int magicmouse_probe(struct hid_device *hdev,
- 	const struct hid_device_id *id)
- {
-@@ -493,15 +508,10 @@ static int magicmouse_probe(struct hid_device *hdev,
- 		goto err_free;
- 	}
- 
--	/* We do this after hid-input is done parsing reports so that
--	 * hid-input uses the most natural button and axis IDs.
--	 */
--	if (msc->input) {
--		ret = magicmouse_setup_input(msc->input, hdev);
--		if (ret) {
--			hid_err(hdev, "magicmouse setup input failed (%d)\n", ret);
--			goto err_stop_hw;
--		}
-+	if (!msc->input) {
-+		hid_err(hdev, "magicmouse input not registered\n");
-+		ret = -ENOMEM;
-+		goto err_stop_hw;
- 	}
- 
- 	if (id->product == USB_DEVICE_ID_APPLE_MAGICMOUSE)
-@@ -568,6 +578,7 @@ static struct hid_driver magicmouse_driver = {
- 	.remove = magicmouse_remove,
- 	.raw_event = magicmouse_raw_event,
- 	.input_mapping = magicmouse_input_mapping,
-+	.input_configured = magicmouse_input_configured,
- };
- 
- static int __init magicmouse_init(void)
-diff --git a/drivers/hwspinlock/hwspinlock_core.c b/drivers/hwspinlock/hwspinlock_core.c
-index db713c0..461a0d7 100644
---- a/drivers/hwspinlock/hwspinlock_core.c
-+++ b/drivers/hwspinlock/hwspinlock_core.c
-@@ -416,6 +416,8 @@ static int __hwspin_lock_request(struct hwspinlock *hwlock)
- 	ret = pm_runtime_get_sync(dev);
- 	if (ret < 0) {
- 		dev_err(dev, "%s: can't power on device\n", __func__);
-+		pm_runtime_put_noidle(dev);
-+		module_put(dev->driver->owner);
- 		return ret;
- 	}
- 
-diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-index b3e3294..0d03d38 100644
---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
-@@ -7858,12 +7858,19 @@ static int __init ixgbe_init_module(void)
- 	ixgbe_dbg_init();
- #endif /* CONFIG_DEBUG_FS */
- 
-+	ret = pci_register_driver(&ixgbe_driver);
-+	if (ret) {
-+#ifdef CONFIG_DEBUG_FS
-+		ixgbe_dbg_exit();
-+#endif /* CONFIG_DEBUG_FS */
-+		return ret;
-+	}
-+
- #ifdef CONFIG_IXGBE_DCA
- 	dca_register_notify(&dca_notifier);
- #endif
- 
--	ret = pci_register_driver(&ixgbe_driver);
--	return ret;
-+	return 0;
- }
- 
- module_init(ixgbe_init_module);
-diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
-index 998974f..2d849da 100644
---- a/drivers/net/ethernet/realtek/r8169.c
-+++ b/drivers/net/ethernet/realtek/r8169.c
-@@ -3819,6 +3819,30 @@ static void rtl_init_mdio_ops(struct rtl8169_private *tp)
- 	}
- }
- 
-+static void rtl_speed_down(struct rtl8169_private *tp)
-+{
-+	u32 adv;
-+	int lpa;
-+
-+	rtl_writephy(tp, 0x1f, 0x0000);
-+	lpa = rtl_readphy(tp, MII_LPA);
-+
-+	if (lpa & (LPA_10HALF | LPA_10FULL))
-+		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full;
-+	else if (lpa & (LPA_100HALF | LPA_100FULL))
-+		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
-+		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full;
-+	else
-+		adv = ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full |
-+		      ADVERTISED_100baseT_Half | ADVERTISED_100baseT_Full |
-+		      (tp->mii.supports_gmii ?
-+		       ADVERTISED_1000baseT_Half |
-+		       ADVERTISED_1000baseT_Full : 0);
-+
-+	rtl8169_set_speed(tp->dev, AUTONEG_ENABLE, SPEED_1000, DUPLEX_FULL,
-+			  adv);
-+}
-+
- static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
- {
- 	void __iomem *ioaddr = tp->mmio_addr;
-@@ -3849,9 +3873,7 @@ static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
- 	if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
- 		return false;
- 
--	rtl_writephy(tp, 0x1f, 0x0000);
--	rtl_writephy(tp, MII_BMCR, 0x0000);
--
-+	rtl_speed_down(tp);
- 	rtl_wol_suspend_quirk(tp);
- 
- 	return true;
-diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
-index cdb11b3..3eca710 100644
---- a/drivers/net/wireless/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/mwifiex/cfg80211.c
-@@ -1846,7 +1846,8 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
- 		}
- 	}
- 
--	for (i = 0; i < request->n_channels; i++) {
-+	for (i = 0; i < min_t(u32, request->n_channels,
-+			      MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
- 		chan = request->channels[i];
- 		priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
- 		priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
-diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
-index 8955a0e..771be26 100644
---- a/drivers/net/wireless/mwifiex/scan.c
-+++ b/drivers/net/wireless/mwifiex/scan.c
-@@ -1371,8 +1371,10 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
- 			queue_work(adapter->workqueue, &adapter->main_work);
- 
- 			/* Perform internal scan synchronously */
--			if (!priv->scan_request)
-+			if (!priv->scan_request) {
-+				dev_dbg(adapter->dev, "wait internal scan\n");
- 				mwifiex_wait_queue_complete(adapter, cmd_node);
-+			}
- 		} else {
- 			spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
- 					       flags);
-@@ -1768,7 +1770,12 @@ check_next_scan:
- 		/* Need to indicate IOCTL complete */
- 		if (adapter->curr_cmd->wait_q_enabled) {
- 			adapter->cmd_wait_q.status = 0;
--			mwifiex_complete_cmd(adapter, adapter->curr_cmd);
-+			if (!priv->scan_request) {
-+				dev_dbg(adapter->dev,
-+					"complete internal scan\n");
-+				mwifiex_complete_cmd(adapter,
-+						     adapter->curr_cmd);
-+			}
- 		}
- 		if (priv->report_scan_result)
- 			priv->report_scan_result = false;
-diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
-index a0c8cae..b1c673e 100644
---- a/drivers/net/wireless/rt2x00/rt2x00pci.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
-@@ -52,8 +52,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
- 		udelay(REGISTER_BUSY_DELAY);
- 	}
- 
--	ERROR(rt2x00dev, "Indirect register access failed: "
--	      "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
-+	printk_once(KERN_ERR "%s() Indirect register access failed: "
-+	      "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
- 	*reg = ~0;
- 
- 	return 0;
-diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
-index 1af4008..21354bf 100644
---- a/drivers/pci/pci-acpi.c
-+++ b/drivers/pci/pci-acpi.c
-@@ -53,14 +53,15 @@ static void pci_acpi_wake_dev(acpi_handle handle, u32 event, void *context)
- 		return;
- 	}
- 
--	if (!pci_dev->pm_cap || !pci_dev->pme_support
--	     || pci_check_pme_status(pci_dev)) {
--		if (pci_dev->pme_poll)
--			pci_dev->pme_poll = false;
-+	/* Clear PME Status if set. */
-+	if (pci_dev->pme_support)
-+		pci_check_pme_status(pci_dev);
- 
--		pci_wakeup_event(pci_dev);
--		pm_runtime_resume(&pci_dev->dev);
--	}
-+	if (pci_dev->pme_poll)
-+		pci_dev->pme_poll = false;
-+
-+	pci_wakeup_event(pci_dev);
-+	pm_runtime_resume(&pci_dev->dev);
- 
- 	if (pci_dev->subordinate)
- 		pci_pme_wakeup_bus(pci_dev->subordinate);
-diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
-index 08c243a..ed4d094 100644
---- a/drivers/pci/pcie/portdrv_pci.c
-+++ b/drivers/pci/pcie/portdrv_pci.c
-@@ -185,14 +185,6 @@ static const struct dev_pm_ops pcie_portdrv_pm_ops = {
- #endif /* !PM */
- 
- /*
-- * PCIe port runtime suspend is broken for some chipsets, so use a
-- * black list to disable runtime PM for these chipsets.
-- */
--static const struct pci_device_id port_runtime_pm_black_list[] = {
--	{ /* end: all zeroes */ }
--};
--
--/*
-  * pcie_portdrv_probe - Probe PCI-Express port devices
-  * @dev: PCI-Express port device being probed
-  *
-@@ -225,16 +217,11 @@ static int pcie_portdrv_probe(struct pci_dev *dev,
- 	 * it by default.
- 	 */
- 	dev->d3cold_allowed = false;
--	if (!pci_match_id(port_runtime_pm_black_list, dev))
--		pm_runtime_put_noidle(&dev->dev);
--
- 	return 0;
- }
- 
- static void pcie_portdrv_remove(struct pci_dev *dev)
- {
--	if (!pci_match_id(port_runtime_pm_black_list, dev))
--		pm_runtime_get_noresume(&dev->dev);
- 	pcie_port_device_remove(dev);
- 	pci_disable_device(dev);
- }
-diff --git a/drivers/platform/x86/msi-wmi.c b/drivers/platform/x86/msi-wmi.c
-index 2264331..b96766b 100644
---- a/drivers/platform/x86/msi-wmi.c
-+++ b/drivers/platform/x86/msi-wmi.c
-@@ -176,7 +176,7 @@ static void msi_wmi_notify(u32 value, void *context)
- 				pr_debug("Suppressed key event 0x%X - "
- 					 "Last press was %lld us ago\n",
- 					 key->code, ktime_to_us(diff));
--				return;
-+				goto msi_wmi_notify_exit;
- 			}
- 			last_pressed[key->code - SCANCODE_BASE] = cur;
- 
-@@ -195,6 +195,8 @@ static void msi_wmi_notify(u32 value, void *context)
- 			pr_info("Unknown key pressed - %x\n", eventcode);
- 	} else
- 		pr_info("Unknown event received\n");
-+
-+msi_wmi_notify_exit:
- 	kfree(response.pointer);
- }
- 
-diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
-index 96ce101..a936efb 100644
---- a/drivers/remoteproc/Kconfig
-+++ b/drivers/remoteproc/Kconfig
-@@ -5,7 +5,7 @@ config REMOTEPROC
- 	tristate
- 	depends on EXPERIMENTAL
- 	depends on HAS_DMA
--	select FW_CONFIG
-+	select FW_LOADER
- 	select VIRTIO
- 
- config OMAP_REMOTEPROC
-diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
-index dd3bfaf..752b507 100644
---- a/drivers/remoteproc/remoteproc_core.c
-+++ b/drivers/remoteproc/remoteproc_core.c
-@@ -370,10 +370,12 @@ static int rproc_handle_vdev(struct rproc *rproc, struct fw_rsc_vdev *rsc,
- 	/* it is now safe to add the virtio device */
- 	ret = rproc_add_virtio_dev(rvdev, rsc->id);
- 	if (ret)
--		goto free_rvdev;
-+		goto remove_rvdev;
- 
- 	return 0;
- 
-+remove_rvdev:
-+	list_del(&rvdev->node);
- free_rvdev:
- 	kfree(rvdev);
- 	return ret;
-diff --git a/drivers/remoteproc/ste_modem_rproc.c b/drivers/remoteproc/ste_modem_rproc.c
-index a7743c0..fb95c42 100644
---- a/drivers/remoteproc/ste_modem_rproc.c
-+++ b/drivers/remoteproc/ste_modem_rproc.c
-@@ -240,6 +240,8 @@ static int sproc_drv_remove(struct platform_device *pdev)
- 
- 	/* Unregister as remoteproc device */
- 	rproc_del(sproc->rproc);
-+	dma_free_coherent(sproc->rproc->dev.parent, SPROC_FW_SIZE,
-+			  sproc->fw_addr, sproc->fw_dma_addr);
- 	rproc_put(sproc->rproc);
- 
- 	mdev->drv_data = NULL;
-@@ -297,10 +299,13 @@ static int sproc_probe(struct platform_device *pdev)
- 	/* Register as a remoteproc device */
- 	err = rproc_add(rproc);
- 	if (err)
--		goto free_rproc;
-+		goto free_mem;
- 
- 	return 0;
- 
-+free_mem:
-+	dma_free_coherent(rproc->dev.parent, SPROC_FW_SIZE,
-+			  sproc->fw_addr, sproc->fw_dma_addr);
- free_rproc:
- 	/* Reset device data upon error */
- 	mdev->drv_data = NULL;
-diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
-index d38b267..b6469e2 100644
---- a/drivers/rtc/rtc-at91rm9200.c
-+++ b/drivers/rtc/rtc-at91rm9200.c
-@@ -44,7 +44,6 @@ static DECLARE_COMPLETION(at91_rtc_updated);
- static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
- static void __iomem *at91_rtc_regs;
- static int irq;
--static u32 at91_rtc_imr;
- 
- /*
-  * Decode time/date into rtc_time structure
-@@ -109,11 +108,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
- 	cr = at91_rtc_read(AT91_RTC_CR);
- 	at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
- 
--	at91_rtc_imr |= AT91_RTC_ACKUPD;
- 	at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
- 	wait_for_completion(&at91_rtc_updated);	/* wait for ACKUPD interrupt */
- 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
--	at91_rtc_imr &= ~AT91_RTC_ACKUPD;
- 
- 	at91_rtc_write(AT91_RTC_TIMR,
- 			  bin2bcd(tm->tm_sec) << 0
-@@ -145,7 +142,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
- 	tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
- 	tm->tm_year = at91_alarm_year - 1900;
- 
--	alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
-+	alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
- 			? 1 : 0;
- 
- 	pr_debug("%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
-@@ -171,7 +168,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
- 	tm.tm_sec = alrm->time.tm_sec;
- 
- 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
--	at91_rtc_imr &= ~AT91_RTC_ALARM;
- 	at91_rtc_write(AT91_RTC_TIMALR,
- 		  bin2bcd(tm.tm_sec) << 0
- 		| bin2bcd(tm.tm_min) << 8
-@@ -184,7 +180,6 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
- 
- 	if (alrm->enabled) {
- 		at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
--		at91_rtc_imr |= AT91_RTC_ALARM;
- 		at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
- 	}
- 
-@@ -201,12 +196,9 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
- 
- 	if (enabled) {
- 		at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
--		at91_rtc_imr |= AT91_RTC_ALARM;
- 		at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
--	} else {
-+	} else
- 		at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
--		at91_rtc_imr &= ~AT91_RTC_ALARM;
--	}
- 
- 	return 0;
- }
-@@ -215,10 +207,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
-  */
- static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
- {
-+	unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
-+
- 	seq_printf(seq, "update_IRQ\t: %s\n",
--			(at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
-+			(imr & AT91_RTC_ACKUPD) ? "yes" : "no");
- 	seq_printf(seq, "periodic_IRQ\t: %s\n",
--			(at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
-+			(imr & AT91_RTC_SECEV) ? "yes" : "no");
- 
- 	return 0;
- }
-@@ -233,7 +227,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
- 	unsigned int rtsr;
- 	unsigned long events = 0;
- 
--	rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
-+	rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
- 	if (rtsr) {		/* this interrupt is shared!  Is it ours? */
- 		if (rtsr & AT91_RTC_ALARM)
- 			events |= (RTC_AF | RTC_IRQF);
-@@ -297,7 +291,6 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
- 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
- 					AT91_RTC_SECEV | AT91_RTC_TIMEV |
- 					AT91_RTC_CALEV);
--	at91_rtc_imr = 0;
- 
- 	ret = request_irq(irq, at91_rtc_interrupt,
- 				IRQF_SHARED,
-@@ -337,7 +330,6 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
- 	at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
- 					AT91_RTC_SECEV | AT91_RTC_TIMEV |
- 					AT91_RTC_CALEV);
--	at91_rtc_imr = 0;
- 	free_irq(irq, pdev);
- 
- 	rtc_device_unregister(rtc);
-@@ -350,35 +342,31 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
- 
- /* AT91RM9200 RTC Power management control */
- 
--static u32 at91_rtc_bkpimr;
--
-+static u32 at91_rtc_imr;
- 
- static int at91_rtc_suspend(struct device *dev)
- {
- 	/* this IRQ is shared with DBGU and other hardware which isn't
- 	 * necessarily doing PM like we are...
- 	 */
--	at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
--	if (at91_rtc_bkpimr) {
--		if (device_may_wakeup(dev)) {
-+	at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
-+			& (AT91_RTC_ALARM|AT91_RTC_SECEV);
-+	if (at91_rtc_imr) {
-+		if (device_may_wakeup(dev))
- 			enable_irq_wake(irq);
--		} else {
--			at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
--			at91_rtc_imr &= ~at91_rtc_bkpimr;
--		}
--}
-+		else
-+			at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
-+	}
- 	return 0;
- }
- 
- static int at91_rtc_resume(struct device *dev)
- {
--	if (at91_rtc_bkpimr) {
--		if (device_may_wakeup(dev)) {
-+	if (at91_rtc_imr) {
-+		if (device_may_wakeup(dev))
- 			disable_irq_wake(irq);
--		} else {
--			at91_rtc_imr |= at91_rtc_bkpimr;
--			at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
--		}
-+		else
-+			at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
- 	}
- 	return 0;
- }
-diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
-index 5f940b6..da1945e 100644
---- a/drivers/rtc/rtc-at91rm9200.h
-+++ b/drivers/rtc/rtc-at91rm9200.h
-@@ -64,6 +64,7 @@
- #define	AT91_RTC_SCCR		0x1c			/* Status Clear Command Register */
- #define	AT91_RTC_IER		0x20			/* Interrupt Enable Register */
- #define	AT91_RTC_IDR		0x24			/* Interrupt Disable Register */
-+#define	AT91_RTC_IMR		0x28			/* Interrupt Mask Register */
- 
- #define	AT91_RTC_VER		0x2c			/* Valid Entry Register */
- #define		AT91_RTC_NVTIM		(1 <<  0)		/* Non valid Time */
-diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
-index cb3a310..41e21bf 100644
---- a/drivers/spi/spi-mpc512x-psc.c
-+++ b/drivers/spi/spi-mpc512x-psc.c
-@@ -164,7 +164,7 @@ static int mpc512x_psc_spi_transfer_rxtx(struct spi_device *spi,
- 
- 		for (i = count; i > 0; i--) {
- 			data = tx_buf ? *tx_buf++ : 0;
--			if (len == EOFBYTE)
-+			if (len == EOFBYTE && t->cs_change)
- 				setbits32(&fifo->txcmd, MPC512x_PSC_FIFO_EOF);
- 			out_8(&fifo->txdata_8, data);
- 			len--;
-diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c
-index ad93231..6796a25 100644
---- a/drivers/spi/spi-s3c64xx.c
-+++ b/drivers/spi/spi-s3c64xx.c
-@@ -997,25 +997,30 @@ static irqreturn_t s3c64xx_spi_irq(int irq, void *data)
- {
- 	struct s3c64xx_spi_driver_data *sdd = data;
- 	struct spi_master *spi = sdd->master;
--	unsigned int val;
-+	unsigned int val, clr = 0;
- 
--	val = readl(sdd->regs + S3C64XX_SPI_PENDING_CLR);
-+	val = readl(sdd->regs + S3C64XX_SPI_STATUS);
- 
--	val &= S3C64XX_SPI_PND_RX_OVERRUN_CLR |
--		S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
--		S3C64XX_SPI_PND_TX_OVERRUN_CLR |
--		S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
--
--	writel(val, sdd->regs + S3C64XX_SPI_PENDING_CLR);
--
--	if (val & S3C64XX_SPI_PND_RX_OVERRUN_CLR)
-+	if (val & S3C64XX_SPI_ST_RX_OVERRUN_ERR) {
-+		clr = S3C64XX_SPI_PND_RX_OVERRUN_CLR;
- 		dev_err(&spi->dev, "RX overrun\n");
--	if (val & S3C64XX_SPI_PND_RX_UNDERRUN_CLR)
-+	}
-+	if (val & S3C64XX_SPI_ST_RX_UNDERRUN_ERR) {
-+		clr |= S3C64XX_SPI_PND_RX_UNDERRUN_CLR;
- 		dev_err(&spi->dev, "RX underrun\n");
--	if (val & S3C64XX_SPI_PND_TX_OVERRUN_CLR)
-+	}
-+	if (val & S3C64XX_SPI_ST_TX_OVERRUN_ERR) {
-+		clr |= S3C64XX_SPI_PND_TX_OVERRUN_CLR;
- 		dev_err(&spi->dev, "TX overrun\n");
--	if (val & S3C64XX_SPI_PND_TX_UNDERRUN_CLR)
-+	}
-+	if (val & S3C64XX_SPI_ST_TX_UNDERRUN_ERR) {
-+		clr |= S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
- 		dev_err(&spi->dev, "TX underrun\n");
-+	}
-+
-+	/* Clear the pending irq by setting and then clearing it */
-+	writel(clr, sdd->regs + S3C64XX_SPI_PENDING_CLR);
-+	writel(0, sdd->regs + S3C64XX_SPI_PENDING_CLR);
- 
- 	return IRQ_HANDLED;
- }
-@@ -1039,9 +1044,13 @@ static void s3c64xx_spi_hwinit(struct s3c64xx_spi_driver_data *sdd, int channel)
- 	writel(0, regs + S3C64XX_SPI_MODE_CFG);
- 	writel(0, regs + S3C64XX_SPI_PACKET_CNT);
- 
--	/* Clear any irq pending bits */
--	writel(readl(regs + S3C64XX_SPI_PENDING_CLR),
--				regs + S3C64XX_SPI_PENDING_CLR);
-+	/* Clear any irq pending bits, should set and clear the bits */
-+	val = S3C64XX_SPI_PND_RX_OVERRUN_CLR |
-+		S3C64XX_SPI_PND_RX_UNDERRUN_CLR |
-+		S3C64XX_SPI_PND_TX_OVERRUN_CLR |
-+		S3C64XX_SPI_PND_TX_UNDERRUN_CLR;
-+	writel(val, regs + S3C64XX_SPI_PENDING_CLR);
-+	writel(0, regs + S3C64XX_SPI_PENDING_CLR);
- 
- 	writel(0, regs + S3C64XX_SPI_SWAP_CFG);
- 
-diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
-index 8c8ce80..bfbf9fb 100644
---- a/drivers/thermal/thermal_sys.c
-+++ b/drivers/thermal/thermal_sys.c
-@@ -1807,6 +1807,7 @@ static int __init thermal_init(void)
- 		idr_destroy(&thermal_cdev_idr);
- 		mutex_destroy(&thermal_idr_lock);
- 		mutex_destroy(&thermal_list_lock);
-+		return result;
- 	}
- 	result = genetlink_init();
- 	return result;
-diff --git a/drivers/tty/serial/8250/8250_pnp.c b/drivers/tty/serial/8250/8250_pnp.c
-index b3455a9..35d9ab9 100644
---- a/drivers/tty/serial/8250/8250_pnp.c
-+++ b/drivers/tty/serial/8250/8250_pnp.c
-@@ -429,7 +429,6 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
- {
- 	struct uart_8250_port uart;
- 	int ret, line, flags = dev_id->driver_data;
--	struct resource *res = NULL;
- 
- 	if (flags & UNKNOWN_DEV) {
- 		ret = serial_pnp_guess_board(dev);
-@@ -440,12 +439,11 @@ serial_pnp_probe(struct pnp_dev *dev, const struct pnp_device_id *dev_id)
- 	memset(&uart, 0, sizeof(uart));
- 	if (pnp_irq_valid(dev, 0))
- 		uart.port.irq = pnp_irq(dev, 0);
--	if ((flags & CIR_PORT) && pnp_port_valid(dev, 2))
--		res = pnp_get_resource(dev, IORESOURCE_IO, 2);
--	else if (pnp_port_valid(dev, 0))
--		res = pnp_get_resource(dev, IORESOURCE_IO, 0);
--	if (pnp_resource_enabled(res)) {
--		uart.port.iobase = res->start;
-+	if ((flags & CIR_PORT) && pnp_port_valid(dev, 2)) {
-+		uart.port.iobase = pnp_port_start(dev, 2);
-+		uart.port.iotype = UPIO_PORT;
-+	} else if (pnp_port_valid(dev, 0)) {
-+		uart.port.iobase = pnp_port_start(dev, 0);
- 		uart.port.iotype = UPIO_PORT;
- 	} else if (pnp_mem_valid(dev, 0)) {
- 		uart.port.mapbase = pnp_mem_start(dev, 0);
-diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
-index b28e66c..4a62e12 100644
---- a/drivers/vfio/pci/vfio_pci.c
-+++ b/drivers/vfio/pci/vfio_pci.c
-@@ -331,6 +331,7 @@ static long vfio_pci_ioctl(void *device_data,
- 
- 		if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
- 			size_t size;
-+			int max = vfio_pci_get_irq_count(vdev, hdr.index);
- 
- 			if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
- 				size = sizeof(uint8_t);
-@@ -340,7 +341,7 @@ static long vfio_pci_ioctl(void *device_data,
- 				return -EINVAL;
- 
- 			if (hdr.argsz - minsz < hdr.count * size ||
--			    hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
-+			    hdr.start >= max || hdr.start + hdr.count > max)
- 				return -EINVAL;
- 
- 			data = memdup_user((void __user *)(arg + minsz),
-diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
-index 2e9779b..c53189d 100644
---- a/fs/nfs/nfs4client.c
-+++ b/fs/nfs/nfs4client.c
-@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
- 			   struct rpc_cred *cred)
- {
- 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
--	struct nfs_client *pos, *n, *prev = NULL;
-+	struct nfs_client *pos, *prev = NULL;
- 	struct nfs4_setclientid_res clid = {
- 		.clientid	= new->cl_clientid,
- 		.confirm	= new->cl_confirm,
-@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
- 	int status = -NFS4ERR_STALE_CLIENTID;
- 
- 	spin_lock(&nn->nfs_client_lock);
--	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
-+	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
- 		/* If "pos" isn't marked ready, we can't trust the
- 		 * remaining fields in "pos" */
--		if (pos->cl_cons_state < NFS_CS_READY)
-+		if (pos->cl_cons_state > NFS_CS_READY) {
-+			atomic_inc(&pos->cl_count);
-+			spin_unlock(&nn->nfs_client_lock);
-+
-+			if (prev)
-+				nfs_put_client(prev);
-+			prev = pos;
-+
-+			status = nfs_wait_client_init_complete(pos);
-+			spin_lock(&nn->nfs_client_lock);
-+			if (status < 0)
-+				continue;
-+		}
-+		if (pos->cl_cons_state != NFS_CS_READY)
- 			continue;
- 
- 		if (pos->rpc_ops != new->rpc_ops)
-@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 			   struct rpc_cred *cred)
- {
- 	struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
--	struct nfs_client *pos, *n, *prev = NULL;
-+	struct nfs_client *pos, *prev = NULL;
- 	int status = -NFS4ERR_STALE_CLIENTID;
- 
- 	spin_lock(&nn->nfs_client_lock);
--	list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
-+	list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
- 		/* If "pos" isn't marked ready, we can't trust the
- 		 * remaining fields in "pos", especially the client
- 		 * ID and serverowner fields.  Wait for CREATE_SESSION
- 		 * to finish. */
--		if (pos->cl_cons_state < NFS_CS_READY) {
-+		if (pos->cl_cons_state > NFS_CS_READY) {
- 			atomic_inc(&pos->cl_count);
- 			spin_unlock(&nn->nfs_client_lock);
- 
-@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 				nfs_put_client(prev);
- 			prev = pos;
- 
--			nfs4_schedule_lease_recovery(pos);
- 			status = nfs_wait_client_init_complete(pos);
--			if (status < 0) {
--				nfs_put_client(pos);
--				spin_lock(&nn->nfs_client_lock);
--				continue;
-+			if (status == 0) {
-+				nfs4_schedule_lease_recovery(pos);
-+				status = nfs4_wait_clnt_recover(pos);
- 			}
--			status = pos->cl_cons_state;
- 			spin_lock(&nn->nfs_client_lock);
- 			if (status < 0)
- 				continue;
- 		}
-+		if (pos->cl_cons_state != NFS_CS_READY)
-+			continue;
- 
- 		if (pos->rpc_ops != new->rpc_ops)
- 			continue;
-@@ -469,17 +481,18 @@ int nfs41_walk_client_list(struct nfs_client *new,
- 			continue;
- 
- 		atomic_inc(&pos->cl_count);
--		spin_unlock(&nn->nfs_client_lock);
-+		*result = pos;
-+		status = 0;
- 		dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
- 			__func__, pos, atomic_read(&pos->cl_count));
--
--		*result = pos;
--		return 0;
-+		break;
- 	}
- 
- 	/* No matching nfs_client found. */
- 	spin_unlock(&nn->nfs_client_lock);
- 	dprintk("NFS: <-- %s status = %d\n", __func__, status);
-+	if (prev)
-+		nfs_put_client(prev);
- 	return status;
- }
- #endif	/* CONFIG_NFS_V4_1 */
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index e61f68d..994fbe2 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1877,7 +1877,13 @@ again:
- 			status = PTR_ERR(clnt);
- 			break;
- 		}
--		clp->cl_rpcclient = clnt;
-+		/* Note: this is safe because we haven't yet marked the
-+		 * client as ready, so we are the only user of
-+		 * clp->cl_rpcclient
-+		 */
-+		clnt = xchg(&clp->cl_rpcclient, clnt);
-+		rpc_shutdown_client(clnt);
-+		clnt = clp->cl_rpcclient;
- 		goto again;
- 
- 	case -NFS4ERR_MINOR_VERS_MISMATCH:
-diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index c196369..4cce1d9 100644
---- a/fs/reiserfs/xattr.c
-+++ b/fs/reiserfs/xattr.c
-@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
- 	if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
- 		return -ENOSPC;
- 
--	if (name[0] == '.' && (name[1] == '\0' ||
--			       (name[1] == '.' && name[2] == '\0')))
-+	if (name[0] == '.' && (namelen < 2 ||
-+			       (namelen == 2 && name[1] == '.')))
- 		return 0;
- 
- 	dentry = lookup_one_len(name, dbuf->xadir, namelen);
-diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
-index ddc0f6a..97f6875 100644
---- a/fs/ubifs/super.c
-+++ b/fs/ubifs/super.c
-@@ -1568,6 +1568,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
- 	c->remounting_rw = 1;
- 	c->ro_mount = 0;
- 
-+	if (c->space_fixup) {
-+		err = ubifs_fixup_free_space(c);
-+		if (err)
-+			return err;
-+	}
-+
- 	err = check_free_space(c);
- 	if (err)
- 		goto out;
-@@ -1684,12 +1690,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
- 		err = dbg_check_space_info(c);
- 	}
- 
--	if (c->space_fixup) {
--		err = ubifs_fixup_free_space(c);
--		if (err)
--			goto out;
--	}
--
- 	mutex_unlock(&c->umount_mutex);
- 	return err;
- 
-diff --git a/include/linux/ata.h b/include/linux/ata.h
-index 8f7a3d6..ee0bd95 100644
---- a/include/linux/ata.h
-+++ b/include/linux/ata.h
-@@ -954,7 +954,7 @@ static inline int atapi_cdb_len(const u16 *dev_id)
- 	}
- }
- 
--static inline bool atapi_command_packet_set(const u16 *dev_id)
-+static inline int atapi_command_packet_set(const u16 *dev_id)
- {
- 	return (dev_id[ATA_ID_CONFIG] >> 8) & 0x1f;
- }
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 649e5f8..0621bca 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -398,6 +398,7 @@ enum {
- 	ATA_HORKAGE_NOSETXFER	= (1 << 14),	/* skip SETXFER, SATA only */
- 	ATA_HORKAGE_BROKEN_FPDMA_AA	= (1 << 15),	/* skip AA */
- 	ATA_HORKAGE_DUMP_ID	= (1 << 16),	/* dump IDENTIFY data */
-+	ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),	/* Set max sects to 65535 */
- 
- 	 /* DMA mask for user DMA control: User visible values; DO NOT
- 	    renumber */
-diff --git a/include/linux/preempt.h b/include/linux/preempt.h
-index 5a710b9..87a03c7 100644
---- a/include/linux/preempt.h
-+++ b/include/linux/preempt.h
-@@ -93,14 +93,20 @@ do { \
- 
- #else /* !CONFIG_PREEMPT_COUNT */
- 
--#define preempt_disable()		do { } while (0)
--#define sched_preempt_enable_no_resched()	do { } while (0)
--#define preempt_enable_no_resched()	do { } while (0)
--#define preempt_enable()		do { } while (0)
--
--#define preempt_disable_notrace()		do { } while (0)
--#define preempt_enable_no_resched_notrace()	do { } while (0)
--#define preempt_enable_notrace()		do { } while (0)
-+/*
-+ * Even if we don't have any preemption, we need preempt disable/enable
-+ * to be barriers, so that we don't have things like get_user/put_user
-+ * that can cause faults and scheduling migrate into our preempt-protected
-+ * region.
-+ */
-+#define preempt_disable()		barrier()
-+#define sched_preempt_enable_no_resched()	barrier()
-+#define preempt_enable_no_resched()	barrier()
-+#define preempt_enable()		barrier()
-+
-+#define preempt_disable_notrace()		barrier()
-+#define preempt_enable_no_resched_notrace()	barrier()
-+#define preempt_enable_notrace()		barrier()
- 
- #endif /* CONFIG_PREEMPT_COUNT */
- 
-diff --git a/include/linux/spinlock_up.h b/include/linux/spinlock_up.h
-index a26e2fb..e2369c1 100644
---- a/include/linux/spinlock_up.h
-+++ b/include/linux/spinlock_up.h
-@@ -16,7 +16,10 @@
-  * In the debug case, 1 means unlocked, 0 means locked. (the values
-  * are inverted, to catch initialization bugs)
-  *
-- * No atomicity anywhere, we are on UP.
-+ * No atomicity anywhere, we are on UP. However, we still need
-+ * the compiler barriers, because we do not want the compiler to
-+ * move potentially faulting instructions (notably user accesses)
-+ * into the locked sequence, resulting in non-atomic execution.
-  */
- 
- #ifdef CONFIG_DEBUG_SPINLOCK
-@@ -25,6 +28,7 @@
- static inline void arch_spin_lock(arch_spinlock_t *lock)
- {
- 	lock->slock = 0;
-+	barrier();
- }
- 
- static inline void
-@@ -32,6 +36,7 @@ arch_spin_lock_flags(arch_spinlock_t *lock, unsigned long flags)
- {
- 	local_irq_save(flags);
- 	lock->slock = 0;
-+	barrier();
- }
- 
- static inline int arch_spin_trylock(arch_spinlock_t *lock)
-@@ -39,32 +44,34 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock)
- 	char oldval = lock->slock;
- 
- 	lock->slock = 0;
-+	barrier();
- 
- 	return oldval > 0;
- }
- 
- static inline void arch_spin_unlock(arch_spinlock_t *lock)
- {
-+	barrier();
- 	lock->slock = 1;
- }
- 
- /*
-  * Read-write spinlocks. No debug version.
-  */
--#define arch_read_lock(lock)		do { (void)(lock); } while (0)
--#define arch_write_lock(lock)		do { (void)(lock); } while (0)
--#define arch_read_trylock(lock)	({ (void)(lock); 1; })
--#define arch_write_trylock(lock)	({ (void)(lock); 1; })
--#define arch_read_unlock(lock)		do { (void)(lock); } while (0)
--#define arch_write_unlock(lock)	do { (void)(lock); } while (0)
-+#define arch_read_lock(lock)		do { barrier(); (void)(lock); } while (0)
-+#define arch_write_lock(lock)		do { barrier(); (void)(lock); } while (0)
-+#define arch_read_trylock(lock)	({ barrier(); (void)(lock); 1; })
-+#define arch_write_trylock(lock)	({ barrier(); (void)(lock); 1; })
-+#define arch_read_unlock(lock)		do { barrier(); (void)(lock); } while (0)
-+#define arch_write_unlock(lock)	do { barrier(); (void)(lock); } while (0)
- 
- #else /* DEBUG_SPINLOCK */
- #define arch_spin_is_locked(lock)	((void)(lock), 0)
- /* for sched.c and kernel_lock.c: */
--# define arch_spin_lock(lock)		do { (void)(lock); } while (0)
--# define arch_spin_lock_flags(lock, flags)	do { (void)(lock); } while (0)
--# define arch_spin_unlock(lock)	do { (void)(lock); } while (0)
--# define arch_spin_trylock(lock)	({ (void)(lock); 1; })
-+# define arch_spin_lock(lock)		do { barrier(); (void)(lock); } while (0)
-+# define arch_spin_lock_flags(lock, flags)	do { barrier(); (void)(lock); } while (0)
-+# define arch_spin_unlock(lock)	do { barrier(); (void)(lock); } while (0)
-+# define arch_spin_trylock(lock)	({ barrier(); (void)(lock); 1; })
- #endif /* DEBUG_SPINLOCK */
- 
- #define arch_spin_is_contended(lock)	(((void)(lock), 0))
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index b27052c..64bc5d8 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -4537,12 +4537,8 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
- 		ftrace_startup_sysctl();
- 
- 		/* we are starting ftrace again */
--		if (ftrace_ops_list != &ftrace_list_end) {
--			if (ftrace_ops_list->next == &ftrace_list_end)
--				ftrace_trace_function = ftrace_ops_list->func;
--			else
--				ftrace_trace_function = ftrace_ops_list_func;
--		}
-+		if (ftrace_ops_list != &ftrace_list_end)
-+			update_ftrace_function();
- 
- 	} else {
- 		/* stopping ftrace calls (just send to ftrace_stub) */
-diff --git a/mm/mmap.c b/mm/mmap.c
-index 8832b87..90db251 100644
---- a/mm/mmap.c
-+++ b/mm/mmap.c
-@@ -1922,7 +1922,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- 
- 	/* Check the cache first. */
- 	/* (Cache hit rate is typically around 35%.) */
--	vma = mm->mmap_cache;
-+	vma = ACCESS_ONCE(mm->mmap_cache);
- 	if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
- 		struct rb_node *rb_node;
- 
-diff --git a/mm/nommu.c b/mm/nommu.c
-index 79c3cac..bbe1f3f 100644
---- a/mm/nommu.c
-+++ b/mm/nommu.c
-@@ -819,7 +819,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- 	struct vm_area_struct *vma;
- 
- 	/* check the cache first */
--	vma = mm->mmap_cache;
-+	vma = ACCESS_ONCE(mm->mmap_cache);
- 	if (vma && vma->vm_start <= addr && vma->vm_end > addr)
- 		return vma;
- 
-diff --git a/net/can/gw.c b/net/can/gw.c
-index 574dda78e..28e7bdc 100644
---- a/net/can/gw.c
-+++ b/net/can/gw.c
-@@ -436,7 +436,7 @@ static int cgw_notifier(struct notifier_block *nb,
- 			if (gwj->src.dev == dev || gwj->dst.dev == dev) {
- 				hlist_del(&gwj->list);
- 				cgw_unregister_filter(gwj);
--				kfree(gwj);
-+				kmem_cache_free(cgw_cache, gwj);
- 			}
- 		}
- 	}
-@@ -829,7 +829,7 @@ static void cgw_remove_all_jobs(void)
- 	hlist_for_each_entry_safe(gwj, n, nx, &cgw_list, list) {
- 		hlist_del(&gwj->list);
- 		cgw_unregister_filter(gwj);
--		kfree(gwj);
-+		kmem_cache_free(cgw_cache, gwj);
- 	}
- }
- 
-@@ -885,7 +885,7 @@ static int cgw_remove_job(struct sk_buff *skb,  struct nlmsghdr *nlh, void *arg)
- 
- 		hlist_del(&gwj->list);
- 		cgw_unregister_filter(gwj);
--		kfree(gwj);
-+		kmem_cache_free(cgw_cache, gwj);
- 		err = 0;
- 		break;
- 	}
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index 0479c64..49c48c6 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -2499,7 +2499,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- 			list_del(&dep->list);
- 			mutex_unlock(&local->mtx);
- 
--			ieee80211_roc_notify_destroy(dep);
-+			ieee80211_roc_notify_destroy(dep, true);
- 			return 0;
- 		}
- 
-@@ -2539,7 +2539,7 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- 			ieee80211_start_next_roc(local);
- 		mutex_unlock(&local->mtx);
- 
--		ieee80211_roc_notify_destroy(found);
-+		ieee80211_roc_notify_destroy(found, true);
- 	} else {
- 		/* work may be pending so use it all the time */
- 		found->abort = true;
-@@ -2549,6 +2549,8 @@ static int ieee80211_cancel_roc(struct ieee80211_local *local,
- 
- 		/* work will clean up etc */
- 		flush_delayed_work(&found->work);
-+		WARN_ON(!found->to_be_freed);
-+		kfree(found);
- 	}
- 
- 	return 0;
-diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index 2ed065c..55d8f89 100644
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -346,6 +346,7 @@ struct ieee80211_roc_work {
- 	struct ieee80211_channel *chan;
- 
- 	bool started, abort, hw_begun, notified;
-+	bool to_be_freed;
- 
- 	unsigned long hw_start_time;
- 
-@@ -1363,7 +1364,7 @@ void ieee80211_offchannel_return(struct ieee80211_local *local);
- void ieee80211_roc_setup(struct ieee80211_local *local);
- void ieee80211_start_next_roc(struct ieee80211_local *local);
- void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
--void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc);
-+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free);
- void ieee80211_sw_roc_work(struct work_struct *work);
- void ieee80211_handle_roc_started(struct ieee80211_roc_work *roc);
- 
-diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
-index a3ad4c3..7acbdaa 100644
---- a/net/mac80211/offchannel.c
-+++ b/net/mac80211/offchannel.c
-@@ -299,10 +299,13 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
- 	}
- }
- 
--void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
-+void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc, bool free)
- {
- 	struct ieee80211_roc_work *dep, *tmp;
- 
-+	if (WARN_ON(roc->to_be_freed))
-+		return;
-+
- 	/* was never transmitted */
- 	if (roc->frame) {
- 		cfg80211_mgmt_tx_status(&roc->sdata->wdev,
-@@ -318,9 +321,12 @@ void ieee80211_roc_notify_destroy(struct ieee80211_roc_work *roc)
- 						   GFP_KERNEL);
- 
- 	list_for_each_entry_safe(dep, tmp, &roc->dependents, list)
--		ieee80211_roc_notify_destroy(dep);
-+		ieee80211_roc_notify_destroy(dep, true);
- 
--	kfree(roc);
-+	if (free)
-+		kfree(roc);
-+	else
-+		roc->to_be_freed = true;
- }
- 
- void ieee80211_sw_roc_work(struct work_struct *work)
-@@ -333,6 +339,9 @@ void ieee80211_sw_roc_work(struct work_struct *work)
- 
- 	mutex_lock(&local->mtx);
- 
-+	if (roc->to_be_freed)
-+		goto out_unlock;
-+
- 	if (roc->abort)
- 		goto finish;
- 
-@@ -372,7 +381,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
-  finish:
- 		list_del(&roc->list);
- 		started = roc->started;
--		ieee80211_roc_notify_destroy(roc);
-+		ieee80211_roc_notify_destroy(roc, !roc->abort);
- 
- 		if (started) {
- 			drv_flush(local, false);
-@@ -412,7 +421,7 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
- 
- 	list_del(&roc->list);
- 
--	ieee80211_roc_notify_destroy(roc);
-+	ieee80211_roc_notify_destroy(roc, true);
- 
- 	/* if there's another roc, start it now */
- 	ieee80211_start_next_roc(local);
-@@ -462,12 +471,14 @@ void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata)
- 	list_for_each_entry_safe(roc, tmp, &tmp_list, list) {
- 		if (local->ops->remain_on_channel) {
- 			list_del(&roc->list);
--			ieee80211_roc_notify_destroy(roc);
-+			ieee80211_roc_notify_destroy(roc, true);
- 		} else {
- 			ieee80211_queue_delayed_work(&local->hw, &roc->work, 0);
- 
- 			/* work will clean up etc */
- 			flush_delayed_work(&roc->work);
-+			WARN_ON(!roc->to_be_freed);
-+			kfree(roc);
- 		}
- 	}
- 
-diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index 507b5e8..716aa41 100644
---- a/net/sunrpc/clnt.c
-+++ b/net/sunrpc/clnt.c
-@@ -511,7 +511,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
- 	new = rpc_new_client(args, xprt);
- 	if (IS_ERR(new)) {
- 		err = PTR_ERR(new);
--		goto out_put;
-+		goto out_err;
- 	}
- 
- 	atomic_inc(&clnt->cl_count);
-@@ -524,8 +524,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
- 	new->cl_chatty = clnt->cl_chatty;
- 	return new;
- 
--out_put:
--	xprt_put(xprt);
- out_err:
- 	dprintk("RPC:       %s: returned error %d\n", __func__, err);
- 	return ERR_PTR(err);
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index e46b6a3..622f726 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -173,7 +173,7 @@ const char *snd_hda_get_jack_type(u32 cfg)
- 		"Line Out", "Speaker", "HP Out", "CD",
- 		"SPDIF Out", "Digital Out", "Modem Line", "Modem Hand",
- 		"Line In", "Aux", "Mic", "Telephony",
--		"SPDIF In", "Digitial In", "Reserved", "Other"
-+		"SPDIF In", "Digital In", "Reserved", "Other"
- 	};
- 
- 	return jack_types[(cfg & AC_DEFCFG_DEVICE)
-diff --git a/sound/pci/hda/hda_eld.c b/sound/pci/hda/hda_eld.c
-index 4c054f4..86f6468 100644
---- a/sound/pci/hda/hda_eld.c
-+++ b/sound/pci/hda/hda_eld.c
-@@ -322,7 +322,7 @@ int snd_hdmi_get_eld(struct hdmi_eld *eld,
- 		     struct hda_codec *codec, hda_nid_t nid)
- {
- 	int i;
--	int ret;
-+	int ret = 0;
- 	int size;
- 	unsigned char *buf;
- 
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 47fb18d..ee975a2 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -6720,7 +6720,8 @@ static int alc662_parse_auto_config(struct hda_codec *codec)
- 	const hda_nid_t *ssids;
- 
- 	if (codec->vendor_id == 0x10ec0272 || codec->vendor_id == 0x10ec0663 ||
--	    codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670)
-+	    codec->vendor_id == 0x10ec0665 || codec->vendor_id == 0x10ec0670 ||
-+	    codec->vendor_id == 0x10ec0671)
- 		ssids = alc663_ssids;
- 	else
- 		ssids = alc662_ssids;
-@@ -7173,6 +7174,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
- 	{ .id = 0x10ec0665, .name = "ALC665", .patch = patch_alc662 },
- 	{ .id = 0x10ec0668, .name = "ALC668", .patch = patch_alc662 },
- 	{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
-+	{ .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
- 	{ .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
- 	{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
- 	{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
-diff --git a/sound/soc/fsl/imx-ssi.c b/sound/soc/fsl/imx-ssi.c
-index 3b48042..63e453f 100644
---- a/sound/soc/fsl/imx-ssi.c
-+++ b/sound/soc/fsl/imx-ssi.c
-@@ -496,6 +496,8 @@ static void imx_ssi_ac97_reset(struct snd_ac97 *ac97)
- 
- 	if (imx_ssi->ac97_reset)
- 		imx_ssi->ac97_reset(ac97);
-+	/* First read sometimes fails, do a dummy read */
-+	imx_ssi_ac97_read(ac97, 0);
- }
- 
- static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
-@@ -504,6 +506,9 @@ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
- 
- 	if (imx_ssi->ac97_warm_reset)
- 		imx_ssi->ac97_warm_reset(ac97);
-+
-+	/* First read sometimes fails, do a dummy read */
-+	imx_ssi_ac97_read(ac97, 0);
- }
- 
- struct snd_ac97_bus_ops soc_ac97_ops = {
-diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
-index 19eff8f..1a8b03e 100644
---- a/sound/soc/sh/dma-sh7760.c
-+++ b/sound/soc/sh/dma-sh7760.c
-@@ -342,8 +342,8 @@ static int camelot_pcm_new(struct snd_soc_pcm_runtime *rtd)
- 	return 0;
- }
- 
--static struct snd_soc_platform sh7760_soc_platform = {
--	.pcm_ops 	= &camelot_pcm_ops,
-+static struct snd_soc_platform_driver sh7760_soc_platform = {
-+	.ops		= &camelot_pcm_ops,
- 	.pcm_new	= camelot_pcm_new,
- 	.pcm_free	= camelot_pcm_free,
- };
-diff --git a/sound/soc/spear/spear_pcm.c b/sound/soc/spear/spear_pcm.c
-index 9b76cc5..5e7aebe 100644
---- a/sound/soc/spear/spear_pcm.c
-+++ b/sound/soc/spear/spear_pcm.c
-@@ -149,9 +149,9 @@ static void spear_pcm_free(struct snd_pcm *pcm)
- 
- static u64 spear_pcm_dmamask = DMA_BIT_MASK(32);
- 
--static int spear_pcm_new(struct snd_card *card,
--		struct snd_soc_dai *dai, struct snd_pcm *pcm)
-+static int spear_pcm_new(struct snd_soc_pcm_runtime *rtd)
- {
-+	struct snd_card *card = rtd->card->snd_card;
- 	int ret;
- 
- 	if (!card->dev->dma_mask)
-@@ -159,16 +159,16 @@ static int spear_pcm_new(struct snd_card *card,
- 	if (!card->dev->coherent_dma_mask)
- 		card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
- 
--	if (dai->driver->playback.channels_min) {
--		ret = spear_pcm_preallocate_dma_buffer(pcm,
-+	if (rtd->cpu_dai->driver->playback.channels_min) {
-+		ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
- 				SNDRV_PCM_STREAM_PLAYBACK,
- 				spear_pcm_hardware.buffer_bytes_max);
- 		if (ret)
- 			return ret;
- 	}
- 
--	if (dai->driver->capture.channels_min) {
--		ret = spear_pcm_preallocate_dma_buffer(pcm,
-+	if (rtd->cpu_dai->driver->capture.channels_min) {
-+		ret = spear_pcm_preallocate_dma_buffer(rtd->pcm,
- 				SNDRV_PCM_STREAM_CAPTURE,
- 				spear_pcm_hardware.buffer_bytes_max);
- 		if (ret)
diff --git a/3.8.8/1007_linux-3.8.8.patch b/3.8.8/1007_linux-3.8.8.patch
deleted file mode 100644
index 8db28d7..0000000
--- a/3.8.8/1007_linux-3.8.8.patch
+++ /dev/null
@@ -1,1471 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 85204da..7684f95 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 8
--SUBLEVEL = 7
-+SUBLEVEL = 8
- EXTRAVERSION =
- NAME = Displaced Humerus Anterior
- 
-diff --git a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
-index 93c3afb..3694e94 100644
---- a/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
-+++ b/arch/arm/boot/dts/kirkwood-iomega_ix2_200.dts
-@@ -96,11 +96,11 @@
- 				marvell,function = "gpio";
- 			};
- 			pmx_led_rebuild_brt_ctrl_1: pmx-led-rebuild-brt-ctrl-1 {
--				marvell,pins = "mpp44";
-+				marvell,pins = "mpp46";
- 				marvell,function = "gpio";
- 			};
- 			pmx_led_rebuild_brt_ctrl_2: pmx-led-rebuild-brt-ctrl-2 {
--				marvell,pins = "mpp45";
-+				marvell,pins = "mpp47";
- 				marvell,function = "gpio";
- 			};
- 
-@@ -157,14 +157,14 @@
- 			gpios = <&gpio0 16 0>;
- 			linux,default-trigger = "default-on";
- 		};
--		health_led1 {
-+		rebuild_led {
-+			label = "status:white:rebuild_led";
-+			gpios = <&gpio1 4 0>;
-+		};
-+		health_led {
- 			label = "status:red:health_led";
- 			gpios = <&gpio1 5 0>;
- 		};
--		health_led2 {
--			label = "status:white:health_led";
--			gpios = <&gpio1 4 0>;
--		};
- 		backup_led {
- 			label = "status:blue:backup_led";
- 			gpios = <&gpio0 15 0>;
-diff --git a/arch/arm/mach-imx/clk-imx35.c b/arch/arm/mach-imx/clk-imx35.c
-index f0727e8..0edce4b 100644
---- a/arch/arm/mach-imx/clk-imx35.c
-+++ b/arch/arm/mach-imx/clk-imx35.c
-@@ -257,6 +257,7 @@ int __init mx35_clocks_init()
- 	clk_register_clkdev(clk[wdog_gate], NULL, "imx2-wdt.0");
- 	clk_register_clkdev(clk[nfc_div], NULL, "imx25-nand.0");
- 	clk_register_clkdev(clk[csi_gate], NULL, "mx3-camera.0");
-+	clk_register_clkdev(clk[admux_gate], "audmux", NULL);
- 
- 	clk_prepare_enable(clk[spba_gate]);
- 	clk_prepare_enable(clk[gpio1_gate]);
-diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
-index 5edd174..7361e47 100644
---- a/arch/x86/include/asm/paravirt.h
-+++ b/arch/x86/include/asm/paravirt.h
-@@ -703,7 +703,10 @@ static inline void arch_leave_lazy_mmu_mode(void)
- 	PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
- }
- 
--void arch_flush_lazy_mmu_mode(void);
-+static inline void arch_flush_lazy_mmu_mode(void)
-+{
-+	PVOP_VCALL0(pv_mmu_ops.lazy_mode.flush);
-+}
- 
- static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
- 				phys_addr_t phys, pgprot_t flags)
-diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h
-index 142236e..b3b0ec1 100644
---- a/arch/x86/include/asm/paravirt_types.h
-+++ b/arch/x86/include/asm/paravirt_types.h
-@@ -91,6 +91,7 @@ struct pv_lazy_ops {
- 	/* Set deferred update mode, used for batching operations. */
- 	void (*enter)(void);
- 	void (*leave)(void);
-+	void (*flush)(void);
- };
- 
- struct pv_time_ops {
-@@ -679,6 +680,7 @@ void paravirt_end_context_switch(struct task_struct *next);
- 
- void paravirt_enter_lazy_mmu(void);
- void paravirt_leave_lazy_mmu(void);
-+void paravirt_flush_lazy_mmu(void);
- 
- void _paravirt_nop(void);
- u32 _paravirt_ident_32(u32);
-diff --git a/arch/x86/include/asm/tlb.h b/arch/x86/include/asm/tlb.h
-index 4fef207..c779730 100644
---- a/arch/x86/include/asm/tlb.h
-+++ b/arch/x86/include/asm/tlb.h
-@@ -7,7 +7,7 @@
- 
- #define tlb_flush(tlb)							\
- {									\
--	if (tlb->fullmm == 0)						\
-+	if (!tlb->fullmm && !tlb->need_flush_all) 			\
- 		flush_tlb_mm_range(tlb->mm, tlb->start, tlb->end, 0UL);	\
- 	else								\
- 		flush_tlb_mm_range(tlb->mm, 0UL, TLB_FLUSH_ALL, 0UL);	\
-diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
-index 17fff18..8bfb335 100644
---- a/arch/x86/kernel/paravirt.c
-+++ b/arch/x86/kernel/paravirt.c
-@@ -263,6 +263,18 @@ void paravirt_leave_lazy_mmu(void)
- 	leave_lazy(PARAVIRT_LAZY_MMU);
- }
- 
-+void paravirt_flush_lazy_mmu(void)
-+{
-+	preempt_disable();
-+
-+	if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
-+		arch_leave_lazy_mmu_mode();
-+		arch_enter_lazy_mmu_mode();
-+	}
-+
-+	preempt_enable();
-+}
-+
- void paravirt_start_context_switch(struct task_struct *prev)
- {
- 	BUG_ON(preemptible());
-@@ -292,18 +304,6 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
- 	return this_cpu_read(paravirt_lazy_mode);
- }
- 
--void arch_flush_lazy_mmu_mode(void)
--{
--	preempt_disable();
--
--	if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
--		arch_leave_lazy_mmu_mode();
--		arch_enter_lazy_mmu_mode();
--	}
--
--	preempt_enable();
--}
--
- struct pv_info pv_info = {
- 	.name = "bare hardware",
- 	.paravirt_enabled = 0,
-@@ -475,6 +475,7 @@ struct pv_mmu_ops pv_mmu_ops = {
- 	.lazy_mode = {
- 		.enter = paravirt_nop,
- 		.leave = paravirt_nop,
-+		.flush = paravirt_nop,
- 	},
- 
- 	.set_fixmap = native_set_fixmap,
-diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
-index df4176c..20a4fd4 100644
---- a/arch/x86/lguest/boot.c
-+++ b/arch/x86/lguest/boot.c
-@@ -1333,6 +1333,7 @@ __init void lguest_init(void)
- 	pv_mmu_ops.read_cr3 = lguest_read_cr3;
- 	pv_mmu_ops.lazy_mode.enter = paravirt_enter_lazy_mmu;
- 	pv_mmu_ops.lazy_mode.leave = lguest_leave_lazy_mmu_mode;
-+	pv_mmu_ops.lazy_mode.flush = paravirt_flush_lazy_mmu;
- 	pv_mmu_ops.pte_update = lguest_pte_update;
- 	pv_mmu_ops.pte_update_defer = lguest_pte_update;
- 
-diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
-index fb674fd..4f7d793 100644
---- a/arch/x86/mm/fault.c
-+++ b/arch/x86/mm/fault.c
-@@ -378,10 +378,12 @@ static noinline __kprobes int vmalloc_fault(unsigned long address)
- 	if (pgd_none(*pgd_ref))
- 		return -1;
- 
--	if (pgd_none(*pgd))
-+	if (pgd_none(*pgd)) {
- 		set_pgd(pgd, *pgd_ref);
--	else
-+		arch_flush_lazy_mmu_mode();
-+	} else {
- 		BUG_ON(pgd_page_vaddr(*pgd) != pgd_page_vaddr(*pgd_ref));
-+	}
- 
- 	/*
- 	 * Below here mismatches are bugs because these lower tables
-diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index e27fbf8..395b3b4 100644
---- a/arch/x86/mm/pgtable.c
-+++ b/arch/x86/mm/pgtable.c
-@@ -58,6 +58,13 @@ void ___pte_free_tlb(struct mmu_gather *tlb, struct page *pte)
- void ___pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmd)
- {
- 	paravirt_release_pmd(__pa(pmd) >> PAGE_SHIFT);
-+	/*
-+	 * NOTE! For PAE, any changes to the top page-directory-pointer-table
-+	 * entries need a full cr3 reload to flush.
-+	 */
-+#ifdef CONFIG_X86_PAE
-+	tlb->need_flush_all = 1;
-+#endif
- 	tlb_remove_page(tlb, virt_to_page(pmd));
- }
- 
-diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
-index 01de35c..cab96b6 100644
---- a/arch/x86/xen/mmu.c
-+++ b/arch/x86/xen/mmu.c
-@@ -2190,6 +2190,7 @@ static const struct pv_mmu_ops xen_mmu_ops __initconst = {
- 	.lazy_mode = {
- 		.enter = paravirt_enter_lazy_mmu,
- 		.leave = xen_leave_lazy_mmu,
-+		.flush = paravirt_flush_lazy_mmu,
- 	},
- 
- 	.set_fixmap = xen_set_fixmap,
-diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
-index 5a31264..8607724 100644
---- a/drivers/dma/omap-dma.c
-+++ b/drivers/dma/omap-dma.c
-@@ -276,12 +276,20 @@ static void omap_dma_issue_pending(struct dma_chan *chan)
- 
- 	spin_lock_irqsave(&c->vc.lock, flags);
- 	if (vchan_issue_pending(&c->vc) && !c->desc) {
--		struct omap_dmadev *d = to_omap_dma_dev(chan->device);
--		spin_lock(&d->lock);
--		if (list_empty(&c->node))
--			list_add_tail(&c->node, &d->pending);
--		spin_unlock(&d->lock);
--		tasklet_schedule(&d->task);
-+		/*
-+		 * c->cyclic is used only by audio and in this case the DMA need
-+		 * to be started without delay.
-+		 */
-+		if (!c->cyclic) {
-+			struct omap_dmadev *d = to_omap_dma_dev(chan->device);
-+			spin_lock(&d->lock);
-+			if (list_empty(&c->node))
-+				list_add_tail(&c->node, &d->pending);
-+			spin_unlock(&d->lock);
-+			tasklet_schedule(&d->task);
-+		} else {
-+			omap_dma_start_desc(c);
-+		}
- 	}
- 	spin_unlock_irqrestore(&c->vc.lock, flags);
- }
-diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
-index d542a14..ea537fa 100644
---- a/drivers/gpio/gpiolib-of.c
-+++ b/drivers/gpio/gpiolib-of.c
-@@ -228,7 +228,7 @@ static void of_gpiochip_add_pin_range(struct gpio_chip *chip)
- 	if (!np)
- 		return;
- 
--	do {
-+	for (;; index++) {
- 		ret = of_parse_phandle_with_args(np, "gpio-ranges",
- 				"#gpio-range-cells", index, &pinspec);
- 		if (ret)
-@@ -257,8 +257,7 @@ static void of_gpiochip_add_pin_range(struct gpio_chip *chip)
- 
- 		if (ret)
- 			break;
--
--	} while (index++);
-+	}
- }
- 
- #else
-diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
-index fe5cdbc..b44d548 100644
---- a/drivers/gpu/drm/udl/udl_connector.c
-+++ b/drivers/gpu/drm/udl/udl_connector.c
-@@ -61,6 +61,10 @@ static int udl_get_modes(struct drm_connector *connector)
- 	int ret;
- 
- 	edid = (struct edid *)udl_get_edid(udl);
-+	if (!edid) {
-+		drm_mode_connector_update_edid_property(connector, NULL);
-+		return 0;
-+	}
- 
- 	/*
- 	 * We only read the main block, but if the monitor reports extension
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
-index 21a8242..18d3764 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_lcn.c
-@@ -1137,9 +1137,8 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
- 	gain0_15 = ((biq1 & 0xf) << 12) |
- 		   ((tia & 0xf) << 8) |
- 		   ((lna2 & 0x3) << 6) |
--		   ((lna2 & 0x3) << 4) |
--		   ((lna1 & 0x3) << 2) |
--		   ((lna1 & 0x3) << 0);
-+		   ((lna2 &
-+		     0x3) << 4) | ((lna1 & 0x3) << 2) | ((lna1 & 0x3) << 0);
- 
- 	mod_phy_reg(pi, 0x4b6, (0xffff << 0), gain0_15 << 0);
- 	mod_phy_reg(pi, 0x4b7, (0xf << 0), gain16_19 << 0);
-@@ -1157,8 +1156,6 @@ wlc_lcnphy_set_rx_gain_by_distribution(struct brcms_phy *pi,
- 	}
- 
- 	mod_phy_reg(pi, 0x44d, (0x1 << 0), (!trsw) << 0);
--	mod_phy_reg(pi, 0x4b1, (0x3 << 11), lna1 << 11);
--	mod_phy_reg(pi, 0x4e6, (0x3 << 3), lna1 << 3);
- 
- }
- 
-@@ -1331,43 +1328,6 @@ static u32 wlc_lcnphy_measure_digital_power(struct brcms_phy *pi, u16 nsamples)
- 	return (iq_est.i_pwr + iq_est.q_pwr) / nsamples;
- }
- 
--static bool wlc_lcnphy_rx_iq_cal_gain(struct brcms_phy *pi, u16 biq1_gain,
--				      u16 tia_gain, u16 lna2_gain)
--{
--	u32 i_thresh_l, q_thresh_l;
--	u32 i_thresh_h, q_thresh_h;
--	struct lcnphy_iq_est iq_est_h, iq_est_l;
--
--	wlc_lcnphy_set_rx_gain_by_distribution(pi, 0, 0, 0, biq1_gain, tia_gain,
--					       lna2_gain, 0);
--
--	wlc_lcnphy_rx_gain_override_enable(pi, true);
--	wlc_lcnphy_start_tx_tone(pi, 2000, (40 >> 1), 0);
--	udelay(500);
--	write_radio_reg(pi, RADIO_2064_REG112, 0);
--	if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_l))
--		return false;
--
--	wlc_lcnphy_start_tx_tone(pi, 2000, 40, 0);
--	udelay(500);
--	write_radio_reg(pi, RADIO_2064_REG112, 0);
--	if (!wlc_lcnphy_rx_iq_est(pi, 1024, 32, &iq_est_h))
--		return false;
--
--	i_thresh_l = (iq_est_l.i_pwr << 1);
--	i_thresh_h = (iq_est_l.i_pwr << 2) + iq_est_l.i_pwr;
--
--	q_thresh_l = (iq_est_l.q_pwr << 1);
--	q_thresh_h = (iq_est_l.q_pwr << 2) + iq_est_l.q_pwr;
--	if ((iq_est_h.i_pwr > i_thresh_l) &&
--	    (iq_est_h.i_pwr < i_thresh_h) &&
--	    (iq_est_h.q_pwr > q_thresh_l) &&
--	    (iq_est_h.q_pwr < q_thresh_h))
--		return true;
--
--	return false;
--}
--
- static bool
- wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
- 		     const struct lcnphy_rx_iqcomp *iqcomp,
-@@ -1382,8 +1342,8 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
- 	    RFOverrideVal0_old, rfoverride2_old, rfoverride2val_old,
- 	    rfoverride3_old, rfoverride3val_old, rfoverride4_old,
- 	    rfoverride4val_old, afectrlovr_old, afectrlovrval_old;
--	int tia_gain, lna2_gain, biq1_gain;
--	bool set_gain;
-+	int tia_gain;
-+	u32 received_power, rx_pwr_threshold;
- 	u16 old_sslpnCalibClkEnCtrl, old_sslpnRxFeClkEnCtrl;
- 	u16 values_to_save[11];
- 	s16 *ptr;
-@@ -1408,134 +1368,126 @@ wlc_lcnphy_rx_iq_cal(struct brcms_phy *pi,
- 		goto cal_done;
- 	}
- 
--	WARN_ON(module != 1);
--	tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
--	wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
--
--	for (i = 0; i < 11; i++)
--		values_to_save[i] =
--			read_radio_reg(pi, rxiq_cal_rf_reg[i]);
--	Core1TxControl_old = read_phy_reg(pi, 0x631);
--
--	or_phy_reg(pi, 0x631, 0x0015);
--
--	RFOverride0_old = read_phy_reg(pi, 0x44c);
--	RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
--	rfoverride2_old = read_phy_reg(pi, 0x4b0);
--	rfoverride2val_old = read_phy_reg(pi, 0x4b1);
--	rfoverride3_old = read_phy_reg(pi, 0x4f9);
--	rfoverride3val_old = read_phy_reg(pi, 0x4fa);
--	rfoverride4_old = read_phy_reg(pi, 0x938);
--	rfoverride4val_old = read_phy_reg(pi, 0x939);
--	afectrlovr_old = read_phy_reg(pi, 0x43b);
--	afectrlovrval_old = read_phy_reg(pi, 0x43c);
--	old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
--	old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
--
--	tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
--	if (tx_gain_override_old) {
--		wlc_lcnphy_get_tx_gain(pi, &old_gains);
--		tx_gain_index_old = pi_lcn->lcnphy_current_index;
--	}
--
--	wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
-+	if (module == 1) {
- 
--	mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
--	mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
-+		tx_pwr_ctrl = wlc_lcnphy_get_tx_pwr_ctrl(pi);
-+		wlc_lcnphy_set_tx_pwr_ctrl(pi, LCNPHY_TX_PWR_CTRL_OFF);
- 
--	mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
--	mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
-+		for (i = 0; i < 11; i++)
-+			values_to_save[i] =
-+				read_radio_reg(pi, rxiq_cal_rf_reg[i]);
-+		Core1TxControl_old = read_phy_reg(pi, 0x631);
-+
-+		or_phy_reg(pi, 0x631, 0x0015);
-+
-+		RFOverride0_old = read_phy_reg(pi, 0x44c);
-+		RFOverrideVal0_old = read_phy_reg(pi, 0x44d);
-+		rfoverride2_old = read_phy_reg(pi, 0x4b0);
-+		rfoverride2val_old = read_phy_reg(pi, 0x4b1);
-+		rfoverride3_old = read_phy_reg(pi, 0x4f9);
-+		rfoverride3val_old = read_phy_reg(pi, 0x4fa);
-+		rfoverride4_old = read_phy_reg(pi, 0x938);
-+		rfoverride4val_old = read_phy_reg(pi, 0x939);
-+		afectrlovr_old = read_phy_reg(pi, 0x43b);
-+		afectrlovrval_old = read_phy_reg(pi, 0x43c);
-+		old_sslpnCalibClkEnCtrl = read_phy_reg(pi, 0x6da);
-+		old_sslpnRxFeClkEnCtrl = read_phy_reg(pi, 0x6db);
-+
-+		tx_gain_override_old = wlc_lcnphy_tx_gain_override_enabled(pi);
-+		if (tx_gain_override_old) {
-+			wlc_lcnphy_get_tx_gain(pi, &old_gains);
-+			tx_gain_index_old = pi_lcn->lcnphy_current_index;
-+		}
- 
--	write_radio_reg(pi, RADIO_2064_REG116, 0x06);
--	write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
--	write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
--	write_radio_reg(pi, RADIO_2064_REG098, 0x03);
--	write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
--	mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
--	write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
--	write_radio_reg(pi, RADIO_2064_REG114, 0x01);
--	write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
--	write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
--
--	mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
--	mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
--	mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
--	mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
--	mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
--	mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
--	mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
--	mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
--	mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
--	mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
-+		wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_idx);
- 
--	mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
--	mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-+		mod_phy_reg(pi, 0x4f9, (0x1 << 0), 1 << 0);
-+		mod_phy_reg(pi, 0x4fa, (0x1 << 0), 0 << 0);
- 
--	write_phy_reg(pi, 0x6da, 0xffff);
--	or_phy_reg(pi, 0x6db, 0x3);
-+		mod_phy_reg(pi, 0x43b, (0x1 << 1), 1 << 1);
-+		mod_phy_reg(pi, 0x43c, (0x1 << 1), 0 << 1);
- 
--	wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
--	set_gain = false;
--
--	lna2_gain = 3;
--	while ((lna2_gain >= 0) && !set_gain) {
--		tia_gain = 4;
--
--		while ((tia_gain >= 0) && !set_gain) {
--			biq1_gain = 6;
--
--			while ((biq1_gain >= 0) && !set_gain) {
--				set_gain = wlc_lcnphy_rx_iq_cal_gain(pi,
--								     (u16)
--								     biq1_gain,
--								     (u16)
--								     tia_gain,
--								     (u16)
--								     lna2_gain);
--				biq1_gain -= 1;
--			}
-+		write_radio_reg(pi, RADIO_2064_REG116, 0x06);
-+		write_radio_reg(pi, RADIO_2064_REG12C, 0x07);
-+		write_radio_reg(pi, RADIO_2064_REG06A, 0xd3);
-+		write_radio_reg(pi, RADIO_2064_REG098, 0x03);
-+		write_radio_reg(pi, RADIO_2064_REG00B, 0x7);
-+		mod_radio_reg(pi, RADIO_2064_REG113, 1 << 4, 1 << 4);
-+		write_radio_reg(pi, RADIO_2064_REG01D, 0x01);
-+		write_radio_reg(pi, RADIO_2064_REG114, 0x01);
-+		write_radio_reg(pi, RADIO_2064_REG02E, 0x10);
-+		write_radio_reg(pi, RADIO_2064_REG12A, 0x08);
-+
-+		mod_phy_reg(pi, 0x938, (0x1 << 0), 1 << 0);
-+		mod_phy_reg(pi, 0x939, (0x1 << 0), 0 << 0);
-+		mod_phy_reg(pi, 0x938, (0x1 << 1), 1 << 1);
-+		mod_phy_reg(pi, 0x939, (0x1 << 1), 1 << 1);
-+		mod_phy_reg(pi, 0x938, (0x1 << 2), 1 << 2);
-+		mod_phy_reg(pi, 0x939, (0x1 << 2), 1 << 2);
-+		mod_phy_reg(pi, 0x938, (0x1 << 3), 1 << 3);
-+		mod_phy_reg(pi, 0x939, (0x1 << 3), 1 << 3);
-+		mod_phy_reg(pi, 0x938, (0x1 << 5), 1 << 5);
-+		mod_phy_reg(pi, 0x939, (0x1 << 5), 0 << 5);
-+
-+		mod_phy_reg(pi, 0x43b, (0x1 << 0), 1 << 0);
-+		mod_phy_reg(pi, 0x43c, (0x1 << 0), 0 << 0);
-+
-+		wlc_lcnphy_start_tx_tone(pi, 2000, 120, 0);
-+		write_phy_reg(pi, 0x6da, 0xffff);
-+		or_phy_reg(pi, 0x6db, 0x3);
-+		wlc_lcnphy_set_trsw_override(pi, tx_switch, rx_switch);
-+		wlc_lcnphy_rx_gain_override_enable(pi, true);
-+
-+		tia_gain = 8;
-+		rx_pwr_threshold = 950;
-+		while (tia_gain > 0) {
- 			tia_gain -= 1;
-+			wlc_lcnphy_set_rx_gain_by_distribution(pi,
-+							       0, 0, 2, 2,
-+							       (u16)
-+							       tia_gain, 1, 0);
-+			udelay(500);
-+
-+			received_power =
-+				wlc_lcnphy_measure_digital_power(pi, 2000);
-+			if (received_power < rx_pwr_threshold)
-+				break;
- 		}
--		lna2_gain -= 1;
--	}
-+		result = wlc_lcnphy_calc_rx_iq_comp(pi, 0xffff);
- 
--	if (set_gain)
--		result = wlc_lcnphy_calc_rx_iq_comp(pi, 1024);
--	else
--		result = false;
-+		wlc_lcnphy_stop_tx_tone(pi);
- 
--	wlc_lcnphy_stop_tx_tone(pi);
-+		write_phy_reg(pi, 0x631, Core1TxControl_old);
- 
--	write_phy_reg(pi, 0x631, Core1TxControl_old);
--
--	write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
--	write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
--	write_phy_reg(pi, 0x4b0, rfoverride2_old);
--	write_phy_reg(pi, 0x4b1, rfoverride2val_old);
--	write_phy_reg(pi, 0x4f9, rfoverride3_old);
--	write_phy_reg(pi, 0x4fa, rfoverride3val_old);
--	write_phy_reg(pi, 0x938, rfoverride4_old);
--	write_phy_reg(pi, 0x939, rfoverride4val_old);
--	write_phy_reg(pi, 0x43b, afectrlovr_old);
--	write_phy_reg(pi, 0x43c, afectrlovrval_old);
--	write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
--	write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
-+		write_phy_reg(pi, 0x44c, RFOverrideVal0_old);
-+		write_phy_reg(pi, 0x44d, RFOverrideVal0_old);
-+		write_phy_reg(pi, 0x4b0, rfoverride2_old);
-+		write_phy_reg(pi, 0x4b1, rfoverride2val_old);
-+		write_phy_reg(pi, 0x4f9, rfoverride3_old);
-+		write_phy_reg(pi, 0x4fa, rfoverride3val_old);
-+		write_phy_reg(pi, 0x938, rfoverride4_old);
-+		write_phy_reg(pi, 0x939, rfoverride4val_old);
-+		write_phy_reg(pi, 0x43b, afectrlovr_old);
-+		write_phy_reg(pi, 0x43c, afectrlovrval_old);
-+		write_phy_reg(pi, 0x6da, old_sslpnCalibClkEnCtrl);
-+		write_phy_reg(pi, 0x6db, old_sslpnRxFeClkEnCtrl);
- 
--	wlc_lcnphy_clear_trsw_override(pi);
-+		wlc_lcnphy_clear_trsw_override(pi);
- 
--	mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
-+		mod_phy_reg(pi, 0x44c, (0x1 << 2), 0 << 2);
- 
--	for (i = 0; i < 11; i++)
--		write_radio_reg(pi, rxiq_cal_rf_reg[i],
--				values_to_save[i]);
-+		for (i = 0; i < 11; i++)
-+			write_radio_reg(pi, rxiq_cal_rf_reg[i],
-+					values_to_save[i]);
- 
--	if (tx_gain_override_old)
--		wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
--	else
--		wlc_lcnphy_disable_tx_gain_override(pi);
-+		if (tx_gain_override_old)
-+			wlc_lcnphy_set_tx_pwr_by_index(pi, tx_gain_index_old);
-+		else
-+			wlc_lcnphy_disable_tx_gain_override(pi);
- 
--	wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
--	wlc_lcnphy_rx_gain_override_enable(pi, false);
-+		wlc_lcnphy_set_tx_pwr_ctrl(pi, tx_pwr_ctrl);
-+		wlc_lcnphy_rx_gain_override_enable(pi, false);
-+	}
- 
- cal_done:
- 	kfree(ptr);
-@@ -1829,17 +1781,6 @@ wlc_lcnphy_radio_2064_channel_tune_4313(struct brcms_phy *pi, u8 channel)
- 		write_radio_reg(pi, RADIO_2064_REG038, 3);
- 		write_radio_reg(pi, RADIO_2064_REG091, 7);
- 	}
--
--	if (!(pi->sh->boardflags & BFL_FEM)) {
--		u8 reg038[14] = {0xd, 0xe, 0xd, 0xd, 0xd, 0xc,
--			0xa, 0xb, 0xb, 0x3, 0x3, 0x2, 0x0, 0x0};
--
--		write_radio_reg(pi, RADIO_2064_REG02A, 0xf);
--		write_radio_reg(pi, RADIO_2064_REG091, 0x3);
--		write_radio_reg(pi, RADIO_2064_REG038, 0x3);
--
--		write_radio_reg(pi, RADIO_2064_REG038, reg038[channel - 1]);
--	}
- }
- 
- static int
-@@ -2034,16 +1975,6 @@ wlc_lcnphy_set_tssi_mux(struct brcms_phy *pi, enum lcnphy_tssi_mode pos)
- 		} else {
- 			mod_radio_reg(pi, RADIO_2064_REG03A, 1, 0x1);
- 			mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
--			mod_radio_reg(pi, RADIO_2064_REG028, 0x1, 0x0);
--			mod_radio_reg(pi, RADIO_2064_REG11A, 0x4, 1<<2);
--			mod_radio_reg(pi, RADIO_2064_REG036, 0x10, 0x0);
--			mod_radio_reg(pi, RADIO_2064_REG11A, 0x10, 1<<4);
--			mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
--			mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x77);
--			mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, 0xe<<1);
--			mod_radio_reg(pi, RADIO_2064_REG112, 0x80, 1<<7);
--			mod_radio_reg(pi, RADIO_2064_REG005, 0x7, 1<<1);
--			mod_radio_reg(pi, RADIO_2064_REG029, 0xf0, 0<<4);
- 		}
- 	} else {
- 		mod_phy_reg(pi, 0x4d9, (0x1 << 2), (0x1) << 2);
-@@ -2130,14 +2061,12 @@ static void wlc_lcnphy_pwrctrl_rssiparams(struct brcms_phy *pi)
- 		    (auxpga_vmid_temp << 0) | (auxpga_gain_temp << 12));
- 
- 	mod_radio_reg(pi, RADIO_2064_REG082, (1 << 5), (1 << 5));
--	mod_radio_reg(pi, RADIO_2064_REG07C, (1 << 0), (1 << 0));
- }
- 
- static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
- {
- 	struct phytbl_info tab;
- 	u32 rfseq, ind;
--	u8 tssi_sel;
- 
- 	tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
- 	tab.tbl_width = 32;
-@@ -2159,13 +2088,7 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
- 
- 	mod_phy_reg(pi, 0x503, (0x1 << 4), (1) << 4);
- 
--	if (pi->sh->boardflags & BFL_FEM) {
--		tssi_sel = 0x1;
--		wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
--	} else {
--		tssi_sel = 0xe;
--		wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_POST_PA);
--	}
-+	wlc_lcnphy_set_tssi_mux(pi, LCNPHY_TSSI_EXT);
- 	mod_phy_reg(pi, 0x4a4, (0x1 << 14), (0) << 14);
- 
- 	mod_phy_reg(pi, 0x4a4, (0x1 << 15), (1) << 15);
-@@ -2201,10 +2124,9 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
- 	mod_phy_reg(pi, 0x49a, (0x1ff << 0), (0xff) << 0);
- 
- 	if (LCNREV_IS(pi->pubpi.phy_rev, 2)) {
--		mod_radio_reg(pi, RADIO_2064_REG028, 0xf, tssi_sel);
-+		mod_radio_reg(pi, RADIO_2064_REG028, 0xf, 0xe);
- 		mod_radio_reg(pi, RADIO_2064_REG086, 0x4, 0x4);
- 	} else {
--		mod_radio_reg(pi, RADIO_2064_REG028, 0x1e, tssi_sel << 1);
- 		mod_radio_reg(pi, RADIO_2064_REG03A, 0x1, 1);
- 		mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 1 << 3);
- 	}
-@@ -2251,10 +2173,6 @@ static void wlc_lcnphy_tssi_setup(struct brcms_phy *pi)
- 
- 	mod_phy_reg(pi, 0x4d7, (0xf << 8), (0) << 8);
- 
--	mod_radio_reg(pi, RADIO_2064_REG035, 0xff, 0x0);
--	mod_radio_reg(pi, RADIO_2064_REG036, 0x3, 0x0);
--	mod_radio_reg(pi, RADIO_2064_REG11A, 0x8, 0x8);
--
- 	wlc_lcnphy_pwrctrl_rssiparams(pi);
- }
- 
-@@ -2873,8 +2791,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
- 		read_radio_reg(pi, RADIO_2064_REG007) & 1;
- 	u16 SAVE_jtag_auxpga = read_radio_reg(pi, RADIO_2064_REG0FF) & 0x10;
- 	u16 SAVE_iqadc_aux_en = read_radio_reg(pi, RADIO_2064_REG11F) & 4;
--	u8 SAVE_bbmult = wlc_lcnphy_get_bbmult(pi);
--
- 	idleTssi = read_phy_reg(pi, 0x4ab);
- 	suspend = (0 == (bcma_read32(pi->d11core, D11REGOFFS(maccontrol)) &
- 			 MCTL_EN_MAC));
-@@ -2892,12 +2808,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
- 	mod_radio_reg(pi, RADIO_2064_REG0FF, 0x10, 1 << 4);
- 	mod_radio_reg(pi, RADIO_2064_REG11F, 0x4, 1 << 2);
- 	wlc_lcnphy_tssi_setup(pi);
--
--	mod_phy_reg(pi, 0x4d7, (0x1 << 0), (1 << 0));
--	mod_phy_reg(pi, 0x4d7, (0x1 << 6), (1 << 6));
--
--	wlc_lcnphy_set_bbmult(pi, 0x0);
--
- 	wlc_phy_do_dummy_tx(pi, true, OFF);
- 	idleTssi = ((read_phy_reg(pi, 0x4ab) & (0x1ff << 0))
- 		    >> 0);
-@@ -2919,7 +2829,6 @@ static void wlc_lcnphy_idle_tssi_est(struct brcms_phy_pub *ppi)
- 
- 	mod_phy_reg(pi, 0x44c, (0x1 << 12), (0) << 12);
- 
--	wlc_lcnphy_set_bbmult(pi, SAVE_bbmult);
- 	wlc_lcnphy_set_tx_gain_override(pi, tx_gain_override_old);
- 	wlc_lcnphy_set_tx_gain(pi, &old_gains);
- 	wlc_lcnphy_set_tx_pwr_ctrl(pi, SAVE_txpwrctrl);
-@@ -3133,11 +3042,6 @@ static void wlc_lcnphy_tx_pwr_ctrl_init(struct brcms_phy_pub *ppi)
- 			wlc_lcnphy_write_table(pi, &tab);
- 			tab.tbl_offset++;
- 		}
--		mod_phy_reg(pi, 0x4d0, (0x1 << 0), (0) << 0);
--		mod_phy_reg(pi, 0x4d3, (0xff << 0), (0) << 0);
--		mod_phy_reg(pi, 0x4d3, (0xff << 8), (0) << 8);
--		mod_phy_reg(pi, 0x4d0, (0x1 << 4), (0) << 4);
--		mod_phy_reg(pi, 0x4d0, (0x1 << 2), (0) << 2);
- 
- 		mod_phy_reg(pi, 0x410, (0x1 << 7), (0) << 7);
- 
-@@ -3939,6 +3843,7 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
- 	target_gains.pad_gain = 21;
- 	target_gains.dac_gain = 0;
- 	wlc_lcnphy_set_tx_gain(pi, &target_gains);
-+	wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
- 
- 	if (LCNREV_IS(pi->pubpi.phy_rev, 1) || pi_lcn->lcnphy_hw_iqcal_en) {
- 
-@@ -3949,7 +3854,6 @@ static void wlc_lcnphy_txpwrtbl_iqlo_cal(struct brcms_phy *pi)
- 					lcnphy_recal ? LCNPHY_CAL_RECAL :
- 					LCNPHY_CAL_FULL), false);
- 	} else {
--		wlc_lcnphy_set_tx_pwr_by_index(pi, 16);
- 		wlc_lcnphy_tx_iqlo_soft_cal_full(pi);
- 	}
- 
-@@ -4374,22 +4278,17 @@ wlc_lcnphy_load_tx_gain_table(struct brcms_phy *pi,
- 	if (CHSPEC_IS5G(pi->radio_chanspec))
- 		pa_gain = 0x70;
- 	else
--		pa_gain = 0x60;
-+		pa_gain = 0x70;
- 
- 	if (pi->sh->boardflags & BFL_FEM)
- 		pa_gain = 0x10;
--
- 	tab.tbl_id = LCNPHY_TBL_ID_TXPWRCTL;
- 	tab.tbl_width = 32;
- 	tab.tbl_len = 1;
- 	tab.tbl_ptr = &val;
- 
- 	for (j = 0; j < 128; j++) {
--		if (pi->sh->boardflags & BFL_FEM)
--			gm_gain = gain_table[j].gm;
--		else
--			gm_gain = 15;
--
-+		gm_gain = gain_table[j].gm;
- 		val = (((u32) pa_gain << 24) |
- 		       (gain_table[j].pad << 16) |
- 		       (gain_table[j].pga << 8) | gm_gain);
-@@ -4600,10 +4499,7 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
- 
- 	write_phy_reg(pi, 0x4ea, 0x4688);
- 
--	if (pi->sh->boardflags & BFL_FEM)
--		mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
--	else
--		mod_phy_reg(pi, 0x4eb, (0x7 << 0), 3 << 0);
-+	mod_phy_reg(pi, 0x4eb, (0x7 << 0), 2 << 0);
- 
- 	mod_phy_reg(pi, 0x4eb, (0x7 << 6), 0 << 6);
- 
-@@ -4614,13 +4510,6 @@ static void wlc_radio_2064_init(struct brcms_phy *pi)
- 	wlc_lcnphy_rcal(pi);
- 
- 	wlc_lcnphy_rc_cal(pi);
--
--	if (!(pi->sh->boardflags & BFL_FEM)) {
--		write_radio_reg(pi, RADIO_2064_REG032, 0x6f);
--		write_radio_reg(pi, RADIO_2064_REG033, 0x19);
--		write_radio_reg(pi, RADIO_2064_REG039, 0xe);
--	}
--
- }
- 
- static void wlc_lcnphy_radio_init(struct brcms_phy *pi)
-@@ -4650,20 +4539,22 @@ static void wlc_lcnphy_tbl_init(struct brcms_phy *pi)
- 		wlc_lcnphy_write_table(pi, &tab);
- 	}
- 
--	if (!(pi->sh->boardflags & BFL_FEM)) {
--		tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
--		tab.tbl_width = 16;
--		tab.tbl_ptr = &val;
--		tab.tbl_len = 1;
-+	tab.tbl_id = LCNPHY_TBL_ID_RFSEQ;
-+	tab.tbl_width = 16;
-+	tab.tbl_ptr = &val;
-+	tab.tbl_len = 1;
- 
--		val = 150;
--		tab.tbl_offset = 0;
--		wlc_lcnphy_write_table(pi, &tab);
-+	val = 114;
-+	tab.tbl_offset = 0;
-+	wlc_lcnphy_write_table(pi, &tab);
- 
--		val = 220;
--		tab.tbl_offset = 1;
--		wlc_lcnphy_write_table(pi, &tab);
--	}
-+	val = 130;
-+	tab.tbl_offset = 1;
-+	wlc_lcnphy_write_table(pi, &tab);
-+
-+	val = 6;
-+	tab.tbl_offset = 8;
-+	wlc_lcnphy_write_table(pi, &tab);
- 
- 	if (CHSPEC_IS2G(pi->radio_chanspec)) {
- 		if (pi->sh->boardflags & BFL_FEM)
-@@ -5055,7 +4946,6 @@ void wlc_phy_chanspec_set_lcnphy(struct brcms_phy *pi, u16 chanspec)
- 		wlc_lcnphy_load_tx_iir_filter(pi, true, 3);
- 
- 	mod_phy_reg(pi, 0x4eb, (0x7 << 3), (1) << 3);
--	wlc_lcnphy_tssi_setup(pi);
- }
- 
- void wlc_phy_detach_lcnphy(struct brcms_phy *pi)
-@@ -5094,7 +4984,8 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
- 	if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
- 		return false;
- 
--	if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
-+	if ((pi->sh->boardflags & BFL_FEM) &&
-+	    (LCNREV_IS(pi->pubpi.phy_rev, 1))) {
- 		if (pi_lcn->lcnphy_tempsense_option == 3) {
- 			pi->hwpwrctrl = true;
- 			pi->hwpwrctrl_capable = true;
-diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
-index b7e95ac..622c01c 100644
---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
-+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phytbl_lcn.c
-@@ -1992,70 +1992,70 @@ static const u16 dot11lcn_sw_ctrl_tbl_4313_epa_rev0[] = {
- };
- 
- static const u16 dot11lcn_sw_ctrl_tbl_4313_rev0[] = {
--	0x0009,
- 	0x000a,
--	0x0005,
--	0x0006,
- 	0x0009,
--	0x000a,
--	0x0005,
- 	0x0006,
--	0x0009,
--	0x000a,
- 	0x0005,
--	0x0006,
--	0x0009,
- 	0x000a,
--	0x0005,
--	0x0006,
- 	0x0009,
--	0x000a,
--	0x0005,
- 	0x0006,
--	0x0009,
--	0x000a,
- 	0x0005,
--	0x0006,
--	0x0009,
- 	0x000a,
--	0x0005,
--	0x0006,
- 	0x0009,
--	0x000a,
--	0x0005,
- 	0x0006,
--	0x0009,
--	0x000a,
- 	0x0005,
--	0x0006,
--	0x0009,
- 	0x000a,
--	0x0005,
--	0x0006,
- 	0x0009,
--	0x000a,
--	0x0005,
- 	0x0006,
--	0x0009,
--	0x000a,
- 	0x0005,
--	0x0006,
-+	0x000a,
- 	0x0009,
-+	0x0006,
-+	0x0005,
- 	0x000a,
-+	0x0009,
-+	0x0006,
- 	0x0005,
-+	0x000a,
-+	0x0009,
- 	0x0006,
-+	0x0005,
-+	0x000a,
- 	0x0009,
-+	0x0006,
-+	0x0005,
- 	0x000a,
-+	0x0009,
-+	0x0006,
- 	0x0005,
-+	0x000a,
-+	0x0009,
- 	0x0006,
-+	0x0005,
-+	0x000a,
- 	0x0009,
-+	0x0006,
-+	0x0005,
- 	0x000a,
-+	0x0009,
-+	0x0006,
- 	0x0005,
-+	0x000a,
-+	0x0009,
- 	0x0006,
-+	0x0005,
-+	0x000a,
- 	0x0009,
-+	0x0006,
-+	0x0005,
- 	0x000a,
-+	0x0009,
-+	0x0006,
- 	0x0005,
-+	0x000a,
-+	0x0009,
- 	0x0006,
-+	0x0005,
- };
- 
- static const u16 dot11lcn_sw_ctrl_tbl_rev0[] = {
-diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
-index aec2e0d..1924d8b 100644
---- a/drivers/scsi/libsas/sas_expander.c
-+++ b/drivers/scsi/libsas/sas_expander.c
-@@ -235,6 +235,17 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
- 	linkrate  = phy->linkrate;
- 	memcpy(sas_addr, phy->attached_sas_addr, SAS_ADDR_SIZE);
- 
-+	/* Handle vacant phy - rest of dr data is not valid so skip it */
-+	if (phy->phy_state == PHY_VACANT) {
-+		memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
-+		phy->attached_dev_type = NO_DEVICE;
-+		if (!test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state)) {
-+			phy->phy_id = phy_id;
-+			goto skip;
-+		} else
-+			goto out;
-+	}
-+
- 	phy->attached_dev_type = to_dev_type(dr);
- 	if (test_bit(SAS_HA_ATA_EH_ACTIVE, &ha->state))
- 		goto out;
-@@ -272,6 +283,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp)
- 	phy->phy->maximum_linkrate = dr->pmax_linkrate;
- 	phy->phy->negotiated_linkrate = phy->linkrate;
- 
-+ skip:
- 	if (new_phy)
- 		if (sas_phy_add(phy->phy)) {
- 			sas_phy_free(phy->phy);
-diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
-index 7d4ec02..fea564c 100644
---- a/drivers/target/target_core_alua.c
-+++ b/drivers/target/target_core_alua.c
-@@ -408,6 +408,7 @@ static inline int core_alua_state_standby(
- 	case REPORT_LUNS:
- 	case RECEIVE_DIAGNOSTIC:
- 	case SEND_DIAGNOSTIC:
-+		return 0;
- 	case MAINTENANCE_IN:
- 		switch (cdb[1] & 0x1f) {
- 		case MI_REPORT_TARGET_PGS:
-@@ -450,6 +451,7 @@ static inline int core_alua_state_unavailable(
- 	switch (cdb[0]) {
- 	case INQUIRY:
- 	case REPORT_LUNS:
-+		return 0;
- 	case MAINTENANCE_IN:
- 		switch (cdb[1] & 0x1f) {
- 		case MI_REPORT_TARGET_PGS:
-@@ -490,6 +492,7 @@ static inline int core_alua_state_transition(
- 	switch (cdb[0]) {
- 	case INQUIRY:
- 	case REPORT_LUNS:
-+		return 0;
- 	case MAINTENANCE_IN:
- 		switch (cdb[1] & 0x1f) {
- 		case MI_REPORT_TARGET_PGS:
-diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
-index c578229..78f1be2 100644
---- a/drivers/tty/tty_ldisc.c
-+++ b/drivers/tty/tty_ldisc.c
-@@ -934,17 +934,17 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
- 	 * race with the set_ldisc code path.
- 	 */
- 
--	tty_lock_pair(tty, o_tty);
- 	tty_ldisc_halt(tty);
--	tty_ldisc_flush_works(tty);
--	if (o_tty) {
-+	if (o_tty)
- 		tty_ldisc_halt(o_tty);
-+
-+	tty_ldisc_flush_works(tty);
-+	if (o_tty)
- 		tty_ldisc_flush_works(o_tty);
--	}
- 
-+	tty_lock_pair(tty, o_tty);
- 	/* This will need doing differently if we need to lock */
- 	tty_ldisc_kill(tty);
--
- 	if (o_tty)
- 		tty_ldisc_kill(o_tty);
- 
-diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
-index 12b3da3..f7199b9 100644
---- a/fs/cifs/connect.c
-+++ b/fs/cifs/connect.c
-@@ -1546,14 +1546,24 @@ cifs_parse_mount_options(const char *mountdata, const char *devname,
- 			}
- 			break;
- 		case Opt_blank_pass:
--			vol->password = NULL;
--			break;
--		case Opt_pass:
- 			/* passwords have to be handled differently
- 			 * to allow the character used for deliminator
- 			 * to be passed within them
- 			 */
- 
-+			/*
-+			 * Check if this is a case where the  password
-+			 * starts with a delimiter
-+			 */
-+			tmp_end = strchr(data, '=');
-+			tmp_end++;
-+			if (!(tmp_end < end && tmp_end[1] == delim)) {
-+				/* No it is not. Set the password to NULL */
-+				vol->password = NULL;
-+				break;
-+			}
-+			/* Yes it is. Drop down to Opt_pass below.*/
-+		case Opt_pass:
- 			/* Obtain the value string */
- 			value = strchr(data, '=');
- 			value++;
-diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
-index 991ab2d..7af426b 100644
---- a/fs/gfs2/file.c
-+++ b/fs/gfs2/file.c
-@@ -924,8 +924,11 @@ static int gfs2_lock(struct file *file, int cmd, struct file_lock *fl)
- 		cmd = F_SETLK;
- 		fl->fl_type = F_UNLCK;
- 	}
--	if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags)))
-+	if (unlikely(test_bit(SDF_SHUTDOWN, &sdp->sd_flags))) {
-+		if (fl->fl_type == F_UNLCK)
-+			posix_lock_file_wait(file, fl);
- 		return -EIO;
-+	}
- 	if (IS_GETLK(cmd))
- 		return dlm_posix_get(ls->ls_dlm, ip->i_no_addr, file, fl);
- 	else if (fl->fl_type == F_UNLCK)
-diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
-index b7eff07..9afba3d6 100644
---- a/fs/gfs2/rgrp.c
-+++ b/fs/gfs2/rgrp.c
-@@ -576,7 +576,7 @@ int gfs2_rs_alloc(struct gfs2_inode *ip)
- 	RB_CLEAR_NODE(&ip->i_res->rs_node);
- out:
- 	up_write(&ip->i_rw_mutex);
--	return 0;
-+	return error;
- }
- 
- static void dump_rs(struct seq_file *seq, const struct gfs2_blkreserv *rs)
-diff --git a/fs/inode.c b/fs/inode.c
-index 14084b7..b98540e 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -725,7 +725,7 @@ void prune_icache_sb(struct super_block *sb, int nr_to_scan)
- 		 * inode to the back of the list so we don't spin on it.
- 		 */
- 		if (!spin_trylock(&inode->i_lock)) {
--			list_move_tail(&inode->i_lru, &sb->s_inode_lru);
-+			list_move(&inode->i_lru, &sb->s_inode_lru);
- 			continue;
- 		}
- 
-diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h
-index 25f01d0..b1b1fa6 100644
---- a/include/asm-generic/tlb.h
-+++ b/include/asm-generic/tlb.h
-@@ -99,7 +99,12 @@ struct mmu_gather {
- 	unsigned int		need_flush : 1,	/* Did free PTEs */
- 				fast_mode  : 1; /* No batching   */
- 
--	unsigned int		fullmm;
-+	/* we are in the middle of an operation to clear
-+	 * a full mm and can make some optimizations */
-+	unsigned int		fullmm : 1,
-+	/* we have performed an operation which
-+	 * requires a complete flush of the tlb */
-+				need_flush_all : 1;
- 
- 	struct mmu_gather_batch *active;
- 	struct mmu_gather_batch	local;
-diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
-index 92691d8..616603d 100644
---- a/include/linux/ftrace.h
-+++ b/include/linux/ftrace.h
-@@ -394,7 +394,6 @@ ssize_t ftrace_filter_write(struct file *file, const char __user *ubuf,
- 			    size_t cnt, loff_t *ppos);
- ssize_t ftrace_notrace_write(struct file *file, const char __user *ubuf,
- 			     size_t cnt, loff_t *ppos);
--loff_t ftrace_regex_lseek(struct file *file, loff_t offset, int whence);
- int ftrace_regex_release(struct inode *inode, struct file *file);
- 
- void __init
-@@ -567,6 +566,8 @@ static inline int
- ftrace_regex_release(struct inode *inode, struct file *file) { return -ENODEV; }
- #endif /* CONFIG_DYNAMIC_FTRACE */
- 
-+loff_t ftrace_filter_lseek(struct file *file, loff_t offset, int whence);
-+
- /* totally disable ftrace - can not re-enable after this */
- void ftrace_kill(void);
- 
-diff --git a/ipc/msg.c b/ipc/msg.c
-index 31cd1bf..fede1d0 100644
---- a/ipc/msg.c
-+++ b/ipc/msg.c
-@@ -872,6 +872,7 @@ long do_msgrcv(int msqid, void __user *buf, size_t bufsz, long msgtyp,
- 							goto out_unlock;
- 						break;
- 					}
-+					msg = ERR_PTR(-EAGAIN);
- 				} else
- 					break;
- 				msg_counter++;
-diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
-index c685e31..c3ae144 100644
---- a/kernel/sched/clock.c
-+++ b/kernel/sched/clock.c
-@@ -176,10 +176,36 @@ static u64 sched_clock_remote(struct sched_clock_data *scd)
- 	u64 this_clock, remote_clock;
- 	u64 *ptr, old_val, val;
- 
-+#if BITS_PER_LONG != 64
-+again:
-+	/*
-+	 * Careful here: The local and the remote clock values need to
-+	 * be read out atomic as we need to compare the values and
-+	 * then update either the local or the remote side. So the
-+	 * cmpxchg64 below only protects one readout.
-+	 *
-+	 * We must reread via sched_clock_local() in the retry case on
-+	 * 32bit as an NMI could use sched_clock_local() via the
-+	 * tracer and hit between the readout of
-+	 * the low32bit and the high 32bit portion.
-+	 */
-+	this_clock = sched_clock_local(my_scd);
-+	/*
-+	 * We must enforce atomic readout on 32bit, otherwise the
-+	 * update on the remote cpu can hit inbetween the readout of
-+	 * the low32bit and the high 32bit portion.
-+	 */
-+	remote_clock = cmpxchg64(&scd->clock, 0, 0);
-+#else
-+	/*
-+	 * On 64bit the read of [my]scd->clock is atomic versus the
-+	 * update, so we can avoid the above 32bit dance.
-+	 */
- 	sched_clock_local(my_scd);
- again:
- 	this_clock = my_scd->clock;
- 	remote_clock = scd->clock;
-+#endif
- 
- 	/*
- 	 * Use the opportunity that we have both locks
-diff --git a/kernel/sys.c b/kernel/sys.c
-index 265b376..47f1d1b 100644
---- a/kernel/sys.c
-+++ b/kernel/sys.c
-@@ -323,7 +323,6 @@ void kernel_restart_prepare(char *cmd)
- 	system_state = SYSTEM_RESTART;
- 	usermodehelper_disable();
- 	device_shutdown();
--	syscore_shutdown();
- }
- 
- /**
-@@ -369,6 +368,7 @@ void kernel_restart(char *cmd)
- {
- 	kernel_restart_prepare(cmd);
- 	disable_nonboot_cpus();
-+	syscore_shutdown();
- 	if (!cmd)
- 		printk(KERN_EMERG "Restarting system.\n");
- 	else
-@@ -394,6 +394,7 @@ static void kernel_shutdown_prepare(enum system_states state)
- void kernel_halt(void)
- {
- 	kernel_shutdown_prepare(SYSTEM_HALT);
-+	disable_nonboot_cpus();
- 	syscore_shutdown();
- 	printk(KERN_EMERG "System halted.\n");
- 	kmsg_dump(KMSG_DUMP_HALT);
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 64bc5d8..35cc3a8 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -668,7 +668,6 @@ int ftrace_profile_pages_init(struct ftrace_profile_stat *stat)
- 		free_page(tmp);
- 	}
- 
--	free_page((unsigned long)stat->pages);
- 	stat->pages = NULL;
- 	stat->start = NULL;
- 
-@@ -1028,6 +1027,19 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
- 
- static struct pid * const ftrace_swapper_pid = &init_struct_pid;
- 
-+loff_t
-+ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
-+{
-+	loff_t ret;
-+
-+	if (file->f_mode & FMODE_READ)
-+		ret = seq_lseek(file, offset, whence);
-+	else
-+		file->f_pos = ret = 1;
-+
-+	return ret;
-+}
-+
- #ifdef CONFIG_DYNAMIC_FTRACE
- 
- #ifndef CONFIG_FTRACE_MCOUNT_RECORD
-@@ -2590,7 +2602,7 @@ static void ftrace_filter_reset(struct ftrace_hash *hash)
-  * routine, you can use ftrace_filter_write() for the write
-  * routine if @flag has FTRACE_ITER_FILTER set, or
-  * ftrace_notrace_write() if @flag has FTRACE_ITER_NOTRACE set.
-- * ftrace_regex_lseek() should be used as the lseek routine, and
-+ * ftrace_filter_lseek() should be used as the lseek routine, and
-  * release must call ftrace_regex_release().
-  */
- int
-@@ -2674,19 +2686,6 @@ ftrace_notrace_open(struct inode *inode, struct file *file)
- 				 inode, file);
- }
- 
--loff_t
--ftrace_regex_lseek(struct file *file, loff_t offset, int whence)
--{
--	loff_t ret;
--
--	if (file->f_mode & FMODE_READ)
--		ret = seq_lseek(file, offset, whence);
--	else
--		file->f_pos = ret = 1;
--
--	return ret;
--}
--
- static int ftrace_match(char *str, char *regex, int len, int type)
- {
- 	int matched = 0;
-@@ -3549,7 +3548,7 @@ static const struct file_operations ftrace_filter_fops = {
- 	.open = ftrace_filter_open,
- 	.read = seq_read,
- 	.write = ftrace_filter_write,
--	.llseek = ftrace_regex_lseek,
-+	.llseek = ftrace_filter_lseek,
- 	.release = ftrace_regex_release,
- };
- 
-@@ -3557,7 +3556,7 @@ static const struct file_operations ftrace_notrace_fops = {
- 	.open = ftrace_notrace_open,
- 	.read = seq_read,
- 	.write = ftrace_notrace_write,
--	.llseek = ftrace_regex_lseek,
-+	.llseek = ftrace_filter_lseek,
- 	.release = ftrace_regex_release,
- };
- 
-@@ -3762,8 +3761,8 @@ static const struct file_operations ftrace_graph_fops = {
- 	.open		= ftrace_graph_open,
- 	.read		= seq_read,
- 	.write		= ftrace_graph_write,
-+	.llseek		= ftrace_filter_lseek,
- 	.release	= ftrace_graph_release,
--	.llseek		= seq_lseek,
- };
- #endif /* CONFIG_FUNCTION_GRAPH_TRACER */
- 
-@@ -4421,7 +4420,7 @@ static const struct file_operations ftrace_pid_fops = {
- 	.open		= ftrace_pid_open,
- 	.write		= ftrace_pid_write,
- 	.read		= seq_read,
--	.llseek		= seq_lseek,
-+	.llseek		= ftrace_filter_lseek,
- 	.release	= ftrace_pid_release,
- };
- 
-diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c
-index 42ca822..83a8b5b 100644
---- a/kernel/trace/trace_stack.c
-+++ b/kernel/trace/trace_stack.c
-@@ -322,7 +322,7 @@ static const struct file_operations stack_trace_filter_fops = {
- 	.open = stack_trace_filter_open,
- 	.read = seq_read,
- 	.write = ftrace_filter_write,
--	.llseek = ftrace_regex_lseek,
-+	.llseek = ftrace_filter_lseek,
- 	.release = ftrace_regex_release,
- };
- 
-diff --git a/lib/kobject.c b/lib/kobject.c
-index e07ee1f..a654866 100644
---- a/lib/kobject.c
-+++ b/lib/kobject.c
-@@ -529,6 +529,13 @@ struct kobject *kobject_get(struct kobject *kobj)
- 	return kobj;
- }
- 
-+static struct kobject *kobject_get_unless_zero(struct kobject *kobj)
-+{
-+	if (!kref_get_unless_zero(&kobj->kref))
-+		kobj = NULL;
-+	return kobj;
-+}
-+
- /*
-  * kobject_cleanup - free kobject resources.
-  * @kobj: object to cleanup
-@@ -751,7 +758,7 @@ struct kobject *kset_find_obj(struct kset *kset, const char *name)
- 
- 	list_for_each_entry(k, &kset->list, entry) {
- 		if (kobject_name(k) && !strcmp(kobject_name(k), name)) {
--			ret = kobject_get(k);
-+			ret = kobject_get_unless_zero(k);
- 			break;
- 		}
- 	}
-diff --git a/mm/memory.c b/mm/memory.c
-index bb1369f..f8b734a 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -212,6 +212,7 @@ void tlb_gather_mmu(struct mmu_gather *tlb, struct mm_struct *mm, bool fullmm)
- 	tlb->mm = mm;
- 
- 	tlb->fullmm     = fullmm;
-+	tlb->need_flush_all = 0;
- 	tlb->start	= -1UL;
- 	tlb->end	= 0;
- 	tlb->need_flush = 0;
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index 1440b3f..b54c2e8 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -576,7 +576,7 @@ static int wm5102_sysclk_ev(struct snd_soc_dapm_widget *w,
- 			    struct snd_kcontrol *kcontrol, int event)
- {
- 	struct snd_soc_codec *codec = w->codec;
--	struct arizona *arizona = dev_get_drvdata(codec->dev);
-+	struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
- 	struct regmap *regmap = codec->control_data;
- 	const struct reg_default *patch = NULL;
- 	int i, patch_size;
-diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
-index 134e41c..f8a31ad 100644
---- a/sound/soc/codecs/wm8903.c
-+++ b/sound/soc/codecs/wm8903.c
-@@ -1083,6 +1083,8 @@ static const struct snd_soc_dapm_route wm8903_intercon[] = {
- 	{ "ROP", NULL, "Right Speaker PGA" },
- 	{ "RON", NULL, "Right Speaker PGA" },
- 
-+	{ "Charge Pump", NULL, "CLK_DSP" },
-+
- 	{ "Left Headphone Output PGA", NULL, "Charge Pump" },
- 	{ "Right Headphone Output PGA", NULL, "Charge Pump" },
- 	{ "Left Line Output PGA", NULL, "Charge Pump" },
-diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
-index 2370063..f3ab918 100644
---- a/sound/soc/soc-core.c
-+++ b/sound/soc/soc-core.c
-@@ -2959,7 +2959,7 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
- 	val = val << shift;
- 
- 	ret = snd_soc_update_bits_locked(codec, reg, val_mask, val);
--	if (ret != 0)
-+	if (ret < 0)
- 		return ret;
- 
- 	if (snd_soc_volsw_is_stereo(mc)) {
-diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
-index 15520de..190f434 100644
---- a/sound/usb/mixer_quirks.c
-+++ b/sound/usb/mixer_quirks.c
-@@ -509,7 +509,7 @@ static int snd_nativeinstruments_control_get(struct snd_kcontrol *kcontrol,
- 	else
- 		ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), bRequest,
- 				  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN,
--				  0, cpu_to_le16(wIndex),
-+				  0, wIndex,
- 				  &tmp, sizeof(tmp), 1000);
- 	up_read(&mixer->chip->shutdown_rwsem);
- 
-@@ -540,7 +540,7 @@ static int snd_nativeinstruments_control_put(struct snd_kcontrol *kcontrol,
- 	else
- 		ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), bRequest,
- 				  USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT,
--				  cpu_to_le16(wValue), cpu_to_le16(wIndex),
-+				  wValue, wIndex,
- 				  NULL, 0, 1000);
- 	up_read(&mixer->chip->shutdown_rwsem);
- 
-diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
-index 0115289..b9ca776 100644
---- a/sound/usb/quirks.c
-+++ b/sound/usb/quirks.c
-@@ -486,7 +486,7 @@ static int snd_usb_nativeinstruments_boot_quirk(struct usb_device *dev)
- {
- 	int ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
- 				  0xaf, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
--				  cpu_to_le16(1), 0, NULL, 0, 1000);
-+				  1, 0, NULL, 0, 1000);
- 
- 	if (ret < 0)
- 		return ret;