Grsec/PaX: 3.0-{3.2.64,3.14.23,3.17.2}-20141106203420141106

59 files changed, 4267 insertions, 6613 deletions

diff --git a/3.14.23/0000_README b/3.14.23/0000_README
index ceedf6a..3f5888e 100644
--- a/3.14.23/0000_README
+++ b/3.14.23/0000_README
@@ -2,11 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	1022_linux-3.14.23.patch
-From:	http://www.kernel.org
-Desc:	Linux 3.14.23
-
-Patch:	4420_grsecurity-3.0-3.14.23-201410312212.patch
+Patch:	4420_grsecurity-3.0-3.14.23-201411062033.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.14.23/1022_linux-3.14.23.patch b/3.14.23/1022_linux-3.14.23.patch
deleted file mode 100644
index d74580b..0000000
--- a/3.14.23/1022_linux-3.14.23.patch
+++ /dev/null
@@ -1,5877 +0,0 @@
-diff --git a/Documentation/lzo.txt b/Documentation/lzo.txt
-new file mode 100644
-index 0000000..ea45dd3
---- /dev/null
-+++ b/Documentation/lzo.txt
-@@ -0,0 +1,164 @@
-+
-+LZO stream format as understood by Linux's LZO decompressor
-+===========================================================
-+
-+Introduction
-+
-+  This is not a specification. No specification seems to be publicly available
-+  for the LZO stream format. This document describes what input format the LZO
-+  decompressor as implemented in the Linux kernel understands. The file subject
-+  of this analysis is lib/lzo/lzo1x_decompress_safe.c. No analysis was made on
-+  the compressor nor on any other implementations though it seems likely that
-+  the format matches the standard one. The purpose of this document is to
-+  better understand what the code does in order to propose more efficient fixes
-+  for future bug reports.
-+
-+Description
-+
-+  The stream is composed of a series of instructions, operands, and data. The
-+  instructions consist in a few bits representing an opcode, and bits forming
-+  the operands for the instruction, whose size and position depend on the
-+  opcode and on the number of literals copied by previous instruction. The
-+  operands are used to indicate :
-+
-+    - a distance when copying data from the dictionary (past output buffer)
-+    - a length (number of bytes to copy from dictionary)
-+    - the number of literals to copy, which is retained in variable "state"
-+      as a piece of information for next instructions.
-+
-+  Optionally depending on the opcode and operands, extra data may follow. These
-+  extra data can be a complement for the operand (eg: a length or a distance
-+  encoded on larger values), or a literal to be copied to the output buffer.
-+
-+  The first byte of the block follows a different encoding from other bytes, it
-+  seems to be optimized for literal use only, since there is no dictionary yet
-+  prior to that byte.
-+
-+  Lengths are always encoded on a variable size starting with a small number
-+  of bits in the operand. If the number of bits isn't enough to represent the
-+  length, up to 255 may be added in increments by consuming more bytes with a
-+  rate of at most 255 per extra byte (thus the compression ratio cannot exceed
-+  around 255:1). The variable length encoding using #bits is always the same :
-+
-+       length = byte & ((1 << #bits) - 1)
-+       if (!length) {
-+               length = ((1 << #bits) - 1)
-+               length += 255*(number of zero bytes)
-+               length += first-non-zero-byte
-+       }
-+       length += constant (generally 2 or 3)
-+
-+  For references to the dictionary, distances are relative to the output
-+  pointer. Distances are encoded using very few bits belonging to certain
-+  ranges, resulting in multiple copy instructions using different encodings.
-+  Certain encodings involve one extra byte, others involve two extra bytes
-+  forming a little-endian 16-bit quantity (marked LE16 below).
-+
-+  After any instruction except the large literal copy, 0, 1, 2 or 3 literals
-+  are copied before starting the next instruction. The number of literals that
-+  were copied may change the meaning and behaviour of the next instruction. In
-+  practice, only one instruction needs to know whether 0, less than 4, or more
-+  literals were copied. This is the information stored in the <state> variable
-+  in this implementation. This number of immediate literals to be copied is
-+  generally encoded in the last two bits of the instruction but may also be
-+  taken from the last two bits of an extra operand (eg: distance).
-+
-+  End of stream is declared when a block copy of distance 0 is seen. Only one
-+  instruction may encode this distance (0001HLLL), it takes one LE16 operand
-+  for the distance, thus requiring 3 bytes.
-+
-+  IMPORTANT NOTE : in the code some length checks are missing because certain
-+  instructions are called under the assumption that a certain number of bytes
-+  follow because it has already been garanteed before parsing the instructions.
-+  They just have to "refill" this credit if they consume extra bytes. This is
-+  an implementation design choice independant on the algorithm or encoding.
-+
-+Byte sequences
-+
-+  First byte encoding :
-+
-+      0..17   : follow regular instruction encoding, see below. It is worth
-+                noting that codes 16 and 17 will represent a block copy from
-+                the dictionary which is empty, and that they will always be
-+                invalid at this place.
-+
-+      18..21  : copy 0..3 literals
-+                state = (byte - 17) = 0..3  [ copy <state> literals ]
-+                skip byte
-+
-+      22..255 : copy literal string
-+                length = (byte - 17) = 4..238
-+                state = 4 [ don't copy extra literals ]
-+                skip byte
-+
-+  Instruction encoding :
-+
-+      0 0 0 0 X X X X  (0..15)
-+        Depends on the number of literals copied by the last instruction.
-+        If last instruction did not copy any literal (state == 0), this
-+        encoding will be a copy of 4 or more literal, and must be interpreted
-+        like this :
-+
-+           0 0 0 0 L L L L  (0..15)  : copy long literal string
-+           length = 3 + (L ?: 15 + (zero_bytes * 255) + non_zero_byte)
-+           state = 4  (no extra literals are copied)
-+
-+        If last instruction used to copy between 1 to 3 literals (encoded in
-+        the instruction's opcode or distance), the instruction is a copy of a
-+        2-byte block from the dictionary within a 1kB distance. It is worth
-+        noting that this instruction provides little savings since it uses 2
-+        bytes to encode a copy of 2 other bytes but it encodes the number of
-+        following literals for free. It must be interpreted like this :
-+
-+           0 0 0 0 D D S S  (0..15)  : copy 2 bytes from <= 1kB distance
-+           length = 2
-+           state = S (copy S literals after this block)
-+         Always followed by exactly one byte : H H H H H H H H
-+           distance = (H << 2) + D + 1
-+
-+        If last instruction used to copy 4 or more literals (as detected by
-+        state == 4), the instruction becomes a copy of a 3-byte block from the
-+        dictionary from a 2..3kB distance, and must be interpreted like this :
-+
-+           0 0 0 0 D D S S  (0..15)  : copy 3 bytes from 2..3 kB distance
-+           length = 3
-+           state = S (copy S literals after this block)
-+         Always followed by exactly one byte : H H H H H H H H
-+           distance = (H << 2) + D + 2049
-+
-+      0 0 0 1 H L L L  (16..31)
-+           Copy of a block within 16..48kB distance (preferably less than 10B)
-+           length = 2 + (L ?: 7 + (zero_bytes * 255) + non_zero_byte)
-+        Always followed by exactly one LE16 :  D D D D D D D D : D D D D D D S S
-+           distance = 16384 + (H << 14) + D
-+           state = S (copy S literals after this block)
-+           End of stream is reached if distance == 16384
-+
-+      0 0 1 L L L L L  (32..63)
-+           Copy of small block within 16kB distance (preferably less than 34B)
-+           length = 2 + (L ?: 31 + (zero_bytes * 255) + non_zero_byte)
-+        Always followed by exactly one LE16 :  D D D D D D D D : D D D D D D S S
-+           distance = D + 1
-+           state = S (copy S literals after this block)
-+
-+      0 1 L D D D S S  (64..127)
-+           Copy 3-4 bytes from block within 2kB distance
-+           state = S (copy S literals after this block)
-+           length = 3 + L
-+         Always followed by exactly one byte : H H H H H H H H
-+           distance = (H << 3) + D + 1
-+
-+      1 L L D D D S S  (128..255)
-+           Copy 5-8 bytes from block within 2kB distance
-+           state = S (copy S literals after this block)
-+           length = 5 + L
-+         Always followed by exactly one byte : H H H H H H H H
-+           distance = (H << 3) + D + 1
-+
-+Authors
-+
-+  This document was written by Willy Tarreau <w@1wt.eu> on 2014/07/19 during an
-+  analysis of the decompression code available in Linux 3.16-rc5. The code is
-+  tricky, it is possible that this document contains mistakes or that a few
-+  corner cases were overlooked. In any case, please report any doubt, fix, or
-+  proposed updates to the author(s) so that the document can be updated.
-diff --git a/Documentation/virtual/kvm/mmu.txt b/Documentation/virtual/kvm/mmu.txt
-index 2908941..53838d9 100644
---- a/Documentation/virtual/kvm/mmu.txt
-+++ b/Documentation/virtual/kvm/mmu.txt
-@@ -425,6 +425,20 @@ fault through the slow path.
- Since only 19 bits are used to store generation-number on mmio spte, all
- pages are zapped when there is an overflow.
- 
-+Unfortunately, a single memory access might access kvm_memslots(kvm) multiple
-+times, the last one happening when the generation number is retrieved and
-+stored into the MMIO spte.  Thus, the MMIO spte might be created based on
-+out-of-date information, but with an up-to-date generation number.
-+
-+To avoid this, the generation number is incremented again after synchronize_srcu
-+returns; thus, the low bit of kvm_memslots(kvm)->generation is only 1 during a
-+memslot update, while some SRCU readers might be using the old copy.  We do not
-+want to use an MMIO sptes created with an odd generation number, and we can do
-+this without losing a bit in the MMIO spte.  The low bit of the generation
-+is not stored in MMIO spte, and presumed zero when it is extracted out of the
-+spte.  If KVM is unlucky and creates an MMIO spte while the low bit is 1,
-+the next access to the spte will always be a cache miss.
-+
- 
- Further reading
- ===============
-diff --git a/Makefile b/Makefile
-index a59980e..135a04a 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 22
-+SUBLEVEL = 23
- EXTRAVERSION =
- NAME = Remembering Coco
- 
-diff --git a/arch/arm/boot/dts/armada-370-netgear-rn102.dts b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
-index 651aeb5..f3188e9 100644
---- a/arch/arm/boot/dts/armada-370-netgear-rn102.dts
-+++ b/arch/arm/boot/dts/armada-370-netgear-rn102.dts
-@@ -144,6 +144,10 @@
- 				marvell,nand-enable-arbiter;
- 				nand-on-flash-bbt;
- 
-+				/* Use Hardware BCH ECC */
-+				nand-ecc-strength = <4>;
-+				nand-ecc-step-size = <512>;
-+
- 				partition@0 {
- 					label = "u-boot";
- 					reg = <0x0000000 0x180000>;  /* 1.5MB */
-diff --git a/arch/arm/boot/dts/armada-370-netgear-rn104.dts b/arch/arm/boot/dts/armada-370-netgear-rn104.dts
-index 4e27587..da406c1 100644
---- a/arch/arm/boot/dts/armada-370-netgear-rn104.dts
-+++ b/arch/arm/boot/dts/armada-370-netgear-rn104.dts
-@@ -146,6 +146,10 @@
- 				marvell,nand-enable-arbiter;
- 				nand-on-flash-bbt;
- 
-+				/* Use Hardware BCH ECC */
-+				nand-ecc-strength = <4>;
-+				nand-ecc-step-size = <512>;
-+
- 				partition@0 {
- 					label = "u-boot";
- 					reg = <0x0000000 0x180000>;  /* 1.5MB */
-diff --git a/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts b/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts
-index ff049ee..b4aba09 100644
---- a/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts
-+++ b/arch/arm/boot/dts/armada-xp-netgear-rn2120.dts
-@@ -224,6 +224,10 @@
- 				marvell,nand-enable-arbiter;
- 				nand-on-flash-bbt;
- 
-+				/* Use Hardware BCH ECC */
-+				nand-ecc-strength = <4>;
-+				nand-ecc-step-size = <512>;
-+
- 				partition@0 {
- 					label = "u-boot";
- 					reg = <0x0000000 0x180000>;  /* 1.5MB */
-diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
-index fece866..b8f234b 100644
---- a/arch/arm/boot/dts/at91sam9263.dtsi
-+++ b/arch/arm/boot/dts/at91sam9263.dtsi
-@@ -535,6 +535,7 @@
- 				compatible = "atmel,hsmci";
- 				reg = <0xfff80000 0x600>;
- 				interrupts = <10 IRQ_TYPE_LEVEL_HIGH 0>;
-+				pinctrl-names = "default";
- 				#address-cells = <1>;
- 				#size-cells = <0>;
- 				status = "disabled";
-@@ -544,6 +545,7 @@
- 				compatible = "atmel,hsmci";
- 				reg = <0xfff84000 0x600>;
- 				interrupts = <11 IRQ_TYPE_LEVEL_HIGH 0>;
-+				pinctrl-names = "default";
- 				#address-cells = <1>;
- 				#size-cells = <0>;
- 				status = "disabled";
-diff --git a/arch/arm/boot/dts/sama5d3_can.dtsi b/arch/arm/boot/dts/sama5d3_can.dtsi
-index a077585..eaf4145 100644
---- a/arch/arm/boot/dts/sama5d3_can.dtsi
-+++ b/arch/arm/boot/dts/sama5d3_can.dtsi
-@@ -40,7 +40,7 @@
- 						atmel,clk-output-range = <0 66000000>;
- 					};
- 
--					can1_clk: can0_clk {
-+					can1_clk: can1_clk {
- 						#clock-cells = <0>;
- 						reg = <41>;
- 						atmel,clk-output-range = <0 66000000>;
-diff --git a/arch/arm/mach-at91/clock.c b/arch/arm/mach-at91/clock.c
-index 034529d..d66f102 100644
---- a/arch/arm/mach-at91/clock.c
-+++ b/arch/arm/mach-at91/clock.c
-@@ -962,6 +962,7 @@ static int __init at91_clock_reset(void)
- 	}
- 
- 	at91_pmc_write(AT91_PMC_SCDR, scdr);
-+	at91_pmc_write(AT91_PMC_PCDR, pcdr);
- 	if (cpu_is_sama5d3())
- 		at91_pmc_write(AT91_PMC_PCDR1, pcdr1);
- 
-diff --git a/arch/arm64/include/asm/compat.h b/arch/arm64/include/asm/compat.h
-index fda2704..e72289a 100644
---- a/arch/arm64/include/asm/compat.h
-+++ b/arch/arm64/include/asm/compat.h
-@@ -37,8 +37,8 @@ typedef s32		compat_ssize_t;
- typedef s32		compat_time_t;
- typedef s32		compat_clock_t;
- typedef s32		compat_pid_t;
--typedef u32		__compat_uid_t;
--typedef u32		__compat_gid_t;
-+typedef u16		__compat_uid_t;
-+typedef u16		__compat_gid_t;
- typedef u16		__compat_uid16_t;
- typedef u16		__compat_gid16_t;
- typedef u32		__compat_uid32_t;
-diff --git a/arch/m68k/mm/hwtest.c b/arch/m68k/mm/hwtest.c
-index 2c7dde3..2a5259f 100644
---- a/arch/m68k/mm/hwtest.c
-+++ b/arch/m68k/mm/hwtest.c
-@@ -28,9 +28,11 @@
- int hwreg_present( volatile void *regp )
- {
-     int	ret = 0;
-+    unsigned long flags;
-     long	save_sp, save_vbr;
-     long	tmp_vectors[3];
- 
-+    local_irq_save(flags);
-     __asm__ __volatile__
- 	(	"movec	%/vbr,%2\n\t"
- 		"movel	#Lberr1,%4@(8)\n\t"
-@@ -46,6 +48,7 @@ int hwreg_present( volatile void *regp )
- 		: "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
- 		: "a" (regp), "a" (tmp_vectors)
-                 );
-+    local_irq_restore(flags);
- 
-     return( ret );
- }
-@@ -58,9 +61,11 @@ EXPORT_SYMBOL(hwreg_present);
- int hwreg_write( volatile void *regp, unsigned short val )
- {
- 	int		ret;
-+	unsigned long flags;
- 	long	save_sp, save_vbr;
- 	long	tmp_vectors[3];
- 
-+	local_irq_save(flags);
- 	__asm__ __volatile__
- 	(	"movec	%/vbr,%2\n\t"
- 		"movel	#Lberr2,%4@(8)\n\t"
-@@ -78,6 +83,7 @@ int hwreg_write( volatile void *regp, unsigned short val )
- 		: "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
- 		: "a" (regp), "a" (tmp_vectors), "g" (val)
- 	);
-+	local_irq_restore(flags);
- 
- 	return( ret );
- }
-diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
-index 4642d6a..de1ec54 100644
---- a/arch/powerpc/platforms/pseries/iommu.c
-+++ b/arch/powerpc/platforms/pseries/iommu.c
-@@ -329,16 +329,16 @@ struct direct_window {
- 
- /* Dynamic DMA Window support */
- struct ddw_query_response {
--	__be32 windows_available;
--	__be32 largest_available_block;
--	__be32 page_size;
--	__be32 migration_capable;
-+	u32 windows_available;
-+	u32 largest_available_block;
-+	u32 page_size;
-+	u32 migration_capable;
- };
- 
- struct ddw_create_response {
--	__be32 liobn;
--	__be32 addr_hi;
--	__be32 addr_lo;
-+	u32 liobn;
-+	u32 addr_hi;
-+	u32 addr_lo;
- };
- 
- static LIST_HEAD(direct_window_list);
-@@ -725,16 +725,18 @@ static void remove_ddw(struct device_node *np, bool remove_prop)
- {
- 	struct dynamic_dma_window_prop *dwp;
- 	struct property *win64;
--	const u32 *ddw_avail;
-+	u32 ddw_avail[3];
- 	u64 liobn;
--	int len, ret = 0;
-+	int ret = 0;
-+
-+	ret = of_property_read_u32_array(np, "ibm,ddw-applicable",
-+					 &ddw_avail[0], 3);
- 
--	ddw_avail = of_get_property(np, "ibm,ddw-applicable", &len);
- 	win64 = of_find_property(np, DIRECT64_PROPNAME, NULL);
- 	if (!win64)
- 		return;
- 
--	if (!ddw_avail || len < 3 * sizeof(u32) || win64->length < sizeof(*dwp))
-+	if (ret || win64->length < sizeof(*dwp))
- 		goto delprop;
- 
- 	dwp = win64->value;
-@@ -872,8 +874,9 @@ static int create_ddw(struct pci_dev *dev, const u32 *ddw_avail,
- 
- 	do {
- 		/* extra outputs are LIOBN and dma-addr (hi, lo) */
--		ret = rtas_call(ddw_avail[1], 5, 4, (u32 *)create, cfg_addr,
--				BUID_HI(buid), BUID_LO(buid), page_shift, window_shift);
-+		ret = rtas_call(ddw_avail[1], 5, 4, (u32 *)create,
-+				cfg_addr, BUID_HI(buid), BUID_LO(buid),
-+				page_shift, window_shift);
- 	} while (rtas_busy_delay(ret));
- 	dev_info(&dev->dev,
- 		"ibm,create-pe-dma-window(%x) %x %x %x %x %x returned %d "
-@@ -910,7 +913,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- 	int page_shift;
- 	u64 dma_addr, max_addr;
- 	struct device_node *dn;
--	const u32 *uninitialized_var(ddw_avail);
-+	u32 ddw_avail[3];
- 	struct direct_window *window;
- 	struct property *win64;
- 	struct dynamic_dma_window_prop *ddwprop;
-@@ -942,8 +945,9 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- 	 * for the given node in that order.
- 	 * the property is actually in the parent, not the PE
- 	 */
--	ddw_avail = of_get_property(pdn, "ibm,ddw-applicable", &len);
--	if (!ddw_avail || len < 3 * sizeof(u32))
-+	ret = of_property_read_u32_array(pdn, "ibm,ddw-applicable",
-+					 &ddw_avail[0], 3);
-+	if (ret)
- 		goto out_failed;
- 
-        /*
-@@ -966,11 +970,11 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- 		dev_dbg(&dev->dev, "no free dynamic windows");
- 		goto out_failed;
- 	}
--	if (be32_to_cpu(query.page_size) & 4) {
-+	if (query.page_size & 4) {
- 		page_shift = 24; /* 16MB */
--	} else if (be32_to_cpu(query.page_size) & 2) {
-+	} else if (query.page_size & 2) {
- 		page_shift = 16; /* 64kB */
--	} else if (be32_to_cpu(query.page_size) & 1) {
-+	} else if (query.page_size & 1) {
- 		page_shift = 12; /* 4kB */
- 	} else {
- 		dev_dbg(&dev->dev, "no supported direct page size in mask %x",
-@@ -980,7 +984,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- 	/* verify the window * number of ptes will map the partition */
- 	/* check largest block * page size > max memory hotplug addr */
- 	max_addr = memory_hotplug_max();
--	if (be32_to_cpu(query.largest_available_block) < (max_addr >> page_shift)) {
-+	if (query.largest_available_block < (max_addr >> page_shift)) {
- 		dev_dbg(&dev->dev, "can't map partiton max 0x%llx with %u "
- 			  "%llu-sized pages\n", max_addr,  query.largest_available_block,
- 			  1ULL << page_shift);
-@@ -1006,8 +1010,9 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- 	if (ret != 0)
- 		goto out_free_prop;
- 
--	ddwprop->liobn = create.liobn;
--	ddwprop->dma_base = cpu_to_be64(of_read_number(&create.addr_hi, 2));
-+	ddwprop->liobn = cpu_to_be32(create.liobn);
-+	ddwprop->dma_base = cpu_to_be64(((u64)create.addr_hi << 32) |
-+			create.addr_lo);
- 	ddwprop->tce_shift = cpu_to_be32(page_shift);
- 	ddwprop->window_shift = cpu_to_be32(len);
- 
-@@ -1039,7 +1044,7 @@ static u64 enable_ddw(struct pci_dev *dev, struct device_node *pdn)
- 	list_add(&window->list, &direct_window_list);
- 	spin_unlock(&direct_window_list_lock);
- 
--	dma_addr = of_read_number(&create.addr_hi, 2);
-+	dma_addr = be64_to_cpu(ddwprop->dma_base);
- 	goto out_unlock;
- 
- out_free_window:
-diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
-index 5f79d2d..f1ba119 100644
---- a/arch/s390/kvm/interrupt.c
-+++ b/arch/s390/kvm/interrupt.c
-@@ -71,6 +71,7 @@ static int __interrupt_is_deliverable(struct kvm_vcpu *vcpu,
- 			return 0;
- 		if (vcpu->arch.sie_block->gcr[0] & 0x2000ul)
- 			return 1;
-+		return 0;
- 	case KVM_S390_INT_EMERGENCY:
- 		if (psw_extint_disabled(vcpu))
- 			return 0;
-diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
-index b398c68..a38513c 100644
---- a/arch/sparc/Kconfig
-+++ b/arch/sparc/Kconfig
-@@ -67,6 +67,7 @@ config SPARC64
- 	select HAVE_SYSCALL_TRACEPOINTS
- 	select HAVE_CONTEXT_TRACKING
- 	select HAVE_DEBUG_KMEMLEAK
-+	select SPARSE_IRQ
- 	select RTC_DRV_CMOS
- 	select RTC_DRV_BQ4802
- 	select RTC_DRV_SUN4V
-diff --git a/arch/sparc/include/asm/hypervisor.h b/arch/sparc/include/asm/hypervisor.h
-index ca121f0..17be9d6 100644
---- a/arch/sparc/include/asm/hypervisor.h
-+++ b/arch/sparc/include/asm/hypervisor.h
-@@ -2944,6 +2944,16 @@ extern unsigned long sun4v_vt_set_perfreg(unsigned long reg_num,
- 					  unsigned long reg_val);
- #endif
- 
-+#define	HV_FAST_T5_GET_PERFREG		0x1a8
-+#define	HV_FAST_T5_SET_PERFREG		0x1a9
-+
-+#ifndef	__ASSEMBLY__
-+unsigned long sun4v_t5_get_perfreg(unsigned long reg_num,
-+				   unsigned long *reg_val);
-+unsigned long sun4v_t5_set_perfreg(unsigned long reg_num,
-+				   unsigned long reg_val);
-+#endif
-+
- /* Function numbers for HV_CORE_TRAP.  */
- #define HV_CORE_SET_VER			0x00
- #define HV_CORE_PUTCHAR			0x01
-@@ -2975,6 +2985,7 @@ extern unsigned long sun4v_vt_set_perfreg(unsigned long reg_num,
- #define HV_GRP_VF_CPU			0x0205
- #define HV_GRP_KT_CPU			0x0209
- #define HV_GRP_VT_CPU			0x020c
-+#define HV_GRP_T5_CPU			0x0211
- #define HV_GRP_DIAG			0x0300
- 
- #ifndef __ASSEMBLY__
-diff --git a/arch/sparc/include/asm/irq_64.h b/arch/sparc/include/asm/irq_64.h
-index abf6afe..3deb07f 100644
---- a/arch/sparc/include/asm/irq_64.h
-+++ b/arch/sparc/include/asm/irq_64.h
-@@ -37,7 +37,7 @@
-  *
-  * ino_bucket->irq allocation is made during {sun4v_,}build_irq().
-  */
--#define NR_IRQS    255
-+#define NR_IRQS		(2048)
- 
- extern void irq_install_pre_handler(int irq,
- 				    void (*func)(unsigned int, void *, void *),
-@@ -57,11 +57,8 @@ extern unsigned int sun4u_build_msi(u32 portid, unsigned int *irq_p,
- 				    unsigned long iclr_base);
- extern void sun4u_destroy_msi(unsigned int irq);
- 
--extern unsigned char irq_alloc(unsigned int dev_handle,
--				    unsigned int dev_ino);
--#ifdef CONFIG_PCI_MSI
--extern void irq_free(unsigned int irq);
--#endif
-+unsigned int irq_alloc(unsigned int dev_handle, unsigned int dev_ino);
-+void irq_free(unsigned int irq);
- 
- extern void __init init_IRQ(void);
- extern void fixup_irqs(void);
-diff --git a/arch/sparc/include/asm/ldc.h b/arch/sparc/include/asm/ldc.h
-index bdb524a..8732ed3 100644
---- a/arch/sparc/include/asm/ldc.h
-+++ b/arch/sparc/include/asm/ldc.h
-@@ -53,13 +53,14 @@ struct ldc_channel;
- /* Allocate state for a channel.  */
- extern struct ldc_channel *ldc_alloc(unsigned long id,
- 				     const struct ldc_channel_config *cfgp,
--				     void *event_arg);
-+				     void *event_arg,
-+				     const char *name);
- 
- /* Shut down and free state for a channel.  */
- extern void ldc_free(struct ldc_channel *lp);
- 
- /* Register TX and RX queues of the link with the hypervisor.  */
--extern int ldc_bind(struct ldc_channel *lp, const char *name);
-+extern int ldc_bind(struct ldc_channel *lp);
- 
- /* For non-RAW protocols we need to complete a handshake before
-  * communication can proceed.  ldc_connect() does that, if the
-diff --git a/arch/sparc/include/asm/oplib_64.h b/arch/sparc/include/asm/oplib_64.h
-index a12dbe3..e48fdf4 100644
---- a/arch/sparc/include/asm/oplib_64.h
-+++ b/arch/sparc/include/asm/oplib_64.h
-@@ -62,7 +62,8 @@ struct linux_mem_p1275 {
- /* You must call prom_init() before using any of the library services,
-  * preferably as early as possible.  Pass it the romvec pointer.
-  */
--extern void prom_init(void *cif_handler, void *cif_stack);
-+extern void prom_init(void *cif_handler);
-+extern void prom_init_report(void);
- 
- /* Boot argument acquisition, returns the boot command line string. */
- extern char *prom_getbootargs(void);
-diff --git a/arch/sparc/include/asm/page_64.h b/arch/sparc/include/asm/page_64.h
-index aac53fc..b18e602 100644
---- a/arch/sparc/include/asm/page_64.h
-+++ b/arch/sparc/include/asm/page_64.h
-@@ -57,18 +57,21 @@ extern void copy_user_page(void *to, void *from, unsigned long vaddr, struct pag
- typedef struct { unsigned long pte; } pte_t;
- typedef struct { unsigned long iopte; } iopte_t;
- typedef struct { unsigned long pmd; } pmd_t;
-+typedef struct { unsigned long pud; } pud_t;
- typedef struct { unsigned long pgd; } pgd_t;
- typedef struct { unsigned long pgprot; } pgprot_t;
- 
- #define pte_val(x)	((x).pte)
- #define iopte_val(x)	((x).iopte)
- #define pmd_val(x)      ((x).pmd)
-+#define pud_val(x)      ((x).pud)
- #define pgd_val(x)	((x).pgd)
- #define pgprot_val(x)	((x).pgprot)
- 
- #define __pte(x)	((pte_t) { (x) } )
- #define __iopte(x)	((iopte_t) { (x) } )
- #define __pmd(x)        ((pmd_t) { (x) } )
-+#define __pud(x)        ((pud_t) { (x) } )
- #define __pgd(x)	((pgd_t) { (x) } )
- #define __pgprot(x)	((pgprot_t) { (x) } )
- 
-@@ -77,18 +80,21 @@ typedef struct { unsigned long pgprot; } pgprot_t;
- typedef unsigned long pte_t;
- typedef unsigned long iopte_t;
- typedef unsigned long pmd_t;
-+typedef unsigned long pud_t;
- typedef unsigned long pgd_t;
- typedef unsigned long pgprot_t;
- 
- #define pte_val(x)	(x)
- #define iopte_val(x)	(x)
- #define pmd_val(x)      (x)
-+#define pud_val(x)      (x)
- #define pgd_val(x)	(x)
- #define pgprot_val(x)	(x)
- 
- #define __pte(x)	(x)
- #define __iopte(x)	(x)
- #define __pmd(x)        (x)
-+#define __pud(x)        (x)
- #define __pgd(x)	(x)
- #define __pgprot(x)	(x)
- 
-@@ -96,21 +102,14 @@ typedef unsigned long pgprot_t;
- 
- typedef pte_t *pgtable_t;
- 
--/* These two values define the virtual address space range in which we
-- * must forbid 64-bit user processes from making mappings.  It used to
-- * represent precisely the virtual address space hole present in most
-- * early sparc64 chips including UltraSPARC-I.  But now it also is
-- * further constrained by the limits of our page tables, which is
-- * 43-bits of virtual address.
-- */
--#define SPARC64_VA_HOLE_TOP	_AC(0xfffffc0000000000,UL)
--#define SPARC64_VA_HOLE_BOTTOM	_AC(0x0000040000000000,UL)
-+extern unsigned long sparc64_va_hole_top;
-+extern unsigned long sparc64_va_hole_bottom;
- 
- /* The next two defines specify the actual exclusion region we
-  * enforce, wherein we use a 4GB red zone on each side of the VA hole.
-  */
--#define VA_EXCLUDE_START (SPARC64_VA_HOLE_BOTTOM - (1UL << 32UL))
--#define VA_EXCLUDE_END   (SPARC64_VA_HOLE_TOP + (1UL << 32UL))
-+#define VA_EXCLUDE_START (sparc64_va_hole_bottom - (1UL << 32UL))
-+#define VA_EXCLUDE_END   (sparc64_va_hole_top + (1UL << 32UL))
- 
- #define TASK_UNMAPPED_BASE	(test_thread_flag(TIF_32BIT) ? \
- 				 _AC(0x0000000070000000,UL) : \
-@@ -118,20 +117,16 @@ typedef pte_t *pgtable_t;
- 
- #include <asm-generic/memory_model.h>
- 
--#define PAGE_OFFSET_BY_BITS(X)	(-(_AC(1,UL) << (X)))
- extern unsigned long PAGE_OFFSET;
- 
- #endif /* !(__ASSEMBLY__) */
- 
--/* The maximum number of physical memory address bits we support, this
-- * is used to size various tables used to manage kernel TLB misses and
-- * also the sparsemem code.
-+/* The maximum number of physical memory address bits we support.  The
-+ * largest value we can support is whatever "KPGD_SHIFT + KPTE_BITS"
-+ * evaluates to.
-  */
--#define MAX_PHYS_ADDRESS_BITS	47
-+#define MAX_PHYS_ADDRESS_BITS	53
- 
--/* These two shift counts are used when indexing sparc64_valid_addr_bitmap
-- * and kpte_linear_bitmap.
-- */
- #define ILOG2_4MB		22
- #define ILOG2_256MB		28
- 
-diff --git a/arch/sparc/include/asm/pgalloc_64.h b/arch/sparc/include/asm/pgalloc_64.h
-index bcfe063..2c8d41f 100644
---- a/arch/sparc/include/asm/pgalloc_64.h
-+++ b/arch/sparc/include/asm/pgalloc_64.h
-@@ -15,6 +15,13 @@
- 
- extern struct kmem_cache *pgtable_cache;
- 
-+static inline void __pgd_populate(pgd_t *pgd, pud_t *pud)
-+{
-+	pgd_set(pgd, pud);
-+}
-+
-+#define pgd_populate(MM, PGD, PUD)	__pgd_populate(PGD, PUD)
-+
- static inline pgd_t *pgd_alloc(struct mm_struct *mm)
- {
- 	return kmem_cache_alloc(pgtable_cache, GFP_KERNEL);
-@@ -25,7 +32,23 @@ static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd)
- 	kmem_cache_free(pgtable_cache, pgd);
- }
- 
--#define pud_populate(MM, PUD, PMD)	pud_set(PUD, PMD)
-+static inline void __pud_populate(pud_t *pud, pmd_t *pmd)
-+{
-+	pud_set(pud, pmd);
-+}
-+
-+#define pud_populate(MM, PUD, PMD)	__pud_populate(PUD, PMD)
-+
-+static inline pud_t *pud_alloc_one(struct mm_struct *mm, unsigned long addr)
-+{
-+	return kmem_cache_alloc(pgtable_cache,
-+				GFP_KERNEL|__GFP_REPEAT);
-+}
-+
-+static inline void pud_free(struct mm_struct *mm, pud_t *pud)
-+{
-+	kmem_cache_free(pgtable_cache, pud);
-+}
- 
- static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long addr)
- {
-@@ -91,4 +114,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pte_t *pte,
- #define __pmd_free_tlb(tlb, pmd, addr)		      \
- 	pgtable_free_tlb(tlb, pmd, false)
- 
-+#define __pud_free_tlb(tlb, pud, addr)		      \
-+	pgtable_free_tlb(tlb, pud, false)
-+
- #endif /* _SPARC64_PGALLOC_H */
-diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
-index 1a49ffd..e8dfabf 100644
---- a/arch/sparc/include/asm/pgtable_64.h
-+++ b/arch/sparc/include/asm/pgtable_64.h
-@@ -20,8 +20,6 @@
- #include <asm/page.h>
- #include <asm/processor.h>
- 
--#include <asm-generic/pgtable-nopud.h>
--
- /* The kernel image occupies 0x4000000 to 0x6000000 (4MB --> 96MB).
-  * The page copy blockops can use 0x6000000 to 0x8000000.
-  * The 8K TSB is mapped in the 0x8000000 to 0x8400000 range.
-@@ -42,10 +40,7 @@
- #define LOW_OBP_ADDRESS		_AC(0x00000000f0000000,UL)
- #define HI_OBP_ADDRESS		_AC(0x0000000100000000,UL)
- #define VMALLOC_START		_AC(0x0000000100000000,UL)
--#define VMALLOC_END		_AC(0x0000010000000000,UL)
--#define VMEMMAP_BASE		_AC(0x0000010000000000,UL)
--
--#define vmemmap			((struct page *)VMEMMAP_BASE)
-+#define VMEMMAP_BASE		VMALLOC_END
- 
- /* PMD_SHIFT determines the size of the area a second-level page
-  * table can map
-@@ -55,13 +50,25 @@
- #define PMD_MASK	(~(PMD_SIZE-1))
- #define PMD_BITS	(PAGE_SHIFT - 3)
- 
--/* PGDIR_SHIFT determines what a third-level page table entry can map */
--#define PGDIR_SHIFT	(PAGE_SHIFT + (PAGE_SHIFT-3) + PMD_BITS)
-+/* PUD_SHIFT determines the size of the area a third-level page
-+ * table can map
-+ */
-+#define PUD_SHIFT	(PMD_SHIFT + PMD_BITS)
-+#define PUD_SIZE	(_AC(1,UL) << PUD_SHIFT)
-+#define PUD_MASK	(~(PUD_SIZE-1))
-+#define PUD_BITS	(PAGE_SHIFT - 3)
-+
-+/* PGDIR_SHIFT determines what a fourth-level page table entry can map */
-+#define PGDIR_SHIFT	(PUD_SHIFT + PUD_BITS)
- #define PGDIR_SIZE	(_AC(1,UL) << PGDIR_SHIFT)
- #define PGDIR_MASK	(~(PGDIR_SIZE-1))
- #define PGDIR_BITS	(PAGE_SHIFT - 3)
- 
--#if (PGDIR_SHIFT + PGDIR_BITS) != 43
-+#if (MAX_PHYS_ADDRESS_BITS > PGDIR_SHIFT + PGDIR_BITS)
-+#error MAX_PHYS_ADDRESS_BITS exceeds what kernel page tables can support
-+#endif
-+
-+#if (PGDIR_SHIFT + PGDIR_BITS) != 53
- #error Page table parameters do not cover virtual address space properly.
- #endif
- 
-@@ -71,28 +78,18 @@
- 
- #ifndef __ASSEMBLY__
- 
--#include <linux/sched.h>
--
--extern unsigned long sparc64_valid_addr_bitmap[];
-+extern unsigned long VMALLOC_END;
- 
--/* Needs to be defined here and not in linux/mm.h, as it is arch dependent */
--static inline bool __kern_addr_valid(unsigned long paddr)
--{
--	if ((paddr >> MAX_PHYS_ADDRESS_BITS) != 0UL)
--		return false;
--	return test_bit(paddr >> ILOG2_4MB, sparc64_valid_addr_bitmap);
--}
-+#define vmemmap			((struct page *)VMEMMAP_BASE)
- 
--static inline bool kern_addr_valid(unsigned long addr)
--{
--	unsigned long paddr = __pa(addr);
-+#include <linux/sched.h>
- 
--	return __kern_addr_valid(paddr);
--}
-+bool kern_addr_valid(unsigned long addr);
- 
- /* Entries per page directory level. */
- #define PTRS_PER_PTE	(1UL << (PAGE_SHIFT-3))
- #define PTRS_PER_PMD	(1UL << PMD_BITS)
-+#define PTRS_PER_PUD	(1UL << PUD_BITS)
- #define PTRS_PER_PGD	(1UL << PGDIR_BITS)
- 
- /* Kernel has a separate 44bit address space. */
-@@ -101,6 +98,9 @@ static inline bool kern_addr_valid(unsigned long addr)
- #define pmd_ERROR(e)							\
- 	pr_err("%s:%d: bad pmd %p(%016lx) seen at (%pS)\n",		\
- 	       __FILE__, __LINE__, &(e), pmd_val(e), __builtin_return_address(0))
-+#define pud_ERROR(e)							\
-+	pr_err("%s:%d: bad pud %p(%016lx) seen at (%pS)\n",		\
-+	       __FILE__, __LINE__, &(e), pud_val(e), __builtin_return_address(0))
- #define pgd_ERROR(e)							\
- 	pr_err("%s:%d: bad pgd %p(%016lx) seen at (%pS)\n",		\
- 	       __FILE__, __LINE__, &(e), pgd_val(e), __builtin_return_address(0))
-@@ -112,6 +112,7 @@ static inline bool kern_addr_valid(unsigned long addr)
- #define _PAGE_R	  	  _AC(0x8000000000000000,UL) /* Keep ref bit uptodate*/
- #define _PAGE_SPECIAL     _AC(0x0200000000000000,UL) /* Special page         */
- #define _PAGE_PMD_HUGE    _AC(0x0100000000000000,UL) /* Huge page            */
-+#define _PAGE_PUD_HUGE    _PAGE_PMD_HUGE
- 
- /* Advertise support for _PAGE_SPECIAL */
- #define __HAVE_ARCH_PTE_SPECIAL
-@@ -658,26 +659,26 @@ static inline unsigned long pmd_large(pmd_t pmd)
- 	return pte_val(pte) & _PAGE_PMD_HUGE;
- }
- 
--#ifdef CONFIG_TRANSPARENT_HUGEPAGE
--static inline unsigned long pmd_young(pmd_t pmd)
-+static inline unsigned long pmd_pfn(pmd_t pmd)
- {
- 	pte_t pte = __pte(pmd_val(pmd));
- 
--	return pte_young(pte);
-+	return pte_pfn(pte);
- }
- 
--static inline unsigned long pmd_write(pmd_t pmd)
-+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
-+static inline unsigned long pmd_young(pmd_t pmd)
- {
- 	pte_t pte = __pte(pmd_val(pmd));
- 
--	return pte_write(pte);
-+	return pte_young(pte);
- }
- 
--static inline unsigned long pmd_pfn(pmd_t pmd)
-+static inline unsigned long pmd_write(pmd_t pmd)
- {
- 	pte_t pte = __pte(pmd_val(pmd));
- 
--	return pte_pfn(pte);
-+	return pte_write(pte);
- }
- 
- static inline unsigned long pmd_trans_huge(pmd_t pmd)
-@@ -771,13 +772,15 @@ static inline int pmd_present(pmd_t pmd)
-  * the top bits outside of the range of any physical address size we
-  * support are clear as well.  We also validate the physical itself.
-  */
--#define pmd_bad(pmd)			((pmd_val(pmd) & ~PAGE_MASK) || \
--					 !__kern_addr_valid(pmd_val(pmd)))
-+#define pmd_bad(pmd)			(pmd_val(pmd) & ~PAGE_MASK)
- 
- #define pud_none(pud)			(!pud_val(pud))
- 
--#define pud_bad(pud)			((pud_val(pud) & ~PAGE_MASK) || \
--					 !__kern_addr_valid(pud_val(pud)))
-+#define pud_bad(pud)			(pud_val(pud) & ~PAGE_MASK)
-+
-+#define pgd_none(pgd)			(!pgd_val(pgd))
-+
-+#define pgd_bad(pgd)			(pgd_val(pgd) & ~PAGE_MASK)
- 
- #ifdef CONFIG_TRANSPARENT_HUGEPAGE
- extern void set_pmd_at(struct mm_struct *mm, unsigned long addr,
-@@ -815,10 +818,31 @@ static inline unsigned long __pmd_page(pmd_t pmd)
- #define pmd_clear(pmdp)			(pmd_val(*(pmdp)) = 0UL)
- #define pud_present(pud)		(pud_val(pud) != 0U)
- #define pud_clear(pudp)			(pud_val(*(pudp)) = 0UL)
-+#define pgd_page_vaddr(pgd)		\
-+	((unsigned long) __va(pgd_val(pgd)))
-+#define pgd_present(pgd)		(pgd_val(pgd) != 0U)
-+#define pgd_clear(pgdp)			(pgd_val(*(pgd)) = 0UL)
-+
-+static inline unsigned long pud_large(pud_t pud)
-+{
-+	pte_t pte = __pte(pud_val(pud));
-+
-+	return pte_val(pte) & _PAGE_PMD_HUGE;
-+}
-+
-+static inline unsigned long pud_pfn(pud_t pud)
-+{
-+	pte_t pte = __pte(pud_val(pud));
-+
-+	return pte_pfn(pte);
-+}
- 
- /* Same in both SUN4V and SUN4U.  */
- #define pte_none(pte) 			(!pte_val(pte))
- 
-+#define pgd_set(pgdp, pudp)	\
-+	(pgd_val(*(pgdp)) = (__pa((unsigned long) (pudp))))
-+
- /* to find an entry in a page-table-directory. */
- #define pgd_index(address)	(((address) >> PGDIR_SHIFT) & (PTRS_PER_PGD - 1))
- #define pgd_offset(mm, address)	((mm)->pgd + pgd_index(address))
-@@ -826,6 +850,11 @@ static inline unsigned long __pmd_page(pmd_t pmd)
- /* to find an entry in a kernel page-table-directory */
- #define pgd_offset_k(address) pgd_offset(&init_mm, address)
- 
-+/* Find an entry in the third-level page table.. */
-+#define pud_index(address)	(((address) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
-+#define pud_offset(pgdp, address)	\
-+	((pud_t *) pgd_page_vaddr(*(pgdp)) + pud_index(address))
-+
- /* Find an entry in the second-level page table.. */
- #define pmd_offset(pudp, address)	\
- 	((pmd_t *) pud_page_vaddr(*(pudp)) + \
-@@ -898,7 +927,6 @@ static inline void __set_pte_at(struct mm_struct *mm, unsigned long addr,
- #endif
- 
- extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
--extern pmd_t swapper_low_pmd_dir[PTRS_PER_PMD];
- 
- extern void paging_init(void);
- extern unsigned long find_ecache_flush_span(unsigned long size);
-diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h
-index 5e35e05..acd6146 100644
---- a/arch/sparc/include/asm/setup.h
-+++ b/arch/sparc/include/asm/setup.h
-@@ -24,6 +24,10 @@ static inline int con_is_present(void)
- }
- #endif
- 
-+#ifdef CONFIG_SPARC64
-+extern void __init start_early_boot(void);
-+#endif
-+
- extern void sun_do_break(void);
- extern int stop_a_enabled;
- extern int scons_pwroff;
-diff --git a/arch/sparc/include/asm/spitfire.h b/arch/sparc/include/asm/spitfire.h
-index 6b67e50..69424d4 100644
---- a/arch/sparc/include/asm/spitfire.h
-+++ b/arch/sparc/include/asm/spitfire.h
-@@ -45,6 +45,8 @@
- #define SUN4V_CHIP_NIAGARA3	0x03
- #define SUN4V_CHIP_NIAGARA4	0x04
- #define SUN4V_CHIP_NIAGARA5	0x05
-+#define SUN4V_CHIP_SPARC_M6	0x06
-+#define SUN4V_CHIP_SPARC_M7	0x07
- #define SUN4V_CHIP_SPARC64X	0x8a
- #define SUN4V_CHIP_UNKNOWN	0xff
- 
-diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
-index a5f01ac..cc6275c 100644
---- a/arch/sparc/include/asm/thread_info_64.h
-+++ b/arch/sparc/include/asm/thread_info_64.h
-@@ -63,7 +63,8 @@ struct thread_info {
- 	struct pt_regs		*kern_una_regs;
- 	unsigned int		kern_una_insn;
- 
--	unsigned long		fpregs[0] __attribute__ ((aligned(64)));
-+	unsigned long		fpregs[(7 * 256) / sizeof(unsigned long)]
-+		__attribute__ ((aligned(64)));
- };
- 
- #endif /* !(__ASSEMBLY__) */
-@@ -102,6 +103,7 @@ struct thread_info {
- #define FAULT_CODE_ITLB		0x04	/* Miss happened in I-TLB	   */
- #define FAULT_CODE_WINFIXUP	0x08	/* Miss happened during spill/fill */
- #define FAULT_CODE_BLKCOMMIT	0x10	/* Use blk-commit ASI in copy_page */
-+#define	FAULT_CODE_BAD_RA	0x20	/* Bad RA for sun4v		   */
- 
- #if PAGE_SHIFT == 13
- #define THREAD_SIZE (2*PAGE_SIZE)
-diff --git a/arch/sparc/include/asm/tsb.h b/arch/sparc/include/asm/tsb.h
-index 90916f9..ecb49cf 100644
---- a/arch/sparc/include/asm/tsb.h
-+++ b/arch/sparc/include/asm/tsb.h
-@@ -133,9 +133,24 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- 	sub	TSB, 0x8, TSB;   \
- 	TSB_STORE(TSB, TAG);
- 
--	/* Do a kernel page table walk.  Leaves physical PTE pointer in
--	 * REG1.  Jumps to FAIL_LABEL on early page table walk termination.
--	 * VADDR will not be clobbered, but REG2 will.
-+	/* Do a kernel page table walk.  Leaves valid PTE value in
-+	 * REG1.  Jumps to FAIL_LABEL on early page table walk
-+	 * termination.  VADDR will not be clobbered, but REG2 will.
-+	 *
-+	 * There are two masks we must apply to propagate bits from
-+	 * the virtual address into the PTE physical address field
-+	 * when dealing with huge pages.  This is because the page
-+	 * table boundaries do not match the huge page size(s) the
-+	 * hardware supports.
-+	 *
-+	 * In these cases we propagate the bits that are below the
-+	 * page table level where we saw the huge page mapping, but
-+	 * are still within the relevant physical bits for the huge
-+	 * page size in question.  So for PMD mappings (which fall on
-+	 * bit 23, for 8MB per PMD) we must propagate bit 22 for a
-+	 * 4MB huge page.  For huge PUDs (which fall on bit 33, for
-+	 * 8GB per PUD), we have to accomodate 256MB and 2GB huge
-+	 * pages.  So for those we propagate bits 32 to 28.
- 	 */
- #define KERN_PGTABLE_WALK(VADDR, REG1, REG2, FAIL_LABEL)	\
- 	sethi		%hi(swapper_pg_dir), REG1; \
-@@ -145,15 +160,40 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- 	andn		REG2, 0x7, REG2; \
- 	ldx		[REG1 + REG2], REG1; \
- 	brz,pn		REG1, FAIL_LABEL; \
--	 sllx		VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
-+	 sllx		VADDR, 64 - (PUD_SHIFT + PUD_BITS), REG2; \
- 	srlx		REG2, 64 - PAGE_SHIFT, REG2; \
- 	andn		REG2, 0x7, REG2; \
- 	ldxa		[REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
- 	brz,pn		REG1, FAIL_LABEL; \
--	 sllx		VADDR, 64 - PMD_SHIFT, REG2; \
-+	sethi		%uhi(_PAGE_PUD_HUGE), REG2; \
-+	brz,pn		REG1, FAIL_LABEL; \
-+	 sllx		REG2, 32, REG2; \
-+	andcc		REG1, REG2, %g0; \
-+	sethi		%hi(0xf8000000), REG2; \
-+	bne,pt		%xcc, 697f; \
-+	 sllx		REG2, 1, REG2; \
-+	sllx		VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
- 	srlx		REG2, 64 - PAGE_SHIFT, REG2; \
- 	andn		REG2, 0x7, REG2; \
--	add		REG1, REG2, REG1;
-+	ldxa		[REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
-+	sethi		%uhi(_PAGE_PMD_HUGE), REG2; \
-+	brz,pn		REG1, FAIL_LABEL; \
-+	 sllx		REG2, 32, REG2; \
-+	andcc		REG1, REG2, %g0; \
-+	be,pn		%xcc, 698f; \
-+	 sethi		%hi(0x400000), REG2; \
-+697:	brgez,pn	REG1, FAIL_LABEL; \
-+	 andn		REG1, REG2, REG1; \
-+	and		VADDR, REG2, REG2; \
-+	ba,pt		%xcc, 699f; \
-+	 or		REG1, REG2, REG1; \
-+698:	sllx		VADDR, 64 - PMD_SHIFT, REG2; \
-+	srlx		REG2, 64 - PAGE_SHIFT, REG2; \
-+	andn		REG2, 0x7, REG2; \
-+	ldxa		[REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
-+	brgez,pn	REG1, FAIL_LABEL; \
-+	 nop; \
-+699:
- 
- 	/* PMD has been loaded into REG1, interpret the value, seeing
- 	 * if it is a HUGE PMD or a normal one.  If it is not valid
-@@ -198,6 +238,11 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- 	andn		REG2, 0x7, REG2; \
- 	ldxa		[PHYS_PGD + REG2] ASI_PHYS_USE_EC, REG1; \
- 	brz,pn		REG1, FAIL_LABEL; \
-+	 sllx		VADDR, 64 - (PUD_SHIFT + PUD_BITS), REG2; \
-+	srlx		REG2, 64 - PAGE_SHIFT, REG2; \
-+	andn		REG2, 0x7, REG2; \
-+	ldxa		[REG1 + REG2] ASI_PHYS_USE_EC, REG1; \
-+	brz,pn		REG1, FAIL_LABEL; \
- 	 sllx		VADDR, 64 - (PMD_SHIFT + PMD_BITS), REG2; \
- 	srlx		REG2, 64 - PAGE_SHIFT, REG2; \
- 	andn		REG2, 0x7, REG2; \
-@@ -246,8 +291,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- 	(KERNEL_TSB_SIZE_BYTES / 16)
- #define KERNEL_TSB4M_NENTRIES	4096
- 
--#define KTSB_PHYS_SHIFT		15
--
- 	/* Do a kernel TSB lookup at tl>0 on VADDR+TAG, branch to OK_LABEL
- 	 * on TSB hit.  REG1, REG2, REG3, and REG4 are used as temporaries
- 	 * and the found TTE will be left in REG1.  REG3 and REG4 must
-@@ -256,17 +299,15 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- 	 * VADDR and TAG will be preserved and not clobbered by this macro.
- 	 */
- #define KERN_TSB_LOOKUP_TL1(VADDR, TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
--661:	sethi		%hi(swapper_tsb), REG1;			\
--	or		REG1, %lo(swapper_tsb), REG1; \
-+661:	sethi		%uhi(swapper_tsb), REG1; \
-+	sethi		%hi(swapper_tsb), REG2; \
-+	or		REG1, %ulo(swapper_tsb), REG1; \
-+	or		REG2, %lo(swapper_tsb), REG2; \
- 	.section	.swapper_tsb_phys_patch, "ax"; \
- 	.word		661b; \
- 	.previous; \
--661:	nop; \
--	.section	.tsb_ldquad_phys_patch, "ax"; \
--	.word		661b; \
--	sllx		REG1, KTSB_PHYS_SHIFT, REG1; \
--	sllx		REG1, KTSB_PHYS_SHIFT, REG1; \
--	.previous; \
-+	sllx		REG1, 32, REG1; \
-+	or		REG1, REG2, REG1; \
- 	srlx		VADDR, PAGE_SHIFT, REG2; \
- 	and		REG2, (KERNEL_TSB_NENTRIES - 1), REG2; \
- 	sllx		REG2, 4, REG2; \
-@@ -281,17 +322,15 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
- 	 * we can make use of that for the index computation.
- 	 */
- #define KERN_TSB4M_LOOKUP_TL1(TAG, REG1, REG2, REG3, REG4, OK_LABEL) \
--661:	sethi		%hi(swapper_4m_tsb), REG1;	     \
--	or		REG1, %lo(swapper_4m_tsb), REG1; \
-+661:	sethi		%uhi(swapper_4m_tsb), REG1; \
-+	sethi		%hi(swapper_4m_tsb), REG2; \
-+	or		REG1, %ulo(swapper_4m_tsb), REG1; \
-+	or		REG2, %lo(swapper_4m_tsb), REG2; \
- 	.section	.swapper_4m_tsb_phys_patch, "ax"; \
- 	.word		661b; \
- 	.previous; \
--661:	nop; \
--	.section	.tsb_ldquad_phys_patch, "ax"; \
--	.word		661b; \
--	sllx		REG1, KTSB_PHYS_SHIFT, REG1; \
--	sllx		REG1, KTSB_PHYS_SHIFT, REG1; \
--	.previous; \
-+	sllx		REG1, 32, REG1; \
-+	or		REG1, REG2, REG1; \
- 	and		TAG, (KERNEL_TSB4M_NENTRIES - 1), REG2; \
- 	sllx		REG2, 4, REG2; \
- 	add		REG1, REG2, REG2; \
-diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
-index 39ca301..11fdf0e 100644
---- a/arch/sparc/include/asm/visasm.h
-+++ b/arch/sparc/include/asm/visasm.h
-@@ -39,6 +39,14 @@
- 297:	wr		%o5, FPRS_FEF, %fprs;		\
- 298:
- 
-+#define VISEntryHalfFast(fail_label)			\
-+	rd		%fprs, %o5;			\
-+	andcc		%o5, FPRS_FEF, %g0;		\
-+	be,pt		%icc, 297f;			\
-+	 nop;						\
-+	ba,a,pt		%xcc, fail_label;		\
-+297:	wr		%o5, FPRS_FEF, %fprs;
-+
- #define VISExitHalf					\
- 	wr		%o5, 0, %fprs;
- 
-diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
-index 5c51258..52e10de 100644
---- a/arch/sparc/kernel/cpu.c
-+++ b/arch/sparc/kernel/cpu.c
-@@ -493,6 +493,18 @@ static void __init sun4v_cpu_probe(void)
- 		sparc_pmu_type = "niagara5";
- 		break;
- 
-+	case SUN4V_CHIP_SPARC_M6:
-+		sparc_cpu_type = "SPARC-M6";
-+		sparc_fpu_type = "SPARC-M6 integrated FPU";
-+		sparc_pmu_type = "sparc-m6";
-+		break;
-+
-+	case SUN4V_CHIP_SPARC_M7:
-+		sparc_cpu_type = "SPARC-M7";
-+		sparc_fpu_type = "SPARC-M7 integrated FPU";
-+		sparc_pmu_type = "sparc-m7";
-+		break;
-+
- 	case SUN4V_CHIP_SPARC64X:
- 		sparc_cpu_type = "SPARC64-X";
- 		sparc_fpu_type = "SPARC64-X integrated FPU";
-diff --git a/arch/sparc/kernel/cpumap.c b/arch/sparc/kernel/cpumap.c
-index de1c844..e69ec0e 100644
---- a/arch/sparc/kernel/cpumap.c
-+++ b/arch/sparc/kernel/cpumap.c
-@@ -326,6 +326,8 @@ static int iterate_cpu(struct cpuinfo_tree *t, unsigned int root_index)
- 	case SUN4V_CHIP_NIAGARA3:
- 	case SUN4V_CHIP_NIAGARA4:
- 	case SUN4V_CHIP_NIAGARA5:
-+	case SUN4V_CHIP_SPARC_M6:
-+	case SUN4V_CHIP_SPARC_M7:
- 	case SUN4V_CHIP_SPARC64X:
- 		rover_inc_table = niagara_iterate_method;
- 		break;
-diff --git a/arch/sparc/kernel/ds.c b/arch/sparc/kernel/ds.c
-index dff60ab..f87a55d 100644
---- a/arch/sparc/kernel/ds.c
-+++ b/arch/sparc/kernel/ds.c
-@@ -1200,14 +1200,14 @@ static int ds_probe(struct vio_dev *vdev, const struct vio_device_id *id)
- 	ds_cfg.tx_irq = vdev->tx_irq;
- 	ds_cfg.rx_irq = vdev->rx_irq;
- 
--	lp = ldc_alloc(vdev->channel_id, &ds_cfg, dp);
-+	lp = ldc_alloc(vdev->channel_id, &ds_cfg, dp, "DS");
- 	if (IS_ERR(lp)) {
- 		err = PTR_ERR(lp);
- 		goto out_free_ds_states;
- 	}
- 	dp->lp = lp;
- 
--	err = ldc_bind(lp, "DS");
-+	err = ldc_bind(lp);
- 	if (err)
- 		goto out_free_ldc;
- 
-diff --git a/arch/sparc/kernel/dtlb_prot.S b/arch/sparc/kernel/dtlb_prot.S
-index b2c2c5b..d668ca14 100644
---- a/arch/sparc/kernel/dtlb_prot.S
-+++ b/arch/sparc/kernel/dtlb_prot.S
-@@ -24,11 +24,11 @@
- 	mov		TLB_TAG_ACCESS, %g4		! For reload of vaddr
- 
- /* PROT ** ICACHE line 2: More real fault processing */
-+	ldxa		[%g4] ASI_DMMU, %g5		! Put tagaccess in %g5
- 	bgu,pn		%xcc, winfix_trampoline		! Yes, perform winfixup
--	 ldxa		[%g4] ASI_DMMU, %g5		! Put tagaccess in %g5
--	ba,pt		%xcc, sparc64_realfault_common	! Nope, normal fault
- 	 mov		FAULT_CODE_DTLB | FAULT_CODE_WRITE, %g4
--	nop
-+	ba,pt		%xcc, sparc64_realfault_common	! Nope, normal fault
-+	 nop
- 	nop
- 	nop
- 	nop
-diff --git a/arch/sparc/kernel/entry.h b/arch/sparc/kernel/entry.h
-index 140966f..c88ffb9 100644
---- a/arch/sparc/kernel/entry.h
-+++ b/arch/sparc/kernel/entry.h
-@@ -66,13 +66,10 @@ struct pause_patch_entry {
- extern struct pause_patch_entry __pause_3insn_patch,
- 	__pause_3insn_patch_end;
- 
--extern void __init per_cpu_patch(void);
- extern void sun4v_patch_1insn_range(struct sun4v_1insn_patch_entry *,
- 				    struct sun4v_1insn_patch_entry *);
- extern void sun4v_patch_2insn_range(struct sun4v_2insn_patch_entry *,
- 				    struct sun4v_2insn_patch_entry *);
--extern void __init sun4v_patch(void);
--extern void __init boot_cpu_id_too_large(int cpu);
- extern unsigned int dcache_parity_tl1_occurred;
- extern unsigned int icache_parity_tl1_occurred;
- 
-diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
-index 452f04f..3d61fca 100644
---- a/arch/sparc/kernel/head_64.S
-+++ b/arch/sparc/kernel/head_64.S
-@@ -427,6 +427,12 @@ sun4v_chip_type:
- 	cmp	%g2, '5'
- 	be,pt	%xcc, 5f
- 	 mov	SUN4V_CHIP_NIAGARA5, %g4
-+	cmp	%g2, '6'
-+	be,pt	%xcc, 5f
-+	 mov	SUN4V_CHIP_SPARC_M6, %g4
-+	cmp	%g2, '7'
-+	be,pt	%xcc, 5f
-+	 mov	SUN4V_CHIP_SPARC_M7, %g4
- 	ba,pt	%xcc, 49f
- 	 nop
- 
-@@ -585,6 +591,12 @@ niagara_tlb_fixup:
- 	cmp	%g1, SUN4V_CHIP_NIAGARA5
- 	be,pt	%xcc, niagara4_patch
- 	 nop
-+	cmp	%g1, SUN4V_CHIP_SPARC_M6
-+	be,pt	%xcc, niagara4_patch
-+	 nop
-+	cmp	%g1, SUN4V_CHIP_SPARC_M7
-+	be,pt	%xcc, niagara4_patch
-+	 nop
- 
- 	call	generic_patch_copyops
- 	 nop
-@@ -660,14 +672,12 @@ tlb_fixup_done:
- 	sethi	%hi(init_thread_union), %g6
- 	or	%g6, %lo(init_thread_union), %g6
- 	ldx	[%g6 + TI_TASK], %g4
--	mov	%sp, %l6
- 
- 	wr	%g0, ASI_P, %asi
- 	mov	1, %g1
- 	sllx	%g1, THREAD_SHIFT, %g1
- 	sub	%g1, (STACKFRAME_SZ + STACK_BIAS), %g1
- 	add	%g6, %g1, %sp
--	mov	0, %fp
- 
- 	/* Set per-cpu pointer initially to zero, this makes
- 	 * the boot-cpu use the in-kernel-image per-cpu areas
-@@ -694,44 +704,14 @@ tlb_fixup_done:
- 	 nop
- #endif
- 
--	mov	%l6, %o1			! OpenPROM stack
- 	call	prom_init
- 	 mov	%l7, %o0			! OpenPROM cif handler
- 
--	/* Initialize current_thread_info()->cpu as early as possible.
--	 * In order to do that accurately we have to patch up the get_cpuid()
--	 * assembler sequences.  And that, in turn, requires that we know
--	 * if we are on a Starfire box or not.  While we're here, patch up
--	 * the sun4v sequences as well.
-+	/* To create a one-register-window buffer between the kernel's
-+	 * initial stack and the last stack frame we use from the firmware,
-+	 * do the rest of the boot from a C helper function.
- 	 */
--	call	check_if_starfire
--	 nop
--	call	per_cpu_patch
--	 nop
--	call	sun4v_patch
--	 nop
--
--#ifdef CONFIG_SMP
--	call	hard_smp_processor_id
--	 nop
--	cmp	%o0, NR_CPUS
--	blu,pt	%xcc, 1f
--	 nop
--	call	boot_cpu_id_too_large
--	 nop
--	/* Not reached... */
--
--1:
--#else
--	mov	0, %o0
--#endif
--	sth	%o0, [%g6 + TI_CPU]
--
--	call	prom_init_report
--	 nop
--
--	/* Off we go.... */
--	call	start_kernel
-+	call	start_early_boot
- 	 nop
- 	/* Not reached... */
- 
-diff --git a/arch/sparc/kernel/hvapi.c b/arch/sparc/kernel/hvapi.c
-index c0a2de0..5c55145 100644
---- a/arch/sparc/kernel/hvapi.c
-+++ b/arch/sparc/kernel/hvapi.c
-@@ -46,6 +46,7 @@ static struct api_info api_table[] = {
- 	{ .group = HV_GRP_VF_CPU,				},
- 	{ .group = HV_GRP_KT_CPU,				},
- 	{ .group = HV_GRP_VT_CPU,				},
-+	{ .group = HV_GRP_T5_CPU,				},
- 	{ .group = HV_GRP_DIAG,		.flags = FLAG_PRE_API	},
- };
- 
-diff --git a/arch/sparc/kernel/hvcalls.S b/arch/sparc/kernel/hvcalls.S
-index f3ab509..caedf83 100644
---- a/arch/sparc/kernel/hvcalls.S
-+++ b/arch/sparc/kernel/hvcalls.S
-@@ -821,3 +821,19 @@ ENTRY(sun4v_vt_set_perfreg)
- 	retl
- 	 nop
- ENDPROC(sun4v_vt_set_perfreg)
-+
-+ENTRY(sun4v_t5_get_perfreg)
-+	mov	%o1, %o4
-+	mov	HV_FAST_T5_GET_PERFREG, %o5
-+	ta	HV_FAST_TRAP
-+	stx	%o1, [%o4]
-+	retl
-+	 nop
-+ENDPROC(sun4v_t5_get_perfreg)
-+
-+ENTRY(sun4v_t5_set_perfreg)
-+	mov	HV_FAST_T5_SET_PERFREG, %o5
-+	ta	HV_FAST_TRAP
-+	retl
-+	 nop
-+ENDPROC(sun4v_t5_set_perfreg)
-diff --git a/arch/sparc/kernel/hvtramp.S b/arch/sparc/kernel/hvtramp.S
-index b7ddcdd..cdbfec2 100644
---- a/arch/sparc/kernel/hvtramp.S
-+++ b/arch/sparc/kernel/hvtramp.S
-@@ -109,7 +109,6 @@ hv_cpu_startup:
- 	sllx		%g5, THREAD_SHIFT, %g5
- 	sub		%g5, (STACKFRAME_SZ + STACK_BIAS), %g5
- 	add		%g6, %g5, %sp
--	mov		0, %fp
- 
- 	call		init_irqwork_curcpu
- 	 nop
-diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
-index e7e215d..c2d81ad 100644
---- a/arch/sparc/kernel/ioport.c
-+++ b/arch/sparc/kernel/ioport.c
-@@ -278,7 +278,8 @@ static void *sbus_alloc_coherent(struct device *dev, size_t len,
- 	}
- 
- 	order = get_order(len_total);
--	if ((va = __get_free_pages(GFP_KERNEL|__GFP_COMP, order)) == 0)
-+	va = __get_free_pages(gfp, order);
-+	if (va == 0)
- 		goto err_nopages;
- 
- 	if ((res = kzalloc(sizeof(struct resource), GFP_KERNEL)) == NULL)
-@@ -443,7 +444,7 @@ static void *pci32_alloc_coherent(struct device *dev, size_t len,
- 	}
- 
- 	order = get_order(len_total);
--	va = (void *) __get_free_pages(GFP_KERNEL, order);
-+	va = (void *) __get_free_pages(gfp, order);
- 	if (va == NULL) {
- 		printk("pci_alloc_consistent: no %ld pages\n", len_total>>PAGE_SHIFT);
- 		goto err_nopages;
-diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
-index 666193f..4033c23 100644
---- a/arch/sparc/kernel/irq_64.c
-+++ b/arch/sparc/kernel/irq_64.c
-@@ -47,8 +47,6 @@
- #include "cpumap.h"
- #include "kstack.h"
- 
--#define NUM_IVECS	(IMAP_INR + 1)
--
- struct ino_bucket *ivector_table;
- unsigned long ivector_table_pa;
- 
-@@ -107,55 +105,196 @@ static void bucket_set_irq(unsigned long bucket_pa, unsigned int irq)
- 
- #define irq_work_pa(__cpu)	&(trap_block[(__cpu)].irq_worklist_pa)
- 
--static struct {
--	unsigned int dev_handle;
--	unsigned int dev_ino;
--	unsigned int in_use;
--} irq_table[NR_IRQS];
--static DEFINE_SPINLOCK(irq_alloc_lock);
-+static unsigned long hvirq_major __initdata;
-+static int __init early_hvirq_major(char *p)
-+{
-+	int rc = kstrtoul(p, 10, &hvirq_major);
-+
-+	return rc;
-+}
-+early_param("hvirq", early_hvirq_major);
-+
-+static int hv_irq_version;
-+
-+/* Major version 2.0 of HV_GRP_INTR added support for the VIRQ cookie
-+ * based interfaces, but:
-+ *
-+ * 1) Several OSs, Solaris and Linux included, use them even when only
-+ *    negotiating version 1.0 (or failing to negotiate at all).  So the
-+ *    hypervisor has a workaround that provides the VIRQ interfaces even
-+ *    when only verion 1.0 of the API is in use.
-+ *
-+ * 2) Second, and more importantly, with major version 2.0 these VIRQ
-+ *    interfaces only were actually hooked up for LDC interrupts, even
-+ *    though the Hypervisor specification clearly stated:
-+ *
-+ *	The new interrupt API functions will be available to a guest
-+ *	when it negotiates version 2.0 in the interrupt API group 0x2. When
-+ *	a guest negotiates version 2.0, all interrupt sources will only
-+ *	support using the cookie interface, and any attempt to use the
-+ *	version 1.0 interrupt APIs numbered 0xa0 to 0xa6 will result in the
-+ *	ENOTSUPPORTED error being returned.
-+ *
-+ *   with an emphasis on "all interrupt sources".
-+ *
-+ * To correct this, major version 3.0 was created which does actually
-+ * support VIRQs for all interrupt sources (not just LDC devices).  So
-+ * if we want to move completely over the cookie based VIRQs we must
-+ * negotiate major version 3.0 or later of HV_GRP_INTR.
-+ */
-+static bool sun4v_cookie_only_virqs(void)
-+{
-+	if (hv_irq_version >= 3)
-+		return true;
-+	return false;
-+}
- 
--unsigned char irq_alloc(unsigned int dev_handle, unsigned int dev_ino)
-+static void __init irq_init_hv(void)
- {
--	unsigned long flags;
--	unsigned char ent;
-+	unsigned long hv_error, major, minor = 0;
-+
-+	if (tlb_type != hypervisor)
-+		return;
- 
--	BUILD_BUG_ON(NR_IRQS >= 256);
-+	if (hvirq_major)
-+		major = hvirq_major;
-+	else
-+		major = 3;
- 
--	spin_lock_irqsave(&irq_alloc_lock, flags);
-+	hv_error = sun4v_hvapi_register(HV_GRP_INTR, major, &minor);
-+	if (!hv_error)
-+		hv_irq_version = major;
-+	else
-+		hv_irq_version = 1;
- 
--	for (ent = 1; ent < NR_IRQS; ent++) {
--		if (!irq_table[ent].in_use)
-+	pr_info("SUN4V: Using IRQ API major %d, cookie only virqs %s\n",
-+		hv_irq_version,
-+		sun4v_cookie_only_virqs() ? "enabled" : "disabled");
-+}
-+
-+/* This function is for the timer interrupt.*/
-+int __init arch_probe_nr_irqs(void)
-+{
-+	return 1;
-+}
-+
-+#define DEFAULT_NUM_IVECS	(0xfffU)
-+static unsigned int nr_ivec = DEFAULT_NUM_IVECS;
-+#define NUM_IVECS (nr_ivec)
-+
-+static unsigned int __init size_nr_ivec(void)
-+{
-+	if (tlb_type == hypervisor) {
-+		switch (sun4v_chip_type) {
-+		/* Athena's devhandle|devino is large.*/
-+		case SUN4V_CHIP_SPARC64X:
-+			nr_ivec = 0xffff;
- 			break;
-+		}
- 	}
--	if (ent >= NR_IRQS) {
--		printk(KERN_ERR "IRQ: Out of virtual IRQs.\n");
--		ent = 0;
--	} else {
--		irq_table[ent].dev_handle = dev_handle;
--		irq_table[ent].dev_ino = dev_ino;
--		irq_table[ent].in_use = 1;
--	}
-+	return nr_ivec;
-+}
-+
-+struct irq_handler_data {
-+	union {
-+		struct {
-+			unsigned int dev_handle;
-+			unsigned int dev_ino;
-+		};
-+		unsigned long sysino;
-+	};
-+	struct ino_bucket bucket;
-+	unsigned long	iclr;
-+	unsigned long	imap;
-+};
-+
-+static inline unsigned int irq_data_to_handle(struct irq_data *data)
-+{
-+	struct irq_handler_data *ihd = data->handler_data;
-+
-+	return ihd->dev_handle;
-+}
-+
-+static inline unsigned int irq_data_to_ino(struct irq_data *data)
-+{
-+	struct irq_handler_data *ihd = data->handler_data;
- 
--	spin_unlock_irqrestore(&irq_alloc_lock, flags);
-+	return ihd->dev_ino;
-+}
-+
-+static inline unsigned long irq_data_to_sysino(struct irq_data *data)
-+{
-+	struct irq_handler_data *ihd = data->handler_data;
- 
--	return ent;
-+	return ihd->sysino;
- }
- 
--#ifdef CONFIG_PCI_MSI
- void irq_free(unsigned int irq)
- {
--	unsigned long flags;
-+	void *data = irq_get_handler_data(irq);
- 
--	if (irq >= NR_IRQS)
--		return;
-+	kfree(data);
-+	irq_set_handler_data(irq, NULL);
-+	irq_free_descs(irq, 1);
-+}
- 
--	spin_lock_irqsave(&irq_alloc_lock, flags);
-+unsigned int irq_alloc(unsigned int dev_handle, unsigned int dev_ino)
-+{
-+	int irq;
- 
--	irq_table[irq].in_use = 0;
-+	irq = __irq_alloc_descs(-1, 1, 1, numa_node_id(), NULL);
-+	if (irq <= 0)
-+		goto out;
- 
--	spin_unlock_irqrestore(&irq_alloc_lock, flags);
-+	return irq;
-+out:
-+	return 0;
-+}
-+
-+static unsigned int cookie_exists(u32 devhandle, unsigned int devino)
-+{
-+	unsigned long hv_err, cookie;
-+	struct ino_bucket *bucket;
-+	unsigned int irq = 0U;
-+
-+	hv_err = sun4v_vintr_get_cookie(devhandle, devino, &cookie);
-+	if (hv_err) {
-+		pr_err("HV get cookie failed hv_err = %ld\n", hv_err);
-+		goto out;
-+	}
-+
-+	if (cookie & ((1UL << 63UL))) {
-+		cookie = ~cookie;
-+		bucket = (struct ino_bucket *) __va(cookie);
-+		irq = bucket->__irq;
-+	}
-+out:
-+	return irq;
-+}
-+
-+static unsigned int sysino_exists(u32 devhandle, unsigned int devino)
-+{
-+	unsigned long sysino = sun4v_devino_to_sysino(devhandle, devino);
-+	struct ino_bucket *bucket;
-+	unsigned int irq;
-+
-+	bucket = &ivector_table[sysino];
-+	irq = bucket_get_irq(__pa(bucket));
-+
-+	return irq;
-+}
-+
-+void ack_bad_irq(unsigned int irq)
-+{
-+	pr_crit("BAD IRQ ack %d\n", irq);
-+}
-+
-+void irq_install_pre_handler(int irq,
-+			     void (*func)(unsigned int, void *, void *),
-+			     void *arg1, void *arg2)
-+{
-+	pr_warn("IRQ pre handler NOT supported.\n");
- }
--#endif
- 
- /*
-  * /proc/interrupts printing:
-@@ -206,15 +345,6 @@ static unsigned int sun4u_compute_tid(unsigned long imap, unsigned long cpuid)
- 	return tid;
- }
- 
--struct irq_handler_data {
--	unsigned long	iclr;
--	unsigned long	imap;
--
--	void		(*pre_handler)(unsigned int, void *, void *);
--	void		*arg1;
--	void		*arg2;
--};
--
- #ifdef CONFIG_SMP
- static int irq_choose_cpu(unsigned int irq, const struct cpumask *affinity)
- {
-@@ -316,8 +446,8 @@ static void sun4u_irq_eoi(struct irq_data *data)
- 
- static void sun4v_irq_enable(struct irq_data *data)
- {
--	unsigned int ino = irq_table[data->irq].dev_ino;
- 	unsigned long cpuid = irq_choose_cpu(data->irq, data->affinity);
-+	unsigned int ino = irq_data_to_sysino(data);
- 	int err;
- 
- 	err = sun4v_intr_settarget(ino, cpuid);
-@@ -337,8 +467,8 @@ static void sun4v_irq_enable(struct irq_data *data)
- static int sun4v_set_affinity(struct irq_data *data,
- 			       const struct cpumask *mask, bool force)
- {
--	unsigned int ino = irq_table[data->irq].dev_ino;
- 	unsigned long cpuid = irq_choose_cpu(data->irq, mask);
-+	unsigned int ino = irq_data_to_sysino(data);
- 	int err;
- 
- 	err = sun4v_intr_settarget(ino, cpuid);
-@@ -351,7 +481,7 @@ static int sun4v_set_affinity(struct irq_data *data,
- 
- static void sun4v_irq_disable(struct irq_data *data)
- {
--	unsigned int ino = irq_table[data->irq].dev_ino;
-+	unsigned int ino = irq_data_to_sysino(data);
- 	int err;
- 
- 	err = sun4v_intr_setenabled(ino, HV_INTR_DISABLED);
-@@ -362,7 +492,7 @@ static void sun4v_irq_disable(struct irq_data *data)
- 
- static void sun4v_irq_eoi(struct irq_data *data)
- {
--	unsigned int ino = irq_table[data->irq].dev_ino;
-+	unsigned int ino = irq_data_to_sysino(data);
- 	int err;
- 
- 	err = sun4v_intr_setstate(ino, HV_INTR_STATE_IDLE);
-@@ -373,14 +503,13 @@ static void sun4v_irq_eoi(struct irq_data *data)
- 
- static void sun4v_virq_enable(struct irq_data *data)
- {
--	unsigned long cpuid, dev_handle, dev_ino;
-+	unsigned long dev_handle = irq_data_to_handle(data);
-+	unsigned long dev_ino = irq_data_to_ino(data);
-+	unsigned long cpuid;
- 	int err;
- 
- 	cpuid = irq_choose_cpu(data->irq, data->affinity);
- 
--	dev_handle = irq_table[data->irq].dev_handle;
--	dev_ino = irq_table[data->irq].dev_ino;
--
- 	err = sun4v_vintr_set_target(dev_handle, dev_ino, cpuid);
- 	if (err != HV_EOK)
- 		printk(KERN_ERR "sun4v_vintr_set_target(%lx,%lx,%lu): "
-@@ -403,14 +532,13 @@ static void sun4v_virq_enable(struct irq_data *data)
- static int sun4v_virt_set_affinity(struct irq_data *data,
- 				    const struct cpumask *mask, bool force)
- {
--	unsigned long cpuid, dev_handle, dev_ino;
-+	unsigned long dev_handle = irq_data_to_handle(data);
-+	unsigned long dev_ino = irq_data_to_ino(data);
-+	unsigned long cpuid;
- 	int err;
- 
- 	cpuid = irq_choose_cpu(data->irq, mask);
- 
--	dev_handle = irq_table[data->irq].dev_handle;
--	dev_ino = irq_table[data->irq].dev_ino;
--
- 	err = sun4v_vintr_set_target(dev_handle, dev_ino, cpuid);
- 	if (err != HV_EOK)
- 		printk(KERN_ERR "sun4v_vintr_set_target(%lx,%lx,%lu): "
-@@ -422,11 +550,10 @@ static int sun4v_virt_set_affinity(struct irq_data *data,
- 
- static void sun4v_virq_disable(struct irq_data *data)
- {
--	unsigned long dev_handle, dev_ino;
-+	unsigned long dev_handle = irq_data_to_handle(data);
-+	unsigned long dev_ino = irq_data_to_ino(data);
- 	int err;
- 
--	dev_handle = irq_table[data->irq].dev_handle;
--	dev_ino = irq_table[data->irq].dev_ino;
- 
- 	err = sun4v_vintr_set_valid(dev_handle, dev_ino,
- 				    HV_INTR_DISABLED);
-@@ -438,12 +565,10 @@ static void sun4v_virq_disable(struct irq_data *data)
- 
- static void sun4v_virq_eoi(struct irq_data *data)
- {
--	unsigned long dev_handle, dev_ino;
-+	unsigned long dev_handle = irq_data_to_handle(data);
-+	unsigned long dev_ino = irq_data_to_ino(data);
- 	int err;
- 
--	dev_handle = irq_table[data->irq].dev_handle;
--	dev_ino = irq_table[data->irq].dev_ino;
--
- 	err = sun4v_vintr_set_state(dev_handle, dev_ino,
- 				    HV_INTR_STATE_IDLE);
- 	if (err != HV_EOK)
-@@ -479,31 +604,10 @@ static struct irq_chip sun4v_virq = {
- 	.flags			= IRQCHIP_EOI_IF_HANDLED,
- };
- 
--static void pre_flow_handler(struct irq_data *d)
--{
--	struct irq_handler_data *handler_data = irq_data_get_irq_handler_data(d);
--	unsigned int ino = irq_table[d->irq].dev_ino;
--
--	handler_data->pre_handler(ino, handler_data->arg1, handler_data->arg2);
--}
--
--void irq_install_pre_handler(int irq,
--			     void (*func)(unsigned int, void *, void *),
--			     void *arg1, void *arg2)
--{
--	struct irq_handler_data *handler_data = irq_get_handler_data(irq);
--
--	handler_data->pre_handler = func;
--	handler_data->arg1 = arg1;
--	handler_data->arg2 = arg2;
--
--	__irq_set_preflow_handler(irq, pre_flow_handler);
--}
--
- unsigned int build_irq(int inofixup, unsigned long iclr, unsigned long imap)
- {
--	struct ino_bucket *bucket;
- 	struct irq_handler_data *handler_data;
-+	struct ino_bucket *bucket;
- 	unsigned int irq;
- 	int ino;
- 
-@@ -537,119 +641,166 @@ out:
- 	return irq;
- }
- 
--static unsigned int sun4v_build_common(unsigned long sysino,
--				       struct irq_chip *chip)
-+static unsigned int sun4v_build_common(u32 devhandle, unsigned int devino,
-+		void (*handler_data_init)(struct irq_handler_data *data,
-+		u32 devhandle, unsigned int devino),
-+		struct irq_chip *chip)
- {
--	struct ino_bucket *bucket;
--	struct irq_handler_data *handler_data;
-+	struct irq_handler_data *data;
- 	unsigned int irq;
- 
--	BUG_ON(tlb_type != hypervisor);
-+	irq = irq_alloc(devhandle, devino);
-+	if (!irq)
-+		goto out;
- 
--	bucket = &ivector_table[sysino];
--	irq = bucket_get_irq(__pa(bucket));
--	if (!irq) {
--		irq = irq_alloc(0, sysino);
--		bucket_set_irq(__pa(bucket), irq);
--		irq_set_chip_and_handler_name(irq, chip, handle_fasteoi_irq,
--					      "IVEC");
-+	data = kzalloc(sizeof(struct irq_handler_data), GFP_ATOMIC);
-+	if (unlikely(!data)) {
-+		pr_err("IRQ handler data allocation failed.\n");
-+		irq_free(irq);
-+		irq = 0;
-+		goto out;
- 	}
- 
--	handler_data = irq_get_handler_data(irq);
--	if (unlikely(handler_data))
--		goto out;
-+	irq_set_handler_data(irq, data);
-+	handler_data_init(data, devhandle, devino);
-+	irq_set_chip_and_handler_name(irq, chip, handle_fasteoi_irq, "IVEC");
-+	data->imap = ~0UL;
-+	data->iclr = ~0UL;
-+out:
-+	return irq;
-+}
- 
--	handler_data = kzalloc(sizeof(struct irq_handler_data), GFP_ATOMIC);
--	if (unlikely(!handler_data)) {
--		prom_printf("IRQ: kzalloc(irq_handler_data) failed.\n");
--		prom_halt();
--	}
--	irq_set_handler_data(irq, handler_data);
-+static unsigned long cookie_assign(unsigned int irq, u32 devhandle,
-+		unsigned int devino)
-+{
-+	struct irq_handler_data *ihd = irq_get_handler_data(irq);
-+	unsigned long hv_error, cookie;
- 
--	/* Catch accidental accesses to these things.  IMAP/ICLR handling
--	 * is done by hypervisor calls on sun4v platforms, not by direct
--	 * register accesses.
-+	/* handler_irq needs to find the irq. cookie is seen signed in
-+	 * sun4v_dev_mondo and treated as a non ivector_table delivery.
- 	 */
--	handler_data->imap = ~0UL;
--	handler_data->iclr = ~0UL;
-+	ihd->bucket.__irq = irq;
-+	cookie = ~__pa(&ihd->bucket);
- 
--out:
--	return irq;
-+	hv_error = sun4v_vintr_set_cookie(devhandle, devino, cookie);
-+	if (hv_error)
-+		pr_err("HV vintr set cookie failed = %ld\n", hv_error);
-+
-+	return hv_error;
- }
- 
--unsigned int sun4v_build_irq(u32 devhandle, unsigned int devino)
-+static void cookie_handler_data(struct irq_handler_data *data,
-+				u32 devhandle, unsigned int devino)
- {
--	unsigned long sysino = sun4v_devino_to_sysino(devhandle, devino);
-+	data->dev_handle = devhandle;
-+	data->dev_ino = devino;
-+}
- 
--	return sun4v_build_common(sysino, &sun4v_irq);
-+static unsigned int cookie_build_irq(u32 devhandle, unsigned int devino,
-+				     struct irq_chip *chip)
-+{
-+	unsigned long hv_error;
-+	unsigned int irq;
-+
-+	irq = sun4v_build_common(devhandle, devino, cookie_handler_data, chip);
-+
-+	hv_error = cookie_assign(irq, devhandle, devino);
-+	if (hv_error) {
-+		irq_free(irq);
-+		irq = 0;
-+	}
-+
-+	return irq;
- }
- 
--unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
-+static unsigned int sun4v_build_cookie(u32 devhandle, unsigned int devino)
- {
--	struct irq_handler_data *handler_data;
--	unsigned long hv_err, cookie;
--	struct ino_bucket *bucket;
- 	unsigned int irq;
- 
--	bucket = kzalloc(sizeof(struct ino_bucket), GFP_ATOMIC);
--	if (unlikely(!bucket))
--		return 0;
-+	irq = cookie_exists(devhandle, devino);
-+	if (irq)
-+		goto out;
- 
--	/* The only reference we store to the IRQ bucket is
--	 * by physical address which kmemleak can't see, tell
--	 * it that this object explicitly is not a leak and
--	 * should be scanned.
--	 */
--	kmemleak_not_leak(bucket);
-+	irq = cookie_build_irq(devhandle, devino, &sun4v_virq);
- 
--	__flush_dcache_range((unsigned long) bucket,
--			     ((unsigned long) bucket +
--			      sizeof(struct ino_bucket)));
-+out:
-+	return irq;
-+}
- 
--	irq = irq_alloc(devhandle, devino);
-+static void sysino_set_bucket(unsigned int irq)
-+{
-+	struct irq_handler_data *ihd = irq_get_handler_data(irq);
-+	struct ino_bucket *bucket;
-+	unsigned long sysino;
-+
-+	sysino = sun4v_devino_to_sysino(ihd->dev_handle, ihd->dev_ino);
-+	BUG_ON(sysino >= nr_ivec);
-+	bucket = &ivector_table[sysino];
- 	bucket_set_irq(__pa(bucket), irq);
-+}
- 
--	irq_set_chip_and_handler_name(irq, &sun4v_virq, handle_fasteoi_irq,
--				      "IVEC");
-+static void sysino_handler_data(struct irq_handler_data *data,
-+				u32 devhandle, unsigned int devino)
-+{
-+	unsigned long sysino;
- 
--	handler_data = kzalloc(sizeof(struct irq_handler_data), GFP_ATOMIC);
--	if (unlikely(!handler_data))
--		return 0;
-+	sysino = sun4v_devino_to_sysino(devhandle, devino);
-+	data->sysino = sysino;
-+}
- 
--	/* In order to make the LDC channel startup sequence easier,
--	 * especially wrt. locking, we do not let request_irq() enable
--	 * the interrupt.
--	 */
--	irq_set_status_flags(irq, IRQ_NOAUTOEN);
--	irq_set_handler_data(irq, handler_data);
-+static unsigned int sysino_build_irq(u32 devhandle, unsigned int devino,
-+				     struct irq_chip *chip)
-+{
-+	unsigned int irq;
- 
--	/* Catch accidental accesses to these things.  IMAP/ICLR handling
--	 * is done by hypervisor calls on sun4v platforms, not by direct
--	 * register accesses.
--	 */
--	handler_data->imap = ~0UL;
--	handler_data->iclr = ~0UL;
-+	irq = sun4v_build_common(devhandle, devino, sysino_handler_data, chip);
-+	if (!irq)
-+		goto out;
- 
--	cookie = ~__pa(bucket);
--	hv_err = sun4v_vintr_set_cookie(devhandle, devino, cookie);
--	if (hv_err) {
--		prom_printf("IRQ: Fatal, cannot set cookie for [%x:%x] "
--			    "err=%lu\n", devhandle, devino, hv_err);
--		prom_halt();
--	}
-+	sysino_set_bucket(irq);
-+out:
-+	return irq;
-+}
- 
-+static int sun4v_build_sysino(u32 devhandle, unsigned int devino)
-+{
-+	int irq;
-+
-+	irq = sysino_exists(devhandle, devino);
-+	if (irq)
-+		goto out;
-+
-+	irq = sysino_build_irq(devhandle, devino, &sun4v_irq);
-+out:
- 	return irq;
- }
- 
--void ack_bad_irq(unsigned int irq)
-+unsigned int sun4v_build_irq(u32 devhandle, unsigned int devino)
- {
--	unsigned int ino = irq_table[irq].dev_ino;
-+	unsigned int irq;
- 
--	if (!ino)
--		ino = 0xdeadbeef;
-+	if (sun4v_cookie_only_virqs())
-+		irq = sun4v_build_cookie(devhandle, devino);
-+	else
-+		irq = sun4v_build_sysino(devhandle, devino);
- 
--	printk(KERN_CRIT "Unexpected IRQ from ino[%x] irq[%u]\n",
--	       ino, irq);
-+	return irq;
-+}
-+
-+unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
-+{
-+	int irq;
-+
-+	irq = cookie_build_irq(devhandle, devino, &sun4v_virq);
-+	if (!irq)
-+		goto out;
-+
-+	/* This is borrowed from the original function.
-+	 */
-+	irq_set_status_flags(irq, IRQ_NOAUTOEN);
-+
-+out:
-+	return irq;
- }
- 
- void *hardirq_stack[NR_CPUS];
-@@ -720,9 +871,12 @@ void fixup_irqs(void)
- 
- 	for (irq = 0; irq < NR_IRQS; irq++) {
- 		struct irq_desc *desc = irq_to_desc(irq);
--		struct irq_data *data = irq_desc_get_irq_data(desc);
-+		struct irq_data *data;
- 		unsigned long flags;
- 
-+		if (!desc)
-+			continue;
-+		data = irq_desc_get_irq_data(desc);
- 		raw_spin_lock_irqsave(&desc->lock, flags);
- 		if (desc->action && !irqd_is_per_cpu(data)) {
- 			if (data->chip->irq_set_affinity)
-@@ -922,16 +1076,22 @@ static struct irqaction timer_irq_action = {
- 	.name = "timer",
- };
- 
--/* Only invoked on boot processor. */
--void __init init_IRQ(void)
-+static void __init irq_ivector_init(void)
- {
--	unsigned long size;
-+	unsigned long size, order;
-+	unsigned int ivecs;
- 
--	map_prom_timers();
--	kill_prom_timer();
-+	/* If we are doing cookie only VIRQs then we do not need the ivector
-+	 * table to process interrupts.
-+	 */
-+	if (sun4v_cookie_only_virqs())
-+		return;
- 
--	size = sizeof(struct ino_bucket) * NUM_IVECS;
--	ivector_table = kzalloc(size, GFP_KERNEL);
-+	ivecs = size_nr_ivec();
-+	size = sizeof(struct ino_bucket) * ivecs;
-+	order = get_order(size);
-+	ivector_table = (struct ino_bucket *)
-+		__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
- 	if (!ivector_table) {
- 		prom_printf("Fatal error, cannot allocate ivector_table\n");
- 		prom_halt();
-@@ -940,6 +1100,15 @@ void __init init_IRQ(void)
- 			     ((unsigned long) ivector_table) + size);
- 
- 	ivector_table_pa = __pa(ivector_table);
-+}
-+
-+/* Only invoked on boot processor.*/
-+void __init init_IRQ(void)
-+{
-+	irq_init_hv();
-+	irq_ivector_init();
-+	map_prom_timers();
-+	kill_prom_timer();
- 
- 	if (tlb_type == hypervisor)
- 		sun4v_init_mondo_queues();
-diff --git a/arch/sparc/kernel/ktlb.S b/arch/sparc/kernel/ktlb.S
-index 605d492..ef0d8e9 100644
---- a/arch/sparc/kernel/ktlb.S
-+++ b/arch/sparc/kernel/ktlb.S
-@@ -47,14 +47,6 @@ kvmap_itlb_vmalloc_addr:
- 	KERN_PGTABLE_WALK(%g4, %g5, %g2, kvmap_itlb_longpath)
- 
- 	TSB_LOCK_TAG(%g1, %g2, %g7)
--
--	/* Load and check PTE.  */
--	ldxa		[%g5] ASI_PHYS_USE_EC, %g5
--	mov		1, %g7
--	sllx		%g7, TSB_TAG_INVALID_BIT, %g7
--	brgez,a,pn	%g5, kvmap_itlb_longpath
--	 TSB_STORE(%g1, %g7)
--
- 	TSB_WRITE(%g1, %g5, %g6)
- 
- 	/* fallthrough to TLB load */
-@@ -118,6 +110,12 @@ kvmap_dtlb_obp:
- 	ba,pt		%xcc, kvmap_dtlb_load
- 	 nop
- 
-+kvmap_linear_early:
-+	sethi		%hi(kern_linear_pte_xor), %g7
-+	ldx		[%g7 + %lo(kern_linear_pte_xor)], %g2
-+	ba,pt		%xcc, kvmap_dtlb_tsb4m_load
-+	 xor		%g2, %g4, %g5
-+
- 	.align		32
- kvmap_dtlb_tsb4m_load:
- 	TSB_LOCK_TAG(%g1, %g2, %g7)
-@@ -146,105 +144,17 @@ kvmap_dtlb_4v:
- 	/* Correct TAG_TARGET is already in %g6, check 4mb TSB.  */
- 	KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
- #endif
--	/* TSB entry address left in %g1, lookup linear PTE.
--	 * Must preserve %g1 and %g6 (TAG).
--	 */
--kvmap_dtlb_tsb4m_miss:
--	/* Clear the PAGE_OFFSET top virtual bits, shift
--	 * down to get PFN, and make sure PFN is in range.
--	 */
--661:	sllx		%g4, 0, %g5
--	.section	.page_offset_shift_patch, "ax"
--	.word		661b
--	.previous
--
--	/* Check to see if we know about valid memory at the 4MB
--	 * chunk this physical address will reside within.
-+	/* Linear mapping TSB lookup failed.  Fallthrough to kernel
-+	 * page table based lookup.
- 	 */
--661:	srlx		%g5, MAX_PHYS_ADDRESS_BITS, %g2
--	.section	.page_offset_shift_patch, "ax"
--	.word		661b
--	.previous
--
--	brnz,pn		%g2, kvmap_dtlb_longpath
--	 nop
--
--	/* This unconditional branch and delay-slot nop gets patched
--	 * by the sethi sequence once the bitmap is properly setup.
--	 */
--	.globl		valid_addr_bitmap_insn
--valid_addr_bitmap_insn:
--	ba,pt		%xcc, 2f
--	 nop
--	.subsection	2
--	.globl		valid_addr_bitmap_patch
--valid_addr_bitmap_patch:
--	sethi		%hi(sparc64_valid_addr_bitmap), %g7
--	or		%g7, %lo(sparc64_valid_addr_bitmap), %g7
--	.previous
--
--661:	srlx		%g5, ILOG2_4MB, %g2
--	.section	.page_offset_shift_patch, "ax"
--	.word		661b
--	.previous
--
--	srlx		%g2, 6, %g5
--	and		%g2, 63, %g2
--	sllx		%g5, 3, %g5
--	ldx		[%g7 + %g5], %g5
--	mov		1, %g7
--	sllx		%g7, %g2, %g7
--	andcc		%g5, %g7, %g0
--	be,pn		%xcc, kvmap_dtlb_longpath
--
--2:	 sethi		%hi(kpte_linear_bitmap), %g2
--
--	/* Get the 256MB physical address index. */
--661:	sllx		%g4, 0, %g5
--	.section	.page_offset_shift_patch, "ax"
--	.word		661b
--	.previous
--
--	or		%g2, %lo(kpte_linear_bitmap), %g2
--
--661:	srlx		%g5, ILOG2_256MB, %g5
--	.section	.page_offset_shift_patch, "ax"
--	.word		661b
--	.previous
--
--	and		%g5, (32 - 1), %g7
--
--	/* Divide by 32 to get the offset into the bitmask.  */
--	srlx		%g5, 5, %g5
--	add		%g7, %g7, %g7
--	sllx		%g5, 3, %g5
--
--	/* kern_linear_pte_xor[(mask >> shift) & 3)] */
--	ldx		[%g2 + %g5], %g2
--	srlx		%g2, %g7, %g7
--	sethi		%hi(kern_linear_pte_xor), %g5
--	and		%g7, 3, %g7
--	or		%g5, %lo(kern_linear_pte_xor), %g5
--	sllx		%g7, 3, %g7
--	ldx		[%g5 + %g7], %g2
--
- 	.globl		kvmap_linear_patch
- kvmap_linear_patch:
--	ba,pt		%xcc, kvmap_dtlb_tsb4m_load
--	 xor		%g2, %g4, %g5
-+	ba,a,pt		%xcc, kvmap_linear_early
- 
- kvmap_dtlb_vmalloc_addr:
- 	KERN_PGTABLE_WALK(%g4, %g5, %g2, kvmap_dtlb_longpath)
- 
- 	TSB_LOCK_TAG(%g1, %g2, %g7)
--
--	/* Load and check PTE.  */
--	ldxa		[%g5] ASI_PHYS_USE_EC, %g5
--	mov		1, %g7
--	sllx		%g7, TSB_TAG_INVALID_BIT, %g7
--	brgez,a,pn	%g5, kvmap_dtlb_longpath
--	 TSB_STORE(%g1, %g7)
--
- 	TSB_WRITE(%g1, %g5, %g6)
- 
- 	/* fallthrough to TLB load */
-@@ -276,13 +186,8 @@ kvmap_dtlb_load:
- 
- #ifdef CONFIG_SPARSEMEM_VMEMMAP
- kvmap_vmemmap:
--	sub		%g4, %g5, %g5
--	srlx		%g5, ILOG2_4MB, %g5
--	sethi		%hi(vmemmap_table), %g1
--	sllx		%g5, 3, %g5
--	or		%g1, %lo(vmemmap_table), %g1
--	ba,pt		%xcc, kvmap_dtlb_load
--	 ldx		[%g1 + %g5], %g5
-+	KERN_PGTABLE_WALK(%g4, %g5, %g2, kvmap_dtlb_longpath)
-+	ba,a,pt		%xcc, kvmap_dtlb_load
- #endif
- 
- kvmap_dtlb_nonlinear:
-@@ -294,8 +199,8 @@ kvmap_dtlb_nonlinear:
- 
- #ifdef CONFIG_SPARSEMEM_VMEMMAP
- 	/* Do not use the TSB for vmemmap.  */
--	mov		(VMEMMAP_BASE >> 40), %g5
--	sllx		%g5, 40, %g5
-+	sethi		%hi(VMEMMAP_BASE), %g5
-+	ldx		[%g5 + %lo(VMEMMAP_BASE)], %g5
- 	cmp		%g4,%g5
- 	bgeu,pn		%xcc, kvmap_vmemmap
- 	 nop
-@@ -307,8 +212,8 @@ kvmap_dtlb_tsbmiss:
- 	sethi		%hi(MODULES_VADDR), %g5
- 	cmp		%g4, %g5
- 	blu,pn		%xcc, kvmap_dtlb_longpath
--	 mov		(VMALLOC_END >> 40), %g5
--	sllx		%g5, 40, %g5
-+	 sethi		%hi(VMALLOC_END), %g5
-+	ldx		[%g5 + %lo(VMALLOC_END)], %g5
- 	cmp		%g4, %g5
- 	bgeu,pn		%xcc, kvmap_dtlb_longpath
- 	 nop
-diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
-index 66dacd5..27bb554 100644
---- a/arch/sparc/kernel/ldc.c
-+++ b/arch/sparc/kernel/ldc.c
-@@ -1078,7 +1078,8 @@ static void ldc_iommu_release(struct ldc_channel *lp)
- 
- struct ldc_channel *ldc_alloc(unsigned long id,
- 			      const struct ldc_channel_config *cfgp,
--			      void *event_arg)
-+			      void *event_arg,
-+			      const char *name)
- {
- 	struct ldc_channel *lp;
- 	const struct ldc_mode_ops *mops;
-@@ -1093,6 +1094,8 @@ struct ldc_channel *ldc_alloc(unsigned long id,
- 	err = -EINVAL;
- 	if (!cfgp)
- 		goto out_err;
-+	if (!name)
-+		goto out_err;
- 
- 	switch (cfgp->mode) {
- 	case LDC_MODE_RAW:
-@@ -1185,6 +1188,21 @@ struct ldc_channel *ldc_alloc(unsigned long id,
- 
- 	INIT_HLIST_HEAD(&lp->mh_list);
- 
-+	snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
-+	snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
-+
-+	err = request_irq(lp->cfg.rx_irq, ldc_rx, 0,
-+			  lp->rx_irq_name, lp);
-+	if (err)
-+		goto out_free_txq;
-+
-+	err = request_irq(lp->cfg.tx_irq, ldc_tx, 0,
-+			  lp->tx_irq_name, lp);
-+	if (err) {
-+		free_irq(lp->cfg.rx_irq, lp);
-+		goto out_free_txq;
-+	}
-+
- 	return lp;
- 
- out_free_txq:
-@@ -1237,31 +1255,14 @@ EXPORT_SYMBOL(ldc_free);
-  * state.  This does not initiate a handshake, ldc_connect() does
-  * that.
-  */
--int ldc_bind(struct ldc_channel *lp, const char *name)
-+int ldc_bind(struct ldc_channel *lp)
- {
- 	unsigned long hv_err, flags;
- 	int err = -EINVAL;
- 
--	if (!name ||
--	    (lp->state != LDC_STATE_INIT))
-+	if (lp->state != LDC_STATE_INIT)
- 		return -EINVAL;
- 
--	snprintf(lp->rx_irq_name, LDC_IRQ_NAME_MAX, "%s RX", name);
--	snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
--
--	err = request_irq(lp->cfg.rx_irq, ldc_rx, 0,
--			  lp->rx_irq_name, lp);
--	if (err)
--		return err;
--
--	err = request_irq(lp->cfg.tx_irq, ldc_tx, 0,
--			  lp->tx_irq_name, lp);
--	if (err) {
--		free_irq(lp->cfg.rx_irq, lp);
--		return err;
--	}
--
--
- 	spin_lock_irqsave(&lp->lock, flags);
- 
- 	enable_irq(lp->cfg.rx_irq);
-diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
-index 6479256..fce8ab1 100644
---- a/arch/sparc/kernel/nmi.c
-+++ b/arch/sparc/kernel/nmi.c
-@@ -141,7 +141,6 @@ static inline unsigned int get_nmi_count(int cpu)
- 
- static __init void nmi_cpu_busy(void *data)
- {
--	local_irq_enable_in_hardirq();
- 	while (endflag == 0)
- 		mb();
- }
-diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
-index 269af58..7e967c8 100644
---- a/arch/sparc/kernel/pcr.c
-+++ b/arch/sparc/kernel/pcr.c
-@@ -191,12 +191,41 @@ static const struct pcr_ops n4_pcr_ops = {
- 	.pcr_nmi_disable	= PCR_N4_PICNPT,
- };
- 
-+static u64 n5_pcr_read(unsigned long reg_num)
-+{
-+	unsigned long val;
-+
-+	(void) sun4v_t5_get_perfreg(reg_num, &val);
-+
-+	return val;
-+}
-+
-+static void n5_pcr_write(unsigned long reg_num, u64 val)
-+{
-+	(void) sun4v_t5_set_perfreg(reg_num, val);
-+}
-+
-+static const struct pcr_ops n5_pcr_ops = {
-+	.read_pcr		= n5_pcr_read,
-+	.write_pcr		= n5_pcr_write,
-+	.read_pic		= n4_pic_read,
-+	.write_pic		= n4_pic_write,
-+	.nmi_picl_value		= n4_picl_value,
-+	.pcr_nmi_enable		= (PCR_N4_PICNPT | PCR_N4_STRACE |
-+				   PCR_N4_UTRACE | PCR_N4_TOE |
-+				   (26 << PCR_N4_SL_SHIFT)),
-+	.pcr_nmi_disable	= PCR_N4_PICNPT,
-+};
-+
-+
- static unsigned long perf_hsvc_group;
- static unsigned long perf_hsvc_major;
- static unsigned long perf_hsvc_minor;
- 
- static int __init register_perf_hsvc(void)
- {
-+	unsigned long hverror;
-+
- 	if (tlb_type == hypervisor) {
- 		switch (sun4v_chip_type) {
- 		case SUN4V_CHIP_NIAGARA1:
-@@ -215,6 +244,10 @@ static int __init register_perf_hsvc(void)
- 			perf_hsvc_group = HV_GRP_VT_CPU;
- 			break;
- 
-+		case SUN4V_CHIP_NIAGARA5:
-+			perf_hsvc_group = HV_GRP_T5_CPU;
-+			break;
-+
- 		default:
- 			return -ENODEV;
- 		}
-@@ -222,10 +255,12 @@ static int __init register_perf_hsvc(void)
- 
- 		perf_hsvc_major = 1;
- 		perf_hsvc_minor = 0;
--		if (sun4v_hvapi_register(perf_hsvc_group,
--					 perf_hsvc_major,
--					 &perf_hsvc_minor)) {
--			printk("perfmon: Could not register hvapi.\n");
-+		hverror = sun4v_hvapi_register(perf_hsvc_group,
-+					       perf_hsvc_major,
-+					       &perf_hsvc_minor);
-+		if (hverror) {
-+			pr_err("perfmon: Could not register hvapi(0x%lx).\n",
-+			       hverror);
- 			return -ENODEV;
- 		}
- 	}
-@@ -254,6 +289,10 @@ static int __init setup_sun4v_pcr_ops(void)
- 		pcr_ops = &n4_pcr_ops;
- 		break;
- 
-+	case SUN4V_CHIP_NIAGARA5:
-+		pcr_ops = &n5_pcr_ops;
-+		break;
-+
- 	default:
- 		ret = -ENODEV;
- 		break;
-diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
-index b5c38fa..617b9fe 100644
---- a/arch/sparc/kernel/perf_event.c
-+++ b/arch/sparc/kernel/perf_event.c
-@@ -1662,7 +1662,8 @@ static bool __init supported_pmu(void)
- 		sparc_pmu = &niagara2_pmu;
- 		return true;
- 	}
--	if (!strcmp(sparc_pmu_type, "niagara4")) {
-+	if (!strcmp(sparc_pmu_type, "niagara4") ||
-+	    !strcmp(sparc_pmu_type, "niagara5")) {
- 		sparc_pmu = &niagara4_pmu;
- 		return true;
- 	}
-@@ -1671,9 +1672,12 @@ static bool __init supported_pmu(void)
- 
- int __init init_hw_perf_events(void)
- {
-+	int err;
-+
- 	pr_info("Performance events: ");
- 
--	if (!supported_pmu()) {
-+	err = pcr_arch_init();
-+	if (err || !supported_pmu()) {
- 		pr_cont("No support for PMU type '%s'\n", sparc_pmu_type);
- 		return 0;
- 	}
-@@ -1685,7 +1689,7 @@ int __init init_hw_perf_events(void)
- 
- 	return 0;
- }
--early_initcall(init_hw_perf_events);
-+pure_initcall(init_hw_perf_events);
- 
- void perf_callchain_kernel(struct perf_callchain_entry *entry,
- 			   struct pt_regs *regs)
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index d7b4967..c6f7113 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -306,6 +306,9 @@ static void __global_pmu_self(int this_cpu)
- 	struct global_pmu_snapshot *pp;
- 	int i, num;
- 
-+	if (!pcr_ops)
-+		return;
-+
- 	pp = &global_cpu_snapshot[this_cpu].pmu;
- 
- 	num = 1;
-diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
-index 3fdb455..61a5198 100644
---- a/arch/sparc/kernel/setup_64.c
-+++ b/arch/sparc/kernel/setup_64.c
-@@ -30,6 +30,7 @@
- #include <linux/cpu.h>
- #include <linux/initrd.h>
- #include <linux/module.h>
-+#include <linux/start_kernel.h>
- 
- #include <asm/io.h>
- #include <asm/processor.h>
-@@ -174,7 +175,7 @@ char reboot_command[COMMAND_LINE_SIZE];
- 
- static struct pt_regs fake_swapper_regs = { { 0, }, 0, 0, 0, 0 };
- 
--void __init per_cpu_patch(void)
-+static void __init per_cpu_patch(void)
- {
- 	struct cpuid_patch_entry *p;
- 	unsigned long ver;
-@@ -266,7 +267,7 @@ void sun4v_patch_2insn_range(struct sun4v_2insn_patch_entry *start,
- 	}
- }
- 
--void __init sun4v_patch(void)
-+static void __init sun4v_patch(void)
- {
- 	extern void sun4v_hvapi_init(void);
- 
-@@ -335,14 +336,25 @@ static void __init pause_patch(void)
- 	}
- }
- 
--#ifdef CONFIG_SMP
--void __init boot_cpu_id_too_large(int cpu)
-+void __init start_early_boot(void)
- {
--	prom_printf("Serious problem, boot cpu id (%d) >= NR_CPUS (%d)\n",
--		    cpu, NR_CPUS);
--	prom_halt();
-+	int cpu;
-+
-+	check_if_starfire();
-+	per_cpu_patch();
-+	sun4v_patch();
-+
-+	cpu = hard_smp_processor_id();
-+	if (cpu >= NR_CPUS) {
-+		prom_printf("Serious problem, boot cpu id (%d) >= NR_CPUS (%d)\n",
-+			    cpu, NR_CPUS);
-+		prom_halt();
-+	}
-+	current_thread_info()->cpu = cpu;
-+
-+	prom_init_report();
-+	start_kernel();
- }
--#endif
- 
- /* On Ultra, we support all of the v8 capabilities. */
- unsigned long sparc64_elf_hwcap = (HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR |
-@@ -500,12 +512,16 @@ static void __init init_sparc64_elf_hwcap(void)
- 		    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- 		    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- 		    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+		    sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+		    sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- 		    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- 			cap |= HWCAP_SPARC_BLKINIT;
- 		if (sun4v_chip_type == SUN4V_CHIP_NIAGARA2 ||
- 		    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- 		    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- 		    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+		    sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+		    sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- 		    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- 			cap |= HWCAP_SPARC_N2;
- 	}
-@@ -533,6 +549,8 @@ static void __init init_sparc64_elf_hwcap(void)
- 			    sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- 			    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- 			    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+			    sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+			    sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- 			    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- 				cap |= (AV_SPARC_VIS | AV_SPARC_VIS2 |
- 					AV_SPARC_ASI_BLK_INIT |
-@@ -540,6 +558,8 @@ static void __init init_sparc64_elf_hwcap(void)
- 			if (sun4v_chip_type == SUN4V_CHIP_NIAGARA3 ||
- 			    sun4v_chip_type == SUN4V_CHIP_NIAGARA4 ||
- 			    sun4v_chip_type == SUN4V_CHIP_NIAGARA5 ||
-+			    sun4v_chip_type == SUN4V_CHIP_SPARC_M6 ||
-+			    sun4v_chip_type == SUN4V_CHIP_SPARC_M7 ||
- 			    sun4v_chip_type == SUN4V_CHIP_SPARC64X)
- 				cap |= (AV_SPARC_VIS3 | AV_SPARC_HPC |
- 					AV_SPARC_FMAF);
-diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
-index 8416d7f..50c3dd03 100644
---- a/arch/sparc/kernel/smp_64.c
-+++ b/arch/sparc/kernel/smp_64.c
-@@ -1395,7 +1395,6 @@ void __cpu_die(unsigned int cpu)
- 
- void __init smp_cpus_done(unsigned int max_cpus)
- {
--	pcr_arch_init();
- }
- 
- void smp_send_reschedule(int cpu)
-@@ -1480,6 +1479,13 @@ static void __init pcpu_populate_pte(unsigned long addr)
- 	pud_t *pud;
- 	pmd_t *pmd;
- 
-+	if (pgd_none(*pgd)) {
-+		pud_t *new;
-+
-+		new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
-+		pgd_populate(&init_mm, pgd, new);
-+	}
-+
- 	pud = pud_offset(pgd, addr);
- 	if (pud_none(*pud)) {
- 		pmd_t *new;
-diff --git a/arch/sparc/kernel/sun4v_tlb_miss.S b/arch/sparc/kernel/sun4v_tlb_miss.S
-index e0c09bf8..6179e19 100644
---- a/arch/sparc/kernel/sun4v_tlb_miss.S
-+++ b/arch/sparc/kernel/sun4v_tlb_miss.S
-@@ -195,6 +195,11 @@ sun4v_tsb_miss_common:
- 	 ldx	[%g2 + TRAP_PER_CPU_PGD_PADDR], %g7
- 
- sun4v_itlb_error:
-+	rdpr	%tl, %g1
-+	cmp	%g1, 1
-+	ble,pt	%icc, sun4v_bad_ra
-+	 or	%g0, FAULT_CODE_BAD_RA | FAULT_CODE_ITLB, %g1
-+
- 	sethi	%hi(sun4v_err_itlb_vaddr), %g1
- 	stx	%g4, [%g1 + %lo(sun4v_err_itlb_vaddr)]
- 	sethi	%hi(sun4v_err_itlb_ctx), %g1
-@@ -206,15 +211,10 @@ sun4v_itlb_error:
- 	sethi	%hi(sun4v_err_itlb_error), %g1
- 	stx	%o0, [%g1 + %lo(sun4v_err_itlb_error)]
- 
-+	sethi	%hi(1f), %g7
- 	rdpr	%tl, %g4
--	cmp	%g4, 1
--	ble,pt	%icc, 1f
--	 sethi	%hi(2f), %g7
- 	ba,pt	%xcc, etraptl1
--	 or	%g7, %lo(2f), %g7
--
--1:	ba,pt	%xcc, etrap
--2:	 or	%g7, %lo(2b), %g7
-+1:	 or	%g7, %lo(1f), %g7
- 	mov	%l4, %o1
- 	call	sun4v_itlb_error_report
- 	 add	%sp, PTREGS_OFF, %o0
-@@ -222,6 +222,11 @@ sun4v_itlb_error:
- 	/* NOTREACHED */
- 
- sun4v_dtlb_error:
-+	rdpr	%tl, %g1
-+	cmp	%g1, 1
-+	ble,pt	%icc, sun4v_bad_ra
-+	 or	%g0, FAULT_CODE_BAD_RA | FAULT_CODE_DTLB, %g1
-+
- 	sethi	%hi(sun4v_err_dtlb_vaddr), %g1
- 	stx	%g4, [%g1 + %lo(sun4v_err_dtlb_vaddr)]
- 	sethi	%hi(sun4v_err_dtlb_ctx), %g1
-@@ -233,21 +238,23 @@ sun4v_dtlb_error:
- 	sethi	%hi(sun4v_err_dtlb_error), %g1
- 	stx	%o0, [%g1 + %lo(sun4v_err_dtlb_error)]
- 
-+	sethi	%hi(1f), %g7
- 	rdpr	%tl, %g4
--	cmp	%g4, 1
--	ble,pt	%icc, 1f
--	 sethi	%hi(2f), %g7
- 	ba,pt	%xcc, etraptl1
--	 or	%g7, %lo(2f), %g7
--
--1:	ba,pt	%xcc, etrap
--2:	 or	%g7, %lo(2b), %g7
-+1:	 or	%g7, %lo(1f), %g7
- 	mov	%l4, %o1
- 	call	sun4v_dtlb_error_report
- 	 add	%sp, PTREGS_OFF, %o0
- 
- 	/* NOTREACHED */
- 
-+sun4v_bad_ra:
-+	or	%g0, %g4, %g5
-+	ba,pt	%xcc, sparc64_realfault_common
-+	 or	%g1, %g0, %g4
-+
-+	/* NOTREACHED */
-+
- 	/* Instruction Access Exception, tl0. */
- sun4v_iacc:
- 	ldxa	[%g0] ASI_SCRATCHPAD, %g2
-diff --git a/arch/sparc/kernel/trampoline_64.S b/arch/sparc/kernel/trampoline_64.S
-index 737f8cb..88ede1d 100644
---- a/arch/sparc/kernel/trampoline_64.S
-+++ b/arch/sparc/kernel/trampoline_64.S
-@@ -109,10 +109,13 @@ startup_continue:
- 	brnz,pn		%g1, 1b
- 	 nop
- 
--	sethi		%hi(p1275buf), %g2
--	or		%g2, %lo(p1275buf), %g2
--	ldx		[%g2 + 0x10], %l2
--	add		%l2, -(192 + 128), %sp
-+	/* Get onto temporary stack which will be in the locked
-+	 * kernel image.
-+	 */
-+	sethi		%hi(tramp_stack), %g1
-+	or		%g1, %lo(tramp_stack), %g1
-+	add		%g1, TRAMP_STACK_SIZE, %g1
-+	sub		%g1, STACKFRAME_SZ + STACK_BIAS + 256, %sp
- 	flushw
- 
- 	/* Setup the loop variables:
-@@ -394,7 +397,6 @@ after_lock_tlb:
- 	sllx		%g5, THREAD_SHIFT, %g5
- 	sub		%g5, (STACKFRAME_SZ + STACK_BIAS), %g5
- 	add		%g6, %g5, %sp
--	mov		0, %fp
- 
- 	rdpr		%pstate, %o1
- 	or		%o1, PSTATE_IE, %o1
-diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
-index 4ced92f..25d0c7e 100644
---- a/arch/sparc/kernel/traps_64.c
-+++ b/arch/sparc/kernel/traps_64.c
-@@ -2102,6 +2102,11 @@ void sun4v_nonresum_overflow(struct pt_regs *regs)
- 	atomic_inc(&sun4v_nonresum_oflow_cnt);
- }
- 
-+static void sun4v_tlb_error(struct pt_regs *regs)
-+{
-+	die_if_kernel("TLB/TSB error", regs);
-+}
-+
- unsigned long sun4v_err_itlb_vaddr;
- unsigned long sun4v_err_itlb_ctx;
- unsigned long sun4v_err_itlb_pte;
-@@ -2109,8 +2114,7 @@ unsigned long sun4v_err_itlb_error;
- 
- void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
- {
--	if (tl > 1)
--		dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-+	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
- 
- 	printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
- 	       regs->tpc, tl);
-@@ -2123,7 +2127,7 @@ void sun4v_itlb_error_report(struct pt_regs *regs, int tl)
- 	       sun4v_err_itlb_vaddr, sun4v_err_itlb_ctx,
- 	       sun4v_err_itlb_pte, sun4v_err_itlb_error);
- 
--	prom_halt();
-+	sun4v_tlb_error(regs);
- }
- 
- unsigned long sun4v_err_dtlb_vaddr;
-@@ -2133,8 +2137,7 @@ unsigned long sun4v_err_dtlb_error;
- 
- void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
- {
--	if (tl > 1)
--		dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
-+	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
- 
- 	printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
- 	       regs->tpc, tl);
-@@ -2147,7 +2150,7 @@ void sun4v_dtlb_error_report(struct pt_regs *regs, int tl)
- 	       sun4v_err_dtlb_vaddr, sun4v_err_dtlb_ctx,
- 	       sun4v_err_dtlb_pte, sun4v_err_dtlb_error);
- 
--	prom_halt();
-+	sun4v_tlb_error(regs);
- }
- 
- void hypervisor_tlbop_error(unsigned long err, unsigned long op)
-diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S
-index 14158d4..be98685 100644
---- a/arch/sparc/kernel/tsb.S
-+++ b/arch/sparc/kernel/tsb.S
-@@ -162,10 +162,10 @@ tsb_miss_page_table_walk_sun4v_fastpath:
- 	nop
- 	.previous
- 
--	rdpr	%tl, %g3
--	cmp	%g3, 1
-+	rdpr	%tl, %g7
-+	cmp	%g7, 1
- 	bne,pn	%xcc, winfix_trampoline
--	 nop
-+	 mov	%g3, %g4
- 	ba,pt	%xcc, etrap
- 	 rd	%pc, %g7
- 	call	hugetlb_setup
-diff --git a/arch/sparc/kernel/viohs.c b/arch/sparc/kernel/viohs.c
-index f8e7dd5..9c5fbd0 100644
---- a/arch/sparc/kernel/viohs.c
-+++ b/arch/sparc/kernel/viohs.c
-@@ -714,7 +714,7 @@ int vio_ldc_alloc(struct vio_driver_state *vio,
- 	cfg.tx_irq = vio->vdev->tx_irq;
- 	cfg.rx_irq = vio->vdev->rx_irq;
- 
--	lp = ldc_alloc(vio->vdev->channel_id, &cfg, event_arg);
-+	lp = ldc_alloc(vio->vdev->channel_id, &cfg, event_arg, vio->name);
- 	if (IS_ERR(lp))
- 		return PTR_ERR(lp);
- 
-@@ -746,7 +746,7 @@ void vio_port_up(struct vio_driver_state *vio)
- 
- 	err = 0;
- 	if (state == LDC_STATE_INIT) {
--		err = ldc_bind(vio->lp, vio->name);
-+		err = ldc_bind(vio->lp);
- 		if (err)
- 			printk(KERN_WARNING "%s: Port %lu bind failed, "
- 			       "err=%d\n",
-diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
-index 932ff90..0924305 100644
---- a/arch/sparc/kernel/vmlinux.lds.S
-+++ b/arch/sparc/kernel/vmlinux.lds.S
-@@ -35,8 +35,9 @@ jiffies = jiffies_64;
- 
- SECTIONS
- {
--	/* swapper_low_pmd_dir is sparc64 only */
--	swapper_low_pmd_dir = 0x0000000000402000;
-+#ifdef CONFIG_SPARC64
-+	swapper_pg_dir = 0x0000000000402000;
-+#endif
- 	. = INITIAL_ADDRESS;
- 	.text TEXTSTART :
- 	{
-@@ -122,11 +123,6 @@ SECTIONS
- 		*(.swapper_4m_tsb_phys_patch)
- 		__swapper_4m_tsb_phys_patch_end = .;
- 	}
--	.page_offset_shift_patch : {
--		__page_offset_shift_patch = .;
--		*(.page_offset_shift_patch)
--		__page_offset_shift_patch_end = .;
--	}
- 	.popc_3insn_patch : {
- 		__popc_3insn_patch = .;
- 		*(.popc_3insn_patch)
-diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
-index 9cf2ee0..140527a 100644
---- a/arch/sparc/lib/NG4memcpy.S
-+++ b/arch/sparc/lib/NG4memcpy.S
-@@ -41,6 +41,10 @@
- #endif
- #endif
- 
-+#if !defined(EX_LD) && !defined(EX_ST)
-+#define NON_USER_COPY
-+#endif
-+
- #ifndef EX_LD
- #define EX_LD(x)	x
- #endif
-@@ -197,9 +201,13 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
- 	 mov		EX_RETVAL(%o3), %o0
- 
- .Llarge_src_unaligned:
-+#ifdef NON_USER_COPY
-+	VISEntryHalfFast(.Lmedium_vis_entry_fail)
-+#else
-+	VISEntryHalf
-+#endif
- 	andn		%o2, 0x3f, %o4
- 	sub		%o2, %o4, %o2
--	VISEntryHalf
- 	alignaddr	%o1, %g0, %g1
- 	add		%o1, %o4, %o1
- 	EX_LD(LOAD(ldd, %g1 + 0x00, %f0))
-@@ -240,6 +248,10 @@ FUNC_NAME:	/* %o0=dst, %o1=src, %o2=len */
- 	 nop
- 	ba,a,pt		%icc, .Lmedium_unaligned
- 
-+#ifdef NON_USER_COPY
-+.Lmedium_vis_entry_fail:
-+	 or		%o0, %o1, %g2
-+#endif
- .Lmedium:
- 	LOAD(prefetch, %o1 + 0x40, #n_reads_strong)
- 	andcc		%g2, 0x7, %g0
-diff --git a/arch/sparc/lib/memset.S b/arch/sparc/lib/memset.S
-index 99c017b..f75e690 100644
---- a/arch/sparc/lib/memset.S
-+++ b/arch/sparc/lib/memset.S
-@@ -3,8 +3,9 @@
-  * Copyright (C) 1996,1997 Jakub Jelinek (jj@sunsite.mff.cuni.cz)
-  * Copyright (C) 1996 David S. Miller (davem@caip.rutgers.edu)
-  *
-- * Returns 0, if ok, and number of bytes not yet set if exception
-- * occurs and we were called as clear_user.
-+ * Calls to memset returns initial %o0. Calls to bzero returns 0, if ok, and
-+ * number of bytes not yet set if exception occurs and we were called as
-+ * clear_user.
-  */
- 
- #include <asm/ptrace.h>
-@@ -65,6 +66,8 @@ __bzero_begin:
- 	.globl	__memset_start, __memset_end
- __memset_start:
- memset:
-+	mov	%o0, %g1
-+	mov	1, %g4
- 	and	%o1, 0xff, %g3
- 	sll	%g3, 8, %g2
- 	or	%g3, %g2, %g3
-@@ -89,6 +92,7 @@ memset:
- 	 sub	%o0, %o2, %o0
- 
- __bzero:
-+	clr	%g4
- 	mov	%g0, %g3
- 1:
- 	cmp	%o1, 7
-@@ -151,8 +155,8 @@ __bzero:
- 	bne,a	8f
- 	 EX(stb	%g3, [%o0], and %o1, 1)
- 8:
--	retl
--	 clr	%o0
-+	b	0f
-+	 nop
- 7:
- 	be	13b
- 	 orcc	%o1, 0, %g0
-@@ -164,6 +168,12 @@ __bzero:
- 	bne	8b
- 	 EX(stb	%g3, [%o0 - 1], add %o1, 1)
- 0:
-+	andcc	%g4, 1, %g0
-+	be	5f
-+	 nop
-+	retl
-+	 mov	%g1, %o0
-+5:
- 	retl
- 	 clr	%o0
- __memset_end:
-diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
-index 4ced3fc..45a413e 100644
---- a/arch/sparc/mm/fault_64.c
-+++ b/arch/sparc/mm/fault_64.c
-@@ -348,6 +348,9 @@ retry:
- 		down_read(&mm->mmap_sem);
- 	}
- 
-+	if (fault_code & FAULT_CODE_BAD_RA)
-+		goto do_sigbus;
-+
- 	vma = find_vma(mm, address);
- 	if (!vma)
- 		goto bad_area;
-diff --git a/arch/sparc/mm/gup.c b/arch/sparc/mm/gup.c
-index 1aed043..ae6ce38 100644
---- a/arch/sparc/mm/gup.c
-+++ b/arch/sparc/mm/gup.c
-@@ -160,6 +160,36 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
- 	return 1;
- }
- 
-+int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
-+			  struct page **pages)
-+{
-+	struct mm_struct *mm = current->mm;
-+	unsigned long addr, len, end;
-+	unsigned long next, flags;
-+	pgd_t *pgdp;
-+	int nr = 0;
-+
-+	start &= PAGE_MASK;
-+	addr = start;
-+	len = (unsigned long) nr_pages << PAGE_SHIFT;
-+	end = start + len;
-+
-+	local_irq_save(flags);
-+	pgdp = pgd_offset(mm, addr);
-+	do {
-+		pgd_t pgd = *pgdp;
-+
-+		next = pgd_addr_end(addr, end);
-+		if (pgd_none(pgd))
-+			break;
-+		if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
-+			break;
-+	} while (pgdp++, addr = next, addr != end);
-+	local_irq_restore(flags);
-+
-+	return nr;
-+}
-+
- int get_user_pages_fast(unsigned long start, int nr_pages, int write,
- 			struct page **pages)
- {
-diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
-index 9686224..34506f2 100644
---- a/arch/sparc/mm/init_64.c
-+++ b/arch/sparc/mm/init_64.c
-@@ -73,7 +73,6 @@ unsigned long kern_linear_pte_xor[4] __read_mostly;
-  * 'cpu' properties, but we need to have this table setup before the
-  * MDESC is initialized.
-  */
--unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
- 
- #ifndef CONFIG_DEBUG_PAGEALLOC
- /* A special kernel TSB for 4MB, 256MB, 2GB and 16GB linear mappings.
-@@ -82,10 +81,11 @@ unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
-  */
- extern struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
- #endif
-+extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
- 
- static unsigned long cpu_pgsz_mask;
- 
--#define MAX_BANKS	32
-+#define MAX_BANKS	1024
- 
- static struct linux_prom64_registers pavail[MAX_BANKS];
- static int pavail_ents;
-@@ -163,10 +163,6 @@ static void __init read_obp_memory(const char *property,
- 	     cmp_p64, NULL);
- }
- 
--unsigned long sparc64_valid_addr_bitmap[VALID_ADDR_BITMAP_BYTES /
--					sizeof(unsigned long)];
--EXPORT_SYMBOL(sparc64_valid_addr_bitmap);
--
- /* Kernel physical address base and size in bytes.  */
- unsigned long kern_base __read_mostly;
- unsigned long kern_size __read_mostly;
-@@ -838,7 +834,10 @@ static int find_node(unsigned long addr)
- 		if ((addr & p->mask) == p->val)
- 			return i;
- 	}
--	return -1;
-+	/* The following condition has been observed on LDOM guests.*/
-+	WARN_ONCE(1, "find_node: A physical address doesn't match a NUMA node"
-+		" rule. Some physical memory will be owned by node 0.");
-+	return 0;
- }
- 
- static u64 memblock_nid_range(u64 start, u64 end, int *nid)
-@@ -1360,9 +1359,144 @@ static unsigned long __init bootmem_init(unsigned long phys_base)
- static struct linux_prom64_registers pall[MAX_BANKS] __initdata;
- static int pall_ents __initdata;
- 
--#ifdef CONFIG_DEBUG_PAGEALLOC
-+static unsigned long max_phys_bits = 40;
-+
-+bool kern_addr_valid(unsigned long addr)
-+{
-+	pgd_t *pgd;
-+	pud_t *pud;
-+	pmd_t *pmd;
-+	pte_t *pte;
-+
-+	if ((long)addr < 0L) {
-+		unsigned long pa = __pa(addr);
-+
-+		if ((addr >> max_phys_bits) != 0UL)
-+			return false;
-+
-+		return pfn_valid(pa >> PAGE_SHIFT);
-+	}
-+
-+	if (addr >= (unsigned long) KERNBASE &&
-+	    addr < (unsigned long)&_end)
-+		return true;
-+
-+	pgd = pgd_offset_k(addr);
-+	if (pgd_none(*pgd))
-+		return 0;
-+
-+	pud = pud_offset(pgd, addr);
-+	if (pud_none(*pud))
-+		return 0;
-+
-+	if (pud_large(*pud))
-+		return pfn_valid(pud_pfn(*pud));
-+
-+	pmd = pmd_offset(pud, addr);
-+	if (pmd_none(*pmd))
-+		return 0;
-+
-+	if (pmd_large(*pmd))
-+		return pfn_valid(pmd_pfn(*pmd));
-+
-+	pte = pte_offset_kernel(pmd, addr);
-+	if (pte_none(*pte))
-+		return 0;
-+
-+	return pfn_valid(pte_pfn(*pte));
-+}
-+EXPORT_SYMBOL(kern_addr_valid);
-+
-+static unsigned long __ref kernel_map_hugepud(unsigned long vstart,
-+					      unsigned long vend,
-+					      pud_t *pud)
-+{
-+	const unsigned long mask16gb = (1UL << 34) - 1UL;
-+	u64 pte_val = vstart;
-+
-+	/* Each PUD is 8GB */
-+	if ((vstart & mask16gb) ||
-+	    (vend - vstart <= mask16gb)) {
-+		pte_val ^= kern_linear_pte_xor[2];
-+		pud_val(*pud) = pte_val | _PAGE_PUD_HUGE;
-+
-+		return vstart + PUD_SIZE;
-+	}
-+
-+	pte_val ^= kern_linear_pte_xor[3];
-+	pte_val |= _PAGE_PUD_HUGE;
-+
-+	vend = vstart + mask16gb + 1UL;
-+	while (vstart < vend) {
-+		pud_val(*pud) = pte_val;
-+
-+		pte_val += PUD_SIZE;
-+		vstart += PUD_SIZE;
-+		pud++;
-+	}
-+	return vstart;
-+}
-+
-+static bool kernel_can_map_hugepud(unsigned long vstart, unsigned long vend,
-+				   bool guard)
-+{
-+	if (guard && !(vstart & ~PUD_MASK) && (vend - vstart) >= PUD_SIZE)
-+		return true;
-+
-+	return false;
-+}
-+
-+static unsigned long __ref kernel_map_hugepmd(unsigned long vstart,
-+					      unsigned long vend,
-+					      pmd_t *pmd)
-+{
-+	const unsigned long mask256mb = (1UL << 28) - 1UL;
-+	const unsigned long mask2gb = (1UL << 31) - 1UL;
-+	u64 pte_val = vstart;
-+
-+	/* Each PMD is 8MB */
-+	if ((vstart & mask256mb) ||
-+	    (vend - vstart <= mask256mb)) {
-+		pte_val ^= kern_linear_pte_xor[0];
-+		pmd_val(*pmd) = pte_val | _PAGE_PMD_HUGE;
-+
-+		return vstart + PMD_SIZE;
-+	}
-+
-+	if ((vstart & mask2gb) ||
-+	    (vend - vstart <= mask2gb)) {
-+		pte_val ^= kern_linear_pte_xor[1];
-+		pte_val |= _PAGE_PMD_HUGE;
-+		vend = vstart + mask256mb + 1UL;
-+	} else {
-+		pte_val ^= kern_linear_pte_xor[2];
-+		pte_val |= _PAGE_PMD_HUGE;
-+		vend = vstart + mask2gb + 1UL;
-+	}
-+
-+	while (vstart < vend) {
-+		pmd_val(*pmd) = pte_val;
-+
-+		pte_val += PMD_SIZE;
-+		vstart += PMD_SIZE;
-+		pmd++;
-+	}
-+
-+	return vstart;
-+}
-+
-+static bool kernel_can_map_hugepmd(unsigned long vstart, unsigned long vend,
-+				   bool guard)
-+{
-+	if (guard && !(vstart & ~PMD_MASK) && (vend - vstart) >= PMD_SIZE)
-+		return true;
-+
-+	return false;
-+}
-+
- static unsigned long __ref kernel_map_range(unsigned long pstart,
--					    unsigned long pend, pgprot_t prot)
-+					    unsigned long pend, pgprot_t prot,
-+					    bool use_huge)
- {
- 	unsigned long vstart = PAGE_OFFSET + pstart;
- 	unsigned long vend = PAGE_OFFSET + pend;
-@@ -1381,19 +1515,34 @@ static unsigned long __ref kernel_map_range(unsigned long pstart,
- 		pmd_t *pmd;
- 		pte_t *pte;
- 
-+		if (pgd_none(*pgd)) {
-+			pud_t *new;
-+
-+			new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
-+			alloc_bytes += PAGE_SIZE;
-+			pgd_populate(&init_mm, pgd, new);
-+		}
- 		pud = pud_offset(pgd, vstart);
- 		if (pud_none(*pud)) {
- 			pmd_t *new;
- 
-+			if (kernel_can_map_hugepud(vstart, vend, use_huge)) {
-+				vstart = kernel_map_hugepud(vstart, vend, pud);
-+				continue;
-+			}
- 			new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
- 			alloc_bytes += PAGE_SIZE;
- 			pud_populate(&init_mm, pud, new);
- 		}
- 
- 		pmd = pmd_offset(pud, vstart);
--		if (!pmd_present(*pmd)) {
-+		if (pmd_none(*pmd)) {
- 			pte_t *new;
- 
-+			if (kernel_can_map_hugepmd(vstart, vend, use_huge)) {
-+				vstart = kernel_map_hugepmd(vstart, vend, pmd);
-+				continue;
-+			}
- 			new = __alloc_bootmem(PAGE_SIZE, PAGE_SIZE, PAGE_SIZE);
- 			alloc_bytes += PAGE_SIZE;
- 			pmd_populate_kernel(&init_mm, pmd, new);
-@@ -1416,100 +1565,34 @@ static unsigned long __ref kernel_map_range(unsigned long pstart,
- 	return alloc_bytes;
- }
- 
--extern unsigned int kvmap_linear_patch[1];
--#endif /* CONFIG_DEBUG_PAGEALLOC */
--
--static void __init kpte_set_val(unsigned long index, unsigned long val)
-+static void __init flush_all_kernel_tsbs(void)
- {
--	unsigned long *ptr = kpte_linear_bitmap;
--
--	val <<= ((index % (BITS_PER_LONG / 2)) * 2);
--	ptr += (index / (BITS_PER_LONG / 2));
--
--	*ptr |= val;
--}
--
--static const unsigned long kpte_shift_min = 28; /* 256MB */
--static const unsigned long kpte_shift_max = 34; /* 16GB */
--static const unsigned long kpte_shift_incr = 3;
--
--static unsigned long kpte_mark_using_shift(unsigned long start, unsigned long end,
--					   unsigned long shift)
--{
--	unsigned long size = (1UL << shift);
--	unsigned long mask = (size - 1UL);
--	unsigned long remains = end - start;
--	unsigned long val;
--
--	if (remains < size || (start & mask))
--		return start;
--
--	/* VAL maps:
--	 *
--	 *	shift 28 --> kern_linear_pte_xor index 1
--	 *	shift 31 --> kern_linear_pte_xor index 2
--	 *	shift 34 --> kern_linear_pte_xor index 3
--	 */
--	val = ((shift - kpte_shift_min) / kpte_shift_incr) + 1;
--
--	remains &= ~mask;
--	if (shift != kpte_shift_max)
--		remains = size;
--
--	while (remains) {
--		unsigned long index = start >> kpte_shift_min;
-+	int i;
- 
--		kpte_set_val(index, val);
-+	for (i = 0; i < KERNEL_TSB_NENTRIES; i++) {
-+		struct tsb *ent = &swapper_tsb[i];
- 
--		start += 1UL << kpte_shift_min;
--		remains -= 1UL << kpte_shift_min;
-+		ent->tag = (1UL << TSB_TAG_INVALID_BIT);
- 	}
-+#ifndef CONFIG_DEBUG_PAGEALLOC
-+	for (i = 0; i < KERNEL_TSB4M_NENTRIES; i++) {
-+		struct tsb *ent = &swapper_4m_tsb[i];
- 
--	return start;
--}
--
--static void __init mark_kpte_bitmap(unsigned long start, unsigned long end)
--{
--	unsigned long smallest_size, smallest_mask;
--	unsigned long s;
--
--	smallest_size = (1UL << kpte_shift_min);
--	smallest_mask = (smallest_size - 1UL);
--
--	while (start < end) {
--		unsigned long orig_start = start;
--
--		for (s = kpte_shift_max; s >= kpte_shift_min; s -= kpte_shift_incr) {
--			start = kpte_mark_using_shift(start, end, s);
--
--			if (start != orig_start)
--				break;
--		}
--
--		if (start == orig_start)
--			start = (start + smallest_size) & ~smallest_mask;
-+		ent->tag = (1UL << TSB_TAG_INVALID_BIT);
- 	}
-+#endif
- }
- 
--static void __init init_kpte_bitmap(void)
--{
--	unsigned long i;
--
--	for (i = 0; i < pall_ents; i++) {
--		unsigned long phys_start, phys_end;
--
--		phys_start = pall[i].phys_addr;
--		phys_end = phys_start + pall[i].reg_size;
--
--		mark_kpte_bitmap(phys_start, phys_end);
--	}
--}
-+extern unsigned int kvmap_linear_patch[1];
- 
- static void __init kernel_physical_mapping_init(void)
- {
--#ifdef CONFIG_DEBUG_PAGEALLOC
- 	unsigned long i, mem_alloced = 0UL;
-+	bool use_huge = true;
- 
-+#ifdef CONFIG_DEBUG_PAGEALLOC
-+	use_huge = false;
-+#endif
- 	for (i = 0; i < pall_ents; i++) {
- 		unsigned long phys_start, phys_end;
- 
-@@ -1517,7 +1600,7 @@ static void __init kernel_physical_mapping_init(void)
- 		phys_end = phys_start + pall[i].reg_size;
- 
- 		mem_alloced += kernel_map_range(phys_start, phys_end,
--						PAGE_KERNEL);
-+						PAGE_KERNEL, use_huge);
- 	}
- 
- 	printk("Allocated %ld bytes for kernel page tables.\n",
-@@ -1526,8 +1609,9 @@ static void __init kernel_physical_mapping_init(void)
- 	kvmap_linear_patch[0] = 0x01000000; /* nop */
- 	flushi(&kvmap_linear_patch[0]);
- 
-+	flush_all_kernel_tsbs();
-+
- 	__flush_tlb_all();
--#endif
- }
- 
- #ifdef CONFIG_DEBUG_PAGEALLOC
-@@ -1537,7 +1621,7 @@ void kernel_map_pages(struct page *page, int numpages, int enable)
- 	unsigned long phys_end = phys_start + (numpages * PAGE_SIZE);
- 
- 	kernel_map_range(phys_start, phys_end,
--			 (enable ? PAGE_KERNEL : __pgprot(0)));
-+			 (enable ? PAGE_KERNEL : __pgprot(0)), false);
- 
- 	flush_tsb_kernel_range(PAGE_OFFSET + phys_start,
- 			       PAGE_OFFSET + phys_end);
-@@ -1565,76 +1649,56 @@ unsigned long __init find_ecache_flush_span(unsigned long size)
- unsigned long PAGE_OFFSET;
- EXPORT_SYMBOL(PAGE_OFFSET);
- 
--static void __init page_offset_shift_patch_one(unsigned int *insn, unsigned long phys_bits)
--{
--	unsigned long final_shift;
--	unsigned int val = *insn;
--	unsigned int cnt;
--
--	/* We are patching in ilog2(max_supported_phys_address), and
--	 * we are doing so in a manner similar to a relocation addend.
--	 * That is, we are adding the shift value to whatever value
--	 * is in the shift instruction count field already.
--	 */
--	cnt = (val & 0x3f);
--	val &= ~0x3f;
--
--	/* If we are trying to shift >= 64 bits, clear the destination
--	 * register.  This can happen when phys_bits ends up being equal
--	 * to MAX_PHYS_ADDRESS_BITS.
--	 */
--	final_shift = (cnt + (64 - phys_bits));
--	if (final_shift >= 64) {
--		unsigned int rd = (val >> 25) & 0x1f;
--
--		val = 0x80100000 | (rd << 25);
--	} else {
--		val |= final_shift;
--	}
--	*insn = val;
--
--	__asm__ __volatile__("flush	%0"
--			     : /* no outputs */
--			     : "r" (insn));
--}
--
--static void __init page_offset_shift_patch(unsigned long phys_bits)
--{
--	extern unsigned int __page_offset_shift_patch;
--	extern unsigned int __page_offset_shift_patch_end;
--	unsigned int *p;
--
--	p = &__page_offset_shift_patch;
--	while (p < &__page_offset_shift_patch_end) {
--		unsigned int *insn = (unsigned int *)(unsigned long)*p;
-+unsigned long VMALLOC_END   = 0x0000010000000000UL;
-+EXPORT_SYMBOL(VMALLOC_END);
- 
--		page_offset_shift_patch_one(insn, phys_bits);
--
--		p++;
--	}
--}
-+unsigned long sparc64_va_hole_top =    0xfffff80000000000UL;
-+unsigned long sparc64_va_hole_bottom = 0x0000080000000000UL;
- 
- static void __init setup_page_offset(void)
- {
--	unsigned long max_phys_bits = 40;
--
- 	if (tlb_type == cheetah || tlb_type == cheetah_plus) {
-+		/* Cheetah/Panther support a full 64-bit virtual
-+		 * address, so we can use all that our page tables
-+		 * support.
-+		 */
-+		sparc64_va_hole_top =    0xfff0000000000000UL;
-+		sparc64_va_hole_bottom = 0x0010000000000000UL;
-+
- 		max_phys_bits = 42;
- 	} else if (tlb_type == hypervisor) {
- 		switch (sun4v_chip_type) {
- 		case SUN4V_CHIP_NIAGARA1:
- 		case SUN4V_CHIP_NIAGARA2:
-+			/* T1 and T2 support 48-bit virtual addresses.  */
-+			sparc64_va_hole_top =    0xffff800000000000UL;
-+			sparc64_va_hole_bottom = 0x0000800000000000UL;
-+
- 			max_phys_bits = 39;
- 			break;
- 		case SUN4V_CHIP_NIAGARA3:
-+			/* T3 supports 48-bit virtual addresses.  */
-+			sparc64_va_hole_top =    0xffff800000000000UL;
-+			sparc64_va_hole_bottom = 0x0000800000000000UL;
-+
- 			max_phys_bits = 43;
- 			break;
- 		case SUN4V_CHIP_NIAGARA4:
- 		case SUN4V_CHIP_NIAGARA5:
- 		case SUN4V_CHIP_SPARC64X:
--		default:
-+		case SUN4V_CHIP_SPARC_M6:
-+			/* T4 and later support 52-bit virtual addresses.  */
-+			sparc64_va_hole_top =    0xfff8000000000000UL;
-+			sparc64_va_hole_bottom = 0x0008000000000000UL;
- 			max_phys_bits = 47;
- 			break;
-+		case SUN4V_CHIP_SPARC_M7:
-+		default:
-+			/* M7 and later support 52-bit virtual addresses.  */
-+			sparc64_va_hole_top =    0xfff8000000000000UL;
-+			sparc64_va_hole_bottom = 0x0008000000000000UL;
-+			max_phys_bits = 49;
-+			break;
- 		}
- 	}
- 
-@@ -1644,12 +1708,16 @@ static void __init setup_page_offset(void)
- 		prom_halt();
- 	}
- 
--	PAGE_OFFSET = PAGE_OFFSET_BY_BITS(max_phys_bits);
-+	PAGE_OFFSET = sparc64_va_hole_top;
-+	VMALLOC_END = ((sparc64_va_hole_bottom >> 1) +
-+		       (sparc64_va_hole_bottom >> 2));
- 
--	pr_info("PAGE_OFFSET is 0x%016lx (max_phys_bits == %lu)\n",
-+	pr_info("MM: PAGE_OFFSET is 0x%016lx (max_phys_bits == %lu)\n",
- 		PAGE_OFFSET, max_phys_bits);
--
--	page_offset_shift_patch(max_phys_bits);
-+	pr_info("MM: VMALLOC [0x%016lx --> 0x%016lx]\n",
-+		VMALLOC_START, VMALLOC_END);
-+	pr_info("MM: VMEMMAP [0x%016lx --> 0x%016lx]\n",
-+		VMEMMAP_BASE, VMEMMAP_BASE << 1);
- }
- 
- static void __init tsb_phys_patch(void)
-@@ -1694,21 +1762,42 @@ static void __init tsb_phys_patch(void)
- #define NUM_KTSB_DESCR	1
- #endif
- static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
--extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
-+
-+/* The swapper TSBs are loaded with a base sequence of:
-+ *
-+ *	sethi	%uhi(SYMBOL), REG1
-+ *	sethi	%hi(SYMBOL), REG2
-+ *	or	REG1, %ulo(SYMBOL), REG1
-+ *	or	REG2, %lo(SYMBOL), REG2
-+ *	sllx	REG1, 32, REG1
-+ *	or	REG1, REG2, REG1
-+ *
-+ * When we use physical addressing for the TSB accesses, we patch the
-+ * first four instructions in the above sequence.
-+ */
- 
- static void patch_one_ktsb_phys(unsigned int *start, unsigned int *end, unsigned long pa)
- {
--	pa >>= KTSB_PHYS_SHIFT;
-+	unsigned long high_bits, low_bits;
-+
-+	high_bits = (pa >> 32) & 0xffffffff;
-+	low_bits = (pa >> 0) & 0xffffffff;
- 
- 	while (start < end) {
- 		unsigned int *ia = (unsigned int *)(unsigned long)*start;
- 
--		ia[0] = (ia[0] & ~0x3fffff) | (pa >> 10);
-+		ia[0] = (ia[0] & ~0x3fffff) | (high_bits >> 10);
- 		__asm__ __volatile__("flush	%0" : : "r" (ia));
- 
--		ia[1] = (ia[1] & ~0x3ff) | (pa & 0x3ff);
-+		ia[1] = (ia[1] & ~0x3fffff) | (low_bits >> 10);
- 		__asm__ __volatile__("flush	%0" : : "r" (ia + 1));
- 
-+		ia[2] = (ia[2] & ~0x1fff) | (high_bits & 0x3ff);
-+		__asm__ __volatile__("flush	%0" : : "r" (ia + 2));
-+
-+		ia[3] = (ia[3] & ~0x1fff) | (low_bits & 0x3ff);
-+		__asm__ __volatile__("flush	%0" : : "r" (ia + 3));
-+
- 		start++;
- 	}
- }
-@@ -1847,7 +1936,6 @@ static void __init sun4v_linear_pte_xor_finalize(void)
- /* paging_init() sets up the page tables */
- 
- static unsigned long last_valid_pfn;
--pgd_t swapper_pg_dir[PTRS_PER_PGD];
- 
- static void sun4u_pgprot_init(void);
- static void sun4v_pgprot_init(void);
-@@ -1950,16 +2038,10 @@ void __init paging_init(void)
- 	 */
- 	init_mm.pgd += ((shift) / (sizeof(pgd_t)));
- 	
--	memset(swapper_low_pmd_dir, 0, sizeof(swapper_low_pmd_dir));
-+	memset(swapper_pg_dir, 0, sizeof(swapper_pg_dir));
- 
--	/* Now can init the kernel/bad page tables. */
--	pud_set(pud_offset(&swapper_pg_dir[0], 0),
--		swapper_low_pmd_dir + (shift / sizeof(pgd_t)));
--	
- 	inherit_prom_mappings();
- 	
--	init_kpte_bitmap();
--
- 	/* Ok, we can use our TLB miss and window trap handlers safely.  */
- 	setup_tba();
- 
-@@ -2066,70 +2148,6 @@ int page_in_phys_avail(unsigned long paddr)
- 	return 0;
- }
- 
--static struct linux_prom64_registers pavail_rescan[MAX_BANKS] __initdata;
--static int pavail_rescan_ents __initdata;
--
--/* Certain OBP calls, such as fetching "available" properties, can
-- * claim physical memory.  So, along with initializing the valid
-- * address bitmap, what we do here is refetch the physical available
-- * memory list again, and make sure it provides at least as much
-- * memory as 'pavail' does.
-- */
--static void __init setup_valid_addr_bitmap_from_pavail(unsigned long *bitmap)
--{
--	int i;
--
--	read_obp_memory("available", &pavail_rescan[0], &pavail_rescan_ents);
--
--	for (i = 0; i < pavail_ents; i++) {
--		unsigned long old_start, old_end;
--
--		old_start = pavail[i].phys_addr;
--		old_end = old_start + pavail[i].reg_size;
--		while (old_start < old_end) {
--			int n;
--
--			for (n = 0; n < pavail_rescan_ents; n++) {
--				unsigned long new_start, new_end;
--
--				new_start = pavail_rescan[n].phys_addr;
--				new_end = new_start +
--					pavail_rescan[n].reg_size;
--
--				if (new_start <= old_start &&
--				    new_end >= (old_start + PAGE_SIZE)) {
--					set_bit(old_start >> ILOG2_4MB, bitmap);
--					goto do_next_page;
--				}
--			}
--
--			prom_printf("mem_init: Lost memory in pavail\n");
--			prom_printf("mem_init: OLD start[%lx] size[%lx]\n",
--				    pavail[i].phys_addr,
--				    pavail[i].reg_size);
--			prom_printf("mem_init: NEW start[%lx] size[%lx]\n",
--				    pavail_rescan[i].phys_addr,
--				    pavail_rescan[i].reg_size);
--			prom_printf("mem_init: Cannot continue, aborting.\n");
--			prom_halt();
--
--		do_next_page:
--			old_start += PAGE_SIZE;
--		}
--	}
--}
--
--static void __init patch_tlb_miss_handler_bitmap(void)
--{
--	extern unsigned int valid_addr_bitmap_insn[];
--	extern unsigned int valid_addr_bitmap_patch[];
--
--	valid_addr_bitmap_insn[1] = valid_addr_bitmap_patch[1];
--	mb();
--	valid_addr_bitmap_insn[0] = valid_addr_bitmap_patch[0];
--	flushi(&valid_addr_bitmap_insn[0]);
--}
--
- static void __init register_page_bootmem_info(void)
- {
- #ifdef CONFIG_NEED_MULTIPLE_NODES
-@@ -2142,18 +2160,6 @@ static void __init register_page_bootmem_info(void)
- }
- void __init mem_init(void)
- {
--	unsigned long addr, last;
--
--	addr = PAGE_OFFSET + kern_base;
--	last = PAGE_ALIGN(kern_size) + addr;
--	while (addr < last) {
--		set_bit(__pa(addr) >> ILOG2_4MB, sparc64_valid_addr_bitmap);
--		addr += PAGE_SIZE;
--	}
--
--	setup_valid_addr_bitmap_from_pavail(sparc64_valid_addr_bitmap);
--	patch_tlb_miss_handler_bitmap();
--
- 	high_memory = __va(last_valid_pfn << PAGE_SHIFT);
- 
- 	register_page_bootmem_info();
-@@ -2243,18 +2249,9 @@ unsigned long _PAGE_CACHE __read_mostly;
- EXPORT_SYMBOL(_PAGE_CACHE);
- 
- #ifdef CONFIG_SPARSEMEM_VMEMMAP
--unsigned long vmemmap_table[VMEMMAP_SIZE];
--
--static long __meminitdata addr_start, addr_end;
--static int __meminitdata node_start;
--
- int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend,
- 			       int node)
- {
--	unsigned long phys_start = (vstart - VMEMMAP_BASE);
--	unsigned long phys_end = (vend - VMEMMAP_BASE);
--	unsigned long addr = phys_start & VMEMMAP_CHUNK_MASK;
--	unsigned long end = VMEMMAP_ALIGN(phys_end);
- 	unsigned long pte_base;
- 
- 	pte_base = (_PAGE_VALID | _PAGE_SZ4MB_4U |
-@@ -2265,47 +2262,52 @@ int __meminit vmemmap_populate(unsigned long vstart, unsigned long vend,
- 			    _PAGE_CP_4V | _PAGE_CV_4V |
- 			    _PAGE_P_4V | _PAGE_W_4V);
- 
--	for (; addr < end; addr += VMEMMAP_CHUNK) {
--		unsigned long *vmem_pp =
--			vmemmap_table + (addr >> VMEMMAP_CHUNK_SHIFT);
--		void *block;
-+	pte_base |= _PAGE_PMD_HUGE;
- 
--		if (!(*vmem_pp & _PAGE_VALID)) {
--			block = vmemmap_alloc_block(1UL << ILOG2_4MB, node);
--			if (!block)
-+	vstart = vstart & PMD_MASK;
-+	vend = ALIGN(vend, PMD_SIZE);
-+	for (; vstart < vend; vstart += PMD_SIZE) {
-+		pgd_t *pgd = pgd_offset_k(vstart);
-+		unsigned long pte;
-+		pud_t *pud;
-+		pmd_t *pmd;
-+
-+		if (pgd_none(*pgd)) {
-+			pud_t *new = vmemmap_alloc_block(PAGE_SIZE, node);
-+
-+			if (!new)
- 				return -ENOMEM;
-+			pgd_populate(&init_mm, pgd, new);
-+		}
- 
--			*vmem_pp = pte_base | __pa(block);
-+		pud = pud_offset(pgd, vstart);
-+		if (pud_none(*pud)) {
-+			pmd_t *new = vmemmap_alloc_block(PAGE_SIZE, node);
- 
--			/* check to see if we have contiguous blocks */
--			if (addr_end != addr || node_start != node) {
--				if (addr_start)
--					printk(KERN_DEBUG " [%lx-%lx] on node %d\n",
--					       addr_start, addr_end-1, node_start);
--				addr_start = addr;
--				node_start = node;
--			}
--			addr_end = addr + VMEMMAP_CHUNK;
-+			if (!new)
-+				return -ENOMEM;
-+			pud_populate(&init_mm, pud, new);
- 		}
--	}
--	return 0;
--}
- 
--void __meminit vmemmap_populate_print_last(void)
--{
--	if (addr_start) {
--		printk(KERN_DEBUG " [%lx-%lx] on node %d\n",
--		       addr_start, addr_end-1, node_start);
--		addr_start = 0;
--		addr_end = 0;
--		node_start = 0;
-+		pmd = pmd_offset(pud, vstart);
-+
-+		pte = pmd_val(*pmd);
-+		if (!(pte & _PAGE_VALID)) {
-+			void *block = vmemmap_alloc_block(PMD_SIZE, node);
-+
-+			if (!block)
-+				return -ENOMEM;
-+
-+			pmd_val(*pmd) = pte_base | __pa(block);
-+		}
- 	}
-+
-+	return 0;
- }
- 
- void vmemmap_free(unsigned long start, unsigned long end)
- {
- }
--
- #endif /* CONFIG_SPARSEMEM_VMEMMAP */
- 
- static void prot_init_common(unsigned long page_none,
-@@ -2717,8 +2719,8 @@ void flush_tlb_kernel_range(unsigned long start, unsigned long end)
- 			do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS);
- 		}
- 		if (end > HI_OBP_ADDRESS) {
--			flush_tsb_kernel_range(end, HI_OBP_ADDRESS);
--			do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS);
-+			flush_tsb_kernel_range(HI_OBP_ADDRESS, end);
-+			do_flush_tlb_kernel_range(HI_OBP_ADDRESS, end);
- 		}
- 	} else {
- 		flush_tsb_kernel_range(start, end);
-diff --git a/arch/sparc/mm/init_64.h b/arch/sparc/mm/init_64.h
-index 5d3782de..ac49119 100644
---- a/arch/sparc/mm/init_64.h
-+++ b/arch/sparc/mm/init_64.h
-@@ -8,15 +8,8 @@
-  */
- 
- #define MAX_PHYS_ADDRESS	(1UL << MAX_PHYS_ADDRESS_BITS)
--#define KPTE_BITMAP_CHUNK_SZ		(256UL * 1024UL * 1024UL)
--#define KPTE_BITMAP_BYTES	\
--	((MAX_PHYS_ADDRESS / KPTE_BITMAP_CHUNK_SZ) / 4)
--#define VALID_ADDR_BITMAP_CHUNK_SZ	(4UL * 1024UL * 1024UL)
--#define VALID_ADDR_BITMAP_BYTES	\
--	((MAX_PHYS_ADDRESS / VALID_ADDR_BITMAP_CHUNK_SZ) / 8)
- 
- extern unsigned long kern_linear_pte_xor[4];
--extern unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
- extern unsigned int sparc64_highest_unlocked_tlb_ent;
- extern unsigned long sparc64_kern_pri_context;
- extern unsigned long sparc64_kern_pri_nuc_bits;
-@@ -38,15 +31,4 @@ extern unsigned long kern_locked_tte_data;
- 
- extern void prom_world(int enter);
- 
--#ifdef CONFIG_SPARSEMEM_VMEMMAP
--#define VMEMMAP_CHUNK_SHIFT	22
--#define VMEMMAP_CHUNK		(1UL << VMEMMAP_CHUNK_SHIFT)
--#define VMEMMAP_CHUNK_MASK	~(VMEMMAP_CHUNK - 1UL)
--#define VMEMMAP_ALIGN(x)	(((x)+VMEMMAP_CHUNK-1UL)&VMEMMAP_CHUNK_MASK)
--
--#define VMEMMAP_SIZE	((((1UL << MAX_PHYSADDR_BITS) >> PAGE_SHIFT) * \
--			  sizeof(struct page)) >> VMEMMAP_CHUNK_SHIFT)
--extern unsigned long vmemmap_table[VMEMMAP_SIZE];
--#endif
--
- #endif /* _SPARC64_MM_INIT_H */
-diff --git a/arch/sparc/power/hibernate_asm.S b/arch/sparc/power/hibernate_asm.S
-index 7994216..d7d9017 100644
---- a/arch/sparc/power/hibernate_asm.S
-+++ b/arch/sparc/power/hibernate_asm.S
-@@ -54,8 +54,8 @@ ENTRY(swsusp_arch_resume)
- 	 nop
- 
- 	/* Write PAGE_OFFSET to %g7 */
--	sethi	%uhi(PAGE_OFFSET), %g7
--	sllx	%g7, 32, %g7
-+	sethi	%hi(PAGE_OFFSET), %g7
-+	ldx	[%g7 + %lo(PAGE_OFFSET)], %g7
- 
- 	setuw	(PAGE_SIZE-8), %g3
- 
-diff --git a/arch/sparc/prom/bootstr_64.c b/arch/sparc/prom/bootstr_64.c
-index ab9ccc6..7149e77 100644
---- a/arch/sparc/prom/bootstr_64.c
-+++ b/arch/sparc/prom/bootstr_64.c
-@@ -14,7 +14,10 @@
-  *          the .bss section or it will break things.
-  */
- 
--#define BARG_LEN  256
-+/* We limit BARG_LEN to 1024 because this is the size of the
-+ * 'barg_out' command line buffer in the SILO bootloader.
-+ */
-+#define BARG_LEN 1024
- struct {
- 	int bootstr_len;
- 	int bootstr_valid;
-diff --git a/arch/sparc/prom/cif.S b/arch/sparc/prom/cif.S
-index 9c86b4b..8050f38 100644
---- a/arch/sparc/prom/cif.S
-+++ b/arch/sparc/prom/cif.S
-@@ -11,11 +11,10 @@
- 	.text
- 	.globl	prom_cif_direct
- prom_cif_direct:
-+	save	%sp, -192, %sp
- 	sethi	%hi(p1275buf), %o1
- 	or	%o1, %lo(p1275buf), %o1
--	ldx	[%o1 + 0x0010], %o2	! prom_cif_stack
--	save	%o2, -192, %sp
--	ldx	[%i1 + 0x0008], %l2	! prom_cif_handler
-+	ldx	[%o1 + 0x0008], %l2	! prom_cif_handler
- 	mov	%g4, %l0
- 	mov	%g5, %l1
- 	mov	%g6, %l3
-diff --git a/arch/sparc/prom/init_64.c b/arch/sparc/prom/init_64.c
-index d95db75..110b0d7 100644
---- a/arch/sparc/prom/init_64.c
-+++ b/arch/sparc/prom/init_64.c
-@@ -26,13 +26,13 @@ phandle prom_chosen_node;
-  * It gets passed the pointer to the PROM vector.
-  */
- 
--extern void prom_cif_init(void *, void *);
-+extern void prom_cif_init(void *);
- 
--void __init prom_init(void *cif_handler, void *cif_stack)
-+void __init prom_init(void *cif_handler)
- {
- 	phandle node;
- 
--	prom_cif_init(cif_handler, cif_stack);
-+	prom_cif_init(cif_handler);
- 
- 	prom_chosen_node = prom_finddevice(prom_chosen_path);
- 	if (!prom_chosen_node || (s32)prom_chosen_node == -1)
-diff --git a/arch/sparc/prom/p1275.c b/arch/sparc/prom/p1275.c
-index e58b817..545d8bb 100644
---- a/arch/sparc/prom/p1275.c
-+++ b/arch/sparc/prom/p1275.c
-@@ -9,6 +9,7 @@
- #include <linux/smp.h>
- #include <linux/string.h>
- #include <linux/spinlock.h>
-+#include <linux/irqflags.h>
- 
- #include <asm/openprom.h>
- #include <asm/oplib.h>
-@@ -19,7 +20,6 @@
- struct {
- 	long prom_callback;			/* 0x00 */
- 	void (*prom_cif_handler)(long *);	/* 0x08 */
--	unsigned long prom_cif_stack;		/* 0x10 */
- } p1275buf;
- 
- extern void prom_world(int);
-@@ -36,8 +36,8 @@ void p1275_cmd_direct(unsigned long *args)
- {
- 	unsigned long flags;
- 
--	raw_local_save_flags(flags);
--	raw_local_irq_restore((unsigned long)PIL_NMI);
-+	local_save_flags(flags);
-+	local_irq_restore((unsigned long)PIL_NMI);
- 	raw_spin_lock(&prom_entry_lock);
- 
- 	prom_world(1);
-@@ -45,11 +45,10 @@ void p1275_cmd_direct(unsigned long *args)
- 	prom_world(0);
- 
- 	raw_spin_unlock(&prom_entry_lock);
--	raw_local_irq_restore(flags);
-+	local_irq_restore(flags);
- }
- 
- void prom_cif_init(void *cif_handler, void *cif_stack)
- {
- 	p1275buf.prom_cif_handler = (void (*)(long *))cif_handler;
--	p1275buf.prom_cif_stack = (unsigned long)cif_stack;
- }
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index d71d5ac..ac63ea4 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -480,6 +480,7 @@ struct kvm_vcpu_arch {
- 	u64 mmio_gva;
- 	unsigned access;
- 	gfn_t mmio_gfn;
-+	u64 mmio_gen;
- 
- 	struct kvm_pmu pmu;
- 
-diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
-index 5cd9bfa..c1a07d3 100644
---- a/arch/x86/kernel/cpu/intel.c
-+++ b/arch/x86/kernel/cpu/intel.c
-@@ -153,6 +153,21 @@ static void early_init_intel(struct cpuinfo_x86 *c)
- 			setup_clear_cpu_cap(X86_FEATURE_ERMS);
- 		}
- 	}
-+
-+	/*
-+	 * Intel Quark Core DevMan_001.pdf section 6.4.11
-+	 * "The operating system also is required to invalidate (i.e., flush)
-+	 *  the TLB when any changes are made to any of the page table entries.
-+	 *  The operating system must reload CR3 to cause the TLB to be flushed"
-+	 *
-+	 * As a result cpu_has_pge() in arch/x86/include/asm/tlbflush.h should
-+	 * be false so that __flush_tlb_all() causes CR3 insted of CR4.PGE
-+	 * to be modified
-+	 */
-+	if (c->x86 == 5 && c->x86_model == 9) {
-+		pr_info("Disabling PGE capability bit\n");
-+		setup_clear_cpu_cap(X86_FEATURE_PGE);
-+	}
- }
- 
- #ifdef CONFIG_X86_32
-diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index 9b53135..49088b8 100644
---- a/arch/x86/kvm/mmu.c
-+++ b/arch/x86/kvm/mmu.c
-@@ -198,16 +198,20 @@ void kvm_mmu_set_mmio_spte_mask(u64 mmio_mask)
- EXPORT_SYMBOL_GPL(kvm_mmu_set_mmio_spte_mask);
- 
- /*
-- * spte bits of bit 3 ~ bit 11 are used as low 9 bits of generation number,
-- * the bits of bits 52 ~ bit 61 are used as high 10 bits of generation
-- * number.
-+ * the low bit of the generation number is always presumed to be zero.
-+ * This disables mmio caching during memslot updates.  The concept is
-+ * similar to a seqcount but instead of retrying the access we just punt
-+ * and ignore the cache.
-+ *
-+ * spte bits 3-11 are used as bits 1-9 of the generation number,
-+ * the bits 52-61 are used as bits 10-19 of the generation number.
-  */
--#define MMIO_SPTE_GEN_LOW_SHIFT		3
-+#define MMIO_SPTE_GEN_LOW_SHIFT		2
- #define MMIO_SPTE_GEN_HIGH_SHIFT	52
- 
--#define MMIO_GEN_SHIFT			19
--#define MMIO_GEN_LOW_SHIFT		9
--#define MMIO_GEN_LOW_MASK		((1 << MMIO_GEN_LOW_SHIFT) - 1)
-+#define MMIO_GEN_SHIFT			20
-+#define MMIO_GEN_LOW_SHIFT		10
-+#define MMIO_GEN_LOW_MASK		((1 << MMIO_GEN_LOW_SHIFT) - 2)
- #define MMIO_GEN_MASK			((1 << MMIO_GEN_SHIFT) - 1)
- #define MMIO_MAX_GEN			((1 << MMIO_GEN_SHIFT) - 1)
- 
-@@ -3157,7 +3161,7 @@ static void mmu_sync_roots(struct kvm_vcpu *vcpu)
- 	if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
- 		return;
- 
--	vcpu_clear_mmio_info(vcpu, ~0ul);
-+	vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY);
- 	kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC);
- 	if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
- 		hpa_t root = vcpu->arch.mmu.root_hpa;
-@@ -4379,7 +4383,7 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm)
- 	 * The very rare case: if the generation-number is round,
- 	 * zap all shadow pages.
- 	 */
--	if (unlikely(kvm_current_mmio_generation(kvm) >= MMIO_MAX_GEN)) {
-+	if (unlikely(kvm_current_mmio_generation(kvm) == 0)) {
- 		printk_ratelimited(KERN_INFO "kvm: zapping shadow pages for mmio generation wraparound\n");
- 		kvm_mmu_invalidate_zap_all_pages(kvm);
- 	}
-diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
-index 8da5823..21ea4fc 100644
---- a/arch/x86/kvm/x86.h
-+++ b/arch/x86/kvm/x86.h
-@@ -78,15 +78,23 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
- 	vcpu->arch.mmio_gva = gva & PAGE_MASK;
- 	vcpu->arch.access = access;
- 	vcpu->arch.mmio_gfn = gfn;
-+	vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation;
-+}
-+
-+static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu)
-+{
-+	return vcpu->arch.mmio_gen == kvm_memslots(vcpu->kvm)->generation;
- }
- 
- /*
-- * Clear the mmio cache info for the given gva,
-- * specially, if gva is ~0ul, we clear all mmio cache info.
-+ * Clear the mmio cache info for the given gva. If gva is MMIO_GVA_ANY, we
-+ * clear all mmio cache info.
-  */
-+#define MMIO_GVA_ANY (~(gva_t)0)
-+
- static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva)
- {
--	if (gva != (~0ul) && vcpu->arch.mmio_gva != (gva & PAGE_MASK))
-+	if (gva != MMIO_GVA_ANY && vcpu->arch.mmio_gva != (gva & PAGE_MASK))
- 		return;
- 
- 	vcpu->arch.mmio_gva = 0;
-@@ -94,7 +102,8 @@ static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva)
- 
- static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva)
- {
--	if (vcpu->arch.mmio_gva && vcpu->arch.mmio_gva == (gva & PAGE_MASK))
-+	if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gva &&
-+	      vcpu->arch.mmio_gva == (gva & PAGE_MASK))
- 		return true;
- 
- 	return false;
-@@ -102,7 +111,8 @@ static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva)
- 
- static inline bool vcpu_match_mmio_gpa(struct kvm_vcpu *vcpu, gpa_t gpa)
- {
--	if (vcpu->arch.mmio_gfn && vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT)
-+	if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gfn &&
-+	      vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT)
- 		return true;
- 
- 	return false;
-diff --git a/crypto/async_tx/async_xor.c b/crypto/async_tx/async_xor.c
-index 3c562f5..e1bce26 100644
---- a/crypto/async_tx/async_xor.c
-+++ b/crypto/async_tx/async_xor.c
-@@ -78,8 +78,6 @@ do_async_xor(struct dma_chan *chan, struct dmaengine_unmap_data *unmap,
- 		tx = dma->device_prep_dma_xor(chan, dma_dest, src_list,
- 					      xor_src_cnt, unmap->len,
- 					      dma_flags);
--		src_list[0] = tmp;
--
- 
- 		if (unlikely(!tx))
- 			async_tx_quiesce(&submit->depend_tx);
-@@ -92,6 +90,7 @@ do_async_xor(struct dma_chan *chan, struct dmaengine_unmap_data *unmap,
- 						      xor_src_cnt, unmap->len,
- 						      dma_flags);
- 		}
-+		src_list[0] = tmp;
- 
- 		dma_set_unmap(tx, unmap);
- 		async_tx_submit(chan, tx, submit);
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index c30df50e..2495ee5 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -1081,6 +1081,9 @@ _request_firmware(const struct firmware **firmware_p, const char *name,
- 	if (!firmware_p)
- 		return -EINVAL;
- 
-+	if (!name || name[0] == '\0')
-+		return -EINVAL;
-+
- 	ret = _request_firmware_prepare(&fw, name, device);
- 	if (ret <= 0) /* error or already assigned */
- 		goto out;
-diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
-index c5471cd..d39fd61 100644
---- a/drivers/base/regmap/regmap-debugfs.c
-+++ b/drivers/base/regmap/regmap-debugfs.c
-@@ -473,6 +473,7 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
- {
- 	struct rb_node *next;
- 	struct regmap_range_node *range_node;
-+	const char *devname = "dummy";
- 
- 	/* If we don't have the debugfs root yet, postpone init */
- 	if (!regmap_debugfs_root) {
-@@ -491,12 +492,15 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
- 	INIT_LIST_HEAD(&map->debugfs_off_cache);
- 	mutex_init(&map->cache_lock);
- 
-+	if (map->dev)
-+		devname = dev_name(map->dev);
-+
- 	if (name) {
- 		map->debugfs_name = kasprintf(GFP_KERNEL, "%s-%s",
--					      dev_name(map->dev), name);
-+					      devname, name);
- 		name = map->debugfs_name;
- 	} else {
--		name = dev_name(map->dev);
-+		name = devname;
- 	}
- 
- 	map->debugfs = debugfs_create_dir(name, regmap_debugfs_root);
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 2ea056c..f6cff3b 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -1308,7 +1308,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
- 	}
- 
- #ifdef LOG_DEVICE
--	if (strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
-+	if (map->dev && strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
- 		dev_info(map->dev, "%x <= %x\n", reg, val);
- #endif
- 
-@@ -1557,6 +1557,9 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
- 	} else {
- 		void *wval;
- 
-+		if (!val_count)
-+			return -EINVAL;
-+
- 		wval = kmemdup(val, val_count * val_bytes, GFP_KERNEL);
- 		if (!wval) {
- 			ret = -ENOMEM;
-@@ -1739,7 +1742,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
- 	ret = map->reg_read(context, reg, val);
- 	if (ret == 0) {
- #ifdef LOG_DEVICE
--		if (strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
-+		if (map->dev && strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
- 			dev_info(map->dev, "%x => %x\n", reg, *val);
- #endif
- 
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 1c7b504..e00c3f8 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -309,6 +309,9 @@ static void btusb_intr_complete(struct urb *urb)
- 			BT_ERR("%s corrupted event packet", hdev->name);
- 			hdev->stat.err_rx++;
- 		}
-+	} else if (urb->status == -ENOENT) {
-+		/* Avoid suspend failed when usb_kill_urb */
-+		return;
- 	}
- 
- 	if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
-@@ -397,6 +400,9 @@ static void btusb_bulk_complete(struct urb *urb)
- 			BT_ERR("%s corrupted ACL packet", hdev->name);
- 			hdev->stat.err_rx++;
- 		}
-+	} else if (urb->status == -ENOENT) {
-+		/* Avoid suspend failed when usb_kill_urb */
-+		return;
- 	}
- 
- 	if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
-@@ -491,6 +497,9 @@ static void btusb_isoc_complete(struct urb *urb)
- 				hdev->stat.err_rx++;
- 			}
- 		}
-+	} else if (urb->status == -ENOENT) {
-+		/* Avoid suspend failed when usb_kill_urb */
-+		return;
- 	}
- 
- 	if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
-diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
-index e36a024..5651992 100644
---- a/drivers/bluetooth/hci_h5.c
-+++ b/drivers/bluetooth/hci_h5.c
-@@ -237,7 +237,7 @@ static void h5_pkt_cull(struct h5 *h5)
- 			break;
- 
- 		to_remove--;
--		seq = (seq - 1) % 8;
-+		seq = (seq - 1) & 0x07;
- 	}
- 
- 	if (seq != h5->rx_ack)
-diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 69ea36f..e99e71a 100644
---- a/drivers/hv/channel.c
-+++ b/drivers/hv/channel.c
-@@ -164,8 +164,10 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
- 	ret = vmbus_post_msg(open_msg,
- 			       sizeof(struct vmbus_channel_open_channel));
- 
--	if (ret != 0)
-+	if (ret != 0) {
-+		err = ret;
- 		goto error1;
-+	}
- 
- 	t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ);
- 	if (t == 0) {
-@@ -362,7 +364,6 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
- 	u32 next_gpadl_handle;
- 	unsigned long flags;
- 	int ret = 0;
--	int t;
- 
- 	next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
- 	atomic_inc(&vmbus_connection.next_gpadl_handle);
-@@ -409,9 +410,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
- 
- 		}
- 	}
--	t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
--	BUG_ON(t == 0);
--
-+	wait_for_completion(&msginfo->waitevent);
- 
- 	/* At this point, we received the gpadl created msg */
- 	*gpadl_handle = gpadlmsg->gpadl;
-@@ -434,7 +433,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- 	struct vmbus_channel_gpadl_teardown *msg;
- 	struct vmbus_channel_msginfo *info;
- 	unsigned long flags;
--	int ret, t;
-+	int ret;
- 
- 	info = kmalloc(sizeof(*info) +
- 		       sizeof(struct vmbus_channel_gpadl_teardown), GFP_KERNEL);
-@@ -456,11 +455,12 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- 	ret = vmbus_post_msg(msg,
- 			       sizeof(struct vmbus_channel_gpadl_teardown));
- 
--	BUG_ON(ret != 0);
--	t = wait_for_completion_timeout(&info->waitevent, 5*HZ);
--	BUG_ON(t == 0);
-+	if (ret)
-+		goto post_msg_err;
-+
-+	wait_for_completion(&info->waitevent);
- 
--	/* Received a torndown response */
-+post_msg_err:
- 	spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
- 	list_del(&info->msglistentry);
- 	spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
-@@ -470,7 +470,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
- }
- EXPORT_SYMBOL_GPL(vmbus_teardown_gpadl);
- 
--static void vmbus_close_internal(struct vmbus_channel *channel)
-+static int vmbus_close_internal(struct vmbus_channel *channel)
- {
- 	struct vmbus_channel_close_channel *msg;
- 	int ret;
-@@ -492,11 +492,28 @@ static void vmbus_close_internal(struct vmbus_channel *channel)
- 
- 	ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel));
- 
--	BUG_ON(ret != 0);
-+	if (ret) {
-+		pr_err("Close failed: close post msg return is %d\n", ret);
-+		/*
-+		 * If we failed to post the close msg,
-+		 * it is perhaps better to leak memory.
-+		 */
-+		return ret;
-+	}
-+
- 	/* Tear down the gpadl for the channel's ring buffer */
--	if (channel->ringbuffer_gpadlhandle)
--		vmbus_teardown_gpadl(channel,
--					  channel->ringbuffer_gpadlhandle);
-+	if (channel->ringbuffer_gpadlhandle) {
-+		ret = vmbus_teardown_gpadl(channel,
-+					   channel->ringbuffer_gpadlhandle);
-+		if (ret) {
-+			pr_err("Close failed: teardown gpadl return %d\n", ret);
-+			/*
-+			 * If we failed to teardown gpadl,
-+			 * it is perhaps better to leak memory.
-+			 */
-+			return ret;
-+		}
-+	}
- 
- 	/* Cleanup the ring buffers for this channel */
- 	hv_ringbuffer_cleanup(&channel->outbound);
-@@ -505,7 +522,7 @@ static void vmbus_close_internal(struct vmbus_channel *channel)
- 	free_pages((unsigned long)channel->ringbuffer_pages,
- 		get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
- 
--
-+	return ret;
- }
- 
- /*
-diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
-index ce5a9f2..d8fd95c 100644
---- a/drivers/hv/connection.c
-+++ b/drivers/hv/connection.c
-@@ -408,10 +408,21 @@ int vmbus_post_msg(void *buffer, size_t buflen)
- 	 * insufficient resources. Retry the operation a couple of
- 	 * times before giving up.
- 	 */
--	while (retries < 3) {
--		ret =  hv_post_message(conn_id, 1, buffer, buflen);
--		if (ret != HV_STATUS_INSUFFICIENT_BUFFERS)
-+	while (retries < 10) {
-+		ret = hv_post_message(conn_id, 1, buffer, buflen);
-+
-+		switch (ret) {
-+		case HV_STATUS_INSUFFICIENT_BUFFERS:
-+			ret = -ENOMEM;
-+		case -ENOMEM:
-+			break;
-+		case HV_STATUS_SUCCESS:
- 			return ret;
-+		default:
-+			pr_err("hv_post_msg() failed; error code:%d\n", ret);
-+			return -EINVAL;
-+		}
-+
- 		retries++;
- 		msleep(100);
- 	}
-diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c
-index 5653e50..424f51d 100644
---- a/drivers/message/fusion/mptspi.c
-+++ b/drivers/message/fusion/mptspi.c
-@@ -1422,6 +1422,11 @@ mptspi_probe(struct pci_dev *pdev, const struct pci_device_id *id)
- 		goto out_mptspi_probe;
-         }
- 
-+	/* VMWare emulation doesn't properly implement WRITE_SAME
-+	 */
-+	if (pdev->subsystem_vendor == 0x15AD)
-+		sh->no_write_same = 1;
-+
- 	spin_lock_irqsave(&ioc->FreeQlock, flags);
- 
- 	/* Attach the SCSI Host to the IOC structure
-diff --git a/drivers/misc/mei/bus.c b/drivers/misc/mei/bus.c
-index 4bc7d62..9a07bba 100644
---- a/drivers/misc/mei/bus.c
-+++ b/drivers/misc/mei/bus.c
-@@ -71,7 +71,7 @@ static int mei_cl_device_probe(struct device *dev)
- 
- 	dev_dbg(dev, "Device probe\n");
- 
--	strncpy(id.name, dev_name(dev), sizeof(id.name));
-+	strlcpy(id.name, dev_name(dev), sizeof(id.name));
- 
- 	return driver->probe(device, &id);
- }
-diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
-index df1f5e7..1ac33d9 100644
---- a/drivers/net/wireless/iwlwifi/pcie/drv.c
-+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
-@@ -272,6 +272,8 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
- 	{IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x08B1, 0x4072, iwl7260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x08B1, 0x4C60, iwl7260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x08B1, 0x4C70, iwl7260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
- 	{IWL_PCI_DEVICE(0x08B1, 0x406A, iwl7260_2n_cfg)},
- 	{IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
-@@ -315,6 +317,8 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
- 	{IWL_PCI_DEVICE(0x08B1, 0xC770, iwl7260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x08B1, 0xC760, iwl7260_2n_cfg)},
- 	{IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x08B1, 0xCC70, iwl7260_2ac_cfg)},
-+	{IWL_PCI_DEVICE(0x08B1, 0xCC60, iwl7260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x08B2, 0xC272, iwl7260_2ac_cfg)},
- 	{IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
- 	{IWL_PCI_DEVICE(0x08B2, 0xC26A, iwl7260_n_cfg)},
-diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
-index a394a9a..7cf6081 100644
---- a/drivers/net/wireless/rt2x00/rt2800.h
-+++ b/drivers/net/wireless/rt2x00/rt2800.h
-@@ -2039,7 +2039,7 @@ struct mac_iveiv_entry {
-  * 2 - drop tx power by 12dBm,
-  * 3 - increase tx power by 6dBm
-  */
--#define BBP1_TX_POWER_CTRL		FIELD8(0x07)
-+#define BBP1_TX_POWER_CTRL		FIELD8(0x03)
- #define BBP1_TX_ANTENNA			FIELD8(0x18)
- 
- /*
-diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
-index 483d9ad..9773667 100644
---- a/drivers/pci/host/pci-mvebu.c
-+++ b/drivers/pci/host/pci-mvebu.c
-@@ -855,7 +855,7 @@ static int mvebu_get_tgt_attr(struct device_node *np, int devfn,
- 	rangesz = pna + na + ns;
- 	nranges = rlen / sizeof(__be32) / rangesz;
- 
--	for (i = 0; i < nranges; i++) {
-+	for (i = 0; i < nranges; i++, range += rangesz) {
- 		u32 flags = of_read_number(range, 1);
- 		u32 slot = of_read_number(range + 1, 1);
- 		u64 cpuaddr = of_read_number(range + na, pna);
-@@ -865,14 +865,14 @@ static int mvebu_get_tgt_attr(struct device_node *np, int devfn,
- 			rtype = IORESOURCE_IO;
- 		else if (DT_FLAGS_TO_TYPE(flags) == DT_TYPE_MEM32)
- 			rtype = IORESOURCE_MEM;
-+		else
-+			continue;
- 
- 		if (slot == PCI_SLOT(devfn) && type == rtype) {
- 			*tgt = DT_CPUADDR_TO_TARGET(cpuaddr);
- 			*attr = DT_CPUADDR_TO_ATTR(cpuaddr);
- 			return 0;
- 		}
--
--		range += rangesz;
- 	}
- 
- 	return -ENOENT;
-diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index 276ef9c..39a207a 100644
---- a/drivers/pci/pci-sysfs.c
-+++ b/drivers/pci/pci-sysfs.c
-@@ -178,7 +178,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
- {
- 	struct pci_dev *pci_dev = to_pci_dev(dev);
- 
--	return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x\n",
-+	return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X\n",
- 		       pci_dev->vendor, pci_dev->device,
- 		       pci_dev->subsystem_vendor, pci_dev->subsystem_device,
- 		       (u8)(pci_dev->class >> 16), (u8)(pci_dev->class >> 8),
-diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
-index 813f437..6e8776b 100644
---- a/drivers/pci/quirks.c
-+++ b/drivers/pci/quirks.c
-@@ -24,6 +24,7 @@
- #include <linux/ioport.h>
- #include <linux/sched.h>
- #include <linux/ktime.h>
-+#include <linux/mm.h>
- #include <asm/dma.h>	/* isa_dma_bridge_buggy */
- #include "pci.h"
- 
-@@ -287,6 +288,25 @@ static void quirk_citrine(struct pci_dev *dev)
- }
- DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM,	PCI_DEVICE_ID_IBM_CITRINE,	quirk_citrine);
- 
-+/*  On IBM Crocodile ipr SAS adapters, expand BAR to system page size */
-+static void quirk_extend_bar_to_page(struct pci_dev *dev)
-+{
-+	int i;
-+
-+	for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
-+		struct resource *r = &dev->resource[i];
-+
-+		if (r->flags & IORESOURCE_MEM && resource_size(r) < PAGE_SIZE) {
-+			r->end = PAGE_SIZE - 1;
-+			r->start = 0;
-+			r->flags |= IORESOURCE_UNSET;
-+			dev_info(&dev->dev, "expanded BAR %d to page size: %pR\n",
-+				 i, r);
-+		}
-+	}
-+}
-+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, 0x034a, quirk_extend_bar_to_page);
-+
- /*
-  *  S3 868 and 968 chips report region size equal to 32M, but they decode 64M.
-  *  If it's needed, re-allocate the region.
-diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
-index b2fcac7..5bb9406 100644
---- a/drivers/scsi/be2iscsi/be_mgmt.c
-+++ b/drivers/scsi/be2iscsi/be_mgmt.c
-@@ -897,17 +897,20 @@ mgmt_static_ip_modify(struct beiscsi_hba *phba,
- 
- 	if (ip_action == IP_ACTION_ADD) {
- 		memcpy(req->ip_params.ip_record.ip_addr.addr, ip_param->value,
--		       ip_param->len);
-+		       sizeof(req->ip_params.ip_record.ip_addr.addr));
- 
- 		if (subnet_param)
- 			memcpy(req->ip_params.ip_record.ip_addr.subnet_mask,
--			       subnet_param->value, subnet_param->len);
-+			       subnet_param->value,
-+			       sizeof(req->ip_params.ip_record.ip_addr.subnet_mask));
- 	} else {
- 		memcpy(req->ip_params.ip_record.ip_addr.addr,
--		       if_info->ip_addr.addr, ip_param->len);
-+		       if_info->ip_addr.addr,
-+		       sizeof(req->ip_params.ip_record.ip_addr.addr));
- 
- 		memcpy(req->ip_params.ip_record.ip_addr.subnet_mask,
--		       if_info->ip_addr.subnet_mask, ip_param->len);
-+		       if_info->ip_addr.subnet_mask,
-+		       sizeof(req->ip_params.ip_record.ip_addr.subnet_mask));
- 	}
- 
- 	rc = mgmt_exec_nonemb_cmd(phba, &nonemb_cmd, NULL, 0);
-@@ -935,7 +938,7 @@ static int mgmt_modify_gateway(struct beiscsi_hba *phba, uint8_t *gt_addr,
- 	req->action = gtway_action;
- 	req->ip_addr.ip_type = BE2_IPV4;
- 
--	memcpy(req->ip_addr.addr, gt_addr, param_len);
-+	memcpy(req->ip_addr.addr, gt_addr, sizeof(req->ip_addr.addr));
- 
- 	return mgmt_exec_nonemb_cmd(phba, &nonemb_cmd, NULL, 0);
- }
-diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
-index 83cb612..23c1b0c 100644
---- a/drivers/scsi/qla2xxx/qla_os.c
-+++ b/drivers/scsi/qla2xxx/qla_os.c
-@@ -3039,10 +3039,8 @@ qla2x00_unmap_iobases(struct qla_hw_data *ha)
- }
- 
- static void
--qla2x00_clear_drv_active(scsi_qla_host_t *vha)
-+qla2x00_clear_drv_active(struct qla_hw_data *ha)
- {
--	struct qla_hw_data *ha = vha->hw;
--
- 	if (IS_QLA8044(ha)) {
- 		qla8044_idc_lock(ha);
- 		qla8044_clear_drv_active(ha);
-@@ -3111,7 +3109,7 @@ qla2x00_remove_one(struct pci_dev *pdev)
- 
- 	scsi_host_put(base_vha->host);
- 
--	qla2x00_clear_drv_active(base_vha);
-+	qla2x00_clear_drv_active(ha);
- 
- 	qla2x00_unmap_iobases(ha);
- 
-diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
-index 0cb7307..2f264ac 100644
---- a/drivers/scsi/qla2xxx/qla_target.c
-+++ b/drivers/scsi/qla2xxx/qla_target.c
-@@ -1382,12 +1382,10 @@ static inline void qlt_unmap_sg(struct scsi_qla_host *vha,
- static int qlt_check_reserve_free_req(struct scsi_qla_host *vha,
- 	uint32_t req_cnt)
- {
--	struct qla_hw_data *ha = vha->hw;
--	device_reg_t __iomem *reg = ha->iobase;
- 	uint32_t cnt;
- 
- 	if (vha->req->cnt < (req_cnt + 2)) {
--		cnt = (uint16_t)RD_REG_DWORD(&reg->isp24.req_q_out);
-+		cnt = (uint16_t)RD_REG_DWORD(vha->req->req_q_out);
- 
- 		ql_dbg(ql_dbg_tgt, vha, 0xe00a,
- 		    "Request ring circled: cnt=%d, vha->->ring_index=%d, "
-diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
-index 6d207af..a4c45ea 100644
---- a/drivers/spi/spi-dw-mid.c
-+++ b/drivers/spi/spi-dw-mid.c
-@@ -89,7 +89,13 @@ err_exit:
- 
- static void mid_spi_dma_exit(struct dw_spi *dws)
- {
-+	if (!dws->dma_inited)
-+		return;
-+
-+	dmaengine_terminate_all(dws->txchan);
- 	dma_release_channel(dws->txchan);
-+
-+	dmaengine_terminate_all(dws->rxchan);
- 	dma_release_channel(dws->rxchan);
- }
- 
-@@ -136,7 +142,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
- 	txconf.dst_addr = dws->dma_addr;
- 	txconf.dst_maxburst = LNW_DMA_MSIZE_16;
- 	txconf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
--	txconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-+	txconf.dst_addr_width = dws->dma_width;
- 	txconf.device_fc = false;
- 
- 	txchan->device->device_control(txchan, DMA_SLAVE_CONFIG,
-@@ -159,7 +165,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
- 	rxconf.src_addr = dws->dma_addr;
- 	rxconf.src_maxburst = LNW_DMA_MSIZE_16;
- 	rxconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
--	rxconf.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
-+	rxconf.src_addr_width = dws->dma_width;
- 	rxconf.device_fc = false;
- 
- 	rxchan->device->device_control(rxchan, DMA_SLAVE_CONFIG,
-diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
-index db8434d..f4e68b3 100644
---- a/drivers/tty/serial/omap-serial.c
-+++ b/drivers/tty/serial/omap-serial.c
-@@ -260,8 +260,16 @@ serial_omap_baud_is_mode16(struct uart_port *port, unsigned int baud)
- {
- 	unsigned int n13 = port->uartclk / (13 * baud);
- 	unsigned int n16 = port->uartclk / (16 * baud);
--	int baudAbsDiff13 = baud - (port->uartclk / (13 * n13));
--	int baudAbsDiff16 = baud - (port->uartclk / (16 * n16));
-+	int baudAbsDiff13;
-+	int baudAbsDiff16;
-+
-+	if (n13 == 0)
-+		n13 = 1;
-+	if (n16 == 0)
-+		n16 = 1;
-+
-+	baudAbsDiff13 = baud - (port->uartclk / (13 * n13));
-+	baudAbsDiff16 = baud - (port->uartclk / (16 * n16));
- 	if (baudAbsDiff13 < 0)
- 		baudAbsDiff13 = -baudAbsDiff13;
- 	if (baudAbsDiff16 < 0)
-diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
-index 8154165..fd13ef0 100644
---- a/drivers/usb/gadget/Kconfig
-+++ b/drivers/usb/gadget/Kconfig
-@@ -445,7 +445,7 @@ config USB_GOKU
- 	   gadget drivers to also be dynamically linked.
- 
- config USB_EG20T
--	tristate "Intel EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
-+	tristate "Intel QUARK X1000/EG20T PCH/LAPIS Semiconductor IOH(ML7213/ML7831) UDC"
- 	depends on PCI
- 	help
- 	  This is a USB device driver for EG20T PCH.
-@@ -466,6 +466,7 @@ config USB_EG20T
- 	  ML7213/ML7831 is companion chip for Intel Atom E6xx series.
- 	  ML7213/ML7831 is completely compatible for Intel EG20T PCH.
- 
-+	  This driver can be used with Intel's Quark X1000 SOC platform
- #
- # LAST -- dummy/emulated controller
- #
-diff --git a/drivers/usb/gadget/pch_udc.c b/drivers/usb/gadget/pch_udc.c
-index eb8c3be..460d953 100644
---- a/drivers/usb/gadget/pch_udc.c
-+++ b/drivers/usb/gadget/pch_udc.c
-@@ -343,6 +343,7 @@ struct pch_vbus_gpio_data {
-  * @setup_data:		Received setup data
-  * @phys_addr:		of device memory
-  * @base_addr:		for mapped device memory
-+ * @bar:		Indicates which PCI BAR for USB regs
-  * @irq:		IRQ line for the device
-  * @cfg_data:		current cfg, intf, and alt in use
-  * @vbus_gpio:		GPIO informaton for detecting VBUS
-@@ -370,14 +371,17 @@ struct pch_udc_dev {
- 	struct usb_ctrlrequest		setup_data;
- 	unsigned long			phys_addr;
- 	void __iomem			*base_addr;
-+	unsigned			bar;
- 	unsigned			irq;
- 	struct pch_udc_cfg_data		cfg_data;
- 	struct pch_vbus_gpio_data	vbus_gpio;
- };
- #define to_pch_udc(g)	(container_of((g), struct pch_udc_dev, gadget))
- 
-+#define PCH_UDC_PCI_BAR_QUARK_X1000	0
- #define PCH_UDC_PCI_BAR			1
- #define PCI_DEVICE_ID_INTEL_EG20T_UDC	0x8808
-+#define PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC	0x0939
- #define PCI_VENDOR_ID_ROHM		0x10DB
- #define PCI_DEVICE_ID_ML7213_IOH_UDC	0x801D
- #define PCI_DEVICE_ID_ML7831_IOH_UDC	0x8808
-@@ -3076,7 +3080,7 @@ static void pch_udc_remove(struct pci_dev *pdev)
- 		iounmap(dev->base_addr);
- 	if (dev->mem_region)
- 		release_mem_region(dev->phys_addr,
--				   pci_resource_len(pdev, PCH_UDC_PCI_BAR));
-+				   pci_resource_len(pdev, dev->bar));
- 	if (dev->active)
- 		pci_disable_device(pdev);
- 	kfree(dev);
-@@ -3144,9 +3148,15 @@ static int pch_udc_probe(struct pci_dev *pdev,
- 	dev->active = 1;
- 	pci_set_drvdata(pdev, dev);
- 
-+	/* Determine BAR based on PCI ID */
-+	if (id->device == PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC)
-+		dev->bar = PCH_UDC_PCI_BAR_QUARK_X1000;
-+	else
-+		dev->bar = PCH_UDC_PCI_BAR;
-+
- 	/* PCI resource allocation */
--	resource = pci_resource_start(pdev, 1);
--	len = pci_resource_len(pdev, 1);
-+	resource = pci_resource_start(pdev, dev->bar);
-+	len = pci_resource_len(pdev, dev->bar);
- 
- 	if (!request_mem_region(resource, len, KBUILD_MODNAME)) {
- 		dev_err(&pdev->dev, "%s: pci device used already\n", __func__);
-@@ -3212,6 +3222,12 @@ finished:
- 
- static const struct pci_device_id pch_udc_pcidev_id[] = {
- 	{
-+		PCI_DEVICE(PCI_VENDOR_ID_INTEL,
-+			   PCI_DEVICE_ID_INTEL_QUARK_X1000_UDC),
-+		.class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
-+		.class_mask = 0xffffffff,
-+	},
-+	{
- 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_EG20T_UDC),
- 		.class = (PCI_CLASS_SERIAL_USB << 8) | 0xfe,
- 		.class_mask = 0xffffffff,
-diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
-index 0165b86..a9a881e 100644
---- a/fs/btrfs/file.c
-+++ b/fs/btrfs/file.c
-@@ -2510,23 +2510,28 @@ static int find_desired_extent(struct inode *inode, loff_t *offset, int whence)
- 	struct btrfs_root *root = BTRFS_I(inode)->root;
- 	struct extent_map *em = NULL;
- 	struct extent_state *cached_state = NULL;
--	u64 lockstart = *offset;
--	u64 lockend = i_size_read(inode);
--	u64 start = *offset;
--	u64 len = i_size_read(inode);
-+	u64 lockstart;
-+	u64 lockend;
-+	u64 start;
-+	u64 len;
- 	int ret = 0;
- 
--	lockend = max_t(u64, root->sectorsize, lockend);
-+	if (inode->i_size == 0)
-+		return -ENXIO;
-+
-+	/*
-+	 * *offset can be negative, in this case we start finding DATA/HOLE from
-+	 * the very start of the file.
-+	 */
-+	start = max_t(loff_t, 0, *offset);
-+
-+	lockstart = round_down(start, root->sectorsize);
-+	lockend = round_up(i_size_read(inode), root->sectorsize);
- 	if (lockend <= lockstart)
- 		lockend = lockstart + root->sectorsize;
--
- 	lockend--;
- 	len = lockend - lockstart + 1;
- 
--	len = max_t(u64, len, root->sectorsize);
--	if (inode->i_size == 0)
--		return -ENXIO;
--
- 	lock_extent_bits(&BTRFS_I(inode)->io_tree, lockstart, lockend, 0,
- 			 &cached_state);
- 
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index c69c763..d68a725 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -3596,7 +3596,8 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
- 	 * without delay
- 	 */
- 	if (!btrfs_is_free_space_inode(inode)
--	    && root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID) {
-+	    && root->root_key.objectid != BTRFS_DATA_RELOC_TREE_OBJECTID
-+	    && !root->fs_info->log_root_recovering) {
- 		btrfs_update_root_times(trans, root);
- 
- 		ret = btrfs_delayed_update_inode(trans, root, inode);
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index a6d8efa..0b72006 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -302,6 +302,9 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg)
- 			goto out_drop;
- 
- 	} else {
-+		ret = btrfs_set_prop(inode, "btrfs.compression", NULL, 0, 0);
-+		if (ret && ret != -ENODATA)
-+			goto out_drop;
- 		ip->flags &= ~(BTRFS_INODE_COMPRESS | BTRFS_INODE_NOCOMPRESS);
- 	}
- 
-@@ -4750,6 +4753,12 @@ long btrfs_ioctl(struct file *file, unsigned int
- 		if (ret)
- 			return ret;
- 		ret = btrfs_sync_fs(file->f_dentry->d_sb, 1);
-+		/*
-+		 * The transaction thread may want to do more work,
-+		 * namely it pokes the cleaner ktread that will start
-+		 * processing uncleaned subvols.
-+		 */
-+		wake_up_process(root->fs_info->transaction_kthread);
- 		return ret;
- 	}
- 	case BTRFS_IOC_START_SYNC:
-diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
-index 07b3b36..01f977e 100644
---- a/fs/btrfs/relocation.c
-+++ b/fs/btrfs/relocation.c
-@@ -736,7 +736,8 @@ again:
- 		err = ret;
- 		goto out;
- 	}
--	BUG_ON(!ret || !path1->slots[0]);
-+	ASSERT(ret);
-+	ASSERT(path1->slots[0]);
- 
- 	path1->slots[0]--;
- 
-@@ -746,10 +747,10 @@ again:
- 		 * the backref was added previously when processing
- 		 * backref of type BTRFS_TREE_BLOCK_REF_KEY
- 		 */
--		BUG_ON(!list_is_singular(&cur->upper));
-+		ASSERT(list_is_singular(&cur->upper));
- 		edge = list_entry(cur->upper.next, struct backref_edge,
- 				  list[LOWER]);
--		BUG_ON(!list_empty(&edge->list[UPPER]));
-+		ASSERT(list_empty(&edge->list[UPPER]));
- 		exist = edge->node[UPPER];
- 		/*
- 		 * add the upper level block to pending list if we need
-@@ -831,7 +832,7 @@ again:
- 					cur->cowonly = 1;
- 			}
- #else
--		BUG_ON(key.type == BTRFS_EXTENT_REF_V0_KEY);
-+		ASSERT(key.type != BTRFS_EXTENT_REF_V0_KEY);
- 		if (key.type == BTRFS_SHARED_BLOCK_REF_KEY) {
- #endif
- 			if (key.objectid == key.offset) {
-@@ -840,7 +841,7 @@ again:
- 				 * backref of this type.
- 				 */
- 				root = find_reloc_root(rc, cur->bytenr);
--				BUG_ON(!root);
-+				ASSERT(root);
- 				cur->root = root;
- 				break;
- 			}
-@@ -868,7 +869,7 @@ again:
- 			} else {
- 				upper = rb_entry(rb_node, struct backref_node,
- 						 rb_node);
--				BUG_ON(!upper->checked);
-+				ASSERT(upper->checked);
- 				INIT_LIST_HEAD(&edge->list[UPPER]);
- 			}
- 			list_add_tail(&edge->list[LOWER], &cur->upper);
-@@ -892,7 +893,7 @@ again:
- 
- 		if (btrfs_root_level(&root->root_item) == cur->level) {
- 			/* tree root */
--			BUG_ON(btrfs_root_bytenr(&root->root_item) !=
-+			ASSERT(btrfs_root_bytenr(&root->root_item) ==
- 			       cur->bytenr);
- 			if (should_ignore_root(root))
- 				list_add(&cur->list, &useless);
-@@ -927,7 +928,7 @@ again:
- 		need_check = true;
- 		for (; level < BTRFS_MAX_LEVEL; level++) {
- 			if (!path2->nodes[level]) {
--				BUG_ON(btrfs_root_bytenr(&root->root_item) !=
-+				ASSERT(btrfs_root_bytenr(&root->root_item) ==
- 				       lower->bytenr);
- 				if (should_ignore_root(root))
- 					list_add(&lower->list, &useless);
-@@ -976,12 +977,15 @@ again:
- 					need_check = false;
- 					list_add_tail(&edge->list[UPPER],
- 						      &list);
--				} else
-+				} else {
-+					if (upper->checked)
-+						need_check = true;
- 					INIT_LIST_HEAD(&edge->list[UPPER]);
-+				}
- 			} else {
- 				upper = rb_entry(rb_node, struct backref_node,
- 						 rb_node);
--				BUG_ON(!upper->checked);
-+				ASSERT(upper->checked);
- 				INIT_LIST_HEAD(&edge->list[UPPER]);
- 				if (!upper->owner)
- 					upper->owner = btrfs_header_owner(eb);
-@@ -1025,7 +1029,7 @@ next:
- 	 * everything goes well, connect backref nodes and insert backref nodes
- 	 * into the cache.
- 	 */
--	BUG_ON(!node->checked);
-+	ASSERT(node->checked);
- 	cowonly = node->cowonly;
- 	if (!cowonly) {
- 		rb_node = tree_insert(&cache->rb_root, node->bytenr,
-@@ -1061,8 +1065,21 @@ next:
- 			continue;
- 		}
- 
--		BUG_ON(!upper->checked);
--		BUG_ON(cowonly != upper->cowonly);
-+		if (!upper->checked) {
-+			/*
-+			 * Still want to blow up for developers since this is a
-+			 * logic bug.
-+			 */
-+			ASSERT(0);
-+			err = -EINVAL;
-+			goto out;
-+		}
-+		if (cowonly != upper->cowonly) {
-+			ASSERT(0);
-+			err = -EINVAL;
-+			goto out;
-+		}
-+
- 		if (!cowonly) {
- 			rb_node = tree_insert(&cache->rb_root, upper->bytenr,
- 					      &upper->rb_node);
-@@ -1085,7 +1102,7 @@ next:
- 	while (!list_empty(&useless)) {
- 		upper = list_entry(useless.next, struct backref_node, list);
- 		list_del_init(&upper->list);
--		BUG_ON(!list_empty(&upper->upper));
-+		ASSERT(list_empty(&upper->upper));
- 		if (upper == node)
- 			node = NULL;
- 		if (upper->lowest) {
-@@ -1118,29 +1135,45 @@ out:
- 	if (err) {
- 		while (!list_empty(&useless)) {
- 			lower = list_entry(useless.next,
--					   struct backref_node, upper);
--			list_del_init(&lower->upper);
-+					   struct backref_node, list);
-+			list_del_init(&lower->list);
- 		}
--		upper = node;
--		INIT_LIST_HEAD(&list);
--		while (upper) {
--			if (RB_EMPTY_NODE(&upper->rb_node)) {
--				list_splice_tail(&upper->upper, &list);
--				free_backref_node(cache, upper);
--			}
--
--			if (list_empty(&list))
--				break;
--
--			edge = list_entry(list.next, struct backref_edge,
--					  list[LOWER]);
-+		while (!list_empty(&list)) {
-+			edge = list_first_entry(&list, struct backref_edge,
-+						list[UPPER]);
-+			list_del(&edge->list[UPPER]);
- 			list_del(&edge->list[LOWER]);
-+			lower = edge->node[LOWER];
- 			upper = edge->node[UPPER];
- 			free_backref_edge(cache, edge);
-+
-+			/*
-+			 * Lower is no longer linked to any upper backref nodes
-+			 * and isn't in the cache, we can free it ourselves.
-+			 */
-+			if (list_empty(&lower->upper) &&
-+			    RB_EMPTY_NODE(&lower->rb_node))
-+				list_add(&lower->list, &useless);
-+
-+			if (!RB_EMPTY_NODE(&upper->rb_node))
-+				continue;
-+
-+			/* Add this guy's upper edges to the list to proces */
-+			list_for_each_entry(edge, &upper->upper, list[LOWER])
-+				list_add_tail(&edge->list[UPPER], &list);
-+			if (list_empty(&upper->upper))
-+				list_add(&upper->list, &useless);
-+		}
-+
-+		while (!list_empty(&useless)) {
-+			lower = list_entry(useless.next,
-+					   struct backref_node, list);
-+			list_del_init(&lower->list);
-+			free_backref_node(cache, lower);
- 		}
- 		return ERR_PTR(err);
- 	}
--	BUG_ON(node && node->detached);
-+	ASSERT(!node || !node->detached);
- 	return node;
- }
- 
-diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
-index a65ed4c..20d7935 100644
---- a/fs/btrfs/send.c
-+++ b/fs/btrfs/send.c
-@@ -4728,7 +4728,9 @@ static int finish_inode_if_needed(struct send_ctx *sctx, int at_end)
- 
- 	if (S_ISREG(sctx->cur_inode_mode)) {
- 		if (need_send_hole(sctx)) {
--			if (sctx->cur_inode_last_extent == (u64)-1) {
-+			if (sctx->cur_inode_last_extent == (u64)-1 ||
-+			    sctx->cur_inode_last_extent <
-+			    sctx->cur_inode_size) {
- 				ret = get_last_extent(sctx, (u64)-1);
- 				if (ret)
- 					goto out;
-diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
-index b05bf58..a0b65a0 100644
---- a/fs/btrfs/transaction.c
-+++ b/fs/btrfs/transaction.c
-@@ -592,7 +592,6 @@ int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid)
- 		if (transid <= root->fs_info->last_trans_committed)
- 			goto out;
- 
--		ret = -EINVAL;
- 		/* find specified transaction */
- 		spin_lock(&root->fs_info->trans_lock);
- 		list_for_each_entry(t, &root->fs_info->trans_list, list) {
-@@ -608,9 +607,16 @@ int btrfs_wait_for_commit(struct btrfs_root *root, u64 transid)
- 			}
- 		}
- 		spin_unlock(&root->fs_info->trans_lock);
--		/* The specified transaction doesn't exist */
--		if (!cur_trans)
-+
-+		/*
-+		 * The specified transaction doesn't exist, or we
-+		 * raced with btrfs_commit_transaction
-+		 */
-+		if (!cur_trans) {
-+			if (transid > root->fs_info->last_trans_committed)
-+				ret = -EINVAL;
- 			goto out;
-+		}
- 	} else {
- 		/* find newest transaction that is committing | committed */
- 		spin_lock(&root->fs_info->trans_lock);
-diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
-index b167ca4..a85ceb7 100644
---- a/fs/ecryptfs/inode.c
-+++ b/fs/ecryptfs/inode.c
-@@ -1039,7 +1039,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
- 	}
- 
- 	rc = vfs_setxattr(lower_dentry, name, value, size, flags);
--	if (!rc)
-+	if (!rc && dentry->d_inode)
- 		fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
- out:
- 	return rc;
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 75536db..c7d4a0a 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -1365,6 +1365,8 @@ static int do_umount(struct mount *mnt, int flags)
- 		 * Special case for "unmounting" root ...
- 		 * we just try to remount it readonly.
- 		 */
-+		if (!capable(CAP_SYS_ADMIN))
-+			return -EPERM;
- 		down_write(&sb->s_umount);
- 		if (!(sb->s_flags & MS_RDONLY))
- 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 2e9662e..da657b7 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -7242,7 +7242,7 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cr
- 	int ret = 0;
- 
- 	if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0)
--		return 0;
-+		return -EAGAIN;
- 	task = _nfs41_proc_sequence(clp, cred, false);
- 	if (IS_ERR(task))
- 		ret = PTR_ERR(task);
-diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
-index 1720d32..e1ba58c 100644
---- a/fs/nfs/nfs4renewd.c
-+++ b/fs/nfs/nfs4renewd.c
-@@ -88,10 +88,18 @@ nfs4_renew_state(struct work_struct *work)
- 			}
- 			nfs_expire_all_delegations(clp);
- 		} else {
-+			int ret;
-+
- 			/* Queue an asynchronous RENEW. */
--			ops->sched_state_renewal(clp, cred, renew_flags);
-+			ret = ops->sched_state_renewal(clp, cred, renew_flags);
- 			put_rpccred(cred);
--			goto out_exp;
-+			switch (ret) {
-+			default:
-+				goto out_exp;
-+			case -EAGAIN:
-+			case -ENOMEM:
-+				break;
-+			}
- 		}
- 	} else {
- 		dprintk("%s: failed to call renewd. Reason: lease not expired \n",
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index 27f5f85..b4f177f 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1732,7 +1732,8 @@ restart:
- 			if (status < 0) {
- 				set_bit(ops->owner_flag_bit, &sp->so_flags);
- 				nfs4_put_state_owner(sp);
--				return nfs4_recovery_handle_error(clp, status);
-+				status = nfs4_recovery_handle_error(clp, status);
-+				return (status != 0) ? status : -EAGAIN;
- 			}
- 
- 			nfs4_put_state_owner(sp);
-@@ -1741,7 +1742,7 @@ restart:
- 		spin_unlock(&clp->cl_lock);
- 	}
- 	rcu_read_unlock();
--	return status;
-+	return 0;
- }
- 
- static int nfs4_check_lease(struct nfs_client *clp)
-@@ -1788,7 +1789,6 @@ static int nfs4_handle_reclaim_lease_error(struct nfs_client *clp, int status)
- 		break;
- 	case -NFS4ERR_STALE_CLIENTID:
- 		clear_bit(NFS4CLNT_LEASE_CONFIRM, &clp->cl_state);
--		nfs4_state_clear_reclaim_reboot(clp);
- 		nfs4_state_start_reclaim_reboot(clp);
- 		break;
- 	case -NFS4ERR_CLID_INUSE:
-@@ -2370,6 +2370,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
- 			status = nfs4_check_lease(clp);
- 			if (status < 0)
- 				goto out_error;
-+			continue;
- 		}
- 
- 		if (test_and_clear_bit(NFS4CLNT_MOVED, &clp->cl_state)) {
-@@ -2391,14 +2392,11 @@ static void nfs4_state_manager(struct nfs_client *clp)
- 			section = "reclaim reboot";
- 			status = nfs4_do_reclaim(clp,
- 				clp->cl_mvops->reboot_recovery_ops);
--			if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
--			    test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
--				continue;
--			nfs4_state_end_reclaim_reboot(clp);
--			if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state))
-+			if (status == -EAGAIN)
- 				continue;
- 			if (status < 0)
- 				goto out_error;
-+			nfs4_state_end_reclaim_reboot(clp);
- 		}
- 
- 		/* Now recover expired state... */
-@@ -2406,9 +2404,7 @@ static void nfs4_state_manager(struct nfs_client *clp)
- 			section = "reclaim nograce";
- 			status = nfs4_do_reclaim(clp,
- 				clp->cl_mvops->nograce_recovery_ops);
--			if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
--			    test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) ||
--			    test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
-+			if (status == -EAGAIN)
- 				continue;
- 			if (status < 0)
- 				goto out_error;
-diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
-index 287a22c..de6323e 100644
---- a/fs/notify/fanotify/fanotify_user.c
-+++ b/fs/notify/fanotify/fanotify_user.c
-@@ -71,7 +71,7 @@ static int create_fd(struct fsnotify_group *group,
- 
- 	pr_debug("%s: group=%p event=%p\n", __func__, group, event);
- 
--	client_fd = get_unused_fd();
-+	client_fd = get_unused_fd_flags(group->fanotify_data.f_flags);
- 	if (client_fd < 0)
- 		return client_fd;
- 
-diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c
-index 5d2518b..0461fbe 100644
---- a/fs/xfs/xfs_aops.c
-+++ b/fs/xfs/xfs_aops.c
-@@ -434,10 +434,22 @@ xfs_start_page_writeback(
- {
- 	ASSERT(PageLocked(page));
- 	ASSERT(!PageWriteback(page));
--	if (clear_dirty)
-+
-+	/*
-+	 * if the page was not fully cleaned, we need to ensure that the higher
-+	 * layers come back to it correctly. That means we need to keep the page
-+	 * dirty, and for WB_SYNC_ALL writeback we need to ensure the
-+	 * PAGECACHE_TAG_TOWRITE index mark is not removed so another attempt to
-+	 * write this page in this writeback sweep will be made.
-+	 */
-+	if (clear_dirty) {
- 		clear_page_dirty_for_io(page);
--	set_page_writeback(page);
-+		set_page_writeback(page);
-+	} else
-+		set_page_writeback_keepwrite(page);
-+
- 	unlock_page(page);
-+
- 	/* If no buffers on the page are to be written, finish it here */
- 	if (!buffers)
- 		end_page_writeback(page);
-diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h
-new file mode 100644
-index 0000000..cdd1cc2
---- /dev/null
-+++ b/include/linux/compiler-gcc5.h
-@@ -0,0 +1,66 @@
-+#ifndef __LINUX_COMPILER_H
-+#error "Please don't include <linux/compiler-gcc5.h> directly, include <linux/compiler.h> instead."
-+#endif
-+
-+#define __used				__attribute__((__used__))
-+#define __must_check			__attribute__((warn_unused_result))
-+#define __compiler_offsetof(a, b)	__builtin_offsetof(a, b)
-+
-+/* Mark functions as cold. gcc will assume any path leading to a call
-+   to them will be unlikely.  This means a lot of manual unlikely()s
-+   are unnecessary now for any paths leading to the usual suspects
-+   like BUG(), printk(), panic() etc. [but let's keep them for now for
-+   older compilers]
-+
-+   Early snapshots of gcc 4.3 don't support this and we can't detect this
-+   in the preprocessor, but we can live with this because they're unreleased.
-+   Maketime probing would be overkill here.
-+
-+   gcc also has a __attribute__((__hot__)) to move hot functions into
-+   a special section, but I don't see any sense in this right now in
-+   the kernel context */
-+#define __cold			__attribute__((__cold__))
-+
-+#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
-+
-+#ifndef __CHECKER__
-+# define __compiletime_warning(message) __attribute__((warning(message)))
-+# define __compiletime_error(message) __attribute__((error(message)))
-+#endif /* __CHECKER__ */
-+
-+/*
-+ * Mark a position in code as unreachable.  This can be used to
-+ * suppress control flow warnings after asm blocks that transfer
-+ * control elsewhere.
-+ *
-+ * Early snapshots of gcc 4.5 don't support this and we can't detect
-+ * this in the preprocessor, but we can live with this because they're
-+ * unreleased.  Really, we need to have autoconf for the kernel.
-+ */
-+#define unreachable() __builtin_unreachable()
-+
-+/* Mark a function definition as prohibited from being cloned. */
-+#define __noclone	__attribute__((__noclone__))
-+
-+/*
-+ * Tell the optimizer that something else uses this function or variable.
-+ */
-+#define __visible __attribute__((externally_visible))
-+
-+/*
-+ * GCC 'asm goto' miscompiles certain code sequences:
-+ *
-+ *   http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
-+ *
-+ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
-+ * Fixed in GCC 4.8.2 and later versions.
-+ *
-+ * (asm goto is automatically volatile - the naming reflects this.)
-+ */
-+#define asm_volatile_goto(x...)	do { asm goto(x); asm (""); } while (0)
-+
-+#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
-+#define __HAVE_BUILTIN_BSWAP32__
-+#define __HAVE_BUILTIN_BSWAP64__
-+#define __HAVE_BUILTIN_BSWAP16__
-+#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
-diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
-index 97fbecd..057c1d8 100644
---- a/include/linux/pci_ids.h
-+++ b/include/linux/pci_ids.h
-@@ -2551,6 +2551,7 @@
- #define PCI_DEVICE_ID_INTEL_MFD_EMMC0	0x0823
- #define PCI_DEVICE_ID_INTEL_MFD_EMMC1	0x0824
- #define PCI_DEVICE_ID_INTEL_MRST_SD2	0x084F
-+#define PCI_DEVICE_ID_INTEL_QUARK_X1000_ILB	0x095E
- #define PCI_DEVICE_ID_INTEL_I960	0x0960
- #define PCI_DEVICE_ID_INTEL_I960RM	0x0962
- #define PCI_DEVICE_ID_INTEL_CENTERTON_ILB	0x0c60
-diff --git a/include/linux/sched.h b/include/linux/sched.h
-index d7ca410..218b058 100644
---- a/include/linux/sched.h
-+++ b/include/linux/sched.h
-@@ -1876,11 +1876,13 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
- #define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
- #define used_math() tsk_used_math(current)
- 
--/* __GFP_IO isn't allowed if PF_MEMALLOC_NOIO is set in current->flags */
-+/* __GFP_IO isn't allowed if PF_MEMALLOC_NOIO is set in current->flags
-+ * __GFP_FS is also cleared as it implies __GFP_IO.
-+ */
- static inline gfp_t memalloc_noio_flags(gfp_t flags)
- {
- 	if (unlikely(current->flags & PF_MEMALLOC_NOIO))
--		flags &= ~__GFP_IO;
-+		flags &= ~(__GFP_IO | __GFP_FS);
- 	return flags;
- }
- 
-diff --git a/kernel/futex.c b/kernel/futex.c
-index 0b0dc02..fda2950 100644
---- a/kernel/futex.c
-+++ b/kernel/futex.c
-@@ -329,6 +329,8 @@ static void get_futex_key_refs(union futex_key *key)
- 	case FUT_OFF_MMSHARED:
- 		futex_get_mm(key); /* implies MB (B) */
- 		break;
-+	default:
-+		smp_mb(); /* explicit MB (B) */
- 	}
- }
- 
-diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
-index 8563081..a1c387f 100644
---- a/lib/lzo/lzo1x_decompress_safe.c
-+++ b/lib/lzo/lzo1x_decompress_safe.c
-@@ -19,31 +19,21 @@
- #include <linux/lzo.h>
- #include "lzodefs.h"
- 
--#define HAVE_IP(t, x)					\
--	(((size_t)(ip_end - ip) >= (size_t)(t + x)) &&	\
--	 (((t + x) >= t) && ((t + x) >= x)))
-+#define HAVE_IP(x)      ((size_t)(ip_end - ip) >= (size_t)(x))
-+#define HAVE_OP(x)      ((size_t)(op_end - op) >= (size_t)(x))
-+#define NEED_IP(x)      if (!HAVE_IP(x)) goto input_overrun
-+#define NEED_OP(x)      if (!HAVE_OP(x)) goto output_overrun
-+#define TEST_LB(m_pos)  if ((m_pos) < out) goto lookbehind_overrun
- 
--#define HAVE_OP(t, x)					\
--	(((size_t)(op_end - op) >= (size_t)(t + x)) &&	\
--	 (((t + x) >= t) && ((t + x) >= x)))
--
--#define NEED_IP(t, x)					\
--	do {						\
--		if (!HAVE_IP(t, x))			\
--			goto input_overrun;		\
--	} while (0)
--
--#define NEED_OP(t, x)					\
--	do {						\
--		if (!HAVE_OP(t, x))			\
--			goto output_overrun;		\
--	} while (0)
--
--#define TEST_LB(m_pos)					\
--	do {						\
--		if ((m_pos) < out)			\
--			goto lookbehind_overrun;	\
--	} while (0)
-+/* This MAX_255_COUNT is the maximum number of times we can add 255 to a base
-+ * count without overflowing an integer. The multiply will overflow when
-+ * multiplying 255 by more than MAXINT/255. The sum will overflow earlier
-+ * depending on the base count. Since the base count is taken from a u8
-+ * and a few bits, it is safe to assume that it will always be lower than
-+ * or equal to 2*255, thus we can always prevent any overflow by accepting
-+ * two less 255 steps. See Documentation/lzo.txt for more information.
-+ */
-+#define MAX_255_COUNT      ((((size_t)~0) / 255) - 2)
- 
- int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
- 			  unsigned char *out, size_t *out_len)
-@@ -75,17 +65,24 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
- 		if (t < 16) {
- 			if (likely(state == 0)) {
- 				if (unlikely(t == 0)) {
-+					size_t offset;
-+					const unsigned char *ip_last = ip;
-+
- 					while (unlikely(*ip == 0)) {
--						t += 255;
- 						ip++;
--						NEED_IP(1, 0);
-+						NEED_IP(1);
- 					}
--					t += 15 + *ip++;
-+					offset = ip - ip_last;
-+					if (unlikely(offset > MAX_255_COUNT))
-+						return LZO_E_ERROR;
-+
-+					offset = (offset << 8) - offset;
-+					t += offset + 15 + *ip++;
- 				}
- 				t += 3;
- copy_literal_run:
- #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
--				if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
-+				if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
- 					const unsigned char *ie = ip + t;
- 					unsigned char *oe = op + t;
- 					do {
-@@ -101,8 +98,8 @@ copy_literal_run:
- 				} else
- #endif
- 				{
--					NEED_OP(t, 0);
--					NEED_IP(t, 3);
-+					NEED_OP(t);
-+					NEED_IP(t + 3);
- 					do {
- 						*op++ = *ip++;
- 					} while (--t > 0);
-@@ -115,7 +112,7 @@ copy_literal_run:
- 				m_pos -= t >> 2;
- 				m_pos -= *ip++ << 2;
- 				TEST_LB(m_pos);
--				NEED_OP(2, 0);
-+				NEED_OP(2);
- 				op[0] = m_pos[0];
- 				op[1] = m_pos[1];
- 				op += 2;
-@@ -136,13 +133,20 @@ copy_literal_run:
- 		} else if (t >= 32) {
- 			t = (t & 31) + (3 - 1);
- 			if (unlikely(t == 2)) {
-+				size_t offset;
-+				const unsigned char *ip_last = ip;
-+
- 				while (unlikely(*ip == 0)) {
--					t += 255;
- 					ip++;
--					NEED_IP(1, 0);
-+					NEED_IP(1);
- 				}
--				t += 31 + *ip++;
--				NEED_IP(2, 0);
-+				offset = ip - ip_last;
-+				if (unlikely(offset > MAX_255_COUNT))
-+					return LZO_E_ERROR;
-+
-+				offset = (offset << 8) - offset;
-+				t += offset + 31 + *ip++;
-+				NEED_IP(2);
- 			}
- 			m_pos = op - 1;
- 			next = get_unaligned_le16(ip);
-@@ -154,13 +158,20 @@ copy_literal_run:
- 			m_pos -= (t & 8) << 11;
- 			t = (t & 7) + (3 - 1);
- 			if (unlikely(t == 2)) {
-+				size_t offset;
-+				const unsigned char *ip_last = ip;
-+
- 				while (unlikely(*ip == 0)) {
--					t += 255;
- 					ip++;
--					NEED_IP(1, 0);
-+					NEED_IP(1);
- 				}
--				t += 7 + *ip++;
--				NEED_IP(2, 0);
-+				offset = ip - ip_last;
-+				if (unlikely(offset > MAX_255_COUNT))
-+					return LZO_E_ERROR;
-+
-+				offset = (offset << 8) - offset;
-+				t += offset + 7 + *ip++;
-+				NEED_IP(2);
- 			}
- 			next = get_unaligned_le16(ip);
- 			ip += 2;
-@@ -174,7 +185,7 @@ copy_literal_run:
- #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
- 		if (op - m_pos >= 8) {
- 			unsigned char *oe = op + t;
--			if (likely(HAVE_OP(t, 15))) {
-+			if (likely(HAVE_OP(t + 15))) {
- 				do {
- 					COPY8(op, m_pos);
- 					op += 8;
-@@ -184,7 +195,7 @@ copy_literal_run:
- 					m_pos += 8;
- 				} while (op < oe);
- 				op = oe;
--				if (HAVE_IP(6, 0)) {
-+				if (HAVE_IP(6)) {
- 					state = next;
- 					COPY4(op, ip);
- 					op += next;
-@@ -192,7 +203,7 @@ copy_literal_run:
- 					continue;
- 				}
- 			} else {
--				NEED_OP(t, 0);
-+				NEED_OP(t);
- 				do {
- 					*op++ = *m_pos++;
- 				} while (op < oe);
-@@ -201,7 +212,7 @@ copy_literal_run:
- #endif
- 		{
- 			unsigned char *oe = op + t;
--			NEED_OP(t, 0);
-+			NEED_OP(t);
- 			op[0] = m_pos[0];
- 			op[1] = m_pos[1];
- 			op += 2;
-@@ -214,15 +225,15 @@ match_next:
- 		state = next;
- 		t = next;
- #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
--		if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
-+		if (likely(HAVE_IP(6) && HAVE_OP(4))) {
- 			COPY4(op, ip);
- 			op += t;
- 			ip += t;
- 		} else
- #endif
- 		{
--			NEED_IP(t, 3);
--			NEED_OP(t, 0);
-+			NEED_IP(t + 3);
-+			NEED_OP(t);
- 			while (t > 0) {
- 				*op++ = *ip++;
- 				t--;
-diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
-index 6afa3b4..0007c9e 100644
---- a/net/bluetooth/l2cap_core.c
-+++ b/net/bluetooth/l2cap_core.c
-@@ -2608,12 +2608,8 @@ static int l2cap_segment_le_sdu(struct l2cap_chan *chan,
- 
- 	BT_DBG("chan %p, msg %p, len %zu", chan, msg, len);
- 
--	pdu_len = chan->conn->mtu - L2CAP_HDR_SIZE;
--
--	pdu_len = min_t(size_t, pdu_len, chan->remote_mps);
--
- 	sdu_len = len;
--	pdu_len -= L2CAP_SDULEN_SIZE;
-+	pdu_len = chan->remote_mps - L2CAP_SDULEN_SIZE;
- 
- 	while (len > 0) {
- 		if (len <= pdu_len)
-diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
-index 734e946..6df1b25 100644
---- a/security/integrity/ima/ima_appraise.c
-+++ b/security/integrity/ima/ima_appraise.c
-@@ -194,8 +194,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint,
- 			goto out;
- 
- 		cause = "missing-hash";
--		status =
--		    (inode->i_size == 0) ? INTEGRITY_PASS : INTEGRITY_NOLABEL;
-+		status = INTEGRITY_NOLABEL;
-+		if (inode->i_size == 0) {
-+			iint->flags |= IMA_NEW_FILE;
-+			status = INTEGRITY_PASS;
-+		}
- 		goto out;
- 	}
- 
-diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
-index 76d8aad..9f70efd 100644
---- a/security/integrity/ima/ima_main.c
-+++ b/security/integrity/ima/ima_main.c
-@@ -131,11 +131,13 @@ static void ima_check_last_writer(struct integrity_iint_cache *iint,
- 		return;
- 
- 	mutex_lock(&inode->i_mutex);
--	if (atomic_read(&inode->i_writecount) == 1 &&
--	    iint->version != inode->i_version) {
--		iint->flags &= ~IMA_DONE_MASK;
--		if (iint->flags & IMA_APPRAISE)
--			ima_update_xattr(iint, file);
-+	if (atomic_read(&inode->i_writecount) == 1) {
-+		if ((iint->version != inode->i_version) ||
-+		    (iint->flags & IMA_NEW_FILE)) {
-+			iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
-+			if (iint->flags & IMA_APPRAISE)
-+				ima_update_xattr(iint, file);
-+		}
- 	}
- 	mutex_unlock(&inode->i_mutex);
- }
-diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
-index 33c0a70..2f8715d 100644
---- a/security/integrity/integrity.h
-+++ b/security/integrity/integrity.h
-@@ -31,6 +31,7 @@
- #define IMA_DIGSIG		0x01000000
- #define IMA_DIGSIG_REQUIRED	0x02000000
- #define IMA_PERMIT_DIRECTIO	0x04000000
-+#define IMA_NEW_FILE		0x08000000
- 
- #define IMA_DO_MASK		(IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
- 				 IMA_APPRAISE_SUBMASK)
-diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index 01a5e05..566b0f6 100644
---- a/sound/core/pcm_native.c
-+++ b/sound/core/pcm_native.c
-@@ -3189,7 +3189,7 @@ static const struct vm_operations_struct snd_pcm_vm_ops_data_fault = {
- 
- #ifndef ARCH_HAS_DMA_MMAP_COHERENT
- /* This should be defined / handled globally! */
--#ifdef CONFIG_ARM
-+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
- #define ARCH_HAS_DMA_MMAP_COHERENT
- #endif
- #endif
-diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
-index cae3659..0a34b5f 100644
---- a/sound/pci/emu10k1/emu10k1_callback.c
-+++ b/sound/pci/emu10k1/emu10k1_callback.c
-@@ -85,6 +85,8 @@ snd_emu10k1_ops_setup(struct snd_emux *emux)
-  * get more voice for pcm
-  *
-  * terminate most inactive voice and give it as a pcm voice.
-+ *
-+ * voice_lock is already held.
-  */
- int
- snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
-@@ -92,12 +94,10 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
- 	struct snd_emux *emu;
- 	struct snd_emux_voice *vp;
- 	struct best_voice best[V_END];
--	unsigned long flags;
- 	int i;
- 
- 	emu = hw->synth;
- 
--	spin_lock_irqsave(&emu->voice_lock, flags);
- 	lookup_voices(emu, hw, best, 1); /* no OFF voices */
- 	for (i = 0; i < V_END; i++) {
- 		if (best[i].voice >= 0) {
-@@ -113,11 +113,9 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
- 			vp->emu->num_voices--;
- 			vp->ch = -1;
- 			vp->state = SNDRV_EMUX_ST_OFF;
--			spin_unlock_irqrestore(&emu->voice_lock, flags);
- 			return ch;
- 		}
- 	}
--	spin_unlock_irqrestore(&emu->voice_lock, flags);
- 
- 	/* not found */
- 	return -ENOMEM;
-diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
-index d135c90..8253b48 100644
---- a/sound/pci/hda/patch_hdmi.c
-+++ b/sound/pci/hda/patch_hdmi.c
-@@ -1557,19 +1557,22 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
- 		}
- 	}
- 
--	if (pin_eld->eld_valid && !eld->eld_valid) {
--		update_eld = true;
-+	if (pin_eld->eld_valid != eld->eld_valid)
- 		eld_changed = true;
--	}
-+
-+	if (pin_eld->eld_valid && !eld->eld_valid)
-+		update_eld = true;
-+
- 	if (update_eld) {
- 		bool old_eld_valid = pin_eld->eld_valid;
- 		pin_eld->eld_valid = eld->eld_valid;
--		eld_changed = pin_eld->eld_size != eld->eld_size ||
-+		if (pin_eld->eld_size != eld->eld_size ||
- 			      memcmp(pin_eld->eld_buffer, eld->eld_buffer,
--				     eld->eld_size) != 0;
--		if (eld_changed)
-+				     eld->eld_size) != 0) {
- 			memcpy(pin_eld->eld_buffer, eld->eld_buffer,
- 			       eld->eld_size);
-+			eld_changed = true;
-+		}
- 		pin_eld->eld_size = eld->eld_size;
- 		pin_eld->info = eld->info;
- 
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index 5d0058b..4c826a4 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -2926,6 +2926,9 @@ static void alc283_shutup(struct hda_codec *codec)
- 
- 	alc_write_coef_idx(codec, 0x43, 0x9004);
- 
-+	/*depop hp during suspend*/
-+	alc_write_coef_idx(codec, 0x06, 0x2100);
-+
- 	snd_hda_codec_write(codec, hp_pin, 0,
- 			    AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_MUTE);
- 
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index 223c47b..c657752 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -385,6 +385,36 @@ YAMAHA_DEVICE(0x105d, NULL),
- 	}
- },
- {
-+	USB_DEVICE(0x0499, 0x1509),
-+	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-+		/* .vendor_name = "Yamaha", */
-+		/* .product_name = "Steinberg UR22", */
-+		.ifnum = QUIRK_ANY_INTERFACE,
-+		.type = QUIRK_COMPOSITE,
-+		.data = (const struct snd_usb_audio_quirk[]) {
-+			{
-+				.ifnum = 1,
-+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-+			},
-+			{
-+				.ifnum = 2,
-+				.type = QUIRK_AUDIO_STANDARD_INTERFACE
-+			},
-+			{
-+				.ifnum = 3,
-+				.type = QUIRK_MIDI_YAMAHA
-+			},
-+			{
-+				.ifnum = 4,
-+				.type = QUIRK_IGNORE_INTERFACE
-+			},
-+			{
-+				.ifnum = -1
-+			}
-+		}
-+	}
-+},
-+{
- 	USB_DEVICE(0x0499, 0x150a),
- 	.driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
- 		/* .vendor_name = "Yamaha", */
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 03a0381..6611253 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -52,6 +52,7 @@
- 
- #include <asm/processor.h>
- #include <asm/io.h>
-+#include <asm/ioctl.h>
- #include <asm/uaccess.h>
- #include <asm/pgtable.h>
- 
-@@ -95,8 +96,6 @@ static int hardware_enable_all(void);
- static void hardware_disable_all(void);
- 
- static void kvm_io_bus_destroy(struct kvm_io_bus *bus);
--static void update_memslots(struct kvm_memslots *slots,
--			    struct kvm_memory_slot *new, u64 last_generation);
- 
- static void kvm_release_pfn_dirty(pfn_t pfn);
- static void mark_page_dirty_in_slot(struct kvm *kvm,
-@@ -682,8 +681,7 @@ static void sort_memslots(struct kvm_memslots *slots)
- }
- 
- static void update_memslots(struct kvm_memslots *slots,
--			    struct kvm_memory_slot *new,
--			    u64 last_generation)
-+			    struct kvm_memory_slot *new)
- {
- 	if (new) {
- 		int id = new->id;
-@@ -694,8 +692,6 @@ static void update_memslots(struct kvm_memslots *slots,
- 		if (new->npages != npages)
- 			sort_memslots(slots);
- 	}
--
--	slots->generation = last_generation + 1;
- }
- 
- static int check_memory_region_flags(struct kvm_userspace_memory_region *mem)
-@@ -717,10 +713,24 @@ static struct kvm_memslots *install_new_memslots(struct kvm *kvm,
- {
- 	struct kvm_memslots *old_memslots = kvm->memslots;
- 
--	update_memslots(slots, new, kvm->memslots->generation);
-+	/*
-+	 * Set the low bit in the generation, which disables SPTE caching
-+	 * until the end of synchronize_srcu_expedited.
-+	 */
-+	WARN_ON(old_memslots->generation & 1);
-+	slots->generation = old_memslots->generation + 1;
-+
-+	update_memslots(slots, new);
- 	rcu_assign_pointer(kvm->memslots, slots);
- 	synchronize_srcu_expedited(&kvm->srcu);
- 
-+	/*
-+	 * Increment the new memslot generation a second time. This prevents
-+	 * vm exits that race with memslot updates from caching a memslot
-+	 * generation that will (potentially) be valid forever.
-+	 */
-+	slots->generation++;
-+
- 	kvm_arch_memslots_updated(kvm);
- 
- 	return old_memslots;
-@@ -1970,6 +1980,9 @@ static long kvm_vcpu_ioctl(struct file *filp,
- 	if (vcpu->kvm->mm != current->mm)
- 		return -EIO;
- 
-+	if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
-+		return -EINVAL;
-+
- #if defined(CONFIG_S390) || defined(CONFIG_PPC) || defined(CONFIG_MIPS)
- 	/*
- 	 * Special cases: vcpu ioctls that are asynchronous to vcpu execution,
diff --git a/3.14.23/4420_grsecurity-3.0-3.14.23-201410312212.patch b/3.14.23/4420_grsecurity-3.0-3.14.23-201411062033.patch
index 2b0f9bd..399d2be 100644
--- a/3.14.23/4420_grsecurity-3.0-3.14.23-201410312212.patch
+++ b/3.14.23/4420_grsecurity-3.0-3.14.23-201411062033.patch
@@ -93492,6 +93492,82 @@ index e6be585..d73ae5e 100644
  		return;
  
  	local_irq_save(flags);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 759d5e0..5156a5fe 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ 	int size;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 
+ 	/* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
+@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ 	int syscall_nr;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 
+ 	/* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
+@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ 	int size;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 	if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ 		return;
+@@ -602,6 +602,8 @@ static int perf_sysenter_enable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return -EINVAL;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	if (!sys_perf_refcount_enter)
+@@ -622,6 +624,8 @@ static void perf_sysenter_disable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	sys_perf_refcount_enter--;
+@@ -641,7 +645,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ 	int size;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 	if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ 		return;
+@@ -674,6 +678,8 @@ static int perf_sysexit_enable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return -EINVAL;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	if (!sys_perf_refcount_exit)
+@@ -694,6 +700,8 @@ static void perf_sysexit_disable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	sys_perf_refcount_exit--;
 diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
 index 80a57af..7f5a7ff 100644
 --- a/kernel/user_namespace.c
@@ -100239,7 +100315,7 @@ index b543470..d2ddae2 100644
  	if (!can_dir) {
  		printk(KERN_INFO "can: failed to create /proc/net/can . "
 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
-index 0a31298..241da43 100644
+index 0a31298..6301eb0 100644
 --- a/net/ceph/messenger.c
 +++ b/net/ceph/messenger.c
 @@ -187,7 +187,7 @@ static void con_fault(struct ceph_connection *con);
@@ -100260,6 +100336,19 @@ index 0a31298..241da43 100644
  	s = addr_str[i];
  
  	switch (ss->ss_family) {
+@@ -291,7 +291,11 @@ int ceph_msgr_init(void)
+ 	if (ceph_msgr_slab_init())
+ 		return -ENOMEM;
+ 
+-	ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0);
++	/*
++	 * The number of active work items is limited by the number of
++	 * connections, so leave @max_active at default.
++	 */
++	ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_MEM_RECLAIM, 0);
+ 	if (ceph_msgr_wq)
+ 		return 0;
+ 
 diff --git a/net/compat.c b/net/compat.c
 index cbc1a2a..ab7644e 100644
 --- a/net/compat.c
diff --git a/3.17.2/0000_README b/3.17.2/0000_README
index c71a071..08a13b9 100644
--- a/3.17.2/0000_README
+++ b/3.17.2/0000_README
@@ -2,7 +2,7 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.0-3.17.2-201410312213.patch
+Patch:	4420_grsecurity-3.0-3.17.2-201411062034.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.17.2/4420_grsecurity-3.0-3.17.2-201410312213.patch b/3.17.2/4420_grsecurity-3.0-3.17.2-201411062034.patch
index 942b997..2da5648 100644
--- a/3.17.2/4420_grsecurity-3.0-3.17.2-201410312213.patch
+++ b/3.17.2/4420_grsecurity-3.0-3.17.2-201411062034.patch
@@ -29335,7 +29335,7 @@ index 38a0afe..94421a9 100644
  
  out:
 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 03954f7..48daa1a 100644
+index 03954f7..0f4ad73 100644
 --- a/arch/x86/kvm/emulate.c
 +++ b/arch/x86/kvm/emulate.c
 @@ -504,11 +504,6 @@ static void rsp_increment(struct x86_emulate_ctxt *ctxt, int inc)
@@ -29350,7 +29350,7 @@ index 03954f7..48daa1a 100644
  static u32 desc_limit_scaled(struct desc_struct *desc)
  {
  	u32 limit = get_desc_limit(desc);
-@@ -568,6 +563,38 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
+@@ -568,6 +563,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
  	return emulate_exception(ctxt, NM_VECTOR, 0, false);
  }
  
@@ -29364,12 +29364,14 @@ index 03954f7..48daa1a 100644
 +	case 4:
 +		ctxt->_eip = (u32)dst;
 +		break;
++#ifdef CONFIG_X86_64
 +	case 8:
 +		if ((cs_l && is_noncanonical_address(dst)) ||
-+		    (!cs_l && (dst & ~(u32)-1)))
++		    (!cs_l && (dst >> 32) != 0))
 +			return emulate_gp(ctxt, 0);
 +		ctxt->_eip = dst;
 +		break;
++#endif
 +	default:
 +		WARN(1, "unsupported eip assignment size\n");
 +	}
@@ -29389,7 +29391,7 @@ index 03954f7..48daa1a 100644
  static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
  {
  	u16 selector;
-@@ -750,8 +777,10 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
+@@ -750,8 +779,10 @@ static int __do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt, int op_size)
  static __always_inline int do_insn_fetch_bytes(struct x86_emulate_ctxt *ctxt,
  					       unsigned size)
  {
@@ -29402,7 +29404,7 @@ index 03954f7..48daa1a 100644
  	else
  		return X86EMUL_CONTINUE;
  }
-@@ -1415,7 +1444,9 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+@@ -1415,7 +1446,9 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
  
  /* Does not support long mode */
  static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
@@ -29413,7 +29415,7 @@ index 03954f7..48daa1a 100644
  {
  	struct desc_struct seg_desc, old_desc;
  	u8 dpl, rpl;
-@@ -1547,6 +1578,8 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+@@ -1547,6 +1580,8 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
  	}
  load:
  	ctxt->ops->set_segment(ctxt, selector, &seg_desc, base3, seg);
@@ -29422,7 +29424,7 @@ index 03954f7..48daa1a 100644
  	return X86EMUL_CONTINUE;
  exception:
  	emulate_exception(ctxt, err_vec, err_code, true);
-@@ -1557,7 +1590,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+@@ -1557,7 +1592,7 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
  				   u16 selector, int seg)
  {
  	u8 cpl = ctxt->ops->cpl(ctxt);
@@ -29431,7 +29433,7 @@ index 03954f7..48daa1a 100644
  }
  
  static void write_register_operand(struct operand *op)
-@@ -1951,17 +1984,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
+@@ -1951,17 +1986,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
  static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
  {
  	int rc;
@@ -29459,7 +29461,7 @@ index 03954f7..48daa1a 100644
 -	return X86EMUL_CONTINUE;
 +	rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
 +	if (rc != X86EMUL_CONTINUE) {
-+		WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64);
++		WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
 +		/* assigning eip failed; restore the old cs */
 +		ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
 +		return rc;
@@ -29468,7 +29470,7 @@ index 03954f7..48daa1a 100644
  }
  
  static int em_grp45(struct x86_emulate_ctxt *ctxt)
-@@ -1972,13 +2019,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
+@@ -1972,13 +2021,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
  	case 2: /* call near abs */ {
  		long int old_eip;
  		old_eip = ctxt->_eip;
@@ -29486,7 +29488,7 @@ index 03954f7..48daa1a 100644
  		break;
  	case 5: /* jmp far */
  		rc = em_jmp_far(ctxt);
-@@ -2013,30 +2062,47 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
+@@ -2013,30 +2064,47 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
  
  static int em_ret(struct x86_emulate_ctxt *ctxt)
  {
@@ -29537,13 +29539,13 @@ index 03954f7..48daa1a 100644
 +		return rc;
 +	rc = assign_eip_far(ctxt, eip, new_desc.l);
 +	if (rc != X86EMUL_CONTINUE) {
-+		WARN_ON(!ctxt->mode != X86EMUL_MODE_PROT64);
++		WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
 +		ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
 +	}
  	return rc;
  }
  
-@@ -2297,7 +2363,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2297,7 +2365,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
  {
  	const struct x86_emulate_ops *ops = ctxt->ops;
  	struct desc_struct cs, ss;
@@ -29552,7 +29554,7 @@ index 03954f7..48daa1a 100644
  	int usermode;
  	u16 cs_sel = 0, ss_sel = 0;
  
-@@ -2313,6 +2379,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2313,6 +2381,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
  	else
  		usermode = X86EMUL_MODE_PROT32;
  
@@ -29562,7 +29564,7 @@ index 03954f7..48daa1a 100644
  	cs.dpl = 3;
  	ss.dpl = 3;
  	ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
-@@ -2330,6 +2399,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2330,6 +2401,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
  		ss_sel = cs_sel + 8;
  		cs.d = 0;
  		cs.l = 1;
@@ -29572,7 +29574,7 @@ index 03954f7..48daa1a 100644
  		break;
  	}
  	cs_sel |= SELECTOR_RPL_MASK;
-@@ -2338,8 +2410,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+@@ -2338,8 +2412,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
  	ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
  	ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
  
@@ -29583,7 +29585,7 @@ index 03954f7..48daa1a 100644
  
  	return X86EMUL_CONTINUE;
  }
-@@ -2457,19 +2529,24 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+@@ -2457,19 +2531,24 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
  	 * Now load segment descriptors. If fault happens at this stage
  	 * it is handled in a context of new task
  	 */
@@ -29613,7 +29615,7 @@ index 03954f7..48daa1a 100644
  	if (ret != X86EMUL_CONTINUE)
  		return ret;
  
-@@ -2594,25 +2671,32 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+@@ -2594,25 +2673,32 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
  	 * Now load segment descriptors. If fault happenes at this stage
  	 * it is handled in a context of new task
  	 */
@@ -29653,7 +29655,7 @@ index 03954f7..48daa1a 100644
  	if (ret != X86EMUL_CONTINUE)
  		return ret;
  
-@@ -2880,10 +2964,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt)
+@@ -2880,10 +2966,13 @@ static int em_aad(struct x86_emulate_ctxt *ctxt)
  
  static int em_call(struct x86_emulate_ctxt *ctxt)
  {
@@ -29668,7 +29670,7 @@ index 03954f7..48daa1a 100644
  	return em_push(ctxt);
  }
  
-@@ -2892,34 +2979,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
+@@ -2892,34 +2981,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
  	u16 sel, old_cs;
  	ulong old_eip;
  	int rc;
@@ -29729,7 +29731,7 @@ index 03954f7..48daa1a 100644
  	if (rc != X86EMUL_CONTINUE)
  		return rc;
  	rsp_increment(ctxt, ctxt->src.val);
-@@ -3250,20 +3353,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
+@@ -3250,20 +3355,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
  
  static int em_loop(struct x86_emulate_ctxt *ctxt)
  {
@@ -29758,7 +29760,7 @@ index 03954f7..48daa1a 100644
  }
  
  static int em_in(struct x86_emulate_ctxt *ctxt)
-@@ -3351,6 +3458,12 @@ static int em_bswap(struct x86_emulate_ctxt *ctxt)
+@@ -3351,6 +3460,12 @@ static int em_bswap(struct x86_emulate_ctxt *ctxt)
  	return X86EMUL_CONTINUE;
  }
  
@@ -29771,7 +29773,7 @@ index 03954f7..48daa1a 100644
  static bool valid_cr(int nr)
  {
  	switch (nr) {
-@@ -3683,6 +3796,16 @@ static const struct opcode group11[] = {
+@@ -3683,6 +3798,16 @@ static const struct opcode group11[] = {
  	X7(D(Undefined)),
  };
  
@@ -29788,7 +29790,7 @@ index 03954f7..48daa1a 100644
  static const struct gprefix pfx_0f_6f_0f_7f = {
  	I(Mmx, em_mov), I(Sse | Aligned, em_mov), N, I(Sse | Unaligned, em_mov),
  };
-@@ -3887,10 +4010,11 @@ static const struct opcode twobyte_table[256] = {
+@@ -3887,10 +4012,11 @@ static const struct opcode twobyte_table[256] = {
  	N, I(ImplicitOps | EmulateOnUD, em_syscall),
  	II(ImplicitOps | Priv, em_clts, clts), N,
  	DI(ImplicitOps | Priv, invd), DI(ImplicitOps | Priv, wbinvd), N, N,
@@ -29802,7 +29804,7 @@ index 03954f7..48daa1a 100644
  	/* 0x20 - 0x2F */
  	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, cr_read, check_cr_read),
  	DIP(ModRM | DstMem | Priv | Op3264 | NoMod, dr_read, check_dr_read),
-@@ -3942,7 +4066,7 @@ static const struct opcode twobyte_table[256] = {
+@@ -3942,7 +4068,7 @@ static const struct opcode twobyte_table[256] = {
  	F(DstMem | SrcReg | ModRM | BitOp | Lock | PageTable, em_bts),
  	F(DstMem | SrcReg | Src2ImmByte | ModRM, em_shrd),
  	F(DstMem | SrcReg | Src2CL | ModRM, em_shrd),
@@ -29811,7 +29813,7 @@ index 03954f7..48daa1a 100644
  	/* 0xB0 - 0xB7 */
  	I2bv(DstMem | SrcReg | ModRM | Lock | PageTable, em_cmpxchg),
  	I(DstReg | SrcMemFAddr | ModRM | Src2SS, em_lseg),
-@@ -4458,10 +4582,10 @@ done_prefixes:
+@@ -4458,10 +4584,10 @@ done_prefixes:
  	/* Decode and fetch the destination operand: register or memory. */
  	rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
  
@@ -29823,7 +29825,7 @@ index 03954f7..48daa1a 100644
  	return (rc != X86EMUL_CONTINUE) ? EMULATION_FAILED : EMULATION_OK;
  }
  
-@@ -4711,7 +4835,7 @@ special_insn:
+@@ -4711,7 +4837,7 @@ special_insn:
  		break;
  	case 0x70 ... 0x7f: /* jcc (short) */
  		if (test_cc(ctxt->b, ctxt->eflags))
@@ -29832,7 +29834,7 @@ index 03954f7..48daa1a 100644
  		break;
  	case 0x8d: /* lea r16/r32, m */
  		ctxt->dst.val = ctxt->src.addr.mem.ea;
-@@ -4741,7 +4865,7 @@ special_insn:
+@@ -4741,7 +4867,7 @@ special_insn:
  		break;
  	case 0xe9: /* jmp rel */
  	case 0xeb: /* jmp rel short */
@@ -29841,7 +29843,7 @@ index 03954f7..48daa1a 100644
  		ctxt->dst.type = OP_NONE; /* Disable writeback. */
  		break;
  	case 0xf4:              /* hlt */
-@@ -4864,13 +4988,11 @@ twobyte_insn:
+@@ -4864,13 +4990,11 @@ twobyte_insn:
  		break;
  	case 0x80 ... 0x8f: /* jnz rel, etc*/
  		if (test_cc(ctxt->b, ctxt->eflags))
@@ -95262,6 +95264,82 @@ index 8a4e5cb..64f270d 100644
  		return;
  
  	local_irq_save(flags);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 759d5e0..5156a5fe 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -313,7 +313,7 @@ static void ftrace_syscall_enter(void *data, struct pt_regs *regs, long id)
+ 	int size;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 
+ 	/* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE) */
+@@ -360,7 +360,7 @@ static void ftrace_syscall_exit(void *data, struct pt_regs *regs, long ret)
+ 	int syscall_nr;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 
+ 	/* Here we're inside tp handler's rcu_read_lock_sched (__DO_TRACE()) */
+@@ -567,7 +567,7 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ 	int size;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 	if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ 		return;
+@@ -602,6 +602,8 @@ static int perf_sysenter_enable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return -EINVAL;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	if (!sys_perf_refcount_enter)
+@@ -622,6 +624,8 @@ static void perf_sysenter_disable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	sys_perf_refcount_enter--;
+@@ -641,7 +645,7 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ 	int size;
+ 
+ 	syscall_nr = trace_get_syscall_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 	if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ 		return;
+@@ -674,6 +678,8 @@ static int perf_sysexit_enable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return -EINVAL;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	if (!sys_perf_refcount_exit)
+@@ -694,6 +700,8 @@ static void perf_sysexit_disable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	sys_perf_refcount_exit--;
 diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
 index aa312b0..395f343 100644
 --- a/kernel/user_namespace.c
@@ -101964,7 +102042,7 @@ index 1a19b98..df2b4ec 100644
  	if (!can_dir) {
  		printk(KERN_INFO "can: failed to create /proc/net/can . "
 diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
-index b2f571d..b584643 100644
+index b2f571d..e6160e9 100644
 --- a/net/ceph/messenger.c
 +++ b/net/ceph/messenger.c
 @@ -188,7 +188,7 @@ static void con_fault(struct ceph_connection *con);
@@ -101985,6 +102063,19 @@ index b2f571d..b584643 100644
  	s = addr_str[i];
  
  	switch (ss->ss_family) {
+@@ -292,7 +292,11 @@ int ceph_msgr_init(void)
+ 	if (ceph_msgr_slab_init())
+ 		return -ENOMEM;
+ 
+-	ceph_msgr_wq = alloc_workqueue("ceph-msgr", 0, 0);
++	/*
++	 * The number of active work items is limited by the number of
++	 * connections, so leave @max_active at default.
++	 */
++	ceph_msgr_wq = alloc_workqueue("ceph-msgr", WQ_MEM_RECLAIM, 0);
+ 	if (ceph_msgr_wq)
+ 		return 0;
+ 
 diff --git a/net/compat.c b/net/compat.c
 index bc8aeef..f9c070c 100644
 --- a/net/compat.c
diff --git a/3.2.63/0000_README b/3.2.64/0000_README
index dc58512..4dc0dd8 100644
--- a/3.2.63/0000_README
+++ b/3.2.64/0000_README
@@ -170,7 +170,11 @@ Patch:	1062_linux-3.2.63.patch
 From:	http://www.kernel.org
 Desc:	Linux 3.2.63
 
-Patch:	4420_grsecurity-3.0-3.2.63-201411020808.patch
+Patch:	1063_linux-3.2.64.patch
+From:	http://www.kernel.org
+Desc:	Linux 3.2.64
+
+Patch:	4420_grsecurity-3.0-3.2.64-201411062032.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/3.2.63/1021_linux-3.2.22.patch b/3.2.64/1021_linux-3.2.22.patch
index e6ad93a..e6ad93a 100644
--- a/3.2.63/1021_linux-3.2.22.patch
+++ b/3.2.64/1021_linux-3.2.22.patch
diff --git a/3.2.63/1022_linux-3.2.23.patch b/3.2.64/1022_linux-3.2.23.patch
index 3d796d0..3d796d0 100644
--- a/3.2.63/1022_linux-3.2.23.patch
+++ b/3.2.64/1022_linux-3.2.23.patch
diff --git a/3.2.63/1023_linux-3.2.24.patch b/3.2.64/1023_linux-3.2.24.patch
index 4692eb4..4692eb4 100644
--- a/3.2.63/1023_linux-3.2.24.patch
+++ b/3.2.64/1023_linux-3.2.24.patch
diff --git a/3.2.63/1024_linux-3.2.25.patch b/3.2.64/1024_linux-3.2.25.patch
index e95c213..e95c213 100644
--- a/3.2.63/1024_linux-3.2.25.patch
+++ b/3.2.64/1024_linux-3.2.25.patch
diff --git a/3.2.63/1025_linux-3.2.26.patch b/3.2.64/1025_linux-3.2.26.patch
index 44065b9..44065b9 100644
--- a/3.2.63/1025_linux-3.2.26.patch
+++ b/3.2.64/1025_linux-3.2.26.patch
diff --git a/3.2.63/1026_linux-3.2.27.patch b/3.2.64/1026_linux-3.2.27.patch
index 5878eb4..5878eb4 100644
--- a/3.2.63/1026_linux-3.2.27.patch
+++ b/3.2.64/1026_linux-3.2.27.patch
diff --git a/3.2.63/1027_linux-3.2.28.patch b/3.2.64/1027_linux-3.2.28.patch
index 4dbba4b..4dbba4b 100644
--- a/3.2.63/1027_linux-3.2.28.patch
+++ b/3.2.64/1027_linux-3.2.28.patch
diff --git a/3.2.63/1028_linux-3.2.29.patch b/3.2.64/1028_linux-3.2.29.patch
index 3c65179..3c65179 100644
--- a/3.2.63/1028_linux-3.2.29.patch
+++ b/3.2.64/1028_linux-3.2.29.patch
diff --git a/3.2.63/1029_linux-3.2.30.patch b/3.2.64/1029_linux-3.2.30.patch
index 86aea4b..86aea4b 100644
--- a/3.2.63/1029_linux-3.2.30.patch
+++ b/3.2.64/1029_linux-3.2.30.patch
diff --git a/3.2.63/1030_linux-3.2.31.patch b/3.2.64/1030_linux-3.2.31.patch
index c6accf5..c6accf5 100644
--- a/3.2.63/1030_linux-3.2.31.patch
+++ b/3.2.64/1030_linux-3.2.31.patch
diff --git a/3.2.63/1031_linux-3.2.32.patch b/3.2.64/1031_linux-3.2.32.patch
index 247fc0b..247fc0b 100644
--- a/3.2.63/1031_linux-3.2.32.patch
+++ b/3.2.64/1031_linux-3.2.32.patch
diff --git a/3.2.63/1032_linux-3.2.33.patch b/3.2.64/1032_linux-3.2.33.patch
index c32fb75..c32fb75 100644
--- a/3.2.63/1032_linux-3.2.33.patch
+++ b/3.2.64/1032_linux-3.2.33.patch
diff --git a/3.2.63/1033_linux-3.2.34.patch b/3.2.64/1033_linux-3.2.34.patch
index d647b38..d647b38 100644
--- a/3.2.63/1033_linux-3.2.34.patch
+++ b/3.2.64/1033_linux-3.2.34.patch
diff --git a/3.2.63/1034_linux-3.2.35.patch b/3.2.64/1034_linux-3.2.35.patch
index 76a9c19..76a9c19 100644
--- a/3.2.63/1034_linux-3.2.35.patch
+++ b/3.2.64/1034_linux-3.2.35.patch
diff --git a/3.2.63/1035_linux-3.2.36.patch b/3.2.64/1035_linux-3.2.36.patch
index 5d192a3..5d192a3 100644
--- a/3.2.63/1035_linux-3.2.36.patch
+++ b/3.2.64/1035_linux-3.2.36.patch
diff --git a/3.2.63/1036_linux-3.2.37.patch b/3.2.64/1036_linux-3.2.37.patch
index ad13251..ad13251 100644
--- a/3.2.63/1036_linux-3.2.37.patch
+++ b/3.2.64/1036_linux-3.2.37.patch
diff --git a/3.2.63/1037_linux-3.2.38.patch b/3.2.64/1037_linux-3.2.38.patch
index a3c106f..a3c106f 100644
--- a/3.2.63/1037_linux-3.2.38.patch
+++ b/3.2.64/1037_linux-3.2.38.patch
diff --git a/3.2.63/1038_linux-3.2.39.patch b/3.2.64/1038_linux-3.2.39.patch
index 5639e92..5639e92 100644
--- a/3.2.63/1038_linux-3.2.39.patch
+++ b/3.2.64/1038_linux-3.2.39.patch
diff --git a/3.2.63/1039_linux-3.2.40.patch b/3.2.64/1039_linux-3.2.40.patch
index f26b39c..f26b39c 100644
--- a/3.2.63/1039_linux-3.2.40.patch
+++ b/3.2.64/1039_linux-3.2.40.patch
diff --git a/3.2.63/1040_linux-3.2.41.patch b/3.2.64/1040_linux-3.2.41.patch
index 0d27fcb..0d27fcb 100644
--- a/3.2.63/1040_linux-3.2.41.patch
+++ b/3.2.64/1040_linux-3.2.41.patch
diff --git a/3.2.63/1041_linux-3.2.42.patch b/3.2.64/1041_linux-3.2.42.patch
index 77a08ed..77a08ed 100644
--- a/3.2.63/1041_linux-3.2.42.patch
+++ b/3.2.64/1041_linux-3.2.42.patch
diff --git a/3.2.63/1042_linux-3.2.43.patch b/3.2.64/1042_linux-3.2.43.patch
index a3f878b..a3f878b 100644
--- a/3.2.63/1042_linux-3.2.43.patch
+++ b/3.2.64/1042_linux-3.2.43.patch
diff --git a/3.2.63/1043_linux-3.2.44.patch b/3.2.64/1043_linux-3.2.44.patch
index 3d5e6ff..3d5e6ff 100644
--- a/3.2.63/1043_linux-3.2.44.patch
+++ b/3.2.64/1043_linux-3.2.44.patch
diff --git a/3.2.63/1044_linux-3.2.45.patch b/3.2.64/1044_linux-3.2.45.patch
index 44e1767..44e1767 100644
--- a/3.2.63/1044_linux-3.2.45.patch
+++ b/3.2.64/1044_linux-3.2.45.patch
diff --git a/3.2.63/1045_linux-3.2.46.patch b/3.2.64/1045_linux-3.2.46.patch
index bc10efd..bc10efd 100644
--- a/3.2.63/1045_linux-3.2.46.patch
+++ b/3.2.64/1045_linux-3.2.46.patch
diff --git a/3.2.63/1046_linux-3.2.47.patch b/3.2.64/1046_linux-3.2.47.patch
index b74563c..b74563c 100644
--- a/3.2.63/1046_linux-3.2.47.patch
+++ b/3.2.64/1046_linux-3.2.47.patch
diff --git a/3.2.63/1047_linux-3.2.48.patch b/3.2.64/1047_linux-3.2.48.patch
index 6d55b1f..6d55b1f 100644
--- a/3.2.63/1047_linux-3.2.48.patch
+++ b/3.2.64/1047_linux-3.2.48.patch
diff --git a/3.2.63/1048_linux-3.2.49.patch b/3.2.64/1048_linux-3.2.49.patch
index 2dab0cf..2dab0cf 100644
--- a/3.2.63/1048_linux-3.2.49.patch
+++ b/3.2.64/1048_linux-3.2.49.patch
diff --git a/3.2.63/1049_linux-3.2.50.patch b/3.2.64/1049_linux-3.2.50.patch
index 20b3015..20b3015 100644
--- a/3.2.63/1049_linux-3.2.50.patch
+++ b/3.2.64/1049_linux-3.2.50.patch
diff --git a/3.2.63/1050_linux-3.2.51.patch b/3.2.64/1050_linux-3.2.51.patch
index 5d5832b..5d5832b 100644
--- a/3.2.63/1050_linux-3.2.51.patch
+++ b/3.2.64/1050_linux-3.2.51.patch
diff --git a/3.2.63/1051_linux-3.2.52.patch b/3.2.64/1051_linux-3.2.52.patch
index 94b9359..94b9359 100644
--- a/3.2.63/1051_linux-3.2.52.patch
+++ b/3.2.64/1051_linux-3.2.52.patch
diff --git a/3.2.63/1052_linux-3.2.53.patch b/3.2.64/1052_linux-3.2.53.patch
index 986d714..986d714 100644
--- a/3.2.63/1052_linux-3.2.53.patch
+++ b/3.2.64/1052_linux-3.2.53.patch
diff --git a/3.2.63/1053_linux-3.2.54.patch b/3.2.64/1053_linux-3.2.54.patch
index a907496..a907496 100644
--- a/3.2.63/1053_linux-3.2.54.patch
+++ b/3.2.64/1053_linux-3.2.54.patch
diff --git a/3.2.63/1054_linux-3.2.55.patch b/3.2.64/1054_linux-3.2.55.patch
index 6071ff5..6071ff5 100644
--- a/3.2.63/1054_linux-3.2.55.patch
+++ b/3.2.64/1054_linux-3.2.55.patch
diff --git a/3.2.63/1055_linux-3.2.56.patch b/3.2.64/1055_linux-3.2.56.patch
index 2e8239c..2e8239c 100644
--- a/3.2.63/1055_linux-3.2.56.patch
+++ b/3.2.64/1055_linux-3.2.56.patch
diff --git a/3.2.63/1056_linux-3.2.57.patch b/3.2.64/1056_linux-3.2.57.patch
index 7b8f174..7b8f174 100644
--- a/3.2.63/1056_linux-3.2.57.patch
+++ b/3.2.64/1056_linux-3.2.57.patch
diff --git a/3.2.63/1057_linux-3.2.58.patch b/3.2.64/1057_linux-3.2.58.patch
index db5723a..db5723a 100644
--- a/3.2.63/1057_linux-3.2.58.patch
+++ b/3.2.64/1057_linux-3.2.58.patch
diff --git a/3.2.63/1058_linux-3.2.59.patch b/3.2.64/1058_linux-3.2.59.patch
index cd59fe9..cd59fe9 100644
--- a/3.2.63/1058_linux-3.2.59.patch
+++ b/3.2.64/1058_linux-3.2.59.patch
diff --git a/3.2.63/1059_linux-3.2.60.patch b/3.2.64/1059_linux-3.2.60.patch
index c5a9389..c5a9389 100644
--- a/3.2.63/1059_linux-3.2.60.patch
+++ b/3.2.64/1059_linux-3.2.60.patch
diff --git a/3.2.63/1060_linux-3.2.61.patch b/3.2.64/1060_linux-3.2.61.patch
index a1bf580..a1bf580 100644
--- a/3.2.63/1060_linux-3.2.61.patch
+++ b/3.2.64/1060_linux-3.2.61.patch
diff --git a/3.2.63/1061_linux-3.2.62.patch b/3.2.64/1061_linux-3.2.62.patch
index 34217f0..34217f0 100644
--- a/3.2.63/1061_linux-3.2.62.patch
+++ b/3.2.64/1061_linux-3.2.62.patch
diff --git a/3.2.63/1062_linux-3.2.63.patch b/3.2.64/1062_linux-3.2.63.patch
index f7c7415..f7c7415 100644
--- a/3.2.63/1062_linux-3.2.63.patch
+++ b/3.2.64/1062_linux-3.2.63.patch
diff --git a/3.2.64/1063_linux-3.2.64.patch b/3.2.64/1063_linux-3.2.64.patch
new file mode 100644
index 0000000..862b4f0
--- /dev/null
+++ b/3.2.64/1063_linux-3.2.64.patch
@@ -0,0 +1,3821 @@
+diff --git a/Makefile b/Makefile
+index 6d3f2d4..2b58ffc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 63
++SUBLEVEL = 64
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index a125c4b..6e39bf1 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -38,6 +38,7 @@
+  * This code is not portable to processors with late data abort handling.
+  */
+ #define CODING_BITS(i)	(i & 0x0e000000)
++#define COND_BITS(i)	(i & 0xf0000000)
+ 
+ #define LDST_I_BIT(i)	(i & (1 << 26))		/* Immediate constant	*/
+ #define LDST_P_BIT(i)	(i & (1 << 24))		/* Preindex		*/
+@@ -812,6 +813,8 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ 		break;
+ 
+ 	case 0x04000000:	/* ldr or str immediate */
++		if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */
++			goto bad;
+ 		offset.un = OFFSET_BITS(instr);
+ 		handler = do_alignment_ldrstr;
+ 		break;
+diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
+index 5cad0fa..ca51d69 100644
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -13,6 +13,7 @@
+ 
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/string.h>
+ 
+ #include <asm/addrspace.h>
+ 
+diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
+index 4c968e7..55eca41 100644
+--- a/arch/mips/kernel/mcount.S
++++ b/arch/mips/kernel/mcount.S
+@@ -119,7 +119,11 @@ NESTED(_mcount, PT_SIZE, ra)
+ 	 nop
+ #endif
+ 	b	ftrace_stub
++#ifdef CONFIG_32BIT
++	 addiu sp, sp, 8
++#else
+ 	 nop
++#endif
+ 
+ static_trace:
+ 	MCOUNT_SAVE_REGS
+@@ -129,6 +133,9 @@ static_trace:
+ 	 move	a1, AT		/* arg2: parent's return address */
+ 
+ 	MCOUNT_RESTORE_REGS
++#ifdef CONFIG_32BIT
++	addiu sp, sp, 8
++#endif
+ 	.globl ftrace_stub
+ ftrace_stub:
+ 	RETURN_BACK
+@@ -177,6 +184,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra)
+ 	jal	prepare_ftrace_return
+ 	 nop
+ 	MCOUNT_RESTORE_REGS
++#ifndef CONFIG_DYNAMIC_FTRACE
++#ifdef CONFIG_32BIT
++	addiu sp, sp, 8
++#endif
++#endif
+ 	RETURN_BACK
+ 	END(ftrace_graph_caller)
+ 
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index fe425bb..228a205 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -606,6 +606,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+ 			r4k_blast_scache();
+ 		else
+ 			blast_scache_range(addr, addr + size);
++		preempt_enable();
+ 		__sync();
+ 		return;
+ 	}
+@@ -647,6 +648,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ 			 */
+ 			blast_inv_scache_range(addr, addr + size);
+ 		}
++		preempt_enable();
+ 		__sync();
+ 		return;
+ 	}
+diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
+index 55cca1d..75947e0 100644
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -47,7 +47,12 @@ cflags-y	:= -pipe
+ 
+ # These flags should be implied by an hppa-linux configuration, but they
+ # are not in gcc 3.2.
+-cflags-y	+= -mno-space-regs -mfast-indirect-calls
++cflags-y	+= -mno-space-regs
++
++# -mfast-indirect-calls is only relevant for 32-bit kernels.
++ifndef CONFIG_64BIT
++cflags-y	+= -mfast-indirect-calls
++endif
+ 
+ # Currently we save and restore fpregs on all kernel entry/interruption paths.
+ # If that gets optimized, we might need to disable the use of fpregs in the
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index dd072b1..f6f41dd 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -516,16 +516,6 @@ rerun_vcpu:
+ 
+ 	BUG_ON(vcpu->kvm->arch.float_int.local_int[vcpu->vcpu_id] == NULL);
+ 
+-	switch (kvm_run->exit_reason) {
+-	case KVM_EXIT_S390_SIEIC:
+-	case KVM_EXIT_UNKNOWN:
+-	case KVM_EXIT_INTR:
+-	case KVM_EXIT_S390_RESET:
+-		break;
+-	default:
+-		BUG();
+-	}
+-
+ 	vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
+ 	vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
+ 
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index b3eb9a7..15d24cb 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -821,6 +821,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code)
+ 	kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
+ }
+ 
++static inline u64 get_canonical(u64 la)
++{
++	return ((int64_t)la << 16) >> 16;
++}
++
++static inline bool is_noncanonical_address(u64 la)
++{
++#ifdef CONFIG_X86_64
++	return get_canonical(la) != la;
++#else
++	return false;
++#endif
++}
++
+ #define TSS_IOPB_BASE_OFFSET 0x66
+ #define TSS_BASE_SIZE 0x68
+ #define TSS_IOPB_SIZE (65536 / 8)
+diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
+index 31f180c..36cbe2a 100644
+--- a/arch/x86/include/asm/vmx.h
++++ b/arch/x86/include/asm/vmx.h
+@@ -279,6 +279,8 @@ enum vmcs_field {
+ #define EXIT_REASON_APIC_ACCESS         44
+ #define EXIT_REASON_EPT_VIOLATION       48
+ #define EXIT_REASON_EPT_MISCONFIG       49
++#define EXIT_REASON_INVEPT              50
++#define EXIT_REASON_INVVPID             53
+ #define EXIT_REASON_WBINVD		54
+ #define EXIT_REASON_XSETBV		55
+ 
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 6e68bd9..bb28f2ca 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1252,6 +1252,9 @@ static void remove_siblinginfo(int cpu)
+ 
+ 	for_each_cpu(sibling, cpu_sibling_mask(cpu))
+ 		cpumask_clear_cpu(cpu, cpu_sibling_mask(sibling));
++	for_each_cpu(sibling, cpu_llc_shared_mask(cpu))
++		cpumask_clear_cpu(cpu, cpu_llc_shared_mask(sibling));
++	cpumask_clear(cpu_llc_shared_mask(cpu));
+ 	cpumask_clear(cpu_sibling_mask(cpu));
+ 	cpumask_clear(cpu_core_mask(cpu));
+ 	c->phys_proc_id = 0;
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 638cab5..f0ac042 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -456,11 +456,6 @@ register_address_increment(struct x86_emulate_ctxt *ctxt, unsigned long *reg, in
+ 		*reg = (*reg & ~ad_mask(ctxt)) | ((*reg + inc) & ad_mask(ctxt));
+ }
+ 
+-static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
+-{
+-	register_address_increment(ctxt, &ctxt->_eip, rel);
+-}
+-
+ static u32 desc_limit_scaled(struct desc_struct *desc)
+ {
+ 	u32 limit = get_desc_limit(desc);
+@@ -534,6 +529,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
+ 	return emulate_exception(ctxt, NM_VECTOR, 0, false);
+ }
+ 
++static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
++			       int cs_l)
++{
++	switch (ctxt->op_bytes) {
++	case 2:
++		ctxt->_eip = (u16)dst;
++		break;
++	case 4:
++		ctxt->_eip = (u32)dst;
++		break;
++#ifdef CONFIG_X86_64
++	case 8:
++		if ((cs_l && is_noncanonical_address(dst)) ||
++		    (!cs_l && (dst >> 32) != 0))
++			return emulate_gp(ctxt, 0);
++		ctxt->_eip = dst;
++		break;
++#endif
++	default:
++		WARN(1, "unsupported eip assignment size\n");
++	}
++	return X86EMUL_CONTINUE;
++}
++
++static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
++{
++	return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64);
++}
++
++static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
++{
++	return assign_eip_near(ctxt, ctxt->_eip + rel);
++}
++
+ static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
+ {
+ 	u16 selector;
+@@ -1206,11 +1235,12 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ }
+ 
+ /* Does not support long mode */
+-static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+-				   u16 selector, int seg)
++static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
++				     u16 selector, int seg, u8 cpl,
++				     struct desc_struct *desc)
+ {
+ 	struct desc_struct seg_desc;
+-	u8 dpl, rpl, cpl;
++	u8 dpl, rpl;
+ 	unsigned err_vec = GP_VECTOR;
+ 	u32 err_code = 0;
+ 	bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
+@@ -1259,7 +1289,6 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 
+ 	rpl = selector & 3;
+ 	dpl = seg_desc.dpl;
+-	cpl = ctxt->ops->cpl(ctxt);
+ 
+ 	switch (seg) {
+ 	case VCPU_SREG_SS:
+@@ -1316,12 +1345,21 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ 	}
+ load:
+ 	ctxt->ops->set_segment(ctxt, selector, &seg_desc, 0, seg);
++	if (desc)
++		*desc = seg_desc;
+ 	return X86EMUL_CONTINUE;
+ exception:
+ 	emulate_exception(ctxt, err_vec, err_code, true);
+ 	return X86EMUL_PROPAGATE_FAULT;
+ }
+ 
++static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
++				   u16 selector, int seg)
++{
++	u8 cpl = ctxt->ops->cpl(ctxt);
++	return __load_segment_descriptor(ctxt, selector, seg, cpl, NULL);
++}
++
+ static void write_register_operand(struct operand *op)
+ {
+ 	/* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
+@@ -1661,17 +1699,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
+ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
+ {
+ 	int rc;
+-	unsigned short sel;
++	unsigned short sel, old_sel;
++	struct desc_struct old_desc, new_desc;
++	const struct x86_emulate_ops *ops = ctxt->ops;
++	u8 cpl = ctxt->ops->cpl(ctxt);
++
++	/* Assignment of RIP may only fail in 64-bit mode */
++	if (ctxt->mode == X86EMUL_MODE_PROT64)
++		ops->get_segment(ctxt, &old_sel, &old_desc, NULL,
++				 VCPU_SREG_CS);
+ 
+ 	memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
+ 
+-	rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS);
++	rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl,
++				       &new_desc);
+ 	if (rc != X86EMUL_CONTINUE)
+ 		return rc;
+ 
+-	ctxt->_eip = 0;
+-	memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
+-	return X86EMUL_CONTINUE;
++	rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
++	if (rc != X86EMUL_CONTINUE) {
++		WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
++		/* assigning eip failed; restore the old cs */
++		ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
++		return rc;
++	}
++	return rc;
+ }
+ 
+ static int em_grp1a(struct x86_emulate_ctxt *ctxt)
+@@ -1770,13 +1822,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
+ 	case 2: /* call near abs */ {
+ 		long int old_eip;
+ 		old_eip = ctxt->_eip;
+-		ctxt->_eip = ctxt->src.val;
++		rc = assign_eip_near(ctxt, ctxt->src.val);
++		if (rc != X86EMUL_CONTINUE)
++			break;
+ 		ctxt->src.val = old_eip;
+ 		rc = em_push(ctxt);
+ 		break;
+ 	}
+ 	case 4: /* jmp abs */
+-		ctxt->_eip = ctxt->src.val;
++		rc = assign_eip_near(ctxt, ctxt->src.val);
+ 		break;
+ 	case 5: /* jmp far */
+ 		rc = em_jmp_far(ctxt);
+@@ -1808,30 +1862,47 @@ static int em_grp9(struct x86_emulate_ctxt *ctxt)
+ 
+ static int em_ret(struct x86_emulate_ctxt *ctxt)
+ {
+-	ctxt->dst.type = OP_REG;
+-	ctxt->dst.addr.reg = &ctxt->_eip;
+-	ctxt->dst.bytes = ctxt->op_bytes;
+-	return em_pop(ctxt);
++	int rc;
++	unsigned long eip;
++
++	rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
++	if (rc != X86EMUL_CONTINUE)
++		return rc;
++
++	return assign_eip_near(ctxt, eip);
+ }
+ 
+ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ {
+ 	int rc;
+-	unsigned long cs;
++	unsigned long eip, cs;
++	u16 old_cs;
+ 	int cpl = ctxt->ops->cpl(ctxt);
++	struct desc_struct old_desc, new_desc;
++	const struct x86_emulate_ops *ops = ctxt->ops;
+ 
+-	rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes);
++	if (ctxt->mode == X86EMUL_MODE_PROT64)
++		ops->get_segment(ctxt, &old_cs, &old_desc, NULL,
++				 VCPU_SREG_CS);
++
++	rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
+ 	if (rc != X86EMUL_CONTINUE)
+ 		return rc;
+-	if (ctxt->op_bytes == 4)
+-		ctxt->_eip = (u32)ctxt->_eip;
+ 	rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
+ 	if (rc != X86EMUL_CONTINUE)
+ 		return rc;
+ 	/* Outer-privilege level return is not implemented */
+ 	if (ctxt->mode >= X86EMUL_MODE_PROT16 && (cs & 3) > cpl)
+ 		return X86EMUL_UNHANDLEABLE;
+-	rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS);
++	rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0,
++				       &new_desc);
++	if (rc != X86EMUL_CONTINUE)
++		return rc;
++	rc = assign_eip_far(ctxt, eip, new_desc.l);
++	if (rc != X86EMUL_CONTINUE) {
++		WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
++		ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
++	}
+ 	return rc;
+ }
+ 
+@@ -2043,7 +2114,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ {
+ 	struct x86_emulate_ops *ops = ctxt->ops;
+ 	struct desc_struct cs, ss;
+-	u64 msr_data;
++	u64 msr_data, rcx, rdx;
+ 	int usermode;
+ 	u16 cs_sel = 0, ss_sel = 0;
+ 
+@@ -2059,6 +2130,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ 	else
+ 		usermode = X86EMUL_MODE_PROT32;
+ 
++	rcx = ctxt->regs[VCPU_REGS_RCX];
++	rdx = ctxt->regs[VCPU_REGS_RDX];
++
+ 	cs.dpl = 3;
+ 	ss.dpl = 3;
+ 	ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
+@@ -2076,6 +2150,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ 		ss_sel = cs_sel + 8;
+ 		cs.d = 0;
+ 		cs.l = 1;
++		if (is_noncanonical_address(rcx) ||
++		    is_noncanonical_address(rdx))
++			return emulate_gp(ctxt, 0);
+ 		break;
+ 	}
+ 	cs_sel |= SELECTOR_RPL_MASK;
+@@ -2084,8 +2161,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ 	ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
+ 	ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+ 
+-	ctxt->_eip = ctxt->regs[VCPU_REGS_RDX];
+-	ctxt->regs[VCPU_REGS_RSP] = ctxt->regs[VCPU_REGS_RCX];
++	ctxt->_eip = rdx;
++	ctxt->regs[VCPU_REGS_RSP] = rcx;
+ 
+ 	return X86EMUL_CONTINUE;
+ }
+@@ -2174,6 +2251,7 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+ 				 struct tss_segment_16 *tss)
+ {
+ 	int ret;
++	u8 cpl;
+ 
+ 	ctxt->_eip = tss->ip;
+ 	ctxt->eflags = tss->flag | 2;
+@@ -2196,23 +2274,30 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+ 	set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
+ 	set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
+ 
++	cpl = tss->cs & 3;
++
+ 	/*
+ 	 * Now load segment descriptors. If fault happenes at this stage
+ 	 * it is handled in a context of new task
+ 	 */
+-	ret = load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR);
++	ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES);
++	ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS);
++	ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS);
++	ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS);
++	ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+ 
+@@ -2291,6 +2376,7 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ 				 struct tss_segment_32 *tss)
+ {
+ 	int ret;
++	u8 cpl;
+ 
+ 	if (ctxt->ops->set_cr(ctxt, 3, tss->cr3))
+ 		return emulate_gp(ctxt, 0);
+@@ -2307,7 +2393,8 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ 
+ 	/*
+ 	 * SDM says that segment selectors are loaded before segment
+-	 * descriptors
++	 * descriptors.  This is important because CPL checks will
++	 * use CS.RPL.
+ 	 */
+ 	set_segment_selector(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
+ 	set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
+@@ -2317,29 +2404,38 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ 	set_segment_selector(ctxt, tss->fs, VCPU_SREG_FS);
+ 	set_segment_selector(ctxt, tss->gs, VCPU_SREG_GS);
+ 
++	cpl = tss->cs & 3;
++
+ 	/*
+ 	 * Now load segment descriptors. If fault happenes at this stage
+ 	 * it is handled in a context of new task
+ 	 */
+-	ret = load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
++	ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR,
++					cpl, NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES);
++	ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS);
++	ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS);
++	ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS);
++	ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS);
++	ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+-	ret = load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS);
++	ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl,
++					NULL);
+ 	if (ret != X86EMUL_CONTINUE)
+ 		return ret;
+ 
+@@ -2536,39 +2632,67 @@ static int em_das(struct x86_emulate_ctxt *ctxt)
+ 	return X86EMUL_CONTINUE;
+ }
+ 
++static int em_call(struct x86_emulate_ctxt *ctxt)
++{
++	int rc;
++	long rel = ctxt->src.val;
++
++	ctxt->src.val = (unsigned long)ctxt->_eip;
++	rc = jmp_rel(ctxt, rel);
++	if (rc != X86EMUL_CONTINUE)
++		return rc;
++	return em_push(ctxt);
++}
++
+ static int em_call_far(struct x86_emulate_ctxt *ctxt)
+ {
+ 	u16 sel, old_cs;
+ 	ulong old_eip;
+ 	int rc;
++	struct desc_struct old_desc, new_desc;
++	const struct x86_emulate_ops *ops = ctxt->ops;
++	int cpl = ctxt->ops->cpl(ctxt);
+ 
+-	old_cs = get_segment_selector(ctxt, VCPU_SREG_CS);
+ 	old_eip = ctxt->_eip;
++	ops->get_segment(ctxt, &old_cs, &old_desc, NULL, VCPU_SREG_CS);
+ 
+ 	memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
+-	if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS))
++	rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl,
++				       &new_desc);
++	if (rc != X86EMUL_CONTINUE)
+ 		return X86EMUL_CONTINUE;
+ 
+-	ctxt->_eip = 0;
+-	memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
++	rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
++	if (rc != X86EMUL_CONTINUE)
++		goto fail;
+ 
+ 	ctxt->src.val = old_cs;
+ 	rc = em_push(ctxt);
+ 	if (rc != X86EMUL_CONTINUE)
+-		return rc;
++		goto fail;
+ 
+ 	ctxt->src.val = old_eip;
+-	return em_push(ctxt);
++	rc = em_push(ctxt);
++	/* If we failed, we tainted the memory, but the very least we should
++	   restore cs */
++	if (rc != X86EMUL_CONTINUE)
++		goto fail;
++	return rc;
++fail:
++	ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
++	return rc;
++
+ }
+ 
+ static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
+ {
+ 	int rc;
++	unsigned long eip;
+ 
+-	ctxt->dst.type = OP_REG;
+-	ctxt->dst.addr.reg = &ctxt->_eip;
+-	ctxt->dst.bytes = ctxt->op_bytes;
+-	rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes);
++	rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
++	if (rc != X86EMUL_CONTINUE)
++		return rc;
++	rc = assign_eip_near(ctxt, eip);
+ 	if (rc != X86EMUL_CONTINUE)
+ 		return rc;
+ 	register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], ctxt->src.val);
+@@ -2814,20 +2938,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
+ 
+ static int em_loop(struct x86_emulate_ctxt *ctxt)
+ {
++	int rc = X86EMUL_CONTINUE;
++
+ 	register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RCX], -1);
+ 	if ((address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) != 0) &&
+ 	    (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags)))
+-		jmp_rel(ctxt, ctxt->src.val);
++		rc = jmp_rel(ctxt, ctxt->src.val);
+ 
+-	return X86EMUL_CONTINUE;
++	return rc;
+ }
+ 
+ static int em_jcxz(struct x86_emulate_ctxt *ctxt)
+ {
++	int rc = X86EMUL_CONTINUE;
++
+ 	if (address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) == 0)
+-		jmp_rel(ctxt, ctxt->src.val);
++		rc = jmp_rel(ctxt, ctxt->src.val);
+ 
+-	return X86EMUL_CONTINUE;
++	return rc;
+ }
+ 
+ static int em_cli(struct x86_emulate_ctxt *ctxt)
+@@ -3271,7 +3399,7 @@ static struct opcode opcode_table[256] = {
+ 	D2bvIP(SrcImmUByte | DstAcc, in,  check_perm_in),
+ 	D2bvIP(SrcAcc | DstImmUByte, out, check_perm_out),
+ 	/* 0xE8 - 0xEF */
+-	D(SrcImm | Stack), D(SrcImm | ImplicitOps),
++	I(SrcImm | Stack, em_call), D(SrcImm | ImplicitOps),
+ 	I(SrcImmFAddr | No64, em_jmp_far), D(SrcImmByte | ImplicitOps),
+ 	D2bvIP(SrcDX | DstAcc, in,  check_perm_in),
+ 	D2bvIP(SrcAcc | DstDX, out, check_perm_out),
+@@ -3920,7 +4048,7 @@ special_insn:
+ 		break;
+ 	case 0x70 ... 0x7f: /* jcc (short) */
+ 		if (test_cc(ctxt->b, ctxt->eflags))
+-			jmp_rel(ctxt, ctxt->src.val);
++			rc = jmp_rel(ctxt, ctxt->src.val);
+ 		break;
+ 	case 0x8d: /* lea r16/r32, m */
+ 		ctxt->dst.val = ctxt->src.addr.mem.ea;
+@@ -3966,16 +4094,9 @@ special_insn:
+ 	case 0xe6: /* outb */
+ 	case 0xe7: /* out */
+ 		goto do_io_out;
+-	case 0xe8: /* call (near) */ {
+-		long int rel = ctxt->src.val;
+-		ctxt->src.val = (unsigned long) ctxt->_eip;
+-		jmp_rel(ctxt, rel);
+-		rc = em_push(ctxt);
+-		break;
+-	}
+ 	case 0xe9: /* jmp rel */
+ 	case 0xeb: /* jmp rel short */
+-		jmp_rel(ctxt, ctxt->src.val);
++		rc = jmp_rel(ctxt, ctxt->src.val);
+ 		ctxt->dst.type = OP_NONE; /* Disable writeback. */
+ 		break;
+ 	case 0xec: /* in al,dx */
+@@ -4141,7 +4262,7 @@ twobyte_insn:
+ 		break;
+ 	case 0x80 ... 0x8f: /* jnz rel, etc*/
+ 		if (test_cc(ctxt->b, ctxt->eflags))
+-			jmp_rel(ctxt, ctxt->src.val);
++			rc = jmp_rel(ctxt, ctxt->src.val);
+ 		break;
+ 	case 0x90 ... 0x9f:     /* setcc r/m8 */
+ 		ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags);
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index 139415e..cced57f 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -264,8 +264,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
+ 		return;
+ 
+ 	timer = &pit->pit_state.pit_timer.timer;
++	mutex_lock(&pit->pit_state.lock);
+ 	if (hrtimer_cancel(timer))
+ 		hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
++	mutex_unlock(&pit->pit_state.lock);
+ }
+ 
+ static void destroy_pit_timer(struct kvm_pit *pit)
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 2102a17..82f97a5 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3109,7 +3109,7 @@ static int wrmsr_interception(struct vcpu_svm *svm)
+ 
+ 
+ 	svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
+-	if (svm_set_msr(&svm->vcpu, ecx, data)) {
++	if (kvm_set_msr(&svm->vcpu, ecx, data)) {
+ 		trace_kvm_msr_write_ex(ecx, data);
+ 		kvm_inject_gp(&svm->vcpu, 0);
+ 	} else {
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index a4f6bda..578b1c6 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -390,6 +390,7 @@ struct vcpu_vmx {
+ 		u16           fs_sel, gs_sel, ldt_sel;
+ 		int           gs_ldt_reload_needed;
+ 		int           fs_reload_needed;
++		unsigned long vmcs_host_cr4;	/* May not match real cr4 */
+ 	} host_state;
+ 	struct {
+ 		int vm86_active;
+@@ -3629,16 +3630,21 @@ static void vmx_disable_intercept_for_msr(u32 msr, bool longmode_only)
+  * Note that host-state that does change is set elsewhere. E.g., host-state
+  * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
+  */
+-static void vmx_set_constant_host_state(void)
++static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ {
+ 	u32 low32, high32;
+ 	unsigned long tmpl;
+ 	struct desc_ptr dt;
++	unsigned long cr4;
+ 
+ 	vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS);  /* 22.2.3 */
+-	vmcs_writel(HOST_CR4, read_cr4());  /* 22.2.3, 22.2.5 */
+ 	vmcs_writel(HOST_CR3, read_cr3());  /* 22.2.3  FIXME: shadow tables */
+ 
++	/* Save the most likely value for this task's CR4 in the VMCS. */
++	cr4 = read_cr4();
++	vmcs_writel(HOST_CR4, cr4);			/* 22.2.3, 22.2.5 */
++	vmx->host_state.vmcs_host_cr4 = cr4;
++
+ 	vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS);  /* 22.2.4 */
+ 	vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS);  /* 22.2.4 */
+ 	vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS);  /* 22.2.4 */
+@@ -3760,7 +3766,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
+ 
+ 	vmcs_write16(HOST_FS_SELECTOR, 0);            /* 22.2.4 */
+ 	vmcs_write16(HOST_GS_SELECTOR, 0);            /* 22.2.4 */
+-	vmx_set_constant_host_state();
++	vmx_set_constant_host_state(vmx);
+ #ifdef CONFIG_X86_64
+ 	rdmsrl(MSR_FS_BASE, a);
+ 	vmcs_writel(HOST_FS_BASE, a); /* 22.2.4 */
+@@ -4544,7 +4550,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu)
+ 	u64 data = (vcpu->arch.regs[VCPU_REGS_RAX] & -1u)
+ 		| ((u64)(vcpu->arch.regs[VCPU_REGS_RDX] & -1u) << 32);
+ 
+-	if (vmx_set_msr(vcpu, ecx, data) != 0) {
++	if (kvm_set_msr(vcpu, ecx, data) != 0) {
+ 		trace_kvm_msr_write_ex(ecx, data);
+ 		kvm_inject_gp(vcpu, 0);
+ 		return 1;
+@@ -5550,6 +5556,18 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
+ 	return 1;
+ }
+ 
++static int handle_invept(struct kvm_vcpu *vcpu)
++{
++	kvm_queue_exception(vcpu, UD_VECTOR);
++	return 1;
++}
++
++static int handle_invvpid(struct kvm_vcpu *vcpu)
++{
++	kvm_queue_exception(vcpu, UD_VECTOR);
++	return 1;
++}
++
+ /*
+  * The exit handlers return 1 if the exit was handled fully and guest execution
+  * may resume.  Otherwise they set the kvm_run parameter to indicate what needs
+@@ -5591,6 +5609,8 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
+ 	[EXIT_REASON_PAUSE_INSTRUCTION]       = handle_pause,
+ 	[EXIT_REASON_MWAIT_INSTRUCTION]	      = handle_invalid_op,
+ 	[EXIT_REASON_MONITOR_INSTRUCTION]     = handle_invalid_op,
++	[EXIT_REASON_INVEPT]                  = handle_invept,
++	[EXIT_REASON_INVVPID]                 = handle_invvpid,
+ };
+ 
+ static const int kvm_vmx_max_exit_handlers =
+@@ -5775,6 +5795,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
+ 	case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD:
+ 	case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE:
+ 	case EXIT_REASON_VMOFF: case EXIT_REASON_VMON:
++	case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID:
+ 		/*
+ 		 * VMX instructions trap unconditionally. This allows L1 to
+ 		 * emulate them for its L2 guest, i.e., allows 3-level nesting!
+@@ -6093,6 +6114,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
+ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ {
+ 	struct vcpu_vmx *vmx = to_vmx(vcpu);
++	unsigned long cr4;
+ 
+ 	if (is_guest_mode(vcpu) && !vmx->nested.nested_run_pending) {
+ 		struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+@@ -6123,6 +6145,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ 	if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+ 		vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+ 
++	cr4 = read_cr4();
++	if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) {
++		vmcs_writel(HOST_CR4, cr4);
++		vmx->host_state.vmcs_host_cr4 = cr4;
++	}
++
+ 	/* When single-stepping over STI and MOV SS, we must clear the
+ 	 * corresponding interruptibility bits in the guest state. Otherwise
+ 	 * vmentry fails as it then expects bit 14 (BS) in pending debug
+@@ -6581,7 +6609,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+ 	 * Other fields are different per CPU, and will be set later when
+ 	 * vmx_vcpu_load() is called, and when vmx_save_host_state() is called.
+ 	 */
+-	vmx_set_constant_host_state();
++	vmx_set_constant_host_state(vmx);
+ 
+ 	/*
+ 	 * HOST_RSP is normally set correctly in vmx_vcpu_run() just before
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index b9fefaf..2d7d0df 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -893,7 +893,6 @@ void kvm_enable_efer_bits(u64 mask)
+ }
+ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+ 
+-
+ /*
+  * Writes msr value into into the appropriate "register".
+  * Returns 0 on success, non-0 otherwise.
+@@ -901,8 +900,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+  */
+ int kvm_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
+ {
++	switch (msr_index) {
++	case MSR_FS_BASE:
++	case MSR_GS_BASE:
++	case MSR_KERNEL_GS_BASE:
++	case MSR_CSTAR:
++	case MSR_LSTAR:
++		if (is_noncanonical_address(data))
++			return 1;
++		break;
++	case MSR_IA32_SYSENTER_EIP:
++	case MSR_IA32_SYSENTER_ESP:
++		/*
++		 * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if
++		 * non-canonical address is written on Intel but not on
++		 * AMD (which ignores the top 32-bits, because it does
++		 * not implement 64-bit SYSENTER).
++		 *
++		 * 64-bit code should hence be able to write a non-canonical
++		 * value on AMD.  Making the address canonical ensures that
++		 * vmentry does not fail on Intel after writing a non-canonical
++		 * value, and that something deterministic happens if the guest
++		 * invokes 64-bit SYSENTER.
++		 */
++		data = get_canonical(data);
++	}
+ 	return kvm_x86_ops->set_msr(vcpu, msr_index, data);
+ }
++EXPORT_SYMBOL_GPL(kvm_set_msr);
+ 
+ /*
+  * Adapt set_msr() to msr_io()'s calling convention
+diff --git a/block/genhd.c b/block/genhd.c
+index 8bd4ef2..41b0435 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -28,10 +28,10 @@ struct kobject *block_depr;
+ /* for extended dynamic devt allocation, currently only one major is used */
+ #define NR_EXT_DEVT		(1 << MINORBITS)
+ 
+-/* For extended devt allocation.  ext_devt_mutex prevents look up
++/* For extended devt allocation.  ext_devt_lock prevents look up
+  * results from going away underneath its user.
+  */
+-static DEFINE_MUTEX(ext_devt_mutex);
++static DEFINE_SPINLOCK(ext_devt_lock);
+ static DEFINE_IDR(ext_devt_idr);
+ 
+ static struct device_type disk_type;
+@@ -421,13 +421,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ 	do {
+ 		if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
+ 			return -ENOMEM;
+-		mutex_lock(&ext_devt_mutex);
++		spin_lock(&ext_devt_lock);
+ 		rc = idr_get_new(&ext_devt_idr, part, &idx);
+ 		if (!rc && idx >= NR_EXT_DEVT) {
+ 			idr_remove(&ext_devt_idr, idx);
+ 			rc = -EBUSY;
+ 		}
+-		mutex_unlock(&ext_devt_mutex);
++		spin_unlock(&ext_devt_lock);
+ 	} while (rc == -EAGAIN);
+ 
+ 	if (rc)
+@@ -448,15 +448,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+  */
+ void blk_free_devt(dev_t devt)
+ {
+-	might_sleep();
+-
+ 	if (devt == MKDEV(0, 0))
+ 		return;
+ 
+ 	if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
+-		mutex_lock(&ext_devt_mutex);
++		spin_lock(&ext_devt_lock);
+ 		idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+-		mutex_unlock(&ext_devt_mutex);
++		spin_unlock(&ext_devt_lock);
+ 	}
+ }
+ 
+@@ -663,7 +661,6 @@ void del_gendisk(struct gendisk *disk)
+ 	if (!sysfs_deprecated)
+ 		sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
+ 	device_del(disk_to_dev(disk));
+-	blk_free_devt(disk_to_dev(disk)->devt);
+ }
+ EXPORT_SYMBOL(del_gendisk);
+ 
+@@ -688,13 +685,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
+ 	} else {
+ 		struct hd_struct *part;
+ 
+-		mutex_lock(&ext_devt_mutex);
++		spin_lock(&ext_devt_lock);
+ 		part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+ 		if (part && get_disk(part_to_disk(part))) {
+ 			*partno = part->partno;
+ 			disk = part_to_disk(part);
+ 		}
+-		mutex_unlock(&ext_devt_mutex);
++		spin_unlock(&ext_devt_lock);
+ 	}
+ 
+ 	return disk;
+@@ -1102,6 +1099,7 @@ static void disk_release(struct device *dev)
+ {
+ 	struct gendisk *disk = dev_to_disk(dev);
+ 
++	blk_free_devt(dev->devt);
+ 	disk_release_events(disk);
+ 	kfree(disk->random);
+ 	disk_replace_part_tbl(disk, NULL);
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index de0791c..388ba10 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1165,9 +1165,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+ 	if (smp_processor_id() == 0 &&
+ 			cpuidle_get_driver() == &acpi_idle_driver) {
+ 
+-		cpuidle_pause_and_lock();
+ 		/* Protect against cpu-hotplug */
+ 		get_online_cpus();
++		cpuidle_pause_and_lock();
+ 
+ 		/* Disable all cpuidle devices */
+ 		for_each_online_cpu(cpu) {
+@@ -1192,8 +1192,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+ 				cpuidle_enable_device(&_pr->power.dev);
+ 			}
+ 		}
+-		put_online_cpus();
+ 		cpuidle_resume_and_unlock();
++		put_online_cpus();
+ 	}
+ 
+ 	return 0;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 43b0acf..4007f62 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -315,6 +315,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
+ 	{ PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
++	{ PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */
++	{ PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */
++	{ PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */
++	{ PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */
++	{ PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */
++	{ PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
++	{ PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
++	{ PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+ 
+ 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -449,6 +457,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
++	  .driver_data = board_ahci_yes_fbs },			/* 88se9182 */
++	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9182),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 */
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9192),
+ 	  .driver_data = board_ahci_yes_fbs },			/* 88se9172 on some Gigabyte */
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 5b0b5f7..b1e8e11 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -362,6 +362,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ 	{ 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
+ 	/* SATA Controller IDE (Coleto Creek) */
+ 	{ 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++	/* SATA Controller IDE (9 Series) */
++	{ 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++	/* SATA Controller IDE (9 Series) */
++	{ 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++	/* SATA Controller IDE (9 Series) */
++	{ 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
++	/* SATA Controller IDE (9 Series) */
++	{ 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+ 
+ 	{ }	/* terminate list */
+ };
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index bf441db..ea78bc46 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -36,6 +36,9 @@ bool regmap_readable(struct regmap *map, unsigned int reg)
+ 	if (map->max_register && reg > map->max_register)
+ 		return false;
+ 
++	if (map->format.format_write)
++		return false;
++
+ 	if (map->readable_reg)
+ 		return map->readable_reg(map->dev, reg);
+ 
+@@ -44,7 +47,7 @@ bool regmap_readable(struct regmap *map, unsigned int reg)
+ 
+ bool regmap_volatile(struct regmap *map, unsigned int reg)
+ {
+-	if (map->max_register && reg > map->max_register)
++	if (!map->format.format_write && !regmap_readable(map, reg))
+ 		return false;
+ 
+ 	if (map->volatile_reg)
+@@ -55,7 +58,7 @@ bool regmap_volatile(struct regmap *map, unsigned int reg)
+ 
+ bool regmap_precious(struct regmap *map, unsigned int reg)
+ {
+-	if (map->max_register && reg > map->max_register)
++	if (!regmap_readable(map, reg))
+ 		return false;
+ 
+ 	if (map->precious_reg)
+diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
+index 0016fee..96d5cfc 100644
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -651,7 +651,7 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
+ 	DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->lvds_ssc_freq);
+ }
+ 
+-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
++static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+ {
+ 	DRM_DEBUG_KMS("Falling back to manually reading VBT from "
+ 		      "VBIOS ROM for %s\n",
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 74d312f..fadd021 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -613,7 +613,7 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
+ 	.destroy = intel_encoder_destroy,
+ };
+ 
+-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
++static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+ {
+ 	DRM_DEBUG_KMS("Skipping LVDS initialization for %s\n", id->ident);
+ 	return 1;
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 6d9c32b..24e9756 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -457,6 +457,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ 		}
+ 	}
+ 
++	/* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
++	if ((dev->pdev->device == 0x9805) &&
++	    (dev->pdev->subsystem_vendor == 0x1734) &&
++	    (dev->pdev->subsystem_device == 0x11bd)) {
++		if (*connector_type == DRM_MODE_CONNECTOR_VGA)
++			return false;
++	}
+ 
+ 	return true;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+index a0c2f12..decca82 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+@@ -163,8 +163,9 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+ 
+ 	mutex_lock(&dev_priv->hw_mutex);
+ 
++	vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+ 	while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
+-		vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
++		;
+ 
+ 	dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE);
+ 
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 70423dc..2d5bb5b 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1130,6 +1130,13 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ 	if (param[1] == 0)
+ 		return true;
+ 
++	/*
++	 * Some models have a revision higher then 20. Meaning param[2] may
++	 * be 10 or 20, skip the rates check for these.
++	 */
++	if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++		return true;
++
+ 	for (i = 0; i < ARRAY_SIZE(rates); i++)
+ 		if (param[2] == rates[i])
+ 			return false;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index df8b72b..a50e121 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -506,10 +506,61 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ 			 ((buf[0] & 0x04) >> 1) |
+ 			 ((buf[3] & 0x04) >> 2));
+ 
++		if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
++			SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
++		    hw->w == 2) {
++			synaptics_parse_agm(buf, priv, hw);
++			return 1;
++		}
++
++		hw->x = (((buf[3] & 0x10) << 8) |
++			 ((buf[1] & 0x0f) << 8) |
++			 buf[4]);
++		hw->y = (((buf[3] & 0x20) << 7) |
++			 ((buf[1] & 0xf0) << 4) |
++			 buf[5]);
++		hw->z = buf[2];
++
+ 		hw->left  = (buf[0] & 0x01) ? 1 : 0;
+ 		hw->right = (buf[0] & 0x02) ? 1 : 0;
+ 
+-		if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
++		if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) {
++			/*
++			 * ForcePads, like Clickpads, use middle button
++			 * bits to report primary button clicks.
++			 * Unfortunately they report primary button not
++			 * only when user presses on the pad above certain
++			 * threshold, but also when there are more than one
++			 * finger on the touchpad, which interferes with
++			 * out multi-finger gestures.
++			 */
++			if (hw->z == 0) {
++				/* No contacts */
++				priv->press = priv->report_press = false;
++			} else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) {
++				/*
++				 * Single-finger touch with pressure above
++				 * the threshold. If pressure stays long
++				 * enough, we'll start reporting primary
++				 * button. We rely on the device continuing
++				 * sending data even if finger does not
++				 * move.
++				 */
++				if  (!priv->press) {
++					priv->press_start = jiffies;
++					priv->press = true;
++				} else if (time_after(jiffies,
++						priv->press_start +
++							msecs_to_jiffies(50))) {
++					priv->report_press = true;
++				}
++			} else {
++				priv->press = false;
++			}
++
++			hw->left = priv->report_press;
++
++		} else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+ 			/*
+ 			 * Clickpad's button is transmitted as middle button,
+ 			 * however, since it is primary button, we will report
+@@ -528,21 +579,6 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ 			hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ 		}
+ 
+-		if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+-			SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
+-		    hw->w == 2) {
+-			synaptics_parse_agm(buf, priv, hw);
+-			return 1;
+-		}
+-
+-		hw->x = (((buf[3] & 0x10) << 8) |
+-			 ((buf[1] & 0x0f) << 8) |
+-			 buf[4]);
+-		hw->y = (((buf[3] & 0x20) << 7) |
+-			 ((buf[1] & 0xf0) << 4) |
+-			 buf[5]);
+-		hw->z = buf[2];
+-
+ 		if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+ 		    ((buf[0] ^ buf[3]) & 0x02)) {
+ 			switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
+index 622aea8..908d167 100644
+--- a/drivers/input/mouse/synaptics.h
++++ b/drivers/input/mouse/synaptics.h
+@@ -77,6 +77,11 @@
+  * 2	0x08	image sensor		image sensor tracks 5 fingers, but only
+  *					reports 2.
+  * 2	0x20	report min		query 0x0f gives min coord reported
++ * 2	0x80	forcepad		forcepad is a variant of clickpad that
++ *					does not have physical buttons but rather
++ *					uses pressure above certain threshold to
++ *					report primary clicks. Forcepads also have
++ *					clickpad bit set.
+  */
+ #define SYN_CAP_CLICKPAD(ex0c)		((ex0c) & 0x100000) /* 1-button ClickPad */
+ #define SYN_CAP_CLICKPAD2BTN(ex0c)	((ex0c) & 0x000100) /* 2-button ClickPad */
+@@ -85,6 +90,7 @@
+ #define SYN_CAP_ADV_GESTURE(ex0c)	((ex0c) & 0x080000)
+ #define SYN_CAP_REDUCED_FILTERING(ex0c)	((ex0c) & 0x000400)
+ #define SYN_CAP_IMAGE_SENSOR(ex0c)	((ex0c) & 0x000800)
++#define SYN_CAP_FORCEPAD(ex0c)		((ex0c) & 0x008000)
+ 
+ /* synaptics modes query bits */
+ #define SYN_MODE_ABSOLUTE(m)		((m) & (1 << 7))
+@@ -170,6 +176,11 @@ struct synaptics_data {
+ 	 */
+ 	struct synaptics_hw_state agm;
+ 	bool agm_pending;			/* new AGM packet received */
++
++	/* ForcePad handling */
++	unsigned long				press_start;
++	bool					press;
++	bool					report_press;
+ };
+ 
+ void synaptics_module_init(void);
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 031270c..bab8238 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -458,6 +458,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ 		},
+ 	},
++	{
++		/* Avatar AVIU-145A6 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
++		},
++	},
+ 	{ }
+ };
+ 
+@@ -594,6 +601,14 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ 		},
+ 	},
++	{
++		/* Fujitsu U574 laptop */
++		/* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
+index 8755f5f..e4ecf3b 100644
+--- a/drivers/input/serio/serport.c
++++ b/drivers/input/serio/serport.c
+@@ -21,6 +21,7 @@
+ #include <linux/init.h>
+ #include <linux/serio.h>
+ #include <linux/tty.h>
++#include <linux/compat.h>
+ 
+ MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
+ MODULE_DESCRIPTION("Input device TTY line discipline");
+@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, u
+ 	return 0;
+ }
+ 
++static void serport_set_type(struct tty_struct *tty, unsigned long type)
++{
++	struct serport *serport = tty->disc_data;
++
++	serport->id.proto = type & 0x000000ff;
++	serport->id.id    = (type & 0x0000ff00) >> 8;
++	serport->id.extra = (type & 0x00ff0000) >> 16;
++}
++
+ /*
+  * serport_ldisc_ioctl() allows to set the port protocol, and device ID
+  */
+ 
+-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg)
++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file,
++			       unsigned int cmd, unsigned long arg)
+ {
+-	struct serport *serport = (struct serport*) tty->disc_data;
+-	unsigned long type;
+-
+ 	if (cmd == SPIOCSTYPE) {
++		unsigned long type;
++
+ 		if (get_user(type, (unsigned long __user *) arg))
+ 			return -EFAULT;
+ 
+-		serport->id.proto = type & 0x000000ff;
+-		serport->id.id	  = (type & 0x0000ff00) >> 8;
+-		serport->id.extra = (type & 0x00ff0000) >> 16;
++		serport_set_type(tty, type);
++		return 0;
++	}
++
++	return -EINVAL;
++}
++
++#ifdef CONFIG_COMPAT
++#define COMPAT_SPIOCSTYPE	_IOW('q', 0x01, compat_ulong_t)
++static long serport_ldisc_compat_ioctl(struct tty_struct *tty,
++				       struct file *file,
++				       unsigned int cmd, unsigned long arg)
++{
++	if (cmd == COMPAT_SPIOCSTYPE) {
++		void __user *uarg = compat_ptr(arg);
++		compat_ulong_t compat_type;
++
++		if (get_user(compat_type, (compat_ulong_t __user *)uarg))
++			return -EFAULT;
+ 
++		serport_set_type(tty, compat_type);
+ 		return 0;
+ 	}
+ 
+ 	return -EINVAL;
+ }
++#endif
+ 
+ static void serport_ldisc_write_wakeup(struct tty_struct * tty)
+ {
+@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldisc = {
+ 	.close =	serport_ldisc_close,
+ 	.read =		serport_ldisc_read,
+ 	.ioctl =	serport_ldisc_ioctl,
++#ifdef CONFIG_COMPAT
++	.compat_ioctl =	serport_ldisc_compat_ioctl,
++#endif
+ 	.receive_buf =	serport_ldisc_receive,
+ 	.write_wakeup =	serport_ldisc_write_wakeup
+ };
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index aa142f9..4878d91 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1565,6 +1565,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 	unsigned int key_size, opt_params;
+ 	unsigned long long tmpll;
+ 	int ret;
++	size_t iv_size_padding;
+ 	struct dm_arg_set as;
+ 	const char *opt_string;
+ 
+@@ -1600,12 +1601,23 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 
+ 	cc->dmreq_start = sizeof(struct ablkcipher_request);
+ 	cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
+-	cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
+-	cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
+-			   ~(crypto_tfm_ctx_alignment() - 1);
++	cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
++
++	if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
++		/* Allocate the padding exactly */
++		iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
++				& crypto_ablkcipher_alignmask(any_tfm(cc));
++	} else {
++		/*
++		 * If the cipher requires greater alignment than kmalloc
++		 * alignment, we don't know the exact position of the
++		 * initialization vector. We must assume worst case.
++		 */
++		iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
++	}
+ 
+ 	cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
+-			sizeof(struct dm_crypt_request) + cc->iv_size);
++			sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
+ 	if (!cc->req_pool) {
+ 		ti->error = "Cannot allocate crypt request mempool";
+ 		goto bad;
+diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
+index 044ea06..ab411c3 100644
+--- a/drivers/net/can/at91_can.c
++++ b/drivers/net/can/at91_can.c
+@@ -1115,7 +1115,9 @@ static int at91_open(struct net_device *dev)
+ 	struct at91_priv *priv = netdev_priv(dev);
+ 	int err;
+ 
+-	clk_enable(priv->clk);
++	err = clk_prepare_enable(priv->clk);
++	if (err)
++		return err;
+ 
+ 	/* check or determine and set bittime */
+ 	err = open_candev(dev);
+@@ -1139,7 +1141,7 @@ static int at91_open(struct net_device *dev)
+  out_close:
+ 	close_candev(dev);
+  out:
+-	clk_disable(priv->clk);
++	clk_disable_unprepare(priv->clk);
+ 
+ 	return err;
+ }
+@@ -1156,7 +1158,7 @@ static int at91_close(struct net_device *dev)
+ 	at91_chip_stop(dev, CAN_STATE_STOPPED);
+ 
+ 	free_irq(dev->irq, dev);
+-	clk_disable(priv->clk);
++	clk_disable_unprepare(priv->clk);
+ 
+ 	close_candev(dev);
+ 
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 7c6bb5a..b1f354f 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -120,7 +120,9 @@
+ 	(FLEXCAN_ESR_ERR_BUS | FLEXCAN_ESR_ERR_STATE)
+ 
+ /* FLEXCAN interrupt flag register (IFLAG) bits */
+-#define FLEXCAN_TX_BUF_ID		8
++/* Errata ERR005829 step7: Reserve first valid MB */
++#define FLEXCAN_TX_BUF_RESERVED		8
++#define FLEXCAN_TX_BUF_ID		9
+ #define FLEXCAN_IFLAG_BUF(x)		BIT(x)
+ #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW	BIT(7)
+ #define FLEXCAN_IFLAG_RX_FIFO_WARN	BIT(6)
+@@ -131,6 +133,17 @@
+ 
+ /* FLEXCAN message buffers */
+ #define FLEXCAN_MB_CNT_CODE(x)		(((x) & 0xf) << 24)
++#define FLEXCAN_MB_CODE_RX_INACTIVE	(0x0 << 24)
++#define FLEXCAN_MB_CODE_RX_EMPTY	(0x4 << 24)
++#define FLEXCAN_MB_CODE_RX_FULL		(0x2 << 24)
++#define FLEXCAN_MB_CODE_RX_OVERRRUN	(0x6 << 24)
++#define FLEXCAN_MB_CODE_RX_RANSWER	(0xa << 24)
++
++#define FLEXCAN_MB_CODE_TX_INACTIVE	(0x8 << 24)
++#define FLEXCAN_MB_CODE_TX_ABORT	(0x9 << 24)
++#define FLEXCAN_MB_CODE_TX_DATA		(0xc << 24)
++#define FLEXCAN_MB_CODE_TX_TANSWER	(0xe << 24)
++
+ #define FLEXCAN_MB_CNT_SRR		BIT(22)
+ #define FLEXCAN_MB_CNT_IDE		BIT(21)
+ #define FLEXCAN_MB_CNT_RTR		BIT(20)
+@@ -302,6 +315,14 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	flexcan_write(can_id, &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_id);
+ 	flexcan_write(ctrl, &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+ 
++	/* Errata ERR005829 step8:
++	 * Write twice INACTIVE(0x8) code to first MB.
++	 */
++	flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++		      &regs->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++	flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++		      &regs->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++
+ 	kfree_skb(skb);
+ 
+ 	/* tx_packets is incremented in flexcan_irq */
+@@ -611,6 +632,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ 	if (reg_iflag1 & (1 << FLEXCAN_TX_BUF_ID)) {
+ 		/* tx_bytes is incremented in flexcan_start_xmit */
+ 		stats->tx_packets++;
++		/* after sending a RTR frame mailbox is in RX mode */
++		flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++			      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+ 		flexcan_write((1 << FLEXCAN_TX_BUF_ID), &regs->iflag1);
+ 		netif_wake_queue(dev);
+ 	}
+@@ -668,6 +692,7 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	struct flexcan_regs __iomem *regs = priv->base;
+ 	int err;
+ 	u32 reg_mcr, reg_ctrl;
++	int i;
+ 
+ 	/* enable module */
+ 	flexcan_chip_enable(priv);
+@@ -733,8 +758,18 @@ static int flexcan_chip_start(struct net_device *dev)
+ 	dev_dbg(dev->dev.parent, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
+ 	flexcan_write(reg_ctrl, &regs->ctrl);
+ 
+-	/* Abort any pending TX, mark Mailbox as INACTIVE */
+-	flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
++	/* clear and invalidate all mailboxes first */
++	for (i = FLEXCAN_TX_BUF_ID; i < ARRAY_SIZE(regs->cantxfg); i++) {
++		flexcan_write(FLEXCAN_MB_CODE_RX_INACTIVE,
++			      &regs->cantxfg[i].can_ctrl);
++	}
++
++	/* Errata ERR005829: mark first TX mailbox as INACTIVE */
++	flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++		      &regs->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++
++	/* mark TX mailbox as INACTIVE */
++	flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
+ 		      &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+ 
+ 	/* acceptance mask/acceptance code (accept everything) */
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+index d696536..d552fa3 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-rxon.c
+@@ -440,6 +440,14 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
+ 	/* always get timestamp with Rx frame */
+ 	ctx->staging.flags |= RXON_FLG_TSF2HOST_MSK;
+ 
++	/*
++	 * force CTS-to-self frames protection if RTS-CTS is not preferred
++	 * one aggregation protection method
++	 */
++	if (!(priv->cfg->ht_params &&
++	      priv->cfg->ht_params->use_rts_for_aggregation))
++		ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++
+ 	if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) ||
+ 	    !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK))
+ 		ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK;
+@@ -872,6 +880,11 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw,
+ 	else
+ 		ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK;
+ 
++	if (bss_conf->use_cts_prot)
++		ctx->staging.flags |= RXON_FLG_SELF_CTS_EN;
++	else
++		ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN;
++
+ 	memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN);
+ 
+ 	if (vif->type == NL80211_IFTYPE_AP ||
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index c184253..1644b1f 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -316,6 +316,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ 	{RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ 	{RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++	{RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
+ 	{RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ 	{RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ 	{RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 143bbe4..2794a30 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -718,11 +718,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ 			return NULL;
+ 		}
+ 
++		if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
++			iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
++			return NULL;
++		}
++
+ 		task = conn->login_task;
+ 	} else {
+ 		if (session->state != ISCSI_STATE_LOGGED_IN)
+ 			return NULL;
+ 
++		if (data_size != 0) {
++			iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
++			return NULL;
++		}
++
+ 		BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
+ 		BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
+ 
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index ab5dd16..ae4e7da 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4306,6 +4306,7 @@ static void iscsit_logout_post_handler_diffcid(
+ {
+ 	struct iscsi_conn *l_conn;
+ 	struct iscsi_session *sess = conn->sess;
++	bool conn_found = false;
+ 
+ 	if (!sess)
+ 		return;
+@@ -4314,12 +4315,13 @@ static void iscsit_logout_post_handler_diffcid(
+ 	list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {
+ 		if (l_conn->cid == cid) {
+ 			iscsit_inc_conn_usage_count(l_conn);
++			conn_found = true;
+ 			break;
+ 		}
+ 	}
+ 	spin_unlock_bh(&sess->conn_lock);
+ 
+-	if (!l_conn)
++	if (!conn_found)
+ 		return;
+ 
+ 	if (l_conn->sock)
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index db313ba..e5f5bff 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -552,7 +552,7 @@ int iscsi_copy_param_list(
+ 	param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
+ 	if (!param_list) {
+ 		pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
+-		goto err_out;
++		return -1;
+ 	}
+ 	INIT_LIST_HEAD(&param_list->param_list);
+ 	INIT_LIST_HEAD(&param_list->extra_response_list);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index f08732b..10aec1a 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3651,9 +3651,10 @@ static void hub_events(void)
+ 
+ 		hub = list_entry(tmp, struct usb_hub, event_list);
+ 		kref_get(&hub->kref);
++		hdev = hub->hdev;
++		usb_get_dev(hdev);
+ 		spin_unlock_irq(&hub_event_lock);
+ 
+-		hdev = hub->hdev;
+ 		hub_dev = hub->intfdev;
+ 		intf = to_usb_interface(hub_dev);
+ 		dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
+@@ -3888,6 +3889,7 @@ static void hub_events(void)
+ 		usb_autopm_put_interface(intf);
+  loop_disconnected:
+ 		usb_unlock_device(hdev);
++		usb_put_dev(hdev);
+ 		kref_put(&hub->kref, hub_release);
+ 
+         } /* end while (1) */
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 600d823..3d9b57e 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -427,9 +427,6 @@ static int __devexit dwc3_remove(struct platform_device *pdev)
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 
+-	pm_runtime_put(&pdev->dev);
+-	pm_runtime_disable(&pdev->dev);
+-
+ 	dwc3_debugfs_exit(dwc);
+ 
+ 	if (features & DWC3_HAS_PERIPHERAL)
+@@ -440,6 +437,9 @@ static int __devexit dwc3_remove(struct platform_device *pdev)
+ 	iounmap(dwc->regs);
+ 	kfree(dwc->mem);
+ 
++	pm_runtime_put_sync(&pdev->dev);
++	pm_runtime_disable(&pdev->dev);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 517cadb..a3b569f 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -440,7 +440,8 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array,
+ }
+ 
+ /* Updates Link Status for super Speed port */
+-static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
++static void xhci_hub_report_link_state(struct xhci_hcd *xhci,
++		u32 *status, u32 status_reg)
+ {
+ 	u32 pls = status_reg & PORT_PLS_MASK;
+ 
+@@ -479,7 +480,8 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
+ 		 * in which sometimes the port enters compliance mode
+ 		 * caused by a delay on the host-device negotiation.
+ 		 */
+-		if (pls == USB_SS_PORT_LS_COMP_MOD)
++		if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
++				(pls == USB_SS_PORT_LS_COMP_MOD))
+ 			pls |= USB_PORT_STAT_CONNECTION;
+ 	}
+ 
+@@ -655,7 +657,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ 		}
+ 		/* Update Port Link State for super speed ports*/
+ 		if (hcd->speed == HCD_USB3) {
+-			xhci_hub_report_link_state(&status, temp);
++			xhci_hub_report_link_state(xhci, &status, temp);
+ 			/*
+ 			 * Verify if all USB3 Ports Have entered U0 already.
+ 			 * Delete Compliance Mode Timer if so.
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 74922b9..0f4a41d 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1723,7 +1723,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ 	}
+ 
+ 	num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+-	for (i = 0; i < num_ports; i++) {
++	for (i = 0; i < num_ports && xhci->rh_bw; i++) {
+ 		struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+ 		for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+ 			struct list_head *ep = &bwt->interval_bw[j].endpoints;
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 0d34f85..8fe5c13 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -752,6 +752,7 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ 		.driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ 	{ USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
++	{ USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
+ 	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+ 	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+ 	{ USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+@@ -961,6 +962,8 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ 	/* ekey Devices */
+ 	{ USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
++	/* GE Healthcare devices */
++	{ USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index cbcb1e6..bd509de 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -831,6 +831,12 @@
+ #define TELLDUS_TELLSTICK_PID		0x0C30	/* RF control dongle 433 MHz using FT232RL */
+ 
+ /*
++ * NOVITUS printers
++ */
++#define NOVITUS_VID			0x1a28
++#define NOVITUS_BONO_E_PID		0x6010
++
++/*
+  * RT Systems programming cables for various ham radios
+  */
+ #define RTSYSTEMS_VID		0x2100	/* Vendor ID */
+@@ -1379,3 +1385,9 @@
+  * ekey biometric systems GmbH (http://ekey.net/)
+  */
+ #define FTDI_EKEY_CONV_USB_PID		0xCB08	/* Converter USB */
++
++/*
++ * GE Healthcare devices
++ */
++#define GE_HEALTHCARE_VID		0x1901
++#define GE_HEALTHCARE_NEMO_TRACKER_PID	0x0015
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 0d26ab6..db9e54a 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -296,14 +296,19 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x1199, 0x68A2),   /* Sierra Wireless MC77xx in QMI mode */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-	{ USB_DEVICE(0x1199, 0x68A3), 	/* Sierra Wireless Direct IP modems */
++	/* Sierra Wireless Direct IP modems */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68A3, 0xFF, 0xFF, 0xFF),
++	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
++	},
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF),
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+ 	/* AT&T Direct IP LTE modems */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-	{ USB_DEVICE(0x0f3d, 0x68A3), 	/* Airprime/Sierra Wireless Direct IP modems */
++	/* Airprime/Sierra Wireless Direct IP modems */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68A3, 0xFF, 0xFF, 0xFF),
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+ 
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index e588a11..a6c4c7d 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -93,6 +93,12 @@ UNUSUAL_DEV(  0x03f0, 0x4002, 0x0001, 0x0001,
+ 		"PhotoSmart R707",
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY),
+ 
++UNUSUAL_DEV(  0x03f3, 0x0001, 0x0000, 0x9999,
++		"Adaptec",
++		"USBConnect 2000",
++		USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++		US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
+  * and Olaf Hering <olh@suse.de> (different bcd's, same vendor/product)
+  * for USB floppies that need the SINGLE_LUN enforcement.
+@@ -733,6 +739,12 @@ UNUSUAL_DEV(  0x059b, 0x0001, 0x0100, 0x0100,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_SINGLE_LUN ),
+ 
++UNUSUAL_DEV(  0x059b, 0x0040, 0x0100, 0x0100,
++		"Iomega",
++		"Jaz USB Adapter",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_SINGLE_LUN ),
++
+ /* Reported by <Hendryk.Pfeiffer@gmx.de> */
+ UNUSUAL_DEV(  0x059f, 0x0643, 0x0000, 0x0000,
+ 		"LaCie",
+@@ -1105,6 +1117,18 @@ UNUSUAL_DEV(  0x0851, 0x1543, 0x0200, 0x0200,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NOT_LOCKABLE),
+ 
++UNUSUAL_DEV(  0x085a, 0x0026, 0x0100, 0x0133,
++		"Xircom",
++		"PortGear USB-SCSI (Mac USB Dock)",
++		USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++		US_FL_SCM_MULT_TARG ),
++
++UNUSUAL_DEV(  0x085a, 0x0028, 0x0100, 0x0133,
++		"Xircom",
++		"PortGear USB to SCSI Converter",
++		USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++		US_FL_SCM_MULT_TARG ),
++
+ /* Submitted by Jan De Luyck <lkml@kcore.org> */
+ UNUSUAL_DEV(  0x08bd, 0x1100, 0x0000, 0x0000,
+ 		"CITIZEN",
+@@ -1932,6 +1956,14 @@ UNUSUAL_DEV(  0x152d, 0x2329, 0x0100, 0x0100,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+ 
++/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
++ * and Mac USB Dock USB-SCSI */
++UNUSUAL_DEV(  0x1645, 0x0007, 0x0100, 0x0133,
++		"Entrega Technologies",
++		"USB to SCSI Converter",
++		USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++		US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Robert Schedel <r.schedel@yahoo.de>
+  * Note: this is a 'super top' device like the above 14cd/6600 device */
+ UNUSUAL_DEV(  0x1652, 0x6600, 0x0201, 0x0201,
+@@ -1947,6 +1979,12 @@ UNUSUAL_DEV(  0x177f, 0x0400, 0x0000, 0x0000,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+ 
++UNUSUAL_DEV(  0x1822, 0x0001, 0x0000, 0x9999,
++		"Ariston Technologies",
++		"iConnect USB to SCSI adapter",
++		USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++		US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+  * These Appotech controllers are found in Picture Frames, they provide a
+  * (buggy) emulation of a cdrom drive which contains the windows software
+diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c
+index 5241f1d..3c9e929 100644
+--- a/drivers/uwb/lc-dev.c
++++ b/drivers/uwb/lc-dev.c
+@@ -441,16 +441,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
+ 	uwb_dev->mac_addr = *bce->mac_addr;
+ 	uwb_dev->dev_addr = bce->dev_addr;
+ 	dev_set_name(&uwb_dev->dev, macbuf);
++
++	/* plug the beacon cache */
++	bce->uwb_dev = uwb_dev;
++	uwb_dev->bce = bce;
++	uwb_bce_get(bce);		/* released in uwb_dev_sys_release() */
++
+ 	result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc);
+ 	if (result < 0) {
+ 		dev_err(dev, "new device %s: cannot instantiate device\n",
+ 			macbuf);
+ 		goto error_dev_add;
+ 	}
+-	/* plug the beacon cache */
+-	bce->uwb_dev = uwb_dev;
+-	uwb_dev->bce = bce;
+-	uwb_bce_get(bce);		/* released in uwb_dev_sys_release() */
++
+ 	dev_info(dev, "uwb device (mac %s dev %s) connected to %s %s\n",
+ 		 macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name,
+ 		 dev_name(rc->uwb_dev.dev.parent));
+@@ -458,6 +461,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
+ 	return;
+ 
+ error_dev_add:
++	bce->uwb_dev = NULL;
++	uwb_bce_put(bce);
+ 	kfree(uwb_dev);
+ 	return;
+ }
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index c8af7e5..6548417 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -108,16 +108,11 @@ static void do_suspend(void)
+ 
+ 	shutting_down = SHUTDOWN_SUSPEND;
+ 
+-#ifdef CONFIG_PREEMPT
+-	/* If the kernel is preemptible, we need to freeze all the processes
+-	   to prevent them from being in the middle of a pagetable update
+-	   during suspend. */
+ 	err = freeze_processes();
+ 	if (err) {
+ 		printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
+ 		goto out;
+ 	}
+-#endif
+ 
+ 	err = dpm_suspend_start(PMSG_FREEZE);
+ 	if (err) {
+@@ -172,10 +167,8 @@ out_resume:
+ 	clock_was_set();
+ 
+ out_thaw:
+-#ifdef CONFIG_PREEMPT
+ 	thaw_processes();
+ out:
+-#endif
+ 	shutting_down = SHUTDOWN_INVALID;
+ }
+ #endif	/* CONFIG_HIBERNATE_CALLBACKS */
+diff --git a/fs/aio.c b/fs/aio.c
+index 8cdd8ea..9acfd07 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -1102,6 +1102,13 @@ static int aio_read_evt(struct kioctx *ioctx, struct io_event *ent)
+ 	head = ring->head % info->nr;
+ 	if (head != ring->tail) {
+ 		struct io_event *evp = aio_ring_event(info, head, KM_USER1);
++
++		/*
++		 * Ensure that once we've read the current tail pointer, that
++		 * we also see the events that were stored up to the tail.
++		 */
++		smp_rmb();
++
+ 		*ent = *evp;
+ 		head = (head + 1) % info->nr;
+ 		smp_mb(); /* finish reading the event before updatng the head */
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 5f4bde2..59496e7 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1021,7 +1021,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ 		bh = page_buffers(page);
+ 		if (bh->b_size == size) {
+ 			end_block = init_page_buffers(page, bdev,
+-						index << sizebits, size);
++						(sector_t)index << sizebits,
++						size);
+ 			goto done;
+ 		}
+ 		if (!try_to_free_buffers(page))
+@@ -1042,7 +1043,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ 	 */
+ 	spin_lock(&inode->i_mapping->private_lock);
+ 	link_dev_buffers(page, bh);
+-	end_block = init_page_buffers(page, bdev, index << sizebits, size);
++	end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
++			size);
+ 	spin_unlock(&inode->i_mapping->private_lock);
+ done:
+ 	ret = (block < end_block) ? 1 : -ENXIO;
+diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
+index 91a6945..5a45b8f 100644
+--- a/fs/ext2/inode.c
++++ b/fs/ext2/inode.c
+@@ -619,6 +619,8 @@ static int ext2_get_blocks(struct inode *inode,
+ 	int count = 0;
+ 	ext2_fsblk_t first_block = 0;
+ 
++	BUG_ON(maxblocks == 0);
++
+ 	depth = ext2_block_to_path(inode,iblock,offsets,&blocks_to_boundary);
+ 
+ 	if (depth == 0)
+diff --git a/fs/ext2/xip.c b/fs/ext2/xip.c
+index 322a56b..af014bb 100644
+--- a/fs/ext2/xip.c
++++ b/fs/ext2/xip.c
+@@ -37,6 +37,7 @@ __ext2_get_block(struct inode *inode, pgoff_t pgoff, int create,
+ 	int rc;
+ 
+ 	memset(&tmp, 0, sizeof(struct buffer_head));
++	tmp.b_size = 1 << inode->i_blkbits;
+ 	rc = ext2_get_block(inode, pgoff, &tmp, create);
+ 	*result = tmp.b_blocknr;
+ 
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 818b43e..5baa7ba 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1312,6 +1312,8 @@ static void mb_free_blocks(struct inode *inode, struct ext4_buddy *e4b,
+ 	void *buddy2;
+ 	struct super_block *sb = e4b->bd_sb;
+ 
++	if (WARN_ON(count == 0))
++		return;
+ 	BUG_ON(first + count > (sb->s_blocksize << 3));
+ 	assert_spin_locked(ext4_group_lock_ptr(sb, e4b->bd_group));
+ 	mb_check_buddy(e4b);
+@@ -3132,6 +3134,8 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
+ 	int err;
+ 
+ 	if (pa == NULL) {
++		if (ac->ac_f_ex.fe_len == 0)
++			return;
+ 		err = ext4_mb_load_buddy(ac->ac_sb, ac->ac_f_ex.fe_group, &e4b);
+ 		if (err) {
+ 			/*
+@@ -3146,6 +3150,7 @@ static void ext4_discard_allocated_blocks(struct ext4_allocation_context *ac)
+ 		mb_free_blocks(ac->ac_inode, &e4b, ac->ac_f_ex.fe_start,
+ 			       ac->ac_f_ex.fe_len);
+ 		ext4_unlock_group(ac->ac_sb, ac->ac_f_ex.fe_group);
++		ext4_mb_unload_buddy(&e4b);
+ 		return;
+ 	}
+ 	if (pa->pa_type == MB_INODE_PA)
+diff --git a/fs/namei.c b/fs/namei.c
+index 9680cef..dea2dab 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -554,24 +554,22 @@ static int complete_walk(struct nameidata *nd)
+ 
+ static __always_inline void set_root(struct nameidata *nd)
+ {
+-	if (!nd->root.mnt)
+-		get_fs_root(current->fs, &nd->root);
++	get_fs_root(current->fs, &nd->root);
+ }
+ 
+ static int link_path_walk(const char *, struct nameidata *);
+ 
+-static __always_inline void set_root_rcu(struct nameidata *nd)
++static __always_inline unsigned set_root_rcu(struct nameidata *nd)
+ {
+-	if (!nd->root.mnt) {
+-		struct fs_struct *fs = current->fs;
+-		unsigned seq;
++	struct fs_struct *fs = current->fs;
++	unsigned seq, res;
+ 
+-		do {
+-			seq = read_seqcount_begin(&fs->seq);
+-			nd->root = fs->root;
+-			nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
+-		} while (read_seqcount_retry(&fs->seq, seq));
+-	}
++	do {
++		seq = read_seqcount_begin(&fs->seq);
++		nd->root = fs->root;
++		res = __read_seqcount_begin(&nd->root.dentry->d_seq);
++	} while (read_seqcount_retry(&fs->seq, seq));
++	return res;
+ }
+ 
+ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
+@@ -582,7 +580,8 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l
+ 		goto fail;
+ 
+ 	if (*link == '/') {
+-		set_root(nd);
++		if (!nd->root.mnt)
++			set_root(nd);
+ 		path_put(&nd->path);
+ 		nd->path = nd->root;
+ 		path_get(&nd->root);
+@@ -912,22 +911,11 @@ static bool __follow_mount_rcu(struct nameidata *nd, struct path *path,
+ 	return true;
+ }
+ 
+-static void follow_mount_rcu(struct nameidata *nd)
+-{
+-	while (d_mountpoint(nd->path.dentry)) {
+-		struct vfsmount *mounted;
+-		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
+-		if (!mounted)
+-			break;
+-		nd->path.mnt = mounted;
+-		nd->path.dentry = mounted->mnt_root;
+-		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+-	}
+-}
+-
+ static int follow_dotdot_rcu(struct nameidata *nd)
+ {
+-	set_root_rcu(nd);
++	struct inode *inode = nd->inode;
++	if (!nd->root.mnt)
++		set_root_rcu(nd);
+ 
+ 	while (1) {
+ 		if (nd->path.dentry == nd->root.dentry &&
+@@ -939,6 +927,7 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ 			struct dentry *parent = old->d_parent;
+ 			unsigned seq;
+ 
++			inode = parent->d_inode;
+ 			seq = read_seqcount_begin(&parent->d_seq);
+ 			if (read_seqcount_retry(&old->d_seq, nd->seq))
+ 				goto failed;
+@@ -948,10 +937,20 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ 		}
+ 		if (!follow_up_rcu(&nd->path))
+ 			break;
++		inode = nd->path.dentry->d_inode;
+ 		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
+ 	}
+-	follow_mount_rcu(nd);
+-	nd->inode = nd->path.dentry->d_inode;
++	while (d_mountpoint(nd->path.dentry)) {
++		struct vfsmount *mounted;
++		mounted = __lookup_mnt(nd->path.mnt, nd->path.dentry, 1);
++		if (!mounted)
++			break;
++		nd->path.mnt = mounted;
++		nd->path.dentry = mounted->mnt_root;
++		inode = nd->path.dentry->d_inode;
++		nd->seq = read_seqcount_begin(&nd->path.dentry->d_seq);
++	}
++	nd->inode = inode;
+ 	return 0;
+ 
+ failed:
+@@ -1030,7 +1029,8 @@ static void follow_mount(struct path *path)
+ 
+ static void follow_dotdot(struct nameidata *nd)
+ {
+-	set_root(nd);
++	if (!nd->root.mnt)
++		set_root(nd);
+ 
+ 	while(1) {
+ 		struct dentry *old = nd->path.dentry;
+@@ -1504,7 +1504,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
+ 		if (flags & LOOKUP_RCU) {
+ 			br_read_lock(vfsmount_lock);
+ 			rcu_read_lock();
+-			set_root_rcu(nd);
++			nd->seq = set_root_rcu(nd);
+ 		} else {
+ 			set_root(nd);
+ 			path_get(&nd->root);
+@@ -1560,7 +1560,14 @@ static int path_init(int dfd, const char *name, unsigned int flags,
+ 	}
+ 
+ 	nd->inode = nd->path.dentry->d_inode;
+-	return 0;
++	if (!(flags & LOOKUP_RCU))
++		return 0;
++	if (likely(!read_seqcount_retry(&nd->path.dentry->d_seq, nd->seq)))
++		return 0;
++	if (!(nd->flags & LOOKUP_ROOT))
++		nd->root.mnt = NULL;
++	rcu_read_unlock();
++	return -ECHILD;
+ 
+ fput_fail:
+ 	fput_light(file, fput_needed);
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index c4a2a68..61a1303 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2015,23 +2015,23 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ 	is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
+ 	is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
+ 	is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
+-	/* Calculate the current open share mode */
+-	calldata->arg.fmode = 0;
+-	if (is_rdonly || is_rdwr)
+-		calldata->arg.fmode |= FMODE_READ;
+-	if (is_wronly || is_rdwr)
+-		calldata->arg.fmode |= FMODE_WRITE;
+ 	/* Calculate the change in open mode */
++	calldata->arg.fmode = 0;
+ 	if (state->n_rdwr == 0) {
+-		if (state->n_rdonly == 0) {
+-			call_close |= is_rdonly || is_rdwr;
+-			calldata->arg.fmode &= ~FMODE_READ;
+-		}
+-		if (state->n_wronly == 0) {
+-			call_close |= is_wronly || is_rdwr;
+-			calldata->arg.fmode &= ~FMODE_WRITE;
+-		}
+-	}
++		if (state->n_rdonly == 0)
++			call_close |= is_rdonly;
++		else if (is_rdonly)
++			calldata->arg.fmode |= FMODE_READ;
++		if (state->n_wronly == 0)
++			call_close |= is_wronly;
++		else if (is_wronly)
++			calldata->arg.fmode |= FMODE_WRITE;
++	} else if (is_rdwr)
++		calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
++
++	if (calldata->arg.fmode == 0)
++		call_close |= is_rdwr;
++
+ 	spin_unlock(&state->owner->so_lock);
+ 
+ 	if (!call_close) {
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index 11e1888..e2e7914 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -508,6 +508,9 @@ set_nfsv4_acl_one(struct dentry *dentry, struct posix_acl *pacl, char *key)
+ 	char *buf = NULL;
+ 	int error = 0;
+ 
++	if (!pacl)
++		return vfs_setxattr(dentry, key, NULL, 0, 0);
++
+ 	buflen = posix_acl_xattr_size(pacl->a_count);
+ 	buf = kmalloc(buflen, GFP_KERNEL);
+ 	error = -ENOMEM;
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index edeb239..b2d8a96 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -24,6 +24,7 @@
+ #include <linux/buffer_head.h>
+ #include <linux/gfp.h>
+ #include <linux/mpage.h>
++#include <linux/pagemap.h>
+ #include <linux/writeback.h>
+ #include <linux/uio.h>
+ #include "nilfs.h"
+@@ -195,10 +196,10 @@ static int nilfs_writepage(struct page *page, struct writeback_control *wbc)
+ 
+ static int nilfs_set_page_dirty(struct page *page)
+ {
++	struct inode *inode = page->mapping->host;
+ 	int ret = __set_page_dirty_nobuffers(page);
+ 
+ 	if (page_has_buffers(page)) {
+-		struct inode *inode = page->mapping->host;
+ 		unsigned nr_dirty = 0;
+ 		struct buffer_head *bh, *head;
+ 
+@@ -221,6 +222,10 @@ static int nilfs_set_page_dirty(struct page *page)
+ 
+ 		if (nr_dirty)
+ 			nilfs_set_file_dirty(inode, nr_dirty);
++	} else if (ret) {
++		unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
++
++		nilfs_set_file_dirty(inode, nr_dirty);
+ 	}
+ 	return ret;
+ }
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 005261c..dbc372e 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -653,12 +653,9 @@ void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm,
+ 	clear_bit(bit, res->refmap);
+ }
+ 
+-
+-void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
++static void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ 				   struct dlm_lock_resource *res)
+ {
+-	assert_spin_locked(&res->spinlock);
+-
+ 	res->inflight_locks++;
+ 
+ 	mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
+@@ -666,6 +663,13 @@ void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ 	     __builtin_return_address(0));
+ }
+ 
++void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
++				   struct dlm_lock_resource *res)
++{
++	assert_spin_locked(&res->spinlock);
++	__dlm_lockres_grab_inflight_ref(dlm, res);
++}
++
+ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
+ 				   struct dlm_lock_resource *res)
+ {
+@@ -855,10 +859,8 @@ lookup:
+ 	/* finally add the lockres to its hash bucket */
+ 	__dlm_insert_lockres(dlm, res);
+ 
+-	/* Grab inflight ref to pin the resource */
+-	spin_lock(&res->spinlock);
+-	dlm_lockres_grab_inflight_ref(dlm, res);
+-	spin_unlock(&res->spinlock);
++	/* since this lockres is new it doesn't not require the spinlock */
++	__dlm_lockres_grab_inflight_ref(dlm, res);
+ 
+ 	/* get an extra ref on the mle in case this is a BLOCK
+ 	 * if so, the creator of the BLOCK may try to put the last
+diff --git a/fs/partitions/check.c b/fs/partitions/check.c
+index 1ef15cc..18c58e5 100644
+--- a/fs/partitions/check.c
++++ b/fs/partitions/check.c
+@@ -361,6 +361,7 @@ static const struct attribute_group *part_attr_groups[] = {
+ static void part_release(struct device *dev)
+ {
+ 	struct hd_struct *p = dev_to_part(dev);
++	blk_free_devt(dev->devt);
+ 	free_part_stats(p);
+ 	free_part_info(p);
+ 	kfree(p);
+@@ -403,7 +404,6 @@ void delete_partition(struct gendisk *disk, int partno)
+ 	rcu_assign_pointer(ptbl->last_lookup, NULL);
+ 	kobject_put(part->holder_dir);
+ 	device_del(part_to_dev(part));
+-	blk_free_devt(part_devt(part));
+ 
+ 	hd_struct_put(part);
+ }
+diff --git a/include/linux/alarmtimer.h b/include/linux/alarmtimer.h
+index 975009e..9a9838a 100644
+--- a/include/linux/alarmtimer.h
++++ b/include/linux/alarmtimer.h
+@@ -48,6 +48,7 @@ int alarm_try_to_cancel(struct alarm *alarm);
+ int alarm_cancel(struct alarm *alarm);
+ 
+ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval);
++ktime_t alarm_expires_remaining(const struct alarm *alarm);
+ 
+ /*
+  * A alarmtimer is active, when it is enqueued into timerqueue or the
+diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
+index ffbeb2c..5b6efef 100644
+--- a/include/linux/ceph/messenger.h
++++ b/include/linux/ceph/messenger.h
+@@ -92,7 +92,7 @@ struct ceph_msg {
+ 	bool front_is_vmalloc;
+ 	bool more_to_follow;
+ 	bool needs_out_seq;
+-	int front_max;
++	int front_alloc_len;
+ 	unsigned long ack_stamp;        /* tx: when we were acked */
+ 
+ 	struct ceph_msgpool *pool;
+diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
+index f5df3dc..f4e8578 100644
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -259,23 +259,11 @@ extern unsigned long preset_lpj;
+ #define SEC_JIFFIE_SC (32 - SHIFT_HZ)
+ #endif
+ #define NSEC_JIFFIE_SC (SEC_JIFFIE_SC + 29)
+-#define USEC_JIFFIE_SC (SEC_JIFFIE_SC + 19)
+ #define SEC_CONVERSION ((unsigned long)((((u64)NSEC_PER_SEC << SEC_JIFFIE_SC) +\
+                                 TICK_NSEC -1) / (u64)TICK_NSEC))
+ 
+ #define NSEC_CONVERSION ((unsigned long)((((u64)1 << NSEC_JIFFIE_SC) +\
+                                         TICK_NSEC -1) / (u64)TICK_NSEC))
+-#define USEC_CONVERSION  \
+-                    ((unsigned long)((((u64)NSEC_PER_USEC << USEC_JIFFIE_SC) +\
+-                                        TICK_NSEC -1) / (u64)TICK_NSEC))
+-/*
+- * USEC_ROUND is used in the timeval to jiffie conversion.  See there
+- * for more details.  It is the scaled resolution rounding value.  Note
+- * that it is a 64-bit value.  Since, when it is applied, we are already
+- * in jiffies (albit scaled), it is nothing but the bits we will shift
+- * off.
+- */
+-#define USEC_ROUND (u64)(((u64)1 << USEC_JIFFIE_SC) - 1)
+ /*
+  * The maximum jiffie value is (MAX_INT >> 1).  Here we translate that
+  * into seconds.  The 64-bit case will overflow if we are not careful,
+diff --git a/include/net/regulatory.h b/include/net/regulatory.h
+index eb7d3c2..c3c22e0 100644
+--- a/include/net/regulatory.h
++++ b/include/net/regulatory.h
+@@ -92,7 +92,7 @@ struct ieee80211_reg_rule {
+ 
+ struct ieee80211_regdomain {
+ 	u32 n_reg_rules;
+-	char alpha2[2];
++	char alpha2[3];
+ 	struct ieee80211_reg_rule reg_rules[];
+ };
+ 
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index ad03988..e0f1c91 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -523,6 +523,11 @@ static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
+ 	asoc->pmtu_pending = 0;
+ }
+ 
++static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk)
++{
++	return !list_empty(&chunk->list);
++}
++
+ /* Walk through a list of TLV parameters.  Don't trust the
+  * individual parameter lengths and instead depend on
+  * the chunk length to indicate when to stop.  Make sure
+diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
+index 9148632..4d1be75 100644
+--- a/include/net/sctp/sm.h
++++ b/include/net/sctp/sm.h
+@@ -251,9 +251,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *,
+ 					      int, __be16);
+ struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc,
+ 					     union sctp_addr *addr);
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+-		       struct sctp_paramhdr *param_hdr, void *chunk_end,
+-		       struct sctp_paramhdr **errp);
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++			struct sctp_chunk *chunk, bool addr_param_needed,
++			struct sctp_paramhdr **errp);
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 				       struct sctp_chunk *asconf);
+ int sctp_process_asconf_ack(struct sctp_association *asoc,
+diff --git a/init/Kconfig b/init/Kconfig
+index 43298f9..b8dc1de 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -555,6 +555,7 @@ config LOG_BUF_SHIFT
+ 	int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
+ 	range 12 21
+ 	default 17
++	depends on PRINTK
+ 	help
+ 	  Select kernel log buffer size as a power of 2.
+ 	  Examples:
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 93fc15e..ffcf896 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3871,6 +3871,11 @@ static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, int mode)
+ {
+ 	struct cgroup *c_parent = dentry->d_parent->d_fsdata;
+ 
++	/* Do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable.
++	 */
++	if (strchr(dentry->d_name.name, '\n'))
++		return -EINVAL;
++
+ 	/* the vfs holds inode->i_mutex already */
+ 	return cgroup_create(c_parent, dentry, mode | S_IFDIR);
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 14c111c..4a14895 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1683,6 +1683,16 @@ retry:
+ 	 */
+ 	if (ctx->is_active) {
+ 		raw_spin_unlock_irq(&ctx->lock);
++		/*
++		 * Reload the task pointer, it might have been changed by
++		 * a concurrent perf_event_context_sched_out().
++		 */
++		task = ctx->task;
++		/*
++		 * Reload the task pointer, it might have been changed by
++		 * a concurrent perf_event_context_sched_out().
++		 */
++		task = ctx->task;
+ 		goto retry;
+ 	}
+ 
+@@ -7071,8 +7081,10 @@ int perf_event_init_task(struct task_struct *child)
+ 
+ 	for_each_task_context_nr(ctxn) {
+ 		ret = perf_event_init_context(child, ctxn);
+-		if (ret)
++		if (ret) {
++			perf_event_free_task(child);
+ 			return ret;
++		}
+ 	}
+ 
+ 	return 0;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 13bba30..29b4604 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1221,7 +1221,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ 		goto bad_fork_cleanup_policy;
+ 	retval = audit_alloc(p);
+ 	if (retval)
+-		goto bad_fork_cleanup_policy;
++		goto bad_fork_cleanup_perf;
+ 	/* copy all the process information */
+ 	retval = copy_semundo(clone_flags, p);
+ 	if (retval)
+@@ -1406,8 +1406,9 @@ bad_fork_cleanup_semundo:
+ 	exit_sem(p);
+ bad_fork_cleanup_audit:
+ 	audit_free(p);
+-bad_fork_cleanup_policy:
++bad_fork_cleanup_perf:
+ 	perf_event_free_task(p);
++bad_fork_cleanup_policy:
+ #ifdef CONFIG_NUMA
+ 	mpol_put(p->mempolicy);
+ bad_fork_cleanup_cgroup:
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 1bb37d0..f31f190 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2460,6 +2460,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	 * shared futexes. We need to compare the keys:
+ 	 */
+ 	if (match_futex(&q.key, &key2)) {
++		queue_unlock(&q, hb);
+ 		ret = -EINVAL;
+ 		goto out_put_keys;
+ 	}
+diff --git a/kernel/time.c b/kernel/time.c
+index 73e416d..060f961 100644
+--- a/kernel/time.c
++++ b/kernel/time.c
+@@ -493,17 +493,20 @@ EXPORT_SYMBOL(usecs_to_jiffies);
+  * that a remainder subtract here would not do the right thing as the
+  * resolution values don't fall on second boundries.  I.e. the line:
+  * nsec -= nsec % TICK_NSEC; is NOT a correct resolution rounding.
++ * Note that due to the small error in the multiplier here, this
++ * rounding is incorrect for sufficiently large values of tv_nsec, but
++ * well formed timespecs should have tv_nsec < NSEC_PER_SEC, so we're
++ * OK.
+  *
+  * Rather, we just shift the bits off the right.
+  *
+  * The >> (NSEC_JIFFIE_SC - SEC_JIFFIE_SC) converts the scaled nsec
+  * value to a scaled second value.
+  */
+-unsigned long
+-timespec_to_jiffies(const struct timespec *value)
++static unsigned long
++__timespec_to_jiffies(unsigned long sec, long nsec)
+ {
+-	unsigned long sec = value->tv_sec;
+-	long nsec = value->tv_nsec + TICK_NSEC - 1;
++	nsec = nsec + TICK_NSEC - 1;
+ 
+ 	if (sec >= MAX_SEC_IN_JIFFIES){
+ 		sec = MAX_SEC_IN_JIFFIES;
+@@ -514,6 +517,13 @@ timespec_to_jiffies(const struct timespec *value)
+ 		 (NSEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
+ 
+ }
++
++unsigned long
++timespec_to_jiffies(const struct timespec *value)
++{
++	return __timespec_to_jiffies(value->tv_sec, value->tv_nsec);
++}
++
+ EXPORT_SYMBOL(timespec_to_jiffies);
+ 
+ void
+@@ -530,31 +540,27 @@ jiffies_to_timespec(const unsigned long jiffies, struct timespec *value)
+ }
+ EXPORT_SYMBOL(jiffies_to_timespec);
+ 
+-/* Same for "timeval"
++/*
++ * We could use a similar algorithm to timespec_to_jiffies (with a
++ * different multiplier for usec instead of nsec). But this has a
++ * problem with rounding: we can't exactly add TICK_NSEC - 1 to the
++ * usec value, since it's not necessarily integral.
+  *
+- * Well, almost.  The problem here is that the real system resolution is
+- * in nanoseconds and the value being converted is in micro seconds.
+- * Also for some machines (those that use HZ = 1024, in-particular),
+- * there is a LARGE error in the tick size in microseconds.
+-
+- * The solution we use is to do the rounding AFTER we convert the
+- * microsecond part.  Thus the USEC_ROUND, the bits to be shifted off.
+- * Instruction wise, this should cost only an additional add with carry
+- * instruction above the way it was done above.
++ * We could instead round in the intermediate scaled representation
++ * (i.e. in units of 1/2^(large scale) jiffies) but that's also
++ * perilous: the scaling introduces a small positive error, which
++ * combined with a division-rounding-upward (i.e. adding 2^(scale) - 1
++ * units to the intermediate before shifting) leads to accidental
++ * overflow and overestimates.
++ *
++ * At the cost of one additional multiplication by a constant, just
++ * use the timespec implementation.
+  */
+ unsigned long
+ timeval_to_jiffies(const struct timeval *value)
+ {
+-	unsigned long sec = value->tv_sec;
+-	long usec = value->tv_usec;
+-
+-	if (sec >= MAX_SEC_IN_JIFFIES){
+-		sec = MAX_SEC_IN_JIFFIES;
+-		usec = 0;
+-	}
+-	return (((u64)sec * SEC_CONVERSION) +
+-		(((u64)usec * USEC_CONVERSION + USEC_ROUND) >>
+-		 (USEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
++	return __timespec_to_jiffies(value->tv_sec,
++				     value->tv_usec * NSEC_PER_USEC);
+ }
+ EXPORT_SYMBOL(timeval_to_jiffies);
+ 
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index eb198a3..7eaf162 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -226,6 +226,12 @@ static enum hrtimer_restart alarmtimer_fired(struct hrtimer *timer)
+ 
+ }
+ 
++ktime_t alarm_expires_remaining(const struct alarm *alarm)
++{
++	struct alarm_base *base = &alarm_bases[alarm->type];
++	return ktime_sub(alarm->node.expires, base->gettime());
++}
++
+ #ifdef CONFIG_RTC_CLASS
+ /**
+  * alarmtimer_suspend - Suspend time callback
+@@ -442,18 +448,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
+ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ 							ktime_t now)
+ {
++	unsigned long flags;
+ 	struct k_itimer *ptr = container_of(alarm, struct k_itimer,
+ 						it.alarm.alarmtimer);
+-	if (posix_timer_event(ptr, 0) != 0)
+-		ptr->it_overrun++;
++	enum alarmtimer_restart result = ALARMTIMER_NORESTART;
++
++	spin_lock_irqsave(&ptr->it_lock, flags);
++	if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
++		if (posix_timer_event(ptr, 0) != 0)
++			ptr->it_overrun++;
++	}
+ 
+ 	/* Re-add periodic timers */
+ 	if (ptr->it.alarm.interval.tv64) {
+ 		ptr->it_overrun += alarm_forward(alarm, now,
+ 						ptr->it.alarm.interval);
+-		return ALARMTIMER_RESTART;
++		result = ALARMTIMER_RESTART;
+ 	}
+-	return ALARMTIMER_NORESTART;
++	spin_unlock_irqrestore(&ptr->it_lock, flags);
++
++	return result;
+ }
+ 
+ /**
+@@ -519,18 +533,22 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+  * @new_timer: k_itimer pointer
+  * @cur_setting: itimerspec data to fill
+  *
+- * Copies the itimerspec data out from the k_itimer
++ * Copies out the current itimerspec data
+  */
+ static void alarm_timer_get(struct k_itimer *timr,
+ 				struct itimerspec *cur_setting)
+ {
+-	memset(cur_setting, 0, sizeof(struct itimerspec));
++	ktime_t relative_expiry_time =
++		alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
++
++	if (ktime_to_ns(relative_expiry_time) > 0) {
++		cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
++	} else {
++		cur_setting->it_value.tv_sec = 0;
++		cur_setting->it_value.tv_nsec = 0;
++	}
+ 
+-	cur_setting->it_interval =
+-			ktime_to_timespec(timr->it.alarm.interval);
+-	cur_setting->it_value =
+-		ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
+-	return;
++	cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
+ }
+ 
+ /**
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index 4babd77..b252661 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -2847,7 +2847,7 @@ static void rb_iter_reset(struct ring_buffer_iter *iter)
+ 	iter->head = cpu_buffer->reader_page->read;
+ 
+ 	iter->cache_reader_page = iter->head_page;
+-	iter->cache_read = iter->head;
++	iter->cache_read = cpu_buffer->read;
+ 
+ 	if (iter->head)
+ 		iter->read_stamp = cpu_buffer->read_stamp;
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 09d6a9d..7d26ea5 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -141,8 +141,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
+ 
+ 	get_page(new);
+ 	pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
++
++	/* Recheck VMA as permissions can change since migration started  */
+ 	if (is_write_migration_entry(entry))
+-		pte = pte_mkwrite(pte);
++		pte = maybe_mkwrite(pte, vma);
++
+ #ifdef CONFIG_HUGETLB_PAGE
+ 	if (PageHuge(new))
+ 		pte = pte_mkhuge(pte);
+diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
+index 12a48a88..0539f6a 100644
+--- a/mm/percpu-vm.c
++++ b/mm/percpu-vm.c
+@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+ 			    int page_start, int page_end)
+ {
+ 	const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
+-	unsigned int cpu;
++	unsigned int cpu, tcpu;
+ 	int i;
+ 
+ 	for_each_possible_cpu(cpu) {
+@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+ 			struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
+ 
+ 			*pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
+-			if (!*pagep) {
+-				pcpu_free_pages(chunk, pages, populated,
+-						page_start, page_end);
+-				return -ENOMEM;
+-			}
++			if (!*pagep)
++				goto err;
+ 		}
+ 	}
+ 	return 0;
++
++err:
++	while (--i >= page_start)
++		__free_page(pages[pcpu_page_idx(cpu, i)]);
++
++	for_each_possible_cpu(tcpu) {
++		if (tcpu == cpu)
++			break;
++		for (i = page_start; i < page_end; i++)
++			__free_page(pages[pcpu_page_idx(tcpu, i)]);
++	}
++	return -ENOMEM;
+ }
+ 
+ /**
+@@ -264,6 +273,7 @@ err:
+ 		__pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
+ 				   page_end - page_start);
+ 	}
++	pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
+ 	return err;
+ }
+ 
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 5c29750..e29a1c4 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1895,6 +1895,8 @@ void __init setup_per_cpu_areas(void)
+ 
+ 	if (pcpu_setup_first_chunk(ai, fc) < 0)
+ 		panic("Failed to initialize percpu areas.");
++
++	pcpu_free_alloc_info(ai);
+ }
+ 
+ #endif	/* CONFIG_SMP */
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 1371021..83efac6 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1719,8 +1719,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct
+ 
+ 	if (new_dentry->d_inode) {
+ 		(void) shmem_unlink(new_dir, new_dentry);
+-		if (they_are_dirs)
++		if (they_are_dirs) {
++			drop_nlink(new_dentry->d_inode);
+ 			drop_nlink(old_dir);
++		}
+ 	} else if (they_are_dirs) {
+ 		drop_nlink(old_dir);
+ 		inc_nlink(new_dir);
+diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
+index 1587dc6..9898d1f 100644
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -13,8 +13,6 @@
+ #include "auth_x.h"
+ #include "auth_x_protocol.h"
+ 
+-#define TEMP_TICKET_BUF_LEN	256
+-
+ static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
+ 
+ static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
+@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret,
+ }
+ 
+ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+-			  void **p, void *end, void *obuf, size_t olen)
++			  void **p, void *end, void **obuf, size_t olen)
+ {
+ 	struct ceph_x_encrypt_header head;
+ 	size_t head_len = sizeof(head);
+@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+ 		return -EINVAL;
+ 
+ 	dout("ceph_x_decrypt len %d\n", len);
+-	ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
+-			    *p, len);
++	if (*obuf == NULL) {
++		*obuf = kmalloc(len, GFP_NOFS);
++		if (!*obuf)
++			return -ENOMEM;
++		olen = len;
++	}
++
++	ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
+ 	if (ret)
+ 		return ret;
+ 	if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
+@@ -129,139 +133,120 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
+ 	kfree(th);
+ }
+ 
+-static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+-				    struct ceph_crypto_key *secret,
+-				    void *buf, void *end)
++static int process_one_ticket(struct ceph_auth_client *ac,
++			      struct ceph_crypto_key *secret,
++			      void **p, void *end)
+ {
+ 	struct ceph_x_info *xi = ac->private;
+-	int num;
+-	void *p = buf;
++	int type;
++	u8 tkt_struct_v, blob_struct_v;
++	struct ceph_x_ticket_handler *th;
++	void *dbuf = NULL;
++	void *dp, *dend;
++	int dlen;
++	char is_enc;
++	struct timespec validity;
++	struct ceph_crypto_key old_key;
++	void *ticket_buf = NULL;
++	void *tp, *tpend;
++	struct ceph_timespec new_validity;
++	struct ceph_crypto_key new_session_key;
++	struct ceph_buffer *new_ticket_blob;
++	unsigned long new_expires, new_renew_after;
++	u64 new_secret_id;
+ 	int ret;
+-	char *dbuf;
+-	char *ticket_buf;
+-	u8 reply_struct_v;
+ 
+-	dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+-	if (!dbuf)
+-		return -ENOMEM;
++	ceph_decode_need(p, end, sizeof(u32) + 1, bad);
+ 
+-	ret = -ENOMEM;
+-	ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+-	if (!ticket_buf)
+-		goto out_dbuf;
++	type = ceph_decode_32(p);
++	dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+ 
+-	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+-	reply_struct_v = ceph_decode_8(&p);
+-	if (reply_struct_v != 1)
++	tkt_struct_v = ceph_decode_8(p);
++	if (tkt_struct_v != 1)
+ 		goto bad;
+-	num = ceph_decode_32(&p);
+-	dout("%d tickets\n", num);
+-	while (num--) {
+-		int type;
+-		u8 tkt_struct_v, blob_struct_v;
+-		struct ceph_x_ticket_handler *th;
+-		void *dp, *dend;
+-		int dlen;
+-		char is_enc;
+-		struct timespec validity;
+-		struct ceph_crypto_key old_key;
+-		void *tp, *tpend;
+-		struct ceph_timespec new_validity;
+-		struct ceph_crypto_key new_session_key;
+-		struct ceph_buffer *new_ticket_blob;
+-		unsigned long new_expires, new_renew_after;
+-		u64 new_secret_id;
+-
+-		ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
+-
+-		type = ceph_decode_32(&p);
+-		dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+-
+-		tkt_struct_v = ceph_decode_8(&p);
+-		if (tkt_struct_v != 1)
+-			goto bad;
+-
+-		th = get_ticket_handler(ac, type);
+-		if (IS_ERR(th)) {
+-			ret = PTR_ERR(th);
+-			goto out;
+-		}
+ 
+-		/* blob for me */
+-		dlen = ceph_x_decrypt(secret, &p, end, dbuf,
+-				      TEMP_TICKET_BUF_LEN);
+-		if (dlen <= 0) {
+-			ret = dlen;
+-			goto out;
+-		}
+-		dout(" decrypted %d bytes\n", dlen);
+-		dend = dbuf + dlen;
+-		dp = dbuf;
++	th = get_ticket_handler(ac, type);
++	if (IS_ERR(th)) {
++		ret = PTR_ERR(th);
++		goto out;
++	}
+ 
+-		tkt_struct_v = ceph_decode_8(&dp);
+-		if (tkt_struct_v != 1)
+-			goto bad;
++	/* blob for me */
++	dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
++	if (dlen <= 0) {
++		ret = dlen;
++		goto out;
++	}
++	dout(" decrypted %d bytes\n", dlen);
++	dp = dbuf;
++	dend = dp + dlen;
+ 
+-		memcpy(&old_key, &th->session_key, sizeof(old_key));
+-		ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+-		if (ret)
+-			goto out;
++	tkt_struct_v = ceph_decode_8(&dp);
++	if (tkt_struct_v != 1)
++		goto bad;
+ 
+-		ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+-		ceph_decode_timespec(&validity, &new_validity);
+-		new_expires = get_seconds() + validity.tv_sec;
+-		new_renew_after = new_expires - (validity.tv_sec / 4);
+-		dout(" expires=%lu renew_after=%lu\n", new_expires,
+-		     new_renew_after);
++	memcpy(&old_key, &th->session_key, sizeof(old_key));
++	ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
++	if (ret)
++		goto out;
+ 
+-		/* ticket blob for service */
+-		ceph_decode_8_safe(&p, end, is_enc, bad);
+-		tp = ticket_buf;
+-		if (is_enc) {
+-			/* encrypted */
+-			dout(" encrypted ticket\n");
+-			dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
+-					      TEMP_TICKET_BUF_LEN);
+-			if (dlen < 0) {
+-				ret = dlen;
+-				goto out;
+-			}
+-			dlen = ceph_decode_32(&tp);
+-		} else {
+-			/* unencrypted */
+-			ceph_decode_32_safe(&p, end, dlen, bad);
+-			ceph_decode_need(&p, end, dlen, bad);
+-			ceph_decode_copy(&p, ticket_buf, dlen);
++	ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
++	ceph_decode_timespec(&validity, &new_validity);
++	new_expires = get_seconds() + validity.tv_sec;
++	new_renew_after = new_expires - (validity.tv_sec / 4);
++	dout(" expires=%lu renew_after=%lu\n", new_expires,
++	     new_renew_after);
++
++	/* ticket blob for service */
++	ceph_decode_8_safe(p, end, is_enc, bad);
++	if (is_enc) {
++		/* encrypted */
++		dout(" encrypted ticket\n");
++		dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
++		if (dlen < 0) {
++			ret = dlen;
++			goto out;
+ 		}
+-		tpend = tp + dlen;
+-		dout(" ticket blob is %d bytes\n", dlen);
+-		ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+-		blob_struct_v = ceph_decode_8(&tp);
+-		new_secret_id = ceph_decode_64(&tp);
+-		ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+-		if (ret)
++		tp = ticket_buf;
++		dlen = ceph_decode_32(&tp);
++	} else {
++		/* unencrypted */
++		ceph_decode_32_safe(p, end, dlen, bad);
++		ticket_buf = kmalloc(dlen, GFP_NOFS);
++		if (!ticket_buf) {
++			ret = -ENOMEM;
+ 			goto out;
+-
+-		/* all is well, update our ticket */
+-		ceph_crypto_key_destroy(&th->session_key);
+-		if (th->ticket_blob)
+-			ceph_buffer_put(th->ticket_blob);
+-		th->session_key = new_session_key;
+-		th->ticket_blob = new_ticket_blob;
+-		th->validity = new_validity;
+-		th->secret_id = new_secret_id;
+-		th->expires = new_expires;
+-		th->renew_after = new_renew_after;
+-		dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+-		     type, ceph_entity_type_name(type), th->secret_id,
+-		     (int)th->ticket_blob->vec.iov_len);
+-		xi->have_keys |= th->service;
++		}
++		tp = ticket_buf;
++		ceph_decode_need(p, end, dlen, bad);
++		ceph_decode_copy(p, ticket_buf, dlen);
+ 	}
++	tpend = tp + dlen;
++	dout(" ticket blob is %d bytes\n", dlen);
++	ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
++	blob_struct_v = ceph_decode_8(&tp);
++	new_secret_id = ceph_decode_64(&tp);
++	ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
++	if (ret)
++		goto out;
++
++	/* all is well, update our ticket */
++	ceph_crypto_key_destroy(&th->session_key);
++	if (th->ticket_blob)
++		ceph_buffer_put(th->ticket_blob);
++	th->session_key = new_session_key;
++	th->ticket_blob = new_ticket_blob;
++	th->validity = new_validity;
++	th->secret_id = new_secret_id;
++	th->expires = new_expires;
++	th->renew_after = new_renew_after;
++	dout(" got ticket service %d (%s) secret_id %lld len %d\n",
++	     type, ceph_entity_type_name(type), th->secret_id,
++	     (int)th->ticket_blob->vec.iov_len);
++	xi->have_keys |= th->service;
+ 
+-	ret = 0;
+ out:
+ 	kfree(ticket_buf);
+-out_dbuf:
+ 	kfree(dbuf);
+ 	return ret;
+ 
+@@ -270,6 +255,34 @@ bad:
+ 	goto out;
+ }
+ 
++static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
++				    struct ceph_crypto_key *secret,
++				    void *buf, void *end)
++{
++	void *p = buf;
++	u8 reply_struct_v;
++	u32 num;
++	int ret;
++
++	ceph_decode_8_safe(&p, end, reply_struct_v, bad);
++	if (reply_struct_v != 1)
++		return -EINVAL;
++
++	ceph_decode_32_safe(&p, end, num, bad);
++	dout("%d tickets\n", num);
++
++	while (num--) {
++		ret = process_one_ticket(ac, secret, &p, end);
++		if (ret)
++			return ret;
++	}
++
++	return 0;
++
++bad:
++	return -EINVAL;
++}
++
+ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+ 				   struct ceph_x_ticket_handler *th,
+ 				   struct ceph_x_authorizer *au)
+@@ -563,13 +576,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+ 	struct ceph_x_ticket_handler *th;
+ 	int ret = 0;
+ 	struct ceph_x_authorize_reply reply;
++	void *preply = &reply;
+ 	void *p = au->reply_buf;
+ 	void *end = p + sizeof(au->reply_buf);
+ 
+ 	th = get_ticket_handler(ac, au->service);
+ 	if (IS_ERR(th))
+ 		return PTR_ERR(th);
+-	ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
++	ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
+ 	if (ret < 0)
+ 		return ret;
+ 	if (ret != sizeof(reply))
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 20ba2d5..7a239f0 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2423,7 +2423,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags,
+ 	m->footer.middle_crc = 0;
+ 	m->footer.data_crc = 0;
+ 	m->footer.flags = 0;
+-	m->front_max = front_len;
++	m->front_alloc_len = front_len;
+ 	m->front_is_vmalloc = false;
+ 	m->more_to_follow = false;
+ 	m->ack_stamp = 0;
+@@ -2594,8 +2594,8 @@ EXPORT_SYMBOL(ceph_msg_last_put);
+ 
+ void ceph_msg_dump(struct ceph_msg *msg)
+ {
+-	pr_debug("msg_dump %p (front_max %d nr_pages %d)\n", msg,
+-		 msg->front_max, msg->nr_pages);
++	pr_debug("msg_dump %p (front_alloc_len %d nr_pages %d)\n", msg,
++		 msg->front_alloc_len, msg->nr_pages);
+ 	print_hex_dump(KERN_DEBUG, "header: ",
+ 		       DUMP_PREFIX_OFFSET, 16, 1,
+ 		       &msg->hdr, sizeof(msg->hdr), true);
+diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
+index 0b62dea..0c0859b 100644
+--- a/net/ceph/mon_client.c
++++ b/net/ceph/mon_client.c
+@@ -150,7 +150,7 @@ static int __open_session(struct ceph_mon_client *monc)
+ 		/* initiatiate authentication handshake */
+ 		ret = ceph_auth_build_hello(monc->auth,
+ 					    monc->m_auth->front.iov_base,
+-					    monc->m_auth->front_max);
++					    monc->m_auth->front_alloc_len);
+ 		__send_prepared_auth_request(monc, ret);
+ 	} else {
+ 		dout("open_session mon%d already open\n", monc->cur_mon);
+@@ -194,7 +194,7 @@ static void __send_subscribe(struct ceph_mon_client *monc)
+ 		int num;
+ 
+ 		p = msg->front.iov_base;
+-		end = p + msg->front_max;
++		end = p + msg->front_alloc_len;
+ 
+ 		num = 1 + !!monc->want_next_osdmap + !!monc->want_mdsmap;
+ 		ceph_encode_32(&p, num);
+@@ -860,7 +860,7 @@ static void handle_auth_reply(struct ceph_mon_client *monc,
+ 	ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base,
+ 				     msg->front.iov_len,
+ 				     monc->m_auth->front.iov_base,
+-				     monc->m_auth->front_max);
++				     monc->m_auth->front_alloc_len);
+ 	if (ret < 0) {
+ 		monc->client->auth_err = ret;
+ 		wake_up_all(&monc->client->auth_wq);
+@@ -887,7 +887,7 @@ static int __validate_auth(struct ceph_mon_client *monc)
+ 		return 0;
+ 
+ 	ret = ceph_build_auth(monc->auth, monc->m_auth->front.iov_base,
+-			      monc->m_auth->front_max);
++			      monc->m_auth->front_alloc_len);
+ 	if (ret <= 0)
+ 		return ret; /* either an error, or no need to authenticate */
+ 	__send_prepared_auth_request(monc, ret);
+@@ -987,7 +987,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
+ 	if (!m) {
+ 		pr_info("alloc_msg unknown type %d\n", type);
+ 		*skip = 1;
++	} else if (front_len > m->front_alloc_len) {
++		pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
++			   front_len, m->front_alloc_len,
++			   (unsigned int)con->peer_name.type,
++			   le64_to_cpu(con->peer_name.num));
++		ceph_msg_put(m);
++		m = ceph_msg_new(type, front_len, GFP_NOFS, false);
+ 	}
++
+ 	return m;
+ }
+ 
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index d361dc0..8e79a9e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -151,6 +151,9 @@ static void		 ipv4_link_failure(struct sk_buff *skb);
+ static void		 ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
+ static int rt_garbage_collect(struct dst_ops *ops);
+ 
++static void __rt_garbage_collect(struct work_struct *w);
++static DECLARE_WORK(rt_gc_worker, __rt_garbage_collect);
++
+ static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+ 			    int how)
+ {
+@@ -979,12 +982,13 @@ static void rt_emergency_hash_rebuild(struct net *net)
+    and when load increases it reduces to limit cache size.
+  */
+ 
+-static int rt_garbage_collect(struct dst_ops *ops)
++static void __do_rt_garbage_collect(int elasticity, int min_interval)
+ {
+ 	static unsigned long expire = RT_GC_TIMEOUT;
+ 	static unsigned long last_gc;
+ 	static int rover;
+ 	static int equilibrium;
++	static DEFINE_SPINLOCK(rt_gc_lock);
+ 	struct rtable *rth;
+ 	struct rtable __rcu **rthp;
+ 	unsigned long now = jiffies;
+@@ -996,9 +1000,11 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ 	 * do not make it too frequently.
+ 	 */
+ 
++	spin_lock_bh(&rt_gc_lock);
++
+ 	RT_CACHE_STAT_INC(gc_total);
+ 
+-	if (now - last_gc < ip_rt_gc_min_interval &&
++	if (now - last_gc < min_interval &&
+ 	    entries < ip_rt_max_size) {
+ 		RT_CACHE_STAT_INC(gc_ignored);
+ 		goto out;
+@@ -1006,7 +1012,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ 
+ 	entries = dst_entries_get_slow(&ipv4_dst_ops);
+ 	/* Calculate number of entries, which we want to expire now. */
+-	goal = entries - (ip_rt_gc_elasticity << rt_hash_log);
++	goal = entries - (elasticity << rt_hash_log);
+ 	if (goal <= 0) {
+ 		if (equilibrium < ipv4_dst_ops.gc_thresh)
+ 			equilibrium = ipv4_dst_ops.gc_thresh;
+@@ -1023,7 +1029,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ 		equilibrium = entries - goal;
+ 	}
+ 
+-	if (now - last_gc >= ip_rt_gc_min_interval)
++	if (now - last_gc >= min_interval)
+ 		last_gc = now;
+ 
+ 	if (goal <= 0) {
+@@ -1088,15 +1094,34 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ 	if (net_ratelimit())
+ 		printk(KERN_WARNING "dst cache overflow\n");
+ 	RT_CACHE_STAT_INC(gc_dst_overflow);
+-	return 1;
++	goto out;
+ 
+ work_done:
+-	expire += ip_rt_gc_min_interval;
++	expire += min_interval;
+ 	if (expire > ip_rt_gc_timeout ||
+ 	    dst_entries_get_fast(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh ||
+ 	    dst_entries_get_slow(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh)
+ 		expire = ip_rt_gc_timeout;
+-out:	return 0;
++out:
++	spin_unlock_bh(&rt_gc_lock);
++}
++
++static void __rt_garbage_collect(struct work_struct *w)
++{
++	__do_rt_garbage_collect(ip_rt_gc_elasticity, ip_rt_gc_min_interval);
++}
++
++static int rt_garbage_collect(struct dst_ops *ops)
++{
++	if (!work_pending(&rt_gc_worker))
++		schedule_work(&rt_gc_worker);
++
++	if (dst_entries_get_fast(&ipv4_dst_ops) >= ip_rt_max_size ||
++	    dst_entries_get_slow(&ipv4_dst_ops) >= ip_rt_max_size) {
++		RT_CACHE_STAT_INC(gc_dst_overflow);
++		return 1;
++	}
++	return 0;
+ }
+ 
+ /*
+@@ -1153,7 +1178,7 @@ static struct rtable *rt_intern_hash(unsigned hash, struct rtable *rt,
+ 	unsigned long	now;
+ 	u32 		min_score;
+ 	int		chain_length;
+-	int attempts = !in_softirq();
++	int attempts = 1;
+ 
+ restart:
+ 	chain_length = 0;
+@@ -1290,14 +1315,15 @@ restart:
+ 			   can be released. Try to shrink route cache,
+ 			   it is most likely it holds some neighbour records.
+ 			 */
+-			if (attempts-- > 0) {
+-				int saved_elasticity = ip_rt_gc_elasticity;
+-				int saved_int = ip_rt_gc_min_interval;
+-				ip_rt_gc_elasticity	= 1;
+-				ip_rt_gc_min_interval	= 0;
+-				rt_garbage_collect(&ipv4_dst_ops);
+-				ip_rt_gc_min_interval	= saved_int;
+-				ip_rt_gc_elasticity	= saved_elasticity;
++			if (!in_softirq() && attempts-- > 0) {
++				static DEFINE_SPINLOCK(lock);
++
++				if (spin_trylock(&lock)) {
++					__do_rt_garbage_collect(1, 0);
++					spin_unlock(&lock);
++				} else {
++					spin_unlock_wait(&lock);
++				}
+ 				goto restart;
+ 			}
+ 
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index b9edff0..3afdd78 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2443,8 +2443,18 @@ static void init_loopback(struct net_device *dev)
+ 			if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+ 				continue;
+ 
+-			if (sp_ifa->rt)
+-				continue;
++			if (sp_ifa->rt) {
++				/* This dst has been added to garbage list when
++				 * lo device down, release this obsolete dst and
++				 * reallocate a new router for ifa.
++				 */
++				if (sp_ifa->rt->dst.obsolete > 0) {
++					dst_release(&sp_ifa->rt->dst);
++					sp_ifa->rt = NULL;
++				} else {
++					continue;
++				}
++			}
+ 
+ 			sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+ 
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index f8bec1e..d131a95 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1362,7 +1362,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
+ 	fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+ 	fptr->nexthdr = nexthdr;
+ 	fptr->reserved = 0;
+-	ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
++	fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+ 
+ 	/* Fragment the skb. ipv6 header and the remaining fields of the
+ 	 * fragment header are updated in ipv6_gso_segment()
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 437fb59..767bf4a 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -774,7 +774,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	/* If PMTU discovery was enabled, use the MTU that was discovered */
+ 	dst = sk_dst_get(tunnel->sock);
+ 	if (dst != NULL) {
+-		u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
++		u32 pmtu = dst_mtu(dst);
++
+ 		if (pmtu != 0)
+ 			session->mtu = session->mru = pmtu -
+ 				PPPOL2TP_HEADER_OVERHEAD;
+diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
+index 29fa5ba..6422845 100644
+--- a/net/netfilter/ipvs/ip_vs_conn.c
++++ b/net/netfilter/ipvs/ip_vs_conn.c
+@@ -777,7 +777,6 @@ static void ip_vs_conn_expire(unsigned long data)
+ 			ip_vs_control_del(cp);
+ 
+ 		if (cp->flags & IP_VS_CONN_F_NFCT) {
+-			ip_vs_conn_drop_conntrack(cp);
+ 			/* Do not access conntracks during subsys cleanup
+ 			 * because nf_conntrack_find_get can not be used after
+ 			 * conntrack cleanup for the net.
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index da54d29..5b2d8e6 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1638,6 +1638,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack(
+ 	 * ack chunk whose serial number matches that of the request.
+ 	 */
+ 	list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) {
++		if (sctp_chunk_pending(ack))
++			continue;
+ 		if (ack->subh.addip_hdr->serial == serial) {
+ 			sctp_chunk_hold(ack);
+ 			return ack;
+diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
+index 397296f..32421ae 100644
+--- a/net/sctp/inqueue.c
++++ b/net/sctp/inqueue.c
+@@ -152,18 +152,9 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
+ 		} else {
+ 			/* Nothing to do. Next chunk in the packet, please. */
+ 			ch = (sctp_chunkhdr_t *) chunk->chunk_end;
+-
+ 			/* Force chunk->skb->data to chunk->chunk_end.  */
+-			skb_pull(chunk->skb,
+-				 chunk->chunk_end - chunk->skb->data);
+-
+-			/* Verify that we have at least chunk headers
+-			 * worth of buffer left.
+-			 */
+-			if (skb_headlen(chunk->skb) < sizeof(sctp_chunkhdr_t)) {
+-				sctp_chunk_free(chunk);
+-				chunk = queue->in_progress = NULL;
+-			}
++			skb_pull(chunk->skb, chunk->chunk_end - chunk->skb->data);
++			/* We are guaranteed to pull a SCTP header. */
+ 		}
+ 	}
+ 
+@@ -199,24 +190,14 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
+ 	skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
+ 	chunk->subh.v = NULL; /* Subheader is no longer valid.  */
+ 
+-	if (chunk->chunk_end < skb_tail_pointer(chunk->skb)) {
++	if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) <
++	    skb_tail_pointer(chunk->skb)) {
+ 		/* This is not a singleton */
+ 		chunk->singleton = 0;
+ 	} else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) {
+-		/* RFC 2960, Section 6.10  Bundling
+-		 *
+-		 * Partial chunks MUST NOT be placed in an SCTP packet.
+-		 * If the receiver detects a partial chunk, it MUST drop
+-		 * the chunk.
+-		 *
+-		 * Since the end of the chunk is past the end of our buffer
+-		 * (which contains the whole packet, we can freely discard
+-		 * the whole packet.
+-		 */
+-		sctp_chunk_free(chunk);
+-		chunk = queue->in_progress = NULL;
+-
+-		return NULL;
++		/* Discard inside state machine. */
++		chunk->pdiscard = 1;
++		chunk->chunk_end = skb_tail_pointer(chunk->skb);
+ 	} else {
+ 		/* We are at the end of the packet, so mark the chunk
+ 		 * in case we need to send a SACK.
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index c95a3f2..d8d4704 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -3068,50 +3068,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
+ 	return SCTP_ERROR_NO_ERROR;
+ }
+ 
+-/* Verify the ASCONF packet before we process it.  */
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+-		       struct sctp_paramhdr *param_hdr, void *chunk_end,
+-		       struct sctp_paramhdr **errp) {
+-	sctp_addip_param_t *asconf_param;
++/* Verify the ASCONF packet before we process it. */
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++			struct sctp_chunk *chunk, bool addr_param_needed,
++			struct sctp_paramhdr **errp)
++{
++	sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr;
+ 	union sctp_params param;
+-	int length, plen;
+-
+-	param.v = (sctp_paramhdr_t *) param_hdr;
+-	while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) {
+-		length = ntohs(param.p->length);
+-		*errp = param.p;
++	bool addr_param_seen = false;
+ 
+-		if (param.v > chunk_end - length ||
+-		    length < sizeof(sctp_paramhdr_t))
+-			return 0;
++	sctp_walk_params(param, addip, addip_hdr.params) {
++		size_t length = ntohs(param.p->length);
+ 
++		*errp = param.p;
+ 		switch (param.p->type) {
++		case SCTP_PARAM_ERR_CAUSE:
++			break;
++		case SCTP_PARAM_IPV4_ADDRESS:
++			if (length != sizeof(sctp_ipv4addr_param_t))
++				return false;
++			addr_param_seen = true;
++			break;
++		case SCTP_PARAM_IPV6_ADDRESS:
++			if (length != sizeof(sctp_ipv6addr_param_t))
++				return false;
++			addr_param_seen = true;
++			break;
+ 		case SCTP_PARAM_ADD_IP:
+ 		case SCTP_PARAM_DEL_IP:
+ 		case SCTP_PARAM_SET_PRIMARY:
+-			asconf_param = (sctp_addip_param_t *)param.v;
+-			plen = ntohs(asconf_param->param_hdr.length);
+-			if (plen < sizeof(sctp_addip_param_t) +
+-			    sizeof(sctp_paramhdr_t))
+-				return 0;
++			/* In ASCONF chunks, these need to be first. */
++			if (addr_param_needed && !addr_param_seen)
++				return false;
++			length = ntohs(param.addip->param_hdr.length);
++			if (length < sizeof(sctp_addip_param_t) +
++				     sizeof(sctp_paramhdr_t))
++				return false;
+ 			break;
+ 		case SCTP_PARAM_SUCCESS_REPORT:
+ 		case SCTP_PARAM_ADAPTATION_LAYER_IND:
+ 			if (length != sizeof(sctp_addip_param_t))
+-				return 0;
+-
++				return false;
+ 			break;
+ 		default:
+-			break;
++			/* This is unkown to us, reject! */
++			return false;
+ 		}
+-
+-		param.v += WORD_ROUND(length);
+ 	}
+ 
+-	if (param.v != chunk_end)
+-		return 0;
++	/* Remaining sanity checks. */
++	if (addr_param_needed && !addr_param_seen)
++		return false;
++	if (!addr_param_needed && addr_param_seen)
++		return false;
++	if (param.v != chunk->chunk_end)
++		return false;
+ 
+-	return 1;
++	return true;
+ }
+ 
+ /* Process an incoming ASCONF chunk with the next expected serial no. and
+@@ -3120,16 +3133,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc,
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 				       struct sctp_chunk *asconf)
+ {
++	sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr;
++	bool all_param_pass = true;
++	union sctp_params param;
+ 	sctp_addiphdr_t		*hdr;
+ 	union sctp_addr_param	*addr_param;
+ 	sctp_addip_param_t	*asconf_param;
+ 	struct sctp_chunk	*asconf_ack;
+-
+ 	__be16	err_code;
+ 	int	length = 0;
+ 	int	chunk_len;
+ 	__u32	serial;
+-	int	all_param_pass = 1;
+ 
+ 	chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
+ 	hdr = (sctp_addiphdr_t *)asconf->skb->data;
+@@ -3157,9 +3171,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 		goto done;
+ 
+ 	/* Process the TLVs contained within the ASCONF chunk. */
+-	while (chunk_len > 0) {
++	sctp_walk_params(param, addip, addip_hdr.params) {
++		/* Skip preceeding address parameters. */
++		if (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
++		    param.p->type == SCTP_PARAM_IPV6_ADDRESS)
++			continue;
++
+ 		err_code = sctp_process_asconf_param(asoc, asconf,
+-						     asconf_param);
++						     param.addip);
+ 		/* ADDIP 4.1 A7)
+ 		 * If an error response is received for a TLV parameter,
+ 		 * all TLVs with no response before the failed TLV are
+@@ -3167,28 +3186,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ 		 * the failed response are considered unsuccessful unless
+ 		 * a specific success indication is present for the parameter.
+ 		 */
+-		if (SCTP_ERROR_NO_ERROR != err_code)
+-			all_param_pass = 0;
+-
++		if (err_code != SCTP_ERROR_NO_ERROR)
++			all_param_pass = false;
+ 		if (!all_param_pass)
+-			sctp_add_asconf_response(asconf_ack,
+-						 asconf_param->crr_id, err_code,
+-						 asconf_param);
++			sctp_add_asconf_response(asconf_ack, param.addip->crr_id,
++						 err_code, param.addip);
+ 
+ 		/* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add
+ 		 * an IP address sends an 'Out of Resource' in its response, it
+ 		 * MUST also fail any subsequent add or delete requests bundled
+ 		 * in the ASCONF.
+ 		 */
+-		if (SCTP_ERROR_RSRC_LOW == err_code)
++		if (err_code == SCTP_ERROR_RSRC_LOW)
+ 			goto done;
+-
+-		/* Move to the next ASCONF param. */
+-		length = ntohs(asconf_param->param_hdr.length);
+-		asconf_param = (void *)asconf_param + length;
+-		chunk_len -= length;
+ 	}
+-
+ done:
+ 	asoc->peer.addip_serial++;
+ 
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 5ac33b6..d02dd3c 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -163,6 +163,9 @@ sctp_chunk_length_valid(struct sctp_chunk *chunk,
+ {
+ 	__u16 chunk_length = ntohs(chunk->chunk_hdr->length);
+ 
++	/* Previously already marked? */
++	if (unlikely(chunk->pdiscard))
++		return 0;
+ 	if (unlikely(chunk_length < required_length))
+ 		return 0;
+ 
+@@ -3516,9 +3519,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+ 	struct sctp_chunk	*asconf_ack = NULL;
+ 	struct sctp_paramhdr	*err_param = NULL;
+ 	sctp_addiphdr_t		*hdr;
+-	union sctp_addr_param	*addr_param;
+ 	__u32			serial;
+-	int			length;
+ 
+ 	if (!sctp_vtag_verify(chunk, asoc)) {
+ 		sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
+@@ -3543,17 +3544,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+ 	hdr = (sctp_addiphdr_t *)chunk->skb->data;
+ 	serial = ntohl(hdr->serial);
+ 
+-	addr_param = (union sctp_addr_param *)hdr->params;
+-	length = ntohs(addr_param->p.length);
+-	if (length < sizeof(sctp_paramhdr_t))
+-		return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+-			   (void *)addr_param, commands);
+-
+ 	/* Verify the ASCONF chunk before processing it. */
+-	if (!sctp_verify_asconf(asoc,
+-			    (sctp_paramhdr_t *)((void *)addr_param + length),
+-			    (void *)chunk->chunk_end,
+-			    &err_param))
++	if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
+ 		return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ 						  (void *)err_param, commands);
+ 
+@@ -3670,10 +3662,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
+ 	rcvd_serial = ntohl(addip_hdr->serial);
+ 
+ 	/* Verify the ASCONF-ACK chunk before processing it. */
+-	if (!sctp_verify_asconf(asoc,
+-	    (sctp_paramhdr_t *)addip_hdr->params,
+-	    (void *)asconf_ack->chunk_end,
+-	    &err_param))
++	if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
+ 		return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ 			   (void *)err_param, commands);
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 6d4d263..cdf77a2 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4804,6 +4804,9 @@ int cfg80211_testmode_reply(struct sk_buff *skb)
+ 	void *hdr = ((void **)skb->cb)[1];
+ 	struct nlattr *data = ((void **)skb->cb)[2];
+ 
++	/* clear CB data for netlink core to own from now on */
++	memset(skb->cb, 0, sizeof(skb->cb));
++
+ 	if (WARN_ON(!rdev->testmode_info)) {
+ 		kfree_skb(skb);
+ 		return -EINVAL;
+@@ -4830,6 +4833,9 @@ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ 	void *hdr = ((void **)skb->cb)[1];
+ 	struct nlattr *data = ((void **)skb->cb)[2];
+ 
++	/* clear CB data for netlink core to own from now on */
++	memset(skb->cb, 0, sizeof(skb->cb));
++
+ 	nla_nest_end(skb, data);
+ 	genlmsg_end(skb, hdr);
+ 	genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index cf0d46e..7f00d34 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1692,14 +1692,16 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream,
+ {
+ 	struct snd_pcm_hw_params *params = arg;
+ 	snd_pcm_format_t format;
+-	int channels, width;
++	int channels;
++	ssize_t frame_size;
+ 
+ 	params->fifo_size = substream->runtime->hw.fifo_size;
+ 	if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_FIFO_IN_FRAMES)) {
+ 		format = params_format(params);
+ 		channels = params_channels(params);
+-		width = snd_pcm_format_physical_width(format);
+-		params->fifo_size /= width * channels;
++		frame_size = snd_pcm_format_size(format, channels);
++		if (frame_size > 0)
++			params->fifo_size /= (unsigned)frame_size;
+ 	}
+ 	return 0;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 491cdf0..d10a6ef 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -789,6 +789,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
+ 		case 0x10ec0885:
+ 		case 0x10ec0887:
+ 		/*case 0x10ec0889:*/ /* this causes an SPDIF problem */
++		case 0x10ec0900:
+ 			alc889_coef_init(codec);
+ 			break;
+ 		case 0x10ec0888:
+@@ -4343,6 +4344,7 @@ static int patch_alc882(struct hda_codec *codec)
+ 	switch (codec->vendor_id) {
+ 	case 0x10ec0882:
+ 	case 0x10ec0885:
++	case 0x10ec0900:
+ 		break;
+ 	default:
+ 		/* ALC883 and variants */
diff --git a/3.2.63/4420_grsecurity-3.0-3.2.63-201411020808.patch b/3.2.64/4420_grsecurity-3.0-3.2.64-201411062032.patch
index ab7ff79..7cb2c8e 100644
--- a/3.2.63/4420_grsecurity-3.0-3.2.63-201411020808.patch
+++ b/3.2.64/4420_grsecurity-3.0-3.2.64-201411062032.patch
@@ -278,7 +278,7 @@ index 88fd7f5..b318a78 100644
  ==============================================================
  
 diff --git a/Makefile b/Makefile
-index 6d3f2d4..8bd5807 100644
+index 2b58ffc..895bdb8 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -14092,7 +14092,7 @@ index 5478825..839e88c 100644
  #define flush_insn_slot(p)	do { } while (0)
  
 diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index b3eb9a7..7c34d91 100644
+index 15d24cb..ee4dcd1 100644
 --- a/arch/x86/include/asm/kvm_host.h
 +++ b/arch/x86/include/asm/kvm_host.h
 @@ -459,7 +459,7 @@ struct kvm_arch {
@@ -23595,7 +23595,7 @@ index 16204dc..0e7d4b7 100644
  	.smp_prepare_cpus	= native_smp_prepare_cpus,
  	.smp_cpus_done		= native_smp_cpus_done,
 diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
-index 6e68bd9..facb68a 100644
+index bb28f2ca..e377b54 100644
 --- a/arch/x86/kernel/smpboot.c
 +++ b/arch/x86/kernel/smpboot.c
 @@ -252,11 +252,13 @@ notrace static void __cpuinit start_secondary(void *unused)
@@ -24907,7 +24907,7 @@ index 7110911..069da9c 100644
  		/*
  		 * Encountered an error while doing the restore from the
 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
-index 638cab5..0a38f1e 100644
+index f0ac042..f6e5b65 100644
 --- a/arch/x86/kvm/emulate.c
 +++ b/arch/x86/kvm/emulate.c
 @@ -249,6 +249,7 @@ struct gprefix {
@@ -25003,7 +25003,7 @@ index 9299410..ade2f9b 100644
  	spin_unlock(&vcpu->kvm->mmu_lock);
  
 diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
-index 2102a17..16e1531 100644
+index 82f97a5..159a0df 100644
 --- a/arch/x86/kvm/svm.c
 +++ b/arch/x86/kvm/svm.c
 @@ -3403,7 +3403,11 @@ static void reload_tss(struct kvm_vcpu *vcpu)
@@ -25030,10 +25030,10 @@ index 2102a17..16e1531 100644
  
  	local_irq_disable();
 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index a4f6bda..40eb721 100644
+index 578b1c6..5a7039c 100644
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
-@@ -1099,12 +1099,12 @@ static void vmcs_write64(unsigned long field, u64 value)
+@@ -1100,12 +1100,12 @@ static void vmcs_write64(unsigned long field, u64 value)
  #endif
  }
  
@@ -25048,7 +25048,7 @@ index a4f6bda..40eb721 100644
  {
  	vmcs_writel(field, vmcs_readl(field) | mask);
  }
-@@ -1305,7 +1305,11 @@ static void reload_tss(void)
+@@ -1306,7 +1306,11 @@ static void reload_tss(void)
  	struct desc_struct *descs;
  
  	descs = (void *)gdt->address;
@@ -25060,7 +25060,7 @@ index a4f6bda..40eb721 100644
  	load_TR_desc();
  }
  
-@@ -1504,6 +1508,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+@@ -1505,6 +1509,10 @@ static void vmx_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
  		vmcs_writel(HOST_TR_BASE, kvm_read_tr_base()); /* 22.2.4 */
  		vmcs_writel(HOST_GDTR_BASE, gdt->address);   /* 22.2.4 */
  
@@ -25071,7 +25071,7 @@ index a4f6bda..40eb721 100644
  		rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
  		vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
  		vmx->loaded_vmcs->cpu = cpu;
-@@ -2634,8 +2642,11 @@ static __init int hardware_setup(void)
+@@ -2635,8 +2643,11 @@ static __init int hardware_setup(void)
  	if (!cpu_has_vmx_flexpriority())
  		flexpriority_enabled = 0;
  
@@ -25085,18 +25085,18 @@ index a4f6bda..40eb721 100644
  
  	if (enable_ept && !cpu_has_vmx_ept_2m_page())
  		kvm_disable_largepages();
-@@ -3637,7 +3648,10 @@ static void vmx_set_constant_host_state(void)
+@@ -3638,7 +3649,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ 	unsigned long cr4;
  
  	vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS);  /* 22.2.3 */
- 	vmcs_writel(HOST_CR4, read_cr4());  /* 22.2.3, 22.2.5 */
 +
 +#ifndef CONFIG_PAX_PER_CPU_PGD
  	vmcs_writel(HOST_CR3, read_cr3());  /* 22.2.3  FIXME: shadow tables */
 +#endif
  
- 	vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS);  /* 22.2.4 */
- 	vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS);  /* 22.2.4 */
-@@ -3649,7 +3663,7 @@ static void vmx_set_constant_host_state(void)
+ 	/* Save the most likely value for this task's CR4 in the VMCS. */
+ 	cr4 = read_cr4();
+@@ -3655,7 +3669,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
  	vmcs_writel(HOST_IDTR_BASE, dt.address);   /* 22.2.4 */
  
  	asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
@@ -25105,7 +25105,7 @@ index a4f6bda..40eb721 100644
  
  	rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
  	vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6178,6 +6192,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6206,6 +6220,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		"jmp .Lkvm_vmx_return \n\t"
  		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
  		".Lkvm_vmx_return: "
@@ -25118,7 +25118,7 @@ index a4f6bda..40eb721 100644
  		/* Save guest registers, load host registers, keep flags */
  		"mov %0, %c[wordsize](%%"R"sp) \n\t"
  		"pop %0 \n\t"
-@@ -6226,6 +6246,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6254,6 +6274,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  #endif
  		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
  		[wordsize]"i"(sizeof(ulong))
@@ -25130,7 +25130,7 @@ index a4f6bda..40eb721 100644
  	      : "cc", "memory"
  		, R"ax", R"bx", R"di", R"si"
  #ifdef CONFIG_X86_64
-@@ -6254,7 +6279,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6282,7 +6307,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
  		}
  	}
  
@@ -25149,10 +25149,10 @@ index a4f6bda..40eb721 100644
  
  	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index b9fefaf..32b0407 100644
+index 2d7d0df..4476198 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
-@@ -1344,8 +1344,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
+@@ -1369,8 +1369,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
  {
  	struct kvm *kvm = vcpu->kvm;
  	int lm = is_long_mode(vcpu);
@@ -25163,7 +25163,7 @@ index b9fefaf..32b0407 100644
  	u8 blob_size = lm ? kvm->arch.xen_hvm_config.blob_size_64
  		: kvm->arch.xen_hvm_config.blob_size_32;
  	u32 page_num = data & ~PAGE_MASK;
-@@ -2162,6 +2162,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
+@@ -2187,6 +2187,8 @@ long kvm_arch_dev_ioctl(struct file *filp,
  		if (n < msr_list.nmsrs)
  			goto out;
  		r = -EFAULT;
@@ -25172,7 +25172,7 @@ index b9fefaf..32b0407 100644
  		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
  				 num_msrs_to_save * sizeof(u32)))
  			goto out;
-@@ -2337,15 +2339,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2362,15 +2364,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(struct kvm_vcpu *vcpu,
  				     struct kvm_cpuid2 *cpuid,
  				     struct kvm_cpuid_entry2 __user *entries)
  {
@@ -25196,7 +25196,7 @@ index b9fefaf..32b0407 100644
  	vcpu->arch.cpuid_nent = cpuid->nent;
  	kvm_apic_set_version(vcpu);
  	kvm_x86_ops->cpuid_update(vcpu);
-@@ -2360,15 +2367,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
+@@ -2385,15 +2392,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(struct kvm_vcpu *vcpu,
  				     struct kvm_cpuid2 *cpuid,
  				     struct kvm_cpuid_entry2 __user *entries)
  {
@@ -25219,7 +25219,7 @@ index b9fefaf..32b0407 100644
  	return 0;
  
  out:
-@@ -2743,7 +2754,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
+@@ -2768,7 +2779,7 @@ static int kvm_vcpu_ioctl_set_lapic(struct kvm_vcpu *vcpu,
  static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
  				    struct kvm_interrupt *irq)
  {
@@ -25228,7 +25228,7 @@ index b9fefaf..32b0407 100644
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -5184,7 +5195,7 @@ static void kvm_set_mmio_spte_mask(void)
+@@ -5209,7 +5220,7 @@ static void kvm_set_mmio_spte_mask(void)
  	kvm_mmu_set_mmio_spte_mask(mask);
  }
  
@@ -32597,10 +32597,10 @@ index 7b72502..3d7b647 100644
  			err = -EFAULT;
  			goto out;
 diff --git a/block/genhd.c b/block/genhd.c
-index 8bd4ef2..078f68b9 100644
+index 41b0435..09f9f28 100644
 --- a/block/genhd.c
 +++ b/block/genhd.c
-@@ -474,21 +474,24 @@ static char *bdevt_str(dev_t devt, char *buf)
+@@ -472,21 +472,24 @@ static char *bdevt_str(dev_t devt, char *buf)
  
  /*
   * Register device numbers dev..(dev+range-1)
@@ -32978,7 +32978,7 @@ index ac28db3..0848b37 100644
  	/*
  	 * Buggy BIOS check
 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
-index de0791c..d6d4ea3 100644
+index 388ba10..d509dbb 100644
 --- a/drivers/acpi/processor_idle.c
 +++ b/drivers/acpi/processor_idle.c
 @@ -1036,7 +1036,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
@@ -39557,7 +39557,7 @@ index 0e3fa7d..35f9ed6 100644
  	wait_queue_head_t fifo_queue;
  	int fence_queue_waiters; /* Protected by hw_mutex */
 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
-index a0c2f12..68ae6cb 100644
+index decca82..7968bc5 100644
 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
 @@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
@@ -39569,7 +39569,7 @@ index a0c2f12..68ae6cb 100644
  	iowrite32(dev_priv->last_read_seqno, fifo_mem + SVGA_FIFO_FENCE);
  	vmw_marker_queue_init(&fifo->marker_queue);
  	return vmw_fifo_send_fence(dev_priv, &dummy);
-@@ -355,7 +355,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
+@@ -356,7 +356,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
  				if (reserveable)
  					iowrite32(bytes, fifo_mem +
  						  SVGA_FIFO_RESERVED);
@@ -39578,7 +39578,7 @@ index a0c2f12..68ae6cb 100644
  			} else {
  				need_bounce = true;
  			}
-@@ -475,7 +475,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
+@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
  
  	fm = vmw_fifo_reserve(dev_priv, bytes);
  	if (unlikely(fm == NULL)) {
@@ -39587,7 +39587,7 @@ index a0c2f12..68ae6cb 100644
  		ret = -ENOMEM;
  		(void)vmw_fallback_wait(dev_priv, false, true, *seqno,
  					false, 3*HZ);
-@@ -483,7 +483,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
+@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *seqno)
  	}
  
  	do {
@@ -48153,32 +48153,6 @@ index 9de9db2..1e09660 100644
  
  	fc_frame_free(fp);
  }
-diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
-index 143bbe4..2794a30 100644
---- a/drivers/scsi/libiscsi.c
-+++ b/drivers/scsi/libiscsi.c
-@@ -718,11 +718,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
- 			return NULL;
- 		}
- 
-+		if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
-+			iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
-+			return NULL;
-+		}
-+
- 		task = conn->login_task;
- 	} else {
- 		if (session->state != ISCSI_STATE_LOGGED_IN)
- 			return NULL;
- 
-+		if (data_size != 0) {
-+			iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
-+			return NULL;
-+		}
-+
- 		BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
- 		BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
- 
 diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
 index 5e170e3..1e87efc 100644
 --- a/drivers/scsi/libsas/sas_ata.c
@@ -50164,7 +50138,7 @@ index ed147c4..94fc3c6 100644
  
  /* core tmem accessor functions */
 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index ab5dd16..17f7bd2 100644
+index ae4e7da..46264ce 100644
 --- a/drivers/target/iscsi/iscsi_target.c
 +++ b/drivers/target/iscsi/iscsi_target.c
 @@ -1357,7 +1357,7 @@ static int iscsit_handle_data_out(struct iscsi_conn *conn, unsigned char *buf)
@@ -51322,7 +51296,7 @@ index 032e5a6..bc422e4 100644
  			wake_up(&usb_kill_urb_queue);
  		usb_put_urb(urb);
 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index f08732b..6338872 100644
+index 10aec1a..387cff3 100644
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
 @@ -25,6 +25,7 @@
@@ -55416,7 +55390,7 @@ index 356dcf0..c0046cd 100644
  static const struct super_operations afs_super_ops = {
  	.statfs		= afs_statfs,
 diff --git a/fs/aio.c b/fs/aio.c
-index 8cdd8ea..64197b4 100644
+index 9acfd07..ad962e7 100644
 --- a/fs/aio.c
 +++ b/fs/aio.c
 @@ -119,7 +119,7 @@ static int aio_setup_ring(struct kioctx *ctx)
@@ -55428,7 +55402,7 @@ index 8cdd8ea..64197b4 100644
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-@@ -1461,18 +1461,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
+@@ -1468,18 +1468,19 @@ static ssize_t aio_fsync(struct kiocb *iocb)
  static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  {
  	ssize_t ret;
@@ -55450,7 +55424,7 @@ index 8cdd8ea..64197b4 100644
  				&kiocb->ki_iovec, 1);
  	if (ret < 0)
  		goto out;
-@@ -1481,6 +1482,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
+@@ -1488,6 +1489,10 @@ static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb, bool compat)
  	if (ret < 0)
  		goto out;
  
@@ -56882,30 +56856,10 @@ index 200f63b..490b833 100644
  /*
   * used by btrfsctl to scan devices when no FS is mounted
 diff --git a/fs/buffer.c b/fs/buffer.c
-index 5f4bde2..5df71b8 100644
+index 59496e7..5df71b8 100644
 --- a/fs/buffer.c
 +++ b/fs/buffer.c
-@@ -1021,7 +1021,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
- 		bh = page_buffers(page);
- 		if (bh->b_size == size) {
- 			end_block = init_page_buffers(page, bdev,
--						index << sizebits, size);
-+						(sector_t)index << sizebits,
-+						size);
- 			goto done;
- 		}
- 		if (!try_to_free_buffers(page))
-@@ -1042,7 +1043,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
- 	 */
- 	spin_lock(&inode->i_mapping->private_lock);
- 	link_dev_buffers(page, bh);
--	end_block = init_page_buffers(page, bdev, index << sizebits, size);
-+	end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
-+			size);
- 	spin_unlock(&inode->i_mapping->private_lock);
- done:
- 	ret = (block < end_block) ? 1 : -ENXIO;
-@@ -2256,6 +2258,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping,
+@@ -2258,6 +2258,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping,
  		err = 0;
  
  		balance_dirty_pages_ratelimited(mapping);
@@ -56917,7 +56871,7 @@ index 5f4bde2..5df71b8 100644
  	}
  
  	/* page covers the boundary, find the boundary offset */
-@@ -3316,7 +3323,7 @@ void __init buffer_init(void)
+@@ -3318,7 +3323,7 @@ void __init buffer_init(void)
  	bh_cachep = kmem_cache_create("buffer_head",
  			sizeof(struct buffer_head), 0,
  				(SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|
@@ -59189,10 +59143,10 @@ index 40f4d06..7f3507d 100644
  
  	/* locality groups */
 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 818b43e..9a76283 100644
+index 5baa7ba..917bb08 100644
 --- a/fs/ext4/mballoc.c
 +++ b/fs/ext4/mballoc.c
-@@ -1794,7 +1794,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
+@@ -1796,7 +1796,7 @@ void ext4_mb_simple_scan_group(struct ext4_allocation_context *ac,
  		BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
  
  		if (EXT4_SB(sb)->s_mb_stats)
@@ -59201,7 +59155,7 @@ index 818b43e..9a76283 100644
  
  		break;
  	}
-@@ -2092,7 +2092,7 @@ repeat:
+@@ -2094,7 +2094,7 @@ repeat:
  			ac->ac_status = AC_STATUS_CONTINUE;
  			ac->ac_flags |= EXT4_MB_HINT_FIRST;
  			cr = 3;
@@ -59210,7 +59164,7 @@ index 818b43e..9a76283 100644
  			goto repeat;
  		}
  	}
-@@ -2599,25 +2599,25 @@ int ext4_mb_release(struct super_block *sb)
+@@ -2601,25 +2601,25 @@ int ext4_mb_release(struct super_block *sb)
  	if (sbi->s_mb_stats) {
  		ext4_msg(sb, KERN_INFO,
  		       "mballoc: %u blocks %u reqs (%u success)",
@@ -59246,7 +59200,7 @@ index 818b43e..9a76283 100644
  	}
  
  	free_percpu(sbi->s_locality_groups);
-@@ -3101,16 +3101,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
+@@ -3103,16 +3103,16 @@ static void ext4_mb_collect_stats(struct ext4_allocation_context *ac)
  	struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
  
  	if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
@@ -59269,7 +59223,7 @@ index 818b43e..9a76283 100644
  	}
  
  	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3534,7 +3534,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
+@@ -3539,7 +3539,7 @@ ext4_mb_new_inode_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_inode_pa(ac, pa);
  
  	ext4_mb_use_inode_pa(ac, pa);
@@ -59278,7 +59232,7 @@ index 818b43e..9a76283 100644
  
  	ei = EXT4_I(ac->ac_inode);
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3594,7 +3594,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
+@@ -3599,7 +3599,7 @@ ext4_mb_new_group_pa(struct ext4_allocation_context *ac)
  	trace_ext4_mb_new_group_pa(ac, pa);
  
  	ext4_mb_use_group_pa(ac, pa);
@@ -59287,7 +59241,7 @@ index 818b43e..9a76283 100644
  
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
  	lg = ac->ac_lg;
-@@ -3683,7 +3683,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
+@@ -3688,7 +3688,7 @@ ext4_mb_release_inode_pa(struct ext4_buddy *e4b, struct buffer_head *bitmap_bh,
  		 * from the bitmap and continue.
  		 */
  	}
@@ -59296,7 +59250,7 @@ index 818b43e..9a76283 100644
  
  	return err;
  }
-@@ -3701,7 +3701,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
+@@ -3706,7 +3706,7 @@ ext4_mb_release_group_pa(struct ext4_buddy *e4b,
  	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
  	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
  	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -61558,7 +61512,7 @@ index 4d46a6a..dee1cdf 100644
  static int __init init_minix_fs(void)
  {
 diff --git a/fs/namei.c b/fs/namei.c
-index 9680cef..36c9152 100644
+index dea2dab..6452ab2 100644
 --- a/fs/namei.c
 +++ b/fs/namei.c
 @@ -279,16 +279,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -61612,7 +61566,7 @@ index 9680cef..36c9152 100644
  	return -EACCES;
  }
  
-@@ -653,11 +661,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
+@@ -652,11 +660,19 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
  		return error;
  	}
  
@@ -61642,7 +61596,7 @@ index 9680cef..36c9152 100644
  		put_link(nd, &link, cookie);
  	} while (res > 0);
  
-@@ -1617,6 +1635,8 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1624,6 +1642,8 @@ static int path_lookupat(int dfd, const char *name,
  			err = follow_link(&link, nd, &cookie);
  			if (!err)
  				err = lookup_last(nd, &path);
@@ -61651,7 +61605,7 @@ index 9680cef..36c9152 100644
  			put_link(nd, &link, cookie);
  		}
  	}
-@@ -1624,6 +1644,13 @@ static int path_lookupat(int dfd, const char *name,
+@@ -1631,6 +1651,13 @@ static int path_lookupat(int dfd, const char *name,
  	if (!err)
  		err = complete_walk(nd);
  
@@ -61665,7 +61619,7 @@ index 9680cef..36c9152 100644
  	if (!err && nd->flags & LOOKUP_DIRECTORY) {
  		if (!nd->inode->i_op->lookup) {
  			path_put(&nd->path);
-@@ -1655,6 +1682,12 @@ static int do_path_lookup(int dfd, const char *name,
+@@ -1662,6 +1689,12 @@ static int do_path_lookup(int dfd, const char *name,
  			if (nd->path.dentry && nd->inode)
  				audit_inode(name, nd->path.dentry);
  		}
@@ -61678,7 +61632,7 @@ index 9680cef..36c9152 100644
  	}
  	return retval;
  }
-@@ -1784,7 +1817,13 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
+@@ -1791,7 +1824,13 @@ struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
  	if (!len)
  		return ERR_PTR(-EACCES);
  
@@ -61692,7 +61646,7 @@ index 9680cef..36c9152 100644
  	while (len--) {
  		c = *(const unsigned char *)name++;
  		if (c == '/' || c == '\0')
-@@ -2048,6 +2087,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
+@@ -2055,6 +2094,13 @@ static int may_open(struct path *path, int acc_mode, int flag)
  	if (flag & O_NOATIME && !inode_owner_or_capable(inode))
  		return -EPERM;
  
@@ -61706,7 +61660,7 @@ index 9680cef..36c9152 100644
  	return 0;
  }
  
-@@ -2083,7 +2129,7 @@ static inline int open_to_namei_flags(int flag)
+@@ -2090,7 +2136,7 @@ static inline int open_to_namei_flags(int flag)
  /*
   * Handle the last step of open()
   */
@@ -61715,7 +61669,7 @@ index 9680cef..36c9152 100644
  			    const struct open_flags *op, const char *pathname)
  {
  	struct dentry *dir = nd->path.dentry;
-@@ -2109,16 +2155,32 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2116,16 +2162,32 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  		error = complete_walk(nd);
  		if (error)
  			return ERR_PTR(error);
@@ -61748,7 +61702,7 @@ index 9680cef..36c9152 100644
  		audit_inode(pathname, dir);
  		goto ok;
  	}
-@@ -2134,18 +2196,31 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2141,18 +2203,31 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  					!symlink_ok);
  		if (error < 0)
  			return ERR_PTR(error);
@@ -61781,7 +61735,7 @@ index 9680cef..36c9152 100644
  		audit_inode(pathname, nd->path.dentry);
  		goto ok;
  	}
-@@ -2180,6 +2255,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2187,6 +2262,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	/* Negative dentry, just create the file */
  	if (!dentry->d_inode) {
  		int mode = op->mode;
@@ -61799,7 +61753,7 @@ index 9680cef..36c9152 100644
  		if (!IS_POSIXACL(dir->d_inode))
  			mode &= ~current_umask();
  		/*
-@@ -2203,6 +2289,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2210,6 +2296,8 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  		error = vfs_create(dir->d_inode, dentry, mode, nd);
  		if (error)
  			goto exit_mutex_unlock;
@@ -61808,7 +61762,7 @@ index 9680cef..36c9152 100644
  		mutex_unlock(&dir->d_inode->i_mutex);
  		dput(nd->path.dentry);
  		nd->path.dentry = dentry;
-@@ -2212,6 +2300,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2219,6 +2307,19 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	/*
  	 * It already exists.
  	 */
@@ -61828,7 +61782,7 @@ index 9680cef..36c9152 100644
  	mutex_unlock(&dir->d_inode->i_mutex);
  	audit_inode(pathname, path->dentry);
  
-@@ -2230,11 +2331,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2237,11 +2338,17 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	if (!path->dentry->d_inode)
  		goto exit_dput;
  
@@ -61847,7 +61801,7 @@ index 9680cef..36c9152 100644
  	/* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
  	error = complete_walk(nd);
  	if (error)
-@@ -2242,6 +2349,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
+@@ -2249,6 +2356,12 @@ static struct file *do_last(struct nameidata *nd, struct path *path,
  	error = -EISDIR;
  	if (S_ISDIR(nd->inode->i_mode))
  		goto exit;
@@ -61860,7 +61814,7 @@ index 9680cef..36c9152 100644
  ok:
  	if (!S_ISREG(nd->inode->i_mode))
  		will_truncate = 0;
-@@ -2314,7 +2427,7 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2321,7 +2434,7 @@ static struct file *path_openat(int dfd, const char *pathname,
  	if (unlikely(error))
  		goto out_filp;
  
@@ -61869,7 +61823,7 @@ index 9680cef..36c9152 100644
  	while (unlikely(!filp)) { /* trailing symlink */
  		struct path link = path;
  		void *cookie;
-@@ -2329,8 +2442,9 @@ static struct file *path_openat(int dfd, const char *pathname,
+@@ -2336,8 +2449,9 @@ static struct file *path_openat(int dfd, const char *pathname,
  		error = follow_link(&link, nd, &cookie);
  		if (unlikely(error))
  			filp = ERR_PTR(error);
@@ -61881,7 +61835,7 @@ index 9680cef..36c9152 100644
  		put_link(nd, &link, cookie);
  	}
  out:
-@@ -2424,6 +2538,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
+@@ -2431,6 +2545,11 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path
  	*path = nd.path;
  	return dentry;
  eexist:
@@ -61893,7 +61847,7 @@ index 9680cef..36c9152 100644
  	dput(dentry);
  	dentry = ERR_PTR(-EEXIST);
  fail:
-@@ -2446,6 +2565,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
+@@ -2453,6 +2572,20 @@ struct dentry *user_path_create(int dfd, const char __user *pathname, struct pat
  }
  EXPORT_SYMBOL(user_path_create);
  
@@ -61914,7 +61868,7 @@ index 9680cef..36c9152 100644
  int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
  {
  	int error = may_create(dir, dentry);
-@@ -2513,6 +2646,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+@@ -2520,6 +2653,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_dput;
@@ -61932,7 +61886,7 @@ index 9680cef..36c9152 100644
  	error = security_path_mknod(&path, dentry, mode, dev);
  	if (error)
  		goto out_drop_write;
-@@ -2530,6 +2674,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
+@@ -2537,6 +2681,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, int, mode,
  	}
  out_drop_write:
  	mnt_drop_write(path.mnt);
@@ -61942,7 +61896,7 @@ index 9680cef..36c9152 100644
  out_dput:
  	dput(dentry);
  	mutex_unlock(&path.dentry->d_inode->i_mutex);
-@@ -2579,12 +2726,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
+@@ -2586,12 +2733,21 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, int, mode)
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_dput;
@@ -61964,7 +61918,7 @@ index 9680cef..36c9152 100644
  out_dput:
  	dput(dentry);
  	mutex_unlock(&path.dentry->d_inode->i_mutex);
-@@ -2664,6 +2820,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2671,6 +2827,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	char * name;
  	struct dentry *dentry;
  	struct nameidata nd;
@@ -61973,7 +61927,7 @@ index 9680cef..36c9152 100644
  
  	error = user_path_parent(dfd, pathname, &nd, &name);
  	if (error)
-@@ -2692,6 +2850,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2699,6 +2857,15 @@ static long do_rmdir(int dfd, const char __user *pathname)
  		error = -ENOENT;
  		goto exit3;
  	}
@@ -61989,7 +61943,7 @@ index 9680cef..36c9152 100644
  	error = mnt_want_write(nd.path.mnt);
  	if (error)
  		goto exit3;
-@@ -2699,6 +2866,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
+@@ -2706,6 +2873,8 @@ static long do_rmdir(int dfd, const char __user *pathname)
  	if (error)
  		goto exit4;
  	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
@@ -61998,7 +61952,7 @@ index 9680cef..36c9152 100644
  exit4:
  	mnt_drop_write(nd.path.mnt);
  exit3:
-@@ -2761,6 +2930,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2768,6 +2937,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  	struct dentry *dentry;
  	struct nameidata nd;
  	struct inode *inode = NULL;
@@ -62007,7 +61961,7 @@ index 9680cef..36c9152 100644
  
  	error = user_path_parent(dfd, pathname, &nd, &name);
  	if (error)
-@@ -2783,6 +2954,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2790,6 +2961,16 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  		if (!inode)
  			goto slashes;
  		ihold(inode);
@@ -62024,7 +61978,7 @@ index 9680cef..36c9152 100644
  		error = mnt_want_write(nd.path.mnt);
  		if (error)
  			goto exit2;
-@@ -2790,6 +2971,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
+@@ -2797,6 +2978,8 @@ static long do_unlinkat(int dfd, const char __user *pathname)
  		if (error)
  			goto exit3;
  		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
@@ -62033,7 +61987,7 @@ index 9680cef..36c9152 100644
  exit3:
  		mnt_drop_write(nd.path.mnt);
  	exit2:
-@@ -2865,10 +3048,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
+@@ -2872,10 +3055,18 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname,
  	error = mnt_want_write(path.mnt);
  	if (error)
  		goto out_dput;
@@ -62052,7 +62006,7 @@ index 9680cef..36c9152 100644
  out_drop_write:
  	mnt_drop_write(path.mnt);
  out_dput:
-@@ -2940,6 +3131,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2947,6 +3138,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  {
  	struct dentry *new_dentry;
  	struct path old_path, new_path;
@@ -62060,7 +62014,7 @@ index 9680cef..36c9152 100644
  	int how = 0;
  	int error;
  
-@@ -2963,7 +3155,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2970,7 +3162,7 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	if (error)
  		return error;
  
@@ -62069,7 +62023,7 @@ index 9680cef..36c9152 100644
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
  		goto out;
-@@ -2974,13 +3166,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
+@@ -2981,13 +3173,30 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
  	error = mnt_want_write(new_path.mnt);
  	if (error)
  		goto out_dput;
@@ -62100,7 +62054,7 @@ index 9680cef..36c9152 100644
  	dput(new_dentry);
  	mutex_unlock(&new_path.dentry->d_inode->i_mutex);
  	path_put(&new_path);
-@@ -3208,6 +3417,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+@@ -3215,6 +3424,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -62113,7 +62067,7 @@ index 9680cef..36c9152 100644
  	error = mnt_want_write(oldnd.path.mnt);
  	if (error)
  		goto exit5;
-@@ -3217,6 +3432,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
+@@ -3224,6 +3439,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname,
  		goto exit6;
  	error = vfs_rename(old_dir->d_inode, old_dentry,
  				   new_dir->d_inode, new_dentry);
@@ -62123,7 +62077,7 @@ index 9680cef..36c9152 100644
  exit6:
  	mnt_drop_write(oldnd.path.mnt);
  exit5:
-@@ -3242,6 +3460,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
+@@ -3249,6 +3467,8 @@ SYSCALL_DEFINE2(rename, const char __user *, oldname, const char __user *, newna
  
  int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
  {
@@ -62132,7 +62086,7 @@ index 9680cef..36c9152 100644
  	int len;
  
  	len = PTR_ERR(link);
-@@ -3251,7 +3471,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
+@@ -3258,7 +3478,14 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
  	len = strlen(link);
  	if (len > (unsigned) buflen)
  		len = buflen;
@@ -62355,7 +62309,7 @@ index b78b5b6..c64d84f 100644
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
 diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index c4a2a68..ec7ff6e 100644
+index 61a1303..3e0034a 100644
 --- a/fs/nfs/nfs4proc.c
 +++ b/fs/nfs/nfs4proc.c
 @@ -1037,7 +1037,7 @@ static struct nfs4_state *nfs4_try_open_cached(struct nfs4_opendata *opendata)
@@ -62476,10 +62430,10 @@ index c45a2ea..1a6bd66 100644
  #ifdef CONFIG_PROC_FS
  static int create_proc_exports_entry(void)
 diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index 11e1888..216bf2f 100644
+index e2e7914..f057f88 100644
 --- a/fs/nfsd/vfs.c
 +++ b/fs/nfsd/vfs.c
-@@ -957,7 +957,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+@@ -960,7 +960,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
  	} else {
  		oldfs = get_fs();
  		set_fs(KERNEL_DS);
@@ -62488,7 +62442,7 @@ index 11e1888..216bf2f 100644
  		set_fs(oldfs);
  	}
  
-@@ -1061,7 +1061,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
+@@ -1064,7 +1064,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
  
  	/* Write the data. */
  	oldfs = get_fs(); set_fs(KERNEL_DS);
@@ -62497,7 +62451,7 @@ index 11e1888..216bf2f 100644
  	set_fs(oldfs);
  	if (host_err < 0)
  		goto out_nfserr;
-@@ -1602,7 +1602,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
+@@ -1605,7 +1605,7 @@ nfsd_readlink(struct svc_rqst *rqstp, struct svc_fh *fhp, char *buf, int *lenp)
  	 */
  
  	oldfs = get_fs(); set_fs(KERNEL_DS);
@@ -78989,7 +78943,7 @@ index 7408af8..8d6f9dd 100644
  #ifdef CONFIG_CPU_IDLE
  
 diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h
-index 4f7a632..b9e6f95 100644
+index 4f7a6323..b9e6f95 100644
 --- a/include/linux/cpumask.h
 +++ b/include/linux/cpumask.h
 @@ -117,17 +117,17 @@ static inline unsigned int cpumask_first(const struct cpumask *srcp)
@@ -81204,10 +81158,10 @@ index e2e1ab5..1e1e417 100644
  	irq_flow_handler_t	handle_irq;
  #ifdef CONFIG_IRQ_PREFLOW_FASTEOI
 diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
-index f5df3dc..116cbeb 100644
+index f4e8578..cbfc9fc 100644
 --- a/include/linux/jiffies.h
 +++ b/include/linux/jiffies.h
-@@ -295,9 +295,9 @@ extern unsigned long preset_lpj;
+@@ -283,9 +283,9 @@ extern unsigned long preset_lpj;
   */
  extern unsigned int jiffies_to_msecs(const unsigned long j);
  extern unsigned int jiffies_to_usecs(const unsigned long j);
@@ -85502,7 +85456,7 @@ index 3702939..cf9e78e 100644
  extern int	__rtnl_link_register(struct rtnl_link_ops *ops);
  extern void	__rtnl_link_unregister(struct rtnl_link_ops *ops);
 diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
-index ad03988..0c5a964 100644
+index e0f1c91..c73f85c 100644
 --- a/include/net/sctp/sctp.h
 +++ b/include/net/sctp/sctp.h
 @@ -318,9 +318,9 @@ do {									\
@@ -85519,7 +85473,7 @@ index ad03988..0c5a964 100644
  #define SCTP_DISABLE_DEBUG
  #define SCTP_ASSERT(expr, str, func)
 diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
-index 9148632..be3c5ac 100644
+index 4d1be75..a54d29e 100644
 --- a/include/net/sctp/sm.h
 +++ b/include/net/sctp/sm.h
 @@ -86,7 +86,7 @@ typedef void (sctp_timer_event_t) (unsigned long);
@@ -86297,10 +86251,10 @@ index 0993a22..32ba2fe 100644
  	void *pmi_pal;
  	u8 *vbe_state_orig;		/*
 diff --git a/init/Kconfig b/init/Kconfig
-index 43298f9..7e4816c 100644
+index b8dc1de..e4ce6c6 100644
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1214,7 +1214,7 @@ config SLUB_DEBUG
+@@ -1215,7 +1215,7 @@ config SLUB_DEBUG
  
  config COMPAT_BRK
  	bool "Disable heap randomization"
@@ -86309,7 +86263,7 @@ index 43298f9..7e4816c 100644
  	help
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
-@@ -1397,7 +1397,7 @@ config INIT_ALL_POSSIBLE
+@@ -1398,7 +1398,7 @@ config INIT_ALL_POSSIBLE
  config STOP_MACHINE
  	bool
  	default y
@@ -87325,10 +87279,10 @@ index b463871..59495fd 100644
   * nsown_capable - Check superior capability to one's own user_ns
   * @cap: The capability in question
 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
-index 93fc15e..94e383a 100644
+index ffcf896..a88b61f 100644
 --- a/kernel/cgroup.c
 +++ b/kernel/cgroup.c
-@@ -4750,6 +4750,14 @@ static void cgroup_release_agent(struct work_struct *work)
+@@ -4755,6 +4755,14 @@ static void cgroup_release_agent(struct work_struct *work)
  						    release_list);
  		list_del_init(&cgrp->release_list);
  		raw_spin_unlock(&release_list_lock);
@@ -87343,7 +87297,7 @@ index 93fc15e..94e383a 100644
  		pathbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
  		if (!pathbuf)
  			goto continue_free;
-@@ -5169,7 +5177,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
+@@ -5174,7 +5182,7 @@ static int cgroup_css_links_read(struct cgroup *cont,
  		struct css_set *cg = link->cg;
  		struct task_struct *task;
  		int count = 0;
@@ -87767,7 +87721,7 @@ index 63786e7..0780cac 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 14c111c..98d977c 100644
+index 4a14895..e44008c 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -145,8 +145,15 @@ static struct srcu_struct pmus_srcu;
@@ -87796,7 +87750,7 @@ index 14c111c..98d977c 100644
  
  static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
  			      enum event_type_t event_type);
-@@ -2589,7 +2596,7 @@ static void __perf_event_read(void *info)
+@@ -2599,7 +2606,7 @@ static void __perf_event_read(void *info)
  
  static inline u64 perf_event_count(struct perf_event *event)
  {
@@ -87805,7 +87759,7 @@ index 14c111c..98d977c 100644
  }
  
  static u64 perf_event_read(struct perf_event *event)
-@@ -3132,9 +3139,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
+@@ -3142,9 +3149,9 @@ u64 perf_event_read_value(struct perf_event *event, u64 *enabled, u64 *running)
  	mutex_lock(&event->child_mutex);
  	total += perf_event_read(event);
  	*enabled += event->total_time_enabled +
@@ -87817,7 +87771,7 @@ index 14c111c..98d977c 100644
  
  	list_for_each_entry(child, &event->child_list, child_list) {
  		total += perf_event_read(child);
-@@ -3526,10 +3533,10 @@ void perf_event_update_userpage(struct perf_event *event)
+@@ -3536,10 +3543,10 @@ void perf_event_update_userpage(struct perf_event *event)
  		userpg->offset -= local64_read(&event->hw.prev_count);
  
  	userpg->time_enabled = enabled +
@@ -87830,7 +87784,7 @@ index 14c111c..98d977c 100644
  
  	barrier();
  	++userpg->lock;
-@@ -4037,11 +4044,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4047,11 +4054,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
  	values[n++] = perf_event_count(event);
  	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
  		values[n++] = enabled +
@@ -87844,7 +87798,7 @@ index 14c111c..98d977c 100644
  	}
  	if (read_format & PERF_FORMAT_ID)
  		values[n++] = primary_event_id(event);
-@@ -4692,12 +4699,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
+@@ -4702,12 +4709,12 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
  		 * need to add enough zero bytes after the string to handle
  		 * the 64bit alignment we do later.
  		 */
@@ -87859,7 +87813,7 @@ index 14c111c..98d977c 100644
  		if (IS_ERR(name)) {
  			name = strncpy(tmp, "//toolong", sizeof(tmp));
  			goto got_name;
-@@ -6063,7 +6070,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -6073,7 +6080,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
  	event->parent		= parent_event;
  
  	event->ns		= get_pid_ns(current->nsproxy->pid_ns);
@@ -87868,7 +87822,7 @@ index 14c111c..98d977c 100644
  
  	event->state		= PERF_EVENT_STATE_INACTIVE;
  
-@@ -6309,6 +6316,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -6319,6 +6326,11 @@ SYSCALL_DEFINE5(perf_event_open,
  	if (flags & ~PERF_FLAG_ALL)
  		return -EINVAL;
  
@@ -87880,7 +87834,7 @@ index 14c111c..98d977c 100644
  	err = perf_copy_attr(attr_uptr, &attr);
  	if (err)
  		return err;
-@@ -6607,10 +6619,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -6617,10 +6629,10 @@ static void sync_child_event(struct perf_event *child_event,
  	/*
  	 * Add back the child's count to the parent's count:
  	 */
@@ -87894,18 +87848,6 @@ index 14c111c..98d977c 100644
  		     &parent_event->child_total_time_running);
  
  	/*
-@@ -7071,8 +7083,10 @@ int perf_event_init_task(struct task_struct *child)
- 
- 	for_each_task_context_nr(ctxn) {
- 		ret = perf_event_init_context(child, ctxn);
--		if (ret)
-+		if (ret) {
-+			perf_event_free_task(child);
- 			return ret;
-+		}
- 	}
- 
- 	return 0;
 diff --git a/kernel/events/internal.h b/kernel/events/internal.h
 index a2101bb..f2e0354 100644
 --- a/kernel/events/internal.h
@@ -88037,7 +87979,7 @@ index fde15f9..99f1b97 100644
  {
  	struct signal_struct *sig = current->signal;
 diff --git a/kernel/fork.c b/kernel/fork.c
-index 13bba30..ee14dbd 100644
+index 29b4604..ee14dbd 100644
 --- a/kernel/fork.c
 +++ b/kernel/fork.c
 @@ -34,6 +34,7 @@
@@ -88479,15 +88421,6 @@ index 13bba30..ee14dbd 100644
  			goto bad_fork_free;
  	}
  	current->flags &= ~PF_NPROC_EXCEEDED;
-@@ -1221,7 +1345,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
- 		goto bad_fork_cleanup_policy;
- 	retval = audit_alloc(p);
- 	if (retval)
--		goto bad_fork_cleanup_policy;
-+		goto bad_fork_cleanup_perf;
- 	/* copy all the process information */
- 	retval = copy_semundo(clone_flags, p);
- 	if (retval)
 @@ -1341,6 +1465,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
  		goto bad_fork_free_pid;
  	}
@@ -88500,18 +88433,7 @@ index 13bba30..ee14dbd 100644
  	if (clone_flags & CLONE_THREAD) {
  		current->signal->nr_threads++;
  		atomic_inc(&current->signal->live);
-@@ -1406,8 +1535,9 @@ bad_fork_cleanup_semundo:
- 	exit_sem(p);
- bad_fork_cleanup_audit:
- 	audit_free(p);
--bad_fork_cleanup_policy:
-+bad_fork_cleanup_perf:
- 	perf_event_free_task(p);
-+bad_fork_cleanup_policy:
- #ifdef CONFIG_NUMA
- 	mpol_put(p->mempolicy);
- bad_fork_cleanup_cgroup:
-@@ -1423,6 +1553,8 @@ bad_fork_cleanup_count:
+@@ -1424,6 +1553,8 @@ bad_fork_cleanup_count:
  bad_fork_free:
  	free_task(p);
  fork_out:
@@ -88520,7 +88442,7 @@ index 13bba30..ee14dbd 100644
  	return ERR_PTR(retval);
  }
  
-@@ -1509,6 +1641,7 @@ long do_fork(unsigned long clone_flags,
+@@ -1510,6 +1641,7 @@ long do_fork(unsigned long clone_flags,
  
  	p = copy_process(clone_flags, stack_start, regs, stack_size,
  			 child_tidptr, NULL, trace);
@@ -88528,7 +88450,7 @@ index 13bba30..ee14dbd 100644
  	/*
  	 * Do this prior waking up the new thread - the thread pointer
  	 * might get invalid after that point, if the thread exits quickly.
-@@ -1525,6 +1658,8 @@ long do_fork(unsigned long clone_flags,
+@@ -1526,6 +1658,8 @@ long do_fork(unsigned long clone_flags,
  		if (clone_flags & CLONE_PARENT_SETTID)
  			put_user(nr, parent_tidptr);
  
@@ -88537,7 +88459,7 @@ index 13bba30..ee14dbd 100644
  		if (clone_flags & CLONE_VFORK) {
  			p->vfork_done = &vfork;
  			init_completion(&vfork);
-@@ -1597,7 +1732,7 @@ void __init proc_caches_init(void)
+@@ -1598,7 +1732,7 @@ void __init proc_caches_init(void)
  	mm_cachep = kmem_cache_create("mm_struct",
  			sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
  			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_NOTRACK, NULL);
@@ -88546,7 +88468,7 @@ index 13bba30..ee14dbd 100644
  	mmap_init();
  	nsproxy_cache_init();
  }
-@@ -1636,7 +1771,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
+@@ -1637,7 +1771,7 @@ static int unshare_fs(unsigned long unshare_flags, struct fs_struct **new_fsp)
  		return 0;
  
  	/* don't need lock here; in the worst case we'll do useless copy */
@@ -88555,7 +88477,7 @@ index 13bba30..ee14dbd 100644
  		return 0;
  
  	*new_fsp = copy_fs_struct(fs);
-@@ -1725,7 +1860,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
+@@ -1726,7 +1860,8 @@ SYSCALL_DEFINE1(unshare, unsigned long, unshare_flags)
  			fs = current->fs;
  			spin_lock(&fs->lock);
  			current->fs = new_fs;
@@ -88566,7 +88488,7 @@ index 13bba30..ee14dbd 100644
  			else
  				new_fs = fs;
 diff --git a/kernel/futex.c b/kernel/futex.c
-index 1bb37d0..8d00f9b 100644
+index f31f190..8d00f9b 100644
 --- a/kernel/futex.c
 +++ b/kernel/futex.c
 @@ -54,6 +54,7 @@
@@ -88625,15 +88547,7 @@ index 1bb37d0..8d00f9b 100644
  
  	pagefault_disable();
  	ret = __copy_from_user_inatomic(dest, from, sizeof(u32));
-@@ -2460,6 +2468,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
- 	 * shared futexes. We need to compare the keys:
- 	 */
- 	if (match_futex(&q.key, &key2)) {
-+		queue_unlock(&q, hb);
- 		ret = -EINVAL;
- 		goto out_put_keys;
- 	}
-@@ -2877,6 +2886,7 @@ static int __init futex_init(void)
+@@ -2878,6 +2886,7 @@ static int __init futex_init(void)
  {
  	u32 curval;
  	int i;
@@ -88641,7 +88555,7 @@ index 1bb37d0..8d00f9b 100644
  
  	/*
  	 * This will fail and we want it. Some arch implementations do
-@@ -2888,8 +2898,11 @@ static int __init futex_init(void)
+@@ -2889,8 +2898,11 @@ static int __init futex_init(void)
  	 * implementation, the non-functional ones will return
  	 * -ENOSYS.
  	 */
@@ -93069,7 +92983,7 @@ index e660464..c8b9e67 100644
  		return cmd_attr_register_cpumask(info);
  	else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
 diff --git a/kernel/time.c b/kernel/time.c
-index 73e416d..cfc6f69 100644
+index 060f961..fe7a19e 100644
 --- a/kernel/time.c
 +++ b/kernel/time.c
 @@ -163,6 +163,11 @@ int do_sys_settimeofday(const struct timespec *tv, const struct timezone *tz)
@@ -93085,82 +92999,10 @@ index 73e416d..cfc6f69 100644
  		sys_tz = *tz;
  		update_vsyscall_tz();
 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
-index eb198a3..42f27b5 100644
+index 7eaf162..e2615e7 100644
 --- a/kernel/time/alarmtimer.c
 +++ b/kernel/time/alarmtimer.c
-@@ -442,18 +442,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
- static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
- 							ktime_t now)
- {
-+	unsigned long flags;
- 	struct k_itimer *ptr = container_of(alarm, struct k_itimer,
- 						it.alarm.alarmtimer);
--	if (posix_timer_event(ptr, 0) != 0)
--		ptr->it_overrun++;
-+	enum alarmtimer_restart result = ALARMTIMER_NORESTART;
-+
-+	spin_lock_irqsave(&ptr->it_lock, flags);
-+	if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
-+		if (posix_timer_event(ptr, 0) != 0)
-+			ptr->it_overrun++;
-+	}
- 
- 	/* Re-add periodic timers */
- 	if (ptr->it.alarm.interval.tv64) {
- 		ptr->it_overrun += alarm_forward(alarm, now,
- 						ptr->it.alarm.interval);
--		return ALARMTIMER_RESTART;
-+		result = ALARMTIMER_RESTART;
- 	}
--	return ALARMTIMER_NORESTART;
-+	spin_unlock_irqrestore(&ptr->it_lock, flags);
-+
-+	return result;
- }
- 
- /**
-@@ -514,23 +522,33 @@ static int alarm_timer_create(struct k_itimer *new_timer)
- 	return 0;
- }
- 
-+static ktime_t alarm_expires_remaining(const struct alarm *alarm)
-+{
-+	struct alarm_base *base = &alarm_bases[alarm->type];
-+	return ktime_sub(alarm->node.expires, base->gettime());
-+}
-+
- /**
-  * alarm_timer_get - posix timer_get interface
-  * @new_timer: k_itimer pointer
-  * @cur_setting: itimerspec data to fill
-  *
-- * Copies the itimerspec data out from the k_itimer
-+ * Copies out the current itimerspec data
-  */
- static void alarm_timer_get(struct k_itimer *timr,
- 				struct itimerspec *cur_setting)
- {
--	memset(cur_setting, 0, sizeof(struct itimerspec));
-+	ktime_t relative_expiry_time =
-+		alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
- 
--	cur_setting->it_interval =
--			ktime_to_timespec(timr->it.alarm.interval);
--	cur_setting->it_value =
--		ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
--	return;
-+	if (ktime_to_ns(relative_expiry_time) > 0) {
-+		cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
-+	} else {
-+		cur_setting->it_value.tv_sec = 0;
-+		cur_setting->it_value.tv_nsec = 0;
-+	}
-+
-+	cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
- }
- 
- /**
-@@ -789,7 +807,7 @@ static int __init alarmtimer_init(void)
+@@ -807,7 +807,7 @@ static int __init alarmtimer_init(void)
  	struct platform_device *pdev;
  	int error = 0;
  	int i;
@@ -93445,7 +93287,7 @@ index dcbafed..9feb3de 100644
  
  	ftrace_graph_active++;
 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
-index 4babd77..3e869fd 100644
+index b252661..45b218f 100644
 --- a/kernel/trace/ring_buffer.c
 +++ b/kernel/trace/ring_buffer.c
 @@ -376,9 +376,9 @@ struct buffer_data_page {
@@ -93963,6 +93805,82 @@ index c5b20a3..6b38c73 100644
  		return;
  
  	local_irq_save(flags);
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index 7c75bbb..f32b331 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -309,7 +309,7 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ 	int syscall_nr;
+ 
+ 	syscall_nr = syscall_get_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 	if (!test_bit(syscall_nr, enabled_enter_syscalls))
+ 		return;
+@@ -349,7 +349,7 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ 	int syscall_nr;
+ 
+ 	syscall_nr = syscall_get_nr(current, regs);
+-	if (syscall_nr < 0)
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ 		return;
+ 	if (!test_bit(syscall_nr, enabled_exit_syscalls))
+ 		return;
+@@ -519,6 +519,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ 	int size;
+ 
+ 	syscall_nr = syscall_get_nr(current, regs);
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
++		return;
+ 	if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ 		return;
+ 
+@@ -554,6 +556,8 @@ int perf_sysenter_enable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return -EINVAL;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	if (!sys_perf_refcount_enter)
+@@ -574,6 +578,8 @@ void perf_sysenter_disable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	sys_perf_refcount_enter--;
+@@ -593,6 +599,8 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ 	int size;
+ 
+ 	syscall_nr = syscall_get_nr(current, regs);
++	if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
++		return;
+ 	if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ 		return;
+ 
+@@ -630,6 +638,8 @@ int perf_sysexit_enable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return -EINVAL;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	if (!sys_perf_refcount_exit)
+@@ -650,6 +660,8 @@ void perf_sysexit_disable(struct ftrace_event_call *call)
+ 	int num;
+ 
+ 	num = ((struct syscall_metadata *)call->data)->syscall_nr;
++	if (WARN_ON_ONCE(num < 0 || num >= NR_syscalls))
++		return;
+ 
+ 	mutex_lock(&syscall_trace_lock);
+ 	sys_perf_refcount_exit--;
 diff --git a/kernel/trace/trace_workqueue.c b/kernel/trace/trace_workqueue.c
 index 209b379..7f76423 100644
 --- a/kernel/trace/trace_workqueue.c
@@ -96613,23 +96531,10 @@ index a72fa33..0b12a09 100644
  		err = -EPERM;
  		goto out;
 diff --git a/mm/migrate.c b/mm/migrate.c
-index 09d6a9d..e2941874 100644
+index 7d26ea5..e2941874 100644
 --- a/mm/migrate.c
 +++ b/mm/migrate.c
-@@ -141,8 +141,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
- 
- 	get_page(new);
- 	pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
-+
-+	/* Recheck VMA as permissions can change since migration started  */
- 	if (is_write_migration_entry(entry))
--		pte = pte_mkwrite(pte);
-+		pte = maybe_mkwrite(pte, vma);
-+
- #ifdef CONFIG_HUGETLB_PAGE
- 	if (PageHuge(new))
- 		pte = pte_mkhuge(pte);
-@@ -1389,6 +1392,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+@@ -1392,6 +1392,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
  	if (!mm)
  		return -EINVAL;
  
@@ -96644,7 +96549,7 @@ index 09d6a9d..e2941874 100644
  	/*
  	 * Check if this process has the right to modify the specified
  	 * process. The right exists if the process has administrative
-@@ -1398,8 +1409,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
+@@ -1401,8 +1409,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages,
  	rcu_read_lock();
  	tcred = __task_cred(task);
  	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
@@ -98835,7 +98740,7 @@ index 62a7fa23..aaa6823 100644
  	if (order && (gfp_flags & __GFP_COMP))
  		prep_compound_page(page, order);
 diff --git a/mm/percpu.c b/mm/percpu.c
-index 5c29750..99f6386 100644
+index e29a1c4..e7f90f0 100644
 --- a/mm/percpu.c
 +++ b/mm/percpu.c
 @@ -121,7 +121,7 @@ static unsigned int pcpu_low_unit_cpu __read_mostly;
@@ -99040,7 +98945,7 @@ index f3f6fd3..0d91a63 100644
  
  /*
 diff --git a/mm/shmem.c b/mm/shmem.c
-index 1371021..7104960 100644
+index 83efac6..7104960 100644
 --- a/mm/shmem.c
 +++ b/mm/shmem.c
 @@ -31,7 +31,7 @@
@@ -99061,19 +98966,7 @@ index 1371021..7104960 100644
  
  /*
   * vmtruncate_range() communicates with shmem_fault via
-@@ -1719,8 +1719,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct
- 
- 	if (new_dentry->d_inode) {
- 		(void) shmem_unlink(new_dir, new_dentry);
--		if (they_are_dirs)
-+		if (they_are_dirs) {
-+			drop_nlink(new_dentry->d_inode);
- 			drop_nlink(old_dir);
-+		}
- 	} else if (they_are_dirs) {
- 		drop_nlink(old_dir);
- 		inc_nlink(new_dir);
-@@ -1924,6 +1926,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
+@@ -1926,6 +1926,11 @@ static const struct xattr_handler *shmem_xattr_handlers[] = {
  static int shmem_xattr_validate(const char *name)
  {
  	struct { const char *prefix; size_t len; } arr[] = {
@@ -99085,7 +98978,7 @@ index 1371021..7104960 100644
  		{ XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN },
  		{ XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN }
  	};
-@@ -1977,6 +1984,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
+@@ -1979,6 +1984,15 @@ static int shmem_setxattr(struct dentry *dentry, const char *name,
  	if (err)
  		return err;
  
@@ -99101,7 +98994,7 @@ index 1371021..7104960 100644
  	if (size == 0)
  		value = "";  /* empty EA, do not remove */
  
-@@ -2310,8 +2326,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
+@@ -2312,8 +2326,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent)
  	int err = -ENOMEM;
  
  	/* Round up to L1_CACHE_BYTES to resist false sharing */
@@ -101690,360 +101583,6 @@ index ba873c3..3b00036 100644
  
  	if (!can_dir) {
  		printk(KERN_INFO "can: failed to create /proc/net/can . "
-diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
-index 1587dc6..9898d1f 100644
---- a/net/ceph/auth_x.c
-+++ b/net/ceph/auth_x.c
-@@ -13,8 +13,6 @@
- #include "auth_x.h"
- #include "auth_x_protocol.h"
- 
--#define TEMP_TICKET_BUF_LEN	256
--
- static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
- 
- static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
-@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret,
- }
- 
- static int ceph_x_decrypt(struct ceph_crypto_key *secret,
--			  void **p, void *end, void *obuf, size_t olen)
-+			  void **p, void *end, void **obuf, size_t olen)
- {
- 	struct ceph_x_encrypt_header head;
- 	size_t head_len = sizeof(head);
-@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
- 		return -EINVAL;
- 
- 	dout("ceph_x_decrypt len %d\n", len);
--	ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
--			    *p, len);
-+	if (*obuf == NULL) {
-+		*obuf = kmalloc(len, GFP_NOFS);
-+		if (!*obuf)
-+			return -ENOMEM;
-+		olen = len;
-+	}
-+
-+	ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
- 	if (ret)
- 		return ret;
- 	if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
-@@ -129,145 +133,154 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
- 	kfree(th);
- }
- 
-+static int process_one_ticket(struct ceph_auth_client *ac,
-+			      struct ceph_crypto_key *secret,
-+			      void **p, void *end)
-+{
-+	struct ceph_x_info *xi = ac->private;
-+	int type;
-+	u8 tkt_struct_v, blob_struct_v;
-+	struct ceph_x_ticket_handler *th;
-+	void *dbuf = NULL;
-+	void *dp, *dend;
-+	int dlen;
-+	char is_enc;
-+	struct timespec validity;
-+	struct ceph_crypto_key old_key;
-+	void *ticket_buf = NULL;
-+	void *tp, *tpend;
-+	struct ceph_timespec new_validity;
-+	struct ceph_crypto_key new_session_key;
-+	struct ceph_buffer *new_ticket_blob;
-+	unsigned long new_expires, new_renew_after;
-+	u64 new_secret_id;
-+	int ret;
-+
-+	ceph_decode_need(p, end, sizeof(u32) + 1, bad);
-+
-+	type = ceph_decode_32(p);
-+	dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
-+
-+	tkt_struct_v = ceph_decode_8(p);
-+	if (tkt_struct_v != 1)
-+		goto bad;
-+
-+	th = get_ticket_handler(ac, type);
-+	if (IS_ERR(th)) {
-+		ret = PTR_ERR(th);
-+		goto out;
-+	}
-+
-+	/* blob for me */
-+	dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
-+	if (dlen <= 0) {
-+		ret = dlen;
-+		goto out;
-+	}
-+	dout(" decrypted %d bytes\n", dlen);
-+	dp = dbuf;
-+	dend = dp + dlen;
-+
-+	tkt_struct_v = ceph_decode_8(&dp);
-+	if (tkt_struct_v != 1)
-+		goto bad;
-+
-+	memcpy(&old_key, &th->session_key, sizeof(old_key));
-+	ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
-+	if (ret)
-+		goto out;
-+
-+	ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
-+	ceph_decode_timespec(&validity, &new_validity);
-+	new_expires = get_seconds() + validity.tv_sec;
-+	new_renew_after = new_expires - (validity.tv_sec / 4);
-+	dout(" expires=%lu renew_after=%lu\n", new_expires,
-+	     new_renew_after);
-+
-+	/* ticket blob for service */
-+	ceph_decode_8_safe(p, end, is_enc, bad);
-+	if (is_enc) {
-+		/* encrypted */
-+		dout(" encrypted ticket\n");
-+		dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
-+		if (dlen < 0) {
-+			ret = dlen;
-+			goto out;
-+		}
-+		tp = ticket_buf;
-+		dlen = ceph_decode_32(&tp);
-+	} else {
-+		/* unencrypted */
-+		ceph_decode_32_safe(p, end, dlen, bad);
-+		ticket_buf = kmalloc(dlen, GFP_NOFS);
-+		if (!ticket_buf) {
-+			ret = -ENOMEM;
-+			goto out;
-+		}
-+		tp = ticket_buf;
-+		ceph_decode_need(p, end, dlen, bad);
-+		ceph_decode_copy(p, ticket_buf, dlen);
-+	}
-+	tpend = tp + dlen;
-+	dout(" ticket blob is %d bytes\n", dlen);
-+	ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
-+	blob_struct_v = ceph_decode_8(&tp);
-+	new_secret_id = ceph_decode_64(&tp);
-+	ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
-+	if (ret)
-+		goto out;
-+
-+	/* all is well, update our ticket */
-+	ceph_crypto_key_destroy(&th->session_key);
-+	if (th->ticket_blob)
-+		ceph_buffer_put(th->ticket_blob);
-+	th->session_key = new_session_key;
-+	th->ticket_blob = new_ticket_blob;
-+	th->validity = new_validity;
-+	th->secret_id = new_secret_id;
-+	th->expires = new_expires;
-+	th->renew_after = new_renew_after;
-+	dout(" got ticket service %d (%s) secret_id %lld len %d\n",
-+	     type, ceph_entity_type_name(type), th->secret_id,
-+	     (int)th->ticket_blob->vec.iov_len);
-+	xi->have_keys |= th->service;
-+
-+out:
-+	kfree(ticket_buf);
-+	kfree(dbuf);
-+	return ret;
-+
-+bad:
-+	ret = -EINVAL;
-+	goto out;
-+}
-+
- static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
- 				    struct ceph_crypto_key *secret,
- 				    void *buf, void *end)
- {
--	struct ceph_x_info *xi = ac->private;
--	int num;
- 	void *p = buf;
--	int ret;
--	char *dbuf;
--	char *ticket_buf;
- 	u8 reply_struct_v;
-+	u32 num;
-+	int ret;
- 
--	dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
--	if (!dbuf)
--		return -ENOMEM;
--
--	ret = -ENOMEM;
--	ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
--	if (!ticket_buf)
--		goto out_dbuf;
--
--	ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
--	reply_struct_v = ceph_decode_8(&p);
-+	ceph_decode_8_safe(&p, end, reply_struct_v, bad);
- 	if (reply_struct_v != 1)
--		goto bad;
--	num = ceph_decode_32(&p);
-+		return -EINVAL;
-+
-+	ceph_decode_32_safe(&p, end, num, bad);
- 	dout("%d tickets\n", num);
-+
- 	while (num--) {
--		int type;
--		u8 tkt_struct_v, blob_struct_v;
--		struct ceph_x_ticket_handler *th;
--		void *dp, *dend;
--		int dlen;
--		char is_enc;
--		struct timespec validity;
--		struct ceph_crypto_key old_key;
--		void *tp, *tpend;
--		struct ceph_timespec new_validity;
--		struct ceph_crypto_key new_session_key;
--		struct ceph_buffer *new_ticket_blob;
--		unsigned long new_expires, new_renew_after;
--		u64 new_secret_id;
--
--		ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
--
--		type = ceph_decode_32(&p);
--		dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
--
--		tkt_struct_v = ceph_decode_8(&p);
--		if (tkt_struct_v != 1)
--			goto bad;
--
--		th = get_ticket_handler(ac, type);
--		if (IS_ERR(th)) {
--			ret = PTR_ERR(th);
--			goto out;
--		}
--
--		/* blob for me */
--		dlen = ceph_x_decrypt(secret, &p, end, dbuf,
--				      TEMP_TICKET_BUF_LEN);
--		if (dlen <= 0) {
--			ret = dlen;
--			goto out;
--		}
--		dout(" decrypted %d bytes\n", dlen);
--		dend = dbuf + dlen;
--		dp = dbuf;
--
--		tkt_struct_v = ceph_decode_8(&dp);
--		if (tkt_struct_v != 1)
--			goto bad;
--
--		memcpy(&old_key, &th->session_key, sizeof(old_key));
--		ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
-+		ret = process_one_ticket(ac, secret, &p, end);
- 		if (ret)
--			goto out;
--
--		ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
--		ceph_decode_timespec(&validity, &new_validity);
--		new_expires = get_seconds() + validity.tv_sec;
--		new_renew_after = new_expires - (validity.tv_sec / 4);
--		dout(" expires=%lu renew_after=%lu\n", new_expires,
--		     new_renew_after);
--
--		/* ticket blob for service */
--		ceph_decode_8_safe(&p, end, is_enc, bad);
--		tp = ticket_buf;
--		if (is_enc) {
--			/* encrypted */
--			dout(" encrypted ticket\n");
--			dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
--					      TEMP_TICKET_BUF_LEN);
--			if (dlen < 0) {
--				ret = dlen;
--				goto out;
--			}
--			dlen = ceph_decode_32(&tp);
--		} else {
--			/* unencrypted */
--			ceph_decode_32_safe(&p, end, dlen, bad);
--			ceph_decode_need(&p, end, dlen, bad);
--			ceph_decode_copy(&p, ticket_buf, dlen);
--		}
--		tpend = tp + dlen;
--		dout(" ticket blob is %d bytes\n", dlen);
--		ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
--		blob_struct_v = ceph_decode_8(&tp);
--		new_secret_id = ceph_decode_64(&tp);
--		ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
--		if (ret)
--			goto out;
--
--		/* all is well, update our ticket */
--		ceph_crypto_key_destroy(&th->session_key);
--		if (th->ticket_blob)
--			ceph_buffer_put(th->ticket_blob);
--		th->session_key = new_session_key;
--		th->ticket_blob = new_ticket_blob;
--		th->validity = new_validity;
--		th->secret_id = new_secret_id;
--		th->expires = new_expires;
--		th->renew_after = new_renew_after;
--		dout(" got ticket service %d (%s) secret_id %lld len %d\n",
--		     type, ceph_entity_type_name(type), th->secret_id,
--		     (int)th->ticket_blob->vec.iov_len);
--		xi->have_keys |= th->service;
-+			return ret;
- 	}
- 
--	ret = 0;
--out:
--	kfree(ticket_buf);
--out_dbuf:
--	kfree(dbuf);
--	return ret;
-+	return 0;
- 
- bad:
--	ret = -EINVAL;
--	goto out;
-+	return -EINVAL;
- }
- 
- static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
-@@ -563,13 +576,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
- 	struct ceph_x_ticket_handler *th;
- 	int ret = 0;
- 	struct ceph_x_authorize_reply reply;
-+	void *preply = &reply;
- 	void *p = au->reply_buf;
- 	void *end = p + sizeof(au->reply_buf);
- 
- 	th = get_ticket_handler(ac, au->service);
- 	if (IS_ERR(th))
- 		return PTR_ERR(th);
--	ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
-+	ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
- 	if (ret < 0)
- 		return ret;
- 	if (ret != sizeof(reply))
-diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
-index 0b62dea..c2b8d20 100644
---- a/net/ceph/mon_client.c
-+++ b/net/ceph/mon_client.c
-@@ -987,7 +987,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
- 	if (!m) {
- 		pr_info("alloc_msg unknown type %d\n", type);
- 		*skip = 1;
-+	} else if (front_len > m->front_max) {
-+		pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
-+			   front_len, m->front_max,
-+			   (unsigned int)con->peer_name.type,
-+			   le64_to_cpu(con->peer_name.num));
-+		ceph_msg_put(m);
-+		m = ceph_msg_new(type, front_len, GFP_NOFS, false);
- 	}
-+
- 	return m;
- }
- 
 diff --git a/net/compat.c b/net/compat.c
 index 759e542..7cf6606 100644
 --- a/net/compat.c
@@ -103817,10 +103356,10 @@ index 75fea1f..a26be5a 100644
  	.exit = raw_exit_net,
  };
 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
-index d361dc0..a814666 100644
+index 8e79a9e..3767dfd 100644
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
-@@ -313,7 +313,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
+@@ -316,7 +316,7 @@ static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
  
  static inline int rt_genid(struct net *net)
  {
@@ -103829,7 +103368,7 @@ index d361dc0..a814666 100644
  }
  
  #ifdef CONFIG_PROC_FS
-@@ -551,7 +551,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
+@@ -554,7 +554,7 @@ static const struct seq_operations rt_cpu_seq_ops = {
  
  static int rt_cpu_seq_open(struct inode *inode, struct file *file)
  {
@@ -103838,7 +103377,7 @@ index d361dc0..a814666 100644
  }
  
  static const struct file_operations rt_cpu_seq_fops = {
-@@ -589,7 +589,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
+@@ -592,7 +592,7 @@ static int rt_acct_proc_show(struct seq_file *m, void *v)
  
  static int rt_acct_proc_open(struct inode *inode, struct file *file)
  {
@@ -103847,7 +103386,7 @@ index d361dc0..a814666 100644
  }
  
  static const struct file_operations rt_acct_proc_fops = {
-@@ -641,7 +641,7 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
+@@ -644,7 +644,7 @@ static void __net_exit ip_rt_do_proc_exit(struct net *net)
  #endif
  }
  
@@ -103856,7 +103395,7 @@ index d361dc0..a814666 100644
  	.init = ip_rt_do_proc_init,
  	.exit = ip_rt_do_proc_exit,
  };
-@@ -937,7 +937,7 @@ static void rt_cache_invalidate(struct net *net)
+@@ -940,7 +940,7 @@ static void rt_cache_invalidate(struct net *net)
  	unsigned char shuffle;
  
  	get_random_bytes(&shuffle, sizeof(shuffle));
@@ -103865,7 +103404,7 @@ index d361dc0..a814666 100644
  	redirect_genid++;
  	inetpeer_invalidate_tree(AF_INET);
  }
-@@ -1346,11 +1346,11 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
+@@ -1372,11 +1372,11 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
  
  #define IP_IDENTS_SZ 2048u
  struct ip_ident_bucket {
@@ -103879,7 +103418,7 @@ index d361dc0..a814666 100644
  
  /* In order to protect privacy, we add a perturbation to identifiers
   * if one generator is seldom used. This makes hard for an attacker
-@@ -1370,7 +1370,7 @@ u32 ip_idents_reserve(u32 hash, int segs)
+@@ -1396,7 +1396,7 @@ u32 ip_idents_reserve(u32 hash, int segs)
  		delta = (u32)(x >> 32);
  	}
  
@@ -103888,7 +103427,7 @@ index d361dc0..a814666 100644
  }
  EXPORT_SYMBOL(ip_idents_reserve);
  
-@@ -3228,7 +3228,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
+@@ -3254,7 +3254,7 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
  {
  	if (write) {
  		int flush_delay;
@@ -103897,7 +103436,7 @@ index d361dc0..a814666 100644
  		struct net *net;
  
  		memcpy(&ctl, __ctl, sizeof(ctl));
-@@ -3377,6 +3377,7 @@ static struct ctl_table ipv4_route_flush_table[] = {
+@@ -3403,6 +3403,7 @@ static struct ctl_table ipv4_route_flush_table[] = {
  		.maxlen		= sizeof(int),
  		.mode		= 0200,
  		.proc_handler	= ipv4_sysctl_rtcache_flush,
@@ -103905,7 +103444,7 @@ index d361dc0..a814666 100644
  	},
  	{ },
  };
-@@ -3390,25 +3391,23 @@ static __net_initdata struct ctl_path ipv4_route_path[] = {
+@@ -3416,25 +3417,23 @@ static __net_initdata struct ctl_path ipv4_route_path[] = {
  
  static __net_init int sysctl_route_net_init(struct net *net)
  {
@@ -103938,7 +103477,7 @@ index d361dc0..a814666 100644
  err_dup:
  	return -ENOMEM;
  }
-@@ -3423,7 +3422,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
+@@ -3449,7 +3448,7 @@ static __net_exit void sysctl_route_net_exit(struct net *net)
  	kfree(tbl);
  }
  
@@ -103947,7 +103486,7 @@ index d361dc0..a814666 100644
  	.init = sysctl_route_net_init,
  	.exit = sysctl_route_net_exit,
  };
-@@ -3438,7 +3437,7 @@ static __net_init int rt_genid_init(struct net *net)
+@@ -3464,7 +3463,7 @@ static __net_init int rt_genid_init(struct net *net)
  	return 0;
  }
  
@@ -103956,7 +103495,7 @@ index d361dc0..a814666 100644
  	.init = rt_genid_init,
  };
  
-@@ -3461,11 +3460,7 @@ int __init ip_rt_init(void)
+@@ -3487,11 +3486,7 @@ int __init ip_rt_init(void)
  {
  	int rc = 0;
  
@@ -104613,7 +104152,7 @@ index a0b4c5d..a5818a1 100644
  }
  
 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index b9edff0..63ad6cf 100644
+index 3afdd78..cf4a70f 100644
 --- a/net/ipv6/addrconf.c
 +++ b/net/ipv6/addrconf.c
 @@ -2160,7 +2160,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
@@ -104625,7 +104164,7 @@ index b9edff0..63ad6cf 100644
  
  		if (ops->ndo_do_ioctl) {
  			mm_segment_t oldfs = get_fs();
-@@ -3227,16 +3227,23 @@ static const struct file_operations if6_fops = {
+@@ -3237,16 +3237,23 @@ static const struct file_operations if6_fops = {
  	.release	= seq_release_net,
  };
  
@@ -105155,7 +104694,7 @@ index c69358c..d1e5855 100644
  
  static int tcp6_seq_show(struct seq_file *seq, void *v)
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index f8bec1e..e2c60f8 100644
+index d131a95..e2c60f8 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -50,6 +50,10 @@
@@ -105206,15 +104745,6 @@ index f8bec1e..e2c60f8 100644
  		bh_unlock_sock(sk);
  		sock_put(sk);
  		goto discard;
-@@ -1362,7 +1369,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
- 	fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
- 	fptr->nexthdr = nexthdr;
- 	fptr->reserved = 0;
--	ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
-+	fptr->identification = skb_shinfo(skb)->ip6_frag_id;
- 
- 	/* Fragment the skb. ipv6 header and the remaining fields of the
- 	 * fragment header are updated in ipv6_gso_segment()
 @@ -1409,8 +1416,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
  		   0, 0L, 0,
  		   sock_i_uid(sp), 0,
@@ -105831,7 +105361,7 @@ index e13095d..6617217 100644
  		[IPSET_ATTR_CIDR]	= { .type = NLA_U8 },
  		[IPSET_ATTR_TIMEOUT]	= { .type = NLA_U32 },
 diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c
-index 29fa5ba..8debc79 100644
+index 6422845..2c19968 100644
 --- a/net/netfilter/ipvs/ip_vs_conn.c
 +++ b/net/netfilter/ipvs/ip_vs_conn.c
 @@ -556,7 +556,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, struct ip_vs_dest *dest)
@@ -105843,7 +105373,7 @@ index 29fa5ba..8debc79 100644
  	if (cp->protocol != IPPROTO_UDP)
  		conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
  	/* Bind with the destination and its corresponding transmitter */
-@@ -869,7 +869,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
+@@ -868,7 +868,7 @@ ip_vs_conn_new(const struct ip_vs_conn_param *p,
  	atomic_set(&cp->refcnt, 1);
  
  	atomic_set(&cp->n_control, 0);
@@ -105852,7 +105382,7 @@ index 29fa5ba..8debc79 100644
  
  	atomic_inc(&ipvs->conn_count);
  	if (flags & IP_VS_CONN_F_NO_CPORT)
-@@ -1149,7 +1149,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
+@@ -1148,7 +1148,7 @@ static inline int todrop_entry(struct ip_vs_conn *cp)
  
  	/* Don't drop the entry if its number of incoming packets is not
  	   located in [0, 8] */
diff --git a/3.2.63/4425_grsec_remove_EI_PAX.patch b/3.2.64/4425_grsec_remove_EI_PAX.patch
index cf65d90..cf65d90 100644
--- a/3.2.63/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.64/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.63/4427_force_XATTR_PAX_tmpfs.patch b/3.2.64/4427_force_XATTR_PAX_tmpfs.patch
index caaeed1..caaeed1 100644
--- a/3.2.63/4427_force_XATTR_PAX_tmpfs.patch
+++ b/3.2.64/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.63/4430_grsec-remove-localversion-grsec.patch b/3.2.64/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/3.2.63/4430_grsec-remove-localversion-grsec.patch
+++ b/3.2.64/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.63/4435_grsec-mute-warnings.patch b/3.2.64/4435_grsec-mute-warnings.patch
index da01ac7..da01ac7 100644
--- a/3.2.63/4435_grsec-mute-warnings.patch
+++ b/3.2.64/4435_grsec-mute-warnings.patch
diff --git a/3.2.63/4440_grsec-remove-protected-paths.patch b/3.2.64/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/3.2.63/4440_grsec-remove-protected-paths.patch
+++ b/3.2.64/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.63/4450_grsec-kconfig-default-gids.patch b/3.2.64/4450_grsec-kconfig-default-gids.patch
index b4a0e64..b4a0e64 100644
--- a/3.2.63/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.64/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.63/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.64/4465_selinux-avc_audit-log-curr_ip.patch
index ed1cb9b..ed1cb9b 100644
--- a/3.2.63/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.64/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.63/4470_disable-compat_vdso.patch b/3.2.64/4470_disable-compat_vdso.patch
index 42bc94d..42bc94d 100644
--- a/3.2.63/4470_disable-compat_vdso.patch
+++ b/3.2.64/4470_disable-compat_vdso.patch
diff --git a/3.2.63/4475_emutramp_default_on.patch b/3.2.64/4475_emutramp_default_on.patch
index 941870b..941870b 100644
--- a/3.2.63/4475_emutramp_default_on.patch
+++ b/3.2.64/4475_emutramp_default_on.patch