* [gentoo-commits] proj/hardened-patchset:master commit in: 4.1.4/, 3.14.49/, 3.2.70/, 3.2.69/, 4.1.5/, 3.14.50/
@ 2015-08-12 2:10 Anthony G. Basile
0 siblings, 0 replies; only message in thread
From: Anthony G. Basile @ 2015-08-12 2:10 UTC (permalink / raw
To: gentoo-commits
commit: 1de11cdd8e7748bb66eca924f709d2055f64efe0
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Aug 12 02:13:21 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Aug 12 02:13:21 2015 +0000
URL: https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=1de11cdd
grsecurity-{3.2.70,3.14.50,4.1.5}-201508102129
3.14.49/1047_linux-3.14.48.patch | 1019 --
3.14.49/1048_linux-3.14.49.patch | 4039 -------
{3.14.49 => 3.14.50}/0000_README | 10 +-
3.14.50/1049_linux-3.14.50.patch | 700 ++
.../4420_grsecurity-3.1-3.14.50-201508102128.patch | 381 +-
{4.1.4 => 3.14.50}/4425_grsec_remove_EI_PAX.patch | 0
.../4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
.../4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
.../4470_disable-compat_vdso.patch | 0
{4.1.4 => 3.14.50}/4475_emutramp_default_on.patch | 0
{3.2.69 => 3.2.70}/0000_README | 6 +-
{3.2.69 => 3.2.70}/1021_linux-3.2.22.patch | 0
{3.2.69 => 3.2.70}/1022_linux-3.2.23.patch | 0
{3.2.69 => 3.2.70}/1023_linux-3.2.24.patch | 0
{3.2.69 => 3.2.70}/1024_linux-3.2.25.patch | 0
{3.2.69 => 3.2.70}/1025_linux-3.2.26.patch | 0
{3.2.69 => 3.2.70}/1026_linux-3.2.27.patch | 0
{3.2.69 => 3.2.70}/1027_linux-3.2.28.patch | 0
{3.2.69 => 3.2.70}/1028_linux-3.2.29.patch | 0
{3.2.69 => 3.2.70}/1029_linux-3.2.30.patch | 0
{3.2.69 => 3.2.70}/1030_linux-3.2.31.patch | 0
{3.2.69 => 3.2.70}/1031_linux-3.2.32.patch | 0
{3.2.69 => 3.2.70}/1032_linux-3.2.33.patch | 0
{3.2.69 => 3.2.70}/1033_linux-3.2.34.patch | 0
{3.2.69 => 3.2.70}/1034_linux-3.2.35.patch | 0
{3.2.69 => 3.2.70}/1035_linux-3.2.36.patch | 0
{3.2.69 => 3.2.70}/1036_linux-3.2.37.patch | 0
{3.2.69 => 3.2.70}/1037_linux-3.2.38.patch | 0
{3.2.69 => 3.2.70}/1038_linux-3.2.39.patch | 0
{3.2.69 => 3.2.70}/1039_linux-3.2.40.patch | 0
{3.2.69 => 3.2.70}/1040_linux-3.2.41.patch | 0
{3.2.69 => 3.2.70}/1041_linux-3.2.42.patch | 0
{3.2.69 => 3.2.70}/1042_linux-3.2.43.patch | 0
{3.2.69 => 3.2.70}/1043_linux-3.2.44.patch | 0
{3.2.69 => 3.2.70}/1044_linux-3.2.45.patch | 0
{3.2.69 => 3.2.70}/1045_linux-3.2.46.patch | 0
{3.2.69 => 3.2.70}/1046_linux-3.2.47.patch | 0
{3.2.69 => 3.2.70}/1047_linux-3.2.48.patch | 0
{3.2.69 => 3.2.70}/1048_linux-3.2.49.patch | 0
{3.2.69 => 3.2.70}/1049_linux-3.2.50.patch | 0
{3.2.69 => 3.2.70}/1050_linux-3.2.51.patch | 0
{3.2.69 => 3.2.70}/1051_linux-3.2.52.patch | 0
{3.2.69 => 3.2.70}/1052_linux-3.2.53.patch | 0
{3.2.69 => 3.2.70}/1053_linux-3.2.54.patch | 0
{3.2.69 => 3.2.70}/1054_linux-3.2.55.patch | 0
{3.2.69 => 3.2.70}/1055_linux-3.2.56.patch | 0
{3.2.69 => 3.2.70}/1056_linux-3.2.57.patch | 0
{3.2.69 => 3.2.70}/1057_linux-3.2.58.patch | 0
{3.2.69 => 3.2.70}/1058_linux-3.2.59.patch | 0
{3.2.69 => 3.2.70}/1059_linux-3.2.60.patch | 0
{3.2.69 => 3.2.70}/1060_linux-3.2.61.patch | 0
{3.2.69 => 3.2.70}/1061_linux-3.2.62.patch | 0
{3.2.69 => 3.2.70}/1062_linux-3.2.63.patch | 0
{3.2.69 => 3.2.70}/1063_linux-3.2.64.patch | 0
{3.2.69 => 3.2.70}/1064_linux-3.2.65.patch | 0
{3.2.69 => 3.2.70}/1065_linux-3.2.66.patch | 0
{3.2.69 => 3.2.70}/1066_linux-3.2.67.patch | 0
{3.2.69 => 3.2.70}/1067_linux-3.2.68.patch | 0
{3.2.69 => 3.2.70}/1068_linux-3.2.69.patch | 0
3.2.70/1069_linux-3.2.70.patch | 5879 ++++++++++
.../4420_grsecurity-3.1-3.2.70-201508102127.patch | 742 +-
{3.2.69 => 3.2.70}/4425_grsec_remove_EI_PAX.patch | 0
.../4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.2.69 => 3.2.70}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{3.2.69 => 3.2.70}/4470_disable-compat_vdso.patch | 0
{3.2.69 => 3.2.70}/4475_emutramp_default_on.patch | 0
4.1.4/1003_linux-4.1.4.patch | 11078 -------------------
{4.1.4 => 4.1.5}/0000_README | 6 +-
4.1.5/1004_linux-4.1.5.patch | 5750 ++++++++++
.../4420_grsecurity-3.1-4.1.5-201508102129.patch | 1460 ++-
{3.14.49 => 4.1.5}/4425_grsec_remove_EI_PAX.patch | 0
{4.1.4 => 4.1.5}/4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{4.1.4 => 4.1.5}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{4.1.4 => 4.1.5}/4470_disable-compat_vdso.patch | 0
{3.14.49 => 4.1.5}/4475_emutramp_default_on.patch | 0
87 files changed, 13527 insertions(+), 17543 deletions(-)
diff --git a/3.14.49/1047_linux-3.14.48.patch b/3.14.49/1047_linux-3.14.48.patch
deleted file mode 100644
index 3a7169d..0000000
--- a/3.14.49/1047_linux-3.14.48.patch
+++ /dev/null
@@ -1,1019 +0,0 @@
-diff --git a/Makefile b/Makefile
-index f9041e6..25393e8 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 47
-+SUBLEVEL = 48
- EXTRAVERSION =
- NAME = Remembering Coco
-
-diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h
-index 9f79231..7d35af3 100644
---- a/arch/arm/include/asm/kvm_mmu.h
-+++ b/arch/arm/include/asm/kvm_mmu.h
-@@ -117,13 +117,14 @@ static inline void kvm_set_s2pmd_writable(pmd_t *pmd)
- (__boundary - 1 < (end) - 1)? __boundary: (end); \
- })
-
-+#define kvm_pgd_index(addr) pgd_index(addr)
-+
- static inline bool kvm_page_empty(void *ptr)
- {
- struct page *ptr_page = virt_to_page(ptr);
- return page_count(ptr_page) == 1;
- }
-
--
- #define kvm_pte_table_empty(ptep) kvm_page_empty(ptep)
- #define kvm_pmd_table_empty(pmdp) kvm_page_empty(pmdp)
- #define kvm_pud_table_empty(pudp) (0)
-diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
-index 2e74a61..f6a52a2 100644
---- a/arch/arm/kvm/arm.c
-+++ b/arch/arm/kvm/arm.c
-@@ -441,6 +441,7 @@ static void update_vttbr(struct kvm *kvm)
-
- static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- {
-+ struct kvm *kvm = vcpu->kvm;
- int ret;
-
- if (likely(vcpu->arch.has_run_once))
-@@ -452,12 +453,20 @@ static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
- * Initialize the VGIC before running a vcpu the first time on
- * this VM.
- */
-- if (unlikely(!vgic_initialized(vcpu->kvm))) {
-- ret = kvm_vgic_init(vcpu->kvm);
-+ if (unlikely(!vgic_initialized(kvm))) {
-+ ret = kvm_vgic_init(kvm);
- if (ret)
- return ret;
- }
-
-+ /*
-+ * Enable the arch timers only if we have an in-kernel VGIC
-+ * and it has been properly initialized, since we cannot handle
-+ * interrupts from the virtual timer with a userspace gic.
-+ */
-+ if (irqchip_in_kernel(kvm) && vgic_initialized(kvm))
-+ kvm_timer_enable(kvm);
-+
- return 0;
- }
-
-diff --git a/arch/arm/kvm/interrupts.S b/arch/arm/kvm/interrupts.S
-index 0d68d40..a1467e7 100644
---- a/arch/arm/kvm/interrupts.S
-+++ b/arch/arm/kvm/interrupts.S
-@@ -159,13 +159,9 @@ __kvm_vcpu_return:
- @ Don't trap coprocessor accesses for host kernel
- set_hstr vmexit
- set_hdcr vmexit
-- set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11))
-+ set_hcptr vmexit, (HCPTR_TTA | HCPTR_TCP(10) | HCPTR_TCP(11)), after_vfp_restore
-
- #ifdef CONFIG_VFPv3
-- @ Save floating point registers we if let guest use them.
-- tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
-- bne after_vfp_restore
--
- @ Switch VFP/NEON hardware state to the host's
- add r7, vcpu, #VCPU_VFP_GUEST
- store_vfp_state r7
-@@ -177,6 +173,8 @@ after_vfp_restore:
- @ Restore FPEXC_EN which we clobbered on entry
- pop {r2}
- VFPFMXR FPEXC, r2
-+#else
-+after_vfp_restore:
- #endif
-
- @ Reset Hyp-role
-@@ -467,7 +465,7 @@ switch_to_guest_vfp:
- push {r3-r7}
-
- @ NEON/VFP used. Turn on VFP access.
-- set_hcptr vmexit, (HCPTR_TCP(10) | HCPTR_TCP(11))
-+ set_hcptr vmtrap, (HCPTR_TCP(10) | HCPTR_TCP(11))
-
- @ Switch VFP/NEON hardware state to the guest's
- add r7, r0, #VCPU_VFP_HOST
-diff --git a/arch/arm/kvm/interrupts_head.S b/arch/arm/kvm/interrupts_head.S
-index 76af9302..2973b2d 100644
---- a/arch/arm/kvm/interrupts_head.S
-+++ b/arch/arm/kvm/interrupts_head.S
-@@ -578,8 +578,13 @@ vcpu .req r0 @ vcpu pointer always in r0
- .endm
-
- /* Configures the HCPTR (Hyp Coprocessor Trap Register) on entry/return
-- * (hardware reset value is 0). Keep previous value in r2. */
--.macro set_hcptr operation, mask
-+ * (hardware reset value is 0). Keep previous value in r2.
-+ * An ISB is emited on vmexit/vmtrap, but executed on vmexit only if
-+ * VFP wasn't already enabled (always executed on vmtrap).
-+ * If a label is specified with vmexit, it is branched to if VFP wasn't
-+ * enabled.
-+ */
-+.macro set_hcptr operation, mask, label = none
- mrc p15, 4, r2, c1, c1, 2
- ldr r3, =\mask
- .if \operation == vmentry
-@@ -588,6 +593,17 @@ vcpu .req r0 @ vcpu pointer always in r0
- bic r3, r2, r3 @ Don't trap defined coproc-accesses
- .endif
- mcr p15, 4, r3, c1, c1, 2
-+ .if \operation != vmentry
-+ .if \operation == vmexit
-+ tst r2, #(HCPTR_TCP(10) | HCPTR_TCP(11))
-+ beq 1f
-+ .endif
-+ isb
-+ .if \label != none
-+ b \label
-+ .endif
-+1:
-+ .endif
- .endm
-
- /* Configures the HDCR (Hyp Debug Configuration Register) on entry/return
-diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
-index 524b4b5..c612e37 100644
---- a/arch/arm/kvm/mmu.c
-+++ b/arch/arm/kvm/mmu.c
-@@ -194,7 +194,7 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp,
- phys_addr_t addr = start, end = start + size;
- phys_addr_t next;
-
-- pgd = pgdp + pgd_index(addr);
-+ pgd = pgdp + kvm_pgd_index(addr);
- do {
- next = kvm_pgd_addr_end(addr, end);
- if (!pgd_none(*pgd))
-@@ -264,7 +264,7 @@ static void stage2_flush_memslot(struct kvm *kvm,
- phys_addr_t next;
- pgd_t *pgd;
-
-- pgd = kvm->arch.pgd + pgd_index(addr);
-+ pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- do {
- next = kvm_pgd_addr_end(addr, end);
- stage2_flush_puds(kvm, pgd, addr, next);
-@@ -649,7 +649,7 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache
- pud_t *pud;
- pmd_t *pmd;
-
-- pgd = kvm->arch.pgd + pgd_index(addr);
-+ pgd = kvm->arch.pgd + kvm_pgd_index(addr);
- pud = pud_offset(pgd, addr);
- if (pud_none(*pud)) {
- if (!cache)
-diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
-index 681cb90..91f33c2 100644
---- a/arch/arm64/include/asm/kvm_emulate.h
-+++ b/arch/arm64/include/asm/kvm_emulate.h
-@@ -41,6 +41,8 @@ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
- static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
- {
- vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
-+ if (test_bit(KVM_ARM_VCPU_EL1_32BIT, vcpu->arch.features))
-+ vcpu->arch.hcr_el2 &= ~HCR_RW;
- }
-
- static inline unsigned long *vcpu_pc(const struct kvm_vcpu *vcpu)
-diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h
-index 0d51874..15a8a86 100644
---- a/arch/arm64/include/asm/kvm_mmu.h
-+++ b/arch/arm64/include/asm/kvm_mmu.h
-@@ -69,6 +69,8 @@
- #define PTRS_PER_S2_PGD (1 << (KVM_PHYS_SHIFT - PGDIR_SHIFT))
- #define S2_PGD_ORDER get_order(PTRS_PER_S2_PGD * sizeof(pgd_t))
-
-+#define kvm_pgd_index(addr) (((addr) >> PGDIR_SHIFT) & (PTRS_PER_S2_PGD - 1))
-+
- int create_hyp_mappings(void *from, void *to);
- int create_hyp_io_mappings(void *from, void *to, phys_addr_t);
- void free_boot_hyp_pgd(void);
-diff --git a/arch/arm64/kvm/hyp.S b/arch/arm64/kvm/hyp.S
-index 5dfc8331..3aaf3bc 100644
---- a/arch/arm64/kvm/hyp.S
-+++ b/arch/arm64/kvm/hyp.S
-@@ -629,6 +629,7 @@ ENTRY(__kvm_tlb_flush_vmid_ipa)
- * Instead, we invalidate Stage-2 for this IPA, and the
- * whole of Stage-1. Weep...
- */
-+ lsr x1, x1, #12
- tlbi ipas2e1is, x1
- /*
- * We have to ensure completion of the invalidation at Stage-2,
-diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
-index 70a7816..0b43265 100644
---- a/arch/arm64/kvm/reset.c
-+++ b/arch/arm64/kvm/reset.c
-@@ -90,7 +90,6 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu)
- if (!cpu_has_32bit_el1())
- return -EINVAL;
- cpu_reset = &default_regs_reset32;
-- vcpu->arch.hcr_el2 &= ~HCR_RW;
- } else {
- cpu_reset = &default_regs_reset;
- }
-diff --git a/arch/mips/include/asm/mach-generic/spaces.h b/arch/mips/include/asm/mach-generic/spaces.h
-index 9488fa5..afc96ec 100644
---- a/arch/mips/include/asm/mach-generic/spaces.h
-+++ b/arch/mips/include/asm/mach-generic/spaces.h
-@@ -94,7 +94,11 @@
- #endif
-
- #ifndef FIXADDR_TOP
-+#ifdef CONFIG_KVM_GUEST
-+#define FIXADDR_TOP ((unsigned long)(long)(int)0x7ffe0000)
-+#else
- #define FIXADDR_TOP ((unsigned long)(long)(int)0xfffe0000)
- #endif
-+#endif
-
- #endif /* __ASM_MACH_GENERIC_SPACES_H */
-diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
-index 38265dc..65dfbd0 100644
---- a/arch/powerpc/perf/core-book3s.c
-+++ b/arch/powerpc/perf/core-book3s.c
-@@ -124,7 +124,16 @@ static inline void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) {}
-
- static bool regs_use_siar(struct pt_regs *regs)
- {
-- return !!regs->result;
-+ /*
-+ * When we take a performance monitor exception the regs are setup
-+ * using perf_read_regs() which overloads some fields, in particular
-+ * regs->result to tell us whether to use SIAR.
-+ *
-+ * However if the regs are from another exception, eg. a syscall, then
-+ * they have not been setup using perf_read_regs() and so regs->result
-+ * is something random.
-+ */
-+ return ((TRAP(regs) == 0xf00) && regs->result);
- }
-
- /*
-diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
-index 27bb554..7ef2862 100644
---- a/arch/sparc/kernel/ldc.c
-+++ b/arch/sparc/kernel/ldc.c
-@@ -2307,7 +2307,7 @@ void *ldc_alloc_exp_dring(struct ldc_channel *lp, unsigned int len,
- if (len & (8UL - 1))
- return ERR_PTR(-EINVAL);
-
-- buf = kzalloc(len, GFP_KERNEL);
-+ buf = kzalloc(len, GFP_ATOMIC);
- if (!buf)
- return ERR_PTR(-ENOMEM);
-
-diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 5dab54a..96e743a 100644
---- a/arch/x86/Kconfig
-+++ b/arch/x86/Kconfig
-@@ -2440,9 +2440,19 @@ config X86_DMA_REMAP
- depends on STA2X11
-
- config IOSF_MBI
-- tristate
-- default m
-+ tristate "Intel System On Chip IOSF Sideband support"
- depends on PCI
-+ ---help---
-+ Enables sideband access to mailbox registers on SoC's. The sideband is
-+ available on the following platforms. This list is not meant to be
-+ exclusive.
-+ - BayTrail
-+ - Cherryview
-+ - Braswell
-+ - Quark
-+
-+ You should say Y if you are running a kernel on one of these
-+ platforms.
-
- source "net/Kconfig"
-
-diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
-index e9dc029..ac03bd7 100644
---- a/arch/x86/include/asm/kvm_host.h
-+++ b/arch/x86/include/asm/kvm_host.h
-@@ -571,7 +571,7 @@ struct kvm_arch {
- struct kvm_pic *vpic;
- struct kvm_ioapic *vioapic;
- struct kvm_pit *vpit;
-- int vapics_in_nmi_mode;
-+ atomic_t vapics_in_nmi_mode;
- struct mutex apic_map_lock;
- struct kvm_apic_map *apic_map;
-
-diff --git a/arch/x86/kvm/i8254.c b/arch/x86/kvm/i8254.c
-index 298781d..1406ffd 100644
---- a/arch/x86/kvm/i8254.c
-+++ b/arch/x86/kvm/i8254.c
-@@ -305,7 +305,7 @@ static void pit_do_work(struct kthread_work *work)
- * LVT0 to NMI delivery. Other PIC interrupts are just sent to
- * VCPU0, and only if its LVT0 is in EXTINT mode.
- */
-- if (kvm->arch.vapics_in_nmi_mode > 0)
-+ if (atomic_read(&kvm->arch.vapics_in_nmi_mode) > 0)
- kvm_for_each_vcpu(i, vcpu, kvm)
- kvm_apic_nmi_wd_deliver(vcpu);
- }
-diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
-index 453e5fb..6456734 100644
---- a/arch/x86/kvm/lapic.c
-+++ b/arch/x86/kvm/lapic.c
-@@ -1109,10 +1109,10 @@ static void apic_manage_nmi_watchdog(struct kvm_lapic *apic, u32 lvt0_val)
- if (!nmi_wd_enabled) {
- apic_debug("Receive NMI setting on APIC_LVT0 "
- "for cpu %d\n", apic->vcpu->vcpu_id);
-- apic->vcpu->kvm->arch.vapics_in_nmi_mode++;
-+ atomic_inc(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- }
- } else if (nmi_wd_enabled)
-- apic->vcpu->kvm->arch.vapics_in_nmi_mode--;
-+ atomic_dec(&apic->vcpu->kvm->arch.vapics_in_nmi_mode);
- }
-
- static int apic_reg_write(struct kvm_lapic *apic, u32 reg, u32 val)
-diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
-index 4f25ec0..bf00138 100644
---- a/arch/x86/pci/acpi.c
-+++ b/arch/x86/pci/acpi.c
-@@ -84,6 +84,17 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
- DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
- },
- },
-+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/931368 */
-+ /* https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/1033299 */
-+ {
-+ .callback = set_use_crs,
-+ .ident = "Foxconn K8M890-8237A",
-+ .matches = {
-+ DMI_MATCH(DMI_BOARD_VENDOR, "Foxconn"),
-+ DMI_MATCH(DMI_BOARD_NAME, "K8M890-8237A"),
-+ DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies, LTD"),
-+ },
-+ },
-
- /* Now for the blacklist.. */
-
-@@ -124,8 +135,10 @@ void __init pci_acpi_crs_quirks(void)
- {
- int year;
-
-- if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008)
-- pci_use_crs = false;
-+ if (dmi_get_date(DMI_BIOS_DATE, &year, NULL, NULL) && year < 2008) {
-+ if (iomem_resource.end <= 0xffffffff)
-+ pci_use_crs = false;
-+ }
-
- dmi_check_system(pci_crs_quirks);
-
-diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index 533a509..fbc693b 100644
---- a/drivers/cpufreq/intel_pstate.c
-+++ b/drivers/cpufreq/intel_pstate.c
-@@ -417,7 +417,7 @@ static void byt_set_pstate(struct cpudata *cpudata, int pstate)
-
- val |= vid;
-
-- wrmsrl(MSR_IA32_PERF_CTL, val);
-+ wrmsrl_on_cpu(cpudata->cpu, MSR_IA32_PERF_CTL, val);
- }
-
- #define BYT_BCLK_FREQS 5
-diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
-index 5967667..1f35487 100644
---- a/drivers/crypto/talitos.c
-+++ b/drivers/crypto/talitos.c
-@@ -927,7 +927,8 @@ static int sg_to_link_tbl(struct scatterlist *sg, int sg_count,
- sg_count--;
- link_tbl_ptr--;
- }
-- be16_add_cpu(&link_tbl_ptr->len, cryptlen);
-+ link_tbl_ptr->len = cpu_to_be16(be16_to_cpu(link_tbl_ptr->len)
-+ + cryptlen);
-
- /* tag end of link table */
- link_tbl_ptr->j_extent = DESC_PTR_LNKTBL_RETURN;
-@@ -2563,6 +2564,7 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev,
- break;
- default:
- dev_err(dev, "unknown algorithm type %d\n", t_alg->algt.type);
-+ kfree(t_alg);
- return ERR_PTR(-EINVAL);
- }
-
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index 9cbef59..9359740 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -1922,9 +1922,15 @@ static void free_pt_##LVL (unsigned long __pt) \
- pt = (u64 *)__pt; \
- \
- for (i = 0; i < 512; ++i) { \
-+ /* PTE present? */ \
- if (!IOMMU_PTE_PRESENT(pt[i])) \
- continue; \
- \
-+ /* Large PTE? */ \
-+ if (PM_PTE_LEVEL(pt[i]) == 0 || \
-+ PM_PTE_LEVEL(pt[i]) == 7) \
-+ continue; \
-+ \
- p = (unsigned long)IOMMU_PTE_PAGE(pt[i]); \
- FN(p); \
- } \
-diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
-index 25f7419..62c3fb9 100644
---- a/drivers/net/phy/phy_device.c
-+++ b/drivers/net/phy/phy_device.c
-@@ -765,10 +765,11 @@ static int genphy_config_advert(struct phy_device *phydev)
- if (phydev->supported & (SUPPORTED_1000baseT_Half |
- SUPPORTED_1000baseT_Full)) {
- adv |= ethtool_adv_to_mii_ctrl1000_t(advertise);
-- if (adv != oldadv)
-- changed = 1;
- }
-
-+ if (adv != oldadv)
-+ changed = 1;
-+
- err = phy_write(phydev, MII_CTRL1000, adv);
- if (err < 0)
- return err;
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 1d7e8a3..aa24f7d 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2905,17 +2905,6 @@ restart:
- vfsmnt = &mnt->mnt;
- continue;
- }
-- /*
-- * Filesystems needing to implement special "root names"
-- * should do so with ->d_dname()
-- */
-- if (IS_ROOT(dentry) &&
-- (dentry->d_name.len != 1 ||
-- dentry->d_name.name[0] != '/')) {
-- WARN(1, "Root dentry has weird name <%.*s>\n",
-- (int) dentry->d_name.len,
-- dentry->d_name.name);
-- }
- if (!error)
- error = is_mounted(vfsmnt) ? 1 : 2;
- break;
-diff --git a/fs/inode.c b/fs/inode.c
-index e846a32..644875b 100644
---- a/fs/inode.c
-+++ b/fs/inode.c
-@@ -1631,8 +1631,8 @@ int file_remove_suid(struct file *file)
- error = security_inode_killpriv(dentry);
- if (!error && killsuid)
- error = __remove_suid(dentry, killsuid);
-- if (!error && (inode->i_sb->s_flags & MS_NOSEC))
-- inode->i_flags |= S_NOSEC;
-+ if (!error)
-+ inode_has_no_xattr(inode);
-
- return error;
- }
-diff --git a/fs/namespace.c b/fs/namespace.c
-index 2faa7ea..fc99d18 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -3031,11 +3031,15 @@ bool fs_fully_visible(struct file_system_type *type)
- if (mnt->mnt.mnt_root != mnt->mnt.mnt_sb->s_root)
- continue;
-
-- /* This mount is not fully visible if there are any child mounts
-- * that cover anything except for empty directories.
-+ /* This mount is not fully visible if there are any
-+ * locked child mounts that cover anything except for
-+ * empty directories.
- */
- list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
- struct inode *inode = child->mnt_mountpoint->d_inode;
-+ /* Only worry about locked mounts */
-+ if (!(mnt->mnt.mnt_flags & MNT_LOCKED))
-+ continue;
- if (!S_ISDIR(inode->i_mode))
- goto next;
- if (inode->i_nlink > 2)
-diff --git a/include/kvm/arm_arch_timer.h b/include/kvm/arm_arch_timer.h
-index 6d9aedd..327b155 100644
---- a/include/kvm/arm_arch_timer.h
-+++ b/include/kvm/arm_arch_timer.h
-@@ -60,7 +60,8 @@ struct arch_timer_cpu {
-
- #ifdef CONFIG_KVM_ARM_TIMER
- int kvm_timer_hyp_init(void);
--int kvm_timer_init(struct kvm *kvm);
-+void kvm_timer_enable(struct kvm *kvm);
-+void kvm_timer_init(struct kvm *kvm);
- void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- const struct kvm_irq_level *irq);
- void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu);
-@@ -73,11 +74,8 @@ static inline int kvm_timer_hyp_init(void)
- return 0;
- };
-
--static inline int kvm_timer_init(struct kvm *kvm)
--{
-- return 0;
--}
--
-+static inline void kvm_timer_enable(struct kvm *kvm) {}
-+static inline void kvm_timer_init(struct kvm *kvm) {}
- static inline void kvm_timer_vcpu_reset(struct kvm_vcpu *vcpu,
- const struct kvm_irq_level *irq) {}
- static inline void kvm_timer_vcpu_init(struct kvm_vcpu *vcpu) {}
-diff --git a/include/net/netns/sctp.h b/include/net/netns/sctp.h
-index 3573a81..8ba379f 100644
---- a/include/net/netns/sctp.h
-+++ b/include/net/netns/sctp.h
-@@ -31,6 +31,7 @@ struct netns_sctp {
- struct list_head addr_waitq;
- struct timer_list addr_wq_timer;
- struct list_head auto_asconf_splist;
-+ /* Lock that protects both addr_waitq and auto_asconf_splist */
- spinlock_t addr_wq_lock;
-
- /* Lock that protects the local_addr_list writers */
-diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index 0dfcc92..2c2d388 100644
---- a/include/net/sctp/structs.h
-+++ b/include/net/sctp/structs.h
-@@ -219,6 +219,10 @@ struct sctp_sock {
- atomic_t pd_mode;
- /* Receive to here while partial delivery is in effect. */
- struct sk_buff_head pd_lobby;
-+
-+ /* These must be the last fields, as they will skipped on copies,
-+ * like on accept and peeloff operations
-+ */
- struct list_head auto_asconf_list;
- int do_auto_asconf;
- };
-diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
-index a9a4a1b..8d423bc 100644
---- a/net/bridge/br_ioctl.c
-+++ b/net/bridge/br_ioctl.c
-@@ -247,9 +247,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
- if (!ns_capable(dev_net(dev)->user_ns, CAP_NET_ADMIN))
- return -EPERM;
-
-- spin_lock_bh(&br->lock);
- br_stp_set_bridge_priority(br, args[1]);
-- spin_unlock_bh(&br->lock);
- return 0;
-
- case BRCTL_SET_PORT_PRIORITY:
-diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 11a2e6c..7bbc8fe 100644
---- a/net/bridge/br_multicast.c
-+++ b/net/bridge/br_multicast.c
-@@ -1086,6 +1086,9 @@ static void br_multicast_add_router(struct net_bridge *br,
- struct net_bridge_port *p;
- struct hlist_node *slot = NULL;
-
-+ if (!hlist_unhashed(&port->rlist))
-+ return;
-+
- hlist_for_each_entry(p, &br->router_list, rlist) {
- if ((unsigned long) port >= (unsigned long) p)
- break;
-@@ -1113,12 +1116,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
- if (port->multicast_router != 1)
- return;
-
-- if (!hlist_unhashed(&port->rlist))
-- goto timer;
--
- br_multicast_add_router(br, port);
-
--timer:
- mod_timer(&port->multicast_router_timer,
- now + br->multicast_querier_interval);
- }
-diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
-index 189ba1e..9a0005a 100644
---- a/net/bridge/br_stp_if.c
-+++ b/net/bridge/br_stp_if.c
-@@ -243,12 +243,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
- return true;
- }
-
--/* called under bridge lock */
-+/* Acquires and releases bridge lock */
- void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- {
- struct net_bridge_port *p;
- int wasroot;
-
-+ spin_lock_bh(&br->lock);
- wasroot = br_is_root_bridge(br);
-
- list_for_each_entry(p, &br->port_list, list) {
-@@ -266,6 +267,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
- br_port_state_selection(br);
- if (br_is_root_bridge(br) && !wasroot)
- br_become_root_bridge(br);
-+ spin_unlock_bh(&br->lock);
- }
-
- /* called under bridge lock */
-diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 7d95f69..0f062c6 100644
---- a/net/core/neighbour.c
-+++ b/net/core/neighbour.c
-@@ -976,6 +976,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
- rc = 0;
- if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
- goto out_unlock_bh;
-+ if (neigh->dead)
-+ goto out_dead;
-
- if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
- if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
-@@ -1032,6 +1034,13 @@ out_unlock_bh:
- write_unlock(&neigh->lock);
- local_bh_enable();
- return rc;
-+
-+out_dead:
-+ if (neigh->nud_state & NUD_STALE)
-+ goto out_unlock_bh;
-+ write_unlock_bh(&neigh->lock);
-+ kfree_skb(skb);
-+ return 1;
- }
- EXPORT_SYMBOL(__neigh_event_send);
-
-@@ -1095,6 +1104,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
- if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
- (old & (NUD_NOARP | NUD_PERMANENT)))
- goto out;
-+ if (neigh->dead)
-+ goto out;
-
- if (!(new & NUD_VALID)) {
- neigh_del_timer(neigh);
-@@ -1244,6 +1255,8 @@ EXPORT_SYMBOL(neigh_update);
- */
- void __neigh_set_probe_once(struct neighbour *neigh)
- {
-+ if (neigh->dead)
-+ return;
- neigh->updated = jiffies;
- if (!(neigh->nud_state & NUD_FAILED))
- return;
-diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 69ec61a..8207f8d 100644
---- a/net/core/skbuff.c
-+++ b/net/core/skbuff.c
-@@ -368,9 +368,11 @@ refill:
- for (order = NETDEV_FRAG_PAGE_MAX_ORDER; ;) {
- gfp_t gfp = gfp_mask;
-
-- if (order)
-+ if (order) {
- gfp |= __GFP_COMP | __GFP_NOWARN |
- __GFP_NOMEMALLOC;
-+ gfp &= ~__GFP_WAIT;
-+ }
- nc->frag.page = alloc_pages(gfp, order);
- if (likely(nc->frag.page))
- break;
-diff --git a/net/core/sock.c b/net/core/sock.c
-index 650dd58..8ebfa52 100644
---- a/net/core/sock.c
-+++ b/net/core/sock.c
-@@ -1914,8 +1914,10 @@ bool skb_page_frag_refill(unsigned int sz, struct page_frag *pfrag, gfp_t prio)
- do {
- gfp_t gfp = prio;
-
-- if (order)
-+ if (order) {
- gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NORETRY;
-+ gfp &= ~__GFP_WAIT;
-+ }
- pfrag->page = alloc_pages(gfp, order);
- if (likely(pfrag->page)) {
- pfrag->offset = 0;
-diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
-index 07bd8ed..951fe55 100644
---- a/net/ipv4/af_inet.c
-+++ b/net/ipv4/af_inet.c
-@@ -228,6 +228,8 @@ int inet_listen(struct socket *sock, int backlog)
- err = 0;
- if (err)
- goto out;
-+
-+ tcp_fastopen_init_key_once(true);
- }
- err = inet_csk_listen_start(sk, backlog);
- if (err)
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 29d240b..dc45221 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -2684,10 +2684,13 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
-
- case TCP_FASTOPEN:
- if (val >= 0 && ((1 << sk->sk_state) & (TCPF_CLOSE |
-- TCPF_LISTEN)))
-+ TCPF_LISTEN))) {
-+ tcp_fastopen_init_key_once(true);
-+
- err = fastopen_init_queue(sk, val);
-- else
-+ } else {
- err = -EINVAL;
-+ }
- break;
- case TCP_TIMESTAMP:
- if (!tp->repair)
-diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
-index f195d93..ee6518d 100644
---- a/net/ipv4/tcp_fastopen.c
-+++ b/net/ipv4/tcp_fastopen.c
-@@ -84,8 +84,6 @@ void tcp_fastopen_cookie_gen(__be32 src, __be32 dst,
- __be32 path[4] = { src, dst, 0, 0 };
- struct tcp_fastopen_context *ctx;
-
-- tcp_fastopen_init_key_once(true);
--
- rcu_read_lock();
- ctx = rcu_dereference(tcp_fastopen_ctx);
- if (ctx) {
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 48b1817..84a60b8 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-@@ -1264,16 +1264,6 @@ static void packet_sock_destruct(struct sock *sk)
- sk_refcnt_debug_dec(sk);
- }
-
--static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
--{
-- int x = atomic_read(&f->rr_cur) + 1;
--
-- if (x >= num)
-- x = 0;
--
-- return x;
--}
--
- static unsigned int fanout_demux_hash(struct packet_fanout *f,
- struct sk_buff *skb,
- unsigned int num)
-@@ -1285,13 +1275,9 @@ static unsigned int fanout_demux_lb(struct packet_fanout *f,
- struct sk_buff *skb,
- unsigned int num)
- {
-- int cur, old;
-+ unsigned int val = atomic_inc_return(&f->rr_cur);
-
-- cur = atomic_read(&f->rr_cur);
-- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
-- fanout_rr_next(f, num))) != cur)
-- cur = old;
-- return cur;
-+ return val % num;
- }
-
- static unsigned int fanout_demux_cpu(struct packet_fanout *f,
-@@ -1345,7 +1331,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
- struct packet_type *pt, struct net_device *orig_dev)
- {
- struct packet_fanout *f = pt->af_packet_priv;
-- unsigned int num = f->num_members;
-+ unsigned int num = ACCESS_ONCE(f->num_members);
- struct packet_sock *po;
- unsigned int idx;
-
-diff --git a/net/sctp/output.c b/net/sctp/output.c
-index 740ca5f..e39e6d5 100644
---- a/net/sctp/output.c
-+++ b/net/sctp/output.c
-@@ -599,7 +599,9 @@ out:
- return err;
- no_route:
- kfree_skb(nskb);
-- IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
-+
-+ if (asoc)
-+ IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
-
- /* FIXME: Returning the 'err' will effect all the associations
- * associated with a socket, although only one of the paths of the
-diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index 604a6ac..f940fdc 100644
---- a/net/sctp/socket.c
-+++ b/net/sctp/socket.c
-@@ -1532,8 +1532,10 @@ static void sctp_close(struct sock *sk, long timeout)
-
- /* Supposedly, no process has access to the socket, but
- * the net layers still may.
-+ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
-+ * held and that should be grabbed before socket lock.
- */
-- local_bh_disable();
-+ spin_lock_bh(&net->sctp.addr_wq_lock);
- bh_lock_sock(sk);
-
- /* Hold the sock, since sk_common_release() will put sock_put()
-@@ -1543,7 +1545,7 @@ static void sctp_close(struct sock *sk, long timeout)
- sk_common_release(sk);
-
- bh_unlock_sock(sk);
-- local_bh_enable();
-+ spin_unlock_bh(&net->sctp.addr_wq_lock);
-
- sock_put(sk);
-
-@@ -3511,6 +3513,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
- return 0;
-
-+ spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- if (val == 0 && sp->do_auto_asconf) {
- list_del(&sp->auto_asconf_list);
- sp->do_auto_asconf = 0;
-@@ -3519,6 +3522,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
- &sock_net(sk)->sctp.auto_asconf_splist);
- sp->do_auto_asconf = 1;
- }
-+ spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);
- return 0;
- }
-
-@@ -4009,18 +4013,28 @@ static int sctp_init_sock(struct sock *sk)
- local_bh_disable();
- percpu_counter_inc(&sctp_sockets_allocated);
- sock_prot_inuse_add(net, sk->sk_prot, 1);
-+
-+ /* Nothing can fail after this block, otherwise
-+ * sctp_destroy_sock() will be called without addr_wq_lock held
-+ */
- if (net->sctp.default_auto_asconf) {
-+ spin_lock(&sock_net(sk)->sctp.addr_wq_lock);
- list_add_tail(&sp->auto_asconf_list,
- &net->sctp.auto_asconf_splist);
- sp->do_auto_asconf = 1;
-- } else
-+ spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);
-+ } else {
- sp->do_auto_asconf = 0;
-+ }
-+
- local_bh_enable();
-
- return 0;
- }
-
--/* Cleanup any SCTP per socket resources. */
-+/* Cleanup any SCTP per socket resources. Must be called with
-+ * sock_net(sk)->sctp.addr_wq_lock held if sp->do_auto_asconf is true
-+ */
- static void sctp_destroy_sock(struct sock *sk)
- {
- struct sctp_sock *sp;
-@@ -6973,6 +6987,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
- newinet->mc_list = NULL;
- }
-
-+static inline void sctp_copy_descendant(struct sock *sk_to,
-+ const struct sock *sk_from)
-+{
-+ int ancestor_size = sizeof(struct inet_sock) +
-+ sizeof(struct sctp_sock) -
-+ offsetof(struct sctp_sock, auto_asconf_list);
-+
-+ if (sk_from->sk_family == PF_INET6)
-+ ancestor_size += sizeof(struct ipv6_pinfo);
-+
-+ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
-+}
-+
- /* Populate the fields of the newsk from the oldsk and migrate the assoc
- * and its messages to the newsk.
- */
-@@ -6987,7 +7014,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- struct sk_buff *skb, *tmp;
- struct sctp_ulpevent *event;
- struct sctp_bind_hashbucket *head;
-- struct list_head tmplist;
-
- /* Migrate socket buffer sizes and all the socket level options to the
- * new socket.
-@@ -6995,12 +7021,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
- newsk->sk_sndbuf = oldsk->sk_sndbuf;
- newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
- /* Brute force copy old sctp opt. */
-- if (oldsp->do_auto_asconf) {
-- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
-- inet_sk_copy_descendant(newsk, oldsk);
-- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
-- } else
-- inet_sk_copy_descendant(newsk, oldsk);
-+ sctp_copy_descendant(newsk, oldsk);
-
- /* Restore the ep value that was overwritten with the above structure
- * copy.
-diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c
-index 5081e80..c6fe405 100644
---- a/virt/kvm/arm/arch_timer.c
-+++ b/virt/kvm/arm/arch_timer.c
-@@ -61,12 +61,14 @@ static void timer_disarm(struct arch_timer_cpu *timer)
-
- static void kvm_timer_inject_irq(struct kvm_vcpu *vcpu)
- {
-+ int ret;
- struct arch_timer_cpu *timer = &vcpu->arch.timer_cpu;
-
- timer->cntv_ctl |= ARCH_TIMER_CTRL_IT_MASK;
-- kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
-- timer->irq->irq,
-- timer->irq->level);
-+ ret = kvm_vgic_inject_irq(vcpu->kvm, vcpu->vcpu_id,
-+ timer->irq->irq,
-+ timer->irq->level);
-+ WARN_ON(ret);
- }
-
- static irqreturn_t kvm_arch_timer_handler(int irq, void *dev_id)
-@@ -307,12 +309,24 @@ void kvm_timer_vcpu_terminate(struct kvm_vcpu *vcpu)
- timer_disarm(timer);
- }
-
--int kvm_timer_init(struct kvm *kvm)
-+void kvm_timer_enable(struct kvm *kvm)
- {
-- if (timecounter && wqueue) {
-- kvm->arch.timer.cntvoff = kvm_phys_timer_read();
-+ if (kvm->arch.timer.enabled)
-+ return;
-+
-+ /*
-+ * There is a potential race here between VCPUs starting for the first
-+ * time, which may be enabling the timer multiple times. That doesn't
-+ * hurt though, because we're just setting a variable to the same
-+ * variable that it already was. The important thing is that all
-+ * VCPUs have the enabled variable set, before entering the guest, if
-+ * the arch timers are enabled.
-+ */
-+ if (timecounter && wqueue)
- kvm->arch.timer.enabled = 1;
-- }
-+}
-
-- return 0;
-+void kvm_timer_init(struct kvm *kvm)
-+{
-+ kvm->arch.timer.cntvoff = kvm_phys_timer_read();
- }
-diff --git a/virt/kvm/arm/vgic.c b/virt/kvm/arm/vgic.c
-index c324a52..152ec76 100644
---- a/virt/kvm/arm/vgic.c
-+++ b/virt/kvm/arm/vgic.c
-@@ -1042,6 +1042,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- lr, irq, vgic_cpu->vgic_lr[lr]);
- BUG_ON(!test_bit(lr, vgic_cpu->lr_used));
- vgic_cpu->vgic_lr[lr] |= GICH_LR_PENDING_BIT;
-+ __clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
- return true;
- }
-
-@@ -1055,6 +1056,7 @@ static bool vgic_queue_irq(struct kvm_vcpu *vcpu, u8 sgi_source_id, int irq)
- vgic_cpu->vgic_lr[lr] = MK_LR_PEND(sgi_source_id, irq);
- vgic_cpu->vgic_irq_lr_map[irq] = lr;
- set_bit(lr, vgic_cpu->lr_used);
-+ __clear_bit(lr, (unsigned long *)vgic_cpu->vgic_elrsr);
-
- if (!vgic_irq_is_edge(vcpu, irq))
- vgic_cpu->vgic_lr[lr] |= GICH_LR_EOI;
-@@ -1209,6 +1211,14 @@ static bool vgic_process_maintenance(struct kvm_vcpu *vcpu)
- if (vgic_cpu->vgic_misr & GICH_MISR_U)
- vgic_cpu->vgic_hcr &= ~GICH_HCR_UIE;
-
-+ /*
-+ * In the next iterations of the vcpu loop, if we sync the vgic state
-+ * after flushing it, but before entering the guest (this happens for
-+ * pending signals and vmid rollovers), then make sure we don't pick
-+ * up any old maintenance interrupts here.
-+ */
-+ memset(vgic_cpu->vgic_eisr, 0, sizeof(vgic_cpu->vgic_eisr[0]) * 2);
-+
- return level_pending;
- }
-
diff --git a/3.14.49/1048_linux-3.14.49.patch b/3.14.49/1048_linux-3.14.49.patch
deleted file mode 100644
index a202904..0000000
--- a/3.14.49/1048_linux-3.14.49.patch
+++ /dev/null
@@ -1,4039 +0,0 @@
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index 01ef408..8faff12 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -91,5 +91,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
- audio(mclk), uart0(cts)
- mpp63 63 gpo, spi0(sck), tclk
--mpp64 64 gpio, spi0(miso), spi0-1(cs1)
--mpp65 65 gpio, spi0(mosi), spi0-1(cs2)
-+mpp64 64 gpio, spi0(miso), spi0(cs1)
-+mpp65 65 gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index bfa0a2e..86dec67 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -41,15 +41,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26 26 gpio, lcd(clk), tdm(fsync)
- mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30 30 gpio, tdm(int1), sd0(clk)
--mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31 31 gpio, tdm(int2), sd0(cmd)
-+mpp32 32 gpio, tdm(int3), sd0(d0)
- mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -57,21 +57,18 @@ mpp36 36 gpio, spi(mosi)
- mpp37 37 gpio, spi(miso)
- mpp38 38 gpio, spi(sck)
- mpp39 39 gpio, spi(cs0)
--mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
-- pcie(clkreq0)
-+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
- pcie(clkreq1)
--mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
-- vdd(cpu0-pd)
--mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
-- vdd(cpu2-3-pd){1}
-+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
- mem(bat)
- mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
- ref(clkout)
--mpp48 48 gpio, tclk, dev(burst/last)
-+mpp48 48 gpio, dev(clkout), dev(burst/last)
-
- * Marvell Armada XP (mv78260 and mv78460 only)
-
-@@ -83,9 +80,9 @@ mpp51 51 gpio, dev(ad16)
- mpp52 52 gpio, dev(ad17)
- mpp53 53 gpio, dev(ad18)
- mpp54 54 gpio, dev(ad19)
--mpp55 55 gpio, dev(ad20), vdd(cpu0-pd)
--mpp56 56 gpio, dev(ad21), vdd(cpu1-pd)
--mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55 55 gpio, dev(ad20)
-+mpp56 56 gpio, dev(ad21)
-+mpp57 57 gpio, dev(ad22)
- mpp58 58 gpio, dev(ad23)
- mpp59 59 gpio, dev(ad24)
- mpp60 60 gpio, dev(ad25)
-@@ -95,6 +92,3 @@ mpp63 63 gpio, dev(ad28)
- mpp64 64 gpio, dev(ad29)
- mpp65 65 gpio, dev(ad30)
- mpp66 66 gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/spi/spi_pl022.txt b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-index 22ed679..4d1673c 100644
---- a/Documentation/devicetree/bindings/spi/spi_pl022.txt
-+++ b/Documentation/devicetree/bindings/spi/spi_pl022.txt
-@@ -4,9 +4,9 @@ Required properties:
- - compatible : "arm,pl022", "arm,primecell"
- - reg : Offset and length of the register set for the device
- - interrupts : Should contain SPI controller interrupt
-+- num-cs : total number of chipselects
-
- Optional properties:
--- num-cs : total number of chipselects
- - cs-gpios : should specify GPIOs used for chipselects.
- The gpios will be referred to as reg = <index> in the SPI child nodes.
- If unspecified, a single SPI device without a chip select can be used.
-diff --git a/Makefile b/Makefile
-index 25393e8..fee8460 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 48
-+SUBLEVEL = 49
- EXTRAVERSION =
- NAME = Remembering Coco
-
-diff --git a/arch/arc/include/asm/cmpxchg.h b/arch/arc/include/asm/cmpxchg.h
-index 03cd689..90de5c5 100644
---- a/arch/arc/include/asm/cmpxchg.h
-+++ b/arch/arc/include/asm/cmpxchg.h
-@@ -25,10 +25,11 @@ __cmpxchg(volatile void *ptr, unsigned long expected, unsigned long new)
- " scond %3, [%1] \n"
- " bnz 1b \n"
- "2: \n"
-- : "=&r"(prev)
-- : "r"(ptr), "ir"(expected),
-- "r"(new) /* can't be "ir". scond can't take limm for "b" */
-- : "cc");
-+ : "=&r"(prev) /* Early clobber, to prevent reg reuse */
-+ : "r"(ptr), /* Not "m": llock only supports reg direct addr mode */
-+ "ir"(expected),
-+ "r"(new) /* can't be "ir". scond can't take LIMM for "b" */
-+ : "cc", "memory"); /* so that gcc knows memory is being written here */
-
- return prev;
- }
-diff --git a/arch/arm64/kernel/vdso/Makefile b/arch/arm64/kernel/vdso/Makefile
-index a268a9a..a622dd0 100644
---- a/arch/arm64/kernel/vdso/Makefile
-+++ b/arch/arm64/kernel/vdso/Makefile
-@@ -15,6 +15,10 @@ ccflags-y := -shared -fno-common -fno-builtin
- ccflags-y += -nostdlib -Wl,-soname=linux-vdso.so.1 \
- $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-
-+# Workaround for bare-metal (ELF) toolchains that neglect to pass -shared
-+# down to collect2, resulting in silent corruption of the vDSO image.
-+ccflags-y += -Wl,-shared
-+
- obj-y += vdso.o
- extra-y += vdso.lds vdso-offsets.h
- CPPFLAGS_vdso.lds += -P -C -U$(ARCH)
-diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
-index baa758d..76c1e6c 100644
---- a/arch/arm64/mm/context.c
-+++ b/arch/arm64/mm/context.c
-@@ -92,6 +92,14 @@ static void reset_context(void *info)
- unsigned int cpu = smp_processor_id();
- struct mm_struct *mm = current->active_mm;
-
-+ /*
-+ * current->active_mm could be init_mm for the idle thread immediately
-+ * after secondary CPU boot or hotplug. TTBR0_EL1 is already set to
-+ * the reserved value, so no need to reset any context.
-+ */
-+ if (mm == &init_mm)
-+ return;
-+
- smp_rmb();
- asid = cpu_last_asid + cpu;
-
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 023747b..e3a24b7 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -46,13 +46,13 @@ struct page *follow_huge_addr(struct mm_struct *mm, unsigned long address,
-
- int pmd_huge(pmd_t pmd)
- {
-- return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
-
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
-- return !(pud_val(pud) & PUD_TABLE_BIT);
-+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- return 0;
- #endif
-diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
-index d0b4c2e..aeb95a1 100644
---- a/arch/arm64/mm/init.c
-+++ b/arch/arm64/mm/init.c
-@@ -243,7 +243,7 @@ static void __init free_unused_memmap(void)
- * memmap entries are valid from the bank end aligned to
- * MAX_ORDER_NR_PAGES.
- */
-- prev_end = ALIGN(start + __phys_to_pfn(reg->size),
-+ prev_end = ALIGN(__phys_to_pfn(reg->base + reg->size),
- MAX_ORDER_NR_PAGES);
- }
-
-diff --git a/arch/mips/kvm/kvm_mips_emul.c b/arch/mips/kvm/kvm_mips_emul.c
-index e75ef82..c76f297 100644
---- a/arch/mips/kvm/kvm_mips_emul.c
-+++ b/arch/mips/kvm/kvm_mips_emul.c
-@@ -1626,7 +1626,7 @@ kvm_mips_complete_mmio_load(struct kvm_vcpu *vcpu, struct kvm_run *run)
- if (vcpu->mmio_needed == 2)
- *gpr = *(int16_t *) run->mmio.data;
- else
-- *gpr = *(int16_t *) run->mmio.data;
-+ *gpr = *(uint16_t *)run->mmio.data;
-
- break;
- case 1:
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 246ef68..2c3c578 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -175,10 +175,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- * Obtain a permanent mapping for the FACS. This is required for the
- * Global Lock and the Firmware Waking Vector
- */
-- status = acpi_tb_initialize_facs();
-- if (ACPI_FAILURE(status)) {
-- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-- return_ACPI_STATUS(status);
-+ if (!(flags & ACPI_NO_FACS_INIT)) {
-+ status = acpi_tb_initialize_facs();
-+ if (ACPI_FAILURE(status)) {
-+ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+ return_ACPI_STATUS(status);
-+ }
- }
- #endif /* !ACPI_REDUCED_HARDWARE */
-
-diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
-index b48aefa..60be8d0 100644
---- a/drivers/acpi/bus.c
-+++ b/drivers/acpi/bus.c
-@@ -450,6 +450,16 @@ static int __init acpi_bus_init_irq(void)
- u8 acpi_gbl_permanent_mmap;
-
-
-+/**
-+ * acpi_early_init - Initialize ACPICA and populate the ACPI namespace.
-+ *
-+ * The ACPI tables are accessible after this, but the handling of events has not
-+ * been initialized and the global lock is not available yet, so AML should not
-+ * be executed at this point.
-+ *
-+ * Doing this before switching the EFI runtime services to virtual mode allows
-+ * the EfiBootServices memory to be freed slightly earlier on boot.
-+ */
- void __init acpi_early_init(void)
- {
- acpi_status status;
-@@ -510,26 +520,42 @@ void __init acpi_early_init(void)
- acpi_gbl_FADT.sci_interrupt = acpi_sci_override_gsi;
- }
- #endif
-+ return;
-+
-+ error0:
-+ disable_acpi();
-+}
-+
-+/**
-+ * acpi_subsystem_init - Finalize the early initialization of ACPI.
-+ *
-+ * Switch over the platform to the ACPI mode (if possible), initialize the
-+ * handling of ACPI events, install the interrupt and global lock handlers.
-+ *
-+ * Doing this too early is generally unsafe, but at the same time it needs to be
-+ * done before all things that really depend on ACPI. The right spot appears to
-+ * be before finalizing the EFI initialization.
-+ */
-+void __init acpi_subsystem_init(void)
-+{
-+ acpi_status status;
-+
-+ if (acpi_disabled)
-+ return;
-
- status = acpi_enable_subsystem(~ACPI_NO_ACPI_ENABLE);
- if (ACPI_FAILURE(status)) {
- printk(KERN_ERR PREFIX "Unable to enable ACPI\n");
-- goto error0;
-+ disable_acpi();
-+ } else {
-+ /*
-+ * If the system is using ACPI then we can be reasonably
-+ * confident that any regulators are managed by the firmware
-+ * so tell the regulator core it has everything it needs to
-+ * know.
-+ */
-+ regulator_has_full_constraints();
- }
--
-- /*
-- * If the system is using ACPI then we can be reasonably
-- * confident that any regulators are managed by the firmware
-- * so tell the regulator core it has everything it needs to
-- * know.
-- */
-- regulator_has_full_constraints();
--
-- return;
--
-- error0:
-- disable_acpi();
-- return;
- }
-
- static int __init acpi_bus_init(void)
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index b1c0fcd..b0e6691 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -4173,9 +4173,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
- ATA_HORKAGE_FIRMWARE_WARN },
-
-- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
-+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
-+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
-
- /* Blacklist entries taken from Silicon Image 3124/3132
- Windows driver .inf file - also several Linux problem reports */
-@@ -4229,6 +4230,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "Micron_M550*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
- { "Crucial_CT*M550SSD*", NULL, ATA_HORKAGE_NO_NCQ_TRIM, },
-
-+ /* devices that don't properly handle TRIM commands */
-+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
-+
- /*
- * Some WD SATA-I drives spin up and down erratically when the link
- * is put into the slumber mode. We don't have full list of the
-@@ -4533,7 +4537,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
- else /* In the ancient relic department - skip all of this */
- return 0;
-
-- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
-+ /* On some disks, this command causes spin-up, so we need longer timeout */
-+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
-
- DPRINTK("EXIT, err_mask=%x\n", err_mask);
- return err_mask;
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index ef8567d..6fecf0b 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -2510,7 +2510,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
- rbuf[14] = (lowest_aligned >> 8) & 0x3f;
- rbuf[15] = lowest_aligned;
-
-- if (ata_id_has_trim(args->id)) {
-+ if (ata_id_has_trim(args->id) &&
-+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
- rbuf[14] |= 0x80; /* TPE */
-
- if (ata_id_has_zero_after_trim(args->id))
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 2495ee5..f0c15f9 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
- kfree(fw_priv);
- }
-
--static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
- {
-- struct firmware_priv *fw_priv = to_firmware_priv(dev);
--
- if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
- return -ENOMEM;
- if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
-@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
- return 0;
- }
-
-+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+ struct firmware_priv *fw_priv = to_firmware_priv(dev);
-+ int err = 0;
-+
-+ mutex_lock(&fw_lock);
-+ if (fw_priv->buf)
-+ err = do_firmware_uevent(fw_priv, env);
-+ mutex_unlock(&fw_lock);
-+ return err;
-+}
-+
- static struct class firmware_class = {
- .name = "firmware",
- .class_attrs = firmware_class_attrs,
-diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
-index 2f9a3d8..58559d7 100644
---- a/drivers/base/regmap/regmap.c
-+++ b/drivers/base/regmap/regmap.c
-@@ -808,11 +808,10 @@ EXPORT_SYMBOL_GPL(devm_regmap_init);
- static void regmap_field_init(struct regmap_field *rm_field,
- struct regmap *regmap, struct reg_field reg_field)
- {
-- int field_bits = reg_field.msb - reg_field.lsb + 1;
- rm_field->regmap = regmap;
- rm_field->reg = reg_field.reg;
- rm_field->shift = reg_field.lsb;
-- rm_field->mask = ((BIT(field_bits) - 1) << reg_field.lsb);
-+ rm_field->mask = GENMASK(reg_field.msb, reg_field.lsb);
- rm_field->id_size = reg_field.id_size;
- rm_field->id_offset = reg_field.id_offset;
- }
-@@ -1947,7 +1946,7 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
- &ival);
- if (ret != 0)
- return ret;
-- memcpy(val + (i * val_bytes), &ival, val_bytes);
-+ map->format.format_val(val + (i * val_bytes), ival, 0);
- }
- }
-
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index 63688d3..12be7cb 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -1826,11 +1826,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
- rbd_assert(obj_request_type_valid(type));
-
- size = strlen(object_name) + 1;
-- name = kmalloc(size, GFP_KERNEL);
-+ name = kmalloc(size, GFP_NOIO);
- if (!name)
- return NULL;
-
-- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
-+ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
- if (!obj_request) {
- kfree(name);
- return NULL;
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index c0e7a9aa9..c23658e 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -1293,6 +1293,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
- }
- fw_ptr = fw->data;
-
-+ kfree_skb(skb);
-+
- /* This Intel specific command enables the manufacturer mode of the
- * controller.
- *
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index 5c85350..19e301f 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -586,7 +586,7 @@ static inline int needs_ilk_vtd_wa(void)
- /* Query intel_iommu to see if we need the workaround. Presumably that
- * was loaded first.
- */
-- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
-+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
- gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
- intel_iommu_gfx_mapped)
- return 1;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index 102463ba..643bba7 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -579,6 +579,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- goto cleanup;
- }
-
-+ ibmvtpm->dev = dev;
-+ ibmvtpm->vdev = vio_dev;
-+
- crq_q = &ibmvtpm->crq_queue;
- crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
- if (!crq_q->crq_addr) {
-@@ -623,8 +626,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
-
- crq_q->index = 0;
-
-- ibmvtpm->dev = dev;
-- ibmvtpm->vdev = vio_dev;
- TPM_VPRIV(chip) = (void *)ibmvtpm;
-
- spin_lock_init(&ibmvtpm->rtce_lock);
-diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
-index 831b482..ddd03f8 100644
---- a/drivers/clocksource/exynos_mct.c
-+++ b/drivers/clocksource/exynos_mct.c
-@@ -422,15 +422,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
-
- if (mct_int_type == MCT_INT_SPI) {
-- evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
-- if (request_irq(evt->irq, exynos4_mct_tick_isr,
-- IRQF_TIMER | IRQF_NOBALANCING,
-- evt->name, mevt)) {
-- pr_err("exynos-mct: cannot register IRQ %d\n",
-- evt->irq);
-+
-+ if (evt->irq == -1)
- return -EIO;
-- }
-- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
-+
-+ irq_force_affinity(evt->irq, cpumask_of(cpu));
-+ enable_irq(evt->irq);
- } else {
- enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
- }
-@@ -443,10 +440,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- static void exynos4_local_timer_stop(struct clock_event_device *evt)
- {
- evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
-- if (mct_int_type == MCT_INT_SPI)
-- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
-- else
-+ if (mct_int_type == MCT_INT_SPI) {
-+ if (evt->irq != -1)
-+ disable_irq_nosync(evt->irq);
-+ } else {
- disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
-+ }
- }
-
- static int exynos4_mct_cpu_notify(struct notifier_block *self,
-@@ -478,7 +477,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
-
- static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
- {
-- int err;
-+ int err, cpu;
- struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
- struct clk *mct_clk, *tick_clk;
-
-@@ -505,7 +504,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
- WARN(err, "MCT: can't request IRQ %d (%d)\n",
- mct_irqs[MCT_L0_IRQ], err);
- } else {
-- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
-+ for_each_possible_cpu(cpu) {
-+ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
-+ struct mct_clock_event_device *pcpu_mevt =
-+ per_cpu_ptr(&percpu_mct_tick, cpu);
-+
-+ pcpu_mevt->evt.irq = -1;
-+
-+ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
-+ if (request_irq(mct_irq,
-+ exynos4_mct_tick_isr,
-+ IRQF_TIMER | IRQF_NOBALANCING,
-+ pcpu_mevt->name, pcpu_mevt)) {
-+ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
-+ cpu);
-+
-+ continue;
-+ }
-+ pcpu_mevt->evt.irq = mct_irq;
-+ }
- }
-
- err = register_cpu_notifier(&exynos4_mct_cpu_nb);
-diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
-index e3d2052..1adc039 100644
---- a/drivers/cpuidle/cpuidle.c
-+++ b/drivers/cpuidle/cpuidle.c
-@@ -131,6 +131,9 @@ int cpuidle_idle_call(void)
-
- /* ask the governor for the next state */
- next_state = cpuidle_curr_governor->select(drv, dev);
-+ if (next_state < 0)
-+ return -EBUSY;
-+
- if (need_resched()) {
- dev->last_residency = 0;
- /* give the governor an opportunity to reflect on the outcome */
-diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
-index cf7f2f0..027c484 100644
---- a/drivers/cpuidle/governors/menu.c
-+++ b/drivers/cpuidle/governors/menu.c
-@@ -297,7 +297,7 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
- data->needs_update = 0;
- }
-
-- data->last_state_idx = 0;
-+ data->last_state_idx = CPUIDLE_DRIVER_STATE_START - 1;
- data->exit_us = 0;
-
- /* Special case when user has set very strict latency requirement */
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index 394cbc5..6b2f01d 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -316,7 +316,8 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- dma_cookie_t cookie = 0;
- int busy = mv_chan_is_busy(mv_chan);
- u32 current_desc = mv_chan_get_current_desc(mv_chan);
-- int seen_current = 0;
-+ int current_cleaned = 0;
-+ struct mv_xor_desc *hw_desc;
-
- dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
- dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
-@@ -328,38 +329,57 @@ static void __mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
-
- list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
- chain_node) {
-- prefetch(_iter);
-- prefetch(&_iter->async_tx);
-
-- /* do not advance past the current descriptor loaded into the
-- * hardware channel, subsequent descriptors are either in
-- * process or have not been submitted
-- */
-- if (seen_current)
-- break;
-+ /* clean finished descriptors */
-+ hw_desc = iter->hw_desc;
-+ if (hw_desc->status & XOR_DESC_SUCCESS) {
-+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
-+ cookie);
-
-- /* stop the search if we reach the current descriptor and the
-- * channel is busy
-- */
-- if (iter->async_tx.phys == current_desc) {
-- seen_current = 1;
-- if (busy)
-+ /* done processing desc, clean slot */
-+ mv_xor_clean_slot(iter, mv_chan);
-+
-+ /* break if we did cleaned the current */
-+ if (iter->async_tx.phys == current_desc) {
-+ current_cleaned = 1;
-+ break;
-+ }
-+ } else {
-+ if (iter->async_tx.phys == current_desc) {
-+ current_cleaned = 0;
- break;
-+ }
- }
--
-- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
--
-- if (mv_xor_clean_slot(iter, mv_chan))
-- break;
- }
-
- if ((busy == 0) && !list_empty(&mv_chan->chain)) {
-- struct mv_xor_desc_slot *chain_head;
-- chain_head = list_entry(mv_chan->chain.next,
-- struct mv_xor_desc_slot,
-- chain_node);
--
-- mv_xor_start_new_chain(mv_chan, chain_head);
-+ if (current_cleaned) {
-+ /*
-+ * current descriptor cleaned and removed, run
-+ * from list head
-+ */
-+ iter = list_entry(mv_chan->chain.next,
-+ struct mv_xor_desc_slot,
-+ chain_node);
-+ mv_xor_start_new_chain(mv_chan, iter);
-+ } else {
-+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
-+ /*
-+ * descriptors are still waiting after
-+ * current, trigger them
-+ */
-+ iter = list_entry(iter->chain_node.next,
-+ struct mv_xor_desc_slot,
-+ chain_node);
-+ mv_xor_start_new_chain(mv_chan, iter);
-+ } else {
-+ /*
-+ * some descriptors are still waiting
-+ * to be cleaned
-+ */
-+ tasklet_schedule(&mv_chan->irq_tasklet);
-+ }
-+ }
- }
-
- if (cookie > 0)
-diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
-index d074922..5d14e4b 100644
---- a/drivers/dma/mv_xor.h
-+++ b/drivers/dma/mv_xor.h
-@@ -33,6 +33,7 @@
- #define XOR_OPERATION_MODE_XOR 0
- #define XOR_OPERATION_MODE_MEMCPY 2
- #define XOR_DESCRIPTOR_SWAP BIT(14)
-+#define XOR_DESC_SUCCESS 0x40000000
-
- #define XOR_CURR_DESC(chan) (chan->mmr_high_base + 0x10 + (chan->idx * 4))
- #define XOR_NEXT_DESC(chan) (chan->mmr_high_base + 0x00 + (chan->idx * 4))
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3b7d32d..903db3c 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -2155,8 +2155,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- if (!drm_core_check_feature(dev, DRIVER_MODESET))
- return -EINVAL;
-
-- /* For some reason crtc x/y offsets are signed internally. */
-- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
-+ /*
-+ * Universal plane src offsets are only 16.16, prevent havoc for
-+ * drivers using universal plane code internally.
-+ */
-+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
- return -ERANGE;
-
- drm_modeset_lock_all(dev);
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index eb89653..c5e96a3 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
-
- cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
- cmd->type = QXL_SURFACE_CMD_CREATE;
-+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
- cmd->u.surface_create.format = surf->surf.format;
- cmd->u.surface_create.width = surf->surf.width;
- cmd->u.surface_create.height = surf->surf.height;
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index 0bb86e6..56a13a9 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- qobj = gem_to_qxl_bo(gobj);
-
- ret = qxl_release_list_add(release, qobj);
-- if (ret)
-+ if (ret) {
-+ drm_gem_object_unreference_unlocked(gobj);
- return NULL;
-+ }
-
- return qobj;
- }
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index c4558bd..2fd2fb3 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -4148,6 +4148,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
- WDOORBELL32(ring->doorbell_index, ring->wptr);
- }
-
-+static void cik_compute_stop(struct radeon_device *rdev,
-+ struct radeon_ring *ring)
-+{
-+ u32 j, tmp;
-+
-+ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
-+ /* Disable wptr polling. */
-+ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
-+ tmp &= ~WPTR_POLL_EN;
-+ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
-+ /* Disable HQD. */
-+ if (RREG32(CP_HQD_ACTIVE) & 1) {
-+ WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
-+ for (j = 0; j < rdev->usec_timeout; j++) {
-+ if (!(RREG32(CP_HQD_ACTIVE) & 1))
-+ break;
-+ udelay(1);
-+ }
-+ WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
-+ WREG32(CP_HQD_PQ_RPTR, 0);
-+ WREG32(CP_HQD_PQ_WPTR, 0);
-+ }
-+ cik_srbm_select(rdev, 0, 0, 0, 0);
-+}
-+
- /**
- * cik_cp_compute_enable - enable/disable the compute CP MEs
- *
-@@ -4161,6 +4186,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
- if (enable)
- WREG32(CP_MEC_CNTL, 0);
- else {
-+ /*
-+ * To make hibernation reliable we need to clear compute ring
-+ * configuration before halting the compute ring.
-+ */
-+ mutex_lock(&rdev->srbm_mutex);
-+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
-+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
-+ mutex_unlock(&rdev->srbm_mutex);
-+
- WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
- rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
- rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
-diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
-index 66ba713..e590aec 100644
---- a/drivers/gpu/drm/radeon/cik_sdma.c
-+++ b/drivers/gpu/drm/radeon/cik_sdma.c
-@@ -266,6 +266,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
- }
- rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
- rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
-+
-+ /* FIXME use something else than big hammer but after few days can not
-+ * seem to find good combination so reset SDMA blocks as it seems we
-+ * do not shut them down properly. This fix hibernation and does not
-+ * affect suspend to ram.
-+ */
-+ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
-+ (void)RREG32(SRBM_SOFT_RESET);
-+ udelay(50);
-+ WREG32(SRBM_SOFT_RESET, 0);
-+ (void)RREG32(SRBM_SOFT_RESET);
- }
-
- /**
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index a8f9b46..e609722 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -251,8 +251,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
- }
- }
- }
-- mb();
-- radeon_gart_tlb_flush(rdev);
-+ if (rdev->gart.ptr) {
-+ mb();
-+ radeon_gart_tlb_flush(rdev);
-+ }
- }
-
- /**
-@@ -294,8 +296,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
- }
- }
- }
-- mb();
-- radeon_gart_tlb_flush(rdev);
-+ if (rdev->gart.ptr) {
-+ mb();
-+ radeon_gart_tlb_flush(rdev);
-+ }
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index b3f0293..f8b20e1 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- struct drm_mode_config *mode_config = &dev->mode_config;
- struct drm_connector *connector;
-
-+ mutex_lock(&mode_config->mutex);
- if (mode_config->num_connector) {
- list_for_each_entry(connector, &mode_config->connector_list, head)
- radeon_connector_hotplug(connector);
- }
-+ mutex_unlock(&mode_config->mutex);
- /* Just fire off a uevent and let userspace tell us what to do */
- drm_helper_hpd_irq_event(dev);
- }
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index 11804cc..c9053f7 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- { 0, 0, 0, 0 },
- };
-
-diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
-index d219c06..972444a 100644
---- a/drivers/hwmon/mcp3021.c
-+++ b/drivers/hwmon/mcp3021.c
-@@ -31,14 +31,11 @@
- /* output format */
- #define MCP3021_SAR_SHIFT 2
- #define MCP3021_SAR_MASK 0x3ff
--
- #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */
--#define MCP3021_OUTPUT_SCALE 4
-
- #define MCP3221_SAR_SHIFT 0
- #define MCP3221_SAR_MASK 0xfff
- #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */
--#define MCP3221_OUTPUT_SCALE 1
-
- enum chips {
- mcp3021,
-@@ -54,7 +51,6 @@ struct mcp3021_data {
- u16 sar_shift;
- u16 sar_mask;
- u8 output_res;
-- u8 output_scale;
- };
-
- static int mcp3021_read16(struct i2c_client *client)
-@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
-
- static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
- {
-- if (val == 0)
-- return 0;
--
-- val = val * data->output_scale - data->output_scale / 2;
--
-- return val * DIV_ROUND_CLOSEST(data->vdd,
-- (1 << data->output_res) * data->output_scale);
-+ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
- }
-
- static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
-@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
- data->sar_shift = MCP3021_SAR_SHIFT;
- data->sar_mask = MCP3021_SAR_MASK;
- data->output_res = MCP3021_OUTPUT_RES;
-- data->output_scale = MCP3021_OUTPUT_SCALE;
- break;
-
- case mcp3221:
- data->sar_shift = MCP3221_SAR_SHIFT;
- data->sar_mask = MCP3221_SAR_MASK;
- data->output_res = MCP3221_OUTPUT_RES;
-- data->output_scale = MCP3221_OUTPUT_SCALE;
- break;
- }
-
-diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
-index 8873d84..50862c9 100644
---- a/drivers/i2c/busses/i2c-at91.c
-+++ b/drivers/i2c/busses/i2c-at91.c
-@@ -62,6 +62,9 @@
- #define AT91_TWI_UNRE 0x0080 /* Underrun Error */
- #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */
-
-+#define AT91_TWI_INT_MASK \
-+ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
-+
- #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */
- #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */
- #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */
-@@ -117,13 +120,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
-
- static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
- {
-- at91_twi_write(dev, AT91_TWI_IDR,
-- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
-+ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
- }
-
- static void at91_twi_irq_save(struct at91_twi_dev *dev)
- {
-- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
-+ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
- at91_disable_twi_interrupts(dev);
- }
-
-@@ -213,6 +215,14 @@ static void at91_twi_write_data_dma_callback(void *data)
- dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
- dev->buf_len, DMA_TO_DEVICE);
-
-+ /*
-+ * When this callback is called, THR/TX FIFO is likely not to be empty
-+ * yet. So we have to wait for TXCOMP or NACK bits to be set into the
-+ * Status Register to be sure that the STOP bit has been sent and the
-+ * transfer is completed. The NACK interrupt has already been enabled,
-+ * we just have to enable TXCOMP one.
-+ */
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
- }
-
-@@ -307,7 +317,7 @@ static void at91_twi_read_data_dma_callback(void *data)
- /* The last two bytes have to be read without using dma */
- dev->buf += dev->buf_len - 2;
- dev->buf_len = 2;
-- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
- }
-
- static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
-@@ -368,7 +378,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
- /* catch error flags */
- dev->transfer_status |= status;
-
-- if (irqstatus & AT91_TWI_TXCOMP) {
-+ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
- at91_disable_twi_interrupts(dev);
- complete(&dev->cmd_complete);
- }
-@@ -381,6 +391,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- int ret;
- bool has_unre_flag = dev->pdata->has_unre_flag;
-
-+ /*
-+ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
-+ * read flag but shows the state of the transmission at the time the
-+ * Status Register is read. According to the programmer datasheet,
-+ * TXCOMP is set when both holding register and internal shifter are
-+ * empty and STOP condition has been sent.
-+ * Consequently, we should enable NACK interrupt rather than TXCOMP to
-+ * detect transmission failure.
-+ *
-+ * Besides, the TXCOMP bit is already set before the i2c transaction
-+ * has been started. For read transactions, this bit is cleared when
-+ * writing the START bit into the Control Register. So the
-+ * corresponding interrupt can safely be enabled just after.
-+ * However for write transactions managed by the CPU, we first write
-+ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
-+ * interrupt. If TXCOMP interrupt were enabled before writing into THR,
-+ * the interrupt handler would be called immediately and the i2c command
-+ * would be reported as completed.
-+ * Also when a write transaction is managed by the DMA controller,
-+ * enabling the TXCOMP interrupt in this function may lead to a race
-+ * condition since we don't know whether the TXCOMP interrupt is enabled
-+ * before or after the DMA has started to write into THR. So the TXCOMP
-+ * interrupt is enabled later by at91_twi_write_data_dma_callback().
-+ * Immediately after in that DMA callback, we still need to send the
-+ * STOP condition manually writing the corresponding bit into the
-+ * Control Register.
-+ */
-+
- dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
- (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
-
-@@ -411,26 +449,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- * seems to be the best solution.
- */
- if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- at91_twi_read_data_dma(dev);
-- /*
-- * It is important to enable TXCOMP irq here because
-- * doing it only when transferring the last two bytes
-- * will mask NACK errors since TXCOMP is set when a
-- * NACK occurs.
-- */
-- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP);
-- } else
-+ } else {
- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
-+ AT91_TWI_TXCOMP |
-+ AT91_TWI_NACK |
-+ AT91_TWI_RXRDY);
-+ }
- } else {
- if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- at91_twi_write_data_dma(dev);
-- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- } else {
- at91_twi_write_next_byte(dev);
- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
-+ AT91_TWI_TXCOMP |
-+ AT91_TWI_NACK |
-+ AT91_TWI_TXRDY);
- }
- }
-
-diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
-index e6bf77d..ed4e45f 100644
---- a/drivers/iio/adc/at91_adc.c
-+++ b/drivers/iio/adc/at91_adc.c
-@@ -58,7 +58,7 @@ struct at91_adc_caps {
- u8 ts_pen_detect_sensitivity;
-
- /* startup time calculate function */
-- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
-+ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
-
- u8 num_channels;
- struct at91_adc_reg_desc registers;
-@@ -82,7 +82,7 @@ struct at91_adc_state {
- u8 num_channels;
- void __iomem *reg_base;
- struct at91_adc_reg_desc *registers;
-- u8 startup_time;
-+ u32 startup_time;
- u8 sample_hold_time;
- bool sleep_mode;
- struct iio_trigger **trig;
-@@ -590,7 +590,7 @@ ret:
- return ret;
- }
-
--static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
- {
- /*
- * Number of ticks needed to cover the startup time of the ADC
-@@ -601,7 +601,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
- return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
- }
-
--static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
- {
- /*
- * For sama5d3x and at91sam9x5, the formula changes to:
-diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
-index e8199cc..1e66651 100644
---- a/drivers/iio/dac/ad5624r_spi.c
-+++ b/drivers/iio/dac/ad5624r_spi.c
-@@ -22,7 +22,7 @@
- #include "ad5624r.h"
-
- static int ad5624r_spi_write(struct spi_device *spi,
-- u8 cmd, u8 addr, u16 val, u8 len)
-+ u8 cmd, u8 addr, u16 val, u8 shift)
- {
- u32 data;
- u8 msg[3];
-@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
- * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
- * for the AD5664R, AD5644R, and AD5624R, respectively.
- */
-- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
-+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
- msg[0] = data >> 16;
- msg[1] = data >> 8;
- msg[2] = data;
-diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
-index 84a0789..7a80509 100644
---- a/drivers/iio/temperature/tmp006.c
-+++ b/drivers/iio/temperature/tmp006.c
-@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
- struct tmp006_data *data = iio_priv(indio_dev);
- int i;
-
-+ if (mask != IIO_CHAN_INFO_SAMP_FREQ)
-+ return -EINVAL;
-+
- for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
- if ((val == tmp006_freqs[i][0]) &&
- (val2 == tmp006_freqs[i][1])) {
-diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
-index 6014227..dd2b610 100644
---- a/drivers/infiniband/ulp/isert/ib_isert.c
-+++ b/drivers/infiniband/ulp/isert/ib_isert.c
-@@ -59,6 +59,8 @@ static int
- isert_rdma_accept(struct isert_conn *isert_conn);
- struct rdma_cm_id *isert_setup_id(struct isert_np *isert_np);
-
-+static void isert_release_work(struct work_struct *work);
-+
- static void
- isert_qp_event_callback(struct ib_event *e, void *context)
- {
-@@ -206,7 +208,7 @@ fail:
- static void
- isert_free_rx_descriptors(struct isert_conn *isert_conn)
- {
-- struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
-+ struct ib_device *ib_dev = isert_conn->conn_device->ib_device;
- struct iser_rx_desc *rx_desc;
- int i;
-
-@@ -534,6 +536,7 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- mutex_init(&isert_conn->conn_mutex);
- spin_lock_init(&isert_conn->conn_lock);
- INIT_LIST_HEAD(&isert_conn->conn_fr_pool);
-+ INIT_WORK(&isert_conn->release_work, isert_release_work);
-
- isert_conn->conn_cm_id = cma_id;
- isert_conn->responder_resources = event->param.conn.responder_resources;
-@@ -647,9 +650,9 @@ out:
- static void
- isert_connect_release(struct isert_conn *isert_conn)
- {
-- struct ib_device *ib_dev = isert_conn->conn_cm_id->device;
- struct isert_device *device = isert_conn->conn_device;
- int cq_index;
-+ struct ib_device *ib_dev = device->ib_device;
-
- pr_debug("Entering isert_connect_release(): >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\n");
-
-@@ -657,7 +660,8 @@ isert_connect_release(struct isert_conn *isert_conn)
- isert_conn_free_fastreg_pool(isert_conn);
-
- isert_free_rx_descriptors(isert_conn);
-- rdma_destroy_id(isert_conn->conn_cm_id);
-+ if (isert_conn->conn_cm_id)
-+ rdma_destroy_id(isert_conn->conn_cm_id);
-
- if (isert_conn->conn_qp) {
- cq_index = ((struct isert_cq_desc *)
-@@ -799,6 +803,7 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- {
- struct isert_np *isert_np = cma_id->context;
- struct isert_conn *isert_conn;
-+ bool terminating = false;
-
- if (isert_np->np_cm_id == cma_id)
- return isert_np_cma_handler(cma_id->context, event);
-@@ -806,21 +811,37 @@ isert_disconnected_handler(struct rdma_cm_id *cma_id,
- isert_conn = cma_id->qp->qp_context;
-
- mutex_lock(&isert_conn->conn_mutex);
-+ terminating = (isert_conn->state == ISER_CONN_TERMINATING);
- isert_conn_terminate(isert_conn);
- mutex_unlock(&isert_conn->conn_mutex);
-
- pr_info("conn %p completing conn_wait\n", isert_conn);
- complete(&isert_conn->conn_wait);
-
-+ if (terminating)
-+ goto out;
-+
-+ mutex_lock(&isert_np->np_accept_mutex);
-+ if (!list_empty(&isert_conn->conn_accept_node)) {
-+ list_del_init(&isert_conn->conn_accept_node);
-+ isert_put_conn(isert_conn);
-+ queue_work(isert_release_wq, &isert_conn->release_work);
-+ }
-+ mutex_unlock(&isert_np->np_accept_mutex);
-+
-+out:
- return 0;
- }
-
--static void
-+static int
- isert_connect_error(struct rdma_cm_id *cma_id)
- {
- struct isert_conn *isert_conn = cma_id->qp->qp_context;
-
-+ isert_conn->conn_cm_id = NULL;
- isert_put_conn(isert_conn);
-+
-+ return -1;
- }
-
- static int
-@@ -850,7 +871,7 @@ isert_cma_handler(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
- case RDMA_CM_EVENT_REJECTED: /* FALLTHRU */
- case RDMA_CM_EVENT_UNREACHABLE: /* FALLTHRU */
- case RDMA_CM_EVENT_CONNECT_ERROR:
-- isert_connect_error(cma_id);
-+ ret = isert_connect_error(cma_id);
- break;
- default:
- pr_err("Unhandled RDMA CMA event: %d\n", event->event);
-@@ -2944,7 +2965,6 @@ static void isert_wait_conn(struct iscsi_conn *conn)
-
- wait_for_completion(&isert_conn->conn_wait_comp_err);
-
-- INIT_WORK(&isert_conn->release_work, isert_release_work);
- queue_work(isert_release_wq, &isert_conn->release_work);
- }
-
-diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c
-index f37d63c..825545c 100644
---- a/drivers/leds/led-class.c
-+++ b/drivers/leds/led-class.c
-@@ -178,6 +178,7 @@ void led_classdev_resume(struct led_classdev *led_cdev)
- }
- EXPORT_SYMBOL_GPL(led_classdev_resume);
-
-+#ifdef CONFIG_PM_SLEEP
- static int led_suspend(struct device *dev)
- {
- struct led_classdev *led_cdev = dev_get_drvdata(dev);
-@@ -197,11 +198,9 @@ static int led_resume(struct device *dev)
-
- return 0;
- }
-+#endif
-
--static const struct dev_pm_ops leds_class_dev_pm_ops = {
-- .suspend = led_suspend,
-- .resume = led_resume,
--};
-+static SIMPLE_DEV_PM_OPS(leds_class_dev_pm_ops, led_suspend, led_resume);
-
- /**
- * led_classdev_register - register a new object of led_classdev class.
-diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
-index 28a9012..b3b0697 100644
---- a/drivers/md/dm-stats.c
-+++ b/drivers/md/dm-stats.c
-@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
- return -EINVAL;
-
- if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
-+ if (!divisor)
-+ return -EINVAL;
- step = end - start;
- if (do_div(step, divisor))
- step++;
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 40959ee..b4067b9 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -6232,7 +6232,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
- mddev->ctime != info->ctime ||
- mddev->level != info->level ||
- /* mddev->layout != info->layout || */
-- !mddev->persistent != info->not_persistent||
-+ mddev->persistent != !info->not_persistent ||
- mddev->chunk_sectors != info->chunk_size >> 9 ||
- /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
- ((state^info->state) & 0xfffffe00)
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index b88757c..a03178e 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
-
- if (s < 0 && nr_center < -s) {
- /* not enough in central node */
-- shift(left, center, nr_center);
-- s = nr_center - target;
-+ shift(left, center, -nr_center);
-+ s += nr_center;
- shift(left, right, s);
- nr_right += s;
- } else
-@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- if (s > 0 && nr_center < s) {
- /* not enough in central node */
- shift(center, right, nr_center);
-- s = target - nr_center;
-+ s -= nr_center;
- shift(left, right, s);
- nr_left -= s;
- } else
-diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
-index 200ac12..fdd3793 100644
---- a/drivers/md/persistent-data/dm-btree.c
-+++ b/drivers/md/persistent-data/dm-btree.c
-@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
- int r;
- struct del_stack *s;
-
-- s = kmalloc(sizeof(*s), GFP_KERNEL);
-+ s = kmalloc(sizeof(*s), GFP_NOIO);
- if (!s)
- return -ENOMEM;
- s->info = info;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index f4e22bc..199c9cc 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
- smm->recursion_count++;
- }
-
-+static int apply_bops(struct sm_metadata *smm)
-+{
-+ int r = 0;
-+
-+ while (!brb_empty(&smm->uncommitted)) {
-+ struct block_op bop;
-+
-+ r = brb_pop(&smm->uncommitted, &bop);
-+ if (r) {
-+ DMERR("bug in bop ring buffer");
-+ break;
-+ }
-+
-+ r = commit_bop(smm, &bop);
-+ if (r)
-+ break;
-+ }
-+
-+ return r;
-+}
-+
- static int out(struct sm_metadata *smm)
- {
- int r = 0;
-@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
- return -ENOMEM;
- }
-
-- if (smm->recursion_count == 1) {
-- while (!brb_empty(&smm->uncommitted)) {
-- struct block_op bop;
--
-- r = brb_pop(&smm->uncommitted, &bop);
-- if (r) {
-- DMERR("bug in bop ring buffer");
-- break;
-- }
--
-- r = commit_bop(smm, &bop);
-- if (r)
-- break;
-- }
-- }
-+ if (smm->recursion_count == 1)
-+ apply_bops(smm);
-
- smm->recursion_count--;
-
-@@ -702,6 +710,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
- }
- old_len = smm->begin;
-
-+ r = apply_bops(smm);
-+ if (r) {
-+ DMERR("%s: apply_bops failed", __func__);
-+ goto out;
-+ }
-+
- r = sm_ll_commit(&smm->ll);
- if (r)
- goto out;
-@@ -771,6 +785,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
- if (r)
- return r;
-
-+ r = apply_bops(smm);
-+ if (r) {
-+ DMERR("%s: apply_bops failed", __func__);
-+ return r;
-+ }
-+
- return sm_metadata_commit(sm);
- }
-
-diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
-index fb504f1..5930aee 100644
---- a/drivers/media/dvb-frontends/af9013.c
-+++ b/drivers/media/dvb-frontends/af9013.c
-@@ -606,6 +606,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
- }
- }
-
-+ /* Return an error if can't find bandwidth or the right clock */
-+ if (i == ARRAY_SIZE(coeff_lut))
-+ return -EINVAL;
-+
- ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
- sizeof(coeff_lut[i].val));
- }
-diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
-index 2916d7c..7bc68b3 100644
---- a/drivers/media/dvb-frontends/cx24116.c
-+++ b/drivers/media/dvb-frontends/cx24116.c
-@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- struct cx24116_state *state = fe->demodulator_priv;
- int i, ret;
-
-+ /* Validate length */
-+ if (d->msg_len > sizeof(d->msg))
-+ return -EINVAL;
-+
- /* Dump DiSEqC message */
- if (debug) {
- printk(KERN_INFO "cx24116: %s(", __func__);
-@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- printk(") toneburst=%d\n", toneburst);
- }
-
-- /* Validate length */
-- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
-- return -EINVAL;
--
- /* DiSEqC message */
- for (i = 0; i < d->msg_len; i++)
- state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
-diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
-index a6c3c9e..d2eab06 100644
---- a/drivers/media/dvb-frontends/cx24117.c
-+++ b/drivers/media/dvb-frontends/cx24117.c
-@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
- dev_dbg(&state->priv->i2c->dev, ")\n");
-
- /* Validate length */
-- if (d->msg_len > 15)
-+ if (d->msg_len > sizeof(d->msg))
- return -EINVAL;
-
- /* DiSEqC message */
-diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
-index 93eeaf7..0b4f8fe 100644
---- a/drivers/media/dvb-frontends/s5h1420.c
-+++ b/drivers/media/dvb-frontends/s5h1420.c
-@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
- int result = 0;
-
- dprintk("enter %s\n", __func__);
-- if (cmd->msg_len > 8)
-+ if (cmd->msg_len > sizeof(cmd->msg))
- return -EINVAL;
-
- /* setup for DISEQC */
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index b1e21fc..d71f5ef 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -205,6 +205,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
-
- ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
-
-+ mmc_blk_put(md);
-+
- return ret;
- }
-
-@@ -1861,9 +1863,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- break;
- case MMC_BLK_CMD_ERR:
- ret = mmc_blk_cmd_err(md, card, brq, req, ret);
-- if (!mmc_blk_reset(md, card->host, type))
-- break;
-- goto cmd_abort;
-+ if (mmc_blk_reset(md, card->host, type))
-+ goto cmd_abort;
-+ if (!ret)
-+ goto start_new_req;
-+ break;
- case MMC_BLK_RETRY:
- if (retry++ < 5)
- break;
-diff --git a/drivers/mtd/maps/dc21285.c b/drivers/mtd/maps/dc21285.c
-index f8a7dd1..70a3db3 100644
---- a/drivers/mtd/maps/dc21285.c
-+++ b/drivers/mtd/maps/dc21285.c
-@@ -38,9 +38,9 @@ static void nw_en_write(void)
- * we want to write a bit pattern XXX1 to Xilinx to enable
- * the write gate, which will be open for about the next 2ms.
- */
-- spin_lock_irqsave(&nw_gpio_lock, flags);
-+ raw_spin_lock_irqsave(&nw_gpio_lock, flags);
- nw_cpld_modify(CPLD_FLASH_WR_ENABLE, CPLD_FLASH_WR_ENABLE);
-- spin_unlock_irqrestore(&nw_gpio_lock, flags);
-+ raw_spin_unlock_irqrestore(&nw_gpio_lock, flags);
-
- /*
- * let the ISA bus to catch on...
-diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
-index 5073cbc..32d5e40 100644
---- a/drivers/mtd/mtd_blkdevs.c
-+++ b/drivers/mtd/mtd_blkdevs.c
-@@ -199,6 +199,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
- return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/
-
- mutex_lock(&dev->lock);
-+ mutex_lock(&mtd_table_mutex);
-
- if (dev->open)
- goto unlock;
-@@ -222,6 +223,7 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode)
-
- unlock:
- dev->open++;
-+ mutex_unlock(&mtd_table_mutex);
- mutex_unlock(&dev->lock);
- blktrans_dev_put(dev);
- return ret;
-@@ -232,6 +234,7 @@ error_release:
- error_put:
- module_put(dev->tr->owner);
- kref_put(&dev->ref, blktrans_dev_release);
-+ mutex_unlock(&mtd_table_mutex);
- mutex_unlock(&dev->lock);
- blktrans_dev_put(dev);
- return ret;
-@@ -245,6 +248,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- return;
-
- mutex_lock(&dev->lock);
-+ mutex_lock(&mtd_table_mutex);
-
- if (--dev->open)
- goto unlock;
-@@ -258,6 +262,7 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode)
- __put_mtd_device(dev->mtd);
- }
- unlock:
-+ mutex_unlock(&mtd_table_mutex);
- mutex_unlock(&dev->lock);
- blktrans_dev_put(dev);
- }
-diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
-index 9715a7b..efc542d 100644
---- a/drivers/mtd/nand/nand_base.c
-+++ b/drivers/mtd/nand/nand_base.c
-@@ -2000,7 +2000,7 @@ static int nand_write_page_raw_syndrome(struct mtd_info *mtd,
- oob += chip->ecc.prepad;
- }
-
-- chip->read_buf(mtd, oob, eccbytes);
-+ chip->write_buf(mtd, oob, eccbytes);
- oob += eccbytes;
-
- if (chip->ecc.postpad) {
-@@ -3063,7 +3063,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- int *busw)
- {
- struct nand_onfi_params *p = &chip->onfi_params;
-- int i;
-+ int i, j;
- int val;
-
- /* Try ONFI for unknown chip or LP */
-@@ -3072,18 +3072,10 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
- chip->read_byte(mtd) != 'F' || chip->read_byte(mtd) != 'I')
- return 0;
-
-- /*
-- * ONFI must be probed in 8-bit mode or with NAND_BUSWIDTH_AUTO, not
-- * with NAND_BUSWIDTH_16
-- */
-- if (chip->options & NAND_BUSWIDTH_16) {
-- pr_err("ONFI cannot be probed in 16-bit mode; aborting\n");
-- return 0;
-- }
--
- chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
- for (i = 0; i < 3; i++) {
-- chip->read_buf(mtd, (uint8_t *)p, sizeof(*p));
-+ for (j = 0; j < sizeof(*p); j++)
-+ ((uint8_t *)p)[j] = chip->read_byte(mtd);
- if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
- le16_to_cpu(p->crc)) {
- break;
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index 5924f72..f35ce8e 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -205,11 +205,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
- ath_stop_ani(sc);
- ath9k_hw_disable_interrupts(ah);
-
-- if (!ath_drain_all_txq(sc))
-- ret = false;
--
-- if (!ath_stoprecv(sc))
-- ret = false;
-+ if (AR_SREV_9300_20_OR_LATER(ah)) {
-+ ret &= ath_stoprecv(sc);
-+ ret &= ath_drain_all_txq(sc);
-+ } else {
-+ ret &= ath_drain_all_txq(sc);
-+ ret &= ath_stoprecv(sc);
-+ }
-
- return ret;
- }
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 3935614..e99f329 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -77,7 +77,7 @@ EXPORT_SYMBOL(of_n_size_cells);
- #ifdef CONFIG_NUMA
- int __weak of_node_to_nid(struct device_node *np)
- {
-- return numa_node_id();
-+ return NUMA_NO_NODE;
- }
- #endif
-
-diff --git a/drivers/pcmcia/topic.h b/drivers/pcmcia/topic.h
-index 615a45a..582688fe 100644
---- a/drivers/pcmcia/topic.h
-+++ b/drivers/pcmcia/topic.h
-@@ -104,6 +104,9 @@
- #define TOPIC_EXCA_IF_CONTROL 0x3e /* 8 bit */
- #define TOPIC_EXCA_IFC_33V_ENA 0x01
-
-+#define TOPIC_PCI_CFG_PPBCN 0x3e /* 16-bit */
-+#define TOPIC_PCI_CFG_PPBCN_WBEN 0x0400
-+
- static void topic97_zoom_video(struct pcmcia_socket *sock, int onoff)
- {
- struct yenta_socket *socket = container_of(sock, struct yenta_socket, socket);
-@@ -138,6 +141,7 @@ static int topic97_override(struct yenta_socket *socket)
- static int topic95_override(struct yenta_socket *socket)
- {
- u8 fctrl;
-+ u16 ppbcn;
-
- /* enable 3.3V support for 16bit cards */
- fctrl = exca_readb(socket, TOPIC_EXCA_IF_CONTROL);
-@@ -146,6 +150,18 @@ static int topic95_override(struct yenta_socket *socket)
- /* tell yenta to use exca registers to power 16bit cards */
- socket->flags |= YENTA_16BIT_POWER_EXCA | YENTA_16BIT_POWER_DF;
-
-+ /* Disable write buffers to prevent lockups under load with numerous
-+ Cardbus cards, observed on Tecra 500CDT and reported elsewhere on the
-+ net. This is not a power-on default according to the datasheet
-+ but some BIOSes seem to set it. */
-+ if (pci_read_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, &ppbcn) == 0
-+ && socket->dev->revision <= 7
-+ && (ppbcn & TOPIC_PCI_CFG_PPBCN_WBEN)) {
-+ ppbcn &= ~TOPIC_PCI_CFG_PPBCN_WBEN;
-+ pci_write_config_word(socket->dev, TOPIC_PCI_CFG_PPBCN, ppbcn);
-+ dev_info(&socket->dev->dev, "Disabled ToPIC95 Cardbus write buffers.\n");
-+ }
-+
- return 0;
- }
-
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-index ae1f760..bb525b1 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-@@ -358,11 +358,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
- MPP_MODE(64,
- MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "spi0", "miso"),
-- MPP_FUNCTION(0x2, "spi0-1", "cs1")),
-+ MPP_FUNCTION(0x2, "spi0", "cs1")),
- MPP_MODE(65,
- MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "spi0", "mosi"),
-- MPP_FUNCTION(0x2, "spi0-1", "cs2")),
-+ MPP_FUNCTION(0x2, "spi0", "cs2")),
- };
-
- static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-index 843a51f..d918c51 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-@@ -14,10 +14,7 @@
- * available: mv78230, mv78260 and mv78460. From a pin muxing
- * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
- * both have 67 MPP pins (more GPIOs and address lines for the memory
-- * bus mainly). The only difference between the mv78260 and the
-- * mv78460 in terms of pin muxing is the addition of two functions on
-- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
-- * cores, mv78460 has four cores).
-+ * bus mainly).
- */
-
- #include <linux/err.h>
-@@ -159,20 +156,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_MODE(24,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)),
- MPP_MODE(25,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)),
- MPP_MODE(26,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)),
- MPP_MODE(27,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS),
-@@ -187,8 +181,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)),
- MPP_MODE(30,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS),
-@@ -196,13 +189,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_MODE(31,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)),
- MPP_MODE(32,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)),
- MPP_MODE(33,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS),
-@@ -234,7 +225,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)),
- MPP_MODE(41,
-@@ -249,15 +239,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)),
- MPP_MODE(43,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)),
-+ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)),
- MPP_MODE(44,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS),
-@@ -286,7 +274,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)),
- MPP_MODE(48,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS),
-+ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
- MPP_MODE(49,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-@@ -308,16 +296,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)),
- MPP_MODE(55,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)),
- MPP_MODE(56,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)),
- MPP_MODE(57,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)),
- MPP_MODE(58,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)),
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index fed4111..1beb232 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -272,7 +272,6 @@ static struct dmi_system_id dell_quirks[] = {
- };
-
- static struct calling_interface_buffer *buffer;
--static struct page *bufferpage;
- static DEFINE_MUTEX(buffer_mutex);
-
- static int hwswitch_state;
-@@ -825,12 +824,11 @@ static int __init dell_init(void)
- * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
- * is passed to SMI handler.
- */
-- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
-- if (!bufferpage) {
-+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
-+ if (!buffer) {
- ret = -ENOMEM;
- goto fail_buffer;
- }
-- buffer = page_address(bufferpage);
-
- ret = dell_setup_rfkill();
-
-@@ -892,7 +890,7 @@ fail_backlight:
- cancel_delayed_work_sync(&dell_rfkill_work);
- dell_cleanup_rfkill();
- fail_rfkill:
-- free_page((unsigned long)bufferpage);
-+ free_page((unsigned long)buffer);
- fail_buffer:
- platform_device_del(platform_device);
- fail_platform_device2:
-diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
-index 6dd060a..0d1a5d4 100644
---- a/drivers/platform/x86/ideapad-laptop.c
-+++ b/drivers/platform/x86/ideapad-laptop.c
-@@ -461,8 +461,9 @@ const struct ideapad_rfk_data ideapad_rfk_data[] = {
- static int ideapad_rfk_set(void *data, bool blocked)
- {
- struct ideapad_rfk_priv *priv = data;
-+ int opcode = ideapad_rfk_data[priv->dev].opcode;
-
-- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
-+ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
- }
-
- static struct rfkill_ops ideapad_rfk_ops = {
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 5d8d2dc..427cb62 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -773,7 +773,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
- static void print_constraints(struct regulator_dev *rdev)
- {
- struct regulation_constraints *constraints = rdev->constraints;
-- char buf[80] = "";
-+ char buf[160] = "";
- int count = 0;
- int ret;
-
-diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h
-index 0801f3d..02edae7 100644
---- a/drivers/scsi/ipr.h
-+++ b/drivers/scsi/ipr.h
-@@ -264,7 +264,7 @@
- #define IPR_RUNTIME_RESET 0x40000000
-
- #define IPR_IPL_INIT_MIN_STAGE_TIME 5
--#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 15
-+#define IPR_IPL_INIT_DEFAULT_STAGE_TIME 30
- #define IPR_IPL_INIT_STAGE_UNKNOWN 0x0
- #define IPR_IPL_INIT_STAGE_TRANSOP 0xB0000000
- #define IPR_IPL_INIT_STAGE_MASK 0xff000000
-diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
-index 0a1dcb4..13f4bef 100644
---- a/drivers/scsi/qla2xxx/qla_isr.c
-+++ b/drivers/scsi/qla2xxx/qla_isr.c
-@@ -572,8 +572,9 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
- struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
- struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
- struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
-- uint32_t rscn_entry, host_pid;
-+ uint32_t rscn_entry, host_pid, tmp_pid;
- unsigned long flags;
-+ fc_port_t *fcport = NULL;
-
- /* Setup to process RIO completion. */
- handle_cnt = 0;
-@@ -968,6 +969,20 @@ skip_rio:
- if (qla2x00_is_a_vp_did(vha, rscn_entry))
- break;
-
-+ /*
-+ * Search for the rport related to this RSCN entry and mark it
-+ * as lost.
-+ */
-+ list_for_each_entry(fcport, &vha->vp_fcports, list) {
-+ if (atomic_read(&fcport->state) != FCS_ONLINE)
-+ continue;
-+ tmp_pid = fcport->d_id.b24;
-+ if (fcport->d_id.b24 == rscn_entry) {
-+ qla2x00_mark_device_lost(vha, fcport, 0, 0);
-+ break;
-+ }
-+ }
-+
- atomic_set(&vha->loop_down_timer, 0);
- vha->flags.management_server_logged_in = 0;
-
-diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
-index e3e794e..b85eaa0 100644
---- a/drivers/scsi/scsi_transport_srp.c
-+++ b/drivers/scsi/scsi_transport_srp.c
-@@ -397,6 +397,36 @@ static void srp_reconnect_work(struct work_struct *work)
- }
- }
-
-+/**
-+ * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-+ * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-+ *
-+ * To do: add support for scsi-mq in this function.
-+ */
-+static int scsi_request_fn_active(struct Scsi_Host *shost)
-+{
-+ struct scsi_device *sdev;
-+ struct request_queue *q;
-+ int request_fn_active = 0;
-+
-+ shost_for_each_device(sdev, shost) {
-+ q = sdev->request_queue;
-+
-+ spin_lock_irq(q->queue_lock);
-+ request_fn_active += q->request_fn_active;
-+ spin_unlock_irq(q->queue_lock);
-+ }
-+
-+ return request_fn_active;
-+}
-+
-+/* Wait until ongoing shost->hostt->queuecommand() calls have finished. */
-+static void srp_wait_for_queuecommand(struct Scsi_Host *shost)
-+{
-+ while (scsi_request_fn_active(shost))
-+ msleep(20);
-+}
-+
- static void __rport_fail_io_fast(struct srp_rport *rport)
- {
- struct Scsi_Host *shost = rport_to_shost(rport);
-@@ -410,8 +440,10 @@ static void __rport_fail_io_fast(struct srp_rport *rport)
-
- /* Involve the LLD if possible to terminate all I/O on the rport. */
- i = to_srp_internal(shost->transportt);
-- if (i->f->terminate_rport_io)
-+ if (i->f->terminate_rport_io) {
-+ srp_wait_for_queuecommand(shost);
- i->f->terminate_rport_io(rport);
-+ }
- }
-
- /**
-@@ -505,27 +537,6 @@ void srp_start_tl_fail_timers(struct srp_rport *rport)
- EXPORT_SYMBOL(srp_start_tl_fail_timers);
-
- /**
-- * scsi_request_fn_active() - number of kernel threads inside scsi_request_fn()
-- * @shost: SCSI host for which to count the number of scsi_request_fn() callers.
-- */
--static int scsi_request_fn_active(struct Scsi_Host *shost)
--{
-- struct scsi_device *sdev;
-- struct request_queue *q;
-- int request_fn_active = 0;
--
-- shost_for_each_device(sdev, shost) {
-- q = sdev->request_queue;
--
-- spin_lock_irq(q->queue_lock);
-- request_fn_active += q->request_fn_active;
-- spin_unlock_irq(q->queue_lock);
-- }
--
-- return request_fn_active;
--}
--
--/**
- * srp_reconnect_rport() - reconnect to an SRP target port
- * @rport: SRP target port.
- *
-@@ -560,8 +571,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
- if (res)
- goto out;
- scsi_target_block(&shost->shost_gendev);
-- while (scsi_request_fn_active(shost))
-- msleep(20);
-+ srp_wait_for_queuecommand(shost);
- res = rport->state != SRP_RPORT_LOST ? i->f->reconnect(rport) : -ENODEV;
- pr_debug("%s (state %d): transport.reconnect() returned %d\n",
- dev_name(&shost->shost_gendev), rport->state, res);
-diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index d6563ec..f3e3ae8 100644
---- a/drivers/spi/spi.c
-+++ b/drivers/spi/spi.c
-@@ -834,9 +834,6 @@ void spi_finalize_current_message(struct spi_master *master)
-
- spin_lock_irqsave(&master->queue_lock, flags);
- mesg = master->cur_msg;
-- master->cur_msg = NULL;
--
-- queue_kthread_work(&master->kworker, &master->pump_messages);
- spin_unlock_irqrestore(&master->queue_lock, flags);
-
- if (master->cur_msg_prepared && master->unprepare_message) {
-@@ -847,9 +844,13 @@ void spi_finalize_current_message(struct spi_master *master)
- }
- }
-
-- trace_spi_message_done(mesg);
--
-+ spin_lock_irqsave(&master->queue_lock, flags);
-+ master->cur_msg = NULL;
- master->cur_msg_prepared = false;
-+ queue_kthread_work(&master->kworker, &master->pump_messages);
-+ spin_unlock_irqrestore(&master->queue_lock, flags);
-+
-+ trace_spi_message_done(mesg);
-
- mesg->state = NULL;
- if (mesg->complete)
-diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
-index ea96537..d060b1f 100644
---- a/drivers/staging/rtl8712/rtl8712_recv.c
-+++ b/drivers/staging/rtl8712/rtl8712_recv.c
-@@ -1075,7 +1075,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
- /* for first fragment packet, driver need allocate 1536 +
- * drvinfo_sz + RXDESC_SIZE to defrag packet. */
- if ((mf == 1) && (frag == 0))
-- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
-+ /*1658+6=1664, 1664 is 128 alignment.*/
-+ alloc_sz = max_t(u16, tmp_len, 1658);
- else
- alloc_sz = tmp_len;
- /* 2 is for IP header 4 bytes alignment in QoS packet case.
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index b61c555..c8d7b30 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -518,7 +518,7 @@ static struct iscsit_transport iscsi_target_transport = {
-
- static int __init iscsi_target_init_module(void)
- {
-- int ret = 0;
-+ int ret = 0, size;
-
- pr_debug("iSCSI-Target "ISCSIT_VERSION"\n");
-
-@@ -527,6 +527,7 @@ static int __init iscsi_target_init_module(void)
- pr_err("Unable to allocate memory for iscsit_global\n");
- return -1;
- }
-+ spin_lock_init(&iscsit_global->ts_bitmap_lock);
- mutex_init(&auth_id_lock);
- spin_lock_init(&sess_idr_lock);
- idr_init(&tiqn_idr);
-@@ -536,15 +537,11 @@ static int __init iscsi_target_init_module(void)
- if (ret < 0)
- goto out;
-
-- ret = iscsi_thread_set_init();
-- if (ret < 0)
-+ size = BITS_TO_LONGS(ISCSIT_BITMAP_BITS) * sizeof(long);
-+ iscsit_global->ts_bitmap = vzalloc(size);
-+ if (!iscsit_global->ts_bitmap) {
-+ pr_err("Unable to allocate iscsit_global->ts_bitmap\n");
- goto configfs_out;
--
-- if (iscsi_allocate_thread_sets(TARGET_THREAD_SET_COUNT) !=
-- TARGET_THREAD_SET_COUNT) {
-- pr_err("iscsi_allocate_thread_sets() returned"
-- " unexpected value!\n");
-- goto ts_out1;
- }
-
- lio_qr_cache = kmem_cache_create("lio_qr_cache",
-@@ -553,7 +550,7 @@ static int __init iscsi_target_init_module(void)
- if (!lio_qr_cache) {
- pr_err("nable to kmem_cache_create() for"
- " lio_qr_cache\n");
-- goto ts_out2;
-+ goto bitmap_out;
- }
-
- lio_dr_cache = kmem_cache_create("lio_dr_cache",
-@@ -597,10 +594,8 @@ dr_out:
- kmem_cache_destroy(lio_dr_cache);
- qr_out:
- kmem_cache_destroy(lio_qr_cache);
--ts_out2:
-- iscsi_deallocate_thread_sets();
--ts_out1:
-- iscsi_thread_set_free();
-+bitmap_out:
-+ vfree(iscsit_global->ts_bitmap);
- configfs_out:
- iscsi_target_deregister_configfs();
- out:
-@@ -610,8 +605,6 @@ out:
-
- static void __exit iscsi_target_cleanup_module(void)
- {
-- iscsi_deallocate_thread_sets();
-- iscsi_thread_set_free();
- iscsit_release_discovery_tpg();
- iscsit_unregister_transport(&iscsi_target_transport);
- kmem_cache_destroy(lio_qr_cache);
-@@ -621,6 +614,7 @@ static void __exit iscsi_target_cleanup_module(void)
-
- iscsi_target_deregister_configfs();
-
-+ vfree(iscsit_global->ts_bitmap);
- kfree(iscsit_global);
- }
-
-@@ -3653,17 +3647,16 @@ static int iscsit_send_reject(
-
- void iscsit_thread_get_cpumask(struct iscsi_conn *conn)
- {
-- struct iscsi_thread_set *ts = conn->thread_set;
- int ord, cpu;
- /*
-- * thread_id is assigned from iscsit_global->ts_bitmap from
-- * within iscsi_thread_set.c:iscsi_allocate_thread_sets()
-+ * bitmap_id is assigned from iscsit_global->ts_bitmap from
-+ * within iscsit_start_kthreads()
- *
-- * Here we use thread_id to determine which CPU that this
-- * iSCSI connection's iscsi_thread_set will be scheduled to
-+ * Here we use bitmap_id to determine which CPU that this
-+ * iSCSI connection's RX/TX threads will be scheduled to
- * execute upon.
- */
-- ord = ts->thread_id % cpumask_weight(cpu_online_mask);
-+ ord = conn->bitmap_id % cpumask_weight(cpu_online_mask);
- for_each_online_cpu(cpu) {
- if (ord-- == 0) {
- cpumask_set_cpu(cpu, conn->conn_cpumask);
-@@ -3855,7 +3848,7 @@ check_rsp_state:
- switch (state) {
- case ISTATE_SEND_LOGOUTRSP:
- if (!iscsit_logout_post_handler(cmd, conn))
-- goto restart;
-+ return -ECONNRESET;
- /* fall through */
- case ISTATE_SEND_STATUS:
- case ISTATE_SEND_ASYNCMSG:
-@@ -3883,8 +3876,6 @@ check_rsp_state:
-
- err:
- return -1;
--restart:
-- return -EAGAIN;
- }
-
- static int iscsit_handle_response_queue(struct iscsi_conn *conn)
-@@ -3911,21 +3902,13 @@ static int iscsit_handle_response_queue(struct iscsi_conn *conn)
- int iscsi_target_tx_thread(void *arg)
- {
- int ret = 0;
-- struct iscsi_conn *conn;
-- struct iscsi_thread_set *ts = arg;
-+ struct iscsi_conn *conn = arg;
- /*
- * Allow ourselves to be interrupted by SIGINT so that a
- * connection recovery / failure event can be triggered externally.
- */
- allow_signal(SIGINT);
-
--restart:
-- conn = iscsi_tx_thread_pre_handler(ts);
-- if (!conn)
-- goto out;
--
-- ret = 0;
--
- while (!kthread_should_stop()) {
- /*
- * Ensure that both TX and RX per connection kthreads
-@@ -3934,11 +3917,9 @@ restart:
- iscsit_thread_check_cpumask(conn, current, 1);
-
- wait_event_interruptible(conn->queues_wq,
-- !iscsit_conn_all_queues_empty(conn) ||
-- ts->status == ISCSI_THREAD_SET_RESET);
-+ !iscsit_conn_all_queues_empty(conn));
-
-- if ((ts->status == ISCSI_THREAD_SET_RESET) ||
-- signal_pending(current))
-+ if (signal_pending(current))
- goto transport_err;
-
- get_immediate:
-@@ -3949,15 +3930,14 @@ get_immediate:
- ret = iscsit_handle_response_queue(conn);
- if (ret == 1)
- goto get_immediate;
-- else if (ret == -EAGAIN)
-- goto restart;
-+ else if (ret == -ECONNRESET)
-+ goto out;
- else if (ret < 0)
- goto transport_err;
- }
-
- transport_err:
- iscsit_take_action_for_connection_exit(conn);
-- goto restart;
- out:
- return 0;
- }
-@@ -4046,8 +4026,7 @@ int iscsi_target_rx_thread(void *arg)
- int ret;
- u8 buffer[ISCSI_HDR_LEN], opcode;
- u32 checksum = 0, digest = 0;
-- struct iscsi_conn *conn = NULL;
-- struct iscsi_thread_set *ts = arg;
-+ struct iscsi_conn *conn = arg;
- struct kvec iov;
- /*
- * Allow ourselves to be interrupted by SIGINT so that a
-@@ -4055,11 +4034,6 @@ int iscsi_target_rx_thread(void *arg)
- */
- allow_signal(SIGINT);
-
--restart:
-- conn = iscsi_rx_thread_pre_handler(ts);
-- if (!conn)
-- goto out;
--
- if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
- struct completion comp;
- int rc;
-@@ -4069,7 +4043,7 @@ restart:
- if (rc < 0)
- goto transport_err;
-
-- goto out;
-+ goto transport_err;
- }
-
- while (!kthread_should_stop()) {
-@@ -4145,8 +4119,6 @@ transport_err:
- if (!signal_pending(current))
- atomic_set(&conn->transport_failed, 1);
- iscsit_take_action_for_connection_exit(conn);
-- goto restart;
--out:
- return 0;
- }
-
-@@ -4208,7 +4180,24 @@ int iscsit_close_connection(
- if (conn->conn_transport->transport_type == ISCSI_TCP)
- complete(&conn->conn_logout_comp);
-
-- iscsi_release_thread_set(conn);
-+ if (!strcmp(current->comm, ISCSI_RX_THREAD_NAME)) {
-+ if (conn->tx_thread &&
-+ cmpxchg(&conn->tx_thread_active, true, false)) {
-+ send_sig(SIGINT, conn->tx_thread, 1);
-+ kthread_stop(conn->tx_thread);
-+ }
-+ } else if (!strcmp(current->comm, ISCSI_TX_THREAD_NAME)) {
-+ if (conn->rx_thread &&
-+ cmpxchg(&conn->rx_thread_active, true, false)) {
-+ send_sig(SIGINT, conn->rx_thread, 1);
-+ kthread_stop(conn->rx_thread);
-+ }
-+ }
-+
-+ spin_lock(&iscsit_global->ts_bitmap_lock);
-+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+ get_order(1));
-+ spin_unlock(&iscsit_global->ts_bitmap_lock);
-
- iscsit_stop_timers_for_cmds(conn);
- iscsit_stop_nopin_response_timer(conn);
-@@ -4487,15 +4476,13 @@ static void iscsit_logout_post_handler_closesession(
- struct iscsi_conn *conn)
- {
- struct iscsi_session *sess = conn->sess;
--
-- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
-- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+ int sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
- complete(&conn->conn_logout_comp);
-
- iscsit_dec_conn_usage_count(conn);
-- iscsit_stop_session(sess, 1, 1);
-+ iscsit_stop_session(sess, sleep, sleep);
- iscsit_dec_session_usage_count(sess);
- target_put_session(sess->se_sess);
- }
-@@ -4503,13 +4490,12 @@ static void iscsit_logout_post_handler_closesession(
- static void iscsit_logout_post_handler_samecid(
- struct iscsi_conn *conn)
- {
-- iscsi_set_thread_clear(conn, ISCSI_CLEAR_TX_THREAD);
-- iscsi_set_thread_set_signal(conn, ISCSI_SIGNAL_TX_THREAD);
-+ int sleep = cmpxchg(&conn->tx_thread_active, true, false);
-
- atomic_set(&conn->conn_logout_remove, 0);
- complete(&conn->conn_logout_comp);
-
-- iscsit_cause_connection_reinstatement(conn, 1);
-+ iscsit_cause_connection_reinstatement(conn, sleep);
- iscsit_dec_conn_usage_count(conn);
- }
-
-diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h
-index 1d4a8c8..825b579 100644
---- a/drivers/target/iscsi/iscsi_target_core.h
-+++ b/drivers/target/iscsi/iscsi_target_core.h
-@@ -601,6 +601,11 @@ struct iscsi_conn {
- struct iscsi_session *sess;
- /* Pointer to thread_set in use for this conn's threads */
- struct iscsi_thread_set *thread_set;
-+ int bitmap_id;
-+ int rx_thread_active;
-+ struct task_struct *rx_thread;
-+ int tx_thread_active;
-+ struct task_struct *tx_thread;
- /* list_head for session connection list */
- struct list_head conn_list;
- } ____cacheline_aligned;
-@@ -869,10 +874,12 @@ struct iscsit_global {
- /* Unique identifier used for the authentication daemon */
- u32 auth_id;
- u32 inactive_ts;
-+#define ISCSIT_BITMAP_BITS 262144
- /* Thread Set bitmap count */
- int ts_bitmap_count;
- /* Thread Set bitmap pointer */
- unsigned long *ts_bitmap;
-+ spinlock_t ts_bitmap_lock;
- /* Used for iSCSI discovery session authentication */
- struct iscsi_node_acl discovery_acl;
- struct iscsi_portal_group *discovery_tpg;
-diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c
-index 0d1e6ee..7396d90 100644
---- a/drivers/target/iscsi/iscsi_target_erl0.c
-+++ b/drivers/target/iscsi/iscsi_target_erl0.c
-@@ -864,7 +864,10 @@ void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *conn)
- }
- spin_unlock_bh(&conn->state_lock);
-
-- iscsi_thread_set_force_reinstatement(conn);
-+ if (conn->tx_thread && conn->tx_thread_active)
-+ send_sig(SIGINT, conn->tx_thread, 1);
-+ if (conn->rx_thread && conn->rx_thread_active)
-+ send_sig(SIGINT, conn->rx_thread, 1);
-
- sleep:
- wait_for_completion(&conn->conn_wait_rcfr_comp);
-@@ -889,10 +892,10 @@ void iscsit_cause_connection_reinstatement(struct iscsi_conn *conn, int sleep)
- return;
- }
-
-- if (iscsi_thread_set_force_reinstatement(conn) < 0) {
-- spin_unlock_bh(&conn->state_lock);
-- return;
-- }
-+ if (conn->tx_thread && conn->tx_thread_active)
-+ send_sig(SIGINT, conn->tx_thread, 1);
-+ if (conn->rx_thread && conn->rx_thread_active)
-+ send_sig(SIGINT, conn->rx_thread, 1);
-
- atomic_set(&conn->connection_reinstatement, 1);
- if (!sleep) {
-diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
-index c5d3811..449df09 100644
---- a/drivers/target/iscsi/iscsi_target_login.c
-+++ b/drivers/target/iscsi/iscsi_target_login.c
-@@ -681,6 +681,51 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
- iscsit_start_nopin_timer(conn);
- }
-
-+int iscsit_start_kthreads(struct iscsi_conn *conn)
-+{
-+ int ret = 0;
-+
-+ spin_lock(&iscsit_global->ts_bitmap_lock);
-+ conn->bitmap_id = bitmap_find_free_region(iscsit_global->ts_bitmap,
-+ ISCSIT_BITMAP_BITS, get_order(1));
-+ spin_unlock(&iscsit_global->ts_bitmap_lock);
-+
-+ if (conn->bitmap_id < 0) {
-+ pr_err("bitmap_find_free_region() failed for"
-+ " iscsit_start_kthreads()\n");
-+ return -ENOMEM;
-+ }
-+
-+ conn->tx_thread = kthread_run(iscsi_target_tx_thread, conn,
-+ "%s", ISCSI_TX_THREAD_NAME);
-+ if (IS_ERR(conn->tx_thread)) {
-+ pr_err("Unable to start iscsi_target_tx_thread\n");
-+ ret = PTR_ERR(conn->tx_thread);
-+ goto out_bitmap;
-+ }
-+ conn->tx_thread_active = true;
-+
-+ conn->rx_thread = kthread_run(iscsi_target_rx_thread, conn,
-+ "%s", ISCSI_RX_THREAD_NAME);
-+ if (IS_ERR(conn->rx_thread)) {
-+ pr_err("Unable to start iscsi_target_rx_thread\n");
-+ ret = PTR_ERR(conn->rx_thread);
-+ goto out_tx;
-+ }
-+ conn->rx_thread_active = true;
-+
-+ return 0;
-+out_tx:
-+ kthread_stop(conn->tx_thread);
-+ conn->tx_thread_active = false;
-+out_bitmap:
-+ spin_lock(&iscsit_global->ts_bitmap_lock);
-+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
-+ get_order(1));
-+ spin_unlock(&iscsit_global->ts_bitmap_lock);
-+ return ret;
-+}
-+
- int iscsi_post_login_handler(
- struct iscsi_np *np,
- struct iscsi_conn *conn,
-@@ -691,7 +736,7 @@ int iscsi_post_login_handler(
- struct se_session *se_sess = sess->se_sess;
- struct iscsi_portal_group *tpg = sess->tpg;
- struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
-- struct iscsi_thread_set *ts;
-+ int rc;
-
- iscsit_inc_conn_usage_count(conn);
-
-@@ -706,7 +751,6 @@ int iscsi_post_login_handler(
- /*
- * SCSI Initiator -> SCSI Target Port Mapping
- */
-- ts = iscsi_get_thread_set();
- if (!zero_tsih) {
- iscsi_set_session_parameters(sess->sess_ops,
- conn->param_list, 0);
-@@ -733,9 +777,11 @@ int iscsi_post_login_handler(
- sess->sess_ops->InitiatorName);
- spin_unlock_bh(&sess->conn_lock);
-
-- iscsi_post_login_start_timers(conn);
-+ rc = iscsit_start_kthreads(conn);
-+ if (rc)
-+ return rc;
-
-- iscsi_activate_thread_set(conn, ts);
-+ iscsi_post_login_start_timers(conn);
- /*
- * Determine CPU mask to ensure connection's RX and TX kthreads
- * are scheduled on the same CPU.
-@@ -792,8 +838,11 @@ int iscsi_post_login_handler(
- " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
- spin_unlock_bh(&se_tpg->session_lock);
-
-+ rc = iscsit_start_kthreads(conn);
-+ if (rc)
-+ return rc;
-+
- iscsi_post_login_start_timers(conn);
-- iscsi_activate_thread_set(conn, ts);
- /*
- * Determine CPU mask to ensure connection's RX and TX kthreads
- * are scheduled on the same CPU.
-diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c
-index ee52ab7..c501eba 100644
---- a/drivers/thermal/step_wise.c
-+++ b/drivers/thermal/step_wise.c
-@@ -76,7 +76,7 @@ static unsigned long get_target_state(struct thermal_instance *instance,
- next_target = instance->upper;
- break;
- case THERMAL_TREND_DROPPING:
-- if (cur_state == instance->lower) {
-+ if (cur_state <= instance->lower) {
- if (!throttle)
- next_target = THERMAL_NO_TARGET;
- } else {
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 45b7b96..8016aaa 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
- snoop(&urb->dev->dev, "urb complete\n");
- snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
- as->status, COMPLETE, NULL, 0);
-- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
-+ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
- snoop_urb_data(urb, urb->actual_length);
-
- if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
-@@ -1591,7 +1591,7 @@ static struct async *reap_as(struct dev_state *ps)
- for (;;) {
- __set_current_state(TASK_INTERRUPTIBLE);
- as = async_getcompleted(ps);
-- if (as)
-+ if (as || !connected(ps))
- break;
- if (signal_pending(current))
- break;
-@@ -1614,7 +1614,7 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
- }
- if (signal_pending(current))
- return -EINTR;
-- return -EIO;
-+ return -ENODEV;
- }
-
- static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
-@@ -1623,10 +1623,11 @@ static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
- struct async *as;
-
- as = async_getcompleted(ps);
-- retval = -EAGAIN;
- if (as) {
- retval = processcompl(as, (void __user * __user *)arg);
- free_async(as);
-+ } else {
-+ retval = (connected(ps) ? -EAGAIN : -ENODEV);
- }
- return retval;
- }
-@@ -1756,7 +1757,7 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
- }
- if (signal_pending(current))
- return -EINTR;
-- return -EIO;
-+ return -ENODEV;
- }
-
- static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
-@@ -1764,11 +1765,12 @@ static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
- int retval;
- struct async *as;
-
-- retval = -EAGAIN;
- as = async_getcompleted(ps);
- if (as) {
- retval = processcompl_compat(as, (void __user * __user *)arg);
- free_async(as);
-+ } else {
-+ retval = (connected(ps) ? -EAGAIN : -ENODEV);
- }
- return retval;
- }
-@@ -1940,7 +1942,8 @@ static int proc_get_capabilities(struct dev_state *ps, void __user *arg)
- {
- __u32 caps;
-
-- caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM;
-+ caps = USBDEVFS_CAP_ZERO_PACKET | USBDEVFS_CAP_NO_PACKET_SIZE_LIM |
-+ USBDEVFS_CAP_REAP_AFTER_DISCONNECT;
- if (!ps->dev->bus->no_stop_on_short)
- caps |= USBDEVFS_CAP_BULK_CONTINUATION;
- if (ps->dev->bus->sg_tablesize)
-@@ -2001,6 +2004,32 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- return -EPERM;
-
- usb_lock_device(dev);
-+
-+ /* Reap operations are allowed even after disconnection */
-+ switch (cmd) {
-+ case USBDEVFS_REAPURB:
-+ snoop(&dev->dev, "%s: REAPURB\n", __func__);
-+ ret = proc_reapurb(ps, p);
-+ goto done;
-+
-+ case USBDEVFS_REAPURBNDELAY:
-+ snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
-+ ret = proc_reapurbnonblock(ps, p);
-+ goto done;
-+
-+#ifdef CONFIG_COMPAT
-+ case USBDEVFS_REAPURB32:
-+ snoop(&dev->dev, "%s: REAPURB32\n", __func__);
-+ ret = proc_reapurb_compat(ps, p);
-+ goto done;
-+
-+ case USBDEVFS_REAPURBNDELAY32:
-+ snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
-+ ret = proc_reapurbnonblock_compat(ps, p);
-+ goto done;
-+#endif
-+ }
-+
- if (!connected(ps)) {
- usb_unlock_device(dev);
- return -ENODEV;
-@@ -2094,16 +2123,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- inode->i_mtime = CURRENT_TIME;
- break;
-
-- case USBDEVFS_REAPURB32:
-- snoop(&dev->dev, "%s: REAPURB32\n", __func__);
-- ret = proc_reapurb_compat(ps, p);
-- break;
--
-- case USBDEVFS_REAPURBNDELAY32:
-- snoop(&dev->dev, "%s: REAPURBNDELAY32\n", __func__);
-- ret = proc_reapurbnonblock_compat(ps, p);
-- break;
--
- case USBDEVFS_IOCTL32:
- snoop(&dev->dev, "%s: IOCTL32\n", __func__);
- ret = proc_ioctl_compat(ps, ptr_to_compat(p));
-@@ -2115,16 +2134,6 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- ret = proc_unlinkurb(ps, p);
- break;
-
-- case USBDEVFS_REAPURB:
-- snoop(&dev->dev, "%s: REAPURB\n", __func__);
-- ret = proc_reapurb(ps, p);
-- break;
--
-- case USBDEVFS_REAPURBNDELAY:
-- snoop(&dev->dev, "%s: REAPURBNDELAY\n", __func__);
-- ret = proc_reapurbnonblock(ps, p);
-- break;
--
- case USBDEVFS_DISCSIGNAL:
- snoop(&dev->dev, "%s: DISCSIGNAL\n", __func__);
- ret = proc_disconnectsignal(ps, p);
-@@ -2161,6 +2170,8 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
- ret = proc_disconnect_claim(ps, p);
- break;
- }
-+
-+ done:
- usb_unlock_device(dev);
- if (ret >= 0)
- inode->i_atime = CURRENT_TIME;
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 0985ff7..a05fc58 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -707,6 +707,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
- dev_vdbg(dwc->dev, "USB_REQ_SET_ISOCH_DELAY\n");
- ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
- break;
-+ case USB_REQ_SET_INTERFACE:
-+ dev_vdbg(dwc->dev, "USB_REQ_SET_INTERFACE\n");
-+ dwc->start_config_issued = false;
-+ /* Fall through */
- default:
- dev_vdbg(dwc->dev, "Forwarding to gadget driver\n");
- ret = dwc3_ep0_delegate_req(dwc, ctrl);
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 8f6738d..a57ad1f 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -299,6 +299,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, int cmd, u32 param)
- if (!(reg & DWC3_DGCMD_CMDACT)) {
- dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- DWC3_DGCMD_STATUS(reg));
-+ if (DWC3_DGCMD_STATUS(reg))
-+ return -EINVAL;
- return 0;
- }
-
-@@ -335,6 +337,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- if (!(reg & DWC3_DEPCMD_CMDACT)) {
- dev_vdbg(dwc->dev, "Command Complete --> %d\n",
- DWC3_DEPCMD_STATUS(reg));
-+ if (DWC3_DEPCMD_STATUS(reg))
-+ return -EINVAL;
- return 0;
- }
-
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 9bce4f0..f8893b3 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1331,10 +1331,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- /* Attempt to use the ring cache */
- if (virt_dev->num_rings_cached == 0)
- return -ENOMEM;
-+ virt_dev->num_rings_cached--;
- virt_dev->eps[ep_index].new_ring =
- virt_dev->ring_cache[virt_dev->num_rings_cached];
- virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-- virt_dev->num_rings_cached--;
- xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
- 1, type);
- }
-diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
-index 0241a3a..1e9bde4 100644
---- a/drivers/usb/musb/musb_virthub.c
-+++ b/drivers/usb/musb/musb_virthub.c
-@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
- #ifdef CONFIG_USB_MUSB_HOST
- return 1;
- #else
-- if (musb->port_mode == MUSB_PORT_MODE_HOST)
-- return 1;
-- return musb->g.dev.driver != NULL;
-+ return musb->port_mode == MUSB_PORT_MODE_HOST;
- #endif
- }
-
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index 73c7292..d11335d 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
- { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
- { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
- { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
-+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
- { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
- { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index 8b34841..096438e 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1755,6 +1755,7 @@ static const struct usb_device_id option_ids[] = {
- { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
- { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
- { } /* Terminating entry */
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 9a08e18..3d66e9c 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1300,6 +1300,7 @@ static void __exit usb_serial_exit(void)
- tty_unregister_driver(usb_serial_tty_driver);
- put_tty_driver(usb_serial_tty_driver);
- bus_unregister(&usb_serial_bus_type);
-+ idr_destroy(&serial_minors);
- }
-
-
-diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
-index 09cf013..90a6406 100644
---- a/drivers/watchdog/omap_wdt.c
-+++ b/drivers/watchdog/omap_wdt.c
-@@ -134,6 +134,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
-
- pm_runtime_get_sync(wdev->dev);
-
-+ /*
-+ * Make sure the watchdog is disabled. This is unfortunately required
-+ * because writing to various registers with the watchdog running has no
-+ * effect.
-+ */
-+ omap_wdt_disable(wdev);
-+
- /* initialize prescaler */
- while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
- cpu_relax();
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index bb7991c..bfdeadb 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
- unlock_new_inode(inode);
- return inode;
- error:
-- unlock_new_inode(inode);
-- iput(inode);
-+ iget_failed(inode);
- return ERR_PTR(retval);
-
- }
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
-index 59dc8e8..de8606c 100644
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
- unlock_new_inode(inode);
- return inode;
- error:
-- unlock_new_inode(inode);
-- iput(inode);
-+ iget_failed(inode);
- return ERR_PTR(retval);
-
- }
-diff --git a/fs/bio.c b/fs/bio.c
-index 8754e7b..b2b1451 100644
---- a/fs/bio.c
-+++ b/fs/bio.c
-@@ -1806,8 +1806,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
- * Allocates and returns a new bio which represents @sectors from the start of
- * @bio, and updates @bio to represent the remaining sectors.
- *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
- */
- struct bio *bio_split(struct bio *bio, int sectors,
- gfp_t gfp, struct bio_set *bs)
-@@ -1817,7 +1818,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- BUG_ON(sectors <= 0);
- BUG_ON(sectors >= bio_sectors(bio));
-
-- split = bio_clone_fast(bio, gfp, bs);
-+ /*
-+ * Discards need a mutable bio_vec to accommodate the payload
-+ * required by the DSM TRIM and UNMAP commands.
-+ */
-+ if (bio->bi_rw & REQ_DISCARD)
-+ split = bio_clone_bioset(bio, gfp, bs);
-+ else
-+ split = bio_clone_fast(bio, gfp, bs);
-+
- if (!split)
- return NULL;
-
-diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
-index ab485e5..644942a 100644
---- a/fs/btrfs/inode-map.c
-+++ b/fs/btrfs/inode-map.c
-@@ -281,7 +281,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- __btrfs_add_free_space(ctl, info->offset, count);
- free:
- rb_erase(&info->offset_index, rbroot);
-- kfree(info);
-+ kmem_cache_free(btrfs_free_space_cachep, info);
- }
- }
-
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 3e16042..d40ae42 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -2743,7 +2743,7 @@ out_unlock:
- static long btrfs_ioctl_file_extent_same(struct file *file,
- struct btrfs_ioctl_same_args __user *argp)
- {
-- struct btrfs_ioctl_same_args *same;
-+ struct btrfs_ioctl_same_args *same = NULL;
- struct btrfs_ioctl_same_extent_info *info;
- struct inode *src = file_inode(file);
- u64 off;
-@@ -2773,6 +2773,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
-
- if (IS_ERR(same)) {
- ret = PTR_ERR(same);
-+ same = NULL;
- goto out;
- }
-
-@@ -2843,6 +2844,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
-
- out:
- mnt_drop_write_file(file);
-+ kfree(same);
- return ret;
- }
-
-diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
-index e6574d7..a7c5277 100644
---- a/fs/ext4/indirect.c
-+++ b/fs/ext4/indirect.c
-@@ -576,7 +576,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
- EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
- EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
- "non-extent mapped inodes with bigalloc");
-- return -ENOSPC;
-+ return -EUCLEAN;
- }
-
- goal = ext4_find_goal(inode, map->m_lblk, partial);
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index da03340..f9c63ae 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1357,7 +1357,7 @@ static void ext4_da_page_release_reservation(struct page *page,
- unsigned int offset,
- unsigned int length)
- {
-- int to_release = 0;
-+ int to_release = 0, contiguous_blks = 0;
- struct buffer_head *head, *bh;
- unsigned int curr_off = 0;
- struct inode *inode = page->mapping->host;
-@@ -1378,14 +1378,23 @@ static void ext4_da_page_release_reservation(struct page *page,
-
- if ((offset <= curr_off) && (buffer_delay(bh))) {
- to_release++;
-+ contiguous_blks++;
- clear_buffer_delay(bh);
-+ } else if (contiguous_blks) {
-+ lblk = page->index <<
-+ (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+ lblk += (curr_off >> inode->i_blkbits) -
-+ contiguous_blks;
-+ ext4_es_remove_extent(inode, lblk, contiguous_blks);
-+ contiguous_blks = 0;
- }
- curr_off = next_off;
- } while ((bh = bh->b_this_page) != head);
-
-- if (to_release) {
-+ if (contiguous_blks) {
- lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
-- ext4_es_remove_extent(inode, lblk, to_release);
-+ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
-+ ext4_es_remove_extent(inode, lblk, contiguous_blks);
- }
-
- /* If we have released all the blocks belonging to a cluster, then we
-@@ -1744,19 +1753,32 @@ static int __ext4_journalled_writepage(struct page *page,
- ext4_walk_page_buffers(handle, page_bufs, 0, len,
- NULL, bget_one);
- }
-- /* As soon as we unlock the page, it can go away, but we have
-- * references to buffers so we are safe */
-+ /*
-+ * We need to release the page lock before we start the
-+ * journal, so grab a reference so the page won't disappear
-+ * out from under us.
-+ */
-+ get_page(page);
- unlock_page(page);
-
- handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
- ext4_writepage_trans_blocks(inode));
- if (IS_ERR(handle)) {
- ret = PTR_ERR(handle);
-- goto out;
-+ put_page(page);
-+ goto out_no_pagelock;
- }
--
- BUG_ON(!ext4_handle_valid(handle));
-
-+ lock_page(page);
-+ put_page(page);
-+ if (page->mapping != mapping) {
-+ /* The page got truncated from under us */
-+ ext4_journal_stop(handle);
-+ ret = 0;
-+ goto out;
-+ }
-+
- if (inline_data) {
- ret = ext4_journal_get_write_access(handle, inode_bh);
-
-@@ -1781,6 +1803,8 @@ static int __ext4_journalled_writepage(struct page *page,
- NULL, bput_one);
- ext4_set_inode_state(inode, EXT4_STATE_JDATA);
- out:
-+ unlock_page(page);
-+out_no_pagelock:
- brelse(inode_bh);
- return ret;
- }
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 7620133..c4a5e4d 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4793,18 +4793,12 @@ do_more:
- /*
- * blocks being freed are metadata. these blocks shouldn't
- * be used until this transaction is committed
-+ *
-+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
-+ * to fail.
- */
-- retry:
-- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
-- if (!new_entry) {
-- /*
-- * We use a retry loop because
-- * ext4_free_blocks() is not allowed to fail.
-- */
-- cond_resched();
-- congestion_wait(BLK_RW_ASYNC, HZ/50);
-- goto retry;
-- }
-+ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
-+ GFP_NOFS|__GFP_NOFAIL);
- new_entry->efd_start_cluster = bit;
- new_entry->efd_group = block_group;
- new_entry->efd_count = count_clusters;
-diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
-index 2ae73a8..be92ed2 100644
---- a/fs/ext4/migrate.c
-+++ b/fs/ext4/migrate.c
-@@ -616,6 +616,7 @@ int ext4_ind_migrate(struct inode *inode)
- struct ext4_inode_info *ei = EXT4_I(inode);
- struct ext4_extent *ex;
- unsigned int i, len;
-+ ext4_lblk_t start, end;
- ext4_fsblk_t blk;
- handle_t *handle;
- int ret;
-@@ -629,6 +630,14 @@ int ext4_ind_migrate(struct inode *inode)
- EXT4_FEATURE_RO_COMPAT_BIGALLOC))
- return -EOPNOTSUPP;
-
-+ /*
-+ * In order to get correct extent info, force all delayed allocation
-+ * blocks to be allocated, otherwise delayed allocation blocks may not
-+ * be reflected and bypass the checks on extent header.
-+ */
-+ if (test_opt(inode->i_sb, DELALLOC))
-+ ext4_alloc_da_blocks(inode);
-+
- handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
- if (IS_ERR(handle))
- return PTR_ERR(handle);
-@@ -646,11 +655,13 @@ int ext4_ind_migrate(struct inode *inode)
- goto errout;
- }
- if (eh->eh_entries == 0)
-- blk = len = 0;
-+ blk = len = start = end = 0;
- else {
- len = le16_to_cpu(ex->ee_len);
- blk = ext4_ext_pblock(ex);
-- if (len > EXT4_NDIR_BLOCKS) {
-+ start = le32_to_cpu(ex->ee_block);
-+ end = start + len - 1;
-+ if (end >= EXT4_NDIR_BLOCKS) {
- ret = -EOPNOTSUPP;
- goto errout;
- }
-@@ -658,7 +669,7 @@ int ext4_ind_migrate(struct inode *inode)
-
- ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
- memset(ei->i_data, 0, sizeof(ei->i_data));
-- for (i=0; i < len; i++)
-+ for (i = start; i <= end; i++)
- ei->i_data[i] = cpu_to_le32(blk++);
- ext4_mark_inode_dirty(handle, inode);
- errout:
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 9fb3e6c..a07af5b 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -832,6 +832,7 @@ static void ext4_put_super(struct super_block *sb)
- dump_orphan_list(sb, sbi);
- J_ASSERT(list_empty(&sbi->s_orphan));
-
-+ sync_blockdev(sb->s_bdev);
- invalidate_bdev(sb->s_bdev);
- if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
- /*
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 73f6bcb..faf00af 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- goto err_fput;
-
- fuse_conn_init(fc);
-+ fc->release = fuse_free_conn;
-
- fc->dev = sb->s_dev;
- fc->sb = sb;
-@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- fc->dont_mask = 1;
- sb->s_flags |= MS_POSIXACL;
-
-- fc->release = fuse_free_conn;
- fc->flags = d.flags;
- fc->user_id = d.user_id;
- fc->group_id = d.group_id;
-diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index 4534ff6..77b583d 100644
---- a/fs/hpfs/super.c
-+++ b/fs/hpfs/super.c
-@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
- }
-
- /* Filesystem error... */
--static char err_buf[1024];
--
- void hpfs_error(struct super_block *s, const char *fmt, ...)
- {
-+ struct va_format vaf;
- va_list args;
-
- va_start(args, fmt);
-- vsnprintf(err_buf, sizeof(err_buf), fmt, args);
-+
-+ vaf.fmt = fmt;
-+ vaf.va = &args;
-+
-+ pr_err("filesystem error: %pV", &vaf);
-+
- va_end(args);
-
-- printk("HPFS: filesystem error: %s", err_buf);
- if (!hpfs_sb(s)->sb_was_error) {
- if (hpfs_sb(s)->sb_err == 2) {
- printk("; crashing the system because you wanted it\n");
-diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
-index 7f34f47..b892355 100644
---- a/fs/jbd2/checkpoint.c
-+++ b/fs/jbd2/checkpoint.c
-@@ -448,7 +448,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- unsigned long blocknr;
-
- if (is_journal_aborted(journal))
-- return 1;
-+ return -EIO;
-
- if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
- return 1;
-@@ -463,10 +463,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- * jbd2_cleanup_journal_tail() doesn't get called all that often.
- */
- if (journal->j_flags & JBD2_BARRIER)
-- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
-
-- __jbd2_update_log_tail(journal, first_tid, blocknr);
-- return 0;
-+ return __jbd2_update_log_tail(journal, first_tid, blocknr);
- }
-
-
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index f2d78a3..e8d62d7 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- *
- * Requires j_checkpoint_mutex
- */
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- {
- unsigned long freed;
-+ int ret;
-
- BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
-
-@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- * space and if we lose sb update during power failure we'd replay
- * old transaction with possibly newly overwritten data.
- */
-- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+ if (ret)
-+ goto out;
-+
- write_lock(&journal->j_state_lock);
- freed = block - journal->j_tail;
- if (block < journal->j_tail)
-@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- journal->j_tail_sequence = tid;
- journal->j_tail = block;
- write_unlock(&journal->j_state_lock);
-+
-+out:
-+ return ret;
- }
-
- /*
-@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
- return jbd2_journal_start_thread(journal);
- }
-
--static void jbd2_write_superblock(journal_t *journal, int write_op)
-+static int jbd2_write_superblock(journal_t *journal, int write_op)
- {
- struct buffer_head *bh = journal->j_sb_buffer;
- journal_superblock_t *sb = journal->j_superblock;
-@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- printk(KERN_ERR "JBD2: Error %d detected when updating "
- "journal superblock for %s.\n", ret,
- journal->j_devname);
-+ jbd2_journal_abort(journal, ret);
- }
-+
-+ return ret;
- }
-
- /**
-@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- * Update a journal's superblock information about log tail and write it to
- * disk, waiting for the IO to complete.
- */
--void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
-+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- unsigned long tail_block, int write_op)
- {
- journal_superblock_t *sb = journal->j_superblock;
-+ int ret;
-
- BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
-@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- sb->s_sequence = cpu_to_be32(tail_tid);
- sb->s_start = cpu_to_be32(tail_block);
-
-- jbd2_write_superblock(journal, write_op);
-+ ret = jbd2_write_superblock(journal, write_op);
-+ if (ret)
-+ goto out;
-
- /* Log is no longer empty */
- write_lock(&journal->j_state_lock);
- WARN_ON(!sb->s_sequence);
- journal->j_flags &= ~JBD2_FLUSHED;
- write_unlock(&journal->j_state_lock);
-+
-+out:
-+ return ret;
- }
-
- /**
-@@ -1952,7 +1968,14 @@ int jbd2_journal_flush(journal_t *journal)
- return -EIO;
-
- mutex_lock(&journal->j_checkpoint_mutex);
-- jbd2_cleanup_journal_tail(journal);
-+ if (!err) {
-+ err = jbd2_cleanup_journal_tail(journal);
-+ if (err < 0) {
-+ mutex_unlock(&journal->j_checkpoint_mutex);
-+ goto out;
-+ }
-+ err = 0;
-+ }
-
- /* Finally, mark the journal as really needing no recovery.
- * This sets s_start==0 in the underlying superblock, which is
-@@ -1968,7 +1991,8 @@ int jbd2_journal_flush(journal_t *journal)
- J_ASSERT(journal->j_head == journal->j_tail);
- J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
- write_unlock(&journal->j_state_lock);
-- return 0;
-+out:
-+ return err;
- }
-
- /**
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index fa6d721..4495cad 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
- if (args->npages != 0)
- xdr_write_pages(xdr, args->pages, 0, args->len);
- else
-- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
-+ xdr_reserve_space(xdr, args->len);
-
- error = nfsacl_encode(xdr->buf, base, args->inode,
- (args->mask & NFS_ACL) ?
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index b4f177f..c402b67 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1482,6 +1482,8 @@ restart:
- spin_unlock(&state->state_lock);
- }
- nfs4_put_open_state(state);
-+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
-+ &state->flags);
- spin_lock(&sp->so_lock);
- goto restart;
- }
-diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
-index 14e58f2..98d4948 100644
---- a/fs/xfs/xfs_symlink.c
-+++ b/fs/xfs/xfs_symlink.c
-@@ -102,7 +102,7 @@ xfs_readlink_bmap(
- cur_chunk += sizeof(struct xfs_dsymlink_hdr);
- }
-
-- memcpy(link + offset, bp->b_addr, byte_cnt);
-+ memcpy(link + offset, cur_chunk, byte_cnt);
-
- pathlen -= byte_cnt;
- offset += byte_cnt;
-diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
-index 8fc12f8..69afb57 100644
---- a/include/acpi/actypes.h
-+++ b/include/acpi/actypes.h
-@@ -561,6 +561,7 @@ typedef u64 acpi_integer;
- #define ACPI_NO_ACPI_ENABLE 0x10
- #define ACPI_NO_DEVICE_INIT 0x20
- #define ACPI_NO_OBJECT_INIT 0x40
-+#define ACPI_NO_FACS_INIT 0x80
-
- /*
- * Initialization state
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index cd80aa8..77af621 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -402,6 +402,7 @@ extern acpi_status acpi_pci_osc_control_set(acpi_handle handle,
- #define ACPI_OST_SC_INSERT_NOT_SUPPORTED 0x82
-
- extern void acpi_early_init(void);
-+extern void acpi_subsystem_init(void);
-
- extern int acpi_nvs_register(__u64 start, __u64 size);
-
-@@ -436,6 +437,7 @@ static inline const char *acpi_dev_name(struct acpi_device *adev)
- }
-
- static inline void acpi_early_init(void) { }
-+static inline void acpi_subsystem_init(void) { }
-
- static inline int early_acpi_boot_init(void)
- {
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 0dae71e..e1fb0f6 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
- int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
- int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- unsigned long *block);
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-
- /* Commit management */
-@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal);
- extern int jbd2_journal_wipe (journal_t *, int);
- extern int jbd2_journal_skip_recovery (journal_t *);
- extern void jbd2_journal_update_sb_errno(journal_t *);
--extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
-+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
- unsigned long, int);
- extern void __jbd2_journal_abort_hard (journal_t *);
- extern void jbd2_journal_abort (journal_t *, int);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index b84e786..189c9ff 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -428,6 +428,7 @@ enum {
- ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19), /* don't use queued TRIM */
- ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
- ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
-+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
-
- /* DMA mask for user DMA control: User visible values; DO NOT
- renumber */
-diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
-index 53988cb..3a36a2c 100644
---- a/include/linux/nfs_xdr.h
-+++ b/include/linux/nfs_xdr.h
-@@ -1155,7 +1155,7 @@ struct nfs41_state_protection {
- struct nfs4_op_map allow;
- };
-
--#define NFS4_EXCHANGE_ID_LEN (48)
-+#define NFS4_EXCHANGE_ID_LEN (127)
- struct nfs41_exchange_id_args {
- struct nfs_client *client;
- nfs4_verifier *verifier;
-diff --git a/include/linux/of.h b/include/linux/of.h
-index 3f8144d..9f2698d 100644
---- a/include/linux/of.h
-+++ b/include/linux/of.h
-@@ -517,7 +517,10 @@ static inline const char *of_prop_next_string(struct property *prop,
- #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
- extern int of_node_to_nid(struct device_node *np);
- #else
--static inline int of_node_to_nid(struct device_node *device) { return 0; }
-+static inline int of_node_to_nid(struct device_node *device)
-+{
-+ return NUMA_NO_NODE;
-+}
- #endif
-
- static inline struct device_node *of_find_matching_node(
-diff --git a/include/uapi/linux/usbdevice_fs.h b/include/uapi/linux/usbdevice_fs.h
-index 0c65e4b..ef29266 100644
---- a/include/uapi/linux/usbdevice_fs.h
-+++ b/include/uapi/linux/usbdevice_fs.h
-@@ -125,11 +125,12 @@ struct usbdevfs_hub_portinfo {
- char port [127]; /* e.g. port 3 connects to device 27 */
- };
-
--/* Device capability flags */
-+/* System and bus capability flags */
- #define USBDEVFS_CAP_ZERO_PACKET 0x01
- #define USBDEVFS_CAP_BULK_CONTINUATION 0x02
- #define USBDEVFS_CAP_NO_PACKET_SIZE_LIM 0x04
- #define USBDEVFS_CAP_BULK_SCATTER_GATHER 0x08
-+#define USBDEVFS_CAP_REAP_AFTER_DISCONNECT 0x10
-
- /* USBDEVFS_DISCONNECT_CLAIM flags & struct */
-
-diff --git a/init/main.c b/init/main.c
-index 58c132d..008edce 100644
---- a/init/main.c
-+++ b/init/main.c
-@@ -643,6 +643,7 @@ asmlinkage void __init start_kernel(void)
-
- check_bugs();
-
-+ acpi_subsystem_init();
- sfi_init_late();
-
- if (efi_enabled(EFI_RUNTIME_SERVICES)) {
-diff --git a/kernel/irq/devres.c b/kernel/irq/devres.c
-index 1ef0606..0296d6f 100644
---- a/kernel/irq/devres.c
-+++ b/kernel/irq/devres.c
-@@ -104,7 +104,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- return -ENOMEM;
-
- rc = request_any_context_irq(irq, handler, irqflags, devname, dev_id);
-- if (rc) {
-+ if (rc < 0) {
- devres_free(dr);
- return rc;
- }
-@@ -113,7 +113,7 @@ int devm_request_any_context_irq(struct device *dev, unsigned int irq,
- dr->dev_id = dev_id;
- devres_add(dev, dr);
-
-- return 0;
-+ return rc;
- }
- EXPORT_SYMBOL(devm_request_any_context_irq);
-
-diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 2fac9cc..9d18628 100644
---- a/kernel/power/Kconfig
-+++ b/kernel/power/Kconfig
-@@ -191,7 +191,7 @@ config DPM_WATCHDOG
- config DPM_WATCHDOG_TIMEOUT
- int "Watchdog timeout in seconds"
- range 1 120
-- default 12
-+ default 60
- depends on DPM_WATCHDOG
-
- config PM_TRACE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index a755ad7..02e7fb4 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -383,11 +383,11 @@ static int check_syslog_permissions(int type, bool from_file)
- * already done the capabilities checks at open time.
- */
- if (from_file && type != SYSLOG_ACTION_OPEN)
-- return 0;
-+ goto ok;
-
- if (syslog_action_restricted(type)) {
- if (capable(CAP_SYSLOG))
-- return 0;
-+ goto ok;
- /*
- * For historical reasons, accept CAP_SYS_ADMIN too, with
- * a warning.
-@@ -397,10 +397,11 @@ static int check_syslog_permissions(int type, bool from_file)
- "CAP_SYS_ADMIN but no CAP_SYSLOG "
- "(deprecated).\n",
- current->comm, task_pid_nr(current));
-- return 0;
-+ goto ok;
- }
- return -EPERM;
- }
-+ok:
- return security_syslog(type);
- }
-
-@@ -1126,10 +1127,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
- if (error)
- goto out;
-
-- error = security_syslog(type);
-- if (error)
-- return error;
--
- switch (type) {
- case SYSLOG_ACTION_CLOSE: /* Close log */
- break;
-diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c
-index 1254f31..ae359f0 100644
---- a/kernel/rcu/tiny.c
-+++ b/kernel/rcu/tiny.c
-@@ -284,6 +284,11 @@ static void __rcu_process_callbacks(struct rcu_ctrlblk *rcp)
-
- /* Move the ready-to-invoke callbacks to a local list. */
- local_irq_save(flags);
-+ if (rcp->donetail == &rcp->rcucblist) {
-+ /* No callbacks ready, so just leave. */
-+ local_irq_restore(flags);
-+ return;
-+ }
- RCU_TRACE(trace_rcu_batch_start(rcp->name, 0, rcp->qlen, -1));
- list = rcp->rcucblist;
- rcp->rcucblist = *rcp->donetail;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index c8bd809..c1be95c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -422,6 +422,7 @@ enum {
-
- TRACE_CONTROL_BIT,
-
-+ TRACE_BRANCH_BIT,
- /*
- * Abuse of the trace_recursion.
- * As we need a way to maintain state if we are tracing the function
-diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
-index 697fb9b..60850b4 100644
---- a/kernel/trace/trace_branch.c
-+++ b/kernel/trace/trace_branch.c
-@@ -37,9 +37,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- struct trace_branch *entry;
- struct ring_buffer *buffer;
- unsigned long flags;
-- int cpu, pc;
-+ int pc;
- const char *p;
-
-+ if (current->trace_recursion & TRACE_BRANCH_BIT)
-+ return;
-+
- /*
- * I would love to save just the ftrace_likely_data pointer, but
- * this code can also be used by modules. Ugly things can happen
-@@ -50,10 +53,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- if (unlikely(!tr))
- return;
-
-- local_irq_save(flags);
-- cpu = raw_smp_processor_id();
-- data = per_cpu_ptr(tr->trace_buffer.data, cpu);
-- if (atomic_inc_return(&data->disabled) != 1)
-+ raw_local_irq_save(flags);
-+ current->trace_recursion |= TRACE_BRANCH_BIT;
-+ data = this_cpu_ptr(tr->trace_buffer.data);
-+ if (atomic_read(&data->disabled))
- goto out;
-
- pc = preempt_count();
-@@ -82,8 +85,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- __buffer_unlock_commit(buffer, event);
-
- out:
-- atomic_dec(&data->disabled);
-- local_irq_restore(flags);
-+ current->trace_recursion &= ~TRACE_BRANCH_BIT;
-+ raw_local_irq_restore(flags);
- }
-
- static inline
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index cb347e8..7b244d0 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -1086,6 +1086,9 @@ static void parse_init(struct filter_parse_state *ps,
-
- static char infix_next(struct filter_parse_state *ps)
- {
-+ if (!ps->infix.cnt)
-+ return 0;
-+
- ps->infix.cnt--;
-
- return ps->infix.string[ps->infix.tail++];
-@@ -1101,6 +1104,9 @@ static char infix_peek(struct filter_parse_state *ps)
-
- static void infix_advance(struct filter_parse_state *ps)
- {
-+ if (!ps->infix.cnt)
-+ return;
-+
- ps->infix.cnt--;
- ps->infix.tail++;
- }
-@@ -1413,7 +1419,9 @@ static int check_preds(struct filter_parse_state *ps)
- continue;
- }
- n_normal_preds++;
-- WARN_ON_ONCE(cnt < 0);
-+ /* all ops should have operands */
-+ if (cnt < 0)
-+ break;
- }
-
- if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index e5c4ebe..c0634aa 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -603,12 +603,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- unsigned a, b;
- int c, old_c, totaldigits;
- const char __user __force *ubuf = (const char __user __force *)buf;
-- int exp_digit, in_range;
-+ int at_start, in_range;
-
- totaldigits = c = 0;
- bitmap_zero(maskp, nmaskbits);
- do {
-- exp_digit = 1;
-+ at_start = 1;
- in_range = 0;
- a = b = 0;
-
-@@ -637,11 +637,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- break;
-
- if (c == '-') {
-- if (exp_digit || in_range)
-+ if (at_start || in_range)
- return -EINVAL;
- b = 0;
- in_range = 1;
-- exp_digit = 1;
- continue;
- }
-
-@@ -651,16 +650,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- b = b * 10 + (c - '0');
- if (!in_range)
- a = b;
-- exp_digit = 0;
-+ at_start = 0;
- totaldigits++;
- }
- if (!(a <= b))
- return -EINVAL;
- if (b >= nmaskbits)
- return -ERANGE;
-- while (a <= b) {
-- set_bit(a, maskp);
-- a++;
-+ if (!at_start) {
-+ while (a <= b) {
-+ set_bit(a, maskp);
-+ a++;
-+ }
- }
- } while (buflen && c == ',');
- return 0;
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 9186550..08046f3 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -839,7 +839,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
- if (err < 0) {
- if (err == -EIO)
- c->status = Disconnected;
-- goto reterr;
-+ if (err != -ERESTARTSYS)
-+ goto reterr;
- }
- if (req->status == REQ_STATUS_ERROR) {
- p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
-diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
-index aade4a5..bde94d8 100644
---- a/net/ceph/osdmap.c
-+++ b/net/ceph/osdmap.c
-@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
- {
- int j;
- dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-- ceph_decode_32_safe(p, end, b->num_nodes, bad);
-+ ceph_decode_8_safe(p, end, b->num_nodes, bad);
- b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
- if (b->node_weights == NULL)
- return -ENOMEM;
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index c7a7a86..9e58c99 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -248,6 +248,7 @@ static void ieee80211_restart_work(struct work_struct *work)
- {
- struct ieee80211_local *local =
- container_of(work, struct ieee80211_local, restart_work);
-+ struct ieee80211_sub_if_data *sdata;
-
- /* wait for scan work complete */
- flush_workqueue(local->workqueue);
-@@ -256,6 +257,8 @@ static void ieee80211_restart_work(struct work_struct *work)
- "%s called with hardware scan in progress\n", __func__);
-
- rtnl_lock();
-+ list_for_each_entry(sdata, &local->interfaces, list)
-+ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
- ieee80211_scan_cancel(local);
- ieee80211_reconfig(local);
- rtnl_unlock();
-diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
-index e860d4f..ab21968 100644
---- a/net/sunrpc/backchannel_rqst.c
-+++ b/net/sunrpc/backchannel_rqst.c
-@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
-
- dprintk("RPC: free allocations for req= %p\n", req);
- WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
-- xbufp = &req->rq_private_buf;
-+ xbufp = &req->rq_rcv_buf;
- free_page((unsigned long)xbufp->head[0].iov_base);
- xbufp = &req->rq_snd_buf;
- free_page((unsigned long)xbufp->head[0].iov_base);
-diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
-index 7e71e06..048550a 100644
---- a/security/integrity/evm/evm_main.c
-+++ b/security/integrity/evm/evm_main.c
-@@ -20,6 +20,7 @@
- #include <linux/xattr.h>
- #include <linux/integrity.h>
- #include <linux/evm.h>
-+#include <linux/magic.h>
- #include <crypto/hash.h>
- #include "evm.h"
-
-@@ -275,6 +276,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
- iint = integrity_iint_find(dentry->d_inode);
- if (iint && (iint->flags & IMA_NEW_FILE))
- return 0;
-+
-+ /* exception for pseudo filesystems */
-+ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
-+ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
-+ return 0;
-+
-+ integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
-+ dentry->d_inode, dentry->d_name.name,
-+ "update_metadata",
-+ integrity_status_msg[evm_status],
-+ -EPERM, 0);
- }
- out:
- if (evm_status != INTEGRITY_PASS)
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index f79fa8b..5cb7de9 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- const char *op, const char *cause);
- int ima_init_crypto(void);
- void ima_putc(struct seq_file *m, void *data, int datalen);
--void ima_print_digest(struct seq_file *m, u8 *digest, int size);
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
- struct ima_template_desc *ima_template_desc_current(void);
- int ima_init_template(void);
-
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 468a3ba..35f3c90 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -186,9 +186,9 @@ static const struct file_operations ima_measurements_ops = {
- .release = seq_release,
- };
-
--void ima_print_digest(struct seq_file *m, u8 *digest, int size)
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
- {
-- int i;
-+ u32 i;
-
- for (i = 0; i < size; i++)
- seq_printf(m, "%02x", *(digest + i));
-diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
-index e8592e7..dcf77b7 100644
---- a/security/integrity/ima/ima_template_lib.c
-+++ b/security/integrity/ima/ima_template_lib.c
-@@ -79,7 +79,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
- enum data_formats datafmt,
- struct ima_field_data *field_data)
- {
-- u8 *buf_ptr = field_data->data, buflen = field_data->len;
-+ u8 *buf_ptr = field_data->data;
-+ u32 buflen = field_data->len;
-
- switch (datafmt) {
- case DATA_FMT_DIGEST_WITH_ALGO:
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index 2fb2576..04d0d7c 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1151,9 +1151,11 @@ void __key_link_end(struct key *keyring,
- if (index_key->type == &key_type_keyring)
- up_write(&keyring_serialise_link_sem);
-
-- if (edit && !edit->dead_leaf) {
-- key_payload_reserve(keyring,
-- keyring->datalen - KEYQUOTA_LINK_BYTES);
-+ if (edit) {
-+ if (!edit->dead_leaf) {
-+ key_payload_reserve(keyring,
-+ keyring->datalen - KEYQUOTA_LINK_BYTES);
-+ }
- assoc_array_cancel_edit(edit);
- }
- up_write(&keyring->sem);
-diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
-index ba17522..2f503c0 100644
---- a/sound/pci/hda/patch_realtek.c
-+++ b/sound/pci/hda/patch_realtek.c
-@@ -3955,6 +3955,7 @@ enum {
- ALC269_FIXUP_LIFEBOOK,
- ALC269_FIXUP_LIFEBOOK_EXTMIC,
- ALC269_FIXUP_LIFEBOOK_HP_PIN,
-+ ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT,
- ALC269_FIXUP_AMIC,
- ALC269_FIXUP_DMIC,
- ALC269VB_FIXUP_AMIC,
-@@ -3973,6 +3974,7 @@ enum {
- ALC269_FIXUP_DELL3_MIC_NO_PRESENCE,
- ALC269_FIXUP_HEADSET_MODE,
- ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC,
-+ ALC269_FIXUP_ASPIRE_HEADSET_MIC,
- ALC269_FIXUP_ASUS_X101_FUNC,
- ALC269_FIXUP_ASUS_X101_VERB,
- ALC269_FIXUP_ASUS_X101,
-@@ -4096,6 +4098,10 @@ static const struct hda_fixup alc269_fixups[] = {
- { }
- },
- },
-+ [ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT] = {
-+ .type = HDA_FIXUP_FUNC,
-+ .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
-+ },
- [ALC269_FIXUP_AMIC] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
-@@ -4214,6 +4220,15 @@ static const struct hda_fixup alc269_fixups[] = {
- .type = HDA_FIXUP_FUNC,
- .v.func = alc_fixup_headset_mode_no_hp_mic,
- },
-+ [ALC269_FIXUP_ASPIRE_HEADSET_MIC] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ { 0x19, 0x01a1913c }, /* headset mic w/o jack detect */
-+ { }
-+ },
-+ .chained = true,
-+ .chain_id = ALC269_FIXUP_HEADSET_MODE,
-+ },
- [ALC286_FIXUP_SONY_MIC_NO_PRESENCE] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = (const struct hda_pintbl[]) {
-@@ -4397,6 +4412,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x1025, 0x029b, "Acer 1810TZ", ALC269_FIXUP_INV_DMIC),
- SND_PCI_QUIRK(0x1025, 0x0349, "Acer AOD260", ALC269_FIXUP_INV_DMIC),
- SND_PCI_QUIRK(0x1025, 0x047c, "Acer AC700", ALC269_FIXUP_ACER_AC700),
-+ SND_PCI_QUIRK(0x1025, 0x072d, "Acer Aspire V5-571G", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
-+ SND_PCI_QUIRK(0x1025, 0x080d, "Acer Aspire V5-122P", ALC269_FIXUP_ASPIRE_HEADSET_MIC),
- SND_PCI_QUIRK(0x1025, 0x0740, "Acer AO725", ALC271_FIXUP_HP_GATE_MIC_JACK),
- SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
- SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
-@@ -4549,6 +4566,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
- SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
- SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
- SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
-+ SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT),
- SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN),
- SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index ce9c8e1..fbee45c 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -41,7 +41,7 @@ struct wm5102_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- static const struct wm_adsp_region wm5102_dsp1_regions[] = {
-diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
-index 2c3c962..0fce853 100644
---- a/sound/soc/codecs/wm5110.c
-+++ b/sound/soc/codecs/wm5110.c
-@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- #define WM5110_NG_SRC(name, base) \
-diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
-index 2f167a8..62bacb8 100644
---- a/sound/soc/codecs/wm8737.c
-+++ b/sound/soc/codecs/wm8737.c
-@@ -494,7 +494,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
-
- /* Fast VMID ramp at 2*2.5k */
- snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
-- WM8737_VMIDSEL_MASK, 0x4);
-+ WM8737_VMIDSEL_MASK,
-+ 2 << WM8737_VMIDSEL_SHIFT);
-
- /* Bring VMID up */
- snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
-@@ -508,7 +509,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
-
- /* VMID at 2*300k */
- snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
-- WM8737_VMIDSEL_MASK, 2);
-+ WM8737_VMIDSEL_MASK,
-+ 1 << WM8737_VMIDSEL_SHIFT);
-
- break;
-
-diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
-index db94931..0bb4a64 100644
---- a/sound/soc/codecs/wm8903.h
-+++ b/sound/soc/codecs/wm8903.h
-@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
- #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
-
- #define WM8903_VMID_RES_50K 2
--#define WM8903_VMID_RES_250K 3
-+#define WM8903_VMID_RES_250K 4
- #define WM8903_VMID_RES_5K 6
-
- /*
-diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
-index 1c1fc61..475fc24 100644
---- a/sound/soc/codecs/wm8955.c
-+++ b/sound/soc/codecs/wm8955.c
-@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
- WM8955_K_17_9_MASK,
- (pll.k >> 9) & WM8955_K_17_9_MASK);
-- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
-+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
- WM8955_K_8_0_MASK,
- pll.k & WM8955_K_8_0_MASK);
- if (pll.k)
-diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
-index edfd4ed..e04dbaa 100644
---- a/sound/soc/codecs/wm8960.c
-+++ b/sound/soc/codecs/wm8960.c
-@@ -242,7 +242,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
- SOC_ENUM("ADC Polarity", wm8960_enum[0]),
- SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
-
--SOC_ENUM("DAC Polarity", wm8960_enum[2]),
-+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
- SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
- wm8960_get_deemph, wm8960_put_deemph),
-
-diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
-index 555115e..1461ae61 100644
---- a/sound/soc/codecs/wm8997.c
-+++ b/sound/soc/codecs/wm8997.c
-@@ -40,7 +40,7 @@ struct wm8997_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- static const struct reg_default wm8997_sysclk_reva_patch[] = {
-diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
-index 3a3d17c..6644525 100644
---- a/sound/soc/fsl/imx-wm8962.c
-+++ b/sound/soc/fsl/imx-wm8962.c
-@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
- dev_err(&pdev->dev, "audmux internal port setup failed\n");
- return ret;
- }
-- imx_audmux_v2_configure_port(ext_port,
-+ ret = imx_audmux_v2_configure_port(ext_port,
- IMX_AUDMUX_V2_PTCR_SYN,
- IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
- if (ret) {
diff --git a/3.14.49/0000_README b/3.14.50/0000_README
similarity index 89%
rename from 3.14.49/0000_README
rename to 3.14.50/0000_README
index eb9a47e..5416cb6 100644
--- a/3.14.49/0000_README
+++ b/3.14.50/0000_README
@@ -2,15 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1047_linux-3.14.48.patch
+Patch: 1049_linux-3.14.50.patch
From: http://www.kernel.org
-Desc: Linux 3.14.48
+Desc: Linux 3.14.50
-Patch: 1048_linux-3.14.49.patch
-From: http://www.kernel.org
-Desc: Linux 3.14.49
-
-Patch: 4420_grsecurity-3.1-3.14.49-201508032312.patch
+Patch: 4420_grsecurity-3.1-3.14.50-201508102128.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.14.50/1049_linux-3.14.50.patch b/3.14.50/1049_linux-3.14.50.patch
new file mode 100644
index 0000000..bd7d238
--- /dev/null
+++ b/3.14.50/1049_linux-3.14.50.patch
@@ -0,0 +1,700 @@
+diff --git a/Makefile b/Makefile
+index fee8460..d71c40a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 49
++SUBLEVEL = 50
+ EXTRAVERSION =
+ NAME = Remembering Coco
+
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2..2a58af7 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+
+-#define instruction_pointer(regs) ((regs)->ret)
++#define instruction_pointer(regs) (unsigned long)((regs)->ret)
+ #define profile_pc(regs) instruction_pointer(regs)
+
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97..52c179b 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_enable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (IS_ERR_OR_NULL(clk))
++ return;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_disable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ unsigned long flags;
+ unsigned long rate;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ rate = clk->get_rate(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ unsigned long flags, actual_rate;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ unsigned long flags;
+ long ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ unsigned long flags;
+ int ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_parent)
+ return -ENOSYS;
+
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+- return clk->parent;
++ return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 29bd7be..1ecd47b 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -276,6 +276,8 @@ ENTRY(_sclp_print_early)
+ jno .Lesa2
+ ahi %r15,-80
+ stmh %r6,%r15,96(%r15) # store upper register halves
++ basr %r13,0
++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
+ .Lesa2:
+ #endif
+ lr %r10,%r2 # save string pointer
+@@ -299,6 +301,8 @@ ENTRY(_sclp_print_early)
+ #endif
+ lm %r6,%r15,120(%r15) # restore registers
+ br %r14
++.Lzeroes:
++ .fill 64,4,0
+
+ .LwritedataS4:
+ .long 0x00760005 # SCLP command for write data
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index 74c9172..bdb3ecf 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1146,7 +1146,7 @@ static void __init load_hv_initrd(void)
+
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+- free_bootmem(__pa(begin), end - begin);
++ free_bootmem_late(__pa(begin), end - begin);
+ }
+
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 78cbb2d..ec5a3c7 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ unsigned int e820_type = 0;
+ unsigned long m = efi->efi_memmap;
+
++#ifdef CONFIG_X86_64
++ m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ switch (d->type) {
+ case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
+index c5b56ed..a814c80 100644
+--- a/arch/x86/boot/compressed/head_32.S
++++ b/arch/x86/boot/compressed/head_32.S
+@@ -54,7 +54,7 @@ ENTRY(efi_pe_entry)
+ call reloc
+ reloc:
+ popl %ecx
+- subl reloc, %ecx
++ subl $reloc, %ecx
+ movl %ecx, BP_code32_start(%eax)
+
+ sub $0x4, %esp
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index d8f80e7..a717585 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -703,8 +703,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ return -EINVAL;
+
+ disk = get_gendisk(MKDEV(major, minor), &part);
+- if (!disk || part)
++ if (!disk)
+ return -EINVAL;
++ if (part) {
++ put_disk(disk);
++ return -EINVAL;
++ }
+
+ rcu_read_lock();
+ spin_lock_irq(disk->queue->queue_lock);
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084..85aa761 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ ATA_LFLAG_NO_SRST |
+ ATA_LFLAG_ASSUME_ATA;
+ }
++ } else if (vendor == 0x11ab && devid == 0x4140) {
++ /* Marvell 4140 quirks */
++ ata_for_each_link(link, ap, EDGE) {
++ /* port 4 is for SEMB device and it doesn't like SRST */
++ if (link->pmp == 4)
++ link->flags |= ATA_LFLAG_DISABLED;
++ }
+ }
+ }
+
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index a096633..c6f7e91 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -625,6 +625,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ goto err_out;
+ }
+
++ /* TSC-25 data sheet specifies a delay after the RESET command */
++ msleep(150);
++
+ /* set coordinate output rate */
+ buf[0] = buf[1] = 0xFF;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index b96ee9d..9be97e0 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (r1_bio->mddev->degraded == conf->raid_disks ||
+ (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ uptodate = 1;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ }
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index a7d9f95..7fd86be 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -47,6 +47,6 @@
+ #define ESDHC_DMA_SYSCTL 0x40c
+ #define ESDHC_DMA_SNOOP 0x00000040
+
+-#define ESDHC_HOST_CONTROL_RES 0x05
++#define ESDHC_HOST_CONTROL_RES 0x01
+
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index 561c6b4..b807666 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -257,6 +257,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ goto err_of_parse;
+ sdhci_get_of_property(pdev);
+ pdata = pxav3_get_mmc_pdata(dev);
++ pdev->dev.platform_data = pdata;
+ } else if (pdata) {
+ /* on-chip device */
+ if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index a1d6986..f310982 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ spin_lock(&st_use_lock);
+ STp->in_use = 0;
+ spin_unlock(&st_use_lock);
+- scsi_tape_put(STp);
+ if (resumed)
+ scsi_autopm_put_device(STp->device);
++ scsi_tape_put(STp);
+ return retval;
+
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index c8d7b30..55ec9b4 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4476,7 +4476,18 @@ static void iscsit_logout_post_handler_closesession(
+ struct iscsi_conn *conn)
+ {
+ struct iscsi_session *sess = conn->sess;
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++ /*
++ * Traditional iscsi/tcp will invoke this logic from TX thread
++ * context during session logout, so clear tx_thread_active and
++ * sleep if iscsit_close_connection() has not already occured.
++ *
++ * Since iser-target invokes this logic from it's own workqueue,
++ * always sleep waiting for RX/TX thread shutdown to complete
++ * within iscsit_close_connection().
++ */
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4490,7 +4501,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ struct iscsi_conn *conn)
+ {
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4709,6 +4723,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ struct iscsi_session *sess;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ struct se_session *se_sess, *se_sess_tmp;
++ LIST_HEAD(free_list);
+ int session_count = 0;
+
+ spin_lock_bh(&se_tpg->session_lock);
+@@ -4730,14 +4745,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ }
+ atomic_set(&sess->session_reinstatement, 1);
+ spin_unlock(&sess->conn_lock);
+- spin_unlock_bh(&se_tpg->session_lock);
+
+- iscsit_free_session(sess);
+- spin_lock_bh(&se_tpg->session_lock);
++ list_move_tail(&se_sess->sess_list, &free_list);
++ }
++ spin_unlock_bh(&se_tpg->session_lock);
+
++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
++
++ iscsit_free_session(sess);
+ session_count++;
+ }
+- spin_unlock_bh(&se_tpg->session_lock);
+
+ pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ " Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index b9e16abb..5c95765 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -480,10 +480,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+- * Do not report it to usb core.
++ * Do not report it to usb core, instead, pretend to be U3,
++ * thus usb core knows it's not ready for transfer
+ */
+- if (pls == XDEV_RESUME)
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
+ return;
++ }
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+@@ -584,7 +587,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_C_RESET << 16;
+ /* USB3.0 only */
+ if (hcd->speed == HCD_USB3) {
+- if ((raw_port_status & PORT_PLC))
++ /* Port link change with port in resume state should not be
++ * reported to usbcore, as this is an internal state to be
++ * handled by xhci driver. Reporting PLC to usbcore may
++ * cause usbcore clearing PLC first and port change event
++ * irq won't be generated.
++ */
++ if ((raw_port_status & PORT_PLC) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((raw_port_status & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1114,10 +1124,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (hcd->self.root_hub->do_remote_wakeup) {
+- if (bus_state->resuming_ports) {
++ if (bus_state->resuming_ports || /* USB2 */
++ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "suspend failed because "
+- "a port is resuming\n");
++ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ return -EBUSY;
+ }
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index f615712..bcc43a2 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1740,6 +1740,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ usb_hcd_resume_root_hub(hcd);
+ }
+
++ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 16f4f8d..fc61e663b 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3424,6 +3424,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ return -EINVAL;
+ }
+
++ if (virt_dev->tt_info)
++ old_active_eps = virt_dev->tt_info->active_eps;
++
+ if (virt_dev->udev != udev) {
+ /* If the virt_dev and the udev does not match, this virt_dev
+ * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 70facb7..c167485 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0 (0x0 << 5)
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
++#define XDEV_INACTIVE (0x6 << 5)
+ #define XDEV_RESUME (0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER (1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 821e1e2..da380a9 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2032,6 +2032,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++ "ZTE,Incorporated",
++ "ZTE WCDMA Technologies MSM",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+ * This encrypted pen drive returns bogus data for the initial READ(10).
+ */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 78987e4..85095d7 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -876,6 +876,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ }
+ if (eventfp != d->log_file) {
+ filep = d->log_file;
++ d->log_file = eventfp;
+ ctx = d->log_ctx;
+ d->log_ctx = eventfp ?
+ eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index aa24f7d..3d2f27b 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -587,6 +587,9 @@ repeat:
+ if (unlikely(d_unhashed(dentry)))
+ goto kill_it;
+
++ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++ goto kill_it;
++
+ if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ if (dentry->d_op->d_delete(dentry))
+ goto kill_it;
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107..7a5237a 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ /*
+- * If the interrupt has a parent irq and runs
+- * in the thread context of the parent irq,
+- * retrigger the parent.
++ * If the interrupt is running in the thread
++ * context of the parent irq we need to be
++ * careful, because we cannot trigger it
++ * directly.
+ */
+- if (desc->parent_irq &&
+- irq_settings_is_nested_thread(desc))
++ if (irq_settings_is_nested_thread(desc)) {
++ /*
++ * If the parent_irq is valid, we
++ * retrigger the parent, otherwise we
++ * do nothing.
++ */
++ if (!desc->parent_irq)
++ return;
+ irq = desc->parent_irq;
++ }
+ /* Set it pending and activate the softirq: */
+ set_bit(irq, irqs_resend);
+ tasklet_schedule(&resend_tasklet);
+diff --git a/mm/memory.c b/mm/memory.c
+index 749e1c6..e9ddc7a 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -3234,6 +3234,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+
+ pte_unmap(page_table);
+
++ /* File mapping without ->vm_ops ? */
++ if (vma->vm_flags & VM_SHARED)
++ return VM_FAULT_SIGBUS;
++
+ /* Check if we need to add a guard page to the stack */
+ if (check_stack_guard_page(vma, address) < 0)
+ return VM_FAULT_SIGSEGV;
+@@ -3502,6 +3506,9 @@ static int do_linear_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+ - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
+
+ pte_unmap(page_table);
++ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
++ if (!vma->vm_ops->fault)
++ return VM_FAULT_SIGBUS;
+ return __do_fault(mm, vma, address, pmd, pgoff, flags, orig_pte);
+ }
+
+@@ -3650,11 +3657,9 @@ static int handle_pte_fault(struct mm_struct *mm,
+ entry = ACCESS_ONCE(*pte);
+ if (!pte_present(entry)) {
+ if (pte_none(entry)) {
+- if (vma->vm_ops) {
+- if (likely(vma->vm_ops->fault))
+- return do_linear_fault(mm, vma, address,
++ if (vma->vm_ops)
++ return do_linear_fault(mm, vma, address,
+ pte, pmd, flags, entry);
+- }
+ return do_anonymous_page(mm, vma, address,
+ pte, pmd, flags);
+ }
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 653ce5d..5d8bc1f 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -712,6 +712,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+
+ debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ sdata->vif.debugfs_dir = NULL;
++ sdata->debugfs.subdir_stations = NULL;
+ }
+
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index e8fdb17..a985158 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ }
+
+ ibmr = rds_ib_alloc_fmr(rds_ibdev);
+- if (IS_ERR(ibmr))
++ if (IS_ERR(ibmr)) {
++ rds_ib_dev_put(rds_ibdev);
+ return ibmr;
++ }
+
+ ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ if (ret == 0)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 2f503c0..907371d 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2282,7 +2282,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index b16be39..9a3e107 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -336,6 +336,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ { 0 }
+ };
+
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++ { 3, NULL, .dB = &bose_companion5_dB },
++ { 0 } /* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++ { 7, NULL, .dB = &dragonfly_1_2_dB },
++ { 0 } /* terminator */
++};
++
+ /*
+ * Control map entries
+ */
+@@ -442,6 +456,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x25c4, 0x0003),
+ .map = scms_usb3318_map,
+ },
++ {
++ /* Bose Companion 5 */
++ .id = USB_ID(0x05a7, 0x1020),
++ .map = bose_companion5_map,
++ },
++ {
++ /* Dragonfly DAC 1.2 */
++ .id = USB_ID(0x21b4, 0x0081),
++ .map = dragonfly_1_2_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 5293b5a..7c24088 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2516,6 +2516,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
++/* Steinberg devices */
++{
++ /* Steinberg MI2 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++{
++ /* Steinberg MI4 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ /* TerraTec devices */
+ {
+ USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
diff --git a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
similarity index 99%
rename from 3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch
rename to 3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
index 75ba2f6..1086c4e 100644
--- a/3.14.49/4420_grsecurity-3.1-3.14.49-201508032312.patch
+++ b/3.14.50/4420_grsecurity-3.1-3.14.50-201508102128.patch
@@ -328,7 +328,7 @@ index 855d9b3..154c500 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index fee8460..5d81b33 100644
+index d71c40a..4d15036 100644
--- a/Makefile
+++ b/Makefile
@@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -10431,6 +10431,40 @@ index ad7e178..26cd4a7 100644
if (unlikely(ret))
ret = copy_to_user_fixup(to, from, size);
return ret;
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 11fdf0e..50d6f16 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+ * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+
+ #define VISEntryHalf \
+- rd %fprs, %o5; \
+- andcc %o5, FPRS_FEF, %g0; \
+- be,pt %icc, 297f; \
+- sethi %hi(298f), %g7; \
+- sethi %hi(VISenterhalf), %g1; \
+- jmpl %g1 + %lo(VISenterhalf), %g0; \
+- or %g7, %lo(298f), %g7; \
+- clr %o5; \
+-297: wr %o5, FPRS_FEF, %fprs; \
+-298:
++ VISEntry
++
++#define VISExitHalf \
++ VISExit
+
+ #define VISEntryHalfFast(fail_label) \
+ rd %fprs, %o5; \
+@@ -47,7 +41,7 @@
+ ba,a,pt %xcc, fail_label; \
+ 297: wr %o5, FPRS_FEF, %fprs;
+
+-#define VISExitHalf \
++#define VISExitHalfFast \
+ wr %o5, 0, %fprs;
+
+ #ifndef __ASSEMBLY__
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index d15cc17..d0ae796 100644
--- a/arch/sparc/kernel/Makefile
@@ -11092,6 +11126,105 @@ index dbe119b..089c7c1 100644
lib-$(CONFIG_SPARC32) += ashrdi3.o
lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a..83aeeb1 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ add %o0, 0x40, %o0
+ bne,pt %icc, 1b
+ LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++ VISExitHalfFast
++#else
+ VISExitHalf
+-
++#endif
+ brz,pn %o2, .Lexit
+ cmp %o2, 19
+ ble,pn %icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9..a063d84 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+
+ stx %g3, [%g6 + TI_GSR]
+ 2: add %g6, %g1, %g3
+- cmp %o5, FPRS_DU
+- be,pn %icc, 6f
+- sll %g1, 3, %g1
++ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++ sll %g1, 3, %g1
+ stb %o5, [%g3 + TI_FPSAVED]
+ rd %gsr, %g2
+ add %g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+ .align 32
+ 80: jmpl %g7 + %g0, %g0
+ nop
+-
+-6: ldub [%g3 + TI_FPSAVED], %o5
+- or %o5, FPRS_DU, %o5
+- add %g6, TI_FPREGS+0x80, %g2
+- stb %o5, [%g3 + TI_FPSAVED]
+-
+- sll %g1, 5, %g1
+- add %g6, TI_FPREGS+0xc0, %g3
+- wr %g0, FPRS_FEF, %fprs
+- membar #Sync
+- stda %f32, [%g2 + %g1] ASI_BLK_P
+- stda %f48, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 80f
+- nop
+-
+- .align 32
+-80: jmpl %g7 + %g0, %g0
+- nop
+-
+- .align 32
+-VISenterhalf:
+- ldub [%g6 + TI_FPDEPTH], %g1
+- brnz,a,pn %g1, 1f
+- cmp %g1, 1
+- stb %g0, [%g6 + TI_FPSAVED]
+- stx %fsr, [%g6 + TI_XFSR]
+- clr %o5
+- jmpl %g7 + %g0, %g0
+- wr %g0, FPRS_FEF, %fprs
+-
+-1: bne,pn %icc, 2f
+- srl %g1, 1, %g1
+- ba,pt %xcc, vis1
+- sub %g7, 8, %g7
+-2: addcc %g6, %g1, %g3
+- sll %g1, 3, %g1
+- andn %o5, FPRS_DU, %g2
+- stb %g2, [%g3 + TI_FPSAVED]
+-
+- rd %gsr, %g2
+- add %g6, %g1, %g3
+- stx %g2, [%g3 + TI_GSR]
+- add %g6, %g1, %g2
+- stx %fsr, [%g2 + TI_XFSR]
+- sll %g1, 5, %g1
+-3: andcc %o5, FPRS_DL, %g0
+- be,pn %icc, 4f
+- add %g6, TI_FPREGS, %g2
+-
+- add %g6, TI_FPREGS+0x40, %g3
+- membar #Sync
+- stda %f0, [%g2 + %g1] ASI_BLK_P
+- stda %f16, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 4f
+- nop
+-
+- .align 32
+-4: and %o5, FPRS_DU, %o5
+- jmpl %g7 + %g0, %g0
+- wr %o5, FPRS_FEF, %fprs
diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
index 85c233d..68500e0 100644
--- a/arch/sparc/lib/atomic_64.S
@@ -11307,7 +11440,7 @@ index 85c233d..68500e0 100644
cmp %g1, %g7
bne,pn %xcc, BACKOFF_LABEL(2f, 1b)
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 323335b..ed85ea2 100644
+index 323335b..e8ee09d 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -100,12 +100,18 @@ EXPORT_SYMBOL(__clear_user);
@@ -11329,6 +11462,17 @@ index 323335b..ed85ea2 100644
EXPORT_SYMBOL(atomic64_sub_ret);
EXPORT_SYMBOL(atomic64_dec_if_positive);
+@@ -126,10 +132,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ unsigned long *);
diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
index 30c3ecc..736f015 100644
--- a/arch/sparc/mm/Makefile
@@ -12816,21 +12960,6 @@ index 67e9f5c..2af15db 100644
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 78cbb2d..ec5a3c7 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -560,6 +560,10 @@ static efi_status_t setup_e820(struct boot_params *params,
- unsigned int e820_type = 0;
- unsigned long m = efi->efi_memmap;
-
-+#ifdef CONFIG_X86_64
-+ m |= (u64)efi->efi_memmap_hi << 32;
-+#endif
-+
- d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
- switch (d->type) {
- case EFI_RESERVED_TYPE:
diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
index a53440e..c3dbf1e 100644
--- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -12874,7 +13003,7 @@ index a53440e..c3dbf1e 100644
.previous
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
-index c5b56ed..9f79ed3 100644
+index a814c80..5df45f6 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -119,10 +119,10 @@ preferred_addr:
@@ -36926,10 +37055,10 @@ index af00795..2bb8105 100644
#define XCHAL_ICACHE_SIZE 32768 /* I-cache size in bytes or 0 */
#define XCHAL_DCACHE_SIZE 32768 /* D-cache size in bytes or 0 */
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
-index d8f80e7..5f41702 100644
+index a717585..11de03b 100644
--- a/block/blk-cgroup.c
+++ b/block/blk-cgroup.c
-@@ -809,7 +809,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
+@@ -813,7 +813,7 @@ static void blkcg_css_free(struct cgroup_subsys_state *css)
static struct cgroup_subsys_state *
blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
{
@@ -36938,7 +37067,7 @@ index d8f80e7..5f41702 100644
struct blkcg *blkcg;
if (!parent_css) {
-@@ -823,7 +823,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
+@@ -827,7 +827,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
blkcg->cfq_weight = CFQ_WEIGHT_DEFAULT;
blkcg->cfq_leaf_weight = CFQ_WEIGHT_DEFAULT;
@@ -46093,7 +46222,7 @@ index 3e6d115..ffecdeb 100644
/*----------------------------------------------------------------*/
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index b96ee9d..1d38b21 100644
+index 9be97e0..71b21b0 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1937,7 +1937,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -49509,7 +49638,7 @@ index f9e96c4..6b1faeb 100644
deferred:
#endif
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 841b608..198a8b7 100644
+index 841b608..1f38243 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -47,7 +47,7 @@ module_param(gso, bool, 0444);
@@ -49521,6 +49650,18 @@ index 841b608..198a8b7 100644
#define VIRTNET_DRIVER_VERSION "1.0.0"
+@@ -1652,9 +1652,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 0fa3b44..e913fc9 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -53028,21 +53169,6 @@ index 40d8592..8e89146 100644
int block_sectors = 0;
long error_sector;
struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
-diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
-index a1d6986..f310982 100644
---- a/drivers/scsi/st.c
-+++ b/drivers/scsi/st.c
-@@ -1262,9 +1262,9 @@ static int st_open(struct inode *inode, struct file *filp)
- spin_lock(&st_use_lock);
- STp->in_use = 0;
- spin_unlock(&st_use_lock);
-- scsi_tape_put(STp);
- if (resumed)
- scsi_autopm_put_device(STp->device);
-+ scsi_tape_put(STp);
- return retval;
-
- }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index f3e3ae8..f876b14 100644
--- a/drivers/spi/spi.c
@@ -74381,7 +74507,7 @@ index a93f7e6..d58bcbe 100644
return 0;
while (nr) {
diff --git a/fs/dcache.c b/fs/dcache.c
-index aa24f7d..8f1bf8c 100644
+index 3d2f27b..8f1bf8c 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -250,7 +250,7 @@ static void __d_free(struct rcu_head *head)
@@ -74393,17 +74519,7 @@ index aa24f7d..8f1bf8c 100644
this_cpu_dec(nr_dentry);
if (dentry->d_op && dentry->d_op->d_release)
dentry->d_op->d_release(dentry);
-@@ -587,6 +587,9 @@ repeat:
- if (unlikely(d_unhashed(dentry)))
- goto kill_it;
-
-+ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
-+ goto kill_it;
-+
- if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
- if (dentry->d_op->d_delete(dentry))
- goto kill_it;
-@@ -596,7 +599,7 @@ repeat:
+@@ -599,7 +599,7 @@ repeat:
dentry->d_flags |= DCACHE_REFERENCED;
dentry_lru_add(dentry);
@@ -74412,7 +74528,7 @@ index aa24f7d..8f1bf8c 100644
spin_unlock(&dentry->d_lock);
return;
-@@ -651,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
+@@ -654,7 +654,7 @@ int d_invalidate(struct dentry * dentry)
* We also need to leave mountpoints alone,
* directory or not.
*/
@@ -74421,7 +74537,7 @@ index aa24f7d..8f1bf8c 100644
if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
spin_unlock(&dentry->d_lock);
return -EBUSY;
-@@ -667,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
+@@ -670,7 +670,7 @@ EXPORT_SYMBOL(d_invalidate);
/* This must be called with d_lock held */
static inline void __dget_dlock(struct dentry *dentry)
{
@@ -74430,7 +74546,7 @@ index aa24f7d..8f1bf8c 100644
}
static inline void __dget(struct dentry *dentry)
-@@ -708,8 +711,8 @@ repeat:
+@@ -711,8 +711,8 @@ repeat:
goto repeat;
}
rcu_read_unlock();
@@ -74441,7 +74557,7 @@ index aa24f7d..8f1bf8c 100644
spin_unlock(&ret->d_lock);
return ret;
}
-@@ -792,7 +795,7 @@ restart:
+@@ -795,7 +795,7 @@ restart:
spin_lock(&inode->i_lock);
hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
spin_lock(&dentry->d_lock);
@@ -74450,7 +74566,7 @@ index aa24f7d..8f1bf8c 100644
/*
* inform the fs via d_prune that this dentry
* is about to be unhashed and destroyed.
-@@ -884,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -887,7 +887,7 @@ static void shrink_dentry_list(struct list_head *list)
* We found an inuse dentry which was not removed from
* the LRU because of laziness during lookup. Do not free it.
*/
@@ -74459,7 +74575,7 @@ index aa24f7d..8f1bf8c 100644
spin_unlock(&dentry->d_lock);
continue;
}
-@@ -930,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
+@@ -933,7 +933,7 @@ dentry_lru_isolate(struct list_head *item, spinlock_t *lru_lock, void *arg)
* counts, just remove them from the LRU. Otherwise give them
* another pass through the LRU.
*/
@@ -74468,7 +74584,7 @@ index aa24f7d..8f1bf8c 100644
d_lru_isolate(dentry);
spin_unlock(&dentry->d_lock);
return LRU_REMOVED;
-@@ -1269,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+@@ -1272,7 +1272,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
* loop in shrink_dcache_parent() might not make any progress
* and loop forever.
*/
@@ -74477,7 +74593,7 @@ index aa24f7d..8f1bf8c 100644
dentry_lru_del(dentry);
} else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
/*
-@@ -1323,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1326,11 +1326,11 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
struct select_data *data = _data;
enum d_walk_ret ret = D_WALK_CONTINUE;
@@ -74491,7 +74607,7 @@ index aa24f7d..8f1bf8c 100644
goto out;
printk(KERN_ERR
"BUG: Dentry %p{i=%lx,n=%s}"
-@@ -1337,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
+@@ -1340,7 +1340,7 @@ static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry)
dentry->d_inode ?
dentry->d_inode->i_ino : 0UL,
dentry->d_name.name,
@@ -74500,7 +74616,7 @@ index aa24f7d..8f1bf8c 100644
dentry->d_sb->s_type->name,
dentry->d_sb->s_id);
BUG();
-@@ -1495,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1498,7 +1498,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
*/
dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
if (name->len > DNAME_INLINE_LEN-1) {
@@ -74509,7 +74625,7 @@ index aa24f7d..8f1bf8c 100644
if (!dname) {
kmem_cache_free(dentry_cache, dentry);
return NULL;
-@@ -1513,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1516,7 +1516,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
smp_wmb();
dentry->d_name.name = dname;
@@ -74518,7 +74634,7 @@ index aa24f7d..8f1bf8c 100644
dentry->d_flags = 0;
spin_lock_init(&dentry->d_lock);
seqcount_init(&dentry->d_seq);
-@@ -1522,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1525,6 +1525,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
dentry->d_sb = sb;
dentry->d_op = NULL;
dentry->d_fsdata = NULL;
@@ -74528,7 +74644,7 @@ index aa24f7d..8f1bf8c 100644
INIT_HLIST_BL_NODE(&dentry->d_hash);
INIT_LIST_HEAD(&dentry->d_lru);
INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2276,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2279,7 +2282,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
goto next;
}
@@ -74537,7 +74653,7 @@ index aa24f7d..8f1bf8c 100644
found = dentry;
spin_unlock(&dentry->d_lock);
break;
-@@ -2375,7 +2381,7 @@ again:
+@@ -2378,7 +2381,7 @@ again:
spin_lock(&dentry->d_lock);
inode = dentry->d_inode;
isdir = S_ISDIR(inode->i_mode);
@@ -74546,7 +74662,7 @@ index aa24f7d..8f1bf8c 100644
if (!spin_trylock(&inode->i_lock)) {
spin_unlock(&dentry->d_lock);
cpu_relax();
-@@ -3308,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3311,7 +3314,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
dentry->d_flags |= DCACHE_GENOCIDE;
@@ -74555,7 +74671,7 @@ index aa24f7d..8f1bf8c 100644
}
}
return D_WALK_CONTINUE;
-@@ -3424,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3427,7 +3430,8 @@ void __init vfs_caches_init(unsigned long mempages)
mempages -= reserve;
names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -77944,7 +78060,7 @@ index b29e42f..5ea7fdf 100644
#define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
diff --git a/fs/namei.c b/fs/namei.c
-index ccb8000..ac58c5a 100644
+index ccb8000..02d506e 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -331,17 +331,34 @@ int generic_permission(struct inode *inode, int mask)
@@ -78000,6 +78116,15 @@ index ccb8000..ac58c5a 100644
return -EACCES;
}
+@@ -733,7 +742,7 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
+ return 0;
+
+ /* Allowed if parent directory not sticky and world-writable. */
+- parent = nd->path.dentry->d_inode;
++ parent = nd->inode;
+ if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
+ return 0;
+
@@ -821,7 +830,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
{
struct dentry *dentry = link->dentry;
@@ -111608,7 +111733,7 @@ index 9502057..a83c0d4 100644
}
unset_migratetype_isolate(page, MIGRATE_MOVABLE);
diff --git a/mm/memory.c b/mm/memory.c
-index 749e1c6..f7fbc29 100644
+index e9ddc7a..f465481 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -403,6 +403,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -112065,7 +112190,7 @@ index 749e1c6..f7fbc29 100644
* We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked.
* We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -3228,27 +3412,23 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3228,31 +3412,29 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long address, pte_t *page_table, pmd_t *pmd,
unsigned int flags)
{
@@ -112076,6 +112201,13 @@ index 749e1c6..f7fbc29 100644
- pte_unmap(page_table);
-
+ /* File mapping without ->vm_ops ? */
+- if (vma->vm_flags & VM_SHARED)
++ if (vma->vm_flags & VM_SHARED) {
++ pte_unmap(page_table);
+ return VM_FAULT_SIGBUS;
++ }
+
- /* Check if we need to add a guard page to the stack */
- if (check_stack_guard_page(vma, address) < 0)
- return VM_FAULT_SIGSEGV;
@@ -112098,7 +112230,7 @@ index 749e1c6..f7fbc29 100644
if (unlikely(anon_vma_prepare(vma)))
goto oom;
page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -3272,6 +3452,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3276,6 +3458,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (!pte_none(*page_table))
goto release;
@@ -112110,7 +112242,7 @@ index 749e1c6..f7fbc29 100644
inc_mm_counter_fast(mm, MM_ANONPAGES);
page_add_new_anon_rmap(page, vma, address);
setpte:
-@@ -3279,6 +3464,12 @@ setpte:
+@@ -3283,6 +3470,12 @@ setpte:
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -112123,7 +112255,7 @@ index 749e1c6..f7fbc29 100644
unlock:
pte_unmap_unlock(page_table, ptl);
return 0;
-@@ -3423,6 +3614,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3427,6 +3620,12 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
*/
/* Only go through if we didn't race with anybody else... */
if (likely(pte_same(*page_table, orig_pte))) {
@@ -112136,7 +112268,7 @@ index 749e1c6..f7fbc29 100644
flush_icache_page(vma, page);
entry = mk_pte(page, vma->vm_page_prot);
if (flags & FAULT_FLAG_WRITE)
-@@ -3444,6 +3641,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3448,6 +3647,14 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
/* no need to invalidate: a not-present page won't be cached */
update_mmu_cache(vma, address, page_table);
@@ -112151,7 +112283,7 @@ index 749e1c6..f7fbc29 100644
} else {
if (cow_page)
mem_cgroup_uncharge_page(cow_page);
-@@ -3691,6 +3896,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3696,6 +3903,12 @@ static int handle_pte_fault(struct mm_struct *mm,
if (flags & FAULT_FLAG_WRITE)
flush_tlb_fix_spurious_fault(vma, address);
}
@@ -112164,7 +112296,7 @@ index 749e1c6..f7fbc29 100644
unlock:
pte_unmap_unlock(pte, ptl);
return 0;
-@@ -3707,9 +3918,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3712,9 +3925,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
pmd_t *pmd;
pte_t *pte;
@@ -112206,7 +112338,7 @@ index 749e1c6..f7fbc29 100644
pgd = pgd_offset(mm, address);
pud = pud_alloc(mm, pgd, address);
if (!pud)
-@@ -3837,6 +4080,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3842,6 +4087,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -112230,7 +112362,7 @@ index 749e1c6..f7fbc29 100644
#endif /* __PAGETABLE_PUD_FOLDED */
#ifndef __PAGETABLE_PMD_FOLDED
-@@ -3867,6 +4127,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3872,6 +4134,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -112261,7 +112393,7 @@ index 749e1c6..f7fbc29 100644
#endif /* __PAGETABLE_PMD_FOLDED */
#if !defined(__HAVE_ARCH_GATE_AREA)
-@@ -3880,7 +4164,7 @@ static int __init gate_vma_init(void)
+@@ -3885,7 +4171,7 @@ static int __init gate_vma_init(void)
gate_vma.vm_start = FIXADDR_USER_START;
gate_vma.vm_end = FIXADDR_USER_END;
gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -112270,7 +112402,7 @@ index 749e1c6..f7fbc29 100644
return 0;
}
-@@ -4014,8 +4298,8 @@ out:
+@@ -4019,8 +4305,8 @@ out:
return ret;
}
@@ -112281,7 +112413,7 @@ index 749e1c6..f7fbc29 100644
{
resource_size_t phys_addr;
unsigned long prot = 0;
-@@ -4041,8 +4325,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -4046,8 +4332,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
* Access another process' address space as given in mm. If non-NULL, use the
* given task for page fault accounting.
*/
@@ -112292,7 +112424,7 @@ index 749e1c6..f7fbc29 100644
{
struct vm_area_struct *vma;
void *old_buf = buf;
-@@ -4050,7 +4334,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4055,7 +4341,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
down_read(&mm->mmap_sem);
/* ignore errors, just check how much was successfully transferred */
while (len) {
@@ -112301,7 +112433,7 @@ index 749e1c6..f7fbc29 100644
void *maddr;
struct page *page = NULL;
-@@ -4109,8 +4393,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -4114,8 +4400,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
*
* The caller must hold a reference on @mm.
*/
@@ -112312,7 +112444,7 @@ index 749e1c6..f7fbc29 100644
{
return __access_remote_vm(NULL, mm, addr, buf, len, write);
}
-@@ -4120,11 +4404,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -4125,11 +4411,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
* Source/target buffer must be kernel space,
* Do not walk the page table directly, use get_user_pages
*/
@@ -117100,19 +117232,19 @@ index d125290..e86e034 100644
a0 = a[0];
a1 = a[1];
diff --git a/net/core/datagram.c b/net/core/datagram.c
-index a16ed7b..689402b 100644
+index a16ed7b..a334f7d 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -130,6 +130,35 @@ out_noerr:
goto out;
}
-+static int skb_set_peeked(struct sk_buff *skb)
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
+{
+ struct sk_buff *nskb;
+
+ if (skb->peeked)
-+ return 0;
++ return skb;
+
+ /* We have to unshare an skb before modifying it. */
+ if (!skb_shared(skb))
@@ -117120,7 +117252,7 @@ index a16ed7b..689402b 100644
+
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
-+ return -ENOMEM;
++ return ERR_PTR(-ENOMEM);
+
+ skb->prev->next = nskb;
+ skb->next->prev = nskb;
@@ -117133,7 +117265,7 @@ index a16ed7b..689402b 100644
+done:
+ skb->peeked = 1;
+
-+ return 0;
++ return skb;
+}
+
/**
@@ -117158,20 +117290,21 @@ index a16ed7b..689402b 100644
int _off = *off;
last = (struct sk_buff *)queue;
-@@ -198,7 +227,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -198,7 +227,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
_off -= skb->len;
continue;
}
- skb->peeked = 1;
+
-+ error = skb_set_peeked(skb);
-+ if (error)
++ skb = skb_set_peeked(skb);
++ error = PTR_ERR(skb);
++ if (IS_ERR(skb))
+ goto unlock_err;
+
atomic_inc(&skb->users);
} else
__skb_unlink(skb, queue);
-@@ -222,6 +255,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -222,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
return NULL;
@@ -117180,7 +117313,7 @@ index a16ed7b..689402b 100644
no_packet:
*err = error;
return NULL;
-@@ -301,7 +336,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+@@ -301,7 +337,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
}
kfree_skb(skb);
@@ -121788,6 +121921,19 @@ index b7ebe23..b6352f6 100644
}
#endif
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f6..140a44a 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 04ce3b1..48119a6 100644
--- a/net/rds/iw.h
@@ -135209,10 +135355,10 @@ index 0000000..176c32f
+#endif
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
new file mode 100644
-index 0000000..51560ee
+index 0000000..b5dfeff
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,6061 @@
+@@ -0,0 +1,6092 @@
+intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL
+ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
+storvsc_connect_to_vsp_22 storvsc_connect_to_vsp 2 22 NULL
@@ -135517,6 +135663,7 @@ index 0000000..51560ee
+_iwl_dbgfs_d3_sram_write_3315 _iwl_dbgfs_d3_sram_write 3 3315 NULL
+dbDiscardAG_3322 dbDiscardAG 3 3322 NULL
+compat_sys_setsockopt_3326 compat_sys_setsockopt 5 3326 NULL
++ocfs2_extend_xattr_bucket_3328 ocfs2_extend_xattr_bucket 4 3328 NULL
+read_from_oldmem_3337 read_from_oldmem 2 3337 NULL
+sysfs_create_group_3339 sysfs_create_group 0 3339 NULL
+tty_port_register_device_attr_3341 tty_port_register_device_attr 3 3341 NULL
@@ -135611,7 +135758,7 @@ index 0000000..51560ee
+__copy_from_user_inatomic_4365 __copy_from_user_inatomic 0-3 4365 NULL nohasharray
+lookup_string_4365 lookup_string 0 4365 &__copy_from_user_inatomic_4365
+irda_sendmsg_4388 irda_sendmsg 4 4388 NULL
-+access_process_vm_4412 access_process_vm 0 4412 NULL nohasharray
++access_process_vm_4412 access_process_vm 0-2-4 4412 NULL nohasharray
+cxacru_cm_get_array_4412 cxacru_cm_get_array 4 4412 &access_process_vm_4412
+libfc_vport_create_4415 libfc_vport_create 2 4415 NULL
+rtw_android_get_rssi_4421 rtw_android_get_rssi 0 4421 NULL
@@ -135967,6 +136114,7 @@ index 0000000..51560ee
+ocfs2_find_path_8754 ocfs2_find_path 0 8754 NULL
+yurex_write_8761 yurex_write 3 8761 NULL
+joydev_compat_ioctl_8765 joydev_compat_ioctl 2 8765 NULL
++x32_arch_ptrace_8767 x32_arch_ptrace 3 8767 NULL
+kstrtoint_from_user_8778 kstrtoint_from_user 2 8778 NULL
+paging32_prefetch_gpte_8783 paging32_prefetch_gpte 4 8783 NULL
+ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 3-4 8785 NULL
@@ -136209,6 +136357,7 @@ index 0000000..51560ee
+insert_inline_extent_backref_11063 insert_inline_extent_backref 8 11063 NULL
+tcp_send_mss_11079 tcp_send_mss 0 11079 NULL
+count_argc_11083 count_argc 0 11083 NULL
++ocfs2_blocks_per_xattr_bucket_11099 ocfs2_blocks_per_xattr_bucket 0 11099 NULL
+kvm_write_guest_cached_11106 kvm_write_guest_cached 4 11106 NULL
+tw_change_queue_depth_11116 tw_change_queue_depth 2 11116 NULL
+page_offset_11120 page_offset 0 11120 NULL
@@ -136405,6 +136554,7 @@ index 0000000..51560ee
+snd_rme96_playback_copy_13111 snd_rme96_playback_copy 5 13111 NULL
+bfad_debugfs_read_13119 bfad_debugfs_read 3 13119 NULL
+blk_update_request_13146 blk_update_request 3 13146 NULL
++ocfs2_quota_trans_credits_13150 ocfs2_quota_trans_credits 0 13150 NULL
+caif_stream_recvmsg_13173 caif_stream_recvmsg 4 13173 NULL
+pwr_disable_ps_read_13176 pwr_disable_ps_read 3 13176 NULL
+ucs2_strlen_13178 ucs2_strlen 0 13178 NULL
@@ -136774,7 +136924,7 @@ index 0000000..51560ee
+befs_nls2utf_17163 befs_nls2utf 3 17163 NULL
+tx_tx_start_templates_read_17164 tx_tx_start_templates_read 3 17164 NULL
+UniStrnlen_17169 UniStrnlen 0 17169 NULL
-+access_remote_vm_17189 access_remote_vm 0 17189 NULL nohasharray
++access_remote_vm_17189 access_remote_vm 0-2-4 17189 NULL nohasharray
+iwl_dbgfs_txfifo_flush_write_17189 iwl_dbgfs_txfifo_flush_write 3 17189 &access_remote_vm_17189 nohasharray
+ocfs2_flock_handle_signal_17189 ocfs2_flock_handle_signal 0 17189 &iwl_dbgfs_txfifo_flush_write_17189
+iscsit_find_cmd_from_itt_or_dump_17194 iscsit_find_cmd_from_itt_or_dump 3 17194 NULL nohasharray
@@ -136814,6 +136964,7 @@ index 0000000..51560ee
+osst_execute_17607 osst_execute 7-6 17607 NULL
+ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout_17618 ieee80211_if_read_dot11MeshHWMPactivePathToRootTimeout 3 17618 NULL
+dma_map_page_17628 dma_map_page 0 17628 NULL
++ocfs2_rotate_subtree_left_17634 ocfs2_rotate_subtree_left 5 17634 NULL
+twl4030_set_gpio_direction_17645 twl4030_set_gpio_direction 1 17645 NULL
+SYSC_migrate_pages_17657 SYSC_migrate_pages 2 17657 NULL
+packet_setsockopt_17662 packet_setsockopt 5 17662 NULL
@@ -137164,6 +137315,7 @@ index 0000000..51560ee
+bl_add_page_to_bio_21094 bl_add_page_to_bio 2 21094 NULL nohasharray
+multipath_status_21094 multipath_status 5 21094 &bl_add_page_to_bio_21094
+rate_control_pid_events_read_21099 rate_control_pid_events_read 3 21099 NULL
++ocfs2_extend_meta_needed_21104 ocfs2_extend_meta_needed 0 21104 NULL
+ath6kl_send_go_probe_resp_21113 ath6kl_send_go_probe_resp 3 21113 NULL
+_efx_mcdi_rpc_async_21119 _efx_mcdi_rpc_async 4-5 21119 NULL
+i2400m_rx_trace_21127 i2400m_rx_trace 3 21127 NULL
@@ -137183,6 +137335,7 @@ index 0000000..51560ee
+get_zeroed_page_21322 get_zeroed_page 0 21322 NULL
+ftrace_profile_read_21327 ftrace_profile_read 3 21327 NULL
+read_file_bool_bmps_21344 read_file_bool_bmps 3 21344 NULL
++ocfs2_find_subtree_root_21351 ocfs2_find_subtree_root 0 21351 NULL
+gfs2_ea_get_copy_21353 gfs2_ea_get_copy 0 21353 NULL
+alloc_orinocodev_21371 alloc_orinocodev 1 21371 NULL
+SYSC_rt_sigpending_21379 SYSC_rt_sigpending 2 21379 NULL
@@ -137360,6 +137513,7 @@ index 0000000..51560ee
+usblp_write_23178 usblp_write 3 23178 NULL
+gss_pipe_downcall_23182 gss_pipe_downcall 3 23182 NULL
+mpi_alloc_limb_space_23190 mpi_alloc_limb_space 1 23190 NULL
++convert_ip_to_linear_23198 convert_ip_to_linear 0 23198 NULL
+tty_buffer_request_room_23228 tty_buffer_request_room 2-0 23228 NULL
+xlog_get_bp_23229 xlog_get_bp 2 23229 NULL nohasharray
+__read_status_pci_23229 __read_status_pci 0 23229 &xlog_get_bp_23229
@@ -137776,6 +137930,7 @@ index 0000000..51560ee
+sky2_pci_read16_27863 sky2_pci_read16 0 27863 NULL
+ieee80211_if_read_dot11MeshHWMProotInterval_27873 ieee80211_if_read_dot11MeshHWMProotInterval 3 27873 NULL
+unix_seqpacket_sendmsg_27893 unix_seqpacket_sendmsg 4 27893 NULL
++SyS_ptrace_27924 SyS_ptrace 3 27924 NULL
+check_mapped_name_27943 check_mapped_name 3 27943 NULL
+bio_next_split_27961 bio_next_split 2 27961 NULL nohasharray
+tracing_clock_write_27961 tracing_clock_write 3 27961 &bio_next_split_27961
@@ -137996,6 +138151,7 @@ index 0000000..51560ee
+read_4k_modal_eeprom_30212 read_4k_modal_eeprom 3 30212 NULL
+SyS_semop_30227 SyS_semop 3 30227 NULL
+bitmap_file_set_bit_30228 bitmap_file_set_bit 2 30228 NULL
++ocfs2_calc_bg_discontig_credits_30230 ocfs2_calc_bg_discontig_credits 0 30230 NULL
+shmem_unuse_inode_30263 shmem_unuse_inode 0 30263 NULL
+rawv6_recvmsg_30265 rawv6_recvmsg 4 30265 NULL
+try_break_deleg_30271 try_break_deleg 0 30271 NULL nohasharray
@@ -138007,6 +138163,7 @@ index 0000000..51560ee
+osc_contention_seconds_seq_write_30305 osc_contention_seconds_seq_write 3 30305 NULL
+ext4_acl_from_disk_30320 ext4_acl_from_disk 2 30320 NULL
+i8254_read_30330 i8254_read 0 30330 NULL
++generic_ptrace_pokedata_30338 generic_ptrace_pokedata 2 30338 NULL
+resource_from_user_30341 resource_from_user 3 30341 NULL
+o2nm_this_node_30342 o2nm_this_node 0 30342 NULL
+gfs2_trans_begin_30359 gfs2_trans_begin 0 30359 NULL
@@ -138081,6 +138238,7 @@ index 0000000..51560ee
+size_inside_page_31141 size_inside_page 0 31141 NULL
+w9966_v4l_read_31148 w9966_v4l_read 3 31148 NULL
+ch_do_scsi_31171 ch_do_scsi 4 31171 NULL
++crypto_rng_seedsize_31196 crypto_rng_seedsize 0 31196 NULL
+r592_read_fifo_pio_31198 r592_read_fifo_pio 3 31198 NULL
+mtdchar_readoob_31200 mtdchar_readoob 4 31200 NULL
+__btrfs_free_reserved_extent_31207 __btrfs_free_reserved_extent 2 31207 NULL
@@ -138177,6 +138335,7 @@ index 0000000..51560ee
+calc_hmac_32010 calc_hmac 3 32010 NULL
+aead_len_32021 aead_len 0 32021 NULL
+stk_read_32038 stk_read 3 32038 NULL
++ocfs2_update_edge_lengths_32046 ocfs2_update_edge_lengths 3 32046 NULL
+SYSC_llistxattr_32061 SYSC_llistxattr 3 32061 NULL
+proc_scsi_devinfo_write_32064 proc_scsi_devinfo_write 3 32064 NULL
+xfs_buf_iowait_32068 xfs_buf_iowait 0 32068 NULL
@@ -138258,6 +138417,7 @@ index 0000000..51560ee
+zlib_inflate_workspacesize_32927 zlib_inflate_workspacesize 0 32927 NULL
+rmap_recycle_32938 rmap_recycle 3 32938 NULL
+xfs_log_reserve_32959 xfs_log_reserve 0 32959 NULL
++arch_ptrace_32981 arch_ptrace 3 32981 NULL
+compat_filldir_32999 compat_filldir 3 32999 NULL
+SyS_syslog_33007 SyS_syslog 3 33007 NULL
+br_multicast_set_hash_max_33012 br_multicast_set_hash_max 2 33012 NULL
@@ -138389,6 +138549,7 @@ index 0000000..51560ee
+mwifiex_regrdwr_read_34472 mwifiex_regrdwr_read 3 34472 NULL
+skcipher_sndbuf_34476 skcipher_sndbuf 0 34476 NULL
+i2o_parm_field_get_34477 i2o_parm_field_get 5 34477 NULL
++ocfs2_mv_xattr_buckets_34484 ocfs2_mv_xattr_buckets 6 34484 NULL
+security_inode_permission_34488 security_inode_permission 0 34488 NULL
+SyS_pwritev_34494 SyS_pwritev 3 34494 NULL
+qp_alloc_res_34496 qp_alloc_res 5 34496 NULL
@@ -138510,6 +138671,7 @@ index 0000000..51560ee
+SYSC_pwritev_35690 SYSC_pwritev 3 35690 NULL
+rds_page_copy_user_35691 rds_page_copy_user 4 35691 NULL
+md_super_write_35703 md_super_write 4 35703 NULL
++ocfs2_extent_recs_per_gd_35710 ocfs2_extent_recs_per_gd 0 35710 NULL
+iwl_dbgfs_disable_ht40_read_35761 iwl_dbgfs_disable_ht40_read 3 35761 NULL
+udf_alloc_i_data_35786 udf_alloc_i_data 2 35786 NULL
+pvr2_hdw_cpufw_get_35824 pvr2_hdw_cpufw_get 0-4-2 35824 NULL
@@ -138546,6 +138708,7 @@ index 0000000..51560ee
+mtip_hw_read_device_status_36082 mtip_hw_read_device_status 3 36082 NULL
+vga_arb_write_36112 vga_arb_write 3 36112 NULL
+simple_xattr_alloc_36118 simple_xattr_alloc 2 36118 NULL
++compat_ptrace_request_36131 compat_ptrace_request 3 36131 NULL
+ext3_readpages_36144 ext3_readpages 4 36144 NULL
+twl_set_36154 twl_set 2 36154 NULL
+b1_alloc_card_36155 b1_alloc_card 1 36155 NULL
@@ -138663,6 +138826,7 @@ index 0000000..51560ee
+_iwl_dbgfs_fw_restart_write_37270 _iwl_dbgfs_fw_restart_write 3 37270 NULL
+ieee80211_if_read_power_mode_37305 ieee80211_if_read_power_mode 3 37305 NULL
+ext3_direct_IO_37308 ext3_direct_IO 4 37308 NULL
++ocfs2_calc_extend_credits_37310 ocfs2_calc_extend_credits 0 37310 NULL
+jffs2_write_dirent_37311 jffs2_write_dirent 5 37311 NULL
+send_msg_37323 send_msg 4 37323 NULL
+l2cap_create_connless_pdu_37327 l2cap_create_connless_pdu 3 37327 NULL nohasharray
@@ -138791,6 +138955,7 @@ index 0000000..51560ee
+_ipw_read32_38565 _ipw_read32 0 38565 NULL
+snd_nm256_playback_copy_38567 snd_nm256_playback_copy 5-3 38567 NULL
+copy_ctl_value_to_user_38587 copy_ctl_value_to_user 4 38587 NULL
++compat_sys_ptrace_38595 compat_sys_ptrace 3 38595 NULL
+rd_allocate_sgl_table_38607 rd_allocate_sgl_table 3 38607 NULL
+icn_writecmd_38629 icn_writecmd 2 38629 NULL
+write_enabled_file_bool_38630 write_enabled_file_bool 3 38630 NULL
@@ -139011,6 +139176,7 @@ index 0000000..51560ee
+provide_user_output_41105 provide_user_output 3 41105 NULL
+f_audio_buffer_alloc_41110 f_audio_buffer_alloc 1 41110 NULL
+ath10k_read_wmi_services_41112 ath10k_read_wmi_services 3 41112 NULL
++ocfs2_extend_trans_41116 ocfs2_extend_trans 2 41116 NULL
+v4l2_ctrl_new_int_menu_41151 v4l2_ctrl_new_int_menu 4 41151 NULL
+tx_frag_mpdu_alloc_failed_read_41167 tx_frag_mpdu_alloc_failed_read 3 41167 NULL
+dvb_ca_write_41171 dvb_ca_write 3 41171 NULL
@@ -139331,6 +139497,7 @@ index 0000000..51560ee
+sysfs_create_link_44685 sysfs_create_link 0 44685 NULL
+ts_read_44687 ts_read 3 44687 NULL
+lov_emerg_alloc_44698 lov_emerg_alloc 1 44698 NULL
++__ocfs2_rotate_tree_left_44705 __ocfs2_rotate_tree_left 3 44705 NULL
+xfer_to_user_44713 xfer_to_user 3 44713 NULL nohasharray
+__generic_block_fiemap_44713 __generic_block_fiemap 4 44713 &xfer_to_user_44713
+_zd_iowrite32v_locked_44725 _zd_iowrite32v_locked 3 44725 NULL
@@ -139360,7 +139527,7 @@ index 0000000..51560ee
+regmap_spi_read_44921 regmap_spi_read 3-5 44921 NULL
+tx_queue_status_read_44978 tx_queue_status_read 3 44978 NULL
+bytepos_delta_45017 bytepos_delta 0-2 45017 NULL
-+ptrace_writedata_45021 ptrace_writedata 4 45021 NULL
++ptrace_writedata_45021 ptrace_writedata 4-3 45021 NULL
+dm_kvzalloc_45025 dm_kvzalloc 1 45025 NULL
+sysfs_do_create_link_sd_45057 sysfs_do_create_link_sd 0 45057 NULL
+sel_write_user_45060 sel_write_user 3 45060 NULL
@@ -139452,7 +139619,7 @@ index 0000000..51560ee
+sierra_setup_urb_46029 sierra_setup_urb 5 46029 NULL
+fnic_reset_stats_read_46030 fnic_reset_stats_read 3 46030 NULL nohasharray
+get_free_entries_46030 get_free_entries 1 46030 &fnic_reset_stats_read_46030
-+__access_remote_vm_46031 __access_remote_vm 0 46031 NULL
++__access_remote_vm_46031 __access_remote_vm 0-3-5 46031 NULL
+snd_emu10k1x_ptr_read_46049 snd_emu10k1x_ptr_read 0 46049 NULL
+__ocfs2_move_extent_46060 __ocfs2_move_extent 3-4 46060 NULL nohasharray
+dma_tx_errors_read_46060 dma_tx_errors_read 3 46060 &__ocfs2_move_extent_46060
@@ -139578,6 +139745,7 @@ index 0000000..51560ee
+sta_vht_capa_read_47409 sta_vht_capa_read 3 47409 NULL
+crypto_ablkcipher_alignmask_47410 crypto_ablkcipher_alignmask 0 47410 NULL
+lbs_wrrf_write_47418 lbs_wrrf_write 3 47418 NULL
++environ_read_47451 environ_read 3 47451 NULL
+nvme_trans_send_fw_cmd_47479 nvme_trans_send_fw_cmd 4 47479 NULL
+newpart_47485 newpart 6-4 47485 NULL
+core_sys_select_47494 core_sys_select 1 47494 NULL
@@ -139817,6 +139985,7 @@ index 0000000..51560ee
+dn_mss_from_pmtu_50011 dn_mss_from_pmtu 0-2 50011 NULL
+xfs_ialloc_inode_init_50015 xfs_ialloc_inode_init 0 50015 NULL
+security_context_to_sid_50019 security_context_to_sid 2 50019 NULL
++ptrace_readdata_50020 ptrace_readdata 2-4 50020 NULL
+isdn_read_50021 isdn_read 3 50021 NULL
+mdc_rename_pack_50023 mdc_rename_pack 4-6 50023 NULL
+brcmf_debugfs_chipinfo_read_50033 brcmf_debugfs_chipinfo_read 3 50033 NULL
@@ -139951,7 +140120,8 @@ index 0000000..51560ee
+init_map_ipmac_51317 init_map_ipmac 5 51317 NULL
+alloc_hippi_dev_51320 alloc_hippi_dev 1 51320 NULL
+ext2_xattr_get_51327 ext2_xattr_get 0 51327 NULL
-+alloc_smp_req_51337 alloc_smp_req 1 51337 NULL
++alloc_smp_req_51337 alloc_smp_req 1 51337 NULL nohasharray
++compat_arch_ptrace_51337 compat_arch_ptrace 3 51337 &alloc_smp_req_51337
+ipw_get_event_log_len_51341 ipw_get_event_log_len 0 51341 NULL
+ieee80211_if_fmt_estab_plinks_51370 ieee80211_if_fmt_estab_plinks 3 51370 NULL
+radeon_kms_compat_ioctl_51371 radeon_kms_compat_ioctl 2 51371 NULL
@@ -140334,6 +140504,7 @@ index 0000000..51560ee
+memcpy_fromiovec_55247 memcpy_fromiovec 3 55247 NULL
+lbs_failcount_write_55276 lbs_failcount_write 3 55276 NULL
+persistent_ram_new_55286 persistent_ram_new 2-1 55286 NULL
++ptrace_request_55288 ptrace_request 3 55288 NULL
+rx_streaming_interval_read_55291 rx_streaming_interval_read 3 55291 NULL nohasharray
+xd_read_cis_55291 xd_read_cis 4 55291 &rx_streaming_interval_read_55291
+lov_get_stripecnt_55297 lov_get_stripecnt 0-3 55297 NULL
@@ -140590,6 +140761,7 @@ index 0000000..51560ee
+ld2_57794 ld2 0 57794 NULL
+ivtv_read_57796 ivtv_read 3 57796 NULL
+ion_test_ioctl_57799 ion_test_ioctl 2 57799 NULL
++generic_ptrace_peekdata_57806 generic_ptrace_peekdata 2 57806 NULL
+bfad_debugfs_read_regrd_57830 bfad_debugfs_read_regrd 3 57830 NULL
+copy_to_user_57835 copy_to_user 3-0 57835 NULL
+xfs_rtpick_extent_57843 xfs_rtpick_extent 0 57843 NULL nohasharray
@@ -140691,6 +140863,7 @@ index 0000000..51560ee
+ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout_58965 ieee80211_if_fmt_dot11MeshHWMPactivePathToRootTimeout 3 58965 NULL
+crypto_aead_ivsize_58970 crypto_aead_ivsize 0 58970 NULL
+__mem_cgroup_try_charge_58976 __mem_cgroup_try_charge 0 58976 NULL
++bch_extent_to_text_58987 bch_extent_to_text 2 58987 NULL
+init_list_set_59005 init_list_set 3 59005 NULL
+ep_write_59008 ep_write 3 59008 NULL
+lpfc_idiag_baracc_write_59014 lpfc_idiag_baracc_write 3 59014 NULL
@@ -140777,6 +140950,7 @@ index 0000000..51560ee
+pvr2_ioread_set_sync_key_59882 pvr2_ioread_set_sync_key 3 59882 NULL
+l2cap_sock_recvmsg_59886 l2cap_sock_recvmsg 4 59886 NULL
+ffs_prepare_buffer_59892 ffs_prepare_buffer 2 59892 NULL
++ocfs2_extend_rotate_transaction_59894 ocfs2_extend_rotate_transaction 2-3 59894 NULL
+kvm_mmu_notifier_invalidate_range_start_59944 kvm_mmu_notifier_invalidate_range_start 3-4 59944 NULL
+ath10k_read_dfs_stats_59949 ath10k_read_dfs_stats 3 59949 NULL
+dapm_widget_power_read_file_59950 dapm_widget_power_read_file 3 59950 NULL nohasharray
@@ -140997,10 +141171,12 @@ index 0000000..51560ee
+nfsd_read_file_62241 nfsd_read_file 6 62241 NULL
+subtract_dirty_62242 subtract_dirty 2-3 62242 NULL
+ion_handle_test_dma_62262 ion_handle_test_dma 4-5 62262 NULL
++get_random_int_62279 get_random_int 0 62279 NULL
+il_dbgfs_sram_read_62296 il_dbgfs_sram_read 3 62296 NULL
+sparse_early_usemaps_alloc_pgdat_section_62304 sparse_early_usemaps_alloc_pgdat_section 2 62304 NULL
+subsystem_filter_read_62310 subsystem_filter_read 3 62310 NULL
+Wb35Reg_BurstWrite_62327 Wb35Reg_BurstWrite 4 62327 NULL
++ocfs2_xattr_buckets_per_cluster_62330 ocfs2_xattr_buckets_per_cluster 0 62330 NULL
+subseq_list_62332 subseq_list 3-0 62332 NULL
+ll_statahead_max_seq_write_62333 ll_statahead_max_seq_write 3 62333 NULL
+flash_write_62354 flash_write 3 62354 NULL
@@ -141145,6 +141321,7 @@ index 0000000..51560ee
+bypass_wd_write_64120 bypass_wd_write 3 64120 NULL
+ext4_prepare_inline_data_64124 ext4_prepare_inline_data 3 64124 NULL
+init_bch_64130 init_bch 1-2 64130 NULL
++SYSC_ptrace_64136 SYSC_ptrace 3 64136 NULL
+ablkcipher_copy_iv_64140 ablkcipher_copy_iv 3 64140 NULL
+dlfb_ops_write_64150 dlfb_ops_write 3 64150 NULL
+cpumask_scnprintf_64170 cpumask_scnprintf 0-2 64170 NULL
@@ -141374,7 +141551,7 @@ index 0000000..560cd7b
+zpios_read_64734 zpios_read 3 64734 NULL
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
new file mode 100644
-index 0000000..7e07890
+index 0000000..2133228
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_plugin.c
@@ -0,0 +1,260 @@
@@ -141411,7 +141588,7 @@ index 0000000..7e07890
+tree size_overflow_type_TI;
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20140725_01",
++ .version = "20140725_02",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+
diff --git a/4.1.4/4425_grsec_remove_EI_PAX.patch b/3.14.50/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 4.1.4/4425_grsec_remove_EI_PAX.patch
rename to 3.14.50/4425_grsec_remove_EI_PAX.patch
diff --git a/3.14.49/4427_force_XATTR_PAX_tmpfs.patch b/3.14.50/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.14.49/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.14.50/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.1.4/4430_grsec-remove-localversion-grsec.patch b/3.14.50/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 4.1.4/4430_grsec-remove-localversion-grsec.patch
rename to 3.14.50/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.14.49/4435_grsec-mute-warnings.patch b/3.14.50/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.14.49/4435_grsec-mute-warnings.patch
rename to 3.14.50/4435_grsec-mute-warnings.patch
diff --git a/4.1.4/4440_grsec-remove-protected-paths.patch b/3.14.50/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 4.1.4/4440_grsec-remove-protected-paths.patch
rename to 3.14.50/4440_grsec-remove-protected-paths.patch
diff --git a/3.14.49/4450_grsec-kconfig-default-gids.patch b/3.14.50/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.14.49/4450_grsec-kconfig-default-gids.patch
rename to 3.14.50/4450_grsec-kconfig-default-gids.patch
diff --git a/3.14.49/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.14.49/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.14.50/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.14.49/4470_disable-compat_vdso.patch b/3.14.50/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.14.49/4470_disable-compat_vdso.patch
rename to 3.14.50/4470_disable-compat_vdso.patch
diff --git a/4.1.4/4475_emutramp_default_on.patch b/3.14.50/4475_emutramp_default_on.patch
similarity index 100%
rename from 4.1.4/4475_emutramp_default_on.patch
rename to 3.14.50/4475_emutramp_default_on.patch
diff --git a/3.2.69/0000_README b/3.2.70/0000_README
similarity index 97%
rename from 3.2.69/0000_README
rename to 3.2.70/0000_README
index 96cd54d..52d8c39 100644
--- a/3.2.69/0000_README
+++ b/3.2.70/0000_README
@@ -194,7 +194,11 @@ Patch: 1068_linux-3.2.69.patch
From: http://www.kernel.org
Desc: Linux 3.2.69
-Patch: 4420_grsecurity-3.1-3.2.69-201508020900.patch
+Patch: 1069_linux-3.2.70.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.70
+
+Patch: 4420_grsecurity-3.1-3.2.70-201508102127.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.69/1021_linux-3.2.22.patch b/3.2.70/1021_linux-3.2.22.patch
similarity index 100%
rename from 3.2.69/1021_linux-3.2.22.patch
rename to 3.2.70/1021_linux-3.2.22.patch
diff --git a/3.2.69/1022_linux-3.2.23.patch b/3.2.70/1022_linux-3.2.23.patch
similarity index 100%
rename from 3.2.69/1022_linux-3.2.23.patch
rename to 3.2.70/1022_linux-3.2.23.patch
diff --git a/3.2.69/1023_linux-3.2.24.patch b/3.2.70/1023_linux-3.2.24.patch
similarity index 100%
rename from 3.2.69/1023_linux-3.2.24.patch
rename to 3.2.70/1023_linux-3.2.24.patch
diff --git a/3.2.69/1024_linux-3.2.25.patch b/3.2.70/1024_linux-3.2.25.patch
similarity index 100%
rename from 3.2.69/1024_linux-3.2.25.patch
rename to 3.2.70/1024_linux-3.2.25.patch
diff --git a/3.2.69/1025_linux-3.2.26.patch b/3.2.70/1025_linux-3.2.26.patch
similarity index 100%
rename from 3.2.69/1025_linux-3.2.26.patch
rename to 3.2.70/1025_linux-3.2.26.patch
diff --git a/3.2.69/1026_linux-3.2.27.patch b/3.2.70/1026_linux-3.2.27.patch
similarity index 100%
rename from 3.2.69/1026_linux-3.2.27.patch
rename to 3.2.70/1026_linux-3.2.27.patch
diff --git a/3.2.69/1027_linux-3.2.28.patch b/3.2.70/1027_linux-3.2.28.patch
similarity index 100%
rename from 3.2.69/1027_linux-3.2.28.patch
rename to 3.2.70/1027_linux-3.2.28.patch
diff --git a/3.2.69/1028_linux-3.2.29.patch b/3.2.70/1028_linux-3.2.29.patch
similarity index 100%
rename from 3.2.69/1028_linux-3.2.29.patch
rename to 3.2.70/1028_linux-3.2.29.patch
diff --git a/3.2.69/1029_linux-3.2.30.patch b/3.2.70/1029_linux-3.2.30.patch
similarity index 100%
rename from 3.2.69/1029_linux-3.2.30.patch
rename to 3.2.70/1029_linux-3.2.30.patch
diff --git a/3.2.69/1030_linux-3.2.31.patch b/3.2.70/1030_linux-3.2.31.patch
similarity index 100%
rename from 3.2.69/1030_linux-3.2.31.patch
rename to 3.2.70/1030_linux-3.2.31.patch
diff --git a/3.2.69/1031_linux-3.2.32.patch b/3.2.70/1031_linux-3.2.32.patch
similarity index 100%
rename from 3.2.69/1031_linux-3.2.32.patch
rename to 3.2.70/1031_linux-3.2.32.patch
diff --git a/3.2.69/1032_linux-3.2.33.patch b/3.2.70/1032_linux-3.2.33.patch
similarity index 100%
rename from 3.2.69/1032_linux-3.2.33.patch
rename to 3.2.70/1032_linux-3.2.33.patch
diff --git a/3.2.69/1033_linux-3.2.34.patch b/3.2.70/1033_linux-3.2.34.patch
similarity index 100%
rename from 3.2.69/1033_linux-3.2.34.patch
rename to 3.2.70/1033_linux-3.2.34.patch
diff --git a/3.2.69/1034_linux-3.2.35.patch b/3.2.70/1034_linux-3.2.35.patch
similarity index 100%
rename from 3.2.69/1034_linux-3.2.35.patch
rename to 3.2.70/1034_linux-3.2.35.patch
diff --git a/3.2.69/1035_linux-3.2.36.patch b/3.2.70/1035_linux-3.2.36.patch
similarity index 100%
rename from 3.2.69/1035_linux-3.2.36.patch
rename to 3.2.70/1035_linux-3.2.36.patch
diff --git a/3.2.69/1036_linux-3.2.37.patch b/3.2.70/1036_linux-3.2.37.patch
similarity index 100%
rename from 3.2.69/1036_linux-3.2.37.patch
rename to 3.2.70/1036_linux-3.2.37.patch
diff --git a/3.2.69/1037_linux-3.2.38.patch b/3.2.70/1037_linux-3.2.38.patch
similarity index 100%
rename from 3.2.69/1037_linux-3.2.38.patch
rename to 3.2.70/1037_linux-3.2.38.patch
diff --git a/3.2.69/1038_linux-3.2.39.patch b/3.2.70/1038_linux-3.2.39.patch
similarity index 100%
rename from 3.2.69/1038_linux-3.2.39.patch
rename to 3.2.70/1038_linux-3.2.39.patch
diff --git a/3.2.69/1039_linux-3.2.40.patch b/3.2.70/1039_linux-3.2.40.patch
similarity index 100%
rename from 3.2.69/1039_linux-3.2.40.patch
rename to 3.2.70/1039_linux-3.2.40.patch
diff --git a/3.2.69/1040_linux-3.2.41.patch b/3.2.70/1040_linux-3.2.41.patch
similarity index 100%
rename from 3.2.69/1040_linux-3.2.41.patch
rename to 3.2.70/1040_linux-3.2.41.patch
diff --git a/3.2.69/1041_linux-3.2.42.patch b/3.2.70/1041_linux-3.2.42.patch
similarity index 100%
rename from 3.2.69/1041_linux-3.2.42.patch
rename to 3.2.70/1041_linux-3.2.42.patch
diff --git a/3.2.69/1042_linux-3.2.43.patch b/3.2.70/1042_linux-3.2.43.patch
similarity index 100%
rename from 3.2.69/1042_linux-3.2.43.patch
rename to 3.2.70/1042_linux-3.2.43.patch
diff --git a/3.2.69/1043_linux-3.2.44.patch b/3.2.70/1043_linux-3.2.44.patch
similarity index 100%
rename from 3.2.69/1043_linux-3.2.44.patch
rename to 3.2.70/1043_linux-3.2.44.patch
diff --git a/3.2.69/1044_linux-3.2.45.patch b/3.2.70/1044_linux-3.2.45.patch
similarity index 100%
rename from 3.2.69/1044_linux-3.2.45.patch
rename to 3.2.70/1044_linux-3.2.45.patch
diff --git a/3.2.69/1045_linux-3.2.46.patch b/3.2.70/1045_linux-3.2.46.patch
similarity index 100%
rename from 3.2.69/1045_linux-3.2.46.patch
rename to 3.2.70/1045_linux-3.2.46.patch
diff --git a/3.2.69/1046_linux-3.2.47.patch b/3.2.70/1046_linux-3.2.47.patch
similarity index 100%
rename from 3.2.69/1046_linux-3.2.47.patch
rename to 3.2.70/1046_linux-3.2.47.patch
diff --git a/3.2.69/1047_linux-3.2.48.patch b/3.2.70/1047_linux-3.2.48.patch
similarity index 100%
rename from 3.2.69/1047_linux-3.2.48.patch
rename to 3.2.70/1047_linux-3.2.48.patch
diff --git a/3.2.69/1048_linux-3.2.49.patch b/3.2.70/1048_linux-3.2.49.patch
similarity index 100%
rename from 3.2.69/1048_linux-3.2.49.patch
rename to 3.2.70/1048_linux-3.2.49.patch
diff --git a/3.2.69/1049_linux-3.2.50.patch b/3.2.70/1049_linux-3.2.50.patch
similarity index 100%
rename from 3.2.69/1049_linux-3.2.50.patch
rename to 3.2.70/1049_linux-3.2.50.patch
diff --git a/3.2.69/1050_linux-3.2.51.patch b/3.2.70/1050_linux-3.2.51.patch
similarity index 100%
rename from 3.2.69/1050_linux-3.2.51.patch
rename to 3.2.70/1050_linux-3.2.51.patch
diff --git a/3.2.69/1051_linux-3.2.52.patch b/3.2.70/1051_linux-3.2.52.patch
similarity index 100%
rename from 3.2.69/1051_linux-3.2.52.patch
rename to 3.2.70/1051_linux-3.2.52.patch
diff --git a/3.2.69/1052_linux-3.2.53.patch b/3.2.70/1052_linux-3.2.53.patch
similarity index 100%
rename from 3.2.69/1052_linux-3.2.53.patch
rename to 3.2.70/1052_linux-3.2.53.patch
diff --git a/3.2.69/1053_linux-3.2.54.patch b/3.2.70/1053_linux-3.2.54.patch
similarity index 100%
rename from 3.2.69/1053_linux-3.2.54.patch
rename to 3.2.70/1053_linux-3.2.54.patch
diff --git a/3.2.69/1054_linux-3.2.55.patch b/3.2.70/1054_linux-3.2.55.patch
similarity index 100%
rename from 3.2.69/1054_linux-3.2.55.patch
rename to 3.2.70/1054_linux-3.2.55.patch
diff --git a/3.2.69/1055_linux-3.2.56.patch b/3.2.70/1055_linux-3.2.56.patch
similarity index 100%
rename from 3.2.69/1055_linux-3.2.56.patch
rename to 3.2.70/1055_linux-3.2.56.patch
diff --git a/3.2.69/1056_linux-3.2.57.patch b/3.2.70/1056_linux-3.2.57.patch
similarity index 100%
rename from 3.2.69/1056_linux-3.2.57.patch
rename to 3.2.70/1056_linux-3.2.57.patch
diff --git a/3.2.69/1057_linux-3.2.58.patch b/3.2.70/1057_linux-3.2.58.patch
similarity index 100%
rename from 3.2.69/1057_linux-3.2.58.patch
rename to 3.2.70/1057_linux-3.2.58.patch
diff --git a/3.2.69/1058_linux-3.2.59.patch b/3.2.70/1058_linux-3.2.59.patch
similarity index 100%
rename from 3.2.69/1058_linux-3.2.59.patch
rename to 3.2.70/1058_linux-3.2.59.patch
diff --git a/3.2.69/1059_linux-3.2.60.patch b/3.2.70/1059_linux-3.2.60.patch
similarity index 100%
rename from 3.2.69/1059_linux-3.2.60.patch
rename to 3.2.70/1059_linux-3.2.60.patch
diff --git a/3.2.69/1060_linux-3.2.61.patch b/3.2.70/1060_linux-3.2.61.patch
similarity index 100%
rename from 3.2.69/1060_linux-3.2.61.patch
rename to 3.2.70/1060_linux-3.2.61.patch
diff --git a/3.2.69/1061_linux-3.2.62.patch b/3.2.70/1061_linux-3.2.62.patch
similarity index 100%
rename from 3.2.69/1061_linux-3.2.62.patch
rename to 3.2.70/1061_linux-3.2.62.patch
diff --git a/3.2.69/1062_linux-3.2.63.patch b/3.2.70/1062_linux-3.2.63.patch
similarity index 100%
rename from 3.2.69/1062_linux-3.2.63.patch
rename to 3.2.70/1062_linux-3.2.63.patch
diff --git a/3.2.69/1063_linux-3.2.64.patch b/3.2.70/1063_linux-3.2.64.patch
similarity index 100%
rename from 3.2.69/1063_linux-3.2.64.patch
rename to 3.2.70/1063_linux-3.2.64.patch
diff --git a/3.2.69/1064_linux-3.2.65.patch b/3.2.70/1064_linux-3.2.65.patch
similarity index 100%
rename from 3.2.69/1064_linux-3.2.65.patch
rename to 3.2.70/1064_linux-3.2.65.patch
diff --git a/3.2.69/1065_linux-3.2.66.patch b/3.2.70/1065_linux-3.2.66.patch
similarity index 100%
rename from 3.2.69/1065_linux-3.2.66.patch
rename to 3.2.70/1065_linux-3.2.66.patch
diff --git a/3.2.69/1066_linux-3.2.67.patch b/3.2.70/1066_linux-3.2.67.patch
similarity index 100%
rename from 3.2.69/1066_linux-3.2.67.patch
rename to 3.2.70/1066_linux-3.2.67.patch
diff --git a/3.2.69/1067_linux-3.2.68.patch b/3.2.70/1067_linux-3.2.68.patch
similarity index 100%
rename from 3.2.69/1067_linux-3.2.68.patch
rename to 3.2.70/1067_linux-3.2.68.patch
diff --git a/3.2.69/1068_linux-3.2.69.patch b/3.2.70/1068_linux-3.2.69.patch
similarity index 100%
rename from 3.2.69/1068_linux-3.2.69.patch
rename to 3.2.70/1068_linux-3.2.69.patch
diff --git a/3.2.70/1069_linux-3.2.70.patch b/3.2.70/1069_linux-3.2.70.patch
new file mode 100644
index 0000000..b694627
--- /dev/null
+++ b/3.2.70/1069_linux-3.2.70.patch
@@ -0,0 +1,5879 @@
+diff --git a/Documentation/networking/rds.txt b/Documentation/networking/rds.txt
+index c67077c..e1a3d59 100644
+--- a/Documentation/networking/rds.txt
++++ b/Documentation/networking/rds.txt
+@@ -62,11 +62,10 @@ Socket Interface
+ ================
+
+ AF_RDS, PF_RDS, SOL_RDS
+- These constants haven't been assigned yet, because RDS isn't in
+- mainline yet. Currently, the kernel module assigns some constant
+- and publishes it to user space through two sysctl files
+- /proc/sys/net/rds/pf_rds
+- /proc/sys/net/rds/sol_rds
++ AF_RDS and PF_RDS are the domain type to be used with socket(2)
++ to create RDS sockets. SOL_RDS is the socket-level to be used
++ with setsockopt(2) and getsockopt(2) for RDS specific socket
++ options.
+
+ fd = socket(PF_RDS, SOCK_SEQPACKET, 0);
+ This creates a new, unbound RDS socket.
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index b04cb7d..074da62 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -164,8 +164,8 @@ static const char *foo_get_group_name(struct pinctrl_dev *pctldev,
+ }
+
+ static int foo_get_group_pins(struct pinctrl_dev *pctldev, unsigned selector,
+- unsigned ** const pins,
+- unsigned * const num_pins)
++ const unsigned **pins,
++ unsigned *num_pins)
+ {
+ *pins = (unsigned *) foo_groups[selector].pins;
+ *num_pins = foo_groups[selector].num_pins;
+diff --git a/Makefile b/Makefile
+index 8071888..41a626b 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
+index 0e9ce8d..a4b1186 100644
+--- a/arch/arm/include/asm/elf.h
++++ b/arch/arm/include/asm/elf.h
+@@ -116,7 +116,7 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
+ the loader. We need to make sure that it is out of the way of the program
+ that it will "exec", and that there is sufficient room for the brk. */
+
+-#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
++#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+
+ /* When the program starts, a1 contains a pointer to a function to be
+ registered with atexit, as per the SVR4 ABI. A value of 0 means we
+diff --git a/arch/mips/include/asm/cacheflush.h b/arch/mips/include/asm/cacheflush.h
+index 69468de..484c5bc 100644
+--- a/arch/mips/include/asm/cacheflush.h
++++ b/arch/mips/include/asm/cacheflush.h
+@@ -29,6 +29,20 @@
+ * - flush_icache_all() flush the entire instruction cache
+ * - flush_data_cache_page() flushes a page from the data cache
+ */
++
++ /*
++ * This flag is used to indicate that the page pointed to by a pte
++ * is dirty and requires cleaning before returning it to the user.
++ */
++#define PG_dcache_dirty PG_arch_1
++
++#define Page_dcache_dirty(page) \
++ test_bit(PG_dcache_dirty, &(page)->flags)
++#define SetPageDcacheDirty(page) \
++ set_bit(PG_dcache_dirty, &(page)->flags)
++#define ClearPageDcacheDirty(page) \
++ clear_bit(PG_dcache_dirty, &(page)->flags)
++
+ extern void (*flush_cache_all)(void);
+ extern void (*__flush_cache_all)(void);
+ extern void (*flush_cache_mm)(struct mm_struct *mm);
+@@ -37,13 +51,15 @@ extern void (*flush_cache_range)(struct vm_area_struct *vma,
+ unsigned long start, unsigned long end);
+ extern void (*flush_cache_page)(struct vm_area_struct *vma, unsigned long page, unsigned long pfn);
+ extern void __flush_dcache_page(struct page *page);
++extern void __flush_icache_page(struct vm_area_struct *vma, struct page *page);
+
+ #define ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE 1
+ static inline void flush_dcache_page(struct page *page)
+ {
+- if (cpu_has_dc_aliases || !cpu_has_ic_fills_f_dc)
++ if (cpu_has_dc_aliases)
+ __flush_dcache_page(page);
+-
++ else if (!cpu_has_ic_fills_f_dc)
++ SetPageDcacheDirty(page);
+ }
+
+ #define flush_dcache_mmap_lock(mapping) do { } while (0)
+@@ -61,6 +77,11 @@ static inline void flush_anon_page(struct vm_area_struct *vma,
+ static inline void flush_icache_page(struct vm_area_struct *vma,
+ struct page *page)
+ {
++ if (!cpu_has_ic_fills_f_dc && (vma->vm_flags & VM_EXEC) &&
++ Page_dcache_dirty(page)) {
++ __flush_icache_page(vma, page);
++ ClearPageDcacheDirty(page);
++ }
+ }
+
+ extern void (*flush_icache_range)(unsigned long start, unsigned long end);
+@@ -95,19 +116,6 @@ extern void (*flush_icache_all)(void);
+ extern void (*local_flush_data_cache_page)(void * addr);
+ extern void (*flush_data_cache_page)(unsigned long addr);
+
+-/*
+- * This flag is used to indicate that the page pointed to by a pte
+- * is dirty and requires cleaning before returning it to the user.
+- */
+-#define PG_dcache_dirty PG_arch_1
+-
+-#define Page_dcache_dirty(page) \
+- test_bit(PG_dcache_dirty, &(page)->flags)
+-#define SetPageDcacheDirty(page) \
+- set_bit(PG_dcache_dirty, &(page)->flags)
+-#define ClearPageDcacheDirty(page) \
+- clear_bit(PG_dcache_dirty, &(page)->flags)
+-
+ /* Run kernel code uncached, useful for cache probing functions. */
+ unsigned long run_uncached(void *func);
+
+diff --git a/arch/mips/include/asm/cpu-features.h b/arch/mips/include/asm/cpu-features.h
+index ca400f7..0f4991b 100644
+--- a/arch/mips/include/asm/cpu-features.h
++++ b/arch/mips/include/asm/cpu-features.h
+@@ -153,8 +153,32 @@
+ #define cpu_has_mips_r (cpu_has_mips32r1 | cpu_has_mips32r2 | \
+ cpu_has_mips64r1 | cpu_has_mips64r2)
+
++/*
++ * cpu_has_mips_r2_exec_hazard - return if IHB is required on current processor
++ *
++ * Returns non-zero value if the current processor implementation requires
++ * an IHB instruction to deal with an instruction hazard as per MIPS R2
++ * architecture specification, zero otherwise.
++ */
+ #ifndef cpu_has_mips_r2_exec_hazard
+-#define cpu_has_mips_r2_exec_hazard cpu_has_mips_r2
++#define cpu_has_mips_r2_exec_hazard \
++({ \
++ int __res; \
++ \
++ switch (current_cpu_type()) { \
++ case CPU_74K: \
++ case CPU_CAVIUM_OCTEON: \
++ case CPU_CAVIUM_OCTEON_PLUS: \
++ case CPU_CAVIUM_OCTEON2: \
++ __res = 0; \
++ break; \
++ \
++ default: \
++ __res = 1; \
++ } \
++ \
++ __res; \
++})
+ #endif
+
+ /*
+diff --git a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+index a58addb..6ae8e3c 100644
+--- a/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
++++ b/arch/mips/include/asm/mach-cavium-octeon/cpu-feature-overrides.h
+@@ -51,7 +51,6 @@
+ #define cpu_has_mips32r2 0
+ #define cpu_has_mips64r1 0
+ #define cpu_has_mips64r2 1
+-#define cpu_has_mips_r2_exec_hazard 0
+ #define cpu_has_dsp 0
+ #define cpu_has_mipsmt 0
+ #define cpu_has_vint 0
+diff --git a/arch/mips/include/asm/octeon/pci-octeon.h b/arch/mips/include/asm/octeon/pci-octeon.h
+index fba2ba2..ac83283 100644
+--- a/arch/mips/include/asm/octeon/pci-octeon.h
++++ b/arch/mips/include/asm/octeon/pci-octeon.h
+@@ -11,9 +11,6 @@
+
+ #include <linux/pci.h>
+
+-/* Some PCI cards require delays when accessing config space. */
+-#define PCI_CONFIG_SPACE_DELAY 10000
+-
+ /*
+ * The physical memory base mapped by BAR1. 256MB at the end of the
+ * first 4GB.
+diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
+index 7f50318..6e489e5 100644
+--- a/arch/mips/kernel/irq.c
++++ b/arch/mips/kernel/irq.c
+@@ -111,7 +111,7 @@ void __init init_IRQ(void)
+ #endif
+ }
+
+-#ifdef DEBUG_STACKOVERFLOW
++#ifdef CONFIG_DEBUG_STACKOVERFLOW
+ static inline void check_stack_overflow(void)
+ {
+ unsigned long sp;
+diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
+index 829320c..0f8839b 100644
+--- a/arch/mips/mm/cache.c
++++ b/arch/mips/mm/cache.c
+@@ -118,6 +118,18 @@ void __flush_anon_page(struct page *page, unsigned long vmaddr)
+
+ EXPORT_SYMBOL(__flush_anon_page);
+
++void __flush_icache_page(struct vm_area_struct *vma, struct page *page)
++{
++ unsigned long addr;
++
++ if (PageHighMem(page))
++ return;
++
++ addr = (unsigned long) page_address(page);
++ flush_data_cache_page(addr);
++}
++EXPORT_SYMBOL_GPL(__flush_icache_page);
++
+ void __update_cache(struct vm_area_struct *vma, unsigned long address,
+ pte_t pte)
+ {
+diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
+index ed1c542..66d3c38 100644
+--- a/arch/mips/pci/pci-octeon.c
++++ b/arch/mips/pci/pci-octeon.c
+@@ -279,9 +279,6 @@ static int octeon_read_config(struct pci_bus *bus, unsigned int devfn,
+ pci_addr.s.func = devfn & 0x7;
+ pci_addr.s.reg = reg;
+
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ switch (size) {
+ case 4:
+ *val = le32_to_cpu(cvmx_read64_uint32(pci_addr.u64));
+@@ -316,9 +313,6 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+ pci_addr.s.func = devfn & 0x7;
+ pci_addr.s.reg = reg;
+
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ switch (size) {
+ case 4:
+ cvmx_write64_uint32(pci_addr.u64, cpu_to_le32(val));
+diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
+index 0583c463..37a8790 100644
+--- a/arch/mips/pci/pcie-octeon.c
++++ b/arch/mips/pci/pcie-octeon.c
+@@ -1219,9 +1219,6 @@ static inline int octeon_pcie_write_config(int pcie_port, struct pci_bus *bus,
+ devfn & 0x7, reg, val);
+ return PCIBIOS_SUCCESSFUL;
+ }
+-#if PCI_CONFIG_SPACE_DELAY
+- udelay(PCI_CONFIG_SPACE_DELAY);
+-#endif
+ return PCIBIOS_FUNC_NOT_SUPPORTED;
+ }
+
+diff --git a/arch/mips/power/hibernate.S b/arch/mips/power/hibernate.S
+index 5bf34ec..2ca1735 100644
+--- a/arch/mips/power/hibernate.S
++++ b/arch/mips/power/hibernate.S
+@@ -31,6 +31,8 @@ LEAF(swsusp_arch_suspend)
+ END(swsusp_arch_suspend)
+
+ LEAF(swsusp_arch_resume)
++ /* Avoid TLB mismatch during and after kernel resume */
++ jal local_flush_tlb_all
+ PTR_L t0, restore_pblist
+ 0:
+ PTR_L t1, PBE_ADDRESS(t0) /* source */
+@@ -44,7 +46,6 @@ LEAF(swsusp_arch_resume)
+ bne t1, t3, 1b
+ PTR_L t0, PBE_NEXT(t0)
+ bnez t0, 0b
+- jal local_flush_tlb_all /* Avoid TLB mismatch after kernel resume */
+ PTR_LA t0, saved_regs
+ PTR_L ra, PT_R31(t0)
+ PTR_L sp, PT_R29(t0)
+diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
+index a7bb757..c3f1be95 100644
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -121,11 +121,13 @@ extern void __ashrdi3(void);
+ extern void __ashldi3(void);
+ extern void __lshrdi3(void);
+ extern void __muldi3(void);
++extern void __ucmpdi2(void);
+
+ EXPORT_SYMBOL(__ashrdi3);
+ EXPORT_SYMBOL(__ashldi3);
+ EXPORT_SYMBOL(__lshrdi3);
+ EXPORT_SYMBOL(__muldi3);
++EXPORT_SYMBOL(__ucmpdi2);
+
+ asmlinkage void * __canonicalize_funcptr_for_compare(void *);
+ EXPORT_SYMBOL(__canonicalize_funcptr_for_compare);
+diff --git a/arch/parisc/lib/Makefile b/arch/parisc/lib/Makefile
+index 5f2e690..5651536 100644
+--- a/arch/parisc/lib/Makefile
++++ b/arch/parisc/lib/Makefile
+@@ -2,6 +2,7 @@
+ # Makefile for parisc-specific library files
+ #
+
+-lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o
++lib-y := lusercopy.o bitops.o checksum.o io.o memset.o fixup.o memcpy.o \
++ ucmpdi2.o
+
+ obj-y := iomap.o
+diff --git a/arch/parisc/lib/ucmpdi2.c b/arch/parisc/lib/ucmpdi2.c
+new file mode 100644
+index 0000000..149c016
+--- /dev/null
++++ b/arch/parisc/lib/ucmpdi2.c
+@@ -0,0 +1,25 @@
++#include <linux/module.h>
++
++union ull_union {
++ unsigned long long ull;
++ struct {
++ unsigned int high;
++ unsigned int low;
++ } ui;
++};
++
++int __ucmpdi2(unsigned long long a, unsigned long long b)
++{
++ union ull_union au = {.ull = a};
++ union ull_union bu = {.ull = b};
++
++ if (au.ui.high < bu.ui.high)
++ return 0;
++ else if (au.ui.high > bu.ui.high)
++ return 2;
++ if (au.ui.low < bu.ui.low)
++ return 0;
++ else if (au.ui.low > bu.ui.low)
++ return 2;
++ return 1;
++}
+diff --git a/arch/powerpc/kernel/cacheinfo.c b/arch/powerpc/kernel/cacheinfo.c
+index 02ebe1a..4f15565 100644
+--- a/arch/powerpc/kernel/cacheinfo.c
++++ b/arch/powerpc/kernel/cacheinfo.c
+@@ -62,12 +62,22 @@ struct cache_type_info {
+ };
+
+ /* These are used to index the cache_type_info array. */
+-#define CACHE_TYPE_UNIFIED 0
+-#define CACHE_TYPE_INSTRUCTION 1
+-#define CACHE_TYPE_DATA 2
++#define CACHE_TYPE_UNIFIED 0 /* cache-size, cache-block-size, etc. */
++#define CACHE_TYPE_UNIFIED_D 1 /* d-cache-size, d-cache-block-size, etc */
++#define CACHE_TYPE_INSTRUCTION 2
++#define CACHE_TYPE_DATA 3
+
+ static const struct cache_type_info cache_type_info[] = {
+ {
++ /* Embedded systems that use cache-size, cache-block-size,
++ * etc. for the Unified (typically L2) cache. */
++ .name = "Unified",
++ .size_prop = "cache-size",
++ .line_size_props = { "cache-line-size",
++ "cache-block-size", },
++ .nr_sets_prop = "cache-sets",
++ },
++ {
+ /* PowerPC Processor binding says the [di]-cache-*
+ * must be equal on unified caches, so just use
+ * d-cache properties. */
+@@ -293,7 +303,8 @@ static struct cache *cache_find_first_sibling(struct cache *cache)
+ {
+ struct cache *iter;
+
+- if (cache->type == CACHE_TYPE_UNIFIED)
++ if (cache->type == CACHE_TYPE_UNIFIED ||
++ cache->type == CACHE_TYPE_UNIFIED_D)
+ return cache;
+
+ list_for_each_entry(iter, &cache_list, list)
+@@ -324,15 +335,29 @@ static bool cache_node_is_unified(const struct device_node *np)
+ return of_get_property(np, "cache-unified", NULL);
+ }
+
+-static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++/*
++ * Unified caches can have two different sets of tags. Most embedded
++ * use cache-size, etc. for the unified cache size, but open firmware systems
++ * use d-cache-size, etc. Check on initialization for which type we have, and
++ * return the appropriate structure type. Assume it's embedded if it isn't
++ * open firmware. If it's yet a 3rd type, then there will be missing entries
++ * in /sys/devices/system/cpu/cpu0/cache/index2/, and this code will need
++ * to be extended further.
++ */
++static int cache_is_unified_d(const struct device_node *np)
+ {
+- struct cache *cache;
++ return of_get_property(np,
++ cache_type_info[CACHE_TYPE_UNIFIED_D].size_prop, NULL) ?
++ CACHE_TYPE_UNIFIED_D : CACHE_TYPE_UNIFIED;
++}
+
++/*
++ */
++static struct cache *__cpuinit cache_do_one_devnode_unified(struct device_node *node, int level)
++{
+ pr_debug("creating L%d ucache for %s\n", level, node->full_name);
+
+- cache = new_cache(CACHE_TYPE_UNIFIED, level, node);
+-
+- return cache;
++ return new_cache(cache_is_unified_d(node), level, node);
+ }
+
+ static struct cache *__cpuinit cache_do_one_devnode_split(struct device_node *node, int level)
+diff --git a/arch/powerpc/kernel/perf_callchain.c b/arch/powerpc/kernel/perf_callchain.c
+index 564c1d8..e80026c 100644
+--- a/arch/powerpc/kernel/perf_callchain.c
++++ b/arch/powerpc/kernel/perf_callchain.c
+@@ -243,7 +243,7 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry,
+ sp = regs->gpr[1];
+ perf_callchain_store(entry, next_ip);
+
+- for (;;) {
++ while (entry->nr < PERF_MAX_STACK_DEPTH) {
+ fp = (unsigned long __user *) sp;
+ if (!valid_user_sp(sp, 1) || read_user_stack_64(fp, &next_sp))
+ return;
+diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c
+index 82288e9..83940d7 100644
+--- a/arch/powerpc/kernel/setup-common.c
++++ b/arch/powerpc/kernel/setup-common.c
+@@ -428,7 +428,7 @@ void __init smp_setup_cpu_maps(void)
+ DBG("smp_setup_cpu_maps()\n");
+
+ while ((dn = of_find_node_by_type(dn, "cpu")) && cpu < nr_cpu_ids) {
+- const int *intserv;
++ const __be32 *intserv;
+ int j, len;
+
+ DBG(" * %s...\n", dn->full_name);
+@@ -447,10 +447,18 @@ void __init smp_setup_cpu_maps(void)
+ }
+
+ for (j = 0; j < nthreads && cpu < nr_cpu_ids; j++) {
++ bool avail;
++
+ DBG(" thread %d -> cpu %d (hard id %d)\n",
+- j, cpu, intserv[j]);
+- set_cpu_present(cpu, of_device_is_available(dn));
+- set_hard_smp_processor_id(cpu, intserv[j]);
++ j, cpu, be32_to_cpu(intserv[j]));
++
++ avail = of_device_is_available(dn);
++ if (!avail)
++ avail = !of_property_match_string(dn,
++ "enable-method", "spin-table");
++
++ set_cpu_present(cpu, avail);
++ set_hard_smp_processor_id(cpu, be32_to_cpu(intserv[j]));
+ set_cpu_possible(cpu, true);
+ cpu++;
+ }
+diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
+index 3e8fe4b..cec664a 100644
+--- a/arch/powerpc/kernel/vmlinux.lds.S
++++ b/arch/powerpc/kernel/vmlinux.lds.S
+@@ -212,6 +212,7 @@ SECTIONS
+ *(.opd)
+ }
+
++ . = ALIGN(256);
+ .got : AT(ADDR(.got) - LOAD_OFFSET) {
+ __toc_start = .;
+ *(.got)
+diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
+index 5a783d8..67a42ed 100644
+--- a/arch/powerpc/mm/mmap_64.c
++++ b/arch/powerpc/mm/mmap_64.c
+@@ -53,14 +53,6 @@ static inline int mmap_is_legacy(void)
+ return sysctl_legacy_va_layout;
+ }
+
+-/*
+- * Since get_random_int() returns the same value within a 1 jiffy window,
+- * we will almost always get the same randomisation for the stack and mmap
+- * region. This will mean the relative distance between stack and mmap will
+- * be the same.
+- *
+- * To avoid this we can shift the randomness by 1 bit.
+- */
+ static unsigned long mmap_rnd(void)
+ {
+ unsigned long rnd = 0;
+@@ -68,11 +60,11 @@ static unsigned long mmap_rnd(void)
+ if (current->flags & PF_RANDOMIZE) {
+ /* 8MB for 32bit, 1GB for 64bit */
+ if (is_32bit_task())
+- rnd = (long)(get_random_int() % (1<<(22-PAGE_SHIFT)));
++ rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
+ else
+- rnd = (long)(get_random_int() % (1<<(29-PAGE_SHIFT)));
++ rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
+ }
+- return (rnd << PAGE_SHIFT) * 2;
++ return rnd << PAGE_SHIFT;
+ }
+
+ static inline unsigned long mmap_base(void)
+diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c
+index 0f1b706..2767276 100644
+--- a/arch/powerpc/platforms/pseries/dlpar.c
++++ b/arch/powerpc/platforms/pseries/dlpar.c
+@@ -416,6 +416,12 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ goto out;
+ }
+
++ rc = dlpar_acquire_drc(drc_index);
++ if (rc) {
++ rc = -EINVAL;
++ goto out;
++ }
++
+ dn = dlpar_configure_connector(drc_index);
+ if (!dn) {
+ rc = -EINVAL;
+@@ -436,13 +442,6 @@ static ssize_t dlpar_cpu_probe(const char *buf, size_t count)
+ kfree(dn->full_name);
+ dn->full_name = cpu_name;
+
+- rc = dlpar_acquire_drc(drc_index);
+- if (rc) {
+- dlpar_free_cc_nodes(dn);
+- rc = -EINVAL;
+- goto out;
+- }
+-
+ rc = dlpar_attach_node(dn);
+ if (rc) {
+ dlpar_release_drc(drc_index);
+diff --git a/arch/s390/crypto/ghash_s390.c b/arch/s390/crypto/ghash_s390.c
+index 31086ea..568521a 100644
+--- a/arch/s390/crypto/ghash_s390.c
++++ b/arch/s390/crypto/ghash_s390.c
+@@ -16,11 +16,12 @@
+ #define GHASH_DIGEST_SIZE 16
+
+ struct ghash_ctx {
+- u8 icv[16];
+- u8 key[16];
++ u8 key[GHASH_BLOCK_SIZE];
+ };
+
+ struct ghash_desc_ctx {
++ u8 icv[GHASH_BLOCK_SIZE];
++ u8 key[GHASH_BLOCK_SIZE];
+ u8 buffer[GHASH_BLOCK_SIZE];
+ u32 bytes;
+ };
+@@ -28,8 +29,10 @@ struct ghash_desc_ctx {
+ static int ghash_init(struct shash_desc *desc)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
++ struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+
+ memset(dctx, 0, sizeof(*dctx));
++ memcpy(dctx->key, ctx->key, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -45,7 +48,6 @@ static int ghash_setkey(struct crypto_shash *tfm,
+ }
+
+ memcpy(ctx->key, key, GHASH_BLOCK_SIZE);
+- memset(ctx->icv, 0, GHASH_BLOCK_SIZE);
+
+ return 0;
+ }
+@@ -54,7 +56,6 @@ static int ghash_update(struct shash_desc *desc,
+ const u8 *src, unsigned int srclen)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ unsigned int n;
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -70,7 +71,7 @@ static int ghash_update(struct shash_desc *desc,
+ src += n;
+
+ if (!dctx->bytes) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf,
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf,
+ GHASH_BLOCK_SIZE);
+ if (ret != GHASH_BLOCK_SIZE)
+ return -EIO;
+@@ -79,7 +80,7 @@ static int ghash_update(struct shash_desc *desc,
+
+ n = srclen & ~(GHASH_BLOCK_SIZE - 1);
+ if (n) {
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, src, n);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, src, n);
+ if (ret != n)
+ return -EIO;
+ src += n;
+@@ -94,7 +95,7 @@ static int ghash_update(struct shash_desc *desc,
+ return 0;
+ }
+
+-static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
++static int ghash_flush(struct ghash_desc_ctx *dctx)
+ {
+ u8 *buf = dctx->buffer;
+ int ret;
+@@ -104,24 +105,24 @@ static int ghash_flush(struct ghash_ctx *ctx, struct ghash_desc_ctx *dctx)
+
+ memset(pos, 0, dctx->bytes);
+
+- ret = crypt_s390_kimd(KIMD_GHASH, ctx, buf, GHASH_BLOCK_SIZE);
++ ret = crypt_s390_kimd(KIMD_GHASH, dctx, buf, GHASH_BLOCK_SIZE);
+ if (ret != GHASH_BLOCK_SIZE)
+ return -EIO;
++
++ dctx->bytes = 0;
+ }
+
+- dctx->bytes = 0;
+ return 0;
+ }
+
+ static int ghash_final(struct shash_desc *desc, u8 *dst)
+ {
+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc);
+- struct ghash_ctx *ctx = crypto_shash_ctx(desc->tfm);
+ int ret;
+
+- ret = ghash_flush(ctx, dctx);
++ ret = ghash_flush(dctx);
+ if (!ret)
+- memcpy(dst, ctx->icv, GHASH_BLOCK_SIZE);
++ memcpy(dst, dctx->icv, GHASH_BLOCK_SIZE);
+ return ret;
+ }
+
+diff --git a/arch/s390/kernel/suspend.c b/arch/s390/kernel/suspend.c
+index 47df775..ba17092 100644
+--- a/arch/s390/kernel/suspend.c
++++ b/arch/s390/kernel/suspend.c
+@@ -9,6 +9,8 @@
+ #include <linux/pfn.h>
+ #include <linux/suspend.h>
+ #include <linux/mm.h>
++#include <asm/ipl.h>
++#include <asm/sections.h>
+ #include <asm/system.h>
+
+ /*
+@@ -137,6 +139,8 @@ int pfn_is_nosave(unsigned long pfn)
+ {
+ unsigned long nosave_begin_pfn = PFN_DOWN(__pa(&__nosave_begin));
+ unsigned long nosave_end_pfn = PFN_DOWN(__pa(&__nosave_end));
++ unsigned long eshared_pfn = PFN_DOWN(__pa(&_eshared)) - 1;
++ unsigned long stext_pfn = PFN_DOWN(__pa(&_stext));
+
+ /* Always save lowcore pages (LC protection might be enabled). */
+ if (pfn <= LC_PAGES)
+@@ -144,6 +148,8 @@ int pfn_is_nosave(unsigned long pfn)
+ if (pfn >= nosave_begin_pfn && pfn < nosave_end_pfn)
+ return 1;
+ /* Skip memory holes and read-only pages (NSS, DCSS, ...). */
++ if (pfn >= stext_pfn && pfn <= eshared_pfn)
++ return ipl_info.type == IPL_TYPE_NSS ? 1 : 0;
+ if (tprot(PFN_PHYS(pfn)))
+ return 1;
+ return 0;
+diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
+index d026389..c593e1e 100644
+--- a/arch/s390/kvm/priv.c
++++ b/arch/s390/kvm/priv.c
+@@ -219,6 +219,7 @@ static void handle_stsi_3_2_2(struct kvm_vcpu *vcpu, struct sysinfo_3_2_2 *mem)
+ for (n = mem->count - 1; n > 0 ; n--)
+ memcpy(&mem->vm[n], &mem->vm[n - 1], sizeof(mem->vm[0]));
+
++ memset(&mem->vm[0], 0, sizeof(mem->vm[0]));
+ mem->vm[0].cpus_total = cpus;
+ mem->vm[0].cpus_configured = cpus;
+ mem->vm[0].cpus_standby = 0;
+diff --git a/arch/sparc/kernel/leon_pci.c b/arch/sparc/kernel/leon_pci.c
+index f1cf6ef..a0ef32e 100644
+--- a/arch/sparc/kernel/leon_pci.c
++++ b/arch/sparc/kernel/leon_pci.c
+@@ -78,7 +78,6 @@ EXPORT_SYMBOL(pcibios_bus_to_resource);
+
+ void __devinit pcibios_fixup_bus(struct pci_bus *pbus)
+ {
+- struct leon_pci_info *info = pbus->sysdata;
+ struct pci_dev *dev;
+ int i, has_io, has_mem;
+ u16 cmd;
+@@ -153,18 +152,6 @@ int pcibios_enable_device(struct pci_dev *dev, int mask)
+ return pci_enable_resources(dev, mask);
+ }
+
+-struct device_node *pci_device_to_OF_node(struct pci_dev *pdev)
+-{
+- /*
+- * Currently the OpenBoot nodes are not connected with the PCI device,
+- * this is because the LEON PROM does not create PCI nodes. Eventually
+- * this will change and the same approach as pcic.c can be used to
+- * match PROM nodes with pci devices.
+- */
+- return NULL;
+-}
+-EXPORT_SYMBOL(pci_device_to_OF_node);
+-
+ void __devinit pcibios_update_irq(struct pci_dev *dev, int irq)
+ {
+ #ifdef CONFIG_PCI_DEBUG
+diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
+index 5e4252b..0ff682d 100644
+--- a/arch/sparc/kernel/sys_sparc_64.c
++++ b/arch/sparc/kernel/sys_sparc_64.c
+@@ -368,11 +368,11 @@ static unsigned long mmap_rnd(void)
+ if (current->flags & PF_RANDOMIZE) {
+ unsigned long val = get_random_int();
+ if (test_thread_flag(TIF_32BIT))
+- rnd = (val % (1UL << (22UL-PAGE_SHIFT)));
++ rnd = (val % (1UL << (23UL-PAGE_SHIFT)));
+ else
+- rnd = (val % (1UL << (29UL-PAGE_SHIFT)));
++ rnd = (val % (1UL << (30UL-PAGE_SHIFT)));
+ }
+- return (rnd << PAGE_SHIFT) * 2;
++ return rnd << PAGE_SHIFT;
+ }
+
+ void arch_pick_mmap_layout(struct mm_struct *mm)
+diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
+index 28a1bca..d720208 100644
+--- a/arch/x86/Kconfig
++++ b/arch/x86/Kconfig
+@@ -133,7 +133,8 @@ config SBUS
+ bool
+
+ config NEED_DMA_MAP_STATE
+- def_bool (X86_64 || INTEL_IOMMU || DMA_API_DEBUG)
++ def_bool y
++ depends on X86_64 || INTEL_IOMMU || DMA_API_DEBUG || SWIOTLB
+
+ config NEED_SG_DMA_LENGTH
+ def_bool y
+diff --git a/arch/x86/include/asm/iommu_table.h b/arch/x86/include/asm/iommu_table.h
+index f229b13..0c54822 100644
+--- a/arch/x86/include/asm/iommu_table.h
++++ b/arch/x86/include/asm/iommu_table.h
+@@ -79,11 +79,12 @@ struct iommu_table_entry {
+ * d). Similar to the 'init', except that this gets called from pci_iommu_init
+ * where we do have a memory allocator.
+ *
+- * The standard vs the _FINISH differs in that the _FINISH variant will
+- * continue detecting other IOMMUs in the call list after the
+- * the detection routine returns a positive number. The _FINISH will
+- * stop the execution chain. Both will still call the 'init' and
+- * 'late_init' functions if they are set.
++ * The standard IOMMU_INIT differs from the IOMMU_INIT_FINISH variant
++ * in that the former will continue detecting other IOMMUs in the call
++ * list after the detection routine returns a positive number, while the
++ * latter will stop the execution chain upon first successful detection.
++ * Both variants will still call the 'init' and 'late_init' functions if
++ * they are set.
+ */
+ #define IOMMU_INIT_FINISH(_detect, _depend, _init, _late_init) \
+ __IOMMU_INIT(_detect, _depend, _init, _late_init, 1)
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 41b2f57..78842ce 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -700,9 +700,12 @@ void native_machine_shutdown(void)
+ /* Make certain I only run on the appropriate processor */
+ set_cpus_allowed_ptr(current, cpumask_of(reboot_cpu_id));
+
+- /* O.K Now that I'm on the appropriate processor,
+- * stop all of the others.
++ /*
++ * O.K Now that I'm on the appropriate processor, stop all of the
++ * others. Also disable the local irq to not receive the per-cpu
++ * timer interrupt which may trigger scheduler's load balance.
+ */
++ local_irq_disable();
+ stop_other_cpus();
+ #endif
+
+diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
+index bfc9507..4a949c7 100644
+--- a/arch/x86/kvm/mmu.c
++++ b/arch/x86/kvm/mmu.c
+@@ -3609,7 +3609,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
+ }
+ }
+
+- mask.cr0_wp = mask.cr4_pae = mask.nxe = 1;
++ mask.cr0_wp = mask.cr4_pae = mask.nxe = mask.smep_andnot_wp = 1;
+ for_each_gfn_indirect_valid_sp(vcpu->kvm, sp, gfn, node) {
+ pte_size = sp->role.cr4_pae ? 8 : 4;
+ misaligned = (offset ^ (offset + bytes - 1)) & ~(pte_size - 1);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 8831c43..421958f 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -3032,8 +3032,16 @@ static void vmx_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3)
+
+ static int vmx_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4)
+ {
+- unsigned long hw_cr4 = cr4 | (to_vmx(vcpu)->rmode.vm86_active ?
+- KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
++ /*
++ * Pass through host's Machine Check Enable value to hw_cr4, which
++ * is in force while we are in guest mode. Do not let guests control
++ * this bit, even if host CR4.MCE == 0.
++ */
++ unsigned long hw_cr4 =
++ (read_cr4() & X86_CR4_MCE) |
++ (cr4 & ~X86_CR4_MCE) |
++ (to_vmx(vcpu)->rmode.vm86_active ?
++ KVM_RMODE_VM_CR4_ALWAYS_ON : KVM_PMODE_VM_CR4_ALWAYS_ON);
+
+ if (cr4 & X86_CR4_VMXE) {
+ /*
+diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
+index 554b7b5..433b21d 100644
+--- a/arch/x86/lib/usercopy_64.c
++++ b/arch/x86/lib/usercopy_64.c
+@@ -113,7 +113,7 @@ long __strnlen_user(const char __user *s, long n)
+ char c;
+
+ while (1) {
+- if (res>n)
++ if (res >= n)
+ return n+1;
+ if (__get_user(c, s))
+ return 0;
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 5a5b6e4..11e3100 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -150,7 +150,12 @@ void bpf_jit_compile(struct sk_filter *fp)
+ }
+ cleanup_addr = proglen; /* epilogue address */
+
+- for (pass = 0; pass < 10; pass++) {
++ /* JITed image shrinks with every pass and the loop iterates
++ * until the image stops shrinking. Very large bpf programs
++ * may converge on the last pass. In such case do one more
++ * pass to emit the final image
++ */
++ for (pass = 0; pass < 10 || image; pass++) {
+ u8 seen_or_pass0 = (pass == 0) ? (SEEN_XREG | SEEN_DATAREF | SEEN_MEM) : seen;
+ /* no prologue/epilogue for trivial filters (RET something) */
+ proglen = 0;
+diff --git a/drivers/acpi/acpica/acmacros.h b/drivers/acpi/acpica/acmacros.h
+index b7491ee..6454fe6 100644
+--- a/drivers/acpi/acpica/acmacros.h
++++ b/drivers/acpi/acpica/acmacros.h
+@@ -59,19 +59,15 @@
+ #define ACPI_SET64(ptr) *ACPI_CAST_PTR (u64, ptr)
+
+ /*
+- * printf() format helpers
++ * printf() format helper. This macros is a workaround for the difficulties
++ * with emitting 64-bit integers and 64-bit pointers with the same code
++ * for both 32-bit and 64-bit hosts.
+ */
+
+ /* Split 64-bit integer into two 32-bit values. Use with %8.8_x%8.8_x */
+
+ #define ACPI_FORMAT_UINT64(i) ACPI_HIDWORD(i), ACPI_LODWORD(i)
+
+-#if ACPI_MACHINE_WIDTH == 64
+-#define ACPI_FORMAT_NATIVE_UINT(i) ACPI_FORMAT_UINT64(i)
+-#else
+-#define ACPI_FORMAT_NATIVE_UINT(i) 0, (i)
+-#endif
+-
+ /*
+ * Macros for moving data around to/from buffers that are possibly unaligned.
+ * If the hardware supports the transfer of unaligned data, just do the store.
+diff --git a/drivers/acpi/acpica/dsopcode.c b/drivers/acpi/acpica/dsopcode.c
+index c627a28..9d19587 100644
+--- a/drivers/acpi/acpica/dsopcode.c
++++ b/drivers/acpi/acpica/dsopcode.c
+@@ -446,7 +446,7 @@ acpi_ds_eval_region_operands(struct acpi_walk_state *walk_state,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+@@ -545,7 +545,7 @@ acpi_ds_eval_table_region_operands(struct acpi_walk_state *walk_state,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_EXEC, "RgnObj %p Addr %8.8X%8.8X Len %X\n",
+ obj_desc,
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->region.address),
+ obj_desc->region.length));
+
+ /* Now the address and length are valid for this opregion */
+diff --git a/drivers/acpi/acpica/evregion.c b/drivers/acpi/acpica/evregion.c
+index f0edf5c..cb18ab4 100644
+--- a/drivers/acpi/acpica/evregion.c
++++ b/drivers/acpi/acpica/evregion.c
+@@ -450,8 +450,8 @@ acpi_ev_address_space_dispatch(union acpi_operand_object *region_obj,
+ ACPI_DEBUG_PRINT((ACPI_DB_OPREGION,
+ "Handler %p (@%p) Address %8.8X%8.8X [%s]\n",
+ ®ion_obj->region.handler->address_space, handler,
+- ACPI_FORMAT_NATIVE_UINT(region_obj->region.address +
+- region_offset),
++ ACPI_FORMAT_UINT64(region_obj->region.address +
++ region_offset),
+ acpi_ut_get_region_name(region_obj->region.
+ space_id)));
+
+diff --git a/drivers/acpi/acpica/exdump.c b/drivers/acpi/acpica/exdump.c
+index 61b8c0e..c572fa0 100644
+--- a/drivers/acpi/acpica/exdump.c
++++ b/drivers/acpi/acpica/exdump.c
+@@ -613,8 +613,8 @@ void acpi_ex_dump_operand(union acpi_operand_object *obj_desc, u32 depth)
+ acpi_os_printf("\n");
+ } else {
+ acpi_os_printf(" base %8.8X%8.8X Length %X\n",
+- ACPI_FORMAT_NATIVE_UINT(obj_desc->region.
+- address),
++ ACPI_FORMAT_UINT64(obj_desc->region.
++ address),
+ obj_desc->region.length);
+ }
+ break;
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index b334f54..be22142 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -257,17 +257,15 @@ acpi_ex_access_region(union acpi_operand_object *obj_desc,
+ }
+
+ ACPI_DEBUG_PRINT_RAW((ACPI_DB_BFIELD,
+- " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %p\n",
++ " Region [%s:%X], Width %X, ByteBase %X, Offset %X at %8.8X%8.8X\n",
+ acpi_ut_get_region_name(rgn_desc->region.
+ space_id),
+ rgn_desc->region.space_id,
+ obj_desc->common_field.access_byte_width,
+ obj_desc->common_field.base_byte_offset,
+- field_datum_byte_offset, ACPI_CAST_PTR(void,
+- (rgn_desc->
+- region.
+- address +
+- region_offset))));
++ field_datum_byte_offset,
++ ACPI_FORMAT_UINT64(rgn_desc->region.address +
++ region_offset)));
+
+ /* Invoke the appropriate address_space/op_region handler */
+
+diff --git a/drivers/acpi/acpica/exregion.c b/drivers/acpi/acpica/exregion.c
+index f0d5e14..dd5e930 100644
+--- a/drivers/acpi/acpica/exregion.c
++++ b/drivers/acpi/acpica/exregion.c
+@@ -174,7 +174,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+ if (!mem_info->mapped_logical_address) {
+ ACPI_ERROR((AE_INFO,
+ "Could not map memory at 0x%8.8X%8.8X, size %u",
+- ACPI_FORMAT_NATIVE_UINT(address),
++ ACPI_FORMAT_UINT64(address),
+ (u32) map_length));
+ mem_info->mapped_length = 0;
+ return_ACPI_STATUS(AE_NO_MEMORY);
+@@ -195,8 +195,7 @@ acpi_ex_system_memory_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-Memory (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /*
+ * Perform the memory read or write
+@@ -298,8 +297,7 @@ acpi_ex_system_io_space_handler(u32 function,
+
+ ACPI_DEBUG_PRINT((ACPI_DB_INFO,
+ "System-IO (width %u) R/W %u Address=%8.8X%8.8X\n",
+- bit_width, function,
+- ACPI_FORMAT_NATIVE_UINT(address)));
++ bit_width, function, ACPI_FORMAT_UINT64(address)));
+
+ /* Decode the function parameter */
+
+diff --git a/drivers/acpi/acpica/hwvalid.c b/drivers/acpi/acpica/hwvalid.c
+index 5f16058..d43b8af 100644
+--- a/drivers/acpi/acpica/hwvalid.c
++++ b/drivers/acpi/acpica/hwvalid.c
+@@ -141,17 +141,17 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+ byte_width = ACPI_DIV_8(bit_width);
+ last_address = address + byte_width - 1;
+
+- ACPI_DEBUG_PRINT((ACPI_DB_IO, "Address %p LastAddress %p Length %X",
+- ACPI_CAST_PTR(void, address), ACPI_CAST_PTR(void,
+- last_address),
+- byte_width));
++ ACPI_DEBUG_PRINT((ACPI_DB_IO,
++ "Address %8.8X%8.8X LastAddress %8.8X%8.8X Length %X",
++ ACPI_FORMAT_UINT64(address),
++ ACPI_FORMAT_UINT64(last_address), byte_width));
+
+ /* Maximum 16-bit address in I/O space */
+
+ if (last_address > ACPI_UINT16_MAX) {
+ ACPI_ERROR((AE_INFO,
+- "Illegal I/O port address/length above 64K: %p/0x%X",
+- ACPI_CAST_PTR(void, address), byte_width));
++ "Illegal I/O port address/length above 64K: %8.8X%8.8X/0x%X",
++ ACPI_FORMAT_UINT64(address), byte_width));
+ return_ACPI_STATUS(AE_LIMIT);
+ }
+
+@@ -180,8 +180,8 @@ acpi_hw_validate_io_request(acpi_io_address address, u32 bit_width)
+
+ if (acpi_gbl_osi_data >= port_info->osi_dependency) {
+ ACPI_DEBUG_PRINT((ACPI_DB_IO,
+- "Denied AML access to port 0x%p/%X (%s 0x%.4X-0x%.4X)",
+- ACPI_CAST_PTR(void, address),
++ "Denied AML access to port 0x%8.8X%8.8X/%X (%s 0x%.4X-0x%.4X)",
++ ACPI_FORMAT_UINT64(address),
+ byte_width, port_info->name,
+ port_info->start,
+ port_info->end));
+diff --git a/drivers/acpi/acpica/nsdump.c b/drivers/acpi/acpica/nsdump.c
+index b683cc2..0a68c73 100644
+--- a/drivers/acpi/acpica/nsdump.c
++++ b/drivers/acpi/acpica/nsdump.c
+@@ -251,12 +251,11 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ switch (type) {
+ case ACPI_TYPE_PROCESSOR:
+
+- acpi_os_printf("ID %X Len %.4X Addr %p\n",
++ acpi_os_printf("ID %02X Len %02X Addr %8.8X%8.8X\n",
+ obj_desc->processor.proc_id,
+ obj_desc->processor.length,
+- ACPI_CAST_PTR(void,
+- obj_desc->processor.
+- address));
++ ACPI_FORMAT_UINT64(obj_desc->processor.
++ address));
+ break;
+
+ case ACPI_TYPE_DEVICE:
+@@ -327,8 +326,9 @@ acpi_ns_dump_one_object(acpi_handle obj_handle,
+ space_id));
+ if (obj_desc->region.flags & AOPOBJ_DATA_VALID) {
+ acpi_os_printf(" Addr %8.8X%8.8X Len %.4X\n",
+- ACPI_FORMAT_NATIVE_UINT
+- (obj_desc->region.address),
++ ACPI_FORMAT_UINT64(obj_desc->
++ region.
++ address),
+ obj_desc->region.length);
+ } else {
+ acpi_os_printf
+diff --git a/drivers/acpi/acpica/tbinstal.c b/drivers/acpi/acpica/tbinstal.c
+index 62365f6..08a3380 100644
+--- a/drivers/acpi/acpica/tbinstal.c
++++ b/drivers/acpi/acpica/tbinstal.c
+@@ -228,9 +228,9 @@ acpi_tb_add_table(struct acpi_table_desc *table_desc, u32 *table_index)
+ status = acpi_os_table_override(table_desc->pointer, &override_table);
+ if (ACPI_SUCCESS(status) && override_table) {
+ ACPI_INFO((AE_INFO,
+- "%4.4s @ 0x%p Table override, replaced with:",
++ "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
+ table_desc->pointer->signature,
+- ACPI_CAST_PTR(void, table_desc->address)));
++ ACPI_FORMAT_UINT64(table_desc->address)));
+
+ /* We can delete the table that was passed as a parameter */
+
+diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
+index 0f2d395..24de78fe 100644
+--- a/drivers/acpi/acpica/tbutils.c
++++ b/drivers/acpi/acpica/tbutils.c
+@@ -237,16 +237,12 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ {
+ struct acpi_table_header local_header;
+
+- /*
+- * The reason that the Address is cast to a void pointer is so that we
+- * can use %p which will work properly on both 32-bit and 64-bit hosts.
+- */
+ if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_FACS)) {
+
+ /* FACS only has signature and length fields */
+
+- ACPI_INFO((AE_INFO, "%4.4s %p %05X",
+- header->signature, ACPI_CAST_PTR(void, address),
++ ACPI_INFO((AE_INFO, "%4.4s 0x%8.8X%8.8X %05X",
++ header->signature, ACPI_FORMAT_UINT64(address),
+ header->length));
+ } else if (ACPI_COMPARE_NAME(header->signature, ACPI_SIG_RSDP)) {
+
+@@ -257,8 +253,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ header)->oem_id, ACPI_OEM_ID_SIZE);
+ acpi_tb_fix_string(local_header.oem_id, ACPI_OEM_ID_SIZE);
+
+- ACPI_INFO((AE_INFO, "RSDP %p %05X (v%.2d %6.6s)",
+- ACPI_CAST_PTR (void, address),
++ ACPI_INFO((AE_INFO, "RSDP 0x%8.8X%8.8X %05X (v%.2d %6.6s)",
++ ACPI_FORMAT_UINT64(address),
+ (ACPI_CAST_PTR(struct acpi_table_rsdp, header)->
+ revision >
+ 0) ? ACPI_CAST_PTR(struct acpi_table_rsdp,
+@@ -272,8 +268,8 @@ acpi_tb_print_table_header(acpi_physical_address address,
+ acpi_tb_cleanup_table_header(&local_header, header);
+
+ ACPI_INFO((AE_INFO,
+- "%4.4s %p %05X (v%.2d %6.6s %8.8s %08X %4.4s %08X)",
+- local_header.signature, ACPI_CAST_PTR(void, address),
++ "%-4.4s 0x%8.8X%8.8X %05X (v%.2d %-6.6s %-8.8s %08X %-4.4s %08X)",
++ local_header.signature, ACPI_FORMAT_UINT64(address),
+ local_header.length, local_header.revision,
+ local_header.oem_id, local_header.oem_table_id,
+ local_header.oem_revision,
+@@ -488,9 +484,8 @@ acpi_tb_install_table(acpi_physical_address address,
+ status = acpi_os_table_override(mapped_table, &override_table);
+ if (ACPI_SUCCESS(status) && override_table) {
+ ACPI_INFO((AE_INFO,
+- "%4.4s @ 0x%p Table override, replaced with:",
+- mapped_table->signature, ACPI_CAST_PTR(void,
+- address)));
++ "%4.4s @ 0x%8.8X%8.8X Table override, replaced with:",
++ mapped_table->signature, ACPI_FORMAT_UINT64(address)));
+
+ acpi_gbl_root_table_list.tables[table_index].pointer =
+ override_table;
+diff --git a/drivers/acpi/acpica/tbxfroot.c b/drivers/acpi/acpica/tbxfroot.c
+index 7eb6c6c..0272fbe 100644
+--- a/drivers/acpi/acpica/tbxfroot.c
++++ b/drivers/acpi/acpica/tbxfroot.c
+@@ -119,7 +119,7 @@ static acpi_status acpi_tb_validate_rsdp(struct acpi_table_rsdp *rsdp)
+ *
+ ******************************************************************************/
+
+-acpi_status acpi_find_root_pointer(acpi_size *table_address)
++acpi_status acpi_find_root_pointer(acpi_physical_address * table_address)
+ {
+ u8 *table_ptr;
+ u8 *mem_rover;
+@@ -177,7 +177,8 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ physical_address +=
+ (u32) ACPI_PTR_DIFF(mem_rover, table_ptr);
+
+- *table_address = physical_address;
++ *table_address =
++ (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+ }
+@@ -210,7 +211,7 @@ acpi_status acpi_find_root_pointer(acpi_size *table_address)
+ (ACPI_HI_RSDP_WINDOW_BASE +
+ ACPI_PTR_DIFF(mem_rover, table_ptr));
+
+- *table_address = physical_address;
++ *table_address = (acpi_physical_address) physical_address;
+ return_ACPI_STATUS(AE_OK);
+ }
+
+diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
+index a6664d2..7be7aa6 100644
+--- a/drivers/acpi/osl.c
++++ b/drivers/acpi/osl.c
+@@ -179,7 +179,7 @@ static void __init acpi_request_region (struct acpi_generic_address *addr,
+ request_mem_region(addr->address, length, desc);
+ }
+
+-static int __init acpi_reserve_resources(void)
++static void __init acpi_reserve_resources(void)
+ {
+ acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
+ "ACPI PM1a_EVT_BLK");
+@@ -208,10 +208,7 @@ static int __init acpi_reserve_resources(void)
+ if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
+ acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
+ acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
+-
+- return 0;
+ }
+-device_initcall(acpi_reserve_resources);
+
+ void acpi_os_printf(const char *fmt, ...)
+ {
+@@ -1630,6 +1627,7 @@ acpi_status __init acpi_os_initialize(void)
+
+ acpi_status __init acpi_os_initialize1(void)
+ {
++ acpi_reserve_resources();
+ kacpid_wq = alloc_workqueue("kacpid", 0, 1);
+ kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
+ kacpi_hotplug_wq = alloc_workqueue("kacpi_hotplug", 0, 1);
+diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
+index 81f32e5..e2958aa 100644
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -67,6 +67,7 @@ enum board_ids {
+ board_ahci_yes_fbs,
+
+ /* board IDs for specific chipsets in alphabetical order */
++ board_ahci_avn,
+ board_ahci_mcp65,
+ board_ahci_mcp77,
+ board_ahci_mcp89,
+@@ -85,6 +86,8 @@ enum board_ids {
+ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline);
+ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ unsigned long deadline);
+ #ifdef CONFIG_PM
+@@ -108,6 +111,11 @@ static struct ata_port_operations ahci_p5wdh_ops = {
+
+ #define AHCI_HFLAGS(flags) .private_data = (void *)(flags)
+
++static struct ata_port_operations ahci_avn_ops = {
++ .inherits = &ahci_ops,
++ .hardreset = ahci_avn_hardreset,
++};
++
+ static const struct ata_port_info ahci_port_info[] = {
+ /* by features */
+ [board_ahci] =
+@@ -156,6 +164,12 @@ static const struct ata_port_info ahci_port_info[] = {
+ .port_ops = &ahci_ops,
+ },
+ /* by chipsets */
++ [board_ahci_avn] = {
++ .flags = AHCI_FLAG_COMMON,
++ .pio_mask = ATA_PIO4,
++ .udma_mask = ATA_UDMA6,
++ .port_ops = &ahci_avn_ops,
++ },
+ [board_ahci_mcp65] =
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_NO_FPDMA_AA | AHCI_HFLAG_NO_PMP |
+@@ -302,14 +316,14 @@ static const struct pci_device_id ahci_pci_tbl[] = {
+ { PCI_VDEVICE(INTEL, 0x1f27), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2e), board_ahci }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x1f2f), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f32), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f33), board_ahci }, /* Avoton AHCI */
+- { PCI_VDEVICE(INTEL, 0x1f34), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f35), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f36), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f37), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci }, /* Avoton RAID */
+- { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f32), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f33), board_ahci_avn }, /* Avoton AHCI */
++ { PCI_VDEVICE(INTEL, 0x1f34), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f35), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f36), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f37), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3e), board_ahci_avn }, /* Avoton RAID */
++ { PCI_VDEVICE(INTEL, 0x1f3f), board_ahci_avn }, /* Avoton RAID */
+ { PCI_VDEVICE(INTEL, 0x8d02), board_ahci }, /* Wellsburg AHCI */
+ { PCI_VDEVICE(INTEL, 0x8d04), board_ahci }, /* Wellsburg RAID */
+ { PCI_VDEVICE(INTEL, 0x8d06), board_ahci }, /* Wellsburg RAID */
+@@ -680,6 +694,78 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class,
+ return rc;
+ }
+
++/*
++ * ahci_avn_hardreset - attempt more aggressive recovery of Avoton ports.
++ *
++ * It has been observed with some SSDs that the timing of events in the
++ * link synchronization phase can leave the port in a state that can not
++ * be recovered by a SATA-hard-reset alone. The failing signature is
++ * SStatus.DET stuck at 1 ("Device presence detected but Phy
++ * communication not established"). It was found that unloading and
++ * reloading the driver when this problem occurs allows the drive
++ * connection to be recovered (DET advanced to 0x3). The critical
++ * component of reloading the driver is that the port state machines are
++ * reset by bouncing "port enable" in the AHCI PCS configuration
++ * register. So, reproduce that effect by bouncing a port whenever we
++ * see DET==1 after a reset.
++ */
++static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class,
++ unsigned long deadline)
++{
++ const unsigned long *timing = sata_ehc_deb_timing(&link->eh_context);
++ struct ata_port *ap = link->ap;
++ struct ahci_port_priv *pp = ap->private_data;
++ u8 *d2h_fis = pp->rx_fis + RX_FIS_D2H_REG;
++ unsigned long tmo = deadline - jiffies;
++ struct ata_taskfile tf;
++ bool online;
++ int rc, i;
++
++ DPRINTK("ENTER\n");
++
++ ahci_stop_engine(ap);
++
++ for (i = 0; i < 2; i++) {
++ u16 val;
++ u32 sstatus;
++ int port = ap->port_no;
++ struct ata_host *host = ap->host;
++ struct pci_dev *pdev = to_pci_dev(host->dev);
++
++ /* clear D2H reception area to properly wait for D2H FIS */
++ ata_tf_init(link->device, &tf);
++ tf.command = ATA_BUSY;
++ ata_tf_to_fis(&tf, 0, 0, d2h_fis);
++
++ rc = sata_link_hardreset(link, timing, deadline, &online,
++ ahci_check_ready);
++
++ if (sata_scr_read(link, SCR_STATUS, &sstatus) != 0 ||
++ (sstatus & 0xf) != 1)
++ break;
++
++ ata_link_printk(link, KERN_INFO, "avn bounce port%d\n",
++ port);
++
++ pci_read_config_word(pdev, 0x92, &val);
++ val &= ~(1 << port);
++ pci_write_config_word(pdev, 0x92, val);
++ ata_msleep(ap, 1000);
++ val |= 1 << port;
++ pci_write_config_word(pdev, 0x92, val);
++ deadline += tmo;
++ }
++
++ ahci_start_engine(ap);
++
++ if (online)
++ *class = ahci_dev_classify(ap);
++
++ DPRINTK("EXIT, rc=%d, class=%u\n", rc, *class);
++ return rc;
++}
++
++
+ #ifdef CONFIG_PM
+ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg)
+ {
+diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
+index b175000..cdf58f7 100644
+--- a/drivers/ata/ahci.h
++++ b/drivers/ata/ahci.h
+@@ -314,6 +314,7 @@ extern struct device_attribute *ahci_sdev_attrs[];
+ extern struct ata_port_operations ahci_ops;
+ extern struct ata_port_operations ahci_pmp_retry_srst_ops;
+
++unsigned int ahci_dev_classify(struct ata_port *ap);
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ u32 opts);
+ void ahci_save_initial_config(struct device *dev,
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index de2802c..41ffb8c 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -1137,7 +1137,7 @@ static void ahci_dev_config(struct ata_device *dev)
+ }
+ }
+
+-static unsigned int ahci_dev_classify(struct ata_port *ap)
++unsigned int ahci_dev_classify(struct ata_port *ap)
+ {
+ void __iomem *port_mmio = ahci_port_base(ap);
+ struct ata_taskfile tf;
+@@ -1151,6 +1151,7 @@ static unsigned int ahci_dev_classify(struct ata_port *ap)
+
+ return ata_dev_classify(&tf);
+ }
++EXPORT_SYMBOL_GPL(ahci_dev_classify);
+
+ void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
+ u32 opts)
+@@ -1668,8 +1669,7 @@ static void ahci_port_intr(struct ata_port *ap)
+ if (unlikely(resetting))
+ status &= ~PORT_IRQ_BAD_PMP;
+
+- /* if LPM is enabled, PHYRDY doesn't mean anything */
+- if (ap->link.lpm_policy > ATA_LPM_MAX_POWER) {
++ if (sata_lpm_ignore_phy_events(&ap->link)) {
+ status &= ~PORT_IRQ_PHYRDY;
+ ahci_scr_write(&ap->link, SCR_ERROR, SERR_PHYRDY_CHG);
+ }
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 5d8fc3d..fcd8586 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6615,6 +6615,38 @@ u32 ata_wait_register(struct ata_port *ap, void __iomem *reg, u32 mask, u32 val,
+ return tmp;
+ }
+
++/**
++ * sata_lpm_ignore_phy_events - test if PHY event should be ignored
++ * @link: Link receiving the event
++ *
++ * Test whether the received PHY event has to be ignored or not.
++ *
++ * LOCKING:
++ * None:
++ *
++ * RETURNS:
++ * True if the event has to be ignored.
++ */
++bool sata_lpm_ignore_phy_events(struct ata_link *link)
++{
++ unsigned long lpm_timeout = link->last_lpm_change +
++ msecs_to_jiffies(ATA_TMOUT_SPURIOUS_PHY);
++
++ /* if LPM is enabled, PHYRDY doesn't mean anything */
++ if (link->lpm_policy > ATA_LPM_MAX_POWER)
++ return true;
++
++ /* ignore the first PHY event after the LPM policy changed
++ * as it is might be spurious
++ */
++ if ((link->flags & ATA_LFLAG_CHANGED) &&
++ time_before(jiffies, lpm_timeout))
++ return true;
++
++ return false;
++}
++EXPORT_SYMBOL_GPL(sata_lpm_ignore_phy_events);
++
+ /*
+ * Dummy port_ops
+ */
+diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
+index 7d1a478..f54b0775 100644
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -3423,6 +3423,9 @@ static int ata_eh_set_lpm(struct ata_link *link, enum ata_lpm_policy policy,
+ }
+ }
+
++ link->last_lpm_change = jiffies;
++ link->flags |= ATA_LFLAG_CHANGED;
++
+ return 0;
+
+ fail:
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 3eb6ad2..9f32f43 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -63,6 +63,7 @@ static struct usb_device_id ath3k_table[] = {
+ /* Atheros AR3011 with sflash firmware*/
+ { USB_DEVICE(0x0489, 0xE027) },
+ { USB_DEVICE(0x0489, 0xE03D) },
++ { USB_DEVICE(0x04F2, 0xAFF1) },
+ { USB_DEVICE(0x0930, 0x0215) },
+ { USB_DEVICE(0x0CF3, 0x3002) },
+ { USB_DEVICE(0x0CF3, 0xE019) },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 5c385e5..92973a3 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -148,6 +148,7 @@ static struct usb_device_id blacklist_table[] = {
+ /* Atheros 3011 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
++ { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
+ { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
+index 5948a21..203361e 100644
+--- a/drivers/edac/Kconfig
++++ b/drivers/edac/Kconfig
+@@ -214,7 +214,7 @@ config EDAC_I7300
+
+ config EDAC_SBRIDGE
+ tristate "Intel Sandy-Bridge Integrated MC"
+- depends on EDAC_MM_EDAC && PCI && X86_64 && X86_MCE_INTEL
++ depends on EDAC_MM_EDAC && PCI && X86 && X86_MCE_INTEL
+ depends on EXPERIMENTAL
+ help
+ Support for error detection and correction the Intel
+diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
+index da71881..f8f790c 100644
+--- a/drivers/edac/sb_edac.c
++++ b/drivers/edac/sb_edac.c
+@@ -20,6 +20,7 @@
+ #include <linux/mmzone.h>
+ #include <linux/smp.h>
+ #include <linux/bitmap.h>
++#include <linux/math64.h>
+ #include <asm/processor.h>
+ #include <asm/mce.h>
+
+@@ -671,6 +672,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ u32 reg;
+ u64 limit, prv = 0;
+ u64 tmp_mb;
++ u32 gb, mb;
+ u32 rir_way;
+
+ /*
+@@ -683,8 +685,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tolm = GET_TOLM(reg);
+ tmp_mb = (1 + pvt->tolm) >> 20;
+
+- debugf0("TOLM: %Lu.%03Lu GB (0x%016Lx)\n",
+- tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tolm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TOHM: %u.%03u GB (0x%016Lx)\n",
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /* Address range is already 45:25 */
+ pci_read_config_dword(pvt->pci_sad1, TOHM,
+@@ -692,8 +695,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ pvt->tohm = GET_TOHM(reg);
+ tmp_mb = (1 + pvt->tohm) >> 20;
+
+- debugf0("TOHM: %Lu.%03Lu GB (0x%016Lx)",
+- tmp_mb / 1000, tmp_mb % 1000, (u64)pvt->tohm);
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TOHM: %u.%03u GB (0x%016Lx)",
++ gb, (mb*1000)/1024, (u64)pvt->tohm);
+
+ /*
+ * Step 2) Get SAD range and SAD Interleave list
+@@ -715,10 +719,11 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+
+ tmp_mb = (limit + 1) >> 20;
+- debugf0("SAD#%d %s up to %Lu.%03Lu GB (0x%016Lx) %s reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1000, &mb);
++ debugf0("SAD#%d %s up to %u.%03u GB (0x%016Lx) %s reg=0x%08x\n",
+ n_sads,
+ get_dram_attr(reg),
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ INTERLEAVE_MODE(reg) ? "Interleave: 8:6" : "Interleave: [8:6]XOR[18:16]",
+ reg);
+@@ -748,8 +753,9 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ break;
+ tmp_mb = (limit + 1) >> 20;
+
+- debugf0("TAD#%d: up to %Lu.%03Lu GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
+- n_tads, tmp_mb / 1000, tmp_mb % 1000,
++ gb = div_u64_rem(tmp_mb, 1000, &mb);
++ debugf0("TAD#%d: up to %u.%03u GB (0x%016Lx), socket interleave %d, memory interleave %d, TGT: %d, %d, %d, %d, reg=0x%08x\n",
++ n_tads, gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)TAD_SOCK(reg),
+ (u32)TAD_CH(reg),
+@@ -772,9 +778,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ tad_ch_nilv_offset[j],
+ ®);
+ tmp_mb = TAD_OFFSET(reg) >> 20;
+- debugf0("TAD CH#%d, offset #%d: %Lu.%03Lu GB (0x%016Lx), reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("TAD CH#%d, offset #%d: %u.%03u GB (0x%016Lx), reg=0x%08x\n",
+ i, j,
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ reg);
+ }
+@@ -796,9 +803,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+
+ tmp_mb = RIR_LIMIT(reg) >> 20;
+ rir_way = 1 << RIR_WAY(reg);
+- debugf0("CH#%d RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d, reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("CH#%d RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d, reg=0x%08x\n",
+ i, j,
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ rir_way,
+ reg);
+@@ -809,9 +817,10 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
+ ®);
+ tmp_mb = RIR_OFFSET(reg) << 6;
+
+- debugf0("CH#%d RIR#%d INTL#%d, offset %Lu.%03Lu GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
++ gb = div_u64_rem(tmp_mb, 1024, &mb);
++ debugf0("CH#%d RIR#%d INTL#%d, offset %u.%03u GB (0x%016Lx), tgt: %d, reg=0x%08x\n",
+ i, j, k,
+- tmp_mb / 1000, tmp_mb % 1000,
++ gb, (mb*1000)/1024,
+ ((u64)tmp_mb) << 20L,
+ (u32)RIR_RNK_TGT(reg),
+ reg);
+@@ -849,6 +858,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ u8 ch_way,sck_way;
+ u32 tad_offset;
+ u32 rir_way;
++ u32 gb, mb;
+ u64 ch_addr, offset, limit, prv = 0;
+
+
+@@ -859,7 +869,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ * range (e. g. VGA addresses). It is unlikely, however, that the
+ * memory controller would generate an error on that range.
+ */
+- if ((addr > (u64) pvt->tolm) && (addr < (1L << 32))) {
++ if ((addr > (u64) pvt->tolm) && (addr < (1LL << 32))) {
+ sprintf(msg, "Error at TOLM area, on addr 0x%08Lx", addr);
+ edac_mc_handle_ce_no_info(mci, msg);
+ return -EINVAL;
+@@ -1054,7 +1064,7 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ ch_addr = addr & 0x7f;
+ /* Remove socket wayness and remove 6 bits */
+ addr >>= 6;
+- addr /= sck_xch;
++ addr = div_u64(addr, sck_xch);
+ #if 0
+ /* Divide by channel way */
+ addr = addr / ch_way;
+@@ -1074,10 +1084,10 @@ static int get_memory_error_data(struct mem_ctl_info *mci,
+ continue;
+
+ limit = RIR_LIMIT(reg);
+-
+- debugf0("RIR#%d, limit: %Lu.%03Lu GB (0x%016Lx), way: %d\n",
++ gb = div_u64_rem(limit >> 20, 1024, &mb);
++ debugf0("RIR#%d, limit: %u.%03u GB (0x%016Lx), way: %d\n",
+ n_rir,
+- (limit >> 20) / 1000, (limit >> 20) % 1000,
++ gb, (mb*1000)/1024,
+ limit,
+ 1 << RIR_WAY(reg));
+ if (ch_addr <= limit)
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 2861ef4..20f7daa 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -410,24 +410,48 @@ static void __init dmi_dump_ids(void)
+ printk(KERN_CONT "\n");
+ }
+
+-static int __init dmi_present(const char __iomem *p)
++static int __init dmi_present(const u8 *buf)
+ {
+- u8 buf[15];
++ int smbios_ver;
+
+- memcpy_fromio(buf, p, 15);
+- if (dmi_checksum(buf, 15)) {
++ if (memcmp(buf, "_SM_", 4) == 0 &&
++ buf[5] < 32 && dmi_checksum(buf, buf[5])) {
++ smbios_ver = (buf[6] << 8) + buf[7];
++
++ /* Some BIOS report weird SMBIOS version, fix that up */
++ switch (smbios_ver) {
++ case 0x021F:
++ case 0x0221:
++ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
++ smbios_ver & 0xFF, 3);
++ smbios_ver = 0x0203;
++ break;
++ case 0x0233:
++ pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
++ smbios_ver = 0x0206;
++ break;
++ }
++ } else {
++ smbios_ver = 0;
++ }
++
++ buf += 16;
++
++ if (memcmp(buf, "_DMI_", 5) == 0 && dmi_checksum(buf, 15)) {
++ if (smbios_ver)
++ dmi_ver = smbios_ver;
++ else
++ dmi_ver = (buf[14] & 0xF0) << 4 | (buf[14] & 0x0F);
+ dmi_num = (buf[13] << 8) | buf[12];
+ dmi_len = (buf[7] << 8) | buf[6];
+ dmi_base = (buf[11] << 24) | (buf[10] << 16) |
+ (buf[9] << 8) | buf[8];
+
+ if (dmi_walk_early(dmi_decode) == 0) {
+- if (dmi_ver)
++ if (smbios_ver) {
+ pr_info("SMBIOS %d.%d present.\n",
+ dmi_ver >> 8, dmi_ver & 0xFF);
+- else {
+- dmi_ver = (buf[14] & 0xF0) << 4 |
+- (buf[14] & 0x0F);
++ } else {
+ pr_info("Legacy DMI %d.%d present.\n",
+ dmi_ver >> 8, dmi_ver & 0xFF);
+ }
+@@ -435,40 +459,14 @@ static int __init dmi_present(const char __iomem *p)
+ return 0;
+ }
+ }
+- dmi_ver = 0;
+- return 1;
+-}
+
+-static int __init smbios_present(const char __iomem *p)
+-{
+- u8 buf[32];
+-
+- memcpy_fromio(buf, p, 32);
+- if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+- dmi_ver = (buf[6] << 8) + buf[7];
+-
+- /* Some BIOS report weird SMBIOS version, fix that up */
+- switch (dmi_ver) {
+- case 0x021F:
+- case 0x0221:
+- pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
+- dmi_ver & 0xFF, 3);
+- dmi_ver = 0x0203;
+- break;
+- case 0x0233:
+- pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
+- dmi_ver = 0x0206;
+- break;
+- }
+- return memcmp(p + 16, "_DMI_", 5) || dmi_present(p + 16);
+- }
+ return 1;
+ }
+
+ void __init dmi_scan_machine(void)
+ {
+ char __iomem *p, *q;
+- int rc;
++ char buf[32];
+
+ if (efi_enabled(EFI_CONFIG_TABLES)) {
+ if (efi.smbios == EFI_INVALID_TABLE_ADDR)
+@@ -481,10 +479,10 @@ void __init dmi_scan_machine(void)
+ p = dmi_ioremap(efi.smbios, 32);
+ if (p == NULL)
+ goto error;
+-
+- rc = smbios_present(p);
++ memcpy_fromio(buf, p, 32);
+ dmi_iounmap(p, 32);
+- if (!rc) {
++
++ if (!dmi_present(buf)) {
+ dmi_available = 1;
+ goto out;
+ }
+@@ -499,18 +497,15 @@ void __init dmi_scan_machine(void)
+ if (p == NULL)
+ goto error;
+
++ memset(buf, 0, 16);
+ for (q = p; q < p + 0x10000; q += 16) {
+- if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
+- rc = smbios_present(q);
+- else if (memcmp(q, "_DMI_", 5) == 0)
+- rc = dmi_present(q);
+- else
+- continue;
+- if (!rc) {
++ memcpy_fromio(buf + 16, q, 16);
++ if (!dmi_present(buf)) {
+ dmi_available = 1;
+ dmi_iounmap(p, 0x10000);
+ goto out;
+ }
++ memcpy(buf, buf + 16, 16);
+ }
+ dmi_iounmap(p, 0x10000);
+ }
+diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
+index 36ae055..e901fef 100644
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -726,6 +726,7 @@ static struct class gpio_class = {
+ */
+ int gpio_export(unsigned gpio, bool direction_may_change)
+ {
++ struct gpio_chip *chip;
+ unsigned long flags;
+ struct gpio_desc *desc;
+ int status;
+@@ -743,10 +744,18 @@ int gpio_export(unsigned gpio, bool direction_may_change)
+ return -EINVAL;
+ }
+
++ desc = &gpio_desc[gpio];
++ chip = desc->chip;
++
+ mutex_lock(&sysfs_lock);
+
++ /* check if chip is being removed */
++ if (!chip || !chip->exported) {
++ status = -ENODEV;
++ goto fail_unlock;
++ }
++
+ spin_lock_irqsave(&gpio_lock, flags);
+- desc = &gpio_desc[gpio];
+ if (!test_bit(FLAG_REQUESTED, &desc->flags) ||
+ test_bit(FLAG_EXPORT, &desc->flags)) {
+ spin_unlock_irqrestore(&gpio_lock, flags);
+@@ -973,12 +982,15 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ {
+ int status;
+ struct device *dev;
++ struct gpio_desc *desc;
++ unsigned int i;
+
+ mutex_lock(&sysfs_lock);
+ dev = class_find_device(&gpio_class, NULL, chip, match_export);
+ if (dev) {
+ put_device(dev);
+ device_unregister(dev);
++ /* prevent further gpiod exports */
+ chip->exported = 0;
+ status = 0;
+ } else
+@@ -988,6 +1000,13 @@ static void gpiochip_unexport(struct gpio_chip *chip)
+ if (status)
+ pr_debug("%s: chip %s status %d\n", __func__,
+ chip->label, status);
++
++ /* unregister gpio class devices owned by sysfs */
++ for (i = 0; i < chip->ngpio; i++) {
++ desc = &gpio_desc[chip->base + i];
++ if (test_and_clear_bit(FLAG_SYSFS, &desc->flags))
++ gpio_free(chip->base + i);
++ }
+ }
+
+ static int __init gpiolib_sysfs_init(void)
+@@ -1137,6 +1156,8 @@ int gpiochip_remove(struct gpio_chip *chip)
+ int status = 0;
+ unsigned id;
+
++ gpiochip_unexport(chip);
++
+ spin_lock_irqsave(&gpio_lock, flags);
+
+ of_gpiochip_remove(chip);
+@@ -1154,9 +1175,6 @@ int gpiochip_remove(struct gpio_chip *chip)
+
+ spin_unlock_irqrestore(&gpio_lock, flags);
+
+- if (status == 0)
+- gpiochip_unexport(chip);
+-
+ return status;
+ }
+ EXPORT_SYMBOL_GPL(gpiochip_remove);
+diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
+index 927d170..76c4f2a 100644
+--- a/drivers/gpu/drm/radeon/atombios_crtc.c
++++ b/drivers/gpu/drm/radeon/atombios_crtc.c
+@@ -302,8 +302,10 @@ atombios_set_crtc_dtd_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+@@ -346,8 +348,10 @@ static void atombios_crtc_set_timing(struct drm_crtc *crtc,
+ misc |= ATOM_COMPOSITESYNC;
+ if (mode->flags & DRM_MODE_FLAG_INTERLACE)
+ misc |= ATOM_INTERLACE;
+- if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ if (mode->flags & DRM_MODE_FLAG_DBLCLK)
+ misc |= ATOM_DOUBLE_CLOCK_MODE;
++ if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
++ misc |= ATOM_H_REPLICATIONBY2 | ATOM_V_REPLICATIONBY2;
+
+ args.susModeMiscInfo.usAccess = cpu_to_le16(misc);
+ args.ucCRTC = radeon_crtc->crtc_id;
+diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
+index 44a1ea4..a7e6f03 100644
+--- a/drivers/hv/channel.c
++++ b/drivers/hv/channel.c
+@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+ GFP_KERNEL);
+ if (!open_info) {
+ err = -ENOMEM;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ init_completion(&open_info->waitevent);
+@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size,
+
+ if (userdatalen > MAX_USER_DEFINED_BYTES) {
+ err = -EINVAL;
+- goto error0;
++ goto error_gpadl;
+ }
+
+ if (userdatalen)
+@@ -234,6 +234,9 @@ error1:
+ list_del(&open_info->msglistentry);
+ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags);
+
++error_gpadl:
++ vmbus_teardown_gpadl(newchannel, newchannel->ringbuffer_gpadlhandle);
++
+ error0:
+ free_pages((unsigned long)out,
+ get_order(send_ringbuffer_size + recv_ringbuffer_size));
+diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c
+index 12b85ff..7f963328b 100644
+--- a/drivers/hv/channel_mgmt.c
++++ b/drivers/hv/channel_mgmt.c
+@@ -606,7 +606,7 @@ int vmbus_request_offers(void)
+ {
+ struct vmbus_channel_message_header *msg;
+ struct vmbus_channel_msginfo *msginfo;
+- int ret, t;
++ int ret;
+
+ msginfo = kmalloc(sizeof(*msginfo) +
+ sizeof(struct vmbus_channel_message_header),
+@@ -614,8 +614,6 @@ int vmbus_request_offers(void)
+ if (!msginfo)
+ return -ENOMEM;
+
+- init_completion(&msginfo->waitevent);
+-
+ msg = (struct vmbus_channel_message_header *)msginfo->msg;
+
+ msg->msgtype = CHANNELMSG_REQUESTOFFERS;
+@@ -629,14 +627,6 @@ int vmbus_request_offers(void)
+ goto cleanup;
+ }
+
+- t = wait_for_completion_timeout(&msginfo->waitevent, 5*HZ);
+- if (t == 0) {
+- ret = -ETIMEDOUT;
+- goto cleanup;
+- }
+-
+-
+-
+ cleanup:
+ kfree(msginfo);
+
+diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
+index 055ebeb..c1fef27 100644
+--- a/drivers/infiniband/core/umem.c
++++ b/drivers/infiniband/core/umem.c
+@@ -94,12 +94,15 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
+ if (dmasync)
+ dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
+
++ if (!size)
++ return ERR_PTR(-EINVAL);
++
+ /*
+ * If the combination of the addr and size requested for this memory
+ * region causes an integer overflow, return error.
+ */
+- if ((PAGE_ALIGN(addr + size) <= size) ||
+- (PAGE_ALIGN(addr + size) <= addr))
++ if (((addr + size) < addr) ||
++ PAGE_ALIGN(addr + size) < (addr + size))
+ return ERR_PTR(-EINVAL);
+
+ if (!can_do_mlock())
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index a16f0c8..2ed14a7 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1670,8 +1670,7 @@ static int build_lso_seg(struct mlx4_wqe_lso_seg *wqe, struct ib_send_wr *wr,
+
+ memcpy(wqe->header, wr->wr.ud.header, wr->wr.ud.hlen);
+
+- *lso_hdr_sz = cpu_to_be32((wr->wr.ud.mss - wr->wr.ud.hlen) << 16 |
+- wr->wr.ud.hlen);
++ *lso_hdr_sz = cpu_to_be32(wr->wr.ud.mss << 16 | wr->wr.ud.hlen);
+ *lso_seg_len = halign;
+ return 0;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 2d5bb5b..548ea99 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -296,7 +296,7 @@ static void elantech_report_semi_mt_data(struct input_dev *dev,
+ unsigned int x2, unsigned int y2)
+ {
+ elantech_set_slot(dev, 0, num_fingers != 0, x1, y1);
+- elantech_set_slot(dev, 1, num_fingers == 2, x2, y2);
++ elantech_set_slot(dev, 1, num_fingers >= 2, x2, y2);
+ }
+
+ /*
+@@ -692,18 +692,18 @@ static int elantech_packet_check_v3(struct psmouse *psmouse)
+ static int elantech_packet_check_v4(struct psmouse *psmouse)
+ {
+ unsigned char *packet = psmouse->packet;
++ unsigned char packet_type = packet[3] & 0x03;
+
+- if ((packet[0] & 0x0c) == 0x04 &&
+- (packet[3] & 0x1f) == 0x11)
++ switch (packet_type) {
++ case 0:
++ return PACKET_V4_STATUS;
++
++ case 1:
+ return PACKET_V4_HEAD;
+
+- if ((packet[0] & 0x0c) == 0x04 &&
+- (packet[3] & 0x1f) == 0x12)
++ case 2:
+ return PACKET_V4_MOTION;
+-
+- if ((packet[0] & 0x0c) == 0x04 &&
+- (packet[3] & 0x1f) == 0x10)
+- return PACKET_V4_STATUS;
++ }
+
+ return PACKET_UNKNOWN;
+ }
+@@ -766,6 +766,21 @@ static psmouse_ret_t elantech_process_byte(struct psmouse *psmouse)
+ }
+
+ /*
++ * This writes the reg_07 value again to the hardware at the end of every
++ * set_rate call because the register loses its value. reg_07 allows setting
++ * absolute mode on v4 hardware
++ */
++static void elantech_set_rate_restore_reg_07(struct psmouse *psmouse,
++ unsigned int rate)
++{
++ struct elantech_data *etd = psmouse->private;
++
++ etd->original_set_rate(psmouse, rate);
++ if (elantech_write_reg(psmouse, 0x07, etd->reg_07))
++ psmouse_err(psmouse, "restoring reg_07 failed\n");
++}
++
++/*
+ * Put the touchpad into absolute mode
+ */
+ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+@@ -1131,10 +1146,11 @@ static bool elantech_is_signature_valid(const unsigned char *param)
+ return true;
+
+ /*
+- * Some models have a revision higher then 20. Meaning param[2] may
+- * be 10 or 20, skip the rates check for these.
++ * Some hw_version >= 4 models have a revision higher then 20. Meaning
++ * that param[2] may be 10 or 20, skip the rates check for these.
+ */
+- if (param[0] == 0x46 && (param[1] & 0xef) == 0x0f && param[2] < 40)
++ if ((param[0] & 0x0f) >= 0x06 && (param[1] & 0xaf) == 0x0f &&
++ param[2] < 40)
+ return true;
+
+ for (i = 0; i < ARRAY_SIZE(rates); i++)
+@@ -1269,6 +1285,12 @@ static int elantech_set_properties(struct elantech_data *etd)
+ etd->hw_version = 3;
+ break;
+ case 6:
++ case 7:
++ case 8:
++ case 9:
++ case 10:
++ case 13:
++ case 14:
+ etd->hw_version = 4;
+ break;
+ default:
+@@ -1353,6 +1375,11 @@ int elantech_init(struct psmouse *psmouse)
+ goto init_fail;
+ }
+
++ if (etd->fw_version == 0x381f17) {
++ etd->original_set_rate = psmouse->set_rate;
++ psmouse->set_rate = elantech_set_rate_restore_reg_07;
++ }
++
+ if (elantech_set_input_params(psmouse)) {
+ psmouse_err(psmouse, "failed to query touchpad range.\n");
+ goto init_fail;
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 3569bed..092ac72 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -136,6 +136,7 @@ struct elantech_data {
+ unsigned int width;
+ struct finger_pos mt[ETP_MAX_FINGERS];
+ unsigned char parity[256];
++ void (*original_set_rate)(struct psmouse *psmouse, unsigned int rate);
+ };
+
+ #ifdef CONFIG_MOUSE_PS2_ELANTECH
+diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
+index b5fdcb7..34842e5 100644
+--- a/drivers/lguest/core.c
++++ b/drivers/lguest/core.c
+@@ -171,7 +171,7 @@ static void unmap_switcher(void)
+ bool lguest_address_ok(const struct lguest *lg,
+ unsigned long addr, unsigned long len)
+ {
+- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
++ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
+ }
+
+ /*
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c293d9c..6056ee7 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -1554,7 +1554,8 @@ static int resize_stripes(struct r5conf *conf, int newsize)
+
+ conf->slab_cache = sc;
+ conf->active_name = 1-conf->active_name;
+- conf->pool_size = newsize;
++ if (!err)
++ conf->pool_size = newsize;
+ return err;
+ }
+
+diff --git a/drivers/memstick/core/mspro_block.c b/drivers/memstick/core/mspro_block.c
+index 9729b92..f8449d5 100644
+--- a/drivers/memstick/core/mspro_block.c
++++ b/drivers/memstick/core/mspro_block.c
+@@ -760,7 +760,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+
+ if (error || (card->current_mrq.tpc == MSPRO_CMD_STOP)) {
+ if (msb->data_dir == READ) {
+- for (cnt = 0; cnt < msb->current_seg; cnt++)
++ for (cnt = 0; cnt < msb->current_seg; cnt++) {
+ t_len += msb->req_sg[cnt].length
+ / msb->page_size;
+
+@@ -768,6 +768,7 @@ static int mspro_block_complete_req(struct memstick_dev *card, int error)
+ t_len += msb->current_page - 1;
+
+ t_len *= msb->page_size;
++ }
+ }
+ } else
+ t_len = blk_rq_bytes(msb->block_req);
+diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
+index 411a994..fc7386e 100644
+--- a/drivers/mmc/core/core.c
++++ b/drivers/mmc/core/core.c
+@@ -2424,6 +2424,7 @@ int mmc_pm_notify(struct notifier_block *notify_block,
+ switch (mode) {
+ case PM_HIBERNATION_PREPARE:
+ case PM_SUSPEND_PREPARE:
++ case PM_RESTORE_PREPARE:
+
+ spin_lock_irqsave(&host->lock, flags);
+ host->rescan_disable = 1;
+diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
+index ad76592..7ac2c05 100644
+--- a/drivers/mtd/ubi/cdev.c
++++ b/drivers/mtd/ubi/cdev.c
+@@ -475,7 +475,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
+ /* Validate the request */
+ err = -EINVAL;
+ if (req.lnum < 0 || req.lnum >= vol->reserved_pebs ||
+- req.bytes < 0 || req.lnum >= vol->usable_leb_size)
++ req.bytes < 0 || req.bytes > vol->usable_leb_size)
+ break;
+ if (req.dtype != UBI_LONGTERM && req.dtype != UBI_SHORTTERM &&
+ req.dtype != UBI_UNKNOWN)
+diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
+index cd26da8..22b3636 100644
+--- a/drivers/mtd/ubi/eba.c
++++ b/drivers/mtd/ubi/eba.c
+@@ -1261,7 +1261,8 @@ int ubi_eba_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
+ * during re-size.
+ */
+ ubi_scan_move_to_list(sv, seb, &si->erase);
+- vol->eba_tbl[seb->lnum] = seb->pnum;
++ else
++ vol->eba_tbl[seb->lnum] = seb->pnum;
+ }
+ }
+
+diff --git a/drivers/mtd/ubi/misc.c b/drivers/mtd/ubi/misc.c
+index f6a7d7a..b14ab43 100644
+--- a/drivers/mtd/ubi/misc.c
++++ b/drivers/mtd/ubi/misc.c
+@@ -74,6 +74,8 @@ int ubi_check_volume(struct ubi_device *ubi, int vol_id)
+ for (i = 0; i < vol->used_ebs; i++) {
+ int size;
+
++ cond_resched();
++
+ if (i == vol->used_ebs - 1)
+ size = vol->last_eb_bytes;
+ else
+diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
+index b2b62de..c5b2357 100644
+--- a/drivers/mtd/ubi/scan.c
++++ b/drivers/mtd/ubi/scan.c
+@@ -408,7 +408,7 @@ static int compare_lebs(struct ubi_device *ubi, const struct ubi_scan_leb *seb,
+ second_is_newer = !second_is_newer;
+ } else {
+ dbg_bld("PEB %d CRC is OK", pnum);
+- bitflips = !!err;
++ bitflips |= !!err;
+ }
+
+ vfree(buf);
+diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
+index cf42971..422e5be 100644
+--- a/drivers/mtd/ubi/wl.c
++++ b/drivers/mtd/ubi/wl.c
+@@ -665,7 +665,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
+ int cancel)
+ {
+ int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+- int vol_id = -1, uninitialized_var(lnum);
++ int vol_id = -1, lnum = -1;
+ struct ubi_wl_entry *e1, *e2;
+ struct ubi_vid_hdr *vid_hdr;
+
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index 6546191..bd4e598 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -149,6 +149,11 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
+ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int *work_done, int work_to_do);
++static void e1000_alloc_dummy_rx_buffers(struct e1000_adapter *adapter,
++ struct e1000_rx_ring *rx_ring,
++ int cleaned_count)
++{
++}
+ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
+ struct e1000_rx_ring *rx_ring,
+ int cleaned_count);
+@@ -3322,8 +3327,11 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
+ msleep(1);
+ /* e1000_down has a dependency on max_frame_size */
+ hw->max_frame_size = max_frame;
+- if (netif_running(netdev))
++ if (netif_running(netdev)) {
++ /* prevent buffers from being reallocated */
++ adapter->alloc_rx_buf = e1000_alloc_dummy_rx_buffers;
+ e1000_down(adapter);
++ }
+
+ /* NOTE: netdev_alloc_skb reserves 16 bytes, and typically NET_IP_ALIGN
+ * means we reserve 2 more, this pushes us to allocate from the next
+diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
+index 9663e0b..bb335ab 100644
+--- a/drivers/net/phy/dp83640.c
++++ b/drivers/net/phy/dp83640.c
+@@ -42,7 +42,7 @@
+ #define PSF_TX 0x1000
+ #define EXT_EVENT 1
+ #define CAL_EVENT 7
+-#define CAL_TRIGGER 7
++#define CAL_TRIGGER 1
+ #define PER_TRIGGER 6
+
+ /* phyter seems to miss the mark by 16 ns */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+index 1644b1f..ec347d2 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+@@ -367,6 +367,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
+ {RTL_USB_DEVICE(0x2001, 0x3307, rtl92cu_hal_cfg)}, /*D-Link-Cameo*/
+ {RTL_USB_DEVICE(0x2001, 0x3309, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
+ {RTL_USB_DEVICE(0x2001, 0x330a, rtl92cu_hal_cfg)}, /*D-Link-Alpha*/
++ {RTL_USB_DEVICE(0x2001, 0x330d, rtl92cu_hal_cfg)}, /*D-Link DWA-131 */
+ {RTL_USB_DEVICE(0x2019, 0xab2b, rtl92cu_hal_cfg)}, /*Planex -Abocom*/
+ {RTL_USB_DEVICE(0x20f4, 0x624d, rtl92cu_hal_cfg)}, /*TRENDNet*/
+ {RTL_USB_DEVICE(0x2357, 0x0100, rtl92cu_hal_cfg)}, /*TP-Link WN8200ND*/
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index e5fe956..17e6429 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -117,7 +117,7 @@ static int _usbctrl_vendorreq_sync_read(struct usb_device *udev, u8 request,
+ reqtype = REALTEK_USB_VENQT_READ;
+
+ status = usb_control_msg(udev, pipe, request, reqtype, value, index,
+- pdata, len, 0); /* max. timeout */
++ pdata, len, 1000);
+
+ if (status < 0)
+ pr_err("reg 0x%x, usbctrl_vendorreq TimeOut! status:0x%x value=0x%x\n",
+diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
+index 1ce729d..b7d782f 100644
+--- a/drivers/net/xen-netback/xenbus.c
++++ b/drivers/net/xen-netback/xenbus.c
+@@ -27,6 +27,8 @@ struct backend_info {
+ enum xenbus_state frontend_state;
+ struct xenbus_watch hotplug_status_watch;
+ u8 have_hotplug_status_watch:1;
++
++ const char *hotplug_script;
+ };
+
+ static int connect_rings(struct backend_info *);
+@@ -45,6 +47,7 @@ static int netback_remove(struct xenbus_device *dev)
+ xenvif_disconnect(be->vif);
+ be->vif = NULL;
+ }
++ kfree(be->hotplug_script);
+ kfree(be);
+ dev_set_drvdata(&dev->dev, NULL);
+ return 0;
+@@ -62,6 +65,7 @@ static int netback_probe(struct xenbus_device *dev,
+ struct xenbus_transaction xbt;
+ int err;
+ int sg;
++ const char *script;
+ struct backend_info *be = kzalloc(sizeof(struct backend_info),
+ GFP_KERNEL);
+ if (!be) {
+@@ -122,6 +126,15 @@ static int netback_probe(struct xenbus_device *dev,
+ goto fail;
+ }
+
++ script = xenbus_read(XBT_NIL, dev->nodename, "script", NULL);
++ if (IS_ERR(script)) {
++ err = PTR_ERR(script);
++ xenbus_dev_fatal(dev, err, "reading script");
++ goto fail;
++ }
++
++ be->hotplug_script = script;
++
+ err = xenbus_switch_state(dev, XenbusStateInitWait);
+ if (err)
+ goto fail;
+@@ -150,22 +163,14 @@ static int netback_uevent(struct xenbus_device *xdev,
+ struct kobj_uevent_env *env)
+ {
+ struct backend_info *be = dev_get_drvdata(&xdev->dev);
+- char *val;
+
+- val = xenbus_read(XBT_NIL, xdev->nodename, "script", NULL);
+- if (IS_ERR(val)) {
+- int err = PTR_ERR(val);
+- xenbus_dev_fatal(xdev, err, "reading script");
+- return err;
+- } else {
+- if (add_uevent_var(env, "script=%s", val)) {
+- kfree(val);
+- return -ENOMEM;
+- }
+- kfree(val);
+- }
++ if (!be)
++ return 0;
++
++ if (add_uevent_var(env, "script=%s", be->hotplug_script))
++ return -ENOMEM;
+
+- if (!be || !be->vif)
++ if (!be->vif)
+ return 0;
+
+ return add_uevent_var(env, "vif=%s", be->vif->dev->name);
+diff --git a/drivers/of/base.c b/drivers/of/base.c
+index 37639a6..21935580 100644
+--- a/drivers/of/base.c
++++ b/drivers/of/base.c
+@@ -761,6 +761,42 @@ int of_property_read_string_index(struct device_node *np, const char *propname,
+ }
+ EXPORT_SYMBOL_GPL(of_property_read_string_index);
+
++/**
++ * of_property_match_string() - Find string in a list and return index
++ * @np: pointer to node containing string list property
++ * @propname: string list property name
++ * @string: pointer to string to search for in string list
++ *
++ * This function searches a string list property and returns the index
++ * of a specific string value.
++ */
++int of_property_match_string(struct device_node *np, const char *propname,
++ const char *string)
++{
++ struct property *prop = of_find_property(np, propname, NULL);
++ size_t l;
++ int i;
++ const char *p, *end;
++
++ if (!prop)
++ return -EINVAL;
++ if (!prop->value)
++ return -ENODATA;
++
++ p = prop->value;
++ end = p + prop->length;
++
++ for (i = 0; p < end; i++, p += l) {
++ l = strlen(p) + 1;
++ if (p + l > end)
++ return -EILSEQ;
++ pr_debug("comparing %s with %s\n", string, p);
++ if (strcmp(string, p) == 0)
++ return i; /* Found it; return index */
++ }
++ return -ENODATA;
++}
++EXPORT_SYMBOL_GPL(of_property_match_string);
+
+ /**
+ * of_property_count_strings - Find and return the number of strings from a
+diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
+index 8877b83..ba3638e 100644
+--- a/drivers/platform/x86/compal-laptop.c
++++ b/drivers/platform/x86/compal-laptop.c
+@@ -1046,7 +1046,14 @@ static int __devinit compal_probe(struct platform_device *pdev)
+
+ /* Power supply */
+ initialize_power_supply_data(data);
+- power_supply_register(&compal_device->dev, &data->psy);
++ err = power_supply_register(&compal_device->dev, &data->psy);
++ if (err < 0) {
++ hwmon_device_unregister(data->hwmon_dev);
++ sysfs_remove_group(&pdev->dev.kobj,
++ &compal_attribute_group);
++ kfree(data);
++ return err;
++ }
+
+ platform_set_drvdata(pdev, data);
+
+diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
+index 3868ab2..fb37df6 100644
+--- a/drivers/scsi/3w-9xxx.c
++++ b/drivers/scsi/3w-9xxx.c
+@@ -149,7 +149,6 @@ static int twa_reset_sequence(TW_Device_Extension *tw_dev, int soft_reset);
+ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry *sglistarg);
+ static void twa_scsiop_execute_scsi_complete(TW_Device_Extension *tw_dev, int request_id);
+ static char *twa_string_lookup(twa_message_type *table, unsigned int aen_code);
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id);
+
+ /* Functions */
+
+@@ -1352,11 +1351,11 @@ static irqreturn_t twa_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twa_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for valid status after each drain */
+@@ -1414,26 +1413,6 @@ static void twa_load_sgl(TW_Device_Extension *tw_dev, TW_Command_Full *full_comm
+ }
+ } /* End twa_load_sgl() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twa_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twa_map_scsi_sg_data() */
+-
+ /* This function will poll for a response interrupt of a request */
+ static int twa_poll_response(TW_Device_Extension *tw_dev, int request_id, int seconds)
+ {
+@@ -1612,9 +1591,11 @@ static int twa_reset_device_extension(TW_Device_Extension *tw_dev)
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+ if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twa_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1793,21 +1774,18 @@ static int twa_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twa_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ switch (retval) {
+ case SCSI_MLQUEUE_HOST_BUSY:
++ scsi_dma_unmap(SCpnt);
+ twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ break;
+ case 1:
+- tw_dev->state[request_id] = TW_S_COMPLETED;
+- twa_free_request_id(tw_dev, request_id);
+- twa_unmap_scsi_data(tw_dev, request_id);
+ SCpnt->result = (DID_ERROR << 16);
++ scsi_dma_unmap(SCpnt);
+ done(SCpnt);
++ tw_dev->state[request_id] = TW_S_COMPLETED;
++ twa_free_request_id(tw_dev, request_id);
+ retval = 0;
+ }
+ out:
+@@ -1875,8 +1853,8 @@ static int twa_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ command_packet->sg_list[0].address = TW_CPU_TO_SGL(tw_dev->generic_buffer_phys[request_id]);
+ command_packet->sg_list[0].length = cpu_to_le32(TW_MIN_SGL_LENGTH);
+ } else {
+- sg_count = twa_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count < 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1991,15 +1969,6 @@ static char *twa_string_lookup(twa_message_type *table, unsigned int code)
+ return(table[index].text);
+ } /* End twa_string_lookup() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twa_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twa_unmap_scsi_data() */
+-
+ /* This function gets called when a disk is coming on-line */
+ static int twa_slave_configure(struct scsi_device *sdev)
+ {
+diff --git a/drivers/scsi/3w-9xxx.h b/drivers/scsi/3w-9xxx.h
+index 040f721..0fdc83c 100644
+--- a/drivers/scsi/3w-9xxx.h
++++ b/drivers/scsi/3w-9xxx.h
+@@ -324,11 +324,6 @@ static twa_message_type twa_error_table[] = {
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_9550SX_DRAIN_COMPLETED 0xFFFF
+ #define TW_SECTOR_SIZE 512
+diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
+index 13e39e1..c555ccb 100644
+--- a/drivers/scsi/3w-sas.c
++++ b/drivers/scsi/3w-sas.c
+@@ -303,26 +303,6 @@ static int twl_post_command_packet(TW_Device_Extension *tw_dev, int request_id)
+ return 0;
+ } /* End twl_post_command_packet() */
+
+-/* This function will perform a pci-dma mapping for a scatter gather list */
+-static int twl_map_scsi_sg_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- int use_sg;
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- use_sg = scsi_dma_map(cmd);
+- if (!use_sg)
+- return 0;
+- else if (use_sg < 0) {
+- TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1, "Failed to map scatter gather list");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End twl_map_scsi_sg_data() */
+-
+ /* This function hands scsi cdb's to the firmware */
+ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id, char *cdb, int use_sg, TW_SG_Entry_ISO *sglistarg)
+ {
+@@ -370,8 +350,8 @@ static int twl_scsiop_execute_scsi(TW_Device_Extension *tw_dev, int request_id,
+ if (!sglistarg) {
+ /* Map sglist from scsi layer to cmd packet */
+ if (scsi_sg_count(srb)) {
+- sg_count = twl_map_scsi_sg_data(tw_dev, request_id);
+- if (sg_count == 0)
++ sg_count = scsi_dma_map(srb);
++ if (sg_count <= 0)
+ goto out;
+
+ scsi_for_each_sg(srb, sg, sg_count, i) {
+@@ -1116,15 +1096,6 @@ out:
+ return retval;
+ } /* End twl_initialize_device_extension() */
+
+-/* This function will perform a pci-dma unmap */
+-static void twl_unmap_scsi_data(TW_Device_Extension *tw_dev, int request_id)
+-{
+- struct scsi_cmnd *cmd = tw_dev->srb[request_id];
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End twl_unmap_scsi_data() */
+-
+ /* This function will handle attention interrupts */
+ static int twl_handle_attention_interrupt(TW_Device_Extension *tw_dev)
+ {
+@@ -1265,11 +1236,11 @@ static irqreturn_t twl_interrupt(int irq, void *dev_instance)
+ }
+
+ /* Now complete the io */
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ twl_free_request_id(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+- twl_unmap_scsi_data(tw_dev, request_id);
+ }
+
+ /* Check for another response interrupt */
+@@ -1414,10 +1385,12 @@ static int twl_reset_device_extension(TW_Device_Extension *tw_dev, int ioctl_res
+ if ((tw_dev->state[i] != TW_S_FINISHED) &&
+ (tw_dev->state[i] != TW_S_INITIAL) &&
+ (tw_dev->state[i] != TW_S_COMPLETED)) {
+- if (tw_dev->srb[i]) {
+- tw_dev->srb[i]->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- twl_unmap_scsi_data(tw_dev, i);
++ struct scsi_cmnd *cmd = tw_dev->srb[i];
++
++ if (cmd) {
++ cmd->result = (DID_RESET << 16);
++ scsi_dma_unmap(cmd);
++ cmd->scsi_done(cmd);
+ }
+ }
+ }
+@@ -1521,9 +1494,6 @@ static int twl_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ retval = twl_scsiop_execute_scsi(tw_dev, request_id, NULL, 0, NULL);
+ if (retval) {
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+diff --git a/drivers/scsi/3w-sas.h b/drivers/scsi/3w-sas.h
+index d474892..fec6449 100644
+--- a/drivers/scsi/3w-sas.h
++++ b/drivers/scsi/3w-sas.h
+@@ -103,10 +103,6 @@ static char *twl_aen_severity_table[] =
+ #define TW_CURRENT_DRIVER_BUILD 0
+ #define TW_CURRENT_DRIVER_BRANCH 0
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_SECTOR_SIZE 512
+ #define TW_MAX_UNITS 32
+diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
+index 7fe96ff..86bc5f9 100644
+--- a/drivers/scsi/3w-xxxx.c
++++ b/drivers/scsi/3w-xxxx.c
+@@ -1283,32 +1283,6 @@ static int tw_initialize_device_extension(TW_Device_Extension *tw_dev)
+ return 0;
+ } /* End tw_initialize_device_extension() */
+
+-static int tw_map_scsi_sg_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- int use_sg;
+-
+- dprintk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data()\n");
+-
+- use_sg = scsi_dma_map(cmd);
+- if (use_sg < 0) {
+- printk(KERN_WARNING "3w-xxxx: tw_map_scsi_sg_data(): pci_map_sg() failed.\n");
+- return 0;
+- }
+-
+- cmd->SCp.phase = TW_PHASE_SGLIST;
+- cmd->SCp.have_data_in = use_sg;
+-
+- return use_sg;
+-} /* End tw_map_scsi_sg_data() */
+-
+-static void tw_unmap_scsi_data(struct pci_dev *pdev, struct scsi_cmnd *cmd)
+-{
+- dprintk(KERN_WARNING "3w-xxxx: tw_unmap_scsi_data()\n");
+-
+- if (cmd->SCp.phase == TW_PHASE_SGLIST)
+- scsi_dma_unmap(cmd);
+-} /* End tw_unmap_scsi_data() */
+-
+ /* This function will reset a device extension */
+ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ {
+@@ -1331,8 +1305,8 @@ static int tw_reset_device_extension(TW_Device_Extension *tw_dev)
+ srb = tw_dev->srb[i];
+ if (srb != NULL) {
+ srb->result = (DID_RESET << 16);
+- tw_dev->srb[i]->scsi_done(tw_dev->srb[i]);
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[i]);
++ scsi_dma_unmap(srb);
++ srb->scsi_done(srb);
+ }
+ }
+ }
+@@ -1779,8 +1753,8 @@ static int tw_scsiop_read_write(TW_Device_Extension *tw_dev, int request_id)
+ command_packet->byte8.io.lba = lba;
+ command_packet->byte6.block_count = num_sectors;
+
+- use_sg = tw_map_scsi_sg_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+- if (!use_sg)
++ use_sg = scsi_dma_map(srb);
++ if (use_sg <= 0)
+ return 1;
+
+ scsi_for_each_sg(tw_dev->srb[request_id], sg, use_sg, i) {
+@@ -1967,9 +1941,6 @@ static int tw_scsi_queue_lck(struct scsi_cmnd *SCpnt, void (*done)(struct scsi_c
+ /* Save the scsi command for use by the ISR */
+ tw_dev->srb[request_id] = SCpnt;
+
+- /* Initialize phase to zero */
+- SCpnt->SCp.phase = TW_PHASE_INITIAL;
+-
+ switch (*command) {
+ case READ_10:
+ case READ_6:
+@@ -2196,12 +2167,11 @@ static irqreturn_t tw_interrupt(int irq, void *dev_instance)
+
+ /* Now complete the io */
+ if ((error != TW_ISR_DONT_COMPLETE)) {
++ scsi_dma_unmap(tw_dev->srb[request_id]);
++ tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+ tw_dev->state[request_id] = TW_S_COMPLETED;
+ tw_state_request_finish(tw_dev, request_id);
+ tw_dev->posted_request_count--;
+- tw_dev->srb[request_id]->scsi_done(tw_dev->srb[request_id]);
+-
+- tw_unmap_scsi_data(tw_dev->tw_pci_dev, tw_dev->srb[request_id]);
+ }
+ }
+
+diff --git a/drivers/scsi/3w-xxxx.h b/drivers/scsi/3w-xxxx.h
+index 49dcf03..1d31858 100644
+--- a/drivers/scsi/3w-xxxx.h
++++ b/drivers/scsi/3w-xxxx.h
+@@ -195,11 +195,6 @@ static unsigned char tw_sense_table[][4] =
+ #define TW_AEN_SMART_FAIL 0x000F
+ #define TW_AEN_SBUF_FAIL 0x0024
+
+-/* Phase defines */
+-#define TW_PHASE_INITIAL 0
+-#define TW_PHASE_SINGLE 1
+-#define TW_PHASE_SGLIST 2
+-
+ /* Misc defines */
+ #define TW_ALIGNMENT_6000 64 /* 64 bytes */
+ #define TW_ALIGNMENT_7000 4 /* 4 bytes */
+diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+index bfd87fa..3e0f71c 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c
++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c
+@@ -1426,11 +1426,11 @@ megasas_build_ldio_fusion(struct megasas_instance *instance,
+ fp_possible = io_info.fpOkForIo;
+ }
+
+- /* Use smp_processor_id() for now until cmd->request->cpu is CPU
++ /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU
+ id by default, not CPU group id, otherwise all MSI-X queues won't
+ be utilized */
+ cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ?
+- smp_processor_id() % instance->msix_vectors : 0;
++ raw_smp_processor_id() % instance->msix_vectors : 0;
+
+ if (fp_possible) {
+ megasas_set_pd_lba(io_request, scp->cmd_len, &io_info, scp,
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 5c6b5f5..a50825b 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1338,6 +1338,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ {
+ u64 start_lba = blk_rq_pos(scmd->request);
+ u64 end_lba = blk_rq_pos(scmd->request) + (scsi_bufflen(scmd) / 512);
++ u64 factor = scmd->device->sector_size / 512;
+ u64 bad_lba;
+ int info_valid;
+ /*
+@@ -1359,16 +1360,9 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+ if (scsi_bufflen(scmd) <= scmd->device->sector_size)
+ return 0;
+
+- if (scmd->device->sector_size < 512) {
+- /* only legitimate sector_size here is 256 */
+- start_lba <<= 1;
+- end_lba <<= 1;
+- } else {
+- /* be careful ... don't want any overflows */
+- u64 factor = scmd->device->sector_size / 512;
+- do_div(start_lba, factor);
+- do_div(end_lba, factor);
+- }
++ /* be careful ... don't want any overflows */
++ do_div(start_lba, factor);
++ do_div(end_lba, factor);
+
+ /* The bad lba was reported incorrectly, we have no idea where
+ * the error is.
+@@ -1895,8 +1889,7 @@ got_data:
+ if (sector_size != 512 &&
+ sector_size != 1024 &&
+ sector_size != 2048 &&
+- sector_size != 4096 &&
+- sector_size != 256) {
++ sector_size != 4096) {
+ sd_printk(KERN_NOTICE, sdkp, "Unsupported sector size %d.\n",
+ sector_size);
+ /*
+@@ -1945,8 +1938,6 @@ got_data:
+ sdkp->capacity <<= 2;
+ else if (sector_size == 1024)
+ sdkp->capacity <<= 1;
+- else if (sector_size == 256)
+- sdkp->capacity >>= 1;
+
+ blk_queue_physical_block_size(sdp->request_queue,
+ sdkp->physical_block_size);
+diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
+index 2d25616..b4cac39 100644
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
+ md->from_user = 0;
+ }
+
++ if (unlikely(iov_count > UIO_MAXIOV))
++ return -EINVAL;
++
+ if (iov_count) {
+ int len, size = sizeof(struct sg_iovec) * iov_count;
+ struct iovec *iov;
+diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c
+index c43a9e8..54ef3d4 100644
+--- a/drivers/staging/hv/storvsc_drv.c
++++ b/drivers/staging/hv/storvsc_drv.c
+@@ -940,23 +940,24 @@ static unsigned int copy_to_bounce_buffer(struct scatterlist *orig_sgl,
+ if (bounce_sgl[j].length == PAGE_SIZE) {
+ /* full..move to next entry */
+ kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++ bounce_addr = 0;
+ j++;
++ }
+
+- /* if we need to use another bounce buffer */
+- if (srclen || i != orig_sgl_count - 1)
+- bounce_addr =
++ /* if we need to use another bounce buffer */
++ if (srclen && bounce_addr == 0)
++ bounce_addr =
+ (unsigned long)kmap_atomic(
+ sg_page((&bounce_sgl[j])), KM_IRQ0);
+
+- } else if (srclen == 0 && i == orig_sgl_count - 1) {
+- /* unmap the last bounce that is < PAGE_SIZE */
+- kunmap_atomic((void *)bounce_addr, KM_IRQ0);
+- }
+ }
+
+ kunmap_atomic((void *)(src_addr - orig_sgl[i].offset), KM_IRQ0);
+ }
+
++ if (bounce_addr)
++ kunmap_atomic((void *)bounce_addr, KM_IRQ0);
++
+ local_irq_restore(flags);
+
+ return total_copied;
+diff --git a/drivers/staging/line6/pcm.c b/drivers/staging/line6/pcm.c
+index 2d3a420..955c6de 100644
+--- a/drivers/staging/line6/pcm.c
++++ b/drivers/staging/line6/pcm.c
+@@ -88,10 +88,13 @@ static DEVICE_ATTR(impulse_period, S_IWUSR | S_IRUGO, pcm_get_impulse_period,
+
+ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ {
+- unsigned long flags_old =
+- __sync_fetch_and_or(&line6pcm->flags, channels);
+- unsigned long flags_new = flags_old | channels;
+- int err = 0;
++ unsigned long flags_old, flags_new;
++ int err;
++
++ do {
++ flags_old = ACCESS_ONCE(line6pcm->flags);
++ flags_new = flags_old | channels;
++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+
+ #if LINE6_BACKUP_MONITOR_SIGNAL
+ if (!(line6pcm->line6->properties->capabilities & LINE6_BIT_HWMON)) {
+@@ -133,10 +136,8 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ line6pcm->prev_fsize = 0;
+ err = line6_submit_audio_in_all_urbs(line6pcm);
+
+- if (err < 0) {
+- __sync_fetch_and_and(&line6pcm->flags, ~channels);
+- return err;
+- }
++ if (err < 0)
++ goto fail;
+ }
+
+ if (((flags_old & MASK_PLAYBACK) == 0) &&
+@@ -160,20 +161,29 @@ int line6_pcm_start(struct snd_line6_pcm *line6pcm, int channels)
+ line6pcm->count_out = 0;
+ err = line6_submit_audio_out_all_urbs(line6pcm);
+
+- if (err < 0) {
+- __sync_fetch_and_and(&line6pcm->flags, ~channels);
+- return err;
+- }
++ if (err < 0)
++ goto fail;
+ }
+
+ return 0;
++
++fail:
++ do {
++ flags_old = ACCESS_ONCE(line6pcm->flags);
++ flags_new = flags_old & ~channels;
++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
++
++ return err;
+ }
+
+ int line6_pcm_stop(struct snd_line6_pcm *line6pcm, int channels)
+ {
+- unsigned long flags_old =
+- __sync_fetch_and_and(&line6pcm->flags, ~channels);
+- unsigned long flags_new = flags_old & ~channels;
++ unsigned long flags_old, flags_new;
++
++ do {
++ flags_old = ACCESS_ONCE(line6pcm->flags);
++ flags_new = flags_old & ~channels;
++ } while (cmpxchg(&line6pcm->flags, flags_old, flags_new) != flags_old);
+
+ if (((flags_old & MASK_CAPTURE) != 0) &&
+ ((flags_new & MASK_CAPTURE) == 0)) {
+diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
+index 4683d5f..9a584da 100644
+--- a/drivers/staging/panel/panel.c
++++ b/drivers/staging/panel/panel.c
+@@ -274,11 +274,11 @@ static unsigned char lcd_bits[LCD_PORTS][LCD_BITS][BIT_STATES];
+ * LCD types
+ */
+ #define LCD_TYPE_NONE 0
+-#define LCD_TYPE_OLD 1
+-#define LCD_TYPE_KS0074 2
+-#define LCD_TYPE_HANTRONIX 3
+-#define LCD_TYPE_NEXCOM 4
+-#define LCD_TYPE_CUSTOM 5
++#define LCD_TYPE_CUSTOM 1
++#define LCD_TYPE_OLD 2
++#define LCD_TYPE_KS0074 3
++#define LCD_TYPE_HANTRONIX 4
++#define LCD_TYPE_NEXCOM 5
+
+ /*
+ * keypad types
+@@ -456,8 +456,7 @@ MODULE_PARM_DESC(keypad_enabled, "Deprecated option, use keypad_type instead");
+ static int lcd_type = -1;
+ module_param(lcd_type, int, 0000);
+ MODULE_PARM_DESC(lcd_type,
+- "LCD type: 0=none, 1=old //, 2=serial ks0074, "
+- "3=hantronix //, 4=nexcom //, 5=compiled-in");
++ "LCD type: 0=none, 1=compiled-in, 2=old, 3=serial ks0074, 4=hantronix, 5=nexcom");
+
+ static int lcd_proto = -1;
+ module_param(lcd_proto, int, 0000);
+diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
+index ebf9b60..1fb9e58 100644
+--- a/drivers/target/target_core_pscsi.c
++++ b/drivers/target/target_core_pscsi.c
+@@ -569,6 +569,7 @@ static struct se_device *pscsi_create_virtdevice(
+ " pdv_host_id: %d\n", pdv->pdv_host_id);
+ return ERR_PTR(-EINVAL);
+ }
++ pdv->pdv_lld_host = sh;
+ }
+ } else {
+ if (phv->phv_mode == PHV_VIRUTAL_HOST_ID) {
+@@ -655,6 +656,8 @@ static void pscsi_free_device(void *p)
+ if ((phv->phv_mode == PHV_LLD_SCSI_HOST_NO) &&
+ (phv->phv_lld_host != NULL))
+ scsi_host_put(phv->phv_lld_host);
++ else if (pdv->pdv_lld_host)
++ scsi_host_put(pdv->pdv_lld_host);
+
+ if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM))
+ scsi_device_put(sd);
+diff --git a/drivers/target/target_core_pscsi.h b/drivers/target/target_core_pscsi.h
+index fdc17b6..8b0a336 100644
+--- a/drivers/target/target_core_pscsi.h
++++ b/drivers/target/target_core_pscsi.h
+@@ -46,6 +46,7 @@ struct pscsi_dev_virt {
+ struct block_device *pdv_bd;
+ struct scsi_device *pdv_sd;
+ struct se_hba *pdv_se_hba;
++ struct Scsi_Host *pdv_lld_host;
+ } ____cacheline_aligned;
+
+ typedef enum phv_modes {
+diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c
+index 52fdf60..df8f8e0 100644
+--- a/drivers/tty/hvc/hvc_xen.c
++++ b/drivers/tty/hvc/hvc_xen.c
+@@ -167,7 +167,7 @@ static int __init xen_hvc_init(void)
+
+ if (xen_initial_domain()) {
+ ops = &dom0_hvc_ops;
+- xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0);
++ xencons_irq = bind_virq_to_irq(VIRQ_CONSOLE, 0, false);
+ } else {
+ if (!xen_start_info->console.domU.evtchn)
+ return -ENODEV;
+diff --git a/drivers/tty/serial/of_serial.c b/drivers/tty/serial/of_serial.c
+index 6563cad..746e771 100644
+--- a/drivers/tty/serial/of_serial.c
++++ b/drivers/tty/serial/of_serial.c
+@@ -192,7 +192,6 @@ static struct of_device_id __devinitdata of_platform_serial_table[] = {
+ { .compatible = "ibm,qpace-nwp-serial",
+ .data = (void *)PORT_NWPSERIAL, },
+ #endif
+- { .type = "serial", .data = (void *)PORT_UNKNOWN, },
+ { /* end of list */ },
+ };
+
+diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c
+index 6cd4143..d9706e7 100644
+--- a/drivers/tty/serial/uartlite.c
++++ b/drivers/tty/serial/uartlite.c
+@@ -573,7 +573,8 @@ MODULE_DEVICE_TABLE(of, ulite_of_match);
+
+ static int __devinit ulite_probe(struct platform_device *pdev)
+ {
+- struct resource *res, *res2;
++ struct resource *res;
++ int irq;
+ int id = pdev->id;
+ #ifdef CONFIG_OF
+ const __be32 *prop;
+@@ -587,11 +588,11 @@ static int __devinit ulite_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+- return ulite_assign(&pdev->dev, id, res->start, res2->start);
++ return ulite_assign(&pdev->dev, id, res->start, irq);
+ }
+
+ static int __devexit ulite_remove(struct platform_device *pdev)
+diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c
+index b627363..778c39a 100644
+--- a/drivers/tty/serial/xilinx_uartps.c
++++ b/drivers/tty/serial/xilinx_uartps.c
+@@ -941,9 +941,9 @@ static struct uart_driver xuartps_uart_driver = {
+ **/
+ static int __devinit xuartps_probe(struct platform_device *pdev)
+ {
+- int rc;
++ int rc, irq;
+ struct uart_port *port;
+- struct resource *res, *res2;
++ struct resource *res;
+ int clk = 0;
+
+ #ifdef CONFIG_OF
+@@ -964,9 +964,9 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ if (!res)
+ return -ENODEV;
+
+- res2 = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
+- if (!res2)
+- return -ENODEV;
++ irq = platform_get_irq(pdev, 0);
++ if (irq <= 0)
++ return -ENXIO;
+
+ /* Initialize the port structure */
+ port = xuartps_get_port();
+@@ -980,7 +980,7 @@ static int __devinit xuartps_probe(struct platform_device *pdev)
+ * and triggers invocation of the config_port() entry point.
+ */
+ port->mapbase = res->start;
+- port->irq = res2->start;
++ port->irq = irq;
+ port->dev = &pdev->dev;
+ port->uartclk = clk;
+ dev_set_drvdata(&pdev->dev, port);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 360ddb5..57d6302 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -947,11 +947,16 @@ static int acm_probe(struct usb_interface *intf,
+ }
+
+ while (buflen > 0) {
++ elength = buffer[0];
++ if (!elength) {
++ dev_err(&intf->dev, "skipping garbage byte\n");
++ elength = 1;
++ goto next_desc;
++ }
+ if (buffer[1] != USB_DT_CS_INTERFACE) {
+ dev_err(&intf->dev, "skipping garbage\n");
+ goto next_desc;
+ }
+- elength = buffer[0];
+
+ switch (buffer[2]) {
+ case USB_CDC_UNION_TYPE: /* we've found it */
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index 06dfb4f..d34005b 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -224,7 +224,7 @@ static void wdm_int_callback(struct urb *urb)
+ case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+ dev_dbg(&desc->intf->dev,
+ "NOTIFY_RESPONSE_AVAILABLE received: index %d len %d",
+- dr->wIndex, dr->wLength);
++ le16_to_cpu(dr->wIndex), le16_to_cpu(dr->wLength));
+ break;
+
+ case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+@@ -237,14 +237,16 @@ static void wdm_int_callback(struct urb *urb)
+ clear_bit(WDM_POLL_RUNNING, &desc->flags);
+ dev_err(&desc->intf->dev,
+ "unknown notification %d received: index %d len %d\n",
+- dr->bNotificationType, dr->wIndex, dr->wLength);
++ dr->bNotificationType,
++ le16_to_cpu(dr->wIndex),
++ le16_to_cpu(dr->wLength));
+ goto exit;
+ }
+
+ req->bRequestType = (USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE);
+ req->bRequest = USB_CDC_GET_ENCAPSULATED_RESPONSE;
+ req->wValue = 0;
+- req->wIndex = desc->inum;
++ req->wIndex = desc->inum; /* already converted */
+ req->wLength = cpu_to_le16(desc->wMaxCommand);
+
+ usb_fill_control_urb(
+@@ -401,7 +403,7 @@ static ssize_t wdm_write
+ USB_RECIP_INTERFACE);
+ req->bRequest = USB_CDC_SEND_ENCAPSULATED_COMMAND;
+ req->wValue = 0;
+- req->wIndex = desc->inum;
++ req->wIndex = desc->inum; /* already converted */
+ req->wLength = cpu_to_le16(count);
+ set_bit(WDM_IN_USE, &desc->flags);
+ desc->outbuf = buf;
+@@ -414,7 +416,7 @@ static ssize_t wdm_write
+ dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
+ } else {
+ dev_dbg(&desc->intf->dev, "Tx URB has been submitted index=%d",
+- req->wIndex);
++ le16_to_cpu(req->wIndex));
+ }
+ out:
+ usb_autopm_put_interface(desc->intf);
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 25e9eb4..a47e29a 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -2060,8 +2060,13 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ break;
+ case COMP_DEV_ERR:
+ case COMP_STALL:
++ frame->status = -EPROTO;
++ skip_td = true;
++ break;
+ case COMP_TX_ERR:
+ frame->status = -EPROTO;
++ if (event_trb != td->last_trb)
++ return 0;
+ skip_td = true;
+ break;
+ case COMP_STOP:
+@@ -2646,7 +2651,7 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd)
+ xhci_halt(xhci);
+ hw_died:
+ spin_unlock(&xhci->lock);
+- return -ESHUTDOWN;
++ return IRQ_HANDLED;
+ }
+
+ /*
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index efbdf83..d676ae0 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1231,7 +1231,7 @@ union xhci_trb {
+ * since the command ring is 64-byte aligned.
+ * It must also be greater than 16.
+ */
+-#define TRBS_PER_SEGMENT 64
++#define TRBS_PER_SEGMENT 256
+ /* Allow two commands + a link TRB, along with any reserved command TRBs */
+ #define MAX_RSVD_CMD_TRBS (TRBS_PER_SEGMENT - 3)
+ #define SEGMENT_SIZE (TRBS_PER_SEGMENT*16)
+diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
+index 641caf8..6f7d84e 100644
+--- a/drivers/usb/musb/musb_core.c
++++ b/drivers/usb/musb/musb_core.c
+@@ -1524,16 +1524,30 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ (devctl & MUSB_DEVCTL_HM) ? "host" : "peripheral",
+ musb->int_usb, musb->int_tx, musb->int_rx);
+
+- /* the core can interrupt us for multiple reasons; docs have
+- * a generic interrupt flowchart to follow
++ /**
++ * According to Mentor Graphics' documentation, flowchart on page 98,
++ * IRQ should be handled as follows:
++ *
++ * . Resume IRQ
++ * . Session Request IRQ
++ * . VBUS Error IRQ
++ * . Suspend IRQ
++ * . Connect IRQ
++ * . Disconnect IRQ
++ * . Reset/Babble IRQ
++ * . SOF IRQ (we're not using this one)
++ * . Endpoint 0 IRQ
++ * . TX Endpoints
++ * . RX Endpoints
++ *
++ * We will be following that flowchart in order to avoid any problems
++ * that might arise with internal Finite State Machine.
+ */
++
+ if (musb->int_usb)
+ retval |= musb_stage0_irq(musb, musb->int_usb,
+ devctl, power);
+
+- /* "stage 1" is handling endpoint irqs */
+-
+- /* handle endpoint 0 first */
+ if (musb->int_tx & 1) {
+ if (devctl & MUSB_DEVCTL_HM)
+ retval |= musb_h_ep0_irq(musb);
+@@ -1541,43 +1555,37 @@ irqreturn_t musb_interrupt(struct musb *musb)
+ retval |= musb_g_ep0_irq(musb);
+ }
+
+- /* RX on endpoints 1-15 */
+- reg = musb->int_rx >> 1;
++ reg = musb->int_tx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval = ep->rx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (devctl & MUSB_DEVCTL_HM) {
+ if (is_host_capable())
+- musb_host_rx(musb, ep_num);
++ musb_host_tx(musb, ep_num);
+ } else {
+ if (is_peripheral_capable())
+- musb_g_rx(musb, ep_num);
++ musb_g_tx(musb, ep_num);
+ }
+ }
+-
+ reg >>= 1;
+ ep_num++;
+ }
+
+- /* TX on endpoints 1-15 */
+- reg = musb->int_tx >> 1;
++ reg = musb->int_rx >> 1;
+ ep_num = 1;
+ while (reg) {
+ if (reg & 1) {
+- /* musb_ep_select(musb->mregs, ep_num); */
+- /* REVISIT just retval |= ep->tx_irq(...) */
+ retval = IRQ_HANDLED;
+ if (devctl & MUSB_DEVCTL_HM) {
+ if (is_host_capable())
+- musb_host_tx(musb, ep_num);
++ musb_host_rx(musb, ep_num);
+ } else {
+ if (is_peripheral_capable())
+- musb_g_tx(musb, ep_num);
++ musb_g_rx(musb, ep_num);
+ }
+ }
++
+ reg >>= 1;
+ ep_num++;
+ }
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 7f32c74..073a0f98 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -133,6 +133,8 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
+ { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
+ { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
++ { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
++ { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
+ { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index e13ebb0..8257d3b 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -723,6 +723,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_DONGLE_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_AWINDA_STATION_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_CONVERTER_PID) },
++ { USB_DEVICE(XSENS_VID, XSENS_MTDEVBOARD_PID) },
+ { USB_DEVICE(XSENS_VID, XSENS_MTW_PID) },
+ { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
+ { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 361192c..e4a57bb 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -155,6 +155,7 @@
+ #define XSENS_AWINDA_STATION_PID 0x0101
+ #define XSENS_AWINDA_DONGLE_PID 0x0102
+ #define XSENS_MTW_PID 0x0200 /* Xsens MTw */
++#define XSENS_MTDEVBOARD_PID 0x0300 /* Motion Tracker Development Board */
+ #define XSENS_CONVERTER_PID 0xD00D /* Xsens USB-serial converter */
+
+ /* Xsens devices using FTDI VID */
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7ba38ea..a440387 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -67,7 +67,6 @@ static const struct usb_device_id id_table[] = {
+ { USB_DEVICE(DCU10_VENDOR_ID, DCU10_PRODUCT_ID) },
+ { USB_DEVICE(SITECOM_VENDOR_ID, SITECOM_PRODUCT_ID) },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_ID) },
+- { USB_DEVICE(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_ID) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_SX1) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X65) },
+ { USB_DEVICE(SIEMENS_VENDOR_ID, SIEMENS_PRODUCT_ID_X75) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index 71fd9da..e3b7af8 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -62,10 +62,6 @@
+ #define ALCATEL_VENDOR_ID 0x11f7
+ #define ALCATEL_PRODUCT_ID 0x02df
+
+-/* Samsung I330 phone cradle */
+-#define SAMSUNG_VENDOR_ID 0x04e8
+-#define SAMSUNG_PRODUCT_ID 0x8001
+-
+ #define SIEMENS_VENDOR_ID 0x11f5
+ #define SIEMENS_PRODUCT_ID_SX1 0x0001
+ #define SIEMENS_PRODUCT_ID_X65 0x0003
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 0e2c2de..68e8552 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -752,6 +752,13 @@ UNUSUAL_DEV( 0x059f, 0x0643, 0x0000, 0x0000,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_GO_SLOW ),
+
++/* Reported by Christian Schaller <cschalle@redhat.com> */
++UNUSUAL_DEV( 0x059f, 0x0651, 0x0000, 0x0000,
++ "LaCie",
++ "External HDD",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_WP_DETECT ),
++
+ /* Submitted by Joel Bourquard <numlock@freesurf.ch>
+ * Some versions of this device need the SubClass and Protocol overrides
+ * while others don't.
+diff --git a/drivers/xen/events.c b/drivers/xen/events.c
+index f6227cc..bcf7711 100644
+--- a/drivers/xen/events.c
++++ b/drivers/xen/events.c
+@@ -895,7 +895,7 @@ static int find_virq(unsigned int virq, unsigned int cpu)
+ return rc;
+ }
+
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu)
+ {
+ struct evtchn_bind_virq bind_virq;
+ int evtchn, irq, ret;
+@@ -909,8 +909,12 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
+ if (irq == -1)
+ goto out;
+
+- irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
+- handle_percpu_irq, "virq");
++ if (percpu)
++ irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
++ handle_percpu_irq, "virq");
++ else
++ irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
++ handle_edge_irq, "virq");
+
+ bind_virq.virq = virq;
+ bind_virq.vcpu = cpu;
+@@ -1023,7 +1027,7 @@ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ {
+ int irq, retval;
+
+- irq = bind_virq_to_irq(virq, cpu);
++ irq = bind_virq_to_irq(virq, cpu, irqflags & IRQF_PERCPU);
+ if (irq < 0)
+ return irq;
+ retval = request_irq(irq, handler, irqflags, devname, dev_id);
+diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
+index 82ab1c3..bb8cb69 100644
+--- a/drivers/xen/xen-pciback/conf_space.c
++++ b/drivers/xen/xen-pciback/conf_space.c
+@@ -16,8 +16,8 @@
+ #include "conf_space.h"
+ #include "conf_space_quirks.h"
+
+-bool permissive;
+-module_param(permissive, bool, 0644);
++bool xen_pcibk_permissive;
++module_param_named(permissive, xen_pcibk_permissive, bool, 0644);
+
+ /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
+ * xen_pcibk_write_config_word, and xen_pcibk_write_config_byte are created. */
+@@ -262,7 +262,7 @@ int xen_pcibk_config_write(struct pci_dev *dev, int offset, int size, u32 value)
+ * This means that some fields may still be read-only because
+ * they have entries in the config_field list that intercept
+ * the write and do nothing. */
+- if (dev_data->permissive || permissive) {
++ if (dev_data->permissive || xen_pcibk_permissive) {
+ switch (size) {
+ case 1:
+ err = pci_write_config_byte(dev, offset,
+diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
+index 2e1d73d..62461a8 100644
+--- a/drivers/xen/xen-pciback/conf_space.h
++++ b/drivers/xen/xen-pciback/conf_space.h
+@@ -64,7 +64,7 @@ struct config_field_entry {
+ void *data;
+ };
+
+-extern bool permissive;
++extern bool xen_pcibk_permissive;
+
+ #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
+
+diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
+index a5bb81a..1667a90 100644
+--- a/drivers/xen/xen-pciback/conf_space_header.c
++++ b/drivers/xen/xen-pciback/conf_space_header.c
+@@ -105,7 +105,7 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
+
+ cmd->val = value;
+
+- if (!permissive && (!dev_data || !dev_data->permissive))
++ if (!xen_pcibk_permissive && (!dev_data || !dev_data->permissive))
+ return 0;
+
+ /* Only allow the guest to control certain bits. */
+diff --git a/firmware/ihex2fw.c b/firmware/ihex2fw.c
+index cf38e15..08d90e2 100644
+--- a/firmware/ihex2fw.c
++++ b/firmware/ihex2fw.c
+@@ -86,6 +86,7 @@ int main(int argc, char **argv)
+ case 'j':
+ include_jump = 1;
+ break;
++ default:
+ return usage();
+ }
+ }
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index 2aed667..d252462 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -746,6 +746,7 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ i < loc->elf_ex.e_phnum; i++, elf_ppnt++) {
+ int elf_prot = 0, elf_flags;
+ unsigned long k, vaddr;
++ unsigned long total_size = 0;
+
+ if (elf_ppnt->p_type != PT_LOAD)
+ continue;
+@@ -809,10 +810,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
++ total_size = total_mapping_size(elf_phdata,
++ loc->elf_ex.e_phnum);
++ if (!total_size) {
++ retval = -EINVAL;
++ goto out_free_dentry;
++ }
+ }
+
+ error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
+- elf_prot, elf_flags, 0);
++ elf_prot, elf_flags, total_size);
+ if (BAD_ADDR(error)) {
+ send_sig(SIGKILL, current, 0);
+ retval = IS_ERR((void *)error) ?
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index a694317..da528f8 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5678,12 +5678,11 @@ static int __btrfs_free_reserved_extent(struct btrfs_root *root,
+ return -ENOSPC;
+ }
+
+- if (btrfs_test_opt(root, DISCARD))
+- ret = btrfs_discard_extent(root, start, len, NULL);
+-
+ if (pin)
+ pin_down_extent(root, cache, start, len, 1);
+ else {
++ if (btrfs_test_opt(root, DISCARD))
++ ret = btrfs_discard_extent(root, start, len, NULL);
+ btrfs_add_free_space(cache, start, len);
+ btrfs_update_reserved_bytes(cache, len, RESERVE_FREE);
+ }
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 7cbe2f8..52bacff 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2263,6 +2263,11 @@ static noinline long btrfs_ioctl_clone(struct file *file, unsigned long srcfd,
+ if (off + len == src->i_size)
+ len = ALIGN(src->i_size, bs) - off;
+
++ if (len == 0) {
++ ret = 0;
++ goto out_unlock;
++ }
++
+ /* verify the end result is block aligned */
+ if (!IS_ALIGNED(off, bs) || !IS_ALIGNED(off + len, bs) ||
+ !IS_ALIGNED(destoff, bs))
+diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
+index 3848b04..60ff45e 100644
+--- a/fs/btrfs/xattr.c
++++ b/fs/btrfs/xattr.c
+@@ -310,21 +310,40 @@ const struct xattr_handler *btrfs_xattr_handlers[] = {
+ /*
+ * Check if the attribute is in a supported namespace.
+ *
+- * This applied after the check for the synthetic attributes in the system
++ * This is applied after the check for the synthetic attributes in the system
+ * namespace.
+ */
+-static bool btrfs_is_valid_xattr(const char *name)
++static int btrfs_is_valid_xattr(const char *name)
+ {
+- return !strncmp(name, XATTR_SECURITY_PREFIX,
+- XATTR_SECURITY_PREFIX_LEN) ||
+- !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) ||
+- !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) ||
+- !strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN);
++ int len = strlen(name);
++ int prefixlen = 0;
++
++ if (!strncmp(name, XATTR_SECURITY_PREFIX,
++ XATTR_SECURITY_PREFIX_LEN))
++ prefixlen = XATTR_SECURITY_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
++ prefixlen = XATTR_SYSTEM_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
++ prefixlen = XATTR_TRUSTED_PREFIX_LEN;
++ else if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN))
++ prefixlen = XATTR_USER_PREFIX_LEN;
++ else
++ return -EOPNOTSUPP;
++
++ /*
++ * The name cannot consist of just prefix
++ */
++ if (len <= prefixlen)
++ return -EINVAL;
++
++ return 0;
+ }
+
+ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ void *buffer, size_t size)
+ {
++ int ret;
++
+ /*
+ * If this is a request for a synthetic attribute in the system.*
+ * namespace use the generic infrastructure to resolve a handler
+@@ -333,8 +352,9 @@ ssize_t btrfs_getxattr(struct dentry *dentry, const char *name,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_getxattr(dentry, name, buffer, size);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+ return __btrfs_getxattr(dentry->d_inode, name, buffer, size);
+ }
+
+@@ -342,6 +362,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ size_t size, int flags)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -358,8 +379,9 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_setxattr(dentry, name, value, size, flags);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ if (size == 0)
+ value = ""; /* empty EA, do not remove */
+@@ -371,6 +393,7 @@ int btrfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ {
+ struct btrfs_root *root = BTRFS_I(dentry->d_inode)->root;
++ int ret;
+
+ /*
+ * The permission on security.* and system.* is not checked
+@@ -387,8 +410,9 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
+ if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
+ return generic_removexattr(dentry, name);
+
+- if (!btrfs_is_valid_xattr(name))
+- return -EOPNOTSUPP;
++ ret = btrfs_is_valid_xattr(name);
++ if (ret)
++ return ret;
+
+ return __btrfs_setxattr(NULL, dentry->d_inode, name, NULL, 0,
+ XATTR_REPLACE);
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 8bc98af..8a35300 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1016,13 +1016,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+@@ -1142,13 +1142,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+@@ -2938,13 +2938,13 @@ ascend:
+ /* might go back up the wrong parent if we have had a rename */
+ if (!locked && read_seqretry(&rename_lock, seq))
+ goto rename_retry;
+- next = child->d_child.next;
+- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
++ /* go into the first sibling still alive */
++ do {
++ next = child->d_child.next;
+ if (next == &this_parent->d_subdirs)
+ goto ascend;
+ child = list_entry(next, struct dentry, d_child);
+- next = next->next;
+- }
++ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
+ rcu_read_unlock();
+ goto resume;
+ }
+diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
+index a15f1e2..74f03b5 100644
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -135,6 +135,7 @@ static void debugfs_evict_inode(struct inode *inode)
+
+ static const struct super_operations debugfs_super_operations = {
+ .evict_inode = debugfs_evict_inode,
++ .statfs = simple_statfs,
+ };
+
+ static int debug_fill_super(struct super_block *sb, void *data, int silent)
+diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
+index 834d9a1..2da63ab 100644
+--- a/fs/ext4/extents.c
++++ b/fs/ext4/extents.c
+@@ -321,7 +321,7 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
+ ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+ ext4_lblk_t last = lblock + len - 1;
+
+- if (lblock > last)
++ if (len == 0 || lblock > last)
+ return 0;
+ return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
+ }
+@@ -4470,13 +4470,6 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ struct ext4_map_blocks map;
+ unsigned int credits, blkbits = inode->i_blkbits;
+
+- /*
+- * currently supporting (pre)allocate mode for extent-based
+- * files _only_
+- */
+- if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)))
+- return -EOPNOTSUPP;
+-
+ /* Return error if mode is not supported */
+ if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+ return -EOPNOTSUPP;
+@@ -4497,6 +4490,15 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
+ */
+ credits = ext4_chunk_trans_blocks(inode, max_blocks);
+ mutex_lock(&inode->i_mutex);
++
++ /*
++ * We only support preallocation for extent-based files only
++ */
++ if (!(ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS))) {
++ ret = -EOPNOTSUPP;
++ goto out;
++ }
++
+ ret = inode_newsize_ok(inode, (len + offset));
+ if (ret) {
+ mutex_unlock(&inode->i_mutex);
+@@ -4553,6 +4555,7 @@ retry:
+ ret = 0;
+ goto retry;
+ }
++out:
+ mutex_unlock(&inode->i_mutex);
+ trace_ext4_fallocate_exit(inode, offset, max_blocks,
+ ret > 0 ? ret2 : ret);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index c9f2e3d..cd1dd49 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -1456,7 +1456,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ struct inode *inode)
+ {
+ struct inode *dir = dentry->d_parent->d_inode;
+- struct buffer_head *bh;
++ struct buffer_head *bh = NULL;
+ struct ext4_dir_entry_2 *de;
+ struct super_block *sb;
+ int retval;
+@@ -1471,7 +1471,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if (is_dx(dir)) {
+ retval = ext4_dx_add_entry(handle, dentry, inode);
+ if (!retval || (retval != ERR_BAD_DX_DIR))
+- return retval;
++ goto out;
+ ext4_clear_inode_flag(dir, EXT4_INODE_INDEX);
+ dx_fallback++;
+ ext4_mark_inode_dirty(handle, dir);
+@@ -1482,14 +1482,15 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ if(!bh)
+ return retval;
+ retval = add_dirent_to_buf(handle, dentry, inode, NULL, bh);
+- if (retval != -ENOSPC) {
+- brelse(bh);
+- return retval;
+- }
++ if (retval != -ENOSPC)
++ goto out;
+
+ if (blocks == 1 && !dx_fallback &&
+- EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX))
+- return make_indexed_dir(handle, dentry, inode, bh);
++ EXT4_HAS_COMPAT_FEATURE(sb, EXT4_FEATURE_COMPAT_DIR_INDEX)) {
++ retval = make_indexed_dir(handle, dentry, inode, bh);
++ bh = NULL; /* make_indexed_dir releases bh */
++ goto out;
++ }
+ brelse(bh);
+ }
+ bh = ext4_append(handle, dir, &block, &retval);
+@@ -1499,6 +1500,7 @@ static int ext4_add_entry(handle_t *handle, struct dentry *dentry,
+ de->inode = 0;
+ de->rec_len = ext4_rec_len_to_disk(blocksize, blocksize);
+ retval = add_dirent_to_buf(handle, dentry, inode, de, bh);
++out:
+ brelse(bh);
+ if (retval == 0)
+ ext4_set_inode_state(inode, EXT4_STATE_NEWENTRY);
+diff --git a/fs/fhandle.c b/fs/fhandle.c
+index 6b08864..c9e18f3 100644
+--- a/fs/fhandle.c
++++ b/fs/fhandle.c
+@@ -196,8 +196,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
+ goto out_err;
+ }
+ /* copy the full handle */
+- if (copy_from_user(handle, ufh,
+- sizeof(struct file_handle) +
++ *handle = f_handle;
++ if (copy_from_user(&handle->f_handle,
++ &ufh->f_handle,
+ f_handle.handle_bytes)) {
+ retval = -EFAULT;
+ goto out_handle;
+diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
+index da6d7ba..421834b 100644
+--- a/fs/jbd2/recovery.c
++++ b/fs/jbd2/recovery.c
+@@ -711,11 +711,16 @@ static int scan_revoke_records(journal_t *journal, struct buffer_head *bh,
+ {
+ jbd2_journal_revoke_header_t *header;
+ int offset, max;
++ __u32 rcount;
+ int record_len = 4;
+
+ header = (jbd2_journal_revoke_header_t *) bh->b_data;
+ offset = sizeof(jbd2_journal_revoke_header_t);
+- max = be32_to_cpu(header->r_count);
++ rcount = be32_to_cpu(header->r_count);
++
++ if (rcount > journal->j_blocksize)
++ return -EINVAL;
++ max = rcount;
+
+ if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_64BIT))
+ record_len = 8;
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 6e91f8b..d455ea0 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -3272,10 +3272,17 @@ static int check_stateid_generation(stateid_t *in, stateid_t *ref, bool has_sess
+ return nfserr_old_stateid;
+ }
+
++static __be32 nfsd4_check_openowner_confirmed(struct nfs4_ol_stateid *ols)
++{
++ if (ols->st_stateowner->so_is_open_owner &&
++ !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ return nfserr_bad_stateid;
++ return nfs_ok;
++}
++
+ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ {
+ struct nfs4_stid *s;
+- struct nfs4_ol_stateid *ols;
+ __be32 status;
+
+ if (STALE_STATEID(stateid))
+@@ -3289,11 +3296,7 @@ __be32 nfs4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)
+ return status;
+ if (!(s->sc_type & (NFS4_OPEN_STID | NFS4_LOCK_STID)))
+ return nfs_ok;
+- ols = openlockstateid(s);
+- if (ols->st_stateowner->so_is_open_owner
+- && !(openowner(ols->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
+- return nfserr_bad_stateid;
+- return nfs_ok;
++ return nfsd4_check_openowner_confirmed(openlockstateid(s));
+ }
+
+ static __be32 nfsd4_lookup_stateid(stateid_t *stateid, unsigned char typemask, struct nfs4_stid **s)
+@@ -3360,8 +3363,8 @@ nfs4_preprocess_stateid_op(struct nfsd4_compound_state *cstate,
+ status = nfs4_check_fh(current_fh, stp);
+ if (status)
+ goto out;
+- if (stp->st_stateowner->so_is_open_owner
+- && !(openowner(stp->st_stateowner)->oo_flags & NFS4_OO_CONFIRMED))
++ status = nfsd4_check_openowner_confirmed(stp);
++ if (status)
+ goto out;
+ status = nfs4_check_openmode(stp, flags);
+ if (status)
+diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
+index ecdbae1..090d8ce 100644
+--- a/fs/nilfs2/btree.c
++++ b/fs/nilfs2/btree.c
+@@ -388,7 +388,7 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,
+ nchildren = nilfs_btree_node_get_nchildren(node);
+
+ if (unlikely(level < NILFS_BTREE_LEVEL_NODE_MIN ||
+- level > NILFS_BTREE_LEVEL_MAX ||
++ level >= NILFS_BTREE_LEVEL_MAX ||
+ nchildren < 0 ||
+ nchildren > NILFS_BTREE_ROOT_NCHILDREN_MAX)) {
+ pr_crit("NILFS: bad btree root (inode number=%lu): level = %d, flags = 0x%x, nchildren = %d\n",
+diff --git a/fs/ocfs2/dlm/dlmmaster.c b/fs/ocfs2/dlm/dlmmaster.c
+index dbc372e..7ba6ac1 100644
+--- a/fs/ocfs2/dlm/dlmmaster.c
++++ b/fs/ocfs2/dlm/dlmmaster.c
+@@ -729,6 +729,19 @@ lookup:
+ if (tmpres) {
+ spin_unlock(&dlm->spinlock);
+ spin_lock(&tmpres->spinlock);
++
++ /*
++ * Right after dlm spinlock was released, dlm_thread could have
++ * purged the lockres. Check if lockres got unhashed. If so
++ * start over.
++ */
++ if (hlist_unhashed(&tmpres->hash_node)) {
++ spin_unlock(&tmpres->spinlock);
++ dlm_lockres_put(tmpres);
++ tmpres = NULL;
++ goto lookup;
++ }
++
+ /* Wait on the thread that is mastering the resource */
+ if (tmpres->owner == DLM_LOCK_RES_OWNER_UNKNOWN) {
+ __dlm_wait_on_lockres(tmpres);
+diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
+index e043c4c..f58f1c4 100644
+--- a/fs/omfs/inode.c
++++ b/fs/omfs/inode.c
+@@ -361,7 +361,7 @@ nomem:
+ }
+
+ enum {
+- Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask
++ Opt_uid, Opt_gid, Opt_umask, Opt_dmask, Opt_fmask, Opt_err
+ };
+
+ static const match_table_t tokens = {
+@@ -370,6 +370,7 @@ static const match_table_t tokens = {
+ {Opt_umask, "umask=%o"},
+ {Opt_dmask, "dmask=%o"},
+ {Opt_fmask, "fmask=%o"},
++ {Opt_err, NULL},
+ };
+
+ static int parse_options(char *options, struct omfs_sb_info *sbi)
+diff --git a/fs/pipe.c b/fs/pipe.c
+index 8ca88fc..d2cbeff 100644
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
+ }
+
+ static int
+-pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+- int atomic)
++pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
++ size_t *remaining, int atomic)
+ {
+ unsigned long copy;
+
+- while (len > 0) {
++ while (*remaining > 0) {
+ while (!iov->iov_len)
+ iov++;
+- copy = min_t(unsigned long, len, iov->iov_len);
++ copy = min_t(unsigned long, *remaining, iov->iov_len);
+
+ if (atomic) {
+- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
++ if (__copy_from_user_inatomic(addr + *offset,
++ iov->iov_base, copy))
+ return -EFAULT;
+ } else {
+- if (copy_from_user(to, iov->iov_base, copy))
++ if (copy_from_user(addr + *offset,
++ iov->iov_base, copy))
+ return -EFAULT;
+ }
+- to += copy;
+- len -= copy;
++ *offset += copy;
++ *remaining -= copy;
+ iov->iov_base += copy;
+ iov->iov_len -= copy;
+ }
+@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
+ }
+
+ static int
+-pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
+- int atomic)
++pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
++ size_t *remaining, int atomic)
+ {
+ unsigned long copy;
+
+- while (len > 0) {
++ while (*remaining > 0) {
+ while (!iov->iov_len)
+ iov++;
+- copy = min_t(unsigned long, len, iov->iov_len);
++ copy = min_t(unsigned long, *remaining, iov->iov_len);
+
+ if (atomic) {
+- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
++ if (__copy_to_user_inatomic(iov->iov_base,
++ addr + *offset, copy))
+ return -EFAULT;
+ } else {
+- if (copy_to_user(iov->iov_base, from, copy))
++ if (copy_to_user(iov->iov_base,
++ addr + *offset, copy))
+ return -EFAULT;
+ }
+- from += copy;
+- len -= copy;
++ *offset += copy;
++ *remaining -= copy;
+ iov->iov_base += copy;
+ iov->iov_len -= copy;
+ }
+@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ struct pipe_buffer *buf = pipe->bufs + curbuf;
+ const struct pipe_buf_operations *ops = buf->ops;
+ void *addr;
+- size_t chars = buf->len;
++ size_t chars = buf->len, remaining;
+ int error, atomic;
+
+ if (chars > total_len)
+@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
+ }
+
+ atomic = !iov_fault_in_pages_write(iov, chars);
++ remaining = chars;
+ redo:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
++ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
++ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ if (unlikely(error)) {
+ /*
+@@ -414,7 +420,6 @@ redo:
+ break;
+ }
+ ret += chars;
+- buf->offset += chars;
+ buf->len -= chars;
+
+ /* Was it a packet buffer? Clean up and exit */
+@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ if (ops->can_merge && offset + chars <= PAGE_SIZE) {
+ int error, atomic = 1;
+ void *addr;
++ size_t remaining = chars;
+
+ error = ops->confirm(pipe, buf);
+ if (error)
+@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+ iov_fault_in_pages_read(iov, chars);
+ redo1:
+ addr = ops->map(pipe, buf, atomic);
+- error = pipe_iov_copy_from_user(offset + addr, iov,
+- chars, atomic);
++ error = pipe_iov_copy_from_user(addr, &offset, iov,
++ &remaining, atomic);
+ ops->unmap(pipe, buf, addr);
+ ret = error;
+ do_wakeup = 1;
+@@ -565,6 +571,8 @@ redo1:
+ struct page *page = pipe->tmp_page;
+ char *src;
+ int error, atomic = 1;
++ int offset = 0;
++ size_t remaining;
+
+ if (!page) {
+ page = alloc_page(GFP_HIGHUSER);
+@@ -585,14 +593,15 @@ redo1:
+ chars = total_len;
+
+ iov_fault_in_pages_read(iov, chars);
++ remaining = chars;
+ redo2:
+ if (atomic)
+ src = kmap_atomic(page, KM_USER0);
+ else
+ src = kmap(page);
+
+- error = pipe_iov_copy_from_user(src, iov, chars,
+- atomic);
++ error = pipe_iov_copy_from_user(src, &offset, iov,
++ &remaining, atomic);
+ if (atomic)
+ kunmap_atomic(src, KM_USER0);
+ else
+diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
+index f554a93..2ba218e 100644
+--- a/include/acpi/acpixf.h
++++ b/include/acpi/acpixf.h
+@@ -125,7 +125,7 @@ void acpi_free(void *address);
+ */
+ acpi_status acpi_reallocate_root_table(void);
+
+-acpi_status acpi_find_root_pointer(acpi_size *rsdp_address);
++acpi_status acpi_find_root_pointer(acpi_physical_address *rsdp_address);
+
+ acpi_status acpi_load_tables(void);
+
+diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
+index ed73f67..b0d7ef8 100644
+--- a/include/acpi/actypes.h
++++ b/include/acpi/actypes.h
+@@ -198,9 +198,29 @@ typedef int INT32;
+ typedef s32 acpi_native_int;
+
+ typedef u32 acpi_size;
++
++#ifdef ACPI_32BIT_PHYSICAL_ADDRESS
++
++/*
++ * OSPMs can define this to shrink the size of the structures for 32-bit
++ * none PAE environment. ASL compiler may always define this to generate
++ * 32-bit OSPM compliant tables.
++ */
+ typedef u32 acpi_io_address;
+ typedef u32 acpi_physical_address;
+
++#else /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
++/*
++ * It is reported that, after some calculations, the physical addresses can
++ * wrap over the 32-bit boundary on 32-bit PAE environment.
++ * https://bugzilla.kernel.org/show_bug.cgi?id=87971
++ */
++typedef u64 acpi_io_address;
++typedef u64 acpi_physical_address;
++
++#endif /* ACPI_32BIT_PHYSICAL_ADDRESS */
++
+ #define ACPI_MAX_PTR ACPI_UINT32_MAX
+ #define ACPI_SIZE_MAX ACPI_UINT32_MAX
+
+diff --git a/include/acpi/platform/acenv.h b/include/acpi/platform/acenv.h
+index 5af3ed5..b9f9210 100644
+--- a/include/acpi/platform/acenv.h
++++ b/include/acpi/platform/acenv.h
+@@ -75,6 +75,7 @@
+ #define ACPI_CONSTANT_EVAL_ONLY
+ #define ACPI_LARGE_NAMESPACE_NODE
+ #define ACPI_DATA_TABLE_DISASSEMBLY
++#define ACPI_32BIT_PHYSICAL_ADDRESS
+ #endif
+
+ #ifdef ACPI_EXEC_APP
+diff --git a/include/linux/jhash.h b/include/linux/jhash.h
+index 47cb09e..348c6f4 100644
+--- a/include/linux/jhash.h
++++ b/include/linux/jhash.h
+@@ -145,11 +145,11 @@ static inline u32 jhash2(const u32 *k, u32 length, u32 initval)
+ }
+
+
+-/* jhash_3words - hash exactly 3, 2 or 1 word(s) */
+-static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++/* __jhash_nwords - hash exactly 3, 2 or 1 word(s) */
++static inline u32 __jhash_nwords(u32 a, u32 b, u32 c, u32 initval)
+ {
+- a += JHASH_INITVAL;
+- b += JHASH_INITVAL;
++ a += initval;
++ b += initval;
+ c += initval;
+
+ __jhash_final(a, b, c);
+@@ -157,14 +157,19 @@ static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
+ return c;
+ }
+
++static inline u32 jhash_3words(u32 a, u32 b, u32 c, u32 initval)
++{
++ return __jhash_nwords(a, b, c, initval + JHASH_INITVAL + (3 << 2));
++}
++
+ static inline u32 jhash_2words(u32 a, u32 b, u32 initval)
+ {
+- return jhash_3words(a, b, 0, initval);
++ return __jhash_nwords(a, b, 0, initval + JHASH_INITVAL + (2 << 2));
+ }
+
+ static inline u32 jhash_1word(u32 a, u32 initval)
+ {
+- return jhash_3words(a, 0, 0, initval);
++ return __jhash_nwords(a, 0, 0, initval + JHASH_INITVAL + (1 << 2));
+ }
+
+ #endif /* _LINUX_JHASH_H */
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index 42ac6ad..3d4b5b6 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -182,6 +182,7 @@ enum {
+ ATA_LFLAG_DISABLED = (1 << 6), /* link is disabled */
+ ATA_LFLAG_SW_ACTIVITY = (1 << 7), /* keep activity stats */
+ ATA_LFLAG_NO_LPM = (1 << 8), /* disable LPM on this link */
++ ATA_LFLAG_CHANGED = (1 << 10), /* LPM state changed on this link */
+
+ /* struct ata_port flags */
+ ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */
+@@ -284,6 +285,12 @@ enum {
+ */
+ ATA_TMOUT_PMP_SRST_WAIT = 5000,
+
++ /* When the LPM policy is set to ATA_LPM_MAX_POWER, there might
++ * be a spurious PHY event, so ignore the first PHY event that
++ * occurs within 10s after the policy change.
++ */
++ ATA_TMOUT_SPURIOUS_PHY = 10000,
++
+ /* ATA bus states */
+ BUS_UNKNOWN = 0,
+ BUS_DMA = 1,
+@@ -728,6 +735,8 @@ struct ata_link {
+ struct ata_eh_context eh_context;
+
+ struct ata_device device[ATA_MAX_DEVICES];
++
++ unsigned long last_lpm_change; /* when last LPM change happened */
+ };
+ #define ATA_LINK_CLEAR_BEGIN offsetof(struct ata_link, active_tag)
+ #define ATA_LINK_CLEAR_END offsetof(struct ata_link, device[0])
+@@ -1064,6 +1073,7 @@ extern struct ata_device *ata_dev_pair(struct ata_device *adev);
+ extern int ata_do_set_mode(struct ata_link *link, struct ata_device **r_failed_dev);
+ extern void ata_scsi_port_error_handler(struct Scsi_Host *host, struct ata_port *ap);
+ extern void ata_scsi_cmd_error_handler(struct Scsi_Host *host, struct ata_port *ap, struct list_head *eh_q);
++extern bool sata_lpm_ignore_phy_events(struct ata_link *link);
+
+ extern int ata_cable_40wire(struct ata_port *ap);
+ extern int ata_cable_80wire(struct ata_port *ap);
+diff --git a/include/linux/nilfs2_fs.h b/include/linux/nilfs2_fs.h
+index 7454ad7..d4d512f 100644
+--- a/include/linux/nilfs2_fs.h
++++ b/include/linux/nilfs2_fs.h
+@@ -457,7 +457,7 @@ struct nilfs_btree_node {
+ /* level */
+ #define NILFS_BTREE_LEVEL_DATA 0
+ #define NILFS_BTREE_LEVEL_NODE_MIN (NILFS_BTREE_LEVEL_DATA + 1)
+-#define NILFS_BTREE_LEVEL_MAX 14
++#define NILFS_BTREE_LEVEL_MAX 14 /* Max level (exclusive) */
+
+ /**
+ * struct nilfs_palloc_group_desc - block group descriptor
+diff --git a/include/linux/of.h b/include/linux/of.h
+index 9bf9611..c81ef31 100644
+--- a/include/linux/of.h
++++ b/include/linux/of.h
+@@ -211,6 +211,9 @@ extern int of_property_read_string(struct device_node *np,
+ extern int of_property_read_string_index(struct device_node *np,
+ const char *propname,
+ int index, const char **output);
++extern int of_property_match_string(struct device_node *np,
++ const char *propname,
++ const char *string);
+ extern int of_property_count_strings(struct device_node *np,
+ const char *propname);
+ extern int of_device_is_compatible(const struct device_node *device,
+@@ -315,6 +318,13 @@ static inline int of_property_read_u64(const struct device_node *np,
+ return -ENOSYS;
+ }
+
++static inline int of_property_match_string(struct device_node *np,
++ const char *propname,
++ const char *string)
++{
++ return -ENOSYS;
++}
++
+ static inline struct device_node *of_parse_phandle(struct device_node *np,
+ const char *phandle_name,
+ int index)
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index cb34ff4..44e5f47 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -2347,15 +2347,15 @@ static inline bool thread_group_leader(struct task_struct *p)
+ * all we care about is that we have a task with the appropriate
+ * pid, we don't actually care if we have the right task.
+ */
+-static inline int has_group_leader_pid(struct task_struct *p)
++static inline bool has_group_leader_pid(struct task_struct *p)
+ {
+- return p->pid == p->tgid;
++ return task_pid(p) == p->signal->leader_pid;
+ }
+
+ static inline
+-int same_thread_group(struct task_struct *p1, struct task_struct *p2)
++bool same_thread_group(struct task_struct *p1, struct task_struct *p2)
+ {
+- return p1->tgid == p2->tgid;
++ return p1->signal == p2->signal;
+ }
+
+ static inline struct task_struct *next_thread(const struct task_struct *p)
+diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
+index 416dcb0..b8b2e50 100644
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1202,6 +1202,8 @@ ip_vs_lookup_real_service(struct net *net, int af, __u16 protocol,
+
+ extern int ip_vs_use_count_inc(void);
+ extern void ip_vs_use_count_dec(void);
++extern int ip_vs_register_nl_ioctl(void);
++extern void ip_vs_unregister_nl_ioctl(void);
+ extern int ip_vs_control_init(void);
+ extern void ip_vs_control_cleanup(void);
+ extern struct ip_vs_dest *
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index a15432da..2cccd82 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -209,6 +209,7 @@ extern struct sctp_globals {
+ struct list_head addr_waitq;
+ struct timer_list addr_wq_timer;
+ struct list_head auto_asconf_splist;
++ /* Lock that protects both addr_waitq and auto_asconf_splist */
+ spinlock_t addr_wq_lock;
+
+ /* Lock that protects the local_addr_list writers */
+@@ -355,6 +356,10 @@ struct sctp_sock {
+ atomic_t pd_mode;
+ /* Receive to here while partial delivery is in effect. */
+ struct sk_buff_head pd_lobby;
++
++ /* These must be the last fields, as they will skipped on copies,
++ * like on accept and peeloff operations
++ */
+ struct list_head auto_asconf_list;
+ int do_auto_asconf;
+ };
+diff --git a/include/sound/emu10k1.h b/include/sound/emu10k1.h
+index 4f865df..7ee55e3 100644
+--- a/include/sound/emu10k1.h
++++ b/include/sound/emu10k1.h
+@@ -43,7 +43,8 @@
+
+ #define EMUPAGESIZE 4096
+ #define MAXREQVOICES 8
+-#define MAXPAGES 8192
++#define MAXPAGES0 4096 /* 32 bit mode */
++#define MAXPAGES1 8192 /* 31 bit mode */
+ #define RESERVED 0
+ #define NUM_MIDI 16
+ #define NUM_G 64 /* use all channels */
+@@ -52,8 +53,7 @@
+
+ /* FIXME? - according to the OSS driver the EMU10K1 needs a 29 bit DMA mask */
+ #define EMU10K1_DMA_MASK 0x7fffffffUL /* 31bit */
+-#define AUDIGY_DMA_MASK 0x7fffffffUL /* 31bit FIXME - 32 should work? */
+- /* See ALSA bug #1276 - rlrevell */
++#define AUDIGY_DMA_MASK 0xffffffffUL /* 32bit mode */
+
+ #define TMEMSIZE 256*1024
+ #define TMEMSIZEREG 4
+@@ -470,8 +470,11 @@
+
+ #define MAPB 0x0d /* Cache map B */
+
+-#define MAP_PTE_MASK 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
+-#define MAP_PTI_MASK 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
++#define MAP_PTE_MASK0 0xfffff000 /* The 20 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK0 0x00000fff /* The 12 bit index to one of the 4096 PTE dwords */
++
++#define MAP_PTE_MASK1 0xffffe000 /* The 19 MSBs of the PTE indexed by the PTI */
++#define MAP_PTI_MASK1 0x00001fff /* The 13 bit index to one of the 8192 PTE dwords */
+
+ /* 0x0e, 0x0f: Not used */
+
+@@ -1708,6 +1711,7 @@ struct snd_emu10k1 {
+ unsigned short model; /* subsystem id */
+ unsigned int card_type; /* EMU10K1_CARD_* */
+ unsigned int ecard_ctrl; /* ecard control bits */
++ unsigned int address_mode; /* address mode */
+ unsigned long dma_mask; /* PCI DMA mask */
+ unsigned int delay_pcm_irq; /* in samples */
+ int max_cache_pages; /* max memory size / PAGE_SIZE */
+diff --git a/include/xen/events.h b/include/xen/events.h
+index 8f3d622..89b672d 100644
+--- a/include/xen/events.h
++++ b/include/xen/events.h
+@@ -12,7 +12,7 @@ int bind_evtchn_to_irqhandler(unsigned int evtchn,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+ void *dev_id);
+-int bind_virq_to_irq(unsigned int virq, unsigned int cpu);
++int bind_virq_to_irq(unsigned int virq, unsigned int cpu, bool percpu);
+ int bind_virq_to_irqhandler(unsigned int virq, unsigned int cpu,
+ irq_handler_t handler,
+ unsigned long irqflags, const char *devname,
+diff --git a/kernel/ptrace.c b/kernel/ptrace.c
+index f79803a..f07c144 100644
+--- a/kernel/ptrace.c
++++ b/kernel/ptrace.c
+@@ -225,7 +225,7 @@ int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+ */
+ int dumpable = 0;
+ /* Don't let security modules deny introspection */
+- if (task == current)
++ if (same_thread_group(task, current))
+ return 0;
+ rcu_read_lock();
+ tcred = __task_cred(task);
+@@ -640,6 +640,8 @@ static int ptrace_setsiginfo(struct task_struct *child, const siginfo_t *info)
+ static int ptrace_resume(struct task_struct *child, long request,
+ unsigned long data)
+ {
++ bool need_siglock;
++
+ if (!valid_signal(data))
+ return -EIO;
+
+@@ -667,8 +669,26 @@ static int ptrace_resume(struct task_struct *child, long request,
+ user_disable_single_step(child);
+ }
+
++ /*
++ * Change ->exit_code and ->state under siglock to avoid the race
++ * with wait_task_stopped() in between; a non-zero ->exit_code will
++ * wrongly look like another report from tracee.
++ *
++ * Note that we need siglock even if ->exit_code == data and/or this
++ * status was not reported yet, the new status must not be cleared by
++ * wait_task_stopped() after resume.
++ *
++ * If data == 0 we do not care if wait_task_stopped() reports the old
++ * status and clears the code too; this can't race with the tracee, it
++ * takes siglock after resume.
++ */
++ need_siglock = data && !thread_group_empty(current);
++ if (need_siglock)
++ spin_lock_irq(&child->sighand->siglock);
+ child->exit_code = data;
+ wake_up_state(child, __TASK_TRACED);
++ if (need_siglock)
++ spin_unlock_irq(&child->sighand->siglock);
+
+ return 0;
+ }
+diff --git a/kernel/softirq.c b/kernel/softirq.c
+index 2c71d91..44bc103 100644
+--- a/kernel/softirq.c
++++ b/kernel/softirq.c
+@@ -194,22 +194,28 @@ void local_bh_enable_ip(unsigned long ip)
+ EXPORT_SYMBOL(local_bh_enable_ip);
+
+ /*
+- * We restart softirq processing MAX_SOFTIRQ_RESTART times,
+- * and we fall back to softirqd after that.
++ * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
++ * but break the loop if need_resched() is set or after 2 ms.
++ * The MAX_SOFTIRQ_TIME provides a nice upper bound in most cases, but in
++ * certain cases, such as stop_machine(), jiffies may cease to
++ * increment and so we need the MAX_SOFTIRQ_RESTART limit as
++ * well to make sure we eventually return from this method.
+ *
+- * This number has been established via experimentation.
++ * These limits have been established via experimentation.
+ * The two things to balance is latency against fairness -
+ * we want to handle softirqs as soon as possible, but they
+ * should not be able to lock up the box.
+ */
++#define MAX_SOFTIRQ_TIME msecs_to_jiffies(2)
+ #define MAX_SOFTIRQ_RESTART 10
+
+ asmlinkage void __do_softirq(void)
+ {
+ struct softirq_action *h;
+ __u32 pending;
+- int max_restart = MAX_SOFTIRQ_RESTART;
++ unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
+ int cpu;
++ int max_restart = MAX_SOFTIRQ_RESTART;
+
+ pending = local_softirq_pending();
+ account_system_vtime(current);
+@@ -255,11 +261,13 @@ restart:
+ local_irq_disable();
+
+ pending = local_softirq_pending();
+- if (pending && --max_restart)
+- goto restart;
++ if (pending) {
++ if (time_before(jiffies, end) && !need_resched() &&
++ --max_restart)
++ goto restart;
+
+- if (pending)
+ wakeup_softirqd();
++ }
+
+ lockdep_softirq_exit();
+
+diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffer_benchmark.c
+index a5457d5..6ad2e2d 100644
+--- a/kernel/trace/ring_buffer_benchmark.c
++++ b/kernel/trace/ring_buffer_benchmark.c
+@@ -455,7 +455,7 @@ static int __init ring_buffer_benchmark_init(void)
+
+ if (producer_fifo >= 0) {
+ struct sched_param param = {
+- .sched_priority = consumer_fifo
++ .sched_priority = producer_fifo
+ };
+ sched_setscheduler(producer, SCHED_FIFO, ¶m);
+ } else
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index b0996c1..47343cc 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1343,19 +1343,25 @@ static int check_preds(struct filter_parse_state *ps)
+ {
+ int n_normal_preds = 0, n_logical_preds = 0;
+ struct postfix_elt *elt;
++ int cnt = 0;
+
+ list_for_each_entry(elt, &ps->postfix, list) {
+- if (elt->op == OP_NONE)
++ if (elt->op == OP_NONE) {
++ cnt++;
+ continue;
++ }
+
+ if (elt->op == OP_AND || elt->op == OP_OR) {
+ n_logical_preds++;
++ cnt--;
+ continue;
+ }
++ cnt--;
+ n_normal_preds++;
++ WARN_ON_ONCE(cnt < 0);
+ }
+
+- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
++ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
+ parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
+ return -EINVAL;
+ }
+diff --git a/lib/string.c b/lib/string.c
+index 40136f6..dcbe695 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -595,7 +595,7 @@ EXPORT_SYMBOL(memset);
+ void memzero_explicit(void *s, size_t count)
+ {
+ memset(s, 0, count);
+- OPTIMIZER_HIDE_VAR(s);
++ barrier();
+ }
+ EXPORT_SYMBOL(memzero_explicit);
+
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index 1bf1f74..62bfbd9 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -560,7 +560,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ */
+ setpoint = (freerun + limit) / 2;
+ x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+- limit - setpoint + 1);
++ (limit - setpoint) | 1);
+ pos_ratio = x;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+ pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -611,7 +611,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ * scale global setpoint to bdi's:
+ * bdi_setpoint = setpoint * bdi_thresh / thresh
+ */
+- x = div_u64((u64)bdi_thresh << 16, thresh + 1);
++ x = div_u64((u64)bdi_thresh << 16, thresh | 1);
+ bdi_setpoint = setpoint * (u64)x >> 16;
+ /*
+ * Use span=(8*write_bw) in single bdi case as indicated by
+@@ -626,7 +626,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+
+ if (bdi_dirty < x_intercept - span / 4) {
+ pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+- x_intercept - bdi_setpoint + 1);
++ (x_intercept - bdi_setpoint) | 1);
+ } else
+ pos_ratio /= 4;
+
+diff --git a/mm/slub.c b/mm/slub.c
+index 6a4c2fb..60c6969 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1873,18 +1873,24 @@ redo:
+ /* Unfreeze all the cpu partial slabs */
+ static void unfreeze_partials(struct kmem_cache *s)
+ {
+- struct kmem_cache_node *n = NULL;
++ struct kmem_cache_node *n = NULL, *n2 = NULL;
+ struct kmem_cache_cpu *c = this_cpu_ptr(s->cpu_slab);
+ struct page *page, *discard_page = NULL;
+
+ while ((page = c->partial)) {
+- enum slab_modes { M_PARTIAL, M_FREE };
+- enum slab_modes l, m;
+ struct page new;
+ struct page old;
+
+ c->partial = page->next;
+- l = M_FREE;
++
++ n2 = get_node(s, page_to_nid(page));
++ if (n != n2) {
++ if (n)
++ spin_unlock(&n->list_lock);
++
++ n = n2;
++ spin_lock(&n->list_lock);
++ }
+
+ do {
+
+@@ -1897,40 +1903,17 @@ static void unfreeze_partials(struct kmem_cache *s)
+
+ new.frozen = 0;
+
+- if (!new.inuse && (!n || n->nr_partial > s->min_partial))
+- m = M_FREE;
+- else {
+- struct kmem_cache_node *n2 = get_node(s,
+- page_to_nid(page));
+-
+- m = M_PARTIAL;
+- if (n != n2) {
+- if (n)
+- spin_unlock(&n->list_lock);
+-
+- n = n2;
+- spin_lock(&n->list_lock);
+- }
+- }
+-
+- if (l != m) {
+- if (l == M_PARTIAL)
+- remove_partial(n, page);
+- else
+- add_partial(n, page,
+- DEACTIVATE_TO_TAIL);
+-
+- l = m;
+- }
+-
+ } while (!cmpxchg_double_slab(s, page,
+ old.freelist, old.counters,
+ new.freelist, new.counters,
+ "unfreezing slab"));
+
+- if (m == M_FREE) {
++ if (unlikely(!new.inuse && n->nr_partial > s->min_partial)) {
+ page->next = discard_page;
+ discard_page = page;
++ } else {
++ add_partial(n, page, DEACTIVATE_TO_TAIL);
++ stat(s, FREE_ADD_PARTIAL);
+ }
+ }
+
+diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
+index 7222fe1..ea0e15c 100644
+--- a/net/bridge/br_ioctl.c
++++ b/net/bridge/br_ioctl.c
+@@ -246,9 +246,7 @@ static int old_dev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
+ if (!capable(CAP_NET_ADMIN))
+ return -EPERM;
+
+- spin_lock_bh(&br->lock);
+ br_stp_set_bridge_priority(br, args[1]);
+- spin_unlock_bh(&br->lock);
+ return 0;
+
+ case BRCTL_SET_PORT_PRIORITY:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 398a297..1bd197f 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -972,7 +972,7 @@ static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+ }
+
+ err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+- if (!err)
++ if (err)
+ break;
+ }
+
+@@ -991,6 +991,9 @@ static void br_multicast_add_router(struct net_bridge *br,
+ struct net_bridge_port *p;
+ struct hlist_node *n, *slot = NULL;
+
++ if (!hlist_unhashed(&port->rlist))
++ return;
++
+ hlist_for_each_entry(p, n, &br->router_list, rlist) {
+ if ((unsigned long) port >= (unsigned long) p)
+ break;
+@@ -1018,12 +1021,8 @@ static void br_multicast_mark_router(struct net_bridge *br,
+ if (port->multicast_router != 1)
+ return;
+
+- if (!hlist_unhashed(&port->rlist))
+- goto timer;
+-
+ br_multicast_add_router(br, port);
+
+-timer:
+ mod_timer(&port->multicast_router_timer,
+ now + br->multicast_querier_interval);
+ }
+diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
+index 19308e3..0f7dc60 100644
+--- a/net/bridge/br_stp_if.c
++++ b/net/bridge/br_stp_if.c
+@@ -235,12 +235,13 @@ bool br_stp_recalculate_bridge_id(struct net_bridge *br)
+ return true;
+ }
+
+-/* called under bridge lock */
++/* Acquires and releases bridge lock */
+ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ {
+ struct net_bridge_port *p;
+ int wasroot;
+
++ spin_lock_bh(&br->lock);
+ wasroot = br_is_root_bridge(br);
+
+ list_for_each_entry(p, &br->port_list, list) {
+@@ -258,6 +259,7 @@ void br_stp_set_bridge_priority(struct net_bridge *br, u16 newprio)
+ br_port_state_selection(br);
+ if (br_is_root_bridge(br) && !wasroot)
+ br_become_root_bridge(br);
++ spin_unlock_bh(&br->lock);
+ }
+
+ /* called under bridge lock */
+diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
+index 7eed9eb..7e4b4b4 100644
+--- a/net/caif/caif_socket.c
++++ b/net/caif/caif_socket.c
+@@ -366,6 +366,10 @@ static long caif_stream_data_wait(struct sock *sk, long timeo)
+ release_sock(sk);
+ timeo = schedule_timeout(timeo);
+ lock_sock(sk);
++
++ if (sock_flag(sk, SOCK_DEAD))
++ break;
++
+ clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ }
+
+@@ -410,6 +414,10 @@ static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ lock_sock(sk);
++ if (sock_flag(sk, SOCK_DEAD)) {
++ err = -ECONNRESET;
++ goto unlock;
++ }
+ skb = skb_dequeue(&sk->sk_receive_queue);
+ caif_check_flow_release(sk);
+
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 0ea3fd3..c8c2645 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -955,6 +955,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
+ rc = 0;
+ if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
+ goto out_unlock_bh;
++ if (neigh->dead)
++ goto out_dead;
+
+ if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
+ if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+@@ -1003,6 +1005,13 @@ out_unlock_bh:
+ write_unlock(&neigh->lock);
+ local_bh_enable();
+ return rc;
++
++out_dead:
++ if (neigh->nud_state & NUD_STALE)
++ goto out_unlock_bh;
++ write_unlock_bh(&neigh->lock);
++ kfree_skb(skb);
++ return 1;
+ }
+ EXPORT_SYMBOL(__neigh_event_send);
+
+@@ -1066,6 +1075,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
+ (old & (NUD_NOARP | NUD_PERMANENT)))
+ goto out;
++ if (neigh->dead)
++ goto out;
+
+ if (!(new & NUD_VALID)) {
+ neigh_del_timer(neigh);
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 8c2e259..5e92043 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1248,10 +1248,8 @@ csum_copy_err:
+ UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index d131a95..dc08afd 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -451,10 +451,8 @@ csum_copy_err:
+ }
+ unlock_sock_fast(sk, slow);
+
+- if (noblock)
+- return -EAGAIN;
+-
+- /* starting over for a new packet */
++ /* starting over for a new packet, but check if we need to yield */
++ cond_resched();
+ msg->msg_flags &= ~MSG_TRUNC;
+ goto try_again;
+ }
+diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
+index a1c6bfd..34583c5 100644
+--- a/net/mac80211/wep.c
++++ b/net/mac80211/wep.c
+@@ -97,8 +97,7 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
+
+ hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
+
+- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
+- skb_headroom(skb) < WEP_IV_LEN))
++ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
+ return NULL;
+
+ hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -160,6 +159,9 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
+ size_t len;
+ u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+
++ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
++ return -1;
++
+ iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
+ if (!iv)
+ return -1;
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index d864aaf..197ed93 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -2003,10 +2003,18 @@ static int __init ip_vs_init(void)
+ goto cleanup_dev;
+ }
+
++ ret = ip_vs_register_nl_ioctl();
++ if (ret < 0) {
++ pr_err("can't register netlink/ioctl.\n");
++ goto cleanup_hooks;
++ }
++
+ pr_info("ipvs loaded.\n");
+
+ return ret;
+
++cleanup_hooks:
++ nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ cleanup_dev:
+ unregister_pernet_device(&ipvs_core_dev_ops);
+ cleanup_sub:
+@@ -2022,6 +2030,7 @@ exit:
+
+ static void __exit ip_vs_cleanup(void)
+ {
++ ip_vs_unregister_nl_ioctl();
+ nf_unregister_hooks(ip_vs_ops, ARRAY_SIZE(ip_vs_ops));
+ unregister_pernet_device(&ipvs_core_dev_ops);
+ unregister_pernet_subsys(&ipvs_core_ops); /* free ip_vs struct */
+diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
+index 93acfa1..1e27a1f 100644
+--- a/net/netfilter/ipvs/ip_vs_ctl.c
++++ b/net/netfilter/ipvs/ip_vs_ctl.c
+@@ -3689,6 +3689,9 @@ void __net_init ip_vs_control_net_cleanup_sysctl(struct net *net)
+ cancel_work_sync(&ipvs->defense_work.work);
+ unregister_net_sysctl_table(ipvs->sysctl_hdr);
+ ip_vs_stop_estimator(net, &ipvs->tot_stats);
++
++ if (!net_eq(net, &init_net))
++ kfree(ipvs->sysctl_tbl);
+ }
+
+ #else
+@@ -3751,21 +3754,10 @@ void __net_exit ip_vs_control_net_cleanup(struct net *net)
+ free_percpu(ipvs->tot_stats.cpustats);
+ }
+
+-int __init ip_vs_control_init(void)
++int __init ip_vs_register_nl_ioctl(void)
+ {
+- int idx;
+ int ret;
+
+- EnterFunction(2);
+-
+- /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
+- for(idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
+- INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
+- INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
+- }
+-
+- smp_wmb(); /* Do we really need it now ? */
+-
+ ret = nf_register_sockopt(&ip_vs_sockopts);
+ if (ret) {
+ pr_err("cannot register sockopt.\n");
+@@ -3777,28 +3769,47 @@ int __init ip_vs_control_init(void)
+ pr_err("cannot register Generic Netlink interface.\n");
+ goto err_genl;
+ }
+-
+- ret = register_netdevice_notifier(&ip_vs_dst_notifier);
+- if (ret < 0)
+- goto err_notf;
+-
+- LeaveFunction(2);
+ return 0;
+
+-err_notf:
+- ip_vs_genl_unregister();
+ err_genl:
+ nf_unregister_sockopt(&ip_vs_sockopts);
+ err_sock:
+ return ret;
+ }
+
++void ip_vs_unregister_nl_ioctl(void)
++{
++ ip_vs_genl_unregister();
++ nf_unregister_sockopt(&ip_vs_sockopts);
++}
++
++int __init ip_vs_control_init(void)
++{
++ int idx;
++ int ret;
++
++ EnterFunction(2);
++
++ /* Initialize svc_table, ip_vs_svc_fwm_table, rs_table */
++ for (idx = 0; idx < IP_VS_SVC_TAB_SIZE; idx++) {
++ INIT_LIST_HEAD(&ip_vs_svc_table[idx]);
++ INIT_LIST_HEAD(&ip_vs_svc_fwm_table[idx]);
++ }
++
++ smp_wmb(); /* Do we really need it now ? */
++
++ ret = register_netdevice_notifier(&ip_vs_dst_notifier);
++ if (ret < 0)
++ return ret;
++
++ LeaveFunction(2);
++ return 0;
++}
++
+
+ void ip_vs_control_cleanup(void)
+ {
+ EnterFunction(2);
+ unregister_netdevice_notifier(&ip_vs_dst_notifier);
+- ip_vs_genl_unregister();
+- nf_unregister_sockopt(&ip_vs_sockopts);
+ LeaveFunction(2);
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 4f19bf2..0c21f06 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1170,16 +1170,6 @@ static void packet_sock_destruct(struct sock *sk)
+ sk_refcnt_debug_dec(sk);
+ }
+
+-static int fanout_rr_next(struct packet_fanout *f, unsigned int num)
+-{
+- int x = atomic_read(&f->rr_cur) + 1;
+-
+- if (x >= num)
+- x = 0;
+-
+- return x;
+-}
+-
+ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+ u32 idx, hash = skb->rxhash;
+@@ -1191,13 +1181,9 @@ static struct sock *fanout_demux_hash(struct packet_fanout *f, struct sk_buff *s
+
+ static struct sock *fanout_demux_lb(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+ {
+- int cur, old;
++ unsigned int val = atomic_inc_return(&f->rr_cur);
+
+- cur = atomic_read(&f->rr_cur);
+- while ((old = atomic_cmpxchg(&f->rr_cur, cur,
+- fanout_rr_next(f, num))) != cur)
+- cur = old;
+- return f->arr[cur];
++ return f->arr[val % num];
+ }
+
+ static struct sock *fanout_demux_cpu(struct packet_fanout *f, struct sk_buff *skb, unsigned int num)
+@@ -1211,7 +1197,7 @@ static int packet_rcv_fanout(struct sk_buff *skb, struct net_device *dev,
+ struct packet_type *pt, struct net_device *orig_dev)
+ {
+ struct packet_fanout *f = pt->af_packet_priv;
+- unsigned int num = f->num_members;
++ unsigned int num = ACCESS_ONCE(f->num_members);
+ struct packet_sock *po;
+ struct sock *sk;
+
+diff --git a/net/sctp/output.c b/net/sctp/output.c
+index c3b8549..6d56eec 100644
+--- a/net/sctp/output.c
++++ b/net/sctp/output.c
+@@ -587,7 +587,9 @@ out:
+ return err;
+ no_route:
+ kfree_skb(nskb);
+- IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
++
++ if (asoc)
++ IP_INC_STATS(&init_net, IPSTATS_MIB_OUTNOROUTES);
+
+ /* FIXME: Returning the 'err' will effect all the associations
+ * associated with a socket, although only one of the paths of the
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index fc63664..24e88af 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -1539,8 +1539,10 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+
+ /* Supposedly, no process has access to the socket, but
+ * the net layers still may.
++ * Also, sctp_destroy_sock() needs to be called with addr_wq_lock
++ * held and that should be grabbed before socket lock.
+ */
+- sctp_local_bh_disable();
++ spin_lock_bh(&sctp_globals.addr_wq_lock);
+ sctp_bh_lock_sock(sk);
+
+ /* Hold the sock, since sk_common_release() will put sock_put()
+@@ -1550,7 +1552,7 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
+ sk_common_release(sk);
+
+ sctp_bh_unlock_sock(sk);
+- sctp_local_bh_enable();
++ spin_unlock_bh(&sctp_globals.addr_wq_lock);
+
+ sock_put(sk);
+
+@@ -3499,6 +3501,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ if ((val && sp->do_auto_asconf) || (!val && !sp->do_auto_asconf))
+ return 0;
+
++ spin_lock_bh(&sctp_globals.addr_wq_lock);
+ if (val == 0 && sp->do_auto_asconf) {
+ list_del(&sp->auto_asconf_list);
+ sp->do_auto_asconf = 0;
+@@ -3507,6 +3510,7 @@ static int sctp_setsockopt_auto_asconf(struct sock *sk, char __user *optval,
+ &sctp_auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+ }
++ spin_unlock_bh(&sctp_globals.addr_wq_lock);
+ return 0;
+ }
+
+@@ -3942,18 +3946,28 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
+ local_bh_disable();
+ percpu_counter_inc(&sctp_sockets_allocated);
+ sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
++
++ /* Nothing can fail after this block, otherwise
++ * sctp_destroy_sock() will be called without addr_wq_lock held
++ */
+ if (sctp_default_auto_asconf) {
++ spin_lock(&sctp_globals.addr_wq_lock);
+ list_add_tail(&sp->auto_asconf_list,
+ &sctp_auto_asconf_splist);
+ sp->do_auto_asconf = 1;
+- } else
++ spin_unlock(&sctp_globals.addr_wq_lock);
++ } else {
+ sp->do_auto_asconf = 0;
++ }
++
+ local_bh_enable();
+
+ return 0;
+ }
+
+-/* Cleanup any SCTP per socket resources. */
++/* Cleanup any SCTP per socket resources. Must be called with
++ * sctp_globals.addr_wq_lock held if sp->do_auto_asconf is true
++ */
+ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
+ {
+ struct sctp_sock *sp;
+@@ -6719,6 +6733,19 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
+ newinet->mc_list = NULL;
+ }
+
++static inline void sctp_copy_descendant(struct sock *sk_to,
++ const struct sock *sk_from)
++{
++ int ancestor_size = sizeof(struct inet_sock) +
++ sizeof(struct sctp_sock) -
++ offsetof(struct sctp_sock, auto_asconf_list);
++
++ if (sk_from->sk_family == PF_INET6)
++ ancestor_size += sizeof(struct ipv6_pinfo);
++
++ __inet_sk_copy_descendant(sk_to, sk_from, ancestor_size);
++}
++
+ /* Populate the fields of the newsk from the oldsk and migrate the assoc
+ * and its messages to the newsk.
+ */
+@@ -6733,7 +6760,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ struct sk_buff *skb, *tmp;
+ struct sctp_ulpevent *event;
+ struct sctp_bind_hashbucket *head;
+- struct list_head tmplist;
+
+ /* Migrate socket buffer sizes and all the socket level options to the
+ * new socket.
+@@ -6741,12 +6767,7 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
+ newsk->sk_sndbuf = oldsk->sk_sndbuf;
+ newsk->sk_rcvbuf = oldsk->sk_rcvbuf;
+ /* Brute force copy old sctp opt. */
+- if (oldsp->do_auto_asconf) {
+- memcpy(&tmplist, &newsp->auto_asconf_list, sizeof(tmplist));
+- inet_sk_copy_descendant(newsk, oldsk);
+- memcpy(&newsp->auto_asconf_list, &tmplist, sizeof(tmplist));
+- } else
+- inet_sk_copy_descendant(newsk, oldsk);
++ sctp_copy_descendant(newsk, oldsk);
+
+ /* Restore the ep value that was overwritten with the above structure
+ * copy.
+diff --git a/net/socket.c b/net/socket.c
+index 116cf9d..10ea25a 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -1911,14 +1911,12 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+ int err, ctl_len, iov_size, total_len;
+
+ err = -EFAULT;
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ /* do not move before msg_sys is valid */
+ err = -EMSGSIZE;
+@@ -2130,14 +2128,12 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+ struct sockaddr __user *uaddr;
+ int __user *uaddr_len;
+
+- if (MSG_CMSG_COMPAT & flags) {
+- if (get_compat_msghdr(msg_sys, msg_compat))
+- return -EFAULT;
+- } else {
++ if (MSG_CMSG_COMPAT & flags)
++ err = get_compat_msghdr(msg_sys, msg_compat);
++ else
+ err = copy_msghdr_from_user(msg_sys, msg);
+- if (err)
+- return err;
+- }
++ if (err)
++ return err;
+
+ err = -EMSGSIZE;
+ if (msg_sys->msg_iovlen > UIO_MAXIOV)
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 8705ee3..9b1f371 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1870,6 +1870,10 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
+ unix_state_unlock(sk);
+ timeo = schedule_timeout(timeo);
+ unix_state_lock(sk);
++
++ if (sock_flag(sk, SOCK_DEAD))
++ break;
++
+ clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+ }
+
+@@ -1930,6 +1934,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+ struct sk_buff *skb;
+
+ unix_state_lock(sk);
++ if (sock_flag(sk, SOCK_DEAD)) {
++ err = -ECONNRESET;
++ goto unlock;
++ }
+ skb = skb_peek(&sk->sk_receive_queue);
+ if (skb == NULL) {
+ unix_sk(sk)->recursion_level = 0;
+diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c
+index 0920ea3..5776921 100644
+--- a/security/selinux/nlmsgtab.c
++++ b/security/selinux/nlmsgtab.c
+@@ -100,6 +100,12 @@ static struct nlmsg_perm nlmsg_xfrm_perms[] =
+ { XFRM_MSG_FLUSHPOLICY, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_NEWAE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
+ { XFRM_MSG_GETAE, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_REPORT, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MIGRATE, NETLINK_XFRM_SOCKET__NLMSG_WRITE },
++ { XFRM_MSG_NEWSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSADINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_GETSPDINFO, NETLINK_XFRM_SOCKET__NLMSG_READ },
++ { XFRM_MSG_MAPPING, NETLINK_XFRM_SOCKET__NLMSG_READ },
+ };
+
+ static struct nlmsg_perm nlmsg_audit_perms[] =
+diff --git a/sound/pci/emu10k1/emu10k1.c b/sound/pci/emu10k1/emu10k1.c
+index eaa198e..f33e3cc 100644
+--- a/sound/pci/emu10k1/emu10k1.c
++++ b/sound/pci/emu10k1/emu10k1.c
+@@ -181,8 +181,10 @@ static int __devinit snd_card_emu10k1_probe(struct pci_dev *pci,
+ }
+ #endif
+
+- strcpy(card->driver, emu->card_capabilities->driver);
+- strcpy(card->shortname, emu->card_capabilities->name);
++ strlcpy(card->driver, emu->card_capabilities->driver,
++ sizeof(card->driver));
++ strlcpy(card->shortname, emu->card_capabilities->name,
++ sizeof(card->shortname));
+ snprintf(card->longname, sizeof(card->longname),
+ "%s (rev.%d, serial:0x%x) at 0x%lx, irq %i",
+ card->shortname, emu->revision, emu->serial, emu->port, emu->irq);
+diff --git a/sound/pci/emu10k1/emu10k1_callback.c b/sound/pci/emu10k1/emu10k1_callback.c
+index f35284b..8295950 100644
+--- a/sound/pci/emu10k1/emu10k1_callback.c
++++ b/sound/pci/emu10k1/emu10k1_callback.c
+@@ -415,7 +415,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, Z2, ch, 0);
+
+ /* invalidate maps */
+- temp = (hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = (hw->silent_page.addr << hw->address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+ #if 0
+@@ -436,7 +436,7 @@ start_voice(struct snd_emux_voice *vp)
+ snd_emu10k1_ptr_write(hw, CDF, ch, sample);
+
+ /* invalidate maps */
+- temp = ((unsigned int)hw->silent_page.addr << 1) | MAP_PTI_MASK;
++ temp = ((unsigned int)hw->silent_page.addr << hw_address_mode) | (hw->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(hw, MAPA, ch, temp);
+ snd_emu10k1_ptr_write(hw, MAPB, ch, temp);
+
+diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c
+index d37b946..705e73e 100644
+--- a/sound/pci/emu10k1/emu10k1_main.c
++++ b/sound/pci/emu10k1/emu10k1_main.c
+@@ -282,7 +282,7 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ snd_emu10k1_ptr_write(emu, TCB, 0, 0); /* taken from original driver */
+ snd_emu10k1_ptr_write(emu, TCBS, 0, 4); /* taken from original driver */
+
+- silent_page = (emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = (emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ for (ch = 0; ch < NUM_G; ch++) {
+ snd_emu10k1_ptr_write(emu, MAPA, ch, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, ch, silent_page);
+@@ -348,6 +348,11 @@ static int snd_emu10k1_init(struct snd_emu10k1 *emu, int enable_ir, int resume)
+ outl(reg | A_IOCFG_GPOUT0, emu->port + A_IOCFG);
+ }
+
++ if (emu->address_mode == 0) {
++ /* use 16M in 4G */
++ outl(inl(emu->port + HCFG) | HCFG_EXPANDED_MEM, emu->port + HCFG);
++ }
++
+ return 0;
+ }
+
+@@ -1390,7 +1395,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ *
+ */
+ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x20011102,
+- .driver = "Audigy2", .name = "SB Audigy 2 ZS Notebook [SB0530]",
++ .driver = "Audigy2", .name = "Audigy 2 ZS Notebook [SB0530]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0108_chip = 1,
+@@ -1528,7 +1533,7 @@ static struct snd_emu_chip_details emu_chip_details[] = {
+ .adc_1361t = 1, /* 24 bit capture instead of 16bit */
+ .ac97_chip = 1} ,
+ {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x10051102,
+- .driver = "Audigy2", .name = "SB Audigy 2 Platinum EX [SB0280]",
++ .driver = "Audigy2", .name = "Audigy 2 Platinum EX [SB0280]",
+ .id = "Audigy2",
+ .emu10k2_chip = 1,
+ .ca0102_chip = 1,
+@@ -1832,8 +1837,10 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ is_audigy = emu->audigy = c->emu10k2_chip;
+
++ /* set addressing mode */
++ emu->address_mode = is_audigy ? 0 : 1;
+ /* set the DMA transfer mask */
+- emu->dma_mask = is_audigy ? AUDIGY_DMA_MASK : EMU10K1_DMA_MASK;
++ emu->dma_mask = emu->address_mode ? EMU10K1_DMA_MASK : AUDIGY_DMA_MASK;
+ if (pci_set_dma_mask(pci, emu->dma_mask) < 0 ||
+ pci_set_consistent_dma_mask(pci, emu->dma_mask) < 0) {
+ snd_printk(KERN_ERR "architecture does not support PCI busmaster DMA with mask 0x%lx\n", emu->dma_mask);
+@@ -1856,7 +1863,7 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ emu->max_cache_pages = max_cache_bytes >> PAGE_SHIFT;
+ if (snd_dma_alloc_pages(SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(pci),
+- 32 * 1024, &emu->ptb_pages) < 0) {
++ (emu->address_mode ? 32 : 16) * 1024, &emu->ptb_pages) < 0) {
+ err = -ENOMEM;
+ goto error;
+ }
+@@ -1955,8 +1962,8 @@ int __devinit snd_emu10k1_create(struct snd_card *card,
+
+ /* Clear silent pages and set up pointers */
+ memset(emu->silent_page.area, 0, PAGE_SIZE);
+- silent_page = emu->silent_page.addr << 1;
+- for (idx = 0; idx < MAXPAGES; idx++)
++ silent_page = emu->silent_page.addr << emu->address_mode;
++ for (idx = 0; idx < (emu->address_mode ? MAXPAGES1 : MAXPAGES0); idx++)
+ ((u32 *)emu->ptb_pages.area)[idx] = cpu_to_le32(silent_page | idx);
+
+ /* set up voice indices */
+diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c
+index e22b8e2..c673d2b 100644
+--- a/sound/pci/emu10k1/emupcm.c
++++ b/sound/pci/emu10k1/emupcm.c
+@@ -379,7 +379,7 @@ static void snd_emu10k1_pcm_init_voice(struct snd_emu10k1 *emu,
+ snd_emu10k1_ptr_write(emu, Z1, voice, 0);
+ snd_emu10k1_ptr_write(emu, Z2, voice, 0);
+ /* invalidate maps */
+- silent_page = ((unsigned int)emu->silent_page.addr << 1) | MAP_PTI_MASK;
++ silent_page = ((unsigned int)emu->silent_page.addr << emu->address_mode) | (emu->address_mode ? MAP_PTI_MASK1 : MAP_PTI_MASK0);
+ snd_emu10k1_ptr_write(emu, MAPA, voice, silent_page);
+ snd_emu10k1_ptr_write(emu, MAPB, voice, silent_page);
+ /* modulation envelope */
+diff --git a/sound/pci/emu10k1/emuproc.c b/sound/pci/emu10k1/emuproc.c
+index bc38dd4..9c499e6 100644
+--- a/sound/pci/emu10k1/emuproc.c
++++ b/sound/pci/emu10k1/emuproc.c
+@@ -241,31 +241,22 @@ static void snd_emu10k1_proc_spdif_read(struct snd_info_entry *entry,
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+ u32 value2;
+- unsigned long flags;
+ u32 rate;
+
+ if (emu->card_capabilities->emu_model) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x38, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x1) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x2a, &value);
+ snd_emu1010_fpga_read(emu, 0x2b, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "ADAT Locked : %u\n", rate);
+ } else {
+ snd_iprintf(buffer, "ADAT Unlocked\n");
+ }
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x20, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ if ((value & 0x4) == 0) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, 0x28, &value);
+ snd_emu1010_fpga_read(emu, 0x29, &value2);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ rate = 0x1770000 / (((value << 5) | value2)+1);
+ snd_iprintf(buffer, "SPDIF Locked : %d\n", rate);
+ } else {
+@@ -410,14 +401,11 @@ static void snd_emu_proc_emu1010_reg_read(struct snd_info_entry *entry,
+ {
+ struct snd_emu10k1 *emu = entry->private_data;
+ u32 value;
+- unsigned long flags;
+ int i;
+ snd_iprintf(buffer, "EMU1010 Registers:\n\n");
+
+ for(i = 0; i < 0x40; i+=1) {
+- spin_lock_irqsave(&emu->emu_lock, flags);
+ snd_emu1010_fpga_read(emu, i, &value);
+- spin_unlock_irqrestore(&emu->emu_lock, flags);
+ snd_iprintf(buffer, "%02X: %08X, %02X\n", i, value, (value >> 8) & 0x7f);
+ }
+ }
+diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c
+index 4f502a2..87b7c65 100644
+--- a/sound/pci/emu10k1/memory.c
++++ b/sound/pci/emu10k1/memory.c
+@@ -34,10 +34,11 @@
+ * aligned pages in others
+ */
+ #define __set_ptb_entry(emu,page,addr) \
+- (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << 1) | (page)))
++ (((u32 *)(emu)->ptb_pages.area)[page] = cpu_to_le32(((addr) << (emu->address_mode)) | (page)))
+
+ #define UNIT_PAGES (PAGE_SIZE / EMUPAGESIZE)
+-#define MAX_ALIGN_PAGES (MAXPAGES / UNIT_PAGES)
++#define MAX_ALIGN_PAGES0 (MAXPAGES0 / UNIT_PAGES)
++#define MAX_ALIGN_PAGES1 (MAXPAGES1 / UNIT_PAGES)
+ /* get aligned page from offset address */
+ #define get_aligned_page(offset) ((offset) >> PAGE_SHIFT)
+ /* get offset address from aligned page */
+@@ -124,7 +125,7 @@ static int search_empty_map_area(struct snd_emu10k1 *emu, int npages, struct lis
+ }
+ page = blk->mapped_page + blk->pages;
+ }
+- size = MAX_ALIGN_PAGES - page;
++ size = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0) - page;
+ if (size >= max_size) {
+ *nextp = pos;
+ return page;
+@@ -181,7 +182,7 @@ static int unmap_memblk(struct snd_emu10k1 *emu, struct snd_emu10k1_memblk *blk)
+ q = get_emu10k1_memblk(p, mapped_link);
+ end_page = q->mapped_page;
+ } else
+- end_page = MAX_ALIGN_PAGES;
++ end_page = (emu->address_mode ? MAX_ALIGN_PAGES1 : MAX_ALIGN_PAGES0);
+
+ /* remove links */
+ list_del(&blk->mapped_link);
+@@ -305,7 +306,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst
+ if (snd_BUG_ON(!emu))
+ return NULL;
+ if (snd_BUG_ON(runtime->dma_bytes <= 0 ||
+- runtime->dma_bytes >= MAXPAGES * EMUPAGESIZE))
++ runtime->dma_bytes >= (emu->address_mode ? MAXPAGES1 : MAXPAGES0) * EMUPAGESIZE))
+ return NULL;
+ hdr = emu->memhdr;
+ if (snd_BUG_ON(!hdr))
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 843d9f3..6a524fb 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -4598,6 +4598,14 @@ static const struct hda_codec_preset snd_hda_preset_conexant[] = {
+ .patch = patch_conexant_auto },
+ { .id = 0x14f150b9, .name = "CX20665",
+ .patch = patch_conexant_auto },
++ { .id = 0x14f150f1, .name = "CX20721",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f2, .name = "CX20722",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f3, .name = "CX20723",
++ .patch = patch_conexant_auto },
++ { .id = 0x14f150f4, .name = "CX20724",
++ .patch = patch_conexant_auto },
+ { .id = 0x14f1510f, .name = "CX20751/2",
+ .patch = patch_conexant_auto },
+ { .id = 0x14f15110, .name = "CX20751/2",
+@@ -4632,6 +4640,10 @@ MODULE_ALIAS("snd-hda-codec-id:14f150ab");
+ MODULE_ALIAS("snd-hda-codec-id:14f150ac");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b8");
+ MODULE_ALIAS("snd-hda-codec-id:14f150b9");
++MODULE_ALIAS("snd-hda-codec-id:14f150f1");
++MODULE_ALIAS("snd-hda-codec-id:14f150f2");
++MODULE_ALIAS("snd-hda-codec-id:14f150f3");
++MODULE_ALIAS("snd-hda-codec-id:14f150f4");
+ MODULE_ALIAS("snd-hda-codec-id:14f1510f");
+ MODULE_ALIAS("snd-hda-codec-id:14f15110");
+ MODULE_ALIAS("snd-hda-codec-id:14f15111");
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 561d5e0..e99c10b 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -475,10 +475,10 @@ static int cs4271_probe(struct snd_soc_codec *codec)
+ if (gpio_nreset >= 0) {
+ /* Reset codec */
+ gpio_direction_output(gpio_nreset, 0);
+- udelay(1);
++ mdelay(1);
+ gpio_set_value(gpio_nreset, 1);
+ /* Give the codec time to wake up */
+- udelay(1);
++ mdelay(1);
+ }
+
+ cs4271->gpio_nreset = gpio_nreset;
+diff --git a/sound/soc/codecs/wm8741.c b/sound/soc/codecs/wm8741.c
+index 57ad22a..6ab4f27 100644
+--- a/sound/soc/codecs/wm8741.c
++++ b/sound/soc/codecs/wm8741.c
+@@ -117,7 +117,7 @@ static struct {
+ };
+
+ static unsigned int rates_11289[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_11289 = {
+@@ -144,7 +144,7 @@ static struct snd_pcm_hw_constraint_list constraints_16384 = {
+ };
+
+ static unsigned int rates_16934[] = {
+- 44100, 88235,
++ 44100, 88200,
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_16934 = {
+@@ -162,7 +162,7 @@ static struct snd_pcm_hw_constraint_list constraints_18432 = {
+ };
+
+ static unsigned int rates_22579[] = {
+- 44100, 88235, 1764000
++ 44100, 88200, 176400
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_22579 = {
+@@ -180,7 +180,7 @@ static struct snd_pcm_hw_constraint_list constraints_24576 = {
+ };
+
+ static unsigned int rates_36864[] = {
+- 48000, 96000, 19200
++ 48000, 96000, 192000
+ };
+
+ static struct snd_pcm_hw_constraint_list constraints_36864 = {
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index b2abe93..8d26104 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -336,7 +336,7 @@ static const struct snd_soc_dapm_route audio_paths[] = {
+ { "Right Input Mixer", "Boost Switch", "Right Boost Mixer", },
+ { "Right Input Mixer", NULL, "RINPUT1", }, /* Really Boost Switch */
+ { "Right Input Mixer", NULL, "RINPUT2" },
+- { "Right Input Mixer", NULL, "LINPUT3" },
++ { "Right Input Mixer", NULL, "RINPUT3" },
+
+ { "Left ADC", NULL, "Left Input Mixer" },
+ { "Right ADC", NULL, "Right Input Mixer" },
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index b73f226..9a56798 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2449,7 +2449,7 @@ static struct {
+ };
+
+ static int fs_ratios[] = {
+- 64, 128, 192, 256, 348, 512, 768, 1024, 1408, 1536
++ 64, 128, 192, 256, 384, 512, 768, 1024, 1408, 1536
+ };
+
+ static int bclk_divs[] = {
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 1d83a40..3dc1b8a 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2675,12 +2675,18 @@ int snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ kfree(w);
+ return -ENOMEM;
+ }
+- if (dapm->codec && dapm->codec->name_prefix)
++ if (dapm->codec && dapm->codec->name_prefix) {
+ snprintf(w->name, name_len, "%s %s",
+ dapm->codec->name_prefix, widget->name);
+- else
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s %s",
++ dapm->codec->name_prefix,
++ widget->sname);
++ } else {
+ snprintf(w->name, name_len, "%s", widget->name);
+-
++ if (widget->sname)
++ w->sname = kasprintf(GFP_KERNEL, "%s", widget->sname);
++ }
+ switch (w->id) {
+ case snd_soc_dapm_switch:
+ case snd_soc_dapm_mixer:
+diff --git a/sound/synth/emux/emux_oss.c b/sound/synth/emux/emux_oss.c
+index 319754c..daf61ab 100644
+--- a/sound/synth/emux/emux_oss.c
++++ b/sound/synth/emux/emux_oss.c
+@@ -118,12 +118,8 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (snd_BUG_ON(!arg || !emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+-
+- if (!snd_emux_inc_count(emu)) {
+- mutex_unlock(&emu->register_mutex);
++ if (!snd_emux_inc_count(emu))
+ return -EFAULT;
+- }
+
+ memset(&callback, 0, sizeof(callback));
+ callback.owner = THIS_MODULE;
+@@ -135,7 +131,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ if (p == NULL) {
+ snd_printk(KERN_ERR "can't create port\n");
+ snd_emux_dec_count(emu);
+- mutex_unlock(&emu->register_mutex);
+ return -ENOMEM;
+ }
+
+@@ -148,8 +143,6 @@ snd_emux_open_seq_oss(struct snd_seq_oss_arg *arg, void *closure)
+ reset_port_mode(p, arg->seq_mode);
+
+ snd_emux_reset_port(p);
+-
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+@@ -195,13 +188,11 @@ snd_emux_close_seq_oss(struct snd_seq_oss_arg *arg)
+ if (snd_BUG_ON(!emu))
+ return -ENXIO;
+
+- mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+ snd_soundfont_close_check(emu->sflist, SF_CLIENT_NO(p->chset.port));
+ snd_seq_event_port_detach(p->chset.client, p->chset.port);
+ snd_emux_dec_count(emu);
+
+- mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+
+diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
+index 7778b8e..a020920 100644
+--- a/sound/synth/emux/emux_seq.c
++++ b/sound/synth/emux/emux_seq.c
+@@ -124,12 +124,10 @@ snd_emux_detach_seq(struct snd_emux *emu)
+ if (emu->voices)
+ snd_emux_terminate_all(emu);
+
+- mutex_lock(&emu->register_mutex);
+ if (emu->client >= 0) {
+ snd_seq_delete_kernel_client(emu->client);
+ emu->client = -1;
+ }
+- mutex_unlock(&emu->register_mutex);
+ }
+
+
+@@ -269,8 +267,8 @@ snd_emux_event_input(struct snd_seq_event *ev, int direct, void *private_data,
+ /*
+ * increment usage count
+ */
+-int
+-snd_emux_inc_count(struct snd_emux *emu)
++static int
++__snd_emux_inc_count(struct snd_emux *emu)
+ {
+ emu->used++;
+ if (!try_module_get(emu->ops.owner))
+@@ -284,12 +282,21 @@ snd_emux_inc_count(struct snd_emux *emu)
+ return 1;
+ }
+
++int snd_emux_inc_count(struct snd_emux *emu)
++{
++ int ret;
++
++ mutex_lock(&emu->register_mutex);
++ ret = __snd_emux_inc_count(emu);
++ mutex_unlock(&emu->register_mutex);
++ return ret;
++}
+
+ /*
+ * decrease usage count
+ */
+-void
+-snd_emux_dec_count(struct snd_emux *emu)
++static void
++__snd_emux_dec_count(struct snd_emux *emu)
+ {
+ module_put(emu->card->module);
+ emu->used--;
+@@ -298,6 +305,12 @@ snd_emux_dec_count(struct snd_emux *emu)
+ module_put(emu->ops.owner);
+ }
+
++void snd_emux_dec_count(struct snd_emux *emu)
++{
++ mutex_lock(&emu->register_mutex);
++ __snd_emux_dec_count(emu);
++ mutex_unlock(&emu->register_mutex);
++}
+
+ /*
+ * Routine that is called upon a first use of a particular port
+@@ -317,7 +330,7 @@ snd_emux_use(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_init_port(p);
+- snd_emux_inc_count(emu);
++ __snd_emux_inc_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+@@ -340,7 +353,7 @@ snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *info)
+
+ mutex_lock(&emu->register_mutex);
+ snd_emux_sounds_off_all(p);
+- snd_emux_dec_count(emu);
++ __snd_emux_dec_count(emu);
+ mutex_unlock(&emu->register_mutex);
+ return 0;
+ }
+diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
+index 88160b7..488e531 100644
+--- a/sound/usb/mixer.c
++++ b/sound/usb/mixer.c
+@@ -838,6 +838,8 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
+ case USB_ID(0x046d, 0x081b): /* HD Webcam c310 */
+ case USB_ID(0x046d, 0x081d): /* HD Webcam c510 */
+ case USB_ID(0x046d, 0x0825): /* HD Webcam c270 */
++ case USB_ID(0x046d, 0x0826): /* HD Webcam c525 */
++ case USB_ID(0x046d, 0x08ca): /* Logitech Quickcam Fusion */
+ case USB_ID(0x046d, 0x0991):
+ /* Most audio usb devices lie about volume resolution.
+ * Most Logitech webcams have res = 384.
+@@ -1423,11 +1425,6 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ snd_printk(KERN_ERR "invalid MIXER UNIT descriptor %d\n", unitid);
+ return -EINVAL;
+ }
+- /* no bmControls field (e.g. Maya44) -> ignore */
+- if (desc->bLength <= 10 + input_pins) {
+- snd_printdd(KERN_INFO "MU %d has no bmControls field\n", unitid);
+- return 0;
+- }
+
+ num_ins = 0;
+ ich = 0;
+@@ -1435,6 +1432,9 @@ static int parse_audio_mixer_unit(struct mixer_build *state, int unitid, void *r
+ err = parse_audio_unit(state, desc->baSourceID[pin]);
+ if (err < 0)
+ return err;
++ /* no bmControls field (e.g. Maya44) -> ignore */
++ if (desc->bLength <= 10 + input_pins)
++ continue;
+ err = check_input_term(state, desc->baSourceID[pin], &iterm);
+ if (err < 0)
+ return err;
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index 1e0798f..851786f 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -380,6 +380,11 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .ignore_ctl_error = 1,
+ },
+ {
++ /* MAYA44 USB+ */
++ .id = USB_ID(0x2573, 0x0008),
++ .map = maya44_map,
++ },
++ {
+ /* KEF X300A */
+ .id = USB_ID(0x27ac, 0x1000),
+ .map = scms_usb3318_map,
diff --git a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
similarity index 99%
rename from 3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch
rename to 3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
index e361065..9aaf5cc 100644
--- a/3.2.69/4420_grsecurity-3.1-3.2.69-201508020900.patch
+++ b/3.2.70/4420_grsecurity-3.1-3.2.70-201508102127.patch
@@ -315,7 +315,7 @@ index 2a68089..b3300e1 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index 8071888..b024b7b 100644
+index 41a626b..31e889e 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -1693,14 +1693,14 @@ index af18cea..b5dc173 100644
#endif /* __ASSEMBLY__ */
diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h
-index 0e9ce8d..6ef1e03 100644
+index a4b1186..6ef1e03 100644
--- a/arch/arm/include/asm/elf.h
+++ b/arch/arm/include/asm/elf.h
@@ -116,7 +116,14 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs);
the loader. We need to make sure that it is out of the way of the program
that it will "exec", and that there is sufficient room for the brk. */
--#define ELF_ET_DYN_BASE (2 * TASK_SIZE / 3)
+-#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2)
+
+#ifdef CONFIG_PAX_ASLR
@@ -4188,21 +4188,19 @@ index 883fc6c..28c0acd 100644
void __init gt641xx_irq_init(void)
diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c
-index 7f50318..20685b9 100644
+index 6e489e5..79e10cb 100644
--- a/arch/mips/kernel/irq.c
+++ b/arch/mips/kernel/irq.c
-@@ -111,7 +111,10 @@ void __init init_IRQ(void)
- #endif
+@@ -112,6 +112,8 @@ void __init init_IRQ(void)
}
+ #ifdef CONFIG_DEBUG_STACKOVERFLOW
+
- #ifdef DEBUG_STACKOVERFLOW
+extern void gr_handle_kernel_exploit(void);
-+
static inline void check_stack_overflow(void)
{
unsigned long sp;
-@@ -127,6 +130,7 @@ static inline void check_stack_overflow(void)
+@@ -127,6 +129,7 @@ static inline void check_stack_overflow(void)
printk("do_IRQ: stack overflow: %ld\n",
sp - sizeof(struct thread_info));
dump_stack();
@@ -4472,10 +4470,10 @@ index 302d779..b8b4e97 100644
- return ret;
-}
diff --git a/arch/mips/pci/pci-octeon.c b/arch/mips/pci/pci-octeon.c
-index ed1c542..88552ac 100644
+index 66d3c38..fed57fa 100644
--- a/arch/mips/pci/pci-octeon.c
+++ b/arch/mips/pci/pci-octeon.c
-@@ -335,8 +335,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -329,8 +329,8 @@ static int octeon_write_config(struct pci_bus *bus, unsigned int devfn,
static struct pci_ops octeon_pci_ops = {
@@ -4487,10 +4485,10 @@ index ed1c542..88552ac 100644
static struct resource octeon_pci_mem_resource = {
diff --git a/arch/mips/pci/pcie-octeon.c b/arch/mips/pci/pcie-octeon.c
-index 0583c463..c07a38e 100644
+index 37a8790..dd636c1 100644
--- a/arch/mips/pci/pcie-octeon.c
+++ b/arch/mips/pci/pcie-octeon.c
-@@ -1238,8 +1238,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
+@@ -1235,8 +1235,8 @@ static int octeon_pcie1_write_config(struct pci_bus *bus, unsigned int devfn,
}
static struct pci_ops octeon_pcie0_ops = {
@@ -4501,7 +4499,7 @@ index 0583c463..c07a38e 100644
};
static struct resource octeon_pcie0_mem_resource = {
-@@ -1259,8 +1259,8 @@ static struct pci_controller octeon_pcie0_controller = {
+@@ -1256,8 +1256,8 @@ static struct pci_controller octeon_pcie0_controller = {
};
static struct pci_ops octeon_pcie1_ops = {
@@ -6337,13 +6335,13 @@ index 7450843..9f8cfc7 100644
return 0;
}
diff --git a/arch/powerpc/mm/mmap_64.c b/arch/powerpc/mm/mmap_64.c
-index 5a783d8..522eb00 100644
+index 67a42ed..333731a 100644
--- a/arch/powerpc/mm/mmap_64.c
+++ b/arch/powerpc/mm/mmap_64.c
-@@ -61,10 +61,14 @@ static inline int mmap_is_legacy(void)
- *
- * To avoid this we can shift the randomness by 1 bit.
- */
+@@ -53,10 +53,14 @@ static inline int mmap_is_legacy(void)
+ return sysctl_legacy_va_layout;
+ }
+
-static unsigned long mmap_rnd(void)
+static unsigned long mmap_rnd(struct mm_struct *mm)
{
@@ -6356,8 +6354,8 @@ index 5a783d8..522eb00 100644
if (current->flags & PF_RANDOMIZE) {
/* 8MB for 32bit, 1GB for 64bit */
if (is_32bit_task())
-@@ -75,7 +79,7 @@ static unsigned long mmap_rnd(void)
- return (rnd << PAGE_SHIFT) * 2;
+@@ -67,7 +71,7 @@ static unsigned long mmap_rnd(void)
+ return rnd << PAGE_SHIFT;
}
-static inline unsigned long mmap_base(void)
@@ -6365,7 +6363,7 @@ index 5a783d8..522eb00 100644
{
unsigned long gap = rlimit(RLIMIT_STACK);
-@@ -84,7 +88,7 @@ static inline unsigned long mmap_base(void)
+@@ -76,7 +80,7 @@ static inline unsigned long mmap_base(void)
else if (gap > MAX_GAP)
gap = MAX_GAP;
@@ -6374,7 +6372,7 @@ index 5a783d8..522eb00 100644
}
/*
-@@ -99,10 +103,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
+@@ -91,10 +95,22 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
*/
if (mmap_is_legacy()) {
mm->mmap_base = TASK_UNMAPPED_BASE;
@@ -8258,7 +8256,7 @@ index 42b282f..408977c 100644
addr = vmm->vm_end;
if (flags & MAP_SHARED)
diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index 5e4252b..379f84f 100644
+index 0ff682d..60e979d 100644
--- a/arch/sparc/kernel/sys_sparc_64.c
+++ b/arch/sparc/kernel/sys_sparc_64.c
@@ -119,12 +119,13 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi
@@ -10487,7 +10485,7 @@ index ad8f795..2c7eec6 100644
/*
* Memory returned by kmalloc() may be used for DMA, so we must make
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
-index 28a1bca..0443883 100644
+index d720208..5653761 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -75,6 +75,7 @@ config X86
@@ -10498,7 +10496,7 @@ index 28a1bca..0443883 100644
select ARCH_SUPPORTS_ATOMIC_RMW
config INSTRUCTION_DECODER
-@@ -236,7 +237,7 @@ config X86_HT
+@@ -237,7 +238,7 @@ config X86_HT
config X86_32_LAZY_GS
def_bool y
@@ -10507,7 +10505,7 @@ index 28a1bca..0443883 100644
config ARCH_HWEIGHT_CFLAGS
string
-@@ -526,6 +527,7 @@ config SCHED_OMIT_FRAME_POINTER
+@@ -527,6 +528,7 @@ config SCHED_OMIT_FRAME_POINTER
menuconfig PARAVIRT_GUEST
bool "Paravirtualized guest support"
@@ -10515,7 +10513,7 @@ index 28a1bca..0443883 100644
---help---
Say Y here to get to see options related to running Linux under
various hypervisors. This option alone does not add any kernel code.
-@@ -903,6 +905,7 @@ config VM86
+@@ -904,6 +906,7 @@ config VM86
config X86_16BIT
bool "Enable support for 16-bit segments" if EXPERT
@@ -10523,7 +10521,7 @@ index 28a1bca..0443883 100644
default y
---help---
This option is required by programs like Wine to run 16-bit
-@@ -1040,7 +1043,7 @@ choice
+@@ -1041,7 +1044,7 @@ choice
config NOHIGHMEM
bool "off"
@@ -10532,7 +10530,7 @@ index 28a1bca..0443883 100644
---help---
Linux can use up to 64 Gigabytes of physical memory on x86 systems.
However, the address space of 32-bit x86 processors is only 4
-@@ -1077,7 +1080,7 @@ config NOHIGHMEM
+@@ -1078,7 +1081,7 @@ config NOHIGHMEM
config HIGHMEM4G
bool "4GB"
@@ -10541,7 +10539,7 @@ index 28a1bca..0443883 100644
---help---
Select this if you have a 32-bit processor and between 1 and 4
gigabytes of physical RAM.
-@@ -1131,7 +1134,7 @@ config PAGE_OFFSET
+@@ -1132,7 +1135,7 @@ config PAGE_OFFSET
hex
default 0xB0000000 if VMSPLIT_3G_OPT
default 0x80000000 if VMSPLIT_2G
@@ -10550,7 +10548,7 @@ index 28a1bca..0443883 100644
default 0x40000000 if VMSPLIT_1G
default 0xC0000000
depends on X86_32
-@@ -1514,6 +1517,7 @@ config SECCOMP
+@@ -1515,6 +1518,7 @@ config SECCOMP
config CC_STACKPROTECTOR
bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
@@ -10558,7 +10556,7 @@ index 28a1bca..0443883 100644
---help---
This option turns on the -fstack-protector GCC feature. This
feature puts, at the beginning of functions, a canary value on
-@@ -1532,6 +1536,7 @@ source kernel/Kconfig.hz
+@@ -1533,6 +1537,7 @@ source kernel/Kconfig.hz
config KEXEC
bool "kexec system call"
@@ -10566,7 +10564,7 @@ index 28a1bca..0443883 100644
---help---
kexec is a system call that implements the ability to shutdown your
current kernel, and to start another kernel. It is like a reboot
-@@ -1634,6 +1639,8 @@ config X86_NEED_RELOCS
+@@ -1635,6 +1640,8 @@ config X86_NEED_RELOCS
config PHYSICAL_ALIGN
hex "Alignment value to which kernel should be aligned" if X86_32
default "0x1000000"
@@ -10575,7 +10573,7 @@ index 28a1bca..0443883 100644
range 0x2000 0x1000000
---help---
This value puts the alignment restrictions on physical address
-@@ -1665,9 +1672,10 @@ config HOTPLUG_CPU
+@@ -1666,9 +1673,10 @@ config HOTPLUG_CPU
Say N if you want to disable CPU hotplug.
config COMPAT_VDSO
@@ -10587,7 +10585,7 @@ index 28a1bca..0443883 100644
---help---
Map the 32-bit VDSO to the predictable old-style address too.
-@@ -1720,6 +1728,22 @@ config CMDLINE_OVERRIDE
+@@ -1721,6 +1729,22 @@ config CMDLINE_OVERRIDE
This is used to work around broken boot loaders. This should
be set to 'N' under normal conditions.
@@ -23597,7 +23595,7 @@ index 42eb330..139955c 100644
return ret;
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
-index 41b2f57..9dd7145 100644
+index 78842ce..2e4b56d 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -35,7 +35,7 @@ void (*pm_power_off)(void);
@@ -23700,7 +23698,7 @@ index 41b2f57..9dd7145 100644
{
int i;
int attempt = 0;
-@@ -717,13 +749,13 @@ void native_machine_shutdown(void)
+@@ -720,13 +752,13 @@ void native_machine_shutdown(void)
#endif
}
@@ -23716,7 +23714,7 @@ index 41b2f57..9dd7145 100644
{
printk("machine restart\n");
-@@ -732,7 +764,7 @@ static void native_machine_restart(char *__unused)
+@@ -735,7 +767,7 @@ static void native_machine_restart(char *__unused)
__machine_emergency_restart(0);
}
@@ -23725,7 +23723,7 @@ index 41b2f57..9dd7145 100644
{
/* stop other cpus and apics */
machine_shutdown();
-@@ -743,7 +775,7 @@ static void native_machine_halt(void)
+@@ -746,7 +778,7 @@ static void native_machine_halt(void)
stop_this_cpu(NULL);
}
@@ -23734,7 +23732,7 @@ index 41b2f57..9dd7145 100644
{
if (pm_power_off) {
if (!reboot_force)
-@@ -752,9 +784,10 @@ static void native_machine_power_off(void)
+@@ -755,9 +787,10 @@ static void native_machine_power_off(void)
}
/* a fallback in case there is no PM info available */
tboot_shutdown(TB_SHUTDOWN_HALT);
@@ -25424,7 +25422,7 @@ index 176205a..920cd58 100644
#define APIC_LVT_NUM 6
/* 14 is the version for Xeon and Pentium 8.4.8*/
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
-index bfc9507..bf85b38 100644
+index 4a949c7..a1e965f 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3558,7 +3558,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa,
@@ -25495,7 +25493,7 @@ index 7a2d9d6..0e8286c 100644
local_irq_disable();
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
-index 8831c43..98f1a3e 100644
+index 421958f..79e1420 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -1100,12 +1100,12 @@ static void vmcs_write64(unsigned long field, u64 value)
@@ -25550,7 +25548,7 @@ index 8831c43..98f1a3e 100644
if (enable_ept && !cpu_has_vmx_ept_2m_page())
kvm_disable_largepages();
-@@ -3638,7 +3649,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3646,7 +3657,10 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
unsigned long cr4;
vmcs_writel(HOST_CR0, read_cr0() | X86_CR0_TS); /* 22.2.3 */
@@ -25561,7 +25559,7 @@ index 8831c43..98f1a3e 100644
/* Save the most likely value for this task's CR4 in the VMCS. */
cr4 = read_cr4();
-@@ -3655,7 +3669,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
+@@ -3663,7 +3677,7 @@ static void vmx_set_constant_host_state(struct vcpu_vmx *vmx)
vmcs_writel(HOST_IDTR_BASE, dt.address); /* 22.2.4 */
asm("mov $.Lkvm_vmx_return, %0" : "=r"(tmpl));
@@ -25570,7 +25568,7 @@ index 8831c43..98f1a3e 100644
rdmsr(MSR_IA32_SYSENTER_CS, low32, high32);
vmcs_write32(HOST_IA32_SYSENTER_CS, low32);
-@@ -6206,6 +6220,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6214,6 +6228,12 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
"jmp .Lkvm_vmx_return \n\t"
".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
".Lkvm_vmx_return: "
@@ -25583,7 +25581,7 @@ index 8831c43..98f1a3e 100644
/* Save guest registers, load host registers, keep flags */
"mov %0, %c[wordsize](%%"R"sp) \n\t"
"pop %0 \n\t"
-@@ -6254,6 +6274,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6262,6 +6282,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
#endif
[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2)),
[wordsize]"i"(sizeof(ulong))
@@ -25595,7 +25593,7 @@ index 8831c43..98f1a3e 100644
: "cc", "memory"
, R"ax", R"bx", R"di", R"si"
#ifdef CONFIG_X86_64
-@@ -6282,7 +6307,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
+@@ -6290,7 +6315,16 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu)
}
}
@@ -28443,7 +28441,7 @@ index e218d5d..3966c85 100644
+EXPORT_SYMBOL(set_fs);
+#endif
diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index 554b7b5..4027e2c 100644
+index 433b21d..466fd0c 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -42,6 +42,12 @@ long
@@ -31046,7 +31044,7 @@ index 6687022..ceabcfa 100644
+ pax_force_retaddr
ret
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
-index 5a5b6e4..07b4acb 100644
+index 11e3100..db113e1 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -11,6 +11,7 @@
@@ -31241,7 +31239,7 @@ index 5a5b6e4..07b4acb 100644
addrs[i] = proglen;
}
cleanup_addr = proglen; /* epilogue address */
-@@ -221,6 +337,10 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -226,6 +342,10 @@ void bpf_jit_compile(struct sk_filter *fp)
for (i = 0; i < flen; i++) {
unsigned int K = filter[i].k;
@@ -31252,7 +31250,7 @@ index 5a5b6e4..07b4acb 100644
switch (filter[i].code) {
case BPF_S_ALU_ADD_X: /* A += X; */
seen |= SEEN_XREG;
-@@ -253,10 +373,8 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -258,10 +378,8 @@ void bpf_jit_compile(struct sk_filter *fp)
case BPF_S_ALU_MUL_K: /* A *= K */
if (is_imm8(K))
EMIT3(0x6b, 0xc0, K); /* imul imm8,%eax,%eax */
@@ -31265,7 +31263,7 @@ index 5a5b6e4..07b4acb 100644
break;
case BPF_S_ALU_DIV_X: /* A /= X; */
seen |= SEEN_XREG;
-@@ -269,15 +387,21 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -274,15 +392,21 @@ void bpf_jit_compile(struct sk_filter *fp)
EMIT_COND_JMP(X86_JE, addrs[pc_ret0 - 1] -
(addrs[i] - 4));
} else {
@@ -31288,7 +31286,7 @@ index 5a5b6e4..07b4acb 100644
EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
break;
case BPF_S_ALU_AND_X:
-@@ -477,7 +601,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+@@ -482,7 +606,7 @@ void bpf_jit_compile(struct sk_filter *fp)
common_load: seen |= SEEN_DATAREF;
if ((int)K < 0) {
/* Abort the JIT because __load_pointer() is needed. */
@@ -31297,7 +31295,7 @@ index 5a5b6e4..07b4acb 100644
}
t_offset = func - (image + addrs[i]);
EMIT1_off32(0xbe, K); /* mov imm32,%esi */
-@@ -492,7 +616,7 @@ common_load: seen |= SEEN_DATAREF;
+@@ -497,7 +621,7 @@ common_load: seen |= SEEN_DATAREF;
case BPF_S_LDX_B_MSH:
if ((int)K < 0) {
/* Abort the JIT because __load_pointer() is needed. */
@@ -31306,7 +31304,7 @@ index 5a5b6e4..07b4acb 100644
}
seen |= SEEN_DATAREF | SEEN_XREG;
t_offset = sk_load_byte_msh - (image + addrs[i]);
-@@ -572,7 +696,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -577,7 +701,7 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
}
if (filter[i].jt != 0) {
if (filter[i].jf && f_offset)
@@ -31315,7 +31313,7 @@ index 5a5b6e4..07b4acb 100644
EMIT_COND_JMP(t_op, t_offset);
if (filter[i].jf)
EMIT_JMP(f_offset);
-@@ -582,17 +706,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -587,17 +711,18 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
break;
default:
/* hmm, too complex filter, give up with jit compiler */
@@ -31338,7 +31336,7 @@ index 5a5b6e4..07b4acb 100644
}
proglen += ilen;
addrs[i] = proglen;
-@@ -613,11 +738,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -618,11 +743,9 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
break;
}
if (proglen == oldproglen) {
@@ -31352,7 +31350,7 @@ index 5a5b6e4..07b4acb 100644
}
oldproglen = proglen;
}
-@@ -633,7 +756,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
+@@ -638,7 +761,10 @@ cond_branch: f_offset = addrs[i + filter[i].jf] - addrs[i];
bpf_flush_icache(image, image + proglen);
fp->bpf_func = (void *)image;
@@ -31364,7 +31362,7 @@ index 5a5b6e4..07b4acb 100644
out:
kfree(addrs);
return;
-@@ -641,18 +767,20 @@ out:
+@@ -646,18 +772,20 @@ out:
static void jit_free_defer(struct work_struct *arg)
{
@@ -33729,10 +33727,10 @@ index cb842a8..6688e24 100644
* Broken _BQC workaround http://bugzilla.kernel.org/show_bug.cgi?id=13121
*/
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
-index de2802c..2260da9 100644
+index 41ffb8c..2afaff8 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
-@@ -1211,7 +1211,7 @@ int ahci_kick_engine(struct ata_port *ap)
+@@ -1212,7 +1212,7 @@ int ahci_kick_engine(struct ata_port *ap)
}
EXPORT_SYMBOL_GPL(ahci_kick_engine);
@@ -33742,7 +33740,7 @@ index de2802c..2260da9 100644
unsigned long timeout_msec)
{
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 5d8fc3d..d537f03 100644
+index fcd8586..19ba966 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4790,7 +4790,7 @@ void ata_qc_free(struct ata_queued_cmd *qc)
@@ -38367,10 +38365,10 @@ index b153674..ad2ba9b 100644
PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
},
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
-index da71881..8d7d62c 100644
+index f8f790c..b43f147 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
-@@ -367,7 +367,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
+@@ -368,7 +368,7 @@ static const struct pci_id_table pci_dev_descr_sbridge_table[] = {
/*
* pci_device_id table for which devices we are looking for
*/
@@ -38482,10 +38480,10 @@ index 94a58a0..f5eba42 100644
container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 2861ef4..9e90c69 100644
+index 20f7daa..91678be 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
-@@ -490,11 +490,6 @@ void __init dmi_scan_machine(void)
+@@ -488,11 +488,6 @@ void __init dmi_scan_machine(void)
}
}
else {
@@ -38497,7 +38495,7 @@ index 2861ef4..9e90c69 100644
p = dmi_ioremap(0xF0000, 0x10000);
if (p == NULL)
goto error;
-@@ -775,7 +770,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
+@@ -770,7 +765,7 @@ int dmi_walk(void (*decode)(const struct dmi_header *, void *),
if (buf == NULL)
return -1;
@@ -40584,10 +40582,10 @@ index 4ef02b2..8a96831 100644
for (i = 0; i < hid->maxcollection; i++)
diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c
-index 44a1ea4..21cce84 100644
+index a7e6f03..a2b6d86 100644
--- a/drivers/hv/channel.c
+++ b/drivers/hv/channel.c
-@@ -403,8 +403,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
+@@ -406,8 +406,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer,
unsigned long flags;
int ret = 0;
@@ -43051,7 +43049,7 @@ index 614ebeb..ce439fd 100644
.callback = ss4200_led_dmi_callback,
.ident = "Intel SS4200-E",
diff --git a/drivers/lguest/core.c b/drivers/lguest/core.c
-index b5fdcb7..3cb34b8 100644
+index 34842e5..3cb34b8 100644
--- a/drivers/lguest/core.c
+++ b/drivers/lguest/core.c
@@ -92,9 +92,17 @@ static __init int map_switcher(void)
@@ -43081,15 +43079,6 @@ index b5fdcb7..3cb34b8 100644
end_switcher_text - start_switcher_text);
printk(KERN_INFO "lguest: mapped switcher at %p\n",
-@@ -171,7 +179,7 @@ static void unmap_switcher(void)
- bool lguest_address_ok(const struct lguest *lg,
- unsigned long addr, unsigned long len)
- {
-- return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
-+ return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
- }
-
- /*
diff --git a/drivers/lguest/page_tables.c b/drivers/lguest/page_tables.c
index 3b62be16..e33134a 100644
--- a/drivers/lguest/page_tables.c
@@ -43750,7 +43739,7 @@ index abac83a..3652f35 100644
rdev_dec_pending(rdev, mddev);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index c293d9c..808ae97 100644
+index 6056ee7..a4c3ba4 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -598,23 +598,23 @@ async_copy_data(int frombio, struct bio *bio, struct page *page,
@@ -43806,7 +43795,7 @@ index c293d9c..808ae97 100644
sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]);
conf->active_name = 0;
-@@ -1618,19 +1626,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1619,19 +1627,19 @@ static void raid5_end_read_request(struct bio * bi, int error)
(unsigned long long)(sh->sector
+ rdev->data_offset),
bdevname(rdev->bdev, b));
@@ -43830,7 +43819,7 @@ index c293d9c..808ae97 100644
if (conf->mddev->degraded >= conf->max_degraded)
printk_ratelimited(
KERN_WARNING
-@@ -1650,7 +1658,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
+@@ -1651,7 +1659,7 @@ static void raid5_end_read_request(struct bio * bi, int error)
(unsigned long long)(sh->sector
+ rdev->data_offset),
bdn);
@@ -46997,6 +46986,22 @@ index 3d21742..b8e03e7 100644
// waiting for all pending urbs to complete?
if (dev->wait) {
if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index f13a673..218ebf0 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -981,9 +981,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 28ceef2..655b059 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -48357,7 +48362,7 @@ index 26fba2d..693b4d3 100644
1, asus->debug.method_id,
&input, &output);
diff --git a/drivers/platform/x86/compal-laptop.c b/drivers/platform/x86/compal-laptop.c
-index 8877b83..024cf2c 100644
+index ba3638e..70e74af 100644
--- a/drivers/platform/x86/compal-laptop.c
+++ b/drivers/platform/x86/compal-laptop.c
@@ -775,7 +775,7 @@ static int dmi_check_cb_extra(const struct dmi_system_id *id)
@@ -50086,7 +50091,7 @@ index 21a045e..ec89e03 100644
transport_setup_device(&rport->dev);
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index 5c6b5f5..015ec9d 100644
+index a50825b..7995f6ea 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -105,7 +105,7 @@ static void sd_shutdown(struct device *);
@@ -50098,7 +50103,7 @@ index 5c6b5f5..015ec9d 100644
static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer);
static void scsi_disk_release(struct device *cdev);
static void sd_print_sense_hdr(struct scsi_disk *, struct scsi_sense_hdr *);
-@@ -1390,7 +1390,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+@@ -1384,7 +1384,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
*
* Note: potentially run from within an ISR. Must not block.
**/
@@ -50107,7 +50112,7 @@ index 5c6b5f5..015ec9d 100644
{
int result = SCpnt->result;
unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
-@@ -2635,7 +2635,7 @@ static int sd_probe(struct device *dev)
+@@ -2626,7 +2626,7 @@ static int sd_probe(struct device *dev)
device_initialize(&sdkp->dev);
sdkp->dev.parent = dev;
sdkp->dev.class = &sd_disk_class;
@@ -50117,7 +50122,7 @@ index 5c6b5f5..015ec9d 100644
if (device_add(&sdkp->dev))
goto out_free_index;
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
-index 2d25616..c464bcf 100644
+index b4cac39..c464bcf 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -1077,7 +1077,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg)
@@ -50129,17 +50134,7 @@ index 2d25616..c464bcf 100644
case BLKTRACESTART:
return blk_trace_startstop(sdp->device->request_queue, 1);
case BLKTRACESTOP:
-@@ -1687,6 +1687,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd)
- md->from_user = 0;
- }
-
-+ if (unlikely(iov_count > UIO_MAXIOV))
-+ return -EINVAL;
-+
- if (iov_count) {
- int len, size = sizeof(struct sg_iovec) * iov_count;
- struct iovec *iov;
-@@ -2312,7 +2315,7 @@ struct sg_proc_leaf {
+@@ -2315,7 +2315,7 @@ struct sg_proc_leaf {
const struct file_operations * fops;
};
@@ -50148,7 +50143,7 @@ index 2d25616..c464bcf 100644
{"allow_dio", &adio_fops},
{"debug", &debug_fops},
{"def_reserved_size", &dressz_fops},
-@@ -2327,7 +2330,7 @@ sg_proc_init(void)
+@@ -2330,7 +2330,7 @@ sg_proc_init(void)
{
int k, mask;
int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
@@ -56912,10 +56907,10 @@ index 4a88ac3..d2e1657 100644
EXPORT_SYMBOL_GPL(virtqueue_kick);
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
-index f6227cc..3e22fab 100644
+index bcf7711..98a489c 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
-@@ -1632,7 +1632,7 @@ void xen_irq_resume(void)
+@@ -1636,7 +1636,7 @@ void xen_irq_resume(void)
restore_pirqs();
}
@@ -56924,7 +56919,7 @@ index f6227cc..3e22fab 100644
.name = "xen-dyn",
.irq_disable = disable_dynirq,
-@@ -1646,7 +1646,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
+@@ -1650,7 +1650,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
.irq_retrigger = retrigger_dynirq,
};
@@ -56933,7 +56928,7 @@ index f6227cc..3e22fab 100644
.name = "xen-pirq",
.irq_startup = startup_pirq,
-@@ -1666,7 +1666,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
+@@ -1670,7 +1670,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
.irq_retrigger = retrigger_dynirq,
};
@@ -57368,7 +57363,7 @@ index a6395bd..f1e376a 100644
(unsigned long) create_aout_tables((char __user *) bprm->p, bprm);
#ifdef __alpha__
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
-index 2aed667..52b96fd 100644
+index d252462..ebd7fd4 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -32,6 +32,7 @@
@@ -58005,10 +58000,12 @@ index 2aed667..52b96fd 100644
if (elf_read_implies_exec(loc->elf_ex, executable_stack))
current->personality |= READ_IMPLIES_EXEC;
-@@ -809,6 +1246,20 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -810,8 +1247,21 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
#else
load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
#endif
+- total_size = total_mapping_size(elf_phdata,
+- loc->elf_ex.e_phnum);
+
+#ifdef CONFIG_PAX_RANDMMAP
+ /* PaX: randomize base address at the default exe base if requested */
@@ -58023,10 +58020,11 @@ index 2aed667..52b96fd 100644
+ }
+#endif
+
- }
-
- error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -841,9 +1292,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
++ total_size = total_mapping_size(elf_phdata, loc->elf_ex.e_phnum);
+ if (!total_size) {
+ retval = -EINVAL;
+ goto out_free_dentry;
+@@ -848,9 +1298,9 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
* allowed task size. Note that p_filesz must always be
* <= p_memsz so it is only necessary to check p_memsz.
*/
@@ -58039,7 +58037,7 @@ index 2aed667..52b96fd 100644
/* set_brk can never work. Avoid overflows. */
send_sig(SIGKILL, current, 0);
retval = -EINVAL;
-@@ -882,17 +1333,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+@@ -889,17 +1339,44 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
goto out_free_dentry;
}
if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -58090,7 +58088,7 @@ index 2aed667..52b96fd 100644
load_bias);
if (!IS_ERR((void *)elf_entry)) {
/*
-@@ -1099,7 +1577,7 @@ out:
+@@ -1106,7 +1583,7 @@ out:
* Decide what to dump of a segment, part, all or none.
*/
static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -58099,7 +58097,7 @@ index 2aed667..52b96fd 100644
{
#define FILTER(type) (mm_flags & (1UL << MMF_DUMP_##type))
-@@ -1133,7 +1611,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
+@@ -1140,7 +1617,7 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
if (vma->vm_file == NULL)
return 0;
@@ -58108,7 +58106,7 @@ index 2aed667..52b96fd 100644
goto whole;
/*
-@@ -1355,9 +1833,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
+@@ -1362,9 +1839,9 @@ static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm)
{
elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
int i = 0;
@@ -58120,7 +58118,7 @@ index 2aed667..52b96fd 100644
fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
}
-@@ -1852,14 +2330,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
+@@ -1859,14 +2336,14 @@ static void fill_extnum_info(struct elfhdr *elf, struct elf_shdr *shdr4extnum,
}
static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -58137,7 +58135,7 @@ index 2aed667..52b96fd 100644
return size;
}
-@@ -1953,7 +2431,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1960,7 +2437,7 @@ static int elf_core_dump(struct coredump_params *cprm)
dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
@@ -58146,7 +58144,7 @@ index 2aed667..52b96fd 100644
offset += elf_core_extra_data_size();
e_shoff = offset;
-@@ -1967,10 +2445,12 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1974,10 +2451,12 @@ static int elf_core_dump(struct coredump_params *cprm)
offset = dataoff;
size += sizeof(*elf);
@@ -58159,7 +58157,7 @@ index 2aed667..52b96fd 100644
if (size > cprm->limit
|| !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
goto end_coredump;
-@@ -1984,7 +2464,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -1991,7 +2470,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_offset = offset;
phdr.p_vaddr = vma->vm_start;
phdr.p_paddr = 0;
@@ -58168,7 +58166,7 @@ index 2aed667..52b96fd 100644
phdr.p_memsz = vma->vm_end - vma->vm_start;
offset += phdr.p_filesz;
phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -1995,6 +2475,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2002,6 +2481,7 @@ static int elf_core_dump(struct coredump_params *cprm)
phdr.p_align = ELF_EXEC_PAGESIZE;
size += sizeof(phdr);
@@ -58176,7 +58174,7 @@ index 2aed667..52b96fd 100644
if (size > cprm->limit
|| !dump_write(cprm->file, &phdr, sizeof(phdr)))
goto end_coredump;
-@@ -2019,7 +2500,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2026,7 +2506,7 @@ static int elf_core_dump(struct coredump_params *cprm)
unsigned long addr;
unsigned long end;
@@ -58185,7 +58183,7 @@ index 2aed667..52b96fd 100644
for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
struct page *page;
-@@ -2028,6 +2509,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2035,6 +2515,7 @@ static int elf_core_dump(struct coredump_params *cprm)
page = get_dump_page(addr);
if (page) {
void *kaddr = kmap(page);
@@ -58193,7 +58191,7 @@ index 2aed667..52b96fd 100644
stop = ((size += PAGE_SIZE) > cprm->limit) ||
!dump_write(cprm->file, kaddr,
PAGE_SIZE);
-@@ -2045,6 +2527,7 @@ static int elf_core_dump(struct coredump_params *cprm)
+@@ -2052,6 +2533,7 @@ static int elf_core_dump(struct coredump_params *cprm)
if (e_phnum == PN_XNUM) {
size += sizeof(*shdr4extnum);
@@ -58201,7 +58199,7 @@ index 2aed667..52b96fd 100644
if (size > cprm->limit
|| !dump_write(cprm->file, shdr4extnum,
sizeof(*shdr4extnum)))
-@@ -2065,6 +2548,167 @@ out:
+@@ -2072,6 +2554,167 @@ out:
#endif /* CONFIG_ELF_CORE */
@@ -58482,7 +58480,7 @@ index dede441..f2a2507 100644
WARN_ON(trans->transid != btrfs_header_generation(parent));
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index a694317..dc698a1 100644
+index da528f8..97002a3 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -5644,7 +5644,7 @@ again:
@@ -58495,10 +58493,10 @@ index a694317..dc698a1 100644
do_chunk_alloc(trans, root->fs_info->extent_root,
num_bytes, data, CHUNK_ALLOC_FORCE);
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 7cbe2f8..20cc43f 100644
+index 52bacff..a4b7f29 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
-@@ -2770,7 +2770,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
+@@ -2775,7 +2775,7 @@ long btrfs_ioctl_space_info(struct btrfs_root *root, void __user *arg)
up_read(&info->groups_sem);
}
@@ -59438,7 +59436,7 @@ index 739fb59..5385976 100644
static int __init init_cramfs_fs(void)
{
diff --git a/fs/dcache.c b/fs/dcache.c
-index 8bc98af..68601d9 100644
+index 8a35300..aee4955 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -103,11 +103,11 @@ static unsigned int d_hash_shift __read_mostly;
@@ -59481,24 +59479,6 @@ index 8bc98af..68601d9 100644
/*
* If this dentry needs lookup, don't set the referenced flag so that it
* is more likely to be cleaned up by the dcache shrinker in case of
-@@ -1016,13 +1019,13 @@ ascend:
- /* might go back up the wrong parent if we have had a rename */
- if (!locked && read_seqretry(&rename_lock, seq))
- goto rename_retry;
-- next = child->d_child.next;
-- while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED)) {
-+ /* go into the first sibling still alive */
-+ do {
-+ next = child->d_child.next;
- if (next == &this_parent->d_subdirs)
- goto ascend;
- child = list_entry(next, struct dentry, d_child);
-- next = next->next;
-- }
-+ } while (unlikely(child->d_flags & DCACHE_DENTRY_KILLED));
- rcu_read_unlock();
- goto resume;
- }
@@ -1235,6 +1238,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
dentry->d_sb = sb;
dentry->d_op = NULL;
@@ -59520,10 +59500,10 @@ index 8bc98af..68601d9 100644
dcache_init();
inode_init();
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
-index a15f1e2..3077628 100644
+index 74f03b5..c4a9396 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
-@@ -164,6 +164,7 @@ static struct file_system_type debug_fs_type = {
+@@ -165,6 +165,7 @@ static struct file_system_type debug_fs_type = {
.mount = debug_mount,
.kill_sb = kill_litter_super,
};
@@ -59531,7 +59511,7 @@ index a15f1e2..3077628 100644
static int debugfs_create_by_name(const char *name, mode_t mode,
struct dentry *parent,
-@@ -277,11 +278,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
+@@ -278,11 +279,20 @@ EXPORT_SYMBOL_GPL(debugfs_create_file);
* If debugfs is not enabled in the kernel, the value -%ENODEV will be
* returned.
*/
@@ -61286,7 +61266,7 @@ index 22764c7..86372c9 100644
break;
err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
diff --git a/fs/fhandle.c b/fs/fhandle.c
-index 6b08864..030db71 100644
+index c9e18f3..030db71 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -8,6 +8,7 @@
@@ -61306,18 +61286,6 @@ index 6b08864..030db71 100644
retval = -EPERM;
goto out_err;
}
-@@ -196,8 +197,9 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
- goto out_err;
- }
- /* copy the full handle */
-- if (copy_from_user(handle, ufh,
-- sizeof(struct file_handle) +
-+ *handle = f_handle;
-+ if (copy_from_user(&handle->f_handle,
-+ &ufh->f_handle,
- f_handle.handle_bytes)) {
- retval = -EFAULT;
- goto out_handle;
diff --git a/fs/fifo.c b/fs/fifo.c
index cf6f434..3d7942c 100644
--- a/fs/fifo.c
@@ -64749,10 +64717,10 @@ index 5d22872..523db20 100644
kfree(link);
}
diff --git a/fs/omfs/inode.c b/fs/omfs/inode.c
-index e043c4c..f99d456 100644
+index f58f1c4..7aed9d4 100644
--- a/fs/omfs/inode.c
+++ b/fs/omfs/inode.c
-@@ -570,6 +570,7 @@ static struct file_system_type omfs_fs_type = {
+@@ -571,6 +571,7 @@ static struct file_system_type omfs_fs_type = {
.kill_sb = kill_block_super,
.fs_flags = FS_REQUIRES_DEV,
};
@@ -64917,7 +64885,7 @@ index bd8ae78..539d250 100644
ldm_crit ("Out of memory.");
return false;
diff --git a/fs/pipe.c b/fs/pipe.c
-index 8ca88fc..db6ce82 100644
+index d2cbeff..db6ce82 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -33,7 +33,7 @@ unsigned int pipe_max_size = 1048576;
@@ -64929,109 +64897,7 @@ index 8ca88fc..db6ce82 100644
/*
* We use a start+len construction, which provides full use of the
-@@ -103,25 +103,27 @@ void pipe_wait(struct pipe_inode_info *pipe)
- }
-
- static int
--pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
-- int atomic)
-+pipe_iov_copy_from_user(void *addr, int *offset, struct iovec *iov,
-+ size_t *remaining, int atomic)
- {
- unsigned long copy;
-
-- while (len > 0) {
-+ while (*remaining > 0) {
- while (!iov->iov_len)
- iov++;
-- copy = min_t(unsigned long, len, iov->iov_len);
-+ copy = min_t(unsigned long, *remaining, iov->iov_len);
-
- if (atomic) {
-- if (__copy_from_user_inatomic(to, iov->iov_base, copy))
-+ if (__copy_from_user_inatomic(addr + *offset,
-+ iov->iov_base, copy))
- return -EFAULT;
- } else {
-- if (copy_from_user(to, iov->iov_base, copy))
-+ if (copy_from_user(addr + *offset,
-+ iov->iov_base, copy))
- return -EFAULT;
- }
-- to += copy;
-- len -= copy;
-+ *offset += copy;
-+ *remaining -= copy;
- iov->iov_base += copy;
- iov->iov_len -= copy;
- }
-@@ -129,25 +131,27 @@ pipe_iov_copy_from_user(void *to, struct iovec *iov, unsigned long len,
- }
-
- static int
--pipe_iov_copy_to_user(struct iovec *iov, const void *from, unsigned long len,
-- int atomic)
-+pipe_iov_copy_to_user(struct iovec *iov, void *addr, int *offset,
-+ size_t *remaining, int atomic)
- {
- unsigned long copy;
-
-- while (len > 0) {
-+ while (*remaining > 0) {
- while (!iov->iov_len)
- iov++;
-- copy = min_t(unsigned long, len, iov->iov_len);
-+ copy = min_t(unsigned long, *remaining, iov->iov_len);
-
- if (atomic) {
-- if (__copy_to_user_inatomic(iov->iov_base, from, copy))
-+ if (__copy_to_user_inatomic(iov->iov_base,
-+ addr + *offset, copy))
- return -EFAULT;
- } else {
-- if (copy_to_user(iov->iov_base, from, copy))
-+ if (copy_to_user(iov->iov_base,
-+ addr + *offset, copy))
- return -EFAULT;
- }
-- from += copy;
-- len -= copy;
-+ *offset += copy;
-+ *remaining -= copy;
- iov->iov_base += copy;
- iov->iov_len -= copy;
- }
-@@ -383,7 +387,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- struct pipe_buffer *buf = pipe->bufs + curbuf;
- const struct pipe_buf_operations *ops = buf->ops;
- void *addr;
-- size_t chars = buf->len;
-+ size_t chars = buf->len, remaining;
- int error, atomic;
-
- if (chars > total_len)
-@@ -397,9 +401,11 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
- }
-
- atomic = !iov_fault_in_pages_write(iov, chars);
-+ remaining = chars;
- redo:
- addr = ops->map(pipe, buf, atomic);
-- error = pipe_iov_copy_to_user(iov, addr + buf->offset, chars, atomic);
-+ error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
-+ &remaining, atomic);
- ops->unmap(pipe, buf, addr);
- if (unlikely(error)) {
- /*
-@@ -414,7 +420,6 @@ redo:
- break;
- }
- ret += chars;
-- buf->offset += chars;
- buf->len -= chars;
-
- /* Was it a packet buffer? Clean up and exit */
-@@ -437,9 +442,9 @@ redo:
+@@ -442,9 +442,9 @@ redo:
}
if (bufs) /* More to do? */
continue;
@@ -65043,7 +64909,7 @@ index 8ca88fc..db6ce82 100644
/* syscall merging: Usually we must not sleep
* if O_NONBLOCK is set, or if we got some data.
* But if a writer sleeps in kernel space, then
-@@ -503,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
+@@ -508,7 +508,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
mutex_lock(&inode->i_mutex);
pipe = inode->i_pipe;
@@ -65052,26 +64918,7 @@ index 8ca88fc..db6ce82 100644
send_sig(SIGPIPE, current, 0);
ret = -EPIPE;
goto out;
-@@ -521,6 +526,7 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- if (ops->can_merge && offset + chars <= PAGE_SIZE) {
- int error, atomic = 1;
- void *addr;
-+ size_t remaining = chars;
-
- error = ops->confirm(pipe, buf);
- if (error)
-@@ -529,8 +535,8 @@ pipe_write(struct kiocb *iocb, const struct iovec *_iov,
- iov_fault_in_pages_read(iov, chars);
- redo1:
- addr = ops->map(pipe, buf, atomic);
-- error = pipe_iov_copy_from_user(offset + addr, iov,
-- chars, atomic);
-+ error = pipe_iov_copy_from_user(addr, &offset, iov,
-+ &remaining, atomic);
- ops->unmap(pipe, buf, addr);
- ret = error;
- do_wakeup = 1;
-@@ -552,7 +558,7 @@ redo1:
+@@ -558,7 +558,7 @@ redo1:
for (;;) {
int bufs;
@@ -65080,34 +64927,7 @@ index 8ca88fc..db6ce82 100644
send_sig(SIGPIPE, current, 0);
if (!ret)
ret = -EPIPE;
-@@ -565,6 +571,8 @@ redo1:
- struct page *page = pipe->tmp_page;
- char *src;
- int error, atomic = 1;
-+ int offset = 0;
-+ size_t remaining;
-
- if (!page) {
- page = alloc_page(GFP_HIGHUSER);
-@@ -585,14 +593,15 @@ redo1:
- chars = total_len;
-
- iov_fault_in_pages_read(iov, chars);
-+ remaining = chars;
- redo2:
- if (atomic)
- src = kmap_atomic(page, KM_USER0);
- else
- src = kmap(page);
-
-- error = pipe_iov_copy_from_user(src, iov, chars,
-- atomic);
-+ error = pipe_iov_copy_from_user(src, &offset, iov,
-+ &remaining, atomic);
- if (atomic)
- kunmap_atomic(src, KM_USER0);
- else
-@@ -643,9 +652,9 @@ redo2:
+@@ -652,9 +652,9 @@ redo2:
kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
do_wakeup = 0;
}
@@ -65119,7 +64939,7 @@ index 8ca88fc..db6ce82 100644
}
out:
mutex_unlock(&inode->i_mutex);
-@@ -712,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -721,7 +721,7 @@ pipe_poll(struct file *filp, poll_table *wait)
mask = 0;
if (filp->f_mode & FMODE_READ) {
mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
@@ -65128,7 +64948,7 @@ index 8ca88fc..db6ce82 100644
mask |= POLLHUP;
}
-@@ -722,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
+@@ -731,7 +731,7 @@ pipe_poll(struct file *filp, poll_table *wait)
* Most Unices do not set POLLERR for FIFOs but on Linux they
* behave exactly like pipes for poll().
*/
@@ -65137,7 +64957,7 @@ index 8ca88fc..db6ce82 100644
mask |= POLLERR;
}
-@@ -736,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
+@@ -745,10 +745,10 @@ pipe_release(struct inode *inode, int decr, int decw)
mutex_lock(&inode->i_mutex);
pipe = inode->i_pipe;
@@ -65151,7 +64971,7 @@ index 8ca88fc..db6ce82 100644
free_pipe_info(inode);
} else {
wake_up_interruptible_sync_poll(&pipe->wait, POLLIN | POLLOUT | POLLRDNORM | POLLWRNORM | POLLERR | POLLHUP);
-@@ -829,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
+@@ -838,7 +838,7 @@ pipe_read_open(struct inode *inode, struct file *filp)
if (inode->i_pipe) {
ret = 0;
@@ -65160,7 +64980,7 @@ index 8ca88fc..db6ce82 100644
}
mutex_unlock(&inode->i_mutex);
-@@ -846,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
+@@ -855,7 +855,7 @@ pipe_write_open(struct inode *inode, struct file *filp)
if (inode->i_pipe) {
ret = 0;
@@ -65169,7 +64989,7 @@ index 8ca88fc..db6ce82 100644
}
mutex_unlock(&inode->i_mutex);
-@@ -867,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
+@@ -876,9 +876,9 @@ pipe_rdwr_open(struct inode *inode, struct file *filp)
if (inode->i_pipe) {
ret = 0;
if (filp->f_mode & FMODE_READ)
@@ -65181,7 +65001,7 @@ index 8ca88fc..db6ce82 100644
}
mutex_unlock(&inode->i_mutex);
-@@ -961,7 +970,7 @@ void free_pipe_info(struct inode *inode)
+@@ -970,7 +970,7 @@ void free_pipe_info(struct inode *inode)
inode->i_pipe = NULL;
}
@@ -65190,7 +65010,7 @@ index 8ca88fc..db6ce82 100644
/*
* pipefs_dname() is called from d_path().
-@@ -991,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
+@@ -1000,7 +1000,8 @@ static struct inode * get_pipe_inode(void)
goto fail_iput;
inode->i_pipe = pipe;
@@ -65200,7 +65020,7 @@ index 8ca88fc..db6ce82 100644
inode->i_fop = &rdwr_pipefifo_fops;
/*
-@@ -1203,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
+@@ -1212,7 +1213,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
* Currently we rely on the pipe array holding a power-of-2 number
* of pages.
*/
@@ -65209,7 +65029,7 @@ index 8ca88fc..db6ce82 100644
{
unsigned long nr_pages;
-@@ -1253,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
+@@ -1262,13 +1263,16 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
switch (cmd) {
case F_SETPIPE_SZ: {
@@ -84014,10 +83834,10 @@ index f93d8c1..71244f6 100644
int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 42ac6ad..703f223 100644
+index 3d4b5b6..3648fe8 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
-@@ -915,7 +915,7 @@ struct ata_port_operations {
+@@ -924,7 +924,7 @@ struct ata_port_operations {
* fields must be pointers.
*/
const struct ata_port_operations *inherits;
@@ -85621,7 +85441,7 @@ index 9aaf5bf..d5ee2a5 100644
}
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index cb34ff4..c086c98 100644
+index 44e5f47..bf5c1f5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -101,6 +101,7 @@ struct bio_list;
@@ -87830,7 +87650,7 @@ index 6e4569f..0c8aa25 100644
fib_info_update_nh_saddr((net), &FIB_RES_NH(res)))
#define FIB_RES_GW(res) (FIB_RES_NH(res).nh_gw)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
-index 416dcb0..e203877 100644
+index b8b2e50..91489a1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -509,7 +509,7 @@ struct ip_vs_conn {
@@ -88203,10 +88023,10 @@ index 4d1be75..a54d29e 100644
/* Get the size of a DATA chunk payload. */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
-index a15432da..9459dcc 100644
+index 2cccd82..03b6412 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
-@@ -644,7 +644,7 @@ struct sctp_pf {
+@@ -649,7 +649,7 @@ struct sctp_pf {
struct sctp_association *asoc);
void (*addr_v4map) (struct sctp_sock *, union sctp_addr *);
struct sctp_af *af;
@@ -96335,7 +96155,7 @@ index 76b8e77..a2930e8 100644
}
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
-index f79803a..0dcc1be 100644
+index f07c144..d2ad3b0 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -211,7 +211,8 @@ int ptrace_check_attach(struct task_struct *child, bool ignore_state)
@@ -96428,7 +96248,7 @@ index f79803a..0dcc1be 100644
return (data & ~PTRACE_O_MASK) ? -EINVAL : 0;
}
-@@ -720,7 +740,7 @@ int ptrace_request(struct task_struct *child, long request,
+@@ -740,7 +760,7 @@ int ptrace_request(struct task_struct *child, long request,
bool seized = child->ptrace & PT_SEIZED;
int ret = -EIO;
siginfo_t siginfo, *si;
@@ -96437,7 +96257,7 @@ index f79803a..0dcc1be 100644
unsigned long __user *datalp = datavp;
unsigned long flags;
-@@ -922,14 +942,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
+@@ -942,14 +962,21 @@ SYSCALL_DEFINE4(ptrace, long, request, long, pid, unsigned long, addr,
goto out;
}
@@ -96460,7 +96280,7 @@ index f79803a..0dcc1be 100644
goto out_put_task_struct;
}
-@@ -957,7 +984,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
+@@ -977,7 +1004,7 @@ int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
if (copied != sizeof(tmp))
return -EIO;
@@ -96469,7 +96289,7 @@ index f79803a..0dcc1be 100644
}
int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
-@@ -1051,7 +1078,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
+@@ -1071,7 +1098,7 @@ int compat_ptrace_request(struct task_struct *child, compat_long_t request,
}
asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
@@ -96478,7 +96298,7 @@ index f79803a..0dcc1be 100644
{
struct task_struct *child;
long ret;
-@@ -1067,14 +1094,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
+@@ -1087,14 +1114,21 @@ asmlinkage long compat_sys_ptrace(compat_long_t request, compat_long_t pid,
goto out;
}
@@ -97949,7 +97769,7 @@ index 9e800b2..1533ba5 100644
raw_spin_unlock_irq(&call_function.lock);
}
diff --git a/kernel/softirq.c b/kernel/softirq.c
-index 2c71d91..6b690a4 100644
+index 44bc103..c131116 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -52,11 +52,11 @@ irq_cpustat_t irq_stat[NR_CPUS] ____cacheline_aligned;
@@ -97966,7 +97786,7 @@ index 2c71d91..6b690a4 100644
"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
"TASKLET", "SCHED", "HRTIMER", "RCU"
};
-@@ -235,7 +235,7 @@ restart:
+@@ -241,7 +241,7 @@ restart:
kstat_incr_softirqs_this_cpu(vec_nr);
trace_softirq_entry(vec_nr);
@@ -97975,7 +97795,7 @@ index 2c71d91..6b690a4 100644
trace_softirq_exit(vec_nr);
if (unlikely(prev_count != preempt_count())) {
printk(KERN_ERR "huh, entered softirq %u %s %p"
-@@ -385,7 +385,7 @@ void raise_softirq(unsigned int nr)
+@@ -393,7 +393,7 @@ void raise_softirq(unsigned int nr)
local_irq_restore(flags);
}
@@ -97984,7 +97804,7 @@ index 2c71d91..6b690a4 100644
{
softirq_vec[nr].action = action;
}
-@@ -441,7 +441,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
+@@ -449,7 +449,7 @@ void __tasklet_hi_schedule_first(struct tasklet_struct *t)
EXPORT_SYMBOL(__tasklet_hi_schedule_first);
@@ -97993,7 +97813,7 @@ index 2c71d91..6b690a4 100644
{
struct tasklet_struct *list;
-@@ -476,7 +476,7 @@ static void tasklet_action(struct softirq_action *a)
+@@ -484,7 +484,7 @@ static void tasklet_action(struct softirq_action *a)
}
}
@@ -98002,7 +97822,7 @@ index 2c71d91..6b690a4 100644
{
struct tasklet_struct *list;
-@@ -712,7 +712,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
+@@ -720,7 +720,7 @@ static int __cpuinit remote_softirq_cpu_notify(struct notifier_block *self,
return NOTIFY_OK;
}
@@ -98011,7 +97831,7 @@ index 2c71d91..6b690a4 100644
.notifier_call = remote_softirq_cpu_notify,
};
-@@ -894,7 +894,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
+@@ -902,7 +902,7 @@ static int __cpuinit cpu_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
@@ -99610,7 +99430,7 @@ index 875fed4..7a76cbb 100644
}
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index b0996c1..9c39703 100644
+index 47343cc..9c39703 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1027,6 +1027,9 @@ static void parse_init(struct filter_parse_state *ps,
@@ -99633,36 +99453,15 @@ index b0996c1..9c39703 100644
ps->infix.cnt--;
ps->infix.tail++;
}
-@@ -1343,19 +1349,27 @@ static int check_preds(struct filter_parse_state *ps)
- {
- int n_normal_preds = 0, n_logical_preds = 0;
- struct postfix_elt *elt;
-+ int cnt = 0;
-
- list_for_each_entry(elt, &ps->postfix, list) {
-- if (elt->op == OP_NONE)
-+ if (elt->op == OP_NONE) {
-+ cnt++;
- continue;
-+ }
-
- if (elt->op == OP_AND || elt->op == OP_OR) {
- n_logical_preds++;
-+ cnt--;
+@@ -1356,6 +1362,8 @@ static int check_preds(struct filter_parse_state *ps)
+ cnt--;
continue;
}
+ // OP_NOT is not supported in this kernel, will get
+ // a reject here when it's backported
-+ cnt--;
+ cnt--;
n_normal_preds++;
-+ WARN_ON_ONCE(cnt < 0);
- }
-
-- if (!n_normal_preds || n_logical_preds >= n_normal_preds) {
-+ if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
- parse_error(ps, FILT_ERR_INVALID_FILTER, 0);
- return -EINVAL;
- }
+ WARN_ON_ONCE(cnt < 0);
diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index a7d2a4c..b034c76 100644
--- a/kernel/trace/trace_functions_graph.c
@@ -104650,7 +104449,7 @@ index d0cb11f..e0a7fea 100644
struct mm_struct *mm;
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
-index 1bf1f74..5e27559 100644
+index 62bfbd9..bfd70ee 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -522,7 +522,7 @@ unsigned long bdi_dirty_limit(struct backing_dev_info *bdi, unsigned long dirty)
@@ -105763,7 +105562,7 @@ index 8105be4..93fb21c 100644
EXPORT_SYMBOL(kmem_cache_free);
diff --git a/mm/slub.c b/mm/slub.c
-index 6a4c2fb..18d36e8 100644
+index 60c6969..dd5e22f 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -186,7 +186,7 @@ static enum {
@@ -105793,7 +105592,7 @@ index 6a4c2fb..18d36e8 100644
s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
#ifdef CONFIG_STACKTRACE
{
-@@ -2537,6 +2537,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
+@@ -2520,6 +2520,14 @@ static __always_inline void slab_free(struct kmem_cache *s,
slab_free_hook(s, x);
@@ -105808,7 +105607,7 @@ index 6a4c2fb..18d36e8 100644
redo:
/*
* Determine the currently cpus per cpu slab.
-@@ -2572,6 +2580,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
+@@ -2555,6 +2563,8 @@ void kmem_cache_free(struct kmem_cache *s, void *x)
page = virt_to_head_page(x);
@@ -105817,7 +105616,7 @@ index 6a4c2fb..18d36e8 100644
slab_free(s, page, x, _RET_IP_);
trace_kmem_cache_free(_RET_IP_, x);
-@@ -2605,7 +2615,7 @@ static int slub_min_objects;
+@@ -2588,7 +2598,7 @@ static int slub_min_objects;
* Merge control. If this is set then no merging of slab caches will occur.
* (Could be removed. This was introduced to pacify the merge skeptics.)
*/
@@ -105826,7 +105625,7 @@ index 6a4c2fb..18d36e8 100644
/*
* Calculate the order of allocation given an slab object size.
-@@ -2909,6 +2919,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
+@@ -2892,6 +2902,9 @@ static int calculate_sizes(struct kmem_cache *s, int forced_order)
s->inuse = size;
if (((flags & (SLAB_DESTROY_BY_RCU | SLAB_POISON)) ||
@@ -105836,7 +105635,7 @@ index 6a4c2fb..18d36e8 100644
s->ctor)) {
/*
* Relocate free pointer after the object if it is not
-@@ -3055,7 +3068,7 @@ static int kmem_cache_open(struct kmem_cache *s,
+@@ -3038,7 +3051,7 @@ static int kmem_cache_open(struct kmem_cache *s,
else
s->cpu_partial = 30;
@@ -105845,7 +105644,7 @@ index 6a4c2fb..18d36e8 100644
#ifdef CONFIG_NUMA
s->remote_node_defrag_ratio = 1000;
#endif
-@@ -3159,8 +3172,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
+@@ -3142,8 +3155,7 @@ static inline int kmem_cache_close(struct kmem_cache *s)
void kmem_cache_destroy(struct kmem_cache *s)
{
down_write(&slub_lock);
@@ -105855,7 +105654,7 @@ index 6a4c2fb..18d36e8 100644
list_del(&s->list);
up_write(&slub_lock);
if (kmem_cache_close(s)) {
-@@ -3189,6 +3201,10 @@ static struct kmem_cache *kmem_cache;
+@@ -3172,6 +3184,10 @@ static struct kmem_cache *kmem_cache;
static struct kmem_cache *kmalloc_dma_caches[SLUB_PAGE_SHIFT];
#endif
@@ -105866,7 +105665,7 @@ index 6a4c2fb..18d36e8 100644
static int __init setup_slub_min_order(char *str)
{
get_option(&str, &slub_min_order);
-@@ -3303,6 +3319,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
+@@ -3286,6 +3302,13 @@ static struct kmem_cache *get_slab(size_t size, gfp_t flags)
return kmalloc_dma_caches[index];
#endif
@@ -105880,7 +105679,7 @@ index 6a4c2fb..18d36e8 100644
return kmalloc_caches[index];
}
-@@ -3371,6 +3394,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
+@@ -3354,6 +3377,59 @@ void *__kmalloc_node(size_t size, gfp_t flags, int node)
EXPORT_SYMBOL(__kmalloc_node);
#endif
@@ -105940,7 +105739,7 @@ index 6a4c2fb..18d36e8 100644
size_t ksize(const void *object)
{
struct page *page;
-@@ -3435,6 +3511,7 @@ void kfree(const void *x)
+@@ -3418,6 +3494,7 @@ void kfree(const void *x)
if (unlikely(ZERO_OR_NULL_PTR(x)))
return;
@@ -105948,7 +105747,7 @@ index 6a4c2fb..18d36e8 100644
page = virt_to_head_page(x);
if (unlikely(!PageSlab(page))) {
BUG_ON(!PageCompound(page));
-@@ -3645,7 +3722,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
+@@ -3628,7 +3705,7 @@ static void __init kmem_cache_bootstrap_fixup(struct kmem_cache *s)
int node;
list_add(&s->list, &slab_caches);
@@ -105957,7 +105756,7 @@ index 6a4c2fb..18d36e8 100644
for_each_node_state(node, N_NORMAL_MEMORY) {
struct kmem_cache_node *n = get_node(s, node);
-@@ -3762,17 +3839,17 @@ void __init kmem_cache_init(void)
+@@ -3745,17 +3822,17 @@ void __init kmem_cache_init(void)
/* Caches that are not of the two-to-the-power-of size */
if (KMALLOC_MIN_SIZE <= 32) {
@@ -105978,7 +105777,7 @@ index 6a4c2fb..18d36e8 100644
caches++;
}
-@@ -3814,6 +3891,22 @@ void __init kmem_cache_init(void)
+@@ -3797,6 +3874,22 @@ void __init kmem_cache_init(void)
}
}
#endif
@@ -106001,7 +105800,7 @@ index 6a4c2fb..18d36e8 100644
printk(KERN_INFO
"SLUB: Genslabs=%d, HWalign=%d, Order=%d-%d, MinObjects=%d,"
" CPUs=%d, Nodes=%d\n",
-@@ -3840,7 +3933,7 @@ static int slab_unmergeable(struct kmem_cache *s)
+@@ -3823,7 +3916,7 @@ static int slab_unmergeable(struct kmem_cache *s)
/*
* We may have set a slab to be unmergeable during bootstrap.
*/
@@ -106010,7 +105809,7 @@ index 6a4c2fb..18d36e8 100644
return 1;
return 0;
-@@ -3897,9 +3990,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3880,9 +3973,17 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
return NULL;
down_write(&slub_lock);
@@ -106029,7 +105828,7 @@ index 6a4c2fb..18d36e8 100644
/*
* Adjust the object sizes so that we clear
* the complete object on kzalloc.
-@@ -3908,7 +4009,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
+@@ -3891,7 +3992,7 @@ struct kmem_cache *kmem_cache_create(const char *name, size_t size,
s->inuse = max_t(int, s->inuse, ALIGN(size, sizeof(void *)));
if (sysfs_slab_alias(s, name)) {
@@ -106038,7 +105837,7 @@ index 6a4c2fb..18d36e8 100644
goto err;
}
up_write(&slub_lock);
-@@ -3979,7 +4080,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
+@@ -3962,7 +4063,7 @@ static int __cpuinit slab_cpuup_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
@@ -106047,7 +105846,7 @@ index 6a4c2fb..18d36e8 100644
.notifier_call = slab_cpuup_callback
};
-@@ -4037,7 +4138,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -4020,7 +4121,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
}
#endif
@@ -106056,7 +105855,7 @@ index 6a4c2fb..18d36e8 100644
static int count_inuse(struct page *page)
{
return page->inuse;
-@@ -4424,12 +4525,12 @@ static void resiliency_test(void)
+@@ -4407,12 +4508,12 @@ static void resiliency_test(void)
validate_slab_cache(kmalloc_caches[9]);
}
#else
@@ -106071,7 +105870,7 @@ index 6a4c2fb..18d36e8 100644
enum slab_stat_type {
SL_ALL, /* All slabs */
SL_PARTIAL, /* Only partially allocated slabs */
-@@ -4676,7 +4777,7 @@ SLAB_ATTR_RO(ctor);
+@@ -4659,7 +4760,7 @@ SLAB_ATTR_RO(ctor);
static ssize_t aliases_show(struct kmem_cache *s, char *buf)
{
@@ -106080,7 +105879,7 @@ index 6a4c2fb..18d36e8 100644
}
SLAB_ATTR_RO(aliases);
-@@ -5243,6 +5344,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5226,6 +5327,7 @@ static char *create_unique_id(struct kmem_cache *s)
return name;
}
@@ -106088,7 +105887,7 @@ index 6a4c2fb..18d36e8 100644
static int sysfs_slab_add(struct kmem_cache *s)
{
int err;
-@@ -5271,7 +5373,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
+@@ -5254,7 +5356,7 @@ static int sysfs_slab_add(struct kmem_cache *s)
}
s->kobj.kset = slab_kset;
@@ -106097,7 +105896,7 @@ index 6a4c2fb..18d36e8 100644
if (err) {
kobject_put(&s->kobj);
return err;
-@@ -5305,6 +5407,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5288,6 +5390,7 @@ static void sysfs_slab_remove(struct kmem_cache *s)
kobject_del(&s->kobj);
kobject_put(&s->kobj);
}
@@ -106105,7 +105904,7 @@ index 6a4c2fb..18d36e8 100644
/*
* Need to buffer aliases during bootup until sysfs becomes
-@@ -5318,6 +5421,7 @@ struct saved_alias {
+@@ -5301,6 +5404,7 @@ struct saved_alias {
static struct saved_alias *alias_list;
@@ -106113,7 +105912,7 @@ index 6a4c2fb..18d36e8 100644
static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
{
struct saved_alias *al;
-@@ -5340,6 +5444,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5323,6 +5427,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
alias_list = al;
return 0;
}
@@ -107247,10 +107046,10 @@ index f20c4fd..73aee41 100644
if (err < 0) {
pr_err("bridge: can't register sap for STP\n");
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
-index 398a297..83fc29c 100644
+index 1bd197f..1119378 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
-@@ -1416,7 +1416,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
+@@ -1415,7 +1415,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
nexthdr = ip6h->nexthdr;
offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
@@ -107344,7 +107143,7 @@ index 45f93f8..550f429 100644
break;
}
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index 7eed9eb..fd7291e 100644
+index 7e4b4b4..6c8ce35 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -48,19 +48,20 @@ static struct dentry *debugfsdir;
@@ -107449,7 +107248,7 @@ index 7eed9eb..fd7291e 100644
set_rx_flow_on(cf_sk);
caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
}
-@@ -852,7 +853,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
+@@ -860,7 +861,7 @@ static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
/*ifindex = id of the interface.*/
cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
@@ -107458,7 +107257,7 @@ index 7eed9eb..fd7291e 100644
cf_sk->layer.receive = caif_sktrecv_cb;
err = caif_connect_client(sock_net(sk), &cf_sk->conn_req,
-@@ -941,7 +942,7 @@ static int caif_release(struct socket *sock)
+@@ -949,7 +950,7 @@ static int caif_release(struct socket *sock)
spin_unlock_bh(&sk->sk_receive_queue.lock);
sock->sk = NULL;
@@ -107467,7 +107266,7 @@ index 7eed9eb..fd7291e 100644
WARN_ON(IS_ERR(cf_sk->debugfs_socket_dir));
if (cf_sk->debugfs_socket_dir != NULL)
-@@ -1120,7 +1121,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
+@@ -1128,7 +1129,7 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
cf_sk->conn_req.protocol = protocol;
/* Increase the number of sockets created. */
dbfs_atomic_inc(&cnt.caif_nr_socks);
@@ -108245,10 +108044,10 @@ index 66e3f1f..317ae80 100644
m->msg_iov = iov;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
-index 0ea3fd3..d87fef1 100644
+index c8c2645..e503d27 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
-@@ -2803,11 +2803,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
+@@ -2814,11 +2814,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
/* Terminate the table early */
memset(&t->neigh_vars[14], 0, sizeof(t->neigh_vars[14]));
} else {
@@ -110199,7 +109998,7 @@ index 2e0f0af..e2948bf 100644
syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
/* Has it gone just too far? */
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 8c2e259..90d7b4e 100644
+index 5e92043..90d7b4e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -86,6 +86,7 @@
@@ -110270,20 +110069,7 @@ index 8c2e259..90d7b4e 100644
ulen = skb->len - sizeof(struct udphdr);
copied = len;
if (copied > ulen)
-@@ -1248,10 +1269,8 @@ csum_copy_err:
- UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
- unlock_sock_fast(sk, slow);
-
-- if (noblock)
-- return -EAGAIN;
--
-- /* starting over for a new packet */
-+ /* starting over for a new packet, but check if we need to yield */
-+ cond_resched();
- msg->msg_flags &= ~MSG_TRUNC;
- goto try_again;
- }
-@@ -1486,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+@@ -1484,7 +1505,7 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
drop:
UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
@@ -110292,7 +110078,7 @@ index 8c2e259..90d7b4e 100644
kfree_skb(skb);
return -1;
}
-@@ -1505,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -1503,7 +1524,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
if (!skb1) {
@@ -110301,7 +110087,7 @@ index 8c2e259..90d7b4e 100644
UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
IS_UDPLITE(sk));
UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -1674,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -1672,6 +1693,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
goto csum_error;
UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -110311,7 +110097,7 @@ index 8c2e259..90d7b4e 100644
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
/*
-@@ -2097,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2095,8 +2119,13 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
sk_wmem_alloc_get(sp),
sk_rmem_alloc_get(sp),
0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
@@ -110906,7 +110692,7 @@ index 655cc60..c49497a 100644
static int tcp6_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index d131a95..59d5161 100644
+index dc08afd..59d5161 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -50,6 +50,10 @@
@@ -110920,20 +110706,7 @@ index d131a95..59d5161 100644
int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
{
const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
-@@ -451,10 +455,8 @@ csum_copy_err:
- }
- unlock_sock_fast(sk, slow);
-
-- if (noblock)
-- return -EAGAIN;
--
-- /* starting over for a new packet */
-+ /* starting over for a new packet, but check if we need to yield */
-+ cond_resched();
- msg->msg_flags &= ~MSG_TRUNC;
- goto try_again;
- }
-@@ -546,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
+@@ -544,7 +548,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
return 0;
drop:
@@ -110942,7 +110715,7 @@ index d131a95..59d5161 100644
drop_no_sk_drops_inc:
UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
kfree_skb(skb);
-@@ -622,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
+@@ -620,7 +624,7 @@ static void flush_stack(struct sock **stack, unsigned int count,
continue;
}
drop:
@@ -110951,7 +110724,7 @@ index d131a95..59d5161 100644
UDP6_INC_STATS_BH(sock_net(sk),
UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
UDP6_INC_STATS_BH(sock_net(sk),
-@@ -777,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -775,6 +779,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
proto == IPPROTO_UDPLITE);
@@ -110961,7 +110734,7 @@ index d131a95..59d5161 100644
icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
kfree_skb(skb);
-@@ -793,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -791,7 +798,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
if (!sock_owned_by_user(sk))
udpv6_queue_rcv_skb(sk, skb);
else if (sk_add_backlog(sk, skb)) {
@@ -110970,7 +110743,7 @@ index d131a95..59d5161 100644
bh_unlock_sock(sk);
sock_put(sk);
goto discard;
-@@ -1409,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
+@@ -1407,8 +1414,13 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
0, 0L, 0,
sock_i_uid(sp), 0,
sock_i_ino(sp),
@@ -111640,7 +111413,7 @@ index 6422845..2c19968 100644
if (!todrop_rate[i]) return 0;
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index d864aaf..d6afbda 100644
+index 197ed93..49519a9 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -562,7 +562,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
@@ -111662,7 +111435,7 @@ index d864aaf..d6afbda 100644
if ((ipvs->sync_state & IP_VS_STATE_MASTER) &&
cp->protocol == IPPROTO_SCTP) {
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index 93acfa1..e846c43 100644
+index 1e27a1f..9774f6b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -788,7 +788,7 @@ __ip_vs_update_dest(struct ip_vs_service *svc, struct ip_vs_dest *dest,
@@ -112385,7 +112158,7 @@ index b4d889b..bb33240 100644
*uaddr_len = sizeof(struct sockaddr_ax25);
}
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 4f19bf2..e3a2b51 100644
+index 0c21f06..0f53a06 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -195,6 +195,7 @@ struct tpacket_kbdq_core {
@@ -112404,7 +112177,7 @@ index 4f19bf2..e3a2b51 100644
prb_init_ft_ops(p1, req_u);
prb_setup_retire_blk_timer(po, tx_ring);
prb_open_block(p1, pbd);
-@@ -1678,7 +1680,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1664,7 +1666,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_packets++;
@@ -112413,7 +112186,7 @@ index 4f19bf2..e3a2b51 100644
__skb_queue_tail(&sk->sk_receive_queue, skb);
spin_unlock(&sk->sk_receive_queue.lock);
sk->sk_data_ready(sk, skb->len);
-@@ -1687,7 +1689,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1673,7 +1675,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
drop_n_acct:
spin_lock(&sk->sk_receive_queue.lock);
po->stats.tp_drops++;
@@ -112422,7 +112195,7 @@ index 4f19bf2..e3a2b51 100644
spin_unlock(&sk->sk_receive_queue.lock);
drop_n_restore:
-@@ -1778,6 +1780,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -1764,6 +1766,18 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
if ((int)snaplen < 0)
snaplen = 0;
}
@@ -112441,7 +112214,7 @@ index 4f19bf2..e3a2b51 100644
}
spin_lock(&sk->sk_receive_queue.lock);
h.raw = packet_current_rx_frame(po, skb,
-@@ -2623,6 +2637,7 @@ out:
+@@ -2609,6 +2623,7 @@ out:
static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
{
@@ -112449,7 +112222,7 @@ index 4f19bf2..e3a2b51 100644
struct sock_exterr_skb *serr;
struct sk_buff *skb, *skb2;
int copied, err;
-@@ -2644,8 +2659,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
+@@ -2630,8 +2645,9 @@ static int packet_recv_error(struct sock *sk, struct msghdr *msg, int len)
sock_recv_timestamp(msg, sk, skb);
serr = SKB_EXT_ERR(skb);
@@ -112460,7 +112233,7 @@ index 4f19bf2..e3a2b51 100644
msg->msg_flags |= MSG_ERRQUEUE;
err = copied;
-@@ -3273,7 +3289,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3259,7 +3275,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
case PACKET_HDRLEN:
if (len > sizeof(int))
len = sizeof(int);
@@ -112469,7 +112242,7 @@ index 4f19bf2..e3a2b51 100644
return -EFAULT;
switch (val) {
case TPACKET_V1:
-@@ -3323,7 +3339,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3309,7 +3325,11 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
if (put_user(len, optlen))
return -EFAULT;
@@ -112482,7 +112255,7 @@ index 4f19bf2..e3a2b51 100644
return -EFAULT;
return 0;
}
-@@ -3614,6 +3634,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+@@ -3600,6 +3620,10 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
goto out;
if (unlikely(req->tp_block_size & (PAGE_SIZE - 1)))
goto out;
@@ -112661,6 +112434,19 @@ index e29e0ca..fa3a6a3 100644
}
#endif
+diff --git a/net/rds/info.c b/net/rds/info.c
+index f1c016c..a4adb39 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
diff --git a/net/rds/iw.h b/net/rds/iw.h
index 04ce3b1..48119a6 100644
--- a/net/rds/iw.h
@@ -113310,10 +113096,10 @@ index 76388b0..a967f68 100644
sctp_generate_t1_cookie_event,
sctp_generate_t1_init_event,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
-index fc63664..832978a 100644
+index 24e88af..047e703 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
-@@ -2190,11 +2190,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
+@@ -2192,11 +2192,13 @@ static int sctp_setsockopt_events(struct sock *sk, char __user *optval,
{
struct sctp_association *asoc;
struct sctp_ulpevent *event;
@@ -113328,7 +113114,7 @@ index fc63664..832978a 100644
/*
* At the time when a user app subscribes to SCTP_SENDER_DRY_EVENT,
-@@ -4180,13 +4182,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
+@@ -4194,13 +4196,16 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
int __user *optlen)
{
@@ -113346,7 +113132,7 @@ index fc63664..832978a 100644
return -EFAULT;
return 0;
}
-@@ -4204,6 +4209,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
+@@ -4218,6 +4223,8 @@ static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
*/
static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optval, int __user *optlen)
{
@@ -113355,7 +113141,7 @@ index fc63664..832978a 100644
/* Applicable to UDP-style socket only */
if (sctp_style(sk, TCP))
return -EOPNOTSUPP;
-@@ -4212,7 +4219,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
+@@ -4226,7 +4233,8 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
len = sizeof(int);
if (put_user(len, optlen))
return -EFAULT;
@@ -113365,7 +113151,7 @@ index fc63664..832978a 100644
return -EFAULT;
return 0;
}
-@@ -4576,12 +4584,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
+@@ -4590,12 +4598,15 @@ static int sctp_getsockopt_delayed_ack(struct sock *sk, int len,
*/
static int sctp_getsockopt_initmsg(struct sock *sk, int len, char __user *optval, int __user *optlen)
{
@@ -113382,7 +113168,7 @@ index fc63664..832978a 100644
return -EFAULT;
return 0;
}
-@@ -4622,6 +4633,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
+@@ -4636,6 +4647,8 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
if (space_left < addrlen)
return -ENOMEM;
@@ -113445,7 +113231,7 @@ index 8da4481..d02565e 100644
+ (rtt >> sctp_rto_alpha);
} else {
diff --git a/net/socket.c b/net/socket.c
-index 116cf9d..a13ae17 100644
+index 10ea25a..e5f6b01 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -88,6 +88,7 @@
@@ -113629,7 +113415,7 @@ index 116cf9d..a13ae17 100644
int err, err2;
int fput_needed;
-@@ -1973,7 +2039,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -1971,7 +2037,7 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
* checking falls down on this.
*/
if (copy_from_user(ctl_buf,
@@ -113638,7 +113424,7 @@ index 116cf9d..a13ae17 100644
ctl_len))
goto out_freectl;
msg_sys->msg_control = ctl_buf;
-@@ -2124,7 +2190,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2122,7 +2188,7 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
int err, iov_size, total_len, len;
/* kernel mode address */
@@ -113647,7 +113433,7 @@ index 116cf9d..a13ae17 100644
/* user mode address pointers */
struct sockaddr __user *uaddr;
-@@ -2155,7 +2221,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
+@@ -2151,7 +2217,8 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
/* Save the user-mode address (verify_iovec will change the
* kernel msghdr to use the kernel address space)
*/
@@ -113657,7 +113443,7 @@ index 116cf9d..a13ae17 100644
uaddr_len = COMPAT_NAMELEN(msg);
if (MSG_CMSG_COMPAT & flags)
err = verify_compat_iovec(msg_sys, iov,
-@@ -2799,9 +2866,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2795,9 +2862,9 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
}
ifr = compat_alloc_user_space(buf_size);
@@ -113669,7 +113455,7 @@ index 116cf9d..a13ae17 100644
return -EFAULT;
if (put_user(convert_in ? rxnfc : compat_ptr(data),
-@@ -2823,12 +2890,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2819,12 +2886,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
offsetof(struct ethtool_rxnfc, fs.ring_cookie));
if (copy_in_user(rxnfc, compat_rxnfc,
@@ -113686,7 +113472,7 @@ index 116cf9d..a13ae17 100644
copy_in_user(&rxnfc->rule_cnt, &compat_rxnfc->rule_cnt,
sizeof(rxnfc->rule_cnt)))
return -EFAULT;
-@@ -2840,12 +2907,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
+@@ -2836,12 +2903,12 @@ static int ethtool_ioctl(struct net *net, struct compat_ifreq __user *ifr32)
if (convert_out) {
if (copy_in_user(compat_rxnfc, rxnfc,
@@ -113703,7 +113489,7 @@ index 116cf9d..a13ae17 100644
copy_in_user(&compat_rxnfc->rule_cnt, &rxnfc->rule_cnt,
sizeof(rxnfc->rule_cnt)))
return -EFAULT;
-@@ -2915,14 +2982,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
+@@ -2911,14 +2978,14 @@ static int bond_ioctl(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
err = dev_ioctl(net, cmd,
@@ -113720,7 +113506,7 @@ index 116cf9d..a13ae17 100644
return -EFAULT;
if (get_user(data, &ifr32->ifr_ifru.ifru_data))
-@@ -3024,7 +3091,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
+@@ -3020,7 +3087,7 @@ static int compat_sioc_ifmap(struct net *net, unsigned int cmd,
old_fs = get_fs();
set_fs(KERNEL_DS);
@@ -113729,7 +113515,7 @@ index 116cf9d..a13ae17 100644
set_fs(old_fs);
if (cmd == SIOCGIFMAP && !err) {
-@@ -3129,7 +3196,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
+@@ -3125,7 +3192,7 @@ static int routing_ioctl(struct net *net, struct socket *sock,
ret |= __get_user(rtdev, &(ur4->rt_dev));
if (rtdev) {
ret |= copy_from_user(devname, compat_ptr(rtdev), 15);
@@ -113738,7 +113524,7 @@ index 116cf9d..a13ae17 100644
devname[15] = 0;
} else
r4.rt_dev = NULL;
-@@ -3369,8 +3436,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
+@@ -3365,8 +3432,8 @@ int kernel_getsockopt(struct socket *sock, int level, int optname,
int __user *uoptlen;
int err;
@@ -113749,7 +113535,7 @@ index 116cf9d..a13ae17 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
-@@ -3390,7 +3457,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
+@@ -3386,7 +3453,7 @@ int kernel_setsockopt(struct socket *sock, int level, int optname,
char __user *uoptval;
int err;
@@ -114590,7 +114376,7 @@ index 1983717..4d6102c 100644
sub->evt.event = htohl(event, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8705ee3..cf68ef1 100644
+index 9b1f371..ff529bf 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -114639,7 +114425,7 @@ index 8705ee3..cf68ef1 100644
mutex_unlock(&path.dentry->d_inode->i_mutex);
dput(path.dentry);
path.dentry = dentry;
-@@ -2180,11 +2200,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
+@@ -2188,11 +2208,14 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
writable = unix_writable(sk);
other = unix_peer_get(sk);
if (other) {
@@ -114656,7 +114442,7 @@ index 8705ee3..cf68ef1 100644
sock_put(other);
}
-@@ -2276,9 +2299,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2284,9 +2307,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_puts(seq, "Num RefCount Protocol Flags Type St "
"Inode Path\n");
else {
@@ -114671,7 +114457,7 @@ index 8705ee3..cf68ef1 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2303,10 +2330,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2311,10 +2338,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_putc(seq, '@');
i++;
}
@@ -119101,7 +118887,7 @@ index 6ce2778..f25c378 100644
fail:
diff --git a/sound/synth/emux/emux_seq.c b/sound/synth/emux/emux_seq.c
-index 7778b8e..3d619fc 100644
+index a020920..55579f6 100644
--- a/sound/synth/emux/emux_seq.c
+++ b/sound/synth/emux/emux_seq.c
@@ -33,13 +33,13 @@ static int snd_emux_unuse(void *private_data, struct snd_seq_port_subscribe *inf
diff --git a/3.2.69/4425_grsec_remove_EI_PAX.patch b/3.2.70/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.2.69/4425_grsec_remove_EI_PAX.patch
rename to 3.2.70/4425_grsec_remove_EI_PAX.patch
diff --git a/3.2.69/4427_force_XATTR_PAX_tmpfs.patch b/3.2.70/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.2.69/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.2.70/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.2.69/4430_grsec-remove-localversion-grsec.patch b/3.2.70/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.2.69/4430_grsec-remove-localversion-grsec.patch
rename to 3.2.70/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.69/4435_grsec-mute-warnings.patch b/3.2.70/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.2.69/4435_grsec-mute-warnings.patch
rename to 3.2.70/4435_grsec-mute-warnings.patch
diff --git a/3.2.69/4440_grsec-remove-protected-paths.patch b/3.2.70/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.2.69/4440_grsec-remove-protected-paths.patch
rename to 3.2.70/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.69/4450_grsec-kconfig-default-gids.patch b/3.2.70/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.2.69/4450_grsec-kconfig-default-gids.patch
rename to 3.2.70/4450_grsec-kconfig-default-gids.patch
diff --git a/3.2.69/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.2.69/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.2.70/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.2.69/4470_disable-compat_vdso.patch b/3.2.70/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.2.69/4470_disable-compat_vdso.patch
rename to 3.2.70/4470_disable-compat_vdso.patch
diff --git a/3.2.69/4475_emutramp_default_on.patch b/3.2.70/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.2.69/4475_emutramp_default_on.patch
rename to 3.2.70/4475_emutramp_default_on.patch
diff --git a/4.1.4/1003_linux-4.1.4.patch b/4.1.4/1003_linux-4.1.4.patch
deleted file mode 100644
index d9bc159..0000000
--- a/4.1.4/1003_linux-4.1.4.patch
+++ /dev/null
@@ -1,11078 +0,0 @@
-diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
-index d0d0c57..0a378a8 100644
---- a/Documentation/ABI/testing/ima_policy
-+++ b/Documentation/ABI/testing/ima_policy
-@@ -20,17 +20,19 @@ Description:
- action: measure | dont_measure | appraise | dont_appraise | audit
- condition:= base | lsm [option]
- base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=]
-- [fowner]]
-+ [euid=] [fowner=]]
- lsm: [[subj_user=] [subj_role=] [subj_type=]
- [obj_user=] [obj_role=] [obj_type=]]
- option: [[appraise_type=]] [permit_directio]
-
- base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
- [FIRMWARE_CHECK]
-- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
-+ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND]
-+ [[^]MAY_EXEC]
- fsmagic:= hex value
- fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6)
- uid:= decimal value
-+ euid:= decimal value
- fowner:=decimal value
- lsm: are LSM specific
- option: appraise_type:= [imasig]
-@@ -49,11 +51,25 @@ Description:
- dont_measure fsmagic=0x01021994
- dont_appraise fsmagic=0x01021994
- # RAMFS_MAGIC
-- dont_measure fsmagic=0x858458f6
- dont_appraise fsmagic=0x858458f6
-+ # DEVPTS_SUPER_MAGIC
-+ dont_measure fsmagic=0x1cd1
-+ dont_appraise fsmagic=0x1cd1
-+ # BINFMTFS_MAGIC
-+ dont_measure fsmagic=0x42494e4d
-+ dont_appraise fsmagic=0x42494e4d
- # SECURITYFS_MAGIC
- dont_measure fsmagic=0x73636673
- dont_appraise fsmagic=0x73636673
-+ # SELINUX_MAGIC
-+ dont_measure fsmagic=0xf97cff8c
-+ dont_appraise fsmagic=0xf97cff8c
-+ # CGROUP_SUPER_MAGIC
-+ dont_measure fsmagic=0x27e0eb
-+ dont_appraise fsmagic=0x27e0eb
-+ # NSFS_MAGIC
-+ dont_measure fsmagic=0x6e736673
-+ dont_appraise fsmagic=0x6e736673
-
- measure func=BPRM_CHECK
- measure func=FILE_MMAP mask=MAY_EXEC
-@@ -70,10 +86,6 @@ Description:
- Examples of LSM specific definitions:
-
- SELinux:
-- # SELINUX_MAGIC
-- dont_measure fsmagic=0xf97cff8c
-- dont_appraise fsmagic=0xf97cff8c
--
- dont_measure obj_type=var_log_t
- dont_appraise obj_type=var_log_t
- dont_measure obj_type=auditd_log_t
-diff --git a/Documentation/ABI/testing/sysfs-ata b/Documentation/ABI/testing/sysfs-ata
-index 0a93215..9231dae 100644
---- a/Documentation/ABI/testing/sysfs-ata
-+++ b/Documentation/ABI/testing/sysfs-ata
-@@ -90,6 +90,17 @@ gscr
- 130: SATA_PMP_GSCR_SII_GPIO
- Only valid if the device is a PM.
-
-+trim
-+
-+ Shows the DSM TRIM mode currently used by the device. Valid
-+ values are:
-+ unsupported: Drive does not support DSM TRIM
-+ unqueued: Drive supports unqueued DSM TRIM only
-+ queued: Drive supports queued DSM TRIM
-+ forced_unqueued: Drive's unqueued DSM support is known to be
-+ buggy and only unqueued TRIM commands
-+ are sent
-+
- spdn_cnt
-
- Number of time libata decided to lower the speed of link due to errors.
-diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio
-index 3befcb1..1fbdd79 100644
---- a/Documentation/ABI/testing/sysfs-bus-iio
-+++ b/Documentation/ABI/testing/sysfs-bus-iio
-@@ -1165,10 +1165,8 @@ Description:
- object is near the sensor, usually be observing
- reflectivity of infrared or ultrasound emitted.
- Often these sensors are unit less and as such conversion
-- to SI units is not possible. Where it is, the units should
-- be meters. If such a conversion is not possible, the reported
-- values should behave in the same way as a distance, i.e. lower
-- values indicate something is closer to the sensor.
-+ to SI units is not possible. Higher proximity measurements
-+ indicate closer objects, and vice versa.
-
- What: /sys/.../iio:deviceX/in_illuminance_input
- What: /sys/.../iio:deviceX/in_illuminance_raw
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-index adda2a8..e357b02 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-370-pinctrl.txt
-@@ -92,5 +92,5 @@ mpp61 61 gpo, dev(wen1), uart1(txd), audio(rclk)
- mpp62 62 gpio, dev(a2), uart1(cts), tdm(drx), pcie(clkreq0),
- audio(mclk), uart0(cts)
- mpp63 63 gpo, spi0(sck), tclk
--mpp64 64 gpio, spi0(miso), spi0-1(cs1)
--mpp65 65 gpio, spi0(mosi), spi0-1(cs2)
-+mpp64 64 gpio, spi0(miso), spi0(cs1)
-+mpp65 65 gpio, spi0(mosi), spi0(cs2)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-index 7de0cda..bedbe42 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-375-pinctrl.txt
-@@ -22,8 +22,8 @@ mpp5 5 gpio, dev(ad7), spi0(cs2), spi1(cs2)
- mpp6 6 gpio, dev(ad0), led(p1), audio(rclk)
- mpp7 7 gpio, dev(ad1), ptp(clk), led(p2), audio(extclk)
- mpp8 8 gpio, dev (bootcs), spi0(cs0), spi1(cs0)
--mpp9 9 gpio, nf(wen), spi0(sck), spi1(sck)
--mpp10 10 gpio, nf(ren), dram(vttctrl), led(c1)
-+mpp9 9 gpio, spi0(sck), spi1(sck), nand(we)
-+mpp10 10 gpio, dram(vttctrl), led(c1), nand(re)
- mpp11 11 gpio, dev(a0), led(c2), audio(sdo)
- mpp12 12 gpio, dev(a1), audio(bclk)
- mpp13 13 gpio, dev(readyn), pcie0(rstoutn), pcie1(rstoutn)
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-index b17c968..4ac138a 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-38x-pinctrl.txt
-@@ -27,15 +27,15 @@ mpp8 8 gpio, ge0(txd1), dev(ad10)
- mpp9 9 gpio, ge0(txd2), dev(ad11)
- mpp10 10 gpio, ge0(txd3), dev(ad12)
- mpp11 11 gpio, ge0(txctl), dev(ad13)
--mpp12 12 gpio, ge0(rxd0), pcie0(rstout), pcie1(rstout) [1], spi0(cs1), dev(ad14)
--mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15)
--mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1)
--mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi), pcie1(rstout) [1]
--mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq)
-+mpp12 12 gpio, ge0(rxd0), pcie0(rstout), spi0(cs1), dev(ad14), pcie3(clkreq)
-+mpp13 13 gpio, ge0(rxd1), pcie0(clkreq), pcie1(clkreq) [1], spi0(cs2), dev(ad15), pcie2(clkreq)
-+mpp14 14 gpio, ge0(rxd2), ptp(clk), m(vtt_ctrl), spi0(cs3), dev(wen1), pcie3(clkreq)
-+mpp15 15 gpio, ge0(rxd3), ge(mdc slave), pcie0(rstout), spi0(mosi)
-+mpp16 16 gpio, ge0(rxctl), ge(mdio slave), m(decc_err), spi0(miso), pcie0(clkreq), pcie1(clkreq) [1]
- mpp17 17 gpio, ge0(rxclk), ptp(clk), ua1(rxd), spi0(sck), sata1(prsnt)
--mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0), pcie1(rstout) [1]
--mpp19 19 gpio, ge0(col), ptp(event_req), pcie0(clkreq), sata1(prsnt), ua0(cts)
--mpp20 20 gpio, ge0(txclk), ptp(clk), pcie1(rstout) [1], sata0(prsnt), ua0(rts)
-+mpp18 18 gpio, ge0(rxerr), ptp(trig_gen), ua1(txd), spi0(cs0)
-+mpp19 19 gpio, ge0(col), ptp(event_req), ge0(txerr), sata1(prsnt), ua0(cts)
-+mpp20 20 gpio, ge0(txclk), ptp(clk), sata0(prsnt), ua0(rts)
- mpp21 21 gpio, spi0(cs1), ge1(rxd0), sata0(prsnt), sd0(cmd), dev(bootcs)
- mpp22 22 gpio, spi0(mosi), dev(ad0)
- mpp23 23 gpio, spi0(sck), dev(ad2)
-@@ -58,23 +58,23 @@ mpp39 39 gpio, i2c1(sck), ge1(rxd2), ua0(cts), sd0(d1), dev(a2)
- mpp40 40 gpio, i2c1(sda), ge1(rxd3), ua0(rts), sd0(d2), dev(ad6)
- mpp41 41 gpio, ua1(rxd), ge1(rxctl), ua0(cts), spi1(cs3), dev(burst/last)
- mpp42 42 gpio, ua1(txd), ua0(rts), dev(ad7)
--mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), pcie0(rstout), dev(clkout)
--mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3], pcie0(rstout)
--mpp45 45 gpio, ref(clk_out0), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp46 46 gpio, ref(clk_out1), pcie0(rstout), pcie1(rstout) [1], pcie2(rstout), pcie3(rstout)
--mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], spi1(cs2), sata3(prsnt) [2]
--mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4)
--mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5)
--mpp50 50 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(drx), audio(extclk), sd0(cmd)
-+mpp43 43 gpio, pcie0(clkreq), m(vtt_ctrl), m(decc_err), spi1(cs2), dev(clkout)
-+mpp44 44 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [3]
-+mpp45 45 gpio, ref(clk_out0), pcie0(rstout)
-+mpp46 46 gpio, ref(clk_out1), pcie0(rstout)
-+mpp47 47 gpio, sata0(prsnt), sata1(prsnt), sata2(prsnt) [2], sata3(prsnt) [2]
-+mpp48 48 gpio, sata0(prsnt), m(vtt_ctrl), tdm2c(pclk), audio(mclk), sd0(d4), pcie0(clkreq)
-+mpp49 49 gpio, sata2(prsnt) [2], sata3(prsnt) [2], tdm2c(fsync), audio(lrclk), sd0(d5), pcie1(clkreq)
-+mpp50 50 gpio, pcie0(rstout), tdm2c(drx), audio(extclk), sd0(cmd)
- mpp51 51 gpio, tdm2c(dtx), audio(sdo), m(decc_err)
--mpp52 52 gpio, pcie0(rstout), pcie1(rstout) [1], tdm2c(intn), audio(sdi), sd0(d6)
-+mpp52 52 gpio, pcie0(rstout), tdm2c(intn), audio(sdi), sd0(d6)
- mpp53 53 gpio, sata1(prsnt), sata0(prsnt), tdm2c(rstn), audio(bclk), sd0(d7)
--mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), pcie1(rstout) [1], sd0(d3)
-+mpp54 54 gpio, sata0(prsnt), sata1(prsnt), pcie0(rstout), ge0(txerr), sd0(d3)
- mpp55 55 gpio, ua1(cts), ge(mdio), pcie1(clkreq) [1], spi1(cs1), sd0(d0)
- mpp56 56 gpio, ua1(rts), ge(mdc), m(decc_err), spi1(mosi)
- mpp57 57 gpio, spi1(sck), sd0(clk)
- mpp58 58 gpio, pcie1(clkreq) [1], i2c1(sck), pcie2(clkreq), spi1(miso), sd0(d1)
--mpp59 59 gpio, pcie0(rstout), i2c1(sda), pcie1(rstout) [1], spi1(cs0), sd0(d2)
-+mpp59 59 gpio, pcie0(rstout), i2c1(sda), spi1(cs0), sd0(d2)
-
- [1]: only available on 88F6820 and 88F6828
- [2]: only available on 88F6828
-diff --git a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-index 373dbccd..96e7744 100644
---- a/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-+++ b/Documentation/devicetree/bindings/pinctrl/marvell,armada-xp-pinctrl.txt
-@@ -42,15 +42,15 @@ mpp20 20 gpio, ge0(rxd4), ge1(rxd2), lcd(d20), ptp(clk)
- mpp21 21 gpio, ge0(rxd5), ge1(rxd3), lcd(d21), mem(bat)
- mpp22 22 gpio, ge0(rxd6), ge1(rxctl), lcd(d22), sata0(prsnt)
- mpp23 23 gpio, ge0(rxd7), ge1(rxclk), lcd(d23), sata1(prsnt)
--mpp24 24 gpio, lcd(hsync), sata1(prsnt), nf(bootcs-re), tdm(rst)
--mpp25 25 gpio, lcd(vsync), sata0(prsnt), nf(bootcs-we), tdm(pclk)
--mpp26 26 gpio, lcd(clk), tdm(fsync), vdd(cpu1-pd)
-+mpp24 24 gpio, lcd(hsync), sata1(prsnt), tdm(rst)
-+mpp25 25 gpio, lcd(vsync), sata0(prsnt), tdm(pclk)
-+mpp26 26 gpio, lcd(clk), tdm(fsync)
- mpp27 27 gpio, lcd(e), tdm(dtx), ptp(trig)
- mpp28 28 gpio, lcd(pwm), tdm(drx), ptp(evreq)
--mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk), vdd(cpu0-pd)
-+mpp29 29 gpio, lcd(ref-clk), tdm(int0), ptp(clk)
- mpp30 30 gpio, tdm(int1), sd0(clk)
--mpp31 31 gpio, tdm(int2), sd0(cmd), vdd(cpu0-pd)
--mpp32 32 gpio, tdm(int3), sd0(d0), vdd(cpu1-pd)
-+mpp31 31 gpio, tdm(int2), sd0(cmd)
-+mpp32 32 gpio, tdm(int3), sd0(d0)
- mpp33 33 gpio, tdm(int4), sd0(d1), mem(bat)
- mpp34 34 gpio, tdm(int5), sd0(d2), sata0(prsnt)
- mpp35 35 gpio, tdm(int6), sd0(d3), sata1(prsnt)
-@@ -58,21 +58,18 @@ mpp36 36 gpio, spi(mosi)
- mpp37 37 gpio, spi(miso)
- mpp38 38 gpio, spi(sck)
- mpp39 39 gpio, spi(cs0)
--mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), vdd(cpu1-pd),
-- pcie(clkreq0)
-+mpp40 40 gpio, spi(cs1), uart2(cts), lcd(vga-hsync), pcie(clkreq0)
- mpp41 41 gpio, spi(cs2), uart2(rts), lcd(vga-vsync), sata1(prsnt),
- pcie(clkreq1)
--mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer),
-- vdd(cpu0-pd)
--mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout),
-- vdd(cpu2-3-pd){1}
-+mpp42 42 gpio, uart2(rxd), uart0(cts), tdm(int7), tdm-1(timer)
-+mpp43 43 gpio, uart2(txd), uart0(rts), spi(cs3), pcie(rstout)
- mpp44 44 gpio, uart2(cts), uart3(rxd), spi(cs4), pcie(clkreq2),
- mem(bat)
- mpp45 45 gpio, uart2(rts), uart3(txd), spi(cs5), sata1(prsnt)
- mpp46 46 gpio, uart3(rts), uart1(rts), spi(cs6), sata0(prsnt)
- mpp47 47 gpio, uart3(cts), uart1(cts), spi(cs7), pcie(clkreq3),
- ref(clkout)
--mpp48 48 gpio, tclk, dev(burst/last)
-+mpp48 48 gpio, dev(clkout), dev(burst/last)
-
- * Marvell Armada XP (mv78260 and mv78460 only)
-
-@@ -84,9 +81,9 @@ mpp51 51 gpio, dev(ad16)
- mpp52 52 gpio, dev(ad17)
- mpp53 53 gpio, dev(ad18)
- mpp54 54 gpio, dev(ad19)
--mpp55 55 gpio, dev(ad20), vdd(cpu0-pd)
--mpp56 56 gpio, dev(ad21), vdd(cpu1-pd)
--mpp57 57 gpio, dev(ad22), vdd(cpu2-3-pd){1}
-+mpp55 55 gpio, dev(ad20)
-+mpp56 56 gpio, dev(ad21)
-+mpp57 57 gpio, dev(ad22)
- mpp58 58 gpio, dev(ad23)
- mpp59 59 gpio, dev(ad24)
- mpp60 60 gpio, dev(ad25)
-@@ -96,6 +93,3 @@ mpp63 63 gpio, dev(ad28)
- mpp64 64 gpio, dev(ad29)
- mpp65 65 gpio, dev(ad30)
- mpp66 66 gpio, dev(ad31)
--
--Notes:
--* {1} vdd(cpu2-3-pd) only available on mv78460.
-diff --git a/Documentation/devicetree/bindings/usb/atmel-usb.txt b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-index e180d56..de773a0 100644
---- a/Documentation/devicetree/bindings/usb/atmel-usb.txt
-+++ b/Documentation/devicetree/bindings/usb/atmel-usb.txt
-@@ -60,9 +60,9 @@ Atmel High-Speed USB device controller
-
- Required properties:
- - compatible: Should be one of the following
-- "at91sam9rl-udc"
-- "at91sam9g45-udc"
-- "sama5d3-udc"
-+ "atmel,at91sam9rl-udc"
-+ "atmel,at91sam9g45-udc"
-+ "atmel,sama5d3-udc"
- - reg: Address and length of the register set for the device
- - interrupts: Should contain usba interrupt
- - ep childnode: To specify the number of endpoints and their properties.
-diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 6726139..cd03a0f 100644
---- a/Documentation/kernel-parameters.txt
-+++ b/Documentation/kernel-parameters.txt
-@@ -1398,7 +1398,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
- The list of supported hash algorithms is defined
- in crypto/hash_info.h.
-
-- ima_tcb [IMA]
-+ ima_policy= [IMA]
-+ The builtin measurement policy to load during IMA
-+ setup. Specyfing "tcb" as the value, measures all
-+ programs exec'd, files mmap'd for exec, and all files
-+ opened with the read mode bit set by either the
-+ effective uid (euid=0) or uid=0.
-+ Format: "tcb"
-+
-+ ima_tcb [IMA] Deprecated. Use ima_policy= instead.
- Load a policy which meets the needs of the Trusted
- Computing Base. This means IMA will measure all
- programs exec'd, files mmap'd for exec, and all files
-diff --git a/Makefile b/Makefile
-index e3cdec4..36f3225 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 4
- PATCHLEVEL = 1
--SUBLEVEL = 3
-+SUBLEVEL = 4
- EXTRAVERSION =
- NAME = Series 4800
-
-diff --git a/arch/arm/boot/dts/at91-sama5d4ek.dts b/arch/arm/boot/dts/at91-sama5d4ek.dts
-index 89ef4a5..45e7761 100644
---- a/arch/arm/boot/dts/at91-sama5d4ek.dts
-+++ b/arch/arm/boot/dts/at91-sama5d4ek.dts
-@@ -108,8 +108,8 @@
- mmc0: mmc@f8000000 {
- pinctrl-names = "default";
- pinctrl-0 = <&pinctrl_mmc0_clk_cmd_dat0 &pinctrl_mmc0_dat1_3 &pinctrl_mmc0_cd>;
-- slot@1 {
-- reg = <1>;
-+ slot@0 {
-+ reg = <0>;
- bus-width = <4>;
- cd-gpios = <&pioE 5 0>;
- };
-diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
-index 70e59c5..e544211 100644
---- a/arch/arm/boot/dts/at91sam9g45.dtsi
-+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
-@@ -1148,7 +1148,7 @@
- usb2: gadget@fff78000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,at91sam9g45-udc";
- reg = <0x00600000 0x80000
- 0xfff78000 0x400>;
- interrupts = <27 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
-index 3aa56ae..3314a73 100644
---- a/arch/arm/boot/dts/at91sam9x5.dtsi
-+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
-@@ -1062,7 +1062,7 @@
- usb2: gadget@f803c000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,at91sam9g45-udc";
- reg = <0x00500000 0x80000
- 0xf803c000 0x400>;
- interrupts = <23 IRQ_TYPE_LEVEL_HIGH 0>;
-diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
-index bbcfb5a..0cb8b0b 100644
---- a/arch/arm/boot/dts/imx23.dtsi
-+++ b/arch/arm/boot/dts/imx23.dtsi
-@@ -435,6 +435,7 @@
- interrupts = <36 37 38 39 40 41 42 43 44>;
- status = "disabled";
- clocks = <&clks 26>;
-+ #io-channel-cells = <1>;
- };
-
- spdif@80054000 {
-diff --git a/arch/arm/boot/dts/sama5d3.dtsi b/arch/arm/boot/dts/sama5d3.dtsi
-index 57ab858..37e6182 100644
---- a/arch/arm/boot/dts/sama5d3.dtsi
-+++ b/arch/arm/boot/dts/sama5d3.dtsi
-@@ -1321,7 +1321,7 @@
- usb0: gadget@00500000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,sama5d3-udc";
- reg = <0x00500000 0x100000
- 0xf8030000 0x4000>;
- interrupts = <33 IRQ_TYPE_LEVEL_HIGH 2>;
-diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi
-index 6b1bb58..a5f5f40 100644
---- a/arch/arm/boot/dts/sama5d4.dtsi
-+++ b/arch/arm/boot/dts/sama5d4.dtsi
-@@ -123,7 +123,7 @@
- usb0: gadget@00400000 {
- #address-cells = <1>;
- #size-cells = <0>;
-- compatible = "atmel,at91sam9rl-udc";
-+ compatible = "atmel,sama5d3-udc";
- reg = <0x00400000 0x100000
- 0xfc02c000 0x4000>;
- interrupts = <47 IRQ_TYPE_LEVEL_HIGH 2>;
-@@ -1125,10 +1125,10 @@
- compatible = "atmel,at91sam9g46-aes";
- reg = <0xfc044000 0x100>;
- interrupts = <12 IRQ_TYPE_LEVEL_HIGH 0>;
-- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(41)>,
-- <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(40)>;
-+ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(41))>,
-+ <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(40))>;
- dma-names = "tx", "rx";
- clocks = <&aes_clk>;
- clock-names = "aes_clk";
-@@ -1139,10 +1139,10 @@
- compatible = "atmel,at91sam9g46-tdes";
- reg = <0xfc04c000 0x100>;
- interrupts = <14 IRQ_TYPE_LEVEL_HIGH 0>;
-- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(42)>,
-- <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(43)>;
-+ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(42))>,
-+ <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(43))>;
- dma-names = "tx", "rx";
- clocks = <&tdes_clk>;
- clock-names = "tdes_clk";
-@@ -1153,8 +1153,8 @@
- compatible = "atmel,at91sam9g46-sha";
- reg = <0xfc050000 0x100>;
- interrupts = <15 IRQ_TYPE_LEVEL_HIGH 0>;
-- dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1))
-- AT91_XDMAC_DT_PERID(44)>;
-+ dmas = <&dma0 (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1)
-+ | AT91_XDMAC_DT_PERID(44))>;
- dma-names = "tx";
- clocks = <&sha_clk>;
- clock-names = "sha_clk";
-diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
-index cca5b87..f11d825 100644
---- a/arch/arm/kernel/smp.c
-+++ b/arch/arm/kernel/smp.c
-@@ -576,7 +576,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- struct pt_regs *old_regs = set_irq_regs(regs);
-
- if ((unsigned)ipinr < NR_IPI) {
-- trace_ipi_entry(ipi_types[ipinr]);
-+ trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- __inc_irq_stat(cpu, ipi_irqs[ipinr]);
- }
-
-@@ -635,7 +635,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- }
-
- if ((unsigned)ipinr < NR_IPI)
-- trace_ipi_exit(ipi_types[ipinr]);
-+ trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- set_irq_regs(old_regs);
- }
-
-diff --git a/arch/arm/mach-dove/include/mach/irqs.h b/arch/arm/mach-dove/include/mach/irqs.h
-index 03d401d..3f29e6bc 100644
---- a/arch/arm/mach-dove/include/mach/irqs.h
-+++ b/arch/arm/mach-dove/include/mach/irqs.h
-@@ -14,73 +14,73 @@
- /*
- * Dove Low Interrupt Controller
- */
--#define IRQ_DOVE_BRIDGE 0
--#define IRQ_DOVE_H2C 1
--#define IRQ_DOVE_C2H 2
--#define IRQ_DOVE_NAND 3
--#define IRQ_DOVE_PDMA 4
--#define IRQ_DOVE_SPI1 5
--#define IRQ_DOVE_SPI0 6
--#define IRQ_DOVE_UART_0 7
--#define IRQ_DOVE_UART_1 8
--#define IRQ_DOVE_UART_2 9
--#define IRQ_DOVE_UART_3 10
--#define IRQ_DOVE_I2C 11
--#define IRQ_DOVE_GPIO_0_7 12
--#define IRQ_DOVE_GPIO_8_15 13
--#define IRQ_DOVE_GPIO_16_23 14
--#define IRQ_DOVE_PCIE0_ERR 15
--#define IRQ_DOVE_PCIE0 16
--#define IRQ_DOVE_PCIE1_ERR 17
--#define IRQ_DOVE_PCIE1 18
--#define IRQ_DOVE_I2S0 19
--#define IRQ_DOVE_I2S0_ERR 20
--#define IRQ_DOVE_I2S1 21
--#define IRQ_DOVE_I2S1_ERR 22
--#define IRQ_DOVE_USB_ERR 23
--#define IRQ_DOVE_USB0 24
--#define IRQ_DOVE_USB1 25
--#define IRQ_DOVE_GE00_RX 26
--#define IRQ_DOVE_GE00_TX 27
--#define IRQ_DOVE_GE00_MISC 28
--#define IRQ_DOVE_GE00_SUM 29
--#define IRQ_DOVE_GE00_ERR 30
--#define IRQ_DOVE_CRYPTO 31
-+#define IRQ_DOVE_BRIDGE (1 + 0)
-+#define IRQ_DOVE_H2C (1 + 1)
-+#define IRQ_DOVE_C2H (1 + 2)
-+#define IRQ_DOVE_NAND (1 + 3)
-+#define IRQ_DOVE_PDMA (1 + 4)
-+#define IRQ_DOVE_SPI1 (1 + 5)
-+#define IRQ_DOVE_SPI0 (1 + 6)
-+#define IRQ_DOVE_UART_0 (1 + 7)
-+#define IRQ_DOVE_UART_1 (1 + 8)
-+#define IRQ_DOVE_UART_2 (1 + 9)
-+#define IRQ_DOVE_UART_3 (1 + 10)
-+#define IRQ_DOVE_I2C (1 + 11)
-+#define IRQ_DOVE_GPIO_0_7 (1 + 12)
-+#define IRQ_DOVE_GPIO_8_15 (1 + 13)
-+#define IRQ_DOVE_GPIO_16_23 (1 + 14)
-+#define IRQ_DOVE_PCIE0_ERR (1 + 15)
-+#define IRQ_DOVE_PCIE0 (1 + 16)
-+#define IRQ_DOVE_PCIE1_ERR (1 + 17)
-+#define IRQ_DOVE_PCIE1 (1 + 18)
-+#define IRQ_DOVE_I2S0 (1 + 19)
-+#define IRQ_DOVE_I2S0_ERR (1 + 20)
-+#define IRQ_DOVE_I2S1 (1 + 21)
-+#define IRQ_DOVE_I2S1_ERR (1 + 22)
-+#define IRQ_DOVE_USB_ERR (1 + 23)
-+#define IRQ_DOVE_USB0 (1 + 24)
-+#define IRQ_DOVE_USB1 (1 + 25)
-+#define IRQ_DOVE_GE00_RX (1 + 26)
-+#define IRQ_DOVE_GE00_TX (1 + 27)
-+#define IRQ_DOVE_GE00_MISC (1 + 28)
-+#define IRQ_DOVE_GE00_SUM (1 + 29)
-+#define IRQ_DOVE_GE00_ERR (1 + 30)
-+#define IRQ_DOVE_CRYPTO (1 + 31)
-
- /*
- * Dove High Interrupt Controller
- */
--#define IRQ_DOVE_AC97 32
--#define IRQ_DOVE_PMU 33
--#define IRQ_DOVE_CAM 34
--#define IRQ_DOVE_SDIO0 35
--#define IRQ_DOVE_SDIO1 36
--#define IRQ_DOVE_SDIO0_WAKEUP 37
--#define IRQ_DOVE_SDIO1_WAKEUP 38
--#define IRQ_DOVE_XOR_00 39
--#define IRQ_DOVE_XOR_01 40
--#define IRQ_DOVE_XOR0_ERR 41
--#define IRQ_DOVE_XOR_10 42
--#define IRQ_DOVE_XOR_11 43
--#define IRQ_DOVE_XOR1_ERR 44
--#define IRQ_DOVE_LCD_DCON 45
--#define IRQ_DOVE_LCD1 46
--#define IRQ_DOVE_LCD0 47
--#define IRQ_DOVE_GPU 48
--#define IRQ_DOVE_PERFORM_MNTR 49
--#define IRQ_DOVE_VPRO_DMA1 51
--#define IRQ_DOVE_SSP_TIMER 54
--#define IRQ_DOVE_SSP 55
--#define IRQ_DOVE_MC_L2_ERR 56
--#define IRQ_DOVE_CRYPTO_ERR 59
--#define IRQ_DOVE_GPIO_24_31 60
--#define IRQ_DOVE_HIGH_GPIO 61
--#define IRQ_DOVE_SATA 62
-+#define IRQ_DOVE_AC97 (1 + 32)
-+#define IRQ_DOVE_PMU (1 + 33)
-+#define IRQ_DOVE_CAM (1 + 34)
-+#define IRQ_DOVE_SDIO0 (1 + 35)
-+#define IRQ_DOVE_SDIO1 (1 + 36)
-+#define IRQ_DOVE_SDIO0_WAKEUP (1 + 37)
-+#define IRQ_DOVE_SDIO1_WAKEUP (1 + 38)
-+#define IRQ_DOVE_XOR_00 (1 + 39)
-+#define IRQ_DOVE_XOR_01 (1 + 40)
-+#define IRQ_DOVE_XOR0_ERR (1 + 41)
-+#define IRQ_DOVE_XOR_10 (1 + 42)
-+#define IRQ_DOVE_XOR_11 (1 + 43)
-+#define IRQ_DOVE_XOR1_ERR (1 + 44)
-+#define IRQ_DOVE_LCD_DCON (1 + 45)
-+#define IRQ_DOVE_LCD1 (1 + 46)
-+#define IRQ_DOVE_LCD0 (1 + 47)
-+#define IRQ_DOVE_GPU (1 + 48)
-+#define IRQ_DOVE_PERFORM_MNTR (1 + 49)
-+#define IRQ_DOVE_VPRO_DMA1 (1 + 51)
-+#define IRQ_DOVE_SSP_TIMER (1 + 54)
-+#define IRQ_DOVE_SSP (1 + 55)
-+#define IRQ_DOVE_MC_L2_ERR (1 + 56)
-+#define IRQ_DOVE_CRYPTO_ERR (1 + 59)
-+#define IRQ_DOVE_GPIO_24_31 (1 + 60)
-+#define IRQ_DOVE_HIGH_GPIO (1 + 61)
-+#define IRQ_DOVE_SATA (1 + 62)
-
- /*
- * DOVE General Purpose Pins
- */
--#define IRQ_DOVE_GPIO_START 64
-+#define IRQ_DOVE_GPIO_START 65
- #define NR_GPIO_IRQS 64
-
- /*
-diff --git a/arch/arm/mach-dove/irq.c b/arch/arm/mach-dove/irq.c
-index 4a5a7ae..df0223f 100644
---- a/arch/arm/mach-dove/irq.c
-+++ b/arch/arm/mach-dove/irq.c
-@@ -126,14 +126,14 @@ __exception_irq_entry dove_legacy_handle_irq(struct pt_regs *regs)
- stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_LOW_OFF);
- stat &= readl_relaxed(dove_irq_base + IRQ_MASK_LOW_OFF);
- if (stat) {
-- unsigned int hwirq = __fls(stat);
-+ unsigned int hwirq = 1 + __fls(stat);
- handle_IRQ(hwirq, regs);
- return;
- }
- stat = readl_relaxed(dove_irq_base + IRQ_CAUSE_HIGH_OFF);
- stat &= readl_relaxed(dove_irq_base + IRQ_MASK_HIGH_OFF);
- if (stat) {
-- unsigned int hwirq = 32 + __fls(stat);
-+ unsigned int hwirq = 33 + __fls(stat);
- handle_IRQ(hwirq, regs);
- return;
- }
-@@ -144,8 +144,8 @@ void __init dove_init_irq(void)
- {
- int i;
-
-- orion_irq_init(0, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-- orion_irq_init(32, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
-+ orion_irq_init(1, IRQ_VIRT_BASE + IRQ_MASK_LOW_OFF);
-+ orion_irq_init(33, IRQ_VIRT_BASE + IRQ_MASK_HIGH_OFF);
-
- #ifdef CONFIG_MULTI_IRQ_HANDLER
- set_handle_irq(dove_legacy_handle_irq);
-diff --git a/arch/arm/vdso/vdsomunge.c b/arch/arm/vdso/vdsomunge.c
-index 9005b07..aedec81 100644
---- a/arch/arm/vdso/vdsomunge.c
-+++ b/arch/arm/vdso/vdsomunge.c
-@@ -45,13 +45,11 @@
- * it does.
- */
-
--#define _GNU_SOURCE
--
- #include <byteswap.h>
- #include <elf.h>
- #include <errno.h>
--#include <error.h>
- #include <fcntl.h>
-+#include <stdarg.h>
- #include <stdbool.h>
- #include <stdio.h>
- #include <stdlib.h>
-@@ -82,11 +80,25 @@
- #define EF_ARM_ABI_FLOAT_HARD 0x400
- #endif
-
-+static int failed;
-+static const char *argv0;
- static const char *outfile;
-
-+static void fail(const char *fmt, ...)
-+{
-+ va_list ap;
-+
-+ failed = 1;
-+ fprintf(stderr, "%s: ", argv0);
-+ va_start(ap, fmt);
-+ vfprintf(stderr, fmt, ap);
-+ va_end(ap);
-+ exit(EXIT_FAILURE);
-+}
-+
- static void cleanup(void)
- {
-- if (error_message_count > 0 && outfile != NULL)
-+ if (failed && outfile != NULL)
- unlink(outfile);
- }
-
-@@ -119,68 +131,66 @@ int main(int argc, char **argv)
- int infd;
-
- atexit(cleanup);
-+ argv0 = argv[0];
-
- if (argc != 3)
-- error(EXIT_FAILURE, 0, "Usage: %s [infile] [outfile]", argv[0]);
-+ fail("Usage: %s [infile] [outfile]\n", argv[0]);
-
- infile = argv[1];
- outfile = argv[2];
-
- infd = open(infile, O_RDONLY);
- if (infd < 0)
-- error(EXIT_FAILURE, errno, "Cannot open %s", infile);
-+ fail("Cannot open %s: %s\n", infile, strerror(errno));
-
- if (fstat(infd, &stat) != 0)
-- error(EXIT_FAILURE, errno, "Failed stat for %s", infile);
-+ fail("Failed stat for %s: %s\n", infile, strerror(errno));
-
- inbuf = mmap(NULL, stat.st_size, PROT_READ, MAP_PRIVATE, infd, 0);
- if (inbuf == MAP_FAILED)
-- error(EXIT_FAILURE, errno, "Failed to map %s", infile);
-+ fail("Failed to map %s: %s\n", infile, strerror(errno));
-
- close(infd);
-
- inhdr = inbuf;
-
- if (memcmp(&inhdr->e_ident, ELFMAG, SELFMAG) != 0)
-- error(EXIT_FAILURE, 0, "Not an ELF file");
-+ fail("Not an ELF file\n");
-
- if (inhdr->e_ident[EI_CLASS] != ELFCLASS32)
-- error(EXIT_FAILURE, 0, "Unsupported ELF class");
-+ fail("Unsupported ELF class\n");
-
- swap = inhdr->e_ident[EI_DATA] != HOST_ORDER;
-
- if (read_elf_half(inhdr->e_type, swap) != ET_DYN)
-- error(EXIT_FAILURE, 0, "Not a shared object");
-+ fail("Not a shared object\n");
-
-- if (read_elf_half(inhdr->e_machine, swap) != EM_ARM) {
-- error(EXIT_FAILURE, 0, "Unsupported architecture %#x",
-- inhdr->e_machine);
-- }
-+ if (read_elf_half(inhdr->e_machine, swap) != EM_ARM)
-+ fail("Unsupported architecture %#x\n", inhdr->e_machine);
-
- e_flags = read_elf_word(inhdr->e_flags, swap);
-
- if (EF_ARM_EABI_VERSION(e_flags) != EF_ARM_EABI_VER5) {
-- error(EXIT_FAILURE, 0, "Unsupported EABI version %#x",
-- EF_ARM_EABI_VERSION(e_flags));
-+ fail("Unsupported EABI version %#x\n",
-+ EF_ARM_EABI_VERSION(e_flags));
- }
-
- if (e_flags & EF_ARM_ABI_FLOAT_HARD)
-- error(EXIT_FAILURE, 0,
-- "Unexpected hard-float flag set in e_flags");
-+ fail("Unexpected hard-float flag set in e_flags\n");
-
- clear_soft_float = !!(e_flags & EF_ARM_ABI_FLOAT_SOFT);
-
- outfd = open(outfile, O_RDWR | O_CREAT | O_TRUNC, S_IRUSR | S_IWUSR);
- if (outfd < 0)
-- error(EXIT_FAILURE, errno, "Cannot open %s", outfile);
-+ fail("Cannot open %s: %s\n", outfile, strerror(errno));
-
- if (ftruncate(outfd, stat.st_size) != 0)
-- error(EXIT_FAILURE, errno, "Cannot truncate %s", outfile);
-+ fail("Cannot truncate %s: %s\n", outfile, strerror(errno));
-
- outbuf = mmap(NULL, stat.st_size, PROT_READ | PROT_WRITE, MAP_SHARED,
- outfd, 0);
- if (outbuf == MAP_FAILED)
-- error(EXIT_FAILURE, errno, "Failed to map %s", outfile);
-+ fail("Failed to map %s: %s\n", outfile, strerror(errno));
-
- close(outfd);
-
-@@ -195,7 +205,7 @@ int main(int argc, char **argv)
- }
-
- if (msync(outbuf, stat.st_size, MS_SYNC) != 0)
-- error(EXIT_FAILURE, errno, "Failed to sync %s", outfile);
-+ fail("Failed to sync %s: %s\n", outfile, strerror(errno));
-
- return EXIT_SUCCESS;
- }
-diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
-index 2cb0081..d3a202b 100644
---- a/arch/arm64/kernel/smp.c
-+++ b/arch/arm64/kernel/smp.c
-@@ -569,7 +569,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- struct pt_regs *old_regs = set_irq_regs(regs);
-
- if ((unsigned)ipinr < NR_IPI) {
-- trace_ipi_entry(ipi_types[ipinr]);
-+ trace_ipi_entry_rcuidle(ipi_types[ipinr]);
- __inc_irq_stat(cpu, ipi_irqs[ipinr]);
- }
-
-@@ -612,7 +612,7 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
- }
-
- if ((unsigned)ipinr < NR_IPI)
-- trace_ipi_exit(ipi_types[ipinr]);
-+ trace_ipi_exit_rcuidle(ipi_types[ipinr]);
- set_irq_regs(old_regs);
- }
-
-diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
-index 2de9d2e..0eeb4f09 100644
---- a/arch/arm64/mm/hugetlbpage.c
-+++ b/arch/arm64/mm/hugetlbpage.c
-@@ -40,13 +40,13 @@ int huge_pmd_unshare(struct mm_struct *mm, unsigned long *addr, pte_t *ptep)
-
- int pmd_huge(pmd_t pmd)
- {
-- return !(pmd_val(pmd) & PMD_TABLE_BIT);
-+ return pmd_val(pmd) && !(pmd_val(pmd) & PMD_TABLE_BIT);
- }
-
- int pud_huge(pud_t pud)
- {
- #ifndef __PAGETABLE_PMD_FOLDED
-- return !(pud_val(pud) & PUD_TABLE_BIT);
-+ return pud_val(pud) && !(pud_val(pud) & PUD_TABLE_BIT);
- #else
- return 0;
- #endif
-diff --git a/arch/arm64/net/bpf_jit.h b/arch/arm64/net/bpf_jit.h
-index de0a81a..98a26ce 100644
---- a/arch/arm64/net/bpf_jit.h
-+++ b/arch/arm64/net/bpf_jit.h
-@@ -110,6 +110,10 @@
- /* Rd = Rn >> shift; signed */
- #define A64_ASR(sf, Rd, Rn, shift) A64_SBFM(sf, Rd, Rn, shift, (sf) ? 63 : 31)
-
-+/* Zero extend */
-+#define A64_UXTH(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 15)
-+#define A64_UXTW(sf, Rd, Rn) A64_UBFM(sf, Rd, Rn, 0, 31)
-+
- /* Move wide (immediate) */
- #define A64_MOVEW(sf, Rd, imm16, shift, type) \
- aarch64_insn_gen_movewide(Rd, imm16, shift, \
-diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
-index dc6a484..c047598 100644
---- a/arch/arm64/net/bpf_jit_comp.c
-+++ b/arch/arm64/net/bpf_jit_comp.c
-@@ -113,9 +113,9 @@ static inline void emit_a64_mov_i(const int is64, const int reg,
- static inline int bpf2a64_offset(int bpf_to, int bpf_from,
- const struct jit_ctx *ctx)
- {
-- int to = ctx->offset[bpf_to + 1];
-+ int to = ctx->offset[bpf_to];
- /* -1 to account for the Branch instruction */
-- int from = ctx->offset[bpf_from + 1] - 1;
-+ int from = ctx->offset[bpf_from] - 1;
-
- return to - from;
- }
-@@ -289,23 +289,41 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx)
- case BPF_ALU | BPF_END | BPF_FROM_BE:
- #ifdef CONFIG_CPU_BIG_ENDIAN
- if (BPF_SRC(code) == BPF_FROM_BE)
-- break;
-+ goto emit_bswap_uxt;
- #else /* !CONFIG_CPU_BIG_ENDIAN */
- if (BPF_SRC(code) == BPF_FROM_LE)
-- break;
-+ goto emit_bswap_uxt;
- #endif
- switch (imm) {
- case 16:
- emit(A64_REV16(is64, dst, dst), ctx);
-+ /* zero-extend 16 bits into 64 bits */
-+ emit(A64_UXTH(is64, dst, dst), ctx);
- break;
- case 32:
- emit(A64_REV32(is64, dst, dst), ctx);
-+ /* upper 32 bits already cleared */
- break;
- case 64:
- emit(A64_REV64(dst, dst), ctx);
- break;
- }
- break;
-+emit_bswap_uxt:
-+ switch (imm) {
-+ case 16:
-+ /* zero-extend 16 bits into 64 bits */
-+ emit(A64_UXTH(is64, dst, dst), ctx);
-+ break;
-+ case 32:
-+ /* zero-extend 32 bits into 64 bits */
-+ emit(A64_UXTW(is64, dst, dst), ctx);
-+ break;
-+ case 64:
-+ /* nop */
-+ break;
-+ }
-+ break;
- /* dst = imm */
- case BPF_ALU | BPF_MOV | BPF_K:
- case BPF_ALU64 | BPF_MOV | BPF_K:
-@@ -640,10 +658,11 @@ static int build_body(struct jit_ctx *ctx)
- const struct bpf_insn *insn = &prog->insnsi[i];
- int ret;
-
-+ ret = build_insn(insn, ctx);
-+
- if (ctx->image == NULL)
- ctx->offset[i] = ctx->idx;
-
-- ret = build_insn(insn, ctx);
- if (ret > 0) {
- i++;
- continue;
-diff --git a/arch/m68k/Kconfig.cpu b/arch/m68k/Kconfig.cpu
-index 33013df..5c68c85 100644
---- a/arch/m68k/Kconfig.cpu
-+++ b/arch/m68k/Kconfig.cpu
-@@ -125,6 +125,13 @@ endif # M68KCLASSIC
-
- if COLDFIRE
-
-+choice
-+ prompt "ColdFire SoC type"
-+ default M520x
-+ help
-+ Select the type of ColdFire System-on-Chip (SoC) that you want
-+ to build for.
-+
- config M5206
- bool "MCF5206"
- depends on !MMU
-@@ -174,9 +181,6 @@ config M525x
- help
- Freescale (Motorola) Coldfire 5251/5253 processor support.
-
--config M527x
-- bool
--
- config M5271
- bool "MCF5271"
- depends on !MMU
-@@ -223,9 +227,6 @@ config M5307
- help
- Motorola ColdFire 5307 processor support.
-
--config M53xx
-- bool
--
- config M532x
- bool "MCF532x"
- depends on !MMU
-@@ -251,9 +252,6 @@ config M5407
- help
- Motorola ColdFire 5407 processor support.
-
--config M54xx
-- bool
--
- config M547x
- bool "MCF547x"
- select M54xx
-@@ -280,6 +278,17 @@ config M5441x
- help
- Freescale Coldfire 54410/54415/54416/54417/54418 processor support.
-
-+endchoice
-+
-+config M527x
-+ bool
-+
-+config M53xx
-+ bool
-+
-+config M54xx
-+ bool
-+
- endif # COLDFIRE
-
-
-@@ -416,22 +425,10 @@ config HAVE_MBAR
- config HAVE_IPSBAR
- bool
-
--config CLOCK_SET
-- bool "Enable setting the CPU clock frequency"
-- depends on COLDFIRE
-- default n
-- help
-- On some CPU's you do not need to know what the core CPU clock
-- frequency is. On these you can disable clock setting. On some
-- traditional 68K parts, and on all ColdFire parts you need to set
-- the appropriate CPU clock frequency. On these devices many of the
-- onboard peripherals derive their timing from the master CPU clock
-- frequency.
--
- config CLOCK_FREQ
- int "Set the core clock frequency"
- default "66666666"
-- depends on CLOCK_SET
-+ depends on COLDFIRE
- help
- Define the CPU clock frequency in use. This is the core clock
- frequency, it may or may not be the same as the external clock
-diff --git a/arch/m68k/include/asm/coldfire.h b/arch/m68k/include/asm/coldfire.h
-index c94557b..50aa4da 100644
---- a/arch/m68k/include/asm/coldfire.h
-+++ b/arch/m68k/include/asm/coldfire.h
-@@ -19,7 +19,7 @@
- * in any case new boards come along from time to time that have yet
- * another different clocking frequency.
- */
--#ifdef CONFIG_CLOCK_SET
-+#ifdef CONFIG_CLOCK_FREQ
- #define MCF_CLK CONFIG_CLOCK_FREQ
- #else
- #error "Don't know what your ColdFire CPU clock frequency is??"
-diff --git a/arch/openrisc/Kconfig b/arch/openrisc/Kconfig
-index e5a693b..443f44d 100644
---- a/arch/openrisc/Kconfig
-+++ b/arch/openrisc/Kconfig
-@@ -17,6 +17,7 @@ config OPENRISC
- select GENERIC_IRQ_SHOW
- select GENERIC_IOMAP
- select GENERIC_CPU_DEVICES
-+ select HAVE_UID16
- select GENERIC_ATOMIC64
- select GENERIC_CLOCKEVENTS
- select GENERIC_STRNCPY_FROM_USER
-@@ -31,9 +32,6 @@ config MMU
- config HAVE_DMA_ATTRS
- def_bool y
-
--config UID16
-- def_bool y
--
- config RWSEM_GENERIC_SPINLOCK
- def_bool y
-
-diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
-index 9d518d6..844b06d 100644
---- a/arch/x86/mm/mmap.c
-+++ b/arch/x86/mm/mmap.c
-@@ -126,3 +126,10 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
- mm->get_unmapped_area = arch_get_unmapped_area_topdown;
- }
- }
-+
-+const char *arch_vma_name(struct vm_area_struct *vma)
-+{
-+ if (vma->vm_flags & VM_MPX)
-+ return "[mpx]";
-+ return NULL;
-+}
-diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c
-index c439ec4..4d1c11c 100644
---- a/arch/x86/mm/mpx.c
-+++ b/arch/x86/mm/mpx.c
-@@ -18,26 +18,9 @@
- #include <asm/processor.h>
- #include <asm/fpu-internal.h>
-
--static const char *mpx_mapping_name(struct vm_area_struct *vma)
--{
-- return "[mpx]";
--}
--
--static struct vm_operations_struct mpx_vma_ops = {
-- .name = mpx_mapping_name,
--};
--
--static int is_mpx_vma(struct vm_area_struct *vma)
--{
-- return (vma->vm_ops == &mpx_vma_ops);
--}
--
- /*
- * This is really a simplified "vm_mmap". it only handles MPX
- * bounds tables (the bounds directory is user-allocated).
-- *
-- * Later on, we use the vma->vm_ops to uniquely identify these
-- * VMAs.
- */
- static unsigned long mpx_mmap(unsigned long len)
- {
-@@ -83,7 +66,6 @@ static unsigned long mpx_mmap(unsigned long len)
- ret = -ENOMEM;
- goto out;
- }
-- vma->vm_ops = &mpx_vma_ops;
-
- if (vm_flags & VM_LOCKED) {
- up_write(&mm->mmap_sem);
-@@ -661,7 +643,7 @@ static int zap_bt_entries(struct mm_struct *mm,
- * so stop immediately and return an error. This
- * probably results in a SIGSEGV.
- */
-- if (!is_mpx_vma(vma))
-+ if (!(vma->vm_flags & VM_MPX))
- return -EINVAL;
-
- len = min(vma->vm_end, end) - addr;
-diff --git a/block/bio.c b/block/bio.c
-index f66a4ea..4441522 100644
---- a/block/bio.c
-+++ b/block/bio.c
-@@ -1814,8 +1814,9 @@ EXPORT_SYMBOL(bio_endio_nodec);
- * Allocates and returns a new bio which represents @sectors from the start of
- * @bio, and updates @bio to represent the remaining sectors.
- *
-- * The newly allocated bio will point to @bio's bi_io_vec; it is the caller's
-- * responsibility to ensure that @bio is not freed before the split.
-+ * Unless this is a discard request the newly allocated bio will point
-+ * to @bio's bi_io_vec; it is the caller's responsibility to ensure that
-+ * @bio is not freed before the split.
- */
- struct bio *bio_split(struct bio *bio, int sectors,
- gfp_t gfp, struct bio_set *bs)
-@@ -1825,7 +1826,15 @@ struct bio *bio_split(struct bio *bio, int sectors,
- BUG_ON(sectors <= 0);
- BUG_ON(sectors >= bio_sectors(bio));
-
-- split = bio_clone_fast(bio, gfp, bs);
-+ /*
-+ * Discards need a mutable bio_vec to accommodate the payload
-+ * required by the DSM TRIM and UNMAP commands.
-+ */
-+ if (bio->bi_rw & REQ_DISCARD)
-+ split = bio_clone_bioset(bio, gfp, bs);
-+ else
-+ split = bio_clone_fast(bio, gfp, bs);
-+
- if (!split)
- return NULL;
-
-diff --git a/crypto/asymmetric_keys/asymmetric_keys.h b/crypto/asymmetric_keys/asymmetric_keys.h
-index f973308..3f5b537 100644
---- a/crypto/asymmetric_keys/asymmetric_keys.h
-+++ b/crypto/asymmetric_keys/asymmetric_keys.h
-@@ -11,6 +11,9 @@
-
- extern struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id);
-
-+extern int __asymmetric_key_hex_to_key_id(const char *id,
-+ struct asymmetric_key_id *match_id,
-+ size_t hexlen);
- static inline
- const struct asymmetric_key_ids *asymmetric_key_ids(const struct key *key)
- {
-diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c
-index bcbbbd7..b0e4ed2 100644
---- a/crypto/asymmetric_keys/asymmetric_type.c
-+++ b/crypto/asymmetric_keys/asymmetric_type.c
-@@ -104,6 +104,15 @@ static bool asymmetric_match_key_ids(
- return false;
- }
-
-+/* helper function can be called directly with pre-allocated memory */
-+inline int __asymmetric_key_hex_to_key_id(const char *id,
-+ struct asymmetric_key_id *match_id,
-+ size_t hexlen)
-+{
-+ match_id->len = hexlen;
-+ return hex2bin(match_id->data, id, hexlen);
-+}
-+
- /**
- * asymmetric_key_hex_to_key_id - Convert a hex string into a key ID.
- * @id: The ID as a hex string.
-@@ -111,21 +120,20 @@ static bool asymmetric_match_key_ids(
- struct asymmetric_key_id *asymmetric_key_hex_to_key_id(const char *id)
- {
- struct asymmetric_key_id *match_id;
-- size_t hexlen;
-+ size_t asciihexlen;
- int ret;
-
- if (!*id)
- return ERR_PTR(-EINVAL);
-- hexlen = strlen(id);
-- if (hexlen & 1)
-+ asciihexlen = strlen(id);
-+ if (asciihexlen & 1)
- return ERR_PTR(-EINVAL);
-
-- match_id = kmalloc(sizeof(struct asymmetric_key_id) + hexlen / 2,
-+ match_id = kmalloc(sizeof(struct asymmetric_key_id) + asciihexlen / 2,
- GFP_KERNEL);
- if (!match_id)
- return ERR_PTR(-ENOMEM);
-- match_id->len = hexlen / 2;
-- ret = hex2bin(match_id->data, id, hexlen / 2);
-+ ret = __asymmetric_key_hex_to_key_id(id, match_id, asciihexlen / 2);
- if (ret < 0) {
- kfree(match_id);
- return ERR_PTR(-EINVAL);
-diff --git a/crypto/asymmetric_keys/x509_public_key.c b/crypto/asymmetric_keys/x509_public_key.c
-index a6c4203..24f17e6 100644
---- a/crypto/asymmetric_keys/x509_public_key.c
-+++ b/crypto/asymmetric_keys/x509_public_key.c
-@@ -28,17 +28,30 @@ static bool use_builtin_keys;
- static struct asymmetric_key_id *ca_keyid;
-
- #ifndef MODULE
-+static struct {
-+ struct asymmetric_key_id id;
-+ unsigned char data[10];
-+} cakey;
-+
- static int __init ca_keys_setup(char *str)
- {
- if (!str) /* default system keyring */
- return 1;
-
- if (strncmp(str, "id:", 3) == 0) {
-- struct asymmetric_key_id *p;
-- p = asymmetric_key_hex_to_key_id(str + 3);
-- if (p == ERR_PTR(-EINVAL))
-- pr_err("Unparsable hex string in ca_keys\n");
-- else if (!IS_ERR(p))
-+ struct asymmetric_key_id *p = &cakey.id;
-+ size_t hexlen = (strlen(str) - 3) / 2;
-+ int ret;
-+
-+ if (hexlen == 0 || hexlen > sizeof(cakey.data)) {
-+ pr_err("Missing or invalid ca_keys id\n");
-+ return 1;
-+ }
-+
-+ ret = __asymmetric_key_hex_to_key_id(str + 3, p, hexlen);
-+ if (ret < 0)
-+ pr_err("Unparsable ca_keys id hex string\n");
-+ else
- ca_keyid = p; /* owner key 'id:xxxxxx' */
- } else if (strcmp(str, "builtin") == 0) {
- use_builtin_keys = true;
-diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
-index 37fb190..73f056a 100644
---- a/drivers/acpi/acpi_lpss.c
-+++ b/drivers/acpi/acpi_lpss.c
-@@ -352,13 +352,16 @@ static int acpi_lpss_create_device(struct acpi_device *adev,
- pdata->mmio_size = resource_size(rentry->res);
- pdata->mmio_base = ioremap(rentry->res->start,
- pdata->mmio_size);
-- if (!pdata->mmio_base)
-- goto err_out;
- break;
- }
-
- acpi_dev_free_resource_list(&resource_list);
-
-+ if (!pdata->mmio_base) {
-+ ret = -ENOMEM;
-+ goto err_out;
-+ }
-+
- pdata->dev_desc = dev_desc;
-
- if (dev_desc->setup)
-diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
-index 87b2752..7f50dd9 100644
---- a/drivers/acpi/acpica/aclocal.h
-+++ b/drivers/acpi/acpica/aclocal.h
-@@ -213,6 +213,7 @@ struct acpi_table_list {
-
- #define ACPI_TABLE_INDEX_DSDT (0)
- #define ACPI_TABLE_INDEX_FACS (1)
-+#define ACPI_TABLE_INDEX_X_FACS (2)
-
- struct acpi_find_context {
- char *search_for;
-diff --git a/drivers/acpi/acpica/tbfadt.c b/drivers/acpi/acpica/tbfadt.c
-index 7d24860..05be59c 100644
---- a/drivers/acpi/acpica/tbfadt.c
-+++ b/drivers/acpi/acpica/tbfadt.c
-@@ -350,9 +350,18 @@ void acpi_tb_parse_fadt(u32 table_index)
- /* If Hardware Reduced flag is set, there is no FACS */
-
- if (!acpi_gbl_reduced_hardware) {
-- acpi_tb_install_fixed_table((acpi_physical_address)
-- acpi_gbl_FADT.Xfacs, ACPI_SIG_FACS,
-- ACPI_TABLE_INDEX_FACS);
-+ if (acpi_gbl_FADT.facs) {
-+ acpi_tb_install_fixed_table((acpi_physical_address)
-+ acpi_gbl_FADT.facs,
-+ ACPI_SIG_FACS,
-+ ACPI_TABLE_INDEX_FACS);
-+ }
-+ if (acpi_gbl_FADT.Xfacs) {
-+ acpi_tb_install_fixed_table((acpi_physical_address)
-+ acpi_gbl_FADT.Xfacs,
-+ ACPI_SIG_FACS,
-+ ACPI_TABLE_INDEX_X_FACS);
-+ }
- }
- }
-
-@@ -491,13 +500,9 @@ static void acpi_tb_convert_fadt(void)
- acpi_gbl_FADT.header.length = sizeof(struct acpi_table_fadt);
-
- /*
-- * Expand the 32-bit FACS and DSDT addresses to 64-bit as necessary.
-+ * Expand the 32-bit DSDT addresses to 64-bit as necessary.
- * Later ACPICA code will always use the X 64-bit field.
- */
-- acpi_gbl_FADT.Xfacs = acpi_tb_select_address("FACS",
-- acpi_gbl_FADT.facs,
-- acpi_gbl_FADT.Xfacs);
--
- acpi_gbl_FADT.Xdsdt = acpi_tb_select_address("DSDT",
- acpi_gbl_FADT.dsdt,
- acpi_gbl_FADT.Xdsdt);
-diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
-index 6559a58..2fb1afa 100644
---- a/drivers/acpi/acpica/tbutils.c
-+++ b/drivers/acpi/acpica/tbutils.c
-@@ -68,7 +68,8 @@ acpi_tb_get_root_table_entry(u8 *table_entry, u32 table_entry_size);
-
- acpi_status acpi_tb_initialize_facs(void)
- {
-- acpi_status status;
-+ struct acpi_table_facs *facs32;
-+ struct acpi_table_facs *facs64;
-
- /* If Hardware Reduced flag is set, there is no FACS */
-
-@@ -77,11 +78,22 @@ acpi_status acpi_tb_initialize_facs(void)
- return (AE_OK);
- }
-
-- status = acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-- ACPI_CAST_INDIRECT_PTR(struct
-- acpi_table_header,
-- &acpi_gbl_FACS));
-- return (status);
-+ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_FACS,
-+ ACPI_CAST_INDIRECT_PTR(struct
-+ acpi_table_header,
-+ &facs32));
-+ (void)acpi_get_table_by_index(ACPI_TABLE_INDEX_X_FACS,
-+ ACPI_CAST_INDIRECT_PTR(struct
-+ acpi_table_header,
-+ &facs64));
-+
-+ if (acpi_gbl_use32_bit_facs_addresses) {
-+ acpi_gbl_FACS = facs32 ? facs32 : facs64;
-+ } else {
-+ acpi_gbl_FACS = facs64 ? facs64 : facs32;
-+ }
-+
-+ return (AE_OK);
- }
- #endif /* !ACPI_REDUCED_HARDWARE */
-
-@@ -101,7 +113,7 @@ acpi_status acpi_tb_initialize_facs(void)
- u8 acpi_tb_tables_loaded(void)
- {
-
-- if (acpi_gbl_root_table_list.current_table_count >= 3) {
-+ if (acpi_gbl_root_table_list.current_table_count >= 4) {
- return (TRUE);
- }
-
-@@ -357,11 +369,11 @@ acpi_status __init acpi_tb_parse_root_table(acpi_physical_address rsdp_address)
- table_entry = ACPI_ADD_PTR(u8, table, sizeof(struct acpi_table_header));
-
- /*
-- * First two entries in the table array are reserved for the DSDT
-- * and FACS, which are not actually present in the RSDT/XSDT - they
-- * come from the FADT
-+ * First three entries in the table array are reserved for the DSDT
-+ * and 32bit/64bit FACS, which are not actually present in the
-+ * RSDT/XSDT - they come from the FADT
- */
-- acpi_gbl_root_table_list.current_table_count = 2;
-+ acpi_gbl_root_table_list.current_table_count = 3;
-
- /* Initialize the root table array from the RSDT/XSDT */
-
-diff --git a/drivers/acpi/acpica/tbxfload.c b/drivers/acpi/acpica/tbxfload.c
-index aadb300..b63e35d 100644
---- a/drivers/acpi/acpica/tbxfload.c
-+++ b/drivers/acpi/acpica/tbxfload.c
-@@ -166,7 +166,8 @@ static acpi_status acpi_tb_load_namespace(void)
-
- (void)acpi_ut_acquire_mutex(ACPI_MTX_TABLES);
- for (i = 0; i < acpi_gbl_root_table_list.current_table_count; ++i) {
-- if ((!ACPI_COMPARE_NAME
-+ if (!acpi_gbl_root_table_list.tables[i].address ||
-+ (!ACPI_COMPARE_NAME
- (&(acpi_gbl_root_table_list.tables[i].signature),
- ACPI_SIG_SSDT)
- &&
-diff --git a/drivers/acpi/acpica/utxfinit.c b/drivers/acpi/acpica/utxfinit.c
-index 083a768..42a32a6 100644
---- a/drivers/acpi/acpica/utxfinit.c
-+++ b/drivers/acpi/acpica/utxfinit.c
-@@ -179,10 +179,12 @@ acpi_status __init acpi_enable_subsystem(u32 flags)
- * Obtain a permanent mapping for the FACS. This is required for the
- * Global Lock and the Firmware Waking Vector
- */
-- status = acpi_tb_initialize_facs();
-- if (ACPI_FAILURE(status)) {
-- ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-- return_ACPI_STATUS(status);
-+ if (!(flags & ACPI_NO_FACS_INIT)) {
-+ status = acpi_tb_initialize_facs();
-+ if (ACPI_FAILURE(status)) {
-+ ACPI_WARNING((AE_INFO, "Could not map the FACS table"));
-+ return_ACPI_STATUS(status);
-+ }
- }
- #endif /* !ACPI_REDUCED_HARDWARE */
-
-diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
-index 5226a8b..98f5316 100644
---- a/drivers/acpi/osl.c
-+++ b/drivers/acpi/osl.c
-@@ -175,10 +175,14 @@ static void __init acpi_request_region (struct acpi_generic_address *gas,
- if (!addr || !length)
- return;
-
-- acpi_reserve_region(addr, length, gas->space_id, 0, desc);
-+ /* Resources are never freed */
-+ if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO)
-+ request_region(addr, length, desc);
-+ else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
-+ request_mem_region(addr, length, desc);
- }
-
--static void __init acpi_reserve_resources(void)
-+static int __init acpi_reserve_resources(void)
- {
- acpi_request_region(&acpi_gbl_FADT.xpm1a_event_block, acpi_gbl_FADT.pm1_event_length,
- "ACPI PM1a_EVT_BLK");
-@@ -207,7 +211,10 @@ static void __init acpi_reserve_resources(void)
- if (!(acpi_gbl_FADT.gpe1_block_length & 0x1))
- acpi_request_region(&acpi_gbl_FADT.xgpe1_block,
- acpi_gbl_FADT.gpe1_block_length, "ACPI GPE1_BLK");
-+
-+ return 0;
- }
-+fs_initcall_sync(acpi_reserve_resources);
-
- void acpi_os_printf(const char *fmt, ...)
- {
-@@ -1838,7 +1845,6 @@ acpi_status __init acpi_os_initialize(void)
-
- acpi_status __init acpi_os_initialize1(void)
- {
-- acpi_reserve_resources();
- kacpid_wq = alloc_workqueue("kacpid", 0, 1);
- kacpi_notify_wq = alloc_workqueue("kacpi_notify", 0, 1);
- kacpi_hotplug_wq = alloc_ordered_workqueue("kacpi_hotplug", 0);
-diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
-index fcb7807..f1c966e 100644
---- a/drivers/acpi/resource.c
-+++ b/drivers/acpi/resource.c
-@@ -26,7 +26,6 @@
- #include <linux/device.h>
- #include <linux/export.h>
- #include <linux/ioport.h>
--#include <linux/list.h>
- #include <linux/slab.h>
-
- #ifdef CONFIG_X86
-@@ -194,6 +193,7 @@ static bool acpi_decode_space(struct resource_win *win,
- u8 iodec = attr->granularity == 0xfff ? ACPI_DECODE_10 : ACPI_DECODE_16;
- bool wp = addr->info.mem.write_protect;
- u64 len = attr->address_length;
-+ u64 start, end, offset = 0;
- struct resource *res = &win->res;
-
- /*
-@@ -205,9 +205,6 @@ static bool acpi_decode_space(struct resource_win *win,
- pr_debug("ACPI: Invalid address space min_addr_fix %d, max_addr_fix %d, len %llx\n",
- addr->min_address_fixed, addr->max_address_fixed, len);
-
-- res->start = attr->minimum;
-- res->end = attr->maximum;
--
- /*
- * For bridges that translate addresses across the bridge,
- * translation_offset is the offset that must be added to the
-@@ -215,12 +212,22 @@ static bool acpi_decode_space(struct resource_win *win,
- * primary side. Non-bridge devices must list 0 for all Address
- * Translation offset bits.
- */
-- if (addr->producer_consumer == ACPI_PRODUCER) {
-- res->start += attr->translation_offset;
-- res->end += attr->translation_offset;
-- } else if (attr->translation_offset) {
-+ if (addr->producer_consumer == ACPI_PRODUCER)
-+ offset = attr->translation_offset;
-+ else if (attr->translation_offset)
- pr_debug("ACPI: translation_offset(%lld) is invalid for non-bridge device.\n",
- attr->translation_offset);
-+ start = attr->minimum + offset;
-+ end = attr->maximum + offset;
-+
-+ win->offset = offset;
-+ res->start = start;
-+ res->end = end;
-+ if (sizeof(resource_size_t) < sizeof(u64) &&
-+ (offset != win->offset || start != res->start || end != res->end)) {
-+ pr_warn("acpi resource window ([%#llx-%#llx] ignored, not CPU addressable)\n",
-+ attr->minimum, attr->maximum);
-+ return false;
- }
-
- switch (addr->resource_type) {
-@@ -237,8 +244,6 @@ static bool acpi_decode_space(struct resource_win *win,
- return false;
- }
-
-- win->offset = attr->translation_offset;
--
- if (addr->producer_consumer == ACPI_PRODUCER)
- res->flags |= IORESOURCE_WINDOW;
-
-@@ -622,162 +627,3 @@ int acpi_dev_filter_resource_type(struct acpi_resource *ares,
- return (type & types) ? 0 : 1;
- }
- EXPORT_SYMBOL_GPL(acpi_dev_filter_resource_type);
--
--struct reserved_region {
-- struct list_head node;
-- u64 start;
-- u64 end;
--};
--
--static LIST_HEAD(reserved_io_regions);
--static LIST_HEAD(reserved_mem_regions);
--
--static int request_range(u64 start, u64 end, u8 space_id, unsigned long flags,
-- char *desc)
--{
-- unsigned int length = end - start + 1;
-- struct resource *res;
--
-- res = space_id == ACPI_ADR_SPACE_SYSTEM_IO ?
-- request_region(start, length, desc) :
-- request_mem_region(start, length, desc);
-- if (!res)
-- return -EIO;
--
-- res->flags &= ~flags;
-- return 0;
--}
--
--static int add_region_before(u64 start, u64 end, u8 space_id,
-- unsigned long flags, char *desc,
-- struct list_head *head)
--{
-- struct reserved_region *reg;
-- int error;
--
-- reg = kmalloc(sizeof(*reg), GFP_KERNEL);
-- if (!reg)
-- return -ENOMEM;
--
-- error = request_range(start, end, space_id, flags, desc);
-- if (error)
-- return error;
--
-- reg->start = start;
-- reg->end = end;
-- list_add_tail(®->node, head);
-- return 0;
--}
--
--/**
-- * acpi_reserve_region - Reserve an I/O or memory region as a system resource.
-- * @start: Starting address of the region.
-- * @length: Length of the region.
-- * @space_id: Identifier of address space to reserve the region from.
-- * @flags: Resource flags to clear for the region after requesting it.
-- * @desc: Region description (for messages).
-- *
-- * Reserve an I/O or memory region as a system resource to prevent others from
-- * using it. If the new region overlaps with one of the regions (in the given
-- * address space) already reserved by this routine, only the non-overlapping
-- * parts of it will be reserved.
-- *
-- * Returned is either 0 (success) or a negative error code indicating a resource
-- * reservation problem. It is the code of the first encountered error, but the
-- * routine doesn't abort until it has attempted to request all of the parts of
-- * the new region that don't overlap with other regions reserved previously.
-- *
-- * The resources requested by this routine are never released.
-- */
--int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
-- unsigned long flags, char *desc)
--{
-- struct list_head *regions;
-- struct reserved_region *reg;
-- u64 end = start + length - 1;
-- int ret = 0, error = 0;
--
-- if (space_id == ACPI_ADR_SPACE_SYSTEM_IO)
-- regions = &reserved_io_regions;
-- else if (space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY)
-- regions = &reserved_mem_regions;
-- else
-- return -EINVAL;
--
-- if (list_empty(regions))
-- return add_region_before(start, end, space_id, flags, desc, regions);
--
-- list_for_each_entry(reg, regions, node)
-- if (reg->start == end + 1) {
-- /* The new region can be prepended to this one. */
-- ret = request_range(start, end, space_id, flags, desc);
-- if (!ret)
-- reg->start = start;
--
-- return ret;
-- } else if (reg->start > end) {
-- /* No overlap. Add the new region here and get out. */
-- return add_region_before(start, end, space_id, flags,
-- desc, ®->node);
-- } else if (reg->end == start - 1) {
-- goto combine;
-- } else if (reg->end >= start) {
-- goto overlap;
-- }
--
-- /* The new region goes after the last existing one. */
-- return add_region_before(start, end, space_id, flags, desc, regions);
--
-- overlap:
-- /*
-- * The new region overlaps an existing one.
-- *
-- * The head part of the new region immediately preceding the existing
-- * overlapping one can be combined with it right away.
-- */
-- if (reg->start > start) {
-- error = request_range(start, reg->start - 1, space_id, flags, desc);
-- if (error)
-- ret = error;
-- else
-- reg->start = start;
-- }
--
-- combine:
-- /*
-- * The new region is adjacent to an existing one. If it extends beyond
-- * that region all the way to the next one, it is possible to combine
-- * all three of them.
-- */
-- while (reg->end < end) {
-- struct reserved_region *next = NULL;
-- u64 a = reg->end + 1, b = end;
--
-- if (!list_is_last(®->node, regions)) {
-- next = list_next_entry(reg, node);
-- if (next->start <= end)
-- b = next->start - 1;
-- }
-- error = request_range(a, b, space_id, flags, desc);
-- if (!error) {
-- if (next && next->start == b + 1) {
-- reg->end = next->end;
-- list_del(&next->node);
-- kfree(next);
-- } else {
-- reg->end = end;
-- break;
-- }
-- } else if (next) {
-- if (!ret)
-- ret = error;
--
-- reg = next;
-- } else {
-- break;
-- }
-- }
--
-- return ret ? ret : error;
--}
--EXPORT_SYMBOL_GPL(acpi_reserve_region);
-diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
-index 577849c..41c99be 100644
---- a/drivers/ata/libata-core.c
-+++ b/drivers/ata/libata-core.c
-@@ -2478,6 +2478,10 @@ int ata_dev_configure(struct ata_device *dev)
- dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_128,
- dev->max_sectors);
-
-+ if (dev->horkage & ATA_HORKAGE_MAX_SEC_1024)
-+ dev->max_sectors = min_t(unsigned int, ATA_MAX_SECTORS_1024,
-+ dev->max_sectors);
-+
- if (dev->horkage & ATA_HORKAGE_MAX_SEC_LBA48)
- dev->max_sectors = ATA_MAX_SECTORS_LBA48;
-
-@@ -4146,6 +4150,12 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
- { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
-
-+ /*
-+ * Causes silent data corruption with higher max sects.
-+ * http://lkml.kernel.org/g/x49wpy40ysk.fsf@segfault.boston.devel.redhat.com
-+ */
-+ { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 },
-+
- /* Devices we expect to fail diagnostics */
-
- /* Devices where NCQ should be avoided */
-@@ -4174,9 +4184,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "ST3320[68]13AS", "SD1[5-9]", ATA_HORKAGE_NONCQ |
- ATA_HORKAGE_FIRMWARE_WARN },
-
-- /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
-+ /* drives which fail FPDMA_AA activation (some may freeze afterwards) */
- { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
- { "ST1000LM024 HN-M101MBB", "2BA30001", ATA_HORKAGE_BROKEN_FPDMA_AA },
-+ { "VB0250EAVER", "HPG7", ATA_HORKAGE_BROKEN_FPDMA_AA },
-
- /* Blacklist entries taken from Silicon Image 3124/3132
- Windows driver .inf file - also several Linux problem reports */
-@@ -4225,11 +4236,11 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER },
-
- /* devices that don't properly handle queued TRIM commands */
-- { "Micron_M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
-+ { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
- ATA_HORKAGE_ZERO_AFTER_TRIM, },
- { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
- ATA_HORKAGE_ZERO_AFTER_TRIM, },
-- { "Micron_M5[15]0*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
-+ { "Micron_M5[15]0_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
- ATA_HORKAGE_ZERO_AFTER_TRIM, },
- { "Crucial_CT*M550*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM |
- ATA_HORKAGE_ZERO_AFTER_TRIM, },
-@@ -4238,6 +4249,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
- { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM |
- ATA_HORKAGE_ZERO_AFTER_TRIM, },
-
-+ /* devices that don't properly handle TRIM commands */
-+ { "SuperSSpeed S238*", NULL, ATA_HORKAGE_NOTRIM, },
-+
- /*
- * As defined, the DRAT (Deterministic Read After Trim) and RZAT
- * (Return Zero After Trim) flags in the ATA Command Set are
-@@ -4501,7 +4515,8 @@ static unsigned int ata_dev_set_xfermode(struct ata_device *dev)
- else /* In the ancient relic department - skip all of this */
- return 0;
-
-- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 0);
-+ /* On some disks, this command causes spin-up, so we need longer timeout */
-+ err_mask = ata_exec_internal(dev, &tf, NULL, DMA_NONE, NULL, 0, 15000);
-
- DPRINTK("EXIT, err_mask=%x\n", err_mask);
- return err_mask;
-diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
-index cf0022e..7465031 100644
---- a/drivers/ata/libata-eh.c
-+++ b/drivers/ata/libata-eh.c
-@@ -1507,16 +1507,21 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
- {
- struct ata_taskfile tf;
- unsigned int err_mask;
-+ bool dma = false;
-
- DPRINTK("read log page - log 0x%x, page 0x%x\n", log, page);
-
-+retry:
- ata_tf_init(dev, &tf);
-- if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id)) {
-+ if (dev->dma_mode && ata_id_has_read_log_dma_ext(dev->id) &&
-+ !(dev->horkage & ATA_HORKAGE_NO_NCQ_LOG)) {
- tf.command = ATA_CMD_READ_LOG_DMA_EXT;
- tf.protocol = ATA_PROT_DMA;
-+ dma = true;
- } else {
- tf.command = ATA_CMD_READ_LOG_EXT;
- tf.protocol = ATA_PROT_PIO;
-+ dma = false;
- }
- tf.lbal = log;
- tf.lbam = page;
-@@ -1527,6 +1532,12 @@ unsigned int ata_read_log_page(struct ata_device *dev, u8 log,
- err_mask = ata_exec_internal(dev, &tf, NULL, DMA_FROM_DEVICE,
- buf, sectors * ATA_SECT_SIZE, 0);
-
-+ if (err_mask && dma) {
-+ dev->horkage |= ATA_HORKAGE_NO_NCQ_LOG;
-+ ata_dev_warn(dev, "READ LOG DMA EXT failed, trying unqueued\n");
-+ goto retry;
-+ }
-+
- DPRINTK("EXIT, err_mask=%x\n", err_mask);
- return err_mask;
- }
-diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
-index 3131adc..641a61a 100644
---- a/drivers/ata/libata-scsi.c
-+++ b/drivers/ata/libata-scsi.c
-@@ -2568,7 +2568,8 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
- rbuf[14] = (lowest_aligned >> 8) & 0x3f;
- rbuf[15] = lowest_aligned;
-
-- if (ata_id_has_trim(args->id)) {
-+ if (ata_id_has_trim(args->id) &&
-+ !(dev->horkage & ATA_HORKAGE_NOTRIM)) {
- rbuf[14] |= 0x80; /* LBPME */
-
- if (ata_id_has_zero_after_trim(args->id) &&
-diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
-index 3227b7c..e2d9497 100644
---- a/drivers/ata/libata-transport.c
-+++ b/drivers/ata/libata-transport.c
-@@ -560,6 +560,29 @@ show_ata_dev_gscr(struct device *dev,
-
- static DEVICE_ATTR(gscr, S_IRUGO, show_ata_dev_gscr, NULL);
-
-+static ssize_t
-+show_ata_dev_trim(struct device *dev,
-+ struct device_attribute *attr, char *buf)
-+{
-+ struct ata_device *ata_dev = transport_class_to_dev(dev);
-+ unsigned char *mode;
-+
-+ if (!ata_id_has_trim(ata_dev->id))
-+ mode = "unsupported";
-+ else if (ata_dev->horkage & ATA_HORKAGE_NOTRIM)
-+ mode = "forced_unsupported";
-+ else if (ata_dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM)
-+ mode = "forced_unqueued";
-+ else if (ata_fpdma_dsm_supported(ata_dev))
-+ mode = "queued";
-+ else
-+ mode = "unqueued";
-+
-+ return snprintf(buf, 20, "%s\n", mode);
-+}
-+
-+static DEVICE_ATTR(trim, S_IRUGO, show_ata_dev_trim, NULL);
-+
- static DECLARE_TRANSPORT_CLASS(ata_dev_class,
- "ata_device", NULL, NULL, NULL);
-
-@@ -733,6 +756,7 @@ struct scsi_transport_template *ata_attach_transport(void)
- SETUP_DEV_ATTRIBUTE(ering);
- SETUP_DEV_ATTRIBUTE(id);
- SETUP_DEV_ATTRIBUTE(gscr);
-+ SETUP_DEV_ATTRIBUTE(trim);
- BUG_ON(count > ATA_DEV_ATTRS);
- i->dev_attrs[count] = NULL;
-
-diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
-index 171841a..4d1d9de 100644
---- a/drivers/base/firmware_class.c
-+++ b/drivers/base/firmware_class.c
-@@ -544,10 +544,8 @@ static void fw_dev_release(struct device *dev)
- kfree(fw_priv);
- }
-
--static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+static int do_firmware_uevent(struct firmware_priv *fw_priv, struct kobj_uevent_env *env)
- {
-- struct firmware_priv *fw_priv = to_firmware_priv(dev);
--
- if (add_uevent_var(env, "FIRMWARE=%s", fw_priv->buf->fw_id))
- return -ENOMEM;
- if (add_uevent_var(env, "TIMEOUT=%i", loading_timeout))
-@@ -558,6 +556,18 @@ static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
- return 0;
- }
-
-+static int firmware_uevent(struct device *dev, struct kobj_uevent_env *env)
-+{
-+ struct firmware_priv *fw_priv = to_firmware_priv(dev);
-+ int err = 0;
-+
-+ mutex_lock(&fw_lock);
-+ if (fw_priv->buf)
-+ err = do_firmware_uevent(fw_priv, env);
-+ mutex_unlock(&fw_lock);
-+ return err;
-+}
-+
- static struct class firmware_class = {
- .name = "firmware",
- .class_attrs = firmware_class_attrs,
-diff --git a/drivers/base/power/clock_ops.c b/drivers/base/power/clock_ops.c
-index 7fdd017..c7b0fce 100644
---- a/drivers/base/power/clock_ops.c
-+++ b/drivers/base/power/clock_ops.c
-@@ -93,7 +93,7 @@ static int __pm_clk_add(struct device *dev, const char *con_id,
- return -ENOMEM;
- }
- } else {
-- if (IS_ERR(ce->clk) || !__clk_get(clk)) {
-+ if (IS_ERR(clk) || !__clk_get(clk)) {
- kfree(ce);
- return -ENOENT;
- }
-diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index d7173cb..cef6fa8 100644
---- a/drivers/block/loop.c
-+++ b/drivers/block/loop.c
-@@ -86,8 +86,6 @@ static DEFINE_MUTEX(loop_index_mutex);
- static int max_part;
- static int part_shift;
-
--static struct workqueue_struct *loop_wq;
--
- static int transfer_xor(struct loop_device *lo, int cmd,
- struct page *raw_page, unsigned raw_off,
- struct page *loop_page, unsigned loop_off,
-@@ -725,6 +723,12 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
- size = get_loop_size(lo, file);
- if ((loff_t)(sector_t)size != size)
- goto out_putf;
-+ error = -ENOMEM;
-+ lo->wq = alloc_workqueue("kloopd%d",
-+ WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 16,
-+ lo->lo_number);
-+ if (!lo->wq)
-+ goto out_putf;
-
- error = 0;
-
-@@ -872,6 +876,8 @@ static int loop_clr_fd(struct loop_device *lo)
- lo->lo_flags = 0;
- if (!part_shift)
- lo->lo_disk->flags |= GENHD_FL_NO_PART_SCAN;
-+ destroy_workqueue(lo->wq);
-+ lo->wq = NULL;
- mutex_unlock(&lo->lo_ctl_mutex);
- /*
- * Need not hold lo_ctl_mutex to fput backing file.
-@@ -1425,9 +1431,13 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx,
- const struct blk_mq_queue_data *bd)
- {
- struct loop_cmd *cmd = blk_mq_rq_to_pdu(bd->rq);
-+ struct loop_device *lo = cmd->rq->q->queuedata;
-
- blk_mq_start_request(bd->rq);
-
-+ if (lo->lo_state != Lo_bound)
-+ return -EIO;
-+
- if (cmd->rq->cmd_flags & REQ_WRITE) {
- struct loop_device *lo = cmd->rq->q->queuedata;
- bool need_sched = true;
-@@ -1441,9 +1451,9 @@ static int loop_queue_rq(struct blk_mq_hw_ctx *hctx,
- spin_unlock_irq(&lo->lo_lock);
-
- if (need_sched)
-- queue_work(loop_wq, &lo->write_work);
-+ queue_work(lo->wq, &lo->write_work);
- } else {
-- queue_work(loop_wq, &cmd->read_work);
-+ queue_work(lo->wq, &cmd->read_work);
- }
-
- return BLK_MQ_RQ_QUEUE_OK;
-@@ -1455,9 +1465,6 @@ static void loop_handle_cmd(struct loop_cmd *cmd)
- struct loop_device *lo = cmd->rq->q->queuedata;
- int ret = -EIO;
-
-- if (lo->lo_state != Lo_bound)
-- goto failed;
--
- if (write && (lo->lo_flags & LO_FLAGS_READ_ONLY))
- goto failed;
-
-@@ -1806,13 +1813,6 @@ static int __init loop_init(void)
- goto misc_out;
- }
-
-- loop_wq = alloc_workqueue("kloopd",
-- WQ_MEM_RECLAIM | WQ_HIGHPRI | WQ_UNBOUND, 0);
-- if (!loop_wq) {
-- err = -ENOMEM;
-- goto misc_out;
-- }
--
- blk_register_region(MKDEV(LOOP_MAJOR, 0), range,
- THIS_MODULE, loop_probe, NULL, NULL);
-
-@@ -1850,8 +1850,6 @@ static void __exit loop_exit(void)
- blk_unregister_region(MKDEV(LOOP_MAJOR, 0), range);
- unregister_blkdev(LOOP_MAJOR, "loop");
-
-- destroy_workqueue(loop_wq);
--
- misc_deregister(&loop_misc);
- }
-
-diff --git a/drivers/block/loop.h b/drivers/block/loop.h
-index 301c27f..49564ed 100644
---- a/drivers/block/loop.h
-+++ b/drivers/block/loop.h
-@@ -54,6 +54,7 @@ struct loop_device {
- gfp_t old_gfp_mask;
-
- spinlock_t lo_lock;
-+ struct workqueue_struct *wq;
- struct list_head write_cmd_head;
- struct work_struct write_work;
- bool write_started;
-diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index ec6c5c6..53f2535 100644
---- a/drivers/block/rbd.c
-+++ b/drivers/block/rbd.c
-@@ -2001,11 +2001,11 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
- rbd_assert(obj_request_type_valid(type));
-
- size = strlen(object_name) + 1;
-- name = kmalloc(size, GFP_KERNEL);
-+ name = kmalloc(size, GFP_NOIO);
- if (!name)
- return NULL;
-
-- obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
-+ obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_NOIO);
- if (!obj_request) {
- kfree(name);
- return NULL;
-diff --git a/drivers/bluetooth/btbcm.c b/drivers/bluetooth/btbcm.c
-index 4bba866..3f146c9 100644
---- a/drivers/bluetooth/btbcm.c
-+++ b/drivers/bluetooth/btbcm.c
-@@ -378,12 +378,11 @@ int btbcm_setup_apple(struct hci_dev *hdev)
-
- /* Read Verbose Config Version Info */
- skb = btbcm_read_verbose_config(hdev);
-- if (IS_ERR(skb))
-- return PTR_ERR(skb);
--
-- BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
-- get_unaligned_le16(skb->data + 5));
-- kfree_skb(skb);
-+ if (!IS_ERR(skb)) {
-+ BT_INFO("%s: BCM: chip id %u build %4.4u", hdev->name, skb->data[1],
-+ get_unaligned_le16(skb->data + 5));
-+ kfree_skb(skb);
-+ }
-
- set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
-
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 420cc9f..c655015 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -268,7 +268,7 @@ static const struct usb_device_id blacklist_table[] = {
- { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
-
- /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
-- { USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE },
-+ { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
-
- /* Digianswer devices */
- { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
-@@ -1993,6 +1993,8 @@ static int btusb_setup_intel(struct hci_dev *hdev)
- }
- fw_ptr = fw->data;
-
-+ kfree_skb(skb);
-+
- /* This Intel specific command enables the manufacturer mode of the
- * controller.
- *
-@@ -2334,6 +2336,7 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
- struct intel_boot_params *params;
- const struct firmware *fw;
- const u8 *fw_ptr;
-+ u32 frag_len;
- char fwname[64];
- ktime_t calltime, delta, rettime;
- unsigned long long duration;
-@@ -2540,24 +2543,33 @@ static int btusb_setup_intel_new(struct hci_dev *hdev)
- }
-
- fw_ptr = fw->data + 644;
-+ frag_len = 0;
-
- while (fw_ptr - fw->data < fw->size) {
-- struct hci_command_hdr *cmd = (void *)fw_ptr;
-- u8 cmd_len;
-+ struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
-
-- cmd_len = sizeof(*cmd) + cmd->plen;
-+ frag_len += sizeof(*cmd) + cmd->plen;
-
-- /* Send each command from the firmware data buffer as
-- * a single Data fragment.
-+ /* The paramter length of the secure send command requires
-+ * a 4 byte alignment. It happens so that the firmware file
-+ * contains proper Intel_NOP commands to align the fragments
-+ * as needed.
-+ *
-+ * Send set of commands with 4 byte alignment from the
-+ * firmware data buffer as a single Data fragement.
- */
-- err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr);
-- if (err < 0) {
-- BT_ERR("%s: Failed to send firmware data (%d)",
-- hdev->name, err);
-- goto done;
-- }
-+ if (!(frag_len % 4)) {
-+ err = btusb_intel_secure_send(hdev, 0x01, frag_len,
-+ fw_ptr);
-+ if (err < 0) {
-+ BT_ERR("%s: Failed to send firmware data (%d)",
-+ hdev->name, err);
-+ goto done;
-+ }
-
-- fw_ptr += cmd_len;
-+ fw_ptr += frag_len;
-+ frag_len = 0;
-+ }
- }
-
- set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
-diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c
-index aaa0f2a..60397ec 100644
---- a/drivers/bus/arm-ccn.c
-+++ b/drivers/bus/arm-ccn.c
-@@ -212,7 +212,7 @@ static int arm_ccn_node_to_xp_port(int node)
-
- static void arm_ccn_pmu_config_set(u64 *config, u32 node_xp, u32 type, u32 port)
- {
-- *config &= ~((0xff << 0) | (0xff << 8) | (0xff << 24));
-+ *config &= ~((0xff << 0) | (0xff << 8) | (0x3 << 24));
- *config |= (node_xp << 0) | (type << 8) | (port << 24);
- }
-
-diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
-index 0b4188b..c6dea3f 100644
---- a/drivers/char/agp/intel-gtt.c
-+++ b/drivers/char/agp/intel-gtt.c
-@@ -581,7 +581,7 @@ static inline int needs_ilk_vtd_wa(void)
- /* Query intel_iommu to see if we need the workaround. Presumably that
- * was loaded first.
- */
-- if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB ||
-+ if ((gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG ||
- gpu_devid == PCI_DEVICE_ID_INTEL_IRONLAKE_M_IG) &&
- intel_iommu_gfx_mapped)
- return 1;
-diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
-index 283f00a..1082d4b 100644
---- a/drivers/char/tpm/tpm-chip.c
-+++ b/drivers/char/tpm/tpm-chip.c
-@@ -129,8 +129,9 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev,
-
- device_initialize(&chip->dev);
-
-- chip->cdev.owner = chip->pdev->driver->owner;
- cdev_init(&chip->cdev, &tpm_fops);
-+ chip->cdev.owner = chip->pdev->driver->owner;
-+ chip->cdev.kobj.parent = &chip->dev.kobj;
-
- return chip;
- }
-diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
-index b26ceee..1267322 100644
---- a/drivers/char/tpm/tpm_crb.c
-+++ b/drivers/char/tpm/tpm_crb.c
-@@ -233,6 +233,14 @@ static int crb_acpi_add(struct acpi_device *device)
- return -ENODEV;
- }
-
-+ /* At least some versions of AMI BIOS have a bug that TPM2 table has
-+ * zero address for the control area and therefore we must fail.
-+ */
-+ if (!buf->control_area_pa) {
-+ dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
-+ return -EINVAL;
-+ }
-+
- if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
- dev_err(dev, "TPM2 ACPI table has wrong size");
- return -EINVAL;
-@@ -267,7 +275,7 @@ static int crb_acpi_add(struct acpi_device *device)
-
- memcpy_fromio(&pa, &priv->cca->cmd_pa, 8);
- pa = le64_to_cpu(pa);
-- priv->cmd = devm_ioremap_nocache(dev, le64_to_cpu(pa),
-+ priv->cmd = devm_ioremap_nocache(dev, pa,
- ioread32(&priv->cca->cmd_size));
- if (!priv->cmd) {
- dev_err(dev, "ioremap of the command buffer failed\n");
-@@ -276,7 +284,7 @@ static int crb_acpi_add(struct acpi_device *device)
-
- memcpy_fromio(&pa, &priv->cca->rsp_pa, 8);
- pa = le64_to_cpu(pa);
-- priv->rsp = devm_ioremap_nocache(dev, le64_to_cpu(pa),
-+ priv->rsp = devm_ioremap_nocache(dev, pa,
- ioread32(&priv->cca->rsp_size));
- if (!priv->rsp) {
- dev_err(dev, "ioremap of the response buffer failed\n");
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index 42ffa5e..27ebf95 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -578,6 +578,9 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
- goto cleanup;
- }
-
-+ ibmvtpm->dev = dev;
-+ ibmvtpm->vdev = vio_dev;
-+
- crq_q = &ibmvtpm->crq_queue;
- crq_q->crq_addr = (struct ibmvtpm_crq *)get_zeroed_page(GFP_KERNEL);
- if (!crq_q->crq_addr) {
-@@ -622,8 +625,6 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
-
- crq_q->index = 0;
-
-- ibmvtpm->dev = dev;
-- ibmvtpm->vdev = vio_dev;
- TPM_VPRIV(chip) = (void *)ibmvtpm;
-
- spin_lock_init(&ibmvtpm->rtce_lock);
-diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c
-index 5b0f418..9f9cadd 100644
---- a/drivers/clk/clk.c
-+++ b/drivers/clk/clk.c
-@@ -230,11 +230,12 @@ static void clk_dump_one(struct seq_file *s, struct clk_core *c, int level)
- if (!c)
- return;
-
-+ /* This should be JSON format, i.e. elements separated with a comma */
- seq_printf(s, "\"%s\": { ", c->name);
- seq_printf(s, "\"enable_count\": %d,", c->enable_count);
- seq_printf(s, "\"prepare_count\": %d,", c->prepare_count);
-- seq_printf(s, "\"rate\": %lu", clk_core_get_rate(c));
-- seq_printf(s, "\"accuracy\": %lu", clk_core_get_accuracy(c));
-+ seq_printf(s, "\"rate\": %lu,", clk_core_get_rate(c));
-+ seq_printf(s, "\"accuracy\": %lu,", clk_core_get_accuracy(c));
- seq_printf(s, "\"phase\": %d", clk_core_get_phase(c));
- }
-
-diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c
-index b95d17f..92936f0 100644
---- a/drivers/clk/qcom/clk-rcg2.c
-+++ b/drivers/clk/qcom/clk-rcg2.c
-@@ -530,19 +530,16 @@ static int clk_pixel_set_rate(struct clk_hw *hw, unsigned long rate,
- struct clk_rcg2 *rcg = to_clk_rcg2(hw);
- struct freq_tbl f = *rcg->freq_tbl;
- const struct frac_entry *frac = frac_table_pixel;
-- unsigned long request, src_rate;
-+ unsigned long request;
- int delta = 100000;
- u32 mask = BIT(rcg->hid_width) - 1;
- u32 hid_div;
-- int index = qcom_find_src_index(hw, rcg->parent_map, f.src);
-- struct clk *parent = clk_get_parent_by_index(hw->clk, index);
-
- for (; frac->num; frac++) {
- request = (rate * frac->den) / frac->num;
-
-- src_rate = __clk_round_rate(parent, request);
-- if ((src_rate < (request - delta)) ||
-- (src_rate > (request + delta)))
-+ if ((parent_rate < (request - delta)) ||
-+ (parent_rate > (request + delta)))
- continue;
-
- regmap_read(rcg->clkr.regmap, rcg->cmd_rcgr + CFG_REG,
-diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c
-index d86bc46..0a1df82 100644
---- a/drivers/clk/ti/clk-dra7-atl.c
-+++ b/drivers/clk/ti/clk-dra7-atl.c
-@@ -252,6 +252,11 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
- }
-
- clk = of_clk_get_from_provider(&clkspec);
-+ if (IS_ERR(clk)) {
-+ pr_err("%s: failed to get atl clock %d from provider\n",
-+ __func__, i);
-+ return PTR_ERR(clk);
-+ }
-
- cdesc = to_atl_desc(__clk_get_hw(clk));
- cdesc->cinfo = cinfo;
-diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
-index 83564c9..c844616 100644
---- a/drivers/clocksource/exynos_mct.c
-+++ b/drivers/clocksource/exynos_mct.c
-@@ -466,15 +466,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- exynos4_mct_write(TICK_BASE_CNT, mevt->base + MCT_L_TCNTB_OFFSET);
-
- if (mct_int_type == MCT_INT_SPI) {
-- evt->irq = mct_irqs[MCT_L0_IRQ + cpu];
-- if (request_irq(evt->irq, exynos4_mct_tick_isr,
-- IRQF_TIMER | IRQF_NOBALANCING,
-- evt->name, mevt)) {
-- pr_err("exynos-mct: cannot register IRQ %d\n",
-- evt->irq);
-+
-+ if (evt->irq == -1)
- return -EIO;
-- }
-- irq_force_affinity(mct_irqs[MCT_L0_IRQ + cpu], cpumask_of(cpu));
-+
-+ irq_force_affinity(evt->irq, cpumask_of(cpu));
-+ enable_irq(evt->irq);
- } else {
- enable_percpu_irq(mct_irqs[MCT_L0_IRQ], 0);
- }
-@@ -487,10 +484,12 @@ static int exynos4_local_timer_setup(struct clock_event_device *evt)
- static void exynos4_local_timer_stop(struct clock_event_device *evt)
- {
- evt->set_mode(CLOCK_EVT_MODE_UNUSED, evt);
-- if (mct_int_type == MCT_INT_SPI)
-- free_irq(evt->irq, this_cpu_ptr(&percpu_mct_tick));
-- else
-+ if (mct_int_type == MCT_INT_SPI) {
-+ if (evt->irq != -1)
-+ disable_irq_nosync(evt->irq);
-+ } else {
- disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
-+ }
- }
-
- static int exynos4_mct_cpu_notify(struct notifier_block *self,
-@@ -522,7 +521,7 @@ static struct notifier_block exynos4_mct_cpu_nb = {
-
- static void __init exynos4_timer_resources(struct device_node *np, void __iomem *base)
- {
-- int err;
-+ int err, cpu;
- struct mct_clock_event_device *mevt = this_cpu_ptr(&percpu_mct_tick);
- struct clk *mct_clk, *tick_clk;
-
-@@ -549,7 +548,25 @@ static void __init exynos4_timer_resources(struct device_node *np, void __iomem
- WARN(err, "MCT: can't request IRQ %d (%d)\n",
- mct_irqs[MCT_L0_IRQ], err);
- } else {
-- irq_set_affinity(mct_irqs[MCT_L0_IRQ], cpumask_of(0));
-+ for_each_possible_cpu(cpu) {
-+ int mct_irq = mct_irqs[MCT_L0_IRQ + cpu];
-+ struct mct_clock_event_device *pcpu_mevt =
-+ per_cpu_ptr(&percpu_mct_tick, cpu);
-+
-+ pcpu_mevt->evt.irq = -1;
-+
-+ irq_set_status_flags(mct_irq, IRQ_NOAUTOEN);
-+ if (request_irq(mct_irq,
-+ exynos4_mct_tick_isr,
-+ IRQF_TIMER | IRQF_NOBALANCING,
-+ pcpu_mevt->name, pcpu_mevt)) {
-+ pr_err("exynos-mct: cannot register IRQ (cpu%d)\n",
-+ cpu);
-+
-+ continue;
-+ }
-+ pcpu_mevt->evt.irq = mct_irq;
-+ }
- }
-
- err = register_cpu_notifier(&exynos4_mct_cpu_nb);
-diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
-index 1c56001..50f1b42 100644
---- a/drivers/dma/mv_xor.c
-+++ b/drivers/dma/mv_xor.c
-@@ -273,7 +273,8 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
- dma_cookie_t cookie = 0;
- int busy = mv_chan_is_busy(mv_chan);
- u32 current_desc = mv_chan_get_current_desc(mv_chan);
-- int seen_current = 0;
-+ int current_cleaned = 0;
-+ struct mv_xor_desc *hw_desc;
-
- dev_dbg(mv_chan_to_devp(mv_chan), "%s %d\n", __func__, __LINE__);
- dev_dbg(mv_chan_to_devp(mv_chan), "current_desc %x\n", current_desc);
-@@ -285,38 +286,57 @@ static void mv_xor_slot_cleanup(struct mv_xor_chan *mv_chan)
-
- list_for_each_entry_safe(iter, _iter, &mv_chan->chain,
- chain_node) {
-- prefetch(_iter);
-- prefetch(&_iter->async_tx);
-
-- /* do not advance past the current descriptor loaded into the
-- * hardware channel, subsequent descriptors are either in
-- * process or have not been submitted
-- */
-- if (seen_current)
-- break;
-+ /* clean finished descriptors */
-+ hw_desc = iter->hw_desc;
-+ if (hw_desc->status & XOR_DESC_SUCCESS) {
-+ cookie = mv_xor_run_tx_complete_actions(iter, mv_chan,
-+ cookie);
-
-- /* stop the search if we reach the current descriptor and the
-- * channel is busy
-- */
-- if (iter->async_tx.phys == current_desc) {
-- seen_current = 1;
-- if (busy)
-+ /* done processing desc, clean slot */
-+ mv_xor_clean_slot(iter, mv_chan);
-+
-+ /* break if we did cleaned the current */
-+ if (iter->async_tx.phys == current_desc) {
-+ current_cleaned = 1;
-+ break;
-+ }
-+ } else {
-+ if (iter->async_tx.phys == current_desc) {
-+ current_cleaned = 0;
- break;
-+ }
- }
--
-- cookie = mv_xor_run_tx_complete_actions(iter, mv_chan, cookie);
--
-- if (mv_xor_clean_slot(iter, mv_chan))
-- break;
- }
-
- if ((busy == 0) && !list_empty(&mv_chan->chain)) {
-- struct mv_xor_desc_slot *chain_head;
-- chain_head = list_entry(mv_chan->chain.next,
-- struct mv_xor_desc_slot,
-- chain_node);
--
-- mv_xor_start_new_chain(mv_chan, chain_head);
-+ if (current_cleaned) {
-+ /*
-+ * current descriptor cleaned and removed, run
-+ * from list head
-+ */
-+ iter = list_entry(mv_chan->chain.next,
-+ struct mv_xor_desc_slot,
-+ chain_node);
-+ mv_xor_start_new_chain(mv_chan, iter);
-+ } else {
-+ if (!list_is_last(&iter->chain_node, &mv_chan->chain)) {
-+ /*
-+ * descriptors are still waiting after
-+ * current, trigger them
-+ */
-+ iter = list_entry(iter->chain_node.next,
-+ struct mv_xor_desc_slot,
-+ chain_node);
-+ mv_xor_start_new_chain(mv_chan, iter);
-+ } else {
-+ /*
-+ * some descriptors are still waiting
-+ * to be cleaned
-+ */
-+ tasklet_schedule(&mv_chan->irq_tasklet);
-+ }
-+ }
- }
-
- if (cookie > 0)
-diff --git a/drivers/dma/mv_xor.h b/drivers/dma/mv_xor.h
-index 91958db..0e302b3 100644
---- a/drivers/dma/mv_xor.h
-+++ b/drivers/dma/mv_xor.h
-@@ -31,6 +31,7 @@
- #define XOR_OPERATION_MODE_XOR 0
- #define XOR_OPERATION_MODE_MEMCPY 2
- #define XOR_DESCRIPTOR_SWAP BIT(14)
-+#define XOR_DESC_SUCCESS 0x40000000
-
- #define XOR_DESC_DMA_OWNED BIT(31)
- #define XOR_DESC_EOD_INT_EN BIT(31)
-diff --git a/drivers/edac/octeon_edac-l2c.c b/drivers/edac/octeon_edac-l2c.c
-index 7e98084..afea7fc 100644
---- a/drivers/edac/octeon_edac-l2c.c
-+++ b/drivers/edac/octeon_edac-l2c.c
-@@ -151,7 +151,7 @@ static int octeon_l2c_probe(struct platform_device *pdev)
- l2c->ctl_name = "octeon_l2c_err";
-
-
-- if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) {
-+ if (OCTEON_IS_OCTEON1PLUS()) {
- union cvmx_l2t_err l2t_err;
- union cvmx_l2d_err l2d_err;
-
-diff --git a/drivers/edac/octeon_edac-lmc.c b/drivers/edac/octeon_edac-lmc.c
-index bb19e07..cda6dab 100644
---- a/drivers/edac/octeon_edac-lmc.c
-+++ b/drivers/edac/octeon_edac-lmc.c
-@@ -234,7 +234,7 @@ static int octeon_lmc_edac_probe(struct platform_device *pdev)
- layers[0].size = 1;
- layers[0].is_virt_csrow = false;
-
-- if (OCTEON_IS_MODEL(OCTEON_FAM_1_PLUS)) {
-+ if (OCTEON_IS_OCTEON1PLUS()) {
- union cvmx_lmcx_mem_cfg0 cfg0;
-
- cfg0.u64 = cvmx_read_csr(CVMX_LMCX_MEM_CFG0(0));
-diff --git a/drivers/edac/octeon_edac-pc.c b/drivers/edac/octeon_edac-pc.c
-index 0f83c33..2ab6cf2 100644
---- a/drivers/edac/octeon_edac-pc.c
-+++ b/drivers/edac/octeon_edac-pc.c
-@@ -73,7 +73,7 @@ static int co_cache_error_event(struct notifier_block *this,
- edac_device_handle_ce(p->ed, cpu, 0, "dcache");
-
- /* Clear the error indication */
-- if (OCTEON_IS_MODEL(OCTEON_FAM_2))
-+ if (OCTEON_IS_OCTEON2())
- write_octeon_c0_dcacheerr(1);
- else
- write_octeon_c0_dcacheerr(0);
-diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
-index 97b1616..bba843c 100644
---- a/drivers/firmware/dmi_scan.c
-+++ b/drivers/firmware/dmi_scan.c
-@@ -89,9 +89,9 @@ static void dmi_table(u8 *buf,
-
- /*
- * Stop when we have seen all the items the table claimed to have
-- * (SMBIOS < 3.0 only) OR we reach an end-of-table marker OR we run
-- * off the end of the table (should never happen but sometimes does
-- * on bogus implementations.)
-+ * (SMBIOS < 3.0 only) OR we reach an end-of-table marker (SMBIOS
-+ * >= 3.0 only) OR we run off the end of the table (should never
-+ * happen but sometimes does on bogus implementations.)
- */
- while ((!dmi_num || i < dmi_num) &&
- (data - buf + sizeof(struct dmi_header)) <= dmi_len) {
-@@ -110,8 +110,13 @@ static void dmi_table(u8 *buf,
-
- /*
- * 7.45 End-of-Table (Type 127) [SMBIOS reference spec v3.0.0]
-+ * For tables behind a 64-bit entry point, we have no item
-+ * count and no exact table length, so stop on end-of-table
-+ * marker. For tables behind a 32-bit entry point, we have
-+ * seen OEM structures behind the end-of-table marker on
-+ * some systems, so don't trust it.
- */
-- if (dm->type == DMI_ENTRY_END_OF_TABLE)
-+ if (!dmi_num && dm->type == DMI_ENTRY_END_OF_TABLE)
- break;
-
- data += 2;
-diff --git a/drivers/gpu/drm/bridge/ptn3460.c b/drivers/gpu/drm/bridge/ptn3460.c
-index 9d2f053..63a09e4 100644
---- a/drivers/gpu/drm/bridge/ptn3460.c
-+++ b/drivers/gpu/drm/bridge/ptn3460.c
-@@ -15,6 +15,7 @@
-
- #include <linux/delay.h>
- #include <linux/gpio.h>
-+#include <linux/gpio/consumer.h>
- #include <linux/i2c.h>
- #include <linux/module.h>
- #include <linux/of.h>
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 3007b44..800a025 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -2749,8 +2749,11 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
- if (!drm_core_check_feature(dev, DRIVER_MODESET))
- return -EINVAL;
-
-- /* For some reason crtc x/y offsets are signed internally. */
-- if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
-+ /*
-+ * Universal plane src offsets are only 16.16, prevent havoc for
-+ * drivers using universal plane code internally.
-+ */
-+ if (crtc_req->x & 0xffff0000 || crtc_req->y & 0xffff0000)
- return -ERANGE;
-
- drm_modeset_lock_all(dev);
-@@ -5048,12 +5051,9 @@ void drm_mode_config_reset(struct drm_device *dev)
- if (encoder->funcs->reset)
- encoder->funcs->reset(encoder);
-
-- list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-- connector->status = connector_status_unknown;
--
-+ list_for_each_entry(connector, &dev->mode_config.connector_list, head)
- if (connector->funcs->reset)
- connector->funcs->reset(connector);
-- }
- }
- EXPORT_SYMBOL(drm_mode_config_reset);
-
-diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
-index 132581c..778bbb6 100644
---- a/drivers/gpu/drm/drm_dp_mst_topology.c
-+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
-@@ -867,8 +867,16 @@ static void drm_dp_destroy_port(struct kref *kref)
- port->vcpi.num_slots = 0;
-
- kfree(port->cached_edid);
-- if (port->connector)
-- (*port->mgr->cbs->destroy_connector)(mgr, port->connector);
-+
-+ /* we can't destroy the connector here, as
-+ we might be holding the mode_config.mutex
-+ from an EDID retrieval */
-+ if (port->connector) {
-+ mutex_lock(&mgr->destroy_connector_lock);
-+ list_add(&port->connector->destroy_list, &mgr->destroy_connector_list);
-+ mutex_unlock(&mgr->destroy_connector_lock);
-+ schedule_work(&mgr->destroy_connector_work);
-+ }
- drm_dp_port_teardown_pdt(port, port->pdt);
-
- if (!port->input && port->vcpi.vcpi > 0)
-@@ -1163,6 +1171,8 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
- struct drm_dp_mst_port *port;
- int i;
- /* find the port by iterating down */
-+
-+ mutex_lock(&mgr->lock);
- mstb = mgr->mst_primary;
-
- for (i = 0; i < lct - 1; i++) {
-@@ -1182,6 +1192,7 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_
- }
- }
- kref_get(&mstb->kref);
-+ mutex_unlock(&mgr->lock);
- return mstb;
- }
-
-@@ -1189,7 +1200,7 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
- struct drm_dp_mst_branch *mstb)
- {
- struct drm_dp_mst_port *port;
--
-+ struct drm_dp_mst_branch *mstb_child;
- if (!mstb->link_address_sent) {
- drm_dp_send_link_address(mgr, mstb);
- mstb->link_address_sent = true;
-@@ -1204,17 +1215,31 @@ static void drm_dp_check_and_send_link_address(struct drm_dp_mst_topology_mgr *m
- if (!port->available_pbn)
- drm_dp_send_enum_path_resources(mgr, mstb, port);
-
-- if (port->mstb)
-- drm_dp_check_and_send_link_address(mgr, port->mstb);
-+ if (port->mstb) {
-+ mstb_child = drm_dp_get_validated_mstb_ref(mgr, port->mstb);
-+ if (mstb_child) {
-+ drm_dp_check_and_send_link_address(mgr, mstb_child);
-+ drm_dp_put_mst_branch_device(mstb_child);
-+ }
-+ }
- }
- }
-
- static void drm_dp_mst_link_probe_work(struct work_struct *work)
- {
- struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, work);
-+ struct drm_dp_mst_branch *mstb;
-
-- drm_dp_check_and_send_link_address(mgr, mgr->mst_primary);
--
-+ mutex_lock(&mgr->lock);
-+ mstb = mgr->mst_primary;
-+ if (mstb) {
-+ kref_get(&mstb->kref);
-+ }
-+ mutex_unlock(&mgr->lock);
-+ if (mstb) {
-+ drm_dp_check_and_send_link_address(mgr, mstb);
-+ drm_dp_put_mst_branch_device(mstb);
-+ }
- }
-
- static bool drm_dp_validate_guid(struct drm_dp_mst_topology_mgr *mgr,
-@@ -2632,6 +2657,30 @@ static void drm_dp_tx_work(struct work_struct *work)
- mutex_unlock(&mgr->qlock);
- }
-
-+static void drm_dp_destroy_connector_work(struct work_struct *work)
-+{
-+ struct drm_dp_mst_topology_mgr *mgr = container_of(work, struct drm_dp_mst_topology_mgr, destroy_connector_work);
-+ struct drm_connector *connector;
-+
-+ /*
-+ * Not a regular list traverse as we have to drop the destroy
-+ * connector lock before destroying the connector, to avoid AB->BA
-+ * ordering between this lock and the config mutex.
-+ */
-+ for (;;) {
-+ mutex_lock(&mgr->destroy_connector_lock);
-+ connector = list_first_entry_or_null(&mgr->destroy_connector_list, struct drm_connector, destroy_list);
-+ if (!connector) {
-+ mutex_unlock(&mgr->destroy_connector_lock);
-+ break;
-+ }
-+ list_del(&connector->destroy_list);
-+ mutex_unlock(&mgr->destroy_connector_lock);
-+
-+ mgr->cbs->destroy_connector(mgr, connector);
-+ }
-+}
-+
- /**
- * drm_dp_mst_topology_mgr_init - initialise a topology manager
- * @mgr: manager struct to initialise
-@@ -2651,10 +2700,13 @@ int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr,
- mutex_init(&mgr->lock);
- mutex_init(&mgr->qlock);
- mutex_init(&mgr->payload_lock);
-+ mutex_init(&mgr->destroy_connector_lock);
- INIT_LIST_HEAD(&mgr->tx_msg_upq);
- INIT_LIST_HEAD(&mgr->tx_msg_downq);
-+ INIT_LIST_HEAD(&mgr->destroy_connector_list);
- INIT_WORK(&mgr->work, drm_dp_mst_link_probe_work);
- INIT_WORK(&mgr->tx_work, drm_dp_tx_work);
-+ INIT_WORK(&mgr->destroy_connector_work, drm_dp_destroy_connector_work);
- init_waitqueue_head(&mgr->tx_waitq);
- mgr->dev = dev;
- mgr->aux = aux;
-@@ -2679,6 +2731,7 @@ EXPORT_SYMBOL(drm_dp_mst_topology_mgr_init);
- */
- void drm_dp_mst_topology_mgr_destroy(struct drm_dp_mst_topology_mgr *mgr)
- {
-+ flush_work(&mgr->destroy_connector_work);
- mutex_lock(&mgr->payload_lock);
- kfree(mgr->payloads);
- mgr->payloads = NULL;
-diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index aa8bbb4..9cfcd0a 100644
---- a/drivers/gpu/drm/drm_ioc32.c
-+++ b/drivers/gpu/drm/drm_ioc32.c
-@@ -70,6 +70,8 @@
-
- #define DRM_IOCTL_WAIT_VBLANK32 DRM_IOWR(0x3a, drm_wait_vblank32_t)
-
-+#define DRM_IOCTL_MODE_ADDFB232 DRM_IOWR(0xb8, drm_mode_fb_cmd232_t)
-+
- typedef struct drm_version_32 {
- int version_major; /**< Major version */
- int version_minor; /**< Minor version */
-@@ -1016,6 +1018,63 @@ static int compat_drm_wait_vblank(struct file *file, unsigned int cmd,
- return 0;
- }
-
-+typedef struct drm_mode_fb_cmd232 {
-+ u32 fb_id;
-+ u32 width;
-+ u32 height;
-+ u32 pixel_format;
-+ u32 flags;
-+ u32 handles[4];
-+ u32 pitches[4];
-+ u32 offsets[4];
-+ u64 modifier[4];
-+} __attribute__((packed)) drm_mode_fb_cmd232_t;
-+
-+static int compat_drm_mode_addfb2(struct file *file, unsigned int cmd,
-+ unsigned long arg)
-+{
-+ struct drm_mode_fb_cmd232 __user *argp = (void __user *)arg;
-+ struct drm_mode_fb_cmd232 req32;
-+ struct drm_mode_fb_cmd2 __user *req64;
-+ int i;
-+ int err;
-+
-+ if (copy_from_user(&req32, argp, sizeof(req32)))
-+ return -EFAULT;
-+
-+ req64 = compat_alloc_user_space(sizeof(*req64));
-+
-+ if (!access_ok(VERIFY_WRITE, req64, sizeof(*req64))
-+ || __put_user(req32.width, &req64->width)
-+ || __put_user(req32.height, &req64->height)
-+ || __put_user(req32.pixel_format, &req64->pixel_format)
-+ || __put_user(req32.flags, &req64->flags))
-+ return -EFAULT;
-+
-+ for (i = 0; i < 4; i++) {
-+ if (__put_user(req32.handles[i], &req64->handles[i]))
-+ return -EFAULT;
-+ if (__put_user(req32.pitches[i], &req64->pitches[i]))
-+ return -EFAULT;
-+ if (__put_user(req32.offsets[i], &req64->offsets[i]))
-+ return -EFAULT;
-+ if (__put_user(req32.modifier[i], &req64->modifier[i]))
-+ return -EFAULT;
-+ }
-+
-+ err = drm_ioctl(file, DRM_IOCTL_MODE_ADDFB2, (unsigned long)req64);
-+ if (err)
-+ return err;
-+
-+ if (__get_user(req32.fb_id, &req64->fb_id))
-+ return -EFAULT;
-+
-+ if (copy_to_user(argp, &req32, sizeof(req32)))
-+ return -EFAULT;
-+
-+ return 0;
-+}
-+
- static drm_ioctl_compat_t *drm_compat_ioctls[] = {
- [DRM_IOCTL_NR(DRM_IOCTL_VERSION32)] = compat_drm_version,
- [DRM_IOCTL_NR(DRM_IOCTL_GET_UNIQUE32)] = compat_drm_getunique,
-@@ -1048,6 +1107,7 @@ static drm_ioctl_compat_t *drm_compat_ioctls[] = {
- [DRM_IOCTL_NR(DRM_IOCTL_UPDATE_DRAW32)] = compat_drm_update_draw,
- #endif
- [DRM_IOCTL_NR(DRM_IOCTL_WAIT_VBLANK32)] = compat_drm_wait_vblank,
-+ [DRM_IOCTL_NR(DRM_IOCTL_MODE_ADDFB232)] = compat_drm_mode_addfb2,
- };
-
- /**
-diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
-index 2d0995e..596bce5 100644
---- a/drivers/gpu/drm/i915/i915_gem.c
-+++ b/drivers/gpu/drm/i915/i915_gem.c
-@@ -2401,6 +2401,7 @@ int __i915_add_request(struct intel_engine_cs *ring,
- }
-
- request->emitted_jiffies = jiffies;
-+ ring->last_submitted_seqno = request->seqno;
- list_add_tail(&request->list, &ring->request_list);
- request->file_priv = NULL;
-
-diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
-index 0239fbf..ad90fa3 100644
---- a/drivers/gpu/drm/i915/i915_gem_gtt.c
-+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
-@@ -502,17 +502,17 @@ static void gen8_ppgtt_clear_range(struct i915_address_space *vm,
- struct page *page_table;
-
- if (WARN_ON(!ppgtt->pdp.page_directory[pdpe]))
-- continue;
-+ break;
-
- pd = ppgtt->pdp.page_directory[pdpe];
-
- if (WARN_ON(!pd->page_table[pde]))
-- continue;
-+ break;
-
- pt = pd->page_table[pde];
-
- if (WARN_ON(!pt->page))
-- continue;
-+ break;
-
- page_table = pt->page;
-
-diff --git a/drivers/gpu/drm/i915/i915_ioc32.c b/drivers/gpu/drm/i915/i915_ioc32.c
-index 176de63..23aa04c 100644
---- a/drivers/gpu/drm/i915/i915_ioc32.c
-+++ b/drivers/gpu/drm/i915/i915_ioc32.c
-@@ -204,7 +204,7 @@ long i915_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
- drm_ioctl_compat_t *fn = NULL;
- int ret;
-
-- if (nr < DRM_COMMAND_BASE)
-+ if (nr < DRM_COMMAND_BASE || nr >= DRM_COMMAND_END)
- return drm_compat_ioctl(filp, cmd, arg);
-
- if (nr < DRM_COMMAND_BASE + ARRAY_SIZE(i915_compat_ioctls))
-diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
-index 6d49443..b0df8d1 100644
---- a/drivers/gpu/drm/i915/i915_irq.c
-+++ b/drivers/gpu/drm/i915/i915_irq.c
-@@ -2650,18 +2650,11 @@ static void gen8_disable_vblank(struct drm_device *dev, int pipe)
- spin_unlock_irqrestore(&dev_priv->irq_lock, irqflags);
- }
-
--static struct drm_i915_gem_request *
--ring_last_request(struct intel_engine_cs *ring)
--{
-- return list_entry(ring->request_list.prev,
-- struct drm_i915_gem_request, list);
--}
--
- static bool
--ring_idle(struct intel_engine_cs *ring)
-+ring_idle(struct intel_engine_cs *ring, u32 seqno)
- {
- return (list_empty(&ring->request_list) ||
-- i915_gem_request_completed(ring_last_request(ring), false));
-+ i915_seqno_passed(seqno, ring->last_submitted_seqno));
- }
-
- static bool
-@@ -2883,7 +2876,7 @@ static void i915_hangcheck_elapsed(struct work_struct *work)
- acthd = intel_ring_get_active_head(ring);
-
- if (ring->hangcheck.seqno == seqno) {
-- if (ring_idle(ring)) {
-+ if (ring_idle(ring, seqno)) {
- ring->hangcheck.action = HANGCHECK_IDLE;
-
- if (waitqueue_active(&ring->irq_queue)) {
-diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
-index 773d1d2..a30db4b 100644
---- a/drivers/gpu/drm/i915/i915_reg.h
-+++ b/drivers/gpu/drm/i915/i915_reg.h
-@@ -3209,6 +3209,7 @@ enum skl_disp_power_wells {
- #define BLM_POLARITY_PNV (1 << 0) /* pnv only */
-
- #define BLC_HIST_CTL (dev_priv->info.display_mmio_offset + 0x61260)
-+#define BLM_HISTOGRAM_ENABLE (1 << 31)
-
- /* New registers for PCH-split platforms. Safe where new bits show up, the
- * register layout machtes with gen4 BLC_PWM_CTL[12]. */
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index d0f3cbc..57c8878 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -12499,6 +12499,16 @@ intel_check_primary_plane(struct drm_plane *plane,
- intel_crtc->atomic.wait_vblank = true;
- }
-
-+ /*
-+ * FIXME: Actually if we will still have any other plane enabled
-+ * on the pipe we could let IPS enabled still, but for
-+ * now lets consider that when we make primary invisible
-+ * by setting DSPCNTR to 0 on update_primary_plane function
-+ * IPS needs to be disable.
-+ */
-+ if (!state->visible || !fb)
-+ intel_crtc->atomic.disable_ips = true;
-+
- intel_crtc->atomic.fb_bits |=
- INTEL_FRONTBUFFER_PRIMARY(intel_crtc->pipe);
-
-@@ -12590,6 +12600,9 @@ static void intel_begin_crtc_commit(struct drm_crtc *crtc)
- if (intel_crtc->atomic.disable_fbc)
- intel_fbc_disable(dev);
-
-+ if (intel_crtc->atomic.disable_ips)
-+ hsw_disable_ips(intel_crtc);
-+
- if (intel_crtc->atomic.pre_disable_primary)
- intel_pre_disable_primary(crtc);
-
-diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
-index 897f17d..68d1f74 100644
---- a/drivers/gpu/drm/i915/intel_drv.h
-+++ b/drivers/gpu/drm/i915/intel_drv.h
-@@ -424,6 +424,7 @@ struct intel_crtc_atomic_commit {
- /* Sleepable operations to perform before commit */
- bool wait_for_flips;
- bool disable_fbc;
-+ bool disable_ips;
- bool pre_disable_primary;
- bool update_wm;
- unsigned disabled_planes;
-diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
-index 08532d4..2bf92cb 100644
---- a/drivers/gpu/drm/i915/intel_panel.c
-+++ b/drivers/gpu/drm/i915/intel_panel.c
-@@ -879,6 +879,14 @@ static void i9xx_enable_backlight(struct intel_connector *connector)
-
- /* XXX: combine this into above write? */
- intel_panel_actually_set_backlight(connector, panel->backlight.level);
-+
-+ /*
-+ * Needed to enable backlight on some 855gm models. BLC_HIST_CTL is
-+ * 855gm only, but checking for gen2 is safe, as 855gm is the only gen2
-+ * that has backlight.
-+ */
-+ if (IS_GEN2(dev))
-+ I915_WRITE(BLC_HIST_CTL, BLM_HISTOGRAM_ENABLE);
- }
-
- static void i965_enable_backlight(struct intel_connector *connector)
-diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
-index c761fe0..94514d3 100644
---- a/drivers/gpu/drm/i915/intel_ringbuffer.h
-+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
-@@ -266,6 +266,13 @@ struct intel_engine_cs {
- * Do we have some not yet emitted requests outstanding?
- */
- struct drm_i915_gem_request *outstanding_lazy_request;
-+ /**
-+ * Seqno of request most recently submitted to request_list.
-+ * Used exclusively by hang checker to avoid grabbing lock while
-+ * inspecting request list.
-+ */
-+ u32 last_submitted_seqno;
-+
- bool gpu_caches_dirty;
-
- wait_queue_head_t irq_queue;
-diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c
-index ff2a746..a18807e 100644
---- a/drivers/gpu/drm/i915/intel_uncore.c
-+++ b/drivers/gpu/drm/i915/intel_uncore.c
-@@ -1220,10 +1220,12 @@ int i915_reg_read_ioctl(struct drm_device *dev,
- struct drm_i915_private *dev_priv = dev->dev_private;
- struct drm_i915_reg_read *reg = data;
- struct register_whitelist const *entry = whitelist;
-+ unsigned size;
-+ u64 offset;
- int i, ret = 0;
-
- for (i = 0; i < ARRAY_SIZE(whitelist); i++, entry++) {
-- if (entry->offset == reg->offset &&
-+ if (entry->offset == (reg->offset & -entry->size) &&
- (1 << INTEL_INFO(dev)->gen & entry->gen_bitmask))
- break;
- }
-@@ -1231,23 +1233,33 @@ int i915_reg_read_ioctl(struct drm_device *dev,
- if (i == ARRAY_SIZE(whitelist))
- return -EINVAL;
-
-+ /* We use the low bits to encode extra flags as the register should
-+ * be naturally aligned (and those that are not so aligned merely
-+ * limit the available flags for that register).
-+ */
-+ offset = entry->offset;
-+ size = entry->size;
-+ size |= reg->offset ^ offset;
-+
- intel_runtime_pm_get(dev_priv);
-
-- switch (entry->size) {
-+ switch (size) {
-+ case 8 | 1:
-+ reg->val = I915_READ64_2x32(offset, offset+4);
-+ break;
- case 8:
-- reg->val = I915_READ64(reg->offset);
-+ reg->val = I915_READ64(offset);
- break;
- case 4:
-- reg->val = I915_READ(reg->offset);
-+ reg->val = I915_READ(offset);
- break;
- case 2:
-- reg->val = I915_READ16(reg->offset);
-+ reg->val = I915_READ16(offset);
- break;
- case 1:
-- reg->val = I915_READ8(reg->offset);
-+ reg->val = I915_READ8(offset);
- break;
- default:
-- MISSING_CASE(entry->size);
- ret = -EINVAL;
- goto out;
- }
-diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c
-index 9782364..f33251d 100644
---- a/drivers/gpu/drm/qxl/qxl_cmd.c
-+++ b/drivers/gpu/drm/qxl/qxl_cmd.c
-@@ -505,6 +505,7 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev,
-
- cmd = (struct qxl_surface_cmd *)qxl_release_map(qdev, release);
- cmd->type = QXL_SURFACE_CMD_CREATE;
-+ cmd->flags = QXL_SURF_FLAG_KEEP_DATA;
- cmd->u.surface_create.format = surf->surf.format;
- cmd->u.surface_create.width = surf->surf.width;
- cmd->u.surface_create.height = surf->surf.height;
-diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c
-index b110883..7354a4c 100644
---- a/drivers/gpu/drm/qxl/qxl_ioctl.c
-+++ b/drivers/gpu/drm/qxl/qxl_ioctl.c
-@@ -122,8 +122,10 @@ static struct qxl_bo *qxlhw_handle_to_bo(struct qxl_device *qdev,
- qobj = gem_to_qxl_bo(gobj);
-
- ret = qxl_release_list_add(release, qobj);
-- if (ret)
-+ if (ret) {
-+ drm_gem_object_unreference_unlocked(gobj);
- return NULL;
-+ }
-
- return qobj;
- }
-diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c
-index 8730562..4a09947 100644
---- a/drivers/gpu/drm/radeon/ci_dpm.c
-+++ b/drivers/gpu/drm/radeon/ci_dpm.c
-@@ -5818,7 +5818,7 @@ int ci_dpm_init(struct radeon_device *rdev)
- tmp |= DPM_ENABLED;
- break;
- default:
-- DRM_ERROR("Invalid PCC GPIO: %u!\n", gpio.shift);
-+ DRM_DEBUG("Invalid PCC GPIO: %u!\n", gpio.shift);
- break;
- }
- WREG32_SMC(CNB_PWRMGT_CNTL, tmp);
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index ba50f3c..8456653 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -4579,6 +4579,31 @@ void cik_compute_set_wptr(struct radeon_device *rdev,
- WDOORBELL32(ring->doorbell_index, ring->wptr);
- }
-
-+static void cik_compute_stop(struct radeon_device *rdev,
-+ struct radeon_ring *ring)
-+{
-+ u32 j, tmp;
-+
-+ cik_srbm_select(rdev, ring->me, ring->pipe, ring->queue, 0);
-+ /* Disable wptr polling. */
-+ tmp = RREG32(CP_PQ_WPTR_POLL_CNTL);
-+ tmp &= ~WPTR_POLL_EN;
-+ WREG32(CP_PQ_WPTR_POLL_CNTL, tmp);
-+ /* Disable HQD. */
-+ if (RREG32(CP_HQD_ACTIVE) & 1) {
-+ WREG32(CP_HQD_DEQUEUE_REQUEST, 1);
-+ for (j = 0; j < rdev->usec_timeout; j++) {
-+ if (!(RREG32(CP_HQD_ACTIVE) & 1))
-+ break;
-+ udelay(1);
-+ }
-+ WREG32(CP_HQD_DEQUEUE_REQUEST, 0);
-+ WREG32(CP_HQD_PQ_RPTR, 0);
-+ WREG32(CP_HQD_PQ_WPTR, 0);
-+ }
-+ cik_srbm_select(rdev, 0, 0, 0, 0);
-+}
-+
- /**
- * cik_cp_compute_enable - enable/disable the compute CP MEs
- *
-@@ -4592,6 +4617,15 @@ static void cik_cp_compute_enable(struct radeon_device *rdev, bool enable)
- if (enable)
- WREG32(CP_MEC_CNTL, 0);
- else {
-+ /*
-+ * To make hibernation reliable we need to clear compute ring
-+ * configuration before halting the compute ring.
-+ */
-+ mutex_lock(&rdev->srbm_mutex);
-+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX]);
-+ cik_compute_stop(rdev,&rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX]);
-+ mutex_unlock(&rdev->srbm_mutex);
-+
- WREG32(CP_MEC_CNTL, (MEC_ME1_HALT | MEC_ME2_HALT));
- rdev->ring[CAYMAN_RING_TYPE_CP1_INDEX].ready = false;
- rdev->ring[CAYMAN_RING_TYPE_CP2_INDEX].ready = false;
-@@ -7905,23 +7939,27 @@ restart_ih:
- case 1: /* D1 vblank/vline */
- switch (src_data) {
- case 0: /* D1 vblank */
-- if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[0]) {
-- drm_handle_vblank(rdev->ddev, 0);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[0]))
-- radeon_crtc_handle_vblank(rdev, 0);
-- rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D1 vblank\n");
-+ if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[0]) {
-+ drm_handle_vblank(rdev->ddev, 0);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[0]))
-+ radeon_crtc_handle_vblank(rdev, 0);
-+ rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vblank\n");
-+
- break;
- case 1: /* D1 vline */
-- if (rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D1 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int & LB_D1_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -7931,23 +7969,27 @@ restart_ih:
- case 2: /* D2 vblank/vline */
- switch (src_data) {
- case 0: /* D2 vblank */
-- if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[1]) {
-- drm_handle_vblank(rdev->ddev, 1);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[1]))
-- radeon_crtc_handle_vblank(rdev, 1);
-- rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D2 vblank\n");
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[1]) {
-+ drm_handle_vblank(rdev->ddev, 1);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[1]))
-+ radeon_crtc_handle_vblank(rdev, 1);
-+ rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vblank\n");
-+
- break;
- case 1: /* D2 vline */
-- if (rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D2 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont & LB_D2_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -7957,23 +7999,27 @@ restart_ih:
- case 3: /* D3 vblank/vline */
- switch (src_data) {
- case 0: /* D3 vblank */
-- if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[2]) {
-- drm_handle_vblank(rdev->ddev, 2);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[2]))
-- radeon_crtc_handle_vblank(rdev, 2);
-- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D3 vblank\n");
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[2]) {
-+ drm_handle_vblank(rdev->ddev, 2);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[2]))
-+ radeon_crtc_handle_vblank(rdev, 2);
-+ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D3 vblank\n");
-+
- break;
- case 1: /* D3 vline */
-- if (rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D3 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D3 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -7983,23 +8029,27 @@ restart_ih:
- case 4: /* D4 vblank/vline */
- switch (src_data) {
- case 0: /* D4 vblank */
-- if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[3]) {
-- drm_handle_vblank(rdev->ddev, 3);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[3]))
-- radeon_crtc_handle_vblank(rdev, 3);
-- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D4 vblank\n");
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[3]) {
-+ drm_handle_vblank(rdev->ddev, 3);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[3]))
-+ radeon_crtc_handle_vblank(rdev, 3);
-+ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D4 vblank\n");
-+
- break;
- case 1: /* D4 vline */
-- if (rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D4 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D4 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -8009,23 +8059,27 @@ restart_ih:
- case 5: /* D5 vblank/vline */
- switch (src_data) {
- case 0: /* D5 vblank */
-- if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[4]) {
-- drm_handle_vblank(rdev->ddev, 4);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[4]))
-- radeon_crtc_handle_vblank(rdev, 4);
-- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D5 vblank\n");
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[4]) {
-+ drm_handle_vblank(rdev->ddev, 4);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[4]))
-+ radeon_crtc_handle_vblank(rdev, 4);
-+ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D5 vblank\n");
-+
- break;
- case 1: /* D5 vline */
-- if (rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D5 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D5 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -8035,23 +8089,27 @@ restart_ih:
- case 6: /* D6 vblank/vline */
- switch (src_data) {
- case 0: /* D6 vblank */
-- if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[5]) {
-- drm_handle_vblank(rdev->ddev, 5);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[5]))
-- radeon_crtc_handle_vblank(rdev, 5);
-- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D6 vblank\n");
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[5]) {
-+ drm_handle_vblank(rdev->ddev, 5);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[5]))
-+ radeon_crtc_handle_vblank(rdev, 5);
-+ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D6 vblank\n");
-+
- break;
- case 1: /* D6 vline */
-- if (rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D6 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D6 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -8071,88 +8129,112 @@ restart_ih:
- case 42: /* HPD hotplug */
- switch (src_data) {
- case 0:
-- if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD1\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD1\n");
-+
- break;
- case 1:
-- if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD2\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD2\n");
-+
- break;
- case 2:
-- if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD3\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD3\n");
-+
- break;
- case 3:
-- if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD4\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD4\n");
-+
- break;
- case 4:
-- if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD5\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD5\n");
-+
- break;
- case 5:
-- if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD6\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD6\n");
-+
- break;
- case 6:
-- if (rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 1\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int & DC_HPD1_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 1\n");
-+
- break;
- case 7:
-- if (rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 2\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont & DC_HPD2_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 2\n");
-+
- break;
- case 8:
-- if (rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 3\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 3\n");
-+
- break;
- case 9:
-- if (rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 4\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 4\n");
-+
- break;
- case 10:
-- if (rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 5\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 5\n");
-+
- break;
- case 11:
-- if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-- rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 6\n");
-- }
-+ if (!(rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.cik.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 6\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/cik_sdma.c b/drivers/gpu/drm/radeon/cik_sdma.c
-index f86eb54..d16f2ee 100644
---- a/drivers/gpu/drm/radeon/cik_sdma.c
-+++ b/drivers/gpu/drm/radeon/cik_sdma.c
-@@ -268,6 +268,17 @@ static void cik_sdma_gfx_stop(struct radeon_device *rdev)
- }
- rdev->ring[R600_RING_TYPE_DMA_INDEX].ready = false;
- rdev->ring[CAYMAN_RING_TYPE_DMA1_INDEX].ready = false;
-+
-+ /* FIXME use something else than big hammer but after few days can not
-+ * seem to find good combination so reset SDMA blocks as it seems we
-+ * do not shut them down properly. This fix hibernation and does not
-+ * affect suspend to ram.
-+ */
-+ WREG32(SRBM_SOFT_RESET, SOFT_RESET_SDMA | SOFT_RESET_SDMA1);
-+ (void)RREG32(SRBM_SOFT_RESET);
-+ udelay(50);
-+ WREG32(SRBM_SOFT_RESET, 0);
-+ (void)RREG32(SRBM_SOFT_RESET);
- }
-
- /**
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index f848acf..feef136 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -4855,7 +4855,7 @@ restart_ih:
- return IRQ_NONE;
-
- rptr = rdev->ih.rptr;
-- DRM_DEBUG("r600_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
-+ DRM_DEBUG("evergreen_irq_process start: rptr %d, wptr %d\n", rptr, wptr);
-
- /* Order reading of wptr vs. reading of IH ring data */
- rmb();
-@@ -4873,23 +4873,27 @@ restart_ih:
- case 1: /* D1 vblank/vline */
- switch (src_data) {
- case 0: /* D1 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[0]) {
-- drm_handle_vblank(rdev->ddev, 0);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[0]))
-- radeon_crtc_handle_vblank(rdev, 0);
-- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D1 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[0]) {
-+ drm_handle_vblank(rdev->ddev, 0);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[0]))
-+ radeon_crtc_handle_vblank(rdev, 0);
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vblank\n");
-+
- break;
- case 1: /* D1 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D1 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4899,23 +4903,27 @@ restart_ih:
- case 2: /* D2 vblank/vline */
- switch (src_data) {
- case 0: /* D2 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[1]) {
-- drm_handle_vblank(rdev->ddev, 1);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[1]))
-- radeon_crtc_handle_vblank(rdev, 1);
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D2 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[1]) {
-+ drm_handle_vblank(rdev->ddev, 1);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[1]))
-+ radeon_crtc_handle_vblank(rdev, 1);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vblank\n");
-+
- break;
- case 1: /* D2 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D2 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4925,23 +4933,27 @@ restart_ih:
- case 3: /* D3 vblank/vline */
- switch (src_data) {
- case 0: /* D3 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[2]) {
-- drm_handle_vblank(rdev->ddev, 2);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[2]))
-- radeon_crtc_handle_vblank(rdev, 2);
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D3 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D3 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[2]) {
-+ drm_handle_vblank(rdev->ddev, 2);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[2]))
-+ radeon_crtc_handle_vblank(rdev, 2);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D3 vblank\n");
-+
- break;
- case 1: /* D3 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D3 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D3 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D3 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4951,23 +4963,27 @@ restart_ih:
- case 4: /* D4 vblank/vline */
- switch (src_data) {
- case 0: /* D4 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[3]) {
-- drm_handle_vblank(rdev->ddev, 3);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[3]))
-- radeon_crtc_handle_vblank(rdev, 3);
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D4 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D4 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[3]) {
-+ drm_handle_vblank(rdev->ddev, 3);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[3]))
-+ radeon_crtc_handle_vblank(rdev, 3);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D4 vblank\n");
-+
- break;
- case 1: /* D4 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D4 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D4 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D4 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4977,23 +4993,27 @@ restart_ih:
- case 5: /* D5 vblank/vline */
- switch (src_data) {
- case 0: /* D5 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[4]) {
-- drm_handle_vblank(rdev->ddev, 4);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[4]))
-- radeon_crtc_handle_vblank(rdev, 4);
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D5 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D5 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[4]) {
-+ drm_handle_vblank(rdev->ddev, 4);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[4]))
-+ radeon_crtc_handle_vblank(rdev, 4);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D5 vblank\n");
-+
- break;
- case 1: /* D5 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D5 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D5 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D5 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -5003,23 +5023,27 @@ restart_ih:
- case 6: /* D6 vblank/vline */
- switch (src_data) {
- case 0: /* D6 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[5]) {
-- drm_handle_vblank(rdev->ddev, 5);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[5]))
-- radeon_crtc_handle_vblank(rdev, 5);
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D6 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D6 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[5]) {
-+ drm_handle_vblank(rdev->ddev, 5);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[5]))
-+ radeon_crtc_handle_vblank(rdev, 5);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D6 vblank\n");
-+
- break;
- case 1: /* D6 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D6 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D6 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D6 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -5039,88 +5063,100 @@ restart_ih:
- case 42: /* HPD hotplug */
- switch (src_data) {
- case 0:
-- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD1\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD1\n");
- break;
- case 1:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD2\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD2\n");
- break;
- case 2:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD3\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD3\n");
- break;
- case 3:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD4\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD4\n");
- break;
- case 4:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD5\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD5\n");
- break;
- case 5:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD6\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD6\n");
- break;
- case 6:
-- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 1\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 1\n");
- break;
- case 7:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 2\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 2\n");
- break;
- case 8:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 3\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 3\n");
- break;
- case 9:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 4\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 4\n");
- break;
- case 10:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 5\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 5\n");
- break;
- case 11:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 6\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 6\n");
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -5130,46 +5166,52 @@ restart_ih:
- case 44: /* hdmi */
- switch (src_data) {
- case 0:
-- if (rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI0\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.afmt_status1 & AFMT_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.afmt_status1 &= ~AFMT_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI0\n");
- break;
- case 1:
-- if (rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI1\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.afmt_status2 & AFMT_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.afmt_status2 &= ~AFMT_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI1\n");
- break;
- case 2:
-- if (rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI2\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.afmt_status3 & AFMT_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.afmt_status3 &= ~AFMT_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI2\n");
- break;
- case 3:
-- if (rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI3\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.afmt_status4 & AFMT_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.afmt_status4 &= ~AFMT_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI3\n");
- break;
- case 4:
-- if (rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI4\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.afmt_status5 & AFMT_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.afmt_status5 &= ~AFMT_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI4\n");
- break;
- case 5:
-- if (rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI5\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.afmt_status6 & AFMT_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.afmt_status6 &= ~AFMT_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI5\n");
- break;
- default:
- DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 8f6d862..21e479f 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -4039,23 +4039,27 @@ restart_ih:
- case 1: /* D1 vblank/vline */
- switch (src_data) {
- case 0: /* D1 vblank */
-- if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[0]) {
-- drm_handle_vblank(rdev->ddev, 0);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[0]))
-- radeon_crtc_handle_vblank(rdev, 0);
-- rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D1 vblank\n");
-+ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D1 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[0]) {
-+ drm_handle_vblank(rdev->ddev, 0);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[0]))
-+ radeon_crtc_handle_vblank(rdev, 0);
-+ rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vblank\n");
-+
- break;
- case 1: /* D1 vline */
-- if (rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D1 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D1_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D1 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4065,23 +4069,27 @@ restart_ih:
- case 5: /* D2 vblank/vline */
- switch (src_data) {
- case 0: /* D2 vblank */
-- if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[1]) {
-- drm_handle_vblank(rdev->ddev, 1);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[1]))
-- radeon_crtc_handle_vblank(rdev, 1);
-- rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D2 vblank\n");
-+ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: D2 vblank - IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[1]) {
-+ drm_handle_vblank(rdev->ddev, 1);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[1]))
-+ radeon_crtc_handle_vblank(rdev, 1);
-+ rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vblank\n");
-+
- break;
- case 1: /* D1 vline */
-- if (rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D2 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int & LB_D2_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: D2 vline - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int &= ~LB_D2_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4101,46 +4109,53 @@ restart_ih:
- case 19: /* HPD/DAC hotplug */
- switch (src_data) {
- case 0:
-- if (rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD1\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD1_INTERRUPT))
-+ DRM_DEBUG("IH: HPD1 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD1_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD1\n");
- break;
- case 1:
-- if (rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD2\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int & DC_HPD2_INTERRUPT))
-+ DRM_DEBUG("IH: HPD2 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int &= ~DC_HPD2_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD2\n");
- break;
- case 4:
-- if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD3\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD3_INTERRUPT))
-+ DRM_DEBUG("IH: HPD3 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD3_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD3\n");
- break;
- case 5:
-- if (rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD4\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int_cont & DC_HPD4_INTERRUPT))
-+ DRM_DEBUG("IH: HPD4 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int_cont &= ~DC_HPD4_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD4\n");
- break;
- case 10:
-- if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD5\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD5_INTERRUPT))
-+ DRM_DEBUG("IH: HPD5 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD5_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD5\n");
- break;
- case 12:
-- if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) {
-- rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD6\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT))
-+ DRM_DEBUG("IH: HPD6 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.disp_int_cont2 &= ~DC_HPD6_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD6\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -4150,18 +4165,22 @@ restart_ih:
- case 21: /* hdmi */
- switch (src_data) {
- case 4:
-- if (rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI0\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.hdmi0_status & HDMI0_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: HDMI0 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.hdmi0_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI0\n");
-+
- break;
- case 5:
-- if (rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG) {
-- rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-- queue_hdmi = true;
-- DRM_DEBUG("IH: HDMI1\n");
-- }
-+ if (!(rdev->irq.stat_regs.r600.hdmi1_status & HDMI0_AZ_FORMAT_WTRIG))
-+ DRM_DEBUG("IH: HDMI1 - IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.r600.hdmi1_status &= ~HDMI0_AZ_FORMAT_WTRIG;
-+ queue_hdmi = true;
-+ DRM_DEBUG("IH: HDMI1\n");
-+
- break;
- default:
- DRM_ERROR("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/radeon_audio.c b/drivers/gpu/drm/radeon/radeon_audio.c
-index 25191f1..fa719c5 100644
---- a/drivers/gpu/drm/radeon/radeon_audio.c
-+++ b/drivers/gpu/drm/radeon/radeon_audio.c
-@@ -242,6 +242,13 @@ static struct radeon_audio_funcs dce6_dp_funcs = {
- .dpms = evergreen_dp_enable,
- };
-
-+static void radeon_audio_enable(struct radeon_device *rdev,
-+ struct r600_audio_pin *pin, u8 enable_mask)
-+{
-+ if (rdev->audio.funcs->enable)
-+ rdev->audio.funcs->enable(rdev, pin, enable_mask);
-+}
-+
- static void radeon_audio_interface_init(struct radeon_device *rdev)
- {
- if (ASIC_IS_DCE6(rdev)) {
-@@ -307,7 +314,7 @@ int radeon_audio_init(struct radeon_device *rdev)
-
- /* disable audio. it will be set up later */
- for (i = 0; i < rdev->audio.num_pins; i++)
-- radeon_audio_enable(rdev, &rdev->audio.pin[i], false);
-+ radeon_audio_enable(rdev, &rdev->audio.pin[i], 0);
-
- return 0;
- }
-@@ -443,13 +450,6 @@ static void radeon_audio_select_pin(struct drm_encoder *encoder)
- radeon_encoder->audio->select_pin(encoder);
- }
-
--void radeon_audio_enable(struct radeon_device *rdev,
-- struct r600_audio_pin *pin, u8 enable_mask)
--{
-- if (rdev->audio.funcs->enable)
-- rdev->audio.funcs->enable(rdev, pin, enable_mask);
--}
--
- void radeon_audio_detect(struct drm_connector *connector,
- enum drm_connector_status status)
- {
-@@ -469,22 +469,22 @@ void radeon_audio_detect(struct drm_connector *connector,
- dig = radeon_encoder->enc_priv;
-
- if (status == connector_status_connected) {
-- struct radeon_connector *radeon_connector;
-- int sink_type;
--
- if (!drm_detect_monitor_audio(radeon_connector_edid(connector))) {
- radeon_encoder->audio = NULL;
- return;
- }
-
-- radeon_connector = to_radeon_connector(connector);
-- sink_type = radeon_dp_getsinktype(radeon_connector);
-+ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort) {
-+ struct radeon_connector *radeon_connector = to_radeon_connector(connector);
-
-- if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort &&
-- sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT)
-- radeon_encoder->audio = rdev->audio.dp_funcs;
-- else
-+ if (radeon_dp_getsinktype(radeon_connector) ==
-+ CONNECTOR_OBJECT_ID_DISPLAYPORT)
-+ radeon_encoder->audio = rdev->audio.dp_funcs;
-+ else
-+ radeon_encoder->audio = rdev->audio.hdmi_funcs;
-+ } else {
- radeon_encoder->audio = rdev->audio.hdmi_funcs;
-+ }
-
- dig->afmt->pin = radeon_audio_get_pin(connector->encoder);
- radeon_audio_enable(rdev, dig->afmt->pin, 0xf);
-@@ -502,7 +502,7 @@ void radeon_audio_fini(struct radeon_device *rdev)
- return;
-
- for (i = 0; i < rdev->audio.num_pins; i++)
-- radeon_audio_enable(rdev, &rdev->audio.pin[i], false);
-+ radeon_audio_enable(rdev, &rdev->audio.pin[i], 0);
-
- rdev->audio.enabled = false;
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_audio.h b/drivers/gpu/drm/radeon/radeon_audio.h
-index c92d059..8438304 100644
---- a/drivers/gpu/drm/radeon/radeon_audio.h
-+++ b/drivers/gpu/drm/radeon/radeon_audio.h
-@@ -74,8 +74,6 @@ u32 radeon_audio_endpoint_rreg(struct radeon_device *rdev,
- void radeon_audio_endpoint_wreg(struct radeon_device *rdev,
- u32 offset, u32 reg, u32 v);
- struct r600_audio_pin *radeon_audio_get_pin(struct drm_encoder *encoder);
--void radeon_audio_enable(struct radeon_device *rdev,
-- struct r600_audio_pin *pin, u8 enable_mask);
- void radeon_audio_fini(struct radeon_device *rdev);
- void radeon_audio_mode_set(struct drm_encoder *encoder,
- struct drm_display_mode *mode);
-diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
-index 45e5406..fa66174 100644
---- a/drivers/gpu/drm/radeon/radeon_cursor.c
-+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
-@@ -205,8 +205,9 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y)
- | (x << 16)
- | y));
- /* offset is from DISP(2)_BASE_ADDRESS */
-- WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, (radeon_crtc->legacy_cursor_offset +
-- (yorigin * 256)));
-+ WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset,
-+ radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr +
-+ yorigin * 256);
- }
-
- radeon_crtc->cursor_x = x;
-@@ -227,51 +228,32 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
- return ret;
- }
-
--static int radeon_set_cursor(struct drm_crtc *crtc, struct drm_gem_object *obj)
-+static void radeon_set_cursor(struct drm_crtc *crtc)
- {
- struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
- struct radeon_device *rdev = crtc->dev->dev_private;
-- struct radeon_bo *robj = gem_to_radeon_bo(obj);
-- uint64_t gpu_addr;
-- int ret;
--
-- ret = radeon_bo_reserve(robj, false);
-- if (unlikely(ret != 0))
-- goto fail;
-- /* Only 27 bit offset for legacy cursor */
-- ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM,
-- ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27,
-- &gpu_addr);
-- radeon_bo_unreserve(robj);
-- if (ret)
-- goto fail;
-
- if (ASIC_IS_DCE4(rdev)) {
- WREG32(EVERGREEN_CUR_SURFACE_ADDRESS_HIGH + radeon_crtc->crtc_offset,
-- upper_32_bits(gpu_addr));
-+ upper_32_bits(radeon_crtc->cursor_addr));
- WREG32(EVERGREEN_CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
-- gpu_addr & 0xffffffff);
-+ lower_32_bits(radeon_crtc->cursor_addr));
- } else if (ASIC_IS_AVIVO(rdev)) {
- if (rdev->family >= CHIP_RV770) {
- if (radeon_crtc->crtc_id)
-- WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr));
-+ WREG32(R700_D2CUR_SURFACE_ADDRESS_HIGH,
-+ upper_32_bits(radeon_crtc->cursor_addr));
- else
-- WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH, upper_32_bits(gpu_addr));
-+ WREG32(R700_D1CUR_SURFACE_ADDRESS_HIGH,
-+ upper_32_bits(radeon_crtc->cursor_addr));
- }
- WREG32(AVIVO_D1CUR_SURFACE_ADDRESS + radeon_crtc->crtc_offset,
-- gpu_addr & 0xffffffff);
-+ lower_32_bits(radeon_crtc->cursor_addr));
- } else {
-- radeon_crtc->legacy_cursor_offset = gpu_addr - radeon_crtc->legacy_display_base_addr;
- /* offset is from DISP(2)_BASE_ADDRESS */
-- WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset, radeon_crtc->legacy_cursor_offset);
-+ WREG32(RADEON_CUR_OFFSET + radeon_crtc->crtc_offset,
-+ radeon_crtc->cursor_addr - radeon_crtc->legacy_display_base_addr);
- }
--
-- return 0;
--
--fail:
-- drm_gem_object_unreference_unlocked(obj);
--
-- return ret;
- }
-
- int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
-@@ -283,7 +265,9 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
- int32_t hot_y)
- {
- struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-+ struct radeon_device *rdev = crtc->dev->dev_private;
- struct drm_gem_object *obj;
-+ struct radeon_bo *robj;
- int ret;
-
- if (!handle) {
-@@ -305,6 +289,23 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
- return -ENOENT;
- }
-
-+ robj = gem_to_radeon_bo(obj);
-+ ret = radeon_bo_reserve(robj, false);
-+ if (ret != 0) {
-+ drm_gem_object_unreference_unlocked(obj);
-+ return ret;
-+ }
-+ /* Only 27 bit offset for legacy cursor */
-+ ret = radeon_bo_pin_restricted(robj, RADEON_GEM_DOMAIN_VRAM,
-+ ASIC_IS_AVIVO(rdev) ? 0 : 1 << 27,
-+ &radeon_crtc->cursor_addr);
-+ radeon_bo_unreserve(robj);
-+ if (ret) {
-+ DRM_ERROR("Failed to pin new cursor BO (%d)\n", ret);
-+ drm_gem_object_unreference_unlocked(obj);
-+ return ret;
-+ }
-+
- radeon_crtc->cursor_width = width;
- radeon_crtc->cursor_height = height;
-
-@@ -323,13 +324,8 @@ int radeon_crtc_cursor_set2(struct drm_crtc *crtc,
- radeon_crtc->cursor_hot_y = hot_y;
- }
-
-- ret = radeon_set_cursor(crtc, obj);
--
-- if (ret)
-- DRM_ERROR("radeon_set_cursor returned %d, not changing cursor\n",
-- ret);
-- else
-- radeon_show_cursor(crtc);
-+ radeon_set_cursor(crtc);
-+ radeon_show_cursor(crtc);
-
- radeon_lock_cursor(crtc, false);
-
-@@ -341,8 +337,7 @@ unpin:
- radeon_bo_unpin(robj);
- radeon_bo_unreserve(robj);
- }
-- if (radeon_crtc->cursor_bo != obj)
-- drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo);
-+ drm_gem_object_unreference_unlocked(radeon_crtc->cursor_bo);
- }
-
- radeon_crtc->cursor_bo = obj;
-@@ -360,7 +355,6 @@ unpin:
- void radeon_cursor_reset(struct drm_crtc *crtc)
- {
- struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-- int ret;
-
- if (radeon_crtc->cursor_bo) {
- radeon_lock_cursor(crtc, true);
-@@ -368,12 +362,8 @@ void radeon_cursor_reset(struct drm_crtc *crtc)
- radeon_cursor_move_locked(crtc, radeon_crtc->cursor_x,
- radeon_crtc->cursor_y);
-
-- ret = radeon_set_cursor(crtc, radeon_crtc->cursor_bo);
-- if (ret)
-- DRM_ERROR("radeon_set_cursor returned %d, not showing "
-- "cursor\n", ret);
-- else
-- radeon_show_cursor(crtc);
-+ radeon_set_cursor(crtc);
-+ radeon_show_cursor(crtc);
-
- radeon_lock_cursor(crtc, false);
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
-index a7fdfa4..604c44d 100644
---- a/drivers/gpu/drm/radeon/radeon_device.c
-+++ b/drivers/gpu/drm/radeon/radeon_device.c
-@@ -1572,11 +1572,21 @@ int radeon_suspend_kms(struct drm_device *dev, bool suspend, bool fbcon)
- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF);
- }
-
-- /* unpin the front buffers */
-+ /* unpin the front buffers and cursors */
- list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
- struct radeon_framebuffer *rfb = to_radeon_framebuffer(crtc->primary->fb);
- struct radeon_bo *robj;
-
-+ if (radeon_crtc->cursor_bo) {
-+ struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo);
-+ r = radeon_bo_reserve(robj, false);
-+ if (r == 0) {
-+ radeon_bo_unpin(robj);
-+ radeon_bo_unreserve(robj);
-+ }
-+ }
-+
- if (rfb == NULL || rfb->obj == NULL) {
- continue;
- }
-@@ -1639,6 +1649,7 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
- {
- struct drm_connector *connector;
- struct radeon_device *rdev = dev->dev_private;
-+ struct drm_crtc *crtc;
- int r;
-
- if (dev->switch_power_state == DRM_SWITCH_POWER_OFF)
-@@ -1678,6 +1689,27 @@ int radeon_resume_kms(struct drm_device *dev, bool resume, bool fbcon)
-
- radeon_restore_bios_scratch_regs(rdev);
-
-+ /* pin cursors */
-+ list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-+ struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
-+
-+ if (radeon_crtc->cursor_bo) {
-+ struct radeon_bo *robj = gem_to_radeon_bo(radeon_crtc->cursor_bo);
-+ r = radeon_bo_reserve(robj, false);
-+ if (r == 0) {
-+ /* Only 27 bit offset for legacy cursor */
-+ r = radeon_bo_pin_restricted(robj,
-+ RADEON_GEM_DOMAIN_VRAM,
-+ ASIC_IS_AVIVO(rdev) ?
-+ 0 : 1 << 27,
-+ &radeon_crtc->cursor_addr);
-+ if (r != 0)
-+ DRM_ERROR("Failed to pin cursor BO (%d)\n", r);
-+ radeon_bo_unreserve(robj);
-+ }
-+ }
-+ }
-+
- /* init dig PHYs, disp eng pll */
- if (rdev->is_atom_bios) {
- radeon_atom_encoder_init(rdev);
-diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
-index aeb6767..634793e 100644
---- a/drivers/gpu/drm/radeon/radeon_fb.c
-+++ b/drivers/gpu/drm/radeon/radeon_fb.c
-@@ -257,7 +257,6 @@ static int radeonfb_create(struct drm_fb_helper *helper,
- }
-
- info->par = rfbdev;
-- info->skip_vt_switch = true;
-
- ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj);
- if (ret) {
-diff --git a/drivers/gpu/drm/radeon/radeon_gart.c b/drivers/gpu/drm/radeon/radeon_gart.c
-index 5450fa9..c4777c8 100644
---- a/drivers/gpu/drm/radeon/radeon_gart.c
-+++ b/drivers/gpu/drm/radeon/radeon_gart.c
-@@ -260,8 +260,10 @@ void radeon_gart_unbind(struct radeon_device *rdev, unsigned offset,
- }
- }
- }
-- mb();
-- radeon_gart_tlb_flush(rdev);
-+ if (rdev->gart.ptr) {
-+ mb();
-+ radeon_gart_tlb_flush(rdev);
-+ }
- }
-
- /**
-@@ -306,8 +308,10 @@ int radeon_gart_bind(struct radeon_device *rdev, unsigned offset,
- page_base += RADEON_GPU_PAGE_SIZE;
- }
- }
-- mb();
-- radeon_gart_tlb_flush(rdev);
-+ if (rdev->gart.ptr) {
-+ mb();
-+ radeon_gart_tlb_flush(rdev);
-+ }
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
-index ac3c131..186d0b7 100644
---- a/drivers/gpu/drm/radeon/radeon_gem.c
-+++ b/drivers/gpu/drm/radeon/radeon_gem.c
-@@ -36,6 +36,7 @@ void radeon_gem_object_free(struct drm_gem_object *gobj)
- if (robj) {
- if (robj->gem_base.import_attach)
- drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg);
-+ radeon_mn_unregister(robj);
- radeon_bo_unref(&robj);
- }
- }
-@@ -471,6 +472,7 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
- r = ret;
-
- /* Flush HDP cache via MMIO if necessary */
-+ cur_placement = ACCESS_ONCE(robj->tbo.mem.mem_type);
- if (rdev->asic->mmio_hdp_flush &&
- radeon_mem_type_to_domain(cur_placement) == RADEON_GEM_DOMAIN_VRAM)
- robj->rdev->asic->mmio_hdp_flush(rdev);
-diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-index 7162c93..f682e53 100644
---- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
-+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
-@@ -79,10 +79,12 @@ static void radeon_hotplug_work_func(struct work_struct *work)
- struct drm_mode_config *mode_config = &dev->mode_config;
- struct drm_connector *connector;
-
-+ mutex_lock(&mode_config->mutex);
- if (mode_config->num_connector) {
- list_for_each_entry(connector, &mode_config->connector_list, head)
- radeon_connector_hotplug(connector);
- }
-+ mutex_unlock(&mode_config->mutex);
- /* Just fire off a uevent and let userspace tell us what to do */
- drm_helper_hpd_irq_event(dev);
- }
-diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
-index fa91a17..f01c797 100644
---- a/drivers/gpu/drm/radeon/radeon_mode.h
-+++ b/drivers/gpu/drm/radeon/radeon_mode.h
-@@ -343,7 +343,6 @@ struct radeon_crtc {
- int max_cursor_width;
- int max_cursor_height;
- uint32_t legacy_display_base_addr;
-- uint32_t legacy_cursor_offset;
- enum radeon_rmx_type rmx_type;
- u8 h_border;
- u8 v_border;
-diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
-index 318165d..6763627 100644
---- a/drivers/gpu/drm/radeon/radeon_object.c
-+++ b/drivers/gpu/drm/radeon/radeon_object.c
-@@ -75,7 +75,6 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo)
- bo = container_of(tbo, struct radeon_bo, tbo);
-
- radeon_update_memory_usage(bo, bo->tbo.mem.mem_type, -1);
-- radeon_mn_unregister(bo);
-
- mutex_lock(&bo->rdev->gem.mutex);
- list_del_init(&bo->list);
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index 4c679b8..e15185b 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -6466,23 +6466,27 @@ restart_ih:
- case 1: /* D1 vblank/vline */
- switch (src_data) {
- case 0: /* D1 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[0]) {
-- drm_handle_vblank(rdev->ddev, 0);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[0]))
-- radeon_crtc_handle_vblank(rdev, 0);
-- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D1 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[0]) {
-+ drm_handle_vblank(rdev->ddev, 0);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[0]))
-+ radeon_crtc_handle_vblank(rdev, 0);
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vblank\n");
-+
- break;
- case 1: /* D1 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D1 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & LB_D1_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~LB_D1_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D1 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6492,23 +6496,27 @@ restart_ih:
- case 2: /* D2 vblank/vline */
- switch (src_data) {
- case 0: /* D2 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[1]) {
-- drm_handle_vblank(rdev->ddev, 1);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[1]))
-- radeon_crtc_handle_vblank(rdev, 1);
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D2 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[1]) {
-+ drm_handle_vblank(rdev->ddev, 1);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[1]))
-+ radeon_crtc_handle_vblank(rdev, 1);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vblank\n");
-+
- break;
- case 1: /* D2 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D2 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & LB_D2_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~LB_D2_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D2 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6518,23 +6526,27 @@ restart_ih:
- case 3: /* D3 vblank/vline */
- switch (src_data) {
- case 0: /* D3 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[2]) {
-- drm_handle_vblank(rdev->ddev, 2);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[2]))
-- radeon_crtc_handle_vblank(rdev, 2);
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D3 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[2]) {
-+ drm_handle_vblank(rdev->ddev, 2);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[2]))
-+ radeon_crtc_handle_vblank(rdev, 2);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D3 vblank\n");
-+
- break;
- case 1: /* D3 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D3 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & LB_D3_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~LB_D3_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D3 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6544,23 +6556,27 @@ restart_ih:
- case 4: /* D4 vblank/vline */
- switch (src_data) {
- case 0: /* D4 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[3]) {
-- drm_handle_vblank(rdev->ddev, 3);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[3]))
-- radeon_crtc_handle_vblank(rdev, 3);
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D4 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[3]) {
-+ drm_handle_vblank(rdev->ddev, 3);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[3]))
-+ radeon_crtc_handle_vblank(rdev, 3);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D4 vblank\n");
-+
- break;
- case 1: /* D4 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D4 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & LB_D4_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~LB_D4_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D4 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6570,23 +6586,27 @@ restart_ih:
- case 5: /* D5 vblank/vline */
- switch (src_data) {
- case 0: /* D5 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[4]) {
-- drm_handle_vblank(rdev->ddev, 4);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[4]))
-- radeon_crtc_handle_vblank(rdev, 4);
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D5 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[4]) {
-+ drm_handle_vblank(rdev->ddev, 4);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[4]))
-+ radeon_crtc_handle_vblank(rdev, 4);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D5 vblank\n");
-+
- break;
- case 1: /* D5 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D5 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & LB_D5_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~LB_D5_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D5 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6596,23 +6616,27 @@ restart_ih:
- case 6: /* D6 vblank/vline */
- switch (src_data) {
- case 0: /* D6 vblank */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT) {
-- if (rdev->irq.crtc_vblank_int[5]) {
-- drm_handle_vblank(rdev->ddev, 5);
-- rdev->pm.vblank_sync = true;
-- wake_up(&rdev->irq.vblank_queue);
-- }
-- if (atomic_read(&rdev->irq.pflip[5]))
-- radeon_crtc_handle_vblank(rdev, 5);
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-- DRM_DEBUG("IH: D6 vblank\n");
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VBLANK_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ if (rdev->irq.crtc_vblank_int[5]) {
-+ drm_handle_vblank(rdev->ddev, 5);
-+ rdev->pm.vblank_sync = true;
-+ wake_up(&rdev->irq.vblank_queue);
- }
-+ if (atomic_read(&rdev->irq.pflip[5]))
-+ radeon_crtc_handle_vblank(rdev, 5);
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VBLANK_INTERRUPT;
-+ DRM_DEBUG("IH: D6 vblank\n");
-+
- break;
- case 1: /* D6 vline */
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-- DRM_DEBUG("IH: D6 vline\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & LB_D6_VLINE_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~LB_D6_VLINE_INTERRUPT;
-+ DRM_DEBUG("IH: D6 vline\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-@@ -6632,88 +6656,112 @@ restart_ih:
- case 42: /* HPD hotplug */
- switch (src_data) {
- case 0:
-- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD1\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD1\n");
-+
- break;
- case 1:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD2\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD2\n");
-+
- break;
- case 2:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD3\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD3\n");
-+
- break;
- case 3:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD4\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD4\n");
-+
- break;
- case 4:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD5\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD5\n");
-+
- break;
- case 5:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-- queue_hotplug = true;
-- DRM_DEBUG("IH: HPD6\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_INTERRUPT;
-+ queue_hotplug = true;
-+ DRM_DEBUG("IH: HPD6\n");
-+
- break;
- case 6:
-- if (rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 1\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int & DC_HPD1_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int &= ~DC_HPD1_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 1\n");
-+
- break;
- case 7:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 2\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont & DC_HPD2_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont &= ~DC_HPD2_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 2\n");
-+
- break;
- case 8:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 3\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont2 & DC_HPD3_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont2 &= ~DC_HPD3_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 3\n");
-+
- break;
- case 9:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 4\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont3 & DC_HPD4_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont3 &= ~DC_HPD4_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 4\n");
-+
- break;
- case 10:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 5\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont4 & DC_HPD5_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont4 &= ~DC_HPD5_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 5\n");
-+
- break;
- case 11:
-- if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) {
-- rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-- queue_dp = true;
-- DRM_DEBUG("IH: HPD_RX 6\n");
-- }
-+ if (!(rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT))
-+ DRM_DEBUG("IH: IH event w/o asserted irq bit?\n");
-+
-+ rdev->irq.stat_regs.evergreen.disp_int_cont5 &= ~DC_HPD6_RX_INTERRUPT;
-+ queue_dp = true;
-+ DRM_DEBUG("IH: HPD_RX 6\n");
-+
- break;
- default:
- DRM_DEBUG("Unhandled interrupt: %d %d\n", src_id, src_data);
-diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
-index ff8b83f..9dfcede 100644
---- a/drivers/gpu/drm/radeon/si_dpm.c
-+++ b/drivers/gpu/drm/radeon/si_dpm.c
-@@ -2925,6 +2925,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
- /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
- { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
- { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
-+ { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
- { 0, 0, 0, 0 },
- };
-
-diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
-index eb2282c..eba5f8a 100644
---- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
-+++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c
-@@ -54,55 +54,56 @@ static void rockchip_gem_free_buf(struct rockchip_gem_object *rk_obj)
- &rk_obj->dma_attrs);
- }
-
--int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
-- struct vm_area_struct *vma)
-+static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj,
-+ struct vm_area_struct *vma)
-+
- {
-+ int ret;
- struct rockchip_gem_object *rk_obj = to_rockchip_obj(obj);
- struct drm_device *drm = obj->dev;
-- unsigned long vm_size;
-
-- vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP;
-- vm_size = vma->vm_end - vma->vm_start;
--
-- if (vm_size > obj->size)
-- return -EINVAL;
-+ /*
-+ * dma_alloc_attrs() allocated a struct page table for rk_obj, so clear
-+ * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap().
-+ */
-+ vma->vm_flags &= ~VM_PFNMAP;
-
-- return dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
-+ ret = dma_mmap_attrs(drm->dev, vma, rk_obj->kvaddr, rk_obj->dma_addr,
- obj->size, &rk_obj->dma_attrs);
-+ if (ret)
-+ drm_gem_vm_close(vma);
-+
-+ return ret;
- }
-
--/* drm driver mmap file operations */
--int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
-+int rockchip_gem_mmap_buf(struct drm_gem_object *obj,
-+ struct vm_area_struct *vma)
- {
-- struct drm_file *priv = filp->private_data;
-- struct drm_device *dev = priv->minor->dev;
-- struct drm_gem_object *obj;
-- struct drm_vma_offset_node *node;
-+ struct drm_device *drm = obj->dev;
- int ret;
-
-- if (drm_device_is_unplugged(dev))
-- return -ENODEV;
-+ mutex_lock(&drm->struct_mutex);
-+ ret = drm_gem_mmap_obj(obj, obj->size, vma);
-+ mutex_unlock(&drm->struct_mutex);
-+ if (ret)
-+ return ret;
-
-- mutex_lock(&dev->struct_mutex);
-+ return rockchip_drm_gem_object_mmap(obj, vma);
-+}
-
-- node = drm_vma_offset_exact_lookup(dev->vma_offset_manager,
-- vma->vm_pgoff,
-- vma_pages(vma));
-- if (!node) {
-- mutex_unlock(&dev->struct_mutex);
-- DRM_ERROR("failed to find vma node.\n");
-- return -EINVAL;
-- } else if (!drm_vma_node_is_allowed(node, filp)) {
-- mutex_unlock(&dev->struct_mutex);
-- return -EACCES;
-- }
-+/* drm driver mmap file operations */
-+int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma)
-+{
-+ struct drm_gem_object *obj;
-+ int ret;
-
-- obj = container_of(node, struct drm_gem_object, vma_node);
-- ret = rockchip_gem_mmap_buf(obj, vma);
-+ ret = drm_gem_mmap(filp, vma);
-+ if (ret)
-+ return ret;
-
-- mutex_unlock(&dev->struct_mutex);
-+ obj = vma->vm_private_data;
-
-- return ret;
-+ return rockchip_drm_gem_object_mmap(obj, vma);
- }
-
- struct rockchip_gem_object *
-diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
-index d6b55e3..a43a836 100644
---- a/drivers/gpu/drm/tegra/dpaux.c
-+++ b/drivers/gpu/drm/tegra/dpaux.c
-@@ -72,34 +72,32 @@ static inline void tegra_dpaux_writel(struct tegra_dpaux *dpaux,
- static void tegra_dpaux_write_fifo(struct tegra_dpaux *dpaux, const u8 *buffer,
- size_t size)
- {
-- unsigned long offset = DPAUX_DP_AUXDATA_WRITE(0);
- size_t i, j;
-
-- for (i = 0; i < size; i += 4) {
-- size_t num = min_t(size_t, size - i, 4);
-+ for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
-+ size_t num = min_t(size_t, size - i * 4, 4);
- unsigned long value = 0;
-
- for (j = 0; j < num; j++)
-- value |= buffer[i + j] << (j * 8);
-+ value |= buffer[i * 4 + j] << (j * 8);
-
-- tegra_dpaux_writel(dpaux, value, offset++);
-+ tegra_dpaux_writel(dpaux, value, DPAUX_DP_AUXDATA_WRITE(i));
- }
- }
-
- static void tegra_dpaux_read_fifo(struct tegra_dpaux *dpaux, u8 *buffer,
- size_t size)
- {
-- unsigned long offset = DPAUX_DP_AUXDATA_READ(0);
- size_t i, j;
-
-- for (i = 0; i < size; i += 4) {
-- size_t num = min_t(size_t, size - i, 4);
-+ for (i = 0; i < DIV_ROUND_UP(size, 4); i++) {
-+ size_t num = min_t(size_t, size - i * 4, 4);
- unsigned long value;
-
-- value = tegra_dpaux_readl(dpaux, offset++);
-+ value = tegra_dpaux_readl(dpaux, DPAUX_DP_AUXDATA_READ(i));
-
- for (j = 0; j < num; j++)
-- buffer[i + j] = value >> (j * 8);
-+ buffer[i * 4 + j] = value >> (j * 8);
- }
- }
-
-diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c
-index 7a207ca..6394547 100644
---- a/drivers/gpu/drm/vgem/vgem_drv.c
-+++ b/drivers/gpu/drm/vgem/vgem_drv.c
-@@ -328,6 +328,8 @@ static int __init vgem_init(void)
- goto out;
- }
-
-+ drm_dev_set_unique(vgem_device, "vgem");
-+
- ret = drm_dev_register(vgem_device, 0);
-
- if (ret)
-diff --git a/drivers/hwmon/mcp3021.c b/drivers/hwmon/mcp3021.c
-index d219c06..972444a 100644
---- a/drivers/hwmon/mcp3021.c
-+++ b/drivers/hwmon/mcp3021.c
-@@ -31,14 +31,11 @@
- /* output format */
- #define MCP3021_SAR_SHIFT 2
- #define MCP3021_SAR_MASK 0x3ff
--
- #define MCP3021_OUTPUT_RES 10 /* 10-bit resolution */
--#define MCP3021_OUTPUT_SCALE 4
-
- #define MCP3221_SAR_SHIFT 0
- #define MCP3221_SAR_MASK 0xfff
- #define MCP3221_OUTPUT_RES 12 /* 12-bit resolution */
--#define MCP3221_OUTPUT_SCALE 1
-
- enum chips {
- mcp3021,
-@@ -54,7 +51,6 @@ struct mcp3021_data {
- u16 sar_shift;
- u16 sar_mask;
- u8 output_res;
-- u8 output_scale;
- };
-
- static int mcp3021_read16(struct i2c_client *client)
-@@ -84,13 +80,7 @@ static int mcp3021_read16(struct i2c_client *client)
-
- static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
- {
-- if (val == 0)
-- return 0;
--
-- val = val * data->output_scale - data->output_scale / 2;
--
-- return val * DIV_ROUND_CLOSEST(data->vdd,
-- (1 << data->output_res) * data->output_scale);
-+ return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
- }
-
- static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
-@@ -132,14 +122,12 @@ static int mcp3021_probe(struct i2c_client *client,
- data->sar_shift = MCP3021_SAR_SHIFT;
- data->sar_mask = MCP3021_SAR_MASK;
- data->output_res = MCP3021_OUTPUT_RES;
-- data->output_scale = MCP3021_OUTPUT_SCALE;
- break;
-
- case mcp3221:
- data->sar_shift = MCP3221_SAR_SHIFT;
- data->sar_mask = MCP3221_SAR_MASK;
- data->output_res = MCP3221_OUTPUT_RES;
-- data->output_scale = MCP3221_OUTPUT_SCALE;
- break;
- }
-
-diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
-index 5576579..28fcb2e 100644
---- a/drivers/hwmon/nct7802.c
-+++ b/drivers/hwmon/nct7802.c
-@@ -547,7 +547,7 @@ static umode_t nct7802_temp_is_visible(struct kobject *kobj,
- if (index >= 9 && index < 18 &&
- (reg & 0x0c) != 0x04 && (reg & 0x0c) != 0x08) /* RD2 */
- return 0;
-- if (index >= 18 && index < 27 && (reg & 0x30) != 0x10) /* RD3 */
-+ if (index >= 18 && index < 27 && (reg & 0x30) != 0x20) /* RD3 */
- return 0;
- if (index >= 27 && index < 35) /* local */
- return attr->mode;
-diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c
-index ff23d1b..9bd10a9 100644
---- a/drivers/i2c/busses/i2c-at91.c
-+++ b/drivers/i2c/busses/i2c-at91.c
-@@ -65,6 +65,9 @@
- #define AT91_TWI_UNRE 0x0080 /* Underrun Error */
- #define AT91_TWI_NACK 0x0100 /* Not Acknowledged */
-
-+#define AT91_TWI_INT_MASK \
-+ (AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY | AT91_TWI_NACK)
-+
- #define AT91_TWI_IER 0x0024 /* Interrupt Enable Register */
- #define AT91_TWI_IDR 0x0028 /* Interrupt Disable Register */
- #define AT91_TWI_IMR 0x002c /* Interrupt Mask Register */
-@@ -119,13 +122,12 @@ static void at91_twi_write(struct at91_twi_dev *dev, unsigned reg, unsigned val)
-
- static void at91_disable_twi_interrupts(struct at91_twi_dev *dev)
- {
-- at91_twi_write(dev, AT91_TWI_IDR,
-- AT91_TWI_TXCOMP | AT91_TWI_RXRDY | AT91_TWI_TXRDY);
-+ at91_twi_write(dev, AT91_TWI_IDR, AT91_TWI_INT_MASK);
- }
-
- static void at91_twi_irq_save(struct at91_twi_dev *dev)
- {
-- dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & 0x7;
-+ dev->imr = at91_twi_read(dev, AT91_TWI_IMR) & AT91_TWI_INT_MASK;
- at91_disable_twi_interrupts(dev);
- }
-
-@@ -215,6 +217,14 @@ static void at91_twi_write_data_dma_callback(void *data)
- dma_unmap_single(dev->dev, sg_dma_address(&dev->dma.sg),
- dev->buf_len, DMA_TO_DEVICE);
-
-+ /*
-+ * When this callback is called, THR/TX FIFO is likely not to be empty
-+ * yet. So we have to wait for TXCOMP or NACK bits to be set into the
-+ * Status Register to be sure that the STOP bit has been sent and the
-+ * transfer is completed. The NACK interrupt has already been enabled,
-+ * we just have to enable TXCOMP one.
-+ */
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- at91_twi_write(dev, AT91_TWI_CR, AT91_TWI_STOP);
- }
-
-@@ -309,7 +319,7 @@ static void at91_twi_read_data_dma_callback(void *data)
- /* The last two bytes have to be read without using dma */
- dev->buf += dev->buf_len - 2;
- dev->buf_len = 2;
-- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY);
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_RXRDY | AT91_TWI_TXCOMP);
- }
-
- static void at91_twi_read_data_dma(struct at91_twi_dev *dev)
-@@ -370,7 +380,7 @@ static irqreturn_t atmel_twi_interrupt(int irq, void *dev_id)
- /* catch error flags */
- dev->transfer_status |= status;
-
-- if (irqstatus & AT91_TWI_TXCOMP) {
-+ if (irqstatus & (AT91_TWI_TXCOMP | AT91_TWI_NACK)) {
- at91_disable_twi_interrupts(dev);
- complete(&dev->cmd_complete);
- }
-@@ -384,6 +394,34 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- unsigned long time_left;
- bool has_unre_flag = dev->pdata->has_unre_flag;
-
-+ /*
-+ * WARNING: the TXCOMP bit in the Status Register is NOT a clear on
-+ * read flag but shows the state of the transmission at the time the
-+ * Status Register is read. According to the programmer datasheet,
-+ * TXCOMP is set when both holding register and internal shifter are
-+ * empty and STOP condition has been sent.
-+ * Consequently, we should enable NACK interrupt rather than TXCOMP to
-+ * detect transmission failure.
-+ *
-+ * Besides, the TXCOMP bit is already set before the i2c transaction
-+ * has been started. For read transactions, this bit is cleared when
-+ * writing the START bit into the Control Register. So the
-+ * corresponding interrupt can safely be enabled just after.
-+ * However for write transactions managed by the CPU, we first write
-+ * into THR, so TXCOMP is cleared. Then we can safely enable TXCOMP
-+ * interrupt. If TXCOMP interrupt were enabled before writing into THR,
-+ * the interrupt handler would be called immediately and the i2c command
-+ * would be reported as completed.
-+ * Also when a write transaction is managed by the DMA controller,
-+ * enabling the TXCOMP interrupt in this function may lead to a race
-+ * condition since we don't know whether the TXCOMP interrupt is enabled
-+ * before or after the DMA has started to write into THR. So the TXCOMP
-+ * interrupt is enabled later by at91_twi_write_data_dma_callback().
-+ * Immediately after in that DMA callback, we still need to send the
-+ * STOP condition manually writing the corresponding bit into the
-+ * Control Register.
-+ */
-+
- dev_dbg(dev->dev, "transfer: %s %d bytes.\n",
- (dev->msg->flags & I2C_M_RD) ? "read" : "write", dev->buf_len);
-
-@@ -414,26 +452,24 @@ static int at91_do_twi_transfer(struct at91_twi_dev *dev)
- * seems to be the best solution.
- */
- if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- at91_twi_read_data_dma(dev);
-- /*
-- * It is important to enable TXCOMP irq here because
-- * doing it only when transferring the last two bytes
-- * will mask NACK errors since TXCOMP is set when a
-- * NACK occurs.
-- */
-- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP);
-- } else
-+ } else {
- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP | AT91_TWI_RXRDY);
-+ AT91_TWI_TXCOMP |
-+ AT91_TWI_NACK |
-+ AT91_TWI_RXRDY);
-+ }
- } else {
- if (dev->use_dma && (dev->buf_len > AT91_I2C_DMA_THRESHOLD)) {
-+ at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_NACK);
- at91_twi_write_data_dma(dev);
-- at91_twi_write(dev, AT91_TWI_IER, AT91_TWI_TXCOMP);
- } else {
- at91_twi_write_next_byte(dev);
- at91_twi_write(dev, AT91_TWI_IER,
-- AT91_TWI_TXCOMP | AT91_TWI_TXRDY);
-+ AT91_TWI_TXCOMP |
-+ AT91_TWI_NACK |
-+ AT91_TWI_TXRDY);
- }
- }
-
-diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
-index 06cc1ff..2ba7c0f 100644
---- a/drivers/i2c/i2c-mux.c
-+++ b/drivers/i2c/i2c-mux.c
-@@ -51,7 +51,7 @@ static int i2c_mux_master_xfer(struct i2c_adapter *adap,
-
- ret = priv->select(parent, priv->mux_priv, priv->chan_id);
- if (ret >= 0)
-- ret = parent->algo->master_xfer(parent, msgs, num);
-+ ret = __i2c_transfer(parent, msgs, num);
- if (priv->deselect)
- priv->deselect(parent, priv->mux_priv, priv->chan_id);
-
-@@ -144,6 +144,7 @@ struct i2c_adapter *i2c_add_mux_adapter(struct i2c_adapter *parent,
- priv->adap.dev.parent = &parent->dev;
- priv->adap.retries = parent->retries;
- priv->adap.timeout = parent->timeout;
-+ priv->adap.quirks = parent->quirks;
-
- /* Sanity check on class */
- if (i2c_mux_parent_classes(parent) & class)
-diff --git a/drivers/i2c/muxes/i2c-mux-pca9541.c b/drivers/i2c/muxes/i2c-mux-pca9541.c
-index cb77277..0c8d4d2 100644
---- a/drivers/i2c/muxes/i2c-mux-pca9541.c
-+++ b/drivers/i2c/muxes/i2c-mux-pca9541.c
-@@ -104,7 +104,7 @@ static int pca9541_reg_write(struct i2c_client *client, u8 command, u8 val)
- buf[0] = command;
- buf[1] = val;
- msg.buf = buf;
-- ret = adap->algo->master_xfer(adap, &msg, 1);
-+ ret = __i2c_transfer(adap, &msg, 1);
- } else {
- union i2c_smbus_data data;
-
-@@ -144,7 +144,7 @@ static int pca9541_reg_read(struct i2c_client *client, u8 command)
- .buf = &val
- }
- };
-- ret = adap->algo->master_xfer(adap, msg, 2);
-+ ret = __i2c_transfer(adap, msg, 2);
- if (ret == 2)
- ret = val;
- else if (ret >= 0)
-diff --git a/drivers/i2c/muxes/i2c-mux-pca954x.c b/drivers/i2c/muxes/i2c-mux-pca954x.c
-index bea0d2d..ea4aa9d 100644
---- a/drivers/i2c/muxes/i2c-mux-pca954x.c
-+++ b/drivers/i2c/muxes/i2c-mux-pca954x.c
-@@ -134,7 +134,7 @@ static int pca954x_reg_write(struct i2c_adapter *adap,
- msg.len = 1;
- buf[0] = val;
- msg.buf = buf;
-- ret = adap->algo->master_xfer(adap, &msg, 1);
-+ ret = __i2c_transfer(adap, &msg, 1);
- } else {
- union i2c_smbus_data data;
- ret = adap->algo->smbus_xfer(adap, client->addr,
-diff --git a/drivers/iio/accel/bmc150-accel.c b/drivers/iio/accel/bmc150-accel.c
-index 73e8773..bf827d0 100644
---- a/drivers/iio/accel/bmc150-accel.c
-+++ b/drivers/iio/accel/bmc150-accel.c
-@@ -1465,7 +1465,7 @@ static void bmc150_accel_unregister_triggers(struct bmc150_accel_data *data,
- {
- int i;
-
-- for (i = from; i >= 0; i++) {
-+ for (i = from; i >= 0; i--) {
- if (data->triggers[i].indio_trig) {
- iio_trigger_unregister(data->triggers[i].indio_trig);
- data->triggers[i].indio_trig = NULL;
-diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig
-index e36a73e..1bcb65b 100644
---- a/drivers/iio/adc/Kconfig
-+++ b/drivers/iio/adc/Kconfig
-@@ -146,8 +146,7 @@ config DA9150_GPADC
-
- config CC10001_ADC
- tristate "Cosmic Circuits 10001 ADC driver"
-- depends on HAVE_CLK || REGULATOR
-- depends on HAS_IOMEM
-+ depends on HAS_IOMEM && HAVE_CLK && REGULATOR
- select IIO_BUFFER
- select IIO_TRIGGERED_BUFFER
- help
-diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
-index 8a0eb4a..7b40925 100644
---- a/drivers/iio/adc/at91_adc.c
-+++ b/drivers/iio/adc/at91_adc.c
-@@ -182,7 +182,7 @@ struct at91_adc_caps {
- u8 ts_pen_detect_sensitivity;
-
- /* startup time calculate function */
-- u32 (*calc_startup_ticks)(u8 startup_time, u32 adc_clk_khz);
-+ u32 (*calc_startup_ticks)(u32 startup_time, u32 adc_clk_khz);
-
- u8 num_channels;
- struct at91_adc_reg_desc registers;
-@@ -201,7 +201,7 @@ struct at91_adc_state {
- u8 num_channels;
- void __iomem *reg_base;
- struct at91_adc_reg_desc *registers;
-- u8 startup_time;
-+ u32 startup_time;
- u8 sample_hold_time;
- bool sleep_mode;
- struct iio_trigger **trig;
-@@ -779,7 +779,7 @@ ret:
- return ret;
- }
-
--static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9260(u32 startup_time, u32 adc_clk_khz)
- {
- /*
- * Number of ticks needed to cover the startup time of the ADC
-@@ -790,7 +790,7 @@ static u32 calc_startup_ticks_9260(u8 startup_time, u32 adc_clk_khz)
- return round_up((startup_time * adc_clk_khz / 1000) - 1, 8) / 8;
- }
-
--static u32 calc_startup_ticks_9x5(u8 startup_time, u32 adc_clk_khz)
-+static u32 calc_startup_ticks_9x5(u32 startup_time, u32 adc_clk_khz)
- {
- /*
- * For sama5d3x and at91sam9x5, the formula changes to:
-diff --git a/drivers/iio/adc/rockchip_saradc.c b/drivers/iio/adc/rockchip_saradc.c
-index 8d4e019..9c311c1 100644
---- a/drivers/iio/adc/rockchip_saradc.c
-+++ b/drivers/iio/adc/rockchip_saradc.c
-@@ -349,3 +349,7 @@ static struct platform_driver rockchip_saradc_driver = {
- };
-
- module_platform_driver(rockchip_saradc_driver);
-+
-+MODULE_AUTHOR("Heiko Stuebner <heiko@sntech.de>");
-+MODULE_DESCRIPTION("Rockchip SARADC driver");
-+MODULE_LICENSE("GPL v2");
-diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c
-index 94c5f05..4caecbe 100644
---- a/drivers/iio/adc/twl4030-madc.c
-+++ b/drivers/iio/adc/twl4030-madc.c
-@@ -835,7 +835,8 @@ static int twl4030_madc_probe(struct platform_device *pdev)
- irq = platform_get_irq(pdev, 0);
- ret = devm_request_threaded_irq(&pdev->dev, irq, NULL,
- twl4030_madc_threaded_irq_handler,
-- IRQF_TRIGGER_RISING, "twl4030_madc", madc);
-+ IRQF_TRIGGER_RISING | IRQF_ONESHOT,
-+ "twl4030_madc", madc);
- if (ret) {
- dev_err(&pdev->dev, "could not request irq\n");
- goto err_i2c;
-diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
-index 610fc98..5955110 100644
---- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
-+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
-@@ -36,6 +36,8 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
- s32 poll_value = 0;
-
- if (state) {
-+ if (!atomic_read(&st->user_requested_state))
-+ return 0;
- if (sensor_hub_device_open(st->hsdev))
- return -EIO;
-
-@@ -52,8 +54,12 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
-
- poll_value = hid_sensor_read_poll_value(st);
- } else {
-- if (!atomic_dec_and_test(&st->data_ready))
-+ int val;
-+
-+ val = atomic_dec_if_positive(&st->data_ready);
-+ if (val < 0)
- return 0;
-+
- sensor_hub_device_close(st->hsdev);
- state_val = hid_sensor_get_usage_index(st->hsdev,
- st->power_state.report_id,
-@@ -92,9 +98,11 @@ EXPORT_SYMBOL(hid_sensor_power_state);
-
- int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
- {
-+
- #ifdef CONFIG_PM
- int ret;
-
-+ atomic_set(&st->user_requested_state, state);
- if (state)
- ret = pm_runtime_get_sync(&st->pdev->dev);
- else {
-@@ -109,6 +117,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
-
- return 0;
- #else
-+ atomic_set(&st->user_requested_state, state);
- return _hid_sensor_power_state(st, state);
- #endif
- }
-diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
-index 61bb9d4..e98428d 100644
---- a/drivers/iio/dac/ad5624r_spi.c
-+++ b/drivers/iio/dac/ad5624r_spi.c
-@@ -22,7 +22,7 @@
- #include "ad5624r.h"
-
- static int ad5624r_spi_write(struct spi_device *spi,
-- u8 cmd, u8 addr, u16 val, u8 len)
-+ u8 cmd, u8 addr, u16 val, u8 shift)
- {
- u32 data;
- u8 msg[3];
-@@ -35,7 +35,7 @@ static int ad5624r_spi_write(struct spi_device *spi,
- * 14-, 12-bit input code followed by 0, 2, or 4 don't care bits,
- * for the AD5664R, AD5644R, and AD5624R, respectively.
- */
-- data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << (16 - len));
-+ data = (0 << 22) | (cmd << 19) | (addr << 16) | (val << shift);
- msg[0] = data >> 16;
- msg[1] = data >> 8;
- msg[2] = data;
-diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
-index 17d4bb1..65ce868 100644
---- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
-+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
-@@ -431,6 +431,23 @@ static int inv_mpu6050_write_gyro_scale(struct inv_mpu6050_state *st, int val)
- return -EINVAL;
- }
-
-+static int inv_write_raw_get_fmt(struct iio_dev *indio_dev,
-+ struct iio_chan_spec const *chan, long mask)
-+{
-+ switch (mask) {
-+ case IIO_CHAN_INFO_SCALE:
-+ switch (chan->type) {
-+ case IIO_ANGL_VEL:
-+ return IIO_VAL_INT_PLUS_NANO;
-+ default:
-+ return IIO_VAL_INT_PLUS_MICRO;
-+ }
-+ default:
-+ return IIO_VAL_INT_PLUS_MICRO;
-+ }
-+
-+ return -EINVAL;
-+}
- static int inv_mpu6050_write_accel_scale(struct inv_mpu6050_state *st, int val)
- {
- int result, i;
-@@ -696,6 +713,7 @@ static const struct iio_info mpu_info = {
- .driver_module = THIS_MODULE,
- .read_raw = &inv_mpu6050_read_raw,
- .write_raw = &inv_mpu6050_write_raw,
-+ .write_raw_get_fmt = &inv_write_raw_get_fmt,
- .attrs = &inv_attribute_group,
- .validate_trigger = inv_mpu6050_validate_trigger,
- };
-diff --git a/drivers/iio/light/cm3323.c b/drivers/iio/light/cm3323.c
-index 869033e..a1d4905 100644
---- a/drivers/iio/light/cm3323.c
-+++ b/drivers/iio/light/cm3323.c
-@@ -123,7 +123,7 @@ static int cm3323_set_it_bits(struct cm3323_data *data, int val, int val2)
- for (i = 0; i < ARRAY_SIZE(cm3323_int_time); i++) {
- if (val == cm3323_int_time[i].val &&
- val2 == cm3323_int_time[i].val2) {
-- reg_conf = data->reg_conf;
-+ reg_conf = data->reg_conf & ~CM3323_CONF_IT_MASK;
- reg_conf |= i << CM3323_CONF_IT_SHIFT;
-
- ret = i2c_smbus_write_word_data(data->client,
-diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c
-index 71c2bde..f8b1df0 100644
---- a/drivers/iio/light/tcs3414.c
-+++ b/drivers/iio/light/tcs3414.c
-@@ -185,7 +185,7 @@ static int tcs3414_write_raw(struct iio_dev *indio_dev,
- if (val != 0)
- return -EINVAL;
- for (i = 0; i < ARRAY_SIZE(tcs3414_times); i++) {
-- if (val == tcs3414_times[i] * 1000) {
-+ if (val2 == tcs3414_times[i] * 1000) {
- data->timing &= ~TCS3414_INTEG_MASK;
- data->timing |= i;
- return i2c_smbus_write_byte_data(
-diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
-index fa40f6d..bd26a48 100644
---- a/drivers/iio/proximity/sx9500.c
-+++ b/drivers/iio/proximity/sx9500.c
-@@ -206,7 +206,7 @@ static int sx9500_read_proximity(struct sx9500_data *data,
- if (ret < 0)
- return ret;
-
-- *val = 32767 - (s16)be16_to_cpu(regval);
-+ *val = be16_to_cpu(regval);
-
- return IIO_VAL_INT;
- }
-diff --git a/drivers/iio/temperature/tmp006.c b/drivers/iio/temperature/tmp006.c
-index 84a0789..7a80509 100644
---- a/drivers/iio/temperature/tmp006.c
-+++ b/drivers/iio/temperature/tmp006.c
-@@ -132,6 +132,9 @@ static int tmp006_write_raw(struct iio_dev *indio_dev,
- struct tmp006_data *data = iio_priv(indio_dev);
- int i;
-
-+ if (mask != IIO_CHAN_INFO_SAMP_FREQ)
-+ return -EINVAL;
-+
- for (i = 0; i < ARRAY_SIZE(tmp006_freqs); i++)
- if ((val == tmp006_freqs[i][0]) &&
- (val2 == tmp006_freqs[i][1])) {
-diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
-index 9dcb660..219f212 100644
---- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
-+++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c
-@@ -679,7 +679,6 @@ err:
- ocrdma_release_ucontext_pd(uctx);
- } else {
- status = _ocrdma_dealloc_pd(dev, pd);
-- kfree(pd);
- }
- exit:
- return ERR_PTR(status);
-diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
-index 135a090..c90118e 100644
---- a/drivers/md/bitmap.c
-+++ b/drivers/md/bitmap.c
-@@ -494,7 +494,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
- bitmap_super_t *sb;
- unsigned long chunksize, daemon_sleep, write_behind;
-
-- bitmap->storage.sb_page = alloc_page(GFP_KERNEL);
-+ bitmap->storage.sb_page = alloc_page(GFP_KERNEL | __GFP_ZERO);
- if (bitmap->storage.sb_page == NULL)
- return -ENOMEM;
- bitmap->storage.sb_page->index = 0;
-@@ -541,6 +541,7 @@ static int bitmap_new_disk_sb(struct bitmap *bitmap)
- sb->state = cpu_to_le32(bitmap->flags);
- bitmap->events_cleared = bitmap->mddev->events;
- sb->events_cleared = cpu_to_le64(bitmap->mddev->events);
-+ bitmap->mddev->bitmap_info.nodes = 0;
-
- kunmap_atomic(sb);
-
-@@ -611,8 +612,16 @@ re_read:
- daemon_sleep = le32_to_cpu(sb->daemon_sleep) * HZ;
- write_behind = le32_to_cpu(sb->write_behind);
- sectors_reserved = le32_to_cpu(sb->sectors_reserved);
-- nodes = le32_to_cpu(sb->nodes);
-- strlcpy(bitmap->mddev->bitmap_info.cluster_name, sb->cluster_name, 64);
-+ /* XXX: This is a hack to ensure that we don't use clustering
-+ * in case:
-+ * - dm-raid is in use and
-+ * - the nodes written in bitmap_sb is erroneous.
-+ */
-+ if (!bitmap->mddev->sync_super) {
-+ nodes = le32_to_cpu(sb->nodes);
-+ strlcpy(bitmap->mddev->bitmap_info.cluster_name,
-+ sb->cluster_name, 64);
-+ }
-
- /* verify that the bitmap-specific fields are valid */
- if (sb->magic != cpu_to_le32(BITMAP_MAGIC))
-diff --git a/drivers/md/dm-cache-policy-cleaner.c b/drivers/md/dm-cache-policy-cleaner.c
-index b04d1f9..004e463 100644
---- a/drivers/md/dm-cache-policy-cleaner.c
-+++ b/drivers/md/dm-cache-policy-cleaner.c
-@@ -171,7 +171,8 @@ static void remove_cache_hash_entry(struct wb_cache_entry *e)
- /* Public interface (see dm-cache-policy.h */
- static int wb_map(struct dm_cache_policy *pe, dm_oblock_t oblock,
- bool can_block, bool can_migrate, bool discarded_oblock,
-- struct bio *bio, struct policy_result *result)
-+ struct bio *bio, struct policy_locker *locker,
-+ struct policy_result *result)
- {
- struct policy *p = to_policy(pe);
- struct wb_cache_entry *e;
-diff --git a/drivers/md/dm-cache-policy-internal.h b/drivers/md/dm-cache-policy-internal.h
-index 2256a1f..c198e6d 100644
---- a/drivers/md/dm-cache-policy-internal.h
-+++ b/drivers/md/dm-cache-policy-internal.h
-@@ -16,9 +16,10 @@
- */
- static inline int policy_map(struct dm_cache_policy *p, dm_oblock_t oblock,
- bool can_block, bool can_migrate, bool discarded_oblock,
-- struct bio *bio, struct policy_result *result)
-+ struct bio *bio, struct policy_locker *locker,
-+ struct policy_result *result)
- {
-- return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, result);
-+ return p->map(p, oblock, can_block, can_migrate, discarded_oblock, bio, locker, result);
- }
-
- static inline int policy_lookup(struct dm_cache_policy *p, dm_oblock_t oblock, dm_cblock_t *cblock)
-diff --git a/drivers/md/dm-cache-policy-mq.c b/drivers/md/dm-cache-policy-mq.c
-index 3ddd116..515d44b 100644
---- a/drivers/md/dm-cache-policy-mq.c
-+++ b/drivers/md/dm-cache-policy-mq.c
-@@ -693,9 +693,10 @@ static void requeue(struct mq_policy *mq, struct entry *e)
- * - set the hit count to a hard coded value other than 1, eg, is it better
- * if it goes in at level 2?
- */
--static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock)
-+static int demote_cblock(struct mq_policy *mq,
-+ struct policy_locker *locker, dm_oblock_t *oblock)
- {
-- struct entry *demoted = pop(mq, &mq->cache_clean);
-+ struct entry *demoted = peek(&mq->cache_clean);
-
- if (!demoted)
- /*
-@@ -707,6 +708,13 @@ static int demote_cblock(struct mq_policy *mq, dm_oblock_t *oblock)
- */
- return -ENOSPC;
-
-+ if (locker->fn(locker, demoted->oblock))
-+ /*
-+ * We couldn't lock the demoted block.
-+ */
-+ return -EBUSY;
-+
-+ del(mq, demoted);
- *oblock = demoted->oblock;
- free_entry(&mq->cache_pool, demoted);
-
-@@ -795,6 +803,7 @@ static int cache_entry_found(struct mq_policy *mq,
- * finding which cache block to use.
- */
- static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
-+ struct policy_locker *locker,
- struct policy_result *result)
- {
- int r;
-@@ -803,11 +812,12 @@ static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
- /* Ensure there's a free cblock in the cache */
- if (epool_empty(&mq->cache_pool)) {
- result->op = POLICY_REPLACE;
-- r = demote_cblock(mq, &result->old_oblock);
-+ r = demote_cblock(mq, locker, &result->old_oblock);
- if (r) {
- result->op = POLICY_MISS;
- return 0;
- }
-+
- } else
- result->op = POLICY_NEW;
-
-@@ -829,7 +839,8 @@ static int pre_cache_to_cache(struct mq_policy *mq, struct entry *e,
-
- static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
- bool can_migrate, bool discarded_oblock,
-- int data_dir, struct policy_result *result)
-+ int data_dir, struct policy_locker *locker,
-+ struct policy_result *result)
- {
- int r = 0;
-
-@@ -842,7 +853,7 @@ static int pre_cache_entry_found(struct mq_policy *mq, struct entry *e,
-
- else {
- requeue(mq, e);
-- r = pre_cache_to_cache(mq, e, result);
-+ r = pre_cache_to_cache(mq, e, locker, result);
- }
-
- return r;
-@@ -872,6 +883,7 @@ static void insert_in_pre_cache(struct mq_policy *mq,
- }
-
- static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
-+ struct policy_locker *locker,
- struct policy_result *result)
- {
- int r;
-@@ -879,7 +891,7 @@ static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
-
- if (epool_empty(&mq->cache_pool)) {
- result->op = POLICY_REPLACE;
-- r = demote_cblock(mq, &result->old_oblock);
-+ r = demote_cblock(mq, locker, &result->old_oblock);
- if (unlikely(r)) {
- result->op = POLICY_MISS;
- insert_in_pre_cache(mq, oblock);
-@@ -907,11 +919,12 @@ static void insert_in_cache(struct mq_policy *mq, dm_oblock_t oblock,
-
- static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock,
- bool can_migrate, bool discarded_oblock,
-- int data_dir, struct policy_result *result)
-+ int data_dir, struct policy_locker *locker,
-+ struct policy_result *result)
- {
- if (adjusted_promote_threshold(mq, discarded_oblock, data_dir) <= 1) {
- if (can_migrate)
-- insert_in_cache(mq, oblock, result);
-+ insert_in_cache(mq, oblock, locker, result);
- else
- return -EWOULDBLOCK;
- } else {
-@@ -928,7 +941,8 @@ static int no_entry_found(struct mq_policy *mq, dm_oblock_t oblock,
- */
- static int map(struct mq_policy *mq, dm_oblock_t oblock,
- bool can_migrate, bool discarded_oblock,
-- int data_dir, struct policy_result *result)
-+ int data_dir, struct policy_locker *locker,
-+ struct policy_result *result)
- {
- int r = 0;
- struct entry *e = hash_lookup(mq, oblock);
-@@ -942,11 +956,11 @@ static int map(struct mq_policy *mq, dm_oblock_t oblock,
-
- else if (e)
- r = pre_cache_entry_found(mq, e, can_migrate, discarded_oblock,
-- data_dir, result);
-+ data_dir, locker, result);
-
- else
- r = no_entry_found(mq, oblock, can_migrate, discarded_oblock,
-- data_dir, result);
-+ data_dir, locker, result);
-
- if (r == -EWOULDBLOCK)
- result->op = POLICY_MISS;
-@@ -1012,7 +1026,8 @@ static void copy_tick(struct mq_policy *mq)
-
- static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock,
- bool can_block, bool can_migrate, bool discarded_oblock,
-- struct bio *bio, struct policy_result *result)
-+ struct bio *bio, struct policy_locker *locker,
-+ struct policy_result *result)
- {
- int r;
- struct mq_policy *mq = to_mq_policy(p);
-@@ -1028,7 +1043,7 @@ static int mq_map(struct dm_cache_policy *p, dm_oblock_t oblock,
-
- iot_examine_bio(&mq->tracker, bio);
- r = map(mq, oblock, can_migrate, discarded_oblock,
-- bio_data_dir(bio), result);
-+ bio_data_dir(bio), locker, result);
-
- mutex_unlock(&mq->lock);
-
-diff --git a/drivers/md/dm-cache-policy.h b/drivers/md/dm-cache-policy.h
-index f50fe36..5524e21 100644
---- a/drivers/md/dm-cache-policy.h
-+++ b/drivers/md/dm-cache-policy.h
-@@ -70,6 +70,18 @@ enum policy_operation {
- };
-
- /*
-+ * When issuing a POLICY_REPLACE the policy needs to make a callback to
-+ * lock the block being demoted. This doesn't need to occur during a
-+ * writeback operation since the block remains in the cache.
-+ */
-+struct policy_locker;
-+typedef int (*policy_lock_fn)(struct policy_locker *l, dm_oblock_t oblock);
-+
-+struct policy_locker {
-+ policy_lock_fn fn;
-+};
-+
-+/*
- * This is the instruction passed back to the core target.
- */
- struct policy_result {
-@@ -122,7 +134,8 @@ struct dm_cache_policy {
- */
- int (*map)(struct dm_cache_policy *p, dm_oblock_t oblock,
- bool can_block, bool can_migrate, bool discarded_oblock,
-- struct bio *bio, struct policy_result *result);
-+ struct bio *bio, struct policy_locker *locker,
-+ struct policy_result *result);
-
- /*
- * Sometimes we want to see if a block is in the cache, without
-diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c
-index 7755af3..e049bec 100644
---- a/drivers/md/dm-cache-target.c
-+++ b/drivers/md/dm-cache-target.c
-@@ -1445,16 +1445,43 @@ static void inc_miss_counter(struct cache *cache, struct bio *bio)
- &cache->stats.read_miss : &cache->stats.write_miss);
- }
-
-+/*----------------------------------------------------------------*/
-+
-+struct old_oblock_lock {
-+ struct policy_locker locker;
-+ struct cache *cache;
-+ struct prealloc *structs;
-+ struct dm_bio_prison_cell *cell;
-+};
-+
-+static int null_locker(struct policy_locker *locker, dm_oblock_t b)
-+{
-+ /* This should never be called */
-+ BUG();
-+ return 0;
-+}
-+
-+static int cell_locker(struct policy_locker *locker, dm_oblock_t b)
-+{
-+ struct old_oblock_lock *l = container_of(locker, struct old_oblock_lock, locker);
-+ struct dm_bio_prison_cell *cell_prealloc = prealloc_get_cell(l->structs);
-+
-+ return bio_detain(l->cache, b, NULL, cell_prealloc,
-+ (cell_free_fn) prealloc_put_cell,
-+ l->structs, &l->cell);
-+}
-+
- static void process_bio(struct cache *cache, struct prealloc *structs,
- struct bio *bio)
- {
- int r;
- bool release_cell = true;
- dm_oblock_t block = get_bio_block(cache, bio);
-- struct dm_bio_prison_cell *cell_prealloc, *old_ocell, *new_ocell;
-+ struct dm_bio_prison_cell *cell_prealloc, *new_ocell;
- struct policy_result lookup_result;
- bool passthrough = passthrough_mode(&cache->features);
- bool discarded_block, can_migrate;
-+ struct old_oblock_lock ool;
-
- /*
- * Check to see if that block is currently migrating.
-@@ -1469,8 +1496,12 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
- discarded_block = is_discarded_oblock(cache, block);
- can_migrate = !passthrough && (discarded_block || spare_migration_bandwidth(cache));
-
-+ ool.locker.fn = cell_locker;
-+ ool.cache = cache;
-+ ool.structs = structs;
-+ ool.cell = NULL;
- r = policy_map(cache->policy, block, true, can_migrate, discarded_block,
-- bio, &lookup_result);
-+ bio, &ool.locker, &lookup_result);
-
- if (r == -EWOULDBLOCK)
- /* migration has been denied */
-@@ -1527,27 +1558,11 @@ static void process_bio(struct cache *cache, struct prealloc *structs,
- break;
-
- case POLICY_REPLACE:
-- cell_prealloc = prealloc_get_cell(structs);
-- r = bio_detain(cache, lookup_result.old_oblock, bio, cell_prealloc,
-- (cell_free_fn) prealloc_put_cell,
-- structs, &old_ocell);
-- if (r > 0) {
-- /*
-- * We have to be careful to avoid lock inversion of
-- * the cells. So we back off, and wait for the
-- * old_ocell to become free.
-- */
-- policy_force_mapping(cache->policy, block,
-- lookup_result.old_oblock);
-- atomic_inc(&cache->stats.cache_cell_clash);
-- break;
-- }
- atomic_inc(&cache->stats.demotion);
- atomic_inc(&cache->stats.promotion);
--
- demote_then_promote(cache, structs, lookup_result.old_oblock,
- block, lookup_result.cblock,
-- old_ocell, new_ocell);
-+ ool.cell, new_ocell);
- release_cell = false;
- break;
-
-@@ -2595,6 +2610,9 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso
- bool discarded_block;
- struct policy_result lookup_result;
- struct per_bio_data *pb = init_per_bio_data(bio, pb_data_size);
-+ struct old_oblock_lock ool;
-+
-+ ool.locker.fn = null_locker;
-
- if (unlikely(from_oblock(block) >= from_oblock(cache->origin_blocks))) {
- /*
-@@ -2633,7 +2651,7 @@ static int __cache_map(struct cache *cache, struct bio *bio, struct dm_bio_priso
- discarded_block = is_discarded_oblock(cache, block);
-
- r = policy_map(cache->policy, block, false, can_migrate, discarded_block,
-- bio, &lookup_result);
-+ bio, &ool.locker, &lookup_result);
- if (r == -EWOULDBLOCK) {
- cell_defer(cache, *cell, true);
- return DM_MAPIO_SUBMITTED;
-diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c
-index f478a4c..419bdd4 100644
---- a/drivers/md/dm-stats.c
-+++ b/drivers/md/dm-stats.c
-@@ -795,6 +795,8 @@ static int message_stats_create(struct mapped_device *md,
- return -EINVAL;
-
- if (sscanf(argv[2], "/%u%c", &divisor, &dummy) == 1) {
-+ if (!divisor)
-+ return -EINVAL;
- step = end - start;
- if (do_div(step, divisor))
- step++;
-diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
-index 921aafd..e22e6c8 100644
---- a/drivers/md/dm-thin.c
-+++ b/drivers/md/dm-thin.c
-@@ -18,6 +18,7 @@
- #include <linux/init.h>
- #include <linux/module.h>
- #include <linux/slab.h>
-+#include <linux/vmalloc.h>
- #include <linux/sort.h>
- #include <linux/rbtree.h>
-
-@@ -260,7 +261,7 @@ struct pool {
- process_mapping_fn process_prepared_mapping;
- process_mapping_fn process_prepared_discard;
-
-- struct dm_bio_prison_cell *cell_sort_array[CELL_SORT_ARRAY_SIZE];
-+ struct dm_bio_prison_cell **cell_sort_array;
- };
-
- static enum pool_mode get_pool_mode(struct pool *pool);
-@@ -2499,6 +2500,7 @@ static void __pool_destroy(struct pool *pool)
- {
- __pool_table_remove(pool);
-
-+ vfree(pool->cell_sort_array);
- if (dm_pool_metadata_close(pool->pmd) < 0)
- DMWARN("%s: dm_pool_metadata_close() failed.", __func__);
-
-@@ -2611,6 +2613,13 @@ static struct pool *pool_create(struct mapped_device *pool_md,
- goto bad_mapping_pool;
- }
-
-+ pool->cell_sort_array = vmalloc(sizeof(*pool->cell_sort_array) * CELL_SORT_ARRAY_SIZE);
-+ if (!pool->cell_sort_array) {
-+ *error = "Error allocating cell sort array";
-+ err_p = ERR_PTR(-ENOMEM);
-+ goto bad_sort_array;
-+ }
-+
- pool->ref_count = 1;
- pool->last_commit_jiffies = jiffies;
- pool->pool_md = pool_md;
-@@ -2619,6 +2628,8 @@ static struct pool *pool_create(struct mapped_device *pool_md,
-
- return pool;
-
-+bad_sort_array:
-+ mempool_destroy(pool->mapping_pool);
- bad_mapping_pool:
- dm_deferred_set_destroy(pool->all_io_ds);
- bad_all_io_ds:
-diff --git a/drivers/md/md.c b/drivers/md/md.c
-index 4dbed4a..b920028 100644
---- a/drivers/md/md.c
-+++ b/drivers/md/md.c
-@@ -4005,8 +4005,10 @@ new_dev_store(struct mddev *mddev, const char *buf, size_t len)
- else
- rdev = md_import_device(dev, -1, -1);
-
-- if (IS_ERR(rdev))
-+ if (IS_ERR(rdev)) {
-+ mddev_unlock(mddev);
- return PTR_ERR(rdev);
-+ }
- err = bind_rdev_to_array(rdev, mddev);
- out:
- if (err)
-@@ -5159,6 +5161,7 @@ int md_run(struct mddev *mddev)
- mddev_detach(mddev);
- if (mddev->private)
- pers->free(mddev, mddev->private);
-+ mddev->private = NULL;
- module_put(pers->owner);
- bitmap_destroy(mddev);
- return err;
-@@ -5294,6 +5297,7 @@ static void md_clean(struct mddev *mddev)
- mddev->changed = 0;
- mddev->degraded = 0;
- mddev->safemode = 0;
-+ mddev->private = NULL;
- mddev->merge_check_needed = 0;
- mddev->bitmap_info.offset = 0;
- mddev->bitmap_info.default_offset = 0;
-@@ -5366,6 +5370,7 @@ static void __md_stop(struct mddev *mddev)
- mddev->pers = NULL;
- spin_unlock(&mddev->lock);
- pers->free(mddev, mddev->private);
-+ mddev->private = NULL;
- if (pers->sync_request && mddev->to_remove == NULL)
- mddev->to_remove = &md_redundancy_group;
- module_put(pers->owner);
-@@ -6375,7 +6380,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info)
- mddev->ctime != info->ctime ||
- mddev->level != info->level ||
- /* mddev->layout != info->layout || */
-- !mddev->persistent != info->not_persistent||
-+ mddev->persistent != !info->not_persistent ||
- mddev->chunk_sectors != info->chunk_size >> 9 ||
- /* ignore bottom 8 bits of state, and allow SB_BITMAP_PRESENT to change */
- ((state^info->state) & 0xfffffe00)
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index b88757c..a03178e 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -309,8 +309,8 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
-
- if (s < 0 && nr_center < -s) {
- /* not enough in central node */
-- shift(left, center, nr_center);
-- s = nr_center - target;
-+ shift(left, center, -nr_center);
-+ s += nr_center;
- shift(left, right, s);
- nr_right += s;
- } else
-@@ -323,7 +323,7 @@ static void redistribute3(struct dm_btree_info *info, struct btree_node *parent,
- if (s > 0 && nr_center < s) {
- /* not enough in central node */
- shift(center, right, nr_center);
-- s = target - nr_center;
-+ s -= nr_center;
- shift(left, right, s);
- nr_left -= s;
- } else
-diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c
-index 200ac12..fdd3793 100644
---- a/drivers/md/persistent-data/dm-btree.c
-+++ b/drivers/md/persistent-data/dm-btree.c
-@@ -255,7 +255,7 @@ int dm_btree_del(struct dm_btree_info *info, dm_block_t root)
- int r;
- struct del_stack *s;
-
-- s = kmalloc(sizeof(*s), GFP_KERNEL);
-+ s = kmalloc(sizeof(*s), GFP_NOIO);
- if (!s)
- return -ENOMEM;
- s->info = info;
-diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c
-index e8a9042..5309129 100644
---- a/drivers/md/persistent-data/dm-space-map-metadata.c
-+++ b/drivers/md/persistent-data/dm-space-map-metadata.c
-@@ -204,6 +204,27 @@ static void in(struct sm_metadata *smm)
- smm->recursion_count++;
- }
-
-+static int apply_bops(struct sm_metadata *smm)
-+{
-+ int r = 0;
-+
-+ while (!brb_empty(&smm->uncommitted)) {
-+ struct block_op bop;
-+
-+ r = brb_pop(&smm->uncommitted, &bop);
-+ if (r) {
-+ DMERR("bug in bop ring buffer");
-+ break;
-+ }
-+
-+ r = commit_bop(smm, &bop);
-+ if (r)
-+ break;
-+ }
-+
-+ return r;
-+}
-+
- static int out(struct sm_metadata *smm)
- {
- int r = 0;
-@@ -216,21 +237,8 @@ static int out(struct sm_metadata *smm)
- return -ENOMEM;
- }
-
-- if (smm->recursion_count == 1) {
-- while (!brb_empty(&smm->uncommitted)) {
-- struct block_op bop;
--
-- r = brb_pop(&smm->uncommitted, &bop);
-- if (r) {
-- DMERR("bug in bop ring buffer");
-- break;
-- }
--
-- r = commit_bop(smm, &bop);
-- if (r)
-- break;
-- }
-- }
-+ if (smm->recursion_count == 1)
-+ apply_bops(smm);
-
- smm->recursion_count--;
-
-@@ -704,6 +712,12 @@ static int sm_metadata_extend(struct dm_space_map *sm, dm_block_t extra_blocks)
- }
- old_len = smm->begin;
-
-+ r = apply_bops(smm);
-+ if (r) {
-+ DMERR("%s: apply_bops failed", __func__);
-+ goto out;
-+ }
-+
- r = sm_ll_commit(&smm->ll);
- if (r)
- goto out;
-@@ -773,6 +787,12 @@ int dm_sm_metadata_create(struct dm_space_map *sm,
- if (r)
- return r;
-
-+ r = apply_bops(smm);
-+ if (r) {
-+ DMERR("%s: apply_bops failed", __func__);
-+ return r;
-+ }
-+
- return sm_metadata_commit(sm);
- }
-
-diff --git a/drivers/media/dvb-frontends/af9013.c b/drivers/media/dvb-frontends/af9013.c
-index 8001690..ba6c8f6 100644
---- a/drivers/media/dvb-frontends/af9013.c
-+++ b/drivers/media/dvb-frontends/af9013.c
-@@ -605,6 +605,10 @@ static int af9013_set_frontend(struct dvb_frontend *fe)
- }
- }
-
-+ /* Return an error if can't find bandwidth or the right clock */
-+ if (i == ARRAY_SIZE(coeff_lut))
-+ return -EINVAL;
-+
- ret = af9013_wr_regs(state, 0xae00, coeff_lut[i].val,
- sizeof(coeff_lut[i].val));
- }
-diff --git a/drivers/media/dvb-frontends/cx24116.c b/drivers/media/dvb-frontends/cx24116.c
-index 2916d7c..7bc68b3 100644
---- a/drivers/media/dvb-frontends/cx24116.c
-+++ b/drivers/media/dvb-frontends/cx24116.c
-@@ -963,6 +963,10 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- struct cx24116_state *state = fe->demodulator_priv;
- int i, ret;
-
-+ /* Validate length */
-+ if (d->msg_len > sizeof(d->msg))
-+ return -EINVAL;
-+
- /* Dump DiSEqC message */
- if (debug) {
- printk(KERN_INFO "cx24116: %s(", __func__);
-@@ -974,10 +978,6 @@ static int cx24116_send_diseqc_msg(struct dvb_frontend *fe,
- printk(") toneburst=%d\n", toneburst);
- }
-
-- /* Validate length */
-- if (d->msg_len > (CX24116_ARGLEN - CX24116_DISEQC_MSGOFS))
-- return -EINVAL;
--
- /* DiSEqC message */
- for (i = 0; i < d->msg_len; i++)
- state->dsec_cmd.args[CX24116_DISEQC_MSGOFS + i] = d->msg[i];
-diff --git a/drivers/media/dvb-frontends/cx24117.c b/drivers/media/dvb-frontends/cx24117.c
-index acb965c..af63635 100644
---- a/drivers/media/dvb-frontends/cx24117.c
-+++ b/drivers/media/dvb-frontends/cx24117.c
-@@ -1043,7 +1043,7 @@ static int cx24117_send_diseqc_msg(struct dvb_frontend *fe,
- dev_dbg(&state->priv->i2c->dev, ")\n");
-
- /* Validate length */
-- if (d->msg_len > 15)
-+ if (d->msg_len > sizeof(d->msg))
- return -EINVAL;
-
- /* DiSEqC message */
-diff --git a/drivers/media/dvb-frontends/s5h1420.c b/drivers/media/dvb-frontends/s5h1420.c
-index 93eeaf7..0b4f8fe 100644
---- a/drivers/media/dvb-frontends/s5h1420.c
-+++ b/drivers/media/dvb-frontends/s5h1420.c
-@@ -180,7 +180,7 @@ static int s5h1420_send_master_cmd (struct dvb_frontend* fe,
- int result = 0;
-
- dprintk("enter %s\n", __func__);
-- if (cmd->msg_len > 8)
-+ if (cmd->msg_len > sizeof(cmd->msg))
- return -EINVAL;
-
- /* setup for DISEQC */
-diff --git a/drivers/media/pci/cx18/cx18-streams.c b/drivers/media/pci/cx18/cx18-streams.c
-index c82d25d..c986084 100644
---- a/drivers/media/pci/cx18/cx18-streams.c
-+++ b/drivers/media/pci/cx18/cx18-streams.c
-@@ -90,6 +90,7 @@ static struct {
- "encoder PCM audio",
- VFL_TYPE_GRABBER, CX18_V4L2_ENC_PCM_OFFSET,
- PCI_DMA_FROMDEVICE,
-+ V4L2_CAP_TUNER | V4L2_CAP_AUDIO | V4L2_CAP_READWRITE,
- },
- { /* CX18_ENC_STREAM_TYPE_IDX */
- "encoder IDX",
-diff --git a/drivers/media/pci/saa7164/saa7164-encoder.c b/drivers/media/pci/saa7164/saa7164-encoder.c
-index 9266965..7a0a651 100644
---- a/drivers/media/pci/saa7164/saa7164-encoder.c
-+++ b/drivers/media/pci/saa7164/saa7164-encoder.c
-@@ -721,13 +721,14 @@ static int vidioc_querycap(struct file *file, void *priv,
- sizeof(cap->card));
- sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
-
-- cap->capabilities =
-+ cap->device_caps =
- V4L2_CAP_VIDEO_CAPTURE |
-- V4L2_CAP_READWRITE |
-- 0;
-+ V4L2_CAP_READWRITE |
-+ V4L2_CAP_TUNER;
-
-- cap->capabilities |= V4L2_CAP_TUNER;
-- cap->version = 0;
-+ cap->capabilities = cap->device_caps |
-+ V4L2_CAP_VBI_CAPTURE |
-+ V4L2_CAP_DEVICE_CAPS;
-
- return 0;
- }
-diff --git a/drivers/media/pci/saa7164/saa7164-vbi.c b/drivers/media/pci/saa7164/saa7164-vbi.c
-index 6e025fe..06117e6 100644
---- a/drivers/media/pci/saa7164/saa7164-vbi.c
-+++ b/drivers/media/pci/saa7164/saa7164-vbi.c
-@@ -660,13 +660,14 @@ static int vidioc_querycap(struct file *file, void *priv,
- sizeof(cap->card));
- sprintf(cap->bus_info, "PCI:%s", pci_name(dev->pci));
-
-- cap->capabilities =
-+ cap->device_caps =
- V4L2_CAP_VBI_CAPTURE |
-- V4L2_CAP_READWRITE |
-- 0;
-+ V4L2_CAP_READWRITE |
-+ V4L2_CAP_TUNER;
-
-- cap->capabilities |= V4L2_CAP_TUNER;
-- cap->version = 0;
-+ cap->capabilities = cap->device_caps |
-+ V4L2_CAP_VIDEO_CAPTURE |
-+ V4L2_CAP_DEVICE_CAPS;
-
- return 0;
- }
-diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c
-index 2b40393..0d248ce 100644
---- a/drivers/media/usb/dvb-usb/dib0700_core.c
-+++ b/drivers/media/usb/dvb-usb/dib0700_core.c
-@@ -655,10 +655,20 @@ out:
- struct dib0700_rc_response {
- u8 report_id;
- u8 data_state;
-- u8 system;
-- u8 not_system;
-- u8 data;
-- u8 not_data;
-+ union {
-+ struct {
-+ u8 system;
-+ u8 not_system;
-+ u8 data;
-+ u8 not_data;
-+ } nec;
-+ struct {
-+ u8 not_used;
-+ u8 system;
-+ u8 data;
-+ u8 not_data;
-+ } rc5;
-+ };
- };
- #define RC_MSG_SIZE_V1_20 6
-
-@@ -694,8 +704,8 @@ static void dib0700_rc_urb_completion(struct urb *purb)
-
- deb_data("IR ID = %02X state = %02X System = %02X %02X Cmd = %02X %02X (len %d)\n",
- poll_reply->report_id, poll_reply->data_state,
-- poll_reply->system, poll_reply->not_system,
-- poll_reply->data, poll_reply->not_data,
-+ poll_reply->nec.system, poll_reply->nec.not_system,
-+ poll_reply->nec.data, poll_reply->nec.not_data,
- purb->actual_length);
-
- switch (d->props.rc.core.protocol) {
-@@ -704,30 +714,30 @@ static void dib0700_rc_urb_completion(struct urb *purb)
- toggle = 0;
-
- /* NEC protocol sends repeat code as 0 0 0 FF */
-- if (poll_reply->system == 0x00 &&
-- poll_reply->not_system == 0x00 &&
-- poll_reply->data == 0x00 &&
-- poll_reply->not_data == 0xff) {
-+ if (poll_reply->nec.system == 0x00 &&
-+ poll_reply->nec.not_system == 0x00 &&
-+ poll_reply->nec.data == 0x00 &&
-+ poll_reply->nec.not_data == 0xff) {
- poll_reply->data_state = 2;
- break;
- }
-
-- if ((poll_reply->data ^ poll_reply->not_data) != 0xff) {
-+ if ((poll_reply->nec.data ^ poll_reply->nec.not_data) != 0xff) {
- deb_data("NEC32 protocol\n");
-- keycode = RC_SCANCODE_NEC32(poll_reply->system << 24 |
-- poll_reply->not_system << 16 |
-- poll_reply->data << 8 |
-- poll_reply->not_data);
-- } else if ((poll_reply->system ^ poll_reply->not_system) != 0xff) {
-+ keycode = RC_SCANCODE_NEC32(poll_reply->nec.system << 24 |
-+ poll_reply->nec.not_system << 16 |
-+ poll_reply->nec.data << 8 |
-+ poll_reply->nec.not_data);
-+ } else if ((poll_reply->nec.system ^ poll_reply->nec.not_system) != 0xff) {
- deb_data("NEC extended protocol\n");
-- keycode = RC_SCANCODE_NECX(poll_reply->system << 8 |
-- poll_reply->not_system,
-- poll_reply->data);
-+ keycode = RC_SCANCODE_NECX(poll_reply->nec.system << 8 |
-+ poll_reply->nec.not_system,
-+ poll_reply->nec.data);
-
- } else {
- deb_data("NEC normal protocol\n");
-- keycode = RC_SCANCODE_NEC(poll_reply->system,
-- poll_reply->data);
-+ keycode = RC_SCANCODE_NEC(poll_reply->nec.system,
-+ poll_reply->nec.data);
- }
-
- break;
-@@ -735,19 +745,19 @@ static void dib0700_rc_urb_completion(struct urb *purb)
- deb_data("RC5 protocol\n");
- protocol = RC_TYPE_RC5;
- toggle = poll_reply->report_id;
-- keycode = RC_SCANCODE_RC5(poll_reply->system, poll_reply->data);
-+ keycode = RC_SCANCODE_RC5(poll_reply->rc5.system, poll_reply->rc5.data);
-+
-+ if ((poll_reply->rc5.data ^ poll_reply->rc5.not_data) != 0xff) {
-+ /* Key failed integrity check */
-+ err("key failed integrity check: %02x %02x %02x %02x",
-+ poll_reply->rc5.not_used, poll_reply->rc5.system,
-+ poll_reply->rc5.data, poll_reply->rc5.not_data);
-+ goto resubmit;
-+ }
-
- break;
- }
-
-- if ((poll_reply->data + poll_reply->not_data) != 0xff) {
-- /* Key failed integrity check */
-- err("key failed integrity check: %02x %02x %02x %02x",
-- poll_reply->system, poll_reply->not_system,
-- poll_reply->data, poll_reply->not_data);
-- goto resubmit;
-- }
--
- rc_keydown(d->rc_dev, protocol, keycode, toggle);
-
- resubmit:
-diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c
-index d7d55a2..c170523 100644
---- a/drivers/media/usb/dvb-usb/dib0700_devices.c
-+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c
-@@ -3944,6 +3944,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
-
- DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
- }},
-+ .size_of_priv = sizeof(struct
-+ dib0700_adapter_state),
- }, {
- .num_frontends = 1,
- .fe = {{
-@@ -3956,6 +3958,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
-
- DIB0700_DEFAULT_STREAMING_CONFIG(0x03),
- }},
-+ .size_of_priv = sizeof(struct
-+ dib0700_adapter_state),
- }
- },
-
-@@ -4009,6 +4013,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
-
- DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
- }},
-+ .size_of_priv = sizeof(struct
-+ dib0700_adapter_state),
- },
- },
-
-diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
-index 66ada01..cf9d644 100644
---- a/drivers/media/v4l2-core/videobuf2-core.c
-+++ b/drivers/media/v4l2-core/videobuf2-core.c
-@@ -1237,6 +1237,23 @@ void vb2_discard_done(struct vb2_queue *q)
- }
- EXPORT_SYMBOL_GPL(vb2_discard_done);
-
-+static void vb2_warn_zero_bytesused(struct vb2_buffer *vb)
-+{
-+ static bool __check_once __read_mostly;
-+
-+ if (__check_once)
-+ return;
-+
-+ __check_once = true;
-+ __WARN();
-+
-+ pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
-+ if (vb->vb2_queue->allow_zero_bytesused)
-+ pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
-+ else
-+ pr_warn_once("use the actual size instead.\n");
-+}
-+
- /**
- * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
- * v4l2_buffer by the userspace. The caller has already verified that struct
-@@ -1247,16 +1264,6 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
- {
- unsigned int plane;
-
-- if (V4L2_TYPE_IS_OUTPUT(b->type)) {
-- if (WARN_ON_ONCE(b->bytesused == 0)) {
-- pr_warn_once("use of bytesused == 0 is deprecated and will be removed in the future,\n");
-- if (vb->vb2_queue->allow_zero_bytesused)
-- pr_warn_once("use VIDIOC_DECODER_CMD(V4L2_DEC_CMD_STOP) instead.\n");
-- else
-- pr_warn_once("use the actual size instead.\n");
-- }
-- }
--
- if (V4L2_TYPE_IS_MULTIPLANAR(b->type)) {
- if (b->memory == V4L2_MEMORY_USERPTR) {
- for (plane = 0; plane < vb->num_planes; ++plane) {
-@@ -1297,6 +1304,9 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
- struct v4l2_plane *pdst = &v4l2_planes[plane];
- struct v4l2_plane *psrc = &b->m.planes[plane];
-
-+ if (psrc->bytesused == 0)
-+ vb2_warn_zero_bytesused(vb);
-+
- if (vb->vb2_queue->allow_zero_bytesused)
- pdst->bytesused = psrc->bytesused;
- else
-@@ -1331,6 +1341,9 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
- }
-
- if (V4L2_TYPE_IS_OUTPUT(b->type)) {
-+ if (b->bytesused == 0)
-+ vb2_warn_zero_bytesused(vb);
-+
- if (vb->vb2_queue->allow_zero_bytesused)
- v4l2_planes[0].bytesused = b->bytesused;
- else
-diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
-index 60f7141..31d2627 100644
---- a/drivers/mmc/card/block.c
-+++ b/drivers/mmc/card/block.c
-@@ -208,6 +208,8 @@ static ssize_t power_ro_lock_show(struct device *dev,
-
- ret = snprintf(buf, PAGE_SIZE, "%d\n", locked);
-
-+ mmc_blk_put(md);
-+
- return ret;
- }
-
-@@ -1910,9 +1912,11 @@ static int mmc_blk_issue_rw_rq(struct mmc_queue *mq, struct request *rqc)
- break;
- case MMC_BLK_CMD_ERR:
- ret = mmc_blk_cmd_err(md, card, brq, req, ret);
-- if (!mmc_blk_reset(md, card->host, type))
-- break;
-- goto cmd_abort;
-+ if (mmc_blk_reset(md, card->host, type))
-+ goto cmd_abort;
-+ if (!ret)
-+ goto start_new_req;
-+ break;
- case MMC_BLK_RETRY:
- if (retry++ < 5)
- break;
-diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
-index 9231cdf..d3dbb28 100644
---- a/drivers/mmc/host/sdhci.c
-+++ b/drivers/mmc/host/sdhci.c
-@@ -3315,13 +3315,14 @@ int sdhci_add_host(struct sdhci_host *host)
- SDHCI_MAX_CURRENT_MULTIPLIER;
- }
-
-- /* If OCR set by external regulators, use it instead */
-+ /* If OCR set by host, use it instead. */
-+ if (host->ocr_mask)
-+ ocr_avail = host->ocr_mask;
-+
-+ /* If OCR set by external regulators, give it highest prio. */
- if (mmc->ocr_avail)
- ocr_avail = mmc->ocr_avail;
-
-- if (host->ocr_mask)
-- ocr_avail &= host->ocr_mask;
--
- mmc->ocr_avail = ocr_avail;
- mmc->ocr_avail_sdio = ocr_avail;
- if (host->ocr_avail_sdio)
-diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
-index dc79ed8..32e7775 100644
---- a/drivers/net/ethernet/intel/e1000e/82571.c
-+++ b/drivers/net/ethernet/intel/e1000e/82571.c
-@@ -2010,7 +2010,7 @@ const struct e1000_info e1000_82573_info = {
- .flags2 = FLAG2_DISABLE_ASPM_L1
- | FLAG2_DISABLE_ASPM_L0S,
- .pba = 20,
-- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
-+ .max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
- .get_variants = e1000_get_variants_82571,
- .mac_ops = &e82571_mac_ops,
- .phy_ops = &e82_phy_ops_m88,
-diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
-index 9d81c03..e2498db 100644
---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
-+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
-@@ -1563,7 +1563,7 @@ static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
- ((adapter->hw.mac.type >= e1000_pch2lan) &&
- (!(er32(CTRL_EXT) & E1000_CTRL_EXT_LSECCK)))) {
- adapter->flags &= ~FLAG_HAS_JUMBO_FRAMES;
-- adapter->max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN;
-+ adapter->max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
-
- hw->mac.ops.blink_led = NULL;
- }
-@@ -5681,7 +5681,7 @@ const struct e1000_info e1000_ich8_info = {
- | FLAG_HAS_FLASH
- | FLAG_APME_IN_WUC,
- .pba = 8,
-- .max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN,
-+ .max_hw_frame_size = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN,
- .get_variants = e1000_get_variants_ich8lan,
- .mac_ops = &ich8_mac_ops,
- .phy_ops = &ich8_phy_ops,
-@@ -5754,7 +5754,7 @@ const struct e1000_info e1000_pch2_info = {
- .flags2 = FLAG2_HAS_PHY_STATS
- | FLAG2_HAS_EEE,
- .pba = 26,
-- .max_hw_frame_size = 9018,
-+ .max_hw_frame_size = 9022,
- .get_variants = e1000_get_variants_ich8lan,
- .mac_ops = &ich8_mac_ops,
- .phy_ops = &ich8_phy_ops,
-@@ -5774,7 +5774,7 @@ const struct e1000_info e1000_pch_lpt_info = {
- .flags2 = FLAG2_HAS_PHY_STATS
- | FLAG2_HAS_EEE,
- .pba = 26,
-- .max_hw_frame_size = 9018,
-+ .max_hw_frame_size = 9022,
- .get_variants = e1000_get_variants_ich8lan,
- .mac_ops = &ich8_mac_ops,
- .phy_ops = &ich8_phy_ops,
-@@ -5794,7 +5794,7 @@ const struct e1000_info e1000_pch_spt_info = {
- .flags2 = FLAG2_HAS_PHY_STATS
- | FLAG2_HAS_EEE,
- .pba = 26,
-- .max_hw_frame_size = 9018,
-+ .max_hw_frame_size = 9022,
- .get_variants = e1000_get_variants_ich8lan,
- .mac_ops = &ich8_mac_ops,
- .phy_ops = &ich8_phy_ops,
-diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
-index c509a5c..68913d1 100644
---- a/drivers/net/ethernet/intel/e1000e/netdev.c
-+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
-@@ -3807,7 +3807,7 @@ void e1000e_reset(struct e1000_adapter *adapter)
- /* reset Packet Buffer Allocation to default */
- ew32(PBA, pba);
-
-- if (adapter->max_frame_size > ETH_FRAME_LEN + ETH_FCS_LEN) {
-+ if (adapter->max_frame_size > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) {
- /* To maintain wire speed transmits, the Tx FIFO should be
- * large enough to accommodate two full transmit packets,
- * rounded up to the next 1KB and expressed in KB. Likewise,
-@@ -4196,9 +4196,9 @@ static int e1000_sw_init(struct e1000_adapter *adapter)
- {
- struct net_device *netdev = adapter->netdev;
-
-- adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN;
-+ adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
- adapter->rx_ps_bsize0 = 128;
-- adapter->max_frame_size = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
-+ adapter->max_frame_size = netdev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
- adapter->min_frame_size = ETH_ZLEN + ETH_FCS_LEN;
- adapter->tx_ring_count = E1000_DEFAULT_TXD;
- adapter->rx_ring_count = E1000_DEFAULT_RXD;
-@@ -5781,17 +5781,17 @@ struct rtnl_link_stats64 *e1000e_get_stats64(struct net_device *netdev,
- static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
- {
- struct e1000_adapter *adapter = netdev_priv(netdev);
-- int max_frame = new_mtu + VLAN_HLEN + ETH_HLEN + ETH_FCS_LEN;
-+ int max_frame = new_mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
-
- /* Jumbo frame support */
-- if ((max_frame > ETH_FRAME_LEN + ETH_FCS_LEN) &&
-+ if ((max_frame > (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)) &&
- !(adapter->flags & FLAG_HAS_JUMBO_FRAMES)) {
- e_err("Jumbo Frames not supported.\n");
- return -EINVAL;
- }
-
- /* Supported frame sizes */
-- if ((new_mtu < ETH_ZLEN + ETH_FCS_LEN + VLAN_HLEN) ||
-+ if ((new_mtu < (VLAN_ETH_ZLEN + ETH_FCS_LEN)) ||
- (max_frame > adapter->max_hw_frame_size)) {
- e_err("Unsupported MTU setting\n");
- return -EINVAL;
-@@ -5831,10 +5831,8 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
- adapter->rx_buffer_len = 4096;
-
- /* adjust allocation if LPE protects us, and we aren't using SBP */
-- if ((max_frame == ETH_FRAME_LEN + ETH_FCS_LEN) ||
-- (max_frame == ETH_FRAME_LEN + VLAN_HLEN + ETH_FCS_LEN))
-- adapter->rx_buffer_len = ETH_FRAME_LEN + VLAN_HLEN
-- + ETH_FCS_LEN;
-+ if (max_frame <= (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN))
-+ adapter->rx_buffer_len = VLAN_ETH_FRAME_LEN + ETH_FCS_LEN;
-
- if (netif_running(netdev))
- e1000e_up(adapter);
-diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
-index e82a0d4..5dbc617 100644
---- a/drivers/net/wireless/ath/ath9k/htc.h
-+++ b/drivers/net/wireless/ath/ath9k/htc.h
-@@ -440,9 +440,9 @@ static inline void ath9k_htc_stop_btcoex(struct ath9k_htc_priv *priv)
- }
- #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
-
--#define OP_BT_PRIORITY_DETECTED BIT(3)
--#define OP_BT_SCAN BIT(4)
--#define OP_TSF_RESET BIT(6)
-+#define OP_BT_PRIORITY_DETECTED 3
-+#define OP_BT_SCAN 4
-+#define OP_TSF_RESET 6
-
- enum htc_op_flags {
- HTC_FWFLAG_NO_RMW,
-diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
-index b0badef..d5f2fbf 100644
---- a/drivers/net/wireless/ath/ath9k/main.c
-+++ b/drivers/net/wireless/ath/ath9k/main.c
-@@ -216,11 +216,13 @@ static bool ath_prepare_reset(struct ath_softc *sc)
- ath_stop_ani(sc);
- ath9k_hw_disable_interrupts(ah);
-
-- if (!ath_drain_all_txq(sc))
-- ret = false;
--
-- if (!ath_stoprecv(sc))
-- ret = false;
-+ if (AR_SREV_9300_20_OR_LATER(ah)) {
-+ ret &= ath_stoprecv(sc);
-+ ret &= ath_drain_all_txq(sc);
-+ } else {
-+ ret &= ath_drain_all_txq(sc);
-+ ret &= ath_stoprecv(sc);
-+ }
-
- return ret;
- }
-diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
-index 9ac04c1..8c17b94 100644
---- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
-+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
-@@ -6,7 +6,7 @@
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
-@@ -32,7 +32,7 @@
- * BSD LICENSE
- *
- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
-@@ -1356,6 +1356,7 @@ static ssize_t iwl_dbgfs_d0i3_refs_read(struct file *file,
- PRINT_MVM_REF(IWL_MVM_REF_UCODE_DOWN);
- PRINT_MVM_REF(IWL_MVM_REF_SCAN);
- PRINT_MVM_REF(IWL_MVM_REF_ROC);
-+ PRINT_MVM_REF(IWL_MVM_REF_ROC_AUX);
- PRINT_MVM_REF(IWL_MVM_REF_P2P_CLIENT);
- PRINT_MVM_REF(IWL_MVM_REF_AP_IBSS);
- PRINT_MVM_REF(IWL_MVM_REF_USER);
-diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
-index dda9f7b..60c138a 100644
---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
-+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
-@@ -1404,7 +1404,7 @@ void __iwl_mvm_mac_stop(struct iwl_mvm *mvm)
- * The work item could be running or queued if the
- * ROC time event stops just as we get here.
- */
-- cancel_work_sync(&mvm->roc_done_wk);
-+ flush_work(&mvm->roc_done_wk);
-
- iwl_trans_stop_device(mvm->trans);
-
-diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
-index cf70f68..6af21da 100644
---- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
-+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
-@@ -275,6 +275,7 @@ enum iwl_mvm_ref_type {
- IWL_MVM_REF_UCODE_DOWN,
- IWL_MVM_REF_SCAN,
- IWL_MVM_REF_ROC,
-+ IWL_MVM_REF_ROC_AUX,
- IWL_MVM_REF_P2P_CLIENT,
- IWL_MVM_REF_AP_IBSS,
- IWL_MVM_REF_USER,
-diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
-index fd7b0d3..a7448cf 100644
---- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
-+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
-@@ -6,7 +6,7 @@
- * GPL LICENSE SUMMARY
- *
- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of version 2 of the GNU General Public License as
-@@ -32,7 +32,7 @@
- * BSD LICENSE
- *
- * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
-- * Copyright(c) 2013 - 2014 Intel Mobile Communications GmbH
-+ * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
-@@ -108,12 +108,14 @@ void iwl_mvm_roc_done_wk(struct work_struct *wk)
- * in the case that the time event actually completed in the firmware
- * (which is handled in iwl_mvm_te_handle_notif).
- */
-- if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status))
-+ if (test_and_clear_bit(IWL_MVM_STATUS_ROC_RUNNING, &mvm->status)) {
- queues |= BIT(IWL_MVM_OFFCHANNEL_QUEUE);
-- if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status))
-+ iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
-+ }
-+ if (test_and_clear_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status)) {
- queues |= BIT(mvm->aux_queue);
--
-- iwl_mvm_unref(mvm, IWL_MVM_REF_ROC);
-+ iwl_mvm_unref(mvm, IWL_MVM_REF_ROC_AUX);
-+ }
-
- synchronize_net();
-
-@@ -393,6 +395,7 @@ static int iwl_mvm_aux_roc_te_handle_notif(struct iwl_mvm *mvm,
- } else if (le32_to_cpu(notif->action) == TE_V2_NOTIF_HOST_EVENT_START) {
- set_bit(IWL_MVM_STATUS_ROC_AUX_RUNNING, &mvm->status);
- te_data->running = true;
-+ iwl_mvm_ref(mvm, IWL_MVM_REF_ROC_AUX);
- ieee80211_ready_on_channel(mvm->hw); /* Start TE */
- } else {
- IWL_DEBUG_TE(mvm,
-diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
-index 86ce5b1..e5d8108f 100644
---- a/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/hw.c
-@@ -1354,27 +1354,11 @@ void rtl88ee_set_qos(struct ieee80211_hw *hw, int aci)
- }
- }
-
--static void rtl88ee_clear_interrupt(struct ieee80211_hw *hw)
--{
-- struct rtl_priv *rtlpriv = rtl_priv(hw);
-- u32 tmp;
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISR);
-- rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl88ee_enable_interrupt(struct ieee80211_hw *hw)
- {
- struct rtl_priv *rtlpriv = rtl_priv(hw);
- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-- rtl88ee_clear_interrupt(hw);/*clear it here first*/
- rtl_write_dword(rtlpriv, REG_HIMR,
- rtlpci->irq_mask[0] & 0xFFFFFFFF);
- rtl_write_dword(rtlpriv, REG_HIMRE,
-diff --git a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
-index da0a612..cbf2ca7 100644
---- a/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8192ee/hw.c
-@@ -1584,28 +1584,11 @@ void rtl92ee_set_qos(struct ieee80211_hw *hw, int aci)
- }
- }
-
--static void rtl92ee_clear_interrupt(struct ieee80211_hw *hw)
--{
-- struct rtl_priv *rtlpriv = rtl_priv(hw);
-- u32 tmp;
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISR);
-- rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl92ee_enable_interrupt(struct ieee80211_hw *hw)
- {
- struct rtl_priv *rtlpriv = rtl_priv(hw);
- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-- rtl92ee_clear_interrupt(hw);/*clear it here first*/
--
- rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
- rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
- rtlpci->irq_enabled = true;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
-index 67bb47d..a4b7eac 100644
---- a/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/hw.c
-@@ -1258,18 +1258,6 @@ void rtl8723e_set_qos(struct ieee80211_hw *hw, int aci)
- }
- }
-
--static void rtl8723e_clear_interrupt(struct ieee80211_hw *hw)
--{
-- struct rtl_priv *rtlpriv = rtl_priv(hw);
-- u32 tmp;
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISR);
-- rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--}
--
- void rtl8723e_enable_interrupt(struct ieee80211_hw *hw)
- {
- struct rtl_priv *rtlpriv = rtl_priv(hw);
-@@ -1284,7 +1272,6 @@ void rtl8723e_disable_interrupt(struct ieee80211_hw *hw)
- {
- struct rtl_priv *rtlpriv = rtl_priv(hw);
- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-- rtl8723e_clear_interrupt(hw);/*clear it here first*/
- rtl_write_dword(rtlpriv, 0x3a8, IMR8190_DISABLED);
- rtl_write_dword(rtlpriv, 0x3ac, IMR8190_DISABLED);
- rtlpci->irq_enabled = false;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
-index b681af3..b941726 100644
---- a/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8723be/hw.c
-@@ -1634,28 +1634,11 @@ void rtl8723be_set_qos(struct ieee80211_hw *hw, int aci)
- }
- }
-
--static void rtl8723be_clear_interrupt(struct ieee80211_hw *hw)
--{
-- struct rtl_priv *rtlpriv = rtl_priv(hw);
-- u32 tmp;
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISR);
-- rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl8723be_enable_interrupt(struct ieee80211_hw *hw)
- {
- struct rtl_priv *rtlpriv = rtl_priv(hw);
- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-- rtl8723be_clear_interrupt(hw);/*clear it here first*/
--
- rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
- rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
- rtlpci->irq_enabled = true;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
-index 8704eee..57966e3 100644
---- a/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8821ae/hw.c
-@@ -2253,31 +2253,11 @@ void rtl8821ae_set_qos(struct ieee80211_hw *hw, int aci)
- }
- }
-
--static void rtl8821ae_clear_interrupt(struct ieee80211_hw *hw)
--{
-- struct rtl_priv *rtlpriv = rtl_priv(hw);
-- u32 tmp;
-- tmp = rtl_read_dword(rtlpriv, REG_HISR);
-- /*printk("clear interrupt first:\n");
-- printk("0x%x = 0x%08x\n",REG_HISR, tmp);*/
-- rtl_write_dword(rtlpriv, REG_HISR, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HISRE);
-- /*printk("0x%x = 0x%08x\n",REG_HISRE, tmp);*/
-- rtl_write_dword(rtlpriv, REG_HISRE, tmp);
--
-- tmp = rtl_read_dword(rtlpriv, REG_HSISR);
-- /*printk("0x%x = 0x%08x\n",REG_HSISR, tmp);*/
-- rtl_write_dword(rtlpriv, REG_HSISR, tmp);
--}
--
- void rtl8821ae_enable_interrupt(struct ieee80211_hw *hw)
- {
- struct rtl_priv *rtlpriv = rtl_priv(hw);
- struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
-
-- rtl8821ae_clear_interrupt(hw);/*clear it here first*/
--
- rtl_write_dword(rtlpriv, REG_HIMR, rtlpci->irq_mask[0] & 0xFFFFFFFF);
- rtl_write_dword(rtlpriv, REG_HIMRE, rtlpci->irq_mask[1] & 0xFFFFFFFF);
- rtlpci->irq_enabled = true;
-diff --git a/drivers/nfc/st21nfcb/i2c.c b/drivers/nfc/st21nfcb/i2c.c
-index 76a4cad..c44f8cf 100644
---- a/drivers/nfc/st21nfcb/i2c.c
-+++ b/drivers/nfc/st21nfcb/i2c.c
-@@ -87,11 +87,6 @@ static void st21nfcb_nci_i2c_disable(void *phy_id)
- gpio_set_value(phy->gpio_reset, 1);
- }
-
--static void st21nfcb_nci_remove_header(struct sk_buff *skb)
--{
-- skb_pull(skb, ST21NFCB_FRAME_HEADROOM);
--}
--
- /*
- * Writing a frame must not return the number of written bytes.
- * It must return either zero for success, or <0 for error.
-@@ -121,8 +116,6 @@ static int st21nfcb_nci_i2c_write(void *phy_id, struct sk_buff *skb)
- r = 0;
- }
-
-- st21nfcb_nci_remove_header(skb);
--
- return r;
- }
-
-@@ -366,9 +359,6 @@ static int st21nfcb_nci_i2c_remove(struct i2c_client *client)
-
- ndlc_remove(phy->ndlc);
-
-- if (phy->powered)
-- st21nfcb_nci_i2c_disable(phy);
--
- return 0;
- }
-
-diff --git a/drivers/nfc/st21nfcb/st21nfcb.c b/drivers/nfc/st21nfcb/st21nfcb.c
-index ca9871a..c7dc282 100644
---- a/drivers/nfc/st21nfcb/st21nfcb.c
-+++ b/drivers/nfc/st21nfcb/st21nfcb.c
-@@ -131,11 +131,8 @@ EXPORT_SYMBOL_GPL(st21nfcb_nci_probe);
-
- void st21nfcb_nci_remove(struct nci_dev *ndev)
- {
-- struct st21nfcb_nci_info *info = nci_get_drvdata(ndev);
--
- nci_unregister_device(ndev);
- nci_free_device(ndev);
-- kfree(info);
- }
- EXPORT_SYMBOL_GPL(st21nfcb_nci_remove);
-
-diff --git a/drivers/of/address.c b/drivers/of/address.c
-index 6906a3f..8bfda6a 100644
---- a/drivers/of/address.c
-+++ b/drivers/of/address.c
-@@ -712,7 +712,7 @@ int __weak pci_register_io_range(phys_addr_t addr, resource_size_t size)
- }
-
- /* add the range to the list */
-- range = kzalloc(sizeof(*range), GFP_KERNEL);
-+ range = kzalloc(sizeof(*range), GFP_ATOMIC);
- if (!range) {
- err = -ENOMEM;
- goto end_register;
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index f065026..5ed9724 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -89,7 +89,7 @@ EXPORT_SYMBOL(of_n_size_cells);
- #ifdef CONFIG_NUMA
- int __weak of_node_to_nid(struct device_node *np)
- {
-- return numa_node_id();
-+ return NUMA_NO_NODE;
- }
- #endif
-
-diff --git a/drivers/phy/phy-berlin-usb.c b/drivers/phy/phy-berlin-usb.c
-index c6fc95b..ab54f28 100644
---- a/drivers/phy/phy-berlin-usb.c
-+++ b/drivers/phy/phy-berlin-usb.c
-@@ -106,8 +106,8 @@
- static const u32 phy_berlin_pll_dividers[] = {
- /* Berlin 2 */
- CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
-- /* Berlin 2CD */
-- CLK_REF_DIV(0x6) | FEEDBACK_CLK_DIV(0x55),
-+ /* Berlin 2CD/Q */
-+ CLK_REF_DIV(0xc) | FEEDBACK_CLK_DIV(0x54),
- };
-
- struct phy_berlin_usb_priv {
-diff --git a/drivers/phy/phy-twl4030-usb.c b/drivers/phy/phy-twl4030-usb.c
-index bc42d6a..8882afb 100644
---- a/drivers/phy/phy-twl4030-usb.c
-+++ b/drivers/phy/phy-twl4030-usb.c
-@@ -711,7 +711,6 @@ static int twl4030_usb_probe(struct platform_device *pdev)
- pm_runtime_use_autosuspend(&pdev->dev);
- pm_runtime_set_autosuspend_delay(&pdev->dev, 2000);
- pm_runtime_enable(&pdev->dev);
-- pm_runtime_get_sync(&pdev->dev);
-
- /* Our job is to use irqs and status from the power module
- * to keep the transceiver disabled when nothing's connected.
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-370.c b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-index 03aa58c..1eb084c 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-370.c
-@@ -370,11 +370,11 @@ static struct mvebu_mpp_mode mv88f6710_mpp_modes[] = {
- MPP_MODE(64,
- MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "spi0", "miso"),
-- MPP_FUNCTION(0x2, "spi0-1", "cs1")),
-+ MPP_FUNCTION(0x2, "spi0", "cs1")),
- MPP_MODE(65,
- MPP_FUNCTION(0x0, "gpio", NULL),
- MPP_FUNCTION(0x1, "spi0", "mosi"),
-- MPP_FUNCTION(0x2, "spi0-1", "cs2")),
-+ MPP_FUNCTION(0x2, "spi0", "cs2")),
- };
-
- static struct mvebu_pinctrl_soc_info armada_370_pinctrl_info;
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-375.c b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
-index ca1e757..203291b 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-375.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-375.c
-@@ -92,19 +92,17 @@ static struct mvebu_mpp_mode mv88f6720_mpp_modes[] = {
- MPP_FUNCTION(0x5, "nand", "io1")),
- MPP_MODE(8,
- MPP_FUNCTION(0x0, "gpio", NULL),
-- MPP_FUNCTION(0x1, "dev ", "bootcs"),
-+ MPP_FUNCTION(0x1, "dev", "bootcs"),
- MPP_FUNCTION(0x2, "spi0", "cs0"),
- MPP_FUNCTION(0x3, "spi1", "cs0"),
- MPP_FUNCTION(0x5, "nand", "ce")),
- MPP_MODE(9,
- MPP_FUNCTION(0x0, "gpio", NULL),
-- MPP_FUNCTION(0x1, "nf", "wen"),
- MPP_FUNCTION(0x2, "spi0", "sck"),
- MPP_FUNCTION(0x3, "spi1", "sck"),
- MPP_FUNCTION(0x5, "nand", "we")),
- MPP_MODE(10,
- MPP_FUNCTION(0x0, "gpio", NULL),
-- MPP_FUNCTION(0x1, "nf", "ren"),
- MPP_FUNCTION(0x2, "dram", "vttctrl"),
- MPP_FUNCTION(0x3, "led", "c1"),
- MPP_FUNCTION(0x5, "nand", "re"),
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
-index 83bbcc7..ff411a5 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-38x.c
-@@ -94,37 +94,39 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "rxd0", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(4, "spi0", "cs1", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(5, "dev", "ad14", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)),
- MPP_MODE(13,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "rxd1", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "pcie0", "clkreq", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie1", "clkreq", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(4, "spi0", "cs2", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(5, "dev", "ad15", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(6, "pcie2", "clkreq", V_88F6810_PLUS)),
- MPP_MODE(14,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "rxd2", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "m", "vtt_ctrl", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "spi0", "cs3", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(5, "dev", "wen1", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(6, "pcie3", "clkreq", V_88F6810_PLUS)),
- MPP_MODE(15,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "rxd3", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "ge", "mdc slave", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)),
-+ MPP_VAR_FUNCTION(4, "spi0", "mosi", V_88F6810_PLUS)),
- MPP_MODE(16,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "rxctl", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "ge", "mdio slave", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "spi0", "miso", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(5, "pcie0", "clkreq", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)),
- MPP_MODE(17,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "rxclk", V_88F6810_PLUS),
-@@ -137,13 +139,12 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(1, "ge0", "rxerr", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "ptp", "trig_gen", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "ua1", "txd", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "pcie1", "rstout", V_88F6820_PLUS)),
-+ MPP_VAR_FUNCTION(4, "spi0", "cs0", V_88F6810_PLUS)),
- MPP_MODE(19,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "col", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "ptp", "event_req", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(3, "pcie0", "clkreq", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(3, "ge0", "txerr", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "sata1", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "ua0", "cts", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(6, "ua1", "rxd", V_88F6810_PLUS)),
-@@ -151,7 +152,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ge0", "txclk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "ptp", "clk", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(4, "sata0", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "ua0", "rts", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(6, "ua1", "txd", V_88F6810_PLUS)),
-@@ -277,35 +277,27 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(1, "pcie0", "clkreq", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "m", "decc_err", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(4, "pcie0", "rstout", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "dev", "clkout", V_88F6810_PLUS)),
- MPP_MODE(44,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828),
-- MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828),
-- MPP_VAR_FUNCTION(5, "pcie0", "rstout", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(4, "sata3", "prsnt", V_88F6828)),
- MPP_MODE(45,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ref", "clk_out0", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
-- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)),
- MPP_MODE(46,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "ref", "clk_out1", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
-- MPP_VAR_FUNCTION(4, "pcie2", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "pcie3", "rstout", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(2, "pcie0", "rstout", V_88F6810_PLUS)),
- MPP_MODE(47,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "sata2", "prsnt", V_88F6828),
-- MPP_VAR_FUNCTION(4, "spi1", "cs2", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sata3", "prsnt", V_88F6828)),
- MPP_MODE(48,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
-@@ -313,18 +305,19 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(2, "m", "vtt_ctrl", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "tdm2c", "pclk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "audio", "mclk", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(5, "sd0", "d4", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(6, "pcie0", "clkreq", V_88F6810_PLUS)),
- MPP_MODE(49,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "sata2", "prsnt", V_88F6828),
- MPP_VAR_FUNCTION(2, "sata3", "prsnt", V_88F6828),
- MPP_VAR_FUNCTION(3, "tdm2c", "fsync", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "audio", "lrclk", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS)),
-+ MPP_VAR_FUNCTION(5, "sd0", "d5", V_88F6810_PLUS),
-+ MPP_VAR_FUNCTION(6, "pcie1", "clkreq", V_88F6820_PLUS)),
- MPP_MODE(50,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(3, "tdm2c", "drx", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "audio", "extclk", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sd0", "cmd", V_88F6810_PLUS)),
-@@ -336,7 +329,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_MODE(52,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(2, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(3, "tdm2c", "intn", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(4, "audio", "sdi", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sd0", "d6", V_88F6810_PLUS)),
-@@ -352,7 +344,7 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(1, "sata0", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "sata1", "prsnt", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(3, "pcie0", "rstout", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(4, "pcie1", "rstout", V_88F6820_PLUS),
-+ MPP_VAR_FUNCTION(4, "ge0", "txerr", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sd0", "d3", V_88F6810_PLUS)),
- MPP_MODE(55,
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
-@@ -382,7 +374,6 @@ static struct mvebu_mpp_mode armada_38x_mpp_modes[] = {
- MPP_VAR_FUNCTION(0, "gpio", NULL, V_88F6810_PLUS),
- MPP_VAR_FUNCTION(1, "pcie0", "rstout", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(2, "i2c1", "sda", V_88F6810_PLUS),
-- MPP_VAR_FUNCTION(3, "pcie1", "rstout", V_88F6820_PLUS),
- MPP_VAR_FUNCTION(4, "spi1", "cs0", V_88F6810_PLUS),
- MPP_VAR_FUNCTION(5, "sd0", "d2", V_88F6810_PLUS)),
- };
-@@ -411,7 +402,7 @@ static struct mvebu_mpp_ctrl armada_38x_mpp_controls[] = {
-
- static struct pinctrl_gpio_range armada_38x_mpp_gpio_ranges[] = {
- MPP_GPIO_RANGE(0, 0, 0, 32),
-- MPP_GPIO_RANGE(1, 32, 32, 27),
-+ MPP_GPIO_RANGE(1, 32, 32, 28),
- };
-
- static int armada_38x_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
-index 4249162..2dcf9b4 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-39x.c
-@@ -380,7 +380,7 @@ static struct mvebu_mpp_ctrl armada_39x_mpp_controls[] = {
-
- static struct pinctrl_gpio_range armada_39x_mpp_gpio_ranges[] = {
- MPP_GPIO_RANGE(0, 0, 0, 32),
-- MPP_GPIO_RANGE(1, 32, 32, 27),
-+ MPP_GPIO_RANGE(1, 32, 32, 28),
- };
-
- static int armada_39x_pinctrl_probe(struct platform_device *pdev)
-diff --git a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-index 578db9f..d7cdb14 100644
---- a/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-+++ b/drivers/pinctrl/mvebu/pinctrl-armada-xp.c
-@@ -14,10 +14,7 @@
- * available: mv78230, mv78260 and mv78460. From a pin muxing
- * perspective, the mv78230 has 49 MPP pins. The mv78260 and mv78460
- * both have 67 MPP pins (more GPIOs and address lines for the memory
-- * bus mainly). The only difference between the mv78260 and the
-- * mv78460 in terms of pin muxing is the addition of two functions on
-- * pins 43 and 56 to access the VDD of the CPU2 and 3 (mv78260 has two
-- * cores, mv78460 has four cores).
-+ * bus mainly).
- */
-
- #include <linux/err.h>
-@@ -172,20 +169,17 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_MODE(24,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sata1", "prsnt", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-re", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "rst", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "hsync", V_MV78230_PLUS)),
- MPP_MODE(25,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sata0", "prsnt", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x2, "nf", "bootcs-we", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "pclk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "vsync", V_MV78230_PLUS)),
- MPP_MODE(26,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "fsync", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "lcd", "clk", V_MV78230_PLUS)),
- MPP_MODE(27,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "ptp", "trig", V_MV78230_PLUS),
-@@ -200,8 +194,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "ptp", "clk", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int0", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "lcd", "ref-clk", V_MV78230_PLUS)),
- MPP_MODE(30,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "clk", V_MV78230_PLUS),
-@@ -209,13 +202,11 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_MODE(31,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "cmd", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x3, "tdm", "int2", V_MV78230_PLUS)),
- MPP_MODE(32,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "d0", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu1-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x3, "tdm", "int3", V_MV78230_PLUS)),
- MPP_MODE(33,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "sd0", "d1", V_MV78230_PLUS),
-@@ -247,7 +238,6 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "spi", "cs1", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart2", "cts", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x3, "vdd", "cpu1-pd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x4, "lcd", "vga-hsync", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x5, "pcie", "clkreq0", V_MV78230_PLUS)),
- MPP_MODE(41,
-@@ -262,15 +252,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x1, "uart2", "rxd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart0", "cts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "tdm", "int7", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu0-pd", V_MV78230_PLUS)),
-+ MPP_VAR_FUNCTION(0x4, "tdm-1", "timer", V_MV78230_PLUS)),
- MPP_MODE(43,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "uart2", "txd", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "uart0", "rts", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x3, "spi", "cs3", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x5, "vdd", "cpu2-3-pd", V_MV78460)),
-+ MPP_VAR_FUNCTION(0x4, "pcie", "rstout", V_MV78230_PLUS)),
- MPP_MODE(44,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x1, "uart2", "cts", V_MV78230_PLUS),
-@@ -299,7 +287,7 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x5, "pcie", "clkreq3", V_MV78230_PLUS)),
- MPP_MODE(48,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78230_PLUS),
-- MPP_VAR_FUNCTION(0x1, "tclk", NULL, V_MV78230_PLUS),
-+ MPP_VAR_FUNCTION(0x1, "dev", "clkout", V_MV78230_PLUS),
- MPP_VAR_FUNCTION(0x2, "dev", "burst/last", V_MV78230_PLUS)),
- MPP_MODE(49,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-@@ -321,16 +309,13 @@ static struct mvebu_mpp_mode armada_xp_mpp_modes[] = {
- MPP_VAR_FUNCTION(0x1, "dev", "ad19", V_MV78260_PLUS)),
- MPP_MODE(55,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu0-pd", V_MV78260_PLUS)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad20", V_MV78260_PLUS)),
- MPP_MODE(56,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu1-pd", V_MV78260_PLUS)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad21", V_MV78260_PLUS)),
- MPP_MODE(57,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS),
-- MPP_VAR_FUNCTION(0x2, "vdd", "cpu2-3-pd", V_MV78460)),
-+ MPP_VAR_FUNCTION(0x1, "dev", "ad22", V_MV78260_PLUS)),
- MPP_MODE(58,
- MPP_VAR_FUNCTION(0x0, "gpio", NULL, V_MV78260_PLUS),
- MPP_VAR_FUNCTION(0x1, "dev", "ad23", V_MV78260_PLUS)),
-diff --git a/drivers/pinctrl/pinctrl-zynq.c b/drivers/pinctrl/pinctrl-zynq.c
-index 22280bd..8c51a3c 100644
---- a/drivers/pinctrl/pinctrl-zynq.c
-+++ b/drivers/pinctrl/pinctrl-zynq.c
-@@ -714,12 +714,13 @@ static const char * const gpio0_groups[] = {"gpio0_0_grp",
- .mux_val = mval, \
- }
-
--#define DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(fname, mval, mux, mask, shift) \
-+#define DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(fname, mval, offset, mask, shift)\
- [ZYNQ_PMUX_##fname] = { \
- .name = #fname, \
- .groups = fname##_groups, \
- .ngroups = ARRAY_SIZE(fname##_groups), \
- .mux_val = mval, \
-+ .mux = offset, \
- .mux_mask = mask, \
- .mux_shift = shift, \
- }
-@@ -744,15 +745,15 @@ static const struct zynq_pinmux_function zynq_pmux_functions[] = {
- DEFINE_ZYNQ_PINMUX_FUNCTION(spi1, 0x50),
- DEFINE_ZYNQ_PINMUX_FUNCTION(sdio0, 0x40),
- DEFINE_ZYNQ_PINMUX_FUNCTION(sdio0_pc, 0xc),
-- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_wp, 0, 130, ZYNQ_SDIO_WP_MASK,
-+ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_wp, 0, 0x130, ZYNQ_SDIO_WP_MASK,
- ZYNQ_SDIO_WP_SHIFT),
-- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_cd, 0, 130, ZYNQ_SDIO_CD_MASK,
-+ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio0_cd, 0, 0x130, ZYNQ_SDIO_CD_MASK,
- ZYNQ_SDIO_CD_SHIFT),
- DEFINE_ZYNQ_PINMUX_FUNCTION(sdio1, 0x40),
- DEFINE_ZYNQ_PINMUX_FUNCTION(sdio1_pc, 0xc),
-- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_wp, 0, 134, ZYNQ_SDIO_WP_MASK,
-+ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_wp, 0, 0x134, ZYNQ_SDIO_WP_MASK,
- ZYNQ_SDIO_WP_SHIFT),
-- DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_cd, 0, 134, ZYNQ_SDIO_CD_MASK,
-+ DEFINE_ZYNQ_PINMUX_FUNCTION_MUX(sdio1_cd, 0, 0x134, ZYNQ_SDIO_CD_MASK,
- ZYNQ_SDIO_CD_SHIFT),
- DEFINE_ZYNQ_PINMUX_FUNCTION(smc0_nor, 4),
- DEFINE_ZYNQ_PINMUX_FUNCTION(smc0_nor_cs1, 8),
-diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
-index d688d80..2c1d5f5 100644
---- a/drivers/platform/x86/dell-laptop.c
-+++ b/drivers/platform/x86/dell-laptop.c
-@@ -305,7 +305,6 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
- };
-
- static struct calling_interface_buffer *buffer;
--static struct page *bufferpage;
- static DEFINE_MUTEX(buffer_mutex);
-
- static int hwswitch_state;
-@@ -1896,12 +1895,11 @@ static int __init dell_init(void)
- * Allocate buffer below 4GB for SMI data--only 32-bit physical addr
- * is passed to SMI handler.
- */
-- bufferpage = alloc_page(GFP_KERNEL | GFP_DMA32);
-- if (!bufferpage) {
-+ buffer = (void *)__get_free_page(GFP_KERNEL | GFP_DMA32);
-+ if (!buffer) {
- ret = -ENOMEM;
- goto fail_buffer;
- }
-- buffer = page_address(bufferpage);
-
- ret = dell_setup_rfkill();
-
-@@ -1965,7 +1963,7 @@ fail_backlight:
- cancel_delayed_work_sync(&dell_rfkill_work);
- dell_cleanup_rfkill();
- fail_rfkill:
-- free_page((unsigned long)bufferpage);
-+ free_page((unsigned long)buffer);
- fail_buffer:
- platform_device_del(platform_device);
- fail_platform_device2:
-diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
-index b496db8..cb7cd8d 100644
---- a/drivers/platform/x86/ideapad-laptop.c
-+++ b/drivers/platform/x86/ideapad-laptop.c
-@@ -464,8 +464,9 @@ static const struct ideapad_rfk_data ideapad_rfk_data[] = {
- static int ideapad_rfk_set(void *data, bool blocked)
- {
- struct ideapad_rfk_priv *priv = data;
-+ int opcode = ideapad_rfk_data[priv->dev].opcode;
-
-- return write_ec_cmd(priv->priv->adev->handle, priv->dev, !blocked);
-+ return write_ec_cmd(priv->priv->adev->handle, opcode, !blocked);
- }
-
- static struct rfkill_ops ideapad_rfk_ops = {
-@@ -837,6 +838,13 @@ static const struct dmi_system_id no_hw_rfkill_list[] = {
- },
- },
- {
-+ .ident = "Lenovo G50-30",
-+ .matches = {
-+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-+ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo G50-30"),
-+ },
-+ },
-+ {
- .ident = "Lenovo Yoga 2 11 / 13 / Pro",
- .matches = {
- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
-diff --git a/drivers/pnp/system.c b/drivers/pnp/system.c
-index 515f338..49c1720 100644
---- a/drivers/pnp/system.c
-+++ b/drivers/pnp/system.c
-@@ -7,7 +7,6 @@
- * Bjorn Helgaas <bjorn.helgaas@hp.com>
- */
-
--#include <linux/acpi.h>
- #include <linux/pnp.h>
- #include <linux/device.h>
- #include <linux/init.h>
-@@ -23,41 +22,25 @@ static const struct pnp_device_id pnp_dev_table[] = {
- {"", 0}
- };
-
--#ifdef CONFIG_ACPI
--static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
--{
-- u8 space_id = io ? ACPI_ADR_SPACE_SYSTEM_IO : ACPI_ADR_SPACE_SYSTEM_MEMORY;
-- return !acpi_reserve_region(start, length, space_id, IORESOURCE_BUSY, desc);
--}
--#else
--static bool __reserve_range(u64 start, unsigned int length, bool io, char *desc)
--{
-- struct resource *res;
--
-- res = io ? request_region(start, length, desc) :
-- request_mem_region(start, length, desc);
-- if (res) {
-- res->flags &= ~IORESOURCE_BUSY;
-- return true;
-- }
-- return false;
--}
--#endif
--
- static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
- {
- char *regionid;
- const char *pnpid = dev_name(&dev->dev);
- resource_size_t start = r->start, end = r->end;
-- bool reserved;
-+ struct resource *res;
-
- regionid = kmalloc(16, GFP_KERNEL);
- if (!regionid)
- return;
-
- snprintf(regionid, 16, "pnp %s", pnpid);
-- reserved = __reserve_range(start, end - start + 1, !!port, regionid);
-- if (!reserved)
-+ if (port)
-+ res = request_region(start, end - start + 1, regionid);
-+ else
-+ res = request_mem_region(start, end - start + 1, regionid);
-+ if (res)
-+ res->flags &= ~IORESOURCE_BUSY;
-+ else
- kfree(regionid);
-
- /*
-@@ -66,7 +49,7 @@ static void reserve_range(struct pnp_dev *dev, struct resource *r, int port)
- * have double reservations.
- */
- dev_info(&dev->dev, "%pR %s reserved\n", r,
-- reserved ? "has been" : "could not be");
-+ res ? "has been" : "could not be");
- }
-
- static void reserve_resources_of_dev(struct pnp_dev *dev)
-diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c
-index 0479e80..d87a85c 100644
---- a/drivers/rtc/rtc-snvs.c
-+++ b/drivers/rtc/rtc-snvs.c
-@@ -322,6 +322,13 @@ static int snvs_rtc_suspend(struct device *dev)
- if (device_may_wakeup(dev))
- enable_irq_wake(data->irq);
-
-+ return 0;
-+}
-+
-+static int snvs_rtc_suspend_noirq(struct device *dev)
-+{
-+ struct snvs_rtc_data *data = dev_get_drvdata(dev);
-+
- if (data->clk)
- clk_disable_unprepare(data->clk);
-
-@@ -331,23 +338,28 @@ static int snvs_rtc_suspend(struct device *dev)
- static int snvs_rtc_resume(struct device *dev)
- {
- struct snvs_rtc_data *data = dev_get_drvdata(dev);
-- int ret;
-
- if (device_may_wakeup(dev))
-- disable_irq_wake(data->irq);
-+ return disable_irq_wake(data->irq);
-
-- if (data->clk) {
-- ret = clk_prepare_enable(data->clk);
-- if (ret)
-- return ret;
-- }
-+ return 0;
-+}
-+
-+static int snvs_rtc_resume_noirq(struct device *dev)
-+{
-+ struct snvs_rtc_data *data = dev_get_drvdata(dev);
-+
-+ if (data->clk)
-+ return clk_prepare_enable(data->clk);
-
- return 0;
- }
-
- static const struct dev_pm_ops snvs_rtc_pm_ops = {
-- .suspend_noirq = snvs_rtc_suspend,
-- .resume_noirq = snvs_rtc_resume,
-+ .suspend = snvs_rtc_suspend,
-+ .suspend_noirq = snvs_rtc_suspend_noirq,
-+ .resume = snvs_rtc_resume,
-+ .resume_noirq = snvs_rtc_resume_noirq,
- };
-
- #define SNVS_RTC_PM_OPS (&snvs_rtc_pm_ops)
-diff --git a/drivers/staging/comedi/drivers/cb_pcimdas.c b/drivers/staging/comedi/drivers/cb_pcimdas.c
-index c458e50..4ebf5aa 100644
---- a/drivers/staging/comedi/drivers/cb_pcimdas.c
-+++ b/drivers/staging/comedi/drivers/cb_pcimdas.c
-@@ -243,7 +243,7 @@ static int cb_pcimdas_ao_insn_write(struct comedi_device *dev,
- return insn->n;
- }
-
--static int cb_pcimdas_di_insn_read(struct comedi_device *dev,
-+static int cb_pcimdas_di_insn_bits(struct comedi_device *dev,
- struct comedi_subdevice *s,
- struct comedi_insn *insn,
- unsigned int *data)
-@@ -258,7 +258,7 @@ static int cb_pcimdas_di_insn_read(struct comedi_device *dev,
- return insn->n;
- }
-
--static int cb_pcimdas_do_insn_write(struct comedi_device *dev,
-+static int cb_pcimdas_do_insn_bits(struct comedi_device *dev,
- struct comedi_subdevice *s,
- struct comedi_insn *insn,
- unsigned int *data)
-@@ -424,7 +424,7 @@ static int cb_pcimdas_auto_attach(struct comedi_device *dev,
- s->n_chan = 4;
- s->maxdata = 1;
- s->range_table = &range_digital;
-- s->insn_read = cb_pcimdas_di_insn_read;
-+ s->insn_bits = cb_pcimdas_di_insn_bits;
-
- /* Digital Output subdevice (main connector) */
- s = &dev->subdevices[4];
-@@ -433,7 +433,7 @@ static int cb_pcimdas_auto_attach(struct comedi_device *dev,
- s->n_chan = 4;
- s->maxdata = 1;
- s->range_table = &range_digital;
-- s->insn_write = cb_pcimdas_do_insn_write;
-+ s->insn_bits = cb_pcimdas_do_insn_bits;
-
- /* Counter subdevice (8254) */
- s = &dev->subdevices[5];
-diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c
-index 50227b5..fcb8c61 100644
---- a/drivers/staging/rtl8712/rtl8712_recv.c
-+++ b/drivers/staging/rtl8712/rtl8712_recv.c
-@@ -1056,7 +1056,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb)
- /* for first fragment packet, driver need allocate 1536 +
- * drvinfo_sz + RXDESC_SIZE to defrag packet. */
- if ((mf == 1) && (frag == 0))
-- alloc_sz = 1658;/*1658+6=1664, 1664 is 128 alignment.*/
-+ /*1658+6=1664, 1664 is 128 alignment.*/
-+ alloc_sz = max_t(u16, tmp_len, 1658);
- else
- alloc_sz = tmp_len;
- /* 2 is for IP header 4 bytes alignment in QoS packet case.
-diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
-index 0343ae3..15baacb 100644
---- a/drivers/staging/vt6655/device_main.c
-+++ b/drivers/staging/vt6655/device_main.c
-@@ -807,6 +807,10 @@ static int device_rx_srv(struct vnt_private *pDevice, unsigned int uIdx)
- pRD = pRD->next) {
- if (works++ > 15)
- break;
-+
-+ if (!pRD->pRDInfo->skb)
-+ break;
-+
- if (vnt_receive_frame(pDevice, pRD)) {
- if (!device_alloc_rx_buf(pDevice, pRD)) {
- dev_err(&pDevice->pcid->dev,
-@@ -1417,7 +1421,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
-
- priv->current_aid = conf->aid;
-
-- if (changed & BSS_CHANGED_BSSID) {
-+ if (changed & BSS_CHANGED_BSSID && conf->bssid) {
- unsigned long flags;
-
- spin_lock_irqsave(&priv->lock, flags);
-diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c
-index ab3ab84..766fdce 100644
---- a/drivers/staging/vt6656/main_usb.c
-+++ b/drivers/staging/vt6656/main_usb.c
-@@ -701,7 +701,7 @@ static void vnt_bss_info_changed(struct ieee80211_hw *hw,
-
- priv->current_aid = conf->aid;
-
-- if (changed & BSS_CHANGED_BSSID)
-+ if (changed & BSS_CHANGED_BSSID && conf->bssid)
- vnt_mac_set_bssid_addr(priv, (u8 *)conf->bssid);
-
-
-diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
-index f8120c1..8cd3534 100644
---- a/drivers/tty/serial/Kconfig
-+++ b/drivers/tty/serial/Kconfig
-@@ -241,7 +241,6 @@ config SERIAL_SAMSUNG
- tristate "Samsung SoC serial support"
- depends on PLAT_SAMSUNG || ARCH_EXYNOS
- select SERIAL_CORE
-- select SERIAL_EARLYCON
- help
- Support for the on-chip UARTs on the Samsung S3C24XX series CPUs,
- providing /dev/ttySAC0, 1 and 2 (note, some machines may not
-@@ -277,6 +276,7 @@ config SERIAL_SAMSUNG_CONSOLE
- bool "Support for console on Samsung SoC serial port"
- depends on SERIAL_SAMSUNG=y
- select SERIAL_CORE_CONSOLE
-+ select SERIAL_EARLYCON
- help
- Allow selection of the S3C24XX on-board serial ports for use as
- an virtual console.
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 27dade2..5ca1dfb 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -315,8 +315,7 @@ static int atmel_config_rs485(struct uart_port *port,
- if (rs485conf->flags & SER_RS485_ENABLED) {
- dev_dbg(port->dev, "Setting UART to RS485\n");
- atmel_port->tx_done_mask = ATMEL_US_TXEMPTY;
-- if ((rs485conf->delay_rts_after_send) > 0)
-- UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
-+ UART_PUT_TTGR(port, rs485conf->delay_rts_after_send);
- mode |= ATMEL_US_USMODE_RS485;
- } else {
- dev_dbg(port->dev, "Setting UART to RS232\n");
-@@ -354,8 +353,7 @@ static void atmel_set_mctrl(struct uart_port *port, u_int mctrl)
-
- /* override mode to RS485 if needed, otherwise keep the current mode */
- if (port->rs485.flags & SER_RS485_ENABLED) {
-- if ((port->rs485.delay_rts_after_send) > 0)
-- UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
-+ UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
- mode &= ~ATMEL_US_USMODE;
- mode |= ATMEL_US_USMODE_RS485;
- }
-@@ -2061,8 +2059,7 @@ static void atmel_set_termios(struct uart_port *port, struct ktermios *termios,
-
- /* mode */
- if (port->rs485.flags & SER_RS485_ENABLED) {
-- if ((port->rs485.delay_rts_after_send) > 0)
-- UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
-+ UART_PUT_TTGR(port, port->rs485.delay_rts_after_send);
- mode |= ATMEL_US_USMODE_RS485;
- } else if (termios->c_cflag & CRTSCTS) {
- /* RS232 with hardware handshake (RTS/CTS) */
-diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
-index 843f2cd..9ffdfcf 100644
---- a/drivers/tty/sysrq.c
-+++ b/drivers/tty/sysrq.c
-@@ -55,9 +55,6 @@
- static int __read_mostly sysrq_enabled = CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE;
- static bool __read_mostly sysrq_always_enabled;
-
--unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED };
--int sysrq_reset_downtime_ms __weak;
--
- static bool sysrq_on(void)
- {
- return sysrq_enabled || sysrq_always_enabled;
-@@ -569,6 +566,7 @@ void handle_sysrq(int key)
- EXPORT_SYMBOL(handle_sysrq);
-
- #ifdef CONFIG_INPUT
-+static int sysrq_reset_downtime_ms;
-
- /* Simple translation table for the SysRq keys */
- static const unsigned char sysrq_xlate[KEY_CNT] =
-@@ -949,23 +947,8 @@ static bool sysrq_handler_registered;
-
- static inline void sysrq_register_handler(void)
- {
-- unsigned short key;
- int error;
-- int i;
--
-- /* First check if a __weak interface was instantiated. */
-- for (i = 0; i < ARRAY_SIZE(sysrq_reset_seq); i++) {
-- key = platform_sysrq_reset_seq[i];
-- if (key == KEY_RESERVED || key > KEY_MAX)
-- break;
--
-- sysrq_reset_seq[sysrq_reset_seq_len++] = key;
-- }
-
-- /*
-- * DT configuration takes precedence over anything that would
-- * have been defined via the __weak interface.
-- */
- sysrq_of_get_keyreset_config();
-
- error = input_register_handler(&sysrq_handler);
-diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
-index 4b0448c..986abde 100644
---- a/drivers/usb/core/devio.c
-+++ b/drivers/usb/core/devio.c
-@@ -513,7 +513,7 @@ static void async_completed(struct urb *urb)
- snoop(&urb->dev->dev, "urb complete\n");
- snoop_urb(urb->dev, as->userurb, urb->pipe, urb->actual_length,
- as->status, COMPLETE, NULL, 0);
-- if ((urb->transfer_flags & URB_DIR_MASK) == USB_DIR_IN)
-+ if ((urb->transfer_flags & URB_DIR_MASK) == URB_DIR_IN)
- snoop_urb_data(urb, urb->actual_length);
-
- if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET &&
-diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
-index 45a915c..1c1385e 100644
---- a/drivers/usb/core/hcd.c
-+++ b/drivers/usb/core/hcd.c
-@@ -1022,9 +1022,12 @@ static int register_root_hub(struct usb_hcd *hcd)
- dev_name(&usb_dev->dev), retval);
- return (retval < 0) ? retval : -EMSGSIZE;
- }
-- if (usb_dev->speed == USB_SPEED_SUPER) {
-+
-+ if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
- retval = usb_get_bos_descriptor(usb_dev);
-- if (retval < 0) {
-+ if (!retval) {
-+ usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
-+ } else if (usb_dev->speed == USB_SPEED_SUPER) {
- mutex_unlock(&usb_bus_list_lock);
- dev_dbg(parent_dev, "can't read %s bos descriptor %d\n",
- dev_name(&usb_dev->dev), retval);
-diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 3b71516..1e9a8c9 100644
---- a/drivers/usb/core/hub.c
-+++ b/drivers/usb/core/hub.c
-@@ -122,7 +122,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
- return usb_get_intfdata(hdev->actconfig->interface[0]);
- }
-
--static int usb_device_supports_lpm(struct usb_device *udev)
-+int usb_device_supports_lpm(struct usb_device *udev)
- {
- /* USB 2.1 (and greater) devices indicate LPM support through
- * their USB 2.0 Extended Capabilities BOS descriptor.
-@@ -2616,9 +2616,6 @@ static bool use_new_scheme(struct usb_device *udev, int retry)
- return USE_NEW_SCHEME(retry);
- }
-
--static int hub_port_reset(struct usb_hub *hub, int port1,
-- struct usb_device *udev, unsigned int delay, bool warm);
--
- /* Is a USB 3.0 port in the Inactive or Compliance Mode state?
- * Port worm reset is required to recover
- */
-@@ -2706,44 +2703,6 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
- return 0;
- }
-
--static void hub_port_finish_reset(struct usb_hub *hub, int port1,
-- struct usb_device *udev, int *status)
--{
-- switch (*status) {
-- case 0:
-- /* TRSTRCY = 10 ms; plus some extra */
-- msleep(10 + 40);
-- if (udev) {
-- struct usb_hcd *hcd = bus_to_hcd(udev->bus);
--
-- update_devnum(udev, 0);
-- /* The xHC may think the device is already reset,
-- * so ignore the status.
-- */
-- if (hcd->driver->reset_device)
-- hcd->driver->reset_device(hcd, udev);
-- }
-- /* FALL THROUGH */
-- case -ENOTCONN:
-- case -ENODEV:
-- usb_clear_port_feature(hub->hdev,
-- port1, USB_PORT_FEAT_C_RESET);
-- if (hub_is_superspeed(hub->hdev)) {
-- usb_clear_port_feature(hub->hdev, port1,
-- USB_PORT_FEAT_C_BH_PORT_RESET);
-- usb_clear_port_feature(hub->hdev, port1,
-- USB_PORT_FEAT_C_PORT_LINK_STATE);
-- usb_clear_port_feature(hub->hdev, port1,
-- USB_PORT_FEAT_C_CONNECTION);
-- }
-- if (udev)
-- usb_set_device_state(udev, *status
-- ? USB_STATE_NOTATTACHED
-- : USB_STATE_DEFAULT);
-- break;
-- }
--}
--
- /* Handle port reset and port warm(BH) reset (for USB3 protocol ports) */
- static int hub_port_reset(struct usb_hub *hub, int port1,
- struct usb_device *udev, unsigned int delay, bool warm)
-@@ -2767,13 +2726,10 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
- * If the caller hasn't explicitly requested a warm reset,
- * double check and see if one is needed.
- */
-- status = hub_port_status(hub, port1,
-- &portstatus, &portchange);
-- if (status < 0)
-- goto done;
--
-- if (hub_port_warm_reset_required(hub, port1, portstatus))
-- warm = true;
-+ if (hub_port_status(hub, port1, &portstatus, &portchange) == 0)
-+ if (hub_port_warm_reset_required(hub, port1,
-+ portstatus))
-+ warm = true;
- }
- clear_bit(port1, hub->warm_reset_bits);
-
-@@ -2799,11 +2755,19 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
-
- /* Check for disconnect or reset */
- if (status == 0 || status == -ENOTCONN || status == -ENODEV) {
-- hub_port_finish_reset(hub, port1, udev, &status);
-+ usb_clear_port_feature(hub->hdev, port1,
-+ USB_PORT_FEAT_C_RESET);
-
- if (!hub_is_superspeed(hub->hdev))
- goto done;
-
-+ usb_clear_port_feature(hub->hdev, port1,
-+ USB_PORT_FEAT_C_BH_PORT_RESET);
-+ usb_clear_port_feature(hub->hdev, port1,
-+ USB_PORT_FEAT_C_PORT_LINK_STATE);
-+ usb_clear_port_feature(hub->hdev, port1,
-+ USB_PORT_FEAT_C_CONNECTION);
-+
- /*
- * If a USB 3.0 device migrates from reset to an error
- * state, re-issue the warm reset.
-@@ -2836,6 +2800,26 @@ static int hub_port_reset(struct usb_hub *hub, int port1,
- dev_err(&port_dev->dev, "Cannot enable. Maybe the USB cable is bad?\n");
-
- done:
-+ if (status == 0) {
-+ /* TRSTRCY = 10 ms; plus some extra */
-+ msleep(10 + 40);
-+ if (udev) {
-+ struct usb_hcd *hcd = bus_to_hcd(udev->bus);
-+
-+ update_devnum(udev, 0);
-+ /* The xHC may think the device is already reset,
-+ * so ignore the status.
-+ */
-+ if (hcd->driver->reset_device)
-+ hcd->driver->reset_device(hcd, udev);
-+
-+ usb_set_device_state(udev, USB_STATE_DEFAULT);
-+ }
-+ } else {
-+ if (udev)
-+ usb_set_device_state(udev, USB_STATE_NOTATTACHED);
-+ }
-+
- if (!hub_is_superspeed(hub->hdev))
- up_read(&ehci_cf_port_reset_rwsem);
-
-diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
-index 7eb1e26..457255a 100644
---- a/drivers/usb/core/usb.h
-+++ b/drivers/usb/core/usb.h
-@@ -65,6 +65,7 @@ extern int usb_hub_init(void);
- extern void usb_hub_cleanup(void);
- extern int usb_major_init(void);
- extern void usb_major_cleanup(void);
-+extern int usb_device_supports_lpm(struct usb_device *udev);
-
- #ifdef CONFIG_PM
-
-diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
-index 2ef3c8d..69e769c 100644
---- a/drivers/usb/dwc3/ep0.c
-+++ b/drivers/usb/dwc3/ep0.c
-@@ -727,6 +727,10 @@ static int dwc3_ep0_std_request(struct dwc3 *dwc, struct usb_ctrlrequest *ctrl)
- dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_ISOCH_DELAY");
- ret = dwc3_ep0_set_isoch_delay(dwc, ctrl);
- break;
-+ case USB_REQ_SET_INTERFACE:
-+ dwc3_trace(trace_dwc3_ep0, "USB_REQ_SET_INTERFACE");
-+ dwc->start_config_issued = false;
-+ /* Fall through */
- default:
- dwc3_trace(trace_dwc3_ep0, "Forwarding to gadget driver");
- ret = dwc3_ep0_delegate_req(dwc, ctrl);
-diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
-index 8946c32..333a7c0 100644
---- a/drivers/usb/dwc3/gadget.c
-+++ b/drivers/usb/dwc3/gadget.c
-@@ -291,6 +291,8 @@ int dwc3_send_gadget_generic_command(struct dwc3 *dwc, unsigned cmd, u32 param)
- dwc3_trace(trace_dwc3_gadget,
- "Command Complete --> %d",
- DWC3_DGCMD_STATUS(reg));
-+ if (DWC3_DGCMD_STATUS(reg))
-+ return -EINVAL;
- return 0;
- }
-
-@@ -328,6 +330,8 @@ int dwc3_send_gadget_ep_cmd(struct dwc3 *dwc, unsigned ep,
- dwc3_trace(trace_dwc3_gadget,
- "Command Complete --> %d",
- DWC3_DEPCMD_STATUS(reg));
-+ if (DWC3_DEPCMD_STATUS(reg))
-+ return -EINVAL;
- return 0;
- }
-
-@@ -1902,12 +1906,16 @@ static void dwc3_endpoint_transfer_complete(struct dwc3 *dwc,
- {
- unsigned status = 0;
- int clean_busy;
-+ u32 is_xfer_complete;
-+
-+ is_xfer_complete = (event->endpoint_event == DWC3_DEPEVT_XFERCOMPLETE);
-
- if (event->status & DEPEVT_STATUS_BUSERR)
- status = -ECONNRESET;
-
- clean_busy = dwc3_cleanup_done_reqs(dwc, dep, event, status);
-- if (clean_busy)
-+ if (clean_busy && (is_xfer_complete ||
-+ usb_endpoint_xfer_isoc(dep->endpoint.desc)))
- dep->flags &= ~DWC3_EP_BUSY;
-
- /*
-diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
-index 4e3447b..58b4657 100644
---- a/drivers/usb/gadget/composite.c
-+++ b/drivers/usb/gadget/composite.c
-@@ -1758,10 +1758,13 @@ unknown:
- * take such requests too, if that's ever needed: to work
- * in config 0, etc.
- */
-- list_for_each_entry(f, &cdev->config->functions, list)
-- if (f->req_match && f->req_match(f, ctrl))
-- goto try_fun_setup;
-- f = NULL;
-+ if (cdev->config) {
-+ list_for_each_entry(f, &cdev->config->functions, list)
-+ if (f->req_match && f->req_match(f, ctrl))
-+ goto try_fun_setup;
-+ f = NULL;
-+ }
-+
- switch (ctrl->bRequestType & USB_RECIP_MASK) {
- case USB_RECIP_INTERFACE:
- if (!cdev->config || intf >= MAX_CONFIG_INTERFACES)
-diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
-index 45b8c8b..6e7be91 100644
---- a/drivers/usb/gadget/function/f_fs.c
-+++ b/drivers/usb/gadget/function/f_fs.c
-@@ -924,7 +924,8 @@ static ssize_t ffs_epfile_write_iter(struct kiocb *kiocb, struct iov_iter *from)
-
- kiocb->private = p;
-
-- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-+ if (p->aio)
-+ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-
- res = ffs_epfile_io(kiocb->ki_filp, p);
- if (res == -EIOCBQUEUED)
-@@ -968,7 +969,8 @@ static ssize_t ffs_epfile_read_iter(struct kiocb *kiocb, struct iov_iter *to)
-
- kiocb->private = p;
-
-- kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-+ if (p->aio)
-+ kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);
-
- res = ffs_epfile_io(kiocb->ki_filp, p);
- if (res == -EIOCBQUEUED)
-diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
-index 3cc109f..15c3071 100644
---- a/drivers/usb/gadget/function/f_mass_storage.c
-+++ b/drivers/usb/gadget/function/f_mass_storage.c
-@@ -2786,7 +2786,7 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
- return -EINVAL;
- }
-
-- curlun = kcalloc(nluns, sizeof(*curlun), GFP_KERNEL);
-+ curlun = kcalloc(FSG_MAX_LUNS, sizeof(*curlun), GFP_KERNEL);
- if (unlikely(!curlun))
- return -ENOMEM;
-
-@@ -2796,8 +2796,6 @@ int fsg_common_set_nluns(struct fsg_common *common, int nluns)
- common->luns = curlun;
- common->nluns = nluns;
-
-- pr_info("Number of LUNs=%d\n", common->nluns);
--
- return 0;
- }
- EXPORT_SYMBOL_GPL(fsg_common_set_nluns);
-@@ -3563,14 +3561,26 @@ static struct usb_function *fsg_alloc(struct usb_function_instance *fi)
- struct fsg_opts *opts = fsg_opts_from_func_inst(fi);
- struct fsg_common *common = opts->common;
- struct fsg_dev *fsg;
-+ unsigned nluns, i;
-
- fsg = kzalloc(sizeof(*fsg), GFP_KERNEL);
- if (unlikely(!fsg))
- return ERR_PTR(-ENOMEM);
-
- mutex_lock(&opts->lock);
-+ if (!opts->refcnt) {
-+ for (nluns = i = 0; i < FSG_MAX_LUNS; ++i)
-+ if (common->luns[i])
-+ nluns = i + 1;
-+ if (!nluns)
-+ pr_warn("No LUNS defined, continuing anyway\n");
-+ else
-+ common->nluns = nluns;
-+ pr_info("Number of LUNs=%u\n", common->nluns);
-+ }
- opts->refcnt++;
- mutex_unlock(&opts->lock);
-+
- fsg->function.name = FSG_DRIVER_DESC;
- fsg->function.bind = fsg_bind;
- fsg->function.unbind = fsg_unbind;
-diff --git a/drivers/usb/gadget/udc/mv_udc_core.c b/drivers/usb/gadget/udc/mv_udc_core.c
-index d32160d..5da37c9 100644
---- a/drivers/usb/gadget/udc/mv_udc_core.c
-+++ b/drivers/usb/gadget/udc/mv_udc_core.c
-@@ -2167,7 +2167,7 @@ static int mv_udc_probe(struct platform_device *pdev)
- return -ENODEV;
- }
-
-- udc->phy_regs = ioremap(r->start, resource_size(r));
-+ udc->phy_regs = devm_ioremap(&pdev->dev, r->start, resource_size(r));
- if (udc->phy_regs == NULL) {
- dev_err(&pdev->dev, "failed to map phy I/O memory\n");
- return -EBUSY;
-diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c
-index 1463c39..fe1d5fc 100644
---- a/drivers/usb/host/ohci-q.c
-+++ b/drivers/usb/host/ohci-q.c
-@@ -980,10 +980,6 @@ rescan_all:
- int completed, modified;
- __hc32 *prev;
-
-- /* Is this ED already invisible to the hardware? */
-- if (ed->state == ED_IDLE)
-- goto ed_idle;
--
- /* only take off EDs that the HC isn't using, accounting for
- * frame counter wraps and EDs with partially retired TDs
- */
-@@ -1011,12 +1007,10 @@ skip_ed:
- }
-
- /* ED's now officially unlinked, hc doesn't see */
-- ed->state = ED_IDLE;
- ed->hwHeadP &= ~cpu_to_hc32(ohci, ED_H);
- ed->hwNextED = 0;
- wmb();
- ed->hwINFO &= ~cpu_to_hc32(ohci, ED_SKIP | ED_DEQUEUE);
--ed_idle:
-
- /* reentrancy: if we drop the schedule lock, someone might
- * have modified this list. normally it's just prepending
-@@ -1087,6 +1081,7 @@ rescan_this:
- if (list_empty(&ed->td_list)) {
- *last = ed->ed_next;
- ed->ed_next = NULL;
-+ ed->state = ED_IDLE;
- list_del(&ed->in_use_list);
- } else if (ohci->rh_state == OHCI_RH_RUNNING) {
- *last = ed->ed_next;
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index f833640..3e442f7 100644
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1427,10 +1427,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- /* Attempt to use the ring cache */
- if (virt_dev->num_rings_cached == 0)
- return -ENOMEM;
-+ virt_dev->num_rings_cached--;
- virt_dev->eps[ep_index].new_ring =
- virt_dev->ring_cache[virt_dev->num_rings_cached];
- virt_dev->ring_cache[virt_dev->num_rings_cached] = NULL;
-- virt_dev->num_rings_cached--;
- xhci_reinit_cached_ring(xhci, virt_dev->eps[ep_index].new_ring,
- 1, type);
- }
-diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c
-index 86c4b53..4731bac 100644
---- a/drivers/usb/musb/musb_virthub.c
-+++ b/drivers/usb/musb/musb_virthub.c
-@@ -273,9 +273,7 @@ static int musb_has_gadget(struct musb *musb)
- #ifdef CONFIG_USB_MUSB_HOST
- return 1;
- #else
-- if (musb->port_mode == MUSB_PORT_MODE_HOST)
-- return 1;
-- return musb->g.dev.driver != NULL;
-+ return musb->port_mode == MUSB_PORT_MODE_HOST;
- #endif
- }
-
-diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
-index 8f7cb06..3fcc048 100644
---- a/drivers/usb/phy/phy-mxs-usb.c
-+++ b/drivers/usb/phy/phy-mxs-usb.c
-@@ -217,6 +217,9 @@ static bool mxs_phy_get_vbus_status(struct mxs_phy *mxs_phy)
- {
- unsigned int vbus_value;
-
-+ if (!mxs_phy->regmap_anatop)
-+ return false;
-+
- if (mxs_phy->port_id == 0)
- regmap_read(mxs_phy->regmap_anatop,
- ANADIG_USB1_VBUS_DET_STAT,
-diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
-index ffd739e..eac7cca 100644
---- a/drivers/usb/serial/cp210x.c
-+++ b/drivers/usb/serial/cp210x.c
-@@ -187,6 +187,7 @@ static const struct usb_device_id id_table[] = {
- { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */
- { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */
- { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */
-+ { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */
- { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
- { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
- { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
-diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
-index f0c0c53..19b85ee 100644
---- a/drivers/usb/serial/option.c
-+++ b/drivers/usb/serial/option.c
-@@ -1765,6 +1765,7 @@ static const struct usb_device_id option_ids[] = {
- { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
- { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
-+ { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */
- { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
- { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) },
- { } /* Terminating entry */
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 529066b..46f1f13 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -1306,6 +1306,7 @@ static void __exit usb_serial_exit(void)
- tty_unregister_driver(usb_serial_tty_driver);
- put_tty_driver(usb_serial_tty_driver);
- bus_unregister(&usb_serial_bus_type);
-+ idr_destroy(&serial_minors);
- }
-
-
-diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
-index 1f11a20..55eb86c 100644
---- a/drivers/w1/slaves/w1_therm.c
-+++ b/drivers/w1/slaves/w1_therm.c
-@@ -59,16 +59,32 @@ MODULE_ALIAS("w1-family-" __stringify(W1_THERM_DS28EA00));
- static int w1_strong_pullup = 1;
- module_param_named(strong_pullup, w1_strong_pullup, int, 0);
-
-+struct w1_therm_family_data {
-+ uint8_t rom[9];
-+ atomic_t refcnt;
-+};
-+
-+/* return the address of the refcnt in the family data */
-+#define THERM_REFCNT(family_data) \
-+ (&((struct w1_therm_family_data*)family_data)->refcnt)
-+
- static int w1_therm_add_slave(struct w1_slave *sl)
- {
-- sl->family_data = kzalloc(9, GFP_KERNEL);
-+ sl->family_data = kzalloc(sizeof(struct w1_therm_family_data),
-+ GFP_KERNEL);
- if (!sl->family_data)
- return -ENOMEM;
-+ atomic_set(THERM_REFCNT(sl->family_data), 1);
- return 0;
- }
-
- static void w1_therm_remove_slave(struct w1_slave *sl)
- {
-+ int refcnt = atomic_sub_return(1, THERM_REFCNT(sl->family_data));
-+ while(refcnt) {
-+ msleep(1000);
-+ refcnt = atomic_read(THERM_REFCNT(sl->family_data));
-+ }
- kfree(sl->family_data);
- sl->family_data = NULL;
- }
-@@ -194,13 +210,22 @@ static ssize_t w1_slave_show(struct device *device,
- struct w1_slave *sl = dev_to_w1_slave(device);
- struct w1_master *dev = sl->master;
- u8 rom[9], crc, verdict, external_power;
-- int i, max_trying = 10;
-+ int i, ret, max_trying = 10;
- ssize_t c = PAGE_SIZE;
-+ u8 *family_data = sl->family_data;
-+
-+ ret = mutex_lock_interruptible(&dev->bus_mutex);
-+ if (ret != 0)
-+ goto post_unlock;
-
-- i = mutex_lock_interruptible(&dev->bus_mutex);
-- if (i != 0)
-- return i;
-+ if(!sl->family_data)
-+ {
-+ ret = -ENODEV;
-+ goto pre_unlock;
-+ }
-
-+ /* prevent the slave from going away in sleep */
-+ atomic_inc(THERM_REFCNT(family_data));
- memset(rom, 0, sizeof(rom));
-
- while (max_trying--) {
-@@ -230,17 +255,19 @@ static ssize_t w1_slave_show(struct device *device,
- mutex_unlock(&dev->bus_mutex);
-
- sleep_rem = msleep_interruptible(tm);
-- if (sleep_rem != 0)
-- return -EINTR;
-+ if (sleep_rem != 0) {
-+ ret = -EINTR;
-+ goto post_unlock;
-+ }
-
-- i = mutex_lock_interruptible(&dev->bus_mutex);
-- if (i != 0)
-- return i;
-+ ret = mutex_lock_interruptible(&dev->bus_mutex);
-+ if (ret != 0)
-+ goto post_unlock;
- } else if (!w1_strong_pullup) {
- sleep_rem = msleep_interruptible(tm);
- if (sleep_rem != 0) {
-- mutex_unlock(&dev->bus_mutex);
-- return -EINTR;
-+ ret = -EINTR;
-+ goto pre_unlock;
- }
- }
-
-@@ -269,19 +296,24 @@ static ssize_t w1_slave_show(struct device *device,
- c -= snprintf(buf + PAGE_SIZE - c, c, ": crc=%02x %s\n",
- crc, (verdict) ? "YES" : "NO");
- if (verdict)
-- memcpy(sl->family_data, rom, sizeof(rom));
-+ memcpy(family_data, rom, sizeof(rom));
- else
- dev_warn(device, "Read failed CRC check\n");
-
- for (i = 0; i < 9; ++i)
- c -= snprintf(buf + PAGE_SIZE - c, c, "%02x ",
-- ((u8 *)sl->family_data)[i]);
-+ ((u8 *)family_data)[i]);
-
- c -= snprintf(buf + PAGE_SIZE - c, c, "t=%d\n",
- w1_convert_temp(rom, sl->family->fid));
-+ ret = PAGE_SIZE - c;
-+
-+pre_unlock:
- mutex_unlock(&dev->bus_mutex);
-
-- return PAGE_SIZE - c;
-+post_unlock:
-+ atomic_dec(THERM_REFCNT(family_data));
-+ return ret;
- }
-
- static int __init w1_therm_init(void)
-diff --git a/drivers/watchdog/omap_wdt.c b/drivers/watchdog/omap_wdt.c
-index 1e6be9e..c9c97da 100644
---- a/drivers/watchdog/omap_wdt.c
-+++ b/drivers/watchdog/omap_wdt.c
-@@ -132,6 +132,13 @@ static int omap_wdt_start(struct watchdog_device *wdog)
-
- pm_runtime_get_sync(wdev->dev);
-
-+ /*
-+ * Make sure the watchdog is disabled. This is unfortunately required
-+ * because writing to various registers with the watchdog running has no
-+ * effect.
-+ */
-+ omap_wdt_disable(wdev);
-+
- /* initialize prescaler */
- while (readl_relaxed(base + OMAP_WATCHDOG_WPS) & 0x01)
- cpu_relax();
-diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
-index 703342e..53f1e8a 100644
---- a/fs/9p/vfs_inode.c
-+++ b/fs/9p/vfs_inode.c
-@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
- unlock_new_inode(inode);
- return inode;
- error:
-- unlock_new_inode(inode);
-- iput(inode);
-+ iget_failed(inode);
- return ERR_PTR(retval);
-
- }
-diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
-index 9861c7c..4d3ecfb 100644
---- a/fs/9p/vfs_inode_dotl.c
-+++ b/fs/9p/vfs_inode_dotl.c
-@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
- unlock_new_inode(inode);
- return inode;
- error:
-- unlock_new_inode(inode);
-- iput(inode);
-+ iget_failed(inode);
- return ERR_PTR(retval);
-
- }
-diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
-index f6a596d..d4a582a 100644
---- a/fs/btrfs/inode-map.c
-+++ b/fs/btrfs/inode-map.c
-@@ -246,6 +246,7 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- {
- struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
- struct rb_root *rbroot = &root->free_ino_pinned->free_space_offset;
-+ spinlock_t *rbroot_lock = &root->free_ino_pinned->tree_lock;
- struct btrfs_free_space *info;
- struct rb_node *n;
- u64 count;
-@@ -254,24 +255,30 @@ void btrfs_unpin_free_ino(struct btrfs_root *root)
- return;
-
- while (1) {
-+ bool add_to_ctl = true;
-+
-+ spin_lock(rbroot_lock);
- n = rb_first(rbroot);
-- if (!n)
-+ if (!n) {
-+ spin_unlock(rbroot_lock);
- break;
-+ }
-
- info = rb_entry(n, struct btrfs_free_space, offset_index);
- BUG_ON(info->bitmap); /* Logic error */
-
- if (info->offset > root->ino_cache_progress)
-- goto free;
-+ add_to_ctl = false;
- else if (info->offset + info->bytes > root->ino_cache_progress)
- count = root->ino_cache_progress - info->offset + 1;
- else
- count = info->bytes;
-
-- __btrfs_add_free_space(ctl, info->offset, count);
--free:
- rb_erase(&info->offset_index, rbroot);
-- kfree(info);
-+ spin_unlock(rbroot_lock);
-+ if (add_to_ctl)
-+ __btrfs_add_free_space(ctl, info->offset, count);
-+ kmem_cache_free(btrfs_free_space_cachep, info);
- }
- }
-
-diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
-index 1c22c65..37d456a 100644
---- a/fs/btrfs/ioctl.c
-+++ b/fs/btrfs/ioctl.c
-@@ -2413,8 +2413,6 @@ static noinline int btrfs_ioctl_snap_destroy(struct file *file,
- goto out_unlock_inode;
- }
-
-- d_invalidate(dentry);
--
- down_write(&root->fs_info->subvol_sem);
-
- err = may_destroy_subvol(dest);
-@@ -2508,7 +2506,7 @@ out_up_write:
- out_unlock_inode:
- mutex_unlock(&inode->i_mutex);
- if (!err) {
-- shrink_dcache_sb(root->fs_info->sb);
-+ d_invalidate(dentry);
- btrfs_invalidate_inodes(dest);
- d_delete(dentry);
- ASSERT(dest->send_in_progress == 0);
-@@ -2940,7 +2938,7 @@ out_unlock:
- static long btrfs_ioctl_file_extent_same(struct file *file,
- struct btrfs_ioctl_same_args __user *argp)
- {
-- struct btrfs_ioctl_same_args *same;
-+ struct btrfs_ioctl_same_args *same = NULL;
- struct btrfs_ioctl_same_extent_info *info;
- struct inode *src = file_inode(file);
- u64 off;
-@@ -2970,6 +2968,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
-
- if (IS_ERR(same)) {
- ret = PTR_ERR(same);
-+ same = NULL;
- goto out;
- }
-
-@@ -3040,6 +3039,7 @@ static long btrfs_ioctl_file_extent_same(struct file *file,
-
- out:
- mnt_drop_write_file(file);
-+ kfree(same);
- return ret;
- }
-
-@@ -3434,6 +3434,20 @@ process_slot:
- u64 trim = 0;
- u64 aligned_end = 0;
-
-+ /*
-+ * Don't copy an inline extent into an offset
-+ * greater than zero. Having an inline extent
-+ * at such an offset results in chaos as btrfs
-+ * isn't prepared for such cases. Just skip
-+ * this case for the same reasons as commented
-+ * at btrfs_ioctl_clone().
-+ */
-+ if (last_dest_end > 0) {
-+ ret = -EOPNOTSUPP;
-+ btrfs_end_transaction(trans, root);
-+ goto out;
-+ }
-+
- if (off > key.offset) {
- skip = off - key.offset;
- new_key.offset += skip;
-diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
-index 5628e25..94e909c 100644
---- a/fs/btrfs/transaction.c
-+++ b/fs/btrfs/transaction.c
-@@ -758,7 +758,7 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans,
-
- if (!list_empty(&trans->ordered)) {
- spin_lock(&info->trans_lock);
-- list_splice(&trans->ordered, &cur_trans->pending_ordered);
-+ list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
- spin_unlock(&info->trans_lock);
- }
-
-@@ -1848,7 +1848,7 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans,
- }
-
- spin_lock(&root->fs_info->trans_lock);
-- list_splice(&trans->ordered, &cur_trans->pending_ordered);
-+ list_splice_init(&trans->ordered, &cur_trans->pending_ordered);
- if (cur_trans->state >= TRANS_STATE_COMMIT_START) {
- spin_unlock(&root->fs_info->trans_lock);
- atomic_inc(&cur_trans->use_count);
-diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index d049683..4920fce 100644
---- a/fs/btrfs/tree-log.c
-+++ b/fs/btrfs/tree-log.c
-@@ -4161,6 +4161,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
- u64 ino = btrfs_ino(inode);
- struct extent_map_tree *em_tree = &BTRFS_I(inode)->extent_tree;
- u64 logged_isize = 0;
-+ bool need_log_inode_item = true;
-
- path = btrfs_alloc_path();
- if (!path)
-@@ -4269,11 +4270,6 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans,
- } else {
- if (inode_only == LOG_INODE_ALL)
- fast_search = true;
-- ret = log_inode_item(trans, log, dst_path, inode);
-- if (ret) {
-- err = ret;
-- goto out_unlock;
-- }
- goto log_extents;
- }
-
-@@ -4296,6 +4292,9 @@ again:
- if (min_key.type > max_key.type)
- break;
-
-+ if (min_key.type == BTRFS_INODE_ITEM_KEY)
-+ need_log_inode_item = false;
-+
- src = path->nodes[0];
- if (ins_nr && ins_start_slot + ins_nr == path->slots[0]) {
- ins_nr++;
-@@ -4366,6 +4365,11 @@ next_slot:
- log_extents:
- btrfs_release_path(path);
- btrfs_release_path(dst_path);
-+ if (need_log_inode_item) {
-+ err = log_inode_item(trans, log, dst_path, inode);
-+ if (err)
-+ goto out_unlock;
-+ }
- if (fast_search) {
- /*
- * Some ordered extents started by fsync might have completed
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index e003a1e..87ba10d 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -503,7 +503,7 @@ __read_extent_tree_block(const char *function, unsigned int line,
- struct buffer_head *bh;
- int err;
-
-- bh = sb_getblk(inode->i_sb, pblk);
-+ bh = sb_getblk_gfp(inode->i_sb, pblk, __GFP_MOVABLE | GFP_NOFS);
- if (unlikely(!bh))
- return ERR_PTR(-ENOMEM);
-
-@@ -1088,7 +1088,7 @@ static int ext4_ext_split(handle_t *handle, struct inode *inode,
- err = -EIO;
- goto cleanup;
- }
-- bh = sb_getblk(inode->i_sb, newblock);
-+ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
- if (unlikely(!bh)) {
- err = -ENOMEM;
- goto cleanup;
-@@ -1282,7 +1282,7 @@ static int ext4_ext_grow_indepth(handle_t *handle, struct inode *inode,
- if (newblock == 0)
- return err;
-
-- bh = sb_getblk(inode->i_sb, newblock);
-+ bh = sb_getblk_gfp(inode->i_sb, newblock, __GFP_MOVABLE | GFP_NOFS);
- if (unlikely(!bh))
- return -ENOMEM;
- lock_buffer(bh);
-diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
-index 9588240..94ae687 100644
---- a/fs/ext4/indirect.c
-+++ b/fs/ext4/indirect.c
-@@ -565,7 +565,7 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode,
- EXT4_FEATURE_RO_COMPAT_BIGALLOC)) {
- EXT4_ERROR_INODE(inode, "Can't allocate blocks for "
- "non-extent mapped inodes with bigalloc");
-- return -ENOSPC;
-+ return -EUCLEAN;
- }
-
- /* Set up for the direct block allocation */
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index 0554b0b..966c614 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -1342,7 +1342,7 @@ static void ext4_da_page_release_reservation(struct page *page,
- unsigned int offset,
- unsigned int length)
- {
-- int to_release = 0;
-+ int to_release = 0, contiguous_blks = 0;
- struct buffer_head *head, *bh;
- unsigned int curr_off = 0;
- struct inode *inode = page->mapping->host;
-@@ -1363,14 +1363,23 @@ static void ext4_da_page_release_reservation(struct page *page,
-
- if ((offset <= curr_off) && (buffer_delay(bh))) {
- to_release++;
-+ contiguous_blks++;
- clear_buffer_delay(bh);
-+ } else if (contiguous_blks) {
-+ lblk = page->index <<
-+ (PAGE_CACHE_SHIFT - inode->i_blkbits);
-+ lblk += (curr_off >> inode->i_blkbits) -
-+ contiguous_blks;
-+ ext4_es_remove_extent(inode, lblk, contiguous_blks);
-+ contiguous_blks = 0;
- }
- curr_off = next_off;
- } while ((bh = bh->b_this_page) != head);
-
-- if (to_release) {
-+ if (contiguous_blks) {
- lblk = page->index << (PAGE_CACHE_SHIFT - inode->i_blkbits);
-- ext4_es_remove_extent(inode, lblk, to_release);
-+ lblk += (curr_off >> inode->i_blkbits) - contiguous_blks;
-+ ext4_es_remove_extent(inode, lblk, contiguous_blks);
- }
-
- /* If we have released all the blocks belonging to a cluster, then we
-@@ -1701,19 +1710,32 @@ static int __ext4_journalled_writepage(struct page *page,
- ext4_walk_page_buffers(handle, page_bufs, 0, len,
- NULL, bget_one);
- }
-- /* As soon as we unlock the page, it can go away, but we have
-- * references to buffers so we are safe */
-+ /*
-+ * We need to release the page lock before we start the
-+ * journal, so grab a reference so the page won't disappear
-+ * out from under us.
-+ */
-+ get_page(page);
- unlock_page(page);
-
- handle = ext4_journal_start(inode, EXT4_HT_WRITE_PAGE,
- ext4_writepage_trans_blocks(inode));
- if (IS_ERR(handle)) {
- ret = PTR_ERR(handle);
-- goto out;
-+ put_page(page);
-+ goto out_no_pagelock;
- }
--
- BUG_ON(!ext4_handle_valid(handle));
-
-+ lock_page(page);
-+ put_page(page);
-+ if (page->mapping != mapping) {
-+ /* The page got truncated from under us */
-+ ext4_journal_stop(handle);
-+ ret = 0;
-+ goto out;
-+ }
-+
- if (inline_data) {
- BUFFER_TRACE(inode_bh, "get write access");
- ret = ext4_journal_get_write_access(handle, inode_bh);
-@@ -1739,6 +1761,8 @@ static int __ext4_journalled_writepage(struct page *page,
- NULL, bput_one);
- ext4_set_inode_state(inode, EXT4_STATE_JDATA);
- out:
-+ unlock_page(page);
-+out_no_pagelock:
- brelse(inode_bh);
- return ret;
- }
-@@ -4345,7 +4369,12 @@ static void ext4_update_other_inodes_time(struct super_block *sb,
- int inode_size = EXT4_INODE_SIZE(sb);
-
- oi.orig_ino = orig_ino;
-- ino = (orig_ino & ~(inodes_per_block - 1)) + 1;
-+ /*
-+ * Calculate the first inode in the inode table block. Inode
-+ * numbers are one-based. That is, the first inode in a block
-+ * (assuming 4k blocks and 256 byte inodes) is (n*16 + 1).
-+ */
-+ ino = ((orig_ino - 1) & ~(inodes_per_block - 1)) + 1;
- for (i = 0; i < inodes_per_block; i++, ino++, buf += inode_size) {
- if (ino == orig_ino)
- continue;
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 8d1e602..4126048 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -4800,18 +4800,12 @@ do_more:
- /*
- * blocks being freed are metadata. these blocks shouldn't
- * be used until this transaction is committed
-+ *
-+ * We use __GFP_NOFAIL because ext4_free_blocks() is not allowed
-+ * to fail.
- */
-- retry:
-- new_entry = kmem_cache_alloc(ext4_free_data_cachep, GFP_NOFS);
-- if (!new_entry) {
-- /*
-- * We use a retry loop because
-- * ext4_free_blocks() is not allowed to fail.
-- */
-- cond_resched();
-- congestion_wait(BLK_RW_ASYNC, HZ/50);
-- goto retry;
-- }
-+ new_entry = kmem_cache_alloc(ext4_free_data_cachep,
-+ GFP_NOFS|__GFP_NOFAIL);
- new_entry->efd_start_cluster = bit;
- new_entry->efd_group = block_group;
- new_entry->efd_count = count_clusters;
-diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
-index b52374e..6163ad2 100644
---- a/fs/ext4/migrate.c
-+++ b/fs/ext4/migrate.c
-@@ -620,6 +620,7 @@ int ext4_ind_migrate(struct inode *inode)
- struct ext4_inode_info *ei = EXT4_I(inode);
- struct ext4_extent *ex;
- unsigned int i, len;
-+ ext4_lblk_t start, end;
- ext4_fsblk_t blk;
- handle_t *handle;
- int ret;
-@@ -633,6 +634,14 @@ int ext4_ind_migrate(struct inode *inode)
- EXT4_FEATURE_RO_COMPAT_BIGALLOC))
- return -EOPNOTSUPP;
-
-+ /*
-+ * In order to get correct extent info, force all delayed allocation
-+ * blocks to be allocated, otherwise delayed allocation blocks may not
-+ * be reflected and bypass the checks on extent header.
-+ */
-+ if (test_opt(inode->i_sb, DELALLOC))
-+ ext4_alloc_da_blocks(inode);
-+
- handle = ext4_journal_start(inode, EXT4_HT_MIGRATE, 1);
- if (IS_ERR(handle))
- return PTR_ERR(handle);
-@@ -650,11 +659,13 @@ int ext4_ind_migrate(struct inode *inode)
- goto errout;
- }
- if (eh->eh_entries == 0)
-- blk = len = 0;
-+ blk = len = start = end = 0;
- else {
- len = le16_to_cpu(ex->ee_len);
- blk = ext4_ext_pblock(ex);
-- if (len > EXT4_NDIR_BLOCKS) {
-+ start = le32_to_cpu(ex->ee_block);
-+ end = start + len - 1;
-+ if (end >= EXT4_NDIR_BLOCKS) {
- ret = -EOPNOTSUPP;
- goto errout;
- }
-@@ -662,7 +673,7 @@ int ext4_ind_migrate(struct inode *inode)
-
- ext4_clear_inode_flag(inode, EXT4_INODE_EXTENTS);
- memset(ei->i_data, 0, sizeof(ei->i_data));
-- for (i=0; i < len; i++)
-+ for (i = start; i <= end; i++)
- ei->i_data[i] = cpu_to_le32(blk++);
- ext4_mark_inode_dirty(handle, inode);
- errout:
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index ca9d4a2..ca12affd 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -807,6 +807,7 @@ static void ext4_put_super(struct super_block *sb)
- dump_orphan_list(sb, sbi);
- J_ASSERT(list_empty(&sbi->s_orphan));
-
-+ sync_blockdev(sb->s_bdev);
- invalidate_bdev(sb->s_bdev);
- if (sbi->journal_bdev && sbi->journal_bdev != sb->s_bdev) {
- /*
-@@ -4943,6 +4944,9 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data)
- set_task_ioprio(sbi->s_journal->j_task, journal_ioprio);
- }
-
-+ if (*flags & MS_LAZYTIME)
-+ sb->s_flags |= MS_LAZYTIME;
-+
- if ((*flags & MS_RDONLY) != (sb->s_flags & MS_RDONLY)) {
- if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) {
- err = -EROFS;
-diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c
-index 18dacf9..708d697 100644
---- a/fs/fuse/inode.c
-+++ b/fs/fuse/inode.c
-@@ -1026,6 +1026,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- goto err_fput;
-
- fuse_conn_init(fc);
-+ fc->release = fuse_free_conn;
-
- fc->dev = sb->s_dev;
- fc->sb = sb;
-@@ -1040,7 +1041,6 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent)
- fc->dont_mask = 1;
- sb->s_flags |= MS_POSIXACL;
-
-- fc->release = fuse_free_conn;
- fc->flags = d.flags;
- fc->user_id = d.user_id;
- fc->group_id = d.group_id;
-diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
-index 7cd00d3..8685c65 100644
---- a/fs/hpfs/super.c
-+++ b/fs/hpfs/super.c
-@@ -52,17 +52,20 @@ static void unmark_dirty(struct super_block *s)
- }
-
- /* Filesystem error... */
--static char err_buf[1024];
--
- void hpfs_error(struct super_block *s, const char *fmt, ...)
- {
-+ struct va_format vaf;
- va_list args;
-
- va_start(args, fmt);
-- vsnprintf(err_buf, sizeof(err_buf), fmt, args);
-+
-+ vaf.fmt = fmt;
-+ vaf.va = &args;
-+
-+ pr_err("filesystem error: %pV", &vaf);
-+
- va_end(args);
-
-- pr_err("filesystem error: %s", err_buf);
- if (!hpfs_sb(s)->sb_was_error) {
- if (hpfs_sb(s)->sb_err == 2) {
- pr_cont("; crashing the system because you wanted it\n");
-@@ -424,11 +427,14 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
- int o;
- struct hpfs_sb_info *sbi = hpfs_sb(s);
- char *new_opts = kstrdup(data, GFP_KERNEL);
--
-+
-+ if (!new_opts)
-+ return -ENOMEM;
-+
- sync_filesystem(s);
-
- *flags |= MS_NOATIME;
--
-+
- hpfs_lock(s);
- uid = sbi->sb_uid; gid = sbi->sb_gid;
- umask = 0777 & ~sbi->sb_mode;
-diff --git a/fs/jbd2/checkpoint.c b/fs/jbd2/checkpoint.c
-index 988b32e..4227dc4 100644
---- a/fs/jbd2/checkpoint.c
-+++ b/fs/jbd2/checkpoint.c
-@@ -390,7 +390,7 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- unsigned long blocknr;
-
- if (is_journal_aborted(journal))
-- return 1;
-+ return -EIO;
-
- if (!jbd2_journal_get_log_tail(journal, &first_tid, &blocknr))
- return 1;
-@@ -405,10 +405,9 @@ int jbd2_cleanup_journal_tail(journal_t *journal)
- * jbd2_cleanup_journal_tail() doesn't get called all that often.
- */
- if (journal->j_flags & JBD2_BARRIER)
-- blkdev_issue_flush(journal->j_fs_dev, GFP_KERNEL, NULL);
-+ blkdev_issue_flush(journal->j_fs_dev, GFP_NOFS, NULL);
-
-- __jbd2_update_log_tail(journal, first_tid, blocknr);
-- return 0;
-+ return __jbd2_update_log_tail(journal, first_tid, blocknr);
- }
-
-
-diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
-index b96bd80..112fad9 100644
---- a/fs/jbd2/journal.c
-+++ b/fs/jbd2/journal.c
-@@ -885,9 +885,10 @@ int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- *
- * Requires j_checkpoint_mutex
- */
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- {
- unsigned long freed;
-+ int ret;
-
- BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
-
-@@ -897,7 +898,10 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- * space and if we lose sb update during power failure we'd replay
- * old transaction with possibly newly overwritten data.
- */
-- jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+ ret = jbd2_journal_update_sb_log_tail(journal, tid, block, WRITE_FUA);
-+ if (ret)
-+ goto out;
-+
- write_lock(&journal->j_state_lock);
- freed = block - journal->j_tail;
- if (block < journal->j_tail)
-@@ -913,6 +917,9 @@ void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block)
- journal->j_tail_sequence = tid;
- journal->j_tail = block;
- write_unlock(&journal->j_state_lock);
-+
-+out:
-+ return ret;
- }
-
- /*
-@@ -1331,7 +1338,7 @@ static int journal_reset(journal_t *journal)
- return jbd2_journal_start_thread(journal);
- }
-
--static void jbd2_write_superblock(journal_t *journal, int write_op)
-+static int jbd2_write_superblock(journal_t *journal, int write_op)
- {
- struct buffer_head *bh = journal->j_sb_buffer;
- journal_superblock_t *sb = journal->j_superblock;
-@@ -1370,7 +1377,10 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- printk(KERN_ERR "JBD2: Error %d detected when updating "
- "journal superblock for %s.\n", ret,
- journal->j_devname);
-+ jbd2_journal_abort(journal, ret);
- }
-+
-+ return ret;
- }
-
- /**
-@@ -1383,10 +1393,11 @@ static void jbd2_write_superblock(journal_t *journal, int write_op)
- * Update a journal's superblock information about log tail and write it to
- * disk, waiting for the IO to complete.
- */
--void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
-+int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- unsigned long tail_block, int write_op)
- {
- journal_superblock_t *sb = journal->j_superblock;
-+ int ret;
-
- BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex));
- jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n",
-@@ -1395,13 +1406,18 @@ void jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid,
- sb->s_sequence = cpu_to_be32(tail_tid);
- sb->s_start = cpu_to_be32(tail_block);
-
-- jbd2_write_superblock(journal, write_op);
-+ ret = jbd2_write_superblock(journal, write_op);
-+ if (ret)
-+ goto out;
-
- /* Log is no longer empty */
- write_lock(&journal->j_state_lock);
- WARN_ON(!sb->s_sequence);
- journal->j_flags &= ~JBD2_FLUSHED;
- write_unlock(&journal->j_state_lock);
-+
-+out:
-+ return ret;
- }
-
- /**
-@@ -1950,7 +1966,14 @@ int jbd2_journal_flush(journal_t *journal)
- return -EIO;
-
- mutex_lock(&journal->j_checkpoint_mutex);
-- jbd2_cleanup_journal_tail(journal);
-+ if (!err) {
-+ err = jbd2_cleanup_journal_tail(journal);
-+ if (err < 0) {
-+ mutex_unlock(&journal->j_checkpoint_mutex);
-+ goto out;
-+ }
-+ err = 0;
-+ }
-
- /* Finally, mark the journal as really needing no recovery.
- * This sets s_start==0 in the underlying superblock, which is
-@@ -1966,7 +1989,8 @@ int jbd2_journal_flush(journal_t *journal)
- J_ASSERT(journal->j_head == journal->j_tail);
- J_ASSERT(journal->j_tail_sequence == journal->j_transaction_sequence);
- write_unlock(&journal->j_state_lock);
-- return 0;
-+out:
-+ return err;
- }
-
- /**
-diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c b/fs/nfs/flexfilelayout/flexfilelayout.c
-index 7d05089..6f5f0f4 100644
---- a/fs/nfs/flexfilelayout/flexfilelayout.c
-+++ b/fs/nfs/flexfilelayout/flexfilelayout.c
-@@ -631,7 +631,7 @@ static void ff_layout_reset_write(struct nfs_pgio_header *hdr, bool retry_pnfs)
- nfs_direct_set_resched_writes(hdr->dreq);
- /* fake unstable write to let common nfs resend pages */
- hdr->verf.committed = NFS_UNSTABLE;
-- hdr->good_bytes = 0;
-+ hdr->good_bytes = hdr->args.count;
- }
- return;
- }
-diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
-index 77a2d02..f13e196 100644
---- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c
-+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c
-@@ -324,7 +324,8 @@ static int ff_layout_update_mirror_cred(struct nfs4_ff_layout_mirror *mirror,
- __func__, PTR_ERR(cred));
- return PTR_ERR(cred);
- } else {
-- mirror->cred = cred;
-+ if (cmpxchg(&mirror->cred, NULL, cred))
-+ put_rpccred(cred);
- }
- }
- return 0;
-@@ -386,7 +387,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
- /* matching smp_wmb() in _nfs4_pnfs_v3/4_ds_connect */
- smp_rmb();
- if (ds->ds_clp)
-- goto out;
-+ goto out_update_creds;
-
- flavor = nfs4_ff_layout_choose_authflavor(mirror);
-
-@@ -430,7 +431,7 @@ nfs4_ff_layout_prepare_ds(struct pnfs_layout_segment *lseg, u32 ds_idx,
- }
- }
- }
--
-+out_update_creds:
- if (ff_layout_update_mirror_cred(mirror, ds))
- ds = NULL;
- out:
-diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
-index 53852a4..9b04c2e 100644
---- a/fs/nfs/nfs3xdr.c
-+++ b/fs/nfs/nfs3xdr.c
-@@ -1342,7 +1342,7 @@ static void nfs3_xdr_enc_setacl3args(struct rpc_rqst *req,
- if (args->npages != 0)
- xdr_write_pages(xdr, args->pages, 0, args->len);
- else
-- xdr_reserve_space(xdr, NFS_ACL_INLINE_BUFSIZE);
-+ xdr_reserve_space(xdr, args->len);
-
- error = nfsacl_encode(xdr->buf, base, args->inode,
- (args->mask & NFS_ACL) ?
-diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
-index 2782cfc..ddef1dc 100644
---- a/fs/nfs/nfs4state.c
-+++ b/fs/nfs/nfs4state.c
-@@ -1482,6 +1482,8 @@ restart:
- spin_unlock(&state->state_lock);
- }
- nfs4_put_open_state(state);
-+ clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
-+ &state->flags);
- spin_lock(&sp->so_lock);
- goto restart;
- }
-diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
-index 2306062..d47c188 100644
---- a/fs/nfs/pnfs.c
-+++ b/fs/nfs/pnfs.c
-@@ -1821,6 +1821,7 @@ int pnfs_write_done_resend_to_mds(struct nfs_pgio_header *hdr)
- /* Resend all requests through the MDS */
- nfs_pageio_init_write(&pgio, hdr->inode, FLUSH_STABLE, true,
- hdr->completion_ops);
-+ set_bit(NFS_CONTEXT_RESEND_WRITES, &hdr->args.context->flags);
- return nfs_pageio_resend(&pgio, hdr);
- }
- EXPORT_SYMBOL_GPL(pnfs_write_done_resend_to_mds);
-@@ -1865,6 +1866,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc,
- mirror->pg_recoalesce = 1;
- }
- nfs_pgio_data_destroy(hdr);
-+ hdr->release(hdr);
- }
-
- static enum pnfs_try_status
-@@ -1979,6 +1981,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc,
- mirror->pg_recoalesce = 1;
- }
- nfs_pgio_data_destroy(hdr);
-+ hdr->release(hdr);
- }
-
- /*
-diff --git a/fs/nfs/write.c b/fs/nfs/write.c
-index dfc19f1..daf3556 100644
---- a/fs/nfs/write.c
-+++ b/fs/nfs/write.c
-@@ -1289,6 +1289,7 @@ static void nfs_initiate_write(struct nfs_pgio_header *hdr,
- static void nfs_redirty_request(struct nfs_page *req)
- {
- nfs_mark_request_dirty(req);
-+ set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags);
- nfs_unlock_request(req);
- nfs_end_page_writeback(req);
- nfs_release_request(req);
-diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
-index 907870e..70e9af5 100644
---- a/fs/overlayfs/readdir.c
-+++ b/fs/overlayfs/readdir.c
-@@ -23,6 +23,7 @@ struct ovl_cache_entry {
- u64 ino;
- struct list_head l_node;
- struct rb_node node;
-+ struct ovl_cache_entry *next_maybe_whiteout;
- bool is_whiteout;
- char name[];
- };
-@@ -39,7 +40,7 @@ struct ovl_readdir_data {
- struct rb_root root;
- struct list_head *list;
- struct list_head middle;
-- struct dentry *dir;
-+ struct ovl_cache_entry *first_maybe_whiteout;
- int count;
- int err;
- };
-@@ -79,7 +80,7 @@ static struct ovl_cache_entry *ovl_cache_entry_find(struct rb_root *root,
- return NULL;
- }
-
--static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir,
-+static struct ovl_cache_entry *ovl_cache_entry_new(struct ovl_readdir_data *rdd,
- const char *name, int len,
- u64 ino, unsigned int d_type)
- {
-@@ -98,29 +99,8 @@ static struct ovl_cache_entry *ovl_cache_entry_new(struct dentry *dir,
- p->is_whiteout = false;
-
- if (d_type == DT_CHR) {
-- struct dentry *dentry;
-- const struct cred *old_cred;
-- struct cred *override_cred;
--
-- override_cred = prepare_creds();
-- if (!override_cred) {
-- kfree(p);
-- return NULL;
-- }
--
-- /*
-- * CAP_DAC_OVERRIDE for lookup
-- */
-- cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
-- old_cred = override_creds(override_cred);
--
-- dentry = lookup_one_len(name, dir, len);
-- if (!IS_ERR(dentry)) {
-- p->is_whiteout = ovl_is_whiteout(dentry);
-- dput(dentry);
-- }
-- revert_creds(old_cred);
-- put_cred(override_cred);
-+ p->next_maybe_whiteout = rdd->first_maybe_whiteout;
-+ rdd->first_maybe_whiteout = p;
- }
- return p;
- }
-@@ -148,7 +128,7 @@ static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd,
- return 0;
- }
-
-- p = ovl_cache_entry_new(rdd->dir, name, len, ino, d_type);
-+ p = ovl_cache_entry_new(rdd, name, len, ino, d_type);
- if (p == NULL)
- return -ENOMEM;
-
-@@ -169,7 +149,7 @@ static int ovl_fill_lower(struct ovl_readdir_data *rdd,
- if (p) {
- list_move_tail(&p->l_node, &rdd->middle);
- } else {
-- p = ovl_cache_entry_new(rdd->dir, name, namelen, ino, d_type);
-+ p = ovl_cache_entry_new(rdd, name, namelen, ino, d_type);
- if (p == NULL)
- rdd->err = -ENOMEM;
- else
-@@ -219,6 +199,43 @@ static int ovl_fill_merge(struct dir_context *ctx, const char *name,
- return ovl_fill_lower(rdd, name, namelen, offset, ino, d_type);
- }
-
-+static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
-+{
-+ int err;
-+ struct ovl_cache_entry *p;
-+ struct dentry *dentry;
-+ const struct cred *old_cred;
-+ struct cred *override_cred;
-+
-+ override_cred = prepare_creds();
-+ if (!override_cred)
-+ return -ENOMEM;
-+
-+ /*
-+ * CAP_DAC_OVERRIDE for lookup
-+ */
-+ cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
-+ old_cred = override_creds(override_cred);
-+
-+ err = mutex_lock_killable(&dir->d_inode->i_mutex);
-+ if (!err) {
-+ while (rdd->first_maybe_whiteout) {
-+ p = rdd->first_maybe_whiteout;
-+ rdd->first_maybe_whiteout = p->next_maybe_whiteout;
-+ dentry = lookup_one_len(p->name, dir, p->len);
-+ if (!IS_ERR(dentry)) {
-+ p->is_whiteout = ovl_is_whiteout(dentry);
-+ dput(dentry);
-+ }
-+ }
-+ mutex_unlock(&dir->d_inode->i_mutex);
-+ }
-+ revert_creds(old_cred);
-+ put_cred(override_cred);
-+
-+ return err;
-+}
-+
- static inline int ovl_dir_read(struct path *realpath,
- struct ovl_readdir_data *rdd)
- {
-@@ -229,7 +246,7 @@ static inline int ovl_dir_read(struct path *realpath,
- if (IS_ERR(realfile))
- return PTR_ERR(realfile);
-
-- rdd->dir = realpath->dentry;
-+ rdd->first_maybe_whiteout = NULL;
- rdd->ctx.pos = 0;
- do {
- rdd->count = 0;
-@@ -238,6 +255,10 @@ static inline int ovl_dir_read(struct path *realpath,
- if (err >= 0)
- err = rdd->err;
- } while (!err && rdd->count);
-+
-+ if (!err && rdd->first_maybe_whiteout)
-+ err = ovl_check_whiteouts(realpath->dentry, rdd);
-+
- fput(realfile);
-
- return err;
-diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
-index 3fbf167..73e75a8 100644
---- a/fs/xfs/xfs_attr_inactive.c
-+++ b/fs/xfs/xfs_attr_inactive.c
-@@ -435,8 +435,14 @@ xfs_attr_inactive(
- */
- xfs_trans_ijoin(trans, dp, 0);
-
-- /* invalidate and truncate the attribute fork extents */
-- if (dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
-+ /*
-+ * Invalidate and truncate the attribute fork extents. Make sure the
-+ * fork actually has attributes as otherwise the invalidation has no
-+ * blocks to read and returns an error. In this case, just do the fork
-+ * removal below.
-+ */
-+ if (xfs_inode_hasattr(dp) &&
-+ dp->i_d.di_aformat != XFS_DINODE_FMT_LOCAL) {
- error = xfs_attr3_root_inactive(&trans, dp);
- if (error)
- goto out_cancel;
-diff --git a/fs/xfs/xfs_symlink.c b/fs/xfs/xfs_symlink.c
-index 3df411e..40c0765 100644
---- a/fs/xfs/xfs_symlink.c
-+++ b/fs/xfs/xfs_symlink.c
-@@ -104,7 +104,7 @@ xfs_readlink_bmap(
- cur_chunk += sizeof(struct xfs_dsymlink_hdr);
- }
-
-- memcpy(link + offset, bp->b_addr, byte_cnt);
-+ memcpy(link + offset, cur_chunk, byte_cnt);
-
- pathlen -= byte_cnt;
- offset += byte_cnt;
-diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
-index 08ef57b..f5ed1f1 100644
---- a/include/acpi/acpixf.h
-+++ b/include/acpi/acpixf.h
-@@ -195,9 +195,18 @@ ACPI_INIT_GLOBAL(u8, acpi_gbl_do_not_use_xsdt, FALSE);
- * address. Although ACPICA adheres to the ACPI specification which
- * requires the use of the corresponding 64-bit address if it is non-zero,
- * some machines have been found to have a corrupted non-zero 64-bit
-- * address. Default is TRUE, favor the 32-bit addresses.
-+ * address. Default is FALSE, do not favor the 32-bit addresses.
- */
--ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, TRUE);
-+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_fadt_addresses, FALSE);
-+
-+/*
-+ * Optionally use 32-bit FACS table addresses.
-+ * It is reported that some platforms fail to resume from system suspending
-+ * if 64-bit FACS table address is selected:
-+ * https://bugzilla.kernel.org/show_bug.cgi?id=74021
-+ * Default is TRUE, favor the 32-bit addresses.
-+ */
-+ACPI_INIT_GLOBAL(u8, acpi_gbl_use32_bit_facs_addresses, TRUE);
-
- /*
- * Optionally truncate I/O addresses to 16 bits. Provides compatibility
-diff --git a/include/acpi/actypes.h b/include/acpi/actypes.h
-index 1c3002e..181427e 100644
---- a/include/acpi/actypes.h
-+++ b/include/acpi/actypes.h
-@@ -572,6 +572,7 @@ typedef u64 acpi_integer;
- #define ACPI_NO_ACPI_ENABLE 0x10
- #define ACPI_NO_DEVICE_INIT 0x20
- #define ACPI_NO_OBJECT_INIT 0x40
-+#define ACPI_NO_FACS_INIT 0x80
-
- /*
- * Initialization state
-diff --git a/include/drm/drm_atomic.h b/include/drm/drm_atomic.h
-index c1571034..3f13b91 100644
---- a/include/drm/drm_atomic.h
-+++ b/include/drm/drm_atomic.h
-@@ -77,26 +77,26 @@ int __must_check drm_atomic_async_commit(struct drm_atomic_state *state);
-
- #define for_each_connector_in_state(state, connector, connector_state, __i) \
- for ((__i) = 0; \
-- (connector) = (state)->connectors[__i], \
-- (connector_state) = (state)->connector_states[__i], \
-- (__i) < (state)->num_connector; \
-+ (__i) < (state)->num_connector && \
-+ ((connector) = (state)->connectors[__i], \
-+ (connector_state) = (state)->connector_states[__i], 1); \
- (__i)++) \
- if (connector)
-
- #define for_each_crtc_in_state(state, crtc, crtc_state, __i) \
- for ((__i) = 0; \
-- (crtc) = (state)->crtcs[__i], \
-- (crtc_state) = (state)->crtc_states[__i], \
-- (__i) < (state)->dev->mode_config.num_crtc; \
-+ (__i) < (state)->dev->mode_config.num_crtc && \
-+ ((crtc) = (state)->crtcs[__i], \
-+ (crtc_state) = (state)->crtc_states[__i], 1); \
- (__i)++) \
- if (crtc_state)
-
--#define for_each_plane_in_state(state, plane, plane_state, __i) \
-- for ((__i) = 0; \
-- (plane) = (state)->planes[__i], \
-- (plane_state) = (state)->plane_states[__i], \
-- (__i) < (state)->dev->mode_config.num_total_plane; \
-- (__i)++) \
-+#define for_each_plane_in_state(state, plane, plane_state, __i) \
-+ for ((__i) = 0; \
-+ (__i) < (state)->dev->mode_config.num_total_plane && \
-+ ((plane) = (state)->planes[__i], \
-+ (plane_state) = (state)->plane_states[__i], 1); \
-+ (__i)++) \
- if (plane_state)
-
- #endif /* DRM_ATOMIC_H_ */
-diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
-index ca71c03..5423358 100644
---- a/include/drm/drm_crtc.h
-+++ b/include/drm/drm_crtc.h
-@@ -731,6 +731,8 @@ struct drm_connector {
- uint8_t num_h_tile, num_v_tile;
- uint8_t tile_h_loc, tile_v_loc;
- uint16_t tile_h_size, tile_v_size;
-+
-+ struct list_head destroy_list;
- };
-
- /**
-diff --git a/include/drm/drm_dp_mst_helper.h b/include/drm/drm_dp_mst_helper.h
-index a250781..86d0b25 100644
---- a/include/drm/drm_dp_mst_helper.h
-+++ b/include/drm/drm_dp_mst_helper.h
-@@ -463,6 +463,10 @@ struct drm_dp_mst_topology_mgr {
- struct work_struct work;
-
- struct work_struct tx_work;
-+
-+ struct list_head destroy_connector_list;
-+ struct mutex destroy_connector_lock;
-+ struct work_struct destroy_connector_work;
- };
-
- int drm_dp_mst_topology_mgr_init(struct drm_dp_mst_topology_mgr *mgr, struct device *dev, struct drm_dp_aux *aux, int max_dpcd_transaction_bytes, int max_payloads, int conn_base_id);
-diff --git a/include/linux/acpi.h b/include/linux/acpi.h
-index 5da2d2e..4550be3 100644
---- a/include/linux/acpi.h
-+++ b/include/linux/acpi.h
-@@ -332,9 +332,6 @@ int acpi_check_region(resource_size_t start, resource_size_t n,
-
- int acpi_resources_are_enforced(void);
-
--int acpi_reserve_region(u64 start, unsigned int length, u8 space_id,
-- unsigned long flags, char *desc);
--
- #ifdef CONFIG_HIBERNATION
- void __init acpi_no_s4_hw_signature(void);
- #endif
-@@ -530,13 +527,6 @@ static inline int acpi_check_region(resource_size_t start, resource_size_t n,
- return 0;
- }
-
--static inline int acpi_reserve_region(u64 start, unsigned int length,
-- u8 space_id, unsigned long flags,
-- char *desc)
--{
-- return -ENXIO;
--}
--
- struct acpi_table_header;
- static inline int acpi_table_parse(char *id,
- int (*handler)(struct acpi_table_header *))
-diff --git a/include/linux/ata.h b/include/linux/ata.h
-index b666b77..533dbb6 100644
---- a/include/linux/ata.h
-+++ b/include/linux/ata.h
-@@ -45,6 +45,7 @@ enum {
- ATA_SECT_SIZE = 512,
- ATA_MAX_SECTORS_128 = 128,
- ATA_MAX_SECTORS = 256,
-+ ATA_MAX_SECTORS_1024 = 1024,
- ATA_MAX_SECTORS_LBA48 = 65535,/* TODO: 65536? */
- ATA_MAX_SECTORS_TAPE = 65535,
-
-diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h
-index 73b4522..e6797de 100644
---- a/include/linux/buffer_head.h
-+++ b/include/linux/buffer_head.h
-@@ -317,6 +317,13 @@ sb_getblk(struct super_block *sb, sector_t block)
- return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, __GFP_MOVABLE);
- }
-
-+
-+static inline struct buffer_head *
-+sb_getblk_gfp(struct super_block *sb, sector_t block, gfp_t gfp)
-+{
-+ return __getblk_gfp(sb->s_bdev, block, sb->s_blocksize, gfp);
-+}
-+
- static inline struct buffer_head *
- sb_find_get_block(struct super_block *sb, sector_t block)
- {
-diff --git a/include/linux/compiler-intel.h b/include/linux/compiler-intel.h
-index 0c9a2f2..d4c7113 100644
---- a/include/linux/compiler-intel.h
-+++ b/include/linux/compiler-intel.h
-@@ -13,10 +13,12 @@
- /* Intel ECC compiler doesn't support gcc specific asm stmts.
- * It uses intrinsics to do the equivalent things.
- */
-+#undef barrier
- #undef barrier_data
- #undef RELOC_HIDE
- #undef OPTIMIZER_HIDE_VAR
-
-+#define barrier() __memory_barrier()
- #define barrier_data(ptr) barrier()
-
- #define RELOC_HIDE(ptr, off) \
-diff --git a/include/linux/gpio/consumer.h b/include/linux/gpio/consumer.h
-index 3a7c9ff..da04265 100644
---- a/include/linux/gpio/consumer.h
-+++ b/include/linux/gpio/consumer.h
-@@ -406,6 +406,21 @@ static inline int desc_to_gpio(const struct gpio_desc *desc)
- return -EINVAL;
- }
-
-+/* Child properties interface */
-+struct fwnode_handle;
-+
-+static inline struct gpio_desc *fwnode_get_named_gpiod(
-+ struct fwnode_handle *fwnode, const char *propname)
-+{
-+ return ERR_PTR(-ENOSYS);
-+}
-+
-+static inline struct gpio_desc *devm_get_gpiod_from_child(
-+ struct device *dev, const char *con_id, struct fwnode_handle *child)
-+{
-+ return ERR_PTR(-ENOSYS);
-+}
-+
- #endif /* CONFIG_GPIOLIB */
-
- /*
-diff --git a/include/linux/hid-sensor-hub.h b/include/linux/hid-sensor-hub.h
-index 0042bf3..c02b5ce 100644
---- a/include/linux/hid-sensor-hub.h
-+++ b/include/linux/hid-sensor-hub.h
-@@ -230,6 +230,7 @@ struct hid_sensor_common {
- struct platform_device *pdev;
- unsigned usage_id;
- atomic_t data_ready;
-+ atomic_t user_requested_state;
- struct iio_trigger *trigger;
- struct hid_sensor_hub_attribute_info poll;
- struct hid_sensor_hub_attribute_info report_state;
-diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
-index 20e7f78..edb640a 100644
---- a/include/linux/jbd2.h
-+++ b/include/linux/jbd2.h
-@@ -1035,7 +1035,7 @@ struct buffer_head *jbd2_journal_get_descriptor_buffer(journal_t *journal);
- int jbd2_journal_next_log_block(journal_t *, unsigned long long *);
- int jbd2_journal_get_log_tail(journal_t *journal, tid_t *tid,
- unsigned long *block);
--void __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-+int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
- void jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block);
-
- /* Commit management */
-@@ -1157,7 +1157,7 @@ extern int jbd2_journal_recover (journal_t *journal);
- extern int jbd2_journal_wipe (journal_t *, int);
- extern int jbd2_journal_skip_recovery (journal_t *);
- extern void jbd2_journal_update_sb_errno(journal_t *);
--extern void jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
-+extern int jbd2_journal_update_sb_log_tail (journal_t *, tid_t,
- unsigned long, int);
- extern void __jbd2_journal_abort_hard (journal_t *);
- extern void jbd2_journal_abort (journal_t *, int);
-diff --git a/include/linux/libata.h b/include/linux/libata.h
-index 28aeae4..e0e3378 100644
---- a/include/linux/libata.h
-+++ b/include/linux/libata.h
-@@ -431,6 +431,9 @@ enum {
- ATA_HORKAGE_NOLPM = (1 << 20), /* don't use LPM */
- ATA_HORKAGE_WD_BROKEN_LPM = (1 << 21), /* some WDs have broken LPM */
- ATA_HORKAGE_ZERO_AFTER_TRIM = (1 << 22),/* guarantees zero after trim */
-+ ATA_HORKAGE_NO_NCQ_LOG = (1 << 23), /* don't use NCQ for log read */
-+ ATA_HORKAGE_NOTRIM = (1 << 24), /* don't use TRIM */
-+ ATA_HORKAGE_MAX_SEC_1024 = (1 << 25), /* Limit max sects to 1024 */
-
- /* DMA mask for user DMA control: User visible values; DO NOT
- renumber */
-diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
-index 93ab607..e9e9a8d 100644
---- a/include/linux/nfs_xdr.h
-+++ b/include/linux/nfs_xdr.h
-@@ -1142,7 +1142,7 @@ struct nfs41_state_protection {
- struct nfs4_op_map allow;
- };
-
--#define NFS4_EXCHANGE_ID_LEN (48)
-+#define NFS4_EXCHANGE_ID_LEN (127)
- struct nfs41_exchange_id_args {
- struct nfs_client *client;
- nfs4_verifier *verifier;
-diff --git a/include/linux/of.h b/include/linux/of.h
-index b871ff9..8135d50 100644
---- a/include/linux/of.h
-+++ b/include/linux/of.h
-@@ -673,7 +673,10 @@ static inline void of_property_clear_flag(struct property *p, unsigned long flag
- #if defined(CONFIG_OF) && defined(CONFIG_NUMA)
- extern int of_node_to_nid(struct device_node *np);
- #else
--static inline int of_node_to_nid(struct device_node *device) { return 0; }
-+static inline int of_node_to_nid(struct device_node *device)
-+{
-+ return NUMA_NO_NODE;
-+}
- #endif
-
- static inline struct device_node *of_find_matching_node(
-diff --git a/include/uapi/drm/i915_drm.h b/include/uapi/drm/i915_drm.h
-index 551b673..a7e41fb 100644
---- a/include/uapi/drm/i915_drm.h
-+++ b/include/uapi/drm/i915_drm.h
-@@ -1065,6 +1065,14 @@ struct drm_i915_reg_read {
- __u64 offset;
- __u64 val; /* Return value */
- };
-+/* Known registers:
-+ *
-+ * Render engine timestamp - 0x2358 + 64bit - gen7+
-+ * - Note this register returns an invalid value if using the default
-+ * single instruction 8byte read, in order to workaround that use
-+ * offset (0x2538 | 1) instead.
-+ *
-+ */
-
- struct drm_i915_reset_stats {
- __u32 ctx_id;
-diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig
-index 7e01f78..9e30231 100644
---- a/kernel/power/Kconfig
-+++ b/kernel/power/Kconfig
-@@ -187,7 +187,7 @@ config DPM_WATCHDOG
- config DPM_WATCHDOG_TIMEOUT
- int "Watchdog timeout in seconds"
- range 1 120
-- default 12
-+ default 60
- depends on DPM_WATCHDOG
-
- config PM_TRACE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index c099b08..bff0169 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -484,11 +484,11 @@ int check_syslog_permissions(int type, bool from_file)
- * already done the capabilities checks at open time.
- */
- if (from_file && type != SYSLOG_ACTION_OPEN)
-- return 0;
-+ goto ok;
-
- if (syslog_action_restricted(type)) {
- if (capable(CAP_SYSLOG))
-- return 0;
-+ goto ok;
- /*
- * For historical reasons, accept CAP_SYS_ADMIN too, with
- * a warning.
-@@ -498,10 +498,11 @@ int check_syslog_permissions(int type, bool from_file)
- "CAP_SYS_ADMIN but no CAP_SYSLOG "
- "(deprecated).\n",
- current->comm, task_pid_nr(current));
-- return 0;
-+ goto ok;
- }
- return -EPERM;
- }
-+ok:
- return security_syslog(type);
- }
-
-@@ -1263,10 +1264,6 @@ int do_syslog(int type, char __user *buf, int len, bool from_file)
- if (error)
- goto out;
-
-- error = security_syslog(type);
-- if (error)
-- return error;
--
- switch (type) {
- case SYSLOG_ACTION_CLOSE: /* Close log */
- break;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index d261201..921691c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -444,6 +444,7 @@ enum {
-
- TRACE_CONTROL_BIT,
-
-+ TRACE_BRANCH_BIT,
- /*
- * Abuse of the trace_recursion.
- * As we need a way to maintain state if we are tracing the function
-@@ -1312,7 +1313,7 @@ void trace_event_init(void);
- void trace_event_enum_update(struct trace_enum_map **map, int len);
- #else
- static inline void __init trace_event_init(void) { }
--static inlin void trace_event_enum_update(struct trace_enum_map **map, int len) { }
-+static inline void trace_event_enum_update(struct trace_enum_map **map, int len) { }
- #endif
-
- extern struct trace_iterator *tracepoint_print_iter;
-diff --git a/kernel/trace/trace_branch.c b/kernel/trace/trace_branch.c
-index 57cbf1e..1879980 100644
---- a/kernel/trace/trace_branch.c
-+++ b/kernel/trace/trace_branch.c
-@@ -36,9 +36,12 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- struct trace_branch *entry;
- struct ring_buffer *buffer;
- unsigned long flags;
-- int cpu, pc;
-+ int pc;
- const char *p;
-
-+ if (current->trace_recursion & TRACE_BRANCH_BIT)
-+ return;
-+
- /*
- * I would love to save just the ftrace_likely_data pointer, but
- * this code can also be used by modules. Ugly things can happen
-@@ -49,10 +52,10 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- if (unlikely(!tr))
- return;
-
-- local_irq_save(flags);
-- cpu = raw_smp_processor_id();
-- data = per_cpu_ptr(tr->trace_buffer.data, cpu);
-- if (atomic_inc_return(&data->disabled) != 1)
-+ raw_local_irq_save(flags);
-+ current->trace_recursion |= TRACE_BRANCH_BIT;
-+ data = this_cpu_ptr(tr->trace_buffer.data);
-+ if (atomic_read(&data->disabled))
- goto out;
-
- pc = preempt_count();
-@@ -81,8 +84,8 @@ probe_likely_condition(struct ftrace_branch_data *f, int val, int expect)
- __buffer_unlock_commit(buffer, event);
-
- out:
-- atomic_dec(&data->disabled);
-- local_irq_restore(flags);
-+ current->trace_recursion &= ~TRACE_BRANCH_BIT;
-+ raw_local_irq_restore(flags);
- }
-
- static inline
-diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
-index 7f2e97c..52adf02 100644
---- a/kernel/trace/trace_events_filter.c
-+++ b/kernel/trace/trace_events_filter.c
-@@ -1056,6 +1056,9 @@ static void parse_init(struct filter_parse_state *ps,
-
- static char infix_next(struct filter_parse_state *ps)
- {
-+ if (!ps->infix.cnt)
-+ return 0;
-+
- ps->infix.cnt--;
-
- return ps->infix.string[ps->infix.tail++];
-@@ -1071,6 +1074,9 @@ static char infix_peek(struct filter_parse_state *ps)
-
- static void infix_advance(struct filter_parse_state *ps)
- {
-+ if (!ps->infix.cnt)
-+ return;
-+
- ps->infix.cnt--;
- ps->infix.tail++;
- }
-@@ -1385,7 +1391,9 @@ static int check_preds(struct filter_parse_state *ps)
- if (elt->op != OP_NOT)
- cnt--;
- n_normal_preds++;
-- WARN_ON_ONCE(cnt < 0);
-+ /* all ops should have operands */
-+ if (cnt < 0)
-+ break;
- }
-
- if (cnt != 1 || !n_normal_preds || n_logical_preds >= n_normal_preds) {
-diff --git a/lib/bitmap.c b/lib/bitmap.c
-index 64c0926..40162f8 100644
---- a/lib/bitmap.c
-+++ b/lib/bitmap.c
-@@ -506,12 +506,12 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- unsigned a, b;
- int c, old_c, totaldigits;
- const char __user __force *ubuf = (const char __user __force *)buf;
-- int exp_digit, in_range;
-+ int at_start, in_range;
-
- totaldigits = c = 0;
- bitmap_zero(maskp, nmaskbits);
- do {
-- exp_digit = 1;
-+ at_start = 1;
- in_range = 0;
- a = b = 0;
-
-@@ -540,11 +540,10 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- break;
-
- if (c == '-') {
-- if (exp_digit || in_range)
-+ if (at_start || in_range)
- return -EINVAL;
- b = 0;
- in_range = 1;
-- exp_digit = 1;
- continue;
- }
-
-@@ -554,16 +553,18 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen,
- b = b * 10 + (c - '0');
- if (!in_range)
- a = b;
-- exp_digit = 0;
-+ at_start = 0;
- totaldigits++;
- }
- if (!(a <= b))
- return -EINVAL;
- if (b >= nmaskbits)
- return -ERANGE;
-- while (a <= b) {
-- set_bit(a, maskp);
-- a++;
-+ if (!at_start) {
-+ while (a <= b) {
-+ set_bit(a, maskp);
-+ a++;
-+ }
- }
- } while (buflen && c == ',');
- return 0;
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 271e443..8c4c1f9 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -40,6 +40,11 @@ int hugepages_treat_as_movable;
- int hugetlb_max_hstate __read_mostly;
- unsigned int default_hstate_idx;
- struct hstate hstates[HUGE_MAX_HSTATE];
-+/*
-+ * Minimum page order among possible hugepage sizes, set to a proper value
-+ * at boot time.
-+ */
-+static unsigned int minimum_order __read_mostly = UINT_MAX;
-
- __initdata LIST_HEAD(huge_boot_pages);
-
-@@ -1188,19 +1193,13 @@ static void dissolve_free_huge_page(struct page *page)
- */
- void dissolve_free_huge_pages(unsigned long start_pfn, unsigned long end_pfn)
- {
-- unsigned int order = 8 * sizeof(void *);
- unsigned long pfn;
-- struct hstate *h;
-
- if (!hugepages_supported())
- return;
-
-- /* Set scan step to minimum hugepage size */
-- for_each_hstate(h)
-- if (order > huge_page_order(h))
-- order = huge_page_order(h);
-- VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << order));
-- for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << order)
-+ VM_BUG_ON(!IS_ALIGNED(start_pfn, 1 << minimum_order));
-+ for (pfn = start_pfn; pfn < end_pfn; pfn += 1 << minimum_order)
- dissolve_free_huge_page(pfn_to_page(pfn));
- }
-
-@@ -1627,10 +1626,14 @@ static void __init hugetlb_init_hstates(void)
- struct hstate *h;
-
- for_each_hstate(h) {
-+ if (minimum_order > huge_page_order(h))
-+ minimum_order = huge_page_order(h);
-+
- /* oversize hugepages were init'ed in early boot */
- if (!hstate_is_gigantic(h))
- hugetlb_hstate_alloc_pages(h);
- }
-+ VM_BUG_ON(minimum_order == UINT_MAX);
- }
-
- static char * __init memfmt(char *buf, unsigned long n)
-diff --git a/mm/memory.c b/mm/memory.c
-index 22e037e..2a9e098 100644
---- a/mm/memory.c
-+++ b/mm/memory.c
-@@ -2669,6 +2669,10 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
-
- pte_unmap(page_table);
-
-+ /* File mapping without ->vm_ops ? */
-+ if (vma->vm_flags & VM_SHARED)
-+ return VM_FAULT_SIGBUS;
-+
- /* Check if we need to add a guard page to the stack */
- if (check_stack_guard_page(vma, address) < 0)
- return VM_FAULT_SIGSEGV;
-@@ -3097,6 +3101,9 @@ static int do_fault(struct mm_struct *mm, struct vm_area_struct *vma,
- - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff;
-
- pte_unmap(page_table);
-+ /* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */
-+ if (!vma->vm_ops->fault)
-+ return VM_FAULT_SIGBUS;
- if (!(flags & FAULT_FLAG_WRITE))
- return do_read_fault(mm, vma, address, pmd, pgoff, flags,
- orig_pte);
-@@ -3242,13 +3249,12 @@ static int handle_pte_fault(struct mm_struct *mm,
- barrier();
- if (!pte_present(entry)) {
- if (pte_none(entry)) {
-- if (vma->vm_ops) {
-- if (likely(vma->vm_ops->fault))
-- return do_fault(mm, vma, address, pte,
-- pmd, flags, entry);
-- }
-- return do_anonymous_page(mm, vma, address,
-- pte, pmd, flags);
-+ if (vma->vm_ops)
-+ return do_fault(mm, vma, address, pte, pmd,
-+ flags, entry);
-+
-+ return do_anonymous_page(mm, vma, address, pte, pmd,
-+ flags);
- }
- return do_swap_page(mm, vma, address,
- pte, pmd, flags, entry);
-diff --git a/net/9p/client.c b/net/9p/client.c
-index 6f4c4c8..81925b9 100644
---- a/net/9p/client.c
-+++ b/net/9p/client.c
-@@ -843,7 +843,8 @@ static struct p9_req_t *p9_client_zc_rpc(struct p9_client *c, int8_t type,
- if (err < 0) {
- if (err == -EIO)
- c->status = Disconnected;
-- goto reterr;
-+ if (err != -ERESTARTSYS)
-+ goto reterr;
- }
- if (req->status == REQ_STATUS_ERROR) {
- p9_debug(P9_DEBUG_ERROR, "req_status error %d\n", req->t_err);
-@@ -1647,6 +1648,7 @@ p9_client_write(struct p9_fid *fid, u64 offset, struct iov_iter *from, int *err)
- if (*err) {
- trace_9p_protocol_dump(clnt, req->rc);
- p9_free_req(clnt, req);
-+ break;
- }
-
- p9_debug(P9_DEBUG_9P, "<<< RWRITE count %d\n", count);
-diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
-index 56f9edb..e11a5cf 100644
---- a/net/bluetooth/hci_sock.c
-+++ b/net/bluetooth/hci_sock.c
-@@ -741,10 +741,11 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
- goto done;
- }
-
-- if (test_bit(HCI_UP, &hdev->flags) ||
-- test_bit(HCI_INIT, &hdev->flags) ||
-+ if (test_bit(HCI_INIT, &hdev->flags) ||
- hci_dev_test_flag(hdev, HCI_SETUP) ||
-- hci_dev_test_flag(hdev, HCI_CONFIG)) {
-+ hci_dev_test_flag(hdev, HCI_CONFIG) ||
-+ (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
-+ test_bit(HCI_UP, &hdev->flags))) {
- err = -EBUSY;
- hci_dev_put(hdev);
- goto done;
-@@ -760,10 +761,21 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr,
-
- err = hci_dev_open(hdev->id);
- if (err) {
-- hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
-- mgmt_index_added(hdev);
-- hci_dev_put(hdev);
-- goto done;
-+ if (err == -EALREADY) {
-+ /* In case the transport is already up and
-+ * running, clear the error here.
-+ *
-+ * This can happen when opening an user
-+ * channel and HCI_AUTO_OFF grace period
-+ * is still active.
-+ */
-+ err = 0;
-+ } else {
-+ hci_dev_clear_flag(hdev, HCI_USER_CHANNEL);
-+ mgmt_index_added(hdev);
-+ hci_dev_put(hdev);
-+ goto done;
-+ }
- }
-
- atomic_inc(&hdev->promisc);
-diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c
-index 1579669..4a31258 100644
---- a/net/ceph/osdmap.c
-+++ b/net/ceph/osdmap.c
-@@ -89,7 +89,7 @@ static int crush_decode_tree_bucket(void **p, void *end,
- {
- int j;
- dout("crush_decode_tree_bucket %p to %p\n", *p, end);
-- ceph_decode_32_safe(p, end, b->num_nodes, bad);
-+ ceph_decode_8_safe(p, end, b->num_nodes, bad);
- b->node_weights = kcalloc(b->num_nodes, sizeof(u32), GFP_NOFS);
- if (b->node_weights == NULL)
- return -ENOMEM;
-diff --git a/net/ieee802154/socket.c b/net/ieee802154/socket.c
-index b60c65f..627a253 100644
---- a/net/ieee802154/socket.c
-+++ b/net/ieee802154/socket.c
-@@ -739,6 +739,12 @@ static int dgram_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
- sock_recv_ts_and_drops(msg, sk, skb);
-
- if (saddr) {
-+ /* Clear the implicit padding in struct sockaddr_ieee802154
-+ * (16 bits between 'family' and 'addr') and in struct
-+ * ieee802154_addr_sa (16 bits at the end of the structure).
-+ */
-+ memset(saddr, 0, sizeof(*saddr));
-+
- saddr->family = AF_IEEE802154;
- ieee802154_addr_to_sa(&saddr->addr, &mac_cb(skb)->source);
- *addr_len = sizeof(*saddr);
-diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
-index ff347a0..f06d422 100644
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3356,6 +3356,7 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
- /* Update CSA counters */
- if (sdata->vif.csa_active &&
- (sdata->vif.type == NL80211_IFTYPE_AP ||
-+ sdata->vif.type == NL80211_IFTYPE_MESH_POINT ||
- sdata->vif.type == NL80211_IFTYPE_ADHOC) &&
- params->n_csa_offsets) {
- int i;
-diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
-index bfef1b2..a9c9d96 100644
---- a/net/mac80211/ibss.c
-+++ b/net/mac80211/ibss.c
-@@ -146,6 +146,7 @@ ieee80211_ibss_build_presp(struct ieee80211_sub_if_data *sdata,
- csa_settings->chandef.chan->center_freq);
- presp->csa_counter_offsets[0] = (pos - presp->head);
- *pos++ = csa_settings->count;
-+ presp->csa_current_counter = csa_settings->count;
- }
-
- /* put the remaining rates in WLAN_EID_EXT_SUPP_RATES */
-diff --git a/net/mac80211/main.c b/net/mac80211/main.c
-index df3051d..e86daed 100644
---- a/net/mac80211/main.c
-+++ b/net/mac80211/main.c
-@@ -249,6 +249,7 @@ static void ieee80211_restart_work(struct work_struct *work)
- {
- struct ieee80211_local *local =
- container_of(work, struct ieee80211_local, restart_work);
-+ struct ieee80211_sub_if_data *sdata;
-
- /* wait for scan work complete */
- flush_workqueue(local->workqueue);
-@@ -257,6 +258,8 @@ static void ieee80211_restart_work(struct work_struct *work)
- "%s called with hardware scan in progress\n", __func__);
-
- rtnl_lock();
-+ list_for_each_entry(sdata, &local->interfaces, list)
-+ flush_delayed_work(&sdata->dec_tailroom_needed_wk);
- ieee80211_scan_cancel(local);
- ieee80211_reconfig(local);
- rtnl_unlock();
-diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
-index d468424..817098a 100644
---- a/net/mac80211/mesh.c
-+++ b/net/mac80211/mesh.c
-@@ -680,6 +680,7 @@ ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
- *pos++ = 0x0;
- *pos++ = ieee80211_frequency_to_channel(
- csa->settings.chandef.chan->center_freq);
-+ bcn->csa_current_counter = csa->settings.count;
- bcn->csa_counter_offsets[0] = hdr_len + 6;
- *pos++ = csa->settings.count;
- *pos++ = WLAN_EID_CHAN_SWITCH_PARAM;
-diff --git a/net/sunrpc/backchannel_rqst.c b/net/sunrpc/backchannel_rqst.c
-index 9dd0ea8d..28504df 100644
---- a/net/sunrpc/backchannel_rqst.c
-+++ b/net/sunrpc/backchannel_rqst.c
-@@ -60,7 +60,7 @@ static void xprt_free_allocation(struct rpc_rqst *req)
-
- dprintk("RPC: free allocations for req= %p\n", req);
- WARN_ON_ONCE(test_bit(RPC_BC_PA_IN_USE, &req->rq_bc_pa_state));
-- xbufp = &req->rq_private_buf;
-+ xbufp = &req->rq_rcv_buf;
- free_page((unsigned long)xbufp->head[0].iov_base);
- xbufp = &req->rq_snd_buf;
- free_page((unsigned long)xbufp->head[0].iov_base);
-diff --git a/net/wireless/util.c b/net/wireless/util.c
-index 70051ab..7e4e3ff 100644
---- a/net/wireless/util.c
-+++ b/net/wireless/util.c
-@@ -944,7 +944,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
- ntype == NL80211_IFTYPE_P2P_CLIENT))
- return -EBUSY;
-
-- if (ntype != otype && netif_running(dev)) {
-+ if (ntype != otype) {
- dev->ieee80211_ptr->use_4addr = false;
- dev->ieee80211_ptr->mesh_id_up_len = 0;
- wdev_lock(dev->ieee80211_ptr);
-diff --git a/samples/trace_events/trace-events-sample.h b/samples/trace_events/trace-events-sample.h
-index 8965d1b..125d640 100644
---- a/samples/trace_events/trace-events-sample.h
-+++ b/samples/trace_events/trace-events-sample.h
-@@ -168,7 +168,10 @@
- *
- * For __dynamic_array(int, foo, bar) use __get_dynamic_array(foo)
- * Use __get_dynamic_array_len(foo) to get the length of the array
-- * saved.
-+ * saved. Note, __get_dynamic_array_len() returns the total allocated
-+ * length of the dynamic array; __print_array() expects the second
-+ * parameter to be the number of elements. To get that, the array length
-+ * needs to be divided by the element size.
- *
- * For __string(foo, bar) use __get_str(foo)
- *
-@@ -288,7 +291,7 @@ TRACE_EVENT(foo_bar,
- * This prints out the array that is defined by __array in a nice format.
- */
- __print_array(__get_dynamic_array(list),
-- __get_dynamic_array_len(list),
-+ __get_dynamic_array_len(list) / sizeof(int),
- sizeof(int)),
- __get_str(str), __get_bitmask(cpus))
- );
-diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
-index 10f9943..5820914 100644
---- a/security/integrity/evm/evm_main.c
-+++ b/security/integrity/evm/evm_main.c
-@@ -296,6 +296,17 @@ static int evm_protect_xattr(struct dentry *dentry, const char *xattr_name,
- iint = integrity_iint_find(d_backing_inode(dentry));
- if (iint && (iint->flags & IMA_NEW_FILE))
- return 0;
-+
-+ /* exception for pseudo filesystems */
-+ if (dentry->d_inode->i_sb->s_magic == TMPFS_MAGIC
-+ || dentry->d_inode->i_sb->s_magic == SYSFS_MAGIC)
-+ return 0;
-+
-+ integrity_audit_msg(AUDIT_INTEGRITY_METADATA,
-+ dentry->d_inode, dentry->d_name.name,
-+ "update_metadata",
-+ integrity_status_msg[evm_status],
-+ -EPERM, 0);
- }
- out:
- if (evm_status != INTEGRITY_PASS)
-diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
-index 8ee997d..fc56d4d 100644
---- a/security/integrity/ima/ima.h
-+++ b/security/integrity/ima/ima.h
-@@ -106,7 +106,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
- const char *op, const char *cause);
- int ima_init_crypto(void);
- void ima_putc(struct seq_file *m, void *data, int datalen);
--void ima_print_digest(struct seq_file *m, u8 *digest, int size);
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size);
- struct ima_template_desc *ima_template_desc_current(void);
- int ima_init_template(void);
-
-diff --git a/security/integrity/ima/ima_fs.c b/security/integrity/ima/ima_fs.c
-index 461215e..816d175 100644
---- a/security/integrity/ima/ima_fs.c
-+++ b/security/integrity/ima/ima_fs.c
-@@ -190,9 +190,9 @@ static const struct file_operations ima_measurements_ops = {
- .release = seq_release,
- };
-
--void ima_print_digest(struct seq_file *m, u8 *digest, int size)
-+void ima_print_digest(struct seq_file *m, u8 *digest, u32 size)
- {
-- int i;
-+ u32 i;
-
- for (i = 0; i < size; i++)
- seq_printf(m, "%02x", *(digest + i));
-diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
-index d1eefb9..3997e20 100644
---- a/security/integrity/ima/ima_policy.c
-+++ b/security/integrity/ima/ima_policy.c
-@@ -27,6 +27,8 @@
- #define IMA_UID 0x0008
- #define IMA_FOWNER 0x0010
- #define IMA_FSUUID 0x0020
-+#define IMA_INMASK 0x0040
-+#define IMA_EUID 0x0080
-
- #define UNKNOWN 0
- #define MEASURE 0x0001 /* same as IMA_MEASURE */
-@@ -42,6 +44,8 @@ enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
- LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
- };
-
-+enum policy_types { ORIGINAL_TCB = 1, DEFAULT_TCB };
-+
- struct ima_rule_entry {
- struct list_head list;
- int action;
-@@ -70,7 +74,7 @@ struct ima_rule_entry {
- * normal users can easily run the machine out of memory simply building
- * and running executables.
- */
--static struct ima_rule_entry default_rules[] = {
-+static struct ima_rule_entry dont_measure_rules[] = {
- {.action = DONT_MEASURE, .fsmagic = PROC_SUPER_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_MEASURE, .fsmagic = SYSFS_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_MEASURE, .fsmagic = DEBUGFS_MAGIC, .flags = IMA_FSMAGIC},
-@@ -79,12 +83,31 @@ static struct ima_rule_entry default_rules[] = {
- {.action = DONT_MEASURE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_MEASURE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_MEASURE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
-+ {.action = DONT_MEASURE, .fsmagic = CGROUP_SUPER_MAGIC,
-+ .flags = IMA_FSMAGIC},
-+ {.action = DONT_MEASURE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC}
-+};
-+
-+static struct ima_rule_entry original_measurement_rules[] = {
- {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
- .flags = IMA_FUNC | IMA_MASK},
- {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
- .flags = IMA_FUNC | IMA_MASK},
-- {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ, .uid = GLOBAL_ROOT_UID,
-- .flags = IMA_FUNC | IMA_MASK | IMA_UID},
-+ {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
-+ .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_MASK | IMA_UID},
-+ {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
-+ {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
-+};
-+
-+static struct ima_rule_entry default_measurement_rules[] = {
-+ {.action = MEASURE, .func = MMAP_CHECK, .mask = MAY_EXEC,
-+ .flags = IMA_FUNC | IMA_MASK},
-+ {.action = MEASURE, .func = BPRM_CHECK, .mask = MAY_EXEC,
-+ .flags = IMA_FUNC | IMA_MASK},
-+ {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
-+ .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_EUID},
-+ {.action = MEASURE, .func = FILE_CHECK, .mask = MAY_READ,
-+ .uid = GLOBAL_ROOT_UID, .flags = IMA_FUNC | IMA_INMASK | IMA_UID},
- {.action = MEASURE, .func = MODULE_CHECK, .flags = IMA_FUNC},
- {.action = MEASURE, .func = FIRMWARE_CHECK, .flags = IMA_FUNC},
- };
-@@ -99,6 +122,7 @@ static struct ima_rule_entry default_appraise_rules[] = {
- {.action = DONT_APPRAISE, .fsmagic = BINFMTFS_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_APPRAISE, .fsmagic = SECURITYFS_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_APPRAISE, .fsmagic = SELINUX_MAGIC, .flags = IMA_FSMAGIC},
-+ {.action = DONT_APPRAISE, .fsmagic = NSFS_MAGIC, .flags = IMA_FSMAGIC},
- {.action = DONT_APPRAISE, .fsmagic = CGROUP_SUPER_MAGIC, .flags = IMA_FSMAGIC},
- #ifndef CONFIG_IMA_APPRAISE_SIGNED_INIT
- {.action = APPRAISE, .fowner = GLOBAL_ROOT_UID, .flags = IMA_FOWNER},
-@@ -115,14 +139,29 @@ static struct list_head *ima_rules;
-
- static DEFINE_MUTEX(ima_rules_mutex);
-
--static bool ima_use_tcb __initdata;
-+static int ima_policy __initdata;
- static int __init default_measure_policy_setup(char *str)
- {
-- ima_use_tcb = 1;
-+ if (ima_policy)
-+ return 1;
-+
-+ ima_policy = ORIGINAL_TCB;
- return 1;
- }
- __setup("ima_tcb", default_measure_policy_setup);
-
-+static int __init policy_setup(char *str)
-+{
-+ if (ima_policy)
-+ return 1;
-+
-+ if (strcmp(str, "tcb") == 0)
-+ ima_policy = DEFAULT_TCB;
-+
-+ return 1;
-+}
-+__setup("ima_policy=", policy_setup);
-+
- static bool ima_use_appraise_tcb __initdata;
- static int __init default_appraise_policy_setup(char *str)
- {
-@@ -182,6 +221,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
- if ((rule->flags & IMA_MASK) &&
- (rule->mask != mask && func != POST_SETATTR))
- return false;
-+ if ((rule->flags & IMA_INMASK) &&
-+ (!(rule->mask & mask) && func != POST_SETATTR))
-+ return false;
- if ((rule->flags & IMA_FSMAGIC)
- && rule->fsmagic != inode->i_sb->s_magic)
- return false;
-@@ -190,6 +232,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
- return false;
- if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid))
- return false;
-+ if (rule->flags & IMA_EUID) {
-+ if (has_capability_noaudit(current, CAP_SETUID)) {
-+ if (!uid_eq(rule->uid, cred->euid)
-+ && !uid_eq(rule->uid, cred->suid)
-+ && !uid_eq(rule->uid, cred->uid))
-+ return false;
-+ } else if (!uid_eq(rule->uid, cred->euid))
-+ return false;
-+ }
-+
- if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid))
- return false;
- for (i = 0; i < MAX_LSM_RULES; i++) {
-@@ -333,21 +385,31 @@ void __init ima_init_policy(void)
- {
- int i, measure_entries, appraise_entries;
-
-- /* if !ima_use_tcb set entries = 0 so we load NO default rules */
-- measure_entries = ima_use_tcb ? ARRAY_SIZE(default_rules) : 0;
-+ /* if !ima_policy set entries = 0 so we load NO default rules */
-+ measure_entries = ima_policy ? ARRAY_SIZE(dont_measure_rules) : 0;
- appraise_entries = ima_use_appraise_tcb ?
- ARRAY_SIZE(default_appraise_rules) : 0;
-
-- for (i = 0; i < measure_entries + appraise_entries; i++) {
-- if (i < measure_entries)
-- list_add_tail(&default_rules[i].list,
-- &ima_default_rules);
-- else {
-- int j = i - measure_entries;
-+ for (i = 0; i < measure_entries; i++)
-+ list_add_tail(&dont_measure_rules[i].list, &ima_default_rules);
-
-- list_add_tail(&default_appraise_rules[j].list,
-+ switch (ima_policy) {
-+ case ORIGINAL_TCB:
-+ for (i = 0; i < ARRAY_SIZE(original_measurement_rules); i++)
-+ list_add_tail(&original_measurement_rules[i].list,
- &ima_default_rules);
-- }
-+ break;
-+ case DEFAULT_TCB:
-+ for (i = 0; i < ARRAY_SIZE(default_measurement_rules); i++)
-+ list_add_tail(&default_measurement_rules[i].list,
-+ &ima_default_rules);
-+ default:
-+ break;
-+ }
-+
-+ for (i = 0; i < appraise_entries; i++) {
-+ list_add_tail(&default_appraise_rules[i].list,
-+ &ima_default_rules);
- }
-
- ima_rules = &ima_default_rules;
-@@ -373,7 +435,8 @@ enum {
- Opt_audit,
- Opt_obj_user, Opt_obj_role, Opt_obj_type,
- Opt_subj_user, Opt_subj_role, Opt_subj_type,
-- Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
-+ Opt_func, Opt_mask, Opt_fsmagic,
-+ Opt_uid, Opt_euid, Opt_fowner,
- Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
- };
-
-@@ -394,6 +457,7 @@ static match_table_t policy_tokens = {
- {Opt_fsmagic, "fsmagic=%s"},
- {Opt_fsuuid, "fsuuid=%s"},
- {Opt_uid, "uid=%s"},
-+ {Opt_euid, "euid=%s"},
- {Opt_fowner, "fowner=%s"},
- {Opt_appraise_type, "appraise_type=%s"},
- {Opt_permit_directio, "permit_directio"},
-@@ -435,6 +499,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value)
- static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- {
- struct audit_buffer *ab;
-+ char *from;
- char *p;
- int result = 0;
-
-@@ -525,18 +590,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- if (entry->mask)
- result = -EINVAL;
-
-- if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
-+ from = args[0].from;
-+ if (*from == '^')
-+ from++;
-+
-+ if ((strcmp(from, "MAY_EXEC")) == 0)
- entry->mask = MAY_EXEC;
-- else if (strcmp(args[0].from, "MAY_WRITE") == 0)
-+ else if (strcmp(from, "MAY_WRITE") == 0)
- entry->mask = MAY_WRITE;
-- else if (strcmp(args[0].from, "MAY_READ") == 0)
-+ else if (strcmp(from, "MAY_READ") == 0)
- entry->mask = MAY_READ;
-- else if (strcmp(args[0].from, "MAY_APPEND") == 0)
-+ else if (strcmp(from, "MAY_APPEND") == 0)
- entry->mask = MAY_APPEND;
- else
- result = -EINVAL;
- if (!result)
-- entry->flags |= IMA_MASK;
-+ entry->flags |= (*args[0].from == '^')
-+ ? IMA_INMASK : IMA_MASK;
- break;
- case Opt_fsmagic:
- ima_log_string(ab, "fsmagic", args[0].from);
-@@ -566,6 +636,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
- break;
- case Opt_uid:
- ima_log_string(ab, "uid", args[0].from);
-+ case Opt_euid:
-+ if (token == Opt_euid)
-+ ima_log_string(ab, "euid", args[0].from);
-
- if (uid_valid(entry->uid)) {
- result = -EINVAL;
-@@ -574,11 +647,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
-
- result = kstrtoul(args[0].from, 10, &lnum);
- if (!result) {
-- entry->uid = make_kuid(current_user_ns(), (uid_t)lnum);
-- if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum))
-+ entry->uid = make_kuid(current_user_ns(),
-+ (uid_t) lnum);
-+ if (!uid_valid(entry->uid) ||
-+ (uid_t)lnum != lnum)
- result = -EINVAL;
- else
-- entry->flags |= IMA_UID;
-+ entry->flags |= (token == Opt_uid)
-+ ? IMA_UID : IMA_EUID;
- }
- break;
- case Opt_fowner:
-diff --git a/security/integrity/ima/ima_template_lib.c b/security/integrity/ima/ima_template_lib.c
-index bcfc36c..61fbd0c 100644
---- a/security/integrity/ima/ima_template_lib.c
-+++ b/security/integrity/ima/ima_template_lib.c
-@@ -70,7 +70,8 @@ static void ima_show_template_data_ascii(struct seq_file *m,
- enum data_formats datafmt,
- struct ima_field_data *field_data)
- {
-- u8 *buf_ptr = field_data->data, buflen = field_data->len;
-+ u8 *buf_ptr = field_data->data;
-+ u32 buflen = field_data->len;
-
- switch (datafmt) {
- case DATA_FMT_DIGEST_WITH_ALGO:
-diff --git a/security/keys/keyring.c b/security/keys/keyring.c
-index e72548b..d334370 100644
---- a/security/keys/keyring.c
-+++ b/security/keys/keyring.c
-@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
- if (index_key->type == &key_type_keyring)
- up_write(&keyring_serialise_link_sem);
-
-- if (edit && !edit->dead_leaf) {
-- key_payload_reserve(keyring,
-- keyring->datalen - KEYQUOTA_LINK_BYTES);
-+ if (edit) {
-+ if (!edit->dead_leaf) {
-+ key_payload_reserve(keyring,
-+ keyring->datalen - KEYQUOTA_LINK_BYTES);
-+ }
- assoc_array_cancel_edit(edit);
- }
- up_write(&keyring->sem);
-diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index 212070e..7f8d7f1 100644
---- a/security/selinux/hooks.c
-+++ b/security/selinux/hooks.c
-@@ -3288,7 +3288,8 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
- int rc = 0;
-
- if (default_noexec &&
-- (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
-+ (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
-+ (!shared && (prot & PROT_WRITE)))) {
- /*
- * We are making executable an anonymous mapping or a
- * private file mapping that will also be writable.
-diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c
-index afe6a26..57644b1 100644
---- a/security/selinux/ss/ebitmap.c
-+++ b/security/selinux/ss/ebitmap.c
-@@ -153,6 +153,12 @@ int ebitmap_netlbl_import(struct ebitmap *ebmap,
- if (offset == (u32)-1)
- return 0;
-
-+ /* don't waste ebitmap space if the netlabel bitmap is empty */
-+ if (bitmap == 0) {
-+ offset += EBITMAP_UNIT_SIZE;
-+ continue;
-+ }
-+
- if (e_iter == NULL ||
- offset >= e_iter->startbit + EBITMAP_SIZE) {
- e_prev = e_iter;
-diff --git a/sound/soc/codecs/max98925.c b/sound/soc/codecs/max98925.c
-index 9b5a17d..aad6642 100644
---- a/sound/soc/codecs/max98925.c
-+++ b/sound/soc/codecs/max98925.c
-@@ -346,7 +346,7 @@ static int max98925_dai_set_fmt(struct snd_soc_dai *codec_dai,
- }
-
- regmap_update_bits(max98925->regmap, MAX98925_FORMAT,
-- M98925_DAI_BCI_MASK, invert);
-+ M98925_DAI_BCI_MASK | M98925_DAI_WCI_MASK, invert);
- return 0;
- }
-
-diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
-index be4d741..2ee44ab 100644
---- a/sound/soc/codecs/rt5645.c
-+++ b/sound/soc/codecs/rt5645.c
-@@ -2837,6 +2837,8 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
- }
- }
-
-+ INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
-+
- if (rt5645->i2c->irq) {
- ret = request_threaded_irq(rt5645->i2c->irq, NULL, rt5645_irq,
- IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING
-@@ -2855,8 +2857,6 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
- dev_err(&i2c->dev, "Fail gpio_direction hp_det_gpio\n");
- }
-
-- INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
--
- return snd_soc_register_codec(&i2c->dev, &soc_codec_dev_rt5645,
- rt5645_dai, ARRAY_SIZE(rt5645_dai));
- }
-diff --git a/sound/soc/codecs/tas2552.c b/sound/soc/codecs/tas2552.c
-index dfb4ff5..1855859 100644
---- a/sound/soc/codecs/tas2552.c
-+++ b/sound/soc/codecs/tas2552.c
-@@ -120,6 +120,9 @@ static void tas2552_sw_shutdown(struct tas2552_data *tas_data, int sw_shutdown)
- {
- u8 cfg1_reg;
-
-+ if (!tas_data->codec)
-+ return;
-+
- if (sw_shutdown)
- cfg1_reg = 0;
- else
-@@ -335,7 +338,6 @@ static DECLARE_TLV_DB_SCALE(dac_tlv, -7, 100, 24);
- static const struct snd_kcontrol_new tas2552_snd_controls[] = {
- SOC_SINGLE_TLV("Speaker Driver Playback Volume",
- TAS2552_PGA_GAIN, 0, 0x1f, 1, dac_tlv),
-- SOC_DAPM_SINGLE("Playback AMP", SND_SOC_NOPM, 0, 1, 0),
- };
-
- static const struct reg_default tas2552_init_regs[] = {
-diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
-index 0c6d1bc..d476221 100644
---- a/sound/soc/codecs/wm5102.c
-+++ b/sound/soc/codecs/wm5102.c
-@@ -42,7 +42,7 @@ struct wm5102_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- static const struct wm_adsp_region wm5102_dsp1_regions[] = {
-diff --git a/sound/soc/codecs/wm5110.c b/sound/soc/codecs/wm5110.c
-index fbaeddb..3ee6cfd 100644
---- a/sound/soc/codecs/wm5110.c
-+++ b/sound/soc/codecs/wm5110.c
-@@ -167,7 +167,7 @@ static int wm5110_sysclk_ev(struct snd_soc_dapm_widget *w,
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- #define WM5110_NG_SRC(name, base) \
-diff --git a/sound/soc/codecs/wm8737.c b/sound/soc/codecs/wm8737.c
-index ada9ac1..51171e4 100644
---- a/sound/soc/codecs/wm8737.c
-+++ b/sound/soc/codecs/wm8737.c
-@@ -483,7 +483,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
-
- /* Fast VMID ramp at 2*2.5k */
- snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
-- WM8737_VMIDSEL_MASK, 0x4);
-+ WM8737_VMIDSEL_MASK,
-+ 2 << WM8737_VMIDSEL_SHIFT);
-
- /* Bring VMID up */
- snd_soc_update_bits(codec, WM8737_POWER_MANAGEMENT,
-@@ -497,7 +498,8 @@ static int wm8737_set_bias_level(struct snd_soc_codec *codec,
-
- /* VMID at 2*300k */
- snd_soc_update_bits(codec, WM8737_MISC_BIAS_CONTROL,
-- WM8737_VMIDSEL_MASK, 2);
-+ WM8737_VMIDSEL_MASK,
-+ 1 << WM8737_VMIDSEL_SHIFT);
-
- break;
-
-diff --git a/sound/soc/codecs/wm8903.h b/sound/soc/codecs/wm8903.h
-index db94931..0bb4a64 100644
---- a/sound/soc/codecs/wm8903.h
-+++ b/sound/soc/codecs/wm8903.h
-@@ -172,7 +172,7 @@ extern int wm8903_mic_detect(struct snd_soc_codec *codec,
- #define WM8903_VMID_BUF_ENA_WIDTH 1 /* VMID_BUF_ENA */
-
- #define WM8903_VMID_RES_50K 2
--#define WM8903_VMID_RES_250K 3
-+#define WM8903_VMID_RES_250K 4
- #define WM8903_VMID_RES_5K 6
-
- /*
-diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
-index 00bec91..03e04bf 100644
---- a/sound/soc/codecs/wm8955.c
-+++ b/sound/soc/codecs/wm8955.c
-@@ -298,7 +298,7 @@ static int wm8955_configure_clocking(struct snd_soc_codec *codec)
- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
- WM8955_K_17_9_MASK,
- (pll.k >> 9) & WM8955_K_17_9_MASK);
-- snd_soc_update_bits(codec, WM8955_PLL_CONTROL_2,
-+ snd_soc_update_bits(codec, WM8955_PLL_CONTROL_3,
- WM8955_K_8_0_MASK,
- pll.k & WM8955_K_8_0_MASK);
- if (pll.k)
-diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
-index e97a761..8d7f632 100644
---- a/sound/soc/codecs/wm8960.c
-+++ b/sound/soc/codecs/wm8960.c
-@@ -245,7 +245,7 @@ SOC_SINGLE("PCM Playback -6dB Switch", WM8960_DACCTL1, 7, 1, 0),
- SOC_ENUM("ADC Polarity", wm8960_enum[0]),
- SOC_SINGLE("ADC High Pass Filter Switch", WM8960_DACCTL1, 0, 1, 0),
-
--SOC_ENUM("DAC Polarity", wm8960_enum[2]),
-+SOC_ENUM("DAC Polarity", wm8960_enum[1]),
- SOC_SINGLE_BOOL_EXT("DAC Deemphasis Switch", 0,
- wm8960_get_deemph, wm8960_put_deemph),
-
-diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c
-index a4d1177..e7c81ba 100644
---- a/sound/soc/codecs/wm8997.c
-+++ b/sound/soc/codecs/wm8997.c
-@@ -40,7 +40,7 @@ struct wm8997_priv {
- static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
- static DECLARE_TLV_DB_SCALE(eq_tlv, -1200, 100, 0);
- static DECLARE_TLV_DB_SCALE(digital_tlv, -6400, 50, 0);
--static DECLARE_TLV_DB_SCALE(noise_tlv, 0, 600, 0);
-+static DECLARE_TLV_DB_SCALE(noise_tlv, -13200, 600, 0);
- static DECLARE_TLV_DB_SCALE(ng_tlv, -10200, 600, 0);
-
- static const struct reg_default wm8997_sysclk_reva_patch[] = {
-diff --git a/sound/soc/fsl/imx-wm8962.c b/sound/soc/fsl/imx-wm8962.c
-index cd146d4..b38b98c 100644
---- a/sound/soc/fsl/imx-wm8962.c
-+++ b/sound/soc/fsl/imx-wm8962.c
-@@ -190,7 +190,7 @@ static int imx_wm8962_probe(struct platform_device *pdev)
- dev_err(&pdev->dev, "audmux internal port setup failed\n");
- return ret;
- }
-- imx_audmux_v2_configure_port(ext_port,
-+ ret = imx_audmux_v2_configure_port(ext_port,
- IMX_AUDMUX_V2_PTCR_SYN,
- IMX_AUDMUX_V2_PDCR_RXDSEL(int_port));
- if (ret) {
-diff --git a/sound/soc/omap/Kconfig b/sound/soc/omap/Kconfig
-index 6768e4f..30d0109 100644
---- a/sound/soc/omap/Kconfig
-+++ b/sound/soc/omap/Kconfig
-@@ -100,12 +100,13 @@ config SND_OMAP_SOC_OMAP_TWL4030
-
- config SND_OMAP_SOC_OMAP_ABE_TWL6040
- tristate "SoC Audio support for OMAP boards using ABE and twl6040 codec"
-- depends on TWL6040_CORE && SND_OMAP_SOC && (ARCH_OMAP4 || SOC_OMAP5 || COMPILE_TEST)
-+ depends on TWL6040_CORE && SND_OMAP_SOC
-+ depends on ARCH_OMAP4 || (SOC_OMAP5 && MFD_PALMAS) || COMPILE_TEST
- select SND_OMAP_SOC_DMIC
- select SND_OMAP_SOC_MCPDM
- select SND_SOC_TWL6040
- select SND_SOC_DMIC
-- select COMMON_CLK_PALMAS if MFD_PALMAS
-+ select COMMON_CLK_PALMAS if (SOC_OMAP5 && MFD_PALMAS)
- help
- Say Y if you want to add support for SoC audio on OMAP boards using
- ABE and twl6040 codec. This driver currently supports:
-diff --git a/sound/soc/qcom/Kconfig b/sound/soc/qcom/Kconfig
-index 5f58e4f..b07f183 100644
---- a/sound/soc/qcom/Kconfig
-+++ b/sound/soc/qcom/Kconfig
-@@ -6,12 +6,10 @@ config SND_SOC_QCOM
-
- config SND_SOC_LPASS_CPU
- tristate
-- depends on SND_SOC_QCOM
- select REGMAP_MMIO
-
- config SND_SOC_LPASS_PLATFORM
- tristate
-- depends on SND_SOC_QCOM
- select REGMAP_MMIO
-
- config SND_SOC_STORM
-diff --git a/tools/perf/util/cloexec.c b/tools/perf/util/cloexec.c
-index 85b5238..2babdda 100644
---- a/tools/perf/util/cloexec.c
-+++ b/tools/perf/util/cloexec.c
-@@ -7,11 +7,15 @@
-
- static unsigned long flag = PERF_FLAG_FD_CLOEXEC;
-
-+#ifdef __GLIBC_PREREQ
-+#if !__GLIBC_PREREQ(2, 6)
- int __weak sched_getcpu(void)
- {
- errno = ENOSYS;
- return -1;
- }
-+#endif
-+#endif
-
- static int perf_flag_probe(void)
- {
diff --git a/4.1.4/0000_README b/4.1.5/0000_README
similarity index 94%
rename from 4.1.4/0000_README
rename to 4.1.5/0000_README
index 9d09b8e..ec1dd3d 100644
--- a/4.1.4/0000_README
+++ b/4.1.5/0000_README
@@ -2,11 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1003_linux-4.1.4.patch
+Patch: 1004_linux-4.1.5.patch
From: http://www.kernel.org
-Desc: Linux 4.1.4
+Desc: Linux 4.1.5
-Patch: 4420_grsecurity-3.1-4.1.4-201508032312.patch
+Patch: 4420_grsecurity-3.1-4.1.5-201508102129.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/4.1.5/1004_linux-4.1.5.patch b/4.1.5/1004_linux-4.1.5.patch
new file mode 100644
index 0000000..cb5d5d6
--- /dev/null
+++ b/4.1.5/1004_linux-4.1.5.patch
@@ -0,0 +1,5750 @@
+diff --git a/Documentation/hwmon/nct7904 b/Documentation/hwmon/nct7904
+index 014f112..57fffe3 100644
+--- a/Documentation/hwmon/nct7904
++++ b/Documentation/hwmon/nct7904
+@@ -35,11 +35,11 @@ temp1_input Local temperature (1/1000 degree,
+ temp[2-9]_input CPU temperatures (1/1000 degree,
+ 0.125 degree resolution)
+
+-fan[1-4]_mode R/W, 0/1 for manual or SmartFan mode
++pwm[1-4]_enable R/W, 1/2 for manual or SmartFan mode
+ Setting SmartFan mode is supported only if it has been
+ previously configured by BIOS (or configuration EEPROM)
+
+-fan[1-4]_pwm R/O in SmartFan mode, R/W in manual control mode
++pwm[1-4] R/O in SmartFan mode, R/W in manual control mode
+
+ The driver checks sensor control registers and does not export the sensors
+ that are not enabled. Anyway, a sensor that is enabled may actually be not
+diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
+index 74b6c6d..d2b1c40 100644
+--- a/Documentation/kbuild/makefiles.txt
++++ b/Documentation/kbuild/makefiles.txt
+@@ -952,6 +952,14 @@ When kbuild executes, the following steps are followed (roughly):
+ $(KBUILD_ARFLAGS) set by the top level Makefile to "D" (deterministic
+ mode) if this option is supported by $(AR).
+
++ ARCH_CPPFLAGS, ARCH_AFLAGS, ARCH_CFLAGS Overrides the kbuild defaults
++
++ These variables are appended to the KBUILD_CPPFLAGS,
++ KBUILD_AFLAGS, and KBUILD_CFLAGS, respectively, after the
++ top-level Makefile has set any other flags. This provides a
++ means for an architecture to override the defaults.
++
++
+ --- 6.2 Add prerequisites to archheaders:
+
+ The archheaders: rule is used to generate header files that
+diff --git a/Makefile b/Makefile
+index 36f3225..068dd69 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 1
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+ NAME = Series 4800
+
+@@ -783,10 +783,11 @@ endif
+ include scripts/Makefile.kasan
+ include scripts/Makefile.extrawarn
+
+-# Add user supplied CPPFLAGS, AFLAGS and CFLAGS as the last assignments
+-KBUILD_CPPFLAGS += $(KCPPFLAGS)
+-KBUILD_AFLAGS += $(KAFLAGS)
+-KBUILD_CFLAGS += $(KCFLAGS)
++# Add any arch overrides and user supplied CPPFLAGS, AFLAGS and CFLAGS as the
++# last assignments
++KBUILD_CPPFLAGS += $(ARCH_CPPFLAGS) $(KCPPFLAGS)
++KBUILD_AFLAGS += $(ARCH_AFLAGS) $(KAFLAGS)
++KBUILD_CFLAGS += $(ARCH_CFLAGS) $(KCFLAGS)
+
+ # Use --build-id when available.
+ LDFLAGS_BUILD_ID = $(patsubst -Wl$(comma)%,%,\
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index db72fec..2f21e1e 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -43,7 +43,8 @@ endif
+
+ ifndef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ # Generic build system uses -O2, we want -O3
+-cflags-y += -O3
++# Note: No need to add to cflags-y as that happens anyways
++ARCH_CFLAGS += -O3
+ endif
+
+ # small data is default for elf32 tool-chain. If not usable, disable it
+diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
+index 624a9d0..dae03e6 100644
+--- a/arch/arc/include/asm/bitops.h
++++ b/arch/arc/include/asm/bitops.h
+@@ -18,83 +18,49 @@
+ #include <linux/types.h>
+ #include <linux/compiler.h>
+ #include <asm/barrier.h>
++#ifndef CONFIG_ARC_HAS_LLSC
++#include <asm/smp.h>
++#endif
+
+-/*
+- * Hardware assisted read-modify-write using ARC700 LLOCK/SCOND insns.
+- * The Kconfig glue ensures that in SMP, this is only set if the container
+- * SoC/platform has cross-core coherent LLOCK/SCOND
+- */
+ #if defined(CONFIG_ARC_HAS_LLSC)
+
+-static inline void set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned int temp;
+-
+- m += nr >> 5;
+-
+- /*
+- * ARC ISA micro-optimization:
+- *
+- * Instructions dealing with bitpos only consider lower 5 bits (0-31)
+- * e.g (x << 33) is handled like (x << 1) by ASL instruction
+- * (mem pointer still needs adjustment to point to next word)
+- *
+- * Hence the masking to clamp @nr arg can be elided in general.
+- *
+- * However if @nr is a constant (above assumed it in a register),
+- * and greater than 31, gcc can optimize away (x << 33) to 0,
+- * as overflow, given the 32-bit ISA. Thus masking needs to be done
+- * for constant @nr, but no code is generated due to const prop.
+- */
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- __asm__ __volatile__(
+- "1: llock %0, [%1] \n"
+- " bset %0, %0, %2 \n"
+- " scond %0, [%1] \n"
+- " bnz 1b \n"
+- : "=&r"(temp)
+- : "r"(m), "ir"(nr)
+- : "cc");
+-}
+-
+-static inline void clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned int temp;
+-
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- __asm__ __volatile__(
+- "1: llock %0, [%1] \n"
+- " bclr %0, %0, %2 \n"
+- " scond %0, [%1] \n"
+- " bnz 1b \n"
+- : "=&r"(temp)
+- : "r"(m), "ir"(nr)
+- : "cc");
+-}
+-
+-static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned int temp;
+-
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
++/*
++ * Hardware assisted Atomic-R-M-W
++ */
+
+- __asm__ __volatile__(
+- "1: llock %0, [%1] \n"
+- " bxor %0, %0, %2 \n"
+- " scond %0, [%1] \n"
+- " bnz 1b \n"
+- : "=&r"(temp)
+- : "r"(m), "ir"(nr)
+- : "cc");
++#define BIT_OP(op, c_op, asm_op) \
++static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
++{ \
++ unsigned int temp; \
++ \
++ m += nr >> 5; \
++ \
++ /* \
++ * ARC ISA micro-optimization: \
++ * \
++ * Instructions dealing with bitpos only consider lower 5 bits \
++ * e.g (x << 33) is handled like (x << 1) by ASL instruction \
++ * (mem pointer still needs adjustment to point to next word) \
++ * \
++ * Hence the masking to clamp @nr arg can be elided in general. \
++ * \
++ * However if @nr is a constant (above assumed in a register), \
++ * and greater than 31, gcc can optimize away (x << 33) to 0, \
++ * as overflow, given the 32-bit ISA. Thus masking needs to be \
++ * done for const @nr, but no code is generated due to gcc \
++ * const prop. \
++ */ \
++ nr &= 0x1f; \
++ \
++ __asm__ __volatile__( \
++ "1: llock %0, [%1] \n" \
++ " " #asm_op " %0, %0, %2 \n" \
++ " scond %0, [%1] \n" \
++ " bnz 1b \n" \
++ : "=&r"(temp) /* Early clobber, to prevent reg reuse */ \
++ : "r"(m), /* Not "m": llock only supports reg direct addr mode */ \
++ "ir"(nr) \
++ : "cc"); \
+ }
+
+ /*
+@@ -108,91 +74,37 @@ static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+ * Since ARC lacks a equivalent h/w primitive, the bit is set unconditionally
+ * and the old value of bit is returned
+ */
+-static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old, temp;
+-
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- /*
+- * Explicit full memory barrier needed before/after as
+- * LLOCK/SCOND themselves don't provide any such semantics
+- */
+- smp_mb();
+-
+- __asm__ __volatile__(
+- "1: llock %0, [%2] \n"
+- " bset %1, %0, %3 \n"
+- " scond %1, [%2] \n"
+- " bnz 1b \n"
+- : "=&r"(old), "=&r"(temp)
+- : "r"(m), "ir"(nr)
+- : "cc");
+-
+- smp_mb();
+-
+- return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned int old, temp;
+-
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- smp_mb();
+-
+- __asm__ __volatile__(
+- "1: llock %0, [%2] \n"
+- " bclr %1, %0, %3 \n"
+- " scond %1, [%2] \n"
+- " bnz 1b \n"
+- : "=&r"(old), "=&r"(temp)
+- : "r"(m), "ir"(nr)
+- : "cc");
+-
+- smp_mb();
+-
+- return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned int old, temp;
+-
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- smp_mb();
+-
+- __asm__ __volatile__(
+- "1: llock %0, [%2] \n"
+- " bxor %1, %0, %3 \n"
+- " scond %1, [%2] \n"
+- " bnz 1b \n"
+- : "=&r"(old), "=&r"(temp)
+- : "r"(m), "ir"(nr)
+- : "cc");
+-
+- smp_mb();
+-
+- return (old & (1 << nr)) != 0;
++#define TEST_N_BIT_OP(op, c_op, asm_op) \
++static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{ \
++ unsigned long old, temp; \
++ \
++ m += nr >> 5; \
++ \
++ nr &= 0x1f; \
++ \
++ /* \
++ * Explicit full memory barrier needed before/after as \
++ * LLOCK/SCOND themselves don't provide any such smenatic \
++ */ \
++ smp_mb(); \
++ \
++ __asm__ __volatile__( \
++ "1: llock %0, [%2] \n" \
++ " " #asm_op " %1, %0, %3 \n" \
++ " scond %1, [%2] \n" \
++ " bnz 1b \n" \
++ : "=&r"(old), "=&r"(temp) \
++ : "r"(m), "ir"(nr) \
++ : "cc"); \
++ \
++ smp_mb(); \
++ \
++ return (old & (1 << nr)) != 0; \
+ }
+
+ #else /* !CONFIG_ARC_HAS_LLSC */
+
+-#include <asm/smp.h>
+-
+ /*
+ * Non hardware assisted Atomic-R-M-W
+ * Locking would change to irq-disabling only (UP) and spinlocks (SMP)
+@@ -209,111 +121,37 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+ * at compile time)
+ */
+
+-static inline void set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long temp, flags;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- bitops_lock(flags);
+-
+- temp = *m;
+- *m = temp | (1UL << nr);
+-
+- bitops_unlock(flags);
++#define BIT_OP(op, c_op, asm_op) \
++static inline void op##_bit(unsigned long nr, volatile unsigned long *m)\
++{ \
++ unsigned long temp, flags; \
++ m += nr >> 5; \
++ \
++ /* \
++ * spin lock/unlock provide the needed smp_mb() before/after \
++ */ \
++ bitops_lock(flags); \
++ \
++ temp = *m; \
++ *m = temp c_op (1UL << (nr & 0x1f)); \
++ \
++ bitops_unlock(flags); \
+ }
+
+-static inline void clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long temp, flags;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- bitops_lock(flags);
+-
+- temp = *m;
+- *m = temp & ~(1UL << nr);
+-
+- bitops_unlock(flags);
+-}
+-
+-static inline void change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long temp, flags;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- bitops_lock(flags);
+-
+- temp = *m;
+- *m = temp ^ (1UL << nr);
+-
+- bitops_unlock(flags);
+-}
+-
+-static inline int test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old, flags;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- /*
+- * spin lock/unlock provide the needed smp_mb() before/after
+- */
+- bitops_lock(flags);
+-
+- old = *m;
+- *m = old | (1 << nr);
+-
+- bitops_unlock(flags);
+-
+- return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old, flags;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- bitops_lock(flags);
+-
+- old = *m;
+- *m = old & ~(1 << nr);
+-
+- bitops_unlock(flags);
+-
+- return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old, flags;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- bitops_lock(flags);
+-
+- old = *m;
+- *m = old ^ (1 << nr);
+-
+- bitops_unlock(flags);
+-
+- return (old & (1 << nr)) != 0;
++#define TEST_N_BIT_OP(op, c_op, asm_op) \
++static inline int test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{ \
++ unsigned long old, flags; \
++ m += nr >> 5; \
++ \
++ bitops_lock(flags); \
++ \
++ old = *m; \
++ *m = old c_op (1UL << (nr & 0x1f)); \
++ \
++ bitops_unlock(flags); \
++ \
++ return (old & (1UL << (nr & 0x1f))) != 0; \
+ }
+
+ #endif /* CONFIG_ARC_HAS_LLSC */
+@@ -322,86 +160,45 @@ test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+ * Non atomic variants
+ **************************************/
+
+-static inline void __set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long temp;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- temp = *m;
+- *m = temp | (1UL << nr);
++#define __BIT_OP(op, c_op, asm_op) \
++static inline void __##op##_bit(unsigned long nr, volatile unsigned long *m) \
++{ \
++ unsigned long temp; \
++ m += nr >> 5; \
++ \
++ temp = *m; \
++ *m = temp c_op (1UL << (nr & 0x1f)); \
+ }
+
+-static inline void __clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long temp;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- temp = *m;
+- *m = temp & ~(1UL << nr);
++#define __TEST_N_BIT_OP(op, c_op, asm_op) \
++static inline int __test_and_##op##_bit(unsigned long nr, volatile unsigned long *m)\
++{ \
++ unsigned long old; \
++ m += nr >> 5; \
++ \
++ old = *m; \
++ *m = old c_op (1UL << (nr & 0x1f)); \
++ \
++ return (old & (1UL << (nr & 0x1f))) != 0; \
+ }
+
+-static inline void __change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long temp;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- temp = *m;
+- *m = temp ^ (1UL << nr);
+-}
+-
+-static inline int
+-__test_and_set_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- old = *m;
+- *m = old | (1 << nr);
+-
+- return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-__test_and_clear_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- old = *m;
+- *m = old & ~(1 << nr);
+-
+- return (old & (1 << nr)) != 0;
+-}
+-
+-static inline int
+-__test_and_change_bit(unsigned long nr, volatile unsigned long *m)
+-{
+- unsigned long old;
+- m += nr >> 5;
+-
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- old = *m;
+- *m = old ^ (1 << nr);
+-
+- return (old & (1 << nr)) != 0;
+-}
++#define BIT_OPS(op, c_op, asm_op) \
++ \
++ /* set_bit(), clear_bit(), change_bit() */ \
++ BIT_OP(op, c_op, asm_op) \
++ \
++ /* test_and_set_bit(), test_and_clear_bit(), test_and_change_bit() */\
++ TEST_N_BIT_OP(op, c_op, asm_op) \
++ \
++ /* __set_bit(), __clear_bit(), __change_bit() */ \
++ __BIT_OP(op, c_op, asm_op) \
++ \
++ /* __test_and_set_bit(), __test_and_clear_bit(), __test_and_change_bit() */\
++ __TEST_N_BIT_OP(op, c_op, asm_op)
++
++BIT_OPS(set, |, bset)
++BIT_OPS(clear, & ~, bclr)
++BIT_OPS(change, ^, bxor)
+
+ /*
+ * This routine doesn't need to be atomic.
+@@ -413,10 +210,7 @@ test_bit(unsigned int nr, const volatile unsigned long *addr)
+
+ addr += nr >> 5;
+
+- if (__builtin_constant_p(nr))
+- nr &= 0x1f;
+-
+- mask = 1 << nr;
++ mask = 1UL << (nr & 0x1f);
+
+ return ((mask & *addr) != 0);
+ }
+diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h
+index 1bfeec2..2a58af7 100644
+--- a/arch/arc/include/asm/ptrace.h
++++ b/arch/arc/include/asm/ptrace.h
+@@ -63,7 +63,7 @@ struct callee_regs {
+ long r25, r24, r23, r22, r21, r20, r19, r18, r17, r16, r15, r14, r13;
+ };
+
+-#define instruction_pointer(regs) ((regs)->ret)
++#define instruction_pointer(regs) (unsigned long)((regs)->ret)
+ #define profile_pc(regs) instruction_pointer(regs)
+
+ /* return 1 if user mode or 0 if kernel mode */
+diff --git a/arch/arm/boot/dts/am57xx-beagle-x15.dts b/arch/arm/boot/dts/am57xx-beagle-x15.dts
+index 7128fad..c9df40e 100644
+--- a/arch/arm/boot/dts/am57xx-beagle-x15.dts
++++ b/arch/arm/boot/dts/am57xx-beagle-x15.dts
+@@ -544,6 +544,10 @@
+ phy-supply = <&ldousb_reg>;
+ };
+
++&usb2_phy2 {
++ phy-supply = <&ldousb_reg>;
++};
++
+ &usb1 {
+ dr_mode = "host";
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/dra7-evm.dts b/arch/arm/boot/dts/dra7-evm.dts
+index aa46590..096f68b 100644
+--- a/arch/arm/boot/dts/dra7-evm.dts
++++ b/arch/arm/boot/dts/dra7-evm.dts
+@@ -686,7 +686,8 @@
+
+ &dcan1 {
+ status = "ok";
+- pinctrl-names = "default", "sleep";
+- pinctrl-0 = <&dcan1_pins_default>;
++ pinctrl-names = "default", "sleep", "active";
++ pinctrl-0 = <&dcan1_pins_sleep>;
+ pinctrl-1 = <&dcan1_pins_sleep>;
++ pinctrl-2 = <&dcan1_pins_default>;
+ };
+diff --git a/arch/arm/boot/dts/dra72-evm.dts b/arch/arm/boot/dts/dra72-evm.dts
+index ce0390f..6b05f6a 100644
+--- a/arch/arm/boot/dts/dra72-evm.dts
++++ b/arch/arm/boot/dts/dra72-evm.dts
+@@ -497,9 +497,10 @@
+
+ &dcan1 {
+ status = "ok";
+- pinctrl-names = "default", "sleep";
+- pinctrl-0 = <&dcan1_pins_default>;
++ pinctrl-names = "default", "sleep", "active";
++ pinctrl-0 = <&dcan1_pins_sleep>;
+ pinctrl-1 = <&dcan1_pins_sleep>;
++ pinctrl-2 = <&dcan1_pins_default>;
+ };
+
+ &qspi {
+diff --git a/arch/arm/mach-imx/gpc.c b/arch/arm/mach-imx/gpc.c
+index 6d0893a..78b6fd0 100644
+--- a/arch/arm/mach-imx/gpc.c
++++ b/arch/arm/mach-imx/gpc.c
+@@ -291,8 +291,6 @@ void __init imx_gpc_check_dt(void)
+ }
+ }
+
+-#ifdef CONFIG_PM_GENERIC_DOMAINS
+-
+ static void _imx6q_pm_pu_power_off(struct generic_pm_domain *genpd)
+ {
+ int iso, iso2sw;
+@@ -399,7 +397,6 @@ static struct genpd_onecell_data imx_gpc_onecell_data = {
+ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
+ {
+ struct clk *clk;
+- bool is_off;
+ int i;
+
+ imx6q_pu_domain.reg = pu_reg;
+@@ -416,18 +413,13 @@ static int imx_gpc_genpd_init(struct device *dev, struct regulator *pu_reg)
+ }
+ imx6q_pu_domain.num_clks = i;
+
+- is_off = IS_ENABLED(CONFIG_PM);
+- if (is_off) {
+- _imx6q_pm_pu_power_off(&imx6q_pu_domain.base);
+- } else {
+- /*
+- * Enable power if compiled without CONFIG_PM in case the
+- * bootloader disabled it.
+- */
+- imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
+- }
++ /* Enable power always in case bootloader disabled it. */
++ imx6q_pm_pu_power_on(&imx6q_pu_domain.base);
++
++ if (!IS_ENABLED(CONFIG_PM_GENERIC_DOMAINS))
++ return 0;
+
+- pm_genpd_init(&imx6q_pu_domain.base, NULL, is_off);
++ pm_genpd_init(&imx6q_pu_domain.base, NULL, false);
+ return of_genpd_add_provider_onecell(dev->of_node,
+ &imx_gpc_onecell_data);
+
+@@ -437,13 +429,6 @@ clk_err:
+ return -EINVAL;
+ }
+
+-#else
+-static inline int imx_gpc_genpd_init(struct device *dev, struct regulator *reg)
+-{
+- return 0;
+-}
+-#endif /* CONFIG_PM_GENERIC_DOMAINS */
+-
+ static int imx_gpc_probe(struct platform_device *pdev)
+ {
+ struct regulator *pu_reg;
+diff --git a/arch/arm/mach-pxa/capc7117.c b/arch/arm/mach-pxa/capc7117.c
+index c092730..bf366b3 100644
+--- a/arch/arm/mach-pxa/capc7117.c
++++ b/arch/arm/mach-pxa/capc7117.c
+@@ -24,6 +24,7 @@
+ #include <linux/ata_platform.h>
+ #include <linux/serial_8250.h>
+ #include <linux/gpio.h>
++#include <linux/regulator/machine.h>
+
+ #include <asm/mach-types.h>
+ #include <asm/mach/arch.h>
+@@ -144,6 +145,8 @@ static void __init capc7117_init(void)
+
+ capc7117_uarts_init();
+ capc7117_ide_init();
++
++ regulator_has_full_constraints();
+ }
+
+ MACHINE_START(CAPC7117,
+diff --git a/arch/arm/mach-pxa/cm-x2xx.c b/arch/arm/mach-pxa/cm-x2xx.c
+index bb99f59..a17a91e 100644
+--- a/arch/arm/mach-pxa/cm-x2xx.c
++++ b/arch/arm/mach-pxa/cm-x2xx.c
+@@ -13,6 +13,7 @@
+ #include <linux/syscore_ops.h>
+ #include <linux/irq.h>
+ #include <linux/gpio.h>
++#include <linux/regulator/machine.h>
+
+ #include <linux/dm9000.h>
+ #include <linux/leds.h>
+@@ -466,6 +467,8 @@ static void __init cmx2xx_init(void)
+ cmx2xx_init_ac97();
+ cmx2xx_init_touchscreen();
+ cmx2xx_init_leds();
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init cmx2xx_init_irq(void)
+diff --git a/arch/arm/mach-pxa/cm-x300.c b/arch/arm/mach-pxa/cm-x300.c
+index 4d3588d..5851f4c 100644
+--- a/arch/arm/mach-pxa/cm-x300.c
++++ b/arch/arm/mach-pxa/cm-x300.c
+@@ -835,6 +835,8 @@ static void __init cm_x300_init(void)
+ cm_x300_init_ac97();
+ cm_x300_init_wi2wi();
+ cm_x300_init_bl();
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init cm_x300_fixup(struct tag *tags, char **cmdline)
+diff --git a/arch/arm/mach-pxa/colibri-pxa270.c b/arch/arm/mach-pxa/colibri-pxa270.c
+index 5f9d930..3503826 100644
+--- a/arch/arm/mach-pxa/colibri-pxa270.c
++++ b/arch/arm/mach-pxa/colibri-pxa270.c
+@@ -18,6 +18,7 @@
+ #include <linux/mtd/partitions.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/machine.h>
+ #include <linux/ucb1400.h>
+
+ #include <asm/mach/arch.h>
+@@ -294,6 +295,8 @@ static void __init colibri_pxa270_init(void)
+ printk(KERN_ERR "Illegal colibri_pxa270_baseboard type %d\n",
+ colibri_pxa270_baseboard);
+ }
++
++ regulator_has_full_constraints();
+ }
+
+ /* The "Income s.r.o. SH-Dmaster PXA270 SBC" board can be booted either
+diff --git a/arch/arm/mach-pxa/em-x270.c b/arch/arm/mach-pxa/em-x270.c
+index 51531ec..9d7072b 100644
+--- a/arch/arm/mach-pxa/em-x270.c
++++ b/arch/arm/mach-pxa/em-x270.c
+@@ -1306,6 +1306,8 @@ static void __init em_x270_init(void)
+ em_x270_init_i2c();
+ em_x270_init_camera();
+ em_x270_userspace_consumers_init();
++
++ regulator_has_full_constraints();
+ }
+
+ MACHINE_START(EM_X270, "Compulab EM-X270")
+diff --git a/arch/arm/mach-pxa/icontrol.c b/arch/arm/mach-pxa/icontrol.c
+index c98511c..9b0eb02 100644
+--- a/arch/arm/mach-pxa/icontrol.c
++++ b/arch/arm/mach-pxa/icontrol.c
+@@ -26,6 +26,7 @@
+ #include <linux/spi/spi.h>
+ #include <linux/spi/pxa2xx_spi.h>
+ #include <linux/can/platform/mcp251x.h>
++#include <linux/regulator/machine.h>
+
+ #include "generic.h"
+
+@@ -185,6 +186,8 @@ static void __init icontrol_init(void)
+ mxm_8x10_mmc_init();
+
+ icontrol_can_init();
++
++ regulator_has_full_constraints();
+ }
+
+ MACHINE_START(ICONTROL, "iControl/SafeTcam boards using Embedian MXM-8x10 CoM")
+diff --git a/arch/arm/mach-pxa/trizeps4.c b/arch/arm/mach-pxa/trizeps4.c
+index 872dcb2..066e3a2 100644
+--- a/arch/arm/mach-pxa/trizeps4.c
++++ b/arch/arm/mach-pxa/trizeps4.c
+@@ -26,6 +26,7 @@
+ #include <linux/dm9000.h>
+ #include <linux/mtd/physmap.h>
+ #include <linux/mtd/partitions.h>
++#include <linux/regulator/machine.h>
+ #include <linux/i2c/pxa-i2c.h>
+
+ #include <asm/types.h>
+@@ -534,6 +535,8 @@ static void __init trizeps4_init(void)
+
+ BCR_writew(trizeps_conxs_bcr);
+ board_backlight_power(1);
++
++ regulator_has_full_constraints();
+ }
+
+ static void __init trizeps4_map_io(void)
+diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c
+index aa89488..54122a9 100644
+--- a/arch/arm/mach-pxa/vpac270.c
++++ b/arch/arm/mach-pxa/vpac270.c
+@@ -24,6 +24,7 @@
+ #include <linux/dm9000.h>
+ #include <linux/ucb1400.h>
+ #include <linux/ata_platform.h>
++#include <linux/regulator/machine.h>
+ #include <linux/regulator/max1586.h>
+ #include <linux/i2c/pxa-i2c.h>
+
+@@ -711,6 +712,8 @@ static void __init vpac270_init(void)
+ vpac270_ts_init();
+ vpac270_rtc_init();
+ vpac270_ide_init();
++
++ regulator_has_full_constraints();
+ }
+
+ MACHINE_START(VPAC270, "Voipac PXA270")
+diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c
+index ac2ae5c..6158566f 100644
+--- a/arch/arm/mach-pxa/zeus.c
++++ b/arch/arm/mach-pxa/zeus.c
+@@ -868,6 +868,8 @@ static void __init zeus_init(void)
+ i2c_register_board_info(0, ARRAY_AND_SIZE(zeus_i2c_devices));
+ pxa2xx_set_spi_info(3, &pxa2xx_spi_ssp3_master_info);
+ spi_register_board_info(zeus_spi_board_info, ARRAY_SIZE(zeus_spi_board_info));
++
++ regulator_has_full_constraints();
+ }
+
+ static struct map_desc zeus_io_desc[] __initdata = {
+diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
+index 7e7583d..6e4b9ff 100644
+--- a/arch/arm/mm/dma-mapping.c
++++ b/arch/arm/mm/dma-mapping.c
+@@ -1953,7 +1953,7 @@ static int extend_iommu_mapping(struct dma_iommu_mapping *mapping)
+ {
+ int next_bitmap;
+
+- if (mapping->nr_bitmaps > mapping->extensions)
++ if (mapping->nr_bitmaps >= mapping->extensions)
+ return -EINVAL;
+
+ next_bitmap = mapping->nr_bitmaps;
+diff --git a/arch/arm64/kernel/efi.c b/arch/arm64/kernel/efi.c
+index ab21e0d..352962b 100644
+--- a/arch/arm64/kernel/efi.c
++++ b/arch/arm64/kernel/efi.c
+@@ -122,12 +122,12 @@ static int __init uefi_init(void)
+
+ /* Show what we know for posterity */
+ c16 = early_memremap(efi_to_phys(efi.systab->fw_vendor),
+- sizeof(vendor));
++ sizeof(vendor) * sizeof(efi_char16_t));
+ if (c16) {
+ for (i = 0; i < (int) sizeof(vendor) - 1 && *c16; ++i)
+ vendor[i] = c16[i];
+ vendor[i] = '\0';
+- early_memunmap(c16, sizeof(vendor));
++ early_memunmap(c16, sizeof(vendor) * sizeof(efi_char16_t));
+ }
+
+ pr_info("EFI v%u.%.02u by %s\n",
+diff --git a/arch/avr32/mach-at32ap/clock.c b/arch/avr32/mach-at32ap/clock.c
+index 23b1a97..52c179b 100644
+--- a/arch/avr32/mach-at32ap/clock.c
++++ b/arch/avr32/mach-at32ap/clock.c
+@@ -80,6 +80,9 @@ int clk_enable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_enable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -106,6 +109,9 @@ void clk_disable(struct clk *clk)
+ {
+ unsigned long flags;
+
++ if (IS_ERR_OR_NULL(clk))
++ return;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ __clk_disable(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -117,6 +123,9 @@ unsigned long clk_get_rate(struct clk *clk)
+ unsigned long flags;
+ unsigned long rate;
+
++ if (!clk)
++ return 0;
++
+ spin_lock_irqsave(&clk_lock, flags);
+ rate = clk->get_rate(clk);
+ spin_unlock_irqrestore(&clk_lock, flags);
+@@ -129,6 +138,9 @@ long clk_round_rate(struct clk *clk, unsigned long rate)
+ {
+ unsigned long flags, actual_rate;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -145,6 +157,9 @@ int clk_set_rate(struct clk *clk, unsigned long rate)
+ unsigned long flags;
+ long ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_rate)
+ return -ENOSYS;
+
+@@ -161,6 +176,9 @@ int clk_set_parent(struct clk *clk, struct clk *parent)
+ unsigned long flags;
+ int ret;
+
++ if (!clk)
++ return 0;
++
+ if (!clk->set_parent)
+ return -ENOSYS;
+
+@@ -174,7 +192,7 @@ EXPORT_SYMBOL(clk_set_parent);
+
+ struct clk *clk_get_parent(struct clk *clk)
+ {
+- return clk->parent;
++ return !clk ? NULL : clk->parent;
+ }
+ EXPORT_SYMBOL(clk_get_parent);
+
+diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
+index f501665..a3b1ffe 100644
+--- a/arch/mips/Kconfig
++++ b/arch/mips/Kconfig
+@@ -1417,6 +1417,7 @@ config CPU_MIPS64_R6
+ select CPU_SUPPORTS_HIGHMEM
+ select CPU_SUPPORTS_MSA
+ select GENERIC_CSUM
++ select MIPS_O32_FP64_SUPPORT if MIPS32_O32
+ help
+ Choose this option to build a kernel for release 6 or later of the
+ MIPS64 architecture. New MIPS processors, starting with the Warrior
+diff --git a/arch/mips/include/asm/fpu.h b/arch/mips/include/asm/fpu.h
+index 084780b..1b06251 100644
+--- a/arch/mips/include/asm/fpu.h
++++ b/arch/mips/include/asm/fpu.h
+@@ -74,7 +74,7 @@ static inline int __enable_fpu(enum fpu_mode mode)
+ goto fr_common;
+
+ case FPU_64BIT:
+-#if !(defined(CONFIG_CPU_MIPS32_R2) || defined(CONFIG_CPU_MIPS32_R6) \
++#if !(defined(CONFIG_CPU_MIPSR2) || defined(CONFIG_CPU_MIPSR6) \
+ || defined(CONFIG_64BIT))
+ /* we only have a 32-bit FPU */
+ return SIGFPE;
+diff --git a/arch/mips/include/asm/smp.h b/arch/mips/include/asm/smp.h
+index 2b25d1b..16f1ea9 100644
+--- a/arch/mips/include/asm/smp.h
++++ b/arch/mips/include/asm/smp.h
+@@ -23,6 +23,7 @@
+ extern int smp_num_siblings;
+ extern cpumask_t cpu_sibling_map[];
+ extern cpumask_t cpu_core_map[];
++extern cpumask_t cpu_foreign_map;
+
+ #define raw_smp_processor_id() (current_thread_info()->cpu)
+
+diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c
+index faa46eb..d0744cc 100644
+--- a/arch/mips/kernel/smp.c
++++ b/arch/mips/kernel/smp.c
+@@ -63,6 +63,13 @@ EXPORT_SYMBOL(cpu_sibling_map);
+ cpumask_t cpu_core_map[NR_CPUS] __read_mostly;
+ EXPORT_SYMBOL(cpu_core_map);
+
++/*
++ * A logcal cpu mask containing only one VPE per core to
++ * reduce the number of IPIs on large MT systems.
++ */
++cpumask_t cpu_foreign_map __read_mostly;
++EXPORT_SYMBOL(cpu_foreign_map);
++
+ /* representing cpus for which sibling maps can be computed */
+ static cpumask_t cpu_sibling_setup_map;
+
+@@ -103,6 +110,29 @@ static inline void set_cpu_core_map(int cpu)
+ }
+ }
+
++/*
++ * Calculate a new cpu_foreign_map mask whenever a
++ * new cpu appears or disappears.
++ */
++static inline void calculate_cpu_foreign_map(void)
++{
++ int i, k, core_present;
++ cpumask_t temp_foreign_map;
++
++ /* Re-calculate the mask */
++ for_each_online_cpu(i) {
++ core_present = 0;
++ for_each_cpu(k, &temp_foreign_map)
++ if (cpu_data[i].package == cpu_data[k].package &&
++ cpu_data[i].core == cpu_data[k].core)
++ core_present = 1;
++ if (!core_present)
++ cpumask_set_cpu(i, &temp_foreign_map);
++ }
++
++ cpumask_copy(&cpu_foreign_map, &temp_foreign_map);
++}
++
+ struct plat_smp_ops *mp_ops;
+ EXPORT_SYMBOL(mp_ops);
+
+@@ -146,6 +176,8 @@ asmlinkage void start_secondary(void)
+ set_cpu_sibling_map(cpu);
+ set_cpu_core_map(cpu);
+
++ calculate_cpu_foreign_map();
++
+ cpumask_set_cpu(cpu, &cpu_callin_map);
+
+ synchronise_count_slave(cpu);
+@@ -173,9 +205,18 @@ void __irq_entry smp_call_function_interrupt(void)
+ static void stop_this_cpu(void *dummy)
+ {
+ /*
+- * Remove this CPU:
++ * Remove this CPU. Be a bit slow here and
++ * set the bits for every online CPU so we don't miss
++ * any IPI whilst taking this VPE down.
+ */
++
++ cpumask_copy(&cpu_foreign_map, cpu_online_mask);
++
++ /* Make it visible to every other CPU */
++ smp_mb();
++
+ set_cpu_online(smp_processor_id(), false);
++ calculate_cpu_foreign_map();
+ local_irq_disable();
+ while (1);
+ }
+@@ -197,6 +238,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus)
+ mp_ops->prepare_cpus(max_cpus);
+ set_cpu_sibling_map(0);
+ set_cpu_core_map(0);
++ calculate_cpu_foreign_map();
+ #ifndef CONFIG_HOTPLUG_CPU
+ init_cpu_present(cpu_possible_mask);
+ #endif
+diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c
+index 22b9b2c..6983fcd 100644
+--- a/arch/mips/math-emu/cp1emu.c
++++ b/arch/mips/math-emu/cp1emu.c
+@@ -451,7 +451,7 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn,
+ /* Fall through */
+ case jr_op:
+ /* For R6, JR already emulated in jalr_op */
+- if (NO_R6EMU && insn.r_format.opcode == jr_op)
++ if (NO_R6EMU && insn.r_format.func == jr_op)
+ break;
+ *contpc = regs->regs[insn.r_format.rs];
+ return 1;
+diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
+index 2e03ab1..dca0efc 100644
+--- a/arch/mips/mm/c-r4k.c
++++ b/arch/mips/mm/c-r4k.c
+@@ -37,6 +37,7 @@
+ #include <asm/cacheflush.h> /* for run_uncached() */
+ #include <asm/traps.h>
+ #include <asm/dma-coherence.h>
++#include <asm/mips-cm.h>
+
+ /*
+ * Special Variant of smp_call_function for use by cache functions:
+@@ -51,9 +52,16 @@ static inline void r4k_on_each_cpu(void (*func) (void *info), void *info)
+ {
+ preempt_disable();
+
+-#ifndef CONFIG_MIPS_MT_SMP
+- smp_call_function(func, info, 1);
+-#endif
++ /*
++ * The Coherent Manager propagates address-based cache ops to other
++ * cores but not index-based ops. However, r4k_on_each_cpu is used
++ * in both cases so there is no easy way to tell what kind of op is
++ * executed to the other cores. The best we can probably do is
++ * to restrict that call when a CM is not present because both
++ * CM-based SMP protocols (CMP & CPS) restrict index-based cache ops.
++ */
++ if (!mips_cm_present())
++ smp_call_function_many(&cpu_foreign_map, func, info, 1);
+ func(info);
+ preempt_enable();
+ }
+diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
+index 3a08eae..3edbb9f 100644
+--- a/arch/parisc/include/asm/pgalloc.h
++++ b/arch/parisc/include/asm/pgalloc.h
+@@ -72,7 +72,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
+
+ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ {
+- if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
++ if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
+ /*
+ * This is the permanent pmd attached to the pgd;
+ * cannot free it.
+@@ -81,6 +81,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+ */
+ mm_inc_nr_pmds(mm);
+ return;
++ }
+ free_pages((unsigned long)pmd, PMD_ORDER);
+ }
+
+diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
+index 0a18375..f93c4a4 100644
+--- a/arch/parisc/include/asm/pgtable.h
++++ b/arch/parisc/include/asm/pgtable.h
+@@ -16,7 +16,7 @@
+ #include <asm/processor.h>
+ #include <asm/cache.h>
+
+-extern spinlock_t pa_dbit_lock;
++extern spinlock_t pa_tlb_lock;
+
+ /*
+ * kern_addr_valid(ADDR) tests if ADDR is pointing to valid kernel
+@@ -33,6 +33,19 @@ extern spinlock_t pa_dbit_lock;
+ */
+ #define kern_addr_valid(addr) (1)
+
++/* Purge data and instruction TLB entries. Must be called holding
++ * the pa_tlb_lock. The TLB purge instructions are slow on SMP
++ * machines since the purge must be broadcast to all CPUs.
++ */
++
++static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
++{
++ mtsp(mm->context, 1);
++ pdtlb(addr);
++ if (unlikely(split_tlb))
++ pitlb(addr);
++}
++
+ /* Certain architectures need to do special things when PTEs
+ * within a page table are directly modified. Thus, the following
+ * hook is made available.
+@@ -42,15 +55,20 @@ extern spinlock_t pa_dbit_lock;
+ *(pteptr) = (pteval); \
+ } while(0)
+
+-extern void purge_tlb_entries(struct mm_struct *, unsigned long);
++#define pte_inserted(x) \
++ ((pte_val(x) & (_PAGE_PRESENT|_PAGE_ACCESSED)) \
++ == (_PAGE_PRESENT|_PAGE_ACCESSED))
+
+-#define set_pte_at(mm, addr, ptep, pteval) \
+- do { \
++#define set_pte_at(mm, addr, ptep, pteval) \
++ do { \
++ pte_t old_pte; \
+ unsigned long flags; \
+- spin_lock_irqsave(&pa_dbit_lock, flags); \
+- set_pte(ptep, pteval); \
+- purge_tlb_entries(mm, addr); \
+- spin_unlock_irqrestore(&pa_dbit_lock, flags); \
++ spin_lock_irqsave(&pa_tlb_lock, flags); \
++ old_pte = *ptep; \
++ set_pte(ptep, pteval); \
++ if (pte_inserted(old_pte)) \
++ purge_tlb_entries(mm, addr); \
++ spin_unlock_irqrestore(&pa_tlb_lock, flags); \
+ } while (0)
+
+ #endif /* !__ASSEMBLY__ */
+@@ -268,7 +286,7 @@ extern unsigned long *empty_zero_page;
+
+ #define pte_none(x) (pte_val(x) == 0)
+ #define pte_present(x) (pte_val(x) & _PAGE_PRESENT)
+-#define pte_clear(mm,addr,xp) do { pte_val(*(xp)) = 0; } while (0)
++#define pte_clear(mm, addr, xp) set_pte_at(mm, addr, xp, __pte(0))
+
+ #define pmd_flag(x) (pmd_val(x) & PxD_FLAG_MASK)
+ #define pmd_address(x) ((unsigned long)(pmd_val(x) &~ PxD_FLAG_MASK) << PxD_VALUE_SHIFT)
+@@ -435,15 +453,15 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
+ if (!pte_young(*ptep))
+ return 0;
+
+- spin_lock_irqsave(&pa_dbit_lock, flags);
++ spin_lock_irqsave(&pa_tlb_lock, flags);
+ pte = *ptep;
+ if (!pte_young(pte)) {
+- spin_unlock_irqrestore(&pa_dbit_lock, flags);
++ spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ return 0;
+ }
+ set_pte(ptep, pte_mkold(pte));
+ purge_tlb_entries(vma->vm_mm, addr);
+- spin_unlock_irqrestore(&pa_dbit_lock, flags);
++ spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ return 1;
+ }
+
+@@ -453,11 +471,12 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ pte_t old_pte;
+ unsigned long flags;
+
+- spin_lock_irqsave(&pa_dbit_lock, flags);
++ spin_lock_irqsave(&pa_tlb_lock, flags);
+ old_pte = *ptep;
+- pte_clear(mm,addr,ptep);
+- purge_tlb_entries(mm, addr);
+- spin_unlock_irqrestore(&pa_dbit_lock, flags);
++ set_pte(ptep, __pte(0));
++ if (pte_inserted(old_pte))
++ purge_tlb_entries(mm, addr);
++ spin_unlock_irqrestore(&pa_tlb_lock, flags);
+
+ return old_pte;
+ }
+@@ -465,10 +484,10 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
+ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
+ {
+ unsigned long flags;
+- spin_lock_irqsave(&pa_dbit_lock, flags);
++ spin_lock_irqsave(&pa_tlb_lock, flags);
+ set_pte(ptep, pte_wrprotect(*ptep));
+ purge_tlb_entries(mm, addr);
+- spin_unlock_irqrestore(&pa_dbit_lock, flags);
++ spin_unlock_irqrestore(&pa_tlb_lock, flags);
+ }
+
+ #define pte_same(A,B) (pte_val(A) == pte_val(B))
+diff --git a/arch/parisc/include/asm/tlbflush.h b/arch/parisc/include/asm/tlbflush.h
+index 9d086a5..e84b964 100644
+--- a/arch/parisc/include/asm/tlbflush.h
++++ b/arch/parisc/include/asm/tlbflush.h
+@@ -13,6 +13,9 @@
+ * active at any one time on the Merced bus. This tlb purge
+ * synchronisation is fairly lightweight and harmless so we activate
+ * it on all systems not just the N class.
++
++ * It is also used to ensure PTE updates are atomic and consistent
++ * with the TLB.
+ */
+ extern spinlock_t pa_tlb_lock;
+
+@@ -24,20 +27,24 @@ extern void flush_tlb_all_local(void *);
+
+ #define smp_flush_tlb_all() flush_tlb_all()
+
++int __flush_tlb_range(unsigned long sid,
++ unsigned long start, unsigned long end);
++
++#define flush_tlb_range(vma, start, end) \
++ __flush_tlb_range((vma)->vm_mm->context, start, end)
++
++#define flush_tlb_kernel_range(start, end) \
++ __flush_tlb_range(0, start, end)
++
+ /*
+ * flush_tlb_mm()
+ *
+- * XXX This code is NOT valid for HP-UX compatibility processes,
+- * (although it will probably work 99% of the time). HP-UX
+- * processes are free to play with the space id's and save them
+- * over long periods of time, etc. so we have to preserve the
+- * space and just flush the entire tlb. We need to check the
+- * personality in order to do that, but the personality is not
+- * currently being set correctly.
+- *
+- * Of course, Linux processes could do the same thing, but
+- * we don't support that (and the compilers, dynamic linker,
+- * etc. do not do that).
++ * The code to switch to a new context is NOT valid for processes
++ * which play with the space id's. Thus, we have to preserve the
++ * space and just flush the entire tlb. However, the compilers,
++ * dynamic linker, etc, do not manipulate space id's, so there
++ * could be a significant performance benefit in switching contexts
++ * and not flushing the whole tlb.
+ */
+
+ static inline void flush_tlb_mm(struct mm_struct *mm)
+@@ -45,10 +52,18 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
+ BUG_ON(mm == &init_mm); /* Should never happen */
+
+ #if 1 || defined(CONFIG_SMP)
++ /* Except for very small threads, flushing the whole TLB is
++ * faster than using __flush_tlb_range. The pdtlb and pitlb
++ * instructions are very slow because of the TLB broadcast.
++ * It might be faster to do local range flushes on all CPUs
++ * on PA 2.0 systems.
++ */
+ flush_tlb_all();
+ #else
+ /* FIXME: currently broken, causing space id and protection ids
+- * to go out of sync, resulting in faults on userspace accesses.
++ * to go out of sync, resulting in faults on userspace accesses.
++ * This approach needs further investigation since running many
++ * small applications (e.g., GCC testsuite) is faster on HP-UX.
+ */
+ if (mm) {
+ if (mm->context != 0)
+@@ -65,22 +80,12 @@ static inline void flush_tlb_page(struct vm_area_struct *vma,
+ {
+ unsigned long flags, sid;
+
+- /* For one page, it's not worth testing the split_tlb variable */
+-
+- mb();
+ sid = vma->vm_mm->context;
+ purge_tlb_start(flags);
+ mtsp(sid, 1);
+ pdtlb(addr);
+- pitlb(addr);
++ if (unlikely(split_tlb))
++ pitlb(addr);
+ purge_tlb_end(flags);
+ }
+-
+-void __flush_tlb_range(unsigned long sid,
+- unsigned long start, unsigned long end);
+-
+-#define flush_tlb_range(vma,start,end) __flush_tlb_range((vma)->vm_mm->context,start,end)
+-
+-#define flush_tlb_kernel_range(start, end) __flush_tlb_range(0,start,end)
+-
+ #endif
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index f6448c7..cda6dbb 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -342,12 +342,15 @@ EXPORT_SYMBOL(flush_data_cache_local);
+ EXPORT_SYMBOL(flush_kernel_icache_range_asm);
+
+ #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */
+-int parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
++static unsigned long parisc_cache_flush_threshold __read_mostly = FLUSH_THRESHOLD;
++
++#define FLUSH_TLB_THRESHOLD (2*1024*1024) /* 2MB initial TLB threshold */
++static unsigned long parisc_tlb_flush_threshold __read_mostly = FLUSH_TLB_THRESHOLD;
+
+ void __init parisc_setup_cache_timing(void)
+ {
+ unsigned long rangetime, alltime;
+- unsigned long size;
++ unsigned long size, start;
+
+ alltime = mfctl(16);
+ flush_data_cache();
+@@ -364,14 +367,43 @@ void __init parisc_setup_cache_timing(void)
+ /* Racy, but if we see an intermediate value, it's ok too... */
+ parisc_cache_flush_threshold = size * alltime / rangetime;
+
+- parisc_cache_flush_threshold = (parisc_cache_flush_threshold + L1_CACHE_BYTES - 1) &~ (L1_CACHE_BYTES - 1);
++ parisc_cache_flush_threshold = L1_CACHE_ALIGN(parisc_cache_flush_threshold);
+ if (!parisc_cache_flush_threshold)
+ parisc_cache_flush_threshold = FLUSH_THRESHOLD;
+
+ if (parisc_cache_flush_threshold > cache_info.dc_size)
+ parisc_cache_flush_threshold = cache_info.dc_size;
+
+- printk(KERN_INFO "Setting cache flush threshold to %x (%d CPUs online)\n", parisc_cache_flush_threshold, num_online_cpus());
++ printk(KERN_INFO "Setting cache flush threshold to %lu kB\n",
++ parisc_cache_flush_threshold/1024);
++
++ /* calculate TLB flush threshold */
++
++ alltime = mfctl(16);
++ flush_tlb_all();
++ alltime = mfctl(16) - alltime;
++
++ size = PAGE_SIZE;
++ start = (unsigned long) _text;
++ rangetime = mfctl(16);
++ while (start < (unsigned long) _end) {
++ flush_tlb_kernel_range(start, start + PAGE_SIZE);
++ start += PAGE_SIZE;
++ size += PAGE_SIZE;
++ }
++ rangetime = mfctl(16) - rangetime;
++
++ printk(KERN_DEBUG "Whole TLB flush %lu cycles, flushing %lu bytes %lu cycles\n",
++ alltime, size, rangetime);
++
++ parisc_tlb_flush_threshold = size * alltime / rangetime;
++ parisc_tlb_flush_threshold *= num_online_cpus();
++ parisc_tlb_flush_threshold = PAGE_ALIGN(parisc_tlb_flush_threshold);
++ if (!parisc_tlb_flush_threshold)
++ parisc_tlb_flush_threshold = FLUSH_TLB_THRESHOLD;
++
++ printk(KERN_INFO "Setting TLB flush threshold to %lu kB\n",
++ parisc_tlb_flush_threshold/1024);
+ }
+
+ extern void purge_kernel_dcache_page_asm(unsigned long);
+@@ -403,48 +435,45 @@ void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+ }
+ EXPORT_SYMBOL(copy_user_page);
+
+-void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
+-{
+- unsigned long flags;
+-
+- /* Note: purge_tlb_entries can be called at startup with
+- no context. */
+-
+- purge_tlb_start(flags);
+- mtsp(mm->context, 1);
+- pdtlb(addr);
+- pitlb(addr);
+- purge_tlb_end(flags);
+-}
+-EXPORT_SYMBOL(purge_tlb_entries);
+-
+-void __flush_tlb_range(unsigned long sid, unsigned long start,
+- unsigned long end)
++/* __flush_tlb_range()
++ *
++ * returns 1 if all TLBs were flushed.
++ */
++int __flush_tlb_range(unsigned long sid, unsigned long start,
++ unsigned long end)
+ {
+- unsigned long npages;
++ unsigned long flags, size;
+
+- npages = ((end - (start & PAGE_MASK)) + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+- if (npages >= 512) /* 2MB of space: arbitrary, should be tuned */
++ size = (end - start);
++ if (size >= parisc_tlb_flush_threshold) {
+ flush_tlb_all();
+- else {
+- unsigned long flags;
++ return 1;
++ }
+
++ /* Purge TLB entries for small ranges using the pdtlb and
++ pitlb instructions. These instructions execute locally
++ but cause a purge request to be broadcast to other TLBs. */
++ if (likely(!split_tlb)) {
++ while (start < end) {
++ purge_tlb_start(flags);
++ mtsp(sid, 1);
++ pdtlb(start);
++ purge_tlb_end(flags);
++ start += PAGE_SIZE;
++ }
++ return 0;
++ }
++
++ /* split TLB case */
++ while (start < end) {
+ purge_tlb_start(flags);
+ mtsp(sid, 1);
+- if (split_tlb) {
+- while (npages--) {
+- pdtlb(start);
+- pitlb(start);
+- start += PAGE_SIZE;
+- }
+- } else {
+- while (npages--) {
+- pdtlb(start);
+- start += PAGE_SIZE;
+- }
+- }
++ pdtlb(start);
++ pitlb(start);
+ purge_tlb_end(flags);
++ start += PAGE_SIZE;
+ }
++ return 0;
+ }
+
+ static void cacheflush_h_tmp_function(void *dummy)
+diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S
+index 7581961..c5ef408 100644
+--- a/arch/parisc/kernel/entry.S
++++ b/arch/parisc/kernel/entry.S
+@@ -45,7 +45,7 @@
+ .level 2.0
+ #endif
+
+- .import pa_dbit_lock,data
++ .import pa_tlb_lock,data
+
+ /* space_to_prot macro creates a prot id from a space id */
+
+@@ -420,8 +420,8 @@
+ SHLREG %r9,PxD_VALUE_SHIFT,\pmd
+ extru \va,31-PAGE_SHIFT,ASM_BITS_PER_PTE,\index
+ dep %r0,31,PAGE_SHIFT,\pmd /* clear offset */
+- shladd \index,BITS_PER_PTE_ENTRY,\pmd,\pmd
+- LDREG %r0(\pmd),\pte /* pmd is now pte */
++ shladd \index,BITS_PER_PTE_ENTRY,\pmd,\pmd /* pmd is now pte */
++ LDREG %r0(\pmd),\pte
+ bb,>=,n \pte,_PAGE_PRESENT_BIT,\fault
+ .endm
+
+@@ -453,57 +453,53 @@
+ L2_ptep \pgd,\pte,\index,\va,\fault
+ .endm
+
+- /* Acquire pa_dbit_lock lock. */
+- .macro dbit_lock spc,tmp,tmp1
++ /* Acquire pa_tlb_lock lock and recheck page is still present. */
++ .macro tlb_lock spc,ptp,pte,tmp,tmp1,fault
+ #ifdef CONFIG_SMP
+ cmpib,COND(=),n 0,\spc,2f
+- load32 PA(pa_dbit_lock),\tmp
++ load32 PA(pa_tlb_lock),\tmp
+ 1: LDCW 0(\tmp),\tmp1
+ cmpib,COND(=) 0,\tmp1,1b
+ nop
++ LDREG 0(\ptp),\pte
++ bb,<,n \pte,_PAGE_PRESENT_BIT,2f
++ b \fault
++ stw \spc,0(\tmp)
+ 2:
+ #endif
+ .endm
+
+- /* Release pa_dbit_lock lock without reloading lock address. */
+- .macro dbit_unlock0 spc,tmp
++ /* Release pa_tlb_lock lock without reloading lock address. */
++ .macro tlb_unlock0 spc,tmp
+ #ifdef CONFIG_SMP
+ or,COND(=) %r0,\spc,%r0
+ stw \spc,0(\tmp)
+ #endif
+ .endm
+
+- /* Release pa_dbit_lock lock. */
+- .macro dbit_unlock1 spc,tmp
++ /* Release pa_tlb_lock lock. */
++ .macro tlb_unlock1 spc,tmp
+ #ifdef CONFIG_SMP
+- load32 PA(pa_dbit_lock),\tmp
+- dbit_unlock0 \spc,\tmp
++ load32 PA(pa_tlb_lock),\tmp
++ tlb_unlock0 \spc,\tmp
+ #endif
+ .endm
+
+ /* Set the _PAGE_ACCESSED bit of the PTE. Be clever and
+ * don't needlessly dirty the cache line if it was already set */
+- .macro update_ptep spc,ptep,pte,tmp,tmp1
+-#ifdef CONFIG_SMP
+- or,COND(=) %r0,\spc,%r0
+- LDREG 0(\ptep),\pte
+-#endif
++ .macro update_accessed ptp,pte,tmp,tmp1
+ ldi _PAGE_ACCESSED,\tmp1
+ or \tmp1,\pte,\tmp
+ and,COND(<>) \tmp1,\pte,%r0
+- STREG \tmp,0(\ptep)
++ STREG \tmp,0(\ptp)
+ .endm
+
+ /* Set the dirty bit (and accessed bit). No need to be
+ * clever, this is only used from the dirty fault */
+- .macro update_dirty spc,ptep,pte,tmp
+-#ifdef CONFIG_SMP
+- or,COND(=) %r0,\spc,%r0
+- LDREG 0(\ptep),\pte
+-#endif
++ .macro update_dirty ptp,pte,tmp
+ ldi _PAGE_ACCESSED|_PAGE_DIRTY,\tmp
+ or \tmp,\pte,\pte
+- STREG \pte,0(\ptep)
++ STREG \pte,0(\ptp)
+ .endm
+
+ /* bitshift difference between a PFN (based on kernel's PAGE_SIZE)
+@@ -1148,14 +1144,14 @@ dtlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,dtlb_check_alias_20w
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,dtlb_check_alias_20w
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ idtlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1174,14 +1170,14 @@ nadtlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,nadtlb_check_alias_20w
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,nadtlb_check_alias_20w
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ idtlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1202,20 +1198,20 @@ dtlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,dtlb_check_alias_11
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,dtlb_check_alias_11
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+- mfsp %sr1,t0 /* Save sr1 so we can use it in tlb inserts */
++ mfsp %sr1,t1 /* Save sr1 so we can use it in tlb inserts */
+ mtsp spc,%sr1
+
+ idtlba pte,(%sr1,va)
+ idtlbp prot,(%sr1,va)
+
+- mtsp t0, %sr1 /* Restore sr1 */
+- dbit_unlock1 spc,t0
++ mtsp t1, %sr1 /* Restore sr1 */
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1235,21 +1231,20 @@ nadtlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,nadtlb_check_alias_11
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,nadtlb_check_alias_11
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+-
+- mfsp %sr1,t0 /* Save sr1 so we can use it in tlb inserts */
++ mfsp %sr1,t1 /* Save sr1 so we can use it in tlb inserts */
+ mtsp spc,%sr1
+
+ idtlba pte,(%sr1,va)
+ idtlbp prot,(%sr1,va)
+
+- mtsp t0, %sr1 /* Restore sr1 */
+- dbit_unlock1 spc,t0
++ mtsp t1, %sr1 /* Restore sr1 */
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1269,16 +1264,16 @@ dtlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,dtlb_check_alias_20
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,dtlb_check_alias_20
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+- f_extend pte,t0
++ f_extend pte,t1
+
+ idtlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1297,16 +1292,16 @@ nadtlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,nadtlb_check_alias_20
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,nadtlb_check_alias_20
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+- f_extend pte,t0
++ f_extend pte,t1
+
+- idtlbt pte,prot
+- dbit_unlock1 spc,t0
++ idtlbt pte,prot
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1406,14 +1401,14 @@ itlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,itlb_fault
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,itlb_fault
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ iitlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1430,14 +1425,14 @@ naitlb_miss_20w:
+
+ L3_ptep ptp,pte,t0,va,naitlb_check_alias_20w
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,naitlb_check_alias_20w
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+ iitlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1458,20 +1453,20 @@ itlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,itlb_fault
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,itlb_fault
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+- mfsp %sr1,t0 /* Save sr1 so we can use it in tlb inserts */
++ mfsp %sr1,t1 /* Save sr1 so we can use it in tlb inserts */
+ mtsp spc,%sr1
+
+ iitlba pte,(%sr1,va)
+ iitlbp prot,(%sr1,va)
+
+- mtsp t0, %sr1 /* Restore sr1 */
+- dbit_unlock1 spc,t0
++ mtsp t1, %sr1 /* Restore sr1 */
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1482,20 +1477,20 @@ naitlb_miss_11:
+
+ L2_ptep ptp,pte,t0,va,naitlb_check_alias_11
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,naitlb_check_alias_11
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+- mfsp %sr1,t0 /* Save sr1 so we can use it in tlb inserts */
++ mfsp %sr1,t1 /* Save sr1 so we can use it in tlb inserts */
+ mtsp spc,%sr1
+
+ iitlba pte,(%sr1,va)
+ iitlbp prot,(%sr1,va)
+
+- mtsp t0, %sr1 /* Restore sr1 */
+- dbit_unlock1 spc,t0
++ mtsp t1, %sr1 /* Restore sr1 */
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1516,16 +1511,16 @@ itlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,itlb_fault
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,itlb_fault
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+- f_extend pte,t0
++ f_extend pte,t1
+
+ iitlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1536,16 +1531,16 @@ naitlb_miss_20:
+
+ L2_ptep ptp,pte,t0,va,naitlb_check_alias_20
+
+- dbit_lock spc,t0,t1
+- update_ptep spc,ptp,pte,t0,t1
++ tlb_lock spc,ptp,pte,t0,t1,naitlb_check_alias_20
++ update_accessed ptp,pte,t0,t1
+
+ make_insert_tlb spc,pte,prot
+
+- f_extend pte,t0
++ f_extend pte,t1
+
+ iitlbt pte,prot
+- dbit_unlock1 spc,t0
+
++ tlb_unlock1 spc,t0
+ rfir
+ nop
+
+@@ -1568,14 +1563,14 @@ dbit_trap_20w:
+
+ L3_ptep ptp,pte,t0,va,dbit_fault
+
+- dbit_lock spc,t0,t1
+- update_dirty spc,ptp,pte,t1
++ tlb_lock spc,ptp,pte,t0,t1,dbit_fault
++ update_dirty ptp,pte,t1
+
+ make_insert_tlb spc,pte,prot
+
+ idtlbt pte,prot
+- dbit_unlock0 spc,t0
+
++ tlb_unlock0 spc,t0
+ rfir
+ nop
+ #else
+@@ -1588,8 +1583,8 @@ dbit_trap_11:
+
+ L2_ptep ptp,pte,t0,va,dbit_fault
+
+- dbit_lock spc,t0,t1
+- update_dirty spc,ptp,pte,t1
++ tlb_lock spc,ptp,pte,t0,t1,dbit_fault
++ update_dirty ptp,pte,t1
+
+ make_insert_tlb_11 spc,pte,prot
+
+@@ -1600,8 +1595,8 @@ dbit_trap_11:
+ idtlbp prot,(%sr1,va)
+
+ mtsp t1, %sr1 /* Restore sr1 */
+- dbit_unlock0 spc,t0
+
++ tlb_unlock0 spc,t0
+ rfir
+ nop
+
+@@ -1612,16 +1607,16 @@ dbit_trap_20:
+
+ L2_ptep ptp,pte,t0,va,dbit_fault
+
+- dbit_lock spc,t0,t1
+- update_dirty spc,ptp,pte,t1
++ tlb_lock spc,ptp,pte,t0,t1,dbit_fault
++ update_dirty ptp,pte,t1
+
+ make_insert_tlb spc,pte,prot
+
+ f_extend pte,t1
+
+- idtlbt pte,prot
+- dbit_unlock0 spc,t0
++ idtlbt pte,prot
+
++ tlb_unlock0 spc,t0
+ rfir
+ nop
+ #endif
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 47ee620..7f67c4c 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -43,10 +43,6 @@
+
+ #include "../math-emu/math-emu.h" /* for handle_fpe() */
+
+-#if defined(CONFIG_SMP) || defined(CONFIG_DEBUG_SPINLOCK)
+-DEFINE_SPINLOCK(pa_dbit_lock);
+-#endif
+-
+ static void parisc_show_stack(struct task_struct *task, unsigned long *sp,
+ struct pt_regs *regs);
+
+diff --git a/arch/powerpc/kernel/idle_power7.S b/arch/powerpc/kernel/idle_power7.S
+index ccde8f0..112ccf4 100644
+--- a/arch/powerpc/kernel/idle_power7.S
++++ b/arch/powerpc/kernel/idle_power7.S
+@@ -52,6 +52,22 @@
+ .text
+
+ /*
++ * Used by threads when the lock bit of core_idle_state is set.
++ * Threads will spin in HMT_LOW until the lock bit is cleared.
++ * r14 - pointer to core_idle_state
++ * r15 - used to load contents of core_idle_state
++ */
++
++core_idle_lock_held:
++ HMT_LOW
++3: lwz r15,0(r14)
++ andi. r15,r15,PNV_CORE_IDLE_LOCK_BIT
++ bne 3b
++ HMT_MEDIUM
++ lwarx r15,0,r14
++ blr
++
++/*
+ * Pass requested state in r3:
+ * r3 - PNV_THREAD_NAP/SLEEP/WINKLE
+ *
+@@ -150,6 +166,10 @@ power7_enter_nap_mode:
+ ld r14,PACA_CORE_IDLE_STATE_PTR(r13)
+ lwarx_loop1:
+ lwarx r15,0,r14
++
++ andi. r9,r15,PNV_CORE_IDLE_LOCK_BIT
++ bnel core_idle_lock_held
++
+ andc r15,r15,r7 /* Clear thread bit */
+
+ andi. r15,r15,PNV_CORE_IDLE_THREAD_BITS
+@@ -294,7 +314,7 @@ lwarx_loop2:
+ * workaround undo code or resyncing timebase or restoring context
+ * In either case loop until the lock bit is cleared.
+ */
+- bne core_idle_lock_held
++ bnel core_idle_lock_held
+
+ cmpwi cr2,r15,0
+ lbz r4,PACA_SUBCORE_SIBLING_MASK(r13)
+@@ -319,15 +339,6 @@ lwarx_loop2:
+ isync
+ b common_exit
+
+-core_idle_lock_held:
+- HMT_LOW
+-core_idle_lock_loop:
+- lwz r15,0(14)
+- andi. r9,r15,PNV_CORE_IDLE_LOCK_BIT
+- bne core_idle_lock_loop
+- HMT_MEDIUM
+- b lwarx_loop2
+-
+ first_thread_in_subcore:
+ /* First thread in subcore to wakeup */
+ ori r15,r15,PNV_CORE_IDLE_LOCK_BIT
+diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h
+index cfad7fca..d7697ab 100644
+--- a/arch/s390/include/asm/ctl_reg.h
++++ b/arch/s390/include/asm/ctl_reg.h
+@@ -57,7 +57,10 @@ union ctlreg0 {
+ unsigned long lap : 1; /* Low-address-protection control */
+ unsigned long : 4;
+ unsigned long edat : 1; /* Enhanced-DAT-enablement control */
+- unsigned long : 23;
++ unsigned long : 4;
++ unsigned long afp : 1; /* AFP-register control */
++ unsigned long vx : 1; /* Vector enablement control */
++ unsigned long : 17;
+ };
+ };
+
+diff --git a/arch/s390/kernel/cache.c b/arch/s390/kernel/cache.c
+index bff5e3b..8ba3243 100644
+--- a/arch/s390/kernel/cache.c
++++ b/arch/s390/kernel/cache.c
+@@ -138,6 +138,8 @@ int init_cache_level(unsigned int cpu)
+ union cache_topology ct;
+ enum cache_type ctype;
+
++ if (!test_facility(34))
++ return -EOPNOTSUPP;
+ if (!this_cpu_ci)
+ return -EINVAL;
+ ct.raw = ecag(EXTRACT_TOPOLOGY, 0, 0);
+diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
+index 505c17c..56b5508 100644
+--- a/arch/s390/kernel/nmi.c
++++ b/arch/s390/kernel/nmi.c
+@@ -21,6 +21,7 @@
+ #include <asm/nmi.h>
+ #include <asm/crw.h>
+ #include <asm/switch_to.h>
++#include <asm/ctl_reg.h>
+
+ struct mcck_struct {
+ int kill_task;
+@@ -129,26 +130,30 @@ static int notrace s390_revalidate_registers(struct mci *mci)
+ } else
+ asm volatile("lfpc 0(%0)" : : "a" (fpt_creg_save_area));
+
+- asm volatile(
+- " ld 0,0(%0)\n"
+- " ld 1,8(%0)\n"
+- " ld 2,16(%0)\n"
+- " ld 3,24(%0)\n"
+- " ld 4,32(%0)\n"
+- " ld 5,40(%0)\n"
+- " ld 6,48(%0)\n"
+- " ld 7,56(%0)\n"
+- " ld 8,64(%0)\n"
+- " ld 9,72(%0)\n"
+- " ld 10,80(%0)\n"
+- " ld 11,88(%0)\n"
+- " ld 12,96(%0)\n"
+- " ld 13,104(%0)\n"
+- " ld 14,112(%0)\n"
+- " ld 15,120(%0)\n"
+- : : "a" (fpt_save_area));
+- /* Revalidate vector registers */
+- if (MACHINE_HAS_VX && current->thread.vxrs) {
++ if (!MACHINE_HAS_VX) {
++ /* Revalidate floating point registers */
++ asm volatile(
++ " ld 0,0(%0)\n"
++ " ld 1,8(%0)\n"
++ " ld 2,16(%0)\n"
++ " ld 3,24(%0)\n"
++ " ld 4,32(%0)\n"
++ " ld 5,40(%0)\n"
++ " ld 6,48(%0)\n"
++ " ld 7,56(%0)\n"
++ " ld 8,64(%0)\n"
++ " ld 9,72(%0)\n"
++ " ld 10,80(%0)\n"
++ " ld 11,88(%0)\n"
++ " ld 12,96(%0)\n"
++ " ld 13,104(%0)\n"
++ " ld 14,112(%0)\n"
++ " ld 15,120(%0)\n"
++ : : "a" (fpt_save_area));
++ } else {
++ /* Revalidate vector registers */
++ union ctlreg0 cr0;
++
+ if (!mci->vr) {
+ /*
+ * Vector registers can't be restored and therefore
+@@ -156,8 +161,12 @@ static int notrace s390_revalidate_registers(struct mci *mci)
+ */
+ kill_task = 1;
+ }
++ cr0.val = S390_lowcore.cregs_save_area[0];
++ cr0.afp = cr0.vx = 1;
++ __ctl_load(cr0.val, 0, 0);
+ restore_vx_regs((__vector128 *)
+- S390_lowcore.vector_save_area_addr);
++ &S390_lowcore.vector_save_area);
++ __ctl_load(S390_lowcore.cregs_save_area[0], 0, 0);
+ }
+ /* Revalidate access registers */
+ asm volatile(
+diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
+index dc5edc2..8f587d8 100644
+--- a/arch/s390/kernel/process.c
++++ b/arch/s390/kernel/process.c
+@@ -163,7 +163,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp,
+ asmlinkage void execve_tail(void)
+ {
+ current->thread.fp_regs.fpc = 0;
+- asm volatile("sfpc %0,%0" : : "d" (0));
++ asm volatile("sfpc %0" : : "d" (0));
+ }
+
+ /*
+diff --git a/arch/s390/kernel/sclp.S b/arch/s390/kernel/sclp.S
+index 43c3169..ada0c07 100644
+--- a/arch/s390/kernel/sclp.S
++++ b/arch/s390/kernel/sclp.S
+@@ -270,6 +270,8 @@ ENTRY(_sclp_print_early)
+ jno .Lesa2
+ ahi %r15,-80
+ stmh %r6,%r15,96(%r15) # store upper register halves
++ basr %r13,0
++ lmh %r0,%r15,.Lzeroes-.(%r13) # clear upper register halves
+ .Lesa2:
+ lr %r10,%r2 # save string pointer
+ lhi %r2,0
+@@ -291,6 +293,8 @@ ENTRY(_sclp_print_early)
+ .Lesa3:
+ lm %r6,%r15,120(%r15) # restore registers
+ br %r14
++.Lzeroes:
++ .fill 64,4,0
+
+ .LwritedataS4:
+ .long 0x00760005 # SCLP command for write data
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index 9afb9d6..dc2d7aa 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -415,13 +415,13 @@ static void bpf_jit_prologue(struct bpf_jit *jit)
+ EMIT6_DISP_LH(0xe3000000, 0x0004, REG_SKB_DATA, REG_0,
+ BPF_REG_1, offsetof(struct sk_buff, data));
+ }
+- /* BPF compatibility: clear A (%b7) and X (%b8) registers */
+- if (REG_SEEN(BPF_REG_7))
+- /* lghi %b7,0 */
+- EMIT4_IMM(0xa7090000, BPF_REG_7, 0);
+- if (REG_SEEN(BPF_REG_8))
+- /* lghi %b8,0 */
+- EMIT4_IMM(0xa7090000, BPF_REG_8, 0);
++ /* BPF compatibility: clear A (%b0) and X (%b7) registers */
++ if (REG_SEEN(BPF_REG_A))
++ /* lghi %ba,0 */
++ EMIT4_IMM(0xa7090000, BPF_REG_A, 0);
++ if (REG_SEEN(BPF_REG_X))
++ /* lghi %bx,0 */
++ EMIT4_IMM(0xa7090000, BPF_REG_X, 0);
+ }
+
+ /*
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index d366675..396b5c9 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -1139,7 +1139,7 @@ static void __init load_hv_initrd(void)
+
+ void __init free_initrd_mem(unsigned long begin, unsigned long end)
+ {
+- free_bootmem(__pa(begin), end - begin);
++ free_bootmem_late(__pa(begin), end - begin);
+ }
+
+ static int __init setup_initrd(char *str)
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index 48304b8..0cdc154 100644
+--- a/arch/x86/boot/compressed/eboot.c
++++ b/arch/x86/boot/compressed/eboot.c
+@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct boot_params *params,
+ unsigned int e820_type = 0;
+ unsigned long m = efi->efi_memmap;
+
++#ifdef CONFIG_X86_64
++ m |= (u64)efi->efi_memmap_hi << 32;
++#endif
++
+ d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
+ switch (d->type) {
+ case EFI_RESERVED_TYPE:
+diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
+index 8b22422..74a2a8d 100644
+--- a/arch/x86/include/asm/kasan.h
++++ b/arch/x86/include/asm/kasan.h
+@@ -14,15 +14,11 @@
+
+ #ifndef __ASSEMBLY__
+
+-extern pte_t kasan_zero_pte[];
+-extern pte_t kasan_zero_pmd[];
+-extern pte_t kasan_zero_pud[];
+-
+ #ifdef CONFIG_KASAN
+-void __init kasan_map_early_shadow(pgd_t *pgd);
++void __init kasan_early_init(void);
+ void __init kasan_init(void);
+ #else
+-static inline void kasan_map_early_shadow(pgd_t *pgd) { }
++static inline void kasan_early_init(void) { }
+ static inline void kasan_init(void) { }
+ #endif
+
+diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
+index 883f6b9..e997f70 100644
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -23,7 +23,7 @@ extern struct static_key rdpmc_always_available;
+
+ static inline void load_mm_cr4(struct mm_struct *mm)
+ {
+- if (static_key_true(&rdpmc_always_available) ||
++ if (static_key_false(&rdpmc_always_available) ||
+ atomic_read(&mm->context.perf_rdpmc_allowed))
+ cr4_set_bits(X86_CR4_PCE);
+ else
+diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+index e4d1b8b..cb77b11 100644
+--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+@@ -934,6 +934,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
+ return 0;
+
+ /*
++ * Getting up-to-date values requires an SMP IPI which is not
++ * possible if we're being called in interrupt context. Return
++ * the cached values instead.
++ */
++ if (unlikely(in_interrupt()))
++ goto out;
++
++ /*
+ * Notice that we don't perform the reading of an RMID
+ * atomically, because we can't hold a spin lock across the
+ * IPIs.
+diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
+index 5a46681..f129a9a 100644
+--- a/arch/x86/kernel/head64.c
++++ b/arch/x86/kernel/head64.c
+@@ -161,11 +161,12 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ /* Kill off the identity-map trampoline */
+ reset_early_page_tables();
+
+- kasan_map_early_shadow(early_level4_pgt);
+-
+- /* clear bss before set_intr_gate with early_idt_handler */
+ clear_bss();
+
++ clear_page(init_level4_pgt);
++
++ kasan_early_init();
++
+ for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
+ set_intr_gate(i, early_idt_handler_array[i]);
+ load_idt((const struct desc_ptr *)&idt_descr);
+@@ -177,12 +178,9 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+ */
+ load_ucode_bsp();
+
+- clear_page(init_level4_pgt);
+ /* set init_level4_pgt kernel high mapping*/
+ init_level4_pgt[511] = early_level4_pgt[511];
+
+- kasan_map_early_shadow(init_level4_pgt);
+-
+ x86_64_start_reservations(real_mode_data);
+ }
+
+diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
+index df7e780..7e5da2c 100644
+--- a/arch/x86/kernel/head_64.S
++++ b/arch/x86/kernel/head_64.S
+@@ -516,38 +516,9 @@ ENTRY(phys_base)
+ /* This must match the first entry in level2_kernel_pgt */
+ .quad 0x0000000000000000
+
+-#ifdef CONFIG_KASAN
+-#define FILL(VAL, COUNT) \
+- .rept (COUNT) ; \
+- .quad (VAL) ; \
+- .endr
+-
+-NEXT_PAGE(kasan_zero_pte)
+- FILL(kasan_zero_page - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-NEXT_PAGE(kasan_zero_pmd)
+- FILL(kasan_zero_pte - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-NEXT_PAGE(kasan_zero_pud)
+- FILL(kasan_zero_pmd - __START_KERNEL_map + _KERNPG_TABLE, 512)
+-
+-#undef FILL
+-#endif
+-
+-
+ #include "../../x86/xen/xen-head.S"
+
+ __PAGE_ALIGNED_BSS
+ NEXT_PAGE(empty_zero_page)
+ .skip PAGE_SIZE
+
+-#ifdef CONFIG_KASAN
+-/*
+- * This page used as early shadow. We don't use empty_zero_page
+- * at early stages, stack instrumentation could write some garbage
+- * to this page.
+- * Latter we reuse it as zero shadow for large ranges of memory
+- * that allowed to access, but not instrumented by kasan
+- * (vmalloc/vmemmap ...).
+- */
+-NEXT_PAGE(kasan_zero_page)
+- .skip PAGE_SIZE
+-#endif
+diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
+index 4860906..9a54dbe 100644
+--- a/arch/x86/mm/kasan_init_64.c
++++ b/arch/x86/mm/kasan_init_64.c
+@@ -11,7 +11,19 @@
+ extern pgd_t early_level4_pgt[PTRS_PER_PGD];
+ extern struct range pfn_mapped[E820_X_MAX];
+
+-extern unsigned char kasan_zero_page[PAGE_SIZE];
++static pud_t kasan_zero_pud[PTRS_PER_PUD] __page_aligned_bss;
++static pmd_t kasan_zero_pmd[PTRS_PER_PMD] __page_aligned_bss;
++static pte_t kasan_zero_pte[PTRS_PER_PTE] __page_aligned_bss;
++
++/*
++ * This page used as early shadow. We don't use empty_zero_page
++ * at early stages, stack instrumentation could write some garbage
++ * to this page.
++ * Latter we reuse it as zero shadow for large ranges of memory
++ * that allowed to access, but not instrumented by kasan
++ * (vmalloc/vmemmap ...).
++ */
++static unsigned char kasan_zero_page[PAGE_SIZE] __page_aligned_bss;
+
+ static int __init map_range(struct range *range)
+ {
+@@ -36,7 +48,7 @@ static void __init clear_pgds(unsigned long start,
+ pgd_clear(pgd_offset_k(start));
+ }
+
+-void __init kasan_map_early_shadow(pgd_t *pgd)
++static void __init kasan_map_early_shadow(pgd_t *pgd)
+ {
+ int i;
+ unsigned long start = KASAN_SHADOW_START;
+@@ -73,7 +85,7 @@ static int __init zero_pmd_populate(pud_t *pud, unsigned long addr,
+ while (IS_ALIGNED(addr, PMD_SIZE) && addr + PMD_SIZE <= end) {
+ WARN_ON(!pmd_none(*pmd));
+ set_pmd(pmd, __pmd(__pa_nodebug(kasan_zero_pte)
+- | __PAGE_KERNEL_RO));
++ | _KERNPG_TABLE));
+ addr += PMD_SIZE;
+ pmd = pmd_offset(pud, addr);
+ }
+@@ -99,7 +111,7 @@ static int __init zero_pud_populate(pgd_t *pgd, unsigned long addr,
+ while (IS_ALIGNED(addr, PUD_SIZE) && addr + PUD_SIZE <= end) {
+ WARN_ON(!pud_none(*pud));
+ set_pud(pud, __pud(__pa_nodebug(kasan_zero_pmd)
+- | __PAGE_KERNEL_RO));
++ | _KERNPG_TABLE));
+ addr += PUD_SIZE;
+ pud = pud_offset(pgd, addr);
+ }
+@@ -124,7 +136,7 @@ static int __init zero_pgd_populate(unsigned long addr, unsigned long end)
+ while (IS_ALIGNED(addr, PGDIR_SIZE) && addr + PGDIR_SIZE <= end) {
+ WARN_ON(!pgd_none(*pgd));
+ set_pgd(pgd, __pgd(__pa_nodebug(kasan_zero_pud)
+- | __PAGE_KERNEL_RO));
++ | _KERNPG_TABLE));
+ addr += PGDIR_SIZE;
+ pgd = pgd_offset_k(addr);
+ }
+@@ -166,6 +178,26 @@ static struct notifier_block kasan_die_notifier = {
+ };
+ #endif
+
++void __init kasan_early_init(void)
++{
++ int i;
++ pteval_t pte_val = __pa_nodebug(kasan_zero_page) | __PAGE_KERNEL;
++ pmdval_t pmd_val = __pa_nodebug(kasan_zero_pte) | _KERNPG_TABLE;
++ pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE;
++
++ for (i = 0; i < PTRS_PER_PTE; i++)
++ kasan_zero_pte[i] = __pte(pte_val);
++
++ for (i = 0; i < PTRS_PER_PMD; i++)
++ kasan_zero_pmd[i] = __pmd(pmd_val);
++
++ for (i = 0; i < PTRS_PER_PUD; i++)
++ kasan_zero_pud[i] = __pud(pud_val);
++
++ kasan_map_early_shadow(early_level4_pgt);
++ kasan_map_early_shadow(init_level4_pgt);
++}
++
+ void __init kasan_init(void)
+ {
+ int i;
+@@ -176,6 +208,7 @@ void __init kasan_init(void)
+
+ memcpy(early_level4_pgt, init_level4_pgt, sizeof(early_level4_pgt));
+ load_cr3(early_level4_pgt);
++ __flush_tlb_all();
+
+ clear_pgds(KASAN_SHADOW_START, KASAN_SHADOW_END);
+
+@@ -202,5 +235,6 @@ void __init kasan_init(void)
+ memset(kasan_zero_page, 0, PAGE_SIZE);
+
+ load_cr3(init_level4_pgt);
++ __flush_tlb_all();
+ init_task.kasan_depth = 0;
+ }
+diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
+index 3250f23..90b924a 100644
+--- a/arch/x86/mm/tlb.c
++++ b/arch/x86/mm/tlb.c
+@@ -117,7 +117,7 @@ static void flush_tlb_func(void *info)
+ } else {
+ unsigned long addr;
+ unsigned long nr_pages =
+- f->flush_end - f->flush_start / PAGE_SIZE;
++ (f->flush_end - f->flush_start) / PAGE_SIZE;
+ addr = f->flush_start;
+ while (addr < f->flush_end) {
+ __flush_tlb_single(addr);
+diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
+index 02744df..841ea05 100644
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phys_addr)
+
+ static int __init arch_parse_efi_cmdline(char *str)
+ {
++ if (!str) {
++ pr_warn("need at least one option\n");
++ return -EINVAL;
++ }
++
+ if (parse_option_str(str, "old_map"))
+ set_bit(EFI_OLD_MEMMAP, &efi.flags);
+ if (parse_option_str(str, "debug"))
+diff --git a/block/bio-integrity.c b/block/bio-integrity.c
+index 5cbd5d9..39ce74d 100644
+--- a/block/bio-integrity.c
++++ b/block/bio-integrity.c
+@@ -51,7 +51,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio,
+ unsigned long idx = BIO_POOL_NONE;
+ unsigned inline_vecs;
+
+- if (!bs) {
++ if (!bs || !bs->bio_integrity_pool) {
+ bip = kmalloc(sizeof(struct bio_integrity_payload) +
+ sizeof(struct bio_vec) * nr_vecs, gfp_mask);
+ inline_vecs = nr_vecs;
+@@ -104,7 +104,7 @@ void bio_integrity_free(struct bio *bio)
+ kfree(page_address(bip->bip_vec->bv_page) +
+ bip->bip_vec->bv_offset);
+
+- if (bs) {
++ if (bs && bs->bio_integrity_pool) {
+ if (bip->bip_slab != BIO_POOL_NONE)
+ bvec_free(bs->bvec_integrity_pool, bip->bip_vec,
+ bip->bip_slab);
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 0ac817b..6817e28 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -716,8 +716,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ return -EINVAL;
+
+ disk = get_gendisk(MKDEV(major, minor), &part);
+- if (!disk || part)
++ if (!disk)
+ return -EINVAL;
++ if (part) {
++ put_disk(disk);
++ return -EINVAL;
++ }
+
+ rcu_read_lock();
+ spin_lock_irq(disk->queue->queue_lock);
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 594eea0..2dc1fd6 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1968,7 +1968,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
+ goto err_hctxs;
+
+ setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
+- blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
++ blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
+
+ q->nr_queues = nr_cpu_ids;
+ q->nr_hw_queues = set->nr_hw_queues;
+diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
+index 7ccc084..85aa761 100644
+--- a/drivers/ata/libata-pmp.c
++++ b/drivers/ata/libata-pmp.c
+@@ -460,6 +460,13 @@ static void sata_pmp_quirks(struct ata_port *ap)
+ ATA_LFLAG_NO_SRST |
+ ATA_LFLAG_ASSUME_ATA;
+ }
++ } else if (vendor == 0x11ab && devid == 0x4140) {
++ /* Marvell 4140 quirks */
++ ata_for_each_link(link, ap, EDGE) {
++ /* port 4 is for SEMB device and it doesn't like SRST */
++ if (link->pmp == 4)
++ link->flags |= ATA_LFLAG_DISABLED;
++ }
+ }
+ }
+
+diff --git a/drivers/clk/st/clk-flexgen.c b/drivers/clk/st/clk-flexgen.c
+index bf12a25..0f8db28 100644
+--- a/drivers/clk/st/clk-flexgen.c
++++ b/drivers/clk/st/clk-flexgen.c
+@@ -303,6 +303,8 @@ void __init st_of_flexgen_setup(struct device_node *np)
+ if (!rlock)
+ goto err;
+
++ spin_lock_init(rlock);
++
+ for (i = 0; i < clk_data->clk_num; i++) {
+ struct clk *clk;
+ const char *clk_name;
+diff --git a/drivers/clk/st/clkgen-fsyn.c b/drivers/clk/st/clkgen-fsyn.c
+index a917c4c..6ae068a 100644
+--- a/drivers/clk/st/clkgen-fsyn.c
++++ b/drivers/clk/st/clkgen-fsyn.c
+@@ -340,7 +340,7 @@ static const struct clkgen_quadfs_data st_fs660c32_C_407 = {
+ CLKGEN_FIELD(0x30c, 0xf, 20),
+ CLKGEN_FIELD(0x310, 0xf, 20) },
+ .lockstatus_present = true,
+- .lock_status = CLKGEN_FIELD(0x2A0, 0x1, 24),
++ .lock_status = CLKGEN_FIELD(0x2f0, 0x1, 24),
+ .powerup_polarity = 1,
+ .standby_polarity = 1,
+ .pll_ops = &st_quadfs_pll_c32_ops,
+diff --git a/drivers/clk/st/clkgen-mux.c b/drivers/clk/st/clkgen-mux.c
+index fdcff10..ef65146 100644
+--- a/drivers/clk/st/clkgen-mux.c
++++ b/drivers/clk/st/clkgen-mux.c
+@@ -582,7 +582,7 @@ static struct clkgen_mux_data stih416_a9_mux_data = {
+ };
+ static struct clkgen_mux_data stih407_a9_mux_data = {
+ .offset = 0x1a4,
+- .shift = 1,
++ .shift = 0,
+ .width = 2,
+ };
+
+diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
+index c45d274..6f9d27f 100644
+--- a/drivers/cpufreq/intel_pstate.c
++++ b/drivers/cpufreq/intel_pstate.c
+@@ -678,6 +678,7 @@ static struct cpu_defaults knl_params = {
+ .get_max = core_get_max_pstate,
+ .get_min = core_get_min_pstate,
+ .get_turbo = knl_get_turbo_pstate,
++ .get_scaling = core_get_scaling,
+ .set = core_set_pstate,
+ },
+ };
+diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
+index 4630709..0a70e46 100644
+--- a/drivers/crypto/omap-des.c
++++ b/drivers/crypto/omap-des.c
+@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
+ dmaengine_terminate_all(dd->dma_lch_in);
+ dmaengine_terminate_all(dd->dma_lch_out);
+
+- dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
+- dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
+-
+ return err;
+ }
+
+diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
+index 4fd9961..d425374 100644
+--- a/drivers/firmware/efi/cper.c
++++ b/drivers/firmware/efi/cper.c
+@@ -305,10 +305,17 @@ const char *cper_mem_err_unpack(struct trace_seq *p,
+ return ret;
+ }
+
+-static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem)
++static void cper_print_mem(const char *pfx, const struct cper_sec_mem_err *mem,
++ int len)
+ {
+ struct cper_mem_err_compact cmem;
+
++ /* Don't trust UEFI 2.1/2.2 structure with bad validation bits */
++ if (len == sizeof(struct cper_sec_mem_err_old) &&
++ (mem->validation_bits & ~(CPER_MEM_VALID_RANK_NUMBER - 1))) {
++ pr_err(FW_WARN "valid bits set for fields beyond structure\n");
++ return;
++ }
+ if (mem->validation_bits & CPER_MEM_VALID_ERROR_STATUS)
+ printk("%s""error_status: 0x%016llx\n", pfx, mem->error_status);
+ if (mem->validation_bits & CPER_MEM_VALID_PA)
+@@ -405,8 +412,10 @@ static void cper_estatus_print_section(
+ } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PLATFORM_MEM)) {
+ struct cper_sec_mem_err *mem_err = (void *)(gdata + 1);
+ printk("%s""section_type: memory error\n", newpfx);
+- if (gdata->error_data_length >= sizeof(*mem_err))
+- cper_print_mem(newpfx, mem_err);
++ if (gdata->error_data_length >=
++ sizeof(struct cper_sec_mem_err_old))
++ cper_print_mem(newpfx, mem_err,
++ gdata->error_data_length);
+ else
+ goto err_section_too_small;
+ } else if (!uuid_le_cmp(*sec_type, CPER_SEC_PCIE)) {
+diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
+index e14363d..63226e9 100644
+--- a/drivers/firmware/efi/efi.c
++++ b/drivers/firmware/efi/efi.c
+@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void)
+
+ static int __init parse_efi_cmdline(char *str)
+ {
++ if (!str) {
++ pr_warn("need at least one option\n");
++ return -EINVAL;
++ }
++
+ if (parse_option_str(str, "noruntime"))
+ disable_runtime = true;
+
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index 8904933..cd6dae0 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -863,8 +863,10 @@ nouveau_drm_preclose(struct drm_device *dev, struct drm_file *fpriv)
+
+ pm_runtime_get_sync(dev->dev);
+
++ mutex_lock(&cli->mutex);
+ if (cli->abi16)
+ nouveau_abi16_fini(cli->abi16);
++ mutex_unlock(&cli->mutex);
+
+ mutex_lock(&drm->client.mutex);
+ list_del(&cli->head);
+diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+index 4ef602c..495c576 100644
+--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
+@@ -203,7 +203,7 @@ nv04_fbcon_accel_init(struct fb_info *info)
+ if (ret)
+ return ret;
+
+- if (RING_SPACE(chan, 49)) {
++ if (RING_SPACE(chan, 49 + (device->info.chipset >= 0x11 ? 4 : 0))) {
+ nouveau_fbcon_gpu_lockup(info);
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
+index 7da7958..981342d 100644
+--- a/drivers/gpu/drm/nouveau/nv50_display.c
++++ b/drivers/gpu/drm/nouveau/nv50_display.c
+@@ -979,7 +979,7 @@ nv50_crtc_cursor_show_hide(struct nouveau_crtc *nv_crtc, bool show, bool update)
+ {
+ struct nv50_mast *mast = nv50_mast(nv_crtc->base.dev);
+
+- if (show && nv_crtc->cursor.nvbo)
++ if (show && nv_crtc->cursor.nvbo && nv_crtc->base.enabled)
+ nv50_crtc_cursor_show(nv_crtc);
+ else
+ nv50_crtc_cursor_hide(nv_crtc);
+diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+index 80614f1..282143f 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv04.c
+@@ -50,7 +50,12 @@ nv04_instobj_dtor(struct nvkm_object *object)
+ {
+ struct nv04_instmem_priv *priv = (void *)nvkm_instmem(object);
+ struct nv04_instobj_priv *node = (void *)object;
++ struct nvkm_subdev *subdev = (void *)priv;
++
++ mutex_lock(&subdev->mutex);
+ nvkm_mm_free(&priv->heap, &node->mem);
++ mutex_unlock(&subdev->mutex);
++
+ nvkm_instobj_destroy(&node->base);
+ }
+
+@@ -62,6 +67,7 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
+ struct nv04_instmem_priv *priv = (void *)nvkm_instmem(parent);
+ struct nv04_instobj_priv *node;
+ struct nvkm_instobj_args *args = data;
++ struct nvkm_subdev *subdev = (void *)priv;
+ int ret;
+
+ if (!args->align)
+@@ -72,8 +78,10 @@ nv04_instobj_ctor(struct nvkm_object *parent, struct nvkm_object *engine,
+ if (ret)
+ return ret;
+
++ mutex_lock(&subdev->mutex);
+ ret = nvkm_mm_head(&priv->heap, 0, 1, args->size, args->size,
+ args->align, &node->mem);
++ mutex_unlock(&subdev->mutex);
+ if (ret)
+ return ret;
+
+diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
+index 3318de6..a2dbbbe 100644
+--- a/drivers/hid/hid-cp2112.c
++++ b/drivers/hid/hid-cp2112.c
+@@ -356,6 +356,8 @@ static int cp2112_read(struct cp2112_device *dev, u8 *data, size_t size)
+ struct cp2112_force_read_report report;
+ int ret;
+
++ if (size > sizeof(dev->read_data))
++ size = sizeof(dev->read_data);
+ report.report = CP2112_DATA_READ_FORCE_SEND;
+ report.length = cpu_to_be16(size);
+
+diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
+index 28fcb2e..fbfc02b 100644
+--- a/drivers/hwmon/nct7802.c
++++ b/drivers/hwmon/nct7802.c
+@@ -195,7 +195,7 @@ abort:
+ }
+
+ static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
+- unsigned int voltage)
++ unsigned long voltage)
+ {
+ int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
+ int err;
+diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c
+index b77b82f..6153df73 100644
+--- a/drivers/hwmon/nct7904.c
++++ b/drivers/hwmon/nct7904.c
+@@ -412,8 +412,9 @@ static ssize_t show_pwm(struct device *dev,
+ return sprintf(buf, "%d\n", val);
+ }
+
+-static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+- const char *buf, size_t count)
++static ssize_t store_enable(struct device *dev,
++ struct device_attribute *devattr,
++ const char *buf, size_t count)
+ {
+ int index = to_sensor_dev_attr(devattr)->index;
+ struct nct7904_data *data = dev_get_drvdata(dev);
+@@ -422,18 +423,18 @@ static ssize_t store_mode(struct device *dev, struct device_attribute *devattr,
+
+ if (kstrtoul(buf, 10, &val) < 0)
+ return -EINVAL;
+- if (val > 1 || (val && !data->fan_mode[index]))
++ if (val < 1 || val > 2 || (val == 2 && !data->fan_mode[index]))
+ return -EINVAL;
+
+ ret = nct7904_write_reg(data, BANK_3, FANCTL1_FMR_REG + index,
+- val ? data->fan_mode[index] : 0);
++ val == 2 ? data->fan_mode[index] : 0);
+
+ return ret ? ret : count;
+ }
+
+-/* Return 0 for manual mode or 1 for SmartFan mode */
+-static ssize_t show_mode(struct device *dev,
+- struct device_attribute *devattr, char *buf)
++/* Return 1 for manual mode or 2 for SmartFan mode */
++static ssize_t show_enable(struct device *dev,
++ struct device_attribute *devattr, char *buf)
+ {
+ int index = to_sensor_dev_attr(devattr)->index;
+ struct nct7904_data *data = dev_get_drvdata(dev);
+@@ -443,36 +444,36 @@ static ssize_t show_mode(struct device *dev,
+ if (val < 0)
+ return val;
+
+- return sprintf(buf, "%d\n", val ? 1 : 0);
++ return sprintf(buf, "%d\n", val ? 2 : 1);
+ }
+
+ /* 2 attributes per channel: pwm and mode */
+-static SENSOR_DEVICE_ATTR(fan1_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm1, S_IRUGO | S_IWUSR,
+ show_pwm, store_pwm, 0);
+-static SENSOR_DEVICE_ATTR(fan1_mode, S_IRUGO | S_IWUSR,
+- show_mode, store_mode, 0);
+-static SENSOR_DEVICE_ATTR(fan2_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm1_enable, S_IRUGO | S_IWUSR,
++ show_enable, store_enable, 0);
++static SENSOR_DEVICE_ATTR(pwm2, S_IRUGO | S_IWUSR,
+ show_pwm, store_pwm, 1);
+-static SENSOR_DEVICE_ATTR(fan2_mode, S_IRUGO | S_IWUSR,
+- show_mode, store_mode, 1);
+-static SENSOR_DEVICE_ATTR(fan3_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm2_enable, S_IRUGO | S_IWUSR,
++ show_enable, store_enable, 1);
++static SENSOR_DEVICE_ATTR(pwm3, S_IRUGO | S_IWUSR,
+ show_pwm, store_pwm, 2);
+-static SENSOR_DEVICE_ATTR(fan3_mode, S_IRUGO | S_IWUSR,
+- show_mode, store_mode, 2);
+-static SENSOR_DEVICE_ATTR(fan4_pwm, S_IRUGO | S_IWUSR,
++static SENSOR_DEVICE_ATTR(pwm3_enable, S_IRUGO | S_IWUSR,
++ show_enable, store_enable, 2);
++static SENSOR_DEVICE_ATTR(pwm4, S_IRUGO | S_IWUSR,
+ show_pwm, store_pwm, 3);
+-static SENSOR_DEVICE_ATTR(fan4_mode, S_IRUGO | S_IWUSR,
+- show_mode, store_mode, 3);
++static SENSOR_DEVICE_ATTR(pwm4_enable, S_IRUGO | S_IWUSR,
++ show_enable, store_enable, 3);
+
+ static struct attribute *nct7904_fanctl_attrs[] = {
+- &sensor_dev_attr_fan1_pwm.dev_attr.attr,
+- &sensor_dev_attr_fan1_mode.dev_attr.attr,
+- &sensor_dev_attr_fan2_pwm.dev_attr.attr,
+- &sensor_dev_attr_fan2_mode.dev_attr.attr,
+- &sensor_dev_attr_fan3_pwm.dev_attr.attr,
+- &sensor_dev_attr_fan3_mode.dev_attr.attr,
+- &sensor_dev_attr_fan4_pwm.dev_attr.attr,
+- &sensor_dev_attr_fan4_mode.dev_attr.attr,
++ &sensor_dev_attr_pwm1.dev_attr.attr,
++ &sensor_dev_attr_pwm1_enable.dev_attr.attr,
++ &sensor_dev_attr_pwm2.dev_attr.attr,
++ &sensor_dev_attr_pwm2_enable.dev_attr.attr,
++ &sensor_dev_attr_pwm3.dev_attr.attr,
++ &sensor_dev_attr_pwm3_enable.dev_attr.attr,
++ &sensor_dev_attr_pwm4.dev_attr.attr,
++ &sensor_dev_attr_pwm4_enable.dev_attr.attr,
+ NULL
+ };
+
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+index e5cc430..2d13fd0 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+@@ -176,7 +176,8 @@ int ipoib_transport_dev_init(struct net_device *dev, struct ib_device *ca)
+ else
+ size += ipoib_recvq_size * ipoib_max_conn_qp;
+ } else
+- goto out_free_wq;
++ if (ret != -ENOSYS)
++ goto out_free_wq;
+
+ priv->recv_cq = ib_create_cq(priv->ca, ipoib_ib_completion, NULL, dev, size, 0);
+ if (IS_ERR(priv->recv_cq)) {
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 35c8d0c..3a32caf 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1199,7 +1199,7 @@ static void set_input_params(struct psmouse *psmouse,
+ ABS_MT_POSITION_Y);
+ /* Image sensors can report per-contact pressure */
+ input_set_abs_params(dev, ABS_MT_PRESSURE, 0, 255, 0, 0);
+- input_mt_init_slots(dev, 3, INPUT_MT_POINTER | INPUT_MT_TRACK);
++ input_mt_init_slots(dev, 2, INPUT_MT_POINTER | INPUT_MT_TRACK);
+
+ /* Image sensors can signal 4 and 5 finger clicks */
+ __set_bit(BTN_TOOL_QUADTAP, dev->keybit);
+diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
+index f2c6c35..2c41107 100644
+--- a/drivers/input/touchscreen/usbtouchscreen.c
++++ b/drivers/input/touchscreen/usbtouchscreen.c
+@@ -627,6 +627,9 @@ static int dmc_tsc10_init(struct usbtouch_usb *usbtouch)
+ goto err_out;
+ }
+
++ /* TSC-25 data sheet specifies a delay after the RESET command */
++ msleep(150);
++
+ /* set coordinate output rate */
+ buf[0] = buf[1] = 0xFF;
+ ret = usb_control_msg(dev, usb_rcvctrlpipe (dev, 0),
+diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
+index 5ecfaf2..c87c4b1 100644
+--- a/drivers/iommu/intel-iommu.c
++++ b/drivers/iommu/intel-iommu.c
+@@ -1756,8 +1756,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
+
+ static void domain_exit(struct dmar_domain *domain)
+ {
++ struct dmar_drhd_unit *drhd;
++ struct intel_iommu *iommu;
+ struct page *freelist = NULL;
+- int i;
+
+ /* Domain 0 is reserved, so dont process it */
+ if (!domain)
+@@ -1777,8 +1778,10 @@ static void domain_exit(struct dmar_domain *domain)
+
+ /* clear attached or cached domains */
+ rcu_read_lock();
+- for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
+- iommu_detach_domain(domain, g_iommus[i]);
++ for_each_active_iommu(iommu, drhd)
++ if (domain_type_is_vm(domain) ||
++ test_bit(iommu->seq_id, domain->iommu_bmp))
++ iommu_detach_domain(domain, iommu);
+ rcu_read_unlock();
+
+ dma_free_pagelist(freelist);
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 1b7e155..c00e2db 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -75,6 +75,13 @@ struct its_node {
+
+ #define ITS_ITT_ALIGN SZ_256
+
++struct event_lpi_map {
++ unsigned long *lpi_map;
++ u16 *col_map;
++ irq_hw_number_t lpi_base;
++ int nr_lpis;
++};
++
+ /*
+ * The ITS view of a device - belongs to an ITS, a collection, owns an
+ * interrupt translation table, and a list of interrupts.
+@@ -82,11 +89,8 @@ struct its_node {
+ struct its_device {
+ struct list_head entry;
+ struct its_node *its;
+- struct its_collection *collection;
++ struct event_lpi_map event_map;
+ void *itt;
+- unsigned long *lpi_map;
+- irq_hw_number_t lpi_base;
+- int nr_lpis;
+ u32 nr_ites;
+ u32 device_id;
+ };
+@@ -99,6 +103,14 @@ static struct rdists *gic_rdists;
+ #define gic_data_rdist() (raw_cpu_ptr(gic_rdists->rdist))
+ #define gic_data_rdist_rd_base() (gic_data_rdist()->rd_base)
+
++static struct its_collection *dev_event_to_col(struct its_device *its_dev,
++ u32 event)
++{
++ struct its_node *its = its_dev->its;
++
++ return its->collections + its_dev->event_map.col_map[event];
++}
++
+ /*
+ * ITS command descriptors - parameters to be encoded in a command
+ * block.
+@@ -134,7 +146,7 @@ struct its_cmd_desc {
+ struct {
+ struct its_device *dev;
+ struct its_collection *col;
+- u32 id;
++ u32 event_id;
+ } its_movi_cmd;
+
+ struct {
+@@ -241,7 +253,7 @@ static struct its_collection *its_build_mapd_cmd(struct its_cmd_block *cmd,
+
+ its_fixup_cmd(cmd);
+
+- return desc->its_mapd_cmd.dev->collection;
++ return NULL;
+ }
+
+ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
+@@ -260,52 +272,72 @@ static struct its_collection *its_build_mapc_cmd(struct its_cmd_block *cmd,
+ static struct its_collection *its_build_mapvi_cmd(struct its_cmd_block *cmd,
+ struct its_cmd_desc *desc)
+ {
++ struct its_collection *col;
++
++ col = dev_event_to_col(desc->its_mapvi_cmd.dev,
++ desc->its_mapvi_cmd.event_id);
++
+ its_encode_cmd(cmd, GITS_CMD_MAPVI);
+ its_encode_devid(cmd, desc->its_mapvi_cmd.dev->device_id);
+ its_encode_event_id(cmd, desc->its_mapvi_cmd.event_id);
+ its_encode_phys_id(cmd, desc->its_mapvi_cmd.phys_id);
+- its_encode_collection(cmd, desc->its_mapvi_cmd.dev->collection->col_id);
++ its_encode_collection(cmd, col->col_id);
+
+ its_fixup_cmd(cmd);
+
+- return desc->its_mapvi_cmd.dev->collection;
++ return col;
+ }
+
+ static struct its_collection *its_build_movi_cmd(struct its_cmd_block *cmd,
+ struct its_cmd_desc *desc)
+ {
++ struct its_collection *col;
++
++ col = dev_event_to_col(desc->its_movi_cmd.dev,
++ desc->its_movi_cmd.event_id);
++
+ its_encode_cmd(cmd, GITS_CMD_MOVI);
+ its_encode_devid(cmd, desc->its_movi_cmd.dev->device_id);
+- its_encode_event_id(cmd, desc->its_movi_cmd.id);
++ its_encode_event_id(cmd, desc->its_movi_cmd.event_id);
+ its_encode_collection(cmd, desc->its_movi_cmd.col->col_id);
+
+ its_fixup_cmd(cmd);
+
+- return desc->its_movi_cmd.dev->collection;
++ return col;
+ }
+
+ static struct its_collection *its_build_discard_cmd(struct its_cmd_block *cmd,
+ struct its_cmd_desc *desc)
+ {
++ struct its_collection *col;
++
++ col = dev_event_to_col(desc->its_discard_cmd.dev,
++ desc->its_discard_cmd.event_id);
++
+ its_encode_cmd(cmd, GITS_CMD_DISCARD);
+ its_encode_devid(cmd, desc->its_discard_cmd.dev->device_id);
+ its_encode_event_id(cmd, desc->its_discard_cmd.event_id);
+
+ its_fixup_cmd(cmd);
+
+- return desc->its_discard_cmd.dev->collection;
++ return col;
+ }
+
+ static struct its_collection *its_build_inv_cmd(struct its_cmd_block *cmd,
+ struct its_cmd_desc *desc)
+ {
++ struct its_collection *col;
++
++ col = dev_event_to_col(desc->its_inv_cmd.dev,
++ desc->its_inv_cmd.event_id);
++
+ its_encode_cmd(cmd, GITS_CMD_INV);
+ its_encode_devid(cmd, desc->its_inv_cmd.dev->device_id);
+ its_encode_event_id(cmd, desc->its_inv_cmd.event_id);
+
+ its_fixup_cmd(cmd);
+
+- return desc->its_inv_cmd.dev->collection;
++ return col;
+ }
+
+ static struct its_collection *its_build_invall_cmd(struct its_cmd_block *cmd,
+@@ -497,7 +529,7 @@ static void its_send_movi(struct its_device *dev,
+
+ desc.its_movi_cmd.dev = dev;
+ desc.its_movi_cmd.col = col;
+- desc.its_movi_cmd.id = id;
++ desc.its_movi_cmd.event_id = id;
+
+ its_send_single_command(dev->its, its_build_movi_cmd, &desc);
+ }
+@@ -528,7 +560,7 @@ static void its_send_invall(struct its_node *its, struct its_collection *col)
+ static inline u32 its_get_event_id(struct irq_data *d)
+ {
+ struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+- return d->hwirq - its_dev->lpi_base;
++ return d->hwirq - its_dev->event_map.lpi_base;
+ }
+
+ static void lpi_set_config(struct irq_data *d, bool enable)
+@@ -583,7 +615,7 @@ static int its_set_affinity(struct irq_data *d, const struct cpumask *mask_val,
+
+ target_col = &its_dev->its->collections[cpu];
+ its_send_movi(its_dev, target_col, id);
+- its_dev->collection = target_col;
++ its_dev->event_map.col_map[id] = cpu;
+
+ return IRQ_SET_MASK_OK_DONE;
+ }
+@@ -713,8 +745,10 @@ out:
+ return bitmap;
+ }
+
+-static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
++static void its_lpi_free(struct event_lpi_map *map)
+ {
++ int base = map->lpi_base;
++ int nr_ids = map->nr_lpis;
+ int lpi;
+
+ spin_lock(&lpi_lock);
+@@ -731,7 +765,8 @@ static void its_lpi_free(unsigned long *bitmap, int base, int nr_ids)
+
+ spin_unlock(&lpi_lock);
+
+- kfree(bitmap);
++ kfree(map->lpi_map);
++ kfree(map->col_map);
+ }
+
+ /*
+@@ -1099,11 +1134,11 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ struct its_device *dev;
+ unsigned long *lpi_map;
+ unsigned long flags;
++ u16 *col_map = NULL;
+ void *itt;
+ int lpi_base;
+ int nr_lpis;
+ int nr_ites;
+- int cpu;
+ int sz;
+
+ dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+@@ -1117,20 +1152,24 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
+ itt = kzalloc(sz, GFP_KERNEL);
+ lpi_map = its_lpi_alloc_chunks(nvecs, &lpi_base, &nr_lpis);
++ if (lpi_map)
++ col_map = kzalloc(sizeof(*col_map) * nr_lpis, GFP_KERNEL);
+
+- if (!dev || !itt || !lpi_map) {
++ if (!dev || !itt || !lpi_map || !col_map) {
+ kfree(dev);
+ kfree(itt);
+ kfree(lpi_map);
++ kfree(col_map);
+ return NULL;
+ }
+
+ dev->its = its;
+ dev->itt = itt;
+ dev->nr_ites = nr_ites;
+- dev->lpi_map = lpi_map;
+- dev->lpi_base = lpi_base;
+- dev->nr_lpis = nr_lpis;
++ dev->event_map.lpi_map = lpi_map;
++ dev->event_map.col_map = col_map;
++ dev->event_map.lpi_base = lpi_base;
++ dev->event_map.nr_lpis = nr_lpis;
+ dev->device_id = dev_id;
+ INIT_LIST_HEAD(&dev->entry);
+
+@@ -1138,10 +1177,6 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id,
+ list_add(&dev->entry, &its->its_device_list);
+ raw_spin_unlock_irqrestore(&its->lock, flags);
+
+- /* Bind the device to the first possible CPU */
+- cpu = cpumask_first(cpu_online_mask);
+- dev->collection = &its->collections[cpu];
+-
+ /* Map device to its ITT */
+ its_send_mapd(dev, 1);
+
+@@ -1163,12 +1198,13 @@ static int its_alloc_device_irq(struct its_device *dev, irq_hw_number_t *hwirq)
+ {
+ int idx;
+
+- idx = find_first_zero_bit(dev->lpi_map, dev->nr_lpis);
+- if (idx == dev->nr_lpis)
++ idx = find_first_zero_bit(dev->event_map.lpi_map,
++ dev->event_map.nr_lpis);
++ if (idx == dev->event_map.nr_lpis)
+ return -ENOSPC;
+
+- *hwirq = dev->lpi_base + idx;
+- set_bit(idx, dev->lpi_map);
++ *hwirq = dev->event_map.lpi_base + idx;
++ set_bit(idx, dev->event_map.lpi_map);
+
+ return 0;
+ }
+@@ -1288,7 +1324,8 @@ static int its_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
+ irq_domain_set_hwirq_and_chip(domain, virq + i,
+ hwirq, &its_irq_chip, its_dev);
+ dev_dbg(info->scratchpad[1].ptr, "ID:%d pID:%d vID:%d\n",
+- (int)(hwirq - its_dev->lpi_base), (int)hwirq, virq + i);
++ (int)(hwirq - its_dev->event_map.lpi_base),
++ (int)hwirq, virq + i);
+ }
+
+ return 0;
+@@ -1300,6 +1337,9 @@ static void its_irq_domain_activate(struct irq_domain *domain,
+ struct its_device *its_dev = irq_data_get_irq_chip_data(d);
+ u32 event = its_get_event_id(d);
+
++ /* Bind the LPI to the first possible CPU */
++ its_dev->event_map.col_map[event] = cpumask_first(cpu_online_mask);
++
+ /* Map the GIC IRQ and event to the device */
+ its_send_mapvi(its_dev, d->hwirq, event);
+ }
+@@ -1327,17 +1367,16 @@ static void its_irq_domain_free(struct irq_domain *domain, unsigned int virq,
+ u32 event = its_get_event_id(data);
+
+ /* Mark interrupt index as unused */
+- clear_bit(event, its_dev->lpi_map);
++ clear_bit(event, its_dev->event_map.lpi_map);
+
+ /* Nuke the entry in the domain */
+ irq_domain_reset_irq_data(data);
+ }
+
+ /* If all interrupts have been freed, start mopping the floor */
+- if (bitmap_empty(its_dev->lpi_map, its_dev->nr_lpis)) {
+- its_lpi_free(its_dev->lpi_map,
+- its_dev->lpi_base,
+- its_dev->nr_lpis);
++ if (bitmap_empty(its_dev->event_map.lpi_map,
++ its_dev->event_map.nr_lpis)) {
++ its_lpi_free(&its_dev->event_map);
+
+ /* Unmap device/itt */
+ its_send_mapd(its_dev, 0);
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 2caf492..e8d8456 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1053,13 +1053,10 @@ static struct dm_rq_target_io *tio_from_request(struct request *rq)
+ */
+ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
+ {
+- int nr_requests_pending;
+-
+ atomic_dec(&md->pending[rw]);
+
+ /* nudge anyone waiting on suspend queue */
+- nr_requests_pending = md_in_flight(md);
+- if (!nr_requests_pending)
++ if (!md_in_flight(md))
+ wake_up(&md->wait);
+
+ /*
+@@ -1071,8 +1068,7 @@ static void rq_completed(struct mapped_device *md, int rw, bool run_queue)
+ if (run_queue) {
+ if (md->queue->mq_ops)
+ blk_mq_run_hw_queues(md->queue, true);
+- else if (!nr_requests_pending ||
+- (nr_requests_pending >= md->queue->nr_congestion_on))
++ else
+ blk_run_queue_async(md->queue);
+ }
+
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 9157a29..cd7b0c1 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -336,7 +336,7 @@ static void raid1_end_read_request(struct bio *bio, int error)
+ spin_lock_irqsave(&conf->device_lock, flags);
+ if (r1_bio->mddev->degraded == conf->raid_disks ||
+ (r1_bio->mddev->degraded == conf->raid_disks-1 &&
+- !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags)))
++ test_bit(In_sync, &conf->mirrors[mirror].rdev->flags)))
+ uptodate = 1;
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ }
+diff --git a/drivers/misc/cxl/context.c b/drivers/misc/cxl/context.c
+index d1b55fe..e4dc8cd 100644
+--- a/drivers/misc/cxl/context.c
++++ b/drivers/misc/cxl/context.c
+@@ -113,11 +113,11 @@ static int cxl_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+
+ if (ctx->afu->current_mode == CXL_MODE_DEDICATED) {
+ area = ctx->afu->psn_phys;
+- if (offset > ctx->afu->adapter->ps_size)
++ if (offset >= ctx->afu->adapter->ps_size)
+ return VM_FAULT_SIGBUS;
+ } else {
+ area = ctx->psn_phys;
+- if (offset > ctx->psn_size)
++ if (offset >= ctx->psn_size)
+ return VM_FAULT_SIGBUS;
+ }
+
+diff --git a/drivers/misc/cxl/main.c b/drivers/misc/cxl/main.c
+index 8ccddce..de350dd 100644
+--- a/drivers/misc/cxl/main.c
++++ b/drivers/misc/cxl/main.c
+@@ -73,7 +73,7 @@ static inline void cxl_slbia_core(struct mm_struct *mm)
+ spin_lock(&adapter->afu_list_lock);
+ for (slice = 0; slice < adapter->slices; slice++) {
+ afu = adapter->afu[slice];
+- if (!afu->enabled)
++ if (!afu || !afu->enabled)
+ continue;
+ rcu_read_lock();
+ idr_for_each_entry(&afu->contexts_idr, ctx, id)
+diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
+index 3e29681..e40bcd03 100644
+--- a/drivers/misc/mei/main.c
++++ b/drivers/misc/mei/main.c
+@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
+ /* Fill in the data structures */
+ devno = MKDEV(MAJOR(mei_devt), dev->minor);
+ cdev_init(&dev->cdev, &mei_fops);
+- dev->cdev.owner = mei_fops.owner;
++ dev->cdev.owner = parent->driver->owner;
+
+ /* Add the device */
+ ret = cdev_add(&dev->cdev, devno, 1);
+diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
+index 9df2b68..d0abdffb 100644
+--- a/drivers/mmc/host/omap_hsmmc.c
++++ b/drivers/mmc/host/omap_hsmmc.c
+@@ -1062,6 +1062,10 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
+
+ if (status & (CTO_EN | CCRC_EN))
+ end_cmd = 1;
++ if (host->data || host->response_busy) {
++ end_trans = !end_cmd;
++ host->response_busy = 0;
++ }
+ if (status & (CTO_EN | DTO_EN))
+ hsmmc_command_incomplete(host, -ETIMEDOUT, end_cmd);
+ else if (status & (CCRC_EN | DCRC_EN))
+@@ -1081,10 +1085,6 @@ static void omap_hsmmc_do_irq(struct omap_hsmmc_host *host, int status)
+ }
+ dev_dbg(mmc_dev(host->mmc), "AC12 err: 0x%x\n", ac12);
+ }
+- if (host->data || host->response_busy) {
+- end_trans = !end_cmd;
+- host->response_busy = 0;
+- }
+ }
+
+ OMAP_HSMMC_WRITE(host->base, STAT, status);
+diff --git a/drivers/mmc/host/sdhci-esdhc.h b/drivers/mmc/host/sdhci-esdhc.h
+index 3497cfa..a870c42 100644
+--- a/drivers/mmc/host/sdhci-esdhc.h
++++ b/drivers/mmc/host/sdhci-esdhc.h
+@@ -45,6 +45,6 @@
+ #define ESDHC_DMA_SYSCTL 0x40c
+ #define ESDHC_DMA_SNOOP 0x00000040
+
+-#define ESDHC_HOST_CONTROL_RES 0x05
++#define ESDHC_HOST_CONTROL_RES 0x01
+
+ #endif /* _DRIVERS_MMC_SDHCI_ESDHC_H */
+diff --git a/drivers/mmc/host/sdhci-pxav3.c b/drivers/mmc/host/sdhci-pxav3.c
+index b5103a2..065dc70 100644
+--- a/drivers/mmc/host/sdhci-pxav3.c
++++ b/drivers/mmc/host/sdhci-pxav3.c
+@@ -411,6 +411,7 @@ static int sdhci_pxav3_probe(struct platform_device *pdev)
+ goto err_of_parse;
+ sdhci_get_of_property(pdev);
+ pdata = pxav3_get_mmc_pdata(dev);
++ pdev->dev.platform_data = pdata;
+ } else if (pdata) {
+ /* on-chip device */
+ if (pdata->flags & PXA_FLAG_CARD_PERMANENT)
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index d3dbb28..bec8a30 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -3037,8 +3037,11 @@ int sdhci_add_host(struct sdhci_host *host)
+ GFP_KERNEL);
+ host->align_buffer = kmalloc(host->align_buffer_sz, GFP_KERNEL);
+ if (!host->adma_table || !host->align_buffer) {
+- dma_free_coherent(mmc_dev(mmc), host->adma_table_sz,
+- host->adma_table, host->adma_addr);
++ if (host->adma_table)
++ dma_free_coherent(mmc_dev(mmc),
++ host->adma_table_sz,
++ host->adma_table,
++ host->adma_addr);
+ kfree(host->align_buffer);
+ pr_warn("%s: Unable to allocate ADMA buffers - falling back to standard DMA\n",
+ mmc_hostname(mmc));
+diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
+index 041525d..5d214d1 100644
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -592,6 +592,7 @@ static int c_can_start(struct net_device *dev)
+ {
+ struct c_can_priv *priv = netdev_priv(dev);
+ int err;
++ struct pinctrl *p;
+
+ /* basic c_can configuration */
+ err = c_can_chip_config(dev);
+@@ -604,8 +605,13 @@ static int c_can_start(struct net_device *dev)
+
+ priv->can.state = CAN_STATE_ERROR_ACTIVE;
+
+- /* activate pins */
+- pinctrl_pm_select_default_state(dev->dev.parent);
++ /* Attempt to use "active" if available else use "default" */
++ p = pinctrl_get_select(priv->device, "active");
++ if (!IS_ERR(p))
++ pinctrl_put(p);
++ else
++ pinctrl_pm_select_default_state(priv->device);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index e9b1810..aede704 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -440,9 +440,6 @@ unsigned int can_get_echo_skb(struct net_device *dev, unsigned int idx)
+ struct can_frame *cf = (struct can_frame *)skb->data;
+ u8 dlc = cf->can_dlc;
+
+- if (!(skb->tstamp.tv64))
+- __net_timestamp(skb);
+-
+ netif_rx(priv->echo_skb[idx]);
+ priv->echo_skb[idx] = NULL;
+
+@@ -578,7 +575,6 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+ if (unlikely(!skb))
+ return NULL;
+
+- __net_timestamp(skb);
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -589,6 +585,7 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
+
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
+
+ *cf = (struct can_frame *)skb_put(skb, sizeof(struct can_frame));
+ memset(*cf, 0, sizeof(struct can_frame));
+@@ -607,7 +604,6 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+ if (unlikely(!skb))
+ return NULL;
+
+- __net_timestamp(skb);
+ skb->protocol = htons(ETH_P_CANFD);
+ skb->pkt_type = PACKET_BROADCAST;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+@@ -618,6 +614,7 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
+
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
+
+ *cfd = (struct canfd_frame *)skb_put(skb, sizeof(struct canfd_frame));
+ memset(*cfd, 0, sizeof(struct canfd_frame));
+diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
+index 7deb80d..2f9ebad 100644
+--- a/drivers/net/can/rcar_can.c
++++ b/drivers/net/can/rcar_can.c
+@@ -526,7 +526,7 @@ static int rcar_can_open(struct net_device *ndev)
+ napi_enable(&priv->napi);
+ err = request_irq(ndev->irq, rcar_can_interrupt, 0, ndev->name, ndev);
+ if (err) {
+- netdev_err(ndev, "error requesting interrupt %x\n", ndev->irq);
++ netdev_err(ndev, "error requesting interrupt %d\n", ndev->irq);
+ goto out_close;
+ }
+ can_led_event(ndev, CAN_LED_EVENT_OPEN);
+@@ -758,8 +758,9 @@ static int rcar_can_probe(struct platform_device *pdev)
+ }
+
+ irq = platform_get_irq(pdev, 0);
+- if (!irq) {
++ if (irq < 0) {
+ dev_err(&pdev->dev, "No IRQ resource\n");
++ err = irq;
+ goto fail;
+ }
+
+@@ -823,7 +824,7 @@ static int rcar_can_probe(struct platform_device *pdev)
+
+ devm_can_led_init(ndev);
+
+- dev_info(&pdev->dev, "device registered (reg_base=%p, irq=%u)\n",
++ dev_info(&pdev->dev, "device registered (regs @ %p, IRQ%d)\n",
+ priv->regs, ndev->irq);
+
+ return 0;
+diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c
+index f64f529..a23a7af 100644
+--- a/drivers/net/can/slcan.c
++++ b/drivers/net/can/slcan.c
+@@ -207,7 +207,6 @@ static void slc_bump(struct slcan *sl)
+ if (!skb)
+ return;
+
+- __net_timestamp(skb);
+ skb->dev = sl->dev;
+ skb->protocol = htons(ETH_P_CAN);
+ skb->pkt_type = PACKET_BROADCAST;
+@@ -215,6 +214,7 @@ static void slc_bump(struct slcan *sl)
+
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = sl->dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
+
+ memcpy(skb_put(skb, sizeof(struct can_frame)),
+ &cf, sizeof(struct can_frame));
+diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c
+index bf63fee..34c625e 100644
+--- a/drivers/net/can/spi/mcp251x.c
++++ b/drivers/net/can/spi/mcp251x.c
+@@ -1221,17 +1221,16 @@ static int __maybe_unused mcp251x_can_resume(struct device *dev)
+ struct spi_device *spi = to_spi_device(dev);
+ struct mcp251x_priv *priv = spi_get_drvdata(spi);
+
+- if (priv->after_suspend & AFTER_SUSPEND_POWER) {
++ if (priv->after_suspend & AFTER_SUSPEND_POWER)
+ mcp251x_power_enable(priv->power, 1);
++
++ if (priv->after_suspend & AFTER_SUSPEND_UP) {
++ mcp251x_power_enable(priv->transceiver, 1);
+ queue_work(priv->wq, &priv->restart_work);
+ } else {
+- if (priv->after_suspend & AFTER_SUSPEND_UP) {
+- mcp251x_power_enable(priv->transceiver, 1);
+- queue_work(priv->wq, &priv->restart_work);
+- } else {
+- priv->after_suspend = 0;
+- }
++ priv->after_suspend = 0;
+ }
++
+ priv->force_quit = 0;
+ enable_irq(spi->irq);
+ return 0;
+diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
+index 0ce868d..674f367 100644
+--- a/drivers/net/can/vcan.c
++++ b/drivers/net/can/vcan.c
+@@ -78,9 +78,6 @@ static void vcan_rx(struct sk_buff *skb, struct net_device *dev)
+ skb->dev = dev;
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
+
+- if (!(skb->tstamp.tv64))
+- __net_timestamp(skb);
+-
+ netif_rx_ni(skb);
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+index 8e604a3..ef20be0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
++++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+@@ -540,13 +540,11 @@ static void iwl_set_hw_address_family_8000(struct device *dev,
+ hw_addr = (const u8 *)(mac_override +
+ MAC_ADDRESS_OVERRIDE_FAMILY_8000);
+
+- /* The byte order is little endian 16 bit, meaning 214365 */
+- data->hw_addr[0] = hw_addr[1];
+- data->hw_addr[1] = hw_addr[0];
+- data->hw_addr[2] = hw_addr[3];
+- data->hw_addr[3] = hw_addr[2];
+- data->hw_addr[4] = hw_addr[5];
+- data->hw_addr[5] = hw_addr[4];
++ /*
++ * Store the MAC address from MAO section.
++ * No byte swapping is required in MAO section
++ */
++ memcpy(data->hw_addr, hw_addr, ETH_ALEN);
+
+ /*
+ * Force the use of the OTP MAC address in case of reserved MAC
+diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
+index ef32e17..281451c 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
++++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
+@@ -225,7 +225,7 @@ void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm, struct iwl_tx_cmd *tx_cmd,
+
+ if (info->band == IEEE80211_BAND_2GHZ &&
+ !iwl_mvm_bt_coex_is_shared_ant_avail(mvm))
+- rate_flags = BIT(mvm->cfg->non_shared_ant) << RATE_MCS_ANT_POS;
++ rate_flags = mvm->cfg->non_shared_ant << RATE_MCS_ANT_POS;
+ else
+ rate_flags =
+ BIT(mvm->mgmt_last_antenna_idx) << RATE_MCS_ANT_POS;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
+index dc17909..37e6a6f 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
++++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
+@@ -2515,6 +2515,12 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
+ trans->hw_rev = (trans->hw_rev & 0xfff0) |
+ (CSR_HW_REV_STEP(trans->hw_rev << 2) << 2);
+
++ ret = iwl_pcie_prepare_card_hw(trans);
++ if (ret) {
++ IWL_WARN(trans, "Exit HW not ready\n");
++ goto out_pci_disable_msi;
++ }
++
+ /*
+ * in-order to recognize C step driver should read chip version
+ * id located at the AUX bus MISC address space.
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx1-core.c b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+index 5ac59fb..d3a3be7 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx1-core.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx1-core.c
+@@ -403,14 +403,13 @@ static int imx1_pinconf_set(struct pinctrl_dev *pctldev,
+ unsigned num_configs)
+ {
+ struct imx1_pinctrl *ipctl = pinctrl_dev_get_drvdata(pctldev);
+- const struct imx1_pinctrl_soc_info *info = ipctl->info;
+ int i;
+
+ for (i = 0; i != num_configs; ++i) {
+ imx1_write_bit(ipctl, pin_id, configs[i] & 0x01, MX1_PUEN);
+
+ dev_dbg(ipctl->dev, "pinconf set pullup pin %s\n",
+- info->pins[pin_id].name);
++ pin_desc_get(pctldev, pin_id)->name);
+ }
+
+ return 0;
+diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
+index ff82811..8de1351 100644
+--- a/drivers/regulator/s2mps11.c
++++ b/drivers/regulator/s2mps11.c
+@@ -34,6 +34,8 @@
+ #include <linux/mfd/samsung/s2mps14.h>
+ #include <linux/mfd/samsung/s2mpu02.h>
+
++/* The highest number of possible regulators for supported devices. */
++#define S2MPS_REGULATOR_MAX S2MPS13_REGULATOR_MAX
+ struct s2mps11_info {
+ unsigned int rdev_num;
+ int ramp_delay2;
+@@ -49,7 +51,7 @@ struct s2mps11_info {
+ * One bit for each S2MPS13/S2MPS14/S2MPU02 regulator whether
+ * the suspend mode was enabled.
+ */
+- unsigned long long s2mps14_suspend_state:50;
++ DECLARE_BITMAP(suspend_state, S2MPS_REGULATOR_MAX);
+
+ /* Array of size rdev_num with GPIO-s for external sleep control */
+ int *ext_control_gpio;
+@@ -500,7 +502,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+ switch (s2mps11->dev_type) {
+ case S2MPS13X:
+ case S2MPS14X:
+- if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++ if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ val = S2MPS14_ENABLE_SUSPEND;
+ else if (gpio_is_valid(s2mps11->ext_control_gpio[rdev_get_id(rdev)]))
+ val = S2MPS14_ENABLE_EXT_CONTROL;
+@@ -508,7 +510,7 @@ static int s2mps14_regulator_enable(struct regulator_dev *rdev)
+ val = rdev->desc->enable_mask;
+ break;
+ case S2MPU02:
+- if (s2mps11->s2mps14_suspend_state & (1 << rdev_get_id(rdev)))
++ if (test_bit(rdev_get_id(rdev), s2mps11->suspend_state))
+ val = S2MPU02_ENABLE_SUSPEND;
+ else
+ val = rdev->desc->enable_mask;
+@@ -562,7 +564,7 @@ static int s2mps14_regulator_set_suspend_disable(struct regulator_dev *rdev)
+ if (ret < 0)
+ return ret;
+
+- s2mps11->s2mps14_suspend_state |= (1 << rdev_get_id(rdev));
++ set_bit(rdev_get_id(rdev), s2mps11->suspend_state);
+ /*
+ * Don't enable suspend mode if regulator is already disabled because
+ * this would effectively for a short time turn on the regulator after
+@@ -960,18 +962,22 @@ static int s2mps11_pmic_probe(struct platform_device *pdev)
+ case S2MPS11X:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mps11_regulators);
+ regulators = s2mps11_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ case S2MPS13X:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mps13_regulators);
+ regulators = s2mps13_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ case S2MPS14X:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mps14_regulators);
+ regulators = s2mps14_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ case S2MPU02:
+ s2mps11->rdev_num = ARRAY_SIZE(s2mpu02_regulators);
+ regulators = s2mpu02_regulators;
++ BUILD_BUG_ON(S2MPS_REGULATOR_MAX < s2mps11->rdev_num);
+ break;
+ default:
+ dev_err(&pdev->dev, "Invalid device type: %u\n",
+diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
+index 0e6ee3c..e9ae6b9 100644
+--- a/drivers/scsi/qla2xxx/qla_dbg.c
++++ b/drivers/scsi/qla2xxx/qla_dbg.c
+@@ -68,7 +68,7 @@
+ * | | | 0xd101-0xd1fe |
+ * | | | 0xd214-0xd2fe |
+ * | Target Mode | 0xe079 | |
+- * | Target Mode Management | 0xf072 | 0xf002 |
++ * | Target Mode Management | 0xf080 | 0xf002 |
+ * | | | 0xf046-0xf049 |
+ * | Target Mode Task Management | 0x1000b | |
+ * ----------------------------------------------------------------------
+diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
+index 285cb20..998498e 100644
+--- a/drivers/scsi/qla2xxx/qla_init.c
++++ b/drivers/scsi/qla2xxx/qla_init.c
+@@ -2924,6 +2924,7 @@ qla2x00_rport_del(void *data)
+ struct fc_rport *rport;
+ scsi_qla_host_t *vha = fcport->vha;
+ unsigned long flags;
++ unsigned long vha_flags;
+
+ spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+ rport = fcport->drport ? fcport->drport: fcport->rport;
+@@ -2935,7 +2936,9 @@ qla2x00_rport_del(void *data)
+ * Release the target mode FC NEXUS in qla_target.c code
+ * if target mod is enabled.
+ */
++ spin_lock_irqsave(&vha->hw->hardware_lock, vha_flags);
+ qlt_fc_port_deleted(vha, fcport);
++ spin_unlock_irqrestore(&vha->hw->hardware_lock, vha_flags);
+ }
+ }
+
+@@ -3303,6 +3306,7 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
+ * Create target mode FC NEXUS in qla_target.c if target mode is
+ * enabled..
+ */
++
+ qlt_fc_port_added(vha, fcport);
+
+ spin_lock_irqsave(fcport->vha->host->host_lock, flags);
+@@ -3460,20 +3464,43 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ if ((fcport->flags & FCF_FABRIC_DEVICE) == 0)
+ continue;
+
+- if (fcport->scan_state == QLA_FCPORT_SCAN &&
+- atomic_read(&fcport->state) == FCS_ONLINE) {
+- qla2x00_mark_device_lost(vha, fcport,
+- ql2xplogiabsentdevice, 0);
+- if (fcport->loop_id != FC_NO_LOOP_ID &&
+- (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
+- fcport->port_type != FCT_INITIATOR &&
+- fcport->port_type != FCT_BROADCAST) {
+- ha->isp_ops->fabric_logout(vha,
+- fcport->loop_id,
+- fcport->d_id.b.domain,
+- fcport->d_id.b.area,
+- fcport->d_id.b.al_pa);
+- qla2x00_clear_loop_id(fcport);
++ if (fcport->scan_state == QLA_FCPORT_SCAN) {
++ if (qla_ini_mode_enabled(base_vha) &&
++ atomic_read(&fcport->state) == FCS_ONLINE) {
++ qla2x00_mark_device_lost(vha, fcport,
++ ql2xplogiabsentdevice, 0);
++ if (fcport->loop_id != FC_NO_LOOP_ID &&
++ (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
++ fcport->port_type != FCT_INITIATOR &&
++ fcport->port_type != FCT_BROADCAST) {
++ ha->isp_ops->fabric_logout(vha,
++ fcport->loop_id,
++ fcport->d_id.b.domain,
++ fcport->d_id.b.area,
++ fcport->d_id.b.al_pa);
++ qla2x00_clear_loop_id(fcport);
++ }
++ } else if (!qla_ini_mode_enabled(base_vha)) {
++ /*
++ * In target mode, explicitly kill
++ * sessions and log out of devices
++ * that are gone, so that we don't
++ * end up with an initiator using the
++ * wrong ACL (if the fabric recycles
++ * an FC address and we have a stale
++ * session around) and so that we don't
++ * report initiators that are no longer
++ * on the fabric.
++ */
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf077,
++ "port gone, logging out/killing session: "
++ "%8phC state 0x%x flags 0x%x fc4_type 0x%x "
++ "scan_state %d\n",
++ fcport->port_name,
++ atomic_read(&fcport->state),
++ fcport->flags, fcport->fc4_type,
++ fcport->scan_state);
++ qlt_fc_port_deleted(vha, fcport);
+ }
+ }
+ }
+@@ -3494,6 +3521,28 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ (fcport->flags & FCF_LOGIN_NEEDED) == 0)
+ continue;
+
++ /*
++ * If we're not an initiator, skip looking for devices
++ * and logging in. There's no reason for us to do it,
++ * and it seems to actively cause problems in target
++ * mode if we race with the initiator logging into us
++ * (we might get the "port ID used" status back from
++ * our login command and log out the initiator, which
++ * seems to cause havoc).
++ */
++ if (!qla_ini_mode_enabled(base_vha)) {
++ if (fcport->scan_state == QLA_FCPORT_FOUND) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf078,
++ "port %8phC state 0x%x flags 0x%x fc4_type 0x%x "
++ "scan_state %d (initiator mode disabled; skipping "
++ "login)\n", fcport->port_name,
++ atomic_read(&fcport->state),
++ fcport->flags, fcport->fc4_type,
++ fcport->scan_state);
++ }
++ continue;
++ }
++
+ if (fcport->loop_id == FC_NO_LOOP_ID) {
+ fcport->loop_id = next_loopid;
+ rval = qla2x00_find_new_loop_id(
+@@ -3520,16 +3569,38 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
+ test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
+ break;
+
+- /* Find a new loop ID to use. */
+- fcport->loop_id = next_loopid;
+- rval = qla2x00_find_new_loop_id(base_vha, fcport);
+- if (rval != QLA_SUCCESS) {
+- /* Ran out of IDs to use */
+- break;
+- }
++ /*
++ * If we're not an initiator, skip looking for devices
++ * and logging in. There's no reason for us to do it,
++ * and it seems to actively cause problems in target
++ * mode if we race with the initiator logging into us
++ * (we might get the "port ID used" status back from
++ * our login command and log out the initiator, which
++ * seems to cause havoc).
++ */
++ if (qla_ini_mode_enabled(base_vha)) {
++ /* Find a new loop ID to use. */
++ fcport->loop_id = next_loopid;
++ rval = qla2x00_find_new_loop_id(base_vha,
++ fcport);
++ if (rval != QLA_SUCCESS) {
++ /* Ran out of IDs to use */
++ break;
++ }
+
+- /* Login and update database */
+- qla2x00_fabric_dev_login(vha, fcport, &next_loopid);
++ /* Login and update database */
++ qla2x00_fabric_dev_login(vha, fcport,
++ &next_loopid);
++ } else {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf079,
++ "new port %8phC state 0x%x flags 0x%x fc4_type "
++ "0x%x scan_state %d (initiator mode disabled; "
++ "skipping login)\n",
++ fcport->port_name,
++ atomic_read(&fcport->state),
++ fcport->flags, fcport->fc4_type,
++ fcport->scan_state);
++ }
+
+ list_move_tail(&fcport->list, &vha->vp_fcports);
+ }
+@@ -3725,11 +3796,12 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ fcport->fp_speed = new_fcport->fp_speed;
+
+ /*
+- * If address the same and state FCS_ONLINE, nothing
+- * changed.
++ * If address the same and state FCS_ONLINE
++ * (or in target mode), nothing changed.
+ */
+ if (fcport->d_id.b24 == new_fcport->d_id.b24 &&
+- atomic_read(&fcport->state) == FCS_ONLINE) {
++ (atomic_read(&fcport->state) == FCS_ONLINE ||
++ !qla_ini_mode_enabled(base_vha))) {
+ break;
+ }
+
+@@ -3749,6 +3821,22 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ * Log it out if still logged in and mark it for
+ * relogin later.
+ */
++ if (!qla_ini_mode_enabled(base_vha)) {
++ ql_dbg(ql_dbg_tgt_mgt, vha, 0xf080,
++ "port changed FC ID, %8phC"
++ " old %x:%x:%x (loop_id 0x%04x)-> new %x:%x:%x\n",
++ fcport->port_name,
++ fcport->d_id.b.domain,
++ fcport->d_id.b.area,
++ fcport->d_id.b.al_pa,
++ fcport->loop_id,
++ new_fcport->d_id.b.domain,
++ new_fcport->d_id.b.area,
++ new_fcport->d_id.b.al_pa);
++ fcport->d_id.b24 = new_fcport->d_id.b24;
++ break;
++ }
++
+ fcport->d_id.b24 = new_fcport->d_id.b24;
+ fcport->flags |= FCF_LOGIN_NEEDED;
+ if (fcport->loop_id != FC_NO_LOOP_ID &&
+@@ -3768,6 +3856,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
+ if (found)
+ continue;
+ /* If device was not in our fcports list, then add it. */
++ new_fcport->scan_state = QLA_FCPORT_FOUND;
+ list_add_tail(&new_fcport->list, new_fcports);
+
+ /* Allocate a new replacement fcport. */
+diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
+index fe8a8d1..496a733 100644
+--- a/drivers/scsi/qla2xxx/qla_target.c
++++ b/drivers/scsi/qla2xxx/qla_target.c
+@@ -113,6 +113,7 @@ static void qlt_abort_cmd_on_host_reset(struct scsi_qla_host *vha,
+ static void qlt_alloc_qfull_cmd(struct scsi_qla_host *vha,
+ struct atio_from_isp *atio, uint16_t status, int qfull);
+ static void qlt_disable_vha(struct scsi_qla_host *vha);
++static void qlt_clear_tgt_db(struct qla_tgt *tgt);
+ /*
+ * Global Variables
+ */
+@@ -431,10 +432,10 @@ static int qlt_reset(struct scsi_qla_host *vha, void *iocb, int mcmd)
+
+ loop_id = le16_to_cpu(n->u.isp24.nport_handle);
+ if (loop_id == 0xFFFF) {
+-#if 0 /* FIXME: Re-enable Global event handling.. */
+ /* Global event */
+- atomic_inc(&ha->tgt.qla_tgt->tgt_global_resets_count);
+- qlt_clear_tgt_db(ha->tgt.qla_tgt);
++ atomic_inc(&vha->vha_tgt.qla_tgt->tgt_global_resets_count);
++ qlt_clear_tgt_db(vha->vha_tgt.qla_tgt);
++#if 0 /* FIXME: do we need to choose a session here? */
+ if (!list_empty(&ha->tgt.qla_tgt->sess_list)) {
+ sess = list_entry(ha->tgt.qla_tgt->sess_list.next,
+ typeof(*sess), sess_list_entry);
+@@ -782,25 +783,20 @@ void qlt_fc_port_added(struct scsi_qla_host *vha, fc_port_t *fcport)
+
+ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+ {
+- struct qla_hw_data *ha = vha->hw;
+ struct qla_tgt *tgt = vha->vha_tgt.qla_tgt;
+ struct qla_tgt_sess *sess;
+- unsigned long flags;
+
+ if (!vha->hw->tgt.tgt_ops)
+ return;
+
+- if (!tgt || (fcport->port_type != FCT_INITIATOR))
++ if (!tgt)
+ return;
+
+- spin_lock_irqsave(&ha->hardware_lock, flags);
+ if (tgt->tgt_stop) {
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return;
+ }
+ sess = qlt_find_sess_by_port_name(tgt, fcport->port_name);
+ if (!sess) {
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ return;
+ }
+
+@@ -808,7 +804,6 @@ void qlt_fc_port_deleted(struct scsi_qla_host *vha, fc_port_t *fcport)
+
+ sess->local = 1;
+ qlt_schedule_sess_for_deletion(sess, false);
+- spin_unlock_irqrestore(&ha->hardware_lock, flags);
+ }
+
+ static inline int test_tgt_sess_count(struct qla_tgt *tgt)
+@@ -2347,9 +2342,10 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
+ res = qlt_build_ctio_crc2_pkt(&prm, vha);
+ else
+ res = qlt_24xx_build_ctio_pkt(&prm, vha);
+- if (unlikely(res != 0))
++ if (unlikely(res != 0)) {
++ vha->req->cnt += full_req_cnt;
+ goto out_unmap_unlock;
+-
++ }
+
+ pkt = (struct ctio7_to_24xx *)prm.pkt;
+
+@@ -2487,8 +2483,11 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
+ else
+ res = qlt_24xx_build_ctio_pkt(&prm, vha);
+
+- if (unlikely(res != 0))
++ if (unlikely(res != 0)) {
++ vha->req->cnt += prm.req_cnt;
+ goto out_unlock_free_unmap;
++ }
++
+ pkt = (struct ctio7_to_24xx *)prm.pkt;
+ pkt->u.status0.flags |= __constant_cpu_to_le16(CTIO7_FLAGS_DATA_OUT |
+ CTIO7_FLAGS_STATUS_MODE_0);
+@@ -2717,7 +2716,7 @@ static int __qlt_send_term_exchange(struct scsi_qla_host *vha,
+ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
+ struct qla_tgt_cmd *cmd, struct atio_from_isp *atio, int ha_locked)
+ {
+- unsigned long flags;
++ unsigned long flags = 0;
+ int rc;
+
+ if (qlt_issue_marker(vha, ha_locked) < 0)
+@@ -2733,17 +2732,18 @@ static void qlt_send_term_exchange(struct scsi_qla_host *vha,
+ rc = __qlt_send_term_exchange(vha, cmd, atio);
+ if (rc == -ENOMEM)
+ qlt_alloc_qfull_cmd(vha, atio, 0, 0);
+- spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
+
+ done:
+ if (cmd && ((cmd->state != QLA_TGT_STATE_ABORTED) ||
+ !cmd->cmd_sent_to_fw)) {
+- if (!ha_locked && !in_interrupt())
+- msleep(250); /* just in case */
+-
+- qlt_unmap_sg(vha, cmd);
++ if (cmd->sg_mapped)
++ qlt_unmap_sg(vha, cmd);
+ vha->hw->tgt.tgt_ops->free_cmd(cmd);
+ }
++
++ if (!ha_locked)
++ spin_unlock_irqrestore(&vha->hw->hardware_lock, flags);
++
+ return;
+ }
+
+@@ -3347,6 +3347,11 @@ static struct qla_tgt_cmd *qlt_get_tag(scsi_qla_host_t *vha,
+ cmd->loop_id = sess->loop_id;
+ cmd->conf_compl_supported = sess->conf_compl_supported;
+
++ cmd->cmd_flags = 0;
++ cmd->jiffies_at_alloc = get_jiffies_64();
++
++ cmd->reset_count = vha->hw->chip_reset;
++
+ return cmd;
+ }
+
+@@ -3453,11 +3458,6 @@ static int qlt_handle_cmd_for_atio(struct scsi_qla_host *vha,
+ return -ENOMEM;
+ }
+
+- cmd->cmd_flags = 0;
+- cmd->jiffies_at_alloc = get_jiffies_64();
+-
+- cmd->reset_count = vha->hw->chip_reset;
+-
+ cmd->cmd_in_wq = 1;
+ cmd->cmd_flags |= BIT_0;
+ INIT_WORK(&cmd->work, qlt_do_work);
+diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c
+index c95a4e9..59c31bf 100644
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -944,7 +944,7 @@ void scsi_eh_prep_cmnd(struct scsi_cmnd *scmd, struct scsi_eh_save *ses,
+ scmd->sdb.length);
+ scmd->sdb.table.sgl = &ses->sense_sgl;
+ scmd->sc_data_direction = DMA_FROM_DEVICE;
+- scmd->sdb.table.nents = 1;
++ scmd->sdb.table.nents = scmd->sdb.table.orig_nents = 1;
+ scmd->cmnd[0] = REQUEST_SENSE;
+ scmd->cmnd[4] = scmd->sdb.length;
+ scmd->cmd_len = COMMAND_SIZE(scmd->cmnd[0]);
+diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
+index b1a2631..448ebda 100644
+--- a/drivers/scsi/scsi_lib.c
++++ b/drivers/scsi/scsi_lib.c
+@@ -583,7 +583,7 @@ static struct scatterlist *scsi_sg_alloc(unsigned int nents, gfp_t gfp_mask)
+
+ static void scsi_free_sgtable(struct scsi_data_buffer *sdb, bool mq)
+ {
+- if (mq && sdb->table.nents <= SCSI_MAX_SG_SEGMENTS)
++ if (mq && sdb->table.orig_nents <= SCSI_MAX_SG_SEGMENTS)
+ return;
+ __sg_free_table(&sdb->table, SCSI_MAX_SG_SEGMENTS, mq, scsi_sg_free);
+ }
+@@ -597,8 +597,8 @@ static int scsi_alloc_sgtable(struct scsi_data_buffer *sdb, int nents, bool mq)
+
+ if (mq) {
+ if (nents <= SCSI_MAX_SG_SEGMENTS) {
+- sdb->table.nents = nents;
+- sg_init_table(sdb->table.sgl, sdb->table.nents);
++ sdb->table.nents = sdb->table.orig_nents = nents;
++ sg_init_table(sdb->table.sgl, nents);
+ return 0;
+ }
+ first_chunk = sdb->table.sgl;
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 1ac38e7..9ad4116 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -859,7 +859,7 @@ sdev_store_queue_depth(struct device *dev, struct device_attribute *attr,
+
+ depth = simple_strtoul(buf, NULL, 0);
+
+- if (depth < 1 || depth > sht->can_queue)
++ if (depth < 1 || depth > sdev->host->can_queue)
+ return -EINVAL;
+
+ retval = sht->change_queue_depth(sdev, depth);
+diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
+index 9a1c342..525ab4c 100644
+--- a/drivers/scsi/st.c
++++ b/drivers/scsi/st.c
+@@ -1274,9 +1274,9 @@ static int st_open(struct inode *inode, struct file *filp)
+ spin_lock(&st_use_lock);
+ STp->in_use = 0;
+ spin_unlock(&st_use_lock);
+- scsi_tape_put(STp);
+ if (resumed)
+ scsi_autopm_put_device(STp->device);
++ scsi_tape_put(STp);
+ return retval;
+
+ }
+diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c
+index 788e2b1..acce90a 100644
+--- a/drivers/spi/spi-img-spfi.c
++++ b/drivers/spi/spi-img-spfi.c
+@@ -40,6 +40,7 @@
+ #define SPFI_CONTROL_SOFT_RESET BIT(11)
+ #define SPFI_CONTROL_SEND_DMA BIT(10)
+ #define SPFI_CONTROL_GET_DMA BIT(9)
++#define SPFI_CONTROL_SE BIT(8)
+ #define SPFI_CONTROL_TMODE_SHIFT 5
+ #define SPFI_CONTROL_TMODE_MASK 0x7
+ #define SPFI_CONTROL_TMODE_SINGLE 0
+@@ -491,6 +492,7 @@ static void img_spfi_config(struct spi_master *master, struct spi_device *spi,
+ else if (xfer->tx_nbits == SPI_NBITS_QUAD &&
+ xfer->rx_nbits == SPI_NBITS_QUAD)
+ val |= SPFI_CONTROL_TMODE_QUAD << SPFI_CONTROL_TMODE_SHIFT;
++ val |= SPFI_CONTROL_SE;
+ spfi_writel(spfi, val, SPFI_CONTROL);
+ }
+
+diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
+index f08e812..412b9c8 100644
+--- a/drivers/spi/spi-imx.c
++++ b/drivers/spi/spi-imx.c
+@@ -201,8 +201,9 @@ static bool spi_imx_can_dma(struct spi_master *master, struct spi_device *spi,
+ {
+ struct spi_imx_data *spi_imx = spi_master_get_devdata(master);
+
+- if (spi_imx->dma_is_inited && (transfer->len > spi_imx->rx_wml)
+- && (transfer->len > spi_imx->tx_wml))
++ if (spi_imx->dma_is_inited
++ && transfer->len > spi_imx->rx_wml * sizeof(u32)
++ && transfer->len > spi_imx->tx_wml * sizeof(u32))
+ return true;
+ return false;
+ }
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 74e6114f..305a5cb 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -4001,7 +4001,13 @@ get_immediate:
+ }
+
+ transport_err:
+- iscsit_take_action_for_connection_exit(conn);
++ /*
++ * Avoid the normal connection failure code-path if this connection
++ * is still within LOGIN mode, and iscsi_np process context is
++ * responsible for cleaning up the early connection failure.
++ */
++ if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN)
++ iscsit_take_action_for_connection_exit(conn);
+ out:
+ return 0;
+ }
+@@ -4093,7 +4099,7 @@ reject:
+
+ int iscsi_target_rx_thread(void *arg)
+ {
+- int ret;
++ int ret, rc;
+ u8 buffer[ISCSI_HDR_LEN], opcode;
+ u32 checksum = 0, digest = 0;
+ struct iscsi_conn *conn = arg;
+@@ -4103,10 +4109,16 @@ int iscsi_target_rx_thread(void *arg)
+ * connection recovery / failure event can be triggered externally.
+ */
+ allow_signal(SIGINT);
++ /*
++ * Wait for iscsi_post_login_handler() to complete before allowing
++ * incoming iscsi/tcp socket I/O, and/or failing the connection.
++ */
++ rc = wait_for_completion_interruptible(&conn->rx_login_comp);
++ if (rc < 0)
++ return 0;
+
+ if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) {
+ struct completion comp;
+- int rc;
+
+ init_completion(&comp);
+ rc = wait_for_completion_interruptible(&comp);
+@@ -4543,7 +4555,18 @@ static void iscsit_logout_post_handler_closesession(
+ struct iscsi_conn *conn)
+ {
+ struct iscsi_session *sess = conn->sess;
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++ /*
++ * Traditional iscsi/tcp will invoke this logic from TX thread
++ * context during session logout, so clear tx_thread_active and
++ * sleep if iscsit_close_connection() has not already occured.
++ *
++ * Since iser-target invokes this logic from it's own workqueue,
++ * always sleep waiting for RX/TX thread shutdown to complete
++ * within iscsit_close_connection().
++ */
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4557,7 +4580,10 @@ static void iscsit_logout_post_handler_closesession(
+ static void iscsit_logout_post_handler_samecid(
+ struct iscsi_conn *conn)
+ {
+- int sleep = cmpxchg(&conn->tx_thread_active, true, false);
++ int sleep = 1;
++
++ if (conn->conn_transport->transport_type == ISCSI_TCP)
++ sleep = cmpxchg(&conn->tx_thread_active, true, false);
+
+ atomic_set(&conn->conn_logout_remove, 0);
+ complete(&conn->conn_logout_comp);
+@@ -4776,6 +4802,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ struct iscsi_session *sess;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+ struct se_session *se_sess, *se_sess_tmp;
++ LIST_HEAD(free_list);
+ int session_count = 0;
+
+ spin_lock_bh(&se_tpg->session_lock);
+@@ -4797,14 +4824,17 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
+ }
+ atomic_set(&sess->session_reinstatement, 1);
+ spin_unlock(&sess->conn_lock);
+- spin_unlock_bh(&se_tpg->session_lock);
+
+- iscsit_free_session(sess);
+- spin_lock_bh(&se_tpg->session_lock);
++ list_move_tail(&se_sess->sess_list, &free_list);
++ }
++ spin_unlock_bh(&se_tpg->session_lock);
++
++ list_for_each_entry_safe(se_sess, se_sess_tmp, &free_list, sess_list) {
++ sess = (struct iscsi_session *)se_sess->fabric_sess_ptr;
+
++ iscsit_free_session(sess);
+ session_count++;
+ }
+- spin_unlock_bh(&se_tpg->session_lock);
+
+ pr_debug("Released %d iSCSI Session(s) from Target Portal"
+ " Group: %hu\n", session_count, tpg->tpgt);
+diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
+index 70d799d..c3bccad 100644
+--- a/drivers/target/iscsi/iscsi_target_login.c
++++ b/drivers/target/iscsi/iscsi_target_login.c
+@@ -82,6 +82,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn)
+ init_completion(&conn->conn_logout_comp);
+ init_completion(&conn->rx_half_close_comp);
+ init_completion(&conn->tx_half_close_comp);
++ init_completion(&conn->rx_login_comp);
+ spin_lock_init(&conn->cmd_lock);
+ spin_lock_init(&conn->conn_usage_lock);
+ spin_lock_init(&conn->immed_queue_lock);
+@@ -699,7 +700,7 @@ static void iscsi_post_login_start_timers(struct iscsi_conn *conn)
+ iscsit_start_nopin_timer(conn);
+ }
+
+-static int iscsit_start_kthreads(struct iscsi_conn *conn)
++int iscsit_start_kthreads(struct iscsi_conn *conn)
+ {
+ int ret = 0;
+
+@@ -734,6 +735,7 @@ static int iscsit_start_kthreads(struct iscsi_conn *conn)
+
+ return 0;
+ out_tx:
++ send_sig(SIGINT, conn->tx_thread, 1);
+ kthread_stop(conn->tx_thread);
+ conn->tx_thread_active = false;
+ out_bitmap:
+@@ -744,7 +746,7 @@ out_bitmap:
+ return ret;
+ }
+
+-int iscsi_post_login_handler(
++void iscsi_post_login_handler(
+ struct iscsi_np *np,
+ struct iscsi_conn *conn,
+ u8 zero_tsih)
+@@ -754,7 +756,6 @@ int iscsi_post_login_handler(
+ struct se_session *se_sess = sess->se_sess;
+ struct iscsi_portal_group *tpg = sess->tpg;
+ struct se_portal_group *se_tpg = &tpg->tpg_se_tpg;
+- int rc;
+
+ iscsit_inc_conn_usage_count(conn);
+
+@@ -795,10 +796,6 @@ int iscsi_post_login_handler(
+ sess->sess_ops->InitiatorName);
+ spin_unlock_bh(&sess->conn_lock);
+
+- rc = iscsit_start_kthreads(conn);
+- if (rc)
+- return rc;
+-
+ iscsi_post_login_start_timers(conn);
+ /*
+ * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -807,15 +804,20 @@ int iscsi_post_login_handler(
+ iscsit_thread_get_cpumask(conn);
+ conn->conn_rx_reset_cpumask = 1;
+ conn->conn_tx_reset_cpumask = 1;
+-
++ /*
++ * Wakeup the sleeping iscsi_target_rx_thread() now that
++ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++ */
++ complete(&conn->rx_login_comp);
+ iscsit_dec_conn_usage_count(conn);
++
+ if (stop_timer) {
+ spin_lock_bh(&se_tpg->session_lock);
+ iscsit_stop_time2retain_timer(sess);
+ spin_unlock_bh(&se_tpg->session_lock);
+ }
+ iscsit_dec_session_usage_count(sess);
+- return 0;
++ return;
+ }
+
+ iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1);
+@@ -856,10 +858,6 @@ int iscsi_post_login_handler(
+ " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt);
+ spin_unlock_bh(&se_tpg->session_lock);
+
+- rc = iscsit_start_kthreads(conn);
+- if (rc)
+- return rc;
+-
+ iscsi_post_login_start_timers(conn);
+ /*
+ * Determine CPU mask to ensure connection's RX and TX kthreads
+@@ -868,10 +866,12 @@ int iscsi_post_login_handler(
+ iscsit_thread_get_cpumask(conn);
+ conn->conn_rx_reset_cpumask = 1;
+ conn->conn_tx_reset_cpumask = 1;
+-
++ /*
++ * Wakeup the sleeping iscsi_target_rx_thread() now that
++ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state.
++ */
++ complete(&conn->rx_login_comp);
+ iscsit_dec_conn_usage_count(conn);
+-
+- return 0;
+ }
+
+ static void iscsi_handle_login_thread_timeout(unsigned long data)
+@@ -1436,23 +1436,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np)
+ if (ret < 0)
+ goto new_sess_out;
+
+- if (!conn->sess) {
+- pr_err("struct iscsi_conn session pointer is NULL!\n");
+- goto new_sess_out;
+- }
+-
+ iscsi_stop_login_thread_timer(np);
+
+- if (signal_pending(current))
+- goto new_sess_out;
+-
+ if (ret == 1) {
+ tpg_np = conn->tpg_np;
+
+- ret = iscsi_post_login_handler(np, conn, zero_tsih);
+- if (ret < 0)
+- goto new_sess_out;
+-
++ iscsi_post_login_handler(np, conn, zero_tsih);
+ iscsit_deaccess_np(np, tpg, tpg_np);
+ }
+
+diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h
+index 29d0983..55cbf45 100644
+--- a/drivers/target/iscsi/iscsi_target_login.h
++++ b/drivers/target/iscsi/iscsi_target_login.h
+@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *);
+ extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *);
+ extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32);
+ extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *);
+-extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
++extern int iscsit_start_kthreads(struct iscsi_conn *);
++extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8);
+ extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *,
+ bool, bool);
+ extern int iscsi_target_login_thread(void *);
+diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
+index 8c02fa3..f9cde91 100644
+--- a/drivers/target/iscsi/iscsi_target_nego.c
++++ b/drivers/target/iscsi/iscsi_target_nego.c
+@@ -17,6 +17,7 @@
+ ******************************************************************************/
+
+ #include <linux/ctype.h>
++#include <linux/kthread.h>
+ #include <scsi/iscsi_proto.h>
+ #include <target/target_core_base.h>
+ #include <target/target_core_fabric.h>
+@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ ntohl(login_rsp->statsn), login->rsp_length);
+
+ padding = ((-login->rsp_length) & 3);
++ /*
++ * Before sending the last login response containing the transition
++ * bit for full-feature-phase, go ahead and start up TX/RX threads
++ * now to avoid potential resource allocation failures after the
++ * final login response has been sent.
++ */
++ if (login->login_complete) {
++ int rc = iscsit_start_kthreads(conn);
++ if (rc) {
++ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR,
++ ISCSI_LOGIN_STATUS_NO_RESOURCES);
++ return -1;
++ }
++ }
+
+ if (conn->conn_transport->iscsit_put_login_tx(conn, login,
+ login->rsp_length + padding) < 0)
+- return -1;
++ goto err;
+
+ login->rsp_length = 0;
+ mutex_lock(&sess->cmdsn_mutex);
+@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log
+ mutex_unlock(&sess->cmdsn_mutex);
+
+ return 0;
++
++err:
++ if (login->login_complete) {
++ if (conn->rx_thread && conn->rx_thread_active) {
++ send_sig(SIGINT, conn->rx_thread, 1);
++ kthread_stop(conn->rx_thread);
++ }
++ if (conn->tx_thread && conn->tx_thread_active) {
++ send_sig(SIGINT, conn->tx_thread, 1);
++ kthread_stop(conn->tx_thread);
++ }
++ spin_lock(&iscsit_global->ts_bitmap_lock);
++ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id,
++ get_order(1));
++ spin_unlock(&iscsit_global->ts_bitmap_lock);
++ }
++ return -1;
+ }
+
+ static void iscsi_target_sk_data_ready(struct sock *sk)
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 396344c..16ed0b6 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1108,19 +1108,29 @@ static void eraser(unsigned char c, struct tty_struct *tty)
+ * Locking: ctrl_lock
+ */
+
+-static void isig(int sig, struct tty_struct *tty)
++static void __isig(int sig, struct tty_struct *tty)
+ {
+- struct n_tty_data *ldata = tty->disc_data;
+ struct pid *tty_pgrp = tty_get_pgrp(tty);
+ if (tty_pgrp) {
+ kill_pgrp(tty_pgrp, sig, 1);
+ put_pid(tty_pgrp);
+ }
++}
+
+- if (!L_NOFLSH(tty)) {
++static void isig(int sig, struct tty_struct *tty)
++{
++ struct n_tty_data *ldata = tty->disc_data;
++
++ if (L_NOFLSH(tty)) {
++ /* signal only */
++ __isig(sig, tty);
++
++ } else { /* signal and flush */
+ up_read(&tty->termios_rwsem);
+ down_write(&tty->termios_rwsem);
+
++ __isig(sig, tty);
++
+ /* clear echo buffer */
+ mutex_lock(&ldata->output_lock);
+ ldata->echo_head = ldata->echo_tail = 0;
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index 8825039..01aa52f 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -1132,11 +1132,6 @@ static int imx_startup(struct uart_port *port)
+ while (!(readl(sport->port.membase + UCR2) & UCR2_SRST) && (--i > 0))
+ udelay(1);
+
+- /* Can we enable the DMA support? */
+- if (is_imx6q_uart(sport) && !uart_console(port) &&
+- !sport->dma_is_inited)
+- imx_uart_dma_init(sport);
+-
+ spin_lock_irqsave(&sport->port.lock, flags);
+
+ /*
+@@ -1145,9 +1140,6 @@ static int imx_startup(struct uart_port *port)
+ writel(USR1_RTSD, sport->port.membase + USR1);
+ writel(USR2_ORE, sport->port.membase + USR2);
+
+- if (sport->dma_is_inited && !sport->dma_is_enabled)
+- imx_enable_dma(sport);
+-
+ temp = readl(sport->port.membase + UCR1);
+ temp |= UCR1_RRDYEN | UCR1_RTSDEN | UCR1_UARTEN;
+
+@@ -1318,6 +1310,11 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
+ } else {
+ ucr2 |= UCR2_CTSC;
+ }
++
++ /* Can we enable the DMA support? */
++ if (is_imx6q_uart(sport) && !uart_console(port)
++ && !sport->dma_is_inited)
++ imx_uart_dma_init(sport);
+ } else {
+ termios->c_cflag &= ~CRTSCTS;
+ }
+@@ -1434,6 +1431,8 @@ imx_set_termios(struct uart_port *port, struct ktermios *termios,
+ if (UART_ENABLE_MS(&sport->port, termios->c_cflag))
+ imx_enable_ms(&sport->port);
+
++ if (sport->dma_is_inited && !sport->dma_is_enabled)
++ imx_enable_dma(sport);
+ spin_unlock_irqrestore(&sport->port.lock, flags);
+ }
+
+diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
+index 0b7bb12..ec54044 100644
+--- a/drivers/tty/serial/serial_core.c
++++ b/drivers/tty/serial/serial_core.c
+@@ -1409,7 +1409,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
+ mutex_lock(&port->mutex);
+ uart_shutdown(tty, state);
+ tty_port_tty_set(port, NULL);
+- tty->closing = 0;
++
+ spin_lock_irqsave(&port->lock, flags);
+
+ if (port->blocked_open) {
+@@ -1435,6 +1435,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
+ mutex_unlock(&port->mutex);
+
+ tty_ldisc_flush(tty);
++ tty->closing = 0;
+ }
+
+ static void uart_wait_until_sent(struct tty_struct *tty, int timeout)
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 0827d7c..ee07ba4 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -484,10 +484,13 @@ static void xhci_hub_report_usb3_link_state(struct xhci_hcd *xhci,
+ u32 pls = status_reg & PORT_PLS_MASK;
+
+ /* resume state is a xHCI internal state.
+- * Do not report it to usb core.
++ * Do not report it to usb core, instead, pretend to be U3,
++ * thus usb core knows it's not ready for transfer
+ */
+- if (pls == XDEV_RESUME)
++ if (pls == XDEV_RESUME) {
++ *status |= USB_SS_PORT_LS_U3;
+ return;
++ }
+
+ /* When the CAS bit is set then warm reset
+ * should be performed on port
+@@ -588,7 +591,14 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
+ status |= USB_PORT_STAT_C_RESET << 16;
+ /* USB3.0 only */
+ if (hcd->speed == HCD_USB3) {
+- if ((raw_port_status & PORT_PLC))
++ /* Port link change with port in resume state should not be
++ * reported to usbcore, as this is an internal state to be
++ * handled by xhci driver. Reporting PLC to usbcore may
++ * cause usbcore clearing PLC first and port change event
++ * irq won't be generated.
++ */
++ if ((raw_port_status & PORT_PLC) &&
++ (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME)
+ status |= USB_PORT_STAT_C_LINK_STATE << 16;
+ if ((raw_port_status & PORT_WRC))
+ status |= USB_PORT_STAT_C_BH_RESET << 16;
+@@ -1120,10 +1130,10 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ spin_lock_irqsave(&xhci->lock, flags);
+
+ if (hcd->self.root_hub->do_remote_wakeup) {
+- if (bus_state->resuming_ports) {
++ if (bus_state->resuming_ports || /* USB2 */
++ bus_state->port_remote_wakeup) { /* USB3 */
+ spin_unlock_irqrestore(&xhci->lock, flags);
+- xhci_dbg(xhci, "suspend failed because "
+- "a port is resuming\n");
++ xhci_dbg(xhci, "suspend failed because a port is resuming\n");
+ return -EBUSY;
+ }
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 7d34cbf..d095677 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1546,6 +1546,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
+ usb_hcd_resume_root_hub(hcd);
+ }
+
++ if (hcd->speed == HCD_USB3 && (temp & PORT_PLS_MASK) == XDEV_INACTIVE)
++ bus_state->port_remote_wakeup &= ~(1 << faked_port_index);
++
+ if ((temp & PORT_PLC) && (temp & PORT_PLS_MASK) == XDEV_RESUME) {
+ xhci_dbg(xhci, "port resume event for port %d\n", port_id);
+
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 36bf089..c502c22 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -3453,6 +3453,9 @@ int xhci_discover_or_reset_device(struct usb_hcd *hcd, struct usb_device *udev)
+ return -EINVAL;
+ }
+
++ if (virt_dev->tt_info)
++ old_active_eps = virt_dev->tt_info->active_eps;
++
+ if (virt_dev->udev != udev) {
+ /* If the virt_dev and the udev does not match, this virt_dev
+ * may belong to another udev.
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 6977f84..0f26dd2 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -285,6 +285,7 @@ struct xhci_op_regs {
+ #define XDEV_U0 (0x0 << 5)
+ #define XDEV_U2 (0x2 << 5)
+ #define XDEV_U3 (0x3 << 5)
++#define XDEV_INACTIVE (0x6 << 5)
+ #define XDEV_RESUME (0xf << 5)
+ /* true: port has power (see HCC_PPC) */
+ #define PORT_POWER (1 << 9)
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index caf1888..87898ca 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -2065,6 +2065,18 @@ UNUSUAL_DEV( 0x1908, 0x3335, 0x0200, 0x0200,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_READ_DISC_INFO ),
+
++/* Reported by Oliver Neukum <oneukum@suse.com>
++ * This device morphes spontaneously into another device if the access
++ * pattern of Windows isn't followed. Thus writable media would be dirty
++ * if the initial instance is used. So the device is limited to its
++ * virtual CD.
++ * And yes, the concept that BCD goes up to 9 is not heeded */
++UNUSUAL_DEV( 0x19d2, 0x1225, 0x0000, 0xffff,
++ "ZTE,Incorporated",
++ "ZTE WCDMA Technologies MSM",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_SINGLE_LUN ),
++
+ /* Reported by Sven Geggus <sven-usbst@geggus.net>
+ * This encrypted pen drive returns bogus data for the initial READ(10).
+ */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 2ee2826..fa49d329 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -886,6 +886,7 @@ long vhost_dev_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *argp)
+ }
+ if (eventfp != d->log_file) {
+ filep = d->log_file;
++ d->log_file = eventfp;
+ ctx = d->log_ctx;
+ d->log_ctx = eventfp ?
+ eventfd_ctx_fileget(eventfp) : NULL;
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 50bb3c2..5d03eb0 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
+
+ /*
+ * If we have a d_op->d_delete() operation, we sould not
+- * let the dentry count go to zero, so use "put__or_lock".
++ * let the dentry count go to zero, so use "put_or_lock".
+ */
+ if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
+ return lockref_put_or_lock(&dentry->d_lockref);
+@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
+ */
+ smp_rmb();
+ d_flags = ACCESS_ONCE(dentry->d_flags);
+- d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
++ d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
+
+ /* Nothing to do? Dropping the reference was all we needed? */
+ if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
+@@ -776,6 +776,9 @@ repeat:
+ if (unlikely(d_unhashed(dentry)))
+ goto kill_it;
+
++ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
++ goto kill_it;
++
+ if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
+ if (dentry->d_op->d_delete(dentry))
+ goto kill_it;
+diff --git a/fs/namespace.c b/fs/namespace.c
+index 02c6875..fce3cc1 100644
+--- a/fs/namespace.c
++++ b/fs/namespace.c
+@@ -1350,6 +1350,36 @@ enum umount_tree_flags {
+ UMOUNT_PROPAGATE = 2,
+ UMOUNT_CONNECTED = 4,
+ };
++
++static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
++{
++ /* Leaving mounts connected is only valid for lazy umounts */
++ if (how & UMOUNT_SYNC)
++ return true;
++
++ /* A mount without a parent has nothing to be connected to */
++ if (!mnt_has_parent(mnt))
++ return true;
++
++ /* Because the reference counting rules change when mounts are
++ * unmounted and connected, umounted mounts may not be
++ * connected to mounted mounts.
++ */
++ if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
++ return true;
++
++ /* Has it been requested that the mount remain connected? */
++ if (how & UMOUNT_CONNECTED)
++ return false;
++
++ /* Is the mount locked such that it needs to remain connected? */
++ if (IS_MNT_LOCKED(mnt))
++ return false;
++
++ /* By default disconnect the mount */
++ return true;
++}
++
+ /*
+ * mount_lock must be held
+ * namespace_sem must be held for write
+@@ -1387,10 +1417,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
+ if (how & UMOUNT_SYNC)
+ p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
+
+- disconnect = !(((how & UMOUNT_CONNECTED) &&
+- mnt_has_parent(p) &&
+- (p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
+- IS_MNT_LOCKED_AND_LAZY(p));
++ disconnect = disconnect_mount(p, how);
+
+ pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
+ disconnect ? &unmounted : NULL);
+@@ -1527,11 +1554,8 @@ void __detach_mounts(struct dentry *dentry)
+ while (!hlist_empty(&mp->m_list)) {
+ mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
+ if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
+- struct mount *p, *tmp;
+- list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) {
+- hlist_add_head(&p->mnt_umount.s_list, &unmounted);
+- umount_mnt(p);
+- }
++ hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
++ umount_mnt(mnt);
+ }
+ else umount_tree(mnt, UMOUNT_CONNECTED);
+ }
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index f734562..5d25b9d 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -1242,9 +1242,11 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
+ if (fattr->valid & NFS_ATTR_FATTR_SIZE) {
+ cur_size = i_size_read(inode);
+ new_isize = nfs_size_to_loff_t(fattr->size);
+- if (cur_size != new_isize && nfsi->nrequests == 0)
++ if (cur_size != new_isize)
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
+ }
++ if (nfsi->nrequests != 0)
++ invalid &= ~NFS_INO_REVAL_PAGECACHE;
+
+ /* Have any file permissions changed? */
+ if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
+@@ -1682,8 +1684,7 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ invalid |= NFS_INO_INVALID_ATTR
+ | NFS_INO_INVALID_DATA
+ | NFS_INO_INVALID_ACCESS
+- | NFS_INO_INVALID_ACL
+- | NFS_INO_REVAL_PAGECACHE;
++ | NFS_INO_INVALID_ACL;
+ if (S_ISDIR(inode->i_mode))
+ nfs_force_lookup_revalidate(inode);
+ inode->i_version = fattr->change_attr;
+@@ -1715,7 +1716,6 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
+ if ((nfsi->nrequests == 0) || new_isize > cur_isize) {
+ i_size_write(inode, new_isize);
+ invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA;
+- invalid &= ~NFS_INO_REVAL_PAGECACHE;
+ }
+ dprintk("NFS: isize change on server for file %s/%ld "
+ "(%Ld to %Ld)\n",
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 55e1e3a..d3f2051 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -1204,12 +1204,15 @@ static bool nfs_need_update_open_stateid(struct nfs4_state *state,
+
+ static void nfs_resync_open_stateid_locked(struct nfs4_state *state)
+ {
++ if (!(state->n_wronly || state->n_rdonly || state->n_rdwr))
++ return;
+ if (state->n_wronly)
+ set_bit(NFS_O_WRONLY_STATE, &state->flags);
+ if (state->n_rdonly)
+ set_bit(NFS_O_RDONLY_STATE, &state->flags);
+ if (state->n_rdwr)
+ set_bit(NFS_O_RDWR_STATE, &state->flags);
++ set_bit(NFS_OPEN_STATE, &state->flags);
+ }
+
+ static void nfs_clear_open_stateid_locked(struct nfs4_state *state,
+diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
+index 282b393..7b45526 100644
+--- a/fs/nfs/pagelist.c
++++ b/fs/nfs/pagelist.c
+@@ -1110,8 +1110,11 @@ static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
+ nfs_list_remove_request(req);
+ if (__nfs_pageio_add_request(desc, req))
+ continue;
+- if (desc->pg_error < 0)
++ if (desc->pg_error < 0) {
++ list_splice_tail(&head, &mirror->pg_list);
++ mirror->pg_recoalesce = 1;
+ return 0;
++ }
+ break;
+ }
+ } while (mirror->pg_recoalesce);
+diff --git a/fs/pnode.h b/fs/pnode.h
+index 7114ce6..0fcdbe7 100644
+--- a/fs/pnode.h
++++ b/fs/pnode.h
+@@ -20,8 +20,6 @@
+ #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
+ #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
+ #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
+-#define IS_MNT_LOCKED_AND_LAZY(m) \
+- (((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
+
+ #define CL_EXPIRE 0x01
+ #define CL_SLAVE 0x02
+diff --git a/fs/xfs/libxfs/xfs_attr_remote.c b/fs/xfs/libxfs/xfs_attr_remote.c
+index 20de88d..dd71403 100644
+--- a/fs/xfs/libxfs/xfs_attr_remote.c
++++ b/fs/xfs/libxfs/xfs_attr_remote.c
+@@ -159,11 +159,10 @@ xfs_attr3_rmt_write_verify(
+ struct xfs_buf *bp)
+ {
+ struct xfs_mount *mp = bp->b_target->bt_mount;
+- struct xfs_buf_log_item *bip = bp->b_fspriv;
++ int blksize = mp->m_attr_geo->blksize;
+ char *ptr;
+ int len;
+ xfs_daddr_t bno;
+- int blksize = mp->m_attr_geo->blksize;
+
+ /* no verification of non-crc buffers */
+ if (!xfs_sb_version_hascrc(&mp->m_sb))
+@@ -175,16 +174,22 @@ xfs_attr3_rmt_write_verify(
+ ASSERT(len >= blksize);
+
+ while (len > 0) {
++ struct xfs_attr3_rmt_hdr *rmt = (struct xfs_attr3_rmt_hdr *)ptr;
++
+ if (!xfs_attr3_rmt_verify(mp, ptr, blksize, bno)) {
+ xfs_buf_ioerror(bp, -EFSCORRUPTED);
+ xfs_verifier_error(bp);
+ return;
+ }
+- if (bip) {
+- struct xfs_attr3_rmt_hdr *rmt;
+
+- rmt = (struct xfs_attr3_rmt_hdr *)ptr;
+- rmt->rm_lsn = cpu_to_be64(bip->bli_item.li_lsn);
++ /*
++ * Ensure we aren't writing bogus LSNs to disk. See
++ * xfs_attr3_rmt_hdr_set() for the explanation.
++ */
++ if (rmt->rm_lsn != cpu_to_be64(NULLCOMMITLSN)) {
++ xfs_buf_ioerror(bp, -EFSCORRUPTED);
++ xfs_verifier_error(bp);
++ return;
+ }
+ xfs_update_cksum(ptr, blksize, XFS_ATTR3_RMT_CRC_OFF);
+
+@@ -221,6 +226,18 @@ xfs_attr3_rmt_hdr_set(
+ rmt->rm_owner = cpu_to_be64(ino);
+ rmt->rm_blkno = cpu_to_be64(bno);
+
++ /*
++ * Remote attribute blocks are written synchronously, so we don't
++ * have an LSN that we can stamp in them that makes any sense to log
++ * recovery. To ensure that log recovery handles overwrites of these
++ * blocks sanely (i.e. once they've been freed and reallocated as some
++ * other type of metadata) we need to ensure that the LSN has a value
++ * that tells log recovery to ignore the LSN and overwrite the buffer
++ * with whatever is in it's log. To do this, we use the magic
++ * NULLCOMMITLSN to indicate that the LSN is invalid.
++ */
++ rmt->rm_lsn = cpu_to_be64(NULLCOMMITLSN);
++
+ return sizeof(struct xfs_attr3_rmt_hdr);
+ }
+
+@@ -434,14 +451,21 @@ xfs_attr_rmtval_set(
+
+ /*
+ * Allocate a single extent, up to the size of the value.
++ *
++ * Note that we have to consider this a data allocation as we
++ * write the remote attribute without logging the contents.
++ * Hence we must ensure that we aren't using blocks that are on
++ * the busy list so that we don't overwrite blocks which have
++ * recently been freed but their transactions are not yet
++ * committed to disk. If we overwrite the contents of a busy
++ * extent and then crash then the block may not contain the
++ * correct metadata after log recovery occurs.
+ */
+ xfs_bmap_init(args->flist, args->firstblock);
+ nmap = 1;
+ error = xfs_bmapi_write(args->trans, dp, (xfs_fileoff_t)lblkno,
+- blkcnt,
+- XFS_BMAPI_ATTRFORK | XFS_BMAPI_METADATA,
+- args->firstblock, args->total, &map, &nmap,
+- args->flist);
++ blkcnt, XFS_BMAPI_ATTRFORK, args->firstblock,
++ args->total, &map, &nmap, args->flist);
+ if (!error) {
+ error = xfs_bmap_finish(&args->trans, args->flist,
+ &committed);
+diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
+index 4f5784f..a5d0339 100644
+--- a/fs/xfs/xfs_log_recover.c
++++ b/fs/xfs/xfs_log_recover.c
+@@ -1887,9 +1887,14 @@ xlog_recover_get_buf_lsn(
+ uuid = &((struct xfs_dir3_blk_hdr *)blk)->uuid;
+ break;
+ case XFS_ATTR3_RMT_MAGIC:
+- lsn = be64_to_cpu(((struct xfs_attr3_rmt_hdr *)blk)->rm_lsn);
+- uuid = &((struct xfs_attr3_rmt_hdr *)blk)->rm_uuid;
+- break;
++ /*
++ * Remote attr blocks are written synchronously, rather than
++ * being logged. That means they do not contain a valid LSN
++ * (i.e. transactionally ordered) in them, and hence any time we
++ * see a buffer to replay over the top of a remote attribute
++ * block we should simply do so.
++ */
++ goto recover_immediately;
+ case XFS_SB_MAGIC:
+ lsn = be64_to_cpu(((struct xfs_dsb *)blk)->sb_lsn);
+ uuid = &((struct xfs_dsb *)blk)->sb_uuid;
+diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
+index b6a52a4..51bb653 100644
+--- a/include/linux/can/skb.h
++++ b/include/linux/can/skb.h
+@@ -27,10 +27,12 @@
+ /**
+ * struct can_skb_priv - private additional data inside CAN sk_buffs
+ * @ifindex: ifindex of the first interface the CAN frame appeared on
++ * @skbcnt: atomic counter to have an unique id together with skb pointer
+ * @cf: align to the following CAN frame at skb->data
+ */
+ struct can_skb_priv {
+ int ifindex;
++ int skbcnt;
+ struct can_frame cf[0];
+ };
+
+diff --git a/include/linux/cper.h b/include/linux/cper.h
+index 76abba4..dcacb1a 100644
+--- a/include/linux/cper.h
++++ b/include/linux/cper.h
+@@ -340,7 +340,27 @@ struct cper_ia_proc_ctx {
+ __u64 mm_reg_addr;
+ };
+
+-/* Memory Error Section */
++/* Old Memory Error Section UEFI 2.1, 2.2 */
++struct cper_sec_mem_err_old {
++ __u64 validation_bits;
++ __u64 error_status;
++ __u64 physical_addr;
++ __u64 physical_addr_mask;
++ __u16 node;
++ __u16 card;
++ __u16 module;
++ __u16 bank;
++ __u16 device;
++ __u16 row;
++ __u16 column;
++ __u16 bit_pos;
++ __u64 requestor_id;
++ __u64 responder_id;
++ __u64 target_id;
++ __u8 error_type;
++};
++
++/* Memory Error Section UEFI >= 2.3 */
+ struct cper_sec_mem_err {
+ __u64 validation_bits;
+ __u64 error_status;
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index 1da6029..6cd8c0e 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
+ * SAVE_REGS. If another ops with this flag set is already registered
+ * for any of the functions that this ops will be registered for, then
+ * this ops will fail to register or set_filter_ip.
++ * PID - Is affected by set_ftrace_pid (allows filtering on those pids)
+ */
+ enum {
+ FTRACE_OPS_FL_ENABLED = 1 << 0,
+@@ -132,6 +133,7 @@ enum {
+ FTRACE_OPS_FL_MODIFYING = 1 << 11,
+ FTRACE_OPS_FL_ALLOC_TRAMP = 1 << 12,
+ FTRACE_OPS_FL_IPMODIFY = 1 << 13,
++ FTRACE_OPS_FL_PID = 1 << 14,
+ };
+
+ #ifdef CONFIG_DYNAMIC_FTRACE
+@@ -159,6 +161,7 @@ struct ftrace_ops {
+ struct ftrace_ops *next;
+ unsigned long flags;
+ void *private;
++ ftrace_func_t saved_func;
+ int __percpu *disabled;
+ #ifdef CONFIG_DYNAMIC_FTRACE
+ int nr_trampolines;
+diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h
+index 54e7af3..73abbc5 100644
+--- a/include/target/iscsi/iscsi_target_core.h
++++ b/include/target/iscsi/iscsi_target_core.h
+@@ -606,6 +606,7 @@ struct iscsi_conn {
+ int bitmap_id;
+ int rx_thread_active;
+ struct task_struct *rx_thread;
++ struct completion rx_login_comp;
+ int tx_thread_active;
+ struct task_struct *tx_thread;
+ /* list_head for session connection list */
+diff --git a/kernel/irq/resend.c b/kernel/irq/resend.c
+index 9065107..7a5237a 100644
+--- a/kernel/irq/resend.c
++++ b/kernel/irq/resend.c
+@@ -75,13 +75,21 @@ void check_irq_resend(struct irq_desc *desc, unsigned int irq)
+ !desc->irq_data.chip->irq_retrigger(&desc->irq_data)) {
+ #ifdef CONFIG_HARDIRQS_SW_RESEND
+ /*
+- * If the interrupt has a parent irq and runs
+- * in the thread context of the parent irq,
+- * retrigger the parent.
++ * If the interrupt is running in the thread
++ * context of the parent irq we need to be
++ * careful, because we cannot trigger it
++ * directly.
+ */
+- if (desc->parent_irq &&
+- irq_settings_is_nested_thread(desc))
++ if (irq_settings_is_nested_thread(desc)) {
++ /*
++ * If the parent_irq is valid, we
++ * retrigger the parent, otherwise we
++ * do nothing.
++ */
++ if (!desc->parent_irq)
++ return;
+ irq = desc->parent_irq;
++ }
+ /* Set it pending and activate the softirq: */
+ set_bit(irq, irqs_resend);
+ tasklet_schedule(&resend_tasklet);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 02bece4..eb11011 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -98,6 +98,13 @@ struct ftrace_pid {
+ struct pid *pid;
+ };
+
++static bool ftrace_pids_enabled(void)
++{
++ return !list_empty(&ftrace_pids);
++}
++
++static void ftrace_update_trampoline(struct ftrace_ops *ops);
++
+ /*
+ * ftrace_disabled is set when an anomaly is discovered.
+ * ftrace_disabled is much stronger than ftrace_enabled.
+@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
+ static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
+ static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
+ ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
+-ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
+ static struct ftrace_ops global_ops;
+ static struct ftrace_ops control_ops;
+
+@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
+ if (!test_tsk_trace_trace(current))
+ return;
+
+- ftrace_pid_function(ip, parent_ip, op, regs);
+-}
+-
+-static void set_ftrace_pid_function(ftrace_func_t func)
+-{
+- /* do not set ftrace_pid_function to itself! */
+- if (func != ftrace_pid_func)
+- ftrace_pid_function = func;
++ op->saved_func(ip, parent_ip, op, regs);
+ }
+
+ /**
+@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
+ void clear_ftrace_function(void)
+ {
+ ftrace_trace_function = ftrace_stub;
+- ftrace_pid_function = ftrace_stub;
+ }
+
+ static void control_ops_disable_all(struct ftrace_ops *ops)
+@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
+ } else
+ add_ftrace_ops(&ftrace_ops_list, ops);
+
++ /* Always save the function, and reset at unregistering */
++ ops->saved_func = ops->func;
++
++ if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
++ ops->func = ftrace_pid_func;
++
+ ftrace_update_trampoline(ops);
+
+ if (ftrace_enabled)
+@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
+ if (ftrace_enabled)
+ update_ftrace_function();
+
++ ops->func = ops->saved_func;
++
+ return 0;
+ }
+
+ static void ftrace_update_pid_func(void)
+ {
++ bool enabled = ftrace_pids_enabled();
++ struct ftrace_ops *op;
++
+ /* Only do something if we are tracing something */
+ if (ftrace_trace_function == ftrace_stub)
+ return;
+
++ do_for_each_ftrace_op(op, ftrace_ops_list) {
++ if (op->flags & FTRACE_OPS_FL_PID) {
++ op->func = enabled ? ftrace_pid_func :
++ op->saved_func;
++ ftrace_update_trampoline(op);
++ }
++ } while_for_each_ftrace_op(op);
++
+ update_ftrace_function();
+ }
+
+@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
+ .local_hash.filter_hash = EMPTY_HASH,
+ INIT_OPS_HASH(global_ops)
+ .flags = FTRACE_OPS_FL_RECURSION_SAFE |
+- FTRACE_OPS_FL_INITIALIZED,
++ FTRACE_OPS_FL_INITIALIZED |
++ FTRACE_OPS_FL_PID,
+ };
+
+ /*
+@@ -5023,7 +5041,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
+
+ static struct ftrace_ops global_ops = {
+ .func = ftrace_stub,
+- .flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
++ .flags = FTRACE_OPS_FL_RECURSION_SAFE |
++ FTRACE_OPS_FL_INITIALIZED |
++ FTRACE_OPS_FL_PID,
+ };
+
+ static int __init ftrace_nodyn_init(void)
+@@ -5080,11 +5100,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
+ if (WARN_ON(tr->ops->func != ftrace_stub))
+ printk("ftrace ops had %pS for function\n",
+ tr->ops->func);
+- /* Only the top level instance does pid tracing */
+- if (!list_empty(&ftrace_pids)) {
+- set_ftrace_pid_function(func);
+- func = ftrace_pid_func;
+- }
+ }
+ tr->ops->func = func;
+ tr->ops->private = tr;
+@@ -5371,7 +5386,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
+ {
+ mutex_lock(&ftrace_lock);
+
+- if (list_empty(&ftrace_pids) && (!*pos))
++ if (!ftrace_pids_enabled() && (!*pos))
+ return (void *) 1;
+
+ return seq_list_start(&ftrace_pids, *pos);
+@@ -5610,6 +5625,7 @@ static struct ftrace_ops graph_ops = {
+ .func = ftrace_stub,
+ .flags = FTRACE_OPS_FL_RECURSION_SAFE |
+ FTRACE_OPS_FL_INITIALIZED |
++ FTRACE_OPS_FL_PID |
+ FTRACE_OPS_FL_STUB,
+ #ifdef FTRACE_GRAPH_TRAMP_ADDR
+ .trampoline = FTRACE_GRAPH_TRAMP_ADDR,
+diff --git a/lib/dma-debug.c b/lib/dma-debug.c
+index ae4b65e..dace71f 100644
+--- a/lib/dma-debug.c
++++ b/lib/dma-debug.c
+@@ -574,6 +574,9 @@ void debug_dma_assert_idle(struct page *page)
+ unsigned long flags;
+ phys_addr_t cln;
+
++ if (dma_debug_disabled())
++ return;
++
+ if (!page)
+ return;
+
+diff --git a/net/can/af_can.c b/net/can/af_can.c
+index 689c818..62c635f 100644
+--- a/net/can/af_can.c
++++ b/net/can/af_can.c
+@@ -89,6 +89,8 @@ struct timer_list can_stattimer; /* timer for statistics update */
+ struct s_stats can_stats; /* packet statistics */
+ struct s_pstats can_pstats; /* receive list statistics */
+
++static atomic_t skbcounter = ATOMIC_INIT(0);
++
+ /*
+ * af_can socket functions
+ */
+@@ -310,12 +312,8 @@ int can_send(struct sk_buff *skb, int loop)
+ return err;
+ }
+
+- if (newskb) {
+- if (!(newskb->tstamp.tv64))
+- __net_timestamp(newskb);
+-
++ if (newskb)
+ netif_rx_ni(newskb);
+- }
+
+ /* update statistics */
+ can_stats.tx_frames++;
+@@ -683,6 +681,10 @@ static void can_receive(struct sk_buff *skb, struct net_device *dev)
+ can_stats.rx_frames++;
+ can_stats.rx_frames_delta++;
+
++ /* create non-zero unique skb identifier together with *skb */
++ while (!(can_skb_prv(skb)->skbcnt))
++ can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
++
+ rcu_read_lock();
+
+ /* deliver the packet to sockets listening on all devices */
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index b523453..a1ba687 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -261,6 +261,7 @@ static void bcm_can_tx(struct bcm_op *op)
+
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
+
+ memcpy(skb_put(skb, CFSIZ), cf, CFSIZ);
+
+@@ -1217,6 +1218,7 @@ static int bcm_tx_send(struct msghdr *msg, int ifindex, struct sock *sk)
+ }
+
+ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
+ skb->dev = dev;
+ can_skb_set_owner(skb, sk);
+ err = can_send(skb, 1); /* send with loopback */
+diff --git a/net/can/raw.c b/net/can/raw.c
+index 31b9748..2e67b14 100644
+--- a/net/can/raw.c
++++ b/net/can/raw.c
+@@ -75,7 +75,7 @@ MODULE_ALIAS("can-proto-1");
+ */
+
+ struct uniqframe {
+- ktime_t tstamp;
++ int skbcnt;
+ const struct sk_buff *skb;
+ unsigned int join_rx_count;
+ };
+@@ -133,7 +133,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+
+ /* eliminate multiple filter matches for the same skb */
+ if (this_cpu_ptr(ro->uniq)->skb == oskb &&
+- ktime_equal(this_cpu_ptr(ro->uniq)->tstamp, oskb->tstamp)) {
++ this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
+ if (ro->join_filters) {
+ this_cpu_inc(ro->uniq->join_rx_count);
+ /* drop frame until all enabled filters matched */
+@@ -144,7 +144,7 @@ static void raw_rcv(struct sk_buff *oskb, void *data)
+ }
+ } else {
+ this_cpu_ptr(ro->uniq)->skb = oskb;
+- this_cpu_ptr(ro->uniq)->tstamp = oskb->tstamp;
++ this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
+ this_cpu_ptr(ro->uniq)->join_rx_count = 1;
+ /* drop first frame to check all enabled filters? */
+ if (ro->join_filters && ro->count > 1)
+@@ -749,6 +749,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
+
+ can_skb_reserve(skb);
+ can_skb_prv(skb)->ifindex = dev->ifindex;
++ can_skb_prv(skb)->skbcnt = 0;
+
+ err = memcpy_from_msg(skb_put(skb, size), msg, size);
+ if (err < 0)
+diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
+index 29236e8..c09c013 100644
+--- a/net/mac80211/debugfs_netdev.c
++++ b/net/mac80211/debugfs_netdev.c
+@@ -723,6 +723,7 @@ void ieee80211_debugfs_remove_netdev(struct ieee80211_sub_if_data *sdata)
+
+ debugfs_remove_recursive(sdata->vif.debugfs_dir);
+ sdata->vif.debugfs_dir = NULL;
++ sdata->debugfs.subdir_stations = NULL;
+ }
+
+ void ieee80211_debugfs_rename_netdev(struct ieee80211_sub_if_data *sdata)
+diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
+index 273b8bf..657ba9f 100644
+--- a/net/rds/ib_rdma.c
++++ b/net/rds/ib_rdma.c
+@@ -759,8 +759,10 @@ void *rds_ib_get_mr(struct scatterlist *sg, unsigned long nents,
+ }
+
+ ibmr = rds_ib_alloc_fmr(rds_ibdev);
+- if (IS_ERR(ibmr))
++ if (IS_ERR(ibmr)) {
++ rds_ib_dev_put(rds_ibdev);
+ return ibmr;
++ }
+
+ ret = rds_ib_map_fmr(rds_ibdev, ibmr, sg, nents);
+ if (ret == 0)
+diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
+index d126c03..75888dd 100644
+--- a/sound/core/pcm_native.c
++++ b/sound/core/pcm_native.c
+@@ -85,7 +85,7 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
+ void snd_pcm_stream_lock(struct snd_pcm_substream *substream)
+ {
+ if (substream->pcm->nonatomic) {
+- down_read(&snd_pcm_link_rwsem);
++ down_read_nested(&snd_pcm_link_rwsem, SINGLE_DEPTH_NESTING);
+ mutex_lock(&substream->self_group.mutex);
+ } else {
+ read_lock(&snd_pcm_link_rwlock);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index c403dd1..44dfc7b 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2056,6 +2056,8 @@ static const struct pci_device_id azx_ids[] = {
+ /* ATI HDMI */
+ { PCI_DEVICE(0x1002, 0x1308),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0x157a),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0x793b),
+ .driver_data = AZX_DRIVER_ATIHDMI | AZX_DCAPS_PRESET_ATI_HDMI },
+ { PCI_DEVICE(0x1002, 0x7919),
+@@ -2110,8 +2112,14 @@ static const struct pci_device_id azx_ids[] = {
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaab0),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaac0),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ { PCI_DEVICE(0x1002, 0xaac8),
+ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaad8),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
++ { PCI_DEVICE(0x1002, 0xaae8),
++ .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+ /* VIA VT8251/VT8237A */
+ { PCI_DEVICE(0x1106, 0x3288),
+ .driver_data = AZX_DRIVER_VIA | AZX_DCAPS_POSFIX_VIA },
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 5f44f60..225b78b 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -3333,6 +3333,7 @@ static const struct hda_codec_preset snd_hda_preset_hdmi[] = {
+ { .id = 0x10de0070, .name = "GPU 70 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de0071, .name = "GPU 71 HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de0072, .name = "GPU 72 HDMI/DP", .patch = patch_nvhdmi },
++{ .id = 0x10de007d, .name = "GPU 7d HDMI/DP", .patch = patch_nvhdmi },
+ { .id = 0x10de8001, .name = "MCP73 HDMI", .patch = patch_nvhdmi_2ch },
+ { .id = 0x11069f80, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+ { .id = 0x11069f81, .name = "VX900 HDMI/DP", .patch = patch_via_hdmi },
+@@ -3396,6 +3397,7 @@ MODULE_ALIAS("snd-hda-codec-id:10de0067");
+ MODULE_ALIAS("snd-hda-codec-id:10de0070");
+ MODULE_ALIAS("snd-hda-codec-id:10de0071");
+ MODULE_ALIAS("snd-hda-codec-id:10de0072");
++MODULE_ALIAS("snd-hda-codec-id:10de007d");
+ MODULE_ALIAS("snd-hda-codec-id:10de8001");
+ MODULE_ALIAS("snd-hda-codec-id:11069f80");
+ MODULE_ALIAS("snd-hda-codec-id:11069f81");
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0e75998..590bcfb0 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2224,7 +2224,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x106b, 0x4300, "iMac 9,1", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4600, "MacbookPro 5,2", ALC889_FIXUP_IMAC91_VREF),
+ SND_PCI_QUIRK(0x106b, 0x4900, "iMac 9,1 Aluminum", ALC889_FIXUP_IMAC91_VREF),
+- SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_IMAC91_VREF),
++ SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF),
+
+ SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
+@@ -5004,7 +5004,7 @@ static const struct hda_fixup alc269_fixups[] = {
+ { 0x14, 0x90170110 },
+ { 0x17, 0x40000008 },
+ { 0x18, 0x411111f0 },
+- { 0x19, 0x411111f0 },
++ { 0x19, 0x01a1913c },
+ { 0x1a, 0x411111f0 },
+ { 0x1b, 0x411111f0 },
+ { 0x1d, 0x40f89b2d },
+@@ -5114,6 +5114,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x0665, "Dell XPS 13", ALC288_FIXUP_DELL_XPS_13),
++ SND_PCI_QUIRK(0x1028, 0x069a, "Dell Vostro 5480", ALC290_FIXUP_SUBWOOFER_HSJACK),
+ SND_PCI_QUIRK(0x1028, 0x06c7, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+@@ -5382,6 +5383,17 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+ {0x1d, 0x40700001},
+ {0x21, 0x02211030}),
+ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++ {0x12, 0x40000000},
++ {0x14, 0x90170130},
++ {0x17, 0x411111f0},
++ {0x18, 0x411111f0},
++ {0x19, 0x411111f0},
++ {0x1a, 0x411111f0},
++ {0x1b, 0x01014020},
++ {0x1d, 0x4054c029},
++ {0x1e, 0x411111f0},
++ {0x21, 0x0221103f}),
++ SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x12, 0x90a60160},
+ {0x14, 0x90170120},
+ {0x17, 0x90170140},
+diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
+index 6c66d7e..25f0f45 100644
+--- a/sound/pci/hda/patch_sigmatel.c
++++ b/sound/pci/hda/patch_sigmatel.c
+@@ -2920,7 +2920,8 @@ static const struct snd_pci_quirk stac92hd83xxx_fixup_tbl[] = {
+ SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x148a,
+ "HP Mini", STAC_92HD83XXX_HP_LED),
+ SND_PCI_QUIRK_VENDOR(PCI_VENDOR_ID_HP, "HP", STAC_92HD83XXX_HP),
+- SND_PCI_QUIRK(PCI_VENDOR_ID_TOSHIBA, 0xfa91,
++ /* match both for 0xfa91 and 0xfa93 */
++ SND_PCI_QUIRK_MASK(PCI_VENDOR_ID_TOSHIBA, 0xfffd, 0xfa91,
+ "Toshiba Satellite S50D", STAC_92HD83XXX_GPIO10_EAPD),
+ {} /* terminator */
+ };
+diff --git a/sound/usb/line6/pcm.c b/sound/usb/line6/pcm.c
+index 8461d6b..204cc07 100644
+--- a/sound/usb/line6/pcm.c
++++ b/sound/usb/line6/pcm.c
+@@ -186,12 +186,8 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
+ int ret = 0;
+
+ spin_lock_irqsave(&pstr->lock, flags);
+- if (!test_and_set_bit(type, &pstr->running)) {
+- if (pstr->active_urbs || pstr->unlink_urbs) {
+- ret = -EBUSY;
+- goto error;
+- }
+-
++ if (!test_and_set_bit(type, &pstr->running) &&
++ !(pstr->active_urbs || pstr->unlink_urbs)) {
+ pstr->count = 0;
+ /* Submit all currently available URBs */
+ if (direction == SNDRV_PCM_STREAM_PLAYBACK)
+@@ -199,7 +195,6 @@ static int line6_stream_start(struct snd_line6_pcm *line6pcm, int direction,
+ else
+ ret = line6_submit_audio_in_all_urbs(line6pcm);
+ }
+- error:
+ if (ret < 0)
+ clear_bit(type, &pstr->running);
+ spin_unlock_irqrestore(&pstr->lock, flags);
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index e5000da..6a803ef 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -341,6 +341,20 @@ static const struct usbmix_name_map scms_usb3318_map[] = {
+ { 0 }
+ };
+
++/* Bose companion 5, the dB conversion factor is 16 instead of 256 */
++static struct usbmix_dB_map bose_companion5_dB = {-5006, -6};
++static struct usbmix_name_map bose_companion5_map[] = {
++ { 3, NULL, .dB = &bose_companion5_dB },
++ { 0 } /* terminator */
++};
++
++/* Dragonfly DAC 1.2, the dB conversion factor is 1 instead of 256 */
++static struct usbmix_dB_map dragonfly_1_2_dB = {0, 5000};
++static struct usbmix_name_map dragonfly_1_2_map[] = {
++ { 7, NULL, .dB = &dragonfly_1_2_dB },
++ { 0 } /* terminator */
++};
++
+ /*
+ * Control map entries
+ */
+@@ -451,6 +465,16 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ .id = USB_ID(0x25c4, 0x0003),
+ .map = scms_usb3318_map,
+ },
++ {
++ /* Bose Companion 5 */
++ .id = USB_ID(0x05a7, 0x1020),
++ .map = bose_companion5_map,
++ },
++ {
++ /* Dragonfly DAC 1.2 */
++ .id = USB_ID(0x21b4, 0x0081),
++ .map = dragonfly_1_2_map,
++ },
+ { 0 } /* terminator */
+ };
+
+diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
+index 2f6d3e9..e475665 100644
+--- a/sound/usb/quirks-table.h
++++ b/sound/usb/quirks-table.h
+@@ -2512,6 +2512,74 @@ YAMAHA_DEVICE(0x7010, "UB99"),
+ }
+ },
+
++/* Steinberg devices */
++{
++ /* Steinberg MI2 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x2040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++{
++ /* Steinberg MI4 */
++ USB_DEVICE_VENDOR_SPEC(0x0a4e, 0x4040),
++ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
++ .ifnum = QUIRK_ANY_INTERFACE,
++ .type = QUIRK_COMPOSITE,
++ .data = & (const struct snd_usb_audio_quirk[]) {
++ {
++ .ifnum = 0,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 1,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 2,
++ .type = QUIRK_AUDIO_STANDARD_INTERFACE
++ },
++ {
++ .ifnum = 3,
++ .type = QUIRK_MIDI_FIXED_ENDPOINT,
++ .data = &(const struct snd_usb_midi_endpoint_info) {
++ .out_cables = 0x0001,
++ .in_cables = 0x0001
++ }
++ },
++ {
++ .ifnum = -1
++ }
++ }
++ }
++},
++
+ /* TerraTec devices */
+ {
+ USB_DEVICE_VENDOR_SPEC(0x0ccd, 0x0012),
+diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
+index 995b7a8..658b0a8 100644
+--- a/tools/perf/ui/browsers/hists.c
++++ b/tools/perf/ui/browsers/hists.c
+@@ -45,7 +45,7 @@ static struct rb_node *hists__filter_entries(struct rb_node *nd,
+
+ static bool hist_browser__has_filter(struct hist_browser *hb)
+ {
+- return hists__has_filter(hb->hists) || hb->min_pcnt;
++ return hists__has_filter(hb->hists) || hb->min_pcnt || symbol_conf.has_filter;
+ }
+
+ static int hist_browser__get_folding(struct hist_browser *browser)
+diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
+index 201f6c4c..99378a5 100644
+--- a/tools/perf/util/symbol.c
++++ b/tools/perf/util/symbol.c
+@@ -1893,6 +1893,8 @@ int setup_intlist(struct intlist **list, const char *list_str,
+ pr_err("problems parsing %s list\n", list_name);
+ return -1;
+ }
++
++ symbol_conf.has_filter = true;
+ return 0;
+ }
+
+diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
+index 0956150..be02179 100644
+--- a/tools/perf/util/symbol.h
++++ b/tools/perf/util/symbol.h
+@@ -105,7 +105,8 @@ struct symbol_conf {
+ demangle_kernel,
+ filter_relative,
+ show_hist_headers,
+- branch_callstack;
++ branch_callstack,
++ has_filter;
+ const char *vmlinux_name,
+ *kallsyms_name,
+ *source_prefix,
diff --git a/4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch b/4.1.5/4420_grsecurity-3.1-4.1.5-201508102129.patch
similarity index 99%
rename from 4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch
rename to 4.1.5/4420_grsecurity-3.1-4.1.5-201508102129.patch
index 95b7d51..c6671a0 100644
--- a/4.1.4/4420_grsecurity-3.1-4.1.4-201508032312.patch
+++ b/4.1.5/4420_grsecurity-3.1-4.1.5-201508102129.patch
@@ -235,7 +235,7 @@ index 9de9813..1462492 100644
+zconf.lex.c
zoffset.h
diff --git a/Documentation/kbuild/makefiles.txt b/Documentation/kbuild/makefiles.txt
-index 74b6c6d..eac0e77 100644
+index d2b1c40..3e90a74 100644
--- a/Documentation/kbuild/makefiles.txt
+++ b/Documentation/kbuild/makefiles.txt
@@ -23,10 +23,11 @@ This document describes the Linux kernel Makefiles.
@@ -406,7 +406,7 @@ index c831001..1bfbbf6 100644
A toggle value indicating if modules are allowed to be loaded
diff --git a/Makefile b/Makefile
-index 36f3225..414e93e 100644
+index 068dd69..e4ad6b7 100644
--- a/Makefile
+++ b/Makefile
@@ -299,7 +299,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -515,7 +515,7 @@ index 36f3225..414e93e 100644
endif
ifdef CONFIG_DEBUG_INFO_DWARF4
KBUILD_CFLAGS += $(call cc-option, -gdwarf-4,)
-@@ -883,7 +953,7 @@ export mod_sign_cmd
+@@ -884,7 +954,7 @@ export mod_sign_cmd
ifeq ($(KBUILD_EXTMOD),)
@@ -524,7 +524,7 @@ index 36f3225..414e93e 100644
vmlinux-dirs := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
$(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-@@ -933,6 +1003,8 @@ endif
+@@ -934,6 +1004,8 @@ endif
# The actual objects are generated when descending,
# make sure no implicit rule kicks in
@@ -533,7 +533,7 @@ index 36f3225..414e93e 100644
$(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
# Handle descending into subdirectories listed in $(vmlinux-dirs)
-@@ -942,7 +1014,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
+@@ -943,7 +1015,7 @@ $(sort $(vmlinux-deps)): $(vmlinux-dirs) ;
# Error messages still appears in the original language
PHONY += $(vmlinux-dirs)
@@ -542,7 +542,7 @@ index 36f3225..414e93e 100644
$(Q)$(MAKE) $(build)=$@
define filechk_kernel.release
-@@ -985,10 +1057,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
+@@ -986,10 +1058,13 @@ prepare1: prepare2 $(version_h) include/generated/utsrelease.h \
archprepare: archheaders archscripts prepare1 scripts_basic
@@ -556,7 +556,7 @@ index 36f3225..414e93e 100644
prepare: prepare0
# Generate some files
-@@ -1096,6 +1171,8 @@ all: modules
+@@ -1097,6 +1172,8 @@ all: modules
# using awk while concatenating to the final file.
PHONY += modules
@@ -565,7 +565,7 @@ index 36f3225..414e93e 100644
modules: $(vmlinux-dirs) $(if $(KBUILD_BUILTIN),vmlinux) modules.builtin
$(Q)$(AWK) '!x[$$0]++' $(vmlinux-dirs:%=$(objtree)/%/modules.order) > $(objtree)/modules.order
@$(kecho) ' Building modules, stage 2.';
-@@ -1111,7 +1188,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
+@@ -1112,7 +1189,7 @@ modules.builtin: $(vmlinux-dirs:%=%/modules.builtin)
# Target to prepare building external modules
PHONY += modules_prepare
@@ -574,7 +574,7 @@ index 36f3225..414e93e 100644
# Target to install modules
PHONY += modules_install
-@@ -1177,7 +1254,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
+@@ -1178,7 +1255,10 @@ MRPROPER_FILES += .config .config.old .version .old_version \
Module.symvers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS \
signing_key.priv signing_key.x509 x509.genkey \
extra_certificates signing_key.x509.keyid \
@@ -586,7 +586,7 @@ index 36f3225..414e93e 100644
# clean - Delete most, but leave enough to build external modules
#
-@@ -1216,7 +1296,7 @@ distclean: mrproper
+@@ -1217,7 +1297,7 @@ distclean: mrproper
@find $(srctree) $(RCS_FIND_IGNORE) \
\( -name '*.orig' -o -name '*.rej' -o -name '*~' \
-o -name '*.bak' -o -name '#*#' -o -name '.*.orig' \
@@ -595,7 +595,7 @@ index 36f3225..414e93e 100644
-type f -print | xargs rm -f
-@@ -1382,6 +1462,8 @@ PHONY += $(module-dirs) modules
+@@ -1383,6 +1463,8 @@ PHONY += $(module-dirs) modules
$(module-dirs): crmodverdir $(objtree)/Module.symvers
$(Q)$(MAKE) $(build)=$(patsubst _module_%,%,$@)
@@ -604,7 +604,7 @@ index 36f3225..414e93e 100644
modules: $(module-dirs)
@$(kecho) ' Building modules, stage 2.';
$(Q)$(MAKE) -f $(srctree)/scripts/Makefile.modpost
-@@ -1522,17 +1604,21 @@ else
+@@ -1523,17 +1605,21 @@ else
target-dir = $(if $(KBUILD_EXTMOD),$(dir $<),$(dir $@))
endif
@@ -630,7 +630,7 @@ index 36f3225..414e93e 100644
$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
%.symtypes: %.c prepare scripts FORCE
$(Q)$(MAKE) $(build)=$(build-dir) $(target-dir)$(notdir $@)
-@@ -1544,11 +1630,15 @@ endif
+@@ -1545,11 +1631,15 @@ endif
$(build)=$(build-dir)
# Make sure the latest headers are built for Documentation
Documentation/: headers_install
@@ -5845,10 +5845,10 @@ index 4efe96a..60e8699 100644
#define SMP_CACHE_BYTES L1_CACHE_BYTES
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
-index f501665..b107753 100644
+index a3b1ffe..7d61ca6 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
-@@ -2585,6 +2585,7 @@ source "kernel/Kconfig.preempt"
+@@ -2586,6 +2586,7 @@ source "kernel/Kconfig.preempt"
config KEXEC
bool "Kexec system call"
@@ -7355,7 +7355,7 @@ index 78c9fd3..42fa66a 100644
instruction set this CPU supports. This could be done in user space,
but it's not easy, and we've already done it here. */
diff --git a/arch/parisc/include/asm/pgalloc.h b/arch/parisc/include/asm/pgalloc.h
-index 3a08eae..08fef28 100644
+index 3edbb9f..08fef28 100644
--- a/arch/parisc/include/asm/pgalloc.h
+++ b/arch/parisc/include/asm/pgalloc.h
@@ -61,6 +61,11 @@ static inline void pgd_populate(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmd)
@@ -7370,24 +7370,7 @@ index 3a08eae..08fef28 100644
static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
{
pmd_t *pmd = (pmd_t *)__get_free_pages(GFP_KERNEL|__GFP_REPEAT,
-@@ -72,7 +77,7 @@ static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address)
-
- static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- {
-- if(pmd_flag(*pmd) & PxD_FLAG_ATTACHED)
-+ if (pmd_flag(*pmd) & PxD_FLAG_ATTACHED) {
- /*
- * This is the permanent pmd attached to the pgd;
- * cannot free it.
-@@ -81,6 +86,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
- */
- mm_inc_nr_pmds(mm);
- return;
-+ }
- free_pages((unsigned long)pmd, PMD_ORDER);
- }
-
-@@ -96,6 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
+@@ -97,6 +102,7 @@ static inline void pmd_free(struct mm_struct *mm, pmd_t *pmd)
#define pmd_alloc_one(mm, addr) ({ BUG(); ((pmd_t *)2); })
#define pmd_free(mm, x) do { } while (0)
#define pgd_populate(mm, pmd, pte) BUG()
@@ -7396,10 +7379,10 @@ index 3a08eae..08fef28 100644
#endif
diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
-index 0a18375..d613939 100644
+index f93c4a4..cfd5663 100644
--- a/arch/parisc/include/asm/pgtable.h
+++ b/arch/parisc/include/asm/pgtable.h
-@@ -213,6 +213,17 @@ extern void purge_tlb_entries(struct mm_struct *, unsigned long);
+@@ -231,6 +231,17 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
#define PAGE_EXECREAD __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
#define PAGE_COPY PAGE_EXECREAD
#define PAGE_RWX __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
@@ -7610,10 +7593,10 @@ index 5aba01a..47cdd5a 100644
mm->mmap_base = mm->mmap_legacy_base;
mm->get_unmapped_area = arch_get_unmapped_area;
diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 47ee620..1107387 100644
+index 7f67c4c..d85c11d 100644
--- a/arch/parisc/kernel/traps.c
+++ b/arch/parisc/kernel/traps.c
-@@ -726,9 +726,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+@@ -722,9 +722,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
down_read(¤t->mm->mmap_sem);
vma = find_vma(current->mm,regs->iaoq[0]);
@@ -9699,7 +9682,7 @@ index 0c1a679..e1df357 100644
if (r_type == R_390_GOTPC)
rc = apply_rela_bits(loc, val, 1, 32, 0);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
-index dc5edc2..7d34ae3 100644
+index 8f587d8..0642516b 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -200,27 +200,3 @@ unsigned long get_wchan(struct task_struct *p)
@@ -10567,6 +10550,40 @@ index a35194b..47dabc0d 100644
if (unlikely(ret))
ret = copy_to_user_fixup(to, from, size);
return ret;
+diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h
+index 1f0aa20..6424249 100644
+--- a/arch/sparc/include/asm/visasm.h
++++ b/arch/sparc/include/asm/visasm.h
+@@ -28,16 +28,10 @@
+ * Must preserve %o5 between VISEntryHalf and VISExitHalf */
+
+ #define VISEntryHalf \
+- rd %fprs, %o5; \
+- andcc %o5, FPRS_FEF, %g0; \
+- be,pt %icc, 297f; \
+- sethi %hi(298f), %g7; \
+- sethi %hi(VISenterhalf), %g1; \
+- jmpl %g1 + %lo(VISenterhalf), %g0; \
+- or %g7, %lo(298f), %g7; \
+- clr %o5; \
+-297: wr %o5, FPRS_FEF, %fprs; \
+-298:
++ VISEntry
++
++#define VISExitHalf \
++ VISExit
+
+ #define VISEntryHalfFast(fail_label) \
+ rd %fprs, %o5; \
+@@ -47,7 +41,7 @@
+ ba,a,pt %xcc, fail_label; \
+ 297: wr %o5, FPRS_FEF, %fprs;
+
+-#define VISExitHalf \
++#define VISExitHalfFast \
+ wr %o5, 0, %fprs;
+
+ #ifndef __ASSEMBLY__
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index 7cf9c6e..6206648 100644
--- a/arch/sparc/kernel/Makefile
@@ -11217,6 +11234,105 @@ index 3269b02..64f5231 100644
lib-$(CONFIG_SPARC32) += ashrdi3.o
lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S
+index 140527a..83aeeb1 100644
+--- a/arch/sparc/lib/NG4memcpy.S
++++ b/arch/sparc/lib/NG4memcpy.S
+@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
+ add %o0, 0x40, %o0
+ bne,pt %icc, 1b
+ LOAD(prefetch, %g1 + 0x200, #n_reads_strong)
++#ifdef NON_USER_COPY
++ VISExitHalfFast
++#else
+ VISExitHalf
+-
++#endif
+ brz,pn %o2, .Lexit
+ cmp %o2, 19
+ ble,pn %icc, .Lsmall_unaligned
+diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S
+index b320ae9..a063d84 100644
+--- a/arch/sparc/lib/VISsave.S
++++ b/arch/sparc/lib/VISsave.S
+@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+
+ stx %g3, [%g6 + TI_GSR]
+ 2: add %g6, %g1, %g3
+- cmp %o5, FPRS_DU
+- be,pn %icc, 6f
+- sll %g1, 3, %g1
++ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5
++ sll %g1, 3, %g1
+ stb %o5, [%g3 + TI_FPSAVED]
+ rd %gsr, %g2
+ add %g6, %g1, %g3
+@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3
+ .align 32
+ 80: jmpl %g7 + %g0, %g0
+ nop
+-
+-6: ldub [%g3 + TI_FPSAVED], %o5
+- or %o5, FPRS_DU, %o5
+- add %g6, TI_FPREGS+0x80, %g2
+- stb %o5, [%g3 + TI_FPSAVED]
+-
+- sll %g1, 5, %g1
+- add %g6, TI_FPREGS+0xc0, %g3
+- wr %g0, FPRS_FEF, %fprs
+- membar #Sync
+- stda %f32, [%g2 + %g1] ASI_BLK_P
+- stda %f48, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 80f
+- nop
+-
+- .align 32
+-80: jmpl %g7 + %g0, %g0
+- nop
+-
+- .align 32
+-VISenterhalf:
+- ldub [%g6 + TI_FPDEPTH], %g1
+- brnz,a,pn %g1, 1f
+- cmp %g1, 1
+- stb %g0, [%g6 + TI_FPSAVED]
+- stx %fsr, [%g6 + TI_XFSR]
+- clr %o5
+- jmpl %g7 + %g0, %g0
+- wr %g0, FPRS_FEF, %fprs
+-
+-1: bne,pn %icc, 2f
+- srl %g1, 1, %g1
+- ba,pt %xcc, vis1
+- sub %g7, 8, %g7
+-2: addcc %g6, %g1, %g3
+- sll %g1, 3, %g1
+- andn %o5, FPRS_DU, %g2
+- stb %g2, [%g3 + TI_FPSAVED]
+-
+- rd %gsr, %g2
+- add %g6, %g1, %g3
+- stx %g2, [%g3 + TI_GSR]
+- add %g6, %g1, %g2
+- stx %fsr, [%g2 + TI_XFSR]
+- sll %g1, 5, %g1
+-3: andcc %o5, FPRS_DL, %g0
+- be,pn %icc, 4f
+- add %g6, TI_FPREGS, %g2
+-
+- add %g6, TI_FPREGS+0x40, %g3
+- membar #Sync
+- stda %f0, [%g2 + %g1] ASI_BLK_P
+- stda %f16, [%g3 + %g1] ASI_BLK_P
+- membar #Sync
+- ba,pt %xcc, 4f
+- nop
+-
+- .align 32
+-4: and %o5, FPRS_DU, %o5
+- jmpl %g7 + %g0, %g0
+- wr %o5, FPRS_FEF, %fprs
diff --git a/arch/sparc/lib/atomic_64.S b/arch/sparc/lib/atomic_64.S
index 05dac43..76f8ed4 100644
--- a/arch/sparc/lib/atomic_64.S
@@ -11339,7 +11455,7 @@ index 05dac43..76f8ed4 100644
ENTRY(atomic64_dec_if_positive) /* %o0 = atomic_ptr */
BACKOFF_SETUP(%o2)
diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c
-index 1d649a9..fbc5bfc 100644
+index 1d649a9..c2e23c4 100644
--- a/arch/sparc/lib/ksyms.c
+++ b/arch/sparc/lib/ksyms.c
@@ -101,7 +101,9 @@ EXPORT_SYMBOL(__clear_user);
@@ -11362,6 +11478,17 @@ index 1d649a9..fbc5bfc 100644
ATOMIC_OPS(sub)
#undef ATOMIC_OPS
+@@ -135,10 +139,6 @@ EXPORT_SYMBOL(copy_user_page);
+ void VISenter(void);
+ EXPORT_SYMBOL(VISenter);
+
+-/* CRYPTO code needs this */
+-void VISenterhalf(void);
+-EXPORT_SYMBOL(VISenterhalf);
+-
+ extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *);
+ extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *,
+ unsigned long *);
diff --git a/arch/sparc/mm/Makefile b/arch/sparc/mm/Makefile
index 30c3ecc..736f015 100644
--- a/arch/sparc/mm/Makefile
@@ -12840,21 +12967,6 @@ index 0a291cd..9686efc 100644
KBUILD_AFLAGS := $(KBUILD_CFLAGS) -D__ASSEMBLY__
GCOV_PROFILE := n
-diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
-index 48304b8..0cdc154 100644
---- a/arch/x86/boot/compressed/eboot.c
-+++ b/arch/x86/boot/compressed/eboot.c
-@@ -1193,6 +1193,10 @@ static efi_status_t setup_e820(struct boot_params *params,
- unsigned int e820_type = 0;
- unsigned long m = efi->efi_memmap;
-
-+#ifdef CONFIG_X86_64
-+ m |= (u64)efi->efi_memmap_hi << 32;
-+#endif
-+
- d = (efi_memory_desc_t *)(m + (i * efi->efi_memdesc_size));
- switch (d->type) {
- case EFI_RESERVED_TYPE:
diff --git a/arch/x86/boot/compressed/efi_stub_32.S b/arch/x86/boot/compressed/efi_stub_32.S
index a53440e..c3dbf1e 100644
--- a/arch/x86/boot/compressed/efi_stub_32.S
@@ -16540,19 +16652,20 @@ index acdee09..a553db3 100644
struct compat_timespec {
compat_time_t tv_sec;
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
-index 3d6606f..91703f1 100644
+index 3d6606f..300641d 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
-@@ -214,7 +214,7 @@
+@@ -214,7 +214,8 @@
#define X86_FEATURE_PAUSEFILTER ( 8*32+13) /* AMD filtered pause intercept */
#define X86_FEATURE_PFTHRESHOLD ( 8*32+14) /* AMD pause filter threshold */
#define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer vmmcall to vmcall */
-
++#define X86_FEATURE_PCIDUDEREF ( 8*32+30) /* PaX PCID based UDEREF */
+#define X86_FEATURE_STRONGUDEREF (8*32+31) /* PaX PCID based strong UDEREF */
/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/
-@@ -222,7 +222,7 @@
+@@ -222,7 +223,7 @@
#define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */
#define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */
#define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */
@@ -16561,7 +16674,7 @@ index 3d6606f..91703f1 100644
#define X86_FEATURE_BMI2 ( 9*32+ 8) /* 2nd group bit manipulation extensions */
#define X86_FEATURE_ERMS ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB */
#define X86_FEATURE_INVPCID ( 9*32+10) /* Invalidate Processor Context ID */
-@@ -401,6 +401,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
+@@ -401,6 +402,7 @@ extern const char * const x86_bug_flags[NBUGINTS*32];
#define cpu_has_eager_fpu boot_cpu_has(X86_FEATURE_EAGER_FPU)
#define cpu_has_topoext boot_cpu_has(X86_FEATURE_TOPOEXT)
#define cpu_has_bpext boot_cpu_has(X86_FEATURE_BPEXT)
@@ -16569,17 +16682,17 @@ index 3d6606f..91703f1 100644
#if __GNUC__ >= 4
extern void warn_pre_alternatives(void);
-@@ -454,7 +455,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
+@@ -454,7 +456,8 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
#ifdef CONFIG_X86_DEBUG_STATIC_CPU_HAS
t_warn:
- warn_pre_alternatives();
-+ if (bit != X86_FEATURE_PCID && bit != X86_FEATURE_INVPCID)
++ if (bit != X86_FEATURE_PCID && bit != X86_FEATURE_INVPCID && bit != X86_FEATURE_PCIDUDEREF)
+ warn_pre_alternatives();
return false;
#endif
-@@ -475,7 +477,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
+@@ -475,7 +478,7 @@ static __always_inline __pure bool __static_cpu_has(u16 bit)
".section .discard,\"aw\",@progbits\n"
" .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
".previous\n"
@@ -16588,7 +16701,7 @@ index 3d6606f..91703f1 100644
"3: movb $1,%0\n"
"4:\n"
".previous\n"
-@@ -510,7 +512,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
+@@ -510,7 +513,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
" .byte 5f - 4f\n" /* repl len */
" .byte 3b - 2b\n" /* pad len */
".previous\n"
@@ -16597,7 +16710,7 @@ index 3d6606f..91703f1 100644
"4: jmp %l[t_no]\n"
"5:\n"
".previous\n"
-@@ -545,7 +547,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
+@@ -545,7 +548,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
".section .discard,\"aw\",@progbits\n"
" .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
".previous\n"
@@ -16606,7 +16719,7 @@ index 3d6606f..91703f1 100644
"3: movb $0,%0\n"
"4:\n"
".previous\n"
-@@ -560,7 +562,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
+@@ -560,7 +563,7 @@ static __always_inline __pure bool _static_cpu_has_safe(u16 bit)
".section .discard,\"aw\",@progbits\n"
" .byte 0xff + (6f-5f) - (4b-3b)\n" /* size check */
".previous\n"
@@ -17453,7 +17566,7 @@ index 09b9620..923aecd 100644
atomic_t perf_rdpmc_allowed; /* nonzero if rdpmc is allowed */
} mm_context_t;
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
-index 883f6b93..bb405b5 100644
+index e997f70..5d819f7 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -42,6 +42,20 @@ void destroy_context(struct mm_struct *mm);
@@ -17462,7 +17575,7 @@ index 883f6b93..bb405b5 100644
{
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (!(static_cpu_has(X86_FEATURE_PCID))) {
++ if (!(static_cpu_has(X86_FEATURE_PCIDUDEREF))) {
+ unsigned int i;
+ pgd_t *pgd;
+
@@ -17500,7 +17613,7 @@ index 883f6b93..bb405b5 100644
+ pax_open_kernel();
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (static_cpu_has(X86_FEATURE_PCID))
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF))
+ __clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
+ else
+#endif
@@ -17511,7 +17624,7 @@ index 883f6b93..bb405b5 100644
+ BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (static_cpu_has(X86_FEATURE_PCID)) {
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
+ if (static_cpu_has(X86_FEATURE_INVPCID)) {
+ u64 descriptor[2];
+ descriptor[0] = PCID_USER;
@@ -17568,7 +17681,7 @@ index 883f6b93..bb405b5 100644
+ pax_open_kernel();
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (static_cpu_has(X86_FEATURE_PCID))
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF))
+ __clone_user_pgds(get_cpu_pgd(cpu, user), next->pgd);
+ else
+#endif
@@ -17579,7 +17692,7 @@ index 883f6b93..bb405b5 100644
+ BUG_ON((__pa(get_cpu_pgd(cpu, kernel)) | PCID_KERNEL) != (read_cr3() & __PHYSICAL_MASK) && (__pa(get_cpu_pgd(cpu, user)) | PCID_USER) != (read_cr3() & __PHYSICAL_MASK));
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (static_cpu_has(X86_FEATURE_PCID)) {
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
+ if (static_cpu_has(X86_FEATURE_INVPCID)) {
+ u64 descriptor[2];
+ descriptor[0] = PCID_USER;
@@ -19416,10 +19529,10 @@ index b4bdec3..e8af9bc 100644
#endif
#endif /* _ASM_X86_THREAD_INFO_H */
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
-index cd79194..e7a9491 100644
+index cd79194..c72ad3f 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
-@@ -86,18 +86,44 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
+@@ -86,18 +86,45 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask)
static inline void __native_flush_tlb(void)
{
@@ -19432,7 +19545,7 @@ index cd79194..e7a9491 100644
+ }
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (static_cpu_has(X86_FEATURE_PCID)) {
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
+ unsigned int cpu = raw_get_cpu();
+
+ native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER);
@@ -19442,6 +19555,7 @@ index cd79194..e7a9491 100644
+ }
+#endif
+
++
native_write_cr3(native_read_cr3());
}
@@ -19470,7 +19584,7 @@ index cd79194..e7a9491 100644
}
static inline void __native_flush_tlb_global(void)
-@@ -118,6 +144,41 @@ static inline void __native_flush_tlb_global(void)
+@@ -118,6 +145,43 @@ static inline void __native_flush_tlb_global(void)
static inline void __native_flush_tlb_single(unsigned long addr)
{
@@ -19481,14 +19595,16 @@ index cd79194..e7a9491 100644
+ descriptor[1] = addr;
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
-+ if (addr < TASK_SIZE_MAX)
-+ descriptor[1] += pax_user_shadow_base;
-+ asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
-+ }
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
++ if (!static_cpu_has(X86_FEATURE_STRONGUDEREF) || addr >= TASK_SIZE_MAX) {
++ if (addr < TASK_SIZE_MAX)
++ descriptor[1] += pax_user_shadow_base;
++ asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
++ }
+
-+ descriptor[0] = PCID_USER;
-+ descriptor[1] = addr;
++ descriptor[0] = PCID_USER;
++ descriptor[1] = addr;
++ }
+#endif
+
+ asm volatile(__ASM_INVPCID : : "d"(&descriptor), "a"(INVPCID_SINGLE_ADDRESS) : "memory");
@@ -19496,7 +19612,7 @@ index cd79194..e7a9491 100644
+ }
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+ if (static_cpu_has(X86_FEATURE_PCID)) {
++ if (static_cpu_has(X86_FEATURE_PCIDUDEREF)) {
+ unsigned int cpu = raw_get_cpu();
+
+ native_write_cr3(__pa(get_cpu_pgd(cpu, user)) | PCID_USER | PCID_NOFLUSH);
@@ -21143,7 +21259,7 @@ index e4cf633..941f450 100644
if (c->x86_model == 3 && c->x86_mask == 0)
size = 64;
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
-index a62cf04..041e39c 100644
+index a62cf04..a55415c 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -91,60 +91,6 @@ static const struct cpu_dev default_cpu = {
@@ -21207,10 +21323,57 @@ index a62cf04..041e39c 100644
static int __init x86_xsave_setup(char *s)
{
if (strlen(s))
-@@ -306,6 +252,59 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
+@@ -306,6 +252,109 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c)
}
}
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++#ifdef CONFIG_X86_64
++static bool uderef_enabled __read_only = true;
++unsigned long pax_user_shadow_base __read_only;
++EXPORT_SYMBOL(pax_user_shadow_base);
++extern char pax_enter_kernel_user[];
++extern char pax_exit_kernel_user[];
++
++static int __init setup_pax_weakuderef(char *str)
++{
++ if (uderef_enabled)
++ pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
++ return 1;
++}
++__setup("pax_weakuderef", setup_pax_weakuderef);
++#endif
++
++static int __init setup_pax_nouderef(char *str)
++{
++#ifdef CONFIG_X86_32
++ unsigned int cpu;
++ struct desc_struct *gdt;
++
++ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
++ gdt = get_cpu_gdt_table(cpu);
++ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
++ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
++ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
++ }
++ loadsegment(ds, __KERNEL_DS);
++ loadsegment(es, __KERNEL_DS);
++ loadsegment(ss, __KERNEL_DS);
++#else
++ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
++ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
++ clone_pgd_mask = ~(pgdval_t)0UL;
++ pax_user_shadow_base = 0UL;
++ setup_clear_cpu_cap(X86_FEATURE_PCIDUDEREF);
++ uderef_enabled = false;
++#endif
++
++ return 0;
++}
++early_param("pax_nouderef", setup_pax_nouderef);
++#endif
++
+#ifdef CONFIG_X86_64
+static __init int setup_disable_pcid(char *arg)
+{
@@ -21218,7 +21381,7 @@ index a62cf04..041e39c 100644
+ setup_clear_cpu_cap(X86_FEATURE_INVPCID);
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (clone_pgd_mask != ~(pgdval_t)0UL)
++ if (uderef_enabled)
+ pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
+#endif
+
@@ -21228,26 +21391,31 @@ index a62cf04..041e39c 100644
+
+static void setup_pcid(struct cpuinfo_x86 *c)
+{
-+ if (!cpu_has(c, X86_FEATURE_PCID)) {
++ if (cpu_has(c, X86_FEATURE_PCID)) {
++ printk("PAX: PCID detected\n");
++ cr4_set_bits(X86_CR4_PCIDE);
++ } else
+ clear_cpu_cap(c, X86_FEATURE_INVPCID);
+
++ if (cpu_has(c, X86_FEATURE_INVPCID))
++ printk("PAX: INVPCID detected\n");
++
+#ifdef CONFIG_PAX_MEMORY_UDEREF
-+ if (clone_pgd_mask != ~(pgdval_t)0UL) {
-+ pax_open_kernel();
-+ pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
-+ pax_close_kernel();
-+ printk("PAX: slow and weak UDEREF enabled\n");
-+ } else
-+ printk("PAX: UDEREF disabled\n");
-+#endif
++ if (!uderef_enabled) {
++ printk("PAX: UDEREF disabled\n");
++ return;
++ }
+
++ if (!cpu_has(c, X86_FEATURE_PCID)) {
++ pax_open_kernel();
++ pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
++ pax_close_kernel();
++ printk("PAX: slow and weak UDEREF enabled\n");
+ return;
+ }
+
-+ printk("PAX: PCID detected\n");
-+ cr4_set_bits(X86_CR4_PCIDE);
++ set_cpu_cap(c, X86_FEATURE_PCIDUDEREF);
+
-+#ifdef CONFIG_PAX_MEMORY_UDEREF
+ pax_open_kernel();
+ clone_pgd_mask = ~(pgdval_t)0UL;
+ pax_close_kernel();
@@ -21259,15 +21427,13 @@ index a62cf04..041e39c 100644
+ }
+#endif
+
-+ if (cpu_has(c, X86_FEATURE_INVPCID))
-+ printk("PAX: INVPCID detected\n");
+}
+#endif
+
/*
* Some CPU features depend on higher CPUID levels, which may not always
* be available due to CPUID level capping or broken virtualization
-@@ -406,7 +405,7 @@ void switch_to_new_gdt(int cpu)
+@@ -406,7 +455,7 @@ void switch_to_new_gdt(int cpu)
{
struct desc_ptr gdt_descr;
@@ -21276,7 +21442,7 @@ index a62cf04..041e39c 100644
gdt_descr.size = GDT_SIZE - 1;
load_gdt(&gdt_descr);
/* Reload the per-cpu base */
-@@ -935,6 +934,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
+@@ -935,6 +984,20 @@ static void identify_cpu(struct cpuinfo_x86 *c)
setup_smep(c);
setup_smap(c);
@@ -21297,7 +21463,7 @@ index a62cf04..041e39c 100644
/*
* The vendor-specific functions might have changed features.
* Now we do "generic changes."
-@@ -1009,7 +1022,7 @@ void enable_sep_cpu(void)
+@@ -1009,7 +1072,7 @@ void enable_sep_cpu(void)
int cpu;
cpu = get_cpu();
@@ -21306,7 +21472,7 @@ index a62cf04..041e39c 100644
if (!boot_cpu_has(X86_FEATURE_SEP))
goto out;
-@@ -1155,14 +1168,16 @@ static __init int setup_disablecpuid(char *arg)
+@@ -1155,14 +1218,16 @@ static __init int setup_disablecpuid(char *arg)
}
__setup("clearcpuid=", setup_disablecpuid);
@@ -21327,7 +21493,7 @@ index a62cf04..041e39c 100644
DEFINE_PER_CPU_FIRST(union irq_stack_union,
irq_stack_union) __aligned(PAGE_SIZE) __visible;
-@@ -1367,7 +1382,7 @@ void cpu_init(void)
+@@ -1367,7 +1432,7 @@ void cpu_init(void)
*/
load_ucode_ap();
@@ -21336,7 +21502,7 @@ index a62cf04..041e39c 100644
oist = &per_cpu(orig_ist, cpu);
#ifdef CONFIG_NUMA
-@@ -1399,7 +1414,6 @@ void cpu_init(void)
+@@ -1399,7 +1464,6 @@ void cpu_init(void)
wrmsrl(MSR_KERNEL_GS_BASE, 0);
barrier();
@@ -21344,7 +21510,7 @@ index a62cf04..041e39c 100644
x2apic_setup();
/*
-@@ -1451,7 +1465,7 @@ void cpu_init(void)
+@@ -1451,7 +1515,7 @@ void cpu_init(void)
{
int cpu = smp_processor_id();
struct task_struct *curr = current;
@@ -21754,25 +21920,10 @@ index 7795f3f..3535b76 100644
__bts_event_stop(event);
diff --git a/arch/x86/kernel/cpu/perf_event_intel_cqm.c b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
-index e4d1b8b..8867302 100644
+index cb77b11..8867302 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_cqm.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_cqm.c
-@@ -934,6 +934,14 @@ static u64 intel_cqm_event_count(struct perf_event *event)
- return 0;
-
- /*
-+ * Getting up-to-date values requires an SMP IPI which is not
-+ * possible if we're being called in interrupt context. Return
-+ * the cached values instead.
-+ */
-+ if (unlikely(in_interrupt()))
-+ goto out;
-+
-+ /*
- * Notice that we don't perform the reading of an RMID
- * atomically, because we can't hold a spin lock across the
- * IPIs.
-@@ -1352,7 +1360,9 @@ static int __init intel_cqm_init(void)
+@@ -1360,7 +1360,9 @@ static int __init intel_cqm_init(void)
goto out;
}
@@ -23102,7 +23253,7 @@ index 1c30976..71b41b9 100644
#endif
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
-index 02c2eff..a13739f 100644
+index 02c2eff..9c9ea72 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -46,6 +46,8 @@
@@ -23114,7 +23265,7 @@ index 02c2eff..a13739f 100644
/* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this. */
#include <linux/elf-em.h>
-@@ -64,6 +66,401 @@ ENTRY(native_usergs_sysret64)
+@@ -64,6 +66,402 @@ ENTRY(native_usergs_sysret64)
ENDPROC(native_usergs_sysret64)
#endif /* CONFIG_PARAVIRT */
@@ -23444,6 +23595,7 @@ index 02c2eff..a13739f 100644
+#endif
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
++ ALTERNATIVE "jmp 111f", "", X86_FEATURE_PCID
+ btr $2,%ebx
+ jnc 111f
+ GET_CR3_INTO_RDI
@@ -23516,7 +23668,7 @@ index 02c2eff..a13739f 100644
.macro TRACE_IRQS_IRETQ
#ifdef CONFIG_TRACE_IRQFLAGS
-@@ -100,7 +497,7 @@ ENDPROC(native_usergs_sysret64)
+@@ -100,7 +498,7 @@ ENDPROC(native_usergs_sysret64)
.endm
.macro TRACE_IRQS_IRETQ_DEBUG
@@ -23525,7 +23677,7 @@ index 02c2eff..a13739f 100644
jnc 1f
TRACE_IRQS_ON_DEBUG
1:
-@@ -221,14 +618,6 @@ GLOBAL(system_call_after_swapgs)
+@@ -221,14 +619,6 @@ GLOBAL(system_call_after_swapgs)
/* Construct struct pt_regs on stack */
pushq_cfi $__USER_DS /* pt_regs->ss */
pushq_cfi PER_CPU_VAR(rsp_scratch) /* pt_regs->sp */
@@ -23540,7 +23692,7 @@ index 02c2eff..a13739f 100644
pushq_cfi %r11 /* pt_regs->flags */
pushq_cfi $__USER_CS /* pt_regs->cs */
pushq_cfi %rcx /* pt_regs->ip */
-@@ -246,7 +635,27 @@ GLOBAL(system_call_after_swapgs)
+@@ -246,7 +636,27 @@ GLOBAL(system_call_after_swapgs)
sub $(6*8),%rsp /* pt_regs->bp,bx,r12-15 not saved */
CFI_ADJUST_CFA_OFFSET 6*8
@@ -23569,7 +23721,7 @@ index 02c2eff..a13739f 100644
jnz tracesys
system_call_fastpath:
#if __SYSCALL_MASK == ~0
-@@ -279,10 +688,13 @@ system_call_fastpath:
+@@ -279,10 +689,13 @@ system_call_fastpath:
* flags (TIF_NOTIFY_RESUME, TIF_USER_RETURN_NOTIFY, etc) set is
* very bad.
*/
@@ -23584,7 +23736,7 @@ index 02c2eff..a13739f 100644
RESTORE_C_REGS_EXCEPT_RCX_R11
movq RIP(%rsp),%rcx
-@@ -316,6 +728,9 @@ tracesys:
+@@ -316,6 +729,9 @@ tracesys:
call syscall_trace_enter_phase1
test %rax, %rax
jnz tracesys_phase2 /* if needed, run the slow path */
@@ -23594,7 +23746,7 @@ index 02c2eff..a13739f 100644
RESTORE_C_REGS_EXCEPT_RAX /* else restore clobbered regs */
movq ORIG_RAX(%rsp), %rax
jmp system_call_fastpath /* and return to the fast path */
-@@ -327,6 +742,8 @@ tracesys_phase2:
+@@ -327,6 +743,8 @@ tracesys_phase2:
movq %rax,%rdx
call syscall_trace_enter_phase2
@@ -23603,7 +23755,7 @@ index 02c2eff..a13739f 100644
/*
* Reload registers from stack in case ptrace changed them.
* We don't reload %rax because syscall_trace_entry_phase2() returned
-@@ -364,6 +781,8 @@ GLOBAL(int_with_check)
+@@ -364,6 +782,8 @@ GLOBAL(int_with_check)
andl %edi,%edx
jnz int_careful
andl $~TS_COMPAT,TI_status(%rcx)
@@ -23612,7 +23764,7 @@ index 02c2eff..a13739f 100644
jmp syscall_return
/* Either reschedule or signal or syscall exit tracking needed. */
-@@ -485,7 +904,7 @@ opportunistic_sysret_failed:
+@@ -485,7 +905,7 @@ opportunistic_sysret_failed:
SWAPGS
jmp restore_c_regs_and_iret
CFI_ENDPROC
@@ -23621,7 +23773,7 @@ index 02c2eff..a13739f 100644
.macro FORK_LIKE func
-@@ -495,7 +914,7 @@ ENTRY(stub_\func)
+@@ -495,7 +915,7 @@ ENTRY(stub_\func)
SAVE_EXTRA_REGS 8
jmp sys_\func
CFI_ENDPROC
@@ -23630,7 +23782,7 @@ index 02c2eff..a13739f 100644
.endm
FORK_LIKE clone
-@@ -519,7 +938,7 @@ return_from_execve:
+@@ -519,7 +939,7 @@ return_from_execve:
movq %rax,RAX(%rsp)
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -23639,7 +23791,7 @@ index 02c2eff..a13739f 100644
/*
* Remaining execve stubs are only 7 bytes long.
* ENTRY() often aligns to 16 bytes, which in this case has no benefits.
-@@ -531,7 +950,7 @@ GLOBAL(stub_execveat)
+@@ -531,7 +951,7 @@ GLOBAL(stub_execveat)
call sys_execveat
jmp return_from_execve
CFI_ENDPROC
@@ -23648,7 +23800,7 @@ index 02c2eff..a13739f 100644
#ifdef CONFIG_X86_X32_ABI
.align 8
-@@ -541,7 +960,7 @@ GLOBAL(stub_x32_execve)
+@@ -541,7 +961,7 @@ GLOBAL(stub_x32_execve)
call compat_sys_execve
jmp return_from_execve
CFI_ENDPROC
@@ -23657,7 +23809,7 @@ index 02c2eff..a13739f 100644
.align 8
GLOBAL(stub_x32_execveat)
CFI_STARTPROC
-@@ -549,7 +968,7 @@ GLOBAL(stub_x32_execveat)
+@@ -549,7 +969,7 @@ GLOBAL(stub_x32_execveat)
call compat_sys_execveat
jmp return_from_execve
CFI_ENDPROC
@@ -23666,7 +23818,7 @@ index 02c2eff..a13739f 100644
#endif
#ifdef CONFIG_IA32_EMULATION
-@@ -592,7 +1011,7 @@ return_from_stub:
+@@ -592,7 +1012,7 @@ return_from_stub:
movq %rax,RAX(%rsp)
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -23675,7 +23827,7 @@ index 02c2eff..a13739f 100644
#ifdef CONFIG_X86_X32_ABI
ENTRY(stub_x32_rt_sigreturn)
-@@ -602,7 +1021,7 @@ ENTRY(stub_x32_rt_sigreturn)
+@@ -602,7 +1022,7 @@ ENTRY(stub_x32_rt_sigreturn)
call sys32_x32_rt_sigreturn
jmp return_from_stub
CFI_ENDPROC
@@ -23684,7 +23836,7 @@ index 02c2eff..a13739f 100644
#endif
/*
-@@ -622,7 +1041,7 @@ ENTRY(ret_from_fork)
+@@ -622,7 +1042,7 @@ ENTRY(ret_from_fork)
RESTORE_EXTRA_REGS
@@ -23693,7 +23845,7 @@ index 02c2eff..a13739f 100644
/*
* By the time we get here, we have no idea whether our pt_regs,
-@@ -641,7 +1060,7 @@ ENTRY(ret_from_fork)
+@@ -641,7 +1061,7 @@ ENTRY(ret_from_fork)
RESTORE_EXTRA_REGS
jmp int_ret_from_sys_call
CFI_ENDPROC
@@ -23702,7 +23854,7 @@ index 02c2eff..a13739f 100644
/*
* Build the entry stubs with some assembler magic.
-@@ -659,7 +1078,7 @@ ENTRY(irq_entries_start)
+@@ -659,7 +1079,7 @@ ENTRY(irq_entries_start)
.align 8
.endr
CFI_ENDPROC
@@ -23711,7 +23863,7 @@ index 02c2eff..a13739f 100644
/*
* Interrupt entry/exit.
-@@ -672,21 +1091,13 @@ END(irq_entries_start)
+@@ -672,21 +1092,13 @@ END(irq_entries_start)
/* 0(%rsp): ~(interrupt number) */
.macro interrupt func
cld
@@ -23738,7 +23890,7 @@ index 02c2eff..a13739f 100644
je 1f
SWAPGS
1:
-@@ -709,8 +1120,20 @@ END(irq_entries_start)
+@@ -709,8 +1121,20 @@ END(irq_entries_start)
CFI_ESCAPE 0x0f /* DW_CFA_def_cfa_expression */, 6, \
0x77 /* DW_OP_breg7 (rsp) */, 0, \
0x06 /* DW_OP_deref */, \
@@ -23760,7 +23912,7 @@ index 02c2eff..a13739f 100644
/* We entered an interrupt context - irqs are off: */
TRACE_IRQS_OFF
-@@ -735,13 +1158,12 @@ ret_from_intr:
+@@ -735,13 +1159,12 @@ ret_from_intr:
/* Restore saved previous stack */
popq %rsi
@@ -23778,7 +23930,7 @@ index 02c2eff..a13739f 100644
je retint_kernel
/* Interrupt came from user space */
-@@ -763,6 +1185,8 @@ retint_swapgs: /* return to user-space */
+@@ -763,6 +1186,8 @@ retint_swapgs: /* return to user-space */
* The iretq could re-enable interrupts:
*/
DISABLE_INTERRUPTS(CLBR_ANY)
@@ -23787,7 +23939,7 @@ index 02c2eff..a13739f 100644
TRACE_IRQS_IRETQ
SWAPGS
-@@ -781,6 +1205,21 @@ retint_kernel:
+@@ -781,6 +1206,21 @@ retint_kernel:
jmp 0b
1:
#endif
@@ -23809,7 +23961,7 @@ index 02c2eff..a13739f 100644
/*
* The iretq could re-enable interrupts:
*/
-@@ -793,8 +1232,6 @@ retint_kernel:
+@@ -793,8 +1233,6 @@ retint_kernel:
restore_c_regs_and_iret:
RESTORE_C_REGS
REMOVE_PT_GPREGS_FROM_STACK 8
@@ -23818,7 +23970,7 @@ index 02c2eff..a13739f 100644
INTERRUPT_RETURN
ENTRY(native_iret)
-@@ -824,15 +1261,15 @@ native_irq_return_ldt:
+@@ -824,15 +1262,15 @@ native_irq_return_ldt:
SWAPGS
movq PER_CPU_VAR(espfix_waddr),%rdi
movq %rax,(0*8)(%rdi) /* RAX */
@@ -23839,7 +23991,7 @@ index 02c2eff..a13739f 100644
movq %rax,(4*8)(%rdi)
andl $0xffff0000,%eax
popq_cfi %rdi
-@@ -875,7 +1312,7 @@ retint_signal:
+@@ -875,7 +1313,7 @@ retint_signal:
jmp retint_with_reschedule
CFI_ENDPROC
@@ -23848,7 +24000,7 @@ index 02c2eff..a13739f 100644
/*
* APIC interrupts.
-@@ -889,7 +1326,7 @@ ENTRY(\sym)
+@@ -889,7 +1327,7 @@ ENTRY(\sym)
interrupt \do_sym
jmp ret_from_intr
CFI_ENDPROC
@@ -23857,7 +24009,7 @@ index 02c2eff..a13739f 100644
.endm
#ifdef CONFIG_TRACING
-@@ -962,7 +1399,7 @@ apicinterrupt IRQ_WORK_VECTOR \
+@@ -962,7 +1400,7 @@ apicinterrupt IRQ_WORK_VECTOR \
/*
* Exception entry points.
*/
@@ -23866,7 +24018,7 @@ index 02c2eff..a13739f 100644
.macro idtentry sym do_sym has_error_code:req paranoid=0 shift_ist=-1
ENTRY(\sym)
-@@ -1018,6 +1455,12 @@ ENTRY(\sym)
+@@ -1018,6 +1456,12 @@ ENTRY(\sym)
.endif
.if \shift_ist != -1
@@ -23879,7 +24031,7 @@ index 02c2eff..a13739f 100644
subq $EXCEPTION_STKSZ, CPU_TSS_IST(\shift_ist)
.endif
-@@ -1065,7 +1508,7 @@ ENTRY(\sym)
+@@ -1065,7 +1509,7 @@ ENTRY(\sym)
.endif
CFI_ENDPROC
@@ -23888,7 +24040,7 @@ index 02c2eff..a13739f 100644
.endm
#ifdef CONFIG_TRACING
-@@ -1106,9 +1549,10 @@ gs_change:
+@@ -1106,9 +1550,10 @@ gs_change:
2: mfence /* workaround */
SWAPGS
popfq_cfi
@@ -23900,7 +24052,7 @@ index 02c2eff..a13739f 100644
_ASM_EXTABLE(gs_change,bad_gs)
.section .fixup,"ax"
-@@ -1136,9 +1580,10 @@ ENTRY(do_softirq_own_stack)
+@@ -1136,9 +1581,10 @@ ENTRY(do_softirq_own_stack)
CFI_DEF_CFA_REGISTER rsp
CFI_ADJUST_CFA_OFFSET -8
decl PER_CPU_VAR(irq_count)
@@ -23912,7 +24064,7 @@ index 02c2eff..a13739f 100644
#ifdef CONFIG_XEN
idtentry xen_hypervisor_callback xen_do_hypervisor_callback has_error_code=0
-@@ -1179,7 +1624,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
+@@ -1179,7 +1625,7 @@ ENTRY(xen_do_hypervisor_callback) # do_hypervisor_callback(struct *pt_regs)
#endif
jmp error_exit
CFI_ENDPROC
@@ -23921,7 +24073,7 @@ index 02c2eff..a13739f 100644
/*
* Hypervisor uses this for application faults while it executes.
-@@ -1240,7 +1685,7 @@ ENTRY(xen_failsafe_callback)
+@@ -1240,7 +1686,7 @@ ENTRY(xen_failsafe_callback)
SAVE_EXTRA_REGS
jmp error_exit
CFI_ENDPROC
@@ -23930,7 +24082,7 @@ index 02c2eff..a13739f 100644
apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \
xen_hvm_callback_vector xen_evtchn_do_upcall
-@@ -1286,9 +1731,39 @@ ENTRY(paranoid_entry)
+@@ -1286,9 +1732,39 @@ ENTRY(paranoid_entry)
js 1f /* negative -> in kernel */
SWAPGS
xorl %ebx,%ebx
@@ -23972,7 +24124,7 @@ index 02c2eff..a13739f 100644
/*
* "Paranoid" exit path from exception stack. This is invoked
-@@ -1305,20 +1780,27 @@ ENTRY(paranoid_exit)
+@@ -1305,20 +1781,27 @@ ENTRY(paranoid_exit)
DEFAULT_FRAME
DISABLE_INTERRUPTS(CLBR_NONE)
TRACE_IRQS_OFF_DEBUG
@@ -24002,7 +24154,7 @@ index 02c2eff..a13739f 100644
/*
* Save all registers in pt_regs, and switch gs if needed.
-@@ -1330,12 +1812,23 @@ ENTRY(error_entry)
+@@ -1330,12 +1813,23 @@ ENTRY(error_entry)
SAVE_C_REGS 8
SAVE_EXTRA_REGS 8
xorl %ebx,%ebx
@@ -24027,7 +24179,7 @@ index 02c2eff..a13739f 100644
ret
/*
-@@ -1370,7 +1863,7 @@ error_bad_iret:
+@@ -1370,7 +1864,7 @@ error_bad_iret:
decl %ebx /* Return to usergs */
jmp error_sti
CFI_ENDPROC
@@ -24036,7 +24188,7 @@ index 02c2eff..a13739f 100644
/* On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it) */
-@@ -1381,7 +1874,7 @@ ENTRY(error_exit)
+@@ -1381,7 +1875,7 @@ ENTRY(error_exit)
DISABLE_INTERRUPTS(CLBR_NONE)
TRACE_IRQS_OFF
GET_THREAD_INFO(%rcx)
@@ -24045,7 +24197,7 @@ index 02c2eff..a13739f 100644
jne retint_kernel
LOCKDEP_SYS_EXIT_IRQ
movl TI_flags(%rcx),%edx
-@@ -1390,7 +1883,7 @@ ENTRY(error_exit)
+@@ -1390,7 +1884,7 @@ ENTRY(error_exit)
jnz retint_careful
jmp retint_swapgs
CFI_ENDPROC
@@ -24054,7 +24206,7 @@ index 02c2eff..a13739f 100644
/* Runs on exception stack */
ENTRY(nmi)
-@@ -1413,11 +1906,12 @@ ENTRY(nmi)
+@@ -1413,11 +1907,12 @@ ENTRY(nmi)
* If the variable is not set and the stack is not the NMI
* stack then:
* o Set the special variable on the stack
@@ -24070,7 +24222,7 @@ index 02c2eff..a13739f 100644
* o return back to the first NMI
*
* Now on exit of the first NMI, we first clear the stack variable
-@@ -1426,32 +1920,185 @@ ENTRY(nmi)
+@@ -1426,32 +1921,185 @@ ENTRY(nmi)
* a nested NMI that updated the copy interrupt stack frame, a
* jump will be made to the repeat_nmi code that will handle the second
* NMI.
@@ -24267,7 +24419,7 @@ index 02c2eff..a13739f 100644
*/
lea 6*8(%rsp), %rdx
/* Compare the NMI stack (rdx) with the stack we came from (4*8(%rsp)) */
-@@ -1462,27 +2109,22 @@ ENTRY(nmi)
+@@ -1462,27 +2110,22 @@ ENTRY(nmi)
cmpq %rdx, 4*8(%rsp)
/* If it is below the NMI stack, it is a normal NMI */
jb first_nmi
@@ -24305,7 +24457,7 @@ index 02c2eff..a13739f 100644
CFI_ADJUST_CFA_OFFSET 1*8
leaq -10*8(%rsp), %rdx
pushq_cfi $__KERNEL_DS
-@@ -1499,60 +2141,24 @@ nested_nmi_out:
+@@ -1499,60 +2142,24 @@ nested_nmi_out:
popq_cfi %rdx
CFI_RESTORE rdx
@@ -24371,7 +24523,7 @@ index 02c2eff..a13739f 100644
.rept 5
pushq_cfi 11*8(%rsp)
.endr
-@@ -1560,6 +2166,7 @@ first_nmi:
+@@ -1560,6 +2167,7 @@ first_nmi:
/* Everything up to here is safe from nested NMIs */
@@ -24379,7 +24531,7 @@ index 02c2eff..a13739f 100644
/*
* If there was a nested NMI, the first NMI's iret will return
* here. But NMIs are still enabled and we can take another
-@@ -1568,16 +2175,21 @@ first_nmi:
+@@ -1568,16 +2176,21 @@ first_nmi:
* it will just return, as we are about to repeat an NMI anyway.
* This makes it safe to copy to the stack frame that a nested
* NMI will update.
@@ -24408,7 +24560,7 @@ index 02c2eff..a13739f 100644
addq $(10*8), %rsp
CFI_ADJUST_CFA_OFFSET -10*8
.rept 5
-@@ -1588,66 +2200,65 @@ repeat_nmi:
+@@ -1588,66 +2201,66 @@ repeat_nmi:
end_repeat_nmi:
/*
@@ -24458,12 +24610,13 @@ index 02c2eff..a13739f 100644
-1:
-
- testl %ebx,%ebx /* swapgs needed? */
++ pax_exit_kernel_nmi
++
+ testl $1,%ebx /* swapgs needed? */
jnz nmi_restore
nmi_swapgs:
SWAPGS_UNSAFE_STACK
nmi_restore:
-+ pax_exit_kernel_nmi
RESTORE_EXTRA_REGS
RESTORE_C_REGS
- /* Pop the extra iret frame at once */
@@ -24637,7 +24790,7 @@ index 8b7b0a5..02219db 100644
/* ALLOC_TRAMP flags lets us know we created it */
ops->flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
-index 5a46681..1ef7ffa 100644
+index f129a9a..af8f6da 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -68,12 +68,12 @@ again:
@@ -24681,14 +24834,15 @@ index 5a46681..1ef7ffa 100644
}
pmd = (physaddr & PMD_MASK) + early_pmd_flags;
pmd_p[pmd_index(address)] = pmd;
-@@ -177,7 +177,6 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
- */
- load_ucode_bsp();
+@@ -163,8 +163,6 @@ asmlinkage __visible void __init x86_64_start_kernel(char * real_mode_data)
+
+ clear_bss();
- clear_page(init_level4_pgt);
- /* set init_level4_pgt kernel high mapping*/
- init_level4_pgt[511] = early_level4_pgt[511];
+-
+ kasan_early_init();
+ for (i = 0; i < NUM_EXCEPTION_VECTORS; i++)
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index 7e429c9..7244a52 100644
--- a/arch/x86/kernel/head_32.S
@@ -25113,7 +25267,7 @@ index 7e429c9..7244a52 100644
+ .fill PAGE_SIZE_asm - GDT_SIZE,1,0
+ .endr
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
-index df7e780..e97a497 100644
+index 7e5da2c..761adf1 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -20,6 +20,8 @@
@@ -25311,7 +25465,7 @@ index df7e780..e97a497 100644
NEXT_PAGE(level2_kernel_pgt)
/*
* 512 MB kernel mapping. We spend a full page on this pagetable
-@@ -494,23 +557,61 @@ NEXT_PAGE(level2_kernel_pgt)
+@@ -494,31 +557,69 @@ NEXT_PAGE(level2_kernel_pgt)
KERNEL_IMAGE_SIZE/PMD_SIZE)
NEXT_PAGE(level2_fixmap_pgt)
@@ -25379,8 +25533,7 @@ index df7e780..e97a497 100644
ENTRY(phys_base)
/* This must match the first entry in level2_kernel_pgt */
-@@ -534,8 +635,8 @@ NEXT_PAGE(kasan_zero_pud)
-
+ .quad 0x0000000000000000
#include "../../x86/xen/xen-head.S"
-
@@ -34475,7 +34628,7 @@ index 90555bf..f5f1828 100644
}
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
-index 3250f23..4197ac2 100644
+index 90b924a..4197ac2 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -45,7 +45,11 @@ void leave_mm(int cpu)
@@ -34490,15 +34643,6 @@ index 3250f23..4197ac2 100644
/*
* This gets called in the idle path where RCU
* functions differently. Tracing normally
-@@ -117,7 +121,7 @@ static void flush_tlb_func(void *info)
- } else {
- unsigned long addr;
- unsigned long nr_pages =
-- f->flush_end - f->flush_start / PAGE_SIZE;
-+ (f->flush_end - f->flush_start) / PAGE_SIZE;
- addr = f->flush_start;
- while (addr < f->flush_end) {
- __flush_tlb_single(addr);
diff --git a/arch/x86/mm/uderef_64.c b/arch/x86/mm/uderef_64.c
new file mode 100644
index 0000000..3fda3f3
@@ -35155,22 +35299,6 @@ index 9b83b90..4112152 100644
return !(ret & 0xff00);
}
EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
-index 02744df..841ea05 100644
---- a/arch/x86/platform/efi/efi.c
-+++ b/arch/x86/platform/efi/efi.c
-@@ -946,6 +946,11 @@ u64 efi_mem_attributes(unsigned long phys_addr)
-
- static int __init arch_parse_efi_cmdline(char *str)
- {
-+ if (!str) {
-+ pr_warn("need at least one option\n");
-+ return -EINVAL;
-+ }
-+
- if (parse_option_str(str, "old_map"))
- set_bit(EFI_OLD_MEMMAP, &efi.flags);
- if (parse_option_str(str, "debug"))
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index ed5b673..24d2d53 100644
--- a/arch/x86/platform/efi/efi_32.c
@@ -36559,19 +36687,6 @@ index da310a1..213b5c9 100644
if (do_copy)
bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
else
-diff --git a/block/blk-mq.c b/block/blk-mq.c
-index 594eea0..2dc1fd6 100644
---- a/block/blk-mq.c
-+++ b/block/blk-mq.c
-@@ -1968,7 +1968,7 @@ struct request_queue *blk_mq_init_allocated_queue(struct blk_mq_tag_set *set,
- goto err_hctxs;
-
- setup_timer(&q->timeout, blk_mq_rq_timer, (unsigned long) q);
-- blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30000);
-+ blk_queue_rq_timeout(q, set->timeout ? set->timeout : 30 * HZ);
-
- q->nr_queues = nr_cpu_ids;
- q->nr_hw_queues = set->nr_hw_queues;
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 53b1737..08177d2e 100644
--- a/block/blk-softirq.c
@@ -40082,7 +40197,7 @@ index ad3f38f..8f086cd 100644
}
EXPORT_SYMBOL_GPL(od_unregister_powersave_bias_handler);
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
-index c45d274..0f469f7 100644
+index 6f9d27f..14385d1 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -134,10 +134,10 @@ struct pstate_funcs {
@@ -40098,7 +40213,7 @@ index c45d274..0f469f7 100644
static int hwp_active;
struct perf_limits {
-@@ -721,18 +721,18 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
+@@ -722,18 +722,18 @@ static void intel_pstate_set_pstate(struct cpudata *cpu, int pstate)
cpu->pstate.current_pstate = pstate;
@@ -40124,7 +40239,7 @@ index c45d274..0f469f7 100644
intel_pstate_set_pstate(cpu, cpu->pstate.min_pstate);
}
-@@ -1056,15 +1056,15 @@ static unsigned int force_load;
+@@ -1057,15 +1057,15 @@ static unsigned int force_load;
static int intel_pstate_msrs_not_valid(void)
{
@@ -40144,7 +40259,7 @@ index c45d274..0f469f7 100644
{
pid_params.sample_rate_ms = policy->sample_rate_ms;
pid_params.p_gain_pct = policy->p_gain_pct;
-@@ -1076,12 +1076,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
+@@ -1077,12 +1077,7 @@ static void copy_pid_params(struct pstate_adjust_policy *policy)
static void copy_cpu_funcs(struct pstate_funcs *funcs)
{
@@ -40379,20 +40494,6 @@ index 8d2a772..33826c9 100644
err = pci_request_regions(pdev, name);
if (err)
-diff --git a/drivers/crypto/omap-des.c b/drivers/crypto/omap-des.c
-index 4630709..0a70e46 100644
---- a/drivers/crypto/omap-des.c
-+++ b/drivers/crypto/omap-des.c
-@@ -536,9 +536,6 @@ static int omap_des_crypt_dma_stop(struct omap_des_dev *dd)
- dmaengine_terminate_all(dd->dma_lch_in);
- dmaengine_terminate_all(dd->dma_lch_out);
-
-- dma_unmap_sg(dd->dev, dd->in_sg, dd->in_sg_len, DMA_TO_DEVICE);
-- dma_unmap_sg(dd->dev, dd->out_sg, dd->out_sg_len, DMA_FROM_DEVICE);
--
- return err;
- }
-
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index ca1b362..01cae6a 100644
--- a/drivers/devfreq/devfreq.c
@@ -40707,7 +40808,7 @@ index 94a58a0..f5eba42 100644
container_of(_dev_attr, struct dmi_device_attribute, dev_attr)
diff --git a/drivers/firmware/efi/cper.c b/drivers/firmware/efi/cper.c
-index 4fd9961..52d60ce 100644
+index d425374..1da1716 100644
--- a/drivers/firmware/efi/cper.c
+++ b/drivers/firmware/efi/cper.c
@@ -44,12 +44,12 @@ static char rcd_decode_str[CPER_REC_LEN];
@@ -40728,22 +40829,10 @@ index 4fd9961..52d60ce 100644
EXPORT_SYMBOL_GPL(cper_next_record_id);
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
-index e14363d..302716e 100644
+index 63226e9..302716e 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
-@@ -57,6 +57,11 @@ bool efi_runtime_disabled(void)
-
- static int __init parse_efi_cmdline(char *str)
- {
-+ if (!str) {
-+ pr_warn("need at least one option\n");
-+ return -EINVAL;
-+ }
-+
- if (parse_option_str(str, "noruntime"))
- disable_runtime = true;
-
-@@ -159,14 +164,16 @@ static struct attribute_group efi_subsys_attr_group = {
+@@ -164,14 +164,16 @@ static struct attribute_group efi_subsys_attr_group = {
};
static struct efivars generic_efivars;
@@ -41314,7 +41403,7 @@ index cbb4fc0..5c756cb9 100644
else
type = types[map->type];
diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c
-index 9cfcd0a..97778c5 100644
+index 9cfcd0a..7142a7f 100644
--- a/drivers/gpu/drm/drm_ioc32.c
+++ b/drivers/gpu/drm/drm_ioc32.c
@@ -459,7 +459,7 @@ static int compat_drm_infobufs(struct file *file, unsigned int cmd,
@@ -41352,11 +41441,8 @@ index 9cfcd0a..97778c5 100644
int ret;
/* Assume that ioctls without an explicit compat routine will just
-@@ -1130,12 +1129,11 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
- * than always failing.
- */
+@@ -1132,10 +1131,8 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
if (nr >= ARRAY_SIZE(drm_compat_ioctls))
-+
return drm_ioctl(filp, cmd, arg);
- fn = drm_compat_ioctls[nr];
@@ -41728,10 +41814,10 @@ index 0190b69..60c3eaf 100644
#define BIT_TABLE(id, funcid) ((struct bit_table){ id, parse_bit_##funcid##_tbl_entry })
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
-index 8904933..9624b38 100644
+index cd6dae0..f25eb48 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
-@@ -941,7 +941,8 @@ static struct drm_driver
+@@ -943,7 +943,8 @@ static struct drm_driver
driver_stub = {
.driver_features =
DRIVER_USE_AGP |
@@ -42854,6 +42940,28 @@ index 722a925..594c312 100644
hid_debug_register(hdev, dev_name(&hdev->dev));
ret = device_add(&hdev->dev);
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 008e89b..32d52d2 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -462,12 +462,15 @@ out:
+
+ static void hidinput_cleanup_battery(struct hid_device *dev)
+ {
++ const struct power_supply_desc *psy_desc;
++
+ if (!dev->battery)
+ return;
+
++ psy_desc = dev->battery->desc;
+ power_supply_unregister(dev->battery);
+- kfree(dev->battery->desc->name);
+- kfree(dev->battery->desc);
++ kfree(psy_desc->name);
++ kfree(psy_desc);
+ dev->battery = NULL;
+ }
+ #else /* !CONFIG_HID_BATTERY_STRENGTH */
diff --git a/drivers/hid/hid-sensor-custom.c b/drivers/hid/hid-sensor-custom.c
index 5614fee..8301fbf 100644
--- a/drivers/hid/hid-sensor-custom.c
@@ -43170,19 +43278,6 @@ index bd1c99d..2fa55ad 100644
struct attribute **attrs;
struct sensor_device_template **t;
int i, count;
-diff --git a/drivers/hwmon/nct7802.c b/drivers/hwmon/nct7802.c
-index 28fcb2e..fbfc02b 100644
---- a/drivers/hwmon/nct7802.c
-+++ b/drivers/hwmon/nct7802.c
-@@ -195,7 +195,7 @@ abort:
- }
-
- static int nct7802_write_voltage(struct nct7802_data *data, int nr, int index,
-- unsigned int voltage)
-+ unsigned long voltage)
- {
- int shift = 8 - REG_VOLTAGE_LIMIT_MSB_SHIFT[index - 1][nr];
- int err;
diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c
index f2e47c7..45d7941 100644
--- a/drivers/hwmon/pmbus/pmbus_core.c
@@ -44634,34 +44729,6 @@ index 65075ef..53823f9 100644
dev_notice(smmu->dev, "\tSupported page sizes: 0x%08lx\n", size);
if (smmu->features & ARM_SMMU_FEAT_TRANS_S1)
-diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
-index 5ecfaf2..c87c4b1 100644
---- a/drivers/iommu/intel-iommu.c
-+++ b/drivers/iommu/intel-iommu.c
-@@ -1756,8 +1756,9 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
-
- static void domain_exit(struct dmar_domain *domain)
- {
-+ struct dmar_drhd_unit *drhd;
-+ struct intel_iommu *iommu;
- struct page *freelist = NULL;
-- int i;
-
- /* Domain 0 is reserved, so dont process it */
- if (!domain)
-@@ -1777,8 +1778,10 @@ static void domain_exit(struct dmar_domain *domain)
-
- /* clear attached or cached domains */
- rcu_read_lock();
-- for_each_set_bit(i, domain->iommu_bmp, g_num_of_iommus)
-- iommu_detach_domain(domain, g_iommus[i]);
-+ for_each_active_iommu(iommu, drhd)
-+ if (domain_type_is_vm(domain) ||
-+ test_bit(iommu->seq_id, domain->iommu_bmp))
-+ iommu_detach_domain(domain, iommu);
- rcu_read_unlock();
-
- dma_free_pagelist(freelist);
diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
index 4e46021..f0a24fef 100644
--- a/drivers/iommu/io-pgtable-arm.c
@@ -45877,7 +45944,7 @@ index 79f6941..b33b4e0 100644
pmd->bl_info.value_type.inc = data_block_inc;
pmd->bl_info.value_type.dec = data_block_dec;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 2caf492..0c0dcac 100644
+index e8d8456..d04a41a 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -191,9 +191,9 @@ struct mapped_device {
@@ -45892,7 +45959,7 @@ index 2caf492..0c0dcac 100644
struct list_head uevent_list;
spinlock_t uevent_lock; /* Protect access to uevent_list */
-@@ -2298,8 +2298,8 @@ static struct mapped_device *alloc_dev(int minor)
+@@ -2294,8 +2294,8 @@ static struct mapped_device *alloc_dev(int minor)
spin_lock_init(&md->deferred_lock);
atomic_set(&md->holders, 1);
atomic_set(&md->open_count, 0);
@@ -45903,7 +45970,7 @@ index 2caf492..0c0dcac 100644
INIT_LIST_HEAD(&md->uevent_list);
INIT_LIST_HEAD(&md->table_devices);
spin_lock_init(&md->uevent_lock);
-@@ -2466,7 +2466,7 @@ static void event_callback(void *context)
+@@ -2462,7 +2462,7 @@ static void event_callback(void *context)
dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
@@ -45912,7 +45979,7 @@ index 2caf492..0c0dcac 100644
wake_up(&md->eventq);
}
-@@ -3465,18 +3465,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -3461,18 +3461,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
uint32_t dm_next_uevent_seq(struct mapped_device *md)
{
@@ -46141,7 +46208,7 @@ index 3e6d115..ffecdeb 100644
/*----------------------------------------------------------------*/
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
-index 9157a29..0d462f0 100644
+index cd7b0c1..377cd70 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1934,7 +1934,7 @@ static int fix_sync_read_error(struct r1bio *r1_bio)
@@ -47906,19 +47973,6 @@ index c439c82..1f20f57 100644
union axis_conversion ac; /* hw -> logical axis */
int mapped_btns[3];
-diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
-index 3e29681..e40bcd03 100644
---- a/drivers/misc/mei/main.c
-+++ b/drivers/misc/mei/main.c
-@@ -685,7 +685,7 @@ int mei_register(struct mei_device *dev, struct device *parent)
- /* Fill in the data structures */
- devno = MKDEV(MAJOR(mei_devt), dev->minor);
- cdev_init(&dev->cdev, &mei_fops);
-- dev->cdev.owner = mei_fops.owner;
-+ dev->cdev.owner = parent->driver->owner;
-
- /* Add the device */
- ret = cdev_add(&dev->cdev, devno, 1);
diff --git a/drivers/misc/sgi-gru/gruhandles.c b/drivers/misc/sgi-gru/gruhandles.c
index 2f30bad..c4c13d0 100644
--- a/drivers/misc/sgi-gru/gruhandles.c
@@ -48253,7 +48307,7 @@ index fb26674..3172c2b 100644
mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
mmc->max_busy_timeout = 0;
diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c
-index 9df2b68..6d5ed1a 100644
+index d0abdffb..bb1f8d7 100644
--- a/drivers/mmc/host/omap_hsmmc.c
+++ b/drivers/mmc/host/omap_hsmmc.c
@@ -2004,7 +2004,9 @@ static int omap_hsmmc_probe(struct platform_device *pdev)
@@ -48408,10 +48462,10 @@ index e8c96b8..516a96c 100644
Say Y here if you want to support for Freescale FlexCAN.
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index e9b1810..5c2f3f9 100644
+index aede704..b516b4d 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
-@@ -964,7 +964,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
+@@ -961,7 +961,7 @@ static int can_newlink(struct net *src_net, struct net_device *dev,
return -EOPNOTSUPP;
}
@@ -48421,10 +48475,10 @@ index e9b1810..5c2f3f9 100644
.maxtype = IFLA_CAN_MAX,
.policy = can_policy,
diff --git a/drivers/net/can/vcan.c b/drivers/net/can/vcan.c
-index 0ce868d..e5dc8bd 100644
+index 674f367..ec3a31f 100644
--- a/drivers/net/can/vcan.c
+++ b/drivers/net/can/vcan.c
-@@ -166,7 +166,7 @@ static void vcan_setup(struct net_device *dev)
+@@ -163,7 +163,7 @@ static void vcan_setup(struct net_device *dev)
dev->destructor = free_netdev;
}
@@ -50016,7 +50070,7 @@ index a2515887..6d13233 100644
/* we will have to manufacture ethernet headers, prepare template */
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 63c7810..4ad33aa 100644
+index 63c7810..a694d2b 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -48,7 +48,7 @@ module_param(gso, bool, 0444);
@@ -50028,6 +50082,18 @@ index 63c7810..4ad33aa 100644
#define VIRTNET_DRIVER_VERSION "1.0.0"
+@@ -1756,9 +1756,9 @@ static int virtnet_probe(struct virtio_device *vdev)
+ /* Do we support "hardware" checksums? */
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_CSUM)) {
+ /* This opens up the world of extra features. */
+- dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->hw_features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+ if (csum)
+- dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG|NETIF_F_FRAGLIST;
++ dev->features |= NETIF_F_HW_CSUM|NETIF_F_SG;
+
+ if (virtio_has_feature(vdev, VIRTIO_NET_F_GSO)) {
+ dev->hw_features |= NETIF_F_TSO | NETIF_F_UFO
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 61c0840..92e7f7e 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -50790,7 +50856,7 @@ index 0ffb6ff..c0b7f0e 100644
memset(buf, 0, sizeof(buf));
buf_size = min(count, sizeof(buf) - 1);
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
-index dc17909..989c9fb 100644
+index 37e6a6f..b3b0369 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1919,7 +1919,7 @@ static ssize_t iwl_dbgfs_interrupt_write(struct file *file,
@@ -53416,7 +53482,7 @@ index 3833bf5..95feaf1 100644
if (drv->done)
good_bytes = drv->done(cmd);
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
-index b1a2631..5bcd9c8 100644
+index 448ebda..9bd345f 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1597,7 +1597,7 @@ static void scsi_kill_request(struct request *req, struct request_queue *q)
@@ -53450,7 +53516,7 @@ index b1a2631..5bcd9c8 100644
/* check if the device is still usable */
if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
-index 1ac38e7..6acc656 100644
+index 9ad4116..4e736fc 100644
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -788,7 +788,7 @@ show_iostat_##field(struct device *dev, struct device_attribute *attr, \
@@ -53636,21 +53702,6 @@ index 8bd54a6..dd037a5 100644
int block_sectors = 0;
long error_sector;
struct scsi_cd *cd = scsi_cd(SCpnt->request->rq_disk);
-diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
-index 9a1c342..525ab4c 100644
---- a/drivers/scsi/st.c
-+++ b/drivers/scsi/st.c
-@@ -1274,9 +1274,9 @@ static int st_open(struct inode *inode, struct file *filp)
- spin_lock(&st_use_lock);
- STp->in_use = 0;
- spin_unlock(&st_use_lock);
-- scsi_tape_put(STp);
- if (resumed)
- scsi_autopm_put_device(STp->device);
-+ scsi_tape_put(STp);
- return retval;
-
- }
diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c b/drivers/soc/tegra/fuse/fuse-tegra.c
index c0d660f..24a5854 100644
--- a/drivers/soc/tegra/fuse/fuse-tegra.c
@@ -54904,7 +54955,7 @@ index 2c34c32..81d10e1 100644
dlci->modem_rx = 0;
diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
-index 396344c..875c1d6 100644
+index 16ed0b6..7d944b4 100644
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@ -116,7 +116,7 @@ struct n_tty_data {
@@ -54916,7 +54967,7 @@ index 396344c..875c1d6 100644
size_t line_start;
/* protected by output lock */
-@@ -2572,6 +2572,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
+@@ -2582,6 +2582,7 @@ void n_tty_inherit_ops(struct tty_ldisc_ops *ops)
{
*ops = tty_ldisc_N_TTY;
ops->owner = NULL;
@@ -55208,7 +55259,7 @@ index a0ae942..befa48d 100644
if (cfg->uart_flags & UPF_CONS_FLOW) {
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
-index 0b7bb12..ebe191a 100644
+index ec54044..fc93d3f 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1376,7 +1376,7 @@ static void uart_close(struct tty_struct *tty, struct file *filp)
@@ -55229,7 +55280,7 @@ index 0b7bb12..ebe191a 100644
return;
/*
-@@ -1510,7 +1510,7 @@ static void uart_hangup(struct tty_struct *tty)
+@@ -1511,7 +1511,7 @@ static void uart_hangup(struct tty_struct *tty)
uart_flush_buffer(tty);
uart_shutdown(tty, state);
spin_lock_irqsave(&port->lock, flags);
@@ -55238,7 +55289,7 @@ index 0b7bb12..ebe191a 100644
clear_bit(ASYNCB_NORMAL_ACTIVE, &port->flags);
spin_unlock_irqrestore(&port->lock, flags);
tty_port_tty_set(port, NULL);
-@@ -1597,7 +1597,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
+@@ -1598,7 +1598,7 @@ static int uart_open(struct tty_struct *tty, struct file *filp)
pr_debug("uart_open(%d) called\n", line);
spin_lock_irq(&port->lock);
@@ -74864,7 +74915,7 @@ index bbbe139..b76fae5 100644
return 0;
while (nr) {
diff --git a/fs/dcache.c b/fs/dcache.c
-index 50bb3c2..d874b57 100644
+index 5d03eb0..d874b57 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -545,7 +545,7 @@ static void __dentry_kill(struct dentry *dentry)
@@ -74885,15 +74936,6 @@ index 50bb3c2..d874b57 100644
return NULL;
if (likely(spin_trylock(&parent->d_lock)))
return parent;
-@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
-
- /*
- * If we have a d_op->d_delete() operation, we sould not
-- * let the dentry count go to zero, so use "put__or_lock".
-+ * let the dentry count go to zero, so use "put_or_lock".
- */
- if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
- return lockref_put_or_lock(&dentry->d_lockref);
@@ -660,8 +660,8 @@ static inline bool fast_dput(struct dentry *dentry)
*/
if (unlikely(ret < 0)) {
@@ -74905,15 +74947,6 @@ index 50bb3c2..d874b57 100644
spin_unlock(&dentry->d_lock);
return 1;
}
-@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
- */
- smp_rmb();
- d_flags = ACCESS_ONCE(dentry->d_flags);
-- d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
-+ d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
-
- /* Nothing to do? Dropping the reference was all we needed? */
- if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
@@ -716,7 +716,7 @@ static inline bool fast_dput(struct dentry *dentry)
* else could have killed it and marked it dead. Either way, we
* don't need to do anything else.
@@ -74932,17 +74965,7 @@ index 50bb3c2..d874b57 100644
return 0;
}
-@@ -776,6 +776,9 @@ repeat:
- if (unlikely(d_unhashed(dentry)))
- goto kill_it;
-
-+ if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
-+ goto kill_it;
-+
- if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
- if (dentry->d_op->d_delete(dentry))
- goto kill_it;
-@@ -785,7 +788,7 @@ repeat:
+@@ -788,7 +788,7 @@ repeat:
dentry->d_flags |= DCACHE_REFERENCED;
dentry_lru_add(dentry);
@@ -74951,7 +74974,7 @@ index 50bb3c2..d874b57 100644
spin_unlock(&dentry->d_lock);
return;
-@@ -800,7 +803,7 @@ EXPORT_SYMBOL(dput);
+@@ -803,7 +803,7 @@ EXPORT_SYMBOL(dput);
/* This must be called with d_lock held */
static inline void __dget_dlock(struct dentry *dentry)
{
@@ -74960,7 +74983,7 @@ index 50bb3c2..d874b57 100644
}
static inline void __dget(struct dentry *dentry)
-@@ -841,8 +844,8 @@ repeat:
+@@ -844,8 +844,8 @@ repeat:
goto repeat;
}
rcu_read_unlock();
@@ -74971,7 +74994,7 @@ index 50bb3c2..d874b57 100644
spin_unlock(&ret->d_lock);
return ret;
}
-@@ -920,9 +923,9 @@ restart:
+@@ -923,9 +923,9 @@ restart:
spin_lock(&inode->i_lock);
hlist_for_each_entry(dentry, &inode->i_dentry, d_u.d_alias) {
spin_lock(&dentry->d_lock);
@@ -74983,7 +75006,7 @@ index 50bb3c2..d874b57 100644
__dentry_kill(dentry);
dput(parent);
goto restart;
-@@ -957,7 +960,7 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -960,7 +960,7 @@ static void shrink_dentry_list(struct list_head *list)
* We found an inuse dentry which was not removed from
* the LRU because of laziness during lookup. Do not free it.
*/
@@ -74992,7 +75015,7 @@ index 50bb3c2..d874b57 100644
spin_unlock(&dentry->d_lock);
if (parent)
spin_unlock(&parent->d_lock);
-@@ -995,8 +998,8 @@ static void shrink_dentry_list(struct list_head *list)
+@@ -998,8 +998,8 @@ static void shrink_dentry_list(struct list_head *list)
dentry = parent;
while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) {
parent = lock_parent(dentry);
@@ -75003,7 +75026,7 @@ index 50bb3c2..d874b57 100644
spin_unlock(&dentry->d_lock);
if (parent)
spin_unlock(&parent->d_lock);
-@@ -1036,7 +1039,7 @@ static enum lru_status dentry_lru_isolate(struct list_head *item,
+@@ -1039,7 +1039,7 @@ static enum lru_status dentry_lru_isolate(struct list_head *item,
* counts, just remove them from the LRU. Otherwise give them
* another pass through the LRU.
*/
@@ -75012,7 +75035,7 @@ index 50bb3c2..d874b57 100644
d_lru_isolate(lru, dentry);
spin_unlock(&dentry->d_lock);
return LRU_REMOVED;
-@@ -1370,7 +1373,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
+@@ -1373,7 +1373,7 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry)
} else {
if (dentry->d_flags & DCACHE_LRU_LIST)
d_lru_del(dentry);
@@ -75021,7 +75044,7 @@ index 50bb3c2..d874b57 100644
d_shrink_add(dentry, &data->dispose);
data->found++;
}
-@@ -1418,7 +1421,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
+@@ -1421,7 +1421,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
return D_WALK_CONTINUE;
/* root with refcount 1 is fine */
@@ -75030,7 +75053,7 @@ index 50bb3c2..d874b57 100644
return D_WALK_CONTINUE;
printk(KERN_ERR "BUG: Dentry %p{i=%lx,n=%pd} "
-@@ -1427,7 +1430,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
+@@ -1430,7 +1430,7 @@ static enum d_walk_ret umount_check(void *_data, struct dentry *dentry)
dentry->d_inode ?
dentry->d_inode->i_ino : 0UL,
dentry,
@@ -75039,7 +75062,7 @@ index 50bb3c2..d874b57 100644
dentry->d_sb->s_type->name,
dentry->d_sb->s_id);
WARN_ON(1);
-@@ -1568,7 +1571,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1571,7 +1571,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
dentry->d_iname[DNAME_INLINE_LEN-1] = 0;
if (name->len > DNAME_INLINE_LEN-1) {
size_t size = offsetof(struct external_name, name[1]);
@@ -75048,7 +75071,7 @@ index 50bb3c2..d874b57 100644
if (!p) {
kmem_cache_free(dentry_cache, dentry);
return NULL;
-@@ -1591,7 +1594,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1594,7 +1594,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
smp_wmb();
dentry->d_name.name = dname;
@@ -75057,7 +75080,7 @@ index 50bb3c2..d874b57 100644
dentry->d_flags = 0;
spin_lock_init(&dentry->d_lock);
seqcount_init(&dentry->d_seq);
-@@ -1600,6 +1603,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
+@@ -1603,6 +1603,9 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
dentry->d_sb = sb;
dentry->d_op = NULL;
dentry->d_fsdata = NULL;
@@ -75067,7 +75090,7 @@ index 50bb3c2..d874b57 100644
INIT_HLIST_BL_NODE(&dentry->d_hash);
INIT_LIST_HEAD(&dentry->d_lru);
INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2321,7 +2327,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2324,7 +2327,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
goto next;
}
@@ -75076,7 +75099,7 @@ index 50bb3c2..d874b57 100644
found = dentry;
spin_unlock(&dentry->d_lock);
break;
-@@ -2389,7 +2395,7 @@ again:
+@@ -2392,7 +2395,7 @@ again:
spin_lock(&dentry->d_lock);
inode = dentry->d_inode;
isdir = S_ISDIR(inode->i_mode);
@@ -75085,7 +75108,7 @@ index 50bb3c2..d874b57 100644
if (!spin_trylock(&inode->i_lock)) {
spin_unlock(&dentry->d_lock);
cpu_relax();
-@@ -3331,7 +3337,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3334,7 +3337,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
dentry->d_flags |= DCACHE_GENOCIDE;
@@ -75094,7 +75117,7 @@ index 50bb3c2..d874b57 100644
}
}
return D_WALK_CONTINUE;
-@@ -3447,7 +3453,8 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3450,7 +3453,8 @@ void __init vfs_caches_init(unsigned long mempages)
mempages -= reserve;
names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -78505,7 +78528,7 @@ index 6a61c2b..bd79179 100644
#define MNT_NS_INTERNAL ERR_PTR(-EINVAL) /* distinct from any mnt_namespace */
diff --git a/fs/namei.c b/fs/namei.c
-index fe30d3b..cf767ae 100644
+index fe30d3b..57656a7 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -336,17 +336,32 @@ int generic_permission(struct inode *inode, int mask)
@@ -78585,6 +78608,15 @@ index fe30d3b..cf767ae 100644
{
return nd->saved_names[nd->depth];
}
+@@ -766,7 +773,7 @@ static inline int may_follow_link(struct path *link, struct nameidata *nd)
+ return 0;
+
+ /* Allowed if parent directory not sticky and world-writable. */
+- parent = nd->path.dentry->d_inode;
++ parent = nd->inode;
+ if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
+ return 0;
+
@@ -854,7 +861,7 @@ follow_link(struct path *link, struct nameidata *nd, void **p)
{
struct dentry *dentry = link->dentry;
@@ -79098,59 +79130,10 @@ index fe30d3b..cf767ae 100644
out:
return len;
diff --git a/fs/namespace.c b/fs/namespace.c
-index 02c6875..ac3626c 100644
+index fce3cc1..ac3626c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
-@@ -1350,6 +1350,36 @@ enum umount_tree_flags {
- UMOUNT_PROPAGATE = 2,
- UMOUNT_CONNECTED = 4,
- };
-+
-+static bool disconnect_mount(struct mount *mnt, enum umount_tree_flags how)
-+{
-+ /* Leaving mounts connected is only valid for lazy umounts */
-+ if (how & UMOUNT_SYNC)
-+ return true;
-+
-+ /* A mount without a parent has nothing to be connected to */
-+ if (!mnt_has_parent(mnt))
-+ return true;
-+
-+ /* Because the reference counting rules change when mounts are
-+ * unmounted and connected, umounted mounts may not be
-+ * connected to mounted mounts.
-+ */
-+ if (!(mnt->mnt_parent->mnt.mnt_flags & MNT_UMOUNT))
-+ return true;
-+
-+ /* Has it been requested that the mount remain connected? */
-+ if (how & UMOUNT_CONNECTED)
-+ return false;
-+
-+ /* Is the mount locked such that it needs to remain connected? */
-+ if (IS_MNT_LOCKED(mnt))
-+ return false;
-+
-+ /* By default disconnect the mount */
-+ return true;
-+}
-+
- /*
- * mount_lock must be held
- * namespace_sem must be held for write
-@@ -1387,10 +1417,7 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how)
- if (how & UMOUNT_SYNC)
- p->mnt.mnt_flags |= MNT_SYNC_UMOUNT;
-
-- disconnect = !(((how & UMOUNT_CONNECTED) &&
-- mnt_has_parent(p) &&
-- (p->mnt_parent->mnt.mnt_flags & MNT_UMOUNT)) ||
-- IS_MNT_LOCKED_AND_LAZY(p));
-+ disconnect = disconnect_mount(p, how);
-
- pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt,
- disconnect ? &unmounted : NULL);
-@@ -1478,6 +1505,9 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -1505,6 +1505,9 @@ static int do_umount(struct mount *mnt, int flags)
if (!(sb->s_flags & MS_RDONLY))
retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
up_write(&sb->s_umount);
@@ -79160,7 +79143,7 @@ index 02c6875..ac3626c 100644
return retval;
}
-@@ -1500,6 +1530,9 @@ static int do_umount(struct mount *mnt, int flags)
+@@ -1527,6 +1530,9 @@ static int do_umount(struct mount *mnt, int flags)
}
unlock_mount_hash();
namespace_unlock();
@@ -79170,21 +79153,7 @@ index 02c6875..ac3626c 100644
return retval;
}
-@@ -1527,11 +1560,8 @@ void __detach_mounts(struct dentry *dentry)
- while (!hlist_empty(&mp->m_list)) {
- mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
- if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
-- struct mount *p, *tmp;
-- list_for_each_entry_safe(p, tmp, &mnt->mnt_mounts, mnt_child) {
-- hlist_add_head(&p->mnt_umount.s_list, &unmounted);
-- umount_mnt(p);
-- }
-+ hlist_add_head(&mnt->mnt_umount.s_list, &unmounted);
-+ umount_mnt(mnt);
- }
- else umount_tree(mnt, UMOUNT_CONNECTED);
- }
-@@ -1557,7 +1587,7 @@ static inline bool may_mount(void)
+@@ -1581,7 +1587,7 @@ static inline bool may_mount(void)
* unixes. Our API is identical to OSF/1 to avoid making a mess of AMD
*/
@@ -79193,7 +79162,7 @@ index 02c6875..ac3626c 100644
{
struct path path;
struct mount *mnt;
-@@ -1602,7 +1632,7 @@ out:
+@@ -1626,7 +1632,7 @@ out:
/*
* The 2.0 compatible umount. No flags.
*/
@@ -79202,7 +79171,7 @@ index 02c6875..ac3626c 100644
{
return sys_umount(name, 0);
}
-@@ -2677,6 +2707,16 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+@@ -2701,6 +2707,16 @@ long do_mount(const char *dev_name, const char __user *dir_name,
MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
MS_STRICTATIME);
@@ -79219,7 +79188,7 @@ index 02c6875..ac3626c 100644
if (flags & MS_REMOUNT)
retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
data_page);
-@@ -2690,7 +2730,10 @@ long do_mount(const char *dev_name, const char __user *dir_name,
+@@ -2714,7 +2730,10 @@ long do_mount(const char *dev_name, const char __user *dir_name,
retval = do_new_mount(&path, type_page, flags, mnt_flags,
dev_name, data_page);
dput_out:
@@ -79230,7 +79199,7 @@ index 02c6875..ac3626c 100644
return retval;
}
-@@ -2708,7 +2751,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
+@@ -2732,7 +2751,7 @@ static void free_mnt_ns(struct mnt_namespace *ns)
* number incrementing at 10Ghz will take 12,427 years to wrap which
* is effectively never, so we can ignore the possibility.
*/
@@ -79239,7 +79208,7 @@ index 02c6875..ac3626c 100644
static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
{
-@@ -2724,7 +2767,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
+@@ -2748,7 +2767,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
return ERR_PTR(ret);
}
new_ns->ns.ops = &mntns_operations;
@@ -79248,7 +79217,7 @@ index 02c6875..ac3626c 100644
atomic_set(&new_ns->count, 1);
new_ns->root = NULL;
INIT_LIST_HEAD(&new_ns->list);
-@@ -2734,7 +2777,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
+@@ -2758,7 +2777,7 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
return new_ns;
}
@@ -79257,7 +79226,7 @@ index 02c6875..ac3626c 100644
struct user_namespace *user_ns, struct fs_struct *new_fs)
{
struct mnt_namespace *new_ns;
-@@ -2855,8 +2898,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
+@@ -2879,8 +2898,8 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
}
EXPORT_SYMBOL(mount_subtree);
@@ -79268,7 +79237,7 @@ index 02c6875..ac3626c 100644
{
int ret;
char *kernel_type;
-@@ -2962,6 +3005,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
+@@ -2986,6 +3005,11 @@ SYSCALL_DEFINE2(pivot_root, const char __user *, new_root,
if (error)
goto out2;
@@ -79280,7 +79249,7 @@ index 02c6875..ac3626c 100644
get_fs_root(current->fs, &root);
old_mp = lock_mount(&old);
error = PTR_ERR(old_mp);
-@@ -3263,7 +3311,7 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
+@@ -3287,7 +3311,7 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
!ns_capable(current_user_ns(), CAP_SYS_ADMIN))
return -EPERM;
@@ -79303,10 +79272,10 @@ index 19ca95c..b28702c 100644
static struct callback_op callback_ops[];
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index f734562..3fd6c4e 100644
+index 5d25b9d..765fc0f 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
-@@ -1275,16 +1275,16 @@ static int nfs_ctime_need_update(const struct inode *inode, const struct nfs_fat
+@@ -1277,16 +1277,16 @@ static int nfs_ctime_need_update(const struct inode *inode, const struct nfs_fat
return timespec_compare(&fattr->ctime, &inode->i_ctime) > 0;
}
@@ -79366,7 +79335,7 @@ index 9e6475b..7970138 100644
/* proc.c */
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 55e1e3a..3886f50 100644
+index d3f2051..dd338dc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -916,6 +916,7 @@ struct nfs4_opendata {
@@ -80226,19 +80195,6 @@ index 8865f79..bd2c79b 100644
goto out;
if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
-diff --git a/fs/pnode.h b/fs/pnode.h
-index 7114ce6..0fcdbe7 100644
---- a/fs/pnode.h
-+++ b/fs/pnode.h
-@@ -20,8 +20,6 @@
- #define SET_MNT_MARK(m) ((m)->mnt.mnt_flags |= MNT_MARKED)
- #define CLEAR_MNT_MARK(m) ((m)->mnt.mnt_flags &= ~MNT_MARKED)
- #define IS_MNT_LOCKED(m) ((m)->mnt.mnt_flags & MNT_LOCKED)
--#define IS_MNT_LOCKED_AND_LAZY(m) \
-- (((m)->mnt.mnt_flags & (MNT_LOCKED|MNT_SYNC_UMOUNT)) == MNT_LOCKED)
-
- #define CL_EXPIRE 0x01
- #define CL_SLAVE 0x02
diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index 84bb65b8..4270e47 100644
--- a/fs/posix_acl.c
@@ -82259,7 +82215,7 @@ index f684c75..4117611 100644
return -EINVAL;
diff --git a/fs/seq_file.c b/fs/seq_file.c
-index 555f821..34684d7 100644
+index 555f821..02a990b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -12,6 +12,8 @@
@@ -82271,25 +82227,19 @@ index 555f821..34684d7 100644
#include <asm/uaccess.h>
#include <asm/page.h>
-@@ -23,16 +25,7 @@ static void seq_set_overflow(struct seq_file *m)
-
- static void *seq_buf_alloc(unsigned long size)
- {
-- void *buf;
--
-- /*
-- * __GFP_NORETRY to avoid oom-killings with high-order allocations -
-- * it's better to fall back to vmalloc() than to kill things.
-- */
+@@ -29,9 +31,9 @@ static void *seq_buf_alloc(unsigned long size)
+ * __GFP_NORETRY to avoid oom-killings with high-order allocations -
+ * it's better to fall back to vmalloc() than to kill things.
+ */
- buf = kmalloc(size, GFP_KERNEL | __GFP_NORETRY | __GFP_NOWARN);
-- if (!buf && size > PAGE_SIZE)
++ buf = kmalloc(size, GFP_KERNEL | GFP_USERCOPY | __GFP_NORETRY | __GFP_NOWARN);
+ if (!buf && size > PAGE_SIZE)
- buf = vmalloc(size);
-- return buf;
-+ return kmalloc(size, GFP_KERNEL | GFP_USERCOPY);
++ buf = vmalloc_usercopy(size);
+ return buf;
}
- /**
-@@ -65,6 +58,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
+@@ -65,6 +67,9 @@ int seq_open(struct file *file, const struct seq_operations *op)
#ifdef CONFIG_USER_NS
p->user_ns = file->f_cred->user_ns;
#endif
@@ -82299,7 +82249,7 @@ index 555f821..34684d7 100644
/*
* Wrappers around seq_open(e.g. swaps_open) need to be
-@@ -87,6 +83,16 @@ int seq_open(struct file *file, const struct seq_operations *op)
+@@ -87,6 +92,16 @@ int seq_open(struct file *file, const struct seq_operations *op)
}
EXPORT_SYMBOL(seq_open);
@@ -82316,7 +82266,7 @@ index 555f821..34684d7 100644
static int traverse(struct seq_file *m, loff_t offset)
{
loff_t pos = 0, index;
-@@ -158,7 +164,7 @@ Eoverflow:
+@@ -158,7 +173,7 @@ Eoverflow:
ssize_t seq_read(struct file *file, char __user *buf, size_t size, loff_t *ppos)
{
struct seq_file *m = file->private_data;
@@ -82325,7 +82275,7 @@ index 555f821..34684d7 100644
loff_t pos;
size_t n;
void *p;
-@@ -557,7 +563,7 @@ static void single_stop(struct seq_file *p, void *v)
+@@ -557,7 +572,7 @@ static void single_stop(struct seq_file *p, void *v)
int single_open(struct file *file, int (*show)(struct seq_file *, void *),
void *data)
{
@@ -82334,7 +82284,7 @@ index 555f821..34684d7 100644
int res = -ENOMEM;
if (op) {
-@@ -593,6 +599,17 @@ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
+@@ -593,6 +608,17 @@ int single_open_size(struct file *file, int (*show)(struct seq_file *, void *),
}
EXPORT_SYMBOL(single_open_size);
@@ -96393,34 +96343,6 @@ index 7ee1774..72505b8 100644
}
/*
-diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
-index 1da6029..6cd8c0e 100644
---- a/include/linux/ftrace.h
-+++ b/include/linux/ftrace.h
-@@ -116,6 +116,7 @@ ftrace_func_t ftrace_ops_get_func(struct ftrace_ops *ops);
- * SAVE_REGS. If another ops with this flag set is already registered
- * for any of the functions that this ops will be registered for, then
- * this ops will fail to register or set_filter_ip.
-+ * PID - Is affected by set_ftrace_pid (allows filtering on those pids)
- */
- enum {
- FTRACE_OPS_FL_ENABLED = 1 << 0,
-@@ -132,6 +133,7 @@ enum {
- FTRACE_OPS_FL_MODIFYING = 1 << 11,
- FTRACE_OPS_FL_ALLOC_TRAMP = 1 << 12,
- FTRACE_OPS_FL_IPMODIFY = 1 << 13,
-+ FTRACE_OPS_FL_PID = 1 << 14,
- };
-
- #ifdef CONFIG_DYNAMIC_FTRACE
-@@ -159,6 +161,7 @@ struct ftrace_ops {
- struct ftrace_ops *next;
- unsigned long flags;
- void *private;
-+ ftrace_func_t saved_func;
- int __percpu *disabled;
- #ifdef CONFIG_DYNAMIC_FTRACE
- int nr_trampolines;
diff --git a/include/linux/genhd.h b/include/linux/genhd.h
index ec274e0..e678159 100644
--- a/include/linux/genhd.h
@@ -101323,10 +101245,10 @@ index b483abd..af305ad 100644
#endif
#endif /* _LINUX_VGA_SWITCHEROO_H_ */
diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h
-index 0ec5983..cc61051 100644
+index 0ec5983..d5888bb 100644
--- a/include/linux/vmalloc.h
+++ b/include/linux/vmalloc.h
-@@ -18,6 +18,11 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
+@@ -18,6 +18,14 @@ struct vm_area_struct; /* vma defining user mapping in mm_types.h */
#define VM_UNINITIALIZED 0x00000020 /* vm_struct is not fully initialized */
#define VM_NO_GUARD 0x00000040 /* don't add guard page */
#define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */
@@ -101335,10 +101257,21 @@ index 0ec5983..cc61051 100644
+#define VM_KERNEXEC 0x00000100 /* allocate from executable kernel memory range */
+#endif
+
++#define VM_USERCOPY 0x00000200 /* allocation intended for copies to userland */
++
++
/* bits [20..32] reserved for arch specific ioremap internals */
/*
-@@ -86,6 +91,10 @@ extern void *vmap(struct page **pages, unsigned int count,
+@@ -67,6 +75,7 @@ static inline void vmalloc_init(void)
+ #endif
+
+ extern void *vmalloc(unsigned long size);
++extern void *vmalloc_usercopy(unsigned long size);
+ extern void *vzalloc(unsigned long size);
+ extern void *vmalloc_user(unsigned long size);
+ extern void *vmalloc_node(unsigned long size, int node);
+@@ -86,6 +95,10 @@ extern void *vmap(struct page **pages, unsigned int count,
unsigned long flags, pgprot_t prot);
extern void vunmap(const void *addr);
@@ -101349,7 +101282,7 @@ index 0ec5983..cc61051 100644
extern int remap_vmalloc_range_partial(struct vm_area_struct *vma,
unsigned long uaddr, void *kaddr,
unsigned long size);
-@@ -150,7 +159,7 @@ extern void free_vm_area(struct vm_struct *area);
+@@ -150,7 +163,7 @@ extern void free_vm_area(struct vm_struct *area);
/* for /dev/kmem */
extern long vread(char *buf, char *addr, unsigned long count);
@@ -103163,7 +103096,7 @@ index ad1bd77..dca2c1b 100644
next_state = Reset;
return 0;
diff --git a/init/main.c b/init/main.c
-index 2a89545..449eca2 100644
+index 2a89545..58711ee 100644
--- a/init/main.c
+++ b/init/main.c
@@ -97,6 +97,8 @@ extern void radix_tree_init(void);
@@ -103175,7 +103108,7 @@ index 2a89545..449eca2 100644
/*
* Debug helper: via this flag we know that we are in 'early bootup code'
* where only the boot processor is running with IRQ disabled. This means
-@@ -158,6 +160,85 @@ static int __init set_reset_devices(char *str)
+@@ -158,6 +160,37 @@ static int __init set_reset_devices(char *str)
__setup("reset_devices", set_reset_devices);
@@ -103199,54 +103132,6 @@ index 2a89545..449eca2 100644
+__setup("grsec_sysfs_restrict", setup_grsec_sysfs_restrict);
+#endif
+
-+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+unsigned long pax_user_shadow_base __read_only;
-+EXPORT_SYMBOL(pax_user_shadow_base);
-+extern char pax_enter_kernel_user[];
-+extern char pax_exit_kernel_user[];
-+#endif
-+
-+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
-+static int __init setup_pax_nouderef(char *str)
-+{
-+#ifdef CONFIG_X86_32
-+ unsigned int cpu;
-+ struct desc_struct *gdt;
-+
-+ for (cpu = 0; cpu < nr_cpu_ids; cpu++) {
-+ gdt = get_cpu_gdt_table(cpu);
-+ gdt[GDT_ENTRY_KERNEL_DS].type = 3;
-+ gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
-+ gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
-+ }
-+ loadsegment(ds, __KERNEL_DS);
-+ loadsegment(es, __KERNEL_DS);
-+ loadsegment(ss, __KERNEL_DS);
-+#else
-+ memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
-+ memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
-+ clone_pgd_mask = ~(pgdval_t)0UL;
-+ pax_user_shadow_base = 0UL;
-+ setup_clear_cpu_cap(X86_FEATURE_PCID);
-+ setup_clear_cpu_cap(X86_FEATURE_INVPCID);
-+#endif
-+
-+ return 0;
-+}
-+early_param("pax_nouderef", setup_pax_nouderef);
-+
-+#ifdef CONFIG_X86_64
-+static int __init setup_pax_weakuderef(char *str)
-+{
-+ if (clone_pgd_mask != ~(pgdval_t)0UL)
-+ pax_user_shadow_base = 1UL << TASK_SIZE_MAX_SHIFT;
-+ return 1;
-+}
-+__setup("pax_weakuderef", setup_pax_weakuderef);
-+#endif
-+#endif
-+
+#ifdef CONFIG_PAX_SOFTMODE
+int pax_softmode;
+
@@ -103261,7 +103146,7 @@ index 2a89545..449eca2 100644
static const char *argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
const char *envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
static const char *panic_later, *panic_param;
-@@ -726,7 +807,7 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
+@@ -726,7 +759,7 @@ static bool __init_or_module initcall_blacklisted(initcall_t fn)
struct blacklist_entry *entry;
char *fn_name;
@@ -103270,7 +103155,7 @@ index 2a89545..449eca2 100644
if (!fn_name)
return false;
-@@ -778,7 +859,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -778,7 +811,7 @@ int __init_or_module do_one_initcall(initcall_t fn)
{
int count = preempt_count();
int ret;
@@ -103279,7 +103164,7 @@ index 2a89545..449eca2 100644
if (initcall_blacklisted(fn))
return -EPERM;
-@@ -788,18 +869,17 @@ int __init_or_module do_one_initcall(initcall_t fn)
+@@ -788,18 +821,17 @@ int __init_or_module do_one_initcall(initcall_t fn)
else
ret = fn();
@@ -103302,7 +103187,7 @@ index 2a89545..449eca2 100644
return ret;
}
-@@ -905,8 +985,8 @@ static int run_init_process(const char *init_filename)
+@@ -905,8 +937,8 @@ static int run_init_process(const char *init_filename)
{
argv_init[0] = init_filename;
return do_execve(getname_kernel(init_filename),
@@ -103313,7 +103198,7 @@ index 2a89545..449eca2 100644
}
static int try_to_run_init_process(const char *init_filename)
-@@ -923,6 +1003,10 @@ static int try_to_run_init_process(const char *init_filename)
+@@ -923,6 +955,10 @@ static int try_to_run_init_process(const char *init_filename)
return ret;
}
@@ -103324,7 +103209,7 @@ index 2a89545..449eca2 100644
static noinline void __init kernel_init_freeable(void);
static int __ref kernel_init(void *unused)
-@@ -947,6 +1031,11 @@ static int __ref kernel_init(void *unused)
+@@ -947,6 +983,11 @@ static int __ref kernel_init(void *unused)
ramdisk_execute_command, ret);
}
@@ -103336,7 +103221,7 @@ index 2a89545..449eca2 100644
/*
* We try each of these until one succeeds.
*
-@@ -1002,7 +1091,7 @@ static noinline void __init kernel_init_freeable(void)
+@@ -1002,7 +1043,7 @@ static noinline void __init kernel_init_freeable(void)
do_basic_setup();
/* Open the /dev/console on the rootfs, this should never fail */
@@ -103345,7 +103230,7 @@ index 2a89545..449eca2 100644
pr_err("Warning: unable to open an initial console.\n");
(void) sys_dup(0);
-@@ -1015,11 +1104,13 @@ static noinline void __init kernel_init_freeable(void)
+@@ -1015,11 +1056,13 @@ static noinline void __init kernel_init_freeable(void)
if (!ramdisk_execute_command)
ramdisk_execute_command = "/init";
@@ -109623,108 +109508,10 @@ index 483cecf..ac46091 100644
ret = -EIO;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 02bece4..43adc29 100644
+index eb11011..43adc29 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
-@@ -98,6 +98,13 @@ struct ftrace_pid {
- struct pid *pid;
- };
-
-+static bool ftrace_pids_enabled(void)
-+{
-+ return !list_empty(&ftrace_pids);
-+}
-+
-+static void ftrace_update_trampoline(struct ftrace_ops *ops);
-+
- /*
- * ftrace_disabled is set when an anomaly is discovered.
- * ftrace_disabled is much stronger than ftrace_enabled.
-@@ -109,7 +116,6 @@ static DEFINE_MUTEX(ftrace_lock);
- static struct ftrace_ops *ftrace_control_list __read_mostly = &ftrace_list_end;
- static struct ftrace_ops *ftrace_ops_list __read_mostly = &ftrace_list_end;
- ftrace_func_t ftrace_trace_function __read_mostly = ftrace_stub;
--ftrace_func_t ftrace_pid_function __read_mostly = ftrace_stub;
- static struct ftrace_ops global_ops;
- static struct ftrace_ops control_ops;
-
-@@ -183,14 +189,7 @@ static void ftrace_pid_func(unsigned long ip, unsigned long parent_ip,
- if (!test_tsk_trace_trace(current))
- return;
-
-- ftrace_pid_function(ip, parent_ip, op, regs);
--}
--
--static void set_ftrace_pid_function(ftrace_func_t func)
--{
-- /* do not set ftrace_pid_function to itself! */
-- if (func != ftrace_pid_func)
-- ftrace_pid_function = func;
-+ op->saved_func(ip, parent_ip, op, regs);
- }
-
- /**
-@@ -202,7 +201,6 @@ static void set_ftrace_pid_function(ftrace_func_t func)
- void clear_ftrace_function(void)
- {
- ftrace_trace_function = ftrace_stub;
-- ftrace_pid_function = ftrace_stub;
- }
-
- static void control_ops_disable_all(struct ftrace_ops *ops)
-@@ -436,6 +434,12 @@ static int __register_ftrace_function(struct ftrace_ops *ops)
- } else
- add_ftrace_ops(&ftrace_ops_list, ops);
-
-+ /* Always save the function, and reset at unregistering */
-+ ops->saved_func = ops->func;
-+
-+ if (ops->flags & FTRACE_OPS_FL_PID && ftrace_pids_enabled())
-+ ops->func = ftrace_pid_func;
-+
- ftrace_update_trampoline(ops);
-
- if (ftrace_enabled)
-@@ -463,15 +467,28 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
- if (ftrace_enabled)
- update_ftrace_function();
-
-+ ops->func = ops->saved_func;
-+
- return 0;
- }
-
- static void ftrace_update_pid_func(void)
- {
-+ bool enabled = ftrace_pids_enabled();
-+ struct ftrace_ops *op;
-+
- /* Only do something if we are tracing something */
- if (ftrace_trace_function == ftrace_stub)
- return;
-
-+ do_for_each_ftrace_op(op, ftrace_ops_list) {
-+ if (op->flags & FTRACE_OPS_FL_PID) {
-+ op->func = enabled ? ftrace_pid_func :
-+ op->saved_func;
-+ ftrace_update_trampoline(op);
-+ }
-+ } while_for_each_ftrace_op(op);
-+
- update_ftrace_function();
- }
-
-@@ -1133,7 +1150,8 @@ static struct ftrace_ops global_ops = {
- .local_hash.filter_hash = EMPTY_HASH,
- INIT_OPS_HASH(global_ops)
- .flags = FTRACE_OPS_FL_RECURSION_SAFE |
-- FTRACE_OPS_FL_INITIALIZED,
-+ FTRACE_OPS_FL_INITIALIZED |
-+ FTRACE_OPS_FL_PID,
- };
-
- /*
-@@ -2395,12 +2413,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
+@@ -2413,12 +2413,17 @@ ftrace_code_disable(struct module *mod, struct dyn_ftrace *rec)
if (unlikely(ftrace_disabled))
return 0;
@@ -109744,7 +109531,7 @@ index 02bece4..43adc29 100644
}
/*
-@@ -4789,8 +4812,10 @@ static int ftrace_process_locs(struct module *mod,
+@@ -4807,8 +4812,10 @@ static int ftrace_process_locs(struct module *mod,
if (!count)
return 0;
@@ -109755,47 +109542,7 @@ index 02bece4..43adc29 100644
start_pg = ftrace_allocate_pages(count);
if (!start_pg)
-@@ -5023,7 +5048,9 @@ static void ftrace_update_trampoline(struct ftrace_ops *ops)
-
- static struct ftrace_ops global_ops = {
- .func = ftrace_stub,
-- .flags = FTRACE_OPS_FL_RECURSION_SAFE | FTRACE_OPS_FL_INITIALIZED,
-+ .flags = FTRACE_OPS_FL_RECURSION_SAFE |
-+ FTRACE_OPS_FL_INITIALIZED |
-+ FTRACE_OPS_FL_PID,
- };
-
- static int __init ftrace_nodyn_init(void)
-@@ -5080,11 +5107,6 @@ void ftrace_init_array_ops(struct trace_array *tr, ftrace_func_t func)
- if (WARN_ON(tr->ops->func != ftrace_stub))
- printk("ftrace ops had %pS for function\n",
- tr->ops->func);
-- /* Only the top level instance does pid tracing */
-- if (!list_empty(&ftrace_pids)) {
-- set_ftrace_pid_function(func);
-- func = ftrace_pid_func;
-- }
- }
- tr->ops->func = func;
- tr->ops->private = tr;
-@@ -5371,7 +5393,7 @@ static void *fpid_start(struct seq_file *m, loff_t *pos)
- {
- mutex_lock(&ftrace_lock);
-
-- if (list_empty(&ftrace_pids) && (!*pos))
-+ if (!ftrace_pids_enabled() && (!*pos))
- return (void *) 1;
-
- return seq_list_start(&ftrace_pids, *pos);
-@@ -5610,6 +5632,7 @@ static struct ftrace_ops graph_ops = {
- .func = ftrace_stub,
- .flags = FTRACE_OPS_FL_RECURSION_SAFE |
- FTRACE_OPS_FL_INITIALIZED |
-+ FTRACE_OPS_FL_PID |
- FTRACE_OPS_FL_STUB,
- #ifdef FTRACE_GRAPH_TRAMP_ADDR
- .trampoline = FTRACE_GRAPH_TRAMP_ADDR,
-@@ -5659,7 +5682,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
+@@ -5675,7 +5682,7 @@ static int alloc_retstack_tasklist(struct ftrace_ret_stack **ret_stack_list)
if (t->ret_stack == NULL) {
atomic_set(&t->tracing_graph_pause, 0);
@@ -109804,7 +109551,7 @@ index 02bece4..43adc29 100644
t->curr_ret_stack = -1;
/* Make sure the tasks see the -1 first: */
smp_wmb();
-@@ -5882,7 +5905,7 @@ static void
+@@ -5898,7 +5905,7 @@ static void
graph_init_task(struct task_struct *t, struct ftrace_ret_stack *ret_stack)
{
atomic_set(&t->tracing_graph_pause, 0);
@@ -110662,10 +110409,10 @@ index 19ea7ed..20cac21 100644
u32 high = divisor >> 32;
u64 quot;
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
-index ae4b65e..daf0230 100644
+index dace71f..13da37b 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
-@@ -979,7 +979,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
+@@ -982,7 +982,7 @@ static int dma_debug_device_change(struct notifier_block *nb, unsigned long acti
void dma_debug_add_bus(struct bus_type *bus)
{
@@ -110674,7 +110421,7 @@ index ae4b65e..daf0230 100644
if (dma_debug_disabled())
return;
-@@ -1161,7 +1161,7 @@ static void check_unmap(struct dma_debug_entry *ref)
+@@ -1164,7 +1164,7 @@ static void check_unmap(struct dma_debug_entry *ref)
static void check_for_stack(struct device *dev, void *addr)
{
@@ -112024,7 +111771,7 @@ index 501820c..9612bcf 100644
}
unset_migratetype_isolate(page, MIGRATE_MOVABLE);
diff --git a/mm/memory.c b/mm/memory.c
-index 2a9e098..f5d6859 100644
+index 2a9e098..4574079 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -414,6 +414,7 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -112407,7 +112154,7 @@ index 2a9e098..f5d6859 100644
* We enter with non-exclusive mmap_sem (to exclude vma changes,
* but allow concurrent faults), and pte mapped but not yet locked.
* We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2663,31 +2854,30 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2663,31 +2854,29 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned int flags)
{
struct mem_cgroup *memcg;
@@ -112423,13 +112170,13 @@ index 2a9e098..f5d6859 100644
+ if (vma->vm_flags & VM_SHARED) {
+ pte_unmap(page_table);
return VM_FAULT_SIGBUS;
--
++ }
+
- /* Check if we need to add a guard page to the stack */
- if (check_stack_guard_page(vma, address) < 0)
- return VM_FAULT_SIGSEGV;
-+ }
-
- /* Use the zero-page for reads */
+-
+- /* Use the zero-page for reads */
if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) {
entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
vma->vm_page_prot));
@@ -112447,7 +112194,7 @@ index 2a9e098..f5d6859 100644
if (unlikely(anon_vma_prepare(vma)))
goto oom;
page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2711,6 +2901,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2711,6 +2900,11 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
if (!pte_none(*page_table))
goto release;
@@ -112459,7 +112206,7 @@ index 2a9e098..f5d6859 100644
inc_mm_counter_fast(mm, MM_ANONPAGES);
page_add_new_anon_rmap(page, vma, address);
mem_cgroup_commit_charge(page, memcg, false);
-@@ -2720,6 +2915,12 @@ setpte:
+@@ -2720,6 +2914,12 @@ setpte:
/* No need to invalidate - it was non-present before */
update_mmu_cache(vma, address, page_table);
@@ -112472,7 +112219,7 @@ index 2a9e098..f5d6859 100644
unlock:
pte_unmap_unlock(page_table, ptl);
return 0;
-@@ -2952,6 +3153,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2952,6 +3152,11 @@ static int do_read_fault(struct mm_struct *mm, struct vm_area_struct *vma,
return ret;
}
do_set_pte(vma, address, fault_page, pte, false, false);
@@ -112484,7 +112231,7 @@ index 2a9e098..f5d6859 100644
unlock_page(fault_page);
unlock_out:
pte_unmap_unlock(pte, ptl);
-@@ -3003,7 +3209,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3003,7 +3208,18 @@ static int do_cow_fault(struct mm_struct *mm, struct vm_area_struct *vma,
}
goto uncharge_out;
}
@@ -112503,7 +112250,7 @@ index 2a9e098..f5d6859 100644
mem_cgroup_commit_charge(new_page, memcg, false);
lru_cache_add_active_or_unevictable(new_page, vma);
pte_unmap_unlock(pte, ptl);
-@@ -3061,6 +3278,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3061,6 +3277,11 @@ static int do_shared_fault(struct mm_struct *mm, struct vm_area_struct *vma,
return ret;
}
do_set_pte(vma, address, fault_page, pte, true, false);
@@ -112515,7 +112262,7 @@ index 2a9e098..f5d6859 100644
pte_unmap_unlock(pte, ptl);
if (set_page_dirty(fault_page))
-@@ -3286,6 +3508,12 @@ static int handle_pte_fault(struct mm_struct *mm,
+@@ -3286,6 +3507,12 @@ static int handle_pte_fault(struct mm_struct *mm,
if (flags & FAULT_FLAG_WRITE)
flush_tlb_fix_spurious_fault(vma, address);
}
@@ -112528,7 +112275,7 @@ index 2a9e098..f5d6859 100644
unlock:
pte_unmap_unlock(pte, ptl);
return 0;
-@@ -3305,9 +3533,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -3305,9 +3532,41 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma,
pmd_t *pmd;
pte_t *pte;
@@ -112570,7 +112317,7 @@ index 2a9e098..f5d6859 100644
pgd = pgd_offset(mm, address);
pud = pud_alloc(mm, pgd, address);
if (!pud)
-@@ -3442,6 +3702,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
+@@ -3442,6 +3701,23 @@ int __pud_alloc(struct mm_struct *mm, pgd_t *pgd, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -112594,7 +112341,7 @@ index 2a9e098..f5d6859 100644
#endif /* __PAGETABLE_PUD_FOLDED */
#ifndef __PAGETABLE_PMD_FOLDED
-@@ -3474,6 +3751,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3474,6 +3750,32 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -112627,7 +112374,7 @@ index 2a9e098..f5d6859 100644
#endif /* __PAGETABLE_PMD_FOLDED */
static int __follow_pte(struct mm_struct *mm, unsigned long address,
-@@ -3583,8 +3886,8 @@ out:
+@@ -3583,8 +3885,8 @@ out:
return ret;
}
@@ -112638,7 +112385,7 @@ index 2a9e098..f5d6859 100644
{
resource_size_t phys_addr;
unsigned long prot = 0;
-@@ -3610,8 +3913,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
+@@ -3610,8 +3912,8 @@ EXPORT_SYMBOL_GPL(generic_access_phys);
* Access another process' address space as given in mm. If non-NULL, use the
* given task for page fault accounting.
*/
@@ -112649,7 +112396,7 @@ index 2a9e098..f5d6859 100644
{
struct vm_area_struct *vma;
void *old_buf = buf;
-@@ -3619,7 +3922,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3619,7 +3921,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
down_read(&mm->mmap_sem);
/* ignore errors, just check how much was successfully transferred */
while (len) {
@@ -112658,7 +112405,7 @@ index 2a9e098..f5d6859 100644
void *maddr;
struct page *page = NULL;
-@@ -3680,8 +3983,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+@@ -3680,8 +3982,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
*
* The caller must hold a reference on @mm.
*/
@@ -112669,7 +112416,7 @@ index 2a9e098..f5d6859 100644
{
return __access_remote_vm(NULL, mm, addr, buf, len, write);
}
-@@ -3691,11 +3994,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+@@ -3691,11 +3993,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
* Source/target buffer must be kernel space,
* Do not walk the page table directly, use get_user_pages
*/
@@ -114916,7 +114663,7 @@ index 47d536e..8321b4e 100644
return -ENOMEM;
diff --git a/mm/slab.c b/mm/slab.c
-index 7eb38dd..a5172b1 100644
+index 7eb38dd..5dee2c4 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -314,10 +314,12 @@ static void kmem_cache_node_init(struct kmem_cache_node *parent)
@@ -115046,7 +114793,7 @@ index 7eb38dd..a5172b1 100644
#endif
}
-@@ -4210,13 +4237,69 @@ static const struct file_operations proc_slabstats_operations = {
+@@ -4210,13 +4237,80 @@ static const struct file_operations proc_slabstats_operations = {
static int __init slab_proc_init(void)
{
#ifdef CONFIG_DEBUG_SLAB_LEAK
@@ -115069,6 +114816,17 @@ index 7eb38dd..a5172b1 100644
+ if (!slab_is_available())
+ return false;
+
++ if (is_vmalloc_addr(ptr)
++#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
++ && !object_starts_on_stack(ptr)
++#endif
++ ) {
++ struct vm_struct *vm = find_vm_area(ptr);
++ if (vm && (vm->flags & VM_USERCOPY))
++ return true;
++ return false;
++ }
++
+ if (!virt_addr_valid(ptr))
+ return false;
+
@@ -115382,7 +115140,7 @@ index 999bb34..9843aea 100644
{
void *ret;
diff --git a/mm/slob.c b/mm/slob.c
-index 4765f65..fafa9d5 100644
+index 4765f65..f17284d 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -157,7 +157,7 @@ static void set_slob(slob_t *s, slobidx_t size, slob_t *next)
@@ -115556,7 +115314,7 @@ index 4765f65..fafa9d5 100644
{
return __do_kmalloc_node(size, gfp, NUMA_NO_NODE, _RET_IP_);
}
-@@ -491,34 +515,112 @@ void kfree(const void *block)
+@@ -491,34 +515,123 @@ void kfree(const void *block)
return;
kmemleak_free(block);
@@ -115585,6 +115343,17 @@ index 4765f65..fafa9d5 100644
+ if (!slab_is_available())
+ return false;
+
++ if (is_vmalloc_addr(ptr)
++#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
++ && !object_starts_on_stack(ptr)
++#endif
++ ) {
++ struct vm_struct *vm = find_vm_area(ptr);
++ if (vm && (vm->flags & VM_USERCOPY))
++ return true;
++ return false;
++ }
++
+ // PAX: TODO
+
+ return false;
@@ -115678,7 +115447,7 @@ index 4765f65..fafa9d5 100644
}
EXPORT_SYMBOL(ksize);
-@@ -534,23 +636,33 @@ int __kmem_cache_create(struct kmem_cache *c, unsigned long flags)
+@@ -534,23 +647,33 @@ int __kmem_cache_create(struct kmem_cache *c, unsigned long flags)
static void *slob_alloc_node(struct kmem_cache *c, gfp_t flags, int node)
{
@@ -115714,7 +115483,7 @@ index 4765f65..fafa9d5 100644
if (b && c->ctor)
c->ctor(b);
-@@ -566,7 +678,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
+@@ -566,7 +689,7 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
EXPORT_SYMBOL(kmem_cache_alloc);
#ifdef CONFIG_NUMA
@@ -115723,7 +115492,7 @@ index 4765f65..fafa9d5 100644
{
return __do_kmalloc_node(size, gfp, node, _RET_IP_);
}
-@@ -579,12 +691,16 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t gfp, int node)
+@@ -579,12 +702,16 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t gfp, int node)
EXPORT_SYMBOL(kmem_cache_alloc_node);
#endif
@@ -115744,7 +115513,7 @@ index 4765f65..fafa9d5 100644
}
static void kmem_rcu_free(struct rcu_head *head)
-@@ -592,22 +708,36 @@ static void kmem_rcu_free(struct rcu_head *head)
+@@ -592,22 +719,36 @@ static void kmem_rcu_free(struct rcu_head *head)
struct slob_rcu *slob_rcu = (struct slob_rcu *)head;
void *b = (void *)slob_rcu - (slob_rcu->size - sizeof(struct slob_rcu));
@@ -115786,7 +115555,7 @@ index 4765f65..fafa9d5 100644
EXPORT_SYMBOL(kmem_cache_free);
diff --git a/mm/slub.c b/mm/slub.c
-index 54c0876..31383a1 100644
+index 54c0876..9fb1661 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -198,7 +198,7 @@ struct track {
@@ -115850,7 +115619,7 @@ index 54c0876..31383a1 100644
{
struct kmem_cache *s;
void *ret;
-@@ -3388,6 +3399,59 @@ static size_t __ksize(const void *object)
+@@ -3388,6 +3399,70 @@ static size_t __ksize(const void *object)
return slab_ksize(page->slab_cache);
}
@@ -115865,6 +115634,17 @@ index 54c0876..31383a1 100644
+ if (!slab_is_available())
+ return false;
+
++ if (is_vmalloc_addr(ptr)
++#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
++ && !object_starts_on_stack(ptr)
++#endif
++ ) {
++ struct vm_struct *vm = find_vm_area(ptr);
++ if (vm && (vm->flags & VM_USERCOPY))
++ return true;
++ return false;
++ }
++
+ if (!virt_addr_valid(ptr))
+ return false;
+
@@ -115910,7 +115690,7 @@ index 54c0876..31383a1 100644
size_t ksize(const void *object)
{
size_t size = __ksize(object);
-@@ -3408,6 +3472,7 @@ void kfree(const void *x)
+@@ -3408,6 +3483,7 @@ void kfree(const void *x)
if (unlikely(ZERO_OR_NULL_PTR(x)))
return;
@@ -115918,7 +115698,7 @@ index 54c0876..31383a1 100644
page = virt_to_head_page(x);
if (unlikely(!PageSlab(page))) {
BUG_ON(!PageCompound(page));
-@@ -3724,7 +3789,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -3724,7 +3800,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
s = find_mergeable(size, align, flags, name, ctor);
if (s) {
@@ -115927,7 +115707,7 @@ index 54c0876..31383a1 100644
/*
* Adjust the object sizes so that we clear
-@@ -3740,7 +3805,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
+@@ -3740,7 +3816,7 @@ __kmem_cache_alias(const char *name, size_t size, size_t align,
}
if (sysfs_slab_alias(s, name)) {
@@ -115936,7 +115716,7 @@ index 54c0876..31383a1 100644
s = NULL;
}
}
-@@ -3857,7 +3922,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
+@@ -3857,7 +3933,7 @@ void *__kmalloc_node_track_caller(size_t size, gfp_t gfpflags,
}
#endif
@@ -115945,7 +115725,7 @@ index 54c0876..31383a1 100644
static int count_inuse(struct page *page)
{
return page->inuse;
-@@ -4138,7 +4203,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
+@@ -4138,7 +4214,11 @@ static int list_locations(struct kmem_cache *s, char *buf,
len += sprintf(buf + len, "%7ld ", l->count);
if (l->addr)
@@ -115957,7 +115737,7 @@ index 54c0876..31383a1 100644
else
len += sprintf(buf + len, "<not-available>");
-@@ -4236,12 +4305,12 @@ static void __init resiliency_test(void)
+@@ -4236,12 +4316,12 @@ static void __init resiliency_test(void)
validate_slab_cache(kmalloc_caches[9]);
}
#else
@@ -115972,7 +115752,7 @@ index 54c0876..31383a1 100644
enum slab_stat_type {
SL_ALL, /* All slabs */
SL_PARTIAL, /* Only partially allocated slabs */
-@@ -4478,13 +4547,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
+@@ -4478,13 +4558,17 @@ static ssize_t ctor_show(struct kmem_cache *s, char *buf)
{
if (!s->ctor)
return 0;
@@ -115991,7 +115771,7 @@ index 54c0876..31383a1 100644
}
SLAB_ATTR_RO(aliases);
-@@ -4572,6 +4645,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
+@@ -4572,6 +4656,22 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
SLAB_ATTR_RO(cache_dma);
#endif
@@ -116014,7 +115794,7 @@ index 54c0876..31383a1 100644
static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
{
return sprintf(buf, "%d\n", !!(s->flags & SLAB_DESTROY_BY_RCU));
-@@ -4627,7 +4716,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
+@@ -4627,7 +4727,7 @@ static ssize_t trace_store(struct kmem_cache *s, const char *buf,
* as well as cause other issues like converting a mergeable
* cache into an umergeable one.
*/
@@ -116023,7 +115803,7 @@ index 54c0876..31383a1 100644
return -EINVAL;
s->flags &= ~SLAB_TRACE;
-@@ -4747,7 +4836,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
+@@ -4747,7 +4847,7 @@ static ssize_t failslab_show(struct kmem_cache *s, char *buf)
static ssize_t failslab_store(struct kmem_cache *s, const char *buf,
size_t length)
{
@@ -116032,7 +115812,7 @@ index 54c0876..31383a1 100644
return -EINVAL;
s->flags &= ~SLAB_FAILSLAB;
-@@ -4914,6 +5003,12 @@ static struct attribute *slab_attrs[] = {
+@@ -4914,6 +5014,12 @@ static struct attribute *slab_attrs[] = {
#ifdef CONFIG_ZONE_DMA
&cache_dma_attr.attr,
#endif
@@ -116045,7 +115825,7 @@ index 54c0876..31383a1 100644
#ifdef CONFIG_NUMA
&remote_node_defrag_ratio_attr.attr,
#endif
-@@ -5155,6 +5250,7 @@ static char *create_unique_id(struct kmem_cache *s)
+@@ -5155,6 +5261,7 @@ static char *create_unique_id(struct kmem_cache *s)
return name;
}
@@ -116053,7 +115833,7 @@ index 54c0876..31383a1 100644
static int sysfs_slab_add(struct kmem_cache *s)
{
int err;
-@@ -5228,6 +5324,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
+@@ -5228,6 +5335,7 @@ void sysfs_slab_remove(struct kmem_cache *s)
kobject_del(&s->kobj);
kobject_put(&s->kobj);
}
@@ -116061,7 +115841,7 @@ index 54c0876..31383a1 100644
/*
* Need to buffer aliases during bootup until sysfs becomes
-@@ -5241,6 +5338,7 @@ struct saved_alias {
+@@ -5241,6 +5349,7 @@ struct saved_alias {
static struct saved_alias *alias_list;
@@ -116069,7 +115849,7 @@ index 54c0876..31383a1 100644
static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
{
struct saved_alias *al;
-@@ -5263,6 +5361,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
+@@ -5263,6 +5372,7 @@ static int sysfs_slab_alias(struct kmem_cache *s, const char *name)
alias_list = al;
return 0;
}
@@ -116204,7 +115984,7 @@ index 68ff8a5..40c7a70 100644
if (len > buflen)
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
-index 2faaa29..9744185 100644
+index 2faaa29..37314a8 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -40,20 +40,65 @@ struct vfree_deferred {
@@ -116498,7 +116278,22 @@ index 2faaa29..9744185 100644
area = __get_vm_area_node(size, align, VM_ALLOC | VM_UNINITIALIZED |
vm_flags, start, end, node, gfp_mask, caller);
if (!area)
-@@ -1838,10 +1979,9 @@ EXPORT_SYMBOL(vzalloc_node);
+@@ -1715,6 +1856,14 @@ static void *__vmalloc_node(unsigned long size, unsigned long align,
+ gfp_mask, prot, 0, node, caller);
+ }
+
++void *vmalloc_usercopy(unsigned long size)
++{
++ return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END,
++ GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
++ VM_USERCOPY, NUMA_NO_NODE,
++ __builtin_return_address(0));
++}
++
+ void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
+ {
+ return __vmalloc_node(size, 1, gfp_mask, prot, NUMA_NO_NODE,
+@@ -1838,10 +1987,9 @@ EXPORT_SYMBOL(vzalloc_node);
* For tight control over page level allocator and protection flags
* use __vmalloc() instead.
*/
@@ -116510,7 +116305,7 @@ index 2faaa29..9744185 100644
NUMA_NO_NODE, __builtin_return_address(0));
}
-@@ -2148,6 +2288,8 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
+@@ -2148,6 +2296,8 @@ int remap_vmalloc_range_partial(struct vm_area_struct *vma, unsigned long uaddr,
{
struct vm_struct *area;
@@ -116519,7 +116314,7 @@ index 2faaa29..9744185 100644
size = PAGE_ALIGN(size);
if (!PAGE_ALIGNED(uaddr) || !PAGE_ALIGNED(kaddr))
-@@ -2630,7 +2772,11 @@ static int s_show(struct seq_file *m, void *p)
+@@ -2630,7 +2780,11 @@ static int s_show(struct seq_file *m, void *p)
v->addr, v->addr + v->size, v->size);
if (v->caller)
@@ -117188,10 +116983,28 @@ index e29ad70b..cc00066 100644
if (ip.proto == htons(ETH_P_IP)) {
if (timer_pending(&br->ip4_other_query.timer))
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
-index 4b5c236..0627070 100644
+index 4b5c236..f303683 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
-@@ -841,7 +841,7 @@ static struct rtnl_af_ops br_af_ops __read_mostly = {
+@@ -112,6 +112,8 @@ static inline size_t br_port_info_size(void)
+ + nla_total_size(1) /* IFLA_BRPORT_FAST_LEAVE */
+ + nla_total_size(1) /* IFLA_BRPORT_LEARNING */
+ + nla_total_size(1) /* IFLA_BRPORT_UNICAST_FLOOD */
++ + nla_total_size(1) /* IFLA_BRPORT_PROXYARP */
++ + nla_total_size(1) /* IFLA_BRPORT_PROXYARP_WIFI */
+ + 0;
+ }
+
+@@ -504,6 +506,8 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
+ [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
+ [IFLA_BRPORT_LEARNING] = { .type = NLA_U8 },
+ [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
++ [IFLA_BRPORT_PROXYARP] = { .type = NLA_U8 },
++ [IFLA_BRPORT_PROXYARP_WIFI] = { .type = NLA_U8 },
+ };
+
+ /* Change the state of the port and notify spanning tree */
+@@ -841,7 +845,7 @@ static struct rtnl_af_ops br_af_ops __read_mostly = {
.get_link_af_size = br_get_link_af_size,
};
@@ -117288,10 +117101,10 @@ index 67a4a36..8d28068 100644
.priv_size = sizeof(struct chnl_net),
.setup = ipcaif_net_setup,
diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 689c818..6323851 100644
+index 62c635f..0b59618 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
-@@ -888,7 +888,7 @@ static const struct net_proto_family can_family_ops = {
+@@ -890,7 +890,7 @@ static const struct net_proto_family can_family_ops = {
};
/* notifier block for netdevice event */
@@ -117301,10 +117114,10 @@ index 689c818..6323851 100644
};
diff --git a/net/can/bcm.c b/net/can/bcm.c
-index b523453..f96e639 100644
+index a1ba687..aafaec5 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
-@@ -1618,7 +1618,7 @@ static int __init bcm_module_init(void)
+@@ -1620,7 +1620,7 @@ static int __init bcm_module_init(void)
}
/* create /proc/net/can-bcm directory */
@@ -117489,19 +117302,19 @@ index 5cfd26a..7e43828 100644
a0 = a[0];
a1 = a[1];
diff --git a/net/core/datagram.c b/net/core/datagram.c
-index b80fb91..d9f4ea5 100644
+index b80fb91..0364f4f 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -131,6 +131,35 @@ out_noerr:
goto out;
}
-+static int skb_set_peeked(struct sk_buff *skb)
++static struct sk_buff *skb_set_peeked(struct sk_buff *skb)
+{
+ struct sk_buff *nskb;
+
+ if (skb->peeked)
-+ return 0;
++ return skb;
+
+ /* We have to unshare an skb before modifying it. */
+ if (!skb_shared(skb))
@@ -117509,7 +117322,7 @@ index b80fb91..d9f4ea5 100644
+
+ nskb = skb_clone(skb, GFP_ATOMIC);
+ if (!nskb)
-+ return -ENOMEM;
++ return ERR_PTR(-ENOMEM);
+
+ skb->prev->next = nskb;
+ skb->next->prev = nskb;
@@ -117522,7 +117335,7 @@ index b80fb91..d9f4ea5 100644
+done:
+ skb->peeked = 1;
+
-+ return 0;
++ return skb;
+}
+
/**
@@ -117547,20 +117360,21 @@ index b80fb91..d9f4ea5 100644
int _off = *off;
last = (struct sk_buff *)queue;
-@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -199,7 +228,12 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
_off -= skb->len;
continue;
}
- skb->peeked = 1;
+
-+ error = skb_set_peeked(skb);
-+ if (error)
++ skb = skb_set_peeked(skb);
++ error = PTR_ERR(skb);
++ if (IS_ERR(skb))
+ goto unlock_err;
+
atomic_inc(&skb->users);
} else
__skb_unlink(skb, queue);
-@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
+@@ -223,6 +257,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
return NULL;
@@ -117569,7 +117383,7 @@ index b80fb91..d9f4ea5 100644
no_packet:
*err = error;
return NULL;
-@@ -302,7 +337,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+@@ -302,7 +338,7 @@ int skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
}
kfree_skb(skb);
@@ -117578,7 +117392,7 @@ index b80fb91..d9f4ea5 100644
sk_mem_reclaim_partial(sk);
return err;
-@@ -622,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
+@@ -622,7 +658,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
!skb->csum_complete_sw)
netdev_rx_csum_fault(skb->dev);
}
@@ -117588,7 +117402,7 @@ index b80fb91..d9f4ea5 100644
return sum;
}
EXPORT_SYMBOL(__skb_checksum_complete_head);
-@@ -642,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
+@@ -642,11 +679,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
netdev_rx_csum_fault(skb->dev);
}
@@ -122031,6 +121845,19 @@ index 1b981a4..ae44b0c 100644
}
#endif
+diff --git a/net/rds/info.c b/net/rds/info.c
+index 9a6b4f6..140a44a 100644
+--- a/net/rds/info.c
++++ b/net/rds/info.c
+@@ -176,7 +176,7 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
+
+ /* check for all kinds of wrapping and the like */
+ start = (unsigned long)optval;
+- if (len < 0 || len + PAGE_SIZE - 1 < len || start + len < start) {
++ if (len < 0 || len > INT_MAX - PAGE_SIZE + 1 || start + len < start) {
+ ret = -EINVAL;
+ goto out;
+ }
diff --git a/net/rds/iw.h b/net/rds/iw.h
index cbe6674..dc9eb89 100644
--- a/net/rds/iw.h
@@ -126162,7 +125989,7 @@ index b48b434..e2ba787 100644
if (err < 0)
return err;
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
-index d126c03..5d84d1cf 100644
+index 75888dd..c940854 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -3004,11 +3004,11 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream,
@@ -133745,10 +133572,10 @@ index 0000000..b8e7188
+}
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
new file mode 100644
-index 0000000..e445f02
+index 0000000..ed2d97b
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,28384 @@
+@@ -0,0 +1,28385 @@
+intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL nohasharray
+iwl_set_tx_power_1 iwl_set_tx_power 0 1 &intel_fake_agp_alloc_by_type_1
+ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
@@ -137372,6 +137199,7 @@ index 0000000..e445f02
+generic_write_sync_8358 generic_write_sync 0 8358 NULL
+qlcnic_open_8359 qlcnic_open 0 8359 NULL
+isku_sysfs_write_talk_8360 isku_sysfs_write_talk 6-0-5 8360 NULL
++vmalloc_usercopy_8361 vmalloc_usercopy 1 8361 NULL
+ath6kl_lrssi_roam_write_8362 ath6kl_lrssi_roam_write 3-0 8362 NULL nohasharray
+batadv_sysfs_add_vlan_8362 batadv_sysfs_add_vlan 0 8362 &ath6kl_lrssi_roam_write_8362
+alloc_sleep_millisecs_store_8364 alloc_sleep_millisecs_store 0-4 8364 NULL
diff --git a/3.14.49/4425_grsec_remove_EI_PAX.patch b/4.1.5/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.14.49/4425_grsec_remove_EI_PAX.patch
rename to 4.1.5/4425_grsec_remove_EI_PAX.patch
diff --git a/4.1.4/4427_force_XATTR_PAX_tmpfs.patch b/4.1.5/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 4.1.4/4427_force_XATTR_PAX_tmpfs.patch
rename to 4.1.5/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.14.49/4430_grsec-remove-localversion-grsec.patch b/4.1.5/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.14.49/4430_grsec-remove-localversion-grsec.patch
rename to 4.1.5/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.1.4/4435_grsec-mute-warnings.patch b/4.1.5/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 4.1.4/4435_grsec-mute-warnings.patch
rename to 4.1.5/4435_grsec-mute-warnings.patch
diff --git a/3.14.49/4440_grsec-remove-protected-paths.patch b/4.1.5/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.14.49/4440_grsec-remove-protected-paths.patch
rename to 4.1.5/4440_grsec-remove-protected-paths.patch
diff --git a/4.1.4/4450_grsec-kconfig-default-gids.patch b/4.1.5/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 4.1.4/4450_grsec-kconfig-default-gids.patch
rename to 4.1.5/4450_grsec-kconfig-default-gids.patch
diff --git a/4.1.4/4465_selinux-avc_audit-log-curr_ip.patch b/4.1.5/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 4.1.4/4465_selinux-avc_audit-log-curr_ip.patch
rename to 4.1.5/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.1.4/4470_disable-compat_vdso.patch b/4.1.5/4470_disable-compat_vdso.patch
similarity index 100%
rename from 4.1.4/4470_disable-compat_vdso.patch
rename to 4.1.5/4470_disable-compat_vdso.patch
diff --git a/3.14.49/4475_emutramp_default_on.patch b/4.1.5/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.14.49/4475_emutramp_default_on.patch
rename to 4.1.5/4475_emutramp_default_on.patch
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2015-08-12 2:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2015-08-12 2:10 [gentoo-commits] proj/hardened-patchset:master commit in: 4.1.4/, 3.14.49/, 3.2.70/, 3.2.69/, 4.1.5/, 3.14.50/ Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox