* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2015-05-13 16:29 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2015-05-13 16:29 UTC (permalink / raw
To: gentoo-commits
commit: 32d9b60b3ab5de17d60670b4c2aebc8843ea49ae
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed May 13 16:17:07 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed May 13 16:17:07 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=32d9b60b
Linux patch 3.4.107
0000_README | 4 +
1106_linux-3.4.107.patch | 8078 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 8082 insertions(+)
diff --git a/0000_README b/0000_README
index ba104e4..bb74c9a 100644
--- a/0000_README
+++ b/0000_README
@@ -463,6 +463,10 @@ Patch: 1105_linux-3.4.106.patch
From: http://www.kernel.org
Desc: Linux 3.4.106
+Patch: 1106_linux-3.4.107.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.107
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1106_linux-3.4.107.patch b/1106_linux-3.4.107.patch
new file mode 100644
index 0000000..0d9f7b8
--- /dev/null
+++ b/1106_linux-3.4.107.patch
@@ -0,0 +1,8078 @@
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 63740dae90a0..c7523c419c88 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -979,6 +979,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ i8042.notimeout [HW] Ignore timeout condition signalled by controller
+ i8042.reset [HW] Reset the controller during init and cleanup
+ i8042.unlock [HW] Unlock (ignore) the keylock
++ i8042.kbdreset [HW] Reset device connected to KBD port
+
+ i810= [HW,DRM]
+
+diff --git a/Makefile b/Makefile
+index 649f1462ebf8..f53f41a8dd09 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 106
++SUBLEVEL = 107
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/alpha/mm/fault.c b/arch/alpha/mm/fault.c
+index 5eecab1a84ef..f153733fb938 100644
+--- a/arch/alpha/mm/fault.c
++++ b/arch/alpha/mm/fault.c
+@@ -149,6 +149,8 @@ do_page_fault(unsigned long address, unsigned long mmcsr,
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/arm/mm/proc-xscale.S b/arch/arm/mm/proc-xscale.S
+index 98821530ae70..98646d0808ab 100644
+--- a/arch/arm/mm/proc-xscale.S
++++ b/arch/arm/mm/proc-xscale.S
+@@ -531,7 +531,7 @@ ENTRY(cpu_xscale_do_suspend)
+ mrc p15, 0, r5, c15, c1, 0 @ CP access reg
+ mrc p15, 0, r6, c13, c0, 0 @ PID
+ mrc p15, 0, r7, c3, c0, 0 @ domain ID
+- mrc p15, 0, r8, c1, c1, 0 @ auxiliary control reg
++ mrc p15, 0, r8, c1, c0, 1 @ auxiliary control reg
+ mrc p15, 0, r9, c1, c0, 0 @ control reg
+ bic r4, r4, #2 @ clear frequency change bit
+ stmia r0, {r4 - r9} @ store cp regs
+@@ -548,7 +548,7 @@ ENTRY(cpu_xscale_do_resume)
+ mcr p15, 0, r6, c13, c0, 0 @ PID
+ mcr p15, 0, r7, c3, c0, 0 @ domain ID
+ mcr p15, 0, r1, c2, c0, 0 @ translation table base addr
+- mcr p15, 0, r8, c1, c1, 0 @ auxiliary control reg
++ mcr p15, 0, r8, c1, c0, 1 @ auxiliary control reg
+ mov r0, r9 @ control register
+ b cpu_resume_mmu
+ ENDPROC(cpu_xscale_do_resume)
+diff --git a/arch/avr32/mm/fault.c b/arch/avr32/mm/fault.c
+index f7040a1e399f..632b649c7be0 100644
+--- a/arch/avr32/mm/fault.c
++++ b/arch/avr32/mm/fault.c
+@@ -136,6 +136,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/cris/mm/fault.c b/arch/cris/mm/fault.c
+index b4760d86e1bb..b07c00c01696 100644
+--- a/arch/cris/mm/fault.c
++++ b/arch/cris/mm/fault.c
+@@ -167,6 +167,8 @@ do_page_fault(unsigned long address, struct pt_regs *regs,
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/frv/mm/fault.c b/arch/frv/mm/fault.c
+index 331c1e2cfb67..854549617dd2 100644
+--- a/arch/frv/mm/fault.c
++++ b/arch/frv/mm/fault.c
+@@ -166,6 +166,8 @@ asmlinkage void do_page_fault(int datammu, unsigned long esr0, unsigned long ear
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/ia64/mm/fault.c b/arch/ia64/mm/fault.c
+index 02d29c2a132a..3c820ea4212f 100644
+--- a/arch/ia64/mm/fault.c
++++ b/arch/ia64/mm/fault.c
+@@ -162,6 +162,8 @@ ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *re
+ */
+ if (fault & VM_FAULT_OOM) {
+ goto out_of_memory;
++ } else if (fault & VM_FAULT_SIGSEGV) {
++ goto bad_area;
+ } else if (fault & VM_FAULT_SIGBUS) {
+ signal = SIGBUS;
+ goto bad_area;
+diff --git a/arch/m32r/mm/fault.c b/arch/m32r/mm/fault.c
+index 3cdfa9c1d091..06827fc92bbf 100644
+--- a/arch/m32r/mm/fault.c
++++ b/arch/m32r/mm/fault.c
+@@ -198,6 +198,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
+index 6b020a8461e7..8646409adf5b 100644
+--- a/arch/m68k/mm/fault.c
++++ b/arch/m68k/mm/fault.c
+@@ -146,6 +146,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto map_err;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto bus_err;
+ BUG();
+diff --git a/arch/microblaze/mm/fault.c b/arch/microblaze/mm/fault.c
+index c38a265846de..c7fe3da48593 100644
+--- a/arch/microblaze/mm/fault.c
++++ b/arch/microblaze/mm/fault.c
+@@ -214,6 +214,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/mips/kernel/irq_cpu.c b/arch/mips/kernel/irq_cpu.c
+index 972263bcf403..0ed44bef070d 100644
+--- a/arch/mips/kernel/irq_cpu.c
++++ b/arch/mips/kernel/irq_cpu.c
+@@ -55,6 +55,8 @@ static struct irq_chip mips_cpu_irq_controller = {
+ .irq_mask_ack = mask_mips_irq,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ /*
+@@ -91,6 +93,8 @@ static struct irq_chip mips_mt_cpu_irq_controller = {
+ .irq_mask_ack = mips_mt_cpu_irq_ack,
+ .irq_unmask = unmask_mips_irq,
+ .irq_eoi = unmask_mips_irq,
++ .irq_disable = mask_mips_irq,
++ .irq_enable = unmask_mips_irq,
+ };
+
+ void __init mips_cpu_irq_init(void)
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index ba9376bf52a1..7c2c1afe73f3 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -105,10 +105,10 @@ asmlinkage __cpuinit void start_secondary(void)
+ if ((read_c0_tcbind() & TCBIND_CURTC) == 0)
+ #endif /* CONFIG_MIPS_MT_SMTC */
+ cpu_probe();
+- cpu_report();
+ per_cpu_trap_init();
+ mips_clockevent_init();
+ mp_ops->init_secondary();
++ cpu_report();
+
+ /*
+ * XXX parity protection should be folded in here when it's converted
+diff --git a/arch/mips/loongson/common/Makefile b/arch/mips/loongson/common/Makefile
+index e526488df655..ce415f70ca86 100644
+--- a/arch/mips/loongson/common/Makefile
++++ b/arch/mips/loongson/common/Makefile
+@@ -10,7 +10,8 @@ obj-$(CONFIG_GENERIC_GPIO) += gpio.o
+ # Serial port support
+ #
+ obj-$(CONFIG_EARLY_PRINTK) += early_printk.o
+-obj-$(CONFIG_SERIAL_8250) += serial.o
++loongson-serial-$(CONFIG_SERIAL_8250) := serial.o
++obj-y += $(loongson-serial-m) $(loongson-serial-y)
+ obj-$(CONFIG_LOONGSON_UART_BASE) += uart_base.o
+ obj-$(CONFIG_LOONGSON_MC146818) += rtc.o
+
+diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
+index c14f6dfed995..5c9ba6a536d1 100644
+--- a/arch/mips/mm/fault.c
++++ b/arch/mips/mm/fault.c
+@@ -155,6 +155,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/mn10300/mm/fault.c b/arch/mn10300/mm/fault.c
+index 90f346f7392d..eb411b3cd7e9 100644
+--- a/arch/mn10300/mm/fault.c
++++ b/arch/mn10300/mm/fault.c
+@@ -255,6 +255,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/openrisc/mm/fault.c b/arch/openrisc/mm/fault.c
+index a5dce82f864b..162abfbced69 100644
+--- a/arch/openrisc/mm/fault.c
++++ b/arch/openrisc/mm/fault.c
+@@ -163,6 +163,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index 18162ce4261e..a9b765a999ef 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -210,6 +210,8 @@ good_area:
+ */
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto bad_area;
+ BUG();
+diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
+index 08ffcf52a856..3d30a4af627f 100644
+--- a/arch/powerpc/mm/fault.c
++++ b/arch/powerpc/mm/fault.c
+@@ -419,7 +419,11 @@ good_area:
+ */
+ fault = handle_mm_fault(mm, vma, address, flags);
+ if (unlikely(fault & (VM_FAULT_RETRY|VM_FAULT_ERROR))) {
+- int rc = mm_fault_error(regs, address, fault);
++ int rc;
++
++ if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
++ rc = mm_fault_error(regs, address, fault);
+ if (rc >= MM_FAULT_RETURN)
+ return rc;
+ }
+diff --git a/arch/powerpc/platforms/cell/spu_fault.c b/arch/powerpc/platforms/cell/spu_fault.c
+index 641e7273d75a..62f3e4e48a0b 100644
+--- a/arch/powerpc/platforms/cell/spu_fault.c
++++ b/arch/powerpc/platforms/cell/spu_fault.c
+@@ -75,7 +75,7 @@ int spu_handle_mm_fault(struct mm_struct *mm, unsigned long ea,
+ if (*flt & VM_FAULT_OOM) {
+ ret = -ENOMEM;
+ goto out_unlock;
+- } else if (*flt & VM_FAULT_SIGBUS) {
++ } else if (*flt & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV)) {
+ ret = -EFAULT;
+ goto out_unlock;
+ }
+diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
+index ad697f84b945..7c8557662198 100644
+--- a/arch/powerpc/platforms/cell/spufs/inode.c
++++ b/arch/powerpc/platforms/cell/spufs/inode.c
+@@ -164,7 +164,7 @@ static void spufs_prune_dir(struct dentry *dir)
+ struct dentry *dentry, *tmp;
+
+ mutex_lock(&dir->d_inode->i_mutex);
+- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+ spin_lock(&dentry->d_lock);
+ if (!(d_unhashed(dentry)) && dentry->d_inode) {
+ dget_dlock(dentry);
+@@ -222,7 +222,7 @@ out:
+ * - free child's inode if possible
+ * - free child
+ */
+- list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_u.d_child) {
++ list_for_each_entry_safe(dentry, tmp, &dir->d_subdirs, d_child) {
+ dput(dentry);
+ }
+
+diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
+index eab3492a45c5..7729c6c07d60 100644
+--- a/arch/powerpc/xmon/xmon.c
++++ b/arch/powerpc/xmon/xmon.c
+@@ -285,10 +285,11 @@ static inline void disable_surveillance(void)
+ args.token = rtas_token("set-indicator");
+ if (args.token == RTAS_UNKNOWN_SERVICE)
+ return;
+- args.nargs = 3;
+- args.nret = 1;
++ args.token = cpu_to_be32(args.token);
++ args.nargs = cpu_to_be32(3);
++ args.nret = cpu_to_be32(1);
+ args.rets = &args.args[3];
+- args.args[0] = SURVEILLANCE_TOKEN;
++ args.args[0] = cpu_to_be32(SURVEILLANCE_TOKEN);
+ args.args[1] = 0;
+ args.args[2] = 0;
+ enter_rtas(__pa(&args));
+diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
+index f2b11ee3fb3a..68ba1bb834bb 100644
+--- a/arch/s390/mm/fault.c
++++ b/arch/s390/mm/fault.c
+@@ -237,6 +237,12 @@ static noinline void do_fault_error(struct pt_regs *regs, int fault)
+ do_no_context(regs);
+ else
+ pagefault_out_of_memory();
++ } else if (fault & VM_FAULT_SIGSEGV) {
++ /* Kernel mode? Handle exceptions or die */
++ if (!user_mode(regs))
++ do_no_context(regs);
++ else
++ do_sigsegv(regs, SEGV_MAPERR);
+ } else if (fault & VM_FAULT_SIGBUS) {
+ /* Kernel mode? Handle exceptions or die */
+ if (!(regs->psw.mask & PSW_MASK_PSTATE))
+diff --git a/arch/score/mm/fault.c b/arch/score/mm/fault.c
+index 47b600e4b2c5..b3744ca70be6 100644
+--- a/arch/score/mm/fault.c
++++ b/arch/score/mm/fault.c
+@@ -110,6 +110,8 @@ survive:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/sh/mm/fault_32.c b/arch/sh/mm/fault_32.c
+index e99b104d967a..a4919631ce03 100644
+--- a/arch/sh/mm/fault_32.c
++++ b/arch/sh/mm/fault_32.c
+@@ -206,6 +206,8 @@ good_area:
+ goto out_of_memory;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ BUG();
+ }
+ if (fault & VM_FAULT_MAJOR) {
+diff --git a/arch/sh/mm/tlbflush_64.c b/arch/sh/mm/tlbflush_64.c
+index 11c5a18f10ed..92f0df95cf83 100644
+--- a/arch/sh/mm/tlbflush_64.c
++++ b/arch/sh/mm/tlbflush_64.c
+@@ -194,6 +194,8 @@ good_area:
+ goto out_of_memory;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ BUG();
+ }
+
+diff --git a/arch/sparc/mm/fault_32.c b/arch/sparc/mm/fault_32.c
+index df3155a17991..5c6238d72076 100644
+--- a/arch/sparc/mm/fault_32.c
++++ b/arch/sparc/mm/fault_32.c
+@@ -300,6 +300,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
+index 1387acafc62c..0dc7b9094a29 100644
+--- a/arch/sparc/mm/fault_64.c
++++ b/arch/sparc/mm/fault_64.c
+@@ -443,6 +443,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/tile/mm/fault.c b/arch/tile/mm/fault.c
+index 22e58f51ed23..a362926d513a 100644
+--- a/arch/tile/mm/fault.c
++++ b/arch/tile/mm/fault.c
+@@ -433,6 +433,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/arch/um/kernel/trap.c b/arch/um/kernel/trap.c
+index dafc94715950..f79ffc901d0e 100644
+--- a/arch/um/kernel/trap.c
++++ b/arch/um/kernel/trap.c
+@@ -69,6 +69,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM) {
+ goto out_of_memory;
++ } else if (fault & VM_FAULT_SIGSEGV) {
++ goto out;
+ } else if (fault & VM_FAULT_SIGBUS) {
+ err = -EACCES;
+ goto out;
+diff --git a/arch/x86/include/asm/ldt.h b/arch/x86/include/asm/ldt.h
+index 46727eb37bfe..6e1aaf73852a 100644
+--- a/arch/x86/include/asm/ldt.h
++++ b/arch/x86/include/asm/ldt.h
+@@ -28,6 +28,13 @@ struct user_desc {
+ unsigned int seg_not_present:1;
+ unsigned int useable:1;
+ #ifdef __x86_64__
++ /*
++ * Because this bit is not present in 32-bit user code, user
++ * programs can pass uninitialized values here. Therefore, in
++ * any context in which a user_desc comes from a 32-bit program,
++ * the kernel must act as though lm == 0, regardless of the
++ * actual value.
++ */
+ unsigned int lm:1;
+ #endif
+ };
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index ccb805966f68..e92e1e4d7a5e 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -130,6 +130,7 @@
+ #define MSR_AMD64_PATCH_LOADER 0xc0010020
+ #define MSR_AMD64_OSVW_ID_LENGTH 0xc0010140
+ #define MSR_AMD64_OSVW_STATUS 0xc0010141
++#define MSR_AMD64_LS_CFG 0xc0011020
+ #define MSR_AMD64_DC_CFG 0xc0011022
+ #define MSR_AMD64_IBSFETCHCTL 0xc0011030
+ #define MSR_AMD64_IBSFETCHLINAD 0xc0011031
+diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
+index a9c8a46dd7d3..5beec8abd37e 100644
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -417,6 +417,16 @@ static void __cpuinit early_init_amd_mc(struct cpuinfo_x86 *c)
+
+ c->x86_coreid_bits = bits;
+ #endif
++
++ /* F16h erratum 793, CVE-2013-6885 */
++ if (c->x86 == 0x16 && c->x86_model <= 0xf) {
++ u64 val;
++
++ if (!rdmsrl_amd_safe(MSR_AMD64_LS_CFG, &val) &&
++ !(val & BIT(15)))
++ wrmsrl_amd_safe(MSR_AMD64_LS_CFG, val | BIT(15));
++ }
++
+ }
+
+ static void __cpuinit bsp_init_amd(struct cpuinfo_x86 *c)
+diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c
+index 646d192b18a2..c465584c2517 100644
+--- a/arch/x86/kernel/cpu/mshyperv.c
++++ b/arch/x86/kernel/cpu/mshyperv.c
+@@ -55,6 +55,7 @@ static struct clocksource hyperv_cs = {
+ .rating = 400, /* use this when running on Hyperv*/
+ .read = read_hv_clock,
+ .mask = CLOCKSOURCE_MASK(64),
++ .flags = CLOCK_SOURCE_IS_CONTINUOUS,
+ };
+
+ static void __init ms_hyperv_init_platform(void)
+diff --git a/arch/x86/kernel/kprobes.c b/arch/x86/kernel/kprobes.c
+index e213fc8408d2..15d3c454e5e3 100644
+--- a/arch/x86/kernel/kprobes.c
++++ b/arch/x86/kernel/kprobes.c
+@@ -1003,6 +1003,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
+ regs->flags &= ~X86_EFLAGS_IF;
+ trace_hardirqs_off();
+ regs->ip = (unsigned long)(jp->entry);
++
++ /*
++ * jprobes use jprobe_return() which skips the normal return
++ * path of the function, and this messes up the accounting of the
++ * function graph tracer to get messed up.
++ *
++ * Pause function graph tracing while performing the jprobe function.
++ */
++ pause_graph_tracing();
+ return 1;
+ }
+
+@@ -1028,24 +1037,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
+ struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
+ u8 *addr = (u8 *) (regs->ip - 1);
+ struct jprobe *jp = container_of(p, struct jprobe, kp);
++ void *saved_sp = kcb->jprobe_saved_sp;
+
+ if ((addr > (u8 *) jprobe_return) &&
+ (addr < (u8 *) jprobe_return_end)) {
+- if (stack_addr(regs) != kcb->jprobe_saved_sp) {
++ if (stack_addr(regs) != saved_sp) {
+ struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
+ printk(KERN_ERR
+ "current sp %p does not match saved sp %p\n",
+- stack_addr(regs), kcb->jprobe_saved_sp);
++ stack_addr(regs), saved_sp);
+ printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
+ show_registers(saved_regs);
+ printk(KERN_ERR "Current registers\n");
+ show_registers(regs);
+ BUG();
+ }
++ /* It's OK to start function graph tracing again */
++ unpause_graph_tracing();
+ *regs = kcb->jprobe_saved_regs;
+- memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
+- kcb->jprobes_stack,
+- MIN_STACK_SIZE(kcb->jprobe_saved_sp));
++ memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
+ preempt_enable_no_resched();
+ return 1;
+ }
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index 43d8b48b23e6..bb390e1ba600 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -286,24 +286,9 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+
+ fpu = switch_fpu_prepare(prev_p, next_p, cpu);
+
+- /*
+- * Reload esp0, LDT and the page table pointer:
+- */
++ /* Reload esp0 and ss1. */
+ load_sp0(tss, next);
+
+- /*
+- * Switch DS and ES.
+- * This won't pick up thread selector changes, but I guess that is ok.
+- */
+- savesegment(es, prev->es);
+- if (unlikely(next->es | prev->es))
+- loadsegment(es, next->es);
+-
+- savesegment(ds, prev->ds);
+- if (unlikely(next->ds | prev->ds))
+- loadsegment(ds, next->ds);
+-
+-
+ /* We must save %fs and %gs before load_TLS() because
+ * %fs and %gs may be cleared by load_TLS().
+ *
+@@ -312,41 +297,101 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ savesegment(fs, fsindex);
+ savesegment(gs, gsindex);
+
++ /*
++ * Load TLS before restoring any segments so that segment loads
++ * reference the correct GDT entries.
++ */
+ load_TLS(next, cpu);
+
+ /*
+- * Leave lazy mode, flushing any hypercalls made here.
+- * This must be done before restoring TLS segments so
+- * the GDT and LDT are properly updated, and must be
+- * done before math_state_restore, so the TS bit is up
+- * to date.
++ * Leave lazy mode, flushing any hypercalls made here. This
++ * must be done after loading TLS entries in the GDT but before
++ * loading segments that might reference them, and and it must
++ * be done before math_state_restore, so the TS bit is up to
++ * date.
+ */
+ arch_end_context_switch(next_p);
+
++ /* Switch DS and ES.
++ *
++ * Reading them only returns the selectors, but writing them (if
++ * nonzero) loads the full descriptor from the GDT or LDT. The
++ * LDT for next is loaded in switch_mm, and the GDT is loaded
++ * above.
++ *
++ * We therefore need to write new values to the segment
++ * registers on every context switch unless both the new and old
++ * values are zero.
++ *
++ * Note that we don't need to do anything for CS and SS, as
++ * those are saved and restored as part of pt_regs.
++ */
++ savesegment(es, prev->es);
++ if (unlikely(next->es | prev->es))
++ loadsegment(es, next->es);
++
++ savesegment(ds, prev->ds);
++ if (unlikely(next->ds | prev->ds))
++ loadsegment(ds, next->ds);
++
+ /*
+ * Switch FS and GS.
+ *
+- * Segment register != 0 always requires a reload. Also
+- * reload when it has changed. When prev process used 64bit
+- * base always reload to avoid an information leak.
++ * These are even more complicated than FS and GS: they have
++ * 64-bit bases are that controlled by arch_prctl. Those bases
++ * only differ from the values in the GDT or LDT if the selector
++ * is 0.
++ *
++ * Loading the segment register resets the hidden base part of
++ * the register to 0 or the value from the GDT / LDT. If the
++ * next base address zero, writing 0 to the segment register is
++ * much faster than using wrmsr to explicitly zero the base.
++ *
++ * The thread_struct.fs and thread_struct.gs values are 0
++ * if the fs and gs bases respectively are not overridden
++ * from the values implied by fsindex and gsindex. They
++ * are nonzero, and store the nonzero base addresses, if
++ * the bases are overridden.
++ *
++ * (fs != 0 && fsindex != 0) || (gs != 0 && gsindex != 0) should
++ * be impossible.
++ *
++ * Therefore we need to reload the segment registers if either
++ * the old or new selector is nonzero, and we need to override
++ * the base address if next thread expects it to be overridden.
++ *
++ * This code is unnecessarily slow in the case where the old and
++ * new indexes are zero and the new base is nonzero -- it will
++ * unnecessarily write 0 to the selector before writing the new
++ * base address.
++ *
++ * Note: This all depends on arch_prctl being the only way that
++ * user code can override the segment base. Once wrfsbase and
++ * wrgsbase are enabled, most of this code will need to change.
+ */
+ if (unlikely(fsindex | next->fsindex | prev->fs)) {
+ loadsegment(fs, next->fsindex);
++
+ /*
+- * Check if the user used a selector != 0; if yes
+- * clear 64bit base, since overloaded base is always
+- * mapped to the Null selector
++ * If user code wrote a nonzero value to FS, then it also
++ * cleared the overridden base address.
++ *
++ * XXX: if user code wrote 0 to FS and cleared the base
++ * address itself, we won't notice and we'll incorrectly
++ * restore the prior base address next time we reschdule
++ * the process.
+ */
+ if (fsindex)
+ prev->fs = 0;
+ }
+- /* when next process has a 64bit base use it */
+ if (next->fs)
+ wrmsrl(MSR_FS_BASE, next->fs);
+ prev->fsindex = fsindex;
+
+ if (unlikely(gsindex | next->gsindex | prev->gs)) {
+ load_gs_index(next->gsindex);
++
++ /* This works (and fails) the same way as fsindex above. */
+ if (gsindex)
+ prev->gs = 0;
+ }
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index 9d25a6eef1e1..fe2e363fa87a 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -60,6 +60,22 @@ static bool tls_desc_okay(const struct user_desc *info)
+ if (!info->seg_32bit)
+ return false;
+
++ /* Only allow data segments in the TLS array. */
++ if (info->contents > 1)
++ return false;
++
++ /*
++ * Non-present segments with DPL 3 present an interesting attack
++ * surface. The kernel should handle such segments correctly,
++ * but TLS is very difficult to protect in a sandbox, so prevent
++ * such segments from being created.
++ *
++ * If userspace needs to remove a TLS entry, it can still delete
++ * it outright.
++ */
++ if (info->seg_not_present)
++ return false;
++
+ return true;
+ }
+
+diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
+index 4a0a2e810b4b..b723f2e09f44 100644
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -887,6 +887,8 @@ mm_fault_error(struct pt_regs *regs, unsigned long error_code,
+ if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
+ VM_FAULT_HWPOISON_LARGE))
+ do_sigbus(regs, error_code, address, fault);
++ else if (fault & VM_FAULT_SIGSEGV)
++ bad_area_nosemaphore(regs, error_code, address);
+ else
+ BUG();
+ }
+diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
+index 5c1ae28825cd..75f9e5d80d02 100644
+--- a/arch/x86/mm/mmap.c
++++ b/arch/x86/mm/mmap.c
+@@ -35,12 +35,12 @@ struct __read_mostly va_alignment va_align = {
+ .flags = -1,
+ };
+
+-static unsigned int stack_maxrandom_size(void)
++static unsigned long stack_maxrandom_size(void)
+ {
+- unsigned int max = 0;
++ unsigned long max = 0;
+ if ((current->flags & PF_RANDOMIZE) &&
+ !(current->personality & ADDR_NO_RANDOMIZE)) {
+- max = ((-1U) & STACK_RND_MASK) << PAGE_SHIFT;
++ max = ((-1UL) & STACK_RND_MASK) << PAGE_SHIFT;
+ }
+
+ return max;
+diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
+index 68d1dc91b37b..bd8b159cbb53 100644
+--- a/arch/x86/um/sys_call_table_32.c
++++ b/arch/x86/um/sys_call_table_32.c
+@@ -43,7 +43,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
+
+ extern asmlinkage void sys_ni_syscall(void);
+
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ /*
+ * Smells like a compiler bug -- it doesn't work
+ * when the & below is removed.
+diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
+index 9924776f4265..cbdab949926d 100644
+--- a/arch/x86/um/sys_call_table_64.c
++++ b/arch/x86/um/sys_call_table_64.c
+@@ -48,7 +48,7 @@ typedef void (*sys_call_ptr_t)(void);
+
+ extern void sys_ni_syscall(void);
+
+-const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
++const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
+ /*
+ * Smells like a compiler bug -- it doesn't work
+ * when the & below is removed.
+diff --git a/arch/x86/vdso/vma.c b/arch/x86/vdso/vma.c
+index 00aaf047b39f..47aa1080c00a 100644
+--- a/arch/x86/vdso/vma.c
++++ b/arch/x86/vdso/vma.c
+@@ -117,23 +117,39 @@ subsys_initcall(init_vdso);
+
+ struct linux_binprm;
+
+-/* Put the vdso above the (randomized) stack with another randomized offset.
+- This way there is no hole in the middle of address space.
+- To save memory make sure it is still in the same PTE as the stack top.
+- This doesn't give that many random bits */
++/*
++ * Put the vdso above the (randomized) stack with another randomized
++ * offset. This way there is no hole in the middle of address space.
++ * To save memory make sure it is still in the same PTE as the stack
++ * top. This doesn't give that many random bits.
++ *
++ * Note that this algorithm is imperfect: the distribution of the vdso
++ * start address within a PMD is biased toward the end.
++ *
++ */
+ static unsigned long vdso_addr(unsigned long start, unsigned len)
+ {
+ unsigned long addr, end;
+ unsigned offset;
+- end = (start + PMD_SIZE - 1) & PMD_MASK;
++
++ /*
++ * Round up the start address. It can start out unaligned as a result
++ * of stack start randomization.
++ */
++ start = PAGE_ALIGN(start);
++
++ /* Round the lowest possible end address up to a PMD boundary. */
++ end = (start + len + PMD_SIZE - 1) & PMD_MASK;
+ if (end >= TASK_SIZE_MAX)
+ end = TASK_SIZE_MAX;
+ end -= len;
+- /* This loses some more bits than a modulo, but is cheaper */
+- offset = get_random_int() & (PTRS_PER_PTE - 1);
+- addr = start + (offset << PAGE_SHIFT);
+- if (addr >= end)
+- addr = end;
++
++ if (end > start) {
++ offset = get_random_int() % (((end - start) >> PAGE_SHIFT) + 1);
++ addr = start + (offset << PAGE_SHIFT);
++ } else {
++ addr = start;
++ }
+
+ /*
+ * page-align it here so that get_unmapped_area doesn't
+diff --git a/arch/xtensa/mm/fault.c b/arch/xtensa/mm/fault.c
+index b17885a0b508..b3877be25ab3 100644
+--- a/arch/xtensa/mm/fault.c
++++ b/arch/xtensa/mm/fault.c
+@@ -108,6 +108,8 @@ good_area:
+ if (unlikely(fault & VM_FAULT_ERROR)) {
+ if (fault & VM_FAULT_OOM)
+ goto out_of_memory;
++ else if (fault & VM_FAULT_SIGSEGV)
++ goto bad_area;
+ else if (fault & VM_FAULT_SIGBUS)
+ goto do_sigbus;
+ BUG();
+diff --git a/block/genhd.c b/block/genhd.c
+index 60f7e6ce76b4..7a2a8dc9bc5f 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1069,9 +1069,16 @@ int disk_expand_part_tbl(struct gendisk *disk, int partno)
+ struct disk_part_tbl *old_ptbl = disk->part_tbl;
+ struct disk_part_tbl *new_ptbl;
+ int len = old_ptbl ? old_ptbl->len : 0;
+- int target = partno + 1;
++ int i, target;
+ size_t size;
+- int i;
++
++ /*
++ * check for int overflow, since we can get here from blkpg_ioctl()
++ * with a user passed 'partno'.
++ */
++ target = partno + 1;
++ if (target < 0)
++ return -EINVAL;
+
+ /* disk_max_parts() is zero during initialization, ignore if so */
+ if (disk_max_parts(disk) && target > disk_max_parts(disk))
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index bf948e134981..6ef6e2ad344e 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -449,6 +449,9 @@ void af_alg_complete(struct crypto_async_request *req, int err)
+ {
+ struct af_alg_completion *completion = req->data;
+
++ if (err == -EINPROGRESS)
++ return;
++
+ completion->err = err;
+ complete(&completion->completion);
+ }
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index ca9a287b5864..6fc61eb07b7b 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -61,6 +61,8 @@ enum board_ids {
+ /* board IDs by feature in alphabetical order */
+ board_ahci,
+ board_ahci_ign_iferr,
++ board_ahci_nomsi,
++ board_ahci_noncq,
+ board_ahci_nosntf,
+ board_ahci_yes_fbs,
+
+@@ -121,6 +123,20 @@ static const struct ata_port_info ahci_port_info[] = {
+ .udma_mask = ATA_UDMA6,
+ .port_ops = &ahci_ops,
+ },
++ [board_ahci_nomsi] = {
++ AHCI_HFLAGS (AHCI_HFLAG_NO_MSI),
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_ops,
++ },
++ [board_ahci_noncq] = {
++ AHCI_HFLAGS (AHCI_HFLAG_NO_NCQ),
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_ops,
++ },
+ [board_ahci_nosntf] =
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_NO_SNTF),
+@@ -313,6 +329,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
++ { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
++ { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
+ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
+ { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
+@@ -469,6 +488,13 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci }, /* ASM1061 */
+ { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci }, /* ASM1062 */
+
++ /*
++ * Samsung SSDs found on some macbooks. NCQ times out if MSI is
++ * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731
++ */
++ { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
++ { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi },
++
+ /* Enmotus */
+ { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
+
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6b922365d5e9..adaf994abb79 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4712,7 +4712,10 @@ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ return NULL;
+
+ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
+- tag = tag < max_queue ? tag : 0;
++ if (ap->flags & ATA_FLAG_LOWTAG)
++ tag = i;
++ else
++ tag = tag < max_queue ? tag : 0;
+
+ /* the last tag is reserved for internal command. */
+ if (tag == ATA_TAG_INTERNAL)
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 3723e5ec2b4d..fad2734a46d0 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -1333,7 +1333,19 @@ void ata_sff_flush_pio_task(struct ata_port *ap)
+ DPRINTK("ENTER\n");
+
+ cancel_delayed_work_sync(&ap->sff_pio_task);
++
++ /*
++ * We wanna reset the HSM state to IDLE. If we do so without
++ * grabbing the port lock, critical sections protected by it which
++ * expect the HSM state to stay stable may get surprised. For
++ * example, we may set IDLE in between the time
++ * __ata_sff_port_intr() checks for HSM_ST_IDLE and before it calls
++ * ata_sff_hsm_move() causing ata_sff_hsm_move() to BUG().
++ */
++ spin_lock_irq(ap->lock);
+ ap->hsm_task_state = HSM_ST_IDLE;
++ spin_unlock_irq(ap->lock);
++
+ ap->sff_pio_task_link = NULL;
+
+ if (ata_msg_ctl(ap))
+diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
+index 69f7cde49c6b..9d6eb14b4bed 100644
+--- a/drivers/ata/sata_dwc_460ex.c
++++ b/drivers/ata/sata_dwc_460ex.c
+@@ -791,7 +791,7 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
+ if (err) {
+ dev_err(host_pvt.dwc_dev, "%s: dma_request_interrupts returns"
+ " %d\n", __func__, err);
+- goto error_out;
++ return err;
+ }
+
+ /* Enabe DMA */
+@@ -802,11 +802,6 @@ static int dma_dwc_init(struct sata_dwc_device *hsdev, int irq)
+ sata_dma_regs);
+
+ return 0;
+-
+-error_out:
+- dma_dwc_exit(hsdev);
+-
+- return err;
+ }
+
+ static int sata_dwc_scr_read(struct ata_link *link, unsigned int scr, u32 *val)
+@@ -1634,7 +1629,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ char *ver = (char *)&versionr;
+ u8 *base = NULL;
+ int err = 0;
+- int irq, rc;
++ int irq;
+ struct ata_host *host;
+ struct ata_port_info pi = sata_dwc_port_info[0];
+ const struct ata_port_info *ppi[] = { &pi, NULL };
+@@ -1688,7 +1683,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ if (irq == NO_IRQ) {
+ dev_err(&ofdev->dev, "no SATA DMA irq\n");
+ err = -ENODEV;
+- goto error_out;
++ goto error_iomap;
+ }
+
+ /* Get physical SATA DMA register base address */
+@@ -1697,14 +1692,16 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ dev_err(&ofdev->dev, "ioremap failed for AHBDMA register"
+ " address\n");
+ err = -ENODEV;
+- goto error_out;
++ goto error_iomap;
+ }
+
+ /* Save dev for later use in dev_xxx() routines */
+ host_pvt.dwc_dev = &ofdev->dev;
+
+ /* Initialize AHB DMAC */
+- dma_dwc_init(hsdev, irq);
++ err = dma_dwc_init(hsdev, irq);
++ if (err)
++ goto error_dma_iomap;
+
+ /* Enable SATA Interrupts */
+ sata_dwc_enable_interrupts(hsdev);
+@@ -1722,9 +1719,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ * device discovery process, invoking our port_start() handler &
+ * error_handler() to execute a dummy Softreset EH session
+ */
+- rc = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
+-
+- if (rc != 0)
++ err = ata_host_activate(host, irq, sata_dwc_isr, 0, &sata_dwc_sht);
++ if (err)
+ dev_err(&ofdev->dev, "failed to activate host");
+
+ dev_set_drvdata(&ofdev->dev, host);
+@@ -1733,7 +1729,8 @@ static int sata_dwc_probe(struct platform_device *ofdev)
+ error_out:
+ /* Free SATA DMA resources */
+ dma_dwc_exit(hsdev);
+-
++error_dma_iomap:
++ iounmap((void __iomem *)host_pvt.sata_dma_regs);
+ error_iomap:
+ iounmap(base);
+ error_kmalloc:
+@@ -1754,6 +1751,7 @@ static int sata_dwc_remove(struct platform_device *ofdev)
+ /* Free SATA DMA resources */
+ dma_dwc_exit(hsdev);
+
++ iounmap((void __iomem *)host_pvt.sata_dma_regs);
+ iounmap(hsdev->reg_base);
+ kfree(hsdev);
+ kfree(host);
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index d6577b93bee3..3d3b59a9adcf 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -1426,7 +1426,7 @@ static int sata_fsl_probe(struct platform_device *ofdev)
+ host_priv->csr_base = csr_base;
+
+ irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
+- if (irq < 0) {
++ if (!irq) {
+ dev_err(&ofdev->dev, "invalid irq from platform\n");
+ goto error_exit_with_cleanup;
+ }
+diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
+index e7e610aa9a7a..cb68aa3f72a6 100644
+--- a/drivers/ata/sata_sil24.c
++++ b/drivers/ata/sata_sil24.c
+@@ -246,7 +246,7 @@ enum {
+ /* host flags */
+ SIL24_COMMON_FLAGS = ATA_FLAG_SATA | ATA_FLAG_PIO_DMA |
+ ATA_FLAG_NCQ | ATA_FLAG_ACPI_SATA |
+- ATA_FLAG_AN | ATA_FLAG_PMP,
++ ATA_FLAG_AN | ATA_FLAG_PMP | ATA_FLAG_LOWTAG,
+ SIL24_FLAG_PCIX_IRQ_WOC = (1 << 24), /* IRQ loss errata on PCI-X */
+
+ IRQ_STAT_4PORTS = 0xf,
+diff --git a/drivers/base/bus.c b/drivers/base/bus.c
+index b850cecb147b..0f682f7d0797 100644
+--- a/drivers/base/bus.c
++++ b/drivers/base/bus.c
+@@ -245,13 +245,15 @@ static ssize_t store_drivers_probe(struct bus_type *bus,
+ const char *buf, size_t count)
+ {
+ struct device *dev;
++ int err = -EINVAL;
+
+ dev = bus_find_device_by_name(bus, NULL, buf);
+ if (!dev)
+ return -ENODEV;
+- if (bus_rescan_devices_helper(dev, NULL) != 0)
+- return -EINVAL;
+- return count;
++ if (bus_rescan_devices_helper(dev, NULL) == 0)
++ err = count;
++ put_device(dev);
++ return err;
+ }
+ #endif
+
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index 32e86d6f141c..aeaf0e183f24 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -1494,34 +1494,11 @@ static void device_create_release(struct device *dev)
+ kfree(dev);
+ }
+
+-/**
+- * device_create_vargs - creates a device and registers it with sysfs
+- * @class: pointer to the struct class that this device should be registered to
+- * @parent: pointer to the parent struct device of this new device, if any
+- * @devt: the dev_t for the char device to be added
+- * @drvdata: the data to be added to the device for callbacks
+- * @fmt: string for the device's name
+- * @args: va_list for the device's name
+- *
+- * This function can be used by char device classes. A struct device
+- * will be created in sysfs, registered to the specified class.
+- *
+- * A "dev" file will be created, showing the dev_t for the device, if
+- * the dev_t is not 0,0.
+- * If a pointer to a parent struct device is passed in, the newly created
+- * struct device will be a child of that device in sysfs.
+- * The pointer to the struct device will be returned from the call.
+- * Any further sysfs files that might be required can be created using this
+- * pointer.
+- *
+- * Returns &struct device pointer on success, or ERR_PTR() on error.
+- *
+- * Note: the struct class passed to this function must have previously
+- * been created with a call to class_create().
+- */
+-struct device *device_create_vargs(struct class *class, struct device *parent,
+- dev_t devt, void *drvdata, const char *fmt,
+- va_list args)
++static struct device *
++device_create_groups_vargs(struct class *class, struct device *parent,
++ dev_t devt, void *drvdata,
++ const struct attribute_group **groups,
++ const char *fmt, va_list args)
+ {
+ struct device *dev = NULL;
+ int retval = -ENODEV;
+@@ -1538,6 +1515,7 @@ struct device *device_create_vargs(struct class *class, struct device *parent,
+ dev->devt = devt;
+ dev->class = class;
+ dev->parent = parent;
++ dev->groups = groups;
+ dev->release = device_create_release;
+ dev_set_drvdata(dev, drvdata);
+
+@@ -1555,6 +1533,39 @@ error:
+ put_device(dev);
+ return ERR_PTR(retval);
+ }
++
++/**
++ * device_create_vargs - creates a device and registers it with sysfs
++ * @class: pointer to the struct class that this device should be registered to
++ * @parent: pointer to the parent struct device of this new device, if any
++ * @devt: the dev_t for the char device to be added
++ * @drvdata: the data to be added to the device for callbacks
++ * @fmt: string for the device's name
++ * @args: va_list for the device's name
++ *
++ * This function can be used by char device classes. A struct device
++ * will be created in sysfs, registered to the specified class.
++ *
++ * A "dev" file will be created, showing the dev_t for the device, if
++ * the dev_t is not 0,0.
++ * If a pointer to a parent struct device is passed in, the newly created
++ * struct device will be a child of that device in sysfs.
++ * The pointer to the struct device will be returned from the call.
++ * Any further sysfs files that might be required can be created using this
++ * pointer.
++ *
++ * Returns &struct device pointer on success, or ERR_PTR() on error.
++ *
++ * Note: the struct class passed to this function must have previously
++ * been created with a call to class_create().
++ */
++struct device *device_create_vargs(struct class *class, struct device *parent,
++ dev_t devt, void *drvdata, const char *fmt,
++ va_list args)
++{
++ return device_create_groups_vargs(class, parent, devt, drvdata, NULL,
++ fmt, args);
++}
+ EXPORT_SYMBOL_GPL(device_create_vargs);
+
+ /**
+@@ -1594,6 +1605,50 @@ struct device *device_create(struct class *class, struct device *parent,
+ }
+ EXPORT_SYMBOL_GPL(device_create);
+
++/**
++ * device_create_with_groups - creates a device and registers it with sysfs
++ * @class: pointer to the struct class that this device should be registered to
++ * @parent: pointer to the parent struct device of this new device, if any
++ * @devt: the dev_t for the char device to be added
++ * @drvdata: the data to be added to the device for callbacks
++ * @groups: NULL-terminated list of attribute groups to be created
++ * @fmt: string for the device's name
++ *
++ * This function can be used by char device classes. A struct device
++ * will be created in sysfs, registered to the specified class.
++ * Additional attributes specified in the groups parameter will also
++ * be created automatically.
++ *
++ * A "dev" file will be created, showing the dev_t for the device, if
++ * the dev_t is not 0,0.
++ * If a pointer to a parent struct device is passed in, the newly created
++ * struct device will be a child of that device in sysfs.
++ * The pointer to the struct device will be returned from the call.
++ * Any further sysfs files that might be required can be created using this
++ * pointer.
++ *
++ * Returns &struct device pointer on success, or ERR_PTR() on error.
++ *
++ * Note: the struct class passed to this function must have previously
++ * been created with a call to class_create().
++ */
++struct device *device_create_with_groups(struct class *class,
++ struct device *parent, dev_t devt,
++ void *drvdata,
++ const struct attribute_group **groups,
++ const char *fmt, ...)
++{
++ va_list vargs;
++ struct device *dev;
++
++ va_start(vargs, fmt);
++ dev = device_create_groups_vargs(class, parent, devt, drvdata, groups,
++ fmt, vargs);
++ va_end(vargs);
++ return dev;
++}
++EXPORT_SYMBOL_GPL(device_create_with_groups);
++
+ static int __match_devt(struct device *dev, void *data)
+ {
+ dev_t *devt = data;
+diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
+index be984e073666..43da22658348 100644
+--- a/drivers/block/drbd/drbd_req.c
++++ b/drivers/block/drbd/drbd_req.c
+@@ -1184,6 +1184,7 @@ int drbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bvm, struct
+ struct request_queue * const b =
+ mdev->ldev->backing_bdev->bd_disk->queue;
+ if (b->merge_bvec_fn) {
++ bvm->bi_bdev = mdev->ldev->backing_bdev;
+ backing_limit = b->merge_bvec_fn(b, bvm, bvec);
+ limit = min(limit, backing_limit);
+ }
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index d02f761d84ec..02fbbf7be9f9 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -62,47 +62,53 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0CF3, 0x3000) },
+
+ /* Atheros AR3011 with sflash firmware*/
++ { USB_DEVICE(0x0489, 0xE027) },
++ { USB_DEVICE(0x0489, 0xE03D) },
++ { USB_DEVICE(0x0930, 0x0215) },
+ { USB_DEVICE(0x0CF3, 0x3002) },
+ { USB_DEVICE(0x0CF3, 0xE019) },
+ { USB_DEVICE(0x13d3, 0x3304) },
+- { USB_DEVICE(0x0930, 0x0215) },
+- { USB_DEVICE(0x0489, 0xE03D) },
+- { USB_DEVICE(0x0489, 0xE027) },
+
+ /* Atheros AR9285 Malbec with sflash firmware */
+ { USB_DEVICE(0x03F0, 0x311D) },
+
+ /* Atheros AR3012 with sflash firmware*/
++ { USB_DEVICE(0x0489, 0xe04d) },
++ { USB_DEVICE(0x0489, 0xe04e) },
++ { USB_DEVICE(0x0489, 0xe057) },
++ { USB_DEVICE(0x0489, 0xe056) },
++ { USB_DEVICE(0x0489, 0xe078) },
++ { USB_DEVICE(0x04c5, 0x1330) },
++ { USB_DEVICE(0x04CA, 0x3004) },
++ { USB_DEVICE(0x04CA, 0x3005) },
++ { USB_DEVICE(0x04CA, 0x3006) },
++ { USB_DEVICE(0x04CA, 0x3008) },
++ { USB_DEVICE(0x04CA, 0x3010) },
++ { USB_DEVICE(0x0930, 0x0219) },
++ { USB_DEVICE(0x0930, 0x0227) },
++ { USB_DEVICE(0x0b05, 0x17d0) },
+ { USB_DEVICE(0x0CF3, 0x0036) },
+ { USB_DEVICE(0x0CF3, 0x3004) },
+ { USB_DEVICE(0x0CF3, 0x3008) },
+ { USB_DEVICE(0x0CF3, 0x311D) },
++ { USB_DEVICE(0x0cf3, 0x3121) },
+ { USB_DEVICE(0x0CF3, 0x817a) },
+- { USB_DEVICE(0x13d3, 0x3375) },
+- { USB_DEVICE(0x04CA, 0x3004) },
+- { USB_DEVICE(0x04CA, 0x3005) },
+- { USB_DEVICE(0x04CA, 0x3006) },
+- { USB_DEVICE(0x04CA, 0x3008) },
+- { USB_DEVICE(0x13d3, 0x3362) },
++ { USB_DEVICE(0x0cf3, 0xe003) },
+ { USB_DEVICE(0x0CF3, 0xE004) },
+ { USB_DEVICE(0x0CF3, 0xE005) },
+- { USB_DEVICE(0x0930, 0x0219) },
+- { USB_DEVICE(0x0489, 0xe057) },
++ { USB_DEVICE(0x13d3, 0x3362) },
++ { USB_DEVICE(0x13d3, 0x3375) },
+ { USB_DEVICE(0x13d3, 0x3393) },
+- { USB_DEVICE(0x0489, 0xe04e) },
+- { USB_DEVICE(0x0489, 0xe056) },
+- { USB_DEVICE(0x0489, 0xe04d) },
+- { USB_DEVICE(0x04c5, 0x1330) },
+ { USB_DEVICE(0x13d3, 0x3402) },
+- { USB_DEVICE(0x0cf3, 0x3121) },
+- { USB_DEVICE(0x0cf3, 0xe003) },
++ { USB_DEVICE(0x13d3, 0x3408) },
++ { USB_DEVICE(0x13d3, 0x3432) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+- { USB_DEVICE(0x0489, 0xE03C) },
+ { USB_DEVICE(0x0489, 0xE036) },
++ { USB_DEVICE(0x0489, 0xE03C) },
+
+ { } /* Terminating entry */
+ };
+@@ -115,29 +121,35 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
+ static struct usb_device_id ath3k_blist_tbl[] = {
+
+ /* Atheros AR3012 with sflash firmware*/
++ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+@@ -149,6 +161,8 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ #define USB_REQ_DFU_DNLOAD 1
+ #define BULK_SIZE 4096
+ #define FW_HDR_SIZE 20
++#define TIMEGAP_USEC_MIN 50
++#define TIMEGAP_USEC_MAX 100
+
+ static int ath3k_load_firmware(struct usb_device *udev,
+ const struct firmware *firmware)
+@@ -179,6 +193,9 @@ static int ath3k_load_firmware(struct usb_device *udev,
+ count -= 20;
+
+ while (count) {
++ /* workaround the compatibility issue with xHCI controller*/
++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ size = min_t(uint, count, BULK_SIZE);
+ pipe = usb_sndbulkpipe(udev, 0x02);
+ memcpy(send_buf, firmware->data + sent, size);
+@@ -255,6 +272,9 @@ static int ath3k_load_fwfile(struct usb_device *udev,
+ count -= size;
+
+ while (count) {
++ /* workaround the compatibility issue with xHCI controller*/
++ usleep_range(TIMEGAP_USEC_MIN, TIMEGAP_USEC_MAX);
++
+ size = min_t(uint, count, BULK_SIZE);
+ pipe = usb_sndbulkpipe(udev, 0x02);
+
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 155a61841e2b..ddb2b873a112 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -55,6 +55,7 @@ static struct usb_driver btusb_driver;
+ #define BTUSB_BROKEN_ISOC 0x20
+ #define BTUSB_WRONG_SCO_MTU 0x40
+ #define BTUSB_ATH3012 0x80
++#define BTUSB_INTEL_BOOT 0x200
+
+ static struct usb_device_id btusb_table[] = {
+ /* Generic Bluetooth USB device */
+@@ -107,18 +108,25 @@ static struct usb_device_id btusb_table[] = {
+ { USB_DEVICE(0x0c10, 0x0000) },
+
+ /* Broadcom BCM20702A0 */
++ { USB_DEVICE(0x0489, 0xe042) },
++ { USB_DEVICE(0x04ca, 0x2003) },
+ { USB_DEVICE(0x0b05, 0x17b5) },
+ { USB_DEVICE(0x0b05, 0x17cb) },
+- { USB_DEVICE(0x04ca, 0x2003) },
+- { USB_DEVICE(0x0489, 0xe042) },
+ { USB_DEVICE(0x413c, 0x8197) },
+
+ /* Foxconn - Hon Hai */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
+
+- /*Broadcom devices with vendor specific id */
++ /* Broadcom devices with vendor specific id */
+ { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
+
++ /* ASUSTek Computer - Broadcom based */
++ { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
++
++ /* Intel Bluetooth USB Bootloader (RAM module) */
++ { USB_DEVICE(0x8087, 0x0a5a),
++ .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
++
+ { } /* Terminating entry */
+ };
+
+@@ -132,52 +140,58 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
+
+ /* Atheros 3011 with sflash firmware */
++ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
+- { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+- { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
+- { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+
+ /* Atheros AR9285 Malbec with sflash firmware */
+ { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
+
+ /* Atheros 3012 with sflash firmware */
++ { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+- { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+- { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
+
+ /* Broadcom BCM2035 */
+- { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
+- { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
+ { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
++ { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
++ { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
+
+ /* Broadcom BCM2045 */
+ { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
+@@ -1050,6 +1064,9 @@ static int btusb_probe(struct usb_interface *intf,
+ hdev->send = btusb_send_frame;
+ hdev->notify = btusb_notify;
+
++ if (id->driver_info & BTUSB_INTEL_BOOT)
++ set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
++
+ /* Interface numbers are hardcoded in the specification */
+ data->isoc = usb_ifnum_to_if(data->udev, 1);
+
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 112c16e08471..7cb3cb94c672 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -60,6 +60,7 @@ struct gpio_desc {
+ #define FLAG_ACTIVE_LOW 7 /* sysfs value has active low */
+ #define FLAG_OPEN_DRAIN 8 /* Gpio is open drain type */
+ #define FLAG_OPEN_SOURCE 9 /* Gpio is open source type */
++#define FLAG_SYSFS_DIR 10 /* show sysfs direction attribute */
+
+ #define ID_SHIFT 16 /* add new flags before this one */
+
+@@ -319,7 +320,7 @@ static ssize_t gpio_value_store(struct device *dev,
+ return status;
+ }
+
+-static const DEVICE_ATTR(value, 0644,
++static DEVICE_ATTR(value, 0644,
+ gpio_value_show, gpio_value_store);
+
+ static irqreturn_t gpio_sysfs_irq(int irq, void *priv)
+@@ -542,17 +543,47 @@ static ssize_t gpio_active_low_store(struct device *dev,
+ return status ? : size;
+ }
+
+-static const DEVICE_ATTR(active_low, 0644,
++static DEVICE_ATTR(active_low, 0644,
+ gpio_active_low_show, gpio_active_low_store);
+
+-static const struct attribute *gpio_attrs[] = {
++static umode_t gpio_is_visible(struct kobject *kobj, struct attribute *attr,
++ int n)
++{
++ struct device *dev = container_of(kobj, struct device, kobj);
++ struct gpio_desc *desc = dev_get_drvdata(dev);
++ unsigned gpio = desc - gpio_desc;
++ umode_t mode = attr->mode;
++ bool show_direction = test_bit(FLAG_SYSFS_DIR, &desc->flags);
++
++ if (attr == &dev_attr_direction.attr) {
++ if (!show_direction)
++ mode = 0;
++ } else if (attr == &dev_attr_edge.attr) {
++ if (gpio_to_irq(gpio) < 0)
++ mode = 0;
++ if (!show_direction && test_bit(FLAG_IS_OUT, &desc->flags))
++ mode = 0;
++ }
++
++ return mode;
++}
++
++static struct attribute *gpio_attrs[] = {
++ &dev_attr_direction.attr,
++ &dev_attr_edge.attr,
+ &dev_attr_value.attr,
+ &dev_attr_active_low.attr,
+ NULL,
+ };
+
+-static const struct attribute_group gpio_attr_group = {
+- .attrs = (struct attribute **) gpio_attrs,
++static const struct attribute_group gpio_group = {
++ .attrs = gpio_attrs,
++ .is_visible = gpio_is_visible,
++};
++
++static const struct attribute_group *gpio_groups[] = {
++ &gpio_group,
++ NULL
+ };
+
+ /*
+@@ -589,16 +620,13 @@ static ssize_t chip_ngpio_show(struct device *dev,
+ }
+ static DEVICE_ATTR(ngpio, 0444, chip_ngpio_show, NULL);
+
+-static const struct attribute *gpiochip_attrs[] = {
++static struct attribute *gpiochip_attrs[] = {
+ &dev_attr_base.attr,
+ &dev_attr_label.attr,
+ &dev_attr_ngpio.attr,
+ NULL,
+ };
+-
+-static const struct attribute_group gpiochip_attr_group = {
+- .attrs = (struct attribute **) gpiochip_attrs,
+-};
++ATTRIBUTE_GROUPS(gpiochip);
+
+ /*
+ * /sys/class/gpio/export ... write-only
+@@ -704,8 +732,9 @@ int gpio_export(unsigned gpio, bool direction_may_change)
+ {
+ unsigned long flags;
+ struct gpio_desc *desc;
+- int status = -EINVAL;
++ int status;
+ const char *ioname = NULL;
++ struct device *dev;
+
+ /* can't export until sysfs is available ... */
+ if (!gpio_class.p) {
+@@ -713,59 +742,50 @@ int gpio_export(unsigned gpio, bool direction_may_change)
+ return -ENOENT;
+ }
+
+- if (!gpio_is_valid(gpio))
+- goto done;
++ if (!gpio_is_valid(gpio)) {
++ pr_debug("%s: gpio %d is not valid\n", __func__, gpio);
++ return -EINVAL;
++ }
+
+ mutex_lock(&sysfs_lock);
+
+ spin_lock_irqsave(&gpio_lock, flags);
+ desc = &gpio_desc[gpio];
+- if (test_bit(FLAG_REQUESTED, &desc->flags)
+- && !test_bit(FLAG_EXPORT, &desc->flags)) {
+- status = 0;
+- if (!desc->chip->direction_input
+- || !desc->chip->direction_output)
+- direction_may_change = false;
++ if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
++ test_bit(FLAG_EXPORT, &desc->flags)) {
++ spin_unlock_irqrestore(&gpio_lock, flags);
++ pr_debug("%s: gpio %d unavailable (requested=%d, exported=%d)\n",
++ __func__, gpio,
++ test_bit(FLAG_REQUESTED, &desc->flags),
++ test_bit(FLAG_EXPORT, &desc->flags));
++ return -EPERM;
+ }
++
++ if (desc->chip->direction_input && desc->chip->direction_output &&
++ direction_may_change) {
++ set_bit(FLAG_SYSFS_DIR, &desc->flags);
++ }
++
+ spin_unlock_irqrestore(&gpio_lock, flags);
+
+ if (desc->chip->names && desc->chip->names[gpio - desc->chip->base])
+ ioname = desc->chip->names[gpio - desc->chip->base];
+
+- if (status == 0) {
+- struct device *dev;
+-
+- dev = device_create(&gpio_class, desc->chip->dev, MKDEV(0, 0),
+- desc, ioname ? ioname : "gpio%u", gpio);
+- if (!IS_ERR(dev)) {
+- status = sysfs_create_group(&dev->kobj,
+- &gpio_attr_group);
+-
+- if (!status && direction_may_change)
+- status = device_create_file(dev,
+- &dev_attr_direction);
+-
+- if (!status && gpio_to_irq(gpio) >= 0
+- && (direction_may_change
+- || !test_bit(FLAG_IS_OUT,
+- &desc->flags)))
+- status = device_create_file(dev,
+- &dev_attr_edge);
+-
+- if (status != 0)
+- device_unregister(dev);
+- } else
+- status = PTR_ERR(dev);
+- if (status == 0)
+- set_bit(FLAG_EXPORT, &desc->flags);
++ dev = device_create_with_groups(&gpio_class, desc->chip->dev,
++ MKDEV(0, 0), desc, gpio_groups,
++ ioname ? ioname : "gpio%u", gpio);
++ if (IS_ERR(dev)) {
++ status = PTR_ERR(dev);
++ goto fail_unlock;
+ }
+
++ set_bit(FLAG_EXPORT, &desc->flags);
+ mutex_unlock(&sysfs_lock);
++ return 0;
+
+-done:
+- if (status)
+- pr_debug("%s: gpio%d status %d\n", __func__, gpio, status);
+-
++fail_unlock:
++ mutex_unlock(&sysfs_lock);
++ pr_debug("%s: gpio%d status %d\n", __func__, gpio, status);
+ return status;
+ }
+ EXPORT_SYMBOL_GPL(gpio_export);
+@@ -805,6 +825,7 @@ int gpio_export_link(struct device *dev, const char *name, unsigned gpio)
+ if (tdev != NULL) {
+ status = sysfs_create_link(&dev->kobj, &tdev->kobj,
+ name);
++ put_device(tdev);
+ } else {
+ status = -ENODEV;
+ }
+@@ -855,7 +876,7 @@ int gpio_sysfs_set_active_low(unsigned gpio, int value)
+ }
+
+ status = sysfs_set_active_low(desc, dev, value);
+-
++ put_device(dev);
+ unlock:
+ mutex_unlock(&sysfs_lock);
+
+@@ -893,6 +914,7 @@ void gpio_unexport(unsigned gpio)
+ dev = class_find_device(&gpio_class, NULL, desc, match_export);
+ if (dev) {
+ gpio_setup_irq(desc, dev, 0);
++ clear_bit(FLAG_SYSFS_DIR, &desc->flags);
+ clear_bit(FLAG_EXPORT, &desc->flags);
+ } else
+ status = -ENODEV;
+@@ -924,13 +946,13 @@ static int gpiochip_export(struct gpio_chip *chip)
+
+ /* use chip->base for the ID; it's already known to be unique */
+ mutex_lock(&sysfs_lock);
+- dev = device_create(&gpio_class, chip->dev, MKDEV(0, 0), chip,
+- "gpiochip%d", chip->base);
+- if (!IS_ERR(dev)) {
+- status = sysfs_create_group(&dev->kobj,
+- &gpiochip_attr_group);
+- } else
++ dev = device_create_with_groups(&gpio_class, chip->dev, MKDEV(0, 0),
++ chip, gpiochip_groups,
++ "gpiochip%d", chip->base);
++ if (IS_ERR(dev))
+ status = PTR_ERR(dev);
++ else
++ status = 0;
+ chip->exported = (status == 0);
+ mutex_unlock(&sysfs_lock);
+
+@@ -1081,19 +1103,18 @@ int gpiochip_add(struct gpio_chip *chip)
+ ? (1 << FLAG_IS_OUT)
+ : 0;
+ }
+- }
+
+- of_gpiochip_add(chip);
++ of_gpiochip_add(chip);
++ }
+
+ unlock:
+ spin_unlock_irqrestore(&gpio_lock, flags);
+
+- if (status)
+- goto fail;
+-
+ status = gpiochip_export(chip);
+- if (status)
++ if (status) {
++ of_gpiochip_remove(chip);
+ goto fail;
++ }
+
+ pr_info("gpiochip_add: registered GPIOs %d to %d on device: %s\n",
+ chip->base, chip->base + chip->ngpio - 1,
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index 2ac4ded0de99..b1f1d105e8c7 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -2193,6 +2193,13 @@ static int sandybridge_write_fence_reg(struct drm_i915_gem_object *obj,
+ int regnum = obj->fence_reg;
+ uint64_t val;
+
++ /* Adjust fence size to match tiled area */
++ if (obj->tiling_mode != I915_TILING_NONE) {
++ uint32_t row_size = obj->stride *
++ (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
++ size = (size / row_size) * row_size;
++ }
++
+ val = (uint64_t)((obj->gtt_offset + size - 4096) &
+ 0xfffff000) << 32;
+ val |= obj->gtt_offset & 0xfffff000;
+@@ -2230,6 +2237,13 @@ static int i965_write_fence_reg(struct drm_i915_gem_object *obj,
+ int regnum = obj->fence_reg;
+ uint64_t val;
+
++ /* Adjust fence size to match tiled area */
++ if (obj->tiling_mode != I915_TILING_NONE) {
++ uint32_t row_size = obj->stride *
++ (obj->tiling_mode == I915_TILING_Y ? 32 : 8);
++ size = (size / row_size) * row_size;
++ }
++
+ val = (uint64_t)((obj->gtt_offset + size - 4096) &
+ 0xfffff000) << 32;
+ val |= obj->gtt_offset & 0xfffff000;
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index 77190cc774cb..3febe292034a 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -932,6 +932,17 @@ bool intel_lvds_init(struct drm_device *dev)
+ int pipe;
+ u8 pin;
+
++ /*
++ * Unlock registers and just leave them unlocked. Do this before
++ * checking quirk lists to avoid bogus WARNINGs.
++ */
++ if (HAS_PCH_SPLIT(dev)) {
++ I915_WRITE(PCH_PP_CONTROL,
++ I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
++ } else {
++ I915_WRITE(PP_CONTROL,
++ I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
++ }
+ if (!intel_lvds_supported(dev))
+ return false;
+
+@@ -1109,19 +1120,6 @@ out:
+ pwm = I915_READ(BLC_PWM_PCH_CTL1);
+ pwm |= PWM_PCH_ENABLE;
+ I915_WRITE(BLC_PWM_PCH_CTL1, pwm);
+- /*
+- * Unlock registers and just
+- * leave them unlocked
+- */
+- I915_WRITE(PCH_PP_CONTROL,
+- I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+- } else {
+- /*
+- * Unlock registers and just
+- * leave them unlocked
+- */
+- I915_WRITE(PP_CONTROL,
+- I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
+ }
+ dev_priv->lid_notifier.notifier_call = intel_lid_notify;
+ if (acpi_lid_notifier_register(&dev_priv->lid_notifier)) {
+diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
+index 9b46238b9692..b7316869f59e 100644
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -428,6 +428,8 @@ int radeon_get_vblank_timestamp_kms(struct drm_device *dev, int crtc,
+
+ /* Get associated drm_crtc: */
+ drmcrtc = &rdev->mode_info.crtcs[crtc]->base;
++ if (!drmcrtc)
++ return -EINVAL;
+
+ /* Helper routine in DRM core does all the work: */
+ return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
+diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
+index 49b55edc55b6..15042d0ca035 100644
+--- a/drivers/gpu/drm/radeon/radeon_ttm.c
++++ b/drivers/gpu/drm/radeon/radeon_ttm.c
+@@ -188,7 +188,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
+ rbo = container_of(bo, struct radeon_bo, tbo);
+ switch (bo->mem.mem_type) {
+ case TTM_PL_VRAM:
+- if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
++ if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
+ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
+ else
+ radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+index 7e0743358dff..992b46bbadfb 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+@@ -485,14 +485,7 @@ void vmw_fence_obj_flush(struct vmw_fence_obj *fence)
+
+ static void vmw_fence_destroy(struct vmw_fence_obj *fence)
+ {
+- struct vmw_fence_manager *fman = fence->fman;
+-
+ kfree(fence);
+- /*
+- * Free kernel space accounting.
+- */
+- ttm_mem_global_free(vmw_mem_glob(fman->dev_priv),
+- fman->fence_size);
+ }
+
+ int vmw_fence_create(struct vmw_fence_manager *fman,
+@@ -500,20 +493,12 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
+ uint32_t mask,
+ struct vmw_fence_obj **p_fence)
+ {
+- struct ttm_mem_global *mem_glob = vmw_mem_glob(fman->dev_priv);
+ struct vmw_fence_obj *fence;
+ int ret;
+
+- ret = ttm_mem_global_alloc(mem_glob, fman->fence_size,
+- false, false);
+- if (unlikely(ret != 0))
+- return ret;
+-
+ fence = kzalloc(sizeof(*fence), GFP_KERNEL);
+- if (unlikely(fence == NULL)) {
+- ret = -ENOMEM;
+- goto out_no_object;
+- }
++ if (unlikely(fence == NULL))
++ return -ENOMEM;
+
+ ret = vmw_fence_obj_init(fman, fence, seqno, mask,
+ vmw_fence_destroy);
+@@ -525,8 +510,6 @@ int vmw_fence_create(struct vmw_fence_manager *fman,
+
+ out_err_init:
+ kfree(fence);
+-out_no_object:
+- ttm_mem_global_free(mem_glob, fman->fence_size);
+ return ret;
+ }
+
+@@ -1049,6 +1032,8 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
+ if (ret != 0)
+ goto out_no_queue;
+
++ return 0;
++
+ out_no_queue:
+ event->base.destroy(&event->base);
+ out_no_event:
+@@ -1123,17 +1108,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
+
+ BUG_ON(fence == NULL);
+
+- if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
+- ret = vmw_event_fence_action_create(file_priv, fence,
+- arg->flags,
+- arg->user_data,
+- true);
+- else
+- ret = vmw_event_fence_action_create(file_priv, fence,
+- arg->flags,
+- arg->user_data,
+- true);
+-
++ ret = vmw_event_fence_action_create(file_priv, fence,
++ arg->flags,
++ arg->user_data,
++ true);
+ if (unlikely(ret != 0)) {
+ if (ret != -ERESTARTSYS)
+ DRM_ERROR("Failed to attach event to fence.\n");
+diff --git a/drivers/hid/hid-roccat-pyra.c b/drivers/hid/hid-roccat-pyra.c
+index df05c1b1064f..53466474b420 100644
+--- a/drivers/hid/hid-roccat-pyra.c
++++ b/drivers/hid/hid-roccat-pyra.c
+@@ -35,6 +35,8 @@ static struct class *pyra_class;
+ static void profile_activated(struct pyra_device *pyra,
+ unsigned int new_profile)
+ {
++ if (new_profile >= ARRAY_SIZE(pyra->profile_settings))
++ return;
+ pyra->actual_profile = new_profile;
+ pyra->actual_cpi = pyra->profile_settings[pyra->actual_profile].y_cpi;
+ }
+@@ -299,10 +301,15 @@ static ssize_t pyra_sysfs_write_settings(struct file *fp,
+ int retval = 0;
+ int difference;
+ struct pyra_roccat_report roccat_report;
++ struct pyra_settings const *settings;
+
+ if (off != 0 || count != sizeof(struct pyra_settings))
+ return -EINVAL;
+
++ settings = (struct pyra_settings const *)buf;
++ if (settings->startup_profile >= ARRAY_SIZE(pyra->profile_settings))
++ return -EINVAL;
++
+ mutex_lock(&pyra->pyra_lock);
+ difference = memcmp(buf, &pyra->settings, sizeof(struct pyra_settings));
+ if (difference) {
+diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c
+index 10619b34bd31..1ec309dbacde 100644
+--- a/drivers/hv/vmbus_drv.c
++++ b/drivers/hv/vmbus_drv.c
+@@ -681,7 +681,7 @@ int vmbus_device_register(struct hv_device *child_device_obj)
+ if (ret)
+ pr_err("Unable to register child device\n");
+ else
+- pr_info("child device %s registered\n",
++ pr_debug("child device %s registered\n",
+ dev_name(&child_device_obj->device));
+
+ return ret;
+@@ -693,14 +693,14 @@ int vmbus_device_register(struct hv_device *child_device_obj)
+ */
+ void vmbus_device_unregister(struct hv_device *device_obj)
+ {
++ pr_debug("child device %s unregistered\n",
++ dev_name(&device_obj->device));
++
+ /*
+ * Kick off the process of unregistering the device.
+ * This will call vmbus_remove() and eventually vmbus_device_release()
+ */
+ device_unregister(&device_obj->device);
+-
+- pr_info("child device %s unregistered\n",
+- dev_name(&device_obj->device));
+ }
+
+
+diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
+index 79b4bcb3b85c..1837fe6677b9 100644
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -416,11 +416,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
+ if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
+ if (msg->flags & I2C_M_IGNORE_NAK)
+ return msg->len;
+- if (stop) {
+- w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
+- w |= DAVINCI_I2C_MDR_STP;
+- davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+- }
++ w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
++ w |= DAVINCI_I2C_MDR_STP;
++ davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+ return -EREMOTEIO;
+ }
+ return -EIO;
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 42f7b257feb0..b4e8db847a34 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -979,9 +979,19 @@ static int xpad_probe(struct usb_interface *intf, const struct usb_device_id *id
+ }
+
+ ep_irq_in = &intf->cur_altsetting->endpoint[1].desc;
+- usb_fill_bulk_urb(xpad->bulk_out, udev,
+- usb_sndbulkpipe(udev, ep_irq_in->bEndpointAddress),
+- xpad->bdata, XPAD_PKT_LEN, xpad_bulk_out, xpad);
++ if (usb_endpoint_is_bulk_out(ep_irq_in)) {
++ usb_fill_bulk_urb(xpad->bulk_out, udev,
++ usb_sndbulkpipe(udev,
++ ep_irq_in->bEndpointAddress),
++ xpad->bdata, XPAD_PKT_LEN,
++ xpad_bulk_out, xpad);
++ } else {
++ usb_fill_int_urb(xpad->bulk_out, udev,
++ usb_sndintpipe(udev,
++ ep_irq_in->bEndpointAddress),
++ xpad->bdata, XPAD_PKT_LEN,
++ xpad_bulk_out, xpad, 0);
++ }
+
+ /*
+ * Submit the int URB immediately rather than waiting for open
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index ce715b1bee46..78227f32d6fa 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ },
+ },
+ {
++ /* Acer Aspire 7738 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
++ },
++ },
++ {
+ /* Gericom Bellagio */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
+@@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
+ { }
+ };
+
++/*
++ * Some laptops need keyboard reset before probing for the trackpad to get
++ * it detected, initialised & finally work.
++ */
++static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
++ {
++ /* Gigabyte P35 v2 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
++ },
++ },
++ {
++ /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
++ },
++ },
++ {
++ /* Gigabyte P34 - Elantech touchpad */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
++ },
++ },
++ { }
++};
++
+ #endif /* CONFIG_X86 */
+
+ #ifdef CONFIG_PNP
+@@ -1001,6 +1037,9 @@ static int __init i8042_platform_init(void)
+ if (dmi_check_system(i8042_dmi_dritek_table))
+ i8042_dritek = true;
+
++ if (dmi_check_system(i8042_dmi_kbdreset_table))
++ i8042_kbdreset = true;
++
+ /*
+ * A20 was already enabled during early kernel init. But some buggy
+ * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 86564414b75a..178e75d6bb06 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -67,6 +67,10 @@ static bool i8042_notimeout;
+ module_param_named(notimeout, i8042_notimeout, bool, 0);
+ MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
+
++static bool i8042_kbdreset;
++module_param_named(kbdreset, i8042_kbdreset, bool, 0);
++MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
++
+ #ifdef CONFIG_X86
+ static bool i8042_dritek;
+ module_param_named(dritek, i8042_dritek, bool, 0);
+@@ -783,6 +787,16 @@ static int __init i8042_check_aux(void)
+ return -1;
+
+ /*
++ * Reset keyboard (needed on some laptops to successfully detect
++ * touchpad, e.g., some Gigabyte laptop models with Elantech
++ * touchpads).
++ */
++ if (i8042_kbdreset) {
++ pr_warn("Attempting to reset device connected to KBD port\n");
++ i8042_kbd_write(NULL, (unsigned char) 0xff);
++ }
++
++/*
+ * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
+ * used it for a PCI card or somethig else.
+ */
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index dd255c578ad9..28af276cff9f 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1792,7 +1792,7 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+ struct dma_pte *first_pte = NULL, *pte = NULL;
+ phys_addr_t uninitialized_var(pteval);
+ int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
+- unsigned long sg_res;
++ unsigned long sg_res = 0;
+ unsigned int largepage_lvl = 0;
+ unsigned long lvl_pages = 0;
+
+@@ -1803,10 +1803,8 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+
+ prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP;
+
+- if (sg)
+- sg_res = 0;
+- else {
+- sg_res = nr_pages + 1;
++ if (!sg) {
++ sg_res = nr_pages;
+ pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
+ }
+
+diff --git a/drivers/mfd/tc6393xb.c b/drivers/mfd/tc6393xb.c
+index 9612264f0e6d..b69d91b50d99 100644
+--- a/drivers/mfd/tc6393xb.c
++++ b/drivers/mfd/tc6393xb.c
+@@ -263,6 +263,17 @@ static int tc6393xb_ohci_disable(struct platform_device *dev)
+ return 0;
+ }
+
++static int tc6393xb_ohci_suspend(struct platform_device *dev)
++{
++ struct tc6393xb_platform_data *tcpd = dev_get_platdata(dev->dev.parent);
++
++ /* We can't properly store/restore OHCI state, so fail here */
++ if (tcpd->resume_restore)
++ return -EBUSY;
++
++ return tc6393xb_ohci_disable(dev);
++}
++
+ static int tc6393xb_fb_enable(struct platform_device *dev)
+ {
+ struct tc6393xb *tc6393xb = dev_get_drvdata(dev->dev.parent);
+@@ -403,7 +414,7 @@ static struct mfd_cell __devinitdata tc6393xb_cells[] = {
+ .num_resources = ARRAY_SIZE(tc6393xb_ohci_resources),
+ .resources = tc6393xb_ohci_resources,
+ .enable = tc6393xb_ohci_enable,
+- .suspend = tc6393xb_ohci_disable,
++ .suspend = tc6393xb_ohci_suspend,
+ .resume = tc6393xb_ohci_enable,
+ .disable = tc6393xb_ohci_disable,
+ },
+diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
+index 425bf5a3edd4..068a2466d060 100644
+--- a/drivers/mtd/ubi/upd.c
++++ b/drivers/mtd/ubi/upd.c
+@@ -135,6 +135,10 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
+ ubi_assert(!vol->updating && !vol->changing_leb);
+ vol->updating = 1;
+
++ vol->upd_buf = vmalloc(ubi->leb_size);
++ if (!vol->upd_buf)
++ return -ENOMEM;
++
+ err = set_update_marker(ubi, vol);
+ if (err)
+ return err;
+@@ -154,14 +158,12 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
+ err = clear_update_marker(ubi, vol, 0);
+ if (err)
+ return err;
++
++ vfree(vol->upd_buf);
+ vol->updating = 0;
+ return 0;
+ }
+
+- vol->upd_buf = vmalloc(ubi->leb_size);
+- if (!vol->upd_buf)
+- return -ENOMEM;
+-
+ vol->upd_ebs = div_u64(bytes + vol->usable_leb_size - 1,
+ vol->usable_leb_size);
+ vol->upd_bytes = bytes;
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index d4f7f9537db2..88c39e42cf5a 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -612,10 +612,14 @@ static int can_changelink(struct net_device *dev,
+ if (dev->flags & IFF_UP)
+ return -EBUSY;
+ cm = nla_data(data[IFLA_CAN_CTRLMODE]);
+- if (cm->flags & ~priv->ctrlmode_supported)
++
++ /* check whether changed bits are allowed to be modified */
++ if (cm->mask & ~priv->ctrlmode_supported)
+ return -EOPNOTSUPP;
++
++ /* clear bits to be modified and copy the flag values */
+ priv->ctrlmode &= ~cm->mask;
+- priv->ctrlmode |= cm->flags;
++ priv->ctrlmode |= (cm->flags & cm->mask);
+ }
+
+ if (data[IFLA_CAN_BITTIMING]) {
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+index d2f91f737871..925c7e16a1c0 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+@@ -737,7 +737,7 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+ dev_err(&intf->dev, "%s: couldn't alloc cmd buffer\n",
+ PCAN_USB_DRIVER_NAME);
+ err = -ENOMEM;
+- goto lbl_set_intf_data;
++ goto lbl_free_candev;
+ }
+
+ dev->udev = usb_dev;
+@@ -776,7 +776,7 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+ err = register_candev(netdev);
+ if (err) {
+ dev_err(&intf->dev, "couldn't register CAN device: %d\n", err);
+- goto lbl_free_cmd_buf;
++ goto lbl_restore_intf_data;
+ }
+
+ if (dev->prev_siblings)
+@@ -789,14 +789,14 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+ if (dev->adapter->dev_init) {
+ err = dev->adapter->dev_init(dev);
+ if (err)
+- goto lbl_free_cmd_buf;
++ goto lbl_unregister_candev;
+ }
+
+ /* set bus off */
+ if (dev->adapter->dev_set_bus) {
+ err = dev->adapter->dev_set_bus(dev, 0);
+ if (err)
+- goto lbl_free_cmd_buf;
++ goto lbl_unregister_candev;
+ }
+
+ /* get device number early */
+@@ -808,11 +808,14 @@ static int peak_usb_create_dev(struct peak_usb_adapter *peak_usb_adapter,
+
+ return 0;
+
+-lbl_free_cmd_buf:
+- kfree(dev->cmd_buf);
++lbl_unregister_candev:
++ unregister_candev(netdev);
+
+-lbl_set_intf_data:
++lbl_restore_intf_data:
+ usb_set_intfdata(intf, dev->prev_siblings);
++ kfree(dev->cmd_buf);
++
++lbl_free_candev:
+ free_candev(netdev);
+
+ return err;
+diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+index c95913a09737..5fe28be94de1 100644
+--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
++++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+@@ -333,8 +333,6 @@ static int pcan_usb_pro_send_req(struct peak_usb_device *dev, int req_id,
+ if (!(dev->state & PCAN_USB_STATE_CONNECTED))
+ return 0;
+
+- memset(req_addr, '\0', req_size);
+-
+ req_type = USB_TYPE_VENDOR | USB_RECIP_OTHER;
+
+ switch (req_id) {
+@@ -345,6 +343,7 @@ static int pcan_usb_pro_send_req(struct peak_usb_device *dev, int req_id,
+ default:
+ p = usb_rcvctrlpipe(dev->udev, 0);
+ req_type |= USB_DIR_IN;
++ memset(req_addr, '\0', req_size);
+ break;
+ }
+
+diff --git a/drivers/net/wireless/ath/ath5k/qcu.c b/drivers/net/wireless/ath/ath5k/qcu.c
+index 30b50f934172..19ba20473cd7 100644
+--- a/drivers/net/wireless/ath/ath5k/qcu.c
++++ b/drivers/net/wireless/ath/ath5k/qcu.c
+@@ -223,13 +223,7 @@ ath5k_hw_setup_tx_queue(struct ath5k_hw *ah, enum ath5k_tx_queue queue_type,
+ } else {
+ switch (queue_type) {
+ case AR5K_TX_QUEUE_DATA:
+- for (queue = AR5K_TX_QUEUE_ID_DATA_MIN;
+- ah->ah_txq[queue].tqi_type !=
+- AR5K_TX_QUEUE_INACTIVE; queue++) {
+-
+- if (queue > AR5K_TX_QUEUE_ID_DATA_MAX)
+- return -EINVAL;
+- }
++ queue = queue_info->tqi_subtype;
+ break;
+ case AR5K_TX_QUEUE_UAPSD:
+ queue = AR5K_TX_QUEUE_ID_UAPSD;
+diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
+index f49be96aba75..d4f09b4088b5 100644
+--- a/drivers/net/wireless/ath/ath9k/hw.h
++++ b/drivers/net/wireless/ath/ath9k/hw.h
+@@ -181,8 +181,8 @@
+ #define PAPRD_IDEAL_AGC2_PWR_RANGE 0xe0
+
+ enum ath_hw_txq_subtype {
+- ATH_TXQ_AC_BE = 0,
+- ATH_TXQ_AC_BK = 1,
++ ATH_TXQ_AC_BK = 0,
++ ATH_TXQ_AC_BE = 1,
+ ATH_TXQ_AC_VI = 2,
+ ATH_TXQ_AC_VO = 3,
+ };
+diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
+index f7bd2532269c..2d628f97e18c 100644
+--- a/drivers/net/wireless/ath/ath9k/mac.c
++++ b/drivers/net/wireless/ath/ath9k/mac.c
+@@ -303,14 +303,7 @@ int ath9k_hw_setuptxqueue(struct ath_hw *ah, enum ath9k_tx_queue type,
+ q = ATH9K_NUM_TX_QUEUES - 3;
+ break;
+ case ATH9K_TX_QUEUE_DATA:
+- for (q = 0; q < ATH9K_NUM_TX_QUEUES; q++)
+- if (ah->txq[q].tqi_type ==
+- ATH9K_TX_QUEUE_INACTIVE)
+- break;
+- if (q == ATH9K_NUM_TX_QUEUES) {
+- ath_err(common, "No available TX queue\n");
+- return -1;
+- }
++ q = qinfo->tqi_subtype;
+ break;
+ default:
+ ath_err(common, "Invalid TX queue type: %u\n", type);
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index 63e0199f7c78..d62ad0b1516d 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -254,14 +254,17 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ res->flags |= IORESOURCE_SIZEALIGN;
+ if (res->flags & IORESOURCE_IO) {
+ l &= PCI_BASE_ADDRESS_IO_MASK;
++ sz &= PCI_BASE_ADDRESS_IO_MASK;
+ mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
+ } else {
+ l &= PCI_BASE_ADDRESS_MEM_MASK;
++ sz &= PCI_BASE_ADDRESS_MEM_MASK;
+ mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
+ }
+ } else {
+ res->flags |= (l & IORESOURCE_ROM_ENABLE);
+ l &= PCI_ROM_ADDRESS_MASK;
++ sz &= PCI_ROM_ADDRESS_MASK;
+ mask = (u32)PCI_ROM_ADDRESS_MASK;
+ }
+
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index e587d0035a74..ffde183ac1b3 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -327,19 +327,52 @@ static void __devinit quirk_s3_64M(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_868, quirk_s3_64M);
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3, PCI_DEVICE_ID_S3_968, quirk_s3_64M);
+
++static void quirk_io(struct pci_dev *dev, int pos, unsigned size,
++ const char *name)
++{
++ u32 region;
++ struct pci_bus_region bus_region;
++ struct resource *res = dev->resource + pos;
++
++ pci_read_config_dword(dev, PCI_BASE_ADDRESS_0 + (pos << 2), ®ion);
++
++ if (!region)
++ return;
++
++ res->name = pci_name(dev);
++ res->flags = region & ~PCI_BASE_ADDRESS_IO_MASK;
++ res->flags |=
++ (IORESOURCE_IO | IORESOURCE_PCI_FIXED | IORESOURCE_SIZEALIGN);
++ region &= ~(size - 1);
++
++ /* Convert from PCI bus to resource space */
++ bus_region.start = region;
++ bus_region.end = region + size - 1;
++ pcibios_bus_to_resource(dev->bus, res, &bus_region);
++
++ dev_info(&dev->dev, FW_BUG "%s quirk: reg 0x%x: %pR\n",
++ name, PCI_BASE_ADDRESS_0 + (pos << 2), res);
++}
++
+ /*
+ * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
+ * ver. 1.33 20070103) don't set the correct ISA PCI region header info.
+ * BAR0 should be 8 bytes; instead, it may be set to something like 8k
+ * (which conflicts w/ BAR1's memory range).
++ *
++ * CS553x's ISA PCI BARs may also be read-only (ref:
++ * https://bugzilla.kernel.org/show_bug.cgi?id=85991 - Comment #4 forward).
+ */
+ static void __devinit quirk_cs5536_vsa(struct pci_dev *dev)
+ {
++ static char *name = "CS5536 ISA bridge";
++
+ if (pci_resource_len(dev, 0) != 8) {
+- struct resource *res = &dev->resource[0];
+- res->end = res->start + 8 - 1;
+- dev_info(&dev->dev, "CS5536 ISA bridge bug detected "
+- "(incorrect header); workaround applied.\n");
++ quirk_io(dev, 0, 8, name); /* SMB */
++ quirk_io(dev, 1, 256, name); /* GPIO */
++ quirk_io(dev, 2, 64, name); /* MFGPT */
++ dev_info(&dev->dev, "%s bug detected (incorrect header); workaround applied\n",
++ name);
+ }
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 0076feae0ce3..be6b6482da57 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
+ AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
+ AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
+ AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
++ AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
+ { NULL, }
+ /* Laptop models without axis info (yet):
+ * "NC6910" "HP Compaq 6910"
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index c18f0fd1577f..0d71557cf7a3 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1395,12 +1395,14 @@ void regulator_put(struct regulator *regulator)
+ device_remove_file(regulator->dev, ®ulator->dev_attr);
+ kfree(regulator->dev_attr.attr.name);
+ }
++ mutex_lock(&rdev->mutex);
+ kfree(regulator->supply_name);
+ list_del(®ulator->list);
+ kfree(regulator);
+
+ rdev->open_count--;
+ rdev->exclusive = 0;
++ mutex_unlock(&rdev->mutex);
+
+ module_put(rdev->owner);
+ mutex_unlock(®ulator_list_mutex);
+diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
+index 4f9f1dcc1551..fa47d8de304a 100644
+--- a/drivers/s390/char/con3215.c
++++ b/drivers/s390/char/con3215.c
+@@ -997,12 +997,26 @@ static int tty3215_write(struct tty_struct * tty,
+ const unsigned char *buf, int count)
+ {
+ struct raw3215_info *raw;
++ int i, written;
+
+ if (!tty)
+ return 0;
+ raw = (struct raw3215_info *) tty->driver_data;
+- raw3215_write(raw, buf, count);
+- return count;
++ written = count;
++ while (count > 0) {
++ for (i = 0; i < count; i++)
++ if (buf[i] == '\t' || buf[i] == '\n')
++ break;
++ raw3215_write(raw, buf, i);
++ count -= i;
++ buf += i;
++ if (count > 0) {
++ raw3215_putchar(raw, *buf);
++ count--;
++ buf++;
++ }
++ }
++ return written;
+ }
+
+ /*
+@@ -1149,7 +1163,7 @@ static int __init tty3215_init(void)
+ driver->subtype = SYSTEM_TYPE_TTY;
+ driver->init_termios = tty_std_termios;
+ driver->init_termios.c_iflag = IGNBRK | IGNPAR;
+- driver->init_termios.c_oflag = ONLCR | XTABS;
++ driver->init_termios.c_oflag = ONLCR;
+ driver->init_termios.c_lflag = ISIG;
+ driver->flags = TTY_DRIVER_REAL_RAW;
+ tty_set_operations(driver, &tty3215_ops);
+diff --git a/drivers/scsi/NCR5380.c b/drivers/scsi/NCR5380.c
+index 165e4dd865d9..a57f85ac96c8 100644
+--- a/drivers/scsi/NCR5380.c
++++ b/drivers/scsi/NCR5380.c
+@@ -2662,14 +2662,14 @@ static void NCR5380_dma_complete(NCR5380_instance * instance) {
+ *
+ * Purpose : abort a command
+ *
+- * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
+- * host byte of the result field to, if zero DID_ABORTED is
++ * Inputs : cmd - the Scsi_Cmnd to abort, code - code to set the
++ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+- * XXX - there is no way to abort the command that is currently
+- * connected, you have to wait for it to complete. If this is
++ * XXX - there is no way to abort the command that is currently
++ * connected, you have to wait for it to complete. If this is
+ * a problem, we could implement longjmp() / setjmp(), setjmp()
+ * called where the loop started in NCR5380_main().
+ *
+@@ -2719,7 +2719,7 @@ static int NCR5380_abort(Scsi_Cmnd * cmd) {
+ * aborted flag and get back into our main loop.
+ */
+
+- return 0;
++ return SUCCESS;
+ }
+ #endif
+
+diff --git a/drivers/scsi/aha1740.c b/drivers/scsi/aha1740.c
+index a3e6ed353917..d0fa3e7196d6 100644
+--- a/drivers/scsi/aha1740.c
++++ b/drivers/scsi/aha1740.c
+@@ -550,7 +550,7 @@ static int aha1740_eh_abort_handler (Scsi_Cmnd *dummy)
+ * quiet as possible...
+ */
+
+- return 0;
++ return SUCCESS;
+ }
+
+ static struct scsi_host_template aha1740_template = {
+diff --git a/drivers/scsi/atari_NCR5380.c b/drivers/scsi/atari_NCR5380.c
+index 2db79b469d9e..589c2a3f629a 100644
+--- a/drivers/scsi/atari_NCR5380.c
++++ b/drivers/scsi/atari_NCR5380.c
+@@ -2638,7 +2638,7 @@ static void NCR5380_reselect(struct Scsi_Host *instance)
+ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+ * XXX - there is no way to abort the command that is currently
+ * connected, you have to wait for it to complete. If this is
+diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+index c1c6a92a0b98..cabfbf359988 100644
+--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+@@ -406,6 +406,7 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
+ struct fc_frame_header *fh;
+ struct fcoe_rcv_info *fr;
+ struct fcoe_percpu_s *bg;
++ struct sk_buff *tmp_skb;
+ unsigned short oxid;
+
+ interface = container_of(ptype, struct bnx2fc_interface,
+@@ -417,6 +418,12 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
+ goto err;
+ }
+
++ tmp_skb = skb_share_check(skb, GFP_ATOMIC);
++ if (!tmp_skb)
++ goto err;
++
++ skb = tmp_skb;
++
+ if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
+ printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n");
+ goto err;
+diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
+index 4d39a9ffc081..152fe62d7c80 100644
+--- a/drivers/scsi/megaraid.c
++++ b/drivers/scsi/megaraid.c
+@@ -1967,7 +1967,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
+ cmd->device->id, cmd->device->lun);
+
+ if(list_empty(&adapter->pending_list))
+- return FALSE;
++ return FAILED;
+
+ list_for_each_safe(pos, next, &adapter->pending_list) {
+
+@@ -1990,7 +1990,7 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
+ (aor==SCB_ABORT) ? "ABORTING":"RESET",
+ scb->idx);
+
+- return FALSE;
++ return FAILED;
+ }
+ else {
+
+@@ -2015,12 +2015,12 @@ megaraid_abort_and_reset(adapter_t *adapter, Scsi_Cmnd *cmd, int aor)
+ list_add_tail(SCSI_LIST(cmd),
+ &adapter->completed_list);
+
+- return TRUE;
++ return SUCCESS;
+ }
+ }
+ }
+
+- return FALSE;
++ return FAILED;
+ }
+
+ static inline int
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 618870033dd0..bacd344f4626 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -919,7 +919,7 @@ megasas_issue_blocked_abort_cmd(struct megasas_instance *instance,
+ abort_fr->abort_mfi_phys_addr_hi = 0;
+
+ cmd->sync_cmd = 1;
+- cmd->cmd_status = 0xFF;
++ cmd->cmd_status = ENODATA;
+
+ instance->instancet->issue_dcmd(instance, cmd);
+
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 05973a491310..7f6746a642e6 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -2238,7 +2238,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ }
+
+ sdkp->DPOFUA = (data.device_specific & 0x10) != 0;
+- if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
++ if (sdp->broken_fua) {
++ sd_printk(KERN_NOTICE, sdkp, "Disabling FUA\n");
++ sdkp->DPOFUA = 0;
++ } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) {
+ sd_printk(KERN_NOTICE, sdkp,
+ "Uses READ/WRITE(6), disabling FUA\n");
+ sdkp->DPOFUA = 0;
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index 446c02379c80..a0df0fbf2db9 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -1359,13 +1359,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
+ if (ret == -EAGAIN) {
+ /* no more space */
+
+- if (cmd_request->bounce_sgl_count) {
++ if (cmd_request->bounce_sgl_count)
+ destroy_bounce_buffer(cmd_request->bounce_sgl,
+ cmd_request->bounce_sgl_count);
+
+- ret = SCSI_MLQUEUE_DEVICE_BUSY;
+- goto queue_error;
+- }
++ ret = SCSI_MLQUEUE_DEVICE_BUSY;
++ goto queue_error;
+ }
+
+ return 0;
+diff --git a/drivers/scsi/sun3_NCR5380.c b/drivers/scsi/sun3_NCR5380.c
+index 7e12a2e4e0a3..9aaf0840d0ac 100644
+--- a/drivers/scsi/sun3_NCR5380.c
++++ b/drivers/scsi/sun3_NCR5380.c
+@@ -2624,15 +2624,15 @@ static void NCR5380_reselect (struct Scsi_Host *instance)
+ * Purpose : abort a command
+ *
+ * Inputs : cmd - the struct scsi_cmnd to abort, code - code to set the
+- * host byte of the result field to, if zero DID_ABORTED is
++ * host byte of the result field to, if zero DID_ABORTED is
+ * used.
+ *
+- * Returns : 0 - success, -1 on failure.
++ * Returns : SUCCESS - success, FAILED on failure.
+ *
+- * XXX - there is no way to abort the command that is currently
+- * connected, you have to wait for it to complete. If this is
++ * XXX - there is no way to abort the command that is currently
++ * connected, you have to wait for it to complete. If this is
+ * a problem, we could implement longjmp() / setjmp(), setjmp()
+- * called where the loop started in NCR5380_main().
++ * called where the loop started in NCR5380_main().
+ */
+
+ static int NCR5380_abort(struct scsi_cmnd *cmd)
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index efc494a65b43..f15f6241671a 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -219,7 +219,6 @@ int dw_spi_mid_init(struct dw_spi *dws)
+ iounmap(clk_reg);
+
+ dws->num_cs = 16;
+- dws->fifo_len = 40; /* FIFO has 40 words buffer */
+
+ #ifdef CONFIG_SPI_DW_MID_DMA
+ dws->dma_priv = kzalloc(sizeof(struct mid_dma), GFP_KERNEL);
+diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c
+index d1a495f64e2d..cce2d7b90aad 100644
+--- a/drivers/spi/spi-dw.c
++++ b/drivers/spi/spi-dw.c
+@@ -394,9 +394,6 @@ static void pump_transfers(unsigned long data)
+ chip = dws->cur_chip;
+ spi = message->spi;
+
+- if (unlikely(!chip->clk_div))
+- chip->clk_div = dws->max_freq / chip->speed_hz;
+-
+ if (message->state == ERROR_STATE) {
+ message->status = -EIO;
+ goto early_exit;
+@@ -438,7 +435,7 @@ static void pump_transfers(unsigned long data)
+ if (transfer->speed_hz) {
+ speed = chip->speed_hz;
+
+- if (transfer->speed_hz != speed) {
++ if ((transfer->speed_hz != speed) || (!chip->clk_div)) {
+ speed = transfer->speed_hz;
+ if (speed > dws->max_freq) {
+ printk(KERN_ERR "MRST SPI0: unsupported"
+@@ -677,7 +674,6 @@ static int dw_spi_setup(struct spi_device *spi)
+ dev_err(&spi->dev, "No max speed HZ parameter\n");
+ return -EINVAL;
+ }
+- chip->speed_hz = spi->max_speed_hz;
+
+ chip->tmode = 0; /* Tx & Rx */
+ /* Default SPI mode is SCPOL = 0, SCPH = 0 */
+@@ -784,13 +780,13 @@ static void spi_hw_init(struct dw_spi *dws)
+ */
+ if (!dws->fifo_len) {
+ u32 fifo;
+- for (fifo = 2; fifo <= 257; fifo++) {
++ for (fifo = 1; fifo < 256; fifo++) {
+ dw_writew(dws, DW_SPI_TXFLTR, fifo);
+ if (fifo != dw_readw(dws, DW_SPI_TXFLTR))
+ break;
+ }
+
+- dws->fifo_len = (fifo == 257) ? 0 : fifo;
++ dws->fifo_len = (fifo == 1) ? 0 : fifo;
+ dw_writew(dws, DW_SPI_TXFLTR, 0);
+ }
+ }
+diff --git a/drivers/staging/comedi/drivers/cb_pcidas64.c b/drivers/staging/comedi/drivers/cb_pcidas64.c
+index 915157d47805..6f743df82542 100644
+--- a/drivers/staging/comedi/drivers/cb_pcidas64.c
++++ b/drivers/staging/comedi/drivers/cb_pcidas64.c
+@@ -423,6 +423,29 @@ static const struct comedi_lrange ai_ranges_64xx = {
+ }
+ };
+
++static const uint8_t ai_range_code_64xx[8] = {
++ 0x0, 0x1, 0x2, 0x3, /* bipolar 10, 5, 2,5, 1.25 */
++ 0x8, 0x9, 0xa, 0xb /* unipolar 10, 5, 2.5, 1.25 */
++};
++
++/* analog input ranges for 64-Mx boards */
++static const struct comedi_lrange ai_ranges_64_mx = {
++ 7, {
++ BIP_RANGE(5),
++ BIP_RANGE(2.5),
++ BIP_RANGE(1.25),
++ BIP_RANGE(0.625),
++ UNI_RANGE(5),
++ UNI_RANGE(2.5),
++ UNI_RANGE(1.25)
++ }
++};
++
++static const uint8_t ai_range_code_64_mx[7] = {
++ 0x0, 0x1, 0x2, 0x3, /* bipolar 5, 2.5, 1.25, 0.625 */
++ 0x9, 0xa, 0xb /* unipolar 5, 2.5, 1.25 */
++};
++
+ /* analog input ranges for 60xx boards */
+ static const struct comedi_lrange ai_ranges_60xx = {
+ 4,
+@@ -434,6 +457,10 @@ static const struct comedi_lrange ai_ranges_60xx = {
+ }
+ };
+
++static const uint8_t ai_range_code_60xx[4] = {
++ 0x0, 0x1, 0x4, 0x7 /* bipolar 10, 5, 0.5, 0.05 */
++};
++
+ /* analog input ranges for 6030, etc boards */
+ static const struct comedi_lrange ai_ranges_6030 = {
+ 14,
+@@ -455,6 +482,11 @@ static const struct comedi_lrange ai_ranges_6030 = {
+ }
+ };
+
++static const uint8_t ai_range_code_6030[14] = {
++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, /* bip 10, 5, 2, 1, 0.5, 0.2, 0.1 */
++ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* uni 10, 5, 2, 1, 0.5, 0.2, 0.1 */
++};
++
+ /* analog input ranges for 6052, etc boards */
+ static const struct comedi_lrange ai_ranges_6052 = {
+ 15,
+@@ -477,6 +509,11 @@ static const struct comedi_lrange ai_ranges_6052 = {
+ }
+ };
+
++static const uint8_t ai_range_code_6052[15] = {
++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7, /* bipolar 10 ... 0.05 */
++ 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf /* unipolar 10 ... 0.1 */
++};
++
+ /* analog input ranges for 4020 board */
+ static const struct comedi_lrange ai_ranges_4020 = {
+ 2,
+@@ -561,6 +598,7 @@ struct pcidas64_board {
+ int ai_bits; /* analog input resolution */
+ int ai_speed; /* fastest conversion period in ns */
+ const struct comedi_lrange *ai_range_table;
++ const uint8_t *ai_range_code;
+ int ao_nchan; /* number of analog out channels */
+ int ao_bits; /* analog output resolution */
+ int ao_scan_speed; /* analog output speed (for a scan, not conversion) */
+@@ -619,6 +657,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+ .ai_range_table = &ai_ranges_64xx,
++ .ai_range_code = ai_range_code_64xx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -635,6 +674,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+ .ai_range_table = &ai_ranges_64xx,
++ .ai_range_code = ai_range_code_64xx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -650,7 +690,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -666,7 +707,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -682,7 +724,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ao_range_table = &ao_ranges_64xx,
+ .ao_range_code = ao_range_code_64xx,
+ .ai_fifo = &ai_fifo_64xx,
+@@ -698,6 +741,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_bits = 16,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &ao_ranges_60xx,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -714,6 +758,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &ao_ranges_60xx,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -729,6 +774,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &ao_ranges_60xx,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -745,6 +791,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &ao_ranges_60xx,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -761,6 +808,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -777,6 +825,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -791,6 +840,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+ .has_8255 = 0,
+ },
+@@ -803,6 +853,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6030,
++ .ai_range_code = ai_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+ .has_8255 = 0,
+ },
+@@ -816,6 +867,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 0,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+ .has_8255 = 0,
+ },
+@@ -830,6 +882,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &ao_ranges_60xx,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -846,6 +899,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 100000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_60xx,
++ .ai_range_code = ai_range_code_60xx,
+ .ao_range_table = &ao_ranges_60xx,
+ .ao_range_code = ao_range_code_60xx,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -862,6 +916,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 1000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -878,6 +933,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 3333,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -894,6 +950,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 1000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -910,6 +967,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 1000,
+ .layout = LAYOUT_60XX,
+ .ai_range_table = &ai_ranges_6052,
++ .ai_range_code = ai_range_code_6052,
+ .ao_range_table = &ao_ranges_6030,
+ .ao_range_code = ao_range_code_6030,
+ .ai_fifo = &ai_fifo_60xx,
+@@ -942,6 +1000,7 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+ .ai_range_table = &ai_ranges_64xx,
++ .ai_range_code = ai_range_code_64xx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -954,7 +1013,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -967,7 +1027,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -980,7 +1041,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 0,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -993,7 +1055,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 2,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1006,7 +1069,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 2,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1019,7 +1083,8 @@ static const struct pcidas64_board pcidas64_boards[] = {
+ .ao_nchan = 2,
+ .ao_scan_speed = 10000,
+ .layout = LAYOUT_64XX,
+- .ai_range_table = &ai_ranges_64xx,
++ .ai_range_table = &ai_ranges_64_mx,
++ .ai_range_code = ai_range_code_64_mx,
+ .ai_fifo = ai_fifo_64xx,
+ .has_8255 = 1,
+ },
+@@ -1257,45 +1322,7 @@ module_exit(driver_cb_pcidas_cleanup_module);
+ static unsigned int ai_range_bits_6xxx(const struct comedi_device *dev,
+ unsigned int range_index)
+ {
+- const struct comedi_krange *range =
+- &board(dev)->ai_range_table->range[range_index];
+- unsigned int bits = 0;
+-
+- switch (range->max) {
+- case 10000000:
+- bits = 0x000;
+- break;
+- case 5000000:
+- bits = 0x100;
+- break;
+- case 2000000:
+- case 2500000:
+- bits = 0x200;
+- break;
+- case 1000000:
+- case 1250000:
+- bits = 0x300;
+- break;
+- case 500000:
+- bits = 0x400;
+- break;
+- case 200000:
+- case 250000:
+- bits = 0x500;
+- break;
+- case 100000:
+- bits = 0x600;
+- break;
+- case 50000:
+- bits = 0x700;
+- break;
+- default:
+- comedi_error(dev, "bug! in ai_range_bits_6xxx");
+- break;
+- }
+- if (range->min == 0)
+- bits += 0x900;
+- return bits;
++ return board(dev)->ai_range_code[range_index] << 8;
+ }
+
+ static unsigned int hw_revision(const struct comedi_device *dev,
+diff --git a/drivers/staging/iio/events.h b/drivers/staging/iio/events.h
+index c25f0e3c92e9..a6f999c12072 100644
+--- a/drivers/staging/iio/events.h
++++ b/drivers/staging/iio/events.h
+@@ -90,7 +90,7 @@ enum iio_event_direction {
+
+ #define IIO_EVENT_CODE_EXTRACT_TYPE(mask) ((mask >> 56) & 0xFF)
+
+-#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0xCF)
++#define IIO_EVENT_CODE_EXTRACT_DIR(mask) ((mask >> 48) & 0x7F)
+
+ #define IIO_EVENT_CODE_EXTRACT_CHAN_TYPE(mask) ((mask >> 32) & 0xFF)
+
+diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
+index 4c05ed6beccc..8d57ab3a54b0 100644
+--- a/drivers/target/iscsi/iscsi_target_util.c
++++ b/drivers/target/iscsi/iscsi_target_util.c
+@@ -1480,15 +1480,15 @@ static int iscsit_do_tx_data(
+ struct iscsi_conn *conn,
+ struct iscsi_data_count *count)
+ {
+- int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
++ int ret, iov_len;
+ struct kvec *iov_p;
+ struct msghdr msg;
+
+ if (!conn || !conn->sock || !conn->conn_ops)
+ return -1;
+
+- if (data <= 0) {
+- pr_err("Data length is: %d\n", data);
++ if (count->data_length <= 0) {
++ pr_err("Data length is: %d\n", count->data_length);
+ return -1;
+ }
+
+@@ -1497,20 +1497,16 @@ static int iscsit_do_tx_data(
+ iov_p = count->iov;
+ iov_len = count->iov_count;
+
+- while (total_tx < data) {
+- tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
+- (data - total_tx));
+- if (tx_loop <= 0) {
+- pr_debug("tx_loop: %d total_tx %d\n",
+- tx_loop, total_tx);
+- return tx_loop;
+- }
+- total_tx += tx_loop;
+- pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
+- tx_loop, total_tx, data);
++ ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
++ count->data_length);
++ if (ret != count->data_length) {
++ pr_err("Unexpected ret: %d send data %d\n",
++ ret, count->data_length);
++ return -EPIPE;
+ }
++ pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
+
+- return total_tx;
++ return ret;
+ }
+
+ int rx_data(
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index d8b0aee35632..1b7d2c0abd7e 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -524,11 +524,15 @@ static void s3c24xx_serial_pm(struct uart_port *port, unsigned int level,
+ unsigned int old)
+ {
+ struct s3c24xx_uart_port *ourport = to_ourport(port);
++ int timeout = 10000;
+
+ ourport->pm_level = level;
+
+ switch (level) {
+ case 3:
++ while (--timeout && !s3c24xx_serial_txempty_nofifo(port))
++ udelay(100);
++
+ if (!IS_ERR(ourport->baudclk) && ourport->baudclk != NULL)
+ clk_disable(ourport->baudclk);
+
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 8f4a628d3382..05325773ab94 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1108,10 +1108,11 @@ next_desc:
+ } else {
+ control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
+ data_interface = usb_ifnum_to_if(usb_dev, (data_interface_num = union_header->bSlaveInterface0));
+- if (!control_interface || !data_interface) {
+- dev_dbg(&intf->dev, "no interfaces\n");
+- return -ENODEV;
+- }
++ }
++
++ if (!control_interface || !data_interface) {
++ dev_dbg(&intf->dev, "no interfaces\n");
++ return -ENODEV;
+ }
+
+ if (data_interface_num != call_interface_num)
+@@ -1429,6 +1430,7 @@ static void acm_disconnect(struct usb_interface *intf)
+ &dev_attr_wCountryCodes);
+ device_remove_file(&acm->control->dev,
+ &dev_attr_iCountryCodeRelDate);
++ kfree(acm->country_codes);
+ }
+ device_remove_file(&acm->control->dev, &dev_attr_bmCapabilities);
+ usb_set_intfdata(acm->control, NULL);
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 6ed7e7c787d8..cc1004a2f9cd 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -201,6 +201,17 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum,
+ if (n == 0)
+ n = 9; /* 32 ms = 2^(9-1) uframes */
+ j = 16;
++
++ /*
++ * Adjust bInterval for quirked devices.
++ * This quirk fixes bIntervals reported in
++ * linear microframes.
++ */
++ if (to_usb_device(ddev)->quirks &
++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL) {
++ n = clamp(fls(d->bInterval), i, j);
++ i = j = n;
++ }
+ break;
+ default: /* USB_SPEED_FULL or _LOW */
+ /* For low-speed, 10 ms is the official minimum.
+diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
+index d2b9af59cba9..b283a652f155 100644
+--- a/drivers/usb/core/inode.c
++++ b/drivers/usb/core/inode.c
+@@ -211,7 +211,7 @@ static void update_bus(struct dentry *bus)
+
+ mutex_lock(&bus->d_inode->i_mutex);
+
+- list_for_each_entry(dev, &bus->d_subdirs, d_u.d_child)
++ list_for_each_entry(dev, &bus->d_subdirs, d_child)
+ if (dev->d_inode)
+ update_dev(dev);
+
+@@ -228,7 +228,7 @@ static void update_sb(struct super_block *sb)
+
+ mutex_lock_nested(&root->d_inode->i_mutex, I_MUTEX_PARENT);
+
+- list_for_each_entry(bus, &root->d_subdirs, d_u.d_child) {
++ list_for_each_entry(bus, &root->d_subdirs, d_child) {
+ if (bus->d_inode) {
+ switch (S_IFMT & bus->d_inode->i_mode) {
+ case S_IFDIR:
+@@ -342,7 +342,7 @@ static int usbfs_empty (struct dentry *dentry)
+
+ spin_lock(&dentry->d_lock);
+ list_for_each(list, &dentry->d_subdirs) {
+- struct dentry *de = list_entry(list, struct dentry, d_u.d_child);
++ struct dentry *de = list_entry(list, struct dentry, d_child);
+
+ spin_lock_nested(&de->d_lock, DENTRY_D_LOCK_NESTED);
+ if (usbfs_positive(de)) {
+diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
+index e8cdce571bb1..2753cec61aaf 100644
+--- a/drivers/usb/core/otg_whitelist.h
++++ b/drivers/usb/core/otg_whitelist.h
+@@ -59,6 +59,11 @@ static int is_targeted(struct usb_device *dev)
+ le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
+ return 0;
+
++ /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
++ if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
++ le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
++ return 1;
++
+ /* NOTE: can't use usb_match_id() since interface caches
+ * aren't set up yet. this is cut/paste from that code.
+ */
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 980a9d8c6504..9fac46d41f4d 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -43,6 +43,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Creative SB Audigy 2 NX */
+ { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Microsoft Wireless Laser Mouse 6000 Receiver */
++ { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Microsoft LifeCam-VX700 v2.0 */
+ { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -149,6 +152,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* SKYMEDI USB_DRIVE */
+ { USB_DEVICE(0x1516, 0x8628), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Razer - Razer Blade Keyboard */
++ { USB_DEVICE(0x1532, 0x0116), .driver_info =
++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
++
+ /* BUILDWIN Photo Frame */
+ { USB_DEVICE(0x1908, 0x1315), .driver_info =
+ USB_QUIRK_HONOR_BNUMINTERFACES },
+@@ -168,6 +175,10 @@ static const struct usb_device_id usb_interface_quirk_list[] = {
+ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+
++ /* Protocol and OTG Electrical Test Device */
++ { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
++ USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
++
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 1acb3a419539..b7f89268c0f4 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -851,6 +851,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
+ if (last_one)
+ break;
+ }
++
++ if (last_one)
++ break;
+ } else {
+ dma = req->request.dma;
+ length = req->request.length;
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 90dcf54cd7e8..1f230edfedf9 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -470,7 +470,8 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ {
+ void __iomem *base;
+ u32 control;
+- u32 fminterval;
++ u32 fminterval = 0;
++ bool no_fminterval = false;
+ int cnt;
+
+ if (!mmio_resource_enabled(pdev, 0))
+@@ -480,6 +481,13 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ if (base == NULL)
+ return;
+
++ /*
++ * ULi M5237 OHCI controller locks the whole system when accessing
++ * the OHCI_FMINTERVAL offset.
++ */
++ if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
++ no_fminterval = true;
++
+ control = readl(base + OHCI_CONTROL);
+
+ /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
+@@ -518,7 +526,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ }
+
+ /* software reset of the controller, preserving HcFmInterval */
+- fminterval = readl(base + OHCI_FMINTERVAL);
++ if (!no_fminterval)
++ fminterval = readl(base + OHCI_FMINTERVAL);
++
+ writel(OHCI_HCR, base + OHCI_CMDSTATUS);
+
+ /* reset requires max 10 us delay */
+@@ -527,7 +537,9 @@ static void __devinit quirk_usb_handoff_ohci(struct pci_dev *pdev)
+ break;
+ udelay(1);
+ }
+- writel(fminterval, base + OHCI_FMINTERVAL);
++
++ if (!no_fminterval)
++ writel(fminterval, base + OHCI_FMINTERVAL);
+
+ /* Now the controller is safely in SUSPEND and nothing can wake it up */
+ iounmap(base);
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index c8835d591b37..c9e39d453f6b 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -238,7 +238,7 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ xhci->shared_hcd->state != HC_STATE_SUSPENDED)
+ return -EINVAL;
+
+- retval = xhci_suspend(xhci);
++ retval = xhci_suspend(xhci, do_wakeup);
+
+ return retval;
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 95e8648ade45..950edebba8f1 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1178,9 +1178,8 @@ static void handle_reset_ep_completion(struct xhci_hcd *xhci,
+ false);
+ xhci_ring_cmd_db(xhci);
+ } else {
+- /* Clear our internal halted state and restart the ring(s) */
++ /* Clear our internal halted state */
+ xhci->devs[slot_id]->eps[ep_index].ep_state &= ~EP_HALTED;
+- ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ }
+ }
+
+@@ -1916,23 +1915,12 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ ep->stopped_trb = event_trb;
+ return 0;
+ } else {
+- if (trb_comp_code == COMP_STALL) {
+- /* The transfer is completed from the driver's
+- * perspective, but we need to issue a set dequeue
+- * command for this stalled endpoint to move the dequeue
+- * pointer past the TD. We can't do that here because
+- * the halt condition must be cleared first. Let the
+- * USB class driver clear the stall later.
+- */
+- ep->stopped_td = td;
+- ep->stopped_trb = event_trb;
+- ep->stopped_stream = ep_ring->stream_id;
+- } else if (xhci_requires_manual_halt_cleanup(xhci,
+- ep_ctx, trb_comp_code)) {
+- /* Other types of errors halt the endpoint, but the
+- * class driver doesn't call usb_reset_endpoint() unless
+- * the error is -EPIPE. Clear the halted status in the
+- * xHCI hardware manually.
++ if (trb_comp_code == COMP_STALL ||
++ xhci_requires_manual_halt_cleanup(xhci, ep_ctx,
++ trb_comp_code)) {
++ /* Issue a reset endpoint command to clear the host side * halt, followed by a set dequeue command to move the
++ * dequeue pointer past the TD.
++ * The class driver clears the device side halt later.
+ */
+ xhci_cleanup_halted_endpoint(xhci,
+ slot_id, ep_index, ep_ring->stream_id,
+@@ -2052,9 +2040,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ else
+ td->urb->actual_length = 0;
+
+- xhci_cleanup_halted_endpoint(xhci,
+- slot_id, ep_index, 0, td, event_trb);
+- return finish_td(xhci, td, event_trb, event, ep, status, true);
++ return finish_td(xhci, td, event_trb, event, ep, status, false);
+ }
+ /*
+ * Did we transfer any data, despite the errors that might have
+@@ -2606,17 +2592,8 @@ cleanup:
+ if (ret) {
+ urb = td->urb;
+ urb_priv = urb->hcpriv;
+- /* Leave the TD around for the reset endpoint function
+- * to use(but only if it's not a control endpoint,
+- * since we already queued the Set TR dequeue pointer
+- * command for stalled control endpoints).
+- */
+- if (usb_endpoint_xfer_control(&urb->ep->desc) ||
+- (trb_comp_code != COMP_STALL &&
+- trb_comp_code != COMP_BABBLE))
+- xhci_urb_free_priv(xhci, urb_priv);
+- else
+- kfree(urb_priv);
++
++ xhci_urb_free_priv(xhci, urb_priv);
+
+ usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
+ if ((urb->actual_length != urb->transfer_buffer_length &&
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 424d9cf9d9a0..d96652d3fb54 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -33,6 +33,8 @@
+ #define DRIVER_AUTHOR "Sarah Sharp"
+ #define DRIVER_DESC "'eXtensible' Host Controller (xHC) Driver"
+
++#define PORT_WAKE_BITS (PORT_WKOC_E | PORT_WKDISC_E | PORT_WKCONN_E)
++
+ /* Some 0.95 hardware can't handle the chain bit on a Link TRB being cleared */
+ static int link_quirk;
+ module_param(link_quirk, int, S_IRUGO | S_IWUSR);
+@@ -884,19 +886,57 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
+ xhci_set_cmd_ring_deq(xhci);
+ }
+
++static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci)
++{
++ int port_index;
++ __le32 __iomem **port_array;
++ unsigned long flags;
++ u32 t1, t2;
++
++ spin_lock_irqsave(&xhci->lock, flags);
++
++ /* disble usb3 ports Wake bits*/
++ port_index = xhci->num_usb3_ports;
++ port_array = xhci->usb3_ports;
++ while (port_index--) {
++ t1 = readl(port_array[port_index]);
++ t1 = xhci_port_state_to_neutral(t1);
++ t2 = t1 & ~PORT_WAKE_BITS;
++ if (t1 != t2)
++ writel(t2, port_array[port_index]);
++ }
++
++ /* disble usb2 ports Wake bits*/
++ port_index = xhci->num_usb2_ports;
++ port_array = xhci->usb2_ports;
++ while (port_index--) {
++ t1 = readl(port_array[port_index]);
++ t1 = xhci_port_state_to_neutral(t1);
++ t2 = t1 & ~PORT_WAKE_BITS;
++ if (t1 != t2)
++ writel(t2, port_array[port_index]);
++ }
++
++ spin_unlock_irqrestore(&xhci->lock, flags);
++}
++
+ /*
+ * Stop HC (not bus-specific)
+ *
+ * This is called when the machine transition into S3/S4 mode.
+ *
+ */
+-int xhci_suspend(struct xhci_hcd *xhci)
++int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup)
+ {
+ int rc = 0;
+ unsigned int delay = XHCI_MAX_HALT_USEC;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ u32 command;
+
++ /* Clear root port wake on bits if wakeup not allowed. */
++ if (!do_wakeup)
++ xhci_disable_port_wake_on_bits(xhci);
++
+ /* Don't poll the roothubs on bus suspend. */
+ xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+ clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+@@ -2851,61 +2891,31 @@ void xhci_cleanup_stalled_ring(struct xhci_hcd *xhci,
+ }
+ }
+
+-/* Deal with stalled endpoints. The core should have sent the control message
+- * to clear the halt condition. However, we need to make the xHCI hardware
+- * reset its sequence number, since a device will expect a sequence number of
+- * zero after the halt condition is cleared.
++/* Called when clearing halted device. The core should have sent the control
++ * message to clear the device halt condition. The host side of the halt should
++ * already be cleared with a reset endpoint command issued when the STALL tx
++ * event was received.
++ *
+ * Context: in_interrupt
+ */
++
+ void xhci_endpoint_reset(struct usb_hcd *hcd,
+ struct usb_host_endpoint *ep)
+ {
+ struct xhci_hcd *xhci;
+- struct usb_device *udev;
+- unsigned int ep_index;
+- unsigned long flags;
+- int ret;
+- struct xhci_virt_ep *virt_ep;
+
+ xhci = hcd_to_xhci(hcd);
+- udev = (struct usb_device *) ep->hcpriv;
+- /* Called with a root hub endpoint (or an endpoint that wasn't added
+- * with xhci_add_endpoint()
+- */
+- if (!ep->hcpriv)
+- return;
+- ep_index = xhci_get_endpoint_index(&ep->desc);
+- virt_ep = &xhci->devs[udev->slot_id]->eps[ep_index];
+- if (!virt_ep->stopped_td) {
+- xhci_dbg(xhci, "Endpoint 0x%x not halted, refusing to reset.\n",
+- ep->desc.bEndpointAddress);
+- return;
+- }
+- if (usb_endpoint_xfer_control(&ep->desc)) {
+- xhci_dbg(xhci, "Control endpoint stall already handled.\n");
+- return;
+- }
+-
+- xhci_dbg(xhci, "Queueing reset endpoint command\n");
+- spin_lock_irqsave(&xhci->lock, flags);
+- ret = xhci_queue_reset_ep(xhci, udev->slot_id, ep_index);
+ /*
+- * Can't change the ring dequeue pointer until it's transitioned to the
+- * stopped state, which is only upon a successful reset endpoint
+- * command. Better hope that last command worked!
++ * We might need to implement the config ep cmd in xhci 4.8.1 note:
++ * The Reset Endpoint Command may only be issued to endpoints in the
++ * Halted state. If software wishes reset the Data Toggle or Sequence
++ * Number of an endpoint that isn't in the Halted state, then software
++ * may issue a Configure Endpoint Command with the Drop and Add bits set
++ * for the target endpoint. that is in the Stopped state.
+ */
+- if (!ret) {
+- xhci_cleanup_stalled_ring(xhci, udev, ep_index);
+- kfree(virt_ep->stopped_td);
+- xhci_ring_cmd_db(xhci);
+- }
+- virt_ep->stopped_td = NULL;
+- virt_ep->stopped_trb = NULL;
+- virt_ep->stopped_stream = 0;
+- spin_unlock_irqrestore(&xhci->lock, flags);
+-
+- if (ret)
+- xhci_warn(xhci, "FIXME allocate a new ring segment\n");
++ /* For now just print debug to follow the situation */
++ xhci_dbg(xhci, "Endpoint 0x%x ep reset callback called\n",
++ ep->desc.bEndpointAddress);
+ }
+
+ static int xhci_check_streams_endpoint(struct xhci_hcd *xhci,
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 2b7fe0b1c249..6c8093509511 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1729,7 +1729,7 @@ void xhci_shutdown(struct usb_hcd *hcd);
+ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks);
+
+ #ifdef CONFIG_PM
+-int xhci_suspend(struct xhci_hcd *xhci);
++int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup);
+ int xhci_resume(struct xhci_hcd *xhci, bool hibernated);
+ #else
+ #define xhci_suspend NULL
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 00bd2a5e0362..056dc6e4a9f9 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -672,6 +672,9 @@ static int __usbhsg_ep_set_halt_wedge(struct usb_ep *ep, int halt, int wedge)
+ struct device *dev = usbhsg_gpriv_to_dev(gpriv);
+ unsigned long flags;
+
++ if (!pipe)
++ return -EINVAL;
++
+ usbhsg_pipe_disable(uep);
+
+ dev_dbg(dev, "set halt %d (pipe %d)\n",
+diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c
+index 1ee6b2ab0f89..87302ddec0a4 100644
+--- a/drivers/usb/serial/console.c
++++ b/drivers/usb/serial/console.c
+@@ -47,6 +47,8 @@ static struct console usbcons;
+ * ------------------------------------------------------------
+ */
+
++static const struct tty_operations usb_console_fake_tty_ops = {
++};
+
+ /*
+ * The parsing of the command line works exactly like the
+@@ -141,14 +143,17 @@ static int usb_console_setup(struct console *co, char *options)
+ goto reset_open_count;
+ }
+ kref_init(&tty->kref);
+- tty_port_tty_set(&port->port, tty);
+ tty->driver = usb_serial_tty_driver;
+ tty->index = co->index;
++ INIT_LIST_HEAD(&tty->tty_files);
++ kref_get(&tty->driver->kref);
++ tty->ops = &usb_console_fake_tty_ops;
+ if (tty_init_termios(tty)) {
+ retval = -ENOMEM;
+ err("no more memory");
+- goto free_tty;
++ goto put_tty;
+ }
++ tty_port_tty_set(&port->port, tty);
+ }
+
+ /* only call the device specific open if this
+@@ -170,7 +175,7 @@ static int usb_console_setup(struct console *co, char *options)
+ serial->type->set_termios(tty, port, &dummy);
+
+ tty_port_tty_set(&port->port, NULL);
+- kfree(tty);
++ tty_kref_put(tty);
+ }
+ set_bit(ASYNCB_INITIALIZED, &port->port.flags);
+ }
+@@ -186,8 +191,8 @@ static int usb_console_setup(struct console *co, char *options)
+
+ fail:
+ tty_port_tty_set(&port->port, NULL);
+- free_tty:
+- kfree(tty);
++ put_tty:
++ tty_kref_put(tty);
+ reset_open_count:
+ port->port.count = 0;
+ usb_autopm_put_interface(serial->interface);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 19074db60896..813793714bea 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -126,9 +126,12 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
+ { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
+ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
++ { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
++ { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
+ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
++ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index a89433bd5314..4bfcfa785823 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -494,6 +494,39 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FD_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FE_PID) },
+ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_01FF_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_4701_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9300_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9301_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9302_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9303_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9304_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9305_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9306_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9307_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9308_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9309_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930A_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930B_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930C_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930D_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930E_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_930F_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9310_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9311_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9312_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9313_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9314_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9315_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9316_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9317_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9318_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_9319_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931A_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931B_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931C_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931D_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931E_PID) },
++ { USB_DEVICE(MTXORB_VID, MTXORB_FTDI_RANGE_931F_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PERLE_ULTRAPORT_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PIEGROUP_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_TNC_X_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 64ee791687d9..ecb4dee48caf 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -920,8 +920,8 @@
+ #define BAYER_CONTOUR_CABLE_PID 0x6001
+
+ /*
+- * The following are the values for the Matrix Orbital FTDI Range
+- * Anything in this range will use an FT232RL.
++ * Matrix Orbital Intelligent USB displays.
++ * http://www.matrixorbital.com
+ */
+ #define MTXORB_VID 0x1B3D
+ #define MTXORB_FTDI_RANGE_0100_PID 0x0100
+@@ -1180,8 +1180,39 @@
+ #define MTXORB_FTDI_RANGE_01FD_PID 0x01FD
+ #define MTXORB_FTDI_RANGE_01FE_PID 0x01FE
+ #define MTXORB_FTDI_RANGE_01FF_PID 0x01FF
+-
+-
++#define MTXORB_FTDI_RANGE_4701_PID 0x4701
++#define MTXORB_FTDI_RANGE_9300_PID 0x9300
++#define MTXORB_FTDI_RANGE_9301_PID 0x9301
++#define MTXORB_FTDI_RANGE_9302_PID 0x9302
++#define MTXORB_FTDI_RANGE_9303_PID 0x9303
++#define MTXORB_FTDI_RANGE_9304_PID 0x9304
++#define MTXORB_FTDI_RANGE_9305_PID 0x9305
++#define MTXORB_FTDI_RANGE_9306_PID 0x9306
++#define MTXORB_FTDI_RANGE_9307_PID 0x9307
++#define MTXORB_FTDI_RANGE_9308_PID 0x9308
++#define MTXORB_FTDI_RANGE_9309_PID 0x9309
++#define MTXORB_FTDI_RANGE_930A_PID 0x930A
++#define MTXORB_FTDI_RANGE_930B_PID 0x930B
++#define MTXORB_FTDI_RANGE_930C_PID 0x930C
++#define MTXORB_FTDI_RANGE_930D_PID 0x930D
++#define MTXORB_FTDI_RANGE_930E_PID 0x930E
++#define MTXORB_FTDI_RANGE_930F_PID 0x930F
++#define MTXORB_FTDI_RANGE_9310_PID 0x9310
++#define MTXORB_FTDI_RANGE_9311_PID 0x9311
++#define MTXORB_FTDI_RANGE_9312_PID 0x9312
++#define MTXORB_FTDI_RANGE_9313_PID 0x9313
++#define MTXORB_FTDI_RANGE_9314_PID 0x9314
++#define MTXORB_FTDI_RANGE_9315_PID 0x9315
++#define MTXORB_FTDI_RANGE_9316_PID 0x9316
++#define MTXORB_FTDI_RANGE_9317_PID 0x9317
++#define MTXORB_FTDI_RANGE_9318_PID 0x9318
++#define MTXORB_FTDI_RANGE_9319_PID 0x9319
++#define MTXORB_FTDI_RANGE_931A_PID 0x931A
++#define MTXORB_FTDI_RANGE_931B_PID 0x931B
++#define MTXORB_FTDI_RANGE_931C_PID 0x931C
++#define MTXORB_FTDI_RANGE_931D_PID 0x931D
++#define MTXORB_FTDI_RANGE_931E_PID 0x931E
++#define MTXORB_FTDI_RANGE_931F_PID 0x931F
+
+ /*
+ * The Mobility Lab (TML)
+diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
+index 66d806ee9f3e..0879ac7fd2cb 100644
+--- a/drivers/usb/serial/keyspan.c
++++ b/drivers/usb/serial/keyspan.c
+@@ -323,24 +323,28 @@ static void usa26_indat_callback(struct urb *urb)
+ if ((data[0] & 0x80) == 0) {
+ /* no errors on individual bytes, only
+ possible overrun err */
+- if (data[0] & RXERROR_OVERRUN)
+- err = TTY_OVERRUN;
+- else
+- err = 0;
++ if (data[0] & RXERROR_OVERRUN) {
++ tty_insert_flip_char(tty, 0, TTY_OVERRUN);
++ }
+ for (i = 1; i < urb->actual_length ; ++i)
+- tty_insert_flip_char(tty, data[i], err);
++ tty_insert_flip_char(tty, data[i], TTY_NORMAL);
+ } else {
+ /* some bytes had errors, every byte has status */
+ dbg("%s - RX error!!!!", __func__);
+ for (i = 0; i + 1 < urb->actual_length; i += 2) {
+- int stat = data[i], flag = 0;
+- if (stat & RXERROR_OVERRUN)
+- flag |= TTY_OVERRUN;
+- if (stat & RXERROR_FRAMING)
+- flag |= TTY_FRAME;
+- if (stat & RXERROR_PARITY)
+- flag |= TTY_PARITY;
++ int stat = data[i];
++ int flag = TTY_NORMAL;
++
++ if (stat & RXERROR_OVERRUN) {
++ tty_insert_flip_char(tty, 0,
++ TTY_OVERRUN);
++ }
+ /* XXX should handle break (0x10) */
++ if (stat & RXERROR_PARITY)
++ flag = TTY_PARITY;
++ else if (stat & RXERROR_FRAMING)
++ flag = TTY_FRAME;
++
+ tty_insert_flip_char(tty, data[i+1], flag);
+ }
+ }
+@@ -712,14 +716,19 @@ static void usa49_indat_callback(struct urb *urb)
+ } else {
+ /* some bytes had errors, every byte has status */
+ for (i = 0; i + 1 < urb->actual_length; i += 2) {
+- int stat = data[i], flag = 0;
+- if (stat & RXERROR_OVERRUN)
+- flag |= TTY_OVERRUN;
+- if (stat & RXERROR_FRAMING)
+- flag |= TTY_FRAME;
+- if (stat & RXERROR_PARITY)
+- flag |= TTY_PARITY;
++ int stat = data[i];
++ int flag = TTY_NORMAL;
++
++ if (stat & RXERROR_OVERRUN) {
++ tty_insert_flip_char(tty, 0,
++ TTY_OVERRUN);
++ }
+ /* XXX should handle break (0x10) */
++ if (stat & RXERROR_PARITY)
++ flag = TTY_PARITY;
++ else if (stat & RXERROR_FRAMING)
++ flag = TTY_FRAME;
++
+ tty_insert_flip_char(tty, data[i+1], flag);
+ }
+ }
+@@ -779,14 +788,19 @@ static void usa49wg_indat_callback(struct urb *urb)
+ * some bytes had errors, every byte has status
+ */
+ for (x = 0; x + 1 < len; x += 2) {
+- int stat = data[i], flag = 0;
+- if (stat & RXERROR_OVERRUN)
+- flag |= TTY_OVERRUN;
+- if (stat & RXERROR_FRAMING)
+- flag |= TTY_FRAME;
+- if (stat & RXERROR_PARITY)
+- flag |= TTY_PARITY;
++ int stat = data[i];
++ int flag = TTY_NORMAL;
++
++ if (stat & RXERROR_OVERRUN) {
++ tty_insert_flip_char(tty, 0,
++ TTY_OVERRUN);
++ }
+ /* XXX should handle break (0x10) */
++ if (stat & RXERROR_PARITY)
++ flag = TTY_PARITY;
++ else if (stat & RXERROR_FRAMING)
++ flag = TTY_FRAME;
++
+ tty_insert_flip_char(tty,
+ data[i+1], flag);
+ i += 2;
+@@ -844,25 +858,32 @@ static void usa90_indat_callback(struct urb *urb)
+ if ((data[0] & 0x80) == 0) {
+ /* no errors on individual bytes, only
+ possible overrun err*/
+- if (data[0] & RXERROR_OVERRUN)
+- err = TTY_OVERRUN;
+- else
+- err = 0;
++ if (data[0] & RXERROR_OVERRUN) {
++ tty_insert_flip_char(tty, 0,
++ TTY_OVERRUN);
++ }
+ for (i = 1; i < urb->actual_length ; ++i)
+ tty_insert_flip_char(tty, data[i],
+- err);
++ TTY_NORMAL);
+ } else {
+ /* some bytes had errors, every byte has status */
+ dbg("%s - RX error!!!!", __func__);
+ for (i = 0; i + 1 < urb->actual_length; i += 2) {
+- int stat = data[i], flag = 0;
+- if (stat & RXERROR_OVERRUN)
+- flag |= TTY_OVERRUN;
+- if (stat & RXERROR_FRAMING)
+- flag |= TTY_FRAME;
+- if (stat & RXERROR_PARITY)
+- flag |= TTY_PARITY;
++ int stat = data[i];
++ int flag = TTY_NORMAL;
++
++ if (stat & RXERROR_OVERRUN) {
++ tty_insert_flip_char(
++ tty, 0,
++ TTY_OVERRUN);
++ }
++
+ /* XXX should handle break (0x10) */
++ if (stat & RXERROR_PARITY)
++ flag = TTY_PARITY;
++ else if (stat & RXERROR_FRAMING)
++ flag = TTY_FRAME;
++
+ tty_insert_flip_char(tty, data[i+1],
+ flag);
+ }
+diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
+index d19fa6a9d247..f425507d999a 100644
+--- a/drivers/usb/serial/ssu100.c
++++ b/drivers/usb/serial/ssu100.c
+@@ -598,10 +598,10 @@ static void ssu100_update_lsr(struct usb_serial_port *port, u8 lsr,
+ if (*tty_flag == TTY_NORMAL)
+ *tty_flag = TTY_FRAME;
+ }
+- if (lsr & UART_LSR_OE){
++ if (lsr & UART_LSR_OE) {
+ priv->icount.overrun++;
+- if (*tty_flag == TTY_NORMAL)
+- *tty_flag = TTY_OVERRUN;
++ tty_insert_flip_char(tty_port_tty_get(&port->port),
++ 0, TTY_OVERRUN);
+ }
+ }
+
+@@ -622,11 +622,8 @@ static int ssu100_process_packet(struct urb *urb,
+ if ((len >= 4) &&
+ (packet[0] == 0x1b) && (packet[1] == 0x1b) &&
+ ((packet[2] == 0x00) || (packet[2] == 0x01))) {
+- if (packet[2] == 0x00) {
++ if (packet[2] == 0x00)
+ ssu100_update_lsr(port, packet[3], &flag);
+- if (flag == TTY_OVERRUN)
+- tty_insert_flip_char(tty, 0, TTY_OVERRUN);
+- }
+ if (packet[2] == 0x01)
+ ssu100_update_msr(port, packet[3]);
+
+diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
+index 3a7fd6f6af4f..248a198dc974 100644
+--- a/drivers/usb/storage/scsiglue.c
++++ b/drivers/usb/storage/scsiglue.c
+@@ -242,6 +242,10 @@ static int slave_configure(struct scsi_device *sdev)
+ US_FL_SCM_MULT_TARG)) &&
+ us->protocol == USB_PR_BULK)
+ us->use_last_sector_hacks = 1;
++
++ /* A few buggy USB-ATA bridges don't understand FUA */
++ if (us->fflags & US_FL_BROKEN_FUA)
++ sdev->broken_fua = 1;
+ } else {
+
+ /* Non-disk-type devices don't need to blacklist any pages
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index a280945d2236..25174beb8d8d 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -1940,6 +1940,13 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE ),
+
++/* Reported by Michael Büsch <m@bues.ch> */
++UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114,
++ "JMicron",
++ "USB to ATA/ATAPI Bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BROKEN_FUA ),
++
+ /* Reported by Alexandre Oliva <oliva@lsd.ic.unicamp.br>
+ * JMicron responds to USN and several other SCSI ioctls with a
+ * residue that causes subsequent I/O requests to fail. */
+@@ -1949,6 +1956,13 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
++/* Reported by Dmitry Nezhevenko <dion@dion.org.ua> */
++UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114,
++ "JMicron",
++ "USB to ATA/ATAPI Bridge",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_BROKEN_FUA ),
++
+ /* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
+ * and Mac USB Dock USB-SCSI */
+ UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
+diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
+index 080c35b34bbb..cc5dbb5b2f71 100644
+--- a/drivers/video/logo/logo.c
++++ b/drivers/video/logo/logo.c
+@@ -25,6 +25,21 @@ static bool nologo;
+ module_param(nologo, bool, 0);
+ MODULE_PARM_DESC(nologo, "Disables startup logo");
+
++/*
++ * Logos are located in the initdata, and will be freed in kernel_init.
++ * Use late_init to mark the logos as freed to prevent any further use.
++ */
++
++static bool logos_freed;
++
++static int __init fb_logo_late_init(void)
++{
++ logos_freed = true;
++ return 0;
++}
++
++late_initcall(fb_logo_late_init);
++
+ /* logo's are marked __initdata. Use __init_refok to tell
+ * modpost that it is intended that this function uses data
+ * marked __initdata.
+@@ -33,7 +48,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
+ {
+ const struct linux_logo *logo = NULL;
+
+- if (nologo)
++ if (nologo || logos_freed)
+ return NULL;
+
+ if (depth >= 1) {
+diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c
+index 984c501c258f..cc02a9b36219 100644
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -9,33 +9,32 @@ static unsigned int dev_index;
+ static ssize_t device_show(struct device *_d,
+ struct device_attribute *attr, char *buf)
+ {
+- struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_d);
+ return sprintf(buf, "0x%04x\n", dev->id.device);
+ }
+ static ssize_t vendor_show(struct device *_d,
+ struct device_attribute *attr, char *buf)
+ {
+- struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_d);
+ return sprintf(buf, "0x%04x\n", dev->id.vendor);
+ }
+ static ssize_t status_show(struct device *_d,
+ struct device_attribute *attr, char *buf)
+ {
+- struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_d);
+ return sprintf(buf, "0x%08x\n", dev->config->get_status(dev));
+ }
+ static ssize_t modalias_show(struct device *_d,
+ struct device_attribute *attr, char *buf)
+ {
+- struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
+-
++ struct virtio_device *dev = dev_to_virtio(_d);
+ return sprintf(buf, "virtio:d%08Xv%08X\n",
+ dev->id.device, dev->id.vendor);
+ }
+ static ssize_t features_show(struct device *_d,
+ struct device_attribute *attr, char *buf)
+ {
+- struct virtio_device *dev = container_of(_d, struct virtio_device, dev);
++ struct virtio_device *dev = dev_to_virtio(_d);
+ unsigned int i;
+ ssize_t len = 0;
+
+@@ -70,7 +69,7 @@ static inline int virtio_id_match(const struct virtio_device *dev,
+ static int virtio_dev_match(struct device *_dv, struct device_driver *_dr)
+ {
+ unsigned int i;
+- struct virtio_device *dev = container_of(_dv,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_dv);
+ const struct virtio_device_id *ids;
+
+ ids = container_of(_dr, struct virtio_driver, driver)->id_table;
+@@ -82,7 +81,7 @@ static int virtio_dev_match(struct device *_dv, struct device_driver *_dr)
+
+ static int virtio_uevent(struct device *_dv, struct kobj_uevent_env *env)
+ {
+- struct virtio_device *dev = container_of(_dv,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_dv);
+
+ return add_uevent_var(env, "MODALIAS=virtio:d%08Xv%08X",
+ dev->id.device, dev->id.vendor);
+@@ -110,7 +109,7 @@ EXPORT_SYMBOL_GPL(virtio_check_driver_offered_feature);
+ static int virtio_dev_probe(struct device *_d)
+ {
+ int err, i;
+- struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_d);
+ struct virtio_driver *drv = container_of(dev->dev.driver,
+ struct virtio_driver, driver);
+ u32 device_features;
+@@ -148,7 +147,7 @@ static int virtio_dev_probe(struct device *_d)
+
+ static int virtio_dev_remove(struct device *_d)
+ {
+- struct virtio_device *dev = container_of(_d,struct virtio_device,dev);
++ struct virtio_device *dev = dev_to_virtio(_d);
+ struct virtio_driver *drv = container_of(dev->dev.driver,
+ struct virtio_driver, driver);
+
+diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
+index a41f264dc23d..cc56763ff96d 100644
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -624,11 +624,13 @@ static struct virtio_config_ops virtio_pci_config_ops = {
+
+ static void virtio_pci_release_dev(struct device *_d)
+ {
+- /*
+- * No need for a release method as we allocate/free
+- * all devices together with the pci devices.
+- * Provide an empty one to avoid getting a warning from core.
+- */
++ struct virtio_device *vdev = dev_to_virtio(_d);
++ struct virtio_pci_device *vp_dev = to_vp_device(vdev);
++
++ /* As struct device is a kobject, it's not safe to
++ * free the memory (including the reference counter itself)
++ * until it's release callback. */
++ kfree(vp_dev);
+ }
+
+ /* the PCI probing function */
+@@ -716,7 +718,6 @@ static void __devexit virtio_pci_remove(struct pci_dev *pci_dev)
+ pci_iounmap(pci_dev, vp_dev->ioaddr);
+ pci_release_regions(pci_dev);
+ pci_disable_device(pci_dev);
+- kfree(vp_dev);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index a1e6c990cd41..a86a78d8e614 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -81,7 +81,7 @@ static struct dentry *v9fs_dentry_from_dir_inode(struct inode *inode)
+ spin_lock(&inode->i_lock);
+ /* Directory should have only one entry. */
+ BUG_ON(S_ISDIR(inode->i_mode) && !list_is_singular(&inode->i_dentry));
+- dentry = list_entry(inode->i_dentry.next, struct dentry, d_alias);
++ dentry = list_entry(inode->i_dentry.next, struct dentry, d_u.d_alias);
+ spin_unlock(&inode->i_lock);
+ return dentry;
+ }
+diff --git a/fs/affs/amigaffs.c b/fs/affs/amigaffs.c
+index 52a6407682e6..43a8f374b4a0 100644
+--- a/fs/affs/amigaffs.c
++++ b/fs/affs/amigaffs.c
+@@ -132,7 +132,7 @@ affs_fix_dcache(struct dentry *dentry, u32 entry_ino)
+ head = &inode->i_dentry;
+ next = head->next;
+ while (next != head) {
+- dentry = list_entry(next, struct dentry, d_alias);
++ dentry = list_entry(next, struct dentry, d_u.d_alias);
+ if (entry_ino == (u32)(long)dentry->d_fsdata) {
+ dentry->d_fsdata = data;
+ break;
+diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
+index b1cdb0ae5ca6..54effed1ce59 100644
+--- a/fs/autofs4/expire.c
++++ b/fs/autofs4/expire.c
+@@ -100,7 +100,7 @@ static struct dentry *get_next_positive_subdir(struct dentry *prev,
+ p = prev;
+ spin_lock(&p->d_lock);
+ again:
+- next = p->d_u.d_child.next;
++ next = p->d_child.next;
+ start:
+ if (next == &root->d_subdirs) {
+ spin_unlock(&p->d_lock);
+@@ -109,7 +109,7 @@ start:
+ return NULL;
+ }
+
+- q = list_entry(next, struct dentry, d_u.d_child);
++ q = list_entry(next, struct dentry, d_child);
+
+ spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
+ /* Negative dentry - try next */
+@@ -166,13 +166,13 @@ again:
+ goto relock;
+ }
+ spin_unlock(&p->d_lock);
+- next = p->d_u.d_child.next;
++ next = p->d_child.next;
+ p = parent;
+ if (next != &parent->d_subdirs)
+ break;
+ }
+ }
+- ret = list_entry(next, struct dentry, d_u.d_child);
++ ret = list_entry(next, struct dentry, d_child);
+
+ spin_lock_nested(&ret->d_lock, DENTRY_D_LOCK_NESTED);
+ /* Negative dentry - try next */
+@@ -457,7 +457,7 @@ found:
+ spin_lock(&sbi->lookup_lock);
+ spin_lock(&expired->d_parent->d_lock);
+ spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);
++ list_move(&expired->d_parent->d_subdirs, &expired->d_child);
+ spin_unlock(&expired->d_lock);
+ spin_unlock(&expired->d_parent->d_lock);
+ spin_unlock(&sbi->lookup_lock);
+diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
+index 8c4292f89eef..411760477c4b 100644
+--- a/fs/autofs4/root.c
++++ b/fs/autofs4/root.c
+@@ -651,7 +651,7 @@ static void autofs_clear_leaf_automount_flags(struct dentry *dentry)
+ /* only consider parents below dentrys in the root */
+ if (IS_ROOT(parent->d_parent))
+ return;
+- d_child = &dentry->d_u.d_child;
++ d_child = &dentry->d_child;
+ /* Set parent managed if it's becoming empty */
+ if (d_child->next == &parent->d_subdirs &&
+ d_child->prev == &parent->d_subdirs)
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index a009b9e322ac..6dacccef7790 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -539,11 +539,12 @@ out:
+
+ static unsigned long randomize_stack_top(unsigned long stack_top)
+ {
+- unsigned int random_variable = 0;
++ unsigned long random_variable = 0;
+
+ if ((current->flags & PF_RANDOMIZE) &&
+ !(current->personality & ADDR_NO_RANDOMIZE)) {
+- random_variable = get_random_int() & STACK_RND_MASK;
++ random_variable = (unsigned long) get_random_int();
++ random_variable &= STACK_RND_MASK;
+ random_variable <<= PAGE_SHIFT;
+ }
+ #ifdef CONFIG_STACK_GROWSUP
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index a7ffc88a7dbe..7c23cd9c2136 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3556,12 +3556,6 @@ static int btrfs_destroy_pinned_extent(struct btrfs_root *root,
+ if (ret)
+ break;
+
+- /* opt_discard */
+- if (btrfs_test_opt(root, DISCARD))
+- ret = btrfs_error_discard_extent(root, start,
+- end + 1 - start,
+- NULL);
+-
+ clear_extent_dirty(unpin, start, end, GFP_NOFS);
+ btrfs_error_unpin_extent_range(root, start, end);
+ cond_resched();
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 224ce21cc0ac..cf6e7f4a4f4c 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -4892,7 +4892,8 @@ void btrfs_prepare_extent_commit(struct btrfs_trans_handle *trans,
+ update_global_block_rsv(fs_info);
+ }
+
+-static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
++static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end,
++ const bool return_free_space)
+ {
+ struct btrfs_fs_info *fs_info = root->fs_info;
+ struct btrfs_block_group_cache *cache = NULL;
+@@ -4912,7 +4913,8 @@ static int unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
+
+ if (start < cache->last_byte_to_unpin) {
+ len = min(len, cache->last_byte_to_unpin - start);
+- btrfs_add_free_space(cache, start, len);
++ if (return_free_space)
++ btrfs_add_free_space(cache, start, len);
+ }
+
+ start += len;
+@@ -4960,7 +4962,7 @@ int btrfs_finish_extent_commit(struct btrfs_trans_handle *trans,
+ end + 1 - start, NULL);
+
+ clear_extent_dirty(unpin, start, end, GFP_NOFS);
+- unpin_extent_range(root, start, end);
++ unpin_extent_range(root, start, end, true);
+ cond_resched();
+ }
+
+@@ -8008,7 +8010,7 @@ out:
+
+ int btrfs_error_unpin_extent_range(struct btrfs_root *root, u64 start, u64 end)
+ {
+- return unpin_extent_range(root, start, end);
++ return unpin_extent_range(root, start, end, false);
+ }
+
+ int btrfs_error_discard_extent(struct btrfs_root *root, u64 bytenr,
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 3e8094be4604..455b64336628 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -104,7 +104,7 @@ static unsigned fpos_off(loff_t p)
+ /*
+ * When possible, we try to satisfy a readdir by peeking at the
+ * dcache. We make this work by carefully ordering dentries on
+- * d_u.d_child when we initially get results back from the MDS, and
++ * d_child when we initially get results back from the MDS, and
+ * falling back to a "normal" sync readdir if any dentries in the dir
+ * are dropped.
+ *
+@@ -140,11 +140,11 @@ static int __dcache_readdir(struct file *filp,
+ p = parent->d_subdirs.prev;
+ dout(" initial p %p/%p\n", p->prev, p->next);
+ } else {
+- p = last->d_u.d_child.prev;
++ p = last->d_child.prev;
+ }
+
+ more:
+- dentry = list_entry(p, struct dentry, d_u.d_child);
++ dentry = list_entry(p, struct dentry, d_child);
+ di = ceph_dentry(dentry);
+ while (1) {
+ dout(" p %p/%p %s d_subdirs %p/%p\n", p->prev, p->next,
+@@ -166,7 +166,7 @@ more:
+ !dentry->d_inode ? " null" : "");
+ spin_unlock(&dentry->d_lock);
+ p = p->prev;
+- dentry = list_entry(p, struct dentry, d_u.d_child);
++ dentry = list_entry(p, struct dentry, d_child);
+ di = ceph_dentry(dentry);
+ }
+
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 81613bced19f..1ea77206a0d5 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -869,9 +869,9 @@ static void ceph_set_dentry_offset(struct dentry *dn)
+
+ spin_lock(&dir->d_lock);
+ spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&dn->d_u.d_child, &dir->d_subdirs);
++ list_move(&dn->d_child, &dir->d_subdirs);
+ dout("set_dentry_offset %p %lld (%p %p)\n", dn, di->offset,
+- dn->d_u.d_child.prev, dn->d_u.d_child.next);
++ dn->d_child.prev, dn->d_child.next);
+ spin_unlock(&dn->d_lock);
+ spin_unlock(&dir->d_lock);
+ }
+@@ -1262,7 +1262,7 @@ retry_lookup:
+ /* reorder parent's d_subdirs */
+ spin_lock(&parent->d_lock);
+ spin_lock_nested(&dn->d_lock, DENTRY_D_LOCK_NESTED);
+- list_move(&dn->d_u.d_child, &parent->d_subdirs);
++ list_move(&dn->d_child, &parent->d_subdirs);
+ spin_unlock(&dn->d_lock);
+ spin_unlock(&parent->d_lock);
+ }
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 8d6ac6bec9e9..2c2acc03b24e 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -833,7 +833,7 @@ inode_has_hashed_dentries(struct inode *inode)
+ struct dentry *dentry;
+
+ spin_lock(&inode->i_lock);
+- list_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ if (!d_unhashed(dentry) || IS_ROOT(dentry)) {
+ spin_unlock(&inode->i_lock);
+ return true;
+diff --git a/fs/coda/cache.c b/fs/coda/cache.c
+index 690157876184..4b2e5cb502f6 100644
+--- a/fs/coda/cache.c
++++ b/fs/coda/cache.c
+@@ -95,7 +95,7 @@ static void coda_flag_children(struct dentry *parent, int flag)
+ spin_lock(&parent->d_lock);
+ list_for_each(child, &parent->d_subdirs)
+ {
+- de = list_entry(child, struct dentry, d_u.d_child);
++ de = list_entry(child, struct dentry, d_child);
+ /* don't know what to do with negative dentries */
+ if ( ! de->d_inode )
+ continue;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 09e2eda55c57..8038a780696f 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -43,7 +43,7 @@
+ /*
+ * Usage:
+ * dcache->d_inode->i_lock protects:
+- * - i_dentry, d_alias, d_inode of aliases
++ * - i_dentry, d_u.d_alias, d_inode of aliases
+ * dcache_hash_bucket lock protects:
+ * - the dcache hash table
+ * s_anon bl list spinlock protects:
+@@ -58,7 +58,7 @@
+ * - d_unhashed()
+ * - d_parent and d_subdirs
+ * - childrens' d_child and d_parent
+- * - d_alias, d_inode
++ * - d_u.d_alias, d_inode
+ *
+ * Ordering:
+ * dentry->d_inode->i_lock
+@@ -202,7 +202,6 @@ static void __d_free(struct rcu_head *head)
+ {
+ struct dentry *dentry = container_of(head, struct dentry, d_u.d_rcu);
+
+- WARN_ON(!list_empty(&dentry->d_alias));
+ if (dname_external(dentry))
+ kfree(dentry->d_name.name);
+ kmem_cache_free(dentry_cache, dentry);
+@@ -213,6 +212,7 @@ static void __d_free(struct rcu_head *head)
+ */
+ static void d_free(struct dentry *dentry)
+ {
++ WARN_ON(!list_empty(&dentry->d_u.d_alias));
+ BUG_ON(dentry->d_count);
+ this_cpu_dec(nr_dentry);
+ if (dentry->d_op && dentry->d_op->d_release)
+@@ -251,7 +251,7 @@ static void dentry_iput(struct dentry * dentry)
+ struct inode *inode = dentry->d_inode;
+ if (inode) {
+ dentry->d_inode = NULL;
+- list_del_init(&dentry->d_alias);
++ list_del_init(&dentry->d_u.d_alias);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&inode->i_lock);
+ if (!inode->i_nlink)
+@@ -275,7 +275,7 @@ static void dentry_unlink_inode(struct dentry * dentry)
+ {
+ struct inode *inode = dentry->d_inode;
+ dentry->d_inode = NULL;
+- list_del_init(&dentry->d_alias);
++ list_del_init(&dentry->d_u.d_alias);
+ dentry_rcuwalk_barrier(dentry);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&inode->i_lock);
+@@ -368,9 +368,9 @@ static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent)
+ __releases(parent->d_lock)
+ __releases(dentry->d_inode->i_lock)
+ {
+- list_del(&dentry->d_u.d_child);
++ __list_del_entry(&dentry->d_child);
+ /*
+- * Inform try_to_ascend() that we are no longer attached to the
++ * Inform ascending readers that we are no longer attached to the
+ * dentry tree
+ */
+ dentry->d_flags |= DCACHE_DENTRY_KILLED;
+@@ -686,7 +686,7 @@ static struct dentry *__d_find_alias(struct inode *inode, int want_discon)
+
+ again:
+ discon_alias = NULL;
+- list_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&alias->d_lock);
+ if (S_ISDIR(inode->i_mode) || !d_unhashed(alias)) {
+ if (IS_ROOT(alias) &&
+@@ -739,7 +739,7 @@ void d_prune_aliases(struct inode *inode)
+ struct dentry *dentry;
+ restart:
+ spin_lock(&inode->i_lock);
+- list_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ spin_lock(&dentry->d_lock);
+ if (!dentry->d_count) {
+ __dget_dlock(dentry);
+@@ -919,7 +919,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
+ /* descend to the first leaf in the current subtree */
+ while (!list_empty(&dentry->d_subdirs))
+ dentry = list_entry(dentry->d_subdirs.next,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+
+ /* consume the dentries from this leaf up through its parents
+ * until we find one with children or run out altogether */
+@@ -951,17 +951,17 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
+
+ if (IS_ROOT(dentry)) {
+ parent = NULL;
+- list_del(&dentry->d_u.d_child);
++ list_del(&dentry->d_child);
+ } else {
+ parent = dentry->d_parent;
+ parent->d_count--;
+- list_del(&dentry->d_u.d_child);
++ list_del(&dentry->d_child);
+ }
+
+ inode = dentry->d_inode;
+ if (inode) {
+ dentry->d_inode = NULL;
+- list_del_init(&dentry->d_alias);
++ list_del_init(&dentry->d_u.d_alias);
+ if (dentry->d_op && dentry->d_op->d_iput)
+ dentry->d_op->d_iput(dentry, inode);
+ else
+@@ -979,7 +979,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
+ } while (list_empty(&dentry->d_subdirs));
+
+ dentry = list_entry(dentry->d_subdirs.next,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+ }
+ }
+
+@@ -1011,34 +1011,6 @@ void shrink_dcache_for_umount(struct super_block *sb)
+ }
+ }
+
+-/*
+- * This tries to ascend one level of parenthood, but
+- * we can race with renaming, so we need to re-check
+- * the parenthood after dropping the lock and check
+- * that the sequence number still matches.
+- */
+-static struct dentry *try_to_ascend(struct dentry *old, int locked, unsigned seq)
+-{
+- struct dentry *new = old->d_parent;
+-
+- rcu_read_lock();
+- spin_unlock(&old->d_lock);
+- spin_lock(&new->d_lock);
+-
+- /*
+- * might go back up the wrong parent if we have had a rename
+- * or deletion
+- */
+- if (new != old->d_parent ||
+- (old->d_flags & DCACHE_DENTRY_KILLED) ||
+- (!locked && read_seqretry(&rename_lock, seq))) {
+- spin_unlock(&new->d_lock);
+- new = NULL;
+- }
+- rcu_read_unlock();
+- return new;
+-}
+-
+
+ /*
+ * Search for at least 1 mount point in the dentry's subdirs.
+@@ -1072,7 +1044,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -1094,30 +1066,48 @@ resume:
+ /*
+ * All done at this level ... ascend and resume the search.
+ */
++ rcu_read_lock();
++ascend:
+ if (this_parent != parent) {
+ struct dentry *child = this_parent;
+- this_parent = try_to_ascend(this_parent, locked, seq);
+- if (!this_parent)
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* might go back up the wrong parent if we have had a rename */
++ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_u.d_child.next;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
++ }
++ rcu_read_unlock();
+ goto resume;
+ }
+- spin_unlock(&this_parent->d_lock);
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return 0; /* No mount points found in tree */
+ positive:
+ if (!locked && read_seqretry(&rename_lock, seq))
+- goto rename_retry;
++ goto rename_retry_unlocked;
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return 1;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ goto again;
++rename_retry_unlocked:
+ locked = 1;
+ write_seqlock(&rename_lock);
+ goto again;
+@@ -1155,7 +1145,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -1182,6 +1172,7 @@ resume:
+ */
+ if (found && need_resched()) {
+ spin_unlock(&dentry->d_lock);
++ rcu_read_lock();
+ goto out;
+ }
+
+@@ -1201,23 +1192,40 @@ resume:
+ /*
+ * All done at this level ... ascend and resume the search.
+ */
++ rcu_read_lock();
++ascend:
+ if (this_parent != parent) {
+ struct dentry *child = this_parent;
+- this_parent = try_to_ascend(this_parent, locked, seq);
+- if (!this_parent)
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* might go back up the wrong parent if we have had a rename */
++ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_u.d_child.next;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
++ }
++ rcu_read_unlock();
+ goto resume;
+ }
+ out:
+- spin_unlock(&this_parent->d_lock);
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return found;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (found)
+ return found;
+ if (locked)
+@@ -1292,8 +1300,8 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+ INIT_HLIST_BL_NODE(&dentry->d_hash);
+ INIT_LIST_HEAD(&dentry->d_lru);
+ INIT_LIST_HEAD(&dentry->d_subdirs);
+- INIT_LIST_HEAD(&dentry->d_alias);
+- INIT_LIST_HEAD(&dentry->d_u.d_child);
++ INIT_LIST_HEAD(&dentry->d_u.d_alias);
++ INIT_LIST_HEAD(&dentry->d_child);
+ d_set_d_op(dentry, dentry->d_sb->s_d_op);
+
+ this_cpu_inc(nr_dentry);
+@@ -1323,7 +1331,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
+ */
+ __dget_dlock(parent);
+ dentry->d_parent = parent;
+- list_add(&dentry->d_u.d_child, &parent->d_subdirs);
++ list_add(&dentry->d_child, &parent->d_subdirs);
+ spin_unlock(&parent->d_lock);
+
+ return dentry;
+@@ -1380,7 +1388,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+ if (inode) {
+ if (unlikely(IS_AUTOMOUNT(inode)))
+ dentry->d_flags |= DCACHE_NEED_AUTOMOUNT;
+- list_add(&dentry->d_alias, &inode->i_dentry);
++ list_add(&dentry->d_u.d_alias, &inode->i_dentry);
+ }
+ dentry->d_inode = inode;
+ dentry_rcuwalk_barrier(dentry);
+@@ -1405,7 +1413,7 @@ static void __d_instantiate(struct dentry *dentry, struct inode *inode)
+
+ void d_instantiate(struct dentry *entry, struct inode * inode)
+ {
+- BUG_ON(!list_empty(&entry->d_alias));
++ BUG_ON(!list_empty(&entry->d_u.d_alias));
+ if (inode)
+ spin_lock(&inode->i_lock);
+ __d_instantiate(entry, inode);
+@@ -1444,7 +1452,7 @@ static struct dentry *__d_instantiate_unique(struct dentry *entry,
+ return NULL;
+ }
+
+- list_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ struct qstr *qstr = &alias->d_name;
+
+ /*
+@@ -1470,7 +1478,7 @@ struct dentry *d_instantiate_unique(struct dentry *entry, struct inode *inode)
+ {
+ struct dentry *result;
+
+- BUG_ON(!list_empty(&entry->d_alias));
++ BUG_ON(!list_empty(&entry->d_u.d_alias));
+
+ if (inode)
+ spin_lock(&inode->i_lock);
+@@ -1513,7 +1521,7 @@ static struct dentry * __d_find_any_alias(struct inode *inode)
+
+ if (list_empty(&inode->i_dentry))
+ return NULL;
+- alias = list_first_entry(&inode->i_dentry, struct dentry, d_alias);
++ alias = list_first_entry(&inode->i_dentry, struct dentry, d_u.d_alias);
+ __dget(alias);
+ return alias;
+ }
+@@ -1587,7 +1595,7 @@ struct dentry *d_obtain_alias(struct inode *inode)
+ spin_lock(&tmp->d_lock);
+ tmp->d_inode = inode;
+ tmp->d_flags |= DCACHE_DISCONNECTED;
+- list_add(&tmp->d_alias, &inode->i_dentry);
++ list_add(&tmp->d_u.d_alias, &inode->i_dentry);
+ hlist_bl_lock(&tmp->d_sb->s_anon);
+ hlist_bl_add_head(&tmp->d_hash, &tmp->d_sb->s_anon);
+ hlist_bl_unlock(&tmp->d_sb->s_anon);
+@@ -1996,7 +2004,7 @@ int d_validate(struct dentry *dentry, struct dentry *dparent)
+ struct dentry *child;
+
+ spin_lock(&dparent->d_lock);
+- list_for_each_entry(child, &dparent->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dparent->d_subdirs, d_child) {
+ if (dentry == child) {
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+ __dget_dlock(dentry);
+@@ -2243,8 +2251,8 @@ static void __d_move(struct dentry * dentry, struct dentry * target)
+ /* Unhash the target: dput() will then get rid of it */
+ __d_drop(target);
+
+- list_del(&dentry->d_u.d_child);
+- list_del(&target->d_u.d_child);
++ list_del(&dentry->d_child);
++ list_del(&target->d_child);
+
+ /* Switch the names.. */
+ switch_names(dentry, target);
+@@ -2254,15 +2262,15 @@ static void __d_move(struct dentry * dentry, struct dentry * target)
+ if (IS_ROOT(dentry)) {
+ dentry->d_parent = target->d_parent;
+ target->d_parent = target;
+- INIT_LIST_HEAD(&target->d_u.d_child);
++ INIT_LIST_HEAD(&target->d_child);
+ } else {
+ swap(dentry->d_parent, target->d_parent);
+
+ /* And add them back to the (new) parent lists */
+- list_add(&target->d_u.d_child, &target->d_parent->d_subdirs);
++ list_add(&target->d_child, &target->d_parent->d_subdirs);
+ }
+
+- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs);
+
+ write_seqcount_end(&target->d_seq);
+ write_seqcount_end(&dentry->d_seq);
+@@ -2369,18 +2377,18 @@ static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
+ swap(dentry->d_name.hash, anon->d_name.hash);
+
+ dentry->d_parent = (aparent == anon) ? dentry : aparent;
+- list_del(&dentry->d_u.d_child);
++ list_del(&dentry->d_child);
+ if (!IS_ROOT(dentry))
+- list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
++ list_add(&dentry->d_child, &dentry->d_parent->d_subdirs);
+ else
+- INIT_LIST_HEAD(&dentry->d_u.d_child);
++ INIT_LIST_HEAD(&dentry->d_child);
+
+ anon->d_parent = (dparent == dentry) ? anon : dparent;
+- list_del(&anon->d_u.d_child);
++ list_del(&anon->d_child);
+ if (!IS_ROOT(anon))
+- list_add(&anon->d_u.d_child, &anon->d_parent->d_subdirs);
++ list_add(&anon->d_child, &anon->d_parent->d_subdirs);
+ else
+- INIT_LIST_HEAD(&anon->d_u.d_child);
++ INIT_LIST_HEAD(&anon->d_child);
+
+ write_seqcount_end(&dentry->d_seq);
+ write_seqcount_end(&anon->d_seq);
+@@ -2934,7 +2942,7 @@ repeat:
+ resume:
+ while (next != &this_parent->d_subdirs) {
+ struct list_head *tmp = next;
+- struct dentry *dentry = list_entry(tmp, struct dentry, d_u.d_child);
++ struct dentry *dentry = list_entry(tmp, struct dentry, d_child);
+ next = tmp->next;
+
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+@@ -2955,26 +2963,43 @@ resume:
+ }
+ spin_unlock(&dentry->d_lock);
+ }
++ rcu_read_lock();
++ascend:
+ if (this_parent != root) {
+ struct dentry *child = this_parent;
+ if (!(this_parent->d_flags & DCACHE_GENOCIDE)) {
+ this_parent->d_flags |= DCACHE_GENOCIDE;
+ this_parent->d_count--;
+ }
+- this_parent = try_to_ascend(this_parent, locked, seq);
+- if (!this_parent)
++ this_parent = child->d_parent;
++
++ spin_unlock(&child->d_lock);
++ spin_lock(&this_parent->d_lock);
++
++ /* might go back up the wrong parent if we have had a rename */
++ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_u.d_child.next;
++ next = child->d_child.next;
++ while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ if (next == &this_parent->d_subdirs)
++ goto ascend;
++ child = list_entry(next, struct dentry, d_child);
++ next = next->next;
++ }
++ rcu_read_unlock();
+ goto resume;
+ }
+- spin_unlock(&this_parent->d_lock);
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ write_sequnlock(&rename_lock);
+ return;
+
+ rename_retry:
++ spin_unlock(&this_parent->d_lock);
++ rcu_read_unlock();
+ if (locked)
+ goto again;
+ locked = 1;
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 9dc6e76b7a90..47d64e9282bf 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -539,7 +539,7 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ parent = dentry;
+ down:
+ mutex_lock(&parent->d_inode->i_mutex);
+- list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) {
++ list_for_each_entry_safe(child, next, &parent->d_subdirs, d_child) {
+ if (!debugfs_positive(child))
+ continue;
+
+@@ -560,8 +560,8 @@ void debugfs_remove_recursive(struct dentry *dentry)
+ mutex_lock(&parent->d_inode->i_mutex);
+
+ if (child != dentry) {
+- next = list_entry(child->d_u.d_child.next, struct dentry,
+- d_u.d_child);
++ next = list_entry(child->d_child.next, struct dentry,
++ d_child);
+ goto up;
+ }
+
+diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
+index ea9931281557..3d0633891f28 100644
+--- a/fs/ecryptfs/crypto.c
++++ b/fs/ecryptfs/crypto.c
+@@ -2044,7 +2044,6 @@ ecryptfs_decode_from_filename(unsigned char *dst, size_t *dst_size,
+ break;
+ case 2:
+ dst[dst_byte_offset++] |= (src_byte);
+- dst[dst_byte_offset] = 0;
+ current_bit_offset = 0;
+ break;
+ }
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index d45ba4568128..f04aa3303464 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -195,24 +195,12 @@ static int ecryptfs_open(struct inode *inode, struct file *file)
+ {
+ int rc = 0;
+ struct ecryptfs_crypt_stat *crypt_stat = NULL;
+- struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+ struct dentry *ecryptfs_dentry = file->f_path.dentry;
+ /* Private value of ecryptfs_dentry allocated in
+ * ecryptfs_lookup() */
+ struct dentry *lower_dentry;
+ struct ecryptfs_file_info *file_info;
+
+- mount_crypt_stat = &ecryptfs_superblock_to_private(
+- ecryptfs_dentry->d_sb)->mount_crypt_stat;
+- if ((mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
+- && ((file->f_flags & O_WRONLY) || (file->f_flags & O_RDWR)
+- || (file->f_flags & O_CREAT) || (file->f_flags & O_TRUNC)
+- || (file->f_flags & O_APPEND))) {
+- printk(KERN_WARNING "Mount has encrypted view enabled; "
+- "files may only be read\n");
+- rc = -EPERM;
+- goto out;
+- }
+ /* Released in ecryptfs_release or end of function if failure */
+ file_info = kmem_cache_zalloc(ecryptfs_file_info_cache, GFP_KERNEL);
+ ecryptfs_set_file_private(file, file_info);
+diff --git a/fs/ecryptfs/main.c b/fs/ecryptfs/main.c
+index 240832e8b289..93b7bec021bc 100644
+--- a/fs/ecryptfs/main.c
++++ b/fs/ecryptfs/main.c
+@@ -494,6 +494,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+ {
+ struct super_block *s;
+ struct ecryptfs_sb_info *sbi;
++ struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+ struct ecryptfs_dentry_info *root_info;
+ const char *err = "Getting sb failed";
+ struct inode *inode;
+@@ -512,6 +513,7 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+ err = "Error parsing options";
+ goto out;
+ }
++ mount_crypt_stat = &sbi->mount_crypt_stat;
+
+ s = sget(fs_type, NULL, set_anon_super, NULL);
+ if (IS_ERR(s)) {
+@@ -557,11 +559,19 @@ static struct dentry *ecryptfs_mount(struct file_system_type *fs_type, int flags
+
+ /**
+ * Set the POSIX ACL flag based on whether they're enabled in the lower
+- * mount. Force a read-only eCryptfs mount if the lower mount is ro.
+- * Allow a ro eCryptfs mount even when the lower mount is rw.
++ * mount.
+ */
+ s->s_flags = flags & ~MS_POSIXACL;
+- s->s_flags |= path.dentry->d_sb->s_flags & (MS_RDONLY | MS_POSIXACL);
++ s->s_flags |= path.dentry->d_sb->s_flags & MS_POSIXACL;
++
++ /**
++ * Force a read-only eCryptfs mount when:
++ * 1) The lower mount is ro
++ * 2) The ecryptfs_encrypted_view mount option is specified
++ */
++ if (path.dentry->d_sb->s_flags & MS_RDONLY ||
++ mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)
++ s->s_flags |= MS_RDONLY;
+
+ s->s_maxbytes = path.dentry->d_sb->s_maxbytes;
+ s->s_blocksize = path.dentry->d_sb->s_blocksize;
+diff --git a/fs/exportfs/expfs.c b/fs/exportfs/expfs.c
+index b05acb796135..3bbf5e75df0a 100644
+--- a/fs/exportfs/expfs.c
++++ b/fs/exportfs/expfs.c
+@@ -50,7 +50,7 @@ find_acceptable_alias(struct dentry *result,
+
+ inode = result->d_inode;
+ spin_lock(&inode->i_lock);
+- list_for_each_entry(dentry, &inode->i_dentry, d_alias) {
++ list_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
+ dget(dentry);
+ spin_unlock(&inode->i_lock);
+ if (toput)
+diff --git a/fs/ext4/fsync.c b/fs/ext4/fsync.c
+index a8d03a4d3f8b..019c29c89824 100644
+--- a/fs/ext4/fsync.c
++++ b/fs/ext4/fsync.c
+@@ -139,7 +139,7 @@ static int ext4_sync_parent(struct inode *inode)
+ spin_lock(&inode->i_lock);
+ if (!list_empty(&inode->i_dentry)) {
+ dentry = list_first_entry(&inode->i_dentry,
+- struct dentry, d_alias);
++ struct dentry, d_u.d_alias);
+ dget(dentry);
+ }
+ spin_unlock(&inode->i_lock);
+diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
+index b35bd64fb548..f8458342593d 100644
+--- a/fs/fs-writeback.c
++++ b/fs/fs-writeback.c
+@@ -402,7 +402,6 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
+
+ /* Set I_SYNC, reset I_DIRTY_PAGES */
+ inode->i_state |= I_SYNC;
+- inode->i_state &= ~I_DIRTY_PAGES;
+ spin_unlock(&inode->i_lock);
+ spin_unlock(&wb->list_lock);
+
+@@ -425,9 +424,28 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
+ * write_inode()
+ */
+ spin_lock(&inode->i_lock);
++
+ dirty = inode->i_state & I_DIRTY;
+- inode->i_state &= ~(I_DIRTY_SYNC | I_DIRTY_DATASYNC);
++ inode->i_state &= ~I_DIRTY;
++
++ /*
++ * Paired with smp_mb() in __mark_inode_dirty(). This allows
++ * __mark_inode_dirty() to test i_state without grabbing i_lock -
++ * either they see the I_DIRTY bits cleared or we see the dirtied
++ * inode.
++ *
++ * I_DIRTY_PAGES is always cleared together above even if @mapping
++ * still has dirty pages. The flag is reinstated after smp_mb() if
++ * necessary. This guarantees that either __mark_inode_dirty()
++ * sees clear I_DIRTY_PAGES or we see PAGECACHE_TAG_DIRTY.
++ */
++ smp_mb();
++
++ if (mapping_tagged(mapping, PAGECACHE_TAG_DIRTY))
++ inode->i_state |= I_DIRTY_PAGES;
++
+ spin_unlock(&inode->i_lock);
++
+ /* Don't write the inode if only I_DIRTY_PAGES was set */
+ if (dirty & (I_DIRTY_SYNC | I_DIRTY_DATASYNC)) {
+ int err = write_inode(inode, wbc);
+@@ -453,7 +471,6 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
+ * We didn't write back all the pages. nfs_writepages()
+ * sometimes bales out without doing anything.
+ */
+- inode->i_state |= I_DIRTY_PAGES;
+ if (wbc->nr_to_write <= 0) {
+ /*
+ * slice used up: queue for next turn
+@@ -1074,12 +1091,11 @@ void __mark_inode_dirty(struct inode *inode, int flags)
+ }
+
+ /*
+- * make sure that changes are seen by all cpus before we test i_state
+- * -- mikulas
++ * Paired with smp_mb() in __writeback_single_inode() for the
++ * following lockless i_state test. See there for details.
+ */
+ smp_mb();
+
+- /* avoid the locking if we can */
+ if ((inode->i_state & flags) == flags)
+ return;
+
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index ee62cc0c2499..17809499c752 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -30,6 +30,7 @@ struct rock_state {
+ int cont_size;
+ int cont_extent;
+ int cont_offset;
++ int cont_loops;
+ struct inode *inode;
+ };
+
+@@ -73,6 +74,9 @@ static void init_rock_state(struct rock_state *rs, struct inode *inode)
+ rs->inode = inode;
+ }
+
++/* Maximum number of Rock Ridge continuation entries */
++#define RR_MAX_CE_ENTRIES 32
++
+ /*
+ * Returns 0 if the caller should continue scanning, 1 if the scan must end
+ * and -ve on error.
+@@ -105,6 +109,8 @@ static int rock_continue(struct rock_state *rs)
+ goto out;
+ }
+ ret = -EIO;
++ if (++rs->cont_loops >= RR_MAX_CE_ENTRIES)
++ goto out;
+ bh = sb_bread(rs->inode->i_sb, rs->cont_extent);
+ if (bh) {
+ memcpy(rs->buffer, bh->b_data + rs->cont_offset,
+@@ -356,6 +362,9 @@ repeat:
+ rs.cont_size = isonum_733(rr->u.CE.size);
+ break;
+ case SIG('E', 'R'):
++ /* Invalid length of ER tag id? */
++ if (rr->u.ER.len_id + offsetof(struct rock_ridge, u.ER.data) > rr->len)
++ goto out;
+ ISOFS_SB(inode->i_sb)->s_rock = 1;
+ printk(KERN_DEBUG "ISO 9660 Extensions: ");
+ {
+diff --git a/fs/jfs/jfs_dtree.c b/fs/jfs/jfs_dtree.c
+index b6f17c0b7718..33c8624f2286 100644
+--- a/fs/jfs/jfs_dtree.c
++++ b/fs/jfs/jfs_dtree.c
+@@ -3103,7 +3103,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ * self "."
+ */
+ filp->f_pos = 1;
+- if (filldir(dirent, ".", 1, 0, ip->i_ino,
++ if (filldir(dirent, ".", 1, 1, ip->i_ino,
+ DT_DIR))
+ return 0;
+ }
+@@ -3111,7 +3111,7 @@ int jfs_readdir(struct file *filp, void *dirent, filldir_t filldir)
+ * parent ".."
+ */
+ filp->f_pos = 2;
+- if (filldir(dirent, "..", 2, 1, PARENT(ip), DT_DIR))
++ if (filldir(dirent, "..", 2, 2, PARENT(ip), DT_DIR))
+ return 0;
+
+ /*
+diff --git a/fs/libfs.c b/fs/libfs.c
+index 18d08f5db53a..65c126f0d5e0 100644
+--- a/fs/libfs.c
++++ b/fs/libfs.c
+@@ -104,18 +104,18 @@ loff_t dcache_dir_lseek(struct file *file, loff_t offset, int origin)
+
+ spin_lock(&dentry->d_lock);
+ /* d_lock not required for cursor */
+- list_del(&cursor->d_u.d_child);
++ list_del(&cursor->d_child);
+ p = dentry->d_subdirs.next;
+ while (n && p != &dentry->d_subdirs) {
+ struct dentry *next;
+- next = list_entry(p, struct dentry, d_u.d_child);
++ next = list_entry(p, struct dentry, d_child);
+ spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ if (simple_positive(next))
+ n--;
+ spin_unlock(&next->d_lock);
+ p = p->next;
+ }
+- list_add_tail(&cursor->d_u.d_child, p);
++ list_add_tail(&cursor->d_child, p);
+ spin_unlock(&dentry->d_lock);
+ }
+ }
+@@ -139,7 +139,7 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ {
+ struct dentry *dentry = filp->f_path.dentry;
+ struct dentry *cursor = filp->private_data;
+- struct list_head *p, *q = &cursor->d_u.d_child;
++ struct list_head *p, *q = &cursor->d_child;
+ ino_t ino;
+ int i = filp->f_pos;
+
+@@ -165,7 +165,7 @@ int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
+
+ for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
+ struct dentry *next;
+- next = list_entry(p, struct dentry, d_u.d_child);
++ next = list_entry(p, struct dentry, d_child);
+ spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ if (!simple_positive(next)) {
+ spin_unlock(&next->d_lock);
+@@ -289,7 +289,7 @@ int simple_empty(struct dentry *dentry)
+ int ret = 0;
+
+ spin_lock(&dentry->d_lock);
+- list_for_each_entry(child, &dentry->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &dentry->d_subdirs, d_child) {
+ spin_lock_nested(&child->d_lock, DENTRY_D_LOCK_NESTED);
+ if (simple_positive(child)) {
+ spin_unlock(&child->d_lock);
+diff --git a/fs/ncpfs/dir.c b/fs/ncpfs/dir.c
+index 9560fd7f5c7a..ba792a0ab9f2 100644
+--- a/fs/ncpfs/dir.c
++++ b/fs/ncpfs/dir.c
+@@ -391,7 +391,7 @@ ncp_dget_fpos(struct dentry *dentry, struct dentry *parent, unsigned long fpos)
+ spin_lock(&parent->d_lock);
+ next = parent->d_subdirs.next;
+ while (next != &parent->d_subdirs) {
+- dent = list_entry(next, struct dentry, d_u.d_child);
++ dent = list_entry(next, struct dentry, d_child);
+ if ((unsigned long)dent->d_fsdata == fpos) {
+ if (dent->d_inode)
+ dget(dent);
+diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c
+index 6958adfaff08..0a76def69d95 100644
+--- a/fs/ncpfs/ioctl.c
++++ b/fs/ncpfs/ioctl.c
+@@ -445,7 +445,6 @@ static long __ncp_ioctl(struct inode *inode, unsigned int cmd, unsigned long arg
+ result = -EIO;
+ }
+ }
+- result = 0;
+ }
+ mutex_unlock(&server->root_setup_lock);
+
+diff --git a/fs/ncpfs/ncplib_kernel.h b/fs/ncpfs/ncplib_kernel.h
+index 32c06587351a..6d5e7c56c79d 100644
+--- a/fs/ncpfs/ncplib_kernel.h
++++ b/fs/ncpfs/ncplib_kernel.h
+@@ -194,7 +194,7 @@ ncp_renew_dentries(struct dentry *parent)
+ spin_lock(&parent->d_lock);
+ next = parent->d_subdirs.next;
+ while (next != &parent->d_subdirs) {
+- dentry = list_entry(next, struct dentry, d_u.d_child);
++ dentry = list_entry(next, struct dentry, d_child);
+
+ if (dentry->d_fsdata == NULL)
+ ncp_age_dentry(server, dentry);
+@@ -216,7 +216,7 @@ ncp_invalidate_dircache_entries(struct dentry *parent)
+ spin_lock(&parent->d_lock);
+ next = parent->d_subdirs.next;
+ while (next != &parent->d_subdirs) {
+- dentry = list_entry(next, struct dentry, d_u.d_child);
++ dentry = list_entry(next, struct dentry, d_child);
+ dentry->d_fsdata = NULL;
+ ncp_age_dentry(server, dentry);
+ next = next->next;
+diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
+index 4ca6f5c8038e..b242f69557fd 100644
+--- a/fs/nfs/getroot.c
++++ b/fs/nfs/getroot.c
+@@ -62,7 +62,7 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
+ */
+ spin_lock(&sb->s_root->d_inode->i_lock);
+ spin_lock(&sb->s_root->d_lock);
+- list_del_init(&sb->s_root->d_alias);
++ list_del_init(&sb->s_root->d_u.d_alias);
+ spin_unlock(&sb->s_root->d_lock);
+ spin_unlock(&sb->s_root->d_inode->i_lock);
+ }
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index c8e9f637153a..ebf3f592ae14 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -784,8 +784,12 @@ static bool nfsd41_cb_get_slot(struct nfs4_client *clp, struct rpc_task *task)
+ {
+ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
+ rpc_sleep_on(&clp->cl_cb_waitq, task, NULL);
+- dprintk("%s slot is busy\n", __func__);
+- return false;
++ /* Race breaker */
++ if (test_and_set_bit(0, &clp->cl_cb_slot_busy) != 0) {
++ dprintk("%s slot is busy\n", __func__);
++ return false;
++ }
++ rpc_wake_up_queued_task(&clp->cl_cb_waitq, task);
+ }
+ return true;
+ }
+diff --git a/fs/nilfs2/nilfs.h b/fs/nilfs2/nilfs.h
+index 250add84da76..161a10c89cb7 100644
+--- a/fs/nilfs2/nilfs.h
++++ b/fs/nilfs2/nilfs.h
+@@ -128,7 +128,6 @@ enum {
+ * @ti_save: Backup of journal_info field of task_struct
+ * @ti_flags: Flags
+ * @ti_count: Nest level
+- * @ti_garbage: List of inode to be put when releasing semaphore
+ */
+ struct nilfs_transaction_info {
+ u32 ti_magic;
+@@ -137,7 +136,6 @@ struct nilfs_transaction_info {
+ one of other filesystems has a bug. */
+ unsigned short ti_flags;
+ unsigned short ti_count;
+- struct list_head ti_garbage;
+ };
+
+ /* ti_magic */
+diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
+index e0a5a181fa46..7bb866c5e4d5 100644
+--- a/fs/nilfs2/segment.c
++++ b/fs/nilfs2/segment.c
+@@ -302,7 +302,6 @@ static void nilfs_transaction_lock(struct super_block *sb,
+ ti->ti_count = 0;
+ ti->ti_save = cur_ti;
+ ti->ti_magic = NILFS_TI_MAGIC;
+- INIT_LIST_HEAD(&ti->ti_garbage);
+ current->journal_info = ti;
+
+ for (;;) {
+@@ -329,8 +328,6 @@ static void nilfs_transaction_unlock(struct super_block *sb)
+
+ up_write(&nilfs->ns_segctor_sem);
+ current->journal_info = ti->ti_save;
+- if (!list_empty(&ti->ti_garbage))
+- nilfs_dispose_list(nilfs, &ti->ti_garbage, 0);
+ }
+
+ static void *nilfs_segctor_map_segsum_entry(struct nilfs_sc_info *sci,
+@@ -743,6 +740,15 @@ static void nilfs_dispose_list(struct the_nilfs *nilfs,
+ }
+ }
+
++static void nilfs_iput_work_func(struct work_struct *work)
++{
++ struct nilfs_sc_info *sci = container_of(work, struct nilfs_sc_info,
++ sc_iput_work);
++ struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
++
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 0);
++}
++
+ static int nilfs_test_metadata_dirty(struct the_nilfs *nilfs,
+ struct nilfs_root *root)
+ {
+@@ -1896,8 +1902,9 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci,
+ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ struct the_nilfs *nilfs)
+ {
+- struct nilfs_transaction_info *ti = current->journal_info;
+ struct nilfs_inode_info *ii, *n;
++ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
++ int defer_iput = false;
+
+ spin_lock(&nilfs->ns_inode_lock);
+ list_for_each_entry_safe(ii, n, &sci->sc_dirty_files, i_dirty) {
+@@ -1908,9 +1915,24 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
+ clear_bit(NILFS_I_BUSY, &ii->i_state);
+ brelse(ii->i_bh);
+ ii->i_bh = NULL;
+- list_move_tail(&ii->i_dirty, &ti->ti_garbage);
++ list_del_init(&ii->i_dirty);
++ if (!ii->vfs_inode.i_nlink || during_mount) {
++ /*
++ * Defer calling iput() to avoid deadlocks if
++ * i_nlink == 0 or mount is not yet finished.
++ */
++ list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
++ defer_iput = true;
++ } else {
++ spin_unlock(&nilfs->ns_inode_lock);
++ iput(&ii->vfs_inode);
++ spin_lock(&nilfs->ns_inode_lock);
++ }
+ }
+ spin_unlock(&nilfs->ns_inode_lock);
++
++ if (defer_iput)
++ schedule_work(&sci->sc_iput_work);
+ }
+
+ /*
+@@ -2577,6 +2599,8 @@ static struct nilfs_sc_info *nilfs_segctor_new(struct super_block *sb,
+ INIT_LIST_HEAD(&sci->sc_segbufs);
+ INIT_LIST_HEAD(&sci->sc_write_logs);
+ INIT_LIST_HEAD(&sci->sc_gc_inodes);
++ INIT_LIST_HEAD(&sci->sc_iput_queue);
++ INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
+ init_timer(&sci->sc_timer);
+
+ sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
+@@ -2603,6 +2627,8 @@ static void nilfs_segctor_write_out(struct nilfs_sc_info *sci)
+ ret = nilfs_segctor_construct(sci, SC_LSEG_SR);
+ nilfs_transaction_unlock(sci->sc_super);
+
++ flush_work(&sci->sc_iput_work);
++
+ } while (ret && retrycount-- > 0);
+ }
+
+@@ -2627,6 +2653,9 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
+ || sci->sc_seq_request != sci->sc_seq_done);
+ spin_unlock(&sci->sc_state_lock);
+
++ if (flush_work(&sci->sc_iput_work))
++ flag = true;
++
+ if (flag || !nilfs_segctor_confirm(sci))
+ nilfs_segctor_write_out(sci);
+
+@@ -2636,6 +2665,12 @@ static void nilfs_segctor_destroy(struct nilfs_sc_info *sci)
+ nilfs_dispose_list(nilfs, &sci->sc_dirty_files, 1);
+ }
+
++ if (!list_empty(&sci->sc_iput_queue)) {
++ nilfs_warning(sci->sc_super, __func__,
++ "iput queue is not empty\n");
++ nilfs_dispose_list(nilfs, &sci->sc_iput_queue, 1);
++ }
++
+ WARN_ON(!list_empty(&sci->sc_segbufs));
+ WARN_ON(!list_empty(&sci->sc_write_logs));
+
+diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
+index 38a1d0013314..a48d6de1e02c 100644
+--- a/fs/nilfs2/segment.h
++++ b/fs/nilfs2/segment.h
+@@ -26,6 +26,7 @@
+ #include <linux/types.h>
+ #include <linux/fs.h>
+ #include <linux/buffer_head.h>
++#include <linux/workqueue.h>
+ #include <linux/nilfs2_fs.h>
+ #include "nilfs.h"
+
+@@ -92,6 +93,8 @@ struct nilfs_segsum_pointer {
+ * @sc_nblk_inc: Block count of current generation
+ * @sc_dirty_files: List of files to be written
+ * @sc_gc_inodes: List of GC inodes having blocks to be written
++ * @sc_iput_queue: list of inodes for which iput should be done
++ * @sc_iput_work: work struct to defer iput call
+ * @sc_freesegs: array of segment numbers to be freed
+ * @sc_nfreesegs: number of segments on @sc_freesegs
+ * @sc_dsync_inode: inode whose data pages are written for a sync operation
+@@ -135,6 +138,8 @@ struct nilfs_sc_info {
+
+ struct list_head sc_dirty_files;
+ struct list_head sc_gc_inodes;
++ struct list_head sc_iput_queue;
++ struct work_struct sc_iput_work;
+
+ __u64 *sc_freesegs;
+ size_t sc_nfreesegs;
+diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c
+index ccb14d3fc0de..e5b6db6634d1 100644
+--- a/fs/notify/fsnotify.c
++++ b/fs/notify/fsnotify.c
+@@ -63,14 +63,14 @@ void __fsnotify_update_child_dentry_flags(struct inode *inode)
+ spin_lock(&inode->i_lock);
+ /* run all of the dentries associated with this inode. Since this is a
+ * directory, there damn well better only be one item on this list */
+- list_for_each_entry(alias, &inode->i_dentry, d_alias) {
++ list_for_each_entry(alias, &inode->i_dentry, d_u.d_alias) {
+ struct dentry *child;
+
+ /* run all of the children of the original inode and fix their
+ * d_flags to indicate parental interest (their parent is the
+ * original inode) */
+ spin_lock(&alias->d_lock);
+- list_for_each_entry(child, &alias->d_subdirs, d_u.d_child) {
++ list_for_each_entry(child, &alias->d_subdirs, d_child) {
+ if (!child->d_inode)
+ continue;
+
+diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
+index b13c00ac48eb..df6daccf49ba 100644
+--- a/fs/notify/inode_mark.c
++++ b/fs/notify/inode_mark.c
+@@ -282,20 +282,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
+ spin_unlock(&inode->i_lock);
+
+ /* In case the dropping of a reference would nuke next_i. */
+- if ((&next_i->i_sb_list != list) &&
+- atomic_read(&next_i->i_count)) {
++ while (&next_i->i_sb_list != list) {
+ spin_lock(&next_i->i_lock);
+- if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
++ if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
++ atomic_read(&next_i->i_count)) {
+ __iget(next_i);
+ need_iput = next_i;
++ spin_unlock(&next_i->i_lock);
++ break;
+ }
+ spin_unlock(&next_i->i_lock);
++ next_i = list_entry(next_i->i_sb_list.next,
++ struct inode, i_sb_list);
+ }
+
+ /*
+- * We can safely drop inode_sb_list_lock here because we hold
+- * references on both inode and next_i. Also no new inodes
+- * will be added since the umount has begun.
++ * We can safely drop inode_sb_list_lock here because either
++ * we actually hold references on both inode and next_i or
++ * end of list. Also no new inodes will be added since the
++ * umount has begun.
+ */
+ spin_unlock(&inode_sb_list_lock);
+
+diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c
+index 340bd02839be..e9829ca38fd7 100644
+--- a/fs/ocfs2/aops.c
++++ b/fs/ocfs2/aops.c
+@@ -917,7 +917,7 @@ void ocfs2_unlock_and_free_pages(struct page **pages, int num_pages)
+ }
+ }
+
+-static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
++static void ocfs2_unlock_pages(struct ocfs2_write_ctxt *wc)
+ {
+ int i;
+
+@@ -938,7 +938,11 @@ static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
+ page_cache_release(wc->w_target_page);
+ }
+ ocfs2_unlock_and_free_pages(wc->w_pages, wc->w_num_pages);
++}
+
++static void ocfs2_free_write_ctxt(struct ocfs2_write_ctxt *wc)
++{
++ ocfs2_unlock_pages(wc);
+ brelse(wc->w_di_bh);
+ kfree(wc);
+ }
+@@ -2059,11 +2063,19 @@ out_write_size:
+ di->i_mtime_nsec = di->i_ctime_nsec = cpu_to_le32(inode->i_mtime.tv_nsec);
+ ocfs2_journal_dirty(handle, wc->w_di_bh);
+
++ /* unlock pages before dealloc since it needs acquiring j_trans_barrier
++ * lock, or it will cause a deadlock since journal commit threads holds
++ * this lock and will ask for the page lock when flushing the data.
++ * put it here to preserve the unlock order.
++ */
++ ocfs2_unlock_pages(wc);
++
+ ocfs2_commit_trans(osb, handle);
+
+ ocfs2_run_deallocs(osb, &wc->w_dealloc);
+
+- ocfs2_free_write_ctxt(wc);
++ brelse(wc->w_di_bh);
++ kfree(wc);
+
+ return copied;
+ }
+diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
+index e5ba34818332..26977cc14ae4 100644
+--- a/fs/ocfs2/dcache.c
++++ b/fs/ocfs2/dcache.c
+@@ -175,7 +175,7 @@ struct dentry *ocfs2_find_local_alias(struct inode *inode,
+
+ spin_lock(&inode->i_lock);
+ list_for_each(p, &inode->i_dentry) {
+- dentry = list_entry(p, struct dentry, d_alias);
++ dentry = list_entry(p, struct dentry, d_u.d_alias);
+
+ spin_lock(&dentry->d_lock);
+ if (ocfs2_match_dentry(dentry, parent_blkno, skip_unhashed)) {
+diff --git a/fs/proc/stat.c b/fs/proc/stat.c
+index e296572c73ed..f65c5da2ac76 100644
+--- a/fs/proc/stat.c
++++ b/fs/proc/stat.c
+@@ -159,7 +159,7 @@ static int show_stat(struct seq_file *p, void *v)
+
+ /* sum again ? it could be updated? */
+ for_each_irq_nr(j)
+- seq_put_decimal_ull(p, ' ', kstat_irqs(j));
++ seq_put_decimal_ull(p, ' ', kstat_irqs_usr(j));
+
+ seq_printf(p,
+ "\nctxt %llu\n"
+diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
+index 8df7fd28cca7..bc179339eb26 100644
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -985,9 +985,19 @@ out:
+ return ret;
+ }
+
++static int pagemap_open(struct inode *inode, struct file *file)
++{
++ /* do not disclose physical addresses to unprivileged
++ userspace (closes a rowhammer attack vector) */
++ if (!capable(CAP_SYS_ADMIN))
++ return -EPERM;
++ return 0;
++}
++
+ const struct file_operations proc_pagemap_operations = {
+ .llseek = mem_lseek, /* borrow this */
+ .read = pagemap_read,
++ .open = pagemap_open,
+ };
+ #endif /* CONFIG_PROC_PAGE_MONITOR */
+
+diff --git a/fs/udf/dir.c b/fs/udf/dir.c
+index eb8bfe2b89a5..56341af63acb 100644
+--- a/fs/udf/dir.c
++++ b/fs/udf/dir.c
+@@ -163,7 +163,8 @@ static int do_udf_readdir(struct inode *dir, struct file *filp,
+ struct kernel_lb_addr tloc = lelb_to_cpu(cfi.icb.extLocation);
+
+ iblock = udf_get_lb_pblock(dir->i_sb, &tloc, 0);
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ dt_type = DT_UNKNOWN;
+ }
+
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index aa70035fb402..8053ee75d297 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1392,6 +1392,20 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ iinfo->i_lenEAttr;
+ }
+
++ /* Sanity checks for files in ICB so that we don't get confused later */
++ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
++ /*
++ * For file in ICB data is stored in allocation descriptor
++ * so sizes should match
++ */
++ if (iinfo->i_lenAlloc != inode->i_size)
++ return;
++ /* File in ICB has to fit in there... */
++ if (inode->i_size > inode->i_sb->s_blocksize -
++ udf_file_entry_alloc_offset(inode))
++ return;
++ }
++
+ switch (fe->icbTag.fileType) {
+ case ICBTAG_FILE_TYPE_DIRECTORY:
+ inode->i_op = &udf_dir_inode_operations;
+diff --git a/fs/udf/namei.c b/fs/udf/namei.c
+index 78bff11169ea..407c1296b7c7 100644
+--- a/fs/udf/namei.c
++++ b/fs/udf/namei.c
+@@ -233,7 +233,8 @@ static struct fileIdentDesc *udf_find_entry(struct inode *dir,
+ if (!lfi)
+ continue;
+
+- flen = udf_get_filename(dir->i_sb, nameptr, fname, lfi);
++ flen = udf_get_filename(dir->i_sb, nameptr, lfi, fname,
++ UDF_NAME_LEN);
+ if (flen && udf_match(flen, fname, child->len, child->name))
+ goto out_ok;
+ }
+diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c
+index d7c6dbe4194b..0422b7b8369f 100644
+--- a/fs/udf/symlink.c
++++ b/fs/udf/symlink.c
+@@ -30,49 +30,73 @@
+ #include <linux/buffer_head.h>
+ #include "udf_i.h"
+
+-static void udf_pc_to_char(struct super_block *sb, unsigned char *from,
+- int fromlen, unsigned char *to)
++static int udf_pc_to_char(struct super_block *sb, unsigned char *from,
++ int fromlen, unsigned char *to, int tolen)
+ {
+ struct pathComponent *pc;
+ int elen = 0;
++ int comp_len;
+ unsigned char *p = to;
+
++ /* Reserve one byte for terminating \0 */
++ tolen--;
+ while (elen < fromlen) {
+ pc = (struct pathComponent *)(from + elen);
++ elen += sizeof(struct pathComponent);
+ switch (pc->componentType) {
+ case 1:
+ /*
+ * Symlink points to some place which should be agreed
+ * upon between originator and receiver of the media. Ignore.
+ */
+- if (pc->lengthComponentIdent > 0)
++ if (pc->lengthComponentIdent > 0) {
++ elen += pc->lengthComponentIdent;
+ break;
++ }
+ /* Fall through */
+ case 2:
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ p = to;
+ *p++ = '/';
++ tolen--;
+ break;
+ case 3:
++ if (tolen < 3)
++ return -ENAMETOOLONG;
+ memcpy(p, "../", 3);
+ p += 3;
++ tolen -= 3;
+ break;
+ case 4:
++ if (tolen < 2)
++ return -ENAMETOOLONG;
+ memcpy(p, "./", 2);
+ p += 2;
++ tolen -= 2;
+ /* that would be . - just ignore */
+ break;
+ case 5:
+- p += udf_get_filename(sb, pc->componentIdent, p,
+- pc->lengthComponentIdent);
++ elen += pc->lengthComponentIdent;
++ if (elen > fromlen)
++ return -EIO;
++ comp_len = udf_get_filename(sb, pc->componentIdent,
++ pc->lengthComponentIdent,
++ p, tolen);
++ p += comp_len;
++ tolen -= comp_len;
++ if (tolen == 0)
++ return -ENAMETOOLONG;
+ *p++ = '/';
++ tolen--;
+ break;
+ }
+- elen += sizeof(struct pathComponent) + pc->lengthComponentIdent;
+ }
+ if (p > to + 1)
+ p[-1] = '\0';
+ else
+ p[0] = '\0';
++ return 0;
+ }
+
+ static int udf_symlink_filler(struct file *file, struct page *page)
+@@ -80,11 +104,17 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ struct inode *inode = page->mapping->host;
+ struct buffer_head *bh = NULL;
+ unsigned char *symlink;
+- int err = -EIO;
++ int err;
+ unsigned char *p = kmap(page);
+ struct udf_inode_info *iinfo;
+ uint32_t pos;
+
++ /* We don't support symlinks longer than one block */
++ if (inode->i_size > inode->i_sb->s_blocksize) {
++ err = -ENAMETOOLONG;
++ goto out_unmap;
++ }
++
+ iinfo = UDF_I(inode);
+ pos = udf_block_map(inode, 0);
+
+@@ -94,14 +124,18 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ } else {
+ bh = sb_bread(inode->i_sb, pos);
+
+- if (!bh)
+- goto out;
++ if (!bh) {
++ err = -EIO;
++ goto out_unlock_inode;
++ }
+
+ symlink = bh->b_data;
+ }
+
+- udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p);
++ err = udf_pc_to_char(inode->i_sb, symlink, inode->i_size, p, PAGE_SIZE);
+ brelse(bh);
++ if (err)
++ goto out_unlock_inode;
+
+ up_read(&iinfo->i_data_sem);
+ SetPageUptodate(page);
+@@ -109,9 +143,10 @@ static int udf_symlink_filler(struct file *file, struct page *page)
+ unlock_page(page);
+ return 0;
+
+-out:
++out_unlock_inode:
+ up_read(&iinfo->i_data_sem);
+ SetPageError(page);
++out_unmap:
+ kunmap(page);
+ unlock_page(page);
+ return err;
+diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
+index ebe10314e512..375f64884c7b 100644
+--- a/fs/udf/udfdecl.h
++++ b/fs/udf/udfdecl.h
+@@ -207,7 +207,8 @@ udf_get_lb_pblock(struct super_block *sb, struct kernel_lb_addr *loc,
+ }
+
+ /* unicode.c */
+-extern int udf_get_filename(struct super_block *, uint8_t *, uint8_t *, int);
++extern int udf_get_filename(struct super_block *, uint8_t *, int, uint8_t *,
++ int);
+ extern int udf_put_filename(struct super_block *, const uint8_t *, uint8_t *,
+ int);
+ extern int udf_build_ustr(struct ustr *, dstring *, int);
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 44b815e57f94..d29c06fbf4ce 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -28,7 +28,8 @@
+
+ #include "udf_sb.h"
+
+-static int udf_translate_to_linux(uint8_t *, uint8_t *, int, uint8_t *, int);
++static int udf_translate_to_linux(uint8_t *, int, uint8_t *, int, uint8_t *,
++ int);
+
+ static int udf_char_to_ustr(struct ustr *dest, const uint8_t *src, int strlen)
+ {
+@@ -333,8 +334,8 @@ try_again:
+ return u_len + 1;
+ }
+
+-int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+- int flen)
++int udf_get_filename(struct super_block *sb, uint8_t *sname, int slen,
++ uint8_t *dname, int dlen)
+ {
+ struct ustr *filename, *unifilename;
+ int len = 0;
+@@ -347,7 +348,7 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+ if (!unifilename)
+ goto out1;
+
+- if (udf_build_ustr_exact(unifilename, sname, flen))
++ if (udf_build_ustr_exact(unifilename, sname, slen))
+ goto out2;
+
+ if (UDF_QUERY_FLAG(sb, UDF_FLAG_UTF8)) {
+@@ -366,7 +367,8 @@ int udf_get_filename(struct super_block *sb, uint8_t *sname, uint8_t *dname,
+ } else
+ goto out2;
+
+- len = udf_translate_to_linux(dname, filename->u_name, filename->u_len,
++ len = udf_translate_to_linux(dname, dlen,
++ filename->u_name, filename->u_len,
+ unifilename->u_name, unifilename->u_len);
+ out2:
+ kfree(unifilename);
+@@ -403,10 +405,12 @@ int udf_put_filename(struct super_block *sb, const uint8_t *sname,
+ #define EXT_MARK '.'
+ #define CRC_MARK '#'
+ #define EXT_SIZE 5
++/* Number of chars we need to store generated CRC to make filename unique */
++#define CRC_LEN 5
+
+-static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+- int udfLen, uint8_t *fidName,
+- int fidNameLen)
++static int udf_translate_to_linux(uint8_t *newName, int newLen,
++ uint8_t *udfName, int udfLen,
++ uint8_t *fidName, int fidNameLen)
+ {
+ int index, newIndex = 0, needsCRC = 0;
+ int extIndex = 0, newExtIndex = 0, hasExt = 0;
+@@ -440,7 +444,7 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+ newExtIndex = newIndex;
+ }
+ }
+- if (newIndex < 256)
++ if (newIndex < newLen)
+ newName[newIndex++] = curr;
+ else
+ needsCRC = 1;
+@@ -468,13 +472,13 @@ static int udf_translate_to_linux(uint8_t *newName, uint8_t *udfName,
+ }
+ ext[localExtIndex++] = curr;
+ }
+- maxFilenameLen = 250 - localExtIndex;
++ maxFilenameLen = newLen - CRC_LEN - localExtIndex;
+ if (newIndex > maxFilenameLen)
+ newIndex = maxFilenameLen;
+ else
+ newIndex = newExtIndex;
+- } else if (newIndex > 250)
+- newIndex = 250;
++ } else if (newIndex > newLen - CRC_LEN)
++ newIndex = newLen - CRC_LEN;
+ newName[newIndex++] = CRC_MARK;
+ valueCRC = crc_itu_t(0, fidName, fidNameLen);
+ newName[newIndex++] = hexChar[(valueCRC & 0xf000) >> 12];
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 1332df02d8f2..31e55bf1df6d 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -105,15 +105,15 @@ struct dentry {
+ void *d_fsdata; /* fs-specific data */
+
+ struct list_head d_lru; /* LRU list */
++ struct list_head d_child; /* child of parent list */
++ struct list_head d_subdirs; /* our children */
+ /*
+- * d_child and d_rcu can share memory
++ * d_alias and d_rcu can share memory
+ */
+ union {
+- struct list_head d_child; /* child of parent list */
++ struct list_head d_alias; /* inode alias list */
+ struct rcu_head d_rcu;
+ } d_u;
+- struct list_head d_subdirs; /* our children */
+- struct list_head d_alias; /* inode alias list */
+ };
+
+ /*
+diff --git a/include/linux/device.h b/include/linux/device.h
+index 5ad17cccdd71..e93fed98878a 100644
+--- a/include/linux/device.h
++++ b/include/linux/device.h
+@@ -835,6 +835,11 @@ extern __printf(5, 6)
+ struct device *device_create(struct class *cls, struct device *parent,
+ dev_t devt, void *drvdata,
+ const char *fmt, ...);
++extern __printf(6, 7)
++struct device *device_create_with_groups(struct class *cls,
++ struct device *parent, dev_t devt, void *drvdata,
++ const struct attribute_group **groups,
++ const char *fmt, ...);
+ extern void device_destroy(struct class *cls, dev_t devt);
+
+ /*
+diff --git a/include/linux/kernel_stat.h b/include/linux/kernel_stat.h
+index 2fbd9053c2df..8e62498eeab3 100644
+--- a/include/linux/kernel_stat.h
++++ b/include/linux/kernel_stat.h
+@@ -104,8 +104,13 @@ static inline unsigned int kstat_irqs(unsigned int irq)
+
+ return sum;
+ }
++static inline unsigned int kstat_irqs_usr(unsigned int irq)
++{
++ return kstat_irqs(irq);
++}
+ #else
+ extern unsigned int kstat_irqs(unsigned int irq);
++extern unsigned int kstat_irqs_usr(unsigned int irq);
+ #endif
+
+ /*
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index dd16deb27dd8..764cd54dfea7 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -207,6 +207,7 @@ enum {
+ ATA_FLAG_SW_ACTIVITY = (1 << 22), /* driver supports sw activity
+ * led */
+ ATA_FLAG_NO_DIPM = (1 << 23), /* host not happy with DIPM */
++ ATA_FLAG_LOWTAG = (1 << 24), /* host wants lowest available tag */
+
+ /* bits 24:31 of ap->flags are reserved for LLD specific flags */
+
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 656b4e968991..ceebf63ef5da 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -841,6 +841,7 @@ static inline int page_mapped(struct page *page)
+ #define VM_FAULT_WRITE 0x0008 /* Special case for get_user_pages */
+ #define VM_FAULT_HWPOISON 0x0010 /* Hit poisoned small page */
+ #define VM_FAULT_HWPOISON_LARGE 0x0020 /* Hit poisoned large page. Index encoded in upper bits */
++#define VM_FAULT_SIGSEGV 0x0040
+
+ #define VM_FAULT_NOPAGE 0x0100 /* ->fault installed the pte, not return page */
+ #define VM_FAULT_LOCKED 0x0200 /* ->fault locked the returned page */
+@@ -848,8 +849,8 @@ static inline int page_mapped(struct page *page)
+
+ #define VM_FAULT_HWPOISON_LARGE_MASK 0xf000 /* encodes hpage index for large hwpoison */
+
+-#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_HWPOISON | \
+- VM_FAULT_HWPOISON_LARGE)
++#define VM_FAULT_ERROR (VM_FAULT_OOM | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | \
++ VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE)
+
+ /* Encode hstate index for a hwpoisoned large page */
+ #define VM_FAULT_SET_HINDEX(x) ((x) << 12)
+@@ -1456,7 +1457,7 @@ extern int expand_downwards(struct vm_area_struct *vma,
+ #if VM_GROWSUP
+ extern int expand_upwards(struct vm_area_struct *vma, unsigned long address);
+ #else
+- #define expand_upwards(vma, address) do { } while (0)
++ #define expand_upwards(vma, address) (0)
+ #endif
+
+ /* Look up the first VMA which satisfies addr < vm_end, NULL if none. */
+diff --git a/include/linux/rmap.h b/include/linux/rmap.h
+index fd07c4542cee..5a6cbf785265 100644
+--- a/include/linux/rmap.h
++++ b/include/linux/rmap.h
+@@ -37,6 +37,16 @@ struct anon_vma {
+ atomic_t refcount;
+
+ /*
++ * Count of child anon_vmas and VMAs which points to this anon_vma.
++ *
++ * This counter is used for making decision about reusing anon_vma
++ * instead of forking new one. See comments in function anon_vma_clone.
++ */
++ unsigned degree;
++
++ struct anon_vma *parent; /* Parent of this anon_vma */
++
++ /*
+ * NOTE: the LSB of the head.next is set by
+ * mm_take_all_locks() _after_ taking the above lock. So the
+ * head must only be read/written after taking the above lock
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index 0010009b2f00..caf2e56bdf21 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -80,6 +80,15 @@ struct attribute_group {
+
+ #define __ATTR_NULL { .attr = { .name = NULL } }
+
++#define ATTRIBUTE_GROUPS(name) \
++static const struct attribute_group name##_group = { \
++ .attrs = name##_attrs, \
++}; \
++static const struct attribute_group *name##_groups[] = { \
++ &name##_group, \
++ NULL, \
++}
++
+ #define attr_name(_attr) (_attr).attr.name
+
+ struct file;
+diff --git a/include/linux/time.h b/include/linux/time.h
+index 03dce74e217c..bf1bb618b352 100644
+--- a/include/linux/time.h
++++ b/include/linux/time.h
+@@ -189,6 +189,19 @@ extern void getboottime(struct timespec *ts);
+ extern void monotonic_to_bootbased(struct timespec *ts);
+ extern void get_monotonic_boottime(struct timespec *ts);
+
++static inline bool timeval_valid(const struct timeval *tv)
++{
++ /* Dates before 1970 are bogus */
++ if (tv->tv_sec < 0)
++ return false;
++
++ /* Can't have more microseconds then a second */
++ if (tv->tv_usec < 0 || tv->tv_usec >= USEC_PER_SEC)
++ return false;
++
++ return true;
++}
++
+ extern struct timespec timespec_trunc(struct timespec t, unsigned gran);
+ extern int timekeeping_valid_for_hres(void);
+ extern u64 timekeeping_max_deferment(void);
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index d0d2af09dcc6..0972470bb072 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -36,4 +36,15 @@
+ /* device can't handle device_qualifier descriptor requests */
+ #define USB_QUIRK_DEVICE_QUALIFIER 0x00000100
+
++/*
++ * For high speed and super speed interupt endpoints, the USB 2.0 and
++ * USB 3.0 spec require the interval in microframes
++ * (1 microframe = 125 microseconds) to be calculated as
++ * interval = 2 ^ (bInterval-1).
++ *
++ * Devices with this quirk report their bInterval as the result of this
++ * calculation instead of the exponent variable used in the calculation.
++ */
++#define USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL 0x00000080
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 17df3600bcef..f2000e9804ea 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -64,7 +64,9 @@
+ US_FLAG(NO_READ_CAPACITY_16, 0x00080000) \
+ /* cannot handle READ_CAPACITY_16 */ \
+ US_FLAG(INITIAL_READ10, 0x00100000) \
+- /* Initial READ(10) (and others) must be retried */
++ /* Initial READ(10) (and others) must be retried */ \
++ US_FLAG(BROKEN_FUA, 0x01000000) \
++ /* Cannot handle FUA in WRITE or READ CDBs */ \
+
+ #define US_FLAG(name, value) US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/include/linux/virtio.h b/include/linux/virtio.h
+index 2b779bf80cc0..f73e2c76bd8a 100644
+--- a/include/linux/virtio.h
++++ b/include/linux/virtio.h
+@@ -75,7 +75,11 @@ struct virtio_device {
+ void *priv;
+ };
+
+-#define dev_to_virtio(dev) container_of(dev, struct virtio_device, dev)
++static inline struct virtio_device *dev_to_virtio(struct device *_dev)
++{
++ return container_of(_dev, struct virtio_device, dev);
++}
++
+ int register_virtio_device(struct virtio_device *dev);
+ void unregister_virtio_device(struct virtio_device *dev);
+
+diff --git a/include/linux/writeback.h b/include/linux/writeback.h
+index a2b84f598e2b..dd8d4918de2e 100644
+--- a/include/linux/writeback.h
++++ b/include/linux/writeback.h
+@@ -186,7 +186,6 @@ int write_cache_pages(struct address_space *mapping,
+ struct writeback_control *wbc, writepage_t writepage,
+ void *data);
+ int do_writepages(struct address_space *mapping, struct writeback_control *wbc);
+-void set_page_dirty_balance(struct page *page, int page_mkwrite);
+ void writeback_set_ratelimit(void);
+ void tag_pages_for_writeback(struct address_space *mapping,
+ pgoff_t start, pgoff_t end);
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index a2ef81466b00..43c8bbcdb512 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -524,6 +524,11 @@ static inline void sctp_assoc_pending_pmtu(struct sctp_association *asoc)
+ asoc->pmtu_pending = 0;
+ }
+
++static inline bool sctp_chunk_pending(const struct sctp_chunk *chunk)
++{
++ return !list_empty(&chunk->list);
++}
++
+ /* Walk through a list of TLV parameters. Don't trust the
+ * individual parameter lengths and instead depend on
+ * the chunk length to indicate when to stop. Make sure
+diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
+index 9148632b8204..4d1be75e3857 100644
+--- a/include/net/sctp/sm.h
++++ b/include/net/sctp/sm.h
+@@ -251,9 +251,9 @@ struct sctp_chunk *sctp_make_asconf_update_ip(struct sctp_association *,
+ int, __be16);
+ struct sctp_chunk *sctp_make_asconf_set_prim(struct sctp_association *asoc,
+ union sctp_addr *addr);
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+- struct sctp_paramhdr *param_hdr, void *chunk_end,
+- struct sctp_paramhdr **errp);
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++ struct sctp_chunk *chunk, bool addr_param_needed,
++ struct sctp_paramhdr **errp);
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ struct sctp_chunk *asconf);
+ int sctp_process_asconf_ack(struct sctp_association *asoc,
+diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
+index ba9698852321..d2f5f44d50f8 100644
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -153,6 +153,7 @@ struct scsi_device {
+ unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */
+ unsigned try_rc_10_first:1; /* Try READ_CAPACACITY_10 first */
+ unsigned is_visible:1; /* is the device visible in sysfs */
++ unsigned broken_fua:1; /* Don't set FUA bit */
+
+ DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
+ struct list_head event_list; /* asserted events */
+diff --git a/include/sound/ak4113.h b/include/sound/ak4113.h
+index 2609048c1d44..3a34f6edc2d1 100644
+--- a/include/sound/ak4113.h
++++ b/include/sound/ak4113.h
+@@ -286,7 +286,7 @@ struct ak4113 {
+ ak4113_write_t *write;
+ ak4113_read_t *read;
+ void *private_data;
+- unsigned int init:1;
++ atomic_t wq_processing;
+ spinlock_t lock;
+ unsigned char regmap[AK4113_WRITABLE_REGS];
+ struct snd_kcontrol *kctls[AK4113_CONTROLS];
+diff --git a/include/sound/ak4114.h b/include/sound/ak4114.h
+index 3ce69fd92523..69441161009c 100644
+--- a/include/sound/ak4114.h
++++ b/include/sound/ak4114.h
+@@ -168,7 +168,7 @@ struct ak4114 {
+ ak4114_write_t * write;
+ ak4114_read_t * read;
+ void * private_data;
+- unsigned int init: 1;
++ atomic_t wq_processing;
+ spinlock_t lock;
+ unsigned char regmap[7];
+ unsigned char txcsb[5];
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index c776f8941175..34eda955e887 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -898,7 +898,7 @@ static void cgroup_clear_directory(struct dentry *dentry)
+ spin_lock(&dentry->d_lock);
+ node = dentry->d_subdirs.next;
+ while (node != &dentry->d_subdirs) {
+- struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
++ struct dentry *d = list_entry(node, struct dentry, d_child);
+
+ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
+ list_del_init(node);
+@@ -932,7 +932,7 @@ static void cgroup_d_remove_dir(struct dentry *dentry)
+ parent = dentry->d_parent;
+ spin_lock(&parent->d_lock);
+ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+- list_del_init(&dentry->d_u.d_child);
++ list_del_init(&dentry->d_child);
+ spin_unlock(&dentry->d_lock);
+ spin_unlock(&parent->d_lock);
+ remove_dir(dentry);
+diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
+index 8e5c56b3b7d9..5a414405deef 100644
+--- a/kernel/irq/internals.h
++++ b/kernel/irq/internals.h
+@@ -74,6 +74,14 @@ extern void irq_percpu_disable(struct irq_desc *desc, unsigned int cpu);
+ extern void mask_irq(struct irq_desc *desc);
+ extern void unmask_irq(struct irq_desc *desc);
+
++#ifdef CONFIG_SPARSE_IRQ
++extern void irq_lock_sparse(void);
++extern void irq_unlock_sparse(void);
++#else
++static inline void irq_lock_sparse(void) { }
++static inline void irq_unlock_sparse(void) { }
++#endif
++
+ extern void init_kstat_irqs(struct irq_desc *desc, int node, int nr);
+
+ irqreturn_t handle_irq_event_percpu(struct irq_desc *desc, struct irqaction *action);
+diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
+index 8ab8e9390297..07d45516b540 100644
+--- a/kernel/irq/irqdesc.c
++++ b/kernel/irq/irqdesc.c
+@@ -131,6 +131,16 @@ static void free_masks(struct irq_desc *desc)
+ static inline void free_masks(struct irq_desc *desc) { }
+ #endif
+
++void irq_lock_sparse(void)
++{
++ mutex_lock(&sparse_irq_lock);
++}
++
++void irq_unlock_sparse(void)
++{
++ mutex_unlock(&sparse_irq_lock);
++}
++
+ static struct irq_desc *alloc_desc(int irq, int node, struct module *owner)
+ {
+ struct irq_desc *desc;
+@@ -167,6 +177,12 @@ static void free_desc(unsigned int irq)
+
+ unregister_irq_proc(irq, desc);
+
++ /*
++ * sparse_irq_lock protects also show_interrupts() and
++ * kstat_irq_usr(). Once we deleted the descriptor from the
++ * sparse tree we can free it. Access in proc will fail to
++ * lookup the descriptor.
++ */
+ mutex_lock(&sparse_irq_lock);
+ delete_irq_desc(irq);
+ mutex_unlock(&sparse_irq_lock);
+@@ -489,6 +505,15 @@ void dynamic_irq_cleanup(unsigned int irq)
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+ }
+
++/**
++ * kstat_irqs_cpu - Get the statistics for an interrupt on a cpu
++ * @irq: The interrupt number
++ * @cpu: The cpu number
++ *
++ * Returns the sum of interrupt counts on @cpu since boot for
++ * @irq. The caller must ensure that the interrupt is not removed
++ * concurrently.
++ */
+ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+@@ -497,6 +522,14 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
+ *per_cpu_ptr(desc->kstat_irqs, cpu) : 0;
+ }
+
++/**
++ * kstat_irqs - Get the statistics for an interrupt
++ * @irq: The interrupt number
++ *
++ * Returns the sum of interrupt counts on all cpus since boot for
++ * @irq. The caller must ensure that the interrupt is not removed
++ * concurrently.
++ */
+ unsigned int kstat_irqs(unsigned int irq)
+ {
+ struct irq_desc *desc = irq_to_desc(irq);
+@@ -509,3 +542,22 @@ unsigned int kstat_irqs(unsigned int irq)
+ sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
+ return sum;
+ }
++
++/**
++ * kstat_irqs_usr - Get the statistics for an interrupt
++ * @irq: The interrupt number
++ *
++ * Returns the sum of interrupt counts on all cpus since boot for
++ * @irq. Contrary to kstat_irqs() this can be called from any
++ * preemptible context. It's protected against concurrent removal of
++ * an interrupt descriptor when sparse irqs are enabled.
++ */
++unsigned int kstat_irqs_usr(unsigned int irq)
++{
++ int sum;
++
++ irq_lock_sparse();
++ sum = kstat_irqs(irq);
++ irq_unlock_sparse();
++ return sum;
++}
+diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
+index 4bd4faa6323a..fb655f5f9689 100644
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -15,6 +15,23 @@
+
+ #include "internals.h"
+
++/*
++ * Access rules:
++ *
++ * procfs protects read/write of /proc/irq/N/ files against a
++ * concurrent free of the interrupt descriptor. remove_proc_entry()
++ * immediately prevents new read/writes to happen and waits for
++ * already running read/write functions to complete.
++ *
++ * We remove the proc entries first and then delete the interrupt
++ * descriptor from the radix tree and free it. So it is guaranteed
++ * that irq_to_desc(N) is valid as long as the read/writes are
++ * permitted by procfs.
++ *
++ * The read from /proc/interrupts is a different problem because there
++ * is no protection. So the lookup and the access to irqdesc
++ * information must be protected by sparse_irq_lock.
++ */
+ static struct proc_dir_entry *root_irq_dir;
+
+ #ifdef CONFIG_SMP
+@@ -441,9 +458,10 @@ int show_interrupts(struct seq_file *p, void *v)
+ seq_putc(p, '\n');
+ }
+
++ irq_lock_sparse();
+ desc = irq_to_desc(i);
+ if (!desc)
+- return 0;
++ goto outsparse;
+
+ raw_spin_lock_irqsave(&desc->lock, flags);
+ for_each_online_cpu(j)
+@@ -481,6 +499,8 @@ int show_interrupts(struct seq_file *p, void *v)
+ seq_putc(p, '\n');
+ out:
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
++outsparse:
++ irq_unlock_sparse();
+ return 0;
+ }
+ #endif
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 526c77d1b655..71429db2af2f 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -1293,7 +1293,12 @@ select_task_rq_rt(struct task_struct *p, int sd_flag, int flags)
+ (p->rt.nr_cpus_allowed > 1)) {
+ int target = find_lowest_rq(p);
+
+- if (target != -1)
++ /*
++ * Don't bother moving it if the destination CPU is
++ * not running a lower priority task.
++ */
++ if (target != -1 &&
++ p->prio < cpu_rq(target)->rt.highest_prio.curr)
+ cpu = target;
+ }
+ rcu_read_unlock();
+@@ -1570,6 +1575,16 @@ static struct rq *find_lock_lowest_rq(struct task_struct *task, struct rq *rq)
+
+ lowest_rq = cpu_rq(cpu);
+
++ if (lowest_rq->rt.highest_prio.curr <= task->prio) {
++ /*
++ * Target rq has tasks of equal or higher priority,
++ * retrying does not release any lock and is unlikely
++ * to yield a different result.
++ */
++ lowest_rq = NULL;
++ break;
++ }
++
+ /* if the prio of this runqueue changed, try again */
+ if (double_lock_balance(rq, lowest_rq)) {
+ /*
+diff --git a/kernel/time.c b/kernel/time.c
+index a09529030093..0864d70da80d 100644
+--- a/kernel/time.c
++++ b/kernel/time.c
+@@ -186,6 +186,10 @@ SYSCALL_DEFINE2(settimeofday, struct timeval __user *, tv,
+ if (tv) {
+ if (copy_from_user(&user_tv, tv, sizeof(*tv)))
+ return -EFAULT;
++
++ if (!timeval_valid(&user_tv))
++ return -EINVAL;
++
+ new_ts.tv_sec = user_tv.tv_sec;
+ new_ts.tv_nsec = user_tv.tv_usec * NSEC_PER_USEC;
+ }
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index 8b707100286b..e32587e7a6ca 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -660,6 +660,17 @@ int do_adjtimex(struct timex *txc)
+ return result;
+ }
+
++ /*
++ * Check for potential multiplication overflows that can
++ * only happen on 64-bit systems:
++ */
++ if ((txc->modes & ADJ_FREQUENCY) && (BITS_PER_LONG == 64)) {
++ if (LLONG_MIN / PPM_SCALE > txc->freq)
++ return -EINVAL;
++ if (LLONG_MAX / PPM_SCALE < txc->freq)
++ return -EINVAL;
++ }
++
+ getnstimeofday(&ts);
+
+ spin_lock_irq(&ntp_lock);
+diff --git a/lib/checksum.c b/lib/checksum.c
+index 12dceb27ff20..33f29f0197b7 100644
+--- a/lib/checksum.c
++++ b/lib/checksum.c
+@@ -179,6 +179,15 @@ csum_partial_copy(const void *src, void *dst, int len, __wsum sum)
+ EXPORT_SYMBOL(csum_partial_copy);
+
+ #ifndef csum_tcpudp_nofold
++static inline u32 from64to32(u64 x)
++{
++ /* add up 32-bit and 32-bit for 32+c bit */
++ x = (x & 0xffffffff) + (x >> 32);
++ /* add up carry.. */
++ x = (x & 0xffffffff) + (x >> 32);
++ return (u32)x;
++}
++
+ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
+ unsigned short len,
+ unsigned short proto,
+@@ -193,8 +202,7 @@ __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr,
+ #else
+ s += (proto + len) << 8;
+ #endif
+- s += (s >> 32);
+- return (__force __wsum)s;
++ return (__force __wsum)from64to32(s);
+ }
+ EXPORT_SYMBOL(csum_tcpudp_nofold);
+ #endif
+diff --git a/mm/ksm.c b/mm/ksm.c
+index 47c885368890..77c71185fb79 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -342,7 +342,7 @@ static int break_ksm(struct vm_area_struct *vma, unsigned long addr)
+ else
+ ret = VM_FAULT_WRITE;
+ put_page(page);
+- } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_OOM)));
++ } while (!(ret & (VM_FAULT_WRITE | VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV | VM_FAULT_OOM)));
+ /*
+ * We must loop because handle_mm_fault() may back out if there's
+ * any difficulty e.g. if pte accessed bit gets updated concurrently.
+diff --git a/mm/memory.c b/mm/memory.c
+index c34e60a950aa..45cd14f0c7bf 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -847,20 +847,20 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
+ if (!pte_file(pte)) {
+ swp_entry_t entry = pte_to_swp_entry(pte);
+
+- if (swap_duplicate(entry) < 0)
+- return entry.val;
+-
+- /* make sure dst_mm is on swapoff's mmlist. */
+- if (unlikely(list_empty(&dst_mm->mmlist))) {
+- spin_lock(&mmlist_lock);
+- if (list_empty(&dst_mm->mmlist))
+- list_add(&dst_mm->mmlist,
+- &src_mm->mmlist);
+- spin_unlock(&mmlist_lock);
+- }
+- if (likely(!non_swap_entry(entry)))
++ if (likely(!non_swap_entry(entry))) {
++ if (swap_duplicate(entry) < 0)
++ return entry.val;
++
++ /* make sure dst_mm is on swapoff's mmlist. */
++ if (unlikely(list_empty(&dst_mm->mmlist))) {
++ spin_lock(&mmlist_lock);
++ if (list_empty(&dst_mm->mmlist))
++ list_add(&dst_mm->mmlist,
++ &src_mm->mmlist);
++ spin_unlock(&mmlist_lock);
++ }
+ rss[MM_SWAPENTS]++;
+- else if (is_migration_entry(entry)) {
++ } else if (is_migration_entry(entry)) {
+ page = migration_entry_to_page(entry);
+
+ if (PageAnon(page))
+@@ -1787,7 +1787,7 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ else
+ return -EFAULT;
+ }
+- if (ret & VM_FAULT_SIGBUS)
++ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+ return i ? i : -EFAULT;
+ BUG();
+ }
+@@ -1891,7 +1891,7 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ return -ENOMEM;
+ if (ret & (VM_FAULT_HWPOISON | VM_FAULT_HWPOISON_LARGE))
+ return -EHWPOISON;
+- if (ret & VM_FAULT_SIGBUS)
++ if (ret & (VM_FAULT_SIGBUS | VM_FAULT_SIGSEGV))
+ return -EFAULT;
+ BUG();
+ }
+@@ -2681,18 +2681,25 @@ reuse:
+ if (!dirty_page)
+ return ret;
+
+- /*
+- * Yes, Virginia, this is actually required to prevent a race
+- * with clear_page_dirty_for_io() from clearing the page dirty
+- * bit after it clear all dirty ptes, but before a racing
+- * do_wp_page installs a dirty pte.
+- *
+- * __do_fault is protected similarly.
+- */
+ if (!page_mkwrite) {
+- wait_on_page_locked(dirty_page);
+- set_page_dirty_balance(dirty_page, page_mkwrite);
++ struct address_space *mapping;
++ int dirtied;
++
++ lock_page(dirty_page);
++ dirtied = set_page_dirty(dirty_page);
++ VM_BUG_ON(dirty_page);
++ mapping = dirty_page->mapping;
++ unlock_page(dirty_page);
++
++ if (dirtied && mapping) {
++ /*
++ * Some device drivers do not set page.mapping
++ * but still dirty their pages
++ */
++ balance_dirty_pages_ratelimited(mapping);
++ }
+ }
++
+ put_page(dirty_page);
+ if (page_mkwrite) {
+ struct address_space *mapping = dirty_page->mapping;
+@@ -3137,7 +3144,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
+ if (prev && prev->vm_end == address)
+ return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
+
+- expand_downwards(vma, address - PAGE_SIZE);
++ return expand_downwards(vma, address - PAGE_SIZE);
+ }
+ if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
+ struct vm_area_struct *next = vma->vm_next;
+@@ -3146,7 +3153,7 @@ static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned lo
+ if (next && next->vm_start == address + PAGE_SIZE)
+ return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
+
+- expand_upwards(vma, address + PAGE_SIZE);
++ return expand_upwards(vma, address + PAGE_SIZE);
+ }
+ return 0;
+ }
+@@ -3168,7 +3175,7 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ /* Check if we need to add a guard page to the stack */
+ if (check_stack_guard_page(vma, address) < 0)
+- return VM_FAULT_SIGBUS;
++ return VM_FAULT_SIGSEGV;
+
+ /* Use the zero-page for reads */
+ if (!(flags & FAULT_FLAG_WRITE)) {
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 94fdbe8f3b99..208e70f1006d 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -567,9 +567,12 @@ again: remove_next = 1 + (end > next->vm_end);
+ * shrinking vma had, to cover any anon pages imported.
+ */
+ if (exporter && exporter->anon_vma && !importer->anon_vma) {
+- if (anon_vma_clone(importer, exporter))
+- return -ENOMEM;
++ int error;
++
+ importer->anon_vma = exporter->anon_vma;
++ error = anon_vma_clone(importer, exporter);
++ if (error)
++ return error;
+ }
+ }
+
+@@ -1727,14 +1730,17 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+ {
+ struct mm_struct *mm = vma->vm_mm;
+ struct rlimit *rlim = current->signal->rlim;
+- unsigned long new_start;
++ unsigned long new_start, actual_size;
+
+ /* address space limit tests */
+ if (!may_expand_vm(mm, grow))
+ return -ENOMEM;
+
+ /* Stack limit test */
+- if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
++ actual_size = size;
++ if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN)))
++ actual_size -= PAGE_SIZE;
++ if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
+ return -ENOMEM;
+
+ /* mlock limit tests */
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 2a13b7997ac6..057884c2b4d9 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -1394,16 +1394,6 @@ pause:
+ bdi_start_background_writeback(bdi);
+ }
+
+-void set_page_dirty_balance(struct page *page, int page_mkwrite)
+-{
+- if (set_page_dirty(page) || page_mkwrite) {
+- struct address_space *mapping = page_mapping(page);
+-
+- if (mapping)
+- balance_dirty_pages_ratelimited(mapping);
+- }
+-}
+-
+ static DEFINE_PER_CPU(int, bdp_ratelimits);
+
+ /*
+@@ -1981,32 +1971,25 @@ EXPORT_SYMBOL(account_page_writeback);
+ * page dirty in that case, but not all the buffers. This is a "bottom-up"
+ * dirtying, whereas __set_page_dirty_buffers() is a "top-down" dirtying.
+ *
+- * Most callers have locked the page, which pins the address_space in memory.
+- * But zap_pte_range() does not lock the page, however in that case the
+- * mapping is pinned by the vma's ->vm_file reference.
+- *
+- * We take care to handle the case where the page was truncated from the
+- * mapping by re-checking page_mapping() inside tree_lock.
++ * The caller must ensure this doesn't race with truncation. Most will simply
++ * hold the page lock, but e.g. zap_pte_range() calls with the page mapped and
++ * the pte lock held, which also locks out truncat
+ */
+ int __set_page_dirty_nobuffers(struct page *page)
+ {
+ if (!TestSetPageDirty(page)) {
+ struct address_space *mapping = page_mapping(page);
+- struct address_space *mapping2;
+ unsigned long flags;
+
+ if (!mapping)
+ return 1;
+
+ spin_lock_irqsave(&mapping->tree_lock, flags);
+- mapping2 = page_mapping(page);
+- if (mapping2) { /* Race with truncate? */
+- BUG_ON(mapping2 != mapping);
+- WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
+- account_page_dirtied(page, mapping);
+- radix_tree_tag_set(&mapping->page_tree,
+- page_index(page), PAGECACHE_TAG_DIRTY);
+- }
++ BUG_ON(page_mapping(page) != mapping);
++ WARN_ON_ONCE(!PagePrivate(page) && !PageUptodate(page));
++ account_page_dirtied(page, mapping);
++ radix_tree_tag_set(&mapping->page_tree, page_index(page),
++ PAGECACHE_TAG_DIRTY);
+ spin_unlock_irqrestore(&mapping->tree_lock, flags);
+ if (mapping->host) {
+ /* !PageAnon && !swapper_space */
+@@ -2163,12 +2146,10 @@ int clear_page_dirty_for_io(struct page *page)
+ /*
+ * We carefully synchronise fault handlers against
+ * installing a dirty pte and marking the page dirty
+- * at this point. We do this by having them hold the
+- * page lock at some point after installing their
+- * pte, but before marking the page dirty.
+- * Pages are always locked coming in here, so we get
+- * the desired exclusion. See mm/memory.c:do_wp_page()
+- * for more comments.
++ * at this point. We do this by having them hold the
++ * page lock while dirtying the page, and pages are
++ * always locked coming in here, so we get the desired
++ * exclusion.
+ */
+ if (TestClearPageDirty(page)) {
+ dec_zone_page_state(page, NR_FILE_DIRTY);
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 695eaff55d77..57f503b185a9 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -72,6 +72,8 @@ static inline struct anon_vma *anon_vma_alloc(void)
+ anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL);
+ if (anon_vma) {
+ atomic_set(&anon_vma->refcount, 1);
++ anon_vma->degree = 1; /* Reference for first vma */
++ anon_vma->parent = anon_vma;
+ /*
+ * Initialise the anon_vma root to point to itself. If called
+ * from fork, the root will be reset to the parents anon_vma.
+@@ -193,6 +195,8 @@ int anon_vma_prepare(struct vm_area_struct *vma)
+ if (likely(!vma->anon_vma)) {
+ vma->anon_vma = anon_vma;
+ anon_vma_chain_link(vma, avc, anon_vma);
++ /* vma reference or self-parent link for new root */
++ anon_vma->degree++;
+ allocated = NULL;
+ avc = NULL;
+ }
+@@ -241,6 +245,14 @@ static inline void unlock_anon_vma_root(struct anon_vma *root)
+ /*
+ * Attach the anon_vmas from src to dst.
+ * Returns 0 on success, -ENOMEM on failure.
++ *
++ * If dst->anon_vma is NULL this function tries to find and reuse existing
++ * anon_vma which has no vmas and only one child anon_vma. This prevents
++ * degradation of anon_vma hierarchy to endless linear chain in case of
++ * constantly forking task. On the other hand, an anon_vma with more than one
++ * child isn't reused even if there was no alive vma, thus rmap walker has a
++ * good chance of avoiding scanning the whole hierarchy when it searches where
++ * page is mapped.
+ */
+ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ {
+@@ -261,11 +273,32 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ anon_vma = pavc->anon_vma;
+ root = lock_anon_vma_root(root, anon_vma);
+ anon_vma_chain_link(dst, avc, anon_vma);
++
++ /*
++ * Reuse existing anon_vma if its degree lower than two,
++ * that means it has no vma and only one anon_vma child.
++ *
++ * Do not chose parent anon_vma, otherwise first child
++ * will always reuse it. Root anon_vma is never reused:
++ * it has self-parent reference and at least one child.
++ */
++ if (!dst->anon_vma && anon_vma != src->anon_vma &&
++ anon_vma->degree < 2)
++ dst->anon_vma = anon_vma;
+ }
++ if (dst->anon_vma)
++ dst->anon_vma->degree++;
+ unlock_anon_vma_root(root);
+ return 0;
+
+ enomem_failure:
++ /*
++ * dst->anon_vma is dropped here otherwise its degree can be incorrectly
++ * decremented in unlink_anon_vmas().
++ * We can safely do this because callers of anon_vma_clone() don't care
++ * about dst->anon_vma if anon_vma_clone() failed.
++ */
++ dst->anon_vma = NULL;
+ unlink_anon_vmas(dst);
+ return -ENOMEM;
+ }
+@@ -329,6 +362,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ if (!pvma->anon_vma)
+ return 0;
+
++ /* Drop inherited anon_vma, we'll reuse existing or allocate new. */
++ vma->anon_vma = NULL;
++
+ /*
+ * First, attach the new VMA to the parent VMA's anon_vmas,
+ * so rmap can find non-COWed pages in child processes.
+@@ -336,6 +372,10 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ if (anon_vma_clone(vma, pvma))
+ return -ENOMEM;
+
++ /* An existing anon_vma has been reused, all done then. */
++ if (vma->anon_vma)
++ return 0;
++
+ /* Then add our own anon_vma. */
+ anon_vma = anon_vma_alloc();
+ if (!anon_vma)
+@@ -349,6 +389,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ * lock any of the anon_vmas in this anon_vma tree.
+ */
+ anon_vma->root = pvma->anon_vma->root;
++ anon_vma->parent = pvma->anon_vma;
+ /*
+ * With refcounts, an anon_vma can stay around longer than the
+ * process it belongs to. The root anon_vma needs to be pinned until
+@@ -359,6 +400,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
+ vma->anon_vma = anon_vma;
+ anon_vma_lock(anon_vma);
+ anon_vma_chain_link(vma, avc, anon_vma);
++ anon_vma->parent->degree++;
+ anon_vma_unlock(anon_vma);
+
+ return 0;
+@@ -389,12 +431,16 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ * Leave empty anon_vmas on the list - we'll need
+ * to free them outside the lock.
+ */
+- if (list_empty(&anon_vma->head))
++ if (list_empty(&anon_vma->head)) {
++ anon_vma->parent->degree--;
+ continue;
++ }
+
+ list_del(&avc->same_vma);
+ anon_vma_chain_free(avc);
+ }
++ if (vma->anon_vma)
++ vma->anon_vma->degree--;
+ unlock_anon_vma_root(root);
+
+ /*
+@@ -405,6 +451,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma)
+ list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) {
+ struct anon_vma *anon_vma = avc->anon_vma;
+
++ BUG_ON(anon_vma->degree);
+ put_anon_vma(anon_vma);
+
+ list_del(&avc->same_vma);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 3bb535b08822..c11fd9ea78c9 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -3239,7 +3239,7 @@ static inline int l2cap_information_rsp(struct l2cap_conn *conn,
+ struct l2cap_info_rsp *rsp = (struct l2cap_info_rsp *) data;
+ u16 type, result;
+
+- if (cmd_len != sizeof(*rsp))
++ if (cmd_len < sizeof(*rsp))
+ return -EPROTO;
+
+ type = __le16_to_cpu(rsp->type);
+@@ -3445,7 +3445,7 @@ static inline int l2cap_move_channel_confirm_rsp(struct l2cap_conn *conn,
+ struct l2cap_move_chan_cfm_rsp *rsp = data;
+ u16 icid;
+
+- if (cmd_len < sizeof(*rsp))
++ if (cmd_len != sizeof(*rsp))
+ return -EPROTO;
+
+ icid = le16_to_cpu(rsp->icid);
+diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
+index d09340e1523f..b8d940398adc 100644
+--- a/net/caif/chnl_net.c
++++ b/net/caif/chnl_net.c
+@@ -467,7 +467,6 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
+ ASSERT_RTNL();
+ caifdev = netdev_priv(dev);
+ caif_netlink_parms(data, &caifdev->conn_req);
+- dev_net_set(caifdev->netdev, src_net);
+
+ ret = register_netdevice(dev);
+ if (ret)
+diff --git a/net/compat.c b/net/compat.c
+index 2c774d889d39..5b1750930916 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
+ __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
+ __get_user(kmsg->msg_flags, &umsg->msg_flags))
+ return -EFAULT;
++
++ if (!tmp1)
++ kmsg->msg_namelen = 0;
++
++ if (kmsg->msg_namelen < 0)
++ return -EINVAL;
++
+ if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+ kmsg->msg_namelen = sizeof(struct sockaddr_storage);
+ kmsg->msg_name = compat_ptr(tmp1);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 0770364832a1..901495216f85 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2143,12 +2143,14 @@ netdev_features_t netif_skb_features(struct sk_buff *skb)
+ if (skb_shinfo(skb)->gso_segs > skb->dev->gso_max_segs)
+ features &= ~NETIF_F_GSO_MASK;
+
+- if (protocol == htons(ETH_P_8021Q)) {
+- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+- protocol = veh->h_vlan_encapsulated_proto;
+- } else if (!vlan_tx_tag_present(skb)) {
+- return harmonize_features(skb, protocol, features);
+- }
++ if (!vlan_tx_tag_present(skb)) {
++ if (unlikely(protocol == htons(ETH_P_8021Q))) {
++ struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
++ protocol = veh->h_vlan_encapsulated_proto;
++ } else {
++ return harmonize_features(skb, protocol, features);
++ }
++ }
+
+ features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX);
+
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 5bb77a691327..2cfcfb7efa91 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -633,6 +633,29 @@ insert_above:
+ return ln;
+ }
+
++static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
++ struct net *net)
++{
++ if (atomic_read(&rt->rt6i_ref) != 1) {
++ /* This route is used as dummy address holder in some split
++ * nodes. It is not leaked, but it still holds other resources,
++ * which must be released in time. So, scan ascendant nodes
++ * and replace dummy references to this route with references
++ * to still alive ones.
++ */
++ while (fn) {
++ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
++ fn->leaf = fib6_find_prefix(net, fn);
++ atomic_inc(&fn->leaf->rt6i_ref);
++ rt6_release(rt);
++ }
++ fn = fn->parent;
++ }
++ /* No more references are possible at this point. */
++ BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
++ }
++}
++
+ /*
+ * Insert routing information in a node.
+ */
+@@ -723,11 +746,12 @@ add:
+ rt->dst.rt6_next = iter->dst.rt6_next;
+ atomic_inc(&rt->rt6i_ref);
+ inet6_rt_notify(RTM_NEWROUTE, rt, info);
+- rt6_release(iter);
+ if (!(fn->fn_flags & RTN_RTINFO)) {
+ info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
+ fn->fn_flags |= RTN_RTINFO;
+ }
++ fib6_purge_rt(iter, fn, info->nl_net);
++ rt6_release(iter);
+ }
+
+ return 0;
+@@ -1229,24 +1253,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
+ fn = fib6_repair_tree(net, fn);
+ }
+
+- if (atomic_read(&rt->rt6i_ref) != 1) {
+- /* This route is used as dummy address holder in some split
+- * nodes. It is not leaked, but it still holds other resources,
+- * which must be released in time. So, scan ascendant nodes
+- * and replace dummy references to this route with references
+- * to still alive ones.
+- */
+- while (fn) {
+- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+- fn->leaf = fib6_find_prefix(net, fn);
+- atomic_inc(&fn->leaf->rt6i_ref);
+- rt6_release(rt);
+- }
+- fn = fn->parent;
+- }
+- /* No more references are possible at this point. */
+- BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
+- }
++ fib6_purge_rt(rt, fn, net);
+
+ inet6_rt_notify(RTM_DELROUTE, rt, info);
+ rt6_release(rt);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 32929b07269f..24f2a4135edf 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1486,14 +1486,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
+- goto out;
+-
+ if (is_multicast_ether_addr(hdr->addr1)) {
+ rx->local->dot11MulticastReceivedFrameCount++;
+- goto out;
++ goto out_no_led;
+ }
+
++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++ goto out;
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -1584,9 +1584,10 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ status->rx_flags |= IEEE80211_RX_FRAGMENTED;
+
+ out:
++ ieee80211_led_rx(rx->local);
++ out_no_led:
+ if (rx->sta)
+ rx->sta->rx_packets++;
+- ieee80211_led_rx(rx->local);
+ return RX_CONTINUE;
+ }
+
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index 00bdb1d9d690..abdb4755f382 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -662,16 +662,24 @@ static inline int ip_vs_gather_frags_v6(struct sk_buff *skb, u_int32_t user)
+ }
+ #endif
+
+-static int ip_vs_route_me_harder(int af, struct sk_buff *skb)
++static int ip_vs_route_me_harder(int af, struct sk_buff *skb,
++ unsigned int hooknum)
+ {
++ if (!sysctl_snat_reroute(skb))
++ return 0;
++ /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */
++ if (NF_INET_LOCAL_IN == hooknum)
++ return 0;
+ #ifdef CONFIG_IP_VS_IPV6
+ if (af == AF_INET6) {
+- if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0)
++ struct dst_entry *dst = skb_dst(skb);
++
++ if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
++ ip6_route_me_harder(skb) != 0)
+ return 1;
+ } else
+ #endif
+- if ((sysctl_snat_reroute(skb) ||
+- skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
++ if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
+ ip_route_me_harder(skb, RTN_LOCAL) != 0)
+ return 1;
+
+@@ -782,7 +790,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
+ union nf_inet_addr *snet,
+ __u8 protocol, struct ip_vs_conn *cp,
+ struct ip_vs_protocol *pp,
+- unsigned int offset, unsigned int ihl)
++ unsigned int offset, unsigned int ihl,
++ unsigned int hooknum)
+ {
+ unsigned int verdict = NF_DROP;
+
+@@ -812,7 +821,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
+ #endif
+ ip_vs_nat_icmp(skb, pp, cp, 1);
+
+- if (ip_vs_route_me_harder(af, skb))
++ if (ip_vs_route_me_harder(af, skb, hooknum))
+ goto out;
+
+ /* do the statistics and put it back */
+@@ -908,7 +917,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related,
+
+ snet.ip = iph->saddr;
+ return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
+- pp, offset, ihl);
++ pp, offset, ihl, hooknum);
+ }
+
+ #ifdef CONFIG_IP_VS_IPV6
+@@ -985,7 +994,8 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related,
+
+ snet.in6 = iph->saddr;
+ return handle_response_icmp(AF_INET6, skb, &snet, cih->nexthdr, cp,
+- pp, offset, sizeof(struct ipv6hdr));
++ pp, offset, sizeof(struct ipv6hdr),
++ hooknum);
+ }
+ #endif
+
+@@ -1018,7 +1028,7 @@ static inline int is_tcp_reset(const struct sk_buff *skb, int nh_len)
+ */
+ static unsigned int
+ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
+- struct ip_vs_conn *cp, int ihl)
++ struct ip_vs_conn *cp, int ihl, unsigned int hooknum)
+ {
+ struct ip_vs_protocol *pp = pd->pp;
+
+@@ -1056,7 +1066,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
+ * if it came from this machine itself. So re-compute
+ * the routing information.
+ */
+- if (ip_vs_route_me_harder(af, skb))
++ if (ip_vs_route_me_harder(af, skb, hooknum))
+ goto drop;
+
+ IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT");
+@@ -1169,7 +1179,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)
+ cp = pp->conn_out_get(af, skb, &iph, iph.len, 0);
+
+ if (likely(cp))
+- return handle_response(af, skb, pd, cp, iph.len);
++ return handle_response(af, skb, pd, cp, iph.len, hooknum);
+ if (sysctl_nat_icmp_send(net) &&
+ (pp->protocol == IPPROTO_TCP ||
+ pp->protocol == IPPROTO_UDP ||
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index da54d2922f51..d014b053ad26 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1272,7 +1272,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
+ asoc->peer.peer_hmacs = new->peer.peer_hmacs;
+ new->peer.peer_hmacs = NULL;
+
+- sctp_auth_key_put(asoc->asoc_shared_key);
+ sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
+ }
+
+@@ -1638,6 +1637,8 @@ struct sctp_chunk *sctp_assoc_lookup_asconf_ack(
+ * ack chunk whose serial number matches that of the request.
+ */
+ list_for_each_entry(ack, &asoc->asconf_ack_list, transmitted_list) {
++ if (sctp_chunk_pending(ack))
++ continue;
+ if (ack->subh.addip_hdr->serial == serial) {
+ sctp_chunk_hold(ack);
+ return ack;
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index adb028746270..f1249b36837c 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -2569,7 +2569,10 @@ do_addr_param:
+
+ addr_param = param.v + sizeof(sctp_addip_param_t);
+
+- af = sctp_get_af_specific(param_type2af(param.p->type));
++ af = sctp_get_af_specific(param_type2af(addr_param->p.type));
++ if (af == NULL)
++ break;
++
+ af->from_addr_param(&addr, addr_param,
+ htons(asoc->peer.port), 0);
+
+@@ -3068,50 +3071,63 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc,
+ return SCTP_ERROR_NO_ERROR;
+ }
+
+-/* Verify the ASCONF packet before we process it. */
+-int sctp_verify_asconf(const struct sctp_association *asoc,
+- struct sctp_paramhdr *param_hdr, void *chunk_end,
+- struct sctp_paramhdr **errp) {
+- sctp_addip_param_t *asconf_param;
++/* Verify the ASCONF packet before we process it. */
++bool sctp_verify_asconf(const struct sctp_association *asoc,
++ struct sctp_chunk *chunk, bool addr_param_needed,
++ struct sctp_paramhdr **errp)
++{
++ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) chunk->chunk_hdr;
+ union sctp_params param;
+- int length, plen;
++ bool addr_param_seen = false;
+
+- param.v = (sctp_paramhdr_t *) param_hdr;
+- while (param.v <= chunk_end - sizeof(sctp_paramhdr_t)) {
+- length = ntohs(param.p->length);
+- *errp = param.p;
+-
+- if (param.v > chunk_end - length ||
+- length < sizeof(sctp_paramhdr_t))
+- return 0;
++ sctp_walk_params(param, addip, addip_hdr.params) {
++ size_t length = ntohs(param.p->length);
+
++ *errp = param.p;
+ switch (param.p->type) {
++ case SCTP_PARAM_ERR_CAUSE:
++ break;
++ case SCTP_PARAM_IPV4_ADDRESS:
++ if (length != sizeof(sctp_ipv4addr_param_t))
++ return false;
++ addr_param_seen = true;
++ break;
++ case SCTP_PARAM_IPV6_ADDRESS:
++ if (length != sizeof(sctp_ipv6addr_param_t))
++ return false;
++ addr_param_seen = true;
++ break;
+ case SCTP_PARAM_ADD_IP:
+ case SCTP_PARAM_DEL_IP:
+ case SCTP_PARAM_SET_PRIMARY:
+- asconf_param = (sctp_addip_param_t *)param.v;
+- plen = ntohs(asconf_param->param_hdr.length);
+- if (plen < sizeof(sctp_addip_param_t) +
+- sizeof(sctp_paramhdr_t))
+- return 0;
++ /* In ASCONF chunks, these need to be first. */
++ if (addr_param_needed && !addr_param_seen)
++ return false;
++ length = ntohs(param.addip->param_hdr.length);
++ if (length < sizeof(sctp_addip_param_t) +
++ sizeof(sctp_paramhdr_t))
++ return false;
+ break;
+ case SCTP_PARAM_SUCCESS_REPORT:
+ case SCTP_PARAM_ADAPTATION_LAYER_IND:
+ if (length != sizeof(sctp_addip_param_t))
+- return 0;
+-
++ return false;
+ break;
+ default:
+- break;
++ /* This is unkown to us, reject! */
++ return false;
+ }
+-
+- param.v += WORD_ROUND(length);
+ }
+
+- if (param.v != chunk_end)
+- return 0;
++ /* Remaining sanity checks. */
++ if (addr_param_needed && !addr_param_seen)
++ return false;
++ if (!addr_param_needed && addr_param_seen)
++ return false;
++ if (param.v != chunk->chunk_end)
++ return false;
+
+- return 1;
++ return true;
+ }
+
+ /* Process an incoming ASCONF chunk with the next expected serial no. and
+@@ -3120,16 +3136,17 @@ int sctp_verify_asconf(const struct sctp_association *asoc,
+ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ struct sctp_chunk *asconf)
+ {
++ sctp_addip_chunk_t *addip = (sctp_addip_chunk_t *) asconf->chunk_hdr;
++ bool all_param_pass = true;
++ union sctp_params param;
+ sctp_addiphdr_t *hdr;
+ union sctp_addr_param *addr_param;
+ sctp_addip_param_t *asconf_param;
+ struct sctp_chunk *asconf_ack;
+-
+ __be16 err_code;
+ int length = 0;
+ int chunk_len;
+ __u32 serial;
+- int all_param_pass = 1;
+
+ chunk_len = ntohs(asconf->chunk_hdr->length) - sizeof(sctp_chunkhdr_t);
+ hdr = (sctp_addiphdr_t *)asconf->skb->data;
+@@ -3157,9 +3174,14 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ goto done;
+
+ /* Process the TLVs contained within the ASCONF chunk. */
+- while (chunk_len > 0) {
++ sctp_walk_params(param, addip, addip_hdr.params) {
++ /* Skip preceeding address parameters. */
++ if (param.p->type == SCTP_PARAM_IPV4_ADDRESS ||
++ param.p->type == SCTP_PARAM_IPV6_ADDRESS)
++ continue;
++
+ err_code = sctp_process_asconf_param(asoc, asconf,
+- asconf_param);
++ param.addip);
+ /* ADDIP 4.1 A7)
+ * If an error response is received for a TLV parameter,
+ * all TLVs with no response before the failed TLV are
+@@ -3167,28 +3189,20 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
+ * the failed response are considered unsuccessful unless
+ * a specific success indication is present for the parameter.
+ */
+- if (SCTP_ERROR_NO_ERROR != err_code)
+- all_param_pass = 0;
+-
++ if (err_code != SCTP_ERROR_NO_ERROR)
++ all_param_pass = false;
+ if (!all_param_pass)
+- sctp_add_asconf_response(asconf_ack,
+- asconf_param->crr_id, err_code,
+- asconf_param);
++ sctp_add_asconf_response(asconf_ack, param.addip->crr_id,
++ err_code, param.addip);
+
+ /* ADDIP 4.3 D11) When an endpoint receiving an ASCONF to add
+ * an IP address sends an 'Out of Resource' in its response, it
+ * MUST also fail any subsequent add or delete requests bundled
+ * in the ASCONF.
+ */
+- if (SCTP_ERROR_RSRC_LOW == err_code)
++ if (err_code == SCTP_ERROR_RSRC_LOW)
+ goto done;
+-
+- /* Move to the next ASCONF param. */
+- length = ntohs(asconf_param->param_hdr.length);
+- asconf_param = (void *)asconf_param + length;
+- chunk_len -= length;
+ }
+-
+ done:
+ asoc->peer.addip_serial++;
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 5ac33b600538..a6a300630af4 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -3516,9 +3516,7 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+ struct sctp_chunk *asconf_ack = NULL;
+ struct sctp_paramhdr *err_param = NULL;
+ sctp_addiphdr_t *hdr;
+- union sctp_addr_param *addr_param;
+ __u32 serial;
+- int length;
+
+ if (!sctp_vtag_verify(chunk, asoc)) {
+ sctp_add_cmd_sf(commands, SCTP_CMD_REPORT_BAD_TAG,
+@@ -3543,17 +3541,8 @@ sctp_disposition_t sctp_sf_do_asconf(const struct sctp_endpoint *ep,
+ hdr = (sctp_addiphdr_t *)chunk->skb->data;
+ serial = ntohl(hdr->serial);
+
+- addr_param = (union sctp_addr_param *)hdr->params;
+- length = ntohs(addr_param->p.length);
+- if (length < sizeof(sctp_paramhdr_t))
+- return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+- (void *)addr_param, commands);
+-
+ /* Verify the ASCONF chunk before processing it. */
+- if (!sctp_verify_asconf(asoc,
+- (sctp_paramhdr_t *)((void *)addr_param + length),
+- (void *)chunk->chunk_end,
+- &err_param))
++ if (!sctp_verify_asconf(asoc, chunk, true, &err_param))
+ return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ (void *)err_param, commands);
+
+@@ -3670,10 +3659,7 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
+ rcvd_serial = ntohl(addip_hdr->serial);
+
+ /* Verify the ASCONF-ACK chunk before processing it. */
+- if (!sctp_verify_asconf(asoc,
+- (sctp_paramhdr_t *)addip_hdr->params,
+- (void *)asconf_ack->chunk_end,
+- &err_param))
++ if (!sctp_verify_asconf(asoc, asconf_ack, false, &err_param))
+ return sctp_sf_violation_paramlen(ep, asoc, type, arg,
+ (void *)err_param, commands);
+
+diff --git a/net/socket.c b/net/socket.c
+index cc3fc4d4263e..025f7f4d2d80 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1908,6 +1908,9 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
+ if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
+ return -EFAULT;
+
++ if (kmsg->msg_name == NULL)
++ kmsg->msg_namelen = 0;
++
+ if (kmsg->msg_namelen < 0)
+ return -EINVAL;
+
+diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
+index 4c23cfc0296c..a0769e1d4b8e 100644
+--- a/net/sunrpc/svcsock.c
++++ b/net/sunrpc/svcsock.c
+@@ -1055,17 +1055,12 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
+ xid = *p++;
+ calldir = *p;
+
+- if (bc_xprt)
+- req = xprt_lookup_rqst(bc_xprt, xid);
+-
+- if (!req) {
+- printk(KERN_NOTICE
+- "%s: Got unrecognized reply: "
+- "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
+- __func__, ntohl(calldir),
+- bc_xprt, xid);
++ if (!bc_xprt)
+ return -EAGAIN;
+- }
++ spin_lock_bh(&bc_xprt->transport_lock);
++ req = xprt_lookup_rqst(bc_xprt, xid);
++ if (!req)
++ goto unlock_notfound;
+
+ memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf));
+ /*
+@@ -1076,11 +1071,21 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
+ dst = &req->rq_private_buf.head[0];
+ src = &rqstp->rq_arg.head[0];
+ if (dst->iov_len < src->iov_len)
+- return -EAGAIN; /* whatever; just giving up. */
++ goto unlock_eagain; /* whatever; just giving up. */
+ memcpy(dst->iov_base, src->iov_base, src->iov_len);
+ xprt_complete_rqst(req->rq_task, svsk->sk_reclen);
+ rqstp->rq_arg.len = 0;
++ spin_unlock_bh(&bc_xprt->transport_lock);
+ return 0;
++unlock_notfound:
++ printk(KERN_NOTICE
++ "%s: Got unrecognized reply: "
++ "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
++ __func__, ntohl(calldir),
++ bc_xprt, ntohl(xid));
++unlock_eagain:
++ spin_unlock_bh(&bc_xprt->transport_lock);
++ return -EAGAIN;
+ }
+
+ static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len)
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 52646f9ecc80..63c18079683a 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -1868,6 +1868,9 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
+ if (!rdev->ops->get_key)
+ return -EOPNOTSUPP;
+
++ if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
++ return -ENOENT;
++
+ msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+ if (!msg)
+ return -ENOMEM;
+@@ -1885,10 +1888,6 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
+ if (mac_addr)
+ NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr);
+
+- if (pairwise && mac_addr &&
+- !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+- return -ENOENT;
+-
+ err = rdev->ops->get_key(&rdev->wiphy, dev, key_idx, pairwise,
+ mac_addr, &cookie, get_key_callback);
+
+@@ -2060,7 +2059,7 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ wdev_lock(dev->ieee80211_ptr);
+ err = nl80211_key_allowed(dev->ieee80211_ptr);
+
+- if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
++ if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
+ !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
+ err = -ENOENT;
+
+diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
+index 858966ab019c..679218b56ede 100755
+--- a/scripts/recordmcount.pl
++++ b/scripts/recordmcount.pl
+@@ -262,7 +262,6 @@ if ($arch eq "x86_64") {
+ # force flags for this arch
+ $ld .= " -m shlelf_linux";
+ $objcopy .= " -O elf32-sh-linux";
+- $cc .= " -m32";
+
+ } elsif ($arch eq "powerpc") {
+ $local_regex = "^[0-9a-fA-F]+\\s+t\\s+(\\.?\\S+)";
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 2d1bb8af7696..a02f92302a52 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -1016,10 +1016,13 @@ static int __init init_encrypted(void)
+ ret = encrypted_shash_alloc();
+ if (ret < 0)
+ return ret;
++ ret = aes_get_sizes();
++ if (ret < 0)
++ goto out;
+ ret = register_key_type(&key_type_encrypted);
+ if (ret < 0)
+ goto out;
+- return aes_get_sizes();
++ return 0;
+ out:
+ encrypted_shash_release();
+ return ret;
+diff --git a/security/keys/gc.c b/security/keys/gc.c
+index a42b45531aac..87632bd17b3e 100644
+--- a/security/keys/gc.c
++++ b/security/keys/gc.c
+@@ -188,12 +188,12 @@ static noinline void key_gc_unused_key(struct key *key)
+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+ atomic_dec(&key->user->nikeys);
+
+- key_user_put(key->user);
+-
+ /* now throw away the key memory */
+ if (key->type->destroy)
+ key->type->destroy(key);
+
++ key_user_put(key->user);
++
+ kfree(key->description);
+
+ #ifdef KEY_DEBUGGING
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 3068d16cf128..0a9891e7ba94 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1191,7 +1191,7 @@ static void sel_remove_entries(struct dentry *de)
+ spin_lock(&de->d_lock);
+ node = de->d_subdirs.next;
+ while (node != &de->d_subdirs) {
+- struct dentry *d = list_entry(node, struct dentry, d_u.d_child);
++ struct dentry *d = list_entry(node, struct dentry, d_child);
+
+ spin_lock_nested(&d->d_lock, DENTRY_D_LOCK_NESTED);
+ list_del_init(node);
+@@ -1694,12 +1694,12 @@ static void sel_remove_classes(void)
+
+ list_for_each(class_node, &class_dir->d_subdirs) {
+ struct dentry *class_subdir = list_entry(class_node,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+ struct list_head *class_subdir_node;
+
+ list_for_each(class_subdir_node, &class_subdir->d_subdirs) {
+ struct dentry *d = list_entry(class_subdir_node,
+- struct dentry, d_u.d_child);
++ struct dentry, d_child);
+
+ if (d->d_inode)
+ if (d->d_inode->i_mode & S_IFDIR)
+diff --git a/sound/core/seq/seq_dummy.c b/sound/core/seq/seq_dummy.c
+index dbc550716790..f60d81497f28 100644
+--- a/sound/core/seq/seq_dummy.c
++++ b/sound/core/seq/seq_dummy.c
+@@ -82,36 +82,6 @@ struct snd_seq_dummy_port {
+ static int my_client = -1;
+
+ /*
+- * unuse callback - send ALL_SOUNDS_OFF and RESET_CONTROLLERS events
+- * to subscribers.
+- * Note: this callback is called only after all subscribers are removed.
+- */
+-static int
+-dummy_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+-{
+- struct snd_seq_dummy_port *p;
+- int i;
+- struct snd_seq_event ev;
+-
+- p = private_data;
+- memset(&ev, 0, sizeof(ev));
+- if (p->duplex)
+- ev.source.port = p->connect;
+- else
+- ev.source.port = p->port;
+- ev.dest.client = SNDRV_SEQ_ADDRESS_SUBSCRIBERS;
+- ev.type = SNDRV_SEQ_EVENT_CONTROLLER;
+- for (i = 0; i < 16; i++) {
+- ev.data.control.channel = i;
+- ev.data.control.param = MIDI_CTL_ALL_SOUNDS_OFF;
+- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
+- ev.data.control.param = MIDI_CTL_RESET_CONTROLLERS;
+- snd_seq_kernel_client_dispatch(p->client, &ev, 0, 0);
+- }
+- return 0;
+-}
+-
+-/*
+ * event input callback - just redirect events to subscribers
+ */
+ static int
+@@ -175,7 +145,6 @@ create_port(int idx, int type)
+ | SNDRV_SEQ_PORT_TYPE_PORT;
+ memset(&pcb, 0, sizeof(pcb));
+ pcb.owner = THIS_MODULE;
+- pcb.unuse = dummy_unuse;
+ pcb.event_input = dummy_input;
+ pcb.private_free = dummy_free;
+ pcb.private_data = rec;
+diff --git a/sound/i2c/other/ak4113.c b/sound/i2c/other/ak4113.c
+index dde5c9c92132..e1ab3ad87adb 100644
+--- a/sound/i2c/other/ak4113.c
++++ b/sound/i2c/other/ak4113.c
+@@ -56,8 +56,7 @@ static inline unsigned char reg_read(struct ak4113 *ak4113, unsigned char reg)
+
+ static void snd_ak4113_free(struct ak4113 *chip)
+ {
+- chip->init = 1; /* don't schedule new work */
+- mb();
++ atomic_inc(&chip->wq_processing); /* don't schedule new work */
+ cancel_delayed_work_sync(&chip->work);
+ kfree(chip);
+ }
+@@ -89,6 +88,7 @@ int snd_ak4113_create(struct snd_card *card, ak4113_read_t *read,
+ chip->write = write;
+ chip->private_data = private_data;
+ INIT_DELAYED_WORK(&chip->work, ak4113_stats);
++ atomic_set(&chip->wq_processing, 0);
+
+ for (reg = 0; reg < AK4113_WRITABLE_REGS ; reg++)
+ chip->regmap[reg] = pgm[reg];
+@@ -139,13 +139,11 @@ static void ak4113_init_regs(struct ak4113 *chip)
+
+ void snd_ak4113_reinit(struct ak4113 *chip)
+ {
+- chip->init = 1;
+- mb();
+- flush_delayed_work_sync(&chip->work);
++ if (atomic_inc_return(&chip->wq_processing) == 1)
++ cancel_delayed_work_sync(&chip->work);
+ ak4113_init_regs(chip);
+ /* bring up statistics / event queing */
+- chip->init = 0;
+- if (chip->kctls[0])
++ if (atomic_dec_and_test(&chip->wq_processing))
+ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+ EXPORT_SYMBOL_GPL(snd_ak4113_reinit);
+@@ -632,8 +630,9 @@ static void ak4113_stats(struct work_struct *work)
+ {
+ struct ak4113 *chip = container_of(work, struct ak4113, work.work);
+
+- if (!chip->init)
++ if (atomic_inc_return(&chip->wq_processing) == 1)
+ snd_ak4113_check_rate_and_errors(chip, chip->check_flags);
+
+- schedule_delayed_work(&chip->work, HZ / 10);
++ if (atomic_dec_and_test(&chip->wq_processing))
++ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+diff --git a/sound/i2c/other/ak4114.c b/sound/i2c/other/ak4114.c
+index fdf3c1b65e38..4c6b37967da7 100644
+--- a/sound/i2c/other/ak4114.c
++++ b/sound/i2c/other/ak4114.c
+@@ -66,8 +66,7 @@ static void reg_dump(struct ak4114 *ak4114)
+
+ static void snd_ak4114_free(struct ak4114 *chip)
+ {
+- chip->init = 1; /* don't schedule new work */
+- mb();
++ atomic_inc(&chip->wq_processing); /* don't schedule new work */
+ cancel_delayed_work_sync(&chip->work);
+ kfree(chip);
+ }
+@@ -100,6 +99,7 @@ int snd_ak4114_create(struct snd_card *card,
+ chip->write = write;
+ chip->private_data = private_data;
+ INIT_DELAYED_WORK(&chip->work, ak4114_stats);
++ atomic_set(&chip->wq_processing, 0);
+
+ for (reg = 0; reg < 7; reg++)
+ chip->regmap[reg] = pgm[reg];
+@@ -152,13 +152,11 @@ static void ak4114_init_regs(struct ak4114 *chip)
+
+ void snd_ak4114_reinit(struct ak4114 *chip)
+ {
+- chip->init = 1;
+- mb();
+- flush_delayed_work_sync(&chip->work);
++ if (atomic_inc_return(&chip->wq_processing) == 1)
++ cancel_delayed_work_sync(&chip->work);
+ ak4114_init_regs(chip);
+ /* bring up statistics / event queing */
+- chip->init = 0;
+- if (chip->kctls[0])
++ if (atomic_dec_and_test(&chip->wq_processing))
+ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+
+@@ -612,10 +610,10 @@ static void ak4114_stats(struct work_struct *work)
+ {
+ struct ak4114 *chip = container_of(work, struct ak4114, work.work);
+
+- if (!chip->init)
++ if (atomic_inc_return(&chip->wq_processing) == 1)
+ snd_ak4114_check_rate_and_errors(chip, chip->check_flags);
+-
+- schedule_delayed_work(&chip->work, HZ / 10);
++ if (atomic_dec_and_test(&chip->wq_processing))
++ schedule_delayed_work(&chip->work, HZ / 10);
+ }
+
+ EXPORT_SYMBOL(snd_ak4114_create);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 33e538f76909..f461737e4e6c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2685,6 +2685,7 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
+ struct azx *chip;
+ int i, err;
+ unsigned short gcap;
++ unsigned int dma_bits = 64;
+ static struct snd_device_ops ops = {
+ .dev_free = azx_dev_free,
+ };
+@@ -2780,9 +2781,14 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
+ gcap = azx_readw(chip, GCAP);
+ snd_printdd(SFX "chipset global capabilities = 0x%x\n", gcap);
+
++ /* AMD devices support 40 or 48bit DMA, take the safe one */
++ if (chip->pci->vendor == PCI_VENDOR_ID_AMD)
++ dma_bits = 40;
++
+ /* disable SB600 64bit support for safety */
+ if (chip->pci->vendor == PCI_VENDOR_ID_ATI) {
+ struct pci_dev *p_smbus;
++ dma_bits = 40;
+ p_smbus = pci_get_device(PCI_VENDOR_ID_ATI,
+ PCI_DEVICE_ID_ATI_SBX00_SMBUS,
+ NULL);
+@@ -2812,9 +2818,11 @@ static int __devinit azx_create(struct snd_card *card, struct pci_dev *pci,
+ }
+
+ /* allow 64bit DMA address if supported by H/W */
+- if ((gcap & ICH6_GCAP_64OK) && !pci_set_dma_mask(pci, DMA_BIT_MASK(64)))
+- pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(64));
+- else {
++ if (!(gcap & ICH6_GCAP_64OK))
++ dma_bits = 32;
++ if (!pci_set_dma_mask(pci, DMA_BIT_MASK(dma_bits))) {
++ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(dma_bits));
++ } else {
+ pci_set_dma_mask(pci, DMA_BIT_MASK(32));
+ pci_set_consistent_dma_mask(pci, DMA_BIT_MASK(32));
+ }
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 137b67f8e69a..606f87aa24d9 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4246,9 +4246,9 @@ static void stac_store_hints(struct hda_codec *codec)
+ spec->gpio_mask;
+ }
+ if (get_int_hint(codec, "gpio_dir", &spec->gpio_dir))
+- spec->gpio_mask &= spec->gpio_mask;
+- if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
+ spec->gpio_dir &= spec->gpio_mask;
++ if (get_int_hint(codec, "gpio_data", &spec->gpio_data))
++ spec->gpio_data &= spec->gpio_mask;
+ if (get_int_hint(codec, "eapd_mask", &spec->eapd_mask))
+ spec->eapd_mask &= spec->gpio_mask;
+ if (get_int_hint(codec, "gpio_mute", &spec->gpio_mute))
+diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
+index 354341ec0f42..8d7d29c73c8a 100644
+--- a/sound/soc/atmel/atmel_ssc_dai.c
++++ b/sound/soc/atmel/atmel_ssc_dai.c
+@@ -341,7 +341,6 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ struct atmel_pcm_dma_params *dma_params;
+ int dir, channels, bits;
+ u32 tfmr, rfmr, tcmr, rcmr;
+- int start_event;
+ int ret;
+
+ /*
+@@ -460,19 +459,10 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ * The SSC transmit clock is obtained from the BCLK signal on
+ * on the TK line, and the SSC receive clock is
+ * generated from the transmit clock.
+- *
+- * For single channel data, one sample is transferred
+- * on the falling edge of the LRC clock.
+- * For two channel data, one sample is
+- * transferred on both edges of the LRC clock.
+ */
+- start_event = ((channels == 1)
+- ? SSC_START_FALLING_RF
+- : SSC_START_EDGE_RF);
+-
+ rcmr = SSC_BF(RCMR_PERIOD, 0)
+ | SSC_BF(RCMR_STTDLY, START_DELAY)
+- | SSC_BF(RCMR_START, start_event)
++ | SSC_BF(RCMR_START, SSC_START_FALLING_RF)
+ | SSC_BF(RCMR_CKI, SSC_CKI_RISING)
+ | SSC_BF(RCMR_CKO, SSC_CKO_NONE)
+ | SSC_BF(RCMR_CKS, SSC_CKS_CLOCK);
+@@ -480,14 +470,14 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ rfmr = SSC_BF(RFMR_FSEDGE, SSC_FSEDGE_POSITIVE)
+ | SSC_BF(RFMR_FSOS, SSC_FSOS_NONE)
+ | SSC_BF(RFMR_FSLEN, 0)
+- | SSC_BF(RFMR_DATNB, 0)
++ | SSC_BF(RFMR_DATNB, (channels - 1))
+ | SSC_BIT(RFMR_MSBF)
+ | SSC_BF(RFMR_LOOP, 0)
+ | SSC_BF(RFMR_DATLEN, (bits - 1));
+
+ tcmr = SSC_BF(TCMR_PERIOD, 0)
+ | SSC_BF(TCMR_STTDLY, START_DELAY)
+- | SSC_BF(TCMR_START, start_event)
++ | SSC_BF(TCMR_START, SSC_START_FALLING_RF)
+ | SSC_BF(TCMR_CKI, SSC_CKI_FALLING)
+ | SSC_BF(TCMR_CKO, SSC_CKO_NONE)
+ | SSC_BF(TCMR_CKS, SSC_CKS_PIN);
+@@ -496,7 +486,7 @@ static int atmel_ssc_hw_params(struct snd_pcm_substream *substream,
+ | SSC_BF(TFMR_FSDEN, 0)
+ | SSC_BF(TFMR_FSOS, SSC_FSOS_NONE)
+ | SSC_BF(TFMR_FSLEN, 0)
+- | SSC_BF(TFMR_DATNB, 0)
++ | SSC_BF(TFMR_DATNB, (channels - 1))
+ | SSC_BIT(TFMR_MSBF)
+ | SSC_BF(TFMR_DATDEF, 0)
+ | SSC_BF(TFMR_DATLEN, (bits - 1));
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index c40b7ca7a143..87cbf14bbdcd 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1238,6 +1238,9 @@ static int sgtl5000_enable_regulators(struct snd_soc_codec *codec)
+ /* wait for all power rails bring up */
+ udelay(10);
+
++ /* Need 8 clocks before I2C accesses */
++ udelay(1);
++
+ /* read chip information */
+ reg = snd_soc_read(codec, SGTL5000_CHIP_ID);
+ if (((reg & SGTL5000_PARTID_MASK) >> SGTL5000_PARTID_SHIFT) !=
+diff --git a/sound/soc/codecs/sigmadsp.c b/sound/soc/codecs/sigmadsp.c
+index 4068f2491232..bb3878c9625f 100644
+--- a/sound/soc/codecs/sigmadsp.c
++++ b/sound/soc/codecs/sigmadsp.c
+@@ -176,6 +176,13 @@ static int _process_sigma_firmware(struct device *dev,
+ goto done;
+ }
+
++ if (ssfw_head->version != 1) {
++ dev_err(dev,
++ "Failed to load firmware: Invalid version %d. Supported firmware versions: 1\n",
++ ssfw_head->version);
++ goto done;
++ }
++
+ crc = crc32(0, fw->data + sizeof(*ssfw_head),
+ fw->size - sizeof(*ssfw_head));
+ pr_debug("%s: crc=%x\n", __func__, crc);
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index ddb0d904a353..a09d7eb1f02f 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -496,7 +496,7 @@ static struct {
+ { 22050, 2 },
+ { 24000, 2 },
+ { 16000, 3 },
+- { 11250, 4 },
++ { 11025, 4 },
+ { 12000, 4 },
+ { 8000, 5 },
+ };
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index e5fee1800a4f..de86e7487def 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -364,6 +364,8 @@ static void snd_usbmidi_error_timer(unsigned long data)
+ if (in && in->error_resubmit) {
+ in->error_resubmit = 0;
+ for (j = 0; j < INPUT_URBS; ++j) {
++ if (atomic_read(&in->urbs[j]->use_count))
++ continue;
+ in->urbs[j]->dev = umidi->dev;
+ snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC);
+ }
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 2b67823e8205..c419aa30d544 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -834,6 +834,7 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ case USB_ID(0x046d, 0x0807): /* Logitech Webcam C500 */
+ case USB_ID(0x046d, 0x0808):
+ case USB_ID(0x046d, 0x0809):
++ case USB_ID(0x046d, 0x0819): /* Logitech Webcam C210 */
+ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 0e4e909d111e..1e0798f6539b 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -304,8 +304,11 @@ static struct usbmix_name_map hercules_usb51_map[] = {
+ { 0 } /* terminator */
+ };
+
+-static const struct usbmix_name_map kef_x300a_map[] = {
+- { 10, NULL }, /* firmware locks up (?) when we try to access this FU */
++/* some (all?) SCMS USB3318 devices are affected by a firmware lock up
++ * when anything attempts to access FU 10 (control)
++ */
++static const struct usbmix_name_map scms_usb3318_map[] = {
++ { 10, NULL },
+ { 0 }
+ };
+
+@@ -377,8 +380,14 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .ignore_ctl_error = 1,
+ },
+ {
++ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+- .map = kef_x300a_map,
++ .map = scms_usb3318_map,
++ },
++ {
++ /* Arcam rPAC */
++ .id = USB_ID(0x25c4, 0x0003),
++ .map = scms_usb3318_map,
+ },
+ { 0 } /* terminator */
+ };
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2016-12-09 23:49 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2016-12-09 23:49 UTC (permalink / raw
To: gentoo-commits
commit: aacb6d87890588e839500bcfeabb1fde7bf93e35
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 9 23:49:24 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 9 23:49:24 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=aacb6d87
Fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926.
0000_README | 8 +--
1520_fix-race-condition-in-packet-set-ring.patch | 62 ++++++++++++++++++++++++
2 files changed, 66 insertions(+), 4 deletions(-)
diff --git a/0000_README b/0000_README
index 6a446df..aa8adef 100644
--- a/0000_README
+++ b/0000_README
@@ -495,14 +495,14 @@ Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
-Patch: 1500_selinux-add-SOCK_DIAG_BY_FAMILY-to-the-list-of-netli.patch
-From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6a96e15096da6e7491107321cfa660c7c2aa119d
-Desc: selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types
-
Patch: 1512_af_key-initialize-satype-in-key_notify_policy_flush.patch
From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=85dfb745ee40232876663ae206cba35f24ab2a40
Desc: af_key: initialize satype in key_notify_policy_flush()
+Patch: 1520_fix-race-condition-in-packet-set-ring.patch
+From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c
+Desc: packet: fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926.
+
Patch: 1700_correct-bnx2-firware-ver-mips.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=424609
Desc: Correct firmware version for bnx2 on mips
diff --git a/1520_fix-race-condition-in-packet-set-ring.patch b/1520_fix-race-condition-in-packet-set-ring.patch
new file mode 100644
index 0000000..d85527f
--- /dev/null
+++ b/1520_fix-race-condition-in-packet-set-ring.patch
@@ -0,0 +1,62 @@
+--- a/net/packet/af_packet.c 2016-12-07 18:10:25.785812861 -0500
++++ b/net/packet/af_packet.c 2016-12-07 18:18:45.597933525 -0500
+@@ -3648,19 +3648,25 @@ packet_setsockopt(struct socket *sock, i
+
+ if (optlen != sizeof(val))
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+ switch (val) {
+ case TPACKET_V1:
+ case TPACKET_V2:
+ case TPACKET_V3:
+- po->tp_version = val;
+- return 0;
++ break;
+ default:
+ return -EINVAL;
+ }
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->tp_version = val;
++ ret = 0;
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_RESERVE:
+ {
+@@ -4164,6 +4170,7 @@ static int packet_set_ring(struct sock *
+ /* Added to avoid minimal code churn */
+ struct tpacket_req *req = &req_u->req;
+
++ lock_sock(sk);
+ /* Opening a Tx-ring is NOT supported in TPACKET_V3 */
+ if (!closing && tx_ring && (po->tp_version > TPACKET_V2)) {
+ net_warn_ratelimited("Tx-ring is not supported.\n");
+@@ -4245,8 +4252,6 @@ static int packet_set_ring(struct sock *
+ goto out;
+ }
+
+- lock_sock(sk);
+-
+ /* Detach socket from network */
+ spin_lock(&po->bind_lock);
+ was_running = po->running;
+@@ -4294,11 +4299,11 @@ static int packet_set_ring(struct sock *
+ if (!tx_ring)
+ prb_shutdown_retire_blk_timer(po, rb_queue);
+ }
+- release_sock(sk);
+
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
++ release_sock(sk);
+ return err;
+ }
+
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2016-11-01 11:58 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2016-11-01 11:58 UTC (permalink / raw
To: gentoo-commits
commit: faca600326e872a08745525a8c3dd15f0fbdc517
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 1 11:57:06 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 1 11:57:06 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=faca6003
Linux patch 3.4.113
0000_README | 4 +
1112_linux-3.4.113.patch | 4341 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4345 insertions(+)
diff --git a/0000_README b/0000_README
index 2dee9b4..6a446df 100644
--- a/0000_README
+++ b/0000_README
@@ -487,6 +487,10 @@ Patch: 1111_linux-3.4.112.patch
From: http://www.kernel.org
Desc: Linux 3.4.112
+Patch: 1112_linux-3.4.113.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.113
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1112_linux-3.4.113.patch b/1112_linux-3.4.113.patch
new file mode 100644
index 0000000..938581a
--- /dev/null
+++ b/1112_linux-3.4.113.patch
@@ -0,0 +1,4341 @@
+diff --git a/Makefile b/Makefile
+index c63e1836d738..564196d5d89a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 112
++SUBLEVEL = 113
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mach-pxa/include/mach/pxa27x.h b/arch/arm/mach-pxa/include/mach/pxa27x.h
+index 7cff640582b8..66c4cbfc7f36 100644
+--- a/arch/arm/mach-pxa/include/mach/pxa27x.h
++++ b/arch/arm/mach-pxa/include/mach/pxa27x.h
+@@ -21,7 +21,7 @@
+
+ extern void __init pxa27x_map_io(void);
+ extern void __init pxa27x_init_irq(void);
+-extern int __init pxa27x_set_pwrmode(unsigned int mode);
++extern int pxa27x_set_pwrmode(unsigned int mode);
+ extern void pxa27x_cpu_pm_enter(suspend_state_t state);
+
+ #define pxa27x_handle_irq ichp_handle_irq
+diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
+index a2fe795bae14..f7c997822cff 100644
+--- a/arch/arm/mach-pxa/pxa27x.c
++++ b/arch/arm/mach-pxa/pxa27x.c
+@@ -242,7 +242,7 @@ static struct clk_lookup pxa27x_clkregs[] = {
+ */
+ static unsigned int pwrmode = PWRMODE_SLEEP;
+
+-int __init pxa27x_set_pwrmode(unsigned int mode)
++int pxa27x_set_pwrmode(unsigned int mode)
+ {
+ switch (mode) {
+ case PWRMODE_SLEEP:
+diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S
+index fb489cc56713..74c3e53092e7 100644
+--- a/arch/arm/mm/proc-v7.S
++++ b/arch/arm/mm/proc-v7.S
+@@ -94,7 +94,7 @@ ENDPROC(cpu_v7_dcache_clean_area)
+ .equ cpu_v7_suspend_size, 4 * 8
+ #ifdef CONFIG_ARM_CPU_SUSPEND
+ ENTRY(cpu_v7_do_suspend)
+- stmfd sp!, {r4 - r10, lr}
++ stmfd sp!, {r4 - r11, lr}
+ mrc p15, 0, r4, c13, c0, 0 @ FCSE/PID
+ mrc p15, 0, r5, c13, c0, 3 @ User r/o thread ID
+ stmia r0!, {r4 - r5}
+@@ -105,7 +105,7 @@ ENTRY(cpu_v7_do_suspend)
+ mrc p15, 0, r9, c1, c0, 1 @ Auxiliary control register
+ mrc p15, 0, r10, c1, c0, 2 @ Co-processor access control
+ stmia r0, {r6 - r11}
+- ldmfd sp!, {r4 - r10, pc}
++ ldmfd sp!, {r4 - r11, pc}
+ ENDPROC(cpu_v7_do_suspend)
+
+ ENTRY(cpu_v7_do_resume)
+diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
+index 3f4c5cb6433e..939a6b76810b 100644
+--- a/arch/mips/include/asm/atomic.h
++++ b/arch/mips/include/asm/atomic.h
+@@ -679,7 +679,7 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
+ * @u: ...unless v is equal to u.
+ *
+ * Atomically adds @a to @v, so long as it was not @u.
+- * Returns the old value of @v.
++ * Returns true iff @v was not @u.
+ */
+ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u)
+ {
+diff --git a/arch/parisc/kernel/signal.c b/arch/parisc/kernel/signal.c
+index 12c1ed33dc18..c6268551b910 100644
+--- a/arch/parisc/kernel/signal.c
++++ b/arch/parisc/kernel/signal.c
+@@ -468,6 +468,55 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
+ return 1;
+ }
+
++/*
++ * Check how the syscall number gets loaded into %r20 within
++ * the delay branch in userspace and adjust as needed.
++ */
++
++static void check_syscallno_in_delay_branch(struct pt_regs *regs)
++{
++ u32 opcode, source_reg;
++ u32 __user *uaddr;
++ int err;
++
++ /* Usually we don't have to restore %r20 (the system call number)
++ * because it gets loaded in the delay slot of the branch external
++ * instruction via the ldi instruction.
++ * In some cases a register-to-register copy instruction might have
++ * been used instead, in which case we need to copy the syscall
++ * number into the source register before returning to userspace.
++ */
++
++ /* A syscall is just a branch, so all we have to do is fiddle the
++ * return pointer so that the ble instruction gets executed again.
++ */
++ regs->gr[31] -= 8; /* delayed branching */
++
++ /* Get assembler opcode of code in delay branch */
++ uaddr = (unsigned int *) ((regs->gr[31] & ~3) + 4);
++ err = get_user(opcode, uaddr);
++ if (err)
++ return;
++
++ /* Check if delay branch uses "ldi int,%r20" */
++ if ((opcode & 0xffff0000) == 0x34140000)
++ return; /* everything ok, just return */
++
++ /* Check if delay branch uses "nop" */
++ if (opcode == INSN_NOP)
++ return;
++
++ /* Check if delay branch uses "copy %rX,%r20" */
++ if ((opcode & 0xffe0ffff) == 0x08000254) {
++ source_reg = (opcode >> 16) & 31;
++ regs->gr[source_reg] = regs->gr[20];
++ return;
++ }
++
++ pr_warn("syscall restart: %s (pid %d): unexpected opcode 0x%08x\n",
++ current->comm, task_pid_nr(current), opcode);
++}
++
+ static inline void
+ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
+ {
+@@ -489,10 +538,7 @@ syscall_restart(struct pt_regs *regs, struct k_sigaction *ka)
+ }
+ /* fallthrough */
+ case -ERESTARTNOINTR:
+- /* A syscall is just a branch, so all
+- * we have to do is fiddle the return pointer.
+- */
+- regs->gr[31] -= 8; /* delayed branching */
++ check_syscallno_in_delay_branch(regs);
+ /* Preserve original r28. */
+ regs->gr[28] = regs->orig_r28;
+ break;
+@@ -543,18 +589,9 @@ insert_restart_trampoline(struct pt_regs *regs)
+ }
+ case -ERESTARTNOHAND:
+ case -ERESTARTSYS:
+- case -ERESTARTNOINTR: {
+- /* Hooray for delayed branching. We don't
+- * have to restore %r20 (the system call
+- * number) because it gets loaded in the delay
+- * slot of the branch external instruction.
+- */
+- regs->gr[31] -= 8;
+- /* Preserve original r28. */
+- regs->gr[28] = regs->orig_r28;
+-
++ case -ERESTARTNOINTR:
++ check_syscallno_in_delay_branch(regs);
+ return;
+- }
+ default:
+ break;
+ }
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index 40f4eb3766d1..59d0eac26132 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -45,6 +45,9 @@ L3_START_KERNEL = pud_index(__START_KERNEL_map)
+ .globl startup_64
+ startup_64:
+
++ /* Sanitize CPU configuration */
++ call verify_cpu
++
+ /*
+ * At this point the CPU runs in 64bit mode CS.L = 1 CS.D = 1,
+ * and someone has loaded an identity mapped page table
+@@ -160,6 +163,9 @@ ENTRY(secondary_startup_64)
+ * after the boot processor executes this code.
+ */
+
++ /* Sanitize CPU configuration */
++ call verify_cpu
++
+ /* Enable PAE mode and PGE */
+ movl $(X86_CR4_PAE | X86_CR4_PGE), %eax
+ movq %rax, %cr4
+@@ -253,6 +259,8 @@ ENTRY(secondary_startup_64)
+ pushq %rax # target address in negative space
+ lretq
+
++#include "verify_cpu.S"
++
+ /* SMP bootup changes these two */
+ __REFDATA
+ .align 8
+diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
+index 115eac431483..b2952cac860f 100644
+--- a/arch/x86/kernel/signal.c
++++ b/arch/x86/kernel/signal.c
+@@ -748,12 +748,15 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
+ return 0;
+ }
+
+-#ifdef CONFIG_X86_32
+-#define NR_restart_syscall __NR_restart_syscall
+-#else /* !CONFIG_X86_32 */
+-#define NR_restart_syscall \
+- test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall : __NR_restart_syscall
+-#endif /* CONFIG_X86_32 */
++static inline unsigned long get_nr_restart_syscall(const struct pt_regs *regs)
++{
++#if defined(CONFIG_X86_32) || !defined(CONFIG_X86_64)
++ return __NR_restart_syscall;
++#else /* !CONFIG_X86_32 && CONFIG_X86_64 */
++ return test_thread_flag(TIF_IA32) ? __NR_ia32_restart_syscall :
++ __NR_restart_syscall | (regs->orig_ax & __X32_SYSCALL_BIT);
++#endif /* CONFIG_X86_32 || !CONFIG_X86_64 */
++}
+
+ /*
+ * Note that 'init' is a special process: it doesn't get signals it doesn't
+@@ -795,7 +798,7 @@ static void do_signal(struct pt_regs *regs)
+ break;
+
+ case -ERESTART_RESTARTBLOCK:
+- regs->ax = NR_restart_syscall;
++ regs->ax = get_nr_restart_syscall(regs);
+ regs->ip -= 2;
+ break;
+ }
+diff --git a/arch/x86/kernel/verify_cpu.S b/arch/x86/kernel/verify_cpu.S
+index b9242bacbe59..4cf401f581e7 100644
+--- a/arch/x86/kernel/verify_cpu.S
++++ b/arch/x86/kernel/verify_cpu.S
+@@ -34,10 +34,11 @@
+ #include <asm/msr-index.h>
+
+ verify_cpu:
+- pushfl # Save caller passed flags
+- pushl $0 # Kill any dangerous flags
+- popfl
++ pushf # Save caller passed flags
++ push $0 # Kill any dangerous flags
++ popf
+
++#ifndef __x86_64__
+ pushfl # standard way to check for cpuid
+ popl %eax
+ movl %eax,%ebx
+@@ -48,6 +49,7 @@ verify_cpu:
+ popl %eax
+ cmpl %eax,%ebx
+ jz verify_cpu_no_longmode # cpu has no cpuid
++#endif
+
+ movl $0x0,%eax # See if cpuid 1 is implemented
+ cpuid
+@@ -130,10 +132,10 @@ verify_cpu_sse_test:
+ jmp verify_cpu_sse_test # try again
+
+ verify_cpu_no_longmode:
+- popfl # Restore caller passed flags
++ popf # Restore caller passed flags
+ movl $1,%eax
+ ret
+ verify_cpu_sse_ok:
+- popfl # Restore caller passed flags
++ popf # Restore caller passed flags
+ xorl %eax, %eax
+ ret
+diff --git a/block/partitions/mac.c b/block/partitions/mac.c
+index 11f688bd76c5..f51c9305d1e1 100644
+--- a/block/partitions/mac.c
++++ b/block/partitions/mac.c
+@@ -32,7 +32,7 @@ int mac_partition(struct parsed_partitions *state)
+ Sector sect;
+ unsigned char *data;
+ int slot, blocks_in_map;
+- unsigned secsize;
++ unsigned secsize, datasize, partoffset;
+ #ifdef CONFIG_PPC_PMAC
+ int found_root = 0;
+ int found_root_goodness = 0;
+@@ -50,10 +50,14 @@ int mac_partition(struct parsed_partitions *state)
+ }
+ secsize = be16_to_cpu(md->block_size);
+ put_dev_sector(sect);
+- data = read_part_sector(state, secsize/512, §);
++ datasize = round_down(secsize, 512);
++ data = read_part_sector(state, datasize / 512, §);
+ if (!data)
+ return -1;
+- part = (struct mac_partition *) (data + secsize%512);
++ partoffset = secsize % 512;
++ if (partoffset + sizeof(*part) > datasize)
++ return -1;
++ part = (struct mac_partition *) (data + partoffset);
+ if (be16_to_cpu(part->signature) != MAC_PARTITION_MAGIC) {
+ put_dev_sector(sect);
+ return 0; /* not a MacOS disk */
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index 4a9c499ea78a..1ef14284d09e 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -280,12 +280,12 @@ static int ablkcipher_walk_first(struct ablkcipher_request *req,
+ if (WARN_ON_ONCE(in_irq()))
+ return -EDEADLK;
+
++ walk->iv = req->info;
+ walk->nbytes = walk->total;
+ if (unlikely(!walk->total))
+ return 0;
+
+ walk->iv_buffer = NULL;
+- walk->iv = req->info;
+ if (unlikely(((unsigned long)walk->iv & alignmask))) {
+ int err = ablkcipher_copy_iv(walk, tfm, alignmask);
+ if (err)
+diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c
+index 850246206b12..a68b56a368a8 100644
+--- a/crypto/algif_hash.c
++++ b/crypto/algif_hash.c
+@@ -192,9 +192,14 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
+ struct sock *sk2;
+ struct alg_sock *ask2;
+ struct hash_ctx *ctx2;
++ bool more;
+ int err;
+
+- err = crypto_ahash_export(req, state);
++ lock_sock(sk);
++ more = ctx->more;
++ err = more ? crypto_ahash_export(req, state) : 0;
++ release_sock(sk);
++
+ if (err)
+ return err;
+
+@@ -205,7 +210,10 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags)
+ sk2 = newsock->sk;
+ ask2 = alg_sk(sk2);
+ ctx2 = ask2->private;
+- ctx2->more = 1;
++ ctx2->more = more;
++
++ if (!more)
++ return err;
+
+ err = crypto_ahash_import(&ctx2->req, state);
+ if (err) {
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index 0a1ebea3d6fc..34e5d6507e54 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -329,12 +329,12 @@ static int blkcipher_walk_first(struct blkcipher_desc *desc,
+ if (WARN_ON_ONCE(in_irq()))
+ return -EDEADLK;
+
++ walk->iv = desc->info;
+ walk->nbytes = walk->total;
+ if (unlikely(!walk->total))
+ return 0;
+
+ walk->buffer = NULL;
+- walk->iv = desc->info;
+ if (unlikely(((unsigned long)walk->iv & alignmask))) {
+ int err = blkcipher_copy_iv(walk, tfm, alignmask);
+ if (err)
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index f48720cf96ff..2788c155cd0d 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -85,6 +85,7 @@ static void *acpi_irq_context;
+ static struct workqueue_struct *kacpid_wq;
+ static struct workqueue_struct *kacpi_notify_wq;
+ struct workqueue_struct *kacpi_hotplug_wq;
++unsigned int acpi_sci_irq = INVALID_ACPI_IRQ;
+ EXPORT_SYMBOL(kacpi_hotplug_wq);
+
+ /*
+@@ -612,17 +613,19 @@ acpi_os_install_interrupt_handler(u32 gsi, acpi_osd_handler handler,
+ acpi_irq_handler = NULL;
+ return AE_NOT_ACQUIRED;
+ }
++ acpi_sci_irq = irq;
+
+ return AE_OK;
+ }
+
+-acpi_status acpi_os_remove_interrupt_handler(u32 irq, acpi_osd_handler handler)
++acpi_status acpi_os_remove_interrupt_handler(u32 gsi, acpi_osd_handler handler)
+ {
+- if (irq != acpi_gbl_FADT.sci_interrupt)
++ if (gsi != acpi_gbl_FADT.sci_interrupt || !acpi_sci_irq_valid())
+ return AE_BAD_PARAMETER;
+
+- free_irq(irq, acpi_irq);
++ free_irq(acpi_sci_irq, acpi_irq);
+ acpi_irq_handler = NULL;
++ acpi_sci_irq = INVALID_ACPI_IRQ;
+
+ return AE_OK;
+ }
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 30cdba79d7ae..1f0db2c542e2 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1228,6 +1228,15 @@ static int ahci_exec_polled_cmd(struct ata_port *ap, int pmp,
+ ata_tf_to_fis(tf, pmp, is_cmd, fis);
+ ahci_fill_cmd_slot(pp, 0, cmd_fis_len | flags | (pmp << 12));
+
++ /* set port value for softreset of Port Multiplier */
++ if (pp->fbs_enabled && pp->fbs_last_dev != pmp) {
++ tmp = readl(port_mmio + PORT_FBS);
++ tmp &= ~(PORT_FBS_DEV_MASK | PORT_FBS_DEC);
++ tmp |= pmp << PORT_FBS_DEV_OFFSET;
++ writel(tmp, port_mmio + PORT_FBS);
++ pp->fbs_last_dev = pmp;
++ }
++
+ /* issue & wait */
+ writel(1, port_mmio + PORT_CMD_ISSUE);
+
+diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
+index 0c4ed89b6aa5..7f0c7f068030 100644
+--- a/drivers/ata/sata_sil.c
++++ b/drivers/ata/sata_sil.c
+@@ -631,6 +631,9 @@ static void sil_dev_config(struct ata_device *dev)
+ unsigned int n, quirks = 0;
+ unsigned char model_num[ATA_ID_PROD_LEN + 1];
+
++ /* This controller doesn't support trim */
++ dev->horkage |= ATA_HORKAGE_NOTRIM;
++
+ ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));
+
+ for (n = 0; sil_blacklist[n].product; n++)
+diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
+index 933adc5a2637..47e5b6509682 100644
+--- a/drivers/block/xen-blkback/common.h
++++ b/drivers/block/xen-blkback/common.h
+@@ -256,8 +256,8 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
+ struct blkif_x86_32_request *src)
+ {
+ int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
+- dst->operation = src->operation;
+- switch (src->operation) {
++ dst->operation = ACCESS_ONCE(src->operation);
++ switch (dst->operation) {
+ case BLKIF_OP_READ:
+ case BLKIF_OP_WRITE:
+ case BLKIF_OP_WRITE_BARRIER:
+@@ -292,8 +292,8 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
+ struct blkif_x86_64_request *src)
+ {
+ int i, n = BLKIF_MAX_SEGMENTS_PER_REQUEST;
+- dst->operation = src->operation;
+- switch (src->operation) {
++ dst->operation = ACCESS_ONCE(src->operation);
++ switch (dst->operation) {
+ case BLKIF_OP_READ:
+ case BLKIF_OP_WRITE:
+ case BLKIF_OP_WRITE_BARRIER:
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 4b8e03fc3281..8ff6f5c21852 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -94,6 +94,7 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x0CF3, 0x311D) },
+ { USB_DEVICE(0x0cf3, 0x3121) },
+ { USB_DEVICE(0x0CF3, 0x817a) },
++ { USB_DEVICE(0x0CF3, 0x817b) },
+ { USB_DEVICE(0x0cf3, 0xe003) },
+ { USB_DEVICE(0x0CF3, 0xE004) },
+ { USB_DEVICE(0x0CF3, 0xE005) },
+@@ -144,6 +145,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0CF3, 0x817b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index bbd1e6c7a4e9..2302075cb5ca 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -172,6 +172,7 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
+index c1de4c3a3fe7..4eedb0781912 100644
+--- a/drivers/firewire/ohci.c
++++ b/drivers/firewire/ohci.c
+@@ -3620,6 +3620,11 @@ static int __devinit pci_probe(struct pci_dev *dev,
+
+ reg_write(ohci, OHCI1394_IsoXmitIntMaskSet, ~0);
+ ohci->it_context_support = reg_read(ohci, OHCI1394_IsoXmitIntMaskSet);
++ /* JMicron JMB38x often shows 0 at first read, just ignore it */
++ if (!ohci->it_context_support) {
++ dev_notice(&dev->dev, "overriding IsoXmitIntMask\n");
++ ohci->it_context_support = 0xf;
++ }
+ reg_write(ohci, OHCI1394_IsoXmitIntMaskClear, ~0);
+ ohci->it_context_mask = ohci->it_context_support;
+ ohci->n_it = hweight32(ohci->it_context_mask);
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 77c456d624bf..afd1cc14b26c 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -51,6 +51,11 @@ static void radeon_hotplug_work_func(struct work_struct *work)
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ /* we can race here at startup, some boards seem to trigger
++ * hotplug irqs when they shouldn't. */
++ if (!rdev->mode_info.mode_config_initialized)
++ return;
++
+ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
+diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
+index 111d956d8e7d..6a46d6e3377b 100644
+--- a/drivers/gpu/vga/vgaarb.c
++++ b/drivers/gpu/vga/vgaarb.c
+@@ -381,8 +381,10 @@ int vga_get(struct pci_dev *pdev, unsigned int rsrc, int interruptible)
+ set_current_state(interruptible ?
+ TASK_INTERRUPTIBLE :
+ TASK_UNINTERRUPTIBLE);
+- if (signal_pending(current)) {
+- rc = -EINTR;
++ if (interruptible && signal_pending(current)) {
++ __set_current_state(TASK_RUNNING);
++ remove_wait_queue(&vga_wait_queue, &wait);
++ rc = -ERESTARTSYS;
+ break;
+ }
+ schedule();
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 75fa2e7b87b5..b8ad132bc220 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1301,7 +1301,7 @@ int hid_connect(struct hid_device *hdev, unsigned int connect_mask)
+ "Multi-Axis Controller"
+ };
+ const char *type, *bus;
+- char buf[64];
++ char buf[64] = "";
+ unsigned int i;
+ int len;
+ int ret;
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index bd400f2a8d26..99e4974fe699 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3586,10 +3586,15 @@ found:
+ for (bus = dev->bus; bus; bus = bus->parent) {
+ struct pci_dev *bridge = bus->self;
+
+- if (!bridge || !pci_is_pcie(bridge) ||
++ /* If it's an integrated device, allow ATS */
++ if (!bridge)
++ return 1;
++ /* Connected via non-PCIe: no ATS */
++ if (!pci_is_pcie(bridge) ||
+ bridge->pcie_type == PCI_EXP_TYPE_PCI_BRIDGE)
+ return 0;
+
++ /* If we found the root port, look it up in the ATSR */
+ if (bridge->pcie_type == PCI_EXP_TYPE_ROOT_PORT) {
+ for (i = 0; i < atsru->devices_cnt; i++)
+ if (atsru->devices[i] == bridge)
+diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
+index 6f3fd4cf4378..39119914e185 100644
+--- a/drivers/isdn/gigaset/ser-gigaset.c
++++ b/drivers/isdn/gigaset/ser-gigaset.c
+@@ -371,19 +371,12 @@ static void gigaset_freecshw(struct cardstate *cs)
+ tasklet_kill(&cs->write_tasklet);
+ if (!cs->hw.ser)
+ return;
+- dev_set_drvdata(&cs->hw.ser->dev.dev, NULL);
+ platform_device_unregister(&cs->hw.ser->dev);
+- kfree(cs->hw.ser);
+- cs->hw.ser = NULL;
+ }
+
+ static void gigaset_device_release(struct device *dev)
+ {
+- struct platform_device *pdev = to_platform_device(dev);
+-
+- /* adapted from platform_device_release() in drivers/base/platform.c */
+- kfree(dev->platform_data);
+- kfree(pdev->resource);
++ kfree(container_of(dev, struct ser_cardstate, dev.dev));
+ }
+
+ /*
+@@ -412,7 +405,6 @@ static int gigaset_initcshw(struct cardstate *cs)
+ cs->hw.ser = NULL;
+ return 0;
+ }
+- dev_set_drvdata(&cs->hw.ser->dev.dev, cs);
+
+ tasklet_init(&cs->write_tasklet,
+ gigaset_modem_fill, (unsigned long) cs);
+diff --git a/drivers/isdn/hardware/mISDN/mISDNipac.c b/drivers/isdn/hardware/mISDN/mISDNipac.c
+index 884369f09cad..c0b787b3336c 100644
+--- a/drivers/isdn/hardware/mISDN/mISDNipac.c
++++ b/drivers/isdn/hardware/mISDN/mISDNipac.c
+@@ -1156,7 +1156,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
+
+ if (ipac->type & IPAC_TYPE_IPACX) {
+ ista = ReadIPAC(ipac, ISACX_ISTA);
+- while (ista && cnt--) {
++ while (ista && --cnt) {
+ pr_debug("%s: ISTA %02x\n", ipac->name, ista);
+ if (ista & IPACX__ICA)
+ ipac_irq(&ipac->hscx[0], ista);
+@@ -1168,7 +1168,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
+ }
+ } else if (ipac->type & IPAC_TYPE_IPAC) {
+ ista = ReadIPAC(ipac, IPAC_ISTA);
+- while (ista && cnt--) {
++ while (ista && --cnt) {
+ pr_debug("%s: ISTA %02x\n", ipac->name, ista);
+ if (ista & (IPAC__ICD | IPAC__EXD)) {
+ istad = ReadISAC(isac, ISAC_ISTA);
+@@ -1186,7 +1186,7 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
+ ista = ReadIPAC(ipac, IPAC_ISTA);
+ }
+ } else if (ipac->type & IPAC_TYPE_HSCX) {
+- while (cnt) {
++ while (--cnt) {
+ ista = ReadIPAC(ipac, IPAC_ISTAB + ipac->hscx[1].off);
+ pr_debug("%s: B2 ISTA %02x\n", ipac->name, ista);
+ if (ista)
+@@ -1197,7 +1197,6 @@ mISDNipac_irq(struct ipac_hw *ipac, int maxloop)
+ mISDNisac_irq(isac, istad);
+ if (0 == (ista | istad))
+ break;
+- cnt--;
+ }
+ }
+ if (cnt > maxloop) /* only for ISAC/HSCX without PCI IRQ test */
+diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c
+index d5fc3ec3639e..a0b28eee8270 100644
+--- a/drivers/md/dm-mpath.c
++++ b/drivers/md/dm-mpath.c
+@@ -1553,11 +1553,8 @@ static int multipath_ioctl(struct dm_target *ti, unsigned int cmd,
+ /*
+ * Only pass ioctls through if the device sizes match exactly.
+ */
+- if (!bdev || ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT) {
+- int err = scsi_verify_blk_ioctl(NULL, cmd);
+- if (err)
+- r = err;
+- }
++ if (!r && ti->len != i_size_read(bdev->bd_inode) >> SECTOR_SHIFT)
++ r = scsi_verify_blk_ioctl(NULL, cmd);
+
+ return r ? : __blkdev_driver_ioctl(bdev, mode, cmd, arg);
+ }
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index be86d59eaa90..c948acfba43c 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -230,6 +230,16 @@ static void pop_frame(struct del_stack *s)
+ dm_tm_unlock(s->tm, f->b);
+ }
+
++static void unlock_all_frames(struct del_stack *s)
++{
++ struct frame *f;
++
++ while (unprocessed_frames(s)) {
++ f = s->spine + s->top--;
++ dm_tm_unlock(s->tm, f->b);
++ }
++}
++
+ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
+ {
+ int r;
+@@ -285,9 +295,13 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
+ f->current_child = f->nr_children;
+ }
+ }
+-
+ out:
++ if (r) {
++ /* cleanup all frames of del_stack */
++ unlock_all_frames(s);
++ }
+ kfree(s);
++
+ return r;
+ }
+ EXPORT_SYMBOL_GPL(dm_btree_del);
+@@ -450,8 +464,10 @@ static int btree_split_sibling(struct shadow_spine *s, dm_block_t root,
+
+ r = insert_at(sizeof(__le64), pn, parent_index + 1,
+ le64_to_cpu(rn->keys[0]), &location);
+- if (r)
++ if (r) {
++ unlock_block(s->info, right);
+ return r;
++ }
+
+ if (key < le64_to_cpu(rn->keys[0])) {
+ unlock_block(s->info, right);
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index a548eed38937..a4d994f0cea4 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1272,11 +1272,8 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ set_bit(Blocked, &rdev->flags);
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (test_and_clear_bit(In_sync, &rdev->flags)) {
+- unsigned long flags;
+- spin_lock_irqsave(&conf->device_lock, flags);
+ mddev->degraded++;
+ set_bit(Faulty, &rdev->flags);
+- spin_unlock_irqrestore(&conf->device_lock, flags);
+ /*
+ * if recovery is running, make sure it aborts.
+ */
+diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
+index bf24aa77175d..1c96f3d08c34 100644
+--- a/drivers/mtd/mtdpart.c
++++ b/drivers/mtd/mtdpart.c
+@@ -632,8 +632,10 @@ int add_mtd_partitions(struct mtd_info *master,
+
+ for (i = 0; i < nbparts; i++) {
+ slave = allocate_partition(master, parts + i, i, cur_offset);
+- if (IS_ERR(slave))
++ if (IS_ERR(slave)) {
++ del_mtd_partitions(master);
+ return PTR_ERR(slave);
++ }
+
+ mutex_lock(&mtd_partitions_mutex);
+ list_add(&slave->list, &mtd_partitions);
+diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
+index 2d3ad72958ff..18244862dfbf 100644
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -177,6 +177,9 @@ static void sja1000_start(struct net_device *dev)
+ priv->write_reg(priv, REG_RXERR, 0x0);
+ priv->read_reg(priv, REG_ECC);
+
++ /* clear interrupt flags */
++ priv->read_reg(priv, REG_IR);
++
+ /* leave reset mode */
+ set_normal_mode(dev);
+ }
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 16caebaec007..53f5a96e99c3 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1513,8 +1513,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+ txdesc = &mdp->tx_ring[entry];
+ /* soft swap. */
+ if (!mdp->cd->hw_swap)
+- sh_eth_soft_swap(phys_to_virt(ALIGN(txdesc->addr, 4)),
+- skb->len + 2);
++ sh_eth_soft_swap(PTR_ALIGN(skb->data, 4), skb->len + 2);
+ txdesc->addr = dma_map_single(&ndev->dev, skb->data, skb->len,
+ DMA_TO_DEVICE);
+ if (skb->len < ETHERSMALL)
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 6749acf6f3f4..e7352399b1fa 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -173,6 +173,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ skb = ip_check_defrag(skb, IP_DEFRAG_MACVLAN);
+ if (!skb)
+ return RX_HANDLER_CONSUMED;
++ *pskb = skb;
+ eth = eth_hdr(skb);
+ src = macvlan_hash_lookup(port, eth->h_source);
+ if (!src)
+@@ -222,6 +223,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ if (!skb)
+ goto out;
+
++ *pskb = skb;
+ skb->dev = dev;
+ skb->pkt_type = PACKET_HOST;
+
+diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c
+index 60338ff63092..5b45369a0878 100644
+--- a/drivers/net/phy/broadcom.c
++++ b/drivers/net/phy/broadcom.c
+@@ -933,7 +933,7 @@ static struct mdio_device_id __maybe_unused broadcom_tbl[] = {
+ { PHY_ID_BCM5421, 0xfffffff0 },
+ { PHY_ID_BCM5461, 0xfffffff0 },
+ { PHY_ID_BCM5464, 0xfffffff0 },
+- { PHY_ID_BCM5482, 0xfffffff0 },
++ { PHY_ID_BCM5481, 0xfffffff0 },
+ { PHY_ID_BCM5482, 0xfffffff0 },
+ { PHY_ID_BCM50610, 0xfffffff0 },
+ { PHY_ID_BCM50610M, 0xfffffff0 },
+diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
+index d7a65e141d1a..dadf08512273 100644
+--- a/drivers/net/wan/x25_asy.c
++++ b/drivers/net/wan/x25_asy.c
+@@ -546,16 +546,12 @@ static void x25_asy_receive_buf(struct tty_struct *tty,
+
+ static int x25_asy_open_tty(struct tty_struct *tty)
+ {
+- struct x25_asy *sl = tty->disc_data;
++ struct x25_asy *sl;
+ int err;
+
+ if (tty->ops->write == NULL)
+ return -EOPNOTSUPP;
+
+- /* First make sure we're not already connected. */
+- if (sl && sl->magic == X25_ASY_MAGIC)
+- return -EEXIST;
+-
+ /* OK. Find a free X.25 channel to use. */
+ sl = x25_asy_alloc();
+ if (sl == NULL)
+diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c
+index 1a845074c52a..e24ef9a4228d 100644
+--- a/drivers/net/wireless/mwifiex/debugfs.c
++++ b/drivers/net/wireless/mwifiex/debugfs.c
+@@ -621,7 +621,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf,
+ (struct mwifiex_private *) file->private_data;
+ unsigned long addr = get_zeroed_page(GFP_KERNEL);
+ char *buf = (char *) addr;
+- int pos = 0, ret = 0, i;
++ int pos, ret, i;
+ u8 value[MAX_EEPROM_DATA];
+
+ if (!buf)
+@@ -629,7 +629,7 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf,
+
+ if (saved_offset == -1) {
+ /* No command has been given */
+- pos += snprintf(buf, PAGE_SIZE, "0");
++ pos = snprintf(buf, PAGE_SIZE, "0");
+ goto done;
+ }
+
+@@ -638,17 +638,17 @@ mwifiex_rdeeprom_read(struct file *file, char __user *ubuf,
+ (u16) saved_bytes, value);
+ if (ret) {
+ ret = -EINVAL;
+- goto done;
++ goto out_free;
+ }
+
+- pos += snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes);
++ pos = snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes);
+
+ for (i = 0; i < saved_bytes; i++)
+- pos += snprintf(buf + strlen(buf), PAGE_SIZE, "%d ", value[i]);
+-
+- ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos);
++ pos += scnprintf(buf + pos, PAGE_SIZE - pos, "%d ", value[i]);
+
+ done:
++ ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos);
++out_free:
+ free_page(addr);
+ return ret;
+ }
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index cd4966bcb2d2..37bcc560210e 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -398,17 +398,17 @@ static struct netbk_rx_meta *get_next_rx_buffer(struct xenvif *vif,
+ struct netrx_pending_operations *npo)
+ {
+ struct netbk_rx_meta *meta;
+- struct xen_netif_rx_request *req;
++ struct xen_netif_rx_request req;
+
+- req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
++ RING_COPY_REQUEST(&vif->rx, vif->rx.req_cons++, &req);
+
+ meta = npo->meta + npo->meta_prod++;
+ meta->gso_size = 0;
+ meta->size = 0;
+- meta->id = req->id;
++ meta->id = req.id;
+
+ npo->copy_off = 0;
+- npo->copy_gref = req->gref;
++ npo->copy_gref = req.gref;
+
+ return meta;
+ }
+@@ -510,7 +510,7 @@ static int netbk_gop_skb(struct sk_buff *skb,
+ struct xenvif *vif = netdev_priv(skb->dev);
+ int nr_frags = skb_shinfo(skb)->nr_frags;
+ int i;
+- struct xen_netif_rx_request *req;
++ struct xen_netif_rx_request req;
+ struct netbk_rx_meta *meta;
+ unsigned char *data;
+ int head = 1;
+@@ -520,14 +520,14 @@ static int netbk_gop_skb(struct sk_buff *skb,
+
+ /* Set up a GSO prefix descriptor, if necessary */
+ if (skb_shinfo(skb)->gso_size && vif->gso_prefix) {
+- req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
++ RING_COPY_REQUEST(&vif->rx, vif->rx.req_cons++, &req);
+ meta = npo->meta + npo->meta_prod++;
+ meta->gso_size = skb_shinfo(skb)->gso_size;
+ meta->size = 0;
+- meta->id = req->id;
++ meta->id = req.id;
+ }
+
+- req = RING_GET_REQUEST(&vif->rx, vif->rx.req_cons++);
++ RING_COPY_REQUEST(&vif->rx, vif->rx.req_cons++, &req);
+ meta = npo->meta + npo->meta_prod++;
+
+ if (!vif->gso_prefix)
+@@ -536,9 +536,9 @@ static int netbk_gop_skb(struct sk_buff *skb,
+ meta->gso_size = 0;
+
+ meta->size = 0;
+- meta->id = req->id;
++ meta->id = req.id;
+ npo->copy_off = 0;
+- npo->copy_gref = req->gref;
++ npo->copy_gref = req.gref;
+
+ data = skb->data;
+ while (data < skb_tail_pointer(skb)) {
+@@ -856,9 +856,7 @@ static void tx_add_credit(struct xenvif *vif)
+ * Allow a burst big enough to transmit a jumbo packet of up to 128kB.
+ * Otherwise the interface can seize up due to insufficient credit.
+ */
+- max_burst = RING_GET_REQUEST(&vif->tx, vif->tx.req_cons)->size;
+- max_burst = min(max_burst, 131072UL);
+- max_burst = max(max_burst, vif->credit_bytes);
++ max_burst = max(131072UL, vif->credit_bytes);
+
+ /* Take care that adding a new chunk of credit doesn't wrap to zero. */
+ max_credit = vif->remaining_credit + vif->credit_bytes;
+@@ -884,7 +882,7 @@ static void netbk_tx_err(struct xenvif *vif,
+ make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
+ if (cons == end)
+ break;
+- txp = RING_GET_REQUEST(&vif->tx, cons++);
++ RING_COPY_REQUEST(&vif->tx, cons++, txp);
+ } while (1);
+ vif->tx.req_cons = cons;
+ xen_netbk_check_rx_xenvif(vif);
+@@ -945,8 +943,7 @@ static int netbk_count_requests(struct xenvif *vif,
+ drop_err = -E2BIG;
+ }
+
+- memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + slots),
+- sizeof(*txp));
++ RING_COPY_REQUEST(&vif->tx, cons + slots, txp);
+
+ /* If the guest submitted a frame >= 64 KiB then
+ * first->size overflowed and following slots will
+@@ -1228,8 +1225,7 @@ static int xen_netbk_get_extras(struct xenvif *vif,
+ return -EBADR;
+ }
+
+- memcpy(&extra, RING_GET_REQUEST(&vif->tx, cons),
+- sizeof(extra));
++ RING_COPY_REQUEST(&vif->tx, cons, &extra);
+ if (unlikely(!extra.type ||
+ extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
+ vif->tx.req_cons = ++cons;
+@@ -1424,7 +1420,7 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
+
+ idx = vif->tx.req_cons;
+ rmb(); /* Ensure that we see the request before we copy it. */
+- memcpy(&txreq, RING_GET_REQUEST(&vif->tx, idx), sizeof(txreq));
++ RING_COPY_REQUEST(&vif->tx, idx, &txreq);
+
+ /* Credit-based scheduling. */
+ if (txreq.size > vif->remaining_credit &&
+diff --git a/drivers/parisc/iommu-helpers.h b/drivers/parisc/iommu-helpers.h
+index 8c33491b21fe..c6aa38883466 100644
+--- a/drivers/parisc/iommu-helpers.h
++++ b/drivers/parisc/iommu-helpers.h
+@@ -104,7 +104,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
+ struct scatterlist *contig_sg; /* contig chunk head */
+ unsigned long dma_offset, dma_len; /* start/len of DMA stream */
+ unsigned int n_mappings = 0;
+- unsigned int max_seg_size = dma_get_max_seg_size(dev);
++ unsigned int max_seg_size = min(dma_get_max_seg_size(dev),
++ (unsigned)DMA_CHUNK_SIZE);
++ unsigned int max_seg_boundary = dma_get_seg_boundary(dev) + 1;
++ if (max_seg_boundary) /* check if the addition above didn't overflow */
++ max_seg_size = min(max_seg_size, max_seg_boundary);
+
+ while (nents > 0) {
+
+@@ -139,14 +143,11 @@ iommu_coalesce_chunks(struct ioc *ioc, struct device *dev,
+
+ /*
+ ** First make sure current dma stream won't
+- ** exceed DMA_CHUNK_SIZE if we coalesce the
++ ** exceed max_seg_size if we coalesce the
+ ** next entry.
+ */
+- if(unlikely(ALIGN(dma_len + dma_offset + startsg->length,
+- IOVP_SIZE) > DMA_CHUNK_SIZE))
+- break;
+-
+- if (startsg->length + dma_len > max_seg_size)
++ if (unlikely(ALIGN(dma_len + dma_offset + startsg->length, IOVP_SIZE) >
++ max_seg_size))
+ break;
+
+ /*
+diff --git a/drivers/power/wm831x_power.c b/drivers/power/wm831x_power.c
+index 987332b71d8d..036ee0b258be 100644
+--- a/drivers/power/wm831x_power.c
++++ b/drivers/power/wm831x_power.c
+@@ -567,7 +567,7 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq_byname(pdev, "SYSLO");
+ ret = request_threaded_irq(irq, NULL, wm831x_syslo_irq,
+- IRQF_TRIGGER_RISING, "System power low",
++ IRQF_TRIGGER_RISING | IRQF_ONESHOT, "System power low",
+ power);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "Failed to request SYSLO IRQ %d: %d\n",
+@@ -577,7 +577,7 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
+
+ irq = platform_get_irq_byname(pdev, "PWR SRC");
+ ret = request_threaded_irq(irq, NULL, wm831x_pwr_src_irq,
+- IRQF_TRIGGER_RISING, "Power source",
++ IRQF_TRIGGER_RISING | IRQF_ONESHOT, "Power source",
+ power);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "Failed to request PWR SRC IRQ %d: %d\n",
+@@ -588,7 +588,7 @@ static __devinit int wm831x_power_probe(struct platform_device *pdev)
+ for (i = 0; i < ARRAY_SIZE(wm831x_bat_irqs); i++) {
+ irq = platform_get_irq_byname(pdev, wm831x_bat_irqs[i]);
+ ret = request_threaded_irq(irq, NULL, wm831x_bat_irq,
+- IRQF_TRIGGER_RISING,
++ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
+ wm831x_bat_irqs[i],
+ power);
+ if (ret != 0) {
+diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
+index 1a7955a39070..0eaf19676157 100644
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -300,6 +300,8 @@ enum MR_EVT_ARGS {
+ MR_EVT_ARGS_GENERIC,
+ };
+
++
++#define SGE_BUFFER_SIZE 4096
+ /*
+ * define constants for device list query options
+ */
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index bacd344f4626..2e46060e45e2 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3582,7 +3582,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ }
+
+ instance->max_sectors_per_req = instance->max_num_sge *
+- PAGE_SIZE / 512;
++ SGE_BUFFER_SIZE / 512;
+ if (tmp_sectors && (instance->max_sectors_per_req > tmp_sectors))
+ instance->max_sectors_per_req = tmp_sectors;
+
+@@ -5014,6 +5014,9 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
+ int i;
+ int error = 0;
+ compat_uptr_t ptr;
++ unsigned long local_raw_ptr;
++ u32 local_sense_off;
++ u32 local_sense_len;
+
+ if (clear_user(ioc, sizeof(*ioc)))
+ return -EFAULT;
+@@ -5031,9 +5034,15 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
+ * sense_len is not null, so prepare the 64bit value under
+ * the same condition.
+ */
+- if (ioc->sense_len) {
++ if (get_user(local_raw_ptr, ioc->frame.raw) ||
++ get_user(local_sense_off, &ioc->sense_off) ||
++ get_user(local_sense_len, &ioc->sense_len))
++ return -EFAULT;
++
++
++ if (local_sense_len) {
+ void __user **sense_ioc_ptr =
+- (void __user **)(ioc->frame.raw + ioc->sense_off);
++ (void __user **)((u8*)local_raw_ptr + local_sense_off);
+ compat_uptr_t *sense_cioc_ptr =
+ (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
+ if (get_user(ptr, sense_cioc_ptr) ||
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 72ca515a4304..ca6ddab8c4a7 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -793,7 +793,7 @@ sdev_store_queue_ramp_up_period(struct device *dev,
+ return -EINVAL;
+
+ sdev->queue_ramp_up_period = msecs_to_jiffies(period);
+- return period;
++ return count;
+ }
+
+ static struct device_attribute sdev_attr_queue_ramp_up_period =
+@@ -1020,31 +1020,23 @@ static void __scsi_remove_target(struct scsi_target *starget)
+ void scsi_remove_target(struct device *dev)
+ {
+ struct Scsi_Host *shost = dev_to_shost(dev->parent);
+- struct scsi_target *starget, *last = NULL;
++ struct scsi_target *starget;
+ unsigned long flags;
+
+- /* remove targets being careful to lookup next entry before
+- * deleting the last
+- */
++restart:
+ spin_lock_irqsave(shost->host_lock, flags);
+ list_for_each_entry(starget, &shost->__targets, siblings) {
+ if (starget->state == STARGET_DEL)
+ continue;
+ if (starget->dev.parent == dev || &starget->dev == dev) {
+- /* assuming new targets arrive at the end */
+ starget->reap_ref++;
+ spin_unlock_irqrestore(shost->host_lock, flags);
+- if (last)
+- scsi_target_reap(last);
+- last = starget;
+ __scsi_remove_target(starget);
+- spin_lock_irqsave(shost->host_lock, flags);
++ scsi_target_reap(starget);
++ goto restart;
+ }
+ }
+ spin_unlock_irqrestore(shost->host_lock, flags);
+-
+- if (last)
+- scsi_target_reap(last);
+ }
+ EXPORT_SYMBOL(scsi_remove_target);
+
+diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
+index eba183c428cf..3643bbf5456d 100644
+--- a/drivers/scsi/ses.c
++++ b/drivers/scsi/ses.c
+@@ -70,6 +70,7 @@ static int ses_probe(struct device *dev)
+ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
+ void *buf, int bufflen)
+ {
++ int ret;
+ unsigned char cmd[] = {
+ RECEIVE_DIAGNOSTIC,
+ 1, /* Set PCV bit */
+@@ -78,9 +79,26 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
+ bufflen & 0xff,
+ 0
+ };
++ unsigned char recv_page_code;
+
+- return scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
++ ret = scsi_execute_req(sdev, cmd, DMA_FROM_DEVICE, buf, bufflen,
+ NULL, SES_TIMEOUT, SES_RETRIES, NULL);
++ if (unlikely(!ret))
++ return ret;
++
++ recv_page_code = ((unsigned char *)buf)[0];
++
++ if (likely(recv_page_code == page_code))
++ return ret;
++
++ /* successful diagnostic but wrong page code. This happens to some
++ * USB devices, just print a message and pretend there was an error */
++
++ sdev_printk(KERN_ERR, sdev,
++ "Wrong diagnostic page; asked for %d got %u\n",
++ page_code, recv_page_code);
++
++ return -EINVAL;
+ }
+
+ static int ses_send_diag(struct scsi_device *sdev, int page_code,
+@@ -436,7 +454,15 @@ static void ses_enclosure_data_process(struct enclosure_device *edev,
+ if (desc_ptr)
+ desc_ptr += len;
+
+- if (addl_desc_ptr)
++ if (addl_desc_ptr &&
++ /* only find additional descriptions for specific devices */
++ (type_ptr[0] == ENCLOSURE_COMPONENT_DEVICE ||
++ type_ptr[0] == ENCLOSURE_COMPONENT_ARRAY_DEVICE ||
++ type_ptr[0] == ENCLOSURE_COMPONENT_SAS_EXPANDER ||
++ /* these elements are optional */
++ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_TARGET_PORT ||
++ type_ptr[0] == ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT ||
++ type_ptr[0] == ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS))
+ addl_desc_ptr += addl_desc_ptr[1] + 2;
+
+ }
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index a3f31e9ab214..516fd23ba0d5 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -846,7 +846,7 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
+
+ device_initialize(&master->dev);
+ master->dev.class = &spi_master_class;
+- master->dev.parent = get_device(dev);
++ master->dev.parent = dev;
+ spi_master_set_devdata(master, &master[1]);
+
+ return master;
+diff --git a/drivers/staging/iio/adc/lpc32xx_adc.c b/drivers/staging/iio/adc/lpc32xx_adc.c
+index dfc9033843a3..37ca387327cf 100644
+--- a/drivers/staging/iio/adc/lpc32xx_adc.c
++++ b/drivers/staging/iio/adc/lpc32xx_adc.c
+@@ -75,7 +75,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev,
+
+ if (mask == 0) {
+ mutex_lock(&indio_dev->mlock);
+- clk_enable(info->clk);
++ clk_prepare_enable(info->clk);
+ /* Measurement setup */
+ __raw_writel(AD_INTERNAL | (chan->address) | AD_REFp | AD_REFm,
+ LPC32XX_ADC_SELECT(info->adc_base));
+@@ -83,7 +83,7 @@ static int lpc32xx_read_raw(struct iio_dev *indio_dev,
+ __raw_writel(AD_PDN_CTRL | AD_STROBE,
+ LPC32XX_ADC_CTRL(info->adc_base));
+ wait_for_completion(&info->completion); /* set by ISR */
+- clk_disable(info->clk);
++ clk_disable_unprepare(info->clk);
+ *val = info->value;
+ mutex_unlock(&indio_dev->mlock);
+
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index 1b1bf38e8839..3c4a54cf4b5d 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -147,6 +147,7 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = {
+ {USB_DEVICE(0x0DF6, 0x0058)},
+ {USB_DEVICE(0x0DF6, 0x0049)},
+ {USB_DEVICE(0x0DF6, 0x004C)},
++ {USB_DEVICE(0x0DF6, 0x006C)},
+ {USB_DEVICE(0x0DF6, 0x0064)},
+ /* Skyworth */
+ {USB_DEVICE(0x14b2, 0x3300)},
+diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
+index 4f02f9ce05c5..3f59d6c399da 100644
+--- a/drivers/tty/tty_buffer.c
++++ b/drivers/tty/tty_buffer.c
+@@ -443,7 +443,8 @@ static void flush_to_ldisc(struct work_struct *work)
+ flag_buf = head->flag_buf_ptr + head->read;
+ head->read += count;
+ spin_unlock_irqrestore(&tty->buf.lock, flags);
+- disc->ops->receive_buf(tty, char_buf,
++ if (disc->ops->receive_buf)
++ disc->ops->receive_buf(tty, char_buf,
+ flag_buf, count);
+ spin_lock_irqsave(&tty->buf.lock, flags);
+ }
+diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
+index a68c1a63dc65..8bbe67ccb758 100644
+--- a/drivers/usb/class/usblp.c
++++ b/drivers/usb/class/usblp.c
+@@ -861,11 +861,11 @@ static int usblp_wwait(struct usblp *usblp, int nonblock)
+
+ add_wait_queue(&usblp->wwait, &waita);
+ for (;;) {
+- set_current_state(TASK_INTERRUPTIBLE);
+ if (mutex_lock_interruptible(&usblp->mut)) {
+ rc = -EINTR;
+ break;
+ }
++ set_current_state(TASK_INTERRUPTIBLE);
+ rc = usblp_wtest(usblp, nonblock);
+ mutex_unlock(&usblp->mut);
+ if (rc <= 0)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 62ea924dee1c..65ff69a05225 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -156,6 +156,7 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsem);
+ #define HUB_DEBOUNCE_STABLE 100
+
+
++static void hub_release(struct kref *kref);
+ static int usb_reset_and_verify_device(struct usb_device *udev);
+
+ static inline char *portspeed(struct usb_hub *hub, int portstatus)
+@@ -797,10 +798,20 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ unsigned delay;
+
+ /* Continue a partial initialization */
+- if (type == HUB_INIT2)
+- goto init2;
+- if (type == HUB_INIT3)
++ if (type == HUB_INIT2 || type == HUB_INIT3) {
++ device_lock(hub->intfdev);
++
++ /* Was the hub disconnected while we were waiting? */
++ if (hub->disconnected) {
++ device_unlock(hub->intfdev);
++ kref_put(&hub->kref, hub_release);
++ return;
++ }
++ if (type == HUB_INIT2)
++ goto init2;
+ goto init3;
++ }
++ kref_get(&hub->kref);
+
+ /* The superspeed hub except for root hub has to use Hub Depth
+ * value as an offset into the route string to locate the bits
+@@ -990,6 +1001,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ PREPARE_DELAYED_WORK(&hub->init_work, hub_init_func3);
+ schedule_delayed_work(&hub->init_work,
+ msecs_to_jiffies(delay));
++ device_unlock(hub->intfdev);
+ return; /* Continues at init3: below */
+ } else {
+ msleep(delay);
+@@ -1010,6 +1022,11 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
+ /* Allow autosuspend if it was suppressed */
+ if (type <= HUB_INIT3)
+ usb_autopm_put_interface_async(to_usb_interface(hub->intfdev));
++
++ if (type == HUB_INIT2 || type == HUB_INIT3)
++ device_unlock(hub->intfdev);
++
++ kref_put(&hub->kref, hub_release);
+ }
+
+ /* Implement the continuations for the delays above */
+@@ -1638,10 +1655,8 @@ void usb_set_device_state(struct usb_device *udev,
+ || new_state == USB_STATE_SUSPENDED)
+ ; /* No change to wakeup settings */
+ else if (new_state == USB_STATE_CONFIGURED)
+- wakeup = (udev->quirks &
+- USB_QUIRK_IGNORE_REMOTE_WAKEUP) ? 0 :
+- udev->actconfig->desc.bmAttributes &
+- USB_CONFIG_ATT_WAKEUP;
++ wakeup = udev->actconfig->desc.bmAttributes
++ & USB_CONFIG_ATT_WAKEUP;
+ else
+ wakeup = 0;
+ }
+diff --git a/drivers/usb/core/otg_whitelist.h b/drivers/usb/core/otg_whitelist.h
+index 2753cec61aaf..e8cdce571bb1 100644
+--- a/drivers/usb/core/otg_whitelist.h
++++ b/drivers/usb/core/otg_whitelist.h
+@@ -59,11 +59,6 @@ static int is_targeted(struct usb_device *dev)
+ le16_to_cpu(dev->descriptor.idProduct) == 0xbadd))
+ return 0;
+
+- /* OTG PET device is always targeted (see OTG 2.0 ECN 6.4.2) */
+- if ((le16_to_cpu(dev->descriptor.idVendor) == 0x1a0a &&
+- le16_to_cpu(dev->descriptor.idProduct) == 0x0200))
+- return 1;
+-
+ /* NOTE: can't use usb_match_id() since interface caches
+ * aren't set up yet. this is cut/paste from that code.
+ */
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index fd8e60ee7df2..90f04a8e859a 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -184,14 +184,6 @@ static const struct usb_device_id usb_interface_quirk_list[] = {
+ { USB_VENDOR_AND_INTERFACE_INFO(0x046d, USB_CLASS_VIDEO, 1, 0),
+ .driver_info = USB_QUIRK_RESET_RESUME },
+
+- /* ASUS Base Station(T100) */
+- { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
+- USB_QUIRK_IGNORE_REMOTE_WAKEUP },
+-
+- /* Protocol and OTG Electrical Test Device */
+- { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
+- USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
+-
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
+index 76083ae92138..412b4feea17b 100644
+--- a/drivers/usb/host/whci/qset.c
++++ b/drivers/usb/host/whci/qset.c
+@@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
+ if (std->pl_virt == NULL)
+ return -ENOMEM;
+ std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
++ if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
++ kfree(std->pl_virt);
++ return -EFAULT;
++ }
+
+ for (p = 0; p < std->num_pointers; p++) {
+ std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 88be7a51df52..95ac4cf9d5bf 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -4123,8 +4123,16 @@ int xhci_update_hub_device(struct usb_hcd *hcd, struct usb_device *hdev,
+ ctrl_ctx->add_flags |= cpu_to_le32(SLOT_FLAG);
+ slot_ctx = xhci_get_slot_ctx(xhci, config_cmd->in_ctx);
+ slot_ctx->dev_info |= cpu_to_le32(DEV_HUB);
++ /*
++ * refer to section 6.2.2: MTT should be 0 for full speed hub,
++ * but it may be already set to 1 when setup an xHCI virtual
++ * device, so clear it anyway.
++ */
+ if (tt->multi)
+ slot_ctx->dev_info |= cpu_to_le32(DEV_MTT);
++ else if (hdev->speed == USB_SPEED_FULL)
++ slot_ctx->dev_info &= cpu_to_le32(~DEV_MTT);
++
+ if (xhci->hci_version > 0x95) {
+ xhci_dbg(xhci, "xHCI version %x needs hub "
+ "TT think time and number of ports\n",
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index d3481c497be9..db25165ed16a 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -131,7 +131,7 @@ static inline struct musb *dev_to_musb(struct device *dev)
+ /*-------------------------------------------------------------------------*/
+
+ #ifndef CONFIG_BLACKFIN
+-static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
++static int musb_ulpi_read(struct usb_phy *phy, u32 reg)
+ {
+ void __iomem *addr = phy->io_priv;
+ int i = 0;
+@@ -150,7 +150,7 @@ static int musb_ulpi_read(struct usb_phy *phy, u32 offset)
+ * ULPICarKitControlDisableUTMI after clearing POWER_SUSPENDM.
+ */
+
+- musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset);
++ musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg);
+ musb_writeb(addr, MUSB_ULPI_REG_CONTROL,
+ MUSB_ULPI_REG_REQ | MUSB_ULPI_RDN_WR);
+
+@@ -175,7 +175,7 @@ out:
+ return ret;
+ }
+
+-static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
++static int musb_ulpi_write(struct usb_phy *phy, u32 val, u32 reg)
+ {
+ void __iomem *addr = phy->io_priv;
+ int i = 0;
+@@ -190,8 +190,8 @@ static int musb_ulpi_write(struct usb_phy *phy, u32 offset, u32 data)
+ power &= ~MUSB_POWER_SUSPENDM;
+ musb_writeb(addr, MUSB_POWER, power);
+
+- musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)offset);
+- musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)data);
++ musb_writeb(addr, MUSB_ULPI_REG_ADDR, (u8)reg);
++ musb_writeb(addr, MUSB_ULPI_REG_DATA, (u8)val);
+ musb_writeb(addr, MUSB_ULPI_REG_CONTROL, MUSB_ULPI_REG_REQ);
+
+ while (!(musb_readb(addr, MUSB_ULPI_REG_CONTROL)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7a04e2c4e0af..b48444b84e40 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -138,7 +138,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+- { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
+ { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
+ { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
+diff --git a/drivers/usb/serial/ipaq.c b/drivers/usb/serial/ipaq.c
+index 10c02b8b5664..af019a82c0d6 100644
+--- a/drivers/usb/serial/ipaq.c
++++ b/drivers/usb/serial/ipaq.c
+@@ -550,7 +550,8 @@ static int ipaq_open(struct tty_struct *tty,
+ * through. Since this has a reasonably high failure rate, we retry
+ * several times.
+ */
+- while (retries--) {
++ while (retries) {
++ retries--;
+ result = usb_control_msg(serial->dev,
+ usb_sndctrlpipe(serial->dev, 0), 0x22, 0x21,
+ 0x1, 0, NULL, 0, 100);
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index cb999af237dd..1852ca6a33a3 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -162,6 +162,7 @@ static void option_instat_callback(struct urb *urb);
+ #define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0x9001
+ #define NOVATELWIRELESS_PRODUCT_E362 0x9010
+ #define NOVATELWIRELESS_PRODUCT_E371 0x9011
++#define NOVATELWIRELESS_PRODUCT_U620L 0x9022
+ #define NOVATELWIRELESS_PRODUCT_G2 0xA010
+ #define NOVATELWIRELESS_PRODUCT_MC551 0xB001
+
+@@ -351,6 +352,7 @@ static void option_instat_callback(struct urb *urb);
+ /* This is the 4G XS Stick W14 a.k.a. Mobilcom Debitel Surf-Stick *
+ * It seems to contain a Qualcomm QSC6240/6290 chipset */
+ #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603
++#define FOUR_G_SYSTEMS_PRODUCT_W100 0x9b01
+
+ /* iBall 3.5G connect wireless modem */
+ #define IBALL_3_5G_CONNECT 0x9605
+@@ -524,6 +526,11 @@ static const struct option_blacklist_info four_g_w14_blacklist = {
+ .sendsetup = BIT(0) | BIT(1),
+ };
+
++static const struct option_blacklist_info four_g_w100_blacklist = {
++ .sendsetup = BIT(1) | BIT(2),
++ .reserved = BIT(3),
++};
++
+ static const struct option_blacklist_info alcatel_x200_blacklist = {
+ .sendsetup = BIT(0) | BIT(1),
+ .reserved = BIT(4),
+@@ -1045,6 +1052,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC551, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E362, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_E371, 0xff, 0xff, 0xff) },
++ { USB_DEVICE_AND_INTERFACE_INFO(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_U620L, 0xff, 0x00, 0x00) },
+
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
+ { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
+@@ -1619,6 +1627,9 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
++ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100),
++ .driver_info = (kernel_ulong_t)&four_g_w100_blacklist
++ },
+ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
+index 257577977d23..974c4fa30b14 100644
+--- a/drivers/usb/serial/ti_usb_3410_5052.c
++++ b/drivers/usb/serial/ti_usb_3410_5052.c
+@@ -164,7 +164,7 @@ static unsigned int product_5052_count;
+ /* the array dimension is the number of default entries plus */
+ /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
+ /* null entry */
+-static struct usb_device_id ti_id_table_3410[15+TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_3410[16+TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+@@ -190,7 +190,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
+ };
+
+-static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1] = {
++static struct usb_device_id ti_id_table_combined[20+2*TI_EXTRA_VID_PID_COUNT+1] = {
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
+ { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
+ { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
+diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
+index a7def010eba3..7a642e3e049c 100644
+--- a/drivers/xen/xen-pciback/pciback.h
++++ b/drivers/xen/xen-pciback/pciback.h
+@@ -37,6 +37,7 @@ struct xen_pcibk_device {
+ struct xen_pci_sharedinfo *sh_info;
+ unsigned long flags;
+ struct work_struct op_work;
++ struct xen_pci_op op;
+ };
+
+ struct xen_pcibk_dev_data {
+diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
+index d52703c5821a..3d0c70a81208 100644
+--- a/drivers/xen/xen-pciback/pciback_ops.c
++++ b/drivers/xen/xen-pciback/pciback_ops.c
+@@ -69,6 +69,13 @@ static void xen_pcibk_control_isr(struct pci_dev *dev, int reset)
+ enable ? "enable" : "disable");
+
+ if (enable) {
++ /*
++ * The MSI or MSI-X should not have an IRQ handler. Otherwise
++ * if the guest terminates we BUG_ON in free_msi_irqs.
++ */
++ if (dev->msi_enabled || dev->msix_enabled)
++ goto out;
++
+ rc = request_irq(dev_data->irq,
+ xen_pcibk_guest_interrupt, IRQF_SHARED,
+ dev_data->irq_name, dev);
+@@ -143,7 +150,12 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
+ if (unlikely(verbose_request))
+ printk(KERN_DEBUG DRV_NAME ": %s: enable MSI\n", pci_name(dev));
+
+- status = pci_enable_msi(dev);
++ if (dev->msi_enabled)
++ status = -EALREADY;
++ else if (dev->msix_enabled)
++ status = -ENXIO;
++ else
++ status = pci_enable_msi(dev);
+
+ if (status) {
+ pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI for guest %u: err %d\n",
+@@ -172,20 +184,23 @@ static
+ int xen_pcibk_disable_msi(struct xen_pcibk_device *pdev,
+ struct pci_dev *dev, struct xen_pci_op *op)
+ {
+- struct xen_pcibk_dev_data *dev_data;
+-
+ if (unlikely(verbose_request))
+ printk(KERN_DEBUG DRV_NAME ": %s: disable MSI\n",
+ pci_name(dev));
+- pci_disable_msi(dev);
+
++ if (dev->msi_enabled) {
++ struct xen_pcibk_dev_data *dev_data;
++
++ pci_disable_msi(dev);
++
++ dev_data = pci_get_drvdata(dev);
++ if (dev_data)
++ dev_data->ack_intr = 1;
++ }
+ op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
+ if (unlikely(verbose_request))
+ printk(KERN_DEBUG DRV_NAME ": %s: MSI: %d\n", pci_name(dev),
+ op->value);
+- dev_data = pci_get_drvdata(dev);
+- if (dev_data)
+- dev_data->ack_intr = 1;
+ return 0;
+ }
+
+@@ -196,13 +211,26 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
+ struct xen_pcibk_dev_data *dev_data;
+ int i, result;
+ struct msix_entry *entries;
++ u16 cmd;
+
+ if (unlikely(verbose_request))
+ printk(KERN_DEBUG DRV_NAME ": %s: enable MSI-X\n",
+ pci_name(dev));
++
+ if (op->value > SH_INFO_MAX_VEC)
+ return -EINVAL;
+
++ if (dev->msix_enabled)
++ return -EALREADY;
++
++ /*
++ * PCI_COMMAND_MEMORY must be enabled, otherwise we may not be able
++ * to access the BARs where the MSI-X entries reside.
++ */
++ pci_read_config_word(dev, PCI_COMMAND, &cmd);
++ if (dev->msi_enabled || !(cmd & PCI_COMMAND_MEMORY))
++ return -ENXIO;
++
+ entries = kmalloc(op->value * sizeof(*entries), GFP_KERNEL);
+ if (entries == NULL)
+ return -ENOMEM;
+@@ -244,23 +272,27 @@ static
+ int xen_pcibk_disable_msix(struct xen_pcibk_device *pdev,
+ struct pci_dev *dev, struct xen_pci_op *op)
+ {
+- struct xen_pcibk_dev_data *dev_data;
+ if (unlikely(verbose_request))
+ printk(KERN_DEBUG DRV_NAME ": %s: disable MSI-X\n",
+ pci_name(dev));
+- pci_disable_msix(dev);
+
++ if (dev->msix_enabled) {
++ struct xen_pcibk_dev_data *dev_data;
++
++ pci_disable_msix(dev);
++
++ dev_data = pci_get_drvdata(dev);
++ if (dev_data)
++ dev_data->ack_intr = 1;
++ }
+ /*
+ * SR-IOV devices (which don't have any legacy IRQ) have
+ * an undefined IRQ value of zero.
+ */
+ op->value = dev->irq ? xen_pirq_from_irq(dev->irq) : 0;
+ if (unlikely(verbose_request))
+- printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n", pci_name(dev),
+- op->value);
+- dev_data = pci_get_drvdata(dev);
+- if (dev_data)
+- dev_data->ack_intr = 1;
++ printk(KERN_DEBUG DRV_NAME ": %s: MSI-X: %d\n",
++ pci_name(dev), op->value);
+ return 0;
+ }
+ #endif
+@@ -297,9 +329,14 @@ void xen_pcibk_do_op(struct work_struct *data)
+ container_of(data, struct xen_pcibk_device, op_work);
+ struct pci_dev *dev;
+ struct xen_pcibk_dev_data *dev_data = NULL;
+- struct xen_pci_op *op = &pdev->sh_info->op;
++ struct xen_pci_op *op = &pdev->op;
+ int test_intx = 0;
++#ifdef CONFIG_PCI_MSI
++ unsigned int nr = 0;
++#endif
+
++ *op = pdev->sh_info->op;
++ barrier();
+ dev = xen_pcibk_get_pci_dev(pdev, op->domain, op->bus, op->devfn);
+
+ if (dev == NULL)
+@@ -325,6 +362,7 @@ void xen_pcibk_do_op(struct work_struct *data)
+ op->err = xen_pcibk_disable_msi(pdev, dev, op);
+ break;
+ case XEN_PCI_OP_enable_msix:
++ nr = op->value;
+ op->err = xen_pcibk_enable_msix(pdev, dev, op);
+ break;
+ case XEN_PCI_OP_disable_msix:
+@@ -341,6 +379,17 @@ void xen_pcibk_do_op(struct work_struct *data)
+ if ((dev_data->enable_intx != test_intx))
+ xen_pcibk_control_isr(dev, 0 /* no reset */);
+ }
++ pdev->sh_info->op.err = op->err;
++ pdev->sh_info->op.value = op->value;
++#ifdef CONFIG_PCI_MSI
++ if (op->cmd == XEN_PCI_OP_enable_msix && op->err == 0) {
++ unsigned int i;
++
++ for (i = 0; i < nr; i++)
++ pdev->sh_info->op.msix_entries[i].vector =
++ op->msix_entries[i].vector;
++ }
++#endif
+ /* Tell the driver domain that we're done. */
+ wmb();
+ clear_bit(_XEN_PCIF_active, (unsigned long *)&pdev->sh_info->flags);
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index c9b32dcf820d..116e43f89325 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -447,9 +447,9 @@ void v9fs_evict_inode(struct inode *inode)
+ {
+ struct v9fs_inode *v9inode = V9FS_I(inode);
+
+- truncate_inode_pages(inode->i_mapping, 0);
++ truncate_inode_pages(&inode->i_data, 0);
+ end_writeback(inode);
+- filemap_fdatawrite(inode->i_mapping);
++ filemap_fdatawrite(&inode->i_data);
+
+ #ifdef CONFIG_9P_FSCACHE
+ v9fs_cache_inode_put_cookie(inode);
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index a181b58cedd5..a54779243735 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -668,16 +668,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ */
+ would_dump(bprm, interpreter);
+
+- retval = kernel_read(interpreter, 0, bprm->buf,
+- BINPRM_BUF_SIZE);
+- if (retval != BINPRM_BUF_SIZE) {
++ /* Get the exec headers */
++ retval = kernel_read(interpreter, 0,
++ (void *)&loc->interp_elf_ex,
++ sizeof(loc->interp_elf_ex));
++ if (retval != sizeof(loc->interp_elf_ex)) {
+ if (retval >= 0)
+ retval = -EIO;
+ goto out_free_dentry;
+ }
+
+- /* Get the exec headers */
+- loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
+ break;
+ }
+ elf_ppnt++;
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 575c1902d38d..d460390484a8 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1203,8 +1203,14 @@ next_slot:
+ num_bytes = 0;
+ btrfs_item_key_to_cpu(leaf, &found_key, path->slots[0]);
+
+- if (found_key.objectid > ino ||
+- found_key.type > BTRFS_EXTENT_DATA_KEY ||
++ if (found_key.objectid > ino)
++ break;
++ if (WARN_ON_ONCE(found_key.objectid < ino) ||
++ found_key.type < BTRFS_EXTENT_DATA_KEY) {
++ path->slots[0]++;
++ goto next_slot;
++ }
++ if (found_key.type > BTRFS_EXTENT_DATA_KEY ||
+ found_key.offset > end)
+ break;
+
+diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
+index b4d2438da9a5..00d942540e6c 100644
+--- a/fs/cachefiles/rdwr.c
++++ b/fs/cachefiles/rdwr.c
+@@ -914,6 +914,15 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
+ cache = container_of(object->fscache.cache,
+ struct cachefiles_cache, cache);
+
++ pos = (loff_t)page->index << PAGE_SHIFT;
++
++ /* We mustn't write more data than we have, so we have to beware of a
++ * partial page at EOF.
++ */
++ eof = object->fscache.store_limit_l;
++ if (pos >= eof)
++ goto error;
++
+ /* write the page to the backing filesystem and let it store it in its
+ * own time */
+ dget(object->backer);
+@@ -922,47 +931,46 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
+ cache->cache_cred);
+ if (IS_ERR(file)) {
+ ret = PTR_ERR(file);
+- } else {
++ goto error_2;
++ }
++ if (!file->f_op->write) {
+ ret = -EIO;
+- if (file->f_op->write) {
+- pos = (loff_t) page->index << PAGE_SHIFT;
+-
+- /* we mustn't write more data than we have, so we have
+- * to beware of a partial page at EOF */
+- eof = object->fscache.store_limit_l;
+- len = PAGE_SIZE;
+- if (eof & ~PAGE_MASK) {
+- ASSERTCMP(pos, <, eof);
+- if (eof - pos < PAGE_SIZE) {
+- _debug("cut short %llx to %llx",
+- pos, eof);
+- len = eof - pos;
+- ASSERTCMP(pos + len, ==, eof);
+- }
+- }
++ goto error_2;
++ }
+
+- data = kmap(page);
+- old_fs = get_fs();
+- set_fs(KERNEL_DS);
+- ret = file->f_op->write(
+- file, (const void __user *) data, len, &pos);
+- set_fs(old_fs);
+- kunmap(page);
+- if (ret != len)
+- ret = -EIO;
++ len = PAGE_SIZE;
++ if (eof & ~PAGE_MASK) {
++ if (eof - pos < PAGE_SIZE) {
++ _debug("cut short %llx to %llx",
++ pos, eof);
++ len = eof - pos;
++ ASSERTCMP(pos + len, ==, eof);
+ }
+- fput(file);
+ }
+
+- if (ret < 0) {
+- if (ret == -EIO)
+- cachefiles_io_error_obj(
+- object, "Write page to backing file failed");
+- ret = -ENOBUFS;
+- }
++ data = kmap(page);
++ old_fs = get_fs();
++ set_fs(KERNEL_DS);
++ ret = file->f_op->write(
++ file, (const void __user *) data, len, &pos);
++ set_fs(old_fs);
++ kunmap(page);
++ fput(file);
++ if (ret != len)
++ goto error_eio;
++
++ _leave(" = 0");
++ return 0;
+
+- _leave(" = %d", ret);
+- return ret;
++error_eio:
++ ret = -EIO;
++error_2:
++ if (ret == -EIO)
++ cachefiles_io_error_obj(object,
++ "Write page to backing file failed");
++error:
++ _leave(" = -ENOBUFS [%d]", ret);
++ return -ENOBUFS;
+ }
+
+ /*
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index b9cdb6df8d2b..aedf75fd62b4 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -26,6 +26,7 @@
+ #include <linux/seqlock.h>
+ #include <linux/mutex.h>
+ #include <linux/timer.h>
++#include <linux/version.h>
+ #include <linux/wait.h>
+ #include <linux/blockgroup_lock.h>
+ #include <linux/percpu_counter.h>
+@@ -704,19 +705,55 @@ struct move_extent {
+ <= (EXT4_GOOD_OLD_INODE_SIZE + \
+ (einode)->i_extra_isize)) \
+
++/*
++ * We use an encoding that preserves the times for extra epoch "00":
++ *
++ * extra msb of adjust for signed
++ * epoch 32-bit 32-bit tv_sec to
++ * bits time decoded 64-bit tv_sec 64-bit tv_sec valid time range
++ * 0 0 1 -0x80000000..-0x00000001 0x000000000 1901-12-13..1969-12-31
++ * 0 0 0 0x000000000..0x07fffffff 0x000000000 1970-01-01..2038-01-19
++ * 0 1 1 0x080000000..0x0ffffffff 0x100000000 2038-01-19..2106-02-07
++ * 0 1 0 0x100000000..0x17fffffff 0x100000000 2106-02-07..2174-02-25
++ * 1 0 1 0x180000000..0x1ffffffff 0x200000000 2174-02-25..2242-03-16
++ * 1 0 0 0x200000000..0x27fffffff 0x200000000 2242-03-16..2310-04-04
++ * 1 1 1 0x280000000..0x2ffffffff 0x300000000 2310-04-04..2378-04-22
++ * 1 1 0 0x300000000..0x37fffffff 0x300000000 2378-04-22..2446-05-10
++ *
++ * Note that previous versions of the kernel on 64-bit systems would
++ * incorrectly use extra epoch bits 1,1 for dates between 1901 and
++ * 1970. e2fsck will correct this, assuming that it is run on the
++ * affected filesystem before 2242.
++ */
++
+ static inline __le32 ext4_encode_extra_time(struct timespec *time)
+ {
+- return cpu_to_le32((sizeof(time->tv_sec) > 4 ?
+- (time->tv_sec >> 32) & EXT4_EPOCH_MASK : 0) |
+- ((time->tv_nsec << EXT4_EPOCH_BITS) & EXT4_NSEC_MASK));
++ u32 extra = sizeof(time->tv_sec) > 4 ?
++ ((time->tv_sec - (s32)time->tv_sec) >> 32) & EXT4_EPOCH_MASK : 0;
++ return cpu_to_le32(extra | (time->tv_nsec << EXT4_EPOCH_BITS));
+ }
+
+ static inline void ext4_decode_extra_time(struct timespec *time, __le32 extra)
+ {
+- if (sizeof(time->tv_sec) > 4)
+- time->tv_sec |= (__u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK)
+- << 32;
+- time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
++ if (unlikely(sizeof(time->tv_sec) > 4 &&
++ (extra & cpu_to_le32(EXT4_EPOCH_MASK)))) {
++#if LINUX_VERSION_CODE < KERNEL_VERSION(4,20,0)
++ /* Handle legacy encoding of pre-1970 dates with epoch
++ * bits 1,1. We assume that by kernel version 4.20,
++ * everyone will have run fsck over the affected
++ * filesystems to correct the problem. (This
++ * backwards compatibility may be removed before this
++ * time, at the discretion of the ext4 developers.)
++ */
++ u64 extra_bits = le32_to_cpu(extra) & EXT4_EPOCH_MASK;
++ if (extra_bits == 3 && ((time->tv_sec) & 0x80000000) != 0)
++ extra_bits = 0;
++ time->tv_sec += extra_bits << 32;
++#else
++ time->tv_sec += (u64)(le32_to_cpu(extra) & EXT4_EPOCH_MASK) << 32;
++#endif
++ }
++ time->tv_nsec = (le32_to_cpu(extra) & EXT4_NSEC_MASK) >> EXT4_EPOCH_BITS;
+ }
+
+ #define EXT4_INODE_SET_XTIME(xtime, inode, raw_inode) \
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 3de888c3894a..5862518c6737 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -483,9 +483,13 @@ static void ext4_handle_error(struct super_block *sb)
+ ext4_msg(sb, KERN_CRIT, "Remounting filesystem read-only");
+ sb->s_flags |= MS_RDONLY;
+ }
+- if (test_opt(sb, ERRORS_PANIC))
++ if (test_opt(sb, ERRORS_PANIC)) {
++ if (EXT4_SB(sb)->s_journal &&
++ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
++ return;
+ panic("EXT4-fs (device %s): panic forced after error\n",
+ sb->s_id);
++ }
+ }
+
+ void __ext4_error(struct super_block *sb, const char *function,
+@@ -659,8 +663,12 @@ void __ext4_abort(struct super_block *sb, const char *function,
+ jbd2_journal_abort(EXT4_SB(sb)->s_journal, -EIO);
+ save_error_info(sb, function, line);
+ }
+- if (test_opt(sb, ERRORS_PANIC))
++ if (test_opt(sb, ERRORS_PANIC)) {
++ if (EXT4_SB(sb)->s_journal &&
++ !(EXT4_SB(sb)->s_journal->j_flags & JBD2_REC_ERR))
++ return;
+ panic("EXT4-fs panic from previous error\n");
++ }
+ }
+
+ void ext4_msg(struct super_block *sb, const char *prefix, const char *fmt, ...)
+diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c
+index e028b8eb1c40..6f4e4ed0c8e3 100644
+--- a/fs/fscache/netfs.c
++++ b/fs/fscache/netfs.c
+@@ -22,6 +22,7 @@ static LIST_HEAD(fscache_netfs_list);
+ int __fscache_register_netfs(struct fscache_netfs *netfs)
+ {
+ struct fscache_netfs *ptr;
++ struct fscache_cookie *cookie;
+ int ret;
+
+ _enter("{%s}", netfs->name);
+@@ -29,27 +30,23 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
+ INIT_LIST_HEAD(&netfs->link);
+
+ /* allocate a cookie for the primary index */
+- netfs->primary_index =
+- kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
++ cookie = kmem_cache_zalloc(fscache_cookie_jar, GFP_KERNEL);
+
+- if (!netfs->primary_index) {
++ if (!cookie) {
+ _leave(" = -ENOMEM");
+ return -ENOMEM;
+ }
+
+ /* initialise the primary index cookie */
+- atomic_set(&netfs->primary_index->usage, 1);
+- atomic_set(&netfs->primary_index->n_children, 0);
++ atomic_set(&cookie->usage, 1);
++ atomic_set(&cookie->n_children, 0);
+
+- netfs->primary_index->def = &fscache_fsdef_netfs_def;
+- netfs->primary_index->parent = &fscache_fsdef_index;
+- netfs->primary_index->netfs_data = netfs;
++ cookie->def = &fscache_fsdef_netfs_def;
++ cookie->parent = &fscache_fsdef_index;
++ cookie->netfs_data = netfs;
+
+- atomic_inc(&netfs->primary_index->parent->usage);
+- atomic_inc(&netfs->primary_index->parent->n_children);
+-
+- spin_lock_init(&netfs->primary_index->lock);
+- INIT_HLIST_HEAD(&netfs->primary_index->backing_objects);
++ spin_lock_init(&cookie->lock);
++ INIT_HLIST_HEAD(&cookie->backing_objects);
+
+ /* check the netfs type is not already present */
+ down_write(&fscache_addremove_sem);
+@@ -60,6 +57,10 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
+ goto already_registered;
+ }
+
++ atomic_inc(&cookie->parent->usage);
++ atomic_inc(&cookie->parent->n_children);
++
++ netfs->primary_index = cookie;
+ list_add(&netfs->link, &fscache_netfs_list);
+ ret = 0;
+
+@@ -69,11 +70,8 @@ int __fscache_register_netfs(struct fscache_netfs *netfs)
+ already_registered:
+ up_write(&fscache_addremove_sem);
+
+- if (ret < 0) {
+- netfs->primary_index->parent = NULL;
+- __fscache_cookie_put(netfs->primary_index);
+- netfs->primary_index = NULL;
+- }
++ if (ret < 0)
++ kmem_cache_free(fscache_cookie_jar, cookie);
+
+ _leave(" = %d", ret);
+ return ret;
+diff --git a/fs/fscache/page.c b/fs/fscache/page.c
+index 3f7a59bfa7ad..c9d52e1a8fa9 100644
+--- a/fs/fscache/page.c
++++ b/fs/fscache/page.c
+@@ -676,7 +676,7 @@ static void fscache_write_op(struct fscache_operation *_op)
+ goto superseded;
+ page = results[0];
+ _debug("gang %d [%lx]", n, page->index);
+- if (page->index > op->store_limit) {
++ if (page->index >= op->store_limit) {
+ fscache_stat(&fscache_n_store_pages_over_limit);
+ goto superseded;
+ }
+diff --git a/fs/fuse/file.c b/fs/fuse/file.c
+index e4f1f1ace347..951457a2da6b 100644
+--- a/fs/fuse/file.c
++++ b/fs/fuse/file.c
+@@ -846,6 +846,7 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
+
+ mark_page_accessed(page);
+
++ iov_iter_advance(ii, tmp);
+ if (!tmp) {
+ unlock_page(page);
+ page_cache_release(page);
+@@ -857,7 +858,6 @@ static ssize_t fuse_fill_write_pages(struct fuse_req *req,
+ req->pages[req->num_pages] = page;
+ req->num_pages++;
+
+- iov_iter_advance(ii, tmp);
+ count += tmp;
+ pos += tmp;
+ offset += tmp;
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index a3279442bf30..2e3063c76ab6 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -1921,8 +1921,12 @@ static void __journal_abort_soft (journal_t *journal, int errno)
+
+ __jbd2_journal_abort_hard(journal);
+
+- if (errno)
++ if (errno) {
+ jbd2_journal_update_sb_errno(journal);
++ write_lock(&journal->j_state_lock);
++ journal->j_flags |= JBD2_REC_ERR;
++ write_unlock(&journal->j_state_lock);
++ }
+ }
+
+ /**
+diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
+index f512c690d38e..51a743e6307b 100644
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1904,6 +1904,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
+
+ if (!buffer_dirty(bh)) {
+ /* bdflush has written it. We can drop it now */
++ __jbd2_journal_remove_checkpoint(jh);
+ goto zap_buffer;
+ }
+
+@@ -1941,6 +1942,7 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh)
+ /* The orphan record's transaction has
+ * committed. We can cleanse this buffer */
+ clear_buffer_jbddirty(bh);
++ __jbd2_journal_remove_checkpoint(jh);
+ goto zap_buffer;
+ }
+ }
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index a6d59054e8b3..bf980b5821cc 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1458,7 +1458,11 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ nfsi->attrtimeo_timestamp = now;
+ }
+ }
+- invalid &= ~NFS_INO_INVALID_ATTR;
++
++ /* Don't declare attrcache up to date if there were no attrs! */
++ if (fattr->valid != 0)
++ invalid &= ~NFS_INO_INVALID_ATTR;
++
+ /* Don't invalidate the data if we were to blame */
+ if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)
+ || S_ISLNK(inode->i_mode)))
+diff --git a/fs/ocfs2/resize.c b/fs/ocfs2/resize.c
+index ec55add7604a..2ca64fab715c 100644
+--- a/fs/ocfs2/resize.c
++++ b/fs/ocfs2/resize.c
+@@ -56,11 +56,12 @@ static u16 ocfs2_calc_new_backup_super(struct inode *inode,
+ int new_clusters,
+ u32 first_new_cluster,
+ u16 cl_cpg,
++ u16 old_bg_clusters,
+ int set)
+ {
+ int i;
+ u16 backups = 0;
+- u32 cluster;
++ u32 cluster, lgd_cluster;
+ u64 blkno, gd_blkno, lgd_blkno = le64_to_cpu(gd->bg_blkno);
+
+ for (i = 0; i < OCFS2_MAX_BACKUP_SUPERBLOCKS; i++) {
+@@ -73,6 +74,12 @@ static u16 ocfs2_calc_new_backup_super(struct inode *inode,
+ else if (gd_blkno > lgd_blkno)
+ break;
+
++ /* check if already done backup super */
++ lgd_cluster = ocfs2_blocks_to_clusters(inode->i_sb, lgd_blkno);
++ lgd_cluster += old_bg_clusters;
++ if (lgd_cluster >= cluster)
++ continue;
++
+ if (set)
+ ocfs2_set_bit(cluster % cl_cpg,
+ (unsigned long *)gd->bg_bitmap);
+@@ -101,6 +108,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
+ u16 chain, num_bits, backups = 0;
+ u16 cl_bpc = le16_to_cpu(cl->cl_bpc);
+ u16 cl_cpg = le16_to_cpu(cl->cl_cpg);
++ u16 old_bg_clusters;
+
+ trace_ocfs2_update_last_group_and_inode(new_clusters,
+ first_new_cluster);
+@@ -114,6 +122,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
+
+ group = (struct ocfs2_group_desc *)group_bh->b_data;
+
++ old_bg_clusters = le16_to_cpu(group->bg_bits) / cl_bpc;
+ /* update the group first. */
+ num_bits = new_clusters * cl_bpc;
+ le16_add_cpu(&group->bg_bits, num_bits);
+@@ -129,7 +138,7 @@ static int ocfs2_update_last_group_and_inode(handle_t *handle,
+ group,
+ new_clusters,
+ first_new_cluster,
+- cl_cpg, 1);
++ cl_cpg, old_bg_clusters, 1);
+ le16_add_cpu(&group->bg_free_bits_count, -1 * backups);
+ }
+
+@@ -169,7 +178,7 @@ out_rollback:
+ group,
+ new_clusters,
+ first_new_cluster,
+- cl_cpg, 0);
++ cl_cpg, old_bg_clusters, 0);
+ le16_add_cpu(&group->bg_free_bits_count, backups);
+ le16_add_cpu(&group->bg_bits, -1 * num_bits);
+ le16_add_cpu(&group->bg_free_bits_count, -1 * num_bits);
+diff --git a/fs/splice.c b/fs/splice.c
+index 286417764d6b..8b97331b3b14 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -850,6 +850,13 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+ */
+ int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
+ {
++ /*
++ * Check for signal early to make process killable when there are
++ * always buffers available
++ */
++ if (signal_pending(current))
++ return -ERESTARTSYS;
++
+ while (!pipe->nrbufs) {
+ if (!pipe->writers)
+ return 0;
+@@ -928,6 +935,7 @@ ssize_t __splice_from_pipe(struct pipe_inode_info *pipe, struct splice_desc *sd,
+
+ splice_from_pipe_begin(sd);
+ do {
++ cond_resched();
+ ret = splice_from_pipe_next(pipe, sd);
+ if (ret > 0)
+ ret = splice_from_pipe_feed(pipe, sd, actor);
+diff --git a/fs/sysv/inode.c b/fs/sysv/inode.c
+index 3da5ce25faf0..fcdd63c71a2b 100644
+--- a/fs/sysv/inode.c
++++ b/fs/sysv/inode.c
+@@ -176,14 +176,8 @@ void sysv_set_inode(struct inode *inode, dev_t rdev)
+ inode->i_fop = &sysv_dir_operations;
+ inode->i_mapping->a_ops = &sysv_aops;
+ } else if (S_ISLNK(inode->i_mode)) {
+- if (inode->i_blocks) {
+- inode->i_op = &sysv_symlink_inode_operations;
+- inode->i_mapping->a_ops = &sysv_aops;
+- } else {
+- inode->i_op = &sysv_fast_symlink_inode_operations;
+- nd_terminate_link(SYSV_I(inode)->i_data, inode->i_size,
+- sizeof(SYSV_I(inode)->i_data) - 1);
+- }
++ inode->i_op = &sysv_symlink_inode_operations;
++ inode->i_mapping->a_ops = &sysv_aops;
+ } else
+ init_special_inode(inode, inode->i_mode, rdev);
+ }
+diff --git a/include/linux/acpi.h b/include/linux/acpi.h
+index f421dd84f29d..668351a6a683 100644
+--- a/include/linux/acpi.h
++++ b/include/linux/acpi.h
+@@ -110,6 +110,12 @@ int acpi_unregister_ioapic(acpi_handle handle, u32 gsi_base);
+ void acpi_irq_stats_init(void);
+ extern u32 acpi_irq_handled;
+ extern u32 acpi_irq_not_handled;
++extern unsigned int acpi_sci_irq;
++#define INVALID_ACPI_IRQ ((unsigned)-1)
++static inline bool acpi_sci_irq_valid(void)
++{
++ return acpi_sci_irq != INVALID_ACPI_IRQ;
++}
+
+ extern int sbf_port;
+ extern unsigned long acpi_realmode_flags;
+diff --git a/include/linux/enclosure.h b/include/linux/enclosure.h
+index 9a33c5f7e126..f6c229e2bffa 100644
+--- a/include/linux/enclosure.h
++++ b/include/linux/enclosure.h
+@@ -29,7 +29,11 @@
+ /* A few generic types ... taken from ses-2 */
+ enum enclosure_component_type {
+ ENCLOSURE_COMPONENT_DEVICE = 0x01,
++ ENCLOSURE_COMPONENT_CONTROLLER_ELECTRONICS = 0x07,
++ ENCLOSURE_COMPONENT_SCSI_TARGET_PORT = 0x14,
++ ENCLOSURE_COMPONENT_SCSI_INITIATOR_PORT = 0x15,
+ ENCLOSURE_COMPONENT_ARRAY_DEVICE = 0x17,
++ ENCLOSURE_COMPONENT_SAS_EXPANDER = 0x18,
+ };
+
+ /* ses-2 common element status */
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 2179d78b6ea6..ee8090f33757 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -954,6 +954,7 @@ struct journal_s
+ #define JBD2_ABORT_ON_SYNCDATA_ERR 0x040 /* Abort the journal on file
+ * data write error in ordered
+ * mode */
++#define JBD2_REC_ERR 0x080 /* The errno in the sb has been recorded */
+
+ /*
+ * Function declarations for the journaling transaction and buffer
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index ceebf63ef5da..ef706abe56be 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -1525,6 +1525,7 @@ struct page *follow_page(struct vm_area_struct *, unsigned long address,
+ #define FOLL_MLOCK 0x40 /* mark page as mlocked */
+ #define FOLL_SPLIT 0x80 /* don't return transhuge pages, split them */
+ #define FOLL_HWPOISON 0x100 /* check page is hwpoisoned */
++#define FOLL_COW 0x4000 /* internal GUP flag */
+
+ typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
+ void *data);
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 0972470bb072..a67e7d13008b 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -30,9 +30,6 @@
+ descriptor */
+ #define USB_QUIRK_DELAY_INIT 0x00000040
+
+-/* device generates spurious wakeup, ignore remote wakeup capability */
+-#define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200
+-
+ /* device can't handle device_qualifier descriptor requests */
+ #define USB_QUIRK_DEVICE_QUALIFIER 0x00000100
+
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index d29a576e4a16..f3cbf1c14fda 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -56,9 +56,10 @@ struct unix_sock {
+ struct list_head link;
+ atomic_long_t inflight;
+ spinlock_t lock;
+- unsigned int gc_candidate : 1;
+- unsigned int gc_maybe_cycle : 1;
+ unsigned char recursion_level;
++ unsigned long gc_flags;
++#define UNIX_GC_CANDIDATE 0
++#define UNIX_GC_MAYBE_CYCLE 1
+ struct socket_wq peer_wq;
+ wait_queue_t peer_wake;
+ };
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 49c4cfe810d2..acaab5e569e1 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -37,6 +37,7 @@ struct fib6_config {
+ int fc_ifindex;
+ u32 fc_flags;
+ u32 fc_protocol;
++ u32 fc_type; /* only 8 bits are used */
+
+ struct in6_addr fc_dst;
+ struct in6_addr fc_src;
+diff --git a/include/net/ndisc.h b/include/net/ndisc.h
+index 6f9c25a76cd1..cd205e939c71 100644
+--- a/include/net/ndisc.h
++++ b/include/net/ndisc.h
+@@ -117,7 +117,9 @@ static inline struct neighbour *__ipv6_neigh_lookup(struct neigh_table *tbl, str
+ }
+
+ extern int ndisc_init(void);
++extern int ndisc_late_init(void);
+
++extern void ndisc_late_cleanup(void);
+ extern void ndisc_cleanup(void);
+
+ extern int ndisc_rcv(struct sk_buff *skb);
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index 4ea0ec64eada..e60eb4036c0d 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -1587,7 +1587,8 @@ struct sctp_association {
+ * : order. When DATA chunks are out of order,
+ * : SACK's are not delayed (see Section 6).
+ */
+- __u8 sack_needed; /* Do we need to sack the peer? */
++ __u8 sack_needed:1, /* Do we need to sack the peer? */
++ zero_window_announced:1;
+ __u32 sack_cnt;
+
+ /* These are capabilities which our peer advertised. */
+diff --git a/include/xen/interface/io/ring.h b/include/xen/interface/io/ring.h
+index 7d28aff605c7..7dc685b4057d 100644
+--- a/include/xen/interface/io/ring.h
++++ b/include/xen/interface/io/ring.h
+@@ -181,6 +181,20 @@ struct __name##_back_ring { \
+ #define RING_GET_REQUEST(_r, _idx) \
+ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].req))
+
++/*
++ * Get a local copy of a request.
++ *
++ * Use this in preference to RING_GET_REQUEST() so all processing is
++ * done on a local copy that cannot be modified by the other end.
++ *
++ * Note that https://gcc.gnu.org/bugzilla/show_bug.cgi?id=58145 may cause this
++ * to be ineffective where _req is a struct which consists of only bitfields.
++ */
++#define RING_COPY_REQUEST(_r, _idx, _req) do { \
++ /* Use volatile to force the copy into _req. */ \
++ *(_req) = *(volatile typeof(_req))RING_GET_REQUEST(_r, _idx); \
++} while (0)
++
+ #define RING_GET_RESPONSE(_r, _idx) \
+ (&((_r)->sring->ring[((_idx) & (RING_SIZE(_r) - 1))].rsp))
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 2e6c24843eb6..4713480bfe14 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -5366,6 +5366,10 @@ static int perf_tp_filter_match(struct perf_event *event,
+ {
+ void *record = data->raw->data;
+
++ /* only top level events have filters set */
++ if (event->parent)
++ event = event->parent;
++
+ if (likely(!event->filter) || filter_match_preds(event->filter, record))
+ return 1;
+ return 0;
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 9baa6315acf5..43e4342d56a5 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -1181,6 +1181,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
+ if (!desc)
+ return NULL;
+
++ chip_bus_lock(desc);
+ raw_spin_lock_irqsave(&desc->lock, flags);
+
+ /*
+@@ -1194,7 +1195,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
+ if (!action) {
+ WARN(1, "Trying to free already-free IRQ %d\n", irq);
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
+-
++ chip_bus_sync_unlock(desc);
+ return NULL;
+ }
+
+@@ -1223,6 +1224,7 @@ static struct irqaction *__free_irq(unsigned int irq, void *dev_id)
+ #endif
+
+ raw_spin_unlock_irqrestore(&desc->lock, flags);
++ chip_bus_sync_unlock(desc);
+
+ unregister_handler_proc(irq, action);
+
+@@ -1296,9 +1298,7 @@ void free_irq(unsigned int irq, void *dev_id)
+ desc->affinity_notify = NULL;
+ #endif
+
+- chip_bus_lock(desc);
+ kfree(__free_irq(irq, dev_id));
+- chip_bus_sync_unlock(desc);
+ }
+ EXPORT_SYMBOL(free_irq);
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 609a22630674..e29d8005328d 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -5931,11 +5931,11 @@ static int init_rootdomain(struct root_domain *rd)
+ {
+ memset(rd, 0, sizeof(*rd));
+
+- if (!alloc_cpumask_var(&rd->span, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&rd->span, GFP_KERNEL))
+ goto out;
+- if (!alloc_cpumask_var(&rd->online, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&rd->online, GFP_KERNEL))
+ goto free_span;
+- if (!alloc_cpumask_var(&rd->rto_mask, GFP_KERNEL))
++ if (!zalloc_cpumask_var(&rd->rto_mask, GFP_KERNEL))
+ goto free_online;
+
+ if (cpupri_init(&rd->cpupri) != 0)
+diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
+index e32587e7a6ca..ea8d82ee797d 100644
+--- a/kernel/time/ntp.c
++++ b/kernel/time/ntp.c
+@@ -34,6 +34,7 @@ unsigned long tick_nsec;
+ static u64 tick_length;
+ static u64 tick_length_base;
+
++#define SECS_PER_DAY 86400
+ #define MAX_TICKADJ 500LL /* usecs */
+ #define MAX_TICKADJ_SCALED \
+ (((MAX_TICKADJ * NSEC_PER_USEC) << NTP_SCALE_SHIFT) / NTP_INTERVAL_FREQ)
+@@ -78,6 +79,9 @@ static long time_adjust;
+ /* constant (boot-param configurable) NTP tick adjustment (upscaled) */
+ static s64 ntp_tick_adj;
+
++/* second value of the next pending leapsecond, or KTIME_MAX if no leap */
++static s64 ntp_next_leap_sec = KTIME_MAX;
++
+ #ifdef CONFIG_NTP_PPS
+
+ /*
+@@ -354,6 +358,8 @@ void ntp_clear(void)
+ time_maxerror = NTP_PHASE_LIMIT;
+ time_esterror = NTP_PHASE_LIMIT;
+
++ ntp_next_leap_sec = KTIME_MAX;
++
+ ntp_update_frequency();
+
+ tick_length = tick_length_base;
+@@ -377,6 +383,21 @@ u64 ntp_tick_length(void)
+ return ret;
+ }
+
++/**
++ * ntp_get_next_leap - Returns the next leapsecond in CLOCK_REALTIME ktime_t
++ *
++ * Provides the time of the next leapsecond against CLOCK_REALTIME in
++ * a ktime_t format. Returns KTIME_MAX if no leapsecond is pending.
++ */
++ktime_t ntp_get_next_leap(void)
++{
++ ktime_t ret;
++
++ if ((time_state == TIME_INS) && (time_status & STA_INS))
++ return ktime_set(ntp_next_leap_sec, 0);
++ ret.tv64 = KTIME_MAX;
++ return ret;
++}
+
+ /*
+ * this routine handles the overflow of the microsecond field
+@@ -403,15 +424,21 @@ int second_overflow(unsigned long secs)
+ */
+ switch (time_state) {
+ case TIME_OK:
+- if (time_status & STA_INS)
++ if (time_status & STA_INS) {
+ time_state = TIME_INS;
+- else if (time_status & STA_DEL)
++ ntp_next_leap_sec = secs + SECS_PER_DAY -
++ (secs % SECS_PER_DAY);
++ } else if (time_status & STA_DEL) {
+ time_state = TIME_DEL;
++ ntp_next_leap_sec = secs + SECS_PER_DAY -
++ ((secs+1) % SECS_PER_DAY);
++ }
+ break;
+ case TIME_INS:
+- if (!(time_status & STA_INS))
++ if (!(time_status & STA_INS)) {
++ ntp_next_leap_sec = KTIME_MAX;
+ time_state = TIME_OK;
+- else if (secs % 86400 == 0) {
++ } else if (secs % SECS_PER_DAY == 0) {
+ leap = -1;
+ time_state = TIME_OOP;
+ time_tai++;
+@@ -420,10 +447,12 @@ int second_overflow(unsigned long secs)
+ }
+ break;
+ case TIME_DEL:
+- if (!(time_status & STA_DEL))
++ if (!(time_status & STA_DEL)) {
++ ntp_next_leap_sec = KTIME_MAX;
+ time_state = TIME_OK;
+- else if ((secs + 1) % 86400 == 0) {
++ } else if ((secs + 1) % SECS_PER_DAY == 0) {
+ leap = 1;
++ ntp_next_leap_sec = KTIME_MAX;
+ time_tai--;
+ time_state = TIME_WAIT;
+ printk(KERN_NOTICE
+@@ -431,6 +460,7 @@ int second_overflow(unsigned long secs)
+ }
+ break;
+ case TIME_OOP:
++ ntp_next_leap_sec = KTIME_MAX;
+ time_state = TIME_WAIT;
+ break;
+
+@@ -549,6 +579,7 @@ static inline void process_adj_status(struct timex *txc, struct timespec *ts)
+ if ((time_status & STA_PLL) && !(txc->status & STA_PLL)) {
+ time_state = TIME_OK;
+ time_status = STA_UNSYNC;
++ ntp_next_leap_sec = KTIME_MAX;
+ /* restart PPS frequency calibration */
+ pps_reset_freq_interval();
+ }
+@@ -619,7 +650,7 @@ static inline void process_adjtimex_modes(struct timex *txc, struct timespec *ts
+ * adjtimex mainly allows reading (and writing, if superuser) of
+ * kernel time-keeping variables. used by xntpd.
+ */
+-int do_adjtimex(struct timex *txc)
++int __do_adjtimex(struct timex *txc)
+ {
+ struct timespec ts;
+ int result;
+diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
+index 32f0cb8f1fe8..a72f63e2f285 100644
+--- a/kernel/time/timekeeping.c
++++ b/kernel/time/timekeeping.c
+@@ -21,6 +21,9 @@
+ #include <linux/tick.h>
+ #include <linux/stop_machine.h>
+
++extern ktime_t ntp_get_next_leap(void);
++extern int __do_adjtimex(struct timex *);
++
+ /* Structure holding internal timekeeping values. */
+ struct timekeeper {
+ /* Current clocksource used for timekeeping. */
+@@ -30,6 +33,8 @@ struct timekeeper {
+ /* The shift value of the current clocksource. */
+ int shift;
+
++ /* CLOCK_MONOTONIC time value of a pending leap-second*/
++ ktime_t next_leap_ktime;
+ /* Number of clock cycles in one NTP interval. */
+ cycle_t cycle_interval;
+ /* Number of clock shifted nano seconds in one NTP interval. */
+@@ -186,6 +191,17 @@ static void update_rt_offset(void)
+ timekeeper.offs_real = timespec_to_ktime(tmp);
+ }
+
++/*
++ * tk_update_leap_state - helper to update the next_leap_ktime
++ */
++static inline void tk_update_leap_state(struct timekeeper *tk)
++{
++ tk->next_leap_ktime = ntp_get_next_leap();
++ if (tk->next_leap_ktime.tv64 != KTIME_MAX)
++ /* Convert to monotonic time */
++ tk->next_leap_ktime = ktime_sub(tk->next_leap_ktime, tk->offs_real);
++}
++
+ /* must hold write on timekeeper.lock */
+ static void timekeeping_update(bool clearntp)
+ {
+@@ -193,6 +209,7 @@ static void timekeeping_update(bool clearntp)
+ timekeeper.ntp_error = 0;
+ ntp_clear();
+ }
++ tk_update_leap_state(&timekeeper);
+ update_rt_offset();
+ update_vsyscall(&timekeeper.xtime, &timekeeper.wall_to_monotonic,
+ timekeeper.clock, timekeeper.mult);
+@@ -1329,10 +1346,16 @@ ktime_t ktime_get_update_offsets(ktime_t *offs_real, ktime_t *offs_boot)
+
+ *offs_real = timekeeper.offs_real;
+ *offs_boot = timekeeper.offs_boot;
++
++ now = ktime_add_ns(ktime_set(secs, 0), nsecs);
++ now = ktime_sub(now, *offs_real);
++
++ /* Handle leapsecond insertion adjustments */
++ if (unlikely(now.tv64 >= timekeeper.next_leap_ktime.tv64))
++ *offs_real = ktime_sub(timekeeper.offs_real, ktime_set(1, 0));
++
+ } while (read_seqretry(&timekeeper.lock, seq));
+
+- now = ktime_add_ns(ktime_set(secs, 0), nsecs);
+- now = ktime_sub(now, *offs_real);
+ return now;
+ }
+ #endif
+@@ -1354,6 +1377,16 @@ ktime_t ktime_get_monotonic_offset(void)
+ }
+ EXPORT_SYMBOL_GPL(ktime_get_monotonic_offset);
+
++/*
++ * do_adjtimex() - Accessor function to NTP __do_adjtimex function
++ */
++int do_adjtimex(struct timex *txc)
++{
++ int ret;
++ ret = __do_adjtimex(txc);
++ tk_update_leap_state(&timekeeper);
++ return ret;
++}
+
+ /**
+ * xtime_update() - advances the timekeeping infrastructure
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index bd0f1c499e0a..6cbd36f422e6 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1549,12 +1549,6 @@ rb_set_commit_to_write(struct ring_buffer_per_cpu *cpu_buffer)
+ goto again;
+ }
+
+-static void rb_reset_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+-{
+- cpu_buffer->read_stamp = cpu_buffer->reader_page->page->time_stamp;
+- cpu_buffer->reader_page->read = 0;
+-}
+-
+ static void rb_inc_iter(struct ring_buffer_iter *iter)
+ {
+ struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
+@@ -3094,7 +3088,7 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+
+ /* Finally update the reader page to the new head */
+ cpu_buffer->reader_page = reader;
+- rb_reset_reader_page(cpu_buffer);
++ cpu_buffer->reader_page->read = 0;
+
+ if (overwrite != cpu_buffer->last_overrun) {
+ cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun;
+@@ -3104,6 +3098,10 @@ rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer)
+ goto again;
+
+ out:
++ /* Update the read_stamp on the first event */
++ if (reader && reader->read == 0)
++ cpu_buffer->read_stamp = reader->page->time_stamp;
++
+ arch_spin_unlock(&cpu_buffer->lock);
+ local_irq_restore(flags);
+
+diff --git a/lib/devres.c b/lib/devres.c
+index 80b9c76d436a..584c2dcfcb03 100644
+--- a/lib/devres.c
++++ b/lib/devres.c
+@@ -390,7 +390,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask)
+ if (!iomap)
+ return;
+
+- for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
++ for (i = 0; i < PCIM_IOMAP_MAX; i++) {
+ if (!(mask & (1 << i)))
+ continue;
+
+diff --git a/mm/backing-dev.c b/mm/backing-dev.c
+index dd8e2aafb07e..0e51d2e808ab 100644
+--- a/mm/backing-dev.c
++++ b/mm/backing-dev.c
+@@ -843,8 +843,9 @@ EXPORT_SYMBOL(congestion_wait);
+ * jiffies for either a BDI to exit congestion of the given @sync queue
+ * or a write to complete.
+ *
+- * In the absence of zone congestion, cond_resched() is called to yield
+- * the processor if necessary but otherwise does not sleep.
++ * In the absence of zone congestion, a short sleep or a cond_resched is
++ * performed to yield the processor and to allow other subsystems to make
++ * a forward progress.
+ *
+ * The return value is 0 if the sleep is for the full timeout. Otherwise,
+ * it is the number of jiffies that were still remaining when the function
+@@ -864,7 +865,19 @@ long wait_iff_congested(struct zone *zone, int sync, long timeout)
+ */
+ if (atomic_read(&nr_bdi_congested[sync]) == 0 ||
+ !zone_is_reclaim_congested(zone)) {
+- cond_resched();
++
++ /*
++ * Memory allocation/reclaim might be called from a WQ
++ * context and the current implementation of the WQ
++ * concurrency control doesn't recognize that a particular
++ * WQ is congested if the worker thread is looping without
++ * ever sleeping. Therefore we have to do a short sleep
++ * here rather than calling cond_resched().
++ */
++ if (current->flags & PF_WQ_WORKER)
++ schedule_timeout_uninterruptible(1);
++ else
++ cond_resched();
+
+ /* In case we scheduled, work out time remaining */
+ ret = timeout - (jiffies - start);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index e622aab7fd8c..6726bfea8623 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2835,12 +2835,12 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ } else if (unlikely(is_hugetlb_entry_hwpoisoned(entry)))
+ return VM_FAULT_HWPOISON_LARGE |
+ VM_FAULT_SET_HINDEX(h - hstates);
++ } else {
++ ptep = huge_pte_alloc(mm, address, huge_page_size(h));
++ if (!ptep)
++ return VM_FAULT_OOM;
+ }
+
+- ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+- if (!ptep)
+- return VM_FAULT_OOM;
+-
+ /*
+ * Serialize hugepage allocation and instantiation, so that we don't
+ * get spurious allocation failures if two CPUs race to instantiate
+@@ -2929,13 +2929,17 @@ out_page_table_lock:
+ unlock_page(pagecache_page);
+ put_page(pagecache_page);
+ }
+- if (page != pagecache_page)
+- unlock_page(page);
+- put_page(page);
+-
+ out_mutex:
+ mutex_unlock(&hugetlb_instantiation_mutex);
+-
++ /*
++ * Generally it's safe to hold refcount during waiting page lock. But
++ * here we just wait to defer the next page fault to avoid busy loop and
++ * the page is not used after unlocked before returning from the current
++ * page fault. So we are safe from accessing freed page, even if we wait
++ * here without taking refcount.
++ */
++ if (need_wait_lock)
++ wait_on_page_locked(page);
+ return ret;
+ }
+
+diff --git a/mm/memory.c b/mm/memory.c
+index 4774579d8acb..97019112eac4 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1447,6 +1447,24 @@ int zap_vma_ptes(struct vm_area_struct *vma, unsigned long address,
+ }
+ EXPORT_SYMBOL_GPL(zap_vma_ptes);
+
++static inline bool can_follow_write_pte(pte_t pte, struct page *page,
++ unsigned int flags)
++{
++ if (pte_write(pte))
++ return true;
++
++ /*
++ * Make sure that we are really following CoWed page. We do not really
++ * have to care about exclusiveness of the page because we only want
++ * to ensure that once COWed page hasn't disappeared in the meantime
++ * or it hasn't been merged to a KSM page.
++ */
++ if ((flags & FOLL_FORCE) && (flags & FOLL_COW))
++ return page && PageAnon(page) && !PageKsm(page);
++
++ return false;
++}
++
+ /**
+ * follow_page - look up a page descriptor from a user-virtual address
+ * @vma: vm_area_struct mapping @address
+@@ -1529,10 +1547,13 @@ split_fallthrough:
+ pte = *ptep;
+ if (!pte_present(pte))
+ goto no_page;
+- if ((flags & FOLL_WRITE) && !pte_write(pte))
+- goto unlock;
+
+ page = vm_normal_page(vma, address, pte);
++ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, page, flags)) {
++ pte_unmap_unlock(ptep, ptl);
++ return NULL;
++ }
++
+ if (unlikely(!page)) {
+ if ((flags & FOLL_DUMP) ||
+ !is_zero_pfn(pte_pfn(pte)))
+@@ -1575,7 +1596,7 @@ split_fallthrough:
+ unlock_page(page);
+ }
+ }
+-unlock:
++
+ pte_unmap_unlock(ptep, ptl);
+ out:
+ return page;
+@@ -1809,17 +1830,13 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ * The VM_FAULT_WRITE bit tells us that
+ * do_wp_page has broken COW when necessary,
+ * even if maybe_mkwrite decided not to set
+- * pte_write. We can thus safely do subsequent
+- * page lookups as if they were reads. But only
+- * do so when looping for pte_write is futile:
+- * in some cases userspace may also be wanting
+- * to write to the gotten user page, which a
+- * read fault here might prevent (a readonly
+- * page might get reCOWed by userspace write).
++ * pte_write. We cannot simply drop FOLL_WRITE
++ * here because the COWed page might be gone by
++ * the time we do the subsequent page lookups.
+ */
+ if ((ret & VM_FAULT_WRITE) &&
+ !(vma->vm_flags & VM_WRITE))
+- foll_flags &= ~FOLL_WRITE;
++ foll_flags |= FOLL_COW;
+
+ cond_resched();
+ }
+diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
+index 09d87b709179..223232a8c98c 100644
+--- a/mm/memory_hotplug.c
++++ b/mm/memory_hotplug.c
+@@ -716,23 +716,30 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
+ */
+ static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn)
+ {
+- unsigned long pfn;
++ unsigned long pfn, sec_end_pfn;
+ struct zone *zone = NULL;
+ struct page *page;
+ int i;
+- for (pfn = start_pfn;
++ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn);
+ pfn < end_pfn;
+- pfn += MAX_ORDER_NR_PAGES) {
+- i = 0;
+- /* This is just a CONFIG_HOLES_IN_ZONE check.*/
+- while ((i < MAX_ORDER_NR_PAGES) && !pfn_valid_within(pfn + i))
+- i++;
+- if (i == MAX_ORDER_NR_PAGES)
++ pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) {
++ /* Make sure the memory section is present first */
++ if (!present_section_nr(pfn_to_section_nr(pfn)))
+ continue;
+- page = pfn_to_page(pfn + i);
+- if (zone && page_zone(page) != zone)
+- return 0;
+- zone = page_zone(page);
++ for (; pfn < sec_end_pfn && pfn < end_pfn;
++ pfn += MAX_ORDER_NR_PAGES) {
++ i = 0;
++ /* This is just a CONFIG_HOLES_IN_ZONE check.*/
++ while ((i < MAX_ORDER_NR_PAGES) &&
++ !pfn_valid_within(pfn + i))
++ i++;
++ if (i == MAX_ORDER_NR_PAGES)
++ continue;
++ page = pfn_to_page(pfn + i);
++ if (zone && page_zone(page) != zone)
++ return 0;
++ zone = page_zone(page);
++ }
+ }
+ return 1;
+ }
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 7db1b9bab492..e89c0f6d9f9f 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1139,13 +1139,14 @@ static const struct file_operations proc_vmstat_file_operations = {
+ #endif /* CONFIG_PROC_FS */
+
+ #ifdef CONFIG_SMP
++static struct workqueue_struct *vmstat_wq;
+ static DEFINE_PER_CPU(struct delayed_work, vmstat_work);
+ int sysctl_stat_interval __read_mostly = HZ;
+
+ static void vmstat_update(struct work_struct *w)
+ {
+ refresh_cpu_vm_stats(smp_processor_id());
+- schedule_delayed_work(&__get_cpu_var(vmstat_work),
++ queue_delayed_work(vmstat_wq, &__get_cpu_var(vmstat_work),
+ round_jiffies_relative(sysctl_stat_interval));
+ }
+
+@@ -1154,7 +1155,7 @@ static void __cpuinit start_cpu_timer(int cpu)
+ struct delayed_work *work = &per_cpu(vmstat_work, cpu);
+
+ INIT_DELAYED_WORK_DEFERRABLE(work, vmstat_update);
+- schedule_delayed_work_on(cpu, work, __round_jiffies_relative(HZ, cpu));
++ queue_delayed_work_on(cpu, vmstat_wq, work, __round_jiffies_relative(HZ, cpu));
+ }
+
+ /*
+@@ -1204,6 +1205,7 @@ static int __init setup_vmstat(void)
+
+ register_cpu_notifier(&vmstat_notifier);
+
++ vmstat_wq = alloc_workqueue("vmstat", WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
+ for_each_online_cpu(cpu)
+ start_cpu_timer(cpu);
+ #endif
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index ba96ad93d136..bc412ca9041e 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -695,7 +695,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
+ if (likely(!sum)) {
+ if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE))
+ netdev_rx_csum_fault(skb->dev);
+- skb->ip_summed = CHECKSUM_UNNECESSARY;
++ if (!skb_shared(skb))
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
+ }
+ return sum;
+ }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 4f679bf4f12e..573d62b9cbeb 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5368,6 +5368,9 @@ int __netdev_update_features(struct net_device *dev)
+ netdev_err(dev,
+ "set_features() failed (%d); wanted %pNF, left %pNF\n",
+ err, &features, &dev->features);
++ /* return non-0 since some features might have changed and
++ * it's better to fire a spurious notification than miss it
++ */
+ return -1;
+ }
+
+diff --git a/net/core/dst.c b/net/core/dst.c
+index 43d94cedbf7c..48cff898b5a4 100644
+--- a/net/core/dst.c
++++ b/net/core/dst.c
+@@ -269,10 +269,11 @@ void dst_release(struct dst_entry *dst)
+ {
+ if (dst) {
+ int newrefcnt;
++ unsigned short nocache = dst->flags & DST_NOCACHE;
+
+ newrefcnt = atomic_dec_return(&dst->__refcnt);
+ WARN_ON(newrefcnt < 0);
+- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) {
++ if (!newrefcnt && unlikely(nocache)) {
+ dst = dst_destroy(dst);
+ if (dst)
+ __dst_free(dst);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index ebd4b21cb9d4..dbd00dfbc6ce 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2186,7 +2186,7 @@ static int pneigh_fill_info(struct sk_buff *skb, struct pneigh_entry *pn,
+ ndm->ndm_pad2 = 0;
+ ndm->ndm_flags = pn->flags | NTF_PROXY;
+ ndm->ndm_type = NDA_DST;
+- ndm->ndm_ifindex = pn->dev->ifindex;
++ ndm->ndm_ifindex = pn->dev ? pn->dev->ifindex : 0;
+ ndm->ndm_state = NUD_NONE;
+
+ NLA_PUT(skb, NDA_DST, tbl->key_len, pn->key);
+@@ -2259,7 +2259,7 @@ static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
+ if (h > s_h)
+ s_idx = 0;
+ for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
+- if (dev_net(n->dev) != net)
++ if (pneigh_net(n) != net)
+ continue;
+ if (idx < s_idx)
+ goto next;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 2d3290496a0a..55b08e09f0c8 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -89,7 +89,7 @@ int sysctl_tcp_adv_win_scale __read_mostly = 1;
+ EXPORT_SYMBOL(sysctl_tcp_adv_win_scale);
+
+ /* rfc5961 challenge ack rate limiting */
+-int sysctl_tcp_challenge_ack_limit = 100;
++int sysctl_tcp_challenge_ack_limit = 1000;
+
+ int sysctl_tcp_stdurg __read_mostly;
+ int sysctl_tcp_rfc1337 __read_mostly;
+@@ -3701,13 +3701,18 @@ static void tcp_send_challenge_ack(struct sock *sk)
+ /* unprotected vars, we dont care of overwrites */
+ static u32 challenge_timestamp;
+ static unsigned int challenge_count;
+- u32 now = jiffies / HZ;
++ u32 count, now = jiffies / HZ;
+
+ if (now != challenge_timestamp) {
++ u32 half = (sysctl_tcp_challenge_ack_limit + 1) >> 1;
++
+ challenge_timestamp = now;
+- challenge_count = 0;
++ ACCESS_ONCE(challenge_count) = half +
++ (u32)(((u64)random32() * sysctl_tcp_challenge_ack_limit) >> 32);
+ }
+- if (++challenge_count <= sysctl_tcp_challenge_ack_limit) {
++ count = ACCESS_ONCE(challenge_count);
++ if (count > 0) {
++ ACCESS_ONCE(challenge_count) = count - 1;
+ NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPCHALLENGEACK);
+ tcp_send_ack(sk);
+ }
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 727678dc7968..6e212f7a5782 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -983,7 +983,8 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
+ }
+
+ md5sig = rcu_dereference_protected(tp->md5sig_info,
+- sock_owned_by_user(sk));
++ sock_owned_by_user(sk) ||
++ lockdep_is_held(&sk->sk_lock.slock));
+ if (!md5sig) {
+ md5sig = kmalloc(sizeof(*md5sig), gfp);
+ if (!md5sig)
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 5f8c20b67da2..8629205717b5 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1175,6 +1175,7 @@ int udp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+ int peeked, off = 0;
+ int err;
+ int is_udplite = IS_UDPLITE(sk);
++ bool checksum_valid = false;
+ bool slow;
+
+ if (flags & MSG_ERRQUEUE)
+@@ -1200,11 +1201,12 @@ try_again:
+ */
+
+ if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+- if (udp_lib_checksum_complete(skb))
++ checksum_valid = !udp_lib_checksum_complete(skb);
++ if (!checksum_valid)
+ goto csum_copy_err;
+ }
+
+- if (skb_csum_unnecessary(skb))
++ if (checksum_valid || skb_csum_unnecessary(skb))
+ err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+ msg->msg_iov, copied);
+ else {
+diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
+index 2d8ddba9ee58..c8c6a121298b 100644
+--- a/net/ipv6/addrlabel.c
++++ b/net/ipv6/addrlabel.c
+@@ -558,7 +558,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
+
+ rcu_read_lock();
+ p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
+- if (p && ip6addrlbl_hold(p))
++ if (p && !ip6addrlbl_hold(p))
+ p = NULL;
+ lseq = ip6addrlbl_table.seq;
+ rcu_read_unlock();
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 5300ef35fd41..8ddb56ff0c7a 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -1161,6 +1161,9 @@ static int __init inet6_init(void)
+ err = ip6_route_init();
+ if (err)
+ goto ip6_route_fail;
++ err = ndisc_late_init();
++ if (err)
++ goto ndisc_late_fail;
+ err = ip6_flowlabel_init();
+ if (err)
+ goto ip6_flowlabel_fail;
+@@ -1221,6 +1224,8 @@ ipv6_exthdrs_fail:
+ addrconf_fail:
+ ip6_flowlabel_cleanup();
+ ip6_flowlabel_fail:
++ ndisc_late_cleanup();
++ndisc_late_fail:
+ ip6_route_cleanup();
+ ip6_route_fail:
+ #ifdef CONFIG_PROC_FS
+@@ -1288,6 +1293,7 @@ static void __exit inet6_exit(void)
+ ipv6_exthdrs_exit();
+ addrconf_cleanup();
+ ip6_flowlabel_cleanup();
++ ndisc_late_cleanup();
+ ip6_route_cleanup();
+ #ifdef CONFIG_PROC_FS
+
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index fc5ce6e9dc6f..e6b7a0031a14 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1595,6 +1595,8 @@ static DEFINE_SPINLOCK(fib6_gc_lock);
+
+ void fib6_run_gc(unsigned long expires, struct net *net, bool force)
+ {
++ unsigned long now;
++
+ if (force) {
+ spin_lock_bh(&fib6_gc_lock);
+ } else if (!spin_trylock_bh(&fib6_gc_lock)) {
+@@ -1607,10 +1609,12 @@ void fib6_run_gc(unsigned long expires, struct net *net, bool force)
+ gc_args.more = icmp6_dst_gc();
+
+ fib6_clean_all(net, fib6_age, 0, NULL);
++ now = jiffies;
++ net->ipv6.ip6_rt_last_gc = now;
+
+ if (gc_args.more)
+ mod_timer(&net->ipv6.ip6_fib_timer,
+- round_jiffies(jiffies
++ round_jiffies(now
+ + net->ipv6.sysctl.ip6_rt_gc_interval));
+ else
+ del_timer(&net->ipv6.ip6_fib_timer);
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
+index abe1f768b5b6..c5fa9df58e53 100644
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -117,7 +117,7 @@ static int __ip6mr_fill_mroute(struct mr6_table *mrt, struct sk_buff *skb,
+ struct mfc6_cache *c, struct rtmsg *rtm);
+ static int ip6mr_rtm_dumproute(struct sk_buff *skb,
+ struct netlink_callback *cb);
+-static void mroute_clean_tables(struct mr6_table *mrt);
++static void mroute_clean_tables(struct mr6_table *mrt, bool all);
+ static void ipmr_expire_process(unsigned long arg);
+
+ #ifdef CONFIG_IPV6_MROUTE_MULTIPLE_TABLES
+@@ -333,8 +333,8 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
+
+ static void ip6mr_free_table(struct mr6_table *mrt)
+ {
+- del_timer(&mrt->ipmr_expire_timer);
+- mroute_clean_tables(mrt);
++ del_timer_sync(&mrt->ipmr_expire_timer);
++ mroute_clean_tables(mrt, true);
+ kfree(mrt);
+ }
+
+@@ -1472,7 +1472,7 @@ static int ip6mr_mfc_add(struct net *net, struct mr6_table *mrt,
+ * Close the multicast socket, and clear the vif tables etc
+ */
+
+-static void mroute_clean_tables(struct mr6_table *mrt)
++static void mroute_clean_tables(struct mr6_table *mrt, bool all)
+ {
+ int i;
+ LIST_HEAD(list);
+@@ -1482,8 +1482,9 @@ static void mroute_clean_tables(struct mr6_table *mrt)
+ * Shut down all active vif entries
+ */
+ for (i = 0; i < mrt->maxvif; i++) {
+- if (!(mrt->vif6_table[i].flags & VIFF_STATIC))
+- mif6_delete(mrt, i, &list);
++ if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC))
++ continue;
++ mif6_delete(mrt, i, &list);
+ }
+ unregister_netdevice_many(&list);
+
+@@ -1492,7 +1493,7 @@ static void mroute_clean_tables(struct mr6_table *mrt)
+ */
+ for (i = 0; i < MFC6_LINES; i++) {
+ list_for_each_entry_safe(c, next, &mrt->mfc6_cache_array[i], list) {
+- if (c->mfc_flags & MFC_STATIC)
++ if (!all && (c->mfc_flags & MFC_STATIC))
+ continue;
+ write_lock_bh(&mrt_lock);
+ list_del(&c->list);
+@@ -1546,7 +1547,7 @@ int ip6mr_sk_done(struct sock *sk)
+ net->ipv6.devconf_all->mc_forwarding--;
+ write_unlock_bh(&mrt_lock);
+
+- mroute_clean_tables(mrt);
++ mroute_clean_tables(mrt, false);
+ err = 0;
+ break;
+ }
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index e235b4c2b1be..02e656886c25 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1867,24 +1867,28 @@ int __init ndisc_init(void)
+ if (err)
+ goto out_unregister_pernet;
+ #endif
+- err = register_netdevice_notifier(&ndisc_netdev_notifier);
+- if (err)
+- goto out_unregister_sysctl;
+ out:
+ return err;
+
+-out_unregister_sysctl:
+ #ifdef CONFIG_SYSCTL
+- neigh_sysctl_unregister(&nd_tbl.parms);
+ out_unregister_pernet:
+-#endif
+ unregister_pernet_subsys(&ndisc_net_ops);
+ goto out;
++#endif
+ }
+
+-void ndisc_cleanup(void)
++int __init ndisc_late_init(void)
++{
++ return register_netdevice_notifier(&ndisc_netdev_notifier);
++}
++
++void ndisc_late_cleanup(void)
+ {
+ unregister_netdevice_notifier(&ndisc_netdev_notifier);
++}
++
++void ndisc_cleanup(void)
++{
+ #ifdef CONFIG_SYSCTL
+ neigh_sysctl_unregister(&nd_tbl.parms);
+ #endif
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 7ab7f8a5ee4f..794cd2afc66f 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1230,7 +1230,6 @@ static void icmp6_clean_all(int (*func)(struct rt6_info *rt, void *arg),
+
+ static int ip6_dst_gc(struct dst_ops *ops)
+ {
+- unsigned long now = jiffies;
+ struct net *net = container_of(ops, struct net, ipv6.ip6_dst_ops);
+ int rt_min_interval = net->ipv6.sysctl.ip6_rt_gc_min_interval;
+ int rt_max_size = net->ipv6.sysctl.ip6_rt_max_size;
+@@ -1240,13 +1239,12 @@ static int ip6_dst_gc(struct dst_ops *ops)
+ int entries;
+
+ entries = dst_entries_get_fast(ops);
+- if (time_after(rt_last_gc + rt_min_interval, now) &&
++ if (time_after(rt_last_gc + rt_min_interval, jiffies) &&
+ entries <= rt_max_size)
+ goto out;
+
+ net->ipv6.ip6_rt_gc_expire++;
+ fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
+- net->ipv6.ip6_rt_last_gc = now;
+ entries = dst_entries_get_slow(ops);
+ if (entries < ops->gc_thresh)
+ net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
+@@ -1401,8 +1399,18 @@ int ip6_route_add(struct fib6_config *cfg)
+ }
+ rt->dst.output = ip6_pkt_discard_out;
+ rt->dst.input = ip6_pkt_discard;
+- rt->dst.error = -ENETUNREACH;
+ rt->rt6i_flags = RTF_REJECT|RTF_NONEXTHOP;
++ switch (cfg->fc_type) {
++ case RTN_BLACKHOLE:
++ rt->dst.error = -EINVAL;
++ break;
++ case RTN_PROHIBIT:
++ rt->dst.error = -EACCES;
++ break;
++ default:
++ rt->dst.error = -ENETUNREACH;
++ break;
++ }
+ goto install_route;
+ }
+
+@@ -2345,8 +2353,11 @@ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
+ cfg->fc_src_len = rtm->rtm_src_len;
+ cfg->fc_flags = RTF_UP;
+ cfg->fc_protocol = rtm->rtm_protocol;
++ cfg->fc_type = rtm->rtm_type;
+
+- if (rtm->rtm_type == RTN_UNREACHABLE)
++ if (rtm->rtm_type == RTN_UNREACHABLE ||
++ rtm->rtm_type == RTN_BLACKHOLE ||
++ rtm->rtm_type == RTN_PROHIBIT)
+ cfg->fc_flags |= RTF_REJECT;
+
+ if (rtm->rtm_type == RTN_LOCAL)
+@@ -2476,8 +2487,19 @@ static int rt6_fill_node(struct net *net,
+ table = RT6_TABLE_UNSPEC;
+ rtm->rtm_table = table;
+ NLA_PUT_U32(skb, RTA_TABLE, table);
+- if (rt->rt6i_flags & RTF_REJECT)
+- rtm->rtm_type = RTN_UNREACHABLE;
++ if (rt->rt6i_flags & RTF_REJECT) {
++ switch (rt->dst.error) {
++ case -EINVAL:
++ rtm->rtm_type = RTN_BLACKHOLE;
++ break;
++ case -EACCES:
++ rtm->rtm_type = RTN_PROHIBIT;
++ break;
++ default:
++ rtm->rtm_type = RTN_UNREACHABLE;
++ break;
++ }
++ }
+ else if (rt->rt6i_flags & RTF_LOCAL)
+ rtm->rtm_type = RTN_LOCAL;
+ else if (rt->dst.dev && (rt->dst.dev->flags & IFF_LOOPBACK))
+diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
+index 4f3cec12aa85..aa109da50001 100644
+--- a/net/ipv6/tunnel6.c
++++ b/net/ipv6/tunnel6.c
+@@ -145,6 +145,16 @@ static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ break;
+ }
+
++static void tunnel46_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
++ u8 type, u8 code, int offset, __be32 info)
++{
++ struct xfrm6_tunnel *handler;
++
++ for_each_tunnel_rcu(tunnel46_handlers, handler)
++ if (!handler->err_handler(skb, opt, type, code, offset, info))
++ break;
++}
++
+ static const struct inet6_protocol tunnel6_protocol = {
+ .handler = tunnel6_rcv,
+ .err_handler = tunnel6_err,
+@@ -153,7 +163,7 @@ static const struct inet6_protocol tunnel6_protocol = {
+
+ static const struct inet6_protocol tunnel46_protocol = {
+ .handler = tunnel46_rcv,
+- .err_handler = tunnel6_err,
++ .err_handler = tunnel46_err,
+ .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+ };
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 2f99b12b717e..ea5023ba9532 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -345,6 +345,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
+ int peeked, off = 0;
+ int err;
+ int is_udplite = IS_UDPLITE(sk);
++ bool checksum_valid = false;
+ int is_udp4;
+ bool slow;
+
+@@ -376,11 +377,12 @@ try_again:
+ */
+
+ if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+- if (udp_lib_checksum_complete(skb))
++ checksum_valid = !udp_lib_checksum_complete(skb);
++ if (!checksum_valid)
+ goto csum_copy_err;
+ }
+
+- if (skb_csum_unnecessary(skb))
++ if (checksum_valid || skb_csum_unnecessary(skb))
+ err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
+ msg->msg_iov, copied );
+ else {
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 49aaefd99635..7ed81ee4d6a2 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -757,10 +757,8 @@ void mesh_plink_broken(struct sta_info *sta)
+ static void mesh_path_node_reclaim(struct rcu_head *rp)
+ {
+ struct mpath_node *node = container_of(rp, struct mpath_node, rcu);
+- struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
+
+ del_timer_sync(&node->mpath->timer);
+- atomic_dec(&sdata->u.mesh.mpaths);
+ kfree(node->mpath);
+ kfree(node);
+ }
+@@ -768,8 +766,9 @@ static void mesh_path_node_reclaim(struct rcu_head *rp)
+ /* needs to be called with the corresponding hashwlock taken */
+ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
+ {
+- struct mesh_path *mpath;
+- mpath = node->mpath;
++ struct mesh_path *mpath = node->mpath;
++ struct ieee80211_sub_if_data *sdata = node->mpath->sdata;
++
+ spin_lock(&mpath->state_lock);
+ mpath->flags |= MESH_PATH_RESOLVING;
+ if (mpath->is_gate)
+@@ -777,6 +776,7 @@ static void __mesh_path_del(struct mesh_table *tbl, struct mpath_node *node)
+ hlist_del_rcu(&node->list);
+ call_rcu(&node->rcu, mesh_path_node_reclaim);
+ spin_unlock(&mpath->state_lock);
++ atomic_dec(&sdata->u.mesh.mpaths);
+ atomic_dec(&tbl->entries);
+ }
+
+diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
+index abc31d7bd2a5..1dae14232a52 100644
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2384,7 +2384,7 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+
+ if (ifmgd->rssi_min_thold != ifmgd->rssi_max_thold &&
+ ifmgd->count_beacon_signal >= IEEE80211_SIGNAL_AVE_MIN_COUNT) {
+- int sig = ifmgd->ave_beacon_signal;
++ int sig = ifmgd->ave_beacon_signal / 16;
+ int last_sig = ifmgd->last_ave_beacon_signal;
+
+ /*
+diff --git a/net/rfkill/core.c b/net/rfkill/core.c
+index f974961754ca..feef1a459b53 100644
+--- a/net/rfkill/core.c
++++ b/net/rfkill/core.c
+@@ -51,7 +51,6 @@
+ struct rfkill {
+ spinlock_t lock;
+
+- const char *name;
+ enum rfkill_type type;
+
+ unsigned long state;
+@@ -75,6 +74,7 @@ struct rfkill {
+ struct delayed_work poll_work;
+ struct work_struct uevent_work;
+ struct work_struct sync_work;
++ char name[];
+ };
+ #define to_rfkill(d) container_of(d, struct rfkill, dev)
+
+@@ -849,14 +849,14 @@ struct rfkill * __must_check rfkill_alloc(const char *name,
+ if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
+ return NULL;
+
+- rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
++ rfkill = kzalloc(sizeof(*rfkill) + strlen(name) + 1, GFP_KERNEL);
+ if (!rfkill)
+ return NULL;
+
+ spin_lock_init(&rfkill->lock);
+ INIT_LIST_HEAD(&rfkill->node);
+ rfkill->type = type;
+- rfkill->name = name;
++ strcpy(rfkill->name, name);
+ rfkill->ops = ops;
+ rfkill->data = ops_data;
+
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 333926d4d356..075e3537d5b9 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -804,8 +804,8 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
+ if (!has_sha1)
+ return -EINVAL;
+
+- memcpy(ep->auth_hmacs_list->hmac_ids, &hmacs->shmac_idents[0],
+- hmacs->shmac_num_idents * sizeof(__u16));
++ for (i = 0; i < hmacs->shmac_num_idents; i++)
++ ep->auth_hmacs_list->hmac_ids[i] = htons(hmacs->shmac_idents[i]);
+ ep->auth_hmacs_list->param_hdr.length = htons(sizeof(sctp_paramhdr_t) +
+ hmacs->shmac_num_idents * sizeof(__u16));
+ return 0;
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 3dd7207d33ad..7b285462c88e 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -1265,6 +1265,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
+ */
+
+ sack_a_rwnd = ntohl(sack->a_rwnd);
++ asoc->peer.zero_window_announced = !sack_a_rwnd;
+ outstanding = q->outstanding_bytes;
+
+ if (outstanding < sack_a_rwnd)
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 5fa033ac59e5..06c75b1a5a21 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -249,11 +249,12 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
+ int error;
+ struct sctp_transport *transport = (struct sctp_transport *) peer;
+ struct sctp_association *asoc = transport->asoc;
++ struct sock *sk = asoc->base.sk;
+
+ /* Check whether a task is in the sock. */
+
+- sctp_bh_lock_sock(asoc->base.sk);
+- if (sock_owned_by_user(asoc->base.sk)) {
++ sctp_bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
+ SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+ /* Try again later. */
+@@ -276,10 +277,10 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
+ transport, GFP_ATOMIC);
+
+ if (error)
+- asoc->base.sk->sk_err = -error;
++ sk->sk_err = -error;
+
+ out_unlock:
+- sctp_bh_unlock_sock(asoc->base.sk);
++ sctp_bh_unlock_sock(sk);
+ sctp_transport_put(transport);
+ }
+
+@@ -289,10 +290,11 @@ out_unlock:
+ static void sctp_generate_timeout_event(struct sctp_association *asoc,
+ sctp_event_timeout_t timeout_type)
+ {
++ struct sock *sk = asoc->base.sk;
+ int error = 0;
+
+- sctp_bh_lock_sock(asoc->base.sk);
+- if (sock_owned_by_user(asoc->base.sk)) {
++ sctp_bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
+ SCTP_DEBUG_PRINTK("%s:Sock is busy: timer %d\n",
+ __func__,
+ timeout_type);
+@@ -316,10 +318,10 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
+ (void *)timeout_type, GFP_ATOMIC);
+
+ if (error)
+- asoc->base.sk->sk_err = -error;
++ sk->sk_err = -error;
+
+ out_unlock:
+- sctp_bh_unlock_sock(asoc->base.sk);
++ sctp_bh_unlock_sock(sk);
+ sctp_association_put(asoc);
+ }
+
+@@ -369,9 +371,10 @@ void sctp_generate_heartbeat_event(unsigned long data)
+ int error = 0;
+ struct sctp_transport *transport = (struct sctp_transport *) data;
+ struct sctp_association *asoc = transport->asoc;
++ struct sock *sk = asoc->base.sk;
+
+- sctp_bh_lock_sock(asoc->base.sk);
+- if (sock_owned_by_user(asoc->base.sk)) {
++ sctp_bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
+ SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+ /* Try again later. */
+@@ -392,10 +395,10 @@ void sctp_generate_heartbeat_event(unsigned long data)
+ transport, GFP_ATOMIC);
+
+ if (error)
+- asoc->base.sk->sk_err = -error;
++ sk->sk_err = -error;
+
+ out_unlock:
+- sctp_bh_unlock_sock(asoc->base.sk);
++ sctp_bh_unlock_sock(sk);
+ sctp_transport_put(transport);
+ }
+
+@@ -406,9 +409,10 @@ void sctp_generate_proto_unreach_event(unsigned long data)
+ {
+ struct sctp_transport *transport = (struct sctp_transport *) data;
+ struct sctp_association *asoc = transport->asoc;
++ struct sock *sk = asoc->base.sk;
+
+- sctp_bh_lock_sock(asoc->base.sk);
+- if (sock_owned_by_user(asoc->base.sk)) {
++ sctp_bh_lock_sock(sk);
++ if (sock_owned_by_user(sk)) {
+ SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+ /* Try again later. */
+@@ -429,7 +433,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
+ asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+
+ out_unlock:
+- sctp_bh_unlock_sock(asoc->base.sk);
++ sctp_bh_unlock_sock(sk);
+ sctp_association_put(asoc);
+ }
+
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index a6a300630af4..5de7200f07a7 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -5299,7 +5299,8 @@ sctp_disposition_t sctp_sf_do_6_3_3_rtx(const struct sctp_endpoint *ep,
+ SCTP_INC_STATS(SCTP_MIB_T3_RTX_EXPIREDS);
+
+ if (asoc->overall_error_count >= asoc->max_retrans) {
+- if (asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
++ if (asoc->peer.zero_window_announced &&
++ asoc->state == SCTP_STATE_SHUTDOWN_PENDING) {
+ /*
+ * We are here likely because the receiver had its rwnd
+ * closed for a while and we have not been able to
+diff --git a/net/socket.c b/net/socket.c
+index f5ce151e0e3b..1769abc1dd55 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2332,31 +2332,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+ break;
+ }
+
+-out_put:
+- fput_light(sock->file, fput_needed);
+-
+ if (err == 0)
+- return datagrams;
++ goto out_put;
+
+- if (datagrams != 0) {
++ if (datagrams == 0) {
++ datagrams = err;
++ goto out_put;
++ }
++
++ /*
++ * We may return less entries than requested (vlen) if the
++ * sock is non block and there aren't enough datagrams...
++ */
++ if (err != -EAGAIN) {
+ /*
+- * We may return less entries than requested (vlen) if the
+- * sock is non block and there aren't enough datagrams...
++ * ... or if recvmsg returns an error after we
++ * received some datagrams, where we record the
++ * error to return on the next call or if the
++ * app asks about it using getsockopt(SO_ERROR).
+ */
+- if (err != -EAGAIN) {
+- /*
+- * ... or if recvmsg returns an error after we
+- * received some datagrams, where we record the
+- * error to return on the next call or if the
+- * app asks about it using getsockopt(SO_ERROR).
+- */
+- sock->sk->sk_err = -err;
+- }
+-
+- return datagrams;
++ sock->sk->sk_err = -err;
+ }
++out_put:
++ fput_light(sock->file, fput_needed);
+
+- return err;
++ return datagrams;
+ }
+
+ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
+diff --git a/net/unix/garbage.c b/net/unix/garbage.c
+index b6f4b994eb35..00d3e5678599 100644
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -185,7 +185,7 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
+ * have been added to the queues after
+ * starting the garbage collection
+ */
+- if (u->gc_candidate) {
++ if (test_bit(UNIX_GC_CANDIDATE, &u->gc_flags)) {
+ hit = true;
+ func(u);
+ }
+@@ -254,7 +254,7 @@ static void inc_inflight_move_tail(struct unix_sock *u)
+ * of the list, so that it's checked even if it was already
+ * passed over
+ */
+- if (u->gc_maybe_cycle)
++ if (test_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags))
+ list_move_tail(&u->link, &gc_candidates);
+ }
+
+@@ -315,8 +315,8 @@ void unix_gc(void)
+ BUG_ON(total_refs < inflight_refs);
+ if (total_refs == inflight_refs) {
+ list_move_tail(&u->link, &gc_candidates);
+- u->gc_candidate = 1;
+- u->gc_maybe_cycle = 1;
++ __set_bit(UNIX_GC_CANDIDATE, &u->gc_flags);
++ __set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);
+ }
+ }
+
+@@ -344,7 +344,7 @@ void unix_gc(void)
+
+ if (atomic_long_read(&u->inflight) > 0) {
+ list_move_tail(&u->link, ¬_cycle_list);
+- u->gc_maybe_cycle = 0;
++ __clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);
+ scan_children(&u->sk, inc_inflight_move_tail, NULL);
+ }
+ }
+@@ -356,7 +356,7 @@ void unix_gc(void)
+ */
+ while (!list_empty(¬_cycle_list)) {
+ u = list_entry(not_cycle_list.next, struct unix_sock, link);
+- u->gc_candidate = 0;
++ __clear_bit(UNIX_GC_CANDIDATE, &u->gc_flags);
+ list_move_tail(&u->link, &gc_inflight_list);
+ }
+
+diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
+index ee52cb8e17ad..0d5ae4a0f20c 100644
+--- a/scripts/recordmcount.c
++++ b/scripts/recordmcount.c
+@@ -35,12 +35,17 @@
+
+ static int fd_map; /* File descriptor for file being modified. */
+ static int mmap_failed; /* Boolean flag. */
+-static void *ehdr_curr; /* current ElfXX_Ehdr * for resource cleanup */
+ static char gpfx; /* prefix for global symbol name (sometimes '_') */
+ static struct stat sb; /* Remember .st_size, etc. */
+ static jmp_buf jmpenv; /* setjmp/longjmp per-file error escape */
+ static const char *altmcount; /* alternate mcount symbol name */
+ static int warn_on_notrace_sect; /* warn when section has mcount not being recorded */
++static void *file_map; /* pointer of the mapped file */
++static void *file_end; /* pointer to the end of the mapped file */
++static int file_updated; /* flag to state file was changed */
++static void *file_ptr; /* current file pointer location */
++static void *file_append; /* added to the end of the file */
++static size_t file_append_size; /* how much is added to end of file */
+
+ /* setjmp() return values */
+ enum {
+@@ -54,10 +59,14 @@ static void
+ cleanup(void)
+ {
+ if (!mmap_failed)
+- munmap(ehdr_curr, sb.st_size);
++ munmap(file_map, sb.st_size);
+ else
+- free(ehdr_curr);
+- close(fd_map);
++ free(file_map);
++ file_map = NULL;
++ free(file_append);
++ file_append = NULL;
++ file_append_size = 0;
++ file_updated = 0;
+ }
+
+ static void __attribute__((noreturn))
+@@ -79,12 +88,22 @@ succeed_file(void)
+ static off_t
+ ulseek(int const fd, off_t const offset, int const whence)
+ {
+- off_t const w = lseek(fd, offset, whence);
+- if (w == (off_t)-1) {
+- perror("lseek");
++ switch (whence) {
++ case SEEK_SET:
++ file_ptr = file_map + offset;
++ break;
++ case SEEK_CUR:
++ file_ptr += offset;
++ break;
++ case SEEK_END:
++ file_ptr = file_map + (sb.st_size - offset);
++ break;
++ }
++ if (file_ptr < file_map) {
++ fprintf(stderr, "lseek: seek before file\n");
+ fail_file();
+ }
+- return w;
++ return file_ptr - file_map;
+ }
+
+ static size_t
+@@ -101,12 +120,38 @@ uread(int const fd, void *const buf, size_t const count)
+ static size_t
+ uwrite(int const fd, void const *const buf, size_t const count)
+ {
+- size_t const n = write(fd, buf, count);
+- if (n != count) {
+- perror("write");
+- fail_file();
++ size_t cnt = count;
++ off_t idx = 0;
++
++ file_updated = 1;
++
++ if (file_ptr + count >= file_end) {
++ off_t aoffset = (file_ptr + count) - file_end;
++
++ if (aoffset > file_append_size) {
++ file_append = realloc(file_append, aoffset);
++ file_append_size = aoffset;
++ }
++ if (!file_append) {
++ perror("write");
++ fail_file();
++ }
++ if (file_ptr < file_end) {
++ cnt = file_end - file_ptr;
++ } else {
++ cnt = 0;
++ idx = aoffset - count;
++ }
+ }
+- return n;
++
++ if (cnt)
++ memcpy(file_ptr, buf, cnt);
++
++ if (cnt < count)
++ memcpy(file_append + idx, buf + cnt, count - cnt);
++
++ file_ptr += count;
++ return count;
+ }
+
+ static void *
+@@ -163,9 +208,7 @@ static int make_nop_x86(void *map, size_t const offset)
+ */
+ static void *mmap_file(char const *fname)
+ {
+- void *addr;
+-
+- fd_map = open(fname, O_RDWR);
++ fd_map = open(fname, O_RDONLY);
+ if (fd_map < 0 || fstat(fd_map, &sb) < 0) {
+ perror(fname);
+ fail_file();
+@@ -174,15 +217,58 @@ static void *mmap_file(char const *fname)
+ fprintf(stderr, "not a regular file: %s\n", fname);
+ fail_file();
+ }
+- addr = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
+- fd_map, 0);
++ file_map = mmap(0, sb.st_size, PROT_READ|PROT_WRITE, MAP_PRIVATE,
++ fd_map, 0);
+ mmap_failed = 0;
+- if (addr == MAP_FAILED) {
++ if (file_map == MAP_FAILED) {
+ mmap_failed = 1;
+- addr = umalloc(sb.st_size);
+- uread(fd_map, addr, sb.st_size);
++ file_map = umalloc(sb.st_size);
++ uread(fd_map, file_map, sb.st_size);
++ }
++ close(fd_map);
++
++ file_end = file_map + sb.st_size;
++
++ return file_map;
++}
++
++static void write_file(const char *fname)
++{
++ char tmp_file[strlen(fname) + 4];
++ size_t n;
++
++ if (!file_updated)
++ return;
++
++ sprintf(tmp_file, "%s.rc", fname);
++
++ /*
++ * After reading the entire file into memory, delete it
++ * and write it back, to prevent weird side effects of modifying
++ * an object file in place.
++ */
++ fd_map = open(tmp_file, O_WRONLY | O_TRUNC | O_CREAT, sb.st_mode);
++ if (fd_map < 0) {
++ perror(fname);
++ fail_file();
++ }
++ n = write(fd_map, file_map, sb.st_size);
++ if (n != sb.st_size) {
++ perror("write");
++ fail_file();
++ }
++ if (file_append_size) {
++ n = write(fd_map, file_append, file_append_size);
++ if (n != file_append_size) {
++ perror("write");
++ fail_file();
++ }
++ }
++ close(fd_map);
++ if (rename(tmp_file, fname) < 0) {
++ perror(fname);
++ fail_file();
+ }
+- return addr;
+ }
+
+ /* w8rev, w8nat, ...: Handle endianness. */
+@@ -289,7 +375,6 @@ do_file(char const *const fname)
+ Elf32_Ehdr *const ehdr = mmap_file(fname);
+ unsigned int reltype = 0;
+
+- ehdr_curr = ehdr;
+ w = w4nat;
+ w2 = w2nat;
+ w8 = w8nat;
+@@ -401,6 +486,7 @@ do_file(char const *const fname)
+ }
+ } /* end switch */
+
++ write_file(fname);
+ cleanup();
+ }
+
+@@ -453,11 +539,14 @@ main(int argc, char *argv[])
+ case SJ_SETJMP: /* normal sequence */
+ /* Avoid problems if early cleanup() */
+ fd_map = -1;
+- ehdr_curr = NULL;
+ mmap_failed = 1;
++ file_map = NULL;
++ file_ptr = NULL;
++ file_updated = 0;
+ do_file(file);
+ break;
+ case SJ_FAIL: /* error in do_file or below */
++ fprintf(stderr, "%s: failed\n", file);
+ ++n_error;
+ break;
+ case SJ_SUCCEED: /* premature success */
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index 5e29610303b0..799d73483fb2 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -375,7 +375,7 @@ static void nop_mcount(Elf_Shdr const *const relhdr,
+
+ if (mcountsym == Elf_r_sym(relp) && !is_fake_mcount(relp)) {
+ if (make_nop)
+- ret = make_nop((void *)ehdr, shdr->sh_offset + relp->r_offset);
++ ret = make_nop((void *)ehdr, _w(shdr->sh_offset) + _w(relp->r_offset));
+ if (warn_on_notrace_sect && !once) {
+ printf("Section %s has mcount callers being ignored\n",
+ txtname);
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index dfc8c229e355..0ba68b18d696 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -702,16 +702,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
+
+ /* the key is probably readable - now try to read it */
+ can_read_key:
+- ret = key_validate(key);
+- if (ret == 0) {
+- ret = -EOPNOTSUPP;
+- if (key->type->read) {
+- /* read the data with the semaphore held (since we
+- * might sleep) */
+- down_read(&key->sem);
++ ret = -EOPNOTSUPP;
++ if (key->type->read) {
++ /* Read the data with the semaphore held (since we might sleep)
++ * to protect against the key being updated or revoked.
++ */
++ down_read(&key->sem);
++ ret = key_validate(key);
++ if (ret == 0)
+ ret = key->type->read(key, buffer, buflen);
+- up_read(&key->sem);
+- }
++ up_read(&key->sem);
+ }
+
+ error2:
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index f461737e4e6c..833d8355a92d 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -3144,11 +3144,13 @@ static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
+ .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
+ .class_mask = 0xffffff,
+ .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
++ AZX_DCAPS_NO_64BIT |
+ AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
+ #else
+ /* this entry seems still valid -- i.e. without emu20kx chip */
+ { PCI_DEVICE(0x1102, 0x0009),
+ .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
++ AZX_DCAPS_NO_64BIT |
+ AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
+ #endif
+ /* Vortex86MX */
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 606f87aa24d9..247b1a155354 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -4932,6 +4932,7 @@ static int find_mute_led_cfg(struct hda_codec *codec, int default_polarity)
+ static int hp_blike_system(u32 subsystem_id)
+ {
+ switch (subsystem_id) {
++ case 0x103c1473: /* HP ProBook 6550b */
+ case 0x103c1520:
+ case 0x103c1521:
+ case 0x103c1523:
+diff --git a/sound/pci/rme96.c b/sound/pci/rme96.c
+index ba894158e76c..03eb085d5066 100644
+--- a/sound/pci/rme96.c
++++ b/sound/pci/rme96.c
+@@ -704,10 +704,11 @@ snd_rme96_playback_setrate(struct rme96 *rme96,
+ {
+ /* change to/from double-speed: reset the DAC (if available) */
+ snd_rme96_reset_dac(rme96);
++ return 1; /* need to restore volume */
+ } else {
+ writel(rme96->wcreg, rme96->iobase + RME96_IO_CONTROL_REGISTER);
++ return 0;
+ }
+- return 0;
+ }
+
+ static int
+@@ -945,6 +946,7 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
+ struct rme96 *rme96 = snd_pcm_substream_chip(substream);
+ struct snd_pcm_runtime *runtime = substream->runtime;
+ int err, rate, dummy;
++ bool apply_dac_volume = false;
+
+ runtime->dma_area = (void __force *)(rme96->iobase +
+ RME96_IO_PLAY_BUFFER);
+@@ -958,24 +960,26 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
+ {
+ /* slave clock */
+ if ((int)params_rate(params) != rate) {
+- spin_unlock_irq(&rme96->lock);
+- return -EIO;
+- }
+- } else if ((err = snd_rme96_playback_setrate(rme96, params_rate(params))) < 0) {
+- spin_unlock_irq(&rme96->lock);
+- return err;
+- }
+- if ((err = snd_rme96_playback_setformat(rme96, params_format(params))) < 0) {
+- spin_unlock_irq(&rme96->lock);
+- return err;
++ err = -EIO;
++ goto error;
++ }
++ } else {
++ err = snd_rme96_playback_setrate(rme96, params_rate(params));
++ if (err < 0)
++ goto error;
++ apply_dac_volume = err > 0; /* need to restore volume later? */
+ }
++
++ err = snd_rme96_playback_setformat(rme96, params_format(params));
++ if (err < 0)
++ goto error;
+ snd_rme96_setframelog(rme96, params_channels(params), 1);
+ if (rme96->capture_periodsize != 0) {
+ if (params_period_size(params) << rme96->playback_frlog !=
+ rme96->capture_periodsize)
+ {
+- spin_unlock_irq(&rme96->lock);
+- return -EBUSY;
++ err = -EBUSY;
++ goto error;
+ }
+ }
+ rme96->playback_periodsize =
+@@ -986,9 +990,16 @@ snd_rme96_playback_hw_params(struct snd_pcm_substream *substream,
+ rme96->wcreg &= ~(RME96_WCR_PRO | RME96_WCR_DOLBY | RME96_WCR_EMP);
+ writel(rme96->wcreg |= rme96->wcreg_spdif_stream, rme96->iobase + RME96_IO_CONTROL_REGISTER);
+ }
++
++ err = 0;
++ error:
+ spin_unlock_irq(&rme96->lock);
+-
+- return 0;
++ if (apply_dac_volume) {
++ usleep_range(3000, 10000);
++ snd_rme96_apply_dac_volume(rme96);
++ }
++
++ return err;
+ }
+
+ static int
+diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
+index 451ec4800f4e..fd06baaeee01 100644
+--- a/sound/soc/codecs/wm8962.c
++++ b/sound/soc/codecs/wm8962.c
+@@ -363,8 +363,8 @@ static struct reg_default wm8962_reg[] = {
+ { 16924, 0x0059 }, /* R16924 - HDBASS_PG_1 */
+ { 16925, 0x999A }, /* R16925 - HDBASS_PG_0 */
+
+- { 17048, 0x0083 }, /* R17408 - HPF_C_1 */
+- { 17049, 0x98AD }, /* R17409 - HPF_C_0 */
++ { 17408, 0x0083 }, /* R17408 - HPF_C_1 */
++ { 17409, 0x98AD }, /* R17409 - HPF_C_0 */
+
+ { 17920, 0x007F }, /* R17920 - ADCL_RETUNE_C1_1 */
+ { 17921, 0xFFFF }, /* R17921 - ADCL_RETUNE_C1_0 */
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index de86e7487def..075f32483769 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -174,6 +174,8 @@ struct snd_usb_midi_in_endpoint {
+ u8 running_status_length;
+ } ports[0x10];
+ u8 seen_f5;
++ bool in_sysex;
++ u8 last_cin;
+ u8 error_resubmit;
+ int current_port;
+ };
+@@ -465,6 +467,39 @@ static void snd_usbmidi_maudio_broken_running_status_input(
+ }
+
+ /*
++ * QinHeng CH345 is buggy: every second packet inside a SysEx has not CIN 4
++ * but the previously seen CIN, but still with three data bytes.
++ */
++static void ch345_broken_sysex_input(struct snd_usb_midi_in_endpoint *ep,
++ uint8_t *buffer, int buffer_length)
++{
++ unsigned int i, cin, length;
++
++ for (i = 0; i + 3 < buffer_length; i += 4) {
++ if (buffer[i] == 0 && i > 0)
++ break;
++ cin = buffer[i] & 0x0f;
++ if (ep->in_sysex &&
++ cin == ep->last_cin &&
++ (buffer[i + 1 + (cin == 0x6)] & 0x80) == 0)
++ cin = 0x4;
++#if 0
++ if (buffer[i + 1] == 0x90) {
++ /*
++ * Either a corrupted running status or a real note-on
++ * message; impossible to detect reliably.
++ */
++ }
++#endif
++ length = snd_usbmidi_cin_length[cin];
++ snd_usbmidi_input_data(ep, 0, &buffer[i + 1], length);
++ ep->in_sysex = cin == 0x4;
++ if (!ep->in_sysex)
++ ep->last_cin = cin;
++ }
++}
++
++/*
+ * CME protocol: like the standard protocol, but SysEx commands are sent as a
+ * single USB packet preceded by a 0x0F byte.
+ */
+@@ -650,6 +685,12 @@ static struct usb_protocol_ops snd_usbmidi_cme_ops = {
+ .output_packet = snd_usbmidi_output_standard_packet,
+ };
+
++static struct usb_protocol_ops snd_usbmidi_ch345_broken_sysex_ops = {
++ .input = ch345_broken_sysex_input,
++ .output = snd_usbmidi_standard_output,
++ .output_packet = snd_usbmidi_output_standard_packet,
++};
++
+ /*
+ * AKAI MPD16 protocol:
+ *
+@@ -1326,6 +1367,7 @@ static int snd_usbmidi_out_endpoint_create(struct snd_usb_midi* umidi,
+ * Various chips declare a packet size larger than 4 bytes, but
+ * do not actually work with larger packets:
+ */
++ case USB_ID(0x0a67, 0x5011): /* Medeli DD305 */
+ case USB_ID(0x0a92, 0x1020): /* ESI M4U */
+ case USB_ID(0x1430, 0x474b): /* RedOctane GH MIDI INTERFACE */
+ case USB_ID(0x15ca, 0x0101): /* Textech USB Midi Cable */
+@@ -2214,6 +2256,10 @@ int snd_usbmidi_create(struct snd_card *card,
+
+ err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
+ break;
++ case QUIRK_MIDI_CH345:
++ umidi->usb_protocol_ops = &snd_usbmidi_ch345_broken_sysex_ops;
++ err = snd_usbmidi_detect_per_port_endpoints(umidi, endpoints);
++ break;
+ default:
+ snd_printd(KERN_ERR "invalid quirk type %d\n", quirk->type);
+ err = -ENXIO;
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 4cebbf7f6ad1..862ed16a7e8e 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2689,6 +2689,17 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ .idProduct = 0x1020,
+ },
+
++/* QinHeng devices */
++{
++ USB_DEVICE(0x1a86, 0x752d),
++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
++ .vendor_name = "QinHeng",
++ .product_name = "CH345",
++ .ifnum = 1,
++ .type = QUIRK_MIDI_CH345
++ }
++},
++
+ /* KeithMcMillen Stringport */
+ {
+ USB_DEVICE(0x1f38, 0x0001),
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index 9c82f8b67a61..b01d3cf3759e 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -311,6 +311,7 @@ int snd_usb_create_quirk(struct snd_usb_audio *chip,
+ [QUIRK_MIDI_CME] = create_any_midi_quirk,
+ [QUIRK_MIDI_AKAI] = create_any_midi_quirk,
+ [QUIRK_MIDI_FTDI] = create_any_midi_quirk,
++ [QUIRK_MIDI_CH345] = create_any_midi_quirk,
+ [QUIRK_AUDIO_STANDARD_INTERFACE] = create_standard_audio_quirk,
+ [QUIRK_AUDIO_FIXED_ENDPOINT] = create_fixed_stream_quirk,
+ [QUIRK_AUDIO_EDIROL_UAXX] = create_uaxx_quirk,
+diff --git a/sound/usb/usbaudio.h b/sound/usb/usbaudio.h
+index 6c805a51d7d7..5e0e58adfcdb 100644
+--- a/sound/usb/usbaudio.h
++++ b/sound/usb/usbaudio.h
+@@ -81,6 +81,7 @@ enum quirk_type {
+ QUIRK_MIDI_AKAI,
+ QUIRK_MIDI_US122L,
+ QUIRK_MIDI_FTDI,
++ QUIRK_MIDI_CH345,
+ QUIRK_AUDIO_STANDARD_INTERFACE,
+ QUIRK_AUDIO_FIXED_ENDPOINT,
+ QUIRK_AUDIO_EDIROL_UAXX,
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2016-04-27 19:32 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2016-04-27 19:32 UTC (permalink / raw
To: gentoo-commits
commit: c0e453500c330875aef0cc8f1c5669781dc4ee16
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 27 19:31:59 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Apr 27 19:31:59 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=c0e45350
Linux patch 3.4.112
0000_README | 4 +
1111_linux-3.4.112.patch | 3175 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3179 insertions(+)
diff --git a/0000_README b/0000_README
index efb1797..2dee9b4 100644
--- a/0000_README
+++ b/0000_README
@@ -483,6 +483,10 @@ Patch: 1110_linux-3.4.111.patch
From: http://www.kernel.org
Desc: Linux 3.4.111
+Patch: 1111_linux-3.4.112.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.112
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1111_linux-3.4.112.patch b/1111_linux-3.4.112.patch
new file mode 100644
index 0000000..0247885
--- /dev/null
+++ b/1111_linux-3.4.112.patch
@@ -0,0 +1,3175 @@
+diff --git a/Makefile b/Makefile
+index 8a3f507065f9..c63e1836d738 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 111
++SUBLEVEL = 112
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/Makefile b/arch/arm/Makefile
+index 1d6402cbf4b2..4533386a2c84 100644
+--- a/arch/arm/Makefile
++++ b/arch/arm/Makefile
+@@ -53,6 +53,14 @@ endif
+
+ comma = ,
+
++#
++# The Scalar Replacement of Aggregates (SRA) optimization pass in GCC 4.9 and
++# later may result in code being generated that handles signed short and signed
++# char struct members incorrectly. So disable it.
++# (https://gcc.gnu.org/bugzilla/show_bug.cgi?id=65932)
++#
++KBUILD_CFLAGS += $(call cc-option,-fno-ipa-sra)
++
+ # This selects which instruction set is used.
+ # Note that GCC does not numerically define an architecture version
+ # macro, but instead defines a whole series of macros which makes
+diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
+index d68d1b694680..13579aa1494e 100644
+--- a/arch/arm/kernel/signal.c
++++ b/arch/arm/kernel/signal.c
+@@ -437,12 +437,23 @@ setup_return(struct pt_regs *regs, struct k_sigaction *ka,
+ */
+ thumb = handler & 1;
+
++#if __LINUX_ARM_ARCH__ >= 6
++ /*
++ * Clear the If-Then Thumb-2 execution state. ARM spec
++ * requires this to be all 000s in ARM mode. Snapdragon
++ * S4/Krait misbehaves on a Thumb=>ARM signal transition
++ * without this.
++ *
++ * We must do this whenever we are running on a Thumb-2
++ * capable CPU, which includes ARMv6T2. However, we elect
++ * to do this whenever we're on an ARMv6 or later CPU for
++ * simplicity.
++ */
++ cpsr &= ~PSR_IT_MASK;
++#endif
++
+ if (thumb) {
+ cpsr |= PSR_T_BIT;
+-#if __LINUX_ARM_ARCH__ >= 7
+- /* clear the If-Then Thumb-2 execution state */
+- cpsr &= ~PSR_IT_MASK;
+-#endif
+ } else
+ cpsr &= ~PSR_T_BIT;
+ }
+diff --git a/arch/m68k/include/asm/linkage.h b/arch/m68k/include/asm/linkage.h
+index 5a822bb790f7..066e74f666ae 100644
+--- a/arch/m68k/include/asm/linkage.h
++++ b/arch/m68k/include/asm/linkage.h
+@@ -4,4 +4,34 @@
+ #define __ALIGN .align 4
+ #define __ALIGN_STR ".align 4"
+
++/*
++ * Make sure the compiler doesn't do anything stupid with the
++ * arguments on the stack - they are owned by the *caller*, not
++ * the callee. This just fools gcc into not spilling into them,
++ * and keeps it from doing tailcall recursion and/or using the
++ * stack slots for temporaries, since they are live and "used"
++ * all the way to the end of the function.
++ */
++#define asmlinkage_protect(n, ret, args...) \
++ __asmlinkage_protect##n(ret, ##args)
++#define __asmlinkage_protect_n(ret, args...) \
++ __asm__ __volatile__ ("" : "=r" (ret) : "0" (ret), ##args)
++#define __asmlinkage_protect0(ret) \
++ __asmlinkage_protect_n(ret)
++#define __asmlinkage_protect1(ret, arg1) \
++ __asmlinkage_protect_n(ret, "m" (arg1))
++#define __asmlinkage_protect2(ret, arg1, arg2) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2))
++#define __asmlinkage_protect3(ret, arg1, arg2, arg3) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3))
++#define __asmlinkage_protect4(ret, arg1, arg2, arg3, arg4) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
++ "m" (arg4))
++#define __asmlinkage_protect5(ret, arg1, arg2, arg3, arg4, arg5) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
++ "m" (arg4), "m" (arg5))
++#define __asmlinkage_protect6(ret, arg1, arg2, arg3, arg4, arg5, arg6) \
++ __asmlinkage_protect_n(ret, "m" (arg1), "m" (arg2), "m" (arg3), \
++ "m" (arg4), "m" (arg5), "m" (arg6))
++
+ #endif
+diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
+index 0eea2d2e8563..f395d5dd19b6 100644
+--- a/arch/mips/mm/dma-default.c
++++ b/arch/mips/mm/dma-default.c
+@@ -71,7 +71,7 @@ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
+ else
+ #endif
+ #if defined(CONFIG_ZONE_DMA) && !defined(CONFIG_ZONE_DMA32)
+- if (dev->coherent_dma_mask < DMA_BIT_MASK(64))
++ if (dev->coherent_dma_mask < DMA_BIT_MASK(sizeof(phys_addr_t) * 8))
+ dma_flag = __GFP_DMA;
+ else
+ #endif
+diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
+index 5e7e00889d6f..8e172066e4bc 100644
+--- a/arch/powerpc/include/asm/rtas.h
++++ b/arch/powerpc/include/asm/rtas.h
+@@ -253,6 +253,7 @@ extern void rtas_power_off(void);
+ extern void rtas_halt(void);
+ extern void rtas_os_term(char *str);
+ extern int rtas_get_sensor(int sensor, int index, int *state);
++extern int rtas_get_sensor_fast(int sensor, int index, int *state);
+ extern int rtas_get_power_level(int powerdomain, int *level);
+ extern int rtas_set_power_level(int powerdomain, int level, int *setlevel);
+ extern bool rtas_indicator_present(int token, int *maxindex);
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index 225e9f225126..8178294d6548 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -585,6 +585,23 @@ int rtas_get_sensor(int sensor, int index, int *state)
+ }
+ EXPORT_SYMBOL(rtas_get_sensor);
+
++int rtas_get_sensor_fast(int sensor, int index, int *state)
++{
++ int token = rtas_token("get-sensor-state");
++ int rc;
++
++ if (token == RTAS_UNKNOWN_SERVICE)
++ return -ENOENT;
++
++ rc = rtas_call(token, 2, 2, state, sensor, index);
++ WARN_ON(rc == RTAS_BUSY || (rc >= RTAS_EXTENDED_DELAY_MIN &&
++ rc <= RTAS_EXTENDED_DELAY_MAX));
++
++ if (rc < 0)
++ return rtas_error_rc(rc);
++ return rc;
++}
++
+ bool rtas_indicator_present(int token, int *maxindex)
+ {
+ int proplen, count, i;
+@@ -1025,6 +1042,9 @@ asmlinkage int ppc_rtas(struct rtas_args __user *uargs)
+ if (!capable(CAP_SYS_ADMIN))
+ return -EPERM;
+
++ if (!rtas.entry)
++ return -EINVAL;
++
+ if (copy_from_user(&args, uargs, 3 * sizeof(u32)) != 0)
+ return -EFAULT;
+
+diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
+index be3cfc5ceabb..5b127c8a4a7d 100644
+--- a/arch/powerpc/platforms/powernv/pci.c
++++ b/arch/powerpc/platforms/powernv/pci.c
+@@ -137,6 +137,7 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
+ struct pci_controller *hose = pci_bus_to_host(pdev->bus);
+ struct pnv_phb *phb = hose->private_data;
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ if (WARN_ON(!phb))
+ return;
+@@ -144,9 +145,10 @@ static void pnv_teardown_msi_irqs(struct pci_dev *pdev)
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- pnv_put_msi(phb, virq_to_hw(entry->irq));
+ irq_dispose_mapping(entry->irq);
++ pnv_put_msi(phb, hwirq);
+ }
+ }
+ #endif /* CONFIG_PCI_MSI */
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index c4dfccd3a3d9..2338e6e98483 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -187,7 +187,8 @@ static irqreturn_t ras_epow_interrupt(int irq, void *dev_id)
+ int state;
+ int critical;
+
+- status = rtas_get_sensor(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX, &state);
++ status = rtas_get_sensor_fast(EPOW_SENSOR_TOKEN, EPOW_SENSOR_INDEX,
++ &state);
+
+ if (state > 3)
+ critical = 1; /* Time Critical */
+diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
+index 6e097de00e09..fd1a96b793c6 100644
+--- a/arch/powerpc/sysdev/fsl_msi.c
++++ b/arch/powerpc/sysdev/fsl_msi.c
+@@ -108,15 +108,16 @@ static void fsl_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
+ struct fsl_msi *msi_data;
++ irq_hw_number_t hwirq;
+
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ msi_data = irq_get_chip_data(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_data->bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
+ }
+
+ return;
+diff --git a/arch/powerpc/sysdev/mpic_pasemi_msi.c b/arch/powerpc/sysdev/mpic_pasemi_msi.c
+index 38e62382070c..e8736165a7c7 100644
+--- a/arch/powerpc/sysdev/mpic_pasemi_msi.c
++++ b/arch/powerpc/sysdev/mpic_pasemi_msi.c
+@@ -74,6 +74,7 @@ static int pasemi_msi_check_device(struct pci_dev *pdev, int nvec, int type)
+ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ pr_debug("pasemi_msi_teardown_msi_irqs, pdev %p\n", pdev);
+
+@@ -81,10 +82,10 @@ static void pasemi_msi_teardown_msi_irqs(struct pci_dev *pdev)
+ if (entry->irq == NO_IRQ)
+ continue;
+
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+- virq_to_hw(entry->irq), ALLOC_CHUNK);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, ALLOC_CHUNK);
+ }
+
+ return;
+diff --git a/arch/powerpc/sysdev/mpic_u3msi.c b/arch/powerpc/sysdev/mpic_u3msi.c
+index 9a7aa0ed9c1c..dfc3486bf802 100644
+--- a/arch/powerpc/sysdev/mpic_u3msi.c
++++ b/arch/powerpc/sysdev/mpic_u3msi.c
+@@ -124,15 +124,16 @@ static int u3msi_msi_check_device(struct pci_dev *pdev, int nvec, int type)
+ static void u3msi_teardown_msi_irqs(struct pci_dev *pdev)
+ {
+ struct msi_desc *entry;
++ irq_hw_number_t hwirq;
+
+ list_for_each_entry(entry, &pdev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
+
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_mpic->msi_bitmap, hwirq, 1);
+ }
+
+ return;
+diff --git a/arch/powerpc/sysdev/ppc4xx_msi.c b/arch/powerpc/sysdev/ppc4xx_msi.c
+index 1c2d7af17bbe..4aae9c8dec48 100644
+--- a/arch/powerpc/sysdev/ppc4xx_msi.c
++++ b/arch/powerpc/sysdev/ppc4xx_msi.c
+@@ -114,16 +114,17 @@ void ppc4xx_teardown_msi_irqs(struct pci_dev *dev)
+ {
+ struct msi_desc *entry;
+ struct ppc4xx_msi *msi_data = &ppc4xx_msi;
++ irq_hw_number_t hwirq;
+
+ dev_dbg(&dev->dev, "PCIE-MSI: tearing down msi irqs\n");
+
+ list_for_each_entry(entry, &dev->msi_list, list) {
+ if (entry->irq == NO_IRQ)
+ continue;
++ hwirq = virq_to_hw(entry->irq);
+ irq_set_msi_desc(entry->irq, NULL);
+- msi_bitmap_free_hwirqs(&msi_data->bitmap,
+- virq_to_hw(entry->irq), 1);
+ irq_dispose_mapping(entry->irq);
++ msi_bitmap_free_hwirqs(&msi_data->bitmap, hwirq, 1);
+ }
+ }
+
+diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+index c07446d17463..21069e9a744e 100644
+--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c
++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c
+@@ -292,6 +292,7 @@ static struct ahash_alg ghash_async_alg = {
+ .cra_name = "ghash",
+ .cra_driver_name = "ghash-clmulni",
+ .cra_priority = 400,
++ .cra_ctxsize = sizeof(struct ghash_async_ctx),
+ .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_ASYNC,
+ .cra_blocksize = GHASH_BLOCK_SIZE,
+ .cra_type = &crypto_ahash_type,
+diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h
+index e92e1e4d7a5e..033b8a075f69 100644
+--- a/arch/x86/include/asm/msr-index.h
++++ b/arch/x86/include/asm/msr-index.h
+@@ -166,6 +166,7 @@
+ /* C1E active bits in int pending message */
+ #define K8_INTP_C1E_ACTIVE_MASK 0x18000000
+ #define MSR_K8_TSEG_ADDR 0xc0010112
++#define MSR_K8_TSEG_MASK 0xc0010113
+ #define K8_MTRRFIXRANGE_DRAM_ENABLE 0x00040000 /* MtrrFixDramEn bit */
+ #define K8_MTRRFIXRANGE_DRAM_MODIFY 0x00080000 /* MtrrFixDramModEn bit */
+ #define K8_MTRR_RDMEM_WRMEM_MASK 0x18181818 /* Mask: RdMem|WrMem */
+diff --git a/arch/x86/include/asm/xen/hypervisor.h b/arch/x86/include/asm/xen/hypervisor.h
+index 66d0fff1ee84..fc500f97b39d 100644
+--- a/arch/x86/include/asm/xen/hypervisor.h
++++ b/arch/x86/include/asm/xen/hypervisor.h
+@@ -72,4 +72,6 @@ static inline bool xen_x2apic_para_available(void)
+ }
+ #endif
+
++extern void xen_set_iopl_mask(unsigned mask);
++
+ #endif /* _ASM_X86_XEN_HYPERVISOR_H */
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index d5d7313ed430..9f341bbe0c0f 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -49,6 +49,7 @@
+ #include <asm/syscalls.h>
+ #include <asm/debugreg.h>
+ #include <asm/switch_to.h>
++#include <asm/xen/hypervisor.h>
+
+ asmlinkage extern void ret_from_fork(void);
+
+@@ -419,6 +420,17 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
+ task_thread_info(prev_p)->flags & _TIF_WORK_CTXSW_PREV))
+ __switch_to_xtra(prev_p, next_p, tss);
+
++#ifdef CONFIG_XEN
++ /*
++ * On Xen PV, IOPL bits in pt_regs->flags have no effect, and
++ * current_pt_regs()->flags may not match the current task's
++ * intended IOPL. We need to switch it manually.
++ */
++ if (unlikely(xen_pv_domain() &&
++ prev->iopl != next->iopl))
++ xen_set_iopl_mask(next->iopl);
++#endif
++
+ return prev_p;
+ }
+
+@@ -470,27 +482,59 @@ void set_personality_ia32(bool x32)
+ }
+ EXPORT_SYMBOL_GPL(set_personality_ia32);
+
++/*
++ * Called from fs/proc with a reference on @p to find the function
++ * which called into schedule(). This needs to be done carefully
++ * because the task might wake up and we might look at a stack
++ * changing under us.
++ */
+ unsigned long get_wchan(struct task_struct *p)
+ {
+- unsigned long stack;
+- u64 fp, ip;
++ unsigned long start, bottom, top, sp, fp, ip;
+ int count = 0;
+
+ if (!p || p == current || p->state == TASK_RUNNING)
+ return 0;
+- stack = (unsigned long)task_stack_page(p);
+- if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
++
++ start = (unsigned long)task_stack_page(p);
++ if (!start)
++ return 0;
++
++ /*
++ * Layout of the stack page:
++ *
++ * ----------- topmax = start + THREAD_SIZE - sizeof(unsigned long)
++ * PADDING
++ * ----------- top = topmax - TOP_OF_KERNEL_STACK_PADDING
++ * stack
++ * ----------- bottom = start + sizeof(thread_info)
++ * thread_info
++ * ----------- start
++ *
++ * The tasks stack pointer points at the location where the
++ * framepointer is stored. The data on the stack is:
++ * ... IP FP ... IP FP
++ *
++ * We need to read FP and IP, so we need to adjust the upper
++ * bound by another unsigned long.
++ */
++ top = start + THREAD_SIZE;
++ top -= 2 * sizeof(unsigned long);
++ bottom = start + sizeof(struct thread_info);
++
++ sp = ACCESS_ONCE(p->thread.sp);
++ if (sp < bottom || sp > top)
+ return 0;
+- fp = *(u64 *)(p->thread.sp);
++
++ fp = ACCESS_ONCE(*(unsigned long *)sp);
+ do {
+- if (fp < (unsigned long)stack ||
+- fp >= (unsigned long)stack+THREAD_SIZE)
++ if (fp < bottom || fp > top)
+ return 0;
+- ip = *(u64 *)(fp+8);
++ ip = ACCESS_ONCE(*(unsigned long *)(fp + sizeof(unsigned long)));
+ if (!in_sched_functions(ip))
+ return ip;
+- fp = *(u64 *)fp;
+- } while (count++ < 16);
++ fp = ACCESS_ONCE(*(unsigned long *)fp);
++ } while (count++ < 16 && p->state != TASK_RUNNING);
+ return 0;
+ }
+
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index 8652aa408ae0..ffded61b4c22 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -18,6 +18,7 @@
+ #include <asm/hypervisor.h>
+ #include <asm/nmi.h>
+ #include <asm/x86_init.h>
++#include <asm/geode.h>
+
+ unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */
+ EXPORT_SYMBOL(cpu_khz);
+@@ -800,15 +801,17 @@ EXPORT_SYMBOL_GPL(mark_tsc_unstable);
+
+ static void __init check_system_tsc_reliable(void)
+ {
+-#ifdef CONFIG_MGEODE_LX
+- /* RTSC counts during suspend */
++#if defined(CONFIG_MGEODEGX1) || defined(CONFIG_MGEODE_LX) || defined(CONFIG_X86_GENERIC)
++ if (is_geode_lx()) {
++ /* RTSC counts during suspend */
+ #define RTSC_SUSP 0x100
+- unsigned long res_low, res_high;
++ unsigned long res_low, res_high;
+
+- rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
+- /* Geode_LX - the OLPC CPU has a very reliable TSC */
+- if (res_low & RTSC_SUSP)
+- tsc_clocksource_reliable = 1;
++ rdmsr_safe(MSR_GEODE_BUSCONT_CONF0, &res_low, &res_high);
++ /* Geode_LX - the OLPC CPU has a very reliable TSC */
++ if (res_low & RTSC_SUSP)
++ tsc_clocksource_reliable = 1;
++ }
+ #endif
+ if (boot_cpu_has(X86_FEATURE_TSC_RELIABLE))
+ tsc_clocksource_reliable = 1;
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 9cc83e287adf..32a652179a6d 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1914,6 +1914,8 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 *pdata)
+ case MSR_IA32_LASTINTFROMIP:
+ case MSR_IA32_LASTINTTOIP:
+ case MSR_K8_SYSCFG:
++ case MSR_K8_TSEG_ADDR:
++ case MSR_K8_TSEG_MASK:
+ case MSR_K7_HWCR:
+ case MSR_VM_HSAVE_PA:
+ case MSR_K7_EVNTSEL0:
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 8ade106b879b..761c086778d3 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -860,7 +860,7 @@ static void xen_load_sp0(struct tss_struct *tss,
+ xen_mc_issue(PARAVIRT_LAZY_CPU);
+ }
+
+-static void xen_set_iopl_mask(unsigned mask)
++void xen_set_iopl_mask(unsigned mask)
+ {
+ struct physdev_set_iopl set_iopl;
+
+diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c
+index f8b02601887e..f60abe6d3351 100644
+--- a/arch/x86/xen/setup.c
++++ b/arch/x86/xen/setup.c
+@@ -274,7 +274,7 @@ char * __init xen_memory_setup(void)
+ xen_ignore_unusable(map, memmap.nr_entries);
+
+ /* Make sure the Xen-supplied memory map is well-ordered. */
+- sanitize_e820_map(map, memmap.nr_entries, &memmap.nr_entries);
++ sanitize_e820_map(map, ARRAY_SIZE(map), &memmap.nr_entries);
+
+ max_pages = xen_get_max_pages();
+ if (max_pages > max_pfn)
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index 45fe4109698e..4a9c499ea78a 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -700,7 +700,7 @@ struct crypto_ablkcipher *crypto_alloc_ablkcipher(const char *alg_name,
+ err:
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+diff --git a/crypto/ahash.c b/crypto/ahash.c
+index 0ec05feea438..58241912a07f 100644
+--- a/crypto/ahash.c
++++ b/crypto/ahash.c
+@@ -462,7 +462,8 @@ static int ahash_prepare_alg(struct ahash_alg *alg)
+ struct crypto_alg *base = &alg->halg.base;
+
+ if (alg->halg.digestsize > PAGE_SIZE / 8 ||
+- alg->halg.statesize > PAGE_SIZE / 8)
++ alg->halg.statesize > PAGE_SIZE / 8 ||
++ alg->halg.statesize == 0)
+ return -EINVAL;
+
+ base->cra_type = &crypto_ahash_type;
+diff --git a/crypto/algapi.c b/crypto/algapi.c
+index b4c046c39419..7bae610afef8 100644
+--- a/crypto/algapi.c
++++ b/crypto/algapi.c
+@@ -342,7 +342,7 @@ static void crypto_wait_for_test(struct crypto_larval *larval)
+ crypto_alg_tested(larval->alg.cra_driver_name, 0);
+ }
+
+- err = wait_for_completion_interruptible(&larval->completion);
++ err = wait_for_completion_killable(&larval->completion);
+ WARN_ON(err);
+
+ out:
+diff --git a/crypto/api.c b/crypto/api.c
+index 4f98dd5b1911..c9c2f47843d5 100644
+--- a/crypto/api.c
++++ b/crypto/api.c
+@@ -178,7 +178,7 @@ static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg)
+ struct crypto_larval *larval = (void *)alg;
+ long timeout;
+
+- timeout = wait_for_completion_interruptible_timeout(
++ timeout = wait_for_completion_killable_timeout(
+ &larval->completion, 60 * HZ);
+
+ alg = larval->adult;
+@@ -441,7 +441,7 @@ struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask)
+ err:
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+@@ -558,7 +558,7 @@ void *crypto_alloc_tfm(const char *alg_name,
+ err:
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
+index 910497bd72be..0c19d035729b 100644
+--- a/crypto/crypto_user.c
++++ b/crypto/crypto_user.c
+@@ -350,7 +350,7 @@ static struct crypto_alg *crypto_user_aead_alg(const char *name, u32 type,
+ err = PTR_ERR(alg);
+ if (err != -EAGAIN)
+ break;
+- if (signal_pending(current)) {
++ if (fatal_signal_pending(current)) {
+ err = -EINTR;
+ break;
+ }
+diff --git a/drivers/auxdisplay/ks0108.c b/drivers/auxdisplay/ks0108.c
+index 5b93852392b8..0d752851a1ee 100644
+--- a/drivers/auxdisplay/ks0108.c
++++ b/drivers/auxdisplay/ks0108.c
+@@ -139,6 +139,7 @@ static int __init ks0108_init(void)
+
+ ks0108_pardevice = parport_register_device(ks0108_parport, KS0108_NAME,
+ NULL, NULL, NULL, PARPORT_DEV_EXCL, NULL);
++ parport_put_port(ks0108_parport);
+ if (ks0108_pardevice == NULL) {
+ printk(KERN_ERR KS0108_NAME ": ERROR: "
+ "parport didn't register new device\n");
+diff --git a/drivers/base/devres.c b/drivers/base/devres.c
+index 524bf96c289f..06c541dc4d50 100644
+--- a/drivers/base/devres.c
++++ b/drivers/base/devres.c
+@@ -254,10 +254,10 @@ void * devres_get(struct device *dev, void *new_res,
+ if (!dr) {
+ add_dr(dev, &new_dr->node);
+ dr = new_dr;
+- new_dr = NULL;
++ new_res = NULL;
+ }
+ spin_unlock_irqrestore(&dev->devres_lock, flags);
+- devres_free(new_dr);
++ devres_free(new_res);
+
+ return dr->data;
+ }
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index a1a722502587..5a1373330487 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -311,9 +311,7 @@ int platform_device_add(struct platform_device *pdev)
+ failed:
+ while (--i >= 0) {
+ struct resource *r = &pdev->resource[i];
+- unsigned long type = resource_type(r);
+-
+- if (type == IORESOURCE_MEM || type == IORESOURCE_IO)
++ if (r->parent)
+ release_resource(r);
+ }
+
+@@ -338,9 +336,7 @@ void platform_device_del(struct platform_device *pdev)
+
+ for (i = 0; i < pdev->num_resources; i++) {
+ struct resource *r = &pdev->resource[i];
+- unsigned long type = resource_type(r);
+-
+- if (type == IORESOURCE_MEM || type == IORESOURCE_IO)
++ if (r->parent)
+ release_resource(r);
+ }
+ }
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 1db12895110a..023a9d79e26a 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -23,8 +23,7 @@ static struct dentry *regmap_debugfs_root;
+ /* Calculate the length of a fixed format */
+ static size_t regmap_calc_reg_len(int max_val, char *buf, size_t buf_size)
+ {
+- snprintf(buf, buf_size, "%x", max_val);
+- return strlen(buf);
++ return snprintf(NULL, 0, "%x", max_val);
+ }
+
+ static ssize_t regmap_name_read_file(struct file *file,
+@@ -205,7 +204,7 @@ static ssize_t regmap_access_read_file(struct file *file,
+ /* If we're in the region the user is trying to read */
+ if (p >= *ppos) {
+ /* ...but not beyond it */
+- if (buf_pos >= count - 1 - tot_len)
++ if (buf_pos + tot_len + 1 >= count)
+ break;
+
+ /* Format the register */
+diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
+index a81cdd7b9d83..16477b255d82 100644
+--- a/drivers/block/xen-blkfront.c
++++ b/drivers/block/xen-blkfront.c
+@@ -1314,7 +1314,8 @@ static void blkback_changed(struct xenbus_device *dev,
+ break;
+ /* Missed the backend's Closing state -- fallthrough */
+ case XenbusStateClosing:
+- blkfront_closing(info);
++ if (info)
++ blkfront_closing(info);
+ break;
+ }
+ }
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index ed4b7481a865..93c5b2fdf9b4 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -2945,7 +2945,7 @@ static struct drm_property_blob *drm_property_create_blob(struct drm_device *dev
+ struct drm_property_blob *blob;
+ int ret;
+
+- if (!length || !data)
++ if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob) || !data)
+ return NULL;
+
+ blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
+index 2f46bbfbb1f8..b242534f57c5 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
+@@ -172,11 +172,12 @@ nouveau_gem_info(struct drm_file *file_priv, struct drm_gem_object *gem,
+ struct nouveau_bo *nvbo = nouveau_gem_object(gem);
+ struct nouveau_vma *vma;
+
+- if (nvbo->bo.mem.mem_type == TTM_PL_TT)
++ if (is_power_of_2(nvbo->valid_domains))
++ rep->domain = nvbo->valid_domains;
++ else if (nvbo->bo.mem.mem_type == TTM_PL_TT)
+ rep->domain = NOUVEAU_GEM_DOMAIN_GART;
+ else
+ rep->domain = NOUVEAU_GEM_DOMAIN_VRAM;
+-
+ rep->offset = nvbo->bo.offset;
+ if (fpriv->vm) {
+ vma = nouveau_bo_vma_find(nvbo, fpriv->vm);
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index b72eb507df64..69c2dd085722 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -3399,6 +3399,14 @@ void radeon_combios_asic_init(struct drm_device *dev)
+ rdev->pdev->subsystem_device == 0x30ae)
+ return;
+
++ /* quirk for rs4xx HP Compaq dc5750 Small Form Factor to make it resume
++ * - it hangs on resume inside the dynclk 1 table.
++ */
++ if (rdev->family == CHIP_RS480 &&
++ rdev->pdev->subsystem_vendor == 0x103c &&
++ rdev->pdev->subsystem_device == 0x280a)
++ return;
++
+ /* DYN CLK 1 */
+ table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE);
+ if (table)
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 9184bbe7c602..9c5d96cb6e14 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -82,6 +82,11 @@ void radeon_connector_hotplug(struct drm_connector *connector)
+ if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) {
+ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
+ } else if (radeon_dp_needs_link_train(radeon_connector)) {
++ /* Don't try to start link training before we
++ * have the dpcd */
++ if (!radeon_dp_getdpcd(radeon_connector))
++ return;
++
+ /* set it to OFF so that drm_helper_connector_dpms()
+ * won't return immediately since the current state
+ * is ON at this point.
+diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
+index c889aaef3416..90104c6fc0a4 100644
+--- a/drivers/infiniband/core/cm.c
++++ b/drivers/infiniband/core/cm.c
+@@ -856,6 +856,11 @@ retest:
+ case IB_CM_SIDR_REQ_RCVD:
+ spin_unlock_irq(&cm_id_priv->lock);
+ cm_reject_sidr_req(cm_id_priv, IB_SIDR_REJECT);
++ spin_lock_irq(&cm.lock);
++ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node))
++ rb_erase(&cm_id_priv->sidr_id_node,
++ &cm.remote_sidr_table);
++ spin_unlock_irq(&cm.lock);
+ break;
+ case IB_CM_REQ_SENT:
+ ib_cancel_mad(cm_id_priv->av.port->mad_agent, cm_id_priv->msg);
+@@ -3092,7 +3097,10 @@ int ib_send_cm_sidr_rep(struct ib_cm_id *cm_id,
+ spin_unlock_irqrestore(&cm_id_priv->lock, flags);
+
+ spin_lock_irqsave(&cm.lock, flags);
+- rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
++ if (!RB_EMPTY_NODE(&cm_id_priv->sidr_id_node)) {
++ rb_erase(&cm_id_priv->sidr_id_node, &cm.remote_sidr_table);
++ RB_CLEAR_NODE(&cm_id_priv->sidr_id_node);
++ }
+ spin_unlock_irqrestore(&cm.lock, flags);
+ return 0;
+
+diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
+index 5bcb2afd3dcb..228af1894dc9 100644
+--- a/drivers/infiniband/core/uverbs.h
++++ b/drivers/infiniband/core/uverbs.h
+@@ -69,7 +69,7 @@
+ */
+
+ struct ib_uverbs_device {
+- struct kref ref;
++ atomic_t refcount;
+ int num_comp_vectors;
+ struct completion comp;
+ struct device *dev;
+@@ -78,6 +78,7 @@ struct ib_uverbs_device {
+ struct cdev cdev;
+ struct rb_root xrcd_tree;
+ struct mutex xrcd_tree_mutex;
++ struct kobject kobj;
+ };
+
+ struct ib_uverbs_event_file {
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index 4d27e4c3fe34..95885b49033a 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -1979,6 +1979,12 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
+ next->send_flags = user_wr->send_flags;
+
+ if (is_ud) {
++ if (next->opcode != IB_WR_SEND &&
++ next->opcode != IB_WR_SEND_WITH_IMM) {
++ ret = -EINVAL;
++ goto out_put;
++ }
++
+ next->wr.ud.ah = idr_read_ah(user_wr->wr.ud.ah,
+ file->ucontext);
+ if (!next->wr.ud.ah) {
+@@ -2015,9 +2021,11 @@ ssize_t ib_uverbs_post_send(struct ib_uverbs_file *file,
+ user_wr->wr.atomic.compare_add;
+ next->wr.atomic.swap = user_wr->wr.atomic.swap;
+ next->wr.atomic.rkey = user_wr->wr.atomic.rkey;
++ case IB_WR_SEND:
+ break;
+ default:
+- break;
++ ret = -EINVAL;
++ goto out_put;
+ }
+ }
+
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 5b51e4e6e7f9..c8e766924385 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -117,14 +117,18 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
+ static void ib_uverbs_add_one(struct ib_device *device);
+ static void ib_uverbs_remove_one(struct ib_device *device);
+
+-static void ib_uverbs_release_dev(struct kref *ref)
++static void ib_uverbs_release_dev(struct kobject *kobj)
+ {
+ struct ib_uverbs_device *dev =
+- container_of(ref, struct ib_uverbs_device, ref);
++ container_of(kobj, struct ib_uverbs_device, kobj);
+
+- complete(&dev->comp);
++ kfree(dev);
+ }
+
++static struct kobj_type ib_uverbs_dev_ktype = {
++ .release = ib_uverbs_release_dev,
++};
++
+ static void ib_uverbs_release_event_file(struct kref *ref)
+ {
+ struct ib_uverbs_event_file *file =
+@@ -273,13 +277,19 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
+ return context->device->dealloc_ucontext(context);
+ }
+
++static void ib_uverbs_comp_dev(struct ib_uverbs_device *dev)
++{
++ complete(&dev->comp);
++}
++
+ static void ib_uverbs_release_file(struct kref *ref)
+ {
+ struct ib_uverbs_file *file =
+ container_of(ref, struct ib_uverbs_file, ref);
+
+ module_put(file->device->ib_dev->owner);
+- kref_put(&file->device->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&file->device->refcount))
++ ib_uverbs_comp_dev(file->device);
+
+ kfree(file);
+ }
+@@ -621,9 +631,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
+ int ret;
+
+ dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev);
+- if (dev)
+- kref_get(&dev->ref);
+- else
++ if (!atomic_inc_not_zero(&dev->refcount))
+ return -ENXIO;
+
+ if (!try_module_get(dev->ib_dev->owner)) {
+@@ -644,6 +652,7 @@ static int ib_uverbs_open(struct inode *inode, struct file *filp)
+ mutex_init(&file->mutex);
+
+ filp->private_data = file;
++ kobject_get(&dev->kobj);
+
+ return nonseekable_open(inode, filp);
+
+@@ -651,13 +660,16 @@ err_module:
+ module_put(dev->ib_dev->owner);
+
+ err:
+- kref_put(&dev->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&dev->refcount))
++ ib_uverbs_comp_dev(dev);
++
+ return ret;
+ }
+
+ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ {
+ struct ib_uverbs_file *file = filp->private_data;
++ struct ib_uverbs_device *dev = file->device;
+
+ ib_uverbs_cleanup_ucontext(file, file->ucontext);
+
+@@ -665,6 +677,7 @@ static int ib_uverbs_close(struct inode *inode, struct file *filp)
+ kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
+
+ kref_put(&file->ref, ib_uverbs_release_file);
++ kobject_put(&dev->kobj);
+
+ return 0;
+ }
+@@ -760,10 +773,11 @@ static void ib_uverbs_add_one(struct ib_device *device)
+ if (!uverbs_dev)
+ return;
+
+- kref_init(&uverbs_dev->ref);
++ atomic_set(&uverbs_dev->refcount, 1);
+ init_completion(&uverbs_dev->comp);
+ uverbs_dev->xrcd_tree = RB_ROOT;
+ mutex_init(&uverbs_dev->xrcd_tree_mutex);
++ kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype);
+
+ spin_lock(&map_lock);
+ devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
+@@ -790,6 +804,7 @@ static void ib_uverbs_add_one(struct ib_device *device)
+ cdev_init(&uverbs_dev->cdev, NULL);
+ uverbs_dev->cdev.owner = THIS_MODULE;
+ uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
++ uverbs_dev->cdev.kobj.parent = &uverbs_dev->kobj;
+ kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum);
+ if (cdev_add(&uverbs_dev->cdev, base, 1))
+ goto err_cdev;
+@@ -820,9 +835,10 @@ err_cdev:
+ clear_bit(devnum, overflow_map);
+
+ err:
+- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&uverbs_dev->refcount))
++ ib_uverbs_comp_dev(uverbs_dev);
+ wait_for_completion(&uverbs_dev->comp);
+- kfree(uverbs_dev);
++ kobject_put(&uverbs_dev->kobj);
+ return;
+ }
+
+@@ -842,9 +858,10 @@ static void ib_uverbs_remove_one(struct ib_device *device)
+ else
+ clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, overflow_map);
+
+- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
++ if (atomic_dec_and_test(&uverbs_dev->refcount))
++ ib_uverbs_comp_dev(uverbs_dev);
+ wait_for_completion(&uverbs_dev->comp);
+- kfree(uverbs_dev);
++ kobject_put(&uverbs_dev->kobj);
+ }
+
+ static char *uverbs_devnode(struct device *dev, umode_t *mode)
+diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
+index a251becdaa98..890c23b3d714 100644
+--- a/drivers/infiniband/hw/mlx4/ah.c
++++ b/drivers/infiniband/hw/mlx4/ah.c
+@@ -169,9 +169,13 @@ int mlx4_ib_query_ah(struct ib_ah *ibah, struct ib_ah_attr *ah_attr)
+ enum rdma_link_layer ll;
+
+ memset(ah_attr, 0, sizeof *ah_attr);
+- ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
+ ah_attr->port_num = be32_to_cpu(ah->av.ib.port_pd) >> 24;
+ ll = rdma_port_get_link_layer(ibah->device, ah_attr->port_num);
++ if (ll == IB_LINK_LAYER_ETHERNET)
++ ah_attr->sl = be32_to_cpu(ah->av.eth.sl_tclass_flowlabel) >> 29;
++ else
++ ah_attr->sl = be32_to_cpu(ah->av.ib.sl_tclass_flowlabel) >> 28;
++
+ ah_attr->dlid = ll == IB_LINK_LAYER_INFINIBAND ? be16_to_cpu(ah->av.ib.dlid) : 0;
+ if (ah->av.ib.stat_rate)
+ ah_attr->static_rate = ah->av.ib.stat_rate - MLX4_STAT_RATE_OFFSET;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index a55353c37b3d..30e6d5fa79d3 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1931,8 +1931,8 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain, bool ats)
+ static void clear_dte_entry(u16 devid)
+ {
+ /* remove entry from the device table seen by the hardware */
+- amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
+- amd_iommu_dev_table[devid].data[1] = 0;
++ amd_iommu_dev_table[devid].data[0] = IOMMU_PTE_P | IOMMU_PTE_TV;
++ amd_iommu_dev_table[devid].data[1] &= DTE_FLAG_MASK;
+
+ amd_iommu_apply_erratum_63(devid);
+ }
+diff --git a/drivers/iommu/amd_iommu_types.h b/drivers/iommu/amd_iommu_types.h
+index c4ffacb033f2..42f2090d31cc 100644
+--- a/drivers/iommu/amd_iommu_types.h
++++ b/drivers/iommu/amd_iommu_types.h
+@@ -277,6 +277,7 @@
+ #define IOMMU_PTE_IR (1ULL << 61)
+ #define IOMMU_PTE_IW (1ULL << 62)
+
++#define DTE_FLAG_MASK (0x3ffULL << 32)
+ #define DTE_FLAG_IOTLB (0x01UL << 32)
+ #define DTE_FLAG_GV (0x01ULL << 55)
+ #define DTE_GLX_SHIFT (56)
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 28af276cff9f..bd400f2a8d26 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1827,13 +1827,20 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+ return -ENOMEM;
+ /* It is large page*/
+ if (largepage_lvl > 1) {
++ unsigned long nr_superpages, end_pfn, lvl_pages;
++
+ pteval |= DMA_PTE_LARGE_PAGE;
+- /* Ensure that old small page tables are removed to make room
+- for superpage, if they exist. */
+- dma_pte_clear_range(domain, iov_pfn,
+- iov_pfn + lvl_to_nr_pages(largepage_lvl) - 1);
+- dma_pte_free_pagetable(domain, iov_pfn,
+- iov_pfn + lvl_to_nr_pages(largepage_lvl) - 1);
++ lvl_pages = lvl_to_nr_pages(largepage_lvl);
++
++ nr_superpages = sg_res / lvl_pages;
++ end_pfn = iov_pfn + nr_superpages * lvl_pages - 1;
++
++ /*
++ * Ensure that old small page tables are
++ * removed to make room for superpage(s).
++ */
++ dma_pte_clear_range(domain, iov_pfn, end_pfn);
++ dma_pte_free_pagetable(domain, iov_pfn, end_pfn);
+ } else {
+ pteval &= ~(uint64_t)DMA_PTE_LARGE_PAGE;
+ }
+diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
+index ce8897933a84..004fa10896fd 100644
+--- a/drivers/macintosh/windfarm_core.c
++++ b/drivers/macintosh/windfarm_core.c
+@@ -421,7 +421,7 @@ int wf_unregister_client(struct notifier_block *nb)
+ {
+ mutex_lock(&wf_lock);
+ blocking_notifier_chain_unregister(&wf_client_list, nb);
+- wf_client_count++;
++ wf_client_count--;
+ if (wf_client_count == 0)
+ wf_stop_thread();
+ mutex_unlock(&wf_lock);
+diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
+index da4dc255bc54..518703048fa1 100644
+--- a/drivers/md/Kconfig
++++ b/drivers/md/Kconfig
+@@ -330,7 +330,7 @@ config DM_MULTIPATH
+ # of SCSI_DH if the latter isn't defined but if
+ # it is, DM_MULTIPATH must depend on it. We get a build
+ # error if SCSI_DH=m and DM_MULTIPATH=y
+- depends on SCSI_DH || !SCSI_DH
++ depends on !SCSI_DH || SCSI
+ ---help---
+ Allow volume managers to support multipath hardware.
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index a875348e819e..9085ba934df1 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7954,6 +7954,7 @@ int rdev_set_badblocks(struct md_rdev *rdev, sector_t s, int sectors,
+ /* Make sure they get written out promptly */
+ sysfs_notify_dirent_safe(rdev->sysfs_state);
+ set_bit(MD_CHANGE_CLEAN, &rdev->mddev->flags);
++ set_bit(MD_CHANGE_PENDING, &rdev->mddev->flags);
+ md_wakeup_thread(rdev->mddev->thread);
+ }
+ return rv;
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index dddd5a47f97d..be86d59eaa90 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -502,7 +502,7 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key)
+
+ r = new_block(s->info, &right);
+ if (r < 0) {
+- /* FIXME: put left */
++ unlock_block(s->info, left);
+ return r;
+ }
+
+diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
+index 06a0257e752a..1c9094de644f 100644
+--- a/drivers/md/raid0.c
++++ b/drivers/md/raid0.c
+@@ -88,6 +88,7 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ char b[BDEVNAME_SIZE];
+ char b2[BDEVNAME_SIZE];
+ struct r0conf *conf = kzalloc(sizeof(*conf), GFP_KERNEL);
++ unsigned short blksize = 512;
+
+ if (!conf)
+ return -ENOMEM;
+@@ -102,6 +103,9 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ sector_div(sectors, mddev->chunk_sectors);
+ rdev1->sectors = sectors * mddev->chunk_sectors;
+
++ blksize = max(blksize, queue_logical_block_size(
++ rdev1->bdev->bd_disk->queue));
++
+ rdev_for_each(rdev2, mddev) {
+ pr_debug("md/raid0:%s: comparing %s(%llu)"
+ " with %s(%llu)\n",
+@@ -138,6 +142,18 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ }
+ pr_debug("md/raid0:%s: FINAL %d zones\n",
+ mdname(mddev), conf->nr_strip_zones);
++ /*
++ * now since we have the hard sector sizes, we can make sure
++ * chunk size is a multiple of that sector size
++ */
++ if ((mddev->chunk_sectors << 9) % blksize) {
++ printk(KERN_ERR "md/raid0:%s: chunk_size of %d not multiple of block size %d\n",
++ mdname(mddev),
++ mddev->chunk_sectors << 9, blksize);
++ err = -EINVAL;
++ goto abort;
++ }
++
+ err = -ENOMEM;
+ conf->strip_zone = kzalloc(sizeof(struct strip_zone)*
+ conf->nr_strip_zones, GFP_KERNEL);
+@@ -186,9 +202,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ }
+ dev[j] = rdev1;
+
+- disk_stack_limits(mddev->gendisk, rdev1->bdev,
+- rdev1->data_offset << 9);
+-
+ if (rdev1->bdev->bd_disk->queue->merge_bvec_fn)
+ conf->has_merge_bvec = 1;
+
+@@ -257,21 +270,6 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
+ mddev->queue->backing_dev_info.congested_fn = raid0_congested;
+ mddev->queue->backing_dev_info.congested_data = mddev;
+
+- /*
+- * now since we have the hard sector sizes, we can make sure
+- * chunk size is a multiple of that sector size
+- */
+- if ((mddev->chunk_sectors << 9) % queue_logical_block_size(mddev->queue)) {
+- printk(KERN_ERR "md/raid0:%s: chunk_size of %d not valid\n",
+- mdname(mddev),
+- mddev->chunk_sectors << 9);
+- goto abort;
+- }
+-
+- blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
+- blk_queue_io_opt(mddev->queue,
+- (mddev->chunk_sectors << 9) * mddev->raid_disks);
+-
+ pr_debug("md/raid0:%s: done.\n", mdname(mddev));
+ *private_conf = conf;
+
+@@ -432,6 +430,27 @@ static int raid0_run(struct mddev *mddev)
+ mddev->private = conf;
+ }
+ conf = mddev->private;
++ if (mddev->queue) {
++ struct md_rdev *rdev;
++ bool discard_supported = false;
++
++ blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
++
++ blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
++ blk_queue_io_opt(mddev->queue,
++ (mddev->chunk_sectors << 9) * mddev->raid_disks);
++
++ rdev_for_each(rdev, mddev) {
++ disk_stack_limits(mddev->gendisk, rdev->bdev,
++ rdev->data_offset << 9);
++ if (blk_queue_discard(bdev_get_queue(rdev->bdev)))
++ discard_supported = true;
++ }
++ if (!discard_supported)
++ queue_flag_clear_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
++ else
++ queue_flag_set_unlocked(QUEUE_FLAG_DISCARD, mddev->queue);
++ }
+
+ /* calculate array device size */
+ md_set_array_sectors(mddev, raid0_size(mddev, 0, 0));
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 189eedbc3027..a548eed38937 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -1285,6 +1285,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ set_bit(Faulty, &rdev->flags);
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ set_bit(MD_CHANGE_DEVS, &mddev->flags);
++ set_bit(MD_CHANGE_PENDING, &mddev->flags);
+ printk(KERN_ALERT
+ "md/raid1:%s: Disk failure on %s, disabling device.\n"
+ "md/raid1:%s: Operation continuing on %d devices.\n",
+@@ -2061,6 +2062,7 @@ static void handle_sync_write_finished(struct r1conf *conf, struct r1bio *r1_bio
+ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio)
+ {
+ int m;
++ bool fail = false;
+ for (m = 0; m < conf->raid_disks * 2 ; m++)
+ if (r1_bio->bios[m] == IO_MADE_GOOD) {
+ struct md_rdev *rdev = conf->mirrors[m].rdev;
+@@ -2073,6 +2075,7 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio)
+ * narrow down and record precise write
+ * errors.
+ */
++ fail = true;
+ if (!narrow_write_error(r1_bio, m)) {
+ md_error(conf->mddev,
+ conf->mirrors[m].rdev);
+@@ -2082,9 +2085,17 @@ static void handle_write_finished(struct r1conf *conf, struct r1bio *r1_bio)
+ rdev_dec_pending(conf->mirrors[m].rdev,
+ conf->mddev);
+ }
+- if (test_bit(R1BIO_WriteError, &r1_bio->state))
+- close_write(r1_bio);
+- raid_end_bio_io(r1_bio);
++ if (fail) {
++ spin_lock_irq(&conf->device_lock);
++ list_add(&r1_bio->retry_list, &conf->bio_end_io_list);
++ conf->nr_queued++;
++ spin_unlock_irq(&conf->device_lock);
++ md_wakeup_thread(conf->mddev->thread);
++ } else {
++ if (test_bit(R1BIO_WriteError, &r1_bio->state))
++ close_write(r1_bio);
++ raid_end_bio_io(r1_bio);
++ }
+ }
+
+ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio)
+@@ -2187,6 +2198,29 @@ static void raid1d(struct mddev *mddev)
+
+ md_check_recovery(mddev);
+
++ if (!list_empty_careful(&conf->bio_end_io_list) &&
++ !test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
++ LIST_HEAD(tmp);
++ spin_lock_irqsave(&conf->device_lock, flags);
++ if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
++ while (!list_empty(&conf->bio_end_io_list)) {
++ list_move(conf->bio_end_io_list.prev, &tmp);
++ conf->nr_queued--;
++ }
++ }
++ spin_unlock_irqrestore(&conf->device_lock, flags);
++ while (!list_empty(&tmp)) {
++ r1_bio = list_first_entry(&conf->bio_end_io_list,
++ struct r1bio, retry_list);
++ list_del(&r1_bio->retry_list);
++ if (mddev->degraded)
++ set_bit(R1BIO_Degraded, &r1_bio->state);
++ if (test_bit(R1BIO_WriteError, &r1_bio->state))
++ close_write(r1_bio);
++ raid_end_bio_io(r1_bio);
++ }
++ }
++
+ blk_start_plug(&plug);
+ for (;;) {
+
+@@ -2596,6 +2630,7 @@ static struct r1conf *setup_conf(struct mddev *mddev)
+ conf->raid_disks = mddev->raid_disks;
+ conf->mddev = mddev;
+ INIT_LIST_HEAD(&conf->retry_list);
++ INIT_LIST_HEAD(&conf->bio_end_io_list);
+
+ spin_lock_init(&conf->resync_lock);
+ init_waitqueue_head(&conf->wait_barrier);
+diff --git a/drivers/md/raid1.h b/drivers/md/raid1.h
+index 80ded139314c..50086cf0eae1 100644
+--- a/drivers/md/raid1.h
++++ b/drivers/md/raid1.h
+@@ -48,6 +48,11 @@ struct r1conf {
+ * block, or anything else.
+ */
+ struct list_head retry_list;
++ /* A separate list of r1bio which just need raid_end_bio_io called.
++ * This mustn't happen for writes which had any errors if the superblock
++ * needs to be written.
++ */
++ struct list_head bio_end_io_list;
+
+ /* queue pending writes to be submitted on unplug */
+ struct bio_list pending_bio_list;
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 149426cd1e84..1b779805eeed 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1463,6 +1463,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ set_bit(Blocked, &rdev->flags);
+ set_bit(Faulty, &rdev->flags);
+ set_bit(MD_CHANGE_DEVS, &mddev->flags);
++ set_bit(MD_CHANGE_PENDING, &mddev->flags);
+ printk(KERN_ALERT
+ "md/raid10:%s: Disk failure on %s, disabling device.\n"
+ "md/raid10:%s: Operation continuing on %d devices.\n",
+@@ -2536,6 +2537,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
+ }
+ put_buf(r10_bio);
+ } else {
++ bool fail = false;
+ for (m = 0; m < conf->copies; m++) {
+ int dev = r10_bio->devs[m].devnum;
+ struct bio *bio = r10_bio->devs[m].bio;
+@@ -2548,6 +2550,7 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
+ rdev_dec_pending(rdev, conf->mddev);
+ } else if (bio != NULL &&
+ !test_bit(BIO_UPTODATE, &bio->bi_flags)) {
++ fail = true;
+ if (!narrow_write_error(r10_bio, m)) {
+ md_error(conf->mddev, rdev);
+ set_bit(R10BIO_Degraded,
+@@ -2565,10 +2568,17 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio)
+ rdev_dec_pending(rdev, conf->mddev);
+ }
+ }
+- if (test_bit(R10BIO_WriteError,
+- &r10_bio->state))
+- close_write(r10_bio);
+- raid_end_bio_io(r10_bio);
++ if (fail) {
++ spin_lock_irq(&conf->device_lock);
++ list_add(&r10_bio->retry_list, &conf->bio_end_io_list);
++ spin_unlock_irq(&conf->device_lock);
++ md_wakeup_thread(conf->mddev->thread);
++ } else {
++ if (test_bit(R10BIO_WriteError,
++ &r10_bio->state))
++ close_write(r10_bio);
++ raid_end_bio_io(r10_bio);
++ }
+ }
+ }
+
+@@ -2582,6 +2592,29 @@ static void raid10d(struct mddev *mddev)
+
+ md_check_recovery(mddev);
+
++ if (!list_empty_careful(&conf->bio_end_io_list) &&
++ !test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
++ LIST_HEAD(tmp);
++ spin_lock_irqsave(&conf->device_lock, flags);
++ if (!test_bit(MD_CHANGE_PENDING, &mddev->flags)) {
++ list_add(&tmp, &conf->bio_end_io_list);
++ list_del_init(&conf->bio_end_io_list);
++ }
++ spin_unlock_irqrestore(&conf->device_lock, flags);
++ while (!list_empty(&tmp)) {
++ r10_bio = list_first_entry(&conf->bio_end_io_list,
++ struct r10bio, retry_list);
++ list_del(&r10_bio->retry_list);
++ if (mddev->degraded)
++ set_bit(R10BIO_Degraded, &r10_bio->state);
++
++ if (test_bit(R10BIO_WriteError,
++ &r10_bio->state))
++ close_write(r10_bio);
++ raid_end_bio_io(r10_bio);
++ }
++ }
++
+ blk_start_plug(&plug);
+ for (;;) {
+
+@@ -3286,6 +3319,7 @@ static struct r10conf *setup_conf(struct mddev *mddev)
+
+ spin_lock_init(&conf->device_lock);
+ INIT_LIST_HEAD(&conf->retry_list);
++ INIT_LIST_HEAD(&conf->bio_end_io_list);
+
+ spin_lock_init(&conf->resync_lock);
+ init_waitqueue_head(&conf->wait_barrier);
+diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
+index 24d45b8af5c9..8085d90d1bef 100644
+--- a/drivers/md/raid10.h
++++ b/drivers/md/raid10.h
+@@ -42,6 +42,12 @@ struct r10conf {
+ sector_t chunk_mask;
+
+ struct list_head retry_list;
++ /* A separate list of r1bio which just need raid_end_bio_io called.
++ * This mustn't happen for writes which had any errors if the superblock
++ * needs to be written.
++ */
++ struct list_head bio_end_io_list;
++
+ /* queue pending writes and submit them on unplug */
+ struct bio_list pending_bio_list;
+ int pending_count;
+diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
+index cec1f8c05e67..a7ff6b54793c 100644
+--- a/drivers/media/rc/rc-main.c
++++ b/drivers/media/rc/rc-main.c
+@@ -946,9 +946,6 @@ static int rc_dev_uevent(struct device *device, struct kobj_uevent_env *env)
+ {
+ struct rc_dev *dev = to_rc_dev(device);
+
+- if (!dev || !dev->input_dev)
+- return -ENODEV;
+-
+ if (dev->rc_map.name)
+ ADD_HOTPLUG_VAR("NAME=%s", dev->rc_map.name);
+ if (dev->driver_name)
+diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
+index 43f1a0011a55..8f793ea1d23a 100644
+--- a/drivers/mtd/ubi/io.c
++++ b/drivers/mtd/ubi/io.c
+@@ -942,6 +942,11 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
+ goto bad;
+ }
+
++ if (data_size > ubi->leb_size) {
++ dbg_err("bad data_size");
++ goto bad;
++ }
++
+ if (vol_type == UBI_VID_STATIC) {
+ /*
+ * Although from high-level point of view static volumes may
+diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
+index c015fc0a76d8..4105a508f215 100644
+--- a/drivers/mtd/ubi/vtbl.c
++++ b/drivers/mtd/ubi/vtbl.c
+@@ -656,6 +656,7 @@ static int init_volumes(struct ubi_device *ubi, const struct ubi_scan_info *si,
+ if (ubi->corr_peb_count)
+ ubi_err("%d PEBs are corrupted and not used",
+ ubi->corr_peb_count);
++ return -ENOSPC;
+ }
+ ubi->rsvd_pebs += reserved_pebs;
+ ubi->avail_pebs -= reserved_pebs;
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 284d144ff5a6..3e42cd6f7c77 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -1513,6 +1513,7 @@ int ubi_wl_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
+ if (ubi->corr_peb_count)
+ ubi_err("%d PEBs are corrupted and not used",
+ ubi->corr_peb_count);
++ err = -ENOSPC;
+ goto out_free;
+ }
+ ubi->avail_pebs -= WL_RESERVED_PEBS;
+diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
+index cac5b256a1c7..37534a06b96b 100644
+--- a/drivers/net/wireless/ath/ath9k/init.c
++++ b/drivers/net/wireless/ath/ath9k/init.c
+@@ -683,6 +683,7 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+ hw->max_rate_tries = 10;
+ hw->sta_data_size = sizeof(struct ath_node);
+ hw->vif_data_size = sizeof(struct ath_vif);
++ hw->extra_tx_headroom = 4;
+
+ hw->wiphy->available_antennas_rx = BIT(ah->caps.max_rxchains) - 1;
+ hw->wiphy->available_antennas_tx = BIT(ah->caps.max_txchains) - 1;
+diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+index 56f41c9409d1..6314e24c20ca 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
++++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+@@ -1063,7 +1063,7 @@ static void iwlagn_wowlan_program_keys(struct ieee80211_hw *hw,
+ u8 *pn = seq.ccmp.pn;
+
+ ieee80211_get_key_rx_seq(key, i, &seq);
+- aes_sc->pn = cpu_to_le64(
++ aes_sc[i].pn = cpu_to_le64(
+ (u64)pn[5] |
+ ((u64)pn[4] << 8) |
+ ((u64)pn[3] << 16) |
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index c059ce1dd338..f89fc0f5a6ca 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -604,10 +604,10 @@ struct device_node *of_find_matching_node_by_address(struct device_node *from,
+ struct resource res;
+
+ while (dn) {
+- if (of_address_to_resource(dn, 0, &res))
+- continue;
+- if (res.start == base_address)
++ if (!of_address_to_resource(dn, 0, &res) &&
++ res.start == base_address)
+ return dn;
++
+ dn = of_find_matching_node(dn, matches);
+ }
+
+diff --git a/drivers/pci/access.c b/drivers/pci/access.c
+index 2a581642c237..f49d961cf54d 100644
+--- a/drivers/pci/access.c
++++ b/drivers/pci/access.c
+@@ -357,6 +357,56 @@ static const struct pci_vpd_ops pci_vpd_pci22_ops = {
+ .release = pci_vpd_pci22_release,
+ };
+
++static ssize_t pci_vpd_f0_read(struct pci_dev *dev, loff_t pos, size_t count,
++ void *arg)
++{
++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ ssize_t ret;
++
++ if (!tdev)
++ return -ENODEV;
++
++ ret = pci_read_vpd(tdev, pos, count, arg);
++ pci_dev_put(tdev);
++ return ret;
++}
++
++static ssize_t pci_vpd_f0_write(struct pci_dev *dev, loff_t pos, size_t count,
++ const void *arg)
++{
++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ ssize_t ret;
++
++ if (!tdev)
++ return -ENODEV;
++
++ ret = pci_write_vpd(tdev, pos, count, arg);
++ pci_dev_put(tdev);
++ return ret;
++}
++
++static const struct pci_vpd_ops pci_vpd_f0_ops = {
++ .read = pci_vpd_f0_read,
++ .write = pci_vpd_f0_write,
++ .release = pci_vpd_pci22_release,
++};
++
++static int pci_vpd_f0_dev_check(struct pci_dev *dev)
++{
++ struct pci_dev *tdev = pci_get_slot(dev->bus, PCI_SLOT(dev->devfn));
++ int ret = 0;
++
++ if (!tdev)
++ return -ENODEV;
++ if (!tdev->vpd || !tdev->multifunction ||
++ dev->class != tdev->class || dev->vendor != tdev->vendor ||
++ dev->device != tdev->device)
++ ret = -ENODEV;
++
++ pci_dev_put(tdev);
++ return ret;
++}
++
+ int pci_vpd_pci22_init(struct pci_dev *dev)
+ {
+ struct pci_vpd_pci22 *vpd;
+@@ -365,12 +415,21 @@ int pci_vpd_pci22_init(struct pci_dev *dev)
+ cap = pci_find_capability(dev, PCI_CAP_ID_VPD);
+ if (!cap)
+ return -ENODEV;
++ if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0) {
++ int ret = pci_vpd_f0_dev_check(dev);
++
++ if (ret)
++ return ret;
++ }
+ vpd = kzalloc(sizeof(*vpd), GFP_ATOMIC);
+ if (!vpd)
+ return -ENOMEM;
+
+ vpd->base.len = PCI_VPD_PCI22_SIZE;
+- vpd->base.ops = &pci_vpd_pci22_ops;
++ if (dev->dev_flags & PCI_DEV_FLAGS_VPD_REF_F0)
++ vpd->base.ops = &pci_vpd_f0_ops;
++ else
++ vpd->base.ops = &pci_vpd_pci22_ops;
+ mutex_init(&vpd->lock);
+ vpd->cap = cap;
+ vpd->busy = false;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index c0300242db86..3ce87c82f2b5 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -1883,6 +1883,15 @@ static void __devinit quirk_netmos(struct pci_dev *dev)
+ DECLARE_PCI_FIXUP_CLASS_HEADER(PCI_VENDOR_ID_NETMOS, PCI_ANY_ID,
+ PCI_CLASS_COMMUNICATION_SERIAL, 8, quirk_netmos);
+
++static void quirk_f0_vpd_link(struct pci_dev *dev)
++{
++ if ((dev->class >> 8) != PCI_CLASS_NETWORK_ETHERNET ||
++ !dev->multifunction || !PCI_FUNC(dev->devfn))
++ return;
++ dev->dev_flags |= PCI_DEV_FLAGS_VPD_REF_F0;
++}
++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, quirk_f0_vpd_link);
++
+ static void __devinit quirk_e100_interrupt(struct pci_dev *dev)
+ {
+ u16 command, pmcsr;
+@@ -2834,12 +2843,15 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x3c28, vtd_mask_spec_errors);
+
+ static void __devinit fixup_ti816x_class(struct pci_dev* dev)
+ {
++ u32 class = dev->class;
++
+ /* TI 816x devices do not have class code set when in PCIe boot mode */
+- dev_info(&dev->dev, "Setting PCI class for 816x PCIe device\n");
+- dev->class = PCI_CLASS_MULTIMEDIA_VIDEO;
++ dev->class = PCI_CLASS_MULTIMEDIA_VIDEO << 8;
++ dev_info(&dev->dev, "PCI class overridden (%#08x -> %#08x)\n",
++ class, dev->class);
+ }
+ DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_TI, 0xb800,
+- PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class);
++ PCI_CLASS_NOT_DEFINED, 0, fixup_ti816x_class);
+
+ /* Some PCIe devices do not work reliably with the claimed maximum
+ * payload size supported.
+diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
+index dbb8edfc8baa..06da698daebe 100644
+--- a/drivers/scsi/mvsas/mv_sas.c
++++ b/drivers/scsi/mvsas/mv_sas.c
+@@ -984,6 +984,8 @@ static void mvs_slot_free(struct mvs_info *mvi, u32 rx_desc)
+ static void mvs_slot_task_free(struct mvs_info *mvi, struct sas_task *task,
+ struct mvs_slot_info *slot, u32 slot_idx)
+ {
++ if (!slot)
++ return;
+ if (!slot->task)
+ return;
+ if (!sas_protocol_ata(task->task_proto))
+diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c
+index dc25bee8d33f..2ecc2d6464fb 100644
+--- a/drivers/spi/spi-pxa2xx.c
++++ b/drivers/spi/spi-pxa2xx.c
+@@ -799,6 +799,10 @@ static irqreturn_t ssp_int(int irq, void *dev_id)
+ if (!(sccr1_reg & SSCR1_TIE))
+ mask &= ~SSSR_TFS;
+
++ /* Ignore RX timeout interrupt if it is disabled */
++ if (!(sccr1_reg & SSCR1_TINTE))
++ mask &= ~SSSR_TINT;
++
+ if (!(status & mask))
+ return IRQ_NONE;
+
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 3d8f662e4fe9..a3f31e9ab214 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -831,8 +831,7 @@ static struct class spi_master_class = {
+ *
+ * The caller is responsible for assigning the bus number and initializing
+ * the master's methods before calling spi_register_master(); and (after errors
+- * adding the device) calling spi_master_put() and kfree() to prevent a memory
+- * leak.
++ * adding the device) calling spi_master_put() to prevent a memory leak.
+ */
+ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
+ {
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index fa0376b38019..fc8822fccac1 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1297,8 +1297,7 @@ handle_newline:
+ tty->canon_data++;
+ spin_unlock_irqrestore(&tty->read_lock, flags);
+ kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+- if (waitqueue_active(&tty->read_wait))
+- wake_up_interruptible(&tty->read_wait);
++ wake_up_interruptible(&tty->read_wait);
+ return;
+ }
+ }
+@@ -1421,8 +1420,7 @@ static void n_tty_receive_buf(struct tty_struct *tty, const unsigned char *cp,
+ if ((!tty->icanon && (tty->read_cnt >= tty->minimum_to_wake)) ||
+ L_EXTPROC(tty)) {
+ kill_fasync(&tty->fasync, SIGIO, POLL_IN);
+- if (waitqueue_active(&tty->read_wait))
+- wake_up_interruptible(&tty->read_wait);
++ wake_up_interruptible(&tty->read_wait);
+ }
+
+ /*
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 5f0b4a445b97..3ea41502a7bc 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -2018,8 +2018,24 @@ retry_open:
+ if (!noctty &&
+ current->signal->leader &&
+ !current->signal->tty &&
+- tty->session == NULL)
+- __proc_set_tty(current, tty);
++ tty->session == NULL) {
++ /*
++ * Don't let a process that only has write access to the tty
++ * obtain the privileges associated with having a tty as
++ * controlling terminal (being able to reopen it with full
++ * access through /dev/tty, being able to perform pushback).
++ * Many distributions set the group of all ttys to "tty" and
++ * grant write-only access to all terminals for setgid tty
++ * binaries, which should not imply full privileges on all ttys.
++ *
++ * This could theoretically break old code that performs open()
++ * on a write-only file descriptor. In that case, it might be
++ * necessary to also permit this if
++ * inode_permission(inode, MAY_READ) == 0.
++ */
++ if (filp->f_mode & FMODE_READ)
++ __proc_set_tty(current, tty);
++ }
+ spin_unlock_irq(¤t->sighand->siglock);
+ tty_unlock();
+ mutex_unlock(&tty_mutex);
+@@ -2308,7 +2324,7 @@ static int fionbio(struct file *file, int __user *p)
+ * Takes ->siglock() when updating signal->tty
+ */
+
+-static int tiocsctty(struct tty_struct *tty, int arg)
++static int tiocsctty(struct tty_struct *tty, struct file *file, int arg)
+ {
+ int ret = 0;
+ if (current->signal->leader && (task_session(current) == tty->session))
+@@ -2341,6 +2357,13 @@ static int tiocsctty(struct tty_struct *tty, int arg)
+ goto unlock;
+ }
+ }
++
++ /* See the comment in tty_open(). */
++ if ((file->f_mode & FMODE_READ) == 0 && !capable(CAP_SYS_ADMIN)) {
++ ret = -EPERM;
++ goto unlock;
++ }
++
+ proc_set_tty(current, tty);
+ unlock:
+ mutex_unlock(&tty_mutex);
+@@ -2695,7 +2718,7 @@ long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ no_tty();
+ return 0;
+ case TIOCSCTTY:
+- return tiocsctty(tty, arg);
++ return tiocsctty(tty, file, arg);
+ case TIOCGPGRP:
+ return tiocgpgrp(tty, real_tty, p);
+ case TIOCSPGRP:
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index cc1004a2f9cd..bfc9b69122d0 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -114,16 +114,18 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
+ cfgno, inum, asnum, ep->desc.bEndpointAddress);
+ ep->ss_ep_comp.bmAttributes = 16;
+ } else if (usb_endpoint_xfer_isoc(&ep->desc) &&
+- desc->bmAttributes > 2) {
++ USB_SS_MULT(desc->bmAttributes) > 3) {
+ dev_warn(ddev, "Isoc endpoint has Mult of %d in "
+ "config %d interface %d altsetting %d ep %d: "
+- "setting to 3\n", desc->bmAttributes + 1,
++ "setting to 3\n",
++ USB_SS_MULT(desc->bmAttributes),
+ cfgno, inum, asnum, ep->desc.bEndpointAddress);
+ ep->ss_ep_comp.bmAttributes = 2;
+ }
+
+ if (usb_endpoint_xfer_isoc(&ep->desc))
+- max_tx = (desc->bMaxBurst + 1) * (desc->bmAttributes + 1) *
++ max_tx = (desc->bMaxBurst + 1) *
++ (USB_SS_MULT(desc->bmAttributes)) *
+ usb_endpoint_maxp(&ep->desc);
+ else if (usb_endpoint_xfer_int(&ep->desc))
+ max_tx = usb_endpoint_maxp(&ep->desc) *
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 9fac46d41f4d..fd8e60ee7df2 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -49,6 +49,13 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Microsoft LifeCam-VX700 v2.0 */
+ { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Logitech ConferenceCam CC3000e */
++ { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT },
++ { USB_DEVICE(0x046d, 0x0848), .driver_info = USB_QUIRK_DELAY_INIT },
++
++ /* Logitech PTZ Pro Camera */
++ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT },
++
+ /* Logitech Quickcam Fusion */
+ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -73,6 +80,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ /* Philips PSC805 audio device */
+ { USB_DEVICE(0x0471, 0x0155), .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* Plantronic Audio 655 DSP */
++ { USB_DEVICE(0x047f, 0xc008), .driver_info = USB_QUIRK_RESET_RESUME },
++
++ /* Plantronic Audio 648 USB */
++ { USB_DEVICE(0x047f, 0xc013), .driver_info = USB_QUIRK_RESET_RESUME },
++
+ /* Artisman Watchdog Dongle */
+ { USB_DEVICE(0x04b4, 0x0526), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+diff --git a/drivers/usb/host/ehci-sysfs.c b/drivers/usb/host/ehci-sysfs.c
+index 14ced00ba220..0659024290af 100644
+--- a/drivers/usb/host/ehci-sysfs.c
++++ b/drivers/usb/host/ehci-sysfs.c
+@@ -29,7 +29,7 @@ static ssize_t show_companion(struct device *dev,
+ int count = PAGE_SIZE;
+ char *ptr = buf;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ nports = HCS_N_PORTS(ehci->hcs_params);
+
+ for (index = 0; index < nports; ++index) {
+@@ -54,7 +54,7 @@ static ssize_t store_companion(struct device *dev,
+ struct ehci_hcd *ehci;
+ int portnum, new_owner;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ new_owner = PORT_OWNER; /* Owned by companion */
+ if (sscanf(buf, "%d", &portnum) != 1)
+ return -EINVAL;
+@@ -85,7 +85,7 @@ static ssize_t show_uframe_periodic_max(struct device *dev,
+ struct ehci_hcd *ehci;
+ int n;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ n = scnprintf(buf, PAGE_SIZE, "%d\n", ehci->uframe_periodic_max);
+ return n;
+ }
+@@ -102,7 +102,7 @@ static ssize_t store_uframe_periodic_max(struct device *dev,
+ unsigned long flags;
+ ssize_t ret;
+
+- ehci = hcd_to_ehci(bus_to_hcd(dev_get_drvdata(dev)));
++ ehci = hcd_to_ehci(dev_get_drvdata(dev));
+ if (kstrtouint(buf, 0, &uframe_periodic_max) < 0)
+ return -EINVAL;
+
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 048cc382a7a9..cad4a174e3ed 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1493,10 +1493,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ * use Event Data TRBs, and we don't chain in a link TRB on short
+ * transfers, we're basically dividing by 1.
+ *
+- * xHCI 1.0 specification indicates that the Average TRB Length should
+- * be set to 8 for control endpoints.
++ * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length
++ * should be set to 8 for control endpoints.
+ */
+- if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100)
++ if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
+ ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8));
+ else
+ ep_ctx->tx_info |=
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 710b2e98b846..3053933732a1 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -121,6 +121,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ * PPT chipsets.
+ */
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
++ xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 5623785a300c..f38932857ffa 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -331,6 +331,15 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
+ ret = handshake(xhci, &xhci->op_regs->cmd_ring,
+ CMD_RING_RUNNING, 0, 5 * 1000 * 1000);
+ if (ret < 0) {
++ /* we are about to kill xhci, give it one more chance */
++ xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
++ &xhci->op_regs->cmd_ring);
++ udelay(1000);
++ ret = handshake(xhci, &xhci->op_regs->cmd_ring,
++ CMD_RING_RUNNING, 0, 3 * 1000 * 1000);
++ if (ret == 0)
++ return 0;
++
+ xhci_err(xhci, "Stopped the command ring failed, "
+ "maybe the host is dead\n");
+ xhci->xhc_state |= XHCI_STATE_DYING;
+@@ -2331,6 +2340,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ u32 trb_comp_code;
+ int ret = 0;
+ int td_num = 0;
++ bool handling_skipped_tds = false;
+
+ slot_id = TRB_TO_SLOT_ID(le32_to_cpu(event->flags));
+ xdev = xhci->devs[slot_id];
+@@ -2464,6 +2474,10 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ ep->skip = true;
+ xhci_dbg(xhci, "Miss service interval error, set skip flag\n");
+ goto cleanup;
++ case COMP_PING_ERR:
++ ep->skip = true;
++ xhci_dbg(xhci, "No Ping response error, Skip one Isoc TD\n");
++ goto cleanup;
+ default:
+ if (xhci_is_vendor_info_code(xhci, trb_comp_code)) {
+ status = 0;
+@@ -2595,13 +2609,18 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ ep, &status);
+
+ cleanup:
++
++
++ handling_skipped_tds = ep->skip &&
++ trb_comp_code != COMP_MISSED_INT &&
++ trb_comp_code != COMP_PING_ERR;
++
+ /*
+- * Do not update event ring dequeue pointer if ep->skip is set.
+- * Will roll back to continue process missed tds.
++ * Do not update event ring dequeue pointer if we're in a loop
++ * processing missed tds.
+ */
+- if (trb_comp_code == COMP_MISSED_INT || !ep->skip) {
++ if (!handling_skipped_tds)
+ inc_deq(xhci, xhci->event_ring);
+- }
+
+ if (ret) {
+ urb = td->urb;
+@@ -2636,7 +2655,7 @@ cleanup:
+ * Process them as short transfer until reach the td pointed by
+ * the event.
+ */
+- } while (ep->skip && trb_comp_code != COMP_MISSED_INT);
++ } while (handling_skipped_tds);
+
+ return 0;
+ }
+@@ -3487,8 +3506,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
+ if (start_cycle == 0)
+ field |= 0x1;
+
+- /* xHCI 1.0 6.4.1.2.1: Transfer Type field */
+- if (xhci->hci_version == 0x100) {
++ /* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */
++ if (xhci->hci_version >= 0x100) {
+ if (urb->transfer_buffer_length > 0) {
+ if (setup->bRequestType & USB_DIR_IN)
+ field |= TRB_TX_TYPE(TRB_DATA_IN);
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index fd52e1efd6ca..88be7a51df52 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -141,7 +141,8 @@ static int xhci_start(struct xhci_hcd *xhci)
+ "waited %u microseconds.\n",
+ XHCI_MAX_HALT_USEC);
+ if (!ret)
+- xhci->xhc_state &= ~XHCI_STATE_HALTED;
++ xhci->xhc_state &= ~(XHCI_STATE_HALTED | XHCI_STATE_DYING);
++
+ return ret;
+ }
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 1e4899c2d5f1..4038789d61c0 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -629,6 +629,10 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX2WI_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_CUSTOMWARE_MINIPLEX3_PID) },
+ /*
+ * ELV devices:
+ */
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 1fee973f100a..70b24c02b90d 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -568,6 +568,14 @@
+ */
+ #define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
+
++/*
++ * CustomWare / ShipModul NMEA multiplexers product ids (FTDI_VID)
++ */
++#define FTDI_CUSTOMWARE_MINIPLEX_PID 0xfd48 /* MiniPlex first generation NMEA Multiplexer */
++#define FTDI_CUSTOMWARE_MINIPLEX2_PID 0xfd49 /* MiniPlex-USB and MiniPlex-2 series */
++#define FTDI_CUSTOMWARE_MINIPLEX2WI_PID 0xfd4a /* MiniPlex-2Wi */
++#define FTDI_CUSTOMWARE_MINIPLEX3_PID 0xfd4b /* MiniPlex-3 series */
++
+
+ /********************************/
+ /** third-party VID/PID combos **/
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 9e51325828bc..575c1902d38d 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3685,7 +3685,8 @@ void btrfs_evict_inode(struct inode *inode)
+ goto no_delete;
+ }
+ /* do we really want it for ->i_nlink > 0 and zero btrfs_root_refs? */
+- btrfs_wait_ordered_range(inode, 0, (u64)-1);
++ if (!special_file(inode->i_mode))
++ btrfs_wait_ordered_range(inode, 0, (u64)-1);
+
+ if (root->fs_info->log_root_recovering) {
+ BUG_ON(!list_empty(&BTRFS_I(inode)->i_orphan));
+diff --git a/fs/ceph/super.c b/fs/ceph/super.c
+index f4fa5cf0cdf1..e5eacd9dd532 100644
+--- a/fs/ceph/super.c
++++ b/fs/ceph/super.c
+@@ -383,8 +383,10 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
+ if (opt->flags & CEPH_OPT_NOCRC)
+ seq_puts(m, ",nocrc");
+
+- if (opt->name)
+- seq_printf(m, ",name=%s", opt->name);
++ if (opt->name) {
++ seq_puts(m, ",name=");
++ seq_escape(m, opt->name, ", \t\n\\");
++ }
+ if (opt->key)
+ seq_puts(m, ",secret=<hidden>");
+
+@@ -429,7 +431,7 @@ static int ceph_show_options(struct seq_file *m, struct dentry *root)
+ if (fsopt->max_readdir_bytes != CEPH_MAX_READDIR_BYTES_DEFAULT)
+ seq_printf(m, ",readdir_max_bytes=%d", fsopt->max_readdir_bytes);
+ if (strcmp(fsopt->snapdir_name, CEPH_SNAPDIRNAME_DEFAULT))
+- seq_printf(m, ",snapdirname=%s", fsopt->snapdir_name);
++ seq_show_option(m, "snapdirname", fsopt->snapdir_name);
+ return 0;
+ }
+
+diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c
+index 6dd3b61ea575..8431216eeb3c 100644
+--- a/fs/cifs/cifsencrypt.c
++++ b/fs/cifs/cifsencrypt.c
+@@ -388,6 +388,48 @@ find_domain_name(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ return 0;
+ }
+
++/* Server has provided av pairs/target info in the type 2 challenge
++ * packet and we have plucked it and stored within smb session.
++ * We parse that blob here to find the server given timestamp
++ * as part of ntlmv2 authentication (or local current time as
++ * default in case of failure)
++ */
++static __le64
++find_timestamp(struct cifs_ses *ses)
++{
++ unsigned int attrsize;
++ unsigned int type;
++ unsigned int onesize = sizeof(struct ntlmssp2_name);
++ unsigned char *blobptr;
++ unsigned char *blobend;
++ struct ntlmssp2_name *attrptr;
++
++ if (!ses->auth_key.len || !ses->auth_key.response)
++ return 0;
++
++ blobptr = ses->auth_key.response;
++ blobend = blobptr + ses->auth_key.len;
++
++ while (blobptr + onesize < blobend) {
++ attrptr = (struct ntlmssp2_name *) blobptr;
++ type = le16_to_cpu(attrptr->type);
++ if (type == NTLMSSP_AV_EOL)
++ break;
++ blobptr += 2; /* advance attr type */
++ attrsize = le16_to_cpu(attrptr->length);
++ blobptr += 2; /* advance attr size */
++ if (blobptr + attrsize > blobend)
++ break;
++ if (type == NTLMSSP_AV_TIMESTAMP) {
++ if (attrsize == sizeof(u64))
++ return *((__le64 *)blobptr);
++ }
++ blobptr += attrsize; /* advance attr value */
++ }
++
++ return cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
++}
++
+ static int calc_ntlmv2_hash(struct cifs_ses *ses, char *ntlmv2_hash,
+ const struct nls_table *nls_cp)
+ {
+@@ -549,6 +591,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ struct ntlmv2_resp *buf;
+ char ntlmv2_hash[16];
+ unsigned char *tiblob = NULL; /* target info blob */
++ __le64 rsp_timestamp;
+
+ if (ses->server->secType == RawNTLMSSP) {
+ if (!ses->domainName) {
+@@ -566,6 +609,12 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ }
+ }
+
++ /* Must be within 5 minutes of the server (or in range +/-2h
++ * in case of Mac OS X), so simply carry over server timestamp
++ * (as Windows 7 does)
++ */
++ rsp_timestamp = find_timestamp(ses);
++
+ baselen = CIFS_SESS_KEY_SIZE + sizeof(struct ntlmv2_resp);
+ tilen = ses->auth_key.len;
+ tiblob = ses->auth_key.response;
+@@ -583,7 +632,7 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp)
+ (ses->auth_key.response + CIFS_SESS_KEY_SIZE);
+ buf->blob_signature = cpu_to_le32(0x00000101);
+ buf->reserved = 0;
+- buf->time = cpu_to_le64(cifs_UnixTimeToNT(CURRENT_TIME));
++ buf->time = rsp_timestamp;
+ get_random_bytes(&buf->client_chal, sizeof(buf->client_chal));
+ buf->reserved2 = 0;
+
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index c0f65e84873e..5b730ba78ae3 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -373,10 +373,10 @@ cifs_show_options(struct seq_file *s, struct dentry *root)
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MULTIUSER)
+ seq_printf(s, ",multiuser");
+ else if (tcon->ses->user_name)
+- seq_printf(s, ",username=%s", tcon->ses->user_name);
++ seq_show_option(s, "username", tcon->ses->user_name);
+
+ if (tcon->ses->domainName)
+- seq_printf(s, ",domain=%s", tcon->ses->domainName);
++ seq_show_option(s, "domain", tcon->ses->domainName);
+
+ if (srcaddr->sa_family != AF_UNSPEC) {
+ struct sockaddr_in *saddr4;
+diff --git a/fs/ecryptfs/dentry.c b/fs/ecryptfs/dentry.c
+index 534c1d46e69e..eba8f1d4ad33 100644
+--- a/fs/ecryptfs/dentry.c
++++ b/fs/ecryptfs/dentry.c
+@@ -55,26 +55,26 @@ static int ecryptfs_d_revalidate(struct dentry *dentry, struct nameidata *nd)
+
+ lower_dentry = ecryptfs_dentry_to_lower(dentry);
+ lower_mnt = ecryptfs_dentry_to_lower_mnt(dentry);
+- if (!lower_dentry->d_op || !lower_dentry->d_op->d_revalidate)
+- goto out;
+- if (nd) {
+- dentry_save = nd->path.dentry;
+- vfsmount_save = nd->path.mnt;
+- nd->path.dentry = lower_dentry;
+- nd->path.mnt = lower_mnt;
+- }
+- rc = lower_dentry->d_op->d_revalidate(lower_dentry, nd);
+- if (nd) {
+- nd->path.dentry = dentry_save;
+- nd->path.mnt = vfsmount_save;
++ if (lower_dentry->d_op && lower_dentry->d_op->d_revalidate) {
++ if (nd) {
++ dentry_save = nd->path.dentry;
++ vfsmount_save = nd->path.mnt;
++ nd->path.dentry = lower_dentry;
++ nd->path.mnt = lower_mnt;
++ }
++ rc = lower_dentry->d_op->d_revalidate(lower_dentry, nd);
++ if (nd) {
++ nd->path.dentry = dentry_save;
++ nd->path.mnt = vfsmount_save;
++ }
+ }
+ if (dentry->d_inode) {
+- struct inode *lower_inode =
+- ecryptfs_inode_to_lower(dentry->d_inode);
++ struct inode *inode = dentry->d_inode;
+
+- fsstack_copy_attr_all(dentry->d_inode, lower_inode);
++ fsstack_copy_attr_all(inode, ecryptfs_inode_to_lower(inode));
++ if (!inode->i_nlink)
++ return 0;
+ }
+-out:
+ return rc;
+ }
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 2e26a542c818..3de888c3894a 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1682,10 +1682,10 @@ static inline void ext4_show_quota_options(struct seq_file *seq,
+ }
+
+ if (sbi->s_qf_names[USRQUOTA])
+- seq_printf(seq, ",usrjquota=%s", sbi->s_qf_names[USRQUOTA]);
++ seq_show_option(seq, "usrjquota", sbi->s_qf_names[USRQUOTA]);
+
+ if (sbi->s_qf_names[GRPQUOTA])
+- seq_printf(seq, ",grpjquota=%s", sbi->s_qf_names[GRPQUOTA]);
++ seq_show_option(seq, "grpjquota", sbi->s_qf_names[GRPQUOTA]);
+
+ if (test_opt(sb, USRQUOTA))
+ seq_puts(seq, ",usrquota");
+diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
+index 6172fa77ad59..4db9a9a31f29 100644
+--- a/fs/gfs2/super.c
++++ b/fs/gfs2/super.c
+@@ -1298,11 +1298,11 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root)
+ if (is_ancestor(root, sdp->sd_master_dir))
+ seq_printf(s, ",meta");
+ if (args->ar_lockproto[0])
+- seq_printf(s, ",lockproto=%s", args->ar_lockproto);
++ seq_show_option(s, "lockproto", args->ar_lockproto);
+ if (args->ar_locktable[0])
+- seq_printf(s, ",locktable=%s", args->ar_locktable);
++ seq_show_option(s, "locktable", args->ar_locktable);
+ if (args->ar_hostdata[0])
+- seq_printf(s, ",hostdata=%s", args->ar_hostdata);
++ seq_show_option(s, "hostdata", args->ar_hostdata);
+ if (args->ar_spectator)
+ seq_printf(s, ",spectator");
+ if (args->ar_localflocks)
+diff --git a/fs/hfs/bnode.c b/fs/hfs/bnode.c
+index cdb41a1f6a64..8daea16ef544 100644
+--- a/fs/hfs/bnode.c
++++ b/fs/hfs/bnode.c
+@@ -287,7 +287,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
+ page_cache_release(page);
+ goto fail;
+ }
+- page_cache_release(page);
+ node->page[i] = page;
+ }
+
+@@ -397,11 +396,11 @@ node_error:
+
+ void hfs_bnode_free(struct hfs_bnode *node)
+ {
+- //int i;
++ int i;
+
+- //for (i = 0; i < node->tree->pages_per_bnode; i++)
+- // if (node->page[i])
+- // page_cache_release(node->page[i]);
++ for (i = 0; i < node->tree->pages_per_bnode; i++)
++ if (node->page[i])
++ page_cache_release(node->page[i]);
+ kfree(node);
+ }
+
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index 92fb358ce824..db240c54a23a 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -132,13 +132,16 @@ skip:
+ hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ hfs_bnode_dump(node);
+
+- if (new_node) {
+- /* update parent key if we inserted a key
+- * at the start of the first node
+- */
+- if (!rec && new_node != node)
+- hfs_brec_update_parent(fd);
++ /*
++ * update parent key if we inserted a key
++ * at the start of the node and it is not the new node
++ */
++ if (!rec && new_node != node) {
++ hfs_bnode_read_key(node, fd->search_key, data_off + size);
++ hfs_brec_update_parent(fd);
++ }
+
++ if (new_node) {
+ hfs_bnode_put(fd->bnode);
+ if (!new_node->parent) {
+ hfs_btree_inc_height(tree);
+@@ -167,9 +170,6 @@ skip:
+ goto again;
+ }
+
+- if (!rec)
+- hfs_brec_update_parent(fd);
+-
+ return 0;
+ }
+
+@@ -366,6 +366,8 @@ again:
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
+ __hfs_brec_find(parent, fd);
++ if (fd->record < 0)
++ return -ENOENT;
+ hfs_bnode_dump(parent);
+ rec = fd->record;
+
+diff --git a/fs/hfs/super.c b/fs/hfs/super.c
+index 7b4c537d6e13..be0e218a333e 100644
+--- a/fs/hfs/super.c
++++ b/fs/hfs/super.c
+@@ -138,9 +138,9 @@ static int hfs_show_options(struct seq_file *seq, struct dentry *root)
+ struct hfs_sb_info *sbi = HFS_SB(root->d_sb);
+
+ if (sbi->s_creator != cpu_to_be32(0x3f3f3f3f))
+- seq_printf(seq, ",creator=%.4s", (char *)&sbi->s_creator);
++ seq_show_option_n(seq, "creator", (char *)&sbi->s_creator, 4);
+ if (sbi->s_type != cpu_to_be32(0x3f3f3f3f))
+- seq_printf(seq, ",type=%.4s", (char *)&sbi->s_type);
++ seq_show_option_n(seq, "type", (char *)&sbi->s_type, 4);
+ seq_printf(seq, ",uid=%u,gid=%u", sbi->s_uid, sbi->s_gid);
+ if (sbi->s_file_umask != 0133)
+ seq_printf(seq, ",file_umask=%o", sbi->s_file_umask);
+diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
+index 1c42cc5b899f..a1e91092fc24 100644
+--- a/fs/hfsplus/bnode.c
++++ b/fs/hfsplus/bnode.c
+@@ -454,7 +454,6 @@ static struct hfs_bnode *__hfs_bnode_create(struct hfs_btree *tree, u32 cnid)
+ page_cache_release(page);
+ goto fail;
+ }
+- page_cache_release(page);
+ node->page[i] = page;
+ }
+
+@@ -566,13 +565,11 @@ node_error:
+
+ void hfs_bnode_free(struct hfs_bnode *node)
+ {
+-#if 0
+ int i;
+
+ for (i = 0; i < node->tree->pages_per_bnode; i++)
+ if (node->page[i])
+ page_cache_release(node->page[i]);
+-#endif
+ kfree(node);
+ }
+
+diff --git a/fs/hfsplus/options.c b/fs/hfsplus/options.c
+index 06fa5618600c..38e41d07d67f 100644
+--- a/fs/hfsplus/options.c
++++ b/fs/hfsplus/options.c
+@@ -211,9 +211,9 @@ int hfsplus_show_options(struct seq_file *seq, struct dentry *root)
+ struct hfsplus_sb_info *sbi = HFSPLUS_SB(root->d_sb);
+
+ if (sbi->creator != HFSPLUS_DEF_CR_TYPE)
+- seq_printf(seq, ",creator=%.4s", (char *)&sbi->creator);
++ seq_show_option_n(seq, "creator", (char *)&sbi->creator, 4);
+ if (sbi->type != HFSPLUS_DEF_CR_TYPE)
+- seq_printf(seq, ",type=%.4s", (char *)&sbi->type);
++ seq_show_option_n(seq, "type", (char *)&sbi->type, 4);
+ seq_printf(seq, ",umask=%o,uid=%u,gid=%u", sbi->umask,
+ sbi->uid, sbi->gid);
+ if (sbi->part >= 0)
+diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
+index 07c516bfea76..fe63b15f54d2 100644
+--- a/fs/hostfs/hostfs_kern.c
++++ b/fs/hostfs/hostfs_kern.c
+@@ -264,7 +264,7 @@ static int hostfs_show_options(struct seq_file *seq, struct dentry *root)
+ size_t offset = strlen(root_ino) + 1;
+
+ if (strlen(root_path) > offset)
+- seq_printf(seq, ",%s", root_path + offset);
++ seq_show_option(seq, root_path + offset, NULL);
+
+ return 0;
+ }
+diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
+index 30dd7b10b507..bdb86a8a802e 100644
+--- a/fs/hpfs/namei.c
++++ b/fs/hpfs/namei.c
+@@ -8,6 +8,17 @@
+ #include <linux/sched.h>
+ #include "hpfs_fn.h"
+
++static void hpfs_update_directory_times(struct inode *dir)
++{
++ time_t t = get_seconds();
++ if (t == dir->i_mtime.tv_sec &&
++ t == dir->i_ctime.tv_sec)
++ return;
++ dir->i_mtime.tv_sec = dir->i_ctime.tv_sec = t;
++ dir->i_mtime.tv_nsec = dir->i_ctime.tv_nsec = 0;
++ hpfs_write_inode_nolock(dir);
++}
++
+ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ {
+ const unsigned char *name = dentry->d_name.name;
+@@ -99,6 +110,7 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ result->i_mode = mode | S_IFDIR;
+ hpfs_write_inode_nolock(result);
+ }
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ hpfs_unlock(dir->i_sb);
+ return 0;
+@@ -187,6 +199,7 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, s
+ result->i_mode = mode | S_IFREG;
+ hpfs_write_inode_nolock(result);
+ }
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ hpfs_unlock(dir->i_sb);
+ return 0;
+@@ -262,6 +275,7 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de
+ insert_inode_hash(result);
+
+ hpfs_write_inode_nolock(result);
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ brelse(bh);
+ hpfs_unlock(dir->i_sb);
+@@ -340,6 +354,7 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
+ insert_inode_hash(result);
+
+ hpfs_write_inode_nolock(result);
++ hpfs_update_directory_times(dir);
+ d_instantiate(dentry, result);
+ hpfs_unlock(dir->i_sb);
+ return 0;
+@@ -423,6 +438,8 @@ again:
+ out1:
+ hpfs_brelse4(&qbh);
+ out:
++ if (!err)
++ hpfs_update_directory_times(dir);
+ hpfs_unlock(dir->i_sb);
+ return err;
+ }
+@@ -477,6 +494,8 @@ static int hpfs_rmdir(struct inode *dir, struct dentry *dentry)
+ out1:
+ hpfs_brelse4(&qbh);
+ out:
++ if (!err)
++ hpfs_update_directory_times(dir);
+ hpfs_unlock(dir->i_sb);
+ return err;
+ }
+@@ -595,7 +614,7 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ goto end1;
+ }
+
+- end:
++end:
+ hpfs_i(i)->i_parent_dir = new_dir->i_ino;
+ if (S_ISDIR(i->i_mode)) {
+ inc_nlink(new_dir);
+@@ -610,6 +629,10 @@ static int hpfs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ brelse(bh);
+ }
+ end1:
++ if (!err) {
++ hpfs_update_directory_times(old_dir);
++ hpfs_update_directory_times(new_dir);
++ }
+ hpfs_unlock(i->i_sb);
+ return err;
+ }
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 3d344ab0bdb3..92eff4da0062 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1851,7 +1851,7 @@ static int _nfs4_do_open(struct inode *dir, struct dentry *dentry, fmode_t fmode
+ if (server->caps & NFS_CAP_POSIX_LOCK)
+ set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
+
+- if (opendata->o_arg.open_flags & O_EXCL) {
++ if ((opendata->o_arg.open_flags & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL)) {
+ nfs4_exclusive_attrset(opendata, sattr);
+
+ nfs_fattr_init(opendata->o_res.f_attr);
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 7ba6ac187edd..8e48ba5f6549 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -1411,6 +1411,7 @@ int dlm_master_request_handler(struct o2net_msg *msg, u32 len, void *data,
+ int found, ret;
+ int set_maybe;
+ int dispatch_assert = 0;
++ int dispatched = 0;
+
+ if (!dlm_grab(dlm))
+ return DLM_MASTER_RESP_NO;
+@@ -1617,13 +1618,16 @@ send_response:
+ mlog(ML_ERROR, "failed to dispatch assert master work\n");
+ response = DLM_MASTER_RESP_ERROR;
+ dlm_lockres_put(res);
++ } else {
++ dispatched = 1;
+ }
+ } else {
+ if (res)
+ dlm_lockres_put(res);
+ }
+
+- dlm_put(dlm);
++ if (!dispatched)
++ dlm_put(dlm);
+ return response;
+ }
+
+@@ -2041,7 +2045,6 @@ int dlm_dispatch_assert_master(struct dlm_ctxt *dlm,
+
+
+ /* queue up work for dlm_assert_master_worker */
+- dlm_grab(dlm); /* get an extra ref for the work item */
+ dlm_init_work_item(dlm, item, dlm_assert_master_worker, NULL);
+ item->u.am.lockres = res; /* already have a ref */
+ /* can optionally ignore node numbers higher than this node */
+diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c
+index d15b0714ee3e..0e5013ed7f13 100644
+--- a/fs/ocfs2/dlm/dlmrecovery.c
++++ b/fs/ocfs2/dlm/dlmrecovery.c
+@@ -1689,6 +1689,7 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
+ unsigned int hash;
+ int master = DLM_LOCK_RES_OWNER_UNKNOWN;
+ u32 flags = DLM_ASSERT_MASTER_REQUERY;
++ int dispatched = 0;
+
+ if (!dlm_grab(dlm)) {
+ /* since the domain has gone away on this
+@@ -1710,6 +1711,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
+ mlog_errno(-ENOMEM);
+ /* retry!? */
+ BUG();
++ } else {
++ dispatched = 1;
+ }
+ } else /* put.. incase we are not the master */
+ dlm_lockres_put(res);
+@@ -1717,7 +1720,8 @@ int dlm_master_requery_handler(struct o2net_msg *msg, u32 len, void *data,
+ }
+ spin_unlock(&dlm->spinlock);
+
+- dlm_put(dlm);
++ if (!dispatched)
++ dlm_put(dlm);
+ return master;
+ }
+
+diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
+index 68f4541c2db9..91a0020a0ad3 100644
+--- a/fs/ocfs2/super.c
++++ b/fs/ocfs2/super.c
+@@ -1578,8 +1578,8 @@ static int ocfs2_show_options(struct seq_file *s, struct dentry *root)
+ seq_printf(s, ",localflocks,");
+
+ if (osb->osb_cluster_stack[0])
+- seq_printf(s, ",cluster_stack=%.*s", OCFS2_STACK_LABEL_LEN,
+- osb->osb_cluster_stack);
++ seq_show_option_n(s, "cluster_stack", osb->osb_cluster_stack,
++ OCFS2_STACK_LABEL_LEN);
+ if (opts & OCFS2_MOUNT_USRQUOTA)
+ seq_printf(s, ",usrquota");
+ if (opts & OCFS2_MOUNT_GRPQUOTA)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index abfb93525ca6..6049235e2a69 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -390,6 +390,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ void *addr;
+ size_t chars = buf->len, remaining;
+ int error, atomic;
++ int offset;
+
+ if (chars > total_len)
+ chars = total_len;
+@@ -403,9 +404,10 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+
+ atomic = !iov_fault_in_pages_write(iov, chars);
+ remaining = chars;
++ offset = buf->offset;
+ redo:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
++ error = pipe_iov_copy_to_user(iov, addr, &offset,
+ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ if (unlikely(error)) {
+@@ -421,6 +423,7 @@ redo:
+ break;
+ }
+ ret += chars;
++ buf->offset += chars;
+ buf->len -= chars;
+
+ /* Was it a packet buffer? Clean up and exit */
+diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
+index 8169be93ac0f..e12357bb3090 100644
+--- a/fs/reiserfs/super.c
++++ b/fs/reiserfs/super.c
+@@ -645,18 +645,20 @@ static int reiserfs_show_options(struct seq_file *seq, struct dentry *root)
+ seq_puts(seq, ",acl");
+
+ if (REISERFS_SB(s)->s_jdev)
+- seq_printf(seq, ",jdev=%s", REISERFS_SB(s)->s_jdev);
++ seq_show_option(seq, "jdev", REISERFS_SB(s)->s_jdev);
+
+ if (journal->j_max_commit_age != journal->j_default_max_commit_age)
+ seq_printf(seq, ",commit=%d", journal->j_max_commit_age);
+
+ #ifdef CONFIG_QUOTA
+ if (REISERFS_SB(s)->s_qf_names[USRQUOTA])
+- seq_printf(seq, ",usrjquota=%s", REISERFS_SB(s)->s_qf_names[USRQUOTA]);
++ seq_show_option(seq, "usrjquota",
++ REISERFS_SB(s)->s_qf_names[USRQUOTA]);
+ else if (opts & (1 << REISERFS_USRQUOTA))
+ seq_puts(seq, ",usrquota");
+ if (REISERFS_SB(s)->s_qf_names[GRPQUOTA])
+- seq_printf(seq, ",grpjquota=%s", REISERFS_SB(s)->s_qf_names[GRPQUOTA]);
++ seq_show_option(seq, "grpjquota",
++ REISERFS_SB(s)->s_qf_names[GRPQUOTA]);
+ else if (opts & (1 << REISERFS_GRPQUOTA))
+ seq_puts(seq, ",grpquota");
+ if (REISERFS_SB(s)->s_jquota_fmt) {
+diff --git a/fs/splice.c b/fs/splice.c
+index 67c5210e7ce7..286417764d6b 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1165,7 +1165,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ long ret, bytes;
+ umode_t i_mode;
+ size_t len;
+- int i, flags;
++ int i, flags, more;
+
+ /*
+ * We require the input being a regular file, as we don't want to
+@@ -1208,6 +1208,7 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ * Don't block on output, we have to drain the direct pipe.
+ */
+ sd->flags &= ~SPLICE_F_NONBLOCK;
++ more = sd->flags & SPLICE_F_MORE;
+
+ while (len) {
+ size_t read_len;
+@@ -1221,6 +1222,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd,
+ sd->total_len = read_len;
+
+ /*
++ * If more data is pending, set SPLICE_F_MORE
++ * If this is the last data and SPLICE_F_MORE was not set
++ * initially, clears it.
++ */
++ if (read_len < len)
++ sd->flags |= SPLICE_F_MORE;
++ else if (!more)
++ sd->flags &= ~SPLICE_F_MORE;
++ /*
+ * NOTE: nonblocking mode only applies to the input. We
+ * must not do the output in nonblocking mode as then we
+ * could get stuck data in the internal pipe:
+diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c
+index dab9a5f6dfd6..d6c787dc261d 100644
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -523,9 +523,9 @@ xfs_showargs(
+ seq_printf(m, "," MNTOPT_LOGBSIZE "=%dk", mp->m_logbsize >> 10);
+
+ if (mp->m_logname)
+- seq_printf(m, "," MNTOPT_LOGDEV "=%s", mp->m_logname);
++ seq_show_option(m, MNTOPT_LOGDEV, mp->m_logname);
+ if (mp->m_rtname)
+- seq_printf(m, "," MNTOPT_RTDEV "=%s", mp->m_rtname);
++ seq_show_option(m, MNTOPT_RTDEV, mp->m_rtname);
+
+ if (mp->m_dalign > 0)
+ seq_printf(m, "," MNTOPT_SUNIT "=%d",
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 469c9536c5e5..579baf06f77d 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -176,6 +176,8 @@ enum pci_dev_flags {
+ PCI_DEV_FLAGS_NO_D3 = (__force pci_dev_flags_t) 2,
+ /* Provide indication device is assigned by a Virtual Machine Manager */
+ PCI_DEV_FLAGS_ASSIGNED = (__force pci_dev_flags_t) 4,
++ /* Get VPD from function 0 VPD */
++ PCI_DEV_FLAGS_VPD_REF_F0 = (__force pci_dev_flags_t) (1 << 8),
+ };
+
+ enum pci_irq_reroute_variant {
+diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h
+index fc61854f6224..149b92f05562 100644
+--- a/include/linux/seq_file.h
++++ b/include/linux/seq_file.h
+@@ -127,6 +127,41 @@ int seq_put_decimal_ull(struct seq_file *m, char delimiter,
+ int seq_put_decimal_ll(struct seq_file *m, char delimiter,
+ long long num);
+
++/**
++ * seq_show_options - display mount options with appropriate escapes.
++ * @m: the seq_file handle
++ * @name: the mount option name
++ * @value: the mount option name's value, can be NULL
++ */
++static inline void seq_show_option(struct seq_file *m, const char *name,
++ const char *value)
++{
++ seq_putc(m, ',');
++ seq_escape(m, name, ",= \t\n\\");
++ if (value) {
++ seq_putc(m, '=');
++ seq_escape(m, value, ", \t\n\\");
++ }
++}
++
++/**
++ * seq_show_option_n - display mount options with appropriate escapes
++ * where @value must be a specific length.
++ * @m: the seq_file handle
++ * @name: the mount option name
++ * @value: the mount option name's value, cannot be NULL
++ * @length: the length of @value to display
++ *
++ * This is a macro since this uses "length" to define the size of the
++ * stack buffer.
++ */
++#define seq_show_option_n(m, name, value, length) { \
++ char val_buf[length + 1]; \
++ strncpy(val_buf, value, length); \
++ val_buf[length] = '\0'; \
++ seq_show_option(m, name, val_buf); \
++}
++
+ #define SEQ_START_TOKEN ((void *)1)
+ /*
+ * Helpers for iteration over list_head-s in seq_files
+diff --git a/include/sound/wm8904.h b/include/sound/wm8904.h
+index 898be3a8db9a..6d8f8fba3341 100644
+--- a/include/sound/wm8904.h
++++ b/include/sound/wm8904.h
+@@ -119,7 +119,7 @@
+ #define WM8904_MIC_REGS 2
+ #define WM8904_GPIO_REGS 4
+ #define WM8904_DRC_REGS 4
+-#define WM8904_EQ_REGS 25
++#define WM8904_EQ_REGS 24
+
+ /**
+ * DRC configurations are specified with a label and a set of register
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 34eda955e887..7ff5702507a5 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -1071,15 +1071,16 @@ static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
+
+ mutex_lock(&cgroup_root_mutex);
+ for_each_subsys(root, ss)
+- seq_printf(seq, ",%s", ss->name);
++ seq_show_option(seq, ss->name, NULL);
+ if (test_bit(ROOT_NOPREFIX, &root->flags))
+ seq_puts(seq, ",noprefix");
+ if (strlen(root->release_agent_path))
+- seq_printf(seq, ",release_agent=%s", root->release_agent_path);
++ seq_show_option(seq, "release_agent",
++ root->release_agent_path);
+ if (clone_children(&root->top_cgroup))
+ seq_puts(seq, ",clone_children");
+ if (strlen(root->name))
+- seq_printf(seq, ",name=%s", root->name);
++ seq_show_option(seq, "name", root->name);
+ mutex_unlock(&cgroup_root_mutex);
+ return 0;
+ }
+diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
+index fb655f5f9689..15374d0ac369 100644
+--- a/kernel/irq/proc.c
++++ b/kernel/irq/proc.c
+@@ -12,6 +12,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/interrupt.h>
+ #include <linux/kernel_stat.h>
++#include <linux/mutex.h>
+
+ #include "internals.h"
+
+@@ -326,18 +327,29 @@ void register_handler_proc(unsigned int irq, struct irqaction *action)
+
+ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
+ {
++ static DEFINE_MUTEX(register_lock);
+ char name [MAX_NAMELEN];
+
+- if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip) || desc->dir)
++ if (!root_irq_dir || (desc->irq_data.chip == &no_irq_chip))
+ return;
+
++ /*
++ * irq directories are registered only when a handler is
++ * added, not when the descriptor is created, so multiple
++ * tasks might try to register at the same time.
++ */
++ mutex_lock(®ister_lock);
++
++ if (desc->dir)
++ goto out_unlock;
++
+ memset(name, 0, MAX_NAMELEN);
+ sprintf(name, "%d", irq);
+
+ /* create /proc/irq/1234 */
+ desc->dir = proc_mkdir(name, root_irq_dir);
+ if (!desc->dir)
+- return;
++ goto out_unlock;
+
+ #ifdef CONFIG_SMP
+ /* create /proc/irq/<irq>/smp_affinity */
+@@ -358,6 +370,9 @@ void register_irq_proc(unsigned int irq, struct irq_desc *desc)
+
+ proc_create_data("spurious", 0444, desc->dir,
+ &irq_spurious_proc_fops, (void *)(long)irq);
++
++out_unlock:
++ mutex_unlock(®ister_lock);
+ }
+
+ void unregister_irq_proc(unsigned int irq, struct irq_desc *desc)
+diff --git a/kernel/module.c b/kernel/module.c
+index 5e398961b7b5..18e0879de3c6 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -887,11 +887,15 @@ void symbol_put_addr(void *addr)
+ if (core_kernel_text(a))
+ return;
+
+- /* module_text_address is safe here: we're supposed to have reference
+- * to module from symbol_get, so it can't go away. */
++ /*
++ * Even though we hold a reference on the module; we still need to
++ * disable preemption in order to safely traverse the data structure.
++ */
++ preempt_disable();
+ modaddr = __module_text_address(a);
+ BUG_ON(!modaddr);
+ module_put(modaddr);
++ preempt_enable();
+ }
+ EXPORT_SYMBOL_GPL(symbol_put_addr);
+
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 15be43522c8b..609a22630674 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1949,11 +1949,11 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
+ * If a task dies, then it sets TASK_DEAD in tsk->state and calls
+ * schedule one last time. The schedule call will never return, and
+ * the scheduled task must drop that reference.
+- * The test for TASK_DEAD must occur while the runqueue locks are
+- * still held, otherwise prev could be scheduled on another cpu, die
+- * there before we look at prev->state, and then the reference would
+- * be dropped twice.
+- * Manfred Spraul <manfred@colorfullife.com>
++ *
++ * We must observe prev->state before clearing prev->on_cpu (in
++ * finish_lock_switch), otherwise a concurrent wakeup can get prev
++ * running on another CPU and we could rave with its RUNNING -> DEAD
++ * transition, resulting in a double drop.
+ */
+ prev_state = prev->state;
+ finish_arch_switch(prev);
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index 4a5e7398d77b..44f4058e9e6d 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -702,8 +702,10 @@ static inline void finish_lock_switch(struct rq *rq, struct task_struct *prev)
+ * After ->on_cpu is cleared, the task can be moved to a different CPU.
+ * We must ensure this doesn't happen until the switch is completely
+ * finished.
++ *
++ * Pairs with the control dependency and rmb in try_to_wake_up().
+ */
+- smp_wmb();
++ smp_mb();
+ prev->on_cpu = 0;
+ #endif
+ #ifdef CONFIG_DEBUG_SPINLOCK
+diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c
+index c9583382141a..b3f54079287d 100644
+--- a/kernel/time/clocksource.c
++++ b/kernel/time/clocksource.c
+@@ -291,7 +291,7 @@ static void clocksource_watchdog(unsigned long data)
+ continue;
+
+ /* Check the deviation from the watchdog clocksource. */
+- if ((abs(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD)) {
++ if ((abs64(cs_nsec - wd_nsec) > WATCHDOG_THRESHOLD)) {
+ clocksource_unstable(cs, cs_nsec - wd_nsec);
+ continue;
+ }
+diff --git a/mm/filemap.c b/mm/filemap.c
+index 79c4b2b0b14e..448f9caa8695 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2402,6 +2402,11 @@ again:
+ break;
+ }
+
++ if (fatal_signal_pending(current)) {
++ status = -EINTR;
++ break;
++ }
++
+ status = a_ops->write_begin(file, mapping, pos, bytes, flags,
+ &page, &fsdata);
+ if (unlikely(status))
+@@ -2442,10 +2447,6 @@ again:
+ written += copied;
+
+ balance_dirty_pages_ratelimited(mapping);
+- if (fatal_signal_pending(current)) {
+- status = -EINTR;
+- break;
+- }
+ } while (iov_iter_count(i));
+
+ return written ? written : status;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index bc36e280ce8b..e622aab7fd8c 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2504,6 +2504,14 @@ static int unmap_ref_private(struct mm_struct *mm, struct vm_area_struct *vma,
+ continue;
+
+ /*
++ * Shared VMAs have their own reserves and do not affect
++ * MAP_PRIVATE accounting but it is possible that a shared
++ * VMA is using the same page so check and skip such VMAs.
++ */
++ if (iter_vma->vm_flags & VM_MAYSHARE)
++ continue;
++
++ /*
+ * Unmap the page from other VMAs without their own reserves.
+ * They get marked to be SIGKILLed if they fault in these
+ * areas. This is because a future no-page fault on this VMA
+diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
+index 8755a3079d0f..7fc10b915cd8 100644
+--- a/net/ipv6/xfrm6_output.c
++++ b/net/ipv6/xfrm6_output.c
+@@ -137,20 +137,24 @@ static int __xfrm6_output(struct sk_buff *skb)
+ struct dst_entry *dst = skb_dst(skb);
+ struct xfrm_state *x = dst->xfrm;
+ int mtu = ip6_skb_dst_mtu(skb);
++ bool toobig;
+
+- if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
++ if (x->props.mode != XFRM_MODE_TUNNEL)
++ goto skip_frag;
++
++ toobig = skb->len > mtu && !skb_is_gso(skb);
++
++ if (toobig && xfrm6_local_dontfrag(skb)) {
+ xfrm6_local_rxpmtu(skb, mtu);
+ return -EMSGSIZE;
+- } else if (!skb->local_df && skb->len > mtu && skb->sk) {
++ } else if (!skb->local_df && toobig && skb->sk) {
+ xfrm6_local_error(skb, mtu);
+ return -EMSGSIZE;
+ }
+
+- if (x->props.mode == XFRM_MODE_TUNNEL &&
+- ((skb->len > mtu && !skb_is_gso(skb)) ||
+- dst_allfrag(skb_dst(skb)))) {
++ if (toobig || dst_allfrag(skb_dst(skb)))
+ return ip6_fragment(skb, x->outer_mode->afinfo->output_finish);
+- }
++skip_frag:
+ return x->outer_mode->afinfo->output_finish(skb);
+ }
+
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index f4f24bee99c2..67cd0f1a1bab 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -284,9 +284,6 @@ ieee80211_tx_h_check_assoc(struct ieee80211_tx_data *tx)
+ if (tx->sdata->vif.type == NL80211_IFTYPE_WDS)
+ return TX_CONTINUE;
+
+- if (tx->sdata->vif.type == NL80211_IFTYPE_MESH_POINT)
+- return TX_CONTINUE;
+-
+ if (tx->flags & IEEE80211_TX_PS_BUFFERED)
+ return TX_CONTINUE;
+
+diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+index 42eb7ba0b903..897a5f14c61e 100644
+--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c
++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+@@ -545,6 +545,7 @@ static int send_reply(struct svcxprt_rdma *rdma,
+ {
+ struct ib_send_wr send_wr;
+ struct ib_send_wr inv_wr;
++ u32 xdr_off;
+ int sge_no;
+ int sge_bytes;
+ int page_no;
+@@ -584,8 +585,8 @@ static int send_reply(struct svcxprt_rdma *rdma,
+ ctxt->direction = DMA_TO_DEVICE;
+
+ /* Map the payload indicated by 'byte_count' */
++ xdr_off = 0;
+ for (sge_no = 1; byte_count && sge_no < vec->count; sge_no++) {
+- int xdr_off = 0;
+ sge_bytes = min_t(size_t, vec->sge[sge_no].iov_len, byte_count);
+ byte_count -= sge_bytes;
+ if (!vec->frmr) {
+@@ -623,6 +624,14 @@ static int send_reply(struct svcxprt_rdma *rdma,
+ if (page_no+1 >= sge_no)
+ ctxt->sge[page_no+1].length = 0;
+ }
++
++ /* The loop above bumps sc_dma_used for each sge. The
++ * xdr_buf.tail gets a separate sge, but resides in the
++ * same page as xdr_buf.head. Don't count it twice.
++ */
++ if (sge_no > ctxt->count)
++ atomic_dec(&rdma->sc_dma_used);
++
+ BUG_ON(sge_no > rdma->sc_max_sge);
+ memset(&send_wr, 0, sizeof send_wr);
+ ctxt->wr_op = IB_WR_SEND;
+diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
+index 31275e52c667..d4a564fec093 100644
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -811,6 +811,7 @@ static void xs_reset_transport(struct sock_xprt *transport)
+ {
+ struct socket *sock = transport->sock;
+ struct sock *sk = transport->inet;
++ struct rpc_xprt *xprt = &transport->xprt;
+
+ if (sk == NULL)
+ return;
+@@ -824,6 +825,7 @@ static void xs_reset_transport(struct sock_xprt *transport)
+ sk->sk_user_data = NULL;
+
+ xs_restore_old_callbacks(transport, sk);
++ xprt_clear_connected(xprt);
+ write_unlock_bh(&sk->sk_callback_lock);
+
+ sk->sk_no_check = 0;
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index cbae6d392087..312d2fb598d7 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -1012,7 +1012,7 @@ static void selinux_write_opts(struct seq_file *m,
+ seq_puts(m, prefix);
+ if (has_comma)
+ seq_putc(m, '\"');
+- seq_puts(m, opts->mnt_opts[i]);
++ seq_escape(m, opts->mnt_opts[i], "\"\n\\");
+ if (has_comma)
+ seq_putc(m, '\"');
+ }
+diff --git a/sound/arm/Kconfig b/sound/arm/Kconfig
+index 885683a3b0bd..e0406211716b 100644
+--- a/sound/arm/Kconfig
++++ b/sound/arm/Kconfig
+@@ -9,6 +9,14 @@ menuconfig SND_ARM
+ Drivers that are implemented on ASoC can be found in
+ "ALSA for SoC audio support" section.
+
++config SND_PXA2XX_LIB
++ tristate
++ select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
++ select SND_DMAENGINE_PCM
++
++config SND_PXA2XX_LIB_AC97
++ bool
++
+ if SND_ARM
+
+ config SND_ARMAACI
+@@ -21,13 +29,6 @@ config SND_PXA2XX_PCM
+ tristate
+ select SND_PCM
+
+-config SND_PXA2XX_LIB
+- tristate
+- select SND_AC97_CODEC if SND_PXA2XX_LIB_AC97
+-
+-config SND_PXA2XX_LIB_AC97
+- bool
+-
+ config SND_PXA2XX_AC97
+ tristate "AC97 driver for the Intel PXA2xx chip"
+ depends on ARCH_PXA
+diff --git a/sound/soc/pxa/Kconfig b/sound/soc/pxa/Kconfig
+index a0f7d3cfa470..23deb67b8b4e 100644
+--- a/sound/soc/pxa/Kconfig
++++ b/sound/soc/pxa/Kconfig
+@@ -1,7 +1,6 @@
+ config SND_PXA2XX_SOC
+ tristate "SoC Audio for the Intel PXA2xx chip"
+ depends on ARCH_PXA
+- select SND_ARM
+ select SND_PXA2XX_LIB
+ help
+ Say Y or M if you want to add support for codecs attached to
+@@ -15,7 +14,6 @@ config SND_PXA2XX_AC97
+ config SND_PXA2XX_SOC_AC97
+ tristate
+ select AC97_BUS
+- select SND_ARM
+ select SND_PXA2XX_LIB_AC97
+ select SND_SOC_AC97_BUS
+
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index daf61abc3670..646b66703bd8 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -69,7 +69,8 @@ snd_emux_init_seq_oss(struct snd_emux *emu)
+ struct snd_seq_oss_reg *arg;
+ struct snd_seq_device *dev;
+
+- if (snd_seq_device_new(emu->card, 0, SNDRV_SEQ_DEV_ID_OSS,
++ /* using device#1 here for avoiding conflicts with OPL3 */
++ if (snd_seq_device_new(emu->card, 1, SNDRV_SEQ_DEV_ID_OSS,
+ sizeof(struct snd_seq_oss_reg), &dev) < 0)
+ return;
+
+diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
+index c0b70c697a36..5a4482c2a7d5 100644
+--- a/tools/perf/util/header.c
++++ b/tools/perf/util/header.c
+@@ -1060,25 +1060,19 @@ static void print_cpudesc(struct perf_header *ph, int fd, FILE *fp)
+ static void print_nrcpus(struct perf_header *ph, int fd, FILE *fp)
+ {
+ ssize_t ret;
+- u32 nr;
++ u32 nr[2];
+
+ ret = read(fd, &nr, sizeof(nr));
+ if (ret != (ssize_t)sizeof(nr))
+- nr = -1; /* interpreted as error */
++ nr[0] = nr[1] = -1; /* interpreted as error */
+
+- if (ph->needs_swap)
+- nr = bswap_32(nr);
+-
+- fprintf(fp, "# nrcpus online : %u\n", nr);
+-
+- ret = read(fd, &nr, sizeof(nr));
+- if (ret != (ssize_t)sizeof(nr))
+- nr = -1; /* interpreted as error */
+-
+- if (ph->needs_swap)
+- nr = bswap_32(nr);
++ if (ph->needs_swap) {
++ nr[0] = bswap_32(nr[0]);
++ nr[1] = bswap_32(nr[1]);
++ }
+
+- fprintf(fp, "# nrcpus avail : %u\n", nr);
++ fprintf(fp, "# nrcpus online : %u\n", nr[1]);
++ fprintf(fp, "# nrcpus avail : %u\n", nr[0]);
+ }
+
+ static void print_version(struct perf_header *ph, int fd, FILE *fp)
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2016-03-21 15:06 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2016-03-21 15:06 UTC (permalink / raw
To: gentoo-commits
commit: dec55ef47fbb470215eb260d2f670d7270deb6f5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Mar 21 15:06:48 2016 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Mar 21 15:06:48 2016 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dec55ef4
Linux patch 3.4.111
0000_README | 4 +
1110_linux-3.4.111.patch | 4812 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 4816 insertions(+)
diff --git a/0000_README b/0000_README
index 42786be..efb1797 100644
--- a/0000_README
+++ b/0000_README
@@ -479,6 +479,10 @@ Patch: 1109_linux-3.4.110.patch
From: http://www.kernel.org
Desc: Linux 3.4.110
+Patch: 1110_linux-3.4.111.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.111
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1110_linux-3.4.111.patch b/1110_linux-3.4.111.patch
new file mode 100644
index 0000000..a88763a
--- /dev/null
+++ b/1110_linux-3.4.111.patch
@@ -0,0 +1,4812 @@
+diff --git a/Makefile b/Makefile
+index e99e5a5d571b..8a3f507065f9 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 110
++SUBLEVEL = 111
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h
+index b2202a68cf0f..95bcedbdc92c 100644
+--- a/arch/mips/include/asm/pgtable.h
++++ b/arch/mips/include/asm/pgtable.h
+@@ -153,8 +153,39 @@ static inline void set_pte(pte_t *ptep, pte_t pteval)
+ * Make sure the buddy is global too (if it's !none,
+ * it better already be global)
+ */
++#ifdef CONFIG_SMP
++ /*
++ * For SMP, multiple CPUs can race, so we need to do
++ * this atomically.
++ */
++#ifdef CONFIG_64BIT
++#define LL_INSN "lld"
++#define SC_INSN "scd"
++#else /* CONFIG_32BIT */
++#define LL_INSN "ll"
++#define SC_INSN "sc"
++#endif
++ unsigned long page_global = _PAGE_GLOBAL;
++ unsigned long tmp;
++
++ __asm__ __volatile__ (
++ " .set push\n"
++ " .set noreorder\n"
++ "1: " LL_INSN " %[tmp], %[buddy]\n"
++ " bnez %[tmp], 2f\n"
++ " or %[tmp], %[tmp], %[global]\n"
++ " " SC_INSN " %[tmp], %[buddy]\n"
++ " beqz %[tmp], 1b\n"
++ " nop\n"
++ "2:\n"
++ " .set pop"
++ : [buddy] "+m" (buddy->pte),
++ [tmp] "=&r" (tmp)
++ : [global] "r" (page_global));
++#else /* !CONFIG_SMP */
+ if (pte_none(*buddy))
+ pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL;
++#endif /* CONFIG_SMP */
+ }
+ #endif
+ }
+diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
+index 33f63bab478a..c7e2684a53c9 100644
+--- a/arch/mips/kernel/mips-mt-fpaff.c
++++ b/arch/mips/kernel/mips-mt-fpaff.c
+@@ -154,7 +154,7 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len,
+ unsigned long __user *user_mask_ptr)
+ {
+ unsigned int real_len;
+- cpumask_t mask;
++ cpumask_t allowed, mask;
+ int retval;
+ struct task_struct *p;
+
+@@ -173,7 +173,8 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len,
+ if (retval)
+ goto out_unlock;
+
+- cpumask_and(&mask, &p->thread.user_cpus_allowed, cpu_possible_mask);
++ cpumask_or(&allowed, &p->thread.user_cpus_allowed, &p->cpus_allowed);
++ cpumask_and(&mask, &allowed, cpu_active_mask);
+
+ out_unlock:
+ read_unlock(&tasklist_lock);
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index 60055cefdd04..5f947e531562 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -246,7 +246,7 @@ asmlinkage void execve_tail(void)
+ {
+ current->thread.fp_regs.fpc = 0;
+ if (MACHINE_HAS_IEEE)
+- asm volatile("sfpc %0,%0" : : "d" (0));
++ asm volatile("sfpc %0" : : "d" (0));
+ }
+
+ /*
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 95792d846bb6..51ca1c3b42db 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
+ jno .Lesa2
+ ahi %r15,-80
+ stmh %r6,%r15,96(%r15) # store upper register halves
++ basr %r13,0
++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
+ .Lesa2:
+ #endif
+ lr %r10,%r2 # save string pointer
+@@ -293,6 +295,8 @@ ENTRY(_sclp_print_early)
+ #endif
+ lm %r6,%r15,120(%r15) # restore registers
+ br %r14
++.Lzeroes:
++ .fill 64,4,0
+
+ .LwritedataS4:
+ .long 0x00760005 # SCLP command for write data
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index fd107ab7dd26..c40f8062e3a9 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -972,7 +972,7 @@ static void __init load_hv_initrd(void)
+
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+- free_bootmem(__pa(begin), end - begin);
++ free_bootmem_late(__pa(begin), end - begin);
+ }
+
+ #else
+diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
+index fa9c8c7bc500..d34c94fb3375 100644
+--- a/arch/x86/include/asm/desc.h
++++ b/arch/x86/include/asm/desc.h
+@@ -279,21 +279,6 @@ static inline void clear_LDT(void)
+ set_ldt(NULL, 0);
+ }
+
+-/*
+- * load one particular LDT into the current CPU
+- */
+-static inline void load_LDT_nolock(mm_context_t *pc)
+-{
+- set_ldt(pc->ldt, pc->size);
+-}
+-
+-static inline void load_LDT(mm_context_t *pc)
+-{
+- preempt_disable();
+- load_LDT_nolock(pc);
+- preempt_enable();
+-}
+-
+ static inline unsigned long get_desc_base(const struct desc_struct *desc)
+ {
+ return (unsigned)(desc->base0 | ((desc->base1) << 16) | ((desc->base2) << 24));
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index d60facb1a9d4..493b0267f23e 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -87,6 +87,7 @@
+ #define GP_VECTOR 13
+ #define PF_VECTOR 14
+ #define MF_VECTOR 16
++#define AC_VECTOR 17
+ #define MC_VECTOR 18
+
+ #define SELECTOR_TI_MASK (1 << 2)
+diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h
+index 5f55e6962769..926f67263287 100644
+--- a/arch/x86/include/asm/mmu.h
++++ b/arch/x86/include/asm/mmu.h
+@@ -9,8 +9,7 @@
+ * we put the segment information here.
+ */
+ typedef struct {
+- void *ldt;
+- int size;
++ struct ldt_struct *ldt;
+
+ #ifdef CONFIG_X86_64
+ /* True if mm supports a task running in 32 bit compatibility mode. */
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 69021528b43c..ce4ea94fc4be 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -16,6 +16,51 @@ static inline void paravirt_activate_mm(struct mm_struct *prev,
+ #endif /* !CONFIG_PARAVIRT */
+
+ /*
++ * ldt_structs can be allocated, used, and freed, but they are never
++ * modified while live.
++ */
++struct ldt_struct {
++ /*
++ * Xen requires page-aligned LDTs with special permissions. This is
++ * needed to prevent us from installing evil descriptors such as
++ * call gates. On native, we could merge the ldt_struct and LDT
++ * allocations, but it's not worth trying to optimize.
++ */
++ struct desc_struct *entries;
++ int size;
++};
++
++static inline void load_mm_ldt(struct mm_struct *mm)
++{
++ struct ldt_struct *ldt;
++
++ /* smp_read_barrier_depends synchronizes with barrier in install_ldt */
++ ldt = ACCESS_ONCE(mm->context.ldt);
++ smp_read_barrier_depends();
++
++ /*
++ * Any change to mm->context.ldt is followed by an IPI to all
++ * CPUs with the mm active. The LDT will not be freed until
++ * after the IPI is handled by all such CPUs. This means that,
++ * if the ldt_struct changes before we return, the values we see
++ * will be safe, and the new values will be loaded before we run
++ * any user code.
++ *
++ * NB: don't try to convert this to use RCU without extreme care.
++ * We would still need IRQs off, because we don't want to change
++ * the local LDT after an IPI loaded a newer value than the one
++ * that we can see.
++ */
++
++ if (unlikely(ldt))
++ set_ldt(ldt->entries, ldt->size);
++ else
++ clear_LDT();
++
++ DEBUG_LOCKS_WARN_ON(preemptible());
++}
++
++/*
+ * Used for LDT copy/destruction.
+ */
+ int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
+@@ -52,7 +97,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ * load the LDT, if the LDT is different:
+ */
+ if (unlikely(prev->context.ldt != next->context.ldt))
+- load_LDT_nolock(&next->context);
++ load_mm_ldt(next);
+ }
+ #ifdef CONFIG_SMP
+ else {
+@@ -65,7 +110,7 @@ static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ * to make sure to use no freed page tables.
+ */
+ load_cr3(next->pgd);
+- load_LDT_nolock(&next->context);
++ load_mm_ldt(next);
+ }
+ }
+ #endif
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index 114db0fee86c..b190a620a850 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -1254,7 +1254,7 @@ void __cpuinit cpu_init(void)
+ load_sp0(t, ¤t->thread);
+ set_tss_desc(cpu, t);
+ load_TR_desc();
+- load_LDT(&init_mm.context);
++ load_mm_ldt(&init_mm);
+
+ clear_all_debug_regs();
+ dbg_restore_debug_regs();
+@@ -1302,7 +1302,7 @@ void __cpuinit cpu_init(void)
+ load_sp0(t, thread);
+ set_tss_desc(cpu, t);
+ load_TR_desc();
+- load_LDT(&init_mm.context);
++ load_mm_ldt(&init_mm);
+
+ t->x86_tss.io_bitmap_base = offsetof(struct tss_struct, io_bitmap);
+
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index c37886d759cc..fba5131ce71e 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -12,6 +12,7 @@
+ #include <linux/string.h>
+ #include <linux/mm.h>
+ #include <linux/smp.h>
++#include <linux/slab.h>
+ #include <linux/vmalloc.h>
+ #include <linux/uaccess.h>
+
+@@ -20,82 +21,87 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+
+-#ifdef CONFIG_SMP
++/* context.lock is held for us, so we don't need any locking. */
+ static void flush_ldt(void *current_mm)
+ {
+- if (current->active_mm == current_mm)
+- load_LDT(¤t->active_mm->context);
++ mm_context_t *pc;
++
++ if (current->active_mm != current_mm)
++ return;
++
++ pc = ¤t->active_mm->context;
++ set_ldt(pc->ldt->entries, pc->ldt->size);
+ }
+-#endif
+
+-static int alloc_ldt(mm_context_t *pc, int mincount, int reload)
++/* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */
++static struct ldt_struct *alloc_ldt_struct(int size)
+ {
+- void *oldldt, *newldt;
+- int oldsize;
+-
+- if (mincount <= pc->size)
+- return 0;
+- oldsize = pc->size;
+- mincount = (mincount + (PAGE_SIZE / LDT_ENTRY_SIZE - 1)) &
+- (~(PAGE_SIZE / LDT_ENTRY_SIZE - 1));
+- if (mincount * LDT_ENTRY_SIZE > PAGE_SIZE)
+- newldt = vmalloc(mincount * LDT_ENTRY_SIZE);
++ struct ldt_struct *new_ldt;
++ int alloc_size;
++
++ if (size > LDT_ENTRIES)
++ return NULL;
++
++ new_ldt = kmalloc(sizeof(struct ldt_struct), GFP_KERNEL);
++ if (!new_ldt)
++ return NULL;
++
++ BUILD_BUG_ON(LDT_ENTRY_SIZE != sizeof(struct desc_struct));
++ alloc_size = size * LDT_ENTRY_SIZE;
++
++ /*
++ * Xen is very picky: it requires a page-aligned LDT that has no
++ * trailing nonzero bytes in any page that contains LDT descriptors.
++ * Keep it simple: zero the whole allocation and never allocate less
++ * than PAGE_SIZE.
++ */
++ if (alloc_size > PAGE_SIZE)
++ new_ldt->entries = vzalloc(alloc_size);
+ else
+- newldt = (void *)__get_free_page(GFP_KERNEL);
+-
+- if (!newldt)
+- return -ENOMEM;
++ new_ldt->entries = kzalloc(PAGE_SIZE, GFP_KERNEL);
+
+- if (oldsize)
+- memcpy(newldt, pc->ldt, oldsize * LDT_ENTRY_SIZE);
+- oldldt = pc->ldt;
+- memset(newldt + oldsize * LDT_ENTRY_SIZE, 0,
+- (mincount - oldsize) * LDT_ENTRY_SIZE);
++ if (!new_ldt->entries) {
++ kfree(new_ldt);
++ return NULL;
++ }
+
+- paravirt_alloc_ldt(newldt, mincount);
++ new_ldt->size = size;
++ return new_ldt;
++}
+
+-#ifdef CONFIG_X86_64
+- /* CHECKME: Do we really need this ? */
+- wmb();
+-#endif
+- pc->ldt = newldt;
+- wmb();
+- pc->size = mincount;
+- wmb();
+-
+- if (reload) {
+-#ifdef CONFIG_SMP
+- preempt_disable();
+- load_LDT(pc);
+- if (!cpumask_equal(mm_cpumask(current->mm),
+- cpumask_of(smp_processor_id())))
+- smp_call_function(flush_ldt, current->mm, 1);
+- preempt_enable();
+-#else
+- load_LDT(pc);
+-#endif
+- }
+- if (oldsize) {
+- paravirt_free_ldt(oldldt, oldsize);
+- if (oldsize * LDT_ENTRY_SIZE > PAGE_SIZE)
+- vfree(oldldt);
+- else
+- put_page(virt_to_page(oldldt));
+- }
+- return 0;
++/* After calling this, the LDT is immutable. */
++static void finalize_ldt_struct(struct ldt_struct *ldt)
++{
++ paravirt_alloc_ldt(ldt->entries, ldt->size);
+ }
+
+-static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
++/* context.lock is held */
++static void install_ldt(struct mm_struct *current_mm,
++ struct ldt_struct *ldt)
+ {
+- int err = alloc_ldt(new, old->size, 0);
+- int i;
++ /* Synchronizes with smp_read_barrier_depends in load_mm_ldt. */
++ barrier();
++ ACCESS_ONCE(current_mm->context.ldt) = ldt;
++
++ /* Activate the LDT for all CPUs using current_mm. */
++ smp_call_function_many(mm_cpumask(current_mm), flush_ldt, current_mm,
++ true);
++ local_irq_disable();
++ flush_ldt(current_mm);
++ local_irq_enable();
++}
+
+- if (err < 0)
+- return err;
++static void free_ldt_struct(struct ldt_struct *ldt)
++{
++ if (likely(!ldt))
++ return;
+
+- for (i = 0; i < old->size; i++)
+- write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
+- return 0;
++ paravirt_free_ldt(ldt->entries, ldt->size);
++ if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE)
++ vfree(ldt->entries);
++ else
++ kfree(ldt->entries);
++ kfree(ldt);
+ }
+
+ /*
+@@ -104,17 +110,37 @@ static inline int copy_ldt(mm_context_t *new, mm_context_t *old)
+ */
+ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+ {
++ struct ldt_struct *new_ldt;
+ struct mm_struct *old_mm;
+ int retval = 0;
+
+ mutex_init(&mm->context.lock);
+- mm->context.size = 0;
+ old_mm = current->mm;
+- if (old_mm && old_mm->context.size > 0) {
+- mutex_lock(&old_mm->context.lock);
+- retval = copy_ldt(&mm->context, &old_mm->context);
+- mutex_unlock(&old_mm->context.lock);
++ if (!old_mm) {
++ mm->context.ldt = NULL;
++ return 0;
++ }
++
++ mutex_lock(&old_mm->context.lock);
++ if (!old_mm->context.ldt) {
++ mm->context.ldt = NULL;
++ goto out_unlock;
+ }
++
++ new_ldt = alloc_ldt_struct(old_mm->context.ldt->size);
++ if (!new_ldt) {
++ retval = -ENOMEM;
++ goto out_unlock;
++ }
++
++ memcpy(new_ldt->entries, old_mm->context.ldt->entries,
++ new_ldt->size * LDT_ENTRY_SIZE);
++ finalize_ldt_struct(new_ldt);
++
++ mm->context.ldt = new_ldt;
++
++out_unlock:
++ mutex_unlock(&old_mm->context.lock);
+ return retval;
+ }
+
+@@ -125,53 +151,47 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
+ */
+ void destroy_context(struct mm_struct *mm)
+ {
+- if (mm->context.size) {
+-#ifdef CONFIG_X86_32
+- /* CHECKME: Can this ever happen ? */
+- if (mm == current->active_mm)
+- clear_LDT();
+-#endif
+- paravirt_free_ldt(mm->context.ldt, mm->context.size);
+- if (mm->context.size * LDT_ENTRY_SIZE > PAGE_SIZE)
+- vfree(mm->context.ldt);
+- else
+- put_page(virt_to_page(mm->context.ldt));
+- mm->context.size = 0;
+- }
++ free_ldt_struct(mm->context.ldt);
++ mm->context.ldt = NULL;
+ }
+
+ static int read_ldt(void __user *ptr, unsigned long bytecount)
+ {
+- int err;
++ int retval;
+ unsigned long size;
+ struct mm_struct *mm = current->mm;
+
+- if (!mm->context.size)
+- return 0;
++ mutex_lock(&mm->context.lock);
++
++ if (!mm->context.ldt) {
++ retval = 0;
++ goto out_unlock;
++ }
++
+ if (bytecount > LDT_ENTRY_SIZE * LDT_ENTRIES)
+ bytecount = LDT_ENTRY_SIZE * LDT_ENTRIES;
+
+- mutex_lock(&mm->context.lock);
+- size = mm->context.size * LDT_ENTRY_SIZE;
++ size = mm->context.ldt->size * LDT_ENTRY_SIZE;
+ if (size > bytecount)
+ size = bytecount;
+
+- err = 0;
+- if (copy_to_user(ptr, mm->context.ldt, size))
+- err = -EFAULT;
+- mutex_unlock(&mm->context.lock);
+- if (err < 0)
+- goto error_return;
++ if (copy_to_user(ptr, mm->context.ldt->entries, size)) {
++ retval = -EFAULT;
++ goto out_unlock;
++ }
++
+ if (size != bytecount) {
+- /* zero-fill the rest */
+- if (clear_user(ptr + size, bytecount - size) != 0) {
+- err = -EFAULT;
+- goto error_return;
++ /* Zero-fill the rest and pretend we read bytecount bytes. */
++ if (clear_user(ptr + size, bytecount - size)) {
++ retval = -EFAULT;
++ goto out_unlock;
+ }
+ }
+- return bytecount;
+-error_return:
+- return err;
++ retval = bytecount;
++
++out_unlock:
++ mutex_unlock(&mm->context.lock);
++ return retval;
+ }
+
+ static int read_default_ldt(void __user *ptr, unsigned long bytecount)
+@@ -195,6 +215,8 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ struct desc_struct ldt;
+ int error;
+ struct user_desc ldt_info;
++ int oldsize, newsize;
++ struct ldt_struct *new_ldt, *old_ldt;
+
+ error = -EINVAL;
+ if (bytecount != sizeof(ldt_info))
+@@ -213,34 +235,39 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ goto out;
+ }
+
+- mutex_lock(&mm->context.lock);
+- if (ldt_info.entry_number >= mm->context.size) {
+- error = alloc_ldt(¤t->mm->context,
+- ldt_info.entry_number + 1, 1);
+- if (error < 0)
+- goto out_unlock;
+- }
+-
+- /* Allow LDTs to be cleared by the user. */
+- if (ldt_info.base_addr == 0 && ldt_info.limit == 0) {
+- if (oldmode || LDT_empty(&ldt_info)) {
+- memset(&ldt, 0, sizeof(ldt));
+- goto install;
++ if ((oldmode && !ldt_info.base_addr && !ldt_info.limit) ||
++ LDT_empty(&ldt_info)) {
++ /* The user wants to clear the entry. */
++ memset(&ldt, 0, sizeof(ldt));
++ } else {
++ if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
++ error = -EINVAL;
++ goto out;
+ }
++
++ fill_ldt(&ldt, &ldt_info);
++ if (oldmode)
++ ldt.avl = 0;
+ }
+
+- if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+- error = -EINVAL;
++ mutex_lock(&mm->context.lock);
++
++ old_ldt = mm->context.ldt;
++ oldsize = old_ldt ? old_ldt->size : 0;
++ newsize = max((int)(ldt_info.entry_number + 1), oldsize);
++
++ error = -ENOMEM;
++ new_ldt = alloc_ldt_struct(newsize);
++ if (!new_ldt)
+ goto out_unlock;
+- }
+
+- fill_ldt(&ldt, &ldt_info);
+- if (oldmode)
+- ldt.avl = 0;
++ if (old_ldt)
++ memcpy(new_ldt->entries, old_ldt->entries, oldsize * LDT_ENTRY_SIZE);
++ new_ldt->entries[ldt_info.entry_number] = ldt;
++ finalize_ldt_struct(new_ldt);
+
+- /* Install the new entry ... */
+-install:
+- write_ldt_entry(mm->context.ldt, ldt_info.entry_number, &ldt);
++ install_ldt(mm, new_ldt);
++ free_ldt_struct(old_ldt);
+ error = 0;
+
+ out_unlock:
+diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
+index bb390e1ba600..d5d7313ed430 100644
+--- a/arch/x86/kernel/process_64.c
++++ b/arch/x86/kernel/process_64.c
+@@ -116,11 +116,11 @@ void __show_regs(struct pt_regs *regs, int all)
+ void release_thread(struct task_struct *dead_task)
+ {
+ if (dead_task->mm) {
+- if (dead_task->mm->context.size) {
++ if (dead_task->mm->context.ldt) {
+ printk("WARNING: dead process %8s still has LDT? <%p/%d>\n",
+ dead_task->comm,
+- dead_task->mm->context.ldt,
+- dead_task->mm->context.size);
++ dead_task->mm->context.ldt->entries,
++ dead_task->mm->context.ldt->size);
+ BUG();
+ }
+ }
+diff --git a/arch/x86/kernel/step.c b/arch/x86/kernel/step.c
+index f89cdc6ccd5b..1565262dce89 100644
+--- a/arch/x86/kernel/step.c
++++ b/arch/x86/kernel/step.c
+@@ -5,6 +5,7 @@
+ #include <linux/mm.h>
+ #include <linux/ptrace.h>
+ #include <asm/desc.h>
++#include <asm/mmu_context.h>
+
+ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *regs)
+ {
+@@ -27,13 +28,14 @@ unsigned long convert_ip_to_linear(struct task_struct *child, struct pt_regs *re
+ struct desc_struct *desc;
+ unsigned long base;
+
+- seg &= ~7UL;
++ seg >>= 3;
+
+ mutex_lock(&child->mm->context.lock);
+- if (unlikely((seg >> 3) >= child->mm->context.size))
++ if (unlikely(!child->mm->context.ldt ||
++ seg >= child->mm->context.ldt->size))
+ addr = -1L; /* bogus selector, access would fault */
+ else {
+- desc = child->mm->context.ldt + seg;
++ desc = &child->mm->context.ldt->entries[seg];
+ base = get_desc_base(desc);
+
+ /* 16-bit code segment? */
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 86c74c0cd876..6201ca0c9770 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1081,6 +1081,8 @@ static void init_vmcb(struct vcpu_svm *svm)
+ set_exception_intercept(svm, PF_VECTOR);
+ set_exception_intercept(svm, UD_VECTOR);
+ set_exception_intercept(svm, MC_VECTOR);
++ set_exception_intercept(svm, AC_VECTOR);
++ set_exception_intercept(svm, DB_VECTOR);
+
+ set_intercept(svm, INTERCEPT_INTR);
+ set_intercept(svm, INTERCEPT_NMI);
+@@ -1636,20 +1638,13 @@ static void svm_set_segment(struct kvm_vcpu *vcpu,
+ mark_dirty(svm->vmcb, VMCB_SEG);
+ }
+
+-static void update_db_intercept(struct kvm_vcpu *vcpu)
++static void update_bp_intercept(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+
+- clr_exception_intercept(svm, DB_VECTOR);
+ clr_exception_intercept(svm, BP_VECTOR);
+
+- if (svm->nmi_singlestep)
+- set_exception_intercept(svm, DB_VECTOR);
+-
+ if (vcpu->guest_debug & KVM_GUESTDBG_ENABLE) {
+- if (vcpu->guest_debug &
+- (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))
+- set_exception_intercept(svm, DB_VECTOR);
+ if (vcpu->guest_debug & KVM_GUESTDBG_USE_SW_BP)
+ set_exception_intercept(svm, BP_VECTOR);
+ } else
+@@ -1667,7 +1662,7 @@ static void svm_guest_debug(struct kvm_vcpu *vcpu, struct kvm_guest_debug *dbg)
+
+ mark_dirty(svm->vmcb, VMCB_DR);
+
+- update_db_intercept(vcpu);
++ update_bp_intercept(vcpu);
+ }
+
+ static void new_asid(struct vcpu_svm *svm, struct svm_cpu_data *sd)
+@@ -1741,7 +1736,6 @@ static int db_interception(struct vcpu_svm *svm)
+ if (!(svm->vcpu.guest_debug & KVM_GUESTDBG_SINGLESTEP))
+ svm->vmcb->save.rflags &=
+ ~(X86_EFLAGS_TF | X86_EFLAGS_RF);
+- update_db_intercept(&svm->vcpu);
+ }
+
+ if (svm->vcpu.guest_debug &
+@@ -1776,6 +1770,12 @@ static int ud_interception(struct vcpu_svm *svm)
+ return 1;
+ }
+
++static int ac_interception(struct vcpu_svm *svm)
++{
++ kvm_queue_exception_e(&svm->vcpu, AC_VECTOR, 0);
++ return 1;
++}
++
+ static void svm_fpu_activate(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_svm *svm = to_svm(vcpu);
+@@ -3291,6 +3291,7 @@ static int (*svm_exit_handlers[])(struct vcpu_svm *svm) = {
+ [SVM_EXIT_EXCP_BASE + PF_VECTOR] = pf_interception,
+ [SVM_EXIT_EXCP_BASE + NM_VECTOR] = nm_interception,
+ [SVM_EXIT_EXCP_BASE + MC_VECTOR] = mc_interception,
++ [SVM_EXIT_EXCP_BASE + AC_VECTOR] = ac_interception,
+ [SVM_EXIT_INTR] = intr_interception,
+ [SVM_EXIT_NMI] = nmi_interception,
+ [SVM_EXIT_SMI] = nop_on_interception,
+@@ -3653,7 +3654,6 @@ static void enable_nmi_window(struct kvm_vcpu *vcpu)
+ */
+ svm->nmi_singlestep = true;
+ svm->vmcb->save.rflags |= (X86_EFLAGS_TF | X86_EFLAGS_RF);
+- update_db_intercept(vcpu);
+ }
+
+ static int svm_set_tss_addr(struct kvm *kvm, unsigned int addr)
+diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
+index 911d2641f14c..d26a7e24464e 100644
+--- a/arch/x86/kvm/trace.h
++++ b/arch/x86/kvm/trace.h
+@@ -244,6 +244,7 @@ TRACE_EVENT(kvm_apic,
+ { SVM_EXIT_EXCP_BASE + UD_VECTOR, "UD excp" }, \
+ { SVM_EXIT_EXCP_BASE + PF_VECTOR, "PF excp" }, \
+ { SVM_EXIT_EXCP_BASE + NM_VECTOR, "NM excp" }, \
++ { SVM_EXIT_EXCP_BASE + AC_VECTOR, "AC excp" }, \
+ { SVM_EXIT_EXCP_BASE + MC_VECTOR, "MC excp" }, \
+ { SVM_EXIT_INTR, "interrupt" }, \
+ { SVM_EXIT_NMI, "nmi" }, \
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4ad0d7171d6c..defd510486fd 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1169,7 +1169,7 @@ static void update_exception_bitmap(struct kvm_vcpu *vcpu)
+ u32 eb;
+
+ eb = (1u << PF_VECTOR) | (1u << UD_VECTOR) | (1u << MC_VECTOR) |
+- (1u << NM_VECTOR) | (1u << DB_VECTOR);
++ (1u << NM_VECTOR) | (1u << DB_VECTOR) | (1u << AC_VECTOR);
+ if ((vcpu->guest_debug &
+ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP)) ==
+ (KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP))
+@@ -4260,6 +4260,9 @@ static int handle_exception(struct kvm_vcpu *vcpu)
+
+ ex_no = intr_info & INTR_INFO_VECTOR_MASK;
+ switch (ex_no) {
++ case AC_VECTOR:
++ kvm_queue_exception_e(vcpu, AC_VECTOR, error_code);
++ return 1;
+ case DB_VECTOR:
+ dr6 = vmcs_readl(EXIT_QUALIFICATION);
+ if (!(vcpu->guest_debug &
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 4ad2b7bb382e..9cc83e287adf 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1545,6 +1545,8 @@ static void accumulate_steal_time(struct kvm_vcpu *vcpu)
+
+ static void record_steal_time(struct kvm_vcpu *vcpu)
+ {
++ accumulate_steal_time(vcpu);
++
+ if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED))
+ return;
+
+@@ -1665,12 +1667,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, u32 msr, u64 data)
+ if (!(data & KVM_MSR_ENABLED))
+ break;
+
+- vcpu->arch.st.last_steal = current->sched_info.run_delay;
+-
+- preempt_disable();
+- accumulate_steal_time(vcpu);
+- preempt_enable();
+-
+ kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+
+ break;
+@@ -2327,7 +2323,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu)
+ vcpu->cpu = cpu;
+ }
+
+- accumulate_steal_time(vcpu);
+ kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
+ }
+
+diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
+index 9b868124128d..274a52b1183e 100644
+--- a/arch/x86/math-emu/fpu_entry.c
++++ b/arch/x86/math-emu/fpu_entry.c
+@@ -29,7 +29,6 @@
+
+ #include <asm/uaccess.h>
+ #include <asm/traps.h>
+-#include <asm/desc.h>
+ #include <asm/user.h>
+ #include <asm/i387.h>
+
+@@ -185,7 +184,7 @@ void math_emulate(struct math_emu_info *info)
+ math_abort(FPU_info, SIGILL);
+ }
+
+- code_descriptor = LDT_DESCRIPTOR(FPU_CS);
++ code_descriptor = FPU_get_ldt_descriptor(FPU_CS);
+ if (SEG_D_SIZE(code_descriptor)) {
+ /* The above test may be wrong, the book is not clear */
+ /* Segmented 32 bit protected mode */
+diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h
+index 2c614410a5f3..d342fce49447 100644
+--- a/arch/x86/math-emu/fpu_system.h
++++ b/arch/x86/math-emu/fpu_system.h
+@@ -16,9 +16,24 @@
+ #include <linux/kernel.h>
+ #include <linux/mm.h>
+
+-/* s is always from a cpu register, and the cpu does bounds checking
+- * during register load --> no further bounds checks needed */
+-#define LDT_DESCRIPTOR(s) (((struct desc_struct *)current->mm->context.ldt)[(s) >> 3])
++#include <asm/desc.h>
++#include <asm/mmu_context.h>
++
++static inline struct desc_struct FPU_get_ldt_descriptor(unsigned seg)
++{
++ static struct desc_struct zero_desc;
++ struct desc_struct ret = zero_desc;
++
++#ifdef CONFIG_MODIFY_LDT_SYSCALL
++ seg >>= 3;
++ mutex_lock(¤t->mm->context.lock);
++ if (current->mm->context.ldt && seg < current->mm->context.ldt->size)
++ ret = current->mm->context.ldt->entries[seg];
++ mutex_unlock(¤t->mm->context.lock);
++#endif
++ return ret;
++}
++
+ #define SEG_D_SIZE(x) ((x).b & (3 << 21))
+ #define SEG_G_BIT(x) ((x).b & (1 << 23))
+ #define SEG_GRANULARITY(x) (((x).b & (1 << 23)) ? 4096 : 1)
+diff --git a/arch/x86/math-emu/get_address.c b/arch/x86/math-emu/get_address.c
+index 6ef5e99380f9..d13cab2aec45 100644
+--- a/arch/x86/math-emu/get_address.c
++++ b/arch/x86/math-emu/get_address.c
+@@ -20,7 +20,6 @@
+ #include <linux/stddef.h>
+
+ #include <asm/uaccess.h>
+-#include <asm/desc.h>
+
+ #include "fpu_system.h"
+ #include "exception.h"
+@@ -158,7 +157,7 @@ static long pm_address(u_char FPU_modrm, u_char segment,
+ addr->selector = PM_REG_(segment);
+ }
+
+- descriptor = LDT_DESCRIPTOR(PM_REG_(segment));
++ descriptor = FPU_get_ldt_descriptor(segment);
+ base_address = SEG_BASE_ADDR(descriptor);
+ address = base_address + offset;
+ limit = base_address
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index fcbaac60d938..dd298e73cbb3 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -22,6 +22,7 @@
+ #include <asm/suspend.h>
+ #include <asm/debugreg.h>
+ #include <asm/fpu-internal.h> /* pcntxt_mask */
++#include <asm/mmu_context.h>
+
+ #ifdef CONFIG_X86_32
+ static struct saved_context saved_context;
+@@ -148,7 +149,7 @@ static void fix_processor_context(void)
+ syscall_init(); /* This sets MSR_*STAR and related */
+ #endif
+ load_TR_desc(); /* This does ltr */
+- load_LDT(¤t->active_mm->context); /* This does lldt */
++ load_mm_ldt(current->active_mm); /* This does lldt */
+ }
+
+ /**
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 95980387eeb5..8ade106b879b 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -413,6 +413,7 @@ static void set_aliased_prot(void *v, pgprot_t prot)
+ pte_t pte;
+ unsigned long pfn;
+ struct page *page;
++ unsigned char dummy;
+
+ ptep = lookup_address((unsigned long)v, &level);
+ BUG_ON(ptep == NULL);
+@@ -422,6 +423,32 @@ static void set_aliased_prot(void *v, pgprot_t prot)
+
+ pte = pfn_pte(pfn, prot);
+
++ /*
++ * Careful: update_va_mapping() will fail if the virtual address
++ * we're poking isn't populated in the page tables. We don't
++ * need to worry about the direct map (that's always in the page
++ * tables), but we need to be careful about vmap space. In
++ * particular, the top level page table can lazily propagate
++ * entries between processes, so if we've switched mms since we
++ * vmapped the target in the first place, we might not have the
++ * top-level page table entry populated.
++ *
++ * We disable preemption because we want the same mm active when
++ * we probe the target and when we issue the hypercall. We'll
++ * have the same nominal mm, but if we're a kernel thread, lazy
++ * mm dropping could change our pgd.
++ *
++ * Out of an abundance of caution, this uses __get_user() to fault
++ * in the target address just in case there's some obscure case
++ * in which the target address isn't readable.
++ */
++
++ preempt_disable();
++
++ pagefault_disable(); /* Avoid warnings due to being atomic. */
++ __get_user(dummy, (unsigned char __user __force *)v);
++ pagefault_enable();
++
+ if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0))
+ BUG();
+
+@@ -433,6 +460,8 @@ static void set_aliased_prot(void *v, pgprot_t prot)
+ BUG();
+ } else
+ kmap_flush_unused();
++
++ preempt_enable();
+ }
+
+ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
+@@ -440,6 +469,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries)
+ const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE;
+ int i;
+
++ /*
++ * We need to mark the all aliases of the LDT pages RO. We
++ * don't need to call vm_flush_aliases(), though, since that's
++ * only responsible for flushing aliases out the TLBs, not the
++ * page tables, and Xen will flush the TLB for us if needed.
++ *
++ * To avoid confusing future readers: none of this is necessary
++ * to load the LDT. The hypervisor only checks this when the
++ * LDT is faulted in due to subsequent descriptor access.
++ */
++
+ for(i = 0; i < entries; i += entries_per_page)
+ set_aliased_prot(ldt + i, PAGE_KERNEL_RO);
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 0a6767b9939c..68bdd59e5e62 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4104,9 +4104,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
+ ATA_HORKAGE_FIRMWARE_WARN },
+
+- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
++ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
+ { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
+ { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
++ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
+
+ /* Blacklist entries taken from Silicon Image 3124/3132
+ Windows driver .inf file - also several Linux problem reports */
+@@ -4143,6 +4144,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
+ { "WD My Book", NULL, ATA_HORKAGE_1_5_GBPS, },
+ { "Seagate FreeAgent GoFlex", NULL, ATA_HORKAGE_1_5_GBPS, },
+
++ /* devices that don't properly handle TRIM commands */
++ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
++
+ /*
+ * Devices which choke on SETXFER. Applies only if both the
+ * device and controller are SATA.
+@@ -4440,7 +4444,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
+ else /* In the ancient relic department - skip all of this */
+ return 0;
+
+- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
++ /* On some disks, this command causes spin-up, so we need longer timeout */
++ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
+
+ DPRINTK("EXIT, err_mask=%x\n", err_mask);
+ return err_mask;
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 0ba32fe00d13..93ea33509fa8 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ ATA_LFLAG_NO_SRST |
+ ATA_LFLAG_ASSUME_ATA;
+ }
++ } else if (vendor == 0x11ab && devid == 0x4140) {
++ /* Marvell 4140 quirks */
++ ata_for_each_link(link, ap, EDGE) {
++ /* port 4 is for SEMB device and it doesn't like SRST */
++ if (link->pmp == 4)
++ link->flags |= ATA_LFLAG_DISABLED;
++ }
+ }
+ }
+
+diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
+index 15863a4b6190..94ccbc15f5fb 100644
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -2461,7 +2461,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
+ rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+ rbuf[15] = lowest_aligned;
+
+- if (ata_id_has_trim(args->id)) {
++ if (ata_id_has_trim(args->id) &&
++ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
+ rbuf[14] |= 0x80; /* TPE */
+
+ if (ata_id_has_zero_after_trim(args->id))
+diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
+index 8f3f74ce8c7f..f731abcf3f33 100644
+--- a/drivers/crypto/ixp4xx_crypto.c
++++ b/drivers/crypto/ixp4xx_crypto.c
+@@ -915,7 +915,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt)
+ crypt->mode |= NPE_OP_NOT_IN_PLACE;
+ /* This was never tested by Intel
+ * for more than one dst buffer, I think. */
+- BUG_ON(req->dst->length < nbytes);
+ req_ctx->dst = NULL;
+ if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook,
+ flags, DMA_FROM_DEVICE))
+diff --git a/drivers/edac/ppc4xx_edac.c b/drivers/edac/ppc4xx_edac.c
+index d427c69bb8b1..9212f6c7ee95 100644
+--- a/drivers/edac/ppc4xx_edac.c
++++ b/drivers/edac/ppc4xx_edac.c
+@@ -919,7 +919,7 @@ ppc4xx_edac_init_csrows(struct mem_ctl_info *mci, u32 mcopt1)
+ */
+
+ for (row = 0; row < mci->nr_csrows; row++) {
+- struct csrow_info *csi = &mci->csrows[row];
++ struct csrow_info *csi = mci->csrows[row];
+
+ /*
+ * Get the configuration settings for this
+diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
+index c61e67222160..ed4b7481a865 100644
+--- a/drivers/gpu/drm/drm_crtc.c
++++ b/drivers/gpu/drm/drm_crtc.c
+@@ -1836,8 +1836,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
+ if (!drm_core_check_feature(dev, DRIVER_MODESET))
+ return -EINVAL;
+
+- /* For some reason crtc x/y offsets are signed internally. */
+- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
++ /*
++ * Universal plane src offsets are only 16.16, prevent havoc for
++ * drivers using universal plane code internally.
++ */
++ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
+ return -ERANGE;
+
+ mutex_lock(&dev->mode_config.mutex);
+diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
+index cf5dd63a95c3..b72eb507df64 100644
+--- a/drivers/gpu/drm/radeon/radeon_combios.c
++++ b/drivers/gpu/drm/radeon/radeon_combios.c
+@@ -1259,10 +1259,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
+
+ if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) &&
+ (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) {
++ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
++
++ if (hss > lvds->native_mode.hdisplay)
++ hss = (10 - 1) * 8;
++
+ lvds->native_mode.htotal = lvds->native_mode.hdisplay +
+ (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8;
+ lvds->native_mode.hsync_start = lvds->native_mode.hdisplay +
+- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8;
++ hss;
+ lvds->native_mode.hsync_end = lvds->native_mode.hsync_start +
+ (RBIOS8(tmp + 23) * 8);
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index ce384a449a65..e57eaf8b23db 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -586,6 +586,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ goto err_out;
+ }
+
++ /* TSC-25 data sheet specifies a delay after the RESET command */
++ msleep(150);
++
+ /* set coordinate output rate */
+ buf[0] = buf[1] = 0xFF;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c
+index a1e760150821..7d6c170f5f68 100644
+--- a/drivers/isdn/i4l/isdn_ppp.c
++++ b/drivers/isdn/i4l/isdn_ppp.c
+@@ -301,6 +301,8 @@ isdn_ppp_open(int min, struct file *file)
+ is->compflags = 0;
+
+ is->reset = isdn_ppp_ccp_reset_alloc(is);
++ if (!is->reset)
++ return -ENOMEM;
+
+ is->lp = NULL;
+ is->mp_seqno = 0; /* MP sequence number */
+@@ -320,6 +322,10 @@ isdn_ppp_open(int min, struct file *file)
+ * VJ header compression init
+ */
+ is->slcomp = slhc_init(16, 16); /* not necessary for 2. link in bundle */
++ if (IS_ERR(is->slcomp)) {
++ isdn_ppp_ccp_reset_free(is);
++ return PTR_ERR(is->slcomp);
++ }
+ #endif
+ #ifdef CONFIG_IPPP_FILTER
+ is->pass_filter = NULL;
+@@ -568,10 +574,8 @@ isdn_ppp_ioctl(int min, struct file *file, unsigned int cmd, unsigned long arg)
+ is->maxcid = val;
+ #ifdef CONFIG_ISDN_PPP_VJ
+ sltmp = slhc_init(16, val);
+- if (!sltmp) {
+- printk(KERN_ERR "ippp, can't realloc slhc struct\n");
+- return -ENOMEM;
+- }
++ if (IS_ERR(sltmp))
++ return PTR_ERR(sltmp);
+ if (is->slcomp)
+ slhc_free(is->slcomp);
+ is->slcomp = sltmp;
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index e811e44dfcf7..862612eebd63 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -13,6 +13,7 @@
+ #include <linux/init.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
++#include <linux/vmalloc.h>
+
+ #define DM_MSG_PREFIX "thin"
+
+@@ -149,9 +150,7 @@ static struct bio_prison *prison_create(unsigned nr_cells)
+ {
+ unsigned i;
+ uint32_t nr_buckets = calc_nr_buckets(nr_cells);
+- size_t len = sizeof(struct bio_prison) +
+- (sizeof(struct hlist_head) * nr_buckets);
+- struct bio_prison *prison = kmalloc(len, GFP_KERNEL);
++ struct bio_prison *prison = kmalloc(sizeof(*prison), GFP_KERNEL);
+
+ if (!prison)
+ return NULL;
+@@ -164,9 +163,15 @@ static struct bio_prison *prison_create(unsigned nr_cells)
+ return NULL;
+ }
+
++ prison->cells = vmalloc(sizeof(*prison->cells) * nr_buckets);
++ if (!prison->cells) {
++ mempool_destroy(prison->cell_pool);
++ kfree(prison);
++ return NULL;
++ }
++
+ prison->nr_buckets = nr_buckets;
+ prison->hash_mask = nr_buckets - 1;
+- prison->cells = (struct hlist_head *) (prison + 1);
+ for (i = 0; i < nr_buckets; i++)
+ INIT_HLIST_HEAD(prison->cells + i);
+
+@@ -175,6 +180,7 @@ static struct bio_prison *prison_create(unsigned nr_cells)
+
+ static void prison_destroy(struct bio_prison *prison)
+ {
++ vfree(prison->cells);
+ mempool_destroy(prison->cell_pool);
+ kfree(prison);
+ }
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 83dba060525b..a875348e819e 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5120,16 +5120,30 @@ void md_stop_writes(struct mddev *mddev)
+ }
+ EXPORT_SYMBOL_GPL(md_stop_writes);
+
+-void md_stop(struct mddev *mddev)
++static void __md_stop(struct mddev *mddev)
+ {
+ mddev->ready = 0;
+ mddev->pers->stop(mddev);
+ if (mddev->pers->sync_request && mddev->to_remove == NULL)
+ mddev->to_remove = &md_redundancy_group;
+ module_put(mddev->pers->owner);
++ /* Ensure ->event_work is done */
++ flush_workqueue(md_misc_wq);
+ mddev->pers = NULL;
+ clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+ }
++
++void md_stop(struct mddev *mddev)
++{
++ /* stop the array and free an attached data structures.
++ * This is called from dm-raid
++ */
++ __md_stop(mddev);
++ bitmap_destroy(mddev);
++ if (mddev->bio_set)
++ bioset_free(mddev->bio_set);
++}
++
+ EXPORT_SYMBOL_GPL(md_stop);
+
+ static int md_set_readonly(struct mddev *mddev, struct block_device *bdev)
+@@ -5190,7 +5204,7 @@ static int do_md_stop(struct mddev * mddev, int mode,
+ set_disk_ro(disk, 0);
+
+ __md_stop_writes(mddev);
+- md_stop(mddev);
++ __md_stop(mddev);
+ mddev->queue->merge_bvec_fn = NULL;
+ mddev->queue->backing_dev_info.congested_fn = NULL;
+
+diff --git a/drivers/md/persistent-data/dm-btree-internal.h b/drivers/md/persistent-data/dm-btree-internal.h
+index accbb05f17b6..c2465785e44a 100644
+--- a/drivers/md/persistent-data/dm-btree-internal.h
++++ b/drivers/md/persistent-data/dm-btree-internal.h
+@@ -131,4 +131,10 @@ int lower_bound(struct btree_node *n, uint64_t key);
+
+ extern struct dm_block_validator btree_node_validator;
+
++/*
++ * Value type for upper levels of multi-level btrees.
++ */
++extern void init_le64_type(struct dm_transaction_manager *tm,
++ struct dm_btree_value_type *vt);
++
+ #endif /* DM_BTREE_INTERNAL_H */
+diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
+index b88757cd0d1d..92cd09f3c69b 100644
+--- a/drivers/md/persistent-data/dm-btree-remove.c
++++ b/drivers/md/persistent-data/dm-btree-remove.c
+@@ -301,35 +301,40 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
+ {
+ int s;
+ uint32_t max_entries = le32_to_cpu(left->header.max_entries);
+- unsigned target = (nr_left + nr_center + nr_right) / 3;
+- BUG_ON(target > max_entries);
++ unsigned total = nr_left + nr_center + nr_right;
++ unsigned target_right = total / 3;
++ unsigned remainder = (target_right * 3) != total;
++ unsigned target_left = target_right + remainder;
++
++ BUG_ON(target_left > max_entries);
++ BUG_ON(target_right > max_entries);
+
+ if (nr_left < nr_right) {
+- s = nr_left - target;
++ s = nr_left - target_left;
+
+ if (s < 0 && nr_center < -s) {
+ /* not enough in central node */
+- shift(left, center, nr_center);
+- s = nr_center - target;
++ shift(left, center, -nr_center);
++ s += nr_center;
+ shift(left, right, s);
+ nr_right += s;
+ } else
+ shift(left, center, s);
+
+- shift(center, right, target - nr_right);
++ shift(center, right, target_right - nr_right);
+
+ } else {
+- s = target - nr_right;
++ s = target_right - nr_right;
+ if (s > 0 && nr_center < s) {
+ /* not enough in central node */
+ shift(center, right, nr_center);
+- s = target - nr_center;
++ s -= nr_center;
+ shift(left, right, s);
+ nr_left -= s;
+ } else
+ shift(center, right, s);
+
+- shift(left, center, nr_left - target);
++ shift(left, center, nr_left - target_left);
+ }
+
+ *key_ptr(parent, c->index) = center->keys[0];
+@@ -544,14 +549,6 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
+ return r;
+ }
+
+-static struct dm_btree_value_type le64_type = {
+- .context = NULL,
+- .size = sizeof(__le64),
+- .inc = NULL,
+- .dec = NULL,
+- .equal = NULL
+-};
+-
+ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ uint64_t *keys, dm_block_t *new_root)
+ {
+@@ -559,12 +556,14 @@ int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
+ int index = 0, r = 0;
+ struct shadow_spine spine;
+ struct btree_node *n;
++ struct dm_btree_value_type le64_vt;
+
++ init_le64_type(info->tm, &le64_vt);
+ init_shadow_spine(&spine, info);
+ for (level = 0; level < info->levels; level++) {
+ r = remove_raw(&spine, info,
+ (level == last_level ?
+- &info->value_type : &le64_type),
++ &info->value_type : &le64_vt),
+ root, keys[level], (unsigned *)&index);
+ if (r < 0)
+ break;
+diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c
+index 2f0805c3263e..f6cb762a3a17 100644
+--- a/drivers/md/persistent-data/dm-btree-spine.c
++++ b/drivers/md/persistent-data/dm-btree-spine.c
+@@ -242,3 +242,40 @@ int shadow_root(struct shadow_spine *s)
+ {
+ return s->root;
+ }
++
++static void le64_inc(void *context, void *value_le)
++{
++ struct dm_transaction_manager *tm = context;
++ __le64 v_le;
++
++ memcpy(&v_le, value_le, sizeof(v_le));
++ dm_tm_inc(tm, le64_to_cpu(v_le));
++}
++
++static void le64_dec(void *context, void *value_le)
++{
++ struct dm_transaction_manager *tm = context;
++ __le64 v_le;
++
++ memcpy(&v_le, value_le, sizeof(v_le));
++ dm_tm_dec(tm, le64_to_cpu(v_le));
++}
++
++static int le64_equal(void *context, void *value1_le, void *value2_le)
++{
++ __le64 v1_le, v2_le;
++
++ memcpy(&v1_le, value1_le, sizeof(v1_le));
++ memcpy(&v2_le, value2_le, sizeof(v2_le));
++ return v1_le == v2_le;
++}
++
++void init_le64_type(struct dm_transaction_manager *tm,
++ struct dm_btree_value_type *vt)
++{
++ vt->context = tm;
++ vt->size = sizeof(__le64);
++ vt->inc = le64_inc;
++ vt->dec = le64_dec;
++ vt->equal = le64_equal;
++}
+diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
+index 371f3d49d18e..dddd5a47f97d 100644
+--- a/drivers/md/persistent-data/dm-btree.c
++++ b/drivers/md/persistent-data/dm-btree.c
+@@ -235,7 +235,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
+ int r;
+ struct del_stack *s;
+
+- s = kmalloc(sizeof(*s), GFP_KERNEL);
++ s = kmalloc(sizeof(*s), GFP_NOIO);
+ if (!s)
+ return -ENOMEM;
+ s->tm = info->tm;
+@@ -646,12 +646,7 @@ static int insert(struct dm_btree_info *info, dm_block_t root,
+ struct btree_node *n;
+ struct dm_btree_value_type le64_type;
+
+- le64_type.context = NULL;
+- le64_type.size = sizeof(__le64);
+- le64_type.inc = NULL;
+- le64_type.dec = NULL;
+- le64_type.equal = NULL;
+-
++ init_le64_type(info->tm, &le64_type);
+ init_shadow_spine(&spine, info);
+
+ for (level = 0; level < (info->levels - 1); level++) {
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 75e66c612505..189eedbc3027 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -314,7 +314,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (r1_bio->mddev->degraded == conf->raid_disks ||
+ (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ uptodate = 1;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ }
+@@ -1250,6 +1250,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ {
+ char b[BDEVNAME_SIZE];
+ struct r1conf *conf = mddev->private;
++ unsigned long flags;
+
+ /*
+ * If it is not operational, then we have already marked it as dead
+@@ -1269,6 +1270,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ return;
+ }
+ set_bit(Blocked, &rdev->flags);
++ spin_lock_irqsave(&conf->device_lock, flags);
+ if (test_and_clear_bit(In_sync, &rdev->flags)) {
+ unsigned long flags;
+ spin_lock_irqsave(&conf->device_lock, flags);
+@@ -1281,6 +1283,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev)
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+ } else
+ set_bit(Faulty, &rdev->flags);
++ spin_unlock_irqrestore(&conf->device_lock, flags);
+ set_bit(MD_CHANGE_DEVS, &mddev->flags);
+ printk(KERN_ALERT
+ "md/raid1:%s: Disk failure on %s, disabling device.\n"
+@@ -1334,7 +1337,10 @@ static int raid1_spare_active(struct mddev *mddev)
+ * Find all failed disks within the RAID1 configuration
+ * and mark them readable.
+ * Called under mddev lock, so rcu protection not needed.
++ * device_lock used to avoid races with raid1_end_read_request
++ * which expects 'In_sync' flags and ->degraded to be consistent.
+ */
++ spin_lock_irqsave(&conf->device_lock, flags);
+ for (i = 0; i < conf->raid_disks; i++) {
+ struct md_rdev *rdev = conf->mirrors[i].rdev;
+ struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev;
+@@ -1364,7 +1370,6 @@ static int raid1_spare_active(struct mddev *mddev)
+ sysfs_notify_dirent_safe(rdev->sysfs_state);
+ }
+ }
+- spin_lock_irqsave(&conf->device_lock, flags);
+ mddev->degraded -= count;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index 47a789ea26bc..b4277ac6939f 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -182,6 +182,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
+
+ ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
+
++ mmc_blk_put(md);
++
+ return ret;
+ }
+
+diff --git a/drivers/net/can/mcp251x.c b/drivers/net/can/mcp251x.c
+index 9d6074273caa..d07426d007d0 100644
+--- a/drivers/net/can/mcp251x.c
++++ b/drivers/net/can/mcp251x.c
+@@ -1161,18 +1161,17 @@ static int mcp251x_can_resume(struct spi_device *spi)
+ struct mcp251x_platform_data *pdata = spi->dev.platform_data;
+ struct mcp251x_priv *priv = dev_get_drvdata(&spi->dev);
+
+- if (priv->after_suspend & AFTER_SUSPEND_POWER) {
++ if (priv->after_suspend & AFTER_SUSPEND_POWER)
+ pdata->power_enable(1);
++
++ if (priv->after_suspend & AFTER_SUSPEND_UP) {
++ if (pdata->transceiver_enable)
++ pdata->transceiver_enable(1);
+ queue_work(priv->wq, &priv->restart_work);
+ } else {
+- if (priv->after_suspend & AFTER_SUSPEND_UP) {
+- if (pdata->transceiver_enable)
+- pdata->transceiver_enable(1);
+- queue_work(priv->wq, &priv->restart_work);
+- } else {
+- priv->after_suspend = 0;
+- }
++ priv->after_suspend = 0;
+ }
++
+ priv->force_quit = 0;
+ enable_irq(spi->irq);
+ return 0;
+diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
+index 8489d09494af..e475f8530862 100644
+--- a/drivers/net/ethernet/sun/niu.c
++++ b/drivers/net/ethernet/sun/niu.c
+@@ -6659,10 +6659,8 @@ static netdev_tx_t niu_start_xmit(struct sk_buff *skb,
+ struct sk_buff *skb_new;
+
+ skb_new = skb_realloc_headroom(skb, len);
+- if (!skb_new) {
+- rp->tx_errors++;
++ if (!skb_new)
+ goto out_drop;
+- }
+ kfree_skb(skb);
+ skb = skb_new;
+ } else
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 1207bb19ba58..ba4411b746a5 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -703,10 +703,8 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ val &= 0xffff;
+ }
+ vj = slhc_init(val2+1, val+1);
+- if (!vj) {
+- netdev_err(ppp->dev,
+- "PPP: no memory (VJ compressor)\n");
+- err = -ENOMEM;
++ if (IS_ERR(vj)) {
++ err = PTR_ERR(vj);
+ break;
+ }
+ ppp_lock(ppp);
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 9f047a04215e..5a13ad0f2939 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -420,6 +420,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
+ struct pptp_opt *opt = &po->proto.pptp;
+ int error = 0;
+
++ if (sockaddr_len < sizeof(struct sockaddr_pppox))
++ return -EINVAL;
++
+ lock_sock(sk);
+
+ opt->src_addr = sp->sa_addr.pptp;
+@@ -441,6 +444,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ struct flowi4 fl4;
+ int error = 0;
+
++ if (sockaddr_len < sizeof(struct sockaddr_pppox))
++ return -EINVAL;
++
+ if (sp->sa_protocol != PX_PROTO_PPTP)
+ return -EINVAL;
+
+diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c
+index 1252d9c726a7..b52eabc168a0 100644
+--- a/drivers/net/slip/slhc.c
++++ b/drivers/net/slip/slhc.c
+@@ -84,8 +84,9 @@ static long decode(unsigned char **cpp);
+ static unsigned char * put16(unsigned char *cp, unsigned short x);
+ static unsigned short pull16(unsigned char **cpp);
+
+-/* Initialize compression data structure
++/* Allocate compression data structure
+ * slots must be in range 0 to 255 (zero meaning no compression)
++ * Returns pointer to structure or ERR_PTR() on error.
+ */
+ struct slcompress *
+ slhc_init(int rslots, int tslots)
+@@ -94,11 +95,14 @@ slhc_init(int rslots, int tslots)
+ register struct cstate *ts;
+ struct slcompress *comp;
+
++ if (rslots < 0 || rslots > 255 || tslots < 0 || tslots > 255)
++ return ERR_PTR(-EINVAL);
++
+ comp = kzalloc(sizeof(struct slcompress), GFP_KERNEL);
+ if (! comp)
+ goto out_fail;
+
+- if ( rslots > 0 && rslots < 256 ) {
++ if (rslots > 0) {
+ size_t rsize = rslots * sizeof(struct cstate);
+ comp->rstate = kzalloc(rsize, GFP_KERNEL);
+ if (! comp->rstate)
+@@ -106,7 +110,7 @@ slhc_init(int rslots, int tslots)
+ comp->rslot_limit = rslots - 1;
+ }
+
+- if ( tslots > 0 && tslots < 256 ) {
++ if (tslots > 0) {
+ size_t tsize = tslots * sizeof(struct cstate);
+ comp->tstate = kzalloc(tsize, GFP_KERNEL);
+ if (! comp->tstate)
+@@ -141,7 +145,7 @@ out_free2:
+ out_free:
+ kfree(comp);
+ out_fail:
+- return NULL;
++ return ERR_PTR(-ENOMEM);
+ }
+
+
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index d4c9db3da22a..1f22662648b5 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -163,7 +163,7 @@ static int sl_alloc_bufs(struct slip *sl, int mtu)
+ if (cbuff == NULL)
+ goto err_exit;
+ slcomp = slhc_init(16, 16);
+- if (slcomp == NULL)
++ if (IS_ERR(slcomp))
+ goto err_exit;
+ #endif
+ spin_lock_bh(&sl->lock);
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index efb50d6dfb6c..27c82eee537a 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -1036,9 +1036,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM | NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM | NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
+diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
+index f7357308655a..c979fd02b515 100644
+--- a/drivers/scsi/libfc/fc_fcp.c
++++ b/drivers/scsi/libfc/fc_fcp.c
+@@ -1030,11 +1030,26 @@ restart:
+ fc_fcp_pkt_hold(fsp);
+ spin_unlock_irqrestore(&si->scsi_queue_lock, flags);
+
+- if (!fc_fcp_lock_pkt(fsp)) {
++ spin_lock_bh(&fsp->scsi_pkt_lock);
++ if (!(fsp->state & FC_SRB_COMPL)) {
++ fsp->state |= FC_SRB_COMPL;
++ /*
++ * TODO: dropping scsi_pkt_lock and then reacquiring
++ * again around fc_fcp_cleanup_cmd() is required,
++ * since fc_fcp_cleanup_cmd() calls into
++ * fc_seq_set_resp() and that func preempts cpu using
++ * schedule. May be schedule and related code should be
++ * removed instead of unlocking here to avoid scheduling
++ * while atomic bug.
++ */
++ spin_unlock_bh(&fsp->scsi_pkt_lock);
++
+ fc_fcp_cleanup_cmd(fsp, error);
++
++ spin_lock_bh(&fsp->scsi_pkt_lock);
+ fc_io_compl(fsp);
+- fc_fcp_unlock_pkt(fsp);
+ }
++ spin_unlock_bh(&fsp->scsi_pkt_lock);
+
+ fc_fcp_pkt_release(fsp);
+ spin_lock_irqsave(&si->scsi_queue_lock, flags);
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 1243d2f5bffa..d9a898c5d242 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -2907,10 +2907,10 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ {
+ struct iscsi_conn *conn = cls_conn->dd_data;
+ struct iscsi_session *session = conn->session;
+- unsigned long flags;
+
+ del_timer_sync(&conn->transport_timer);
+
++ mutex_lock(&session->eh_mutex);
+ spin_lock_bh(&session->lock);
+ conn->c_stage = ISCSI_CONN_CLEANUP_WAIT;
+ if (session->leadconn == conn) {
+@@ -2922,28 +2922,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ }
+ spin_unlock_bh(&session->lock);
+
+- /*
+- * Block until all in-progress commands for this connection
+- * time out or fail.
+- */
+- for (;;) {
+- spin_lock_irqsave(session->host->host_lock, flags);
+- if (!session->host->host_busy) { /* OK for ERL == 0 */
+- spin_unlock_irqrestore(session->host->host_lock, flags);
+- break;
+- }
+- spin_unlock_irqrestore(session->host->host_lock, flags);
+- msleep_interruptible(500);
+- iscsi_conn_printk(KERN_INFO, conn, "iscsi conn_destroy(): "
+- "host_busy %d host_failed %d\n",
+- session->host->host_busy,
+- session->host->host_failed);
+- /*
+- * force eh_abort() to unblock
+- */
+- wake_up(&conn->ehwait);
+- }
+-
+ /* flush queued up work because we free the connection below */
+ iscsi_suspend_tx(conn);
+
+@@ -2956,6 +2934,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
+ if (session->leadconn == conn)
+ session->leadconn = NULL;
+ spin_unlock_bh(&session->lock);
++ mutex_unlock(&session->eh_mutex);
+
+ iscsi_destroy_conn(cls_conn);
+ }
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index fb119ce06ae5..ebe83f7f63e7 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
+ md->from_user = 0;
+ }
+
++ if (unlikely(iov_count > UIO_MAXIOV))
++ return -EINVAL;
++
+ if (iov_count) {
+ int len, size = sizeof(struct sg_iovec) * iov_count;
+ struct iovec *iov;
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index e41998cb098e..a3eb263e0321 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1268,9 +1268,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ err_out:
+ normalize_buffer(STp->buffer);
+ STp->in_use = 0;
+- scsi_tape_put(STp);
+ if (resumed)
+ scsi_autopm_put_device(STp->device);
++ scsi_tape_put(STp);
+ mutex_unlock(&st_mutex);
+ return retval;
+
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 56d02e071d7a..963f38312927 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -981,7 +981,7 @@ done:
+ if (cmd->targ_xfer_tag == 0xFFFFFFFF)
+ cmd->targ_xfer_tag = conn->sess->targ_xfer_tag++;
+ spin_unlock_bh(&conn->sess->ttt_lock);
+- } else if (hdr->flags & ISCSI_FLAG_CMD_WRITE)
++ } else
+ cmd->targ_xfer_tag = 0xFFFFFFFF;
+ cmd->cmd_sn = hdr->cmdsn;
+ cmd->exp_stat_sn = hdr->exp_statsn;
+@@ -4500,6 +4500,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ struct iscsi_session *sess;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ struct se_session *se_sess, *se_sess_tmp;
++ LIST_HEAD(free_list);
+ int session_count = 0;
+
+ spin_lock_bh(&se_tpg->session_lock);
+@@ -4521,14 +4522,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ }
+ atomic_set(&sess->session_reinstatement, 1);
+ spin_unlock(&sess->conn_lock);
+- spin_unlock_bh(&se_tpg->session_lock);
+
+- iscsit_free_session(sess);
+- spin_lock_bh(&se_tpg->session_lock);
++ list_move_tail(&se_sess->sess_list, &free_list);
++ }
++ spin_unlock_bh(&se_tpg->session_lock);
+
++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
++
++ iscsit_free_session(sess);
+ session_count++;
+ }
+- spin_unlock_bh(&se_tpg->session_lock);
+
+ pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ " Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
+index 194cafdac16a..97076015b41c 100644
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -614,7 +614,6 @@ struct dwc3 {
+ unsigned three_stage_setup:1;
+ unsigned ep0_bounced:1;
+ unsigned ep0_expect_in:1;
+- unsigned start_config_issued:1;
+ unsigned setup_packet_pending:1;
+ unsigned delayed_status:1;
+ unsigned needs_fifo_resize:1;
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index a8714fd5ffe2..b6051f396015 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -442,7 +442,6 @@ static int dwc3_ep0_set_config(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
+ u32 cfg;
+ int ret;
+
+- dwc->start_config_issued = false;
+ cfg = le16_to_cpu(ctrl->wValue);
+
+ switch (dwc->dev_state) {
+@@ -644,10 +643,6 @@ static void dwc3_ep0_xfer_complete(struct dwc3 *dwc,
+ dev_vdbg(dwc->dev, "Status Phase\n");
+ dwc3_ep0_complete_req(dwc, event);
+ break;
+- case USB_REQ_SET_INTERFACE:
+- dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
+- dwc->start_config_issued = false;
+- /* Fall through */
+ default:
+ WARN(true, "UNKNOWN ep0state %d\n", dwc->ep0state);
+ }
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index b43c6f90b25f..fba74f8a5b5a 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -359,24 +359,66 @@ static void dwc3_free_trb_pool(struct dwc3_ep *dep)
+ dep->trb_pool_dma = 0;
+ }
+
++static int dwc3_gadget_set_xfer_resource(struct dwc3 *dwc, struct dwc3_ep *dep);
++
++/**
++ * dwc3_gadget_start_config - Configure EP resources
++ * @dwc: pointer to our controller context structure
++ * @dep: endpoint that is being enabled
++ *
++ * The assignment of transfer resources cannot perfectly follow the
++ * data book due to the fact that the controller driver does not have
++ * all knowledge of the configuration in advance. It is given this
++ * information piecemeal by the composite gadget framework after every
++ * SET_CONFIGURATION and SET_INTERFACE. Trying to follow the databook
++ * programming model in this scenario can cause errors. For two
++ * reasons:
++ *
++ * 1) The databook says to do DEPSTARTCFG for every SET_CONFIGURATION
++ * and SET_INTERFACE (8.1.5). This is incorrect in the scenario of
++ * multiple interfaces.
++ *
++ * 2) The databook does not mention doing more DEPXFERCFG for new
++ * endpoint on alt setting (8.1.6).
++ *
++ * The following simplified method is used instead:
++ *
++ * All hardware endpoints can be assigned a transfer resource and this
++ * setting will stay persistent until either a core reset or
++ * hibernation. So whenever we do a DEPSTARTCFG(0) we can go ahead and
++ * do DEPXFERCFG for every hardware endpoint as well. We are
++ * guaranteed that there are as many transfer resources as endpoints.
++ *
++ * This function is called for each endpoint when it is being enabled
++ * but is triggered only when called for EP0-out, which always happens
++ * first, and which should only happen in one of the above conditions.
++ */
+ static int dwc3_gadget_start_config(struct dwc3 *dwc, struct dwc3_ep *dep)
+ {
+ struct dwc3_gadget_ep_cmd_params params;
+ u32 cmd;
++ int i;
++ int ret;
++
++ if (dep->number)
++ return 0;
+
+ memset(¶ms, 0x00, sizeof(params));
++ cmd = DWC3_DEPCMD_DEPSTARTCFG;
+
+- if (dep->number != 1) {
+- cmd = DWC3_DEPCMD_DEPSTARTCFG;
+- /* XferRscIdx == 0 for ep0 and 2 for the remaining */
+- if (dep->number > 1) {
+- if (dwc->start_config_issued)
+- return 0;
+- dwc->start_config_issued = true;
+- cmd |= DWC3_DEPCMD_PARAM(2);
+- }
++ ret = dwc3_send_gadget_ep_cmd(dwc, 0, cmd, ¶ms);
++ if (ret)
++ return ret;
+
+- return dwc3_send_gadget_ep_cmd(dwc, 0, cmd, ¶ms);
++ for (i = 0; i < DWC3_ENDPOINTS_NUM; i++) {
++ struct dwc3_ep *dep = dwc->eps[i];
++
++ if (!dep)
++ continue;
++
++ ret = dwc3_gadget_set_xfer_resource(dwc, dep);
++ if (ret)
++ return ret;
+ }
+
+ return 0;
+@@ -471,10 +513,6 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
+ struct dwc3_trb *trb_st_hw;
+ struct dwc3_trb *trb_link;
+
+- ret = dwc3_gadget_set_xfer_resource(dwc, dep);
+- if (ret)
+- return ret;
+-
+ dep->desc = desc;
+ dep->comp_desc = comp_desc;
+ dep->type = usb_endpoint_type(desc);
+@@ -1375,8 +1413,6 @@ static int dwc3_gadget_start(struct usb_gadget *g,
+ reg |= dwc->maximum_speed;
+ dwc3_writel(dwc->regs, DWC3_DCFG, reg);
+
+- dwc->start_config_issued = false;
+-
+ /* Start with SuperSpeed Default */
+ dwc3_gadget_ep0_desc.wMaxPacketSize = cpu_to_le16(512);
+
+@@ -1861,7 +1897,6 @@ static void dwc3_gadget_disconnect_interrupt(struct dwc3 *dwc)
+
+ dwc3_stop_active_transfers(dwc);
+ dwc3_disconnect_gadget(dwc);
+- dwc->start_config_issued = false;
+
+ dwc->gadget.speed = USB_SPEED_UNKNOWN;
+ dwc->setup_packet_pending = false;
+@@ -1949,7 +1984,6 @@ static void dwc3_gadget_reset_interrupt(struct dwc3 *dwc)
+
+ dwc3_stop_active_transfers(dwc);
+ dwc3_clear_stall_all_ep(dwc);
+- dwc->start_config_issued = false;
+
+ /* Reset device address to zero */
+ reg = dwc3_readl(dwc->regs, DWC3_DCFG);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index a6d4393668f5..fbbb11d0f9bb 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -473,10 +473,13 @@ static void xhci_hub_report_link_state(struct xhci_hcd *xhci,
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+- * Do not report it to usb core.
++ * Do not report it to usb core, instead, pretend to be U3,
++ * thus usb core knows it's not ready for transfer
+ */
+- if (pls == XDEV_RESUME)
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
+ return;
++ }
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+@@ -1008,10 +1011,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (hcd->self.root_hub->do_remote_wakeup) {
+- if (bus_state->resuming_ports) {
++ if (bus_state->resuming_ports || /* USB2 */
++ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "suspend failed because "
+- "a port is resuming\n");
++ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ return -EBUSY;
+ }
+ }
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index aa38b1ff45ae..048cc382a7a9 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1420,10 +1420,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
+ /* Attempt to use the ring cache */
+ if (virt_dev->num_rings_cached == 0)
+ return -ENOMEM;
++ virt_dev->num_rings_cached--;
+ virt_dev->eps[ep_index].new_ring =
+ virt_dev->ring_cache[virt_dev->num_rings_cached];
+ virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
+- virt_dev->num_rings_cached--;
+ xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
+ 1, type);
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 5e93425424f6..5623785a300c 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -85,7 +85,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg,
+ return 0;
+ /* offset in TRBs */
+ segment_offset = trb - seg->trbs;
+- if (segment_offset > TRBS_PER_SEGMENT)
++ if (segment_offset >= TRBS_PER_SEGMENT)
+ return 0;
+ return seg->dma + (segment_offset * sizeof(*trb));
+ }
+@@ -1667,6 +1667,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ usb_hcd_resume_root_hub(hcd);
+ }
+
++ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index d96652d3fb54..fd52e1efd6ca 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3368,6 +3368,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ return -EINVAL;
+ }
+
++ if (virt_dev->tt_info)
++ old_active_eps = virt_dev->tt_info->active_eps;
++
+ if (virt_dev->udev != udev) {
+ /* If the virt_dev and the udev does not match, this virt_dev
+ * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 855f084a9a32..f4116fcd1cd8 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -280,6 +280,7 @@ struct xhci_op_regs {
+ #define XDEV_U0 (0x0 << 5)
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
++#define XDEV_INACTIVE (0x6 << 5)
+ #define XDEV_RESUME (0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER (1 << 9)
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 29bf38309252..7a04e2c4e0af 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -193,6 +193,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
+ { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
+ { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
++ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
+ { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
+ { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
+ { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index d8232df2c211..cb999af237dd 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1757,6 +1757,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
++ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
+ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { } /* Terminating entry */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index e3ddec02f032..dd0ca846236e 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -303,6 +303,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
++ { USB_DEVICE(0x1199, 0x68AB) }, /* Sierra Wireless AR8550 */
+ /* AT&T Direct IP LTE modems */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index bf7014d49a50..5cf9db1d5692 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -91,6 +91,8 @@ static int whiteheat_firmware_download(struct usb_serial *serial,
+ static int whiteheat_firmware_attach(struct usb_serial *serial);
+
+ /* function prototypes for the Connect Tech WhiteHEAT serial converter */
++static int whiteheat_probe(struct usb_serial *serial,
++ const struct usb_device_id *id);
+ static int whiteheat_attach(struct usb_serial *serial);
+ static void whiteheat_release(struct usb_serial *serial);
+ static int whiteheat_open(struct tty_struct *tty,
+@@ -134,6 +136,7 @@ static struct usb_serial_driver whiteheat_device = {
+ .description = "Connect Tech - WhiteHEAT",
+ .id_table = id_table_std,
+ .num_ports = 4,
++ .probe = whiteheat_probe,
+ .attach = whiteheat_attach,
+ .release = whiteheat_release,
+ .open = whiteheat_open,
+@@ -336,6 +339,34 @@ static int whiteheat_firmware_attach(struct usb_serial *serial)
+ /*****************************************************************************
+ * Connect Tech's White Heat serial driver functions
+ *****************************************************************************/
++
++static int whiteheat_probe(struct usb_serial *serial,
++ const struct usb_device_id *id)
++{
++ struct usb_host_interface *iface_desc;
++ struct usb_endpoint_descriptor *endpoint;
++ size_t num_bulk_in = 0;
++ size_t num_bulk_out = 0;
++ size_t min_num_bulk;
++ unsigned int i;
++
++ iface_desc = serial->interface->cur_altsetting;
++
++ for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
++ endpoint = &iface_desc->endpoint[i].desc;
++ if (usb_endpoint_is_bulk_in(endpoint))
++ ++num_bulk_in;
++ if (usb_endpoint_is_bulk_out(endpoint))
++ ++num_bulk_out;
++ }
++
++ min_num_bulk = COMMAND_PORT + 1;
++ if (num_bulk_in < min_num_bulk || num_bulk_out < min_num_bulk)
++ return -ENODEV;
++
++ return 0;
++}
++
+ static int whiteheat_attach(struct usb_serial *serial)
+ {
+ struct usb_serial_port *command_port;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index d0ecaf9ff415..61f93ea73f2c 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2019,6 +2019,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++ "ZTE,Incorporated",
++ "ZTE WCDMA Technologies MSM",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+ * This encrypted pen drive returns bogus data for the initial READ(10).
+ */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index a50cb9c28f7d..8b2bac4c1c40 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -884,6 +884,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, unsigned long arg)
+ }
+ if (eventfp != d->log_file) {
+ filep = d->log_file;
++ d->log_file = eventfp;
+ ctx = d->log_ctx;
+ d->log_ctx = eventfp ?
+ eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 014c8dd62962..c9b32dcf820d 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
+ unlock_new_inode(inode);
+ return inode;
+ error:
+- unlock_new_inode(inode);
+- iput(inode);
++ iget_failed(inode);
+ return ERR_PTR(retval);
+
+ }
+diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
+index a86a78d8e614..5cfbaddd3ec5 100644
+--- a/fs/9p/vfs_inode_dotl.c
++++ b/fs/9p/vfs_inode_dotl.c
+@@ -169,8 +169,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
+ unlock_new_inode(inode);
+ return inode;
+ error:
+- unlock_new_inode(inode);
+- iput(inode);
++ iget_failed(inode);
+ return ERR_PTR(retval);
+
+ }
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index b1a1c929ba80..47abfd2b3c4c 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -283,7 +283,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
+ __btrfs_add_free_space(ctl, info->offset, count);
+ free:
+ rb_erase(&info->offset_index, rbroot);
+- kfree(info);
++ kmem_cache_free(btrfs_free_space_cachep, info);
+ }
+ }
+
+diff --git a/fs/buffer.c b/fs/buffer.c
+index ed2dc709883a..e65a585eebc2 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -952,7 +952,7 @@ init_page_buffers(struct page *page, struct block_device *bdev,
+ */
+ static int
+ grow_dev_page(struct block_device *bdev, sector_t block,
+- pgoff_t index, int size, int sizebits)
++ pgoff_t index, int size, int sizebits, gfp_t gfp)
+ {
+ struct inode *inode = bdev->bd_inode;
+ struct page *page;
+@@ -961,7 +961,7 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ int ret = 0; /* Will call free_more_memory() */
+
+ page = find_or_create_page(inode->i_mapping, index,
+- (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS)|__GFP_MOVABLE);
++ (mapping_gfp_mask(inode->i_mapping) & ~__GFP_FS) | gfp);
+ if (!page)
+ return ret;
+
+@@ -1009,7 +1009,7 @@ failed:
+ * that page was dirty, the buffers are set dirty also.
+ */
+ static int
+-grow_buffers(struct block_device *bdev, sector_t block, int size)
++grow_buffers(struct block_device *bdev, sector_t block, int size, gfp_t gfp)
+ {
+ pgoff_t index;
+ int sizebits;
+@@ -1036,11 +1036,12 @@ grow_buffers(struct block_device *bdev, sector_t block, int size)
+ }
+
+ /* Create a page with the proper size buffers.. */
+- return grow_dev_page(bdev, block, index, size, sizebits);
++ return grow_dev_page(bdev, block, index, size, sizebits, gfp);
+ }
+
+-static struct buffer_head *
+-__getblk_slow(struct block_device *bdev, sector_t block, int size)
++struct buffer_head *
++__getblk_slow(struct block_device *bdev, sector_t block,
++ unsigned size, gfp_t gfp)
+ {
+ /* Size must be multiple of hard sectorsize */
+ if (unlikely(size & (bdev_logical_block_size(bdev)-1) ||
+@@ -1062,13 +1063,14 @@ __getblk_slow(struct block_device *bdev, sector_t block, int size)
+ if (bh)
+ return bh;
+
+- ret = grow_buffers(bdev, block, size);
++ ret = grow_buffers(bdev, block, size, gfp);
+ if (ret < 0)
+ return NULL;
+ if (ret == 0)
+ free_more_memory();
+ }
+ }
++EXPORT_SYMBOL(__getblk_slow);
+
+ /*
+ * The relationship between dirty buffers and dirty pages:
+@@ -1319,24 +1321,25 @@ __find_get_block(struct block_device *bdev, sector_t block, unsigned size)
+ EXPORT_SYMBOL(__find_get_block);
+
+ /*
+- * __getblk will locate (and, if necessary, create) the buffer_head
++ * __getblk_gfp() will locate (and, if necessary, create) the buffer_head
+ * which corresponds to the passed block_device, block and size. The
+ * returned buffer has its reference count incremented.
+ *
+- * __getblk() will lock up the machine if grow_dev_page's try_to_free_buffers()
+- * attempt is failing. FIXME, perhaps?
++ * __getblk_gfp() will lock up the machine if grow_dev_page's
++ * try_to_free_buffers() attempt is failing. FIXME, perhaps?
+ */
+ struct buffer_head *
+-__getblk(struct block_device *bdev, sector_t block, unsigned size)
++__getblk_gfp(struct block_device *bdev, sector_t block,
++ unsigned size, gfp_t gfp)
+ {
+ struct buffer_head *bh = __find_get_block(bdev, block, size);
+
+ might_sleep();
+ if (bh == NULL)
+- bh = __getblk_slow(bdev, block, size);
++ bh = __getblk_slow(bdev, block, size, gfp);
+ return bh;
+ }
+-EXPORT_SYMBOL(__getblk);
++EXPORT_SYMBOL(__getblk_gfp);
+
+ /*
+ * Do async read-ahead on a buffer..
+@@ -1352,24 +1355,28 @@ void __breadahead(struct block_device *bdev, sector_t block, unsigned size)
+ EXPORT_SYMBOL(__breadahead);
+
+ /**
+- * __bread() - reads a specified block and returns the bh
++ * __bread_gfp() - reads a specified block and returns the bh
+ * @bdev: the block_device to read from
+ * @block: number of block
+ * @size: size (in bytes) to read
+- *
++ * @gfp: page allocation flag
++ *
+ * Reads a specified block, and returns buffer head that contains it.
++ * The page cache can be allocated from non-movable area
++ * not to prevent page migration if you set gfp to zero.
+ * It returns NULL if the block was unreadable.
+ */
+ struct buffer_head *
+-__bread(struct block_device *bdev, sector_t block, unsigned size)
++__bread_gfp(struct block_device *bdev, sector_t block,
++ unsigned size, gfp_t gfp)
+ {
+- struct buffer_head *bh = __getblk(bdev, block, size);
++ struct buffer_head *bh = __getblk_gfp(bdev, block, size, gfp);
+
+ if (likely(bh) && !buffer_uptodate(bh))
+ bh = __bread_slow(bh);
+ return bh;
+ }
+-EXPORT_SYMBOL(__bread);
++EXPORT_SYMBOL(__bread_gfp);
+
+ /*
+ * invalidate_bh_lrus() is called rarely - but not only at unmount.
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index bbe09a975003..e05cb4c91a9b 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -699,7 +699,8 @@ ext4_ext_find_extent(struct inode *inode, ext4_lblk_t block,
+ path[ppos].p_depth = i;
+ path[ppos].p_ext = NULL;
+
+- bh = sb_getblk(inode->i_sb, path[ppos].p_block);
++ bh = sb_getblk_gfp(inode->i_sb, path[ppos].p_block,
++ __GFP_MOVABLE | GFP_NOFS);
+ if (unlikely(!bh)) {
+ ret = -ENOMEM;
+ goto err;
+@@ -904,7 +905,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
+ err = -EIO;
+ goto cleanup;
+ }
+- bh = sb_getblk(inode->i_sb, newblock);
++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
+ if (!bh) {
+ err = -ENOMEM;
+ goto cleanup;
+@@ -1088,7 +1089,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
+ if (newblock == 0)
+ return err;
+
+- bh = sb_getblk(inode->i_sb, newblock);
++ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
+ if (!bh)
+ return -ENOMEM;
+ lock_buffer(bh);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index cdfc763b313f..46e6562ae66e 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -4643,18 +4643,12 @@ do_more:
+ /*
+ * blocks being freed are metadata. these blocks shouldn't
+ * be used until this transaction is committed
++ *
++ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
++ * to fail.
+ */
+- retry:
+- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
+- if (!new_entry) {
+- /*
+- * We use a retry loop because
+- * ext4_free_blocks() is not allowed to fail.
+- */
+- cond_resched();
+- congestion_wait(BLK_RW_ASYNC, HZ/50);
+- goto retry;
+- }
++ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
++ GFP_NOFS|__GFP_NOFAIL);
+ new_entry->efd_start_cluster = bit;
+ new_entry->efd_group = block_group;
+ new_entry->efd_count = count_clusters;
+diff --git a/fs/file_table.c b/fs/file_table.c
+index 70f2a0fd6aec..a01710a6ff3b 100644
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -34,9 +34,6 @@ struct files_stat_struct files_stat = {
+ .max_files = NR_FILE
+ };
+
+-DECLARE_LGLOCK(files_lglock);
+-DEFINE_LGLOCK(files_lglock);
+-
+ /* SLAB cache for file structures */
+ static struct kmem_cache *filp_cachep __read_mostly;
+
+@@ -129,7 +126,6 @@ struct file *get_empty_filp(void)
+ if (security_file_alloc(f))
+ goto fail_sec;
+
+- INIT_LIST_HEAD(&f->f_u.fu_list);
+ atomic_long_set(&f->f_count, 1);
+ rwlock_init(&f->f_owner.lock);
+ spin_lock_init(&f->f_lock);
+@@ -252,7 +248,6 @@ static void __fput(struct file *file)
+ }
+ fops_put(file->f_op);
+ put_pid(file->f_owner.pid);
+- file_sb_list_del(file);
+ if ((file->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ)
+ i_readcount_dec(inode);
+ if (file->f_mode & FMODE_WRITE)
+@@ -382,134 +377,10 @@ void put_filp(struct file *file)
+ {
+ if (atomic_long_dec_and_test(&file->f_count)) {
+ security_file_free(file);
+- file_sb_list_del(file);
+ file_free(file);
+ }
+ }
+
+-static inline int file_list_cpu(struct file *file)
+-{
+-#ifdef CONFIG_SMP
+- return file->f_sb_list_cpu;
+-#else
+- return smp_processor_id();
+-#endif
+-}
+-
+-/* helper for file_sb_list_add to reduce ifdefs */
+-static inline void __file_sb_list_add(struct file *file, struct super_block *sb)
+-{
+- struct list_head *list;
+-#ifdef CONFIG_SMP
+- int cpu;
+- cpu = smp_processor_id();
+- file->f_sb_list_cpu = cpu;
+- list = per_cpu_ptr(sb->s_files, cpu);
+-#else
+- list = &sb->s_files;
+-#endif
+- list_add(&file->f_u.fu_list, list);
+-}
+-
+-/**
+- * file_sb_list_add - add a file to the sb's file list
+- * @file: file to add
+- * @sb: sb to add it to
+- *
+- * Use this function to associate a file with the superblock of the inode it
+- * refers to.
+- */
+-void file_sb_list_add(struct file *file, struct super_block *sb)
+-{
+- lg_local_lock(files_lglock);
+- __file_sb_list_add(file, sb);
+- lg_local_unlock(files_lglock);
+-}
+-
+-/**
+- * file_sb_list_del - remove a file from the sb's file list
+- * @file: file to remove
+- * @sb: sb to remove it from
+- *
+- * Use this function to remove a file from its superblock.
+- */
+-void file_sb_list_del(struct file *file)
+-{
+- if (!list_empty(&file->f_u.fu_list)) {
+- lg_local_lock_cpu(files_lglock, file_list_cpu(file));
+- list_del_init(&file->f_u.fu_list);
+- lg_local_unlock_cpu(files_lglock, file_list_cpu(file));
+- }
+-}
+-
+-#ifdef CONFIG_SMP
+-
+-/*
+- * These macros iterate all files on all CPUs for a given superblock.
+- * files_lglock must be held globally.
+- */
+-#define do_file_list_for_each_entry(__sb, __file) \
+-{ \
+- int i; \
+- for_each_possible_cpu(i) { \
+- struct list_head *list; \
+- list = per_cpu_ptr((__sb)->s_files, i); \
+- list_for_each_entry((__file), list, f_u.fu_list)
+-
+-#define while_file_list_for_each_entry \
+- } \
+-}
+-
+-#else
+-
+-#define do_file_list_for_each_entry(__sb, __file) \
+-{ \
+- struct list_head *list; \
+- list = &(sb)->s_files; \
+- list_for_each_entry((__file), list, f_u.fu_list)
+-
+-#define while_file_list_for_each_entry \
+-}
+-
+-#endif
+-
+-/**
+- * mark_files_ro - mark all files read-only
+- * @sb: superblock in question
+- *
+- * All files are marked read-only. We don't care about pending
+- * delete files so this should be used in 'force' mode only.
+- */
+-void mark_files_ro(struct super_block *sb)
+-{
+- struct file *f;
+-
+-retry:
+- lg_global_lock(files_lglock);
+- do_file_list_for_each_entry(sb, f) {
+- struct vfsmount *mnt;
+- if (!S_ISREG(f->f_path.dentry->d_inode->i_mode))
+- continue;
+- if (!file_count(f))
+- continue;
+- if (!(f->f_mode & FMODE_WRITE))
+- continue;
+- spin_lock(&f->f_lock);
+- f->f_mode &= ~FMODE_WRITE;
+- spin_unlock(&f->f_lock);
+- if (file_check_writeable(f) != 0)
+- continue;
+- file_release_write(f);
+- mnt = mntget(f->f_path.mnt);
+- /* This can sleep, so we can't hold the spinlock. */
+- lg_global_unlock(files_lglock);
+- mnt_drop_write(mnt);
+- mntput(mnt);
+- goto retry;
+- } while_file_list_for_each_entry;
+- lg_global_unlock(files_lglock);
+-}
+-
+ void __init files_init(unsigned long mempages)
+ {
+ unsigned long n;
+@@ -525,6 +396,5 @@ void __init files_init(unsigned long mempages)
+ n = (mempages * (PAGE_SIZE / 1024)) / 10;
+ files_stat.max_files = max_t(unsigned long, n, NR_FILE);
+ files_defer_init();
+- lg_lock_init(files_lglock);
+ percpu_counter_init(&nr_files, 0);
+ }
+diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
+index 0bf578dbfce7..efc18237fbae 100644
+--- a/fs/hpfs/super.c
++++ b/fs/hpfs/super.c
+@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
+ }
+
+ /* Filesystem error... */
+-static char err_buf[1024];
+-
+ void hpfs_error(struct super_block *s, const char *fmt, ...)
+ {
++ struct va_format vaf;
+ va_list args;
+
+ va_start(args, fmt);
+- vsnprintf(err_buf, sizeof(err_buf), fmt, args);
++
++ vaf.fmt = fmt;
++ vaf.va = &args;
++
++ pr_err("filesystem error: %pV", &vaf);
++
+ va_end(args);
+
+- printk("HPFS: filesystem error: %s", err_buf);
+ if (!hpfs_sb(s)->sb_was_error) {
+ if (hpfs_sb(s)->sb_err == 2) {
+ printk("; crashing the system because you wanted it\n");
+@@ -385,9 +388,13 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
+ int o;
+ struct hpfs_sb_info *sbi = hpfs_sb(s);
+ char *new_opts = kstrdup(data, GFP_KERNEL);
+-
++
++
++ if (!new_opts)
++ return -ENOMEM;
++
+ *flags |= MS_NOATIME;
+-
++
+ hpfs_lock(s);
+ lock_super(s);
+ uid = sbi->sb_uid; gid = sbi->sb_gid;
+diff --git a/fs/internal.h b/fs/internal.h
+index 9962c59ba280..ed005c5eef62 100644
+--- a/fs/internal.h
++++ b/fs/internal.h
+@@ -67,9 +67,6 @@ extern void chroot_fs_refs(struct path *, struct path *);
+ /*
+ * file_table.c
+ */
+-extern void file_sb_list_add(struct file *f, struct super_block *sb);
+-extern void file_sb_list_del(struct file *f);
+-extern void mark_files_ro(struct super_block *);
+ extern struct file *get_empty_filp(void);
+
+ /*
+diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
+index 231eab2b2d07..b5e457ccfed2 100644
+--- a/fs/ocfs2/dlmglue.c
++++ b/fs/ocfs2/dlmglue.c
+@@ -3968,9 +3968,13 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb)
+ osb->dc_work_sequence = osb->dc_wake_sequence;
+
+ processed = osb->blocked_lock_count;
+- while (processed) {
+- BUG_ON(list_empty(&osb->blocked_lock_list));
+-
++ /*
++ * blocked lock processing in this loop might call iput which can
++ * remove items off osb->blocked_lock_list. Downconvert up to
++ * 'processed' number of locks, but stop short if we had some
++ * removed in ocfs2_mark_lockres_freeing when downconverting.
++ */
++ while (processed && !list_empty(&osb->blocked_lock_list)) {
+ lockres = list_entry(osb->blocked_lock_list.next,
+ struct ocfs2_lock_res, l_blocked_list);
+ list_del_init(&lockres->l_blocked_list);
+diff --git a/fs/open.c b/fs/open.c
+index cf1d34fc5e69..703b0512a714 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -672,7 +672,6 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
+ f->f_path.dentry = dentry;
+ f->f_path.mnt = mnt;
+ f->f_pos = 0;
+- file_sb_list_add(f, inode->i_sb);
+
+ if (unlikely(f->f_mode & FMODE_PATH)) {
+ f->f_op = &empty_fops;
+@@ -730,7 +729,6 @@ cleanup_all:
+ mnt_drop_write(mnt);
+ }
+ }
+- file_sb_list_del(f);
+ f->f_path.dentry = NULL;
+ f->f_path.mnt = NULL;
+ cleanup_file:
+diff --git a/fs/super.c b/fs/super.c
+index d0154e52c76b..36fbe271fa41 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -122,22 +122,7 @@ static struct super_block *alloc_super(struct file_system_type *type)
+ s = NULL;
+ goto out;
+ }
+-#ifdef CONFIG_SMP
+- s->s_files = alloc_percpu(struct list_head);
+- if (!s->s_files) {
+- security_sb_free(s);
+- kfree(s);
+- s = NULL;
+- goto out;
+- } else {
+- int i;
+
+- for_each_possible_cpu(i)
+- INIT_LIST_HEAD(per_cpu_ptr(s->s_files, i));
+- }
+-#else
+- INIT_LIST_HEAD(&s->s_files);
+-#endif
+ s->s_bdi = &default_backing_dev_info;
+ INIT_HLIST_NODE(&s->s_instances);
+ INIT_HLIST_BL_HEAD(&s->s_anon);
+@@ -200,9 +185,6 @@ out:
+ */
+ static inline void destroy_super(struct super_block *s)
+ {
+-#ifdef CONFIG_SMP
+- free_percpu(s->s_files);
+-#endif
+ security_sb_free(s);
+ WARN_ON(!list_empty(&s->s_mounts));
+ kfree(s->s_subtype);
+@@ -744,7 +726,8 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
+ make sure there are no rw files opened */
+ if (remount_ro) {
+ if (force) {
+- mark_files_ro(sb);
++ sb->s_readonly_remount = 1;
++ smp_wmb();
+ } else {
+ retval = sb_prepare_remount_readonly(sb);
+ if (retval)
+diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
+index 458f497738a4..fed3f3ac489d 100644
+--- a/include/linux/buffer_head.h
++++ b/include/linux/buffer_head.h
+@@ -166,12 +166,13 @@ void __wait_on_buffer(struct buffer_head *);
+ wait_queue_head_t *bh_waitq_head(struct buffer_head *bh);
+ struct buffer_head *__find_get_block(struct block_device *bdev, sector_t block,
+ unsigned size);
+-struct buffer_head *__getblk(struct block_device *bdev, sector_t block,
+- unsigned size);
++struct buffer_head *__getblk_gfp(struct block_device *bdev, sector_t block,
++ unsigned size, gfp_t gfp);
+ void __brelse(struct buffer_head *);
+ void __bforget(struct buffer_head *);
+ void __breadahead(struct block_device *, sector_t block, unsigned int size);
+-struct buffer_head *__bread(struct block_device *, sector_t block, unsigned size);
++struct buffer_head *__bread_gfp(struct block_device *,
++ sector_t block, unsigned size, gfp_t gfp);
+ void invalidate_bh_lrus(void);
+ struct buffer_head *alloc_buffer_head(gfp_t gfp_flags);
+ void free_buffer_head(struct buffer_head * bh);
+@@ -286,7 +287,13 @@ static inline void bforget(struct buffer_head *bh)
+ static inline struct buffer_head *
+ sb_bread(struct super_block *sb, sector_t block)
+ {
+- return __bread(sb->s_bdev, block, sb->s_blocksize);
++ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
++}
++
++static inline struct buffer_head *
++sb_bread_unmovable(struct super_block *sb, sector_t block)
++{
++ return __bread_gfp(sb->s_bdev, block, sb->s_blocksize, 0);
+ }
+
+ static inline void
+@@ -298,7 +305,14 @@ sb_breadahead(struct super_block *sb, sector_t block)
+ static inline struct buffer_head *
+ sb_getblk(struct super_block *sb, sector_t block)
+ {
+- return __getblk(sb->s_bdev, block, sb->s_blocksize);
++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
++}
++
++
++static inline struct buffer_head *
++sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
++{
++ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
+ }
+
+ static inline struct buffer_head *
+@@ -335,6 +349,36 @@ static inline void lock_buffer(struct buffer_head *bh)
+ __lock_buffer(bh);
+ }
+
++static inline struct buffer_head *getblk_unmovable(struct block_device *bdev,
++ sector_t block,
++ unsigned size)
++{
++ return __getblk_gfp(bdev, block, size, 0);
++}
++
++static inline struct buffer_head *__getblk(struct block_device *bdev,
++ sector_t block,
++ unsigned size)
++{
++ return __getblk_gfp(bdev, block, size, __GFP_MOVABLE);
++}
++
++/**
++ * __bread() - reads a specified block and returns the bh
++ * @bdev: the block_device to read from
++ * @block: number of block
++ * @size: size (in bytes) to read
++ *
++ * Reads a specified block, and returns buffer head that contains it.
++ * The page cache is allocated from movable area so that it can be migrated.
++ * It returns NULL if the block was unreadable.
++ */
++static inline struct buffer_head *
++__bread(struct block_device *bdev, sector_t block, unsigned size)
++{
++ return __bread_gfp(bdev, block, size, __GFP_MOVABLE);
++}
++
+ extern int __set_page_dirty_buffers(struct page *page);
+
+ #else /* CONFIG_BLOCK */
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 210c347425e8..e7bbe996ab49 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -976,12 +976,7 @@ static inline int ra_has_index(struct file_ra_state *ra, pgoff_t index)
+ #define FILE_MNT_WRITE_RELEASED 2
+
+ struct file {
+- /*
+- * fu_list becomes invalid after file_free is called and queued via
+- * fu_rcuhead for RCU freeing
+- */
+ union {
+- struct list_head fu_list;
+ struct rcu_head fu_rcuhead;
+ } f_u;
+ struct path f_path;
+@@ -994,9 +989,6 @@ struct file {
+ * Must not be taken from IRQ context.
+ */
+ spinlock_t f_lock;
+-#ifdef CONFIG_SMP
+- int f_sb_list_cpu;
+-#endif
+ atomic_long_t f_count;
+ unsigned int f_flags;
+ fmode_t f_mode;
+@@ -1443,11 +1435,6 @@ struct super_block {
+
+ struct list_head s_inodes; /* all inodes */
+ struct hlist_bl_head s_anon; /* anonymous dentries for (nfs) exporting */
+-#ifdef CONFIG_SMP
+- struct list_head __percpu *s_files;
+-#else
+- struct list_head s_files;
+-#endif
+ struct list_head s_mounts; /* list of mounts; _not_ for fs use */
+ /* s_dentry_lru, s_nr_dentry_unused protected by dcache.c lru locks */
+ struct list_head s_dentry_lru; /* unused dentry lru */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 35e7f71cd8a5..9736dbe329e6 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -402,6 +402,8 @@ enum {
+ ATA_HORKAGE_BROKEN_FPDMA_AA = (1 << 15), /* skip AA */
+ ATA_HORKAGE_DUMP_ID = (1 << 16), /* dump IDENTIFY data */
+ ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17), /* Set max sects to 65535 */
++ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
++
+
+ /* DMA mask for user DMA control: User visible values; DO NOT
+ renumber */
+diff --git a/include/net/af_unix.h b/include/net/af_unix.h
+index ca68e2cef230..d29a576e4a16 100644
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -60,6 +60,7 @@ struct unix_sock {
+ unsigned int gc_maybe_cycle : 1;
+ unsigned char recursion_level;
+ struct socket_wq peer_wq;
++ wait_queue_t peer_wake;
+ };
+ #define unix_sk(__sk) ((struct unix_sock *)__sk)
+
+diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
+index 0ae759a6c76e..49c4cfe810d2 100644
+--- a/include/net/ip6_fib.h
++++ b/include/net/ip6_fib.h
+@@ -266,7 +266,7 @@ extern void inet6_rt_notify(int event, struct rt6_info *rt,
+ struct nl_info *info);
+
+ extern void fib6_run_gc(unsigned long expires,
+- struct net *net);
++ struct net *net, bool force);
+
+ extern void fib6_gc_cleanup(void);
+
+diff --git a/include/net/sock.h b/include/net/sock.h
+index f673ba5b6b1a..ddc3737b537e 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -329,6 +329,7 @@ struct sock {
+ sk_userlocks : 4,
+ sk_protocol : 8,
+ sk_type : 16;
++#define SK_PROTOCOL_MAX ((u8)~0U)
+ kmemcheck_bitfield_end(flags);
+ int sk_wmem_queued;
+ gfp_t sk_allocation;
+diff --git a/include/sound/tlv.h b/include/sound/tlv.h
+index 7067e2dfb0b9..49e7bd68c153 100644
+--- a/include/sound/tlv.h
++++ b/include/sound/tlv.h
+@@ -38,21 +38,26 @@
+ #define SNDRV_CTL_TLVT_DB_MINMAX 4 /* dB scale with min/max */
+ #define SNDRV_CTL_TLVT_DB_MINMAX_MUTE 5 /* dB scale with min/max with mute */
+
++#define TLV_ITEM(type, ...) \
++ (type), TLV_LENGTH(__VA_ARGS__), __VA_ARGS__
++#define TLV_LENGTH(...) \
++ ((unsigned int)sizeof((const unsigned int[]) { __VA_ARGS__ }))
++
+ #define TLV_DB_SCALE_MASK 0xffff
+ #define TLV_DB_SCALE_MUTE 0x10000
+ #define TLV_DB_SCALE_ITEM(min, step, mute) \
+- SNDRV_CTL_TLVT_DB_SCALE, 2 * sizeof(unsigned int), \
+- (min), ((step) & TLV_DB_SCALE_MASK) | ((mute) ? TLV_DB_SCALE_MUTE : 0)
++ TLV_ITEM(SNDRV_CTL_TLVT_DB_SCALE, \
++ (min), \
++ ((step) & TLV_DB_SCALE_MASK) | \
++ ((mute) ? TLV_DB_SCALE_MUTE : 0))
+ #define DECLARE_TLV_DB_SCALE(name, min, step, mute) \
+ unsigned int name[] = { TLV_DB_SCALE_ITEM(min, step, mute) }
+
+ /* dB scale specified with min/max values instead of step */
+ #define TLV_DB_MINMAX_ITEM(min_dB, max_dB) \
+- SNDRV_CTL_TLVT_DB_MINMAX, 2 * sizeof(unsigned int), \
+- (min_dB), (max_dB)
++ TLV_ITEM(SNDRV_CTL_TLVT_DB_MINMAX, (min_dB), (max_dB))
+ #define TLV_DB_MINMAX_MUTE_ITEM(min_dB, max_dB) \
+- SNDRV_CTL_TLVT_DB_MINMAX_MUTE, 2 * sizeof(unsigned int), \
+- (min_dB), (max_dB)
++ TLV_ITEM(SNDRV_CTL_TLVT_DB_MINMAX_MUTE, (min_dB), (max_dB))
+ #define DECLARE_TLV_DB_MINMAX(name, min_dB, max_dB) \
+ unsigned int name[] = { TLV_DB_MINMAX_ITEM(min_dB, max_dB) }
+ #define DECLARE_TLV_DB_MINMAX_MUTE(name, min_dB, max_dB) \
+@@ -60,13 +65,16 @@
+
+ /* linear volume between min_dB and max_dB (.01dB unit) */
+ #define TLV_DB_LINEAR_ITEM(min_dB, max_dB) \
+- SNDRV_CTL_TLVT_DB_LINEAR, 2 * sizeof(unsigned int), \
+- (min_dB), (max_dB)
++ TLV_ITEM(SNDRV_CTL_TLVT_DB_LINEAR, (min_dB), (max_dB))
+ #define DECLARE_TLV_DB_LINEAR(name, min_dB, max_dB) \
+ unsigned int name[] = { TLV_DB_LINEAR_ITEM(min_dB, max_dB) }
+
+ /* dB range container */
+ /* Each item is: <min> <max> <TLV> */
++#define TLV_DB_RANGE_ITEM(...) \
++ TLV_ITEM(SNDRV_CTL_TLVT_DB_RANGE, __VA_ARGS__)
++#define DECLARE_TLV_DB_RANGE(name, ...) \
++ unsigned int name[] = { TLV_DB_RANGE_ITEM(__VA_ARGS__) }
+ /* The below assumes that each item TLV is 4 words like DB_SCALE or LINEAR */
+ #define TLV_DB_RANGE_HEAD(num) \
+ SNDRV_CTL_TLVT_DB_RANGE, 6 * (num) * sizeof(unsigned int)
+diff --git a/ipc/msg.c b/ipc/msg.c
+index 25f1a6139584..391e3e0a44b5 100644
+--- a/ipc/msg.c
++++ b/ipc/msg.c
+@@ -198,6 +198,15 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
+ return retval;
+ }
+
++ msq->q_stime = msq->q_rtime = 0;
++ msq->q_ctime = get_seconds();
++ msq->q_cbytes = msq->q_qnum = 0;
++ msq->q_qbytes = ns->msg_ctlmnb;
++ msq->q_lspid = msq->q_lrpid = 0;
++ INIT_LIST_HEAD(&msq->q_messages);
++ INIT_LIST_HEAD(&msq->q_receivers);
++ INIT_LIST_HEAD(&msq->q_senders);
++
+ /*
+ * ipc_addid() locks msq
+ */
+@@ -208,15 +217,6 @@ static int newque(struct ipc_namespace *ns, struct ipc_params *params)
+ return id;
+ }
+
+- msq->q_stime = msq->q_rtime = 0;
+- msq->q_ctime = get_seconds();
+- msq->q_cbytes = msq->q_qnum = 0;
+- msq->q_qbytes = ns->msg_ctlmnb;
+- msq->q_lspid = msq->q_lrpid = 0;
+- INIT_LIST_HEAD(&msq->q_messages);
+- INIT_LIST_HEAD(&msq->q_receivers);
+- INIT_LIST_HEAD(&msq->q_senders);
+-
+ msg_unlock(msq);
+
+ return msq->q_perm.id;
+diff --git a/ipc/sem.c b/ipc/sem.c
+index 5215a81420df..67f2110c8a80 100644
+--- a/ipc/sem.c
++++ b/ipc/sem.c
+@@ -1606,16 +1606,27 @@ void exit_sem(struct task_struct *tsk)
+ rcu_read_lock();
+ un = list_entry_rcu(ulp->list_proc.next,
+ struct sem_undo, list_proc);
+- if (&un->list_proc == &ulp->list_proc)
+- semid = -1;
+- else
+- semid = un->semid;
++ if (&un->list_proc == &ulp->list_proc) {
++ /*
++ * We must wait for freeary() before freeing this ulp,
++ * in case we raced with last sem_undo. There is a small
++ * possibility where we exit while freeary() didn't
++ * finish unlocking sem_undo_list.
++ */
++ spin_unlock_wait(&ulp->lock);
++ rcu_read_unlock();
++ break;
++ }
++ spin_lock(&ulp->lock);
++ semid = un->semid;
++ spin_unlock(&ulp->lock);
+ rcu_read_unlock();
+
++ /* exit_sem raced with IPC_RMID, nothing to do */
+ if (semid == -1)
+- break;
++ continue;
+
+- sma = sem_lock_check(tsk->nsproxy->ipc_ns, un->semid);
++ sma = sem_lock_check(tsk->nsproxy->ipc_ns, semid);
+
+ /* exit_sem raced with IPC_RMID, nothing to do */
+ if (IS_ERR(sma))
+diff --git a/ipc/shm.c b/ipc/shm.c
+index a02ef5781ce9..634b0ba15f49 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -500,12 +500,6 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ if (IS_ERR(file))
+ goto no_file;
+
+- id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
+- if (id < 0) {
+- error = id;
+- goto no_id;
+- }
+-
+ shp->shm_cprid = task_tgid_vnr(current);
+ shp->shm_lprid = 0;
+ shp->shm_atim = shp->shm_dtim = 0;
+@@ -514,6 +508,13 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ shp->shm_nattch = 0;
+ shp->shm_file = file;
+ shp->shm_creator = current;
++
++ id = ipc_addid(&shm_ids(ns), &shp->shm_perm, ns->shm_ctlmni);
++ if (id < 0) {
++ error = id;
++ goto no_id;
++ }
++
+ /*
+ * shmid gets reported as "inode#" in /proc/pid/maps.
+ * proc-ps tools use this. Changing this will break them.
+diff --git a/ipc/util.c b/ipc/util.c
+index 75261a31d48d..e4c937703ade 100644
+--- a/ipc/util.c
++++ b/ipc/util.c
+@@ -264,6 +264,10 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
+ rcu_read_lock();
+ spin_lock(&new->lock);
+
++ current_euid_egid(&euid, &egid);
++ new->cuid = new->uid = euid;
++ new->gid = new->cgid = egid;
++
+ err = idr_get_new(&ids->ipcs_idr, new, &id);
+ if (err) {
+ spin_unlock(&new->lock);
+@@ -273,10 +277,6 @@ int ipc_addid(struct ipc_ids* ids, struct kern_ipc_perm* new, int size)
+
+ ids->in_use++;
+
+- current_euid_egid(&euid, &egid);
+- new->cuid = new->uid = euid;
+- new->gid = new->cgid = egid;
+-
+ new->seq = ids->seq++;
+ if(ids->seq > ids->seq_max)
+ ids->seq = 0;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 461b6e0007b1..2e6c24843eb6 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3863,12 +3863,20 @@ static const struct file_operations perf_fops = {
+ * to user-space before waking everybody up.
+ */
+
++static inline struct fasync_struct **perf_event_fasync(struct perf_event *event)
++{
++ /* only the parent has fasync state */
++ if (event->parent)
++ event = event->parent;
++ return &event->fasync;
++}
++
+ void perf_event_wakeup(struct perf_event *event)
+ {
+ ring_buffer_wakeup(event);
+
+ if (event->pending_kill) {
+- kill_fasync(&event->fasync, SIGIO, event->pending_kill);
++ kill_fasync(perf_event_fasync(event), SIGIO, event->pending_kill);
+ event->pending_kill = 0;
+ }
+ }
+@@ -4879,7 +4887,7 @@ static int __perf_event_overflow(struct perf_event *event,
+ else
+ perf_event_output(event, data, regs);
+
+- if (event->fasync && event->pending_kill) {
++ if (*perf_event_fasync(event) && event->pending_kill) {
+ event->pending_wakeup = 1;
+ irq_work_queue(&event->pending);
+ }
+diff --git a/kernel/watchdog.c b/kernel/watchdog.c
+index 991aa9381a44..8304c87cfcd9 100644
+--- a/kernel/watchdog.c
++++ b/kernel/watchdog.c
+@@ -154,14 +154,14 @@ void touch_all_softlockup_watchdogs(void)
+ #ifdef CONFIG_HARDLOCKUP_DETECTOR
+ void touch_nmi_watchdog(void)
+ {
+- if (watchdog_enabled) {
+- unsigned cpu;
+-
+- for_each_present_cpu(cpu) {
+- if (per_cpu(watchdog_nmi_touch, cpu) != true)
+- per_cpu(watchdog_nmi_touch, cpu) = true;
+- }
+- }
++ /*
++ * Using __raw here because some code paths have
++ * preemption enabled. If preemption is enabled
++ * then interrupts should be enabled too, in which
++ * case we shouldn't have to worry about the watchdog
++ * going off.
++ */
++ __raw_get_cpu_var(watchdog_nmi_touch) = true;
+ touch_softlockup_watchdog();
+ }
+ EXPORT_SYMBOL(touch_nmi_watchdog);
+diff --git a/mm/memory.c b/mm/memory.c
+index 02aef93416f2..4774579d8acb 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3173,6 +3173,14 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ pte_unmap(page_table);
+
++ /* File mapping without ->vm_ops ? */
++ if (vma->vm_flags & VM_SHARED)
++ return VM_FAULT_SIGBUS;
++
++ /* File mapping without ->vm_ops ? */
++ if (vma->vm_flags & VM_SHARED)
++ return VM_FAULT_SIGBUS;
++
+ /* Check if we need to add a guard page to the stack */
+ if (check_stack_guard_page(vma, address) < 0)
+ return VM_FAULT_SIGSEGV;
+@@ -3432,6 +3440,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+
+ pte_unmap(page_table);
++ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
++ if (!vma->vm_ops->fault)
++ return VM_FAULT_SIGBUS;
+ return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
+ }
+
+@@ -3490,11 +3501,9 @@ int handle_pte_fault(struct mm_struct *mm,
+ entry = *pte;
+ if (!pte_present(entry)) {
+ if (pte_none(entry)) {
+- if (vma->vm_ops) {
+- if (likely(vma->vm_ops->fault))
+- return do_linear_fault(mm, vma, address,
++ if (vma->vm_ops)
++ return do_linear_fault(mm, vma, address,
+ pte, pmd, flags, entry);
+- }
+ return do_anonymous_page(mm, vma, address,
+ pte, pmd, flags);
+ }
+diff --git a/net/atm/clip.c b/net/atm/clip.c
+index 8ae3a7879335..e55e664faca8 100644
+--- a/net/atm/clip.c
++++ b/net/atm/clip.c
+@@ -317,6 +317,9 @@ static int clip_constructor(struct neighbour *neigh)
+
+ static int clip_encap(struct atm_vcc *vcc, int mode)
+ {
++ if (!CLIP_VCC(vcc))
++ return -EBADFD;
++
+ CLIP_VCC(vcc)->encap = mode;
+ return 0;
+ }
+diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
+index ca1820cf22f2..f59c8af13e57 100644
+--- a/net/ax25/af_ax25.c
++++ b/net/ax25/af_ax25.c
+@@ -811,6 +811,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
+ struct sock *sk;
+ ax25_cb *ax25;
+
++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
++ return -EINVAL;
++
+ if (!net_eq(net, &init_net))
+ return -EAFNOSUPPORT;
+
+diff --git a/net/core/datagram.c b/net/core/datagram.c
+index da7e0c867cc0..ba96ad93d136 100644
+--- a/net/core/datagram.c
++++ b/net/core/datagram.c
+@@ -127,6 +127,35 @@ out_noerr:
+ goto out;
+ }
+
++static int skb_set_peeked(struct sk_buff *skb)
++{
++ struct sk_buff *nskb;
++
++ if (skb->peeked)
++ return 0;
++
++ /* We have to unshare an skb before modifying it. */
++ if (!skb_shared(skb))
++ goto done;
++
++ nskb = skb_clone(skb, GFP_ATOMIC);
++ if (!nskb)
++ return -ENOMEM;
++
++ skb->prev->next = nskb;
++ skb->next->prev = nskb;
++ nskb->prev = skb->prev;
++ nskb->next = skb->next;
++
++ consume_skb(skb);
++ skb = nskb;
++
++done:
++ skb->peeked = 1;
++
++ return 0;
++}
++
+ /**
+ * __skb_recv_datagram - Receive a datagram skbuff
+ * @sk: socket
+@@ -161,7 +190,9 @@ out_noerr:
+ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
+ int *peeked, int *off, int *err)
+ {
++ struct sk_buff_head *queue = &sk->sk_receive_queue;
+ struct sk_buff *skb;
++ unsigned long cpu_flags;
+ long timeo;
+ /*
+ * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
+@@ -180,8 +211,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
+ * Look at current nfs client by the way...
+ * However, this function was correct in any case. 8)
+ */
+- unsigned long cpu_flags;
+- struct sk_buff_head *queue = &sk->sk_receive_queue;
+
+ spin_lock_irqsave(&queue->lock, cpu_flags);
+ skb_queue_walk(queue, skb) {
+@@ -191,7 +220,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
+ *off -= skb->len;
+ continue;
+ }
+- skb->peeked = 1;
++
++ error = skb_set_peeked(skb);
++ if (error)
++ goto unlock_err;
++
+ atomic_inc(&skb->users);
+ } else
+ __skb_unlink(skb, queue);
+@@ -210,6 +243,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned flags,
+
+ return NULL;
+
++unlock_err:
++ spin_unlock_irqrestore(&queue->lock, cpu_flags);
+ no_packet:
+ *err = error;
+ return NULL;
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 901495216f85..4f679bf4f12e 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2880,6 +2880,8 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu,
+ local_irq_save(flags);
+
+ rps_lock(sd);
++ if (!netif_running(skb->dev))
++ goto drop;
+ if (skb_queue_len(&sd->input_pkt_queue) <= netdev_max_backlog) {
+ if (skb_queue_len(&sd->input_pkt_queue)) {
+ enqueue:
+@@ -2900,6 +2902,7 @@ enqueue:
+ goto enqueue;
+ }
+
++drop:
+ sd->dropped++;
+ rps_unlock(sd);
+
+@@ -3188,8 +3191,6 @@ static int __netif_receive_skb(struct sk_buff *skb)
+
+ pt_prev = NULL;
+
+- rcu_read_lock();
+-
+ another_round:
+
+ __this_cpu_inc(softnet_data.processed);
+@@ -3284,7 +3285,6 @@ ncls:
+ }
+
+ out:
+- rcu_read_unlock();
+ return ret;
+ }
+
+@@ -3305,29 +3305,30 @@ out:
+ */
+ int netif_receive_skb(struct sk_buff *skb)
+ {
++ int ret;
++
+ net_timestamp_check(netdev_tstamp_prequeue, skb);
+
+ if (skb_defer_rx_timestamp(skb))
+ return NET_RX_SUCCESS;
+
++ rcu_read_lock();
++
+ #ifdef CONFIG_RPS
+ if (static_key_false(&rps_needed)) {
+ struct rps_dev_flow voidflow, *rflow = &voidflow;
+- int cpu, ret;
+-
+- rcu_read_lock();
+-
+- cpu = get_rps_cpu(skb->dev, skb, &rflow);
++ int cpu = get_rps_cpu(skb->dev, skb, &rflow);
+
+ if (cpu >= 0) {
+ ret = enqueue_to_backlog(skb, cpu, &rflow->last_qtail);
+ rcu_read_unlock();
+ return ret;
+ }
+- rcu_read_unlock();
+ }
+ #endif
+- return __netif_receive_skb(skb);
++ ret = __netif_receive_skb(skb);
++ rcu_read_unlock();
++ return ret;
+ }
+ EXPORT_SYMBOL(netif_receive_skb);
+
+@@ -3718,8 +3719,10 @@ static int process_backlog(struct napi_struct *napi, int quota)
+ unsigned int qlen;
+
+ while ((skb = __skb_dequeue(&sd->process_queue))) {
++ rcu_read_lock();
+ local_irq_enable();
+ __netif_receive_skb(skb);
++ rcu_read_unlock();
+ local_irq_disable();
+ input_queue_head_incr(sd);
+ if (++work >= quota) {
+@@ -5228,6 +5231,7 @@ static void rollback_registered_many(struct list_head *head)
+ unlist_netdevice(dev);
+
+ dev->reg_state = NETREG_UNREGISTERING;
++ on_each_cpu(flush_backlog, dev, 1);
+ }
+
+ synchronize_net();
+@@ -5791,8 +5795,6 @@ void netdev_run_todo(void)
+
+ dev->reg_state = NETREG_UNREGISTERED;
+
+- on_each_cpu(flush_backlog, dev, 1);
+-
+ netdev_wait_allrefs(dev);
+
+ /* paranoia */
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 43c6dd8da602..8941e962a3f9 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1139,10 +1139,6 @@ static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = {
+ [IFLA_INFO_DATA] = { .type = NLA_NESTED },
+ };
+
+-static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
+- [IFLA_VF_INFO] = { .type = NLA_NESTED },
+-};
+-
+ static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
+ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
+@@ -1216,58 +1212,53 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
+ return 0;
+ }
+
+-static int do_setvfinfo(struct net_device *dev, struct nlattr *attr)
++static int do_setvfinfo(struct net_device *dev, struct nlattr **tb)
+ {
+- int rem, err = -EINVAL;
+- struct nlattr *vf;
+ const struct net_device_ops *ops = dev->netdev_ops;
++ int err = -EINVAL;
+
+- nla_for_each_nested(vf, attr, rem) {
+- switch (nla_type(vf)) {
+- case IFLA_VF_MAC: {
+- struct ifla_vf_mac *ivm;
+- ivm = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_mac)
+- err = ops->ndo_set_vf_mac(dev, ivm->vf,
+- ivm->mac);
+- break;
+- }
+- case IFLA_VF_VLAN: {
+- struct ifla_vf_vlan *ivv;
+- ivv = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_vlan)
+- err = ops->ndo_set_vf_vlan(dev, ivv->vf,
+- ivv->vlan,
+- ivv->qos);
+- break;
+- }
+- case IFLA_VF_TX_RATE: {
+- struct ifla_vf_tx_rate *ivt;
+- ivt = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_tx_rate)
+- err = ops->ndo_set_vf_tx_rate(dev, ivt->vf,
+- ivt->rate);
+- break;
+- }
+- case IFLA_VF_SPOOFCHK: {
+- struct ifla_vf_spoofchk *ivs;
+- ivs = nla_data(vf);
+- err = -EOPNOTSUPP;
+- if (ops->ndo_set_vf_spoofchk)
+- err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
+- ivs->setting);
+- break;
+- }
+- default:
+- err = -EINVAL;
+- break;
+- }
+- if (err)
+- break;
++ if (tb[IFLA_VF_MAC]) {
++ struct ifla_vf_mac *ivm = nla_data(tb[IFLA_VF_MAC]);
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_mac)
++ err = ops->ndo_set_vf_mac(dev, ivm->vf,
++ ivm->mac);
++ if (err < 0)
++ return err;
+ }
++
++ if (tb[IFLA_VF_VLAN]) {
++ struct ifla_vf_vlan *ivv = nla_data(tb[IFLA_VF_VLAN]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_vlan)
++ err = ops->ndo_set_vf_vlan(dev, ivv->vf, ivv->vlan,
++ ivv->qos);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_TX_RATE]) {
++ struct ifla_vf_tx_rate *ivt = nla_data(tb[IFLA_VF_TX_RATE]);
++
++ if (ops->ndo_set_vf_tx_rate)
++ err = ops->ndo_set_vf_tx_rate(dev, ivt->vf,
++ ivt->rate);
++ if (err < 0)
++ return err;
++ }
++
++ if (tb[IFLA_VF_SPOOFCHK]) {
++ struct ifla_vf_spoofchk *ivs = nla_data(tb[IFLA_VF_SPOOFCHK]);
++
++ err = -EOPNOTSUPP;
++ if (ops->ndo_set_vf_spoofchk)
++ err = ops->ndo_set_vf_spoofchk(dev, ivs->vf,
++ ivs->setting);
++ if (err < 0)
++ return err;
++ }
++
+ return err;
+ }
+
+@@ -1450,14 +1441,21 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
+ }
+
+ if (tb[IFLA_VFINFO_LIST]) {
++ struct nlattr *vfinfo[IFLA_VF_MAX + 1];
+ struct nlattr *attr;
+ int rem;
++
+ nla_for_each_nested(attr, tb[IFLA_VFINFO_LIST], rem) {
+- if (nla_type(attr) != IFLA_VF_INFO) {
++ if (nla_type(attr) != IFLA_VF_INFO ||
++ nla_len(attr) < NLA_HDRLEN) {
+ err = -EINVAL;
+ goto errout;
+ }
+- err = do_setvfinfo(dev, attr);
++ err = nla_parse_nested(vfinfo, IFLA_VF_MAX, attr,
++ ifla_vf_policy);
++ if (err < 0)
++ goto errout;
++ err = do_setvfinfo(dev, vfinfo);
+ if (err < 0)
+ goto errout;
+ modified = 1;
+diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
+index 77d1550b19fd..c04daddc4491 100644
+--- a/net/core/sysctl_net_core.c
++++ b/net/core/sysctl_net_core.c
+@@ -22,6 +22,8 @@
+ static int zero = 0;
+ static int ushort_max = USHRT_MAX;
+
++static int one = 1;
++
+ #ifdef CONFIG_RPS
+ static int rps_sock_flow_sysctl(ctl_table *table, int write,
+ void __user *buffer, size_t *lenp, loff_t *ppos)
+@@ -94,28 +96,32 @@ static struct ctl_table net_core_table[] = {
+ .data = &sysctl_wmem_max,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "rmem_max",
+ .data = &sysctl_rmem_max,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "wmem_default",
+ .data = &sysctl_wmem_default,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "rmem_default",
+ .data = &sysctl_rmem_default,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "dev_weight",
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index 4136987d94da..4fa941ea4d64 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -680,6 +680,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol,
+ {
+ struct sock *sk;
+
++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
++ return -EINVAL;
++
+ if (!net_eq(net, &init_net))
+ return -EAFNOSUPPORT;
+
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index 78ec298001c8..0a828e25b585 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -284,6 +284,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
+ if (sock->type != SOCK_RAW && sock->type != SOCK_DGRAM)
+ build_ehash_secret();
+
++ if (protocol < 0 || protocol >= IPPROTO_MAX)
++ return -EINVAL;
++
+ sock->state = SS_UNCONNECTED;
+
+ /* Look for the requested type/protocol pair. */
+diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
+index 4a40457d8d14..f4597939b9e9 100644
+--- a/net/ipv4/ip_fragment.c
++++ b/net/ipv4/ip_fragment.c
+@@ -384,7 +384,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ ihl = ip_hdrlen(skb);
+
+ /* Determine the position of this fragment. */
+- end = offset + skb->len - ihl;
++ end = offset + skb->len - skb_network_offset(skb) - ihl;
+ err = -EINVAL;
+
+ /* Is this the final fragment? */
+@@ -414,7 +414,7 @@ static int ip_frag_queue(struct ipq *qp, struct sk_buff *skb)
+ goto err;
+
+ err = -ENOMEM;
+- if (pskb_pull(skb, ihl) == NULL)
++ if (!pskb_pull(skb, skb_network_offset(skb) + ihl))
+ goto err;
+
+ err = pskb_trim_rcsum(skb, end - offset);
+@@ -637,6 +637,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
+ iph->frag_off = 0;
+ iph->tot_len = htons(len);
+ iph->tos |= ecn;
++ ip_send_check(iph);
++
+ IP_INC_STATS_BH(net, IPSTATS_MIB_REASMOKS);
+ qp->q.fragments = NULL;
+ qp->q.fragments_tail = NULL;
+diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
+index 086c97327b9b..009e36d2ba95 100644
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -27,6 +27,7 @@
+ #include <net/tcp_memcontrol.h>
+
+ static int zero;
++static int one = 1;
+ static int tcp_retr1_max = 255;
+ static int ip_local_port_range_min[] = { 1, 1 };
+ static int ip_local_port_range_max[] = { 65535, 65535 };
+@@ -486,14 +487,16 @@ static struct ctl_table ipv4_table[] = {
+ .data = &sysctl_tcp_wmem,
+ .maxlen = sizeof(sysctl_tcp_wmem),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "tcp_rmem",
+ .data = &sysctl_tcp_rmem,
+ .maxlen = sizeof(sysctl_tcp_rmem),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &one,
+ },
+ {
+ .procname = "tcp_app_win",
+@@ -700,7 +703,7 @@ static struct ctl_table ipv4_table[] = {
+ .maxlen = sizeof(sysctl_udp_rmem_min),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &zero
++ .extra1 = &one
+ },
+ {
+ .procname = "udp_wmem_min",
+@@ -708,7 +711,7 @@ static struct ctl_table ipv4_table[] = {
+ .maxlen = sizeof(sysctl_udp_wmem_min),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+- .extra1 = &zero
++ .extra1 = &one
+ },
+ { }
+ };
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index be5876079a8e..b6c236bd2326 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4340,6 +4340,21 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
+ return ret;
+ }
+
++static
++int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ struct inet6_dev *idev = ctl->extra1;
++ int min_mtu = IPV6_MIN_MTU;
++ struct ctl_table lctl;
++
++ lctl = *ctl;
++ lctl.extra1 = &min_mtu;
++ lctl.extra2 = idev ? &idev->dev->mtu : NULL;
++
++ return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
++}
++
+ static void dev_disable_change(struct inet6_dev *idev)
+ {
+ if (!idev || !idev->dev)
+@@ -4449,7 +4464,7 @@ static struct addrconf_sysctl_table
+ .data = &ipv6_devconf.mtu6,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = addrconf_sysctl_mtu,
+ },
+ {
+ .procname = "accept_ra",
+diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
+index 8ed1b930e75f..5300ef35fd41 100644
+--- a/net/ipv6/af_inet6.c
++++ b/net/ipv6/af_inet6.c
+@@ -113,6 +113,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
+ !inet_ehash_secret)
+ build_ehash_secret();
+
++ if (protocol < 0 || protocol >= IPPROTO_MAX)
++ return -EINVAL;
++
+ /* Look for the requested type/protocol pair. */
+ lookup_protocol:
+ err = -ESOCKTNOSUPPORT;
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 2cfcfb7efa91..fc5ce6e9dc6f 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1593,19 +1593,16 @@ static int fib6_age(struct rt6_info *rt, void *arg)
+
+ static DEFINE_SPINLOCK(fib6_gc_lock);
+
+-void fib6_run_gc(unsigned long expires, struct net *net)
++void fib6_run_gc(unsigned long expires, struct net *net, bool force)
+ {
+- if (expires != ~0UL) {
++ if (force) {
+ spin_lock_bh(&fib6_gc_lock);
+- gc_args.timeout = expires ? (int)expires :
+- net->ipv6.sysctl.ip6_rt_gc_interval;
+- } else {
+- if (!spin_trylock_bh(&fib6_gc_lock)) {
+- mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
+- return;
+- }
+- gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
++ } else if (!spin_trylock_bh(&fib6_gc_lock)) {
++ mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
++ return;
+ }
++ gc_args.timeout = expires ? (int)expires :
++ net->ipv6.sysctl.ip6_rt_gc_interval;
+
+ gc_args.more = icmp6_dst_gc();
+
+@@ -1622,7 +1619,7 @@ void fib6_run_gc(unsigned long expires, struct net *net)
+
+ static void fib6_gc_timer_cb(unsigned long arg)
+ {
+- fib6_run_gc(0, (struct net *)arg);
++ fib6_run_gc(0, (struct net *)arg, true);
+ }
+
+ static int __net_init fib6_net_init(struct net *net)
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
+index 5cc78e6930b5..e235b4c2b1be 100644
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -1737,11 +1737,11 @@ static int ndisc_netdev_event(struct notifier_block *this, unsigned long event,
+ switch (event) {
+ case NETDEV_CHANGEADDR:
+ neigh_changeaddr(&nd_tbl, dev);
+- fib6_run_gc(~0UL, net);
++ fib6_run_gc(0, net, false);
+ break;
+ case NETDEV_DOWN:
+ neigh_ifdown(&nd_tbl, dev);
+- fib6_run_gc(~0UL, net);
++ fib6_run_gc(0, net, false);
+ break;
+ case NETDEV_NOTIFY_PEERS:
+ ndisc_send_unsol_na(dev);
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 23b33048ea98..7ab7f8a5ee4f 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -404,6 +404,24 @@ out:
+ }
+
+ #ifdef CONFIG_IPV6_ROUTER_PREF
++struct __rt6_probe_work {
++ struct work_struct work;
++ struct in6_addr target;
++ struct net_device *dev;
++};
++
++static void rt6_probe_deferred(struct work_struct *w)
++{
++ struct in6_addr mcaddr;
++ struct __rt6_probe_work *work =
++ container_of(w, struct __rt6_probe_work, work);
++
++ addrconf_addr_solict_mult(&work->target, &mcaddr);
++ ndisc_send_ns(work->dev, NULL, &work->target, &mcaddr, NULL);
++ dev_put(work->dev);
++ kfree(w);
++}
++
+ static void rt6_probe(struct rt6_info *rt)
+ {
+ struct neighbour *neigh;
+@@ -422,15 +440,22 @@ static void rt6_probe(struct rt6_info *rt)
+ read_lock_bh(&neigh->lock);
+ if (!(neigh->nud_state & NUD_VALID) &&
+ time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
+- struct in6_addr mcaddr;
+- struct in6_addr *target;
++ struct __rt6_probe_work *work;
++
++ work = kmalloc(sizeof(*work), GFP_ATOMIC);
++
++ if (work)
++ neigh->updated = jiffies;
+
+- neigh->updated = jiffies;
+ read_unlock_bh(&neigh->lock);
+
+- target = (struct in6_addr *)&neigh->primary_key;
+- addrconf_addr_solict_mult(target, &mcaddr);
+- ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
++ if (work) {
++ INIT_WORK(&work->work, rt6_probe_deferred);
++ work->target = rt->rt6i_gateway;
++ dev_hold(rt->dst.dev);
++ work->dev = rt->dst.dev;
++ schedule_work(&work->work);
++ }
+ } else {
+ read_unlock_bh(&neigh->lock);
+ }
+@@ -1220,7 +1245,7 @@ static int ip6_dst_gc(struct dst_ops *ops)
+ goto out;
+
+ net->ipv6.ip6_rt_gc_expire++;
+- fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net);
++ fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
+ net->ipv6.ip6_rt_last_gc = now;
+ entries = dst_entries_get_slow(ops);
+ if (entries < ops->gc_thresh)
+@@ -2815,7 +2840,7 @@ int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
+ net = (struct net *)ctl->extra1;
+ delay = net->ipv6.sysctl.flush_delay;
+ proc_dointvec(ctl, write, buffer, lenp, ppos);
+- fib6_run_gc(delay <= 0 ? ~0UL : (unsigned long)delay, net);
++ fib6_run_gc(delay <= 0 ? 0 : (unsigned long)delay, net, delay > 0);
+ return 0;
+ }
+
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index 12218f705315..3eaf4fe85fd5 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -1106,6 +1106,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol,
+
+ IRDA_DEBUG(2, "%s()\n", __func__);
+
++ if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
++ return -EINVAL;
++
+ if (net != &init_net)
+ return -EAFNOSUPPORT;
+
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index d5cd43920ccb..eb6ce3b8a8cb 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -220,7 +220,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
+ #define BROADCAST_ONE 1
+ #define BROADCAST_REGISTERED 2
+ #define BROADCAST_PROMISC_ONLY 4
+-static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
++static int pfkey_broadcast(struct sk_buff *skb,
+ int broadcast_flags, struct sock *one_sk,
+ struct net *net)
+ {
+@@ -246,7 +246,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ * socket.
+ */
+ if (pfk->promisc)
+- pfkey_broadcast_one(skb, &skb2, allocation, sk);
++ pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
+
+ /* the exact target will be processed later */
+ if (sk == one_sk)
+@@ -261,7 +261,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ continue;
+ }
+
+- err2 = pfkey_broadcast_one(skb, &skb2, allocation, sk);
++ err2 = pfkey_broadcast_one(skb, &skb2, GFP_ATOMIC, sk);
+
+ /* Error is cleare after succecful sending to at least one
+ * registered KM */
+@@ -271,7 +271,7 @@ static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ rcu_read_unlock();
+
+ if (one_sk != NULL)
+- err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
++ err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+
+ kfree_skb(skb2);
+ kfree_skb(skb);
+@@ -294,7 +294,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
+ hdr = (struct sadb_msg *) pfk->dump.skb->data;
+ hdr->sadb_msg_seq = 0;
+ hdr->sadb_msg_errno = rc;
+- pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
++ pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+ &pfk->sk, sock_net(&pfk->sk));
+ pfk->dump.skb = NULL;
+ }
+@@ -335,7 +335,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
+ sizeof(uint64_t));
+
+- pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
++ pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+
+ return 0;
+ }
+@@ -1361,7 +1361,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
+
+ xfrm_state_put(x);
+
+- pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
++ pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+
+ return 0;
+ }
+@@ -1449,7 +1449,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
+ hdr->sadb_msg_seq = c->seq;
+ hdr->sadb_msg_pid = c->pid;
+
+- pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
++ pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+
+ return 0;
+ }
+@@ -1566,7 +1566,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
+ out_hdr->sadb_msg_reserved = 0;
+ out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
+ out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
+- pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
++ pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+
+ return 0;
+ }
+@@ -1667,7 +1667,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
+ return -ENOBUFS;
+ }
+
+- pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk, sock_net(sk));
++ pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
+
+ return 0;
+ }
+@@ -1686,7 +1686,7 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
+ hdr->sadb_msg_errno = (uint8_t) 0;
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+
+- return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
++ return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+ }
+
+ static int key_notify_sa_flush(const struct km_event *c)
+@@ -1707,7 +1707,7 @@ static int key_notify_sa_flush(const struct km_event *c)
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ hdr->sadb_msg_reserved = 0;
+
+- pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
++ pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+
+ return 0;
+ }
+@@ -1768,7 +1768,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
+ out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
+
+ if (pfk->dump.skb)
+- pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
++ pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+ &pfk->sk, sock_net(&pfk->sk));
+ pfk->dump.skb = out_skb;
+
+@@ -1829,7 +1829,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
+ new_hdr->sadb_msg_errno = 0;
+ }
+
+- pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
++ pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+ return 0;
+ }
+
+@@ -2160,7 +2160,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
+ out_hdr->sadb_msg_errno = 0;
+ out_hdr->sadb_msg_seq = c->seq;
+ out_hdr->sadb_msg_pid = c->pid;
+- pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
++ pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+ return 0;
+
+ }
+@@ -2386,7 +2386,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
+ out_hdr->sadb_msg_errno = 0;
+ out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
+ out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
+- pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
++ pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+ err = 0;
+
+ out:
+@@ -2639,7 +2639,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
+ out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
+
+ if (pfk->dump.skb)
+- pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
++ pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+ &pfk->sk, sock_net(&pfk->sk));
+ pfk->dump.skb = out_skb;
+
+@@ -2690,7 +2690,7 @@ static int key_notify_policy_flush(const struct km_event *c)
+ hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
+ hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ hdr->sadb_msg_reserved = 0;
+- pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
++ pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+ return 0;
+
+ }
+@@ -2756,7 +2756,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
+ void *ext_hdrs[SADB_EXT_MAX];
+ int err;
+
+- pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
++ pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+ BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
+
+ memset(ext_hdrs, 0, sizeof(ext_hdrs));
+@@ -2962,7 +2962,7 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
+ out_hdr->sadb_msg_seq = 0;
+ out_hdr->sadb_msg_pid = 0;
+
+- pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
++ pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+ return 0;
+ }
+
+@@ -3134,7 +3134,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ xfrm_ctx->ctx_len);
+ }
+
+- return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
++ return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+ }
+
+ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
+@@ -3332,7 +3332,7 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
+ n_port->sadb_x_nat_t_port_port = sport;
+ n_port->sadb_x_nat_t_port_reserved = 0;
+
+- return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, xs_net(x));
++ return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+ }
+
+ #ifdef CONFIG_NET_KEY_MIGRATE
+@@ -3524,7 +3524,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ }
+
+ /* broadcast migrate message to sockets */
+- pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
++ pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+
+ return 0;
+
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index d5404cc0248d..fa4a68993858 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -700,6 +700,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+
+ debugfs_remove_recursive(sdata->debugfs.dir);
+ sdata->debugfs.dir = NULL;
++ sdata->debugfs.subdir_stations = NULL;
+ }
+
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
+index 9a171b2445b1..71935fc880cf 100644
+--- a/net/netfilter/nf_conntrack_core.c
++++ b/net/netfilter/nf_conntrack_core.c
+@@ -309,6 +309,21 @@ static void death_by_timeout(unsigned long ul_conntrack)
+ nf_ct_put(ct);
+ }
+
++static inline bool
++nf_ct_key_equal(struct nf_conntrack_tuple_hash *h,
++ const struct nf_conntrack_tuple *tuple,
++ u16 zone)
++{
++ struct nf_conn *ct = nf_ct_tuplehash_to_ctrack(h);
++
++ /* A conntrack can be recreated with the equal tuple,
++ * so we need to check that the conntrack is confirmed
++ */
++ return nf_ct_tuple_equal(tuple, &h->tuple) &&
++ nf_ct_zone(ct) == zone &&
++ nf_ct_is_confirmed(ct);
++}
++
+ /*
+ * Warning :
+ * - Caller must take a reference on returned object
+@@ -330,8 +345,7 @@ ____nf_conntrack_find(struct net *net, u16 zone,
+ local_bh_disable();
+ begin:
+ hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[bucket], hnnode) {
+- if (nf_ct_tuple_equal(tuple, &h->tuple) &&
+- nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)) == zone) {
++ if (nf_ct_key_equal(h, tuple, zone)) {
+ NF_CT_STAT_INC(net, found);
+ local_bh_enable();
+ return h;
+@@ -378,8 +392,7 @@ begin:
+ !atomic_inc_not_zero(&ct->ct_general.use)))
+ h = NULL;
+ else {
+- if (unlikely(!nf_ct_tuple_equal(tuple, &h->tuple) ||
+- nf_ct_zone(ct) != zone)) {
++ if (unlikely(!nf_ct_key_equal(h, tuple, zone))) {
+ nf_ct_put(ct);
+ goto begin;
+ }
+diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
+index e41ec849120a..6fedfb359b19 100644
+--- a/net/netfilter/nf_conntrack_expect.c
++++ b/net/netfilter/nf_conntrack_expect.c
+@@ -203,7 +203,8 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
+ a->mask.src.u3.all[count] & b->mask.src.u3.all[count];
+ }
+
+- return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask);
++ return nf_ct_tuple_mask_cmp(&a->tuple, &b->tuple, &intersect_mask) &&
++ nf_ct_zone(a->master) == nf_ct_zone(b->master);
+ }
+
+ static inline int expect_matches(const struct nf_conntrack_expect *a,
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index e8fdb172adbb..a985158d95d5 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ }
+
+ ibmr = rds_ib_alloc_fmr(rds_ibdev);
+- if (IS_ERR(ibmr))
++ if (IS_ERR(ibmr)) {
++ rds_ib_dev_put(rds_ibdev);
+ return ibmr;
++ }
+
+ ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ if (ret == 0)
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f66187c..140a44a5f7b7 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
+diff --git a/net/rds/send.c b/net/rds/send.c
+index 88eace57dd6b..31c9fa464b11 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -955,11 +955,13 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
+ release_sock(sk);
+ }
+
+- /* racing with another thread binding seems ok here */
++ lock_sock(sk);
+ if (daddr == 0 || rs->rs_bound_addr == 0) {
++ release_sock(sk);
+ ret = -ENOTCONN; /* XXX not a great errno */
+ goto out;
+ }
++ release_sock(sk);
+
+ /* size of rm including all sgs */
+ ret = rds_rm_size(msg, payload_len);
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 1ff51c9d18d5..5fa033ac59e5 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -682,7 +682,7 @@ static void sctp_cmd_transport_on(sctp_cmd_seq_t *cmds,
+ * outstanding data and rely on the retransmission limit be reached
+ * to shutdown the association.
+ */
+- if (t->asoc->state != SCTP_STATE_SHUTDOWN_PENDING)
++ if (t->asoc->state < SCTP_STATE_SHUTDOWN_PENDING)
+ t->asoc->overall_error_count = 0;
+
+ /* Clear the hb_sent flag to signal that we had a good
+diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
+index f1a63c1885dc..fe5728422667 100644
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -66,6 +66,7 @@ static void xprt_init(struct rpc_xprt *xprt, struct net *net);
+ static void xprt_request_init(struct rpc_task *, struct rpc_xprt *);
+ static void xprt_connect_status(struct rpc_task *task);
+ static int __xprt_get_cong(struct rpc_xprt *, struct rpc_task *);
++static void __xprt_put_cong(struct rpc_xprt *, struct rpc_rqst *);
+ static void xprt_destroy(struct rpc_xprt *xprt);
+
+ static DEFINE_SPINLOCK(xprt_list_lock);
+@@ -269,6 +270,8 @@ int xprt_reserve_xprt_cong(struct rpc_xprt *xprt, struct rpc_task *task)
+ }
+ xprt_clear_locked(xprt);
+ out_sleep:
++ if (req)
++ __xprt_put_cong(xprt, req);
+ dprintk("RPC: %5u failed to lock transport %p\n", task->tk_pid, xprt);
+ task->tk_timeout = 0;
+ task->tk_status = -EAGAIN;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 09a84c9f2f59..de07f944e98a 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -306,6 +306,118 @@ found:
+ return s;
+ }
+
++/* Support code for asymmetrically connected dgram sockets
++ *
++ * If a datagram socket is connected to a socket not itself connected
++ * to the first socket (eg, /dev/log), clients may only enqueue more
++ * messages if the present receive queue of the server socket is not
++ * "too large". This means there's a second writeability condition
++ * poll and sendmsg need to test. The dgram recv code will do a wake
++ * up on the peer_wait wait queue of a socket upon reception of a
++ * datagram which needs to be propagated to sleeping would-be writers
++ * since these might not have sent anything so far. This can't be
++ * accomplished via poll_wait because the lifetime of the server
++ * socket might be less than that of its clients if these break their
++ * association with it or if the server socket is closed while clients
++ * are still connected to it and there's no way to inform "a polling
++ * implementation" that it should let go of a certain wait queue
++ *
++ * In order to propagate a wake up, a wait_queue_t of the client
++ * socket is enqueued on the peer_wait queue of the server socket
++ * whose wake function does a wake_up on the ordinary client socket
++ * wait queue. This connection is established whenever a write (or
++ * poll for write) hit the flow control condition and broken when the
++ * association to the server socket is dissolved or after a wake up
++ * was relayed.
++ */
++
++static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags,
++ void *key)
++{
++ struct unix_sock *u;
++ wait_queue_head_t *u_sleep;
++
++ u = container_of(q, struct unix_sock, peer_wake);
++
++ __remove_wait_queue(&unix_sk(u->peer_wake.private)->peer_wait,
++ q);
++ u->peer_wake.private = NULL;
++
++ /* relaying can only happen while the wq still exists */
++ u_sleep = sk_sleep(&u->sk);
++ if (u_sleep)
++ wake_up_interruptible_poll(u_sleep, key);
++
++ return 0;
++}
++
++static int unix_dgram_peer_wake_connect(struct sock *sk, struct sock *other)
++{
++ struct unix_sock *u, *u_other;
++ int rc;
++
++ u = unix_sk(sk);
++ u_other = unix_sk(other);
++ rc = 0;
++ spin_lock(&u_other->peer_wait.lock);
++
++ if (!u->peer_wake.private) {
++ u->peer_wake.private = other;
++ __add_wait_queue(&u_other->peer_wait, &u->peer_wake);
++
++ rc = 1;
++ }
++
++ spin_unlock(&u_other->peer_wait.lock);
++ return rc;
++}
++
++static void unix_dgram_peer_wake_disconnect(struct sock *sk,
++ struct sock *other)
++{
++ struct unix_sock *u, *u_other;
++
++ u = unix_sk(sk);
++ u_other = unix_sk(other);
++ spin_lock(&u_other->peer_wait.lock);
++
++ if (u->peer_wake.private == other) {
++ __remove_wait_queue(&u_other->peer_wait, &u->peer_wake);
++ u->peer_wake.private = NULL;
++ }
++
++ spin_unlock(&u_other->peer_wait.lock);
++}
++
++static void unix_dgram_peer_wake_disconnect_wakeup(struct sock *sk,
++ struct sock *other)
++{
++ unix_dgram_peer_wake_disconnect(sk, other);
++ wake_up_interruptible_poll(sk_sleep(sk),
++ POLLOUT |
++ POLLWRNORM |
++ POLLWRBAND);
++}
++
++/* preconditions:
++ * - unix_peer(sk) == other
++ * - association is stable
++ */
++static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
++{
++ int connected;
++
++ connected = unix_dgram_peer_wake_connect(sk, other);
++
++ if (unix_recvq_full(other))
++ return 1;
++
++ if (connected)
++ unix_dgram_peer_wake_disconnect(sk, other);
++
++ return 0;
++}
++
+ static inline int unix_writable(struct sock *sk)
+ {
+ return (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
+@@ -410,6 +522,8 @@ static void unix_release_sock(struct sock *sk, int embrion)
+ skpair->sk_state_change(skpair);
+ sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
+ }
++
++ unix_dgram_peer_wake_disconnect(sk, skpair);
+ sock_put(skpair); /* It may now die */
+ unix_peer(sk) = NULL;
+ }
+@@ -646,6 +760,7 @@ static struct sock *unix_create1(struct net *net, struct socket *sock)
+ INIT_LIST_HEAD(&u->link);
+ mutex_init(&u->readlock); /* single task reading lock */
+ init_waitqueue_head(&u->peer_wait);
++ init_waitqueue_func_entry(&u->peer_wake, unix_dgram_peer_wake_relay);
+ unix_insert_socket(unix_sockets_unbound, sk);
+ out:
+ if (sk == NULL)
+@@ -1020,6 +1135,8 @@ restart:
+ if (unix_peer(sk)) {
+ struct sock *old_peer = unix_peer(sk);
+ unix_peer(sk) = other;
++ unix_dgram_peer_wake_disconnect_wakeup(sk, old_peer);
++
+ unix_state_double_unlock(sk, other);
+
+ if (other != old_peer)
+@@ -1459,6 +1576,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
+ long timeo;
+ struct scm_cookie tmp_scm;
+ int max_level;
++ int sk_locked;
+
+ if (NULL == siocb->scm)
+ siocb->scm = &tmp_scm;
+@@ -1527,12 +1645,14 @@ restart:
+ goto out_free;
+ }
+
++ sk_locked = 0;
+ unix_state_lock(other);
++restart_locked:
+ err = -EPERM;
+ if (!unix_may_send(sk, other))
+ goto out_unlock;
+
+- if (sock_flag(other, SOCK_DEAD)) {
++ if (unlikely(sock_flag(other, SOCK_DEAD))) {
+ /*
+ * Check with 1003.1g - what should
+ * datagram error
+@@ -1540,10 +1660,14 @@ restart:
+ unix_state_unlock(other);
+ sock_put(other);
+
++ if (!sk_locked)
++ unix_state_lock(sk);
++
+ err = 0;
+- unix_state_lock(sk);
+ if (unix_peer(sk) == other) {
+ unix_peer(sk) = NULL;
++ unix_dgram_peer_wake_disconnect_wakeup(sk, other);
++
+ unix_state_unlock(sk);
+
+ unix_dgram_disconnected(sk, other);
+@@ -1569,21 +1693,43 @@ restart:
+ goto out_unlock;
+ }
+
+- if (unix_peer(other) != sk && unix_recvq_full(other)) {
+- if (!timeo) {
+- err = -EAGAIN;
+- goto out_unlock;
++ /* other == sk && unix_peer(other) != sk if
++ * - unix_peer(sk) == NULL, destination address bound to sk
++ * - unix_peer(sk) == sk by time of get but disconnected before lock
++ */
++ if (other != sk &&
++ unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
++ if (timeo) {
++ timeo = unix_wait_for_peer(other, timeo);
++
++ err = sock_intr_errno(timeo);
++ if (signal_pending(current))
++ goto out_free;
++
++ goto restart;
+ }
+
+- timeo = unix_wait_for_peer(other, timeo);
++ if (!sk_locked) {
++ unix_state_unlock(other);
++ unix_state_double_lock(sk, other);
++ }
+
+- err = sock_intr_errno(timeo);
+- if (signal_pending(current))
+- goto out_free;
++ if (unix_peer(sk) != other ||
++ unix_dgram_peer_wake_me(sk, other)) {
++ err = -EAGAIN;
++ sk_locked = 1;
++ goto out_unlock;
++ }
+
+- goto restart;
++ if (!sk_locked) {
++ sk_locked = 1;
++ goto restart_locked;
++ }
+ }
+
++ if (unlikely(sk_locked))
++ unix_state_unlock(sk);
++
+ if (sock_flag(other, SOCK_RCVTSTAMP))
+ __net_timestamp(skb);
+ maybe_add_creds(skb, sock, other);
+@@ -1597,6 +1743,8 @@ restart:
+ return len;
+
+ out_unlock:
++ if (sk_locked)
++ unix_state_unlock(sk);
+ unix_state_unlock(other);
+ out_free:
+ kfree_skb(skb);
+@@ -2229,14 +2377,16 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+ return mask;
+
+ writable = unix_writable(sk);
+- other = unix_peer_get(sk);
+- if (other) {
+- if (unix_peer(other) != sk) {
+- sock_poll_wait(file, &unix_sk(other)->peer_wait, wait);
+- if (unix_recvq_full(other))
+- writable = 0;
+- }
+- sock_put(other);
++ if (writable) {
++ unix_state_lock(sk);
++
++ other = unix_peer(sk);
++ if (other && unix_peer(other) != sk &&
++ unix_recvq_full(other) &&
++ unix_dgram_peer_wake_me(sk, other))
++ writable = 0;
++
++ unix_state_unlock(sk);
+ }
+
+ if (writable)
+diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
+index 3346f4236ebe..4a19a7f3bfde 100644
+--- a/scripts/kconfig/streamline_config.pl
++++ b/scripts/kconfig/streamline_config.pl
+@@ -125,7 +125,7 @@ my $ksource = $ARGV[0];
+ my $kconfig = $ARGV[1];
+ my $lsmod_file = $ENV{'LSMOD'};
+
+-my @makefiles = `find $ksource -name Makefile 2>/dev/null`;
++my @makefiles = `find $ksource -name Makefile -or -name Kbuild 2>/dev/null`;
+ chomp @makefiles;
+
+ my %depends;
+diff --git a/security/keys/gc.c b/security/keys/gc.c
+index 87632bd17b3e..9e496adfa3db 100644
+--- a/security/keys/gc.c
++++ b/security/keys/gc.c
+@@ -174,6 +174,12 @@ static noinline void key_gc_unused_key(struct key *key)
+ {
+ key_check(key);
+
++ /* Throw away the key data if the key is instantiated */
++ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
++ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
++ key->type->destroy)
++ key->type->destroy(key);
++
+ security_key_free(key);
+
+ /* deal with the user's key tracking and quota */
+@@ -188,10 +194,6 @@ static noinline void key_gc_unused_key(struct key *key)
+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+ atomic_dec(&key->user->nikeys);
+
+- /* now throw away the key memory */
+- if (key->type->destroy)
+- key->type->destroy(key);
+-
+ key_user_put(key->user);
+
+ kfree(key->description);
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index c419aa30d544..67a827df2cde 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -1211,6 +1211,8 @@ static void build_feature_ctl(struct mixer_build *state, void *raw_desc,
+ break;
+ }
+
++ snd_usb_mixer_fu_apply_quirk(state->mixer, cval, unitid, kctl);
++
+ range = (cval->max - cval->min) / cval->res;
+ /* Are there devices with volume range more than 255? I use a bit more
+ * to be sure. 384 is a resolution magic number found on Logitech
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 851786ffa639..cb980407a3f0 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -312,6 +312,13 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ { 0 }
+ };
+
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++ { 3, NULL, .dB = &bose_companion5_dB },
++ { 0 } /* terminator */
++};
++
+ /*
+ * Control map entries
+ */
+@@ -394,6 +401,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x25c4, 0x0003),
+ .map = scms_usb3318_map,
+ },
++ {
++ /* Bose Companion 5 */
++ .id = USB_ID(0x05a7, 0x1020),
++ .map = bose_companion5_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index 040d1016fb20..21f4d448b242 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -34,6 +34,7 @@
+ #include <sound/control.h>
+ #include <sound/hwdep.h>
+ #include <sound/info.h>
++#include <sound/tlv.h>
+
+ #include "usbaudio.h"
+ #include "mixer.h"
+@@ -682,3 +683,39 @@ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
+ }
+ }
+
++static void snd_dragonfly_quirk_db_scale(struct usb_mixer_interface *mixer,
++ struct snd_kcontrol *kctl)
++{
++ /* Approximation using 10 ranges based on output measurement on hw v1.2.
++ * This seems close to the cubic mapping e.g. alsamixer uses. */
++ static const DECLARE_TLV_DB_RANGE(scale,
++ 0, 1, TLV_DB_MINMAX_ITEM(-5300, -4970),
++ 2, 5, TLV_DB_MINMAX_ITEM(-4710, -4160),
++ 6, 7, TLV_DB_MINMAX_ITEM(-3884, -3710),
++ 8, 14, TLV_DB_MINMAX_ITEM(-3443, -2560),
++ 15, 16, TLV_DB_MINMAX_ITEM(-2475, -2324),
++ 17, 19, TLV_DB_MINMAX_ITEM(-2228, -2031),
++ 20, 26, TLV_DB_MINMAX_ITEM(-1910, -1393),
++ 27, 31, TLV_DB_MINMAX_ITEM(-1322, -1032),
++ 32, 40, TLV_DB_MINMAX_ITEM(-968, -490),
++ 41, 50, TLV_DB_MINMAX_ITEM(-441, 0),
++ );
++
++ dev_info(&mixer->chip->dev->dev, "applying DragonFly dB scale quirk\n");
++ kctl->tlv.p = scale;
++ kctl->vd[0].access |= SNDRV_CTL_ELEM_ACCESS_TLV_READ;
++ kctl->vd[0].access &= ~SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK;
++}
++
++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
++ struct usb_mixer_elem_info *cval, int unitid,
++ struct snd_kcontrol *kctl)
++{
++ switch (mixer->chip->usb_id) {
++ case USB_ID(0x21b4, 0x0081): /* AudioQuest DragonFly */
++ if (unitid == 7 && cval->min == 0 && cval->max == 50)
++ snd_dragonfly_quirk_db_scale(mixer, kctl);
++ break;
++ }
++}
++
+diff --git a/sound/usb/mixer_quirks.h b/sound/usb/mixer_quirks.h
+index bdbfab093816..177c329cd4dd 100644
+--- a/sound/usb/mixer_quirks.h
++++ b/sound/usb/mixer_quirks.h
+@@ -9,5 +9,9 @@ void snd_emuusb_set_samplerate(struct snd_usb_audio *chip,
+ void snd_usb_mixer_rc_memory_change(struct usb_mixer_interface *mixer,
+ int unitid);
+
++void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer,
++ struct usb_mixer_elem_info *cval, int unitid,
++ struct snd_kcontrol *kctl);
++
+ #endif /* SND_USB_MIXER_QUIRKS_H */
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 2ad5d772cd92..4cebbf7f6ad1 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2461,6 +2461,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
++/* Steinberg devices */
++{
++ /* Steinberg MI2 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++{
++ /* Steinberg MI4 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ /* TerraTec devices */
+ {
+ USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2015-10-23 23:33 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2015-10-23 23:33 UTC (permalink / raw
To: gentoo-commits
commit: 5b7a43580499987a3360b75e807ace62b86df1b5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Oct 23 23:33:36 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Oct 23 23:33:36 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5b7a4358
Linux patch 3.4.110
0000_README | 4 +
1109_linux-3.4.110.patch | 2308 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 2312 insertions(+)
diff --git a/0000_README b/0000_README
index 0fcce0d..42786be 100644
--- a/0000_README
+++ b/0000_README
@@ -475,6 +475,10 @@ Patch: 1108_linux-3.4.109.patch
From: http://www.kernel.org
Desc: Linux 3.4.109
+Patch: 1109_linux-3.4.110.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.110
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1109_linux-3.4.110.patch b/1109_linux-3.4.110.patch
new file mode 100644
index 0000000..2178866
--- /dev/null
+++ b/1109_linux-3.4.110.patch
@@ -0,0 +1,2308 @@
+diff --git a/Documentation/networking/pktgen.txt b/Documentation/networking/pktgen.txt
+index 75e4fd708ccb..a03239c4163d 100644
+--- a/Documentation/networking/pktgen.txt
++++ b/Documentation/networking/pktgen.txt
+@@ -24,17 +24,33 @@ For monitoring and control pktgen creates:
+ /proc/net/pktgen/ethX
+
+
+-Viewing threads
+-===============
+-/proc/net/pktgen/kpktgend_0
+-Name: kpktgend_0 max_before_softirq: 10000
+-Running:
+-Stopped: eth1
+-Result: OK: max_before_softirq=10000
++Kernel threads
++==============
++Pktgen creates a thread for each CPU with affinity to that CPU.
++Which is controlled through procfile /proc/net/pktgen/kpktgend_X.
++
++Example: /proc/net/pktgen/kpktgend_0
++
++ Running:
++ Stopped: eth4@0
++ Result: OK: add_device=eth4@0
++
++Most important are the devices assigned to the thread.
+
+-Most important the devices assigned to thread. Note! A device can only belong
+-to one thread.
++The two basic thread commands are:
++ * add_device DEVICE@NAME -- adds a single device
++ * rem_device_all -- remove all associated devices
+
++When adding a device to a thread, a corrosponding procfile is created
++which is used for configuring this device. Thus, device names need to
++be unique.
++
++To support adding the same device to multiple threads, which is useful
++with multi queue NICs, a the device naming scheme is extended with "@":
++ device@something
++
++The part after "@" can be anything, but it is custom to use the thread
++number.
+
+ Viewing devices
+ ===============
+@@ -42,29 +58,32 @@ Viewing devices
+ Parm section holds configured info. Current hold running stats.
+ Result is printed after run or after interruption. Example:
+
+-/proc/net/pktgen/eth1
++/proc/net/pktgen/eth4@0
+
+-Params: count 10000000 min_pkt_size: 60 max_pkt_size: 60
+- frags: 0 delay: 0 clone_skb: 1000000 ifname: eth1
++ Params: count 100000 min_pkt_size: 60 max_pkt_size: 60
++ frags: 0 delay: 0 clone_skb: 64 ifname: eth4@0
+ flows: 0 flowlen: 0
+- dst_min: 10.10.11.2 dst_max:
+- src_min: src_max:
+- src_mac: 00:00:00:00:00:00 dst_mac: 00:04:23:AC:FD:82
+- udp_src_min: 9 udp_src_max: 9 udp_dst_min: 9 udp_dst_max: 9
+- src_mac_count: 0 dst_mac_count: 0
+- Flags:
+-Current:
+- pkts-sofar: 10000000 errors: 39664
+- started: 1103053986245187us stopped: 1103053999346329us idle: 880401us
+- seq_num: 10000011 cur_dst_mac_offset: 0 cur_src_mac_offset: 0
+- cur_saddr: 0x10a0a0a cur_daddr: 0x20b0a0a
+- cur_udp_dst: 9 cur_udp_src: 9
++ queue_map_min: 0 queue_map_max: 0
++ dst_min: 192.168.81.2 dst_max:
++ src_min: src_max:
++ src_mac: 90:e2:ba:0a:56:b4 dst_mac: 00:1b:21:3c:9d:f8
++ udp_src_min: 9 udp_src_max: 109 udp_dst_min: 9 udp_dst_max: 9
++ src_mac_count: 0 dst_mac_count: 0
++ Flags: UDPSRC_RND NO_TIMESTAMP QUEUE_MAP_CPU
++ Current:
++ pkts-sofar: 100000 errors: 0
++ started: 623913381008us stopped: 623913396439us idle: 25us
++ seq_num: 100001 cur_dst_mac_offset: 0 cur_src_mac_offset: 0
++ cur_saddr: 192.168.8.3 cur_daddr: 192.168.81.2
++ cur_udp_dst: 9 cur_udp_src: 42
++ cur_queue_map:
+ flows: 0
+-Result: OK: 13101142(c12220741+d880401) usec, 10000000 (60byte,0frags)
+- 763292pps 390Mb/sec (390805504bps) errors: 39664
++ Result: OK: 15430(c15405d25) usec, 100000 (60byte,0frags)
++ 6480562pps 3110Mb/sec (3110669760bps) errors: 0
+
+-Configuring threads and devices
+-================================
++
++Configuring devices
++===================
+ This is done via the /proc interface easiest done via pgset in the scripts
+
+ Examples:
+@@ -177,6 +196,8 @@ Note when adding devices to a specific CPU there good idea to also assign
+ /proc/irq/XX/smp_affinity so the TX-interrupts gets bound to the same CPU.
+ as this reduces cache bouncing when freeing skb's.
+
++Plus using the device flag QUEUE_MAP_CPU, which maps the SKBs TX queue
++to the running threads CPU (directly from smp_processor_id()).
+
+ Current commands and configuration options
+ ==========================================
+diff --git a/Makefile b/Makefile
+index 7337720d6599..e99e5a5d571b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 109
++SUBLEVEL = 110
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index ad941453340a..7702641520ea 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -899,7 +899,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ if (ctx.imm_count)
+ kfree(ctx.imms);
+ #endif
+- bpf_jit_binary_free(header);
++ module_free(NULL, ctx.target);
+ goto out;
+ }
+ build_epilogue(&ctx);
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index c2dac2e0e56a..69b5a4b873e2 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -115,7 +115,7 @@ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+
+ ghash_flush(dctx);
+- memcpy(dst, dtx->icv, GHASH_BLOCK_SIZE);
++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 4f787579b329..d60facb1a9d4 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -509,7 +509,7 @@ struct kvm_arch {
+ struct kvm_pic *vpic;
+ struct kvm_ioapic *vioapic;
+ struct kvm_pit *vpit;
+- int vapics_in_nmi_mode;
++ atomic_t vapics_in_nmi_mode;
+
+ unsigned int tss_addr;
+ struct page *apic_access_page;
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index db336f9f2c8c..eaad49aa5bed 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -317,7 +317,7 @@ static void pit_do_work(struct work_struct *work)
+ * LVT0 to NMI delivery. Other PIC interrupts are just sent to
+ * VCPU0, and only if its LVT0 is in EXTINT mode.
+ */
+- if (kvm->arch.vapics_in_nmi_mode > 0)
++ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
+ kvm_for_each_vcpu(i, vcpu, kvm)
+ kvm_apic_nmi_wd_deliver(vcpu);
+ }
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 578613da251e..53454a6775bf 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -761,10 +761,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
+ if (!nmi_wd_enabled) {
+ apic_debug("Receive NMI setting on APIC_LVT0 "
+ "for cpu %d\n", apic->vcpu->vcpu_id);
+- apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
++ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
+ }
+ } else if (nmi_wd_enabled)
+- apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
++ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
+ }
+
+ static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
+@@ -1257,6 +1257,7 @@ void kvm_apic_post_state_restore(struct kvm_vcpu *vcpu)
+
+ apic_update_ppr(apic);
+ hrtimer_cancel(&apic->lapic_timer.timer);
++ apic_manage_nmi_watchdog(apic, apic_get_reg(apic, APIC_LVT0));
+ update_divide_count(apic);
+ start_apic_timer(apic);
+ apic->irr_pending = true;
+diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
+index ed2835e148b5..65cf4f22bd6e 100644
+--- a/arch/x86/pci/acpi.c
++++ b/arch/x86/pci/acpi.c
+@@ -70,6 +70,17 @@ static const struct dmi_system_id pci_use_crs_table[] __initconst = {
+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
+ },
+ },
++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
++ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
++ {
++ .callback = set_use_crs,
++ .ident = "Foxconn K8M890-8237A",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
++ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
++ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
++ },
++ },
+
+ /* Now for the blacklist.. */
+
+diff --git a/drivers/acpi/acpica/utxface.c b/drivers/acpi/acpica/utxface.c
+index afa94f51ff0b..0985ab722bb9 100644
+--- a/drivers/acpi/acpica/utxface.c
++++ b/drivers/acpi/acpica/utxface.c
+@@ -166,10 +166,12 @@ acpi_status acpi_enable_subsystem(u32 flags)
+ * Obtain a permanent mapping for the FACS. This is required for the
+ * Global Lock and the Firmware Waking Vector
+ */
+- status = acpi_tb_initialize_facs();
+- if (ACPI_FAILURE(status)) {
+- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
+- return_ACPI_STATUS(status);
++ if (!(flags & ACPI_NO_FACS_INIT)) {
++ status = acpi_tb_initialize_facs();
++ if (ACPI_FAILURE(status)) {
++ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
++ return_ACPI_STATUS(status);
++ }
+ }
+ #endif /* !ACPI_REDUCED_HARDWARE */
+
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index 8e81f85b1ba0..0ac67aca7905 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -784,7 +784,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
+ ret = regmap_read(map, reg + i, &ival);
+ if (ret != 0)
+ return ret;
+- memcpy(val + (i * val_bytes), &ival, val_bytes);
++ map->format.format_val(val + (i * val_bytes), ival);
+ }
+ }
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 52be498c2d1c..4b8e03fc3281 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -104,6 +104,7 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3408) },
+ { USB_DEVICE(0x13d3, 0x3423) },
+ { USB_DEVICE(0x13d3, 0x3432) },
++ { USB_DEVICE(0x13d3, 0x3474) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -153,6 +154,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index f8a58db55055..bbd1e6c7a4e9 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -182,6 +182,7 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
+index 7f025fb620de..4e985cd97618 100644
+--- a/drivers/char/agp/intel-gtt.c
++++ b/drivers/char/agp/intel-gtt.c
+@@ -1194,7 +1194,7 @@ static inline int needs_idle_maps(void)
+ /* Query intel_iommu to see if we need the workaround. Presumably that
+ * was loaded first.
+ */
+- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
++ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
+ gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
+ intel_iommu_gfx_mapped)
+ return 1;
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index 921039e56f87..a759fdcd6f6b 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -2653,6 +2653,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
+ break;
+ default:
+ dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
++ kfree(t_alg);
+ return ERR_PTR(-EINVAL);
+ }
+
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index fa5d55fea46c..c8fecbcb892b 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -390,7 +390,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
+ dma_cookie_t cookie = 0;
+ int busy = mv_chan_is_busy(mv_chan);
+ u32 current_desc = mv_chan_get_current_desc(mv_chan);
+- int seen_current = 0;
++ int current_cleaned = 0;
++ struct mv_xor_desc *hw_desc;
+
+ dev_dbg(mv_chan->device->common.dev, "%s %d\n", __func__, __LINE__);
+ dev_dbg(mv_chan->device->common.dev, "current_desc %x\n", current_desc);
+@@ -402,38 +403,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
+
+ list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
+ chain_node) {
+- prefetch(_iter);
+- prefetch(&_iter->async_tx);
+
+- /* do not advance past the current descriptor loaded into the
+- * hardware channel, subsequent descriptors are either in
+- * process or have not been submitted
+- */
+- if (seen_current)
+- break;
++ /* clean finished descriptors */
++ hw_desc = iter->hw_desc;
++ if (hw_desc->status & XOR_DESC_SUCCESS) {
++ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
++ cookie);
+
+- /* stop the search if we reach the current descriptor and the
+- * channel is busy
+- */
+- if (iter->async_tx.phys == current_desc) {
+- seen_current = 1;
+- if (busy)
++ /* done processing desc, clean slot */
++ mv_xor_clean_slot(iter, mv_chan);
++
++ /* break if we did cleaned the current */
++ if (iter->async_tx.phys == current_desc) {
++ current_cleaned = 1;
++ break;
++ }
++ } else {
++ if (iter->async_tx.phys == current_desc) {
++ current_cleaned = 0;
+ break;
++ }
+ }
+-
+- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
+-
+- if (mv_xor_clean_slot(iter, mv_chan))
+- break;
+ }
+
+ if ((busy == 0) && !list_empty(&mv_chan->chain)) {
+- struct mv_xor_desc_slot *chain_head;
+- chain_head = list_entry(mv_chan->chain.next,
+- struct mv_xor_desc_slot,
+- chain_node);
+-
+- mv_xor_start_new_chain(mv_chan, chain_head);
++ if (current_cleaned) {
++ /*
++ * current descriptor cleaned and removed, run
++ * from list head
++ */
++ iter = list_entry(mv_chan->chain.next,
++ struct mv_xor_desc_slot,
++ chain_node);
++ mv_xor_start_new_chain(mv_chan, iter);
++ } else {
++ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
++ /*
++ * descriptors are still waiting after
++ * current, trigger them
++ */
++ iter = list_entry(iter->chain_node.next,
++ struct mv_xor_desc_slot,
++ chain_node);
++ mv_xor_start_new_chain(mv_chan, iter);
++ } else {
++ /*
++ * some descriptors are still waiting
++ * to be cleaned
++ */
++ tasklet_schedule(&mv_chan->irq_tasklet);
++ }
++ }
+ }
+
+ if (cookie > 0)
+diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
+index 654876b7ba1d..0af03772da3b 100644
+--- a/drivers/dma/mv_xor.h
++++ b/drivers/dma/mv_xor.h
+@@ -30,6 +30,7 @@
+ #define XOR_OPERATION_MODE_XOR 0
+ #define XOR_OPERATION_MODE_MEMCPY 2
+ #define XOR_OPERATION_MODE_MEMSET 4
++#define XOR_DESC_SUCCESS 0x40000000
+
+ #define XOR_CURR_DESC(chan) (chan->mmr_base + 0x210 + (chan->idx * 4))
+ #define XOR_NEXT_DESC(chan) (chan->mmr_base + 0x200 + (chan->idx * 4))
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index e1c744d7370a..b1f1d105e8c7 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1779,6 +1779,9 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring)
+ uint32_t seqno;
+ int i;
+
++ if (list_empty(&ring->request_list))
++ return;
++
+ WARN_ON(i915_verify_lists(ring->dev));
+
+ seqno = ring->get_seqno(ring);
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index db4df97b7872..c5fe79e67ed9 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev)
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 1f451796407b..461262eee79a 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeon_device *rdev)
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index d441aed782ad..9c7062d970ee 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev)
+ WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
+index d66d2cdf4f0a..f3ee36036487 100644
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
+ if (p->relocs_ptr == NULL) {
+ return -ENOMEM;
+ }
+- p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list));
++ p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL);
+ if (p->relocs == NULL) {
+ return -ENOMEM;
+ }
+@@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
+ }
+ }
+ kfree(parser->track);
+- drm_free_large(parser->relocs);
++ kfree(parser->relocs);
+ kfree(parser->relocs_ptr);
+ for (i = 0; i < parser->nchunks; i++) {
+ kfree(parser->chunks[i].kdata);
+diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+index 645dcbf6490b..77c456d624bf 100644
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -51,10 +51,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
+ radeon_connector_hotplug(connector);
+ }
++ mutex_unlock(&mode_config->mutex);
+ /* Just fire off a uevent and let userspace tell us what to do */
+ drm_helper_hpd_irq_event(dev);
+ }
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 3358730be78b..1ec1255520ad 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev)
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 3b6e641decd0..6609a23983d0 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
+ L2_CACHE_BIGK_FRAGMENT_SIZE(0));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
+index c7d4ef18cd40..dcff64f6ced2 100644
+--- a/drivers/infiniband/hw/qib/qib.h
++++ b/drivers/infiniband/hw/qib/qib.h
+@@ -1429,6 +1429,10 @@ extern struct mutex qib_mutex;
+ qib_get_unit_name((dd)->unit), ##__VA_ARGS__); \
+ } while (0)
+
++#define qib_dev_warn(dd, fmt, ...) \
++ dev_warn(&(dd)->pcidev->dev, "%s: " fmt, \
++ qib_get_unit_name((dd)->unit), ##__VA_ARGS__)
++
+ #define qib_dev_porterr(dd, port, fmt, ...) \
+ do { \
+ dev_err(&(dd)->pcidev->dev, "%s: IB%u:%u " fmt, \
+diff --git a/drivers/infiniband/hw/qib/qib_keys.c b/drivers/infiniband/hw/qib/qib_keys.c
+index 8fd19a47df0c..ca6e6cfd7b8f 100644
+--- a/drivers/infiniband/hw/qib/qib_keys.c
++++ b/drivers/infiniband/hw/qib/qib_keys.c
+@@ -69,6 +69,10 @@ int qib_alloc_lkey(struct qib_lkey_table *rkt, struct qib_mregion *mr)
+ * unrestricted LKEY.
+ */
+ rkt->gen++;
++ /*
++ * bits are capped in qib_verbs.c to insure enough bits
++ * for generation number
++ */
+ mr->lkey = (r << (32 - ib_qib_lkey_table_size)) |
+ ((((1 << (24 - ib_qib_lkey_table_size)) - 1) & rkt->gen)
+ << 8);
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.c b/drivers/infiniband/hw/qib/qib_verbs.c
+index 7b6c3bffa9d9..395d9d619af3 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.c
++++ b/drivers/infiniband/hw/qib/qib_verbs.c
+@@ -40,6 +40,7 @@
+ #include <linux/rculist.h>
+ #include <linux/mm.h>
+ #include <linux/random.h>
++#include <linux/vmalloc.h>
+
+ #include "qib.h"
+ #include "qib_common.h"
+@@ -2058,10 +2059,16 @@ int qib_register_ib_device(struct qib_devdata *dd)
+ * the LKEY). The remaining bits act as a generation number or tag.
+ */
+ spin_lock_init(&dev->lk_table.lock);
++ /* insure generation is at least 4 bits see keys.c */
++ if (ib_qib_lkey_table_size > MAX_LKEY_TABLE_BITS) {
++ qib_dev_warn(dd, "lkey bits %u too large, reduced to %u\n",
++ ib_qib_lkey_table_size, MAX_LKEY_TABLE_BITS);
++ ib_qib_lkey_table_size = MAX_LKEY_TABLE_BITS;
++ }
+ dev->lk_table.max = 1 << ib_qib_lkey_table_size;
+ lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table);
+ dev->lk_table.table = (struct qib_mregion **)
+- __get_free_pages(GFP_KERNEL, get_order(lk_tab_size));
++ vmalloc(lk_tab_size);
+ if (dev->lk_table.table == NULL) {
+ ret = -ENOMEM;
+ goto err_lk;
+@@ -2231,7 +2238,7 @@ err_tx:
+ sizeof(struct qib_pio_header),
+ dev->pio_hdrs, dev->pio_hdrs_phys);
+ err_hdrs:
+- free_pages((unsigned long) dev->lk_table.table, get_order(lk_tab_size));
++ vfree(dev->lk_table.table);
+ err_lk:
+ kfree(dev->qp_table);
+ err_qpt:
+@@ -2285,7 +2292,6 @@ void qib_unregister_ib_device(struct qib_devdata *dd)
+ sizeof(struct qib_pio_header),
+ dev->pio_hdrs, dev->pio_hdrs_phys);
+ lk_tab_size = dev->lk_table.max * sizeof(*dev->lk_table.table);
+- free_pages((unsigned long) dev->lk_table.table,
+- get_order(lk_tab_size));
++ vfree(dev->lk_table.table);
+ kfree(dev->qp_table);
+ }
+diff --git a/drivers/infiniband/hw/qib/qib_verbs.h b/drivers/infiniband/hw/qib/qib_verbs.h
+index 0c19ef0c4123..66f7f62388b0 100644
+--- a/drivers/infiniband/hw/qib/qib_verbs.h
++++ b/drivers/infiniband/hw/qib/qib_verbs.h
+@@ -622,6 +622,8 @@ struct qib_qpn_table {
+ struct qpn_map map[QPNMAP_ENTRIES];
+ };
+
++#define MAX_LKEY_TABLE_BITS 23
++
+ struct qib_lkey_table {
+ spinlock_t lock; /* protect changes in this struct */
+ u32 next; /* next unused index (speeds search) */
+diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
+index c32a9093159a..47a789ea26bc 100644
+--- a/drivers/mmc/card/block.c
++++ b/drivers/mmc/card/block.c
+@@ -1372,9 +1372,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
+ break;
+ case MMC_BLK_CMD_ERR:
+ ret = mmc_blk_cmd_err(md, card, brq, req, ret);
+- if (!mmc_blk_reset(md, card->host, type))
+- break;
+- goto cmd_abort;
++ if (mmc_blk_reset(md, card->host, type))
++ goto cmd_abort;
++ if (!ret)
++ goto start_new_req;
++ break;
+ case MMC_BLK_RETRY:
+ if (retry++ < 5)
+ break;
+diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
+index 080f06053bd4..86598a1d8bde 100644
+--- a/drivers/mtd/maps/dc21285.c
++++ b/drivers/mtd/maps/dc21285.c
+@@ -38,9 +38,9 @@ static void nw_en_write(void)
+ * we want to write a bit pattern XXX1 to Xilinx to enable
+ * the write gate, which will be open for about the next 2ms.
+ */
+- spin_lock_irqsave(&nw_gpio_lock, flags);
++ raw_spin_lock_irqsave(&nw_gpio_lock, flags);
+ nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
+- spin_unlock_irqrestore(&nw_gpio_lock, flags);
++ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
+
+ /*
+ * let the ISA bus to catch on...
+diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
+index f1f06715d4e0..1917f7d21c88 100644
+--- a/drivers/mtd/mtd_blkdevs.c
++++ b/drivers/mtd/mtd_blkdevs.c
+@@ -214,6 +214,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+ return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
+
+ mutex_lock(&dev->lock);
++ mutex_lock(&mtd_table_mutex);
+
+ if (dev->open)
+ goto unlock;
+@@ -237,6 +238,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
+
+ unlock:
+ dev->open++;
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+@@ -247,6 +249,7 @@ error_release:
+ error_put:
+ module_put(dev->tr->owner);
+ kref_put(&dev->ref, blktrans_dev_release);
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+@@ -261,6 +264,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode)
+ return ret;
+
+ mutex_lock(&dev->lock);
++ mutex_lock(&mtd_table_mutex);
+
+ if (--dev->open)
+ goto unlock;
+@@ -273,6 +277,7 @@ static int blktrans_release(struct gendisk *disk, fmode_t mode)
+ __put_mtd_device(dev->mtd);
+ }
+ unlock:
++ mutex_unlock(&mtd_table_mutex);
+ mutex_unlock(&dev->lock);
+ blktrans_dev_put(dev);
+ return ret;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/descs.h b/drivers/net/ethernet/stmicro/stmmac/descs.h
+index 9820ec842cc0..e93a0bf128be 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/descs.h
++++ b/drivers/net/ethernet/stmicro/stmmac/descs.h
+@@ -153,6 +153,8 @@ struct dma_desc {
+ u32 buffer2_size:13;
+ u32 reserved4:3;
+ } etx; /* -- enhanced -- */
++
++ u64 all_flags;
+ } des01;
+ unsigned int des2;
+ unsigned int des3;
+diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+index ad1b627f8ec2..e0db6f66e92e 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c
+@@ -232,6 +232,7 @@ static void enh_desc_init_rx_desc(struct dma_desc *p, unsigned int ring_size,
+ {
+ int i;
+ for (i = 0; i < ring_size; i++) {
++ p->des01.all_flags = 0;
+ p->des01.erx.own = 1;
+ p->des01.erx.buffer1_size = BUF_SIZE_8KiB - 1;
+
+@@ -248,7 +249,7 @@ static void enh_desc_init_tx_desc(struct dma_desc *p, unsigned int ring_size)
+ int i;
+
+ for (i = 0; i < ring_size; i++) {
+- p->des01.etx.own = 0;
++ p->des01.all_flags = 0;
+ ehn_desc_tx_set_on_ring_chain(p, (i == ring_size - 1));
+ p++;
+ }
+@@ -271,6 +272,7 @@ static void enh_desc_set_tx_owner(struct dma_desc *p)
+
+ static void enh_desc_set_rx_owner(struct dma_desc *p)
+ {
++ p->des01.all_flags = 0;
+ p->des01.erx.own = 1;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+index 25953bb45a73..9703340c3115 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c
+@@ -126,6 +126,7 @@ static void ndesc_init_rx_desc(struct dma_desc *p, unsigned int ring_size,
+ {
+ int i;
+ for (i = 0; i < ring_size; i++) {
++ p->des01.all_flags = 0;
+ p->des01.rx.own = 1;
+ p->des01.rx.buffer1_size = BUF_SIZE_2KiB - 1;
+
+@@ -141,7 +142,7 @@ static void ndesc_init_tx_desc(struct dma_desc *p, unsigned int ring_size)
+ {
+ int i;
+ for (i = 0; i < ring_size; i++) {
+- p->des01.tx.own = 0;
++ p->des01.all_flags = 0;
+ ndesc_tx_set_on_ring_chain(p, (i == (ring_size - 1)));
+ p++;
+ }
+@@ -164,6 +165,7 @@ static void ndesc_set_tx_owner(struct dma_desc *p)
+
+ static void ndesc_set_rx_owner(struct dma_desc *p)
+ {
++ p->des01.all_flags = 0;
+ p->des01.rx.own = 1;
+ }
+
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 9bdfaba4e308..88c8645e2f52 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -424,19 +424,17 @@ static void init_dma_desc_rings(struct net_device *dev)
+ priv->rx_skbuff =
+ kmalloc(sizeof(struct sk_buff *) * rxsize, GFP_KERNEL);
+ priv->dma_rx =
+- (struct dma_desc *)dma_alloc_coherent(priv->device,
+- rxsize *
+- sizeof(struct dma_desc),
+- &priv->dma_rx_phy,
+- GFP_KERNEL);
++ (struct dma_desc *)dma_zalloc_coherent(priv->device, rxsize *
++ sizeof(struct dma_desc),
++ &priv->dma_rx_phy,
++ GFP_KERNEL);
+ priv->tx_skbuff = kmalloc(sizeof(struct sk_buff *) * txsize,
+ GFP_KERNEL);
+ priv->dma_tx =
+- (struct dma_desc *)dma_alloc_coherent(priv->device,
+- txsize *
+- sizeof(struct dma_desc),
+- &priv->dma_tx_phy,
+- GFP_KERNEL);
++ (struct dma_desc *)dma_zalloc_coherent(priv->device, txsize *
++ sizeof(struct dma_desc),
++ &priv->dma_tx_phy,
++ GFP_KERNEL);
+
+ if ((priv->dma_rx == NULL) || (priv->dma_tx == NULL)) {
+ pr_err("%s:ERROR allocating the DMA Tx/Rx desc\n", __func__);
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index ef2605683de7..7e7bd1570526 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -235,7 +235,7 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
+ {
+ struct ath_hw *ah = sc->sc_ah;
+ struct ath_common *common = ath9k_hw_common(ah);
+- bool ret;
++ bool ret = true;
+
+ ieee80211_stop_queues(sc->hw);
+
+@@ -245,10 +245,13 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
+ ath9k_debug_samp_bb_mac(sc);
+ ath9k_hw_disable_interrupts(ah);
+
+- ret = ath_drain_all_txq(sc, retry_tx);
+-
+- if (!ath_stoprecv(sc))
+- ret = false;
++ if (AR_SREV_9300_20_OR_LATER(ah)) {
++ ret &= ath_stoprecv(sc);
++ ret &= ath_drain_all_txq(sc, retry_tx);
++ } else {
++ ret &= ath_drain_all_txq(sc, retry_tx);
++ ret &= ath_stoprecv(sc);
++ }
+
+ if (!flush) {
+ if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
+index d66e2980bc27..414ac49af480 100644
+--- a/drivers/net/wireless/rndis_wlan.c
++++ b/drivers/net/wireless/rndis_wlan.c
+@@ -407,9 +407,9 @@ struct ndis_80211_pmkid {
+ #define CAP_MODE_80211G 4
+ #define CAP_MODE_MASK 7
+
+-#define WORK_LINK_UP (1<<0)
+-#define WORK_LINK_DOWN (1<<1)
+-#define WORK_SET_MULTICAST_LIST (1<<2)
++#define WORK_LINK_UP 0
++#define WORK_LINK_DOWN 1
++#define WORK_SET_MULTICAST_LIST 2
+
+ #define RNDIS_WLAN_ALG_NONE 0
+ #define RNDIS_WLAN_ALG_WEP (1<<0)
+diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
+index 615a45a8fe86..582688fe7505 100644
+--- a/drivers/pcmcia/topic.h
++++ b/drivers/pcmcia/topic.h
+@@ -104,6 +104,9 @@
+ #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */
+ #define TOPIC_EXCA_IFC_33V_ENA 0x01
+
++#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */
++#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400
++
+ static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
+ {
+ struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
+@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
+ static int topic95_override(struct yenta_socket *socket)
+ {
+ u8 fctrl;
++ u16 ppbcn;
+
+ /* enable 3.3V support for 16bit cards */
+ fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
+@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
+ /* tell yenta to use exca registers to power 16bit cards */
+ socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
+
++ /* Disable write buffers to prevent lockups under load with numerous
++ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
++ net. This is not a power-on default according to the datasheet
++ but some BIOSes seem to set it. */
++ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
++ && socket->dev->revision <= 7
++ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
++ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
++ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
++ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
++ }
++
+ return 0;
+ }
+
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index e6c08ee8d46c..3d6759179f1c 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -216,7 +216,6 @@ static struct dmi_system_id __devinitdata dell_quirks[] = {
+ };
+
+ static struct calling_interface_buffer *buffer;
+-static struct page *bufferpage;
+ static DEFINE_MUTEX(buffer_mutex);
+
+ static int hwswitch_state;
+@@ -714,11 +713,10 @@ static int __init dell_init(void)
+ * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
+ * is passed to SMI handler.
+ */
+- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
++ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
+
+- if (!bufferpage)
++ if (!buffer)
+ goto fail_buffer;
+- buffer = page_address(bufferpage);
+
+ ret = dell_setup_rfkill();
+
+@@ -787,7 +785,7 @@ fail_backlight:
+ fail_filter:
+ dell_cleanup_rfkill();
+ fail_rfkill:
+- free_page((unsigned long)bufferpage);
++ free_page((unsigned long)buffer);
+ fail_buffer:
+ platform_device_del(platform_device);
+ fail_platform_device2:
+diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
+index ac902f7a9baa..34e9fcfc63d6 100644
+--- a/drivers/platform/x86/ideapad-laptop.c
++++ b/drivers/platform/x86/ideapad-laptop.c
+@@ -407,7 +407,8 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
+
+ static int ideapad_rfk_set(void *data, bool blocked)
+ {
+- unsigned long opcode = (unsigned long)data;
++ unsigned long dev = (unsigned long)data;
++ int opcode = ideapad_rfk_data[dev].opcode;
+
+ return write_ec_cmd(ideapad_handle, opcode, !blocked);
+ }
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 0d71557cf7a3..c8f160db9d0e 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -749,7 +749,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
+ static void print_constraints(struct regulator_dev *rdev)
+ {
+ struct regulation_constraints *constraints = rdev->constraints;
+- char buf[80] = "";
++ char buf[160] = "";
+ int count = 0;
+ int ret;
+
+diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
+index 153b8bd91d1e..19ff8b2bbf36 100644
+--- a/drivers/scsi/ipr.h
++++ b/drivers/scsi/ipr.h
+@@ -251,7 +251,7 @@
+ #define IPR_RUNTIME_RESET 0x40000000
+
+ #define IPR_IPL_INIT_MIN_STAGE_TIME 5
+-#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15
++#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30
+ #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0
+ #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000
+ #define IPR_IPL_INIT_STAGE_MASK 0xff000000
+diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
+index 887a80709ab8..549b8ab24d0f 100644
+--- a/drivers/staging/rtl8712/rtl8712_recv.c
++++ b/drivers/staging/rtl8712/rtl8712_recv.c
+@@ -1074,7 +1074,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
+ /* for first fragment packet, driver need allocate 1536 +
+ * drvinfo_sz + RXDESC_SIZE to defrag packet. */
+ if ((mf == 1) && (frag == 0))
+- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
++ /*1658+6=1664, 1664 is 128 alignment.*/
++ alloc_sz = max_t(u16, tmp_len, 1658);
+ else
+ alloc_sz = tmp_len;
+ /* 2 is for IP header 4 bytes alignment in QoS packet case.
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index ff58d288c9c8..85c28e325c95 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -229,8 +229,7 @@ void atmel_config_rs485(struct uart_port *port, struct serial_rs485 *rs485conf)
+ if (rs485conf->flags & SER_RS485_ENABLED) {
+ dev_dbg(port->dev, "Setting UART to RS485\n");
+ atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
+- if ((rs485conf->delay_rts_after_send) > 0)
+- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
++ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
+ mode |= ATMEL_US_USMODE_RS485;
+ } else {
+ dev_dbg(port->dev, "Setting UART to RS232\n");
+@@ -305,9 +304,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
+
+ if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+ dev_dbg(port->dev, "Setting UART to RS485\n");
+- if ((atmel_port->rs485.delay_rts_after_send) > 0)
+- UART_PUT_TTGR(port,
+- atmel_port->rs485.delay_rts_after_send);
++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send);
+ mode |= ATMEL_US_USMODE_RS485;
+ } else {
+ dev_dbg(port->dev, "Setting UART to RS232\n");
+@@ -1239,9 +1236,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
+
+ if (atmel_port->rs485.flags & SER_RS485_ENABLED) {
+ dev_dbg(port->dev, "Setting UART to RS485\n");
+- if ((atmel_port->rs485.delay_rts_after_send) > 0)
+- UART_PUT_TTGR(port,
+- atmel_port->rs485.delay_rts_after_send);
++ UART_PUT_TTGR(port, atmel_port->rs485.delay_rts_after_send);
+ mode |= ATMEL_US_USMODE_RS485;
+ } else {
+ dev_dbg(port->dev, "Setting UART to RS232\n");
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 93f2538b16cc..62ea924dee1c 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -2176,9 +2176,6 @@ static unsigned hub_is_wusb(struct usb_hub *hub)
+ #define HUB_LONG_RESET_TIME 200
+ #define HUB_RESET_TIMEOUT 800
+
+-static int hub_port_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, unsigned int delay, bool warm);
+-
+ /* Is a USB 3.0 port in the Inactive or Complinance Mode state?
+ * Port worm reset is required to recover
+ */
+@@ -2258,44 +2255,6 @@ delay:
+ return -EBUSY;
+ }
+
+-static void hub_port_finish_reset(struct usb_hub *hub, int port1,
+- struct usb_device *udev, int *status)
+-{
+- switch (*status) {
+- case 0:
+- /* TRSTRCY = 10 ms; plus some extra */
+- msleep(10 + 40);
+- if (udev) {
+- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
+-
+- update_devnum(udev, 0);
+- /* The xHC may think the device is already reset,
+- * so ignore the status.
+- */
+- if (hcd->driver->reset_device)
+- hcd->driver->reset_device(hcd, udev);
+- }
+- /* FALL THROUGH */
+- case -ENOTCONN:
+- case -ENODEV:
+- clear_port_feature(hub->hdev,
+- port1, USB_PORT_FEAT_C_RESET);
+- if (hub_is_superspeed(hub->hdev)) {
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_BH_PORT_RESET);
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_PORT_LINK_STATE);
+- clear_port_feature(hub->hdev, port1,
+- USB_PORT_FEAT_C_CONNECTION);
+- }
+- if (udev)
+- usb_set_device_state(udev, *status
+- ? USB_STATE_NOTATTACHED
+- : USB_STATE_DEFAULT);
+- break;
+- }
+-}
+-
+ /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
+ static int hub_port_reset(struct usb_hub *hub, int port1,
+ struct usb_device *udev, unsigned int delay, bool warm)
+@@ -2318,13 +2277,9 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ * If the caller hasn't explicitly requested a warm reset,
+ * double check and see if one is needed.
+ */
+- status = hub_port_status(hub, port1,
+- &portstatus, &portchange);
+- if (status < 0)
+- goto done;
+-
+- if (hub_port_warm_reset_required(hub, portstatus))
+- warm = true;
++ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
++ if (hub_port_warm_reset_required(hub, portstatus))
++ warm = true;
+ }
+
+ /* Reset the port */
+@@ -2347,11 +2302,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+
+ /* Check for disconnect or reset */
+ if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
+- hub_port_finish_reset(hub, port1, udev, &status);
++ clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_RESET);
+
+ if (!hub_is_superspeed(hub->hdev))
+ goto done;
+
++ clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_BH_PORT_RESET);
++ clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_PORT_LINK_STATE);
++ clear_port_feature(hub->hdev, port1,
++ USB_PORT_FEAT_C_CONNECTION);
++
+ /*
+ * If a USB 3.0 device migrates from reset to an error
+ * state, re-issue the warm reset.
+@@ -2385,6 +2348,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
+ port1);
+
+ done:
++ if (status == 0) {
++ /* TRSTRCY = 10 ms; plus some extra */
++ msleep(10 + 40);
++ if (udev) {
++ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
++
++ update_devnum(udev, 0);
++ /* The xHC may think the device is already reset,
++ * so ignore the status.
++ */
++ if (hcd->driver->reset_device)
++ hcd->driver->reset_device(hcd, udev);
++
++ usb_set_device_state(udev, USB_STATE_DEFAULT);
++ }
++ } else {
++ if (udev)
++ usb_set_device_state(udev, USB_STATE_NOTATTACHED);
++ }
++
+ if (!hub_is_superspeed(hub->hdev))
+ up_read(&ehci_cf_port_reset_rwsem);
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 8a7a8ee176fa..a8714fd5ffe2 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -644,6 +644,10 @@ static void dwc3_ep0_xfer_complete(struct dwc3 *dwc,
+ dev_vdbg(dwc->dev, "Status Phase\n");
+ dwc3_ep0_complete_req(dwc, event);
+ break;
++ case USB_REQ_SET_INTERFACE:
++ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
++ dwc->start_config_issued = false;
++ /* Fall through */
+ default:
+ WARN(true, "UNKNOWN ep0state %d\n", dwc->ep0state);
+ }
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index b7f89268c0f4..b43c6f90b25f 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -301,6 +301,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ if (!(reg & DWC3_DEPCMD_CMDACT)) {
+ dev_vdbg(dwc->dev, "Command Complete --> %d\n",
+ DWC3_DEPCMD_STATUS(reg));
++ if (DWC3_DEPCMD_STATUS(reg))
++ return -EINVAL;
+ return 0;
+ }
+
+diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
+index 8285d65cd207..c080be52f4e9 100644
+--- a/drivers/watchdog/omap_wdt.c
++++ b/drivers/watchdog/omap_wdt.c
+@@ -152,6 +152,13 @@ static int omap_wdt_open(struct inode *inode, struct file *file)
+
+ pm_runtime_get_sync(wdev->dev);
+
++ /*
++ * Make sure the watchdog is disabled. This is unfortunately required
++ * because writing to various registers with the watchdog running has no
++ * effect.
++ */
++ omap_wdt_disable(wdev);
++
+ /* initialize prescaler */
+ while (__raw_readl(base + OMAP_WATCHDOG_WPS) & 0x01)
+ cpu_relax();
+diff --git a/fs/dcache.c b/fs/dcache.c
+index d071ea768057..03eb2c2a7e5b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2518,6 +2518,8 @@ static int prepend_path(const struct path *path,
+ struct dentry *dentry = path->dentry;
+ struct vfsmount *vfsmnt = path->mnt;
+ struct mount *mnt = real_mount(vfsmnt);
++ char *orig_buffer = *buffer;
++ int orig_len = *buflen;
+ bool slash = false;
+ int error = 0;
+
+@@ -2525,6 +2527,14 @@ static int prepend_path(const struct path *path,
+ struct dentry * parent;
+
+ if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
++ /* Escaped? */
++ if (dentry != vfsmnt->mnt_root) {
++ *buffer = orig_buffer;
++ *buflen = orig_len;
++ slash = false;
++ error = 3;
++ goto global_root;
++ }
+ /* Global root? */
+ if (!mnt_has_parent(mnt))
+ goto global_root;
+diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
+index 6dc6153dc462..f819837aa193 100644
+--- a/fs/ext4/indirect.c
++++ b/fs/ext4/indirect.c
+@@ -705,7 +705,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
+ EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
+ EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
+ "non-extent mapped inodes with bigalloc");
+- return -ENOSPC;
++ return -EUCLEAN;
+ }
+
+ goal = ext4_find_goal(inode, map->m_lblk, partial);
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 9e9db425c613..facf1cf46eee 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -1848,18 +1848,32 @@ static int __ext4_journalled_writepage(struct page *page,
+ page_bufs = page_buffers(page);
+ BUG_ON(!page_bufs);
+ walk_page_buffers(handle, page_bufs, 0, len, NULL, bget_one);
+- /* As soon as we unlock the page, it can go away, but we have
+- * references to buffers so we are safe */
++ /*
++ * We need to release the page lock before we start the
++ * journal, so grab a reference so the page won't disappear
++ * out from under us.
++ */
++ get_page(page);
+ unlock_page(page);
+
+ handle = ext4_journal_start(inode, ext4_writepage_trans_blocks(inode));
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+- goto out;
++ put_page(page);
++ goto out_no_pagelock;
+ }
+
+ BUG_ON(!ext4_handle_valid(handle));
+
++ lock_page(page);
++ put_page(page);
++ if (page->mapping != mapping) {
++ /* The page got truncated from under us */
++ ext4_journal_stop(handle);
++ ret = 0;
++ goto out;
++ }
++
+ ret = walk_page_buffers(handle, page_bufs, 0, len, NULL,
+ do_journal_get_write_access);
+
+@@ -1875,6 +1889,8 @@ static int __ext4_journalled_writepage(struct page *page,
+ walk_page_buffers(handle, page_bufs, 0, len, NULL, bput_one);
+ ext4_set_inode_state(inode, EXT4_STATE_JDATA);
+ out:
++ unlock_page(page);
++out_no_pagelock:
+ return ret;
+ }
+
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 92ea560efcc7..2e26a542c818 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -888,6 +888,7 @@ static void ext4_put_super(struct super_block *sb)
+ dump_orphan_list(sb, sbi);
+ J_ASSERT(list_empty(&sbi->s_orphan));
+
++ sync_blockdev(sb->s_bdev);
+ invalidate_bdev(sb->s_bdev);
+ if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
+ /*
+diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
+index a5c8b343a156..d8bc0a881f9f 100644
+--- a/fs/fuse/inode.c
++++ b/fs/fuse/inode.c
+@@ -981,6 +981,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
+ goto err_fput;
+
+ fuse_conn_init(fc);
++ fc->release = fuse_free_conn;
+
+ fc->dev = sb->s_dev;
+ fc->sb = sb;
+@@ -995,7 +996,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
+ fc->dont_mask = 1;
+ sb->s_flags |= MS_POSIXACL;
+
+- fc->release = fuse_free_conn;
+ fc->flags = d.flags;
+ fc->user_id = d.user_id;
+ fc->group_id = d.group_id;
+diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
+index c78841ee81cf..4fd78565988d 100644
+--- a/fs/jbd2/checkpoint.c
++++ b/fs/jbd2/checkpoint.c
+@@ -440,7 +440,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ unsigned long blocknr;
+
+ if (is_journal_aborted(journal))
+- return 1;
++ return -EIO;
+
+ if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
+ return 1;
+@@ -455,10 +455,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ * jbd2_cleanup_journal_tail() doesn't get called all that often.
+ */
+ if (journal->j_flags & JBD2_BARRIER)
+- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
++ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
+
+- __jbd2_update_log_tail(journal, first_tid, blocknr);
+- return 0;
++ return __jbd2_update_log_tail(journal, first_tid, blocknr);
+ }
+
+
+@@ -468,14 +467,14 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
+ * journal_clean_one_cp_list
+ *
+ * Find all the written-back checkpoint buffers in the given list and
+- * release them.
++ * release them. If 'destroy' is set, clean all buffers unconditionally.
+ *
+ * Called with the journal locked.
+ * Called with j_list_lock held.
+ * Returns number of buffers reaped (for debug)
+ */
+
+-static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
++static int journal_clean_one_cp_list(struct journal_head *jh, int *released, bool destroy)
+ {
+ struct journal_head *last_jh;
+ struct journal_head *next_jh = jh;
+@@ -489,7 +488,10 @@ static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
+ do {
+ jh = next_jh;
+ next_jh = jh->b_cpnext;
+- ret = __try_to_free_cp_buf(jh);
++ if (!destroy)
++ ret = __try_to_free_cp_buf(jh);
++ else
++ ret = __jbd2_journal_remove_checkpoint(jh) + 1;
+ if (ret) {
+ freed++;
+ if (ret == 2) {
+@@ -515,12 +517,14 @@ static int journal_clean_one_cp_list(struct journal_head *jh, int *released)
+ *
+ * Find all the written-back checkpoint buffers in the journal and release them.
+ *
++ * If 'destroy' is set, release all buffers unconditionally.
++ *
+ * Called with the journal locked.
+ * Called with j_list_lock held.
+ * Returns number of buffers reaped (for debug)
+ */
+
+-int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
++int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy)
+ {
+ transaction_t *transaction, *last_transaction, *next_transaction;
+ int ret = 0;
+@@ -536,7 +540,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+ transaction = next_transaction;
+ next_transaction = transaction->t_cpnext;
+ ret += journal_clean_one_cp_list(transaction->
+- t_checkpoint_list, &released);
++ t_checkpoint_list, &released, destroy);
+ /*
+ * This function only frees up some memory if possible so we
+ * dont have an obligation to finish processing. Bail out if
+@@ -552,7 +556,7 @@ int __jbd2_journal_clean_checkpoint_list(journal_t *journal)
+ * we can possibly see not yet submitted buffers on io_list
+ */
+ ret += journal_clean_one_cp_list(transaction->
+- t_checkpoint_io_list, &released);
++ t_checkpoint_io_list, &released, destroy);
+ if (need_resched())
+ goto out;
+ } while (transaction != last_transaction);
+@@ -561,6 +565,28 @@ out:
+ }
+
+ /*
++ * Remove buffers from all checkpoint lists as journal is aborted and we just
++ * need to free memory
++ */
++void jbd2_journal_destroy_checkpoint(journal_t *journal)
++{
++ /*
++ * We loop because __jbd2_journal_clean_checkpoint_list() may abort
++ * early due to a need of rescheduling.
++ */
++ while (1) {
++ spin_lock(&journal->j_list_lock);
++ if (!journal->j_checkpoint_transactions) {
++ spin_unlock(&journal->j_list_lock);
++ break;
++ }
++ __jbd2_journal_clean_checkpoint_list(journal, true);
++ spin_unlock(&journal->j_list_lock);
++ cond_resched();
++ }
++}
++
++/*
+ * journal_remove_checkpoint: called after a buffer has been committed
+ * to disk (either by being write-back flushed to disk, or being
+ * committed to the log).
+diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
+index a0dcbd62b180..259f28dfc652 100644
+--- a/fs/jbd2/commit.c
++++ b/fs/jbd2/commit.c
+@@ -438,7 +438,7 @@ void jbd2_journal_commit_transaction(journal_t *journal)
+ * frees some memory
+ */
+ spin_lock(&journal->j_list_lock);
+- __jbd2_journal_clean_checkpoint_list(journal);
++ __jbd2_journal_clean_checkpoint_list(journal, false);
+ spin_unlock(&journal->j_list_lock);
+
+ jbd_debug(3, "JBD2: commit phase 1\n");
+diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
+index f6974688e89f..a3279442bf30 100644
+--- a/fs/jbd2/journal.c
++++ b/fs/jbd2/journal.c
+@@ -823,9 +823,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ *
+ * Requires j_checkpoint_mutex
+ */
+-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ {
+ unsigned long freed;
++ int ret;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+
+@@ -835,7 +836,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ * space and if we lose sb update during power failure we'd replay
+ * old transaction with possibly newly overwritten data.
+ */
+- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
++ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
++ if (ret)
++ goto out;
++
+ write_lock(&journal->j_state_lock);
+ freed = block - journal->j_tail;
+ if (block < journal->j_tail)
+@@ -851,6 +855,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
+ journal->j_tail_sequence = tid;
+ journal->j_tail = block;
+ write_unlock(&journal->j_state_lock);
++
++out:
++ return ret;
+ }
+
+ /*
+@@ -1264,7 +1271,7 @@ static int journal_reset(journal_t *journal)
+ return jbd2_journal_start_thread(journal);
+ }
+
+-static void jbd2_write_superblock(journal_t *journal, int write_op)
++static int jbd2_write_superblock(journal_t *journal, int write_op)
+ {
+ struct buffer_head *bh = journal->j_sb_buffer;
+ int ret;
+@@ -1301,7 +1308,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
+ printk(KERN_ERR "JBD2: Error %d detected when updating "
+ "journal superblock for %s.\n", ret,
+ journal->j_devname);
++ jbd2_journal_abort(journal, ret);
+ }
++
++ return ret;
+ }
+
+ /**
+@@ -1314,10 +1324,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
+ * Update a journal's superblock information about log tail and write it to
+ * disk, waiting for the IO to complete.
+ */
+-void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
++int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ unsigned long tail_block, int write_op)
+ {
+ journal_superblock_t *sb = journal->j_superblock;
++ int ret;
+
+ BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
+ jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
+@@ -1326,13 +1337,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
+ sb->s_sequence = cpu_to_be32(tail_tid);
+ sb->s_start = cpu_to_be32(tail_block);
+
+- jbd2_write_superblock(journal, write_op);
++ ret = jbd2_write_superblock(journal, write_op);
++ if (ret)
++ goto out;
+
+ /* Log is no longer empty */
+ write_lock(&journal->j_state_lock);
+ WARN_ON(!sb->s_sequence);
+ journal->j_flags &= ~JBD2_FLUSHED;
+ write_unlock(&journal->j_state_lock);
++
++out:
++ return ret;
+ }
+
+ /**
+@@ -1575,8 +1591,17 @@ int jbd2_journal_destroy(journal_t *journal)
+ while (journal->j_checkpoint_transactions != NULL) {
+ spin_unlock(&journal->j_list_lock);
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_log_do_checkpoint(journal);
++ err = jbd2_log_do_checkpoint(journal);
+ mutex_unlock(&journal->j_checkpoint_mutex);
++ /*
++ * If checkpointing failed, just free the buffers to avoid
++ * looping forever
++ */
++ if (err) {
++ jbd2_journal_destroy_checkpoint(journal);
++ spin_lock(&journal->j_list_lock);
++ break;
++ }
+ spin_lock(&journal->j_list_lock);
+ }
+
+@@ -1785,7 +1810,14 @@ int jbd2_journal_flush(journal_t *journal)
+ return -EIO;
+
+ mutex_lock(&journal->j_checkpoint_mutex);
+- jbd2_cleanup_journal_tail(journal);
++ if (!err) {
++ err = jbd2_cleanup_journal_tail(journal);
++ if (err < 0) {
++ mutex_unlock(&journal->j_checkpoint_mutex);
++ goto out;
++ }
++ err = 0;
++ }
+
+ /* Finally, mark the journal as really needing no recovery.
+ * This sets s_start==0 in the underlying superblock, which is
+@@ -1801,7 +1833,8 @@ int jbd2_journal_flush(journal_t *journal)
+ J_ASSERT(journal->j_head == journal->j_tail);
+ J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
+ write_unlock(&journal->j_state_lock);
+- return 0;
++out:
++ return err;
+ }
+
+ /**
+diff --git a/fs/namei.c b/fs/namei.c
+index 9c4b9b811d7b..4fc034ffd209 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -397,6 +397,24 @@ void path_put(struct path *path)
+ }
+ EXPORT_SYMBOL(path_put);
+
++/**
++ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
++ * @path: nameidate to verify
++ *
++ * Rename can sometimes move a file or directory outside of a bind
++ * mount, path_connected allows those cases to be detected.
++ */
++static bool path_connected(const struct path *path)
++{
++ struct vfsmount *mnt = path->mnt;
++
++ /* Only bind mounts can have disconnected paths */
++ if (mnt->mnt_root == mnt->mnt_sb->s_root)
++ return true;
++
++ return is_subdir(path->dentry, mnt->mnt_root);
++}
++
+ /*
+ * Path walking has 2 modes, rcu-walk and ref-walk (see
+ * Documentation/filesystems/path-lookup.txt). In situations when we can't
+@@ -945,6 +963,8 @@ static int follow_dotdot_rcu(struct nameidata *nd)
+ goto failed;
+ nd->path.dentry = parent;
+ nd->seq = seq;
++ if (unlikely(!path_connected(&nd->path)))
++ goto failed;
+ break;
+ }
+ if (!follow_up_rcu(&nd->path))
+@@ -1029,7 +1049,7 @@ static void follow_mount(struct path *path)
+ }
+ }
+
+-static void follow_dotdot(struct nameidata *nd)
++static int follow_dotdot(struct nameidata *nd)
+ {
+ if (!nd->root.mnt)
+ set_root(nd);
+@@ -1045,6 +1065,10 @@ static void follow_dotdot(struct nameidata *nd)
+ /* rare case of legitimate dget_parent()... */
+ nd->path.dentry = dget_parent(nd->path.dentry);
+ dput(old);
++ if (unlikely(!path_connected(&nd->path))) {
++ path_put(&nd->path);
++ return -ENOENT;
++ }
+ break;
+ }
+ if (!follow_up(&nd->path))
+@@ -1052,6 +1076,7 @@ static void follow_dotdot(struct nameidata *nd)
+ }
+ follow_mount(&nd->path);
+ nd->inode = nd->path.dentry->d_inode;
++ return 0;
+ }
+
+ /*
+@@ -1252,7 +1277,7 @@ static inline int handle_dots(struct nameidata *nd, int type)
+ if (follow_dotdot_rcu(nd))
+ return -ECHILD;
+ } else
+- follow_dotdot(nd);
++ return follow_dotdot(nd);
+ }
+ return 0;
+ }
+diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
+index a77cc9a3ce55..e60bbe2ff5a8 100644
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -1333,7 +1333,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
+ if (args->npages != 0)
+ xdr_write_pages(xdr, args->pages, 0, args->len);
+ else
+- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
++ xdr_reserve_space(xdr, args->len);
+
+ error = nfsacl_encode(xdr->buf, base, args->inode,
+ (args->mask & NFS_ACL) ?
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index c4600b59744a..282af88fedaa 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1279,6 +1279,8 @@ restart:
+ }
+ spin_unlock(&state->state_lock);
+ nfs4_put_open_state(state);
++ clear_bit(NFS_STATE_RECLAIM_NOGRACE,
++ &state->flags);
+ goto restart;
+ }
+ }
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index 6d52429f80bc..0460073bb726 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -495,6 +495,7 @@ typedef u64 acpi_integer;
+ #define ACPI_NO_ACPI_ENABLE 0x10
+ #define ACPI_NO_DEVICE_INIT 0x20
+ #define ACPI_NO_OBJECT_INIT 0x40
++#define ACPI_NO_FACS_INIT 0x80
+
+ /*
+ * Initialization state
+diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
+index 2ffbf9938a31..2179d78b6ea6 100644
+--- a/include/linux/jbd2.h
++++ b/include/linux/jbd2.h
+@@ -974,15 +974,16 @@ extern struct journal_head * jbd2_journal_get_descriptor_buffer(journal_t *);
+ int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
+ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
+ unsigned long *block);
+-void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
++int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+ void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
+
+ /* Commit management */
+ extern void jbd2_journal_commit_transaction(journal_t *);
+
+ /* Checkpoint list management */
+-int __jbd2_journal_clean_checkpoint_list(journal_t *journal);
++int __jbd2_journal_clean_checkpoint_list(journal_t *journal, bool destroy);
+ int __jbd2_journal_remove_checkpoint(struct journal_head *);
++void jbd2_journal_destroy_checkpoint(journal_t *journal);
+ void __jbd2_journal_insert_checkpoint(struct journal_head *, transaction_t *);
+
+
+@@ -1093,7 +1094,7 @@ extern int jbd2_journal_recover (journal_t *journal);
+ extern int jbd2_journal_wipe (journal_t *, int);
+ extern int jbd2_journal_skip_recovery (journal_t *);
+ extern void jbd2_journal_update_sb_errno(journal_t *);
+-extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
++extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
+ unsigned long, int);
+ extern void __jbd2_journal_abort_hard (journal_t *);
+ extern void jbd2_journal_abort (journal_t *, int);
+diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
+index 7ba3551a0414..845b40246413 100644
+--- a/include/linux/nfs_xdr.h
++++ b/include/linux/nfs_xdr.h
+@@ -1061,7 +1061,7 @@ struct nfstime4 {
+ };
+
+ #ifdef CONFIG_NFS_V4_1
+-#define NFS4_EXCHANGE_ID_LEN (48)
++#define NFS4_EXCHANGE_ID_LEN (127)
+ struct nfs41_exchange_id_args {
+ struct nfs_client *client;
+ nfs4_verifier *verifier;
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index 88949a994538..4ea0ec64eada 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -209,6 +209,7 @@ extern struct sctp_globals {
+ struct list_head addr_waitq;
+ struct timer_list addr_wq_timer;
+ struct list_head auto_asconf_splist;
++ /* Lock that protects both addr_waitq and auto_asconf_splist */
+ spinlock_t addr_wq_lock;
+
+ /* Lock that protects the local_addr_list writers */
+@@ -355,6 +356,10 @@ struct sctp_sock {
+ atomic_t pd_mode;
+ /* Receive to here while partial delivery is in effect. */
+ struct sk_buff_head pd_lobby;
++
++ /* These must be the last fields, as they will skipped on copies,
++ * like on accept and peeloff operations
++ */
+ struct list_head auto_asconf_list;
+ int do_auto_asconf;
+ };
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index 434f2b673d5b..34031a0ae53f 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -853,6 +853,9 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
+ if (delta.tv64 < 0)
+ return 0;
+
++ if (WARN_ON(timer->state & HRTIMER_STATE_ENQUEUED))
++ return 0;
++
+ if (interval.tv64 < timer->base->resolution.tv64)
+ interval.tv64 = timer->base->resolution.tv64;
+
+@@ -1265,11 +1268,14 @@ static void __run_hrtimer(struct hrtimer *timer, ktime_t *now)
+ * Note: We clear the CALLBACK bit after enqueue_hrtimer and
+ * we do not reprogramm the event hardware. Happens either in
+ * hrtimer_start_range_ns() or in hrtimer_interrupt()
++ *
++ * Note: Because we dropped the cpu_base->lock above,
++ * hrtimer_start_range_ns() can have popped in and enqueued the timer
++ * for us already.
+ */
+- if (restart != HRTIMER_NORESTART) {
+- BUG_ON(timer->state != HRTIMER_STATE_CALLBACK);
++ if (restart != HRTIMER_NORESTART &&
++ !(timer->state & HRTIMER_STATE_ENQUEUED))
+ enqueue_hrtimer(timer, base);
+- }
+
+ WARN_ON_ONCE(!(timer->state & HRTIMER_STATE_CALLBACK));
+
+diff --git a/kernel/rcutiny.c b/kernel/rcutiny.c
+index 37a5444204d2..60a56f4331a6 100644
+--- a/kernel/rcutiny.c
++++ b/kernel/rcutiny.c
+@@ -279,6 +279,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
+
+ /* Move the ready-to-invoke callbacks to a local list. */
+ local_irq_save(flags);
++ if (rcp->donetail == &rcp->rcucblist) {
++ /* No callbacks ready, so just leave. */
++ local_irq_restore(flags);
++ return;
++ }
+ RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
+ list = rcp->rcucblist;
+ rcp->rcucblist = *rcp->donetail;
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 3b04aec58700..096d774ac31c 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1044,6 +1044,9 @@ static void parse_init(struct filter_parse_state *ps,
+
+ static char infix_next(struct filter_parse_state *ps)
+ {
++ if (!ps->infix.cnt)
++ return 0;
++
+ ps->infix.cnt--;
+
+ return ps->infix.string[ps->infix.tail++];
+@@ -1059,6 +1062,9 @@ static char infix_peek(struct filter_parse_state *ps)
+
+ static void infix_advance(struct filter_parse_state *ps)
+ {
++ if (!ps->infix.cnt)
++ return;
++
+ ps->infix.cnt--;
+ ps->infix.tail++;
+ }
+@@ -1372,7 +1378,9 @@ static int check_preds(struct filter_parse_state *ps)
+ }
+ cnt--;
+ n_normal_preds++;
+- WARN_ON_ONCE(cnt < 0);
++ /* all ops should have operands */
++ if (cnt < 0)
++ break;
+ }
+
+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index 6ccf2120b406..f62496a20f27 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
+ unsigned a, b;
+ int c, old_c, totaldigits;
+ const char __user __force *ubuf = (const char __user __force *)buf;
+- int exp_digit, in_range;
++ int at_start, in_range;
+
+ totaldigits = c = 0;
+ bitmap_zero(maskp, nmaskbits);
+ do {
+- exp_digit = 1;
++ at_start = 1;
+ in_range = 0;
+ a = b = 0;
+
+@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
+ break;
+
+ if (c == '-') {
+- if (exp_digit || in_range)
++ if (at_start || in_range)
+ return -EINVAL;
+ b = 0;
+ in_range = 1;
+- exp_digit = 1;
+ continue;
+ }
+
+@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
+ b = b * 10 + (c - '0');
+ if (!in_range)
+ a = b;
+- exp_digit = 0;
++ at_start = 0;
+ totaldigits++;
+ }
+ if (!(a <= b))
+ return -EINVAL;
+ if (b >= nmaskbits)
+ return -ERANGE;
+- while (a <= b) {
+- set_bit(a, maskp);
+- a++;
++ if (!at_start) {
++ while (a <= b) {
++ set_bit(a, maskp);
++ a++;
++ }
+ }
+ } while (buflen && c == ',');
+ return 0;
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index ad6ee88a3d48..c74827c5ba78 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -193,6 +193,8 @@ static struct kmem_cache *scan_area_cache;
+
+ /* set if tracing memory operations is enabled */
+ static atomic_t kmemleak_enabled = ATOMIC_INIT(0);
++/* same as above but only for the kmemleak_free() callback */
++static int kmemleak_free_enabled;
+ /* set in the late_initcall if there were no errors */
+ static atomic_t kmemleak_initialized = ATOMIC_INIT(0);
+ /* enables or disables early logging of the memory operations */
+@@ -936,7 +938,7 @@ void __ref kmemleak_free(const void *ptr)
+ {
+ pr_debug("%s(0x%p)\n", __func__, ptr);
+
+- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr))
++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
+ delete_object_full((unsigned long)ptr);
+ else if (atomic_read(&kmemleak_early_log))
+ log_early(KMEMLEAK_FREE, ptr, 0, 0);
+@@ -976,7 +978,7 @@ void __ref kmemleak_free_percpu(const void __percpu *ptr)
+
+ pr_debug("%s(0x%p)\n", __func__, ptr);
+
+- if (atomic_read(&kmemleak_enabled) && ptr && !IS_ERR(ptr))
++ if (kmemleak_free_enabled && ptr && !IS_ERR(ptr))
+ for_each_possible_cpu(cpu)
+ delete_object_full((unsigned long)per_cpu_ptr(ptr,
+ cpu));
+@@ -1690,6 +1692,13 @@ static void kmemleak_do_cleanup(struct work_struct *work)
+ mutex_lock(&scan_mutex);
+ stop_scan_thread();
+
++ /*
++ * Once the scan thread has stopped, it is safe to no longer track
++ * object freeing. Ordering of the scan thread stopping and the memory
++ * accesses below is guaranteed by the kthread_stop() function.
++ */
++ kmemleak_free_enabled = 0;
++
+ if (cleanup) {
+ rcu_read_lock();
+ list_for_each_entry_rcu(object, &object_list, object_list)
+@@ -1717,6 +1726,8 @@ static void kmemleak_disable(void)
+ /* check whether it is too early for a kernel thread */
+ if (atomic_read(&kmemleak_initialized))
+ schedule_work(&cleanup_work);
++ else
++ kmemleak_free_enabled = 0;
+
+ pr_info("Kernel memory leak detector disabled\n");
+ }
+@@ -1782,8 +1793,10 @@ void __init kmemleak_init(void)
+ if (atomic_read(&kmemleak_error)) {
+ local_irq_restore(flags);
+ return;
+- } else
++ } else {
+ atomic_set(&kmemleak_enabled, 1);
++ kmemleak_free_enabled = 1;
++ }
+ local_irq_restore(flags);
+
+ /*
+diff --git a/net/9p/client.c b/net/9p/client.c
+index b23a17c431c8..32df0a3de277 100644
+--- a/net/9p/client.c
++++ b/net/9p/client.c
+@@ -833,7 +833,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
+ if (err < 0) {
+ if (err == -EIO)
+ c->status = Disconnected;
+- goto reterr;
++ if (err != -ERESTARTSYS)
++ goto reterr;
+ }
+ if (req->status == REQ_STATUS_ERROR) {
+ p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 7222fe1d5460..ea0e15c7ea17 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ if (!capable(CAP_NET_ADMIN))
+ return -EPERM;
+
+- spin_lock_bh(&br->lock);
+ br_stp_set_bridge_priority(br, args[1]);
+- spin_unlock_bh(&br->lock);
+ return 0;
+
+ case BRCTL_SET_PORT_PRIORITY:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index a41051a1bca5..87ae8c30ab41 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -36,6 +36,9 @@
+ #define mlock_dereference(X, br) \
+ rcu_dereference_protected(X, lockdep_is_held(&br->multicast_lock))
+
++static void br_multicast_add_router(struct net_bridge *br,
++ struct net_bridge_port *port);
++
+ #if IS_ENABLED(CONFIG_IPV6)
+ static inline int ipv6_is_transient_multicast(const struct in6_addr *addr)
+ {
+@@ -842,6 +845,8 @@ void br_multicast_enable_port(struct net_bridge_port *port)
+ goto out;
+
+ __br_multicast_enable_port(port);
++ if (port->multicast_router == 2 && hlist_unhashed(&port->rlist))
++ br_multicast_add_router(br, port);
+
+ out:
+ spin_unlock(&br->multicast_lock);
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 2f100ccef86f..23ea15989d55 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -242,12 +242,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+ return true;
+ }
+
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ struct net_bridge_port *p;
+ int wasroot;
+
++ spin_lock_bh(&br->lock);
+ wasroot = br_is_root_bridge(br);
+
+ list_for_each_entry(p, &br->port_list, list) {
+@@ -265,6 +266,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ br_port_state_selection(br);
+ if (br_is_root_bridge(br) && !wasroot)
+ br_become_root_bridge(br);
++ spin_unlock_bh(&br->lock);
+ }
+
+ /* called under bridge lock */
+diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
+index 7fbe21030f54..d4fbcb6268fd 100644
+--- a/net/ceph/osdmap.c
++++ b/net/ceph/osdmap.c
+@@ -102,7 +102,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
+ {
+ int j;
+ dout("crush_decode_tree_bucket %p to %p\n", *p, end);
+- ceph_decode_32_safe(p, end, b->num_nodes, bad);
++ ceph_decode_8_safe(p, end, b->num_nodes, bad);
+ b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
+ if (b->node_weights == NULL)
+ return -ENOMEM;
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index 546b1334fad4..ffa5d5d172c5 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -568,7 +568,7 @@ static int pktgen_if_show(struct seq_file *seq, void *v)
+ " dst_min: %s dst_max: %s\n",
+ pkt_dev->dst_min, pkt_dev->dst_max);
+ seq_printf(seq,
+- " src_min: %s src_max: %s\n",
++ " src_min: %s src_max: %s\n",
+ pkt_dev->src_min, pkt_dev->src_max);
+ }
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index dbe1715c629f..79c75e1d17ee 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1169,16 +1169,6 @@ static void packet_sock_destruct(struct sock *sk)
+ sk_refcnt_debug_dec(sk);
+ }
+
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+- int x = atomic_read(&f->rr_cur) + 1;
+-
+- if (x >= num)
+- x = 0;
+-
+- return x;
+-}
+-
+ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+ u32 idx, hash = skb->rxhash;
+@@ -1190,13 +1180,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s
+
+ static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+- int cur, old;
++ unsigned int val = atomic_inc_return(&f->rr_cur);
+
+- cur = atomic_read(&f->rr_cur);
+- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+- fanout_rr_next(f, num))) != cur)
+- cur = old;
+- return f->arr[cur];
++ return f->arr[val % num];
+ }
+
+ static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+@@ -1210,7 +1196,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *pt, struct net_device *orig_dev)
+ {
+ struct packet_fanout *f = pt->af_packet_priv;
+- unsigned int num = f->num_members;
++ unsigned int num = ACCESS_ONCE(f->num_members);
+ struct packet_sock *po;
+ struct sock *sk;
+
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 0c0bd2fe9aca..bc7b5de49725 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+
+ /* Supposedly, no process has access to the socket, but
+ * the net layers still may.
++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++ * held and that should be grabbed before socket lock.
+ */
+- sctp_local_bh_disable();
++ spin_lock_bh(&sctp_globals.addr_wq_lock);
+ sctp_bh_lock_sock(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ sk_common_release(sk);
+
+ sctp_bh_unlock_sock(sk);
+- sctp_local_bh_enable();
++ spin_unlock_bh(&sctp_globals.addr_wq_lock);
+
+ sock_put(sk);
+
+@@ -3492,6 +3494,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+ return 0;
+
++ spin_lock_bh(&sctp_globals.addr_wq_lock);
+ if (val == 0 && sp->do_auto_asconf) {
+ list_del(&sp->auto_asconf_list);
+ sp->do_auto_asconf = 0;
+@@ -3500,6 +3503,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ &sctp_auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+ }
++ spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ return 0;
+ }
+
+@@ -3935,18 +3939,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ local_bh_disable();
+ percpu_counter_inc(&sctp_sockets_allocated);
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++
++ /* Nothing can fail after this block, otherwise
++ * sctp_destroy_sock() will be called without addr_wq_lock held
++ */
+ if (sctp_default_auto_asconf) {
++ spin_lock(&sctp_globals.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list,
+ &sctp_auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+- } else
++ spin_unlock(&sctp_globals.addr_wq_lock);
++ } else {
+ sp->do_auto_asconf = 0;
++ }
++
+ local_bh_enable();
+
+ return 0;
+ }
+
+-/* Cleanup any SCTP per socket resources. */
++/* Cleanup any SCTP per socket resources. Must be called with
++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true
++ */
+ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+ {
+ struct sctp_sock *sp;
+@@ -6746,6 +6760,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newinet->mc_list = NULL;
+ }
+
++static inline void sctp_copy_descendant(struct sock *sk_to,
++ const struct sock *sk_from)
++{
++ int ancestor_size = sizeof(struct inet_sock) +
++ sizeof(struct sctp_sock) -
++ offsetof(struct sctp_sock, auto_asconf_list);
++
++ if (sk_from->sk_family == PF_INET6)
++ ancestor_size += sizeof(struct ipv6_pinfo);
++
++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
++}
++
+ /* Populate the fields of the newsk from the oldsk and migrate the assoc
+ * and its messages to the newsk.
+ */
+@@ -6760,7 +6787,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ struct sk_buff *skb, *tmp;
+ struct sctp_ulpevent *event;
+ struct sctp_bind_hashbucket *head;
+- struct list_head tmplist;
+
+ /* Migrate socket buffer sizes and all the socket level options to the
+ * new socket.
+@@ -6768,12 +6794,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ newsk->sk_sndbuf = oldsk->sk_sndbuf;
+ newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
+ /* Brute force copy old sctp opt. */
+- if (oldsp->do_auto_asconf) {
+- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+- inet_sk_copy_descendant(newsk, oldsk);
+- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+- } else
+- inet_sk_copy_descendant(newsk, oldsk);
++ sctp_copy_descendant(newsk, oldsk);
+
+ /* Restore the ep value that was overwritten with the above structure
+ * copy.
+diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
+index 31def68a0f6e..617b955f4931 100644
+--- a/net/sunrpc/backchannel_rqst.c
++++ b/net/sunrpc/backchannel_rqst.c
+@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
+
+ dprintk("RPC: free allocations for req= %p\n", req);
+ BUG_ON(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
+- xbufp = &req->rq_private_buf;
++ xbufp = &req->rq_rcv_buf;
+ free_page((unsigned long)xbufp->head[0].iov_base);
+ xbufp = &req->rq_snd_buf;
+ free_page((unsigned long)xbufp->head[0].iov_base);
+diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
+index 4fe9d191e277..80460d2a170d 100644
+--- a/sound/soc/codecs/wm8737.c
++++ b/sound/soc/codecs/wm8737.c
+@@ -484,7 +484,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
+
+ /* Fast VMID ramp at 2*2.5k */
+ snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
+- WM8737_VMIDSEL_MASK, 0x4);
++ WM8737_VMIDSEL_MASK,
++ 2 << WM8737_VMIDSEL_SHIFT);
+
+ /* Bring VMID up */
+ snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
+@@ -498,7 +499,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
+
+ /* VMID at 2*300k */
+ snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
+- WM8737_VMIDSEL_MASK, 2);
++ WM8737_VMIDSEL_MASK,
++ 1 << WM8737_VMIDSEL_SHIFT);
+
+ break;
+
+diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
+index db949311c0f2..0bb4a647755d 100644
+--- a/sound/soc/codecs/wm8903.h
++++ b/sound/soc/codecs/wm8903.h
+@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
+ #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
+
+ #define WM8903_VMID_RES_50K 2
+-#define WM8903_VMID_RES_250K 3
++#define WM8903_VMID_RES_250K 4
+ #define WM8903_VMID_RES_5K 6
+
+ /*
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 4696f6668259..07b78a9540a7 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
+ WM8955_K_17_9_MASK,
+ (pll.k >> 9) & WM8955_K_17_9_MASK);
+- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
++ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
+ WM8955_K_8_0_MASK,
+ pll.k & WM8955_K_8_0_MASK);
+ if (pll.k)
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index ed986e6d10c4..bd3c6ef8077a 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -183,7 +183,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
+ SOC_ENUM("ADC Polarity", wm8960_enum[0]),
+ SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
+
+-SOC_ENUM("DAC Polarity", wm8960_enum[2]),
++SOC_ENUM("DAC Polarity", wm8960_enum[1]),
+ SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
+ wm8960_get_deemph, wm8960_put_deemph),
+
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2015-09-21 15:57 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2015-09-21 15:57 UTC (permalink / raw
To: gentoo-commits
commit: 37749aac60489f971a0be77982f7550a80209d39
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Sep 21 15:57:15 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Sep 21 15:57:15 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=37749aac
Linux patch 3.4.109
0000_README | 4 +
1108_linux-3.4.109.patch | 5116 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5120 insertions(+)
diff --git a/0000_README b/0000_README
index 98c0230..0fcce0d 100644
--- a/0000_README
+++ b/0000_README
@@ -471,6 +471,10 @@ Patch: 1107_linux-3.4.108.patch
From: http://www.kernel.org
Desc: Linux 3.4.108
+Patch: 1108_linux-3.4.109.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.109
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1108_linux-3.4.109.patch b/1108_linux-3.4.109.patch
new file mode 100644
index 0000000..47549c8
--- /dev/null
+++ b/1108_linux-3.4.109.patch
@@ -0,0 +1,5116 @@
+diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
+index c67077cbeb80..e1a3d59bbe0f 100644
+--- a/Documentation/networking/rds.txt
++++ b/Documentation/networking/rds.txt
+@@ -62,11 +62,10 @@ Socket Interface
+ ================
+
+ AF_RDS, PF_RDS, SOL_RDS
+- These constants haven't been assigned yet, because RDS isn't in
+- mainline yet. Currently, the kernel module assigns some constant
+- and publishes it to user space through two sysctl files
+- /proc/sys/net/rds/pf_rds
+- /proc/sys/net/rds/sol_rds
++ AF_RDS and PF_RDS are the domain type to be used with socket(2)
++ to create RDS sockets. SOL_RDS is the socket-level to be used
++ with setsockopt(2) and getsockopt(2) for RDS specific socket
++ options.
+
+ fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
+ This creates a new, unbound RDS socket.
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index d97bccf46147..d4647168eba0 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -72,7 +72,6 @@ static struct pinctrl_desc foo_desc = {
+ .name = "foo",
+ .pins = foo_pins,
+ .npins = ARRAY_SIZE(foo_pins),
+- .maxpin = 63,
+ .owner = THIS_MODULE,
+ };
+
+@@ -166,8 +165,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
+ }
+
+ static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
+- unsigned ** const pins,
+- unsigned * const num_pins)
++ const unsigned **pins,
++ unsigned *num_pins)
+ {
+ *pins = (unsigned *) foo_groups[selector].pins;
+ *num_pins = foo_groups[selector].num_pins;
+@@ -1043,7 +1042,7 @@ The semantics of the pinctrl APIs are:
+
+ Usually the pin control core handled the get/put pair and call out to the
+ device drivers bookkeeping operations, like checking available functions and
+-the associated pins, whereas the enable/disable pass on to the pin controller
++the associated pins, whereas select_state pass on to the pin controller
+ driver which takes care of activating and/or deactivating the mux setting by
+ quickly poking some registers.
+
+@@ -1089,8 +1088,9 @@ function, but with different named in the mapping as described under
+ "Advanced mapping" above. So that for an SPI device, we have two states named
+ "pos-A" and "pos-B".
+
+-This snippet first muxes the function in the pins defined by group A, enables
+-it, disables and releases it, and muxes it in on the pins defined by group B:
++This snippet first initializes a state object for both groups (in foo_probe()),
++then muxes the function in the pins defined by group A, and finally muxes it in
++on the pins defined by group B:
+
+ #include <linux/pinctrl/consumer.h>
+
+diff --git a/Makefile b/Makefile
+index 5056e1bba7e8..7337720d6599 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 108
++SUBLEVEL = 109
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi
+index bc5e7d5ddd54..9cc8ed2310e7 100644
+--- a/arch/arm/boot/dts/imx27.dtsi
++++ b/arch/arm/boot/dts/imx27.dtsi
+@@ -208,7 +208,7 @@
+
+ fec: fec@1002b000 {
+ compatible = "fsl,imx27-fec";
+- reg = <0x1002b000 0x4000>;
++ reg = <0x1002b000 0x1000>;
+ interrupts = <50>;
+ status = "disabled";
+ };
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 38050b1c4800..dfc980ba7416 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
+ the loader. We need to make sure that it is out of the way of the program
+ that it will "exec", and that there is sufficient room for the brk. */
+
+-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+
+ /* When the program starts, a1 contains a pointer to a function to be
+ registered with atexit, as per the SVR4 ABI. A value of 0 means we
+diff --git a/arch/arm/mach-pxa/Kconfig b/arch/arm/mach-pxa/Kconfig
+index fe2d1f80ef50..2f8b17163a51 100644
+--- a/arch/arm/mach-pxa/Kconfig
++++ b/arch/arm/mach-pxa/Kconfig
+@@ -718,4 +718,13 @@ config PXA_HAVE_ISA_IRQS
+ config PXA310_ULPI
+ bool
+
++config PXA_SYSTEMS_CPLDS
++ tristate "Motherboard cplds"
++ default ARCH_LUBBOCK || MACH_MAINSTONE
++ help
++ This driver supports the Lubbock and Mainstone multifunction chip
++ found on the pxa25x development platform system (Lubbock) and pxa27x
++ development platform system (Mainstone). This IO board supports the
++ interrupts handling, ethernet controller, flash chips, etc ...
++
+ endif
+diff --git a/arch/arm/mach-pxa/Makefile b/arch/arm/mach-pxa/Makefile
+index be0f7df8685c..318c0d756bc7 100644
+--- a/arch/arm/mach-pxa/Makefile
++++ b/arch/arm/mach-pxa/Makefile
+@@ -103,4 +103,5 @@ led-$(CONFIG_ARCH_PXA_IDP) += leds-idp.o
+
+ obj-$(CONFIG_LEDS) += $(led-y)
+
++obj-$(CONFIG_PXA_SYSTEMS_CPLDS) += pxa_cplds_irqs.o
+ obj-$(CONFIG_TOSA_BT) += tosa-bt.o
+diff --git a/arch/arm/mach-pxa/include/mach/lubbock.h b/arch/arm/mach-pxa/include/mach/lubbock.h
+index 2a086e8373eb..b20b97e1df4c 100644
+--- a/arch/arm/mach-pxa/include/mach/lubbock.h
++++ b/arch/arm/mach-pxa/include/mach/lubbock.h
+@@ -35,7 +35,9 @@
+ #define LUB_GP __LUB_REG(LUBBOCK_FPGA_PHYS + 0x100)
+
+ /* Board specific IRQs */
+-#define LUBBOCK_IRQ(x) (IRQ_BOARD_START + (x))
++#define LUBBOCK_NR_IRQS IRQ_BOARD_START
++
++#define LUBBOCK_IRQ(x) (LUBBOCK_NR_IRQS + (x))
+ #define LUBBOCK_SD_IRQ LUBBOCK_IRQ(0)
+ #define LUBBOCK_SA1111_IRQ LUBBOCK_IRQ(1)
+ #define LUBBOCK_USB_IRQ LUBBOCK_IRQ(2) /* usb connect */
+@@ -45,8 +47,7 @@
+ #define LUBBOCK_USB_DISC_IRQ LUBBOCK_IRQ(6) /* usb disconnect */
+ #define LUBBOCK_LAST_IRQ LUBBOCK_IRQ(6)
+
+-#define LUBBOCK_SA1111_IRQ_BASE (IRQ_BOARD_START + 16)
+-#define LUBBOCK_NR_IRQS (IRQ_BOARD_START + 16 + 55)
++#define LUBBOCK_SA1111_IRQ_BASE (LUBBOCK_NR_IRQS + 32)
+
+ #ifndef __ASSEMBLY__
+ extern void lubbock_set_misc_wr(unsigned int mask, unsigned int set);
+diff --git a/arch/arm/mach-pxa/include/mach/mainstone.h b/arch/arm/mach-pxa/include/mach/mainstone.h
+index 1bfc4e822a41..e82a7d31104e 100644
+--- a/arch/arm/mach-pxa/include/mach/mainstone.h
++++ b/arch/arm/mach-pxa/include/mach/mainstone.h
+@@ -120,7 +120,9 @@
+ #define MST_PCMCIA_PWR_VCC_50 0x4 /* voltage VCC = 5.0V */
+
+ /* board specific IRQs */
+-#define MAINSTONE_IRQ(x) (IRQ_BOARD_START + (x))
++#define MAINSTONE_NR_IRQS IRQ_BOARD_START
++
++#define MAINSTONE_IRQ(x) (MAINSTONE_NR_IRQS + (x))
+ #define MAINSTONE_MMC_IRQ MAINSTONE_IRQ(0)
+ #define MAINSTONE_USIM_IRQ MAINSTONE_IRQ(1)
+ #define MAINSTONE_USBC_IRQ MAINSTONE_IRQ(2)
+@@ -136,6 +138,4 @@
+ #define MAINSTONE_S1_STSCHG_IRQ MAINSTONE_IRQ(14)
+ #define MAINSTONE_S1_IRQ MAINSTONE_IRQ(15)
+
+-#define MAINSTONE_NR_IRQS (IRQ_BOARD_START + 16)
+-
+ #endif
+diff --git a/arch/arm/mach-pxa/lubbock.c b/arch/arm/mach-pxa/lubbock.c
+index 6bb3f47b1f14..799f31f2c7ff 100644
+--- a/arch/arm/mach-pxa/lubbock.c
++++ b/arch/arm/mach-pxa/lubbock.c
+@@ -12,6 +12,7 @@
+ * published by the Free Software Foundation.
+ */
+ #include <linux/gpio.h>
++#include <linux/gpio/machine.h>
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+ #include <linux/init.h>
+@@ -120,84 +121,6 @@ void lubbock_set_misc_wr(unsigned int mask, unsigned int set)
+ }
+ EXPORT_SYMBOL(lubbock_set_misc_wr);
+
+-static unsigned long lubbock_irq_enabled;
+-
+-static void lubbock_mask_irq(struct irq_data *d)
+-{
+- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0));
+- LUB_IRQ_MASK_EN = (lubbock_irq_enabled &= ~(1 << lubbock_irq));
+-}
+-
+-static void lubbock_unmask_irq(struct irq_data *d)
+-{
+- int lubbock_irq = (d->irq - LUBBOCK_IRQ(0));
+- /* the irq can be acknowledged only if deasserted, so it's done here */
+- LUB_IRQ_SET_CLR &= ~(1 << lubbock_irq);
+- LUB_IRQ_MASK_EN = (lubbock_irq_enabled |= (1 << lubbock_irq));
+-}
+-
+-static struct irq_chip lubbock_irq_chip = {
+- .name = "FPGA",
+- .irq_ack = lubbock_mask_irq,
+- .irq_mask = lubbock_mask_irq,
+- .irq_unmask = lubbock_unmask_irq,
+-};
+-
+-static void lubbock_irq_handler(unsigned int irq, struct irq_desc *desc)
+-{
+- unsigned long pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled;
+- do {
+- /* clear our parent irq */
+- desc->irq_data.chip->irq_ack(&desc->irq_data);
+- if (likely(pending)) {
+- irq = LUBBOCK_IRQ(0) + __ffs(pending);
+- generic_handle_irq(irq);
+- }
+- pending = LUB_IRQ_SET_CLR & lubbock_irq_enabled;
+- } while (pending);
+-}
+-
+-static void __init lubbock_init_irq(void)
+-{
+- int irq;
+-
+- pxa25x_init_irq();
+-
+- /* setup extra lubbock irqs */
+- for (irq = LUBBOCK_IRQ(0); irq <= LUBBOCK_LAST_IRQ; irq++) {
+- irq_set_chip_and_handler(irq, &lubbock_irq_chip,
+- handle_level_irq);
+- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+- }
+-
+- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), lubbock_irq_handler);
+- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING);
+-}
+-
+-#ifdef CONFIG_PM
+-
+-static void lubbock_irq_resume(void)
+-{
+- LUB_IRQ_MASK_EN = lubbock_irq_enabled;
+-}
+-
+-static struct syscore_ops lubbock_irq_syscore_ops = {
+- .resume = lubbock_irq_resume,
+-};
+-
+-static int __init lubbock_irq_device_init(void)
+-{
+- if (machine_is_lubbock()) {
+- register_syscore_ops(&lubbock_irq_syscore_ops);
+- return 0;
+- }
+- return -ENODEV;
+-}
+-
+-device_initcall(lubbock_irq_device_init);
+-
+-#endif
+-
+ static int lubbock_udc_is_connected(void)
+ {
+ return (LUB_MISC_RD & (1 << 9)) == 0;
+@@ -380,11 +303,38 @@ static struct platform_device lubbock_flash_device[2] = {
+ },
+ };
+
++static struct resource lubbock_cplds_resources[] = {
++ [0] = {
++ .start = LUBBOCK_FPGA_PHYS + 0xc0,
++ .end = LUBBOCK_FPGA_PHYS + 0xe0 - 1,
++ .flags = IORESOURCE_MEM,
++ },
++ [1] = {
++ .start = PXA_GPIO_TO_IRQ(0),
++ .end = PXA_GPIO_TO_IRQ(0),
++ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE,
++ },
++ [2] = {
++ .start = LUBBOCK_IRQ(0),
++ .end = LUBBOCK_IRQ(6),
++ .flags = IORESOURCE_IRQ,
++ },
++};
++
++static struct platform_device lubbock_cplds_device = {
++ .name = "pxa_cplds_irqs",
++ .id = -1,
++ .resource = &lubbock_cplds_resources[0],
++ .num_resources = 3,
++};
++
++
+ static struct platform_device *devices[] __initdata = {
+ &sa1111_device,
+ &smc91x_device,
+ &lubbock_flash_device[0],
+ &lubbock_flash_device[1],
++ &lubbock_cplds_device,
+ };
+
+ static struct pxafb_mode_info sharp_lm8v31_mode = {
+@@ -553,7 +503,7 @@ MACHINE_START(LUBBOCK, "Intel DBPXA250 Development Platform (aka Lubbock)")
+ /* Maintainer: MontaVista Software Inc. */
+ .map_io = lubbock_map_io,
+ .nr_irqs = LUBBOCK_NR_IRQS,
+- .init_irq = lubbock_init_irq,
++ .init_irq = pxa25x_init_irq,
+ .handle_irq = pxa25x_handle_irq,
+ .timer = &pxa_timer,
+ .init_machine = lubbock_init,
+diff --git a/arch/arm/mach-pxa/mainstone.c b/arch/arm/mach-pxa/mainstone.c
+index 1aebaf719462..3d679dbc3cc6 100644
+--- a/arch/arm/mach-pxa/mainstone.c
++++ b/arch/arm/mach-pxa/mainstone.c
+@@ -13,6 +13,7 @@
+ * published by the Free Software Foundation.
+ */
+ #include <linux/gpio.h>
++#include <linux/gpio/machine.h>
+ #include <linux/init.h>
+ #include <linux/platform_device.h>
+ #include <linux/syscore_ops.h>
+@@ -120,92 +121,6 @@ static unsigned long mainstone_pin_config[] = {
+ GPIO1_GPIO | WAKEUP_ON_EDGE_BOTH,
+ };
+
+-static unsigned long mainstone_irq_enabled;
+-
+-static void mainstone_mask_irq(struct irq_data *d)
+-{
+- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0));
+- MST_INTMSKENA = (mainstone_irq_enabled &= ~(1 << mainstone_irq));
+-}
+-
+-static void mainstone_unmask_irq(struct irq_data *d)
+-{
+- int mainstone_irq = (d->irq - MAINSTONE_IRQ(0));
+- /* the irq can be acknowledged only if deasserted, so it's done here */
+- MST_INTSETCLR &= ~(1 << mainstone_irq);
+- MST_INTMSKENA = (mainstone_irq_enabled |= (1 << mainstone_irq));
+-}
+-
+-static struct irq_chip mainstone_irq_chip = {
+- .name = "FPGA",
+- .irq_ack = mainstone_mask_irq,
+- .irq_mask = mainstone_mask_irq,
+- .irq_unmask = mainstone_unmask_irq,
+-};
+-
+-static void mainstone_irq_handler(unsigned int irq, struct irq_desc *desc)
+-{
+- unsigned long pending = MST_INTSETCLR & mainstone_irq_enabled;
+- do {
+- /* clear useless edge notification */
+- desc->irq_data.chip->irq_ack(&desc->irq_data);
+- if (likely(pending)) {
+- irq = MAINSTONE_IRQ(0) + __ffs(pending);
+- generic_handle_irq(irq);
+- }
+- pending = MST_INTSETCLR & mainstone_irq_enabled;
+- } while (pending);
+-}
+-
+-static void __init mainstone_init_irq(void)
+-{
+- int irq;
+-
+- pxa27x_init_irq();
+-
+- /* setup extra Mainstone irqs */
+- for(irq = MAINSTONE_IRQ(0); irq <= MAINSTONE_IRQ(15); irq++) {
+- irq_set_chip_and_handler(irq, &mainstone_irq_chip,
+- handle_level_irq);
+- if (irq == MAINSTONE_IRQ(10) || irq == MAINSTONE_IRQ(14))
+- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE | IRQF_NOAUTOEN);
+- else
+- set_irq_flags(irq, IRQF_VALID | IRQF_PROBE);
+- }
+- set_irq_flags(MAINSTONE_IRQ(8), 0);
+- set_irq_flags(MAINSTONE_IRQ(12), 0);
+-
+- MST_INTMSKENA = 0;
+- MST_INTSETCLR = 0;
+-
+- irq_set_chained_handler(PXA_GPIO_TO_IRQ(0), mainstone_irq_handler);
+- irq_set_irq_type(PXA_GPIO_TO_IRQ(0), IRQ_TYPE_EDGE_FALLING);
+-}
+-
+-#ifdef CONFIG_PM
+-
+-static void mainstone_irq_resume(void)
+-{
+- MST_INTMSKENA = mainstone_irq_enabled;
+-}
+-
+-static struct syscore_ops mainstone_irq_syscore_ops = {
+- .resume = mainstone_irq_resume,
+-};
+-
+-static int __init mainstone_irq_device_init(void)
+-{
+- if (machine_is_mainstone())
+- register_syscore_ops(&mainstone_irq_syscore_ops);
+-
+- return 0;
+-}
+-
+-device_initcall(mainstone_irq_device_init);
+-
+-#endif
+-
+-
+ static struct resource smc91x_resources[] = {
+ [0] = {
+ .start = (MST_ETH_PHYS + 0x300),
+@@ -483,11 +398,37 @@ static struct platform_device mst_gpio_keys_device = {
+ },
+ };
+
++static struct resource mst_cplds_resources[] = {
++ [0] = {
++ .start = MST_FPGA_PHYS + 0xc0,
++ .end = MST_FPGA_PHYS + 0xe0 - 1,
++ .flags = IORESOURCE_MEM,
++ },
++ [1] = {
++ .start = PXA_GPIO_TO_IRQ(0),
++ .end = PXA_GPIO_TO_IRQ(0),
++ .flags = IORESOURCE_IRQ | IORESOURCE_IRQ_LOWEDGE,
++ },
++ [2] = {
++ .start = MAINSTONE_IRQ(0),
++ .end = MAINSTONE_IRQ(15),
++ .flags = IORESOURCE_IRQ,
++ },
++};
++
++static struct platform_device mst_cplds_device = {
++ .name = "pxa_cplds_irqs",
++ .id = -1,
++ .resource = &mst_cplds_resources[0],
++ .num_resources = 3,
++};
++
+ static struct platform_device *platform_devices[] __initdata = {
+ &smc91x_device,
+ &mst_flash_device[0],
+ &mst_flash_device[1],
+ &mst_gpio_keys_device,
++ &mst_cplds_device,
+ };
+
+ static struct pxaohci_platform_data mainstone_ohci_platform_data = {
+@@ -618,7 +559,7 @@ MACHINE_START(MAINSTONE, "Intel HCDDBBVA0 Development Platform (aka Mainstone)")
+ .atag_offset = 0x100, /* BLOB boot parameter setting */
+ .map_io = mainstone_map_io,
+ .nr_irqs = MAINSTONE_NR_IRQS,
+- .init_irq = mainstone_init_irq,
++ .init_irq = pxa27x_init_irq,
+ .handle_irq = pxa27x_handle_irq,
+ .timer = &pxa_timer,
+ .init_machine = mainstone_init,
+diff --git a/arch/arm/mach-pxa/pxa_cplds_irqs.c b/arch/arm/mach-pxa/pxa_cplds_irqs.c
+new file mode 100644
+index 000000000000..f1aeb54fabe3
+--- /dev/null
++++ b/arch/arm/mach-pxa/pxa_cplds_irqs.c
+@@ -0,0 +1,200 @@
++/*
++ * Intel Reference Systems cplds
++ *
++ * Copyright (C) 2014 Robert Jarzmik
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * Cplds motherboard driver, supporting lubbock and mainstone SoC board.
++ */
++
++#include <linux/bitops.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/interrupt.h>
++#include <linux/io.h>
++#include <linux/irq.h>
++#include <linux/irqdomain.h>
++#include <linux/mfd/core.h>
++#include <linux/module.h>
++#include <linux/of_platform.h>
++
++#define FPGA_IRQ_MASK_EN 0x0
++#define FPGA_IRQ_SET_CLR 0x10
++
++#define CPLDS_NB_IRQ 32
++
++struct cplds {
++ void __iomem *base;
++ int irq;
++ unsigned int irq_mask;
++ struct gpio_desc *gpio0;
++ struct irq_domain *irqdomain;
++};
++
++static irqreturn_t cplds_irq_handler(int in_irq, void *d)
++{
++ struct cplds *fpga = d;
++ unsigned long pending;
++ unsigned int bit;
++
++ pending = readl(fpga->base + FPGA_IRQ_SET_CLR) & fpga->irq_mask;
++ for_each_set_bit(bit, &pending, CPLDS_NB_IRQ)
++ generic_handle_irq(irq_find_mapping(fpga->irqdomain, bit));
++
++ return IRQ_HANDLED;
++}
++
++static void cplds_irq_mask_ack(struct irq_data *d)
++{
++ struct cplds *fpga = irq_data_get_irq_chip_data(d);
++ unsigned int cplds_irq = irqd_to_hwirq(d);
++ unsigned int set, bit = BIT(cplds_irq);
++
++ fpga->irq_mask &= ~bit;
++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
++ set = readl(fpga->base + FPGA_IRQ_SET_CLR);
++ writel(set & ~bit, fpga->base + FPGA_IRQ_SET_CLR);
++}
++
++static void cplds_irq_unmask(struct irq_data *d)
++{
++ struct cplds *fpga = irq_data_get_irq_chip_data(d);
++ unsigned int cplds_irq = irqd_to_hwirq(d);
++ unsigned int bit = BIT(cplds_irq);
++
++ fpga->irq_mask |= bit;
++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
++}
++
++static struct irq_chip cplds_irq_chip = {
++ .name = "pxa_cplds",
++ .irq_mask_ack = cplds_irq_mask_ack,
++ .irq_unmask = cplds_irq_unmask,
++ .flags = IRQCHIP_MASK_ON_SUSPEND | IRQCHIP_SKIP_SET_WAKE,
++};
++
++static int cplds_irq_domain_map(struct irq_domain *d, unsigned int irq,
++ irq_hw_number_t hwirq)
++{
++ struct cplds *fpga = d->host_data;
++
++ irq_set_chip_and_handler(irq, &cplds_irq_chip, handle_level_irq);
++ irq_set_chip_data(irq, fpga);
++
++ return 0;
++}
++
++static const struct irq_domain_ops cplds_irq_domain_ops = {
++ .xlate = irq_domain_xlate_twocell,
++ .map = cplds_irq_domain_map,
++};
++
++static int cplds_resume(struct platform_device *pdev)
++{
++ struct cplds *fpga = platform_get_drvdata(pdev);
++
++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
++
++ return 0;
++}
++
++static int cplds_probe(struct platform_device *pdev)
++{
++ struct resource *res;
++ struct cplds *fpga;
++ int ret;
++ unsigned int base_irq = 0;
++ unsigned long irqflags = 0;
++
++ fpga = devm_kzalloc(&pdev->dev, sizeof(*fpga), GFP_KERNEL);
++ if (!fpga)
++ return -ENOMEM;
++
++ res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
++ if (res) {
++ fpga->irq = (unsigned int)res->start;
++ irqflags = res->flags;
++ }
++ if (!fpga->irq)
++ return -ENODEV;
++
++ base_irq = platform_get_irq(pdev, 1);
++ if (base_irq < 0)
++ base_irq = 0;
++
++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
++ fpga->base = devm_ioremap_resource(&pdev->dev, res);
++ if (IS_ERR(fpga->base))
++ return PTR_ERR(fpga->base);
++
++ platform_set_drvdata(pdev, fpga);
++
++ writel(fpga->irq_mask, fpga->base + FPGA_IRQ_MASK_EN);
++ writel(0, fpga->base + FPGA_IRQ_SET_CLR);
++
++ ret = devm_request_irq(&pdev->dev, fpga->irq, cplds_irq_handler,
++ irqflags, dev_name(&pdev->dev), fpga);
++ if (ret == -ENOSYS)
++ return -EPROBE_DEFER;
++
++ if (ret) {
++ dev_err(&pdev->dev, "couldn't request main irq%d: %d\n",
++ fpga->irq, ret);
++ return ret;
++ }
++
++ irq_set_irq_wake(fpga->irq, 1);
++ fpga->irqdomain = irq_domain_add_linear(pdev->dev.of_node,
++ CPLDS_NB_IRQ,
++ &cplds_irq_domain_ops, fpga);
++ if (!fpga->irqdomain)
++ return -ENODEV;
++
++ if (base_irq) {
++ ret = irq_create_strict_mappings(fpga->irqdomain, base_irq, 0,
++ CPLDS_NB_IRQ);
++ if (ret) {
++ dev_err(&pdev->dev, "couldn't create the irq mapping %d..%d\n",
++ base_irq, base_irq + CPLDS_NB_IRQ);
++ return ret;
++ }
++ }
++
++ return 0;
++}
++
++static int cplds_remove(struct platform_device *pdev)
++{
++ struct cplds *fpga = platform_get_drvdata(pdev);
++
++ irq_set_chip_and_handler(fpga->irq, NULL, NULL);
++
++ return 0;
++}
++
++static const struct of_device_id cplds_id_table[] = {
++ { .compatible = "intel,lubbock-cplds-irqs", },
++ { .compatible = "intel,mainstone-cplds-irqs", },
++ { }
++};
++MODULE_DEVICE_TABLE(of, cplds_id_table);
++
++static struct platform_driver cplds_driver = {
++ .driver = {
++ .name = "pxa_cplds_irqs",
++ .of_match_table = of_match_ptr(cplds_id_table),
++ },
++ .probe = cplds_probe,
++ .remove = cplds_remove,
++ .resume = cplds_resume,
++};
++
++module_platform_driver(cplds_driver);
++
++MODULE_DESCRIPTION("PXA Cplds interrupts driver");
++MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>");
++MODULE_LICENSE("GPL");
+diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
+index 62135849f48b..ad941453340a 100644
+--- a/arch/arm/net/bpf_jit_32.c
++++ b/arch/arm/net/bpf_jit_32.c
+@@ -52,6 +52,7 @@
+ #define SEEN_DATA (1 << (BPF_MEMWORDS + 3))
+
+ #define FLAG_NEED_X_RESET (1 << 0)
++#define FLAG_IMM_OVERFLOW (1 << 1)
+
+ struct jit_ctx {
+ const struct sk_filter *skf;
+@@ -286,6 +287,15 @@ static u16 imm_offset(u32 k, struct jit_ctx *ctx)
+ /* PC in ARM mode == address of the instruction + 8 */
+ imm = offset - (8 + ctx->idx * 4);
+
++ if (imm & ~0xfff) {
++ /*
++ * literal pool is too far, signal it into flags. we
++ * can only detect it on the second pass unfortunately.
++ */
++ ctx->flags |= FLAG_IMM_OVERFLOW;
++ return 0;
++ }
++
+ return imm;
+ }
+
+@@ -817,6 +827,14 @@ b_epilogue:
+ default:
+ return -1;
+ }
++
++ if (ctx->flags & FLAG_IMM_OVERFLOW)
++ /*
++ * this instruction generated an overflow when
++ * trying to access the literal pool, so
++ * delegate this filter to the kernel interpreter.
++ */
++ return -1;
+ }
+
+ /* compute offsets only during the first pass */
+@@ -876,7 +894,14 @@ void bpf_jit_compile(struct sk_filter *fp)
+
+ ctx.idx = 0;
+ build_prologue(&ctx);
+- build_body(&ctx);
++ if (build_body(&ctx) < 0) {
++#if __LINUX_ARM_ARCH__ < 7
++ if (ctx.imm_count)
++ kfree(ctx.imms);
++#endif
++ bpf_jit_binary_free(header);
++ goto out;
++ }
+ build_epilogue(&ctx);
+
+ flush_icache_range((u32)ctx.target, (u32)(ctx.target + ctx.idx));
+diff --git a/arch/c6x/kernel/time.c b/arch/c6x/kernel/time.c
+index 356ee84cad95..04845aaf5985 100644
+--- a/arch/c6x/kernel/time.c
++++ b/arch/c6x/kernel/time.c
+@@ -49,7 +49,7 @@ u64 sched_clock(void)
+ return (tsc * sched_clock_multiplier) >> SCHED_CLOCK_SHIFT;
+ }
+
+-void time_init(void)
++void __init time_init(void)
+ {
+ u64 tmp = (u64)NSEC_PER_SEC << SCHED_CLOCK_SHIFT;
+
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index a5aa43d07c8e..9cd8cbf9bd43 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -110,7 +110,7 @@ void __init init_IRQ(void)
+ #endif
+ }
+
+-#ifdef DEBUG_STACKOVERFLOW
++#ifdef CONFIG_DEBUG_STACKOVERFLOW
+ static inline void check_stack_overflow(void)
+ {
+ unsigned long sp;
+diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
+index 5bf34ec89669..2ca17353fc0c 100644
+--- a/arch/mips/power/hibernate.S
++++ b/arch/mips/power/hibernate.S
+@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend)
+ END(swsusp_arch_suspend)
+
+ LEAF(swsusp_arch_resume)
++ /* Avoid TLB mismatch during and after kernel resume */
++ jal local_flush_tlb_all
+ PTR_L t0, restore_pblist
+ 0:
+ PTR_L t1, PBE_ADDRESS(t0) /* source */
+@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume)
+ bne t1, t3, 1b
+ PTR_L t0, PBE_NEXT(t0)
+ bnez t0, 0b
+- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
+ PTR_LA t0, saved_regs
+ PTR_L ra, PT_R31(t0)
+ PTR_L sp, PT_R29(t0)
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index b4437e8a7a8f..334254c5292e 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -62,12 +62,22 @@ struct cache_type_info {
+ };
+
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED 0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA 2
++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA 3
+
+ static const struct cache_type_info cache_type_info[] = {
+ {
++ /* Embedded systems that use cache-size, cache-block-size,
++ * etc. for the Unified (typically L2) cache. */
++ .name = "Unified",
++ .size_prop = "cache-size",
++ .line_size_props = { "cache-line-size",
++ "cache-block-size", },
++ .nr_sets_prop = "cache-sets",
++ },
++ {
+ /* PowerPC Processor binding says the [di]-cache-*
+ * must be equal on unified caches, so just use
+ * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
+ {
+ struct cache *iter;
+
+- if (cache->type == CACHE_TYPE_UNIFIED)
++ if (cache->type == CACHE_TYPE_UNIFIED ||
++ cache->type == CACHE_TYPE_UNIFIED_D)
+ return cache;
+
+ list_for_each_entry(iter, &cache_list, list)
+@@ -324,15 +335,27 @@ static bool cache_node_is_unified(const struct device_node *np)
+ return of_get_property(np, "cache-unified", NULL);
+ }
+
+-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++/*
++ * Unified caches can have two different sets of tags. Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc. Check on initialization for which type we have, and
++ * return the appropriate structure type. Assume it's embedded if it isn't
++ * open firmware. If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+- struct cache *cache;
++ return of_get_property(np,
++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+
++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+
+- cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+- return cache;
++ return new_cache(cache_is_unified_d(node), level, node);
+ }
+
+ static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 7703569b5d4f..6be807d29b1d 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -213,6 +213,7 @@ SECTIONS
+ *(.opd)
+ }
+
++ . = ALIGN(256);
+ .got : AT(ADDR(.got) - LOAD_OFFSET) {
+ __toc_start = .;
+ *(.got)
+diff --git a/arch/powerpc/perf/callchain.c b/arch/powerpc/perf/callchain.c
+index e8a18d1cc7c9..a9bd794652c9 100644
+--- a/arch/powerpc/perf/callchain.c
++++ b/arch/powerpc/perf/callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
+ sp = regs->gpr[1];
+ perf_callchain_store(entry, next_ip);
+
+- for (;;) {
++ while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ fp = (unsigned long __user *) sp;
+ if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ return;
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 0f1b706506ed..27672762746b 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ goto out;
+ }
+
++ rc = dlpar_acquire_drc(drc_index);
++ if (rc) {
++ rc = -EINVAL;
++ goto out;
++ }
++
+ dn = dlpar_configure_connector(drc_index);
+ if (!dn) {
+ rc = -EINVAL;
+@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ kfree(dn->full_name);
+ dn->full_name = cpu_name;
+
+- rc = dlpar_acquire_drc(drc_index);
+- if (rc) {
+- dlpar_free_cc_nodes(dn);
+- rc = -EINVAL;
+- goto out;
+- }
+-
+ rc = dlpar_attach_node(dn);
+ if (rc) {
+ dlpar_release_drc(drc_index);
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index b1bd170f24b1..c2dac2e0e56a 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -16,11 +16,12 @@
+ #define GHASH_DIGEST_SIZE 16
+
+ struct ghash_ctx {
+- u8 icv[16];
+- u8 key[16];
++ u8 key[GHASH_BLOCK_SIZE];
+ };
+
+ struct ghash_desc_ctx {
++ u8 icv[GHASH_BLOCK_SIZE];
++ u8 key[GHASH_BLOCK_SIZE];
+ u8 buffer[GHASH_BLOCK_SIZE];
+ u32 bytes;
+ };
+@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
+ static int ghash_init(struct shash_desc *desc)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+
+ memset(dctx, 0, sizeof(*dctx));
++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ }
+
+ memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
+- memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
+ const u8 *src, unsigned int srclen)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ unsigned int n;
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
+ src += n;
+
+ if (!dctx->bytes) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
+ GHASH_BLOCK_SIZE);
+ BUG_ON(ret != GHASH_BLOCK_SIZE);
+ }
+@@ -78,7 +79,7 @@ static int ghash_update(struct shash_desc *desc,
+
+ n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ if (n) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
+ BUG_ON(ret != n);
+ src += n;
+ srclen -= n;
+@@ -92,7 +93,7 @@ static int ghash_update(struct shash_desc *desc,
+ return 0;
+ }
+
+-static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_desc_ctx *dctx)
+ {
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -102,20 +103,19 @@ static void ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+
+ memset(pos, 0, dctx->bytes);
+
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
+ BUG_ON(ret != GHASH_BLOCK_SIZE);
+- }
+
+- dctx->bytes = 0;
++ dctx->bytes = 0;
++ }
+ }
+
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+
+- ghash_flush(ctx, dctx);
+- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++ ghash_flush(dctx);
++ memcpy(dst, dtx->icv, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
+index aa1494d0e380..42068041733c 100644
+--- a/arch/s390/kernel/suspend.c
++++ b/arch/s390/kernel/suspend.c
+@@ -9,6 +9,8 @@
+ #include <linux/pfn.h>
+ #include <linux/suspend.h>
+ #include <linux/mm.h>
++#include <asm/ipl.h>
++#include <asm/sections.h>
+ #include <asm/ctl_reg.h>
+
+ /*
+@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn)
+ {
+ unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
+ unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
+
+ /* Always save lowcore pages (LC protection might be enabled). */
+ if (pfn <= LC_PAGES)
+@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn)
+ if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
+ return 1;
+ /* Skip memory holes and read-only pages (NSS, DCSS, ...). */
++ if (pfn >= stext_pfn && pfn <= eshared_pfn)
++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
+ if (tprot(PFN_PHYS(pfn)))
+ return 1;
+ return 0;
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index e5a45dbd26ac..f641458e86b4 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -218,6 +218,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
+ for (n = mem->count - 1; n > 0 ; n--)
+ memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
+
++ memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
+ mem->vm[0].cpus_total = cpus;
+ mem->vm[0].cpus_configured = cpus;
+ mem->vm[0].cpus_standby = 0;
+diff --git a/arch/x86/include/asm/i387.h b/arch/x86/include/asm/i387.h
+index 257d9cca214f..1262fb6a9df6 100644
+--- a/arch/x86/include/asm/i387.h
++++ b/arch/x86/include/asm/i387.h
+@@ -23,8 +23,32 @@ extern int dump_fpu(struct pt_regs *, struct user_i387_struct *);
+ extern void math_state_restore(void);
+
+ extern bool irq_fpu_usable(void);
+-extern void kernel_fpu_begin(void);
+-extern void kernel_fpu_end(void);
++
++/*
++ * Careful: __kernel_fpu_begin/end() must be called with preempt disabled
++ * and they don't touch the preempt state on their own.
++ * If you enable preemption after __kernel_fpu_begin(), preempt notifier
++ * should call the __kernel_fpu_end() to prevent the kernel/user FPU
++ * state from getting corrupted. KVM for example uses this model.
++ *
++ * All other cases use kernel_fpu_begin/end() which disable preemption
++ * during kernel FPU usage.
++ */
++extern void __kernel_fpu_begin(void);
++extern void __kernel_fpu_end(void);
++
++static inline void kernel_fpu_begin(void)
++{
++ WARN_ON_ONCE(!irq_fpu_usable());
++ preempt_disable();
++ __kernel_fpu_begin();
++}
++
++static inline void kernel_fpu_end(void)
++{
++ __kernel_fpu_end();
++ preempt_enable();
++}
+
+ /*
+ * Some instructions like VIA's padlock instructions generate a spurious
+diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
+index f229b13a5f30..0c5482257fc3 100644
+--- a/arch/x86/include/asm/iommu_table.h
++++ b/arch/x86/include/asm/iommu_table.h
+@@ -79,11 +79,12 @@ struct iommu_table_entry {
+ * d). Similar to the 'init', except that this gets called from pci_iommu_init
+ * where we do have a memory allocator.
+ *
+- * The standard vs the _FINISH differs in that the _FINISH variant will
+- * continue detecting other IOMMUs in the call list after the
+- * the detection routine returns a positive number. The _FINISH will
+- * stop the execution chain. Both will still call the 'init' and
+- * 'late_init' functions if they are set.
++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
++ * in that the former will continue detecting other IOMMUs in the call
++ * list after the detection routine returns a positive number, while the
++ * latter will stop the execution chain upon first successful detection.
++ * Both variants will still call the 'init' and 'late_init' functions if
++ * they are set.
+ */
+ #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \
+ __IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
+diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
+index 0d2db0e7caf4..9eeaed48d0bf 100644
+--- a/arch/x86/kernel/cpu/mcheck/mce.c
++++ b/arch/x86/kernel/cpu/mcheck/mce.c
+@@ -652,11 +652,14 @@ EXPORT_SYMBOL_GPL(machine_check_poll);
+ static int mce_no_way_out(struct mce *m, char **msg)
+ {
+ int i;
++ char *tmp;
+
+ for (i = 0; i < banks; i++) {
+ m->status = mce_rdmsrl(MSR_IA32_MCx_STATUS(i));
+- if (mce_severity(m, tolerant, msg) >= MCE_PANIC_SEVERITY)
++ if (mce_severity(m, tolerant, &tmp) >= MCE_PANIC_SEVERITY) {
++ *msg = tmp;
+ return 1;
++ }
+ }
+ return 0;
+ }
+diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
+index 6610e811fb39..7aa728d72b60 100644
+--- a/arch/x86/kernel/i387.c
++++ b/arch/x86/kernel/i387.c
+@@ -77,29 +77,26 @@ bool irq_fpu_usable(void)
+ }
+ EXPORT_SYMBOL(irq_fpu_usable);
+
+-void kernel_fpu_begin(void)
++void __kernel_fpu_begin(void)
+ {
+ struct task_struct *me = current;
+
+- WARN_ON_ONCE(!irq_fpu_usable());
+- preempt_disable();
+ if (__thread_has_fpu(me)) {
+ __save_init_fpu(me);
+ __thread_clear_has_fpu(me);
+- /* We do 'stts()' in kernel_fpu_end() */
++ /* We do 'stts()' in __kernel_fpu_end() */
+ } else {
+ percpu_write(fpu_owner_task, NULL);
+ clts();
+ }
+ }
+-EXPORT_SYMBOL(kernel_fpu_begin);
++EXPORT_SYMBOL(__kernel_fpu_begin);
+
+-void kernel_fpu_end(void)
++void __kernel_fpu_end(void)
+ {
+ stts();
+- preempt_enable();
+ }
+-EXPORT_SYMBOL(kernel_fpu_end);
++EXPORT_SYMBOL(__kernel_fpu_end);
+
+ void unlazy_fpu(struct task_struct *tsk)
+ {
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index 84f4bca0ca2c..2da1a8c9173e 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3658,7 +3658,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ ++vcpu->kvm->stat.mmu_pte_write;
+ kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE);
+
+- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
+ for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+ if (detect_write_misaligned(sp, gpa, bytes) ||
+ detect_write_flooding(sp)) {
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 2eb4e5af8816..4ad0d7171d6c 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -1455,8 +1455,12 @@ static void __vmx_load_host_state(struct vcpu_vmx *vmx)
+ #ifdef CONFIG_X86_64
+ wrmsrl(MSR_KERNEL_GS_BASE, vmx->msr_host_kernel_gs_base);
+ #endif
+- if (user_has_fpu())
+- clts();
++ /*
++ * If the FPU is not active (through the host task or
++ * the guest vcpu), then restore the cr0.TS bit.
++ */
++ if (!user_has_fpu() && !vmx->vcpu.guest_fpu_loaded)
++ stts();
+ load_gdt(&__get_cpu_var(host_gdt));
+ }
+
+@@ -3633,7 +3637,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ struct desc_ptr dt;
+ unsigned long cr4;
+
+- vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
++ vmcs_writel(HOST_CR0, read_cr0() & ~X86_CR0_TS); /* 22.2.3 */
+ vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
+
+ /* Save the most likely value for this task's CR4 in the VMCS. */
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 318a2454366f..4ad2b7bb382e 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -5907,7 +5907,7 @@ void kvm_load_guest_fpu(struct kvm_vcpu *vcpu)
+ */
+ kvm_put_guest_xcr0(vcpu);
+ vcpu->guest_fpu_loaded = 1;
+- unlazy_fpu(current);
++ __kernel_fpu_begin();
+ fpu_restore_checking(&vcpu->arch.guest_fpu);
+ trace_kvm_fpu(1);
+ }
+@@ -5921,6 +5921,7 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
+
+ vcpu->guest_fpu_loaded = 0;
+ fpu_save_init(&vcpu->arch.guest_fpu);
++ __kernel_fpu_end();
+ ++vcpu->stat.fpu_reload;
+ kvm_make_request(KVM_REQ_DEACTIVATE_FPU, vcpu);
+ trace_kvm_fpu(0);
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 0597f95b6da6..95f9934e8050 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -155,7 +155,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ }
+ cleanup_addr = proglen; /* epilogue address */
+
+- for (pass = 0; pass < 10; pass++) {
++ /* JITed image shrinks with every pass and the loop iterates
++ * until the image stops shrinking. Very large bpf programs
++ * may converge on the last pass. In such case do one more
++ * pass to emit the final image
++ */
++ for (pass = 0; pass < 10 || image; pass++) {
+ u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ /* no prologue/epilogue for trivial filters (RET something) */
+ proglen = 0;
+diff --git a/block/genhd.c b/block/genhd.c
+index 7a2a8dc9bc5f..618ca1aaa858 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ do {
+ if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
+ return -ENOMEM;
+- spin_lock(&ext_devt_lock);
++ spin_lock_bh(&ext_devt_lock);
+ rc = idr_get_new(&ext_devt_idr, part, &idx);
+ if (!rc && idx >= NR_EXT_DEVT) {
+ idr_remove(&ext_devt_idr, idx);
+ rc = -EBUSY;
+ }
+- spin_unlock(&ext_devt_lock);
++ spin_unlock_bh(&ext_devt_lock);
+ } while (rc == -EAGAIN);
+
+ if (rc)
+@@ -451,9 +451,9 @@ void blk_free_devt(dev_t devt)
+ return;
+
+ if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
+- spin_lock(&ext_devt_lock);
++ spin_lock_bh(&ext_devt_lock);
+ idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+- spin_unlock(&ext_devt_lock);
++ spin_unlock_bh(&ext_devt_lock);
+ }
+ }
+
+@@ -684,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
+ } else {
+ struct hd_struct *part;
+
+- spin_lock(&ext_devt_lock);
++ spin_lock_bh(&ext_devt_lock);
+ part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+ if (part && get_disk(part_to_disk(part))) {
+ *partno = part->partno;
+ disk = part_to_disk(part);
+ }
+- spin_unlock(&ext_devt_lock);
++ spin_unlock_bh(&ext_devt_lock);
+ }
+
+ return disk;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 6fc61eb07b7b..1338f1f79582 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -67,6 +67,7 @@ enum board_ids {
+ board_ahci_yes_fbs,
+
+ /* board IDs for specific chipsets in alphabetical order */
++ board_ahci_avn,
+ board_ahci_mcp65,
+ board_ahci_mcp77,
+ board_ahci_mcp89,
+@@ -85,6 +86,8 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
+ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
+ #ifdef CONFIG_PM
+@@ -106,6 +109,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
+ .hardreset = ahci_p5wdh_hardreset,
+ };
+
++static struct ata_port_operations ahci_avn_ops = {
++ .inherits = &ahci_ops,
++ .hardreset = ahci_avn_hardreset,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ /* by features */
+ [board_ahci] =
+@@ -154,6 +162,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ .port_ops = &ahci_ops,
+ },
+ /* by chipsets */
++ [board_ahci_avn] = {
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_avn_ops,
++ },
+ [board_ahci_mcp65] =
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+@@ -300,14 +314,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
+ { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
+ { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
+@@ -671,6 +685,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ return rc;
+ }
+
++/*
++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
++ *
++ * It has been observed with some SSDs that the timing of events in the
++ * link synchronization phase can leave the port in a state that can not
++ * be recovered by a SATA-hard-reset alone. The failing signature is
++ * SStatus.DET stuck at 1 ("Device presence detected but Phy
++ * communication not established"). It was found that unloading and
++ * reloading the driver when this problem occurs allows the drive
++ * connection to be recovered (DET advanced to 0x3). The critical
++ * component of reloading the driver is that the port state machines are
++ * reset by bouncing "port enable" in the AHCI PCS configuration
++ * register. So, reproduce that effect by bouncing a port whenever we
++ * see DET==1 after a reset.
++ */
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++ struct ata_port *ap = link->ap;
++ struct ahci_port_priv *pp = ap->private_data;
++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++ unsigned long tmo = deadline - jiffies;
++ struct ata_taskfile tf;
++ bool online;
++ int rc, i;
++
++ DPRINTK("ENTER\n");
++
++ ahci_stop_engine(ap);
++
++ for (i = 0; i < 2; i++) {
++ u16 val;
++ u32 sstatus;
++ int port = ap->port_no;
++ struct ata_host *host = ap->host;
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ /* clear D2H reception area to properly wait for D2H FIS */
++ ata_tf_init(link->device, &tf);
++ tf.command = ATA_BUSY;
++ ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++ rc = sata_link_hardreset(link, timing, deadline, &online,
++ ahci_check_ready);
++
++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
++ (sstatus & 0xf) != 1)
++ break;
++
++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
++ port);
++
++ pci_read_config_word(pdev, 0x92, &val);
++ val &= ~(1 << port);
++ pci_write_config_word(pdev, 0x92, val);
++ ata_msleep(ap, 1000);
++ val |= 1 << port;
++ pci_write_config_word(pdev, 0x92, val);
++ deadline += tmo;
++ }
++
++ ahci_start_engine(ap);
++
++ if (online)
++ *class = ahci_dev_classify(ap);
++
++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
++ return rc;
++}
++
++
+ #ifdef CONFIG_PM
+ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
+ {
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index c2594ddf25b0..57eb1c212a4c 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -320,6 +320,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
+ extern struct ata_port_operations ahci_ops;
+ extern struct ata_port_operations ahci_pmp_retry_srst_ops;
+
++unsigned int ahci_dev_classify(struct ata_port *ap);
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ u32 opts);
+ void ahci_save_initial_config(struct device *dev,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 60f41cd2c330..30cdba79d7ae 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1139,7 +1139,7 @@ static void ahci_dev_config(struct ata_device *dev)
+ }
+ }
+
+-static unsigned int ahci_dev_classify(struct ata_port *ap)
++unsigned int ahci_dev_classify(struct ata_port *ap)
+ {
+ void __iomem *port_mmio = ahci_port_base(ap);
+ struct ata_taskfile tf;
+@@ -1153,6 +1153,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)
+
+ return ata_dev_classify(&tf);
+ }
++EXPORT_SYMBOL_GPL(ahci_dev_classify);
+
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ u32 opts)
+@@ -1670,8 +1671,7 @@ static void ahci_port_intr(struct ata_port *ap)
+ if (unlikely(resetting))
+ status &= ~PORT_IRQ_BAD_PMP;
+
+- /* if LPM is enabled, PHYRDY doesn't mean anything */
+- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
++ if (sata_lpm_ignore_phy_events(&ap->link)) {
+ status &= ~PORT_IRQ_PHYRDY;
+ ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index adaf994abb79..0a6767b9939c 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6657,6 +6657,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
+ return tmp;
+ }
+
++/**
++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored
++ * @link: Link receiving the event
++ *
++ * Test whether the received PHY event has to be ignored or not.
++ *
++ * LOCKING:
++ * None:
++ *
++ * RETURNS:
++ * True if the event has to be ignored.
++ */
++bool sata_lpm_ignore_phy_events(struct ata_link *link)
++{
++ unsigned long lpm_timeout = link->last_lpm_change +
++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
++
++ /* if LPM is enabled, PHYRDY doesn't mean anything */
++ if (link->lpm_policy > ATA_LPM_MAX_POWER)
++ return true;
++
++ /* ignore the first PHY event after the LPM policy changed
++ * as it is might be spurious
++ */
++ if ((link->flags & ATA_LFLAG_CHANGED) &&
++ time_before(jiffies, lpm_timeout))
++ return true;
++
++ return false;
++}
++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
++
+ /*
+ * Dummy port_ops
+ */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 37fb4d6069a2..033b8cd497ac 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3424,6 +3424,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ }
+ }
+
++ link->last_lpm_change = jiffies;
++ link->flags |= ATA_LFLAG_CHANGED;
++
+ return 0;
+
+ fail:
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 8a084bffd068..52be498c2d1c 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -64,6 +64,7 @@ static struct usb_device_id ath3k_table[] = {
+ /* Atheros AR3011 with sflash firmware*/
+ { USB_DEVICE(0x0489, 0xE027) },
+ { USB_DEVICE(0x0489, 0xE03D) },
++ { USB_DEVICE(0x04F2, 0xAFF1) },
+ { USB_DEVICE(0x0930, 0x0215) },
+ { USB_DEVICE(0x0CF3, 0x3002) },
+ { USB_DEVICE(0x0CF3, 0xE019) },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 7c0b21ebd33b..f8a58db55055 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -142,6 +142,7 @@ static struct usb_device_id blacklist_table[] = {
+ /* Atheros 3011 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index bdecba5de3a4..e53994978ce8 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -2668,7 +2668,7 @@ static int wait_for_msg_done(struct smi_info *smi_info)
+ smi_result == SI_SM_CALL_WITH_TICK_DELAY) {
+ schedule_timeout_uninterruptible(1);
+ smi_result = smi_info->handlers->event(
+- smi_info->si_sm, 100);
++ smi_info->si_sm, jiffies_to_usecs(1));
+ } else if (smi_result == SI_SM_CALL_WITHOUT_DELAY) {
+ smi_result = smi_info->handlers->event(
+ smi_info->si_sm, 0);
+diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
+index b1f1d105e8c7..e1c744d7370a 100644
+--- a/drivers/gpu/drm/i915/i915_gem.c
++++ b/drivers/gpu/drm/i915/i915_gem.c
+@@ -1779,9 +1779,6 @@ i915_gem_retire_requests_ring(struct intel_ring_buffer *ring)
+ uint32_t seqno;
+ int i;
+
+- if (list_empty(&ring->request_list))
+- return;
+-
+ WARN_ON(i915_verify_lists(ring->dev));
+
+ seqno = ring->get_seqno(ring);
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index d51c08da3f69..af6790ccb8a9 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -318,8 +318,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+@@ -362,8 +364,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index c5fe79e67ed9..db4df97b7872 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1079,7 +1079,7 @@ int evergreen_pcie_gart_enable(struct radeon_device *rdev)
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
+index 461262eee79a..1f451796407b 100644
+--- a/drivers/gpu/drm/radeon/ni.c
++++ b/drivers/gpu/drm/radeon/ni.c
+@@ -1075,7 +1075,7 @@ int cayman_pcie_gart_enable(struct radeon_device *rdev)
+ L2_CACHE_BIGK_FRAGMENT_SIZE(6));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 9c7062d970ee..d441aed782ad 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -930,7 +930,7 @@ int r600_pcie_gart_enable(struct radeon_device *rdev)
+ WREG32(MC_VM_L1_TLB_MCB_RD_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(MC_VM_L1_TLB_MCB_WR_SEM_CNTL, tmp | ENABLE_SEMAPHORE_MODE);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
+index f3ee36036487..d66d2cdf4f0a 100644
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -49,7 +49,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
+ if (p->relocs_ptr == NULL) {
+ return -ENOMEM;
+ }
+- p->relocs = kcalloc(p->nrelocs, sizeof(struct radeon_cs_reloc), GFP_KERNEL);
++ p->relocs = drm_calloc_large(p->nrelocs, sizeof(struct radeon_bo_list));
+ if (p->relocs == NULL) {
+ return -ENOMEM;
+ }
+@@ -324,7 +324,7 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
+ }
+ }
+ kfree(parser->track);
+- kfree(parser->relocs);
++ drm_free_large(parser->relocs);
+ kfree(parser->relocs_ptr);
+ for (i = 0; i < parser->nchunks; i++) {
+ kfree(parser->chunks[i].kdata);
+diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
+index 1ec1255520ad..3358730be78b 100644
+--- a/drivers/gpu/drm/radeon/rv770.c
++++ b/drivers/gpu/drm/radeon/rv770.c
+@@ -158,7 +158,7 @@ int rv770_pcie_gart_enable(struct radeon_device *rdev)
+ WREG32(MC_VM_MB_L1_TLB2_CNTL, tmp);
+ WREG32(MC_VM_MB_L1_TLB3_CNTL, tmp);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_CNTL, ENABLE_CONTEXT | PAGE_TABLE_DEPTH(0) |
+ RANGE_PROTECTION_FAULT_ENABLE_DEFAULT);
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index 068b21f0d7df..3b6e641decd0 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -2537,7 +2537,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
+ L2_CACHE_BIGK_FRAGMENT_SIZE(0));
+ /* setup context0 */
+ WREG32(VM_CONTEXT0_PAGE_TABLE_START_ADDR, rdev->mc.gtt_start >> 12);
+- WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, rdev->mc.gtt_end >> 12);
++ WREG32(VM_CONTEXT0_PAGE_TABLE_END_ADDR, (rdev->mc.gtt_end >> 12) - 1);
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR, rdev->gart.table_addr >> 12);
+ WREG32(VM_CONTEXT0_PROTECTION_FAULT_DEFAULT_ADDR,
+ (u32)(rdev->dummy_page.addr >> 12));
+@@ -2555,7 +2555,7 @@ int si_pcie_gart_enable(struct radeon_device *rdev)
+ */
+ /* set vm size, must be a multiple of 4 */
+ WREG32(VM_CONTEXT1_PAGE_TABLE_START_ADDR, 0);
+- WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn);
++ WREG32(VM_CONTEXT1_PAGE_TABLE_END_ADDR, rdev->vm_manager.max_pfn - 1);
+ for (i = 1; i < 16; i++) {
+ if (i < 8)
+ WREG32(VM_CONTEXT0_PAGE_TABLE_BASE_ADDR + (i << 2),
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 3c8b2c473b81..980ef7e174fb 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ GFP_KERNEL);
+ if (!open_info) {
+ err = -ENOMEM;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ init_completion(&open_info->waitevent);
+@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+
+ if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ err = -EINVAL;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ if (userdatalen)
+@@ -234,6 +234,9 @@ error1:
+ list_del(&open_info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
++error_gpadl:
++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ free_pages((unsigned long)out,
+ get_order(send_ringbuffer_size + recv_ringbuffer_size));
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 9ffbfc575a0c..bcf67af0a07c 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -531,7 +531,7 @@ int vmbus_request_offers(void)
+ {
+ struct vmbus_channel_message_header *msg;
+ struct vmbus_channel_msginfo *msginfo;
+- int ret, t;
++ int ret;
+
+ msginfo = kmalloc(sizeof(*msginfo) +
+ sizeof(struct vmbus_channel_message_header),
+@@ -539,8 +539,6 @@ int vmbus_request_offers(void)
+ if (!msginfo)
+ return -ENOMEM;
+
+- init_completion(&msginfo->waitevent);
+-
+ msg = (struct vmbus_channel_message_header *)msginfo->msg;
+
+ msg->msgtype = CHANNELMSG_REQUESTOFFERS;
+@@ -554,14 +552,6 @@ int vmbus_request_offers(void)
+ goto cleanup;
+ }
+
+- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+- if (t == 0) {
+- ret = -ETIMEDOUT;
+- goto cleanup;
+- }
+-
+-
+-
+ cleanup:
+ kfree(msginfo);
+
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index 67432e200c63..8987a9ac0309 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -759,36 +759,43 @@ static int cma_get_net_info(void *hdr, enum rdma_port_space ps,
+ return 0;
+ }
+
++static __be16 ss_get_port(const struct sockaddr_storage *ss)
++{
++ if (ss->ss_family == AF_INET)
++ return ((struct sockaddr_in *)ss)->sin_port;
++ else if (ss->ss_family == AF_INET6)
++ return ((struct sockaddr_in6 *)ss)->sin6_port;
++ BUG();
++}
++
+ static void cma_save_net_info(struct rdma_addr *addr,
+ struct rdma_addr *listen_addr,
+ u8 ip_ver, __be16 port,
+ union cma_ip_addr *src, union cma_ip_addr *dst)
+ {
+- struct sockaddr_in *listen4, *ip4;
+- struct sockaddr_in6 *listen6, *ip6;
++ struct sockaddr_in *ip4;
++ struct sockaddr_in6 *ip6;
+
+ switch (ip_ver) {
+ case 4:
+- listen4 = (struct sockaddr_in *) &listen_addr->src_addr;
+ ip4 = (struct sockaddr_in *) &addr->src_addr;
+- ip4->sin_family = listen4->sin_family;
++ ip4->sin_family = AF_INET;;
+ ip4->sin_addr.s_addr = dst->ip4.addr;
+- ip4->sin_port = listen4->sin_port;
++ ip4->sin_port = ss_get_port(&listen_addr->src_addr);
+
+ ip4 = (struct sockaddr_in *) &addr->dst_addr;
+- ip4->sin_family = listen4->sin_family;
++ ip4->sin_family = AF_INET;
+ ip4->sin_addr.s_addr = src->ip4.addr;
+ ip4->sin_port = port;
+ break;
+ case 6:
+- listen6 = (struct sockaddr_in6 *) &listen_addr->src_addr;
+ ip6 = (struct sockaddr_in6 *) &addr->src_addr;
+- ip6->sin6_family = listen6->sin6_family;
++ ip6->sin6_family = AF_INET6;
+ ip6->sin6_addr = dst->ip6;
+- ip6->sin6_port = listen6->sin6_port;
++ ip6->sin6_port = ss_get_port(&listen_addr->src_addr);
+
+ ip6 = (struct sockaddr_in6 *) &addr->dst_addr;
+- ip6->sin6_family = listen6->sin6_family;
++ ip6->sin6_family = AF_INET6;
+ ip6->sin6_addr = src->ip6;
+ ip6->sin6_port = port;
+ break;
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index d0254beb6d90..c1fef27010d4 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,6 +94,9 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ if (!size)
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index 3a7848966627..b53548c153be 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
+
+ memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+
+- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+- wr->wr.ud.hlen);
++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ *lso_seg_len = halign;
+ return 0;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index f2c2ffedeff5..8eeff9e13319 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -313,7 +313,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev,
+ unsigned int x2, unsigned int y2)
+ {
+ elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+
+ /*
+@@ -783,6 +783,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
+ }
+
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++ unsigned int rate)
++{
++ struct elantech_data *etd = psmouse->private;
++
++ etd->original_set_rate(psmouse, rate);
++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++ psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+ * Put the touchpad into absolute mode
+ */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -980,6 +995,8 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse,
+ * Asus K53SV 0x450f01 78, 15, 0c 2 hw buttons
+ * Asus G46VW 0x460f02 00, 18, 0c 2 hw buttons
+ * Asus G750JX 0x360f00 00, 16, 0c 2 hw buttons
++ * Asus TP500LN 0x381f17 10, 14, 0e clickpad
++ * Asus X750JN 0x381f17 10, 14, 0e clickpad
+ * Asus UX31 0x361f00 20, 15, 0e clickpad
+ * Asus UX32VD 0x361f02 00, 15, 0e clickpad
+ * Avatar AVIU-145A2 0x361f00 ? clickpad
+@@ -1219,10 +1236,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ return true;
+
+ /*
+- * Some models have a revision higher then 20. Meaning param[2] may
+- * be 10 or 20, skip the rates check for these.
++ * Some hw_version >= 4 models have a revision higher then 20. Meaning
++ * that param[2] may be 10 or 20, skip the rates check for these.
+ */
+- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
++ param[2] < 40)
+ return true;
+
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+@@ -1427,6 +1445,11 @@ int elantech_init(struct psmouse *psmouse)
+ goto init_fail;
+ }
+
++ if (etd->fw_version == 0x381f17) {
++ etd->original_set_rate = psmouse->set_rate;
++ psmouse->set_rate = elantech_set_rate_restore_reg_07;
++ }
++
+ if (elantech_set_input_params(psmouse)) {
+ psmouse_err(psmouse, "failed to query touchpad range.\n");
+ goto init_fail;
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 46db3be45ac9..4d1b220cbdfc 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -137,6 +137,7 @@ struct elantech_data {
+ struct finger_pos mt[ETP_MAX_FINGERS];
+ unsigned char parity[256];
+ int (*send_cmd)(struct psmouse *psmouse, unsigned char c, unsigned char *param);
++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index b5fdcb78a75b..34842e5e8b55 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -171,7 +171,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ unsigned long addr, unsigned long len)
+ {
+- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+
+ /*
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 926989d6419f..a1bd68885c7c 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -782,11 +782,10 @@ static int crypt_convert(struct crypt_config *cc,
+
+ switch (r) {
+ /* async */
++ case -EINPROGRESS:
+ case -EBUSY:
+ wait_for_completion(&ctx->restart);
+ INIT_COMPLETION(ctx->restart);
+- /* fall through*/
+- case -EINPROGRESS:
+ this_cc->req = NULL;
+ ctx->sector++;
+ continue;
+@@ -1195,10 +1194,8 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ struct dm_crypt_io *io = container_of(ctx, struct dm_crypt_io, ctx);
+ struct crypt_config *cc = io->target->private;
+
+- if (error == -EINPROGRESS) {
+- complete(&ctx->restart);
++ if (error == -EINPROGRESS)
+ return;
+- }
+
+ if (!error && cc->iv_gen_ops && cc->iv_gen_ops->post)
+ error = cc->iv_gen_ops->post(cc, iv_of_dmreq(cc, dmreq), dmreq);
+@@ -1209,12 +1206,15 @@ static void kcryptd_async_done(struct crypto_async_request *async_req,
+ mempool_free(req_of_dmreq(cc, dmreq), cc->req_pool);
+
+ if (!atomic_dec_and_test(&ctx->pending))
+- return;
++ goto done;
+
+ if (bio_data_dir(io->base_bio) == READ)
+ kcryptd_crypt_read_done(io);
+ else
+ kcryptd_crypt_write_io_submit(io, 1);
++done:
++ if (!completion_done(&ctx->restart))
++ complete(&ctx->restart);
+ }
+
+ static void kcryptd_crypt(struct work_struct *work)
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 17e2f526457c..83dba060525b 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -5431,9 +5431,9 @@ static int get_bitmap_file(struct mddev * mddev, void __user * arg)
+ int err = -ENOMEM;
+
+ if (md_allow_write(mddev))
+- file = kmalloc(sizeof(*file), GFP_NOIO);
++ file = kzalloc(sizeof(*file), GFP_NOIO);
+ else
+- file = kmalloc(sizeof(*file), GFP_KERNEL);
++ file = kzalloc(sizeof(*file), GFP_KERNEL);
+
+ if (!file)
+ goto out;
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c276ad09ace9..7a218e81eb39 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1622,7 +1622,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+
+ conf->slab_cache = sc;
+ conf->active_name = 1-conf->active_name;
+- conf->pool_size = newsize;
++ if (!err)
++ conf->pool_size = newsize;
+ return err;
+ }
+
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index 9729b92fbfdd..f8449d534a25 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+
+ if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
+ if (msb->data_dir == READ) {
+- for (cnt = 0; cnt < msb->current_seg; cnt++)
++ for (cnt = 0; cnt < msb->current_seg; cnt++) {
+ t_len += msb->req_sg[cnt].length
+ / msb->page_size;
+
+@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ t_len += msb->current_page - 1;
+
+ t_len *= msb->page_size;
++ }
+ }
+ } else
+ t_len = blk_rq_bytes(msb->block_req);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index ba821fe70bca..eef126126478 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2370,6 +2370,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
++ case PM_RESTORE_PREPARE:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
+index e6f08d945709..c300cc4dcda0 100644
+--- a/drivers/mmc/host/atmel-mci.c
++++ b/drivers/mmc/host/atmel-mci.c
+@@ -1125,7 +1125,7 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+
+ if (ios->clock) {
+ unsigned int clock_min = ~0U;
+- u32 clkdiv;
++ int clkdiv;
+
+ spin_lock_bh(&host->lock);
+ if (!host->mode_reg) {
+@@ -1150,7 +1150,12 @@ static void atmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+ /* Calculate clock divider */
+ if (host->caps.has_odd_clk_div) {
+ clkdiv = DIV_ROUND_UP(host->bus_hz, clock_min) - 2;
+- if (clkdiv > 511) {
++ if (clkdiv < 0) {
++ dev_warn(&mmc->class_dev,
++ "clock %u too fast; using %lu\n",
++ clock_min, host->bus_hz / 2);
++ clkdiv = 0;
++ } else if (clkdiv > 511) {
+ dev_warn(&mmc->class_dev,
+ "clock %u too slow; using %lu\n",
+ clock_min, host->bus_hz / (511 + 2));
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index ad76592fb2f4..7ac2c05783f3 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ /* Validate the request */
+ err = -EINVAL;
+ if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+- req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++ req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ break;
+ if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM &&
+ req.dtype != UBI_UNKNOWN)
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index 2455d620d96b..9abc0ea6702e 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
+ * during re-size.
+ */
+ ubi_scan_move_to_list(sv, seb, &si->erase);
+- vol->eba_tbl[seb->lnum] = seb->pnum;
++ else
++ vol->eba_tbl[seb->lnum] = seb->pnum;
+ }
+ }
+
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index 7c1a9bf8ac86..284d144ff5a6 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -666,7 +666,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ int cancel)
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+- int vol_id = -1, uninitialized_var(lnum);
++ int vol_id = -1, lnum = -1;
+ struct ubi_wl_entry *e1, *e2;
+ struct ubi_vid_hdr *vid_hdr;
+
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 8d8908d2a9b1..b7a7524c8693 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -144,6 +144,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
+ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int *work_done, int work_to_do);
++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
++ struct e1000_rx_ring *rx_ring,
++ int cleaned_count)
++{
++}
+ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int cleaned_count);
+@@ -3545,8 +3550,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ msleep(1);
+ /* e1000_down has a dependency on max_frame_size */
+ hw->max_frame_size = max_frame;
+- if (netif_running(netdev))
++ if (netif_running(netdev)) {
++ /* prevent buffers from being reallocated */
++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
+ e1000_down(adapter);
++ }
+
+ /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+ * means we reserve 2 more, this pushes us to allocate from the next
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 2c4cdcecbe39..091c85f461a1 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -357,6 +357,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index 2b6faa069e9a..9b6cb583883a 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -119,7 +119,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+
+ do {
+ status = usb_control_msg(udev, pipe, request, reqtype, value,
+- index, pdata, len, 0); /*max. timeout*/
++ index, pdata, len, 1000);
+ if (status < 0) {
+ /* firmware download is checksumed, don't retry */
+ if ((value >= FW_8192C_START_ADDRESS &&
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 1887e2f166a4..67938889f5b6 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -1047,7 +1047,13 @@ static int __devinit compal_probe(struct platform_device *pdev)
+
+ /* Power supply */
+ initialize_power_supply_data(data);
+- power_supply_register(&compal_device->dev, &data->psy);
++ err = power_supply_register(&compal_device->dev, &data->psy);
++ if (err < 0) {
++ hwmon_device_unregister(data->hwmon_dev);
++ sysfs_remove_group(&pdev->dev.kobj,
++ &compal_attribute_group);
++ kfree(data);
++ }
+
+ platform_set_drvdata(pdev, data);
+
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 3868ab2397c6..fb37df690b9a 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
+ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
+ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
+ static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
+
+ /* Functions */
+
+@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twa_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for valid status after each drain */
+@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
+ }
+ } /* End twa_load_sgl() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twa_map_scsi_sg_data() */
+-
+ /* This function will poll for a response interrupt of a request */
+ static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+ {
+@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+ if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twa_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ switch (retval) {
+ case SCSI_MLQUEUE_HOST_BUSY:
++ scsi_dma_unmap(SCpnt);
+ twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ break;
+ case 1:
+- tw_dev->state[request_id] = TW_S_COMPLETED;
+- twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ SCpnt->result = (DID_ERROR << 16);
++ scsi_dma_unmap(SCpnt);
+ done(SCpnt);
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twa_free_request_id(tw_dev, request_id);
+ retval = 0;
+ }
+ out:
+@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+ command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
+ } else {
+- sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count < 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
+ return(table[index].text);
+ } /* End twa_string_lookup() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twa_unmap_scsi_data() */
+-
+ /* This function gets called when a disk is coming on-line */
+ static int twa_slave_configure(struct scsi_device *sdev)
+ {
+diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
+index 040f7214e5b7..0fdc83cfa0e1 100644
+--- a/drivers/scsi/3w-9xxx.h
++++ b/drivers/scsi/3w-9xxx.h
+@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_9550SX_DRAIN_COMPLETED 0xFFFF
+ #define TW_SECTOR_SIZE 512
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+index 13e39e1fdfe2..c555ccb119d1 100644
+--- a/drivers/scsi/3w-sas.c
++++ b/drivers/scsi/3w-sas.c
+@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+ return 0;
+ } /* End twl_post_command_packet() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twl_map_scsi_sg_data() */
+-
+ /* This function hands scsi cdb's to the firmware */
+ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+ {
+@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ if (!sglistarg) {
+ /* Map sglist from scsi layer to cmd packet */
+ if (scsi_sg_count(srb)) {
+- sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count <= 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1116,15 +1096,6 @@ out:
+ return retval;
+ } /* End twl_initialize_device_extension() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twl_unmap_scsi_data() */
+-
+ /* This function will handle attention interrupts */
+ static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+ {
+@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twl_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twl_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for another response interrupt */
+@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
+ if ((tw_dev->state[i] != TW_S_FINISHED) &&
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+- if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twl_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ if (cmd) {
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ if (retval) {
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+index d474892701d4..fec6449c7595 100644
+--- a/drivers/scsi/3w-sas.h
++++ b/drivers/scsi/3w-sas.h
+@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_SECTOR_SIZE 512
+ #define TW_MAX_UNITS 32
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 7fe96ff60c58..86bc5f9212d6 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
+ return 0;
+ } /* End tw_initialize_device_extension() */
+
+-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- int use_sg;
+-
+- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
+-
+- use_sg = scsi_dma_map(cmd);
+- if (use_sg < 0) {
+- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End tw_map_scsi_sg_data() */
+-
+-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End tw_unmap_scsi_data() */
+-
+ /* This function will reset a device extension */
+ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ {
+@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ srb = tw_dev->srb[i];
+ if (srb != NULL) {
+ srb->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
++ scsi_dma_unmap(srb);
++ srb->scsi_done(srb);
+ }
+ }
+ }
+@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
+ command_packet->byte8.io.lba = lba;
+ command_packet->byte6.block_count = num_sectors;
+
+- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+- if (!use_sg)
++ use_sg = scsi_dma_map(srb);
++ if (use_sg <= 0)
+ return 1;
+
+ scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
+@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ switch (*command) {
+ case READ_10:
+ case READ_6:
+@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
+
+ /* Now complete the io */
+ if ((error != TW_ISR_DONT_COMPLETE)) {
++ scsi_dma_unmap(tw_dev->srb[request_id]);
++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ tw_state_request_finish(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+ }
+ }
+
+diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
+index 49dcf03c631a..1d31858766ce 100644
+--- a/drivers/scsi/3w-xxxx.h
++++ b/drivers/scsi/3w-xxxx.h
+@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
+ #define TW_AEN_SMART_FAIL 0x000F
+ #define TW_AEN_SBUF_FAIL 0x0024
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_ALIGNMENT_6000 64 /* 64 bytes */
+ #define TW_ALIGNMENT_7000 4 /* 4 bytes */
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index bfd87fab39aa..3e0f71c155a3 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
+ fp_possible = io_info.fpOkForIo;
+ }
+
+- /* Use smp_processor_id() for now until cmd->request->cpu is CPU
++ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
+ id by default, not CPU group id, otherwise all MSI-X queues won't
+ be utilized */
+ cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
+- smp_processor_id() % instance->msix_vectors : 0;
++ raw_smp_processor_id() % instance->msix_vectors : 0;
+
+ if (fp_possible) {
+ megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp,
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index cf8dfab9489f..28a635c66f3e 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -222,6 +222,7 @@ static struct {
+ {"PIONEER", "CD-ROM DRM-604X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"PIONEER", "CD-ROM DRM-624X", NULL, BLIST_FORCELUN | BLIST_SINGLELUN},
+ {"Promise", "", NULL, BLIST_SPARSELUN},
++ {"QNAP", "iSCSI Storage", NULL, BLIST_MAX_1024},
+ {"QUANTUM", "XP34301", "1071", BLIST_NOTQ},
+ {"REGAL", "CDC-4X", NULL, BLIST_MAX5LUN | BLIST_SINGLELUN},
+ {"SanDisk", "ImageMate CF-SD1", NULL, BLIST_FORCELUN},
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 348840e80921..37abf4fdc8d7 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -888,6 +888,12 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned char *inq_result,
+ */
+ if (*bflags & BLIST_MAX_512)
+ blk_queue_max_hw_sectors(sdev->request_queue, 512);
++ /*
++ * Max 1024 sector transfer length for targets that report incorrect
++ * max/optimal lengths and relied on the old block layer safe default
++ */
++ else if (*bflags & BLIST_MAX_1024)
++ blk_queue_max_hw_sectors(sdev->request_queue, 1024);
+
+ /*
+ * Some devices may not want to have a start command automatically
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 7f6746a642e6..97aa6c647da9 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1423,6 +1423,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ {
+ u64 start_lba = blk_rq_pos(scmd->request);
+ u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++ u64 factor = scmd->device->sector_size / 512;
+ u64 bad_lba;
+ int info_valid;
+ /*
+@@ -1444,16 +1445,10 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ return 0;
+
+- if (scmd->device->sector_size < 512) {
+- /* only legitimate sector_size here is 256 */
+- start_lba <<= 1;
+- end_lba <<= 1;
+- } else {
+- /* be careful ... don't want any overflows */
+- u64 factor = scmd->device->sector_size / 512;
+- do_div(start_lba, factor);
+- do_div(end_lba, factor);
+- }
++ /* be careful ... don't want any overflows */
++ factor = scmd->device->sector_size / 512;
++ do_div(start_lba, factor);
++ do_div(end_lba, factor);
+
+ /* The bad lba was reported incorrectly, we have no idea where
+ * the error is.
+@@ -1984,8 +1979,7 @@ got_data:
+ if (sector_size != 512 &&
+ sector_size != 1024 &&
+ sector_size != 2048 &&
+- sector_size != 4096 &&
+- sector_size != 256) {
++ sector_size != 4096) {
+ sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ sector_size);
+ /*
+@@ -2034,8 +2028,6 @@ got_data:
+ sdkp->capacity <<= 2;
+ else if (sector_size == 1024)
+ sdkp->capacity <<= 1;
+- else if (sector_size == 256)
+- sdkp->capacity >>= 1;
+
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
+diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
+index a0df0fbf2db9..4ae776995e2a 100644
+--- a/drivers/scsi/storvsc_drv.c
++++ b/drivers/scsi/storvsc_drv.c
+@@ -610,21 +610,22 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
+ if (bounce_sgl[j].length == PAGE_SIZE) {
+ /* full..move to next entry */
+ sg_kunmap_atomic(bounce_addr);
++ bounce_addr = 0;
+ j++;
++ }
+
+- /* if we need to use another bounce buffer */
+- if (srclen || i != orig_sgl_count - 1)
+- bounce_addr = sg_kmap_atomic(bounce_sgl,j);
++ /* if we need to use another bounce buffer */
++ if (srclen && bounce_addr == 0)
++ bounce_addr = sg_kmap_atomic(bounce_sgl, j);
+
+- } else if (srclen == 0 && i == orig_sgl_count - 1) {
+- /* unmap the last bounce that is < PAGE_SIZE */
+- sg_kunmap_atomic(bounce_addr);
+- }
+ }
+
+ sg_kunmap_atomic(src_addr - orig_sgl[i].offset);
+ }
+
++ if (bounce_addr)
++ sg_kunmap_atomic(bounce_addr);
++
+ local_irq_restore(flags);
+
+ return total_copied;
+diff --git a/drivers/staging/ozwpan/ozusbsvc1.c b/drivers/staging/ozwpan/ozusbsvc1.c
+index 66bd576bb5e9..ca61576dc46a 100644
+--- a/drivers/staging/ozwpan/ozusbsvc1.c
++++ b/drivers/staging/ozwpan/ozusbsvc1.c
+@@ -314,7 +314,11 @@ void oz_usb_handle_ep_data(struct oz_usb_ctx *usb_ctx,
+ struct oz_multiple_fixed *body =
+ (struct oz_multiple_fixed *)data_hdr;
+ u8 *data = body->data;
+- int n = (len - sizeof(struct oz_multiple_fixed)+1)
++ unsigned int n;
++ if (!body->unit_size ||
++ len < sizeof(struct oz_multiple_fixed) - 1)
++ break;
++ n = (len - (sizeof(struct oz_multiple_fixed) - 1))
+ / body->unit_size;
+ while (n--) {
+ oz_hcd_data_ind(usb_ctx->hport, body->endpoint,
+@@ -376,10 +380,15 @@ void oz_usb_rx(struct oz_pd *pd, struct oz_elt *elt)
+ case OZ_GET_DESC_RSP: {
+ struct oz_get_desc_rsp *body =
+ (struct oz_get_desc_rsp *)usb_hdr;
+- int data_len = elt->length -
+- sizeof(struct oz_get_desc_rsp) + 1;
+- u16 offs = le16_to_cpu(get_unaligned(&body->offset));
+- u16 total_size =
++ u16 offs, total_size;
++ u8 data_len;
++
++ if (elt->length < sizeof(struct oz_get_desc_rsp) - 1)
++ break;
++ data_len = elt->length -
++ (sizeof(struct oz_get_desc_rsp) - 1);
++ offs = le16_to_cpu(get_unaligned(&body->offset));
++ total_size =
+ le16_to_cpu(get_unaligned(&body->total_size));
+ oz_trace("USB_REQ_GET_DESCRIPTOR - cnf\n");
+ oz_hcd_get_desc_cnf(usb_ctx->hport, body->req_id,
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index 6183573f112f..5d4b4f07f4b8 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -273,11 +273,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
+ * LCD types
+ */
+ #define LCD_TYPE_NONE 0
+-#define LCD_TYPE_OLD 1
+-#define LCD_TYPE_KS0074 2
+-#define LCD_TYPE_HANTRONIX 3
+-#define LCD_TYPE_NEXCOM 4
+-#define LCD_TYPE_CUSTOM 5
++#define LCD_TYPE_CUSTOM 1
++#define LCD_TYPE_OLD 2
++#define LCD_TYPE_KS0074 3
++#define LCD_TYPE_HANTRONIX 4
++#define LCD_TYPE_NEXCOM 5
+
+ /*
+ * keypad types
+@@ -455,8 +455,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");
+ static int lcd_type = -1;
+ module_param(lcd_type, int, 0000);
+ MODULE_PARM_DESC(lcd_type,
+- "LCD type: 0=none, 1=old //, 2=serial ks0074, "
+- "3=hantronix //, 4=nexcom //, 5=compiled-in");
++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom");
+
+ static int lcd_proto = -1;
+ module_param(lcd_proto, int, 0000);
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index 808267456eed..ec7e71c1e86c 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -567,6 +567,7 @@ static struct se_device *pscsi_create_virtdevice(
+ " pdv_host_id: %d\n", pdv->pdv_host_id);
+ return ERR_PTR(-EINVAL);
+ }
++ pdv->pdv_lld_host = sh;
+ }
+ } else {
+ if (phv->phv_mode == PHV_VIRTUAL_HOST_ID) {
+@@ -653,6 +654,8 @@ static void pscsi_free_device(void *p)
+ if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
+ (phv->phv_lld_host != NULL))
+ scsi_host_put(phv->phv_lld_host);
++ else if (pdv->pdv_lld_host)
++ scsi_host_put(pdv->pdv_lld_host);
+
+ if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
+ scsi_device_put(sd);
+diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
+index 43f1c419e8e5..6c23c9443dd4 100644
+--- a/drivers/target/target_core_pscsi.h
++++ b/drivers/target/target_core_pscsi.h
+@@ -45,6 +45,7 @@ struct pscsi_dev_virt {
+ int pdv_lun_id;
+ struct block_device *pdv_bd;
+ struct scsi_device *pdv_sd;
++ struct Scsi_Host *pdv_lld_host;
+ struct se_hba *pdv_se_hba;
+ } ____cacheline_aligned;
+
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 944eaeb8e0cf..160b1f38c5df 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -290,7 +290,7 @@ static int xen_initial_domain_console_init(void)
+ return -ENOMEM;
+ }
+
+- info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++ info->irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ info->vtermno = HVC_COOKIE;
+
+ spin_lock(&xencons_lock);
+@@ -300,11 +300,27 @@ static int xen_initial_domain_console_init(void)
+ return 0;
+ }
+
++static void xen_console_update_evtchn(struct xencons_info *info)
++{
++ if (xen_hvm_domain()) {
++ uint64_t v;
++ int err;
++
++ err = hvm_get_parameter(HVM_PARAM_CONSOLE_EVTCHN, &v);
++ if (!err && v)
++ info->evtchn = v;
++ } else
++ info->evtchn = xen_start_info->console.domU.evtchn;
++}
++
+ void xen_console_resume(void)
+ {
+ struct xencons_info *info = vtermno_to_xencons(HVC_COOKIE);
+- if (info != NULL && info->irq)
++ if (info != NULL && info->irq) {
++ if (!xen_initial_domain())
++ xen_console_update_evtchn(info);
+ rebind_evtchn_irq(info->evtchn, info->irq);
++ }
+ }
+
+ static void xencons_disconnect_backend(struct xencons_info *info)
+diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
+index 6563cad09293..746e771c2789 100644
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ { .compatible = "ibm,qpace-nwp-serial",
+ .data = (void *)PORT_NWPSERIAL, },
+ #endif
+- { .type = "serial", .data = (void *)PORT_UNKNOWN, },
+ { /* end of list */ },
+ };
+
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 6cd414341d5e..d9706e734b76 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+
+ static int __devinit ulite_probe(struct platform_device *pdev)
+ {
+- struct resource *res, *res2;
++ struct resource *res;
++ int irq;
+ int id = pdev->id;
+ #ifdef CONFIG_OF
+ const __be32 *prop;
+@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+- return ulite_assign(&pdev->dev, id, res->start, res2->start);
++ return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+
+ static int __devexit ulite_remove(struct platform_device *pdev)
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b627363352e5..778c39a85962 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
+ **/
+ static int __devinit xuartps_probe(struct platform_device *pdev)
+ {
+- int rc;
++ int rc, irq;
+ struct uart_port *port;
+- struct resource *res, *res2;
++ struct resource *res;
+ int clk = 0;
+
+ #ifdef CONFIG_OF
+@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+ /* Initialize the port structure */
+ port = xuartps_get_port();
+@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ * and triggers invocation of the config_port() entry point.
+ */
+ port->mapbase = res->start;
+- port->irq = res2->start;
++ port->irq = irq;
+ port->dev = &pdev->dev;
+ port->uartclk = clk;
+ dev_set_drvdata(&pdev->dev, port);
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index e5fa34e5423f..c65c93959f89 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -268,7 +268,7 @@ static void wdm_int_callback(struct urb *urb)
+ case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+ dev_dbg(&desc->intf->dev,
+ "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
+- dr->wIndex, dr->wLength);
++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
+ break;
+
+ case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+@@ -281,7 +281,9 @@ static void wdm_int_callback(struct urb *urb)
+ clear_bit(WDM_POLL_RUNNING, &desc->flags);
+ dev_err(&desc->intf->dev,
+ "unknown notification %d received: index %d len %d\n",
+- dr->bNotificationType, dr->wIndex, dr->wLength);
++ dr->bNotificationType,
++ le16_to_cpu(dr->wIndex),
++ le16_to_cpu(dr->wLength));
+ goto exit;
+ }
+
+@@ -425,7 +427,7 @@ static ssize_t wdm_write
+ USB_RECIP_INTERFACE);
+ req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
+ req->wValue = 0;
+- req->wIndex = desc->inum;
++ req->wIndex = desc->inum; /* already converted */
+ req->wLength = cpu_to_le16(count);
+ set_bit(WDM_IN_USE, &desc->flags);
+ desc->outbuf = buf;
+@@ -438,7 +440,7 @@ static ssize_t wdm_write
+ dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ } else {
+ dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
+- req->wIndex);
++ le16_to_cpu(req->wIndex));
+ }
+ out:
+ usb_autopm_put_interface(desc->intf);
+@@ -782,7 +784,7 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
+ desc->irq->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
+ desc->irq->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+ desc->irq->wValue = 0;
+- desc->irq->wIndex = desc->inum;
++ desc->irq->wIndex = desc->inum; /* already converted */
+ desc->irq->wLength = cpu_to_le16(desc->wMaxCommand);
+
+ usb_fill_control_urb(
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index e47a4e12b297..5e93425424f6 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2129,8 +2129,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ break;
+ case COMP_DEV_ERR:
+ case COMP_STALL:
++ frame->status = -EPROTO;
++ skip_td = true;
++ break;
+ case COMP_TX_ERR:
+ frame->status = -EPROTO;
++ if (event_trb != td->last_trb)
++ return 0;
+ skip_td = true;
+ break;
+ case COMP_STOP:
+@@ -2738,7 +2743,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ xhci_halt(xhci);
+ hw_died:
+ spin_unlock(&xhci->lock);
+- return -ESHUTDOWN;
++ return IRQ_HANDLED;
+ }
+
+ /*
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 80b3d8559b09..855f084a9a32 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1233,7 +1233,7 @@ union xhci_trb {
+ * since the command ring is 64-byte aligned.
+ * It must also be greater than 16.
+ */
+-#define TRBS_PER_SEGMENT 64
++#define TRBS_PER_SEGMENT 256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
+ #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index a2b4008dc069..d3481c497be9 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1544,16 +1544,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
+ musb->int_usb, musb->int_tx, musb->int_rx);
+
+- /* the core can interrupt us for multiple reasons; docs have
+- * a generic interrupt flowchart to follow
++ /**
++ * According to Mentor Graphics' documentation, flowchart on page 98,
++ * IRQ should be handled as follows:
++ *
++ * . Resume IRQ
++ * . Session Request IRQ
++ * . VBUS Error IRQ
++ * . Suspend IRQ
++ * . Connect IRQ
++ * . Disconnect IRQ
++ * . Reset/Babble IRQ
++ * . SOF IRQ (we're not using this one)
++ * . Endpoint 0 IRQ
++ * . TX Endpoints
++ * . RX Endpoints
++ *
++ * We will be following that flowchart in order to avoid any problems
++ * that might arise with internal Finite State Machine.
+ */
++
+ if (musb->int_usb)
+ retval |= musb_stage0_irq(musb, musb->int_usb,
+ devctl, power);
+
+- /* "stage 1" is handling endpoint irqs */
+-
+- /* handle endpoint 0 first */
+ if (musb->int_tx & 1) {
+ if (devctl & MUSB_DEVCTL_HM)
+ retval |= musb_h_ep0_irq(musb);
+@@ -1561,43 +1575,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ retval |= musb_g_ep0_irq(musb);
+ }
+
+- /* RX on endpoints 1-15 */
+- reg = musb->int_rx >> 1;
++ reg = musb->int_tx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval = ep->rx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (devctl & MUSB_DEVCTL_HM) {
+ if (is_host_capable())
+- musb_host_rx(musb, ep_num);
++ musb_host_tx(musb, ep_num);
+ } else {
+ if (is_peripheral_capable())
+- musb_g_rx(musb, ep_num);
++ musb_g_tx(musb, ep_num);
+ }
+ }
+-
+ reg >>= 1;
+ ep_num++;
+ }
+
+- /* TX on endpoints 1-15 */
+- reg = musb->int_tx >> 1;
++ reg = musb->int_rx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval |= ep->tx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (devctl & MUSB_DEVCTL_HM) {
+ if (is_host_capable())
+- musb_host_tx(musb, ep_num);
++ musb_host_rx(musb, ep_num);
+ } else {
+ if (is_peripheral_capable())
+- musb_g_tx(musb, ep_num);
++ musb_g_rx(musb, ep_num);
+ }
+ }
++
+ reg >>= 1;
+ ep_num++;
+ }
+diff --git a/drivers/usb/otg/otg_fsm.c b/drivers/usb/otg/otg_fsm.c
+index ade131a8ae5e..e87edda1fe22 100644
+--- a/drivers/usb/otg/otg_fsm.c
++++ b/drivers/usb/otg/otg_fsm.c
+@@ -138,9 +138,9 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+ break;
+ case OTG_STATE_B_PERIPHERAL:
+ otg_chrg_vbus(fsm, 0);
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
++ otg_loc_conn(fsm, 1);
+ break;
+ case OTG_STATE_B_WAIT_ACON:
+ otg_chrg_vbus(fsm, 0);
+@@ -200,10 +200,10 @@ int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+
+ break;
+ case OTG_STATE_A_PERIPHERAL:
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
+ otg_drv_vbus(fsm, 1);
++ otg_loc_conn(fsm, 1);
+ break;
+ case OTG_STATE_A_WAIT_VFALL:
+ otg_drv_vbus(fsm, 0);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 5c289fc2bc5a..29bf38309252 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 06abee68cb4f..1e4899c2d5f1 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 105b9826d8d6..1fee973f100a 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -155,6 +155,7 @@
+ #define XSENS_AWINDA_STATION_PID 0x0101
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
+ #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
+
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 3e450b4e9c5f..723ed876f318 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
+ { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
+- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 71fd9da1d6e7..e3b7af8adfb7 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -62,10 +62,6 @@
+ #define ALCATEL_VENDOR_ID 0x11f7
+ #define ALCATEL_PRODUCT_ID 0x02df
+
+-/* Samsung I330 phone cradle */
+-#define SAMSUNG_VENDOR_ID 0x04e8
+-#define SAMSUNG_PRODUCT_ID 0x8001
+-
+ #define SIEMENS_VENDOR_ID 0x11f5
+ #define SIEMENS_PRODUCT_ID_SX1 0x0001
+ #define SIEMENS_PRODUCT_ID_X65 0x0003
+diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
+index b3afd19341f1..c5cf350ea8ce 100644
+--- a/drivers/usb/serial/visor.c
++++ b/drivers/usb/serial/visor.c
+@@ -101,7 +101,7 @@ static struct usb_device_id id_table [] = {
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+ { USB_DEVICE(ACER_VENDOR_ID, ACER_S10_ID),
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID),
++ { USB_DEVICE_INTERFACE_CLASS(SAMSUNG_VENDOR_ID, SAMSUNG_SCH_I330_ID, 0xff),
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+ { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_SPH_I500_ID),
+ .driver_info = (kernel_ulong_t)&palm_os_4_probe },
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 25174beb8d8d..d0ecaf9ff415 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_GO_SLOW ),
+
++/* Reported by Christian Schaller <cschalle@redhat.com> */
++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000,
++ "LaCie",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_WP_DETECT ),
++
+ /* Submitted by Joel Bourquard <numlock@freesurf.ch>
+ * Some versions of this device need the SubClass and Protocol overrides
+ * while others don't.
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index 9161f06564eb..d6e2deee7bf0 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -563,8 +563,8 @@ static unsigned int __startup_pirq(unsigned int irq)
+ pirq_query_unmask(irq);
+
+ evtchn_to_irq[evtchn] = irq;
+- bind_evtchn_to_cpu(evtchn, 0);
+ info->evtchn = evtchn;
++ bind_evtchn_to_cpu(evtchn, 0);
+
+ out:
+ unmask_evtchn(evtchn);
+@@ -906,7 +906,7 @@ static int find_virq(unsigned int virq, unsigned int cpu)
+ return rc;
+ }
+
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ struct evtchn_bind_virq bind_virq;
+ int evtchn, irq, ret;
+@@ -920,8 +920,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+ if (irq == -1)
+ goto out;
+
+- irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+- handle_percpu_irq, "virq");
++ if (percpu)
++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++ handle_percpu_irq, "virq");
++ else
++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++ handle_edge_irq, "virq");
+
+ bind_virq.virq = virq;
+ bind_virq.vcpu = cpu;
+@@ -1042,7 +1046,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ {
+ int irq, retval;
+
+- irq = bind_virq_to_irq(virq, cpu);
++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ if (irq < 0)
+ return irq;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
+index cf38e159131a..08d90e25abf0 100644
+--- a/firmware/ihex2fw.c
++++ b/firmware/ihex2fw.c
+@@ -86,6 +86,7 @@ int main(int argc, char **argv)
+ case 'j':
+ include_jump = 1;
+ break;
++ default:
+ return usage();
+ }
+ }
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 6dacccef7790..a181b58cedd5 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -742,6 +742,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ int elf_prot = 0, elf_flags;
+ unsigned long k, vaddr;
++ unsigned long total_size = 0;
+
+ if (elf_ppnt->p_type != PT_LOAD)
+ continue;
+@@ -805,10 +806,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++ total_size = total_mapping_size(elf_phdata,
++ loc->elf_ex.e_phnum);
++ if (!total_size) {
++ error = -EINVAL;
++ goto out_free_dentry;
++ }
+ }
+
+ error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+- elf_prot, elf_flags, 0);
++ elf_prot, elf_flags, total_size);
+ if (BAD_ADDR(error)) {
+ send_sig(SIGKILL, current, 0);
+ retval = IS_ERR((void *)error) ?
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index cf6e7f4a4f4c..f4576dc0cf29 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5939,12 +5939,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
+ return -ENOSPC;
+ }
+
+- if (btrfs_test_opt(root, DISCARD))
+- ret = btrfs_discard_extent(root, start, len, NULL);
+-
+ if (pin)
+ pin_down_extent(root, cache, start, len, 1);
+ else {
++ if (btrfs_test_opt(root, DISCARD))
++ ret = btrfs_discard_extent(root, start, len, NULL);
+ btrfs_add_free_space(cache, start, len);
+ btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 3a65f4343416..d46c48187636 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2374,6 +2374,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ if (off + len == src->i_size)
+ len = ALIGN(src->i_size, bs) - off;
+
++ if (len == 0) {
++ ret = 0;
++ goto out_unlock;
++ }
++
+ /* verify the end result is block aligned */
+ if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
+ !IS_ALIGNED(destoff, bs))
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index e7a5659087e6..0ee73d128162 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
+ /*
+ * Check if the attribute is in a supported namespace.
+ *
+- * This applied after the check for the synthetic attributes in the system
++ * This is applied after the check for the synthetic attributes in the system
+ * namespace.
+ */
+-static bool btrfs_is_valid_xattr(const char *name)
++static int btrfs_is_valid_xattr(const char *name)
+ {
+- return !strncmp(name, XATTR_SECURITY_PREFIX,
+- XATTR_SECURITY_PREFIX_LEN) ||
+- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
+- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
++ int len = strlen(name);
++ int prefixlen = 0;
++
++ if (!strncmp(name, XATTR_SECURITY_PREFIX,
++ XATTR_SECURITY_PREFIX_LEN))
++ prefixlen = XATTR_SECURITY_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
++ prefixlen = XATTR_SYSTEM_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++ prefixlen = XATTR_TRUSTED_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
++ prefixlen = XATTR_USER_PREFIX_LEN;
++ else
++ return -EOPNOTSUPP;
++
++ /*
++ * The name cannot consist of just prefix
++ */
++ if (len <= prefixlen)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ void *buffer, size_t size)
+ {
++ int ret;
++
+ /*
+ * If this is a request for a synthetic attribute in the system.*
+ * namespace use the generic infrastructure to resolve a handler
+@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_getxattr(dentry, name, buffer, size);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+ return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
+ }
+
+@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ size_t size, int flags)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_setxattr(dentry, name, value, size, flags);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ if (size == 0)
+ value = ""; /* empty EA, do not remove */
+@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_removexattr(dentry, name);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0,
+ XATTR_REPLACE);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 8038a780696f..d071ea768057 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1204,13 +1204,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 4296a6f800a0..bbe09a975003 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -320,7 +320,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+ ext4_lblk_t last = lblock + len - 1;
+
+- if (lblock > last)
++ if (len == 0 || lblock > last)
+ return 0;
+ return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+@@ -4365,13 +4365,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ struct ext4_map_blocks map;
+ unsigned int credits, blkbits = inode->i_blkbits;
+
+- /*
+- * currently supporting (pre)allocate mode for extent-based
+- * files _only_
+- */
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- return -EOPNOTSUPP;
+-
+ /* Return error if mode is not supported */
+ if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ return -EOPNOTSUPP;
+@@ -4392,6 +4385,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ */
+ credits = ext4_chunk_trans_blocks(inode, max_blocks);
+ mutex_lock(&inode->i_mutex);
++
++ /*
++ * We only support preallocation for extent-based files only
++ */
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++ mutex_unlock(&inode->i_mutex);
++ return -EOPNOTSUPP;
++ }
++
+ ret = inode_newsize_ok(inode, (len + offset));
+ if (ret) {
+ mutex_unlock(&inode->i_mutex);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index dc5852301da7..e1e1d467c6f9 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1469,7 +1469,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ struct inode *inode)
+ {
+ struct inode *dir = dentry->d_parent->d_inode;
+- struct buffer_head *bh;
++ struct buffer_head *bh = NULL;
+ struct ext4_dir_entry_2 *de;
+ struct super_block *sb;
+ int retval;
+@@ -1484,7 +1484,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if (is_dx(dir)) {
+ retval = ext4_dx_add_entry(handle, dentry, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+- return retval;
++ goto out;
+ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+@@ -1495,14 +1495,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if(!bh)
+ return retval;
+ retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+- if (retval != -ENOSPC) {
+- brelse(bh);
+- return retval;
+- }
++ if (retval != -ENOSPC)
++ goto out;
+
+ if (blocks == 1 && !dx_fallback &&
+- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+- return make_indexed_dir(handle, dentry, inode, bh);
++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++ retval = make_indexed_dir(handle, dentry, inode, bh);
++ bh = NULL; /* make_indexed_dir releases bh */
++ goto out;
++ }
+ brelse(bh);
+ }
+ bh = ext4_append(handle, dir, &block, &retval);
+@@ -1512,6 +1513,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ de->inode = 0;
+ de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ brelse(bh);
+ if (retval == 0)
+ ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index a48e4a139be1..f7c18e97d852 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -198,8 +198,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ goto out_err;
+ }
+ /* copy the full handle */
+- if (copy_from_user(handle, ufh,
+- sizeof(struct file_handle) +
++ *handle = f_handle;
++ if (copy_from_user(&handle->f_handle,
++ &ufh->f_handle,
+ f_handle.handle_bytes)) {
+ retval = -EFAULT;
+ goto out_handle;
+diff --git a/fs/namei.c b/fs/namei.c
+index bdcd70544fce..9c4b9b811d7b 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -1314,7 +1314,8 @@ static inline int walk_component(struct nameidata *nd, struct path *path,
+ }
+ if (should_follow_link(inode, follow)) {
+ if (nd->flags & LOOKUP_RCU) {
+- if (unlikely(unlazy_walk(nd, path->dentry))) {
++ if (unlikely(nd->path.mnt != path->mnt ||
++ unlazy_walk(nd, path->dentry))) {
+ terminate_walk(nd);
+ return -ECHILD;
+ }
+diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
+index 38a44c679a0a..0184e91eb4fa 100644
+--- a/fs/nfs/callback.c
++++ b/fs/nfs/callback.c
+@@ -156,6 +156,7 @@ nfs41_callback_svc(void *vrqstp)
+ struct rpc_rqst, rq_bc_list);
+ list_del(&req->rq_bc_list);
+ spin_unlock_bh(&serv->sv_cb_lock);
++ finish_wait(&serv->sv_cb_waitq, &wq);
+ dprintk("Invoking bc_svc_process()\n");
+ error = bc_svc_process(serv, req, rqstp);
+ dprintk("bc_svc_process() returned w/ error code= %d\n",
+@@ -163,8 +164,9 @@ nfs41_callback_svc(void *vrqstp)
+ } else {
+ spin_unlock_bh(&serv->sv_cb_lock);
+ schedule();
++ finish_wait(&serv->sv_cb_waitq, &wq);
+ }
+- finish_wait(&serv->sv_cb_waitq, &wq);
++ flush_signals(current);
+ }
+ return 0;
+ }
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index a4b87c69fbbb..6143a1ea63b1 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3364,10 +3364,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess
+ return nfserr_old_stateid;
+ }
+
++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
++{
++ if (ols->st_stateowner->so_is_open_owner &&
++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ return nfserr_bad_stateid;
++ return nfs_ok;
++}
++
+ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ {
+ struct nfs4_stid *s;
+- struct nfs4_ol_stateid *ols;
+ __be32 status;
+
+ if (STALE_STATEID(stateid))
+@@ -3381,11 +3388,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ return status;
+ if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
+ return nfs_ok;
+- ols = openlockstateid(s);
+- if (ols->st_stateowner->so_is_open_owner
+- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
+- return nfserr_bad_stateid;
+- return nfs_ok;
++ return nfsd4_check_openowner_confirmed(openlockstateid(s));
+ }
+
+ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
+@@ -3452,8 +3455,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
+ status = nfs4_check_fh(current_fh, stp);
+ if (status)
+ goto out;
+- if (stp->st_stateowner->so_is_open_owner
+- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ status = nfsd4_check_openowner_confirmed(stp);
++ if (status)
+ goto out;
+ status = nfs4_check_openmode(stp, flags);
+ if (status)
+diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
+index 4db777d3dc05..c8bc7ea199f5 100644
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1163,15 +1163,15 @@ static int __init init_nfsd(void)
+ int retval;
+ printk(KERN_INFO "Installing knfsd (copyright (C) 1996 okir@monad.swb.de).\n");
+
+- retval = register_cld_notifier();
+- if (retval)
+- return retval;
+ retval = register_pernet_subsys(&nfsd_net_ops);
+ if (retval < 0)
+- goto out_unregister_notifier;
+- retval = nfsd4_init_slabs();
++ return retval;
++ retval = register_cld_notifier();
+ if (retval)
+ goto out_unregister_pernet;
++ retval = nfsd4_init_slabs();
++ if (retval)
++ goto out_unregister_notifier;
+ nfs4_state_init();
+ retval = nfsd_fault_inject_init(); /* nfsd fault injection controls */
+ if (retval)
+@@ -1209,10 +1209,10 @@ out_free_stat:
+ nfsd_fault_inject_cleanup();
+ out_free_slabs:
+ nfsd4_free_slabs();
+-out_unregister_pernet:
+- unregister_pernet_subsys(&nfsd_net_ops);
+ out_unregister_notifier:
+ unregister_cld_notifier();
++out_unregister_pernet:
++ unregister_pernet_subsys(&nfsd_net_ops);
+ return retval;
+ }
+
+@@ -1228,8 +1228,8 @@ static void __exit exit_nfsd(void)
+ nfsd4_free_slabs();
+ nfsd_fault_inject_cleanup();
+ unregister_filesystem(&nfsd_fs_type);
+- unregister_pernet_subsys(&nfsd_net_ops);
+ unregister_cld_notifier();
++ unregister_pernet_subsys(&nfsd_net_ops);
+ }
+
+ MODULE_AUTHOR("Olaf Kirch <okir@monad.swb.de>");
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae19a766..090d8ce25bd1 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ nchildren = nilfs_btree_node_get_nchildren(node);
+
+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+- level > NILFS_BTREE_LEVEL_MAX ||
++ level >= NILFS_BTREE_LEVEL_MAX ||
+ nchildren < 0 ||
+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index dbc372e2f71d..7ba6ac187edd 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -729,6 +729,19 @@ lookup:
+ if (tmpres) {
+ spin_unlock(&dlm->spinlock);
+ spin_lock(&tmpres->spinlock);
++
++ /*
++ * Right after dlm spinlock was released, dlm_thread could have
++ * purged the lockres. Check if lockres got unhashed. If so
++ * start over.
++ */
++ if (hlist_unhashed(&tmpres->hash_node)) {
++ spin_unlock(&tmpres->spinlock);
++ dlm_lockres_put(tmpres);
++ tmpres = NULL;
++ goto lookup;
++ }
++
+ /* Wait on the thread that is mastering the resource */
+ if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ __dlm_wait_on_lockres(tmpres);
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index dbc842222589..798dedcd44ef 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -361,7 +361,7 @@ nomem:
+ }
+
+ enum {
+- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+
+ static const match_table_t tokens = {
+@@ -370,6 +370,7 @@ static const match_table_t tokens = {
+ {Opt_umask, "umask=%o"},
+ {Opt_dmask, "dmask=%o"},
+ {Opt_fmask, "fmask=%o"},
++ {Opt_err, NULL},
+ };
+
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 1667e6fe0416..abfb93525ca6 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -104,25 +104,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
+ }
+
+ static int
+-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+- int atomic)
++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
++ size_t *remaining, int atomic)
+ {
+ unsigned long copy;
+
+- while (len > 0) {
++ while (*remaining > 0) {
+ while (!iov->iov_len)
+ iov++;
+- copy = min_t(unsigned long, len, iov->iov_len);
++ copy = min_t(unsigned long, *remaining, iov->iov_len);
+
+ if (atomic) {
+- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
++ if (__copy_from_user_inatomic(addr + *offset,
++ iov->iov_base, copy))
+ return -EFAULT;
+ } else {
+- if (copy_from_user(to, iov->iov_base, copy))
++ if (copy_from_user(addr + *offset,
++ iov->iov_base, copy))
+ return -EFAULT;
+ }
+- to += copy;
+- len -= copy;
++ *offset += copy;
++ *remaining -= copy;
+ iov->iov_base += copy;
+ iov->iov_len -= copy;
+ }
+@@ -130,25 +132,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+ }
+
+ static int
+-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
+- int atomic)
++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
++ size_t *remaining, int atomic)
+ {
+ unsigned long copy;
+
+- while (len > 0) {
++ while (*remaining > 0) {
+ while (!iov->iov_len)
+ iov++;
+- copy = min_t(unsigned long, len, iov->iov_len);
++ copy = min_t(unsigned long, *remaining, iov->iov_len);
+
+ if (atomic) {
+- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
++ if (__copy_to_user_inatomic(iov->iov_base,
++ addr + *offset, copy))
+ return -EFAULT;
+ } else {
+- if (copy_to_user(iov->iov_base, from, copy))
++ if (copy_to_user(iov->iov_base,
++ addr + *offset, copy))
+ return -EFAULT;
+ }
+- from += copy;
+- len -= copy;
++ *offset += copy;
++ *remaining -= copy;
+ iov->iov_base += copy;
+ iov->iov_len -= copy;
+ }
+@@ -384,7 +388,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ struct pipe_buffer *buf = pipe->bufs + curbuf;
+ const struct pipe_buf_operations *ops = buf->ops;
+ void *addr;
+- size_t chars = buf->len;
++ size_t chars = buf->len, remaining;
+ int error, atomic;
+
+ if (chars > total_len)
+@@ -398,9 +402,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ }
+
+ atomic = !iov_fault_in_pages_write(iov, chars);
++ remaining = chars;
+ redo:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
++ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
++ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ if (unlikely(error)) {
+ /*
+@@ -415,7 +421,6 @@ redo:
+ break;
+ }
+ ret += chars;
+- buf->offset += chars;
+ buf->len -= chars;
+
+ /* Was it a packet buffer? Clean up and exit */
+@@ -522,6 +527,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ if (ops->can_merge && offset + chars <= PAGE_SIZE) {
+ int error, atomic = 1;
+ void *addr;
++ size_t remaining = chars;
+
+ error = ops->confirm(pipe, buf);
+ if (error)
+@@ -530,8 +536,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ iov_fault_in_pages_read(iov, chars);
+ redo1:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_from_user(offset + addr, iov,
+- chars, atomic);
++ error = pipe_iov_copy_from_user(addr, &offset, iov,
++ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ ret = error;
+ do_wakeup = 1;
+@@ -566,6 +572,8 @@ redo1:
+ struct page *page = pipe->tmp_page;
+ char *src;
+ int error, atomic = 1;
++ int offset = 0;
++ size_t remaining;
+
+ if (!page) {
+ page = alloc_page(GFP_HIGHUSER);
+@@ -586,14 +594,15 @@ redo1:
+ chars = total_len;
+
+ iov_fault_in_pages_read(iov, chars);
++ remaining = chars;
+ redo2:
+ if (atomic)
+ src = kmap_atomic(page);
+ else
+ src = kmap(page);
+
+- error = pipe_iov_copy_from_user(src, iov, chars,
+- atomic);
++ error = pipe_iov_copy_from_user(src, &offset, iov,
++ &remaining, atomic);
+ if (atomic)
+ kunmap_atomic(src);
+ else
+diff --git a/fs/udf/inode.c b/fs/udf/inode.c
+index 8053ee75d297..330ec8cfeb63 100644
+--- a/fs/udf/inode.c
++++ b/fs/udf/inode.c
+@@ -1392,6 +1392,19 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
+ iinfo->i_lenEAttr;
+ }
+
++ /*
++ * Sanity check length of allocation descriptors and extended attrs to
++ * avoid integer overflows
++ */
++ if (iinfo->i_lenEAttr > inode->i_sb->s_blocksize || iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
++ make_bad_inode(inode);
++ return;
++ }
++ /* Now do exact checks */
++ if (udf_file_entry_alloc_offset(inode) + iinfo->i_lenAlloc > inode->i_sb->s_blocksize) {
++ make_bad_inode(inode);
++ return;
++ }
+ /* Sanity checks for files in ICB so that we don't get confused later */
+ if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) {
+ /*
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index e8bcc4742e0e..6d52429f80bc 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -198,9 +198,29 @@ typedef int INT32;
+ typedef s32 acpi_native_int;
+
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+
++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX ACPI_UINT32_MAX
+
+diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
+index 5af3ed52ef98..b9f921012043 100644
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -75,6 +75,7 @@
+ #define ACPI_CONSTANT_EVAL_ONLY
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+
+ #ifdef ACPI_EXEC_APP
+diff --git a/include/linux/jhash.h b/include/linux/jhash.h
+index 47cb09edec1a..348c6f47e4cc 100644
+--- a/include/linux/jhash.h
++++ b/include/linux/jhash.h
+@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
+ }
+
+
+-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
+-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
+ {
+- a += JHASH_INITVAL;
+- b += JHASH_INITVAL;
++ a += initval;
++ b += initval;
+ c += initval;
+
+ __jhash_final(a, b, c);
+@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
+ return c;
+ }
+
++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++{
++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
++}
++
+ static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
+ {
+- return jhash_3words(a, b, 0, initval);
++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
+ }
+
+ static inline u32 jhash_1word(u32 a, u32 initval)
+ {
+- return jhash_3words(a, 0, 0, initval);
++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
+ }
+
+ #endif /* _LINUX_JHASH_H */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 764cd54dfea7..35e7f71cd8a5 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -182,6 +182,7 @@ enum {
+ ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */
+ ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */
+ ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */
++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */
+
+ /* struct ata_port flags */
+ ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */
+@@ -285,6 +286,12 @@ enum {
+ */
+ ATA_TMOUT_PMP_SRST_WAIT = 5000,
+
++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
++ * be a spurious PHY event, so ignore the first PHY event that
++ * occurs within 10s after the policy change.
++ */
++ ATA_TMOUT_SPURIOUS_PHY = 10000,
++
+ /* ATA bus states */
+ BUS_UNKNOWN = 0,
+ BUS_DMA = 1,
+@@ -727,6 +734,8 @@ struct ata_link {
+ struct ata_eh_context eh_context;
+
+ struct ata_device device[ATA_MAX_DEVICES];
++
++ unsigned long last_lpm_change; /* when last LPM change happened */
+ };
+ #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag)
+ #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0])
+@@ -1065,6 +1074,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
+ extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
+ extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
+ extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
++extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
+
+ extern int ata_cable_40wire(struct ata_port *ap);
+ extern int ata_cable_80wire(struct ata_port *ap);
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index 89bd4a4dcfb4..25c6891e6302 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -458,7 +458,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA 0
+ #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX 14
++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */
+
+ /**
+ * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/include/scsi/scsi_devinfo.h b/include/scsi/scsi_devinfo.h
+index b4ddd3b18b4c..fc8cdff83a50 100644
+--- a/include/scsi/scsi_devinfo.h
++++ b/include/scsi/scsi_devinfo.h
+@@ -30,4 +30,5 @@
+ #define BLIST_RETRY_HWERROR 0x400000 /* retry HARDWARE_ERROR */
+ #define BLIST_MAX_512 0x800000 /* maximum 512 sector cdb length */
+ #define BLIST_ATTACH_PQ3 0x1000000 /* Scan: Attach to PQ3 devices */
++#define BLIST_MAX_1024 0x40000000 /* maximum 1024 sector cdb length */
+ #endif
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index 4f865df42f0f..7ee55e3ff4fe 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -43,7 +43,8 @@
+
+ #define EMUPAGESIZE 4096
+ #define MAXREQVOICES 8
+-#define MAXPAGES 8192
++#define MAXPAGES0 4096 /* 32 bit mode */
++#define MAXPAGES1 8192 /* 31 bit mode */
+ #define RESERVED 0
+ #define NUM_MIDI 16
+ #define NUM_G 64 /* use all channels */
+@@ -52,8 +53,7 @@
+
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */
+-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */
+- /* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */
+
+ #define TMEMSIZE 256*1024
+ #define TMEMSIZEREG 4
+@@ -470,8 +470,11 @@
+
+ #define MAPB 0x0d /* Cache map B */
+
+-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
+-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */
++
++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
+
+ /* 0x0e, 0x0f: Not used */
+
+@@ -1708,6 +1711,7 @@ struct snd_emu10k1 {
+ unsigned short model; /* subsystem id */
+ unsigned int card_type; /* EMU10K1_CARD_* */
+ unsigned int ecard_ctrl; /* ecard control bits */
++ unsigned int address_mode; /* address mode */
+ unsigned long dma_mask; /* PCI DMA mask */
+ unsigned int delay_pcm_irq; /* in samples */
+ int max_cache_pages; /* max memory size / PAGE_SIZE */
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 04399b28e821..f9cb6306511f 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+ void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index a1432369be50..d9e71e311027 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -632,6 +632,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
+ static int ptrace_resume(struct task_struct *child, long request,
+ unsigned long data)
+ {
++ bool need_siglock;
++
+ if (!valid_signal(data))
+ return -EIO;
+
+@@ -659,8 +661,26 @@ static int ptrace_resume(struct task_struct *child, long request,
+ user_disable_single_step(child);
+ }
+
++ /*
++ * Change ->exit_code and ->state under siglock to avoid the race
++ * with wait_task_stopped() in between; a non-zero ->exit_code will
++ * wrongly look like another report from tracee.
++ *
++ * Note that we need siglock even if ->exit_code == data and/or this
++ * status was not reported yet, the new status must not be cleared by
++ * wait_task_stopped() after resume.
++ *
++ * If data == 0 we do not care if wait_task_stopped() reports the old
++ * status and clears the code too; this can't race with the tracee, it
++ * takes siglock after resume.
++ */
++ need_siglock = data && !thread_group_empty(current);
++ if (need_siglock)
++ spin_lock_irq(&child->sighand->siglock);
+ child->exit_code = data;
+ wake_up_state(child, __TASK_TRACED);
++ if (need_siglock)
++ spin_unlock_irq(&child->sighand->siglock);
+
+ return 0;
+ }
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 2f8363e0a1ec..15be43522c8b 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4396,8 +4396,13 @@ recheck:
+
+ if (running)
+ p->sched_class->set_curr_task(rq);
+- if (on_rq)
+- enqueue_task(rq, p, 0);
++ if (on_rq) {
++ /*
++ * We enqueue to tail when the priority of a task is
++ * increased (user space view).
++ */
++ enqueue_task(rq, p, oldprio <= p->prio ? ENQUEUE_HEAD : 0);
++ }
+
+ check_class_changed(rq, p, prev_class, oldprio);
+ task_rq_unlock(rq, p, &flags);
+diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
+index a5457d577b98..6ad2e2d320fe 100644
+--- a/kernel/trace/ring_buffer_benchmark.c
++++ b/kernel/trace/ring_buffer_benchmark.c
+@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)
+
+ if (producer_fifo >= 0) {
+ struct sched_param param = {
+- .sched_priority = consumer_fifo
++ .sched_priority = producer_fifo
+ };
+ sched_setscheduler(producer, SCHED_FIFO, ¶m);
+ } else
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 289197a2d334..3b04aec58700 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1357,19 +1357,25 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ int n_normal_preds = 0, n_logical_preds = 0;
+ struct postfix_elt *elt;
++ int cnt = 0;
+
+ list_for_each_entry(elt, &ps->postfix, list) {
+- if (elt->op == OP_NONE)
++ if (elt->op == OP_NONE) {
++ cnt++;
+ continue;
++ }
+
+ if (elt->op == OP_AND || elt->op == OP_OR) {
+ n_logical_preds++;
++ cnt--;
+ continue;
+ }
++ cnt--;
+ n_normal_preds++;
++ WARN_ON_ONCE(cnt < 0);
+ }
+
+- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ return -EINVAL;
+ }
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 97eec2174769..c957a370bff8 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1095,10 +1095,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags)
+ * The check (unnecessarily) ignores LRU pages being isolated and
+ * walked by the page reclaim code, however that's not a big loss.
+ */
+- if (!PageHuge(p) && !PageTransTail(p)) {
+- if (!PageLRU(p))
+- shake_page(p, 0);
+- if (!PageLRU(p)) {
++ if (!PageHuge(p)) {
++ if (!PageLRU(hpage))
++ shake_page(hpage, 0);
++ if (!PageLRU(hpage)) {
+ /*
+ * shake_page could have turned it free.
+ */
+diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
+index 5ba0c844d508..3cb93e85d221 100644
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -440,7 +440,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
+ fdb->updated = jiffies;
+ }
+ } else {
+- spin_lock(&br->hash_lock);
++ spin_lock_bh(&br->hash_lock);
+ if (likely(!fdb_find(head, addr))) {
+ fdb = fdb_create(head, source, addr);
+ if (fdb)
+@@ -449,7 +449,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
+ /* else we lose race and someone else inserts
+ * it first, don't bother updating
+ */
+- spin_unlock(&br->hash_lock);
++ spin_unlock_bh(&br->hash_lock);
+ }
+ }
+
+@@ -665,9 +665,11 @@ int br_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
+ }
+
+ if (ndm->ndm_flags & NTF_USE) {
++ local_bh_disable();
+ rcu_read_lock();
+ br_fdb_update(p->br, p, addr);
+ rcu_read_unlock();
++ local_bh_enable();
+ } else {
+ spin_lock_bh(&p->br->hash_lock);
+ err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags);
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 0b870d75a542..a41051a1bca5 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ }
+
+ err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+- if (!err)
++ if (err)
+ break;
+ }
+
+@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br,
+ struct net_bridge_port *p;
+ struct hlist_node *n, *slot = NULL;
+
++ if (!hlist_unhashed(&port->rlist))
++ return;
++
+ hlist_for_each_entry(p, n, &br->router_list, rlist) {
+ if ((unsigned long) port >= (unsigned long) p)
+ break;
+@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
+ if (port->multicast_router != 1)
+ return;
+
+- if (!hlist_unhashed(&port->rlist))
+- goto timer;
+-
+ br_multicast_add_router(br, port);
+
+-timer:
+ mod_timer(&port->multicast_router_timer,
+ now + br->multicast_querier_interval);
+ }
+diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
+index e54ef82fdad7..5ba424839939 100644
+--- a/net/bridge/br_netfilter.c
++++ b/net/bridge/br_netfilter.c
+@@ -818,12 +818,12 @@ static unsigned int br_nf_forward_arp(unsigned int hook, struct sk_buff *skb,
+ return NF_STOLEN;
+ }
+
+-#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4)
++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
+ static int br_nf_dev_queue_xmit(struct sk_buff *skb)
+ {
+ int ret;
+
+- if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
++ if (skb->protocol == htons(ETH_P_IP) &&
+ skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
+ !skb_is_gso(skb)) {
+ if (br_parse_ip_options(skb))
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index cb9085272dd7..9f471c32d209 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -138,6 +138,7 @@ static void ping_v4_unhash(struct sock *sk)
+ if (sk_hashed(sk)) {
+ write_lock_bh(&ping_table.lock);
+ hlist_nulls_del(&sk->sk_nulls_node);
++ sk_nulls_node_init(&sk->sk_nulls_node);
+ sock_put(sk);
+ isk->inet_num = 0;
+ isk->inet_sport = 0;
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 7949b5d1663f..5f8c20b67da2 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1251,10 +1251,8 @@ csum_copy_err:
+ UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 4cfba3d5ad2c..23b33048ea98 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1661,6 +1661,17 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
+ goto out;
+ }
+
++#ifdef CONFIG_IPV6_MULTIPLE_TABLES
++ if (rt == net->ipv6.ip6_blk_hole_entry ||
++ rt == net->ipv6.ip6_prohibit_entry) {
++ if (net_ratelimit())
++ printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \
++ " nexthop for redirect target " \
++ "(blackhole or prohibited)\n");
++ goto out;
++ }
++#endif
++
+ /*
+ * We have finally decided to accept it.
+ */
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index ef9052f8c90b..2f99b12b717e 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -451,10 +451,8 @@ csum_copy_err:
+ }
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
+index 7aa31bbfaa3b..9464f92b1447 100644
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+
+ hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+
+- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+- skb_headroom(skb) < WEP_IV_LEN))
++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
+ return NULL;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ size_t len;
+ u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+
++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
++ return -1;
++
+ iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+ if (!iv)
+ return -1;
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index cbc5bfd8c8e4..f2ed4a996290 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3689,6 +3689,9 @@ void __net_exit ip_vs_control_net_cleanup_sysctl(struct net *net)
+ cancel_delayed_work_sync(&ipvs->defense_work);
+ cancel_work_sync(&ipvs->defense_work.work);
+ unregister_net_sysctl_table(ipvs->sysctl_hdr);
++
++ if (!net_eq(net, &init_net))
++ kfree(ipvs->sysctl_tbl);
+ }
+
+ #else
+diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
+index bde7d69b440d..e89563655030 100644
+--- a/net/rose/af_rose.c
++++ b/net/rose/af_rose.c
+@@ -194,7 +194,8 @@ static void rose_kill_by_device(struct net_device *dev)
+
+ if (rose->device == dev) {
+ rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
+- rose->neighbour->use--;
++ if (rose->neighbour)
++ rose->neighbour->use--;
+ rose->device = NULL;
+ }
+ }
+diff --git a/net/socket.c b/net/socket.c
+index 025f7f4d2d80..f5ce151e0e3b 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1934,14 +1934,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+ int err, ctl_len, iov_size, total_len;
+
+ err = -EFAULT;
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ /* do not move before msg_sys is valid */
+ err = -EMSGSIZE;
+@@ -2149,14 +2147,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+ struct sockaddr __user *uaddr;
+ int __user *uaddr_len;
+
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ err = -EMSGSIZE;
+ if (msg_sys->msg_iovlen > UIO_MAXIOV)
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 0920ea3bf599..5776921d6209 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
+ { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ },
+ };
+
+ static struct nlmsg_perm nlmsg_audit_perms[] =
+diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
+index 790c65d980c8..aefde0175846 100644
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
+ }
+ #endif
+
+- strcpy(card->driver, emu->card_capabilities->driver);
+- strcpy(card->shortname, emu->card_capabilities->name);
++ strlcpy(card->driver, emu->card_capabilities->driver,
++ sizeof(card->driver));
++ strlcpy(card->shortname, emu->card_capabilities->name,
++ sizeof(card->shortname));
+ snprintf(card->longname, sizeof(card->longname),
+ "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index f35284be7b02..829595078fa1 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+
+ /* invalidate maps */
+- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+
+ /* invalidate maps */
+- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index a78fdf466fa7..124ae93d3748 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */
+ snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */
+
+- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ for (ch = 0; ch < NUM_G; ch++) {
+ snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ }
+
++ if (emu->address_mode == 0) {
++ /* use 16M in 4G */
++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++ }
++
+ return 0;
+ }
+
+@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ *
+ */
+ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0108_chip = 1,
+@@ -1540,7 +1545,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ .adc_1361t = 1, /* 24 bit capture instead of 16bit */
+ .ac97_chip = 1} ,
+ {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0102_chip = 1,
+@@ -1844,8 +1849,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
++ /* set addressing mode */
++ emu->address_mode = is_audigy ? 0 : 1;
+ /* set the DMA transfer mask */
+- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);
+@@ -1868,7 +1875,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+- 32 * 1024, &emu->ptb_pages) < 0) {
++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ err = -ENOMEM;
+ goto error;
+ }
+@@ -1967,8 +1974,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ /* Clear silent pages and set up pointers */
+ memset(emu->silent_page.area, 0, PAGE_SIZE);
+- silent_page = emu->silent_page.addr << 1;
+- for (idx = 0; idx < MAXPAGES; idx++)
++ silent_page = emu->silent_page.addr << emu->address_mode;
++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+
+ /* set up voice indices */
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index e22b8e2bbd88..c673d2b31510 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
+ snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ /* invalidate maps */
+- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ /* modulation envelope */
+diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
+index bc38dd4d071f..9c499e6bae06 100644
+--- a/sound/pci/emu10k1/emuproc.c
++++ b/sound/pci/emu10k1/emuproc.c
+@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+ u32 value2;
+- unsigned long flags;
+ u32 rate;
+
+ if (emu->card_capabilities->emu_model) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x38, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x1) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x2a, &value);
+ snd_emu1010_fpga_read(emu, 0x2b, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
+ } else {
+ snd_iprintf(buffer, "ADAT Unlocked\n");
+ }
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x20, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x4) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x28, &value);
+ snd_emu1010_fpga_read(emu, 0x29, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
+ } else {
+@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
+ {
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+- unsigned long flags;
+ int i;
+ snd_iprintf(buffer, "EMU1010 Registers:\n\n");
+
+ for(i = 0; i < 0x40; i+=1) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, i, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
+ }
+ }
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index 4f502a2bdc3c..87b7c65fa033 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+ * aligned pages in others
+ */
+ #define __set_ptb_entry(emu,page,addr) \
+- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+
+ #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
+ }
+ page = blk->mapped_page + blk->pages;
+ }
+- size = MAX_ALIGN_PAGES - page;
++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ if (size >= max_size) {
+ *nextp = pos;
+ return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
+ q = get_emu10k1_memblk(p, mapped_link);
+ end_page = q->mapped_page;
+ } else
+- end_page = MAX_ALIGN_PAGES;
++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+
+ /* remove links */
+ list_del(&blk->mapped_link);
+@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ if (snd_BUG_ON(!emu))
+ return NULL;
+ if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ return NULL;
+ hdr = emu->memhdr;
+ if (snd_BUG_ON(!hdr))
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index c74a044284b0..f70115e143ec 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2093,6 +2093,16 @@ _snd_hda_find_mixer_ctl(struct hda_codec *codec,
+ return snd_ctl_find_id(codec->bus->card, &id);
+ }
+
++/* meta hook to call each driver's vmaster hook */
++static void vmaster_hook(void *private_data, int enabled)
++{
++ struct hda_vmaster_mute_hook *hook = private_data;
++
++ if (hook->mute_mode != HDA_VMUTE_FOLLOW_MASTER)
++ enabled = hook->mute_mode;
++ hook->hook(hook->codec, enabled);
++}
++
+ /**
+ * snd_hda_find_mixer_ctl - Find a mixer control element with the given name
+ * @codec: HD-audio codec
+@@ -2520,9 +2530,9 @@ int snd_hda_add_vmaster_hook(struct hda_codec *codec,
+
+ if (!hook->hook || !hook->sw_kctl)
+ return 0;
+- snd_ctl_add_vmaster_hook(hook->sw_kctl, hook->hook, codec);
+ hook->codec = codec;
+ hook->mute_mode = HDA_VMUTE_FOLLOW_MASTER;
++ snd_ctl_add_vmaster_hook(hook->sw_kctl, vmaster_hook, hook);
+ if (!expose_enum_ctl)
+ return 0;
+ kctl = snd_ctl_new1(&vmaster_mute_mode, hook);
+@@ -2540,14 +2550,7 @@ void snd_hda_sync_vmaster_hook(struct hda_vmaster_mute_hook *hook)
+ {
+ if (!hook->hook || !hook->codec)
+ return;
+- switch (hook->mute_mode) {
+- case HDA_VMUTE_FOLLOW_MASTER:
+- snd_ctl_sync_vmaster_hook(hook->sw_kctl);
+- break;
+- default:
+- hook->hook(hook->codec, hook->mute_mode);
+- break;
+- }
++ snd_ctl_sync_vmaster_hook(hook->sw_kctl);
+ }
+ EXPORT_SYMBOL_HDA(snd_hda_sync_vmaster_hook);
+
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 20cfc5b44710..ba80c2f7e047 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4606,6 +4606,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ .patch = patch_conexant_auto },
+ { .id = 0x14f150b9, .name = "CX20665",
+ .patch = patch_conexant_auto },
++ { .id = 0x14f150f1, .name = "CX20721",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f2, .name = "CX20722",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f3, .name = "CX20723",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f4, .name = "CX20724",
++ .patch = patch_conexant_auto },
+ { .id = 0x14f1510f, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15110, .name = "CX20751/2",
+@@ -4640,6 +4648,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index b16a37f633c5..bf1f0abf415b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5412,6 +5412,7 @@ static const struct alc_fixup alc882_fixups[] = {
+ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1025, 0x006c, "Acer Aspire 9810", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x0090, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
++ SND_PCI_QUIRK(0x1025, 0x0107, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x010a, "Acer Ferrari 5000", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x0110, "Acer Aspire", ALC883_FIXUP_ACER_EAPD),
+ SND_PCI_QUIRK(0x1025, 0x0112, "Acer Aspire 9303", ALC883_FIXUP_ACER_EAPD),
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index f9e2bdaf91f1..54059324d942 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
+ if (gpio_nreset >= 0) {
+ /* Reset codec */
+ gpio_direction_output(gpio_nreset, 0);
+- udelay(1);
++ mdelay(1);
+ gpio_set_value(gpio_nreset, 1);
+ /* Give the codec time to wake up */
+- udelay(1);
++ mdelay(1);
+ }
+
+ cs4271->gpio_nreset = gpio_nreset;
+diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
+index 3941f50bf187..90deecddb6ac 100644
+--- a/sound/soc/codecs/wm8741.c
++++ b/sound/soc/codecs/wm8741.c
+@@ -105,7 +105,7 @@ static struct {
+ };
+
+ static unsigned int rates_11289[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_11289 = {
+@@ -132,7 +132,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = {
+ };
+
+ static unsigned int rates_16934[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_16934 = {
+@@ -150,7 +150,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = {
+ };
+
+ static unsigned int rates_22579[] = {
+- 44100, 88235, 1764000
++ 44100, 88200, 176400
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_22579 = {
+@@ -168,7 +168,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = {
+ };
+
+ static unsigned int rates_36864[] = {
+- 48000, 96000, 19200
++ 48000, 96000, 192000
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_36864 = {
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index a3e4831bbe39..ed986e6d10c4 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -333,7 +333,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
+ { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */
+ { "Right Input Mixer", NULL, "RINPUT2" },
+- { "Right Input Mixer", NULL, "LINPUT3" },
++ { "Right Input Mixer", NULL, "RINPUT3" },
+
+ { "Left ADC", NULL, "Left Input Mixer" },
+ { "Right ADC", NULL, "Right Input Mixer" },
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index d9924d76f713..c93c573f967a 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2636,7 +2636,7 @@ static struct {
+ };
+
+ static int fs_ratios[] = {
+- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+
+ static int bclk_divs[] = {
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index 319754cf6208..daf61abc3670 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (snd_BUG_ON(!arg || !emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+-
+- if (!snd_emux_inc_count(emu)) {
+- mutex_unlock(&emu->register_mutex);
++ if (!snd_emux_inc_count(emu))
+ return -EFAULT;
+- }
+
+ memset(&callback, 0, sizeof(callback));
+ callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (p == NULL) {
+ snd_printk(KERN_ERR "can't create port\n");
+ snd_emux_dec_count(emu);
+- mutex_unlock(&emu->register_mutex);
+ return -ENOMEM;
+ }
+
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ reset_port_mode(p, arg->seq_mode);
+
+ snd_emux_reset_port(p);
+-
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
+ if (snd_BUG_ON(!emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+ snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ snd_emux_dec_count(emu);
+
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index 7778b8e19782..a0209204ae48 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
+ if (emu->voices)
+ snd_emux_terminate_all(emu);
+
+- mutex_lock(&emu->register_mutex);
+ if (emu->client >= 0) {
+ snd_seq_delete_kernel_client(emu->client);
+ emu->client = -1;
+ }
+- mutex_unlock(&emu->register_mutex);
+ }
+
+
+@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
+ /*
+ * increment usage count
+ */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ emu->used++;
+ if (!try_module_get(emu->ops.owner))
+@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ return 1;
+ }
+
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++ int ret;
++
++ mutex_lock(&emu->register_mutex);
++ ret = __snd_emux_inc_count(emu);
++ mutex_unlock(&emu->register_mutex);
++ return ret;
++}
+
+ /*
+ * decrease usage count
+ */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ module_put(emu->card->module);
+ emu->used--;
+@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ module_put(emu->ops.owner);
+ }
+
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++ mutex_lock(&emu->register_mutex);
++ __snd_emux_dec_count(emu);
++ mutex_unlock(&emu->register_mutex);
++}
+
+ /*
+ * Routine that is called upon a first use of a particular port
+@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_init_port(p);
+- snd_emux_inc_count(emu);
++ __snd_emux_inc_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+- snd_emux_dec_count(emu);
++ __snd_emux_dec_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 1e0798f6539b..851786ffa639 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .ignore_ctl_error = 1,
+ },
+ {
++ /* MAYA44 USB+ */
++ .id = USB_ID(0x2573, 0x0008),
++ .map = maya44_map,
++ },
++ {
+ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+ .map = scms_usb3318_map,
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2015-09-15 12:56 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2015-09-15 12:56 UTC (permalink / raw
To: gentoo-commits
commit: 48a33b6ee781dae8d2ed6b8d7d3a968993dca333
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Sep 15 12:44:06 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Sep 15 12:44:06 2015 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=48a33b6e
Linux patch 3.4.108
0000_README | 4 +
1107_linux-3.4.108.patch | 5643 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5647 insertions(+)
diff --git a/0000_README b/0000_README
index bb74c9a..98c0230 100644
--- a/0000_README
+++ b/0000_README
@@ -467,6 +467,10 @@ Patch: 1106_linux-3.4.107.patch
From: http://www.kernel.org
Desc: Linux 3.4.107
+Patch: 1107_linux-3.4.108.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.108
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1107_linux-3.4.108.patch b/1107_linux-3.4.108.patch
new file mode 100644
index 0000000..c549fe2
--- /dev/null
+++ b/1107_linux-3.4.108.patch
@@ -0,0 +1,5643 @@
+diff --git a/Makefile b/Makefile
+index f53f41a8dd09..5056e1bba7e8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 107
++SUBLEVEL = 108
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/alpha/kernel/pci-sysfs.c b/arch/alpha/kernel/pci-sysfs.c
+index 53649c7d0068..1a333558f656 100644
+--- a/arch/alpha/kernel/pci-sysfs.c
++++ b/arch/alpha/kernel/pci-sysfs.c
+@@ -84,7 +84,7 @@ static int pci_mmap_resource(struct kobject *kobj,
+ if (iomem_is_exclusive(res->start))
+ return -EINVAL;
+
+- pcibios_resource_to_bus(pdev, &bar, res);
++ pcibios_resource_to_bus(pdev->bus, &bar, res);
+ vma->vm_pgoff += bar.start >> (PAGE_SHIFT - (sparse ? 5 : 0));
+ mmap_type = res->flags & IORESOURCE_MEM ? pci_mmap_mem : pci_mmap_io;
+
+@@ -140,7 +140,7 @@ static int sparse_mem_mmap_fits(struct pci_dev *pdev, int num)
+ long dense_offset;
+ unsigned long sparse_size;
+
+- pcibios_resource_to_bus(pdev, &bar, &pdev->resource[num]);
++ pcibios_resource_to_bus(pdev->bus, &bar, &pdev->resource[num]);
+
+ /* All core logic chips have 4G sparse address space, except
+ CIA which has 16G (see xxx_SPARSE_MEM and xxx_DENSE_MEM
+diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
+index 89f56f3a802e..8c3f8e89d2ae 100644
+--- a/arch/arm/mach-at91/pm.h
++++ b/arch/arm/mach-at91/pm.h
+@@ -38,7 +38,7 @@ static inline void at91rm9200_standby(void)
+ " mcr p15, 0, %0, c7, c0, 4\n\t"
+ " str %5, [%1, %2]"
+ :
+- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
++ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
+ "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
+ "r" (lpr));
+ }
+diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c
+index c1fe32db4755..f801fe8b3e5e 100644
+--- a/arch/arm/mach-pxa/corgi.c
++++ b/arch/arm/mach-pxa/corgi.c
+@@ -26,6 +26,7 @@
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
+ #include <linux/io.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/corgi_lcd.h>
+@@ -711,6 +712,8 @@ static void __init corgi_init(void)
+ sharpsl_nand_partitions[1].size = 53 * 1024 * 1024;
+
+ platform_add_devices(devices, ARRAY_SIZE(devices));
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init fixup_corgi(struct tag *tags, char **cmdline,
+diff --git a/arch/arm/mach-pxa/hx4700.c b/arch/arm/mach-pxa/hx4700.c
+index b83b95a29503..f35a30f19874 100644
+--- a/arch/arm/mach-pxa/hx4700.c
++++ b/arch/arm/mach-pxa/hx4700.c
+@@ -881,6 +881,8 @@ static void __init hx4700_init(void)
+ mdelay(10);
+ gpio_set_value(GPIO71_HX4700_ASIC3_nRESET, 1);
+ mdelay(10);
++
++ regulator_has_full_constraints();
+ }
+
+ MACHINE_START(H4700, "HP iPAQ HX4700")
+diff --git a/arch/arm/mach-pxa/poodle.c b/arch/arm/mach-pxa/poodle.c
+index 89d98c832189..39d10683d1f1 100644
+--- a/arch/arm/mach-pxa/poodle.c
++++ b/arch/arm/mach-pxa/poodle.c
+@@ -25,6 +25,7 @@
+ #include <linux/gpio.h>
+ #include <linux/i2c.h>
+ #include <linux/i2c/pxa-i2c.h>
++#include <linux/regulator/machine.h>
+ #include <linux/spi/spi.h>
+ #include <linux/spi/ads7846.h>
+ #include <linux/spi/pxa2xx_spi.h>
+@@ -452,6 +453,7 @@ static void __init poodle_init(void)
+ pxa_set_i2c_info(NULL);
+ i2c_register_board_info(0, ARRAY_AND_SIZE(poodle_i2c_devices));
+ poodle_init_spi();
++ regulator_has_full_constraints();
+ }
+
+ static void __init fixup_poodle(struct tag *tags, char **cmdline,
+diff --git a/arch/arm/mach-pxa/spitz.c b/arch/arm/mach-pxa/spitz.c
+index df2ab0fb2ace..a1647d0c769f 100644
+--- a/arch/arm/mach-pxa/spitz.c
++++ b/arch/arm/mach-pxa/spitz.c
+@@ -968,6 +968,8 @@ static void __init spitz_init(void)
+ spitz_nor_init();
+ spitz_nand_init();
+ spitz_i2c_init();
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init spitz_fixup(struct tag *tags, char **cmdline,
+diff --git a/arch/arm/mach-sa1100/pm.c b/arch/arm/mach-sa1100/pm.c
+index 2fa499ec6afe..69bbe4e55aa0 100644
+--- a/arch/arm/mach-sa1100/pm.c
++++ b/arch/arm/mach-sa1100/pm.c
+@@ -80,6 +80,7 @@ static int sa11x0_pm_enter(suspend_state_t state)
+ /*
+ * Ensure not to come back here if it wasn't intended
+ */
++ RCSR = RCSR_SMR;
+ PSPR = 0;
+
+ /*
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+index 1382fec9e8c5..7fcb1ac0f232 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+@@ -50,6 +50,7 @@ ethernet@b0000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b0000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+index 221cd2ea5b31..9f25427c1527 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+@@ -50,6 +50,7 @@ ethernet@b1000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b1000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+index 61456c317609..cd7c318ab131 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+@@ -49,6 +49,7 @@ ethernet@b2000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b2000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/kernel/pci_of_scan.c b/arch/powerpc/kernel/pci_of_scan.c
+index 89dde171a6fa..55551a823bd3 100644
+--- a/arch/powerpc/kernel/pci_of_scan.c
++++ b/arch/powerpc/kernel/pci_of_scan.c
+@@ -111,7 +111,7 @@ static void of_pci_parse_addrs(struct device_node *node, struct pci_dev *dev)
+ res->name = pci_name(dev);
+ region.start = base;
+ region.end = base + size - 1;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+ }
+
+@@ -276,7 +276,7 @@ void __devinit of_scan_pci_bridge(struct pci_dev *dev)
+ res->flags = flags;
+ region.start = of_read_number(&ranges[1], 2);
+ region.end = region.start + size - 1;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+ sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus),
+ bus->number);
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index 5da8e8df5922..79a17f798ef8 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -392,7 +392,7 @@ static void __devinit pnv_ioda_setup_pe_segments(struct pci_dev *dev)
+
+ /* Setup IO segments */
+ if (io_res.start < io_res.end) {
+- pcibios_resource_to_bus(dev, ®ion, &io_res);
++ pcibios_resource_to_bus(dev->bus, ®ion, &io_res);
+ pos = region.start;
+ i = pos / phb->ioda.io_segsize;
+ while(i < phb->ioda.total_pe && pos <= region.end) {
+@@ -422,7 +422,7 @@ static void __devinit pnv_ioda_setup_pe_segments(struct pci_dev *dev)
+
+ /* Setup M32 segments */
+ if (m32_res.start < m32_res.end) {
+- pcibios_resource_to_bus(dev, ®ion, &m32_res);
++ pcibios_resource_to_bus(dev->bus, ®ion, &m32_res);
+ pos = region.start;
+ i = pos / phb->ioda.m32_segsize;
+ while(i < phb->ioda.total_pe && pos <= region.end) {
+diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c
+index 1c16141c031c..1fea24944ff4 100644
+--- a/arch/powerpc/sysdev/axonram.c
++++ b/arch/powerpc/sysdev/axonram.c
+@@ -155,7 +155,7 @@ axon_ram_direct_access(struct block_device *device, sector_t sector,
+ }
+
+ *kaddr = (void *)(bank->ph_addr + offset);
+- *pfn = virt_to_phys(kaddr) >> PAGE_SHIFT;
++ *pfn = virt_to_phys(*kaddr) >> PAGE_SHIFT;
+
+ return 0;
+ }
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 0f250d12a18c..7e6ac1f829e7 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -347,7 +347,7 @@ int kvm_arch_vcpu_setup(struct kvm_vcpu *vcpu)
+ vcpu->arch.sie_block->ecb = 6;
+ vcpu->arch.sie_block->eca = 0xC1002001U;
+ vcpu->arch.sie_block->fac = (int) (long) facilities;
+- hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS);
++ hrtimer_init(&vcpu->arch.ckc_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+ tasklet_init(&vcpu->arch.tasklet, kvm_s390_tasklet,
+ (unsigned long) vcpu);
+ vcpu->arch.ckc_timer.function = kvm_s390_idle_wakeup;
+diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
+index 8c5c9a5675b4..ab5f471aa6e9 100644
+--- a/arch/sparc/kernel/pci.c
++++ b/arch/sparc/kernel/pci.c
+@@ -409,7 +409,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev,
+ res2.flags = res->flags;
+ region.start = base;
+ region.end = limit + 0xfff;
+- pcibios_bus_to_resource(dev, &res2, ®ion);
++ pcibios_bus_to_resource(dev->bus, &res2, ®ion);
+ if (!res->start)
+ res->start = res2.start;
+ if (!res->end)
+@@ -427,7 +427,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev,
+ IORESOURCE_MEM);
+ region.start = base;
+ region.end = limit + 0xfffff;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+
+ pci_read_config_word(dev, PCI_PREF_MEMORY_BASE, &mem_base_lo);
+@@ -458,7 +458,7 @@ static void __devinit pci_cfg_fake_ranges(struct pci_dev *dev,
+ IORESOURCE_MEM | IORESOURCE_PREFETCH);
+ region.start = base;
+ region.end = limit + 0xfffff;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+ }
+
+@@ -480,7 +480,7 @@ static void __devinit apb_fake_ranges(struct pci_dev *dev,
+ res->flags = IORESOURCE_IO;
+ region.start = (first << 21);
+ region.end = (last << 21) + ((1 << 21) - 1);
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+
+ pci_read_config_byte(dev, APB_MEM_ADDRESS_MAP, &map);
+ apb_calc_first_last(map, &first, &last);
+@@ -488,7 +488,7 @@ static void __devinit apb_fake_ranges(struct pci_dev *dev,
+ res->flags = IORESOURCE_MEM;
+ region.start = (first << 29);
+ region.end = (last << 29) + ((1 << 29) - 1);
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+
+ static void __devinit pci_of_scan_bus(struct pci_pbm_info *pbm,
+@@ -579,7 +579,7 @@ static void __devinit of_scan_pci_bridge(struct pci_pbm_info *pbm,
+ res->flags = flags;
+ region.start = GET_64BIT(ranges, 1);
+ region.end = region.start + size - 1;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+ after_ranges:
+ sprintf(bus->name, "PCI Bus %04x:%02x", pci_domain_nr(bus),
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 917c1098775b..eda8cb92702f 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -129,7 +129,7 @@ config SBUS
+ bool
+
+ config NEED_DMA_MAP_STATE
+- def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG)
++ def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB)
+
+ config NEED_SG_DMA_LENGTH
+ def_bool y
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index c799352e24fc..51afabd65cbf 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -1203,7 +1203,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
+ if (!src)
+ return -ENOMEM;
+- assoc = (src + req->cryptlen + auth_tag_len);
++ assoc = (src + req->cryptlen);
+ scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
+ scatterwalk_map_and_copy(assoc, req->assoc, 0,
+ req->assoclen, 0);
+@@ -1228,7 +1228,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ scatterwalk_done(&src_sg_walk, 0, 0);
+ scatterwalk_done(&assoc_sg_walk, 0, 0);
+ } else {
+- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
++ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
+ kfree(src);
+ }
+ return retval;
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index 45f9c70f1246..8b49131c7df6 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -414,11 +414,14 @@ ENTRY(ret_from_fork)
+ testl $3, CS-ARGOFFSET(%rsp) # from kernel_thread?
+ jz retint_restore_args
+
+- testl $_TIF_IA32, TI_flags(%rcx) # 32-bit compat task needs IRET
+- jnz int_ret_from_sys_call
+-
+- RESTORE_TOP_OF_STACK %rdi, -ARGOFFSET
+- jmp ret_from_sys_call # go to the SYSRET fastpath
++ /*
++ * By the time we get here, we have no idea whether our pt_regs,
++ * ti flags, and ti status came from the 64-bit SYSCALL fast path,
++ * the slow path, or one of the ia32entry paths.
++ * Use int_ret_from_sys_call to return, since it can safely handle
++ * all of the above.
++ */
++ jmp int_ret_from_sys_call
+
+ CFI_ENDPROC
+ END(ret_from_fork)
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index d398f317f5e0..310cb013458d 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -439,6 +439,17 @@ static struct dmi_system_id __initdata pci_reboot_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1"),
+ },
+ },
++
++ /* ASRock */
++ { /* Handle problems with rebooting on ASRock Q1900DC-ITX */
++ .callback = set_pci_reboot,
++ .ident = "ASRock Q1900DC-ITX",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "ASRock"),
++ DMI_MATCH(DMI_BOARD_NAME, "Q1900DC-ITX"),
++ },
++ },
++
+ { /* Handle problems with rebooting on the Latitude E6320. */
+ .callback = set_pci_reboot,
+ .ident = "Dell Latitude E6320",
+@@ -690,9 +701,12 @@ void native_machine_shutdown(void)
+ /* Make certain I only run on the appropriate processor */
+ set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
+
+- /* O.K Now that I'm on the appropriate processor,
+- * stop all of the others.
++ /*
++ * O.K Now that I'm on the appropriate processor, stop all of the
++ * others. Also disable the local irq to not receive the per-cpu
++ * timer interrupt which may trigger scheduler's load balance.
+ */
++ local_irq_disable();
+ stop_other_cpus();
+ #endif
+
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index 9bfe95fda57c..adc049fef8ca 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -435,7 +435,7 @@ dotraplinkage void __kprobes do_debug(struct pt_regs *regs, long error_code)
+ * then it's very likely the result of an icebp/int01 trap.
+ * User wants a sigtrap for that.
+ */
+- if (!dr6 && user_mode(regs))
++ if (!dr6 && user_mode_vm(regs))
+ user_icebp = 1;
+
+ /* Catch kmemcheck conditions first of all! */
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 91e8680ec239..db08e669228c 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -4246,7 +4246,8 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt)
+ if (rc != X86EMUL_CONTINUE)
+ goto done;
+ }
+- ctxt->dst.orig_val = ctxt->dst.val;
++ /* Copy full 64-bit value for CMPXCHG8B. */
++ ctxt->dst.orig_val64 = ctxt->dst.val64;
+
+ special_insn:
+
+diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
+index 31776d0efc8c..d7ec4e251c0a 100644
+--- a/arch/x86/vdso/vdso32/sigreturn.S
++++ b/arch/x86/vdso/vdso32/sigreturn.S
+@@ -17,6 +17,7 @@
+ .text
+ .globl __kernel_sigreturn
+ .type __kernel_sigreturn,@function
++ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
+ ALIGN
+ __kernel_sigreturn:
+ .LSTART_sigreturn:
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 8c5ad89a65a5..89cff3724db4 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -1872,6 +1872,17 @@ EXPORT_SYMBOL(acpi_video_unregister);
+
+ static int __init acpi_video_init(void)
+ {
++ /*
++ * Let the module load even if ACPI is disabled (e.g. due to
++ * a broken BIOS) so that i915.ko can still be loaded on such
++ * old systems without an AcpiOpRegion.
++ *
++ * acpi_video_register() will report -ENODEV later as well due
++ * to acpi_disabled when i915.ko tries to register itself afterwards.
++ */
++ if (acpi_disabled)
++ return 0;
++
+ dmi_check_system(video_dmi_table);
+
+ if (intel_opregion_present())
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index 35fc56981875..eac37055456c 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -773,10 +773,6 @@ static int __init nbd_init(void)
+ return -EINVAL;
+ }
+
+- nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
+- if (!nbd_dev)
+- return -ENOMEM;
+-
+ part_shift = 0;
+ if (max_part > 0) {
+ part_shift = fls(max_part);
+@@ -798,6 +794,10 @@ static int __init nbd_init(void)
+ if (nbds_max > 1UL << (MINORBITS - part_shift))
+ return -EINVAL;
+
++ nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
++ if (!nbd_dev)
++ return -ENOMEM;
++
+ for (i = 0; i < nbds_max; i++) {
+ struct gendisk *disk = alloc_disk(1 << part_shift);
+ if (!disk)
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 02fbbf7be9f9..8a084bffd068 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -101,6 +101,7 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x13d3, 0x3393) },
+ { USB_DEVICE(0x13d3, 0x3402) },
+ { USB_DEVICE(0x13d3, 0x3408) },
++ { USB_DEVICE(0x13d3, 0x3423) },
+ { USB_DEVICE(0x13d3, 0x3432) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+@@ -149,6 +150,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index ddb2b873a112..7c0b21ebd33b 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -179,6 +179,7 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index a81f4694f322..96f4a503ff9d 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -124,6 +124,7 @@ struct ports_device {
+ * notification
+ */
+ struct work_struct control_work;
++ struct work_struct config_work;
+
+ struct list_head ports;
+
+@@ -1555,10 +1556,21 @@ static void config_intr(struct virtio_device *vdev)
+
+ portdev = vdev->priv;
+
++ if (!use_multiport(portdev))
++ schedule_work(&portdev->config_work);
++}
++
++static void config_work_handler(struct work_struct *work)
++{
++ struct ports_device *portdev;
++
++ portdev = container_of(work, struct ports_device, control_work);
+ if (!use_multiport(portdev)) {
++ struct virtio_device *vdev;
+ struct port *port;
+ u16 rows, cols;
+
++ vdev = portdev->vdev;
+ vdev->config->get(vdev,
+ offsetof(struct virtio_console_config, cols),
+ &cols, sizeof(u16));
+@@ -1752,12 +1764,14 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
+ spin_lock_init(&portdev->ports_lock);
+ INIT_LIST_HEAD(&portdev->ports);
+
++ INIT_WORK(&portdev->config_work, &config_work_handler);
++ INIT_WORK(&portdev->control_work, &control_work_handler);
++
+ if (multiport) {
+ unsigned int nr_added_bufs;
+
+ spin_lock_init(&portdev->c_ivq_lock);
+ spin_lock_init(&portdev->c_ovq_lock);
+- INIT_WORK(&portdev->control_work, &control_work_handler);
+
+ nr_added_bufs = fill_queue(portdev->c_ivq,
+ &portdev->c_ivq_lock);
+@@ -1825,6 +1839,8 @@ static void virtcons_remove(struct virtio_device *vdev)
+ /* Finish up work that's lined up */
+ if (use_multiport(portdev))
+ cancel_work_sync(&portdev->control_work);
++ else
++ cancel_work_sync(&portdev->config_work);
+
+ list_for_each_entry_safe(port, port2, &portdev->ports, list)
+ unplug_port(port);
+@@ -1866,6 +1882,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
+
+ virtqueue_disable_cb(portdev->c_ivq);
+ cancel_work_sync(&portdev->control_work);
++ cancel_work_sync(&portdev->config_work);
+ /*
+ * Once more: if control_work_handler() was running, it would
+ * enable the cb as the last step.
+diff --git a/drivers/cpufreq/speedstep-lib.c b/drivers/cpufreq/speedstep-lib.c
+index 7047821a7f8a..4ab7a2156672 100644
+--- a/drivers/cpufreq/speedstep-lib.c
++++ b/drivers/cpufreq/speedstep-lib.c
+@@ -400,6 +400,7 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,
+
+ pr_debug("previous speed is %u\n", prev_speed);
+
++ preempt_disable();
+ local_irq_save(flags);
+
+ /* switch to low state */
+@@ -464,6 +465,8 @@ unsigned int speedstep_get_freqs(enum speedstep_processor processor,
+
+ out:
+ local_irq_restore(flags);
++ preempt_enable();
++
+ return ret;
+ }
+ EXPORT_SYMBOL_GPL(speedstep_get_freqs);
+diff --git a/drivers/cpufreq/speedstep-smi.c b/drivers/cpufreq/speedstep-smi.c
+index 6a457fcaaad5..b01926df5b1b 100644
+--- a/drivers/cpufreq/speedstep-smi.c
++++ b/drivers/cpufreq/speedstep-smi.c
+@@ -188,6 +188,7 @@ static void speedstep_set_state(unsigned int state)
+ return;
+
+ /* Disable IRQs */
++ preempt_disable();
+ local_irq_save(flags);
+
+ command = (smi_sig & 0xffffff00) | (smi_cmd & 0xff);
+@@ -198,9 +199,19 @@ static void speedstep_set_state(unsigned int state)
+
+ do {
+ if (retry) {
++ /*
++ * We need to enable interrupts, otherwise the blockage
++ * won't resolve.
++ *
++ * We disable preemption so that other processes don't
++ * run. If other processes were running, they could
++ * submit more DMA requests, making the blockage worse.
++ */
+ pr_debug("retry %u, previous result %u, waiting...\n",
+ retry, result);
++ local_irq_enable();
+ mdelay(retry * 50);
++ local_irq_disable();
+ }
+ retry++;
+ __asm__ __volatile__(
+@@ -217,6 +228,7 @@ static void speedstep_set_state(unsigned int state)
+
+ /* enable IRQs */
+ local_irq_restore(flags);
++ preempt_enable();
+
+ if (new_state == state)
+ pr_debug("change to %u MHz succeeded after %u tries "
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index 0924c30dce0b..593ff71c2b63 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -672,7 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ u32 reg;
+ u64 limit, prv = 0;
+ u64 tmp_mb;
+- u32 mb, kb;
++ u32 gb, mb;
+ u32 rir_way;
+
+ /*
+@@ -685,9 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tolm = GET_TOLM(reg);
+ tmp_mb = (1 + pvt->tolm) >> 20;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
+- debugf0("TOLM: %u.%03u GB (0x%016Lx)\n",
+- mb, kb, (u64)pvt->tolm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TOHM: %u.%03u GB (0x%016Lx)\n",
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /* Address range is already 45:25 */
+ pci_read_config_dword(pvt->pci_sad1, TOHM,
+@@ -695,9 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tohm = GET_TOHM(reg);
+ tmp_mb = (1 + pvt->tohm) >> 20;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ debugf0("TOHM: %u.%03u GB (0x%016Lx)",
+- mb, kb, (u64)pvt->tohm);
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /*
+ * Step 2) Get SAD range and SAD Interleave list
+@@ -719,11 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+
+ tmp_mb = (limit + 1) >> 20;
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1000, &mb);
+ debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n",
+ n_sads,
+ get_dram_attr(reg),
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]",
+ reg);
+@@ -753,9 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+ tmp_mb = (limit + 1) >> 20;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1000, &mb);
+ debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+- n_tads, mb, kb,
++ n_tads, gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)TAD_SOCK(reg),
+ (u32)TAD_CH(reg),
+@@ -778,10 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ tad_ch_nilv_offset[j],
+ ®);
+ tmp_mb = TAD_OFFSET(reg) >> 20;
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
+ i, j,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ reg);
+ }
+@@ -803,10 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+
+ tmp_mb = RIR_LIMIT(reg) >> 20;
+ rir_way = 1 << RIR_WAY(reg);
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
+ i, j,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ rir_way,
+ reg);
+@@ -817,10 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ ®);
+ tmp_mb = RIR_OFFSET(reg) << 6;
+
+- mb = div_u64_rem(tmp_mb, 1000, &kb);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
+ debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
+ i, j, k,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)RIR_RNK_TGT(reg),
+ reg);
+@@ -858,7 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ u8 ch_way,sck_way;
+ u32 tad_offset;
+ u32 rir_way;
+- u32 mb, kb;
++ u32 gb, mb;
+ u64 ch_addr, offset, limit, prv = 0;
+
+
+@@ -1084,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ continue;
+
+ limit = RIR_LIMIT(reg);
+- mb = div_u64_rem(limit >> 20, 1000, &kb);
++ gb = div_u64_rem(limit >> 20, 1024, &mb);
+ debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
+ n_rir,
+- mb, kb,
++ gb, (mb*1000)/1024,
+ limit,
+ 1 << RIR_WAY(reg));
+ if (ch_addr <= limit)
+diff --git a/drivers/gpio/gpio-tps65912.c b/drivers/gpio/gpio-tps65912.c
+index 79e66c002350..2712680c1337 100644
+--- a/drivers/gpio/gpio-tps65912.c
++++ b/drivers/gpio/gpio-tps65912.c
+@@ -26,9 +26,12 @@ struct tps65912_gpio_data {
+ struct gpio_chip gpio_chip;
+ };
+
++#define to_tgd(gc) container_of(gc, struct tps65912_gpio_data, gpio_chip)
++
+ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+ int val;
+
+ val = tps65912_reg_read(tps65912, TPS65912_GPIO1 + offset);
+@@ -42,7 +45,8 @@ static int tps65912_gpio_get(struct gpio_chip *gc, unsigned offset)
+ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
+ int value)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+
+ if (value)
+ tps65912_set_bits(tps65912, TPS65912_GPIO1 + offset,
+@@ -55,7 +59,8 @@ static void tps65912_gpio_set(struct gpio_chip *gc, unsigned offset,
+ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
+ int value)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+
+ /* Set the initial value */
+ tps65912_gpio_set(gc, offset, value);
+@@ -66,7 +71,8 @@ static int tps65912_gpio_output(struct gpio_chip *gc, unsigned offset,
+
+ static int tps65912_gpio_input(struct gpio_chip *gc, unsigned offset)
+ {
+- struct tps65912 *tps65912 = container_of(gc, struct tps65912, gpio);
++ struct tps65912_gpio_data *tps65912_gpio = to_tgd(gc);
++ struct tps65912 *tps65912 = tps65912_gpio->tps65912;
+
+ return tps65912_clear_bits(tps65912, TPS65912_GPIO1 + offset,
+ GPIO_CFG_MASK);
+diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
+index 8d1724c42b60..5325c20fd706 100644
+--- a/drivers/gpu/drm/radeon/atombios_dp.c
++++ b/drivers/gpu/drm/radeon/atombios_dp.c
+@@ -777,10 +777,8 @@ static int radeon_dp_link_train_init(struct radeon_dp_link_train_info *dp_info)
+ radeon_write_dpcd_reg(dp_info->radeon_connector,
+ DP_DOWNSPREAD_CTRL, 0);
+
+- if ((dp_info->connector->connector_type == DRM_MODE_CONNECTOR_eDP) &&
+- (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)) {
++ if (dig->panel_mode == DP_PANEL_MODE_INTERNAL_DP2_MODE)
+ radeon_write_dpcd_reg(dp_info->radeon_connector, DP_EDP_CONFIGURATION_SET, 1);
+- }
+
+ /* set the lane count on the sink */
+ tmp = dp_info->dp_lane_count;
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index 01434ef9e00f..c5fe79e67ed9 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -3474,6 +3474,9 @@ int evergreen_init(struct radeon_device *rdev)
+ }
+ }
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
+index 40ed0e5b95a3..8ec5b8553873 100644
+--- a/drivers/gpu/drm/radeon/r100.c
++++ b/drivers/gpu/drm/radeon/r100.c
+@@ -726,6 +726,10 @@ int r100_irq_set(struct radeon_device *rdev)
+ tmp |= RADEON_FP2_DETECT_MASK;
+ }
+ WREG32(RADEON_GEN_INT_CNTL, tmp);
++
++ /* read back to post the write */
++ RREG32(RADEON_GEN_INT_CNTL);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
+index 1555cd694111..9c7062d970ee 100644
+--- a/drivers/gpu/drm/radeon/r600.c
++++ b/drivers/gpu/drm/radeon/r600.c
+@@ -3184,6 +3184,9 @@ int r600_irq_set(struct radeon_device *rdev)
+ WREG32(DC_HOT_PLUG_DETECT3_INT_CONTROL, hpd3);
+ }
+
++ /* posting read */
++ RREG32(R_000E50_SRBM_STATUS);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
+index d306cc8fdeaa..ef56e4ed89d2 100644
+--- a/drivers/gpu/drm/radeon/radeon_bios.c
++++ b/drivers/gpu/drm/radeon/radeon_bios.c
+@@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
+
+ static bool radeon_read_bios(struct radeon_device *rdev)
+ {
+- uint8_t __iomem *bios;
++ uint8_t __iomem *bios, val1, val2;
+ size_t size;
+
+ rdev->bios = NULL;
+@@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
+ return false;
+ }
+
+- if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
++ val1 = readb(&bios[0]);
++ val2 = readb(&bios[1]);
++
++ if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
+ pci_unmap_rom(rdev->pdev, bios);
+ return false;
+ }
+- rdev->bios = kmemdup(bios, size, GFP_KERNEL);
++ rdev->bios = kzalloc(size, GFP_KERNEL);
+ if (rdev->bios == NULL) {
+ pci_unmap_rom(rdev->pdev, bios);
+ return false;
+ }
++ memcpy_fromio(rdev->bios, bios, size);
+ pci_unmap_rom(rdev->pdev, bios);
+ return true;
+ }
+diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
+index cf723c4297a9..f3ee36036487 100644
+--- a/drivers/gpu/drm/radeon/radeon_cs.c
++++ b/drivers/gpu/drm/radeon/radeon_cs.c
+@@ -167,11 +167,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
+ u32 ring = RADEON_CS_RING_GFX;
+ s32 priority = 0;
+
++ INIT_LIST_HEAD(&p->validated);
++
+ if (!cs->num_chunks) {
+ return 0;
+ }
++
+ /* get chunks */
+- INIT_LIST_HEAD(&p->validated);
+ p->idx = 0;
+ p->chunk_ib_idx = -1;
+ p->chunk_relocs_idx = -1;
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index 739eb0d0d12d..07b6dbf68152 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -585,6 +585,10 @@ int rs600_irq_set(struct radeon_device *rdev)
+ WREG32(R_006540_DxMODE_INT_MASK, mode_int);
+ WREG32(R_007D08_DC_HOT_PLUG_DETECT1_INT_CONTROL, hpd1);
+ WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
++
++ /* posting read */
++ RREG32(R_000040_GEN_INT_CNTL);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
+index e710073923e9..068b21f0d7df 100644
+--- a/drivers/gpu/drm/radeon/si.c
++++ b/drivers/gpu/drm/radeon/si.c
+@@ -4126,6 +4126,9 @@ int si_init(struct radeon_device *rdev)
+ return -EINVAL;
+ }
+
++ /* posting read */
++ RREG32(SRBM_STATUS);
++
+ return 0;
+ }
+
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+index db50604ac216..e43341a53fac 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+@@ -547,21 +547,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ goto out_err1;
+ }
+
+- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
+- (dev_priv->vram_size >> PAGE_SHIFT));
+- if (unlikely(ret != 0)) {
+- DRM_ERROR("Failed initializing memory manager for VRAM.\n");
+- goto out_err2;
+- }
+-
+- dev_priv->has_gmr = true;
+- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
+- dev_priv->max_gmr_ids) != 0) {
+- DRM_INFO("No GMR memory available. "
+- "Graphics memory resources are very limited.\n");
+- dev_priv->has_gmr = false;
+- }
+-
+ dev_priv->mmio_mtrr = drm_mtrr_add(dev_priv->mmio_start,
+ dev_priv->mmio_size, DRM_MTRR_WC);
+
+@@ -618,6 +603,22 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
+ ret = vmw_3d_resource_inc(dev_priv, true);
+ if (unlikely(ret != 0))
+ goto out_no_fifo;
++
++ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
++ (dev_priv->vram_size >> PAGE_SHIFT));
++ if (unlikely(ret != 0)) {
++ DRM_ERROR("Failed initializing memory manager for VRAM.\n");
++ goto out_no_vram;
++ }
++
++ dev_priv->has_gmr = true;
++ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
++ dev_priv->max_gmr_ids) != 0) {
++ DRM_INFO("No GMR memory available. "
++ "Graphics memory resources are very limited.\n");
++ dev_priv->has_gmr = false;
++ }
++
+ vmw_kms_save_vga(dev_priv);
+
+ /* Start kms and overlay systems, needs fifo. */
+@@ -663,6 +664,10 @@ out_no_kms:
+ vmw_kms_restore_vga(dev_priv);
+ vmw_3d_resource_dec(dev_priv, false);
+ }
++out_no_vram:
++ if (dev_priv->has_gmr)
++ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
++ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+ out_no_fifo:
+ vmw_fence_manager_takedown(dev_priv->fman);
+ out_no_fman:
+@@ -677,9 +682,6 @@ out_err4:
+ out_err3:
+ drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
+ dev_priv->mmio_size, DRM_MTRR_WC);
+- if (dev_priv->has_gmr)
+- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+ out_err2:
+ (void)ttm_bo_device_release(&dev_priv->bdev);
+ out_err1:
+@@ -709,6 +711,11 @@ static int vmw_driver_unload(struct drm_device *dev)
+ }
+ vmw_kms_close(dev_priv);
+ vmw_overlay_close(dev_priv);
++
++ if (dev_priv->has_gmr)
++ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
++ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
++
+ vmw_fence_manager_takedown(dev_priv->fman);
+ if (dev_priv->stealth)
+ pci_release_region(dev->pdev, 2);
+@@ -719,9 +726,6 @@ static int vmw_driver_unload(struct drm_device *dev)
+ iounmap(dev_priv->mmio_virt);
+ drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
+ dev_priv->mmio_size, DRM_MTRR_WC);
+- if (dev_priv->has_gmr)
+- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
+- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
+ (void)ttm_bo_device_release(&dev_priv->bdev);
+ vmw_ttm_global_release(dev_priv);
+ idr_destroy(&dev_priv->surface_idr);
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index a84112322071..d0254beb6d90 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ /*
++ * If the combination of the addr and size requested for this memory
++ * region causes an integer overflow, return error.
++ */
++ if (((addr + size) < addr) ||
++ PAGE_ALIGN(addr + size) < (addr + size))
++ return ERR_PTR(-EINVAL);
++
+ if (!can_do_mlock())
+ return ERR_PTR(-EPERM);
+
+diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
+index 604556d73d25..5b51e4e6e7f9 100644
+--- a/drivers/infiniband/core/uverbs_main.c
++++ b/drivers/infiniband/core/uverbs_main.c
+@@ -451,6 +451,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
+
+ entry->desc.async.element = element;
+ entry->desc.async.event_type = event;
++ entry->desc.async.reserved = 0;
+ entry->counter = counter;
+
+ list_add_tail(&entry->list, &file->async_file->event_list);
+diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
+index 259b0670b51c..df76538042ee 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -44,6 +44,14 @@ enum {
+ MLX4_IB_VENDOR_CLASS2 = 0xa
+ };
+
++/* Counters should be saturate once they reach their maximum value */
++#define ASSIGN_32BIT_COUNTER(counter, value) do {\
++ if ((value) > (u32)~0U) \
++ counter = cpu_to_be32((u32)~0U); \
++ else \
++ counter = cpu_to_be32(value); \
++} while (0)
++
+ int mlx4_MAD_IFC(struct mlx4_ib_dev *dev, int ignore_mkey, int ignore_bkey,
+ int port, struct ib_wc *in_wc, struct ib_grh *in_grh,
+ void *in_mad, void *response_mad)
+@@ -304,10 +312,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+ static void edit_counter(struct mlx4_counter *cnt,
+ struct ib_pma_portcounters *pma_cnt)
+ {
+- pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
+- pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
+- pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
+- pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
++ (be64_to_cpu(cnt->tx_bytes) >> 2));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
++ (be64_to_cpu(cnt->rx_bytes) >> 2));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
++ be64_to_cpu(cnt->tx_frames));
++ ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
++ be64_to_cpu(cnt->rx_frames));
+ }
+
+ static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
+diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h
+index 6b811e3e8bd1..c7d4ef18cd40 100644
+--- a/drivers/infiniband/hw/qib/qib.h
++++ b/drivers/infiniband/hw/qib/qib.h
+@@ -1013,12 +1013,6 @@ struct qib_devdata {
+ /* control high-level access to EEPROM */
+ struct mutex eep_lock;
+ uint64_t traffic_wds;
+- /* active time is kept in seconds, but logged in hours */
+- atomic_t active_time;
+- /* Below are nominal shadow of EEPROM, new since last EEPROM update */
+- uint8_t eep_st_errs[QIB_EEP_LOG_CNT];
+- uint8_t eep_st_new_errs[QIB_EEP_LOG_CNT];
+- uint16_t eep_hrs;
+ /*
+ * masks for which bits of errs, hwerrs that cause
+ * each of the counters to increment.
+@@ -1235,8 +1229,7 @@ int qib_twsi_blk_rd(struct qib_devdata *dd, int dev, int addr, void *buffer,
+ int qib_twsi_blk_wr(struct qib_devdata *dd, int dev, int addr,
+ const void *buffer, int len);
+ void qib_get_eeprom_info(struct qib_devdata *);
+-int qib_update_eeprom_log(struct qib_devdata *dd);
+-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr);
++#define qib_inc_eeprom_err(dd, eidx, incr)
+ void qib_dump_lookup_output_queue(struct qib_devdata *);
+ void qib_force_pio_avail_update(struct qib_devdata *);
+ void qib_clear_symerror_on_linkup(unsigned long opaque);
+diff --git a/drivers/infiniband/hw/qib/qib_eeprom.c b/drivers/infiniband/hw/qib/qib_eeprom.c
+index 92d9cfe98a68..161ef71d6d42 100644
+--- a/drivers/infiniband/hw/qib/qib_eeprom.c
++++ b/drivers/infiniband/hw/qib/qib_eeprom.c
+@@ -263,189 +263,8 @@ void qib_get_eeprom_info(struct qib_devdata *dd)
+ qib_dev_err(dd, "Board SN %s did not pass functional "
+ "test: %s\n", dd->serial, ifp->if_comment);
+
+- memcpy(&dd->eep_st_errs, &ifp->if_errcntp, QIB_EEP_LOG_CNT);
+- /*
+- * Power-on (actually "active") hours are kept as little-endian value
+- * in EEPROM, but as seconds in a (possibly as small as 24-bit)
+- * atomic_t while running.
+- */
+- atomic_set(&dd->active_time, 0);
+- dd->eep_hrs = ifp->if_powerhour[0] | (ifp->if_powerhour[1] << 8);
+-
+ done:
+ vfree(buf);
+
+ bail:;
+ }
+-
+-/**
+- * qib_update_eeprom_log - copy active-time and error counters to eeprom
+- * @dd: the qlogic_ib device
+- *
+- * Although the time is kept as seconds in the qib_devdata struct, it is
+- * rounded to hours for re-write, as we have only 16 bits in EEPROM.
+- * First-cut code reads whole (expected) struct qib_flash, modifies,
+- * re-writes. Future direction: read/write only what we need, assuming
+- * that the EEPROM had to have been "good enough" for driver init, and
+- * if not, we aren't making it worse.
+- *
+- */
+-int qib_update_eeprom_log(struct qib_devdata *dd)
+-{
+- void *buf;
+- struct qib_flash *ifp;
+- int len, hi_water;
+- uint32_t new_time, new_hrs;
+- u8 csum;
+- int ret, idx;
+- unsigned long flags;
+-
+- /* first, check if we actually need to do anything. */
+- ret = 0;
+- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
+- if (dd->eep_st_new_errs[idx]) {
+- ret = 1;
+- break;
+- }
+- }
+- new_time = atomic_read(&dd->active_time);
+-
+- if (ret == 0 && new_time < 3600)
+- goto bail;
+-
+- /*
+- * The quick-check above determined that there is something worthy
+- * of logging, so get current contents and do a more detailed idea.
+- * read full flash, not just currently used part, since it may have
+- * been written with a newer definition
+- */
+- len = sizeof(struct qib_flash);
+- buf = vmalloc(len);
+- ret = 1;
+- if (!buf) {
+- qib_dev_err(dd, "Couldn't allocate memory to read %u "
+- "bytes from eeprom for logging\n", len);
+- goto bail;
+- }
+-
+- /* Grab semaphore and read current EEPROM. If we get an
+- * error, let go, but if not, keep it until we finish write.
+- */
+- ret = mutex_lock_interruptible(&dd->eep_lock);
+- if (ret) {
+- qib_dev_err(dd, "Unable to acquire EEPROM for logging\n");
+- goto free_bail;
+- }
+- ret = qib_twsi_blk_rd(dd, dd->twsi_eeprom_dev, 0, buf, len);
+- if (ret) {
+- mutex_unlock(&dd->eep_lock);
+- qib_dev_err(dd, "Unable read EEPROM for logging\n");
+- goto free_bail;
+- }
+- ifp = (struct qib_flash *)buf;
+-
+- csum = flash_csum(ifp, 0);
+- if (csum != ifp->if_csum) {
+- mutex_unlock(&dd->eep_lock);
+- qib_dev_err(dd, "EEPROM cks err (0x%02X, S/B 0x%02X)\n",
+- csum, ifp->if_csum);
+- ret = 1;
+- goto free_bail;
+- }
+- hi_water = 0;
+- spin_lock_irqsave(&dd->eep_st_lock, flags);
+- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
+- int new_val = dd->eep_st_new_errs[idx];
+- if (new_val) {
+- /*
+- * If we have seen any errors, add to EEPROM values
+- * We need to saturate at 0xFF (255) and we also
+- * would need to adjust the checksum if we were
+- * trying to minimize EEPROM traffic
+- * Note that we add to actual current count in EEPROM,
+- * in case it was altered while we were running.
+- */
+- new_val += ifp->if_errcntp[idx];
+- if (new_val > 0xFF)
+- new_val = 0xFF;
+- if (ifp->if_errcntp[idx] != new_val) {
+- ifp->if_errcntp[idx] = new_val;
+- hi_water = offsetof(struct qib_flash,
+- if_errcntp) + idx;
+- }
+- /*
+- * update our shadow (used to minimize EEPROM
+- * traffic), to match what we are about to write.
+- */
+- dd->eep_st_errs[idx] = new_val;
+- dd->eep_st_new_errs[idx] = 0;
+- }
+- }
+- /*
+- * Now update active-time. We would like to round to the nearest hour
+- * but unless atomic_t are sure to be proper signed ints we cannot,
+- * because we need to account for what we "transfer" to EEPROM and
+- * if we log an hour at 31 minutes, then we would need to set
+- * active_time to -29 to accurately count the _next_ hour.
+- */
+- if (new_time >= 3600) {
+- new_hrs = new_time / 3600;
+- atomic_sub((new_hrs * 3600), &dd->active_time);
+- new_hrs += dd->eep_hrs;
+- if (new_hrs > 0xFFFF)
+- new_hrs = 0xFFFF;
+- dd->eep_hrs = new_hrs;
+- if ((new_hrs & 0xFF) != ifp->if_powerhour[0]) {
+- ifp->if_powerhour[0] = new_hrs & 0xFF;
+- hi_water = offsetof(struct qib_flash, if_powerhour);
+- }
+- if ((new_hrs >> 8) != ifp->if_powerhour[1]) {
+- ifp->if_powerhour[1] = new_hrs >> 8;
+- hi_water = offsetof(struct qib_flash, if_powerhour) + 1;
+- }
+- }
+- /*
+- * There is a tiny possibility that we could somehow fail to write
+- * the EEPROM after updating our shadows, but problems from holding
+- * the spinlock too long are a much bigger issue.
+- */
+- spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+- if (hi_water) {
+- /* we made some change to the data, uopdate cksum and write */
+- csum = flash_csum(ifp, 1);
+- ret = eeprom_write_with_enable(dd, 0, buf, hi_water + 1);
+- }
+- mutex_unlock(&dd->eep_lock);
+- if (ret)
+- qib_dev_err(dd, "Failed updating EEPROM\n");
+-
+-free_bail:
+- vfree(buf);
+-bail:
+- return ret;
+-}
+-
+-/**
+- * qib_inc_eeprom_err - increment one of the four error counters
+- * that are logged to EEPROM.
+- * @dd: the qlogic_ib device
+- * @eidx: 0..3, the counter to increment
+- * @incr: how much to add
+- *
+- * Each counter is 8-bits, and saturates at 255 (0xFF). They
+- * are copied to the EEPROM (aka flash) whenever qib_update_eeprom_log()
+- * is called, but it can only be called in a context that allows sleep.
+- * This function can be called even at interrupt level.
+- */
+-void qib_inc_eeprom_err(struct qib_devdata *dd, u32 eidx, u32 incr)
+-{
+- uint new_val;
+- unsigned long flags;
+-
+- spin_lock_irqsave(&dd->eep_st_lock, flags);
+- new_val = dd->eep_st_new_errs[eidx] + incr;
+- if (new_val > 255)
+- new_val = 255;
+- dd->eep_st_new_errs[eidx] = new_val;
+- spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+-}
+diff --git a/drivers/infiniband/hw/qib/qib_iba6120.c b/drivers/infiniband/hw/qib/qib_iba6120.c
+index d0c64d514813..eb60abd69a72 100644
+--- a/drivers/infiniband/hw/qib/qib_iba6120.c
++++ b/drivers/infiniband/hw/qib/qib_iba6120.c
+@@ -2674,8 +2674,6 @@ static void qib_get_6120_faststats(unsigned long opaque)
+ spin_lock_irqsave(&dd->eep_st_lock, flags);
+ traffic_wds -= dd->traffic_wds;
+ dd->traffic_wds += traffic_wds;
+- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
+- atomic_add(5, &dd->active_time); /* S/B #define */
+ spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+
+ qib_chk_6120_errormask(dd);
+diff --git a/drivers/infiniband/hw/qib/qib_iba7220.c b/drivers/infiniband/hw/qib/qib_iba7220.c
+index 3c722f79d6f6..b62c7f26a963 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7220.c
++++ b/drivers/infiniband/hw/qib/qib_iba7220.c
+@@ -3292,8 +3292,6 @@ static void qib_get_7220_faststats(unsigned long opaque)
+ spin_lock_irqsave(&dd->eep_st_lock, flags);
+ traffic_wds -= dd->traffic_wds;
+ dd->traffic_wds += traffic_wds;
+- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
+- atomic_add(5, &dd->active_time); /* S/B #define */
+ spin_unlock_irqrestore(&dd->eep_st_lock, flags);
+ done:
+ mod_timer(&dd->stats_timer, jiffies + HZ * ACTIVITY_TIMER);
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index d25205309d45..0d8e3487a5a3 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -4841,8 +4841,6 @@ static void qib_get_7322_faststats(unsigned long opaque)
+ spin_lock_irqsave(&ppd->dd->eep_st_lock, flags);
+ traffic_wds -= ppd->dd->traffic_wds;
+ ppd->dd->traffic_wds += traffic_wds;
+- if (traffic_wds >= QIB_TRAFFIC_ACTIVE_THRESHOLD)
+- atomic_add(ACTIVITY_TIMER, &ppd->dd->active_time);
+ spin_unlock_irqrestore(&ppd->dd->eep_st_lock, flags);
+ if (ppd->cpspec->qdr_dfe_on && (ppd->link_speed_active &
+ QIB_IB_QDR) &&
+diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c
+index cf0cd30adc8d..0776dd0d0f51 100644
+--- a/drivers/infiniband/hw/qib/qib_init.c
++++ b/drivers/infiniband/hw/qib/qib_init.c
+@@ -765,7 +765,6 @@ static void qib_shutdown_device(struct qib_devdata *dd)
+ dd->f_quiet_serdes(ppd);
+ }
+
+- qib_update_eeprom_log(dd);
+ }
+
+ /**
+diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
+index dae51604cfcd..c01cb116a89a 100644
+--- a/drivers/infiniband/hw/qib/qib_sysfs.c
++++ b/drivers/infiniband/hw/qib/qib_sysfs.c
+@@ -550,28 +550,6 @@ bail:
+ return ret < 0 ? ret : count;
+ }
+
+-static ssize_t show_logged_errs(struct device *device,
+- struct device_attribute *attr, char *buf)
+-{
+- struct qib_ibdev *dev =
+- container_of(device, struct qib_ibdev, ibdev.dev);
+- struct qib_devdata *dd = dd_from_dev(dev);
+- int idx, count;
+-
+- /* force consistency with actual EEPROM */
+- if (qib_update_eeprom_log(dd) != 0)
+- return -ENXIO;
+-
+- count = 0;
+- for (idx = 0; idx < QIB_EEP_LOG_CNT; ++idx) {
+- count += scnprintf(buf + count, PAGE_SIZE - count, "%d%c",
+- dd->eep_st_errs[idx],
+- idx == (QIB_EEP_LOG_CNT - 1) ? '\n' : ' ');
+- }
+-
+- return count;
+-}
+-
+ /*
+ * Dump tempsense regs. in decimal, to ease shell-scripts.
+ */
+@@ -618,7 +596,6 @@ static DEVICE_ATTR(nctxts, S_IRUGO, show_nctxts, NULL);
+ static DEVICE_ATTR(nfreectxts, S_IRUGO, show_nfreectxts, NULL);
+ static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
+ static DEVICE_ATTR(boardversion, S_IRUGO, show_boardversion, NULL);
+-static DEVICE_ATTR(logged_errors, S_IRUGO, show_logged_errs, NULL);
+ static DEVICE_ATTR(tempsense, S_IRUGO, show_tempsense, NULL);
+ static DEVICE_ATTR(localbus_info, S_IRUGO, show_localbus_info, NULL);
+ static DEVICE_ATTR(chip_reset, S_IWUSR, NULL, store_chip_reset);
+@@ -632,7 +609,6 @@ static struct device_attribute *qib_attributes[] = {
+ &dev_attr_nfreectxts,
+ &dev_attr_serial,
+ &dev_attr_boardversion,
+- &dev_attr_logged_errors,
+ &dev_attr_tempsense,
+ &dev_attr_localbus_info,
+ &dev_attr_chip_reset,
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 97e5f6f797b4..6d6198a3d52f 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -274,8 +274,14 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ }
+ }
+
+- if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
+- SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
++ if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
++ (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
++ /*
++ * Firmware v8.1 does not report proper number of extended
++ * capabilities, but has been proven to report correct min
++ * coordinates.
++ */
++ SYN_ID_FULL(priv->identity) == 0x801)) {
+ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
+ psmouse_warn(psmouse,
+ "device claims to have min coordinates query, but I'm not able to read it.\n");
+@@ -506,6 +512,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
+ priv->agm_pending = true;
+ }
+
++static void synaptics_parse_ext_buttons(const unsigned char buf[],
++ struct synaptics_data *priv,
++ struct synaptics_hw_state *hw)
++{
++ unsigned int ext_bits =
++ (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++ unsigned int ext_mask = (1U << ext_bits) - 1;
++
++ hw->ext_buttons = buf[4] & ext_mask;
++ hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
++}
++
+ static bool is_forcepad;
+
+ static int synaptics_parse_hw_state(const unsigned char buf[],
+@@ -592,28 +610,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ }
+
+- if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
++ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
+ ((buf[0] ^ buf[3]) & 0x02)) {
+- switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+- default:
+- /*
+- * if nExtBtn is greater than 8 it should be
+- * considered invalid and treated as 0
+- */
+- break;
+- case 8:
+- hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
+- case 6:
+- hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
+- case 4:
+- hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
+- case 2:
+- hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
+- }
++ synaptics_parse_ext_buttons(buf, priv, hw);
+ }
+ } else {
+ hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
+@@ -675,12 +674,35 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
+ }
+ }
+
++static void synaptics_report_ext_buttons(struct psmouse *psmouse,
++ const struct synaptics_hw_state *hw)
++{
++ struct input_dev *dev = psmouse->dev;
++ struct synaptics_data *priv = psmouse->private;
++ int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++ int i;
++
++ if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
++ return;
++
++ /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
++ if (SYN_ID_FULL(priv->identity) == 0x801 &&
++ !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
++ return;
++
++ for (i = 0; i < ext_bits; i++) {
++ input_report_key(dev, BTN_0 + 2 * i,
++ hw->ext_buttons & (1 << i));
++ input_report_key(dev, BTN_1 + 2 * i,
++ hw->ext_buttons & (1 << (i + ext_bits)));
++ }
++}
++
+ static void synaptics_report_buttons(struct psmouse *psmouse,
+ const struct synaptics_hw_state *hw)
+ {
+ struct input_dev *dev = psmouse->dev;
+ struct synaptics_data *priv = psmouse->private;
+- int i;
+
+ input_report_key(dev, BTN_LEFT, hw->left);
+ input_report_key(dev, BTN_RIGHT, hw->right);
+@@ -693,8 +715,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
+ input_report_key(dev, BTN_BACK, hw->down);
+ }
+
+- for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+- input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
++ synaptics_report_ext_buttons(psmouse, hw);
+ }
+
+ static void synaptics_report_slot(struct input_dev *dev, int slot,
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index ea5dd289fe2a..489d7fbcec51 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -298,6 +298,18 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ sector_t remaining = where->count;
+ struct request_queue *q = bdev_get_queue(where->bdev);
+ sector_t discard_sectors;
++ unsigned int uninitialized_var(special_cmd_max_sectors);
++
++ /*
++ * Reject unsupported discard and write same requests.
++ */
++ if (rw & REQ_DISCARD) {
++ special_cmd_max_sectors = q->limits.max_discard_sectors;
++ if (special_cmd_max_sectors == 0) {
++ dec_count(io, region, -EOPNOTSUPP);
++ return;
++ }
++ }
+
+ /*
+ * where->count may be zero if rw holds a flush and we need to
+@@ -321,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ store_io_and_region_in_bio(bio, io, region);
+
+ if (rw & REQ_DISCARD) {
+- discard_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++ discard_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_size = discard_sectors << SECTOR_SHIFT;
+ remaining -= discard_sectors;
+ } else while (remaining) {
+diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
+index a3cf259275af..3afb9cdbdd14 100644
+--- a/drivers/md/dm-raid1.c
++++ b/drivers/md/dm-raid1.c
+@@ -603,6 +603,15 @@ static void write_callback(unsigned long error, void *context)
+ return;
+ }
+
++ /*
++ * If the bio is discard, return an error, but do not
++ * degrade the array.
++ */
++ if (bio->bi_rw & REQ_DISCARD) {
++ bio_endio(bio, -EOPNOTSUPP);
++ return;
++ }
++
+ for (i = 0; i < ms->nr_mirrors; i++)
+ if (test_bit(i, &error))
+ fail_mirror(ms->mirror + i, DM_RAID1_WRITE_ERROR);
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index b092338d5966..696a16bbf835 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1444,8 +1444,6 @@ out:
+ full_bio->bi_end_io = pe->full_bio_end_io;
+ full_bio->bi_private = pe->full_bio_private;
+ }
+- free_pending_exception(pe);
+-
+ increment_pending_exceptions_done_count();
+
+ up_write(&s->lock);
+@@ -1462,6 +1460,8 @@ out:
+ }
+
+ retry_origin_bios(s, origin_bios);
++
++ free_pending_exception(pe);
+ }
+
+ static void commit_callback(void *context, int success)
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 0cf8c519d07e..3bfbccc3f0a7 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2232,7 +2232,7 @@ int dm_setup_md_queue(struct mapped_device *md)
+ return 0;
+ }
+
+-static struct mapped_device *dm_find_md(dev_t dev)
++struct mapped_device *dm_get_md(dev_t dev)
+ {
+ struct mapped_device *md;
+ unsigned minor = MINOR(dev);
+@@ -2243,12 +2243,15 @@ static struct mapped_device *dm_find_md(dev_t dev)
+ spin_lock(&_minor_lock);
+
+ md = idr_find(&_minor_idr, minor);
+- if (md && (md == MINOR_ALLOCED ||
+- (MINOR(disk_devt(dm_disk(md))) != minor) ||
+- dm_deleting_md(md) ||
+- test_bit(DMF_FREEING, &md->flags))) {
+- md = NULL;
+- goto out;
++ if (md) {
++ if ((md == MINOR_ALLOCED ||
++ (MINOR(disk_devt(dm_disk(md))) != minor) ||
++ dm_deleting_md(md) ||
++ test_bit(DMF_FREEING, &md->flags))) {
++ md = NULL;
++ goto out;
++ }
++ dm_get(md);
+ }
+
+ out:
+@@ -2256,16 +2259,6 @@ out:
+
+ return md;
+ }
+-
+-struct mapped_device *dm_get_md(dev_t dev)
+-{
+- struct mapped_device *md = dm_find_md(dev);
+-
+- if (md)
+- dm_get(md);
+-
+- return md;
+-}
+ EXPORT_SYMBOL_GPL(dm_get_md);
+
+ void *dm_get_mdptr(struct mapped_device *md)
+@@ -2302,10 +2295,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ set_bit(DMF_FREEING, &md->flags);
+ spin_unlock(&_minor_lock);
+
++ /*
++ * Take suspend_lock so that presuspend and postsuspend methods
++ * do not race with internal suspend.
++ */
++ mutex_lock(&md->suspend_lock);
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
+ dm_table_postsuspend_targets(map);
+ }
++ mutex_unlock(&md->suspend_lock);
+
+ /*
+ * Rare, but there may be I/O requests still going to complete,
+diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
+index f6a7d7ac4b98..b14ab4384743 100644
+--- a/drivers/mtd/ubi/misc.c
++++ b/drivers/mtd/ubi/misc.c
+@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
+ for (i = 0; i < vol->used_ebs; i++) {
+ int size;
+
++ cond_resched();
++
+ if (i == vol->used_ebs - 1)
+ size = vol->last_eb_bytes;
+ else
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index 88c39e42cf5a..81a00e4d6de6 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -475,6 +475,11 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++ skb_reset_mac_header(skb);
++ skb_reset_network_header(skb);
++ skb_reset_transport_header(skb);
++
+ *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
+ memset(*cf, 0, sizeof(struct can_frame));
+
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index 86b6d8e4e6cd..d63b322c73ae 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1526,7 +1526,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ {
+ struct pcnet32_private *lp;
+ int i, media;
+- int fdx, mii, fset, dxsuflo;
++ int fdx, mii, fset, dxsuflo, sram;
+ int chip_version;
+ char *chipname;
+ struct net_device *dev;
+@@ -1563,7 +1563,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ }
+
+ /* initialize variables */
+- fdx = mii = fset = dxsuflo = 0;
++ fdx = mii = fset = dxsuflo = sram = 0;
+ chip_version = (chip_version >> 12) & 0xffff;
+
+ switch (chip_version) {
+@@ -1596,6 +1596,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C973"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2626:
+ chipname = "PCnet/Home 79C978"; /* PCI */
+@@ -1619,6 +1620,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C975"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2628:
+ chipname = "PCnet/PRO 79C976";
+@@ -1647,6 +1649,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ dxsuflo = 1;
+ }
+
++ /*
++ * The Am79C973/Am79C975 controllers come with 12K of SRAM
++ * which we can use for the Tx/Rx buffers but most importantly,
++ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
++ * Tx fifo underflows.
++ */
++ if (sram) {
++ /*
++ * The SRAM is being configured in two steps. First we
++ * set the SRAM size in the BCR25:SRAM_SIZE bits. According
++ * to the datasheet, each bit corresponds to a 512-byte
++ * page so we can have at most 24 pages. The SRAM_SIZE
++ * holds the value of the upper 8 bits of the 16-bit SRAM size.
++ * The low 8-bits start at 0x00 and end at 0xff. So the
++ * address range is from 0x0000 up to 0x17ff. Therefore,
++ * the SRAM_SIZE is set to 0x17. The next step is to set
++ * the BCR26:SRAM_BND midway through so the Tx and Rx
++ * buffers can share the SRAM equally.
++ */
++ a->write_bcr(ioaddr, 25, 0x17);
++ a->write_bcr(ioaddr, 26, 0xc);
++ /* And finally enable the NOUFLO bit */
++ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
++ }
++
+ dev = alloc_etherdev(sizeof(*lp));
+ if (!dev) {
+ ret = -ENOMEM;
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+index b8e7f3e082e9..1e274e72b8f5 100644
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -10934,6 +10934,10 @@ static int __devinit bnx2x_init_dev(struct pci_dev *pdev,
+ /* clean indirect addresses */
+ pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
+ PCICFG_VENDOR_ID_OFFSET);
++
++ /* Set PCIe reset type to fundamental for EEH recovery */
++ pdev->needs_freset = 1;
++
+ /*
+ * Clean the following indirect addresses for all functions since it
+ * is not used by the driver.
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index d16800f5168a..56299e929791 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -39,9 +39,7 @@
+
+ static struct team_port *team_port_get_rcu(const struct net_device *dev)
+ {
+- struct team_port *port = rcu_dereference(dev->rx_handler_data);
+-
+- return team_port_exists(dev) ? port : NULL;
++ return rcu_dereference(dev->rx_handler_data);
+ }
+
+ static struct team_port *team_port_get_rtnl(const struct net_device *dev)
+diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
+index 200f165c0c6d..2cc3f4132550 100644
+--- a/drivers/net/wireless/ath/ath5k/reset.c
++++ b/drivers/net/wireless/ath/ath5k/reset.c
+@@ -476,7 +476,7 @@ ath5k_hw_wisoc_reset(struct ath5k_hw *ah, u32 flags)
+ regval = ioread32(reg);
+ iowrite32(regval | val, reg);
+ regval = ioread32(reg);
+- usleep_range(100, 150);
++ udelay(100); /* NB: should be atomic */
+
+ /* Bring BB/MAC out of reset */
+ iowrite32(regval & ~val, reg);
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 410018c4c528..bad4ee30728a 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -27,6 +27,8 @@ struct backend_info {
+ enum xenbus_state frontend_state;
+ struct xenbus_watch hotplug_status_watch;
+ u8 have_hotplug_status_watch:1;
++
++ const char *hotplug_script;
+ };
+
+ static int connect_rings(struct backend_info *);
+@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev)
+ xenvif_disconnect(be->vif);
+ be->vif = NULL;
+ }
++ kfree(be->hotplug_script);
+ kfree(be);
+ dev_set_drvdata(&dev->dev, NULL);
+ return 0;
+@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev,
+ struct xenbus_transaction xbt;
+ int err;
+ int sg;
++ const char *script;
+ struct backend_info *be = kzalloc(sizeof(struct backend_info),
+ GFP_KERNEL);
+ if (!be) {
+@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev,
+ goto fail;
+ }
+
++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
++ if (IS_ERR(script)) {
++ err = PTR_ERR(script);
++ xenbus_dev_fatal(dev, err, "reading script");
++ goto fail;
++ }
++
++ be->hotplug_script = script;
++
+ err = xenbus_switch_state(dev, XenbusStateInitWait);
+ if (err)
+ goto fail;
+@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev,
+ struct kobj_uevent_env *env)
+ {
+ struct backend_info *be = dev_get_drvdata(&xdev->dev);
+- char *val;
+
+- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+- if (IS_ERR(val)) {
+- int err = PTR_ERR(val);
+- xenbus_dev_fatal(xdev, err, "reading script");
+- return err;
+- } else {
+- if (add_uevent_var(env, "script=%s", val)) {
+- kfree(val);
+- return -ENOMEM;
+- }
+- kfree(val);
+- }
++ if (!be)
++ return 0;
++
++ if (add_uevent_var(env, "script=%s", be->hotplug_script))
++ return -ENOMEM;
+
+- if (!be || !be->vif)
++ if (!be->vif)
+ return 0;
+
+ return add_uevent_var(env, "vif=%s", be->vif->dev->name);
+diff --git a/drivers/pci/hotplug.c b/drivers/pci/hotplug.c
+index 2b5352a7dffc..3b70f5c11df6 100644
+--- a/drivers/pci/hotplug.c
++++ b/drivers/pci/hotplug.c
+@@ -27,7 +27,7 @@ int pci_uevent(struct device *dev, struct kobj_uevent_env *env)
+ if (add_uevent_var(env, "PCI_SLOT_NAME=%s", pci_name(pdev)))
+ return -ENOMEM;
+
+- if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x",
++ if (add_uevent_var(env, "MODALIAS=pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X",
+ pdev->vendor, pdev->device,
+ pdev->subsystem_vendor, pdev->subsystem_device,
+ (u8)(pdev->class >> 16), (u8)(pdev->class >> 8),
+diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
+index d62ad0b1516d..868440f83939 100644
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -44,12 +44,10 @@ int no_pci_devices(void)
+ }
+ EXPORT_SYMBOL(no_pci_devices);
+
+-static struct pci_host_bridge *pci_host_bridge(struct pci_dev *dev)
++static struct pci_host_bridge *pci_host_bridge(struct pci_bus *bus)
+ {
+- struct pci_bus *bus;
+ struct pci_host_bridge *bridge;
+
+- bus = dev->bus;
+ while (bus->parent)
+ bus = bus->parent;
+
+@@ -66,10 +64,10 @@ static bool resource_contains(struct resource *res1, struct resource *res2)
+ return res1->start <= res2->start && res1->end >= res2->end;
+ }
+
+-void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
++void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
+ struct resource *res)
+ {
+- struct pci_host_bridge *bridge = pci_host_bridge(dev);
++ struct pci_host_bridge *bridge = pci_host_bridge(bus);
+ struct pci_host_bridge_window *window;
+ resource_size_t offset = 0;
+
+@@ -94,10 +92,10 @@ static bool region_contains(struct pci_bus_region *region1,
+ return region1->start <= region2->start && region1->end >= region2->end;
+ }
+
+-void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
++void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res,
+ struct pci_bus_region *region)
+ {
+- struct pci_host_bridge *bridge = pci_host_bridge(dev);
++ struct pci_host_bridge *bridge = pci_host_bridge(bus);
+ struct pci_host_bridge_window *window;
+ struct pci_bus_region bus_region;
+ resource_size_t offset = 0;
+@@ -298,11 +296,11 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+ pci_write_config_dword(dev, pos + 4, 0);
+ region.start = 0;
+ region.end = sz64;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ } else {
+ region.start = l64;
+ region.end = l64 + sz64;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n",
+ pos, res);
+ }
+@@ -314,7 +312,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
+
+ region.start = l;
+ region.end = l + sz;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+
+ dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
+ }
+@@ -373,7 +371,7 @@ static void __devinit pci_read_bridge_io(struct pci_bus *child)
+ res2.flags = res->flags;
+ region.start = base;
+ region.end = limit + 0xfff;
+- pcibios_bus_to_resource(dev, &res2, ®ion);
++ pcibios_bus_to_resource(dev->bus, &res2, ®ion);
+ if (!res->start)
+ res->start = res2.start;
+ if (!res->end)
+@@ -399,7 +397,7 @@ static void __devinit pci_read_bridge_mmio(struct pci_bus *child)
+ res->flags = (mem_base_lo & PCI_MEMORY_RANGE_TYPE_MASK) | IORESOURCE_MEM;
+ region.start = base;
+ region.end = limit + 0xfffff;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res);
+ }
+ }
+@@ -448,7 +446,7 @@ static void __devinit pci_read_bridge_mmio_pref(struct pci_bus *child)
+ res->flags |= IORESOURCE_MEM_64;
+ region.start = base;
+ region.end = limit + 0xfffff;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ dev_printk(KERN_DEBUG, &dev->dev, " bridge window %pR\n", res);
+ }
+ }
+@@ -1063,24 +1061,24 @@ int pci_setup_device(struct pci_dev *dev)
+ region.end = 0x1F7;
+ res = &dev->resource[0];
+ res->flags = LEGACY_IO_RESOURCE;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ region.start = 0x3F6;
+ region.end = 0x3F6;
+ res = &dev->resource[1];
+ res->flags = LEGACY_IO_RESOURCE;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+ if ((progif & 4) == 0) {
+ region.start = 0x170;
+ region.end = 0x177;
+ res = &dev->resource[2];
+ res->flags = LEGACY_IO_RESOURCE;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ region.start = 0x376;
+ region.end = 0x376;
+ res = &dev->resource[3];
+ res->flags = LEGACY_IO_RESOURCE;
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ }
+ }
+ break;
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index ffde183ac1b3..c0300242db86 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -393,7 +393,7 @@ static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
+ /* Convert from PCI bus to resource space. */
+ bus_region.start = res->start;
+ bus_region.end = res->end;
+- pcibios_bus_to_resource(dev, res, &bus_region);
++ pcibios_bus_to_resource(dev->bus, res, &bus_region);
+
+ if (pci_claim_resource(dev, nr) == 0)
+ dev_info(&dev->dev, "quirk: %pR claimed by %s\n",
+diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
+index 48ebdb237f3f..336b999a716d 100644
+--- a/drivers/pci/rom.c
++++ b/drivers/pci/rom.c
+@@ -31,7 +31,7 @@ int pci_enable_rom(struct pci_dev *pdev)
+ if (!res->flags)
+ return -1;
+
+- pcibios_resource_to_bus(pdev, ®ion, res);
++ pcibios_resource_to_bus(pdev->bus, ®ion, res);
+ pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr);
+ rom_addr &= ~PCI_ROM_ADDRESS_MASK;
+ rom_addr |= region.start | PCI_ROM_ADDRESS_ENABLE;
+@@ -69,6 +69,7 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
+ {
+ void __iomem *image;
+ int last_image;
++ unsigned length;
+
+ image = rom;
+ do {
+@@ -91,9 +92,9 @@ size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
+ if (readb(pds + 3) != 'R')
+ break;
+ last_image = readb(pds + 21) & 0x80;
+- /* this length is reliable */
+- image += readw(pds + 16) * 512;
+- } while (!last_image);
++ length = readw(pds + 16);
++ image += length * 512;
++ } while (length && !last_image);
+
+ /* never return a size larger than the PCI resource window */
+ /* there are known ROMs that get the size wrong */
+diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
+index 8fa2d4be88de..244ada411369 100644
+--- a/drivers/pci/setup-bus.c
++++ b/drivers/pci/setup-bus.c
+@@ -408,7 +408,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
+ bus->secondary, bus->subordinate);
+
+ res = bus->resource[0];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_IO) {
+ /*
+ * The IO resource is allocated a range twice as large as it
+@@ -422,7 +422,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
+ }
+
+ res = bus->resource[1];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_IO) {
+ dev_info(&bridge->dev, " bridge window %pR\n", res);
+ pci_write_config_dword(bridge, PCI_CB_IO_BASE_1,
+@@ -432,7 +432,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
+ }
+
+ res = bus->resource[2];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_MEM) {
+ dev_info(&bridge->dev, " bridge window %pR\n", res);
+ pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_0,
+@@ -442,7 +442,7 @@ void pci_setup_cardbus(struct pci_bus *bus)
+ }
+
+ res = bus->resource[3];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_MEM) {
+ dev_info(&bridge->dev, " bridge window %pR\n", res);
+ pci_write_config_dword(bridge, PCI_CB_MEMORY_BASE_1,
+@@ -473,7 +473,7 @@ static void pci_setup_bridge_io(struct pci_bus *bus)
+
+ /* Set up the top and bottom of the PCI I/O segment for this bus. */
+ res = bus->resource[0];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_IO) {
+ pci_read_config_dword(bridge, PCI_IO_BASE, &l);
+ l &= 0xffff0000;
+@@ -504,7 +504,7 @@ static void pci_setup_bridge_mmio(struct pci_bus *bus)
+
+ /* Set up the top and bottom of the PCI Memory segment for this bus. */
+ res = bus->resource[1];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_MEM) {
+ l = (region.start >> 16) & 0xfff0;
+ l |= region.end & 0xfff00000;
+@@ -530,7 +530,7 @@ static void pci_setup_bridge_mmio_pref(struct pci_bus *bus)
+ /* Set up PREF base/limit. */
+ bu = lu = 0;
+ res = bus->resource[2];
+- pcibios_resource_to_bus(bridge, ®ion, res);
++ pcibios_resource_to_bus(bridge->bus, ®ion, res);
+ if (res->flags & IORESOURCE_PREFETCH) {
+ l = (region.start >> 16) & 0xfff0;
+ l |= region.end & 0xfff00000;
+diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
+index be76ebacf486..d427277e43ec 100644
+--- a/drivers/pci/setup-res.c
++++ b/drivers/pci/setup-res.c
+@@ -50,7 +50,7 @@ void pci_update_resource(struct pci_dev *dev, int resno)
+ if (res->flags & IORESOURCE_PCI_FIXED)
+ return;
+
+- pcibios_resource_to_bus(dev, ®ion, res);
++ pcibios_resource_to_bus(dev->bus, ®ion, res);
+
+ new = region.start | (res->flags & PCI_REGION_FLAG_MASK);
+ if (res->flags & IORESOURCE_IO)
+diff --git a/drivers/pcmcia/i82092.c b/drivers/pcmcia/i82092.c
+index 4e8831bdb6ef..099034b39812 100644
+--- a/drivers/pcmcia/i82092.c
++++ b/drivers/pcmcia/i82092.c
+@@ -610,7 +610,7 @@ static int i82092aa_set_mem_map(struct pcmcia_socket *socket, struct pccard_mem_
+
+ enter("i82092aa_set_mem_map");
+
+- pcibios_resource_to_bus(sock_info->dev, ®ion, mem->res);
++ pcibios_resource_to_bus(sock_info->dev->bus, ®ion, mem->res);
+
+ map = mem->map;
+ if (map > 4) {
+diff --git a/drivers/pcmcia/yenta_socket.c b/drivers/pcmcia/yenta_socket.c
+index d07f9ac8c41d..13e76f9bdbcf 100644
+--- a/drivers/pcmcia/yenta_socket.c
++++ b/drivers/pcmcia/yenta_socket.c
+@@ -445,7 +445,7 @@ static int yenta_set_mem_map(struct pcmcia_socket *sock, struct pccard_mem_map *
+ unsigned int start, stop, card_start;
+ unsigned short word;
+
+- pcibios_resource_to_bus(socket->dev, ®ion, mem->res);
++ pcibios_resource_to_bus(socket->dev->bus, ®ion, mem->res);
+
+ map = mem->map;
+ start = region.start;
+@@ -709,7 +709,7 @@ static int yenta_allocate_res(struct yenta_socket *socket, int nr, unsigned type
+ region.start = config_readl(socket, addr_start) & mask;
+ region.end = config_readl(socket, addr_end) | ~mask;
+ if (region.start && region.end > region.start && !override_bios) {
+- pcibios_bus_to_resource(dev, res, ®ion);
++ pcibios_bus_to_resource(dev->bus, res, ®ion);
+ if (pci_claim_resource(dev, PCI_BRIDGE_RESOURCES + nr) == 0)
+ return 0;
+ dev_printk(KERN_INFO, &dev->dev,
+@@ -1033,7 +1033,7 @@ static void yenta_config_init(struct yenta_socket *socket)
+ struct pci_dev *dev = socket->dev;
+ struct pci_bus_region region;
+
+- pcibios_resource_to_bus(socket->dev, ®ion, &dev->resource[0]);
++ pcibios_resource_to_bus(socket->dev->bus, ®ion, &dev->resource[0]);
+
+ config_writel(socket, CB_LEGACY_MODE_BASE, 0);
+ config_writel(socket, PCI_BASE_ADDRESS_0, region.start);
+diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
+index 375756fa95cf..348560a0a4c8 100644
+--- a/drivers/scsi/be2iscsi/be_main.c
++++ b/drivers/scsi/be2iscsi/be_main.c
+@@ -424,7 +424,6 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev)
+ "iscsi_host_alloc failed\n");
+ return NULL;
+ }
+- shost->dma_boundary = pcidev->dma_mask;
+ shost->max_id = BE2_MAX_SESSIONS;
+ shost->max_channel = 0;
+ shost->max_cmd_len = BEISCSI_MAX_CMD_LEN;
+@@ -4399,9 +4398,9 @@ free_port:
+ hba_free:
+ if (phba->msix_enabled)
+ pci_disable_msix(phba->pcidev);
+- iscsi_host_remove(phba->shost);
+ pci_dev_put(phba->pcidev);
+ iscsi_host_free(phba->shost);
++ pci_set_drvdata(pcidev, NULL);
+ disable_pci:
+ pci_disable_device(pcidev);
+ return ret;
+diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
+index bc88cabcfd43..f5ccdcdf2cab 100644
+--- a/drivers/scsi/hpsa.c
++++ b/drivers/scsi/hpsa.c
+@@ -3507,10 +3507,6 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)
+
+ /* Save the PCI command register */
+ pci_read_config_word(pdev, 4, &command_register);
+- /* Turn the board off. This is so that later pci_restore_state()
+- * won't turn the board on before the rest of config space is ready.
+- */
+- pci_disable_device(pdev);
+ pci_save_state(pdev);
+
+ /* find the first memory BAR, so we can find the cfg table */
+@@ -3534,7 +3530,7 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)
+ }
+ rc = write_driver_ver_to_cfgtable(cfgtable);
+ if (rc)
+- goto unmap_vaddr;
++ goto unmap_cfgtable;
+
+ /* If reset via doorbell register is supported, use that.
+ * There are two such methods. Favor the newest method.
+@@ -3558,11 +3554,6 @@ static __devinit int hpsa_kdump_hard_reset_controller(struct pci_dev *pdev)
+ goto unmap_cfgtable;
+
+ pci_restore_state(pdev);
+- rc = pci_enable_device(pdev);
+- if (rc) {
+- dev_warn(&pdev->dev, "failed to enable device.\n");
+- goto unmap_cfgtable;
+- }
+ pci_write_config_word(pdev, 4, command_register);
+
+ /* Some devices (notably the HP Smart Array 5i Controller)
+@@ -4064,10 +4055,37 @@ static void __devinit hpsa_hba_inquiry(struct ctlr_info *h)
+ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev)
+ {
+ int rc, i;
++ void __iomem *vaddr;
+
+ if (!reset_devices)
+ return 0;
+
++ /* kdump kernel is loading, we don't know in which state is
++ * the pci interface. The dev->enable_cnt is equal zero
++ * so we call enable+disable, wait a while and switch it on.
++ */
++ rc = pci_enable_device(pdev);
++ if (rc) {
++ dev_warn(&pdev->dev, "Failed to enable PCI device\n");
++ return -ENODEV;
++ }
++ pci_disable_device(pdev);
++ msleep(260); /* a randomly chosen number */
++ rc = pci_enable_device(pdev);
++ if (rc) {
++ dev_warn(&pdev->dev, "failed to enable device.\n");
++ return -ENODEV;
++ }
++ pci_set_master(pdev);
++
++ vaddr = pci_ioremap_bar(pdev, 0);
++ if (vaddr == NULL) {
++ rc = -ENOMEM;
++ goto out_disable;
++ }
++ writel(SA5_INTR_OFF, vaddr + SA5_REPLY_INTR_MASK_OFFSET);
++ iounmap(vaddr);
++
+ /* Reset the controller with a PCI power-cycle or via doorbell */
+ rc = hpsa_kdump_hard_reset_controller(pdev);
+
+@@ -4076,10 +4094,11 @@ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev)
+ * "performant mode". Or, it might be 640x, which can't reset
+ * due to concerns about shared bbwc between 6402/6404 pair.
+ */
+- if (rc == -ENOTSUPP)
+- return rc; /* just try to do the kdump anyhow. */
+- if (rc)
+- return -ENODEV;
++ if (rc) {
++ if (rc != -ENOTSUPP) /* just try to do the kdump anyhow. */
++ rc = -ENODEV;
++ goto out_disable;
++ }
+
+ /* Now try to get the controller to respond to a no-op */
+ dev_warn(&pdev->dev, "Waiting for controller to respond to no-op\n");
+@@ -4090,7 +4109,11 @@ static __devinit int hpsa_init_reset_devices(struct pci_dev *pdev)
+ dev_warn(&pdev->dev, "no-op failed%s\n",
+ (i < 11 ? "; re-trying" : ""));
+ }
+- return 0;
++
++out_disable:
++
++ pci_disable_device(pdev);
++ return rc;
+ }
+
+ static __devinit int hpsa_allocate_cmd_pool(struct ctlr_info *h)
+@@ -4191,6 +4214,7 @@ static void hpsa_undo_allocations_after_kdump_soft_reset(struct ctlr_info *h)
+ iounmap(h->transtable);
+ if (h->cfgtable)
+ iounmap(h->cfgtable);
++ pci_disable_device(h->pdev);
+ pci_release_regions(h->pdev);
+ kfree(h);
+ }
+diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
+index 629a0865b130..5fbacde78d85 100644
+--- a/drivers/scsi/libsas/sas_discover.c
++++ b/drivers/scsi/libsas/sas_discover.c
+@@ -446,6 +446,7 @@ static void sas_revalidate_domain(struct work_struct *work)
+ struct sas_discovery_event *ev = to_sas_discovery_event(work);
+ struct asd_sas_port *port = ev->port;
+ struct sas_ha_struct *ha = port->ha;
++ struct domain_device *ddev = port->port_dev;
+
+ /* prevent revalidation from finding sata links in recovery */
+ mutex_lock(&ha->disco_mutex);
+@@ -460,8 +461,9 @@ static void sas_revalidate_domain(struct work_struct *work)
+ SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
+ task_pid_nr(current));
+
+- if (port->port_dev)
+- res = sas_ex_revalidate_domain(port->port_dev);
++ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
++ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
++ res = sas_ex_revalidate_domain(ddev);
+
+ SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
+ port->id, task_pid_nr(current), res);
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index ac99b46dc4a4..a30f7a06ee41 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -1209,9 +1209,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
+ "rejecting I/O to dead device\n");
+ ret = BLKPREP_KILL;
+ break;
+- case SDEV_QUIESCE:
+ case SDEV_BLOCK:
+ case SDEV_CREATED_BLOCK:
++ ret = BLKPREP_DEFER;
++ break;
++ case SDEV_QUIESCE:
+ /*
+ * If the devices is blocked we defer normal commands.
+ */
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index eacd46bb36b9..fb119ce06ae5 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -498,7 +498,7 @@ static ssize_t
+ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
+ {
+ sg_io_hdr_t *hp = &srp->header;
+- int err = 0;
++ int err = 0, err2;
+ int len;
+
+ if (count < SZ_SG_IO_HDR) {
+@@ -527,8 +527,8 @@ sg_new_read(Sg_fd * sfp, char __user *buf, size_t count, Sg_request * srp)
+ goto err_out;
+ }
+ err_out:
+- err = sg_finish_rem_req(srp);
+- return (0 == err) ? count : err;
++ err2 = sg_finish_rem_req(srp);
++ return err ? : err2 ? : count;
+ }
+
+ static ssize_t
+diff --git a/drivers/scsi/sym53c8xx_2/sym_glue.c b/drivers/scsi/sym53c8xx_2/sym_glue.c
+index 36d1ed7817eb..1e3d7891b72c 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_glue.c
++++ b/drivers/scsi/sym53c8xx_2/sym_glue.c
+@@ -1609,7 +1609,7 @@ sym_iomap_device(struct sym_device *device)
+ struct pci_bus_region bus_addr;
+ int i = 2;
+
+- pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[1]);
++ pcibios_resource_to_bus(pdev->bus, &bus_addr, &pdev->resource[1]);
+ device->mmio_base = bus_addr.start;
+
+ if (device->chip.features & FE_RAM) {
+@@ -1619,7 +1619,8 @@ sym_iomap_device(struct sym_device *device)
+ */
+ if (!pdev->resource[i].flags)
+ i++;
+- pcibios_resource_to_bus(pdev, &bus_addr, &pdev->resource[i]);
++ pcibios_resource_to_bus(pdev->bus, &bus_addr,
++ &pdev->resource[i]);
+ device->ram_base = bus_addr.start;
+ }
+
+diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
+index 830adbed1d7a..1556db966188 100644
+--- a/drivers/spi/spidev.c
++++ b/drivers/spi/spidev.c
+@@ -241,7 +241,10 @@ static int spidev_message(struct spidev_data *spidev,
+ k_tmp->len = u_tmp->len;
+
+ total += k_tmp->len;
+- if (total > bufsiz) {
++ /* Check total length of transfers. Also check each
++ * transfer length to avoid arithmetic overflow.
++ */
++ if (total > bufsiz || k_tmp->len > bufsiz) {
+ status = -EMSGSIZE;
+ goto done;
+ }
+diff --git a/drivers/staging/comedi/comedi_compat32.c b/drivers/staging/comedi/comedi_compat32.c
+index 41a7a62ba49a..a8a0c0f8b24c 100644
+--- a/drivers/staging/comedi/comedi_compat32.c
++++ b/drivers/staging/comedi/comedi_compat32.c
+@@ -271,7 +271,7 @@ static int compat_cmd(struct file *file, unsigned long arg)
+ {
+ struct comedi_cmd __user *cmd;
+ struct comedi32_cmd_struct __user *cmd32;
+- int rc;
++ int rc, err;
+
+ cmd32 = compat_ptr(arg);
+ cmd = compat_alloc_user_space(sizeof(*cmd));
+@@ -280,7 +280,15 @@ static int compat_cmd(struct file *file, unsigned long arg)
+ if (rc)
+ return rc;
+
+- return translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
++ rc = translated_ioctl(file, COMEDI_CMD, (unsigned long)cmd);
++ if (rc == -EAGAIN) {
++ /* Special case: copy cmd back to user. */
++ err = put_compat_cmd(cmd32, cmd);
++ if (err)
++ rc = err;
++ }
++
++ return rc;
+ }
+
+ /* Handle 32-bit COMEDI_CMDTEST ioctl. */
+diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
+index b8ec783e55e0..30033635317c 100644
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -1029,6 +1029,7 @@ unsigned char byPwrdBm = 0;
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ byPwr = pDevice->abyOFDMPwrTbl[uCH];
+ if (pDevice->byRFType == RF_UW2452) {
+diff --git a/drivers/target/iscsi/iscsi_target_tq.c b/drivers/target/iscsi/iscsi_target_tq.c
+index 977e1cf90e83..4f447fd39779 100644
+--- a/drivers/target/iscsi/iscsi_target_tq.c
++++ b/drivers/target/iscsi/iscsi_target_tq.c
+@@ -26,36 +26,22 @@
+ #include "iscsi_target_tq.h"
+ #include "iscsi_target.h"
+
+-static LIST_HEAD(active_ts_list);
+ static LIST_HEAD(inactive_ts_list);
+-static DEFINE_SPINLOCK(active_ts_lock);
+ static DEFINE_SPINLOCK(inactive_ts_lock);
+ static DEFINE_SPINLOCK(ts_bitmap_lock);
+
+-static void iscsi_add_ts_to_active_list(struct iscsi_thread_set *ts)
+-{
+- spin_lock(&active_ts_lock);
+- list_add_tail(&ts->ts_list, &active_ts_list);
+- iscsit_global->active_ts++;
+- spin_unlock(&active_ts_lock);
+-}
+-
+ extern void iscsi_add_ts_to_inactive_list(struct iscsi_thread_set *ts)
+ {
++ if (!list_empty(&ts->ts_list)) {
++ WARN_ON(1);
++ return;
++ }
+ spin_lock(&inactive_ts_lock);
+ list_add_tail(&ts->ts_list, &inactive_ts_list);
+ iscsit_global->inactive_ts++;
+ spin_unlock(&inactive_ts_lock);
+ }
+
+-static void iscsi_del_ts_from_active_list(struct iscsi_thread_set *ts)
+-{
+- spin_lock(&active_ts_lock);
+- list_del(&ts->ts_list);
+- iscsit_global->active_ts--;
+- spin_unlock(&active_ts_lock);
+-}
+-
+ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+ {
+ struct iscsi_thread_set *ts;
+@@ -69,7 +55,7 @@ static struct iscsi_thread_set *iscsi_get_ts_from_inactive_list(void)
+ list_for_each_entry(ts, &inactive_ts_list, ts_list)
+ break;
+
+- list_del(&ts->ts_list);
++ list_del_init(&ts->ts_list);
+ iscsit_global->inactive_ts--;
+ spin_unlock(&inactive_ts_lock);
+
+@@ -220,8 +206,6 @@ static void iscsi_deallocate_extra_thread_sets(void)
+
+ void iscsi_activate_thread_set(struct iscsi_conn *conn, struct iscsi_thread_set *ts)
+ {
+- iscsi_add_ts_to_active_list(ts);
+-
+ spin_lock_bh(&ts->ts_state_lock);
+ conn->thread_set = ts;
+ ts->conn = conn;
+@@ -424,7 +408,6 @@ struct iscsi_conn *iscsi_rx_thread_pre_handler(struct iscsi_thread_set *ts)
+
+ if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ spin_unlock_bh(&ts->ts_state_lock);
+- iscsi_del_ts_from_active_list(ts);
+
+ if (!iscsit_global->in_shutdown)
+ iscsi_deallocate_extra_thread_sets();
+@@ -477,7 +460,6 @@ struct iscsi_conn *iscsi_tx_thread_pre_handler(struct iscsi_thread_set *ts)
+
+ if (ts->delay_inactive && (--ts->thread_count == 0)) {
+ spin_unlock_bh(&ts->ts_state_lock);
+- iscsi_del_ts_from_active_list(ts);
+
+ if (!iscsit_global->in_shutdown)
+ iscsi_deallocate_extra_thread_sets();
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index d34577dbfd25..808267456eed 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -1165,7 +1165,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
+ struct pscsi_dev_virt *pdv = dev->dev_ptr;
+ struct scsi_device *sd = pdv->pdv_sd;
+
+- return sd->type;
++ return (sd) ? sd->type : TYPE_NO_LUN;
+ }
+
+ static sector_t pscsi_get_blocks(struct se_device *dev)
+diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
+index dc7c0db26e20..8d5cf53886e9 100644
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -330,7 +330,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ ep = fc_seq_exch(seq);
+ if (ep) {
+ lport = ep->lp;
+- if (lport && (ep->xid <= lport->lro_xid))
++ if (lport && (ep->xid <= lport->lro_xid)) {
+ /*
+ * "ddp_done" trigger invalidation of HW
+ * specific DDP context
+@@ -345,6 +345,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ * identified using ep->xid)
+ */
+ cmd->was_ddp_setup = 0;
++ }
+ }
+ }
+ }
+diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
+index cf9a1911d4ab..bc955d7a1d00 100644
+--- a/drivers/tty/pty.c
++++ b/drivers/tty/pty.c
+@@ -173,6 +173,9 @@ static int pty_signal(struct tty_struct *tty, int sig)
+ unsigned long flags;
+ struct pid *pgrp;
+
++ if (sig != SIGINT && sig != SIGQUIT && sig != SIGTSTP)
++ return -EINVAL;
++
+ if (tty->link) {
+ spin_lock_irqsave(&tty->link->ctrl_lock, flags);
+ pgrp = get_pid(tty->link->pgrp);
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index 6f8f985e7805..e4aada5b4954 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -67,7 +67,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
+ "Please send the output of lspci -vv, this\n"
+ "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
+ "manufacturer and name of serial board or\n"
+- "modem board to rmk+serial@arm.linux.org.uk.\n",
++ "modem board to <linux-serial@vger.kernel.org>.\n",
+ pci_name(dev), str, dev->vendor, dev->device,
+ dev->subsystem_vendor, dev->subsystem_device);
+ }
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index a07eb4c068a0..5f0b4a445b97 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -941,8 +941,8 @@ EXPORT_SYMBOL(start_tty);
+ /* We limit tty time update visibility to every 8 seconds or so. */
+ static void tty_update_time(struct timespec *time)
+ {
+- unsigned long sec = get_seconds() & ~7;
+- if ((long)(sec - time->tv_sec) > 0)
++ unsigned long sec = get_seconds();
++ if (abs(sec - time->tv_sec) & ~7)
+ time->tv_sec = sec;
+ }
+
+diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
+index f8d03da536dd..9ab33c729f02 100644
+--- a/drivers/tty/tty_ioctl.c
++++ b/drivers/tty/tty_ioctl.c
+@@ -153,11 +153,17 @@ void tty_wait_until_sent(struct tty_struct *tty, long timeout)
+ #endif
+ if (!timeout)
+ timeout = MAX_SCHEDULE_TIMEOUT;
++
+ if (wait_event_interruptible_timeout(tty->write_wait,
+- !tty_chars_in_buffer(tty), timeout) >= 0) {
+- if (tty->ops->wait_until_sent)
+- tty->ops->wait_until_sent(tty, timeout);
++ !tty_chars_in_buffer(tty), timeout) < 0) {
++ return;
+ }
++
++ if (timeout == MAX_SCHEDULE_TIMEOUT)
++ timeout = 0;
++
++ if (tty->ops->wait_until_sent)
++ tty->ops->wait_until_sent(tty, timeout);
+ }
+ EXPORT_SYMBOL(tty_wait_until_sent);
+
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 268294c71c11..334a7b279c49 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -498,6 +498,7 @@ void invert_screen(struct vc_data *vc, int offset, int count, int viewed)
+ #endif
+ if (DO_UPDATE(vc))
+ do_update_region(vc, (unsigned long) p, count);
++ notify_update(vc);
+ }
+
+ /* used by selection: complement pointer position */
+@@ -514,6 +515,7 @@ void complement_pos(struct vc_data *vc, int offset)
+ scr_writew(old, screenpos(vc, old_offset, 1));
+ if (DO_UPDATE(vc))
+ vc->vc_sw->con_putc(vc, old, oldy, oldx);
++ notify_update(vc);
+ }
+
+ old_offset = offset;
+@@ -531,8 +533,8 @@ void complement_pos(struct vc_data *vc, int offset)
+ oldy = (offset >> 1) / vc->vc_cols;
+ vc->vc_sw->con_putc(vc, new, oldy, oldx);
+ }
++ notify_update(vc);
+ }
+-
+ }
+
+ static void insert_char(struct vc_data *vc, unsigned int nr)
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 05325773ab94..25bc1d6e7d58 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1008,6 +1008,7 @@ static int acm_probe(struct usb_interface *intf,
+ unsigned long quirks;
+ int num_rx_buf;
+ int i;
++ unsigned int elength = 0;
+ int combined_interfaces = 0;
+
+ /* normal quirks */
+@@ -1043,6 +1044,12 @@ static int acm_probe(struct usb_interface *intf,
+ }
+
+ while (buflen > 0) {
++ elength = buffer[0];
++ if (!elength) {
++ dev_err(&intf->dev, "skipping garbage byte\n");
++ elength = 1;
++ goto next_desc;
++ }
+ if (buffer[1] != USB_DT_CS_INTERFACE) {
+ dev_err(&intf->dev, "skipping garbage\n");
+ goto next_desc;
+@@ -1050,6 +1057,8 @@ static int acm_probe(struct usb_interface *intf,
+
+ switch (buffer[2]) {
+ case USB_CDC_UNION_TYPE: /* we've found it */
++ if (elength < sizeof(struct usb_cdc_union_desc))
++ goto next_desc;
+ if (union_header) {
+ dev_err(&intf->dev, "More than one "
+ "union descriptor, skipping ...\n");
+@@ -1058,31 +1067,38 @@ static int acm_probe(struct usb_interface *intf,
+ union_header = (struct usb_cdc_union_desc *)buffer;
+ break;
+ case USB_CDC_COUNTRY_TYPE: /* export through sysfs*/
++ if (elength < sizeof(struct usb_cdc_country_functional_desc))
++ goto next_desc;
+ cfd = (struct usb_cdc_country_functional_desc *)buffer;
+ break;
+ case USB_CDC_HEADER_TYPE: /* maybe check version */
+ break; /* for now we ignore it */
+ case USB_CDC_ACM_TYPE:
++ if (elength < 4)
++ goto next_desc;
+ ac_management_function = buffer[3];
+ break;
+ case USB_CDC_CALL_MANAGEMENT_TYPE:
++ if (elength < 5)
++ goto next_desc;
+ call_management_function = buffer[3];
+ call_interface_num = buffer[4];
+ if ( (quirks & NOT_A_MODEM) == 0 && (call_management_function & 3) != 3)
+ dev_err(&intf->dev, "This device cannot do calls on its own. It is not a modem.\n");
+ break;
+ default:
+- /* there are LOTS more CDC descriptors that
++ /*
++ * there are LOTS more CDC descriptors that
+ * could legitimately be found here.
+ */
+ dev_dbg(&intf->dev, "Ignoring descriptor: "
+- "type %02x, length %d\n",
+- buffer[2], buffer[0]);
++ "type %02x, length %ud\n",
++ buffer[2], elength);
+ break;
+ }
+ next_desc:
+- buflen -= buffer[0];
+- buffer += buffer[0];
++ buflen -= elength;
++ buffer += elength;
+ }
+
+ if (!union_header) {
+diff --git a/drivers/usb/core/buffer.c b/drivers/usb/core/buffer.c
+index b0585e623ba9..19fa68a732f3 100644
+--- a/drivers/usb/core/buffer.c
++++ b/drivers/usb/core/buffer.c
+@@ -22,17 +22,25 @@
+ */
+
+ /* FIXME tune these based on pool statistics ... */
+-static const size_t pool_max[HCD_BUFFER_POOLS] = {
+- /* platforms without dma-friendly caches might need to
+- * prevent cacheline sharing...
+- */
+- 32,
+- 128,
+- 512,
+- PAGE_SIZE / 2
+- /* bigger --> allocate pages */
++static size_t pool_max[HCD_BUFFER_POOLS] = {
++ 32, 128, 512, 2048,
+ };
+
++void __init usb_init_pool_max(void)
++{
++ /*
++ * The pool_max values must never be smaller than
++ * ARCH_KMALLOC_MINALIGN.
++ */
++ if (ARCH_KMALLOC_MINALIGN <= 32)
++ ; /* Original value is okay */
++ else if (ARCH_KMALLOC_MINALIGN <= 64)
++ pool_max[0] = 64;
++ else if (ARCH_KMALLOC_MINALIGN <= 128)
++ pool_max[0] = 0; /* Don't use this pool */
++ else
++ BUILD_BUG(); /* We don't allow this */
++}
+
+ /* SETUP primitives */
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 371fe69caba6..d2ae3d94b58b 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -444,6 +444,7 @@ static void async_completed(struct urb *urb)
+ as->status = urb->status;
+ signr = as->signr;
+ if (signr) {
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.si_signo = as->signr;
+ sinfo.si_errno = as->status;
+ sinfo.si_code = SI_ASYNCIO;
+@@ -2091,6 +2092,7 @@ static void usbdev_remove(struct usb_device *udev)
+ wake_up_all(&ps->wait);
+ list_del_init(&ps->list);
+ if (ps->discsignr) {
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.si_signo = ps->discsignr;
+ sinfo.si_errno = EPIPE;
+ sinfo.si_code = SI_ASYNCIO;
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 35bc3baa8427..621ea00feeb6 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -1686,6 +1686,18 @@ static int autosuspend_check(struct usb_device *udev)
+ dev_dbg(&udev->dev, "remote wakeup needed for autosuspend\n");
+ return -EOPNOTSUPP;
+ }
++
++ /*
++ * If the device is a direct child of the root hub and the HCD
++ * doesn't handle wakeup requests, don't allow autosuspend when
++ * wakeup is needed.
++ */
++ if (w && udev->parent == udev->bus->root_hub &&
++ bus_to_hcd(udev->bus)->cant_recv_wakeups) {
++ dev_dbg(&udev->dev, "HCD doesn't handle wakeup requests\n");
++ return -EOPNOTSUPP;
++ }
++
+ udev->do_remote_wakeup = w;
+ return 0;
+ }
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index 6baeada782eb..f1d0e3ca46b5 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1528,6 +1528,7 @@ static int unlink1(struct usb_hcd *hcd, struct urb *urb, int status)
+ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ {
+ struct usb_hcd *hcd;
++ struct usb_device *udev = urb->dev;
+ int retval = -EIDRM;
+ unsigned long flags;
+
+@@ -1539,20 +1540,19 @@ int usb_hcd_unlink_urb (struct urb *urb, int status)
+ spin_lock_irqsave(&hcd_urb_unlink_lock, flags);
+ if (atomic_read(&urb->use_count) > 0) {
+ retval = 0;
+- usb_get_dev(urb->dev);
++ usb_get_dev(udev);
+ }
+ spin_unlock_irqrestore(&hcd_urb_unlink_lock, flags);
+ if (retval == 0) {
+ hcd = bus_to_hcd(urb->dev->bus);
+ retval = unlink1(hcd, urb, status);
+- usb_put_dev(urb->dev);
++ if (retval == 0)
++ retval = -EINPROGRESS;
++ else if (retval != -EIDRM && retval != -EBUSY)
++ dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",
++ urb, retval);
++ usb_put_dev(udev);
+ }
+-
+- if (retval == 0)
+- retval = -EINPROGRESS;
+- else if (retval != -EIDRM && retval != -EBUSY)
+- dev_dbg(&urb->dev->dev, "hcd_unlink_urb %p fail %d\n",
+- urb, retval);
+ return retval;
+ }
+
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index c74ba7bbc748..89669608d932 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -1010,6 +1010,7 @@ static int __init usb_init(void)
+ pr_info("%s: USB support disabled\n", usbcore_name);
+ return 0;
+ }
++ usb_init_pool_max();
+
+ retval = usb_debugfs_init();
+ if (retval)
+diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
+index d9eaaa3b3e44..093e9075deee 100644
+--- a/drivers/usb/gadget/inode.c
++++ b/drivers/usb/gadget/inode.c
+@@ -570,6 +570,7 @@ static ssize_t ep_aio_read_retry(struct kiocb *iocb)
+ break;
+ }
+ kfree(priv->buf);
++ kfree(priv->iv);
+ kfree(priv);
+ return len;
+ }
+@@ -591,6 +592,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
+ */
+ if (priv->iv == NULL || unlikely(req->actual == 0)) {
+ kfree(req->buf);
++ kfree(priv->iv);
+ kfree(priv);
+ iocb->private = NULL;
+ /* aio_complete() reports bytes-transferred _and_ faults */
+@@ -626,7 +628,7 @@ ep_aio_rwtail(
+ struct usb_request *req;
+ ssize_t value;
+
+- priv = kmalloc(sizeof *priv, GFP_KERNEL);
++ priv = kzalloc(sizeof *priv, GFP_KERNEL);
+ if (!priv) {
+ value = -ENOMEM;
+ fail:
+@@ -634,11 +636,19 @@ fail:
+ return value;
+ }
+ iocb->private = priv;
+- priv->iv = iv;
++ if (iv) {
++ priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
++ GFP_KERNEL);
++ if (!priv->iv) {
++ kfree(priv);
++ goto fail;
++ }
++ }
+ priv->nr_segs = nr_segs;
+
+ value = get_ready_ep(iocb->ki_filp->f_flags, epdata);
+ if (unlikely(value < 0)) {
++ kfree(priv->iv);
+ kfree(priv);
+ goto fail;
+ }
+@@ -672,6 +682,7 @@ fail:
+ mutex_unlock(&epdata->lock);
+
+ if (unlikely(value)) {
++ kfree(priv->iv);
+ kfree(priv);
+ put_ep(epdata);
+ } else
+diff --git a/drivers/usb/host/isp1760-hcd.c b/drivers/usb/host/isp1760-hcd.c
+index fc72d44bf787..949303f08557 100644
+--- a/drivers/usb/host/isp1760-hcd.c
++++ b/drivers/usb/host/isp1760-hcd.c
+@@ -2242,6 +2242,9 @@ struct usb_hcd *isp1760_register(phys_addr_t res_start, resource_size_t res_len,
+ hcd->rsrc_start = res_start;
+ hcd->rsrc_len = res_len;
+
++ /* This driver doesn't support wakeup requests */
++ hcd->cant_recv_wakeups = 1;
++
+ ret = usb_add_hcd(hcd, irq, irqflags);
+ if (ret)
+ goto err_unmap;
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 56ec28bff136..a6d4393668f5 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -383,6 +383,10 @@ static void xhci_clear_port_change_bit(struct xhci_hcd *xhci, u16 wValue,
+ status = PORT_PLC;
+ port_change_bit = "link state";
+ break;
++ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
++ status = PORT_CEC;
++ port_change_bit = "config error";
++ break;
+ default:
+ /* Should never happen */
+ return;
+@@ -617,6 +621,8 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((temp & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
++ if ((temp & PORT_CEC))
++ status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
+ }
+
+ if (hcd->speed != HCD_USB3) {
+@@ -904,6 +910,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ case USB_PORT_FEAT_C_OVER_CURRENT:
+ case USB_PORT_FEAT_C_ENABLE:
+ case USB_PORT_FEAT_C_PORT_LINK_STATE:
++ case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
+ xhci_clear_port_change_bit(xhci, wValue, wIndex,
+ port_array[wIndex], temp);
+ break;
+@@ -957,7 +964,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
+ */
+ status = bus_state->resuming_ports;
+
+- mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC;
++ mask = PORT_CSC | PORT_PEC | PORT_OCC | PORT_PLC | PORT_WRC | PORT_CEC;
+
+ spin_lock_irqsave(&xhci->lock, flags);
+ /* For each port, did anything change? If so, set that bit in buf. */
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index c9e39d453f6b..710b2e98b846 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -36,6 +36,9 @@
+
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
+ #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
++#define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
++#define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
+
+ static const char hcd_name[] = "xhci_hcd";
+
+@@ -102,6 +105,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ if (pdev->vendor == PCI_VENDOR_ID_AMD)
+ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL)
++ xhci->quirks |= XHCI_AVOID_BEI;
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
+ xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
+@@ -116,7 +121,12 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ * PPT chipsets.
+ */
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+- xhci->quirks |= XHCI_AVOID_BEI;
++ }
++ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
++ (pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI ||
++ pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI)) {
++ xhci->quirks |= XHCI_PME_STUCK_QUIRK;
+ }
+ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
+@@ -131,6 +141,21 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+ }
+
++/*
++ * Make sure PME works on some Intel xHCI controllers by writing 1 to clear
++ * the Internal PME flag bit in vendor specific PMCTRL register at offset 0x80a4
++ */
++static void xhci_pme_quirk(struct xhci_hcd *xhci)
++{
++ u32 val;
++ void __iomem *reg;
++
++ reg = (void __iomem *) xhci->cap_regs + 0x80a4;
++ val = readl(reg);
++ writel(val | BIT(28), reg);
++ readl(reg);
++}
++
+ /* called during probe() after chip reset completes */
+ static int xhci_pci_setup(struct usb_hcd *hcd)
+ {
+@@ -238,6 +263,9 @@ static int xhci_pci_suspend(struct usb_hcd *hcd, bool do_wakeup)
+ xhci->shared_hcd->state != HC_STATE_SUSPENDED)
+ return -EINVAL;
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_quirk(xhci);
++
+ retval = xhci_suspend(xhci, do_wakeup);
+
+ return retval;
+@@ -268,6 +296,9 @@ static int xhci_pci_resume(struct usb_hcd *hcd, bool hibernated)
+ if (usb_is_intel_switchable_xhci(pdev))
+ usb_enable_xhci_ports(pdev);
+
++ if (xhci->quirks & XHCI_PME_STUCK_QUIRK)
++ xhci_pme_quirk(xhci);
++
+ retval = xhci_resume(xhci, hibernated);
+ return retval;
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 950edebba8f1..e47a4e12b297 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2049,7 +2049,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ if (event_trb != ep_ring->dequeue) {
+ /* The event was for the status stage */
+ if (event_trb == td->last_trb) {
+- if (td->urb->actual_length != 0) {
++ if (td->urb_length_set) {
+ /* Don't overwrite a previously set error code
+ */
+ if ((*status == -EINPROGRESS || *status == 0) &&
+@@ -2063,7 +2063,13 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ td->urb->transfer_buffer_length;
+ }
+ } else {
+- /* Maybe the event was for the data stage? */
++ /*
++ * Maybe the event was for the data stage? If so, update
++ * already the actual_length of the URB and flag it as
++ * set, so that it is not overwritten in the event for
++ * the last TRB.
++ */
++ td->urb_length_set = true;
+ td->urb->actual_length =
+ td->urb->transfer_buffer_length -
+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6c8093509511..80b3d8559b09 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1,3 +1,4 @@
++
+ /*
+ * xHCI host controller driver
+ *
+@@ -88,9 +89,10 @@ struct xhci_cap_regs {
+ #define HCS_IST(p) (((p) >> 0) & 0xf)
+ /* bits 4:7, max number of Event Ring segments */
+ #define HCS_ERST_MAX(p) (((p) >> 4) & 0xf)
++/* bits 21:25 Hi 5 bits of Scratchpad buffers SW must allocate for the HW */
+ /* bit 26 Scratchpad restore - for save/restore HW state - not used yet */
+-/* bits 27:31 number of Scratchpad buffers SW must allocate for the HW */
+-#define HCS_MAX_SCRATCHPAD(p) (((p) >> 27) & 0x1f)
++/* bits 27:31 Lo 5 bits of Scratchpad buffers SW must allocate for the HW */
++#define HCS_MAX_SCRATCHPAD(p) ((((p) >> 16) & 0x3e0) | (((p) >> 27) & 0x1f))
+
+ /* HCSPARAMS3 - hcs_params3 - bitmasks */
+ /* bits 0:7, Max U1 to U0 latency for the roothub ports */
+@@ -1254,6 +1256,8 @@ struct xhci_td {
+ struct xhci_segment *start_seg;
+ union xhci_trb *first_trb;
+ union xhci_trb *last_trb;
++ /* actual_length of the URB has already been set */
++ bool urb_length_set;
+ };
+
+ /* xHCI command default timeout value */
+@@ -1511,6 +1515,7 @@ struct xhci_hcd {
+ #define XHCI_PLAT (1 << 16)
+ #define XHCI_SLOW_SUSPEND (1 << 17)
+ #define XHCI_SPURIOUS_WAKEUP (1 << 18)
++#define XHCI_PME_STUCK_QUIRK (1 << 20)
+ unsigned int num_active_eps;
+ unsigned int limit_active_eps;
+ /* There are two roothubs to keep track of bus suspend info for */
+diff --git a/drivers/usb/serial/bus.c b/drivers/usb/serial/bus.c
+index ed8adb052ca7..358d2d6d760a 100644
+--- a/drivers/usb/serial/bus.c
++++ b/drivers/usb/serial/bus.c
+@@ -52,6 +52,7 @@ static int usb_serial_device_probe(struct device *dev)
+ {
+ struct usb_serial_driver *driver;
+ struct usb_serial_port *port;
++ struct device *tty_dev;
+ int retval = 0;
+ int minor;
+
+@@ -71,12 +72,20 @@ static int usb_serial_device_probe(struct device *dev)
+ retval = device_create_file(dev, &dev_attr_port_number);
+ if (retval) {
+ if (driver->port_remove)
+- retval = driver->port_remove(port);
++ driver->port_remove(port);
+ goto exit;
+ }
+
+ minor = port->number;
+- tty_register_device(usb_serial_tty_driver, minor, dev);
++ tty_dev = tty_register_device(usb_serial_tty_driver, minor, dev);
++ if (IS_ERR(tty_dev)) {
++ retval = PTR_ERR(tty_dev);
++ device_remove_file(dev, &dev_attr_port_number);
++ if (driver->port_remove)
++ driver->port_remove(port);
++ goto exit;
++ }
++
+ dev_info(&port->serial->dev->dev,
+ "%s converter now attached to ttyUSB%d\n",
+ driver->description, minor);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 813793714bea..5c289fc2bc5a 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -63,6 +63,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x0846, 0x1100) }, /* NetGear Managed Switch M4100 series, M5300 series, M7100 series */
+ { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */
+ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */
++ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */
+ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */
+ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */
+ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
+@@ -152,6 +153,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x166A, 0x0305) }, /* Clipsal C-5000CT2 C-Bus Spectrum Colour Touchscreen */
+ { USB_DEVICE(0x166A, 0x0401) }, /* Clipsal L51xx C-Bus Architectural Dimmer */
+ { USB_DEVICE(0x166A, 0x0101) }, /* Clipsal 5560884 C-Bus Multi-room Audio Matrix Switcher */
++ { USB_DEVICE(0x16C0, 0x09B0) }, /* Lunatico Seletek */
++ { USB_DEVICE(0x16C0, 0x09B1) }, /* Lunatico Seletek */
+ { USB_DEVICE(0x16D6, 0x0001) }, /* Jablotron serial interface */
+ { USB_DEVICE(0x16DC, 0x0010) }, /* W-IE-NE-R Plein & Baus GmbH PL512 Power Supply */
+ { USB_DEVICE(0x16DC, 0x0011) }, /* W-IE-NE-R Plein & Baus GmbH RCM Remote Control for MARATON Power Supply */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 4bfcfa785823..06abee68cb4f 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -628,6 +628,7 @@ static struct usb_device_id id_table_combined [] = {
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
++ { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
+ /*
+ * ELV devices:
+ */
+@@ -823,6 +824,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_ELSTER_UNICOM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_JTAGCABLEII_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) },
++ { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID),
++ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+ { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID),
+@@ -1000,6 +1003,23 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
+ /* GE Healthcare devices */
+ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
++ /* Active Research (Actisense) devices */
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NDC_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
++ { USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_NMEA2000_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ETHERNET_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_WIFI_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_DISPLAY_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_LITE_PID) },
++ { USB_DEVICE(FTDI_VID, CHETCO_SEASMART_ANALOG_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+@@ -1930,8 +1950,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
+
+ dbg("%s", __func__);
+
+- if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
+- (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
++ if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
++ return ftdi_jtag_probe(serial);
++
++ if (udev->product &&
++ (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
++ !strcmp(udev->product, "SNAP Connect E10")))
+ return ftdi_jtag_probe(serial);
+
+ return 0;
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index ecb4dee48caf..105b9826d8d6 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -38,6 +38,9 @@
+
+ #define FTDI_LUMEL_PD12_PID 0x6002
+
++/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
++#define CYBER_CORTEX_AV_PID 0x8698
++
+ /*
+ * Marvell OpenRD Base, Client
+ * http://www.open-rd.org
+@@ -558,6 +561,12 @@
+ */
+ #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
+
++/*
++ * Synapse Wireless product ids (FTDI_VID)
++ * http://www.synapse-wireless.com
++ */
++#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
++
+
+ /********************************/
+ /** third-party VID/PID combos **/
+@@ -1432,3 +1441,23 @@
+ */
+ #define GE_HEALTHCARE_VID 0x1901
+ #define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
++
++/*
++ * Active Research (Actisense) devices
++ */
++#define ACTISENSE_NDC_PID 0xD9A8 /* NDC USB Serial Adapter */
++#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */
++#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */
++#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */
++#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */
++#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */
++#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */
++#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */
++#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */
++#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */
++#define CHETCO_SEASMART_NMEA2000_PID 0xA54A /* SeaSmart NMEA2000 Gateway */
++#define CHETCO_SEASMART_ETHERNET_PID 0xA54B /* SeaSmart Ethernet Gateway */
++#define CHETCO_SEASMART_WIFI_PID 0xA5AC /* SeaSmart Wifi Gateway */
++#define CHETCO_SEASMART_DISPLAY_PID 0xA5AD /* SeaSmart NMEA2000 Display */
++#define CHETCO_SEASMART_LITE_PID 0xA5AE /* SeaSmart Lite USB Adapter */
++#define CHETCO_SEASMART_ANALOG_PID 0xA5AF /* SeaSmart Analog Adapter */
+diff --git a/drivers/video/arkfb.c b/drivers/video/arkfb.c
+index 555dd4c64f5b..65196fe348e4 100644
+--- a/drivers/video/arkfb.c
++++ b/drivers/video/arkfb.c
+@@ -1014,7 +1014,7 @@ static int __devinit ark_pci_probe(struct pci_dev *dev, const struct pci_device_
+
+ vga_res.flags = IORESOURCE_IO;
+
+- pcibios_bus_to_resource(dev, &vga_res, &bus_reg);
++ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg);
+
+ par->state.vgabase = (void __iomem *) vga_res.start;
+
+diff --git a/drivers/video/s3fb.c b/drivers/video/s3fb.c
+index 2c80246b18b8..7b7af8c8706d 100644
+--- a/drivers/video/s3fb.c
++++ b/drivers/video/s3fb.c
+@@ -1172,7 +1172,7 @@ static int __devinit s3_pci_probe(struct pci_dev *dev, const struct pci_device_i
+
+ vga_res.flags = IORESOURCE_IO;
+
+- pcibios_bus_to_resource(dev, &vga_res, &bus_reg);
++ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg);
+
+ par->state.vgabase = (void __iomem *) vga_res.start;
+
+diff --git a/drivers/video/vt8623fb.c b/drivers/video/vt8623fb.c
+index 4e74d262cf3e..dfecf02fad37 100644
+--- a/drivers/video/vt8623fb.c
++++ b/drivers/video/vt8623fb.c
+@@ -727,7 +727,7 @@ static int __devinit vt8623_pci_probe(struct pci_dev *dev, const struct pci_devi
+
+ vga_res.flags = IORESOURCE_IO;
+
+- pcibios_bus_to_resource(dev, &vga_res, &bus_reg);
++ pcibios_bus_to_resource(dev->bus, &vga_res, &bus_reg);
+
+ par->state.vgabase = (void __iomem *) vga_res.start;
+
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 30d7be026c18..bb8cb697f65a 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+
+-static bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+ * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ * This means that some fields may still be read-only because
+ * they have entries in the config_field list that intercept
+ * the write and do nothing. */
+- if (dev_data->permissive || permissive) {
++ if (dev_data->permissive || xen_pcibk_permissive) {
+ switch (size) {
+ case 1:
+ err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index e56c934ad137..62461a8ba1d6 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,6 +64,8 @@ struct config_field_entry {
+ void *data;
+ };
+
++extern bool xen_pcibk_permissive;
++
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+
+ /* Add fields to a device - the add_fields macro expects to get a pointer to
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index 3daf862d739d..1667a9089a4a 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -9,6 +9,10 @@
+ #include "pciback.h"
+ #include "conf_space.h"
+
++struct pci_cmd_info {
++ u16 val;
++};
++
+ struct pci_bar_info {
+ u32 val;
+ u32 len_val;
+@@ -18,22 +22,36 @@ struct pci_bar_info {
+ #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
+ #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
+
+-static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
++/* Bits guests are allowed to control in permissive mode. */
++#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
++ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
++ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
++
++static void *command_init(struct pci_dev *dev, int offset)
+ {
+- int i;
+- int ret;
+-
+- ret = xen_pcibk_read_config_word(dev, offset, value, data);
+- if (!pci_is_enabled(dev))
+- return ret;
+-
+- for (i = 0; i < PCI_ROM_RESOURCE; i++) {
+- if (dev->resource[i].flags & IORESOURCE_IO)
+- *value |= PCI_COMMAND_IO;
+- if (dev->resource[i].flags & IORESOURCE_MEM)
+- *value |= PCI_COMMAND_MEMORY;
++ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
++ int err;
++
++ if (!cmd)
++ return ERR_PTR(-ENOMEM);
++
++ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
++ if (err) {
++ kfree(cmd);
++ return ERR_PTR(err);
+ }
+
++ return cmd;
++}
++
++static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
++{
++ int ret = pci_read_config_word(dev, offset, value);
++ const struct pci_cmd_info *cmd = data;
++
++ *value &= PCI_COMMAND_GUEST;
++ *value |= cmd->val & ~PCI_COMMAND_GUEST;
++
+ return ret;
+ }
+
+@@ -41,6 +59,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ {
+ struct xen_pcibk_dev_data *dev_data;
+ int err;
++ u16 val;
++ struct pci_cmd_info *cmd = data;
+
+ dev_data = pci_get_drvdata(dev);
+ if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
+@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+ }
+ }
+
++ cmd->val = value;
++
++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
++ return 0;
++
++ /* Only allow the guest to control certain bits. */
++ err = pci_read_config_word(dev, offset, &val);
++ if (err || val == value)
++ return err;
++
++ value &= PCI_COMMAND_GUEST;
++ value |= val & ~PCI_COMMAND_GUEST;
++
+ return pci_write_config_word(dev, offset, value);
+ }
+
+@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
+ {
+ .offset = PCI_COMMAND,
+ .size = 2,
++ .init = command_init,
++ .release = bar_release,
+ .u.w.read = command_read,
+ .u.w.write = command_write,
+ },
+diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
+index aa9103f8f01b..ace3eea163f0 100644
+--- a/fs/autofs4/dev-ioctl.c
++++ b/fs/autofs4/dev-ioctl.c
+@@ -95,7 +95,7 @@ static int check_dev_ioctl_version(int cmd, struct autofs_dev_ioctl *param)
+ */
+ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *in)
+ {
+- struct autofs_dev_ioctl tmp;
++ struct autofs_dev_ioctl tmp, *res;
+
+ if (copy_from_user(&tmp, in, sizeof(tmp)))
+ return ERR_PTR(-EFAULT);
+@@ -103,7 +103,14 @@ static struct autofs_dev_ioctl *copy_dev_ioctl(struct autofs_dev_ioctl __user *i
+ if (tmp.size < sizeof(tmp))
+ return ERR_PTR(-EINVAL);
+
+- return memdup_user(in, tmp.size);
++ if (tmp.size > (PATH_MAX + sizeof(tmp)))
++ return ERR_PTR(-ENAMETOOLONG);
++
++ res = memdup_user(in, tmp.size);
++ if (!IS_ERR(res))
++ res->size = tmp.size;
++
++ return res;
+ }
+
+ static inline void free_dev_ioctl(struct autofs_dev_ioctl *param)
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 0898d99b5f7b..f069765b5f79 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -1613,6 +1613,7 @@ refind_writable:
+ cifsFileInfo_put(inv_file);
+ spin_lock(&cifs_file_list_lock);
+ ++refind;
++ inv_file = NULL;
+ goto refind_writable;
+ }
+ }
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index 47d64e9282bf..7b65755114fe 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -238,10 +238,19 @@ static int debugfs_show_options(struct seq_file *m, struct dentry *root)
+ return 0;
+ }
+
++static void debugfs_evict_inode(struct inode *inode)
++{
++ truncate_inode_pages(&inode->i_data, 0);
++ end_writeback(inode);
++ if (S_ISLNK(inode->i_mode))
++ kfree(inode->i_private);
++}
++
+ static const struct super_operations debugfs_super_operations = {
+ .statfs = simple_statfs,
+ .remount_fs = debugfs_remount,
+ .show_options = debugfs_show_options,
++ .evict_inode = debugfs_evict_inode,
+ };
+
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+@@ -459,23 +468,14 @@ static int __debugfs_remove(struct dentry *dentry, struct dentry *parent)
+ int ret = 0;
+
+ if (debugfs_positive(dentry)) {
+- if (dentry->d_inode) {
+- dget(dentry);
+- switch (dentry->d_inode->i_mode & S_IFMT) {
+- case S_IFDIR:
+- ret = simple_rmdir(parent->d_inode, dentry);
+- break;
+- case S_IFLNK:
+- kfree(dentry->d_inode->i_private);
+- /* fall through */
+- default:
+- simple_unlink(parent->d_inode, dentry);
+- break;
+- }
+- if (!ret)
+- d_delete(dentry);
+- dput(dentry);
+- }
++ dget(dentry);
++ if (S_ISDIR(dentry->d_inode->i_mode))
++ ret = simple_rmdir(parent->d_inode, dentry);
++ else
++ simple_unlink(parent->d_inode, dentry);
++ if (!ret)
++ d_delete(dentry);
++ dput(dentry);
+ }
+ return ret;
+ }
+diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c
+index f04aa3303464..e33e0e49c18d 100644
+--- a/fs/ecryptfs/file.c
++++ b/fs/ecryptfs/file.c
+@@ -306,9 +306,22 @@ ecryptfs_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+
+ if (ecryptfs_file_to_private(file))
+ lower_file = ecryptfs_file_to_lower(file);
+- if (lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl)
++ if (!(lower_file && lower_file->f_op && lower_file->f_op->unlocked_ioctl))
++ return rc;
++
++ switch (cmd) {
++ case FITRIM:
++ case FS_IOC_GETFLAGS:
++ case FS_IOC_SETFLAGS:
++ case FS_IOC_GETVERSION:
++ case FS_IOC_SETVERSION:
+ rc = lower_file->f_op->unlocked_ioctl(lower_file, cmd, arg);
+- return rc;
++ fsstack_copy_attr_all(file->f_path.dentry->d_inode,
++ lower_file->f_path.dentry->d_inode);
++ return rc;
++ default:
++ return rc;
++ }
+ }
+
+ #ifdef CONFIG_COMPAT
+@@ -320,9 +333,22 @@ ecryptfs_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+
+ if (ecryptfs_file_to_private(file))
+ lower_file = ecryptfs_file_to_lower(file);
+- if (lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl)
++ if (!(lower_file && lower_file->f_op && lower_file->f_op->compat_ioctl))
++ return rc;
++
++ switch (cmd) {
++ case FITRIM:
++ case FS_IOC32_GETFLAGS:
++ case FS_IOC32_SETFLAGS:
++ case FS_IOC32_GETVERSION:
++ case FS_IOC32_SETVERSION:
+ rc = lower_file->f_op->compat_ioctl(lower_file, cmd, arg);
+- return rc;
++ fsstack_copy_attr_all(file->f_path.dentry->d_inode,
++ lower_file->f_path.dentry->d_inode);
++ return rc;
++ default:
++ return rc;
++ }
+ }
+ #endif
+
+diff --git a/fs/exec.c b/fs/exec.c
+index 5b9dfbe84b19..91d238fd1ea2 100644
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -1248,6 +1248,45 @@ void install_exec_creds(struct linux_binprm *bprm)
+ }
+ EXPORT_SYMBOL(install_exec_creds);
+
++static void bprm_fill_uid(struct linux_binprm *bprm)
++{
++ struct inode *inode;
++ unsigned int mode;
++ uid_t uid;
++ gid_t gid;
++
++ /* clear any previous set[ug]id data from a previous binary */
++ bprm->cred->euid = current_euid();
++ bprm->cred->egid = current_egid();
++
++ if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
++ return;
++
++ inode = bprm->file->f_path.dentry->d_inode;
++ mode = ACCESS_ONCE(inode->i_mode);
++ if (!(mode & (S_ISUID|S_ISGID)))
++ return;
++
++ /* Be careful if suid/sgid is set */
++ mutex_lock(&inode->i_mutex);
++
++ /* reload atomically mode/uid/gid now that lock held */
++ mode = inode->i_mode;
++ uid = inode->i_uid;
++ gid = inode->i_gid;
++ mutex_unlock(&inode->i_mutex);
++
++ if (mode & S_ISUID) {
++ bprm->per_clear |= PER_CLEAR_ON_SETID;
++ bprm->cred->euid = uid;
++ }
++
++ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
++ bprm->per_clear |= PER_CLEAR_ON_SETID;
++ bprm->cred->egid = gid;
++ }
++}
++
+ /*
+ * determine how safe it is to execute the proposed program
+ * - the caller must hold ->cred_guard_mutex to protect against
+@@ -1297,36 +1336,12 @@ static int check_unsafe_exec(struct linux_binprm *bprm)
+ */
+ int prepare_binprm(struct linux_binprm *bprm)
+ {
+- umode_t mode;
+- struct inode * inode = bprm->file->f_path.dentry->d_inode;
+ int retval;
+
+- mode = inode->i_mode;
+ if (bprm->file->f_op == NULL)
+ return -EACCES;
+
+- /* clear any previous set[ug]id data from a previous binary */
+- bprm->cred->euid = current_euid();
+- bprm->cred->egid = current_egid();
+-
+- if (!(bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)) {
+- /* Set-uid? */
+- if (mode & S_ISUID) {
+- bprm->per_clear |= PER_CLEAR_ON_SETID;
+- bprm->cred->euid = inode->i_uid;
+- }
+-
+- /* Set-gid? */
+- /*
+- * If setgid is set but no group execute bit then this
+- * is a candidate for mandatory locking, not a setgid
+- * executable.
+- */
+- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
+- bprm->per_clear |= PER_CLEAR_ON_SETID;
+- bprm->cred->egid = inode->i_gid;
+- }
+- }
++ bprm_fill_uid(bprm);
+
+ /* fill in binprm security blob */
+ retval = security_bprm_set_creds(bprm);
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index f4246cfc8d87..0949b833557e 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -717,8 +717,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
+
+ newpage = buf->page;
+
+- if (WARN_ON(!PageUptodate(newpage)))
+- return -EIO;
++ if (!PageUptodate(newpage))
++ SetPageUptodate(newpage);
+
+ ClearPageMappedToDisk(newpage);
+
+@@ -1634,6 +1634,9 @@ copy_finish:
+ static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
+ unsigned int size, struct fuse_copy_state *cs)
+ {
++ /* Don't try to move pages (yet) */
++ cs->move_pages = 0;
++
+ switch (code) {
+ case FUSE_NOTIFY_POLL:
+ return fuse_notify_poll(fc, size, cs);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index 2a734cfccc92..7429c409ec00 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -130,13 +130,16 @@ skip:
+ hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ hfs_bnode_dump(node);
+
+- if (new_node) {
+- /* update parent key if we inserted a key
+- * at the start of the first node
+- */
+- if (!rec && new_node != node)
+- hfs_brec_update_parent(fd);
++ /*
++ * update parent key if we inserted a key
++ * at the start of the node and it is not the new node
++ */
++ if (!rec && new_node != node) {
++ hfs_bnode_read_key(node, fd->search_key, data_off + size);
++ hfs_brec_update_parent(fd);
++ }
+
++ if (new_node) {
+ hfs_bnode_put(fd->bnode);
+ if (!new_node->parent) {
+ hfs_btree_inc_height(tree);
+@@ -166,9 +169,6 @@ skip:
+ goto again;
+ }
+
+- if (!rec)
+- hfs_brec_update_parent(fd);
+-
+ return 0;
+ }
+
+@@ -368,6 +368,8 @@ again:
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
+ __hfs_brec_find(parent, fd);
++ if (fd->record < 0)
++ return -ENOENT;
+ hfs_bnode_dump(parent);
+ rec = fd->record;
+
+diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c
+index 7654e87b0428..9ad5ba4b299b 100644
+--- a/fs/jffs2/scan.c
++++ b/fs/jffs2/scan.c
+@@ -510,6 +510,10 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
+ sumlen = c->sector_size - je32_to_cpu(sm->offset);
+ sumptr = buf + buf_size - sumlen;
+
++ /* sm->offset maybe wrong but MAGIC maybe right */
++ if (sumlen > c->sector_size)
++ goto full_scan;
++
+ /* Now, make sure the summary itself is available */
+ if (sumlen > buf_size) {
+ /* Need to kmalloc for this. */
+@@ -544,6 +548,7 @@ static int jffs2_scan_eraseblock (struct jffs2_sb_info *c, struct jffs2_eraseblo
+ }
+ }
+
++full_scan:
+ buf_ofs = jeb->offset;
+
+ if (!buf_size) {
+diff --git a/fs/namei.c b/fs/namei.c
+index 5974fb573f5a..bdcd70544fce 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -579,7 +579,8 @@ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *l
+ goto fail;
+
+ if (*link == '/') {
+- set_root(nd);
++ if (!nd->root.mnt)
++ set_root(nd);
+ path_put(&nd->path);
+ nd->path = nd->root;
+ path_get(&nd->root);
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 27c2969a9d02..3abfd5af9cb7 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -463,8 +463,10 @@ static __be32 decode_cb_sequence_args(struct svc_rqst *rqstp,
+
+ for (i = 0; i < args->csa_nrclists; i++) {
+ status = decode_rc_list(xdr, &args->csa_rclists[i]);
+- if (status)
++ if (status) {
++ args->csa_nrclists = i;
+ goto out_free;
++ }
+ }
+ }
+ status = 0;
+diff --git a/fs/nfs/delegation.c b/fs/nfs/delegation.c
+index 16d16e56cc39..62261deb0569 100644
+--- a/fs/nfs/delegation.c
++++ b/fs/nfs/delegation.c
+@@ -148,8 +148,8 @@ void nfs_inode_reclaim_delegation(struct inode *inode, struct rpc_cred *cred,
+ &delegation->flags);
+ NFS_I(inode)->delegation_state = delegation->type;
+ spin_unlock(&delegation->lock);
+- put_rpccred(oldcred);
+ rcu_read_unlock();
++ put_rpccred(oldcred);
+ } else {
+ /* We appear to have raced with a delegation return. */
+ spin_unlock(&delegation->lock);
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index b2e3ff347620..ecdbae19a766 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -31,6 +31,8 @@
+ #include "alloc.h"
+ #include "dat.h"
+
++static void __nilfs_btree_init(struct nilfs_bmap *bmap);
++
+ static struct nilfs_btree_path *nilfs_btree_alloc_path(void)
+ {
+ struct nilfs_btree_path *path;
+@@ -368,6 +370,34 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,
+ return ret;
+ }
+
++/**
++ * nilfs_btree_root_broken - verify consistency of btree root node
++ * @node: btree root node to be examined
++ * @ino: inode number
++ *
++ * Return Value: If node is broken, 1 is returned. Otherwise, 0 is returned.
++ */
++static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
++ unsigned long ino)
++{
++ int level, flags, nchildren;
++ int ret = 0;
++
++ level = nilfs_btree_node_get_level(node);
++ flags = nilfs_btree_node_get_flags(node);
++ nchildren = nilfs_btree_node_get_nchildren(node);
++
++ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
++ level > NILFS_BTREE_LEVEL_MAX ||
++ nchildren < 0 ||
++ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
++ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
++ ino, level, flags, nchildren);
++ ret = 1;
++ }
++ return ret;
++}
++
+ int nilfs_btree_broken_node_block(struct buffer_head *bh)
+ {
+ int ret;
+@@ -1713,7 +1743,7 @@ nilfs_btree_commit_convert_and_insert(struct nilfs_bmap *btree,
+
+ /* convert and insert */
+ dat = NILFS_BMAP_USE_VBN(btree) ? nilfs_bmap_get_dat(btree) : NULL;
+- nilfs_btree_init(btree);
++ __nilfs_btree_init(btree);
+ if (nreq != NULL) {
+ nilfs_bmap_commit_alloc_ptr(btree, dreq, dat);
+ nilfs_bmap_commit_alloc_ptr(btree, nreq, dat);
+@@ -2294,12 +2324,23 @@ static const struct nilfs_bmap_operations nilfs_btree_ops_gc = {
+ .bop_gather_data = NULL,
+ };
+
+-int nilfs_btree_init(struct nilfs_bmap *bmap)
++static void __nilfs_btree_init(struct nilfs_bmap *bmap)
+ {
+ bmap->b_ops = &nilfs_btree_ops;
+ bmap->b_nchildren_per_block =
+ NILFS_BTREE_NODE_NCHILDREN_MAX(nilfs_btree_node_size(bmap));
+- return 0;
++}
++
++int nilfs_btree_init(struct nilfs_bmap *bmap)
++{
++ int ret = 0;
++
++ __nilfs_btree_init(bmap);
++
++ if (nilfs_btree_root_broken(nilfs_btree_get_root(bmap),
++ bmap->b_inode->i_ino))
++ ret = -EIO;
++ return ret;
+ }
+
+ void nilfs_btree_init_gc(struct nilfs_bmap *bmap)
+diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
+index 8021098ff507..dc799343e825 100644
+--- a/fs/ocfs2/file.c
++++ b/fs/ocfs2/file.c
+@@ -2387,10 +2387,14 @@ out_dio:
+ /* buffered aio wouldn't have proper lock coverage today */
+ BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
+
++ if (unlikely(written <= 0))
++ goto no_sync;
++
+ if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
+ ((file->f_flags & O_DIRECT) && !direct_io)) {
+- ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawrite_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ if (ret < 0)
+ written = ret;
+
+@@ -2403,10 +2407,12 @@ out_dio:
+ }
+
+ if (!ret)
+- ret = filemap_fdatawait_range(file->f_mapping, *ppos,
+- *ppos + count - 1);
++ ret = filemap_fdatawait_range(file->f_mapping,
++ iocb->ki_pos - written,
++ iocb->ki_pos - 1);
+ }
+
++no_sync:
+ /*
+ * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
+ * function pointer which is called when o_direct io completes so that
+@@ -2468,9 +2474,7 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
+ struct address_space *mapping = out->f_mapping;
+ struct inode *inode = mapping->host;
+ struct splice_desc sd = {
+- .total_len = len,
+ .flags = flags,
+- .pos = *ppos,
+ .u.file = out,
+ };
+
+@@ -2480,6 +2484,12 @@ static ssize_t ocfs2_file_splice_write(struct pipe_inode_info *pipe,
+ out->f_path.dentry->d_name.len,
+ out->f_path.dentry->d_name.name, len);
+
++ ret = generic_write_checks(out, ppos, &len, 0);
++ if (ret)
++ return ret;
++ sd.total_len = len;
++ sd.pos = *ppos;
++
+ if (pipe->inode)
+ mutex_lock_nested(&pipe->inode->i_mutex, I_MUTEX_PARENT);
+
+diff --git a/fs/splice.c b/fs/splice.c
+index bed6a3c29355..67c5210e7ce7 100644
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -991,13 +991,17 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out,
+ struct address_space *mapping = out->f_mapping;
+ struct inode *inode = mapping->host;
+ struct splice_desc sd = {
+- .total_len = len,
+ .flags = flags,
+- .pos = *ppos,
+ .u.file = out,
+ };
+ ssize_t ret;
+
++ ret = generic_write_checks(out, ppos, &len, S_ISBLK(inode->i_mode));
++ if (ret)
++ return ret;
++ sd.total_len = len;
++ sd.pos = *ppos;
++
+ pipe_lock(pipe);
+
+ splice_from_pipe_begin(&sd);
+diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
+index 4053cbd4490e..ddce23d5fc28 100644
+--- a/include/linux/blk_types.h
++++ b/include/linux/blk_types.h
+@@ -144,7 +144,9 @@ enum rq_flag_bits {
+ __REQ_ELVPRIV, /* elevator private data attached */
+ __REQ_FAILED, /* set if the request failed */
+ __REQ_QUIET, /* don't worry about errors */
+- __REQ_PREEMPT, /* set for "ide_preempt" requests */
++ __REQ_PREEMPT, /* set for "ide_preempt" requests and also
++ for requests for which the SCSI "quiesce"
++ state must be ignored. */
+ __REQ_ALLOCED, /* request came from our alloc pool */
+ __REQ_COPY_USER, /* contains copies of user pages */
+ __REQ_FLUSH_SEQ, /* request for flush sequence */
+diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h
+index a6dfe6944564..fac26cbae59b 100644
+--- a/include/linux/fsnotify.h
++++ b/include/linux/fsnotify.h
+@@ -101,8 +101,10 @@ static inline void fsnotify_move(struct inode *old_dir, struct inode *new_dir,
+ new_dir_mask |= FS_ISDIR;
+ }
+
+- fsnotify(old_dir, old_dir_mask, old_dir, FSNOTIFY_EVENT_INODE, old_name, fs_cookie);
+- fsnotify(new_dir, new_dir_mask, new_dir, FSNOTIFY_EVENT_INODE, new_name, fs_cookie);
++ fsnotify(old_dir, old_dir_mask, source, FSNOTIFY_EVENT_INODE, old_name,
++ fs_cookie);
++ fsnotify(new_dir, new_dir_mask, source, FSNOTIFY_EVENT_INODE, new_name,
++ fs_cookie);
+
+ if (target)
+ fsnotify_link_count(target);
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index e444f5b49118..469c9536c5e5 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -648,9 +648,9 @@ void pci_fixup_cardbus(struct pci_bus *);
+
+ /* Generic PCI functions used internally */
+
+-void pcibios_resource_to_bus(struct pci_dev *dev, struct pci_bus_region *region,
++void pcibios_resource_to_bus(struct pci_bus *bus, struct pci_bus_region *region,
+ struct resource *res);
+-void pcibios_bus_to_resource(struct pci_dev *dev, struct resource *res,
++void pcibios_bus_to_resource(struct pci_bus *bus, struct resource *res,
+ struct pci_bus_region *region);
+ void pcibios_scan_specific_bus(int busn);
+ extern struct pci_bus *pci_find_bus(int domain, int busnr);
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 815cc4b12c4a..feb77716a90f 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -126,6 +126,7 @@ struct usb_hcd {
+ unsigned wireless:1; /* Wireless USB HCD */
+ unsigned authorized_default:1;
+ unsigned has_tt:1; /* Integrated TT in root hub */
++ unsigned cant_recv_wakeups:1;
+
+ unsigned int irq; /* irq allocated */
+ void __iomem *regs; /* device memory/io */
+@@ -399,6 +400,7 @@ extern const struct dev_pm_ops usb_hcd_pci_pm_ops;
+ #endif /* CONFIG_PCI */
+
+ /* pci-ish (pdev null is ok) buffer alloc/mapping support */
++void usb_init_pool_max(void);
+ int hcd_buffer_create(struct usb_hcd *hcd);
+ void hcd_buffer_destroy(struct usb_hcd *hcd);
+
+diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
+index 67b847dfa2bb..d1342c2514d3 100644
+--- a/kernel/debug/kdb/kdb_main.c
++++ b/kernel/debug/kdb/kdb_main.c
+@@ -2598,7 +2598,7 @@ static int kdb_summary(int argc, const char **argv)
+ #define K(x) ((x) << (PAGE_SHIFT - 10))
+ kdb_printf("\nMemTotal: %8lu kB\nMemFree: %8lu kB\n"
+ "Buffers: %8lu kB\n",
+- val.totalram, val.freeram, val.bufferram);
++ K(val.totalram), K(val.freeram), K(val.bufferram));
+ return 0;
+ }
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 04662972802a..461b6e0007b1 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -3877,6 +3877,13 @@ static void perf_pending_event(struct irq_work *entry)
+ {
+ struct perf_event *event = container_of(entry,
+ struct perf_event, pending);
++ int rctx;
++
++ rctx = perf_swevent_get_recursion_context();
++ /*
++ * If we 'fail' here, that's OK, it means recursion is already disabled
++ * and we won't recurse 'further'.
++ */
+
+ if (event->pending_disable) {
+ event->pending_disable = 0;
+@@ -3887,6 +3894,9 @@ static void perf_pending_event(struct irq_work *entry)
+ event->pending_wakeup = 0;
+ perf_event_wakeup(event);
+ }
++
++ if (rctx >= 0)
++ perf_swevent_put_recursion_context(rctx);
+ }
+
+ /*
+diff --git a/kernel/printk.c b/kernel/printk.c
+index 544c0215939a..cb72d9c406cd 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -126,7 +126,7 @@ static struct console *exclusive_console;
+ */
+ struct console_cmdline
+ {
+- char name[8]; /* Name of the driver */
++ char name[16]; /* Name of the driver */
+ int index; /* Minor dev. to use */
+ char *options; /* Options for the driver */
+ #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
+@@ -1498,6 +1498,7 @@ void register_console(struct console *newcon)
+ */
+ for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
+ i++) {
++ BUILD_BUG_ON(sizeof(console_cmdline[i].name) != sizeof(newcon->name));
+ if (strcmp(console_cmdline[i].name, newcon->name) != 0)
+ continue;
+ if (newcon->index >= 0 &&
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 5701cb9a673f..2f8363e0a1ec 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -4031,10 +4031,13 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
+ if (running)
+ p->sched_class->put_prev_task(rq, p);
+
+- if (rt_prio(prio))
++ if (rt_prio(prio)) {
+ p->sched_class = &rt_sched_class;
+- else
++ } else {
++ if (rt_prio(oldprio))
++ p->rt.timeout = 0;
+ p->sched_class = &fair_sched_class;
++ }
+
+ p->prio = prio;
+
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 671f9594e368..5cc401e6d3b4 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip)
+ EXPORT_SYMBOL(local_bh_enable_ip);
+
+ /*
+- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+- * and we fall back to softirqd after that.
++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
++ * but break the loop if need_resched() is set or after 2 ms.
++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
++ * certain cases, such as stop_machine(), jiffies may cease to
++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
++ * well to make sure we eventually return from this method.
+ *
+- * This number has been established via experimentation.
++ * These limits have been established via experimentation.
+ * The two things to balance is latency against fairness -
+ * we want to handle softirqs as soon as possible, but they
+ * should not be able to lock up the box.
+ */
++#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2)
+ #define MAX_SOFTIRQ_RESTART 10
+
+ asmlinkage void __do_softirq(void)
+ {
+ struct softirq_action *h;
+ __u32 pending;
+- int max_restart = MAX_SOFTIRQ_RESTART;
++ unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
+ int cpu;
++ int max_restart = MAX_SOFTIRQ_RESTART;
+
+ pending = local_softirq_pending();
+ account_system_vtime(current);
+@@ -255,11 +261,13 @@ restart:
+ local_irq_disable();
+
+ pending = local_softirq_pending();
+- if (pending && --max_restart)
+- goto restart;
++ if (pending) {
++ if (time_before(jiffies, end) && !need_resched() &&
++ --max_restart)
++ goto restart;
+
+- if (pending)
+ wakeup_softirqd();
++ }
+
+ lockdep_softirq_exit();
+
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 5b6bd45bc58b..ffea326b1bc5 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1014,6 +1014,12 @@ ftrace_filter_lseek(struct file *file, loff_t offset, int whence)
+ return ret;
+ }
+
++#ifdef CONFIG_FUNCTION_GRAPH_TRACER
++static int ftrace_graph_active;
++#else
++# define ftrace_graph_active 0
++#endif
++
+ #ifdef CONFIG_DYNAMIC_FTRACE
+
+ #ifndef CONFIG_FTRACE_MCOUNT_RECORD
+@@ -2056,24 +2062,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
+
+ static void ftrace_startup_sysctl(void)
+ {
++ int command;
++
+ if (unlikely(ftrace_disabled))
+ return;
+
+ /* Force update next time */
+ saved_ftrace_func = NULL;
+ /* ftrace_start_up is true if we want ftrace running */
+- if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_UPDATE_CALLS);
++ if (ftrace_start_up) {
++ command = FTRACE_UPDATE_CALLS;
++ if (ftrace_graph_active)
++ command |= FTRACE_START_FUNC_RET;
++ ftrace_startup_enable(command);
++ }
+ }
+
+ static void ftrace_shutdown_sysctl(void)
+ {
++ int command;
++
+ if (unlikely(ftrace_disabled))
+ return;
+
+ /* ftrace_start_up is true if ftrace is running */
+- if (ftrace_start_up)
+- ftrace_run_update_code(FTRACE_DISABLE_CALLS);
++ if (ftrace_start_up) {
++ command = FTRACE_DISABLE_CALLS;
++ if (ftrace_graph_active)
++ command |= FTRACE_STOP_FUNC_RET;
++ ftrace_run_update_code(command);
++ }
+ }
+
+ static cycle_t ftrace_update_time;
+@@ -4445,12 +4463,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+
+ if (ftrace_enabled) {
+
+- ftrace_startup_sysctl();
+-
+ /* we are starting ftrace again */
+ if (ftrace_ops_list != &ftrace_list_end)
+ update_ftrace_function();
+
++ ftrace_startup_sysctl();
++
+ } else {
+ /* stopping ftrace calls (just send to ftrace_stub) */
+ ftrace_trace_function = ftrace_stub;
+@@ -4465,7 +4483,6 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
+
+ #ifdef CONFIG_FUNCTION_GRAPH_TRACER
+
+-static int ftrace_graph_active;
+ static struct notifier_block ftrace_suspend_notifier;
+
+ int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index efd682099a0a..bc36e280ce8b 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2401,9 +2401,10 @@ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
+ continue;
+
+ /*
+- * HWPoisoned hugepage is already unmapped and dropped reference
++ * Migrating hugepage or HWPoisoned hugepage is already
++ * unmapped and its refcount is dropped
+ */
+- if (unlikely(is_hugetlb_entry_hwpoisoned(pte)))
++ if (unlikely(!pte_present(pte)))
+ continue;
+
+ page = pte_page(pte);
+@@ -2813,6 +2814,7 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ struct page *pagecache_page = NULL;
+ static DEFINE_MUTEX(hugetlb_instantiation_mutex);
+ struct hstate *h = hstate_vma(vma);
++ int need_wait_lock = 0;
+
+ address &= huge_page_mask(h);
+
+@@ -2846,6 +2848,16 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ ret = 0;
+
+ /*
++ * entry could be a migration/hwpoison entry at this point, so this
++ * check prevents the kernel from going below assuming that we have
++ * a active hugepage in pagecache. This goto expects the 2nd page fault,
++ * and is_hugetlb_entry_(migration|hwpoisoned) check will properly
++ * handle it.
++ */
++ if (!pte_present(entry))
++ goto out_mutex;
++
++ /*
+ * If we are going to COW the mapping later, we examine the pending
+ * reservations for this page now. This will ensure that any
+ * allocations necessary to record that reservation occur outside the
+@@ -2864,29 +2876,32 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ vma, address);
+ }
+
++ spin_lock(&mm->page_table_lock);
++
++ /* Check for a racing update before calling hugetlb_cow */
++ if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
++ goto out_page_table_lock;
++
+ /*
+ * hugetlb_cow() requires page locks of pte_page(entry) and
+ * pagecache_page, so here we need take the former one
+ * when page != pagecache_page or !pagecache_page.
+- * Note that locking order is always pagecache_page -> page,
+- * so no worry about deadlock.
+ */
+ page = pte_page(entry);
+- get_page(page);
+ if (page != pagecache_page)
+- lock_page(page);
++ if (!trylock_page(page)) {
++ need_wait_lock = 1;
++ goto out_page_table_lock;
++ }
+
+- spin_lock(&mm->page_table_lock);
+- /* Check for a racing update before calling hugetlb_cow */
+- if (unlikely(!pte_same(entry, huge_ptep_get(ptep))))
+- goto out_page_table_lock;
++ get_page(page);
+
+
+ if (flags & FAULT_FLAG_WRITE) {
+ if (!pte_write(entry)) {
+ ret = hugetlb_cow(mm, vma, address, ptep, entry,
+ pagecache_page);
+- goto out_page_table_lock;
++ goto out_put_page;
+ }
+ entry = pte_mkdirty(entry);
+ }
+@@ -2895,6 +2910,10 @@ int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ flags & FAULT_FLAG_WRITE))
+ update_mmu_cache(vma, address, ptep);
+
++out_put_page:
++ if (page != pagecache_page)
++ unlock_page(page);
++ put_page(page);
+ out_page_table_lock:
+ spin_unlock(&mm->page_table_lock);
+
+@@ -3034,7 +3053,22 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
+ continue;
+ if (huge_pmd_unshare(mm, &address, ptep))
+ continue;
+- if (!huge_pte_none(huge_ptep_get(ptep))) {
++ pte = huge_ptep_get(ptep);
++ if (unlikely(is_hugetlb_entry_hwpoisoned(pte)))
++ continue;
++ if (unlikely(is_hugetlb_entry_migration(pte))) {
++ swp_entry_t entry = pte_to_swp_entry(pte);
++
++ if (is_write_migration_entry(entry)) {
++ pte_t newpte;
++
++ make_migration_entry_read(&entry);
++ newpte = swp_entry_to_pte(entry);
++ set_huge_pte_at(mm, address, ptep, newpte);
++ }
++ continue;
++ }
++ if (!huge_pte_none(pte)) {
+ pte = huge_ptep_get_and_clear(mm, address, ptep);
+ pte = pte_mkhuge(pte_modify(pte, newprot));
+ set_huge_pte_at(mm, address, ptep, pte);
+diff --git a/mm/memory.c b/mm/memory.c
+index 45cd14f0c7bf..02aef93416f2 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3845,7 +3845,7 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+ if (follow_phys(vma, addr, write, &prot, &phys_addr))
+ return -EINVAL;
+
+- maddr = ioremap_prot(phys_addr, PAGE_SIZE, prot);
++ maddr = ioremap_prot(phys_addr, PAGE_ALIGN(len + offset), prot);
+ if (write)
+ memcpy_toio(maddr + offset, buf, len);
+ else
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 208e70f1006d..cb6456d35860 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -112,7 +112,7 @@ struct percpu_counter vm_committed_as ____cacheline_aligned_in_smp;
+ */
+ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
+ {
+- unsigned long free, allowed;
++ long free, allowed;
+
+ vm_acct_memory(pages);
+
+diff --git a/mm/nommu.c b/mm/nommu.c
+index d3afb4765c8a..3f282f9cc13f 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -1916,7 +1916,7 @@ EXPORT_SYMBOL(unmap_mapping_range);
+ */
+ int __vm_enough_memory(struct mm_struct *mm, long pages, int cap_sys_admin)
+ {
+- unsigned long free, allowed;
++ long free, allowed;
+
+ vm_acct_memory(pages);
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 057884c2b4d9..ecd1c4c4207c 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -716,7 +716,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ * scale global setpoint to bdi's:
+ * bdi_setpoint = setpoint * bdi_thresh / thresh
+ */
+- x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++ x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ bdi_setpoint = setpoint * (u64)x >> 16;
+ /*
+ * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -766,8 +766,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
+ * bw * elapsed + write_bandwidth * (period - elapsed)
+ * write_bandwidth = ---------------------------------------------------
+ * period
++ *
++ * @written may have decreased due to account_page_redirty().
++ * Avoid underflowing @bw calculation.
+ */
+- bw = written - bdi->written_stamp;
++ bw = written - min(written, bdi->written_stamp);
+ bw *= HZ;
+ if (unlikely(elapsed > period)) {
+ do_div(bw, elapsed);
+@@ -831,7 +834,7 @@ static void global_update_bandwidth(unsigned long thresh,
+ unsigned long now)
+ {
+ static DEFINE_SPINLOCK(dirty_lock);
+- static unsigned long update_time;
++ static unsigned long update_time = INITIAL_JIFFIES;
+
+ /*
+ * check locklessly first to optimize away locking for the most time
+diff --git a/mm/slub.c b/mm/slub.c
+index 54ac6e90a1fa..aff06374dd5c 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1882,18 +1882,24 @@ redo:
+ /* Unfreeze all the cpu partial slabs */
+ static void unfreeze_partials(struct kmem_cache *s)
+ {
+- struct kmem_cache_node *n = NULL;
++ struct kmem_cache_node *n = NULL, *n2 = NULL;
+ struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
+ struct page *page, *discard_page = NULL;
+
+ while ((page = c->partial)) {
+- enum slab_modes { M_PARTIAL, M_FREE };
+- enum slab_modes l, m;
+ struct page new;
+ struct page old;
+
+ c->partial = page->next;
+- l = M_FREE;
++
++ n2 = get_node(s, page_to_nid(page));
++ if (n != n2) {
++ if (n)
++ spin_unlock(&n->list_lock);
++
++ n = n2;
++ spin_lock(&n->list_lock);
++ }
+
+ do {
+
+@@ -1906,43 +1912,17 @@ static void unfreeze_partials(struct kmem_cache *s)
+
+ new.frozen = 0;
+
+- if (!new.inuse && (!n || n->nr_partial > s->min_partial))
+- m = M_FREE;
+- else {
+- struct kmem_cache_node *n2 = get_node(s,
+- page_to_nid(page));
+-
+- m = M_PARTIAL;
+- if (n != n2) {
+- if (n)
+- spin_unlock(&n->list_lock);
+-
+- n = n2;
+- spin_lock(&n->list_lock);
+- }
+- }
+-
+- if (l != m) {
+- if (l == M_PARTIAL) {
+- remove_partial(n, page);
+- stat(s, FREE_REMOVE_PARTIAL);
+- } else {
+- add_partial(n, page,
+- DEACTIVATE_TO_TAIL);
+- stat(s, FREE_ADD_PARTIAL);
+- }
+-
+- l = m;
+- }
+-
+ } while (!cmpxchg_double_slab(s, page,
+ old.freelist, old.counters,
+ new.freelist, new.counters,
+ "unfreezing slab"));
+
+- if (m == M_FREE) {
++ if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
+ page->next = discard_page;
+ discard_page = page;
++ } else {
++ add_partial(n, page, DEACTIVATE_TO_TAIL);
++ stat(s, FREE_ADD_PARTIAL);
+ }
+ }
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 0ce2ad0696da..7d9dff2227d1 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -244,6 +244,9 @@ int can_send(struct sk_buff *skb, int loop)
+ }
+
+ skb->protocol = htons(ETH_P_CAN);
++ skb->ip_summed = CHECKSUM_UNNECESSARY;
++
++ skb_reset_mac_header(skb);
+ skb_reset_network_header(skb);
+ skb_reset_transport_header(skb);
+
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 3cd37e9d91a6..43c6dd8da602 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1144,14 +1144,10 @@ static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
+ };
+
+ static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
+- [IFLA_VF_MAC] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_mac) },
+- [IFLA_VF_VLAN] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_vlan) },
+- [IFLA_VF_TX_RATE] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_tx_rate) },
+- [IFLA_VF_SPOOFCHK] = { .type = NLA_BINARY,
+- .len = sizeof(struct ifla_vf_spoofchk) },
++ [IFLA_VF_MAC] = { .len = sizeof(struct ifla_vf_mac) },
++ [IFLA_VF_VLAN] = { .len = sizeof(struct ifla_vf_vlan) },
++ [IFLA_VF_TX_RATE] = { .len = sizeof(struct ifla_vf_tx_rate) },
++ [IFLA_VF_SPOOFCHK] = { .len = sizeof(struct ifla_vf_spoofchk) },
+ };
+
+ static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
+@@ -1698,10 +1694,10 @@ static int rtnl_group_changelink(struct net *net, int group,
+ struct ifinfomsg *ifm,
+ struct nlattr **tb)
+ {
+- struct net_device *dev;
++ struct net_device *dev, *aux;
+ int err;
+
+- for_each_netdev(net, dev) {
++ for_each_netdev_safe(net, dev, aux) {
+ if (dev->group == group) {
+ err = do_setlink(dev, ifm, tb, NULL, 0);
+ if (err < 0)
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index c8643a3d2658..4cfba3d5ad2c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -95,7 +95,7 @@ static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
+ u32 *p = NULL;
+
+ if (!(rt->dst.flags & DST_HOST))
+- return NULL;
++ return dst_cow_metrics_generic(dst, old);
+
+ if (!rt->rt6i_peer)
+ rt6_bind_peer(rt, 1);
+diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
+index 6b9d5a0e42f9..20fec0d90049 100644
+--- a/net/irda/ircomm/ircomm_tty.c
++++ b/net/irda/ircomm/ircomm_tty.c
+@@ -843,7 +843,9 @@ static void ircomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
+ orig_jiffies = jiffies;
+
+ /* Set poll time to 200 ms */
+- poll_time = IRDA_MIN(timeout, msecs_to_jiffies(200));
++ poll_time = msecs_to_jiffies(200);
++ if (timeout)
++ poll_time = min_t(unsigned long, timeout, poll_time);
+
+ spin_lock_irqsave(&self->spinlock, flags);
+ while (self->tx_skb && self->tx_skb->len) {
+diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
+index 64d3ce5ea1a0..df2b6ace510d 100644
+--- a/net/mac80211/agg-rx.c
++++ b/net/mac80211/agg-rx.c
+@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
+ container_of(h, struct tid_ampdu_rx, rcu_head);
+ int i;
+
+- del_timer_sync(&tid_rx->reorder_timer);
+-
+ for (i = 0; i < tid_rx->buf_size; i++)
+ dev_kfree_skb(tid_rx->reorder_buf[i]);
+ kfree(tid_rx->reorder_buf);
+@@ -94,6 +92,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+
+ del_timer_sync(&tid_rx->session_timer);
+
++ /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
++ spin_lock_bh(&tid_rx->reorder_lock);
++ tid_rx->removed = true;
++ spin_unlock_bh(&tid_rx->reorder_lock);
++ del_timer_sync(&tid_rx->reorder_timer);
++
+ call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
+ }
+
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index 226be1364ef3..ca07c5e76bfe 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -54,11 +54,25 @@ struct ieee80211_local;
+
+ #define TU_TO_EXP_TIME(x) (jiffies + usecs_to_jiffies((x) * 1024))
+
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+- (IEEE80211_WMM_IE_STA_QOSINFO_AC_BK | \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_BE | \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_VI | \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO)
++/*
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
++ */
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+
+ #define IEEE80211_DEFAULT_MAX_SP_LEN \
+ IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 24f2a4135edf..6202d0504122 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -668,9 +668,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
+
+ set_release_timer:
+
+- mod_timer(&tid_agg_rx->reorder_timer,
+- tid_agg_rx->reorder_time[j] + 1 +
+- HT_RX_REORDER_BUF_TIMEOUT);
++ if (!tid_agg_rx->removed)
++ mod_timer(&tid_agg_rx->reorder_timer,
++ tid_agg_rx->reorder_time[j] + 1 +
++ HT_RX_REORDER_BUF_TIMEOUT);
+ } else {
+ del_timer(&tid_agg_rx->reorder_timer);
+ }
+@@ -1926,6 +1927,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ hdr = (struct ieee80211_hdr *) skb->data;
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
++ if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++ return RX_DROP_MONITOR;
++
+ /* frame is in RMC, don't forward */
+ if (ieee80211_is_data(hdr->frame_control) &&
+ is_multicast_ether_addr(hdr->addr1) &&
+diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
+index 249f4d087936..4e6ece8d6f06 100644
+--- a/net/mac80211/sta_info.h
++++ b/net/mac80211/sta_info.h
+@@ -106,6 +106,7 @@ enum ieee80211_sta_info_flags {
+ * @buf_size: reorder buffer size at receiver
+ * @failed_bar_ssn: ssn of the last failed BAR tx attempt
+ * @bar_pending: BAR needs to be re-sent
++ * @removed: this session is removed (but might have been found due to RCU)
+ *
+ * This structure's lifetime is managed by RCU, assignments to
+ * the array holding it must hold the aggregation mutex.
+@@ -169,6 +170,7 @@ struct tid_ampdu_rx {
+ u16 buf_size;
+ u16 timeout;
+ u8 dialog_token;
++ bool removed;
+ };
+
+ /**
+diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
+index b7fc3dd4b8ef..f4f24bee99c2 100644
+--- a/net/mac80211/tx.c
++++ b/net/mac80211/tx.c
+@@ -544,9 +544,11 @@ ieee80211_tx_h_check_control_port_protocol(struct ieee80211_tx_data *tx)
+ {
+ struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+
+- if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol &&
+- tx->sdata->control_port_no_encrypt))
+- info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
++ if (unlikely(tx->sdata->control_port_protocol == tx->skb->protocol)) {
++ if (tx->sdata->control_port_no_encrypt)
++ info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
++ info->flags |= IEEE80211_TX_CTL_USE_MINRATE;
++ }
+
+ return TX_CONTINUE;
+ }
+diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c
+index e39f693dd3e4..fe3c8d7c83f7 100644
+--- a/net/netfilter/ipvs/ip_vs_ftp.c
++++ b/net/netfilter/ipvs/ip_vs_ftp.c
+@@ -183,6 +183,8 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ struct nf_conn *ct;
+ struct net *net;
+
++ *diff = 0;
++
+ #ifdef CONFIG_IP_VS_IPV6
+ /* This application helper doesn't work with IPv6 yet,
+ * so turn this into a no-op for IPv6 packets
+@@ -191,8 +193,6 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ return 1;
+ #endif
+
+- *diff = 0;
+-
+ /* Only useful for established sessions */
+ if (cp->state != IP_VS_TCP_S_ESTABLISHED)
+ return 1;
+@@ -318,6 +318,9 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ struct ip_vs_conn *n_cp;
+ struct net *net;
+
++ /* no diff required for incoming packets */
++ *diff = 0;
++
+ #ifdef CONFIG_IP_VS_IPV6
+ /* This application helper doesn't work with IPv6 yet,
+ * so turn this into a no-op for IPv6 packets
+@@ -326,9 +329,6 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
+ return 1;
+ #endif
+
+- /* no diff required for incoming packets */
+- *diff = 0;
+-
+ /* Only useful for established sessions */
+ if (cp->state != IP_VS_TCP_S_ESTABLISHED)
+ return 1;
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 8a0d6d6889f0..6a5555c5d2b7 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -763,6 +763,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
+ IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
+ return;
+ }
++ if (!(flags & IP_VS_CONN_F_TEMPLATE))
++ kfree(param->pe_data);
+ } else if (!cp->dest) {
+ dest = ip_vs_try_bind_dest(cp);
+ if (dest)
+@@ -1064,6 +1066,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
+ (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
+ );
+ #endif
++ ip_vs_pe_put(param.pe);
+ return 0;
+ /* Error exit */
+ out:
+diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
+index ce60cf0f6c11..9139a2642b9c 100644
+--- a/net/netfilter/nf_queue.c
++++ b/net/netfilter/nf_queue.c
+@@ -255,7 +255,7 @@ int nf_queue(struct sk_buff *skb,
+ * returned by nf_queue. For instance, callers rely on -ECANCELED to mean
+ * 'ignore this hook'.
+ */
+- if (IS_ERR(segs))
++ if (IS_ERR_OR_NULL(segs))
+ goto out_err;
+ queued = 0;
+ err = 0;
+diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
+index 72bb07f57f97..eb5086cc8515 100644
+--- a/net/netfilter/xt_socket.c
++++ b/net/netfilter/xt_socket.c
+@@ -205,12 +205,13 @@ static int
+ extract_icmp6_fields(const struct sk_buff *skb,
+ unsigned int outside_hdrlen,
+ int *protocol,
+- struct in6_addr **raddr,
+- struct in6_addr **laddr,
++ const struct in6_addr **raddr,
++ const struct in6_addr **laddr,
+ __be16 *rport,
+- __be16 *lport)
++ __be16 *lport,
++ struct ipv6hdr *ipv6_var)
+ {
+- struct ipv6hdr *inside_iph, _inside_iph;
++ const struct ipv6hdr *inside_iph;
+ struct icmp6hdr *icmph, _icmph;
+ __be16 *ports, _ports[2];
+ u8 inside_nexthdr;
+@@ -225,12 +226,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
+ if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
+ return 1;
+
+- inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
++ inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
++ sizeof(*ipv6_var), ipv6_var);
+ if (inside_iph == NULL)
+ return 1;
+ inside_nexthdr = inside_iph->nexthdr;
+
+- inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
++ inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
++ sizeof(*ipv6_var),
+ &inside_nexthdr, &inside_fragoff);
+ if (inside_hdrlen < 0)
+ return 1; /* hjm: Packet has no/incomplete transport layer headers. */
+@@ -258,10 +261,10 @@ extract_icmp6_fields(const struct sk_buff *skb,
+ static bool
+ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
+ {
+- struct ipv6hdr *iph = ipv6_hdr(skb);
++ struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
+ struct udphdr _hdr, *hp = NULL;
+ struct sock *sk;
+- struct in6_addr *daddr, *saddr;
++ const struct in6_addr *daddr, *saddr;
+ __be16 dport, sport;
+ int thoff, tproto;
+ const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
+@@ -285,7 +288,7 @@ socket_mt6_v1(const struct sk_buff *skb, struct xt_action_param *par)
+
+ } else if (tproto == IPPROTO_ICMPV6) {
+ if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
+- &sport, &dport))
++ &sport, &dport, &ipv6_var))
+ return false;
+ } else {
+ return false;
+diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
+index e66341ec455c..a92d635e0780 100644
+--- a/net/openvswitch/datapath.c
++++ b/net/openvswitch/datapath.c
+@@ -269,8 +269,10 @@ static int queue_gso_packets(int dp_ifindex, struct sk_buff *skb,
+ int err;
+
+ segs = skb_gso_segment(skb, NETIF_F_SG | NETIF_F_HW_CSUM);
+- if (IS_ERR(skb))
+- return PTR_ERR(skb);
++ if (IS_ERR(segs))
++ return PTR_ERR(segs);
++ if (segs == NULL)
++ return -EINVAL;
+
+ /* Queue all of the segments. */
+ skb = segs;
+diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
+index 76cb304f3f1a..af4dd9e1fe8f 100644
+--- a/net/sunrpc/cache.c
++++ b/net/sunrpc/cache.c
+@@ -911,7 +911,7 @@ static unsigned int cache_poll(struct file *filp, poll_table *wait,
+ poll_wait(filp, &queue_wait, wait);
+
+ /* alway allow write */
+- mask = POLL_OUT | POLLWRNORM;
++ mask = POLLOUT | POLLWRNORM;
+
+ if (!rp)
+ return mask;
+diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
+index 745973b729af..5547bd8e6f42 100644
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -485,7 +485,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
+ if (rc) {
+ dprintk("RPC: %s: ib_query_device failed %d\n",
+ __func__, rc);
+- goto out2;
++ goto out3;
+ }
+
+ if (devattr.device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) {
+@@ -587,7 +587,7 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
+ printk(KERN_ERR "%s: invalid memory registration mode %d\n",
+ __func__, memreg);
+ rc = -EINVAL;
+- goto out2;
++ goto out3;
+ }
+ dprintk("RPC: %s: memory registration strategy is %d\n",
+ __func__, memreg);
+@@ -596,6 +596,10 @@ rpcrdma_ia_open(struct rpcrdma_xprt *xprt, struct sockaddr *addr, int memreg)
+ ia->ri_memreg_strategy = memreg;
+
+ return 0;
++
++out3:
++ ib_dealloc_pd(ia->ri_pd);
++ ia->ri_pd = NULL;
+ out2:
+ rdma_destroy_id(ia->ri_id);
+ ia->ri_id = NULL;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 63c18079683a..263cbd81bbe6 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -2810,6 +2810,14 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
+ if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
+ return -EINVAL;
+
++ /* HT requires QoS, but if we don't have that just ignore HT/VHT
++ * as userspace might just pass through the capabilities from the IEs
++ * directly, rather than enforcing this restriction and returning an
++ * error in this case.
++ */
++ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
++ params.ht_capa = NULL;
++
+ switch (dev->ieee80211_ptr->iftype) {
+ case NL80211_IFTYPE_AP:
+ case NL80211_IFTYPE_AP_VLAN:
+diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
+index 95a338c89f99..11dd2fbd476f 100644
+--- a/net/xfrm/xfrm_output.c
++++ b/net/xfrm/xfrm_output.c
+@@ -151,6 +151,8 @@ static int xfrm_output_gso(struct sk_buff *skb)
+ kfree_skb(skb);
+ if (IS_ERR(segs))
+ return PTR_ERR(segs);
++ if (segs == NULL)
++ return -EINVAL;
+
+ do {
+ struct sk_buff *nskb = segs->next;
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 0a9891e7ba94..3bf90453d794 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ goto out;
+
+ /* No partial writes. */
+- length = EINVAL;
++ length = -EINVAL;
+ if (*ppos != 0)
+ goto out;
+
+diff --git a/security/smack/smack.h b/security/smack/smack.h
+index 4ede719922ed..cde4cc1d26d0 100644
+--- a/security/smack/smack.h
++++ b/security/smack/smack.h
+@@ -298,6 +298,16 @@ static inline char *smk_of_current(void)
+ return smk_of_task(current_security());
+ }
+
++static inline char *smk_of_task_struct(const struct task_struct *t)
++{
++ char *skp;
++
++ rcu_read_lock();
++ skp = smk_of_task(__task_cred(t)->security);
++ rcu_read_unlock();
++ return skp;
++}
++
+ /*
+ * logging functions
+ */
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 45c32f074166..82df24d19a9f 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -41,8 +41,6 @@
+ #include <linux/binfmts.h>
+ #include "smack.h"
+
+-#define task_security(task) (task_cred_xxx((task), security))
+-
+ #define TRANS_TRUE "TRUE"
+ #define TRANS_TRUE_SIZE 4
+
+@@ -164,7 +162,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode)
+ if (rc != 0)
+ return rc;
+
+- tsp = smk_of_task(task_security(ctp));
++ tsp = smk_of_task_struct(ctp);
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, ctp);
+
+@@ -190,7 +188,7 @@ static int smack_ptrace_traceme(struct task_struct *ptp)
+ if (rc != 0)
+ return rc;
+
+- tsp = smk_of_task(task_security(ptp));
++ tsp = smk_of_task_struct(ptp);
+ smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, ptp);
+
+@@ -1518,7 +1516,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access,
+
+ smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
+ smk_ad_setfield_u_tsk(&ad, p);
+- return smk_curacc(smk_of_task(task_security(p)), access, &ad);
++ return smk_curacc(smk_of_task_struct(p), access, &ad);
+ }
+
+ /**
+@@ -1564,7 +1562,7 @@ static int smack_task_getsid(struct task_struct *p)
+ */
+ static void smack_task_getsecid(struct task_struct *p, u32 *secid)
+ {
+- *secid = smack_to_secid(smk_of_task(task_security(p)));
++ *secid = smack_to_secid(smk_of_task_struct(p));
+ }
+
+ /**
+@@ -1676,7 +1674,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
+ * can write the receiver.
+ */
+ if (secid == 0)
+- return smk_curacc(smk_of_task(task_security(p)), MAY_WRITE,
++ return smk_curacc(smk_of_task_struct(p), MAY_WRITE,
+ &ad);
+ /*
+ * If the secid isn't 0 we're dealing with some USB IO
+@@ -1684,7 +1682,7 @@ static int smack_task_kill(struct task_struct *p, struct siginfo *info,
+ * we can't take privilege into account.
+ */
+ return smk_access(smack_from_secid(secid),
+- smk_of_task(task_security(p)), MAY_WRITE, &ad);
++ smk_of_task_struct(p), MAY_WRITE, &ad);
+ }
+
+ /**
+@@ -1697,9 +1695,13 @@ static int smack_task_wait(struct task_struct *p)
+ {
+ struct smk_audit_info ad;
+ char *sp = smk_of_current();
+- char *tsp = smk_of_forked(task_security(p));
++ char *tsp;
+ int rc;
+
++ rcu_read_lock();
++ tsp = smk_of_forked(__task_cred(p)->security);
++ rcu_read_unlock();
++
+ /* we don't log here, we can be overriden */
+ rc = smk_access(tsp, sp, MAY_WRITE, NULL);
+ if (rc == 0)
+@@ -1736,7 +1738,7 @@ static int smack_task_wait(struct task_struct *p)
+ static void smack_task_to_inode(struct task_struct *p, struct inode *inode)
+ {
+ struct inode_smack *isp = inode->i_security;
+- isp->smk_inode = smk_of_task(task_security(p));
++ isp->smk_inode = smk_of_task_struct(p);
+ }
+
+ /*
+@@ -2719,7 +2721,7 @@ static int smack_getprocattr(struct task_struct *p, char *name, char **value)
+ if (strcmp(name, "current") != 0)
+ return -EINVAL;
+
+- cp = kstrdup(smk_of_task(task_security(p)), GFP_KERNEL);
++ cp = kstrdup(smk_of_task_struct(p), GFP_KERNEL);
+ if (cp == NULL)
+ return -ENOMEM;
+
+diff --git a/sound/core/control.c b/sound/core/control.c
+index e773d5ed1e9a..8fb4d24b920d 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1164,6 +1164,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+
+ if (info->count < 1)
+ return -EINVAL;
++ if (!*info->id.name)
++ return -EINVAL;
++ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
++ return -EINVAL;
+ access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
+ (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
+ SNDRV_CTL_ELEM_ACCESS_INACTIVE|
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index 3a907935fa09..65195a1b3da6 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -1382,6 +1382,8 @@ static int snd_pcm_do_drain_init(struct snd_pcm_substream *substream, int state)
+ if (! snd_pcm_playback_empty(substream)) {
+ snd_pcm_do_start(substream, SNDRV_PCM_STATE_DRAINING);
+ snd_pcm_post_start(substream, SNDRV_PCM_STATE_DRAINING);
++ } else {
++ runtime->status->state = SNDRV_PCM_STATE_SETUP;
+ }
+ break;
+ case SNDRV_PCM_STATE_RUNNING:
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 9461a004f08b..b16a37f633c5 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -759,7 +759,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
+ {
+ /* We currently only handle front, HP */
+ static hda_nid_t pins[] = {
+- 0x0f, 0x10, 0x14, 0x15, 0
++ 0x0f, 0x10, 0x14, 0x15, 0x17, 0
+ };
+ hda_nid_t *p;
+ for (p = pins; *p; p++)
+diff --git a/sound/pci/riptide/riptide.c b/sound/pci/riptide/riptide.c
+index 0481d94aac9b..c1cdd02d09ad 100644
+--- a/sound/pci/riptide/riptide.c
++++ b/sound/pci/riptide/riptide.c
+@@ -2026,32 +2026,43 @@ snd_riptide_joystick_probe(struct pci_dev *pci, const struct pci_device_id *id)
+ {
+ static int dev;
+ struct gameport *gameport;
++ int ret;
+
+ if (dev >= SNDRV_CARDS)
+ return -ENODEV;
++
+ if (!enable[dev]) {
+- dev++;
+- return -ENOENT;
++ ret = -ENOENT;
++ goto inc_dev;
+ }
+
+- if (!joystick_port[dev++])
+- return 0;
++ if (!joystick_port[dev]) {
++ ret = 0;
++ goto inc_dev;
++ }
+
+ gameport = gameport_allocate_port();
+- if (!gameport)
+- return -ENOMEM;
++ if (!gameport) {
++ ret = -ENOMEM;
++ goto inc_dev;
++ }
+ if (!request_region(joystick_port[dev], 8, "Riptide gameport")) {
+ snd_printk(KERN_WARNING
+ "Riptide: cannot grab gameport 0x%x\n",
+ joystick_port[dev]);
+ gameport_free_port(gameport);
+- return -EBUSY;
++ ret = -EBUSY;
++ goto inc_dev;
+ }
+
+ gameport->io = joystick_port[dev];
+ gameport_register_port(gameport);
+ pci_set_drvdata(pci, gameport);
+- return 0;
++
++ ret = 0;
++inc_dev:
++ dev++;
++ return ret;
+ }
+
+ static void __devexit snd_riptide_joystick_remove(struct pci_dev *pci)
+diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
+index bc030a2088da..85d7f55eb99a 100644
+--- a/sound/pci/rme9652/hdspm.c
++++ b/sound/pci/rme9652/hdspm.c
+@@ -5968,6 +5968,9 @@ static int snd_hdspm_playback_open(struct snd_pcm_substream *substream)
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
+@@ -6042,6 +6045,9 @@ static int snd_hdspm_capture_open(struct snd_pcm_substream *substream)
+ snd_pcm_hw_constraint_minmax(runtime,
+ SNDRV_PCM_HW_PARAM_PERIOD_SIZE,
+ 64, 8192);
++ snd_pcm_hw_constraint_minmax(runtime,
++ SNDRV_PCM_HW_PARAM_PERIODS,
++ 2, 2);
+ break;
+ }
+
+diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
+index ebd7b37b902b..81e0e2732318 100644
+--- a/sound/soc/codecs/adav80x.c
++++ b/sound/soc/codecs/adav80x.c
+@@ -307,7 +307,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+- unsigned int deemph = ucontrol->value.enumerated.item[0];
++ unsigned int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -323,7 +323,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = adav80x->deemph;
++ ucontrol->value.integer.value[0] = adav80x->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
+index c4d165a4bddf..e1773e0c193f 100644
+--- a/sound/soc/codecs/ak4641.c
++++ b/sound/soc/codecs/ak4641.c
+@@ -74,7 +74,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -90,7 +90,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = ak4641->deemph;
++ ucontrol->value.integer.value[0] = ak4641->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index bf7141280a74..f9e2bdaf91f1 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -261,7 +261,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = cs4271->deemph;
++ ucontrol->value.integer.value[0] = cs4271->deemph;
+ return 0;
+ }
+
+@@ -271,7 +271,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- cs4271->deemph = ucontrol->value.enumerated.item[0];
++ cs4271->deemph = ucontrol->value.integer.value[0];
+ return cs4271_set_deemph(codec);
+ }
+
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 87cbf14bbdcd..e8a7608ff3de 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1107,13 +1107,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ /* Enable VDDC charge pump */
+ ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+ } else if (vddio >= 3100 && vdda >= 3100) {
+- /*
+- * if vddio and vddd > 3.1v,
+- * charge pump should be clean before set ana_pwr
+- */
+- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+- SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
+-
++ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+ /* VDDC use VDDIO rail */
+ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index bb9f07037485..fb1f0a719396 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -581,7 +581,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->anc_active;
++ ucontrol->value.integer.value[0] = wm2000->anc_active;
+
+ return 0;
+ }
+@@ -591,7 +591,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int anc_active = ucontrol->value.enumerated.item[0];
++ int anc_active = ucontrol->value.integer.value[0];
+
+ if (anc_active > 1)
+ return -EINVAL;
+@@ -607,7 +607,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
++ ucontrol->value.integer.value[0] = wm2000->spk_ena;
+
+ return 0;
+ }
+@@ -617,7 +617,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int val = ucontrol->value.enumerated.item[0];
++ int val = ucontrol->value.integer.value[0];
+
+ if (val > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index 8b5afc1d2e60..3616b5b76837 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -120,7 +120,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8731->deemph;
++ ucontrol->value.integer.value[0] = wm8731->deemph;
+
+ return 0;
+ }
+@@ -130,7 +130,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index 7775854212f5..776653d3960f 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -445,7 +445,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8903->deemph;
++ ucontrol->value.integer.value[0] = wm8903->deemph;
+
+ return 0;
+ }
+@@ -455,7 +455,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index c93e360b6706..19f30401b14c 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -528,7 +528,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8904->deemph;
++ ucontrol->value.integer.value[0] = wm8904->deemph;
+ return 0;
+ }
+
+@@ -537,7 +537,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 61fe97433e73..4696f6668259 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8955->deemph;
++ ucontrol->value.integer.value[0] = wm8955->deemph;
+ return 0;
+ }
+
+@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index a09d7eb1f02f..a3e4831bbe39 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -132,7 +132,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8960->deemph;
++ ucontrol->value.integer.value[0] = wm8960->deemph;
+ return 0;
+ }
+
+@@ -141,7 +141,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
+index 5a649da9122a..96bce55a7462 100644
+--- a/sound/soc/omap/omap-pcm.c
++++ b/sound/soc/omap/omap-pcm.c
+@@ -333,7 +333,7 @@ static struct snd_pcm_ops omap_pcm_ops = {
+ .mmap = omap_pcm_mmap,
+ };
+
+-static u64 omap_pcm_dmamask = DMA_BIT_MASK(64);
++static u64 omap_pcm_dmamask = DMA_BIT_MASK(32);
+
+ static int omap_pcm_preallocate_dma_buffer(struct snd_pcm *pcm,
+ int stream)
+@@ -384,7 +384,7 @@ static int omap_pcm_new(struct snd_soc_pcm_runtime *rtd)
+ if (!card->dev->dma_mask)
+ card->dev->dma_mask = &omap_pcm_dmamask;
+ if (!card->dev->coherent_dma_mask)
+- card->dev->coherent_dma_mask = DMA_BIT_MASK(64);
++ card->dev->coherent_dma_mask = DMA_BIT_MASK(32);
+
+ if (pcm->streams[SNDRV_PCM_STREAM_PLAYBACK].substream) {
+ ret = omap_pcm_preallocate_dma_buffer(pcm,
+diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
+index fb95069c0437..040d1016fb20 100644
+--- a/sound/usb/mixer_quirks.c
++++ b/sound/usb/mixer_quirks.c
+@@ -64,6 +64,7 @@ static const struct rc_config {
+ { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */
+ { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
+ { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
++ { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
+ { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
+ };
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 5ef357983d92..2ad5d772cd92 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -1871,6 +1871,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ }
+ },
++{
++ USB_DEVICE(0x0582, 0x0159),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ /* .vendor_name = "Roland", */
++ /* .product_name = "UA-22", */
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = & (const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
+
+ /* Guillemot devices */
+ {
+diff --git a/tools/perf/Makefile b/tools/perf/Makefile
+index 2db7ba001c63..331647c8ce65 100644
+--- a/tools/perf/Makefile
++++ b/tools/perf/Makefile
+@@ -816,10 +816,10 @@ $(OUTPUT)util/rbtree.o: ../../lib/rbtree.c $(OUTPUT)PERF-CFLAGS
+ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
+
+ $(OUTPUT)util/scripting-engines/trace-event-perl.o: util/scripting-engines/trace-event-perl.c $(OUTPUT)PERF-CFLAGS
+- $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $<
++ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-undef -Wno-switch-default $<
+
+ $(OUTPUT)scripts/perl/Perf-Trace-Util/Context.o: scripts/perl/Perf-Trace-Util/Context.c $(OUTPUT)PERF-CFLAGS
+- $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs $<
++ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs -Wno-undef -Wno-switch-default $<
+
+ $(OUTPUT)util/scripting-engines/trace-event-python.o: util/scripting-engines/trace-event-python.c $(OUTPUT)PERF-CFLAGS
+ $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $(PYTHON_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow $<
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2015-02-02 23:32 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2015-02-02 23:32 UTC (permalink / raw
To: gentoo-commits
commit: a1d2f4883e1b6a2e2ca1849e6c9e1efd51c287d0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Feb 2 23:21:19 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Feb 2 23:21:19 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=a1d2f488
Linux patch 3.4.106
---
0000_README | 4 +
1105_linux-3.4.106.patch | 6748 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 6752 insertions(+)
diff --git a/0000_README b/0000_README
index 5ff1506..ba104e4 100644
--- a/0000_README
+++ b/0000_README
@@ -459,6 +459,10 @@ Patch: 1104_linux-3.4.105.patch
From: http://www.kernel.org
Desc: Linux 3.4.105
+Patch: 1105_linux-3.4.106.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.106
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1105_linux-3.4.106.patch b/1105_linux-3.4.106.patch
new file mode 100644
index 0000000..61b5c3c
--- /dev/null
+++ b/1105_linux-3.4.106.patch
@@ -0,0 +1,6748 @@
+diff --git a/Documentation/lzo.txt b/Documentation/lzo.txt
+new file mode 100644
+index 000000000000..ea45dd3901e3
+--- /dev/null
++++ b/Documentation/lzo.txt
+@@ -0,0 +1,164 @@
++
++LZO stream format as understood by Linux's LZO decompressor
++===========================================================
++
++Introduction
++
++ This is not a specification. No specification seems to be publicly available
++ for the LZO stream format. This document describes what input format the LZO
++ decompressor as implemented in the Linux kernel understands. The file subject
++ of this analysis is lib/lzo/lzo1x_decompress_safe.c. No analysis was made on
++ the compressor nor on any other implementations though it seems likely that
++ the format matches the standard one. The purpose of this document is to
++ better understand what the code does in order to propose more efficient fixes
++ for future bug reports.
++
++Description
++
++ The stream is composed of a series of instructions, operands, and data. The
++ instructions consist in a few bits representing an opcode, and bits forming
++ the operands for the instruction, whose size and position depend on the
++ opcode and on the number of literals copied by previous instruction. The
++ operands are used to indicate :
++
++ - a distance when copying data from the dictionary (past output buffer)
++ - a length (number of bytes to copy from dictionary)
++ - the number of literals to copy, which is retained in variable "state"
++ as a piece of information for next instructions.
++
++ Optionally depending on the opcode and operands, extra data may follow. These
++ extra data can be a complement for the operand (eg: a length or a distance
++ encoded on larger values), or a literal to be copied to the output buffer.
++
++ The first byte of the block follows a different encoding from other bytes, it
++ seems to be optimized for literal use only, since there is no dictionary yet
++ prior to that byte.
++
++ Lengths are always encoded on a variable size starting with a small number
++ of bits in the operand. If the number of bits isn't enough to represent the
++ length, up to 255 may be added in increments by consuming more bytes with a
++ rate of at most 255 per extra byte (thus the compression ratio cannot exceed
++ around 255:1). The variable length encoding using #bits is always the same :
++
++ length = byte & ((1 << #bits) - 1)
++ if (!length) {
++ length = ((1 << #bits) - 1)
++ length += 255*(number of zero bytes)
++ length += first-non-zero-byte
++ }
++ length += constant (generally 2 or 3)
++
++ For references to the dictionary, distances are relative to the output
++ pointer. Distances are encoded using very few bits belonging to certain
++ ranges, resulting in multiple copy instructions using different encodings.
++ Certain encodings involve one extra byte, others involve two extra bytes
++ forming a little-endian 16-bit quantity (marked LE16 below).
++
++ After any instruction except the large literal copy, 0, 1, 2 or 3 literals
++ are copied before starting the next instruction. The number of literals that
++ were copied may change the meaning and behaviour of the next instruction. In
++ practice, only one instruction needs to know whether 0, less than 4, or more
++ literals were copied. This is the information stored in the <state> variable
++ in this implementation. This number of immediate literals to be copied is
++ generally encoded in the last two bits of the instruction but may also be
++ taken from the last two bits of an extra operand (eg: distance).
++
++ End of stream is declared when a block copy of distance 0 is seen. Only one
++ instruction may encode this distance (0001HLLL), it takes one LE16 operand
++ for the distance, thus requiring 3 bytes.
++
++ IMPORTANT NOTE : in the code some length checks are missing because certain
++ instructions are called under the assumption that a certain number of bytes
++ follow because it has already been garanteed before parsing the instructions.
++ They just have to "refill" this credit if they consume extra bytes. This is
++ an implementation design choice independant on the algorithm or encoding.
++
++Byte sequences
++
++ First byte encoding :
++
++ 0..17 : follow regular instruction encoding, see below. It is worth
++ noting that codes 16 and 17 will represent a block copy from
++ the dictionary which is empty, and that they will always be
++ invalid at this place.
++
++ 18..21 : copy 0..3 literals
++ state = (byte - 17) = 0..3 [ copy <state> literals ]
++ skip byte
++
++ 22..255 : copy literal string
++ length = (byte - 17) = 4..238
++ state = 4 [ don't copy extra literals ]
++ skip byte
++
++ Instruction encoding :
++
++ 0 0 0 0 X X X X (0..15)
++ Depends on the number of literals copied by the last instruction.
++ If last instruction did not copy any literal (state == 0), this
++ encoding will be a copy of 4 or more literal, and must be interpreted
++ like this :
++
++ 0 0 0 0 L L L L (0..15) : copy long literal string
++ length = 3 + (L ?: 15 + (zero_bytes * 255) + non_zero_byte)
++ state = 4 (no extra literals are copied)
++
++ If last instruction used to copy between 1 to 3 literals (encoded in
++ the instruction's opcode or distance), the instruction is a copy of a
++ 2-byte block from the dictionary within a 1kB distance. It is worth
++ noting that this instruction provides little savings since it uses 2
++ bytes to encode a copy of 2 other bytes but it encodes the number of
++ following literals for free. It must be interpreted like this :
++
++ 0 0 0 0 D D S S (0..15) : copy 2 bytes from <= 1kB distance
++ length = 2
++ state = S (copy S literals after this block)
++ Always followed by exactly one byte : H H H H H H H H
++ distance = (H << 2) + D + 1
++
++ If last instruction used to copy 4 or more literals (as detected by
++ state == 4), the instruction becomes a copy of a 3-byte block from the
++ dictionary from a 2..3kB distance, and must be interpreted like this :
++
++ 0 0 0 0 D D S S (0..15) : copy 3 bytes from 2..3 kB distance
++ length = 3
++ state = S (copy S literals after this block)
++ Always followed by exactly one byte : H H H H H H H H
++ distance = (H << 2) + D + 2049
++
++ 0 0 0 1 H L L L (16..31)
++ Copy of a block within 16..48kB distance (preferably less than 10B)
++ length = 2 + (L ?: 7 + (zero_bytes * 255) + non_zero_byte)
++ Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S
++ distance = 16384 + (H << 14) + D
++ state = S (copy S literals after this block)
++ End of stream is reached if distance == 16384
++
++ 0 0 1 L L L L L (32..63)
++ Copy of small block within 16kB distance (preferably less than 34B)
++ length = 2 + (L ?: 31 + (zero_bytes * 255) + non_zero_byte)
++ Always followed by exactly one LE16 : D D D D D D D D : D D D D D D S S
++ distance = D + 1
++ state = S (copy S literals after this block)
++
++ 0 1 L D D D S S (64..127)
++ Copy 3-4 bytes from block within 2kB distance
++ state = S (copy S literals after this block)
++ length = 3 + L
++ Always followed by exactly one byte : H H H H H H H H
++ distance = (H << 3) + D + 1
++
++ 1 L L D D D S S (128..255)
++ Copy 5-8 bytes from block within 2kB distance
++ state = S (copy S literals after this block)
++ length = 5 + L
++ Always followed by exactly one byte : H H H H H H H H
++ distance = (H << 3) + D + 1
++
++Authors
++
++ This document was written by Willy Tarreau <w@1wt.eu> on 2014/07/19 during an
++ analysis of the decompression code available in Linux 3.16-rc5. The code is
++ tricky, it is possible that this document contains mistakes or that a few
++ corner cases were overlooked. In any case, please report any doubt, fix, or
++ proposed updates to the author(s) so that the document can be updated.
+diff --git a/Makefile b/Makefile
+index cf2c8a82ca3e..649f1462ebf8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 105
++SUBLEVEL = 106
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/m68k/mm/hwtest.c b/arch/m68k/mm/hwtest.c
+index 2c7dde3c6430..2a5259fd23eb 100644
+--- a/arch/m68k/mm/hwtest.c
++++ b/arch/m68k/mm/hwtest.c
+@@ -28,9 +28,11 @@
+ int hwreg_present( volatile void *regp )
+ {
+ int ret = 0;
++ unsigned long flags;
+ long save_sp, save_vbr;
+ long tmp_vectors[3];
+
++ local_irq_save(flags);
+ __asm__ __volatile__
+ ( "movec %/vbr,%2\n\t"
+ "movel #Lberr1,%4@(8)\n\t"
+@@ -46,6 +48,7 @@ int hwreg_present( volatile void *regp )
+ : "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
+ : "a" (regp), "a" (tmp_vectors)
+ );
++ local_irq_restore(flags);
+
+ return( ret );
+ }
+@@ -58,9 +61,11 @@ EXPORT_SYMBOL(hwreg_present);
+ int hwreg_write( volatile void *regp, unsigned short val )
+ {
+ int ret;
++ unsigned long flags;
+ long save_sp, save_vbr;
+ long tmp_vectors[3];
+
++ local_irq_save(flags);
+ __asm__ __volatile__
+ ( "movec %/vbr,%2\n\t"
+ "movel #Lberr2,%4@(8)\n\t"
+@@ -78,6 +83,7 @@ int hwreg_write( volatile void *regp, unsigned short val )
+ : "=&d" (ret), "=&r" (save_sp), "=&r" (save_vbr)
+ : "a" (regp), "a" (tmp_vectors), "g" (val)
+ );
++ local_irq_restore(flags);
+
+ return( ret );
+ }
+diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
+index 0bc485b3cd60..6d64efe77026 100644
+--- a/arch/mips/mm/tlbex.c
++++ b/arch/mips/mm/tlbex.c
+@@ -1041,6 +1041,7 @@ static void __cpuinit build_update_entries(u32 **p, unsigned int tmp,
+ struct mips_huge_tlb_info {
+ int huge_pte;
+ int restore_scratch;
++ bool need_reload_pte;
+ };
+
+ static struct mips_huge_tlb_info __cpuinit
+@@ -1055,6 +1056,7 @@ build_fast_tlb_refill_handler (u32 **p, struct uasm_label **l,
+
+ rv.huge_pte = scratch;
+ rv.restore_scratch = 0;
++ rv.need_reload_pte = false;
+
+ if (check_for_high_segbits) {
+ UASM_i_MFC0(p, tmp, C0_BADVADDR);
+@@ -1247,6 +1249,7 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
+ } else {
+ htlb_info.huge_pte = K0;
+ htlb_info.restore_scratch = 0;
++ htlb_info.need_reload_pte = true;
+ vmalloc_mode = refill_noscratch;
+ /*
+ * create the plain linear handler
+@@ -1283,6 +1286,8 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
+ }
+ #ifdef CONFIG_HUGETLB_PAGE
+ uasm_l_tlb_huge_update(&l, p);
++ if (htlb_info.need_reload_pte)
++ UASM_i_LW(&p, htlb_info.huge_pte, 0, K1);
+ build_huge_update_entries(&p, htlb_info.huge_pte, K1);
+ build_huge_tlb_write_entry(&p, &l, &r, K0, tlb_random,
+ htlb_info.restore_scratch);
+diff --git a/arch/mips/oprofile/backtrace.c b/arch/mips/oprofile/backtrace.c
+index 6854ed5097d2..83a1dfd8f0e3 100644
+--- a/arch/mips/oprofile/backtrace.c
++++ b/arch/mips/oprofile/backtrace.c
+@@ -92,7 +92,7 @@ static inline int unwind_user_frame(struct stackframe *old_frame,
+ /* This marks the end of the previous function,
+ which means we overran. */
+ break;
+- stack_size = (unsigned) stack_adjustment;
++ stack_size = (unsigned long) stack_adjustment;
+ } else if (is_ra_save_ins(&ip)) {
+ int ra_slot = ip.i_format.simmediate;
+ if (ra_slot < 0)
+diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S
+index e500969bea0c..c3fc39ee57a5 100644
+--- a/arch/powerpc/kernel/entry_64.S
++++ b/arch/powerpc/kernel/entry_64.S
+@@ -813,7 +813,13 @@ user_work:
+ b .ret_from_except_lite
+
+ 1: bl .save_nvgprs
++ /*
++ * Use a non volatile GPR to save and restore our thread_info flags
++ * across the call to restore_interrupts.
++ */
++ mr r30,r4
+ bl .restore_interrupts
++ mr r4,r30
+ addi r3,r1,STACK_FRAME_OVERHEAD
+ bl .do_notify_resume
+ b .ret_from_except
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 10e13b331d38..df69bcb13c79 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -43,6 +43,7 @@ static int __interrupt_is_deliverable(struct kvm_vcpu *vcpu,
+ return 0;
+ if (vcpu->arch.sie_block->gcr[0] & 0x2000ul)
+ return 1;
++ return 0;
+ case KVM_S390_INT_EMERGENCY:
+ if (psw_extint_disabled(vcpu))
+ return 0;
+diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h
+index e95822d683f4..fa9c8c7bc500 100644
+--- a/arch/x86/include/asm/desc.h
++++ b/arch/x86/include/asm/desc.h
+@@ -250,7 +250,8 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
+ gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
+ }
+
+-#define _LDT_empty(info) \
++/* This intentionally ignores lm, since 32-bit apps don't have that field. */
++#define LDT_empty(info) \
+ ((info)->base_addr == 0 && \
+ (info)->limit == 0 && \
+ (info)->contents == 0 && \
+@@ -260,11 +261,18 @@ static inline void native_load_tls(struct thread_struct *t, unsigned int cpu)
+ (info)->seg_not_present == 1 && \
+ (info)->useable == 0)
+
+-#ifdef CONFIG_X86_64
+-#define LDT_empty(info) (_LDT_empty(info) && ((info)->lm == 0))
+-#else
+-#define LDT_empty(info) (_LDT_empty(info))
+-#endif
++/* Lots of programs expect an all-zero user_desc to mean "no segment at all". */
++static inline bool LDT_zero(const struct user_desc *info)
++{
++ return (info->base_addr == 0 &&
++ info->limit == 0 &&
++ info->contents == 0 &&
++ info->read_exec_only == 0 &&
++ info->seg_32bit == 0 &&
++ info->limit_in_pages == 0 &&
++ info->seg_not_present == 0 &&
++ info->useable == 0);
++}
+
+ static inline void clear_LDT(void)
+ {
+diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
+index 5939f44fe0c0..06ec1fe26d98 100644
+--- a/arch/x86/include/asm/elf.h
++++ b/arch/x86/include/asm/elf.h
+@@ -155,8 +155,9 @@ do { \
+ #define elf_check_arch(x) \
+ ((x)->e_machine == EM_X86_64)
+
+-#define compat_elf_check_arch(x) \
+- (elf_check_arch_ia32(x) || (x)->e_machine == EM_X86_64)
++#define compat_elf_check_arch(x) \
++ (elf_check_arch_ia32(x) || \
++ (IS_ENABLED(CONFIG_X86_X32_ABI) && (x)->e_machine == EM_X86_64))
+
+ #if __USER32_DS != __USER_DS
+ # error "The following code assumes __USER32_DS == __USER_DS"
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 944471f4d142..4f787579b329 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -453,6 +453,7 @@ struct kvm_vcpu_arch {
+ u64 mmio_gva;
+ unsigned access;
+ gfn_t mmio_gfn;
++ u64 mmio_gen;
+
+ struct kvm_pmu pmu;
+
+@@ -881,6 +882,20 @@ static inline void kvm_inject_gp(struct kvm_vcpu *vcpu, u32 error_code)
+ kvm_queue_exception_e(vcpu, GP_VECTOR, error_code);
+ }
+
++static inline u64 get_canonical(u64 la)
++{
++ return ((int64_t)la << 16) >> 16;
++}
++
++static inline bool is_noncanonical_address(u64 la)
++{
++#ifdef CONFIG_X86_64
++ return get_canonical(la) != la;
++#else
++ return false;
++#endif
++}
++
+ #define TSS_IOPB_BASE_OFFSET 0x66
+ #define TSS_BASE_SIZE 0x68
+ #define TSS_IOPB_SIZE (65536 / 8)
+@@ -939,7 +954,7 @@ int kvm_arch_interrupt_allowed(struct kvm_vcpu *vcpu);
+ int kvm_cpu_get_interrupt(struct kvm_vcpu *v);
+
+ void kvm_define_shared_msr(unsigned index, u32 msr);
+-void kvm_set_shared_msr(unsigned index, u64 val, u64 mask);
++int kvm_set_shared_msr(unsigned index, u64 val, u64 mask);
+
+ bool kvm_is_linear_rip(struct kvm_vcpu *vcpu, unsigned long linear_rip);
+
+diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h
+index ade619ff9e2a..88dae6b3d7d5 100644
+--- a/arch/x86/include/asm/page_32_types.h
++++ b/arch/x86/include/asm/page_32_types.h
+@@ -18,7 +18,6 @@
+ #define THREAD_ORDER 1
+ #define THREAD_SIZE (PAGE_SIZE << THREAD_ORDER)
+
+-#define STACKFAULT_STACK 0
+ #define DOUBLEFAULT_STACK 1
+ #define NMI_STACK 0
+ #define DEBUG_STACK 0
+diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
+index 7639dbf5d223..a9e9937b9a62 100644
+--- a/arch/x86/include/asm/page_64_types.h
++++ b/arch/x86/include/asm/page_64_types.h
+@@ -14,12 +14,11 @@
+ #define IRQ_STACK_ORDER 2
+ #define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
+
+-#define STACKFAULT_STACK 1
+-#define DOUBLEFAULT_STACK 2
+-#define NMI_STACK 3
+-#define DEBUG_STACK 4
+-#define MCE_STACK 5
+-#define N_EXCEPTION_STACKS 5 /* hw limit: 7 */
++#define DOUBLEFAULT_STACK 1
++#define NMI_STACK 2
++#define DEBUG_STACK 3
++#define MCE_STACK 4
++#define N_EXCEPTION_STACKS 4 /* hw limit: 7 */
+
+ #define PUD_PAGE_SIZE (_AC(1, UL) << PUD_SHIFT)
+ #define PUD_PAGE_MASK (~(PUD_PAGE_SIZE-1))
+diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h
+index 31f180c21ce9..504d1cf9def8 100644
+--- a/arch/x86/include/asm/vmx.h
++++ b/arch/x86/include/asm/vmx.h
+@@ -279,6 +279,8 @@ enum vmcs_field {
+ #define EXIT_REASON_APIC_ACCESS 44
+ #define EXIT_REASON_EPT_VIOLATION 48
+ #define EXIT_REASON_EPT_MISCONFIG 49
++#define EXIT_REASON_INVEPT 50
++#define EXIT_REASON_INVVPID 53
+ #define EXIT_REASON_WBINVD 54
+ #define EXIT_REASON_XSETBV 55
+
+diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
+index edc24480469f..cb5b54e796eb 100644
+--- a/arch/x86/kernel/apic/apic.c
++++ b/arch/x86/kernel/apic/apic.c
+@@ -1229,7 +1229,7 @@ void __cpuinit setup_local_APIC(void)
+ unsigned int value, queued;
+ int i, j, acked = 0;
+ unsigned long long tsc = 0, ntsc;
+- long long max_loops = cpu_khz;
++ long long max_loops = cpu_khz ? cpu_khz : 1000000;
+
+ if (cpu_has_tsc)
+ rdtscll(tsc);
+@@ -1325,7 +1325,7 @@ void __cpuinit setup_local_APIC(void)
+ acked);
+ break;
+ }
+- if (cpu_has_tsc) {
++ if (cpu_has_tsc && cpu_khz) {
+ rdtscll(ntsc);
+ max_loops = (cpu_khz << 10) - (ntsc - tsc);
+ } else
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index cf79302198a6..114db0fee86c 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -142,6 +142,8 @@ EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
+
+ static int __init x86_xsave_setup(char *s)
+ {
++ if (strlen(s))
++ return 0;
+ setup_clear_cpu_cap(X86_FEATURE_XSAVE);
+ setup_clear_cpu_cap(X86_FEATURE_XSAVEOPT);
+ return 1;
+diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
+index 3e6ff6cbf42a..e7a64dd602d9 100644
+--- a/arch/x86/kernel/cpu/intel.c
++++ b/arch/x86/kernel/cpu/intel.c
+@@ -143,6 +143,21 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
+ setup_clear_cpu_cap(X86_FEATURE_ERMS);
+ }
+ }
++
++ /*
++ * Intel Quark Core DevMan_001.pdf section 6.4.11
++ * "The operating system also is required to invalidate (i.e., flush)
++ * the TLB when any changes are made to any of the page table entries.
++ * The operating system must reload CR3 to cause the TLB to be flushed"
++ *
++ * As a result cpu_has_pge() in arch/x86/include/asm/tlbflush.h should
++ * be false so that __flush_tlb_all() causes CR3 insted of CR4.PGE
++ * to be modified
++ */
++ if (c->x86 == 5 && c->x86_model == 9) {
++ pr_info("Disabling PGE capability bit\n");
++ setup_clear_cpu_cap(X86_FEATURE_PGE);
++ }
+ }
+
+ #ifdef CONFIG_X86_32
+diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
+index 17107bd6e1f0..e8206060a0a8 100644
+--- a/arch/x86/kernel/dumpstack_64.c
++++ b/arch/x86/kernel/dumpstack_64.c
+@@ -24,7 +24,6 @@ static char x86_stack_ids[][8] = {
+ [ DEBUG_STACK-1 ] = "#DB",
+ [ NMI_STACK-1 ] = "NMI",
+ [ DOUBLEFAULT_STACK-1 ] = "#DF",
+- [ STACKFAULT_STACK-1 ] = "#SS",
+ [ MCE_STACK-1 ] = "#MC",
+ #if DEBUG_STKSZ > EXCEPTION_STKSZ
+ [ N_EXCEPTION_STACKS ...
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index 42b055e24691..45f9c70f1246 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -912,13 +912,16 @@ ENTRY(native_iret)
+ jnz native_irq_return_ldt
+ #endif
+
++.global native_irq_return_iret
+ native_irq_return_iret:
++ /*
++ * This may fault. Non-paranoid faults on return to userspace are
++ * handled by fixup_bad_iret. These include #SS, #GP, and #NP.
++ * Double-faults due to espfix64 are handled in do_double_fault.
++ * Other faults here are fatal.
++ */
+ iretq
+
+- .section __ex_table,"a"
+- .quad native_irq_return_iret, bad_iret
+- .previous
+-
+ #ifdef CONFIG_X86_ESPFIX64
+ native_irq_return_ldt:
+ pushq_cfi %rax
+@@ -945,25 +948,6 @@ native_irq_return_ldt:
+ jmp native_irq_return_iret
+ #endif
+
+- .section .fixup,"ax"
+-bad_iret:
+- /*
+- * The iret traps when the %cs or %ss being restored is bogus.
+- * We've lost the original trap vector and error code.
+- * #GPF is the most likely one to get for an invalid selector.
+- * So pretend we completed the iret and took the #GPF in user mode.
+- *
+- * We are now running with the kernel GS after exception recovery.
+- * But error_entry expects us to have user GS to match the user %cs,
+- * so swap back.
+- */
+- pushq $0
+-
+- SWAPGS
+- jmp general_protection
+-
+- .previous
+-
+ /* edi: workmask, edx: work */
+ retint_careful:
+ CFI_RESTORE_STATE
+@@ -1011,37 +995,6 @@ ENTRY(retint_kernel)
+ CFI_ENDPROC
+ END(common_interrupt)
+
+- /*
+- * If IRET takes a fault on the espfix stack, then we
+- * end up promoting it to a doublefault. In that case,
+- * modify the stack to make it look like we just entered
+- * the #GP handler from user space, similar to bad_iret.
+- */
+-#ifdef CONFIG_X86_ESPFIX64
+- ALIGN
+-__do_double_fault:
+- XCPT_FRAME 1 RDI+8
+- movq RSP(%rdi),%rax /* Trap on the espfix stack? */
+- sarq $PGDIR_SHIFT,%rax
+- cmpl $ESPFIX_PGD_ENTRY,%eax
+- jne do_double_fault /* No, just deliver the fault */
+- cmpl $__KERNEL_CS,CS(%rdi)
+- jne do_double_fault
+- movq RIP(%rdi),%rax
+- cmpq $native_irq_return_iret,%rax
+- jne do_double_fault /* This shouldn't happen... */
+- movq PER_CPU_VAR(kernel_stack),%rax
+- subq $(6*8-KERNEL_STACK_OFFSET),%rax /* Reset to original stack */
+- movq %rax,RSP(%rdi)
+- movq $0,(%rax) /* Missing (lost) #GP error code */
+- movq $general_protection,RIP(%rdi)
+- retq
+- CFI_ENDPROC
+-END(__do_double_fault)
+-#else
+-# define __do_double_fault do_double_fault
+-#endif
+-
+ /*
+ * End of kprobes section
+ */
+@@ -1217,7 +1170,7 @@ zeroentry overflow do_overflow
+ zeroentry bounds do_bounds
+ zeroentry invalid_op do_invalid_op
+ zeroentry device_not_available do_device_not_available
+-paranoiderrorentry double_fault __do_double_fault
++paranoiderrorentry double_fault do_double_fault
+ zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun
+ errorentry invalid_TSS do_invalid_TSS
+ errorentry segment_not_present do_segment_not_present
+@@ -1431,7 +1384,7 @@ apicinterrupt XEN_HVM_EVTCHN_CALLBACK \
+
+ paranoidzeroentry_ist debug do_debug DEBUG_STACK
+ paranoidzeroentry_ist int3 do_int3 DEBUG_STACK
+-paranoiderrorentry stack_segment do_stack_segment
++errorentry stack_segment do_stack_segment
+ #ifdef CONFIG_XEN
+ zeroentry xen_debug do_debug
+ zeroentry xen_int3 do_int3
+@@ -1541,16 +1494,15 @@ error_sti:
+
+ /*
+ * There are two places in the kernel that can potentially fault with
+- * usergs. Handle them here. The exception handlers after iret run with
+- * kernel gs again, so don't set the user space flag. B stepping K8s
+- * sometimes report an truncated RIP for IRET exceptions returning to
+- * compat mode. Check for these here too.
++ * usergs. Handle them here. B stepping K8s sometimes report a
++ * truncated RIP for IRET exceptions returning to compat mode. Check
++ * for these here too.
+ */
+ error_kernelspace:
+ incl %ebx
+ leaq native_irq_return_iret(%rip),%rcx
+ cmpq %rcx,RIP+8(%rsp)
+- je error_swapgs
++ je error_bad_iret
+ movl %ecx,%eax /* zero extend */
+ cmpq %rax,RIP+8(%rsp)
+ je bstep_iret
+@@ -1561,7 +1513,15 @@ error_kernelspace:
+ bstep_iret:
+ /* Fix truncated RIP */
+ movq %rcx,RIP+8(%rsp)
+- jmp error_swapgs
++ /* fall through */
++
++error_bad_iret:
++ SWAPGS
++ mov %rsp,%rdi
++ call fixup_bad_iret
++ mov %rax,%rsp
++ decl %ebx /* Return to usergs */
++ jmp error_sti
+ CFI_ENDPROC
+ END(error_entry)
+
+diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
+index e554e5ad2fe8..226f28413f76 100644
+--- a/arch/x86/kernel/kvm.c
++++ b/arch/x86/kernel/kvm.c
+@@ -258,7 +258,14 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
+ static void __init paravirt_ops_setup(void)
+ {
+ pv_info.name = "KVM";
+- pv_info.paravirt_enabled = 1;
++
++ /*
++ * KVM isn't paravirt in the sense of paravirt_enabled. A KVM
++ * guest kernel works like a bare metal kernel with additional
++ * features, and paravirt_enabled is about features that are
++ * missing.
++ */
++ pv_info.paravirt_enabled = 0;
+
+ if (kvm_para_has_feature(KVM_FEATURE_NOP_IO_DELAY))
+ pv_cpu_ops.io_delay = kvm_io_delay;
+diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
+index f8492da65bfc..5e3f91bb6ec3 100644
+--- a/arch/x86/kernel/kvmclock.c
++++ b/arch/x86/kernel/kvmclock.c
+@@ -212,7 +212,6 @@ void __init kvmclock_init(void)
+ #endif
+ kvm_get_preset_lpj();
+ clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
+- pv_info.paravirt_enabled = 1;
+ pv_info.name = "KVM";
+
+ if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE_STABLE_BIT))
+diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
+index 9d9d2f9e77a5..9d25a6eef1e1 100644
+--- a/arch/x86/kernel/tls.c
++++ b/arch/x86/kernel/tls.c
+@@ -27,6 +27,42 @@ static int get_free_idx(void)
+ return -ESRCH;
+ }
+
++static bool tls_desc_okay(const struct user_desc *info)
++{
++ /*
++ * For historical reasons (i.e. no one ever documented how any
++ * of the segmentation APIs work), user programs can and do
++ * assume that a struct user_desc that's all zeros except for
++ * entry_number means "no segment at all". This never actually
++ * worked. In fact, up to Linux 3.19, a struct user_desc like
++ * this would create a 16-bit read-write segment with base and
++ * limit both equal to zero.
++ *
++ * That was close enough to "no segment at all" until we
++ * hardened this function to disallow 16-bit TLS segments. Fix
++ * it up by interpreting these zeroed segments the way that they
++ * were almost certainly intended to be interpreted.
++ *
++ * The correct way to ask for "no segment at all" is to specify
++ * a user_desc that satisfies LDT_empty. To keep everything
++ * working, we accept both.
++ *
++ * Note that there's a similar kludge in modify_ldt -- look at
++ * the distinction between modes 1 and 0x11.
++ */
++ if (LDT_empty(info) || LDT_zero(info))
++ return true;
++
++ /*
++ * espfix is required for 16-bit data segments, but espfix
++ * only works for LDT segments.
++ */
++ if (!info->seg_32bit)
++ return false;
++
++ return true;
++}
++
+ static void set_tls_desc(struct task_struct *p, int idx,
+ const struct user_desc *info, int n)
+ {
+@@ -40,7 +76,7 @@ static void set_tls_desc(struct task_struct *p, int idx,
+ cpu = get_cpu();
+
+ while (n-- > 0) {
+- if (LDT_empty(info))
++ if (LDT_empty(info) || LDT_zero(info))
+ desc->a = desc->b = 0;
+ else
+ fill_ldt(desc, info);
+@@ -66,6 +102,9 @@ int do_set_thread_area(struct task_struct *p, int idx,
+ if (copy_from_user(&info, u_info, sizeof(info)))
+ return -EFAULT;
+
++ if (!tls_desc_okay(&info))
++ return -EINVAL;
++
+ if (idx == -1)
+ idx = info.entry_number;
+
+@@ -196,6 +235,7 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
+ {
+ struct user_desc infobuf[GDT_ENTRY_TLS_ENTRIES];
+ const struct user_desc *info;
++ int i;
+
+ if (pos >= GDT_ENTRY_TLS_ENTRIES * sizeof(struct user_desc) ||
+ (pos % sizeof(struct user_desc)) != 0 ||
+@@ -209,6 +249,10 @@ int regset_tls_set(struct task_struct *target, const struct user_regset *regset,
+ else
+ info = infobuf;
+
++ for (i = 0; i < count / sizeof(struct user_desc); i++)
++ if (!tls_desc_okay(info + i))
++ return -EINVAL;
++
+ set_tls_desc(target,
+ GDT_ENTRY_TLS_MIN + (pos / sizeof(struct user_desc)),
+ info, count / sizeof(struct user_desc));
+diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
+index ff9281f16029..9bfe95fda57c 100644
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -213,29 +213,41 @@ DO_ERROR(X86_TRAP_OLD_MF, SIGFPE, "coprocessor segment overrun",
+ coprocessor_segment_overrun)
+ DO_ERROR(X86_TRAP_TS, SIGSEGV, "invalid TSS", invalid_TSS)
+ DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
+-#ifdef CONFIG_X86_32
+ DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
+-#endif
+ DO_ERROR_INFO(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check,
+ BUS_ADRALN, 0)
+
+ #ifdef CONFIG_X86_64
+ /* Runs on IST stack */
+-dotraplinkage void do_stack_segment(struct pt_regs *regs, long error_code)
+-{
+- if (notify_die(DIE_TRAP, "stack segment", regs, error_code,
+- X86_TRAP_SS, SIGBUS) == NOTIFY_STOP)
+- return;
+- preempt_conditional_sti(regs);
+- do_trap(X86_TRAP_SS, SIGBUS, "stack segment", regs, error_code, NULL);
+- preempt_conditional_cli(regs);
+-}
+-
+ dotraplinkage void do_double_fault(struct pt_regs *regs, long error_code)
+ {
+ static const char str[] = "double fault";
+ struct task_struct *tsk = current;
+
++#ifdef CONFIG_X86_ESPFIX64
++ extern unsigned char native_irq_return_iret[];
++
++ /*
++ * If IRET takes a non-IST fault on the espfix64 stack, then we
++ * end up promoting it to a doublefault. In that case, modify
++ * the stack to make it look like we just entered the #GP
++ * handler from user space, similar to bad_iret.
++ */
++ if (((long)regs->sp >> PGDIR_SHIFT) == ESPFIX_PGD_ENTRY &&
++ regs->cs == __KERNEL_CS &&
++ regs->ip == (unsigned long)native_irq_return_iret)
++ {
++ struct pt_regs *normal_regs = task_pt_regs(current);
++
++ /* Fake a #GP(0) from userspace. */
++ memmove(&normal_regs->ip, (void *)regs->sp, 5*8);
++ normal_regs->orig_ax = 0; /* Missing (lost) #GP error code */
++ regs->ip = (unsigned long)general_protection;
++ regs->sp = (unsigned long)&normal_regs->orig_ax;
++ return;
++ }
++#endif
++
+ /* Return not checked because double check cannot be ignored */
+ notify_die(DIE_TRAP, str, regs, error_code, X86_TRAP_DF, SIGSEGV);
+
+@@ -332,7 +344,7 @@ dotraplinkage void __kprobes do_int3(struct pt_regs *regs, long error_code)
+ * for scheduling or signal handling. The actual stack switch is done in
+ * entry.S
+ */
+-asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
++asmlinkage notrace __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
+ {
+ struct pt_regs *regs = eregs;
+ /* Did already sync */
+@@ -351,6 +363,35 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
+ *regs = *eregs;
+ return regs;
+ }
++
++struct bad_iret_stack {
++ void *error_entry_ret;
++ struct pt_regs regs;
++};
++
++asmlinkage notrace __kprobes
++struct bad_iret_stack *fixup_bad_iret(struct bad_iret_stack *s)
++{
++ /*
++ * This is called from entry_64.S early in handling a fault
++ * caused by a bad iret to user mode. To handle the fault
++ * correctly, we want move our stack frame to task_pt_regs
++ * and we want to pretend that the exception came from the
++ * iret target.
++ */
++ struct bad_iret_stack *new_stack =
++ container_of(task_pt_regs(current),
++ struct bad_iret_stack, regs);
++
++ /* Copy the IRET target to the new stack. */
++ memmove(&new_stack->regs.ip, (void *)s->regs.sp, 5*8);
++
++ /* Copy the remainder of the stack from the current stack. */
++ memmove(new_stack, s, offsetof(struct bad_iret_stack, regs.ip));
++
++ BUG_ON(!user_mode_vm(&new_stack->regs));
++ return new_stack;
++}
+ #endif
+
+ /*
+@@ -694,7 +735,7 @@ void __init trap_init(void)
+ set_intr_gate(X86_TRAP_OLD_MF, &coprocessor_segment_overrun);
+ set_intr_gate(X86_TRAP_TS, &invalid_TSS);
+ set_intr_gate(X86_TRAP_NP, &segment_not_present);
+- set_intr_gate_ist(X86_TRAP_SS, &stack_segment, STACKFAULT_STACK);
++ set_intr_gate(X86_TRAP_SS, stack_segment);
+ set_intr_gate(X86_TRAP_GP, &general_protection);
+ set_intr_gate(X86_TRAP_SPURIOUS, &spurious_interrupt_bug);
+ set_intr_gate(X86_TRAP_MF, &coprocessor_error);
+diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
+index fc0a147e3727..8652aa408ae0 100644
+--- a/arch/x86/kernel/tsc.c
++++ b/arch/x86/kernel/tsc.c
+@@ -959,14 +959,17 @@ void __init tsc_init(void)
+
+ x86_init.timers.tsc_pre_init();
+
+- if (!cpu_has_tsc)
++ if (!cpu_has_tsc) {
++ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
+ return;
++ }
+
+ tsc_khz = x86_platform.calibrate_tsc();
+ cpu_khz = tsc_khz;
+
+ if (!tsc_khz) {
+ mark_tsc_unstable("could not calculate TSC khz");
++ setup_clear_cpu_cap(X86_FEATURE_TSC_DEADLINE_TIMER);
+ return;
+ }
+
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 83756223f8aa..91e8680ec239 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -459,11 +459,6 @@ register_address_increment(struct x86_emulate_ctxt *ctxt, unsigned long *reg, in
+ *reg = (*reg & ~ad_mask(ctxt)) | ((*reg + inc) & ad_mask(ctxt));
+ }
+
+-static inline void jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
+-{
+- register_address_increment(ctxt, &ctxt->_eip, rel);
+-}
+-
+ static u32 desc_limit_scaled(struct desc_struct *desc)
+ {
+ u32 limit = get_desc_limit(desc);
+@@ -537,6 +532,40 @@ static int emulate_nm(struct x86_emulate_ctxt *ctxt)
+ return emulate_exception(ctxt, NM_VECTOR, 0, false);
+ }
+
++static inline int assign_eip_far(struct x86_emulate_ctxt *ctxt, ulong dst,
++ int cs_l)
++{
++ switch (ctxt->op_bytes) {
++ case 2:
++ ctxt->_eip = (u16)dst;
++ break;
++ case 4:
++ ctxt->_eip = (u32)dst;
++ break;
++#ifdef CONFIG_X86_64
++ case 8:
++ if ((cs_l && is_noncanonical_address(dst)) ||
++ (!cs_l && (dst >> 32) != 0))
++ return emulate_gp(ctxt, 0);
++ ctxt->_eip = dst;
++ break;
++#endif
++ default:
++ WARN(1, "unsupported eip assignment size\n");
++ }
++ return X86EMUL_CONTINUE;
++}
++
++static inline int assign_eip_near(struct x86_emulate_ctxt *ctxt, ulong dst)
++{
++ return assign_eip_far(ctxt, dst, ctxt->mode == X86EMUL_MODE_PROT64);
++}
++
++static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel)
++{
++ return assign_eip_near(ctxt, ctxt->_eip + rel);
++}
++
+ static u16 get_segment_selector(struct x86_emulate_ctxt *ctxt, unsigned seg)
+ {
+ u16 selector;
+@@ -1224,11 +1253,13 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ }
+
+ /* Does not support long mode */
+-static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+- u16 selector, int seg)
++static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
++ u16 selector, int seg, u8 cpl,
++ bool in_task_switch,
++ struct desc_struct *desc)
+ {
+ struct desc_struct seg_desc;
+- u8 dpl, rpl, cpl;
++ u8 dpl, rpl;
+ unsigned err_vec = GP_VECTOR;
+ u32 err_code = 0;
+ bool null_selector = !(selector & ~0x3); /* 0000-0003 are null */
+@@ -1279,7 +1310,6 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+
+ rpl = selector & 3;
+ dpl = seg_desc.dpl;
+- cpl = ctxt->ops->cpl(ctxt);
+
+ switch (seg) {
+ case VCPU_SREG_SS:
+@@ -1336,12 +1366,21 @@ static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
+ }
+ load:
+ ctxt->ops->set_segment(ctxt, selector, &seg_desc, 0, seg);
++ if (desc)
++ *desc = seg_desc;
+ return X86EMUL_CONTINUE;
+ exception:
+ emulate_exception(ctxt, err_vec, err_code, true);
+ return X86EMUL_PROPAGATE_FAULT;
+ }
+
++static int load_segment_descriptor(struct x86_emulate_ctxt *ctxt,
++ u16 selector, int seg)
++{
++ u8 cpl = ctxt->ops->cpl(ctxt);
++ return __load_segment_descriptor(ctxt, selector, seg, cpl, false, NULL);
++}
++
+ static void write_register_operand(struct operand *op)
+ {
+ /* The 4-byte case *is* correct: in 64-bit mode we zero-extend. */
+@@ -1681,17 +1720,31 @@ static int em_iret(struct x86_emulate_ctxt *ctxt)
+ static int em_jmp_far(struct x86_emulate_ctxt *ctxt)
+ {
+ int rc;
+- unsigned short sel;
++ unsigned short sel, old_sel;
++ struct desc_struct old_desc, new_desc;
++ const struct x86_emulate_ops *ops = ctxt->ops;
++ u8 cpl = ctxt->ops->cpl(ctxt);
++
++ /* Assignment of RIP may only fail in 64-bit mode */
++ if (ctxt->mode == X86EMUL_MODE_PROT64)
++ ops->get_segment(ctxt, &old_sel, &old_desc, NULL,
++ VCPU_SREG_CS);
+
+ memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
+
+- rc = load_segment_descriptor(ctxt, sel, VCPU_SREG_CS);
++ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, false,
++ &new_desc);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+
+- ctxt->_eip = 0;
+- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
+- return X86EMUL_CONTINUE;
++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
++ if (rc != X86EMUL_CONTINUE) {
++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
++ /* assigning eip failed; restore the old cs */
++ ops->set_segment(ctxt, old_sel, &old_desc, 0, VCPU_SREG_CS);
++ return rc;
++ }
++ return rc;
+ }
+
+ static int em_grp2(struct x86_emulate_ctxt *ctxt)
+@@ -1785,13 +1838,15 @@ static int em_grp45(struct x86_emulate_ctxt *ctxt)
+ case 2: /* call near abs */ {
+ long int old_eip;
+ old_eip = ctxt->_eip;
+- ctxt->_eip = ctxt->src.val;
++ rc = assign_eip_near(ctxt, ctxt->src.val);
++ if (rc != X86EMUL_CONTINUE)
++ break;
+ ctxt->src.val = old_eip;
+ rc = em_push(ctxt);
+ break;
+ }
+ case 4: /* jmp abs */
+- ctxt->_eip = ctxt->src.val;
++ rc = assign_eip_near(ctxt, ctxt->src.val);
+ break;
+ case 5: /* jmp far */
+ rc = em_jmp_far(ctxt);
+@@ -1823,26 +1878,43 @@ static int em_cmpxchg8b(struct x86_emulate_ctxt *ctxt)
+
+ static int em_ret(struct x86_emulate_ctxt *ctxt)
+ {
+- ctxt->dst.type = OP_REG;
+- ctxt->dst.addr.reg = &ctxt->_eip;
+- ctxt->dst.bytes = ctxt->op_bytes;
+- return em_pop(ctxt);
++ int rc;
++ unsigned long eip;
++
++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++
++ return assign_eip_near(ctxt, eip);
+ }
+
+ static int em_ret_far(struct x86_emulate_ctxt *ctxt)
+ {
+ int rc;
+- unsigned long cs;
++ unsigned long eip, cs;
++ u16 old_cs;
++ struct desc_struct old_desc, new_desc;
++ const struct x86_emulate_ops *ops = ctxt->ops;
++
++ if (ctxt->mode == X86EMUL_MODE_PROT64)
++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL,
++ VCPU_SREG_CS);
+
+- rc = emulate_pop(ctxt, &ctxt->_eip, ctxt->op_bytes);
++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+- if (ctxt->op_bytes == 4)
+- ctxt->_eip = (u32)ctxt->_eip;
+ rc = emulate_pop(ctxt, &cs, ctxt->op_bytes);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+- rc = load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS);
++ rc = __load_segment_descriptor(ctxt, (u16)cs, VCPU_SREG_CS, 0, false,
++ &new_desc);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++ rc = assign_eip_far(ctxt, eip, new_desc.l);
++ if (rc != X86EMUL_CONTINUE) {
++ WARN_ON(ctxt->mode != X86EMUL_MODE_PROT64);
++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
++ }
+ return rc;
+ }
+
+@@ -2091,7 +2163,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ {
+ struct x86_emulate_ops *ops = ctxt->ops;
+ struct desc_struct cs, ss;
+- u64 msr_data;
++ u64 msr_data, rcx, rdx;
+ int usermode;
+ u16 cs_sel = 0, ss_sel = 0;
+
+@@ -2107,6 +2179,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ else
+ usermode = X86EMUL_MODE_PROT32;
+
++ rcx = ctxt->regs[VCPU_REGS_RCX];
++ rdx = ctxt->regs[VCPU_REGS_RDX];
++
+ cs.dpl = 3;
+ ss.dpl = 3;
+ ops->get_msr(ctxt, MSR_IA32_SYSENTER_CS, &msr_data);
+@@ -2124,6 +2199,9 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ ss_sel = cs_sel + 8;
+ cs.d = 0;
+ cs.l = 1;
++ if (is_noncanonical_address(rcx) ||
++ is_noncanonical_address(rdx))
++ return emulate_gp(ctxt, 0);
+ break;
+ }
+ cs_sel |= SELECTOR_RPL_MASK;
+@@ -2132,8 +2210,8 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt)
+ ops->set_segment(ctxt, cs_sel, &cs, 0, VCPU_SREG_CS);
+ ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS);
+
+- ctxt->_eip = ctxt->regs[VCPU_REGS_RDX];
+- ctxt->regs[VCPU_REGS_RSP] = ctxt->regs[VCPU_REGS_RCX];
++ ctxt->_eip = rdx;
++ ctxt->regs[VCPU_REGS_RSP] = rcx;
+
+ return X86EMUL_CONTINUE;
+ }
+@@ -2222,6 +2300,7 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+ struct tss_segment_16 *tss)
+ {
+ int ret;
++ u8 cpl;
+
+ ctxt->_eip = tss->ip;
+ ctxt->eflags = tss->flag | 2;
+@@ -2244,23 +2323,30 @@ static int load_state_from_tss16(struct x86_emulate_ctxt *ctxt,
+ set_segment_selector(ctxt, tss->ss, VCPU_SREG_SS);
+ set_segment_selector(ctxt, tss->ds, VCPU_SREG_DS);
+
++ cpl = tss->cs & 3;
++
+ /*
+ * Now load segment descriptors. If fault happenes at this stage
+ * it is handled in a context of new task
+ */
+- ret = load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR);
++ ret = __load_segment_descriptor(ctxt, tss->ldt, VCPU_SREG_LDTR, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES);
++ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS);
++ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS);
++ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS);
++ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+
+@@ -2339,6 +2425,7 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ struct tss_segment_32 *tss)
+ {
+ int ret;
++ u8 cpl;
+
+ if (ctxt->ops->set_cr(ctxt, 3, tss->cr3))
+ return emulate_gp(ctxt, 0);
+@@ -2357,7 +2444,8 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+
+ /*
+ * SDM says that segment selectors are loaded before segment
+- * descriptors
++ * descriptors. This is important because CPL checks will
++ * use CS.RPL.
+ */
+ set_segment_selector(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
+ set_segment_selector(ctxt, tss->es, VCPU_SREG_ES);
+@@ -2371,43 +2459,45 @@ static int load_state_from_tss32(struct x86_emulate_ctxt *ctxt,
+ * If we're switching between Protected Mode and VM86, we need to make
+ * sure to update the mode before loading the segment descriptors so
+ * that the selectors are interpreted correctly.
+- *
+- * Need to get rflags to the vcpu struct immediately because it
+- * influences the CPL which is checked at least when loading the segment
+- * descriptors and when pushing an error code to the new kernel stack.
+- *
+- * TODO Introduce a separate ctxt->ops->set_cpl callback
+ */
+- if (ctxt->eflags & X86_EFLAGS_VM)
++ if (ctxt->eflags & X86_EFLAGS_VM) {
+ ctxt->mode = X86EMUL_MODE_VM86;
+- else
++ cpl = 3;
++ } else {
+ ctxt->mode = X86EMUL_MODE_PROT32;
+-
+- ctxt->ops->set_rflags(ctxt, ctxt->eflags);
++ cpl = tss->cs & 3;
++ }
+
+ /*
+ * Now load segment descriptors. If fault happenes at this stage
+ * it is handled in a context of new task
+ */
+- ret = load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR);
++ ret = __load_segment_descriptor(ctxt, tss->ldt_selector, VCPU_SREG_LDTR,
++ cpl, true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES);
++ ret = __load_segment_descriptor(ctxt, tss->es, VCPU_SREG_ES, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS);
++ ret = __load_segment_descriptor(ctxt, tss->cs, VCPU_SREG_CS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS);
++ ret = __load_segment_descriptor(ctxt, tss->ss, VCPU_SREG_SS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS);
++ ret = __load_segment_descriptor(ctxt, tss->ds, VCPU_SREG_DS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS);
++ ret = __load_segment_descriptor(ctxt, tss->fs, VCPU_SREG_FS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+- ret = load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS);
++ ret = __load_segment_descriptor(ctxt, tss->gs, VCPU_SREG_GS, cpl,
++ true, NULL);
+ if (ret != X86EMUL_CONTINUE)
+ return ret;
+
+@@ -2629,10 +2719,13 @@ static int em_das(struct x86_emulate_ctxt *ctxt)
+
+ static int em_call(struct x86_emulate_ctxt *ctxt)
+ {
++ int rc;
+ long rel = ctxt->src.val;
+
+ ctxt->src.val = (unsigned long)ctxt->_eip;
+- jmp_rel(ctxt, rel);
++ rc = jmp_rel(ctxt, rel);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
+ return em_push(ctxt);
+ }
+
+@@ -2641,34 +2734,50 @@ static int em_call_far(struct x86_emulate_ctxt *ctxt)
+ u16 sel, old_cs;
+ ulong old_eip;
+ int rc;
++ struct desc_struct old_desc, new_desc;
++ const struct x86_emulate_ops *ops = ctxt->ops;
++ int cpl = ctxt->ops->cpl(ctxt);
+
+- old_cs = get_segment_selector(ctxt, VCPU_SREG_CS);
+ old_eip = ctxt->_eip;
++ ops->get_segment(ctxt, &old_cs, &old_desc, NULL, VCPU_SREG_CS);
+
+ memcpy(&sel, ctxt->src.valptr + ctxt->op_bytes, 2);
+- if (load_segment_descriptor(ctxt, sel, VCPU_SREG_CS))
++ rc = __load_segment_descriptor(ctxt, sel, VCPU_SREG_CS, cpl, false,
++ &new_desc);
++ if (rc != X86EMUL_CONTINUE)
+ return X86EMUL_CONTINUE;
+
+- ctxt->_eip = 0;
+- memcpy(&ctxt->_eip, ctxt->src.valptr, ctxt->op_bytes);
++ rc = assign_eip_far(ctxt, ctxt->src.val, new_desc.l);
++ if (rc != X86EMUL_CONTINUE)
++ goto fail;
+
+ ctxt->src.val = old_cs;
+ rc = em_push(ctxt);
+ if (rc != X86EMUL_CONTINUE)
+- return rc;
++ goto fail;
+
+ ctxt->src.val = old_eip;
+- return em_push(ctxt);
++ rc = em_push(ctxt);
++ /* If we failed, we tainted the memory, but the very least we should
++ restore cs */
++ if (rc != X86EMUL_CONTINUE)
++ goto fail;
++ return rc;
++fail:
++ ops->set_segment(ctxt, old_cs, &old_desc, 0, VCPU_SREG_CS);
++ return rc;
++
+ }
+
+ static int em_ret_near_imm(struct x86_emulate_ctxt *ctxt)
+ {
+ int rc;
++ unsigned long eip;
+
+- ctxt->dst.type = OP_REG;
+- ctxt->dst.addr.reg = &ctxt->_eip;
+- ctxt->dst.bytes = ctxt->op_bytes;
+- rc = emulate_pop(ctxt, &ctxt->dst.val, ctxt->op_bytes);
++ rc = emulate_pop(ctxt, &eip, ctxt->op_bytes);
++ if (rc != X86EMUL_CONTINUE)
++ return rc;
++ rc = assign_eip_near(ctxt, eip);
+ if (rc != X86EMUL_CONTINUE)
+ return rc;
+ register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RSP], ctxt->src.val);
+@@ -2977,20 +3086,24 @@ static int em_lmsw(struct x86_emulate_ctxt *ctxt)
+
+ static int em_loop(struct x86_emulate_ctxt *ctxt)
+ {
++ int rc = X86EMUL_CONTINUE;
++
+ register_address_increment(ctxt, &ctxt->regs[VCPU_REGS_RCX], -1);
+ if ((address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) != 0) &&
+ (ctxt->b == 0xe2 || test_cc(ctxt->b ^ 0x5, ctxt->eflags)))
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+
+- return X86EMUL_CONTINUE;
++ return rc;
+ }
+
+ static int em_jcxz(struct x86_emulate_ctxt *ctxt)
+ {
++ int rc = X86EMUL_CONTINUE;
++
+ if (address_mask(ctxt, ctxt->regs[VCPU_REGS_RCX]) == 0)
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+
+- return X86EMUL_CONTINUE;
++ return rc;
+ }
+
+ static int em_in(struct x86_emulate_ctxt *ctxt)
+@@ -4168,7 +4281,7 @@ special_insn:
+ break;
+ case 0x70 ... 0x7f: /* jcc (short) */
+ if (test_cc(ctxt->b, ctxt->eflags))
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+ break;
+ case 0x8d: /* lea r16/r32, m */
+ ctxt->dst.val = ctxt->src.addr.mem.ea;
+@@ -4207,7 +4320,7 @@ special_insn:
+ break;
+ case 0xe9: /* jmp rel */
+ case 0xeb: /* jmp rel short */
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+ ctxt->dst.type = OP_NONE; /* Disable writeback. */
+ break;
+ case 0xf4: /* hlt */
+@@ -4310,7 +4423,7 @@ twobyte_insn:
+ break;
+ case 0x80 ... 0x8f: /* jnz rel, etc*/
+ if (test_cc(ctxt->b, ctxt->eflags))
+- jmp_rel(ctxt, ctxt->src.val);
++ rc = jmp_rel(ctxt, ctxt->src.val);
+ break;
+ case 0x90 ... 0x9f: /* setcc r/m8 */
+ ctxt->dst.val = test_cc(ctxt->b, ctxt->eflags);
+diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
+index d68f99df690c..db336f9f2c8c 100644
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -263,8 +263,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
+ return;
+
+ timer = &pit->pit_state.pit_timer.timer;
++ mutex_lock(&pit->pit_state.lock);
+ if (hrtimer_cancel(timer))
+ hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
++ mutex_unlock(&pit->pit_state.lock);
+ }
+
+ static void destroy_pit_timer(struct kvm_pit *pit)
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index fd6dec6ffa47..84f4bca0ca2c 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -2842,7 +2842,7 @@ static void mmu_sync_roots(struct kvm_vcpu *vcpu)
+ if (!VALID_PAGE(vcpu->arch.mmu.root_hpa))
+ return;
+
+- vcpu_clear_mmio_info(vcpu, ~0ul);
++ vcpu_clear_mmio_info(vcpu, MMIO_GVA_ANY);
+ kvm_mmu_audit(vcpu, AUDIT_PRE_SYNC);
+ if (vcpu->arch.mmu.root_level == PT64_ROOT_LEVEL) {
+ hpa_t root = vcpu->arch.mmu.root_hpa;
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index b567285efceb..86c74c0cd876 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3212,7 +3212,7 @@ static int wrmsr_interception(struct vcpu_svm *svm)
+
+
+ svm->next_rip = kvm_rip_read(&svm->vcpu) + 2;
+- if (svm_set_msr(&svm->vcpu, ecx, data)) {
++ if (kvm_set_msr(&svm->vcpu, ecx, data)) {
+ trace_kvm_msr_write_ex(ecx, data);
+ kvm_inject_gp(&svm->vcpu, 0);
+ } else {
+@@ -3494,9 +3494,9 @@ static int handle_exit(struct kvm_vcpu *vcpu)
+
+ if (exit_code >= ARRAY_SIZE(svm_exit_handlers)
+ || !svm_exit_handlers[exit_code]) {
+- kvm_run->exit_reason = KVM_EXIT_UNKNOWN;
+- kvm_run->hw.hardware_exit_reason = exit_code;
+- return 0;
++ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_code);
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
+ }
+
+ return svm_exit_handlers[exit_code](svm);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 617b00b4857b..2eb4e5af8816 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -388,6 +388,7 @@ struct vcpu_vmx {
+ u16 fs_sel, gs_sel, ldt_sel;
+ int gs_ldt_reload_needed;
+ int fs_reload_needed;
++ unsigned long vmcs_host_cr4; /* May not match real cr4 */
+ } host_state;
+ struct {
+ int vm86_active;
+@@ -2209,12 +2210,15 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
+ break;
+ msr = find_msr_entry(vmx, msr_index);
+ if (msr) {
++ u64 old_msr_data = msr->data;
+ msr->data = data;
+ if (msr - vmx->guest_msrs < vmx->save_nmsrs) {
+ preempt_disable();
+- kvm_set_shared_msr(msr->index, msr->data,
+- msr->mask);
++ ret = kvm_set_shared_msr(msr->index, msr->data,
++ msr->mask);
+ preempt_enable();
++ if (ret)
++ msr->data = old_msr_data;
+ }
+ break;
+ }
+@@ -3622,16 +3626,21 @@ static void vmx_disable_intercept_for_msr(u32 msr, bool longmode_only)
+ * Note that host-state that does change is set elsewhere. E.g., host-state
+ * that is set differently for each CPU is set in vmx_vcpu_load(), not here.
+ */
+-static void vmx_set_constant_host_state(void)
++static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+ {
+ u32 low32, high32;
+ unsigned long tmpl;
+ struct desc_ptr dt;
++ unsigned long cr4;
+
+ vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
+- vmcs_writel(HOST_CR4, read_cr4()); /* 22.2.3, 22.2.5 */
+ vmcs_writel(HOST_CR3, read_cr3()); /* 22.2.3 FIXME: shadow tables */
+
++ /* Save the most likely value for this task's CR4 in the VMCS. */
++ cr4 = read_cr4();
++ vmcs_writel(HOST_CR4, cr4); /* 22.2.3, 22.2.5 */
++ vmx->host_state.vmcs_host_cr4 = cr4;
++
+ vmcs_write16(HOST_CS_SELECTOR, __KERNEL_CS); /* 22.2.4 */
+ vmcs_write16(HOST_DS_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+ vmcs_write16(HOST_ES_SELECTOR, __KERNEL_DS); /* 22.2.4 */
+@@ -3753,7 +3762,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)
+
+ vmcs_write16(HOST_FS_SELECTOR, 0); /* 22.2.4 */
+ vmcs_write16(HOST_GS_SELECTOR, 0); /* 22.2.4 */
+- vmx_set_constant_host_state();
++ vmx_set_constant_host_state(vmx);
+ #ifdef CONFIG_X86_64
+ rdmsrl(MSR_FS_BASE, a);
+ vmcs_writel(HOST_FS_BASE, a); /* 22.2.4 */
+@@ -4539,7 +4548,7 @@ static int handle_wrmsr(struct kvm_vcpu *vcpu)
+ u64 data = (vcpu->arch.regs[VCPU_REGS_RAX] & -1u)
+ | ((u64)(vcpu->arch.regs[VCPU_REGS_RDX] & -1u) << 32);
+
+- if (vmx_set_msr(vcpu, ecx, data) != 0) {
++ if (kvm_set_msr(vcpu, ecx, data) != 0) {
+ trace_kvm_msr_write_ex(ecx, data);
+ kvm_inject_gp(vcpu, 0);
+ return 1;
+@@ -5557,6 +5566,18 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu)
+ return 1;
+ }
+
++static int handle_invept(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
++static int handle_invvpid(struct kvm_vcpu *vcpu)
++{
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
++}
++
+ /*
+ * The exit handlers return 1 if the exit was handled fully and guest execution
+ * may resume. Otherwise they set the kvm_run parameter to indicate what needs
+@@ -5599,6 +5620,8 @@ static int (*kvm_vmx_exit_handlers[])(struct kvm_vcpu *vcpu) = {
+ [EXIT_REASON_PAUSE_INSTRUCTION] = handle_pause,
+ [EXIT_REASON_MWAIT_INSTRUCTION] = handle_invalid_op,
+ [EXIT_REASON_MONITOR_INSTRUCTION] = handle_invalid_op,
++ [EXIT_REASON_INVEPT] = handle_invept,
++ [EXIT_REASON_INVVPID] = handle_invvpid,
+ };
+
+ static const int kvm_vmx_max_exit_handlers =
+@@ -5783,6 +5806,7 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu)
+ case EXIT_REASON_VMPTRST: case EXIT_REASON_VMREAD:
+ case EXIT_REASON_VMRESUME: case EXIT_REASON_VMWRITE:
+ case EXIT_REASON_VMOFF: case EXIT_REASON_VMON:
++ case EXIT_REASON_INVEPT: case EXIT_REASON_INVVPID:
+ /*
+ * VMX instructions trap unconditionally. This allows L1 to
+ * emulate them for its L2 guest, i.e., allows 3-level nesting!
+@@ -5912,10 +5936,10 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu)
+ && kvm_vmx_exit_handlers[exit_reason])
+ return kvm_vmx_exit_handlers[exit_reason](vcpu);
+ else {
+- vcpu->run->exit_reason = KVM_EXIT_UNKNOWN;
+- vcpu->run->hw.hardware_exit_reason = exit_reason;
++ WARN_ONCE(1, "vmx: unexpected exit reason 0x%x\n", exit_reason);
++ kvm_queue_exception(vcpu, UD_VECTOR);
++ return 1;
+ }
+- return 0;
+ }
+
+ static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
+@@ -6101,6 +6125,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx)
+ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ unsigned long cr4;
+
+ if (is_guest_mode(vcpu) && !vmx->nested.nested_run_pending) {
+ struct vmcs12 *vmcs12 = get_vmcs12(vcpu);
+@@ -6131,6 +6156,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+ if (test_bit(VCPU_REGS_RIP, (unsigned long *)&vcpu->arch.regs_dirty))
+ vmcs_writel(GUEST_RIP, vcpu->arch.regs[VCPU_REGS_RIP]);
+
++ cr4 = read_cr4();
++ if (unlikely(cr4 != vmx->host_state.vmcs_host_cr4)) {
++ vmcs_writel(HOST_CR4, cr4);
++ vmx->host_state.vmcs_host_cr4 = cr4;
++ }
++
+ /* When single-stepping over STI and MOV SS, we must clear the
+ * corresponding interruptibility bits in the guest state. Otherwise
+ * vmentry fails as it then expects bit 14 (BS) in pending debug
+@@ -6589,7 +6620,7 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12)
+ * Other fields are different per CPU, and will be set later when
+ * vmx_vcpu_load() is called, and when vmx_save_host_state() is called.
+ */
+- vmx_set_constant_host_state();
++ vmx_set_constant_host_state(vmx);
+
+ /*
+ * HOST_RSP is normally set correctly in vmx_vcpu_run() just before
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 4b1be290f6e3..318a2454366f 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -220,19 +220,24 @@ static void kvm_shared_msr_cpu_online(void)
+ shared_msr_update(i, shared_msrs_global.msrs[i]);
+ }
+
+-void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask)
++int kvm_set_shared_msr(unsigned slot, u64 value, u64 mask)
+ {
+ struct kvm_shared_msrs *smsr = &__get_cpu_var(shared_msrs);
++ int err;
+
+ if (((value ^ smsr->values[slot].curr) & mask) == 0)
+- return;
++ return 0;
+ smsr->values[slot].curr = value;
+- wrmsrl(shared_msrs_global.msrs[slot], value);
++ err = checking_wrmsrl(shared_msrs_global.msrs[slot], value);
++ if (err)
++ return 1;
++
+ if (!smsr->registered) {
+ smsr->urn.on_user_return = kvm_on_user_return;
+ user_return_notifier_register(&smsr->urn);
+ smsr->registered = true;
+ }
++ return 0;
+ }
+ EXPORT_SYMBOL_GPL(kvm_set_shared_msr);
+
+@@ -858,7 +863,6 @@ void kvm_enable_efer_bits(u64 mask)
+ }
+ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+
+-
+ /*
+ * Writes msr value into into the appropriate "register".
+ * Returns 0 on success, non-0 otherwise.
+@@ -866,8 +870,34 @@ EXPORT_SYMBOL_GPL(kvm_enable_efer_bits);
+ */
+ int kvm_set_msr(struct kvm_vcpu *vcpu, u32 msr_index, u64 data)
+ {
++ switch (msr_index) {
++ case MSR_FS_BASE:
++ case MSR_GS_BASE:
++ case MSR_KERNEL_GS_BASE:
++ case MSR_CSTAR:
++ case MSR_LSTAR:
++ if (is_noncanonical_address(data))
++ return 1;
++ break;
++ case MSR_IA32_SYSENTER_EIP:
++ case MSR_IA32_SYSENTER_ESP:
++ /*
++ * IA32_SYSENTER_ESP and IA32_SYSENTER_EIP cause #GP if
++ * non-canonical address is written on Intel but not on
++ * AMD (which ignores the top 32-bits, because it does
++ * not implement 64-bit SYSENTER).
++ *
++ * 64-bit code should hence be able to write a non-canonical
++ * value on AMD. Making the address canonical ensures that
++ * vmentry does not fail on Intel after writing a non-canonical
++ * value, and that something deterministic happens if the guest
++ * invokes 64-bit SYSENTER.
++ */
++ data = get_canonical(data);
++ }
+ return kvm_x86_ops->set_msr(vcpu, msr_index, data);
+ }
++EXPORT_SYMBOL_GPL(kvm_set_msr);
+
+ /*
+ * Adapt set_msr() to msr_io()'s calling convention
+diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h
+index cb80c293cdd8..1ce5611fdb09 100644
+--- a/arch/x86/kvm/x86.h
++++ b/arch/x86/kvm/x86.h
+@@ -78,15 +78,23 @@ static inline void vcpu_cache_mmio_info(struct kvm_vcpu *vcpu,
+ vcpu->arch.mmio_gva = gva & PAGE_MASK;
+ vcpu->arch.access = access;
+ vcpu->arch.mmio_gfn = gfn;
++ vcpu->arch.mmio_gen = kvm_memslots(vcpu->kvm)->generation;
++}
++
++static inline bool vcpu_match_mmio_gen(struct kvm_vcpu *vcpu)
++{
++ return vcpu->arch.mmio_gen == kvm_memslots(vcpu->kvm)->generation;
+ }
+
+ /*
+- * Clear the mmio cache info for the given gva,
+- * specially, if gva is ~0ul, we clear all mmio cache info.
++ * Clear the mmio cache info for the given gva. If gva is MMIO_GVA_ANY, we
++ * clear all mmio cache info.
+ */
++#define MMIO_GVA_ANY (~(gva_t)0)
++
+ static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva)
+ {
+- if (gva != (~0ul) && vcpu->arch.mmio_gva != (gva & PAGE_MASK))
++ if (gva != MMIO_GVA_ANY && vcpu->arch.mmio_gva != (gva & PAGE_MASK))
+ return;
+
+ vcpu->arch.mmio_gva = 0;
+@@ -94,7 +102,8 @@ static inline void vcpu_clear_mmio_info(struct kvm_vcpu *vcpu, gva_t gva)
+
+ static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva)
+ {
+- if (vcpu->arch.mmio_gva && vcpu->arch.mmio_gva == (gva & PAGE_MASK))
++ if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gva &&
++ vcpu->arch.mmio_gva == (gva & PAGE_MASK))
+ return true;
+
+ return false;
+@@ -102,7 +111,8 @@ static inline bool vcpu_match_mmio_gva(struct kvm_vcpu *vcpu, unsigned long gva)
+
+ static inline bool vcpu_match_mmio_gpa(struct kvm_vcpu *vcpu, gpa_t gpa)
+ {
+- if (vcpu->arch.mmio_gfn && vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT)
++ if (vcpu_match_mmio_gen(vcpu) && vcpu->arch.mmio_gfn &&
++ vcpu->arch.mmio_gfn == gpa >> PAGE_SHIFT)
+ return true;
+
+ return false;
+diff --git a/arch/xtensa/include/asm/unistd.h b/arch/xtensa/include/asm/unistd.h
+index 798ee6d285a1..7ab1f52f1fdd 100644
+--- a/arch/xtensa/include/asm/unistd.h
++++ b/arch/xtensa/include/asm/unistd.h
+@@ -394,7 +394,8 @@ __SYSCALL(174, sys_chroot, 1)
+ #define __NR_pivot_root 175
+ __SYSCALL(175, sys_pivot_root, 2)
+ #define __NR_umount 176
+-__SYSCALL(176, sys_umount, 2)
++__SYSCALL(176, sys_oldumount, 1)
++#define __ARCH_WANT_SYS_OLDUMOUNT
+ #define __NR_swapoff 177
+ __SYSCALL(177, sys_swapoff, 1)
+ #define __NR_sync 178
+diff --git a/block/blk-settings.c b/block/blk-settings.c
+index b74cc58bc038..14f1d3083cae 100644
+--- a/block/blk-settings.c
++++ b/block/blk-settings.c
+@@ -538,7 +538,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+ bottom = max(b->physical_block_size, b->io_min) + alignment;
+
+ /* Verify that top and bottom intervals line up */
+- if (max(top, bottom) & (min(top, bottom) - 1)) {
++ if (max(top, bottom) % min(top, bottom)) {
+ t->misaligned = 1;
+ ret = -1;
+ }
+@@ -579,7 +579,7 @@ int blk_stack_limits(struct queue_limits *t, struct queue_limits *b,
+
+ /* Find lowest common alignment_offset */
+ t->alignment_offset = lcm(t->alignment_offset, alignment)
+- & (max(t->physical_block_size, t->io_min) - 1);
++ % max(t->physical_block_size, t->io_min);
+
+ /* Verify that new alignment_offset is on a logical block boundary */
+ if (t->alignment_offset & (t->logical_block_size - 1)) {
+diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c
+index 9a87daa6f4fb..f1c00c9aec1a 100644
+--- a/block/scsi_ioctl.c
++++ b/block/scsi_ioctl.c
+@@ -505,7 +505,7 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
+
+ if (bytes && blk_rq_map_kern(q, rq, buffer, bytes, __GFP_WAIT)) {
+ err = DRIVER_ERROR << 24;
+- goto out;
++ goto error;
+ }
+
+ memset(sense, 0, sizeof(sense));
+@@ -515,7 +515,6 @@ int sg_scsi_ioctl(struct request_queue *q, struct gendisk *disk, fmode_t mode,
+
+ blk_execute_rq(q, disk, rq, 0);
+
+-out:
+ err = rq->errors & 0xff; /* only 8 bit SCSI status */
+ if (err) {
+ if (rq->sense_len && rq->sense) {
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index d366a75e6705..ca9a287b5864 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -313,6 +313,11 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
+ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
++ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
++ { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
++ { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
++ { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
+
+ /* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index d8af325a6bda..3723e5ec2b4d 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -2008,13 +2008,15 @@ static int ata_bus_softreset(struct ata_port *ap, unsigned int devmask,
+
+ DPRINTK("ata%u: bus reset via SRST\n", ap->print_id);
+
+- /* software reset. causes dev0 to be selected */
+- iowrite8(ap->ctl, ioaddr->ctl_addr);
+- udelay(20); /* FIXME: flush */
+- iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr);
+- udelay(20); /* FIXME: flush */
+- iowrite8(ap->ctl, ioaddr->ctl_addr);
+- ap->last_ctl = ap->ctl;
++ if (ap->ioaddr.ctl_addr) {
++ /* software reset. causes dev0 to be selected */
++ iowrite8(ap->ctl, ioaddr->ctl_addr);
++ udelay(20); /* FIXME: flush */
++ iowrite8(ap->ctl | ATA_SRST, ioaddr->ctl_addr);
++ udelay(20); /* FIXME: flush */
++ iowrite8(ap->ctl, ioaddr->ctl_addr);
++ ap->last_ctl = ap->ctl;
++ }
+
+ /* wait the port to become ready */
+ return ata_sff_wait_after_reset(&ap->link, devmask, deadline);
+@@ -2215,10 +2217,6 @@ void ata_sff_error_handler(struct ata_port *ap)
+
+ spin_unlock_irqrestore(ap->lock, flags);
+
+- /* ignore ata_sff_softreset if ctl isn't accessible */
+- if (softreset == ata_sff_softreset && !ap->ioaddr.ctl_addr)
+- softreset = NULL;
+-
+ /* ignore built-in hardresets if SCR access is not available */
+ if ((hardreset == sata_std_hardreset ||
+ hardreset == sata_sff_hardreset) && !sata_scr_valid(&ap->link))
+diff --git a/drivers/ata/pata_serverworks.c b/drivers/ata/pata_serverworks.c
+index 71eaf385e970..5929dde07c91 100644
+--- a/drivers/ata/pata_serverworks.c
++++ b/drivers/ata/pata_serverworks.c
+@@ -252,12 +252,18 @@ static void serverworks_set_dmamode(struct ata_port *ap, struct ata_device *adev
+ pci_write_config_byte(pdev, 0x54, ultra_cfg);
+ }
+
+-static struct scsi_host_template serverworks_sht = {
++static struct scsi_host_template serverworks_osb4_sht = {
++ ATA_BMDMA_SHT(DRV_NAME),
++ .sg_tablesize = LIBATA_DUMB_MAX_PRD,
++};
++
++static struct scsi_host_template serverworks_csb_sht = {
+ ATA_BMDMA_SHT(DRV_NAME),
+ };
+
+ static struct ata_port_operations serverworks_osb4_port_ops = {
+ .inherits = &ata_bmdma_port_ops,
++ .qc_prep = ata_bmdma_dumb_qc_prep,
+ .cable_detect = serverworks_cable_detect,
+ .mode_filter = serverworks_osb4_filter,
+ .set_piomode = serverworks_set_piomode,
+@@ -266,6 +272,7 @@ static struct ata_port_operations serverworks_osb4_port_ops = {
+
+ static struct ata_port_operations serverworks_csb_port_ops = {
+ .inherits = &serverworks_osb4_port_ops,
++ .qc_prep = ata_bmdma_qc_prep,
+ .mode_filter = serverworks_csb_filter,
+ };
+
+@@ -405,6 +412,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id
+ }
+ };
+ const struct ata_port_info *ppi[] = { &info[id->driver_data], NULL };
++ struct scsi_host_template *sht = &serverworks_csb_sht;
+ int rc;
+
+ rc = pcim_enable_device(pdev);
+@@ -418,6 +426,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id
+ /* Select non UDMA capable OSB4 if we can't do fixups */
+ if (rc < 0)
+ ppi[0] = &info[1];
++ sht = &serverworks_osb4_sht;
+ }
+ /* setup CSB5/CSB6 : South Bridge and IDE option RAID */
+ else if ((pdev->device == PCI_DEVICE_ID_SERVERWORKS_CSB5IDE) ||
+@@ -434,7 +443,7 @@ static int serverworks_init_one(struct pci_dev *pdev, const struct pci_device_id
+ ppi[1] = &ata_dummy_port_info;
+ }
+
+- return ata_pci_bmdma_init_one(pdev, ppi, &serverworks_sht, NULL, 0);
++ return ata_pci_bmdma_init_one(pdev, ppi, sht, NULL, 0);
+ }
+
+ #ifdef CONFIG_PM
+diff --git a/drivers/base/core.c b/drivers/base/core.c
+index e28ce9898af4..32e86d6f141c 100644
+--- a/drivers/base/core.c
++++ b/drivers/base/core.c
+@@ -718,12 +718,12 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj)
+ return &dir->kobj;
+ }
+
++static DEFINE_MUTEX(gdp_mutex);
+
+ static struct kobject *get_device_parent(struct device *dev,
+ struct device *parent)
+ {
+ if (dev->class) {
+- static DEFINE_MUTEX(gdp_mutex);
+ struct kobject *kobj = NULL;
+ struct kobject *parent_kobj;
+ struct kobject *k;
+@@ -787,7 +787,9 @@ static void cleanup_glue_dir(struct device *dev, struct kobject *glue_dir)
+ glue_dir->kset != &dev->class->p->glue_dirs)
+ return;
+
++ mutex_lock(&gdp_mutex);
+ kobject_put(glue_dir);
++ mutex_unlock(&gdp_mutex);
+ }
+
+ static void cleanup_device_parent(struct device *dev)
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index 5401814c874d..b7a4fe586f8a 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -588,6 +588,9 @@ request_firmware(const struct firmware **firmware_p, const char *name,
+ struct firmware_priv *fw_priv;
+ int ret;
+
++ if (!name || name[0] == '\0')
++ return -EINVAL;
++
+ fw_priv = _request_firmware_prepare(firmware_p, name, device, true,
+ false);
+ if (IS_ERR_OR_NULL(fw_priv))
+diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
+index 8ab1eab90be7..1db12895110a 100644
+--- a/drivers/base/regmap/regmap-debugfs.c
++++ b/drivers/base/regmap/regmap-debugfs.c
+@@ -244,7 +244,12 @@ static const struct file_operations regmap_access_fops = {
+
+ void regmap_debugfs_init(struct regmap *map)
+ {
+- map->debugfs = debugfs_create_dir(dev_name(map->dev),
++ const char *devname = "dummy";
++
++ if (map->dev)
++ devname = dev_name(map->dev);
++
++ map->debugfs = debugfs_create_dir(devname,
+ regmap_debugfs_root);
+ if (!map->debugfs) {
+ dev_warn(map->dev, "Failed to create debugfs directory\n");
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index e5545427b46b..8e81f85b1ba0 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -600,6 +600,11 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
+ if (val_bytes == 1) {
+ wval = (void *)val;
+ } else {
++ if (!val_count) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ wval = kmemdup(val, val_count * val_bytes, GFP_KERNEL);
+ if (!wval) {
+ ret = -ENOMEM;
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 3cc242535012..155a61841e2b 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -304,6 +304,9 @@ static void btusb_intr_complete(struct urb *urb)
+ BT_ERR("%s corrupted event packet", hdev->name);
+ hdev->stat.err_rx++;
+ }
++ } else if (urb->status == -ENOENT) {
++ /* Avoid suspend failed when usb_kill_urb */
++ return;
+ }
+
+ if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
+@@ -392,6 +395,9 @@ static void btusb_bulk_complete(struct urb *urb)
+ BT_ERR("%s corrupted ACL packet", hdev->name);
+ hdev->stat.err_rx++;
+ }
++ } else if (urb->status == -ENOENT) {
++ /* Avoid suspend failed when usb_kill_urb */
++ return;
+ }
+
+ if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
+@@ -486,6 +492,9 @@ static void btusb_isoc_complete(struct urb *urb)
+ hdev->stat.err_rx++;
+ }
+ }
++ } else if (urb->status == -ENOENT) {
++ /* Avoid suspend failed when usb_kill_urb */
++ return;
+ }
+
+ if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
+diff --git a/drivers/char/random.c b/drivers/char/random.c
+index 1052fc4cae66..85172faa1569 100644
+--- a/drivers/char/random.c
++++ b/drivers/char/random.c
+@@ -932,8 +932,8 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
+ * pool while mixing, and hash one final time.
+ */
+ sha_transform(hash.w, extract, workspace);
+- memset(extract, 0, sizeof(extract));
+- memset(workspace, 0, sizeof(workspace));
++ memzero_explicit(extract, sizeof(extract));
++ memzero_explicit(workspace, sizeof(workspace));
+
+ /*
+ * In case the hash function has some recognizable output
+@@ -956,7 +956,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out)
+ }
+
+ memcpy(out, &hash, EXTRACT_SIZE);
+- memset(&hash, 0, sizeof(hash));
++ memzero_explicit(&hash, sizeof(hash));
+ }
+
+ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+@@ -989,7 +989,7 @@ static ssize_t extract_entropy(struct entropy_store *r, void *buf,
+ }
+
+ /* Wipe data just returned from memory */
+- memset(tmp, 0, sizeof(tmp));
++ memzero_explicit(tmp, sizeof(tmp));
+
+ return ret;
+ }
+@@ -1027,7 +1027,7 @@ static ssize_t extract_entropy_user(struct entropy_store *r, void __user *buf,
+ }
+
+ /* Wipe data just returned from memory */
+- memset(tmp, 0, sizeof(tmp));
++ memzero_explicit(tmp, sizeof(tmp));
+
+ return ret;
+ }
+diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
+index 7f2f149ae40f..cf864ef8d181 100644
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -371,7 +371,18 @@ show_one(cpuinfo_max_freq, cpuinfo.max_freq);
+ show_one(cpuinfo_transition_latency, cpuinfo.transition_latency);
+ show_one(scaling_min_freq, min);
+ show_one(scaling_max_freq, max);
+-show_one(scaling_cur_freq, cur);
++
++static ssize_t show_scaling_cur_freq(
++ struct cpufreq_policy *policy, char *buf)
++{
++ ssize_t ret;
++
++ if (cpufreq_driver && cpufreq_driver->setpolicy && cpufreq_driver->get)
++ ret = sprintf(buf, "%u\n", cpufreq_driver->get(policy->cpu));
++ else
++ ret = sprintf(buf, "%u\n", policy->cur);
++ return ret;
++}
+
+ static int __cpufreq_set_policy(struct cpufreq_policy *data,
+ struct cpufreq_policy *policy);
+@@ -818,11 +829,11 @@ static int cpufreq_add_dev_interface(unsigned int cpu,
+ if (ret)
+ goto err_out_kobj_put;
+ }
+- if (cpufreq_driver->target) {
+- ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
+- if (ret)
+- goto err_out_kobj_put;
+- }
++
++ ret = sysfs_create_file(&policy->kobj, &scaling_cur_freq.attr);
++ if (ret)
++ goto err_out_kobj_put;
++
+ if (cpufreq_driver->bios_limit) {
+ ret = sysfs_create_file(&policy->kobj, &bios_limit.attr);
+ if (ret)
+diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
+index 73464a62adf7..0f0bf1a2ae1a 100644
+--- a/drivers/edac/mpc85xx_edac.c
++++ b/drivers/edac/mpc85xx_edac.c
+@@ -577,7 +577,8 @@ static int __devinit mpc85xx_l2_err_probe(struct platform_device *op)
+ if (edac_op_state == EDAC_OPSTATE_INT) {
+ pdata->irq = irq_of_parse_and_map(op->dev.of_node, 0);
+ res = devm_request_irq(&op->dev, pdata->irq,
+- mpc85xx_l2_isr, IRQF_DISABLED,
++ mpc85xx_l2_isr,
++ IRQF_DISABLED | IRQF_SHARED,
+ "[EDAC] L2 err", edac_dev);
+ if (res < 0) {
+ printk(KERN_ERR
+diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
+index b558810b2da0..b449572cb800 100644
+--- a/drivers/firewire/core-cdev.c
++++ b/drivers/firewire/core-cdev.c
+@@ -1619,8 +1619,7 @@ static int dispatch_ioctl(struct client *client,
+ _IOC_SIZE(cmd) > sizeof(buffer))
+ return -ENOTTY;
+
+- if (_IOC_DIR(cmd) == _IOC_READ)
+- memset(&buffer, 0, _IOC_SIZE(cmd));
++ memset(&buffer, 0, sizeof(buffer));
+
+ if (_IOC_DIR(cmd) & _IOC_WRITE)
+ if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
+diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
+index df62c393f2f5..01434ef9e00f 100644
+--- a/drivers/gpu/drm/radeon/evergreen.c
++++ b/drivers/gpu/drm/radeon/evergreen.c
+@@ -1176,6 +1176,7 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
+ WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
+ tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+ WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
++ WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
+ }
+ } else {
+ tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+index 00fb5aa2bf77..7ca1d472d7cb 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+@@ -1915,6 +1915,14 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
+ DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_PVSYNC)
+ };
+ int i;
++ u32 assumed_bpp = 2;
++
++ /*
++ * If using screen objects, then assume 32-bpp because that's what the
++ * SVGA device is assuming
++ */
++ if (dev_priv->sou_priv)
++ assumed_bpp = 4;
+
+ /* Add preferred mode */
+ {
+@@ -1925,8 +1933,9 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
+ mode->vdisplay = du->pref_height;
+ vmw_guess_mode_timing(mode);
+
+- if (vmw_kms_validate_mode_vram(dev_priv, mode->hdisplay * 2,
+- mode->vdisplay)) {
++ if (vmw_kms_validate_mode_vram(dev_priv,
++ mode->hdisplay * assumed_bpp,
++ mode->vdisplay)) {
+ drm_mode_probed_add(connector, mode);
+ } else {
+ drm_mode_destroy(dev, mode);
+@@ -1948,7 +1957,8 @@ int vmw_du_connector_fill_modes(struct drm_connector *connector,
+ bmode->vdisplay > max_height)
+ continue;
+
+- if (!vmw_kms_validate_mode_vram(dev_priv, bmode->hdisplay * 2,
++ if (!vmw_kms_validate_mode_vram(dev_priv,
++ bmode->hdisplay * assumed_bpp,
+ bmode->vdisplay))
+ continue;
+
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index f4c3d28cd1fc..3c8b2c473b81 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -207,8 +207,10 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ ret = vmbus_post_msg(open_msg,
+ sizeof(struct vmbus_channel_open_channel));
+
+- if (ret != 0)
++ if (ret != 0) {
++ err = ret;
+ goto error1;
++ }
+
+ t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ);
+ if (t == 0) {
+@@ -400,7 +402,6 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+ u32 next_gpadl_handle;
+ unsigned long flags;
+ int ret = 0;
+- int t;
+
+ next_gpadl_handle = atomic_read(&vmbus_connection.next_gpadl_handle);
+ atomic_inc(&vmbus_connection.next_gpadl_handle);
+@@ -447,9 +448,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+
+ }
+ }
+- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+- BUG_ON(t == 0);
+-
++ wait_for_completion(&msginfo->waitevent);
+
+ /* At this point, we received the gpadl created msg */
+ *gpadl_handle = gpadlmsg->gpadl;
+@@ -472,7 +471,7 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
+ struct vmbus_channel_gpadl_teardown *msg;
+ struct vmbus_channel_msginfo *info;
+ unsigned long flags;
+- int ret, t;
++ int ret;
+
+ info = kmalloc(sizeof(*info) +
+ sizeof(struct vmbus_channel_gpadl_teardown), GFP_KERNEL);
+@@ -494,11 +493,12 @@ int vmbus_teardown_gpadl(struct vmbus_channel *channel, u32 gpadl_handle)
+ ret = vmbus_post_msg(msg,
+ sizeof(struct vmbus_channel_gpadl_teardown));
+
+- BUG_ON(ret != 0);
+- t = wait_for_completion_timeout(&info->waitevent, 5*HZ);
+- BUG_ON(t == 0);
++ if (ret)
++ goto post_msg_err;
++
++ wait_for_completion(&info->waitevent);
+
+- /* Received a torndown response */
++post_msg_err:
+ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags);
+ list_del(&info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+@@ -531,11 +531,28 @@ void vmbus_close(struct vmbus_channel *channel)
+
+ ret = vmbus_post_msg(msg, sizeof(struct vmbus_channel_close_channel));
+
+- BUG_ON(ret != 0);
++ if (ret) {
++ pr_err("Close failed: close post msg return is %d\n", ret);
++ /*
++ * If we failed to post the close msg,
++ * it is perhaps better to leak memory.
++ */
++ return;
++ }
++
+ /* Tear down the gpadl for the channel's ring buffer */
+- if (channel->ringbuffer_gpadlhandle)
+- vmbus_teardown_gpadl(channel,
+- channel->ringbuffer_gpadlhandle);
++ if (channel->ringbuffer_gpadlhandle) {
++ ret = vmbus_teardown_gpadl(channel,
++ channel->ringbuffer_gpadlhandle);
++ if (ret) {
++ pr_err("Close failed: teardown gpadl return %d\n", ret);
++ /*
++ * If we failed to teardown gpadl,
++ * it is perhaps better to leak memory.
++ */
++ return;
++ }
++ }
+
+ /* Cleanup the ring buffers for this channel */
+ hv_ringbuffer_cleanup(&channel->outbound);
+@@ -543,8 +560,6 @@ void vmbus_close(struct vmbus_channel *channel)
+
+ free_pages((unsigned long)channel->ringbuffer_pages,
+ get_order(channel->ringbuffer_pagecount * PAGE_SIZE));
+-
+-
+ }
+ EXPORT_SYMBOL_GPL(vmbus_close);
+
+diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
+index 650c9f0b6642..2d52a1b15b35 100644
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -294,10 +294,21 @@ int vmbus_post_msg(void *buffer, size_t buflen)
+ * insufficient resources. Retry the operation a couple of
+ * times before giving up.
+ */
+- while (retries < 3) {
+- ret = hv_post_message(conn_id, 1, buffer, buflen);
+- if (ret != HV_STATUS_INSUFFICIENT_BUFFERS)
++ while (retries < 10) {
++ ret = hv_post_message(conn_id, 1, buffer, buflen);
++
++ switch (ret) {
++ case HV_STATUS_INSUFFICIENT_BUFFERS:
++ ret = -ENOMEM;
++ case -ENOMEM:
++ break;
++ case HV_STATUS_SUCCESS:
+ return ret;
++ default:
++ pr_err("hv_post_msg() failed; error code:%d\n", ret);
++ return -EINVAL;
++ }
++
+ retries++;
+ msleep(100);
+ }
+diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
+index ff0b71a7e8e1..6bd8e81cfd9d 100644
+--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
+@@ -2146,6 +2146,7 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
+ if (!qp_init)
+ goto out;
+
++retry:
+ ch->cq = ib_create_cq(sdev->device, srpt_completion, NULL, ch,
+ ch->rq_size + srp_sq_size, 0);
+ if (IS_ERR(ch->cq)) {
+@@ -2169,6 +2170,13 @@ static int srpt_create_ch_ib(struct srpt_rdma_ch *ch)
+ ch->qp = ib_create_qp(sdev->pd, qp_init);
+ if (IS_ERR(ch->qp)) {
+ ret = PTR_ERR(ch->qp);
++ if (ret == -ENOMEM) {
++ srp_sq_size /= 2;
++ if (srp_sq_size >= MIN_SRPT_SQ_SIZE) {
++ ib_destroy_cq(ch->cq);
++ goto retry;
++ }
++ }
+ printk(KERN_ERR "failed to create_qp ret= %d\n", ret);
+ goto err_destroy_cq;
+ }
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 4c6a72d3d48c..9854a1ff5ab5 100644
+--- a/drivers/input/mouse/alps.c
++++ b/drivers/input/mouse/alps.c
+@@ -787,7 +787,13 @@ static psmouse_ret_t alps_process_byte(struct psmouse *psmouse)
+ struct alps_data *priv = psmouse->private;
+ const struct alps_model_info *model = priv->i;
+
+- if ((psmouse->packet[0] & 0xc8) == 0x08) { /* PS/2 packet */
++ /*
++ * Check if we are dealing with a bare PS/2 packet, presumably from
++ * a device connected to the external PS/2 port. Because bare PS/2
++ * protocol does not have enough constant bits to self-synchronize
++ * properly we only do this if the device is fully synchronized.
++ */
++ if (!psmouse->out_of_sync_cnt && (psmouse->packet[0] & 0xc8) == 0x08) {
+ if (psmouse->pktcnt == 3) {
+ alps_report_bare_ps2_packet(psmouse, psmouse->packet,
+ true);
+@@ -1619,6 +1625,9 @@ int alps_init(struct psmouse *psmouse)
+ /* We are having trouble resyncing ALPS touchpads so disable it for now */
+ psmouse->resync_time = 0;
+
++ /* Allow 2 invalid packets without resetting device */
++ psmouse->resetafter = psmouse->pktsize * 2;
++
+ return 0;
+
+ init_fail:
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 32b1363f7ace..97e5f6f797b4 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -506,6 +506,8 @@ static void synaptics_parse_agm(const unsigned char buf[],
+ priv->agm_pending = true;
+ }
+
++static bool is_forcepad;
++
+ static int synaptics_parse_hw_state(const unsigned char buf[],
+ struct synaptics_data *priv,
+ struct synaptics_hw_state *hw)
+@@ -535,7 +537,7 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ hw->left = (buf[0] & 0x01) ? 1 : 0;
+ hw->right = (buf[0] & 0x02) ? 1 : 0;
+
+- if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) {
++ if (is_forcepad) {
+ /*
+ * ForcePads, like Clickpads, use middle button
+ * bits to report primary button clicks.
+@@ -1512,6 +1514,18 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ { }
+ };
+
++static const struct dmi_system_id forcepad_dmi_table[] __initconst = {
++#if defined(CONFIG_DMI) && defined(CONFIG_X86)
++ {
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP EliteBook Folio 1040 G1"),
++ },
++ },
++#endif
++ { }
++};
++
+ void __init synaptics_module_init(void)
+ {
+ const struct dmi_system_id *min_max_dmi;
+@@ -1522,6 +1536,12 @@ void __init synaptics_module_init(void)
+ min_max_dmi = dmi_first_match(min_max_dmi_table);
+ if (min_max_dmi)
+ quirk_min_max = min_max_dmi->driver_data;
++
++ /*
++ * Unfortunately ForcePad capability is not exported over PS/2,
++ * so we have to resort to checking DMI.
++ */
++ is_forcepad = dmi_check_system(forcepad_dmi_table);
+ }
+
+ static int __synaptics_init(struct psmouse *psmouse, bool absolute_mode)
+diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
+index ac1b77354cac..20d861b4e326 100644
+--- a/drivers/input/mouse/synaptics.h
++++ b/drivers/input/mouse/synaptics.h
+@@ -76,12 +76,9 @@
+ * for noise.
+ * 2 0x08 image sensor image sensor tracks 5 fingers, but only
+ * reports 2.
++ * 2 0x01 uniform clickpad whole clickpad moves instead of being
++ * hinged at the top.
+ * 2 0x20 report min query 0x0f gives min coord reported
+- * 2 0x80 forcepad forcepad is a variant of clickpad that
+- * does not have physical buttons but rather
+- * uses pressure above certain threshold to
+- * report primary clicks. Forcepads also have
+- * clickpad bit set.
+ */
+ #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */
+ #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */
+@@ -90,7 +87,6 @@
+ #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000)
+ #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
+ #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800)
+-#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000)
+
+ /* synaptics modes query bits */
+ #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7))
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 1291673bd57e..ce715b1bee46 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -101,6 +101,12 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ },
+ {
+ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X750LN"),
++ },
++ },
++ {
++ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
+ DMI_MATCH(DMI_PRODUCT_NAME , "ProLiant"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "8500"),
+@@ -609,6 +615,22 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+ },
+ },
+ {
++ /* Fujitsu A544 laptop */
++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1111138 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK A544"),
++ },
++ },
++ {
++ /* Fujitsu AH544 laptop */
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK AH544"),
++ },
++ },
++ {
+ /* Fujitsu U574 laptop */
+ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
+ .matches = {
+diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
+index 6f99500790b3..535b09cd3cd8 100644
+--- a/drivers/md/dm-bufio.c
++++ b/drivers/md/dm-bufio.c
+@@ -467,6 +467,7 @@ static void __relink_lru(struct dm_buffer *b, int dirty)
+ b->list_mode = dirty;
+ list_del(&b->lru_list);
+ list_add(&b->lru_list, &c->lru[dirty]);
++ b->last_accessed = jiffies;
+ }
+
+ /*----------------------------------------------------------------
+@@ -1378,9 +1379,9 @@ static void drop_buffers(struct dm_bufio_client *c)
+
+ /*
+ * Test if the buffer is unused and too old, and commit it.
+- * At if noio is set, we must not do any I/O because we hold
+- * dm_bufio_clients_lock and we would risk deadlock if the I/O gets rerouted to
+- * different bufio client.
++ * And if GFP_NOFS is used, we must not do any I/O because we hold
++ * dm_bufio_clients_lock and we would risk deadlock if the I/O gets
++ * rerouted to different bufio client.
+ */
+ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
+ unsigned long max_jiffies)
+@@ -1388,7 +1389,7 @@ static int __cleanup_old_buffer(struct dm_buffer *b, gfp_t gfp,
+ if (jiffies - b->last_accessed < max_jiffies)
+ return 1;
+
+- if (!(gfp & __GFP_IO)) {
++ if (!(gfp & __GFP_FS)) {
+ if (test_bit(B_READING, &b->state) ||
+ test_bit(B_WRITING, &b->state) ||
+ test_bit(B_DIRTY, &b->state))
+@@ -1427,7 +1428,7 @@ static int shrink(struct shrinker *shrinker, struct shrink_control *sc)
+ unsigned long r;
+ unsigned long nr_to_scan = sc->nr_to_scan;
+
+- if (sc->gfp_mask & __GFP_IO)
++ if (sc->gfp_mask & __GFP_FS)
+ dm_bufio_lock(c);
+ else if (!dm_bufio_trylock(c))
+ return !nr_to_scan ? 0 : -1;
+diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
+index 08d9a207259a..c69d0b787746 100644
+--- a/drivers/md/dm-log-userspace-transfer.c
++++ b/drivers/md/dm-log-userspace-transfer.c
+@@ -272,7 +272,7 @@ int dm_ulog_tfr_init(void)
+
+ r = cn_add_callback(&ulog_cn_id, "dmlogusr", cn_ulog_callback);
+ if (r) {
+- cn_del_callback(&ulog_cn_id);
++ kfree(prealloced_cn_msg);
+ return r;
+ }
+
+diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
+index ead5ca99a749..5dea02cff622 100644
+--- a/drivers/md/dm-raid.c
++++ b/drivers/md/dm-raid.c
+@@ -592,8 +592,7 @@ struct dm_raid_superblock {
+ __le32 layout;
+ __le32 stripe_sectors;
+
+- __u8 pad[452]; /* Round struct to 512 bytes. */
+- /* Always set to 0 when writing. */
++ /* Remainder of a logical block is zero-filled when writing (see super_sync()). */
+ } __packed;
+
+ static int read_disk_sb(struct md_rdev *rdev, int size)
+@@ -628,7 +627,7 @@ static void super_sync(struct mddev *mddev, struct md_rdev *rdev)
+ if ((r->raid_disk >= 0) && test_bit(Faulty, &r->flags))
+ failed_devices |= (1ULL << r->raid_disk);
+
+- memset(sb, 0, sizeof(*sb));
++ memset(sb + 1, 0, rdev->sb_size - sizeof(*sb));
+
+ sb->magic = cpu_to_le32(DM_RAID_MAGIC);
+ sb->features = cpu_to_le32(0); /* No features yet */
+@@ -663,7 +662,11 @@ static int super_load(struct md_rdev *rdev, struct md_rdev *refdev)
+ uint64_t events_sb, events_refsb;
+
+ rdev->sb_start = 0;
+- rdev->sb_size = sizeof(*sb);
++ rdev->sb_size = bdev_logical_block_size(rdev->meta_bdev);
++ if (rdev->sb_size < sizeof(*sb) || rdev->sb_size > PAGE_SIZE) {
++ DMERR("superblock size of a logical block is no longer valid");
++ return -EINVAL;
++ }
+
+ ret = read_disk_sb(rdev, rdev->sb_size);
+ if (ret)
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index c2cdefa1651e..d4f7f9537db2 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -359,7 +359,7 @@ void can_free_echo_skb(struct net_device *dev, unsigned int idx)
+ BUG_ON(idx >= priv->echo_skb_max);
+
+ if (priv->echo_skb[idx]) {
+- kfree_skb(priv->echo_skb[idx]);
++ dev_kfree_skb_any(priv->echo_skb[idx]);
+ priv->echo_skb[idx] = NULL;
+ }
+ }
+diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
+index 09b1da5bc512..6c8423411dd8 100644
+--- a/drivers/net/can/usb/esd_usb2.c
++++ b/drivers/net/can/usb/esd_usb2.c
+@@ -1094,6 +1094,7 @@ static void esd_usb2_disconnect(struct usb_interface *intf)
+ }
+ }
+ unlink_all_urbs(dev);
++ kfree(dev);
+ }
+ }
+
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index f5b9de48bb82..c19f9447b200 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -17,6 +17,7 @@
+ #include <linux/idr.h>
+ #include <linux/fs.h>
+
++#include <net/ipv6.h>
+ #include <net/net_namespace.h>
+ #include <net/rtnetlink.h>
+ #include <net/sock.h>
+@@ -578,6 +579,8 @@ static int macvtap_skb_from_vnet_hdr(struct sk_buff *skb,
+ break;
+ case VIRTIO_NET_HDR_GSO_UDP:
+ gso_type = SKB_GSO_UDP;
++ if (skb->protocol == htons(ETH_P_IPV6))
++ ipv6_proxy_select_ident(skb);
+ break;
+ default:
+ return -EINVAL;
+@@ -634,6 +637,8 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
+ if (skb->ip_summed == CHECKSUM_PARTIAL) {
+ vnet_hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
+ vnet_hdr->csum_start = skb_checksum_start_offset(skb);
++ if (vlan_tx_tag_present(skb))
++ vnet_hdr->csum_start += VLAN_HLEN;
+ vnet_hdr->csum_offset = skb->csum_offset;
+ } else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
+ vnet_hdr->flags = VIRTIO_NET_HDR_F_DATA_VALID;
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 21d7151fb0ab..1207bb19ba58 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -588,7 +588,7 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ if (file == ppp->owner)
+ ppp_shutdown_interface(ppp);
+ }
+- if (atomic_long_read(&file->f_count) <= 2) {
++ if (atomic_long_read(&file->f_count) < 2) {
+ ppp_release(NULL, file);
+ err = 0;
+ } else
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 5b1a1b51fdb0..84b95c9b15f6 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -64,6 +64,7 @@
+ #include <linux/nsproxy.h>
+ #include <linux/virtio_net.h>
+ #include <linux/rcupdate.h>
++#include <net/ipv6.h>
+ #include <net/net_namespace.h>
+ #include <net/netns/generic.h>
+ #include <net/rtnetlink.h>
+@@ -696,6 +697,8 @@ static ssize_t tun_get_user(struct tun_struct *tun,
+ break;
+ }
+
++ skb_reset_network_header(skb);
++
+ if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+ pr_debug("GSO!\n");
+ switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+@@ -707,6 +710,8 @@ static ssize_t tun_get_user(struct tun_struct *tun,
+ break;
+ case VIRTIO_NET_HDR_GSO_UDP:
+ skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
++ if (skb->protocol == htons(ETH_P_IPV6))
++ ipv6_proxy_select_ident(skb);
+ break;
+ default:
+ tun->dev->stats.rx_frame_errors++;
+diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
+index 063bfa8b91f4..9105493445bd 100644
+--- a/drivers/net/wireless/rt2x00/rt2800.h
++++ b/drivers/net/wireless/rt2x00/rt2800.h
+@@ -1751,7 +1751,7 @@ struct mac_iveiv_entry {
+ * 2 - drop tx power by 12dBm,
+ * 3 - increase tx power by 6dBm
+ */
+-#define BBP1_TX_POWER_CTRL FIELD8(0x07)
++#define BBP1_TX_POWER_CTRL FIELD8(0x03)
+ #define BBP1_TX_ANTENNA FIELD8(0x18)
+
+ /*
+diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
+index 664e93d2a682..49baf0cfe304 100644
+--- a/drivers/net/wireless/rt2x00/rt2800usb.c
++++ b/drivers/net/wireless/rt2x00/rt2800usb.c
+@@ -1081,6 +1081,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
+ /* Ovislink */
+ { USB_DEVICE(0x1b75, 0x3071) },
+ { USB_DEVICE(0x1b75, 0x3072) },
++ { USB_DEVICE(0x1b75, 0xa200) },
+ /* Para */
+ { USB_DEVICE(0x20b8, 0x8888) },
+ /* Pegatron */
+diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
+index 4d792a242c5e..c5bdbe94aec8 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
+@@ -148,55 +148,29 @@ void rt2x00queue_align_frame(struct sk_buff *skb)
+ skb_trim(skb, frame_length);
+ }
+
+-void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int header_length)
++/*
++ * H/W needs L2 padding between the header and the paylod if header size
++ * is not 4 bytes aligned.
++ */
++void rt2x00queue_insert_l2pad(struct sk_buff *skb, unsigned int hdr_len)
+ {
+- unsigned int payload_length = skb->len - header_length;
+- unsigned int header_align = ALIGN_SIZE(skb, 0);
+- unsigned int payload_align = ALIGN_SIZE(skb, header_length);
+- unsigned int l2pad = payload_length ? L2PAD_SIZE(header_length) : 0;
++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
+
+- /*
+- * Adjust the header alignment if the payload needs to be moved more
+- * than the header.
+- */
+- if (payload_align > header_align)
+- header_align += 4;
+-
+- /* There is nothing to do if no alignment is needed */
+- if (!header_align)
++ if (!l2pad)
+ return;
+
+- /* Reserve the amount of space needed in front of the frame */
+- skb_push(skb, header_align);
+-
+- /*
+- * Move the header.
+- */
+- memmove(skb->data, skb->data + header_align, header_length);
+-
+- /* Move the payload, if present and if required */
+- if (payload_length && payload_align)
+- memmove(skb->data + header_length + l2pad,
+- skb->data + header_length + l2pad + payload_align,
+- payload_length);
+-
+- /* Trim the skb to the correct size */
+- skb_trim(skb, header_length + l2pad + payload_length);
++ skb_push(skb, l2pad);
++ memmove(skb->data, skb->data + l2pad, hdr_len);
+ }
+
+-void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int header_length)
++void rt2x00queue_remove_l2pad(struct sk_buff *skb, unsigned int hdr_len)
+ {
+- /*
+- * L2 padding is only present if the skb contains more than just the
+- * IEEE 802.11 header.
+- */
+- unsigned int l2pad = (skb->len > header_length) ?
+- L2PAD_SIZE(header_length) : 0;
++ unsigned int l2pad = (skb->len > hdr_len) ? L2PAD_SIZE(hdr_len) : 0;
+
+ if (!l2pad)
+ return;
+
+- memmove(skb->data + l2pad, skb->data, header_length);
++ memmove(skb->data + l2pad, skb->data, hdr_len);
+ skb_pull(skb, l2pad);
+ }
+
+diff --git a/drivers/of/address.c b/drivers/of/address.c
+index 66d96f14c274..c059ce1dd338 100644
+--- a/drivers/of/address.c
++++ b/drivers/of/address.c
+@@ -328,6 +328,21 @@ static struct of_bus *of_match_bus(struct device_node *np)
+ return NULL;
+ }
+
++static int of_empty_ranges_quirk(void)
++{
++ if (IS_ENABLED(CONFIG_PPC)) {
++ /* To save cycles, we cache the result */
++ static int quirk_state = -1;
++
++ if (quirk_state < 0)
++ quirk_state =
++ of_machine_is_compatible("Power Macintosh") ||
++ of_machine_is_compatible("MacRISC");
++ return quirk_state;
++ }
++ return false;
++}
++
+ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
+ struct of_bus *pbus, u32 *addr,
+ int na, int ns, int pna, const char *rprop)
+@@ -353,12 +368,10 @@ static int of_translate_one(struct device_node *parent, struct of_bus *bus,
+ * This code is only enabled on powerpc. --gcl
+ */
+ ranges = of_get_property(parent, rprop, &rlen);
+-#if !defined(CONFIG_PPC)
+- if (ranges == NULL) {
++ if (ranges == NULL && !of_empty_ranges_quirk()) {
+ pr_err("OF: no ranges; cannot translate\n");
+ return 1;
+ }
+-#endif /* !defined(CONFIG_PPC) */
+ if (ranges == NULL || rlen == 0) {
+ offset = of_read_number(addr, na);
+ memset(addr, 0, pna * 4);
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 1c207f23b114..d439d0611559 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -716,52 +716,6 @@ int of_property_read_string(struct device_node *np, const char *propname,
+ EXPORT_SYMBOL_GPL(of_property_read_string);
+
+ /**
+- * of_property_read_string_index - Find and read a string from a multiple
+- * strings property.
+- * @np: device node from which the property value is to be read.
+- * @propname: name of the property to be searched.
+- * @index: index of the string in the list of strings
+- * @out_string: pointer to null terminated return string, modified only if
+- * return value is 0.
+- *
+- * Search for a property in a device tree node and retrieve a null
+- * terminated string value (pointer to data, not a copy) in the list of strings
+- * contained in that property.
+- * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
+- * property does not have a value, and -EILSEQ if the string is not
+- * null-terminated within the length of the property data.
+- *
+- * The out_string pointer is modified only if a valid string can be decoded.
+- */
+-int of_property_read_string_index(struct device_node *np, const char *propname,
+- int index, const char **output)
+-{
+- struct property *prop = of_find_property(np, propname, NULL);
+- int i = 0;
+- size_t l = 0, total = 0;
+- const char *p;
+-
+- if (!prop)
+- return -EINVAL;
+- if (!prop->value)
+- return -ENODATA;
+- if (strnlen(prop->value, prop->length) >= prop->length)
+- return -EILSEQ;
+-
+- p = prop->value;
+-
+- for (i = 0; total < prop->length; total += l, p += l) {
+- l = strlen(p) + 1;
+- if (i++ == index) {
+- *output = p;
+- return 0;
+- }
+- }
+- return -ENODATA;
+-}
+-EXPORT_SYMBOL_GPL(of_property_read_string_index);
+-
+-/**
+ * of_property_match_string() - Find string in a list and return index
+ * @np: pointer to node containing string list property
+ * @propname: string list property name
+@@ -787,7 +741,7 @@ int of_property_match_string(struct device_node *np, const char *propname,
+ end = p + prop->length;
+
+ for (i = 0; p < end; i++, p += l) {
+- l = strlen(p) + 1;
++ l = strnlen(p, end - p) + 1;
+ if (p + l > end)
+ return -EILSEQ;
+ pr_debug("comparing %s with %s\n", string, p);
+@@ -799,39 +753,41 @@ int of_property_match_string(struct device_node *np, const char *propname,
+ EXPORT_SYMBOL_GPL(of_property_match_string);
+
+ /**
+- * of_property_count_strings - Find and return the number of strings from a
+- * multiple strings property.
++ * of_property_read_string_util() - Utility helper for parsing string properties
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
++ * @out_strs: output array of string pointers.
++ * @sz: number of array elements to read.
++ * @skip: Number of strings to skip over at beginning of list.
+ *
+- * Search for a property in a device tree node and retrieve the number of null
+- * terminated string contain in it. Returns the number of strings on
+- * success, -EINVAL if the property does not exist, -ENODATA if property
+- * does not have a value, and -EILSEQ if the string is not null-terminated
+- * within the length of the property data.
++ * Don't call this function directly. It is a utility helper for the
++ * of_property_read_string*() family of functions.
+ */
+-int of_property_count_strings(struct device_node *np, const char *propname)
++int of_property_read_string_helper(struct device_node *np, const char *propname,
++ const char **out_strs, size_t sz, int skip)
+ {
+ struct property *prop = of_find_property(np, propname, NULL);
+- int i = 0;
+- size_t l = 0, total = 0;
+- const char *p;
++ int l = 0, i = 0;
++ const char *p, *end;
+
+ if (!prop)
+ return -EINVAL;
+ if (!prop->value)
+ return -ENODATA;
+- if (strnlen(prop->value, prop->length) >= prop->length)
+- return -EILSEQ;
+-
+ p = prop->value;
++ end = p + prop->length;
+
+- for (i = 0; total < prop->length; total += l, p += l, i++)
+- l = strlen(p) + 1;
+-
+- return i;
++ for (i = 0; p < end && (!out_strs || i < skip + sz); i++, p += l) {
++ l = strnlen(p, end - p) + 1;
++ if (p + l > end)
++ return -EILSEQ;
++ if (out_strs && i >= skip)
++ *out_strs++ = p;
++ }
++ i -= skip;
++ return i <= 0 ? -ENODATA : i;
+ }
+-EXPORT_SYMBOL_GPL(of_property_count_strings);
++EXPORT_SYMBOL_GPL(of_property_read_string_helper);
+
+ /**
+ * of_parse_phandle - Resolve a phandle property to a device_node pointer
+diff --git a/drivers/of/selftest.c b/drivers/of/selftest.c
+index f24ffd7088d2..5a0771cc8987 100644
+--- a/drivers/of/selftest.c
++++ b/drivers/of/selftest.c
+@@ -120,8 +120,9 @@ static void __init of_selftest_parse_phandle_with_args(void)
+ pr_info("end - %s\n", passed_all ? "PASS" : "FAIL");
+ }
+
+-static void __init of_selftest_property_match_string(void)
++static void __init of_selftest_property_string(void)
+ {
++ const char *strings[4];
+ struct device_node *np;
+ int rc;
+
+@@ -139,13 +140,66 @@ static void __init of_selftest_property_match_string(void)
+ rc = of_property_match_string(np, "phandle-list-names", "third");
+ selftest(rc == 2, "third expected:0 got:%i\n", rc);
+ rc = of_property_match_string(np, "phandle-list-names", "fourth");
+- selftest(rc == -ENODATA, "unmatched string; rc=%i", rc);
++ selftest(rc == -ENODATA, "unmatched string; rc=%i\n", rc);
+ rc = of_property_match_string(np, "missing-property", "blah");
+- selftest(rc == -EINVAL, "missing property; rc=%i", rc);
++ selftest(rc == -EINVAL, "missing property; rc=%i\n", rc);
+ rc = of_property_match_string(np, "empty-property", "blah");
+- selftest(rc == -ENODATA, "empty property; rc=%i", rc);
++ selftest(rc == -ENODATA, "empty property; rc=%i\n", rc);
+ rc = of_property_match_string(np, "unterminated-string", "blah");
+- selftest(rc == -EILSEQ, "unterminated string; rc=%i", rc);
++ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
++
++ /* of_property_count_strings() tests */
++ rc = of_property_count_strings(np, "string-property");
++ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
++ rc = of_property_count_strings(np, "phandle-list-names");
++ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
++ rc = of_property_count_strings(np, "unterminated-string");
++ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
++ rc = of_property_count_strings(np, "unterminated-string-list");
++ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
++
++ /* of_property_read_string_index() tests */
++ rc = of_property_read_string_index(np, "string-property", 0, strings);
++ selftest(rc == 0 && !strcmp(strings[0], "foobar"), "of_property_read_string_index() failure; rc=%i\n", rc);
++ strings[0] = NULL;
++ rc = of_property_read_string_index(np, "string-property", 1, strings);
++ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
++ rc = of_property_read_string_index(np, "phandle-list-names", 0, strings);
++ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
++ rc = of_property_read_string_index(np, "phandle-list-names", 1, strings);
++ selftest(rc == 0 && !strcmp(strings[0], "second"), "of_property_read_string_index() failure; rc=%i\n", rc);
++ rc = of_property_read_string_index(np, "phandle-list-names", 2, strings);
++ selftest(rc == 0 && !strcmp(strings[0], "third"), "of_property_read_string_index() failure; rc=%i\n", rc);
++ strings[0] = NULL;
++ rc = of_property_read_string_index(np, "phandle-list-names", 3, strings);
++ selftest(rc == -ENODATA && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
++ strings[0] = NULL;
++ rc = of_property_read_string_index(np, "unterminated-string", 0, strings);
++ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
++ rc = of_property_read_string_index(np, "unterminated-string-list", 0, strings);
++ selftest(rc == 0 && !strcmp(strings[0], "first"), "of_property_read_string_index() failure; rc=%i\n", rc);
++ strings[0] = NULL;
++ rc = of_property_read_string_index(np, "unterminated-string-list", 2, strings); /* should fail */
++ selftest(rc == -EILSEQ && strings[0] == NULL, "of_property_read_string_index() failure; rc=%i\n", rc);
++ strings[1] = NULL;
++
++ /* of_property_read_string_array() tests */
++ rc = of_property_read_string_array(np, "string-property", strings, 4);
++ selftest(rc == 1, "Incorrect string count; rc=%i\n", rc);
++ rc = of_property_read_string_array(np, "phandle-list-names", strings, 4);
++ selftest(rc == 3, "Incorrect string count; rc=%i\n", rc);
++ rc = of_property_read_string_array(np, "unterminated-string", strings, 4);
++ selftest(rc == -EILSEQ, "unterminated string; rc=%i\n", rc);
++ /* -- An incorrectly formed string should cause a failure */
++ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 4);
++ selftest(rc == -EILSEQ, "unterminated string array; rc=%i\n", rc);
++ /* -- parsing the correctly formed strings should still work: */
++ strings[2] = NULL;
++ rc = of_property_read_string_array(np, "unterminated-string-list", strings, 2);
++ selftest(rc == 2 && strings[2] == NULL, "of_property_read_string_array() failure; rc=%i\n", rc);
++ strings[1] = NULL;
++ rc = of_property_read_string_array(np, "phandle-list-names", strings, 1);
++ selftest(rc == 1 && strings[1] == NULL, "Overwrote end of string array; rc=%i, str='%s'\n", rc, strings[1]);
+ }
+
+ static int __init of_selftest(void)
+@@ -161,7 +215,7 @@ static int __init of_selftest(void)
+
+ pr_info("start of selftest - you will see error messages\n");
+ of_selftest_parse_phandle_with_args();
+- of_selftest_property_match_string();
++ of_selftest_property_string();
+ pr_info("end of selftest - %s\n", selftest_passed ? "PASS" : "FAIL");
+ return 0;
+ }
+diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
+index 9e39df969560..75dc402f0347 100644
+--- a/drivers/pci/hotplug/pciehp_core.c
++++ b/drivers/pci/hotplug/pciehp_core.c
+@@ -237,6 +237,13 @@ static int pciehp_probe(struct pcie_device *dev)
+ else if (pciehp_acpi_slot_detection_check(dev->port))
+ goto err_out_none;
+
++ if (!dev->port->subordinate) {
++ /* Can happen if we run out of bus numbers during probe */
++ dev_err(&dev->device,
++ "Hotplug bridge without secondary bus, ignoring\n");
++ goto err_out_none;
++ }
++
+ ctrl = pcie_init(dev);
+ if (!ctrl) {
+ dev_err(&dev->device, "Controller initialization failed\n");
+diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
+index a55e248618cd..985ada79191e 100644
+--- a/drivers/pci/pci-sysfs.c
++++ b/drivers/pci/pci-sysfs.c
+@@ -173,7 +173,7 @@ static ssize_t modalias_show(struct device *dev, struct device_attribute *attr,
+ {
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+
+- return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02x\n",
++ return sprintf(buf, "pci:v%08Xd%08Xsv%08Xsd%08Xbc%02Xsc%02Xi%02X\n",
+ pci_dev->vendor, pci_dev->device,
+ pci_dev->subsystem_vendor, pci_dev->subsystem_device,
+ (u8)(pci_dev->class >> 16), (u8)(pci_dev->class >> 8),
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 61bc33ed1116..e587d0035a74 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -28,6 +28,7 @@
+ #include <linux/ioport.h>
+ #include <linux/sched.h>
+ #include <linux/ktime.h>
++#include <linux/mm.h>
+ #include <asm/dma.h> /* isa_dma_bridge_buggy */
+ #include "pci.h"
+
+@@ -291,6 +292,25 @@ static void __devinit quirk_citrine(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, PCI_DEVICE_ID_IBM_CITRINE, quirk_citrine);
+
++/* On IBM Crocodile ipr SAS adapters, expand BAR to system page size */
++static void quirk_extend_bar_to_page(struct pci_dev *dev)
++{
++ int i;
++
++ for (i = 0; i < PCI_STD_RESOURCE_END; i++) {
++ struct resource *r = &dev->resource[i];
++
++ if (r->flags & IORESOURCE_MEM && resource_size(r) < PAGE_SIZE) {
++ r->end = PAGE_SIZE - 1;
++ r->start = 0;
++ r->flags |= IORESOURCE_UNSET;
++ dev_info(&dev->dev, "expanded BAR %d to page size: %pR\n",
++ i, r);
++ }
++ }
++}
++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_IBM, 0x034a, quirk_extend_bar_to_page);
++
+ /*
+ * S3 868 and 968 chips report region size equal to 32M, but they decode 64M.
+ * If it's needed, re-allocate the region.
+diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
+index c1a3fd8e1243..4d047316e831 100644
+--- a/drivers/platform/x86/acer-wmi.c
++++ b/drivers/platform/x86/acer-wmi.c
+@@ -523,6 +523,17 @@ static const struct dmi_system_id video_vendor_dmi_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4750"),
+ },
+ },
++ {
++ /*
++ * Note no video_set_backlight_video_vendor, we must use the
++ * acer interface, as there is no native backlight interface.
++ */
++ .ident = "Acer KAV80",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "KAV80"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
+index de9f432cf22d..28c1bdb2e59b 100644
+--- a/drivers/platform/x86/samsung-laptop.c
++++ b/drivers/platform/x86/samsung-laptop.c
+@@ -1517,6 +1517,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
+ },
+ .driver_data = &samsung_broken_acpi_video,
+ },
++ {
++ .callback = samsung_dmi_matched,
++ .ident = "NC210",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "NC210/NC110"),
++ DMI_MATCH(DMI_BOARD_NAME, "NC210/NC110"),
++ },
++ .driver_data = &samsung_broken_acpi_video,
++ },
+ { },
+ };
+ MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
+diff --git a/drivers/power/charger-manager.c b/drivers/power/charger-manager.c
+index 4c449b26de46..102267fc713d 100644
+--- a/drivers/power/charger-manager.c
++++ b/drivers/power/charger-manager.c
+@@ -808,6 +808,11 @@ static int charger_manager_probe(struct platform_device *pdev)
+ goto err_no_charger_stat;
+ }
+
++ if (!desc->psy_fuel_gauge) {
++ dev_err(&pdev->dev, "No fuel gauge power supply defined\n");
++ return -EINVAL;
++ }
++
+ /* Counting index only */
+ while (desc->psy_charger_stat[i])
+ i++;
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index dcc39b612780..185971c2b41e 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -1679,8 +1679,10 @@ static void scsi_restart_operations(struct Scsi_Host *shost)
+ * is no point trying to lock the door of an off-line device.
+ */
+ shost_for_each_device(sdev, shost) {
+- if (scsi_device_online(sdev) && sdev->locked)
++ if (scsi_device_online(sdev) && sdev->was_reset && sdev->locked) {
+ scsi_eh_lock_door(sdev);
++ sdev->was_reset = 0;
++ }
+ }
+
+ /*
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index b9f0192758d6..efc494a65b43 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -89,7 +89,10 @@ err_exit:
+
+ static void mid_spi_dma_exit(struct dw_spi *dws)
+ {
++ dmaengine_terminate_all(dws->txchan);
+ dma_release_channel(dws->txchan);
++
++ dmaengine_terminate_all(dws->rxchan);
+ dma_release_channel(dws->rxchan);
+ }
+
+@@ -136,7 +139,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+ txconf.dst_addr = dws->dma_addr;
+ txconf.dst_maxburst = LNW_DMA_MSIZE_16;
+ txconf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+- txconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
++ txconf.dst_addr_width = dws->dma_width;
+ txconf.device_fc = false;
+
+ txchan->device->device_control(txchan, DMA_SLAVE_CONFIG,
+@@ -159,7 +162,7 @@ static int mid_spi_dma_transfer(struct dw_spi *dws, int cs_change)
+ rxconf.src_addr = dws->dma_addr;
+ rxconf.src_maxburst = LNW_DMA_MSIZE_16;
+ rxconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+- rxconf.src_addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
++ rxconf.src_addr_width = dws->dma_width;
+ rxconf.device_fc = false;
+
+ rxchan->device->device_control(rxchan, DMA_SLAVE_CONFIG,
+diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
+index 469eb28e8328..e3b845ae93c6 100644
+--- a/drivers/spi/spi-pl022.c
++++ b/drivers/spi/spi-pl022.c
+@@ -1061,7 +1061,7 @@ err_rxdesc:
+ pl022->sgt_tx.nents, DMA_TO_DEVICE);
+ err_tx_sgmap:
+ dma_unmap_sg(rxchan->device->dev, pl022->sgt_rx.sgl,
+- pl022->sgt_tx.nents, DMA_FROM_DEVICE);
++ pl022->sgt_rx.nents, DMA_FROM_DEVICE);
+ err_rx_sgmap:
+ sg_free_table(&pl022->sgt_tx);
+ err_alloc_tx_sg:
+diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
+index cd82b56d58af..2db80b1fda82 100644
+--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
+@@ -109,15 +109,44 @@ static struct ad5933_platform_data ad5933_default_pdata = {
+ };
+
+ static struct iio_chan_spec ad5933_channels[] = {
+- IIO_CHAN(IIO_TEMP, 0, 1, 1, NULL, 0, 0, 0,
+- 0, AD5933_REG_TEMP_DATA, IIO_ST('s', 14, 16, 0), 0),
+- /* Ring Channels */
+- IIO_CHAN(IIO_VOLTAGE, 0, 1, 0, "real_raw", 0, 0,
+- IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
+- AD5933_REG_REAL_DATA, 0, IIO_ST('s', 16, 16, 0), 0),
+- IIO_CHAN(IIO_VOLTAGE, 0, 1, 0, "imag_raw", 0, 0,
+- IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
+- AD5933_REG_IMAG_DATA, 1, IIO_ST('s', 16, 16, 0), 0),
++ {
++ .type = IIO_TEMP,
++ .indexed = 1,
++ .processed_val = 1,
++ .channel = 0,
++ .address = AD5933_REG_TEMP_DATA,
++ .scan_type = {
++ .sign = 's',
++ .realbits = 14,
++ .storagebits = 16,
++ },
++ }, { /* Ring Channels */
++ .type = IIO_VOLTAGE,
++ .indexed = 1,
++ .channel = 0,
++ .extend_name = "real",
++ .info_mask = IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
++ .address = AD5933_REG_REAL_DATA,
++ .scan_index = 0,
++ .scan_type = {
++ .sign = 's',
++ .realbits = 16,
++ .storagebits = 16,
++ },
++ }, {
++ .type = IIO_VOLTAGE,
++ .indexed = 1,
++ .channel = 0,
++ .extend_name = "imag",
++ .info_mask = IIO_CHAN_INFO_SCALE_SEPARATE_BIT,
++ .address = AD5933_REG_IMAG_DATA,
++ .scan_index = 1,
++ .scan_type = {
++ .sign = 's',
++ .realbits = 16,
++ .storagebits = 16,
++ },
++ },
+ };
+
+ static int ad5933_i2c_write(struct i2c_client *client,
+diff --git a/drivers/staging/iio/meter/ade7758_ring.c b/drivers/staging/iio/meter/ade7758_ring.c
+index c45b23bb1229..629a6ed2c6ed 100644
+--- a/drivers/staging/iio/meter/ade7758_ring.c
++++ b/drivers/staging/iio/meter/ade7758_ring.c
+@@ -96,7 +96,7 @@ static int ade7758_ring_preenable(struct iio_dev *indio_dev)
+ size_t d_size;
+ unsigned channel;
+
+- if (!bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
++ if (bitmap_empty(indio_dev->active_scan_mask, indio_dev->masklength))
+ return -EINVAL;
+
+ channel = find_first_bit(indio_dev->active_scan_mask,
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 34df0b2a630e..b4b308ef6cf5 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -3284,8 +3284,7 @@ static void transport_complete_qf(struct se_cmd *cmd)
+
+ if (cmd->se_cmd_flags & SCF_TRANSPORT_TASK_SENSE) {
+ ret = cmd->se_tfo->queue_status(cmd);
+- if (ret)
+- goto out;
++ goto out;
+ }
+
+ switch (cmd->data_direction) {
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index d53f39668044..6f8f985e7805 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1164,6 +1164,7 @@ pci_xr17c154_setup(struct serial_private *priv,
+ #define PCI_DEVICE_ID_PLX_CRONYX_OMEGA 0xc001
+ #define PCI_DEVICE_ID_INTEL_PATSBURG_KT 0x1d3d
+ #define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a
++#define PCI_DEVICE_ID_INTEL_QRK_UART 0x0936
+
+ /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
+ #define PCI_SUBDEVICE_ID_UNKNOWN_0x1584 0x1584
+@@ -1686,6 +1687,13 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
+ .init = pci_eg20t_init,
+ .setup = pci_default_setup,
+ },
++ {
++ .vendor = PCI_VENDOR_ID_INTEL,
++ .device = PCI_DEVICE_ID_INTEL_QRK_UART,
++ .subvendor = PCI_ANY_ID,
++ .subdevice = PCI_ANY_ID,
++ .setup = pci_default_setup,
++ },
+ /*
+ * Cronyx Omega PCI (PLX-chip based)
+ */
+@@ -1894,6 +1902,7 @@ enum pci_board_num_t {
+ pbn_ADDIDATA_PCIe_4_3906250,
+ pbn_ADDIDATA_PCIe_8_3906250,
+ pbn_ce4100_1_115200,
++ pbn_qrk,
+ pbn_omegapci,
+ pbn_NETMOS9900_2s_115200,
+ pbn_brcm_trumanage,
+@@ -2592,6 +2601,12 @@ static struct pciserial_board pci_boards[] __devinitdata = {
+ .base_baud = 921600,
+ .reg_shift = 2,
+ },
++ [pbn_qrk] = {
++ .flags = FL_BASE0,
++ .num_ports = 1,
++ .base_baud = 2764800,
++ .reg_shift = 2,
++ },
+ [pbn_omegapci] = {
+ .flags = FL_BASE0,
+ .num_ports = 8,
+@@ -4164,6 +4179,12 @@ static struct pci_device_id serial_pci_tbl[] = {
+ pbn_ce4100_1_115200 },
+
+ /*
++ * Intel Quark x1000
++ */
++ { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_QRK_UART,
++ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
++ pbn_qrk },
++ /*
+ * Cronyx Omega PCI
+ */
+ { PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_CRONYX_OMEGA,
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 4185cc5332ab..82aac2920e19 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -355,7 +355,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
+ * The spd_hi, spd_vhi, spd_shi, spd_warp kludge...
+ * Die! Die! Die!
+ */
+- if (baud == 38400)
++ if (try == 0 && baud == 38400)
+ baud = altbaud;
+
+ /*
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index b28d6356a142..a07eb4c068a0 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -1633,6 +1633,8 @@ int tty_release(struct inode *inode, struct file *filp)
+ int devpts;
+ int idx;
+ char buf[64];
++ long timeout = 0;
++ int once = 1;
+
+ if (tty_paranoia_check(tty, inode, __func__))
+ return 0;
+@@ -1713,11 +1715,18 @@ int tty_release(struct inode *inode, struct file *filp)
+ if (!do_sleep)
+ break;
+
+- printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
++ if (once) {
++ once = 0;
++ printk(KERN_WARNING "%s: %s: read/write wait queue active!\n",
+ __func__, tty_name(tty, buf));
++ }
+ tty_unlock();
+ mutex_unlock(&tty_mutex);
+- schedule();
++ schedule_timeout_killable(timeout);
++ if (timeout < 120 * HZ)
++ timeout = 2 * timeout + 1;
++ else
++ timeout = MAX_SCHEDULE_TIMEOUT;
+ }
+
+ /*
+diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
+index 8308fc7cdc26..87025d01aaec 100644
+--- a/drivers/tty/vt/consolemap.c
++++ b/drivers/tty/vt/consolemap.c
+@@ -518,6 +518,10 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list)
+
+ /* Save original vc_unipagdir_loc in case we allocate a new one */
+ p = (struct uni_pagedir *)*vc->vc_uni_pagedir_loc;
++
++ if (!p)
++ return -EINVAL;
++
+ if (p->readonly) return -EIO;
+
+ if (!ct) return 0;
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 2f2540ff21f6..8f4a628d3382 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -910,11 +910,12 @@ static void acm_tty_set_termios(struct tty_struct *tty,
+ /* FIXME: Needs to clear unsupported bits in the termios */
+ acm->clocal = ((termios->c_cflag & CLOCAL) != 0);
+
+- if (!newline.dwDTERate) {
++ if (C_BAUD(tty) == B0) {
+ newline.dwDTERate = acm->line.dwDTERate;
+ newctrl &= ~ACM_CTRL_DTR;
+- } else
++ } else if (termios_old && (termios_old->c_cflag & CBAUD) == B0) {
+ newctrl |= ACM_CTRL_DTR;
++ }
+
+ if (newctrl != acm->ctrlout)
+ acm_set_control(acm, acm->ctrlout = newctrl);
+@@ -1601,6 +1602,7 @@ static const struct usb_device_id acm_ids[] = {
+ { USB_DEVICE(0x0572, 0x1328), /* Shiro / Aztech USB MODEM UM-3100 */
+ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
+ },
++ { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */
+ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */
+ },
+ /* Motorola H24 HSPA module: */
+diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
+index e2cc8df3d87b..6baeada782eb 100644
+--- a/drivers/usb/core/hcd.c
++++ b/drivers/usb/core/hcd.c
+@@ -1882,6 +1882,8 @@ int usb_alloc_streams(struct usb_interface *interface,
+ return -EINVAL;
+ if (dev->speed != USB_SPEED_SUPER)
+ return -EINVAL;
++ if (dev->state < USB_STATE_CONFIGURED)
++ return -ENODEV;
+
+ /* Streams only apply to bulk endpoints. */
+ for (i = 0; i < num_eps; i++)
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 62a9e44bfef6..93f2538b16cc 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -1638,8 +1638,10 @@ void usb_set_device_state(struct usb_device *udev,
+ || new_state == USB_STATE_SUSPENDED)
+ ; /* No change to wakeup settings */
+ else if (new_state == USB_STATE_CONFIGURED)
+- wakeup = udev->actconfig->desc.bmAttributes
+- & USB_CONFIG_ATT_WAKEUP;
++ wakeup = (udev->quirks &
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP) ? 0 :
++ udev->actconfig->desc.bmAttributes &
++ USB_CONFIG_ATT_WAKEUP;
+ else
+ wakeup = 0;
+ }
+@@ -3359,6 +3361,9 @@ check_highspeed (struct usb_hub *hub, struct usb_device *udev, int port1)
+ struct usb_qualifier_descriptor *qual;
+ int status;
+
++ if (udev->quirks & USB_QUIRK_DEVICE_QUALIFIER)
++ return;
++
+ qual = kmalloc (sizeof *qual, GFP_KERNEL);
+ if (qual == NULL)
+ return;
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index bcde6f65b1c6..980a9d8c6504 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -88,6 +88,12 @@ static const struct usb_device_id usb_quirk_list[] = {
+ { USB_DEVICE(0x04e8, 0x6601), .driver_info =
+ USB_QUIRK_CONFIG_INTF_STRINGS },
+
++ { USB_DEVICE(0x04f3, 0x009b), .driver_info =
++ USB_QUIRK_DEVICE_QUALIFIER },
++
++ { USB_DEVICE(0x04f3, 0x016f), .driver_info =
++ USB_QUIRK_DEVICE_QUALIFIER },
++
+ /* Roland SC-8820 */
+ { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
+
+@@ -158,6 +164,10 @@ static const struct usb_device_id usb_interface_quirk_list[] = {
+ { USB_VENDOR_AND_INTERFACE_INFO(0x046d, USB_CLASS_VIDEO, 1, 0),
+ .driver_info = USB_QUIRK_RESET_RESUME },
+
++ /* ASUS Base Station(T100) */
++ { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
++ USB_QUIRK_IGNORE_REMOTE_WAKEUP },
++
+ { } /* terminating entry must be last */
+ };
+
+diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
+index 5bf2bc00821b..8a7a8ee176fa 100644
+--- a/drivers/usb/dwc3/ep0.c
++++ b/drivers/usb/dwc3/ep0.c
+@@ -209,7 +209,7 @@ static void dwc3_ep0_stall_and_restart(struct dwc3 *dwc)
+ struct dwc3_ep *dep = dwc->eps[0];
+
+ /* stall is always issued on EP0 */
+- __dwc3_gadget_ep_set_halt(dep, 1);
++ __dwc3_gadget_ep_set_halt(dep, 1, false);
+ dep->flags = DWC3_EP_ENABLED;
+ dwc->delayed_status = false;
+
+@@ -382,7 +382,7 @@ static int dwc3_ep0_handle_feature(struct dwc3 *dwc,
+ return -EINVAL;
+ if (set == 0 && (dep->flags & DWC3_EP_WEDGE))
+ break;
+- ret = __dwc3_gadget_ep_set_halt(dep, set);
++ ret = __dwc3_gadget_ep_set_halt(dep, set, true);
+ if (ret)
+ return -EINVAL;
+ break;
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 895497d42270..1acb3a419539 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -485,12 +485,11 @@ static int __dwc3_gadget_ep_enable(struct dwc3_ep *dep,
+ if (!usb_endpoint_xfer_isoc(desc))
+ return 0;
+
+- memset(&trb_link, 0, sizeof(trb_link));
+-
+ /* Link TRB for ISOC. The HWO bit is never reset */
+ trb_st_hw = &dep->trb_pool[0];
+
+ trb_link = &dep->trb_pool[DWC3_TRB_NUM - 1];
++ memset(trb_link, 0, sizeof(*trb_link));
+
+ trb_link->bpl = lower_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
+ trb_link->bph = upper_32_bits(dwc3_trb_dma_offset(dep, trb_st_hw));
+@@ -533,7 +532,7 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
+
+ /* make sure HW endpoint isn't stalled */
+ if (dep->flags & DWC3_EP_STALL)
+- __dwc3_gadget_ep_set_halt(dep, 0);
++ __dwc3_gadget_ep_set_halt(dep, 0, false);
+
+ reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
+ reg &= ~DWC3_DALEPENA_EP(dep->number);
+@@ -1078,7 +1077,7 @@ out0:
+ return ret;
+ }
+
+-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
++int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol)
+ {
+ struct dwc3_gadget_ep_cmd_params params;
+ struct dwc3 *dwc = dep->dwc;
+@@ -1087,6 +1086,14 @@ int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value)
+ memset(¶ms, 0x00, sizeof(params));
+
+ if (value) {
++ if (!protocol && ((dep->direction && dep->flags & DWC3_EP_BUSY) ||
++ (!list_empty(&dep->req_queued) ||
++ !list_empty(&dep->request_list)))) {
++ dev_dbg(dwc->dev, "%s: pending request, cannot halt\n",
++ dep->name);
++ return -EAGAIN;
++ }
++
+ if (dep->number == 0 || dep->number == 1) {
+ /*
+ * Whenever EP0 is stalled, we will restart
+@@ -1135,7 +1142,7 @@ static int dwc3_gadget_ep_set_halt(struct usb_ep *ep, int value)
+ goto out;
+ }
+
+- ret = __dwc3_gadget_ep_set_halt(dep, value);
++ ret = __dwc3_gadget_ep_set_halt(dep, value, false);
+ out:
+ spin_unlock_irqrestore(&dwc->lock, flags);
+
+diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h
+index a8600084348c..6f498fc4f568 100644
+--- a/drivers/usb/dwc3/gadget.h
++++ b/drivers/usb/dwc3/gadget.h
+@@ -108,7 +108,7 @@ void dwc3_ep0_interrupt(struct dwc3 *dwc,
+ void dwc3_ep0_out_start(struct dwc3 *dwc);
+ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request,
+ gfp_t gfp_flags);
+-int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value);
++int __dwc3_gadget_ep_set_halt(struct dwc3_ep *dep, int value, int protocol);
+ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
+ unsigned cmd, struct dwc3_gadget_ep_cmd_params *params);
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 8882d654b0d1..c8835d591b37 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -118,20 +118,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ xhci->quirks |= XHCI_SPURIOUS_REBOOT;
+ xhci->quirks |= XHCI_AVOID_BEI;
+ }
+- if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+- (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI ||
+- pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI)) {
+- /* Workaround for occasional spurious wakeups from S5 (or
+- * any other sleep) on Haswell machines with LPT and LPT-LP
+- * with the new Intel BIOS
+- */
+- /* Limit the quirk to only known vendors, as this triggers
+- * yet another BIOS bug on some other machines
+- * https://bugzilla.kernel.org/show_bug.cgi?id=66171
+- */
+- if (pdev->subsystem_vendor == PCI_VENDOR_ID_HP)
+- xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
+- }
+ if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
+ pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
+ xhci->quirks |= XHCI_RESET_ON_RESUME;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index ac339570a805..19074db60896 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -128,6 +128,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
+ { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
++ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+@@ -160,7 +161,9 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
++ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
+ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
++ { USB_DEVICE(0x1D6F, 0x0010) }, /* Seluxit ApS RF Dongle */
+ { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+ { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
+ { USB_DEVICE(0x1FB9, 0x0100) }, /* Lake Shore Model 121 Current Source */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 8425e9e9e127..a89433bd5314 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -156,6 +156,7 @@ static struct ftdi_sio_quirk ftdi_8u2232c_quirk = {
+ * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
+ */
+ static struct usb_device_id id_table_combined [] = {
++ { USB_DEVICE(FTDI_VID, FTDI_BRICK_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ZEITCONTROL_TAGTRACE_MIFARE_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CTI_MINI_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CTI_NANO_PID) },
+@@ -685,6 +686,10 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
+ { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
+ { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 7628b91017ba..64ee791687d9 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -30,6 +30,12 @@
+
+ /*** third-party PIDs (using FTDI_VID) ***/
+
++/*
++ * Certain versions of the official Windows FTDI driver reprogrammed
++ * counterfeit FTDI devices to PID 0. Support these devices anyway.
++ */
++#define FTDI_BRICK_PID 0x0000
++
+ #define FTDI_LUMEL_PD12_PID 0x6002
+
+ /*
+@@ -142,12 +148,19 @@
+ /*
+ * Xsens Technologies BV products (http://www.xsens.com).
+ */
+-#define XSENS_CONVERTER_0_PID 0xD388
+-#define XSENS_CONVERTER_1_PID 0xD389
++#define XSENS_VID 0x2639
++#define XSENS_AWINDA_STATION_PID 0x0101
++#define XSENS_AWINDA_DONGLE_PID 0x0102
++#define XSENS_MTW_PID 0x0200 /* Xsens MTw */
++#define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
++
++/* Xsens devices using FTDI VID */
++#define XSENS_CONVERTER_0_PID 0xD388 /* Xsens USB converter */
++#define XSENS_CONVERTER_1_PID 0xD389 /* Xsens Wireless Receiver */
+ #define XSENS_CONVERTER_2_PID 0xD38A
+-#define XSENS_CONVERTER_3_PID 0xD38B
+-#define XSENS_CONVERTER_4_PID 0xD38C
+-#define XSENS_CONVERTER_5_PID 0xD38D
++#define XSENS_CONVERTER_3_PID 0xD38B /* Xsens USB-serial converter */
++#define XSENS_CONVERTER_4_PID 0xD38C /* Xsens Wireless Receiver */
++#define XSENS_CONVERTER_5_PID 0xD38D /* Xsens Awinda Station */
+ #define XSENS_CONVERTER_6_PID 0xD38E
+ #define XSENS_CONVERTER_7_PID 0xD38F
+
+diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
+index 4a9a75eb9b95..c3a53acda67a 100644
+--- a/drivers/usb/serial/kobil_sct.c
++++ b/drivers/usb/serial/kobil_sct.c
+@@ -447,7 +447,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
+ );
+
+ priv->cur_pos = priv->cur_pos + length;
+- result = usb_submit_urb(port->write_urb, GFP_NOIO);
++ result = usb_submit_urb(port->write_urb, GFP_ATOMIC);
+ dbg("%s - port %d Send write URB returns: %i",
+ __func__, port->number, result);
+ todo = priv->filled - priv->cur_pos;
+@@ -463,7 +463,7 @@ static int kobil_write(struct tty_struct *tty, struct usb_serial_port *port,
+ if (priv->device_type == KOBIL_ADAPTER_B_PRODUCT_ID ||
+ priv->device_type == KOBIL_ADAPTER_K_PRODUCT_ID) {
+ result = usb_submit_urb(port->interrupt_in_urb,
+- GFP_NOIO);
++ GFP_ATOMIC);
+ dbg("%s - port %d Send read URB returns: %i",
+ __func__, port->number, result);
+ }
+diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
+index 1f850065d159..58b7cecd682f 100644
+--- a/drivers/usb/serial/opticon.c
++++ b/drivers/usb/serial/opticon.c
+@@ -293,7 +293,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
+
+ /* The conncected devices do not have a bulk write endpoint,
+ * to transmit data to de barcode device the control endpoint is used */
+- dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_NOIO);
++ dr = kmalloc(sizeof(struct usb_ctrlrequest), GFP_ATOMIC);
+ if (!dr) {
+ dev_err(&port->dev, "out of memory\n");
+ count = -ENOMEM;
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 703ebe7eaa93..d8232df2c211 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -269,6 +269,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_DE910_DUAL 0x1010
+ #define TELIT_PRODUCT_UE910_V2 0x1012
+ #define TELIT_PRODUCT_LE920 0x1200
++#define TELIT_PRODUCT_LE910 0x1201
+
+ /* ZTE PRODUCTS */
+ #define ZTE_VENDOR_ID 0x19d2
+@@ -362,6 +363,7 @@ static void option_instat_callback(struct urb *urb);
+
+ /* Haier products */
+ #define HAIER_VENDOR_ID 0x201e
++#define HAIER_PRODUCT_CE81B 0x10f8
+ #define HAIER_PRODUCT_CE100 0x2009
+
+ /* Cinterion (formerly Siemens) products */
+@@ -589,6 +591,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
+ .reserved = BIT(3) | BIT(4),
+ };
+
++static const struct option_blacklist_info telit_le910_blacklist = {
++ .sendsetup = BIT(0),
++ .reserved = BIT(1) | BIT(2),
++};
++
+ static const struct option_blacklist_info telit_le920_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(5),
+@@ -1138,6 +1145,8 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
++ .driver_info = (kernel_ulong_t)&telit_le910_blacklist },
+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+@@ -1614,6 +1623,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
++ { USB_DEVICE_AND_INTERFACE_INFO(HAIER_VENDOR_ID, HAIER_PRODUCT_CE81B, 0xff, 0xff, 0xff) },
+ /* Pirelli */
+ { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_1)},
+ { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_C100_2)},
+diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
+index c70109e5d60b..d8d26f4f14dd 100644
+--- a/drivers/usb/storage/transport.c
++++ b/drivers/usb/storage/transport.c
+@@ -1120,6 +1120,31 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
+ */
+ if (result == USB_STOR_XFER_LONG)
+ fake_sense = 1;
++
++ /*
++ * Sometimes a device will mistakenly skip the data phase
++ * and go directly to the status phase without sending a
++ * zero-length packet. If we get a 13-byte response here,
++ * check whether it really is a CSW.
++ */
++ if (result == USB_STOR_XFER_SHORT &&
++ srb->sc_data_direction == DMA_FROM_DEVICE &&
++ transfer_length - scsi_get_resid(srb) ==
++ US_BULK_CS_WRAP_LEN) {
++ struct scatterlist *sg = NULL;
++ unsigned int offset = 0;
++
++ if (usb_stor_access_xfer_buf((unsigned char *) bcs,
++ US_BULK_CS_WRAP_LEN, srb, &sg,
++ &offset, FROM_XFER_BUF) ==
++ US_BULK_CS_WRAP_LEN &&
++ bcs->Signature ==
++ cpu_to_le32(US_BULK_CS_SIGN)) {
++ US_DEBUGP("Device skipped data phase\n");
++ scsi_set_resid(srb, transfer_length);
++ goto skipped_data_phase;
++ }
++ }
+ }
+
+ /* See flow chart on pg 15 of the Bulk Only Transport spec for
+@@ -1155,6 +1180,7 @@ int usb_stor_Bulk_transport(struct scsi_cmnd *srb, struct us_data *us)
+ if (result != USB_STOR_XFER_GOOD)
+ return USB_STOR_TRANSPORT_ERROR;
+
++ skipped_data_phase:
+ /* check bulk status */
+ residue = le32_to_cpu(bcs->Residue);
+ US_DEBUGP("Bulk Status S 0x%x T 0x%x R %u Stat 0x%x\n",
+diff --git a/drivers/video/console/bitblit.c b/drivers/video/console/bitblit.c
+index 28b1a834906b..6cbb2069531d 100644
+--- a/drivers/video/console/bitblit.c
++++ b/drivers/video/console/bitblit.c
+@@ -205,7 +205,6 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
+ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ int bottom_only)
+ {
+- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
+ unsigned int cw = vc->vc_font.width;
+ unsigned int ch = vc->vc_font.height;
+ unsigned int rw = info->var.xres - (vc->vc_cols*cw);
+@@ -214,7 +213,7 @@ static void bit_clear_margins(struct vc_data *vc, struct fb_info *info,
+ unsigned int bs = info->var.yres - bh;
+ struct fb_fillrect region;
+
+- region.color = attr_bgcol_ec(bgshift, vc, info);
++ region.color = 0;
+ region.rop = ROP_COPY;
+
+ if (rw && !bottom_only) {
+diff --git a/drivers/video/console/fbcon_ccw.c b/drivers/video/console/fbcon_ccw.c
+index 41b32ae23dac..5a3cbf6dff4d 100644
+--- a/drivers/video/console/fbcon_ccw.c
++++ b/drivers/video/console/fbcon_ccw.c
+@@ -197,9 +197,8 @@ static void ccw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ unsigned int bh = info->var.xres - (vc->vc_rows*ch);
+ unsigned int bs = vc->vc_rows*ch;
+ struct fb_fillrect region;
+- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
+
+- region.color = attr_bgcol_ec(bgshift,vc,info);
++ region.color = 0;
+ region.rop = ROP_COPY;
+
+ if (rw && !bottom_only) {
+diff --git a/drivers/video/console/fbcon_cw.c b/drivers/video/console/fbcon_cw.c
+index 6a737827beb1..7d3fd9bda66c 100644
+--- a/drivers/video/console/fbcon_cw.c
++++ b/drivers/video/console/fbcon_cw.c
+@@ -181,9 +181,8 @@ static void cw_clear_margins(struct vc_data *vc, struct fb_info *info,
+ unsigned int bh = info->var.xres - (vc->vc_rows*ch);
+ unsigned int rs = info->var.yres - rw;
+ struct fb_fillrect region;
+- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
+
+- region.color = attr_bgcol_ec(bgshift,vc,info);
++ region.color = 0;
+ region.rop = ROP_COPY;
+
+ if (rw && !bottom_only) {
+diff --git a/drivers/video/console/fbcon_ud.c b/drivers/video/console/fbcon_ud.c
+index ff0872c0498b..19e3714abfe8 100644
+--- a/drivers/video/console/fbcon_ud.c
++++ b/drivers/video/console/fbcon_ud.c
+@@ -227,9 +227,8 @@ static void ud_clear_margins(struct vc_data *vc, struct fb_info *info,
+ unsigned int rw = info->var.xres - (vc->vc_cols*cw);
+ unsigned int bh = info->var.yres - (vc->vc_rows*ch);
+ struct fb_fillrect region;
+- int bgshift = (vc->vc_hi_font_mask) ? 13 : 12;
+
+- region.color = attr_bgcol_ec(bgshift,vc,info);
++ region.color = 0;
+ region.rop = ROP_COPY;
+
+ if (rw && !bottom_only) {
+diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
+index 2e03d416b9af..a41f264dc23d 100644
+--- a/drivers/virtio/virtio_pci.c
++++ b/drivers/virtio/virtio_pci.c
+@@ -745,6 +745,7 @@ static int virtio_pci_restore(struct device *dev)
+ struct pci_dev *pci_dev = to_pci_dev(dev);
+ struct virtio_pci_device *vp_dev = pci_get_drvdata(pci_dev);
+ struct virtio_driver *drv;
++ unsigned status = 0;
+ int ret;
+
+ drv = container_of(vp_dev->vdev.dev.driver,
+@@ -755,14 +756,40 @@ static int virtio_pci_restore(struct device *dev)
+ return ret;
+
+ pci_set_master(pci_dev);
++ /* We always start by resetting the device, in case a previous
++ * driver messed it up. */
++ vp_reset(&vp_dev->vdev);
++
++ /* Acknowledge that we've seen the device. */
++ status |= VIRTIO_CONFIG_S_ACKNOWLEDGE;
++ vp_set_status(&vp_dev->vdev, status);
++
++ /* Maybe driver failed before freeze.
++ * Restore the failed status, for debugging. */
++ status |= vp_dev->saved_status & VIRTIO_CONFIG_S_FAILED;
++ vp_set_status(&vp_dev->vdev, status);
++
++ if (!drv)
++ return 0;
++
++ /* We have a driver! */
++ status |= VIRTIO_CONFIG_S_DRIVER;
++ vp_set_status(&vp_dev->vdev, status);
++
+ vp_finalize_features(&vp_dev->vdev);
+
+- if (drv && drv->restore)
++ if (drv->restore) {
+ ret = drv->restore(&vp_dev->vdev);
++ if (ret) {
++ status |= VIRTIO_CONFIG_S_FAILED;
++ vp_set_status(&vp_dev->vdev, status);
++ return ret;
++ }
++ }
+
+ /* Finally, tell the device we're all set */
+- if (!ret)
+- vp_set_status(&vp_dev->vdev, vp_dev->saved_status);
++ status |= VIRTIO_CONFIG_S_DRIVER_OK;
++ vp_set_status(&vp_dev->vdev, status);
+
+ return ret;
+ }
+diff --git a/fs/btrfs/file-item.c b/fs/btrfs/file-item.c
+index 5d158d320233..6eab2dd16e94 100644
+--- a/fs/btrfs/file-item.c
++++ b/fs/btrfs/file-item.c
+@@ -393,7 +393,7 @@ int btrfs_lookup_csums_range(struct btrfs_root *root, u64 start, u64 end,
+ ret = 0;
+ fail:
+ while (ret < 0 && !list_empty(&tmplist)) {
+- sums = list_entry(&tmplist, struct btrfs_ordered_sum, list);
++ sums = list_entry(tmplist.next, struct btrfs_ordered_sum, list);
+ list_del(&sums->list);
+ kfree(sums);
+ }
+diff --git a/fs/buffer.c b/fs/buffer.c
+index f235e1834e39..ed2dc709883a 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1982,6 +1982,7 @@ int generic_write_end(struct file *file, struct address_space *mapping,
+ struct page *page, void *fsdata)
+ {
+ struct inode *inode = mapping->host;
++ loff_t old_size = inode->i_size;
+ int i_size_changed = 0;
+
+ copied = block_write_end(file, mapping, pos, len, copied, page, fsdata);
+@@ -2001,6 +2002,8 @@ int generic_write_end(struct file *file, struct address_space *mapping,
+ unlock_page(page);
+ page_cache_release(page);
+
++ if (old_size < pos)
++ pagecache_isize_extended(inode, old_size, pos);
+ /*
+ * Don't mark the inode dirty under page lock. First, it unnecessarily
+ * makes the holding time of page lock longer. Second, it forces lock
+@@ -2221,6 +2224,11 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping,
+ err = 0;
+
+ balance_dirty_pages_ratelimited(mapping);
++
++ if (unlikely(fatal_signal_pending(current))) {
++ err = -EINTR;
++ goto out;
++ }
+ }
+
+ /* page covers the boundary, find the boundary offset */
+diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
+index 11030b2fd3b4..b5b9b4086143 100644
+--- a/fs/ecryptfs/inode.c
++++ b/fs/ecryptfs/inode.c
+@@ -1093,7 +1093,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ }
+
+ rc = vfs_setxattr(lower_dentry, name, value, size, flags);
+- if (!rc)
++ if (!rc && dentry->d_inode)
+ fsstack_copy_attr_all(dentry->d_inode, lower_dentry->d_inode);
+ out:
+ return rc;
+diff --git a/fs/ext3/super.c b/fs/ext3/super.c
+index ef4c812c7a63..564f9429b3b1 100644
+--- a/fs/ext3/super.c
++++ b/fs/ext3/super.c
+@@ -1292,13 +1292,6 @@ set_qf_format:
+ "not specified.");
+ return 0;
+ }
+- } else {
+- if (sbi->s_jquota_fmt) {
+- ext3_msg(sb, KERN_ERR, "error: journaled quota format "
+- "specified with no journaling "
+- "enabled.");
+- return 0;
+- }
+ }
+ #endif
+ return 1;
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 521ba9d18ce6..b9cdb6df8d2b 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1891,6 +1891,7 @@ int ext4_get_block(struct inode *inode, sector_t iblock,
+ struct buffer_head *bh_result, int create);
+
+ extern struct inode *ext4_iget(struct super_block *, unsigned long);
++extern struct inode *ext4_iget_normal(struct super_block *, unsigned long);
+ extern int ext4_write_inode(struct inode *, struct writeback_control *);
+ extern int ext4_setattr(struct dentry *, struct iattr *);
+ extern int ext4_getattr(struct vfsmount *mnt, struct dentry *dentry,
+diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
+index 75c4f36bced8..97ca4b6fb2a9 100644
+--- a/fs/ext4/ialloc.c
++++ b/fs/ext4/ialloc.c
+@@ -725,6 +725,10 @@ got:
+ struct buffer_head *block_bitmap_bh;
+
+ block_bitmap_bh = ext4_read_block_bitmap(sb, group);
++ if (!block_bitmap_bh) {
++ err = -EIO;
++ goto out;
++ }
+ BUFFER_TRACE(block_bitmap_bh, "get block bitmap access");
+ err = ext4_journal_get_write_access(handle, block_bitmap_bh);
+ if (err) {
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index 5b6dcba304b1..9e9db425c613 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -157,16 +157,14 @@ void ext4_evict_inode(struct inode *inode)
+ goto no_delete;
+ }
+
+- if (!is_bad_inode(inode))
+- dquot_initialize(inode);
++ if (is_bad_inode(inode))
++ goto no_delete;
++ dquot_initialize(inode);
+
+ if (ext4_should_order_data(inode))
+ ext4_begin_ordered_truncate(inode, 0);
+ truncate_inode_pages(&inode->i_data, 0);
+
+- if (is_bad_inode(inode))
+- goto no_delete;
+-
+ handle = ext4_journal_start(inode, ext4_blocks_for_truncate(inode)+3);
+ if (IS_ERR(handle)) {
+ ext4_std_error(inode->i_sb, PTR_ERR(handle));
+@@ -2410,6 +2408,20 @@ static int ext4_nonda_switch(struct super_block *sb)
+ return 0;
+ }
+
++/* We always reserve for an inode update; the superblock could be there too */
++static int ext4_da_write_credits(struct inode *inode, loff_t pos, unsigned len)
++{
++ if (likely(EXT4_HAS_RO_COMPAT_FEATURE(inode->i_sb,
++ EXT4_FEATURE_RO_COMPAT_LARGE_FILE)))
++ return 1;
++
++ if (pos + len <= 0x7fffffffULL)
++ return 1;
++
++ /* We might need to update the superblock to set LARGE_FILE */
++ return 2;
++}
++
+ static int ext4_da_write_begin(struct file *file, struct address_space *mapping,
+ loff_t pos, unsigned len, unsigned flags,
+ struct page **pagep, void **fsdata)
+@@ -2436,7 +2448,8 @@ retry:
+ * to journalling the i_disksize update if writes to the end
+ * of file which has an already mapped buffer.
+ */
+- handle = ext4_journal_start(inode, 1);
++ handle = ext4_journal_start(inode,
++ ext4_da_write_credits(inode, pos, len));
+ if (IS_ERR(handle)) {
+ ret = PTR_ERR(handle);
+ goto out;
+@@ -3840,6 +3853,13 @@ bad_inode:
+ return ERR_PTR(ret);
+ }
+
++struct inode *ext4_iget_normal(struct super_block *sb, unsigned long ino)
++{
++ if (ino < EXT4_FIRST_INO(sb) && ino != EXT4_ROOT_INO)
++ return ERR_PTR(-EIO);
++ return ext4_iget(sb, ino);
++}
++
+ static int ext4_inode_blocks_set(handle_t *handle,
+ struct ext4_inode *raw_inode,
+ struct ext4_inode_info *ei)
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 665e55ca208c..dc5852301da7 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1051,7 +1051,7 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, stru
+ dentry->d_name.name);
+ return ERR_PTR(-EIO);
+ }
+- inode = ext4_iget(dir->i_sb, ino);
++ inode = ext4_iget_normal(dir->i_sb, ino);
+ if (inode == ERR_PTR(-ESTALE)) {
+ EXT4_ERROR_INODE(dir,
+ "deleted inode referenced: %u",
+@@ -1087,7 +1087,7 @@ struct dentry *ext4_get_parent(struct dentry *child)
+ return ERR_PTR(-EIO);
+ }
+
+- return d_obtain_alias(ext4_iget(child->d_inode->i_sb, ino));
++ return d_obtain_alias(ext4_iget_normal(child->d_inode->i_sb, ino));
+ }
+
+ #define S_SHIFT 12
+@@ -1421,31 +1421,38 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
+ hinfo.hash_version += EXT4_SB(dir->i_sb)->s_hash_unsigned;
+ hinfo.seed = EXT4_SB(dir->i_sb)->s_hash_seed;
+ ext4fs_dirhash(name, namelen, &hinfo);
++ memset(frames, 0, sizeof(frames));
+ frame = frames;
+ frame->entries = entries;
+ frame->at = entries;
+ frame->bh = bh;
+ bh = bh2;
+
+- ext4_handle_dirty_metadata(handle, dir, frame->bh);
+- ext4_handle_dirty_metadata(handle, dir, bh);
++ retval = ext4_handle_dirty_metadata(handle, dir, frame->bh);
++ if (retval)
++ goto out_frames;
++ retval = ext4_handle_dirty_metadata(handle, dir, bh);
++ if (retval)
++ goto out_frames;
+
+ de = do_split(handle,dir, &bh, frame, &hinfo, &retval);
+ if (!de) {
+- /*
+- * Even if the block split failed, we have to properly write
+- * out all the changes we did so far. Otherwise we can end up
+- * with corrupted filesystem.
+- */
+- ext4_mark_inode_dirty(handle, dir);
+- dx_release(frames);
+- return retval;
++ goto out_frames;
+ }
+ dx_release(frames);
+
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
+ brelse(bh);
+ return retval;
++out_frames:
++ /*
++ * Even if the block split failed, we have to properly write
++ * out all the changes we did so far. Otherwise we can end up
++ * with corrupted filesystem.
++ */
++ ext4_mark_inode_dirty(handle, dir);
++ dx_release(frames);
++ return retval;
+ }
+
+ /*
+@@ -1992,7 +1999,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode)
+ struct ext4_iloc iloc;
+ int err = 0, rc;
+
+- if (!ext4_handle_valid(handle))
++ if (!ext4_handle_valid(handle) || is_bad_inode(inode))
+ return 0;
+
+ mutex_lock(&EXT4_SB(sb)->s_orphan_lock);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index a43e43c835d1..cfd321104250 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -991,7 +991,7 @@ static void update_backups(struct super_block *sb,
+ (err = ext4_journal_restart(handle, EXT4_MAX_TRANS_DATA)))
+ break;
+
+- bh = sb_getblk(sb, group * bpg + blk_off);
++ bh = sb_getblk(sb, ((ext4_fsblk_t)group) * bpg + blk_off);
+ if (!bh) {
+ err = -ENOMEM;
+ break;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index f0e4e46867f7..92ea560efcc7 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1041,7 +1041,7 @@ static struct inode *ext4_nfs_get_inode(struct super_block *sb,
+ * Currently we don't know the generation for parent directory, so
+ * a generation of 0 means "accept any"
+ */
+- inode = ext4_iget(sb, ino);
++ inode = ext4_iget_normal(sb, ino);
+ if (IS_ERR(inode))
+ return ERR_CAST(inode);
+ if (generation && inode->i_generation != generation) {
+@@ -1642,13 +1642,6 @@ static int parse_options(char *options, struct super_block *sb,
+ "not specified");
+ return 0;
+ }
+- } else {
+- if (sbi->s_jquota_fmt) {
+- ext4_msg(sb, KERN_ERR, "journaled quota format "
+- "specified with no journaling "
+- "enabled");
+- return 0;
+- }
+ }
+ #endif
+ if (test_opt(sb, DIOREAD_NOLOCK)) {
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index 5743e9db8027..96455e6988fe 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -144,14 +144,28 @@ ext4_listxattr(struct dentry *dentry, char *buffer, size_t size)
+ }
+
+ static int
+-ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end)
++ext4_xattr_check_names(struct ext4_xattr_entry *entry, void *end,
++ void *value_start)
+ {
+- while (!IS_LAST_ENTRY(entry)) {
+- struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(entry);
++ struct ext4_xattr_entry *e = entry;
++
++ while (!IS_LAST_ENTRY(e)) {
++ struct ext4_xattr_entry *next = EXT4_XATTR_NEXT(e);
+ if ((void *)next >= end)
+ return -EIO;
+- entry = next;
++ e = next;
+ }
++
++ while (!IS_LAST_ENTRY(entry)) {
++ if (entry->e_value_size != 0 &&
++ (value_start + le16_to_cpu(entry->e_value_offs) <
++ (void *)e + sizeof(__u32) ||
++ value_start + le16_to_cpu(entry->e_value_offs) +
++ le32_to_cpu(entry->e_value_size) > end))
++ return -EIO;
++ entry = EXT4_XATTR_NEXT(entry);
++ }
++
+ return 0;
+ }
+
+@@ -161,7 +175,8 @@ ext4_xattr_check_block(struct buffer_head *bh)
+ if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) ||
+ BHDR(bh)->h_blocks != cpu_to_le32(1))
+ return -EIO;
+- return ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size);
++ return ext4_xattr_check_names(BFIRST(bh), bh->b_data + bh->b_size,
++ bh->b_data);
+ }
+
+ static inline int
+@@ -274,7 +289,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name,
+ header = IHDR(inode, raw_inode);
+ entry = IFIRST(header);
+ end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+- error = ext4_xattr_check_names(entry, end);
++ error = ext4_xattr_check_names(entry, end, entry);
+ if (error)
+ goto cleanup;
+ error = ext4_xattr_find_entry(&entry, name_index, name,
+@@ -402,7 +417,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size)
+ raw_inode = ext4_raw_inode(&iloc);
+ header = IHDR(inode, raw_inode);
+ end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+- error = ext4_xattr_check_names(IFIRST(header), end);
++ error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header));
+ if (error)
+ goto cleanup;
+ error = ext4_xattr_list_entries(dentry, IFIRST(header),
+@@ -914,7 +929,8 @@ ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i,
+ is->s.here = is->s.first;
+ is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size;
+ if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) {
+- error = ext4_xattr_check_names(IFIRST(header), is->s.end);
++ error = ext4_xattr_check_names(IFIRST(header), is->s.end,
++ IFIRST(header));
+ if (error)
+ return error;
+ /* Find the named attribute. */
+diff --git a/fs/ioprio.c b/fs/ioprio.c
+index 0f1b9515213b..0dd6a2a7ae82 100644
+--- a/fs/ioprio.c
++++ b/fs/ioprio.c
+@@ -153,14 +153,16 @@ out:
+
+ int ioprio_best(unsigned short aprio, unsigned short bprio)
+ {
+- unsigned short aclass = IOPRIO_PRIO_CLASS(aprio);
+- unsigned short bclass = IOPRIO_PRIO_CLASS(bprio);
++ unsigned short aclass;
++ unsigned short bclass;
+
+- if (aclass == IOPRIO_CLASS_NONE)
+- aclass = IOPRIO_CLASS_BE;
+- if (bclass == IOPRIO_CLASS_NONE)
+- bclass = IOPRIO_CLASS_BE;
++ if (!ioprio_valid(aprio))
++ aprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM);
++ if (!ioprio_valid(bprio))
++ bprio = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_BE, IOPRIO_NORM);
+
++ aclass = IOPRIO_PRIO_CLASS(aprio);
++ bclass = IOPRIO_PRIO_CLASS(bprio);
+ if (aclass == bclass)
+ return min(aprio, bprio);
+ if (aclass > bclass)
+diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
+index 606a8dd8818c..0a68e0b22839 100644
+--- a/fs/lockd/mon.c
++++ b/fs/lockd/mon.c
+@@ -114,6 +114,12 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res,
+
+ msg.rpc_proc = &clnt->cl_procinfo[proc];
+ status = rpc_call_sync(clnt, &msg, 0);
++ if (status == -ECONNREFUSED) {
++ dprintk("lockd: NSM upcall RPC failed, status=%d, forcing rebind\n",
++ status);
++ rpc_force_rebind(clnt);
++ status = rpc_call_sync(clnt, &msg, RPC_TASK_SOFTCONN);
++ }
+ if (status < 0)
+ dprintk("lockd: NSM upcall RPC failed, status=%d\n",
+ status);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index f0f2e067c5df..f7be8d9c1cd6 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -2508,6 +2508,9 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+ /* make sure we can reach put_old from new_root */
+ if (!is_path_reachable(real_mount(old.mnt), old.dentry, &new))
+ goto out4;
++ /* make certain new is below the root */
++ if (!is_path_reachable(new_mnt, new.dentry, &root))
++ goto out4;
+ br_write_lock(vfsmount_lock);
+ detach_mnt(new_mnt, &parent_path);
+ detach_mnt(root_mnt, &root_parent);
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 9bb4e5c541b0..a6d59054e8b3 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -512,7 +512,7 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
+ {
+ struct inode *inode = dentry->d_inode;
+ int need_atime = NFS_I(inode)->cache_validity & NFS_INO_INVALID_ATIME;
+- int err;
++ int err = 0;
+
+ /* Flush out writes to the server in order to update c/mtime. */
+ if (S_ISREG(inode->i_mode)) {
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 527a4fc12546..3d344ab0bdb3 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1740,6 +1740,28 @@ static int nfs4_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *sta
+ return ret;
+ }
+
++static void nfs_finish_clear_delegation_stateid(struct nfs4_state *state)
++{
++ nfs_remove_bad_delegation(state->inode);
++ write_seqlock(&state->seqlock);
++ nfs4_stateid_copy(&state->stateid, &state->open_stateid);
++ write_sequnlock(&state->seqlock);
++ clear_bit(NFS_DELEGATED_STATE, &state->flags);
++}
++
++static void nfs40_clear_delegation_stateid(struct nfs4_state *state)
++{
++ if (rcu_access_pointer(NFS_I(state->inode)->delegation) != NULL)
++ nfs_finish_clear_delegation_stateid(state);
++}
++
++static int nfs40_open_expired(struct nfs4_state_owner *sp, struct nfs4_state *state)
++{
++ /* NFSv4.0 doesn't allow for delegation recovery on open expire */
++ nfs40_clear_delegation_stateid(state);
++ return nfs4_open_expired(sp, state);
++}
++
+ #if defined(CONFIG_NFS_V4_1)
+ static int nfs41_check_expired_stateid(struct nfs4_state *state, nfs4_stateid *stateid, unsigned int flags)
+ {
+@@ -5796,7 +5818,7 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cr
+ int ret = 0;
+
+ if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0)
+- return 0;
++ return -EAGAIN;
+ task = _nfs41_proc_sequence(clp, cred, &nfs41_sequence_ops);
+ if (IS_ERR(task))
+ ret = PTR_ERR(task);
+@@ -6547,7 +6569,7 @@ static const struct nfs4_state_recovery_ops nfs41_reboot_recovery_ops = {
+ static const struct nfs4_state_recovery_ops nfs40_nograce_recovery_ops = {
+ .owner_flag_bit = NFS_OWNER_RECLAIM_NOGRACE,
+ .state_flag_bit = NFS_STATE_RECLAIM_NOGRACE,
+- .recover_open = nfs4_open_expired,
++ .recover_open = nfs40_open_expired,
+ .recover_lock = nfs4_lock_expired,
+ .establish_clid = nfs4_init_clientid,
+ .get_clid_cred = nfs4_get_setclientid_cred,
+diff --git a/fs/nfs/nfs4renewd.c b/fs/nfs/nfs4renewd.c
+index dc484c0eae7f..78071cf90079 100644
+--- a/fs/nfs/nfs4renewd.c
++++ b/fs/nfs/nfs4renewd.c
+@@ -88,10 +88,18 @@ nfs4_renew_state(struct work_struct *work)
+ }
+ nfs_expire_all_delegations(clp);
+ } else {
++ int ret;
++
+ /* Queue an asynchronous RENEW. */
+- ops->sched_state_renewal(clp, cred, renew_flags);
++ ret = ops->sched_state_renewal(clp, cred, renew_flags);
+ put_rpccred(cred);
+- goto out_exp;
++ switch (ret) {
++ default:
++ goto out_exp;
++ case -EAGAIN:
++ case -ENOMEM:
++ break;
++ }
+ }
+ } else {
+ dprintk("%s: failed to call renewd. Reason: lease not expired \n",
+diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
+index 461816beff13..c4600b59744a 100644
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1515,7 +1515,8 @@ restart:
+ if (status < 0) {
+ set_bit(ops->owner_flag_bit, &sp->so_flags);
+ nfs4_put_state_owner(sp);
+- return nfs4_recovery_handle_error(clp, status);
++ status = nfs4_recovery_handle_error(clp, status);
++ return (status != 0) ? status : -EAGAIN;
+ }
+
+ nfs4_put_state_owner(sp);
+@@ -1524,7 +1525,7 @@ restart:
+ spin_unlock(&clp->cl_lock);
+ }
+ rcu_read_unlock();
+- return status;
++ return 0;
+ }
+
+ static int nfs4_check_lease(struct nfs_client *clp)
+@@ -1796,23 +1797,18 @@ static void nfs4_state_manager(struct nfs_client *clp)
+ if (test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state)) {
+ status = nfs4_do_reclaim(clp,
+ clp->cl_mvops->reboot_recovery_ops);
+- if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
+- test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state))
+- continue;
+- nfs4_state_end_reclaim_reboot(clp);
+- if (test_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state))
++ if (status == -EAGAIN)
+ continue;
+ if (status < 0)
+ goto out_error;
++ nfs4_state_end_reclaim_reboot(clp);
+ }
+
+ /* Now recover expired state... */
+ if (test_and_clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &clp->cl_state)) {
+ status = nfs4_do_reclaim(clp,
+ clp->cl_mvops->nograce_recovery_ops);
+- if (test_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state) ||
+- test_bit(NFS4CLNT_SESSION_RESET, &clp->cl_state) ||
+- test_bit(NFS4CLNT_RECLAIM_REBOOT, &clp->cl_state))
++ if (status == -EAGAIN)
+ continue;
+ if (status < 0)
+ goto out_error;
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 22beaff3544a..b2ce878080be 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1132,7 +1132,8 @@ static bool need_wrongsec_check(struct svc_rqst *rqstp)
+ */
+ if (argp->opcnt == resp->opcnt)
+ return false;
+-
++ if (next->opnum == OP_ILLEGAL)
++ return false;
+ nextd = OPDESC(next);
+ /*
+ * Rest of 2.6.3.1.1: certain operations will return WRONGSEC
+diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
+index 48bc91d60fce..97d91f046265 100644
+--- a/fs/notify/fanotify/fanotify_user.c
++++ b/fs/notify/fanotify/fanotify_user.c
+@@ -67,7 +67,7 @@ static int create_fd(struct fsnotify_group *group, struct fsnotify_event *event)
+
+ pr_debug("%s: group=%p event=%p\n", __func__, group, event);
+
+- client_fd = get_unused_fd();
++ client_fd = get_unused_fd_flags(group->fanotify_data.f_flags);
+ if (client_fd < 0)
+ return client_fd;
+
+diff --git a/fs/super.c b/fs/super.c
+index 3c520a5ed715..d0154e52c76b 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -69,6 +69,8 @@ static int prune_super(struct shrinker *shrink, struct shrink_control *sc)
+
+ total_objects = sb->s_nr_dentry_unused +
+ sb->s_nr_inodes_unused + fs_objects + 1;
++ if (!total_objects)
++ total_objects = 1;
+
+ if (sc->nr_to_scan) {
+ int dentries;
+diff --git a/fs/ubifs/commit.c b/fs/ubifs/commit.c
+index fb3b5c813a30..b2ca12fd593b 100644
+--- a/fs/ubifs/commit.c
++++ b/fs/ubifs/commit.c
+@@ -166,15 +166,10 @@ static int do_commit(struct ubifs_info *c)
+ err = ubifs_orphan_end_commit(c);
+ if (err)
+ goto out;
+- old_ltail_lnum = c->ltail_lnum;
+- err = ubifs_log_end_commit(c, new_ltail_lnum);
+- if (err)
+- goto out;
+ err = dbg_check_old_index(c, &zroot);
+ if (err)
+ goto out;
+
+- mutex_lock(&c->mst_mutex);
+ c->mst_node->cmt_no = cpu_to_le64(c->cmt_no);
+ c->mst_node->log_lnum = cpu_to_le32(new_ltail_lnum);
+ c->mst_node->root_lnum = cpu_to_le32(zroot.lnum);
+@@ -203,8 +198,9 @@ static int do_commit(struct ubifs_info *c)
+ c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
+ else
+ c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_NO_ORPHS);
+- err = ubifs_write_master(c);
+- mutex_unlock(&c->mst_mutex);
++
++ old_ltail_lnum = c->ltail_lnum;
++ err = ubifs_log_end_commit(c, new_ltail_lnum);
+ if (err)
+ goto out;
+
+diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
+index f9fd068d1ae0..843beda25767 100644
+--- a/fs/ubifs/log.c
++++ b/fs/ubifs/log.c
+@@ -110,10 +110,14 @@ static inline long long empty_log_bytes(const struct ubifs_info *c)
+ h = (long long)c->lhead_lnum * c->leb_size + c->lhead_offs;
+ t = (long long)c->ltail_lnum * c->leb_size;
+
+- if (h >= t)
++ if (h > t)
+ return c->log_bytes - h + t;
+- else
++ else if (h != t)
+ return t - h;
++ else if (c->lhead_lnum != c->ltail_lnum)
++ return 0;
++ else
++ return c->log_bytes;
+ }
+
+ /**
+@@ -453,9 +457,9 @@ out:
+ * @ltail_lnum: new log tail LEB number
+ *
+ * This function is called on when the commit operation was finished. It
+- * moves log tail to new position and unmaps LEBs which contain obsolete data.
+- * Returns zero in case of success and a negative error code in case of
+- * failure.
++ * moves log tail to new position and updates the master node so that it stores
++ * the new log tail LEB number. Returns zero in case of success and a negative
++ * error code in case of failure.
+ */
+ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum)
+ {
+@@ -483,7 +487,12 @@ int ubifs_log_end_commit(struct ubifs_info *c, int ltail_lnum)
+ spin_unlock(&c->buds_lock);
+
+ err = dbg_check_bud_bytes(c);
++ if (err)
++ goto out;
+
++ err = ubifs_write_master(c);
++
++out:
+ mutex_unlock(&c->log_mutex);
+ return err;
+ }
+diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
+index 278c2382e8c2..bb9f48107815 100644
+--- a/fs/ubifs/master.c
++++ b/fs/ubifs/master.c
+@@ -352,10 +352,9 @@ int ubifs_read_master(struct ubifs_info *c)
+ * ubifs_write_master - write master node.
+ * @c: UBIFS file-system description object
+ *
+- * This function writes the master node. The caller has to take the
+- * @c->mst_mutex lock before calling this function. Returns zero in case of
+- * success and a negative error code in case of failure. The master node is
+- * written twice to enable recovery.
++ * This function writes the master node. Returns zero in case of success and a
++ * negative error code in case of failure. The master node is written twice to
++ * enable recovery.
+ */
+ int ubifs_write_master(struct ubifs_info *c)
+ {
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index d867bd97bc60..129bb488ce75 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1984,7 +1984,6 @@ static struct ubifs_info *alloc_ubifs_info(struct ubi_volume_desc *ubi)
+ mutex_init(&c->lp_mutex);
+ mutex_init(&c->tnc_mutex);
+ mutex_init(&c->log_mutex);
+- mutex_init(&c->mst_mutex);
+ mutex_init(&c->umount_mutex);
+ mutex_init(&c->bu_mutex);
+ mutex_init(&c->write_reserve_mutex);
+diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
+index 3f962617e29b..cd62067aea85 100644
+--- a/fs/ubifs/ubifs.h
++++ b/fs/ubifs/ubifs.h
+@@ -1041,7 +1041,6 @@ struct ubifs_debug_info;
+ *
+ * @mst_node: master node
+ * @mst_offs: offset of valid master node
+- * @mst_mutex: protects the master node area, @mst_node, and @mst_offs
+ *
+ * @max_bu_buf_len: maximum bulk-read buffer length
+ * @bu_mutex: protects the pre-allocated bulk-read buffer and @c->bu
+@@ -1281,7 +1280,6 @@ struct ubifs_info {
+
+ struct ubifs_mst_node *mst_node;
+ int mst_offs;
+- struct mutex mst_mutex;
+
+ int max_bu_buf_len;
+ struct mutex bu_mutex;
+diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
+index 757f98066d6b..53baa0d7c34f 100644
+--- a/include/drm/drm_pciids.h
++++ b/include/drm/drm_pciids.h
+@@ -56,7 +56,6 @@
+ {0x1002, 0x4C64, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
+ {0x1002, 0x4C66, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
+ {0x1002, 0x4C67, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV250|RADEON_IS_MOBILITY}, \
+- {0x1002, 0x4C6E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV280|RADEON_IS_MOBILITY}, \
+ {0x1002, 0x4E44, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+ {0x1002, 0x4E45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+ {0x1002, 0x4E46, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_R300}, \
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 4d4ac24a263e..01b7047b60df 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -1069,10 +1069,9 @@ static inline int queue_alignment_offset(struct request_queue *q)
+ static inline int queue_limit_alignment_offset(struct queue_limits *lim, sector_t sector)
+ {
+ unsigned int granularity = max(lim->physical_block_size, lim->io_min);
+- unsigned int alignment = (sector << 9) & (granularity - 1);
++ unsigned int alignment = sector_div(sector, granularity >> 9) << 9;
+
+- return (granularity + lim->alignment_offset - alignment)
+- & (granularity - 1);
++ return (granularity + lim->alignment_offset - alignment) % granularity;
+ }
+
+ static inline int bdev_alignment_offset(struct block_device *bdev)
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 7970e31c8c0e..ea9cffe22ec4 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -37,6 +37,9 @@
+ __asm__ ("" : "=r"(__ptr) : "0"(ptr)); \
+ (typeof(ptr)) (__ptr + (off)); })
+
++/* Make the optimizer believe the variable can be manipulated arbitrarily. */
++#define OPTIMIZER_HIDE_VAR(var) __asm__ ("" : "=r" (var) : "0" (var))
++
+ #ifdef __CHECKER__
+ #define __must_be_array(arr) 0
+ #else
+diff --git a/include/linux/compiler-gcc5.h b/include/linux/compiler-gcc5.h
+new file mode 100644
+index 000000000000..cdd1cc202d51
+--- /dev/null
++++ b/include/linux/compiler-gcc5.h
+@@ -0,0 +1,66 @@
++#ifndef __LINUX_COMPILER_H
++#error "Please don't include <linux/compiler-gcc5.h> directly, include <linux/compiler.h> instead."
++#endif
++
++#define __used __attribute__((__used__))
++#define __must_check __attribute__((warn_unused_result))
++#define __compiler_offsetof(a, b) __builtin_offsetof(a, b)
++
++/* Mark functions as cold. gcc will assume any path leading to a call
++ to them will be unlikely. This means a lot of manual unlikely()s
++ are unnecessary now for any paths leading to the usual suspects
++ like BUG(), printk(), panic() etc. [but let's keep them for now for
++ older compilers]
++
++ Early snapshots of gcc 4.3 don't support this and we can't detect this
++ in the preprocessor, but we can live with this because they're unreleased.
++ Maketime probing would be overkill here.
++
++ gcc also has a __attribute__((__hot__)) to move hot functions into
++ a special section, but I don't see any sense in this right now in
++ the kernel context */
++#define __cold __attribute__((__cold__))
++
++#define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__)
++
++#ifndef __CHECKER__
++# define __compiletime_warning(message) __attribute__((warning(message)))
++# define __compiletime_error(message) __attribute__((error(message)))
++#endif /* __CHECKER__ */
++
++/*
++ * Mark a position in code as unreachable. This can be used to
++ * suppress control flow warnings after asm blocks that transfer
++ * control elsewhere.
++ *
++ * Early snapshots of gcc 4.5 don't support this and we can't detect
++ * this in the preprocessor, but we can live with this because they're
++ * unreleased. Really, we need to have autoconf for the kernel.
++ */
++#define unreachable() __builtin_unreachable()
++
++/* Mark a function definition as prohibited from being cloned. */
++#define __noclone __attribute__((__noclone__))
++
++/*
++ * Tell the optimizer that something else uses this function or variable.
++ */
++#define __visible __attribute__((externally_visible))
++
++/*
++ * GCC 'asm goto' miscompiles certain code sequences:
++ *
++ * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670
++ *
++ * Work it around via a compiler barrier quirk suggested by Jakub Jelinek.
++ * Fixed in GCC 4.8.2 and later versions.
++ *
++ * (asm goto is automatically volatile - the naming reflects this.)
++ */
++#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0)
++
++#ifdef CONFIG_ARCH_USE_BUILTIN_BSWAP
++#define __HAVE_BUILTIN_BSWAP32__
++#define __HAVE_BUILTIN_BSWAP64__
++#define __HAVE_BUILTIN_BSWAP16__
++#endif /* CONFIG_ARCH_USE_BUILTIN_BSWAP */
+diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
+index cba9593c4047..1a97cac7dcb2 100644
+--- a/include/linux/compiler-intel.h
++++ b/include/linux/compiler-intel.h
+@@ -15,6 +15,7 @@
+ */
+ #undef barrier
+ #undef RELOC_HIDE
++#undef OPTIMIZER_HIDE_VAR
+
+ #define barrier() __memory_barrier()
+
+@@ -23,6 +24,12 @@
+ __ptr = (unsigned long) (ptr); \
+ (typeof(ptr)) (__ptr + (off)); })
+
++/* This should act as an optimization barrier on var.
++ * Given that this compiler does not have inline assembly, a compiler barrier
++ * is the best we can do.
++ */
++#define OPTIMIZER_HIDE_VAR(var) barrier()
++
+ /* Intel ECC compiler doesn't support __builtin_types_compatible_p() */
+ #define __must_be_array(a) 0
+
+diff --git a/include/linux/init_task.h b/include/linux/init_task.h
+index e7bafa432aa3..b11e298e989f 100644
+--- a/include/linux/init_task.h
++++ b/include/linux/init_task.h
+@@ -38,6 +38,7 @@ extern struct fs_struct init_fs;
+
+ #define INIT_SIGNALS(sig) { \
+ .nr_threads = 1, \
++ .thread_head = LIST_HEAD_INIT(init_task.thread_node), \
+ .wait_chldexit = __WAIT_QUEUE_HEAD_INITIALIZER(sig.wait_chldexit),\
+ .shared_pending = { \
+ .list = LIST_HEAD_INIT(sig.shared_pending.list), \
+@@ -202,6 +203,7 @@ extern struct task_group root_task_group;
+ [PIDTYPE_SID] = INIT_PID_LINK(PIDTYPE_SID), \
+ }, \
+ .thread_group = LIST_HEAD_INIT(tsk.thread_group), \
++ .thread_node = LIST_HEAD_INIT(init_signals.thread_head), \
+ INIT_IDS \
+ INIT_PERF_EVENTS(tsk) \
+ INIT_TRACE_IRQFLAGS \
+diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
+index 6b394f0b5148..eeb307985715 100644
+--- a/include/linux/khugepaged.h
++++ b/include/linux/khugepaged.h
+@@ -6,7 +6,8 @@
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ extern int __khugepaged_enter(struct mm_struct *mm);
+ extern void __khugepaged_exit(struct mm_struct *mm);
+-extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma);
++extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
++ unsigned long vm_flags);
+
+ #define khugepaged_enabled() \
+ (transparent_hugepage_flags & \
+@@ -35,13 +36,13 @@ static inline void khugepaged_exit(struct mm_struct *mm)
+ __khugepaged_exit(mm);
+ }
+
+-static inline int khugepaged_enter(struct vm_area_struct *vma)
++static inline int khugepaged_enter(struct vm_area_struct *vma,
++ unsigned long vm_flags)
+ {
+ if (!test_bit(MMF_VM_HUGEPAGE, &vma->vm_mm->flags))
+ if ((khugepaged_always() ||
+- (khugepaged_req_madv() &&
+- vma->vm_flags & VM_HUGEPAGE)) &&
+- !(vma->vm_flags & VM_NOHUGEPAGE))
++ (khugepaged_req_madv() && (vm_flags & VM_HUGEPAGE))) &&
++ !(vm_flags & VM_NOHUGEPAGE))
+ if (__khugepaged_enter(vma->vm_mm))
+ return -ENOMEM;
+ return 0;
+@@ -54,11 +55,13 @@ static inline int khugepaged_fork(struct mm_struct *mm, struct mm_struct *oldmm)
+ static inline void khugepaged_exit(struct mm_struct *mm)
+ {
+ }
+-static inline int khugepaged_enter(struct vm_area_struct *vma)
++static inline int khugepaged_enter(struct vm_area_struct *vma,
++ unsigned long vm_flags)
+ {
+ return 0;
+ }
+-static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
++static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
++ unsigned long vm_flags)
+ {
+ return 0;
+ }
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index dbca4b21b7d3..656b4e968991 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -953,6 +953,7 @@ static inline void unmap_shared_mapping_range(struct address_space *mapping,
+
+ extern void truncate_pagecache(struct inode *inode, loff_t old, loff_t new);
+ extern void truncate_setsize(struct inode *inode, loff_t newsize);
++void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to);
+ extern int vmtruncate(struct inode *inode, loff_t offset);
+ extern int vmtruncate_range(struct inode *inode, loff_t offset, loff_t end);
+ void truncate_pagecache_range(struct inode *inode, loff_t offset, loff_t end);
+diff --git a/include/linux/of.h b/include/linux/of.h
+index fa7fb1d97458..ac58796df055 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -212,14 +212,12 @@ extern int of_property_read_u64(const struct device_node *np,
+ extern int of_property_read_string(struct device_node *np,
+ const char *propname,
+ const char **out_string);
+-extern int of_property_read_string_index(struct device_node *np,
+- const char *propname,
+- int index, const char **output);
+ extern int of_property_match_string(struct device_node *np,
+ const char *propname,
+ const char *string);
+-extern int of_property_count_strings(struct device_node *np,
+- const char *propname);
++extern int of_property_read_string_helper(struct device_node *np,
++ const char *propname,
++ const char **out_strs, size_t sz, int index);
+ extern int of_device_is_compatible(const struct device_node *device,
+ const char *);
+ extern int of_device_is_available(const struct device_node *device);
+@@ -304,15 +302,9 @@ static inline int of_property_read_string(struct device_node *np,
+ return -ENOSYS;
+ }
+
+-static inline int of_property_read_string_index(struct device_node *np,
+- const char *propname, int index,
+- const char **out_string)
+-{
+- return -ENOSYS;
+-}
+-
+-static inline int of_property_count_strings(struct device_node *np,
+- const char *propname)
++static inline int of_property_read_string_helper(struct device_node *np,
++ const char *propname,
++ const char **out_strs, size_t sz, int index)
+ {
+ return -ENOSYS;
+ }
+@@ -352,6 +344,70 @@ static inline int of_machine_is_compatible(const char *compat)
+ #endif /* CONFIG_OF */
+
+ /**
++ * of_property_read_string_array() - Read an array of strings from a multiple
++ * strings property.
++ * @np: device node from which the property value is to be read.
++ * @propname: name of the property to be searched.
++ * @out_strs: output array of string pointers.
++ * @sz: number of array elements to read.
++ *
++ * Search for a property in a device tree node and retrieve a list of
++ * terminated string values (pointer to data, not a copy) in that property.
++ *
++ * If @out_strs is NULL, the number of strings in the property is returned.
++ */
++static inline int of_property_read_string_array(struct device_node *np,
++ const char *propname, const char **out_strs,
++ size_t sz)
++{
++ return of_property_read_string_helper(np, propname, out_strs, sz, 0);
++}
++
++/**
++ * of_property_count_strings() - Find and return the number of strings from a
++ * multiple strings property.
++ * @np: device node from which the property value is to be read.
++ * @propname: name of the property to be searched.
++ *
++ * Search for a property in a device tree node and retrieve the number of null
++ * terminated string contain in it. Returns the number of strings on
++ * success, -EINVAL if the property does not exist, -ENODATA if property
++ * does not have a value, and -EILSEQ if the string is not null-terminated
++ * within the length of the property data.
++ */
++static inline int of_property_count_strings(struct device_node *np,
++ const char *propname)
++{
++ return of_property_read_string_helper(np, propname, NULL, 0, 0);
++}
++
++/**
++ * of_property_read_string_index() - Find and read a string from a multiple
++ * strings property.
++ * @np: device node from which the property value is to be read.
++ * @propname: name of the property to be searched.
++ * @index: index of the string in the list of strings
++ * @out_string: pointer to null terminated return string, modified only if
++ * return value is 0.
++ *
++ * Search for a property in a device tree node and retrieve a null
++ * terminated string value (pointer to data, not a copy) in the list of strings
++ * contained in that property.
++ * Returns 0 on success, -EINVAL if the property does not exist, -ENODATA if
++ * property does not have a value, and -EILSEQ if the string is not
++ * null-terminated within the length of the property data.
++ *
++ * The out_string pointer is modified only if a valid string can be decoded.
++ */
++static inline int of_property_read_string_index(struct device_node *np,
++ const char *propname,
++ int index, const char **output)
++{
++ int rc = of_property_read_string_helper(np, propname, output, 1, index);
++ return rc < 0 ? rc : 0;
++}
++
++/**
+ * of_property_read_bool - Findfrom a property
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
+diff --git a/include/linux/oom.h b/include/linux/oom.h
+index 3d7647536b03..d6ed7b05e31c 100644
+--- a/include/linux/oom.h
++++ b/include/linux/oom.h
+@@ -45,6 +45,10 @@ extern int test_set_oom_score_adj(int new_val);
+
+ extern unsigned int oom_badness(struct task_struct *p, struct mem_cgroup *memcg,
+ const nodemask_t *nodemask, unsigned long totalpages);
++
++extern int oom_kills_count(void);
++extern void note_oom_kill(void);
++
+ extern int try_set_zonelist_oom(struct zonelist *zonelist, gfp_t gfp_flags);
+ extern void clear_zonelist_oom(struct zonelist *zonelist, gfp_t gfp_flags);
+
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 56d8233c5de7..d529bd9e6680 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -534,6 +534,7 @@ struct signal_struct {
+ atomic_t sigcnt;
+ atomic_t live;
+ int nr_threads;
++ struct list_head thread_head;
+
+ wait_queue_head_t wait_chldexit; /* for wait4() */
+
+@@ -1394,6 +1395,7 @@ struct task_struct {
+ /* PID/PID hash table linkage. */
+ struct pid_link pids[PIDTYPE_MAX];
+ struct list_head thread_group;
++ struct list_head thread_node;
+
+ struct completion *vfork_done; /* for vfork() */
+ int __user *set_child_tid; /* CLONE_CHILD_SETTID */
+@@ -2397,6 +2399,16 @@ extern bool current_is_single_threaded(void);
+ #define while_each_thread(g, t) \
+ while ((t = next_thread(t)) != g)
+
++#define __for_each_thread(signal, t) \
++ list_for_each_entry_rcu(t, &(signal)->thread_head, thread_node)
++
++#define for_each_thread(p, t) \
++ __for_each_thread((p)->signal, t)
++
++/* Careful: this is a double loop, 'break' won't work as expected. */
++#define for_each_process_thread(p, t) \
++ for_each_process(p) for_each_thread(p, t)
++
+ static inline int get_nr_threads(struct task_struct *tsk)
+ {
+ return tsk->signal->nr_threads;
+diff --git a/include/linux/string.h b/include/linux/string.h
+index e033564f10ba..3d9feb70dc20 100644
+--- a/include/linux/string.h
++++ b/include/linux/string.h
+@@ -133,7 +133,7 @@ int bprintf(u32 *bin_buf, size_t size, const char *fmt, ...) __printf(3, 4);
+ #endif
+
+ extern ssize_t memory_read_from_buffer(void *to, size_t count, loff_t *ppos,
+- const void *from, size_t available);
++ const void *from, size_t available);
+
+ /**
+ * strstarts - does @str start with @prefix?
+@@ -144,5 +144,7 @@ static inline bool strstarts(const char *str, const char *prefix)
+ {
+ return strncmp(str, prefix, strlen(prefix)) == 0;
+ }
++
++void memzero_explicit(void *s, size_t count);
+ #endif
+ #endif /* _LINUX_STRING_H_ */
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index 3e93de7ecbc3..d0d2af09dcc6 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -30,4 +30,10 @@
+ descriptor */
+ #define USB_QUIRK_DELAY_INIT 0x00000040
+
++/* device generates spurious wakeup, ignore remote wakeup capability */
++#define USB_QUIRK_IGNORE_REMOTE_WAKEUP 0x00000200
++
++/* device can't handle device_qualifier descriptor requests */
++#define USB_QUIRK_DEVICE_QUALIFIER 0x00000100
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index 117eaa578d0d..8898a191929a 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -485,6 +485,7 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
+ }
+
+ extern void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
++void ipv6_proxy_select_ident(struct sk_buff *skb);
+
+ /*
+ * Prototypes exported by ipv6
+diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
+index 0caf1f8de0fb..8a142844318f 100644
+--- a/kernel/audit_tree.c
++++ b/kernel/audit_tree.c
+@@ -154,6 +154,7 @@ static struct audit_chunk *alloc_chunk(int count)
+ chunk->owners[i].index = i;
+ }
+ fsnotify_init_mark(&chunk->mark, audit_tree_destroy_watch);
++ chunk->mark.mask = FS_IN_IGNORED;
+ return chunk;
+ }
+
+diff --git a/kernel/exit.c b/kernel/exit.c
+index 3eb4dcfc658a..38980ea0b2d6 100644
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -74,6 +74,7 @@ static void __unhash_process(struct task_struct *p, bool group_dead)
+ __this_cpu_dec(process_counts);
+ }
+ list_del_rcu(&p->thread_group);
++ list_del_rcu(&p->thread_node);
+ }
+
+ /*
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 878dcb2eec55..be2495f0eed7 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1026,6 +1026,11 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
+ sig->nr_threads = 1;
+ atomic_set(&sig->live, 1);
+ atomic_set(&sig->sigcnt, 1);
++
++ /* list_add(thread_node, thread_head) without INIT_LIST_HEAD() */
++ sig->thread_head = (struct list_head)LIST_HEAD_INIT(tsk->thread_node);
++ tsk->thread_node = (struct list_head)LIST_HEAD_INIT(sig->thread_head);
++
+ init_waitqueue_head(&sig->wait_chldexit);
+ if (clone_flags & CLONE_NEWPID)
+ sig->flags |= SIGNAL_UNKILLABLE;
+@@ -1412,14 +1417,6 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ goto bad_fork_free_pid;
+ }
+
+- if (clone_flags & CLONE_THREAD) {
+- current->signal->nr_threads++;
+- atomic_inc(¤t->signal->live);
+- atomic_inc(¤t->signal->sigcnt);
+- p->group_leader = current->group_leader;
+- list_add_tail_rcu(&p->thread_group, &p->group_leader->thread_group);
+- }
+-
+ if (likely(p->pid)) {
+ ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
+
+@@ -1434,6 +1431,15 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ list_add_tail(&p->sibling, &p->real_parent->children);
+ list_add_tail_rcu(&p->tasks, &init_task.tasks);
+ __this_cpu_inc(process_counts);
++ } else {
++ current->signal->nr_threads++;
++ atomic_inc(¤t->signal->live);
++ atomic_inc(¤t->signal->sigcnt);
++ p->group_leader = current->group_leader;
++ list_add_tail_rcu(&p->thread_group,
++ &p->group_leader->thread_group);
++ list_add_tail_rcu(&p->thread_node,
++ &p->signal->thread_head);
+ }
+ attach_pid(p, PIDTYPE_PID, pid);
+ nr_threads++;
+diff --git a/kernel/freezer.c b/kernel/freezer.c
+index 11f82a4d4eae..2f8ecd994d47 100644
+--- a/kernel/freezer.c
++++ b/kernel/freezer.c
+@@ -36,6 +36,9 @@ bool freezing_slow_path(struct task_struct *p)
+ if (p->flags & PF_NOFREEZE)
+ return false;
+
++ if (test_thread_flag(TIF_MEMDIE))
++ return false;
++
+ if (pm_nosig_freezing || cgroup_freezing(p))
+ return true;
+
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 41dfb1866f95..6b320c2ad6fa 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -212,6 +212,8 @@ static void drop_futex_key_refs(union futex_key *key)
+ case FUT_OFF_MMSHARED:
+ mmdrop(key->private.mm);
+ break;
++ default:
++ smp_mb(); /* explicit MB (B) */
+ }
+ }
+
+@@ -484,8 +486,14 @@ static struct futex_pi_state * alloc_pi_state(void)
+ return pi_state;
+ }
+
++/*
++ * Must be called with the hb lock held.
++ */
+ static void free_pi_state(struct futex_pi_state *pi_state)
+ {
++ if (!pi_state)
++ return;
++
+ if (!atomic_dec_and_test(&pi_state->refcount))
+ return;
+
+@@ -1399,15 +1407,6 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
+ }
+
+ retry:
+- if (pi_state != NULL) {
+- /*
+- * We will have to lookup the pi_state again, so free this one
+- * to keep the accounting correct.
+- */
+- free_pi_state(pi_state);
+- pi_state = NULL;
+- }
+-
+ ret = get_futex_key(uaddr1, flags & FLAGS_SHARED, &key1, VERIFY_READ);
+ if (unlikely(ret != 0))
+ goto out;
+@@ -1495,6 +1494,8 @@ retry_private:
+ case 0:
+ break;
+ case -EFAULT:
++ free_pi_state(pi_state);
++ pi_state = NULL;
+ double_unlock_hb(hb1, hb2);
+ put_futex_key(&key2);
+ put_futex_key(&key1);
+@@ -1504,6 +1505,8 @@ retry_private:
+ goto out;
+ case -EAGAIN:
+ /* The owner was exiting, try again. */
++ free_pi_state(pi_state);
++ pi_state = NULL;
+ double_unlock_hb(hb1, hb2);
+ put_futex_key(&key2);
+ put_futex_key(&key1);
+@@ -1580,6 +1583,7 @@ retry_private:
+ }
+
+ out_unlock:
++ free_pi_state(pi_state);
+ double_unlock_hb(hb1, hb2);
+
+ /*
+@@ -1596,8 +1600,6 @@ out_put_keys:
+ out_put_key1:
+ put_futex_key(&key1);
+ out:
+- if (pi_state != NULL)
+- free_pi_state(pi_state);
+ return ret ? ret : task_count;
+ }
+
+diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
+index e885be1e8a11..02824a5c2693 100644
+--- a/kernel/posix-timers.c
++++ b/kernel/posix-timers.c
+@@ -589,6 +589,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
+ goto out;
+ }
+ } else {
++ memset(&event.sigev_value, 0, sizeof(event.sigev_value));
+ event.sigev_notify = SIGEV_SIGNAL;
+ event.sigev_signo = SIGALRM;
+ event.sigev_value.sival_int = new_timer->it_id;
+diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
+index 52a18173c845..dd875cbe0d1a 100644
+--- a/kernel/power/hibernate.c
++++ b/kernel/power/hibernate.c
+@@ -486,8 +486,14 @@ int hibernation_restore(int platform_mode)
+ error = dpm_suspend_start(PMSG_QUIESCE);
+ if (!error) {
+ error = resume_target_kernel(platform_mode);
+- dpm_resume_end(PMSG_RECOVER);
++ /*
++ * The above should either succeed and jump to the new kernel,
++ * or return with an error. Otherwise things are just
++ * undefined, so let's be paranoid.
++ */
++ BUG_ON(!error);
+ }
++ dpm_resume_end(PMSG_RECOVER);
+ pm_restore_gfp_mask();
+ ftrace_start();
+ resume_console();
+diff --git a/kernel/power/process.c b/kernel/power/process.c
+index f27d0c8cd9e8..286ff570f3b7 100644
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -114,6 +114,28 @@ static int try_to_freeze_tasks(bool user_only)
+ return todo ? -EBUSY : 0;
+ }
+
++/*
++ * Returns true if all freezable tasks (except for current) are frozen already
++ */
++static bool check_frozen_processes(void)
++{
++ struct task_struct *g, *p;
++ bool ret = true;
++
++ read_lock(&tasklist_lock);
++ for_each_process_thread(g, p) {
++ if (p != current && !freezer_should_skip(p) &&
++ !frozen(p)) {
++ ret = false;
++ goto done;
++ }
++ }
++done:
++ read_unlock(&tasklist_lock);
++
++ return ret;
++}
++
+ /**
+ * freeze_processes - Signal user space processes to enter the refrigerator.
+ *
+@@ -122,6 +144,7 @@ static int try_to_freeze_tasks(bool user_only)
+ int freeze_processes(void)
+ {
+ int error;
++ int oom_kills_saved;
+
+ error = __usermodehelper_disable(UMH_FREEZING);
+ if (error)
+@@ -132,12 +155,27 @@ int freeze_processes(void)
+
+ printk("Freezing user space processes ... ");
+ pm_freezing = true;
++ oom_kills_saved = oom_kills_count();
+ error = try_to_freeze_tasks(true);
+ if (!error) {
+- printk("done.");
+ __usermodehelper_set_disable_depth(UMH_DISABLED);
+ oom_killer_disable();
++
++ /*
++ * There might have been an OOM kill while we were
++ * freezing tasks and the killed task might be still
++ * on the way out so we have to double check for race.
++ */
++ if (oom_kills_count() != oom_kills_saved &&
++ !check_frozen_processes()) {
++ __usermodehelper_set_disable_depth(UMH_ENABLED);
++ printk("OOM in progress.");
++ error = -EBUSY;
++ goto done;
++ }
++ printk("done.");
+ }
++done:
+ printk("\n");
+ BUG_ON(in_atomic());
+
+diff --git a/kernel/trace/trace_syscalls.c b/kernel/trace/trace_syscalls.c
+index c9ce09addacd..4d0a209ecfda 100644
+--- a/kernel/trace/trace_syscalls.c
++++ b/kernel/trace/trace_syscalls.c
+@@ -309,7 +309,7 @@ void ftrace_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ int pc;
+
+ syscall_nr = syscall_get_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_enter_syscalls))
+ return;
+@@ -349,7 +349,7 @@ void ftrace_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ int pc;
+
+ syscall_nr = syscall_get_nr(current, regs);
+- if (syscall_nr < 0)
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
+ return;
+ if (!test_bit(syscall_nr, enabled_exit_syscalls))
+ return;
+@@ -519,6 +519,8 @@ static void perf_syscall_enter(void *ignore, struct pt_regs *regs, long id)
+ int size;
+
+ syscall_nr = syscall_get_nr(current, regs);
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
++ return;
+ if (!test_bit(syscall_nr, enabled_perf_enter_syscalls))
+ return;
+
+@@ -593,6 +595,8 @@ static void perf_syscall_exit(void *ignore, struct pt_regs *regs, long ret)
+ int size;
+
+ syscall_nr = syscall_get_nr(current, regs);
++ if (syscall_nr < 0 || syscall_nr >= NR_syscalls)
++ return;
+ if (!test_bit(syscall_nr, enabled_perf_exit_syscalls))
+ return;
+
+diff --git a/lib/bitmap.c b/lib/bitmap.c
+index b5a8b6ad2454..6ccf2120b406 100644
+--- a/lib/bitmap.c
++++ b/lib/bitmap.c
+@@ -131,7 +131,9 @@ void __bitmap_shift_right(unsigned long *dst,
+ lower = src[off + k];
+ if (left && off + k == lim - 1)
+ lower &= mask;
+- dst[k] = upper << (BITS_PER_LONG - rem) | lower >> rem;
++ dst[k] = lower >> rem;
++ if (rem)
++ dst[k] |= upper << (BITS_PER_LONG - rem);
+ if (left && k == lim - 1)
+ dst[k] &= mask;
+ }
+@@ -172,7 +174,9 @@ void __bitmap_shift_left(unsigned long *dst,
+ upper = src[k];
+ if (left && k == lim - 1)
+ upper &= (1UL << left) - 1;
+- dst[k + off] = lower >> (BITS_PER_LONG - rem) | upper << rem;
++ dst[k + off] = upper << rem;
++ if (rem)
++ dst[k + off] |= lower >> (BITS_PER_LONG - rem);
+ if (left && k + off == lim - 1)
+ dst[k + off] &= (1UL << left) - 1;
+ }
+diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
+index 8563081e8da3..a1c387f6afba 100644
+--- a/lib/lzo/lzo1x_decompress_safe.c
++++ b/lib/lzo/lzo1x_decompress_safe.c
+@@ -19,31 +19,21 @@
+ #include <linux/lzo.h>
+ #include "lzodefs.h"
+
+-#define HAVE_IP(t, x) \
+- (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \
+- (((t + x) >= t) && ((t + x) >= x)))
++#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x))
++#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x))
++#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun
++#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun
++#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun
+
+-#define HAVE_OP(t, x) \
+- (((size_t)(op_end - op) >= (size_t)(t + x)) && \
+- (((t + x) >= t) && ((t + x) >= x)))
+-
+-#define NEED_IP(t, x) \
+- do { \
+- if (!HAVE_IP(t, x)) \
+- goto input_overrun; \
+- } while (0)
+-
+-#define NEED_OP(t, x) \
+- do { \
+- if (!HAVE_OP(t, x)) \
+- goto output_overrun; \
+- } while (0)
+-
+-#define TEST_LB(m_pos) \
+- do { \
+- if ((m_pos) < out) \
+- goto lookbehind_overrun; \
+- } while (0)
++/* This MAX_255_COUNT is the maximum number of times we can add 255 to a base
++ * count without overflowing an integer. The multiply will overflow when
++ * multiplying 255 by more than MAXINT/255. The sum will overflow earlier
++ * depending on the base count. Since the base count is taken from a u8
++ * and a few bits, it is safe to assume that it will always be lower than
++ * or equal to 2*255, thus we can always prevent any overflow by accepting
++ * two less 255 steps. See Documentation/lzo.txt for more information.
++ */
++#define MAX_255_COUNT ((((size_t)~0) / 255) - 2)
+
+ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
+ unsigned char *out, size_t *out_len)
+@@ -75,17 +65,24 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
+ if (t < 16) {
+ if (likely(state == 0)) {
+ if (unlikely(t == 0)) {
++ size_t offset;
++ const unsigned char *ip_last = ip;
++
+ while (unlikely(*ip == 0)) {
+- t += 255;
+ ip++;
+- NEED_IP(1, 0);
++ NEED_IP(1);
+ }
+- t += 15 + *ip++;
++ offset = ip - ip_last;
++ if (unlikely(offset > MAX_255_COUNT))
++ return LZO_E_ERROR;
++
++ offset = (offset << 8) - offset;
++ t += offset + 15 + *ip++;
+ }
+ t += 3;
+ copy_literal_run:
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+- if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
++ if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
+ const unsigned char *ie = ip + t;
+ unsigned char *oe = op + t;
+ do {
+@@ -101,8 +98,8 @@ copy_literal_run:
+ } else
+ #endif
+ {
+- NEED_OP(t, 0);
+- NEED_IP(t, 3);
++ NEED_OP(t);
++ NEED_IP(t + 3);
+ do {
+ *op++ = *ip++;
+ } while (--t > 0);
+@@ -115,7 +112,7 @@ copy_literal_run:
+ m_pos -= t >> 2;
+ m_pos -= *ip++ << 2;
+ TEST_LB(m_pos);
+- NEED_OP(2, 0);
++ NEED_OP(2);
+ op[0] = m_pos[0];
+ op[1] = m_pos[1];
+ op += 2;
+@@ -136,13 +133,20 @@ copy_literal_run:
+ } else if (t >= 32) {
+ t = (t & 31) + (3 - 1);
+ if (unlikely(t == 2)) {
++ size_t offset;
++ const unsigned char *ip_last = ip;
++
+ while (unlikely(*ip == 0)) {
+- t += 255;
+ ip++;
+- NEED_IP(1, 0);
++ NEED_IP(1);
+ }
+- t += 31 + *ip++;
+- NEED_IP(2, 0);
++ offset = ip - ip_last;
++ if (unlikely(offset > MAX_255_COUNT))
++ return LZO_E_ERROR;
++
++ offset = (offset << 8) - offset;
++ t += offset + 31 + *ip++;
++ NEED_IP(2);
+ }
+ m_pos = op - 1;
+ next = get_unaligned_le16(ip);
+@@ -154,13 +158,20 @@ copy_literal_run:
+ m_pos -= (t & 8) << 11;
+ t = (t & 7) + (3 - 1);
+ if (unlikely(t == 2)) {
++ size_t offset;
++ const unsigned char *ip_last = ip;
++
+ while (unlikely(*ip == 0)) {
+- t += 255;
+ ip++;
+- NEED_IP(1, 0);
++ NEED_IP(1);
+ }
+- t += 7 + *ip++;
+- NEED_IP(2, 0);
++ offset = ip - ip_last;
++ if (unlikely(offset > MAX_255_COUNT))
++ return LZO_E_ERROR;
++
++ offset = (offset << 8) - offset;
++ t += offset + 7 + *ip++;
++ NEED_IP(2);
+ }
+ next = get_unaligned_le16(ip);
+ ip += 2;
+@@ -174,7 +185,7 @@ copy_literal_run:
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+ if (op - m_pos >= 8) {
+ unsigned char *oe = op + t;
+- if (likely(HAVE_OP(t, 15))) {
++ if (likely(HAVE_OP(t + 15))) {
+ do {
+ COPY8(op, m_pos);
+ op += 8;
+@@ -184,7 +195,7 @@ copy_literal_run:
+ m_pos += 8;
+ } while (op < oe);
+ op = oe;
+- if (HAVE_IP(6, 0)) {
++ if (HAVE_IP(6)) {
+ state = next;
+ COPY4(op, ip);
+ op += next;
+@@ -192,7 +203,7 @@ copy_literal_run:
+ continue;
+ }
+ } else {
+- NEED_OP(t, 0);
++ NEED_OP(t);
+ do {
+ *op++ = *m_pos++;
+ } while (op < oe);
+@@ -201,7 +212,7 @@ copy_literal_run:
+ #endif
+ {
+ unsigned char *oe = op + t;
+- NEED_OP(t, 0);
++ NEED_OP(t);
+ op[0] = m_pos[0];
+ op[1] = m_pos[1];
+ op += 2;
+@@ -214,15 +225,15 @@ match_next:
+ state = next;
+ t = next;
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+- if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
++ if (likely(HAVE_IP(6) && HAVE_OP(4))) {
+ COPY4(op, ip);
+ op += t;
+ ip += t;
+ } else
+ #endif
+ {
+- NEED_IP(t, 3);
+- NEED_OP(t, 0);
++ NEED_IP(t + 3);
++ NEED_OP(t);
+ while (t > 0) {
+ *op++ = *ip++;
+ t--;
+diff --git a/lib/string.c b/lib/string.c
+index e5878de4f101..43d0781daf47 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -586,6 +586,22 @@ void *memset(void *s, int c, size_t count)
+ EXPORT_SYMBOL(memset);
+ #endif
+
++/**
++ * memzero_explicit - Fill a region of memory (e.g. sensitive
++ * keying data) with 0s.
++ * @s: Pointer to the start of the area.
++ * @count: The size of the area.
++ *
++ * memzero_explicit() doesn't need an arch-specific version as
++ * it just invokes the one of memset() implicitly.
++ */
++void memzero_explicit(void *s, size_t count)
++{
++ memset(s, 0, count);
++ OPTIMIZER_HIDE_VAR(s);
++}
++EXPORT_SYMBOL(memzero_explicit);
++
+ #ifndef __HAVE_ARCH_MEMCPY
+ /**
+ * memcpy - Copy one area of memory to another
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 3da5c0bff3b0..8978c1bf91e4 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -711,7 +711,7 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ if (haddr >= vma->vm_start && haddr + HPAGE_PMD_SIZE <= vma->vm_end) {
+ if (unlikely(anon_vma_prepare(vma)))
+ return VM_FAULT_OOM;
+- if (unlikely(khugepaged_enter(vma)))
++ if (unlikely(khugepaged_enter(vma, vma->vm_flags)))
+ return VM_FAULT_OOM;
+ page = alloc_hugepage_vma(transparent_hugepage_defrag(vma),
+ vma, haddr, numa_node_id(), 0);
+@@ -1505,7 +1505,7 @@ int hugepage_madvise(struct vm_area_struct *vma,
+ * register it here without waiting a page fault that
+ * may not happen any time soon.
+ */
+- if (unlikely(khugepaged_enter_vma_merge(vma)))
++ if (unlikely(khugepaged_enter_vma_merge(vma, *vm_flags)))
+ return -ENOMEM;
+ break;
+ case MADV_NOHUGEPAGE:
+@@ -1637,7 +1637,8 @@ int __khugepaged_enter(struct mm_struct *mm)
+ return 0;
+ }
+
+-int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
++int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
++ unsigned long vm_flags)
+ {
+ unsigned long hstart, hend;
+ if (!vma->anon_vma)
+@@ -1653,11 +1654,11 @@ int khugepaged_enter_vma_merge(struct vm_area_struct *vma)
+ * If is_pfn_mapping() is true is_learn_pfn_mapping() must be
+ * true too, verify it here.
+ */
+- VM_BUG_ON(is_linear_pfn_mapping(vma) || vma->vm_flags & VM_NO_THP);
++ VM_BUG_ON(is_linear_pfn_mapping(vma) || vm_flags & VM_NO_THP);
+ hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
+ hend = vma->vm_end & HPAGE_PMD_MASK;
+ if (hstart < hend)
+- return khugepaged_enter(vma);
++ return khugepaged_enter(vma, vm_flags);
+ return 0;
+ }
+
+diff --git a/mm/memory.c b/mm/memory.c
+index ffd74f370e8d..c34e60a950aa 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1164,8 +1164,10 @@ again:
+ if (unlikely(page_mapcount(page) < 0))
+ print_bad_pte(vma, addr, ptent, page);
+ force_flush = !__tlb_remove_page(tlb, page);
+- if (force_flush)
++ if (force_flush) {
++ addr += PAGE_SIZE;
+ break;
++ }
+ continue;
+ }
+ /*
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 69367e43e52e..94fdbe8f3b99 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -826,7 +826,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ end, prev->vm_pgoff, NULL);
+ if (err)
+ return NULL;
+- khugepaged_enter_vma_merge(prev);
++ khugepaged_enter_vma_merge(prev, vm_flags);
+ return prev;
+ }
+
+@@ -845,7 +845,7 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+ next->vm_pgoff - pglen, NULL);
+ if (err)
+ return NULL;
+- khugepaged_enter_vma_merge(area);
++ khugepaged_enter_vma_merge(area, vm_flags);
+ return area;
+ }
+
+@@ -1820,7 +1820,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+ }
+ }
+ vma_unlock_anon_vma(vma);
+- khugepaged_enter_vma_merge(vma);
++ khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ return error;
+ }
+ #endif /* CONFIG_STACK_GROWSUP || CONFIG_IA64 */
+@@ -1871,7 +1871,7 @@ int expand_downwards(struct vm_area_struct *vma,
+ }
+ }
+ vma_unlock_anon_vma(vma);
+- khugepaged_enter_vma_merge(vma);
++ khugepaged_enter_vma_merge(vma, vma->vm_flags);
+ return error;
+ }
+
+diff --git a/mm/oom_kill.c b/mm/oom_kill.c
+index 597ecac5731a..cb1f046faa68 100644
+--- a/mm/oom_kill.c
++++ b/mm/oom_kill.c
+@@ -435,6 +435,23 @@ static void dump_header(struct task_struct *p, gfp_t gfp_mask, int order,
+ dump_tasks(memcg, nodemask);
+ }
+
++/*
++ * Number of OOM killer invocations (including memcg OOM killer).
++ * Primarily used by PM freezer to check for potential races with
++ * OOM killed frozen task.
++ */
++static atomic_t oom_kills = ATOMIC_INIT(0);
++
++int oom_kills_count(void)
++{
++ return atomic_read(&oom_kills);
++}
++
++void note_oom_kill(void)
++{
++ atomic_inc(&oom_kills);
++}
++
+ #define K(x) ((x) << (PAGE_SHIFT-10))
+ static void oom_kill_process(struct task_struct *p, gfp_t gfp_mask, int order,
+ unsigned int points, unsigned long totalpages,
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index ff0b0997b953..2891a9059f8a 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -1982,6 +1982,14 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order,
+ }
+
+ /*
++ * PM-freezer should be notified that there might be an OOM killer on
++ * its way to kill and wake somebody up. This is too early and we might
++ * end up not killing anything but false positives are acceptable.
++ * See freeze_processes.
++ */
++ note_oom_kill();
++
++ /*
+ * Go through the zonelist yet one more time, keep very high watermark
+ * here, this is only to catch a parallel oom killing, we must fail if
+ * we're still under heavy pressure.
+diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
+index 1ccbd714059c..b7693fdc6bb5 100644
+--- a/mm/page_cgroup.c
++++ b/mm/page_cgroup.c
+@@ -170,6 +170,7 @@ static void free_page_cgroup(void *addr)
+ sizeof(struct page_cgroup) * PAGES_PER_SECTION;
+
+ BUG_ON(PageReserved(page));
++ kmemleak_free(addr);
+ free_pages_exact(addr, table_size);
+ }
+ }
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 5f6042b61ca8..13b2eefabfdd 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1907,8 +1907,6 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
+-
+- pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
+diff --git a/mm/truncate.c b/mm/truncate.c
+index f38055cb8af6..57625f7ed8e1 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -20,6 +20,7 @@
+ #include <linux/buffer_head.h> /* grr. try_to_release_page,
+ do_invalidatepage */
+ #include <linux/cleancache.h>
++#include <linux/rmap.h>
+ #include "internal.h"
+
+
+@@ -571,16 +572,70 @@ EXPORT_SYMBOL(truncate_pagecache);
+ */
+ void truncate_setsize(struct inode *inode, loff_t newsize)
+ {
+- loff_t oldsize;
+-
+- oldsize = inode->i_size;
++ loff_t oldsize = inode->i_size;
+ i_size_write(inode, newsize);
+
++ if (newsize > oldsize)
++ pagecache_isize_extended(inode, oldsize, newsize);
+ truncate_pagecache(inode, oldsize, newsize);
+ }
+ EXPORT_SYMBOL(truncate_setsize);
+
+ /**
++ * pagecache_isize_extended - update pagecache after extension of i_size
++ * @inode: inode for which i_size was extended
++ * @from: original inode size
++ * @to: new inode size
++ *
++ * Handle extension of inode size either caused by extending truncate or by
++ * write starting after current i_size. We mark the page straddling current
++ * i_size RO so that page_mkwrite() is called on the nearest write access to
++ * the page. This way filesystem can be sure that page_mkwrite() is called on
++ * the page before user writes to the page via mmap after the i_size has been
++ * changed.
++ *
++ * The function must be called after i_size is updated so that page fault
++ * coming after we unlock the page will already see the new i_size.
++ * The function must be called while we still hold i_mutex - this not only
++ * makes sure i_size is stable but also that userspace cannot observe new
++ * i_size value before we are prepared to store mmap writes at new inode size.
++ */
++void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to)
++{
++ int bsize = 1 << inode->i_blkbits;
++ loff_t rounded_from;
++ struct page *page;
++ pgoff_t index;
++
++ WARN_ON(to > inode->i_size);
++
++ if (from >= to || bsize == PAGE_CACHE_SIZE)
++ return;
++ /* Page straddling @from will not have any hole block created? */
++ rounded_from = round_up(from, bsize);
++ if (to <= rounded_from || !(rounded_from & (PAGE_CACHE_SIZE - 1)))
++ return;
++
++ index = from >> PAGE_CACHE_SHIFT;
++ page = find_lock_page(inode->i_mapping, index);
++ /* Page not cached? Nothing to do */
++ if (!page)
++ return;
++ /*
++ * See clear_page_dirty_for_io() for details why set_page_dirty()
++ * is needed.
++ */
++ if (page_mkclean(page))
++ set_page_dirty(page);
++ unlock_page(page);
++ page_cache_release(page);
++}
++EXPORT_SYMBOL(pagecache_isize_extended);
++
++/**
++ * truncate_pagecache_range - unmap and remove pagecache that is hole-punched
++ * @inode: inode
++ * @lstart: offset of beginning of hole
+ * vmtruncate - unmap mappings "freed" by truncate() syscall
+ * @inode: inode of the file used
+ * @newsize: file offset to start truncating
+diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
+index 605156f13899..61e2494dc188 100644
+--- a/net/bluetooth/smp.c
++++ b/net/bluetooth/smp.c
+@@ -325,8 +325,11 @@ static int tk_request(struct l2cap_conn *conn, u8 remote_oob, u8 auth,
+ }
+
+ /* Not Just Works/Confirm results in MITM Authentication */
+- if (method != JUST_CFM)
++ if (method != JUST_CFM) {
+ set_bit(SMP_FLAG_MITM_AUTH, &smp->smp_flags);
++ if (hcon->pending_sec_level < BT_SECURITY_HIGH)
++ hcon->pending_sec_level = BT_SECURITY_HIGH;
++ }
+
+ /* If both devices have Keyoard-Display I/O, the master
+ * Confirms and the slave Enters the passkey.
+diff --git a/net/ceph/crypto.c b/net/ceph/crypto.c
+index 9da7fdd3cd8a..3d1be9911b8e 100644
+--- a/net/ceph/crypto.c
++++ b/net/ceph/crypto.c
+@@ -89,11 +89,82 @@ static struct crypto_blkcipher *ceph_crypto_alloc_cipher(void)
+
+ static const u8 *aes_iv = (u8 *)CEPH_AES_IV;
+
++/*
++ * Should be used for buffers allocated with ceph_kvmalloc().
++ * Currently these are encrypt out-buffer (ceph_buffer) and decrypt
++ * in-buffer (msg front).
++ *
++ * Dispose of @sgt with teardown_sgtable().
++ *
++ * @prealloc_sg is to avoid memory allocation inside sg_alloc_table()
++ * in cases where a single sg is sufficient. No attempt to reduce the
++ * number of sgs by squeezing physically contiguous pages together is
++ * made though, for simplicity.
++ */
++static int setup_sgtable(struct sg_table *sgt, struct scatterlist *prealloc_sg,
++ const void *buf, unsigned int buf_len)
++{
++ struct scatterlist *sg;
++ const bool is_vmalloc = is_vmalloc_addr(buf);
++ unsigned int off = offset_in_page(buf);
++ unsigned int chunk_cnt = 1;
++ unsigned int chunk_len = PAGE_ALIGN(off + buf_len);
++ int i;
++ int ret;
++
++ if (buf_len == 0) {
++ memset(sgt, 0, sizeof(*sgt));
++ return -EINVAL;
++ }
++
++ if (is_vmalloc) {
++ chunk_cnt = chunk_len >> PAGE_SHIFT;
++ chunk_len = PAGE_SIZE;
++ }
++
++ if (chunk_cnt > 1) {
++ ret = sg_alloc_table(sgt, chunk_cnt, GFP_NOFS);
++ if (ret)
++ return ret;
++ } else {
++ WARN_ON(chunk_cnt != 1);
++ sg_init_table(prealloc_sg, 1);
++ sgt->sgl = prealloc_sg;
++ sgt->nents = sgt->orig_nents = 1;
++ }
++
++ for_each_sg(sgt->sgl, sg, sgt->orig_nents, i) {
++ struct page *page;
++ unsigned int len = min(chunk_len - off, buf_len);
++
++ if (is_vmalloc)
++ page = vmalloc_to_page(buf);
++ else
++ page = virt_to_page(buf);
++
++ sg_set_page(sg, page, len, off);
++
++ off = 0;
++ buf += len;
++ buf_len -= len;
++ }
++ WARN_ON(buf_len != 0);
++
++ return 0;
++}
++
++static void teardown_sgtable(struct sg_table *sgt)
++{
++ if (sgt->orig_nents > 1)
++ sg_free_table(sgt);
++}
++
+ static int ceph_aes_encrypt(const void *key, int key_len,
+ void *dst, size_t *dst_len,
+ const void *src, size_t src_len)
+ {
+- struct scatterlist sg_in[2], sg_out[1];
++ struct scatterlist sg_in[2], prealloc_sg;
++ struct sg_table sg_out;
+ struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+ int ret;
+@@ -109,16 +180,18 @@ static int ceph_aes_encrypt(const void *key, int key_len,
+
+ *dst_len = src_len + zero_padding;
+
+- crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ sg_init_table(sg_in, 2);
+ sg_set_buf(&sg_in[0], src, src_len);
+ sg_set_buf(&sg_in[1], pad, zero_padding);
+- sg_init_table(sg_out, 1);
+- sg_set_buf(sg_out, dst, *dst_len);
++ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
++ if (ret)
++ goto out_tfm;
++
++ crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ iv = crypto_blkcipher_crt(tfm)->iv;
+ ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ memcpy(iv, aes_iv, ivsize);
++
+ /*
+ print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
+ key, key_len, 1);
+@@ -127,16 +200,22 @@ static int ceph_aes_encrypt(const void *key, int key_len,
+ print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
+ pad, zero_padding, 1);
+ */
+- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
++ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
+ src_len + zero_padding);
+- crypto_free_blkcipher(tfm);
+- if (ret < 0)
++ if (ret < 0) {
+ pr_err("ceph_aes_crypt failed %d\n", ret);
++ goto out_sg;
++ }
+ /*
+ print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
+ dst, *dst_len, 1);
+ */
+- return 0;
++
++out_sg:
++ teardown_sgtable(&sg_out);
++out_tfm:
++ crypto_free_blkcipher(tfm);
++ return ret;
+ }
+
+ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+@@ -144,7 +223,8 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+ const void *src1, size_t src1_len,
+ const void *src2, size_t src2_len)
+ {
+- struct scatterlist sg_in[3], sg_out[1];
++ struct scatterlist sg_in[3], prealloc_sg;
++ struct sg_table sg_out;
+ struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ struct blkcipher_desc desc = { .tfm = tfm, .flags = 0 };
+ int ret;
+@@ -160,17 +240,19 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+
+ *dst_len = src1_len + src2_len + zero_padding;
+
+- crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ sg_init_table(sg_in, 3);
+ sg_set_buf(&sg_in[0], src1, src1_len);
+ sg_set_buf(&sg_in[1], src2, src2_len);
+ sg_set_buf(&sg_in[2], pad, zero_padding);
+- sg_init_table(sg_out, 1);
+- sg_set_buf(sg_out, dst, *dst_len);
++ ret = setup_sgtable(&sg_out, &prealloc_sg, dst, *dst_len);
++ if (ret)
++ goto out_tfm;
++
++ crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ iv = crypto_blkcipher_crt(tfm)->iv;
+ ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ memcpy(iv, aes_iv, ivsize);
++
+ /*
+ print_hex_dump(KERN_ERR, "enc key: ", DUMP_PREFIX_NONE, 16, 1,
+ key, key_len, 1);
+@@ -181,23 +263,30 @@ static int ceph_aes_encrypt2(const void *key, int key_len, void *dst,
+ print_hex_dump(KERN_ERR, "enc pad: ", DUMP_PREFIX_NONE, 16, 1,
+ pad, zero_padding, 1);
+ */
+- ret = crypto_blkcipher_encrypt(&desc, sg_out, sg_in,
++ ret = crypto_blkcipher_encrypt(&desc, sg_out.sgl, sg_in,
+ src1_len + src2_len + zero_padding);
+- crypto_free_blkcipher(tfm);
+- if (ret < 0)
++ if (ret < 0) {
+ pr_err("ceph_aes_crypt2 failed %d\n", ret);
++ goto out_sg;
++ }
+ /*
+ print_hex_dump(KERN_ERR, "enc out: ", DUMP_PREFIX_NONE, 16, 1,
+ dst, *dst_len, 1);
+ */
+- return 0;
++
++out_sg:
++ teardown_sgtable(&sg_out);
++out_tfm:
++ crypto_free_blkcipher(tfm);
++ return ret;
+ }
+
+ static int ceph_aes_decrypt(const void *key, int key_len,
+ void *dst, size_t *dst_len,
+ const void *src, size_t src_len)
+ {
+- struct scatterlist sg_in[1], sg_out[2];
++ struct sg_table sg_in;
++ struct scatterlist sg_out[2], prealloc_sg;
+ struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ struct blkcipher_desc desc = { .tfm = tfm };
+ char pad[16];
+@@ -209,16 +298,16 @@ static int ceph_aes_decrypt(const void *key, int key_len,
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+- crypto_blkcipher_setkey((void *)tfm, key, key_len);
+- sg_init_table(sg_in, 1);
+ sg_init_table(sg_out, 2);
+- sg_set_buf(sg_in, src, src_len);
+ sg_set_buf(&sg_out[0], dst, *dst_len);
+ sg_set_buf(&sg_out[1], pad, sizeof(pad));
++ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
++ if (ret)
++ goto out_tfm;
+
++ crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ iv = crypto_blkcipher_crt(tfm)->iv;
+ ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ memcpy(iv, aes_iv, ivsize);
+
+ /*
+@@ -227,12 +316,10 @@ static int ceph_aes_decrypt(const void *key, int key_len,
+ print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1,
+ src, src_len, 1);
+ */
+-
+- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+- crypto_free_blkcipher(tfm);
++ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
+ if (ret < 0) {
+ pr_err("ceph_aes_decrypt failed %d\n", ret);
+- return ret;
++ goto out_sg;
+ }
+
+ if (src_len <= *dst_len)
+@@ -250,7 +337,12 @@ static int ceph_aes_decrypt(const void *key, int key_len,
+ print_hex_dump(KERN_ERR, "dec out: ", DUMP_PREFIX_NONE, 16, 1,
+ dst, *dst_len, 1);
+ */
+- return 0;
++
++out_sg:
++ teardown_sgtable(&sg_in);
++out_tfm:
++ crypto_free_blkcipher(tfm);
++ return ret;
+ }
+
+ static int ceph_aes_decrypt2(const void *key, int key_len,
+@@ -258,7 +350,8 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ void *dst2, size_t *dst2_len,
+ const void *src, size_t src_len)
+ {
+- struct scatterlist sg_in[1], sg_out[3];
++ struct sg_table sg_in;
++ struct scatterlist sg_out[3], prealloc_sg;
+ struct crypto_blkcipher *tfm = ceph_crypto_alloc_cipher();
+ struct blkcipher_desc desc = { .tfm = tfm };
+ char pad[16];
+@@ -270,17 +363,17 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ if (IS_ERR(tfm))
+ return PTR_ERR(tfm);
+
+- sg_init_table(sg_in, 1);
+- sg_set_buf(sg_in, src, src_len);
+ sg_init_table(sg_out, 3);
+ sg_set_buf(&sg_out[0], dst1, *dst1_len);
+ sg_set_buf(&sg_out[1], dst2, *dst2_len);
+ sg_set_buf(&sg_out[2], pad, sizeof(pad));
++ ret = setup_sgtable(&sg_in, &prealloc_sg, src, src_len);
++ if (ret)
++ goto out_tfm;
+
+ crypto_blkcipher_setkey((void *)tfm, key, key_len);
+ iv = crypto_blkcipher_crt(tfm)->iv;
+ ivsize = crypto_blkcipher_ivsize(tfm);
+-
+ memcpy(iv, aes_iv, ivsize);
+
+ /*
+@@ -289,12 +382,10 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ print_hex_dump(KERN_ERR, "dec in: ", DUMP_PREFIX_NONE, 16, 1,
+ src, src_len, 1);
+ */
+-
+- ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in, src_len);
+- crypto_free_blkcipher(tfm);
++ ret = crypto_blkcipher_decrypt(&desc, sg_out, sg_in.sgl, src_len);
+ if (ret < 0) {
+ pr_err("ceph_aes_decrypt failed %d\n", ret);
+- return ret;
++ goto out_sg;
+ }
+
+ if (src_len <= *dst1_len)
+@@ -324,7 +415,11 @@ static int ceph_aes_decrypt2(const void *key, int key_len,
+ dst2, *dst2_len, 1);
+ */
+
+- return 0;
++out_sg:
++ teardown_sgtable(&sg_in);
++out_tfm:
++ crypto_free_blkcipher(tfm);
++ return ret;
+ }
+
+
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 7827436ae843..330be870c1ef 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1346,10 +1346,10 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ iph->ihl = 5;
+ iph->tos = inet->tos;
+ iph->frag_off = df;
+- ip_select_ident(skb, sk);
+ iph->ttl = ttl;
+ iph->protocol = sk->sk_protocol;
+ ip_copy_addrs(iph, fl4);
++ ip_select_ident(skb, sk);
+
+ if (opt) {
+ iph->ihl += opt->optlen>>2;
+diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
+index 686934acfac1..4b20d5606f6d 100644
+--- a/net/ipv6/Makefile
++++ b/net/ipv6/Makefile
+@@ -37,6 +37,6 @@ obj-$(CONFIG_NETFILTER) += netfilter/
+ obj-$(CONFIG_IPV6_SIT) += sit.o
+ obj-$(CONFIG_IPV6_TUNNEL) += ip6_tunnel.o
+
+-obj-y += addrconf_core.o exthdrs_core.o
++obj-y += addrconf_core.o exthdrs_core.o output_core.o
+
+ obj-$(subst m,y,$(CONFIG_IPV6)) += inet6_hashtables.o
+diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
+new file mode 100644
+index 000000000000..a6126c62a9be
+--- /dev/null
++++ b/net/ipv6/output_core.c
+@@ -0,0 +1,38 @@
++#include <linux/export.h>
++#include <linux/skbuff.h>
++#include <net/ip.h>
++#include <net/ipv6.h>
++
++/* This function exists only for tap drivers that must support broken
++ * clients requesting UFO without specifying an IPv6 fragment ID.
++ *
++ * This is similar to ipv6_select_ident() but we use an independent hash
++ * seed to limit information leakage.
++ */
++void ipv6_proxy_select_ident(struct sk_buff *skb)
++{
++ static u32 ip6_proxy_idents_hashrnd __read_mostly;
++ static bool hashrnd_initialized = false;
++ struct in6_addr buf[2];
++ struct in6_addr *addrs;
++ u32 hash, id;
++
++ addrs = skb_header_pointer(skb,
++ skb_network_offset(skb) +
++ offsetof(struct ipv6hdr, saddr),
++ sizeof(buf), buf);
++ if (!addrs)
++ return;
++
++ if (unlikely(!hashrnd_initialized)) {
++ hashrnd_initialized = true;
++ get_random_bytes(&ip6_proxy_idents_hashrnd,
++ sizeof(ip6_proxy_idents_hashrnd));
++ }
++ hash = __ipv6_addr_jhash(&addrs[1], ip6_proxy_idents_hashrnd);
++ hash = __ipv6_addr_jhash(&addrs[0], hash);
++
++ id = ip_idents_reserve(hash, 1);
++ skb_shinfo(skb)->ip6_frag_id = htonl(id);
++}
++EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index 95a04f02f30b..9f32756a302a 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -395,10 +395,12 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ u32 hw_reconf_flags = 0;
+ int i;
+ enum nl80211_channel_type orig_ct;
++ bool cancel_scan;
+
+ clear_bit(SDATA_STATE_RUNNING, &sdata->state);
+
+- if (local->scan_sdata == sdata)
++ cancel_scan = local->scan_sdata == sdata;
++ if (cancel_scan)
+ ieee80211_scan_cancel(local);
+
+ /*
+@@ -562,6 +564,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+
+ ieee80211_recalc_ps(local, -1);
+
++ if (cancel_scan)
++ flush_delayed_work(&local->scan_work);
++
+ if (local->open_count == 0) {
+ if (local->ops->napi_poll)
+ napi_disable(&local->napi);
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index f5ed86388555..32929b07269f 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -1486,11 +1486,14 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ sc = le16_to_cpu(hdr->seq_ctrl);
+ frag = sc & IEEE80211_SCTL_FRAG;
+
+- if (likely((!ieee80211_has_morefrags(fc) && frag == 0) ||
+- is_multicast_ether_addr(hdr->addr1))) {
+- /* not fragmented */
++ if (likely(!ieee80211_has_morefrags(fc) && frag == 0))
++ goto out;
++
++ if (is_multicast_ether_addr(hdr->addr1)) {
++ rx->local->dot11MulticastReceivedFrameCount++;
+ goto out;
+ }
++
+ I802_DEBUG_INC(rx->local->rx_handlers_fragments);
+
+ if (skb_linearize(rx->skb))
+@@ -1583,10 +1586,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
+ out:
+ if (rx->sta)
+ rx->sta->rx_packets++;
+- if (is_multicast_ether_addr(hdr->addr1))
+- rx->local->dot11MulticastReceivedFrameCount++;
+- else
+- ieee80211_led_rx(rx->local);
++ ieee80211_led_rx(rx->local);
+ return RX_CONTINUE;
+ }
+
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index c487715698ab..d96b7f6a3b44 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -282,9 +282,12 @@ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+ {
+ const struct evm_ima_xattr_data *xattr_data = xattr_value;
+
+- if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
+- && (xattr_data->type == EVM_XATTR_HMAC))
+- return -EPERM;
++ if (strcmp(xattr_name, XATTR_NAME_EVM) == 0) {
++ if (!xattr_value_len)
++ return -EINVAL;
++ if (xattr_data->type != EVM_IMA_XATTR_DIGSIG)
++ return -EPERM;
++ }
+ return evm_protect_xattr(dentry, xattr_name, xattr_value,
+ xattr_value_len);
+ }
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index 639e5c4028ff..cbae6d392087 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -436,6 +436,7 @@ next_inode:
+ list_entry(sbsec->isec_head.next,
+ struct inode_security_struct, list);
+ struct inode *inode = isec->inode;
++ list_del_init(&isec->list);
+ spin_unlock(&sbsec->isec_lock);
+ inode = igrab(inode);
+ if (inode) {
+@@ -444,7 +445,6 @@ next_inode:
+ iput(inode);
+ }
+ spin_lock(&sbsec->isec_lock);
+- list_del_init(&isec->list);
+ goto next_inode;
+ }
+ spin_unlock(&sbsec->isec_lock);
+diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c
+index 91cdf9435fec..4dbb66ef435d 100644
+--- a/sound/core/pcm_compat.c
++++ b/sound/core/pcm_compat.c
+@@ -204,6 +204,8 @@ static int snd_pcm_status_user_compat(struct snd_pcm_substream *substream,
+ if (err < 0)
+ return err;
+
++ if (clear_user(src, sizeof(*src)))
++ return -EFAULT;
+ if (put_user(status.state, &src->state) ||
+ put_user(status.trigger_tstamp.tv_sec, &src->trigger_tstamp.tv_sec) ||
+ put_user(status.trigger_tstamp.tv_nsec, &src->trigger_tstamp.tv_nsec) ||
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index d776291d09a0..3a907935fa09 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -3171,7 +3171,7 @@ static const struct vm_operations_struct snd_pcm_vm_ops_data_fault = {
+
+ #ifndef ARCH_HAS_DMA_MMAP_COHERENT
+ /* This should be defined / handled globally! */
+-#ifdef CONFIG_ARM
++#if defined(CONFIG_ARM) || defined(CONFIG_ARM64)
+ #define ARCH_HAS_DMA_MMAP_COHERENT
+ #endif
+ #endif
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index a0afa5057488..f35284be7b02 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -85,6 +85,8 @@ snd_emu10k1_ops_setup(struct snd_emux *emux)
+ * get more voice for pcm
+ *
+ * terminate most inactive voice and give it as a pcm voice.
++ *
++ * voice_lock is already held.
+ */
+ int
+ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
+@@ -92,12 +94,10 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
+ struct snd_emux *emu;
+ struct snd_emux_voice *vp;
+ struct best_voice best[V_END];
+- unsigned long flags;
+ int i;
+
+ emu = hw->synth;
+
+- spin_lock_irqsave(&emu->voice_lock, flags);
+ lookup_voices(emu, hw, best, 1); /* no OFF voices */
+ for (i = 0; i < V_END; i++) {
+ if (best[i].voice >= 0) {
+@@ -113,11 +113,9 @@ snd_emu10k1_synth_get_voice(struct snd_emu10k1 *hw)
+ vp->emu->num_voices--;
+ vp->ch = -1;
+ vp->state = SNDRV_EMUX_ST_OFF;
+- spin_unlock_irqrestore(&emu->voice_lock, flags);
+ return ch;
+ }
+ }
+- spin_unlock_irqrestore(&emu->voice_lock, flags);
+
+ /* not found */
+ return -ENOMEM;
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index f0b8d8e38f71..c40b7ca7a143 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1313,8 +1313,7 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
+
+ /* enable small pop, introduce 400ms delay in turning off */
+ snd_soc_update_bits(codec, SGTL5000_CHIP_REF_CTRL,
+- SGTL5000_SMALL_POP,
+- SGTL5000_SMALL_POP);
++ SGTL5000_SMALL_POP, 1);
+
+ /* disable short cut detector */
+ snd_soc_write(codec, SGTL5000_CHIP_SHORT_CTRL, 0);
+diff --git a/sound/soc/codecs/sgtl5000.h b/sound/soc/codecs/sgtl5000.h
+index d3a68bbfea00..0bd6e1cd8200 100644
+--- a/sound/soc/codecs/sgtl5000.h
++++ b/sound/soc/codecs/sgtl5000.h
+@@ -275,7 +275,7 @@
+ #define SGTL5000_BIAS_CTRL_MASK 0x000e
+ #define SGTL5000_BIAS_CTRL_SHIFT 1
+ #define SGTL5000_BIAS_CTRL_WIDTH 3
+-#define SGTL5000_SMALL_POP 0x0001
++#define SGTL5000_SMALL_POP 0
+
+ /*
+ * SGTL5000_CHIP_MIC_CTRL
+diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c
+index 91b728774dba..eb0599f29768 100644
+--- a/sound/soc/sh/fsi.c
++++ b/sound/soc/sh/fsi.c
+@@ -1393,8 +1393,7 @@ static const struct snd_soc_dai_ops fsi_dai_ops = {
+ static struct snd_pcm_hardware fsi_pcm_hardware = {
+ .info = SNDRV_PCM_INFO_INTERLEAVED |
+ SNDRV_PCM_INFO_MMAP |
+- SNDRV_PCM_INFO_MMAP_VALID |
+- SNDRV_PCM_INFO_PAUSE,
++ SNDRV_PCM_INFO_MMAP_VALID,
+ .formats = FSI_FMTS,
+ .rates = FSI_RATES,
+ .rate_min = 8000,
+diff --git a/sound/usb/card.c b/sound/usb/card.c
+index 658ea1118a8e..43fca5231628 100644
+--- a/sound/usb/card.c
++++ b/sound/usb/card.c
+@@ -568,18 +568,19 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
+ {
+ struct snd_card *card;
+ struct list_head *p;
++ bool was_shutdown;
+
+ if (chip == (void *)-1L)
+ return;
+
+ card = chip->card;
+ down_write(&chip->shutdown_rwsem);
++ was_shutdown = chip->shutdown;
+ chip->shutdown = 1;
+ up_write(&chip->shutdown_rwsem);
+
+ mutex_lock(®ister_mutex);
+- chip->num_interfaces--;
+- if (chip->num_interfaces <= 0) {
++ if (!was_shutdown) {
+ snd_card_disconnect(card);
+ /* release the pcm resources */
+ list_for_each(p, &chip->pcm_list) {
+@@ -593,6 +594,10 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
+ list_for_each(p, &chip->mixer_list) {
+ snd_usb_mixer_disconnect(p);
+ }
++ }
++
++ chip->num_interfaces--;
++ if (chip->num_interfaces <= 0) {
+ usb_chip[chip->index] = NULL;
+ mutex_unlock(®ister_mutex);
+ snd_card_free_when_closed(card);
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 915bc2cf73d9..5ef357983d92 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -301,6 +301,36 @@ YAMAHA_DEVICE(0x105d, NULL),
+ }
+ }
+ },
++{
++ USB_DEVICE(0x0499, 0x1509),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ /* .vendor_name = "Yamaha", */
++ /* .product_name = "Steinberg UR22", */
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_YAMAHA
++ },
++ {
++ .ifnum = 4,
++ .type = QUIRK_IGNORE_INTERFACE
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
+ YAMAHA_DEVICE(0x2000, "DGP-7"),
+ YAMAHA_DEVICE(0x2001, "DGP-5"),
+ YAMAHA_DEVICE(0x2002, NULL),
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index defc9baa9a45..3225903ec91b 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -43,13 +43,13 @@ static void kvm_iommu_put_pages(struct kvm *kvm,
+ gfn_t base_gfn, unsigned long npages);
+
+ static pfn_t kvm_pin_pages(struct kvm *kvm, struct kvm_memory_slot *slot,
+- gfn_t gfn, unsigned long size)
++ gfn_t gfn, unsigned long npages)
+ {
+ gfn_t end_gfn;
+ pfn_t pfn;
+
+ pfn = gfn_to_pfn_memslot(kvm, slot, gfn);
+- end_gfn = gfn + (size >> PAGE_SHIFT);
++ end_gfn = gfn + npages;
+ gfn += 1;
+
+ if (is_error_pfn(pfn))
+@@ -117,7 +117,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ * Pin all pages we are about to map in memory. This is
+ * important because we unmap and unpin in 4kb steps later.
+ */
+- pfn = kvm_pin_pages(kvm, slot, gfn, page_size);
++ pfn = kvm_pin_pages(kvm, slot, gfn, page_size >> PAGE_SHIFT);
+ if (is_error_pfn(pfn)) {
+ gfn += 1;
+ continue;
+@@ -129,7 +129,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ if (r) {
+ printk(KERN_ERR "kvm_iommu_map_address:"
+ "iommu failed to map pfn=%llx\n", pfn);
+- kvm_unpin_pages(kvm, pfn, page_size);
++ kvm_unpin_pages(kvm, pfn, page_size >> PAGE_SHIFT);
+ goto unmap_pages;
+ }
+
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index bc5ed1412382..f4732bd2816c 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -52,6 +52,7 @@
+
+ #include <asm/processor.h>
+ #include <asm/io.h>
++#include <asm/ioctl.h>
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+
+@@ -1744,6 +1745,9 @@ static long kvm_vcpu_ioctl(struct file *filp,
+ if (vcpu->kvm->mm != current->mm)
+ return -EIO;
+
++ if (unlikely(_IOC_TYPE(ioctl) != KVMIO))
++ return -EINVAL;
++
+ #if defined(CONFIG_S390) || defined(CONFIG_PPC)
+ /*
+ * Special cases: vcpu ioctls that are asynchronous to vcpu execution,
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2015-01-02 19:13 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2015-01-02 19:13 UTC (permalink / raw
To: gentoo-commits
commit: dfe6365f65151c8d97374bb967301fd419b38a88
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jan 2 19:13:17 2015 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jan 2 19:13:17 2015 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=dfe6365f
Add DEVPTS_MULTIPLE_INSTANCES when GENTOO_LINUX_INIT_SYSTEMD is selected. See bug #534216
---
4567_distro-Gentoo-Kconfig.patch | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/4567_distro-Gentoo-Kconfig.patch b/4567_distro-Gentoo-Kconfig.patch
index 850cabc..690454a 100644
--- a/4567_distro-Gentoo-Kconfig.patch
+++ b/4567_distro-Gentoo-Kconfig.patch
@@ -1,5 +1,5 @@
---- a/Kconfig 2014-04-02 10:11:12.959212144 -0400
-+++ b/Kconfig 2014-04-02 10:11:41.139211921 -0400
+--- a/Kconfig 2014-04-02 09:45:05.389224541 -0400
++++ b/Kconfig 2014-04-02 09:45:39.269224273 -0400
@@ -8,4 +8,6 @@ config SRCARCH
string
option env="SRCARCH"
@@ -7,9 +7,9 @@
+source "distro/Kconfig"
+
source "arch/$SRCARCH/Kconfig"
---- 1969-12-31 19:00:00.000000000 -0500
-+++ b/distro/Kconfig 2014-04-02 10:14:34.049210553 -0400
-@@ -0,0 +1,110 @@
+--- a/distro/Kconfig 1969-12-31 19:00:00.000000000 -0500
++++ b/distro/Kconfig 2015-01-02 13:54:45.589830665 -0500
+@@ -0,0 +1,109 @@
+menu "Gentoo Linux"
+
+config GENTOO_LINUX
@@ -35,7 +35,6 @@
+ select TMPFS
+
+ select MMU
-+ select HOTPLUG
+ select SHMEM
+
+ help
@@ -88,13 +87,13 @@
+ select AUTOFS4_FS
+ select BLK_DEV_BSG
+ select CGROUPS
++ select DEVPTS_MULTIPLE_INSTANCES
+ select EPOLL
+ select FANOTIFY
+ select FHANDLE
-+ select HOTPLUG
+ select INOTIFY_USER
+ select NET
-+ select NET_NS
++ select NET_NS
+ select PROC_FS
+ select SIGNALFD
+ select SYSFS
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-12-20 19:13 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-12-20 19:13 UTC (permalink / raw
To: gentoo-commits
commit: 2832899181c3b1374453562aeabe9d4f09194445
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Dec 21 00:09:58 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Dec 21 00:09:58 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=28328991
Linux patch 3.4.105
---
0000_README | 4 +
1104_linux-3.4.105.patch | 3019 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3023 insertions(+)
diff --git a/0000_README b/0000_README
index 544ba0b..5ff1506 100644
--- a/0000_README
+++ b/0000_README
@@ -455,6 +455,10 @@ Patch: 1103_linux-3.4.104.patch
From: http://www.kernel.org
Desc: Linux 3.4.104
+Patch: 1104_linux-3.4.105.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.105
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1104_linux-3.4.105.patch b/1104_linux-3.4.105.patch
new file mode 100644
index 0000000..05fe15c
--- /dev/null
+++ b/1104_linux-3.4.105.patch
@@ -0,0 +1,3019 @@
+diff --git a/Documentation/cgroups/cpusets.txt b/Documentation/cgroups/cpusets.txt
+index cefd3d8bbd11..a52a39f8a8d4 100644
+--- a/Documentation/cgroups/cpusets.txt
++++ b/Documentation/cgroups/cpusets.txt
+@@ -345,14 +345,14 @@ the named feature on.
+ The implementation is simple.
+
+ Setting the flag 'cpuset.memory_spread_page' turns on a per-process flag
+-PF_SPREAD_PAGE for each task that is in that cpuset or subsequently
++PFA_SPREAD_PAGE for each task that is in that cpuset or subsequently
+ joins that cpuset. The page allocation calls for the page cache
+-is modified to perform an inline check for this PF_SPREAD_PAGE task
++is modified to perform an inline check for this PFA_SPREAD_PAGE task
+ flag, and if set, a call to a new routine cpuset_mem_spread_node()
+ returns the node to prefer for the allocation.
+
+ Similarly, setting 'cpuset.memory_spread_slab' turns on the flag
+-PF_SPREAD_SLAB, and appropriately marked slab caches will allocate
++PFA_SPREAD_SLAB, and appropriately marked slab caches will allocate
+ pages from the node returned by cpuset_mem_spread_node().
+
+ The cpuset_mem_spread_node() routine is also simple. It uses the
+diff --git a/Makefile b/Makefile
+index b66396efb001..cf2c8a82ca3e 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 104
++SUBLEVEL = 105
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
+index fc000e3ac44e..17f4ea2fe3cf 100644
+--- a/arch/arm/mm/alignment.c
++++ b/arch/arm/mm/alignment.c
+@@ -39,6 +39,7 @@
+ * This code is not portable to processors with late data abort handling.
+ */
+ #define CODING_BITS(i) (i & 0x0e000000)
++#define COND_BITS(i) (i & 0xf0000000)
+
+ #define LDST_I_BIT(i) (i & (1 << 26)) /* Immediate constant */
+ #define LDST_P_BIT(i) (i & (1 << 24)) /* Preindex */
+@@ -813,6 +814,8 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
+ break;
+
+ case 0x04000000: /* ldr or str immediate */
++ if (COND_BITS(instr) == 0xf0000000) /* NEON VLDn, VSTn */
++ goto bad;
+ offset.un = OFFSET_BITS(instr);
+ handler = do_alignment_ldrstr;
+ break;
+diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c
+index 5cad0faefa17..ca51d69a99ff 100644
+--- a/arch/mips/boot/compressed/decompress.c
++++ b/arch/mips/boot/compressed/decompress.c
+@@ -13,6 +13,7 @@
+
+ #include <linux/types.h>
+ #include <linux/kernel.h>
++#include <linux/string.h>
+
+ #include <asm/addrspace.h>
+
+diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S
+index 4c968e7efb74..55eca41c91c2 100644
+--- a/arch/mips/kernel/mcount.S
++++ b/arch/mips/kernel/mcount.S
+@@ -119,7 +119,11 @@ NESTED(_mcount, PT_SIZE, ra)
+ nop
+ #endif
+ b ftrace_stub
++#ifdef CONFIG_32BIT
++ addiu sp, sp, 8
++#else
+ nop
++#endif
+
+ static_trace:
+ MCOUNT_SAVE_REGS
+@@ -129,6 +133,9 @@ static_trace:
+ move a1, AT /* arg2: parent's return address */
+
+ MCOUNT_RESTORE_REGS
++#ifdef CONFIG_32BIT
++ addiu sp, sp, 8
++#endif
+ .globl ftrace_stub
+ ftrace_stub:
+ RETURN_BACK
+@@ -177,6 +184,11 @@ NESTED(ftrace_graph_caller, PT_SIZE, ra)
+ jal prepare_ftrace_return
+ nop
+ MCOUNT_RESTORE_REGS
++#ifndef CONFIG_DYNAMIC_FTRACE
++#ifdef CONFIG_32BIT
++ addiu sp, sp, 8
++#endif
++#endif
+ RETURN_BACK
+ END(ftrace_graph_caller)
+
+diff --git a/arch/parisc/Makefile b/arch/parisc/Makefile
+index 19ab7b2ea1cd..ac93ca20b7e2 100644
+--- a/arch/parisc/Makefile
++++ b/arch/parisc/Makefile
+@@ -51,7 +51,12 @@ cflags-y := -pipe
+
+ # These flags should be implied by an hppa-linux configuration, but they
+ # are not in gcc 3.2.
+-cflags-y += -mno-space-regs -mfast-indirect-calls
++cflags-y += -mno-space-regs
++
++# -mfast-indirect-calls is only relevant for 32-bit kernels.
++ifndef CONFIG_64BIT
++cflags-y += -mfast-indirect-calls
++endif
+
+ # Currently we save and restore fpregs on all kernel entry/interruption paths.
+ # If that gets optimized, we might need to disable the use of fpregs in the
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 53c973ebc0c8..0f250d12a18c 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -566,17 +566,6 @@ rerun_vcpu:
+
+ BUG_ON(vcpu->kvm->arch.float_int.local_int[vcpu->vcpu_id] == NULL);
+
+- switch (kvm_run->exit_reason) {
+- case KVM_EXIT_S390_SIEIC:
+- case KVM_EXIT_UNKNOWN:
+- case KVM_EXIT_INTR:
+- case KVM_EXIT_S390_RESET:
+- case KVM_EXIT_S390_UCONTROL:
+- break;
+- default:
+- BUG();
+- }
+-
+ vcpu->arch.sie_block->gpsw.mask = kvm_run->psw_mask;
+ vcpu->arch.sie_block->gpsw.addr = kvm_run->psw_addr;
+ if (kvm_run->kvm_dirty_regs & KVM_SYNC_PREFIX) {
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index d28c59588ad3..c7dbf029c5f7 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -1248,6 +1248,9 @@ static void remove_siblinginfo(int cpu)
+
+ for_each_cpu(sibling, cpu_sibling_mask(cpu))
+ cpumask_clear_cpu(cpu, cpu_sibling_mask(sibling));
++ for_each_cpu(sibling, cpu_llc_shared_mask(cpu))
++ cpumask_clear_cpu(cpu, cpu_llc_shared_mask(sibling));
++ cpumask_clear(cpu_llc_shared_mask(cpu));
+ cpumask_clear(cpu_sibling_mask(cpu));
+ cpumask_clear(cpu_core_mask(cpu));
+ c->phys_proc_id = 0;
+diff --git a/block/genhd.c b/block/genhd.c
+index d815a0fb52dd..60f7e6ce76b4 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -27,10 +27,10 @@ struct kobject *block_depr;
+ /* for extended dynamic devt allocation, currently only one major is used */
+ #define NR_EXT_DEVT (1 << MINORBITS)
+
+-/* For extended devt allocation. ext_devt_mutex prevents look up
++/* For extended devt allocation. ext_devt_lock prevents look up
+ * results from going away underneath its user.
+ */
+-static DEFINE_MUTEX(ext_devt_mutex);
++static DEFINE_SPINLOCK(ext_devt_lock);
+ static DEFINE_IDR(ext_devt_idr);
+
+ static struct device_type disk_type;
+@@ -420,13 +420,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ do {
+ if (!idr_pre_get(&ext_devt_idr, GFP_KERNEL))
+ return -ENOMEM;
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ rc = idr_get_new(&ext_devt_idr, part, &idx);
+ if (!rc && idx >= NR_EXT_DEVT) {
+ idr_remove(&ext_devt_idr, idx);
+ rc = -EBUSY;
+ }
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ } while (rc == -EAGAIN);
+
+ if (rc)
+@@ -447,15 +447,13 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt)
+ */
+ void blk_free_devt(dev_t devt)
+ {
+- might_sleep();
+-
+ if (devt == MKDEV(0, 0))
+ return;
+
+ if (MAJOR(devt) == BLOCK_EXT_MAJOR) {
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ idr_remove(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ }
+ }
+
+@@ -662,7 +660,6 @@ void del_gendisk(struct gendisk *disk)
+ if (!sysfs_deprecated)
+ sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk)));
+ device_del(disk_to_dev(disk));
+- blk_free_devt(disk_to_dev(disk)->devt);
+ }
+ EXPORT_SYMBOL(del_gendisk);
+
+@@ -687,13 +684,13 @@ struct gendisk *get_gendisk(dev_t devt, int *partno)
+ } else {
+ struct hd_struct *part;
+
+- mutex_lock(&ext_devt_mutex);
++ spin_lock(&ext_devt_lock);
+ part = idr_find(&ext_devt_idr, blk_mangle_minor(MINOR(devt)));
+ if (part && get_disk(part_to_disk(part))) {
+ *partno = part->partno;
+ disk = part_to_disk(part);
+ }
+- mutex_unlock(&ext_devt_mutex);
++ spin_unlock(&ext_devt_lock);
+ }
+
+ return disk;
+@@ -1101,6 +1098,7 @@ static void disk_release(struct device *dev)
+ {
+ struct gendisk *disk = dev_to_disk(dev);
+
++ blk_free_devt(dev->devt);
+ disk_release_events(disk);
+ kfree(disk->random);
+ disk_replace_part_tbl(disk, NULL);
+diff --git a/block/partition-generic.c b/block/partition-generic.c
+index 7b8b8d17764c..daafc85ca683 100644
+--- a/block/partition-generic.c
++++ b/block/partition-generic.c
+@@ -211,6 +211,7 @@ static const struct attribute_group *part_attr_groups[] = {
+ static void part_release(struct device *dev)
+ {
+ struct hd_struct *p = dev_to_part(dev);
++ blk_free_devt(dev->devt);
+ free_part_stats(p);
+ free_part_info(p);
+ kfree(p);
+@@ -253,7 +254,6 @@ void delete_partition(struct gendisk *disk, int partno)
+ rcu_assign_pointer(ptbl->last_lookup, NULL);
+ kobject_put(part->holder_dir);
+ device_del(part_to_dev(part));
+- blk_free_devt(part_devt(part));
+
+ hd_struct_put(part);
+ }
+diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
+index 6cba4282588b..e1180ce63e45 100644
+--- a/drivers/acpi/processor_idle.c
++++ b/drivers/acpi/processor_idle.c
+@@ -1195,9 +1195,9 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+
+ if (pr->id == 0 && cpuidle_get_driver() == &acpi_idle_driver) {
+
+- cpuidle_pause_and_lock();
+ /* Protect against cpu-hotplug */
+ get_online_cpus();
++ cpuidle_pause_and_lock();
+
+ /* Disable all cpuidle devices */
+ for_each_online_cpu(cpu) {
+@@ -1222,8 +1222,8 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
+ cpuidle_enable_device(&_pr->power.dev);
+ }
+ }
+- put_online_cpus();
+ cpuidle_resume_and_unlock();
++ put_online_cpus();
+ }
+
+ return 0;
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 0a450eb517e0..d366a75e6705 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -305,6 +305,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x9c85), board_ahci }, /* Wildcat Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */
+ { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */
++ { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */
++ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */
++ { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
++ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+
+ /* JMicron 360/1/3/5/6, match class to avoid IDE function */
+ { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+@@ -435,6 +443,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ .driver_data = board_ahci_yes_fbs }, /* 88se9125 */
+ { PCI_DEVICE(0x1b4b, 0x917a),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 */
++ { PCI_DEVICE(0x1b4b, 0x9182),
++ .driver_data = board_ahci_yes_fbs }, /* 88se9182 */
+ { PCI_DEVICE(0x1b4b, 0x9192),
+ .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
+ { PCI_DEVICE(0x1b4b, 0x91a3),
+diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
+index 9f165a81d0ea..2f081a316b56 100644
+--- a/drivers/ata/ata_piix.c
++++ b/drivers/ata/ata_piix.c
+@@ -362,6 +362,14 @@ static const struct pci_device_id piix_pci_tbl[] = {
+ { 0x8086, 0x0F21, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_byt },
+ /* SATA Controller IDE (Coleto Creek) */
+ { 0x8086, 0x23a6, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c88, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c89, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c80, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
++ /* SATA Controller IDE (9 Series) */
++ { 0x8086, 0x8c81, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata_snb },
+
+ { } /* terminate list */
+ };
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index ca72d1f67282..e5545427b46b 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -48,7 +48,7 @@ bool regmap_readable(struct regmap *map, unsigned int reg)
+
+ bool regmap_volatile(struct regmap *map, unsigned int reg)
+ {
+- if (!regmap_readable(map, reg))
++ if (!map->format.format_write && !regmap_readable(map, reg))
+ return false;
+
+ if (map->volatile_reg)
+diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
+index 98a8c05d4f23..d4550f9962b5 100644
+--- a/drivers/bluetooth/hci_ldisc.c
++++ b/drivers/bluetooth/hci_ldisc.c
+@@ -118,10 +118,6 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu)
+
+ int hci_uart_tx_wakeup(struct hci_uart *hu)
+ {
+- struct tty_struct *tty = hu->tty;
+- struct hci_dev *hdev = hu->hdev;
+- struct sk_buff *skb;
+-
+ if (test_and_set_bit(HCI_UART_SENDING, &hu->tx_state)) {
+ set_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+ return 0;
+@@ -129,6 +125,22 @@ int hci_uart_tx_wakeup(struct hci_uart *hu)
+
+ BT_DBG("");
+
++ schedule_work(&hu->write_work);
++
++ return 0;
++}
++
++static void hci_uart_write_work(struct work_struct *work)
++{
++ struct hci_uart *hu = container_of(work, struct hci_uart, write_work);
++ struct tty_struct *tty = hu->tty;
++ struct hci_dev *hdev = hu->hdev;
++ struct sk_buff *skb;
++
++ /* REVISIT: should we cope with bad skbs or ->write() returning
++ * and error value ?
++ */
++
+ restart:
+ clear_bit(HCI_UART_TX_WAKEUP, &hu->tx_state);
+
+@@ -153,7 +165,6 @@ restart:
+ goto restart;
+
+ clear_bit(HCI_UART_SENDING, &hu->tx_state);
+- return 0;
+ }
+
+ /* ------- Interface to HCI layer ------ */
+@@ -264,6 +275,8 @@ static int hci_uart_tty_open(struct tty_struct *tty)
+ hu->tty = tty;
+ tty->receive_room = 65536;
+
++ INIT_WORK(&hu->write_work, hci_uart_write_work);
++
+ spin_lock_init(&hu->rx_lock);
+
+ /* Flush any pending characters in the driver and line discipline. */
+@@ -298,6 +311,8 @@ static void hci_uart_tty_close(struct tty_struct *tty)
+ if (hdev)
+ hci_uart_close(hdev);
+
++ cancel_work_sync(&hu->write_work);
++
+ if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
+ if (hdev) {
+ hci_unregister_dev(hdev);
+diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h
+index 6cf6ab22ad21..af93d83e503a 100644
+--- a/drivers/bluetooth/hci_uart.h
++++ b/drivers/bluetooth/hci_uart.h
+@@ -66,6 +66,8 @@ struct hci_uart {
+ unsigned long flags;
+ unsigned long hdev_flags;
+
++ struct work_struct write_work;
++
+ struct hci_uart_proto *proto;
+ void *priv;
+
+diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
+index a2c9e56c0c1a..d9e359abc419 100644
+--- a/drivers/gpu/drm/i915/intel_bios.c
++++ b/drivers/gpu/drm/i915/intel_bios.c
+@@ -651,7 +651,7 @@ init_vbt_defaults(struct drm_i915_private *dev_priv)
+ DRM_DEBUG_KMS("Set default to SSC at %dMHz\n", dev_priv->lvds_ssc_freq);
+ }
+
+-static int __init intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
++static int intel_no_opregion_vbt_callback(const struct dmi_system_id *id)
+ {
+ DRM_DEBUG_KMS("Falling back to manually reading VBT from "
+ "VBIOS ROM for %s\n",
+diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
+index a83f7acdbe03..b4f71c22e07d 100644
+--- a/drivers/gpu/drm/i915/intel_crt.c
++++ b/drivers/gpu/drm/i915/intel_crt.c
+@@ -564,7 +564,7 @@ static const struct drm_encoder_funcs intel_crt_enc_funcs = {
+ .destroy = intel_encoder_destroy,
+ };
+
+-static int __init intel_no_crt_dmi_callback(const struct dmi_system_id *id)
++static int intel_no_crt_dmi_callback(const struct dmi_system_id *id)
+ {
+ DRM_DEBUG_KMS("Skipping CRT initialization for %s\n", id->ident);
+ return 1;
+diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
+index b695ab48ebf0..77190cc774cb 100644
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -619,7 +619,7 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
+ .destroy = intel_encoder_destroy,
+ };
+
+-static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
++static int intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+ {
+ DRM_DEBUG_KMS("Skipping LVDS initialization for %s\n", id->ident);
+ return 1;
+diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
+index 6d0c32b9e8aa..1ce67435918b 100644
+--- a/drivers/gpu/drm/radeon/radeon_atombios.c
++++ b/drivers/gpu/drm/radeon/radeon_atombios.c
+@@ -463,6 +463,13 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
+ }
+ }
+
++ /* Fujitsu D3003-S2 board lists DVI-I as DVI-I and VGA */
++ if ((dev->pdev->device == 0x9805) &&
++ (dev->pdev->subsystem_vendor == 0x1734) &&
++ (dev->pdev->subsystem_device == 0x11bd)) {
++ if (*connector_type == DRM_MODE_CONNECTOR_VGA)
++ return false;
++ }
+
+ return true;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+index a0c2f12b1e1b..decca8251bfa 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+@@ -163,8 +163,9 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
+
+ mutex_lock(&dev_priv->hw_mutex);
+
++ vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
+ while (vmw_read(dev_priv, SVGA_REG_BUSY) != 0)
+- vmw_write(dev_priv, SVGA_REG_SYNC, SVGA_SYNC_GENERIC);
++ ;
+
+ dev_priv->last_read_seqno = ioread32(fifo_mem + SVGA_FIFO_FENCE);
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index d93ea6417d15..f2c2ffedeff5 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1218,6 +1218,13 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ if (param[1] == 0)
+ return true;
+
++ /*
++ * Some models have a revision higher then 20. Meaning param[2] may
++ * be 10 or 20, skip the rates check for these.
++ */
++ if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ return true;
++
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+ if (param[2] == rates[i])
+ return false;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 326e19459ee6..32b1363f7ace 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -517,10 +517,61 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ ((buf[0] & 0x04) >> 1) |
+ ((buf[3] & 0x04) >> 2));
+
++ if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
++ SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
++ hw->w == 2) {
++ synaptics_parse_agm(buf, priv, hw);
++ return 1;
++ }
++
++ hw->x = (((buf[3] & 0x10) << 8) |
++ ((buf[1] & 0x0f) << 8) |
++ buf[4]);
++ hw->y = (((buf[3] & 0x20) << 7) |
++ ((buf[1] & 0xf0) << 4) |
++ buf[5]);
++ hw->z = buf[2];
++
+ hw->left = (buf[0] & 0x01) ? 1 : 0;
+ hw->right = (buf[0] & 0x02) ? 1 : 0;
+
+- if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
++ if (SYN_CAP_FORCEPAD(priv->ext_cap_0c)) {
++ /*
++ * ForcePads, like Clickpads, use middle button
++ * bits to report primary button clicks.
++ * Unfortunately they report primary button not
++ * only when user presses on the pad above certain
++ * threshold, but also when there are more than one
++ * finger on the touchpad, which interferes with
++ * out multi-finger gestures.
++ */
++ if (hw->z == 0) {
++ /* No contacts */
++ priv->press = priv->report_press = false;
++ } else if (hw->w >= 4 && ((buf[0] ^ buf[3]) & 0x01)) {
++ /*
++ * Single-finger touch with pressure above
++ * the threshold. If pressure stays long
++ * enough, we'll start reporting primary
++ * button. We rely on the device continuing
++ * sending data even if finger does not
++ * move.
++ */
++ if (!priv->press) {
++ priv->press_start = jiffies;
++ priv->press = true;
++ } else if (time_after(jiffies,
++ priv->press_start +
++ msecs_to_jiffies(50))) {
++ priv->report_press = true;
++ }
++ } else {
++ priv->press = false;
++ }
++
++ hw->left = priv->report_press;
++
++ } else if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+ /*
+ * Clickpad's button is transmitted as middle button,
+ * however, since it is primary button, we will report
+@@ -539,21 +590,6 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ }
+
+- if ((SYN_CAP_ADV_GESTURE(priv->ext_cap_0c) ||
+- SYN_CAP_IMAGE_SENSOR(priv->ext_cap_0c)) &&
+- hw->w == 2) {
+- synaptics_parse_agm(buf, priv, hw);
+- return 1;
+- }
+-
+- hw->x = (((buf[3] & 0x10) << 8) |
+- ((buf[1] & 0x0f) << 8) |
+- buf[4]);
+- hw->y = (((buf[3] & 0x20) << 7) |
+- ((buf[1] & 0xf0) << 4) |
+- buf[5]);
+- hw->z = buf[2];
+-
+ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
+ ((buf[0] ^ buf[3]) & 0x02)) {
+ switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
+index fd26ccca13d7..ac1b77354cac 100644
+--- a/drivers/input/mouse/synaptics.h
++++ b/drivers/input/mouse/synaptics.h
+@@ -77,6 +77,11 @@
+ * 2 0x08 image sensor image sensor tracks 5 fingers, but only
+ * reports 2.
+ * 2 0x20 report min query 0x0f gives min coord reported
++ * 2 0x80 forcepad forcepad is a variant of clickpad that
++ * does not have physical buttons but rather
++ * uses pressure above certain threshold to
++ * report primary clicks. Forcepads also have
++ * clickpad bit set.
+ */
+ #define SYN_CAP_CLICKPAD(ex0c) ((ex0c) & 0x100000) /* 1-button ClickPad */
+ #define SYN_CAP_CLICKPAD2BTN(ex0c) ((ex0c) & 0x000100) /* 2-button ClickPad */
+@@ -85,6 +90,7 @@
+ #define SYN_CAP_ADV_GESTURE(ex0c) ((ex0c) & 0x080000)
+ #define SYN_CAP_REDUCED_FILTERING(ex0c) ((ex0c) & 0x000400)
+ #define SYN_CAP_IMAGE_SENSOR(ex0c) ((ex0c) & 0x000800)
++#define SYN_CAP_FORCEPAD(ex0c) ((ex0c) & 0x008000)
+
+ /* synaptics modes query bits */
+ #define SYN_MODE_ABSOLUTE(m) ((m) & (1 << 7))
+@@ -174,6 +180,11 @@ struct synaptics_data {
+ */
+ struct synaptics_hw_state agm;
+ bool agm_pending; /* new AGM packet received */
++
++ /* ForcePad handling */
++ unsigned long press_start;
++ bool press;
++ bool report_press;
+ };
+
+ void synaptics_module_init(void);
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 0ec9abbe31fe..1291673bd57e 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -458,6 +458,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
+ },
++ {
++ /* Avatar AVIU-145A6 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Intel"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"),
++ },
++ },
+ { }
+ };
+
+@@ -601,6 +608,14 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dv4 Notebook PC"),
+ },
+ },
++ {
++ /* Fujitsu U574 laptop */
++ /* https://bugzilla.kernel.org/show_bug.cgi?id=69731 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"),
++ },
++ },
+ { }
+ };
+
+diff --git a/drivers/input/serio/serport.c b/drivers/input/serio/serport.c
+index 8755f5f3ad37..e4ecf3b64794 100644
+--- a/drivers/input/serio/serport.c
++++ b/drivers/input/serio/serport.c
+@@ -21,6 +21,7 @@
+ #include <linux/init.h>
+ #include <linux/serio.h>
+ #include <linux/tty.h>
++#include <linux/compat.h>
+
+ MODULE_AUTHOR("Vojtech Pavlik <vojtech@ucw.cz>");
+ MODULE_DESCRIPTION("Input device TTY line discipline");
+@@ -196,28 +197,55 @@ static ssize_t serport_ldisc_read(struct tty_struct * tty, struct file * file, u
+ return 0;
+ }
+
++static void serport_set_type(struct tty_struct *tty, unsigned long type)
++{
++ struct serport *serport = tty->disc_data;
++
++ serport->id.proto = type & 0x000000ff;
++ serport->id.id = (type & 0x0000ff00) >> 8;
++ serport->id.extra = (type & 0x00ff0000) >> 16;
++}
++
+ /*
+ * serport_ldisc_ioctl() allows to set the port protocol, and device ID
+ */
+
+-static int serport_ldisc_ioctl(struct tty_struct * tty, struct file * file, unsigned int cmd, unsigned long arg)
++static int serport_ldisc_ioctl(struct tty_struct *tty, struct file *file,
++ unsigned int cmd, unsigned long arg)
+ {
+- struct serport *serport = (struct serport*) tty->disc_data;
+- unsigned long type;
+-
+ if (cmd == SPIOCSTYPE) {
++ unsigned long type;
++
+ if (get_user(type, (unsigned long __user *) arg))
+ return -EFAULT;
+
+- serport->id.proto = type & 0x000000ff;
+- serport->id.id = (type & 0x0000ff00) >> 8;
+- serport->id.extra = (type & 0x00ff0000) >> 16;
++ serport_set_type(tty, type);
++ return 0;
++ }
++
++ return -EINVAL;
++}
++
++#ifdef CONFIG_COMPAT
++#define COMPAT_SPIOCSTYPE _IOW('q', 0x01, compat_ulong_t)
++static long serport_ldisc_compat_ioctl(struct tty_struct *tty,
++ struct file *file,
++ unsigned int cmd, unsigned long arg)
++{
++ if (cmd == COMPAT_SPIOCSTYPE) {
++ void __user *uarg = compat_ptr(arg);
++ compat_ulong_t compat_type;
++
++ if (get_user(compat_type, (compat_ulong_t __user *)uarg))
++ return -EFAULT;
+
++ serport_set_type(tty, compat_type);
+ return 0;
+ }
+
+ return -EINVAL;
+ }
++#endif
+
+ static void serport_ldisc_write_wakeup(struct tty_struct * tty)
+ {
+@@ -241,6 +269,9 @@ static struct tty_ldisc_ops serport_ldisc = {
+ .close = serport_ldisc_close,
+ .read = serport_ldisc_read,
+ .ioctl = serport_ldisc_ioctl,
++#ifdef CONFIG_COMPAT
++ .compat_ioctl = serport_ldisc_compat_ioctl,
++#endif
+ .receive_buf = serport_ldisc_receive,
+ .write_wakeup = serport_ldisc_write_wakeup
+ };
+diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
+index 535c3e276fc7..926989d6419f 100644
+--- a/drivers/md/dm-crypt.c
++++ b/drivers/md/dm-crypt.c
+@@ -1566,6 +1566,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ unsigned int key_size, opt_params;
+ unsigned long long tmpll;
+ int ret;
++ size_t iv_size_padding;
+ struct dm_arg_set as;
+ const char *opt_string;
+ char dummy;
+@@ -1602,12 +1603,23 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+
+ cc->dmreq_start = sizeof(struct ablkcipher_request);
+ cc->dmreq_start += crypto_ablkcipher_reqsize(any_tfm(cc));
+- cc->dmreq_start = ALIGN(cc->dmreq_start, crypto_tfm_ctx_alignment());
+- cc->dmreq_start += crypto_ablkcipher_alignmask(any_tfm(cc)) &
+- ~(crypto_tfm_ctx_alignment() - 1);
++ cc->dmreq_start = ALIGN(cc->dmreq_start, __alignof__(struct dm_crypt_request));
++
++ if (crypto_ablkcipher_alignmask(any_tfm(cc)) < CRYPTO_MINALIGN) {
++ /* Allocate the padding exactly */
++ iv_size_padding = -(cc->dmreq_start + sizeof(struct dm_crypt_request))
++ & crypto_ablkcipher_alignmask(any_tfm(cc));
++ } else {
++ /*
++ * If the cipher requires greater alignment than kmalloc
++ * alignment, we don't know the exact position of the
++ * initialization vector. We must assume worst case.
++ */
++ iv_size_padding = crypto_ablkcipher_alignmask(any_tfm(cc));
++ }
+
+ cc->req_pool = mempool_create_kmalloc_pool(MIN_IOS, cc->dmreq_start +
+- sizeof(struct dm_crypt_request) + cc->iv_size);
++ sizeof(struct dm_crypt_request) + iv_size_padding + cc->iv_size);
+ if (!cc->req_pool) {
+ ti->error = "Cannot allocate crypt request mempool";
+ goto bad;
+diff --git a/drivers/net/can/at91_can.c b/drivers/net/can/at91_can.c
+index 6ea905c2cf6d..12328068822e 100644
+--- a/drivers/net/can/at91_can.c
++++ b/drivers/net/can/at91_can.c
+@@ -1115,7 +1115,9 @@ static int at91_open(struct net_device *dev)
+ struct at91_priv *priv = netdev_priv(dev);
+ int err;
+
+- clk_enable(priv->clk);
++ err = clk_prepare_enable(priv->clk);
++ if (err)
++ return err;
+
+ /* check or determine and set bittime */
+ err = open_candev(dev);
+@@ -1139,7 +1141,7 @@ static int at91_open(struct net_device *dev)
+ out_close:
+ close_candev(dev);
+ out:
+- clk_disable(priv->clk);
++ clk_disable_unprepare(priv->clk);
+
+ return err;
+ }
+@@ -1156,7 +1158,7 @@ static int at91_close(struct net_device *dev)
+ at91_chip_stop(dev, CAN_STATE_STOPPED);
+
+ free_irq(dev->irq, dev);
+- clk_disable(priv->clk);
++ clk_disable_unprepare(priv->clk);
+
+ close_candev(dev);
+
+diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
+index 75e9233aabaf..b523e656dc0b 100644
+--- a/drivers/net/can/flexcan.c
++++ b/drivers/net/can/flexcan.c
+@@ -123,7 +123,9 @@
+ FLEXCAN_ESR_BOFF_INT | FLEXCAN_ESR_ERR_INT)
+
+ /* FLEXCAN interrupt flag register (IFLAG) bits */
+-#define FLEXCAN_TX_BUF_ID 8
++/* Errata ERR005829 step7: Reserve first valid MB */
++#define FLEXCAN_TX_BUF_RESERVED 8
++#define FLEXCAN_TX_BUF_ID 9
+ #define FLEXCAN_IFLAG_BUF(x) BIT(x)
+ #define FLEXCAN_IFLAG_RX_FIFO_OVERFLOW BIT(7)
+ #define FLEXCAN_IFLAG_RX_FIFO_WARN BIT(6)
+@@ -134,6 +136,17 @@
+
+ /* FLEXCAN message buffers */
+ #define FLEXCAN_MB_CNT_CODE(x) (((x) & 0xf) << 24)
++#define FLEXCAN_MB_CODE_RX_INACTIVE (0x0 << 24)
++#define FLEXCAN_MB_CODE_RX_EMPTY (0x4 << 24)
++#define FLEXCAN_MB_CODE_RX_FULL (0x2 << 24)
++#define FLEXCAN_MB_CODE_RX_OVERRRUN (0x6 << 24)
++#define FLEXCAN_MB_CODE_RX_RANSWER (0xa << 24)
++
++#define FLEXCAN_MB_CODE_TX_INACTIVE (0x8 << 24)
++#define FLEXCAN_MB_CODE_TX_ABORT (0x9 << 24)
++#define FLEXCAN_MB_CODE_TX_DATA (0xc << 24)
++#define FLEXCAN_MB_CODE_TX_TANSWER (0xe << 24)
++
+ #define FLEXCAN_MB_CNT_SRR BIT(22)
+ #define FLEXCAN_MB_CNT_IDE BIT(21)
+ #define FLEXCAN_MB_CNT_RTR BIT(20)
+@@ -306,6 +319,14 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ flexcan_write(can_id, ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_id);
+ flexcan_write(ctrl, ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+
++ /* Errata ERR005829 step8:
++ * Write twice INACTIVE(0x8) code to first MB.
++ */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ ®s->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ ®s->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++
+ return NETDEV_TX_OK;
+ }
+
+@@ -612,6 +633,9 @@ static irqreturn_t flexcan_irq(int irq, void *dev_id)
+ if (reg_iflag1 & (1 << FLEXCAN_TX_BUF_ID)) {
+ stats->tx_bytes += can_get_echo_skb(dev, 0);
+ stats->tx_packets++;
++ /* after sending a RTR frame mailbox is in RX mode */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+ flexcan_write((1 << FLEXCAN_TX_BUF_ID), ®s->iflag1);
+ netif_wake_queue(dev);
+ }
+@@ -669,6 +693,7 @@ static int flexcan_chip_start(struct net_device *dev)
+ struct flexcan_regs __iomem *regs = priv->base;
+ int err;
+ u32 reg_mcr, reg_ctrl;
++ int i;
+
+ /* enable module */
+ flexcan_chip_enable(priv);
+@@ -734,8 +759,18 @@ static int flexcan_chip_start(struct net_device *dev)
+ netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
+ flexcan_write(reg_ctrl, ®s->ctrl);
+
+- /* Abort any pending TX, mark Mailbox as INACTIVE */
+- flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
++ /* clear and invalidate all mailboxes first */
++ for (i = FLEXCAN_TX_BUF_ID; i < ARRAY_SIZE(regs->cantxfg); i++) {
++ flexcan_write(FLEXCAN_MB_CODE_RX_INACTIVE,
++ ®s->cantxfg[i].can_ctrl);
++ }
++
++ /* Errata ERR005829: mark first TX mailbox as INACTIVE */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
++ ®s->cantxfg[FLEXCAN_TX_BUF_RESERVED].can_ctrl);
++
++ /* mark TX mailbox as INACTIVE */
++ flexcan_write(FLEXCAN_MB_CODE_TX_INACTIVE,
+ ®s->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
+
+ /* acceptance mask/acceptance code (accept everything) */
+diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+index 307611ae831d..d8e4562a3863 100644
+--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+@@ -969,8 +969,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data)
+ r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
+ for (i = 0; i < q_vector->txr_count; i++) {
+ tx_ring = &(adapter->tx_ring[r_idx]);
+- tx_ring->total_bytes = 0;
+- tx_ring->total_packets = 0;
+ ixgbevf_clean_tx_irq(adapter, tx_ring);
+ r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
+ r_idx + 1);
+@@ -994,16 +992,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data)
+ struct ixgbe_hw *hw = &adapter->hw;
+ struct ixgbevf_ring *rx_ring;
+ int r_idx;
+- int i;
+-
+- r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
+- for (i = 0; i < q_vector->rxr_count; i++) {
+- rx_ring = &(adapter->rx_ring[r_idx]);
+- rx_ring->total_bytes = 0;
+- rx_ring->total_packets = 0;
+- r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
+- r_idx + 1);
+- }
+
+ if (!q_vector->rxr_count)
+ return IRQ_HANDLED;
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+index 1208b753f62f..513baa0b5bee 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -1210,11 +1210,14 @@ static void rtl92c_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw)
+ if (rtlhal->interface == INTF_PCI) {
+ rcu_read_lock();
+ sta = ieee80211_find_sta(mac->vif, mac->bssid);
++ if (!sta)
++ goto out_unlock;
+ }
+ rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
+ p_ra->ratr_state);
+
+ p_ra->pre_ratr_state = p_ra->ratr_state;
++ out_unlock:
+ if (rtlhal->interface == INTF_PCI)
+ rcu_read_unlock();
+ }
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 52a9c338fa47..2c4cdcecbe39 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -306,6 +306,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
+ {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+ {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
++ {RTL_USB_DEVICE(0x0df6, 0x0070, rtl92cu_hal_cfg)}, /*Sitecom - 150N */
+ {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
+ {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
+ {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 82c3fd4bc938..1243d2f5bffa 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -718,11 +718,21 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ return NULL;
+ }
+
++ if (data_size > ISCSI_DEF_MAX_RECV_SEG_LEN) {
++ iscsi_conn_printk(KERN_ERR, conn, "Invalid buffer len of %u for login task. Max len is %u\n", data_size, ISCSI_DEF_MAX_RECV_SEG_LEN);
++ return NULL;
++ }
++
+ task = conn->login_task;
+ } else {
+ if (session->state != ISCSI_STATE_LOGGED_IN)
+ return NULL;
+
++ if (data_size != 0) {
++ iscsi_conn_printk(KERN_ERR, conn, "Can not send data buffer of len %u for op 0x%x\n", data_size, opcode);
++ return NULL;
++ }
++
+ BUG_ON(conn->c_stage == ISCSI_CONN_INITIAL_STAGE);
+ BUG_ON(conn->c_stage == ISCSI_CONN_STOPPED);
+
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index b3f0b0f6d44b..dcc39b612780 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -916,6 +916,15 @@ int scsi_eh_get_sense(struct list_head *work_q,
+ SCSI_SENSE_VALID(scmd))
+ continue;
+
++ if (status_byte(scmd->result) != CHECK_CONDITION)
++ /*
++ * don't request sense if there's no check condition
++ * status because the error we're processing isn't one
++ * that has a sense code (and some devices get
++ * confused by sense requests out of the blue)
++ */
++ continue;
++
+ SCSI_LOG_ERROR_RECOVERY(2, scmd_printk(KERN_INFO, scmd,
+ "%s: requesting sense\n",
+ current->comm));
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index d7ac2c095cc9..56d02e071d7a 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4297,6 +4297,7 @@ static void iscsit_logout_post_handler_diffcid(
+ {
+ struct iscsi_conn *l_conn;
+ struct iscsi_session *sess = conn->sess;
++ bool conn_found = false;
+
+ if (!sess)
+ return;
+@@ -4305,12 +4306,13 @@ static void iscsit_logout_post_handler_diffcid(
+ list_for_each_entry(l_conn, &sess->sess_conn_list, conn_list) {
+ if (l_conn->cid == cid) {
+ iscsit_inc_conn_usage_count(l_conn);
++ conn_found = true;
+ break;
+ }
+ }
+ spin_unlock_bh(&sess->conn_lock);
+
+- if (!l_conn)
++ if (!conn_found)
+ return;
+
+ if (l_conn->sock)
+diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
+index 8a8ff238c231..ed4abadc3df6 100644
+--- a/drivers/target/iscsi/iscsi_target_parameters.c
++++ b/drivers/target/iscsi/iscsi_target_parameters.c
+@@ -552,7 +552,7 @@ int iscsi_copy_param_list(
+ param_list = kzalloc(sizeof(struct iscsi_param_list), GFP_KERNEL);
+ if (!param_list) {
+ pr_err("Unable to allocate memory for struct iscsi_param_list.\n");
+- goto err_out;
++ return -1;
+ }
+ INIT_LIST_HEAD(¶m_list->param_list);
+ INIT_LIST_HEAD(¶m_list->extra_response_list);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index e0d4d901e99d..62a9e44bfef6 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -3729,9 +3729,10 @@ static void hub_events(void)
+
+ hub = list_entry(tmp, struct usb_hub, event_list);
+ kref_get(&hub->kref);
++ hdev = hub->hdev;
++ usb_get_dev(hdev);
+ spin_unlock_irq(&hub_event_lock);
+
+- hdev = hub->hdev;
+ hub_dev = hub->intfdev;
+ intf = to_usb_interface(hub_dev);
+ dev_dbg(hub_dev, "state %d ports %d chg %04x evt %04x\n",
+@@ -3946,6 +3947,7 @@ static void hub_events(void)
+ usb_autopm_put_interface(intf);
+ loop_disconnected:
+ usb_unlock_device(hdev);
++ usb_put_dev(hdev);
+ kref_put(&hub->kref, hub_release);
+
+ } /* end while (1) */
+diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
+index 99b58d84553a..6da443532c70 100644
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -563,9 +563,6 @@ static int __devexit dwc3_remove(struct platform_device *pdev)
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+
+- pm_runtime_put(&pdev->dev);
+- pm_runtime_disable(&pdev->dev);
+-
+ dwc3_debugfs_exit(dwc);
+
+ switch (dwc->mode) {
+@@ -586,6 +583,9 @@ static int __devexit dwc3_remove(struct platform_device *pdev)
+
+ dwc3_core_exit(dwc);
+
++ pm_runtime_put(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++
+ return 0;
+ }
+
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index a94eabd76ad8..56ec28bff136 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -463,7 +463,8 @@ void xhci_test_and_clear_bit(struct xhci_hcd *xhci, __le32 __iomem **port_array,
+ }
+
+ /* Updates Link Status for super Speed port */
+-static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
++static void xhci_hub_report_link_state(struct xhci_hcd *xhci,
++ u32 *status, u32 status_reg)
+ {
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+@@ -502,7 +503,8 @@ static void xhci_hub_report_link_state(u32 *status, u32 status_reg)
+ * in which sometimes the port enters compliance mode
+ * caused by a delay on the host-device negotiation.
+ */
+- if (pls == USB_SS_PORT_LS_COMP_MOD)
++ if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) &&
++ (pls == USB_SS_PORT_LS_COMP_MOD))
+ pls |= USB_PORT_STAT_CONNECTION;
+ }
+
+@@ -680,7 +682,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
+ }
+ /* Update Port Link State for super speed ports*/
+ if (hcd->speed == HCD_USB3) {
+- xhci_hub_report_link_state(&status, temp);
++ xhci_hub_report_link_state(xhci, &status, temp);
+ /*
+ * Verify if all USB3 Ports Have entered U0 already.
+ * Delete Compliance Mode Timer if so.
+diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
+index 197685852638..aa38b1ff45ae 100644
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1813,7 +1813,7 @@ void xhci_mem_cleanup(struct xhci_hcd *xhci)
+ }
+
+ num_ports = HCS_MAX_PORTS(xhci->hcs_params1);
+- for (i = 0; i < num_ports; i++) {
++ for (i = 0; i < num_ports && xhci->rh_bw; i++) {
+ struct xhci_interval_bw_table *bwt = &xhci->rh_bw[i].bw_table;
+ for (j = 0; j < XHCI_MAX_INTERVAL; j++) {
+ struct list_head *ep = &bwt->interval_bw[j].endpoints;
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 121a05207d8b..8425e9e9e127 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -750,6 +750,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_NDI_AURORA_SCU_PID),
+ .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk },
+ { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) },
++ { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) },
+ { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
+@@ -959,6 +960,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ /* ekey Devices */
+ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
++ /* GE Healthcare devices */
++ { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 0eb2e97bcb4a..7628b91017ba 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -828,6 +828,12 @@
+ #define TELLDUS_TELLSTICK_PID 0x0C30 /* RF control dongle 433 MHz using FT232RL */
+
+ /*
++ * NOVITUS printers
++ */
++#define NOVITUS_VID 0x1a28
++#define NOVITUS_BONO_E_PID 0x6010
++
++/*
+ * RT Systems programming cables for various ham radios
+ */
+ #define RTSYSTEMS_VID 0x2100 /* Vendor ID */
+@@ -1376,3 +1382,9 @@
+ * ekey biometric systems GmbH (http://ekey.net/)
+ */
+ #define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */
++
++/*
++ * GE Healthcare devices
++ */
++#define GE_HEALTHCARE_VID 0x1901
++#define GE_HEALTHCARE_NEMO_TRACKER_PID 0x0015
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index bd79d68b51c1..e3ddec02f032 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -296,14 +296,19 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1199, 0x68A2), /* Sierra Wireless MC77xx in QMI mode */
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+- { USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless Direct IP modems */
++ /* Sierra Wireless Direct IP modems */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68A3, 0xFF, 0xFF, 0xFF),
++ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
++ },
++ { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+ /* AT&T Direct IP LTE modems */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+- { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
++ /* Airprime/Sierra Wireless Direct IP modems */
++ { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68A3, 0xFF, 0xFF, 0xFF),
+ .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ },
+
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 1d9fc30f3ac3..a280945d2236 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -93,6 +93,12 @@ UNUSUAL_DEV( 0x03f0, 0x4002, 0x0001, 0x0001,
+ "PhotoSmart R707",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_FIX_CAPACITY),
+
++UNUSUAL_DEV( 0x03f3, 0x0001, 0x0000, 0x9999,
++ "Adaptec",
++ "USBConnect 2000",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Sebastian Kapfer <sebastian_kapfer@gmx.net>
+ * and Olaf Hering <olh@suse.de> (different bcd's, same vendor/product)
+ * for USB floppies that need the SINGLE_LUN enforcement.
+@@ -733,6 +739,12 @@ UNUSUAL_DEV( 0x059b, 0x0001, 0x0100, 0x0100,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_SINGLE_LUN ),
+
++UNUSUAL_DEV( 0x059b, 0x0040, 0x0100, 0x0100,
++ "Iomega",
++ "Jaz USB Adapter",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by <Hendryk.Pfeiffer@gmx.de> */
+ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
+ "LaCie",
+@@ -1105,6 +1117,18 @@ UNUSUAL_DEV( 0x0851, 0x1543, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NOT_LOCKABLE),
+
++UNUSUAL_DEV( 0x085a, 0x0026, 0x0100, 0x0133,
++ "Xircom",
++ "PortGear USB-SCSI (Mac USB Dock)",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
++UNUSUAL_DEV( 0x085a, 0x0028, 0x0100, 0x0133,
++ "Xircom",
++ "PortGear USB to SCSI Converter",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Submitted by Jan De Luyck <lkml@kcore.org> */
+ UNUSUAL_DEV( 0x08bd, 0x1100, 0x0000, 0x0000,
+ "CITIZEN",
+@@ -1925,6 +1949,14 @@ UNUSUAL_DEV( 0x152d, 0x2329, 0x0100, 0x0100,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_IGNORE_RESIDUE | US_FL_SANE_SENSE ),
+
++/* Entrega Technologies U1-SC25 (later Xircom PortGear PGSCSI)
++ * and Mac USB Dock USB-SCSI */
++UNUSUAL_DEV( 0x1645, 0x0007, 0x0100, 0x0133,
++ "Entrega Technologies",
++ "USB to SCSI Converter",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Robert Schedel <r.schedel@yahoo.de>
+ * Note: this is a 'super top' device like the above 14cd/6600 device */
+ UNUSUAL_DEV( 0x1652, 0x6600, 0x0201, 0x0201,
+@@ -1940,6 +1972,12 @@ UNUSUAL_DEV( 0x177f, 0x0400, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_BULK_IGNORE_TAG | US_FL_MAX_SECTORS_64 ),
+
++UNUSUAL_DEV( 0x1822, 0x0001, 0x0000, 0x9999,
++ "Ariston Technologies",
++ "iConnect USB to SCSI adapter",
++ USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_euscsi_init,
++ US_FL_SCM_MULT_TARG ),
++
+ /* Reported by Hans de Goede <hdegoede@redhat.com>
+ * These Appotech controllers are found in Picture Frames, they provide a
+ * (buggy) emulation of a cdrom drive which contains the windows software
+diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c
+index 5241f1d0ef7a..3c9e9295f73c 100644
+--- a/drivers/uwb/lc-dev.c
++++ b/drivers/uwb/lc-dev.c
+@@ -441,16 +441,19 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
+ uwb_dev->mac_addr = *bce->mac_addr;
+ uwb_dev->dev_addr = bce->dev_addr;
+ dev_set_name(&uwb_dev->dev, macbuf);
++
++ /* plug the beacon cache */
++ bce->uwb_dev = uwb_dev;
++ uwb_dev->bce = bce;
++ uwb_bce_get(bce); /* released in uwb_dev_sys_release() */
++
+ result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc);
+ if (result < 0) {
+ dev_err(dev, "new device %s: cannot instantiate device\n",
+ macbuf);
+ goto error_dev_add;
+ }
+- /* plug the beacon cache */
+- bce->uwb_dev = uwb_dev;
+- uwb_dev->bce = bce;
+- uwb_bce_get(bce); /* released in uwb_dev_sys_release() */
++
+ dev_info(dev, "uwb device (mac %s dev %s) connected to %s %s\n",
+ macbuf, devbuf, rc->uwb_dev.dev.parent->bus->name,
+ dev_name(rc->uwb_dev.dev.parent));
+@@ -458,6 +461,8 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
+ return;
+
+ error_dev_add:
++ bce->uwb_dev = NULL;
++ uwb_bce_put(bce);
+ kfree(uwb_dev);
+ return;
+ }
+diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
+index 412b96cc5305..8da1ed1cf3c8 100644
+--- a/drivers/xen/manage.c
++++ b/drivers/xen/manage.c
+@@ -109,16 +109,11 @@ static void do_suspend(void)
+
+ shutting_down = SHUTDOWN_SUSPEND;
+
+-#ifdef CONFIG_PREEMPT
+- /* If the kernel is preemptible, we need to freeze all the processes
+- to prevent them from being in the middle of a pagetable update
+- during suspend. */
+ err = freeze_processes();
+ if (err) {
+ printk(KERN_ERR "xen suspend: freeze failed %d\n", err);
+ goto out;
+ }
+-#endif
+
+ err = dpm_suspend_start(PMSG_FREEZE);
+ if (err) {
+@@ -170,10 +165,8 @@ out_resume:
+ clock_was_set();
+
+ out_thaw:
+-#ifdef CONFIG_PREEMPT
+ thaw_processes();
+ out:
+-#endif
+ shutting_down = SHUTDOWN_INVALID;
+ }
+ #endif /* CONFIG_HIBERNATE_CALLBACKS */
+diff --git a/fs/buffer.c b/fs/buffer.c
+index 9bf31ac982e1..f235e1834e39 100644
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -971,7 +971,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ bh = page_buffers(page);
+ if (bh->b_size == size) {
+ end_block = init_page_buffers(page, bdev,
+- index << sizebits, size);
++ (sector_t)index << sizebits,
++ size);
+ goto done;
+ }
+ if (!try_to_free_buffers(page))
+@@ -992,7 +993,8 @@ grow_dev_page(struct block_device *bdev, sector_t block,
+ */
+ spin_lock(&inode->i_mapping->private_lock);
+ link_dev_buffers(page, bh);
+- end_block = init_page_buffers(page, bdev, index << sizebits, size);
++ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
++ size);
+ spin_unlock(&inode->i_mapping->private_lock);
+ done:
+ ret = (block < end_block) ? 1 : -ENXIO;
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 29224866f743..521ba9d18ce6 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -1674,7 +1674,7 @@ ext4_group_first_block_no(struct super_block *sb, ext4_group_t group_no)
+ /*
+ * Special error return code only used by dx_probe() and its callers.
+ */
+-#define ERR_BAD_DX_DIR -75000
++#define ERR_BAD_DX_DIR (-(MAX_ERRNO - 1))
+
+ void ext4_get_group_no_and_offset(struct super_block *sb, ext4_fsblk_t blocknr,
+ ext4_group_t *blockgrpp, ext4_grpblk_t *offsetp);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 54ad9a54cd89..665e55ca208c 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -861,7 +861,7 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
+ buffer */
+ int num = 0;
+ ext4_lblk_t nblocks;
+- int i, err;
++ int i, err = 0;
+ int namelen;
+
+ *res_dir = NULL;
+@@ -886,7 +886,11 @@ static struct buffer_head * ext4_find_entry (struct inode *dir,
+ * return. Otherwise, fall back to doing a search the
+ * old fashioned way.
+ */
+- if (bh || (err != ERR_BAD_DX_DIR))
++ if (err == -ENOENT)
++ return NULL;
++ if (err && err != ERR_BAD_DX_DIR)
++ return ERR_PTR(err);
++ if (bh)
+ return bh;
+ dxtrace(printk(KERN_DEBUG "ext4_find_entry: dx failed, "
+ "falling back\n"));
+@@ -917,6 +921,11 @@ restart:
+ }
+ num++;
+ bh = ext4_getblk(NULL, dir, b++, 0, &err);
++ if (unlikely(err)) {
++ if (ra_max == 0)
++ return ERR_PTR(err);
++ break;
++ }
+ bh_use[ra_max] = bh;
+ if (bh)
+ ll_rw_block(READ | REQ_META | REQ_PRIO,
+@@ -1026,6 +1035,8 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, stru
+ return ERR_PTR(-ENAMETOOLONG);
+
+ bh = ext4_find_entry(dir, &dentry->d_name, &de);
++ if (IS_ERR(bh))
++ return (struct dentry *) bh;
+ inode = NULL;
+ if (bh) {
+ __u32 ino = le32_to_cpu(de->inode);
+@@ -1063,6 +1074,8 @@ struct dentry *ext4_get_parent(struct dentry *child)
+ struct buffer_head *bh;
+
+ bh = ext4_find_entry(child->d_inode, &dotdot, &de);
++ if (IS_ERR(bh))
++ return (struct dentry *) bh;
+ if (!bh)
+ return ERR_PTR(-ENOENT);
+ ino = le32_to_cpu(de->inode);
+@@ -2137,6 +2150,8 @@ static int ext4_rmdir(struct inode *dir, struct dentry *dentry)
+
+ retval = -ENOENT;
+ bh = ext4_find_entry(dir, &dentry->d_name, &de);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+ if (!bh)
+ goto end_rmdir;
+
+@@ -2202,6 +2217,8 @@ static int ext4_unlink(struct inode *dir, struct dentry *dentry)
+
+ retval = -ENOENT;
+ bh = ext4_find_entry(dir, &dentry->d_name, &de);
++ if (IS_ERR(bh))
++ return PTR_ERR(bh);
+ if (!bh)
+ goto end_unlink;
+
+@@ -2418,6 +2435,8 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ ext4_handle_sync(handle);
+
+ old_bh = ext4_find_entry(old_dir, &old_dentry->d_name, &old_de);
++ if (IS_ERR(old_bh))
++ return PTR_ERR(old_bh);
+ /*
+ * Check for inode number is _not_ due to possible IO errors.
+ * We might rmdir the source, keep it as pwd of some process
+@@ -2431,6 +2450,11 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+
+ new_inode = new_dentry->d_inode;
+ new_bh = ext4_find_entry(new_dir, &new_dentry->d_name, &new_de);
++ if (IS_ERR(new_bh)) {
++ retval = PTR_ERR(new_bh);
++ new_bh = NULL;
++ goto end_rename;
++ }
+ if (new_bh) {
+ if (!new_inode) {
+ brelse(new_bh);
+@@ -2509,7 +2533,9 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ struct ext4_dir_entry_2 *old_de2;
+
+ old_bh2 = ext4_find_entry(old_dir, &old_dentry->d_name, &old_de2);
+- if (old_bh2) {
++ if (IS_ERR(old_bh2)) {
++ retval = PTR_ERR(old_bh2);
++ } else if (old_bh2) {
+ retval = ext4_delete_entry(handle, old_dir,
+ old_de2, old_bh2);
+ brelse(old_bh2);
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 50992c3025c2..a43e43c835d1 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -528,6 +528,7 @@ handle_bb:
+ bh = bclean(handle, sb, block);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
++ bh = NULL;
+ goto out;
+ }
+ if (ext4_bg_has_super(sb, group)) {
+@@ -556,6 +557,7 @@ handle_ib:
+ bh = bclean(handle, sb, block);
+ if (IS_ERR(bh)) {
+ err = PTR_ERR(bh);
++ bh = NULL;
+ goto out;
+ }
+
+diff --git a/fs/namei.c b/fs/namei.c
+index c42791914f82..5974fb573f5a 100644
+--- a/fs/namei.c
++++ b/fs/namei.c
+@@ -553,24 +553,22 @@ static int complete_walk(struct nameidata *nd)
+
+ static __always_inline void set_root(struct nameidata *nd)
+ {
+- if (!nd->root.mnt)
+- get_fs_root(current->fs, &nd->root);
++ get_fs_root(current->fs, &nd->root);
+ }
+
+ static int link_path_walk(const char *, struct nameidata *);
+
+-static __always_inline void set_root_rcu(struct nameidata *nd)
++static __always_inline unsigned set_root_rcu(struct nameidata *nd)
+ {
+- if (!nd->root.mnt) {
+- struct fs_struct *fs = current->fs;
+- unsigned seq;
++ struct fs_struct *fs = current->fs;
++ unsigned seq, res;
+
+- do {
+- seq = read_seqcount_begin(&fs->seq);
+- nd->root = fs->root;
+- nd->seq = __read_seqcount_begin(&nd->root.dentry->d_seq);
+- } while (read_seqcount_retry(&fs->seq, seq));
+- }
++ do {
++ seq = read_seqcount_begin(&fs->seq);
++ nd->root = fs->root;
++ res = __read_seqcount_begin(&nd->root.dentry->d_seq);
++ } while (read_seqcount_retry(&fs->seq, seq));
++ return res;
+ }
+
+ static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
+@@ -928,7 +926,8 @@ static void follow_mount_rcu(struct nameidata *nd)
+
+ static int follow_dotdot_rcu(struct nameidata *nd)
+ {
+- set_root_rcu(nd);
++ if (!nd->root.mnt)
++ set_root_rcu(nd);
+
+ while (1) {
+ if (nd->path.dentry == nd->root.dentry &&
+@@ -1031,7 +1030,8 @@ static void follow_mount(struct path *path)
+
+ static void follow_dotdot(struct nameidata *nd)
+ {
+- set_root(nd);
++ if (!nd->root.mnt)
++ set_root(nd);
+
+ while(1) {
+ struct dentry *old = nd->path.dentry;
+@@ -1633,7 +1633,7 @@ static int path_init(int dfd, const char *name, unsigned int flags,
+ if (flags & LOOKUP_RCU) {
+ br_read_lock(vfsmount_lock);
+ rcu_read_lock();
+- set_root_rcu(nd);
++ nd->seq = set_root_rcu(nd);
+ } else {
+ set_root(nd);
+ path_get(&nd->root);
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 4e465397e456..f0f2e067c5df 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1066,6 +1066,9 @@ void umount_tree(struct mount *mnt, int propagate, struct list_head *kill)
+ for (p = mnt; p; p = next_mnt(p, mnt))
+ list_move(&p->mnt_hash, &tmp_list);
+
++ list_for_each_entry(p, &tmp_list, mnt_hash)
++ list_del_init(&p->mnt_child);
++
+ if (propagate)
+ propagate_umount(&tmp_list);
+
+@@ -1076,7 +1079,6 @@ void umount_tree(struct mount *mnt, int propagate, struct list_head *kill)
+ if (p->mnt_ns)
+ __mnt_make_shortterm(p);
+ p->mnt_ns = NULL;
+- list_del_init(&p->mnt_child);
+ if (mnt_has_parent(p)) {
+ p->mnt_parent->mnt_ghosts++;
+ dentry_reset_mounted(p->mnt_mountpoint);
+@@ -1679,7 +1681,7 @@ static int do_remount(struct path *path, int flags, int mnt_flags,
+ err = do_remount_sb(sb, flags, data, 0);
+ if (!err) {
+ br_write_lock(vfsmount_lock);
+- mnt_flags |= mnt->mnt.mnt_flags & MNT_PROPAGATION_MASK;
++ mnt_flags |= mnt->mnt.mnt_flags & ~MNT_USER_SETTABLE_MASK;
+ mnt->mnt.mnt_flags = mnt_flags;
+ br_write_unlock(vfsmount_lock);
+ }
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 01afcd575920..527a4fc12546 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2063,23 +2063,23 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
+ is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
+ is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
+- /* Calculate the current open share mode */
+- calldata->arg.fmode = 0;
+- if (is_rdonly || is_rdwr)
+- calldata->arg.fmode |= FMODE_READ;
+- if (is_wronly || is_rdwr)
+- calldata->arg.fmode |= FMODE_WRITE;
+ /* Calculate the change in open mode */
++ calldata->arg.fmode = 0;
+ if (state->n_rdwr == 0) {
+- if (state->n_rdonly == 0) {
+- call_close |= is_rdonly || is_rdwr;
+- calldata->arg.fmode &= ~FMODE_READ;
+- }
+- if (state->n_wronly == 0) {
+- call_close |= is_wronly || is_rdwr;
+- calldata->arg.fmode &= ~FMODE_WRITE;
+- }
+- }
++ if (state->n_rdonly == 0)
++ call_close |= is_rdonly;
++ else if (is_rdonly)
++ calldata->arg.fmode |= FMODE_READ;
++ if (state->n_wronly == 0)
++ call_close |= is_wronly;
++ else if (is_wronly)
++ calldata->arg.fmode |= FMODE_WRITE;
++ } else if (is_rdwr)
++ calldata->arg.fmode |= FMODE_READ|FMODE_WRITE;
++
++ if (calldata->arg.fmode == 0)
++ call_close |= is_rdwr;
++
+ spin_unlock(&state->owner->so_lock);
+
+ if (!call_close) {
+diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
+index e3abfde27863..36620e65158b 100644
+--- a/fs/nfsd/vfs.c
++++ b/fs/nfsd/vfs.c
+@@ -508,6 +508,9 @@ set_nfsv4_acl_one(struct dentry *dentry, struct posix_acl *pacl, char *key)
+ char *buf = NULL;
+ int error = 0;
+
++ if (!pacl)
++ return vfs_setxattr(dentry, key, NULL, 0, 0);
++
+ buflen = posix_acl_xattr_size(pacl->a_count);
+ buf = kmalloc(buflen, GFP_KERNEL);
+ error = -ENOMEM;
+diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c
+index aa526bebee3f..204bfcf06314 100644
+--- a/fs/nilfs2/inode.c
++++ b/fs/nilfs2/inode.c
+@@ -24,6 +24,7 @@
+ #include <linux/buffer_head.h>
+ #include <linux/gfp.h>
+ #include <linux/mpage.h>
++#include <linux/pagemap.h>
+ #include <linux/writeback.h>
+ #include <linux/uio.h>
+ #include "nilfs.h"
+@@ -195,10 +196,10 @@ static int nilfs_writepage(struct page *page, struct writeback_control *wbc)
+
+ static int nilfs_set_page_dirty(struct page *page)
+ {
++ struct inode *inode = page->mapping->host;
+ int ret = __set_page_dirty_nobuffers(page);
+
+ if (page_has_buffers(page)) {
+- struct inode *inode = page->mapping->host;
+ unsigned nr_dirty = 0;
+ struct buffer_head *bh, *head;
+
+@@ -221,6 +222,10 @@ static int nilfs_set_page_dirty(struct page *page)
+
+ if (nr_dirty)
+ nilfs_set_file_dirty(inode, nr_dirty);
++ } else if (ret) {
++ unsigned nr_dirty = 1 << (PAGE_CACHE_SHIFT - inode->i_blkbits);
++
++ nilfs_set_file_dirty(inode, nr_dirty);
+ }
+ return ret;
+ }
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index 005261c333b0..dbc372e2f71d 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -653,12 +653,9 @@ void dlm_lockres_clear_refmap_bit(struct dlm_ctxt *dlm,
+ clear_bit(bit, res->refmap);
+ }
+
+-
+-void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
++static void __dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ struct dlm_lock_resource *res)
+ {
+- assert_spin_locked(&res->spinlock);
+-
+ res->inflight_locks++;
+
+ mlog(0, "%s: res %.*s, inflight++: now %u, %ps()\n", dlm->name,
+@@ -666,6 +663,13 @@ void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
+ __builtin_return_address(0));
+ }
+
++void dlm_lockres_grab_inflight_ref(struct dlm_ctxt *dlm,
++ struct dlm_lock_resource *res)
++{
++ assert_spin_locked(&res->spinlock);
++ __dlm_lockres_grab_inflight_ref(dlm, res);
++}
++
+ void dlm_lockres_drop_inflight_ref(struct dlm_ctxt *dlm,
+ struct dlm_lock_resource *res)
+ {
+@@ -855,10 +859,8 @@ lookup:
+ /* finally add the lockres to its hash bucket */
+ __dlm_insert_lockres(dlm, res);
+
+- /* Grab inflight ref to pin the resource */
+- spin_lock(&res->spinlock);
+- dlm_lockres_grab_inflight_ref(dlm, res);
+- spin_unlock(&res->spinlock);
++ /* since this lockres is new it doesn't not require the spinlock */
++ __dlm_lockres_grab_inflight_ref(dlm, res);
+
+ /* get an extra ref on the mle in case this is a BLOCK
+ * if so, the creator of the BLOCK may try to put the last
+diff --git a/fs/pnode.c b/fs/pnode.c
+index ab5fa9e1a79a..f61dcb4f994c 100644
+--- a/fs/pnode.c
++++ b/fs/pnode.c
+@@ -333,8 +333,10 @@ static void __propagate_umount(struct mount *mnt)
+ * umount the child only if the child has no
+ * other children
+ */
+- if (child && list_empty(&child->mnt_mounts))
++ if (child && list_empty(&child->mnt_mounts)) {
++ list_del_init(&child->mnt_child);
+ list_move_tail(&child->mnt_hash, &mnt->mnt_hash);
++ }
+ }
+ }
+
+diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h
+index 668f66baac7b..bb48be7994c1 100644
+--- a/include/linux/cpuset.h
++++ b/include/linux/cpuset.h
+@@ -74,12 +74,12 @@ extern int cpuset_slab_spread_node(void);
+
+ static inline int cpuset_do_page_mem_spread(void)
+ {
+- return current->flags & PF_SPREAD_PAGE;
++ return task_spread_page(current);
+ }
+
+ static inline int cpuset_do_slab_mem_spread(void)
+ {
+- return current->flags & PF_SPREAD_SLAB;
++ return task_spread_slab(current);
+ }
+
+ extern int current_cpuset_is_being_rebound(void);
+diff --git a/include/linux/jiffies.h b/include/linux/jiffies.h
+index f5df3dcfe811..f4e8578f7caa 100644
+--- a/include/linux/jiffies.h
++++ b/include/linux/jiffies.h
+@@ -259,23 +259,11 @@ extern unsigned long preset_lpj;
+ #define SEC_JIFFIE_SC (32 - SHIFT_HZ)
+ #endif
+ #define NSEC_JIFFIE_SC (SEC_JIFFIE_SC + 29)
+-#define USEC_JIFFIE_SC (SEC_JIFFIE_SC + 19)
+ #define SEC_CONVERSION ((unsigned long)((((u64)NSEC_PER_SEC << SEC_JIFFIE_SC) +\
+ TICK_NSEC -1) / (u64)TICK_NSEC))
+
+ #define NSEC_CONVERSION ((unsigned long)((((u64)1 << NSEC_JIFFIE_SC) +\
+ TICK_NSEC -1) / (u64)TICK_NSEC))
+-#define USEC_CONVERSION \
+- ((unsigned long)((((u64)NSEC_PER_USEC << USEC_JIFFIE_SC) +\
+- TICK_NSEC -1) / (u64)TICK_NSEC))
+-/*
+- * USEC_ROUND is used in the timeval to jiffie conversion. See there
+- * for more details. It is the scaled resolution rounding value. Note
+- * that it is a 64-bit value. Since, when it is applied, we are already
+- * in jiffies (albit scaled), it is nothing but the bits we will shift
+- * off.
+- */
+-#define USEC_ROUND (u64)(((u64)1 << USEC_JIFFIE_SC) - 1)
+ /*
+ * The maximum jiffie value is (MAX_INT >> 1). Here we translate that
+ * into seconds. The 64-bit case will overflow if we are not careful,
+diff --git a/include/linux/mount.h b/include/linux/mount.h
+index d7029f4a191a..2044aacc0d2b 100644
+--- a/include/linux/mount.h
++++ b/include/linux/mount.h
+@@ -42,7 +42,9 @@ struct mnt_namespace;
+ * flag, consider how it interacts with shared mounts.
+ */
+ #define MNT_SHARED_MASK (MNT_UNBINDABLE)
+-#define MNT_PROPAGATION_MASK (MNT_SHARED | MNT_UNBINDABLE)
++#define MNT_USER_SETTABLE_MASK (MNT_NOSUID | MNT_NODEV | MNT_NOEXEC \
++ | MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME \
++ | MNT_READONLY)
+
+
+ #define MNT_INTERNAL 0x4000
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index 8cd5cb80223c..56d8233c5de7 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1359,6 +1359,7 @@ struct task_struct {
+ /* IRQ handler threads */
+ unsigned irq_thread:1;
+ #endif
++ unsigned long atomic_flags; /* Flags needing atomic access. */
+
+ pid_t pid;
+ pid_t tgid;
+@@ -1833,8 +1834,6 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
+ #define PF_KTHREAD 0x00200000 /* I am a kernel thread */
+ #define PF_RANDOMIZE 0x00400000 /* randomize virtual address space */
+ #define PF_SWAPWRITE 0x00800000 /* Allowed to write to swap */
+-#define PF_SPREAD_PAGE 0x01000000 /* Spread page cache over cpuset */
+-#define PF_SPREAD_SLAB 0x02000000 /* Spread some slab caches over cpuset */
+ #define PF_THREAD_BOUND 0x04000000 /* Thread bound to specific cpu */
+ #define PF_MCE_EARLY 0x08000000 /* Early kill for mce process policy */
+ #define PF_MEMPOLICY 0x10000000 /* Non-default NUMA mempolicy */
+@@ -1866,6 +1865,20 @@ extern void thread_group_times(struct task_struct *p, cputime_t *ut, cputime_t *
+ #define tsk_used_math(p) ((p)->flags & PF_USED_MATH)
+ #define used_math() tsk_used_math(current)
+
++/* Per-process atomic flags. */
++#define PFA_SPREAD_PAGE 1 /* Spread page cache over cpuset */
++#define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */
++
++#define TASK_PFA_TEST(name, func) \
++ static inline bool task_##func(struct task_struct *p) \
++ { return test_bit(PFA_##name, &p->atomic_flags); }
++#define TASK_PFA_SET(name, func) \
++ static inline void task_set_##func(struct task_struct *p) \
++ { set_bit(PFA_##name, &p->atomic_flags); }
++#define TASK_PFA_CLEAR(name, func) \
++ static inline void task_clear_##func(struct task_struct *p) \
++ { clear_bit(PFA_##name, &p->atomic_flags); }
++
+ /*
+ * task->jobctl flags
+ */
+@@ -1957,6 +1970,14 @@ static inline int set_cpus_allowed(struct task_struct *p, cpumask_t new_mask)
+ }
+ #endif
+
++TASK_PFA_TEST(SPREAD_PAGE, spread_page)
++TASK_PFA_SET(SPREAD_PAGE, spread_page)
++TASK_PFA_CLEAR(SPREAD_PAGE, spread_page)
++
++TASK_PFA_TEST(SPREAD_SLAB, spread_slab)
++TASK_PFA_SET(SPREAD_SLAB, spread_slab)
++TASK_PFA_CLEAR(SPREAD_SLAB, spread_slab)
++
+ /*
+ * Do not use outside of architecture code which knows its limitations.
+ *
+diff --git a/include/net/regulatory.h b/include/net/regulatory.h
+index a5f79933e211..8d64abfcaac2 100644
+--- a/include/net/regulatory.h
++++ b/include/net/regulatory.h
+@@ -97,7 +97,7 @@ struct ieee80211_reg_rule {
+
+ struct ieee80211_regdomain {
+ u32 n_reg_rules;
+- char alpha2[2];
++ char alpha2[3];
+ u8 dfs_region;
+ struct ieee80211_reg_rule reg_rules[];
+ };
+diff --git a/init/Kconfig b/init/Kconfig
+index 6cfd71d06463..f1b0e7828ee2 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -560,6 +560,7 @@ config LOG_BUF_SHIFT
+ int "Kernel log buffer size (16 => 64KB, 17 => 128KB)"
+ range 12 21
+ default 17
++ depends on PRINTK
+ help
+ Select kernel log buffer size as a power of 2.
+ Examples:
+diff --git a/kernel/cgroup.c b/kernel/cgroup.c
+index 7c8f4f7d0c71..c776f8941175 100644
+--- a/kernel/cgroup.c
++++ b/kernel/cgroup.c
+@@ -3838,6 +3838,11 @@ static int cgroup_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
+ {
+ struct cgroup *c_parent = dentry->d_parent->d_fsdata;
+
++ /* Do not accept '\n' to prevent making /proc/<pid>/cgroup unparsable.
++ */
++ if (strchr(dentry->d_name.name, '\n'))
++ return -EINVAL;
++
+ /* the vfs holds inode->i_mutex already */
+ return cgroup_create(c_parent, dentry, mode | S_IFDIR);
+ }
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 9cb82b9aeb73..7f3bde5c50fe 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -326,13 +326,14 @@ static void cpuset_update_task_spread_flag(struct cpuset *cs,
+ struct task_struct *tsk)
+ {
+ if (is_spread_page(cs))
+- tsk->flags |= PF_SPREAD_PAGE;
++ task_set_spread_page(tsk);
+ else
+- tsk->flags &= ~PF_SPREAD_PAGE;
++ task_clear_spread_page(tsk);
++
+ if (is_spread_slab(cs))
+- tsk->flags |= PF_SPREAD_SLAB;
++ task_set_spread_slab(tsk);
+ else
+- tsk->flags &= ~PF_SPREAD_SLAB;
++ task_clear_spread_slab(tsk);
+ }
+
+ /*
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 685ce46b2aff..04662972802a 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -36,6 +36,7 @@
+ #include <linux/perf_event.h>
+ #include <linux/ftrace_event.h>
+ #include <linux/hw_breakpoint.h>
++#include <linux/compat.h>
+
+ #include "internal.h"
+
+@@ -1702,6 +1703,16 @@ retry:
+ */
+ if (ctx->is_active) {
+ raw_spin_unlock_irq(&ctx->lock);
++ /*
++ * Reload the task pointer, it might have been changed by
++ * a concurrent perf_event_context_sched_out().
++ */
++ task = ctx->task;
++ /*
++ * Reload the task pointer, it might have been changed by
++ * a concurrent perf_event_context_sched_out().
++ */
++ task = ctx->task;
+ goto retry;
+ }
+
+@@ -3350,6 +3361,25 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ return 0;
+ }
+
++#ifdef CONFIG_COMPAT
++static long perf_compat_ioctl(struct file *file, unsigned int cmd,
++ unsigned long arg)
++{
++ switch (_IOC_NR(cmd)) {
++ case _IOC_NR(PERF_EVENT_IOC_SET_FILTER):
++ /* Fix up pointer size (usually 4 -> 8 in 32-on-64-bit case */
++ if (_IOC_SIZE(cmd) == sizeof(compat_uptr_t)) {
++ cmd &= ~IOCSIZE_MASK;
++ cmd |= sizeof(void *) << IOCSIZE_SHIFT;
++ }
++ break;
++ }
++ return perf_ioctl(file, cmd, arg);
++}
++#else
++# define perf_compat_ioctl NULL
++#endif
++
+ int perf_event_task_enable(void)
+ {
+ struct perf_event *event;
+@@ -3821,7 +3851,7 @@ static const struct file_operations perf_fops = {
+ .read = perf_read,
+ .poll = perf_poll,
+ .unlocked_ioctl = perf_ioctl,
+- .compat_ioctl = perf_ioctl,
++ .compat_ioctl = perf_compat_ioctl,
+ .mmap = perf_mmap,
+ .fasync = perf_fasync,
+ };
+@@ -7117,8 +7147,10 @@ int perf_event_init_task(struct task_struct *child)
+
+ for_each_task_context_nr(ctxn) {
+ ret = perf_event_init_context(child, ctxn);
+- if (ret)
++ if (ret) {
++ perf_event_free_task(child);
+ return ret;
++ }
+ }
+
+ return 0;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 621c547dabb1..878dcb2eec55 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1285,7 +1285,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+ goto bad_fork_cleanup_policy;
+ retval = audit_alloc(p);
+ if (retval)
+- goto bad_fork_cleanup_policy;
++ goto bad_fork_cleanup_perf;
+ /* copy all the process information */
+ retval = copy_semundo(clone_flags, p);
+ if (retval)
+@@ -1480,8 +1480,9 @@ bad_fork_cleanup_semundo:
+ exit_sem(p);
+ bad_fork_cleanup_audit:
+ audit_free(p);
+-bad_fork_cleanup_policy:
++bad_fork_cleanup_perf:
+ perf_event_free_task(p);
++bad_fork_cleanup_policy:
+ #ifdef CONFIG_NUMA
+ mpol_put(p->mempolicy);
+ bad_fork_cleanup_cgroup:
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 9396b7b853f7..41dfb1866f95 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2460,6 +2460,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ * shared futexes. We need to compare the keys:
+ */
+ if (match_futex(&q.key, &key2)) {
++ queue_unlock(&q, hb);
+ ret = -EINVAL;
+ goto out_put_keys;
+ }
+diff --git a/kernel/time.c b/kernel/time.c
+index ba744cf80696..a09529030093 100644
+--- a/kernel/time.c
++++ b/kernel/time.c
+@@ -487,17 +487,20 @@ EXPORT_SYMBOL(usecs_to_jiffies);
+ * that a remainder subtract here would not do the right thing as the
+ * resolution values don't fall on second boundries. I.e. the line:
+ * nsec -= nsec % TICK_NSEC; is NOT a correct resolution rounding.
++ * Note that due to the small error in the multiplier here, this
++ * rounding is incorrect for sufficiently large values of tv_nsec, but
++ * well formed timespecs should have tv_nsec < NSEC_PER_SEC, so we're
++ * OK.
+ *
+ * Rather, we just shift the bits off the right.
+ *
+ * The >> (NSEC_JIFFIE_SC - SEC_JIFFIE_SC) converts the scaled nsec
+ * value to a scaled second value.
+ */
+-unsigned long
+-timespec_to_jiffies(const struct timespec *value)
++static unsigned long
++__timespec_to_jiffies(unsigned long sec, long nsec)
+ {
+- unsigned long sec = value->tv_sec;
+- long nsec = value->tv_nsec + TICK_NSEC - 1;
++ nsec = nsec + TICK_NSEC - 1;
+
+ if (sec >= MAX_SEC_IN_JIFFIES){
+ sec = MAX_SEC_IN_JIFFIES;
+@@ -508,6 +511,13 @@ timespec_to_jiffies(const struct timespec *value)
+ (NSEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
+
+ }
++
++unsigned long
++timespec_to_jiffies(const struct timespec *value)
++{
++ return __timespec_to_jiffies(value->tv_sec, value->tv_nsec);
++}
++
+ EXPORT_SYMBOL(timespec_to_jiffies);
+
+ void
+@@ -524,31 +534,27 @@ jiffies_to_timespec(const unsigned long jiffies, struct timespec *value)
+ }
+ EXPORT_SYMBOL(jiffies_to_timespec);
+
+-/* Same for "timeval"
++/*
++ * We could use a similar algorithm to timespec_to_jiffies (with a
++ * different multiplier for usec instead of nsec). But this has a
++ * problem with rounding: we can't exactly add TICK_NSEC - 1 to the
++ * usec value, since it's not necessarily integral.
+ *
+- * Well, almost. The problem here is that the real system resolution is
+- * in nanoseconds and the value being converted is in micro seconds.
+- * Also for some machines (those that use HZ = 1024, in-particular),
+- * there is a LARGE error in the tick size in microseconds.
+-
+- * The solution we use is to do the rounding AFTER we convert the
+- * microsecond part. Thus the USEC_ROUND, the bits to be shifted off.
+- * Instruction wise, this should cost only an additional add with carry
+- * instruction above the way it was done above.
++ * We could instead round in the intermediate scaled representation
++ * (i.e. in units of 1/2^(large scale) jiffies) but that's also
++ * perilous: the scaling introduces a small positive error, which
++ * combined with a division-rounding-upward (i.e. adding 2^(scale) - 1
++ * units to the intermediate before shifting) leads to accidental
++ * overflow and overestimates.
++ *
++ * At the cost of one additional multiplication by a constant, just
++ * use the timespec implementation.
+ */
+ unsigned long
+ timeval_to_jiffies(const struct timeval *value)
+ {
+- unsigned long sec = value->tv_sec;
+- long usec = value->tv_usec;
+-
+- if (sec >= MAX_SEC_IN_JIFFIES){
+- sec = MAX_SEC_IN_JIFFIES;
+- usec = 0;
+- }
+- return (((u64)sec * SEC_CONVERSION) +
+- (((u64)usec * USEC_CONVERSION + USEC_ROUND) >>
+- (USEC_JIFFIE_SC - SEC_JIFFIE_SC))) >> SEC_JIFFIE_SC;
++ return __timespec_to_jiffies(value->tv_sec,
++ value->tv_usec * NSEC_PER_USEC);
+ }
+ EXPORT_SYMBOL(timeval_to_jiffies);
+
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index b7045793bd56..3ce926242698 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -232,6 +232,12 @@ static enum hrtimer_restart alarmtimer_fired(struct hrtimer *timer)
+
+ }
+
++ktime_t alarm_expires_remaining(const struct alarm *alarm)
++{
++ struct alarm_base *base = &alarm_bases[alarm->type];
++ return ktime_sub(alarm->node.expires, base->gettime());
++}
++
+ #ifdef CONFIG_RTC_CLASS
+ /**
+ * alarmtimer_suspend - Suspend time callback
+@@ -448,18 +454,26 @@ static enum alarmtimer_type clock2alarm(clockid_t clockid)
+ static enum alarmtimer_restart alarm_handle_timer(struct alarm *alarm,
+ ktime_t now)
+ {
++ unsigned long flags;
+ struct k_itimer *ptr = container_of(alarm, struct k_itimer,
+ it.alarm.alarmtimer);
+- if (posix_timer_event(ptr, 0) != 0)
+- ptr->it_overrun++;
++ enum alarmtimer_restart result = ALARMTIMER_NORESTART;
++
++ spin_lock_irqsave(&ptr->it_lock, flags);
++ if ((ptr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) {
++ if (posix_timer_event(ptr, 0) != 0)
++ ptr->it_overrun++;
++ }
+
+ /* Re-add periodic timers */
+ if (ptr->it.alarm.interval.tv64) {
+ ptr->it_overrun += alarm_forward(alarm, now,
+ ptr->it.alarm.interval);
+- return ALARMTIMER_RESTART;
++ result = ALARMTIMER_RESTART;
+ }
+- return ALARMTIMER_NORESTART;
++ spin_unlock_irqrestore(&ptr->it_lock, flags);
++
++ return result;
+ }
+
+ /**
+@@ -525,18 +539,22 @@ static int alarm_timer_create(struct k_itimer *new_timer)
+ * @new_timer: k_itimer pointer
+ * @cur_setting: itimerspec data to fill
+ *
+- * Copies the itimerspec data out from the k_itimer
++ * Copies out the current itimerspec data
+ */
+ static void alarm_timer_get(struct k_itimer *timr,
+ struct itimerspec *cur_setting)
+ {
+- memset(cur_setting, 0, sizeof(struct itimerspec));
++ ktime_t relative_expiry_time =
++ alarm_expires_remaining(&(timr->it.alarm.alarmtimer));
++
++ if (ktime_to_ns(relative_expiry_time) > 0) {
++ cur_setting->it_value = ktime_to_timespec(relative_expiry_time);
++ } else {
++ cur_setting->it_value.tv_sec = 0;
++ cur_setting->it_value.tv_nsec = 0;
++ }
+
+- cur_setting->it_interval =
+- ktime_to_timespec(timr->it.alarm.interval);
+- cur_setting->it_value =
+- ktime_to_timespec(timr->it.alarm.alarmtimer.node.expires);
+- return;
++ cur_setting->it_interval = ktime_to_timespec(timr->it.alarm.interval);
+ }
+
+ /**
+diff --git a/mm/migrate.c b/mm/migrate.c
+index 5f588b1f2f6d..98b998ffa3af 100644
+--- a/mm/migrate.c
++++ b/mm/migrate.c
+@@ -139,8 +139,11 @@ static int remove_migration_pte(struct page *new, struct vm_area_struct *vma,
+
+ get_page(new);
+ pte = pte_mkold(mk_pte(new, vma->vm_page_prot));
++
++ /* Recheck VMA as permissions can change since migration started */
+ if (is_write_migration_entry(entry))
+- pte = pte_mkwrite(pte);
++ pte = maybe_mkwrite(pte, vma);
++
+ #ifdef CONFIG_HUGETLB_PAGE
+ if (PageHuge(new))
+ pte = pte_mkhuge(pte);
+diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c
+index 405d331804c3..6f3db3707024 100644
+--- a/mm/percpu-vm.c
++++ b/mm/percpu-vm.c
+@@ -108,7 +108,7 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+ int page_start, int page_end)
+ {
+ const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD;
+- unsigned int cpu;
++ unsigned int cpu, tcpu;
+ int i;
+
+ for_each_possible_cpu(cpu) {
+@@ -116,14 +116,23 @@ static int pcpu_alloc_pages(struct pcpu_chunk *chunk,
+ struct page **pagep = &pages[pcpu_page_idx(cpu, i)];
+
+ *pagep = alloc_pages_node(cpu_to_node(cpu), gfp, 0);
+- if (!*pagep) {
+- pcpu_free_pages(chunk, pages, populated,
+- page_start, page_end);
+- return -ENOMEM;
+- }
++ if (!*pagep)
++ goto err;
+ }
+ }
+ return 0;
++
++err:
++ while (--i >= page_start)
++ __free_page(pages[pcpu_page_idx(cpu, i)]);
++
++ for_each_possible_cpu(tcpu) {
++ if (tcpu == cpu)
++ break;
++ for (i = page_start; i < page_end; i++)
++ __free_page(pages[pcpu_page_idx(tcpu, i)]);
++ }
++ return -ENOMEM;
+ }
+
+ /**
+@@ -263,6 +272,7 @@ err:
+ __pcpu_unmap_pages(pcpu_chunk_addr(chunk, tcpu, page_start),
+ page_end - page_start);
+ }
++ pcpu_post_unmap_tlb_flush(chunk, page_start, page_end);
+ return err;
+ }
+
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 13b2eefabfdd..5f6042b61ca8 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -1907,6 +1907,8 @@ void __init setup_per_cpu_areas(void)
+
+ if (pcpu_setup_first_chunk(ai, fc) < 0)
+ panic("Failed to initialize percpu areas.");
++
++ pcpu_free_alloc_info(ai);
+ }
+
+ #endif /* CONFIG_SMP */
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 4bb5a80dd13b..0b77082409f4 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1725,8 +1725,10 @@ static int shmem_rename(struct inode *old_dir, struct dentry *old_dentry, struct
+
+ if (new_dentry->d_inode) {
+ (void) shmem_unlink(new_dir, new_dentry);
+- if (they_are_dirs)
++ if (they_are_dirs) {
++ drop_nlink(new_dentry->d_inode);
+ drop_nlink(old_dir);
++ }
+ } else if (they_are_dirs) {
+ drop_nlink(old_dir);
+ inc_nlink(new_dir);
+diff --git a/mm/slab.c b/mm/slab.c
+index 3eb1c38e2c30..3714dd9c5877 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3321,7 +3321,7 @@ static inline void *____cache_alloc(struct kmem_cache *cachep, gfp_t flags)
+
+ #ifdef CONFIG_NUMA
+ /*
+- * Try allocating on another node if PF_SPREAD_SLAB|PF_MEMPOLICY.
++ * Try allocating on another node if PFA_SPREAD_SLAB|PF_MEMPOLICY.
+ *
+ * If we are in_interrupt, then process context, including cpusets and
+ * mempolicy, may not apply and should not be used for allocation policy.
+@@ -3562,7 +3562,7 @@ __do_cache_alloc(struct kmem_cache *cache, gfp_t flags)
+ {
+ void *objp;
+
+- if (unlikely(current->flags & (PF_SPREAD_SLAB | PF_MEMPOLICY))) {
++ if (unlikely((current->flags & PF_MEMPOLICY) || cpuset_do_slab_mem_spread())) {
+ objp = alternate_node_alloc(cache, flags);
+ if (objp)
+ goto out;
+diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
+index 96238ba95f2b..de6662b14e1f 100644
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -13,8 +13,6 @@
+ #include "auth_x.h"
+ #include "auth_x_protocol.h"
+
+-#define TEMP_TICKET_BUF_LEN 256
+-
+ static void ceph_x_validate_tickets(struct ceph_auth_client *ac, int *pneed);
+
+ static int ceph_x_is_authenticated(struct ceph_auth_client *ac)
+@@ -64,7 +62,7 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret,
+ }
+
+ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+- void **p, void *end, void *obuf, size_t olen)
++ void **p, void *end, void **obuf, size_t olen)
+ {
+ struct ceph_x_encrypt_header head;
+ size_t head_len = sizeof(head);
+@@ -75,8 +73,14 @@ static int ceph_x_decrypt(struct ceph_crypto_key *secret,
+ return -EINVAL;
+
+ dout("ceph_x_decrypt len %d\n", len);
+- ret = ceph_decrypt2(secret, &head, &head_len, obuf, &olen,
+- *p, len);
++ if (*obuf == NULL) {
++ *obuf = kmalloc(len, GFP_NOFS);
++ if (!*obuf)
++ return -ENOMEM;
++ olen = len;
++ }
++
++ ret = ceph_decrypt2(secret, &head, &head_len, *obuf, &olen, *p, len);
+ if (ret)
+ return ret;
+ if (head.struct_v != 1 || le64_to_cpu(head.magic) != CEPHX_ENC_MAGIC)
+@@ -129,139 +133,120 @@ static void remove_ticket_handler(struct ceph_auth_client *ac,
+ kfree(th);
+ }
+
+-static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
+- struct ceph_crypto_key *secret,
+- void *buf, void *end)
++static int process_one_ticket(struct ceph_auth_client *ac,
++ struct ceph_crypto_key *secret,
++ void **p, void *end)
+ {
+ struct ceph_x_info *xi = ac->private;
+- int num;
+- void *p = buf;
++ int type;
++ u8 tkt_struct_v, blob_struct_v;
++ struct ceph_x_ticket_handler *th;
++ void *dbuf = NULL;
++ void *dp, *dend;
++ int dlen;
++ char is_enc;
++ struct timespec validity;
++ struct ceph_crypto_key old_key;
++ void *ticket_buf = NULL;
++ void *tp, *tpend;
++ struct ceph_timespec new_validity;
++ struct ceph_crypto_key new_session_key;
++ struct ceph_buffer *new_ticket_blob;
++ unsigned long new_expires, new_renew_after;
++ u64 new_secret_id;
+ int ret;
+- char *dbuf;
+- char *ticket_buf;
+- u8 reply_struct_v;
+
+- dbuf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+- if (!dbuf)
+- return -ENOMEM;
++ ceph_decode_need(p, end, sizeof(u32) + 1, bad);
+
+- ret = -ENOMEM;
+- ticket_buf = kmalloc(TEMP_TICKET_BUF_LEN, GFP_NOFS);
+- if (!ticket_buf)
+- goto out_dbuf;
++ type = ceph_decode_32(p);
++ dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+
+- ceph_decode_need(&p, end, 1 + sizeof(u32), bad);
+- reply_struct_v = ceph_decode_8(&p);
+- if (reply_struct_v != 1)
++ tkt_struct_v = ceph_decode_8(p);
++ if (tkt_struct_v != 1)
+ goto bad;
+- num = ceph_decode_32(&p);
+- dout("%d tickets\n", num);
+- while (num--) {
+- int type;
+- u8 tkt_struct_v, blob_struct_v;
+- struct ceph_x_ticket_handler *th;
+- void *dp, *dend;
+- int dlen;
+- char is_enc;
+- struct timespec validity;
+- struct ceph_crypto_key old_key;
+- void *tp, *tpend;
+- struct ceph_timespec new_validity;
+- struct ceph_crypto_key new_session_key;
+- struct ceph_buffer *new_ticket_blob;
+- unsigned long new_expires, new_renew_after;
+- u64 new_secret_id;
+-
+- ceph_decode_need(&p, end, sizeof(u32) + 1, bad);
+-
+- type = ceph_decode_32(&p);
+- dout(" ticket type %d %s\n", type, ceph_entity_type_name(type));
+-
+- tkt_struct_v = ceph_decode_8(&p);
+- if (tkt_struct_v != 1)
+- goto bad;
+-
+- th = get_ticket_handler(ac, type);
+- if (IS_ERR(th)) {
+- ret = PTR_ERR(th);
+- goto out;
+- }
+
+- /* blob for me */
+- dlen = ceph_x_decrypt(secret, &p, end, dbuf,
+- TEMP_TICKET_BUF_LEN);
+- if (dlen <= 0) {
+- ret = dlen;
+- goto out;
+- }
+- dout(" decrypted %d bytes\n", dlen);
+- dend = dbuf + dlen;
+- dp = dbuf;
++ th = get_ticket_handler(ac, type);
++ if (IS_ERR(th)) {
++ ret = PTR_ERR(th);
++ goto out;
++ }
+
+- tkt_struct_v = ceph_decode_8(&dp);
+- if (tkt_struct_v != 1)
+- goto bad;
++ /* blob for me */
++ dlen = ceph_x_decrypt(secret, p, end, &dbuf, 0);
++ if (dlen <= 0) {
++ ret = dlen;
++ goto out;
++ }
++ dout(" decrypted %d bytes\n", dlen);
++ dp = dbuf;
++ dend = dp + dlen;
+
+- memcpy(&old_key, &th->session_key, sizeof(old_key));
+- ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
+- if (ret)
+- goto out;
++ tkt_struct_v = ceph_decode_8(&dp);
++ if (tkt_struct_v != 1)
++ goto bad;
+
+- ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
+- ceph_decode_timespec(&validity, &new_validity);
+- new_expires = get_seconds() + validity.tv_sec;
+- new_renew_after = new_expires - (validity.tv_sec / 4);
+- dout(" expires=%lu renew_after=%lu\n", new_expires,
+- new_renew_after);
++ memcpy(&old_key, &th->session_key, sizeof(old_key));
++ ret = ceph_crypto_key_decode(&new_session_key, &dp, dend);
++ if (ret)
++ goto out;
+
+- /* ticket blob for service */
+- ceph_decode_8_safe(&p, end, is_enc, bad);
+- tp = ticket_buf;
+- if (is_enc) {
+- /* encrypted */
+- dout(" encrypted ticket\n");
+- dlen = ceph_x_decrypt(&old_key, &p, end, ticket_buf,
+- TEMP_TICKET_BUF_LEN);
+- if (dlen < 0) {
+- ret = dlen;
+- goto out;
+- }
+- dlen = ceph_decode_32(&tp);
+- } else {
+- /* unencrypted */
+- ceph_decode_32_safe(&p, end, dlen, bad);
+- ceph_decode_need(&p, end, dlen, bad);
+- ceph_decode_copy(&p, ticket_buf, dlen);
++ ceph_decode_copy(&dp, &new_validity, sizeof(new_validity));
++ ceph_decode_timespec(&validity, &new_validity);
++ new_expires = get_seconds() + validity.tv_sec;
++ new_renew_after = new_expires - (validity.tv_sec / 4);
++ dout(" expires=%lu renew_after=%lu\n", new_expires,
++ new_renew_after);
++
++ /* ticket blob for service */
++ ceph_decode_8_safe(p, end, is_enc, bad);
++ if (is_enc) {
++ /* encrypted */
++ dout(" encrypted ticket\n");
++ dlen = ceph_x_decrypt(&old_key, p, end, &ticket_buf, 0);
++ if (dlen < 0) {
++ ret = dlen;
++ goto out;
+ }
+- tpend = tp + dlen;
+- dout(" ticket blob is %d bytes\n", dlen);
+- ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
+- blob_struct_v = ceph_decode_8(&tp);
+- new_secret_id = ceph_decode_64(&tp);
+- ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
+- if (ret)
++ tp = ticket_buf;
++ dlen = ceph_decode_32(&tp);
++ } else {
++ /* unencrypted */
++ ceph_decode_32_safe(p, end, dlen, bad);
++ ticket_buf = kmalloc(dlen, GFP_NOFS);
++ if (!ticket_buf) {
++ ret = -ENOMEM;
+ goto out;
+-
+- /* all is well, update our ticket */
+- ceph_crypto_key_destroy(&th->session_key);
+- if (th->ticket_blob)
+- ceph_buffer_put(th->ticket_blob);
+- th->session_key = new_session_key;
+- th->ticket_blob = new_ticket_blob;
+- th->validity = new_validity;
+- th->secret_id = new_secret_id;
+- th->expires = new_expires;
+- th->renew_after = new_renew_after;
+- dout(" got ticket service %d (%s) secret_id %lld len %d\n",
+- type, ceph_entity_type_name(type), th->secret_id,
+- (int)th->ticket_blob->vec.iov_len);
+- xi->have_keys |= th->service;
++ }
++ tp = ticket_buf;
++ ceph_decode_need(p, end, dlen, bad);
++ ceph_decode_copy(p, ticket_buf, dlen);
+ }
++ tpend = tp + dlen;
++ dout(" ticket blob is %d bytes\n", dlen);
++ ceph_decode_need(&tp, tpend, 1 + sizeof(u64), bad);
++ blob_struct_v = ceph_decode_8(&tp);
++ new_secret_id = ceph_decode_64(&tp);
++ ret = ceph_decode_buffer(&new_ticket_blob, &tp, tpend);
++ if (ret)
++ goto out;
++
++ /* all is well, update our ticket */
++ ceph_crypto_key_destroy(&th->session_key);
++ if (th->ticket_blob)
++ ceph_buffer_put(th->ticket_blob);
++ th->session_key = new_session_key;
++ th->ticket_blob = new_ticket_blob;
++ th->validity = new_validity;
++ th->secret_id = new_secret_id;
++ th->expires = new_expires;
++ th->renew_after = new_renew_after;
++ dout(" got ticket service %d (%s) secret_id %lld len %d\n",
++ type, ceph_entity_type_name(type), th->secret_id,
++ (int)th->ticket_blob->vec.iov_len);
++ xi->have_keys |= th->service;
+
+- ret = 0;
+ out:
+ kfree(ticket_buf);
+-out_dbuf:
+ kfree(dbuf);
+ return ret;
+
+@@ -270,6 +255,34 @@ bad:
+ goto out;
+ }
+
++static int ceph_x_proc_ticket_reply(struct ceph_auth_client *ac,
++ struct ceph_crypto_key *secret,
++ void *buf, void *end)
++{
++ void *p = buf;
++ u8 reply_struct_v;
++ u32 num;
++ int ret;
++
++ ceph_decode_8_safe(&p, end, reply_struct_v, bad);
++ if (reply_struct_v != 1)
++ return -EINVAL;
++
++ ceph_decode_32_safe(&p, end, num, bad);
++ dout("%d tickets\n", num);
++
++ while (num--) {
++ ret = process_one_ticket(ac, secret, &p, end);
++ if (ret)
++ return ret;
++ }
++
++ return 0;
++
++bad:
++ return -EINVAL;
++}
++
+ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+ struct ceph_x_ticket_handler *th,
+ struct ceph_x_authorizer *au)
+@@ -583,13 +596,14 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+ struct ceph_x_ticket_handler *th;
+ int ret = 0;
+ struct ceph_x_authorize_reply reply;
++ void *preply = &reply;
+ void *p = au->reply_buf;
+ void *end = p + sizeof(au->reply_buf);
+
+ th = get_ticket_handler(ac, au->service);
+ if (IS_ERR(th))
+ return PTR_ERR(th);
+- ret = ceph_x_decrypt(&th->session_key, &p, end, &reply, sizeof(reply));
++ ret = ceph_x_decrypt(&th->session_key, &p, end, &preply, sizeof(reply));
+ if (ret < 0)
+ return ret;
+ if (ret != sizeof(reply))
+diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
+index 6765da36f78f..bc293c087de6 100644
+--- a/net/ceph/mon_client.c
++++ b/net/ceph/mon_client.c
+@@ -1042,7 +1042,15 @@ static struct ceph_msg *mon_alloc_msg(struct ceph_connection *con,
+ if (!m) {
+ pr_info("alloc_msg unknown type %d\n", type);
+ *skip = 1;
++ } else if (front_len > m->front_max) {
++ pr_warning("mon_alloc_msg front %d > prealloc %d (%u#%llu)\n",
++ front_len, m->front_max,
++ (unsigned int)con->peer_name.type,
++ le64_to_cpu(con->peer_name.num));
++ ceph_msg_put(m);
++ m = ceph_msg_new(type, front_len, GFP_NOFS, false);
+ }
++
+ return m;
+ }
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index b47375d9d956..0770364832a1 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -5546,13 +5546,8 @@ int register_netdevice(struct net_device *dev)
+ dev->features |= NETIF_F_SOFT_FEATURES;
+ dev->wanted_features = dev->features & dev->hw_features;
+
+- /* Turn on no cache copy if HW is doing checksum */
+ if (!(dev->flags & IFF_LOOPBACK)) {
+ dev->hw_features |= NETIF_F_NOCACHE_COPY;
+- if (dev->features & NETIF_F_ALL_CSUM) {
+- dev->wanted_features |= NETIF_F_NOCACHE_COPY;
+- dev->features |= NETIF_F_NOCACHE_COPY;
+- }
+ }
+
+ /* Make NETIF_F_HIGHDMA inheritable to VLAN devices.
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index fd6843371f2e..6c34bc98bce7 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -150,6 +150,9 @@ static void ipv4_link_failure(struct sk_buff *skb);
+ static void ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
+ static int rt_garbage_collect(struct dst_ops *ops);
+
++static void __rt_garbage_collect(struct work_struct *w);
++static DECLARE_WORK(rt_gc_worker, __rt_garbage_collect);
++
+ static void ipv4_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+ int how)
+ {
+@@ -977,12 +980,13 @@ static void rt_emergency_hash_rebuild(struct net *net)
+ and when load increases it reduces to limit cache size.
+ */
+
+-static int rt_garbage_collect(struct dst_ops *ops)
++static void __do_rt_garbage_collect(int elasticity, int min_interval)
+ {
+ static unsigned long expire = RT_GC_TIMEOUT;
+ static unsigned long last_gc;
+ static int rover;
+ static int equilibrium;
++ static DEFINE_SPINLOCK(rt_gc_lock);
+ struct rtable *rth;
+ struct rtable __rcu **rthp;
+ unsigned long now = jiffies;
+@@ -994,9 +998,11 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ * do not make it too frequently.
+ */
+
++ spin_lock_bh(&rt_gc_lock);
++
+ RT_CACHE_STAT_INC(gc_total);
+
+- if (now - last_gc < ip_rt_gc_min_interval &&
++ if (now - last_gc < min_interval &&
+ entries < ip_rt_max_size) {
+ RT_CACHE_STAT_INC(gc_ignored);
+ goto out;
+@@ -1004,7 +1010,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
+
+ entries = dst_entries_get_slow(&ipv4_dst_ops);
+ /* Calculate number of entries, which we want to expire now. */
+- goal = entries - (ip_rt_gc_elasticity << rt_hash_log);
++ goal = entries - (elasticity << rt_hash_log);
+ if (goal <= 0) {
+ if (equilibrium < ipv4_dst_ops.gc_thresh)
+ equilibrium = ipv4_dst_ops.gc_thresh;
+@@ -1021,7 +1027,7 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ equilibrium = entries - goal;
+ }
+
+- if (now - last_gc >= ip_rt_gc_min_interval)
++ if (now - last_gc >= min_interval)
+ last_gc = now;
+
+ if (goal <= 0) {
+@@ -1086,15 +1092,34 @@ static int rt_garbage_collect(struct dst_ops *ops)
+ if (net_ratelimit())
+ pr_warn("dst cache overflow\n");
+ RT_CACHE_STAT_INC(gc_dst_overflow);
+- return 1;
++ goto out;
+
+ work_done:
+- expire += ip_rt_gc_min_interval;
++ expire += min_interval;
+ if (expire > ip_rt_gc_timeout ||
+ dst_entries_get_fast(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh ||
+ dst_entries_get_slow(&ipv4_dst_ops) < ipv4_dst_ops.gc_thresh)
+ expire = ip_rt_gc_timeout;
+-out: return 0;
++out:
++ spin_unlock_bh(&rt_gc_lock);
++}
++
++static void __rt_garbage_collect(struct work_struct *w)
++{
++ __do_rt_garbage_collect(ip_rt_gc_elasticity, ip_rt_gc_min_interval);
++}
++
++static int rt_garbage_collect(struct dst_ops *ops)
++{
++ if (!work_pending(&rt_gc_worker))
++ schedule_work(&rt_gc_worker);
++
++ if (dst_entries_get_fast(&ipv4_dst_ops) >= ip_rt_max_size ||
++ dst_entries_get_slow(&ipv4_dst_ops) >= ip_rt_max_size) {
++ RT_CACHE_STAT_INC(gc_dst_overflow);
++ return 1;
++ }
++ return 0;
+ }
+
+ /*
+@@ -1151,7 +1176,7 @@ static struct rtable *rt_intern_hash(unsigned hash, struct rtable *rt,
+ unsigned long now;
+ u32 min_score;
+ int chain_length;
+- int attempts = !in_softirq();
++ int attempts = 1;
+
+ restart:
+ chain_length = 0;
+@@ -1287,14 +1312,15 @@ restart:
+ can be released. Try to shrink route cache,
+ it is most likely it holds some neighbour records.
+ */
+- if (attempts-- > 0) {
+- int saved_elasticity = ip_rt_gc_elasticity;
+- int saved_int = ip_rt_gc_min_interval;
+- ip_rt_gc_elasticity = 1;
+- ip_rt_gc_min_interval = 0;
+- rt_garbage_collect(&ipv4_dst_ops);
+- ip_rt_gc_min_interval = saved_int;
+- ip_rt_gc_elasticity = saved_elasticity;
++ if (!in_softirq() && attempts-- > 0) {
++ static DEFINE_SPINLOCK(lock);
++
++ if (spin_trylock(&lock)) {
++ __do_rt_garbage_collect(1, 0);
++ spin_unlock(&lock);
++ } else {
++ spin_unlock_wait(&lock);
++ }
+ goto restart;
+ }
+
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 98fd7384c446..ef9052f8c90b 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1366,7 +1366,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
+ fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
+ fptr->nexthdr = nexthdr;
+ fptr->reserved = 0;
+- ipv6_select_ident(fptr, (struct rt6_info *)skb_dst(skb));
++ fptr->identification = skb_shinfo(skb)->ip6_frag_id;
+
+ /* Fragment the skb. ipv6 header and the remaining fields of the
+ * fragment header are updated in ipv6_gso_segment()
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 82ed7dfb7b80..cf7821b7c0ca 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -774,7 +774,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ /* If PMTU discovery was enabled, use the MTU that was discovered */
+ dst = sk_dst_get(tunnel->sock);
+ if (dst != NULL) {
+- u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
++ u32 pmtu = dst_mtu(dst);
++
+ if (pmtu != 0)
+ session->mtu = session->mru = pmtu -
+ PPPOL2TP_HEADER_OVERHEAD;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index add9f94cd733..52646f9ecc80 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -5059,6 +5059,9 @@ int cfg80211_testmode_reply(struct sk_buff *skb)
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
++ /* clear CB data for netlink core to own from now on */
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ if (WARN_ON(!rdev->testmode_info)) {
+ kfree_skb(skb);
+ return -EINVAL;
+@@ -5085,6 +5088,9 @@ void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
++ /* clear CB data for netlink core to own from now on */
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+ genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
+diff --git a/scripts/tags.sh b/scripts/tags.sh
+index cf7b12fee573..246e4f6bc2ad 100755
+--- a/scripts/tags.sh
++++ b/scripts/tags.sh
+@@ -153,7 +153,10 @@ exuberant()
+ --regex-c++='/CLEARPAGEFLAG_NOOP\(([^,)]*).*/ClearPage\1/' \
+ --regex-c++='/__CLEARPAGEFLAG_NOOP\(([^,)]*).*/__ClearPage\1/' \
+ --regex-c++='/TESTCLEARFLAG_FALSE\(([^,)]*).*/TestClearPage\1/' \
+- --regex-c++='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/'
++ --regex-c++='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/'\
++ --regex-c++='/TASK_PFA_TEST\([^,]*,\s*([^)]*)\)/task_\1/' \
++ --regex-c++='/TASK_PFA_SET\([^,]*,\s*([^)]*)\)/task_set_\1/' \
++ --regex-c++='/TASK_PFA_CLEAR\([^,]*,\s*([^)]*)\)/task_clear_\1/'
+
+ all_kconfigs | xargs $1 -a \
+ --langdef=kconfig --language-force=kconfig \
+@@ -195,7 +198,10 @@ emacs()
+ --regex='/CLEARPAGEFLAG_NOOP\(([^,)]*).*/ClearPage\1/' \
+ --regex='/__CLEARPAGEFLAG_NOOP\(([^,)]*).*/__ClearPage\1/' \
+ --regex='/TESTCLEARFLAG_FALSE\(([^,)]*).*/TestClearPage\1/' \
+- --regex='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/'
++ --regex='/__TESTCLEARFLAG_FALSE\(([^,)]*).*/__TestClearPage\1/'\
++ --regex='/TASK_PFA_TEST\([^,]*,\s*([^)]*)\)/task_\1/' \
++ --regex='/TASK_PFA_SET\([^,]*,\s*([^)]*)\)/task_set_\1/' \
++ --regex='/TASK_PFA_CLEAR\([^,]*,\s*([^)]*)\)/task_clear_\1/'
+
+ all_kconfigs | xargs $1 -a \
+ --regex='/^[ \t]*\(\(menu\)*config\)[ \t]+\([a-zA-Z0-9_]+\)/\3/'
+diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
+index 370fc56d2de7..629257585501 100644
+--- a/sound/core/pcm_lib.c
++++ b/sound/core/pcm_lib.c
+@@ -1693,14 +1693,16 @@ static int snd_pcm_lib_ioctl_fifo_size(struct snd_pcm_substream *substream,
+ {
+ struct snd_pcm_hw_params *params = arg;
+ snd_pcm_format_t format;
+- int channels, width;
++ int channels;
++ ssize_t frame_size;
+
+ params->fifo_size = substream->runtime->hw.fifo_size;
+ if (!(substream->runtime->hw.info & SNDRV_PCM_INFO_FIFO_IN_FRAMES)) {
+ format = params_format(params);
+ channels = params_channels(params);
+- width = snd_pcm_format_physical_width(format);
+- params->fifo_size /= width * channels;
++ frame_size = snd_pcm_format_size(format, channels);
++ if (frame_size > 0)
++ params->fifo_size /= (unsigned)frame_size;
+ }
+ return 0;
+ }
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 36284b8562f0..9461a004f08b 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -811,6 +811,7 @@ static void alc_auto_init_amp(struct hda_codec *codec, int type)
+ case 0x10ec0885:
+ case 0x10ec0887:
+ /*case 0x10ec0889:*/ /* this causes an SPDIF problem */
++ case 0x10ec0900:
+ alc889_coef_init(codec);
+ break;
+ case 0x10ec0888:
+@@ -5516,6 +5517,7 @@ static int patch_alc882(struct hda_codec *codec)
+ switch (codec->vendor_id) {
+ case 0x10ec0882:
+ case 0x10ec0885:
++ case 0x10ec0900:
+ break;
+ default:
+ /* ALC883 and variants */
+diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c
+index 6ac7b8281a02..9998719cc02f 100644
+--- a/sound/soc/samsung/i2s.c
++++ b/sound/soc/samsung/i2s.c
+@@ -392,7 +392,7 @@ static int i2s_set_sysclk(struct snd_soc_dai *dai,
+ if (dir == SND_SOC_CLOCK_IN)
+ rfs = 0;
+
+- if ((rfs && other->rfs && (other->rfs != rfs)) ||
++ if ((rfs && other && other->rfs && (other->rfs != rfs)) ||
+ (any_active(i2s) &&
+ (((dir == SND_SOC_CLOCK_IN)
+ && !(mod & MOD_CDCLKCON)) ||
+diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
+index c88d9741b9e7..34c1fbb5b20b 100644
+--- a/sound/soc/soc-core.c
++++ b/sound/soc/soc-core.c
+@@ -2799,7 +2799,7 @@ int snd_soc_bytes_put(struct snd_kcontrol *kcontrol,
+ unsigned int val;
+ void *data;
+
+- if (!codec->using_regmap)
++ if (!codec->using_regmap || !params->num_regs)
+ return -EINVAL;
+
+ data = ucontrol->value.bytes.data;
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-09-26 17:59 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-09-26 17:59 UTC (permalink / raw
To: gentoo-commits
commit: f9ca61f33c41fa20a3eb99ce3cae9c589cfd2262
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Sep 26 17:56:49 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Sep 26 17:56:49 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=f9ca61f3
Linux patch 3.4.104
---
0000_README | 4 +
1103_linux-3.4.104.patch | 1740 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1744 insertions(+)
diff --git a/0000_README b/0000_README
index 9f3e940..544ba0b 100644
--- a/0000_README
+++ b/0000_README
@@ -451,6 +451,10 @@ Patch: 1102_linux-3.4.103.patch
From: http://www.kernel.org
Desc: Linux 3.4.103
+Patch: 1103_linux-3.4.104.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.104
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1103_linux-3.4.104.patch b/1103_linux-3.4.104.patch
new file mode 100644
index 0000000..e868d32
--- /dev/null
+++ b/1103_linux-3.4.104.patch
@@ -0,0 +1,1740 @@
+diff --git a/Documentation/stable_kernel_rules.txt b/Documentation/stable_kernel_rules.txt
+index b0714d8f678a..8dfb6a5f427d 100644
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -29,6 +29,9 @@ Rules on what kind of patches are accepted, and which ones are not, into the
+
+ Procedure for submitting patches to the -stable tree:
+
++ - If the patch covers files in net/ or drivers/net please follow netdev stable
++ submission guidelines as described in
++ Documentation/networking/netdev-FAQ.txt
+ - Send the patch, after verifying that it follows the above rules, to
+ stable@vger.kernel.org. You must note the upstream commit ID in the
+ changelog of your submission, as well as the kernel version you wish
+diff --git a/Makefile b/Makefile
+index 36f0913bd1d6..b66396efb001 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 103
++SUBLEVEL = 104
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h
+index 7a3d38d5ed6b..5ebab5895edb 100644
+--- a/arch/alpha/include/asm/io.h
++++ b/arch/alpha/include/asm/io.h
+@@ -489,6 +489,11 @@ extern inline void writeq(u64 b, volatile void __iomem *addr)
+ }
+ #endif
+
++#define ioread16be(p) be16_to_cpu(ioread16(p))
++#define ioread32be(p) be32_to_cpu(ioread32(p))
++#define iowrite16be(v,p) iowrite16(cpu_to_be16(v), (p))
++#define iowrite32be(v,p) iowrite32(cpu_to_be32(v), (p))
++
+ #define inb_p inb
+ #define inw_p inw
+ #define inl_p inl
+diff --git a/arch/alpha/oprofile/common.c b/arch/alpha/oprofile/common.c
+index a0a5d27aa215..b8ce18f485d3 100644
+--- a/arch/alpha/oprofile/common.c
++++ b/arch/alpha/oprofile/common.c
+@@ -12,6 +12,7 @@
+ #include <linux/smp.h>
+ #include <linux/errno.h>
+ #include <asm/ptrace.h>
++#include <asm/special_insns.h>
+
+ #include "op_impl.h"
+
+diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S
+index 9a8531eadd3d..9d95a46b25fd 100644
+--- a/arch/arm/kernel/entry-header.S
++++ b/arch/arm/kernel/entry-header.S
+@@ -76,26 +76,21 @@
+ #ifndef CONFIG_THUMB2_KERNEL
+ .macro svc_exit, rpsr
+ msr spsr_cxsf, \rpsr
+-#if defined(CONFIG_CPU_V6)
+- ldr r0, [sp]
+- strex r1, r2, [sp] @ clear the exclusive monitor
+- ldmib sp, {r1 - pc}^ @ load r1 - pc, cpsr
+-#elif defined(CONFIG_CPU_32v6K)
+- clrex @ clear the exclusive monitor
+- ldmia sp, {r0 - pc}^ @ load r0 - pc, cpsr
+-#else
+- ldmia sp, {r0 - pc}^ @ load r0 - pc, cpsr
++#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
++ @ We must avoid clrex due to Cortex-A15 erratum #830321
++ sub r0, sp, #4 @ uninhabited address
++ strex r1, r2, [r0] @ clear the exclusive monitor
+ #endif
++ ldmia sp, {r0 - pc}^ @ load r0 - pc, cpsr
+ .endm
+
+ .macro restore_user_regs, fast = 0, offset = 0
+ ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr
+ ldr lr, [sp, #\offset + S_PC]! @ get pc
+ msr spsr_cxsf, r1 @ save in spsr_svc
+-#if defined(CONFIG_CPU_V6)
++#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
++ @ We must avoid clrex due to Cortex-A15 erratum #830321
+ strex r1, r2, [sp] @ clear the exclusive monitor
+-#elif defined(CONFIG_CPU_32v6K)
+- clrex @ clear the exclusive monitor
+ #endif
+ .if \fast
+ ldmdb sp, {r1 - lr}^ @ get calling r1 - lr
+@@ -123,7 +118,10 @@
+ .macro svc_exit, rpsr
+ ldr lr, [sp, #S_SP] @ top of the stack
+ ldrd r0, r1, [sp, #S_LR] @ calling lr and pc
+- clrex @ clear the exclusive monitor
++
++ @ We must avoid clrex due to Cortex-A15 erratum #830321
++ strex r2, r1, [sp, #S_LR] @ clear the exclusive monitor
++
+ stmdb lr!, {r0, r1, \rpsr} @ calling lr and rfe context
+ ldmia sp, {r0 - r12}
+ mov sp, lr
+@@ -132,13 +130,16 @@
+ .endm
+
+ .macro restore_user_regs, fast = 0, offset = 0
+- clrex @ clear the exclusive monitor
+ mov r2, sp
+ load_user_sp_lr r2, r3, \offset + S_SP @ calling sp, lr
+ ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr
+ ldr lr, [sp, #\offset + S_PC] @ get pc
+ add sp, sp, #\offset + S_SP
+ msr spsr_cxsf, r1 @ save in spsr_svc
++
++ @ We must avoid clrex due to Cortex-A15 erratum #830321
++ strex r1, r2, [sp] @ clear the exclusive monitor
++
+ .if \fast
+ ldmdb sp, {r1 - r12} @ get calling r1 - r12
+ .else
+diff --git a/arch/arm/mm/abort-ev6.S b/arch/arm/mm/abort-ev6.S
+index 80741992a9fc..5d777a567c35 100644
+--- a/arch/arm/mm/abort-ev6.S
++++ b/arch/arm/mm/abort-ev6.S
+@@ -17,12 +17,6 @@
+ */
+ .align 5
+ ENTRY(v6_early_abort)
+-#ifdef CONFIG_CPU_V6
+- sub r1, sp, #4 @ Get unused stack location
+- strex r0, r1, [r1] @ Clear the exclusive monitor
+-#elif defined(CONFIG_CPU_32v6K)
+- clrex
+-#endif
+ mrc p15, 0, r1, c5, c0, 0 @ get FSR
+ mrc p15, 0, r0, c6, c0, 0 @ get FAR
+ /*
+diff --git a/arch/arm/mm/abort-ev7.S b/arch/arm/mm/abort-ev7.S
+index 703375277ba6..4812ad054214 100644
+--- a/arch/arm/mm/abort-ev7.S
++++ b/arch/arm/mm/abort-ev7.S
+@@ -13,12 +13,6 @@
+ */
+ .align 5
+ ENTRY(v7_early_abort)
+- /*
+- * The effect of data aborts on on the exclusive access monitor are
+- * UNPREDICTABLE. Do a CLREX to clear the state
+- */
+- clrex
+-
+ mrc p15, 0, r1, c5, c0, 0 @ get FSR
+ mrc p15, 0, r0, c6, c0, 0 @ get FAR
+
+diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
+index d3a9f012aa0a..b6fb65030d5e 100644
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -265,6 +265,18 @@ static irqreturn_t octeon_rlm_interrupt(int cpl, void *dev_id)
+ }
+ #endif
+
++static char __read_mostly octeon_system_type[80];
++
++static int __init init_octeon_system_type(void)
++{
++ snprintf(octeon_system_type, sizeof(octeon_system_type), "%s (%s)",
++ cvmx_board_type_to_string(octeon_bootinfo->board_type),
++ octeon_model_get_string(read_c0_prid()));
++
++ return 0;
++}
++early_initcall(init_octeon_system_type);
++
+ /**
+ * Return a string representing the system type
+ *
+@@ -272,11 +284,7 @@ static irqreturn_t octeon_rlm_interrupt(int cpl, void *dev_id)
+ */
+ const char *octeon_board_type_string(void)
+ {
+- static char name[80];
+- sprintf(name, "%s (%s)",
+- cvmx_board_type_to_string(octeon_bootinfo->board_type),
+- octeon_model_get_string(read_c0_prid()));
+- return name;
++ return octeon_system_type;
+ }
+
+ const char *get_system_type(void)
+diff --git a/arch/mips/kernel/perf_event_mipsxx.c b/arch/mips/kernel/perf_event_mipsxx.c
+index 811084f4e422..52f60e548722 100644
+--- a/arch/mips/kernel/perf_event_mipsxx.c
++++ b/arch/mips/kernel/perf_event_mipsxx.c
+@@ -162,11 +162,6 @@ static unsigned int counters_total_to_per_cpu(unsigned int counters)
+ return counters >> vpe_shift();
+ }
+
+-static unsigned int counters_per_cpu_to_total(unsigned int counters)
+-{
+- return counters << vpe_shift();
+-}
+-
+ #else /* !CONFIG_MIPS_MT_SMP */
+ #define vpe_id() 0
+
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index bda8eb26ece7..fdd6042843eb 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -12,6 +12,7 @@
+ #include <linux/highmem.h>
+ #include <linux/kernel.h>
+ #include <linux/linkage.h>
++#include <linux/preempt.h>
+ #include <linux/sched.h>
+ #include <linux/smp.h>
+ #include <linux/mm.h>
+@@ -598,6 +599,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+ /* Catch bad driver code */
+ BUG_ON(size == 0);
+
++ preempt_disable();
+ if (cpu_has_inclusive_pcaches) {
+ if (size >= scache_size)
+ r4k_blast_scache();
+@@ -618,6 +620,7 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
+ R4600_HIT_CACHEOP_WAR_IMPL;
+ blast_dcache_range(addr, addr + size);
+ }
++ preempt_enable();
+
+ bc_wback_inv(addr, size);
+ __sync();
+@@ -628,6 +631,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ /* Catch bad driver code */
+ BUG_ON(size == 0);
+
++ preempt_disable();
+ if (cpu_has_inclusive_pcaches) {
+ if (size >= scache_size)
+ r4k_blast_scache();
+@@ -663,6 +667,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
+ cache_op(Hit_Writeback_Inv_D, (addr + size - 1) & almask);
+ blast_inv_dcache_range(addr, addr + size);
+ }
++ preempt_enable();
+
+ bc_inv(addr, size);
+ __sync();
+diff --git a/arch/openrisc/kernel/head.S b/arch/openrisc/kernel/head.S
+index 1088b5fca3bd..27451968e45c 100644
+--- a/arch/openrisc/kernel/head.S
++++ b/arch/openrisc/kernel/head.S
+@@ -19,6 +19,7 @@
+ #include <linux/threads.h>
+ #include <linux/errno.h>
+ #include <linux/init.h>
++#include <linux/serial_reg.h>
+ #include <asm/processor.h>
+ #include <asm/page.h>
+ #include <asm/mmu.h>
+diff --git a/arch/unicore32/Kconfig b/arch/unicore32/Kconfig
+index eeb8054c7cd8..1f3e9ea1cf90 100644
+--- a/arch/unicore32/Kconfig
++++ b/arch/unicore32/Kconfig
+@@ -6,6 +6,7 @@ config UNICORE32
+ select HAVE_DMA_ATTRS
+ select HAVE_KERNEL_GZIP
+ select HAVE_KERNEL_BZIP2
++ select GENERIC_ATOMIC64
+ select HAVE_KERNEL_LZO
+ select HAVE_KERNEL_LZMA
+ select GENERIC_FIND_FIRST_BIT
+diff --git a/arch/unicore32/include/asm/bug.h b/arch/unicore32/include/asm/bug.h
+index b1ff8cadb086..93a56f3e2344 100644
+--- a/arch/unicore32/include/asm/bug.h
++++ b/arch/unicore32/include/asm/bug.h
+@@ -19,9 +19,4 @@ extern void die(const char *msg, struct pt_regs *regs, int err);
+ extern void uc32_notify_die(const char *str, struct pt_regs *regs,
+ struct siginfo *info, unsigned long err, unsigned long trap);
+
+-extern asmlinkage void __backtrace(void);
+-extern asmlinkage void c_backtrace(unsigned long fp, int pmode);
+-
+-extern void __show_regs(struct pt_regs *);
+-
+ #endif /* __UNICORE_BUG_H__ */
+diff --git a/arch/unicore32/include/asm/cmpxchg.h b/arch/unicore32/include/asm/cmpxchg.h
+index df4d5acfd19f..8e797ad4fa24 100644
+--- a/arch/unicore32/include/asm/cmpxchg.h
++++ b/arch/unicore32/include/asm/cmpxchg.h
+@@ -35,7 +35,7 @@ static inline unsigned long __xchg(unsigned long x, volatile void *ptr,
+ : "memory", "cc");
+ break;
+ default:
+- ret = __xchg_bad_pointer();
++ __xchg_bad_pointer();
+ }
+
+ return ret;
+diff --git a/arch/unicore32/kernel/setup.h b/arch/unicore32/kernel/setup.h
+index f23955028a18..30f749da8f73 100644
+--- a/arch/unicore32/kernel/setup.h
++++ b/arch/unicore32/kernel/setup.h
+@@ -30,4 +30,10 @@ extern char __vectors_start[], __vectors_end[];
+ extern void kernel_thread_helper(void);
+
+ extern void __init early_signal_init(void);
++
++extern asmlinkage void __backtrace(void);
++extern asmlinkage void c_backtrace(unsigned long fp, int pmode);
++
++extern void __show_regs(struct pt_regs *);
++
+ #endif
+diff --git a/arch/xtensa/include/asm/ioctls.h b/arch/xtensa/include/asm/ioctls.h
+index fd1d1369a407..96341aabceb8 100644
+--- a/arch/xtensa/include/asm/ioctls.h
++++ b/arch/xtensa/include/asm/ioctls.h
+@@ -28,17 +28,17 @@
+ #define TCSETSW 0x5403
+ #define TCSETSF 0x5404
+
+-#define TCGETA _IOR('t', 23, struct termio)
+-#define TCSETA _IOW('t', 24, struct termio)
+-#define TCSETAW _IOW('t', 25, struct termio)
+-#define TCSETAF _IOW('t', 28, struct termio)
++#define TCGETA 0x80127417 /* _IOR('t', 23, struct termio) */
++#define TCSETA 0x40127418 /* _IOW('t', 24, struct termio) */
++#define TCSETAW 0x40127419 /* _IOW('t', 25, struct termio) */
++#define TCSETAF 0x4012741C /* _IOW('t', 28, struct termio) */
+
+ #define TCSBRK _IO('t', 29)
+ #define TCXONC _IO('t', 30)
+ #define TCFLSH _IO('t', 31)
+
+-#define TIOCSWINSZ _IOW('t', 103, struct winsize)
+-#define TIOCGWINSZ _IOR('t', 104, struct winsize)
++#define TIOCSWINSZ 0x40087467 /* _IOW('t', 103, struct winsize) */
++#define TIOCGWINSZ 0x80087468 /* _IOR('t', 104, struct winsize) */
+ #define TIOCSTART _IO('t', 110) /* start output, like ^Q */
+ #define TIOCSTOP _IO('t', 111) /* stop output, like ^S */
+ #define TIOCOUTQ _IOR('t', 115, int) /* output queue size */
+@@ -88,7 +88,6 @@
+ #define TIOCSETD _IOW('T', 35, int)
+ #define TIOCGETD _IOR('T', 36, int)
+ #define TCSBRKP _IOW('T', 37, int) /* Needed for POSIX tcsendbreak()*/
+-#define TIOCTTYGSTRUCT _IOR('T', 38, struct tty_struct) /* For debugging only*/
+ #define TIOCSBRK _IO('T', 39) /* BSD compatibility */
+ #define TIOCCBRK _IO('T', 40) /* BSD compatibility */
+ #define TIOCGSID _IOR('T', 41, pid_t) /* Return the session ID of FD*/
+@@ -111,8 +110,10 @@
+ #define TIOCSERGETLSR _IOR('T', 89, unsigned int) /* Get line status reg. */
+ /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
+ # define TIOCSER_TEMT 0x01 /* Transmitter physically empty */
+-#define TIOCSERGETMULTI _IOR('T', 90, struct serial_multiport_struct) /* Get multiport config */
+-#define TIOCSERSETMULTI _IOW('T', 91, struct serial_multiport_struct) /* Set multiport config */
++#define TIOCSERGETMULTI 0x80a8545a /* Get multiport config */
++ /* _IOR('T', 90, struct serial_multiport_struct) */
++#define TIOCSERSETMULTI 0x40a8545b /* Set multiport config */
++ /* _IOW('T', 91, struct serial_multiport_struct) */
+
+ #define TIOCMIWAIT _IO('T', 92) /* wait for a change on serial input line(s) */
+ #define TIOCGICOUNT 0x545D /* read serial port inline interrupt counts */
+diff --git a/arch/xtensa/include/asm/pgtable.h b/arch/xtensa/include/asm/pgtable.h
+index b03c043ce75b..7eeaf22fc7b3 100644
+--- a/arch/xtensa/include/asm/pgtable.h
++++ b/arch/xtensa/include/asm/pgtable.h
+@@ -68,7 +68,12 @@
+ #define VMALLOC_START 0xC0000000
+ #define VMALLOC_END 0xC7FEFFFF
+ #define TLBTEMP_BASE_1 0xC7FF0000
+-#define TLBTEMP_BASE_2 0xC7FF8000
++#define TLBTEMP_BASE_2 (TLBTEMP_BASE_1 + DCACHE_WAY_SIZE)
++#if 2 * DCACHE_WAY_SIZE > ICACHE_WAY_SIZE
++#define TLBTEMP_SIZE (2 * DCACHE_WAY_SIZE)
++#else
++#define TLBTEMP_SIZE ICACHE_WAY_SIZE
++#endif
+
+ /*
+ * Xtensa Linux config PTE layout (when present):
+diff --git a/arch/xtensa/kernel/entry.S b/arch/xtensa/kernel/entry.S
+index 6223f3346b5c..e01cffcc35d1 100644
+--- a/arch/xtensa/kernel/entry.S
++++ b/arch/xtensa/kernel/entry.S
+@@ -1053,9 +1053,8 @@ ENTRY(fast_syscall_xtensa)
+ movi a7, 4 # sizeof(unsigned int)
+ access_ok a3, a7, a0, a2, .Leac # a0: scratch reg, a2: sp
+
+- addi a6, a6, -1 # assuming SYS_XTENSA_ATOMIC_SET = 1
+- _bgeui a6, SYS_XTENSA_COUNT - 1, .Lill
+- _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP - 1, .Lnswp
++ _bgeui a6, SYS_XTENSA_COUNT, .Lill
++ _bnei a6, SYS_XTENSA_ATOMIC_CMP_SWP, .Lnswp
+
+ /* Fall through for ATOMIC_CMP_SWP. */
+
+@@ -1067,27 +1066,26 @@ TRY s32i a5, a3, 0 # different, modify value
+ l32i a7, a2, PT_AREG7 # restore a7
+ l32i a0, a2, PT_AREG0 # restore a0
+ movi a2, 1 # and return 1
+- addi a6, a6, 1 # restore a6 (really necessary?)
+ rfe
+
+ 1: l32i a7, a2, PT_AREG7 # restore a7
+ l32i a0, a2, PT_AREG0 # restore a0
+ movi a2, 0 # return 0 (note that we cannot set
+- addi a6, a6, 1 # restore a6 (really necessary?)
+ rfe
+
+ .Lnswp: /* Atomic set, add, and exg_add. */
+
+ TRY l32i a7, a3, 0 # orig
++ addi a6, a6, -SYS_XTENSA_ATOMIC_SET
+ add a0, a4, a7 # + arg
+ moveqz a0, a4, a6 # set
++ addi a6, a6, SYS_XTENSA_ATOMIC_SET
+ TRY s32i a0, a3, 0 # write new value
+
+ mov a0, a2
+ mov a2, a7
+ l32i a7, a0, PT_AREG7 # restore a7
+ l32i a0, a0, PT_AREG0 # restore a0
+- addi a6, a6, 1 # restore a6 (really necessary?)
+ rfe
+
+ CATCH
+@@ -1096,7 +1094,7 @@ CATCH
+ movi a2, -EFAULT
+ rfe
+
+-.Lill: l32i a7, a2, PT_AREG0 # restore a7
++.Lill: l32i a7, a2, PT_AREG7 # restore a7
+ l32i a0, a2, PT_AREG0 # restore a0
+ movi a2, -EINVAL
+ rfe
+@@ -1629,7 +1627,7 @@ ENTRY(fast_second_level_miss)
+ rsr a0, EXCVADDR
+ bltu a0, a3, 2f
+
+- addi a1, a0, -(2 << (DCACHE_ALIAS_ORDER + PAGE_SHIFT))
++ addi a1, a0, -TLBTEMP_SIZE
+ bgeu a1, a3, 2f
+
+ /* Check if we have to restore an ITLB mapping. */
+diff --git a/arch/xtensa/kernel/pci-dma.c b/arch/xtensa/kernel/pci-dma.c
+index 2783fda76ddc..c055c91a96e6 100644
+--- a/arch/xtensa/kernel/pci-dma.c
++++ b/arch/xtensa/kernel/pci-dma.c
+@@ -48,9 +48,8 @@ dma_alloc_coherent(struct device *dev,size_t size,dma_addr_t *handle,gfp_t flag)
+
+ /* We currently don't support coherent memory outside KSEG */
+
+- if (ret < XCHAL_KSEG_CACHED_VADDR
+- || ret >= XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE)
+- BUG();
++ BUG_ON(ret < XCHAL_KSEG_CACHED_VADDR ||
++ ret > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
+
+
+ if (ret != 0) {
+@@ -66,10 +65,11 @@ dma_alloc_coherent(struct device *dev,size_t size,dma_addr_t *handle,gfp_t flag)
+ void dma_free_coherent(struct device *hwdev, size_t size,
+ void *vaddr, dma_addr_t dma_handle)
+ {
+- long addr=(long)vaddr+XCHAL_KSEG_CACHED_VADDR-XCHAL_KSEG_BYPASS_VADDR;
++ unsigned long addr = (unsigned long)vaddr +
++ XCHAL_KSEG_CACHED_VADDR - XCHAL_KSEG_BYPASS_VADDR;
+
+- if (addr < 0 || addr >= XCHAL_KSEG_SIZE)
+- BUG();
++ BUG_ON(addr < XCHAL_KSEG_CACHED_VADDR ||
++ addr > XCHAL_KSEG_CACHED_VADDR + XCHAL_KSEG_SIZE - 1);
+
+ free_pages(addr, get_order(size));
+ }
+diff --git a/drivers/ata/pata_scc.c b/drivers/ata/pata_scc.c
+index e265f835c95d..19759d3df45a 100644
+--- a/drivers/ata/pata_scc.c
++++ b/drivers/ata/pata_scc.c
+@@ -586,7 +586,7 @@ static int scc_wait_after_reset(struct ata_link *link, unsigned int devmask,
+ * Note: Original code is ata_bus_softreset().
+ */
+
+-static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
++static int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
+ unsigned long deadline)
+ {
+ struct ata_ioports *ioaddr = &ap->ioaddr;
+@@ -600,9 +600,7 @@ static unsigned int scc_bus_softreset(struct ata_port *ap, unsigned int devmask,
+ udelay(20);
+ out_be32(ioaddr->ctl_addr, ap->ctl);
+
+- scc_wait_after_reset(&ap->link, devmask, deadline);
+-
+- return 0;
++ return scc_wait_after_reset(&ap->link, devmask, deadline);
+ }
+
+ /**
+@@ -619,7 +617,8 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes,
+ {
+ struct ata_port *ap = link->ap;
+ unsigned int slave_possible = ap->flags & ATA_FLAG_SLAVE_POSS;
+- unsigned int devmask = 0, err_mask;
++ unsigned int devmask = 0;
++ int rc;
+ u8 err;
+
+ DPRINTK("ENTER\n");
+@@ -635,9 +634,9 @@ static int scc_softreset(struct ata_link *link, unsigned int *classes,
+
+ /* issue bus reset */
+ DPRINTK("about to softreset, devmask=%x\n", devmask);
+- err_mask = scc_bus_softreset(ap, devmask, deadline);
+- if (err_mask) {
+- ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", err_mask);
++ rc = scc_bus_softreset(ap, devmask, deadline);
++ if (rc) {
++ ata_port_err(ap, "SRST failed (err_mask=0x%x)\n", rc);
+ return -EIO;
+ }
+
+diff --git a/drivers/hid/hid-cherry.c b/drivers/hid/hid-cherry.c
+index 888ece68a47c..f870bb3a3264 100644
+--- a/drivers/hid/hid-cherry.c
++++ b/drivers/hid/hid-cherry.c
+@@ -29,7 +29,7 @@
+ static __u8 *ch_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 17 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
++ if (*rsize >= 18 && rdesc[11] == 0x3c && rdesc[12] == 0x02) {
+ hid_info(hdev, "fixing up Cherry Cymotion report descriptor\n");
+ rdesc[11] = rdesc[16] = 0xff;
+ rdesc[12] = rdesc[17] = 0x03;
+diff --git a/drivers/hid/hid-kye.c b/drivers/hid/hid-kye.c
+index b4f0d8216fd0..d7118f8ed34c 100644
+--- a/drivers/hid/hid-kye.c
++++ b/drivers/hid/hid-kye.c
+@@ -282,7 +282,7 @@ static __u8 *kye_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ * - change the button usage range to 4-7 for the extra
+ * buttons
+ */
+- if (*rsize >= 74 &&
++ if (*rsize >= 75 &&
+ rdesc[61] == 0x05 && rdesc[62] == 0x08 &&
+ rdesc[63] == 0x19 && rdesc[64] == 0x08 &&
+ rdesc[65] == 0x29 && rdesc[66] == 0x0f &&
+diff --git a/drivers/hid/hid-lg.c b/drivers/hid/hid-lg.c
+index e7a7bd1eb34a..cb01e67a5431 100644
+--- a/drivers/hid/hid-lg.c
++++ b/drivers/hid/hid-lg.c
+@@ -111,7 +111,7 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ {
+ unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+
+- if ((quirks & LG_RDESC) && *rsize >= 90 && rdesc[83] == 0x26 &&
++ if ((quirks & LG_RDESC) && *rsize >= 91 && rdesc[83] == 0x26 &&
+ rdesc[84] == 0x8c && rdesc[85] == 0x02) {
+ hid_info(hdev,
+ "fixing up Logitech keyboard report descriptor\n");
+@@ -120,7 +120,7 @@ static __u8 *lg_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ }
+ if ((quirks & LG_RDESC_REL_ABS) && *rsize >= 50 &&
+ rdesc[32] == 0x81 && rdesc[33] == 0x06 &&
+- rdesc[49] == 0x81 && rdesc[50] == 0x06) {
++ rdesc[49] == 0x81 && rdesc[51] == 0x06) {
+ hid_info(hdev,
+ "fixing up rel/abs in Logitech report descriptor\n");
+ rdesc[33] = rdesc[50] = 0x02;
+diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
+index 3bfd74f1ad49..f009ab2df768 100644
+--- a/drivers/hid/hid-logitech-dj.c
++++ b/drivers/hid/hid-logitech-dj.c
+@@ -230,13 +230,6 @@ static void logi_dj_recv_add_djhid_device(struct dj_receiver_dev *djrcv_dev,
+ return;
+ }
+
+- if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
+- (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
+- dev_err(&djrcv_hdev->dev, "%s: invalid device index:%d\n",
+- __func__, dj_report->device_index);
+- return;
+- }
+-
+ if (djrcv_dev->paired_dj_devices[dj_report->device_index]) {
+ /* The device is already known. No need to reallocate it. */
+ dbg_hid("%s: device is already known\n", __func__);
+@@ -688,7 +681,6 @@ static int logi_dj_raw_event(struct hid_device *hdev,
+ struct dj_receiver_dev *djrcv_dev = hid_get_drvdata(hdev);
+ struct dj_report *dj_report = (struct dj_report *) data;
+ unsigned long flags;
+- bool report_processed = false;
+
+ dbg_hid("%s, size:%d\n", __func__, size);
+
+@@ -716,27 +708,41 @@ static int logi_dj_raw_event(struct hid_device *hdev,
+ * anything else with it.
+ */
+
++ /* case 1) */
++ if (data[0] != REPORT_ID_DJ_SHORT)
++ return false;
++
++ if ((dj_report->device_index < DJ_DEVICE_INDEX_MIN) ||
++ (dj_report->device_index > DJ_DEVICE_INDEX_MAX)) {
++ /*
++ * Device index is wrong, bail out.
++ * This driver can ignore safely the receiver notifications,
++ * so ignore those reports too.
++ */
++ if (dj_report->device_index != DJ_RECEIVER_INDEX)
++ dev_err(&hdev->dev, "%s: invalid device index:%d\n",
++ __func__, dj_report->device_index);
++ return false;
++ }
++
+ spin_lock_irqsave(&djrcv_dev->lock, flags);
+- if (dj_report->report_id == REPORT_ID_DJ_SHORT) {
+- switch (dj_report->report_type) {
+- case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
+- case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
+- logi_dj_recv_queue_notification(djrcv_dev, dj_report);
+- break;
+- case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
+- if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
+- STATUS_LINKLOSS) {
+- logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
+- }
+- break;
+- default:
+- logi_dj_recv_forward_report(djrcv_dev, dj_report);
++ switch (dj_report->report_type) {
++ case REPORT_TYPE_NOTIF_DEVICE_PAIRED:
++ case REPORT_TYPE_NOTIF_DEVICE_UNPAIRED:
++ logi_dj_recv_queue_notification(djrcv_dev, dj_report);
++ break;
++ case REPORT_TYPE_NOTIF_CONNECTION_STATUS:
++ if (dj_report->report_params[CONNECTION_STATUS_PARAM_STATUS] ==
++ STATUS_LINKLOSS) {
++ logi_dj_recv_forward_null_report(djrcv_dev, dj_report);
+ }
+- report_processed = true;
++ break;
++ default:
++ logi_dj_recv_forward_report(djrcv_dev, dj_report);
+ }
+ spin_unlock_irqrestore(&djrcv_dev->lock, flags);
+
+- return report_processed;
++ return true;
+ }
+
+ static int logi_dj_probe(struct hid_device *hdev,
+diff --git a/drivers/hid/hid-logitech-dj.h b/drivers/hid/hid-logitech-dj.h
+index 4a4000340ce1..daeb0aa4bee9 100644
+--- a/drivers/hid/hid-logitech-dj.h
++++ b/drivers/hid/hid-logitech-dj.h
+@@ -27,6 +27,7 @@
+
+ #define DJ_MAX_PAIRED_DEVICES 6
+ #define DJ_MAX_NUMBER_NOTIFICATIONS 8
++#define DJ_RECEIVER_INDEX 0
+ #define DJ_DEVICE_INDEX_MIN 1
+ #define DJ_DEVICE_INDEX_MAX 6
+
+diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c
+index 7cf3ffe4b7bc..81356f6f1580 100644
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -308,6 +308,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+ if (size < 4 || ((size - 4) % 9) != 0)
+ return 0;
+ npoints = (size - 4) / 9;
++ if (npoints > 15) {
++ hid_warn(hdev, "invalid size value (%d) for TRACKPAD_REPORT_ID\n",
++ size);
++ return 0;
++ }
+ msc->ntouches = 0;
+ for (ii = 0; ii < npoints; ii++)
+ magicmouse_emit_touch(msc, ii, data + ii * 9 + 4);
+@@ -331,6 +336,11 @@ static int magicmouse_raw_event(struct hid_device *hdev,
+ if (size < 6 || ((size - 6) % 8) != 0)
+ return 0;
+ npoints = (size - 6) / 8;
++ if (npoints > 15) {
++ hid_warn(hdev, "invalid size value (%d) for MOUSE_REPORT_ID\n",
++ size);
++ return 0;
++ }
+ msc->ntouches = 0;
+ for (ii = 0; ii < npoints; ii++)
+ magicmouse_emit_touch(msc, ii, data + ii * 8 + 6);
+diff --git a/drivers/hid/hid-monterey.c b/drivers/hid/hid-monterey.c
+index dedf757781ae..eb0271e115c1 100644
+--- a/drivers/hid/hid-monterey.c
++++ b/drivers/hid/hid-monterey.c
+@@ -25,7 +25,7 @@
+ static __u8 *mr_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 30 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
++ if (*rsize >= 31 && rdesc[29] == 0x05 && rdesc[30] == 0x09) {
+ hid_info(hdev, "fixing up button/consumer in HID report descriptor\n");
+ rdesc[30] = 0x0c;
+ }
+diff --git a/drivers/hid/hid-petalynx.c b/drivers/hid/hid-petalynx.c
+index f1ea3ff8a98d..99f317ac649a 100644
+--- a/drivers/hid/hid-petalynx.c
++++ b/drivers/hid/hid-petalynx.c
+@@ -26,7 +26,7 @@
+ static __u8 *pl_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 60 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
++ if (*rsize >= 62 && rdesc[39] == 0x2a && rdesc[40] == 0xf5 &&
+ rdesc[41] == 0x00 && rdesc[59] == 0x26 &&
+ rdesc[60] == 0xf9 && rdesc[61] == 0x00) {
+ hid_info(hdev, "fixing up Petalynx Maxter Remote report descriptor\n");
+diff --git a/drivers/hid/hid-picolcd.c b/drivers/hid/hid-picolcd.c
+index 95f90479f285..4e37b1f4c7e2 100644
+--- a/drivers/hid/hid-picolcd.c
++++ b/drivers/hid/hid-picolcd.c
+@@ -2370,6 +2370,12 @@ static int picolcd_raw_event(struct hid_device *hdev,
+ if (!data)
+ return 1;
+
++ if (size > 64) {
++ hid_warn(hdev, "invalid size value (%d) for picolcd raw event\n",
++ size);
++ return 0;
++ }
++
+ if (report->id == REPORT_KEY_STATE) {
+ if (data->input_keys)
+ ret = picolcd_raw_keypad(data, report, raw_data+1, size-1);
+diff --git a/drivers/hid/hid-sunplus.c b/drivers/hid/hid-sunplus.c
+index d484a0043dd4..3d6ae7bbc25b 100644
+--- a/drivers/hid/hid-sunplus.c
++++ b/drivers/hid/hid-sunplus.c
+@@ -25,7 +25,7 @@
+ static __u8 *sp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ unsigned int *rsize)
+ {
+- if (*rsize >= 107 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
++ if (*rsize >= 112 && rdesc[104] == 0x26 && rdesc[105] == 0x80 &&
+ rdesc[106] == 0x03) {
+ hid_info(hdev, "fixing up Sunplus Wireless Desktop report descriptor\n");
+ rdesc[105] = rdesc[110] = 0x03;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index c0536eda58e9..a55353c37b3d 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3028,14 +3028,16 @@ free_domains:
+
+ static void cleanup_domain(struct protection_domain *domain)
+ {
+- struct iommu_dev_data *dev_data, *next;
++ struct iommu_dev_data *entry;
+ unsigned long flags;
+
+ write_lock_irqsave(&amd_iommu_devtable_lock, flags);
+
+- list_for_each_entry_safe(dev_data, next, &domain->dev_list, list) {
+- __detach_device(dev_data);
+- atomic_set(&dev_data->bind, 0);
++ while (!list_empty(&domain->dev_list)) {
++ entry = list_first_entry(&domain->dev_list,
++ struct iommu_dev_data, list);
++ __detach_device(entry);
++ atomic_set(&entry->bind, 0);
+ }
+
+ write_unlock_irqrestore(&amd_iommu_devtable_lock, flags);
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index 17b918d3d6b3..c276ad09ace9 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -3433,6 +3433,8 @@ static void handle_stripe(struct stripe_head *sh)
+ set_bit(R5_Wantwrite, &dev->flags);
+ if (prexor)
+ continue;
++ if (s.failed > 1)
++ continue;
+ if (!test_bit(R5_Insync, &dev->flags) ||
+ ((i == sh->pd_idx || i == sh->qd_idx) &&
+ s.failed == 0))
+diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
+index 33a17609dd0e..b2b715fdccd7 100644
+--- a/drivers/net/ethernet/ibm/ibmveth.c
++++ b/drivers/net/ethernet/ibm/ibmveth.c
+@@ -293,6 +293,18 @@ failure:
+ atomic_add(buffers_added, &(pool->available));
+ }
+
++/*
++ * The final 8 bytes of the buffer list is a counter of frames dropped
++ * because there was not a buffer in the buffer list capable of holding
++ * the frame.
++ */
++static void ibmveth_update_rx_no_buffer(struct ibmveth_adapter *adapter)
++{
++ __be64 *p = adapter->buffer_list_addr + 4096 - 8;
++
++ adapter->rx_no_buffer = be64_to_cpup(p);
++}
++
+ /* replenish routine */
+ static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
+ {
+@@ -308,8 +320,7 @@ static void ibmveth_replenish_task(struct ibmveth_adapter *adapter)
+ ibmveth_replenish_buffer_pool(adapter, pool);
+ }
+
+- adapter->rx_no_buffer = *(u64 *)(((char*)adapter->buffer_list_addr) +
+- 4096 - 8);
++ ibmveth_update_rx_no_buffer(adapter);
+ }
+
+ /* empty and free ana buffer pool - also used to do cleanup in error paths */
+@@ -692,8 +703,7 @@ static int ibmveth_close(struct net_device *netdev)
+
+ free_irq(netdev->irq, netdev);
+
+- adapter->rx_no_buffer = *(u64 *)(((char *)adapter->buffer_list_addr) +
+- 4096 - 8);
++ ibmveth_update_rx_no_buffer(adapter);
+
+ ibmveth_cleanup(adapter);
+
+diff --git a/drivers/staging/et131x/et131x.c b/drivers/staging/et131x/et131x.c
+index 886f5650444e..6a271e91e88b 100644
+--- a/drivers/staging/et131x/et131x.c
++++ b/drivers/staging/et131x/et131x.c
+@@ -1478,22 +1478,16 @@ static int et131x_mii_read(struct et131x_adapter *adapter, u8 reg, u16 *value)
+ *
+ * Return 0 on success, errno on failure (as defined in errno.h)
+ */
+-static int et131x_mii_write(struct et131x_adapter *adapter, u8 reg, u16 value)
++static int et131x_mii_write(struct et131x_adapter *adapter, u8 addr, u8 reg,
++ u16 value)
+ {
+ struct mac_regs __iomem *mac = &adapter->regs->mac;
+- struct phy_device *phydev = adapter->phydev;
+ int status = 0;
+- u8 addr;
+ u32 delay = 0;
+ u32 mii_addr;
+ u32 mii_cmd;
+ u32 mii_indicator;
+
+- if (!phydev)
+- return -EIO;
+-
+- addr = phydev->addr;
+-
+ /* Save a local copy of the registers we are dealing with so we can
+ * set them back
+ */
+@@ -1550,6 +1544,7 @@ static void et1310_phy_access_mii_bit(struct et131x_adapter *adapter,
+ {
+ u16 reg;
+ u16 mask = 0x0001 << bitnum;
++ struct phy_device *phydev = adapter->phydev;
+
+ /* Read the requested register */
+ et131x_mii_read(adapter, regnum, ®);
+@@ -1560,11 +1555,11 @@ static void et1310_phy_access_mii_bit(struct et131x_adapter *adapter,
+ break;
+
+ case TRUEPHY_BIT_SET:
+- et131x_mii_write(adapter, regnum, reg | mask);
++ et131x_mii_write(adapter, phydev->addr, regnum, reg | mask);
+ break;
+
+ case TRUEPHY_BIT_CLEAR:
+- et131x_mii_write(adapter, regnum, reg & ~mask);
++ et131x_mii_write(adapter, phydev->addr, regnum, reg & ~mask);
+ break;
+
+ default:
+@@ -1715,17 +1710,7 @@ static int et131x_mdio_write(struct mii_bus *bus, int phy_addr, int reg, u16 val
+ struct net_device *netdev = bus->priv;
+ struct et131x_adapter *adapter = netdev_priv(netdev);
+
+- return et131x_mii_write(adapter, reg, value);
+-}
+-
+-static int et131x_mdio_reset(struct mii_bus *bus)
+-{
+- struct net_device *netdev = bus->priv;
+- struct et131x_adapter *adapter = netdev_priv(netdev);
+-
+- et131x_mii_write(adapter, MII_BMCR, BMCR_RESET);
+-
+- return 0;
++ return et131x_mii_write(adapter, phy_addr, reg, value);
+ }
+
+ /**
+@@ -1741,12 +1726,13 @@ static int et131x_mdio_reset(struct mii_bus *bus)
+ static void et1310_phy_power_down(struct et131x_adapter *adapter, bool down)
+ {
+ u16 data;
++ struct phy_device *phydev = adapter->phydev;
+
+ et131x_mii_read(adapter, MII_BMCR, &data);
+ data &= ~BMCR_PDOWN;
+ if (down)
+ data |= BMCR_PDOWN;
+- et131x_mii_write(adapter, MII_BMCR, data);
++ et131x_mii_write(adapter, phydev->addr, MII_BMCR, data);
+ }
+
+ /**
+@@ -1759,6 +1745,7 @@ static void et131x_xcvr_init(struct et131x_adapter *adapter)
+ u16 imr;
+ u16 isr;
+ u16 lcr2;
++ struct phy_device *phydev = adapter->phydev;
+
+ et131x_mii_read(adapter, PHY_INTERRUPT_STATUS, &isr);
+ et131x_mii_read(adapter, PHY_INTERRUPT_MASK, &imr);
+@@ -1770,7 +1757,7 @@ static void et131x_xcvr_init(struct et131x_adapter *adapter)
+ ET_PHY_INT_MASK_LINKSTAT &
+ ET_PHY_INT_MASK_ENABLE);
+
+- et131x_mii_write(adapter, PHY_INTERRUPT_MASK, imr);
++ et131x_mii_write(adapter, phydev->addr, PHY_INTERRUPT_MASK, imr);
+
+ /* Set the LED behavior such that LED 1 indicates speed (off =
+ * 10Mbits, blink = 100Mbits, on = 1000Mbits) and LED 2 indicates
+@@ -1791,7 +1778,7 @@ static void et131x_xcvr_init(struct et131x_adapter *adapter)
+ else
+ lcr2 |= (LED_VAL_LINKON << LED_TXRX_SHIFT);
+
+- et131x_mii_write(adapter, PHY_LED_2, lcr2);
++ et131x_mii_write(adapter, phydev->addr, PHY_LED_2, lcr2);
+ }
+ }
+
+@@ -4202,14 +4189,14 @@ static void et131x_adjust_link(struct net_device *netdev)
+
+ et131x_mii_read(adapter, PHY_MPHY_CONTROL_REG,
+ ®ister18);
+- et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
+- register18 | 0x4);
+- et131x_mii_write(adapter, PHY_INDEX_REG,
++ et131x_mii_write(adapter, phydev->addr,
++ PHY_MPHY_CONTROL_REG, register18 | 0x4);
++ et131x_mii_write(adapter, phydev->addr, PHY_INDEX_REG,
+ register18 | 0x8402);
+- et131x_mii_write(adapter, PHY_DATA_REG,
++ et131x_mii_write(adapter, phydev->addr, PHY_DATA_REG,
+ register18 | 511);
+- et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
+- register18);
++ et131x_mii_write(adapter, phydev->addr,
++ PHY_MPHY_CONTROL_REG, register18);
+ }
+
+ et1310_config_flow_control(adapter);
+@@ -4221,7 +4208,8 @@ static void et131x_adjust_link(struct net_device *netdev)
+ et131x_mii_read(adapter, PHY_CONFIG, ®);
+ reg &= ~ET_PHY_CONFIG_TX_FIFO_DEPTH;
+ reg |= ET_PHY_CONFIG_FIFO_DEPTH_32;
+- et131x_mii_write(adapter, PHY_CONFIG, reg);
++ et131x_mii_write(adapter, phydev->addr, PHY_CONFIG,
++ reg);
+ }
+
+ et131x_set_rx_dma_timer(adapter);
+@@ -4254,14 +4242,17 @@ static void et131x_adjust_link(struct net_device *netdev)
+
+ et131x_mii_read(adapter, PHY_MPHY_CONTROL_REG,
+ ®ister18);
+- et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
+- register18 | 0x4);
+- et131x_mii_write(adapter, PHY_INDEX_REG,
+- register18 | 0x8402);
+- et131x_mii_write(adapter, PHY_DATA_REG,
+- register18 | 511);
+- et131x_mii_write(adapter, PHY_MPHY_CONTROL_REG,
+- register18);
++ et131x_mii_write(adapter, phydev->addr,
++ PHY_MPHY_CONTROL_REG,
++ register18 | 0x4);
++ et131x_mii_write(adapter, phydev->addr,
++ PHY_INDEX_REG,
++ register18 | 0x8402);
++ et131x_mii_write(adapter, phydev->addr,
++ PHY_DATA_REG, register18 | 511);
++ et131x_mii_write(adapter, phydev->addr,
++ PHY_MPHY_CONTROL_REG,
++ register18);
+ }
+
+ /* Free the packets being actively sent & stopped */
+@@ -5343,10 +5334,6 @@ static int __devinit et131x_pci_setup(struct pci_dev *pdev,
+ /* Copy address into the net_device struct */
+ memcpy(netdev->dev_addr, adapter->addr, ETH_ALEN);
+
+- /* Init variable for counting how long we do not have link status */
+- adapter->boot_coma = 0;
+- et1310_disable_phy_coma(adapter);
+-
+ rc = -ENOMEM;
+
+ /* Setup the mii_bus struct */
+@@ -5362,7 +5349,6 @@ static int __devinit et131x_pci_setup(struct pci_dev *pdev,
+ adapter->mii_bus->priv = netdev;
+ adapter->mii_bus->read = et131x_mdio_read;
+ adapter->mii_bus->write = et131x_mdio_write;
+- adapter->mii_bus->reset = et131x_mdio_reset;
+ adapter->mii_bus->irq = kmalloc(sizeof(int)*PHY_MAX_ADDR, GFP_KERNEL);
+ if (!adapter->mii_bus->irq) {
+ dev_err(&pdev->dev, "mii_bus irq allocation failed\n");
+@@ -5387,6 +5373,10 @@ static int __devinit et131x_pci_setup(struct pci_dev *pdev,
+ /* Setup et1310 as per the documentation */
+ et131x_adapter_setup(adapter);
+
++ /* Init variable for counting how long we do not have link status */
++ adapter->boot_coma = 0;
++ et1310_disable_phy_coma(adapter);
++
+ /* We can enable interrupts now
+ *
+ * NOTE - Because registration of interrupt handler is done in the
+diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
+index c48cf891e6bc..d53f39668044 100644
+--- a/drivers/tty/serial/8250/8250_pci.c
++++ b/drivers/tty/serial/8250/8250_pci.c
+@@ -1080,12 +1080,12 @@ pci_omegapci_setup(struct serial_private *priv,
+ static int
+ pci_brcm_trumanage_setup(struct serial_private *priv,
+ const struct pciserial_board *board,
+- struct uart_8250_port *port, int idx)
++ struct uart_port *port, int idx)
+ {
+ int ret = pci_default_setup(priv, board, port, idx);
+
+- port->port.type = PORT_BRCM_TRUMANAGE;
+- port->port.flags = (port->port.flags | UPF_FIXED_PORT | UPF_FIXED_TYPE);
++ port->type = PORT_BRCM_TRUMANAGE;
++ port->flags = (port->flags | UPF_FIXED_PORT | UPF_FIXED_TYPE);
+ return ret;
+ }
+
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 33cff0153b25..8882d654b0d1 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -98,6 +98,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ /* AMD PLL quirk */
+ if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info())
+ xhci->quirks |= XHCI_AMD_PLL_FIX;
++
++ if (pdev->vendor == PCI_VENDOR_ID_AMD)
++ xhci->quirks |= XHCI_TRUST_TX_LENGTH;
++
+ if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
+ pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
+ xhci->quirks |= XHCI_EP_LIMIT_QUIRK;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 6f1b36d15419..95e8648ade45 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2528,7 +2528,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ * last TRB of the previous TD. The command completion handle
+ * will take care the rest.
+ */
+- if (!event_seg && trb_comp_code == COMP_STOP_INVAL) {
++ if (!event_seg && (trb_comp_code == COMP_STOP ||
++ trb_comp_code == COMP_STOP_INVAL)) {
+ ret = 0;
+ goto cleanup;
+ }
+diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
+index 7af163da9a79..f1bfd0131e0f 100644
+--- a/drivers/usb/misc/sisusbvga/sisusb.c
++++ b/drivers/usb/misc/sisusbvga/sisusb.c
+@@ -3248,6 +3248,7 @@ static const struct usb_device_id sisusb_table[] = {
+ { USB_DEVICE(0x0711, 0x0918) },
+ { USB_DEVICE(0x0711, 0x0920) },
+ { USB_DEVICE(0x0711, 0x0950) },
++ { USB_DEVICE(0x0711, 0x5200) },
+ { USB_DEVICE(0x182d, 0x021c) },
+ { USB_DEVICE(0x182d, 0x0269) },
+ { }
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 89b5664aa53b..121a05207d8b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -162,6 +162,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
++ { USB_DEVICE(FTDI_VID, FTDI_BM_ATOM_NANO_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_EV3CON_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
+@@ -956,6 +957,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
+ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
++ /* ekey Devices */
++ { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
+ { }, /* Optional parameter entry */
+ { } /* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 106cc16cc6ed..0eb2e97bcb4a 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -42,6 +42,8 @@
+ /* www.candapter.com Ewert Energy Systems CANdapter device */
+ #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
+
++#define FTDI_BM_ATOM_NANO_PID 0xa559 /* Basic Micro ATOM Nano USB2Serial */
++
+ /*
+ * Texas Instruments XDS100v2 JTAG / BeagleBone A3
+ * http://processors.wiki.ti.com/index.php/XDS100
+@@ -1369,3 +1371,8 @@
+ #define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
+ #define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
+ #define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
++
++/*
++ * ekey biometric systems GmbH (http://ekey.net/)
++ */
++#define FTDI_EKEY_CONV_USB_PID 0xCB08 /* Converter USB */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index e1e05bad2be0..703ebe7eaa93 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -499,6 +499,10 @@ static void option_instat_callback(struct urb *urb);
+ #define INOVIA_VENDOR_ID 0x20a6
+ #define INOVIA_SEW858 0x1105
+
++/* VIA Telecom */
++#define VIATELECOM_VENDOR_ID 0x15eb
++#define VIATELECOM_PRODUCT_CDS7 0x0001
++
+ /* some devices interfaces need special handling due to a number of reasons */
+ enum option_blacklist_reason {
+ OPTION_BLACKLIST_NONE = 0,
+@@ -1744,6 +1748,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
+ { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
++ { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
+ { } /* Terminating entry */
+ };
+ MODULE_DEVICE_TABLE(usb, option_ids);
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 9d768ac5a60a..3e450b4e9c5f 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -51,6 +51,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MOTOROLA) },
++ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ZTEK) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
+ { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 42bc082896ac..71fd9da1d6e7 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -22,6 +22,7 @@
+ #define PL2303_PRODUCT_ID_GPRS 0x0609
+ #define PL2303_PRODUCT_ID_HCR331 0x331a
+ #define PL2303_PRODUCT_ID_MOTOROLA 0x0307
++#define PL2303_PRODUCT_ID_ZTEK 0xe1f1
+
+ #define ATEN_VENDOR_ID 0x0557
+ #define ATEN_VENDOR_ID2 0x0547
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 9a145e4b8169..a08230ebe9c5 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -794,29 +794,37 @@ int usb_serial_probe(struct usb_interface *interface,
+ if (usb_endpoint_is_bulk_in(endpoint)) {
+ /* we found a bulk in endpoint */
+ dbg("found bulk in on endpoint %d", i);
+- bulk_in_endpoint[num_bulk_in] = endpoint;
+- ++num_bulk_in;
++ if (num_bulk_in < MAX_NUM_PORTS) {
++ bulk_in_endpoint[num_bulk_in] = endpoint;
++ ++num_bulk_in;
++ }
+ }
+
+ if (usb_endpoint_is_bulk_out(endpoint)) {
+ /* we found a bulk out endpoint */
+ dbg("found bulk out on endpoint %d", i);
+- bulk_out_endpoint[num_bulk_out] = endpoint;
+- ++num_bulk_out;
++ if (num_bulk_out < MAX_NUM_PORTS) {
++ bulk_out_endpoint[num_bulk_out] = endpoint;
++ ++num_bulk_out;
++ }
+ }
+
+ if (usb_endpoint_is_int_in(endpoint)) {
+ /* we found a interrupt in endpoint */
+ dbg("found interrupt in on endpoint %d", i);
+- interrupt_in_endpoint[num_interrupt_in] = endpoint;
+- ++num_interrupt_in;
++ if (num_interrupt_in < MAX_NUM_PORTS) {
++ interrupt_in_endpoint[num_interrupt_in] = endpoint;
++ ++num_interrupt_in;
++ }
+ }
+
+ if (usb_endpoint_is_int_out(endpoint)) {
+ /* we found an interrupt out endpoint */
+ dbg("found interrupt out on endpoint %d", i);
+- interrupt_out_endpoint[num_interrupt_out] = endpoint;
+- ++num_interrupt_out;
++ if (num_interrupt_out < MAX_NUM_PORTS) {
++ interrupt_out_endpoint[num_interrupt_out] = endpoint;
++ ++num_interrupt_out;
++ }
+ }
+ }
+
+@@ -839,8 +847,10 @@ int usb_serial_probe(struct usb_interface *interface,
+ if (usb_endpoint_is_int_in(endpoint)) {
+ /* we found a interrupt in endpoint */
+ dbg("found interrupt in for Prolific device on separate interface");
+- interrupt_in_endpoint[num_interrupt_in] = endpoint;
+- ++num_interrupt_in;
++ if (num_interrupt_in < MAX_NUM_PORTS) {
++ interrupt_in_endpoint[num_interrupt_in] = endpoint;
++ ++num_interrupt_in;
++ }
+ }
+ }
+ }
+@@ -879,6 +889,11 @@ int usb_serial_probe(struct usb_interface *interface,
+ num_ports = type->num_ports;
+ }
+
++ if (num_ports > MAX_NUM_PORTS) {
++ dev_warn(&interface->dev, "too many ports requested: %d\n", num_ports);
++ num_ports = MAX_NUM_PORTS;
++ }
++
+ serial->num_ports = num_ports;
+ serial->num_bulk_in = num_bulk_in;
+ serial->num_bulk_out = num_bulk_out;
+diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c
+index 0d06d7ca86f9..bf7014d49a50 100644
+--- a/drivers/usb/serial/whiteheat.c
++++ b/drivers/usb/serial/whiteheat.c
+@@ -953,6 +953,10 @@ static void command_port_read_callback(struct urb *urb)
+ dbg("%s - command_info is NULL, exiting.", __func__);
+ return;
+ }
++ if (!urb->actual_length) {
++ dev_dbg(&urb->dev->dev, "%s - empty response, exiting.\n", __func__);
++ return;
++ }
+ if (status) {
+ dbg("%s - nonzero urb status: %d", __func__, status);
+ if (status != -ENOENT)
+@@ -974,7 +978,8 @@ static void command_port_read_callback(struct urb *urb)
+ /* These are unsolicited reports from the firmware, hence no
+ waiting command to wakeup */
+ dbg("%s - event received", __func__);
+- } else if (data[0] == WHITEHEAT_GET_DTR_RTS) {
++ } else if ((data[0] == WHITEHEAT_GET_DTR_RTS) &&
++ (urb->actual_length - 1 <= sizeof(command_info->result_buffer))) {
+ memcpy(command_info->result_buffer, &data[1],
+ urb->actual_length - 1);
+ command_info->command_finished = WHITEHEAT_CMD_COMPLETE;
+diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
+index 43944c6d7b41..8d6ac6bec9e9 100644
+--- a/fs/cifs/inode.c
++++ b/fs/cifs/inode.c
+@@ -1653,6 +1653,12 @@ unlink_target:
+ target_dentry, toName);
+ }
+
++ /* force revalidate to go get info when needed */
++ CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
++
++ source_dir->i_ctime = source_dir->i_mtime = target_dir->i_ctime =
++ target_dir->i_mtime = current_fs_time(source_dir->i_sb);
++
+ cifs_rename_exit:
+ kfree(info_buf_source);
+ kfree(fromName);
+diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c
+index 740cad8dcd8d..6a7c4837cc7c 100644
+--- a/fs/ext2/inode.c
++++ b/fs/ext2/inode.c
+@@ -614,6 +614,8 @@ static int ext2_get_blocks(struct inode *inode,
+ int count = 0;
+ ext2_fsblk_t first_block = 0;
+
++ BUG_ON(maxblocks == 0);
++
+ depth = ext2_block_to_path(inode,iblock,offsets,&blocks_to_boundary);
+
+ if (depth == 0)
+diff --git a/fs/ext2/xip.c b/fs/ext2/xip.c
+index 1c3312858fcf..e98171a11cfe 100644
+--- a/fs/ext2/xip.c
++++ b/fs/ext2/xip.c
+@@ -35,6 +35,7 @@ __ext2_get_block(struct inode *inode, pgoff_t pgoff, int create,
+ int rc;
+
+ memset(&tmp, 0, sizeof(struct buffer_head));
++ tmp.b_size = 1 << inode->i_blkbits;
+ rc = ext2_get_block(inode, pgoff, &tmp, create);
+ *result = tmp.b_blocknr;
+
+diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
+index e92a342f14e7..e379b870cecd 100644
+--- a/fs/isofs/inode.c
++++ b/fs/isofs/inode.c
+@@ -68,7 +68,7 @@ static void isofs_put_super(struct super_block *sb)
+ return;
+ }
+
+-static int isofs_read_inode(struct inode *);
++static int isofs_read_inode(struct inode *, int relocated);
+ static int isofs_statfs (struct dentry *, struct kstatfs *);
+
+ static struct kmem_cache *isofs_inode_cachep;
+@@ -1264,7 +1264,7 @@ out_toomany:
+ goto out;
+ }
+
+-static int isofs_read_inode(struct inode *inode)
++static int isofs_read_inode(struct inode *inode, int relocated)
+ {
+ struct super_block *sb = inode->i_sb;
+ struct isofs_sb_info *sbi = ISOFS_SB(sb);
+@@ -1409,7 +1409,7 @@ static int isofs_read_inode(struct inode *inode)
+ */
+
+ if (!high_sierra) {
+- parse_rock_ridge_inode(de, inode);
++ parse_rock_ridge_inode(de, inode, relocated);
+ /* if we want uid/gid set, override the rock ridge setting */
+ if (sbi->s_uid_set)
+ inode->i_uid = sbi->s_uid;
+@@ -1488,9 +1488,10 @@ static int isofs_iget5_set(struct inode *ino, void *data)
+ * offset that point to the underlying meta-data for the inode. The
+ * code below is otherwise similar to the iget() code in
+ * include/linux/fs.h */
+-struct inode *isofs_iget(struct super_block *sb,
+- unsigned long block,
+- unsigned long offset)
++struct inode *__isofs_iget(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset,
++ int relocated)
+ {
+ unsigned long hashval;
+ struct inode *inode;
+@@ -1512,7 +1513,7 @@ struct inode *isofs_iget(struct super_block *sb,
+ return ERR_PTR(-ENOMEM);
+
+ if (inode->i_state & I_NEW) {
+- ret = isofs_read_inode(inode);
++ ret = isofs_read_inode(inode, relocated);
+ if (ret < 0) {
+ iget_failed(inode);
+ inode = ERR_PTR(ret);
+diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h
+index 0e73f63d9274..50cd5839844f 100644
+--- a/fs/isofs/isofs.h
++++ b/fs/isofs/isofs.h
+@@ -107,7 +107,7 @@ extern int iso_date(char *, int);
+
+ struct inode; /* To make gcc happy */
+
+-extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *);
++extern int parse_rock_ridge_inode(struct iso_directory_record *, struct inode *, int relocated);
+ extern int get_rock_ridge_filename(struct iso_directory_record *, char *, struct inode *);
+ extern int isofs_name_translate(struct iso_directory_record *, char *, struct inode *);
+
+@@ -118,9 +118,24 @@ extern struct dentry *isofs_lookup(struct inode *, struct dentry *, struct namei
+ extern struct buffer_head *isofs_bread(struct inode *, sector_t);
+ extern int isofs_get_blocks(struct inode *, sector_t, struct buffer_head **, unsigned long);
+
+-extern struct inode *isofs_iget(struct super_block *sb,
+- unsigned long block,
+- unsigned long offset);
++struct inode *__isofs_iget(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset,
++ int relocated);
++
++static inline struct inode *isofs_iget(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset)
++{
++ return __isofs_iget(sb, block, offset, 0);
++}
++
++static inline struct inode *isofs_iget_reloc(struct super_block *sb,
++ unsigned long block,
++ unsigned long offset)
++{
++ return __isofs_iget(sb, block, offset, 1);
++}
+
+ /* Because the inode number is no longer relevant to finding the
+ * underlying meta-data for an inode, we are free to choose a more
+diff --git a/fs/isofs/rock.c b/fs/isofs/rock.c
+index 70e79d0c756a..ee62cc0c2499 100644
+--- a/fs/isofs/rock.c
++++ b/fs/isofs/rock.c
+@@ -288,12 +288,16 @@ eio:
+ goto out;
+ }
+
++#define RR_REGARD_XA 1
++#define RR_RELOC_DE 2
++
+ static int
+ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+- struct inode *inode, int regard_xa)
++ struct inode *inode, int flags)
+ {
+ int symlink_len = 0;
+ int cnt, sig;
++ unsigned int reloc_block;
+ struct inode *reloc;
+ struct rock_ridge *rr;
+ int rootflag;
+@@ -305,7 +309,7 @@ parse_rock_ridge_inode_internal(struct iso_directory_record *de,
+
+ init_rock_state(&rs, inode);
+ setup_rock_ridge(de, inode, &rs);
+- if (regard_xa) {
++ if (flags & RR_REGARD_XA) {
+ rs.chr += 14;
+ rs.len -= 14;
+ if (rs.len < 0)
+@@ -485,12 +489,22 @@ repeat:
+ "relocated directory\n");
+ goto out;
+ case SIG('C', 'L'):
+- ISOFS_I(inode)->i_first_extent =
+- isonum_733(rr->u.CL.location);
+- reloc =
+- isofs_iget(inode->i_sb,
+- ISOFS_I(inode)->i_first_extent,
+- 0);
++ if (flags & RR_RELOC_DE) {
++ printk(KERN_ERR
++ "ISOFS: Recursive directory relocation "
++ "is not supported\n");
++ goto eio;
++ }
++ reloc_block = isonum_733(rr->u.CL.location);
++ if (reloc_block == ISOFS_I(inode)->i_iget5_block &&
++ ISOFS_I(inode)->i_iget5_offset == 0) {
++ printk(KERN_ERR
++ "ISOFS: Directory relocation points to "
++ "itself\n");
++ goto eio;
++ }
++ ISOFS_I(inode)->i_first_extent = reloc_block;
++ reloc = isofs_iget_reloc(inode->i_sb, reloc_block, 0);
+ if (IS_ERR(reloc)) {
+ ret = PTR_ERR(reloc);
+ goto out;
+@@ -637,9 +651,11 @@ static char *get_symlink_chunk(char *rpnt, struct rock_ridge *rr, char *plimit)
+ return rpnt;
+ }
+
+-int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
++int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode,
++ int relocated)
+ {
+- int result = parse_rock_ridge_inode_internal(de, inode, 0);
++ int flags = relocated ? RR_RELOC_DE : 0;
++ int result = parse_rock_ridge_inode_internal(de, inode, flags);
+
+ /*
+ * if rockridge flag was reset and we didn't look for attributes
+@@ -647,7 +663,8 @@ int parse_rock_ridge_inode(struct iso_directory_record *de, struct inode *inode)
+ */
+ if ((ISOFS_SB(inode->i_sb)->s_rock_offset == -1)
+ && (ISOFS_SB(inode->i_sb)->s_rock == 2)) {
+- result = parse_rock_ridge_inode_internal(de, inode, 14);
++ result = parse_rock_ridge_inode_internal(de, inode,
++ flags | RR_REGARD_XA);
+ }
+ return result;
+ }
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 934bb1ca8335..01afcd575920 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -2051,6 +2051,7 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ {
+ struct nfs4_closedata *calldata = data;
+ struct nfs4_state *state = calldata->state;
++ bool is_rdonly, is_wronly, is_rdwr;
+ int call_close = 0;
+
+ dprintk("%s: begin!\n", __func__);
+@@ -2058,18 +2059,24 @@ static void nfs4_close_prepare(struct rpc_task *task, void *data)
+ return;
+
+ task->tk_msg.rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_OPEN_DOWNGRADE];
+- calldata->arg.fmode = FMODE_READ|FMODE_WRITE;
+ spin_lock(&state->owner->so_lock);
++ is_rdwr = test_bit(NFS_O_RDWR_STATE, &state->flags);
++ is_rdonly = test_bit(NFS_O_RDONLY_STATE, &state->flags);
++ is_wronly = test_bit(NFS_O_WRONLY_STATE, &state->flags);
++ /* Calculate the current open share mode */
++ calldata->arg.fmode = 0;
++ if (is_rdonly || is_rdwr)
++ calldata->arg.fmode |= FMODE_READ;
++ if (is_wronly || is_rdwr)
++ calldata->arg.fmode |= FMODE_WRITE;
+ /* Calculate the change in open mode */
+ if (state->n_rdwr == 0) {
+ if (state->n_rdonly == 0) {
+- call_close |= test_bit(NFS_O_RDONLY_STATE, &state->flags);
+- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
++ call_close |= is_rdonly || is_rdwr;
+ calldata->arg.fmode &= ~FMODE_READ;
+ }
+ if (state->n_wronly == 0) {
+- call_close |= test_bit(NFS_O_WRONLY_STATE, &state->flags);
+- call_close |= test_bit(NFS_O_RDWR_STATE, &state->flags);
++ call_close |= is_wronly || is_rdwr;
+ calldata->arg.fmode &= ~FMODE_WRITE;
+ }
+ }
+diff --git a/include/linux/mempolicy.h b/include/linux/mempolicy.h
+index fe07e5a90569..cc49b232b6e4 100644
+--- a/include/linux/mempolicy.h
++++ b/include/linux/mempolicy.h
+@@ -205,7 +205,7 @@ extern struct zonelist *huge_zonelist(struct vm_area_struct *vma,
+ extern bool init_nodemask_of_mempolicy(nodemask_t *mask);
+ extern bool mempolicy_nodemask_intersects(struct task_struct *tsk,
+ const nodemask_t *mask);
+-extern unsigned slab_node(struct mempolicy *policy);
++extern unsigned slab_node(void);
+
+ extern enum zone_type policy_zone;
+
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 5cec36b6e838..87a43cce8d59 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1609,8 +1609,14 @@ static unsigned interleave_nodes(struct mempolicy *policy)
+ * task can change it's policy. The system default policy requires no
+ * such protection.
+ */
+-unsigned slab_node(struct mempolicy *policy)
++unsigned slab_node(void)
+ {
++ struct mempolicy *policy;
++
++ if (in_interrupt())
++ return numa_node_id();
++
++ policy = current->mempolicy;
+ if (!policy || policy->flags & MPOL_F_LOCAL)
+ return numa_node_id();
+
+diff --git a/mm/slab.c b/mm/slab.c
+index da2bb689a008..3eb1c38e2c30 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3336,7 +3336,7 @@ static void *alternate_node_alloc(struct kmem_cache *cachep, gfp_t flags)
+ if (cpuset_do_slab_mem_spread() && (cachep->flags & SLAB_MEM_SPREAD))
+ nid_alloc = cpuset_slab_spread_node();
+ else if (current->mempolicy)
+- nid_alloc = slab_node(current->mempolicy);
++ nid_alloc = slab_node();
+ if (nid_alloc != nid_here)
+ return ____cache_alloc_node(cachep, flags, nid_alloc);
+ return NULL;
+@@ -3368,7 +3368,7 @@ static void *fallback_alloc(struct kmem_cache *cache, gfp_t flags)
+
+ retry_cpuset:
+ cpuset_mems_cookie = get_mems_allowed();
+- zonelist = node_zonelist(slab_node(current->mempolicy), flags);
++ zonelist = node_zonelist(slab_node(), flags);
+
+ retry:
+ /*
+diff --git a/mm/slub.c b/mm/slub.c
+index c6f225fa9a87..54ac6e90a1fa 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1617,7 +1617,7 @@ static struct page *get_any_partial(struct kmem_cache *s, gfp_t flags,
+
+ do {
+ cpuset_mems_cookie = get_mems_allowed();
+- zonelist = node_zonelist(slab_node(current->mempolicy), flags);
++ zonelist = node_zonelist(slab_node(), flags);
+ for_each_zone_zonelist(zone, z, zonelist, high_zoneidx) {
+ struct kmem_cache_node *n;
+
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 4dac0b332a36..36284b8562f0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -458,6 +458,8 @@ static void alc_fix_pll(struct hda_codec *codec)
+ spec->pll_coef_idx);
+ val = snd_hda_codec_read(codec, spec->pll_nid, 0,
+ AC_VERB_GET_PROC_COEF, 0);
++ if (val == -1)
++ return;
+ snd_hda_codec_write(codec, spec->pll_nid, 0, AC_VERB_SET_COEF_INDEX,
+ spec->pll_coef_idx);
+ snd_hda_codec_write(codec, spec->pll_nid, 0, AC_VERB_SET_PROC_COEF,
+@@ -5843,6 +5845,8 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
+ static void alc269_toggle_power_output(struct hda_codec *codec, int power_up)
+ {
+ int val = alc_read_coef_idx(codec, 0x04);
++ if (val == -1)
++ return;
+ if (power_up)
+ val |= 1 << 11;
+ else
+@@ -6273,27 +6277,30 @@ static void alc269_fill_coef(struct hda_codec *codec)
+ if ((alc_get_coef0(codec) & 0x00ff) == 0x017) {
+ val = alc_read_coef_idx(codec, 0x04);
+ /* Power up output pin */
+- alc_write_coef_idx(codec, 0x04, val | (1<<11));
++ if (val != -1)
++ alc_write_coef_idx(codec, 0x04, val | (1<<11));
+ }
+
+ if ((alc_get_coef0(codec) & 0x00ff) == 0x018) {
+ val = alc_read_coef_idx(codec, 0xd);
+- if ((val & 0x0c00) >> 10 != 0x1) {
++ if (val != -1 && (val & 0x0c00) >> 10 != 0x1) {
+ /* Capless ramp up clock control */
+ alc_write_coef_idx(codec, 0xd, val | (1<<10));
+ }
+ val = alc_read_coef_idx(codec, 0x17);
+- if ((val & 0x01c0) >> 6 != 0x4) {
++ if (val != -1 && (val & 0x01c0) >> 6 != 0x4) {
+ /* Class D power on reset */
+ alc_write_coef_idx(codec, 0x17, val | (1<<7));
+ }
+ }
+
+ val = alc_read_coef_idx(codec, 0xd); /* Class D */
+- alc_write_coef_idx(codec, 0xd, val | (1<<14));
++ if (val != -1)
++ alc_write_coef_idx(codec, 0xd, val | (1<<14));
+
+ val = alc_read_coef_idx(codec, 0x4); /* HP */
+- alc_write_coef_idx(codec, 0x4, val | (1<<11));
++ if (val != -1)
++ alc_write_coef_idx(codec, 0x4, val | (1<<11));
+ }
+
+ /*
+diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
+index fd04ce139031..540e30bdb79a 100644
+--- a/sound/soc/pxa/pxa-ssp.c
++++ b/sound/soc/pxa/pxa-ssp.c
+@@ -779,9 +779,7 @@ static int pxa_ssp_remove(struct snd_soc_dai *dai)
+ SNDRV_PCM_RATE_48000 | SNDRV_PCM_RATE_64000 | \
+ SNDRV_PCM_RATE_88200 | SNDRV_PCM_RATE_96000)
+
+-#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE |\
+- SNDRV_PCM_FMTBIT_S24_LE | \
+- SNDRV_PCM_FMTBIT_S32_LE)
++#define PXA_SSP_FORMATS (SNDRV_PCM_FMTBIT_S16_LE | SNDRV_PCM_FMTBIT_S32_LE)
+
+ static const struct snd_soc_dai_ops pxa_ssp_dai_ops = {
+ .startup = pxa_ssp_startup,
+diff --git a/virt/kvm/iommu.c b/virt/kvm/iommu.c
+index 53d34f626c15..defc9baa9a45 100644
+--- a/virt/kvm/iommu.c
++++ b/virt/kvm/iommu.c
+@@ -61,6 +61,14 @@ static pfn_t kvm_pin_pages(struct kvm *kvm, struct kvm_memory_slot *slot,
+ return pfn;
+ }
+
++static void kvm_unpin_pages(struct kvm *kvm, pfn_t pfn, unsigned long npages)
++{
++ unsigned long i;
++
++ for (i = 0; i < npages; ++i)
++ kvm_release_pfn_clean(pfn + i);
++}
++
+ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ {
+ gfn_t gfn, end_gfn;
+@@ -121,6 +129,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ if (r) {
+ printk(KERN_ERR "kvm_iommu_map_address:"
+ "iommu failed to map pfn=%llx\n", pfn);
++ kvm_unpin_pages(kvm, pfn, page_size);
+ goto unmap_pages;
+ }
+
+@@ -132,7 +141,7 @@ int kvm_iommu_map_pages(struct kvm *kvm, struct kvm_memory_slot *slot)
+ return 0;
+
+ unmap_pages:
+- kvm_iommu_put_pages(kvm, slot->base_gfn, gfn);
++ kvm_iommu_put_pages(kvm, slot->base_gfn, gfn - slot->base_gfn);
+ return r;
+ }
+
+@@ -274,14 +283,6 @@ out_unlock:
+ return r;
+ }
+
+-static void kvm_unpin_pages(struct kvm *kvm, pfn_t pfn, unsigned long npages)
+-{
+- unsigned long i;
+-
+- for (i = 0; i < npages; ++i)
+- kvm_release_pfn_clean(pfn + i);
+-}
+-
+ static void kvm_iommu_put_pages(struct kvm *kvm,
+ gfn_t base_gfn, unsigned long npages)
+ {
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-08-19 11:41 Mike Pagano
2014-08-14 11:44 ` Mike Pagano
0 siblings, 1 reply; 25+ messages in thread
From: Mike Pagano @ 2014-08-19 11:41 UTC (permalink / raw
To: gentoo-commits
commit: b4ff8e8d4d51f14358d6a01bc8ddc449a85729c9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 14 11:42:09 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 14 11:42:09 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=b4ff8e8d
Linux patch 3.4.103
---
0000_README | 4 +
1102_linux-3.4.103.patch | 1133 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1137 insertions(+)
diff --git a/0000_README b/0000_README
index 4747723..9f3e940 100644
--- a/0000_README
+++ b/0000_README
@@ -447,6 +447,10 @@ Patch: 1101_linux-3.4.102.patch
From: http://www.kernel.org
Desc: Linux 3.4.102
+Patch: 1102_linux-3.4.103.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.103
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1102_linux-3.4.103.patch b/1102_linux-3.4.103.patch
new file mode 100644
index 0000000..8d0b2b8
--- /dev/null
+++ b/1102_linux-3.4.103.patch
@@ -0,0 +1,1133 @@
+diff --git a/Makefile b/Makefile
+index dd03fa5777a0..36f0913bd1d6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 102
++SUBLEVEL = 103
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index 656de8bc0ed6..cd24caf1732d 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -24,7 +24,8 @@
+
+ /* The kernel image occupies 0x4000000 to 0x6000000 (4MB --> 96MB).
+ * The page copy blockops can use 0x6000000 to 0x8000000.
+- * The TSB is mapped in the 0x8000000 to 0xa000000 range.
++ * The 8K TSB is mapped in the 0x8000000 to 0x8400000 range.
++ * The 4M TSB is mapped in the 0x8400000 to 0x8800000 range.
+ * The PROM resides in an area spanning 0xf0000000 to 0x100000000.
+ * The vmalloc area spans 0x100000000 to 0x200000000.
+ * Since modules need to be in the lowest 32-bits of the address space,
+@@ -33,7 +34,8 @@
+ * 0x400000000.
+ */
+ #define TLBTEMP_BASE _AC(0x0000000006000000,UL)
+-#define TSBMAP_BASE _AC(0x0000000008000000,UL)
++#define TSBMAP_8K_BASE _AC(0x0000000008000000,UL)
++#define TSBMAP_4M_BASE _AC(0x0000000008400000,UL)
+ #define MODULES_VADDR _AC(0x0000000010000000,UL)
+ #define MODULES_LEN _AC(0x00000000e0000000,UL)
+ #define MODULES_END _AC(0x00000000f0000000,UL)
+diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
+index f0d6a9700f4c..1a4bb971e06d 100644
+--- a/arch/sparc/include/asm/tlbflush_64.h
++++ b/arch/sparc/include/asm/tlbflush_64.h
+@@ -35,6 +35,8 @@ static inline void flush_tlb_range(struct vm_area_struct *vma,
+ {
+ }
+
++void flush_tlb_kernel_range(unsigned long start, unsigned long end);
++
+ #define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
+
+ extern void flush_tlb_pending(void);
+@@ -49,11 +51,6 @@ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
+
+ #ifndef CONFIG_SMP
+
+-#define flush_tlb_kernel_range(start,end) \
+-do { flush_tsb_kernel_range(start,end); \
+- __flush_tlb_kernel_range(start,end); \
+-} while (0)
+-
+ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
+ {
+ __flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
+@@ -64,11 +61,6 @@ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vad
+ extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
+ extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
+
+-#define flush_tlb_kernel_range(start, end) \
+-do { flush_tsb_kernel_range(start,end); \
+- smp_flush_tlb_kernel_range(start, end); \
+-} while (0)
+-
+ #define global_flush_tlb_page(mm, vaddr) \
+ smp_flush_tlb_page(mm, vaddr)
+
+diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
+index 435e406fdec3..1beaf60a5f78 100644
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1339,7 +1339,7 @@ int ldc_connect(struct ldc_channel *lp)
+ if (!(lp->flags & LDC_FLAG_ALLOCED_QUEUES) ||
+ !(lp->flags & LDC_FLAG_REGISTERED_QUEUES) ||
+ lp->hs_state != LDC_HS_OPEN)
+- err = -EINVAL;
++ err = ((lp->hs_state > LDC_HS_OPEN) ? 0 : -EINVAL);
+ else
+ err = start_handshake(lp);
+
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index bb2886ac1df3..bbf7e955cb19 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -151,7 +151,7 @@ void cpu_panic(void)
+ #define NUM_ROUNDS 64 /* magic value */
+ #define NUM_ITERS 5 /* likewise */
+
+-static DEFINE_SPINLOCK(itc_sync_lock);
++static DEFINE_RAW_SPINLOCK(itc_sync_lock);
+ static unsigned long go[SLAVE + 1];
+
+ #define DEBUG_TICK_SYNC 0
+@@ -259,7 +259,7 @@ static void smp_synchronize_one_tick(int cpu)
+ go[MASTER] = 0;
+ membar_safe("#StoreLoad");
+
+- spin_lock_irqsave(&itc_sync_lock, flags);
++ raw_spin_lock_irqsave(&itc_sync_lock, flags);
+ {
+ for (i = 0; i < NUM_ROUNDS*NUM_ITERS; i++) {
+ while (!go[MASTER])
+@@ -270,7 +270,7 @@ static void smp_synchronize_one_tick(int cpu)
+ membar_safe("#StoreLoad");
+ }
+ }
+- spin_unlock_irqrestore(&itc_sync_lock, flags);
++ raw_spin_unlock_irqrestore(&itc_sync_lock, flags);
+ }
+
+ #if defined(CONFIG_SUN_LDOMS) && defined(CONFIG_HOTPLUG_CPU)
+diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
+index d97f3eb72e06..085c60fd4b6b 100644
+--- a/arch/sparc/kernel/sys32.S
++++ b/arch/sparc/kernel/sys32.S
+@@ -87,7 +87,7 @@ SIGN1(sys32_io_submit, compat_sys_io_submit, %o1)
+ SIGN1(sys32_mq_open, compat_sys_mq_open, %o1)
+ SIGN1(sys32_select, compat_sys_select, %o0)
+ SIGN1(sys32_mkdir, sys_mkdir, %o1)
+-SIGN3(sys32_futex, compat_sys_futex, %o1, %o2, %o5)
++SIGN1(sys32_futex, compat_sys_futex, %o1)
+ SIGN1(sys32_sysfs, compat_sys_sysfs, %o0)
+ SIGN2(sys32_sendfile, compat_sys_sendfile, %o0, %o1)
+ SIGN2(sys32_sendfile64, compat_sys_sendfile64, %o0, %o1)
+diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
+index dae85bc2eda5..a3c3a5bcd126 100644
+--- a/arch/sparc/kernel/unaligned_64.c
++++ b/arch/sparc/kernel/unaligned_64.c
+@@ -156,17 +156,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
+ unsigned long compute_effective_address(struct pt_regs *regs,
+ unsigned int insn, unsigned int rd)
+ {
++ int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
+ unsigned int rs1 = (insn >> 14) & 0x1f;
+ unsigned int rs2 = insn & 0x1f;
+- int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
++ unsigned long addr;
+
+ if (insn & 0x2000) {
+ maybe_flush_windows(rs1, 0, rd, from_kernel);
+- return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
++ addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
+ } else {
+ maybe_flush_windows(rs1, rs2, rd, from_kernel);
+- return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
++ addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
+ }
++
++ if (!from_kernel && test_thread_flag(TIF_32BIT))
++ addr &= 0xffffffff;
++
++ return addr;
+ }
+
+ /* This is just to make gcc think die_if_kernel does return... */
+diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
+index 0aed75653b50..e993fc8d7c66 100644
+--- a/arch/sparc/lib/NG2memcpy.S
++++ b/arch/sparc/lib/NG2memcpy.S
+@@ -236,6 +236,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ */
+ VISEntryHalf
+
++ membar #Sync
+ alignaddr %o1, %g0, %g0
+
+ add %o1, (64 - 1), %o4
+diff --git a/arch/sparc/math-emu/math_32.c b/arch/sparc/math-emu/math_32.c
+index aa4d55b0bdf0..5ce8f2f64604 100644
+--- a/arch/sparc/math-emu/math_32.c
++++ b/arch/sparc/math-emu/math_32.c
+@@ -499,7 +499,7 @@ static int do_one_mathemu(u32 insn, unsigned long *pfsr, unsigned long *fregs)
+ case 0: fsr = *pfsr;
+ if (IR == -1) IR = 2;
+ /* fcc is always fcc0 */
+- fsr &= ~0xc00; fsr |= (IR << 10); break;
++ fsr &= ~0xc00; fsr |= (IR << 10);
+ *pfsr = fsr;
+ break;
+ case 1: rd->s = IR; break;
+diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
+index 1fe0429b6314..1387acafc62c 100644
+--- a/arch/sparc/mm/fault_64.c
++++ b/arch/sparc/mm/fault_64.c
+@@ -95,38 +95,51 @@ static unsigned int get_user_insn(unsigned long tpc)
+ pte_t *ptep, pte;
+ unsigned long pa;
+ u32 insn = 0;
+- unsigned long pstate;
+
+- if (pgd_none(*pgdp))
+- goto outret;
++ if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
++ goto out;
+ pudp = pud_offset(pgdp, tpc);
+- if (pud_none(*pudp))
+- goto outret;
+- pmdp = pmd_offset(pudp, tpc);
+- if (pmd_none(*pmdp))
+- goto outret;
+-
+- /* This disables preemption for us as well. */
+- __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
+- __asm__ __volatile__("wrpr %0, %1, %%pstate"
+- : : "r" (pstate), "i" (PSTATE_IE));
+- ptep = pte_offset_map(pmdp, tpc);
+- pte = *ptep;
+- if (!pte_present(pte))
++ if (pud_none(*pudp) || unlikely(pud_bad(*pudp)))
+ goto out;
+
+- pa = (pte_pfn(pte) << PAGE_SHIFT);
+- pa += (tpc & ~PAGE_MASK);
+-
+- /* Use phys bypass so we don't pollute dtlb/dcache. */
+- __asm__ __volatile__("lduwa [%1] %2, %0"
+- : "=r" (insn)
+- : "r" (pa), "i" (ASI_PHYS_USE_EC));
++ /* This disables preemption for us as well. */
++ local_irq_disable();
+
++ pmdp = pmd_offset(pudp, tpc);
++ if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp)))
++ goto out_irq_enable;
++
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++ if (pmd_trans_huge(*pmdp)) {
++ if (pmd_trans_splitting(*pmdp))
++ goto out_irq_enable;
++
++ pa = pmd_pfn(*pmdp) << PAGE_SHIFT;
++ pa += tpc & ~HPAGE_MASK;
++
++ /* Use phys bypass so we don't pollute dtlb/dcache. */
++ __asm__ __volatile__("lduwa [%1] %2, %0"
++ : "=r" (insn)
++ : "r" (pa), "i" (ASI_PHYS_USE_EC));
++ } else
++#endif
++ {
++ ptep = pte_offset_map(pmdp, tpc);
++ pte = *ptep;
++ if (pte_present(pte)) {
++ pa = (pte_pfn(pte) << PAGE_SHIFT);
++ pa += (tpc & ~PAGE_MASK);
++
++ /* Use phys bypass so we don't pollute dtlb/dcache. */
++ __asm__ __volatile__("lduwa [%1] %2, %0"
++ : "=r" (insn)
++ : "r" (pa), "i" (ASI_PHYS_USE_EC));
++ }
++ pte_unmap(ptep);
++ }
++out_irq_enable:
++ local_irq_enable();
+ out:
+- pte_unmap(ptep);
+- __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
+-outret:
+ return insn;
+ }
+
+@@ -154,7 +167,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
+ extern unsigned long compute_effective_address(struct pt_regs *, unsigned int, unsigned int);
+
+ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
+- unsigned int insn, int fault_code)
++ unsigned long fault_addr, unsigned int insn,
++ int fault_code)
+ {
+ unsigned long addr;
+ siginfo_t info;
+@@ -162,10 +176,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
+ info.si_code = code;
+ info.si_signo = sig;
+ info.si_errno = 0;
+- if (fault_code & FAULT_CODE_ITLB)
++ if (fault_code & FAULT_CODE_ITLB) {
+ addr = regs->tpc;
+- else
+- addr = compute_effective_address(regs, insn, 0);
++ } else {
++ /* If we were able to probe the faulting instruction, use it
++ * to compute a precise fault address. Otherwise use the fault
++ * time provided address which may only have page granularity.
++ */
++ if (insn)
++ addr = compute_effective_address(regs, insn, 0);
++ else
++ addr = fault_addr;
++ }
+ info.si_addr = (void __user *) addr;
+ info.si_trapno = 0;
+
+@@ -240,7 +262,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code,
+ /* The si_code was set to make clear whether
+ * this was a SEGV_MAPERR or SEGV_ACCERR fault.
+ */
+- do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code);
++ do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code);
+ return;
+ }
+
+@@ -260,18 +282,6 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs)
+ show_regs(regs);
+ }
+
+-static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
+- unsigned long addr)
+-{
+- static int times;
+-
+- if (times++ < 10)
+- printk(KERN_ERR "FAULT[%s:%d]: 32-bit process "
+- "reports 64-bit fault address [%lx]\n",
+- current->comm, current->pid, addr);
+- show_regs(regs);
+-}
+-
+ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ {
+ struct mm_struct *mm = current->mm;
+@@ -300,10 +310,8 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ goto intr_or_no_mm;
+ }
+ }
+- if (unlikely((address >> 32) != 0)) {
+- bogus_32bit_fault_address(regs, address);
++ if (unlikely((address >> 32) != 0))
+ goto intr_or_no_mm;
+- }
+ }
+
+ if (regs->tstate & TSTATE_PRIV) {
+@@ -515,7 +523,7 @@ do_sigbus:
+ * Send a sigbus, regardless of whether we were in kernel
+ * or user mode.
+ */
+- do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code);
++ do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code);
+
+ /* Kernel mode? Handle exceptions or die */
+ if (regs->tstate & TSTATE_PRIV)
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 7f8238f4f954..7eb24bddf268 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -308,6 +308,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *
+ tsb_index = MM_TSB_BASE;
+ tsb_hash_shift = PAGE_SHIFT;
+
++ /* Don't insert a non-valid PTE into the TSB, we'll deadlock. */
++ if (!(pte_val(pte) & _PAGE_VALID))
++ return;
++
+ spin_lock_irqsave(&mm->context.lock, flags);
+
+ #ifdef CONFIG_HUGETLB_PAGE
+@@ -2417,3 +2421,26 @@ void __flush_tlb_all(void)
+ __asm__ __volatile__("wrpr %0, 0, %%pstate"
+ : : "r" (pstate));
+ }
++
++#ifdef CONFIG_SMP
++#define do_flush_tlb_kernel_range smp_flush_tlb_kernel_range
++#else
++#define do_flush_tlb_kernel_range __flush_tlb_kernel_range
++#endif
++
++void flush_tlb_kernel_range(unsigned long start, unsigned long end)
++{
++ if (start < HI_OBP_ADDRESS && end > LOW_OBP_ADDRESS) {
++ if (start < LOW_OBP_ADDRESS) {
++ flush_tsb_kernel_range(start, LOW_OBP_ADDRESS);
++ do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS);
++ }
++ if (end > HI_OBP_ADDRESS) {
++ flush_tsb_kernel_range(end, HI_OBP_ADDRESS);
++ do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS);
++ }
++ } else {
++ flush_tsb_kernel_range(start, end);
++ do_flush_tlb_kernel_range(start, end);
++ }
++}
+diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
+index f4e84f3440dd..41530193e6d6 100644
+--- a/arch/sparc/mm/tsb.c
++++ b/arch/sparc/mm/tsb.c
+@@ -150,7 +150,19 @@ static void setup_tsb_params(struct mm_struct *mm, unsigned long tsb_idx, unsign
+ mm->context.tsb_block[tsb_idx].tsb_nentries =
+ tsb_bytes / sizeof(struct tsb);
+
+- base = TSBMAP_BASE;
++ switch (tsb_idx) {
++ case MM_TSB_BASE:
++ base = TSBMAP_8K_BASE;
++ break;
++#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
++ case MM_TSB_HUGE:
++ base = TSBMAP_4M_BASE;
++ break;
++#endif
++ default:
++ BUG();
++ }
++
+ tte = pgprot_val(PAGE_KERNEL_LOCKED);
+ tsb_paddr = __pa(mm->context.tsb_block[tsb_idx].tsb);
+ BUG_ON(tsb_paddr & (tsb_bytes - 1UL));
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index c4bb95b051f3..6749acf6f3f4 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -455,6 +455,7 @@ static int macvlan_init(struct net_device *dev)
+ (lowerdev->state & MACVLAN_STATE_MASK);
+ dev->features = lowerdev->features & MACVLAN_FEATURES;
+ dev->features |= NETIF_F_LLTX;
++ dev->vlan_features = lowerdev->vlan_features & MACVLAN_FEATURES;
+ dev->gso_max_size = lowerdev->gso_max_size;
+ dev->iflink = lowerdev->ifindex;
+ dev->hard_header_len = lowerdev->hard_header_len;
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 8327cc596c34..9f047a04215e 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ nf_reset(skb);
+
+ skb->ip_summed = CHECKSUM_NONE;
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+ ip_send_check(iph);
+
+ ip_local_out(skb);
+diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
+index 160e7510aca6..0787b9756165 100644
+--- a/drivers/sbus/char/bbc_envctrl.c
++++ b/drivers/sbus/char/bbc_envctrl.c
+@@ -452,6 +452,9 @@ static void attach_one_temp(struct bbc_i2c_bus *bp, struct platform_device *op,
+ if (!tp)
+ return;
+
++ INIT_LIST_HEAD(&tp->bp_list);
++ INIT_LIST_HEAD(&tp->glob_list);
++
+ tp->client = bbc_i2c_attach(bp, op);
+ if (!tp->client) {
+ kfree(tp);
+@@ -497,6 +500,9 @@ static void attach_one_fan(struct bbc_i2c_bus *bp, struct platform_device *op,
+ if (!fp)
+ return;
+
++ INIT_LIST_HEAD(&fp->bp_list);
++ INIT_LIST_HEAD(&fp->glob_list);
++
+ fp->client = bbc_i2c_attach(bp, op);
+ if (!fp->client) {
+ kfree(fp);
+diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
+index 542668292900..7179f72b11ea 100644
+--- a/drivers/sbus/char/bbc_i2c.c
++++ b/drivers/sbus/char/bbc_i2c.c
+@@ -301,13 +301,18 @@ static struct bbc_i2c_bus * __init attach_one_i2c(struct platform_device *op, in
+ if (!bp)
+ return NULL;
+
++ INIT_LIST_HEAD(&bp->temps);
++ INIT_LIST_HEAD(&bp->fans);
++
+ bp->i2c_control_regs = of_ioremap(&op->resource[0], 0, 0x2, "bbc_i2c_regs");
+ if (!bp->i2c_control_regs)
+ goto fail;
+
+- bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
+- if (!bp->i2c_bussel_reg)
+- goto fail;
++ if (op->num_resources == 2) {
++ bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
++ if (!bp->i2c_bussel_reg)
++ goto fail;
++ }
+
+ bp->waiting = 0;
+ init_waitqueue_head(&bp->wq);
+diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
+index f0d93eb7e6ec..c9549aa135b2 100644
+--- a/drivers/tty/serial/sunsab.c
++++ b/drivers/tty/serial/sunsab.c
+@@ -157,6 +157,15 @@ receive_chars(struct uart_sunsab_port *up,
+ (up->port.line == up->port.cons->index))
+ saw_console_brk = 1;
+
++ if (count == 0) {
++ if (unlikely(stat->sreg.isr1 & SAB82532_ISR1_BRK)) {
++ stat->sreg.isr0 &= ~(SAB82532_ISR0_PERR |
++ SAB82532_ISR0_FERR);
++ up->port.icount.brk++;
++ uart_handle_break(&up->port);
++ }
++ }
++
+ for (i = 0; i < count; i++) {
+ unsigned char ch = buf[i], flag;
+
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 2d643649f0f8..168d30dfe807 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -46,13 +46,12 @@ struct inet_peer {
+ };
+ /*
+ * Once inet_peer is queued for deletion (refcnt == -1), following fields
+- * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
++ * are not available: rid, tcp_ts, tcp_ts_stamp
+ * We can share memory with rcu_head to help keep inet_peer small.
+ */
+ union {
+ struct {
+ atomic_t rid; /* Frag reception counter */
+- atomic_t ip_id_count; /* IP ID for the next packet */
+ __u32 tcp_ts;
+ __u32 tcp_ts_stamp;
+ };
+@@ -102,7 +101,7 @@ extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
+ extern void inetpeer_invalidate_tree(int family);
+
+ /*
+- * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
++ * temporary check to make sure we dont access rid, tcp_ts,
+ * tcp_ts_stamp if no refcount is taken on inet_peer
+ */
+ static inline void inet_peer_refcheck(const struct inet_peer *p)
+@@ -110,13 +109,4 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
+ WARN_ON_ONCE(atomic_read(&p->refcnt) <= 0);
+ }
+
+-
+-/* can be called with or without local BH being disabled */
+-static inline int inet_getid(struct inet_peer *p, int more)
+-{
+- more++;
+- inet_peer_refcheck(p);
+- return atomic_add_return(more, &p->ip_id_count) - more;
+-}
+-
+ #endif /* _NET_INETPEER_H */
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 6d6b12f4753c..34d004892143 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -264,9 +264,10 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
+ !(dst_metric_locked(dst, RTAX_MTU)));
+ }
+
+-extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
++u32 ip_idents_reserve(u32 hash, int segs);
++void __ip_select_ident(struct iphdr *iph, int segs);
+
+-static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
++static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
+ {
+ struct iphdr *iph = ip_hdr(skb);
+
+@@ -276,24 +277,20 @@ static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, s
+ * does not change, they drop every other packet in
+ * a TCP stream using header compression.
+ */
+- iph->id = (sk && inet_sk(sk)->inet_daddr) ?
+- htons(inet_sk(sk)->inet_id++) : 0;
+- } else
+- __ip_select_ident(iph, dst, 0);
+-}
+-
+-static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
+-{
+- struct iphdr *iph = ip_hdr(skb);
+-
+- if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
+ if (sk && inet_sk(sk)->inet_daddr) {
+ iph->id = htons(inet_sk(sk)->inet_id);
+- inet_sk(sk)->inet_id += 1 + more;
+- } else
++ inet_sk(sk)->inet_id += segs;
++ } else {
+ iph->id = 0;
+- } else
+- __ip_select_ident(iph, dst, more);
++ }
++ } else {
++ __ip_select_ident(iph, segs);
++ }
++}
++
++static inline void ip_select_ident(struct sk_buff *skb, struct sock *sk)
++{
++ ip_select_ident_segs(skb, sk, 1);
+ }
+
+ /*
+diff --git a/include/net/ipip.h b/include/net/ipip.h
+index 4dccfe3bf731..e8ee3bb1b1ca 100644
+--- a/include/net/ipip.h
++++ b/include/net/ipip.h
+@@ -50,7 +50,7 @@ struct ip_tunnel_prl_entry {
+ int pkt_len = skb->len - skb_transport_offset(skb); \
+ \
+ skb->ip_summed = CHECKSUM_NONE; \
+- ip_select_ident(skb, &rt->dst, NULL); \
++ ip_select_ident(skb, NULL); \
+ \
+ err = ip_local_out(skb); \
+ if (likely(net_xmit_eval(err) == 0)) { \
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index fa7af9183dc9..117eaa578d0d 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -392,14 +392,19 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a);
+ int ip6_frag_match(struct inet_frag_queue *q, void *a);
+
+ /* more secured version of ipv6_addr_hash() */
+-static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval)
+ {
+ u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+
+ return jhash_3words(v,
+ (__force u32)a->s6_addr32[2],
+ (__force u32)a->s6_addr32[3],
+- ipv6_hash_secret);
++ initval);
++}
++
++static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++{
++ return __ipv6_addr_jhash(a, ipv6_hash_secret);
+ }
+
+ static inline int ipv6_addr_any(const struct in6_addr *a)
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index c2e542b27a5a..b1c3d1c63c4e 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -3,8 +3,6 @@
+
+ #include <linux/types.h>
+
+-extern __u32 secure_ip_id(__be32 daddr);
+-extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+ extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+ extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ __be16 dport);
+diff --git a/net/compat.c b/net/compat.c
+index 93f542335e19..2c774d889d39 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -85,7 +85,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ {
+ int tot_len;
+
+- if (kern_msg->msg_namelen) {
++ if (kern_msg->msg_name && kern_msg->msg_namelen) {
+ if (mode == VERIFY_READ) {
+ int err = move_addr_to_kernel(kern_msg->msg_name,
+ kern_msg->msg_namelen,
+@@ -93,10 +93,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ if (err < 0)
+ return err;
+ }
+- if (kern_msg->msg_name)
+- kern_msg->msg_name = kern_address;
+- } else
++ kern_msg->msg_name = kern_address;
++ } else {
+ kern_msg->msg_name = NULL;
++ kern_msg->msg_namelen = 0;
++ }
+
+ tot_len = iov_from_user_compat_to_kern(kern_iov,
+ (struct compat_iovec __user *)kern_msg->msg_iov,
+diff --git a/net/core/iovec.c b/net/core/iovec.c
+index 7fd34a56aeb3..d1628b79286b 100644
+--- a/net/core/iovec.c
++++ b/net/core/iovec.c
+@@ -39,7 +39,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
+ {
+ int size, ct, err;
+
+- if (m->msg_namelen) {
++ if (m->msg_name && m->msg_namelen) {
+ if (mode == VERIFY_READ) {
+ void __user *namep;
+ namep = (void __user __force *) m->msg_name;
+@@ -48,10 +48,10 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
+ if (err < 0)
+ return err;
+ }
+- if (m->msg_name)
+- m->msg_name = address;
++ m->msg_name = address;
+ } else {
+ m->msg_name = NULL;
++ m->msg_namelen = 0;
+ }
+
+ size = m->msg_iovlen * sizeof(struct iovec);
+@@ -157,6 +157,10 @@ EXPORT_SYMBOL(memcpy_fromiovec);
+ int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+ int offset, int len)
+ {
++ /* No data? Done! */
++ if (len == 0)
++ return 0;
++
+ /* Skip over the finished iovecs */
+ while (offset >= iov->iov_len) {
+ offset -= iov->iov_len;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index 99b2596531bb..6ecbd58418b3 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -79,29 +79,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ #endif
+
+ #ifdef CONFIG_INET
+-__u32 secure_ip_id(__be32 daddr)
+-{
+- u32 hash[MD5_DIGEST_WORDS];
+-
+- hash[0] = (__force __u32) daddr;
+- hash[1] = net_secret[13];
+- hash[2] = net_secret[14];
+- hash[3] = net_secret[15];
+-
+- md5_transform(hash, net_secret);
+-
+- return hash[0];
+-}
+-
+-__u32 secure_ipv6_id(const __be32 daddr[4])
+-{
+- __u32 hash[4];
+-
+- memcpy(hash, daddr, 16);
+- md5_transform(hash, net_secret);
+-
+- return hash[0];
+-}
+
+ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+ __be16 sport, __be16 dport)
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 8de819475378..728f49babfe0 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2748,7 +2748,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+ tail = nskb;
+
+ __copy_skb_header(nskb, skb);
+- nskb->mac_len = skb->mac_len;
+
+ /* nskb and skb might have different headroom */
+ if (nskb->ip_summed == CHECKSUM_PARTIAL)
+@@ -2758,6 +2757,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+ skb_set_network_header(nskb, skb->mac_len);
+ nskb->transport_header = (nskb->network_header +
+ skb_network_header_len(skb));
++ skb_reset_mac_len(nskb);
+ skb_copy_from_linear_data(skb, nskb->data, doffset);
+
+ if (fskb != skb_shinfo(skb)->frag_list)
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 3f0bb3b3819d..782467708c10 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -343,7 +343,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
+ pip->saddr = fl4.saddr;
+ pip->protocol = IPPROTO_IGMP;
+ pip->tot_len = 0; /* filled in later */
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+ ((u8*)&pip[1])[0] = IPOPT_RA;
+ ((u8*)&pip[1])[1] = 4;
+ ((u8*)&pip[1])[2] = 0;
+@@ -687,7 +687,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
+ iph->daddr = dst;
+ iph->saddr = fl4.saddr;
+ iph->protocol = IPPROTO_IGMP;
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+ ((u8*)&iph[1])[0] = IPOPT_RA;
+ ((u8*)&iph[1])[1] = 4;
+ ((u8*)&iph[1])[2] = 0;
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index d63a9268cff6..db1b6a73e0ff 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -26,20 +26,7 @@
+ * Theory of operations.
+ * We keep one entry for each peer IP address. The nodes contains long-living
+ * information about the peer which doesn't depend on routes.
+- * At this moment this information consists only of ID field for the next
+- * outgoing IP packet. This field is incremented with each packet as encoded
+- * in inet_getid() function (include/net/inetpeer.h).
+- * At the moment of writing this notes identifier of IP packets is generated
+- * to be unpredictable using this code only for packets subjected
+- * (actually or potentially) to defragmentation. I.e. DF packets less than
+- * PMTU in size when local fragmentation is disabled use a constant ID and do
+- * not use this code (see ip_select_ident() in include/net/ip.h).
+ *
+- * Route cache entries hold references to our nodes.
+- * New cache entries get references via lookup by destination IP address in
+- * the avl tree. The reference is grabbed only when it's needed i.e. only
+- * when we try to output IP packet which needs an unpredictable ID (see
+- * __ip_select_ident() in net/ipv4/route.c).
+ * Nodes are removed only when reference counter goes to 0.
+ * When it's happened the node may be removed when a sufficient amount of
+ * time has been passed since its last use. The less-recently-used entry can
+@@ -62,7 +49,6 @@
+ * refcnt: atomically against modifications on other CPU;
+ * usually under some other lock to prevent node disappearing
+ * daddr: unchangeable
+- * ip_id_count: atomic value (no lock needed)
+ */
+
+ static struct kmem_cache *peer_cachep __read_mostly;
+@@ -488,10 +474,6 @@ relookup:
+ p->daddr = *daddr;
+ atomic_set(&p->refcnt, 1);
+ atomic_set(&p->rid, 0);
+- atomic_set(&p->ip_id_count,
+- (daddr->family == AF_INET) ?
+- secure_ip_id(daddr->addr.a4) :
+- secure_ipv6_id(daddr->addr.a6));
+ p->tcp_ts_stamp = 0;
+ p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
+ p->rate_tokens = 0;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index d6407b563fd8..7827436ae843 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -161,7 +161,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
+ iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
+ iph->saddr = saddr;
+ iph->protocol = sk->sk_protocol;
+- ip_select_ident(skb, &rt->dst, sk);
++ ip_select_ident(skb, sk);
+
+ if (opt && opt->opt.optlen) {
+ iph->ihl += opt->opt.optlen>>2;
+@@ -403,8 +403,7 @@ packet_routed:
+ ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
+ }
+
+- ip_select_ident_more(skb, &rt->dst, sk,
+- (skb_shinfo(skb)->gso_segs ?: 1) - 1);
++ ip_select_ident_segs(skb, sk, skb_shinfo(skb)->gso_segs ?: 1);
+
+ skb->priority = sk->sk_priority;
+ skb->mark = sk->sk_mark;
+@@ -1347,7 +1346,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ iph->ihl = 5;
+ iph->tos = inet->tos;
+ iph->frag_off = df;
+- ip_select_ident(skb, &rt->dst, sk);
++ ip_select_ident(skb, sk);
+ iph->ttl = ttl;
+ iph->protocol = sk->sk_protocol;
+ ip_copy_addrs(iph, fl4);
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 94cd1ef1e319..5ccef6e06dc5 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1576,7 +1576,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
+ iph->protocol = IPPROTO_IPIP;
+ iph->ihl = 5;
+ iph->tot_len = htons(skb->len);
+- ip_select_ident(skb, skb_dst(skb), NULL);
++ ip_select_ident(skb, NULL);
+ ip_send_check(iph);
+
+ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 48c6ebcb7fe0..c1b3970caa68 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -384,7 +384,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
+ iph->check = 0;
+ iph->tot_len = htons(length);
+ if (!iph->id)
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+
+ iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
+ }
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 90bc88bbd2a4..fd6843371f2e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1341,46 +1341,53 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
+ rt->rt_peer_genid = rt_peer_genid();
+ }
+
+-/*
+- * Peer allocation may fail only in serious out-of-memory conditions. However
+- * we still can generate some output.
+- * Random ID selection looks a bit dangerous because we have no chances to
+- * select ID being unique in a reasonable period of time.
+- * But broken packet identifier may be better than no packet at all.
++#define IP_IDENTS_SZ 2048u
++struct ip_ident_bucket {
++ atomic_t id;
++ u32 stamp32;
++};
++
++static struct ip_ident_bucket *ip_idents __read_mostly;
++
++/* In order to protect privacy, we add a perturbation to identifiers
++ * if one generator is seldom used. This makes hard for an attacker
++ * to infer how many packets were sent between two points in time.
+ */
+-static void ip_select_fb_ident(struct iphdr *iph)
++u32 ip_idents_reserve(u32 hash, int segs)
+ {
+- static DEFINE_SPINLOCK(ip_fb_id_lock);
+- static u32 ip_fallback_id;
+- u32 salt;
++ struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
++ u32 old = ACCESS_ONCE(bucket->stamp32);
++ u32 now = (u32)jiffies;
++ u32 delta = 0;
++
++ if (old != now && cmpxchg(&bucket->stamp32, old, now) == old) {
++ u64 x = random32();
++
++ x *= (now - old);
++ delta = (u32)(x >> 32);
++ }
+
+- spin_lock_bh(&ip_fb_id_lock);
+- salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr);
+- iph->id = htons(salt & 0xFFFF);
+- ip_fallback_id = salt;
+- spin_unlock_bh(&ip_fb_id_lock);
++ return atomic_add_return(segs + delta, &bucket->id) - segs;
+ }
++EXPORT_SYMBOL(ip_idents_reserve);
+
+-void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
++void __ip_select_ident(struct iphdr *iph, int segs)
+ {
+- struct rtable *rt = (struct rtable *) dst;
+-
+- if (rt && !(rt->dst.flags & DST_NOPEER)) {
+- if (rt->peer == NULL)
+- rt_bind_peer(rt, rt->rt_dst, 1);
++ static u32 ip_idents_hashrnd __read_mostly;
++ static bool hashrnd_initialized = false;
++ u32 hash, id;
+
+- /* If peer is attached to destination, it is never detached,
+- so that we need not to grab a lock to dereference it.
+- */
+- if (rt->peer) {
+- iph->id = htons(inet_getid(rt->peer, more));
+- return;
+- }
+- } else if (!rt)
+- printk(KERN_DEBUG "rt_bind_peer(0) @%p\n",
+- __builtin_return_address(0));
++ if (unlikely(!hashrnd_initialized)) {
++ hashrnd_initialized = true;
++ get_random_bytes(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
++ }
+
+- ip_select_fb_ident(iph);
++ hash = jhash_3words((__force u32)iph->daddr,
++ (__force u32)iph->saddr,
++ iph->protocol,
++ ip_idents_hashrnd);
++ id = ip_idents_reserve(hash, segs);
++ iph->id = htons(id);
+ }
+ EXPORT_SYMBOL(__ip_select_ident);
+
+@@ -3009,7 +3016,6 @@ static int rt_fill_info(struct net *net,
+ error = rt->dst.error;
+ if (peer) {
+ inet_peer_refcheck(rt->peer);
+- id = atomic_read(&peer->ip_id_count) & 0xffff;
+ if (peer->tcp_ts_stamp) {
+ ts = peer->tcp_ts;
+ tsage = get_seconds() - peer->tcp_ts_stamp;
+@@ -3441,6 +3447,12 @@ int __init ip_rt_init(void)
+ {
+ int rc = 0;
+
++ ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
++ if (!ip_idents)
++ panic("IP: failed to allocate ip_idents\n");
++
++ get_random_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++
+ #ifdef CONFIG_IP_ROUTE_CLASSID
+ ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
+ if (!ip_rt_acct)
+diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
+index 80fa2bfd7ede..c042e529a11e 100644
+--- a/net/ipv4/tcp_vegas.c
++++ b/net/ipv4/tcp_vegas.c
+@@ -218,7 +218,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+ * This is:
+ * (actual rate in segments) * baseRTT
+ */
+- target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
++ target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT;
++ do_div(target_cwnd, rtt);
+
+ /* Calculate the difference between the window we had,
+ * and the window we would like to have. This quantity
+diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
+index ac43cd747bce..b4d1858be550 100644
+--- a/net/ipv4/tcp_veno.c
++++ b/net/ipv4/tcp_veno.c
+@@ -144,7 +144,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+
+ rtt = veno->minrtt;
+
+- target_cwnd = (tp->snd_cwnd * veno->basertt);
++ target_cwnd = (u64)tp->snd_cwnd * veno->basertt;
+ target_cwnd <<= V_PARAM_SHIFT;
+ do_div(target_cwnd, rtt);
+
+diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
+index 938553efbf8e..5531eb2a56a5 100644
+--- a/net/ipv4/xfrm4_mode_tunnel.c
++++ b/net/ipv4/xfrm4_mode_tunnel.c
+@@ -54,12 +54,12 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
+
+ top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
+ 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
+- ip_select_ident(skb, dst->child, NULL);
+
+ top_iph->ttl = ip4_dst_hoplimit(dst->child);
+
+ top_iph->saddr = x->props.saddr.a4;
+ top_iph->daddr = x->id.daddr.a4;
++ ip_select_ident(skb, NULL);
+
+ return 0;
+ }
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 6225b7cf12b9..2bf7916c816f 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -599,22 +599,19 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+
+ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+ {
+- static atomic_t ipv6_fragmentation_id;
+- int ident;
++ static u32 ip6_idents_hashrnd __read_mostly;
++ static bool hashrnd_initialized = false;
++ u32 hash, id;
+
+- if (rt && !(rt->dst.flags & DST_NOPEER)) {
+- struct inet_peer *peer;
+-
+- if (!rt->rt6i_peer)
+- rt6_bind_peer(rt, 1);
+- peer = rt->rt6i_peer;
+- if (peer) {
+- fhdr->identification = htonl(inet_getid(peer, 0));
+- return;
+- }
++ if (unlikely(!hashrnd_initialized)) {
++ hashrnd_initialized = true;
++ get_random_bytes(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+ }
+- ident = atomic_inc_return(&ipv6_fragmentation_id);
+- fhdr->identification = htonl(ident);
++ hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
++ hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
++
++ id = ip_idents_reserve(hash, 1);
++ fhdr->identification = htonl(id);
+ }
+
+ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index ec78ab63dd46..559d307163b1 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -853,7 +853,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+ iph->daddr = cp->daddr.ip;
+ iph->saddr = saddr;
+ iph->ttl = old_iph->ttl;
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+
+ /* Another hack: avoid icmp_send in ip_fragment */
+ skb->local_df = 1;
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 25b207b3ffe4..da54d2922f51 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1188,6 +1188,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
+ asoc->c = new->c;
+ asoc->peer.rwnd = new->peer.rwnd;
+ asoc->peer.sack_needed = new->peer.sack_needed;
++ asoc->peer.auth_capable = new->peer.auth_capable;
+ asoc->peer.i = new->peer.i;
+ sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
+ asoc->peer.i.initial_tsn, GFP_ATOMIC);
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index cf3e22c586a6..5bd9aa93139d 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,7 @@ out:
+ return err;
+ no_route:
+ kfree_skb(nskb);
+- IP_INC_STATS_BH(&init_net, IPSTATS_MIB_OUTNOROUTES);
++ IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+
+ /* FIXME: Returning the 'err' will effect all the associations
+ * associated with a socket, although only one of the paths of the
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
2014-08-19 11:41 Mike Pagano
@ 2014-08-14 11:44 ` Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-08-14 11:44 UTC (permalink / raw
To: gentoo-commits
commit: b4ff8e8d4d51f14358d6a01bc8ddc449a85729c9
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Aug 14 11:42:09 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Aug 14 11:42:09 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=b4ff8e8d
Linux patch 3.4.103
---
0000_README | 4 +
1102_linux-3.4.103.patch | 1133 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1137 insertions(+)
diff --git a/0000_README b/0000_README
index 4747723..9f3e940 100644
--- a/0000_README
+++ b/0000_README
@@ -447,6 +447,10 @@ Patch: 1101_linux-3.4.102.patch
From: http://www.kernel.org
Desc: Linux 3.4.102
+Patch: 1102_linux-3.4.103.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.103
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1102_linux-3.4.103.patch b/1102_linux-3.4.103.patch
new file mode 100644
index 0000000..8d0b2b8
--- /dev/null
+++ b/1102_linux-3.4.103.patch
@@ -0,0 +1,1133 @@
+diff --git a/Makefile b/Makefile
+index dd03fa5777a0..36f0913bd1d6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 102
++SUBLEVEL = 103
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h
+index 656de8bc0ed6..cd24caf1732d 100644
+--- a/arch/sparc/include/asm/pgtable_64.h
++++ b/arch/sparc/include/asm/pgtable_64.h
+@@ -24,7 +24,8 @@
+
+ /* The kernel image occupies 0x4000000 to 0x6000000 (4MB --> 96MB).
+ * The page copy blockops can use 0x6000000 to 0x8000000.
+- * The TSB is mapped in the 0x8000000 to 0xa000000 range.
++ * The 8K TSB is mapped in the 0x8000000 to 0x8400000 range.
++ * The 4M TSB is mapped in the 0x8400000 to 0x8800000 range.
+ * The PROM resides in an area spanning 0xf0000000 to 0x100000000.
+ * The vmalloc area spans 0x100000000 to 0x200000000.
+ * Since modules need to be in the lowest 32-bits of the address space,
+@@ -33,7 +34,8 @@
+ * 0x400000000.
+ */
+ #define TLBTEMP_BASE _AC(0x0000000006000000,UL)
+-#define TSBMAP_BASE _AC(0x0000000008000000,UL)
++#define TSBMAP_8K_BASE _AC(0x0000000008000000,UL)
++#define TSBMAP_4M_BASE _AC(0x0000000008400000,UL)
+ #define MODULES_VADDR _AC(0x0000000010000000,UL)
+ #define MODULES_LEN _AC(0x00000000e0000000,UL)
+ #define MODULES_END _AC(0x00000000f0000000,UL)
+diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
+index f0d6a9700f4c..1a4bb971e06d 100644
+--- a/arch/sparc/include/asm/tlbflush_64.h
++++ b/arch/sparc/include/asm/tlbflush_64.h
+@@ -35,6 +35,8 @@ static inline void flush_tlb_range(struct vm_area_struct *vma,
+ {
+ }
+
++void flush_tlb_kernel_range(unsigned long start, unsigned long end);
++
+ #define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
+
+ extern void flush_tlb_pending(void);
+@@ -49,11 +51,6 @@ extern void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
+
+ #ifndef CONFIG_SMP
+
+-#define flush_tlb_kernel_range(start,end) \
+-do { flush_tsb_kernel_range(start,end); \
+- __flush_tlb_kernel_range(start,end); \
+-} while (0)
+-
+ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
+ {
+ __flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
+@@ -64,11 +61,6 @@ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vad
+ extern void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
+ extern void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
+
+-#define flush_tlb_kernel_range(start, end) \
+-do { flush_tsb_kernel_range(start,end); \
+- smp_flush_tlb_kernel_range(start, end); \
+-} while (0)
+-
+ #define global_flush_tlb_page(mm, vaddr) \
+ smp_flush_tlb_page(mm, vaddr)
+
+diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
+index 435e406fdec3..1beaf60a5f78 100644
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1339,7 +1339,7 @@ int ldc_connect(struct ldc_channel *lp)
+ if (!(lp->flags & LDC_FLAG_ALLOCED_QUEUES) ||
+ !(lp->flags & LDC_FLAG_REGISTERED_QUEUES) ||
+ lp->hs_state != LDC_HS_OPEN)
+- err = -EINVAL;
++ err = ((lp->hs_state > LDC_HS_OPEN) ? 0 : -EINVAL);
+ else
+ err = start_handshake(lp);
+
+diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
+index bb2886ac1df3..bbf7e955cb19 100644
+--- a/arch/sparc/kernel/smp_64.c
++++ b/arch/sparc/kernel/smp_64.c
+@@ -151,7 +151,7 @@ void cpu_panic(void)
+ #define NUM_ROUNDS 64 /* magic value */
+ #define NUM_ITERS 5 /* likewise */
+
+-static DEFINE_SPINLOCK(itc_sync_lock);
++static DEFINE_RAW_SPINLOCK(itc_sync_lock);
+ static unsigned long go[SLAVE + 1];
+
+ #define DEBUG_TICK_SYNC 0
+@@ -259,7 +259,7 @@ static void smp_synchronize_one_tick(int cpu)
+ go[MASTER] = 0;
+ membar_safe("#StoreLoad");
+
+- spin_lock_irqsave(&itc_sync_lock, flags);
++ raw_spin_lock_irqsave(&itc_sync_lock, flags);
+ {
+ for (i = 0; i < NUM_ROUNDS*NUM_ITERS; i++) {
+ while (!go[MASTER])
+@@ -270,7 +270,7 @@ static void smp_synchronize_one_tick(int cpu)
+ membar_safe("#StoreLoad");
+ }
+ }
+- spin_unlock_irqrestore(&itc_sync_lock, flags);
++ raw_spin_unlock_irqrestore(&itc_sync_lock, flags);
+ }
+
+ #if defined(CONFIG_SUN_LDOMS) && defined(CONFIG_HOTPLUG_CPU)
+diff --git a/arch/sparc/kernel/sys32.S b/arch/sparc/kernel/sys32.S
+index d97f3eb72e06..085c60fd4b6b 100644
+--- a/arch/sparc/kernel/sys32.S
++++ b/arch/sparc/kernel/sys32.S
+@@ -87,7 +87,7 @@ SIGN1(sys32_io_submit, compat_sys_io_submit, %o1)
+ SIGN1(sys32_mq_open, compat_sys_mq_open, %o1)
+ SIGN1(sys32_select, compat_sys_select, %o0)
+ SIGN1(sys32_mkdir, sys_mkdir, %o1)
+-SIGN3(sys32_futex, compat_sys_futex, %o1, %o2, %o5)
++SIGN1(sys32_futex, compat_sys_futex, %o1)
+ SIGN1(sys32_sysfs, compat_sys_sysfs, %o0)
+ SIGN2(sys32_sendfile, compat_sys_sendfile, %o0, %o1)
+ SIGN2(sys32_sendfile64, compat_sys_sendfile64, %o0, %o1)
+diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
+index dae85bc2eda5..a3c3a5bcd126 100644
+--- a/arch/sparc/kernel/unaligned_64.c
++++ b/arch/sparc/kernel/unaligned_64.c
+@@ -156,17 +156,23 @@ static unsigned long *fetch_reg_addr(unsigned int reg, struct pt_regs *regs)
+ unsigned long compute_effective_address(struct pt_regs *regs,
+ unsigned int insn, unsigned int rd)
+ {
++ int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
+ unsigned int rs1 = (insn >> 14) & 0x1f;
+ unsigned int rs2 = insn & 0x1f;
+- int from_kernel = (regs->tstate & TSTATE_PRIV) != 0;
++ unsigned long addr;
+
+ if (insn & 0x2000) {
+ maybe_flush_windows(rs1, 0, rd, from_kernel);
+- return (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
++ addr = (fetch_reg(rs1, regs) + sign_extend_imm13(insn));
+ } else {
+ maybe_flush_windows(rs1, rs2, rd, from_kernel);
+- return (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
++ addr = (fetch_reg(rs1, regs) + fetch_reg(rs2, regs));
+ }
++
++ if (!from_kernel && test_thread_flag(TIF_32BIT))
++ addr &= 0xffffffff;
++
++ return addr;
+ }
+
+ /* This is just to make gcc think die_if_kernel does return... */
+diff --git a/arch/sparc/lib/NG2memcpy.S b/arch/sparc/lib/NG2memcpy.S
+index 0aed75653b50..e993fc8d7c66 100644
+--- a/arch/sparc/lib/NG2memcpy.S
++++ b/arch/sparc/lib/NG2memcpy.S
+@@ -236,6 +236,7 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ */
+ VISEntryHalf
+
++ membar #Sync
+ alignaddr %o1, %g0, %g0
+
+ add %o1, (64 - 1), %o4
+diff --git a/arch/sparc/math-emu/math_32.c b/arch/sparc/math-emu/math_32.c
+index aa4d55b0bdf0..5ce8f2f64604 100644
+--- a/arch/sparc/math-emu/math_32.c
++++ b/arch/sparc/math-emu/math_32.c
+@@ -499,7 +499,7 @@ static int do_one_mathemu(u32 insn, unsigned long *pfsr, unsigned long *fregs)
+ case 0: fsr = *pfsr;
+ if (IR == -1) IR = 2;
+ /* fcc is always fcc0 */
+- fsr &= ~0xc00; fsr |= (IR << 10); break;
++ fsr &= ~0xc00; fsr |= (IR << 10);
+ *pfsr = fsr;
+ break;
+ case 1: rd->s = IR; break;
+diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
+index 1fe0429b6314..1387acafc62c 100644
+--- a/arch/sparc/mm/fault_64.c
++++ b/arch/sparc/mm/fault_64.c
+@@ -95,38 +95,51 @@ static unsigned int get_user_insn(unsigned long tpc)
+ pte_t *ptep, pte;
+ unsigned long pa;
+ u32 insn = 0;
+- unsigned long pstate;
+
+- if (pgd_none(*pgdp))
+- goto outret;
++ if (pgd_none(*pgdp) || unlikely(pgd_bad(*pgdp)))
++ goto out;
+ pudp = pud_offset(pgdp, tpc);
+- if (pud_none(*pudp))
+- goto outret;
+- pmdp = pmd_offset(pudp, tpc);
+- if (pmd_none(*pmdp))
+- goto outret;
+-
+- /* This disables preemption for us as well. */
+- __asm__ __volatile__("rdpr %%pstate, %0" : "=r" (pstate));
+- __asm__ __volatile__("wrpr %0, %1, %%pstate"
+- : : "r" (pstate), "i" (PSTATE_IE));
+- ptep = pte_offset_map(pmdp, tpc);
+- pte = *ptep;
+- if (!pte_present(pte))
++ if (pud_none(*pudp) || unlikely(pud_bad(*pudp)))
+ goto out;
+
+- pa = (pte_pfn(pte) << PAGE_SHIFT);
+- pa += (tpc & ~PAGE_MASK);
+-
+- /* Use phys bypass so we don't pollute dtlb/dcache. */
+- __asm__ __volatile__("lduwa [%1] %2, %0"
+- : "=r" (insn)
+- : "r" (pa), "i" (ASI_PHYS_USE_EC));
++ /* This disables preemption for us as well. */
++ local_irq_disable();
+
++ pmdp = pmd_offset(pudp, tpc);
++ if (pmd_none(*pmdp) || unlikely(pmd_bad(*pmdp)))
++ goto out_irq_enable;
++
++#ifdef CONFIG_TRANSPARENT_HUGEPAGE
++ if (pmd_trans_huge(*pmdp)) {
++ if (pmd_trans_splitting(*pmdp))
++ goto out_irq_enable;
++
++ pa = pmd_pfn(*pmdp) << PAGE_SHIFT;
++ pa += tpc & ~HPAGE_MASK;
++
++ /* Use phys bypass so we don't pollute dtlb/dcache. */
++ __asm__ __volatile__("lduwa [%1] %2, %0"
++ : "=r" (insn)
++ : "r" (pa), "i" (ASI_PHYS_USE_EC));
++ } else
++#endif
++ {
++ ptep = pte_offset_map(pmdp, tpc);
++ pte = *ptep;
++ if (pte_present(pte)) {
++ pa = (pte_pfn(pte) << PAGE_SHIFT);
++ pa += (tpc & ~PAGE_MASK);
++
++ /* Use phys bypass so we don't pollute dtlb/dcache. */
++ __asm__ __volatile__("lduwa [%1] %2, %0"
++ : "=r" (insn)
++ : "r" (pa), "i" (ASI_PHYS_USE_EC));
++ }
++ pte_unmap(ptep);
++ }
++out_irq_enable:
++ local_irq_enable();
+ out:
+- pte_unmap(ptep);
+- __asm__ __volatile__("wrpr %0, 0x0, %%pstate" : : "r" (pstate));
+-outret:
+ return insn;
+ }
+
+@@ -154,7 +167,8 @@ show_signal_msg(struct pt_regs *regs, int sig, int code,
+ extern unsigned long compute_effective_address(struct pt_regs *, unsigned int, unsigned int);
+
+ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
+- unsigned int insn, int fault_code)
++ unsigned long fault_addr, unsigned int insn,
++ int fault_code)
+ {
+ unsigned long addr;
+ siginfo_t info;
+@@ -162,10 +176,18 @@ static void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
+ info.si_code = code;
+ info.si_signo = sig;
+ info.si_errno = 0;
+- if (fault_code & FAULT_CODE_ITLB)
++ if (fault_code & FAULT_CODE_ITLB) {
+ addr = regs->tpc;
+- else
+- addr = compute_effective_address(regs, insn, 0);
++ } else {
++ /* If we were able to probe the faulting instruction, use it
++ * to compute a precise fault address. Otherwise use the fault
++ * time provided address which may only have page granularity.
++ */
++ if (insn)
++ addr = compute_effective_address(regs, insn, 0);
++ else
++ addr = fault_addr;
++ }
+ info.si_addr = (void __user *) addr;
+ info.si_trapno = 0;
+
+@@ -240,7 +262,7 @@ static void __kprobes do_kernel_fault(struct pt_regs *regs, int si_code,
+ /* The si_code was set to make clear whether
+ * this was a SEGV_MAPERR or SEGV_ACCERR fault.
+ */
+- do_fault_siginfo(si_code, SIGSEGV, regs, insn, fault_code);
++ do_fault_siginfo(si_code, SIGSEGV, regs, address, insn, fault_code);
+ return;
+ }
+
+@@ -260,18 +282,6 @@ static void noinline __kprobes bogus_32bit_fault_tpc(struct pt_regs *regs)
+ show_regs(regs);
+ }
+
+-static void noinline __kprobes bogus_32bit_fault_address(struct pt_regs *regs,
+- unsigned long addr)
+-{
+- static int times;
+-
+- if (times++ < 10)
+- printk(KERN_ERR "FAULT[%s:%d]: 32-bit process "
+- "reports 64-bit fault address [%lx]\n",
+- current->comm, current->pid, addr);
+- show_regs(regs);
+-}
+-
+ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ {
+ struct mm_struct *mm = current->mm;
+@@ -300,10 +310,8 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
+ goto intr_or_no_mm;
+ }
+ }
+- if (unlikely((address >> 32) != 0)) {
+- bogus_32bit_fault_address(regs, address);
++ if (unlikely((address >> 32) != 0))
+ goto intr_or_no_mm;
+- }
+ }
+
+ if (regs->tstate & TSTATE_PRIV) {
+@@ -515,7 +523,7 @@ do_sigbus:
+ * Send a sigbus, regardless of whether we were in kernel
+ * or user mode.
+ */
+- do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, insn, fault_code);
++ do_fault_siginfo(BUS_ADRERR, SIGBUS, regs, address, insn, fault_code);
+
+ /* Kernel mode? Handle exceptions or die */
+ if (regs->tstate & TSTATE_PRIV)
+diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
+index 7f8238f4f954..7eb24bddf268 100644
+--- a/arch/sparc/mm/init_64.c
++++ b/arch/sparc/mm/init_64.c
+@@ -308,6 +308,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *
+ tsb_index = MM_TSB_BASE;
+ tsb_hash_shift = PAGE_SHIFT;
+
++ /* Don't insert a non-valid PTE into the TSB, we'll deadlock. */
++ if (!(pte_val(pte) & _PAGE_VALID))
++ return;
++
+ spin_lock_irqsave(&mm->context.lock, flags);
+
+ #ifdef CONFIG_HUGETLB_PAGE
+@@ -2417,3 +2421,26 @@ void __flush_tlb_all(void)
+ __asm__ __volatile__("wrpr %0, 0, %%pstate"
+ : : "r" (pstate));
+ }
++
++#ifdef CONFIG_SMP
++#define do_flush_tlb_kernel_range smp_flush_tlb_kernel_range
++#else
++#define do_flush_tlb_kernel_range __flush_tlb_kernel_range
++#endif
++
++void flush_tlb_kernel_range(unsigned long start, unsigned long end)
++{
++ if (start < HI_OBP_ADDRESS && end > LOW_OBP_ADDRESS) {
++ if (start < LOW_OBP_ADDRESS) {
++ flush_tsb_kernel_range(start, LOW_OBP_ADDRESS);
++ do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS);
++ }
++ if (end > HI_OBP_ADDRESS) {
++ flush_tsb_kernel_range(end, HI_OBP_ADDRESS);
++ do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS);
++ }
++ } else {
++ flush_tsb_kernel_range(start, end);
++ do_flush_tlb_kernel_range(start, end);
++ }
++}
+diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c
+index f4e84f3440dd..41530193e6d6 100644
+--- a/arch/sparc/mm/tsb.c
++++ b/arch/sparc/mm/tsb.c
+@@ -150,7 +150,19 @@ static void setup_tsb_params(struct mm_struct *mm, unsigned long tsb_idx, unsign
+ mm->context.tsb_block[tsb_idx].tsb_nentries =
+ tsb_bytes / sizeof(struct tsb);
+
+- base = TSBMAP_BASE;
++ switch (tsb_idx) {
++ case MM_TSB_BASE:
++ base = TSBMAP_8K_BASE;
++ break;
++#if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
++ case MM_TSB_HUGE:
++ base = TSBMAP_4M_BASE;
++ break;
++#endif
++ default:
++ BUG();
++ }
++
+ tte = pgprot_val(PAGE_KERNEL_LOCKED);
+ tsb_paddr = __pa(mm->context.tsb_block[tsb_idx].tsb);
+ BUG_ON(tsb_paddr & (tsb_bytes - 1UL));
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index c4bb95b051f3..6749acf6f3f4 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -455,6 +455,7 @@ static int macvlan_init(struct net_device *dev)
+ (lowerdev->state & MACVLAN_STATE_MASK);
+ dev->features = lowerdev->features & MACVLAN_FEATURES;
+ dev->features |= NETIF_F_LLTX;
++ dev->vlan_features = lowerdev->vlan_features & MACVLAN_FEATURES;
+ dev->gso_max_size = lowerdev->gso_max_size;
+ dev->iflink = lowerdev->ifindex;
+ dev->hard_header_len = lowerdev->hard_header_len;
+diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
+index 8327cc596c34..9f047a04215e 100644
+--- a/drivers/net/ppp/pptp.c
++++ b/drivers/net/ppp/pptp.c
+@@ -281,7 +281,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
+ nf_reset(skb);
+
+ skb->ip_summed = CHECKSUM_NONE;
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+ ip_send_check(iph);
+
+ ip_local_out(skb);
+diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
+index 160e7510aca6..0787b9756165 100644
+--- a/drivers/sbus/char/bbc_envctrl.c
++++ b/drivers/sbus/char/bbc_envctrl.c
+@@ -452,6 +452,9 @@ static void attach_one_temp(struct bbc_i2c_bus *bp, struct platform_device *op,
+ if (!tp)
+ return;
+
++ INIT_LIST_HEAD(&tp->bp_list);
++ INIT_LIST_HEAD(&tp->glob_list);
++
+ tp->client = bbc_i2c_attach(bp, op);
+ if (!tp->client) {
+ kfree(tp);
+@@ -497,6 +500,9 @@ static void attach_one_fan(struct bbc_i2c_bus *bp, struct platform_device *op,
+ if (!fp)
+ return;
+
++ INIT_LIST_HEAD(&fp->bp_list);
++ INIT_LIST_HEAD(&fp->glob_list);
++
+ fp->client = bbc_i2c_attach(bp, op);
+ if (!fp->client) {
+ kfree(fp);
+diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
+index 542668292900..7179f72b11ea 100644
+--- a/drivers/sbus/char/bbc_i2c.c
++++ b/drivers/sbus/char/bbc_i2c.c
+@@ -301,13 +301,18 @@ static struct bbc_i2c_bus * __init attach_one_i2c(struct platform_device *op, in
+ if (!bp)
+ return NULL;
+
++ INIT_LIST_HEAD(&bp->temps);
++ INIT_LIST_HEAD(&bp->fans);
++
+ bp->i2c_control_regs = of_ioremap(&op->resource[0], 0, 0x2, "bbc_i2c_regs");
+ if (!bp->i2c_control_regs)
+ goto fail;
+
+- bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
+- if (!bp->i2c_bussel_reg)
+- goto fail;
++ if (op->num_resources == 2) {
++ bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
++ if (!bp->i2c_bussel_reg)
++ goto fail;
++ }
+
+ bp->waiting = 0;
+ init_waitqueue_head(&bp->wq);
+diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
+index f0d93eb7e6ec..c9549aa135b2 100644
+--- a/drivers/tty/serial/sunsab.c
++++ b/drivers/tty/serial/sunsab.c
+@@ -157,6 +157,15 @@ receive_chars(struct uart_sunsab_port *up,
+ (up->port.line == up->port.cons->index))
+ saw_console_brk = 1;
+
++ if (count == 0) {
++ if (unlikely(stat->sreg.isr1 & SAB82532_ISR1_BRK)) {
++ stat->sreg.isr0 &= ~(SAB82532_ISR0_PERR |
++ SAB82532_ISR0_FERR);
++ up->port.icount.brk++;
++ uart_handle_break(&up->port);
++ }
++ }
++
+ for (i = 0; i < count; i++) {
+ unsigned char ch = buf[i], flag;
+
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 2d643649f0f8..168d30dfe807 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -46,13 +46,12 @@ struct inet_peer {
+ };
+ /*
+ * Once inet_peer is queued for deletion (refcnt == -1), following fields
+- * are not available: rid, ip_id_count, tcp_ts, tcp_ts_stamp
++ * are not available: rid, tcp_ts, tcp_ts_stamp
+ * We can share memory with rcu_head to help keep inet_peer small.
+ */
+ union {
+ struct {
+ atomic_t rid; /* Frag reception counter */
+- atomic_t ip_id_count; /* IP ID for the next packet */
+ __u32 tcp_ts;
+ __u32 tcp_ts_stamp;
+ };
+@@ -102,7 +101,7 @@ extern bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout);
+ extern void inetpeer_invalidate_tree(int family);
+
+ /*
+- * temporary check to make sure we dont access rid, ip_id_count, tcp_ts,
++ * temporary check to make sure we dont access rid, tcp_ts,
+ * tcp_ts_stamp if no refcount is taken on inet_peer
+ */
+ static inline void inet_peer_refcheck(const struct inet_peer *p)
+@@ -110,13 +109,4 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
+ WARN_ON_ONCE(atomic_read(&p->refcnt) <= 0);
+ }
+
+-
+-/* can be called with or without local BH being disabled */
+-static inline int inet_getid(struct inet_peer *p, int more)
+-{
+- more++;
+- inet_peer_refcheck(p);
+- return atomic_add_return(more, &p->ip_id_count) - more;
+-}
+-
+ #endif /* _NET_INETPEER_H */
+diff --git a/include/net/ip.h b/include/net/ip.h
+index 6d6b12f4753c..34d004892143 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -264,9 +264,10 @@ int ip_dont_fragment(struct sock *sk, struct dst_entry *dst)
+ !(dst_metric_locked(dst, RTAX_MTU)));
+ }
+
+-extern void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more);
++u32 ip_idents_reserve(u32 hash, int segs);
++void __ip_select_ident(struct iphdr *iph, int segs);
+
+-static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk)
++static inline void ip_select_ident_segs(struct sk_buff *skb, struct sock *sk, int segs)
+ {
+ struct iphdr *iph = ip_hdr(skb);
+
+@@ -276,24 +277,20 @@ static inline void ip_select_ident(struct sk_buff *skb, struct dst_entry *dst, s
+ * does not change, they drop every other packet in
+ * a TCP stream using header compression.
+ */
+- iph->id = (sk && inet_sk(sk)->inet_daddr) ?
+- htons(inet_sk(sk)->inet_id++) : 0;
+- } else
+- __ip_select_ident(iph, dst, 0);
+-}
+-
+-static inline void ip_select_ident_more(struct sk_buff *skb, struct dst_entry *dst, struct sock *sk, int more)
+-{
+- struct iphdr *iph = ip_hdr(skb);
+-
+- if ((iph->frag_off & htons(IP_DF)) && !skb->local_df) {
+ if (sk && inet_sk(sk)->inet_daddr) {
+ iph->id = htons(inet_sk(sk)->inet_id);
+- inet_sk(sk)->inet_id += 1 + more;
+- } else
++ inet_sk(sk)->inet_id += segs;
++ } else {
+ iph->id = 0;
+- } else
+- __ip_select_ident(iph, dst, more);
++ }
++ } else {
++ __ip_select_ident(iph, segs);
++ }
++}
++
++static inline void ip_select_ident(struct sk_buff *skb, struct sock *sk)
++{
++ ip_select_ident_segs(skb, sk, 1);
+ }
+
+ /*
+diff --git a/include/net/ipip.h b/include/net/ipip.h
+index 4dccfe3bf731..e8ee3bb1b1ca 100644
+--- a/include/net/ipip.h
++++ b/include/net/ipip.h
+@@ -50,7 +50,7 @@ struct ip_tunnel_prl_entry {
+ int pkt_len = skb->len - skb_transport_offset(skb); \
+ \
+ skb->ip_summed = CHECKSUM_NONE; \
+- ip_select_ident(skb, &rt->dst, NULL); \
++ ip_select_ident(skb, NULL); \
+ \
+ err = ip_local_out(skb); \
+ if (likely(net_xmit_eval(err) == 0)) { \
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h
+index fa7af9183dc9..117eaa578d0d 100644
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -392,14 +392,19 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a);
+ int ip6_frag_match(struct inet_frag_queue *q, void *a);
+
+ /* more secured version of ipv6_addr_hash() */
+-static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval)
+ {
+ u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+
+ return jhash_3words(v,
+ (__force u32)a->s6_addr32[2],
+ (__force u32)a->s6_addr32[3],
+- ipv6_hash_secret);
++ initval);
++}
++
++static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
++{
++ return __ipv6_addr_jhash(a, ipv6_hash_secret);
+ }
+
+ static inline int ipv6_addr_any(const struct in6_addr *a)
+diff --git a/include/net/secure_seq.h b/include/net/secure_seq.h
+index c2e542b27a5a..b1c3d1c63c4e 100644
+--- a/include/net/secure_seq.h
++++ b/include/net/secure_seq.h
+@@ -3,8 +3,6 @@
+
+ #include <linux/types.h>
+
+-extern __u32 secure_ip_id(__be32 daddr);
+-extern __u32 secure_ipv6_id(const __be32 daddr[4]);
+ extern u32 secure_ipv4_port_ephemeral(__be32 saddr, __be32 daddr, __be16 dport);
+ extern u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ __be16 dport);
+diff --git a/net/compat.c b/net/compat.c
+index 93f542335e19..2c774d889d39 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -85,7 +85,7 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ {
+ int tot_len;
+
+- if (kern_msg->msg_namelen) {
++ if (kern_msg->msg_name && kern_msg->msg_namelen) {
+ if (mode == VERIFY_READ) {
+ int err = move_addr_to_kernel(kern_msg->msg_name,
+ kern_msg->msg_namelen,
+@@ -93,10 +93,11 @@ int verify_compat_iovec(struct msghdr *kern_msg, struct iovec *kern_iov,
+ if (err < 0)
+ return err;
+ }
+- if (kern_msg->msg_name)
+- kern_msg->msg_name = kern_address;
+- } else
++ kern_msg->msg_name = kern_address;
++ } else {
+ kern_msg->msg_name = NULL;
++ kern_msg->msg_namelen = 0;
++ }
+
+ tot_len = iov_from_user_compat_to_kern(kern_iov,
+ (struct compat_iovec __user *)kern_msg->msg_iov,
+diff --git a/net/core/iovec.c b/net/core/iovec.c
+index 7fd34a56aeb3..d1628b79286b 100644
+--- a/net/core/iovec.c
++++ b/net/core/iovec.c
+@@ -39,7 +39,7 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
+ {
+ int size, ct, err;
+
+- if (m->msg_namelen) {
++ if (m->msg_name && m->msg_namelen) {
+ if (mode == VERIFY_READ) {
+ void __user *namep;
+ namep = (void __user __force *) m->msg_name;
+@@ -48,10 +48,10 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
+ if (err < 0)
+ return err;
+ }
+- if (m->msg_name)
+- m->msg_name = address;
++ m->msg_name = address;
+ } else {
+ m->msg_name = NULL;
++ m->msg_namelen = 0;
+ }
+
+ size = m->msg_iovlen * sizeof(struct iovec);
+@@ -157,6 +157,10 @@ EXPORT_SYMBOL(memcpy_fromiovec);
+ int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
+ int offset, int len)
+ {
++ /* No data? Done! */
++ if (len == 0)
++ return 0;
++
+ /* Skip over the finished iovecs */
+ while (offset >= iov->iov_len) {
+ offset -= iov->iov_len;
+diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c
+index 99b2596531bb..6ecbd58418b3 100644
+--- a/net/core/secure_seq.c
++++ b/net/core/secure_seq.c
+@@ -79,29 +79,6 @@ u32 secure_ipv6_port_ephemeral(const __be32 *saddr, const __be32 *daddr,
+ #endif
+
+ #ifdef CONFIG_INET
+-__u32 secure_ip_id(__be32 daddr)
+-{
+- u32 hash[MD5_DIGEST_WORDS];
+-
+- hash[0] = (__force __u32) daddr;
+- hash[1] = net_secret[13];
+- hash[2] = net_secret[14];
+- hash[3] = net_secret[15];
+-
+- md5_transform(hash, net_secret);
+-
+- return hash[0];
+-}
+-
+-__u32 secure_ipv6_id(const __be32 daddr[4])
+-{
+- __u32 hash[4];
+-
+- memcpy(hash, daddr, 16);
+- md5_transform(hash, net_secret);
+-
+- return hash[0];
+-}
+
+ __u32 secure_tcp_sequence_number(__be32 saddr, __be32 daddr,
+ __be16 sport, __be16 dport)
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 8de819475378..728f49babfe0 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2748,7 +2748,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+ tail = nskb;
+
+ __copy_skb_header(nskb, skb);
+- nskb->mac_len = skb->mac_len;
+
+ /* nskb and skb might have different headroom */
+ if (nskb->ip_summed == CHECKSUM_PARTIAL)
+@@ -2758,6 +2757,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+ skb_set_network_header(nskb, skb->mac_len);
+ nskb->transport_header = (nskb->network_header +
+ skb_network_header_len(skb));
++ skb_reset_mac_len(nskb);
+ skb_copy_from_linear_data(skb, nskb->data, doffset);
+
+ if (fskb != skb_shinfo(skb)->frag_list)
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 3f0bb3b3819d..782467708c10 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -343,7 +343,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, int size)
+ pip->saddr = fl4.saddr;
+ pip->protocol = IPPROTO_IGMP;
+ pip->tot_len = 0; /* filled in later */
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+ ((u8*)&pip[1])[0] = IPOPT_RA;
+ ((u8*)&pip[1])[1] = 4;
+ ((u8*)&pip[1])[2] = 0;
+@@ -687,7 +687,7 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,
+ iph->daddr = dst;
+ iph->saddr = fl4.saddr;
+ iph->protocol = IPPROTO_IGMP;
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+ ((u8*)&iph[1])[0] = IPOPT_RA;
+ ((u8*)&iph[1])[1] = 4;
+ ((u8*)&iph[1])[2] = 0;
+diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
+index d63a9268cff6..db1b6a73e0ff 100644
+--- a/net/ipv4/inetpeer.c
++++ b/net/ipv4/inetpeer.c
+@@ -26,20 +26,7 @@
+ * Theory of operations.
+ * We keep one entry for each peer IP address. The nodes contains long-living
+ * information about the peer which doesn't depend on routes.
+- * At this moment this information consists only of ID field for the next
+- * outgoing IP packet. This field is incremented with each packet as encoded
+- * in inet_getid() function (include/net/inetpeer.h).
+- * At the moment of writing this notes identifier of IP packets is generated
+- * to be unpredictable using this code only for packets subjected
+- * (actually or potentially) to defragmentation. I.e. DF packets less than
+- * PMTU in size when local fragmentation is disabled use a constant ID and do
+- * not use this code (see ip_select_ident() in include/net/ip.h).
+ *
+- * Route cache entries hold references to our nodes.
+- * New cache entries get references via lookup by destination IP address in
+- * the avl tree. The reference is grabbed only when it's needed i.e. only
+- * when we try to output IP packet which needs an unpredictable ID (see
+- * __ip_select_ident() in net/ipv4/route.c).
+ * Nodes are removed only when reference counter goes to 0.
+ * When it's happened the node may be removed when a sufficient amount of
+ * time has been passed since its last use. The less-recently-used entry can
+@@ -62,7 +49,6 @@
+ * refcnt: atomically against modifications on other CPU;
+ * usually under some other lock to prevent node disappearing
+ * daddr: unchangeable
+- * ip_id_count: atomic value (no lock needed)
+ */
+
+ static struct kmem_cache *peer_cachep __read_mostly;
+@@ -488,10 +474,6 @@ relookup:
+ p->daddr = *daddr;
+ atomic_set(&p->refcnt, 1);
+ atomic_set(&p->rid, 0);
+- atomic_set(&p->ip_id_count,
+- (daddr->family == AF_INET) ?
+- secure_ip_id(daddr->addr.a4) :
+- secure_ipv6_id(daddr->addr.a6));
+ p->tcp_ts_stamp = 0;
+ p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
+ p->rate_tokens = 0;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index d6407b563fd8..7827436ae843 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -161,7 +161,7 @@ int ip_build_and_send_pkt(struct sk_buff *skb, struct sock *sk,
+ iph->daddr = (opt && opt->opt.srr ? opt->opt.faddr : daddr);
+ iph->saddr = saddr;
+ iph->protocol = sk->sk_protocol;
+- ip_select_ident(skb, &rt->dst, sk);
++ ip_select_ident(skb, sk);
+
+ if (opt && opt->opt.optlen) {
+ iph->ihl += opt->opt.optlen>>2;
+@@ -403,8 +403,7 @@ packet_routed:
+ ip_options_build(skb, &inet_opt->opt, inet->inet_daddr, rt, 0);
+ }
+
+- ip_select_ident_more(skb, &rt->dst, sk,
+- (skb_shinfo(skb)->gso_segs ?: 1) - 1);
++ ip_select_ident_segs(skb, sk, skb_shinfo(skb)->gso_segs ?: 1);
+
+ skb->priority = sk->sk_priority;
+ skb->mark = sk->sk_mark;
+@@ -1347,7 +1346,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
+ iph->ihl = 5;
+ iph->tos = inet->tos;
+ iph->frag_off = df;
+- ip_select_ident(skb, &rt->dst, sk);
++ ip_select_ident(skb, sk);
+ iph->ttl = ttl;
+ iph->protocol = sk->sk_protocol;
+ ip_copy_addrs(iph, fl4);
+diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
+index 94cd1ef1e319..5ccef6e06dc5 100644
+--- a/net/ipv4/ipmr.c
++++ b/net/ipv4/ipmr.c
+@@ -1576,7 +1576,7 @@ static void ip_encap(struct sk_buff *skb, __be32 saddr, __be32 daddr)
+ iph->protocol = IPPROTO_IPIP;
+ iph->ihl = 5;
+ iph->tot_len = htons(skb->len);
+- ip_select_ident(skb, skb_dst(skb), NULL);
++ ip_select_ident(skb, NULL);
+ ip_send_check(iph);
+
+ memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
+diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
+index 48c6ebcb7fe0..c1b3970caa68 100644
+--- a/net/ipv4/raw.c
++++ b/net/ipv4/raw.c
+@@ -384,7 +384,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4,
+ iph->check = 0;
+ iph->tot_len = htons(length);
+ if (!iph->id)
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+
+ iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl);
+ }
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 90bc88bbd2a4..fd6843371f2e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1341,46 +1341,53 @@ void rt_bind_peer(struct rtable *rt, __be32 daddr, int create)
+ rt->rt_peer_genid = rt_peer_genid();
+ }
+
+-/*
+- * Peer allocation may fail only in serious out-of-memory conditions. However
+- * we still can generate some output.
+- * Random ID selection looks a bit dangerous because we have no chances to
+- * select ID being unique in a reasonable period of time.
+- * But broken packet identifier may be better than no packet at all.
++#define IP_IDENTS_SZ 2048u
++struct ip_ident_bucket {
++ atomic_t id;
++ u32 stamp32;
++};
++
++static struct ip_ident_bucket *ip_idents __read_mostly;
++
++/* In order to protect privacy, we add a perturbation to identifiers
++ * if one generator is seldom used. This makes hard for an attacker
++ * to infer how many packets were sent between two points in time.
+ */
+-static void ip_select_fb_ident(struct iphdr *iph)
++u32 ip_idents_reserve(u32 hash, int segs)
+ {
+- static DEFINE_SPINLOCK(ip_fb_id_lock);
+- static u32 ip_fallback_id;
+- u32 salt;
++ struct ip_ident_bucket *bucket = ip_idents + hash % IP_IDENTS_SZ;
++ u32 old = ACCESS_ONCE(bucket->stamp32);
++ u32 now = (u32)jiffies;
++ u32 delta = 0;
++
++ if (old != now && cmpxchg(&bucket->stamp32, old, now) == old) {
++ u64 x = random32();
++
++ x *= (now - old);
++ delta = (u32)(x >> 32);
++ }
+
+- spin_lock_bh(&ip_fb_id_lock);
+- salt = secure_ip_id((__force __be32)ip_fallback_id ^ iph->daddr);
+- iph->id = htons(salt & 0xFFFF);
+- ip_fallback_id = salt;
+- spin_unlock_bh(&ip_fb_id_lock);
++ return atomic_add_return(segs + delta, &bucket->id) - segs;
+ }
++EXPORT_SYMBOL(ip_idents_reserve);
+
+-void __ip_select_ident(struct iphdr *iph, struct dst_entry *dst, int more)
++void __ip_select_ident(struct iphdr *iph, int segs)
+ {
+- struct rtable *rt = (struct rtable *) dst;
+-
+- if (rt && !(rt->dst.flags & DST_NOPEER)) {
+- if (rt->peer == NULL)
+- rt_bind_peer(rt, rt->rt_dst, 1);
++ static u32 ip_idents_hashrnd __read_mostly;
++ static bool hashrnd_initialized = false;
++ u32 hash, id;
+
+- /* If peer is attached to destination, it is never detached,
+- so that we need not to grab a lock to dereference it.
+- */
+- if (rt->peer) {
+- iph->id = htons(inet_getid(rt->peer, more));
+- return;
+- }
+- } else if (!rt)
+- printk(KERN_DEBUG "rt_bind_peer(0) @%p\n",
+- __builtin_return_address(0));
++ if (unlikely(!hashrnd_initialized)) {
++ hashrnd_initialized = true;
++ get_random_bytes(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
++ }
+
+- ip_select_fb_ident(iph);
++ hash = jhash_3words((__force u32)iph->daddr,
++ (__force u32)iph->saddr,
++ iph->protocol,
++ ip_idents_hashrnd);
++ id = ip_idents_reserve(hash, segs);
++ iph->id = htons(id);
+ }
+ EXPORT_SYMBOL(__ip_select_ident);
+
+@@ -3009,7 +3016,6 @@ static int rt_fill_info(struct net *net,
+ error = rt->dst.error;
+ if (peer) {
+ inet_peer_refcheck(rt->peer);
+- id = atomic_read(&peer->ip_id_count) & 0xffff;
+ if (peer->tcp_ts_stamp) {
+ ts = peer->tcp_ts;
+ tsage = get_seconds() - peer->tcp_ts_stamp;
+@@ -3441,6 +3447,12 @@ int __init ip_rt_init(void)
+ {
+ int rc = 0;
+
++ ip_idents = kmalloc(IP_IDENTS_SZ * sizeof(*ip_idents), GFP_KERNEL);
++ if (!ip_idents)
++ panic("IP: failed to allocate ip_idents\n");
++
++ get_random_bytes(ip_idents, IP_IDENTS_SZ * sizeof(*ip_idents));
++
+ #ifdef CONFIG_IP_ROUTE_CLASSID
+ ip_rt_acct = __alloc_percpu(256 * sizeof(struct ip_rt_acct), __alignof__(struct ip_rt_acct));
+ if (!ip_rt_acct)
+diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
+index 80fa2bfd7ede..c042e529a11e 100644
+--- a/net/ipv4/tcp_vegas.c
++++ b/net/ipv4/tcp_vegas.c
+@@ -218,7 +218,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+ * This is:
+ * (actual rate in segments) * baseRTT
+ */
+- target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
++ target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT;
++ do_div(target_cwnd, rtt);
+
+ /* Calculate the difference between the window we had,
+ * and the window we would like to have. This quantity
+diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
+index ac43cd747bce..b4d1858be550 100644
+--- a/net/ipv4/tcp_veno.c
++++ b/net/ipv4/tcp_veno.c
+@@ -144,7 +144,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
+
+ rtt = veno->minrtt;
+
+- target_cwnd = (tp->snd_cwnd * veno->basertt);
++ target_cwnd = (u64)tp->snd_cwnd * veno->basertt;
+ target_cwnd <<= V_PARAM_SHIFT;
+ do_div(target_cwnd, rtt);
+
+diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
+index 938553efbf8e..5531eb2a56a5 100644
+--- a/net/ipv4/xfrm4_mode_tunnel.c
++++ b/net/ipv4/xfrm4_mode_tunnel.c
+@@ -54,12 +54,12 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
+
+ top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
+ 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
+- ip_select_ident(skb, dst->child, NULL);
+
+ top_iph->ttl = ip4_dst_hoplimit(dst->child);
+
+ top_iph->saddr = x->props.saddr.a4;
+ top_iph->daddr = x->id.daddr.a4;
++ ip_select_ident(skb, NULL);
+
+ return 0;
+ }
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 6225b7cf12b9..2bf7916c816f 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -599,22 +599,19 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+
+ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+ {
+- static atomic_t ipv6_fragmentation_id;
+- int ident;
++ static u32 ip6_idents_hashrnd __read_mostly;
++ static bool hashrnd_initialized = false;
++ u32 hash, id;
+
+- if (rt && !(rt->dst.flags & DST_NOPEER)) {
+- struct inet_peer *peer;
+-
+- if (!rt->rt6i_peer)
+- rt6_bind_peer(rt, 1);
+- peer = rt->rt6i_peer;
+- if (peer) {
+- fhdr->identification = htonl(inet_getid(peer, 0));
+- return;
+- }
++ if (unlikely(!hashrnd_initialized)) {
++ hashrnd_initialized = true;
++ get_random_bytes(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+ }
+- ident = atomic_inc_return(&ipv6_fragmentation_id);
+- fhdr->identification = htonl(ident);
++ hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
++ hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
++
++ id = ip_idents_reserve(hash, 1);
++ fhdr->identification = htonl(id);
+ }
+
+ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
+index ec78ab63dd46..559d307163b1 100644
+--- a/net/netfilter/ipvs/ip_vs_xmit.c
++++ b/net/netfilter/ipvs/ip_vs_xmit.c
+@@ -853,7 +853,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
+ iph->daddr = cp->daddr.ip;
+ iph->saddr = saddr;
+ iph->ttl = old_iph->ttl;
+- ip_select_ident(skb, &rt->dst, NULL);
++ ip_select_ident(skb, NULL);
+
+ /* Another hack: avoid icmp_send in ip_fragment */
+ skb->local_df = 1;
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 25b207b3ffe4..da54d2922f51 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1188,6 +1188,7 @@ void sctp_assoc_update(struct sctp_association *asoc,
+ asoc->c = new->c;
+ asoc->peer.rwnd = new->peer.rwnd;
+ asoc->peer.sack_needed = new->peer.sack_needed;
++ asoc->peer.auth_capable = new->peer.auth_capable;
+ asoc->peer.i = new->peer.i;
+ sctp_tsnmap_init(&asoc->peer.tsn_map, SCTP_TSN_MAP_INITIAL,
+ asoc->peer.i.initial_tsn, GFP_ATOMIC);
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index cf3e22c586a6..5bd9aa93139d 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,7 @@ out:
+ return err;
+ no_route:
+ kfree_skb(nskb);
+- IP_INC_STATS_BH(&init_net, IPSTATS_MIB_OUTNOROUTES);
++ IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+
+ /* FIXME: Returning the 'err' will effect all the associations
+ * associated with a socket, although only one of the paths of the
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-08-19 11:41 Mike Pagano
2014-07-28 16:52 ` Mike Pagano
0 siblings, 1 reply; 25+ messages in thread
From: Mike Pagano @ 2014-08-19 11:41 UTC (permalink / raw
To: gentoo-commits
commit: da70b949627e538e9465762c96f64ef07190e788
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 28 16:50:30 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jul 28 16:50:30 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=da70b949
Linux patch 3.4.100
---
0000_README | 4 +
1099_linux-3.4.100.patch | 929 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 933 insertions(+)
diff --git a/0000_README b/0000_README
index d5d9d81..af7f3f3 100644
--- a/0000_README
+++ b/0000_README
@@ -435,6 +435,10 @@ Patch: 1098_linux-3.4.99.patch
From: http://www.kernel.org
Desc: Linux 3.4.99
+Patch: 1099_linux-3.4.100.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.100
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1099_linux-3.4.100.patch b/1099_linux-3.4.100.patch
new file mode 100644
index 0000000..597e1fd
--- /dev/null
+++ b/1099_linux-3.4.100.patch
@@ -0,0 +1,929 @@
+diff --git a/Makefile b/Makefile
+index ed97caf40f71..d6c64eb82525 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 99
++SUBLEVEL = 100
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index 268b2455e7b0..b1cbcff69cdb 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -1070,6 +1070,15 @@ again:
+ intel_pmu_lbr_read();
+
+ /*
++ * CondChgd bit 63 doesn't mean any overflow status. Ignore
++ * and clear the bit.
++ */
++ if (__test_and_clear_bit(63, (unsigned long *)&status)) {
++ if (!status)
++ goto done;
++ }
++
++ /*
+ * PEBS overflow sets bit 62 in the global status register
+ */
+ if (__test_and_clear_bit(62, (unsigned long *)&status)) {
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 36e5a8ee0e1e..1ae2e0ea5492 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -14558,38 +14558,40 @@ static struct pcomp_testvec zlib_decomp_tv_template[] = {
+ static struct comp_testvec lzo_comp_tv_template[] = {
+ {
+ .inlen = 70,
+- .outlen = 46,
++ .outlen = 57,
+ .input = "Join us now and share the software "
+ "Join us now and share the software ",
+ .output = "\x00\x0d\x4a\x6f\x69\x6e\x20\x75"
+- "\x73\x20\x6e\x6f\x77\x20\x61\x6e"
+- "\x64\x20\x73\x68\x61\x72\x65\x20"
+- "\x74\x68\x65\x20\x73\x6f\x66\x74"
+- "\x77\x70\x01\x01\x4a\x6f\x69\x6e"
+- "\x3d\x88\x00\x11\x00\x00",
++ "\x73\x20\x6e\x6f\x77\x20\x61\x6e"
++ "\x64\x20\x73\x68\x61\x72\x65\x20"
++ "\x74\x68\x65\x20\x73\x6f\x66\x74"
++ "\x77\x70\x01\x32\x88\x00\x0c\x65"
++ "\x20\x74\x68\x65\x20\x73\x6f\x66"
++ "\x74\x77\x61\x72\x65\x20\x11\x00"
++ "\x00",
+ }, {
+ .inlen = 159,
+- .outlen = 133,
++ .outlen = 131,
+ .input = "This document describes a compression method based on the LZO "
+ "compression algorithm. This document defines the application of "
+ "the LZO algorithm used in UBIFS.",
+- .output = "\x00\x2b\x54\x68\x69\x73\x20\x64"
++ .output = "\x00\x2c\x54\x68\x69\x73\x20\x64"
+ "\x6f\x63\x75\x6d\x65\x6e\x74\x20"
+ "\x64\x65\x73\x63\x72\x69\x62\x65"
+ "\x73\x20\x61\x20\x63\x6f\x6d\x70"
+ "\x72\x65\x73\x73\x69\x6f\x6e\x20"
+ "\x6d\x65\x74\x68\x6f\x64\x20\x62"
+ "\x61\x73\x65\x64\x20\x6f\x6e\x20"
+- "\x74\x68\x65\x20\x4c\x5a\x4f\x2b"
+- "\x8c\x00\x0d\x61\x6c\x67\x6f\x72"
+- "\x69\x74\x68\x6d\x2e\x20\x20\x54"
+- "\x68\x69\x73\x2a\x54\x01\x02\x66"
+- "\x69\x6e\x65\x73\x94\x06\x05\x61"
+- "\x70\x70\x6c\x69\x63\x61\x74\x76"
+- "\x0a\x6f\x66\x88\x02\x60\x09\x27"
+- "\xf0\x00\x0c\x20\x75\x73\x65\x64"
+- "\x20\x69\x6e\x20\x55\x42\x49\x46"
+- "\x53\x2e\x11\x00\x00",
++ "\x74\x68\x65\x20\x4c\x5a\x4f\x20"
++ "\x2a\x8c\x00\x09\x61\x6c\x67\x6f"
++ "\x72\x69\x74\x68\x6d\x2e\x20\x20"
++ "\x2e\x54\x01\x03\x66\x69\x6e\x65"
++ "\x73\x20\x74\x06\x05\x61\x70\x70"
++ "\x6c\x69\x63\x61\x74\x76\x0a\x6f"
++ "\x66\x88\x02\x60\x09\x27\xf0\x00"
++ "\x0c\x20\x75\x73\x65\x64\x20\x69"
++ "\x6e\x20\x55\x42\x49\x46\x53\x2e"
++ "\x11\x00\x00",
+ },
+ };
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 60404f4b2446..adc9bfd4d82f 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -709,6 +709,10 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ struct radeon_device *rdev = dev->dev_private;
+ int ret = 0;
+
++ /* don't leak the edid if we already fetched it in detect() */
++ if (radeon_connector->edid)
++ goto got_edid;
++
+ /* on hw with routers, select right port */
+ if (radeon_connector->router.ddc_valid)
+ radeon_router_select_ddc_port(radeon_connector);
+@@ -748,6 +752,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev);
+ }
+ if (radeon_connector->edid) {
++got_edid:
+ drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
+ ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
+ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 97b2e21ac46a..cf065df9bb18 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -582,7 +582,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+ {
+ struct intel_iommu *iommu;
+ int map_size;
+- u32 ver;
++ u32 ver, sts;
+ static int iommu_allocated = 0;
+ int agaw = 0;
+ int msagaw = 0;
+@@ -652,6 +652,15 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+ (unsigned long long)iommu->cap,
+ (unsigned long long)iommu->ecap);
+
++ /* Reflect status in gcmd */
++ sts = readl(iommu->reg + DMAR_GSTS_REG);
++ if (sts & DMA_GSTS_IRES)
++ iommu->gcmd |= DMA_GCMD_IRE;
++ if (sts & DMA_GSTS_TES)
++ iommu->gcmd |= DMA_GCMD_TE;
++ if (sts & DMA_GSTS_QIES)
++ iommu->gcmd |= DMA_GCMD_QIE;
++
+ raw_spin_lock_init(&iommu->register_lock);
+
+ drhd->iommu = iommu;
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 4e1c6bfc9c8d..dd255c578ad9 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3659,6 +3659,7 @@ static struct notifier_block device_nb = {
+ int __init intel_iommu_init(void)
+ {
+ int ret = 0;
++ struct dmar_drhd_unit *drhd;
+
+ /* VT-d is required for a TXT/tboot launch, so enforce that */
+ force_on = tboot_force_iommu();
+@@ -3669,6 +3670,20 @@ int __init intel_iommu_init(void)
+ return -ENODEV;
+ }
+
++ /*
++ * Disable translation if already enabled prior to OS handover.
++ */
++ for_each_drhd_unit(drhd) {
++ struct intel_iommu *iommu;
++
++ if (drhd->ignored)
++ continue;
++
++ iommu = drhd->iommu;
++ if (iommu->gcmd & DMA_GCMD_TE)
++ iommu_disable_translation(iommu);
++ }
++
+ if (dmar_dev_scope_init() < 0) {
+ if (force_on)
+ panic("tboot: Failed to initialize DMAR device scope\n");
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index ef1f9400b967..b2740f12b180 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -2411,7 +2411,7 @@ static int be_open(struct net_device *netdev)
+
+ for_all_evt_queues(adapter, eqo, i) {
+ napi_enable(&eqo->napi);
+- be_eq_notify(adapter, eqo->q.id, true, false, 0);
++ be_eq_notify(adapter, eqo->q.id, true, true, 0);
+ }
+
+ status = be_cmd_link_status_query(adapter, NULL, NULL,
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 8e2ac643a777..ed6ec513defa 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -1086,6 +1086,24 @@ static struct vnet * __devinit vnet_find_or_create(const u64 *local_mac)
+ return vp;
+ }
+
++static void vnet_cleanup(void)
++{
++ struct vnet *vp;
++ struct net_device *dev;
++
++ mutex_lock(&vnet_list_mutex);
++ while (!list_empty(&vnet_list)) {
++ vp = list_first_entry(&vnet_list, struct vnet, list);
++ list_del(&vp->list);
++ dev = vp->dev;
++ /* vio_unregister_driver() should have cleaned up port_list */
++ BUG_ON(!list_empty(&vp->port_list));
++ unregister_netdev(dev);
++ free_netdev(dev);
++ }
++ mutex_unlock(&vnet_list_mutex);
++}
++
+ static const char *local_mac_prop = "local-mac-address";
+
+ static struct vnet * __devinit vnet_find_parent(struct mdesc_handle *hp,
+@@ -1244,7 +1262,6 @@ static int vnet_port_remove(struct vio_dev *vdev)
+
+ kfree(port);
+
+- unregister_netdev(vp->dev);
+ }
+ return 0;
+ }
+@@ -1272,6 +1289,7 @@ static int __init vnet_init(void)
+ static void __exit vnet_exit(void)
+ {
+ vio_unregister_driver(&vnet_port_driver);
++ vnet_cleanup();
+ }
+
+ module_init(vnet_init);
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index bac88c22d990..fbe75a784edb 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -681,7 +681,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
+ dev->hard_header_len);
+
+- po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
++ po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
+ po->chan.private = sk;
+ po->chan.ops = &pppoe_chan_ops;
+
+diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
+index 9d1b3ca6334b..a884c322f3ea 100644
+--- a/drivers/net/wireless/mwifiex/main.c
++++ b/drivers/net/wireless/mwifiex/main.c
+@@ -457,6 +457,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ tx_info = MWIFIEX_SKB_TXCB(skb);
++ memset(tx_info, 0, sizeof(*tx_info));
+ tx_info->bss_num = priv->bss_num;
+ tx_info->bss_type = priv->bss_type;
+ mwifiex_fill_buffer(skb);
+diff --git a/kernel/power/process.c b/kernel/power/process.c
+index 19db29f67558..f27d0c8cd9e8 100644
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -185,6 +185,7 @@ void thaw_processes(void)
+
+ printk("Restarting tasks ... ");
+
++ __usermodehelper_set_disable_depth(UMH_FREEZING);
+ thaw_workqueues();
+
+ read_lock(&tasklist_lock);
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index 877aa733b961..b7045793bd56 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -569,9 +569,14 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
+ struct itimerspec *new_setting,
+ struct itimerspec *old_setting)
+ {
++ ktime_t exp;
++
+ if (!rtcdev)
+ return -ENOTSUPP;
+
++ if (flags & ~TIMER_ABSTIME)
++ return -EINVAL;
++
+ if (old_setting)
+ alarm_timer_get(timr, old_setting);
+
+@@ -581,8 +586,16 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
+
+ /* start the timer */
+ timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval);
+- alarm_start(&timr->it.alarm.alarmtimer,
+- timespec_to_ktime(new_setting->it_value));
++ exp = timespec_to_ktime(new_setting->it_value);
++ /* Convert (if necessary) to absolute time */
++ if (flags != TIMER_ABSTIME) {
++ ktime_t now;
++
++ now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
++ exp = ktime_add(now, exp);
++ }
++
++ alarm_start(&timr->it.alarm.alarmtimer, exp);
+ return 0;
+ }
+
+@@ -714,6 +727,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
+ if (!alarmtimer_get_rtcdev())
+ return -ENOTSUPP;
+
++ if (flags & ~TIMER_ABSTIME)
++ return -EINVAL;
++
+ if (!capable(CAP_WAKE_ALARM))
+ return -EPERM;
+
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 58c4a477be67..4bb5a80dd13b 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -76,6 +76,17 @@ static struct vfsmount *shm_mnt;
+ /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
+ #define SHORT_SYMLINK_LEN 128
+
++/*
++ * vmtruncate_range() communicates with shmem_fault via
++ * inode->i_private (with i_mutex making sure that it has only one user at
++ * a time): we would prefer not to enlarge the shmem inode just for that.
++ */
++struct shmem_falloc {
++ wait_queue_head_t *waitq; /* faults into hole wait for punch to end */
++ pgoff_t start; /* start of range currently being fallocated */
++ pgoff_t next; /* the next page offset to be fallocated */
++};
++
+ struct shmem_xattr {
+ struct list_head list; /* anchored by shmem_inode_info->xattr_list */
+ char *name; /* xattr name */
+@@ -488,22 +499,19 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+
+ index = start;
+- for ( ; ; ) {
++ while (index <= end) {
+ cond_resched();
+ pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
+ min(end - index, (pgoff_t)PAGEVEC_SIZE - 1) + 1,
+ pvec.pages, indices);
+ if (!pvec.nr) {
+- if (index == start)
++ /* If all gone or hole-punch, we're done */
++ if (index == start || end != -1)
+ break;
++ /* But if truncating, restart to make sure all gone */
+ index = start;
+ continue;
+ }
+- if (index == start && indices[0] > end) {
+- shmem_deswap_pagevec(&pvec);
+- pagevec_release(&pvec);
+- break;
+- }
+ mem_cgroup_uncharge_start();
+ for (i = 0; i < pagevec_count(&pvec); i++) {
+ struct page *page = pvec.pages[i];
+@@ -513,8 +521,12 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ break;
+
+ if (radix_tree_exceptional_entry(page)) {
+- nr_swaps_freed += !shmem_free_swap(mapping,
+- index, page);
++ if (shmem_free_swap(mapping, index, page)) {
++ /* Swap was replaced by page: retry */
++ index--;
++ break;
++ }
++ nr_swaps_freed++;
+ continue;
+ }
+
+@@ -522,6 +534,11 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ if (page->mapping == mapping) {
+ VM_BUG_ON(PageWriteback(page));
+ truncate_inode_page(mapping, page);
++ } else {
++ /* Page was replaced by swap: retry */
++ unlock_page(page);
++ index--;
++ break;
+ }
+ unlock_page(page);
+ }
+@@ -1060,6 +1077,63 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ int error;
+ int ret = VM_FAULT_LOCKED;
+
++ /*
++ * Trinity finds that probing a hole which tmpfs is punching can
++ * prevent the hole-punch from ever completing: which in turn
++ * locks writers out with its hold on i_mutex. So refrain from
++ * faulting pages into the hole while it's being punched. Although
++ * shmem_truncate_range() does remove the additions, it may be unable to
++ * keep up, as each new page needs its own unmap_mapping_range() call,
++ * and the i_mmap tree grows ever slower to scan if new vmas are added.
++ *
++ * It does not matter if we sometimes reach this check just before the
++ * hole-punch begins, so that one fault then races with the punch:
++ * we just need to make racing faults a rare case.
++ *
++ * The implementation below would be much simpler if we just used a
++ * standard mutex or completion: but we cannot take i_mutex in fault,
++ * and bloating every shmem inode for this unlikely case would be sad.
++ */
++ if (unlikely(inode->i_private)) {
++ struct shmem_falloc *shmem_falloc;
++
++ spin_lock(&inode->i_lock);
++ shmem_falloc = inode->i_private;
++ if (shmem_falloc &&
++ vmf->pgoff >= shmem_falloc->start &&
++ vmf->pgoff < shmem_falloc->next) {
++ wait_queue_head_t *shmem_falloc_waitq;
++ DEFINE_WAIT(shmem_fault_wait);
++
++ ret = VM_FAULT_NOPAGE;
++ if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
++ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
++ /* It's polite to up mmap_sem if we can */
++ up_read(&vma->vm_mm->mmap_sem);
++ ret = VM_FAULT_RETRY;
++ }
++
++ shmem_falloc_waitq = shmem_falloc->waitq;
++ prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait,
++ TASK_UNINTERRUPTIBLE);
++ spin_unlock(&inode->i_lock);
++ schedule();
++
++ /*
++ * shmem_falloc_waitq points into the vmtruncate_range()
++ * stack of the hole-punching task: shmem_falloc_waitq
++ * is usually invalid by the time we reach here, but
++ * finish_wait() does not dereference it in that case;
++ * though i_lock needed lest racing with wake_up_all().
++ */
++ spin_lock(&inode->i_lock);
++ finish_wait(shmem_falloc_waitq, &shmem_fault_wait);
++ spin_unlock(&inode->i_lock);
++ return ret;
++ }
++ spin_unlock(&inode->i_lock);
++ }
++
+ error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret);
+ if (error)
+ return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS);
+@@ -1071,6 +1145,47 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ return ret;
+ }
+
++int vmtruncate_range(struct inode *inode, loff_t lstart, loff_t lend)
++{
++ /*
++ * If the underlying filesystem is not going to provide
++ * a way to truncate a range of blocks (punch a hole) -
++ * we should return failure right now.
++ * Only CONFIG_SHMEM shmem.c ever supported i_op->truncate_range().
++ */
++ if (inode->i_op->truncate_range != shmem_truncate_range)
++ return -ENOSYS;
++
++ mutex_lock(&inode->i_mutex);
++ {
++ struct shmem_falloc shmem_falloc;
++ struct address_space *mapping = inode->i_mapping;
++ loff_t unmap_start = round_up(lstart, PAGE_SIZE);
++ loff_t unmap_end = round_down(1 + lend, PAGE_SIZE) - 1;
++ DECLARE_WAIT_QUEUE_HEAD_ONSTACK(shmem_falloc_waitq);
++
++ shmem_falloc.waitq = &shmem_falloc_waitq;
++ shmem_falloc.start = unmap_start >> PAGE_SHIFT;
++ shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
++ spin_lock(&inode->i_lock);
++ inode->i_private = &shmem_falloc;
++ spin_unlock(&inode->i_lock);
++
++ if ((u64)unmap_end > (u64)unmap_start)
++ unmap_mapping_range(mapping, unmap_start,
++ 1 + unmap_end - unmap_start, 0);
++ shmem_truncate_range(inode, lstart, lend);
++ /* No need to unmap again: hole-punching leaves COWed pages */
++
++ spin_lock(&inode->i_lock);
++ inode->i_private = NULL;
++ wake_up_all(&shmem_falloc_waitq);
++ spin_unlock(&inode->i_lock);
++ }
++ mutex_unlock(&inode->i_mutex);
++ return 0;
++}
++
+ #ifdef CONFIG_NUMA
+ static int shmem_set_policy(struct vm_area_struct *vma, struct mempolicy *mpol)
+ {
+@@ -2547,6 +2662,12 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+ EXPORT_SYMBOL_GPL(shmem_truncate_range);
+
++int vmtruncate_range(struct inode *inode, loff_t lstart, loff_t lend)
++{
++ /* Only CONFIG_SHMEM shmem.c ever supported i_op->truncate_range(). */
++ return -ENOSYS;
++}
++
+ #define shmem_vm_ops generic_file_vm_ops
+ #define shmem_file_operations ramfs_file_operations
+ #define shmem_get_inode(sb, dir, mode, dev, flags) ramfs_get_inode(sb, dir, mode, dev)
+diff --git a/mm/truncate.c b/mm/truncate.c
+index 4224627695ba..f38055cb8af6 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -603,31 +603,6 @@ int vmtruncate(struct inode *inode, loff_t newsize)
+ }
+ EXPORT_SYMBOL(vmtruncate);
+
+-int vmtruncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+-{
+- struct address_space *mapping = inode->i_mapping;
+- loff_t holebegin = round_up(lstart, PAGE_SIZE);
+- loff_t holelen = 1 + lend - holebegin;
+-
+- /*
+- * If the underlying filesystem is not going to provide
+- * a way to truncate a range of blocks (punch a hole) -
+- * we should return failure right now.
+- */
+- if (!inode->i_op->truncate_range)
+- return -ENOSYS;
+-
+- mutex_lock(&inode->i_mutex);
+- inode_dio_wait(inode);
+- unmap_mapping_range(mapping, holebegin, holelen, 1);
+- inode->i_op->truncate_range(inode, lstart, lend);
+- /* unmap again to remove racily COWed private pages */
+- unmap_mapping_range(mapping, holebegin, holelen, 1);
+- mutex_unlock(&inode->i_mutex);
+-
+- return 0;
+-}
+-
+ /**
+ * truncate_pagecache_range - unmap and remove pagecache that is hole-punched
+ * @inode: inode
+diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
+index 912613c566cb..37c486c019fe 100644
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -96,8 +96,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_id);
+
+ static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
+ {
+- if (skb_cow(skb, skb_headroom(skb)) < 0)
++ if (skb_cow(skb, skb_headroom(skb)) < 0) {
++ kfree_skb(skb);
+ return NULL;
++ }
++
+ memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
+ skb->mac_header += VLAN_HLEN;
+ return skb;
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 334d4cd7612f..79aaac288afb 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1494,8 +1494,6 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
+ goto drop;
+
+ /* Queue packet (standard) */
+- skb->sk = sock;
+-
+ if (sock_queue_rcv_skb(sock, skb) < 0)
+ goto drop;
+
+@@ -1649,7 +1647,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
+ if (!skb)
+ goto out;
+
+- skb->sk = sk;
+ skb_reserve(skb, ddp_dl->header_length);
+ skb_reserve(skb, dev->hard_header_len);
+ skb->dev = dev;
+diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
+index c32be292c7e3..2022b46ab38f 100644
+--- a/net/dns_resolver/dns_query.c
++++ b/net/dns_resolver/dns_query.c
+@@ -150,7 +150,9 @@ int dns_query(const char *type, const char *name, size_t namelen,
+ if (!*_result)
+ goto put;
+
+- memcpy(*_result, upayload->data, len + 1);
++ memcpy(*_result, upayload->data, len);
++ (*_result)[len] = '\0';
++
+ if (_expiry)
+ *_expiry = rkey->expiry;
+
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index c8e26992742f..3f0bb3b3819d 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1866,6 +1866,10 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
+
+ rtnl_lock();
+ in_dev = ip_mc_find_dev(net, imr);
++ if (!in_dev) {
++ ret = -ENODEV;
++ goto out;
++ }
+ ifindex = imr->imr_ifindex;
+ for (imlp = &inet->mc_list;
+ (iml = rtnl_dereference(*imlp)) != NULL;
+@@ -1883,16 +1887,14 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
+
+ *imlp = iml->next_rcu;
+
+- if (in_dev)
+- ip_mc_dec_group(in_dev, group);
++ ip_mc_dec_group(in_dev, group);
+ rtnl_unlock();
+ /* decrease mem now to avoid the memleak warning */
+ atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+ kfree_rcu(iml, rcu);
+ return 0;
+ }
+- if (!in_dev)
+- ret = -ENODEV;
++out:
+ rtnl_unlock();
+ return ret;
+ }
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index b69a3700642b..523541730777 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -279,6 +279,10 @@ int ip_options_compile(struct net *net,
+ optptr++;
+ continue;
+ }
++ if (unlikely(l < 2)) {
++ pp_ptr = optptr;
++ goto error;
++ }
+ optlen = optptr[1];
+ if (optlen<2 || optlen>l) {
+ pp_ptr = optptr;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 99eb909c9d5f..2d3290496a0a 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1250,7 +1250,7 @@ static int tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
+ }
+
+ /* D-SACK for already forgotten data... Do dumb counting. */
+- if (dup_sack && tp->undo_marker && tp->undo_retrans &&
++ if (dup_sack && tp->undo_marker && tp->undo_retrans > 0 &&
+ !after(end_seq_0, prior_snd_una) &&
+ after(end_seq_0, tp->undo_marker))
+ tp->undo_retrans--;
+@@ -1304,7 +1304,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
+ unsigned int new_len = (pkt_len / mss) * mss;
+ if (!in_sack && new_len < pkt_len) {
+ new_len += mss;
+- if (new_len > skb->len)
++ if (new_len >= skb->len)
+ return 0;
+ }
+ pkt_len = new_len;
+@@ -1328,7 +1328,7 @@ static u8 tcp_sacktag_one(struct sock *sk,
+
+ /* Account D-SACK for retransmitted packet. */
+ if (dup_sack && (sacked & TCPCB_RETRANS)) {
+- if (tp->undo_marker && tp->undo_retrans &&
++ if (tp->undo_marker && tp->undo_retrans > 0 &&
+ after(end_seq, tp->undo_marker))
+ tp->undo_retrans--;
+ if (sacked & TCPCB_SACKED_ACKED)
+@@ -2226,7 +2226,7 @@ static void tcp_clear_retrans_partial(struct tcp_sock *tp)
+ tp->lost_out = 0;
+
+ tp->undo_marker = 0;
+- tp->undo_retrans = 0;
++ tp->undo_retrans = -1;
+ }
+
+ void tcp_clear_retrans(struct tcp_sock *tp)
+@@ -3165,7 +3165,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
+ tp->high_seq = tp->snd_nxt;
+ tp->prior_ssthresh = 0;
+ tp->undo_marker = tp->snd_una;
+- tp->undo_retrans = tp->retrans_out;
++ tp->undo_retrans = tp->retrans_out ? : -1;
+
+ if (icsk->icsk_ca_state < TCP_CA_CWR) {
+ if (!(flag & FLAG_ECE))
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 987f5cc706b4..fd414b61f966 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2194,13 +2194,15 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ if (!tp->retrans_stamp)
+ tp->retrans_stamp = TCP_SKB_CB(skb)->when;
+
+- tp->undo_retrans += tcp_skb_pcount(skb);
+-
+ /* snd_nxt is stored to detect loss of retransmitted segment,
+ * see tcp_input.c tcp_sacktag_write_queue().
+ */
+ TCP_SKB_CB(skb)->ack_seq = tp->snd_nxt;
+ }
++
++ if (tp->undo_retrans < 0)
++ tp->undo_retrans = 0;
++ tp->undo_retrans += tcp_skb_pcount(skb);
+ return err;
+ }
+
+diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
+index 8a84017834c2..57da44707eb1 100644
+--- a/net/sctp/ulpevent.c
++++ b/net/sctp/ulpevent.c
+@@ -373,9 +373,10 @@ fail:
+ * specification [SCTP] and any extensions for a list of possible
+ * error formats.
+ */
+-struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
+- const struct sctp_association *asoc, struct sctp_chunk *chunk,
+- __u16 flags, gfp_t gfp)
++struct sctp_ulpevent *
++sctp_ulpevent_make_remote_error(const struct sctp_association *asoc,
++ struct sctp_chunk *chunk, __u16 flags,
++ gfp_t gfp)
+ {
+ struct sctp_ulpevent *event;
+ struct sctp_remote_error *sre;
+@@ -394,8 +395,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
+ /* Copy the skb to a new skb with room for us to prepend
+ * notification with.
+ */
+- skb = skb_copy_expand(chunk->skb, sizeof(struct sctp_remote_error),
+- 0, gfp);
++ skb = skb_copy_expand(chunk->skb, sizeof(*sre), 0, gfp);
+
+ /* Pull off the rest of the cause TLV from the chunk. */
+ skb_pull(chunk->skb, elen);
+@@ -406,62 +406,21 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
+ event = sctp_skb2event(skb);
+ sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
+
+- sre = (struct sctp_remote_error *)
+- skb_push(skb, sizeof(struct sctp_remote_error));
++ sre = (struct sctp_remote_error *) skb_push(skb, sizeof(*sre));
+
+ /* Trim the buffer to the right length. */
+- skb_trim(skb, sizeof(struct sctp_remote_error) + elen);
++ skb_trim(skb, sizeof(*sre) + elen);
+
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_type:
+- * It should be SCTP_REMOTE_ERROR.
+- */
++ /* RFC6458, Section 6.1.3. SCTP_REMOTE_ERROR */
++ memset(sre, 0, sizeof(*sre));
+ sre->sre_type = SCTP_REMOTE_ERROR;
+-
+- /*
+- * Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_flags: 16 bits (unsigned integer)
+- * Currently unused.
+- */
+ sre->sre_flags = 0;
+-
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_length: sizeof (__u32)
+- *
+- * This field is the total length of the notification data,
+- * including the notification header.
+- */
+ sre->sre_length = skb->len;
+-
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_error: 16 bits (unsigned integer)
+- * This value represents one of the Operational Error causes defined in
+- * the SCTP specification, in network byte order.
+- */
+ sre->sre_error = cause;
+-
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_assoc_id: sizeof (sctp_assoc_t)
+- *
+- * The association id field, holds the identifier for the association.
+- * All notifications for a given association have the same association
+- * identifier. For TCP style socket, this field is ignored.
+- */
+ sctp_ulpevent_set_owner(event, asoc);
+ sre->sre_assoc_id = sctp_assoc2id(asoc);
+
+ return event;
+-
+ fail:
+ return NULL;
+ }
+@@ -904,7 +863,9 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
+ return notification->sn_header.sn_type;
+ }
+
+-/* Copy out the sndrcvinfo into a msghdr. */
++/* RFC6458, Section 5.3.2. SCTP Header Information Structure
++ * (SCTP_SNDRCV, DEPRECATED)
++ */
+ void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
+ struct msghdr *msghdr)
+ {
+@@ -913,74 +874,21 @@ void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
+ if (sctp_ulpevent_is_notification(event))
+ return;
+
+- /* Sockets API Extensions for SCTP
+- * Section 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
+- *
+- * sinfo_stream: 16 bits (unsigned integer)
+- *
+- * For recvmsg() the SCTP stack places the message's stream number in
+- * this value.
+- */
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.sinfo_stream = event->stream;
+- /* sinfo_ssn: 16 bits (unsigned integer)
+- *
+- * For recvmsg() this value contains the stream sequence number that
+- * the remote endpoint placed in the DATA chunk. For fragmented
+- * messages this is the same number for all deliveries of the message
+- * (if more than one recvmsg() is needed to read the message).
+- */
+ sinfo.sinfo_ssn = event->ssn;
+- /* sinfo_ppid: 32 bits (unsigned integer)
+- *
+- * In recvmsg() this value is
+- * the same information that was passed by the upper layer in the peer
+- * application. Please note that byte order issues are NOT accounted
+- * for and this information is passed opaquely by the SCTP stack from
+- * one end to the other.
+- */
+ sinfo.sinfo_ppid = event->ppid;
+- /* sinfo_flags: 16 bits (unsigned integer)
+- *
+- * This field may contain any of the following flags and is composed of
+- * a bitwise OR of these values.
+- *
+- * recvmsg() flags:
+- *
+- * SCTP_UNORDERED - This flag is present when the message was sent
+- * non-ordered.
+- */
+ sinfo.sinfo_flags = event->flags;
+- /* sinfo_tsn: 32 bit (unsigned integer)
+- *
+- * For the receiving side, this field holds a TSN that was
+- * assigned to one of the SCTP Data Chunks.
+- */
+ sinfo.sinfo_tsn = event->tsn;
+- /* sinfo_cumtsn: 32 bit (unsigned integer)
+- *
+- * This field will hold the current cumulative TSN as
+- * known by the underlying SCTP layer. Note this field is
+- * ignored when sending and only valid for a receive
+- * operation when sinfo_flags are set to SCTP_UNORDERED.
+- */
+ sinfo.sinfo_cumtsn = event->cumtsn;
+- /* sinfo_assoc_id: sizeof (sctp_assoc_t)
+- *
+- * The association handle field, sinfo_assoc_id, holds the identifier
+- * for the association announced in the COMMUNICATION_UP notification.
+- * All notifications for a given association have the same identifier.
+- * Ignored for one-to-one style sockets.
+- */
+ sinfo.sinfo_assoc_id = sctp_assoc2id(event->asoc);
+-
+- /* context value that is set via SCTP_CONTEXT socket option. */
++ /* Context value that is set via SCTP_CONTEXT socket option. */
+ sinfo.sinfo_context = event->asoc->default_rcv_context;
+-
+ /* These fields are not used while receiving. */
+ sinfo.sinfo_timetolive = 0;
+
+ put_cmsg(msghdr, IPPROTO_SCTP, SCTP_SNDRCV,
+- sizeof(struct sctp_sndrcvinfo), (void *)&sinfo);
++ sizeof(sinfo), &sinfo);
+ }
+
+ /* Do accounting for bytes received and hold a reference to the association
+diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
+index e00441a2092f..9495be3a61e0 100644
+--- a/net/tipc/bcast.c
++++ b/net/tipc/bcast.c
+@@ -541,6 +541,7 @@ receive:
+
+ buf = node->bclink.deferred_head;
+ node->bclink.deferred_head = buf->next;
++ buf->next = NULL;
+ node->bclink.deferred_size--;
+ goto receive;
+ }
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
2014-08-19 11:41 Mike Pagano
@ 2014-07-28 16:52 ` Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-07-28 16:52 UTC (permalink / raw
To: gentoo-commits
commit: da70b949627e538e9465762c96f64ef07190e788
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 28 16:50:30 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jul 28 16:50:30 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=da70b949
Linux patch 3.4.100
---
0000_README | 4 +
1099_linux-3.4.100.patch | 929 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 933 insertions(+)
diff --git a/0000_README b/0000_README
index d5d9d81..af7f3f3 100644
--- a/0000_README
+++ b/0000_README
@@ -435,6 +435,10 @@ Patch: 1098_linux-3.4.99.patch
From: http://www.kernel.org
Desc: Linux 3.4.99
+Patch: 1099_linux-3.4.100.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.100
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1099_linux-3.4.100.patch b/1099_linux-3.4.100.patch
new file mode 100644
index 0000000..597e1fd
--- /dev/null
+++ b/1099_linux-3.4.100.patch
@@ -0,0 +1,929 @@
+diff --git a/Makefile b/Makefile
+index ed97caf40f71..d6c64eb82525 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 99
++SUBLEVEL = 100
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
+index 268b2455e7b0..b1cbcff69cdb 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel.c
++++ b/arch/x86/kernel/cpu/perf_event_intel.c
+@@ -1070,6 +1070,15 @@ again:
+ intel_pmu_lbr_read();
+
+ /*
++ * CondChgd bit 63 doesn't mean any overflow status. Ignore
++ * and clear the bit.
++ */
++ if (__test_and_clear_bit(63, (unsigned long *)&status)) {
++ if (!status)
++ goto done;
++ }
++
++ /*
+ * PEBS overflow sets bit 62 in the global status register
+ */
+ if (__test_and_clear_bit(62, (unsigned long *)&status)) {
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 36e5a8ee0e1e..1ae2e0ea5492 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -14558,38 +14558,40 @@ static struct pcomp_testvec zlib_decomp_tv_template[] = {
+ static struct comp_testvec lzo_comp_tv_template[] = {
+ {
+ .inlen = 70,
+- .outlen = 46,
++ .outlen = 57,
+ .input = "Join us now and share the software "
+ "Join us now and share the software ",
+ .output = "\x00\x0d\x4a\x6f\x69\x6e\x20\x75"
+- "\x73\x20\x6e\x6f\x77\x20\x61\x6e"
+- "\x64\x20\x73\x68\x61\x72\x65\x20"
+- "\x74\x68\x65\x20\x73\x6f\x66\x74"
+- "\x77\x70\x01\x01\x4a\x6f\x69\x6e"
+- "\x3d\x88\x00\x11\x00\x00",
++ "\x73\x20\x6e\x6f\x77\x20\x61\x6e"
++ "\x64\x20\x73\x68\x61\x72\x65\x20"
++ "\x74\x68\x65\x20\x73\x6f\x66\x74"
++ "\x77\x70\x01\x32\x88\x00\x0c\x65"
++ "\x20\x74\x68\x65\x20\x73\x6f\x66"
++ "\x74\x77\x61\x72\x65\x20\x11\x00"
++ "\x00",
+ }, {
+ .inlen = 159,
+- .outlen = 133,
++ .outlen = 131,
+ .input = "This document describes a compression method based on the LZO "
+ "compression algorithm. This document defines the application of "
+ "the LZO algorithm used in UBIFS.",
+- .output = "\x00\x2b\x54\x68\x69\x73\x20\x64"
++ .output = "\x00\x2c\x54\x68\x69\x73\x20\x64"
+ "\x6f\x63\x75\x6d\x65\x6e\x74\x20"
+ "\x64\x65\x73\x63\x72\x69\x62\x65"
+ "\x73\x20\x61\x20\x63\x6f\x6d\x70"
+ "\x72\x65\x73\x73\x69\x6f\x6e\x20"
+ "\x6d\x65\x74\x68\x6f\x64\x20\x62"
+ "\x61\x73\x65\x64\x20\x6f\x6e\x20"
+- "\x74\x68\x65\x20\x4c\x5a\x4f\x2b"
+- "\x8c\x00\x0d\x61\x6c\x67\x6f\x72"
+- "\x69\x74\x68\x6d\x2e\x20\x20\x54"
+- "\x68\x69\x73\x2a\x54\x01\x02\x66"
+- "\x69\x6e\x65\x73\x94\x06\x05\x61"
+- "\x70\x70\x6c\x69\x63\x61\x74\x76"
+- "\x0a\x6f\x66\x88\x02\x60\x09\x27"
+- "\xf0\x00\x0c\x20\x75\x73\x65\x64"
+- "\x20\x69\x6e\x20\x55\x42\x49\x46"
+- "\x53\x2e\x11\x00\x00",
++ "\x74\x68\x65\x20\x4c\x5a\x4f\x20"
++ "\x2a\x8c\x00\x09\x61\x6c\x67\x6f"
++ "\x72\x69\x74\x68\x6d\x2e\x20\x20"
++ "\x2e\x54\x01\x03\x66\x69\x6e\x65"
++ "\x73\x20\x74\x06\x05\x61\x70\x70"
++ "\x6c\x69\x63\x61\x74\x76\x0a\x6f"
++ "\x66\x88\x02\x60\x09\x27\xf0\x00"
++ "\x0c\x20\x75\x73\x65\x64\x20\x69"
++ "\x6e\x20\x55\x42\x49\x46\x53\x2e"
++ "\x11\x00\x00",
+ },
+ };
+
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index 60404f4b2446..adc9bfd4d82f 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -709,6 +709,10 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ struct radeon_device *rdev = dev->dev_private;
+ int ret = 0;
+
++ /* don't leak the edid if we already fetched it in detect() */
++ if (radeon_connector->edid)
++ goto got_edid;
++
+ /* on hw with routers, select right port */
+ if (radeon_connector->router.ddc_valid)
+ radeon_router_select_ddc_port(radeon_connector);
+@@ -748,6 +752,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev);
+ }
+ if (radeon_connector->edid) {
++got_edid:
+ drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
+ ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
+ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index 97b2e21ac46a..cf065df9bb18 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -582,7 +582,7 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+ {
+ struct intel_iommu *iommu;
+ int map_size;
+- u32 ver;
++ u32 ver, sts;
+ static int iommu_allocated = 0;
+ int agaw = 0;
+ int msagaw = 0;
+@@ -652,6 +652,15 @@ int alloc_iommu(struct dmar_drhd_unit *drhd)
+ (unsigned long long)iommu->cap,
+ (unsigned long long)iommu->ecap);
+
++ /* Reflect status in gcmd */
++ sts = readl(iommu->reg + DMAR_GSTS_REG);
++ if (sts & DMA_GSTS_IRES)
++ iommu->gcmd |= DMA_GCMD_IRE;
++ if (sts & DMA_GSTS_TES)
++ iommu->gcmd |= DMA_GCMD_TE;
++ if (sts & DMA_GSTS_QIES)
++ iommu->gcmd |= DMA_GCMD_QIE;
++
+ raw_spin_lock_init(&iommu->register_lock);
+
+ drhd->iommu = iommu;
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 4e1c6bfc9c8d..dd255c578ad9 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -3659,6 +3659,7 @@ static struct notifier_block device_nb = {
+ int __init intel_iommu_init(void)
+ {
+ int ret = 0;
++ struct dmar_drhd_unit *drhd;
+
+ /* VT-d is required for a TXT/tboot launch, so enforce that */
+ force_on = tboot_force_iommu();
+@@ -3669,6 +3670,20 @@ int __init intel_iommu_init(void)
+ return -ENODEV;
+ }
+
++ /*
++ * Disable translation if already enabled prior to OS handover.
++ */
++ for_each_drhd_unit(drhd) {
++ struct intel_iommu *iommu;
++
++ if (drhd->ignored)
++ continue;
++
++ iommu = drhd->iommu;
++ if (iommu->gcmd & DMA_GCMD_TE)
++ iommu_disable_translation(iommu);
++ }
++
+ if (dmar_dev_scope_init() < 0) {
+ if (force_on)
+ panic("tboot: Failed to initialize DMAR device scope\n");
+diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
+index ef1f9400b967..b2740f12b180 100644
+--- a/drivers/net/ethernet/emulex/benet/be_main.c
++++ b/drivers/net/ethernet/emulex/benet/be_main.c
+@@ -2411,7 +2411,7 @@ static int be_open(struct net_device *netdev)
+
+ for_all_evt_queues(adapter, eqo, i) {
+ napi_enable(&eqo->napi);
+- be_eq_notify(adapter, eqo->q.id, true, false, 0);
++ be_eq_notify(adapter, eqo->q.id, true, true, 0);
+ }
+
+ status = be_cmd_link_status_query(adapter, NULL, NULL,
+diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c
+index 8e2ac643a777..ed6ec513defa 100644
+--- a/drivers/net/ethernet/sun/sunvnet.c
++++ b/drivers/net/ethernet/sun/sunvnet.c
+@@ -1086,6 +1086,24 @@ static struct vnet * __devinit vnet_find_or_create(const u64 *local_mac)
+ return vp;
+ }
+
++static void vnet_cleanup(void)
++{
++ struct vnet *vp;
++ struct net_device *dev;
++
++ mutex_lock(&vnet_list_mutex);
++ while (!list_empty(&vnet_list)) {
++ vp = list_first_entry(&vnet_list, struct vnet, list);
++ list_del(&vp->list);
++ dev = vp->dev;
++ /* vio_unregister_driver() should have cleaned up port_list */
++ BUG_ON(!list_empty(&vp->port_list));
++ unregister_netdev(dev);
++ free_netdev(dev);
++ }
++ mutex_unlock(&vnet_list_mutex);
++}
++
+ static const char *local_mac_prop = "local-mac-address";
+
+ static struct vnet * __devinit vnet_find_parent(struct mdesc_handle *hp,
+@@ -1244,7 +1262,6 @@ static int vnet_port_remove(struct vio_dev *vdev)
+
+ kfree(port);
+
+- unregister_netdev(vp->dev);
+ }
+ return 0;
+ }
+@@ -1272,6 +1289,7 @@ static int __init vnet_init(void)
+ static void __exit vnet_exit(void)
+ {
+ vio_unregister_driver(&vnet_port_driver);
++ vnet_cleanup();
+ }
+
+ module_init(vnet_init);
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index bac88c22d990..fbe75a784edb 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -681,7 +681,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ po->chan.hdrlen = (sizeof(struct pppoe_hdr) +
+ dev->hard_header_len);
+
+- po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr);
++ po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2;
+ po->chan.private = sk;
+ po->chan.ops = &pppoe_chan_ops;
+
+diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
+index 9d1b3ca6334b..a884c322f3ea 100644
+--- a/drivers/net/wireless/mwifiex/main.c
++++ b/drivers/net/wireless/mwifiex/main.c
+@@ -457,6 +457,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ }
+
+ tx_info = MWIFIEX_SKB_TXCB(skb);
++ memset(tx_info, 0, sizeof(*tx_info));
+ tx_info->bss_num = priv->bss_num;
+ tx_info->bss_type = priv->bss_type;
+ mwifiex_fill_buffer(skb);
+diff --git a/kernel/power/process.c b/kernel/power/process.c
+index 19db29f67558..f27d0c8cd9e8 100644
+--- a/kernel/power/process.c
++++ b/kernel/power/process.c
+@@ -185,6 +185,7 @@ void thaw_processes(void)
+
+ printk("Restarting tasks ... ");
+
++ __usermodehelper_set_disable_depth(UMH_FREEZING);
+ thaw_workqueues();
+
+ read_lock(&tasklist_lock);
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index 877aa733b961..b7045793bd56 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -569,9 +569,14 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
+ struct itimerspec *new_setting,
+ struct itimerspec *old_setting)
+ {
++ ktime_t exp;
++
+ if (!rtcdev)
+ return -ENOTSUPP;
+
++ if (flags & ~TIMER_ABSTIME)
++ return -EINVAL;
++
+ if (old_setting)
+ alarm_timer_get(timr, old_setting);
+
+@@ -581,8 +586,16 @@ static int alarm_timer_set(struct k_itimer *timr, int flags,
+
+ /* start the timer */
+ timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval);
+- alarm_start(&timr->it.alarm.alarmtimer,
+- timespec_to_ktime(new_setting->it_value));
++ exp = timespec_to_ktime(new_setting->it_value);
++ /* Convert (if necessary) to absolute time */
++ if (flags != TIMER_ABSTIME) {
++ ktime_t now;
++
++ now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime();
++ exp = ktime_add(now, exp);
++ }
++
++ alarm_start(&timr->it.alarm.alarmtimer, exp);
+ return 0;
+ }
+
+@@ -714,6 +727,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
+ if (!alarmtimer_get_rtcdev())
+ return -ENOTSUPP;
+
++ if (flags & ~TIMER_ABSTIME)
++ return -EINVAL;
++
+ if (!capable(CAP_WAKE_ALARM))
+ return -EPERM;
+
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 58c4a477be67..4bb5a80dd13b 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -76,6 +76,17 @@ static struct vfsmount *shm_mnt;
+ /* Symlink up to this size is kmalloc'ed instead of using a swappable page */
+ #define SHORT_SYMLINK_LEN 128
+
++/*
++ * vmtruncate_range() communicates with shmem_fault via
++ * inode->i_private (with i_mutex making sure that it has only one user at
++ * a time): we would prefer not to enlarge the shmem inode just for that.
++ */
++struct shmem_falloc {
++ wait_queue_head_t *waitq; /* faults into hole wait for punch to end */
++ pgoff_t start; /* start of range currently being fallocated */
++ pgoff_t next; /* the next page offset to be fallocated */
++};
++
+ struct shmem_xattr {
+ struct list_head list; /* anchored by shmem_inode_info->xattr_list */
+ char *name; /* xattr name */
+@@ -488,22 +499,19 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+
+ index = start;
+- for ( ; ; ) {
++ while (index <= end) {
+ cond_resched();
+ pvec.nr = shmem_find_get_pages_and_swap(mapping, index,
+ min(end - index, (pgoff_t)PAGEVEC_SIZE - 1) + 1,
+ pvec.pages, indices);
+ if (!pvec.nr) {
+- if (index == start)
++ /* If all gone or hole-punch, we're done */
++ if (index == start || end != -1)
+ break;
++ /* But if truncating, restart to make sure all gone */
+ index = start;
+ continue;
+ }
+- if (index == start && indices[0] > end) {
+- shmem_deswap_pagevec(&pvec);
+- pagevec_release(&pvec);
+- break;
+- }
+ mem_cgroup_uncharge_start();
+ for (i = 0; i < pagevec_count(&pvec); i++) {
+ struct page *page = pvec.pages[i];
+@@ -513,8 +521,12 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ break;
+
+ if (radix_tree_exceptional_entry(page)) {
+- nr_swaps_freed += !shmem_free_swap(mapping,
+- index, page);
++ if (shmem_free_swap(mapping, index, page)) {
++ /* Swap was replaced by page: retry */
++ index--;
++ break;
++ }
++ nr_swaps_freed++;
+ continue;
+ }
+
+@@ -522,6 +534,11 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ if (page->mapping == mapping) {
+ VM_BUG_ON(PageWriteback(page));
+ truncate_inode_page(mapping, page);
++ } else {
++ /* Page was replaced by swap: retry */
++ unlock_page(page);
++ index--;
++ break;
+ }
+ unlock_page(page);
+ }
+@@ -1060,6 +1077,63 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ int error;
+ int ret = VM_FAULT_LOCKED;
+
++ /*
++ * Trinity finds that probing a hole which tmpfs is punching can
++ * prevent the hole-punch from ever completing: which in turn
++ * locks writers out with its hold on i_mutex. So refrain from
++ * faulting pages into the hole while it's being punched. Although
++ * shmem_truncate_range() does remove the additions, it may be unable to
++ * keep up, as each new page needs its own unmap_mapping_range() call,
++ * and the i_mmap tree grows ever slower to scan if new vmas are added.
++ *
++ * It does not matter if we sometimes reach this check just before the
++ * hole-punch begins, so that one fault then races with the punch:
++ * we just need to make racing faults a rare case.
++ *
++ * The implementation below would be much simpler if we just used a
++ * standard mutex or completion: but we cannot take i_mutex in fault,
++ * and bloating every shmem inode for this unlikely case would be sad.
++ */
++ if (unlikely(inode->i_private)) {
++ struct shmem_falloc *shmem_falloc;
++
++ spin_lock(&inode->i_lock);
++ shmem_falloc = inode->i_private;
++ if (shmem_falloc &&
++ vmf->pgoff >= shmem_falloc->start &&
++ vmf->pgoff < shmem_falloc->next) {
++ wait_queue_head_t *shmem_falloc_waitq;
++ DEFINE_WAIT(shmem_fault_wait);
++
++ ret = VM_FAULT_NOPAGE;
++ if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) &&
++ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) {
++ /* It's polite to up mmap_sem if we can */
++ up_read(&vma->vm_mm->mmap_sem);
++ ret = VM_FAULT_RETRY;
++ }
++
++ shmem_falloc_waitq = shmem_falloc->waitq;
++ prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait,
++ TASK_UNINTERRUPTIBLE);
++ spin_unlock(&inode->i_lock);
++ schedule();
++
++ /*
++ * shmem_falloc_waitq points into the vmtruncate_range()
++ * stack of the hole-punching task: shmem_falloc_waitq
++ * is usually invalid by the time we reach here, but
++ * finish_wait() does not dereference it in that case;
++ * though i_lock needed lest racing with wake_up_all().
++ */
++ spin_lock(&inode->i_lock);
++ finish_wait(shmem_falloc_waitq, &shmem_fault_wait);
++ spin_unlock(&inode->i_lock);
++ return ret;
++ }
++ spin_unlock(&inode->i_lock);
++ }
++
+ error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret);
+ if (error)
+ return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS);
+@@ -1071,6 +1145,47 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ return ret;
+ }
+
++int vmtruncate_range(struct inode *inode, loff_t lstart, loff_t lend)
++{
++ /*
++ * If the underlying filesystem is not going to provide
++ * a way to truncate a range of blocks (punch a hole) -
++ * we should return failure right now.
++ * Only CONFIG_SHMEM shmem.c ever supported i_op->truncate_range().
++ */
++ if (inode->i_op->truncate_range != shmem_truncate_range)
++ return -ENOSYS;
++
++ mutex_lock(&inode->i_mutex);
++ {
++ struct shmem_falloc shmem_falloc;
++ struct address_space *mapping = inode->i_mapping;
++ loff_t unmap_start = round_up(lstart, PAGE_SIZE);
++ loff_t unmap_end = round_down(1 + lend, PAGE_SIZE) - 1;
++ DECLARE_WAIT_QUEUE_HEAD_ONSTACK(shmem_falloc_waitq);
++
++ shmem_falloc.waitq = &shmem_falloc_waitq;
++ shmem_falloc.start = unmap_start >> PAGE_SHIFT;
++ shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT;
++ spin_lock(&inode->i_lock);
++ inode->i_private = &shmem_falloc;
++ spin_unlock(&inode->i_lock);
++
++ if ((u64)unmap_end > (u64)unmap_start)
++ unmap_mapping_range(mapping, unmap_start,
++ 1 + unmap_end - unmap_start, 0);
++ shmem_truncate_range(inode, lstart, lend);
++ /* No need to unmap again: hole-punching leaves COWed pages */
++
++ spin_lock(&inode->i_lock);
++ inode->i_private = NULL;
++ wake_up_all(&shmem_falloc_waitq);
++ spin_unlock(&inode->i_lock);
++ }
++ mutex_unlock(&inode->i_mutex);
++ return 0;
++}
++
+ #ifdef CONFIG_NUMA
+ static int shmem_set_policy(struct vm_area_struct *vma, struct mempolicy *mpol)
+ {
+@@ -2547,6 +2662,12 @@ void shmem_truncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+ }
+ EXPORT_SYMBOL_GPL(shmem_truncate_range);
+
++int vmtruncate_range(struct inode *inode, loff_t lstart, loff_t lend)
++{
++ /* Only CONFIG_SHMEM shmem.c ever supported i_op->truncate_range(). */
++ return -ENOSYS;
++}
++
+ #define shmem_vm_ops generic_file_vm_ops
+ #define shmem_file_operations ramfs_file_operations
+ #define shmem_get_inode(sb, dir, mode, dev, flags) ramfs_get_inode(sb, dir, mode, dev)
+diff --git a/mm/truncate.c b/mm/truncate.c
+index 4224627695ba..f38055cb8af6 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -603,31 +603,6 @@ int vmtruncate(struct inode *inode, loff_t newsize)
+ }
+ EXPORT_SYMBOL(vmtruncate);
+
+-int vmtruncate_range(struct inode *inode, loff_t lstart, loff_t lend)
+-{
+- struct address_space *mapping = inode->i_mapping;
+- loff_t holebegin = round_up(lstart, PAGE_SIZE);
+- loff_t holelen = 1 + lend - holebegin;
+-
+- /*
+- * If the underlying filesystem is not going to provide
+- * a way to truncate a range of blocks (punch a hole) -
+- * we should return failure right now.
+- */
+- if (!inode->i_op->truncate_range)
+- return -ENOSYS;
+-
+- mutex_lock(&inode->i_mutex);
+- inode_dio_wait(inode);
+- unmap_mapping_range(mapping, holebegin, holelen, 1);
+- inode->i_op->truncate_range(inode, lstart, lend);
+- /* unmap again to remove racily COWed private pages */
+- unmap_mapping_range(mapping, holebegin, holelen, 1);
+- mutex_unlock(&inode->i_mutex);
+-
+- return 0;
+-}
+-
+ /**
+ * truncate_pagecache_range - unmap and remove pagecache that is hole-punched
+ * @inode: inode
+diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
+index 912613c566cb..37c486c019fe 100644
+--- a/net/8021q/vlan_core.c
++++ b/net/8021q/vlan_core.c
+@@ -96,8 +96,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_id);
+
+ static struct sk_buff *vlan_reorder_header(struct sk_buff *skb)
+ {
+- if (skb_cow(skb, skb_headroom(skb)) < 0)
++ if (skb_cow(skb, skb_headroom(skb)) < 0) {
++ kfree_skb(skb);
+ return NULL;
++ }
++
+ memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
+ skb->mac_header += VLAN_HLEN;
+ return skb;
+diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
+index 334d4cd7612f..79aaac288afb 100644
+--- a/net/appletalk/ddp.c
++++ b/net/appletalk/ddp.c
+@@ -1494,8 +1494,6 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
+ goto drop;
+
+ /* Queue packet (standard) */
+- skb->sk = sock;
+-
+ if (sock_queue_rcv_skb(sock, skb) < 0)
+ goto drop;
+
+@@ -1649,7 +1647,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr
+ if (!skb)
+ goto out;
+
+- skb->sk = sk;
+ skb_reserve(skb, ddp_dl->header_length);
+ skb_reserve(skb, dev->hard_header_len);
+ skb->dev = dev;
+diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
+index c32be292c7e3..2022b46ab38f 100644
+--- a/net/dns_resolver/dns_query.c
++++ b/net/dns_resolver/dns_query.c
+@@ -150,7 +150,9 @@ int dns_query(const char *type, const char *name, size_t namelen,
+ if (!*_result)
+ goto put;
+
+- memcpy(*_result, upayload->data, len + 1);
++ memcpy(*_result, upayload->data, len);
++ (*_result)[len] = '\0';
++
+ if (_expiry)
+ *_expiry = rkey->expiry;
+
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index c8e26992742f..3f0bb3b3819d 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -1866,6 +1866,10 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
+
+ rtnl_lock();
+ in_dev = ip_mc_find_dev(net, imr);
++ if (!in_dev) {
++ ret = -ENODEV;
++ goto out;
++ }
+ ifindex = imr->imr_ifindex;
+ for (imlp = &inet->mc_list;
+ (iml = rtnl_dereference(*imlp)) != NULL;
+@@ -1883,16 +1887,14 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr)
+
+ *imlp = iml->next_rcu;
+
+- if (in_dev)
+- ip_mc_dec_group(in_dev, group);
++ ip_mc_dec_group(in_dev, group);
+ rtnl_unlock();
+ /* decrease mem now to avoid the memleak warning */
+ atomic_sub(sizeof(*iml), &sk->sk_omem_alloc);
+ kfree_rcu(iml, rcu);
+ return 0;
+ }
+- if (!in_dev)
+- ret = -ENODEV;
++out:
+ rtnl_unlock();
+ return ret;
+ }
+diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
+index b69a3700642b..523541730777 100644
+--- a/net/ipv4/ip_options.c
++++ b/net/ipv4/ip_options.c
+@@ -279,6 +279,10 @@ int ip_options_compile(struct net *net,
+ optptr++;
+ continue;
+ }
++ if (unlikely(l < 2)) {
++ pp_ptr = optptr;
++ goto error;
++ }
+ optlen = optptr[1];
+ if (optlen<2 || optlen>l) {
+ pp_ptr = optptr;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 99eb909c9d5f..2d3290496a0a 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1250,7 +1250,7 @@ static int tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb,
+ }
+
+ /* D-SACK for already forgotten data... Do dumb counting. */
+- if (dup_sack && tp->undo_marker && tp->undo_retrans &&
++ if (dup_sack && tp->undo_marker && tp->undo_retrans > 0 &&
+ !after(end_seq_0, prior_snd_una) &&
+ after(end_seq_0, tp->undo_marker))
+ tp->undo_retrans--;
+@@ -1304,7 +1304,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb,
+ unsigned int new_len = (pkt_len / mss) * mss;
+ if (!in_sack && new_len < pkt_len) {
+ new_len += mss;
+- if (new_len > skb->len)
++ if (new_len >= skb->len)
+ return 0;
+ }
+ pkt_len = new_len;
+@@ -1328,7 +1328,7 @@ static u8 tcp_sacktag_one(struct sock *sk,
+
+ /* Account D-SACK for retransmitted packet. */
+ if (dup_sack && (sacked & TCPCB_RETRANS)) {
+- if (tp->undo_marker && tp->undo_retrans &&
++ if (tp->undo_marker && tp->undo_retrans > 0 &&
+ after(end_seq, tp->undo_marker))
+ tp->undo_retrans--;
+ if (sacked & TCPCB_SACKED_ACKED)
+@@ -2226,7 +2226,7 @@ static void tcp_clear_retrans_partial(struct tcp_sock *tp)
+ tp->lost_out = 0;
+
+ tp->undo_marker = 0;
+- tp->undo_retrans = 0;
++ tp->undo_retrans = -1;
+ }
+
+ void tcp_clear_retrans(struct tcp_sock *tp)
+@@ -3165,7 +3165,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked,
+ tp->high_seq = tp->snd_nxt;
+ tp->prior_ssthresh = 0;
+ tp->undo_marker = tp->snd_una;
+- tp->undo_retrans = tp->retrans_out;
++ tp->undo_retrans = tp->retrans_out ? : -1;
+
+ if (icsk->icsk_ca_state < TCP_CA_CWR) {
+ if (!(flag & FLAG_ECE))
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 987f5cc706b4..fd414b61f966 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2194,13 +2194,15 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
+ if (!tp->retrans_stamp)
+ tp->retrans_stamp = TCP_SKB_CB(skb)->when;
+
+- tp->undo_retrans += tcp_skb_pcount(skb);
+-
+ /* snd_nxt is stored to detect loss of retransmitted segment,
+ * see tcp_input.c tcp_sacktag_write_queue().
+ */
+ TCP_SKB_CB(skb)->ack_seq = tp->snd_nxt;
+ }
++
++ if (tp->undo_retrans < 0)
++ tp->undo_retrans = 0;
++ tp->undo_retrans += tcp_skb_pcount(skb);
+ return err;
+ }
+
+diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
+index 8a84017834c2..57da44707eb1 100644
+--- a/net/sctp/ulpevent.c
++++ b/net/sctp/ulpevent.c
+@@ -373,9 +373,10 @@ fail:
+ * specification [SCTP] and any extensions for a list of possible
+ * error formats.
+ */
+-struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
+- const struct sctp_association *asoc, struct sctp_chunk *chunk,
+- __u16 flags, gfp_t gfp)
++struct sctp_ulpevent *
++sctp_ulpevent_make_remote_error(const struct sctp_association *asoc,
++ struct sctp_chunk *chunk, __u16 flags,
++ gfp_t gfp)
+ {
+ struct sctp_ulpevent *event;
+ struct sctp_remote_error *sre;
+@@ -394,8 +395,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
+ /* Copy the skb to a new skb with room for us to prepend
+ * notification with.
+ */
+- skb = skb_copy_expand(chunk->skb, sizeof(struct sctp_remote_error),
+- 0, gfp);
++ skb = skb_copy_expand(chunk->skb, sizeof(*sre), 0, gfp);
+
+ /* Pull off the rest of the cause TLV from the chunk. */
+ skb_pull(chunk->skb, elen);
+@@ -406,62 +406,21 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error(
+ event = sctp_skb2event(skb);
+ sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize);
+
+- sre = (struct sctp_remote_error *)
+- skb_push(skb, sizeof(struct sctp_remote_error));
++ sre = (struct sctp_remote_error *) skb_push(skb, sizeof(*sre));
+
+ /* Trim the buffer to the right length. */
+- skb_trim(skb, sizeof(struct sctp_remote_error) + elen);
++ skb_trim(skb, sizeof(*sre) + elen);
+
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_type:
+- * It should be SCTP_REMOTE_ERROR.
+- */
++ /* RFC6458, Section 6.1.3. SCTP_REMOTE_ERROR */
++ memset(sre, 0, sizeof(*sre));
+ sre->sre_type = SCTP_REMOTE_ERROR;
+-
+- /*
+- * Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_flags: 16 bits (unsigned integer)
+- * Currently unused.
+- */
+ sre->sre_flags = 0;
+-
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_length: sizeof (__u32)
+- *
+- * This field is the total length of the notification data,
+- * including the notification header.
+- */
+ sre->sre_length = skb->len;
+-
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_error: 16 bits (unsigned integer)
+- * This value represents one of the Operational Error causes defined in
+- * the SCTP specification, in network byte order.
+- */
+ sre->sre_error = cause;
+-
+- /* Socket Extensions for SCTP
+- * 5.3.1.3 SCTP_REMOTE_ERROR
+- *
+- * sre_assoc_id: sizeof (sctp_assoc_t)
+- *
+- * The association id field, holds the identifier for the association.
+- * All notifications for a given association have the same association
+- * identifier. For TCP style socket, this field is ignored.
+- */
+ sctp_ulpevent_set_owner(event, asoc);
+ sre->sre_assoc_id = sctp_assoc2id(asoc);
+
+ return event;
+-
+ fail:
+ return NULL;
+ }
+@@ -904,7 +863,9 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
+ return notification->sn_header.sn_type;
+ }
+
+-/* Copy out the sndrcvinfo into a msghdr. */
++/* RFC6458, Section 5.3.2. SCTP Header Information Structure
++ * (SCTP_SNDRCV, DEPRECATED)
++ */
+ void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
+ struct msghdr *msghdr)
+ {
+@@ -913,74 +874,21 @@ void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event,
+ if (sctp_ulpevent_is_notification(event))
+ return;
+
+- /* Sockets API Extensions for SCTP
+- * Section 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV)
+- *
+- * sinfo_stream: 16 bits (unsigned integer)
+- *
+- * For recvmsg() the SCTP stack places the message's stream number in
+- * this value.
+- */
++ memset(&sinfo, 0, sizeof(sinfo));
+ sinfo.sinfo_stream = event->stream;
+- /* sinfo_ssn: 16 bits (unsigned integer)
+- *
+- * For recvmsg() this value contains the stream sequence number that
+- * the remote endpoint placed in the DATA chunk. For fragmented
+- * messages this is the same number for all deliveries of the message
+- * (if more than one recvmsg() is needed to read the message).
+- */
+ sinfo.sinfo_ssn = event->ssn;
+- /* sinfo_ppid: 32 bits (unsigned integer)
+- *
+- * In recvmsg() this value is
+- * the same information that was passed by the upper layer in the peer
+- * application. Please note that byte order issues are NOT accounted
+- * for and this information is passed opaquely by the SCTP stack from
+- * one end to the other.
+- */
+ sinfo.sinfo_ppid = event->ppid;
+- /* sinfo_flags: 16 bits (unsigned integer)
+- *
+- * This field may contain any of the following flags and is composed of
+- * a bitwise OR of these values.
+- *
+- * recvmsg() flags:
+- *
+- * SCTP_UNORDERED - This flag is present when the message was sent
+- * non-ordered.
+- */
+ sinfo.sinfo_flags = event->flags;
+- /* sinfo_tsn: 32 bit (unsigned integer)
+- *
+- * For the receiving side, this field holds a TSN that was
+- * assigned to one of the SCTP Data Chunks.
+- */
+ sinfo.sinfo_tsn = event->tsn;
+- /* sinfo_cumtsn: 32 bit (unsigned integer)
+- *
+- * This field will hold the current cumulative TSN as
+- * known by the underlying SCTP layer. Note this field is
+- * ignored when sending and only valid for a receive
+- * operation when sinfo_flags are set to SCTP_UNORDERED.
+- */
+ sinfo.sinfo_cumtsn = event->cumtsn;
+- /* sinfo_assoc_id: sizeof (sctp_assoc_t)
+- *
+- * The association handle field, sinfo_assoc_id, holds the identifier
+- * for the association announced in the COMMUNICATION_UP notification.
+- * All notifications for a given association have the same identifier.
+- * Ignored for one-to-one style sockets.
+- */
+ sinfo.sinfo_assoc_id = sctp_assoc2id(event->asoc);
+-
+- /* context value that is set via SCTP_CONTEXT socket option. */
++ /* Context value that is set via SCTP_CONTEXT socket option. */
+ sinfo.sinfo_context = event->asoc->default_rcv_context;
+-
+ /* These fields are not used while receiving. */
+ sinfo.sinfo_timetolive = 0;
+
+ put_cmsg(msghdr, IPPROTO_SCTP, SCTP_SNDRCV,
+- sizeof(struct sctp_sndrcvinfo), (void *)&sinfo);
++ sizeof(sinfo), &sinfo);
+ }
+
+ /* Do accounting for bytes received and hold a reference to the association
+diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
+index e00441a2092f..9495be3a61e0 100644
+--- a/net/tipc/bcast.c
++++ b/net/tipc/bcast.c
+@@ -541,6 +541,7 @@ receive:
+
+ buf = node->bclink.deferred_head;
+ node->bclink.deferred_head = buf->next;
++ buf->next = NULL;
+ node->bclink.deferred_size--;
+ goto receive;
+ }
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-08-08 17:25 Mike Pagano
2014-08-19 11:41 ` Mike Pagano
0 siblings, 1 reply; 25+ messages in thread
From: Mike Pagano @ 2014-08-08 17:25 UTC (permalink / raw
To: gentoo-commits
commit: 48d5e762de93d7df88c6f216d9947f5ac8a8c9a0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 8 17:22:57 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 8 17:22:57 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=48d5e762
Linux patch 3.4.102
---
0000_README | 4 +
1101_linux-3.4.102.patch | 1221 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1225 insertions(+)
diff --git a/0000_README b/0000_README
index 0f65113..4747723 100644
--- a/0000_README
+++ b/0000_README
@@ -443,6 +443,10 @@ Patch: 1100_linux-3.4.101.patch
From: http://www.kernel.org
Desc: Linux 3.4.101
+Patch: 1101_linux-3.4.102.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.102
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1101_linux-3.4.102.patch b/1101_linux-3.4.102.patch
new file mode 100644
index 0000000..c444b8d
--- /dev/null
+++ b/1101_linux-3.4.102.patch
@@ -0,0 +1,1221 @@
+diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
+index d6498e3cd713..f33a9369e35b 100644
+--- a/Documentation/x86/x86_64/mm.txt
++++ b/Documentation/x86/x86_64/mm.txt
+@@ -12,6 +12,8 @@ ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space
+ ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole
+ ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
+ ... unused hole ...
++ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
++... unused hole ...
+ ffffffff80000000 - ffffffffa0000000 (=512 MB) kernel text mapping, from phys 0
+ ffffffffa0000000 - fffffffffff00000 (=1536 MB) module mapping space
+
+diff --git a/Makefile b/Makefile
+index a22bcb567348..dd03fa5777a0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 101
++SUBLEVEL = 102
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mm/idmap.c b/arch/arm/mm/idmap.c
+index ab88ed4f8e08..ef8f2df02540 100644
+--- a/arch/arm/mm/idmap.c
++++ b/arch/arm/mm/idmap.c
+@@ -22,6 +22,13 @@ static void idmap_add_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+ pr_warning("Failed to allocate identity pmd.\n");
+ return;
+ }
++ /*
++ * Copy the original PMD to ensure that the PMD entries for
++ * the kernel image are preserved.
++ */
++ if (!pud_none(*pud))
++ memcpy(pmd, pmd_offset(pud, 0),
++ PTRS_PER_PMD * sizeof(pmd_t));
+ pud_populate(&init_mm, pud, pmd);
+ pmd += pmd_index(addr);
+ } else
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 9df4ea1caaf1..917c1098775b 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -915,10 +915,27 @@ config VM86
+ default y
+ depends on X86_32
+ ---help---
+- This option is required by programs like DOSEMU to run 16-bit legacy
+- code on X86 processors. It also may be needed by software like
+- XFree86 to initialize some video cards via BIOS. Disabling this
+- option saves about 6k.
++ This option is required by programs like DOSEMU to run
++ 16-bit real mode legacy code on x86 processors. It also may
++ be needed by software like XFree86 to initialize some video
++ cards via BIOS. Disabling this option saves about 6K.
++
++config X86_16BIT
++ bool "Enable support for 16-bit segments" if EXPERT
++ default y
++ ---help---
++ This option is required by programs like Wine to run 16-bit
++ protected mode legacy code on x86 processors. Disabling
++ this option saves about 300 bytes on i386, or around 6K text
++ plus 16K runtime memory on x86-64,
++
++config X86_ESPFIX32
++ def_bool y
++ depends on X86_16BIT && X86_32
++
++config X86_ESPFIX64
++ def_bool y
++ depends on X86_16BIT && X86_64
+
+ config TOSHIBA
+ tristate "Toshiba Laptop support"
+diff --git a/arch/x86/include/asm/espfix.h b/arch/x86/include/asm/espfix.h
+new file mode 100644
+index 000000000000..99efebb2f69d
+--- /dev/null
++++ b/arch/x86/include/asm/espfix.h
+@@ -0,0 +1,16 @@
++#ifndef _ASM_X86_ESPFIX_H
++#define _ASM_X86_ESPFIX_H
++
++#ifdef CONFIG_X86_64
++
++#include <asm/percpu.h>
++
++DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
++DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
++
++extern void init_espfix_bsp(void);
++extern void init_espfix_ap(void);
++
++#endif /* CONFIG_X86_64 */
++
++#endif /* _ASM_X86_ESPFIX_H */
+diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
+index bba3cf88e624..0a8b519226b8 100644
+--- a/arch/x86/include/asm/irqflags.h
++++ b/arch/x86/include/asm/irqflags.h
+@@ -129,7 +129,7 @@ static inline notrace unsigned long arch_local_irq_save(void)
+
+ #define PARAVIRT_ADJUST_EXCEPTION_FRAME /* */
+
+-#define INTERRUPT_RETURN iretq
++#define INTERRUPT_RETURN jmp native_iret
+ #define USERGS_SYSRET64 \
+ swapgs; \
+ sysretq;
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 766ea16fbbbd..51817fae7047 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -59,5 +59,7 @@ typedef struct { pteval_t pte; } pte_t;
+ #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
+ #define MODULES_END _AC(0xffffffffff000000, UL)
+ #define MODULES_LEN (MODULES_END - MODULES_VADDR)
++#define ESPFIX_PGD_ENTRY _AC(-2, UL)
++#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)
+
+ #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
+diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
+index d0f19f9fb846..16c7971457f8 100644
+--- a/arch/x86/include/asm/setup.h
++++ b/arch/x86/include/asm/setup.h
+@@ -61,6 +61,8 @@ static inline void x86_ce4100_early_setup(void) { }
+
+ #ifndef _SETUP
+
++#include <asm/espfix.h>
++
+ /*
+ * This is set up by the setup-routine at boot-time
+ */
+diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
+index 532d2e090e6f..9f15a46e9ccb 100644
+--- a/arch/x86/kernel/Makefile
++++ b/arch/x86/kernel/Makefile
+@@ -28,6 +28,7 @@ obj-$(CONFIG_X86_64) += sys_x86_64.o x8664_ksyms_64.o
+ obj-y += syscall_$(BITS).o
+ obj-$(CONFIG_X86_64) += vsyscall_64.o
+ obj-$(CONFIG_X86_64) += vsyscall_emu_64.o
++obj-$(CONFIG_X86_ESPFIX64) += espfix_64.o
+ obj-y += bootflag.o e820.o
+ obj-y += pci-dma.o quirks.o topology.o kdebugfs.o
+ obj-y += alternative.o i8253.o pci-nommu.o hw_breakpoint.o
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index e36c5cf38fde..a0751249d3c1 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -525,6 +525,7 @@ syscall_exit:
+ restore_all:
+ TRACE_IRQS_IRET
+ restore_all_notrace:
++#ifdef CONFIG_X86_ESPFIX32
+ movl PT_EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
+ # Warning: PT_OLDSS(%esp) contains the wrong/random values if we
+ # are returning to the kernel.
+@@ -535,6 +536,7 @@ restore_all_notrace:
+ cmpl $((SEGMENT_LDT << 8) | USER_RPL), %eax
+ CFI_REMEMBER_STATE
+ je ldt_ss # returning to user-space with LDT SS
++#endif
+ restore_nocheck:
+ RESTORE_REGS 4 # skip orig_eax/error_code
+ irq_return:
+@@ -550,6 +552,7 @@ ENTRY(iret_exc)
+ .long irq_return,iret_exc
+ .previous
+
++#ifdef CONFIG_X86_ESPFIX32
+ CFI_RESTORE_STATE
+ ldt_ss:
+ #ifdef CONFIG_PARAVIRT
+@@ -593,6 +596,7 @@ ldt_ss:
+ lss (%esp), %esp /* switch to espfix segment */
+ CFI_ADJUST_CFA_OFFSET -8
+ jmp restore_nocheck
++#endif
+ CFI_ENDPROC
+ ENDPROC(system_call)
+
+@@ -766,6 +770,7 @@ ENDPROC(ptregs_clone)
+ * the high word of the segment base from the GDT and swiches to the
+ * normal stack and adjusts ESP with the matching offset.
+ */
++#ifdef CONFIG_X86_ESPFIX32
+ /* fixup the stack */
+ mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
+ mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
+@@ -775,8 +780,10 @@ ENDPROC(ptregs_clone)
+ pushl_cfi %eax
+ lss (%esp), %esp /* switch to the normal stack segment */
+ CFI_ADJUST_CFA_OFFSET -8
++#endif
+ .endm
+ .macro UNWIND_ESPFIX_STACK
++#ifdef CONFIG_X86_ESPFIX32
+ movl %ss, %eax
+ /* see if on espfix stack */
+ cmpw $__ESPFIX_SS, %ax
+@@ -787,6 +794,7 @@ ENDPROC(ptregs_clone)
+ /* switch to normal stack */
+ FIXUP_ESPFIX_STACK
+ 27:
++#endif
+ .endm
+
+ /*
+@@ -1318,11 +1326,13 @@ END(debug)
+ */
+ ENTRY(nmi)
+ RING0_INT_FRAME
++#ifdef CONFIG_X86_ESPFIX32
+ pushl_cfi %eax
+ movl %ss, %eax
+ cmpw $__ESPFIX_SS, %ax
+ popl_cfi %eax
+ je nmi_espfix_stack
++#endif
+ cmpl $ia32_sysenter_target,(%esp)
+ je nmi_stack_fixup
+ pushl_cfi %eax
+@@ -1362,6 +1372,7 @@ nmi_debug_stack_check:
+ FIX_STACK 24, nmi_stack_correct, 1
+ jmp nmi_stack_correct
+
++#ifdef CONFIG_X86_ESPFIX32
+ nmi_espfix_stack:
+ /* We have a RING0_INT_FRAME here.
+ *
+@@ -1383,6 +1394,7 @@ nmi_espfix_stack:
+ lss 12+4(%esp), %esp # back to espfix stack
+ CFI_ADJUST_CFA_OFFSET -24
+ jmp irq_return
++#endif
+ CFI_ENDPROC
+ END(nmi)
+
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index bd6f59203b5f..42b055e24691 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -55,6 +55,7 @@
+ #include <asm/paravirt.h>
+ #include <asm/ftrace.h>
+ #include <asm/percpu.h>
++#include <asm/pgtable_types.h>
+ #include <linux/err.h>
+
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
+@@ -901,17 +902,47 @@ restore_args:
+ irq_return:
+ INTERRUPT_RETURN
+
+- .section __ex_table, "a"
+- .quad irq_return, bad_iret
+- .previous
+-
+-#ifdef CONFIG_PARAVIRT
+ ENTRY(native_iret)
++ /*
++ * Are we returning to a stack segment from the LDT? Note: in
++ * 64-bit mode SS:RSP on the exception stack is always valid.
++ */
++#ifdef CONFIG_X86_ESPFIX64
++ testb $4,(SS-RIP)(%rsp)
++ jnz native_irq_return_ldt
++#endif
++
++native_irq_return_iret:
+ iretq
+
+ .section __ex_table,"a"
+- .quad native_iret, bad_iret
++ .quad native_irq_return_iret, bad_iret
+ .previous
++
++#ifdef CONFIG_X86_ESPFIX64
++native_irq_return_ldt:
++ pushq_cfi %rax
++ pushq_cfi %rdi
++ SWAPGS
++ movq PER_CPU_VAR(espfix_waddr),%rdi
++ movq %rax,(0*8)(%rdi) /* RAX */
++ movq (2*8)(%rsp),%rax /* RIP */
++ movq %rax,(1*8)(%rdi)
++ movq (3*8)(%rsp),%rax /* CS */
++ movq %rax,(2*8)(%rdi)
++ movq (4*8)(%rsp),%rax /* RFLAGS */
++ movq %rax,(3*8)(%rdi)
++ movq (6*8)(%rsp),%rax /* SS */
++ movq %rax,(5*8)(%rdi)
++ movq (5*8)(%rsp),%rax /* RSP */
++ movq %rax,(4*8)(%rdi)
++ andl $0xffff0000,%eax
++ popq_cfi %rdi
++ orq PER_CPU_VAR(espfix_stack),%rax
++ SWAPGS
++ movq %rax,%rsp
++ popq_cfi %rax
++ jmp native_irq_return_iret
+ #endif
+
+ .section .fixup,"ax"
+@@ -977,9 +1008,40 @@ ENTRY(retint_kernel)
+ call preempt_schedule_irq
+ jmp exit_intr
+ #endif
+-
+ CFI_ENDPROC
+ END(common_interrupt)
++
++ /*
++ * If IRET takes a fault on the espfix stack, then we
++ * end up promoting it to a doublefault. In that case,
++ * modify the stack to make it look like we just entered
++ * the #GP handler from user space, similar to bad_iret.
++ */
++#ifdef CONFIG_X86_ESPFIX64
++ ALIGN
++__do_double_fault:
++ XCPT_FRAME 1 RDI+8
++ movq RSP(%rdi),%rax /* Trap on the espfix stack? */
++ sarq $PGDIR_SHIFT,%rax
++ cmpl $ESPFIX_PGD_ENTRY,%eax
++ jne do_double_fault /* No, just deliver the fault */
++ cmpl $__KERNEL_CS,CS(%rdi)
++ jne do_double_fault
++ movq RIP(%rdi),%rax
++ cmpq $native_irq_return_iret,%rax
++ jne do_double_fault /* This shouldn't happen... */
++ movq PER_CPU_VAR(kernel_stack),%rax
++ subq $(6*8-KERNEL_STACK_OFFSET),%rax /* Reset to original stack */
++ movq %rax,RSP(%rdi)
++ movq $0,(%rax) /* Missing (lost) #GP error code */
++ movq $general_protection,RIP(%rdi)
++ retq
++ CFI_ENDPROC
++END(__do_double_fault)
++#else
++# define __do_double_fault do_double_fault
++#endif
++
+ /*
+ * End of kprobes section
+ */
+@@ -1155,7 +1217,7 @@ zeroentry overflow do_overflow
+ zeroentry bounds do_bounds
+ zeroentry invalid_op do_invalid_op
+ zeroentry device_not_available do_device_not_available
+-paranoiderrorentry double_fault do_double_fault
++paranoiderrorentry double_fault __do_double_fault
+ zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun
+ errorentry invalid_TSS do_invalid_TSS
+ errorentry segment_not_present do_segment_not_present
+@@ -1486,7 +1548,7 @@ error_sti:
+ */
+ error_kernelspace:
+ incl %ebx
+- leaq irq_return(%rip),%rcx
++ leaq native_irq_return_iret(%rip),%rcx
+ cmpq %rcx,RIP+8(%rsp)
+ je error_swapgs
+ movl %ecx,%eax /* zero extend */
+diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
+new file mode 100644
+index 000000000000..94d857fb1033
+--- /dev/null
++++ b/arch/x86/kernel/espfix_64.c
+@@ -0,0 +1,208 @@
++/* ----------------------------------------------------------------------- *
++ *
++ * Copyright 2014 Intel Corporation; author: H. Peter Anvin
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
++ * more details.
++ *
++ * ----------------------------------------------------------------------- */
++
++/*
++ * The IRET instruction, when returning to a 16-bit segment, only
++ * restores the bottom 16 bits of the user space stack pointer. This
++ * causes some 16-bit software to break, but it also leaks kernel state
++ * to user space.
++ *
++ * This works around this by creating percpu "ministacks", each of which
++ * is mapped 2^16 times 64K apart. When we detect that the return SS is
++ * on the LDT, we copy the IRET frame to the ministack and use the
++ * relevant alias to return to userspace. The ministacks are mapped
++ * readonly, so if the IRET fault we promote #GP to #DF which is an IST
++ * vector and thus has its own stack; we then do the fixup in the #DF
++ * handler.
++ *
++ * This file sets up the ministacks and the related page tables. The
++ * actual ministack invocation is in entry_64.S.
++ */
++
++#include <linux/init.h>
++#include <linux/init_task.h>
++#include <linux/kernel.h>
++#include <linux/percpu.h>
++#include <linux/gfp.h>
++#include <linux/random.h>
++#include <asm/pgtable.h>
++#include <asm/pgalloc.h>
++#include <asm/setup.h>
++#include <asm/espfix.h>
++
++/*
++ * Note: we only need 6*8 = 48 bytes for the espfix stack, but round
++ * it up to a cache line to avoid unnecessary sharing.
++ */
++#define ESPFIX_STACK_SIZE (8*8UL)
++#define ESPFIX_STACKS_PER_PAGE (PAGE_SIZE/ESPFIX_STACK_SIZE)
++
++/* There is address space for how many espfix pages? */
++#define ESPFIX_PAGE_SPACE (1UL << (PGDIR_SHIFT-PAGE_SHIFT-16))
++
++#define ESPFIX_MAX_CPUS (ESPFIX_STACKS_PER_PAGE * ESPFIX_PAGE_SPACE)
++#if CONFIG_NR_CPUS > ESPFIX_MAX_CPUS
++# error "Need more than one PGD for the ESPFIX hack"
++#endif
++
++#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO)
++
++/* This contains the *bottom* address of the espfix stack */
++DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
++DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
++
++/* Initialization mutex - should this be a spinlock? */
++static DEFINE_MUTEX(espfix_init_mutex);
++
++/* Page allocation bitmap - each page serves ESPFIX_STACKS_PER_PAGE CPUs */
++#define ESPFIX_MAX_PAGES DIV_ROUND_UP(CONFIG_NR_CPUS, ESPFIX_STACKS_PER_PAGE)
++static void *espfix_pages[ESPFIX_MAX_PAGES];
++
++static __page_aligned_bss pud_t espfix_pud_page[PTRS_PER_PUD]
++ __aligned(PAGE_SIZE);
++
++static unsigned int page_random, slot_random;
++
++/*
++ * This returns the bottom address of the espfix stack for a specific CPU.
++ * The math allows for a non-power-of-two ESPFIX_STACK_SIZE, in which case
++ * we have to account for some amount of padding at the end of each page.
++ */
++static inline unsigned long espfix_base_addr(unsigned int cpu)
++{
++ unsigned long page, slot;
++ unsigned long addr;
++
++ page = (cpu / ESPFIX_STACKS_PER_PAGE) ^ page_random;
++ slot = (cpu + slot_random) % ESPFIX_STACKS_PER_PAGE;
++ addr = (page << PAGE_SHIFT) + (slot * ESPFIX_STACK_SIZE);
++ addr = (addr & 0xffffUL) | ((addr & ~0xffffUL) << 16);
++ addr += ESPFIX_BASE_ADDR;
++ return addr;
++}
++
++#define PTE_STRIDE (65536/PAGE_SIZE)
++#define ESPFIX_PTE_CLONES (PTRS_PER_PTE/PTE_STRIDE)
++#define ESPFIX_PMD_CLONES PTRS_PER_PMD
++#define ESPFIX_PUD_CLONES (65536/(ESPFIX_PTE_CLONES*ESPFIX_PMD_CLONES))
++
++#define PGTABLE_PROT ((_KERNPG_TABLE & ~_PAGE_RW) | _PAGE_NX)
++
++static void init_espfix_random(void)
++{
++ unsigned long rand;
++
++ /*
++ * This is run before the entropy pools are initialized,
++ * but this is hopefully better than nothing.
++ */
++ if (!arch_get_random_long(&rand)) {
++ /* The constant is an arbitrary large prime */
++ rdtscll(rand);
++ rand *= 0xc345c6b72fd16123UL;
++ }
++
++ slot_random = rand % ESPFIX_STACKS_PER_PAGE;
++ page_random = (rand / ESPFIX_STACKS_PER_PAGE)
++ & (ESPFIX_PAGE_SPACE - 1);
++}
++
++void __init init_espfix_bsp(void)
++{
++ pgd_t *pgd_p;
++ pteval_t ptemask;
++
++ ptemask = __supported_pte_mask;
++
++ /* Install the espfix pud into the kernel page directory */
++ pgd_p = &init_level4_pgt[pgd_index(ESPFIX_BASE_ADDR)];
++ pgd_populate(&init_mm, pgd_p, (pud_t *)espfix_pud_page);
++
++ /* Randomize the locations */
++ init_espfix_random();
++
++ /* The rest is the same as for any other processor */
++ init_espfix_ap();
++}
++
++void init_espfix_ap(void)
++{
++ unsigned int cpu, page;
++ unsigned long addr;
++ pud_t pud, *pud_p;
++ pmd_t pmd, *pmd_p;
++ pte_t pte, *pte_p;
++ int n;
++ void *stack_page;
++ pteval_t ptemask;
++
++ /* We only have to do this once... */
++ if (likely(this_cpu_read(espfix_stack)))
++ return; /* Already initialized */
++
++ cpu = smp_processor_id();
++ addr = espfix_base_addr(cpu);
++ page = cpu/ESPFIX_STACKS_PER_PAGE;
++
++ /* Did another CPU already set this up? */
++ stack_page = ACCESS_ONCE(espfix_pages[page]);
++ if (likely(stack_page))
++ goto done;
++
++ mutex_lock(&espfix_init_mutex);
++
++ /* Did we race on the lock? */
++ stack_page = ACCESS_ONCE(espfix_pages[page]);
++ if (stack_page)
++ goto unlock_done;
++
++ ptemask = __supported_pte_mask;
++
++ pud_p = &espfix_pud_page[pud_index(addr)];
++ pud = *pud_p;
++ if (!pud_present(pud)) {
++ pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
++ pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
++ paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
++ for (n = 0; n < ESPFIX_PUD_CLONES; n++)
++ set_pud(&pud_p[n], pud);
++ }
++
++ pmd_p = pmd_offset(&pud, addr);
++ pmd = *pmd_p;
++ if (!pmd_present(pmd)) {
++ pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
++ pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
++ paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
++ for (n = 0; n < ESPFIX_PMD_CLONES; n++)
++ set_pmd(&pmd_p[n], pmd);
++ }
++
++ pte_p = pte_offset_kernel(&pmd, addr);
++ stack_page = (void *)__get_free_page(GFP_KERNEL);
++ pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
++ for (n = 0; n < ESPFIX_PTE_CLONES; n++)
++ set_pte(&pte_p[n*PTE_STRIDE], pte);
++
++ /* Job is done for this CPU and any CPU which shares this page */
++ ACCESS_ONCE(espfix_pages[page]) = stack_page;
++
++unlock_done:
++ mutex_unlock(&espfix_init_mutex);
++done:
++ this_cpu_write(espfix_stack, addr);
++ this_cpu_write(espfix_waddr, (unsigned long)stack_page
++ + (addr & ~PAGE_MASK));
++}
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index dcbbaa165bde..c37886d759cc 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -20,8 +20,6 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+
+-int sysctl_ldt16 = 0;
+-
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -231,16 +229,10 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ }
+ }
+
+- /*
+- * On x86-64 we do not support 16-bit segments due to
+- * IRET leaking the high bits of the kernel stack address.
+- */
+-#ifdef CONFIG_X86_64
+- if (!ldt_info.seg_32bit && !sysctl_ldt16) {
++ if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+ error = -EINVAL;
+ goto out_unlock;
+ }
+-#endif
+
+ fill_ldt(&ldt, &ldt_info);
+ if (oldmode)
+diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
+index 3f08f34f93eb..a1da6737ba5b 100644
+--- a/arch/x86/kernel/paravirt_patch_64.c
++++ b/arch/x86/kernel/paravirt_patch_64.c
+@@ -6,7 +6,6 @@ DEF_NATIVE(pv_irq_ops, irq_disable, "cli");
+ DEF_NATIVE(pv_irq_ops, irq_enable, "sti");
+ DEF_NATIVE(pv_irq_ops, restore_fl, "pushq %rdi; popfq");
+ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
+-DEF_NATIVE(pv_cpu_ops, iret, "iretq");
+ DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
+ DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
+ DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
+@@ -50,7 +49,6 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+ PATCH_SITE(pv_irq_ops, save_fl);
+ PATCH_SITE(pv_irq_ops, irq_enable);
+ PATCH_SITE(pv_irq_ops, irq_disable);
+- PATCH_SITE(pv_cpu_ops, iret);
+ PATCH_SITE(pv_cpu_ops, irq_enable_sysexit);
+ PATCH_SITE(pv_cpu_ops, usergs_sysret32);
+ PATCH_SITE(pv_cpu_ops, usergs_sysret64);
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 849cdcf2e76a..d28c59588ad3 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -271,6 +271,13 @@ notrace static void __cpuinit start_secondary(void *unused)
+ check_tsc_sync_target();
+
+ /*
++ * Enable the espfix hack for this CPU
++ */
++#ifdef CONFIG_X86_ESPFIX64
++ init_espfix_ap();
++#endif
++
++ /*
+ * We need to hold call_lock, so there is no inconsistency
+ * between the time smp_call_function() determines number of
+ * IPI recipients, and the time when the determination is made
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index 0002a3a33081..e04e67753238 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -30,11 +30,13 @@ struct pg_state {
+ unsigned long start_address;
+ unsigned long current_address;
+ const struct addr_marker *marker;
++ unsigned long lines;
+ };
+
+ struct addr_marker {
+ unsigned long start_address;
+ const char *name;
++ unsigned long max_lines;
+ };
+
+ /* indices for address_markers; keep sync'd w/ address_markers below */
+@@ -45,6 +47,7 @@ enum address_markers_idx {
+ LOW_KERNEL_NR,
+ VMALLOC_START_NR,
+ VMEMMAP_START_NR,
++ ESPFIX_START_NR,
+ HIGH_KERNEL_NR,
+ MODULES_VADDR_NR,
+ MODULES_END_NR,
+@@ -67,6 +70,7 @@ static struct addr_marker address_markers[] = {
+ { PAGE_OFFSET, "Low Kernel Mapping" },
+ { VMALLOC_START, "vmalloc() Area" },
+ { VMEMMAP_START, "Vmemmap" },
++ { ESPFIX_BASE_ADDR, "ESPfix Area", 16 },
+ { __START_KERNEL_map, "High Kernel Mapping" },
+ { MODULES_VADDR, "Modules" },
+ { MODULES_END, "End Modules" },
+@@ -163,7 +167,7 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ pgprot_t new_prot, int level)
+ {
+ pgprotval_t prot, cur;
+- static const char units[] = "KMGTPE";
++ static const char units[] = "BKMGTPE";
+
+ /*
+ * If we have a "break" in the series, we need to flush the state that
+@@ -178,6 +182,7 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ st->current_prot = new_prot;
+ st->level = level;
+ st->marker = address_markers;
++ st->lines = 0;
+ seq_printf(m, "---[ %s ]---\n", st->marker->name);
+ } else if (prot != cur || level != st->level ||
+ st->current_address >= st->marker[1].start_address) {
+@@ -188,17 +193,21 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ /*
+ * Now print the actual finished series
+ */
+- seq_printf(m, "0x%0*lx-0x%0*lx ",
+- width, st->start_address,
+- width, st->current_address);
+-
+- delta = (st->current_address - st->start_address) >> 10;
+- while (!(delta & 1023) && unit[1]) {
+- delta >>= 10;
+- unit++;
++ if (!st->marker->max_lines ||
++ st->lines < st->marker->max_lines) {
++ seq_printf(m, "0x%0*lx-0x%0*lx ",
++ width, st->start_address,
++ width, st->current_address);
++
++ delta = (st->current_address - st->start_address);
++ while (!(delta & 1023) && unit[1]) {
++ delta >>= 10;
++ unit++;
++ }
++ seq_printf(m, "%9lu%c ", delta, *unit);
++ printk_prot(m, st->current_prot, st->level);
+ }
+- seq_printf(m, "%9lu%c ", delta, *unit);
+- printk_prot(m, st->current_prot, st->level);
++ st->lines++;
+
+ /*
+ * We print markers for special areas of address space,
+@@ -206,7 +215,15 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ * This helps in the interpretation.
+ */
+ if (st->current_address >= st->marker[1].start_address) {
++ if (st->marker->max_lines &&
++ st->lines > st->marker->max_lines) {
++ unsigned long nskip =
++ st->lines - st->marker->max_lines;
++ seq_printf(m, "... %lu entr%s skipped ... \n",
++ nskip, nskip == 1 ? "y" : "ies");
++ }
+ st->marker++;
++ st->lines = 0;
+ seq_printf(m, "---[ %s ]---\n", st->marker->name);
+ }
+
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index c734408d55e4..66e6d9359826 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,7 +41,6 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled sysctl_vsyscall32
+ #define arch_setup_additional_pages syscall32_setup_pages
+-extern int sysctl_ldt16;
+ #endif
+
+ /*
+@@ -381,13 +380,6 @@ static ctl_table abi_table2[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
+- {
+- .procname = "ldt16",
+- .data = &sysctl_ldt16,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec
+- },
+ {}
+ };
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ac33d5f30778..bf948e134981 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -21,6 +21,7 @@
+ #include <linux/module.h>
+ #include <linux/net.h>
+ #include <linux/rwsem.h>
++#include <linux/security.h>
+
+ struct alg_type_list {
+ const struct af_alg_type *type;
+@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+
+ sock_init_data(newsock, sk2);
+ sock_graft(sk2, newsock);
++ security_sk_clone(sk, sk2);
+
+ err = type->accept(ask->private, sk2);
+ if (err) {
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 2bc036292d9d..ac99b46dc4a4 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -795,6 +795,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
+ scsi_next_command(cmd);
+ return;
+ }
++ } else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
++ /*
++ * Certain non BLOCK_PC requests are commands that don't
++ * actually transfer anything (FLUSH), so cannot use
++ * good_bytes != blk_rq_bytes(req) as the signal for an error.
++ * This sets the error explicitly for the problem case.
++ */
++ error = __scsi_error_from_host_byte(cmd, result);
+ }
+
+ /* no bidi support for !REQ_TYPE_BLOCK_PC yet */
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index 0525927f203f..d633115489d1 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -101,9 +101,9 @@ asmlinkage __printf(1, 2) __cold
+ int printk(const char *fmt, ...);
+
+ /*
+- * Special printk facility for scheduler use only, _DO_NOT_USE_ !
++ * Special printk facility for scheduler/timekeeping use only, _DO_NOT_USE_ !
+ */
+-__printf(1, 2) __cold int printk_sched(const char *fmt, ...);
++__printf(1, 2) __cold int printk_deferred(const char *fmt, ...);
+
+ /*
+ * Please don't use printk_ratelimit(), because it shares ratelimiting state
+@@ -133,7 +133,7 @@ int printk(const char *s, ...)
+ return 0;
+ }
+ static inline __printf(1, 2) __cold
+-int printk_sched(const char *s, ...)
++int printk_deferred(const char *s, ...)
+ {
+ return 0;
+ }
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index e22df7a4f1ab..4424db24396d 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2608,22 +2608,5 @@ static inline bool skb_is_recycleable(const struct sk_buff *skb, int skb_size)
+
+ return true;
+ }
+-
+-/**
+- * skb_gso_network_seglen - Return length of individual segments of a gso packet
+- *
+- * @skb: GSO skb
+- *
+- * skb_gso_network_seglen is used to determine the real size of the
+- * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
+- *
+- * The MAC/L2 header is not accounted for.
+- */
+-static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+-{
+- unsigned int hdr_len = skb_transport_header(skb) -
+- skb_network_header(skb);
+- return hdr_len + skb_gso_transport_seglen(skb);
+-}
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_SKBUFF_H */
+diff --git a/init/main.c b/init/main.c
+index db8e381877ad..f30baf52f80b 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -606,6 +606,10 @@ asmlinkage void __init start_kernel(void)
+ if (efi_enabled(EFI_RUNTIME_SERVICES))
+ efi_enter_virtual_mode();
+ #endif
++#ifdef CONFIG_X86_ESPFIX64
++ /* Should be run before the first non-init thread is created */
++ init_espfix_bsp();
++#endif
+ thread_info_cache_init();
+ cred_init();
+ fork_init(totalram_pages);
+diff --git a/kernel/printk.c b/kernel/printk.c
+index e39adc13f5f5..544c0215939a 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -1653,7 +1653,7 @@ late_initcall(printk_late_init);
+
+ #if defined CONFIG_PRINTK
+
+-int printk_sched(const char *fmt, ...)
++int printk_deferred(const char *fmt, ...)
+ {
+ unsigned long flags;
+ va_list args;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index af837d82634e..5701cb9a673f 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1313,7 +1313,7 @@ out:
+ * leave kernel.
+ */
+ if (p->mm && printk_ratelimit()) {
+- printk_sched("process %d (%s) no longer affine to cpu%d\n",
++ printk_deferred("process %d (%s) no longer affine to cpu%d\n",
+ task_pid_nr(p), p->comm, cpu);
+ }
+ }
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 2b0131835714..526c77d1b655 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -884,7 +884,7 @@ static int sched_rt_runtime_exceeded(struct rt_rq *rt_rq)
+
+ if (!once) {
+ once = true;
+- printk_sched("sched: RT throttling activated\n");
++ printk_deferred("sched: RT throttling activated\n");
+ }
+ } else {
+ /*
+diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
+index 0d37a6fd18af..4d7ee79ec469 100644
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -143,7 +143,8 @@ static int clockevents_increase_min_delta(struct clock_event_device *dev)
+ {
+ /* Nothing to do if we already reached the limit */
+ if (dev->min_delta_ns >= MIN_DELTA_LIMIT) {
+- printk(KERN_WARNING "CE: Reprogramming failure. Giving up\n");
++ printk_deferred(KERN_WARNING
++ "CE: Reprogramming failure. Giving up\n");
+ dev->next_event.tv64 = KTIME_MAX;
+ return -ETIME;
+ }
+@@ -156,9 +157,10 @@ static int clockevents_increase_min_delta(struct clock_event_device *dev)
+ if (dev->min_delta_ns > MIN_DELTA_LIMIT)
+ dev->min_delta_ns = MIN_DELTA_LIMIT;
+
+- printk(KERN_WARNING "CE: %s increased min_delta_ns to %llu nsec\n",
+- dev->name ? dev->name : "?",
+- (unsigned long long) dev->min_delta_ns);
++ printk_deferred(KERN_WARNING
++ "CE: %s increased min_delta_ns to %llu nsec\n",
++ dev->name ? dev->name : "?",
++ (unsigned long long) dev->min_delta_ns);
+ return 0;
+ }
+
+diff --git a/lib/btree.c b/lib/btree.c
+index 5cf9e74ec3f3..53a773ecf57c 100644
+--- a/lib/btree.c
++++ b/lib/btree.c
+@@ -198,6 +198,7 @@ EXPORT_SYMBOL_GPL(btree_init);
+
+ void btree_destroy(struct btree_head *head)
+ {
++ mempool_free(head->node, head->mempool);
+ mempool_destroy(head->mempool);
+ head->mempool = NULL;
+ }
+diff --git a/mm/mlock.c b/mm/mlock.c
+index ef726e8aa8e9..7a84dd1f5ec6 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -78,6 +78,7 @@ void __clear_page_mlock(struct page *page)
+ */
+ void mlock_vma_page(struct page *page)
+ {
++ /* Serialize with page migration */
+ BUG_ON(!PageLocked(page));
+
+ if (!TestSetPageMlocked(page)) {
+@@ -105,6 +106,7 @@ void mlock_vma_page(struct page *page)
+ */
+ void munlock_vma_page(struct page *page)
+ {
++ /* For try_to_munlock() and to serialize with page migration */
+ BUG_ON(!PageLocked(page));
+
+ if (TestClearPageMlocked(page)) {
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 39d530a425b5..ff0b0997b953 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2187,7 +2187,7 @@ static inline int
+ gfp_to_alloc_flags(gfp_t gfp_mask)
+ {
+ int alloc_flags = ALLOC_WMARK_MIN | ALLOC_CPUSET;
+- const gfp_t wait = gfp_mask & __GFP_WAIT;
++ const bool atomic = !(gfp_mask & (__GFP_WAIT | __GFP_NO_KSWAPD));
+
+ /* __GFP_HIGH is assumed to be the same as ALLOC_HIGH to save a branch. */
+ BUILD_BUG_ON(__GFP_HIGH != (__force gfp_t) ALLOC_HIGH);
+@@ -2196,20 +2196,20 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
+ * The caller may dip into page reserves a bit more if the caller
+ * cannot run direct reclaim, or if the caller has realtime scheduling
+ * policy or is asking for __GFP_HIGH memory. GFP_ATOMIC requests will
+- * set both ALLOC_HARDER (!wait) and ALLOC_HIGH (__GFP_HIGH).
++ * set both ALLOC_HARDER (atomic == true) and ALLOC_HIGH (__GFP_HIGH).
+ */
+ alloc_flags |= (__force int) (gfp_mask & __GFP_HIGH);
+
+- if (!wait) {
++ if (atomic) {
+ /*
+- * Not worth trying to allocate harder for
+- * __GFP_NOMEMALLOC even if it can't schedule.
++ * Not worth trying to allocate harder for __GFP_NOMEMALLOC even
++ * if it can't schedule.
+ */
+- if (!(gfp_mask & __GFP_NOMEMALLOC))
++ if (!(gfp_mask & __GFP_NOMEMALLOC))
+ alloc_flags |= ALLOC_HARDER;
+ /*
+- * Ignore cpuset if GFP_ATOMIC (!wait) rather than fail alloc.
+- * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
++ * Ignore cpuset mems for GFP_ATOMIC rather than fail, see the
++ * comment for __cpuset_node_allowed_softwall().
+ */
+ alloc_flags &= ~ALLOC_CPUSET;
+ } else if (unlikely(rt_task(current)) && !in_interrupt())
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 6dc46f345dba..695eaff55d77 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1449,9 +1449,19 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
+ BUG_ON(!page || PageAnon(page));
+
+ if (locked_vma) {
+- mlock_vma_page(page); /* no-op if already mlocked */
+- if (page == check_page)
++ if (page == check_page) {
++ /* we know we have check_page locked */
++ mlock_vma_page(page);
+ ret = SWAP_MLOCK;
++ } else if (trylock_page(page)) {
++ /*
++ * If we can lock the page, perform mlock.
++ * Otherwise leave the page alone, it will be
++ * eventually encountered again later.
++ */
++ mlock_vma_page(page);
++ unlock_page(page);
++ }
+ continue; /* don't unmap */
+ }
+
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index 7593f3a46035..29a07b6c7168 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -39,68 +39,6 @@
+ #include <net/route.h>
+ #include <net/xfrm.h>
+
+-static bool ip_may_fragment(const struct sk_buff *skb)
+-{
+- return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+- skb->local_df;
+-}
+-
+-static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+-{
+- if (skb->len <= mtu)
+- return false;
+-
+- if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+- return false;
+-
+- return true;
+-}
+-
+-static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb)
+-{
+- unsigned int mtu;
+-
+- if (skb->local_df || !skb_is_gso(skb))
+- return false;
+-
+- mtu = dst_mtu(skb_dst(skb));
+-
+- /* if seglen > mtu, do software segmentation for IP fragmentation on
+- * output. DF bit cannot be set since ip_forward would have sent
+- * icmp error.
+- */
+- return skb_gso_network_seglen(skb) > mtu;
+-}
+-
+-/* called if GSO skb needs to be fragmented on forward */
+-static int ip_forward_finish_gso(struct sk_buff *skb)
+-{
+- struct sk_buff *segs;
+- int ret = 0;
+-
+- segs = skb_gso_segment(skb, 0);
+- if (IS_ERR(segs)) {
+- kfree_skb(skb);
+- return -ENOMEM;
+- }
+-
+- consume_skb(skb);
+-
+- do {
+- struct sk_buff *nskb = segs->next;
+- int err;
+-
+- segs->next = NULL;
+- err = dst_output(segs);
+-
+- if (err && ret == 0)
+- ret = err;
+- segs = nskb;
+- } while (segs);
+-
+- return ret;
+-}
+-
+ static int ip_forward_finish(struct sk_buff *skb)
+ {
+ struct ip_options * opt = &(IPCB(skb)->opt);
+@@ -110,9 +48,6 @@ static int ip_forward_finish(struct sk_buff *skb)
+ if (unlikely(opt->optlen))
+ ip_forward_options(skb);
+
+- if (ip_gso_exceeds_dst_mtu(skb))
+- return ip_forward_finish_gso(skb);
+-
+ return dst_output(skb);
+ }
+
+@@ -152,7 +87,8 @@ int ip_forward(struct sk_buff *skb)
+ if (opt->is_strictroute && opt->nexthop != rt->rt_gateway)
+ goto sr_failed;
+
+- if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, dst_mtu(&rt->dst))) {
++ if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
++ (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
+ IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+ htonl(dst_mtu(&rt->dst)));
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index f976c3858df0..be5876079a8e 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2438,8 +2438,18 @@ static void init_loopback(struct net_device *dev)
+ if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+ continue;
+
+- if (sp_ifa->rt)
+- continue;
++ if (sp_ifa->rt) {
++ /* This dst has been added to garbage list when
++ * lo device down, release this obsolete dst and
++ * reallocate a new router for ifa.
++ */
++ if (sp_ifa->rt->dst.obsolete > 0) {
++ dst_release(&sp_ifa->rt->dst);
++ sp_ifa->rt = NULL;
++ } else {
++ continue;
++ }
++ }
+
+ sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 077b9a3f8d25..6225b7cf12b9 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -382,17 +382,6 @@ static inline int ip6_forward_finish(struct sk_buff *skb)
+ return dst_output(skb);
+ }
+
+-static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+-{
+- if (skb->len <= mtu || skb->local_df)
+- return false;
+-
+- if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+- return false;
+-
+- return true;
+-}
+-
+ int ip6_forward(struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+@@ -514,7 +503,7 @@ int ip6_forward(struct sk_buff *skb)
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+
+- if (ip6_pkt_too_big(skb, mtu)) {
++ if (skb->len > mtu && !skb_is_gso(skb)) {
+ /* Again, force OUTPUT device used as source address */
+ skb->dev = dst->dev;
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 4e38a81e48ee..82ed7dfb7b80 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1351,7 +1351,7 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
+ int err;
+
+ if (level != SOL_PPPOL2TP)
+- return udp_prot.setsockopt(sk, level, optname, optval, optlen);
++ return -EINVAL;
+
+ if (optlen < sizeof(int))
+ return -EINVAL;
+@@ -1477,7 +1477,7 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
+ struct pppol2tp_session *ps;
+
+ if (level != SOL_PPPOL2TP)
+- return udp_prot.getsockopt(sk, level, optname, optval, optlen);
++ return -EINVAL;
+
+ if (get_user(len, (int __user *) optlen))
+ return -EFAULT;
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
2014-08-08 17:25 Mike Pagano
@ 2014-08-19 11:41 ` Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-08-19 11:41 UTC (permalink / raw
To: gentoo-commits
commit: 48d5e762de93d7df88c6f216d9947f5ac8a8c9a0
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Aug 8 17:22:57 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Aug 8 17:22:57 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=48d5e762
Linux patch 3.4.102
---
0000_README | 4 +
1101_linux-3.4.102.patch | 1221 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1225 insertions(+)
diff --git a/0000_README b/0000_README
index 0f65113..4747723 100644
--- a/0000_README
+++ b/0000_README
@@ -443,6 +443,10 @@ Patch: 1100_linux-3.4.101.patch
From: http://www.kernel.org
Desc: Linux 3.4.101
+Patch: 1101_linux-3.4.102.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.102
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1101_linux-3.4.102.patch b/1101_linux-3.4.102.patch
new file mode 100644
index 0000000..c444b8d
--- /dev/null
+++ b/1101_linux-3.4.102.patch
@@ -0,0 +1,1221 @@
+diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
+index d6498e3cd713..f33a9369e35b 100644
+--- a/Documentation/x86/x86_64/mm.txt
++++ b/Documentation/x86/x86_64/mm.txt
+@@ -12,6 +12,8 @@ ffffc90000000000 - ffffe8ffffffffff (=45 bits) vmalloc/ioremap space
+ ffffe90000000000 - ffffe9ffffffffff (=40 bits) hole
+ ffffea0000000000 - ffffeaffffffffff (=40 bits) virtual memory map (1TB)
+ ... unused hole ...
++ffffff0000000000 - ffffff7fffffffff (=39 bits) %esp fixup stacks
++... unused hole ...
+ ffffffff80000000 - ffffffffa0000000 (=512 MB) kernel text mapping, from phys 0
+ ffffffffa0000000 - fffffffffff00000 (=1536 MB) module mapping space
+
+diff --git a/Makefile b/Makefile
+index a22bcb567348..dd03fa5777a0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 101
++SUBLEVEL = 102
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mm/idmap.c b/arch/arm/mm/idmap.c
+index ab88ed4f8e08..ef8f2df02540 100644
+--- a/arch/arm/mm/idmap.c
++++ b/arch/arm/mm/idmap.c
+@@ -22,6 +22,13 @@ static void idmap_add_pmd(pud_t *pud, unsigned long addr, unsigned long end,
+ pr_warning("Failed to allocate identity pmd.\n");
+ return;
+ }
++ /*
++ * Copy the original PMD to ensure that the PMD entries for
++ * the kernel image are preserved.
++ */
++ if (!pud_none(*pud))
++ memcpy(pmd, pmd_offset(pud, 0),
++ PTRS_PER_PMD * sizeof(pmd_t));
+ pud_populate(&init_mm, pud, pmd);
+ pmd += pmd_index(addr);
+ } else
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 9df4ea1caaf1..917c1098775b 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -915,10 +915,27 @@ config VM86
+ default y
+ depends on X86_32
+ ---help---
+- This option is required by programs like DOSEMU to run 16-bit legacy
+- code on X86 processors. It also may be needed by software like
+- XFree86 to initialize some video cards via BIOS. Disabling this
+- option saves about 6k.
++ This option is required by programs like DOSEMU to run
++ 16-bit real mode legacy code on x86 processors. It also may
++ be needed by software like XFree86 to initialize some video
++ cards via BIOS. Disabling this option saves about 6K.
++
++config X86_16BIT
++ bool "Enable support for 16-bit segments" if EXPERT
++ default y
++ ---help---
++ This option is required by programs like Wine to run 16-bit
++ protected mode legacy code on x86 processors. Disabling
++ this option saves about 300 bytes on i386, or around 6K text
++ plus 16K runtime memory on x86-64,
++
++config X86_ESPFIX32
++ def_bool y
++ depends on X86_16BIT && X86_32
++
++config X86_ESPFIX64
++ def_bool y
++ depends on X86_16BIT && X86_64
+
+ config TOSHIBA
+ tristate "Toshiba Laptop support"
+diff --git a/arch/x86/include/asm/espfix.h b/arch/x86/include/asm/espfix.h
+new file mode 100644
+index 000000000000..99efebb2f69d
+--- /dev/null
++++ b/arch/x86/include/asm/espfix.h
+@@ -0,0 +1,16 @@
++#ifndef _ASM_X86_ESPFIX_H
++#define _ASM_X86_ESPFIX_H
++
++#ifdef CONFIG_X86_64
++
++#include <asm/percpu.h>
++
++DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
++DECLARE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
++
++extern void init_espfix_bsp(void);
++extern void init_espfix_ap(void);
++
++#endif /* CONFIG_X86_64 */
++
++#endif /* _ASM_X86_ESPFIX_H */
+diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h
+index bba3cf88e624..0a8b519226b8 100644
+--- a/arch/x86/include/asm/irqflags.h
++++ b/arch/x86/include/asm/irqflags.h
+@@ -129,7 +129,7 @@ static inline notrace unsigned long arch_local_irq_save(void)
+
+ #define PARAVIRT_ADJUST_EXCEPTION_FRAME /* */
+
+-#define INTERRUPT_RETURN iretq
++#define INTERRUPT_RETURN jmp native_iret
+ #define USERGS_SYSRET64 \
+ swapgs; \
+ sysretq;
+diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
+index 766ea16fbbbd..51817fae7047 100644
+--- a/arch/x86/include/asm/pgtable_64_types.h
++++ b/arch/x86/include/asm/pgtable_64_types.h
+@@ -59,5 +59,7 @@ typedef struct { pteval_t pte; } pte_t;
+ #define MODULES_VADDR _AC(0xffffffffa0000000, UL)
+ #define MODULES_END _AC(0xffffffffff000000, UL)
+ #define MODULES_LEN (MODULES_END - MODULES_VADDR)
++#define ESPFIX_PGD_ENTRY _AC(-2, UL)
++#define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << PGDIR_SHIFT)
+
+ #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
+diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
+index d0f19f9fb846..16c7971457f8 100644
+--- a/arch/x86/include/asm/setup.h
++++ b/arch/x86/include/asm/setup.h
+@@ -61,6 +61,8 @@ static inline void x86_ce4100_early_setup(void) { }
+
+ #ifndef _SETUP
+
++#include <asm/espfix.h>
++
+ /*
+ * This is set up by the setup-routine at boot-time
+ */
+diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
+index 532d2e090e6f..9f15a46e9ccb 100644
+--- a/arch/x86/kernel/Makefile
++++ b/arch/x86/kernel/Makefile
+@@ -28,6 +28,7 @@ obj-$(CONFIG_X86_64) += sys_x86_64.o x8664_ksyms_64.o
+ obj-y += syscall_$(BITS).o
+ obj-$(CONFIG_X86_64) += vsyscall_64.o
+ obj-$(CONFIG_X86_64) += vsyscall_emu_64.o
++obj-$(CONFIG_X86_ESPFIX64) += espfix_64.o
+ obj-y += bootflag.o e820.o
+ obj-y += pci-dma.o quirks.o topology.o kdebugfs.o
+ obj-y += alternative.o i8253.o pci-nommu.o hw_breakpoint.o
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index e36c5cf38fde..a0751249d3c1 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -525,6 +525,7 @@ syscall_exit:
+ restore_all:
+ TRACE_IRQS_IRET
+ restore_all_notrace:
++#ifdef CONFIG_X86_ESPFIX32
+ movl PT_EFLAGS(%esp), %eax # mix EFLAGS, SS and CS
+ # Warning: PT_OLDSS(%esp) contains the wrong/random values if we
+ # are returning to the kernel.
+@@ -535,6 +536,7 @@ restore_all_notrace:
+ cmpl $((SEGMENT_LDT << 8) | USER_RPL), %eax
+ CFI_REMEMBER_STATE
+ je ldt_ss # returning to user-space with LDT SS
++#endif
+ restore_nocheck:
+ RESTORE_REGS 4 # skip orig_eax/error_code
+ irq_return:
+@@ -550,6 +552,7 @@ ENTRY(iret_exc)
+ .long irq_return,iret_exc
+ .previous
+
++#ifdef CONFIG_X86_ESPFIX32
+ CFI_RESTORE_STATE
+ ldt_ss:
+ #ifdef CONFIG_PARAVIRT
+@@ -593,6 +596,7 @@ ldt_ss:
+ lss (%esp), %esp /* switch to espfix segment */
+ CFI_ADJUST_CFA_OFFSET -8
+ jmp restore_nocheck
++#endif
+ CFI_ENDPROC
+ ENDPROC(system_call)
+
+@@ -766,6 +770,7 @@ ENDPROC(ptregs_clone)
+ * the high word of the segment base from the GDT and swiches to the
+ * normal stack and adjusts ESP with the matching offset.
+ */
++#ifdef CONFIG_X86_ESPFIX32
+ /* fixup the stack */
+ mov GDT_ESPFIX_SS + 4, %al /* bits 16..23 */
+ mov GDT_ESPFIX_SS + 7, %ah /* bits 24..31 */
+@@ -775,8 +780,10 @@ ENDPROC(ptregs_clone)
+ pushl_cfi %eax
+ lss (%esp), %esp /* switch to the normal stack segment */
+ CFI_ADJUST_CFA_OFFSET -8
++#endif
+ .endm
+ .macro UNWIND_ESPFIX_STACK
++#ifdef CONFIG_X86_ESPFIX32
+ movl %ss, %eax
+ /* see if on espfix stack */
+ cmpw $__ESPFIX_SS, %ax
+@@ -787,6 +794,7 @@ ENDPROC(ptregs_clone)
+ /* switch to normal stack */
+ FIXUP_ESPFIX_STACK
+ 27:
++#endif
+ .endm
+
+ /*
+@@ -1318,11 +1326,13 @@ END(debug)
+ */
+ ENTRY(nmi)
+ RING0_INT_FRAME
++#ifdef CONFIG_X86_ESPFIX32
+ pushl_cfi %eax
+ movl %ss, %eax
+ cmpw $__ESPFIX_SS, %ax
+ popl_cfi %eax
+ je nmi_espfix_stack
++#endif
+ cmpl $ia32_sysenter_target,(%esp)
+ je nmi_stack_fixup
+ pushl_cfi %eax
+@@ -1362,6 +1372,7 @@ nmi_debug_stack_check:
+ FIX_STACK 24, nmi_stack_correct, 1
+ jmp nmi_stack_correct
+
++#ifdef CONFIG_X86_ESPFIX32
+ nmi_espfix_stack:
+ /* We have a RING0_INT_FRAME here.
+ *
+@@ -1383,6 +1394,7 @@ nmi_espfix_stack:
+ lss 12+4(%esp), %esp # back to espfix stack
+ CFI_ADJUST_CFA_OFFSET -24
+ jmp irq_return
++#endif
+ CFI_ENDPROC
+ END(nmi)
+
+diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
+index bd6f59203b5f..42b055e24691 100644
+--- a/arch/x86/kernel/entry_64.S
++++ b/arch/x86/kernel/entry_64.S
+@@ -55,6 +55,7 @@
+ #include <asm/paravirt.h>
+ #include <asm/ftrace.h>
+ #include <asm/percpu.h>
++#include <asm/pgtable_types.h>
+ #include <linux/err.h>
+
+ /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
+@@ -901,17 +902,47 @@ restore_args:
+ irq_return:
+ INTERRUPT_RETURN
+
+- .section __ex_table, "a"
+- .quad irq_return, bad_iret
+- .previous
+-
+-#ifdef CONFIG_PARAVIRT
+ ENTRY(native_iret)
++ /*
++ * Are we returning to a stack segment from the LDT? Note: in
++ * 64-bit mode SS:RSP on the exception stack is always valid.
++ */
++#ifdef CONFIG_X86_ESPFIX64
++ testb $4,(SS-RIP)(%rsp)
++ jnz native_irq_return_ldt
++#endif
++
++native_irq_return_iret:
+ iretq
+
+ .section __ex_table,"a"
+- .quad native_iret, bad_iret
++ .quad native_irq_return_iret, bad_iret
+ .previous
++
++#ifdef CONFIG_X86_ESPFIX64
++native_irq_return_ldt:
++ pushq_cfi %rax
++ pushq_cfi %rdi
++ SWAPGS
++ movq PER_CPU_VAR(espfix_waddr),%rdi
++ movq %rax,(0*8)(%rdi) /* RAX */
++ movq (2*8)(%rsp),%rax /* RIP */
++ movq %rax,(1*8)(%rdi)
++ movq (3*8)(%rsp),%rax /* CS */
++ movq %rax,(2*8)(%rdi)
++ movq (4*8)(%rsp),%rax /* RFLAGS */
++ movq %rax,(3*8)(%rdi)
++ movq (6*8)(%rsp),%rax /* SS */
++ movq %rax,(5*8)(%rdi)
++ movq (5*8)(%rsp),%rax /* RSP */
++ movq %rax,(4*8)(%rdi)
++ andl $0xffff0000,%eax
++ popq_cfi %rdi
++ orq PER_CPU_VAR(espfix_stack),%rax
++ SWAPGS
++ movq %rax,%rsp
++ popq_cfi %rax
++ jmp native_irq_return_iret
+ #endif
+
+ .section .fixup,"ax"
+@@ -977,9 +1008,40 @@ ENTRY(retint_kernel)
+ call preempt_schedule_irq
+ jmp exit_intr
+ #endif
+-
+ CFI_ENDPROC
+ END(common_interrupt)
++
++ /*
++ * If IRET takes a fault on the espfix stack, then we
++ * end up promoting it to a doublefault. In that case,
++ * modify the stack to make it look like we just entered
++ * the #GP handler from user space, similar to bad_iret.
++ */
++#ifdef CONFIG_X86_ESPFIX64
++ ALIGN
++__do_double_fault:
++ XCPT_FRAME 1 RDI+8
++ movq RSP(%rdi),%rax /* Trap on the espfix stack? */
++ sarq $PGDIR_SHIFT,%rax
++ cmpl $ESPFIX_PGD_ENTRY,%eax
++ jne do_double_fault /* No, just deliver the fault */
++ cmpl $__KERNEL_CS,CS(%rdi)
++ jne do_double_fault
++ movq RIP(%rdi),%rax
++ cmpq $native_irq_return_iret,%rax
++ jne do_double_fault /* This shouldn't happen... */
++ movq PER_CPU_VAR(kernel_stack),%rax
++ subq $(6*8-KERNEL_STACK_OFFSET),%rax /* Reset to original stack */
++ movq %rax,RSP(%rdi)
++ movq $0,(%rax) /* Missing (lost) #GP error code */
++ movq $general_protection,RIP(%rdi)
++ retq
++ CFI_ENDPROC
++END(__do_double_fault)
++#else
++# define __do_double_fault do_double_fault
++#endif
++
+ /*
+ * End of kprobes section
+ */
+@@ -1155,7 +1217,7 @@ zeroentry overflow do_overflow
+ zeroentry bounds do_bounds
+ zeroentry invalid_op do_invalid_op
+ zeroentry device_not_available do_device_not_available
+-paranoiderrorentry double_fault do_double_fault
++paranoiderrorentry double_fault __do_double_fault
+ zeroentry coprocessor_segment_overrun do_coprocessor_segment_overrun
+ errorentry invalid_TSS do_invalid_TSS
+ errorentry segment_not_present do_segment_not_present
+@@ -1486,7 +1548,7 @@ error_sti:
+ */
+ error_kernelspace:
+ incl %ebx
+- leaq irq_return(%rip),%rcx
++ leaq native_irq_return_iret(%rip),%rcx
+ cmpq %rcx,RIP+8(%rsp)
+ je error_swapgs
+ movl %ecx,%eax /* zero extend */
+diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c
+new file mode 100644
+index 000000000000..94d857fb1033
+--- /dev/null
++++ b/arch/x86/kernel/espfix_64.c
+@@ -0,0 +1,208 @@
++/* ----------------------------------------------------------------------- *
++ *
++ * Copyright 2014 Intel Corporation; author: H. Peter Anvin
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms and conditions of the GNU General Public License,
++ * version 2, as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
++ * more details.
++ *
++ * ----------------------------------------------------------------------- */
++
++/*
++ * The IRET instruction, when returning to a 16-bit segment, only
++ * restores the bottom 16 bits of the user space stack pointer. This
++ * causes some 16-bit software to break, but it also leaks kernel state
++ * to user space.
++ *
++ * This works around this by creating percpu "ministacks", each of which
++ * is mapped 2^16 times 64K apart. When we detect that the return SS is
++ * on the LDT, we copy the IRET frame to the ministack and use the
++ * relevant alias to return to userspace. The ministacks are mapped
++ * readonly, so if the IRET fault we promote #GP to #DF which is an IST
++ * vector and thus has its own stack; we then do the fixup in the #DF
++ * handler.
++ *
++ * This file sets up the ministacks and the related page tables. The
++ * actual ministack invocation is in entry_64.S.
++ */
++
++#include <linux/init.h>
++#include <linux/init_task.h>
++#include <linux/kernel.h>
++#include <linux/percpu.h>
++#include <linux/gfp.h>
++#include <linux/random.h>
++#include <asm/pgtable.h>
++#include <asm/pgalloc.h>
++#include <asm/setup.h>
++#include <asm/espfix.h>
++
++/*
++ * Note: we only need 6*8 = 48 bytes for the espfix stack, but round
++ * it up to a cache line to avoid unnecessary sharing.
++ */
++#define ESPFIX_STACK_SIZE (8*8UL)
++#define ESPFIX_STACKS_PER_PAGE (PAGE_SIZE/ESPFIX_STACK_SIZE)
++
++/* There is address space for how many espfix pages? */
++#define ESPFIX_PAGE_SPACE (1UL << (PGDIR_SHIFT-PAGE_SHIFT-16))
++
++#define ESPFIX_MAX_CPUS (ESPFIX_STACKS_PER_PAGE * ESPFIX_PAGE_SPACE)
++#if CONFIG_NR_CPUS > ESPFIX_MAX_CPUS
++# error "Need more than one PGD for the ESPFIX hack"
++#endif
++
++#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO)
++
++/* This contains the *bottom* address of the espfix stack */
++DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_stack);
++DEFINE_PER_CPU_READ_MOSTLY(unsigned long, espfix_waddr);
++
++/* Initialization mutex - should this be a spinlock? */
++static DEFINE_MUTEX(espfix_init_mutex);
++
++/* Page allocation bitmap - each page serves ESPFIX_STACKS_PER_PAGE CPUs */
++#define ESPFIX_MAX_PAGES DIV_ROUND_UP(CONFIG_NR_CPUS, ESPFIX_STACKS_PER_PAGE)
++static void *espfix_pages[ESPFIX_MAX_PAGES];
++
++static __page_aligned_bss pud_t espfix_pud_page[PTRS_PER_PUD]
++ __aligned(PAGE_SIZE);
++
++static unsigned int page_random, slot_random;
++
++/*
++ * This returns the bottom address of the espfix stack for a specific CPU.
++ * The math allows for a non-power-of-two ESPFIX_STACK_SIZE, in which case
++ * we have to account for some amount of padding at the end of each page.
++ */
++static inline unsigned long espfix_base_addr(unsigned int cpu)
++{
++ unsigned long page, slot;
++ unsigned long addr;
++
++ page = (cpu / ESPFIX_STACKS_PER_PAGE) ^ page_random;
++ slot = (cpu + slot_random) % ESPFIX_STACKS_PER_PAGE;
++ addr = (page << PAGE_SHIFT) + (slot * ESPFIX_STACK_SIZE);
++ addr = (addr & 0xffffUL) | ((addr & ~0xffffUL) << 16);
++ addr += ESPFIX_BASE_ADDR;
++ return addr;
++}
++
++#define PTE_STRIDE (65536/PAGE_SIZE)
++#define ESPFIX_PTE_CLONES (PTRS_PER_PTE/PTE_STRIDE)
++#define ESPFIX_PMD_CLONES PTRS_PER_PMD
++#define ESPFIX_PUD_CLONES (65536/(ESPFIX_PTE_CLONES*ESPFIX_PMD_CLONES))
++
++#define PGTABLE_PROT ((_KERNPG_TABLE & ~_PAGE_RW) | _PAGE_NX)
++
++static void init_espfix_random(void)
++{
++ unsigned long rand;
++
++ /*
++ * This is run before the entropy pools are initialized,
++ * but this is hopefully better than nothing.
++ */
++ if (!arch_get_random_long(&rand)) {
++ /* The constant is an arbitrary large prime */
++ rdtscll(rand);
++ rand *= 0xc345c6b72fd16123UL;
++ }
++
++ slot_random = rand % ESPFIX_STACKS_PER_PAGE;
++ page_random = (rand / ESPFIX_STACKS_PER_PAGE)
++ & (ESPFIX_PAGE_SPACE - 1);
++}
++
++void __init init_espfix_bsp(void)
++{
++ pgd_t *pgd_p;
++ pteval_t ptemask;
++
++ ptemask = __supported_pte_mask;
++
++ /* Install the espfix pud into the kernel page directory */
++ pgd_p = &init_level4_pgt[pgd_index(ESPFIX_BASE_ADDR)];
++ pgd_populate(&init_mm, pgd_p, (pud_t *)espfix_pud_page);
++
++ /* Randomize the locations */
++ init_espfix_random();
++
++ /* The rest is the same as for any other processor */
++ init_espfix_ap();
++}
++
++void init_espfix_ap(void)
++{
++ unsigned int cpu, page;
++ unsigned long addr;
++ pud_t pud, *pud_p;
++ pmd_t pmd, *pmd_p;
++ pte_t pte, *pte_p;
++ int n;
++ void *stack_page;
++ pteval_t ptemask;
++
++ /* We only have to do this once... */
++ if (likely(this_cpu_read(espfix_stack)))
++ return; /* Already initialized */
++
++ cpu = smp_processor_id();
++ addr = espfix_base_addr(cpu);
++ page = cpu/ESPFIX_STACKS_PER_PAGE;
++
++ /* Did another CPU already set this up? */
++ stack_page = ACCESS_ONCE(espfix_pages[page]);
++ if (likely(stack_page))
++ goto done;
++
++ mutex_lock(&espfix_init_mutex);
++
++ /* Did we race on the lock? */
++ stack_page = ACCESS_ONCE(espfix_pages[page]);
++ if (stack_page)
++ goto unlock_done;
++
++ ptemask = __supported_pte_mask;
++
++ pud_p = &espfix_pud_page[pud_index(addr)];
++ pud = *pud_p;
++ if (!pud_present(pud)) {
++ pmd_p = (pmd_t *)__get_free_page(PGALLOC_GFP);
++ pud = __pud(__pa(pmd_p) | (PGTABLE_PROT & ptemask));
++ paravirt_alloc_pmd(&init_mm, __pa(pmd_p) >> PAGE_SHIFT);
++ for (n = 0; n < ESPFIX_PUD_CLONES; n++)
++ set_pud(&pud_p[n], pud);
++ }
++
++ pmd_p = pmd_offset(&pud, addr);
++ pmd = *pmd_p;
++ if (!pmd_present(pmd)) {
++ pte_p = (pte_t *)__get_free_page(PGALLOC_GFP);
++ pmd = __pmd(__pa(pte_p) | (PGTABLE_PROT & ptemask));
++ paravirt_alloc_pte(&init_mm, __pa(pte_p) >> PAGE_SHIFT);
++ for (n = 0; n < ESPFIX_PMD_CLONES; n++)
++ set_pmd(&pmd_p[n], pmd);
++ }
++
++ pte_p = pte_offset_kernel(&pmd, addr);
++ stack_page = (void *)__get_free_page(GFP_KERNEL);
++ pte = __pte(__pa(stack_page) | (__PAGE_KERNEL_RO & ptemask));
++ for (n = 0; n < ESPFIX_PTE_CLONES; n++)
++ set_pte(&pte_p[n*PTE_STRIDE], pte);
++
++ /* Job is done for this CPU and any CPU which shares this page */
++ ACCESS_ONCE(espfix_pages[page]) = stack_page;
++
++unlock_done:
++ mutex_unlock(&espfix_init_mutex);
++done:
++ this_cpu_write(espfix_stack, addr);
++ this_cpu_write(espfix_waddr, (unsigned long)stack_page
++ + (addr & ~PAGE_MASK));
++}
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index dcbbaa165bde..c37886d759cc 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -20,8 +20,6 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+
+-int sysctl_ldt16 = 0;
+-
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -231,16 +229,10 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ }
+ }
+
+- /*
+- * On x86-64 we do not support 16-bit segments due to
+- * IRET leaking the high bits of the kernel stack address.
+- */
+-#ifdef CONFIG_X86_64
+- if (!ldt_info.seg_32bit && !sysctl_ldt16) {
++ if (!IS_ENABLED(CONFIG_X86_16BIT) && !ldt_info.seg_32bit) {
+ error = -EINVAL;
+ goto out_unlock;
+ }
+-#endif
+
+ fill_ldt(&ldt, &ldt_info);
+ if (oldmode)
+diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
+index 3f08f34f93eb..a1da6737ba5b 100644
+--- a/arch/x86/kernel/paravirt_patch_64.c
++++ b/arch/x86/kernel/paravirt_patch_64.c
+@@ -6,7 +6,6 @@ DEF_NATIVE(pv_irq_ops, irq_disable, "cli");
+ DEF_NATIVE(pv_irq_ops, irq_enable, "sti");
+ DEF_NATIVE(pv_irq_ops, restore_fl, "pushq %rdi; popfq");
+ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax");
+-DEF_NATIVE(pv_cpu_ops, iret, "iretq");
+ DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax");
+ DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax");
+ DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3");
+@@ -50,7 +49,6 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+ PATCH_SITE(pv_irq_ops, save_fl);
+ PATCH_SITE(pv_irq_ops, irq_enable);
+ PATCH_SITE(pv_irq_ops, irq_disable);
+- PATCH_SITE(pv_cpu_ops, iret);
+ PATCH_SITE(pv_cpu_ops, irq_enable_sysexit);
+ PATCH_SITE(pv_cpu_ops, usergs_sysret32);
+ PATCH_SITE(pv_cpu_ops, usergs_sysret64);
+diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
+index 849cdcf2e76a..d28c59588ad3 100644
+--- a/arch/x86/kernel/smpboot.c
++++ b/arch/x86/kernel/smpboot.c
+@@ -271,6 +271,13 @@ notrace static void __cpuinit start_secondary(void *unused)
+ check_tsc_sync_target();
+
+ /*
++ * Enable the espfix hack for this CPU
++ */
++#ifdef CONFIG_X86_ESPFIX64
++ init_espfix_ap();
++#endif
++
++ /*
+ * We need to hold call_lock, so there is no inconsistency
+ * between the time smp_call_function() determines number of
+ * IPI recipients, and the time when the determination is made
+diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
+index 0002a3a33081..e04e67753238 100644
+--- a/arch/x86/mm/dump_pagetables.c
++++ b/arch/x86/mm/dump_pagetables.c
+@@ -30,11 +30,13 @@ struct pg_state {
+ unsigned long start_address;
+ unsigned long current_address;
+ const struct addr_marker *marker;
++ unsigned long lines;
+ };
+
+ struct addr_marker {
+ unsigned long start_address;
+ const char *name;
++ unsigned long max_lines;
+ };
+
+ /* indices for address_markers; keep sync'd w/ address_markers below */
+@@ -45,6 +47,7 @@ enum address_markers_idx {
+ LOW_KERNEL_NR,
+ VMALLOC_START_NR,
+ VMEMMAP_START_NR,
++ ESPFIX_START_NR,
+ HIGH_KERNEL_NR,
+ MODULES_VADDR_NR,
+ MODULES_END_NR,
+@@ -67,6 +70,7 @@ static struct addr_marker address_markers[] = {
+ { PAGE_OFFSET, "Low Kernel Mapping" },
+ { VMALLOC_START, "vmalloc() Area" },
+ { VMEMMAP_START, "Vmemmap" },
++ { ESPFIX_BASE_ADDR, "ESPfix Area", 16 },
+ { __START_KERNEL_map, "High Kernel Mapping" },
+ { MODULES_VADDR, "Modules" },
+ { MODULES_END, "End Modules" },
+@@ -163,7 +167,7 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ pgprot_t new_prot, int level)
+ {
+ pgprotval_t prot, cur;
+- static const char units[] = "KMGTPE";
++ static const char units[] = "BKMGTPE";
+
+ /*
+ * If we have a "break" in the series, we need to flush the state that
+@@ -178,6 +182,7 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ st->current_prot = new_prot;
+ st->level = level;
+ st->marker = address_markers;
++ st->lines = 0;
+ seq_printf(m, "---[ %s ]---\n", st->marker->name);
+ } else if (prot != cur || level != st->level ||
+ st->current_address >= st->marker[1].start_address) {
+@@ -188,17 +193,21 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ /*
+ * Now print the actual finished series
+ */
+- seq_printf(m, "0x%0*lx-0x%0*lx ",
+- width, st->start_address,
+- width, st->current_address);
+-
+- delta = (st->current_address - st->start_address) >> 10;
+- while (!(delta & 1023) && unit[1]) {
+- delta >>= 10;
+- unit++;
++ if (!st->marker->max_lines ||
++ st->lines < st->marker->max_lines) {
++ seq_printf(m, "0x%0*lx-0x%0*lx ",
++ width, st->start_address,
++ width, st->current_address);
++
++ delta = (st->current_address - st->start_address);
++ while (!(delta & 1023) && unit[1]) {
++ delta >>= 10;
++ unit++;
++ }
++ seq_printf(m, "%9lu%c ", delta, *unit);
++ printk_prot(m, st->current_prot, st->level);
+ }
+- seq_printf(m, "%9lu%c ", delta, *unit);
+- printk_prot(m, st->current_prot, st->level);
++ st->lines++;
+
+ /*
+ * We print markers for special areas of address space,
+@@ -206,7 +215,15 @@ static void note_page(struct seq_file *m, struct pg_state *st,
+ * This helps in the interpretation.
+ */
+ if (st->current_address >= st->marker[1].start_address) {
++ if (st->marker->max_lines &&
++ st->lines > st->marker->max_lines) {
++ unsigned long nskip =
++ st->lines - st->marker->max_lines;
++ seq_printf(m, "... %lu entr%s skipped ... \n",
++ nskip, nskip == 1 ? "y" : "ies");
++ }
+ st->marker++;
++ st->lines = 0;
+ seq_printf(m, "---[ %s ]---\n", st->marker->name);
+ }
+
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index c734408d55e4..66e6d9359826 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,7 +41,6 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled sysctl_vsyscall32
+ #define arch_setup_additional_pages syscall32_setup_pages
+-extern int sysctl_ldt16;
+ #endif
+
+ /*
+@@ -381,13 +380,6 @@ static ctl_table abi_table2[] = {
+ .mode = 0644,
+ .proc_handler = proc_dointvec
+ },
+- {
+- .procname = "ldt16",
+- .data = &sysctl_ldt16,
+- .maxlen = sizeof(int),
+- .mode = 0644,
+- .proc_handler = proc_dointvec
+- },
+ {}
+ };
+
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
+index ac33d5f30778..bf948e134981 100644
+--- a/crypto/af_alg.c
++++ b/crypto/af_alg.c
+@@ -21,6 +21,7 @@
+ #include <linux/module.h>
+ #include <linux/net.h>
+ #include <linux/rwsem.h>
++#include <linux/security.h>
+
+ struct alg_type_list {
+ const struct af_alg_type *type;
+@@ -243,6 +244,7 @@ int af_alg_accept(struct sock *sk, struct socket *newsock)
+
+ sock_init_data(newsock, sk2);
+ sock_graft(sk2, newsock);
++ security_sk_clone(sk, sk2);
+
+ err = type->accept(ask->private, sk2);
+ if (err) {
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index 2bc036292d9d..ac99b46dc4a4 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -795,6 +795,14 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
+ scsi_next_command(cmd);
+ return;
+ }
++ } else if (blk_rq_bytes(req) == 0 && result && !sense_deferred) {
++ /*
++ * Certain non BLOCK_PC requests are commands that don't
++ * actually transfer anything (FLUSH), so cannot use
++ * good_bytes != blk_rq_bytes(req) as the signal for an error.
++ * This sets the error explicitly for the problem case.
++ */
++ error = __scsi_error_from_host_byte(cmd, result);
+ }
+
+ /* no bidi support for !REQ_TYPE_BLOCK_PC yet */
+diff --git a/include/linux/printk.h b/include/linux/printk.h
+index 0525927f203f..d633115489d1 100644
+--- a/include/linux/printk.h
++++ b/include/linux/printk.h
+@@ -101,9 +101,9 @@ asmlinkage __printf(1, 2) __cold
+ int printk(const char *fmt, ...);
+
+ /*
+- * Special printk facility for scheduler use only, _DO_NOT_USE_ !
++ * Special printk facility for scheduler/timekeeping use only, _DO_NOT_USE_ !
+ */
+-__printf(1, 2) __cold int printk_sched(const char *fmt, ...);
++__printf(1, 2) __cold int printk_deferred(const char *fmt, ...);
+
+ /*
+ * Please don't use printk_ratelimit(), because it shares ratelimiting state
+@@ -133,7 +133,7 @@ int printk(const char *s, ...)
+ return 0;
+ }
+ static inline __printf(1, 2) __cold
+-int printk_sched(const char *s, ...)
++int printk_deferred(const char *s, ...)
+ {
+ return 0;
+ }
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index e22df7a4f1ab..4424db24396d 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2608,22 +2608,5 @@ static inline bool skb_is_recycleable(const struct sk_buff *skb, int skb_size)
+
+ return true;
+ }
+-
+-/**
+- * skb_gso_network_seglen - Return length of individual segments of a gso packet
+- *
+- * @skb: GSO skb
+- *
+- * skb_gso_network_seglen is used to determine the real size of the
+- * individual segments, including Layer3 (IP, IPv6) and L4 headers (TCP/UDP).
+- *
+- * The MAC/L2 header is not accounted for.
+- */
+-static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)
+-{
+- unsigned int hdr_len = skb_transport_header(skb) -
+- skb_network_header(skb);
+- return hdr_len + skb_gso_transport_seglen(skb);
+-}
+ #endif /* __KERNEL__ */
+ #endif /* _LINUX_SKBUFF_H */
+diff --git a/init/main.c b/init/main.c
+index db8e381877ad..f30baf52f80b 100644
+--- a/init/main.c
++++ b/init/main.c
+@@ -606,6 +606,10 @@ asmlinkage void __init start_kernel(void)
+ if (efi_enabled(EFI_RUNTIME_SERVICES))
+ efi_enter_virtual_mode();
+ #endif
++#ifdef CONFIG_X86_ESPFIX64
++ /* Should be run before the first non-init thread is created */
++ init_espfix_bsp();
++#endif
+ thread_info_cache_init();
+ cred_init();
+ fork_init(totalram_pages);
+diff --git a/kernel/printk.c b/kernel/printk.c
+index e39adc13f5f5..544c0215939a 100644
+--- a/kernel/printk.c
++++ b/kernel/printk.c
+@@ -1653,7 +1653,7 @@ late_initcall(printk_late_init);
+
+ #if defined CONFIG_PRINTK
+
+-int printk_sched(const char *fmt, ...)
++int printk_deferred(const char *fmt, ...)
+ {
+ unsigned long flags;
+ va_list args;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index af837d82634e..5701cb9a673f 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -1313,7 +1313,7 @@ out:
+ * leave kernel.
+ */
+ if (p->mm && printk_ratelimit()) {
+- printk_sched("process %d (%s) no longer affine to cpu%d\n",
++ printk_deferred("process %d (%s) no longer affine to cpu%d\n",
+ task_pid_nr(p), p->comm, cpu);
+ }
+ }
+diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
+index 2b0131835714..526c77d1b655 100644
+--- a/kernel/sched/rt.c
++++ b/kernel/sched/rt.c
+@@ -884,7 +884,7 @@ static int sched_rt_runtime_exceeded(struct rt_rq *rt_rq)
+
+ if (!once) {
+ once = true;
+- printk_sched("sched: RT throttling activated\n");
++ printk_deferred("sched: RT throttling activated\n");
+ }
+ } else {
+ /*
+diff --git a/kernel/time/clockevents.c b/kernel/time/clockevents.c
+index 0d37a6fd18af..4d7ee79ec469 100644
+--- a/kernel/time/clockevents.c
++++ b/kernel/time/clockevents.c
+@@ -143,7 +143,8 @@ static int clockevents_increase_min_delta(struct clock_event_device *dev)
+ {
+ /* Nothing to do if we already reached the limit */
+ if (dev->min_delta_ns >= MIN_DELTA_LIMIT) {
+- printk(KERN_WARNING "CE: Reprogramming failure. Giving up\n");
++ printk_deferred(KERN_WARNING
++ "CE: Reprogramming failure. Giving up\n");
+ dev->next_event.tv64 = KTIME_MAX;
+ return -ETIME;
+ }
+@@ -156,9 +157,10 @@ static int clockevents_increase_min_delta(struct clock_event_device *dev)
+ if (dev->min_delta_ns > MIN_DELTA_LIMIT)
+ dev->min_delta_ns = MIN_DELTA_LIMIT;
+
+- printk(KERN_WARNING "CE: %s increased min_delta_ns to %llu nsec\n",
+- dev->name ? dev->name : "?",
+- (unsigned long long) dev->min_delta_ns);
++ printk_deferred(KERN_WARNING
++ "CE: %s increased min_delta_ns to %llu nsec\n",
++ dev->name ? dev->name : "?",
++ (unsigned long long) dev->min_delta_ns);
+ return 0;
+ }
+
+diff --git a/lib/btree.c b/lib/btree.c
+index 5cf9e74ec3f3..53a773ecf57c 100644
+--- a/lib/btree.c
++++ b/lib/btree.c
+@@ -198,6 +198,7 @@ EXPORT_SYMBOL_GPL(btree_init);
+
+ void btree_destroy(struct btree_head *head)
+ {
++ mempool_free(head->node, head->mempool);
+ mempool_destroy(head->mempool);
+ head->mempool = NULL;
+ }
+diff --git a/mm/mlock.c b/mm/mlock.c
+index ef726e8aa8e9..7a84dd1f5ec6 100644
+--- a/mm/mlock.c
++++ b/mm/mlock.c
+@@ -78,6 +78,7 @@ void __clear_page_mlock(struct page *page)
+ */
+ void mlock_vma_page(struct page *page)
+ {
++ /* Serialize with page migration */
+ BUG_ON(!PageLocked(page));
+
+ if (!TestSetPageMlocked(page)) {
+@@ -105,6 +106,7 @@ void mlock_vma_page(struct page *page)
+ */
+ void munlock_vma_page(struct page *page)
+ {
++ /* For try_to_munlock() and to serialize with page migration */
+ BUG_ON(!PageLocked(page));
+
+ if (TestClearPageMlocked(page)) {
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 39d530a425b5..ff0b0997b953 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -2187,7 +2187,7 @@ static inline int
+ gfp_to_alloc_flags(gfp_t gfp_mask)
+ {
+ int alloc_flags = ALLOC_WMARK_MIN | ALLOC_CPUSET;
+- const gfp_t wait = gfp_mask & __GFP_WAIT;
++ const bool atomic = !(gfp_mask & (__GFP_WAIT | __GFP_NO_KSWAPD));
+
+ /* __GFP_HIGH is assumed to be the same as ALLOC_HIGH to save a branch. */
+ BUILD_BUG_ON(__GFP_HIGH != (__force gfp_t) ALLOC_HIGH);
+@@ -2196,20 +2196,20 @@ gfp_to_alloc_flags(gfp_t gfp_mask)
+ * The caller may dip into page reserves a bit more if the caller
+ * cannot run direct reclaim, or if the caller has realtime scheduling
+ * policy or is asking for __GFP_HIGH memory. GFP_ATOMIC requests will
+- * set both ALLOC_HARDER (!wait) and ALLOC_HIGH (__GFP_HIGH).
++ * set both ALLOC_HARDER (atomic == true) and ALLOC_HIGH (__GFP_HIGH).
+ */
+ alloc_flags |= (__force int) (gfp_mask & __GFP_HIGH);
+
+- if (!wait) {
++ if (atomic) {
+ /*
+- * Not worth trying to allocate harder for
+- * __GFP_NOMEMALLOC even if it can't schedule.
++ * Not worth trying to allocate harder for __GFP_NOMEMALLOC even
++ * if it can't schedule.
+ */
+- if (!(gfp_mask & __GFP_NOMEMALLOC))
++ if (!(gfp_mask & __GFP_NOMEMALLOC))
+ alloc_flags |= ALLOC_HARDER;
+ /*
+- * Ignore cpuset if GFP_ATOMIC (!wait) rather than fail alloc.
+- * See also cpuset_zone_allowed() comment in kernel/cpuset.c.
++ * Ignore cpuset mems for GFP_ATOMIC rather than fail, see the
++ * comment for __cpuset_node_allowed_softwall().
+ */
+ alloc_flags &= ~ALLOC_CPUSET;
+ } else if (unlikely(rt_task(current)) && !in_interrupt())
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 6dc46f345dba..695eaff55d77 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -1449,9 +1449,19 @@ static int try_to_unmap_cluster(unsigned long cursor, unsigned int *mapcount,
+ BUG_ON(!page || PageAnon(page));
+
+ if (locked_vma) {
+- mlock_vma_page(page); /* no-op if already mlocked */
+- if (page == check_page)
++ if (page == check_page) {
++ /* we know we have check_page locked */
++ mlock_vma_page(page);
+ ret = SWAP_MLOCK;
++ } else if (trylock_page(page)) {
++ /*
++ * If we can lock the page, perform mlock.
++ * Otherwise leave the page alone, it will be
++ * eventually encountered again later.
++ */
++ mlock_vma_page(page);
++ unlock_page(page);
++ }
+ continue; /* don't unmap */
+ }
+
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index 7593f3a46035..29a07b6c7168 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -39,68 +39,6 @@
+ #include <net/route.h>
+ #include <net/xfrm.h>
+
+-static bool ip_may_fragment(const struct sk_buff *skb)
+-{
+- return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+- skb->local_df;
+-}
+-
+-static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+-{
+- if (skb->len <= mtu)
+- return false;
+-
+- if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+- return false;
+-
+- return true;
+-}
+-
+-static bool ip_gso_exceeds_dst_mtu(const struct sk_buff *skb)
+-{
+- unsigned int mtu;
+-
+- if (skb->local_df || !skb_is_gso(skb))
+- return false;
+-
+- mtu = dst_mtu(skb_dst(skb));
+-
+- /* if seglen > mtu, do software segmentation for IP fragmentation on
+- * output. DF bit cannot be set since ip_forward would have sent
+- * icmp error.
+- */
+- return skb_gso_network_seglen(skb) > mtu;
+-}
+-
+-/* called if GSO skb needs to be fragmented on forward */
+-static int ip_forward_finish_gso(struct sk_buff *skb)
+-{
+- struct sk_buff *segs;
+- int ret = 0;
+-
+- segs = skb_gso_segment(skb, 0);
+- if (IS_ERR(segs)) {
+- kfree_skb(skb);
+- return -ENOMEM;
+- }
+-
+- consume_skb(skb);
+-
+- do {
+- struct sk_buff *nskb = segs->next;
+- int err;
+-
+- segs->next = NULL;
+- err = dst_output(segs);
+-
+- if (err && ret == 0)
+- ret = err;
+- segs = nskb;
+- } while (segs);
+-
+- return ret;
+-}
+-
+ static int ip_forward_finish(struct sk_buff *skb)
+ {
+ struct ip_options * opt = &(IPCB(skb)->opt);
+@@ -110,9 +48,6 @@ static int ip_forward_finish(struct sk_buff *skb)
+ if (unlikely(opt->optlen))
+ ip_forward_options(skb);
+
+- if (ip_gso_exceeds_dst_mtu(skb))
+- return ip_forward_finish_gso(skb);
+-
+ return dst_output(skb);
+ }
+
+@@ -152,7 +87,8 @@ int ip_forward(struct sk_buff *skb)
+ if (opt->is_strictroute && opt->nexthop != rt->rt_gateway)
+ goto sr_failed;
+
+- if (!ip_may_fragment(skb) && ip_exceeds_mtu(skb, dst_mtu(&rt->dst))) {
++ if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
++ (ip_hdr(skb)->frag_off & htons(IP_DF))) && !skb->local_df) {
+ IP_INC_STATS(dev_net(rt->dst.dev), IPSTATS_MIB_FRAGFAILS);
+ icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+ htonl(dst_mtu(&rt->dst)));
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index f976c3858df0..be5876079a8e 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -2438,8 +2438,18 @@ static void init_loopback(struct net_device *dev)
+ if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+ continue;
+
+- if (sp_ifa->rt)
+- continue;
++ if (sp_ifa->rt) {
++ /* This dst has been added to garbage list when
++ * lo device down, release this obsolete dst and
++ * reallocate a new router for ifa.
++ */
++ if (sp_ifa->rt->dst.obsolete > 0) {
++ dst_release(&sp_ifa->rt->dst);
++ sp_ifa->rt = NULL;
++ } else {
++ continue;
++ }
++ }
+
+ sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 077b9a3f8d25..6225b7cf12b9 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -382,17 +382,6 @@ static inline int ip6_forward_finish(struct sk_buff *skb)
+ return dst_output(skb);
+ }
+
+-static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+-{
+- if (skb->len <= mtu || skb->local_df)
+- return false;
+-
+- if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+- return false;
+-
+- return true;
+-}
+-
+ int ip6_forward(struct sk_buff *skb)
+ {
+ struct dst_entry *dst = skb_dst(skb);
+@@ -514,7 +503,7 @@ int ip6_forward(struct sk_buff *skb)
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+
+- if (ip6_pkt_too_big(skb, mtu)) {
++ if (skb->len > mtu && !skb_is_gso(skb)) {
+ /* Again, force OUTPUT device used as source address */
+ skb->dev = dst->dev;
+ icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 4e38a81e48ee..82ed7dfb7b80 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -1351,7 +1351,7 @@ static int pppol2tp_setsockopt(struct socket *sock, int level, int optname,
+ int err;
+
+ if (level != SOL_PPPOL2TP)
+- return udp_prot.setsockopt(sk, level, optname, optval, optlen);
++ return -EINVAL;
+
+ if (optlen < sizeof(int))
+ return -EINVAL;
+@@ -1477,7 +1477,7 @@ static int pppol2tp_getsockopt(struct socket *sock, int level,
+ struct pppol2tp_session *ps;
+
+ if (level != SOL_PPPOL2TP)
+- return udp_prot.getsockopt(sk, level, optname, optval, optlen);
++ return -EINVAL;
+
+ if (get_user(len, (int __user *) optlen))
+ return -EFAULT;
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-08-02 14:43 Mike Pagano
2014-08-19 11:41 ` Mike Pagano
0 siblings, 1 reply; 25+ messages in thread
From: Mike Pagano @ 2014-08-02 14:43 UTC (permalink / raw
To: gentoo-commits
commit: 6170daa192bd78ce9c1c618fdcf4acb5e0bb0c8c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Aug 2 14:41:21 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Aug 2 14:41:21 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=6170daa1
Linux patch 3.4.101
---
0000_README | 4 +
1100_linux-3.4.101.patch | 349 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 353 insertions(+)
diff --git a/0000_README b/0000_README
index af7f3f3..0f65113 100644
--- a/0000_README
+++ b/0000_README
@@ -439,6 +439,10 @@ Patch: 1099_linux-3.4.100.patch
From: http://www.kernel.org
Desc: Linux 3.4.100
+Patch: 1100_linux-3.4.101.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.101
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1100_linux-3.4.101.patch b/1100_linux-3.4.101.patch
new file mode 100644
index 0000000..54832f4
--- /dev/null
+++ b/1100_linux-3.4.101.patch
@@ -0,0 +1,349 @@
+diff --git a/Makefile b/Makefile
+index d6c64eb82525..a22bcb567348 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 100
++SUBLEVEL = 101
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+@@ -592,6 +592,8 @@ KBUILD_CFLAGS += -fomit-frame-pointer
+ endif
+ endif
+
++KBUILD_CFLAGS += $(call cc-option, -fno-var-tracking-assignments)
++
+ ifdef CONFIG_DEBUG_INFO
+ KBUILD_CFLAGS += -g
+ KBUILD_AFLAGS += -gdwarf-2
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 02f300fbf070..e0a8707dd137 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -292,7 +292,9 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ * psw and gprs are stored on the stack
+ */
+ if (addr == (addr_t) &dummy->regs.psw.mask &&
+- ((data & ~PSW_MASK_USER) != psw_user_bits ||
++ (((data^psw_user_bits) & ~PSW_MASK_USER) ||
++ (((data^psw_user_bits) & PSW_MASK_ASC) &&
++ ((data|psw_user_bits) & PSW_MASK_ASC) == PSW_MASK_ASC) ||
+ ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))))
+ /* Invalid psw mask. */
+ return -EINVAL;
+@@ -595,7 +597,10 @@ static int __poke_user_compat(struct task_struct *child,
+ */
+ if (addr == (addr_t) &dummy32->regs.psw.mask) {
+ /* Build a 64 bit psw mask from 31 bit mask. */
+- if ((tmp & ~PSW32_MASK_USER) != psw32_user_bits)
++ if (((tmp^psw32_user_bits) & ~PSW32_MASK_USER) ||
++ (((tmp^psw32_user_bits) & PSW32_MASK_ASC) &&
++ ((tmp|psw32_user_bits) & PSW32_MASK_ASC)
++ == PSW32_MASK_ASC))
+ /* Invalid psw mask. */
+ return -EINVAL;
+ regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index e1e7f9c831da..e36c5cf38fde 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -428,8 +428,8 @@ sysenter_do_call:
+ cmpl $(NR_syscalls), %eax
+ jae sysenter_badsys
+ call *sys_call_table(,%eax,4)
+- movl %eax,PT_EAX(%esp)
+ sysenter_after_call:
++ movl %eax,PT_EAX(%esp)
+ LOCKDEP_SYS_EXIT
+ DISABLE_INTERRUPTS(CLBR_ANY)
+ TRACE_IRQS_OFF
+@@ -510,6 +510,7 @@ ENTRY(system_call)
+ jae syscall_badsys
+ syscall_call:
+ call *sys_call_table(,%eax,4)
++syscall_after_call:
+ movl %eax,PT_EAX(%esp) # store the return value
+ syscall_exit:
+ LOCKDEP_SYS_EXIT
+@@ -678,12 +679,12 @@ syscall_fault:
+ END(syscall_fault)
+
+ syscall_badsys:
+- movl $-ENOSYS,PT_EAX(%esp)
+- jmp syscall_exit
++ movl $-ENOSYS,%eax
++ jmp syscall_after_call
+ END(syscall_badsys)
+
+ sysenter_badsys:
+- movl $-ENOSYS,PT_EAX(%esp)
++ movl $-ENOSYS,%eax
+ jmp sysenter_after_call
+ END(syscall_badsys)
+ CFI_ENDPROC
+diff --git a/block/blk-tag.c b/block/blk-tag.c
+index 4af6f5cc1167..f606487bba56 100644
+--- a/block/blk-tag.c
++++ b/block/blk-tag.c
+@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struct request_queue *q, int tag)
+ EXPORT_SYMBOL(blk_queue_find_tag);
+
+ /**
+- * __blk_free_tags - release a given set of tag maintenance info
++ * blk_free_tags - release a given set of tag maintenance info
+ * @bqt: the tag map to free
+ *
+- * Tries to free the specified @bqt. Returns true if it was
+- * actually freed and false if there are still references using it
++ * Drop the reference count on @bqt and frees it when the last reference
++ * is dropped.
+ */
+-static int __blk_free_tags(struct blk_queue_tag *bqt)
++void blk_free_tags(struct blk_queue_tag *bqt)
+ {
+- int retval;
+-
+- retval = atomic_dec_and_test(&bqt->refcnt);
+- if (retval) {
++ if (atomic_dec_and_test(&bqt->refcnt)) {
+ BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
+ bqt->max_depth);
+
+@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_queue_tag *bqt)
+
+ kfree(bqt);
+ }
+-
+- return retval;
+ }
++EXPORT_SYMBOL(blk_free_tags);
+
+ /**
+ * __blk_queue_free_tags - release tag maintenance info
+@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct request_queue *q)
+ if (!bqt)
+ return;
+
+- __blk_free_tags(bqt);
++ blk_free_tags(bqt);
+
+ q->queue_tags = NULL;
+ queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
+ }
+
+ /**
+- * blk_free_tags - release a given set of tag maintenance info
+- * @bqt: the tag map to free
+- *
+- * For externally managed @bqt frees the map. Callers of this
+- * function must guarantee to have released all the queues that
+- * might have been using this tag map.
+- */
+-void blk_free_tags(struct blk_queue_tag *bqt)
+-{
+- if (unlikely(!__blk_free_tags(bqt)))
+- BUG();
+-}
+-EXPORT_SYMBOL(blk_free_tags);
+-
+-/**
+ * blk_queue_free_tags - release tag maintenance info
+ * @q: the request queue for the device
+ *
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 0e87baf8fcc2..0a450eb517e0 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -446,6 +446,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+
+ /* Promise */
+ { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
++ { PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */
+
+ /* Asmedia */
+ { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6e67fdebdada..6b922365d5e9 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4693,6 +4693,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ * ata_qc_new - Request an available ATA command, for queueing
+ * @ap: target port
+ *
++ * Some ATA host controllers may implement a queue depth which is less
++ * than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
++ * the hardware limitation.
++ *
+ * LOCKING:
+ * None.
+ */
+@@ -4700,14 +4704,15 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ struct ata_queued_cmd *qc = NULL;
++ unsigned int max_queue = ap->host->n_tags;
+ unsigned int i, tag;
+
+ /* no command while frozen */
+ if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
+ return NULL;
+
+- for (i = 0; i < ATA_MAX_QUEUE; i++) {
+- tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
++ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
++ tag = tag < max_queue ? tag : 0;
+
+ /* the last tag is reserved for internal command. */
+ if (tag == ATA_TAG_INTERNAL)
+@@ -5959,6 +5964,7 @@ void ata_host_init(struct ata_host *host, struct device *dev,
+ {
+ spin_lock_init(&host->lock);
+ mutex_init(&host->eh_mutex);
++ host->n_tags = ATA_MAX_QUEUE - 1;
+ host->dev = dev;
+ host->flags = flags;
+ host->ops = ops;
+@@ -6041,6 +6047,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
+ {
+ int i, rc;
+
++ host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1);
++
+ /* host must have been started */
+ if (!(host->flags & ATA_HOST_STARTED)) {
+ dev_err(host->dev, "BUG: trying to register unstarted host\n");
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index f04c0961f993..e5206fc76562 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -331,7 +331,7 @@ static int build_snap_context(struct ceph_snap_realm *realm)
+
+ /* alloc new snap context */
+ err = -ENOMEM;
+- if (num > (ULONG_MAX - sizeof(*snapc)) / sizeof(u64))
++ if (num > (SIZE_MAX - sizeof(*snapc)) / sizeof(u64))
+ goto fail;
+ snapc = kzalloc(sizeof(*snapc) + num*sizeof(u64), GFP_NOFS);
+ if (!snapc)
+diff --git a/include/drm/drm_mem_util.h b/include/drm/drm_mem_util.h
+index 6bd325fedc87..19a240446fca 100644
+--- a/include/drm/drm_mem_util.h
++++ b/include/drm/drm_mem_util.h
+@@ -31,7 +31,7 @@
+
+ static __inline__ void *drm_calloc_large(size_t nmemb, size_t size)
+ {
+- if (size != 0 && nmemb > ULONG_MAX / size)
++ if (size != 0 && nmemb > SIZE_MAX / size)
+ return NULL;
+
+ if (size * nmemb <= PAGE_SIZE)
+@@ -44,7 +44,7 @@ static __inline__ void *drm_calloc_large(size_t nmemb, size_t size)
+ /* Modeled after cairo's malloc_ab, it's like calloc but without the zeroing. */
+ static __inline__ void *drm_malloc_ab(size_t nmemb, size_t size)
+ {
+- if (size != 0 && nmemb > ULONG_MAX / size)
++ if (size != 0 && nmemb > SIZE_MAX / size)
+ return NULL;
+
+ if (size * nmemb <= PAGE_SIZE)
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 645231c373c8..b795ee5cd208 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -35,6 +35,7 @@
+ #define LLONG_MAX ((long long)(~0ULL>>1))
+ #define LLONG_MIN (-LLONG_MAX - 1)
+ #define ULLONG_MAX (~0ULL)
++#define SIZE_MAX (~(size_t)0)
+
+ #define STACK_MAGIC 0xdeadbeef
+
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 50d7cb1ee947..dd16deb27dd8 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -539,6 +539,7 @@ struct ata_host {
+ struct device *dev;
+ void __iomem * const *iomap;
+ unsigned int n_ports;
++ unsigned int n_tags; /* nr of NCQ tags */
+ void *private_data;
+ struct ata_port_operations *ops;
+ unsigned long flags;
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index a595dce6b0c7..67d5d94b783a 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -242,7 +242,7 @@ size_t ksize(const void *);
+ */
+ static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
+ {
+- if (size != 0 && n > ULONG_MAX / size)
++ if (size != 0 && n > SIZE_MAX / size)
+ return NULL;
+ return __kmalloc(n * size, flags);
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 0d4e0ad97a04..efd682099a0a 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2348,6 +2348,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ } else {
+ if (cow)
+ huge_ptep_set_wrprotect(src, addr, src_pte);
++ entry = huge_ptep_get(src_pte);
+ ptepage = pte_page(entry);
+ get_page(ptepage);
+ page_dup_rmap(ptepage);
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 45eb6217bf38..ad6ee88a3d48 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -750,7 +750,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp)
+ }
+
+ spin_lock_irqsave(&object->lock, flags);
+- if (ptr + size > object->pointer + object->size) {
++ if (size == SIZE_MAX) {
++ size = object->pointer + object->size - ptr;
++ } else if (ptr + size > object->pointer + object->size) {
+ kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr);
+ dump_object_info(object);
+ kmem_cache_free(scan_area_cache, area);
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 1196c7728ede..ad9d90064a4b 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -349,6 +349,12 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
+ if (unlikely(!va))
+ return ERR_PTR(-ENOMEM);
+
++ /*
++ * Only scan the relevant parts containing pointers to other objects
++ * to avoid false negatives.
++ */
++ kmemleak_scan_area(&va->rb_node, SIZE_MAX, gfp_mask & GFP_RECLAIM_MASK);
++
+ retry:
+ spin_lock(&vmap_area_lock);
+ /*
+@@ -1669,11 +1675,11 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
+ insert_vmalloc_vmlist(area);
+
+ /*
+- * A ref_count = 3 is needed because the vm_struct and vmap_area
+- * structures allocated in the __get_vm_area_node() function contain
+- * references to the virtual address of the vmalloc'ed block.
++ * A ref_count = 2 is needed because vm_struct allocated in
++ * __get_vm_area_node() contains a reference to the virtual address of
++ * the vmalloc'ed block.
+ */
+- kmemleak_alloc(addr, real_size, 3, gfp_mask);
++ kmemleak_alloc(addr, real_size, 2, gfp_mask);
+
+ return addr;
+
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
2014-08-02 14:43 Mike Pagano
@ 2014-08-19 11:41 ` Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-08-19 11:41 UTC (permalink / raw
To: gentoo-commits
commit: 6170daa192bd78ce9c1c618fdcf4acb5e0bb0c8c
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Aug 2 14:41:21 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Aug 2 14:41:21 2014 +0000
URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=6170daa1
Linux patch 3.4.101
---
0000_README | 4 +
1100_linux-3.4.101.patch | 349 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 353 insertions(+)
diff --git a/0000_README b/0000_README
index af7f3f3..0f65113 100644
--- a/0000_README
+++ b/0000_README
@@ -439,6 +439,10 @@ Patch: 1099_linux-3.4.100.patch
From: http://www.kernel.org
Desc: Linux 3.4.100
+Patch: 1100_linux-3.4.101.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.101
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1100_linux-3.4.101.patch b/1100_linux-3.4.101.patch
new file mode 100644
index 0000000..54832f4
--- /dev/null
+++ b/1100_linux-3.4.101.patch
@@ -0,0 +1,349 @@
+diff --git a/Makefile b/Makefile
+index d6c64eb82525..a22bcb567348 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 100
++SUBLEVEL = 101
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+@@ -592,6 +592,8 @@ KBUILD_CFLAGS += -fomit-frame-pointer
+ endif
+ endif
+
++KBUILD_CFLAGS += $(call cc-option, -fno-var-tracking-assignments)
++
+ ifdef CONFIG_DEBUG_INFO
+ KBUILD_CFLAGS += -g
+ KBUILD_AFLAGS += -gdwarf-2
+diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
+index 02f300fbf070..e0a8707dd137 100644
+--- a/arch/s390/kernel/ptrace.c
++++ b/arch/s390/kernel/ptrace.c
+@@ -292,7 +292,9 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
+ * psw and gprs are stored on the stack
+ */
+ if (addr == (addr_t) &dummy->regs.psw.mask &&
+- ((data & ~PSW_MASK_USER) != psw_user_bits ||
++ (((data^psw_user_bits) & ~PSW_MASK_USER) ||
++ (((data^psw_user_bits) & PSW_MASK_ASC) &&
++ ((data|psw_user_bits) & PSW_MASK_ASC) == PSW_MASK_ASC) ||
+ ((data & PSW_MASK_EA) && !(data & PSW_MASK_BA))))
+ /* Invalid psw mask. */
+ return -EINVAL;
+@@ -595,7 +597,10 @@ static int __poke_user_compat(struct task_struct *child,
+ */
+ if (addr == (addr_t) &dummy32->regs.psw.mask) {
+ /* Build a 64 bit psw mask from 31 bit mask. */
+- if ((tmp & ~PSW32_MASK_USER) != psw32_user_bits)
++ if (((tmp^psw32_user_bits) & ~PSW32_MASK_USER) ||
++ (((tmp^psw32_user_bits) & PSW32_MASK_ASC) &&
++ ((tmp|psw32_user_bits) & PSW32_MASK_ASC)
++ == PSW32_MASK_ASC))
+ /* Invalid psw mask. */
+ return -EINVAL;
+ regs->psw.mask = (regs->psw.mask & ~PSW_MASK_USER) |
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index e1e7f9c831da..e36c5cf38fde 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -428,8 +428,8 @@ sysenter_do_call:
+ cmpl $(NR_syscalls), %eax
+ jae sysenter_badsys
+ call *sys_call_table(,%eax,4)
+- movl %eax,PT_EAX(%esp)
+ sysenter_after_call:
++ movl %eax,PT_EAX(%esp)
+ LOCKDEP_SYS_EXIT
+ DISABLE_INTERRUPTS(CLBR_ANY)
+ TRACE_IRQS_OFF
+@@ -510,6 +510,7 @@ ENTRY(system_call)
+ jae syscall_badsys
+ syscall_call:
+ call *sys_call_table(,%eax,4)
++syscall_after_call:
+ movl %eax,PT_EAX(%esp) # store the return value
+ syscall_exit:
+ LOCKDEP_SYS_EXIT
+@@ -678,12 +679,12 @@ syscall_fault:
+ END(syscall_fault)
+
+ syscall_badsys:
+- movl $-ENOSYS,PT_EAX(%esp)
+- jmp syscall_exit
++ movl $-ENOSYS,%eax
++ jmp syscall_after_call
+ END(syscall_badsys)
+
+ sysenter_badsys:
+- movl $-ENOSYS,PT_EAX(%esp)
++ movl $-ENOSYS,%eax
+ jmp sysenter_after_call
+ END(syscall_badsys)
+ CFI_ENDPROC
+diff --git a/block/blk-tag.c b/block/blk-tag.c
+index 4af6f5cc1167..f606487bba56 100644
+--- a/block/blk-tag.c
++++ b/block/blk-tag.c
+@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struct request_queue *q, int tag)
+ EXPORT_SYMBOL(blk_queue_find_tag);
+
+ /**
+- * __blk_free_tags - release a given set of tag maintenance info
++ * blk_free_tags - release a given set of tag maintenance info
+ * @bqt: the tag map to free
+ *
+- * Tries to free the specified @bqt. Returns true if it was
+- * actually freed and false if there are still references using it
++ * Drop the reference count on @bqt and frees it when the last reference
++ * is dropped.
+ */
+-static int __blk_free_tags(struct blk_queue_tag *bqt)
++void blk_free_tags(struct blk_queue_tag *bqt)
+ {
+- int retval;
+-
+- retval = atomic_dec_and_test(&bqt->refcnt);
+- if (retval) {
++ if (atomic_dec_and_test(&bqt->refcnt)) {
+ BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) <
+ bqt->max_depth);
+
+@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_queue_tag *bqt)
+
+ kfree(bqt);
+ }
+-
+- return retval;
+ }
++EXPORT_SYMBOL(blk_free_tags);
+
+ /**
+ * __blk_queue_free_tags - release tag maintenance info
+@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct request_queue *q)
+ if (!bqt)
+ return;
+
+- __blk_free_tags(bqt);
++ blk_free_tags(bqt);
+
+ q->queue_tags = NULL;
+ queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q);
+ }
+
+ /**
+- * blk_free_tags - release a given set of tag maintenance info
+- * @bqt: the tag map to free
+- *
+- * For externally managed @bqt frees the map. Callers of this
+- * function must guarantee to have released all the queues that
+- * might have been using this tag map.
+- */
+-void blk_free_tags(struct blk_queue_tag *bqt)
+-{
+- if (unlikely(!__blk_free_tags(bqt)))
+- BUG();
+-}
+-EXPORT_SYMBOL(blk_free_tags);
+-
+-/**
+ * blk_queue_free_tags - release tag maintenance info
+ * @q: the request queue for the device
+ *
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 0e87baf8fcc2..0a450eb517e0 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -446,6 +446,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+
+ /* Promise */
+ { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
++ { PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */
+
+ /* Asmedia */
+ { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 6e67fdebdada..6b922365d5e9 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4693,6 +4693,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ * ata_qc_new - Request an available ATA command, for queueing
+ * @ap: target port
+ *
++ * Some ATA host controllers may implement a queue depth which is less
++ * than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond
++ * the hardware limitation.
++ *
+ * LOCKING:
+ * None.
+ */
+@@ -4700,14 +4704,15 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ struct ata_queued_cmd *qc = NULL;
++ unsigned int max_queue = ap->host->n_tags;
+ unsigned int i, tag;
+
+ /* no command while frozen */
+ if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
+ return NULL;
+
+- for (i = 0; i < ATA_MAX_QUEUE; i++) {
+- tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
++ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) {
++ tag = tag < max_queue ? tag : 0;
+
+ /* the last tag is reserved for internal command. */
+ if (tag == ATA_TAG_INTERNAL)
+@@ -5959,6 +5964,7 @@ void ata_host_init(struct ata_host *host, struct device *dev,
+ {
+ spin_lock_init(&host->lock);
+ mutex_init(&host->eh_mutex);
++ host->n_tags = ATA_MAX_QUEUE - 1;
+ host->dev = dev;
+ host->flags = flags;
+ host->ops = ops;
+@@ -6041,6 +6047,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
+ {
+ int i, rc;
+
++ host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1);
++
+ /* host must have been started */
+ if (!(host->flags & ATA_HOST_STARTED)) {
+ dev_err(host->dev, "BUG: trying to register unstarted host\n");
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index f04c0961f993..e5206fc76562 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -331,7 +331,7 @@ static int build_snap_context(struct ceph_snap_realm *realm)
+
+ /* alloc new snap context */
+ err = -ENOMEM;
+- if (num > (ULONG_MAX - sizeof(*snapc)) / sizeof(u64))
++ if (num > (SIZE_MAX - sizeof(*snapc)) / sizeof(u64))
+ goto fail;
+ snapc = kzalloc(sizeof(*snapc) + num*sizeof(u64), GFP_NOFS);
+ if (!snapc)
+diff --git a/include/drm/drm_mem_util.h b/include/drm/drm_mem_util.h
+index 6bd325fedc87..19a240446fca 100644
+--- a/include/drm/drm_mem_util.h
++++ b/include/drm/drm_mem_util.h
+@@ -31,7 +31,7 @@
+
+ static __inline__ void *drm_calloc_large(size_t nmemb, size_t size)
+ {
+- if (size != 0 && nmemb > ULONG_MAX / size)
++ if (size != 0 && nmemb > SIZE_MAX / size)
+ return NULL;
+
+ if (size * nmemb <= PAGE_SIZE)
+@@ -44,7 +44,7 @@ static __inline__ void *drm_calloc_large(size_t nmemb, size_t size)
+ /* Modeled after cairo's malloc_ab, it's like calloc but without the zeroing. */
+ static __inline__ void *drm_malloc_ab(size_t nmemb, size_t size)
+ {
+- if (size != 0 && nmemb > ULONG_MAX / size)
++ if (size != 0 && nmemb > SIZE_MAX / size)
+ return NULL;
+
+ if (size * nmemb <= PAGE_SIZE)
+diff --git a/include/linux/kernel.h b/include/linux/kernel.h
+index 645231c373c8..b795ee5cd208 100644
+--- a/include/linux/kernel.h
++++ b/include/linux/kernel.h
+@@ -35,6 +35,7 @@
+ #define LLONG_MAX ((long long)(~0ULL>>1))
+ #define LLONG_MIN (-LLONG_MAX - 1)
+ #define ULLONG_MAX (~0ULL)
++#define SIZE_MAX (~(size_t)0)
+
+ #define STACK_MAGIC 0xdeadbeef
+
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 50d7cb1ee947..dd16deb27dd8 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -539,6 +539,7 @@ struct ata_host {
+ struct device *dev;
+ void __iomem * const *iomap;
+ unsigned int n_ports;
++ unsigned int n_tags; /* nr of NCQ tags */
+ void *private_data;
+ struct ata_port_operations *ops;
+ unsigned long flags;
+diff --git a/include/linux/slab.h b/include/linux/slab.h
+index a595dce6b0c7..67d5d94b783a 100644
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -242,7 +242,7 @@ size_t ksize(const void *);
+ */
+ static inline void *kmalloc_array(size_t n, size_t size, gfp_t flags)
+ {
+- if (size != 0 && n > ULONG_MAX / size)
++ if (size != 0 && n > SIZE_MAX / size)
+ return NULL;
+ return __kmalloc(n * size, flags);
+ }
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 0d4e0ad97a04..efd682099a0a 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2348,6 +2348,7 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ } else {
+ if (cow)
+ huge_ptep_set_wrprotect(src, addr, src_pte);
++ entry = huge_ptep_get(src_pte);
+ ptepage = pte_page(entry);
+ get_page(ptepage);
+ page_dup_rmap(ptepage);
+diff --git a/mm/kmemleak.c b/mm/kmemleak.c
+index 45eb6217bf38..ad6ee88a3d48 100644
+--- a/mm/kmemleak.c
++++ b/mm/kmemleak.c
+@@ -750,7 +750,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp)
+ }
+
+ spin_lock_irqsave(&object->lock, flags);
+- if (ptr + size > object->pointer + object->size) {
++ if (size == SIZE_MAX) {
++ size = object->pointer + object->size - ptr;
++ } else if (ptr + size > object->pointer + object->size) {
+ kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr);
+ dump_object_info(object);
+ kmem_cache_free(scan_area_cache, area);
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 1196c7728ede..ad9d90064a4b 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -349,6 +349,12 @@ static struct vmap_area *alloc_vmap_area(unsigned long size,
+ if (unlikely(!va))
+ return ERR_PTR(-ENOMEM);
+
++ /*
++ * Only scan the relevant parts containing pointers to other objects
++ * to avoid false negatives.
++ */
++ kmemleak_scan_area(&va->rb_node, SIZE_MAX, gfp_mask & GFP_RECLAIM_MASK);
++
+ retry:
+ spin_lock(&vmap_area_lock);
+ /*
+@@ -1669,11 +1675,11 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
+ insert_vmalloc_vmlist(area);
+
+ /*
+- * A ref_count = 3 is needed because the vm_struct and vmap_area
+- * structures allocated in the __get_vm_area_node() function contain
+- * references to the virtual address of the vmalloc'ed block.
++ * A ref_count = 2 is needed because vm_struct allocated in
++ * __get_vm_area_node() contains a reference to the virtual address of
++ * the vmalloc'ed block.
+ */
+- kmemleak_alloc(addr, real_size, 3, gfp_mask);
++ kmemleak_alloc(addr, real_size, 2, gfp_mask);
+
+ return addr;
+
^ permalink raw reply related [flat|nested] 25+ messages in thread
* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-07-18 11:35 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-07-18 11:35 UTC (permalink / raw
To: gentoo-commits
commit: a8a5bb77ad98f84e3bc415ffcb4953058ca6c37d
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jul 18 11:33:46 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jul 18 11:33:46 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=a8a5bb77
Linux patch 3.4.99
---
0000_README | 4 +
1098_linux-3.4.99.patch | 797 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 801 insertions(+)
diff --git a/0000_README b/0000_README
index 3c72076..d5d9d81 100644
--- a/0000_README
+++ b/0000_README
@@ -431,6 +431,10 @@ Patch: 1097_linux-3.4.98.patch
From: http://www.kernel.org
Desc: Linux 3.4.98
+Patch: 1098_linux-3.4.99.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.99
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1098_linux-3.4.99.patch b/1098_linux-3.4.99.patch
new file mode 100644
index 0000000..8bde200
--- /dev/null
+++ b/1098_linux-3.4.99.patch
@@ -0,0 +1,797 @@
+diff --git a/Makefile b/Makefile
+index d277446ee8ee..ed97caf40f71 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 98
++SUBLEVEL = 99
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index 02aee03e713c..1eef567f177a 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -472,7 +472,22 @@ static void power_pmu_read(struct perf_event *event)
+ } while (local64_cmpxchg(&event->hw.prev_count, prev, val) != prev);
+
+ local64_add(delta, &event->count);
+- local64_sub(delta, &event->hw.period_left);
++
++ /*
++ * A number of places program the PMC with (0x80000000 - period_left).
++ * We never want period_left to be less than 1 because we will program
++ * the PMC with a value >= 0x800000000 and an edge detected PMC will
++ * roll around to 0 before taking an exception. We have seen this
++ * on POWER8.
++ *
++ * To fix this, clamp the minimum value of period_left to 1.
++ */
++ do {
++ prev = local64_read(&event->hw.period_left);
++ val = prev - delta;
++ if (val < 1)
++ val = 1;
++ } while (local64_cmpxchg(&event->hw.period_left, prev, val) != prev);
+ }
+
+ /*
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index be1ef574ce9a..dec49d34c048 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -50,6 +50,21 @@ int ioremap_change_attr(unsigned long vaddr, unsigned long size,
+ return err;
+ }
+
++static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages,
++ void *arg)
++{
++ unsigned long i;
++
++ for (i = 0; i < nr_pages; ++i)
++ if (pfn_valid(start_pfn + i) &&
++ !PageReserved(pfn_to_page(start_pfn + i)))
++ return 1;
++
++ WARN_ONCE(1, "ioremap on RAM pfn 0x%lx\n", start_pfn);
++
++ return 0;
++}
++
+ /*
+ * Remap an arbitrary physical address space into the kernel virtual
+ * address space. Needed when the kernel wants to access high addresses
+@@ -93,14 +108,11 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
+ /*
+ * Don't allow anybody to remap normal RAM that we're using..
+ */
++ pfn = phys_addr >> PAGE_SHIFT;
+ last_pfn = last_addr >> PAGE_SHIFT;
+- for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
+- int is_ram = page_is_ram(pfn);
+-
+- if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
+- return NULL;
+- WARN_ON_ONCE(is_ram);
+- }
++ if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL,
++ __ioremap_check_ram) == 1)
++ return NULL;
+
+ /*
+ * Mappings have to be page-aligned
+diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
+index 9bdfcf50a190..93f3034ea85d 100644
+--- a/drivers/acpi/battery.c
++++ b/drivers/acpi/battery.c
+@@ -34,6 +34,7 @@
+ #include <linux/dmi.h>
+ #include <linux/slab.h>
+ #include <linux/suspend.h>
++#include <linux/delay.h>
+ #include <asm/unaligned.h>
+
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+@@ -1055,6 +1056,28 @@ static int battery_notify(struct notifier_block *nb,
+ return 0;
+ }
+
++/*
++ * Some machines'(E,G Lenovo Z480) ECs are not stable
++ * during boot up and this causes battery driver fails to be
++ * probed due to failure of getting battery information
++ * from EC sometimes. After several retries, the operation
++ * may work. So add retry code here and 20ms sleep between
++ * every retries.
++ */
++static int acpi_battery_update_retry(struct acpi_battery *battery)
++{
++ int retry, ret;
++
++ for (retry = 5; retry; retry--) {
++ ret = acpi_battery_update(battery);
++ if (!ret)
++ break;
++
++ msleep(20);
++ }
++ return ret;
++}
++
+ static int acpi_battery_add(struct acpi_device *device)
+ {
+ int result = 0;
+@@ -1074,9 +1097,11 @@ static int acpi_battery_add(struct acpi_device *device)
+ if (ACPI_SUCCESS(acpi_get_handle(battery->device->handle,
+ "_BIX", &handle)))
+ set_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags);
+- result = acpi_battery_update(battery);
++
++ result = acpi_battery_update_retry(battery);
+ if (result)
+ goto fail;
++
+ #ifdef CONFIG_ACPI_PROCFS_POWER
+ result = acpi_battery_add_fs(device);
+ #endif
+diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
+index 52480010156d..739eb0d0d12d 100644
+--- a/drivers/gpu/drm/radeon/rs600.c
++++ b/drivers/gpu/drm/radeon/rs600.c
+@@ -539,8 +539,10 @@ int rs600_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
+ return -EINVAL;
+ }
+ addr = addr & 0xFFFFFFFFFFFFF000ULL;
+- addr |= R600_PTE_VALID | R600_PTE_SYSTEM | R600_PTE_SNOOPED;
+- addr |= R600_PTE_READABLE | R600_PTE_WRITEABLE;
++ if (addr != rdev->dummy_page.addr)
++ addr |= R600_PTE_VALID | R600_PTE_READABLE |
++ R600_PTE_WRITEABLE;
++ addr |= R600_PTE_SYSTEM | R600_PTE_SNOOPED;
+ writeq(addr, ptr + (i * 8));
+ return 0;
+ }
+diff --git a/drivers/hwmon/adm1029.c b/drivers/hwmon/adm1029.c
+index 80cc465d8ac7..f078baef90fe 100644
+--- a/drivers/hwmon/adm1029.c
++++ b/drivers/hwmon/adm1029.c
+@@ -231,6 +231,9 @@ static ssize_t set_fan_div(struct device *dev,
+ /* Update the value */
+ reg = (reg & 0x3F) | (val << 6);
+
++ /* Update the cache */
++ data->fan_div[attr->index] = reg;
++
+ /* Write value */
+ i2c_smbus_write_byte_data(client,
+ ADM1029_REG_FAN_DIV[attr->index], reg);
+diff --git a/drivers/hwmon/amc6821.c b/drivers/hwmon/amc6821.c
+index f600fa1f92e3..1d2bace45287 100644
+--- a/drivers/hwmon/amc6821.c
++++ b/drivers/hwmon/amc6821.c
+@@ -715,7 +715,7 @@ static SENSOR_DEVICE_ATTR(temp1_max_alarm, S_IRUGO,
+ get_temp_alarm, NULL, IDX_TEMP1_MAX);
+ static SENSOR_DEVICE_ATTR(temp1_crit_alarm, S_IRUGO,
+ get_temp_alarm, NULL, IDX_TEMP1_CRIT);
+-static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO,
+ get_temp, NULL, IDX_TEMP2_INPUT);
+ static SENSOR_DEVICE_ATTR(temp2_min, S_IRUGO | S_IWUSR, get_temp,
+ set_temp, IDX_TEMP2_MIN);
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 3bd9bd49ed9a..ac339570a805 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -159,6 +159,7 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
++ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+ { USB_DEVICE(0x1BE3, 0x07A6) }, /* WAGO 750-923 USB Service Cable */
+ { USB_DEVICE(0x1E29, 0x0102) }, /* Festo CPX-USB */
+ { USB_DEVICE(0x1E29, 0x0501) }, /* Festo CMSP */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index ed1650fb910d..89b5664aa53b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -731,7 +731,8 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_ACG_HFDUAL_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_YEI_SERVOCENTER31_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_THORLABS_PID) },
+- { USB_DEVICE(TESTO_VID, TESTO_USB_INTERFACE_PID) },
++ { USB_DEVICE(TESTO_VID, TESTO_1_PID) },
++ { USB_DEVICE(TESTO_VID, TESTO_3_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_GAMMA_SCOUT_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13M_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_TACTRIX_OPENPORT_13S_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 500474c48f4b..106cc16cc6ed 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -798,7 +798,8 @@
+ * Submitted by Colin Leroy
+ */
+ #define TESTO_VID 0x128D
+-#define TESTO_USB_INTERFACE_PID 0x0001
++#define TESTO_1_PID 0x0001
++#define TESTO_3_PID 0x0003
+
+ /*
+ * Mobility Electronics products.
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 58fcaa5ae548..e1e05bad2be0 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1501,6 +1501,8 @@ static const struct usb_device_id option_ids[] = {
+ .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */
+ .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1428, 0xff, 0xff, 0xff), /* Telewell TW-LTE 4G v2 */
++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index 0b0c03c878e5..f0e4e46867f7 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2589,10 +2589,11 @@ static void print_daily_error_info(unsigned long arg)
+ es = sbi->s_es;
+
+ if (es->s_error_count)
+- ext4_msg(sb, KERN_NOTICE, "error count: %u",
++ /* fsck newer than v1.41.13 is needed to clean this condition. */
++ ext4_msg(sb, KERN_NOTICE, "error count since last fsck: %u",
+ le32_to_cpu(es->s_error_count));
+ if (es->s_first_error_time) {
+- printk(KERN_NOTICE "EXT4-fs (%s): initial error at %u: %.*s:%d",
++ printk(KERN_NOTICE "EXT4-fs (%s): initial error at time %u: %.*s:%d",
+ sb->s_id, le32_to_cpu(es->s_first_error_time),
+ (int) sizeof(es->s_first_error_func),
+ es->s_first_error_func,
+@@ -2606,7 +2607,7 @@ static void print_daily_error_info(unsigned long arg)
+ printk("\n");
+ }
+ if (es->s_last_error_time) {
+- printk(KERN_NOTICE "EXT4-fs (%s): last error at %u: %.*s:%d",
++ printk(KERN_NOTICE "EXT4-fs (%s): last error at time %u: %.*s:%d",
+ sb->s_id, le32_to_cpu(es->s_last_error_time),
+ (int) sizeof(es->s_last_error_func),
+ es->s_last_error_func,
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index 4b843ace285c..9cb82b9aeb73 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -1152,7 +1152,13 @@ done:
+
+ int current_cpuset_is_being_rebound(void)
+ {
+- return task_cs(current) == cpuset_being_rebound;
++ int ret;
++
++ rcu_read_lock();
++ ret = task_cs(current) == cpuset_being_rebound;
++ rcu_read_unlock();
++
++ return ret;
+ }
+
+ static int update_relax_domain_level(struct cpuset *cs, s64 val)
+diff --git a/kernel/rtmutex-debug.h b/kernel/rtmutex-debug.h
+index 14193d596d78..ab29b6a22669 100644
+--- a/kernel/rtmutex-debug.h
++++ b/kernel/rtmutex-debug.h
+@@ -31,3 +31,8 @@ static inline int debug_rt_mutex_detect_deadlock(struct rt_mutex_waiter *waiter,
+ {
+ return (waiter != NULL);
+ }
++
++static inline void rt_mutex_print_deadlock(struct rt_mutex_waiter *w)
++{
++ debug_rt_mutex_print_deadlock(w);
++}
+diff --git a/kernel/rtmutex.c b/kernel/rtmutex.c
+index a242e691c993..375ae48479fa 100644
+--- a/kernel/rtmutex.c
++++ b/kernel/rtmutex.c
+@@ -81,6 +81,47 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
+ owner = *p;
+ } while (cmpxchg(p, owner, owner | RT_MUTEX_HAS_WAITERS) != owner);
+ }
++
++/*
++ * Safe fastpath aware unlock:
++ * 1) Clear the waiters bit
++ * 2) Drop lock->wait_lock
++ * 3) Try to unlock the lock with cmpxchg
++ */
++static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock)
++ __releases(lock->wait_lock)
++{
++ struct task_struct *owner = rt_mutex_owner(lock);
++
++ clear_rt_mutex_waiters(lock);
++ raw_spin_unlock(&lock->wait_lock);
++ /*
++ * If a new waiter comes in between the unlock and the cmpxchg
++ * we have two situations:
++ *
++ * unlock(wait_lock);
++ * lock(wait_lock);
++ * cmpxchg(p, owner, 0) == owner
++ * mark_rt_mutex_waiters(lock);
++ * acquire(lock);
++ * or:
++ *
++ * unlock(wait_lock);
++ * lock(wait_lock);
++ * mark_rt_mutex_waiters(lock);
++ *
++ * cmpxchg(p, owner, 0) != owner
++ * enqueue_waiter();
++ * unlock(wait_lock);
++ * lock(wait_lock);
++ * wake waiter();
++ * unlock(wait_lock);
++ * lock(wait_lock);
++ * acquire(lock);
++ */
++ return rt_mutex_cmpxchg(lock, owner, NULL);
++}
++
+ #else
+ # define rt_mutex_cmpxchg(l,c,n) (0)
+ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
+@@ -88,6 +129,17 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
+ lock->owner = (struct task_struct *)
+ ((unsigned long)lock->owner | RT_MUTEX_HAS_WAITERS);
+ }
++
++/*
++ * Simple slow path only version: lock->owner is protected by lock->wait_lock.
++ */
++static inline bool unlock_rt_mutex_safe(struct rt_mutex *lock)
++ __releases(lock->wait_lock)
++{
++ lock->owner = NULL;
++ raw_spin_unlock(&lock->wait_lock);
++ return true;
++}
+ #endif
+
+ /*
+@@ -141,6 +193,11 @@ static void rt_mutex_adjust_prio(struct task_struct *task)
+ */
+ int max_lock_depth = 1024;
+
++static inline struct rt_mutex *task_blocked_on_lock(struct task_struct *p)
++{
++ return p->pi_blocked_on ? p->pi_blocked_on->lock : NULL;
++}
++
+ /*
+ * Adjust the priority chain. Also used for deadlock detection.
+ * Decreases task's usage by one - may thus free the task.
+@@ -149,6 +206,7 @@ int max_lock_depth = 1024;
+ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ int deadlock_detect,
+ struct rt_mutex *orig_lock,
++ struct rt_mutex *next_lock,
+ struct rt_mutex_waiter *orig_waiter,
+ struct task_struct *top_task)
+ {
+@@ -182,7 +240,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ }
+ put_task_struct(task);
+
+- return deadlock_detect ? -EDEADLK : 0;
++ return -EDEADLK;
+ }
+ retry:
+ /*
+@@ -207,13 +265,32 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ goto out_unlock_pi;
+
+ /*
++ * We dropped all locks after taking a refcount on @task, so
++ * the task might have moved on in the lock chain or even left
++ * the chain completely and blocks now on an unrelated lock or
++ * on @orig_lock.
++ *
++ * We stored the lock on which @task was blocked in @next_lock,
++ * so we can detect the chain change.
++ */
++ if (next_lock != waiter->lock)
++ goto out_unlock_pi;
++
++ /*
+ * Drop out, when the task has no waiters. Note,
+ * top_waiter can be NULL, when we are in the deboosting
+ * mode!
+ */
+- if (top_waiter && (!task_has_pi_waiters(task) ||
+- top_waiter != task_top_pi_waiter(task)))
+- goto out_unlock_pi;
++ if (top_waiter) {
++ if (!task_has_pi_waiters(task))
++ goto out_unlock_pi;
++ /*
++ * If deadlock detection is off, we stop here if we
++ * are not the top pi waiter of the task.
++ */
++ if (!detect_deadlock && top_waiter != task_top_pi_waiter(task))
++ goto out_unlock_pi;
++ }
+
+ /*
+ * When deadlock detection is off then we check, if further
+@@ -229,11 +306,16 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ goto retry;
+ }
+
+- /* Deadlock detection */
++ /*
++ * Deadlock detection. If the lock is the same as the original
++ * lock which caused us to walk the lock chain or if the
++ * current lock is owned by the task which initiated the chain
++ * walk, we detected a deadlock.
++ */
+ if (lock == orig_lock || rt_mutex_owner(lock) == top_task) {
+ debug_rt_mutex_deadlock(deadlock_detect, orig_waiter, lock);
+ raw_spin_unlock(&lock->wait_lock);
+- ret = deadlock_detect ? -EDEADLK : 0;
++ ret = -EDEADLK;
+ goto out_unlock_pi;
+ }
+
+@@ -280,11 +362,26 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
+ __rt_mutex_adjust_prio(task);
+ }
+
++ /*
++ * Check whether the task which owns the current lock is pi
++ * blocked itself. If yes we store a pointer to the lock for
++ * the lock chain change detection above. After we dropped
++ * task->pi_lock next_lock cannot be dereferenced anymore.
++ */
++ next_lock = task_blocked_on_lock(task);
++
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+
+ top_waiter = rt_mutex_top_waiter(lock);
+ raw_spin_unlock(&lock->wait_lock);
+
++ /*
++ * We reached the end of the lock chain. Stop right here. No
++ * point to go back just to figure that out.
++ */
++ if (!next_lock)
++ goto out_put_task;
++
+ if (!detect_deadlock && waiter != top_waiter)
+ goto out_put_task;
+
+@@ -395,8 +492,21 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ {
+ struct task_struct *owner = rt_mutex_owner(lock);
+ struct rt_mutex_waiter *top_waiter = waiter;
+- unsigned long flags;
++ struct rt_mutex *next_lock;
+ int chain_walk = 0, res;
++ unsigned long flags;
++
++ /*
++ * Early deadlock detection. We really don't want the task to
++ * enqueue on itself just to untangle the mess later. It's not
++ * only an optimization. We drop the locks, so another waiter
++ * can come in before the chain walk detects the deadlock. So
++ * the other will detect the deadlock and return -EDEADLOCK,
++ * which is wrong, as the other waiter is not in a deadlock
++ * situation.
++ */
++ if (owner == task)
++ return -EDEADLK;
+
+ raw_spin_lock_irqsave(&task->pi_lock, flags);
+ __rt_mutex_adjust_prio(task);
+@@ -417,20 +527,28 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ if (!owner)
+ return 0;
+
++ raw_spin_lock_irqsave(&owner->pi_lock, flags);
+ if (waiter == rt_mutex_top_waiter(lock)) {
+- raw_spin_lock_irqsave(&owner->pi_lock, flags);
+ plist_del(&top_waiter->pi_list_entry, &owner->pi_waiters);
+ plist_add(&waiter->pi_list_entry, &owner->pi_waiters);
+
+ __rt_mutex_adjust_prio(owner);
+ if (owner->pi_blocked_on)
+ chain_walk = 1;
+- raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+- }
+- else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock))
++ } else if (debug_rt_mutex_detect_deadlock(waiter, detect_deadlock)) {
+ chain_walk = 1;
++ }
++
++ /* Store the lock on which owner is blocked or NULL */
++ next_lock = task_blocked_on_lock(owner);
+
+- if (!chain_walk)
++ raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
++ /*
++ * Even if full deadlock detection is on, if the owner is not
++ * blocked itself, we can avoid finding this out in the chain
++ * walk.
++ */
++ if (!chain_walk || !next_lock)
+ return 0;
+
+ /*
+@@ -442,8 +560,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+
+ raw_spin_unlock(&lock->wait_lock);
+
+- res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock, waiter,
+- task);
++ res = rt_mutex_adjust_prio_chain(owner, detect_deadlock, lock,
++ next_lock, waiter, task);
+
+ raw_spin_lock(&lock->wait_lock);
+
+@@ -453,7 +571,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
+ /*
+ * Wake up the next waiter on the lock.
+ *
+- * Remove the top waiter from the current tasks waiter list and wake it up.
++ * Remove the top waiter from the current tasks pi waiter list and
++ * wake it up.
+ *
+ * Called with lock->wait_lock held.
+ */
+@@ -474,10 +593,23 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
+ */
+ plist_del(&waiter->pi_list_entry, ¤t->pi_waiters);
+
+- rt_mutex_set_owner(lock, NULL);
++ /*
++ * As we are waking up the top waiter, and the waiter stays
++ * queued on the lock until it gets the lock, this lock
++ * obviously has waiters. Just set the bit here and this has
++ * the added benefit of forcing all new tasks into the
++ * slow path making sure no task of lower priority than
++ * the top waiter can steal this lock.
++ */
++ lock->owner = (void *) RT_MUTEX_HAS_WAITERS;
+
+ raw_spin_unlock_irqrestore(¤t->pi_lock, flags);
+
++ /*
++ * It's safe to dereference waiter as it cannot go away as
++ * long as we hold lock->wait_lock. The waiter task needs to
++ * acquire it in order to dequeue the waiter.
++ */
+ wake_up_process(waiter->task);
+ }
+
+@@ -492,8 +624,8 @@ static void remove_waiter(struct rt_mutex *lock,
+ {
+ int first = (waiter == rt_mutex_top_waiter(lock));
+ struct task_struct *owner = rt_mutex_owner(lock);
++ struct rt_mutex *next_lock = NULL;
+ unsigned long flags;
+- int chain_walk = 0;
+
+ raw_spin_lock_irqsave(¤t->pi_lock, flags);
+ plist_del(&waiter->list_entry, &lock->wait_list);
+@@ -517,15 +649,15 @@ static void remove_waiter(struct rt_mutex *lock,
+ }
+ __rt_mutex_adjust_prio(owner);
+
+- if (owner->pi_blocked_on)
+- chain_walk = 1;
++ /* Store the lock on which owner is blocked or NULL */
++ next_lock = task_blocked_on_lock(owner);
+
+ raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
+ }
+
+ WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
+
+- if (!chain_walk)
++ if (!next_lock)
+ return;
+
+ /* gets dropped in rt_mutex_adjust_prio_chain()! */
+@@ -533,7 +665,7 @@ static void remove_waiter(struct rt_mutex *lock,
+
+ raw_spin_unlock(&lock->wait_lock);
+
+- rt_mutex_adjust_prio_chain(owner, 0, lock, NULL, current);
++ rt_mutex_adjust_prio_chain(owner, 0, lock, next_lock, NULL, current);
+
+ raw_spin_lock(&lock->wait_lock);
+ }
+@@ -546,6 +678,7 @@ static void remove_waiter(struct rt_mutex *lock,
+ void rt_mutex_adjust_pi(struct task_struct *task)
+ {
+ struct rt_mutex_waiter *waiter;
++ struct rt_mutex *next_lock;
+ unsigned long flags;
+
+ raw_spin_lock_irqsave(&task->pi_lock, flags);
+@@ -555,12 +688,13 @@ void rt_mutex_adjust_pi(struct task_struct *task)
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+ return;
+ }
+-
++ next_lock = waiter->lock;
+ raw_spin_unlock_irqrestore(&task->pi_lock, flags);
+
+ /* gets dropped in rt_mutex_adjust_prio_chain()! */
+ get_task_struct(task);
+- rt_mutex_adjust_prio_chain(task, 0, NULL, NULL, task);
++
++ rt_mutex_adjust_prio_chain(task, 0, NULL, next_lock, NULL, task);
+ }
+
+ /**
+@@ -612,6 +746,26 @@ __rt_mutex_slowlock(struct rt_mutex *lock, int state,
+ return ret;
+ }
+
++static void rt_mutex_handle_deadlock(int res, int detect_deadlock,
++ struct rt_mutex_waiter *w)
++{
++ /*
++ * If the result is not -EDEADLOCK or the caller requested
++ * deadlock detection, nothing to do here.
++ */
++ if (res != -EDEADLOCK || detect_deadlock)
++ return;
++
++ /*
++ * Yell lowdly and stop the task right here.
++ */
++ rt_mutex_print_deadlock(w);
++ while (1) {
++ set_current_state(TASK_INTERRUPTIBLE);
++ schedule();
++ }
++}
++
+ /*
+ * Slow path lock function:
+ */
+@@ -649,8 +803,10 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
+
+ set_current_state(TASK_RUNNING);
+
+- if (unlikely(ret))
++ if (unlikely(ret)) {
+ remove_waiter(lock, &waiter);
++ rt_mutex_handle_deadlock(ret, detect_deadlock, &waiter);
++ }
+
+ /*
+ * try_to_take_rt_mutex() sets the waiter bit
+@@ -706,12 +862,49 @@ rt_mutex_slowunlock(struct rt_mutex *lock)
+
+ rt_mutex_deadlock_account_unlock(current);
+
+- if (!rt_mutex_has_waiters(lock)) {
+- lock->owner = NULL;
+- raw_spin_unlock(&lock->wait_lock);
+- return;
++ /*
++ * We must be careful here if the fast path is enabled. If we
++ * have no waiters queued we cannot set owner to NULL here
++ * because of:
++ *
++ * foo->lock->owner = NULL;
++ * rtmutex_lock(foo->lock); <- fast path
++ * free = atomic_dec_and_test(foo->refcnt);
++ * rtmutex_unlock(foo->lock); <- fast path
++ * if (free)
++ * kfree(foo);
++ * raw_spin_unlock(foo->lock->wait_lock);
++ *
++ * So for the fastpath enabled kernel:
++ *
++ * Nothing can set the waiters bit as long as we hold
++ * lock->wait_lock. So we do the following sequence:
++ *
++ * owner = rt_mutex_owner(lock);
++ * clear_rt_mutex_waiters(lock);
++ * raw_spin_unlock(&lock->wait_lock);
++ * if (cmpxchg(&lock->owner, owner, 0) == owner)
++ * return;
++ * goto retry;
++ *
++ * The fastpath disabled variant is simple as all access to
++ * lock->owner is serialized by lock->wait_lock:
++ *
++ * lock->owner = NULL;
++ * raw_spin_unlock(&lock->wait_lock);
++ */
++ while (!rt_mutex_has_waiters(lock)) {
++ /* Drops lock->wait_lock ! */
++ if (unlock_rt_mutex_safe(lock) == true)
++ return;
++ /* Relock the rtmutex and try again */
++ raw_spin_lock(&lock->wait_lock);
+ }
+
++ /*
++ * The wakeup next waiter path does not suffer from the above
++ * race. See the comments there.
++ */
+ wakeup_next_waiter(lock);
+
+ raw_spin_unlock(&lock->wait_lock);
+@@ -958,7 +1151,8 @@ int rt_mutex_start_proxy_lock(struct rt_mutex *lock,
+ return 1;
+ }
+
+- ret = task_blocks_on_rt_mutex(lock, waiter, task, detect_deadlock);
++ /* We enforce deadlock detection for futexes */
++ ret = task_blocks_on_rt_mutex(lock, waiter, task, 1);
+
+ if (ret && !rt_mutex_owner(lock)) {
+ /*
+diff --git a/kernel/rtmutex.h b/kernel/rtmutex.h
+index a1a1dd06421d..f6a1f3c133b1 100644
+--- a/kernel/rtmutex.h
++++ b/kernel/rtmutex.h
+@@ -24,3 +24,8 @@
+ #define debug_rt_mutex_print_deadlock(w) do { } while (0)
+ #define debug_rt_mutex_detect_deadlock(w,d) (d)
+ #define debug_rt_mutex_reset_waiter(w) do { } while (0)
++
++static inline void rt_mutex_print_deadlock(struct rt_mutex_waiter *w)
++{
++ WARN(1, "rtmutex deadlock detected\n");
++}
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index a494ec317e0a..8897a6f5c408 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1052,7 +1052,6 @@ void tracing_start(void)
+
+ arch_spin_unlock(&ftrace_max_lock);
+
+- ftrace_start();
+ out:
+ raw_spin_unlock_irqrestore(&tracing_start_lock, flags);
+ }
+@@ -1068,7 +1067,6 @@ void tracing_stop(void)
+ struct ring_buffer *buffer;
+ unsigned long flags;
+
+- ftrace_stop();
+ raw_spin_lock_irqsave(&tracing_start_lock, flags);
+ if (trace_stop_count++)
+ goto out;
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index ee50c256fdc3..5cec36b6e838 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1991,7 +1991,6 @@ struct mempolicy *__mpol_dup(struct mempolicy *old)
+ } else
+ *new = *old;
+
+- rcu_read_lock();
+ if (current_cpuset_is_being_rebound()) {
+ nodemask_t mems = cpuset_mems_allowed(current);
+ if (new->flags & MPOL_F_REBINDING)
+@@ -1999,7 +1998,6 @@ struct mempolicy *__mpol_dup(struct mempolicy *old)
+ else
+ mpol_rebind_policy(new, &mems, MPOL_REBIND_ONCE);
+ }
+- rcu_read_unlock();
+ atomic_set(&new->refcnt, 1);
+ return new;
+ }
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-07-09 23:19 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-07-09 23:19 UTC (permalink / raw
To: gentoo-commits
commit: ceafe7df41a12a32bf25b8e5917f5975e27b72ea
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Jul 9 23:17:24 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Jul 9 23:17:24 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=ceafe7df
Linux patch 3.4.98
---
0000_README | 4 +
1097_linux-3.4.98.patch | 1534 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1538 insertions(+)
diff --git a/0000_README b/0000_README
index bacfd0f..3c72076 100644
--- a/0000_README
+++ b/0000_README
@@ -427,6 +427,10 @@ Patch: 1096_linux-3.4.97.patch
From: http://www.kernel.org
Desc: Linux 3.4.97
+Patch: 1097_linux-3.4.98.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.98
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1097_linux-3.4.98.patch b/1097_linux-3.4.98.patch
new file mode 100644
index 0000000..db655a8
--- /dev/null
+++ b/1097_linux-3.4.98.patch
@@ -0,0 +1,1534 @@
+diff --git a/Makefile b/Makefile
+index fdd7c32ea1f7..d277446ee8ee 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 97
++SUBLEVEL = 98
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/mach-omap2/mux.c b/arch/arm/mach-omap2/mux.c
+index 65c33911341f..90b33c55ac1b 100644
+--- a/arch/arm/mach-omap2/mux.c
++++ b/arch/arm/mach-omap2/mux.c
+@@ -184,8 +184,10 @@ static int __init _omap_mux_get_by_name(struct omap_mux_partition *partition,
+ m0_entry = mux->muxnames[0];
+
+ /* First check for full name in mode0.muxmode format */
+- if (mode0_len && strncmp(muxname, m0_entry, mode0_len))
+- continue;
++ if (mode0_len)
++ if (strncmp(muxname, m0_entry, mode0_len) ||
++ (strlen(m0_entry) != mode0_len))
++ continue;
+
+ /* Then check for muxmode only */
+ for (i = 0; i < OMAP_MUX_NR_MODES; i++) {
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 8f880bc77c56..846a16378d01 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -491,7 +491,7 @@ machine_check_common:
+ STD_EXCEPTION_COMMON(0xb00, trap_0b, .unknown_exception)
+ STD_EXCEPTION_COMMON(0xd00, single_step, .single_step_exception)
+ STD_EXCEPTION_COMMON(0xe00, trap_0e, .unknown_exception)
+- STD_EXCEPTION_COMMON(0xe40, emulation_assist, .program_check_exception)
++ STD_EXCEPTION_COMMON(0xe40, emulation_assist, .emulation_assist_interrupt)
+ STD_EXCEPTION_COMMON(0xe60, hmi_exception, .unknown_exception)
+ STD_EXCEPTION_COMMON_ASYNC(0xf00, performance_monitor, .performance_monitor_exception)
+ STD_EXCEPTION_COMMON(0x1300, instruction_breakpoint, .instruction_breakpoint_exception)
+diff --git a/arch/powerpc/kernel/lparcfg.c b/arch/powerpc/kernel/lparcfg.c
+index f5725bce9ed2..f62fda1b6d61 100644
+--- a/arch/powerpc/kernel/lparcfg.c
++++ b/arch/powerpc/kernel/lparcfg.c
+@@ -35,7 +35,13 @@
+ #include <asm/vdso_datapage.h>
+ #include <asm/vio.h>
+ #include <asm/mmu.h>
++#include <asm/machdep.h>
+
++
++/*
++ * This isn't a module but we expose that to userspace
++ * via /proc so leave the definitions here
++ */
+ #define MODULE_VERS "1.9"
+ #define MODULE_NAME "lparcfg"
+
+@@ -301,6 +307,7 @@ static void parse_system_parameter_string(struct seq_file *m)
+ __pa(rtas_data_buf),
+ RTAS_DATA_BUF_SIZE);
+ memcpy(local_buffer, rtas_data_buf, SPLPAR_MAXLENGTH);
++ local_buffer[SPLPAR_MAXLENGTH - 1] = '\0';
+ spin_unlock(&rtas_data_buf_lock);
+
+ if (call_status != 0) {
+@@ -419,7 +426,8 @@ static void parse_em_data(struct seq_file *m)
+ {
+ unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+
+- if (plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
++ if (firmware_has_feature(FW_FEATURE_LPAR) &&
++ plpar_hcall(H_GET_EM_PARMS, retbuf) == H_SUCCESS)
+ seq_printf(m, "power_mode_data=%016lx\n", retbuf[0]);
+ }
+
+@@ -678,7 +686,6 @@ static int lparcfg_open(struct inode *inode, struct file *file)
+ }
+
+ static const struct file_operations lparcfg_fops = {
+- .owner = THIS_MODULE,
+ .read = seq_read,
+ .write = lparcfg_write,
+ .open = lparcfg_open,
+@@ -704,15 +711,4 @@ static int __init lparcfg_init(void)
+ proc_ppc64_lparcfg = ent;
+ return 0;
+ }
+-
+-static void __exit lparcfg_cleanup(void)
+-{
+- if (proc_ppc64_lparcfg)
+- remove_proc_entry("lparcfg", proc_ppc64_lparcfg->parent);
+-}
+-
+-module_init(lparcfg_init);
+-module_exit(lparcfg_cleanup);
+-MODULE_DESCRIPTION("Interface for LPAR configuration data");
+-MODULE_AUTHOR("Dave Engebretsen");
+-MODULE_LICENSE("GPL");
++machine_device_initcall(pseries, lparcfg_init);
+diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
+index 389bd4f0cdb1..5c9eccc602ef 100644
+--- a/arch/powerpc/kernel/setup_64.c
++++ b/arch/powerpc/kernel/setup_64.c
+@@ -76,7 +76,7 @@
+ #endif
+
+ int boot_cpuid = 0;
+-int __initdata spinning_secondaries;
++int spinning_secondaries;
+ u64 ppc64_pft_size;
+
+ /* Pick defaults since we might want to patch instructions
+diff --git a/arch/powerpc/kernel/sysfs.c b/arch/powerpc/kernel/sysfs.c
+index 8302af649219..a191a72372fa 100644
+--- a/arch/powerpc/kernel/sysfs.c
++++ b/arch/powerpc/kernel/sysfs.c
+@@ -17,6 +17,7 @@
+ #include <asm/machdep.h>
+ #include <asm/smp.h>
+ #include <asm/pmc.h>
++#include <asm/firmware.h>
+
+ #include "cacheinfo.h"
+
+@@ -179,15 +180,25 @@ SYSFS_PMCSETUP(spurr, SPRN_SPURR);
+ SYSFS_PMCSETUP(dscr, SPRN_DSCR);
+ SYSFS_PMCSETUP(pir, SPRN_PIR);
+
++/*
++ Lets only enable read for phyp resources and
++ enable write when needed with a separate function.
++ Lets be conservative and default to pseries.
++ */
+ static DEVICE_ATTR(mmcra, 0600, show_mmcra, store_mmcra);
+ static DEVICE_ATTR(spurr, 0600, show_spurr, NULL);
+ static DEVICE_ATTR(dscr, 0600, show_dscr, store_dscr);
+-static DEVICE_ATTR(purr, 0600, show_purr, store_purr);
++static DEVICE_ATTR(purr, 0400, show_purr, store_purr);
+ static DEVICE_ATTR(pir, 0400, show_pir, NULL);
+
+ unsigned long dscr_default = 0;
+ EXPORT_SYMBOL(dscr_default);
+
++static void add_write_permission_dev_attr(struct device_attribute *attr)
++{
++ attr->attr.mode |= 0200;
++}
++
+ static ssize_t show_dscr_default(struct device *dev,
+ struct device_attribute *attr, char *buf)
+ {
+@@ -394,8 +405,11 @@ static void __cpuinit register_cpu_online(unsigned int cpu)
+ if (cpu_has_feature(CPU_FTR_MMCRA))
+ device_create_file(s, &dev_attr_mmcra);
+
+- if (cpu_has_feature(CPU_FTR_PURR))
++ if (cpu_has_feature(CPU_FTR_PURR)) {
++ if (!firmware_has_feature(FW_FEATURE_LPAR))
++ add_write_permission_dev_attr(&dev_attr_purr);
+ device_create_file(s, &dev_attr_purr);
++ }
+
+ if (cpu_has_feature(CPU_FTR_SPURR))
+ device_create_file(s, &dev_attr_spurr);
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index eb6b72faec0d..b32729b694c2 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -212,8 +212,6 @@ static u64 scan_dispatch_log(u64 stop_tb)
+ if (i == vpa->dtl_idx)
+ return 0;
+ while (i < vpa->dtl_idx) {
+- if (dtl_consumer)
+- dtl_consumer(dtl, i);
+ dtb = dtl->timebase;
+ tb_delta = dtl->enqueue_to_dispatch_time +
+ dtl->ready_to_enqueue_time;
+@@ -226,6 +224,8 @@ static u64 scan_dispatch_log(u64 stop_tb)
+ }
+ if (dtb > stop_tb)
+ break;
++ if (dtl_consumer)
++ dtl_consumer(dtl, i);
+ stolen += tb_delta;
+ ++i;
+ ++dtl;
+diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c
+index 3bb7197a7bdc..5557044b78ab 100644
+--- a/arch/powerpc/kernel/traps.c
++++ b/arch/powerpc/kernel/traps.c
+@@ -1074,6 +1074,16 @@ void __kprobes program_check_exception(struct pt_regs *regs)
+ _exception(SIGILL, regs, ILL_ILLOPC, regs->nip);
+ }
+
++/*
++ * This occurs when running in hypervisor mode on POWER6 or later
++ * and an illegal instruction is encountered.
++ */
++void __kprobes emulation_assist_interrupt(struct pt_regs *regs)
++{
++ regs->msr |= REASON_ILLEGAL;
++ program_check_exception(regs);
++}
++
+ void alignment_exception(struct pt_regs *regs)
+ {
+ int sig, code, fixed = 0;
+diff --git a/arch/powerpc/lib/checksum_64.S b/arch/powerpc/lib/checksum_64.S
+index afa2ebaee174..3cdbc648d979 100644
+--- a/arch/powerpc/lib/checksum_64.S
++++ b/arch/powerpc/lib/checksum_64.S
+@@ -229,19 +229,35 @@ _GLOBAL(csum_partial)
+ blr
+
+
+- .macro source
++ .macro srcnr
+ 100:
+ .section __ex_table,"a"
+ .align 3
+- .llong 100b,.Lsrc_error
++ .llong 100b,.Lsrc_error_nr
+ .previous
+ .endm
+
+- .macro dest
++ .macro source
++150:
++ .section __ex_table,"a"
++ .align 3
++ .llong 150b,.Lsrc_error
++ .previous
++ .endm
++
++ .macro dstnr
+ 200:
+ .section __ex_table,"a"
+ .align 3
+- .llong 200b,.Ldest_error
++ .llong 200b,.Ldest_error_nr
++ .previous
++ .endm
++
++ .macro dest
++250:
++ .section __ex_table,"a"
++ .align 3
++ .llong 250b,.Ldest_error
+ .previous
+ .endm
+
+@@ -277,11 +293,11 @@ _GLOBAL(csum_partial_copy_generic)
+ mtctr r6
+
+ 1:
+-source; lhz r6,0(r3) /* align to doubleword */
++srcnr; lhz r6,0(r3) /* align to doubleword */
+ subi r5,r5,2
+ addi r3,r3,2
+ adde r0,r0,r6
+-dest; sth r6,0(r4)
++dstnr; sth r6,0(r4)
+ addi r4,r4,2
+ bdnz 1b
+
+@@ -395,10 +411,10 @@ dest; std r16,56(r4)
+
+ mtctr r6
+ 3:
+-source; ld r6,0(r3)
++srcnr; ld r6,0(r3)
+ addi r3,r3,8
+ adde r0,r0,r6
+-dest; std r6,0(r4)
++dstnr; std r6,0(r4)
+ addi r4,r4,8
+ bdnz 3b
+
+@@ -408,10 +424,10 @@ dest; std r6,0(r4)
+ srdi. r6,r5,2
+ beq .Lcopy_tail_halfword
+
+-source; lwz r6,0(r3)
++srcnr; lwz r6,0(r3)
+ addi r3,r3,4
+ adde r0,r0,r6
+-dest; stw r6,0(r4)
++dstnr; stw r6,0(r4)
+ addi r4,r4,4
+ subi r5,r5,4
+
+@@ -419,10 +435,10 @@ dest; stw r6,0(r4)
+ srdi. r6,r5,1
+ beq .Lcopy_tail_byte
+
+-source; lhz r6,0(r3)
++srcnr; lhz r6,0(r3)
+ addi r3,r3,2
+ adde r0,r0,r6
+-dest; sth r6,0(r4)
++dstnr; sth r6,0(r4)
+ addi r4,r4,2
+ subi r5,r5,2
+
+@@ -430,10 +446,10 @@ dest; sth r6,0(r4)
+ andi. r6,r5,1
+ beq .Lcopy_finish
+
+-source; lbz r6,0(r3)
++srcnr; lbz r6,0(r3)
+ sldi r9,r6,8 /* Pad the byte out to 16 bits */
+ adde r0,r0,r9
+-dest; stb r6,0(r4)
++dstnr; stb r6,0(r4)
+
+ .Lcopy_finish:
+ addze r0,r0 /* add in final carry */
+@@ -443,6 +459,11 @@ dest; stb r6,0(r4)
+ blr
+
+ .Lsrc_error:
++ ld r14,STK_REG(r14)(r1)
++ ld r15,STK_REG(r15)(r1)
++ ld r16,STK_REG(r16)(r1)
++ addi r1,r1,STACKFRAMESIZE
++.Lsrc_error_nr:
+ cmpdi 0,r7,0
+ beqlr
+ li r6,-EFAULT
+@@ -450,6 +471,11 @@ dest; stb r6,0(r4)
+ blr
+
+ .Ldest_error:
++ ld r14,STK_REG(r14)(r1)
++ ld r15,STK_REG(r15)(r1)
++ ld r16,STK_REG(r16)(r1)
++ addi r1,r1,STACKFRAMESIZE
++.Ldest_error_nr:
+ cmpdi 0,r8,0
+ beqlr
+ li r6,-EFAULT
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index d57eacb9fcf6..944471f4d142 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -102,7 +102,7 @@
+ #define KVM_REFILL_PAGES 25
+ #define KVM_MAX_CPUID_ENTRIES 80
+ #define KVM_NR_FIXED_MTRR_REGION 88
+-#define KVM_NR_VAR_MTRR 8
++#define KVM_NR_VAR_MTRR 10
+
+ #define ASYNC_PF_PER_VCPU 64
+
+@@ -436,7 +436,7 @@ struct kvm_vcpu_arch {
+ bool nmi_injected; /* Trying to inject an NMI this entry */
+
+ struct mtrr_state_type mtrr_state;
+- u32 pat;
++ u64 pat;
+
+ int switch_db_regs;
+ unsigned long db[KVM_NR_DB_REGS];
+diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
+index 415448af36bf..8c5ad89a65a5 100644
+--- a/drivers/acpi/video.c
++++ b/drivers/acpi/video.c
+@@ -463,6 +463,22 @@ static struct dmi_system_id video_dmi_table[] __initdata = {
+ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion m4 Notebook PC"),
+ },
+ },
++ {
++ .callback = video_ignore_initial_backlight,
++ .ident = "HP 1000 Notebook PC",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP 1000 Notebook PC"),
++ },
++ },
++ {
++ .callback = video_ignore_initial_backlight,
++ .ident = "HP Pavilion dm4",
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "Hewlett-Packard"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion dm4 Notebook PC"),
++ },
++ },
+ {}
+ };
+
+diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
+index 45d8097ef4cf..144088717b86 100644
+--- a/drivers/acpi/video_detect.c
++++ b/drivers/acpi/video_detect.c
+@@ -132,6 +132,49 @@ find_video(acpi_handle handle, u32 lvl, void *context, void **rv)
+ return AE_OK;
+ }
+
++/* Force to use vendor driver when the ACPI device is known to be
++ * buggy */
++static int video_detect_force_vendor(const struct dmi_system_id *d)
++{
++ acpi_video_support |= ACPI_VIDEO_BACKLIGHT_DMI_VENDOR;
++ return 0;
++}
++
++static struct dmi_system_id video_detect_dmi_table[] = {
++ /* On Samsung X360, the BIOS will set a flag (VDRV) if generic
++ * ACPI backlight device is used. This flag will definitively break
++ * the backlight interface (even the vendor interface) untill next
++ * reboot. It's why we should prevent video.ko from being used here
++ * and we can't rely on a later call to acpi_video_unregister().
++ */
++ {
++ .callback = video_detect_force_vendor,
++ .ident = "X360",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "X360"),
++ DMI_MATCH(DMI_BOARD_NAME, "X360"),
++ },
++ },
++ {
++ .callback = video_detect_force_vendor,
++ .ident = "Asus UL30VT",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "UL30VT"),
++ },
++ },
++ {
++ .callback = video_detect_force_vendor,
++ .ident = "Asus UL30A",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "UL30A"),
++ },
++ },
++ { },
++};
++
+ /*
+ * Returns the video capabilities of a specific ACPI graphics device
+ *
+@@ -164,6 +207,8 @@ long acpi_video_get_capabilities(acpi_handle graphics_handle)
+ * ACPI_VIDEO_BACKLIGHT_DMI_VENDOR;
+ *}
+ */
++
++ dmi_check_system(video_detect_dmi_table);
+ } else {
+ status = acpi_bus_get_device(graphics_handle, &tmp_dev);
+ if (ACPI_FAILURE(status)) {
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index dc612efbeb7a..d51c08da3f69 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -863,14 +863,16 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
+ args.v5.ucMiscInfo = 0; /* HDMI depth, etc. */
+ if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
+ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_REF_DIV_SRC;
+- switch (bpc) {
+- case 8:
+- default:
+- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
+- break;
+- case 10:
+- args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
+- break;
++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
++ switch (bpc) {
++ case 8:
++ default:
++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_24BPP;
++ break;
++ case 10:
++ args.v5.ucMiscInfo |= PIXEL_CLOCK_V5_MISC_HDMI_30BPP;
++ break;
++ }
+ }
+ args.v5.ucTransmitterID = encoder_id;
+ args.v5.ucEncoderMode = encoder_mode;
+@@ -885,20 +887,22 @@ static void atombios_crtc_program_pll(struct drm_crtc *crtc,
+ args.v6.ucMiscInfo = 0; /* HDMI depth, etc. */
+ if (ss_enabled && (ss->type & ATOM_EXTERNAL_SS_MASK))
+ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_REF_DIV_SRC;
+- switch (bpc) {
+- case 8:
+- default:
+- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
+- break;
+- case 10:
+- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
+- break;
+- case 12:
+- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
+- break;
+- case 16:
+- args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
+- break;
++ if (encoder_mode == ATOM_ENCODER_MODE_HDMI) {
++ switch (bpc) {
++ case 8:
++ default:
++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_24BPP;
++ break;
++ case 10:
++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_30BPP;
++ break;
++ case 12:
++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_36BPP;
++ break;
++ case 16:
++ args.v6.ucMiscInfo |= PIXEL_CLOCK_V6_MISC_HDMI_48BPP;
++ break;
++ }
+ }
+ args.v6.ucTransmitterID = encoder_id;
+ args.v6.ucEncoderMode = encoder_mode;
+diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c
+index 072229dca464..dd5c14e917e0 100644
+--- a/drivers/gpu/drm/radeon/atombios_encoders.c
++++ b/drivers/gpu/drm/radeon/atombios_encoders.c
+@@ -1666,8 +1666,11 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
+ args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
+ else
+ args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+- } else
++ } else if (radeon_encoder->devices & (ATOM_DEVICE_LCD_SUPPORT)) {
++ args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
++ } else {
+ args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
++ }
+ switch (radeon_encoder->encoder_id) {
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+ case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
+index 1334dbd15c1b..9184bbe7c602 100644
+--- a/drivers/gpu/drm/radeon/radeon_connectors.c
++++ b/drivers/gpu/drm/radeon/radeon_connectors.c
+@@ -1279,7 +1279,7 @@ bool radeon_connector_is_dp12_capable(struct drm_connector *connector)
+ struct radeon_device *rdev = dev->dev_private;
+
+ if (ASIC_IS_DCE5(rdev) &&
+- (rdev->clock.dp_extclk >= 53900) &&
++ (rdev->clock.default_dispclk >= 53900) &&
+ radeon_connector_encoder_is_hbr2(connector)) {
+ return true;
+ }
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+index 6651cb328598..7fc3dc7f9985 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -179,7 +179,6 @@ static int vmw_fb_set_par(struct fb_info *info)
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
+- vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
+ vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+ }
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 3a8ef589d8c0..17e2f526457c 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -7180,6 +7180,19 @@ void md_do_sync(struct mddev *mddev)
+ rdev->recovery_offset < j)
+ j = rdev->recovery_offset;
+ rcu_read_unlock();
++
++ /* If there is a bitmap, we need to make sure all
++ * writes that started before we added a spare
++ * complete before we start doing a recovery.
++ * Otherwise the write might complete and (via
++ * bitmap_endwrite) set a bit in the bitmap after the
++ * recovery has checked that bit and skipped that
++ * region.
++ */
++ if (mddev->bitmap) {
++ mddev->pers->quiesce(mddev, 1);
++ mddev->pers->quiesce(mddev, 0);
++ }
+ }
+
+ printk(KERN_INFO "md: %s of RAID array %s\n", desc, mdname(mddev));
+diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
+index def50caa6f84..fd11af4a702a 100644
+--- a/drivers/mtd/nand/pxa3xx_nand.c
++++ b/drivers/mtd/nand/pxa3xx_nand.c
+@@ -93,10 +93,10 @@
+
+ /* macros for registers read/write */
+ #define nand_writel(info, off, val) \
+- __raw_writel((val), (info)->mmio_base + (off))
++ writel_relaxed((val), (info)->mmio_base + (off))
+
+ #define nand_readl(info, off) \
+- __raw_readl((info)->mmio_base + (off))
++ readl_relaxed((info)->mmio_base + (off))
+
+ /* error code and state */
+ enum {
+diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
+index 9db0f8e132e6..ad3961177c68 100644
+--- a/drivers/net/wireless/b43/xmit.c
++++ b/drivers/net/wireless/b43/xmit.c
+@@ -808,9 +808,13 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
+ break;
+ case B43_PHYTYPE_G:
+ status.band = IEEE80211_BAND_2GHZ;
+- /* chanid is the radio channel cookie value as used
+- * to tune the radio. */
+- status.freq = chanid + 2400;
++ /* Somewhere between 478.104 and 508.1084 firmware for G-PHY
++ * has been modified to be compatible with N-PHY and others.
++ */
++ if (dev->fw.rev >= 508)
++ status.freq = ieee80211_channel_to_frequency(chanid, status.band);
++ else
++ status.freq = chanid + 2400;
+ break;
+ case B43_PHYTYPE_N:
+ case B43_PHYTYPE_LP:
+diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
+index aa10c48c0dfa..f8ea77c87b20 100644
+--- a/drivers/net/wireless/rt2x00/rt2500pci.c
++++ b/drivers/net/wireless/rt2x00/rt2500pci.c
+@@ -1679,8 +1679,13 @@ static int rt2500pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
+ /*
+ * Detect if this device has an hardware controlled radio.
+ */
+- if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
++ if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO)) {
+ __set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
++ /*
++ * On this device RFKILL initialized during probe does not work.
++ */
++ __set_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags);
++ }
+
+ /*
+ * Check if the BBP tuning should be enabled.
+diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
+index c264dfa6e611..4be11e36e3ca 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/rt2x00/rt2x00.h
+@@ -717,6 +717,7 @@ enum rt2x00_capability_flags {
+ REQUIRE_SW_SEQNO,
+ REQUIRE_HT_TX_DESC,
+ REQUIRE_PS_AUTOWAKE,
++ REQUIRE_DELAYED_RFKILL,
+
+ /*
+ * Capabilities
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index 8f2c88e2c339..da65f8e97754 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -1022,9 +1022,10 @@ static void rt2x00lib_uninitialize(struct rt2x00_dev *rt2x00dev)
+ return;
+
+ /*
+- * Unregister extra components.
++ * Stop rfkill polling.
+ */
+- rt2x00rfkill_unregister(rt2x00dev);
++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_unregister(rt2x00dev);
+
+ /*
+ * Allow the HW to uninitialize.
+@@ -1062,6 +1063,12 @@ static int rt2x00lib_initialize(struct rt2x00_dev *rt2x00dev)
+
+ set_bit(DEVICE_STATE_INITIALIZED, &rt2x00dev->flags);
+
++ /*
++ * Start rfkill polling.
++ */
++ if (test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_register(rt2x00dev);
++
+ return 0;
+ }
+
+@@ -1207,7 +1214,12 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
+ rt2x00link_register(rt2x00dev);
+ rt2x00leds_register(rt2x00dev);
+ rt2x00debug_register(rt2x00dev);
+- rt2x00rfkill_register(rt2x00dev);
++
++ /*
++ * Start rfkill polling.
++ */
++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_register(rt2x00dev);
+
+ return 0;
+
+@@ -1223,6 +1235,12 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
+ clear_bit(DEVICE_STATE_PRESENT, &rt2x00dev->flags);
+
+ /*
++ * Stop rfkill polling.
++ */
++ if (!test_bit(REQUIRE_DELAYED_RFKILL, &rt2x00dev->cap_flags))
++ rt2x00rfkill_unregister(rt2x00dev);
++
++ /*
+ * Disable radio.
+ */
+ rt2x00lib_disable_radio(rt2x00dev);
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index af247b06c842..e6daf129cc36 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -517,6 +517,8 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
+ crypto.cipher = rt2x00crypto_key_to_cipher(key);
+ if (crypto.cipher == CIPHER_NONE)
+ return -EOPNOTSUPP;
++ if (crypto.cipher == CIPHER_TKIP && rt2x00_is_usb(rt2x00dev))
++ return -EOPNOTSUPP;
+
+ crypto.cmd = cmd;
+
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index 337e8b33d9aa..ac58ee344790 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -484,7 +484,8 @@ static void purge_requests(struct ibmvscsi_host_data *hostdata, int error_code)
+ evt->hostdata->dev);
+ if (evt->cmnd_done)
+ evt->cmnd_done(evt->cmnd);
+- } else if (evt->done)
++ } else if (evt->done && evt->crq.format != VIOSRP_MAD_FORMAT &&
++ evt->iu.srp.login_req.opcode != SRP_LOGIN_REQ)
+ evt->done(evt);
+ free_event_struct(&evt->hostdata->pool, evt);
+ spin_lock_irqsave(hostdata->host->host_lock, flags);
+diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+index d92fe4037e94..6b349e301869 100644
+--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c
++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c
+@@ -3000,7 +3000,11 @@ sym_dequeue_from_squeue(struct sym_hcb *np, int i, int target, int lun, int task
+ if ((target == -1 || cp->target == target) &&
+ (lun == -1 || cp->lun == lun) &&
+ (task == -1 || cp->tag == task)) {
++#ifdef SYM_OPT_HANDLE_DEVICE_QUEUEING
+ sym_set_cam_status(cp->cmd, DID_SOFT_ERROR);
++#else
++ sym_set_cam_status(cp->cmd, DID_REQUEUE);
++#endif
+ sym_remque(&cp->link_ccbq);
+ sym_insque_tail(&cp->link_ccbq, &np->comp_ccbq);
+ }
+diff --git a/drivers/staging/bcm/InterfaceInit.c b/drivers/staging/bcm/InterfaceInit.c
+index 8e3c586a699c..e0f40ae358ed 100644
+--- a/drivers/staging/bcm/InterfaceInit.c
++++ b/drivers/staging/bcm/InterfaceInit.c
+@@ -4,10 +4,12 @@ static struct usb_device_id InterfaceUsbtable[] = {
+ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3B) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_T3L) },
+- { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SM250) },
++ { USB_DEVICE(BCM_USB_VENDOR_ID_T3, BCM_USB_PRODUCT_ID_SYM) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_226) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_FOXCONN, BCM_USB_PRODUCT_ID_1901) },
+ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_TU25) },
++ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_226) },
++ { USB_DEVICE(BCM_USB_VENDOR_ID_ZTE, BCM_USB_PRODUCT_ID_ZTE_326) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(usb, InterfaceUsbtable);
+diff --git a/drivers/staging/bcm/InterfaceInit.h b/drivers/staging/bcm/InterfaceInit.h
+index 058315a64c05..6fa4f09a37c6 100644
+--- a/drivers/staging/bcm/InterfaceInit.h
++++ b/drivers/staging/bcm/InterfaceInit.h
+@@ -8,10 +8,11 @@
+ #define BCM_USB_PRODUCT_ID_T3 0x0300
+ #define BCM_USB_PRODUCT_ID_T3B 0x0210
+ #define BCM_USB_PRODUCT_ID_T3L 0x0220
+-#define BCM_USB_PRODUCT_ID_SM250 0xbccd
+ #define BCM_USB_PRODUCT_ID_SYM 0x15E
+ #define BCM_USB_PRODUCT_ID_1901 0xe017
+-#define BCM_USB_PRODUCT_ID_226 0x0132
++#define BCM_USB_PRODUCT_ID_226 0x0132 /* not sure if this is valid */
++#define BCM_USB_PRODUCT_ID_ZTE_226 0x172
++#define BCM_USB_PRODUCT_ID_ZTE_326 0x173 /* ZTE AX326 */
+ #define BCM_USB_PRODUCT_ID_ZTE_TU25 0x0007
+
+ #define BCM_USB_MINOR_BASE 192
+diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
+index 50dc93e2a227..fff275753416 100644
+--- a/drivers/staging/comedi/comedi_fops.c
++++ b/drivers/staging/comedi/comedi_fops.c
+@@ -1078,22 +1078,19 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ DPRINTK("subdevice busy\n");
+ return -EBUSY;
+ }
+- s->busy = file;
+
+ /* make sure channel/gain list isn't too long */
+ if (user_cmd.chanlist_len > s->len_chanlist) {
+ DPRINTK("channel/gain list too long %u > %d\n",
+ user_cmd.chanlist_len, s->len_chanlist);
+- ret = -EINVAL;
+- goto cleanup;
++ return -EINVAL;
+ }
+
+ /* make sure channel/gain list isn't too short */
+ if (user_cmd.chanlist_len < 1) {
+ DPRINTK("channel/gain list too short %u < 1\n",
+ user_cmd.chanlist_len);
+- ret = -EINVAL;
+- goto cleanup;
++ return -EINVAL;
+ }
+
+ async->cmd = user_cmd;
+@@ -1103,8 +1100,7 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+ kmalloc(async->cmd.chanlist_len * sizeof(int), GFP_KERNEL);
+ if (!async->cmd.chanlist) {
+ DPRINTK("allocation failed\n");
+- ret = -ENOMEM;
+- goto cleanup;
++ return -ENOMEM;
+ }
+
+ if (copy_from_user(async->cmd.chanlist, user_cmd.chanlist,
+@@ -1156,6 +1152,9 @@ static int do_cmd_ioctl(struct comedi_device *dev,
+
+ comedi_set_subdevice_runflags(s, ~0, SRF_USER | SRF_RUNNING);
+
++ /* set s->busy _after_ setting SRF_RUNNING flag to avoid race with
++ * comedi_read() or comedi_write() */
++ s->busy = file;
+ ret = s->do_cmd(dev, s);
+ if (ret == 0)
+ return 0;
+@@ -1658,6 +1657,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
+
+ if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
+ if (count == 0) {
++ mutex_lock(&dev->mutex);
+ if (comedi_get_subdevice_runflags(s) &
+ SRF_ERROR) {
+ retval = -EPIPE;
+@@ -1665,6 +1665,7 @@ static ssize_t comedi_write(struct file *file, const char __user *buf,
+ retval = 0;
+ }
+ do_become_nonbusy(dev, s);
++ mutex_unlock(&dev->mutex);
+ }
+ break;
+ }
+@@ -1779,6 +1780,7 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
+
+ if (n == 0) {
+ if (!(comedi_get_subdevice_runflags(s) & SRF_RUNNING)) {
++ mutex_lock(&dev->mutex);
+ do_become_nonbusy(dev, s);
+ if (comedi_get_subdevice_runflags(s) &
+ SRF_ERROR) {
+@@ -1786,6 +1788,7 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
+ } else {
+ retval = 0;
+ }
++ mutex_unlock(&dev->mutex);
+ break;
+ }
+ if (file->f_flags & O_NONBLOCK) {
+@@ -1823,9 +1826,11 @@ static ssize_t comedi_read(struct file *file, char __user *buf, size_t nbytes,
+ buf += n;
+ break; /* makes device work like a pipe */
+ }
+- if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING)) &&
+- async->buf_read_count - async->buf_write_count == 0) {
+- do_become_nonbusy(dev, s);
++ if (!(comedi_get_subdevice_runflags(s) & (SRF_ERROR | SRF_RUNNING))) {
++ mutex_lock(&dev->mutex);
++ if (async->buf_read_count - async->buf_write_count == 0)
++ do_become_nonbusy(dev, s);
++ mutex_unlock(&dev->mutex);
+ }
+ set_current_state(TASK_RUNNING);
+ remove_wait_queue(&async->wait_head, &wait);
+diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c
+index d2dd75e2af7f..e16d1f38ca64 100644
+--- a/drivers/staging/comedi/drivers/das08.c
++++ b/drivers/staging/comedi/drivers/das08.c
+@@ -385,7 +385,7 @@ static const struct das08_board_struct das08_boards[] = {
+ .ai = das08_ai_rinsn,
+ .ai_nbits = 16,
+ .ai_pg = das08_pg_none,
+- .ai_encoding = das08_encode12,
++ .ai_encoding = das08_encode16,
+ .ao = das08jr_ao_winsn,
+ .ao_nbits = 16,
+ .di = das08jr_di_rbits,
+diff --git a/drivers/staging/wlags49_h2/wl_priv.c b/drivers/staging/wlags49_h2/wl_priv.c
+index f30e5ee4bca3..ff459b206756 100644
+--- a/drivers/staging/wlags49_h2/wl_priv.c
++++ b/drivers/staging/wlags49_h2/wl_priv.c
+@@ -570,6 +570,7 @@ int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp )
+ ltv_t *pLtv;
+ bool_t ltvAllocated = FALSE;
+ ENCSTRCT sEncryption;
++ size_t len;
+
+ #ifdef USE_WDS
+ hcf_16 hcfPort = HCF_PORT_0;
+@@ -686,7 +687,8 @@ int wvlan_uil_put_info( struct uilreq *urq, struct wl_private *lp )
+ break;
+ case CFG_CNF_OWN_NAME:
+ memset( lp->StationName, 0, sizeof( lp->StationName ));
+- memcpy( (void *)lp->StationName, (void *)&pLtv->u.u8[2], (size_t)pLtv->u.u16[0]);
++ len = min_t(size_t, pLtv->u.u16[0], sizeof(lp->StationName));
++ strlcpy(lp->StationName, &pLtv->u.u8[2], len);
+ pLtv->u.u16[0] = CNV_INT_TO_LITTLE( pLtv->u.u16[0] );
+ break;
+ case CFG_CNF_LOAD_BALANCING:
+@@ -1800,6 +1802,7 @@ int wvlan_set_station_nickname(struct net_device *dev,
+ {
+ struct wl_private *lp = wl_priv(dev);
+ unsigned long flags;
++ size_t len;
+ int ret = 0;
+ /*------------------------------------------------------------------------*/
+
+@@ -1810,8 +1813,8 @@ int wvlan_set_station_nickname(struct net_device *dev,
+ wl_lock(lp, &flags);
+
+ memset( lp->StationName, 0, sizeof( lp->StationName ));
+-
+- memcpy( lp->StationName, extra, wrqu->data.length);
++ len = min_t(size_t, wrqu->data.length, sizeof(lp->StationName));
++ strlcpy(lp->StationName, extra, len);
+
+ /* Commit the adapter parameters */
+ wl_apply( lp );
+diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
+index f52cb1ae45d9..32d1effe3d44 100644
+--- a/drivers/usb/gadget/f_fs.c
++++ b/drivers/usb/gadget/f_fs.c
+@@ -1361,11 +1361,13 @@ static int functionfs_bind(struct ffs_data *ffs, struct usb_composite_dev *cdev)
+ ffs->ep0req->context = ffs;
+
+ lang = ffs->stringtabs;
+- for (lang = ffs->stringtabs; *lang; ++lang) {
+- struct usb_string *str = (*lang)->strings;
+- int id = first_id;
+- for (; str->s; ++id, ++str)
+- str->id = id;
++ if (lang) {
++ for (; *lang; ++lang) {
++ struct usb_string *str = (*lang)->strings;
++ int id = first_id;
++ for (; str->s; ++id, ++str)
++ str->id = id;
++ }
+ }
+
+ ffs->gadget = cdev->gadget;
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 87ee28e1e65e..6f1b36d15419 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -3588,7 +3588,7 @@ static unsigned int xhci_get_burst_count(struct xhci_hcd *xhci,
+ return 0;
+
+ max_burst = urb->ep->ss_ep_comp.bMaxBurst;
+- return roundup(total_packet_count, max_burst + 1) - 1;
++ return DIV_ROUND_UP(total_packet_count, max_burst + 1) - 1;
+ }
+
+ /*
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 7299a06af9db..424d9cf9d9a0 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -963,7 +963,7 @@ int xhci_suspend(struct xhci_hcd *xhci)
+ */
+ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ {
+- u32 command, temp = 0;
++ u32 command, temp = 0, status;
+ struct usb_hcd *hcd = xhci_to_hcd(xhci);
+ struct usb_hcd *secondary_hcd;
+ int retval = 0;
+@@ -1087,8 +1087,12 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+
+ done:
+ if (retval == 0) {
+- usb_hcd_resume_root_hub(hcd);
+- usb_hcd_resume_root_hub(xhci->shared_hcd);
++ /* Resume root hubs only when have pending events. */
++ status = readl(&xhci->op_regs->status);
++ if (status & STS_EINT) {
++ usb_hcd_resume_root_hub(hcd);
++ usb_hcd_resume_root_hub(xhci->shared_hcd);
++ }
+ }
+
+ /*
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index bb9f4111d1b8..ed1650fb910d 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1593,14 +1593,17 @@ static void ftdi_set_max_packet_size(struct usb_serial_port *port)
+ struct usb_device *udev = serial->dev;
+
+ struct usb_interface *interface = serial->interface;
+- struct usb_endpoint_descriptor *ep_desc = &interface->cur_altsetting->endpoint[1].desc;
++ struct usb_endpoint_descriptor *ep_desc;
+
+ unsigned num_endpoints;
+- int i;
++ unsigned i;
+
+ num_endpoints = interface->cur_altsetting->desc.bNumEndpoints;
+ dev_info(&udev->dev, "Number of endpoints %d\n", num_endpoints);
+
++ if (!num_endpoints)
++ return;
++
+ /* NOTE: some customers have programmed FT232R/FT245R devices
+ * with an endpoint size of 0 - not good. In this case, we
+ * want to override the endpoint descriptor setting and use a
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index f7ccfbcdbf04..58fcaa5ae548 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -357,6 +357,9 @@ static void option_instat_callback(struct urb *urb);
+ /* Zoom */
+ #define ZOOM_PRODUCT_4597 0x9607
+
++/* SpeedUp SU9800 usb 3g modem */
++#define SPEEDUP_PRODUCT_SU9800 0x9800
++
+ /* Haier products */
+ #define HAIER_VENDOR_ID 0x201e
+ #define HAIER_PRODUCT_CE100 0x2009
+@@ -377,8 +380,12 @@ static void option_instat_callback(struct urb *urb);
+ /* Olivetti products */
+ #define OLIVETTI_VENDOR_ID 0x0b3c
+ #define OLIVETTI_PRODUCT_OLICARD100 0xc000
++#define OLIVETTI_PRODUCT_OLICARD120 0xc001
++#define OLIVETTI_PRODUCT_OLICARD140 0xc002
+ #define OLIVETTI_PRODUCT_OLICARD145 0xc003
++#define OLIVETTI_PRODUCT_OLICARD155 0xc004
+ #define OLIVETTI_PRODUCT_OLICARD200 0xc005
++#define OLIVETTI_PRODUCT_OLICARD160 0xc00a
+ #define OLIVETTI_PRODUCT_OLICARD500 0xc00b
+
+ /* Celot products */
+@@ -1597,6 +1604,7 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+ .driver_info = (kernel_ulong_t)&four_g_w14_blacklist
+ },
++ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+@@ -1631,15 +1639,21 @@ static const struct usb_device_id option_ids[] = {
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, /* HC28 enumerates with Siemens or Cinterion VID depending on FW revision */
+ { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+-
+- { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD120),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD140),
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD155),
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+- .driver_info = (kernel_ulong_t)&net_intf6_blacklist
+- },
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD160),
++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist },
+ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
+- .driver_info = (kernel_ulong_t)&net_intf4_blacklist
+- },
++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
+index 6a8568c6466f..f2da2bd20188 100644
+--- a/fs/cifs/cifs_unicode.c
++++ b/fs/cifs/cifs_unicode.c
+@@ -290,7 +290,8 @@ int
+ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
+ const struct nls_table *cp, int mapChars)
+ {
+- int i, j, charlen;
++ int i, charlen;
++ int j = 0;
+ char src_char;
+ __le16 dst_char;
+ wchar_t tmp;
+@@ -298,12 +299,11 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
+ if (!mapChars)
+ return cifs_strtoUTF16(target, source, PATH_MAX, cp);
+
+- for (i = 0, j = 0; i < srclen; j++) {
++ for (i = 0; i < srclen; j++) {
+ src_char = source[i];
+ charlen = 1;
+ switch (src_char) {
+ case 0:
+- put_unaligned(0, &target[j]);
+ goto ctoUTF16_out;
+ case ':':
+ dst_char = cpu_to_le16(UNI_COLON);
+@@ -350,6 +350,7 @@ cifsConvertToUTF16(__le16 *target, const char *source, int srclen,
+ }
+
+ ctoUTF16_out:
++ put_unaligned(0, &target[j]); /* Null terminate target unicode string */
+ return j;
+ }
+
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index 97a142cde23b..22beaff3544a 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -543,15 +543,6 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
+
+ switch (create->cr_type) {
+ case NF4LNK:
+- /* ugh! we have to null-terminate the linktext, or
+- * vfs_symlink() will choke. it is always safe to
+- * null-terminate by brute force, since at worst we
+- * will overwrite the first byte of the create namelen
+- * in the XDR buffer, which has already been extracted
+- * during XDR decode.
+- */
+- create->cr_linkname[create->cr_linklen] = 0;
+-
+ status = nfsd_symlink(rqstp, &cstate->current_fh,
+ create->cr_name, create->cr_namelen,
+ create->cr_linkname, create->cr_linklen,
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index ba7bf4a11855..04a1ce42e32b 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -465,7 +465,18 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create
+ READ_BUF(4);
+ READ32(create->cr_linklen);
+ READ_BUF(create->cr_linklen);
+- SAVEMEM(create->cr_linkname, create->cr_linklen);
++ /*
++ * The VFS will want a null-terminated string, and
++ * null-terminating in place isn't safe since this might
++ * end on a page boundary:
++ */
++ create->cr_linkname =
++ kmalloc(create->cr_linklen + 1, GFP_KERNEL);
++ if (!create->cr_linkname)
++ return nfserr_jukebox;
++ memcpy(create->cr_linkname, p, create->cr_linklen);
++ create->cr_linkname[create->cr_linklen] = '\0';
++ defer_free(argp, kfree, create->cr_linkname);
+ break;
+ case NF4BLK:
+ case NF4CHR:
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 4e8e6685f513..473907ac9104 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -715,6 +715,22 @@ static inline int usb_make_path(struct usb_device *dev, char *buf, size_t size)
+ .bcdDevice_hi = (hi)
+
+ /**
++ * USB_DEVICE_INTERFACE_CLASS - describe a usb device with a specific interface class
++ * @vend: the 16 bit USB Vendor ID
++ * @prod: the 16 bit USB Product ID
++ * @cl: bInterfaceClass value
++ *
++ * This macro is used to create a struct usb_device_id that matches a
++ * specific interface class of devices.
++ */
++#define USB_DEVICE_INTERFACE_CLASS(vend, prod, cl) \
++ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
++ USB_DEVICE_ID_MATCH_INT_CLASS, \
++ .idVendor = (vend), \
++ .idProduct = (prod), \
++ .bInterfaceClass = (cl)
++
++/**
+ * USB_DEVICE_INTERFACE_PROTOCOL - describe a usb device with a specific interface protocol
+ * @vend: the 16 bit USB Vendor ID
+ * @prod: the 16 bit USB Product ID
+diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
+index 4886c1144972..7d6cb0b2d061 100644
+--- a/include/net/bluetooth/hci_core.h
++++ b/include/net/bluetooth/hci_core.h
+@@ -1068,7 +1068,6 @@ void hci_le_conn_update(struct hci_conn *conn, u16 min, u16 max,
+ u16 latency, u16 to_multiplier);
+ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+ __u8 ltk[16]);
+-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16]);
+ void hci_le_ltk_neg_reply(struct hci_conn *conn);
+
+ int hci_do_inquiry(struct hci_dev *hdev, u8 length);
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d5facc8d78a4..0d4e0ad97a04 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -2276,6 +2276,31 @@ static void set_huge_ptep_writable(struct vm_area_struct *vma,
+ update_mmu_cache(vma, address, ptep);
+ }
+
++static int is_hugetlb_entry_migration(pte_t pte)
++{
++ swp_entry_t swp;
++
++ if (huge_pte_none(pte) || pte_present(pte))
++ return 0;
++ swp = pte_to_swp_entry(pte);
++ if (non_swap_entry(swp) && is_migration_entry(swp))
++ return 1;
++ else
++ return 0;
++}
++
++static int is_hugetlb_entry_hwpoisoned(pte_t pte)
++{
++ swp_entry_t swp;
++
++ if (huge_pte_none(pte) || pte_present(pte))
++ return 0;
++ swp = pte_to_swp_entry(pte);
++ if (non_swap_entry(swp) && is_hwpoison_entry(swp))
++ return 1;
++ else
++ return 0;
++}
+
+ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+ struct vm_area_struct *vma)
+@@ -2303,10 +2328,26 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src,
+
+ spin_lock(&dst->page_table_lock);
+ spin_lock_nested(&src->page_table_lock, SINGLE_DEPTH_NESTING);
+- if (!huge_pte_none(huge_ptep_get(src_pte))) {
++ entry = huge_ptep_get(src_pte);
++ if (huge_pte_none(entry)) { /* skip none entry */
++ ;
++ } else if (unlikely(is_hugetlb_entry_migration(entry) ||
++ is_hugetlb_entry_hwpoisoned(entry))) {
++ swp_entry_t swp_entry = pte_to_swp_entry(entry);
++
++ if (is_write_migration_entry(swp_entry) && cow) {
++ /*
++ * COW mappings require pages in both
++ * parent and child to be set to read.
++ */
++ make_migration_entry_read(&swp_entry);
++ entry = swp_entry_to_pte(swp_entry);
++ set_huge_pte_at(src, addr, src_pte, entry);
++ }
++ set_huge_pte_at(dst, addr, dst_pte, entry);
++ } else {
+ if (cow)
+ huge_ptep_set_wrprotect(src, addr, src_pte);
+- entry = huge_ptep_get(src_pte);
+ ptepage = pte_page(entry);
+ get_page(ptepage);
+ page_dup_rmap(ptepage);
+@@ -2321,32 +2362,6 @@ nomem:
+ return -ENOMEM;
+ }
+
+-static int is_hugetlb_entry_migration(pte_t pte)
+-{
+- swp_entry_t swp;
+-
+- if (huge_pte_none(pte) || pte_present(pte))
+- return 0;
+- swp = pte_to_swp_entry(pte);
+- if (non_swap_entry(swp) && is_migration_entry(swp))
+- return 1;
+- else
+- return 0;
+-}
+-
+-static int is_hugetlb_entry_hwpoisoned(pte_t pte)
+-{
+- swp_entry_t swp;
+-
+- if (huge_pte_none(pte) || pte_present(pte))
+- return 0;
+- swp = pte_to_swp_entry(pte);
+- if (non_swap_entry(swp) && is_hwpoison_entry(swp))
+- return 1;
+- else
+- return 0;
+-}
+-
+ void __unmap_hugepage_range(struct vm_area_struct *vma, unsigned long start,
+ unsigned long end, struct page *ref_page)
+ {
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 82f1b027ba1c..ee50c256fdc3 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -566,24 +566,24 @@ static inline int check_pgd_range(struct vm_area_struct *vma,
+ * If pagelist != NULL then isolate pages from the LRU and
+ * put them on the pagelist.
+ */
+-static struct vm_area_struct *
++static int
+ check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
+ const nodemask_t *nodes, unsigned long flags, void *private)
+ {
+- int err;
+- struct vm_area_struct *first, *vma, *prev;
++ int err = 0;
++ struct vm_area_struct *vma, *prev;
+
+
+- first = find_vma(mm, start);
+- if (!first)
+- return ERR_PTR(-EFAULT);
++ vma = find_vma(mm, start);
++ if (!vma)
++ return -EFAULT;
+ prev = NULL;
+- for (vma = first; vma && vma->vm_start < end; vma = vma->vm_next) {
++ for (; vma && vma->vm_start < end; vma = vma->vm_next) {
+ if (!(flags & MPOL_MF_DISCONTIG_OK)) {
+ if (!vma->vm_next && vma->vm_end < end)
+- return ERR_PTR(-EFAULT);
++ return -EFAULT;
+ if (prev && prev->vm_end < vma->vm_start)
+- return ERR_PTR(-EFAULT);
++ return -EFAULT;
+ }
+ if (!is_vm_hugetlb_page(vma) &&
+ ((flags & MPOL_MF_STRICT) ||
+@@ -597,14 +597,12 @@ check_range(struct mm_struct *mm, unsigned long start, unsigned long end,
+ start = vma->vm_start;
+ err = check_pgd_range(vma, start, endvma, nodes,
+ flags, private);
+- if (err) {
+- first = ERR_PTR(err);
++ if (err)
+ break;
+- }
+ }
+ prev = vma;
+ }
+- return first;
++ return err;
+ }
+
+ /*
+@@ -945,16 +943,15 @@ static int migrate_to_node(struct mm_struct *mm, int source, int dest,
+ {
+ nodemask_t nmask;
+ LIST_HEAD(pagelist);
+- int err = 0;
+- struct vm_area_struct *vma;
++ int err;
+
+ nodes_clear(nmask);
+ node_set(source, nmask);
+
+- vma = check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask,
++ err = check_range(mm, mm->mmap->vm_start, mm->task_size, &nmask,
+ flags | MPOL_MF_DISCONTIG_OK, &pagelist);
+- if (IS_ERR(vma))
+- return PTR_ERR(vma);
++ if (err)
++ return err;
+
+ if (!list_empty(&pagelist)) {
+ err = migrate_pages(&pagelist, new_node_page, dest,
+@@ -1058,16 +1055,17 @@ out:
+
+ /*
+ * Allocate a new page for page migration based on vma policy.
+- * Start assuming that page is mapped by vma pointed to by @private.
++ * Start by assuming the page is mapped by the same vma as contains @start.
+ * Search forward from there, if not. N.B., this assumes that the
+ * list of pages handed to migrate_pages()--which is how we get here--
+ * is in virtual address order.
+ */
+-static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
++static struct page *new_page(struct page *page, unsigned long start, int **x)
+ {
+- struct vm_area_struct *vma = (struct vm_area_struct *)private;
++ struct vm_area_struct *vma;
+ unsigned long uninitialized_var(address);
+
++ vma = find_vma(current->mm, start);
+ while (vma) {
+ address = page_address_in_vma(page, vma);
+ if (address != -EFAULT)
+@@ -1093,7 +1091,7 @@ int do_migrate_pages(struct mm_struct *mm,
+ return -ENOSYS;
+ }
+
+-static struct page *new_vma_page(struct page *page, unsigned long private, int **x)
++static struct page *new_page(struct page *page, unsigned long start, int **x)
+ {
+ return NULL;
+ }
+@@ -1103,7 +1101,6 @@ static long do_mbind(unsigned long start, unsigned long len,
+ unsigned short mode, unsigned short mode_flags,
+ nodemask_t *nmask, unsigned long flags)
+ {
+- struct vm_area_struct *vma;
+ struct mm_struct *mm = current->mm;
+ struct mempolicy *new;
+ unsigned long end;
+@@ -1167,19 +1164,17 @@ static long do_mbind(unsigned long start, unsigned long len,
+ if (err)
+ goto mpol_out;
+
+- vma = check_range(mm, start, end, nmask,
++ err = check_range(mm, start, end, nmask,
+ flags | MPOL_MF_INVERT, &pagelist);
+
+- err = PTR_ERR(vma);
+- if (!IS_ERR(vma)) {
++ if (!err) {
+ int nr_failed = 0;
+
+ err = mbind_range(mm, start, end, new);
+
+ if (!list_empty(&pagelist)) {
+- nr_failed = migrate_pages(&pagelist, new_vma_page,
+- (unsigned long)vma,
+- false, true);
++ nr_failed = migrate_pages(&pagelist, new_page,
++ start, false, true);
+ if (nr_failed)
+ putback_lru_pages(&pagelist);
+ }
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index 39b2baf6c1d5..70bdb7d1d6df 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -224,22 +224,6 @@ void hci_le_start_enc(struct hci_conn *conn, __le16 ediv, __u8 rand[8],
+ }
+ EXPORT_SYMBOL(hci_le_start_enc);
+
+-void hci_le_ltk_reply(struct hci_conn *conn, u8 ltk[16])
+-{
+- struct hci_dev *hdev = conn->hdev;
+- struct hci_cp_le_ltk_reply cp;
+-
+- BT_DBG("%p", conn);
+-
+- memset(&cp, 0, sizeof(cp));
+-
+- cp.handle = cpu_to_le16(conn->handle);
+- memcpy(cp.ltk, ltk, sizeof(ltk));
+-
+- hci_send_cmd(hdev, HCI_OP_LE_LTK_REPLY, sizeof(cp), &cp);
+-}
+-EXPORT_SYMBOL(hci_le_ltk_reply);
+-
+ void hci_le_ltk_neg_reply(struct hci_conn *conn)
+ {
+ struct hci_dev *hdev = conn->hdev;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 21b2de18c3b7..04bff67d5efc 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -3156,8 +3156,11 @@ static inline void hci_user_confirm_request_evt(struct hci_dev *hdev,
+
+ /* If we're not the initiators request authorization to
+ * proceed from user space (mgmt_user_confirm with
+- * confirm_hint set to 1). */
+- if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags)) {
++ * confirm_hint set to 1). The exception is if neither
++ * side had MITM in which case we do auto-accept.
++ */
++ if (!test_bit(HCI_CONN_AUTH_PEND, &conn->flags) &&
++ (loc_mitm || rem_mitm)) {
+ BT_DBG("Confirming auto-accept as acceptor");
+ confirm_hint = 1;
+ goto confirm;
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 30f99c344847..d5404cc0248d 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -33,8 +33,7 @@ static ssize_t ieee80211_if_read(
+ ssize_t ret = -EINVAL;
+
+ read_lock(&dev_base_lock);
+- if (sdata->dev->reg_state == NETREG_REGISTERED)
+- ret = (*format)(sdata, buf, sizeof(buf));
++ ret = (*format)(sdata, buf, sizeof(buf));
+ read_unlock(&dev_base_lock);
+
+ if (ret >= 0)
+@@ -61,8 +60,7 @@ static ssize_t ieee80211_if_write(
+
+ ret = -ENODEV;
+ rtnl_lock();
+- if (sdata->dev->reg_state == NETREG_REGISTERED)
+- ret = (*write)(sdata, buf, count);
++ ret = (*write)(sdata, buf, count);
+ rtnl_unlock();
+
+ return ret;
+diff --git a/tools/usb/ffs-test.c b/tools/usb/ffs-test.c
+index 8674b9ec14f6..b3dbf8e1ff05 100644
+--- a/tools/usb/ffs-test.c
++++ b/tools/usb/ffs-test.c
+@@ -116,8 +116,8 @@ static const struct {
+ .header = {
+ .magic = cpu_to_le32(FUNCTIONFS_DESCRIPTORS_MAGIC),
+ .length = cpu_to_le32(sizeof descriptors),
+- .fs_count = 3,
+- .hs_count = 3,
++ .fs_count = cpu_to_le32(3),
++ .hs_count = cpu_to_le32(3),
+ },
+ .fs_descs = {
+ .intf = {
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-07-07 23:51 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-07-07 23:51 UTC (permalink / raw
To: gentoo-commits
commit: 713c343a0ce53d7ca7edf8a0177795d066f151c6
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Jul 7 23:49:15 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Jul 7 23:49:15 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=713c343a
Linux patch 3.4.97
---
0000_README | 4 +
1096_linux-3.4.97.patch | 552 ++++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 556 insertions(+)
diff --git a/0000_README b/0000_README
index a4ce565..bacfd0f 100644
--- a/0000_README
+++ b/0000_README
@@ -423,6 +423,10 @@ Patch: 1095_linux-3.4.96.patch
From: http://www.kernel.org
Desc: Linux 3.4.96
+Patch: 1096_linux-3.4.97.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.97
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1096_linux-3.4.97.patch b/1096_linux-3.4.97.patch
new file mode 100644
index 0000000..6007072
--- /dev/null
+++ b/1096_linux-3.4.97.patch
@@ -0,0 +1,552 @@
+diff --git a/Makefile b/Makefile
+index e4ecdedbfe27..fdd7c32ea1f7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 96
++SUBLEVEL = 97
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
+index 14ac52c5ae86..884de3433ad7 100644
+--- a/arch/mips/kernel/irq-msc01.c
++++ b/arch/mips/kernel/irq-msc01.c
+@@ -131,7 +131,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma
+
+ board_bind_eic_interrupt = &msc_bind_eic_interrupt;
+
+- for (; nirq >= 0; nirq--, imp++) {
++ for (; nirq > 0; nirq--, imp++) {
+ int n = imp->im_irq;
+
+ switch (imp->im_type) {
+diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
+index e7dba0b2a170..eb6b72faec0d 100644
+--- a/arch/powerpc/kernel/time.c
++++ b/arch/powerpc/kernel/time.c
+@@ -496,7 +496,7 @@ void timer_interrupt(struct pt_regs * regs)
+
+ __get_cpu_var(irq_stat).timer_irqs++;
+
+-#if defined(CONFIG_PPC32) && defined(CONFIG_PMAC)
++#if defined(CONFIG_PPC32) && defined(CONFIG_PPC_PMAC)
+ if (atomic_read(&ppc_n_lost_interrupts) != 0)
+ do_IRQ(regs);
+ #endif
+diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
+index 9a52349874ee..e3b28e34bd78 100644
+--- a/arch/powerpc/lib/sstep.c
++++ b/arch/powerpc/lib/sstep.c
+@@ -1395,7 +1395,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
+ regs->gpr[rd] = byterev_4(val);
+ goto ldst_done;
+
+-#ifdef CONFIG_PPC_CPU
++#ifdef CONFIG_PPC_FPU
+ case 535: /* lfsx */
+ case 567: /* lfsux */
+ if (!(regs->msr & MSR_FP))
+diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
+index 8a811d98a795..9c9e24512f28 100644
+--- a/arch/powerpc/platforms/pseries/eeh_pseries.c
++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
+@@ -319,6 +319,7 @@ static int pseries_eeh_get_state(struct device_node *dn, int *state)
+ } else {
+ result = EEH_STATE_NOT_SUPPORT;
+ }
++ break;
+ default:
+ result = EEH_STATE_NOT_SUPPORT;
+ }
+diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
+index 19f16ebaf4fa..0b60cd9dcf16 100644
+--- a/arch/x86/include/asm/ptrace.h
++++ b/arch/x86/include/asm/ptrace.h
+@@ -286,6 +286,22 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
+
+ #define ARCH_HAS_USER_SINGLE_STEP_INFO
+
++/*
++ * When hitting ptrace_stop(), we cannot return using SYSRET because
++ * that does not restore the full CPU state, only a minimal set. The
++ * ptracer can change arbitrary register values, which is usually okay
++ * because the usual ptrace stops run off the signal delivery path which
++ * forces IRET; however, ptrace_event() stops happen in arbitrary places
++ * in the kernel and don't force IRET path.
++ *
++ * So force IRET path after a ptrace stop.
++ */
++#define arch_ptrace_stop_needed(code, info) \
++({ \
++ set_thread_flag(TIF_NOTIFY_RESUME); \
++ false; \
++})
++
+ struct user_desc;
+ extern int do_get_thread_area(struct task_struct *p, int idx,
+ struct user_desc __user *info);
+diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
+index f0d588f8859e..1acb99100556 100644
+--- a/drivers/infiniband/core/user_mad.c
++++ b/drivers/infiniband/core/user_mad.c
+@@ -98,7 +98,7 @@ struct ib_umad_port {
+
+ struct ib_umad_device {
+ int start_port, end_port;
+- struct kref ref;
++ struct kobject kobj;
+ struct ib_umad_port port[0];
+ };
+
+@@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS);
+ static void ib_umad_add_one(struct ib_device *device);
+ static void ib_umad_remove_one(struct ib_device *device);
+
+-static void ib_umad_release_dev(struct kref *ref)
++static void ib_umad_release_dev(struct kobject *kobj)
+ {
+ struct ib_umad_device *dev =
+- container_of(ref, struct ib_umad_device, ref);
++ container_of(kobj, struct ib_umad_device, kobj);
+
+ kfree(dev);
+ }
+
++static struct kobj_type ib_umad_dev_ktype = {
++ .release = ib_umad_release_dev,
++};
++
+ static int hdr_size(struct ib_umad_file *file)
+ {
+ return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) :
+@@ -780,27 +784,19 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
+ {
+ struct ib_umad_port *port;
+ struct ib_umad_file *file;
+- int ret;
++ int ret = -ENXIO;
+
+ port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
+- if (port)
+- kref_get(&port->umad_dev->ref);
+- else
+- return -ENXIO;
+
+ mutex_lock(&port->file_mutex);
+
+- if (!port->ib_dev) {
+- ret = -ENXIO;
++ if (!port->ib_dev)
+ goto out;
+- }
+
++ ret = -ENOMEM;
+ file = kzalloc(sizeof *file, GFP_KERNEL);
+- if (!file) {
+- kref_put(&port->umad_dev->ref, ib_umad_release_dev);
+- ret = -ENOMEM;
++ if (!file)
+ goto out;
+- }
+
+ mutex_init(&file->mutex);
+ spin_lock_init(&file->send_lock);
+@@ -814,6 +810,13 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
+ list_add_tail(&file->port_list, &port->file_list);
+
+ ret = nonseekable_open(inode, filp);
++ if (ret) {
++ list_del(&file->port_list);
++ kfree(file);
++ goto out;
++ }
++
++ kobject_get(&port->umad_dev->kobj);
+
+ out:
+ mutex_unlock(&port->file_mutex);
+@@ -852,7 +855,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp)
+ mutex_unlock(&file->port->file_mutex);
+
+ kfree(file);
+- kref_put(&dev->ref, ib_umad_release_dev);
++ kobject_put(&dev->kobj);
+
+ return 0;
+ }
+@@ -880,10 +883,6 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
+ int ret;
+
+ port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev);
+- if (port)
+- kref_get(&port->umad_dev->ref);
+- else
+- return -ENXIO;
+
+ if (filp->f_flags & O_NONBLOCK) {
+ if (down_trylock(&port->sm_sem)) {
+@@ -898,17 +897,27 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
+ }
+
+ ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props);
+- if (ret) {
+- up(&port->sm_sem);
+- goto fail;
+- }
++ if (ret)
++ goto err_up_sem;
+
+ filp->private_data = port;
+
+- return nonseekable_open(inode, filp);
++ ret = nonseekable_open(inode, filp);
++ if (ret)
++ goto err_clr_sm_cap;
++
++ kobject_get(&port->umad_dev->kobj);
++
++ return 0;
++
++err_clr_sm_cap:
++ swap(props.set_port_cap_mask, props.clr_port_cap_mask);
++ ib_modify_port(port->ib_dev, port->port_num, 0, &props);
++
++err_up_sem:
++ up(&port->sm_sem);
+
+ fail:
+- kref_put(&port->umad_dev->ref, ib_umad_release_dev);
+ return ret;
+ }
+
+@@ -927,7 +936,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp)
+
+ up(&port->sm_sem);
+
+- kref_put(&port->umad_dev->ref, ib_umad_release_dev);
++ kobject_put(&port->umad_dev->kobj);
+
+ return ret;
+ }
+@@ -995,6 +1004,7 @@ static int find_overflow_devnum(void)
+ }
+
+ static int ib_umad_init_port(struct ib_device *device, int port_num,
++ struct ib_umad_device *umad_dev,
+ struct ib_umad_port *port)
+ {
+ int devnum;
+@@ -1027,6 +1037,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
+
+ cdev_init(&port->cdev, &umad_fops);
+ port->cdev.owner = THIS_MODULE;
++ port->cdev.kobj.parent = &umad_dev->kobj;
+ kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num);
+ if (cdev_add(&port->cdev, base, 1))
+ goto err_cdev;
+@@ -1045,6 +1056,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
+ base += IB_UMAD_MAX_PORTS;
+ cdev_init(&port->sm_cdev, &umad_sm_fops);
+ port->sm_cdev.owner = THIS_MODULE;
++ port->sm_cdev.kobj.parent = &umad_dev->kobj;
+ kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num);
+ if (cdev_add(&port->sm_cdev, base, 1))
+ goto err_sm_cdev;
+@@ -1138,7 +1150,7 @@ static void ib_umad_add_one(struct ib_device *device)
+ if (!umad_dev)
+ return;
+
+- kref_init(&umad_dev->ref);
++ kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype);
+
+ umad_dev->start_port = s;
+ umad_dev->end_port = e;
+@@ -1146,7 +1158,8 @@ static void ib_umad_add_one(struct ib_device *device)
+ for (i = s; i <= e; ++i) {
+ umad_dev->port[i - s].umad_dev = umad_dev;
+
+- if (ib_umad_init_port(device, i, &umad_dev->port[i - s]))
++ if (ib_umad_init_port(device, i, umad_dev,
++ &umad_dev->port[i - s]))
+ goto err;
+ }
+
+@@ -1158,7 +1171,7 @@ err:
+ while (--i >= s)
+ ib_umad_kill_port(&umad_dev->port[i - s]);
+
+- kref_put(&umad_dev->ref, ib_umad_release_dev);
++ kobject_put(&umad_dev->kobj);
+ }
+
+ static void ib_umad_remove_one(struct ib_device *device)
+@@ -1172,7 +1185,7 @@ static void ib_umad_remove_one(struct ib_device *device)
+ for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i)
+ ib_umad_kill_port(&umad_dev->port[i]);
+
+- kref_put(&umad_dev->ref, ib_umad_release_dev);
++ kobject_put(&umad_dev->kobj);
+ }
+
+ static char *umad_devnode(struct device *dev, umode_t *mode)
+diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
+index e2f9a51f4a38..45802e97332e 100644
+--- a/drivers/infiniband/hw/ipath/ipath_diag.c
++++ b/drivers/infiniband/hw/ipath/ipath_diag.c
+@@ -346,6 +346,10 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
+ ret = -EFAULT;
+ goto bail;
+ }
++ dp.len = odp.len;
++ dp.unit = odp.unit;
++ dp.data = odp.data;
++ dp.pbc_wd = 0;
+ } else {
+ ret = -EINVAL;
+ goto bail;
+diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
+index c4ff788823b5..14f39298cb97 100644
+--- a/drivers/infiniband/hw/qib/qib_mad.c
++++ b/drivers/infiniband/hw/qib/qib_mad.c
+@@ -1005,7 +1005,7 @@ static int set_pkeys(struct qib_devdata *dd, u8 port, u16 *pkeys)
+
+ event.event = IB_EVENT_PKEY_CHANGE;
+ event.device = &dd->verbs_dev.ibdev;
+- event.element.port_num = 1;
++ event.element.port_num = port;
+ ib_dispatch_event(&event);
+ }
+ return 0;
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 922d845f76b0..7fa948d7a867 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -1371,6 +1371,12 @@ err_unmap:
+ err_iu:
+ srp_put_tx_iu(target, iu, SRP_IU_CMD);
+
++ /*
++ * Avoid that the loops that iterate over the request ring can
++ * encounter a dangling SCSI command pointer.
++ */
++ req->scmnd = NULL;
++
+ spin_lock_irqsave(&target->lock, flags);
+ list_add(&req->list, &target->free_reqs);
+
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 9bdc3b8597a4..d93ea6417d15 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -472,8 +472,15 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse,
+ input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
+ input_report_key(dev, BTN_TOOL_DOUBLETAP, fingers == 2);
+ input_report_key(dev, BTN_TOOL_TRIPLETAP, fingers == 3);
+- input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
+- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
++
++ /* For clickpads map both buttons to BTN_LEFT */
++ if (etd->fw_version & 0x001000) {
++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03);
++ } else {
++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
++ }
++
+ input_report_abs(dev, ABS_PRESSURE, pres);
+ input_report_abs(dev, ABS_TOOL_WIDTH, width);
+
+@@ -483,10 +490,17 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse,
+ static void elantech_input_sync_v4(struct psmouse *psmouse)
+ {
+ struct input_dev *dev = psmouse->dev;
++ struct elantech_data *etd = psmouse->private;
+ unsigned char *packet = psmouse->packet;
+
+- input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
+- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
++ /* For clickpads map both buttons to BTN_LEFT */
++ if (etd->fw_version & 0x001000) {
++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03);
++ } else {
++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
++ }
++
+ input_mt_report_pointer_emulation(dev, true);
+ input_sync(dev);
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index a7f6dcea0d76..4cdd2bc21403 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3610,7 +3610,7 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode,
+ u16 cmd;
+ int rc;
+
+- WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) & (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY)));
++ WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) && (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY)));
+
+ /* ARCH specific VGA enables */
+ rc = pci_set_vga_state_arch(dev, decode, command_bits, flags);
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index 103c95e300fd..61bc33ed1116 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -2921,6 +2921,7 @@ static void __devinit disable_igfx_irq(struct pci_dev *dev)
+ }
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
+ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
+
+ static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
+ struct pci_fixup *end)
+diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
+index bbb170e50055..a3b97e0c98df 100644
+--- a/drivers/watchdog/sp805_wdt.c
++++ b/drivers/watchdog/sp805_wdt.c
+@@ -62,7 +62,6 @@
+ * @adev: amba device structure of wdt
+ * @status: current status of wdt
+ * @load_val: load value to be set for current timeout
+- * @timeout: current programmed timeout
+ */
+ struct sp805_wdt {
+ spinlock_t lock;
+@@ -73,7 +72,6 @@ struct sp805_wdt {
+ #define WDT_BUSY 0
+ #define WDT_CAN_BE_CLOSED 1
+ unsigned int load_val;
+- unsigned int timeout;
+ };
+
+ /* local variables */
+@@ -101,7 +99,7 @@ static void wdt_setload(unsigned int timeout)
+ spin_lock(&wdt->lock);
+ wdt->load_val = load;
+ /* roundup timeout to closest positive integer value */
+- wdt->timeout = div_u64((load + 1) * 2 + (rate / 2), rate);
++ wdd->timeout = div_u64((load + 1) * 2 + (rate / 2), rate);
+ spin_unlock(&wdt->lock);
+ }
+
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 28e5648c9cc4..a4b87c69fbbb 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3485,7 +3485,7 @@ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
+ * correspondance, and we have to delete the lockowner when we
+ * delete the lock stateid:
+ */
+- unhash_lockowner(lo);
++ release_lockowner(lo);
+ return nfs_ok;
+ }
+
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 6eaa2e2335dc..ba7bf4a11855 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -2032,8 +2032,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
+ err = vfs_getattr(exp->ex_path.mnt, dentry, &stat);
+ if (err)
+ goto out_nfserr;
+- if ((bmval0 & (FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL |
+- FATTR4_WORD0_MAXNAME)) ||
++ if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
++ FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
+ (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
+ FATTR4_WORD1_SPACE_TOTAL))) {
+ err = vfs_statfs(&path, &statfs);
+diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
+index 9e1d05666fed..e0a7a764a903 100644
+--- a/fs/ubifs/shrinker.c
++++ b/fs/ubifs/shrinker.c
+@@ -128,7 +128,6 @@ static int shrink_tnc(struct ubifs_info *c, int nr, int age, int *contention)
+ freed = ubifs_destroy_tnc_subtree(znode);
+ atomic_long_sub(freed, &ubifs_clean_zn_cnt);
+ atomic_long_sub(freed, &c->clean_zn_cnt);
+- ubifs_assert(atomic_long_read(&c->clean_zn_cnt) >= 0);
+ total_freed += freed;
+ znode = zprev;
+ }
+diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
+index 5c719627c2aa..ed12724901bc 100644
+--- a/include/linux/ptrace.h
++++ b/include/linux/ptrace.h
+@@ -379,6 +379,9 @@ static inline void user_single_step_siginfo(struct task_struct *tsk,
+ * calling arch_ptrace_stop() when it would be superfluous. For example,
+ * if the thread has not been back to user mode since the last stop, the
+ * thread state might indicate that nothing needs to be done.
++ *
++ * This is guaranteed to be invoked once before a task stops for ptrace and
++ * may include arch-specific operations necessary prior to a ptrace stop.
+ */
+ #define arch_ptrace_stop_needed(code, info) (0)
+ #endif
+diff --git a/include/trace/syscall.h b/include/trace/syscall.h
+index 31966a4fb8cc..51b72d8a8498 100644
+--- a/include/trace/syscall.h
++++ b/include/trace/syscall.h
+@@ -4,6 +4,7 @@
+ #include <linux/tracepoint.h>
+ #include <linux/unistd.h>
+ #include <linux/ftrace_event.h>
++#include <linux/thread_info.h>
+
+ #include <asm/ptrace.h>
+
+@@ -54,4 +55,18 @@ int perf_sysexit_enable(struct ftrace_event_call *call);
+ void perf_sysexit_disable(struct ftrace_event_call *call);
+ #endif
+
++#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS)
++static inline void syscall_tracepoint_update(struct task_struct *p)
++{
++ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
++ set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
++ else
++ clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
++}
++#else
++static inline void syscall_tracepoint_update(struct task_struct *p)
++{
++}
++#endif
++
+ #endif /* _TRACE_SYSCALL_H */
+diff --git a/kernel/fork.c b/kernel/fork.c
+index afac42b8889c..621c547dabb1 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1441,7 +1441,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
+
+ total_forks++;
+ spin_unlock(¤t->sighand->siglock);
++ syscall_tracepoint_update(p);
+ write_unlock_irq(&tasklist_lock);
++
+ proc_fork_connector(p);
+ cgroup_post_fork(p);
+ if (clone_flags & CLONE_THREAD)
+diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
+index 54e35c1e5948..5e29610303b0 100644
+--- a/scripts/recordmcount.h
++++ b/scripts/recordmcount.h
+@@ -163,11 +163,11 @@ static int mcount_adjust = 0;
+
+ static int MIPS_is_fake_mcount(Elf_Rel const *rp)
+ {
+- static Elf_Addr old_r_offset;
++ static Elf_Addr old_r_offset = ~(Elf_Addr)0;
+ Elf_Addr current_r_offset = _w(rp->r_offset);
+ int is_fake;
+
+- is_fake = old_r_offset &&
++ is_fake = (old_r_offset != ~(Elf_Addr)0) &&
+ (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET);
+ old_r_offset = current_r_offset;
+
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-07-01 16:08 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-07-01 16:08 UTC (permalink / raw
To: gentoo-commits
commit: 4cfc1e2967b4fbddf2d3fc251cdb8ee10b62ccd5
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Jul 1 16:06:53 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Jul 1 16:06:53 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=4cfc1e29
Linux patch 3.4.96
---
0000_README | 4 +
1095_linux-3.4.96.patch | 1326 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 1330 insertions(+)
diff --git a/0000_README b/0000_README
index 1db991a..a4ce565 100644
--- a/0000_README
+++ b/0000_README
@@ -419,6 +419,10 @@ Patch: 1094_linux-3.4.95.patch
From: http://www.kernel.org
Desc: Linux 3.4.95
+Patch: 1095_linux-3.4.96.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.96
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1095_linux-3.4.96.patch b/1095_linux-3.4.96.patch
new file mode 100644
index 0000000..8c229d5
--- /dev/null
+++ b/1095_linux-3.4.96.patch
@@ -0,0 +1,1326 @@
+diff --git a/Makefile b/Makefile
+index fda1dab589be..e4ecdedbfe27 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 95
++SUBLEVEL = 96
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/kernel/stacktrace.c b/arch/arm/kernel/stacktrace.c
+index af4e8c8a5422..6582c4adc182 100644
+--- a/arch/arm/kernel/stacktrace.c
++++ b/arch/arm/kernel/stacktrace.c
+@@ -83,13 +83,16 @@ static int save_trace(struct stackframe *frame, void *d)
+ return trace->nr_entries >= trace->max_entries;
+ }
+
+-void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
++/* This must be noinline to so that our skip calculation works correctly */
++static noinline void __save_stack_trace(struct task_struct *tsk,
++ struct stack_trace *trace, unsigned int nosched)
+ {
+ struct stack_trace_data data;
+ struct stackframe frame;
+
+ data.trace = trace;
+ data.skip = trace->skip;
++ data.no_sched_functions = nosched;
+
+ if (tsk != current) {
+ #ifdef CONFIG_SMP
+@@ -102,7 +105,6 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+ trace->entries[trace->nr_entries++] = ULONG_MAX;
+ return;
+ #else
+- data.no_sched_functions = 1;
+ frame.fp = thread_saved_fp(tsk);
+ frame.sp = thread_saved_sp(tsk);
+ frame.lr = 0; /* recovered from the stack */
+@@ -111,11 +113,12 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+ } else {
+ register unsigned long current_sp asm ("sp");
+
+- data.no_sched_functions = 0;
++ /* We don't want this function nor the caller */
++ data.skip += 2;
+ frame.fp = (unsigned long)__builtin_frame_address(0);
+ frame.sp = current_sp;
+ frame.lr = (unsigned long)__builtin_return_address(0);
+- frame.pc = (unsigned long)save_stack_trace_tsk;
++ frame.pc = (unsigned long)__save_stack_trace;
+ }
+
+ walk_stackframe(&frame, save_trace, &data);
+@@ -123,9 +126,14 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
+ trace->entries[trace->nr_entries++] = ULONG_MAX;
+ }
+
++void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace)
++{
++ __save_stack_trace(tsk, trace, 1);
++}
++
+ void save_stack_trace(struct stack_trace *trace)
+ {
+- save_stack_trace_tsk(current, trace);
++ __save_stack_trace(current, trace, 0);
+ }
+ EXPORT_SYMBOL_GPL(save_stack_trace);
+ #endif
+diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
+index 47853debb3b9..025415e7346a 100644
+--- a/arch/s390/include/asm/lowcore.h
++++ b/arch/s390/include/asm/lowcore.h
+@@ -142,9 +142,9 @@ struct _lowcore {
+ __u8 pad_0x02fc[0x0300-0x02fc]; /* 0x02fc */
+
+ /* Interrupt response block */
+- __u8 irb[64]; /* 0x0300 */
++ __u8 irb[96]; /* 0x0300 */
+
+- __u8 pad_0x0340[0x0e00-0x0340]; /* 0x0340 */
++ __u8 pad_0x0360[0x0e00-0x0360]; /* 0x0360 */
+
+ /*
+ * 0xe00 contains the address of the IPL Parameter Information
+@@ -288,12 +288,13 @@ struct _lowcore {
+ __u8 pad_0x03a0[0x0400-0x03a0]; /* 0x03a0 */
+
+ /* Interrupt response block. */
+- __u8 irb[64]; /* 0x0400 */
++ __u8 irb[96]; /* 0x0400 */
++ __u8 pad_0x0460[0x0480-0x0460]; /* 0x0460 */
+
+ /* Per cpu primary space access list */
+- __u32 paste[16]; /* 0x0440 */
++ __u32 paste[16]; /* 0x0480 */
+
+- __u8 pad_0x0480[0x0e00-0x0480]; /* 0x0480 */
++ __u8 pad_0x04c0[0x0e00-0x04c0]; /* 0x04c0 */
+
+ /*
+ * 0xe00 contains the address of the IPL Parameter Information
+diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
+index 2af4ccd88d16..e1e7f9c831da 100644
+--- a/arch/x86/kernel/entry_32.S
++++ b/arch/x86/kernel/entry_32.S
+@@ -426,9 +426,10 @@ sysenter_past_esp:
+ jnz sysenter_audit
+ sysenter_do_call:
+ cmpl $(NR_syscalls), %eax
+- jae syscall_badsys
++ jae sysenter_badsys
+ call *sys_call_table(,%eax,4)
+ movl %eax,PT_EAX(%esp)
++sysenter_after_call:
+ LOCKDEP_SYS_EXIT
+ DISABLE_INTERRUPTS(CLBR_ANY)
+ TRACE_IRQS_OFF
+@@ -550,11 +551,6 @@ ENTRY(iret_exc)
+
+ CFI_RESTORE_STATE
+ ldt_ss:
+- larl PT_OLDSS(%esp), %eax
+- jnz restore_nocheck
+- testl $0x00400000, %eax # returning to 32bit stack?
+- jnz restore_nocheck # allright, normal return
+-
+ #ifdef CONFIG_PARAVIRT
+ /*
+ * The kernel can't run on a non-flat stack if paravirt mode
+@@ -683,7 +679,12 @@ END(syscall_fault)
+
+ syscall_badsys:
+ movl $-ENOSYS,PT_EAX(%esp)
+- jmp resume_userspace
++ jmp syscall_exit
++END(syscall_badsys)
++
++sysenter_badsys:
++ movl $-ENOSYS,PT_EAX(%esp)
++ jmp sysenter_after_call
+ END(syscall_badsys)
+ CFI_ENDPROC
+ /*
+diff --git a/arch/x86/syscalls/syscall_64.tbl b/arch/x86/syscalls/syscall_64.tbl
+index fd1f10348130..b6c54909d361 100644
+--- a/arch/x86/syscalls/syscall_64.tbl
++++ b/arch/x86/syscalls/syscall_64.tbl
+@@ -212,10 +212,10 @@
+ 203 common sched_setaffinity sys_sched_setaffinity
+ 204 common sched_getaffinity sys_sched_getaffinity
+ 205 64 set_thread_area
+-206 common io_setup sys_io_setup
++206 64 io_setup sys_io_setup
+ 207 common io_destroy sys_io_destroy
+ 208 common io_getevents sys_io_getevents
+-209 common io_submit sys_io_submit
++209 64 io_submit sys_io_submit
+ 210 common io_cancel sys_io_cancel
+ 211 64 get_thread_area
+ 212 common lookup_dcookie sys_lookup_dcookie
+@@ -353,3 +353,5 @@
+ 540 x32 process_vm_writev compat_sys_process_vm_writev
+ 541 x32 setsockopt compat_sys_setsockopt
+ 542 x32 getsockopt compat_sys_getsockopt
++543 x32 io_setup compat_sys_io_setup
++544 x32 io_submit compat_sys_io_submit
+diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
+index 0bf5ec2d5818..06d2d22281b2 100644
+--- a/drivers/acpi/bus.c
++++ b/drivers/acpi/bus.c
+@@ -57,6 +57,12 @@ EXPORT_SYMBOL(acpi_root_dir);
+
+
+ #ifdef CONFIG_X86
++#ifdef CONFIG_ACPI_CUSTOM_DSDT
++static inline int set_copy_dsdt(const struct dmi_system_id *id)
++{
++ return 0;
++}
++#else
+ static int set_copy_dsdt(const struct dmi_system_id *id)
+ {
+ printk(KERN_NOTICE "%s detected - "
+@@ -64,6 +70,7 @@ static int set_copy_dsdt(const struct dmi_system_id *id)
+ acpi_gbl_copy_dsdt_locally = 1;
+ return 0;
+ }
++#endif
+
+ static struct dmi_system_id dsdt_dmi_table[] __initdata = {
+ /*
+diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
+index 25373df1dcf8..5d069c79bd8b 100644
+--- a/drivers/char/applicom.c
++++ b/drivers/char/applicom.c
+@@ -345,7 +345,6 @@ out:
+ free_irq(apbs[i].irq, &dummy);
+ iounmap(apbs[i].RamIO);
+ }
+- pci_disable_device(dev);
+ return ret;
+ }
+
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index 230f435c7ad8..75fa2e7b87b5 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -861,7 +861,17 @@ struct hid_report *hid_validate_values(struct hid_device *hid,
+ * ->numbered being checked, which may not always be the case when
+ * drivers go to access report values.
+ */
+- report = hid->report_enum[type].report_id_hash[id];
++ if (id == 0) {
++ /*
++ * Validating on id 0 means we should examine the first
++ * report in the list.
++ */
++ report = list_entry(
++ hid->report_enum[type].report_list.next,
++ struct hid_report, list);
++ } else {
++ report = hid->report_enum[type].report_id_hash[id];
++ }
+ if (!report) {
+ hid_err(hid, "missing %s %u\n", hid_report_names[type], id);
+ return NULL;
+diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
+index 5f92b865f64b..a28c5d312447 100644
+--- a/drivers/net/can/sja1000/peak_pci.c
++++ b/drivers/net/can/sja1000/peak_pci.c
+@@ -547,7 +547,7 @@ static int __devinit peak_pci_probe(struct pci_dev *pdev,
+ {
+ struct sja1000_priv *priv;
+ struct peak_pci_chan *chan;
+- struct net_device *dev;
++ struct net_device *dev, *prev_dev;
+ void __iomem *cfg_base, *reg_base;
+ u16 sub_sys_id, icr;
+ int i, err, channels;
+@@ -681,11 +681,13 @@ failure_remove_channels:
+ writew(0x0, cfg_base + PITA_ICR + 2);
+
+ chan = NULL;
+- for (dev = pci_get_drvdata(pdev); dev; dev = chan->prev_dev) {
+- unregister_sja1000dev(dev);
+- free_sja1000dev(dev);
++ for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
+ priv = netdev_priv(dev);
+ chan = priv->priv;
++ prev_dev = chan->prev_dev;
++
++ unregister_sja1000dev(dev);
++ free_sja1000dev(dev);
+ }
+
+ /* free any PCIeC resources too */
+@@ -719,10 +721,12 @@ static void __devexit peak_pci_remove(struct pci_dev *pdev)
+
+ /* Loop over all registered devices */
+ while (1) {
++ struct net_device *prev_dev = chan->prev_dev;
++
+ dev_info(&pdev->dev, "removing device %s\n", dev->name);
+ unregister_sja1000dev(dev);
+ free_sja1000dev(dev);
+- dev = chan->prev_dev;
++ dev = prev_dev;
+
+ if (!dev) {
+ /* do that only for first channel */
+diff --git a/drivers/staging/tidspbridge/core/dsp-clock.c b/drivers/staging/tidspbridge/core/dsp-clock.c
+index c7df34e6b60b..f82581428bb0 100644
+--- a/drivers/staging/tidspbridge/core/dsp-clock.c
++++ b/drivers/staging/tidspbridge/core/dsp-clock.c
+@@ -213,7 +213,7 @@ int dsp_clk_enable(enum dsp_clk_id clk_id)
+ case GPT_CLK:
+ status = omap_dm_timer_start(timer[clk_id - 1]);
+ break;
+-#ifdef CONFIG_OMAP_MCBSP
++#ifdef CONFIG_SND_OMAP_SOC_MCBSP
+ case MCBSP_CLK:
+ omap_mcbsp_request(MCBSP_ID(clk_id));
+ omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PAD_SRC);
+@@ -289,7 +289,7 @@ int dsp_clk_disable(enum dsp_clk_id clk_id)
+ case GPT_CLK:
+ status = omap_dm_timer_stop(timer[clk_id - 1]);
+ break;
+-#ifdef CONFIG_OMAP_MCBSP
++#ifdef CONFIG_SND_OMAP_SOC_MCBSP
+ case MCBSP_CLK:
+ omap2_mcbsp_set_clks_src(MCBSP_ID(clk_id), MCBSP_CLKS_PRCM_SRC);
+ omap_mcbsp_free(MCBSP_ID(clk_id));
+diff --git a/drivers/target/target_core_rd.c b/drivers/target/target_core_rd.c
+index 8b68f7b82631..fa4e21b882a0 100644
+--- a/drivers/target/target_core_rd.c
++++ b/drivers/target/target_core_rd.c
+@@ -177,7 +177,7 @@ static int rd_build_device_space(struct rd_dev *rd_dev)
+ - 1;
+
+ for (j = 0; j < sg_per_table; j++) {
+- pg = alloc_pages(GFP_KERNEL, 0);
++ pg = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
+ if (!pg) {
+ pr_err("Unable to allocate scatterlist"
+ " pages for struct rd_dev_sg_table\n");
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index 8ed83b938a77..895497d42270 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -531,6 +531,10 @@ static int __dwc3_gadget_ep_disable(struct dwc3_ep *dep)
+
+ dwc3_remove_requests(dwc, dep);
+
++ /* make sure HW endpoint isn't stalled */
++ if (dep->flags & DWC3_EP_STALL)
++ __dwc3_gadget_ep_set_halt(dep, 0);
++
+ reg = dwc3_readl(dwc->regs, DWC3_DALEPENA);
+ reg &= ~DWC3_DALEPENA_EP(dep->number);
+ dwc3_writel(dwc->regs, DWC3_DALEPENA, reg);
+diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
+index e58b16442971..d9eaaa3b3e44 100644
+--- a/drivers/usb/gadget/inode.c
++++ b/drivers/usb/gadget/inode.c
+@@ -1499,7 +1499,7 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
+ }
+ break;
+
+-#ifndef CONFIG_USB_GADGET_PXA25X
++#ifndef CONFIG_USB_PXA25X
+ /* PXA automagically handles this request too */
+ case USB_REQ_GET_CONFIGURATION:
+ if (ctrl->bRequestType != 0x80)
+diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
+index 78933512c18b..90dcf54cd7e8 100644
+--- a/drivers/usb/host/pci-quirks.c
++++ b/drivers/usb/host/pci-quirks.c
+@@ -555,6 +555,14 @@ static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = {
+ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"),
+ },
+ },
++ {
++ /* HASEE E200 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "HASEE"),
++ DMI_MATCH(DMI_BOARD_NAME, "E210"),
++ DMI_MATCH(DMI_BIOS_VERSION, "6.00"),
++ },
++ },
+ { }
+ };
+
+@@ -564,9 +572,14 @@ static void __devinit ehci_bios_handoff(struct pci_dev *pdev,
+ {
+ int try_handoff = 1, tried_handoff = 0;
+
+- /* The Pegatron Lucid tablet sporadically waits for 98 seconds trying
+- * the handoff on its unused controller. Skip it. */
+- if (pdev->vendor == 0x8086 && pdev->device == 0x283a) {
++ /*
++ * The Pegatron Lucid tablet sporadically waits for 98 seconds trying
++ * the handoff on its unused controller. Skip it.
++ *
++ * The HASEE E200 hangs when the semaphore is set (bugzilla #77021).
++ */
++ if (pdev->vendor == 0x8086 && (pdev->device == 0x283a ||
++ pdev->device == 0x27cc)) {
+ if (dmi_check_system(ehci_dmi_nohandoff_table))
+ try_handoff = 0;
+ }
+diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
+index 055b84adedac..174be05ba2c7 100644
+--- a/drivers/usb/misc/usbtest.c
++++ b/drivers/usb/misc/usbtest.c
+@@ -7,9 +7,10 @@
+ #include <linux/moduleparam.h>
+ #include <linux/scatterlist.h>
+ #include <linux/mutex.h>
+-
++#include <linux/timer.h>
+ #include <linux/usb.h>
+
++#define SIMPLE_IO_TIMEOUT 10000 /* in milliseconds */
+
+ /*-------------------------------------------------------------------------*/
+
+@@ -355,6 +356,7 @@ static int simple_io(
+ int max = urb->transfer_buffer_length;
+ struct completion completion;
+ int retval = 0;
++ unsigned long expire;
+
+ urb->context = &completion;
+ while (retval == 0 && iterations-- > 0) {
+@@ -367,9 +369,15 @@ static int simple_io(
+ if (retval != 0)
+ break;
+
+- /* NOTE: no timeouts; can't be broken out of by interrupt */
+- wait_for_completion(&completion);
+- retval = urb->status;
++ expire = msecs_to_jiffies(SIMPLE_IO_TIMEOUT);
++ if (!wait_for_completion_timeout(&completion, expire)) {
++ usb_kill_urb(urb);
++ retval = (urb->status == -ENOENT ?
++ -ETIMEDOUT : urb->status);
++ } else {
++ retval = urb->status;
++ }
++
+ urb->dev = udev;
+ if (retval == 0 && usb_pipein(urb->pipe))
+ retval = simple_check_buf(tdev, urb);
+@@ -462,6 +470,14 @@ alloc_sglist(int nents, int max, int vary)
+ return sg;
+ }
+
++static void sg_timeout(unsigned long _req)
++{
++ struct usb_sg_request *req = (struct usb_sg_request *) _req;
++
++ req->status = -ETIMEDOUT;
++ usb_sg_cancel(req);
++}
++
+ static int perform_sglist(
+ struct usbtest_dev *tdev,
+ unsigned iterations,
+@@ -473,6 +489,9 @@ static int perform_sglist(
+ {
+ struct usb_device *udev = testdev_to_usbdev(tdev);
+ int retval = 0;
++ struct timer_list sg_timer;
++
++ setup_timer_on_stack(&sg_timer, sg_timeout, (unsigned long) req);
+
+ while (retval == 0 && iterations-- > 0) {
+ retval = usb_sg_init(req, udev, pipe,
+@@ -483,7 +502,10 @@ static int perform_sglist(
+
+ if (retval)
+ break;
++ mod_timer(&sg_timer, jiffies +
++ msecs_to_jiffies(SIMPLE_IO_TIMEOUT));
+ usb_sg_wait(req);
++ del_timer_sync(&sg_timer);
+ retval = req->status;
+
+ /* FIXME check resulting data pattern */
+@@ -1135,6 +1157,11 @@ static int unlink1(struct usbtest_dev *dev, int pipe, int size, int async)
+ urb->context = &completion;
+ urb->complete = unlink1_callback;
+
++ if (usb_pipeout(urb->pipe)) {
++ simple_fill_buf(urb);
++ urb->transfer_flags |= URB_ZERO_PACKET;
++ }
++
+ /* keep the endpoint busy. there are lots of hc/hcd-internal
+ * states, and testing should get to all of them over time.
+ *
+@@ -1265,6 +1292,11 @@ static int unlink_queued(struct usbtest_dev *dev, int pipe, unsigned num,
+ unlink_queued_callback, &ctx);
+ ctx.urbs[i]->transfer_dma = buf_dma;
+ ctx.urbs[i]->transfer_flags = URB_NO_TRANSFER_DMA_MAP;
++
++ if (usb_pipeout(ctx.urbs[i]->pipe)) {
++ simple_fill_buf(ctx.urbs[i]);
++ ctx.urbs[i]->transfer_flags |= URB_ZERO_PACKET;
++ }
+ }
+
+ /* Submit all the URBs and then unlink URBs num - 4 and num - 2. */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index def9ed02bf19..f7ccfbcdbf04 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1930,6 +1930,7 @@ static int option_send_setup(struct usb_serial_port *port)
+ struct usb_wwan_port_private *portdata;
+ int ifNum = serial->interface->cur_altsetting->desc.bInterfaceNumber;
+ int val = 0;
++ int res;
+ dbg("%s", __func__);
+
+ if (is_blacklisted(ifNum, OPTION_BLACKLIST_SENDSETUP,
+@@ -1945,9 +1946,17 @@ static int option_send_setup(struct usb_serial_port *port)
+ if (portdata->rts_state)
+ val |= 0x02;
+
+- return usb_control_msg(serial->dev,
+- usb_rcvctrlpipe(serial->dev, 0),
+- 0x22, 0x21, val, ifNum, NULL, 0, USB_CTRL_SET_TIMEOUT);
++ res = usb_autopm_get_interface(serial->interface);
++ if (res)
++ return res;
++
++ res = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
++ 0x22, 0x21, val, ifNum, NULL,
++ 0, USB_CTRL_SET_TIMEOUT);
++
++ usb_autopm_put_interface(serial->interface);
++
++ return res;
+ }
+
+ MODULE_AUTHOR(DRIVER_AUTHOR);
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index 3f5e4a73ddd5..bd79d68b51c1 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -59,6 +59,7 @@ struct sierra_intf_private {
+ spinlock_t susp_lock;
+ unsigned int suspended:1;
+ int in_flight;
++ unsigned int open_ports;
+ };
+
+ static int sierra_set_power_state(struct usb_device *udev, __u16 swiState)
+@@ -801,6 +802,7 @@ static void sierra_close(struct usb_serial_port *port)
+ struct usb_serial *serial = port->serial;
+ struct sierra_port_private *portdata;
+ struct sierra_intf_private *intfdata = port->serial->private;
++ struct urb *urb;
+
+
+ dev_dbg(&port->dev, "%s\n", __func__);
+@@ -812,7 +814,6 @@ static void sierra_close(struct usb_serial_port *port)
+ if (serial->dev) {
+ mutex_lock(&serial->disc_mutex);
+ if (!serial->disconnected) {
+- serial->interface->needs_remote_wakeup = 0;
+ /* odd error handling due to pm counters */
+ if (!usb_autopm_get_interface(serial->interface))
+ sierra_send_setup(port);
+@@ -823,8 +824,21 @@ static void sierra_close(struct usb_serial_port *port)
+ mutex_unlock(&serial->disc_mutex);
+ spin_lock_irq(&intfdata->susp_lock);
+ portdata->opened = 0;
++ if (--intfdata->open_ports == 0)
++ serial->interface->needs_remote_wakeup = 0;
+ spin_unlock_irq(&intfdata->susp_lock);
+
++ for (;;) {
++ urb = usb_get_from_anchor(&portdata->delayed);
++ if (!urb)
++ break;
++ kfree(urb->transfer_buffer);
++ usb_free_urb(urb);
++ usb_autopm_put_interface_async(serial->interface);
++ spin_lock(&portdata->lock);
++ portdata->outstanding_urbs--;
++ spin_unlock(&portdata->lock);
++ }
+
+ /* Stop reading urbs */
+ sierra_stop_rx_urbs(port);
+@@ -867,23 +881,29 @@ static int sierra_open(struct tty_struct *tty, struct usb_serial_port *port)
+ usb_sndbulkpipe(serial->dev, endpoint) | USB_DIR_IN);
+
+ err = sierra_submit_rx_urbs(port, GFP_KERNEL);
+- if (err) {
+- /* get rid of everything as in close */
+- sierra_close(port);
+- /* restore balance for autopm */
+- if (!serial->disconnected)
+- usb_autopm_put_interface(serial->interface);
+- return err;
+- }
++ if (err)
++ goto err_submit;
++
+ sierra_send_setup(port);
+
+- serial->interface->needs_remote_wakeup = 1;
+ spin_lock_irq(&intfdata->susp_lock);
+ portdata->opened = 1;
++ if (++intfdata->open_ports == 1)
++ serial->interface->needs_remote_wakeup = 1;
+ spin_unlock_irq(&intfdata->susp_lock);
+ usb_autopm_put_interface(serial->interface);
+
+ return 0;
++
++err_submit:
++ sierra_stop_rx_urbs(port);
++
++ for (i = 0; i < portdata->num_in_urbs; i++) {
++ sierra_release_urb(portdata->in_urbs[i]);
++ portdata->in_urbs[i] = NULL;
++ }
++
++ return err;
+ }
+
+
+@@ -994,6 +1014,7 @@ static void sierra_release(struct usb_serial *serial)
+ portdata = usb_get_serial_port_data(port);
+ if (!portdata)
+ continue;
++ usb_set_serial_port_data(port, NULL);
+ kfree(portdata);
+ }
+ kfree(serial->private);
+@@ -1010,6 +1031,8 @@ static void stop_read_write_urbs(struct usb_serial *serial)
+ for (i = 0; i < serial->num_ports; ++i) {
+ port = serial->port[i];
+ portdata = usb_get_serial_port_data(port);
++ if (!portdata)
++ continue;
+ sierra_stop_rx_urbs(port);
+ usb_kill_anchored_urbs(&portdata->active);
+ }
+@@ -1052,6 +1075,9 @@ static int sierra_resume(struct usb_serial *serial)
+ port = serial->port[i];
+ portdata = usb_get_serial_port_data(port);
+
++ if (!portdata)
++ continue;
++
+ while ((urb = usb_get_from_anchor(&portdata->delayed))) {
+ usb_anchor_urb(urb, &portdata->active);
+ intfdata->in_flight++;
+@@ -1059,8 +1085,12 @@ static int sierra_resume(struct usb_serial *serial)
+ if (err < 0) {
+ intfdata->in_flight--;
+ usb_unanchor_urb(urb);
+- usb_scuttle_anchored_urbs(&portdata->delayed);
+- break;
++ kfree(urb->transfer_buffer);
++ usb_free_urb(urb);
++ spin_lock(&portdata->lock);
++ portdata->outstanding_urbs--;
++ spin_unlock(&portdata->lock);
++ continue;
+ }
+ }
+
+diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
+index 820436ec60e9..7e92f50965f6 100644
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -236,8 +236,10 @@ int usb_wwan_write(struct tty_struct *tty, struct usb_serial_port *port,
+ usb_pipeendpoint(this_urb->pipe), i);
+
+ err = usb_autopm_get_interface_async(port->serial->interface);
+- if (err < 0)
++ if (err < 0) {
++ clear_bit(i, &portdata->out_busy);
+ break;
++ }
+
+ /* send the data */
+ memcpy(this_urb->transfer_buffer, buf, todo);
+@@ -406,6 +408,14 @@ int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port)
+
+ dbg("%s", __func__);
+
++ if (port->interrupt_in_urb) {
++ err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
++ if (err) {
++ dev_dbg(&port->dev, "%s: submit int urb failed: %d\n",
++ __func__, err);
++ }
++ }
++
+ /* Start reading from the IN endpoint */
+ for (i = 0; i < N_IN_URB; i++) {
+ urb = portdata->in_urbs[i];
+@@ -432,12 +442,26 @@ int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port)
+ }
+ EXPORT_SYMBOL(usb_wwan_open);
+
++static void unbusy_queued_urb(struct urb *urb,
++ struct usb_wwan_port_private *portdata)
++{
++ int i;
++
++ for (i = 0; i < N_OUT_URB; i++) {
++ if (urb == portdata->out_urbs[i]) {
++ clear_bit(i, &portdata->out_busy);
++ break;
++ }
++ }
++}
++
+ void usb_wwan_close(struct usb_serial_port *port)
+ {
+ int i;
+ struct usb_serial *serial = port->serial;
+ struct usb_wwan_port_private *portdata;
+ struct usb_wwan_intf_private *intfdata = port->serial->private;
++ struct urb *urb;
+
+ dbg("%s", __func__);
+ portdata = usb_get_serial_port_data(port);
+@@ -448,10 +472,19 @@ void usb_wwan_close(struct usb_serial_port *port)
+ portdata->opened = 0;
+ spin_unlock_irq(&intfdata->susp_lock);
+
++ for (;;) {
++ urb = usb_get_from_anchor(&portdata->delayed);
++ if (!urb)
++ break;
++ unbusy_queued_urb(urb, portdata);
++ usb_autopm_put_interface_async(serial->interface);
++ }
++
+ for (i = 0; i < N_IN_URB; i++)
+ usb_kill_urb(portdata->in_urbs[i]);
+ for (i = 0; i < N_OUT_URB; i++)
+ usb_kill_urb(portdata->out_urbs[i]);
++ usb_kill_urb(port->interrupt_in_urb);
+ /* balancing - important as an error cannot be handled*/
+ usb_autopm_get_interface_no_resume(serial->interface);
+ serial->interface->needs_remote_wakeup = 0;
+@@ -527,7 +560,7 @@ static void usb_wwan_setup_urbs(struct usb_serial *serial)
+
+ int usb_wwan_startup(struct usb_serial *serial)
+ {
+- int i, j, err;
++ int i, j;
+ struct usb_serial_port *port;
+ struct usb_wwan_port_private *portdata;
+ u8 *buffer;
+@@ -560,12 +593,6 @@ int usb_wwan_startup(struct usb_serial *serial)
+ }
+
+ usb_set_serial_port_data(port, portdata);
+-
+- if (!port->interrupt_in_urb)
+- continue;
+- err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL);
+- if (err)
+- dbg("%s: submit irq_in urb failed %d", __func__, err);
+ }
+ usb_wwan_setup_urbs(serial);
+ return 0;
+@@ -645,46 +672,32 @@ EXPORT_SYMBOL(usb_wwan_release);
+ int usb_wwan_suspend(struct usb_serial *serial, pm_message_t message)
+ {
+ struct usb_wwan_intf_private *intfdata = serial->private;
+- int b;
+
+ dbg("%s entered", __func__);
+
++ spin_lock_irq(&intfdata->susp_lock);
+ if (PMSG_IS_AUTO(message)) {
+- spin_lock_irq(&intfdata->susp_lock);
+- b = intfdata->in_flight;
+- spin_unlock_irq(&intfdata->susp_lock);
+-
+- if (b)
++ if (intfdata->in_flight) {
++ spin_unlock_irq(&intfdata->susp_lock);
+ return -EBUSY;
++ }
+ }
+
+- spin_lock_irq(&intfdata->susp_lock);
+ intfdata->suspended = 1;
+ spin_unlock_irq(&intfdata->susp_lock);
++
+ stop_read_write_urbs(serial);
+
+ return 0;
+ }
+ EXPORT_SYMBOL(usb_wwan_suspend);
+
+-static void unbusy_queued_urb(struct urb *urb, struct usb_wwan_port_private *portdata)
+-{
+- int i;
+-
+- for (i = 0; i < N_OUT_URB; i++) {
+- if (urb == portdata->out_urbs[i]) {
+- clear_bit(i, &portdata->out_busy);
+- break;
+- }
+- }
+-}
+-
+-static void play_delayed(struct usb_serial_port *port)
++static int play_delayed(struct usb_serial_port *port)
+ {
+ struct usb_wwan_intf_private *data;
+ struct usb_wwan_port_private *portdata;
+ struct urb *urb;
+- int err;
++ int err = 0;
+
+ portdata = usb_get_serial_port_data(port);
+ data = port->serial->private;
+@@ -701,6 +714,8 @@ static void play_delayed(struct usb_serial_port *port)
+ break;
+ }
+ }
++
++ return err;
+ }
+
+ int usb_wwan_resume(struct usb_serial *serial)
+@@ -710,55 +725,53 @@ int usb_wwan_resume(struct usb_serial *serial)
+ struct usb_wwan_intf_private *intfdata = serial->private;
+ struct usb_wwan_port_private *portdata;
+ struct urb *urb;
+- int err = 0;
++ int err;
++ int err_count = 0;
+
+ dbg("%s entered", __func__);
+- /* get the interrupt URBs resubmitted unconditionally */
+- for (i = 0; i < serial->num_ports; i++) {
+- port = serial->port[i];
+- if (!port->interrupt_in_urb) {
+- dbg("%s: No interrupt URB for port %d", __func__, i);
+- continue;
+- }
+- err = usb_submit_urb(port->interrupt_in_urb, GFP_NOIO);
+- dbg("Submitted interrupt URB for port %d (result %d)", i, err);
+- if (err < 0) {
+- err("%s: Error %d for interrupt URB of port%d",
+- __func__, err, i);
+- goto err_out;
+- }
+- }
+
++ spin_lock_irq(&intfdata->susp_lock);
+ for (i = 0; i < serial->num_ports; i++) {
+ /* walk all ports */
+ port = serial->port[i];
+ portdata = usb_get_serial_port_data(port);
+
+ /* skip closed ports */
+- spin_lock_irq(&intfdata->susp_lock);
+- if (!portdata->opened) {
+- spin_unlock_irq(&intfdata->susp_lock);
++ if (!portdata || !portdata->opened)
+ continue;
++
++ if (port->interrupt_in_urb) {
++ err = usb_submit_urb(port->interrupt_in_urb,
++ GFP_ATOMIC);
++ if (err) {
++ dev_err(&port->dev,
++ "%s: submit int urb failed: %d\n",
++ __func__, err);
++ err_count++;
++ }
+ }
+
++ err = play_delayed(port);
++ if (err)
++ err_count++;
++
+ for (j = 0; j < N_IN_URB; j++) {
+ urb = portdata->in_urbs[j];
+ err = usb_submit_urb(urb, GFP_ATOMIC);
+ if (err < 0) {
+ err("%s: Error %d for bulk URB %d",
+ __func__, err, i);
+- spin_unlock_irq(&intfdata->susp_lock);
+- goto err_out;
++ err_count++;
+ }
+ }
+- play_delayed(port);
+- spin_unlock_irq(&intfdata->susp_lock);
+ }
+- spin_lock_irq(&intfdata->susp_lock);
+ intfdata->suspended = 0;
+ spin_unlock_irq(&intfdata->susp_lock);
+-err_out:
+- return err;
++
++ if (err_count)
++ return -EIO;
++
++ return 0;
+ }
+ EXPORT_SYMBOL(usb_wwan_resume);
+ #endif
+diff --git a/drivers/video/matrox/matroxfb_base.h b/drivers/video/matrox/matroxfb_base.h
+index 556d96ce40bf..89a8a89a5eb2 100644
+--- a/drivers/video/matrox/matroxfb_base.h
++++ b/drivers/video/matrox/matroxfb_base.h
+@@ -698,7 +698,7 @@ void matroxfb_unregister_driver(struct matroxfb_driver* drv);
+
+ #define mga_fifo(n) do {} while ((mga_inl(M_FIFOSTATUS) & 0xFF) < (n))
+
+-#define WaitTillIdle() do {} while (mga_inl(M_STATUS) & 0x10000)
++#define WaitTillIdle() do { mga_inl(M_STATUS); do {} while (mga_inl(M_STATUS) & 0x10000); } while (0)
+
+ /* code speedup */
+ #ifdef CONFIG_FB_MATROX_MILLENIUM
+diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
+index bcec06750232..9a6b24a73aae 100644
+--- a/fs/btrfs/backref.c
++++ b/fs/btrfs/backref.c
+@@ -1033,7 +1033,7 @@ static int __get_extent_inline_ref(unsigned long *ptr, struct extent_buffer *eb,
+ *out_eiref = (struct btrfs_extent_inline_ref *)(ei + 1);
+ }
+ *ptr = (unsigned long)*out_eiref;
+- if ((void *)*ptr >= (void *)ei + item_size)
++ if ((unsigned long)(*ptr) >= (unsigned long)ei + item_size)
+ return -ENOENT;
+ }
+
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index d64fda541483..24b58c7f01ef 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -1551,6 +1551,7 @@ again:
+ * shortening the size of the delalloc range we're searching
+ */
+ free_extent_state(cached_state);
++ cached_state = NULL;
+ if (!loops) {
+ unsigned long offset = (*start) & (PAGE_CACHE_SIZE - 1);
+ max_bytes = PAGE_CACHE_SIZE - offset;
+@@ -2244,7 +2245,7 @@ int end_extent_writepage(struct page *page, int err, u64 start, u64 end)
+ {
+ int uptodate = (err == 0);
+ struct extent_io_tree *tree;
+- int ret;
++ int ret = 0;
+
+ tree = &BTRFS_I(page->mapping->host)->io_tree;
+
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 06744f1e91f4..d5dc63c6bb75 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -1446,11 +1446,12 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
+ struct btrfs_fs_devices *fs_devices;
+ fs_devices = root->fs_info->fs_devices;
+ while (fs_devices) {
+- if (fs_devices->seed == cur_devices)
++ if (fs_devices->seed == cur_devices) {
++ fs_devices->seed = cur_devices->seed;
+ break;
++ }
+ fs_devices = fs_devices->seed;
+ }
+- fs_devices->seed = cur_devices->seed;
+ cur_devices->seed = NULL;
+ lock_chunks(root);
+ __btrfs_close_devices(cur_devices);
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index 2941ee6ef24f..cdfc763b313f 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -3015,7 +3015,7 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac,
+ }
+ BUG_ON(start + size <= ac->ac_o_ex.fe_logical &&
+ start > ac->ac_o_ex.fe_logical);
+- BUG_ON(size <= 0 || size > EXT4_CLUSTERS_PER_GROUP(ac->ac_sb));
++ BUG_ON(size <= 0 || size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb));
+
+ /* now prepare goal request */
+
+diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
+index 9a323d12de1c..1e1e41787cd9 100644
+--- a/include/linux/irqdesc.h
++++ b/include/linux/irqdesc.h
+@@ -27,6 +27,8 @@ struct module;
+ * @irq_count: stats field to detect stalled irqs
+ * @last_unhandled: aging timer for unhandled count
+ * @irqs_unhandled: stats field for spurious unhandled interrupts
++ * @threads_handled: stats field for deferred spurious detection of threaded handlers
++ * @threads_handled_last: comparator field for deferred spurious detection of theraded handlers
+ * @lock: locking for SMP
+ * @affinity_hint: hint to user space for preferred irq affinity
+ * @affinity_notify: context for notification of affinity changes
+@@ -52,6 +54,8 @@ struct irq_desc {
+ unsigned int irq_count; /* For detecting broken IRQs */
+ unsigned long last_unhandled; /* Aging timer for unhandled count */
+ unsigned int irqs_unhandled;
++ atomic_t threads_handled;
++ int threads_handled_last;
+ raw_spinlock_t lock;
+ struct cpumask *percpu_enabled;
+ #ifdef CONFIG_SMP
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 0884db3d315e..e22df7a4f1ab 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1674,6 +1674,22 @@ static inline void skb_orphan(struct sk_buff *skb)
+ }
+
+ /**
++ * skb_orphan_frags - orphan the frags contained in a buffer
++ * @skb: buffer to orphan frags from
++ * @gfp_mask: allocation mask for replacement pages
++ *
++ * For each frag in the SKB which needs a destructor (i.e. has an
++ * owner) create a copy of that frag and release the original
++ * page by calling the destructor.
++ */
++static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
++{
++ if (likely(!(skb_shinfo(skb)->tx_flags & SKBTX_DEV_ZEROCOPY)))
++ return 0;
++ return skb_copy_ubufs(skb, gfp_mask);
++}
++
++/**
+ * __skb_queue_purge - empty a list
+ * @list: list to empty
+ *
+diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
+index 3d1bbbcc2923..9baa6315acf5 100644
+--- a/kernel/irq/manage.c
++++ b/kernel/irq/manage.c
+@@ -809,8 +809,8 @@ static int irq_thread(void *data)
+ irq_thread_check_affinity(desc, action);
+
+ action_ret = handler_fn(desc, action);
+- if (!noirqdebug)
+- note_interrupt(action->irq, desc, action_ret);
++ if (action_ret == IRQ_HANDLED)
++ atomic_inc(&desc->threads_handled);
+
+ wake_threads_waitq(desc);
+ }
+diff --git a/kernel/irq/spurious.c b/kernel/irq/spurious.c
+index 7b5f012bde9d..febcee3c2aa9 100644
+--- a/kernel/irq/spurious.c
++++ b/kernel/irq/spurious.c
+@@ -265,21 +265,119 @@ try_misrouted_irq(unsigned int irq, struct irq_desc *desc,
+ return action && (action->flags & IRQF_IRQPOLL);
+ }
+
++#define SPURIOUS_DEFERRED 0x80000000
++
+ void note_interrupt(unsigned int irq, struct irq_desc *desc,
+ irqreturn_t action_ret)
+ {
+ if (desc->istate & IRQS_POLL_INPROGRESS)
+ return;
+
+- /* we get here again via the threaded handler */
+- if (action_ret == IRQ_WAKE_THREAD)
+- return;
+-
+ if (bad_action_ret(action_ret)) {
+ report_bad_irq(irq, desc, action_ret);
+ return;
+ }
+
++ /*
++ * We cannot call note_interrupt from the threaded handler
++ * because we need to look at the compound of all handlers
++ * (primary and threaded). Aside of that in the threaded
++ * shared case we have no serialization against an incoming
++ * hardware interrupt while we are dealing with a threaded
++ * result.
++ *
++ * So in case a thread is woken, we just note the fact and
++ * defer the analysis to the next hardware interrupt.
++ *
++ * The threaded handlers store whether they sucessfully
++ * handled an interrupt and we check whether that number
++ * changed versus the last invocation.
++ *
++ * We could handle all interrupts with the delayed by one
++ * mechanism, but for the non forced threaded case we'd just
++ * add pointless overhead to the straight hardirq interrupts
++ * for the sake of a few lines less code.
++ */
++ if (action_ret & IRQ_WAKE_THREAD) {
++ /*
++ * There is a thread woken. Check whether one of the
++ * shared primary handlers returned IRQ_HANDLED. If
++ * not we defer the spurious detection to the next
++ * interrupt.
++ */
++ if (action_ret == IRQ_WAKE_THREAD) {
++ int handled;
++ /*
++ * We use bit 31 of thread_handled_last to
++ * denote the deferred spurious detection
++ * active. No locking necessary as
++ * thread_handled_last is only accessed here
++ * and we have the guarantee that hard
++ * interrupts are not reentrant.
++ */
++ if (!(desc->threads_handled_last & SPURIOUS_DEFERRED)) {
++ desc->threads_handled_last |= SPURIOUS_DEFERRED;
++ return;
++ }
++ /*
++ * Check whether one of the threaded handlers
++ * returned IRQ_HANDLED since the last
++ * interrupt happened.
++ *
++ * For simplicity we just set bit 31, as it is
++ * set in threads_handled_last as well. So we
++ * avoid extra masking. And we really do not
++ * care about the high bits of the handled
++ * count. We just care about the count being
++ * different than the one we saw before.
++ */
++ handled = atomic_read(&desc->threads_handled);
++ handled |= SPURIOUS_DEFERRED;
++ if (handled != desc->threads_handled_last) {
++ action_ret = IRQ_HANDLED;
++ /*
++ * Note: We keep the SPURIOUS_DEFERRED
++ * bit set. We are handling the
++ * previous invocation right now.
++ * Keep it for the current one, so the
++ * next hardware interrupt will
++ * account for it.
++ */
++ desc->threads_handled_last = handled;
++ } else {
++ /*
++ * None of the threaded handlers felt
++ * responsible for the last interrupt
++ *
++ * We keep the SPURIOUS_DEFERRED bit
++ * set in threads_handled_last as we
++ * need to account for the current
++ * interrupt as well.
++ */
++ action_ret = IRQ_NONE;
++ }
++ } else {
++ /*
++ * One of the primary handlers returned
++ * IRQ_HANDLED. So we don't care about the
++ * threaded handlers on the same line. Clear
++ * the deferred detection bit.
++ *
++ * In theory we could/should check whether the
++ * deferred bit is set and take the result of
++ * the previous run into account here as
++ * well. But it's really not worth the
++ * trouble. If every other interrupt is
++ * handled we never trigger the spurious
++ * detector. And if this is just the one out
++ * of 100k unhandled ones which is handled
++ * then we merily delay the spurious detection
++ * by one hard interrupt. Not a real problem.
++ */
++ desc->threads_handled_last &= ~SPURIOUS_DEFERRED;
++ }
++ }
++
+ if (unlikely(action_ret == IRQ_NONE)) {
+ /*
+ * If we are seeing only the odd spurious IRQ caused by
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 2fe9bf640c71..97eec2174769 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -208,9 +208,9 @@ static int kill_proc(struct task_struct *t, unsigned long addr, int trapno,
+ #endif
+ si.si_addr_lsb = compound_trans_order(compound_head(page)) + PAGE_SHIFT;
+
+- if ((flags & MF_ACTION_REQUIRED) && t == current) {
++ if ((flags & MF_ACTION_REQUIRED) && t->mm == current->mm) {
+ si.si_code = BUS_MCEERR_AR;
+- ret = force_sig_info(SIGBUS, &si, t);
++ ret = force_sig_info(SIGBUS, &si, current);
+ } else {
+ /*
+ * Don't use force here, it's convenient if the signal
+@@ -382,10 +382,12 @@ static void kill_procs(struct list_head *to_kill, int forcekill, int trapno,
+ }
+ }
+
+-static int task_early_kill(struct task_struct *tsk)
++static int task_early_kill(struct task_struct *tsk, int force_early)
+ {
+ if (!tsk->mm)
+ return 0;
++ if (force_early)
++ return 1;
+ if (tsk->flags & PF_MCE_PROCESS)
+ return !!(tsk->flags & PF_MCE_EARLY);
+ return sysctl_memory_failure_early_kill;
+@@ -395,7 +397,7 @@ static int task_early_kill(struct task_struct *tsk)
+ * Collect processes when the error hit an anonymous page.
+ */
+ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
+- struct to_kill **tkc)
++ struct to_kill **tkc, int force_early)
+ {
+ struct vm_area_struct *vma;
+ struct task_struct *tsk;
+@@ -409,7 +411,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
+ for_each_process (tsk) {
+ struct anon_vma_chain *vmac;
+
+- if (!task_early_kill(tsk))
++ if (!task_early_kill(tsk, force_early))
+ continue;
+ list_for_each_entry(vmac, &av->head, same_anon_vma) {
+ vma = vmac->vma;
+@@ -427,7 +429,7 @@ static void collect_procs_anon(struct page *page, struct list_head *to_kill,
+ * Collect processes when the error hit a file mapped page.
+ */
+ static void collect_procs_file(struct page *page, struct list_head *to_kill,
+- struct to_kill **tkc)
++ struct to_kill **tkc, int force_early)
+ {
+ struct vm_area_struct *vma;
+ struct task_struct *tsk;
+@@ -439,7 +441,7 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill,
+ for_each_process(tsk) {
+ pgoff_t pgoff = page->index << (PAGE_CACHE_SHIFT - PAGE_SHIFT);
+
+- if (!task_early_kill(tsk))
++ if (!task_early_kill(tsk, force_early))
+ continue;
+
+ vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff,
+@@ -465,7 +467,8 @@ static void collect_procs_file(struct page *page, struct list_head *to_kill,
+ * First preallocate one tokill structure outside the spin locks,
+ * so that we can kill at least one process reasonably reliable.
+ */
+-static void collect_procs(struct page *page, struct list_head *tokill)
++static void collect_procs(struct page *page, struct list_head *tokill,
++ int force_early)
+ {
+ struct to_kill *tk;
+
+@@ -476,9 +479,9 @@ static void collect_procs(struct page *page, struct list_head *tokill)
+ if (!tk)
+ return;
+ if (PageAnon(page))
+- collect_procs_anon(page, tokill, &tk);
++ collect_procs_anon(page, tokill, &tk, force_early);
+ else
+- collect_procs_file(page, tokill, &tk);
++ collect_procs_file(page, tokill, &tk, force_early);
+ kfree(tk);
+ }
+
+@@ -948,7 +951,7 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
+ * there's nothing that can be done.
+ */
+ if (kill)
+- collect_procs(ppage, &tokill);
++ collect_procs(ppage, &tokill, flags & MF_ACTION_REQUIRED);
+
+ if (hpage != ppage)
+ lock_page(ppage);
+diff --git a/mm/rmap.c b/mm/rmap.c
+index 3ff473feafd4..6dc46f345dba 100644
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -103,6 +103,7 @@ static inline void anon_vma_free(struct anon_vma *anon_vma)
+ * LOCK should suffice since the actual taking of the lock must
+ * happen _before_ what follows.
+ */
++ might_sleep();
+ if (mutex_is_locked(&anon_vma->root->mutex)) {
+ anon_vma_lock(anon_vma);
+ anon_vma_unlock(anon_vma);
+@@ -476,8 +477,9 @@ struct anon_vma *page_get_anon_vma(struct page *page)
+ * above cannot corrupt).
+ */
+ if (!page_mapped(page)) {
++ rcu_read_unlock();
+ put_anon_vma(anon_vma);
+- anon_vma = NULL;
++ return NULL;
+ }
+ out:
+ rcu_read_unlock();
+@@ -527,9 +529,9 @@ struct anon_vma *page_lock_anon_vma(struct page *page)
+ }
+
+ if (!page_mapped(page)) {
++ rcu_read_unlock();
+ put_anon_vma(anon_vma);
+- anon_vma = NULL;
+- goto out;
++ return NULL;
+ }
+
+ /* we pinned the anon_vma, its safe to sleep */
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index 907c8b7c995e..357ada63772c 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -3138,7 +3138,10 @@ static int kswapd(void *p)
+ }
+ }
+
++ tsk->flags &= ~(PF_MEMALLOC | PF_SWAPWRITE | PF_KSWAPD);
+ current->reclaim_state = NULL;
++ lockdep_clear_current_reclaim_state();
++
+ return 0;
+ }
+
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index fe42834df408..8de819475378 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -733,7 +733,7 @@ int skb_copy_ubufs(struct sk_buff *skb, gfp_t gfp_mask)
+ skb_shinfo(skb)->tx_flags &= ~SKBTX_DEV_ZEROCOPY;
+ return 0;
+ }
+-
++EXPORT_SYMBOL_GPL(skb_copy_ubufs);
+
+ /**
+ * skb_clone - duplicate an sk_buff
+@@ -2777,6 +2777,9 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+ skb_put(nskb, hsize), hsize);
+
+ while (pos < offset + len && i < nfrags) {
++ if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
++ goto err;
++
+ *frag = skb_shinfo(skb)->frags[i];
+ __skb_frag_ref(frag);
+ size = skb_frag_size(frag);
^ permalink raw reply related [flat|nested] 25+ messages in thread* [gentoo-commits] proj/linux-patches:3.4 commit in: /
@ 2014-06-27 17:23 Mike Pagano
0 siblings, 0 replies; 25+ messages in thread
From: Mike Pagano @ 2014-06-27 17:23 UTC (permalink / raw
To: gentoo-commits
commit: ce9777db91df0719bbfa9bd38d863096d2664397
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Jun 27 17:22:11 2014 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Jun 27 17:22:11 2014 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=ce9777db
Linux patches 3.4.94 and 3.4.95
---
0000_README | 8 +
1093_linux-3.4.94.patch | 293 +++++++
1094_linux-3.4.95.patch | 2054 +++++++++++++++++++++++++++++++++++++++++++++++
3 files changed, 2355 insertions(+)
diff --git a/0000_README b/0000_README
index 7148101..1db991a 100644
--- a/0000_README
+++ b/0000_README
@@ -411,6 +411,14 @@ Patch: 1092_linux-3.4.93.patch
From: http://www.kernel.org
Desc: Linux 3.4.93
+Patch: 1093_linux-3.4.94.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.94
+
+Patch: 1094_linux-3.4.95.patch
+From: http://www.kernel.org
+Desc: Linux 3.4.95
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1093_linux-3.4.94.patch b/1093_linux-3.4.94.patch
new file mode 100644
index 0000000..059857d
--- /dev/null
+++ b/1093_linux-3.4.94.patch
@@ -0,0 +1,293 @@
+diff --git a/Makefile b/Makefile
+index 20f420096dfa..0864af4a683b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 93
++SUBLEVEL = 94
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
+index 6524c6e21896..694aeedcbf88 100644
+--- a/arch/powerpc/Makefile
++++ b/arch/powerpc/Makefile
+@@ -67,9 +67,11 @@ LDFLAGS_vmlinux-y := -Bstatic
+ LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) := -pie
+ LDFLAGS_vmlinux := $(LDFLAGS_vmlinux-y)
+
++asinstr := $(call as-instr,lis 9$(comma)foo@high,-DHAVE_AS_ATHIGH=1)
++
+ CFLAGS-$(CONFIG_PPC64) := -mminimal-toc -mtraceback=no -mcall-aixdesc
+ CFLAGS-$(CONFIG_PPC32) := -ffixed-r2 -mmultiple
+-KBUILD_CPPFLAGS += -Iarch/$(ARCH)
++KBUILD_CPPFLAGS += -Iarch/$(ARCH) $(asinstr)
+ KBUILD_AFLAGS += -Iarch/$(ARCH)
+ KBUILD_CFLAGS += -msoft-float -pipe -Iarch/$(ARCH) $(CFLAGS-y)
+ CPP = $(CC) -E $(KBUILD_CFLAGS)
+diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h
+index 50f73aa2ba21..6f5a837431e9 100644
+--- a/arch/powerpc/include/asm/ppc_asm.h
++++ b/arch/powerpc/include/asm/ppc_asm.h
+@@ -294,11 +294,16 @@ n:
+ * ld rY,ADDROFF(name)(rX)
+ */
+ #ifdef __powerpc64__
++#ifdef HAVE_AS_ATHIGH
++#define __AS_ATHIGH high
++#else
++#define __AS_ATHIGH h
++#endif
+ #define LOAD_REG_IMMEDIATE(reg,expr) \
+ lis (reg),(expr)@highest; \
+ ori (reg),(reg),(expr)@higher; \
+ rldicr (reg),(reg),32,31; \
+- oris (reg),(reg),(expr)@h; \
++ oris (reg),(reg),(expr)@__AS_ATHIGH; \
+ ori (reg),(reg),(expr)@l;
+
+ #define LOAD_REG_ADDR(reg,name) \
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index ccd7b6711196..0e87baf8fcc2 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -441,6 +441,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ .driver_data = board_ahci_yes_fbs },
+ { PCI_DEVICE(0x1b4b, 0x9230),
+ .driver_data = board_ahci_yes_fbs },
++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642),
++ .driver_data = board_ahci_yes_fbs },
+
+ /* Promise */
+ { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+index 00b81272e314..174b622dcaef 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+@@ -55,7 +55,6 @@ int mlx4_en_create_cq(struct mlx4_en_priv *priv,
+
+ cq->ring = ring;
+ cq->is_tx = mode;
+- spin_lock_init(&cq->lock);
+
+ err = mlx4_alloc_hwq_res(mdev->dev, &cq->wqres,
+ cq->buf_size, 2 * PAGE_SIZE);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 31b455a49273..467a51171d47 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -370,15 +370,11 @@ static void mlx4_en_netpoll(struct net_device *dev)
+ {
+ struct mlx4_en_priv *priv = netdev_priv(dev);
+ struct mlx4_en_cq *cq;
+- unsigned long flags;
+ int i;
+
+ for (i = 0; i < priv->rx_ring_num; i++) {
+ cq = &priv->rx_cq[i];
+- spin_lock_irqsave(&cq->lock, flags);
+- napi_synchronize(&cq->napi);
+- mlx4_en_process_rx_cq(dev, cq, 0);
+- spin_unlock_irqrestore(&cq->lock, flags);
++ napi_schedule(&cq->napi);
+ }
+ }
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index d69fee41f24a..8df3c4be3ff1 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -301,7 +301,6 @@ struct mlx4_en_cq {
+ struct mlx4_cq mcq;
+ struct mlx4_hwq_resources wqres;
+ int ring;
+- spinlock_t lock;
+ struct net_device *dev;
+ struct napi_struct napi;
+ /* Per-core Tx cq processing support */
+diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h
+index e5f416f8042d..1a7955a39070 100644
+--- a/drivers/scsi/megaraid/megaraid_sas.h
++++ b/drivers/scsi/megaraid/megaraid_sas.h
+@@ -1294,7 +1294,6 @@ struct megasas_instance {
+ u32 *reply_queue;
+ dma_addr_t reply_queue_h;
+
+- unsigned long base_addr;
+ struct megasas_register_set __iomem *reg_set;
+
+ struct megasas_pd_list pd_list[MEGASAS_MAX_PD];
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 79261628d067..618870033dd0 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -3445,6 +3445,7 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ u32 max_sectors_1;
+ u32 max_sectors_2;
+ u32 tmp_sectors, msix_enable;
++ resource_size_t base_addr;
+ struct megasas_register_set __iomem *reg_set;
+ struct megasas_ctrl_info *ctrl_info;
+ unsigned long bar_list;
+@@ -3453,14 +3454,14 @@ static int megasas_init_fw(struct megasas_instance *instance)
+ /* Find first memory bar */
+ bar_list = pci_select_bars(instance->pdev, IORESOURCE_MEM);
+ instance->bar = find_first_bit(&bar_list, sizeof(unsigned long));
+- instance->base_addr = pci_resource_start(instance->pdev, instance->bar);
+ if (pci_request_selected_regions(instance->pdev, instance->bar,
+ "megasas: LSI")) {
+ printk(KERN_DEBUG "megasas: IO memory region busy!\n");
+ return -EBUSY;
+ }
+
+- instance->reg_set = ioremap_nocache(instance->base_addr, 8192);
++ base_addr = pci_resource_start(instance->pdev, instance->bar);
++ instance->reg_set = ioremap_nocache(base_addr, 8192);
+
+ if (!instance->reg_set) {
+ printk(KERN_DEBUG "megasas: Failed to map IO mem\n");
+diff --git a/drivers/staging/zram/zram_sysfs.c b/drivers/staging/zram/zram_sysfs.c
+index 826653fff70e..aafcf0330014 100644
+--- a/drivers/staging/zram/zram_sysfs.c
++++ b/drivers/staging/zram/zram_sysfs.c
+@@ -99,18 +99,23 @@ static ssize_t reset_store(struct device *dev,
+ return -ENOMEM;
+
+ /* Do not reset an active device! */
+- if (bdev->bd_holders)
+- return -EBUSY;
++ if (bdev->bd_holders) {
++ ret = -EBUSY;
++ goto out;
++ }
+
+ ret = kstrtou16(buf, 10, &do_reset);
+ if (ret)
+- return ret;
++ goto out;
+
+- if (!do_reset)
+- return -EINVAL;
++ if (!do_reset) {
++ ret = -EINVAL;
++ goto out;
++ }
+
+ /* Make sure all pending I/O is finished */
+ fsync_bdev(bdev);
++ bdput(bdev);
+
+ down_write(&zram->init_lock);
+ if (zram->init_done)
+@@ -118,6 +123,10 @@ static ssize_t reset_store(struct device *dev,
+ up_write(&zram->init_lock);
+
+ return len;
++
++out:
++ bdput(bdev);
++ return ret;
+ }
+
+ static ssize_t num_reads_show(struct device *dev,
+@@ -188,10 +197,12 @@ static ssize_t mem_used_total_show(struct device *dev,
+ u64 val = 0;
+ struct zram *zram = dev_to_zram(dev);
+
++ down_read(&zram->init_lock);
+ if (zram->init_done) {
+ val = zs_get_total_size_bytes(zram->mem_pool) +
+ ((u64)(zram->stats.pages_expand) << PAGE_SHIFT);
+ }
++ up_read(&zram->init_lock);
+
+ return sprintf(buf, "%llu\n", val);
+ }
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index af1de0f34eae..549071209258 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -868,6 +868,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
+ return AUDIT_BUILD_CONTEXT;
+ }
+
++static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
++{
++ int word, bit;
++
++ if (val > 0xffffffff)
++ return false;
++
++ word = AUDIT_WORD(val);
++ if (word >= AUDIT_BITMASK_SIZE)
++ return false;
++
++ bit = AUDIT_BIT(val);
++
++ return rule->mask[word] & bit;
++}
++
+ /* At syscall entry and exit time, this filter is called if the
+ * audit_state is not low enough that auditing cannot take place, but is
+ * also not high enough that we already know we have to write an audit
+@@ -885,11 +901,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
+
+ rcu_read_lock();
+ if (!list_empty(list)) {
+- int word = AUDIT_WORD(ctx->major);
+- int bit = AUDIT_BIT(ctx->major);
+-
+ list_for_each_entry_rcu(e, list, list) {
+- if ((e->rule.mask[word] & bit) == bit &&
++ if (audit_in_mask(&e->rule, ctx->major) &&
+ audit_filter_rules(tsk, &e->rule, ctx, NULL,
+ &state, false)) {
+ rcu_read_unlock();
+@@ -909,20 +922,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
+ static int audit_filter_inode_name(struct task_struct *tsk,
+ struct audit_names *n,
+ struct audit_context *ctx) {
+- int word, bit;
+ int h = audit_hash_ino((u32)n->ino);
+ struct list_head *list = &audit_inode_hash[h];
+ struct audit_entry *e;
+ enum audit_state state;
+
+- word = AUDIT_WORD(ctx->major);
+- bit = AUDIT_BIT(ctx->major);
+-
+ if (list_empty(list))
+ return 0;
+
+ list_for_each_entry_rcu(e, list, list) {
+- if ((e->rule.mask[word] & bit) == bit &&
++ if (audit_in_mask(&e->rule, ctx->major) &&
+ audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
+ ctx->current_state = state;
+ return 1;
+diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
+index 9bb1b8a37a22..010288fdcc90 100644
+--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
++++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
+@@ -22,7 +22,6 @@
+ #endif
+ #include <net/netfilter/nf_conntrack_zones.h>
+
+-/* Returns new sk_buff, or NULL */
+ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
+ {
+ int err;
+@@ -33,8 +32,10 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
+ err = ip_defrag(skb, user);
+ local_bh_enable();
+
+- if (!err)
++ if (!err) {
+ ip_send_check(ip_hdr(skb));
++ skb->local_df = 1;
++ }
+
+ return err;
+ }
diff --git a/1094_linux-3.4.95.patch b/1094_linux-3.4.95.patch
new file mode 100644
index 0000000..38f55d2
--- /dev/null
+++ b/1094_linux-3.4.95.patch
@@ -0,0 +1,2054 @@
+diff --git a/Makefile b/Makefile
+index 0864af4a683b..fda1dab589be 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 94
++SUBLEVEL = 95
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index 1995cb05acf2..6e49bb47f8b2 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -92,8 +92,6 @@ MODULE_PARM_DESC(log_num_mgm_entry_size, "log mgm size, that defines the num"
+ " 10 gives 248.range: 9<="
+ " log_num_mgm_entry_size <= 12");
+
+-#define MLX4_VF (1 << 0)
+-
+ #define HCA_GLOBAL_CAP_MASK 0
+ #define PF_CONTEXT_BEHAVIOUR_MASK 0
+
+@@ -1731,7 +1729,7 @@ static void mlx4_free_ownership(struct mlx4_dev *dev)
+ iounmap(owner);
+ }
+
+-static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
++static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data)
+ {
+ struct mlx4_priv *priv;
+ struct mlx4_dev *dev;
+@@ -1754,12 +1752,11 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ /*
+ * Check for BARs.
+ */
+- if (((id == NULL) || !(id->driver_data & MLX4_VF)) &&
++ if (!(pci_dev_data & MLX4_PCI_DEV_IS_VF) &&
+ !(pci_resource_flags(pdev, 0) & IORESOURCE_MEM)) {
+ dev_err(&pdev->dev, "Missing DCS, aborting."
+- "(id == 0X%p, id->driver_data: 0x%lx,"
+- " pci_resource_flags(pdev, 0):0x%lx)\n", id,
+- id ? id->driver_data : 0, pci_resource_flags(pdev, 0));
++ "(driver_data: 0x%x, pci_resource_flags(pdev, 0):0x%lx)\n",
++ pci_dev_data, pci_resource_flags(pdev, 0));
+ err = -ENODEV;
+ goto err_disable_pdev;
+ }
+@@ -1801,15 +1798,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+ /* Allow large DMA segments, up to the firmware limit of 1 GB */
+ dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024);
+
+- priv = kzalloc(sizeof *priv, GFP_KERNEL);
+- if (!priv) {
+- dev_err(&pdev->dev, "Device struct alloc failed, "
+- "aborting.\n");
+- err = -ENOMEM;
+- goto err_release_regions;
+- }
+-
+- dev = &priv->dev;
++ dev = pci_get_drvdata(pdev);
++ priv = mlx4_priv(dev);
+ dev->pdev = pdev;
+ INIT_LIST_HEAD(&priv->ctx_list);
+ spin_lock_init(&priv->ctx_lock);
+@@ -1824,7 +1814,7 @@ static int __mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
+
+ dev->rev_id = pdev->revision;
+ /* Detect if this device is a virtual function */
+- if (id && id->driver_data & MLX4_VF) {
++ if (pci_dev_data & MLX4_PCI_DEV_IS_VF) {
+ /* When acting as pf, we normally skip vfs unless explicitly
+ * requested to probe them. */
+ if (num_vfs && extended_func_num(pdev) > probe_vf) {
+@@ -1970,7 +1960,7 @@ slave_start:
+ mlx4_sense_init(dev);
+ mlx4_start_sense(dev);
+
+- pci_set_drvdata(pdev, dev);
++ priv->removed = 0;
+
+ return 0;
+
+@@ -2037,79 +2027,111 @@ err_disable_pdev:
+ static int __devinit mlx4_init_one(struct pci_dev *pdev,
+ const struct pci_device_id *id)
+ {
++ struct mlx4_priv *priv;
++ struct mlx4_dev *dev;
++
+ printk_once(KERN_INFO "%s", mlx4_version);
+
+- return __mlx4_init_one(pdev, id);
++ priv = kzalloc(sizeof(*priv), GFP_KERNEL);
++ if (!priv)
++ return -ENOMEM;
++
++ dev = &priv->dev;
++ pci_set_drvdata(pdev, dev);
++ priv->pci_dev_data = id->driver_data;
++
++ return __mlx4_init_one(pdev, id->driver_data);
+ }
+
+-static void mlx4_remove_one(struct pci_dev *pdev)
++static void __mlx4_remove_one(struct pci_dev *pdev)
+ {
+ struct mlx4_dev *dev = pci_get_drvdata(pdev);
+ struct mlx4_priv *priv = mlx4_priv(dev);
++ int pci_dev_data;
+ int p;
+
+- if (dev) {
+- /* in SRIOV it is not allowed to unload the pf's
+- * driver while there are alive vf's */
+- if (mlx4_is_master(dev)) {
+- if (mlx4_how_many_lives_vf(dev))
+- printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n");
+- }
+- mlx4_stop_sense(dev);
+- mlx4_unregister_device(dev);
++ if (priv->removed)
++ return;
+
+- for (p = 1; p <= dev->caps.num_ports; p++) {
+- mlx4_cleanup_port_info(&priv->port[p]);
+- mlx4_CLOSE_PORT(dev, p);
+- }
++ pci_dev_data = priv->pci_dev_data;
+
+- mlx4_cleanup_counters_table(dev);
+- mlx4_cleanup_mcg_table(dev);
+- mlx4_cleanup_qp_table(dev);
+- mlx4_cleanup_srq_table(dev);
+- mlx4_cleanup_cq_table(dev);
+- mlx4_cmd_use_polling(dev);
+- mlx4_cleanup_eq_table(dev);
+- mlx4_cleanup_mr_table(dev);
+- mlx4_cleanup_xrcd_table(dev);
+- mlx4_cleanup_pd_table(dev);
++ /* in SRIOV it is not allowed to unload the pf's
++ * driver while there are alive vf's */
++ if (mlx4_is_master(dev)) {
++ if (mlx4_how_many_lives_vf(dev))
++ printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n");
++ }
++ mlx4_stop_sense(dev);
++ mlx4_unregister_device(dev);
+
+- if (mlx4_is_master(dev))
+- mlx4_free_resource_tracker(dev);
+-
+- iounmap(priv->kar);
+- mlx4_uar_free(dev, &priv->driver_uar);
+- mlx4_cleanup_uar_table(dev);
+- if (!mlx4_is_slave(dev))
+- mlx4_clear_steering(dev);
+- mlx4_free_eq_table(dev);
+- if (mlx4_is_master(dev))
+- mlx4_multi_func_cleanup(dev);
+- mlx4_close_hca(dev);
+- if (mlx4_is_slave(dev))
+- mlx4_multi_func_cleanup(dev);
+- mlx4_cmd_cleanup(dev);
+-
+- if (dev->flags & MLX4_FLAG_MSI_X)
+- pci_disable_msix(pdev);
+- if (num_vfs && (dev->flags & MLX4_FLAG_SRIOV)) {
+- mlx4_warn(dev, "Disabling sriov\n");
+- pci_disable_sriov(pdev);
+- }
++ for (p = 1; p <= dev->caps.num_ports; p++) {
++ mlx4_cleanup_port_info(&priv->port[p]);
++ mlx4_CLOSE_PORT(dev, p);
++ }
++
++ mlx4_cleanup_counters_table(dev);
++ mlx4_cleanup_mcg_table(dev);
++ mlx4_cleanup_qp_table(dev);
++ mlx4_cleanup_srq_table(dev);
++ mlx4_cleanup_cq_table(dev);
++ mlx4_cmd_use_polling(dev);
++ mlx4_cleanup_eq_table(dev);
++ mlx4_cleanup_mr_table(dev);
++ mlx4_cleanup_xrcd_table(dev);
++ mlx4_cleanup_pd_table(dev);
++
++ if (mlx4_is_master(dev))
++ mlx4_free_resource_tracker(dev);
++
++ iounmap(priv->kar);
++ mlx4_uar_free(dev, &priv->driver_uar);
++ mlx4_cleanup_uar_table(dev);
++ if (!mlx4_is_slave(dev))
++ mlx4_clear_steering(dev);
++ mlx4_free_eq_table(dev);
++ if (mlx4_is_master(dev))
++ mlx4_multi_func_cleanup(dev);
++ mlx4_close_hca(dev);
++ if (mlx4_is_slave(dev))
++ mlx4_multi_func_cleanup(dev);
++ mlx4_cmd_cleanup(dev);
+
+- if (!mlx4_is_slave(dev))
+- mlx4_free_ownership(dev);
+- kfree(priv);
+- pci_release_regions(pdev);
+- pci_disable_device(pdev);
+- pci_set_drvdata(pdev, NULL);
++ if (dev->flags & MLX4_FLAG_MSI_X)
++ pci_disable_msix(pdev);
++ if (num_vfs && (dev->flags & MLX4_FLAG_SRIOV)) {
++ mlx4_warn(dev, "Disabling sriov\n");
++ pci_disable_sriov(pdev);
+ }
++
++ if (!mlx4_is_slave(dev))
++ mlx4_free_ownership(dev);
++
++ pci_release_regions(pdev);
++ pci_disable_device(pdev);
++ memset(priv, 0, sizeof(*priv));
++ priv->pci_dev_data = pci_dev_data;
++ priv->removed = 1;
++}
++
++static void mlx4_remove_one(struct pci_dev *pdev)
++{
++ struct mlx4_dev *dev = pci_get_drvdata(pdev);
++ struct mlx4_priv *priv = mlx4_priv(dev);
++
++ __mlx4_remove_one(pdev);
++ kfree(priv);
++ pci_set_drvdata(pdev, NULL);
+ }
+
+ int mlx4_restart_one(struct pci_dev *pdev)
+ {
+- mlx4_remove_one(pdev);
+- return __mlx4_init_one(pdev, NULL);
++ struct mlx4_dev *dev = pci_get_drvdata(pdev);
++ struct mlx4_priv *priv = mlx4_priv(dev);
++ int pci_dev_data;
++
++ pci_dev_data = priv->pci_dev_data;
++ __mlx4_remove_one(pdev);
++ return __mlx4_init_one(pdev, pci_dev_data);
+ }
+
+ static DEFINE_PCI_DEVICE_TABLE(mlx4_pci_table) = {
+@@ -2138,11 +2160,11 @@ static DEFINE_PCI_DEVICE_TABLE(mlx4_pci_table) = {
+ /* MT26478 ConnectX2 40GigE PCIe gen2 */
+ { PCI_VDEVICE(MELLANOX, 0x676e), 0 },
+ /* MT25400 Family [ConnectX-2 Virtual Function] */
+- { PCI_VDEVICE(MELLANOX, 0x1002), MLX4_VF },
++ { PCI_VDEVICE(MELLANOX, 0x1002), MLX4_PCI_DEV_IS_VF },
+ /* MT27500 Family [ConnectX-3] */
+ { PCI_VDEVICE(MELLANOX, 0x1003), 0 },
+ /* MT27500 Family [ConnectX-3 Virtual Function] */
+- { PCI_VDEVICE(MELLANOX, 0x1004), MLX4_VF },
++ { PCI_VDEVICE(MELLANOX, 0x1004), MLX4_PCI_DEV_IS_VF },
+ { PCI_VDEVICE(MELLANOX, 0x1005), 0 }, /* MT27510 Family */
+ { PCI_VDEVICE(MELLANOX, 0x1006), 0 }, /* MT27511 Family */
+ { PCI_VDEVICE(MELLANOX, 0x1007), 0 }, /* MT27520 Family */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+index 2a0ff2cc7182..a3ef1dff163d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+@@ -711,6 +711,10 @@ struct mlx4_steer {
+ struct list_head steer_entries[MLX4_NUM_STEERS];
+ };
+
++enum {
++ MLX4_PCI_DEV_IS_VF = 1 << 0,
++};
++
+ struct mlx4_priv {
+ struct mlx4_dev dev;
+
+@@ -718,6 +722,9 @@ struct mlx4_priv {
+ struct list_head ctx_list;
+ spinlock_t ctx_lock;
+
++ int pci_dev_data;
++ int removed;
++
+ struct list_head pgdir_list;
+ struct mutex pgdir_mutex;
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 8f81805c6825..d16800f5168a 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -889,6 +889,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
+ * to traverse list in reverse under rcu_read_lock
+ */
+ mutex_lock(&team->lock);
++ team->port_mtu_change_allowed = true;
+ list_for_each_entry(port, &team->port_list, list) {
+ err = dev_set_mtu(port->dev, new_mtu);
+ if (err) {
+@@ -897,6 +898,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
+ goto unwind;
+ }
+ }
++ team->port_mtu_change_allowed = false;
+ mutex_unlock(&team->lock);
+
+ dev->mtu = new_mtu;
+@@ -906,6 +908,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu)
+ unwind:
+ list_for_each_entry_continue_reverse(port, &team->port_list, list)
+ dev_set_mtu(port->dev, dev->mtu);
++ team->port_mtu_change_allowed = false;
+ mutex_unlock(&team->lock);
+
+ return err;
+@@ -1671,7 +1674,9 @@ static int team_device_event(struct notifier_block *unused,
+ break;
+ case NETDEV_CHANGEMTU:
+ /* Forbid to change mtu of underlaying device */
+- return NOTIFY_BAD;
++ if (!port->team->port_mtu_change_allowed)
++ return NOTIFY_BAD;
++ break;
+ case NETDEV_PRE_TYPE_CHANGE:
+ /* Forbid to change type of underlaying device */
+ return NOTIFY_BAD;
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index b54f6ecf90d9..cbb04f37ec36 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -342,6 +342,16 @@ static int chap_server_compute_md5(
+ goto out;
+ }
+ /*
++ * During mutual authentication, the CHAP_C generated by the
++ * initiator must not match the original CHAP_C generated by
++ * the target.
++ */
++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) {
++ pr_err("initiator CHAP_C matches target CHAP_C, failing"
++ " login attempt\n");
++ goto out;
++ }
++ /*
+ * Generate CHAP_N and CHAP_R for mutual authentication.
+ */
+ tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index f509888b7ad0..2f2540ff21f6 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -123,13 +123,23 @@ static void acm_release_minor(struct acm *acm)
+ static int acm_ctrl_msg(struct acm *acm, int request, int value,
+ void *buf, int len)
+ {
+- int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
++ int retval;
++
++ retval = usb_autopm_get_interface(acm->control);
++ if (retval)
++ return retval;
++
++ retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
+ request, USB_RT_ACM, value,
+ acm->control->altsetting[0].desc.bInterfaceNumber,
+ buf, len, 5000);
++
+ dev_dbg(&acm->control->dev,
+ "%s - rq 0x%02x, val %#x, len %#x, result %d\n",
+ __func__, request, value, len, retval);
++
++ usb_autopm_put_interface(acm->control);
++
+ return retval < 0 ? retval : 0;
+ }
+
+@@ -234,12 +244,9 @@ static int acm_write_start(struct acm *acm, int wbn)
+ acm->susp_count);
+ usb_autopm_get_interface_async(acm->control);
+ if (acm->susp_count) {
+- if (!acm->delayed_wb)
+- acm->delayed_wb = wb;
+- else
+- usb_autopm_put_interface_async(acm->control);
++ usb_anchor_urb(wb->urb, &acm->delayed);
+ spin_unlock_irqrestore(&acm->write_lock, flags);
+- return 0; /* A white lie */
++ return 0;
+ }
+ usb_mark_last_busy(acm->dev);
+
+@@ -535,6 +542,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
+ {
+ struct acm *acm = container_of(port, struct acm, port);
+ int retval = -ENODEV;
++ int i;
+
+ dev_dbg(&acm->control->dev, "%s\n", __func__);
+
+@@ -583,6 +591,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
+ return 0;
+
+ error_submit_read_urbs:
++ for (i = 0; i < acm->rx_buflimit; i++)
++ usb_kill_urb(acm->read_urbs[i]);
+ acm->ctrlout = 0;
+ acm_set_control(acm, acm->ctrlout);
+ error_set_control:
+@@ -610,21 +620,35 @@ static void acm_port_destruct(struct tty_port *port)
+ static void acm_port_shutdown(struct tty_port *port)
+ {
+ struct acm *acm = container_of(port, struct acm, port);
++ struct urb *urb;
++ struct acm_wb *wb;
+ int i;
++ int pm_err;
+
+ dev_dbg(&acm->control->dev, "%s\n", __func__);
+
+ mutex_lock(&acm->mutex);
+ if (!acm->disconnected) {
+- usb_autopm_get_interface(acm->control);
++ pm_err = usb_autopm_get_interface(acm->control);
+ acm_set_control(acm, acm->ctrlout = 0);
++
++ for (;;) {
++ urb = usb_get_from_anchor(&acm->delayed);
++ if (!urb)
++ break;
++ wb = urb->context;
++ wb->use = 0;
++ usb_autopm_put_interface_async(acm->control);
++ }
++
+ usb_kill_urb(acm->ctrlurb);
+ for (i = 0; i < ACM_NW; i++)
+ usb_kill_urb(acm->wb[i].urb);
+ for (i = 0; i < acm->rx_buflimit; i++)
+ usb_kill_urb(acm->read_urbs[i]);
+ acm->control->needs_remote_wakeup = 0;
+- usb_autopm_put_interface(acm->control);
++ if (!pm_err)
++ usb_autopm_put_interface(acm->control);
+ }
+ mutex_unlock(&acm->mutex);
+ }
+@@ -1211,6 +1235,7 @@ made_compressed_probe:
+ acm->bInterval = epread->bInterval;
+ tty_port_init(&acm->port);
+ acm->port.ops = &acm_port_ops;
++ init_usb_anchor(&acm->delayed);
+
+ buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
+ if (!buf) {
+@@ -1441,18 +1466,15 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ struct acm *acm = usb_get_intfdata(intf);
+ int cnt;
+
++ spin_lock_irq(&acm->read_lock);
++ spin_lock(&acm->write_lock);
+ if (PMSG_IS_AUTO(message)) {
+- int b;
+-
+- spin_lock_irq(&acm->write_lock);
+- b = acm->transmitting;
+- spin_unlock_irq(&acm->write_lock);
+- if (b)
++ if (acm->transmitting) {
++ spin_unlock(&acm->write_lock);
++ spin_unlock_irq(&acm->read_lock);
+ return -EBUSY;
++ }
+ }
+-
+- spin_lock_irq(&acm->read_lock);
+- spin_lock(&acm->write_lock);
+ cnt = acm->susp_count++;
+ spin_unlock(&acm->write_lock);
+ spin_unlock_irq(&acm->read_lock);
+@@ -1460,8 +1482,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ if (cnt)
+ return 0;
+
+- if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags))
+- stop_data_traffic(acm);
++ stop_data_traffic(acm);
+
+ return 0;
+ }
+@@ -1469,29 +1490,24 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ static int acm_resume(struct usb_interface *intf)
+ {
+ struct acm *acm = usb_get_intfdata(intf);
+- struct acm_wb *wb;
++ struct urb *urb;
+ int rv = 0;
+- int cnt;
+
+ spin_lock_irq(&acm->read_lock);
+- acm->susp_count -= 1;
+- cnt = acm->susp_count;
+- spin_unlock_irq(&acm->read_lock);
++ spin_lock(&acm->write_lock);
+
+- if (cnt)
+- return 0;
++ if (--acm->susp_count)
++ goto out;
+
+ if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
+- rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO);
+-
+- spin_lock_irq(&acm->write_lock);
+- if (acm->delayed_wb) {
+- wb = acm->delayed_wb;
+- acm->delayed_wb = NULL;
+- spin_unlock_irq(&acm->write_lock);
+- acm_start_wb(acm, wb);
+- } else {
+- spin_unlock_irq(&acm->write_lock);
++ rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
++
++ for (;;) {
++ urb = usb_get_from_anchor(&acm->delayed);
++ if (!urb)
++ break;
++
++ acm_start_wb(acm, urb->context);
+ }
+
+ /*
+@@ -1499,12 +1515,14 @@ static int acm_resume(struct usb_interface *intf)
+ * do the write path at all cost
+ */
+ if (rv < 0)
+- goto err_out;
++ goto out;
+
+- rv = acm_submit_read_urbs(acm, GFP_NOIO);
++ rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
+ }
++out:
++ spin_unlock(&acm->write_lock);
++ spin_unlock_irq(&acm->read_lock);
+
+-err_out:
+ return rv;
+ }
+
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index 35ef887b7417..96147806b9a4 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -117,7 +117,7 @@ struct acm {
+ unsigned int throttled:1; /* actually throttled */
+ unsigned int throttle_req:1; /* throttle requested */
+ u8 bInterval;
+- struct acm_wb *delayed_wb; /* write queued for a device about to be woken */
++ struct usb_anchor delayed; /* writes queued for a device about to be woken */
+ };
+
+ #define CDC_DATA_INTERFACE_TYPE 0x0a
+diff --git a/include/linux/if_team.h b/include/linux/if_team.h
+index 58404b0c5010..b159b10d915d 100644
+--- a/include/linux/if_team.h
++++ b/include/linux/if_team.h
+@@ -113,6 +113,7 @@ struct team {
+
+ const struct team_mode *mode;
+ struct team_mode_ops ops;
++ bool port_mtu_change_allowed;
+ long mode_priv[TEAM_MODE_PRIV_LONGS];
+ };
+
+diff --git a/include/linux/lzo.h b/include/linux/lzo.h
+index d793497ec1ca..a0848d9377e5 100644
+--- a/include/linux/lzo.h
++++ b/include/linux/lzo.h
+@@ -4,28 +4,28 @@
+ * LZO Public Kernel Interface
+ * A mini subset of the LZO real-time data compression library
+ *
+- * Copyright (C) 1996-2005 Markus F.X.J. Oberhumer <markus@oberhumer.com>
++ * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer <markus@oberhumer.com>
+ *
+ * The full LZO package can be found at:
+ * http://www.oberhumer.com/opensource/lzo/
+ *
+- * Changed for kernel use by:
++ * Changed for Linux kernel use by:
+ * Nitin Gupta <nitingupta910@gmail.com>
+ * Richard Purdie <rpurdie@openedhand.com>
+ */
+
+-#define LZO1X_MEM_COMPRESS (16384 * sizeof(unsigned char *))
+-#define LZO1X_1_MEM_COMPRESS LZO1X_MEM_COMPRESS
++#define LZO1X_1_MEM_COMPRESS (8192 * sizeof(unsigned short))
++#define LZO1X_MEM_COMPRESS LZO1X_1_MEM_COMPRESS
+
+ #define lzo1x_worst_compress(x) ((x) + ((x) / 16) + 64 + 3)
+
+-/* This requires 'workmem' of size LZO1X_1_MEM_COMPRESS */
++/* This requires 'wrkmem' of size LZO1X_1_MEM_COMPRESS */
+ int lzo1x_1_compress(const unsigned char *src, size_t src_len,
+- unsigned char *dst, size_t *dst_len, void *wrkmem);
++ unsigned char *dst, size_t *dst_len, void *wrkmem);
+
+ /* safe decompression with overrun testing */
+ int lzo1x_decompress_safe(const unsigned char *src, size_t src_len,
+- unsigned char *dst, size_t *dst_len);
++ unsigned char *dst, size_t *dst_len);
+
+ /*
+ * Return values (< 0 = Error)
+@@ -40,5 +40,6 @@ int lzo1x_decompress_safe(const unsigned char *src, size_t src_len,
+ #define LZO_E_EOF_NOT_FOUND (-7)
+ #define LZO_E_INPUT_NOT_CONSUMED (-8)
+ #define LZO_E_NOT_YET_IMPLEMENTED (-9)
++#define LZO_E_INVALID_ARGUMENT (-10)
+
+ #endif
+diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h
+index 2040bff945d4..2d643649f0f8 100644
+--- a/include/net/inetpeer.h
++++ b/include/net/inetpeer.h
+@@ -114,16 +114,9 @@ static inline void inet_peer_refcheck(const struct inet_peer *p)
+ /* can be called with or without local BH being disabled */
+ static inline int inet_getid(struct inet_peer *p, int more)
+ {
+- int old, new;
+ more++;
+ inet_peer_refcheck(p);
+- do {
+- old = atomic_read(&p->ip_id_count);
+- new = old + more;
+- if (!new)
+- new = 1;
+- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old);
+- return new;
++ return atomic_add_return(more, &p->ip_id_count) - more;
+ }
+
+ #endif /* _NET_INETPEER_H */
+diff --git a/include/sound/core.h b/include/sound/core.h
+index 93896ad1fcdd..8d29d28d3696 100644
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -120,6 +120,8 @@ struct snd_card {
+ int user_ctl_count; /* count of all user controls */
+ struct list_head controls; /* all controls for this card */
+ struct list_head ctl_files; /* active control files */
++ struct mutex user_ctl_lock; /* protects user controls against
++ concurrent access */
+
+ struct snd_info_entry *proc_root; /* root for soundcard specific files */
+ struct snd_info_entry *proc_id; /* the card id */
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 638dadf6295f..67106f88dca1 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -296,8 +296,10 @@ static void tick_nohz_stop_sched_tick(struct tick_sched *ts)
+ tick_do_timer_cpu = TICK_DO_TIMER_NONE;
+ }
+
+- if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE))
++ if (unlikely(ts->nohz_mode == NOHZ_MODE_INACTIVE)) {
++ ts->sleep_length = (ktime_t) { .tv64 = NSEC_PER_SEC/HZ };
+ return;
++ }
+
+ if (need_resched())
+ return;
+diff --git a/lib/decompress_unlzo.c b/lib/decompress_unlzo.c
+index 4531294fa62f..960183d4258f 100644
+--- a/lib/decompress_unlzo.c
++++ b/lib/decompress_unlzo.c
+@@ -31,7 +31,7 @@
+ */
+
+ #ifdef STATIC
+-#include "lzo/lzo1x_decompress.c"
++#include "lzo/lzo1x_decompress_safe.c"
+ #else
+ #include <linux/decompress/unlzo.h>
+ #endif
+diff --git a/lib/lzo/Makefile b/lib/lzo/Makefile
+index e764116ea12d..f0f7d7ca2b83 100644
+--- a/lib/lzo/Makefile
++++ b/lib/lzo/Makefile
+@@ -1,5 +1,5 @@
+ lzo_compress-objs := lzo1x_compress.o
+-lzo_decompress-objs := lzo1x_decompress.o
++lzo_decompress-objs := lzo1x_decompress_safe.o
+
+ obj-$(CONFIG_LZO_COMPRESS) += lzo_compress.o
+ obj-$(CONFIG_LZO_DECOMPRESS) += lzo_decompress.o
+diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
+index a6040990a62e..236eb21167b5 100644
+--- a/lib/lzo/lzo1x_compress.c
++++ b/lib/lzo/lzo1x_compress.c
+@@ -1,194 +1,243 @@
+ /*
+- * LZO1X Compressor from MiniLZO
++ * LZO1X Compressor from LZO
+ *
+- * Copyright (C) 1996-2005 Markus F.X.J. Oberhumer <markus@oberhumer.com>
++ * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer <markus@oberhumer.com>
+ *
+ * The full LZO package can be found at:
+ * http://www.oberhumer.com/opensource/lzo/
+ *
+- * Changed for kernel use by:
++ * Changed for Linux kernel use by:
+ * Nitin Gupta <nitingupta910@gmail.com>
+ * Richard Purdie <rpurdie@openedhand.com>
+ */
+
+ #include <linux/module.h>
+ #include <linux/kernel.h>
+-#include <linux/lzo.h>
+ #include <asm/unaligned.h>
++#include <linux/lzo.h>
+ #include "lzodefs.h"
+
+ static noinline size_t
+-_lzo1x_1_do_compress(const unsigned char *in, size_t in_len,
+- unsigned char *out, size_t *out_len, void *wrkmem)
++lzo1x_1_do_compress(const unsigned char *in, size_t in_len,
++ unsigned char *out, size_t *out_len,
++ size_t ti, void *wrkmem)
+ {
++ const unsigned char *ip;
++ unsigned char *op;
+ const unsigned char * const in_end = in + in_len;
+- const unsigned char * const ip_end = in + in_len - M2_MAX_LEN - 5;
+- const unsigned char ** const dict = wrkmem;
+- const unsigned char *ip = in, *ii = ip;
+- const unsigned char *end, *m, *m_pos;
+- size_t m_off, m_len, dindex;
+- unsigned char *op = out;
++ const unsigned char * const ip_end = in + in_len - 20;
++ const unsigned char *ii;
++ lzo_dict_t * const dict = (lzo_dict_t *) wrkmem;
+
+- ip += 4;
++ op = out;
++ ip = in;
++ ii = ip;
++ ip += ti < 4 ? 4 - ti : 0;
+
+ for (;;) {
+- dindex = ((size_t)(0x21 * DX3(ip, 5, 5, 6)) >> 5) & D_MASK;
+- m_pos = dict[dindex];
+-
+- if (m_pos < in)
+- goto literal;
+-
+- if (ip == m_pos || ((size_t)(ip - m_pos) > M4_MAX_OFFSET))
+- goto literal;
+-
+- m_off = ip - m_pos;
+- if (m_off <= M2_MAX_OFFSET || m_pos[3] == ip[3])
+- goto try_match;
+-
+- dindex = (dindex & (D_MASK & 0x7ff)) ^ (D_HIGH | 0x1f);
+- m_pos = dict[dindex];
+-
+- if (m_pos < in)
+- goto literal;
+-
+- if (ip == m_pos || ((size_t)(ip - m_pos) > M4_MAX_OFFSET))
+- goto literal;
+-
+- m_off = ip - m_pos;
+- if (m_off <= M2_MAX_OFFSET || m_pos[3] == ip[3])
+- goto try_match;
+-
+- goto literal;
+-
+-try_match:
+- if (get_unaligned((const unsigned short *)m_pos)
+- == get_unaligned((const unsigned short *)ip)) {
+- if (likely(m_pos[2] == ip[2]))
+- goto match;
+- }
+-
++ const unsigned char *m_pos;
++ size_t t, m_len, m_off;
++ u32 dv;
+ literal:
+- dict[dindex] = ip;
+- ++ip;
++ ip += 1 + ((ip - ii) >> 5);
++next:
+ if (unlikely(ip >= ip_end))
+ break;
+- continue;
+-
+-match:
+- dict[dindex] = ip;
+- if (ip != ii) {
+- size_t t = ip - ii;
++ dv = get_unaligned_le32(ip);
++ t = ((dv * 0x1824429d) >> (32 - D_BITS)) & D_MASK;
++ m_pos = in + dict[t];
++ dict[t] = (lzo_dict_t) (ip - in);
++ if (unlikely(dv != get_unaligned_le32(m_pos)))
++ goto literal;
+
++ ii -= ti;
++ ti = 0;
++ t = ip - ii;
++ if (t != 0) {
+ if (t <= 3) {
+ op[-2] |= t;
+- } else if (t <= 18) {
++ COPY4(op, ii);
++ op += t;
++ } else if (t <= 16) {
+ *op++ = (t - 3);
++ COPY8(op, ii);
++ COPY8(op + 8, ii + 8);
++ op += t;
+ } else {
+- size_t tt = t - 18;
+-
+- *op++ = 0;
+- while (tt > 255) {
+- tt -= 255;
++ if (t <= 18) {
++ *op++ = (t - 3);
++ } else {
++ size_t tt = t - 18;
+ *op++ = 0;
++ while (unlikely(tt > 255)) {
++ tt -= 255;
++ *op++ = 0;
++ }
++ *op++ = tt;
+ }
+- *op++ = tt;
++ do {
++ COPY8(op, ii);
++ COPY8(op + 8, ii + 8);
++ op += 16;
++ ii += 16;
++ t -= 16;
++ } while (t >= 16);
++ if (t > 0) do {
++ *op++ = *ii++;
++ } while (--t > 0);
+ }
+- do {
+- *op++ = *ii++;
+- } while (--t > 0);
+ }
+
+- ip += 3;
+- if (m_pos[3] != *ip++ || m_pos[4] != *ip++
+- || m_pos[5] != *ip++ || m_pos[6] != *ip++
+- || m_pos[7] != *ip++ || m_pos[8] != *ip++) {
+- --ip;
+- m_len = ip - ii;
++ m_len = 4;
++ {
++#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && defined(LZO_USE_CTZ64)
++ u64 v;
++ v = get_unaligned((const u64 *) (ip + m_len)) ^
++ get_unaligned((const u64 *) (m_pos + m_len));
++ if (unlikely(v == 0)) {
++ do {
++ m_len += 8;
++ v = get_unaligned((const u64 *) (ip + m_len)) ^
++ get_unaligned((const u64 *) (m_pos + m_len));
++ if (unlikely(ip + m_len >= ip_end))
++ goto m_len_done;
++ } while (v == 0);
++ }
++# if defined(__LITTLE_ENDIAN)
++ m_len += (unsigned) __builtin_ctzll(v) / 8;
++# elif defined(__BIG_ENDIAN)
++ m_len += (unsigned) __builtin_clzll(v) / 8;
++# else
++# error "missing endian definition"
++# endif
++#elif defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && defined(LZO_USE_CTZ32)
++ u32 v;
++ v = get_unaligned((const u32 *) (ip + m_len)) ^
++ get_unaligned((const u32 *) (m_pos + m_len));
++ if (unlikely(v == 0)) {
++ do {
++ m_len += 4;
++ v = get_unaligned((const u32 *) (ip + m_len)) ^
++ get_unaligned((const u32 *) (m_pos + m_len));
++ if (v != 0)
++ break;
++ m_len += 4;
++ v = get_unaligned((const u32 *) (ip + m_len)) ^
++ get_unaligned((const u32 *) (m_pos + m_len));
++ if (unlikely(ip + m_len >= ip_end))
++ goto m_len_done;
++ } while (v == 0);
++ }
++# if defined(__LITTLE_ENDIAN)
++ m_len += (unsigned) __builtin_ctz(v) / 8;
++# elif defined(__BIG_ENDIAN)
++ m_len += (unsigned) __builtin_clz(v) / 8;
++# else
++# error "missing endian definition"
++# endif
++#else
++ if (unlikely(ip[m_len] == m_pos[m_len])) {
++ do {
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (ip[m_len] != m_pos[m_len])
++ break;
++ m_len += 1;
++ if (unlikely(ip + m_len >= ip_end))
++ goto m_len_done;
++ } while (ip[m_len] == m_pos[m_len]);
++ }
++#endif
++ }
++m_len_done:
+
+- if (m_off <= M2_MAX_OFFSET) {
+- m_off -= 1;
+- *op++ = (((m_len - 1) << 5)
+- | ((m_off & 7) << 2));
+- *op++ = (m_off >> 3);
+- } else if (m_off <= M3_MAX_OFFSET) {
+- m_off -= 1;
++ m_off = ip - m_pos;
++ ip += m_len;
++ ii = ip;
++ if (m_len <= M2_MAX_LEN && m_off <= M2_MAX_OFFSET) {
++ m_off -= 1;
++ *op++ = (((m_len - 1) << 5) | ((m_off & 7) << 2));
++ *op++ = (m_off >> 3);
++ } else if (m_off <= M3_MAX_OFFSET) {
++ m_off -= 1;
++ if (m_len <= M3_MAX_LEN)
+ *op++ = (M3_MARKER | (m_len - 2));
+- goto m3_m4_offset;
+- } else {
+- m_off -= 0x4000;
+-
+- *op++ = (M4_MARKER | ((m_off & 0x4000) >> 11)
+- | (m_len - 2));
+- goto m3_m4_offset;
++ else {
++ m_len -= M3_MAX_LEN;
++ *op++ = M3_MARKER | 0;
++ while (unlikely(m_len > 255)) {
++ m_len -= 255;
++ *op++ = 0;
++ }
++ *op++ = (m_len);
+ }
++ *op++ = (m_off << 2);
++ *op++ = (m_off >> 6);
+ } else {
+- end = in_end;
+- m = m_pos + M2_MAX_LEN + 1;
+-
+- while (ip < end && *m == *ip) {
+- m++;
+- ip++;
+- }
+- m_len = ip - ii;
+-
+- if (m_off <= M3_MAX_OFFSET) {
+- m_off -= 1;
+- if (m_len <= 33) {
+- *op++ = (M3_MARKER | (m_len - 2));
+- } else {
+- m_len -= 33;
+- *op++ = M3_MARKER | 0;
+- goto m3_m4_len;
+- }
+- } else {
+- m_off -= 0x4000;
+- if (m_len <= M4_MAX_LEN) {
+- *op++ = (M4_MARKER
+- | ((m_off & 0x4000) >> 11)
++ m_off -= 0x4000;
++ if (m_len <= M4_MAX_LEN)
++ *op++ = (M4_MARKER | ((m_off >> 11) & 8)
+ | (m_len - 2));
+- } else {
+- m_len -= M4_MAX_LEN;
+- *op++ = (M4_MARKER
+- | ((m_off & 0x4000) >> 11));
+-m3_m4_len:
+- while (m_len > 255) {
+- m_len -= 255;
+- *op++ = 0;
+- }
+-
+- *op++ = (m_len);
++ else {
++ m_len -= M4_MAX_LEN;
++ *op++ = (M4_MARKER | ((m_off >> 11) & 8));
++ while (unlikely(m_len > 255)) {
++ m_len -= 255;
++ *op++ = 0;
+ }
++ *op++ = (m_len);
+ }
+-m3_m4_offset:
+- *op++ = ((m_off & 63) << 2);
++ *op++ = (m_off << 2);
+ *op++ = (m_off >> 6);
+ }
+-
+- ii = ip;
+- if (unlikely(ip >= ip_end))
+- break;
++ goto next;
+ }
+-
+ *out_len = op - out;
+- return in_end - ii;
++ return in_end - (ii - ti);
+ }
+
+-int lzo1x_1_compress(const unsigned char *in, size_t in_len, unsigned char *out,
+- size_t *out_len, void *wrkmem)
++int lzo1x_1_compress(const unsigned char *in, size_t in_len,
++ unsigned char *out, size_t *out_len,
++ void *wrkmem)
+ {
+- const unsigned char *ii;
++ const unsigned char *ip = in;
+ unsigned char *op = out;
+- size_t t;
++ size_t l = in_len;
++ size_t t = 0;
+
+- if (unlikely(in_len <= M2_MAX_LEN + 5)) {
+- t = in_len;
+- } else {
+- t = _lzo1x_1_do_compress(in, in_len, op, out_len, wrkmem);
++ while (l > 20) {
++ size_t ll = l <= (M4_MAX_OFFSET + 1) ? l : (M4_MAX_OFFSET + 1);
++ uintptr_t ll_end = (uintptr_t) ip + ll;
++ if ((ll_end + ((t + ll) >> 5)) <= ll_end)
++ break;
++ BUILD_BUG_ON(D_SIZE * sizeof(lzo_dict_t) > LZO1X_1_MEM_COMPRESS);
++ memset(wrkmem, 0, D_SIZE * sizeof(lzo_dict_t));
++ t = lzo1x_1_do_compress(ip, ll, op, out_len, t, wrkmem);
++ ip += ll;
+ op += *out_len;
++ l -= ll;
+ }
++ t += l;
+
+ if (t > 0) {
+- ii = in + in_len - t;
++ const unsigned char *ii = in + in_len - t;
+
+ if (op == out && t <= 238) {
+ *op++ = (17 + t);
+@@ -198,16 +247,21 @@ int lzo1x_1_compress(const unsigned char *in, size_t in_len, unsigned char *out,
+ *op++ = (t - 3);
+ } else {
+ size_t tt = t - 18;
+-
+ *op++ = 0;
+ while (tt > 255) {
+ tt -= 255;
+ *op++ = 0;
+ }
+-
+ *op++ = tt;
+ }
+- do {
++ if (t >= 16) do {
++ COPY8(op, ii);
++ COPY8(op + 8, ii + 8);
++ op += 16;
++ ii += 16;
++ t -= 16;
++ } while (t >= 16);
++ if (t > 0) do {
+ *op++ = *ii++;
+ } while (--t > 0);
+ }
+@@ -223,4 +277,3 @@ EXPORT_SYMBOL_GPL(lzo1x_1_compress);
+
+ MODULE_LICENSE("GPL");
+ MODULE_DESCRIPTION("LZO1X-1 Compressor");
+-
+diff --git a/lib/lzo/lzo1x_decompress.c b/lib/lzo/lzo1x_decompress.c
+deleted file mode 100644
+index f2fd09850223..000000000000
+--- a/lib/lzo/lzo1x_decompress.c
++++ /dev/null
+@@ -1,255 +0,0 @@
+-/*
+- * LZO1X Decompressor from MiniLZO
+- *
+- * Copyright (C) 1996-2005 Markus F.X.J. Oberhumer <markus@oberhumer.com>
+- *
+- * The full LZO package can be found at:
+- * http://www.oberhumer.com/opensource/lzo/
+- *
+- * Changed for kernel use by:
+- * Nitin Gupta <nitingupta910@gmail.com>
+- * Richard Purdie <rpurdie@openedhand.com>
+- */
+-
+-#ifndef STATIC
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#endif
+-
+-#include <asm/unaligned.h>
+-#include <linux/lzo.h>
+-#include "lzodefs.h"
+-
+-#define HAVE_IP(x, ip_end, ip) ((size_t)(ip_end - ip) < (x))
+-#define HAVE_OP(x, op_end, op) ((size_t)(op_end - op) < (x))
+-#define HAVE_LB(m_pos, out, op) (m_pos < out || m_pos >= op)
+-
+-#define COPY4(dst, src) \
+- put_unaligned(get_unaligned((const u32 *)(src)), (u32 *)(dst))
+-
+-int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
+- unsigned char *out, size_t *out_len)
+-{
+- const unsigned char * const ip_end = in + in_len;
+- unsigned char * const op_end = out + *out_len;
+- const unsigned char *ip = in, *m_pos;
+- unsigned char *op = out;
+- size_t t;
+-
+- *out_len = 0;
+-
+- if (*ip > 17) {
+- t = *ip++ - 17;
+- if (t < 4)
+- goto match_next;
+- if (HAVE_OP(t, op_end, op))
+- goto output_overrun;
+- if (HAVE_IP(t + 1, ip_end, ip))
+- goto input_overrun;
+- do {
+- *op++ = *ip++;
+- } while (--t > 0);
+- goto first_literal_run;
+- }
+-
+- while ((ip < ip_end)) {
+- t = *ip++;
+- if (t >= 16)
+- goto match;
+- if (t == 0) {
+- if (HAVE_IP(1, ip_end, ip))
+- goto input_overrun;
+- while (*ip == 0) {
+- t += 255;
+- ip++;
+- if (HAVE_IP(1, ip_end, ip))
+- goto input_overrun;
+- }
+- t += 15 + *ip++;
+- }
+- if (HAVE_OP(t + 3, op_end, op))
+- goto output_overrun;
+- if (HAVE_IP(t + 4, ip_end, ip))
+- goto input_overrun;
+-
+- COPY4(op, ip);
+- op += 4;
+- ip += 4;
+- if (--t > 0) {
+- if (t >= 4) {
+- do {
+- COPY4(op, ip);
+- op += 4;
+- ip += 4;
+- t -= 4;
+- } while (t >= 4);
+- if (t > 0) {
+- do {
+- *op++ = *ip++;
+- } while (--t > 0);
+- }
+- } else {
+- do {
+- *op++ = *ip++;
+- } while (--t > 0);
+- }
+- }
+-
+-first_literal_run:
+- t = *ip++;
+- if (t >= 16)
+- goto match;
+- m_pos = op - (1 + M2_MAX_OFFSET);
+- m_pos -= t >> 2;
+- m_pos -= *ip++ << 2;
+-
+- if (HAVE_LB(m_pos, out, op))
+- goto lookbehind_overrun;
+-
+- if (HAVE_OP(3, op_end, op))
+- goto output_overrun;
+- *op++ = *m_pos++;
+- *op++ = *m_pos++;
+- *op++ = *m_pos;
+-
+- goto match_done;
+-
+- do {
+-match:
+- if (t >= 64) {
+- m_pos = op - 1;
+- m_pos -= (t >> 2) & 7;
+- m_pos -= *ip++ << 3;
+- t = (t >> 5) - 1;
+- if (HAVE_LB(m_pos, out, op))
+- goto lookbehind_overrun;
+- if (HAVE_OP(t + 3 - 1, op_end, op))
+- goto output_overrun;
+- goto copy_match;
+- } else if (t >= 32) {
+- t &= 31;
+- if (t == 0) {
+- if (HAVE_IP(1, ip_end, ip))
+- goto input_overrun;
+- while (*ip == 0) {
+- t += 255;
+- ip++;
+- if (HAVE_IP(1, ip_end, ip))
+- goto input_overrun;
+- }
+- t += 31 + *ip++;
+- }
+- m_pos = op - 1;
+- m_pos -= get_unaligned_le16(ip) >> 2;
+- ip += 2;
+- } else if (t >= 16) {
+- m_pos = op;
+- m_pos -= (t & 8) << 11;
+-
+- t &= 7;
+- if (t == 0) {
+- if (HAVE_IP(1, ip_end, ip))
+- goto input_overrun;
+- while (*ip == 0) {
+- t += 255;
+- ip++;
+- if (HAVE_IP(1, ip_end, ip))
+- goto input_overrun;
+- }
+- t += 7 + *ip++;
+- }
+- m_pos -= get_unaligned_le16(ip) >> 2;
+- ip += 2;
+- if (m_pos == op)
+- goto eof_found;
+- m_pos -= 0x4000;
+- } else {
+- m_pos = op - 1;
+- m_pos -= t >> 2;
+- m_pos -= *ip++ << 2;
+-
+- if (HAVE_LB(m_pos, out, op))
+- goto lookbehind_overrun;
+- if (HAVE_OP(2, op_end, op))
+- goto output_overrun;
+-
+- *op++ = *m_pos++;
+- *op++ = *m_pos;
+- goto match_done;
+- }
+-
+- if (HAVE_LB(m_pos, out, op))
+- goto lookbehind_overrun;
+- if (HAVE_OP(t + 3 - 1, op_end, op))
+- goto output_overrun;
+-
+- if (t >= 2 * 4 - (3 - 1) && (op - m_pos) >= 4) {
+- COPY4(op, m_pos);
+- op += 4;
+- m_pos += 4;
+- t -= 4 - (3 - 1);
+- do {
+- COPY4(op, m_pos);
+- op += 4;
+- m_pos += 4;
+- t -= 4;
+- } while (t >= 4);
+- if (t > 0)
+- do {
+- *op++ = *m_pos++;
+- } while (--t > 0);
+- } else {
+-copy_match:
+- *op++ = *m_pos++;
+- *op++ = *m_pos++;
+- do {
+- *op++ = *m_pos++;
+- } while (--t > 0);
+- }
+-match_done:
+- t = ip[-2] & 3;
+- if (t == 0)
+- break;
+-match_next:
+- if (HAVE_OP(t, op_end, op))
+- goto output_overrun;
+- if (HAVE_IP(t + 1, ip_end, ip))
+- goto input_overrun;
+-
+- *op++ = *ip++;
+- if (t > 1) {
+- *op++ = *ip++;
+- if (t > 2)
+- *op++ = *ip++;
+- }
+-
+- t = *ip++;
+- } while (ip < ip_end);
+- }
+-
+- *out_len = op - out;
+- return LZO_E_EOF_NOT_FOUND;
+-
+-eof_found:
+- *out_len = op - out;
+- return (ip == ip_end ? LZO_E_OK :
+- (ip < ip_end ? LZO_E_INPUT_NOT_CONSUMED : LZO_E_INPUT_OVERRUN));
+-input_overrun:
+- *out_len = op - out;
+- return LZO_E_INPUT_OVERRUN;
+-
+-output_overrun:
+- *out_len = op - out;
+- return LZO_E_OUTPUT_OVERRUN;
+-
+-lookbehind_overrun:
+- *out_len = op - out;
+- return LZO_E_LOOKBEHIND_OVERRUN;
+-}
+-#ifndef STATIC
+-EXPORT_SYMBOL_GPL(lzo1x_decompress_safe);
+-
+-MODULE_LICENSE("GPL");
+-MODULE_DESCRIPTION("LZO1X Decompressor");
+-
+-#endif
+diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
+new file mode 100644
+index 000000000000..8563081e8da3
+--- /dev/null
++++ b/lib/lzo/lzo1x_decompress_safe.c
+@@ -0,0 +1,257 @@
++/*
++ * LZO1X Decompressor from LZO
++ *
++ * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer <markus@oberhumer.com>
++ *
++ * The full LZO package can be found at:
++ * http://www.oberhumer.com/opensource/lzo/
++ *
++ * Changed for Linux kernel use by:
++ * Nitin Gupta <nitingupta910@gmail.com>
++ * Richard Purdie <rpurdie@openedhand.com>
++ */
++
++#ifndef STATIC
++#include <linux/module.h>
++#include <linux/kernel.h>
++#endif
++#include <asm/unaligned.h>
++#include <linux/lzo.h>
++#include "lzodefs.h"
++
++#define HAVE_IP(t, x) \
++ (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \
++ (((t + x) >= t) && ((t + x) >= x)))
++
++#define HAVE_OP(t, x) \
++ (((size_t)(op_end - op) >= (size_t)(t + x)) && \
++ (((t + x) >= t) && ((t + x) >= x)))
++
++#define NEED_IP(t, x) \
++ do { \
++ if (!HAVE_IP(t, x)) \
++ goto input_overrun; \
++ } while (0)
++
++#define NEED_OP(t, x) \
++ do { \
++ if (!HAVE_OP(t, x)) \
++ goto output_overrun; \
++ } while (0)
++
++#define TEST_LB(m_pos) \
++ do { \
++ if ((m_pos) < out) \
++ goto lookbehind_overrun; \
++ } while (0)
++
++int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
++ unsigned char *out, size_t *out_len)
++{
++ unsigned char *op;
++ const unsigned char *ip;
++ size_t t, next;
++ size_t state = 0;
++ const unsigned char *m_pos;
++ const unsigned char * const ip_end = in + in_len;
++ unsigned char * const op_end = out + *out_len;
++
++ op = out;
++ ip = in;
++
++ if (unlikely(in_len < 3))
++ goto input_overrun;
++ if (*ip > 17) {
++ t = *ip++ - 17;
++ if (t < 4) {
++ next = t;
++ goto match_next;
++ }
++ goto copy_literal_run;
++ }
++
++ for (;;) {
++ t = *ip++;
++ if (t < 16) {
++ if (likely(state == 0)) {
++ if (unlikely(t == 0)) {
++ while (unlikely(*ip == 0)) {
++ t += 255;
++ ip++;
++ NEED_IP(1, 0);
++ }
++ t += 15 + *ip++;
++ }
++ t += 3;
++copy_literal_run:
++#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++ if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
++ const unsigned char *ie = ip + t;
++ unsigned char *oe = op + t;
++ do {
++ COPY8(op, ip);
++ op += 8;
++ ip += 8;
++ COPY8(op, ip);
++ op += 8;
++ ip += 8;
++ } while (ip < ie);
++ ip = ie;
++ op = oe;
++ } else
++#endif
++ {
++ NEED_OP(t, 0);
++ NEED_IP(t, 3);
++ do {
++ *op++ = *ip++;
++ } while (--t > 0);
++ }
++ state = 4;
++ continue;
++ } else if (state != 4) {
++ next = t & 3;
++ m_pos = op - 1;
++ m_pos -= t >> 2;
++ m_pos -= *ip++ << 2;
++ TEST_LB(m_pos);
++ NEED_OP(2, 0);
++ op[0] = m_pos[0];
++ op[1] = m_pos[1];
++ op += 2;
++ goto match_next;
++ } else {
++ next = t & 3;
++ m_pos = op - (1 + M2_MAX_OFFSET);
++ m_pos -= t >> 2;
++ m_pos -= *ip++ << 2;
++ t = 3;
++ }
++ } else if (t >= 64) {
++ next = t & 3;
++ m_pos = op - 1;
++ m_pos -= (t >> 2) & 7;
++ m_pos -= *ip++ << 3;
++ t = (t >> 5) - 1 + (3 - 1);
++ } else if (t >= 32) {
++ t = (t & 31) + (3 - 1);
++ if (unlikely(t == 2)) {
++ while (unlikely(*ip == 0)) {
++ t += 255;
++ ip++;
++ NEED_IP(1, 0);
++ }
++ t += 31 + *ip++;
++ NEED_IP(2, 0);
++ }
++ m_pos = op - 1;
++ next = get_unaligned_le16(ip);
++ ip += 2;
++ m_pos -= next >> 2;
++ next &= 3;
++ } else {
++ m_pos = op;
++ m_pos -= (t & 8) << 11;
++ t = (t & 7) + (3 - 1);
++ if (unlikely(t == 2)) {
++ while (unlikely(*ip == 0)) {
++ t += 255;
++ ip++;
++ NEED_IP(1, 0);
++ }
++ t += 7 + *ip++;
++ NEED_IP(2, 0);
++ }
++ next = get_unaligned_le16(ip);
++ ip += 2;
++ m_pos -= next >> 2;
++ next &= 3;
++ if (m_pos == op)
++ goto eof_found;
++ m_pos -= 0x4000;
++ }
++ TEST_LB(m_pos);
++#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++ if (op - m_pos >= 8) {
++ unsigned char *oe = op + t;
++ if (likely(HAVE_OP(t, 15))) {
++ do {
++ COPY8(op, m_pos);
++ op += 8;
++ m_pos += 8;
++ COPY8(op, m_pos);
++ op += 8;
++ m_pos += 8;
++ } while (op < oe);
++ op = oe;
++ if (HAVE_IP(6, 0)) {
++ state = next;
++ COPY4(op, ip);
++ op += next;
++ ip += next;
++ continue;
++ }
++ } else {
++ NEED_OP(t, 0);
++ do {
++ *op++ = *m_pos++;
++ } while (op < oe);
++ }
++ } else
++#endif
++ {
++ unsigned char *oe = op + t;
++ NEED_OP(t, 0);
++ op[0] = m_pos[0];
++ op[1] = m_pos[1];
++ op += 2;
++ m_pos += 2;
++ do {
++ *op++ = *m_pos++;
++ } while (op < oe);
++ }
++match_next:
++ state = next;
++ t = next;
++#if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
++ if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
++ COPY4(op, ip);
++ op += t;
++ ip += t;
++ } else
++#endif
++ {
++ NEED_IP(t, 3);
++ NEED_OP(t, 0);
++ while (t > 0) {
++ *op++ = *ip++;
++ t--;
++ }
++ }
++ }
++
++eof_found:
++ *out_len = op - out;
++ return (t != 3 ? LZO_E_ERROR :
++ ip == ip_end ? LZO_E_OK :
++ ip < ip_end ? LZO_E_INPUT_NOT_CONSUMED : LZO_E_INPUT_OVERRUN);
++
++input_overrun:
++ *out_len = op - out;
++ return LZO_E_INPUT_OVERRUN;
++
++output_overrun:
++ *out_len = op - out;
++ return LZO_E_OUTPUT_OVERRUN;
++
++lookbehind_overrun:
++ *out_len = op - out;
++ return LZO_E_LOOKBEHIND_OVERRUN;
++}
++#ifndef STATIC
++EXPORT_SYMBOL_GPL(lzo1x_decompress_safe);
++
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("LZO1X Decompressor");
++
++#endif
+diff --git a/lib/lzo/lzodefs.h b/lib/lzo/lzodefs.h
+index b6d482c492ef..6710b83ce72e 100644
+--- a/lib/lzo/lzodefs.h
++++ b/lib/lzo/lzodefs.h
+@@ -1,19 +1,37 @@
+ /*
+ * lzodefs.h -- architecture, OS and compiler specific defines
+ *
+- * Copyright (C) 1996-2005 Markus F.X.J. Oberhumer <markus@oberhumer.com>
++ * Copyright (C) 1996-2012 Markus F.X.J. Oberhumer <markus@oberhumer.com>
+ *
+ * The full LZO package can be found at:
+ * http://www.oberhumer.com/opensource/lzo/
+ *
+- * Changed for kernel use by:
++ * Changed for Linux kernel use by:
+ * Nitin Gupta <nitingupta910@gmail.com>
+ * Richard Purdie <rpurdie@openedhand.com>
+ */
+
+-#define LZO_VERSION 0x2020
+-#define LZO_VERSION_STRING "2.02"
+-#define LZO_VERSION_DATE "Oct 17 2005"
++
++#define COPY4(dst, src) \
++ put_unaligned(get_unaligned((const u32 *)(src)), (u32 *)(dst))
++#if defined(__x86_64__)
++#define COPY8(dst, src) \
++ put_unaligned(get_unaligned((const u64 *)(src)), (u64 *)(dst))
++#else
++#define COPY8(dst, src) \
++ COPY4(dst, src); COPY4((dst) + 4, (src) + 4)
++#endif
++
++#if defined(__BIG_ENDIAN) && defined(__LITTLE_ENDIAN)
++#error "conflicting endian definitions"
++#elif defined(__x86_64__)
++#define LZO_USE_CTZ64 1
++#define LZO_USE_CTZ32 1
++#elif defined(__i386__) || defined(__powerpc__)
++#define LZO_USE_CTZ32 1
++#elif defined(__arm__) && (__LINUX_ARM_ARCH__ >= 5)
++#define LZO_USE_CTZ32 1
++#endif
+
+ #define M1_MAX_OFFSET 0x0400
+ #define M2_MAX_OFFSET 0x0800
+@@ -34,10 +52,8 @@
+ #define M3_MARKER 32
+ #define M4_MARKER 16
+
+-#define D_BITS 14
+-#define D_MASK ((1u << D_BITS) - 1)
++#define lzo_dict_t unsigned short
++#define D_BITS 13
++#define D_SIZE (1u << D_BITS)
++#define D_MASK (D_SIZE - 1)
+ #define D_HIGH ((D_MASK >> 1) + 1)
+-
+-#define DX2(p, s1, s2) (((((size_t)((p)[2]) << (s2)) ^ (p)[1]) \
+- << (s1)) ^ (p)[0])
+-#define DX3(p, s1, s2, s3) ((DX2((p)+1, s2, s3) << (s1)) ^ (p)[0])
+diff --git a/lib/nlattr.c b/lib/nlattr.c
+index 01c67507dc43..60abf1b5545a 100644
+--- a/lib/nlattr.c
++++ b/lib/nlattr.c
+@@ -13,6 +13,7 @@
+ #include <linux/skbuff.h>
+ #include <linux/string.h>
+ #include <linux/types.h>
++#include <linux/ratelimit.h>
+ #include <net/netlink.h>
+
+ static const u16 nla_attr_minlen[NLA_TYPE_MAX+1] = {
+@@ -197,8 +198,8 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
+ }
+
+ if (unlikely(rem > 0))
+- printk(KERN_WARNING "netlink: %d bytes leftover after parsing "
+- "attributes.\n", rem);
++ pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
++ rem, current->comm);
+
+ err = 0;
+ errout:
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index d2f634880bdd..490132664d07 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -908,4 +908,5 @@ static void __exit ipip_fini(void)
+ module_init(ipip_init);
+ module_exit(ipip_fini);
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("ipip");
+ MODULE_ALIAS_NETDEV("tunl0");
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 5a2d819d8262..077b9a3f8d25 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -611,7 +611,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
+ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+ {
+ static atomic_t ipv6_fragmentation_id;
+- int old, new;
++ int ident;
+
+ if (rt && !(rt->dst.flags & DST_NOPEER)) {
+ struct inet_peer *peer;
+@@ -624,13 +624,8 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+ return;
+ }
+ }
+- do {
+- old = atomic_read(&ipv6_fragmentation_id);
+- new = old + 1;
+- if (!new)
+- new = 1;
+- } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
+- fhdr->identification = htonl(new);
++ ident = atomic_inc_return(&ipv6_fragmentation_id);
++ fhdr->identification = htonl(ident);
+ }
+
+ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index aa21da6a09cd..b876a2f81263 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -57,6 +57,7 @@
+ MODULE_AUTHOR("Ville Nuorvala");
+ MODULE_DESCRIPTION("IPv6 tunneling device");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("ip6tnl");
+ MODULE_ALIAS_NETDEV("ip6tnl0");
+
+ #ifdef IP6_TNL_DEBUG
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index c4ffd1743528..3f20ba4f9547 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1303,4 +1303,5 @@ static int __init sit_init(void)
+ module_init(sit_init);
+ module_exit(sit_cleanup);
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("sit");
+ MODULE_ALIAS_NETDEV("sit0");
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 3c04692d699a..25b207b3ffe4 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -389,7 +389,7 @@ void sctp_association_free(struct sctp_association *asoc)
+ /* Only real associations count against the endpoint, so
+ * don't bother for if this is a temporary association.
+ */
+- if (!asoc->temp) {
++ if (!list_empty(&asoc->asocs)) {
+ list_del(&asoc->asocs);
+
+ /* Decrement the backlog value for a TCP-style listening
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 8901501425f4..c487715698ab 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -271,12 +271,20 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
+ * @xattr_value: pointer to the new extended attribute value
+ * @xattr_value_len: pointer to the new extended attribute value length
+ *
+- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
+- * the current value is valid.
++ * Before allowing the 'security.evm' protected xattr to be updated,
++ * verify the existing value is valid. As only the kernel should have
++ * access to the EVM encrypted key needed to calculate the HMAC, prevent
++ * userspace from writing HMAC value. Writing 'security.evm' requires
++ * requires CAP_SYS_ADMIN privileges.
+ */
+ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+ const void *xattr_value, size_t xattr_value_len)
+ {
++ const struct evm_ima_xattr_data *xattr_data = xattr_value;
++
++ if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
++ && (xattr_data->type == EVM_XATTR_HMAC))
++ return -EPERM;
+ return evm_protect_xattr(dentry, xattr_name, xattr_value,
+ xattr_value_len);
+ }
+diff --git a/sound/core/control.c b/sound/core/control.c
+index daa4fc8872f3..e773d5ed1e9a 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -288,6 +288,10 @@ static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
+ {
+ struct snd_kcontrol *kctl;
+
++ /* Make sure that the ids assigned to the control do not wrap around */
++ if (card->last_numid >= UINT_MAX - count)
++ card->last_numid = 0;
++
+ list_for_each_entry(kctl, &card->controls, list) {
+ if (kctl->id.numid < card->last_numid + 1 + count &&
+ kctl->id.numid + kctl->count > card->last_numid + 1) {
+@@ -329,6 +333,7 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ {
+ struct snd_ctl_elem_id id;
+ unsigned int idx;
++ unsigned int count;
+ int err = -EINVAL;
+
+ if (! kcontrol)
+@@ -336,6 +341,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ if (snd_BUG_ON(!card || !kcontrol->info))
+ goto error;
+ id = kcontrol->id;
++ if (id.index > UINT_MAX - kcontrol->count)
++ goto error;
++
+ down_write(&card->controls_rwsem);
+ if (snd_ctl_find_id(card, &id)) {
+ up_write(&card->controls_rwsem);
+@@ -357,8 +365,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ card->controls_count += kcontrol->count;
+ kcontrol->id.numid = card->last_numid + 1;
+ card->last_numid += kcontrol->count;
++ count = kcontrol->count;
+ up_write(&card->controls_rwsem);
+- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
++ for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+ return 0;
+
+@@ -387,6 +396,7 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
+ bool add_on_replace)
+ {
+ struct snd_ctl_elem_id id;
++ unsigned int count;
+ unsigned int idx;
+ struct snd_kcontrol *old;
+ int ret;
+@@ -422,8 +432,9 @@ add:
+ card->controls_count += kcontrol->count;
+ kcontrol->id.numid = card->last_numid + 1;
+ card->last_numid += kcontrol->count;
++ count = kcontrol->count;
+ up_write(&card->controls_rwsem);
+- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
++ for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+ return 0;
+
+@@ -894,9 +905,9 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
+ result = kctl->put(kctl, control);
+ }
+ if (result > 0) {
++ struct snd_ctl_elem_id id = control->id;
+ up_read(&card->controls_rwsem);
+- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+- &control->id);
++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
+ return 0;
+ }
+ }
+@@ -988,6 +999,7 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
+
+ struct user_element {
+ struct snd_ctl_elem_info info;
++ struct snd_card *card;
+ void *elem_data; /* element data */
+ unsigned long elem_data_size; /* size of element data in bytes */
+ void *tlv_data; /* TLV data */
+@@ -1031,7 +1043,9 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
+ {
+ struct user_element *ue = kcontrol->private_data;
+
++ mutex_lock(&ue->card->user_ctl_lock);
+ memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size);
++ mutex_unlock(&ue->card->user_ctl_lock);
+ return 0;
+ }
+
+@@ -1040,10 +1054,12 @@ static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
+ {
+ int change;
+ struct user_element *ue = kcontrol->private_data;
+-
++
++ mutex_lock(&ue->card->user_ctl_lock);
+ change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0;
+ if (change)
+ memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size);
++ mutex_unlock(&ue->card->user_ctl_lock);
+ return change;
+ }
+
+@@ -1063,19 +1079,32 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
+ new_data = memdup_user(tlv, size);
+ if (IS_ERR(new_data))
+ return PTR_ERR(new_data);
++ mutex_lock(&ue->card->user_ctl_lock);
+ change = ue->tlv_data_size != size;
+ if (!change)
+ change = memcmp(ue->tlv_data, new_data, size);
+ kfree(ue->tlv_data);
+ ue->tlv_data = new_data;
+ ue->tlv_data_size = size;
++ mutex_unlock(&ue->card->user_ctl_lock);
+ } else {
+- if (! ue->tlv_data_size || ! ue->tlv_data)
+- return -ENXIO;
+- if (size < ue->tlv_data_size)
+- return -ENOSPC;
++ int ret = 0;
++
++ mutex_lock(&ue->card->user_ctl_lock);
++ if (!ue->tlv_data_size || !ue->tlv_data) {
++ ret = -ENXIO;
++ goto err_unlock;
++ }
++ if (size < ue->tlv_data_size) {
++ ret = -ENOSPC;
++ goto err_unlock;
++ }
+ if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
+- return -EFAULT;
++ ret = -EFAULT;
++err_unlock:
++ mutex_unlock(&ue->card->user_ctl_lock);
++ if (ret)
++ return ret;
+ }
+ return change;
+ }
+@@ -1133,8 +1162,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ struct user_element *ue;
+ int idx, err;
+
+- if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS)
+- return -ENOMEM;
+ if (info->count < 1)
+ return -EINVAL;
+ access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
+@@ -1143,21 +1170,16 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
+ info->id.numid = 0;
+ memset(&kctl, 0, sizeof(kctl));
+- down_write(&card->controls_rwsem);
+- _kctl = snd_ctl_find_id(card, &info->id);
+- err = 0;
+- if (_kctl) {
+- if (replace)
+- err = snd_ctl_remove(card, _kctl);
+- else
+- err = -EBUSY;
+- } else {
+- if (replace)
+- err = -ENOENT;
++
++ if (replace) {
++ err = snd_ctl_remove_user_ctl(file, &info->id);
++ if (err)
++ return err;
+ }
+- up_write(&card->controls_rwsem);
+- if (err < 0)
+- return err;
++
++ if (card->user_ctl_count >= MAX_USER_CONTROLS)
++ return -ENOMEM;
++
+ memcpy(&kctl.id, &info->id, sizeof(info->id));
+ kctl.count = info->owner ? info->owner : 1;
+ access |= SNDRV_CTL_ELEM_ACCESS_USER;
+@@ -1207,6 +1229,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
+ if (ue == NULL)
+ return -ENOMEM;
++ ue->card = card;
+ ue->info = *info;
+ ue->info.access = 0;
+ ue->elem_data = (char *)ue + sizeof(*ue);
+@@ -1318,8 +1341,9 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
+ }
+ err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv);
+ if (err > 0) {
++ struct snd_ctl_elem_id id = kctl->id;
+ up_read(&card->controls_rwsem);
+- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id);
++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
+ return 0;
+ }
+ } else {
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 7b012d15c2cf..41020d7395f3 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -208,6 +208,7 @@ int snd_card_create(int idx, const char *xid,
+ INIT_LIST_HEAD(&card->devices);
+ init_rwsem(&card->controls_rwsem);
+ rwlock_init(&card->ctl_files_rwlock);
++ mutex_init(&card->user_ctl_lock);
+ INIT_LIST_HEAD(&card->controls);
+ INIT_LIST_HEAD(&card->ctl_files);
+ spin_lock_init(&card->files_lock);
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2415dcec3265..4dac0b332a36 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -7062,6 +7062,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
+ { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
+ { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
++ { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 },
+ { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
+ { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
+ { .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 },
^ permalink raw reply related [flat|nested] 25+ messages in thread
end of thread, other threads:[~2016-12-09 23:49 UTC | newest]
Thread overview: 25+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-05-13 16:29 [gentoo-commits] proj/linux-patches:3.4 commit in: / Mike Pagano
-- strict thread matches above, loose matches on Subject: below --
2016-12-09 23:49 Mike Pagano
2016-11-01 11:58 Mike Pagano
2016-04-27 19:32 Mike Pagano
2016-03-21 15:06 Mike Pagano
2015-10-23 23:33 Mike Pagano
2015-09-21 15:57 Mike Pagano
2015-09-15 12:56 Mike Pagano
2015-02-02 23:32 Mike Pagano
2015-01-02 19:13 Mike Pagano
2014-12-20 19:13 Mike Pagano
2014-09-26 17:59 Mike Pagano
2014-08-19 11:41 Mike Pagano
2014-08-14 11:44 ` Mike Pagano
2014-08-19 11:41 Mike Pagano
2014-07-28 16:52 ` Mike Pagano
2014-08-08 17:25 Mike Pagano
2014-08-19 11:41 ` Mike Pagano
2014-08-02 14:43 Mike Pagano
2014-08-19 11:41 ` Mike Pagano
2014-07-18 11:35 Mike Pagano
2014-07-09 23:19 Mike Pagano
2014-07-07 23:51 Mike Pagano
2014-07-01 16:08 Mike Pagano
2014-06-27 17:23 Mike Pagano
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox