* [gentoo-commits] proj/hardened-patchset:master commit in: 3.8.6/, 2.6.32/, 3.2.43/, 3.2.42/
@ 2013-04-12 0:58 Anthony G. Basile
0 siblings, 0 replies; only message in thread
From: Anthony G. Basile @ 2013-04-12 0:58 UTC (permalink / raw
To: gentoo-commits
commit: 105861ea220b674c7d4833551cf63194fd26f222
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Thu Apr 11 22:48:09 2013 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Fri Apr 12 00:57:26 2013 +0000
URL: http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-patchset.git;a=commit;h=105861ea
Grsec/PaX: 2.9.1-{2.6.32.60,3.2.43,3.8.6}-201304102034
---
2.6.32/0000_README | 2 +-
..._grsecurity-2.9.1-2.6.32.60-201304102018.patch} | 225 +-
2.6.32/4450_grsec-kconfig-default-gids.patch | 12 +-
2.6.32/4465_selinux-avc_audit-log-curr_ip.patch | 2 +-
{3.2.42 => 3.2.43}/0000_README | 6 +-
{3.2.42 => 3.2.43}/1021_linux-3.2.22.patch | 0
{3.2.42 => 3.2.43}/1022_linux-3.2.23.patch | 0
{3.2.42 => 3.2.43}/1023_linux-3.2.24.patch | 0
{3.2.42 => 3.2.43}/1024_linux-3.2.25.patch | 0
{3.2.42 => 3.2.43}/1025_linux-3.2.26.patch | 0
{3.2.42 => 3.2.43}/1026_linux-3.2.27.patch | 0
{3.2.42 => 3.2.43}/1027_linux-3.2.28.patch | 0
{3.2.42 => 3.2.43}/1028_linux-3.2.29.patch | 0
{3.2.42 => 3.2.43}/1029_linux-3.2.30.patch | 0
{3.2.42 => 3.2.43}/1030_linux-3.2.31.patch | 0
{3.2.42 => 3.2.43}/1031_linux-3.2.32.patch | 0
{3.2.42 => 3.2.43}/1032_linux-3.2.33.patch | 0
{3.2.42 => 3.2.43}/1033_linux-3.2.34.patch | 0
{3.2.42 => 3.2.43}/1034_linux-3.2.35.patch | 0
{3.2.42 => 3.2.43}/1035_linux-3.2.36.patch | 0
{3.2.42 => 3.2.43}/1036_linux-3.2.37.patch | 0
{3.2.42 => 3.2.43}/1037_linux-3.2.38.patch | 0
{3.2.42 => 3.2.43}/1038_linux-3.2.39.patch | 0
{3.2.42 => 3.2.43}/1039_linux-3.2.40.patch | 0
{3.2.42 => 3.2.43}/1040_linux-3.2.41.patch | 0
{3.2.42 => 3.2.43}/1041_linux-3.2.42.patch | 0
3.2.43/1042_linux-3.2.43.patch | 2442 +++++++++
...4420_grsecurity-2.9.1-3.2.43-201304102033.patch | 872 ++--
{3.2.42 => 3.2.43}/4425_grsec_remove_EI_PAX.patch | 2 +-
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.2.42 => 3.2.43}/4435_grsec-mute-warnings.patch | 2 +-
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 20 +-
.../4465_selinux-avc_audit-log-curr_ip.patch | 2 +-
{3.2.42 => 3.2.43}/4470_disable-compat_vdso.patch | 2 +-
3.8.6/0000_README | 10 +-
3.8.6/1004_linux-3.8.5.patch | 3805 -------------
3.8.6/1005_linux-3.8.6.patch | 5592 --------------------
...4420_grsecurity-2.9.1-3.8.6-201304102034.patch} | 629 ++-
3.8.6/4425_grsec_remove_EI_PAX.patch | 2 +-
3.8.6/4435_grsec-mute-warnings.patch | 2 +-
3.8.6/4450_grsec-kconfig-default-gids.patch | 20 +-
3.8.6/4465_selinux-avc_audit-log-curr_ip.patch | 2 +-
3.8.6/4470_disable-compat_vdso.patch | 2 +-
44 files changed, 3744 insertions(+), 9909 deletions(-)
diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index 913d7a0..3154c9f 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -34,7 +34,7 @@ Patch: 1059_linux-2.6.32.60.patch
From: http://www.kernel.org
Desc: Linux 2.6.32.59
-Patch: 4420_grsecurity-2.9.1-2.6.32.60-201304052259.patch
+Patch: 4420_grsecurity-2.9.1-2.6.32.60-201304102018.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304052259.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304102018.patch
similarity index 99%
rename from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304052259.patch
rename to 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304102018.patch
index 5300fa4..a2bcf7d 100644
--- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304052259.patch
+++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201304102018.patch
@@ -1297,19 +1297,10 @@ index 2dfb7d7..8fadd73 100644
/*
* Change these and you break ASM code in entry-common.S
diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h
-index 1d6bd40..fba0cb9 100644
+index 1d6bd40..159316f 100644
--- a/arch/arm/include/asm/uaccess.h
+++ b/arch/arm/include/asm/uaccess.h
-@@ -22,6 +22,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The exception table consists of pairs of addresses: the first is the
- * address of an instruction that is allowed to fault, and the second is
-@@ -387,8 +389,23 @@ do { \
+@@ -387,8 +387,23 @@ do { \
#ifdef CONFIG_MMU
@@ -1335,7 +1326,7 @@ index 1d6bd40..fba0cb9 100644
extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
-@@ -403,6 +420,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
+@@ -403,6 +418,9 @@ extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
{
@@ -1345,7 +1336,7 @@ index 1d6bd40..fba0cb9 100644
if (access_ok(VERIFY_READ, from, n))
n = __copy_from_user(to, from, n);
else /* security hole - plug it */
-@@ -412,6 +432,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
+@@ -412,6 +430,9 @@ static inline unsigned long __must_check copy_from_user(void *to, const void __u
static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
{
@@ -2501,19 +2492,10 @@ index 239ecdc..f94170e 100644
static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..50cdf87 100644
+index 449c8c0..18965fb 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
-@@ -42,6 +42,8 @@
- #include <asm/pgtable.h>
- #include <asm/io.h>
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * For historical reasons, the following macros are grossly misnamed:
- */
-@@ -240,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
+@@ -240,12 +240,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
static inline unsigned long
__copy_to_user (void __user *to, const void *from, unsigned long count)
{
@@ -2538,7 +2520,7 @@ index 449c8c0..50cdf87 100644
return __copy_user((__force void __user *) to, from, count);
}
-@@ -255,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -255,10 +267,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void __user *__cu_to = (to); \
const void *__cu_from = (from); \
@@ -2554,7 +2536,7 @@ index 449c8c0..50cdf87 100644
__cu_len; \
})
-@@ -266,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -266,11 +281,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void *__cu_to = (to); \
const void __user *__cu_from = (from); \
@@ -2685,6 +2667,19 @@ index 1481b0a..e7d38ff 100644
mod->arch.gp = gp;
DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
}
+diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
+index fdf6f9d..dae10ed 100644
+--- a/arch/ia64/kernel/palinfo.c
++++ b/arch/ia64/kernel/palinfo.c
+@@ -977,7 +977,7 @@ create_palinfo_proc_entries(unsigned int cpu)
+ struct proc_dir_entry **pdir;
+ struct proc_dir_entry *cpu_dir;
+ int j;
+- char cpustr[sizeof(CPUSTR)];
++ char cpustr[3+4+1];
+
+
+ /*
diff --git a/arch/ia64/kernel/pci-dma.c b/arch/ia64/kernel/pci-dma.c
index f6b1ff0..de773fb 100644
--- a/arch/ia64/kernel/pci-dma.c
@@ -4374,19 +4369,10 @@ index aa9d383..0380a05 100644
#define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
_TIF_NOTIFY_RESUME)
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index bd0fb84..a42a14b 100644
+index bd0fb84..1f2d065 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
-@@ -13,6 +13,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -327,52 +329,6 @@ do { \
+@@ -327,52 +327,6 @@ do { \
extern unsigned long __copy_tofrom_user(void __user *to,
const void __user *from, unsigned long size);
@@ -4439,7 +4425,7 @@ index bd0fb84..a42a14b 100644
static inline unsigned long __copy_from_user_inatomic(void *to,
const void __user *from, unsigned long n)
{
-@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
+@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
if (ret == 0)
return 0;
}
@@ -4450,7 +4436,7 @@ index bd0fb84..a42a14b 100644
return __copy_tofrom_user((__force void __user *)to, from, n);
}
-@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
+@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
if (ret == 0)
return 0;
}
@@ -4461,7 +4447,7 @@ index bd0fb84..a42a14b 100644
return __copy_tofrom_user(to, (__force const void __user *)from, n);
}
-@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
+@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_user(void __user *to,
return __copy_to_user_inatomic(to, from, size);
}
@@ -6564,20 +6550,13 @@ index f78ad9a..a3213ed 100644
* Thread-synchronous status.
*
diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
-index e88fbe5..96b0ce5 100644
+index e88fbe5..bd0eda7 100644
--- a/arch/sparc/include/asm/uaccess.h
+++ b/arch/sparc/include/asm/uaccess.h
-@@ -1,5 +1,13 @@
+@@ -1,5 +1,6 @@
#ifndef ___ASM_SPARC_UACCESS_H
#define ___ASM_SPARC_UACCESS_H
+
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#include <linux/types.h>
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+#endif
-+#endif
-+
#if defined(__sparc__) && defined(__arch64__)
#include <asm/uaccess_64.h>
#else
@@ -7365,6 +7344,82 @@ index 3792099..2af17d8 100644
regs->tpc, (void *) regs->tpc);
}
}
+diff --git a/arch/sparc/kernel/us3_cpufreq.c b/arch/sparc/kernel/us3_cpufreq.c
+index 365b646..624f037 100644
+--- a/arch/sparc/kernel/us3_cpufreq.c
++++ b/arch/sparc/kernel/us3_cpufreq.c
+@@ -197,6 +197,20 @@ static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
+ return 0;
+ }
+
++static int __init us3_freq_init(void);
++static void __exit us3_freq_exit(void);
++
++static struct cpufreq_driver _cpufreq_us3_driver = {
++ .init = us3_freq_cpu_init,
++ .verify = us3_freq_verify,
++ .target = us3_freq_target,
++ .get = us3_freq_get,
++ .exit = us3_freq_cpu_exit,
++ .owner = THIS_MODULE,
++ .name = "UltraSPARC-III",
++
++};
++
+ static int __init us3_freq_init(void)
+ {
+ unsigned long manuf, impl, ver;
+@@ -214,39 +228,22 @@ static int __init us3_freq_init(void)
+ impl == CHEETAH_PLUS_IMPL ||
+ impl == JAGUAR_IMPL ||
+ impl == PANTHER_IMPL)) {
+- struct cpufreq_driver *driver;
+-
+ ret = -ENOMEM;
+- driver = kzalloc(sizeof(struct cpufreq_driver), GFP_KERNEL);
+- if (!driver)
+- goto err_out;
+-
+ us3_freq_table = kzalloc(
+ (NR_CPUS * sizeof(struct us3_freq_percpu_info)),
+ GFP_KERNEL);
+ if (!us3_freq_table)
+ goto err_out;
+
+- driver->init = us3_freq_cpu_init;
+- driver->verify = us3_freq_verify;
+- driver->target = us3_freq_target;
+- driver->get = us3_freq_get;
+- driver->exit = us3_freq_cpu_exit;
+- driver->owner = THIS_MODULE,
+- strcpy(driver->name, "UltraSPARC-III");
+-
+- cpufreq_us3_driver = driver;
+- ret = cpufreq_register_driver(driver);
++ cpufreq_us3_driver = &_cpufreq_us3_driver;
++ ret = cpufreq_register_driver(cpufreq_us3_driver);
+ if (ret)
+ goto err_out;
+
+ return 0;
+
+ err_out:
+- if (driver) {
+- kfree(driver);
+- cpufreq_us3_driver = NULL;
+- }
++ cpufreq_us3_driver = NULL;
+ kfree(us3_freq_table);
+ us3_freq_table = NULL;
+ return ret;
+@@ -259,7 +256,6 @@ static void __exit us3_freq_exit(void)
+ {
+ if (cpufreq_us3_driver) {
+ cpufreq_unregister_driver(cpufreq_us3_driver);
+- kfree(cpufreq_us3_driver);
+ cpufreq_us3_driver = NULL;
+ kfree(us3_freq_table);
+ us3_freq_table = NULL;
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index e75faf0..24f12f9 100644
--- a/arch/sparc/lib/Makefile
@@ -86339,7 +86394,7 @@ index 0000000..1b9afa9
+endif
diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
new file mode 100644
-index 0000000..1edd4b5
+index 0000000..8d867c7
--- /dev/null
+++ b/grsecurity/gracl.c
@@ -0,0 +1,4201 @@
@@ -88641,7 +88696,7 @@ index 0000000..1edd4b5
+ return;
+
+ for (i = 0; i < RLIM_NLIMITS; i++) {
-+ if (!(proc->resmask & (1 << i)))
++ if (!(proc->resmask & (1U << i)))
+ continue;
+
+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
@@ -89824,7 +89879,7 @@ index 0000000..1edd4b5
+ acl = task->acl;
+
+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+ !(acl->resmask & (1 << (unsigned short) res))))
++ !(acl->resmask & (1U << (unsigned short) res))))
+ return;
+
+ if (wanted >= acl->res[res].rlim_cur) {
@@ -91201,10 +91256,10 @@ index 0000000..5a3ac97
+}
diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
new file mode 100644
-index 0000000..dd925aa
+index 0000000..b6b5239
--- /dev/null
+++ b/grsecurity/gracl_ip.c
-@@ -0,0 +1,385 @@
+@@ -0,0 +1,388 @@
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
+#include <asm/errno.h>
@@ -91312,7 +91367,7 @@ index 0000000..dd925aa
+
+ curr = current->acl;
+
-+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
++ if (curr->sock_families[domain / 32] & (1U << (domain % 32))) {
+ /* the family is allowed, if this is PF_INET allow it only if
+ the extra sock type/protocol checks pass */
+ if (domain == PF_INET)
@@ -91339,8 +91394,8 @@ index 0000000..dd925aa
+ if (!curr->ips)
+ goto exit;
+
-+ if ((curr->ip_type & (1 << type)) &&
-+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++ if ((curr->ip_type & (1U << type)) &&
++ (curr->ip_proto[protocol / 32] & (1U << (protocol % 32))))
+ goto exit;
+
+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
@@ -91377,6 +91432,9 @@ index 0000000..dd925aa
+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
+ else
++#ifndef CONFIG_IPV6
++ if (domain != PF_INET6)
++#endif
+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
+ gr_socktype_to_name(type), protocol);
+
@@ -91392,8 +91450,8 @@ index 0000000..dd925aa
+ (ip_port <= ip->high) &&
+ ((ntohl(ip_addr) & our_netmask) ==
+ (ntohl(our_addr) & our_netmask))
-+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+ && (ip->type & (1 << type))) {
++ && (ip->proto[protocol / 32] & (1U << (protocol % 32)))
++ && (ip->type & (1U << type))) {
+ if (ip->mode & GR_INVERT)
+ return 2; // specifically denied
+ else
@@ -91879,7 +91937,7 @@ index 0000000..70b2179
+}
diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
new file mode 100644
-index 0000000..1d1b734
+index 0000000..6bb1860
--- /dev/null
+++ b/grsecurity/gracl_segv.c
@@ -0,0 +1,284 @@
@@ -92061,7 +92119,7 @@ index 0000000..1d1b734
+
+ curr = task->acl;
+
-+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
++ if (!(curr->resmask & (1U << GR_CRASH_RES)))
+ return;
+
+ if (time_before_eq(curr->expires, get_seconds())) {
@@ -92127,7 +92185,7 @@ index 0000000..1d1b734
+ current->role);
+ read_unlock(&gr_inode_lock);
+
-+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++ if (!curr || !(curr->resmask & (1U << GR_CRASH_RES)) ||
+ (!curr->crashes && !curr->expires))
+ return 0;
+
@@ -118260,7 +118318,7 @@ index e04c9f8..51bc18e 100644
+ (rtt >> sctp_rto_alpha);
} else {
diff --git a/net/socket.c b/net/socket.c
-index d449812..709474b 100644
+index d449812..4965545 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -87,6 +87,7 @@
@@ -118426,6 +118484,15 @@ index d449812..709474b 100644
err =
security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
if (err)
+@@ -1728,7 +1801,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+ struct socket *sock;
+ struct iovec iov;
+ struct msghdr msg;
+- struct sockaddr_storage address;
++ struct sockaddr_storage address = { };
+ int err, err2;
+ int fput_needed;
+
@@ -1882,6 +1955,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct msghdr __user *, msg, unsigned, flags)
int err, ctl_len, iov_size, total_len;
int fput_needed;
@@ -118453,6 +118520,34 @@ index d449812..709474b 100644
uaddr_len = COMPAT_NAMELEN(msg);
if (MSG_CMSG_COMPAT & flags) {
err = verify_compat_iovec(&msg_sys, iov,
+diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
+index b0c5646..f7b3ca7 100644
+--- a/net/sunrpc/clnt.c
++++ b/net/sunrpc/clnt.c
+@@ -166,10 +166,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
+ err = rpciod_up();
+ if (err)
+ goto out_no_rpciod;
+- err = -EINVAL;
+- if (!xprt)
+- goto out_no_xprt;
+
++ err = -EINVAL;
+ if (args->version >= program->nrvers)
+ goto out_err;
+ version = program->version[args->version];
+@@ -262,10 +260,9 @@ out_no_stats:
+ kfree(clnt->cl_server);
+ kfree(clnt);
+ out_err:
+- xprt_put(xprt);
+-out_no_xprt:
+ rpciod_down();
+ out_no_rpciod:
++ xprt_put(xprt);
+ return ERR_PTR(err);
+ }
+
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 9b3941d..d80b670 100644
--- a/net/sunrpc/sched.c
@@ -119544,7 +119639,7 @@ index d52f7a0..b66cdd9 100755
rm -f tags
xtags ctags
diff --git a/security/Kconfig b/security/Kconfig
-index fb363cd..55a557a 100644
+index fb363cd..f289b7c 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -4,6 +4,896 @@
@@ -120299,7 +120394,7 @@ index fb363cd..55a557a 100644
+
+config PAX_MEMORY_STACKLEAK
+ bool "Sanitize kernel stack"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
++ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN))
+ depends on X86
+ help
+ By saying Y here the kernel will erase the kernel stack before it
diff --git a/2.6.32/4450_grsec-kconfig-default-gids.patch b/2.6.32/4450_grsec-kconfig-default-gids.patch
index a8c8fed..dbd4565 100644
--- a/2.6.32/4450_grsec-kconfig-default-gids.patch
+++ b/2.6.32/4450_grsec-kconfig-default-gids.patch
@@ -16,7 +16,7 @@ from shooting themselves in the foot.
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2012-10-13 09:51:35.000000000 -0400
+++ b/grsecurity/Kconfig 2012-10-13 09:52:32.000000000 -0400
-@@ -554,7 +554,7 @@
+@@ -560,7 +560,7 @@
config GRKERNSEC_AUDIT_GID
int "GID for auditing"
depends on GRKERNSEC_AUDIT_GROUP
@@ -25,7 +25,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
config GRKERNSEC_EXECLOG
bool "Exec logging"
-@@ -774,7 +774,7 @@
+@@ -780,7 +780,7 @@
config GRKERNSEC_TPE_UNTRUSTED_GID
int "GID for TPE-untrusted users"
depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -34,7 +34,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*enabled* for. If the sysctl option is enabled, a sysctl option
-@@ -783,7 +783,7 @@
+@@ -789,7 +789,7 @@
config GRKERNSEC_TPE_TRUSTED_GID
int "GID for TPE-trusted users"
depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -876,7 +876,7 @@
+@@ -882,7 +882,7 @@
config GRKERNSEC_SOCKET_ALL_GID
int "GID to deny all sockets for"
depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Here you can choose the GID to disable socket access for. Remember to
add the users you want socket access disabled for to the GID
-@@ -897,7 +897,7 @@
+@@ -903,7 +903,7 @@
config GRKERNSEC_SOCKET_CLIENT_GID
int "GID to deny client sockets for"
depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Here you can choose the GID to disable client socket access for.
Remember to add the users you want client socket access disabled for to
-@@ -915,7 +915,7 @@
+@@ -921,7 +921,7 @@
config GRKERNSEC_SOCKET_SERVER_GID
int "GID to deny server sockets for"
depends on GRKERNSEC_SOCKET_SERVER
diff --git a/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch b/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
index 583259e..6273202 100644
--- a/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/2.6.32/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2011-04-17 18:47:02.000000000 -0400
+++ b/grsecurity/Kconfig 2011-04-17 18:51:15.000000000 -0400
-@@ -974,6 +974,27 @@
+@@ -980,6 +980,27 @@
menu "Logging Options"
depends on GRKERNSEC
diff --git a/3.2.42/0000_README b/3.2.43/0000_README
similarity index 95%
rename from 3.2.42/0000_README
rename to 3.2.43/0000_README
index 45b1591..6802de9 100644
--- a/3.2.42/0000_README
+++ b/3.2.43/0000_README
@@ -86,7 +86,11 @@ Patch: 1041_linux-3.2.42.patch
From: http://www.kernel.org
Desc: Linux 3.2.42
-Patch: 4420_grsecurity-2.9.1-3.2.42-201304052303.patch
+Patch: 1042_linux-3.2.43.patch
+From: http://www.kernel.org
+Desc: Linux 3.2.43
+
+Patch: 4420_grsecurity-2.9.1-3.2.43-201304102033.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.42/1021_linux-3.2.22.patch b/3.2.43/1021_linux-3.2.22.patch
similarity index 100%
rename from 3.2.42/1021_linux-3.2.22.patch
rename to 3.2.43/1021_linux-3.2.22.patch
diff --git a/3.2.42/1022_linux-3.2.23.patch b/3.2.43/1022_linux-3.2.23.patch
similarity index 100%
rename from 3.2.42/1022_linux-3.2.23.patch
rename to 3.2.43/1022_linux-3.2.23.patch
diff --git a/3.2.42/1023_linux-3.2.24.patch b/3.2.43/1023_linux-3.2.24.patch
similarity index 100%
rename from 3.2.42/1023_linux-3.2.24.patch
rename to 3.2.43/1023_linux-3.2.24.patch
diff --git a/3.2.42/1024_linux-3.2.25.patch b/3.2.43/1024_linux-3.2.25.patch
similarity index 100%
rename from 3.2.42/1024_linux-3.2.25.patch
rename to 3.2.43/1024_linux-3.2.25.patch
diff --git a/3.2.42/1025_linux-3.2.26.patch b/3.2.43/1025_linux-3.2.26.patch
similarity index 100%
rename from 3.2.42/1025_linux-3.2.26.patch
rename to 3.2.43/1025_linux-3.2.26.patch
diff --git a/3.2.42/1026_linux-3.2.27.patch b/3.2.43/1026_linux-3.2.27.patch
similarity index 100%
rename from 3.2.42/1026_linux-3.2.27.patch
rename to 3.2.43/1026_linux-3.2.27.patch
diff --git a/3.2.42/1027_linux-3.2.28.patch b/3.2.43/1027_linux-3.2.28.patch
similarity index 100%
rename from 3.2.42/1027_linux-3.2.28.patch
rename to 3.2.43/1027_linux-3.2.28.patch
diff --git a/3.2.42/1028_linux-3.2.29.patch b/3.2.43/1028_linux-3.2.29.patch
similarity index 100%
rename from 3.2.42/1028_linux-3.2.29.patch
rename to 3.2.43/1028_linux-3.2.29.patch
diff --git a/3.2.42/1029_linux-3.2.30.patch b/3.2.43/1029_linux-3.2.30.patch
similarity index 100%
rename from 3.2.42/1029_linux-3.2.30.patch
rename to 3.2.43/1029_linux-3.2.30.patch
diff --git a/3.2.42/1030_linux-3.2.31.patch b/3.2.43/1030_linux-3.2.31.patch
similarity index 100%
rename from 3.2.42/1030_linux-3.2.31.patch
rename to 3.2.43/1030_linux-3.2.31.patch
diff --git a/3.2.42/1031_linux-3.2.32.patch b/3.2.43/1031_linux-3.2.32.patch
similarity index 100%
rename from 3.2.42/1031_linux-3.2.32.patch
rename to 3.2.43/1031_linux-3.2.32.patch
diff --git a/3.2.42/1032_linux-3.2.33.patch b/3.2.43/1032_linux-3.2.33.patch
similarity index 100%
rename from 3.2.42/1032_linux-3.2.33.patch
rename to 3.2.43/1032_linux-3.2.33.patch
diff --git a/3.2.42/1033_linux-3.2.34.patch b/3.2.43/1033_linux-3.2.34.patch
similarity index 100%
rename from 3.2.42/1033_linux-3.2.34.patch
rename to 3.2.43/1033_linux-3.2.34.patch
diff --git a/3.2.42/1034_linux-3.2.35.patch b/3.2.43/1034_linux-3.2.35.patch
similarity index 100%
rename from 3.2.42/1034_linux-3.2.35.patch
rename to 3.2.43/1034_linux-3.2.35.patch
diff --git a/3.2.42/1035_linux-3.2.36.patch b/3.2.43/1035_linux-3.2.36.patch
similarity index 100%
rename from 3.2.42/1035_linux-3.2.36.patch
rename to 3.2.43/1035_linux-3.2.36.patch
diff --git a/3.2.42/1036_linux-3.2.37.patch b/3.2.43/1036_linux-3.2.37.patch
similarity index 100%
rename from 3.2.42/1036_linux-3.2.37.patch
rename to 3.2.43/1036_linux-3.2.37.patch
diff --git a/3.2.42/1037_linux-3.2.38.patch b/3.2.43/1037_linux-3.2.38.patch
similarity index 100%
rename from 3.2.42/1037_linux-3.2.38.patch
rename to 3.2.43/1037_linux-3.2.38.patch
diff --git a/3.2.42/1038_linux-3.2.39.patch b/3.2.43/1038_linux-3.2.39.patch
similarity index 100%
rename from 3.2.42/1038_linux-3.2.39.patch
rename to 3.2.43/1038_linux-3.2.39.patch
diff --git a/3.2.42/1039_linux-3.2.40.patch b/3.2.43/1039_linux-3.2.40.patch
similarity index 100%
rename from 3.2.42/1039_linux-3.2.40.patch
rename to 3.2.43/1039_linux-3.2.40.patch
diff --git a/3.2.42/1040_linux-3.2.41.patch b/3.2.43/1040_linux-3.2.41.patch
similarity index 100%
rename from 3.2.42/1040_linux-3.2.41.patch
rename to 3.2.43/1040_linux-3.2.41.patch
diff --git a/3.2.42/1041_linux-3.2.42.patch b/3.2.43/1041_linux-3.2.42.patch
similarity index 100%
rename from 3.2.42/1041_linux-3.2.42.patch
rename to 3.2.43/1041_linux-3.2.42.patch
diff --git a/3.2.43/1042_linux-3.2.43.patch b/3.2.43/1042_linux-3.2.43.patch
new file mode 100644
index 0000000..a3f878b
--- /dev/null
+++ b/3.2.43/1042_linux-3.2.43.patch
@@ -0,0 +1,2442 @@
+diff --git a/Makefile b/Makefile
+index d44f009..59130db 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 42
++SUBLEVEL = 43
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+
+diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
+index 5f85d8b..a09b6c3 100644
+--- a/arch/tile/kernel/setup.c
++++ b/arch/tile/kernel/setup.c
+@@ -914,7 +914,7 @@ void __cpuinit setup_cpu(int boot)
+ #ifdef CONFIG_BLK_DEV_INITRD
+
+ static int __initdata set_initramfs_file;
+-static char __initdata initramfs_file[128] = "initramfs.cpio.gz";
++static char __initdata initramfs_file[128] = "initramfs";
+
+ static int __init setup_initramfs_file(char *str)
+ {
+@@ -928,9 +928,9 @@ static int __init setup_initramfs_file(char *str)
+ early_param("initramfs_file", setup_initramfs_file);
+
+ /*
+- * We look for an additional "initramfs.cpio.gz" file in the hvfs.
+- * If there is one, we allocate some memory for it and it will be
+- * unpacked to the initramfs after any built-in initramfs_data.
++ * We look for a file called "initramfs" in the hvfs. If there is one, we
++ * allocate some memory for it and it will be unpacked to the initramfs.
++ * If it's compressed, the initd code will uncompress it first.
+ */
+ static void __init load_hv_initrd(void)
+ {
+@@ -940,10 +940,16 @@ static void __init load_hv_initrd(void)
+
+ fd = hv_fs_findfile((HV_VirtAddr) initramfs_file);
+ if (fd == HV_ENOENT) {
+- if (set_initramfs_file)
++ if (set_initramfs_file) {
+ pr_warning("No such hvfs initramfs file '%s'\n",
+ initramfs_file);
+- return;
++ return;
++ } else {
++ /* Try old backwards-compatible name. */
++ fd = hv_fs_findfile((HV_VirtAddr)"initramfs.cpio.gz");
++ if (fd == HV_ENOENT)
++ return;
++ }
+ }
+ BUG_ON(fd < 0);
+ stat = hv_fs_fstat(fd);
+diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
+index 887f68f..db30542 100644
+--- a/drivers/block/aoe/aoecmd.c
++++ b/drivers/block/aoe/aoecmd.c
+@@ -30,8 +30,9 @@ new_skb(ulong len)
+ {
+ struct sk_buff *skb;
+
+- skb = alloc_skb(len, GFP_ATOMIC);
++ skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
+ if (skb) {
++ skb_reserve(skb, MAX_HEADER);
+ skb_reset_mac_header(skb);
+ skb_reset_network_header(skb);
+ skb->protocol = __constant_htons(ETH_P_AOE);
+diff --git a/drivers/block/loop.c b/drivers/block/loop.c
+index 8c6787a..a365562 100644
+--- a/drivers/block/loop.c
++++ b/drivers/block/loop.c
+@@ -907,6 +907,11 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
+ lo->lo_flags |= LO_FLAGS_PARTSCAN;
+ if (lo->lo_flags & LO_FLAGS_PARTSCAN)
+ ioctl_by_bdev(bdev, BLKRRPART, 0);
++
++ /* Grab the block_device to prevent its destruction after we
++ * put /dev/loopXX inode. Later in loop_clr_fd() we bdput(bdev).
++ */
++ bdgrab(bdev);
+ return 0;
+
+ out_clr:
+@@ -1003,8 +1008,10 @@ static int loop_clr_fd(struct loop_device *lo)
+ memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
+ memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
+ memset(lo->lo_file_name, 0, LO_NAME_SIZE);
+- if (bdev)
++ if (bdev) {
++ bdput(bdev);
+ invalidate_bdev(bdev);
++ }
+ set_capacity(lo->lo_disk, 0);
+ loop_sysfs_exit(lo);
+ if (bdev) {
+diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
+index 15ec4db..85fdd4b 100644
+--- a/drivers/block/xen-blkback/blkback.c
++++ b/drivers/block/xen-blkback/blkback.c
+@@ -758,13 +758,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
+ }
+ }
+
+- /*
+- * We set it one so that the last submit_bio does not have to call
+- * atomic_inc.
+- */
+ atomic_set(&pending_req->pendcnt, nbio);
+-
+- /* Get a reference count for the disk queue and start sending I/O */
+ blk_start_plug(&plug);
+
+ for (i = 0; i < nbio; i++)
+@@ -792,6 +786,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
+ fail_put_bio:
+ for (i = 0; i < nbio; i++)
+ bio_put(biolist[i]);
++ atomic_set(&pending_req->pendcnt, 1);
+ __end_block_io_op(pending_req, -EINVAL);
+ msleep(1); /* back off a bit */
+ return -EIO;
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 574ce73..853fdf8 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -72,14 +72,23 @@ static struct usb_device_id ath3k_table[] = {
+ { USB_DEVICE(0x03F0, 0x311D) },
+
+ /* Atheros AR3012 with sflash firmware*/
++ { USB_DEVICE(0x0CF3, 0x0036) },
+ { USB_DEVICE(0x0CF3, 0x3004) },
++ { USB_DEVICE(0x0CF3, 0x3008) },
+ { USB_DEVICE(0x0CF3, 0x311D) },
++ { USB_DEVICE(0x0CF3, 0x817a) },
+ { USB_DEVICE(0x13d3, 0x3375) },
++ { USB_DEVICE(0x04CA, 0x3004) },
+ { USB_DEVICE(0x04CA, 0x3005) },
++ { USB_DEVICE(0x04CA, 0x3006) },
++ { USB_DEVICE(0x04CA, 0x3008) },
+ { USB_DEVICE(0x13d3, 0x3362) },
+ { USB_DEVICE(0x0CF3, 0xE004) },
+ { USB_DEVICE(0x0930, 0x0219) },
+ { USB_DEVICE(0x0489, 0xe057) },
++ { USB_DEVICE(0x13d3, 0x3393) },
++ { USB_DEVICE(0x0489, 0xe04e) },
++ { USB_DEVICE(0x0489, 0xe056) },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE02C) },
+@@ -99,14 +108,23 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
+ static struct usb_device_id ath3k_blist_tbl[] = {
+
+ /* Atheros AR3012 with sflash firmware*/
++ { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU22 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index c5e44a3..6b784b7 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -139,14 +139,23 @@ static struct usb_device_id blacklist_table[] = {
+ { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
+
+ /* Atheros 3012 with sflash firmware */
++ { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+ { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
++ { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
+
+ /* Atheros AR5BBU12 with sflash firmware */
+ { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
+diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
+index 7795d1e..d5ae736 100644
+--- a/drivers/char/virtio_console.c
++++ b/drivers/char/virtio_console.c
+@@ -131,7 +131,8 @@ struct ports_device {
+ spinlock_t ports_lock;
+
+ /* To protect the vq operations for the control channel */
+- spinlock_t cvq_lock;
++ spinlock_t c_ivq_lock;
++ spinlock_t c_ovq_lock;
+
+ /* The current config space is stored here */
+ struct virtio_console_config config;
+@@ -457,11 +458,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
+ vq = portdev->c_ovq;
+
+ sg_init_one(sg, &cpkt, sizeof(cpkt));
++
++ spin_lock(&portdev->c_ovq_lock);
+ if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt) >= 0) {
+ virtqueue_kick(vq);
+ while (!virtqueue_get_buf(vq, &len))
+ cpu_relax();
+ }
++ spin_unlock(&portdev->c_ovq_lock);
+ return 0;
+ }
+
+@@ -1466,23 +1470,23 @@ static void control_work_handler(struct work_struct *work)
+ portdev = container_of(work, struct ports_device, control_work);
+ vq = portdev->c_ivq;
+
+- spin_lock(&portdev->cvq_lock);
++ spin_lock(&portdev->c_ivq_lock);
+ while ((buf = virtqueue_get_buf(vq, &len))) {
+- spin_unlock(&portdev->cvq_lock);
++ spin_unlock(&portdev->c_ivq_lock);
+
+ buf->len = len;
+ buf->offset = 0;
+
+ handle_control_message(portdev, buf);
+
+- spin_lock(&portdev->cvq_lock);
++ spin_lock(&portdev->c_ivq_lock);
+ if (add_inbuf(portdev->c_ivq, buf) < 0) {
+ dev_warn(&portdev->vdev->dev,
+ "Error adding buffer to queue\n");
+ free_buf(buf);
+ }
+ }
+- spin_unlock(&portdev->cvq_lock);
++ spin_unlock(&portdev->c_ivq_lock);
+ }
+
+ static void out_intr(struct virtqueue *vq)
+@@ -1721,10 +1725,12 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
+ if (multiport) {
+ unsigned int nr_added_bufs;
+
+- spin_lock_init(&portdev->cvq_lock);
++ spin_lock_init(&portdev->c_ivq_lock);
++ spin_lock_init(&portdev->c_ovq_lock);
+ INIT_WORK(&portdev->control_work, &control_work_handler);
+
+- nr_added_bufs = fill_queue(portdev->c_ivq, &portdev->cvq_lock);
++ nr_added_bufs = fill_queue(portdev->c_ivq,
++ &portdev->c_ivq_lock);
+ if (!nr_added_bufs) {
+ dev_err(&vdev->dev,
+ "Error allocating buffers for control queue\n");
+diff --git a/drivers/eisa/pci_eisa.c b/drivers/eisa/pci_eisa.c
+index cdae207..d4cd56a 100644
+--- a/drivers/eisa/pci_eisa.c
++++ b/drivers/eisa/pci_eisa.c
+@@ -19,8 +19,7 @@
+ /* There is only *one* pci_eisa device per machine, right ? */
+ static struct eisa_root_device pci_eisa_root;
+
+-static int __init pci_eisa_init(struct pci_dev *pdev,
+- const struct pci_device_id *ent)
++static int __init pci_eisa_init(struct pci_dev *pdev)
+ {
+ int rc;
+
+@@ -45,22 +44,26 @@ static int __init pci_eisa_init(struct pci_dev *pdev,
+ return 0;
+ }
+
+-static struct pci_device_id pci_eisa_pci_tbl[] = {
+- { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
+- PCI_CLASS_BRIDGE_EISA << 8, 0xffff00, 0 },
+- { 0, }
+-};
++/*
++ * We have to call pci_eisa_init_early() before pnpacpi_init()/isapnp_init().
++ * Otherwise pnp resource will get enabled early and could prevent eisa
++ * to be initialized.
++ * Also need to make sure pci_eisa_init_early() is called after
++ * x86/pci_subsys_init().
++ * So need to use subsys_initcall_sync with it.
++ */
++static int __init pci_eisa_init_early(void)
++{
++ struct pci_dev *dev = NULL;
++ int ret;
+
+-static struct pci_driver __refdata pci_eisa_driver = {
+- .name = "pci_eisa",
+- .id_table = pci_eisa_pci_tbl,
+- .probe = pci_eisa_init,
+-};
++ for_each_pci_dev(dev)
++ if ((dev->class >> 8) == PCI_CLASS_BRIDGE_EISA) {
++ ret = pci_eisa_init(dev);
++ if (ret)
++ return ret;
++ }
+
+-static int __init pci_eisa_init_module (void)
+-{
+- return pci_register_driver (&pci_eisa_driver);
++ return 0;
+ }
+-
+-device_initcall(pci_eisa_init_module);
+-MODULE_DEVICE_TABLE(pci, pci_eisa_pci_tbl);
++subsys_initcall_sync(pci_eisa_init_early);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index e665bdf..08075f2 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -539,6 +539,9 @@
+ #define USB_VENDOR_ID_MONTEREY 0x0566
+ #define USB_DEVICE_ID_GENIUS_KB29E 0x3004
+
++#define USB_VENDOR_ID_MSI 0x1770
++#define USB_DEVICE_ID_MSI_GX680R_LED_PANEL 0xff00
++
+ #define USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR 0x0400
+ #define USB_DEVICE_ID_N_S_HARMONY 0xc359
+
+@@ -621,6 +624,9 @@
+ #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH 0x3000
+ #define USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN 0x3001
+
++#define USB_VENDOR_ID_REALTEK 0x0bda
++#define USB_DEVICE_ID_REALTEK_READER 0x0152
++
+ #define USB_VENDOR_ID_ROCCAT 0x1e7d
+ #define USB_DEVICE_ID_ROCCAT_ARVO 0x30d4
+ #define USB_DEVICE_ID_ROCCAT_KONE 0x2ced
+diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
+index 3899989..259b9f4 100644
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -47,9 +47,9 @@ static __u8 *ms_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ rdesc[559] = 0x45;
+ }
+ /* the same as above (s/usage/physical/) */
+- if ((quirks & MS_RDESC_3K) && *rsize == 106 &&
+- !memcmp((char []){ 0x19, 0x00, 0x29, 0xff },
+- &rdesc[94], 4)) {
++ if ((quirks & MS_RDESC_3K) && *rsize == 106 && rdesc[94] == 0x19 &&
++ rdesc[95] == 0x00 && rdesc[96] == 0x29 &&
++ rdesc[97] == 0xff) {
+ rdesc[94] = 0x35;
+ rdesc[96] = 0x45;
+ }
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index e26eddf..96a1e0f 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -71,11 +71,13 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN2, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NOGET },
++ { USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
+ { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET },
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 014504d..3767853 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -755,9 +755,13 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
+ if (++priv->tx_outstanding == ipoib_sendq_size) {
+ ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
+ tx->qp->qp_num);
+- if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
+- ipoib_warn(priv, "request notify on send CQ failed\n");
+ netif_stop_queue(dev);
++ rc = ib_req_notify_cq(priv->send_cq,
++ IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
++ if (rc < 0)
++ ipoib_warn(priv, "request notify on send CQ failed\n");
++ else if (rc)
++ ipoib_send_comp_handler(priv->send_cq, dev);
+ }
+ }
+ }
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 0f074e0..07cb1a6 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -1874,16 +1874,16 @@ static int device_change_notifier(struct notifier_block *nb,
+
+ /* allocate a protection domain if a device is added */
+ dma_domain = find_protection_domain(devid);
+- if (dma_domain)
+- goto out;
+- dma_domain = dma_ops_domain_alloc();
+- if (!dma_domain)
+- goto out;
+- dma_domain->target_dev = devid;
+-
+- spin_lock_irqsave(&iommu_pd_list_lock, flags);
+- list_add_tail(&dma_domain->list, &iommu_pd_list);
+- spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
++ if (!dma_domain) {
++ dma_domain = dma_ops_domain_alloc();
++ if (!dma_domain)
++ goto out;
++ dma_domain->target_dev = devid;
++
++ spin_lock_irqsave(&iommu_pd_list_lock, flags);
++ list_add_tail(&dma_domain->list, &iommu_pd_list);
++ spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
++ }
+
+ dev->archdata.dma_ops = &amd_iommu_dma_ops;
+
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 63e3c47..fc07f90 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1934,12 +1934,11 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
+ return -EINVAL;
+ }
+
++ write_unlock_bh(&bond->lock);
+ /* unregister rx_handler early so bond_handle_frame wouldn't be called
+ * for this slave anymore.
+ */
+ netdev_rx_handler_unregister(slave_dev);
+- write_unlock_bh(&bond->lock);
+- synchronize_net();
+ write_lock_bh(&bond->lock);
+
+ if (!bond->params.fail_over_mac) {
+@@ -3422,6 +3421,28 @@ static int bond_xmit_hash_policy_l2(struct sk_buff *skb, int count)
+
+ /*-------------------------- Device entry points ----------------------------*/
+
++static void bond_work_init_all(struct bonding *bond)
++{
++ INIT_DELAYED_WORK(&bond->mcast_work,
++ bond_resend_igmp_join_requests_delayed);
++ INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
++ INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor);
++ if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
++ INIT_DELAYED_WORK(&bond->arp_work, bond_activebackup_arp_mon);
++ else
++ INIT_DELAYED_WORK(&bond->arp_work, bond_loadbalance_arp_mon);
++ INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
++}
++
++static void bond_work_cancel_all(struct bonding *bond)
++{
++ cancel_delayed_work_sync(&bond->mii_work);
++ cancel_delayed_work_sync(&bond->arp_work);
++ cancel_delayed_work_sync(&bond->alb_work);
++ cancel_delayed_work_sync(&bond->ad_work);
++ cancel_delayed_work_sync(&bond->mcast_work);
++}
++
+ static int bond_open(struct net_device *bond_dev)
+ {
+ struct bonding *bond = netdev_priv(bond_dev);
+@@ -3444,41 +3465,27 @@ static int bond_open(struct net_device *bond_dev)
+ }
+ read_unlock(&bond->lock);
+
+- INIT_DELAYED_WORK(&bond->mcast_work, bond_resend_igmp_join_requests_delayed);
++ bond_work_init_all(bond);
+
+ if (bond_is_lb(bond)) {
+ /* bond_alb_initialize must be called before the timer
+ * is started.
+ */
+- if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
+- /* something went wrong - fail the open operation */
++ if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB)))
+ return -ENOMEM;
+- }
+-
+- INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
+ queue_delayed_work(bond->wq, &bond->alb_work, 0);
+ }
+
+- if (bond->params.miimon) { /* link check interval, in milliseconds. */
+- INIT_DELAYED_WORK(&bond->mii_work, bond_mii_monitor);
++ if (bond->params.miimon) /* link check interval, in milliseconds. */
+ queue_delayed_work(bond->wq, &bond->mii_work, 0);
+- }
+
+ if (bond->params.arp_interval) { /* arp interval, in milliseconds. */
+- if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+- INIT_DELAYED_WORK(&bond->arp_work,
+- bond_activebackup_arp_mon);
+- else
+- INIT_DELAYED_WORK(&bond->arp_work,
+- bond_loadbalance_arp_mon);
+-
+ queue_delayed_work(bond->wq, &bond->arp_work, 0);
+ if (bond->params.arp_validate)
+ bond->recv_probe = bond_arp_rcv;
+ }
+
+ if (bond->params.mode == BOND_MODE_8023AD) {
+- INIT_DELAYED_WORK(&bond->ad_work, bond_3ad_state_machine_handler);
+ queue_delayed_work(bond->wq, &bond->ad_work, 0);
+ /* register to receive LACPDUs */
+ bond->recv_probe = bond_3ad_lacpdu_recv;
+@@ -3493,34 +3500,10 @@ static int bond_close(struct net_device *bond_dev)
+ struct bonding *bond = netdev_priv(bond_dev);
+
+ write_lock_bh(&bond->lock);
+-
+ bond->send_peer_notif = 0;
+-
+ write_unlock_bh(&bond->lock);
+
+- if (bond->params.miimon) { /* link check interval, in milliseconds. */
+- cancel_delayed_work_sync(&bond->mii_work);
+- }
+-
+- if (bond->params.arp_interval) { /* arp interval, in milliseconds. */
+- cancel_delayed_work_sync(&bond->arp_work);
+- }
+-
+- switch (bond->params.mode) {
+- case BOND_MODE_8023AD:
+- cancel_delayed_work_sync(&bond->ad_work);
+- break;
+- case BOND_MODE_TLB:
+- case BOND_MODE_ALB:
+- cancel_delayed_work_sync(&bond->alb_work);
+- break;
+- default:
+- break;
+- }
+-
+- if (delayed_work_pending(&bond->mcast_work))
+- cancel_delayed_work_sync(&bond->mcast_work);
+-
++ bond_work_cancel_all(bond);
+ if (bond_is_lb(bond)) {
+ /* Must be called only after all
+ * slaves have been released
+@@ -4364,26 +4347,6 @@ static void bond_setup(struct net_device *bond_dev)
+ bond_dev->features |= bond_dev->hw_features;
+ }
+
+-static void bond_work_cancel_all(struct bonding *bond)
+-{
+- if (bond->params.miimon && delayed_work_pending(&bond->mii_work))
+- cancel_delayed_work_sync(&bond->mii_work);
+-
+- if (bond->params.arp_interval && delayed_work_pending(&bond->arp_work))
+- cancel_delayed_work_sync(&bond->arp_work);
+-
+- if (bond->params.mode == BOND_MODE_ALB &&
+- delayed_work_pending(&bond->alb_work))
+- cancel_delayed_work_sync(&bond->alb_work);
+-
+- if (bond->params.mode == BOND_MODE_8023AD &&
+- delayed_work_pending(&bond->ad_work))
+- cancel_delayed_work_sync(&bond->ad_work);
+-
+- if (delayed_work_pending(&bond->mcast_work))
+- cancel_delayed_work_sync(&bond->mcast_work);
+-}
+-
+ /*
+ * Destroy a bonding device.
+ * Must be under rtnl_lock when this function is called.
+diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
+index a03fde9..8ed48c2 100644
+--- a/drivers/net/bonding/bond_sysfs.c
++++ b/drivers/net/bonding/bond_sysfs.c
+@@ -184,6 +184,11 @@ int bond_create_slave_symlinks(struct net_device *master,
+ sprintf(linkname, "slave_%s", slave->name);
+ ret = sysfs_create_link(&(master->dev.kobj), &(slave->dev.kobj),
+ linkname);
++
++ /* free the master link created earlier in case of error */
++ if (ret)
++ sysfs_remove_link(&(slave->dev.kobj), "master");
++
+ return ret;
+
+ }
+@@ -514,6 +519,8 @@ static ssize_t bonding_store_arp_interval(struct device *d,
+ int new_value, ret = count;
+ struct bonding *bond = to_bond(d);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
+ if (sscanf(buf, "%d", &new_value) != 1) {
+ pr_err("%s: no arp_interval value specified.\n",
+ bond->dev->name);
+@@ -521,7 +528,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
+ goto out;
+ }
+ if (new_value < 0) {
+- pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n",
++ pr_err("%s: Invalid arp_interval value %d not in range 0-%d; rejected.\n",
+ bond->dev->name, new_value, INT_MAX);
+ ret = -EINVAL;
+ goto out;
+@@ -536,18 +543,15 @@ static ssize_t bonding_store_arp_interval(struct device *d,
+ pr_info("%s: Setting ARP monitoring interval to %d.\n",
+ bond->dev->name, new_value);
+ bond->params.arp_interval = new_value;
+- if (bond->params.miimon) {
+- pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
+- bond->dev->name, bond->dev->name);
+- bond->params.miimon = 0;
+- if (delayed_work_pending(&bond->mii_work)) {
+- cancel_delayed_work(&bond->mii_work);
+- flush_workqueue(bond->wq);
++ if (new_value) {
++ if (bond->params.miimon) {
++ pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
++ bond->dev->name, bond->dev->name);
++ bond->params.miimon = 0;
+ }
+- }
+- if (!bond->params.arp_targets[0]) {
+- pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
+- bond->dev->name);
++ if (!bond->params.arp_targets[0])
++ pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
++ bond->dev->name);
+ }
+ if (bond->dev->flags & IFF_UP) {
+ /* If the interface is up, we may need to fire off
+@@ -555,19 +559,15 @@ static ssize_t bonding_store_arp_interval(struct device *d,
+ * timer will get fired off when the open function
+ * is called.
+ */
+- if (!delayed_work_pending(&bond->arp_work)) {
+- if (bond->params.mode == BOND_MODE_ACTIVEBACKUP)
+- INIT_DELAYED_WORK(&bond->arp_work,
+- bond_activebackup_arp_mon);
+- else
+- INIT_DELAYED_WORK(&bond->arp_work,
+- bond_loadbalance_arp_mon);
+-
++ if (!new_value) {
++ cancel_delayed_work_sync(&bond->arp_work);
++ } else {
++ cancel_delayed_work_sync(&bond->mii_work);
+ queue_delayed_work(bond->wq, &bond->arp_work, 0);
+ }
+ }
+-
+ out:
++ rtnl_unlock();
+ return ret;
+ }
+ static DEVICE_ATTR(arp_interval, S_IRUGO | S_IWUSR,
+@@ -707,7 +707,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
+ }
+ if (new_value < 0) {
+ pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
+- bond->dev->name, new_value, 1, INT_MAX);
++ bond->dev->name, new_value, 0, INT_MAX);
+ ret = -EINVAL;
+ goto out;
+ } else {
+@@ -762,8 +762,8 @@ static ssize_t bonding_store_updelay(struct device *d,
+ goto out;
+ }
+ if (new_value < 0) {
+- pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
+- bond->dev->name, new_value, 1, INT_MAX);
++ pr_err("%s: Invalid up delay value %d not in range %d-%d; rejected.\n",
++ bond->dev->name, new_value, 0, INT_MAX);
+ ret = -EINVAL;
+ goto out;
+ } else {
+@@ -963,6 +963,8 @@ static ssize_t bonding_store_miimon(struct device *d,
+ int new_value, ret = count;
+ struct bonding *bond = to_bond(d);
+
++ if (!rtnl_trylock())
++ return restart_syscall();
+ if (sscanf(buf, "%d", &new_value) != 1) {
+ pr_err("%s: no miimon value specified.\n",
+ bond->dev->name);
+@@ -971,50 +973,43 @@ static ssize_t bonding_store_miimon(struct device *d,
+ }
+ if (new_value < 0) {
+ pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n",
+- bond->dev->name, new_value, 1, INT_MAX);
++ bond->dev->name, new_value, 0, INT_MAX);
+ ret = -EINVAL;
+ goto out;
+- } else {
+- pr_info("%s: Setting MII monitoring interval to %d.\n",
+- bond->dev->name, new_value);
+- bond->params.miimon = new_value;
+- if (bond->params.updelay)
+- pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
+- bond->dev->name,
+- bond->params.updelay * bond->params.miimon);
+- if (bond->params.downdelay)
+- pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
+- bond->dev->name,
+- bond->params.downdelay * bond->params.miimon);
+- if (bond->params.arp_interval) {
+- pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
+- bond->dev->name);
+- bond->params.arp_interval = 0;
+- if (bond->params.arp_validate) {
+- bond->params.arp_validate =
+- BOND_ARP_VALIDATE_NONE;
+- }
+- if (delayed_work_pending(&bond->arp_work)) {
+- cancel_delayed_work(&bond->arp_work);
+- flush_workqueue(bond->wq);
+- }
+- }
+-
+- if (bond->dev->flags & IFF_UP) {
+- /* If the interface is up, we may need to fire off
+- * the MII timer. If the interface is down, the
+- * timer will get fired off when the open function
+- * is called.
+- */
+- if (!delayed_work_pending(&bond->mii_work)) {
+- INIT_DELAYED_WORK(&bond->mii_work,
+- bond_mii_monitor);
+- queue_delayed_work(bond->wq,
+- &bond->mii_work, 0);
+- }
++ }
++ pr_info("%s: Setting MII monitoring interval to %d.\n",
++ bond->dev->name, new_value);
++ bond->params.miimon = new_value;
++ if (bond->params.updelay)
++ pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
++ bond->dev->name,
++ bond->params.updelay * bond->params.miimon);
++ if (bond->params.downdelay)
++ pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
++ bond->dev->name,
++ bond->params.downdelay * bond->params.miimon);
++ if (new_value && bond->params.arp_interval) {
++ pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
++ bond->dev->name);
++ bond->params.arp_interval = 0;
++ if (bond->params.arp_validate)
++ bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
++ }
++ if (bond->dev->flags & IFF_UP) {
++ /* If the interface is up, we may need to fire off
++ * the MII timer. If the interface is down, the
++ * timer will get fired off when the open function
++ * is called.
++ */
++ if (!new_value) {
++ cancel_delayed_work_sync(&bond->mii_work);
++ } else {
++ cancel_delayed_work_sync(&bond->arp_work);
++ queue_delayed_work(bond->wq, &bond->mii_work, 0);
+ }
+ }
+ out:
++ rtnl_unlock();
+ return ret;
+ }
+ static DEVICE_ATTR(miimon, S_IRUGO | S_IWUSR,
+diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
+index c7f3d4e..c31c2d6 100644
+--- a/drivers/net/can/sja1000/plx_pci.c
++++ b/drivers/net/can/sja1000/plx_pci.c
+@@ -309,7 +309,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
+ */
+ if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) ==
+ REG_CR_BASICCAN_INITIAL &&
+- (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) &&
++ (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) &&
+ (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL))
+ flag = 1;
+
+@@ -321,7 +321,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
+ * See states on p. 23 of the Datasheet.
+ */
+ if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL &&
+- priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL &&
++ priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL &&
+ priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL)
+ return flag;
+
+diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
+index 192b0d1..6a1acfe 100644
+--- a/drivers/net/can/sja1000/sja1000.c
++++ b/drivers/net/can/sja1000/sja1000.c
+@@ -91,7 +91,7 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
+ */
+ spin_lock_irqsave(&priv->cmdreg_lock, flags);
+ priv->write_reg(priv, REG_CMR, val);
+- priv->read_reg(priv, REG_SR);
++ priv->read_reg(priv, SJA1000_REG_SR);
+ spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
+ }
+
+@@ -497,7 +497,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
+
+ while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
+ n++;
+- status = priv->read_reg(priv, REG_SR);
++ status = priv->read_reg(priv, SJA1000_REG_SR);
+ /* check for absent controller due to hw unplug */
+ if (status == 0xFF && sja1000_is_absent(priv))
+ return IRQ_NONE;
+@@ -516,7 +516,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
+ /* receive interrupt */
+ while (status & SR_RBS) {
+ sja1000_rx(dev);
+- status = priv->read_reg(priv, REG_SR);
++ status = priv->read_reg(priv, SJA1000_REG_SR);
+ /* check for absent controller */
+ if (status == 0xFF && sja1000_is_absent(priv))
+ return IRQ_NONE;
+diff --git a/drivers/net/can/sja1000/sja1000.h b/drivers/net/can/sja1000/sja1000.h
+index 23fff06..2a79543 100644
+--- a/drivers/net/can/sja1000/sja1000.h
++++ b/drivers/net/can/sja1000/sja1000.h
+@@ -56,7 +56,7 @@
+ /* SJA1000 registers - manual section 6.4 (Pelican Mode) */
+ #define REG_MOD 0x00
+ #define REG_CMR 0x01
+-#define REG_SR 0x02
++#define SJA1000_REG_SR 0x02
+ #define REG_IR 0x03
+ #define REG_IER 0x04
+ #define REG_ALC 0x0B
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e.h b/drivers/net/ethernet/atheros/atl1e/atl1e.h
+index 829b5ad..edfdf6b 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e.h
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h
+@@ -438,7 +438,6 @@ struct atl1e_adapter {
+ struct atl1e_hw hw;
+ struct atl1e_hw_stats hw_stats;
+
+- bool have_msi;
+ u32 wol;
+ u16 link_speed;
+ u16 link_duplex;
+diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+index 95483bc..c69dc29 100644
+--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+@@ -1867,37 +1867,19 @@ static void atl1e_free_irq(struct atl1e_adapter *adapter)
+ struct net_device *netdev = adapter->netdev;
+
+ free_irq(adapter->pdev->irq, netdev);
+-
+- if (adapter->have_msi)
+- pci_disable_msi(adapter->pdev);
+ }
+
+ static int atl1e_request_irq(struct atl1e_adapter *adapter)
+ {
+ struct pci_dev *pdev = adapter->pdev;
+ struct net_device *netdev = adapter->netdev;
+- int flags = 0;
+ int err = 0;
+
+- adapter->have_msi = true;
+- err = pci_enable_msi(adapter->pdev);
+- if (err) {
+- netdev_dbg(adapter->netdev,
+- "Unable to allocate MSI interrupt Error: %d\n", err);
+- adapter->have_msi = false;
+- } else
+- netdev->irq = pdev->irq;
+-
+-
+- if (!adapter->have_msi)
+- flags |= IRQF_SHARED;
+- err = request_irq(adapter->pdev->irq, atl1e_intr, flags,
+- netdev->name, netdev);
++ err = request_irq(pdev->irq, atl1e_intr, IRQF_SHARED,
++ netdev->name, netdev);
+ if (err) {
+ netdev_dbg(adapter->netdev,
+ "Unable to allocate interrupt Error: %d\n", err);
+- if (adapter->have_msi)
+- pci_disable_msi(adapter->pdev);
+ return err;
+ }
+ netdev_dbg(adapter->netdev, "atl1e_request_irq OK\n");
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index c86fa50..c6b9903 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -13433,8 +13433,11 @@ static void __devinit tg3_read_vpd(struct tg3 *tp)
+ if (j + len > block_end)
+ goto partno;
+
+- memcpy(tp->fw_ver, &vpd_data[j], len);
+- strncat(tp->fw_ver, " bc ", vpdlen - len - 1);
++ if (len >= sizeof(tp->fw_ver))
++ len = sizeof(tp->fw_ver) - 1;
++ memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
++ snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
++ &vpd_data[j]);
+ }
+
+ partno:
+diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
+index 2a22f52..2f2e98b 100644
+--- a/drivers/net/ethernet/davicom/dm9000.c
++++ b/drivers/net/ethernet/davicom/dm9000.c
+@@ -257,6 +257,107 @@ static void dm9000_dumpblk_32bit(void __iomem *reg, int count)
+ tmp = readl(reg);
+ }
+
++/*
++ * Sleep, either by using msleep() or if we are suspending, then
++ * use mdelay() to sleep.
++ */
++static void dm9000_msleep(board_info_t *db, unsigned int ms)
++{
++ if (db->in_suspend)
++ mdelay(ms);
++ else
++ msleep(ms);
++}
++
++/* Read a word from phyxcer */
++static int
++dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
++{
++ board_info_t *db = netdev_priv(dev);
++ unsigned long flags;
++ unsigned int reg_save;
++ int ret;
++
++ mutex_lock(&db->addr_lock);
++
++ spin_lock_irqsave(&db->lock, flags);
++
++ /* Save previous register address */
++ reg_save = readb(db->io_addr);
++
++ /* Fill the phyxcer register into REG_0C */
++ iow(db, DM9000_EPAR, DM9000_PHY | reg);
++
++ /* Issue phyxcer read command */
++ iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);
++
++ writeb(reg_save, db->io_addr);
++ spin_unlock_irqrestore(&db->lock, flags);
++
++ dm9000_msleep(db, 1); /* Wait read complete */
++
++ spin_lock_irqsave(&db->lock, flags);
++ reg_save = readb(db->io_addr);
++
++ iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */
++
++ /* The read data keeps on REG_0D & REG_0E */
++ ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
++
++ /* restore the previous address */
++ writeb(reg_save, db->io_addr);
++ spin_unlock_irqrestore(&db->lock, flags);
++
++ mutex_unlock(&db->addr_lock);
++
++ dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
++ return ret;
++}
++
++/* Write a word to phyxcer */
++static void
++dm9000_phy_write(struct net_device *dev,
++ int phyaddr_unused, int reg, int value)
++{
++ board_info_t *db = netdev_priv(dev);
++ unsigned long flags;
++ unsigned long reg_save;
++
++ dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
++ mutex_lock(&db->addr_lock);
++
++ spin_lock_irqsave(&db->lock, flags);
++
++ /* Save previous register address */
++ reg_save = readb(db->io_addr);
++
++ /* Fill the phyxcer register into REG_0C */
++ iow(db, DM9000_EPAR, DM9000_PHY | reg);
++
++ /* Fill the written data into REG_0D & REG_0E */
++ iow(db, DM9000_EPDRL, value);
++ iow(db, DM9000_EPDRH, value >> 8);
++
++ /* Issue phyxcer write command */
++ iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);
++
++ writeb(reg_save, db->io_addr);
++ spin_unlock_irqrestore(&db->lock, flags);
++
++ dm9000_msleep(db, 1); /* Wait write complete */
++
++ spin_lock_irqsave(&db->lock, flags);
++ reg_save = readb(db->io_addr);
++
++ iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */
++
++ /* restore the previous address */
++ writeb(reg_save, db->io_addr);
++
++ spin_unlock_irqrestore(&db->lock, flags);
++ mutex_unlock(&db->addr_lock);
++}
++
+ /* dm9000_set_io
+ *
+ * select the specified set of io routines to use with the
+@@ -793,6 +894,9 @@ dm9000_init_dm9000(struct net_device *dev)
+
+ iow(db, DM9000_GPCR, GPCR_GEP_CNTL); /* Let GPIO0 output */
+
++ dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
++ dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
++
+ ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
+
+ /* if wol is needed, then always set NCR_WAKEEN otherwise we end
+@@ -1199,109 +1303,6 @@ dm9000_open(struct net_device *dev)
+ return 0;
+ }
+
+-/*
+- * Sleep, either by using msleep() or if we are suspending, then
+- * use mdelay() to sleep.
+- */
+-static void dm9000_msleep(board_info_t *db, unsigned int ms)
+-{
+- if (db->in_suspend)
+- mdelay(ms);
+- else
+- msleep(ms);
+-}
+-
+-/*
+- * Read a word from phyxcer
+- */
+-static int
+-dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
+-{
+- board_info_t *db = netdev_priv(dev);
+- unsigned long flags;
+- unsigned int reg_save;
+- int ret;
+-
+- mutex_lock(&db->addr_lock);
+-
+- spin_lock_irqsave(&db->lock,flags);
+-
+- /* Save previous register address */
+- reg_save = readb(db->io_addr);
+-
+- /* Fill the phyxcer register into REG_0C */
+- iow(db, DM9000_EPAR, DM9000_PHY | reg);
+-
+- iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS); /* Issue phyxcer read command */
+-
+- writeb(reg_save, db->io_addr);
+- spin_unlock_irqrestore(&db->lock,flags);
+-
+- dm9000_msleep(db, 1); /* Wait read complete */
+-
+- spin_lock_irqsave(&db->lock,flags);
+- reg_save = readb(db->io_addr);
+-
+- iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */
+-
+- /* The read data keeps on REG_0D & REG_0E */
+- ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
+-
+- /* restore the previous address */
+- writeb(reg_save, db->io_addr);
+- spin_unlock_irqrestore(&db->lock,flags);
+-
+- mutex_unlock(&db->addr_lock);
+-
+- dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
+- return ret;
+-}
+-
+-/*
+- * Write a word to phyxcer
+- */
+-static void
+-dm9000_phy_write(struct net_device *dev,
+- int phyaddr_unused, int reg, int value)
+-{
+- board_info_t *db = netdev_priv(dev);
+- unsigned long flags;
+- unsigned long reg_save;
+-
+- dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
+- mutex_lock(&db->addr_lock);
+-
+- spin_lock_irqsave(&db->lock,flags);
+-
+- /* Save previous register address */
+- reg_save = readb(db->io_addr);
+-
+- /* Fill the phyxcer register into REG_0C */
+- iow(db, DM9000_EPAR, DM9000_PHY | reg);
+-
+- /* Fill the written data into REG_0D & REG_0E */
+- iow(db, DM9000_EPDRL, value);
+- iow(db, DM9000_EPDRH, value >> 8);
+-
+- iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW); /* Issue phyxcer write command */
+-
+- writeb(reg_save, db->io_addr);
+- spin_unlock_irqrestore(&db->lock, flags);
+-
+- dm9000_msleep(db, 1); /* Wait write complete */
+-
+- spin_lock_irqsave(&db->lock,flags);
+- reg_save = readb(db->io_addr);
+-
+- iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */
+-
+- /* restore the previous address */
+- writeb(reg_save, db->io_addr);
+-
+- spin_unlock_irqrestore(&db->lock, flags);
+- mutex_unlock(&db->addr_lock);
+-}
+-
+ static void
+ dm9000_shutdown(struct net_device *dev)
+ {
+@@ -1502,7 +1503,12 @@ dm9000_probe(struct platform_device *pdev)
+ db->flags |= DM9000_PLATF_SIMPLE_PHY;
+ #endif
+
+- dm9000_reset(db);
++ /* Fixing bug on dm9000_probe, takeover dm9000_reset(db),
++ * Need 'NCR_MAC_LBK' bit to indeed stable our DM9000 fifo
++ * while probe stage.
++ */
++
++ iow(db, DM9000_NCR, NCR_MAC_LBK | NCR_RST);
+
+ /* try multiple times, DM9000 sometimes gets the read wrong */
+ for (i = 0; i < 8; i++) {
+diff --git a/drivers/net/ethernet/davicom/dm9000.h b/drivers/net/ethernet/davicom/dm9000.h
+index 55688bd..9ce058a 100644
+--- a/drivers/net/ethernet/davicom/dm9000.h
++++ b/drivers/net/ethernet/davicom/dm9000.h
+@@ -69,7 +69,9 @@
+ #define NCR_WAKEEN (1<<6)
+ #define NCR_FCOL (1<<4)
+ #define NCR_FDX (1<<3)
+-#define NCR_LBK (3<<1)
++
++#define NCR_RESERVED (3<<1)
++#define NCR_MAC_LBK (1<<1)
+ #define NCR_RST (1<<0)
+
+ #define NSR_SPEED (1<<7)
+@@ -167,5 +169,12 @@
+ #define ISR_LNKCHNG (1<<5)
+ #define ISR_UNDERRUN (1<<4)
+
++/* Davicom MII registers.
++ */
++
++#define MII_DM_DSPCR 0x1b /* DSP Control Register */
++
++#define DSPCR_INIT_PARAM 0xE100 /* DSP init parameter */
++
+ #endif /* _DM9000X_H_ */
+
+diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+index cc96a5a..41396fa 100644
+--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+@@ -8003,12 +8003,15 @@ static int __init ixgbe_init_module(void)
+ pr_info("%s - version %s\n", ixgbe_driver_string, ixgbe_driver_version);
+ pr_info("%s\n", ixgbe_copyright);
+
++ ret = pci_register_driver(&ixgbe_driver);
++ if (ret)
++ return ret;
++
+ #ifdef CONFIG_IXGBE_DCA
+ dca_register_notify(&dca_notifier);
+ #endif
+
+- ret = pci_register_driver(&ixgbe_driver);
+- return ret;
++ return 0;
+ }
+
+ module_init(ixgbe_init_module);
+diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
+index 69fc888..94f9a8f 100644
+--- a/drivers/net/ethernet/marvell/sky2.c
++++ b/drivers/net/ethernet/marvell/sky2.c
+@@ -1066,7 +1066,7 @@ static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 space)
+ sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp);
+ sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2);
+
+- tp = space - 2048/8;
++ tp = space - 8192/8;
+ sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
+ sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
+ } else {
+diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
+index 3c896ce..a0f229e 100644
+--- a/drivers/net/ethernet/marvell/sky2.h
++++ b/drivers/net/ethernet/marvell/sky2.h
+@@ -2069,7 +2069,7 @@ enum {
+ GM_IS_RX_FF_OR = 1<<1, /* Receive FIFO Overrun */
+ GM_IS_RX_COMPL = 1<<0, /* Frame Reception Complete */
+
+-#define GMAC_DEF_MSK GM_IS_TX_FF_UR
++#define GMAC_DEF_MSK (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR)
+ };
+
+ /* GMAC_LINK_CTRL 16 bit GMAC Link Control Reg (YUKON only) */
+diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
+index f56743a..115e374 100644
+--- a/drivers/net/ethernet/micrel/ks8851.c
++++ b/drivers/net/ethernet/micrel/ks8851.c
+@@ -490,7 +490,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
+ for (; rxfc != 0; rxfc--) {
+ rxh = ks8851_rdreg32(ks, KS_RXFHSR);
+ rxstat = rxh & 0xffff;
+- rxlen = rxh >> 16;
++ rxlen = (rxh >> 16) & 0xfff;
+
+ netif_dbg(ks, rx_status, ks->netdev,
+ "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen);
+diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+index 43c7b25..495d65c 100644
+--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+@@ -1545,9 +1545,9 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
+ skb_put(skb, length);
+ skb->protocol = eth_type_trans(skb, netdev);
+ if (tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK)
+- skb->ip_summed = CHECKSUM_NONE;
+- else
+ skb->ip_summed = CHECKSUM_UNNECESSARY;
++ else
++ skb->ip_summed = CHECKSUM_NONE;
+
+ napi_gro_receive(&adapter->napi, skb);
+ (*work_done)++;
+diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
+index 22f2788..fd8115e 100644
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1048,7 +1048,7 @@ static void emac_tx_handler(void *token, int len, int status)
+ struct net_device *ndev = skb->dev;
+
+ if (unlikely(netif_queue_stopped(ndev)))
+- netif_start_queue(ndev);
++ netif_wake_queue(ndev);
+ ndev->stats.tx_packets++;
+ ndev->stats.tx_bytes += len;
+ dev_kfree_skb_any(skb);
+diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
+index 7bd219b..f3d17f8 100644
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -720,8 +720,12 @@ static int smsc75xx_set_rx_max_frame_length(struct usbnet *dev, int size)
+ static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu)
+ {
+ struct usbnet *dev = netdev_priv(netdev);
++ int ret;
++
++ if (new_mtu > MAX_SINGLE_PACKET_SIZE)
++ return -EINVAL;
+
+- int ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu);
++ ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
+ check_warn_return(ret, "Failed to set mac rx frame length");
+
+ return usbnet_change_mtu(netdev, new_mtu);
+@@ -965,7 +969,7 @@ static int smsc75xx_reset(struct usbnet *dev)
+
+ netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x", buf);
+
+- ret = smsc75xx_set_rx_max_frame_length(dev, 1514);
++ ret = smsc75xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
+ check_warn_return(ret, "Failed to set max rx frame length");
+
+ ret = smsc75xx_read_reg(dev, MAC_RX, &buf);
+@@ -1109,8 +1113,8 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+ else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT))
+ dev->net->stats.rx_frame_errors++;
+ } else {
+- /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */
+- if (unlikely(size > (ETH_FRAME_LEN + 12))) {
++ /* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */
++ if (unlikely(size > (MAX_SINGLE_PACKET_SIZE + ETH_HLEN + 12))) {
+ netif_dbg(dev, rx_err, dev->net,
+ "size err rx_cmd_a=0x%08x", rx_cmd_a);
+ return 0;
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+index ae750f9..3965356 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+@@ -946,6 +946,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
+ AR_PHY_CL_TAB_1,
+ AR_PHY_CL_TAB_2 };
+
++ /* Use chip chainmask only for calibration */
+ ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
+
+ if (rtt) {
+@@ -1087,6 +1088,9 @@ skip_tx_iqcal:
+ ar9003_hw_rtt_disable(ah);
+ }
+
++ /* Revert chainmask to runtime parameters */
++ ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
++
+ /* Initialize list pointers */
+ ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+ ah->supp_cals = IQ_MISMATCH_CAL;
+diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
+index 5e45604..12975ad 100644
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1482,8 +1482,12 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ const struct b43_dma_ops *ops;
+ struct b43_dmaring *ring;
+ struct b43_dmadesc_meta *meta;
++ static const struct b43_txstatus fake; /* filled with 0 */
++ const struct b43_txstatus *txstat;
+ int slot, firstused;
+ bool frame_succeed;
++ int skip;
++ static u8 err_out1, err_out2;
+
+ ring = parse_cookie(dev, status->cookie, &slot);
+ if (unlikely(!ring))
+@@ -1496,13 +1500,36 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ firstused = ring->current_slot - ring->used_slots + 1;
+ if (firstused < 0)
+ firstused = ring->nr_slots + firstused;
++
++ skip = 0;
+ if (unlikely(slot != firstused)) {
+ /* This possibly is a firmware bug and will result in
+- * malfunction, memory leaks and/or stall of DMA functionality. */
+- b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
+- "Expected %d, but got %d\n",
+- ring->index, firstused, slot);
+- return;
++ * malfunction, memory leaks and/or stall of DMA functionality.
++ */
++ if (slot == next_slot(ring, next_slot(ring, firstused))) {
++ /* If a single header/data pair was missed, skip over
++ * the first two slots in an attempt to recover.
++ */
++ slot = firstused;
++ skip = 2;
++ if (!err_out1) {
++ /* Report the error once. */
++ b43dbg(dev->wl,
++ "Skip on DMA ring %d slot %d.\n",
++ ring->index, slot);
++ err_out1 = 1;
++ }
++ } else {
++ /* More than a single header/data pair were missed.
++ * Report this error once.
++ */
++ if (!err_out2)
++ b43dbg(dev->wl,
++ "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
++ ring->index, firstused, slot);
++ err_out2 = 1;
++ return;
++ }
+ }
+
+ ops = ring->ops;
+@@ -1517,11 +1544,13 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ slot, firstused, ring->index);
+ break;
+ }
++
+ if (meta->skb) {
+ struct b43_private_tx_info *priv_info =
+- b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
++ b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
+
+- unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
++ unmap_descbuffer(ring, meta->dmaaddr,
++ meta->skb->len, 1);
+ kfree(priv_info->bouncebuffer);
+ priv_info->bouncebuffer = NULL;
+ } else {
+@@ -1533,8 +1562,9 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ struct ieee80211_tx_info *info;
+
+ if (unlikely(!meta->skb)) {
+- /* This is a scatter-gather fragment of a frame, so
+- * the skb pointer must not be NULL. */
++ /* This is a scatter-gather fragment of a frame,
++ * so the skb pointer must not be NULL.
++ */
+ b43dbg(dev->wl, "TX status unexpected NULL skb "
+ "at slot %d (first=%d) on ring %d\n",
+ slot, firstused, ring->index);
+@@ -1545,9 +1575,18 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+
+ /*
+ * Call back to inform the ieee80211 subsystem about
+- * the status of the transmission.
++ * the status of the transmission. When skipping over
++ * a missed TX status report, use a status structure
++ * filled with zeros to indicate that the frame was not
++ * sent (frame_count 0) and not acknowledged
+ */
+- frame_succeed = b43_fill_txstatus_report(dev, info, status);
++ if (unlikely(skip))
++ txstat = &fake;
++ else
++ txstat = status;
++
++ frame_succeed = b43_fill_txstatus_report(dev, info,
++ txstat);
+ #ifdef CONFIG_B43_DEBUG
+ if (frame_succeed)
+ ring->nr_succeed_tx_packets++;
+@@ -1575,12 +1614,14 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ /* Everything unmapped and free'd. So it's not used anymore. */
+ ring->used_slots--;
+
+- if (meta->is_last_fragment) {
++ if (meta->is_last_fragment && !skip) {
+ /* This is the last scatter-gather
+ * fragment of the frame. We are done. */
+ break;
+ }
+ slot = next_slot(ring, slot);
++ if (skip > 0)
++ --skip;
+ }
+ if (ring->stopped) {
+ B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
+diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
+index f099b30..3de9875 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
++++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
+@@ -1146,7 +1146,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
+ rt2x00dev->hw->wiphy->interface_modes |=
+ BIT(NL80211_IFTYPE_ADHOC) |
+ BIT(NL80211_IFTYPE_AP) |
++#ifdef CONFIG_MAC80211_MESH
+ BIT(NL80211_IFTYPE_MESH_POINT) |
++#endif
+ BIT(NL80211_IFTYPE_WDS);
+
+ /*
+diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
+index c04ee92..e5fe956 100644
+--- a/drivers/net/wireless/rtlwifi/usb.c
++++ b/drivers/net/wireless/rtlwifi/usb.c
+@@ -812,6 +812,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
+ if (unlikely(!_urb)) {
+ RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
+ ("Can't allocate urb. Drop skb!\n"));
++ kfree_skb(skb);
+ return;
+ }
+ urb_list = &rtlusb->tx_pending[ep_num];
+diff --git a/drivers/spi/spi-mpc512x-psc.c b/drivers/spi/spi-mpc512x-psc.c
+index 4c63f77..2e2b04f 100644
+--- a/drivers/spi/spi-mpc512x-psc.c
++++ b/drivers/spi/spi-mpc512x-psc.c
+@@ -164,7 +164,7 @@ static int mpc512x_psc_spi_transfer_rxtx(struct spi_device *spi,
+
+ for (i = count; i > 0; i--) {
+ data = tx_buf ? *tx_buf++ : 0;
+- if (len == EOFBYTE)
++ if (len == EOFBYTE && t->cs_change)
+ setbits32(&fifo->txcmd, MPC512x_PSC_FIFO_EOF);
+ out_8(&fifo->txdata_8, data);
+ len--;
+diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
+index c72128f..42cad5c 100644
+--- a/drivers/staging/comedi/drivers/s626.c
++++ b/drivers/staging/comedi/drivers/s626.c
+@@ -1882,7 +1882,7 @@ static int s626_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
+ case TRIG_NONE:
+ /* continous acquisition */
+ devpriv->ai_continous = 1;
+- devpriv->ai_sample_count = 0;
++ devpriv->ai_sample_count = 1;
+ break;
+ }
+
+diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
+index 90c8e3a..99fcb8c 100644
+--- a/drivers/tty/serial/atmel_serial.c
++++ b/drivers/tty/serial/atmel_serial.c
+@@ -159,7 +159,7 @@ struct atmel_uart_port {
+ };
+
+ static struct atmel_uart_port atmel_ports[ATMEL_MAX_UART];
+-static unsigned long atmel_ports_in_use;
++static DECLARE_BITMAP(atmel_ports_in_use, ATMEL_MAX_UART);
+
+ #ifdef SUPPORT_SYSRQ
+ static struct console atmel_console;
+@@ -1784,15 +1784,14 @@ static int __devinit atmel_serial_probe(struct platform_device *pdev)
+ if (ret < 0)
+ /* port id not found in platform data nor device-tree aliases:
+ * auto-enumerate it */
+- ret = find_first_zero_bit(&atmel_ports_in_use,
+- sizeof(atmel_ports_in_use));
++ ret = find_first_zero_bit(atmel_ports_in_use, ATMEL_MAX_UART);
+
+- if (ret > ATMEL_MAX_UART) {
++ if (ret >= ATMEL_MAX_UART) {
+ ret = -ENODEV;
+ goto err;
+ }
+
+- if (test_and_set_bit(ret, &atmel_ports_in_use)) {
++ if (test_and_set_bit(ret, atmel_ports_in_use)) {
+ /* port already in use */
+ ret = -EBUSY;
+ goto err;
+@@ -1866,7 +1865,7 @@ static int __devexit atmel_serial_remove(struct platform_device *pdev)
+
+ /* "port" is allocated statically, so we shouldn't free it */
+
+- clear_bit(port->line, &atmel_ports_in_use);
++ clear_bit(port->line, atmel_ports_in_use);
+
+ clk_put(atmel_port->clk);
+
+diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
+index 7a367ff..fd89c42 100644
+--- a/drivers/tty/vt/vc_screen.c
++++ b/drivers/tty/vt/vc_screen.c
+@@ -93,7 +93,7 @@ vcs_poll_data_free(struct vcs_poll_data *poll)
+ static struct vcs_poll_data *
+ vcs_poll_data_get(struct file *file)
+ {
+- struct vcs_poll_data *poll = file->private_data;
++ struct vcs_poll_data *poll = file->private_data, *kill = NULL;
+
+ if (poll)
+ return poll;
+@@ -122,10 +122,12 @@ vcs_poll_data_get(struct file *file)
+ file->private_data = poll;
+ } else {
+ /* someone else raced ahead of us */
+- vcs_poll_data_free(poll);
++ kill = poll;
+ poll = file->private_data;
+ }
+ spin_unlock(&file->f_lock);
++ if (kill)
++ vcs_poll_data_free(kill);
+
+ return poll;
+ }
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 5c1f9e7..37b2a89 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -1964,8 +1964,8 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ if (event_trb != ep_ring->dequeue &&
+ event_trb != td->last_trb)
+ td->urb->actual_length =
+- td->urb->transfer_buffer_length
+- - TRB_LEN(le32_to_cpu(event->transfer_len));
++ td->urb->transfer_buffer_length -
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+ else
+ td->urb->actual_length = 0;
+
+@@ -1997,7 +1997,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ /* Maybe the event was for the data stage? */
+ td->urb->actual_length =
+ td->urb->transfer_buffer_length -
+- TRB_LEN(le32_to_cpu(event->transfer_len));
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+ xhci_dbg(xhci, "Waiting for status "
+ "stage event\n");
+ return 0;
+@@ -2033,7 +2033,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ /* handle completion code */
+ switch (trb_comp_code) {
+ case COMP_SUCCESS:
+- if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
++ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
+ frame->status = 0;
+ break;
+ }
+@@ -2078,7 +2078,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2]));
+ }
+ len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
+- TRB_LEN(le32_to_cpu(event->transfer_len));
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+
+ if (trb_comp_code != COMP_STOP_INVAL) {
+ frame->actual_length = len;
+@@ -2136,7 +2136,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ case COMP_SUCCESS:
+ /* Double check that the HW transferred everything. */
+ if (event_trb != td->last_trb ||
+- TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ xhci_warn(xhci, "WARN Successful completion "
+ "on short TX\n");
+ if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+@@ -2164,18 +2164,18 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ "%d bytes untransferred\n",
+ td->urb->ep->desc.bEndpointAddress,
+ td->urb->transfer_buffer_length,
+- TRB_LEN(le32_to_cpu(event->transfer_len)));
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
+ /* Fast path - was this the last TRB in the TD for this URB? */
+ if (event_trb == td->last_trb) {
+- if (TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
++ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
+ td->urb->actual_length =
+ td->urb->transfer_buffer_length -
+- TRB_LEN(le32_to_cpu(event->transfer_len));
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+ if (td->urb->transfer_buffer_length <
+ td->urb->actual_length) {
+ xhci_warn(xhci, "HC gave bad length "
+ "of %d bytes left\n",
+- TRB_LEN(le32_to_cpu(event->transfer_len)));
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
+ td->urb->actual_length = 0;
+ if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
+ *status = -EREMOTEIO;
+@@ -2217,7 +2217,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ if (trb_comp_code != COMP_STOP_INVAL)
+ td->urb->actual_length +=
+ TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
+- TRB_LEN(le32_to_cpu(event->transfer_len));
++ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
+ }
+
+ return finish_td(xhci, td, event_trb, event, ep, status, false);
+@@ -2283,7 +2283,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
+ * transfer type
+ */
+ case COMP_SUCCESS:
+- if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
++ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
+ break;
+ if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
+ trb_comp_code = COMP_SHORT_TX;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index c519a31..8b4cce45 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -968,6 +968,10 @@ struct xhci_transfer_event {
+ __le32 flags;
+ };
+
++/* Transfer event TRB length bit mask */
++/* bits 0:23 */
++#define EVENT_TRB_LEN(p) ((p) & 0xffffff)
++
+ /** Transfer Event bit fields **/
+ #define TRB_TO_EP_ID(p) (((p) >> 16) & 0x1f)
+
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 71c4696..878ff05 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -648,6 +648,7 @@ static struct usb_device_id id_table_combined [] = {
+ { USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
+ { USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
+ { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
++ { USB_DEVICE(MITSUBISHI_VID, MITSUBISHI_FXUSB_PID) },
+ { USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
+ { USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
+ { USB_DEVICE(BANDB_VID, BANDB_USO9ML2_PID) },
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 97e0a6b..809c03a 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -584,6 +584,13 @@
+ #define CONTEC_COM1USBH_PID 0x8311 /* COM-1(USB)H */
+
+ /*
++ * Mitsubishi Electric Corp. (http://www.meau.com)
++ * Submitted by Konstantin Holoborodko
++ */
++#define MITSUBISHI_VID 0x06D3
++#define MITSUBISHI_FXUSB_PID 0x0284 /* USB/RS422 converters: FX-USB-AW/-BD */
++
++/*
+ * Definitions for B&B Electronics products.
+ */
+ #define BANDB_VID 0x0856 /* B&B Electronics Vendor ID */
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index 833dddb..53ab273 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -587,6 +587,7 @@ struct block_device *bdgrab(struct block_device *bdev)
+ ihold(bdev->bd_inode);
+ return bdev;
+ }
++EXPORT_SYMBOL(bdgrab);
+
+ long nr_blockdev_pages(void)
+ {
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index f5fbe57..8d4d53d 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -3996,7 +3996,7 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
+ spin_lock(&block_rsv->lock);
+ spin_lock(&sinfo->lock);
+
+- block_rsv->size = num_bytes;
++ block_rsv->size = min_t(u64, num_bytes, 512 * 1024 * 1024);
+
+ num_bytes = sinfo->bytes_used + sinfo->bytes_pinned +
+ sinfo->bytes_reserved + sinfo->bytes_readonly +
+diff --git a/fs/dcache.c b/fs/dcache.c
+index bb7f4cc..e923bf4 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -2445,7 +2445,6 @@ static int prepend_path(const struct path *path,
+ bool slash = false;
+ int error = 0;
+
+- br_read_lock(vfsmount_lock);
+ while (dentry != root->dentry || vfsmnt != root->mnt) {
+ struct dentry * parent;
+
+@@ -2475,8 +2474,6 @@ static int prepend_path(const struct path *path,
+ if (!error && !slash)
+ error = prepend(buffer, buflen, "/", 1);
+
+-out:
+- br_read_unlock(vfsmount_lock);
+ return error;
+
+ global_root:
+@@ -2493,7 +2490,7 @@ global_root:
+ error = prepend(buffer, buflen, "/", 1);
+ if (!error)
+ error = vfsmnt->mnt_ns ? 1 : 2;
+- goto out;
++ return error;
+ }
+
+ /**
+@@ -2520,9 +2517,11 @@ char *__d_path(const struct path *path,
+ int error;
+
+ prepend(&res, &buflen, "\0", 1);
++ br_read_lock(vfsmount_lock);
+ write_seqlock(&rename_lock);
+ error = prepend_path(path, root, &res, &buflen);
+ write_sequnlock(&rename_lock);
++ br_read_unlock(vfsmount_lock);
+
+ if (error < 0)
+ return ERR_PTR(error);
+@@ -2539,9 +2538,11 @@ char *d_absolute_path(const struct path *path,
+ int error;
+
+ prepend(&res, &buflen, "\0", 1);
++ br_read_lock(vfsmount_lock);
+ write_seqlock(&rename_lock);
+ error = prepend_path(path, &root, &res, &buflen);
+ write_sequnlock(&rename_lock);
++ br_read_unlock(vfsmount_lock);
+
+ if (error > 1)
+ error = -EINVAL;
+@@ -2605,11 +2606,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
+ return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
+
+ get_fs_root(current->fs, &root);
++ br_read_lock(vfsmount_lock);
+ write_seqlock(&rename_lock);
+ error = path_with_deleted(path, &root, &res, &buflen);
++ write_sequnlock(&rename_lock);
++ br_read_unlock(vfsmount_lock);
+ if (error < 0)
+ res = ERR_PTR(error);
+- write_sequnlock(&rename_lock);
+ path_put(&root);
+ return res;
+ }
+@@ -2764,6 +2767,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
+ get_fs_root_and_pwd(current->fs, &root, &pwd);
+
+ error = -ENOENT;
++ br_read_lock(vfsmount_lock);
+ write_seqlock(&rename_lock);
+ if (!d_unlinked(pwd.dentry)) {
+ unsigned long len;
+@@ -2773,6 +2777,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
+ prepend(&cwd, &buflen, "\0", 1);
+ error = prepend_path(&pwd, &root, &cwd, &buflen);
+ write_sequnlock(&rename_lock);
++ br_read_unlock(vfsmount_lock);
+
+ if (error < 0)
+ goto out;
+@@ -2793,6 +2798,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
+ }
+ } else {
+ write_sequnlock(&rename_lock);
++ br_read_unlock(vfsmount_lock);
+ }
+
+ out:
+diff --git a/fs/nfs/blocklayout/blocklayoutdm.c b/fs/nfs/blocklayout/blocklayoutdm.c
+index d055c75..7326e6e 100644
+--- a/fs/nfs/blocklayout/blocklayoutdm.c
++++ b/fs/nfs/blocklayout/blocklayoutdm.c
+@@ -52,7 +52,8 @@ static void dev_remove(dev_t dev)
+ dprintk("Entering %s\n", __func__);
+
+ memset(&msg, 0, sizeof(msg));
+- msg.data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
++ msg.len = sizeof(bl_msg) + bl_msg.totallen;
++ msg.data = kzalloc(msg.len, GFP_NOFS);
+ if (!msg.data)
+ goto out;
+
+@@ -63,7 +64,6 @@ static void dev_remove(dev_t dev)
+ memcpy(msg.data, &bl_msg, sizeof(bl_msg));
+ dataptr = (uint8_t *) msg.data;
+ memcpy(&dataptr[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request));
+- msg.len = sizeof(bl_msg) + bl_msg.totallen;
+
+ add_wait_queue(&bl_wq, &wq);
+ if (rpc_queue_upcall(bl_device_pipe->d_inode, &msg) < 0) {
+diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
+index 6d7c53d..5639efd 100644
+--- a/fs/nfs/nfs4proc.c
++++ b/fs/nfs/nfs4proc.c
+@@ -3578,7 +3578,8 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu
+ .rpc_argp = &args,
+ .rpc_resp = &res,
+ };
+- int ret = -ENOMEM, npages, i, acl_len = 0;
++ int ret = -ENOMEM, npages, i;
++ size_t acl_len = 0;
+
+ npages = (buflen + PAGE_SIZE - 1) >> PAGE_SHIFT;
+ /* As long as we're doing a round trip to the server anyway,
+@@ -6108,22 +6109,8 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata)
+ static void nfs4_layoutcommit_release(void *calldata)
+ {
+ struct nfs4_layoutcommit_data *data = calldata;
+- struct pnfs_layout_segment *lseg, *tmp;
+- unsigned long *bitlock = &NFS_I(data->args.inode)->flags;
+
+ pnfs_cleanup_layoutcommit(data);
+- /* Matched by references in pnfs_set_layoutcommit */
+- list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
+- list_del_init(&lseg->pls_lc_list);
+- if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
+- &lseg->pls_flags))
+- put_lseg(lseg);
+- }
+-
+- clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
+- smp_mb__after_clear_bit();
+- wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
+-
+ put_rpccred(data->cred);
+ kfree(data);
+ }
+diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
+index 3ad6595..d12514a 100644
+--- a/fs/nfs/pnfs.c
++++ b/fs/nfs/pnfs.c
+@@ -1356,11 +1356,27 @@ static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
+
+ list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
+ if (lseg->pls_range.iomode == IOMODE_RW &&
+- test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
++ test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+ list_add(&lseg->pls_lc_list, listp);
+ }
+ }
+
++static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *listp)
++{
++ struct pnfs_layout_segment *lseg, *tmp;
++ unsigned long *bitlock = &NFS_I(inode)->flags;
++
++ /* Matched by references in pnfs_set_layoutcommit */
++ list_for_each_entry_safe(lseg, tmp, listp, pls_lc_list) {
++ list_del_init(&lseg->pls_lc_list);
++ put_lseg(lseg);
++ }
++
++ clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
++ smp_mb__after_clear_bit();
++ wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
++}
++
+ void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg)
+ {
+ if (lseg->pls_range.iomode == IOMODE_RW) {
+@@ -1409,6 +1425,7 @@ void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data)
+
+ if (nfss->pnfs_curr_ld->cleanup_layoutcommit)
+ nfss->pnfs_curr_ld->cleanup_layoutcommit(data);
++ pnfs_list_write_lseg_done(data->args.inode, &data->lseg_list);
+ }
+
+ /*
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 800c215..24afa96 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -280,7 +280,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
+ iattr->ia_valid |= ATTR_SIZE;
+ }
+ if (bmval[0] & FATTR4_WORD0_ACL) {
+- int nace;
++ u32 nace;
+ struct nfs4_ace *ace;
+
+ READ_BUF(4); len += 4;
+diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
+index 6bc346c..04eecc4 100644
+--- a/fs/reiserfs/xattr.c
++++ b/fs/reiserfs/xattr.c
+@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
+ if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
+ return -ENOSPC;
+
+- if (name[0] == '.' && (name[1] == '\0' ||
+- (name[1] == '.' && name[2] == '\0')))
++ if (name[0] == '.' && (namelen < 2 ||
++ (namelen == 2 && name[1] == '.')))
+ return 0;
+
+ dentry = lookup_one_len(name, dbuf->xadir, namelen);
+diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
+index fabbb81..3899e24 100644
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -985,6 +985,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ ino = parent_sd->s_ino;
+ if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
+ filp->f_pos++;
++ else
++ return 0;
+ }
+ if (filp->f_pos == 1) {
+ if (parent_sd->s_parent)
+@@ -993,6 +995,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ ino = parent_sd->s_ino;
+ if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
+ filp->f_pos++;
++ else
++ return 0;
+ }
+ mutex_lock(&sysfs_mutex);
+ for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
+@@ -1023,10 +1027,21 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
+ return 0;
+ }
+
++static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence)
++{
++ struct inode *inode = file->f_path.dentry->d_inode;
++ loff_t ret;
++
++ mutex_lock(&inode->i_mutex);
++ ret = generic_file_llseek(file, offset, whence);
++ mutex_unlock(&inode->i_mutex);
++
++ return ret;
++}
+
+ const struct file_operations sysfs_dir_operations = {
+ .read = generic_read_dir,
+ .readdir = sysfs_readdir,
+ .release = sysfs_dir_release,
+- .llseek = generic_file_llseek,
++ .llseek = sysfs_dir_llseek,
+ };
+diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
+index ae0e76b..2f467e5 100644
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1583,6 +1583,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ c->remounting_rw = 1;
+ c->ro_mount = 0;
+
++ if (c->space_fixup) {
++ err = ubifs_fixup_free_space(c);
++ if (err)
++ return err;
++ }
++
+ err = check_free_space(c);
+ if (err)
+ goto out;
+@@ -1699,12 +1705,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
+ err = dbg_check_space_info(c);
+ }
+
+- if (c->space_fixup) {
+- err = ubifs_fixup_free_space(c);
+- if (err)
+- goto out;
+- }
+-
+ mutex_unlock(&c->umount_mutex);
+ return err;
+
+diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
+index 5142a82..604f5fc 100644
+--- a/fs/udf/udf_sb.h
++++ b/fs/udf/udf_sb.h
+@@ -82,7 +82,7 @@ struct udf_virtual_data {
+ struct udf_bitmap {
+ __u32 s_extLength;
+ __u32 s_extPosition;
+- __u16 s_nr_groups;
++ int s_nr_groups;
+ struct buffer_head **s_block_bitmap;
+ };
+
+diff --git a/include/linux/thermal.h b/include/linux/thermal.h
+index 47b4a27..5ef859a 100644
+--- a/include/linux/thermal.h
++++ b/include/linux/thermal.h
+@@ -108,7 +108,7 @@ struct thermal_zone_device {
+ /* Adding event notification support elements */
+ #define THERMAL_GENL_FAMILY_NAME "thermal_event"
+ #define THERMAL_GENL_VERSION 0x01
+-#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_group"
++#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_grp"
+
+ enum events {
+ THERMAL_AUX0,
+diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
+index fd4a7b1..cd068b2 100644
+--- a/kernel/time/tick-broadcast.c
++++ b/kernel/time/tick-broadcast.c
+@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
+ */
+ int tick_check_broadcast_device(struct clock_event_device *dev)
+ {
+- if ((tick_broadcast_device.evtdev &&
++ if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
++ (tick_broadcast_device.evtdev &&
+ tick_broadcast_device.evtdev->rating >= dev->rating) ||
+ (dev->features & CLOCK_EVT_FEAT_C3STOP))
+ return 0;
+diff --git a/mm/mmap.c b/mm/mmap.c
+index eae90af..dff37a6 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1573,7 +1573,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+ if (mm) {
+ /* Check the cache first. */
+ /* (Cache hit rate is typically around 35%.) */
+- vma = mm->mmap_cache;
++ vma = ACCESS_ONCE(mm->mmap_cache);
+ if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
+ struct rb_node * rb_node;
+
+diff --git a/mm/nommu.c b/mm/nommu.c
+index f59e170..f0cd7ab 100644
+--- a/mm/nommu.c
++++ b/mm/nommu.c
+@@ -807,7 +807,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
+ struct vm_area_struct *vma;
+
+ /* check the cache first */
+- vma = mm->mmap_cache;
++ vma = ACCESS_ONCE(mm->mmap_cache);
+ if (vma && vma->vm_start <= addr && vma->vm_end > addr)
+ return vma;
+
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index 5471628..963f285 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -110,13 +110,6 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
+ grp = rtnl_dereference(real_dev->vlgrp);
+ BUG_ON(!grp);
+
+- /* Take it out of our own structures, but be sure to interlock with
+- * HW accelerating devices or SW vlan input packet processing if
+- * VLAN is not 0 (leave it there for 802.1p).
+- */
+- if (vlan_id && (real_dev->features & NETIF_F_HW_VLAN_FILTER))
+- ops->ndo_vlan_rx_kill_vid(real_dev, vlan_id);
+-
+ grp->nr_vlans--;
+
+ if (vlan->flags & VLAN_FLAG_GVRP)
+@@ -139,6 +132,13 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
+ call_rcu(&grp->rcu, vlan_rcu_free);
+ }
+
++ /* Take it out of our own structures, but be sure to interlock with
++ * HW accelerating devices or SW vlan input packet processing if
++ * VLAN is not 0 (leave it there for 802.1p).
++ */
++ if (vlan_id && (real_dev->features & NETIF_F_HW_VLAN_FILTER))
++ ops->ndo_vlan_rx_kill_vid(real_dev, vlan_id);
++
+ /* Get rid of the vlan's reference to real_dev */
+ dev_put(real_dev);
+ }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index b23bbbf..720aea0 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3193,6 +3193,7 @@ int netdev_rx_handler_register(struct net_device *dev,
+ if (dev->rx_handler)
+ return -EBUSY;
+
++ /* Note: rx_handler_data must be set before rx_handler */
+ rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
+ rcu_assign_pointer(dev->rx_handler, rx_handler);
+
+@@ -3213,6 +3214,11 @@ void netdev_rx_handler_unregister(struct net_device *dev)
+
+ ASSERT_RTNL();
+ RCU_INIT_POINTER(dev->rx_handler, NULL);
++ /* a reader seeing a non NULL rx_handler in a rcu_read_lock()
++ * section has a guarantee to see a non NULL rx_handler_data
++ * as well.
++ */
++ synchronize_net();
+ RCU_INIT_POINTER(dev->rx_handler_data, NULL);
+ }
+ EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 1b1f7af..3124e17 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2265,11 +2265,8 @@ void tcp_enter_loss(struct sock *sk, int how)
+ if (tcp_is_reno(tp))
+ tcp_reset_reno_sack(tp);
+
+- if (!how) {
+- /* Push undo marker, if it was plain RTO and nothing
+- * was retransmitted. */
+- tp->undo_marker = tp->snd_una;
+- } else {
++ tp->undo_marker = tp->snd_una;
++ if (how) {
+ tp->sacked_out = 0;
+ tp->fackets_out = 0;
+ }
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 9bb7400..5c1807c 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -1587,8 +1587,11 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
+ goto send_now;
+ }
+
+- /* Ok, it looks like it is advisable to defer. */
+- tp->tso_deferred = 1 | (jiffies << 1);
++ /* Ok, it looks like it is advisable to defer.
++ * Do not rearm the timer if already set to not break TCP ACK clocking.
++ */
++ if (!tp->tso_deferred)
++ tp->tso_deferred = 1 | (jiffies << 1);
+
+ return 1;
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index b27baed..8589c2d 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4658,26 +4658,20 @@ static void addrconf_sysctl_unregister(struct inet6_dev *idev)
+
+ static int __net_init addrconf_init_net(struct net *net)
+ {
+- int err;
++ int err = -ENOMEM;
+ struct ipv6_devconf *all, *dflt;
+
+- err = -ENOMEM;
+- all = &ipv6_devconf;
+- dflt = &ipv6_devconf_dflt;
++ all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
++ if (all == NULL)
++ goto err_alloc_all;
+
+- if (!net_eq(net, &init_net)) {
+- all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
+- if (all == NULL)
+- goto err_alloc_all;
++ dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
++ if (dflt == NULL)
++ goto err_alloc_dflt;
+
+- dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
+- if (dflt == NULL)
+- goto err_alloc_dflt;
+- } else {
+- /* these will be inherited by all namespaces */
+- dflt->autoconf = ipv6_defaults.autoconf;
+- dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
+- }
++ /* these will be inherited by all namespaces */
++ dflt->autoconf = ipv6_defaults.autoconf;
++ dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
+
+ net->ipv6.devconf_all = all;
+ net->ipv6.devconf_dflt = dflt;
+diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
+index f8d24dd..6a4f4f3 100644
+--- a/net/ipv6/ip6_input.c
++++ b/net/ipv6/ip6_input.c
+@@ -111,6 +111,27 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
+ ipv6_addr_loopback(&hdr->daddr))
+ goto err;
+
++ /* RFC4291 Errata ID: 3480
++ * Interface-Local scope spans only a single interface on a
++ * node and is useful only for loopback transmission of
++ * multicast. Packets with interface-local scope received
++ * from another node must be discarded.
++ */
++ if (!(skb->pkt_type == PACKET_LOOPBACK ||
++ dev->flags & IFF_LOOPBACK) &&
++ ipv6_addr_is_multicast(&hdr->daddr) &&
++ IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
++ goto err;
++
++ /* RFC4291 2.7
++ * Nodes must not originate a packet to a multicast address whose scope
++ * field contains the reserved value 0; if such a packet is received, it
++ * must be silently dropped.
++ */
++ if (ipv6_addr_is_multicast(&hdr->daddr) &&
++ IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
++ goto err;
++
+ /*
+ * RFC4291 2.7
+ * Multicast addresses must not be used as source addresses in IPv6
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index c24f25a..f4b49c5 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -2584,8 +2584,10 @@ bed:
+ NULL, NULL, NULL);
+
+ /* Check if the we got some results */
+- if (!self->cachedaddr)
+- return -EAGAIN; /* Didn't find any devices */
++ if (!self->cachedaddr) {
++ err = -EAGAIN; /* Didn't find any devices */
++ goto out;
++ }
+ daddr = self->cachedaddr;
+ /* Cleanup */
+ self->cachedaddr = 0;
+diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
+index 482fa57..874f8ff 100644
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -134,6 +134,7 @@ int genl_register_mc_group(struct genl_family *family,
+ int err = 0;
+
+ BUG_ON(grp->name[0] == '\0');
++ BUG_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL);
+
+ genl_lock();
+
+diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
+index 18c5a50..dc6af27 100644
+--- a/net/sunrpc/sched.c
++++ b/net/sunrpc/sched.c
+@@ -139,6 +139,8 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue,
+ list_add_tail(&task->u.tk_wait.list, &queue->tasks[0]);
+ task->tk_waitqueue = queue;
+ queue->qlen++;
++ /* barrier matches the read in rpc_wake_up_task_queue_locked() */
++ smp_wmb();
+ rpc_set_queued(task);
+
+ dprintk("RPC: %5u added to queue %p \"%s\"\n",
+@@ -389,8 +391,11 @@ static void __rpc_do_wake_up_task(struct rpc_wait_queue *queue, struct rpc_task
+ */
+ static void rpc_wake_up_task_queue_locked(struct rpc_wait_queue *queue, struct rpc_task *task)
+ {
+- if (RPC_IS_QUEUED(task) && task->tk_waitqueue == queue)
+- __rpc_do_wake_up_task(queue, task);
++ if (RPC_IS_QUEUED(task)) {
++ smp_rmb();
++ if (task->tk_waitqueue == queue)
++ __rpc_do_wake_up_task(queue, task);
++ }
+ }
+
+ /*
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index 317bfe3..18978b6 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -371,7 +371,7 @@ static void unix_sock_destructor(struct sock *sk)
+ #endif
+ }
+
+-static int unix_release_sock(struct sock *sk, int embrion)
++static void unix_release_sock(struct sock *sk, int embrion)
+ {
+ struct unix_sock *u = unix_sk(sk);
+ struct dentry *dentry;
+@@ -444,8 +444,6 @@ static int unix_release_sock(struct sock *sk, int embrion)
+
+ if (unix_tot_inflight)
+ unix_gc(); /* Garbage collect fds */
+-
+- return 0;
+ }
+
+ static void init_peercred(struct sock *sk)
+@@ -682,9 +680,10 @@ static int unix_release(struct socket *sock)
+ if (!sk)
+ return 0;
+
++ unix_release_sock(sk, 0);
+ sock->sk = NULL;
+
+- return unix_release_sock(sk, 0);
++ return 0;
+ }
+
+ static int unix_autobind(struct socket *sock)
+diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
+index 0b3f5d7..b70eaa2 100644
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -1067,12 +1067,12 @@ long keyctl_instantiate_key_iov(key_serial_t id,
+ ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
+ ARRAY_SIZE(iovstack), iovstack, &iov, 1);
+ if (ret < 0)
+- return ret;
++ goto err;
+ if (ret == 0)
+ goto no_payload_free;
+
+ ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+-
++err:
+ if (iov != iovstack)
+ kfree(iov);
+ return ret;
+diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
+index 971eaf0..4969c98 100644
+--- a/sound/soc/imx/imx-ssi.c
++++ b/sound/soc/imx/imx-ssi.c
+@@ -573,6 +573,8 @@ static void imx_ssi_ac97_reset(struct snd_ac97 *ac97)
+
+ if (imx_ssi->ac97_reset)
+ imx_ssi->ac97_reset(ac97);
++ /* First read sometimes fails, do a dummy read */
++ imx_ssi_ac97_read(ac97, 0);
+ }
+
+ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
+@@ -581,6 +583,9 @@ static void imx_ssi_ac97_warm_reset(struct snd_ac97 *ac97)
+
+ if (imx_ssi->ac97_warm_reset)
+ imx_ssi->ac97_warm_reset(ac97);
++
++ /* First read sometimes fails, do a dummy read */
++ imx_ssi_ac97_read(ac97, 0);
+ }
+
+ struct snd_ac97_bus_ops soc_ac97_ops = {
+diff --git a/sound/soc/sh/dma-sh7760.c b/sound/soc/sh/dma-sh7760.c
+index db74005..1a757c3 100644
+--- a/sound/soc/sh/dma-sh7760.c
++++ b/sound/soc/sh/dma-sh7760.c
+@@ -342,8 +342,8 @@ static int camelot_pcm_new(struct snd_soc_pcm_runtime *rtd)
+ return 0;
+ }
+
+-static struct snd_soc_platform sh7760_soc_platform = {
+- .pcm_ops = &camelot_pcm_ops,
++static struct snd_soc_platform_driver sh7760_soc_platform = {
++ .ops = &camelot_pcm_ops,
+ .pcm_new = camelot_pcm_new,
+ .pcm_free = camelot_pcm_free,
+ };
diff --git a/3.2.42/4420_grsecurity-2.9.1-3.2.42-201304052303.patch b/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304102033.patch
similarity index 99%
rename from 3.2.42/4420_grsecurity-2.9.1-3.2.42-201304052303.patch
rename to 3.2.43/4420_grsecurity-2.9.1-3.2.43-201304102033.patch
index f19c642..a16b135 100644
--- a/3.2.42/4420_grsecurity-2.9.1-3.2.42-201304052303.patch
+++ b/3.2.43/4420_grsecurity-2.9.1-3.2.43-201304102033.patch
@@ -262,7 +262,7 @@ index 88fd7f5..b318a78 100644
==============================================================
diff --git a/Makefile b/Makefile
-index d44f009..158a4a4 100644
+index 59130db..6da759d 100644
--- a/Makefile
+++ b/Makefile
@@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -272,7 +272,7 @@ index d44f009..158a4a4 100644
-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
-HOSTCXXFLAGS = -O2
+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
++HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
# Decide whether to build built-in, modular, or both.
@@ -2601,19 +2601,10 @@ index b77768d..e0795eb 100644
static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..50cdf87 100644
+index 449c8c0..18965fb 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
-@@ -42,6 +42,8 @@
- #include <asm/pgtable.h>
- #include <asm/io.h>
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * For historical reasons, the following macros are grossly misnamed:
- */
-@@ -240,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
+@@ -240,12 +240,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
static inline unsigned long
__copy_to_user (void __user *to, const void *from, unsigned long count)
{
@@ -2638,7 +2629,7 @@ index 449c8c0..50cdf87 100644
return __copy_user((__force void __user *) to, from, count);
}
-@@ -255,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -255,10 +267,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void __user *__cu_to = (to); \
const void *__cu_from = (from); \
@@ -2654,7 +2645,7 @@ index 449c8c0..50cdf87 100644
__cu_len; \
})
-@@ -266,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -266,11 +281,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void *__cu_to = (to); \
const void __user *__cu_from = (from); \
@@ -2790,9 +2781,18 @@ index 24603be..948052d 100644
DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
}
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
-index 77597e5..6f28f3f 100644
+index 77597e5..189dd62f 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
+@@ -977,7 +977,7 @@ create_palinfo_proc_entries(unsigned int cpu)
+ struct proc_dir_entry **pdir;
+ struct proc_dir_entry *cpu_dir;
+ int j;
+- char cpustr[sizeof(CPUSTR)];
++ char cpustr[3+4+1];
+
+
+ /*
@@ -1045,7 +1045,7 @@ static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
@@ -4351,19 +4351,10 @@ index 836f231..39d0b94 100644
#define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
_TIF_NOTIFY_RESUME)
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index bd0fb84..a42a14b 100644
+index bd0fb84..1f2d065 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
-@@ -13,6 +13,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -327,52 +329,6 @@ do { \
+@@ -327,52 +327,6 @@ do { \
extern unsigned long __copy_tofrom_user(void __user *to,
const void __user *from, unsigned long size);
@@ -4416,7 +4407,7 @@ index bd0fb84..a42a14b 100644
static inline unsigned long __copy_from_user_inatomic(void *to,
const void __user *from, unsigned long n)
{
-@@ -396,6 +352,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
+@@ -396,6 +350,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
if (ret == 0)
return 0;
}
@@ -4427,7 +4418,7 @@ index bd0fb84..a42a14b 100644
return __copy_tofrom_user((__force void __user *)to, from, n);
}
-@@ -422,6 +382,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
+@@ -422,6 +380,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
if (ret == 0)
return 0;
}
@@ -4438,7 +4429,7 @@ index bd0fb84..a42a14b 100644
return __copy_tofrom_user(to, (__force const void __user *)from, n);
}
-@@ -439,6 +403,92 @@ static inline unsigned long __copy_to_user(void __user *to,
+@@ -439,6 +401,92 @@ static inline unsigned long __copy_to_user(void __user *to,
return __copy_to_user_inatomic(to, from, size);
}
@@ -5153,6 +5144,22 @@ index 73709f7..63db0f7 100644
/* If hint, make sure it matches our alignment restrictions */
if (!fixed && addr) {
addr = _ALIGN_UP(addr, 1ul << pshift);
+diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
+index 0cfece4..2f1a0e5 100644
+--- a/arch/powerpc/platforms/cell/spufs/file.c
++++ b/arch/powerpc/platforms/cell/spufs/file.c
+@@ -281,9 +281,9 @@ spufs_mem_mmap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ return VM_FAULT_NOPAGE;
+ }
+
+-static int spufs_mem_mmap_access(struct vm_area_struct *vma,
++static ssize_t spufs_mem_mmap_access(struct vm_area_struct *vma,
+ unsigned long address,
+- void *buf, int len, int write)
++ void *buf, size_t len, int write)
+ {
+ struct spu_context *ctx = vma->vm_file->private_data;
+ unsigned long offset = address - vma->vm_start;
diff --git a/arch/powerpc/platforms/powermac/smp.c b/arch/powerpc/platforms/powermac/smp.c
index 3394254..8c6825c 100644
--- a/arch/powerpc/platforms/powermac/smp.c
@@ -6189,20 +6196,13 @@ index 60d86be..6389ac8 100644
* Thread-synchronous status.
*
diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
-index e88fbe5..96b0ce5 100644
+index e88fbe5..bd0eda7 100644
--- a/arch/sparc/include/asm/uaccess.h
+++ b/arch/sparc/include/asm/uaccess.h
-@@ -1,5 +1,13 @@
+@@ -1,5 +1,6 @@
#ifndef ___ASM_SPARC_UACCESS_H
#define ___ASM_SPARC_UACCESS_H
+
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#include <linux/types.h>
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+#endif
-+#endif
-+
#if defined(__sparc__) && defined(__arch64__)
#include <asm/uaccess_64.h>
#else
@@ -6418,6 +6418,19 @@ index 3739a06..48b2ff0 100644
(void *) gp->tpc,
(void *) gp->o7,
(void *) gp->i7,
+diff --git a/arch/sparc/kernel/prom_common.c b/arch/sparc/kernel/prom_common.c
+index 741df91..97cdf05 100644
+--- a/arch/sparc/kernel/prom_common.c
++++ b/arch/sparc/kernel/prom_common.c
+@@ -144,7 +144,7 @@ static int __init prom_common_nextprop(phandle node, char *prev, char *buf)
+
+ unsigned int prom_early_allocated __initdata;
+
+-static struct of_pdt_ops prom_sparc_ops __initdata = {
++static struct of_pdt_ops prom_sparc_ops __initconst = {
+ .nextprop = prom_common_nextprop,
+ .getproplen = prom_getproplen,
+ .getproperty = prom_getproperty,
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 96ee50a..68ce124 100644
--- a/arch/sparc/kernel/ptrace_64.c
@@ -6903,6 +6916,115 @@ index 76e4ac1..78f8bb1 100644
regs->tpc, (void *) regs->tpc);
}
}
+diff --git a/arch/sparc/kernel/us3_cpufreq.c b/arch/sparc/kernel/us3_cpufreq.c
+index eb1624b..f9f4ddb 100644
+--- a/arch/sparc/kernel/us3_cpufreq.c
++++ b/arch/sparc/kernel/us3_cpufreq.c
+@@ -18,14 +18,12 @@
+ #include <asm/head.h>
+ #include <asm/timer.h>
+
+-static struct cpufreq_driver *cpufreq_us3_driver;
+-
+ struct us3_freq_percpu_info {
+ struct cpufreq_frequency_table table[4];
+ };
+
+ /* Indexed by cpu number. */
+-static struct us3_freq_percpu_info *us3_freq_table;
++static struct us3_freq_percpu_info us3_freq_table[NR_CPUS];
+
+ /* UltraSPARC-III has three dividers: 1, 2, and 32. These are controlled
+ * in the Safari config register.
+@@ -191,12 +189,25 @@ static int __init us3_freq_cpu_init(struct cpufreq_policy *policy)
+
+ static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
+ {
+- if (cpufreq_us3_driver)
+- us3_set_cpu_divider_index(policy->cpu, 0);
++ us3_set_cpu_divider_index(policy->cpu, 0);
+
+ return 0;
+ }
+
++static int __init us3_freq_init(void);
++static void __exit us3_freq_exit(void);
++
++static struct cpufreq_driver cpufreq_us3_driver = {
++ .init = us3_freq_cpu_init,
++ .verify = us3_freq_verify,
++ .target = us3_freq_target,
++ .get = us3_freq_get,
++ .exit = us3_freq_cpu_exit,
++ .owner = THIS_MODULE,
++ .name = "UltraSPARC-III",
++
++};
++
+ static int __init us3_freq_init(void)
+ {
+ unsigned long manuf, impl, ver;
+@@ -213,57 +224,15 @@ static int __init us3_freq_init(void)
+ (impl == CHEETAH_IMPL ||
+ impl == CHEETAH_PLUS_IMPL ||
+ impl == JAGUAR_IMPL ||
+- impl == PANTHER_IMPL)) {
+- struct cpufreq_driver *driver;
+-
+- ret = -ENOMEM;
+- driver = kzalloc(sizeof(struct cpufreq_driver), GFP_KERNEL);
+- if (!driver)
+- goto err_out;
+-
+- us3_freq_table = kzalloc(
+- (NR_CPUS * sizeof(struct us3_freq_percpu_info)),
+- GFP_KERNEL);
+- if (!us3_freq_table)
+- goto err_out;
+-
+- driver->init = us3_freq_cpu_init;
+- driver->verify = us3_freq_verify;
+- driver->target = us3_freq_target;
+- driver->get = us3_freq_get;
+- driver->exit = us3_freq_cpu_exit;
+- driver->owner = THIS_MODULE,
+- strcpy(driver->name, "UltraSPARC-III");
+-
+- cpufreq_us3_driver = driver;
+- ret = cpufreq_register_driver(driver);
+- if (ret)
+- goto err_out;
+-
+- return 0;
+-
+-err_out:
+- if (driver) {
+- kfree(driver);
+- cpufreq_us3_driver = NULL;
+- }
+- kfree(us3_freq_table);
+- us3_freq_table = NULL;
+- return ret;
+- }
++ impl == PANTHER_IMPL))
++ return cpufreq_register_driver(cpufreq_us3_driver);
+
+ return -ENODEV;
+ }
+
+ static void __exit us3_freq_exit(void)
+ {
+- if (cpufreq_us3_driver) {
+- cpufreq_unregister_driver(cpufreq_us3_driver);
+- kfree(cpufreq_us3_driver);
+- cpufreq_us3_driver = NULL;
+- kfree(us3_freq_table);
+- us3_freq_table = NULL;
+- }
++ cpufreq_unregister_driver(cpufreq_us3_driver);
+ }
+
+ MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index a3fc437..fea9957 100644
--- a/arch/sparc/lib/Makefile
@@ -26789,7 +26911,7 @@ index 44b93da..b5cb517 100644
if (vma == &gate_vma)
return "[vsyscall]";
diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
-index 7b179b4..6bd1777 100644
+index 7b179b4..6bd17777 100644
--- a/arch/x86/mm/iomap_32.c
+++ b/arch/x86/mm/iomap_32.c
@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
@@ -31591,7 +31713,7 @@ index 43beaca..32e74a7 100644
static struct asender_cmd *get_asender_cmd(int cmd)
{
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index 8c6787a..b7f4770 100644
+index a365562..933bbbd 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -227,7 +227,7 @@ static int __do_lo_send_write(struct file *file,
@@ -32218,10 +32340,10 @@ index 0636520..169c1d0 100644
acpi_os_unmap_memory(virt, len);
return 0;
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index 7795d1e..bc6d80a 100644
+index d5ae736..67d8598 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
-@@ -563,7 +563,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
+@@ -567,7 +567,7 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
if (to_user) {
ssize_t ret;
@@ -32230,7 +32352,7 @@ index 7795d1e..bc6d80a 100644
if (ret)
return -EFAULT;
} else {
-@@ -662,7 +662,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
+@@ -666,7 +666,7 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
if (!port_has_data(port) && !port->host_connected)
return 0;
@@ -38424,10 +38546,10 @@ index a9ff89ff..461d313 100644
struct sm_sysfs_attribute *vendor_attribute;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index 63e3c47..c20fba6 100644
+index fc07f90..c71767f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
-@@ -4832,7 +4832,7 @@ static int bond_get_tx_queues(struct net *net, struct nlattr *tb[],
+@@ -4795,7 +4795,7 @@ static int bond_get_tx_queues(struct net *net, struct nlattr *tb[],
return 0;
}
@@ -38436,7 +38558,7 @@ index 63e3c47..c20fba6 100644
.kind = "bond",
.priv_size = sizeof(struct bonding),
.setup = bond_setup,
-@@ -4948,8 +4948,8 @@ static void __exit bonding_exit(void)
+@@ -4911,8 +4911,8 @@ static void __exit bonding_exit(void)
bond_destroy_debugfs();
@@ -38447,10 +38569,10 @@ index 63e3c47..c20fba6 100644
#ifdef CONFIG_NET_POLL_CONTROLLER
/*
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
-index a03fde9..83254bc 100644
+index 8ed48c2..ae2cb9a 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
-@@ -1061,7 +1061,7 @@ static ssize_t bonding_store_primary(struct device *d,
+@@ -1056,7 +1056,7 @@ static ssize_t bonding_store_primary(struct device *d,
goto out;
}
@@ -38459,7 +38581,7 @@ index a03fde9..83254bc 100644
/* check to see if we are clearing primary */
if (!strlen(ifname) || buf[0] == '\n') {
-@@ -1234,7 +1234,7 @@ static ssize_t bonding_store_active_slave(struct device *d,
+@@ -1229,7 +1229,7 @@ static ssize_t bonding_store_active_slave(struct device *d,
goto out;
}
@@ -38550,23 +38672,6 @@ index 9a517c2..6d245e1 100644
/**
* Send and RX_MODE ramrod according to the provided parameters.
-diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
-index c86fa50..e4be3b3 100644
---- a/drivers/net/ethernet/broadcom/tg3.c
-+++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -13433,8 +13433,10 @@ static void __devinit tg3_read_vpd(struct tg3 *tp)
- if (j + len > block_end)
- goto partno;
-
-- memcpy(tp->fw_ver, &vpd_data[j], len);
-- strncat(tp->fw_ver, " bc ", vpdlen - len - 1);
-+ if (len >= sizeof(tp->fw_ver))
-+ len = sizeof(tp->fw_ver) - 1;
-+ memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
-+ snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len, &vpd_data[j]);
- }
-
- partno:
diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h
index 94b4bd0..73c02de 100644
--- a/drivers/net/ethernet/broadcom/tg3.h
@@ -47885,10 +47990,10 @@ index 4fc4dbb..bae9dce 100644
__bio_for_each_segment(bvec, bio, i, 0) {
char *addr = page_address(bvec->bv_page);
diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 833dddb..bc73fac 100644
+index 53ab273..25649b6 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
-@@ -682,7 +682,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
+@@ -683,7 +683,7 @@ static bool bd_may_claim(struct block_device *bdev, struct block_device *whole,
else if (bdev->bd_contains == bdev)
return true; /* is a whole device which isn't held */
@@ -48745,7 +48850,7 @@ index 9a37a9b..80968f3 100644
/*
* We'll have a dentry and an inode for
diff --git a/fs/dcache.c b/fs/dcache.c
-index bb7f4cc..dcc8779 100644
+index e923bf4..dcc8779 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -103,11 +103,11 @@ static unsigned int d_hash_shift __read_mostly;
@@ -48764,96 +48869,7 @@ index bb7f4cc..dcc8779 100644
return dentry_hashtable + (hash & D_HASHMASK);
}
-@@ -2445,7 +2445,6 @@ static int prepend_path(const struct path *path,
- bool slash = false;
- int error = 0;
-
-- br_read_lock(vfsmount_lock);
- while (dentry != root->dentry || vfsmnt != root->mnt) {
- struct dentry * parent;
-
-@@ -2475,8 +2474,6 @@ static int prepend_path(const struct path *path,
- if (!error && !slash)
- error = prepend(buffer, buflen, "/", 1);
-
--out:
-- br_read_unlock(vfsmount_lock);
- return error;
-
- global_root:
-@@ -2493,7 +2490,7 @@ global_root:
- error = prepend(buffer, buflen, "/", 1);
- if (!error)
- error = vfsmnt->mnt_ns ? 1 : 2;
-- goto out;
-+ return error;
- }
-
- /**
-@@ -2520,9 +2517,11 @@ char *__d_path(const struct path *path,
- int error;
-
- prepend(&res, &buflen, "\0", 1);
-+ br_read_lock(vfsmount_lock);
- write_seqlock(&rename_lock);
- error = prepend_path(path, root, &res, &buflen);
- write_sequnlock(&rename_lock);
-+ br_read_unlock(vfsmount_lock);
-
- if (error < 0)
- return ERR_PTR(error);
-@@ -2539,9 +2538,11 @@ char *d_absolute_path(const struct path *path,
- int error;
-
- prepend(&res, &buflen, "\0", 1);
-+ br_read_lock(vfsmount_lock);
- write_seqlock(&rename_lock);
- error = prepend_path(path, &root, &res, &buflen);
- write_sequnlock(&rename_lock);
-+ br_read_unlock(vfsmount_lock);
-
- if (error > 1)
- error = -EINVAL;
-@@ -2605,11 +2606,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
- return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
-
- get_fs_root(current->fs, &root);
-+ br_read_lock(vfsmount_lock);
- write_seqlock(&rename_lock);
- error = path_with_deleted(path, &root, &res, &buflen);
-+ write_sequnlock(&rename_lock);
-+ br_read_unlock(vfsmount_lock);
- if (error < 0)
- res = ERR_PTR(error);
-- write_sequnlock(&rename_lock);
- path_put(&root);
- return res;
- }
-@@ -2764,6 +2767,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
- get_fs_root_and_pwd(current->fs, &root, &pwd);
-
- error = -ENOENT;
-+ br_read_lock(vfsmount_lock);
- write_seqlock(&rename_lock);
- if (!d_unlinked(pwd.dentry)) {
- unsigned long len;
-@@ -2773,6 +2777,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
- prepend(&cwd, &buflen, "\0", 1);
- error = prepend_path(&pwd, &root, &cwd, &buflen);
- write_sequnlock(&rename_lock);
-+ br_read_unlock(vfsmount_lock);
-
- if (error < 0)
- goto out;
-@@ -2793,6 +2798,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
- }
- } else {
- write_sequnlock(&rename_lock);
-+ br_read_unlock(vfsmount_lock);
- }
-
- out:
-@@ -3049,7 +3055,7 @@ void __init vfs_caches_init(unsigned long mempages)
+@@ -3055,7 +3055,7 @@ void __init vfs_caches_init(unsigned long mempages)
mempages -= reserve;
names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -52731,18 +52747,9 @@ index fe5c5fb6..638dac1 100644
static struct nfsd4_operation nfsd4_ops[];
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 800c215..a92d930 100644
+index 24afa96..a92d930 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
-@@ -280,7 +280,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
- iattr->ia_valid |= ATTR_SIZE;
- }
- if (bmval[0] & FATTR4_WORD0_ACL) {
-- int nace;
-+ u32 nace;
- struct nfs4_ace *ace;
-
- READ_BUF(4); len += 4;
@@ -1451,7 +1451,7 @@ nfsd4_decode_notsupp(struct nfsd4_compoundargs *argp, void *p)
typedef __be32(*nfsd4_dec)(struct nfsd4_compoundargs *argp, void *);
@@ -53546,7 +53553,7 @@ index 439b5a1..61db155 100644
+}
+#endif
diff --git a/fs/proc/base.c b/fs/proc/base.c
-index 1ace83d..a2bc635 100644
+index 1ace83d..83b9247 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -107,6 +107,22 @@ struct pid_entry {
@@ -53760,6 +53767,15 @@ index 1ace83d..a2bc635 100644
if (!mm)
return 0;
+@@ -809,7 +851,7 @@ static ssize_t mem_rw(struct file *file, char __user *buf,
+ goto free;
+
+ while (count > 0) {
+- int this_len = min_t(int, count, PAGE_SIZE);
++ ssize_t this_len = min_t(ssize_t, count, PAGE_SIZE);
+
+ if (write && copy_from_user(page, buf, this_len)) {
+ copied = -EFAULT;
@@ -885,42 +927,49 @@ static const struct file_operations proc_mem_operations = {
.release = mem_release,
};
@@ -53777,7 +53793,7 @@ index 1ace83d..a2bc635 100644
unsigned long src = *ppos;
- int ret = -ESRCH;
- struct mm_struct *mm;
-+ int ret = 0;
++ ssize_t ret = -ESRCH;
+ struct mm_struct *mm = file->private_data;
- if (!task)
@@ -54911,21 +54927,6 @@ index 7a99811..a7c96c4 100644
SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
SF(s_do_balance), SF(s_unneeded_left_neighbor),
SF(s_good_search_by_key_reada), SF(s_bmaps),
-diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c
-index 6bc346c..04eecc4 100644
---- a/fs/reiserfs/xattr.c
-+++ b/fs/reiserfs/xattr.c
-@@ -187,8 +187,8 @@ fill_with_dentries(void *buf, const char *name, int namelen, loff_t offset,
- if (dbuf->count == ARRAY_SIZE(dbuf->dentries))
- return -ENOSPC;
-
-- if (name[0] == '.' && (name[1] == '\0' ||
-- (name[1] == '.' && name[2] == '\0')))
-+ if (name[0] == '.' && (namelen < 2 ||
-+ (namelen == 2 && name[1] == '.')))
- return 0;
-
- dentry = lookup_one_len(name, dbuf->xadir, namelen);
diff --git a/fs/select.c b/fs/select.c
index d33418f..2a5345e 100644
--- a/fs/select.c
@@ -55204,8 +55205,29 @@ index 7b21801..ee8fe9b 100644
generic_fillattr(inode, stat);
return 0;
+diff --git a/fs/sysfs/bin.c b/fs/sysfs/bin.c
+index a475983..3aab767 100644
+--- a/fs/sysfs/bin.c
++++ b/fs/sysfs/bin.c
+@@ -233,13 +233,13 @@ static int bin_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
+ return ret;
+ }
+
+-static int bin_access(struct vm_area_struct *vma, unsigned long addr,
+- void *buf, int len, int write)
++static ssize_t bin_access(struct vm_area_struct *vma, unsigned long addr,
++ void *buf, size_t len, int write)
+ {
+ struct file *file = vma->vm_file;
+ struct bin_buffer *bb = file->private_data;
+ struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
+- int ret;
++ ssize_t ret;
+
+ if (!bb->vm_ops)
+ return -EINVAL;
diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index fabbb81..91a12e3 100644
+index 3899e24..4d594a7 100644
--- a/fs/sysfs/dir.c
+++ b/fs/sysfs/dir.c
@@ -642,6 +642,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd,
@@ -56602,7 +56624,7 @@ index 0000000..1b9afa9
+endif
diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
new file mode 100644
-index 0000000..5553e8c
+index 0000000..5ce409b
--- /dev/null
+++ b/grsecurity/gracl.c
@@ -0,0 +1,4216 @@
@@ -58920,7 +58942,7 @@ index 0000000..5553e8c
+ return;
+
+ for (i = 0; i < RLIM_NLIMITS; i++) {
-+ if (!(proc->resmask & (1 << i)))
++ if (!(proc->resmask & (1U << i)))
+ continue;
+
+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
@@ -60102,7 +60124,7 @@ index 0000000..5553e8c
+ acl = task->acl;
+
+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+ !(acl->resmask & (1 << (unsigned short) res))))
++ !(acl->resmask & (1U << (unsigned short) res))))
+ return;
+
+ if (wanted >= acl->res[res].rlim_cur) {
@@ -61479,10 +61501,10 @@ index 0000000..b20f6e9
+}
diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
new file mode 100644
-index 0000000..58800a7
+index 0000000..db7cc23
--- /dev/null
+++ b/grsecurity/gracl_ip.c
-@@ -0,0 +1,384 @@
+@@ -0,0 +1,387 @@
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
+#include <asm/errno.h>
@@ -61589,7 +61611,7 @@ index 0000000..58800a7
+
+ curr = current->acl;
+
-+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
++ if (curr->sock_families[domain / 32] & (1U << (domain % 32))) {
+ /* the family is allowed, if this is PF_INET allow it only if
+ the extra sock type/protocol checks pass */
+ if (domain == PF_INET)
@@ -61616,8 +61638,8 @@ index 0000000..58800a7
+ if (!curr->ips)
+ goto exit;
+
-+ if ((curr->ip_type & (1 << type)) &&
-+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++ if ((curr->ip_type & (1U << type)) &&
++ (curr->ip_proto[protocol / 32] & (1U << (protocol % 32))))
+ goto exit;
+
+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
@@ -61654,6 +61676,9 @@ index 0000000..58800a7
+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
+ else
++#ifndef CONFIG_IPV6
++ if (domain != PF_INET6)
++#endif
+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
+ gr_socktype_to_name(type), protocol);
+
@@ -61669,8 +61694,8 @@ index 0000000..58800a7
+ (ip_port <= ip->high) &&
+ ((ntohl(ip_addr) & our_netmask) ==
+ (ntohl(our_addr) & our_netmask))
-+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+ && (ip->type & (1 << type))) {
++ && (ip->proto[protocol / 32] & (1U << (protocol % 32)))
++ && (ip->type & (1U << type))) {
+ if (ip->mode & GR_INVERT)
+ return 2; // specifically denied
+ else
@@ -62156,7 +62181,7 @@ index 0000000..39645c9
+}
diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
new file mode 100644
-index 0000000..5556be3
+index 0000000..466c527
--- /dev/null
+++ b/grsecurity/gracl_segv.c
@@ -0,0 +1,299 @@
@@ -62353,7 +62378,7 @@ index 0000000..5556be3
+
+ curr = task->acl;
+
-+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
++ if (!(curr->resmask & (1U << GR_CRASH_RES)))
+ return;
+
+ if (time_before_eq(curr->expires, get_seconds())) {
@@ -62419,7 +62444,7 @@ index 0000000..5556be3
+ current->role);
+ read_unlock(&gr_inode_lock);
+
-+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++ if (!curr || !(curr->resmask & (1U << GR_CRASH_RES)) ||
+ (!curr->crashes && !curr->expires))
+ return 0;
+
@@ -68830,7 +68855,7 @@ index 3797270..7765ede 100644
struct mca_bus {
u64 default_dma_mask;
diff --git a/include/linux/mm.h b/include/linux/mm.h
-index 4baadd1..77a7311 100644
+index 4baadd1..b5b424e 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -115,7 +115,14 @@ extern unsigned int kobjsize(const void *objp);
@@ -68848,6 +68873,17 @@ index 4baadd1..77a7311 100644
#define VM_PFN_AT_MMAP 0x40000000 /* PFNMAP vma that is fully mapped at mmap time */
#define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
+@@ -213,8 +220,8 @@ struct vm_operations_struct {
+ /* called by access_process_vm when get_user_pages() fails, typically
+ * for use by special VMAs that can switch between memory and hardware
+ */
+- int (*access)(struct vm_area_struct *vma, unsigned long addr,
+- void *buf, int len, int write);
++ ssize_t (*access)(struct vm_area_struct *vma, unsigned long addr,
++ void *buf, size_t len, int write);
+ #ifdef CONFIG_NUMA
+ /*
+ * set_policy() op must add a reference to any non-NULL @new mempolicy
@@ -241,6 +248,7 @@ struct vm_operations_struct {
const nodemask_t *to, unsigned long flags);
#endif
@@ -68856,6 +68892,32 @@ index 4baadd1..77a7311 100644
struct mmu_gather;
struct inode;
+@@ -940,8 +948,8 @@ int follow_pfn(struct vm_area_struct *vma, unsigned long address,
+ unsigned long *pfn);
+ int follow_phys(struct vm_area_struct *vma, unsigned long address,
+ unsigned int flags, unsigned long *prot, resource_size_t *phys);
+-int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+- void *buf, int len, int write);
++ssize_t generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
++ void *buf, size_t len, int write);
+
+ static inline void unmap_shared_mapping_range(struct address_space *mapping,
+ loff_t const holebegin, loff_t const holelen)
+@@ -983,10 +991,10 @@ static inline int fixup_user_fault(struct task_struct *tsk,
+ }
+ #endif
+
+-extern int make_pages_present(unsigned long addr, unsigned long end);
+-extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write);
+-extern int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+- void *buf, int len, int write);
++extern ssize_t make_pages_present(unsigned long addr, unsigned long end);
++extern ssize_t access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, size_t len, int write);
++extern ssize_t access_remote_vm(struct mm_struct *mm, unsigned long addr,
++ void *buf, size_t len, int write);
+
+ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ unsigned long start, int len, unsigned int foll_flags,
@@ -1012,34 +1020,6 @@ int set_page_dirty(struct page *page);
int set_page_dirty_lock(struct page *page);
int clear_page_dirty_for_io(struct page *page);
@@ -77660,10 +77722,10 @@ index 8a46f5d..bbe6f9c 100644
.clock_get = alarm_clock_get,
.timer_create = alarm_timer_create,
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index fd4a7b1..fae5c2a 100644
+index cd068b2..b2067ab 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
-@@ -115,7 +115,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
+@@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct clock_event_device *dev, int cpu)
* then clear the broadcast bit.
*/
if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
@@ -79589,7 +79651,7 @@ index 1b03878..d62c02b 100644
/* keep elevated page count for bad page */
return ret;
diff --git a/mm/memory.c b/mm/memory.c
-index 4f2add1..3a99036 100644
+index 4f2add1..6af39ff 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -462,8 +462,12 @@ static inline void free_pmd_range(struct mmu_gather *tlb, pud_t *pud,
@@ -80192,7 +80254,7 @@ index 4f2add1..3a99036 100644
#endif /* __PAGETABLE_PUD_FOLDED */
#ifndef __PAGETABLE_PMD_FOLDED
-@@ -3582,6 +3841,30 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
+@@ -3582,11 +3841,35 @@ int __pmd_alloc(struct mm_struct *mm, pud_t *pud, unsigned long address)
spin_unlock(&mm->page_table_lock);
return 0;
}
@@ -80222,7 +80284,14 @@ index 4f2add1..3a99036 100644
+}
#endif /* __PAGETABLE_PMD_FOLDED */
- int make_pages_present(unsigned long addr, unsigned long end)
+-int make_pages_present(unsigned long addr, unsigned long end)
++ssize_t make_pages_present(unsigned long addr, unsigned long end)
+ {
+- int ret, len, write;
++ ssize_t ret, len, write;
+ struct vm_area_struct * vma;
+
+ vma = find_vma(current->mm, addr);
@@ -3619,7 +3902,7 @@ static int __init gate_vma_init(void)
gate_vma.vm_start = FIXADDR_USER_START;
gate_vma.vm_end = FIXADDR_USER_END;
@@ -80232,6 +80301,63 @@ index 4f2add1..3a99036 100644
/*
* Make sure the vDSO gets into every core dump.
* Dumping its contents makes post-mortem fully interpretable later
+@@ -3759,8 +4042,8 @@ out:
+ return ret;
+ }
+
+-int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+- void *buf, int len, int write)
++ssize_t generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
++ void *buf, size_t len, int write)
+ {
+ resource_size_t phys_addr;
+ unsigned long prot = 0;
+@@ -3785,8 +4068,8 @@ int generic_access_phys(struct vm_area_struct *vma, unsigned long addr,
+ * Access another process' address space as given in mm. If non-NULL, use the
+ * given task for page fault accounting.
+ */
+-static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+- unsigned long addr, void *buf, int len, int write)
++static ssize_t __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
++ unsigned long addr, void *buf, size_t len, int write)
+ {
+ struct vm_area_struct *vma;
+ void *old_buf = buf;
+@@ -3794,7 +4077,7 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+ down_read(&mm->mmap_sem);
+ /* ignore errors, just check how much was successfully transferred */
+ while (len) {
+- int bytes, ret, offset;
++ ssize_t bytes, ret, offset;
+ void *maddr;
+ struct page *page = NULL;
+
+@@ -3853,8 +4136,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+ *
+ * The caller must hold a reference on @mm.
+ */
+-int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+- void *buf, int len, int write)
++ssize_t access_remote_vm(struct mm_struct *mm, unsigned long addr,
++ void *buf, size_t len, int write)
+ {
+ return __access_remote_vm(NULL, mm, addr, buf, len, write);
+ }
+@@ -3864,11 +4147,11 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+ * Source/target buffer must be kernel space,
+ * Do not walk the page table directly, use get_user_pages
+ */
+-int access_process_vm(struct task_struct *tsk, unsigned long addr,
+- void *buf, int len, int write)
++ssize_t access_process_vm(struct task_struct *tsk, unsigned long addr,
++ void *buf, size_t len, int write)
+ {
+ struct mm_struct *mm;
+- int ret;
++ ssize_t ret;
+
+ mm = get_task_mm(tsk);
+ if (!mm)
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 4d1e637..9e0a005 100644
--- a/mm/mempolicy.c
@@ -80423,7 +80549,7 @@ index 4f4f53b..de8e432 100644
capable(CAP_IPC_LOCK))
ret = do_mlockall(flags);
diff --git a/mm/mmap.c b/mm/mmap.c
-index eae90af..d2e3afd 100644
+index dff37a6..d2e3afd 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -30,6 +30,7 @@
@@ -81122,15 +81248,6 @@ index eae90af..d2e3afd 100644
}
unsigned long
-@@ -1573,7 +1837,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- if (mm) {
- /* Check the cache first. */
- /* (Cache hit rate is typically around 35%.) */
-- vma = mm->mmap_cache;
-+ vma = ACCESS_ONCE(mm->mmap_cache);
- if (!(vma && vma->vm_end > addr && vma->vm_start <= addr)) {
- struct rb_node * rb_node;
-
@@ -1603,40 +1867,50 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
EXPORT_SYMBOL(find_vma);
@@ -82255,7 +82372,7 @@ index 07c08c4..8d4ad26 100644
return count;
}
diff --git a/mm/nommu.c b/mm/nommu.c
-index f59e170..a9e7b15 100644
+index f0cd7ab..9b60530 100644
--- a/mm/nommu.c
+++ b/mm/nommu.c
@@ -62,7 +62,6 @@ int sysctl_overcommit_memory = OVERCOMMIT_GUESS; /* heuristic overcommit */
@@ -82266,15 +82383,6 @@ index f59e170..a9e7b15 100644
atomic_long_t mmap_pages_allocated;
-@@ -807,7 +806,7 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
- struct vm_area_struct *vma;
-
- /* check the cache first */
-- vma = mm->mmap_cache;
-+ vma = ACCESS_ONCE(mm->mmap_cache);
- if (vma && vma->vm_start <= addr && vma->vm_end > addr)
- return vma;
-
@@ -827,15 +826,6 @@ struct vm_area_struct *find_vma(struct mm_struct *mm, unsigned long addr)
EXPORT_SYMBOL(find_vma);
@@ -82299,6 +82407,37 @@ index f59e170..a9e7b15 100644
*region = *vma->vm_region;
new->vm_region = region;
+@@ -1961,8 +1952,8 @@ int filemap_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+ }
+ EXPORT_SYMBOL(filemap_fault);
+
+-static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+- unsigned long addr, void *buf, int len, int write)
++static ssize_t __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
++ unsigned long addr, void *buf, size_t len, int write)
+ {
+ struct vm_area_struct *vma;
+
+@@ -2003,8 +1994,8 @@ static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
+ *
+ * The caller must hold a reference on @mm.
+ */
+-int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+- void *buf, int len, int write)
++ssize_t access_remote_vm(struct mm_struct *mm, unsigned long addr,
++ void *buf, size_t len, int write)
+ {
+ return __access_remote_vm(NULL, mm, addr, buf, len, write);
+ }
+@@ -2013,7 +2004,7 @@ int access_remote_vm(struct mm_struct *mm, unsigned long addr,
+ * Access another process' address space.
+ * - source/target buffer must be kernel space
+ */
+-int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write)
++ssize_t access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, size_t len, int write)
+ {
+ struct mm_struct *mm;
+
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 50f0824..0ade43a 100644
--- a/mm/page-writeback.c
@@ -83966,7 +84105,7 @@ index 8fd603b..495a5a1 100644
return 0;
}
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index 5471628..3bd1bf5 100644
+index 963f285..3e3874d 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -513,7 +513,7 @@ out:
@@ -84880,7 +85019,7 @@ index 68bbf9f..5ef0d12 100644
return err;
diff --git a/net/core/dev.c b/net/core/dev.c
-index b23bbbf..1e6a604 100644
+index 720aea0..966cb89 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1142,10 +1142,14 @@ void dev_load(struct net *net, const char *name)
@@ -84943,7 +85082,7 @@ index b23bbbf..1e6a604 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
-@@ -3333,7 +3337,7 @@ ncls:
+@@ -3339,7 +3343,7 @@ ncls:
if (pt_prev) {
ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
} else {
@@ -84952,7 +85091,7 @@ index b23bbbf..1e6a604 100644
kfree_skb(skb);
/* Jamal, now you will not able to escape explaining
* me how you were going to use this. :-)
-@@ -3898,7 +3902,7 @@ void netif_napi_del(struct napi_struct *napi)
+@@ -3904,7 +3908,7 @@ void netif_napi_del(struct napi_struct *napi)
}
EXPORT_SYMBOL(netif_napi_del);
@@ -84961,7 +85100,7 @@ index b23bbbf..1e6a604 100644
{
struct softnet_data *sd = &__get_cpu_var(softnet_data);
unsigned long time_limit = jiffies + 2;
-@@ -4368,8 +4372,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
+@@ -4374,8 +4378,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v)
else
seq_printf(seq, "%04x", ntohs(pt->type));
@@ -84975,7 +85114,7 @@ index b23bbbf..1e6a604 100644
}
return 0;
-@@ -4431,7 +4440,7 @@ static void __net_exit dev_proc_net_exit(struct net *net)
+@@ -4437,7 +4446,7 @@ static void __net_exit dev_proc_net_exit(struct net *net)
proc_net_remove(net, "dev");
}
@@ -84984,7 +85123,7 @@ index b23bbbf..1e6a604 100644
.init = dev_proc_net_init,
.exit = dev_proc_net_exit,
};
-@@ -5926,7 +5935,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
+@@ -5932,7 +5941,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev,
} else {
netdev_stats_to_stats64(storage, &dev->stats);
}
@@ -84993,7 +85132,7 @@ index b23bbbf..1e6a604 100644
return storage;
}
EXPORT_SYMBOL(dev_get_stats);
-@@ -6505,7 +6514,7 @@ static void __net_exit netdev_exit(struct net *net)
+@@ -6511,7 +6520,7 @@ static void __net_exit netdev_exit(struct net *net)
kfree(net->dev_index_head);
}
@@ -85002,7 +85141,7 @@ index b23bbbf..1e6a604 100644
.init = netdev_init,
.exit = netdev_exit,
};
-@@ -6567,7 +6576,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+@@ -6573,7 +6582,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
rtnl_unlock();
}
@@ -85140,7 +85279,7 @@ index dd00b71..74d1779 100644
return error;
}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 3b5e680..d9180cb 100644
+index 3b5e680..ecb9676 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -57,7 +57,7 @@ struct rtnl_link {
@@ -85178,6 +85317,24 @@ index 3b5e680..d9180cb 100644
}
EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
+@@ -1064,7 +1067,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ rcu_read_lock();
+ cb->seq = net->dev_base_seq;
+
+- if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
++ if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+ ifla_policy) >= 0) {
+
+ if (tb[IFLA_EXT_MASK])
+@@ -1907,7 +1910,7 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
+ u32 ext_filter_mask = 0;
+ u16 min_ifinfo_dump_size = 0;
+
+- if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
++ if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+ ifla_policy) >= 0) {
+ if (tb[IFLA_EXT_MASK])
+ ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
diff --git a/net/core/scm.c b/net/core/scm.c
index ff52ad0..aff1c0f 100644
--- a/net/core/scm.c
@@ -86356,10 +86513,10 @@ index 5485077..7e37374 100644
hdr = register_sysctl_paths(net_ipv4_ctl_path, ipv4_table);
if (hdr == NULL)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 1b1f7af..911f274 100644
+index 3124e17..a5dd7e1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
-@@ -4732,7 +4732,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
+@@ -4729,7 +4729,7 @@ static struct sk_buff *tcp_collapse_one(struct sock *sk, struct sk_buff *skb,
* simplifies code)
*/
static void
@@ -86368,7 +86525,7 @@ index 1b1f7af..911f274 100644
struct sk_buff *head, struct sk_buff *tail,
u32 start, u32 end)
{
-@@ -5547,6 +5547,9 @@ slow_path:
+@@ -5544,6 +5544,9 @@ slow_path:
if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
goto csum_error;
@@ -86378,7 +86535,7 @@ index 1b1f7af..911f274 100644
/*
* Standard slow path.
*/
-@@ -5555,7 +5558,7 @@ slow_path:
+@@ -5552,7 +5555,7 @@ slow_path:
return 0;
step5:
@@ -86387,7 +86544,7 @@ index 1b1f7af..911f274 100644
goto discard;
/* ts_recent update must be made after we are sure that the packet
-@@ -5791,6 +5794,7 @@ discard:
+@@ -5788,6 +5791,7 @@ discard:
tcp_paws_reject(&tp->rx_opt, 0))
goto discard_and_undo;
@@ -86395,7 +86552,7 @@ index 1b1f7af..911f274 100644
if (th->syn) {
/* We see SYN without ACK. It is attempt of
* simultaneous connect with crossed SYNs.
-@@ -5839,6 +5843,7 @@ discard:
+@@ -5836,6 +5840,7 @@ discard:
goto discard;
#endif
}
@@ -86403,7 +86560,7 @@ index 1b1f7af..911f274 100644
/* "fifth, if neither of the SYN or RST bits is set then
* drop the segment and return."
*/
-@@ -5882,7 +5887,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5879,7 +5884,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
goto discard;
if (th->syn) {
@@ -86412,7 +86569,7 @@ index 1b1f7af..911f274 100644
goto discard;
if (icsk->icsk_af_ops->conn_request(sk, skb) < 0)
return 1;
-@@ -5921,11 +5926,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -5918,11 +5923,14 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
return 0;
}
@@ -86428,7 +86585,7 @@ index 1b1f7af..911f274 100644
int acceptable = tcp_ack(sk, skb, FLAG_SLOWPATH) > 0;
switch (sk->sk_state) {
-@@ -6030,8 +6038,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
+@@ -6027,8 +6035,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
}
break;
}
@@ -86731,7 +86888,7 @@ index 5a65eea..bd913a1 100644
int udp4_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index b27baed..5c4d458 100644
+index 8589c2d..ca17f68 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2151,7 +2151,7 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
@@ -87193,23 +87350,6 @@ index 8c25419..47a51ae 100644
}
int udp6_seq_show(struct seq_file *seq, void *v)
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index c24f25a..f4b49c5 100644
---- a/net/irda/af_irda.c
-+++ b/net/irda/af_irda.c
-@@ -2584,8 +2584,10 @@ bed:
- NULL, NULL, NULL);
-
- /* Check if the we got some results */
-- if (!self->cachedaddr)
-- return -EAGAIN; /* Didn't find any devices */
-+ if (!self->cachedaddr) {
-+ err = -EAGAIN; /* Didn't find any devices */
-+ goto out;
-+ }
- daddr = self->cachedaddr;
- /* Cleanup */
- self->cachedaddr = 0;
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 253695d..9481ce8 100644
--- a/net/irda/ircomm/ircomm_tty.c
@@ -88153,10 +88293,10 @@ index 3d1d55d..1ee2a18 100644
.exit = netlink_net_exit,
};
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
-index 482fa57..818ca98 100644
+index 874f8ff..339bb58 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
-@@ -287,18 +287,20 @@ int genl_register_ops(struct genl_family *family, struct genl_ops *ops)
+@@ -288,18 +288,20 @@ int genl_register_ops(struct genl_family *family, struct genl_ops *ops)
goto errout;
}
@@ -88182,7 +88322,7 @@ index 482fa57..818ca98 100644
err = 0;
errout:
return err;
-@@ -328,9 +330,9 @@ int genl_unregister_ops(struct genl_family *family, struct genl_ops *ops)
+@@ -329,9 +331,9 @@ int genl_unregister_ops(struct genl_family *family, struct genl_ops *ops)
genl_lock();
list_for_each_entry(rc, &family->ops_list, ops_list) {
if (rc == ops) {
@@ -89061,7 +89201,7 @@ index 8da4481..d02565e 100644
+ (rtt >> sctp_rto_alpha);
} else {
diff --git a/net/socket.c b/net/socket.c
-index 68879db..1187d18 100644
+index 68879db..a5288e9 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -88,6 +88,7 @@
@@ -89223,6 +89363,15 @@ index 68879db..1187d18 100644
SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
unsigned, flags, struct sockaddr __user *, addr,
int, addr_len)
+@@ -1736,7 +1798,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+ struct socket *sock;
+ struct iovec iov;
+ struct msghdr msg;
+- struct sockaddr_storage address;
++ struct sockaddr_storage address = { };
+ int err, err2;
+ int fput_needed;
+
@@ -1950,7 +2012,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
* checking falls down on this.
*/
@@ -89341,10 +89490,34 @@ index 68879db..1187d18 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index b2250da..6cabe9c 100644
+index b2250da..db374b7 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
-@@ -903,7 +903,9 @@ call_start(struct rpc_task *task)
+@@ -163,10 +163,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
+ err = rpciod_up();
+ if (err)
+ goto out_no_rpciod;
+- err = -EINVAL;
+- if (!xprt)
+- goto out_no_xprt;
+
++ err = -EINVAL;
+ if (args->version >= program->nrvers)
+ goto out_err;
+ version = program->version[args->version];
+@@ -259,10 +257,9 @@ out_no_stats:
+ kfree(clnt->cl_server);
+ kfree(clnt);
+ out_err:
+- xprt_put(xprt);
+-out_no_xprt:
+ rpciod_down();
+ out_no_rpciod:
++ xprt_put(xprt);
+ return ERR_PTR(err);
+ }
+
+@@ -903,7 +900,9 @@ call_start(struct rpc_task *task)
(RPC_IS_ASYNC(task) ? "async" : "sync"));
/* Increment call count */
@@ -89356,10 +89529,10 @@ index b2250da..6cabe9c 100644
task->tk_action = call_reserve;
}
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index 18c5a50..775f9f9 100644
+index dc6af27..e3fba77 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
-@@ -238,9 +238,9 @@ static int rpc_wait_bit_killable(void *word)
+@@ -240,9 +240,9 @@ static int rpc_wait_bit_killable(void *word)
#ifdef RPC_DEBUG
static void rpc_task_set_debuginfo(struct rpc_task *task)
{
@@ -89707,40 +89880,10 @@ index 1983717..4d6102c 100644
sub->evt.event = htohl(event, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 317bfe3..911c6c1 100644
+index 18978b6..911c6c1 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
-@@ -371,7 +371,7 @@ static void unix_sock_destructor(struct sock *sk)
- #endif
- }
-
--static int unix_release_sock(struct sock *sk, int embrion)
-+static void unix_release_sock(struct sock *sk, int embrion)
- {
- struct unix_sock *u = unix_sk(sk);
- struct dentry *dentry;
-@@ -444,8 +444,6 @@ static int unix_release_sock(struct sock *sk, int embrion)
-
- if (unix_tot_inflight)
- unix_gc(); /* Garbage collect fds */
--
-- return 0;
- }
-
- static void init_peercred(struct sock *sk)
-@@ -682,9 +680,10 @@ static int unix_release(struct socket *sock)
- if (!sk)
- return 0;
-
-+ unix_release_sock(sk, 0);
- sock->sk = NULL;
-
-- return unix_release_sock(sk, 0);
-+ return 0;
- }
-
- static int unix_autobind(struct socket *sock)
-@@ -767,6 +766,12 @@ static struct sock *unix_find_other(struct net *net,
+@@ -766,6 +766,12 @@ static struct sock *unix_find_other(struct net *net,
err = -ECONNREFUSED;
if (!S_ISSOCK(inode->i_mode))
goto put_fail;
@@ -89753,7 +89896,7 @@ index 317bfe3..911c6c1 100644
u = unix_find_socket_byinode(inode);
if (!u)
goto put_fail;
-@@ -787,6 +792,13 @@ static struct sock *unix_find_other(struct net *net,
+@@ -786,6 +792,13 @@ static struct sock *unix_find_other(struct net *net,
if (u) {
struct dentry *dentry;
dentry = unix_sk(u)->dentry;
@@ -89767,7 +89910,7 @@ index 317bfe3..911c6c1 100644
if (dentry)
touch_atime(unix_sk(u)->mnt, dentry);
} else
-@@ -869,11 +881,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+@@ -868,11 +881,18 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
err = security_path_mknod(&path, dentry, mode, 0);
if (err)
goto out_mknod_drop_write;
@@ -89786,7 +89929,7 @@ index 317bfe3..911c6c1 100644
mutex_unlock(&path.dentry->d_inode->i_mutex);
dput(path.dentry);
path.dentry = dentry;
-@@ -1957,7 +1976,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+@@ -1956,7 +1976,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
if ((UNIXCB(skb).pid != siocb->scm->pid) ||
(UNIXCB(skb).cred != siocb->scm->cred))
break;
@@ -89795,7 +89938,7 @@ index 317bfe3..911c6c1 100644
/* Copy credentials */
scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
check_creds = 1;
-@@ -2261,9 +2280,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2260,9 +2280,13 @@ static int unix_seq_show(struct seq_file *seq, void *v)
seq_puts(seq, "Num RefCount Protocol Flags Type St "
"Inode Path\n");
else {
@@ -89810,7 +89953,7 @@ index 317bfe3..911c6c1 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2290,8 +2313,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2289,8 +2313,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
}
for ( ; i < len; i++)
seq_putc(seq, u->addr->name->sun_path[i]);
@@ -90310,6 +90453,18 @@ index 0000000..5e0222d
+ [[ "$plugincc" =~ "$1" ]] && echo "$1"
+ [[ "$plugincc" =~ "$2" ]] && echo "$2"
+fi
+diff --git a/scripts/headers_install.pl b/scripts/headers_install.pl
+index 48462be..3e08f94 100644
+--- a/scripts/headers_install.pl
++++ b/scripts/headers_install.pl
+@@ -33,6 +33,7 @@ foreach my $file (@files) {
+ $line =~ s/([\s(])__user\s/$1/g;
+ $line =~ s/([\s(])__force\s/$1/g;
+ $line =~ s/([\s(])__iomem\s/$1/g;
++ $line =~ s/(\s?)__intentional_overflow\([-\d\s,]*\)\s?/$1/g;
+ $line =~ s/\s__attribute_const__\s/ /g;
+ $line =~ s/\s__attribute_const__$//g;
+ $line =~ s/\b__packed\b/__attribute__((packed))/g;
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index d1d0ae8..6b73b2a 100644
--- a/scripts/mod/file2alias.c
@@ -90549,7 +90704,7 @@ index 38f6617..e70b72b 100755
exuberant()
diff --git a/security/Kconfig b/security/Kconfig
-index 51bd5a0..14ae375 100644
+index 51bd5a0..43546c5 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -4,6 +4,944 @@
@@ -91308,7 +91463,7 @@ index 51bd5a0..14ae375 100644
+
+config PAX_MEMORY_STACKLEAK
+ bool "Sanitize kernel stack"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
++ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN))
+ depends on X86
+ help
+ By saying Y here the kernel will erase the kernel stack before it
@@ -91724,7 +91879,7 @@ index 4414abd..bb89c73 100644
/* record the root user tracking */
rb_link_node(&root_key_user.node,
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
-index 0b3f5d7..892c8a6 100644
+index b70eaa2..35b5b71 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -921,7 +921,7 @@ static int keyctl_change_reqkey_auth(struct key *key)
@@ -91760,7 +91915,7 @@ index 0b3f5d7..892c8a6 100644
- ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
+ ret = keyctl_instantiate_key_common(id, (const struct iovec __force_user *)iov, ioc, ret, ringid);
-
+ err:
if (iov != iovstack)
kfree(iov);
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
@@ -99248,17 +99403,20 @@ index 0000000..6fcc08d
+alloc_dr_65495 alloc_dr 2 65495 NULL
diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
new file mode 100644
-index 0000000..63c46e5
+index 0000000..9db0d0e
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,2050 @@
+@@ -0,0 +1,2114 @@
+/*
-+ * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011, 2012, 2013 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
+ * http://www.grsecurity.net/~ephox/overflow_plugin/
+ *
++ * Documentation:
++ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
++ *
+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
@@ -99338,7 +99496,7 @@ index 0000000..63c46e5
+static void print_missing_msg(tree func, unsigned int argnum);
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20130316beta",
++ .version = "20130410beta",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+
@@ -100143,6 +100301,61 @@ index 0000000..63c46e5
+ return create_assign(visited, stmt, rhs1, AFTER_STMT);
+}
+
++static bool no_uses(tree node)
++{
++ imm_use_iterator imm_iter;
++ use_operand_p use_p;
++
++ FOR_EACH_IMM_USE_FAST(use_p, imm_iter, node) {
++ const_gimple use_stmt = USE_STMT(use_p);
++ if (use_stmt == NULL)
++ return true;
++ if (is_gimple_debug(use_stmt))
++ continue;
++ if (!(gimple_bb(use_stmt)->flags & BB_REACHABLE))
++ continue;
++ return false;
++ }
++ return true;
++}
++
++// 3.8.5 mm/page-writeback.c __ilog2_u64(): ret, uint + uintmax; uint -> int; int max
++static bool is_const_plus_unsigned_signed_truncation(const_tree lhs)
++{
++ tree rhs1, lhs_type, rhs_type, rhs2, not_const_rhs;
++ gimple def_stmt = get_def_stmt(lhs);
++
++ if (!def_stmt || !gimple_assign_cast_p(def_stmt))
++ return false;
++
++ rhs1 = gimple_assign_rhs1(def_stmt);
++ rhs_type = TREE_TYPE(rhs1);
++ lhs_type = TREE_TYPE(lhs);
++ if (TYPE_UNSIGNED(lhs_type) || !TYPE_UNSIGNED(rhs_type))
++ return false;
++ if (TYPE_MODE(lhs_type) != TYPE_MODE(rhs_type))
++ return false;
++
++ def_stmt = get_def_stmt(rhs1);
++ if (!def_stmt || gimple_code(def_stmt) != GIMPLE_ASSIGN || gimple_num_ops(def_stmt) != 3)
++ return false;
++
++ if (gimple_assign_rhs_code(def_stmt) != PLUS_EXPR)
++ return false;
++
++ rhs1 = gimple_assign_rhs1(def_stmt);
++ rhs2 = gimple_assign_rhs2(def_stmt);
++ if (!is_gimple_constant(rhs1) && !is_gimple_constant(rhs2))
++ return false;
++
++ if (is_gimple_constant(rhs2))
++ not_const_rhs = rhs1;
++ else
++ not_const_rhs = rhs2;
++
++ return no_uses(not_const_rhs);
++}
++
+static bool skip_lhs_cast_check(const_gimple stmt)
+{
+ const_tree rhs = gimple_assign_rhs1(stmt);
@@ -100152,6 +100365,9 @@ index 0000000..63c46e5
+ if (gimple_code(def_stmt) == GIMPLE_ASM)
+ return true;
+
++ if (is_const_plus_unsigned_signed_truncation(rhs))
++ return true;
++
+ return false;
+}
+
@@ -100401,6 +100617,9 @@ index 0000000..63c46e5
+
+ gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
+
++ if (is_const_plus_unsigned_signed_truncation(rhs))
++ return;
++
+ type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
+ // typemax (-1) < typemin (0)
+ if (TREE_OVERFLOW(type_max))
@@ -101637,10 +101856,10 @@ index 0000000..ac2901e
+}
diff --git a/tools/gcc/structleak_plugin.c b/tools/gcc/structleak_plugin.c
new file mode 100644
-index 0000000..77a6b1d
+index 0000000..5afca14
--- /dev/null
+++ b/tools/gcc/structleak_plugin.c
-@@ -0,0 +1,270 @@
+@@ -0,0 +1,271 @@
+/*
+ * Copyright 2013 by PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -101698,7 +101917,7 @@ index 0000000..77a6b1d
+void debug_gimple_stmt(gimple gs);
+
+static struct plugin_info structleak_plugin_info = {
-+ .version = "201303270300",
++ .version = "201304082245",
+ .help = "disable\tdo not activate plugin\n",
+};
+
@@ -101780,18 +101999,19 @@ index 0000000..77a6b1d
+ // first check if the variable is already initialized, warn otherwise
+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
+ gimple stmt = gsi_stmt(gsi);
++ tree rhs1 = gimple_assign_rhs1(stmt);
+
-+ // we're looking for an assignment...
-+ if (!(is_gimple_assign(stmt)))
++ // we're looking for an assignment of a single rhs...
++ if (!gimple_assign_single_p(stmt))
+ continue;
-+ // ... of a single rhs (unary op)...
-+ if (gimple_num_ops(stmt) != 2)
++ // ... of a non-clobbering expression...
++ if (TREE_CLOBBER_P(rhs1))
+ continue;
+ // ... to our variable...
+ if (gimple_get_lhs(stmt) != var)
+ continue;
+ // if it's an initializer then we're good
-+ if (TREE_CODE(gimple_assign_rhs1(stmt)) == CONSTRUCTOR)
++ if (TREE_CODE(rhs1) == CONSTRUCTOR)
+ return;
+ }
+
@@ -101833,7 +102053,7 @@ index 0000000..77a6b1d
+ tree type = TREE_TYPE(var);
+
+ gcc_assert(DECL_P(var));
-+ if (is_global_var(var))
++ if (!auto_var_in_fn_p(var, current_function_decl))
+ continue;
+
+ // only care about structure types
diff --git a/3.2.42/4425_grsec_remove_EI_PAX.patch b/3.2.43/4425_grsec_remove_EI_PAX.patch
similarity index 96%
rename from 3.2.42/4425_grsec_remove_EI_PAX.patch
rename to 3.2.43/4425_grsec_remove_EI_PAX.patch
index 97e6951..7d06ac2 100644
--- a/3.2.42/4425_grsec_remove_EI_PAX.patch
+++ b/3.2.43/4425_grsec_remove_EI_PAX.patch
@@ -8,7 +8,7 @@ X-Gentoo-Bug-URL: https://bugs.gentoo.org/445600
diff -Nuar linux-3.7.1-hardened.orig/security/Kconfig linux-3.7.1-hardened/security/Kconfig
--- linux-3.7.1-hardened.orig/security/Kconfig 2012-12-26 08:39:29.000000000 -0500
+++ linux-3.7.1-hardened/security/Kconfig 2012-12-26 09:05:44.000000000 -0500
-@@ -263,7 +263,7 @@
+@@ -265,7 +265,7 @@
config PAX_EI_PAX
bool 'Use legacy ELF header marking'
diff --git a/3.2.42/4430_grsec-remove-localversion-grsec.patch b/3.2.43/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.2.42/4430_grsec-remove-localversion-grsec.patch
rename to 3.2.43/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.2.42/4435_grsec-mute-warnings.patch b/3.2.43/4435_grsec-mute-warnings.patch
similarity index 96%
rename from 3.2.42/4435_grsec-mute-warnings.patch
rename to 3.2.43/4435_grsec-mute-warnings.patch
index e85abd6..f099757 100644
--- a/3.2.42/4435_grsec-mute-warnings.patch
+++ b/3.2.43/4435_grsec-mute-warnings.patch
@@ -37,7 +37,7 @@ Acked-by: Christian Heim <phreak@gentoo.org>
HOSTCXX = g++
-HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
+HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
- HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
+ HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
diff --git a/3.2.42/4440_grsec-remove-protected-paths.patch b/3.2.43/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.2.42/4440_grsec-remove-protected-paths.patch
rename to 3.2.43/4440_grsec-remove-protected-paths.patch
diff --git a/3.2.42/4450_grsec-kconfig-default-gids.patch b/3.2.43/4450_grsec-kconfig-default-gids.patch
similarity index 95%
rename from 3.2.42/4450_grsec-kconfig-default-gids.patch
rename to 3.2.43/4450_grsec-kconfig-default-gids.patch
index 3dfdc8f..7c20c40 100644
--- a/3.2.42/4450_grsec-kconfig-default-gids.patch
+++ b/3.2.43/4450_grsec-kconfig-default-gids.patch
@@ -16,7 +16,7 @@ from shooting themselves in the foot.
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2012-10-13 09:51:35.000000000 -0400
+++ b/grsecurity/Kconfig 2012-10-13 09:52:32.000000000 -0400
-@@ -572,7 +572,7 @@
+@@ -578,7 +578,7 @@
config GRKERNSEC_AUDIT_GID
int "GID for auditing"
depends on GRKERNSEC_AUDIT_GROUP
@@ -25,7 +25,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
config GRKERNSEC_EXECLOG
bool "Exec logging"
-@@ -792,7 +792,7 @@
+@@ -798,7 +798,7 @@
config GRKERNSEC_TPE_UNTRUSTED_GID
int "GID for TPE-untrusted users"
depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -34,7 +34,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*enabled* for. If the sysctl option is enabled, a sysctl option
-@@ -801,7 +801,7 @@
+@@ -807,7 +807,7 @@
config GRKERNSEC_TPE_TRUSTED_GID
int "GID for TPE-trusted users"
depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -894,7 +894,7 @@
+@@ -900,7 +900,7 @@
config GRKERNSEC_SOCKET_ALL_GID
int "GID to deny all sockets for"
depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Here you can choose the GID to disable socket access for. Remember to
add the users you want socket access disabled for to the GID
-@@ -915,7 +915,7 @@
+@@ -921,7 +921,7 @@
config GRKERNSEC_SOCKET_CLIENT_GID
int "GID to deny client sockets for"
depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Here you can choose the GID to disable client socket access for.
Remember to add the users you want client socket access disabled for to
-@@ -933,7 +933,7 @@
+@@ -939,7 +939,7 @@
config GRKERNSEC_SOCKET_SERVER_GID
int "GID to deny server sockets for"
depends on GRKERNSEC_SOCKET_SERVER
@@ -73,7 +73,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
diff -Nuar a/security/Kconfig b/security/Kconfig
--- a/security/Kconfig 2012-10-13 09:51:35.000000000 -0400
+++ b/security/Kconfig 2012-10-13 09:52:59.000000000 -0400
-@@ -191,7 +191,7 @@
+@@ -193,7 +193,7 @@
config GRKERNSEC_PROC_GID
int "GID exempted from /proc restrictions"
@@ -82,7 +82,7 @@ diff -Nuar a/security/Kconfig b/security/Kconfig
help
Setting this GID determines which group will be exempted from
grsecurity's /proc restrictions, allowing users of the specified
-@@ -202,7 +202,7 @@
+@@ -204,7 +204,7 @@
config GRKERNSEC_TPE_UNTRUSTED_GID
int "GID for TPE-untrusted users"
depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -91,7 +91,7 @@ diff -Nuar a/security/Kconfig b/security/Kconfig
help
Setting this GID determines which group untrusted users should
be added to. These users will be placed under grsecurity's Trusted Path
-@@ -214,7 +214,7 @@
+@@ -216,7 +216,7 @@
config GRKERNSEC_TPE_TRUSTED_GID
int "GID for TPE-trusted users"
depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -100,7 +100,7 @@ diff -Nuar a/security/Kconfig b/security/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -223,7 +223,7 @@
+@@ -225,7 +225,7 @@
config GRKERNSEC_SYMLINKOWN_GID
int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
depends on GRKERNSEC_CONFIG_SERVER
diff --git a/3.2.42/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.43/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 99%
rename from 3.2.42/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.2.43/4465_selinux-avc_audit-log-curr_ip.patch
index a7cc9cd..70cc565 100644
--- a/3.2.42/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.2.43/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2011-04-17 19:25:54.000000000 -0400
+++ b/grsecurity/Kconfig 2011-04-17 19:32:53.000000000 -0400
-@@ -992,6 +992,27 @@
+@@ -998,6 +998,27 @@
menu "Logging Options"
depends on GRKERNSEC
diff --git a/3.2.42/4470_disable-compat_vdso.patch b/3.2.43/4470_disable-compat_vdso.patch
similarity index 98%
rename from 3.2.42/4470_disable-compat_vdso.patch
rename to 3.2.43/4470_disable-compat_vdso.patch
index c06bd8b..99c691b 100644
--- a/3.2.42/4470_disable-compat_vdso.patch
+++ b/3.2.43/4470_disable-compat_vdso.patch
@@ -26,7 +26,7 @@ Closes bug: http://bugs.gentoo.org/show_bug.cgi?id=210138
diff -urp a/arch/x86/Kconfig b/arch/x86/Kconfig
--- a/arch/x86/Kconfig 2009-07-31 01:36:57.323857684 +0100
+++ b/arch/x86/Kconfig 2009-07-31 01:51:39.395749681 +0100
-@@ -1651,17 +1651,8 @@
+@@ -1652,17 +1652,8 @@
config COMPAT_VDSO
def_bool n
diff --git a/3.8.6/0000_README b/3.8.6/0000_README
index 8e2631e..bf971ed 100644
--- a/3.8.6/0000_README
+++ b/3.8.6/0000_README
@@ -2,15 +2,7 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1004_linux-3.8.5.patch
-From: http://www.kernel.org
-Desc: Linux 3.8.5
-
-Patch: 1005_linux-3.8.6.patch
-From: http://www.kernel.org
-Desc: Linux 3.8.6
-
-Patch: 4420_grsecurity-2.9.1-3.8.6-201304052305.patch
+Patch: 4420_grsecurity-2.9.1-3.8.6-201304102034.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.8.6/1004_linux-3.8.5.patch b/3.8.6/1004_linux-3.8.5.patch
deleted file mode 100644
index 27b152f..0000000
--- a/3.8.6/1004_linux-3.8.5.patch
+++ /dev/null
@@ -1,3805 +0,0 @@
-diff --git a/Makefile b/Makefile
-index e20f162..14b38cf 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,8 +1,8 @@
- VERSION = 3
- PATCHLEVEL = 8
--SUBLEVEL = 4
-+SUBLEVEL = 5
- EXTRAVERSION =
--NAME = Unicycling Gorilla
-+NAME = Displaced Humerus Anterior
-
- # *DOCUMENTATION*
- # To see a list of typical targets execute "make help"
-diff --git a/arch/arm/boot/dts/tegra20.dtsi b/arch/arm/boot/dts/tegra20.dtsi
-index b8effa1..4ceb266 100644
---- a/arch/arm/boot/dts/tegra20.dtsi
-+++ b/arch/arm/boot/dts/tegra20.dtsi
-@@ -314,7 +314,7 @@
-
- spi@7000d800 {
- compatible = "nvidia,tegra20-slink";
-- reg = <0x7000d480 0x200>;
-+ reg = <0x7000d800 0x200>;
- interrupts = <0 83 0x04>;
- nvidia,dma-request-selector = <&apbdma 17>;
- #address-cells = <1>;
-diff --git a/arch/arm/boot/dts/tegra30.dtsi b/arch/arm/boot/dts/tegra30.dtsi
-index 529fdb8..aeea838 100644
---- a/arch/arm/boot/dts/tegra30.dtsi
-+++ b/arch/arm/boot/dts/tegra30.dtsi
-@@ -309,7 +309,7 @@
-
- spi@7000d800 {
- compatible = "nvidia,tegra30-slink", "nvidia,tegra20-slink";
-- reg = <0x7000d480 0x200>;
-+ reg = <0x7000d800 0x200>;
- interrupts = <0 83 0x04>;
- nvidia,dma-request-selector = <&apbdma 17>;
- #address-cells = <1>;
-diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
-index dda3904..5397da0 100644
---- a/arch/arm/mm/dma-mapping.c
-+++ b/arch/arm/mm/dma-mapping.c
-@@ -330,6 +330,7 @@ static int __init atomic_pool_init(void)
- {
- struct dma_pool *pool = &atomic_pool;
- pgprot_t prot = pgprot_dmacoherent(pgprot_kernel);
-+ gfp_t gfp = GFP_KERNEL | GFP_DMA;
- unsigned long nr_pages = pool->size >> PAGE_SHIFT;
- unsigned long *bitmap;
- struct page *page;
-@@ -348,8 +349,8 @@ static int __init atomic_pool_init(void)
- if (IS_ENABLED(CONFIG_CMA))
- ptr = __alloc_from_contiguous(NULL, pool->size, prot, &page);
- else
-- ptr = __alloc_remap_buffer(NULL, pool->size, GFP_KERNEL, prot,
-- &page, NULL);
-+ ptr = __alloc_remap_buffer(NULL, pool->size, gfp, prot, &page,
-+ NULL);
- if (ptr) {
- int i;
-
-diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
-index 05928aa..906fea3 100644
---- a/arch/x86/lib/usercopy_64.c
-+++ b/arch/x86/lib/usercopy_64.c
-@@ -74,10 +74,10 @@ copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest)
- char c;
- unsigned zero_len;
-
-- for (; len; --len) {
-+ for (; len; --len, to++) {
- if (__get_user_nocheck(c, from++, sizeof(char)))
- break;
-- if (__put_user_nocheck(c, to++, sizeof(char)))
-+ if (__put_user_nocheck(c, to, sizeof(char)))
- break;
- }
-
-diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
-index 35da181..e9e486f 100644
---- a/drivers/acpi/glue.c
-+++ b/drivers/acpi/glue.c
-@@ -95,40 +95,31 @@ static int acpi_find_bridge_device(struct device *dev, acpi_handle * handle)
- return ret;
- }
-
--/* Get device's handler per its address under its parent */
--struct acpi_find_child {
-- acpi_handle handle;
-- u64 address;
--};
--
--static acpi_status
--do_acpi_find_child(acpi_handle handle, u32 lvl, void *context, void **rv)
-+static acpi_status do_acpi_find_child(acpi_handle handle, u32 lvl_not_used,
-+ void *addr_p, void **ret_p)
- {
-+ unsigned long long addr;
- acpi_status status;
-- struct acpi_device_info *info;
-- struct acpi_find_child *find = context;
--
-- status = acpi_get_object_info(handle, &info);
-- if (ACPI_SUCCESS(status)) {
-- if ((info->address == find->address)
-- && (info->valid & ACPI_VALID_ADR))
-- find->handle = handle;
-- kfree(info);
-+
-+ status = acpi_evaluate_integer(handle, METHOD_NAME__ADR, NULL, &addr);
-+ if (ACPI_SUCCESS(status) && addr == *((u64 *)addr_p)) {
-+ *ret_p = handle;
-+ return AE_CTRL_TERMINATE;
- }
- return AE_OK;
- }
-
- acpi_handle acpi_get_child(acpi_handle parent, u64 address)
- {
-- struct acpi_find_child find = { NULL, address };
-+ void *ret = NULL;
-
- if (!parent)
- return NULL;
-- acpi_walk_namespace(ACPI_TYPE_DEVICE, parent,
-- 1, do_acpi_find_child, NULL, &find, NULL);
-- return find.handle;
--}
-
-+ acpi_walk_namespace(ACPI_TYPE_DEVICE, parent, 1, NULL,
-+ do_acpi_find_child, &address, &ret);
-+ return (acpi_handle)ret;
-+}
- EXPORT_SYMBOL(acpi_get_child);
-
- static int acpi_bind_one(struct device *dev, acpi_handle handle)
-diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
-index 9b00072..42c759a 100644
---- a/drivers/firmware/Kconfig
-+++ b/drivers/firmware/Kconfig
-@@ -53,6 +53,24 @@ config EFI_VARS
- Subsequent efibootmgr releases may be found at:
- <http://linux.dell.com/efibootmgr>
-
-+config EFI_VARS_PSTORE
-+ bool "Register efivars backend for pstore"
-+ depends on EFI_VARS && PSTORE
-+ default y
-+ help
-+ Say Y here to enable use efivars as a backend to pstore. This
-+ will allow writing console messages, crash dumps, or anything
-+ else supported by pstore to EFI variables.
-+
-+config EFI_VARS_PSTORE_DEFAULT_DISABLE
-+ bool "Disable using efivars as a pstore backend by default"
-+ depends on EFI_VARS_PSTORE
-+ default n
-+ help
-+ Saying Y here will disable the use of efivars as a storage
-+ backend for pstore by default. This setting can be overridden
-+ using the efivars module's pstore_disable parameter.
-+
- config EFI_PCDP
- bool "Console device selection via EFI PCDP or HCDP table"
- depends on ACPI && EFI && IA64
-diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
-index 2a2e145..e1d6253 100644
---- a/drivers/firmware/efivars.c
-+++ b/drivers/firmware/efivars.c
-@@ -103,6 +103,11 @@ MODULE_VERSION(EFIVARS_VERSION);
- */
- #define GUID_LEN 36
-
-+static bool efivars_pstore_disable =
-+ IS_ENABLED(CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE);
-+
-+module_param_named(pstore_disable, efivars_pstore_disable, bool, 0644);
-+
- /*
- * The maximum size of VariableName + Data = 1024
- * Therefore, it's reasonable to save that much
-@@ -1301,9 +1306,7 @@ static const struct inode_operations efivarfs_dir_inode_operations = {
- .create = efivarfs_create,
- };
-
--static struct pstore_info efi_pstore_info;
--
--#ifdef CONFIG_PSTORE
-+#ifdef CONFIG_EFI_VARS_PSTORE
-
- static int efi_pstore_open(struct pstore_info *psi)
- {
-@@ -1500,38 +1503,6 @@ static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
-
- return 0;
- }
--#else
--static int efi_pstore_open(struct pstore_info *psi)
--{
-- return 0;
--}
--
--static int efi_pstore_close(struct pstore_info *psi)
--{
-- return 0;
--}
--
--static ssize_t efi_pstore_read(u64 *id, enum pstore_type_id *type, int *count,
-- struct timespec *timespec,
-- char **buf, struct pstore_info *psi)
--{
-- return -1;
--}
--
--static int efi_pstore_write(enum pstore_type_id type,
-- enum kmsg_dump_reason reason, u64 *id,
-- unsigned int part, int count, size_t size,
-- struct pstore_info *psi)
--{
-- return 0;
--}
--
--static int efi_pstore_erase(enum pstore_type_id type, u64 id, int count,
-- struct timespec time, struct pstore_info *psi)
--{
-- return 0;
--}
--#endif
-
- static struct pstore_info efi_pstore_info = {
- .owner = THIS_MODULE,
-@@ -1543,6 +1514,24 @@ static struct pstore_info efi_pstore_info = {
- .erase = efi_pstore_erase,
- };
-
-+static void efivar_pstore_register(struct efivars *efivars)
-+{
-+ efivars->efi_pstore_info = efi_pstore_info;
-+ efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
-+ if (efivars->efi_pstore_info.buf) {
-+ efivars->efi_pstore_info.bufsize = 1024;
-+ efivars->efi_pstore_info.data = efivars;
-+ spin_lock_init(&efivars->efi_pstore_info.buf_lock);
-+ pstore_register(&efivars->efi_pstore_info);
-+ }
-+}
-+#else
-+static void efivar_pstore_register(struct efivars *efivars)
-+{
-+ return;
-+}
-+#endif
-+
- static ssize_t efivar_create(struct file *filp, struct kobject *kobj,
- struct bin_attribute *bin_attr,
- char *buf, loff_t pos, size_t count)
-@@ -1942,15 +1931,8 @@ int register_efivars(struct efivars *efivars,
- if (error)
- unregister_efivars(efivars);
-
-- efivars->efi_pstore_info = efi_pstore_info;
--
-- efivars->efi_pstore_info.buf = kmalloc(4096, GFP_KERNEL);
-- if (efivars->efi_pstore_info.buf) {
-- efivars->efi_pstore_info.bufsize = 1024;
-- efivars->efi_pstore_info.data = efivars;
-- spin_lock_init(&efivars->efi_pstore_info.buf_lock);
-- pstore_register(&efivars->efi_pstore_info);
-- }
-+ if (!efivars_pstore_disable)
-+ efivar_pstore_register(efivars);
-
- register_filesystem(&efivarfs_type);
-
-diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
-index aaded22..dfd9ed3 100644
---- a/drivers/gpu/drm/drm_edid.c
-+++ b/drivers/gpu/drm/drm_edid.c
-@@ -894,7 +894,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
- unsigned vblank = (pt->vactive_vblank_hi & 0xf) << 8 | pt->vblank_lo;
- unsigned hsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc0) << 2 | pt->hsync_offset_lo;
- unsigned hsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x30) << 4 | pt->hsync_pulse_width_lo;
-- unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) >> 2 | pt->vsync_offset_pulse_width_lo >> 4;
-+ unsigned vsync_offset = (pt->hsync_vsync_offset_pulse_width_hi & 0xc) << 2 | pt->vsync_offset_pulse_width_lo >> 4;
- unsigned vsync_pulse_width = (pt->hsync_vsync_offset_pulse_width_hi & 0x3) << 4 | (pt->vsync_offset_pulse_width_lo & 0xf);
-
- /* ignore tiny modes */
-@@ -975,6 +975,7 @@ set_size:
- }
-
- mode->type = DRM_MODE_TYPE_DRIVER;
-+ mode->vrefresh = drm_mode_vrefresh(mode);
- drm_mode_set_name(mode);
-
- return mode;
-diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
-index 8a7c48b..261efc8e 100644
---- a/drivers/gpu/drm/i915/i915_debugfs.c
-+++ b/drivers/gpu/drm/i915/i915_debugfs.c
-@@ -103,7 +103,7 @@ static const char *cache_level_str(int type)
- static void
- describe_obj(struct seq_file *m, struct drm_i915_gem_object *obj)
- {
-- seq_printf(m, "%p: %s%s %8zdKiB %04x %04x %d %d %d%s%s%s",
-+ seq_printf(m, "%pK: %s%s %8zdKiB %04x %04x %d %d %d%s%s%s",
- &obj->base,
- get_pin_flag(obj),
- get_tiling_flag(obj),
-diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-index 26d08bb..7adf5a7 100644
---- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
-@@ -706,15 +706,20 @@ validate_exec_list(struct drm_i915_gem_exec_object2 *exec,
- int count)
- {
- int i;
-+ int relocs_total = 0;
-+ int relocs_max = INT_MAX / sizeof(struct drm_i915_gem_relocation_entry);
-
- for (i = 0; i < count; i++) {
- char __user *ptr = (char __user *)(uintptr_t)exec[i].relocs_ptr;
- int length; /* limited by fault_in_pages_readable() */
-
-- /* First check for malicious input causing overflow */
-- if (exec[i].relocation_count >
-- INT_MAX / sizeof(struct drm_i915_gem_relocation_entry))
-+ /* First check for malicious input causing overflow in
-+ * the worst case where we need to allocate the entire
-+ * relocation tree as a single array.
-+ */
-+ if (exec[i].relocation_count > relocs_max - relocs_total)
- return -EINVAL;
-+ relocs_total += exec[i].relocation_count;
-
- length = exec[i].relocation_count *
- sizeof(struct drm_i915_gem_relocation_entry);
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index fb3715b..2e1c10a 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -1850,7 +1850,7 @@ intel_dp_start_link_train(struct intel_dp *intel_dp)
- for (i = 0; i < intel_dp->lane_count; i++)
- if ((intel_dp->train_set[i] & DP_TRAIN_MAX_SWING_REACHED) == 0)
- break;
-- if (i == intel_dp->lane_count && voltage_tries == 5) {
-+ if (i == intel_dp->lane_count) {
- ++loop_tries;
- if (loop_tries == 5) {
- DRM_DEBUG_KMS("too many full retries, give up\n");
-diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
-index a3730e0..bee8cb6 100644
---- a/drivers/gpu/drm/i915/intel_panel.c
-+++ b/drivers/gpu/drm/i915/intel_panel.c
-@@ -321,9 +321,6 @@ void intel_panel_enable_backlight(struct drm_device *dev,
- if (dev_priv->backlight_level == 0)
- dev_priv->backlight_level = intel_panel_get_max_backlight(dev);
-
-- dev_priv->backlight_enabled = true;
-- intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
--
- if (INTEL_INFO(dev)->gen >= 4) {
- uint32_t reg, tmp;
-
-@@ -359,12 +356,12 @@ void intel_panel_enable_backlight(struct drm_device *dev,
- }
-
- set_level:
-- /* Check the current backlight level and try to set again if it's zero.
-- * On some machines, BLC_PWM_CPU_CTL is cleared to zero automatically
-- * when BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1 are written.
-+ /* Call below after setting BLC_PWM_CPU_CTL2 and BLC_PWM_PCH_CTL1.
-+ * BLC_PWM_CPU_CTL may be cleared to zero automatically when these
-+ * registers are set.
- */
-- if (!intel_panel_get_backlight(dev))
-- intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
-+ dev_priv->backlight_enabled = true;
-+ intel_panel_actually_set_backlight(dev, dev_priv->backlight_level);
- }
-
- static void intel_panel_init_backlight(struct drm_device *dev)
-diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
-index d3d99a2..4f50c40 100644
---- a/drivers/gpu/drm/mgag200/mgag200_mode.c
-+++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
-@@ -382,19 +382,19 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
- m = n = p = 0;
- vcomax = 800000;
- vcomin = 400000;
-- pllreffreq = 3333;
-+ pllreffreq = 33333;
-
- delta = 0xffffffff;
- permitteddelta = clock * 5 / 1000;
-
-- for (testp = 16; testp > 0; testp--) {
-+ for (testp = 16; testp > 0; testp >>= 1) {
- if (clock * testp > vcomax)
- continue;
- if (clock * testp < vcomin)
- continue;
-
- for (testm = 1; testm < 33; testm++) {
-- for (testn = 1; testn < 257; testn++) {
-+ for (testn = 17; testn < 257; testn++) {
- computed = (pllreffreq * testn) /
- (testm * testp);
- if (computed > clock)
-@@ -404,11 +404,11 @@ static int mga_g200eh_set_plls(struct mga_device *mdev, long clock)
- if (tmpdelta < delta) {
- delta = tmpdelta;
- n = testn - 1;
-- m = (testm - 1) | ((n >> 1) & 0x80);
-+ m = (testm - 1);
- p = testp - 1;
- }
- if ((clock * testp) >= 600000)
-- p |= 80;
-+ p |= 0x80;
- }
- }
- }
-diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
-index 835992d..b64e55d 100644
---- a/drivers/gpu/drm/radeon/ni.c
-+++ b/drivers/gpu/drm/radeon/ni.c
-@@ -466,13 +466,19 @@ static void cayman_gpu_init(struct radeon_device *rdev)
- (rdev->pdev->device == 0x9907) ||
- (rdev->pdev->device == 0x9908) ||
- (rdev->pdev->device == 0x9909) ||
-+ (rdev->pdev->device == 0x990B) ||
-+ (rdev->pdev->device == 0x990C) ||
-+ (rdev->pdev->device == 0x990F) ||
- (rdev->pdev->device == 0x9910) ||
-- (rdev->pdev->device == 0x9917)) {
-+ (rdev->pdev->device == 0x9917) ||
-+ (rdev->pdev->device == 0x9999)) {
- rdev->config.cayman.max_simds_per_se = 6;
- rdev->config.cayman.max_backends_per_se = 2;
- } else if ((rdev->pdev->device == 0x9903) ||
- (rdev->pdev->device == 0x9904) ||
- (rdev->pdev->device == 0x990A) ||
-+ (rdev->pdev->device == 0x990D) ||
-+ (rdev->pdev->device == 0x990E) ||
- (rdev->pdev->device == 0x9913) ||
- (rdev->pdev->device == 0x9918)) {
- rdev->config.cayman.max_simds_per_se = 4;
-@@ -481,6 +487,9 @@ static void cayman_gpu_init(struct radeon_device *rdev)
- (rdev->pdev->device == 0x9990) ||
- (rdev->pdev->device == 0x9991) ||
- (rdev->pdev->device == 0x9994) ||
-+ (rdev->pdev->device == 0x9995) ||
-+ (rdev->pdev->device == 0x9996) ||
-+ (rdev->pdev->device == 0x999A) ||
- (rdev->pdev->device == 0x99A0)) {
- rdev->config.cayman.max_simds_per_se = 3;
- rdev->config.cayman.max_backends_per_se = 1;
-@@ -614,11 +623,22 @@ static void cayman_gpu_init(struct radeon_device *rdev)
- WREG32(DMA_TILING_CONFIG + DMA0_REGISTER_OFFSET, gb_addr_config);
- WREG32(DMA_TILING_CONFIG + DMA1_REGISTER_OFFSET, gb_addr_config);
-
-- tmp = gb_addr_config & NUM_PIPES_MASK;
-- tmp = r6xx_remap_render_backend(rdev, tmp,
-- rdev->config.cayman.max_backends_per_se *
-- rdev->config.cayman.max_shader_engines,
-- CAYMAN_MAX_BACKENDS, disabled_rb_mask);
-+ if ((rdev->config.cayman.max_backends_per_se == 1) &&
-+ (rdev->flags & RADEON_IS_IGP)) {
-+ if ((disabled_rb_mask & 3) == 1) {
-+ /* RB0 disabled, RB1 enabled */
-+ tmp = 0x11111111;
-+ } else {
-+ /* RB1 disabled, RB0 enabled */
-+ tmp = 0x00000000;
-+ }
-+ } else {
-+ tmp = gb_addr_config & NUM_PIPES_MASK;
-+ tmp = r6xx_remap_render_backend(rdev, tmp,
-+ rdev->config.cayman.max_backends_per_se *
-+ rdev->config.cayman.max_shader_engines,
-+ CAYMAN_MAX_BACKENDS, disabled_rb_mask);
-+ }
- WREG32(GB_BACKEND_MAP, tmp);
-
- cgts_tcc_disable = 0xffff0000;
-@@ -1662,6 +1682,7 @@ int cayman_resume(struct radeon_device *rdev)
- int cayman_suspend(struct radeon_device *rdev)
- {
- r600_audio_fini(rdev);
-+ radeon_vm_manager_fini(rdev);
- cayman_cp_enable(rdev, false);
- cayman_dma_stop(rdev);
- evergreen_irq_suspend(rdev);
-diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
-index bedda9c..a2f0c24 100644
---- a/drivers/gpu/drm/radeon/radeon_benchmark.c
-+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
-@@ -135,13 +135,15 @@ static void radeon_benchmark_move(struct radeon_device *rdev, unsigned size,
- sdomain, ddomain, "dma");
- }
-
-- time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-- RADEON_BENCHMARK_COPY_BLIT, n);
-- if (time < 0)
-- goto out_cleanup;
-- if (time > 0)
-- radeon_benchmark_log_results(n, size, time,
-- sdomain, ddomain, "blit");
-+ if (rdev->asic->copy.blit) {
-+ time = radeon_benchmark_do_move(rdev, size, saddr, daddr,
-+ RADEON_BENCHMARK_COPY_BLIT, n);
-+ if (time < 0)
-+ goto out_cleanup;
-+ if (time > 0)
-+ radeon_benchmark_log_results(n, size, time,
-+ sdomain, ddomain, "blit");
-+ }
-
- out_cleanup:
- if (sobj) {
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index ae8b482..dd00721 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -4232,6 +4232,7 @@ int si_resume(struct radeon_device *rdev)
-
- int si_suspend(struct radeon_device *rdev)
- {
-+ radeon_vm_manager_fini(rdev);
- si_cp_enable(rdev, false);
- cayman_dma_stop(rdev);
- si_irq_suspend(rdev);
-diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
-index 7b38877..9e622b7 100644
---- a/drivers/i2c/busses/i2c-tegra.c
-+++ b/drivers/i2c/busses/i2c-tegra.c
-@@ -392,7 +392,11 @@ static int tegra_i2c_init(struct tegra_i2c_dev *i2c_dev)
- u32 val;
- int err = 0;
-
-- tegra_i2c_clock_enable(i2c_dev);
-+ err = tegra_i2c_clock_enable(i2c_dev);
-+ if (err < 0) {
-+ dev_err(i2c_dev->dev, "Clock enable failed %d\n", err);
-+ return err;
-+ }
-
- tegra_periph_reset_assert(i2c_dev->div_clk);
- udelay(2);
-@@ -599,7 +603,12 @@ static int tegra_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[],
- if (i2c_dev->is_suspended)
- return -EBUSY;
-
-- tegra_i2c_clock_enable(i2c_dev);
-+ ret = tegra_i2c_clock_enable(i2c_dev);
-+ if (ret < 0) {
-+ dev_err(i2c_dev->dev, "Clock enable failed %d\n", ret);
-+ return ret;
-+ }
-+
- for (i = 0; i < num; i++) {
- enum msg_end_type end_type = MSG_END_STOP;
- if (i < (num - 1)) {
-diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-index 67b0c1d..1ef880d 100644
---- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
-@@ -758,9 +758,13 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
- if (++priv->tx_outstanding == ipoib_sendq_size) {
- ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
- tx->qp->qp_num);
-- if (ib_req_notify_cq(priv->send_cq, IB_CQ_NEXT_COMP))
-- ipoib_warn(priv, "request notify on send CQ failed\n");
- netif_stop_queue(dev);
-+ rc = ib_req_notify_cq(priv->send_cq,
-+ IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS);
-+ if (rc < 0)
-+ ipoib_warn(priv, "request notify on send CQ failed\n");
-+ else if (rc)
-+ ipoib_send_comp_handler(priv->send_cq, dev);
- }
- }
- }
-diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
-index 651ca79..64eff90 100644
---- a/drivers/md/dm-bufio.c
-+++ b/drivers/md/dm-bufio.c
-@@ -1026,6 +1026,8 @@ void dm_bufio_prefetch(struct dm_bufio_client *c,
- {
- struct blk_plug plug;
-
-+ BUG_ON(dm_bufio_in_request());
-+
- blk_start_plug(&plug);
- dm_bufio_lock(c);
-
-diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
-index 7a66d73..2d3a2af 100644
---- a/drivers/md/dm-thin.c
-+++ b/drivers/md/dm-thin.c
-@@ -2479,7 +2479,7 @@ static struct target_type pool_target = {
- .name = "thin-pool",
- .features = DM_TARGET_SINGLETON | DM_TARGET_ALWAYS_WRITEABLE |
- DM_TARGET_IMMUTABLE,
-- .version = {1, 6, 1},
-+ .version = {1, 7, 0},
- .module = THIS_MODULE,
- .ctr = pool_ctr,
- .dtr = pool_dtr,
-@@ -2766,7 +2766,7 @@ static int thin_iterate_devices(struct dm_target *ti,
-
- static struct target_type thin_target = {
- .name = "thin",
-- .version = {1, 7, 1},
-+ .version = {1, 8, 0},
- .module = THIS_MODULE,
- .ctr = thin_ctr,
- .dtr = thin_dtr,
-diff --git a/drivers/md/dm-verity.c b/drivers/md/dm-verity.c
-index 6ad5383..a746f1d 100644
---- a/drivers/md/dm-verity.c
-+++ b/drivers/md/dm-verity.c
-@@ -93,6 +93,13 @@ struct dm_verity_io {
- */
- };
-
-+struct dm_verity_prefetch_work {
-+ struct work_struct work;
-+ struct dm_verity *v;
-+ sector_t block;
-+ unsigned n_blocks;
-+};
-+
- static struct shash_desc *io_hash_desc(struct dm_verity *v, struct dm_verity_io *io)
- {
- return (struct shash_desc *)(io + 1);
-@@ -424,15 +431,18 @@ static void verity_end_io(struct bio *bio, int error)
- * The root buffer is not prefetched, it is assumed that it will be cached
- * all the time.
- */
--static void verity_prefetch_io(struct dm_verity *v, struct dm_verity_io *io)
-+static void verity_prefetch_io(struct work_struct *work)
- {
-+ struct dm_verity_prefetch_work *pw =
-+ container_of(work, struct dm_verity_prefetch_work, work);
-+ struct dm_verity *v = pw->v;
- int i;
-
- for (i = v->levels - 2; i >= 0; i--) {
- sector_t hash_block_start;
- sector_t hash_block_end;
-- verity_hash_at_level(v, io->block, i, &hash_block_start, NULL);
-- verity_hash_at_level(v, io->block + io->n_blocks - 1, i, &hash_block_end, NULL);
-+ verity_hash_at_level(v, pw->block, i, &hash_block_start, NULL);
-+ verity_hash_at_level(v, pw->block + pw->n_blocks - 1, i, &hash_block_end, NULL);
- if (!i) {
- unsigned cluster = ACCESS_ONCE(dm_verity_prefetch_cluster);
-
-@@ -452,6 +462,25 @@ no_prefetch_cluster:
- dm_bufio_prefetch(v->bufio, hash_block_start,
- hash_block_end - hash_block_start + 1);
- }
-+
-+ kfree(pw);
-+}
-+
-+static void verity_submit_prefetch(struct dm_verity *v, struct dm_verity_io *io)
-+{
-+ struct dm_verity_prefetch_work *pw;
-+
-+ pw = kmalloc(sizeof(struct dm_verity_prefetch_work),
-+ GFP_NOIO | __GFP_NORETRY | __GFP_NOMEMALLOC | __GFP_NOWARN);
-+
-+ if (!pw)
-+ return;
-+
-+ INIT_WORK(&pw->work, verity_prefetch_io);
-+ pw->v = v;
-+ pw->block = io->block;
-+ pw->n_blocks = io->n_blocks;
-+ queue_work(v->verify_wq, &pw->work);
- }
-
- /*
-@@ -498,7 +527,7 @@ static int verity_map(struct dm_target *ti, struct bio *bio)
- memcpy(io->io_vec, bio_iovec(bio),
- io->io_vec_size * sizeof(struct bio_vec));
-
-- verity_prefetch_io(v, io);
-+ verity_submit_prefetch(v, io);
-
- generic_make_request(bio);
-
-@@ -858,7 +887,7 @@ bad:
-
- static struct target_type verity_target = {
- .name = "verity",
-- .version = {1, 1, 1},
-+ .version = {1, 2, 0},
- .module = THIS_MODULE,
- .ctr = verity_ctr,
- .dtr = verity_dtr,
-diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c
-index c4f2813..b88757c 100644
---- a/drivers/md/persistent-data/dm-btree-remove.c
-+++ b/drivers/md/persistent-data/dm-btree-remove.c
-@@ -139,15 +139,8 @@ struct child {
- struct btree_node *n;
- };
-
--static struct dm_btree_value_type le64_type = {
-- .context = NULL,
-- .size = sizeof(__le64),
-- .inc = NULL,
-- .dec = NULL,
-- .equal = NULL
--};
--
--static int init_child(struct dm_btree_info *info, struct btree_node *parent,
-+static int init_child(struct dm_btree_info *info, struct dm_btree_value_type *vt,
-+ struct btree_node *parent,
- unsigned index, struct child *result)
- {
- int r, inc;
-@@ -164,7 +157,7 @@ static int init_child(struct dm_btree_info *info, struct btree_node *parent,
- result->n = dm_block_data(result->block);
-
- if (inc)
-- inc_children(info->tm, result->n, &le64_type);
-+ inc_children(info->tm, result->n, vt);
-
- *((__le64 *) value_ptr(parent, index)) =
- cpu_to_le64(dm_block_location(result->block));
-@@ -236,7 +229,7 @@ static void __rebalance2(struct dm_btree_info *info, struct btree_node *parent,
- }
-
- static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
-- unsigned left_index)
-+ struct dm_btree_value_type *vt, unsigned left_index)
- {
- int r;
- struct btree_node *parent;
-@@ -244,11 +237,11 @@ static int rebalance2(struct shadow_spine *s, struct dm_btree_info *info,
-
- parent = dm_block_data(shadow_current(s));
-
-- r = init_child(info, parent, left_index, &left);
-+ r = init_child(info, vt, parent, left_index, &left);
- if (r)
- return r;
-
-- r = init_child(info, parent, left_index + 1, &right);
-+ r = init_child(info, vt, parent, left_index + 1, &right);
- if (r) {
- exit_child(info, &left);
- return r;
-@@ -368,7 +361,7 @@ static void __rebalance3(struct dm_btree_info *info, struct btree_node *parent,
- }
-
- static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
-- unsigned left_index)
-+ struct dm_btree_value_type *vt, unsigned left_index)
- {
- int r;
- struct btree_node *parent = dm_block_data(shadow_current(s));
-@@ -377,17 +370,17 @@ static int rebalance3(struct shadow_spine *s, struct dm_btree_info *info,
- /*
- * FIXME: fill out an array?
- */
-- r = init_child(info, parent, left_index, &left);
-+ r = init_child(info, vt, parent, left_index, &left);
- if (r)
- return r;
-
-- r = init_child(info, parent, left_index + 1, ¢er);
-+ r = init_child(info, vt, parent, left_index + 1, ¢er);
- if (r) {
- exit_child(info, &left);
- return r;
- }
-
-- r = init_child(info, parent, left_index + 2, &right);
-+ r = init_child(info, vt, parent, left_index + 2, &right);
- if (r) {
- exit_child(info, &left);
- exit_child(info, ¢er);
-@@ -434,7 +427,8 @@ static int get_nr_entries(struct dm_transaction_manager *tm,
- }
-
- static int rebalance_children(struct shadow_spine *s,
-- struct dm_btree_info *info, uint64_t key)
-+ struct dm_btree_info *info,
-+ struct dm_btree_value_type *vt, uint64_t key)
- {
- int i, r, has_left_sibling, has_right_sibling;
- uint32_t child_entries;
-@@ -472,13 +466,13 @@ static int rebalance_children(struct shadow_spine *s,
- has_right_sibling = i < (le32_to_cpu(n->header.nr_entries) - 1);
-
- if (!has_left_sibling)
-- r = rebalance2(s, info, i);
-+ r = rebalance2(s, info, vt, i);
-
- else if (!has_right_sibling)
-- r = rebalance2(s, info, i - 1);
-+ r = rebalance2(s, info, vt, i - 1);
-
- else
-- r = rebalance3(s, info, i - 1);
-+ r = rebalance3(s, info, vt, i - 1);
-
- return r;
- }
-@@ -529,7 +523,7 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
- if (le32_to_cpu(n->header.flags) & LEAF_NODE)
- return do_leaf(n, key, index);
-
-- r = rebalance_children(s, info, key);
-+ r = rebalance_children(s, info, vt, key);
- if (r)
- break;
-
-@@ -550,6 +544,14 @@ static int remove_raw(struct shadow_spine *s, struct dm_btree_info *info,
- return r;
- }
-
-+static struct dm_btree_value_type le64_type = {
-+ .context = NULL,
-+ .size = sizeof(__le64),
-+ .inc = NULL,
-+ .dec = NULL,
-+ .equal = NULL
-+};
-+
- int dm_btree_remove(struct dm_btree_info *info, dm_block_t root,
- uint64_t *keys, dm_block_t *new_root)
- {
-diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 19d77a0..94ce78e 100644
---- a/drivers/md/raid5.c
-+++ b/drivers/md/raid5.c
-@@ -674,9 +674,11 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
- bi->bi_next = NULL;
- if (rrdev)
- set_bit(R5_DOUBLE_LOCKED, &sh->dev[i].flags);
-- trace_block_bio_remap(bdev_get_queue(bi->bi_bdev),
-- bi, disk_devt(conf->mddev->gendisk),
-- sh->dev[i].sector);
-+
-+ if (conf->mddev->gendisk)
-+ trace_block_bio_remap(bdev_get_queue(bi->bi_bdev),
-+ bi, disk_devt(conf->mddev->gendisk),
-+ sh->dev[i].sector);
- generic_make_request(bi);
- }
- if (rrdev) {
-@@ -704,9 +706,10 @@ static void ops_run_io(struct stripe_head *sh, struct stripe_head_state *s)
- rbi->bi_io_vec[0].bv_offset = 0;
- rbi->bi_size = STRIPE_SIZE;
- rbi->bi_next = NULL;
-- trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
-- rbi, disk_devt(conf->mddev->gendisk),
-- sh->dev[i].sector);
-+ if (conf->mddev->gendisk)
-+ trace_block_bio_remap(bdev_get_queue(rbi->bi_bdev),
-+ rbi, disk_devt(conf->mddev->gendisk),
-+ sh->dev[i].sector);
- generic_make_request(rbi);
- }
- if (!rdev && !rrdev) {
-@@ -2319,17 +2322,6 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
- int level = conf->level;
-
- if (rcw) {
-- /* if we are not expanding this is a proper write request, and
-- * there will be bios with new data to be drained into the
-- * stripe cache
-- */
-- if (!expand) {
-- sh->reconstruct_state = reconstruct_state_drain_run;
-- set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-- } else
-- sh->reconstruct_state = reconstruct_state_run;
--
-- set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
-
- for (i = disks; i--; ) {
- struct r5dev *dev = &sh->dev[i];
-@@ -2342,6 +2334,21 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
- s->locked++;
- }
- }
-+ /* if we are not expanding this is a proper write request, and
-+ * there will be bios with new data to be drained into the
-+ * stripe cache
-+ */
-+ if (!expand) {
-+ if (!s->locked)
-+ /* False alarm, nothing to do */
-+ return;
-+ sh->reconstruct_state = reconstruct_state_drain_run;
-+ set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-+ } else
-+ sh->reconstruct_state = reconstruct_state_run;
-+
-+ set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
-+
- if (s->locked + conf->max_degraded == disks)
- if (!test_and_set_bit(STRIPE_FULL_WRITE, &sh->state))
- atomic_inc(&conf->pending_full_writes);
-@@ -2350,11 +2357,6 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
- BUG_ON(!(test_bit(R5_UPTODATE, &sh->dev[pd_idx].flags) ||
- test_bit(R5_Wantcompute, &sh->dev[pd_idx].flags)));
-
-- sh->reconstruct_state = reconstruct_state_prexor_drain_run;
-- set_bit(STRIPE_OP_PREXOR, &s->ops_request);
-- set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-- set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
--
- for (i = disks; i--; ) {
- struct r5dev *dev = &sh->dev[i];
- if (i == pd_idx)
-@@ -2369,6 +2371,13 @@ schedule_reconstruction(struct stripe_head *sh, struct stripe_head_state *s,
- s->locked++;
- }
- }
-+ if (!s->locked)
-+ /* False alarm - nothing to do */
-+ return;
-+ sh->reconstruct_state = reconstruct_state_prexor_drain_run;
-+ set_bit(STRIPE_OP_PREXOR, &s->ops_request);
-+ set_bit(STRIPE_OP_BIODRAIN, &s->ops_request);
-+ set_bit(STRIPE_OP_RECONSTRUCT, &s->ops_request);
- }
-
- /* keep the parity disk(s) locked while asynchronous operations
-@@ -2603,6 +2612,8 @@ handle_failed_sync(struct r5conf *conf, struct stripe_head *sh,
- int i;
-
- clear_bit(STRIPE_SYNCING, &sh->state);
-+ if (test_and_clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags))
-+ wake_up(&conf->wait_for_overlap);
- s->syncing = 0;
- s->replacing = 0;
- /* There is nothing more to do for sync/check/repair.
-@@ -2776,6 +2787,7 @@ static void handle_stripe_clean_event(struct r5conf *conf,
- {
- int i;
- struct r5dev *dev;
-+ int discard_pending = 0;
-
- for (i = disks; i--; )
- if (sh->dev[i].written) {
-@@ -2804,9 +2816,23 @@ static void handle_stripe_clean_event(struct r5conf *conf,
- STRIPE_SECTORS,
- !test_bit(STRIPE_DEGRADED, &sh->state),
- 0);
-- }
-- } else if (test_bit(R5_Discard, &sh->dev[i].flags))
-- clear_bit(R5_Discard, &sh->dev[i].flags);
-+ } else if (test_bit(R5_Discard, &dev->flags))
-+ discard_pending = 1;
-+ }
-+ if (!discard_pending &&
-+ test_bit(R5_Discard, &sh->dev[sh->pd_idx].flags)) {
-+ clear_bit(R5_Discard, &sh->dev[sh->pd_idx].flags);
-+ clear_bit(R5_UPTODATE, &sh->dev[sh->pd_idx].flags);
-+ if (sh->qd_idx >= 0) {
-+ clear_bit(R5_Discard, &sh->dev[sh->qd_idx].flags);
-+ clear_bit(R5_UPTODATE, &sh->dev[sh->qd_idx].flags);
-+ }
-+ /* now that discard is done we can proceed with any sync */
-+ clear_bit(STRIPE_DISCARD, &sh->state);
-+ if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state))
-+ set_bit(STRIPE_HANDLE, &sh->state);
-+
-+ }
-
- if (test_and_clear_bit(STRIPE_FULL_WRITE, &sh->state))
- if (atomic_dec_and_test(&conf->pending_full_writes))
-@@ -2865,8 +2891,10 @@ static void handle_stripe_dirtying(struct r5conf *conf,
- set_bit(STRIPE_HANDLE, &sh->state);
- if (rmw < rcw && rmw > 0) {
- /* prefer read-modify-write, but need to get some data */
-- blk_add_trace_msg(conf->mddev->queue, "raid5 rmw %llu %d",
-- (unsigned long long)sh->sector, rmw);
-+ if (conf->mddev->queue)
-+ blk_add_trace_msg(conf->mddev->queue,
-+ "raid5 rmw %llu %d",
-+ (unsigned long long)sh->sector, rmw);
- for (i = disks; i--; ) {
- struct r5dev *dev = &sh->dev[i];
- if ((dev->towrite || i == sh->pd_idx) &&
-@@ -2916,7 +2944,7 @@ static void handle_stripe_dirtying(struct r5conf *conf,
- }
- }
- }
-- if (rcw)
-+ if (rcw && conf->mddev->queue)
- blk_add_trace_msg(conf->mddev->queue, "raid5 rcw %llu %d %d %d",
- (unsigned long long)sh->sector,
- rcw, qread, test_bit(STRIPE_DELAYED, &sh->state));
-@@ -3456,9 +3484,15 @@ static void handle_stripe(struct stripe_head *sh)
- return;
- }
-
-- if (test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
-- set_bit(STRIPE_SYNCING, &sh->state);
-- clear_bit(STRIPE_INSYNC, &sh->state);
-+ if (test_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
-+ spin_lock(&sh->stripe_lock);
-+ /* Cannot process 'sync' concurrently with 'discard' */
-+ if (!test_bit(STRIPE_DISCARD, &sh->state) &&
-+ test_and_clear_bit(STRIPE_SYNC_REQUESTED, &sh->state)) {
-+ set_bit(STRIPE_SYNCING, &sh->state);
-+ clear_bit(STRIPE_INSYNC, &sh->state);
-+ }
-+ spin_unlock(&sh->stripe_lock);
- }
- clear_bit(STRIPE_DELAYED, &sh->state);
-
-@@ -3618,6 +3652,8 @@ static void handle_stripe(struct stripe_head *sh)
- test_bit(STRIPE_INSYNC, &sh->state)) {
- md_done_sync(conf->mddev, STRIPE_SECTORS, 1);
- clear_bit(STRIPE_SYNCING, &sh->state);
-+ if (test_and_clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags))
-+ wake_up(&conf->wait_for_overlap);
- }
-
- /* If the failed drives are just a ReadError, then we might need
-@@ -4023,9 +4059,10 @@ static int chunk_aligned_read(struct mddev *mddev, struct bio * raid_bio)
- atomic_inc(&conf->active_aligned_reads);
- spin_unlock_irq(&conf->device_lock);
-
-- trace_block_bio_remap(bdev_get_queue(align_bi->bi_bdev),
-- align_bi, disk_devt(mddev->gendisk),
-- raid_bio->bi_sector);
-+ if (mddev->gendisk)
-+ trace_block_bio_remap(bdev_get_queue(align_bi->bi_bdev),
-+ align_bi, disk_devt(mddev->gendisk),
-+ raid_bio->bi_sector);
- generic_make_request(align_bi);
- return 1;
- } else {
-@@ -4119,7 +4156,8 @@ static void raid5_unplug(struct blk_plug_cb *blk_cb, bool from_schedule)
- }
- spin_unlock_irq(&conf->device_lock);
- }
-- trace_block_unplug(mddev->queue, cnt, !from_schedule);
-+ if (mddev->queue)
-+ trace_block_unplug(mddev->queue, cnt, !from_schedule);
- kfree(cb);
- }
-
-@@ -4182,6 +4220,13 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
- sh = get_active_stripe(conf, logical_sector, 0, 0, 0);
- prepare_to_wait(&conf->wait_for_overlap, &w,
- TASK_UNINTERRUPTIBLE);
-+ set_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags);
-+ if (test_bit(STRIPE_SYNCING, &sh->state)) {
-+ release_stripe(sh);
-+ schedule();
-+ goto again;
-+ }
-+ clear_bit(R5_Overlap, &sh->dev[sh->pd_idx].flags);
- spin_lock_irq(&sh->stripe_lock);
- for (d = 0; d < conf->raid_disks; d++) {
- if (d == sh->pd_idx || d == sh->qd_idx)
-@@ -4194,6 +4239,7 @@ static void make_discard_request(struct mddev *mddev, struct bio *bi)
- goto again;
- }
- }
-+ set_bit(STRIPE_DISCARD, &sh->state);
- finish_wait(&conf->wait_for_overlap, &w);
- for (d = 0; d < conf->raid_disks; d++) {
- if (d == sh->pd_idx || d == sh->qd_idx)
-diff --git a/drivers/md/raid5.h b/drivers/md/raid5.h
-index 18b2c4a..050a334 100644
---- a/drivers/md/raid5.h
-+++ b/drivers/md/raid5.h
-@@ -323,6 +323,7 @@ enum {
- STRIPE_COMPUTE_RUN,
- STRIPE_OPS_REQ_PENDING,
- STRIPE_ON_UNPLUG_LIST,
-+ STRIPE_DISCARD,
- };
-
- /*
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index a079da17..272f81a 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -1728,6 +1728,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
-
- bond_compute_features(bond);
-
-+ bond_update_speed_duplex(new_slave);
-+
- read_lock(&bond->lock);
-
- new_slave->last_arp_rx = jiffies -
-@@ -1780,8 +1782,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
- new_slave->link == BOND_LINK_DOWN ? "DOWN" :
- (new_slave->link == BOND_LINK_UP ? "UP" : "BACK"));
-
-- bond_update_speed_duplex(new_slave);
--
- if (USES_PRIMARY(bond->params.mode) && bond->params.primary[0]) {
- /* if there is a primary slave, remember it */
- if (strcmp(bond->params.primary, new_slave->dev->name) == 0) {
-@@ -2463,8 +2463,6 @@ static void bond_miimon_commit(struct bonding *bond)
- bond_set_backup_slave(slave);
- }
-
-- bond_update_speed_duplex(slave);
--
- pr_info("%s: link status definitely up for interface %s, %u Mbps %s duplex.\n",
- bond->dev->name, slave->dev->name,
- slave->speed, slave->duplex ? "full" : "half");
-diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
-index a5edac8..3a73bb9 100644
---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
-+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
-@@ -2523,6 +2523,7 @@ load_error2:
- bp->port.pmf = 0;
- load_error1:
- bnx2x_napi_disable(bp);
-+ bnx2x_del_all_napi(bp);
- /* clear pf_load status, as it was already set */
- bnx2x_clear_pf_load(bp);
- load_error0:
-diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
-index b4d7b26..937f5b5 100644
---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
-+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_stats.h
-@@ -456,8 +456,9 @@ struct bnx2x_fw_port_stats_old {
-
- #define UPDATE_QSTAT(s, t) \
- do { \
-- qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi); \
- qstats->t##_lo = qstats_old->t##_lo + le32_to_cpu(s.lo); \
-+ qstats->t##_hi = qstats_old->t##_hi + le32_to_cpu(s.hi) \
-+ + ((qstats->t##_lo < qstats_old->t##_lo) ? 1 : 0); \
- } while (0)
-
- #define UPDATE_QSTAT_OLD(f) \
-diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
-index f0b38fa..3ec98f2 100644
---- a/drivers/net/ethernet/broadcom/tg3.c
-+++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -4093,6 +4093,14 @@ static void tg3_phy_copper_begin(struct tg3 *tp)
- tp->link_config.active_speed = tp->link_config.speed;
- tp->link_config.active_duplex = tp->link_config.duplex;
-
-+ if (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5714) {
-+ /* With autoneg disabled, 5715 only links up when the
-+ * advertisement register has the configured speed
-+ * enabled.
-+ */
-+ tg3_writephy(tp, MII_ADVERTISE, ADVERTISE_ALL);
-+ }
-+
- bmcr = 0;
- switch (tp->link_config.speed) {
- default:
-diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
-index bf57b3c..0bc0099 100644
---- a/drivers/net/ethernet/sfc/efx.c
-+++ b/drivers/net/ethernet/sfc/efx.c
-@@ -779,6 +779,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
- tx_queue->txd.entries);
- }
-
-+ efx_device_detach_sync(efx);
- efx_stop_all(efx);
- efx_stop_interrupts(efx, true);
-
-@@ -832,6 +833,7 @@ out:
-
- efx_start_interrupts(efx, true);
- efx_start_all(efx);
-+ netif_device_attach(efx->net_dev);
- return rc;
-
- rollback:
-@@ -1641,8 +1643,12 @@ static void efx_stop_all(struct efx_nic *efx)
- /* Flush efx_mac_work(), refill_workqueue, monitor_work */
- efx_flush_all(efx);
-
-- /* Stop the kernel transmit interface late, so the watchdog
-- * timer isn't ticking over the flush */
-+ /* Stop the kernel transmit interface. This is only valid if
-+ * the device is stopped or detached; otherwise the watchdog
-+ * may fire immediately.
-+ */
-+ WARN_ON(netif_running(efx->net_dev) &&
-+ netif_device_present(efx->net_dev));
- netif_tx_disable(efx->net_dev);
-
- efx_stop_datapath(efx);
-@@ -1963,16 +1969,18 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
- if (new_mtu > EFX_MAX_MTU)
- return -EINVAL;
-
-- efx_stop_all(efx);
--
- netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
-
-+ efx_device_detach_sync(efx);
-+ efx_stop_all(efx);
-+
- mutex_lock(&efx->mac_lock);
- net_dev->mtu = new_mtu;
- efx->type->reconfigure_mac(efx);
- mutex_unlock(&efx->mac_lock);
-
- efx_start_all(efx);
-+ netif_device_attach(efx->net_dev);
- return 0;
- }
-
-diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
-index 50247df..d2f790d 100644
---- a/drivers/net/ethernet/sfc/efx.h
-+++ b/drivers/net/ethernet/sfc/efx.h
-@@ -171,9 +171,9 @@ static inline void efx_device_detach_sync(struct efx_nic *efx)
- * TX scheduler is stopped when we're done and before
- * netif_device_present() becomes false.
- */
-- netif_tx_lock(dev);
-+ netif_tx_lock_bh(dev);
- netif_device_detach(dev);
-- netif_tx_unlock(dev);
-+ netif_tx_unlock_bh(dev);
- }
-
- #endif /* EFX_EFX_H */
-diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
-index 2d756c1..0a90abd 100644
---- a/drivers/net/ethernet/sfc/net_driver.h
-+++ b/drivers/net/ethernet/sfc/net_driver.h
-@@ -210,6 +210,7 @@ struct efx_tx_queue {
- * Will be %NULL if the buffer slot is currently free.
- * @page: The associated page buffer. Valif iff @flags & %EFX_RX_BUF_PAGE.
- * Will be %NULL if the buffer slot is currently free.
-+ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
- * @len: Buffer length, in bytes.
- * @flags: Flags for buffer and packet state.
- */
-@@ -219,7 +220,8 @@ struct efx_rx_buffer {
- struct sk_buff *skb;
- struct page *page;
- } u;
-- unsigned int len;
-+ u16 page_offset;
-+ u16 len;
- u16 flags;
- };
- #define EFX_RX_BUF_PAGE 0x0001
-diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
-index 0ad790c..eaa8e87 100644
---- a/drivers/net/ethernet/sfc/nic.c
-+++ b/drivers/net/ethernet/sfc/nic.c
-@@ -376,7 +376,8 @@ efx_may_push_tx_desc(struct efx_tx_queue *tx_queue, unsigned int write_count)
- return false;
-
- tx_queue->empty_read_count = 0;
-- return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0;
-+ return ((empty_read_count ^ write_count) & ~EFX_EMPTY_COUNT_VALID) == 0
-+ && tx_queue->write_count - write_count == 1;
- }
-
- /* For each entry inserted into the software descriptor ring, create a
-diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
-index 0767043f..3f93624 100644
---- a/drivers/net/ethernet/sfc/ptp.c
-+++ b/drivers/net/ethernet/sfc/ptp.c
-@@ -1439,7 +1439,7 @@ static int efx_phc_settime(struct ptp_clock_info *ptp,
-
- delta = timespec_sub(*e_ts, time_now);
-
-- efx_phc_adjtime(ptp, timespec_to_ns(&delta));
-+ rc = efx_phc_adjtime(ptp, timespec_to_ns(&delta));
- if (rc != 0)
- return rc;
-
-diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
-index d780a0d..bb579a6 100644
---- a/drivers/net/ethernet/sfc/rx.c
-+++ b/drivers/net/ethernet/sfc/rx.c
-@@ -90,11 +90,7 @@ static unsigned int rx_refill_threshold;
- static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
- struct efx_rx_buffer *buf)
- {
-- /* Offset is always within one page, so we don't need to consider
-- * the page order.
-- */
-- return ((unsigned int) buf->dma_addr & (PAGE_SIZE - 1)) +
-- efx->type->rx_buffer_hash_size;
-+ return buf->page_offset + efx->type->rx_buffer_hash_size;
- }
- static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
- {
-@@ -187,6 +183,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
- struct efx_nic *efx = rx_queue->efx;
- struct efx_rx_buffer *rx_buf;
- struct page *page;
-+ unsigned int page_offset;
- struct efx_rx_page_state *state;
- dma_addr_t dma_addr;
- unsigned index, count;
-@@ -211,12 +208,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
- state->dma_addr = dma_addr;
-
- dma_addr += sizeof(struct efx_rx_page_state);
-+ page_offset = sizeof(struct efx_rx_page_state);
-
- split:
- index = rx_queue->added_count & rx_queue->ptr_mask;
- rx_buf = efx_rx_buffer(rx_queue, index);
- rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
- rx_buf->u.page = page;
-+ rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
- rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
- rx_buf->flags = EFX_RX_BUF_PAGE;
- ++rx_queue->added_count;
-@@ -227,6 +226,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
- /* Use the second half of the page */
- get_page(page);
- dma_addr += (PAGE_SIZE >> 1);
-+ page_offset += (PAGE_SIZE >> 1);
- ++count;
- goto split;
- }
-@@ -236,7 +236,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
- }
-
- static void efx_unmap_rx_buffer(struct efx_nic *efx,
-- struct efx_rx_buffer *rx_buf)
-+ struct efx_rx_buffer *rx_buf,
-+ unsigned int used_len)
- {
- if ((rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.page) {
- struct efx_rx_page_state *state;
-@@ -247,6 +248,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
- state->dma_addr,
- efx_rx_buf_size(efx),
- DMA_FROM_DEVICE);
-+ } else if (used_len) {
-+ dma_sync_single_for_cpu(&efx->pci_dev->dev,
-+ rx_buf->dma_addr, used_len,
-+ DMA_FROM_DEVICE);
- }
- } else if (!(rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.skb) {
- dma_unmap_single(&efx->pci_dev->dev, rx_buf->dma_addr,
-@@ -269,7 +274,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
- static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
- struct efx_rx_buffer *rx_buf)
- {
-- efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
-+ efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
- efx_free_rx_buffer(rx_queue->efx, rx_buf);
- }
-
-@@ -535,10 +540,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
- goto out;
- }
-
-- /* Release card resources - assumes all RX buffers consumed in-order
-- * per RX queue
-+ /* Release and/or sync DMA mapping - assumes all RX buffers
-+ * consumed in-order per RX queue
- */
-- efx_unmap_rx_buffer(efx, rx_buf);
-+ efx_unmap_rx_buffer(efx, rx_buf, len);
-
- /* Prefetch nice and early so data will (hopefully) be in cache by
- * the time we look at it.
-diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
-index 6989ebe..21a942c 100644
---- a/drivers/net/netconsole.c
-+++ b/drivers/net/netconsole.c
-@@ -630,6 +630,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
- goto done;
-
- spin_lock_irqsave(&target_list_lock, flags);
-+restart:
- list_for_each_entry(nt, &target_list, list) {
- netconsole_target_get(nt);
- if (nt->np.dev == dev) {
-@@ -642,15 +643,17 @@ static int netconsole_netdev_event(struct notifier_block *this,
- case NETDEV_UNREGISTER:
- /*
- * rtnl_lock already held
-+ * we might sleep in __netpoll_cleanup()
- */
-- if (nt->np.dev) {
-- __netpoll_cleanup(&nt->np);
-- dev_put(nt->np.dev);
-- nt->np.dev = NULL;
-- }
-+ spin_unlock_irqrestore(&target_list_lock, flags);
-+ __netpoll_cleanup(&nt->np);
-+ spin_lock_irqsave(&target_list_lock, flags);
-+ dev_put(nt->np.dev);
-+ nt->np.dev = NULL;
- nt->enabled = 0;
- stopped = true;
-- break;
-+ netconsole_target_put(nt);
-+ goto restart;
- }
- }
- netconsole_target_put(nt);
-diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
-index 248d2dc..16c8429 100644
---- a/drivers/net/usb/cdc_mbim.c
-+++ b/drivers/net/usb/cdc_mbim.c
-@@ -68,18 +68,9 @@ static int cdc_mbim_bind(struct usbnet *dev, struct usb_interface *intf)
- struct cdc_ncm_ctx *ctx;
- struct usb_driver *subdriver = ERR_PTR(-ENODEV);
- int ret = -ENODEV;
-- u8 data_altsetting = CDC_NCM_DATA_ALTSETTING_NCM;
-+ u8 data_altsetting = cdc_ncm_select_altsetting(dev, intf);
- struct cdc_mbim_state *info = (void *)&dev->data;
-
-- /* see if interface supports MBIM alternate setting */
-- if (intf->num_altsetting == 2) {
-- if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-- usb_set_interface(dev->udev,
-- intf->cur_altsetting->desc.bInterfaceNumber,
-- CDC_NCM_COMM_ALTSETTING_MBIM);
-- data_altsetting = CDC_NCM_DATA_ALTSETTING_MBIM;
-- }
--
- /* Probably NCM, defer for cdc_ncm_bind */
- if (!cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
- goto err;
-diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
-index 6d25439..70fb846 100644
---- a/drivers/net/usb/cdc_ncm.c
-+++ b/drivers/net/usb/cdc_ncm.c
-@@ -55,6 +55,14 @@
-
- #define DRIVER_VERSION "14-Mar-2012"
-
-+#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
-+static bool prefer_mbim = true;
-+#else
-+static bool prefer_mbim;
-+#endif
-+module_param(prefer_mbim, bool, S_IRUGO | S_IWUSR);
-+MODULE_PARM_DESC(prefer_mbim, "Prefer MBIM setting on dual NCM/MBIM functions");
-+
- static void cdc_ncm_txpath_bh(unsigned long param);
- static void cdc_ncm_tx_timeout_start(struct cdc_ncm_ctx *ctx);
- static enum hrtimer_restart cdc_ncm_tx_timer_cb(struct hrtimer *hr_timer);
-@@ -550,9 +558,12 @@ void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf)
- }
- EXPORT_SYMBOL_GPL(cdc_ncm_unbind);
-
--static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
-+/* Select the MBIM altsetting iff it is preferred and available,
-+ * returning the number of the corresponding data interface altsetting
-+ */
-+u8 cdc_ncm_select_altsetting(struct usbnet *dev, struct usb_interface *intf)
- {
-- int ret;
-+ struct usb_host_interface *alt;
-
- /* The MBIM spec defines a NCM compatible default altsetting,
- * which we may have matched:
-@@ -568,23 +579,27 @@ static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
- * endpoint descriptors, shall be constructed according to
- * the rules given in section 6 (USB Device Model) of this
- * specification."
-- *
-- * Do not bind to such interfaces, allowing cdc_mbim to handle
-- * them
- */
--#if IS_ENABLED(CONFIG_USB_NET_CDC_MBIM)
-- if ((intf->num_altsetting == 2) &&
-- !usb_set_interface(dev->udev,
-- intf->cur_altsetting->desc.bInterfaceNumber,
-- CDC_NCM_COMM_ALTSETTING_MBIM)) {
-- if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-- return -ENODEV;
-- else
-- usb_set_interface(dev->udev,
-- intf->cur_altsetting->desc.bInterfaceNumber,
-- CDC_NCM_COMM_ALTSETTING_NCM);
-+ if (prefer_mbim && intf->num_altsetting == 2) {
-+ alt = usb_altnum_to_altsetting(intf, CDC_NCM_COMM_ALTSETTING_MBIM);
-+ if (alt && cdc_ncm_comm_intf_is_mbim(alt) &&
-+ !usb_set_interface(dev->udev,
-+ intf->cur_altsetting->desc.bInterfaceNumber,
-+ CDC_NCM_COMM_ALTSETTING_MBIM))
-+ return CDC_NCM_DATA_ALTSETTING_MBIM;
- }
--#endif
-+ return CDC_NCM_DATA_ALTSETTING_NCM;
-+}
-+EXPORT_SYMBOL_GPL(cdc_ncm_select_altsetting);
-+
-+static int cdc_ncm_bind(struct usbnet *dev, struct usb_interface *intf)
-+{
-+ int ret;
-+
-+ /* MBIM backwards compatible function? */
-+ cdc_ncm_select_altsetting(dev, intf);
-+ if (cdc_ncm_comm_intf_is_mbim(intf->cur_altsetting))
-+ return -ENODEV;
-
- /* NCM data altsetting is always 1 */
- ret = cdc_ncm_bind_common(dev, intf, 1);
-diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
-index 19d9035..b69ca0f 100644
---- a/drivers/net/usb/qmi_wwan.c
-+++ b/drivers/net/usb/qmi_wwan.c
-@@ -139,16 +139,9 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf)
-
- BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data) < sizeof(struct qmi_wwan_state)));
-
-- /* control and data is shared? */
-- if (intf->cur_altsetting->desc.bNumEndpoints == 3) {
-- info->control = intf;
-- info->data = intf;
-- goto shared;
-- }
--
-- /* else require a single interrupt status endpoint on control intf */
-- if (intf->cur_altsetting->desc.bNumEndpoints != 1)
-- goto err;
-+ /* set up initial state */
-+ info->control = intf;
-+ info->data = intf;
-
- /* and a number of CDC descriptors */
- while (len > 3) {
-@@ -207,25 +200,14 @@ next_desc:
- buf += h->bLength;
- }
-
-- /* did we find all the required ones? */
-- if (!(found & (1 << USB_CDC_HEADER_TYPE)) ||
-- !(found & (1 << USB_CDC_UNION_TYPE))) {
-- dev_err(&intf->dev, "CDC functional descriptors missing\n");
-- goto err;
-- }
--
-- /* verify CDC Union */
-- if (desc->bInterfaceNumber != cdc_union->bMasterInterface0) {
-- dev_err(&intf->dev, "bogus CDC Union: master=%u\n", cdc_union->bMasterInterface0);
-- goto err;
-- }
--
-- /* need to save these for unbind */
-- info->control = intf;
-- info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-- if (!info->data) {
-- dev_err(&intf->dev, "bogus CDC Union: slave=%u\n", cdc_union->bSlaveInterface0);
-- goto err;
-+ /* Use separate control and data interfaces if we found a CDC Union */
-+ if (cdc_union) {
-+ info->data = usb_ifnum_to_if(dev->udev, cdc_union->bSlaveInterface0);
-+ if (desc->bInterfaceNumber != cdc_union->bMasterInterface0 || !info->data) {
-+ dev_err(&intf->dev, "bogus CDC Union: master=%u, slave=%u\n",
-+ cdc_union->bMasterInterface0, cdc_union->bSlaveInterface0);
-+ goto err;
-+ }
- }
-
- /* errors aren't fatal - we can live with the dynamic address */
-@@ -235,11 +217,12 @@ next_desc:
- }
-
- /* claim data interface and set it up */
-- status = usb_driver_claim_interface(driver, info->data, dev);
-- if (status < 0)
-- goto err;
-+ if (info->control != info->data) {
-+ status = usb_driver_claim_interface(driver, info->data, dev);
-+ if (status < 0)
-+ goto err;
-+ }
-
--shared:
- status = qmi_wwan_register_subdriver(dev);
- if (status < 0 && info->control != info->data) {
- usb_set_intfdata(info->data, NULL);
-diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
-index 88664ae..3473876 100644
---- a/drivers/net/wireless/mwifiex/join.c
-+++ b/drivers/net/wireless/mwifiex/join.c
-@@ -1092,10 +1092,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
- adhoc_join->bss_descriptor.bssid,
- adhoc_join->bss_descriptor.ssid);
-
-- for (i = 0; bss_desc->supported_rates[i] &&
-- i < MWIFIEX_SUPPORTED_RATES;
-- i++)
-- ;
-+ for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
-+ bss_desc->supported_rates[i]; i++)
-+ ;
- rates_size = i;
-
- /* Copy Data Rates from the Rates recorded in scan response */
-diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
-index 44f8b3f..cdbfc30 100644
---- a/drivers/net/wireless/rt2x00/rt2x00dev.c
-+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
-@@ -1209,7 +1209,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
- rt2x00dev->hw->wiphy->interface_modes |=
- BIT(NL80211_IFTYPE_ADHOC) |
- BIT(NL80211_IFTYPE_AP) |
-+#ifdef CONFIG_MAC80211_MESH
- BIT(NL80211_IFTYPE_MESH_POINT) |
-+#endif
- BIT(NL80211_IFTYPE_WDS);
-
- rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
-diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
-index b1ccff4..c08d0f4 100644
---- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
-+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
-@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
-
- void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
- {
-- /* dummy routine needed for callback from rtl_op_configure_filter() */
--}
--
--/*========================================================================== */
--
--static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
-- enum nl80211_iftype type)
--{
- struct rtl_priv *rtlpriv = rtl_priv(hw);
-- u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
- struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
-- struct rtl_phy *rtlphy = &(rtlpriv->phy);
-- u8 filterout_non_associated_bssid = false;
-+ u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
-
-- switch (type) {
-- case NL80211_IFTYPE_ADHOC:
-- case NL80211_IFTYPE_STATION:
-- filterout_non_associated_bssid = true;
-- break;
-- case NL80211_IFTYPE_UNSPECIFIED:
-- case NL80211_IFTYPE_AP:
-- default:
-- break;
-- }
-- if (filterout_non_associated_bssid) {
-+ if (rtlpriv->psc.rfpwr_state != ERFON)
-+ return;
-+
-+ if (check_bssid) {
-+ u8 tmp;
- if (IS_NORMAL_CHIP(rtlhal->version)) {
-- switch (rtlphy->current_io_type) {
-- case IO_CMD_RESUME_DM_BY_SCAN:
-- reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-- rtlpriv->cfg->ops->set_hw_reg(hw,
-- HW_VAR_RCR, (u8 *)(®_rcr));
-- /* enable update TSF */
-- _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
-- break;
-- case IO_CMD_PAUSE_DM_BY_SCAN:
-- reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-- rtlpriv->cfg->ops->set_hw_reg(hw,
-- HW_VAR_RCR, (u8 *)(®_rcr));
-- /* disable update TSF */
-- _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-- break;
-- }
-+ reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-+ tmp = BIT(4);
- } else {
-- reg_rcr |= (RCR_CBSSID);
-- rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-- (u8 *)(®_rcr));
-- _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
-+ reg_rcr |= RCR_CBSSID;
-+ tmp = BIT(4) | BIT(5);
- }
-- } else if (filterout_non_associated_bssid == false) {
-+ rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-+ (u8 *) (®_rcr));
-+ _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
-+ } else {
-+ u8 tmp;
- if (IS_NORMAL_CHIP(rtlhal->version)) {
-- reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
-- rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-- (u8 *)(®_rcr));
-- _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-+ reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-+ tmp = BIT(4);
- } else {
-- reg_rcr &= (~RCR_CBSSID);
-- rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-- (u8 *)(®_rcr));
-- _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
-+ reg_rcr &= ~RCR_CBSSID;
-+ tmp = BIT(4) | BIT(5);
- }
-+ reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
-+ rtlpriv->cfg->ops->set_hw_reg(hw,
-+ HW_VAR_RCR, (u8 *) (®_rcr));
-+ _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
- }
- }
-
-+/*========================================================================== */
-+
- int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
- {
-+ struct rtl_priv *rtlpriv = rtl_priv(hw);
-+
- if (_rtl92cu_set_media_status(hw, type))
- return -EOPNOTSUPP;
-- _rtl92cu_set_check_bssid(hw, type);
-+
-+ if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
-+ if (type != NL80211_IFTYPE_AP)
-+ rtl92cu_set_check_bssid(hw, true);
-+ } else {
-+ rtl92cu_set_check_bssid(hw, false);
-+ }
-+
- return 0;
- }
-
-@@ -2058,8 +2041,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
- (shortgi_rate << 4) | (shortgi_rate);
- }
- rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
-- RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
-- rtl_read_dword(rtlpriv, REG_ARFR0));
- }
-
- void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
-diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
-index b6469e2..d38b267 100644
---- a/drivers/rtc/rtc-at91rm9200.c
-+++ b/drivers/rtc/rtc-at91rm9200.c
-@@ -44,6 +44,7 @@ static DECLARE_COMPLETION(at91_rtc_updated);
- static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
- static void __iomem *at91_rtc_regs;
- static int irq;
-+static u32 at91_rtc_imr;
-
- /*
- * Decode time/date into rtc_time structure
-@@ -108,9 +109,11 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
- cr = at91_rtc_read(AT91_RTC_CR);
- at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
-
-+ at91_rtc_imr |= AT91_RTC_ACKUPD;
- at91_rtc_write(AT91_RTC_IER, AT91_RTC_ACKUPD);
- wait_for_completion(&at91_rtc_updated); /* wait for ACKUPD interrupt */
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD);
-+ at91_rtc_imr &= ~AT91_RTC_ACKUPD;
-
- at91_rtc_write(AT91_RTC_TIMR,
- bin2bcd(tm->tm_sec) << 0
-@@ -142,7 +145,7 @@ static int at91_rtc_readalarm(struct device *dev, struct rtc_wkalrm *alrm)
- tm->tm_yday = rtc_year_days(tm->tm_mday, tm->tm_mon, tm->tm_year);
- tm->tm_year = at91_alarm_year - 1900;
-
-- alrm->enabled = (at91_rtc_read(AT91_RTC_IMR) & AT91_RTC_ALARM)
-+ alrm->enabled = (at91_rtc_imr & AT91_RTC_ALARM)
- ? 1 : 0;
-
- pr_debug("%s(): %4d-%02d-%02d %02d:%02d:%02d\n", __func__,
-@@ -168,6 +171,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
- tm.tm_sec = alrm->time.tm_sec;
-
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
-+ at91_rtc_imr &= ~AT91_RTC_ALARM;
- at91_rtc_write(AT91_RTC_TIMALR,
- bin2bcd(tm.tm_sec) << 0
- | bin2bcd(tm.tm_min) << 8
-@@ -180,6 +184,7 @@ static int at91_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
-
- if (alrm->enabled) {
- at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-+ at91_rtc_imr |= AT91_RTC_ALARM;
- at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
- }
-
-@@ -196,9 +201,12 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
-
- if (enabled) {
- at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_ALARM);
-+ at91_rtc_imr |= AT91_RTC_ALARM;
- at91_rtc_write(AT91_RTC_IER, AT91_RTC_ALARM);
-- } else
-+ } else {
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ALARM);
-+ at91_rtc_imr &= ~AT91_RTC_ALARM;
-+ }
-
- return 0;
- }
-@@ -207,12 +215,10 @@ static int at91_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
- */
- static int at91_rtc_proc(struct device *dev, struct seq_file *seq)
- {
-- unsigned long imr = at91_rtc_read(AT91_RTC_IMR);
--
- seq_printf(seq, "update_IRQ\t: %s\n",
-- (imr & AT91_RTC_ACKUPD) ? "yes" : "no");
-+ (at91_rtc_imr & AT91_RTC_ACKUPD) ? "yes" : "no");
- seq_printf(seq, "periodic_IRQ\t: %s\n",
-- (imr & AT91_RTC_SECEV) ? "yes" : "no");
-+ (at91_rtc_imr & AT91_RTC_SECEV) ? "yes" : "no");
-
- return 0;
- }
-@@ -227,7 +233,7 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
- unsigned int rtsr;
- unsigned long events = 0;
-
-- rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_read(AT91_RTC_IMR);
-+ rtsr = at91_rtc_read(AT91_RTC_SR) & at91_rtc_imr;
- if (rtsr) { /* this interrupt is shared! Is it ours? */
- if (rtsr & AT91_RTC_ALARM)
- events |= (RTC_AF | RTC_IRQF);
-@@ -291,6 +297,7 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
- AT91_RTC_SECEV | AT91_RTC_TIMEV |
- AT91_RTC_CALEV);
-+ at91_rtc_imr = 0;
-
- ret = request_irq(irq, at91_rtc_interrupt,
- IRQF_SHARED,
-@@ -330,6 +337,7 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
- at91_rtc_write(AT91_RTC_IDR, AT91_RTC_ACKUPD | AT91_RTC_ALARM |
- AT91_RTC_SECEV | AT91_RTC_TIMEV |
- AT91_RTC_CALEV);
-+ at91_rtc_imr = 0;
- free_irq(irq, pdev);
-
- rtc_device_unregister(rtc);
-@@ -342,31 +350,35 @@ static int __exit at91_rtc_remove(struct platform_device *pdev)
-
- /* AT91RM9200 RTC Power management control */
-
--static u32 at91_rtc_imr;
-+static u32 at91_rtc_bkpimr;
-+
-
- static int at91_rtc_suspend(struct device *dev)
- {
- /* this IRQ is shared with DBGU and other hardware which isn't
- * necessarily doing PM like we are...
- */
-- at91_rtc_imr = at91_rtc_read(AT91_RTC_IMR)
-- & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-- if (at91_rtc_imr) {
-- if (device_may_wakeup(dev))
-+ at91_rtc_bkpimr = at91_rtc_imr & (AT91_RTC_ALARM|AT91_RTC_SECEV);
-+ if (at91_rtc_bkpimr) {
-+ if (device_may_wakeup(dev)) {
- enable_irq_wake(irq);
-- else
-- at91_rtc_write(AT91_RTC_IDR, at91_rtc_imr);
-- }
-+ } else {
-+ at91_rtc_write(AT91_RTC_IDR, at91_rtc_bkpimr);
-+ at91_rtc_imr &= ~at91_rtc_bkpimr;
-+ }
-+}
- return 0;
- }
-
- static int at91_rtc_resume(struct device *dev)
- {
-- if (at91_rtc_imr) {
-- if (device_may_wakeup(dev))
-+ if (at91_rtc_bkpimr) {
-+ if (device_may_wakeup(dev)) {
- disable_irq_wake(irq);
-- else
-- at91_rtc_write(AT91_RTC_IER, at91_rtc_imr);
-+ } else {
-+ at91_rtc_imr |= at91_rtc_bkpimr;
-+ at91_rtc_write(AT91_RTC_IER, at91_rtc_bkpimr);
-+ }
- }
- return 0;
- }
-diff --git a/drivers/rtc/rtc-at91rm9200.h b/drivers/rtc/rtc-at91rm9200.h
-index da1945e..5f940b6 100644
---- a/drivers/rtc/rtc-at91rm9200.h
-+++ b/drivers/rtc/rtc-at91rm9200.h
-@@ -64,7 +64,6 @@
- #define AT91_RTC_SCCR 0x1c /* Status Clear Command Register */
- #define AT91_RTC_IER 0x20 /* Interrupt Enable Register */
- #define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */
--#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */
-
- #define AT91_RTC_VER 0x2c /* Valid Entry Register */
- #define AT91_RTC_NVTIM (1 << 0) /* Non valid Time */
-diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
-index db0cf7c..a0fc7b9 100644
---- a/drivers/target/iscsi/iscsi_target_auth.c
-+++ b/drivers/target/iscsi/iscsi_target_auth.c
-@@ -166,6 +166,7 @@ static int chap_server_compute_md5(
- {
- char *endptr;
- unsigned long id;
-+ unsigned char id_as_uchar;
- unsigned char digest[MD5_SIGNATURE_SIZE];
- unsigned char type, response[MD5_SIGNATURE_SIZE * 2 + 2];
- unsigned char identifier[10], *challenge = NULL;
-@@ -355,7 +356,9 @@ static int chap_server_compute_md5(
- goto out;
- }
-
-- sg_init_one(&sg, &id, 1);
-+ /* To handle both endiannesses */
-+ id_as_uchar = id;
-+ sg_init_one(&sg, &id_as_uchar, 1);
- ret = crypto_hash_update(&desc, &sg, 1);
- if (ret < 0) {
- pr_err("crypto_hash_update() failed for id\n");
-diff --git a/drivers/target/target_core_file.h b/drivers/target/target_core_file.h
-index bc02b01..37ffc5b 100644
---- a/drivers/target/target_core_file.h
-+++ b/drivers/target/target_core_file.h
-@@ -7,7 +7,7 @@
- #define FD_DEVICE_QUEUE_DEPTH 32
- #define FD_MAX_DEVICE_QUEUE_DEPTH 128
- #define FD_BLOCKSIZE 512
--#define FD_MAX_SECTORS 1024
-+#define FD_MAX_SECTORS 2048
-
- #define RRF_EMULATE_CDB 0x01
- #define RRF_GOT_LBA 0x02
-diff --git a/drivers/tty/serial/sunsu.c b/drivers/tty/serial/sunsu.c
-index 220da3f..94b0ad7 100644
---- a/drivers/tty/serial/sunsu.c
-+++ b/drivers/tty/serial/sunsu.c
-@@ -974,6 +974,7 @@ static struct uart_ops sunsu_pops = {
- #define UART_NR 4
-
- static struct uart_sunsu_port sunsu_ports[UART_NR];
-+static int nr_inst; /* Number of already registered ports */
-
- #ifdef CONFIG_SERIO
-
-@@ -1343,13 +1344,8 @@ static int __init sunsu_console_setup(struct console *co, char *options)
- printk("Console: ttyS%d (SU)\n",
- (sunsu_reg.minor - 64) + co->index);
-
-- /*
-- * Check whether an invalid uart number has been specified, and
-- * if so, search for the first available port that does have
-- * console support.
-- */
-- if (co->index >= UART_NR)
-- co->index = 0;
-+ if (co->index > nr_inst)
-+ return -ENODEV;
- port = &sunsu_ports[co->index].port;
-
- /*
-@@ -1414,7 +1410,6 @@ static enum su_type su_get_type(struct device_node *dp)
-
- static int su_probe(struct platform_device *op)
- {
-- static int inst;
- struct device_node *dp = op->dev.of_node;
- struct uart_sunsu_port *up;
- struct resource *rp;
-@@ -1424,16 +1419,16 @@ static int su_probe(struct platform_device *op)
-
- type = su_get_type(dp);
- if (type == SU_PORT_PORT) {
-- if (inst >= UART_NR)
-+ if (nr_inst >= UART_NR)
- return -EINVAL;
-- up = &sunsu_ports[inst];
-+ up = &sunsu_ports[nr_inst];
- } else {
- up = kzalloc(sizeof(*up), GFP_KERNEL);
- if (!up)
- return -ENOMEM;
- }
-
-- up->port.line = inst;
-+ up->port.line = nr_inst;
-
- spin_lock_init(&up->port.lock);
-
-@@ -1467,6 +1462,8 @@ static int su_probe(struct platform_device *op)
- }
- dev_set_drvdata(&op->dev, up);
-
-+ nr_inst++;
-+
- return 0;
- }
-
-@@ -1494,7 +1491,7 @@ static int su_probe(struct platform_device *op)
-
- dev_set_drvdata(&op->dev, up);
-
-- inst++;
-+ nr_inst++;
-
- return 0;
-
-diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
-index 2d92cce..35d2cf1 100644
---- a/drivers/usb/class/cdc-acm.c
-+++ b/drivers/usb/class/cdc-acm.c
-@@ -600,7 +600,6 @@ static void acm_port_destruct(struct tty_port *port)
-
- dev_dbg(&acm->control->dev, "%s\n", __func__);
-
-- tty_unregister_device(acm_tty_driver, acm->minor);
- acm_release_minor(acm);
- usb_put_intf(acm->control);
- kfree(acm->country_codes);
-@@ -1418,6 +1417,8 @@ static void acm_disconnect(struct usb_interface *intf)
-
- stop_data_traffic(acm);
-
-+ tty_unregister_device(acm_tty_driver, acm->minor);
-+
- usb_free_urb(acm->ctrlurb);
- for (i = 0; i < ACM_NW; i++)
- usb_free_urb(acm->wb[i].urb);
-diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c
-index 622b4a4..2b487d4 100644
---- a/drivers/usb/core/hcd-pci.c
-+++ b/drivers/usb/core/hcd-pci.c
-@@ -173,6 +173,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
- struct hc_driver *driver;
- struct usb_hcd *hcd;
- int retval;
-+ int hcd_irq = 0;
-
- if (usb_disabled())
- return -ENODEV;
-@@ -187,15 +188,19 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
- return -ENODEV;
- dev->current_state = PCI_D0;
-
-- /* The xHCI driver supports MSI and MSI-X,
-- * so don't fail if the BIOS doesn't provide a legacy IRQ.
-+ /*
-+ * The xHCI driver has its own irq management
-+ * make sure irq setup is not touched for xhci in generic hcd code
- */
-- if (!dev->irq && (driver->flags & HCD_MASK) != HCD_USB3) {
-- dev_err(&dev->dev,
-- "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
-- pci_name(dev));
-- retval = -ENODEV;
-- goto disable_pci;
-+ if ((driver->flags & HCD_MASK) != HCD_USB3) {
-+ if (!dev->irq) {
-+ dev_err(&dev->dev,
-+ "Found HC with no IRQ. Check BIOS/PCI %s setup!\n",
-+ pci_name(dev));
-+ retval = -ENODEV;
-+ goto disable_pci;
-+ }
-+ hcd_irq = dev->irq;
- }
-
- hcd = usb_create_hcd(driver, &dev->dev, pci_name(dev));
-@@ -245,7 +250,7 @@ int usb_hcd_pci_probe(struct pci_dev *dev, const struct pci_device_id *id)
-
- pci_set_master(dev);
-
-- retval = usb_add_hcd(hcd, dev->irq, IRQF_SHARED);
-+ retval = usb_add_hcd(hcd, hcd_irq, IRQF_SHARED);
- if (retval != 0)
- goto unmap_registers;
- set_hs_companion(dev, hcd);
-diff --git a/drivers/usb/gadget/g_ffs.c b/drivers/usb/gadget/g_ffs.c
-index 3953dd4..3b343b2 100644
---- a/drivers/usb/gadget/g_ffs.c
-+++ b/drivers/usb/gadget/g_ffs.c
-@@ -357,7 +357,7 @@ static int gfs_bind(struct usb_composite_dev *cdev)
- goto error;
- gfs_dev_desc.iProduct = gfs_strings[USB_GADGET_PRODUCT_IDX].id;
-
-- for (i = func_num; --i; ) {
-+ for (i = func_num; i--; ) {
- ret = functionfs_bind(ffs_tab[i].ffs_data, cdev);
- if (unlikely(ret < 0)) {
- while (++i < func_num)
-@@ -413,7 +413,7 @@ static int gfs_unbind(struct usb_composite_dev *cdev)
- gether_cleanup();
- gfs_ether_setup = false;
-
-- for (i = func_num; --i; )
-+ for (i = func_num; i--; )
- if (ffs_tab[i].ffs_data)
- functionfs_unbind(ffs_tab[i].ffs_data);
-
-diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
-index b416a3f..416a6dc 100644
---- a/drivers/usb/host/ehci-hcd.c
-+++ b/drivers/usb/host/ehci-hcd.c
-@@ -302,6 +302,7 @@ static void ehci_quiesce (struct ehci_hcd *ehci)
-
- static void end_unlink_async(struct ehci_hcd *ehci);
- static void unlink_empty_async(struct ehci_hcd *ehci);
-+static void unlink_empty_async_suspended(struct ehci_hcd *ehci);
- static void ehci_work(struct ehci_hcd *ehci);
- static void start_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh);
- static void end_unlink_intr(struct ehci_hcd *ehci, struct ehci_qh *qh);
-@@ -748,11 +749,9 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
- /* guard against (alleged) silicon errata */
- if (cmd & CMD_IAAD)
- ehci_dbg(ehci, "IAA with IAAD still set?\n");
-- if (ehci->async_iaa) {
-+ if (ehci->async_iaa)
- COUNT(ehci->stats.iaa);
-- end_unlink_async(ehci);
-- } else
-- ehci_dbg(ehci, "IAA with nothing unlinked?\n");
-+ end_unlink_async(ehci);
- }
-
- /* remote wakeup [4.3.1] */
-diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
-index 4d3b294..7d06e77 100644
---- a/drivers/usb/host/ehci-hub.c
-+++ b/drivers/usb/host/ehci-hub.c
-@@ -328,7 +328,7 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
- ehci->rh_state = EHCI_RH_SUSPENDED;
-
- end_unlink_async(ehci);
-- unlink_empty_async(ehci);
-+ unlink_empty_async_suspended(ehci);
- ehci_handle_intr_unlinks(ehci);
- end_free_itds(ehci);
-
-diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
-index eda2cf4..23d1369 100644
---- a/drivers/usb/host/ehci-q.c
-+++ b/drivers/usb/host/ehci-q.c
-@@ -1178,7 +1178,7 @@ static void single_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh)
- struct ehci_qh *prev;
-
- /* Add to the end of the list of QHs waiting for the next IAAD */
-- qh->qh_state = QH_STATE_UNLINK;
-+ qh->qh_state = QH_STATE_UNLINK_WAIT;
- if (ehci->async_unlink)
- ehci->async_unlink_last->unlink_next = qh;
- else
-@@ -1221,9 +1221,19 @@ static void start_iaa_cycle(struct ehci_hcd *ehci, bool nested)
-
- /* Do only the first waiting QH (nVidia bug?) */
- qh = ehci->async_unlink;
-- ehci->async_iaa = qh;
-- ehci->async_unlink = qh->unlink_next;
-- qh->unlink_next = NULL;
-+
-+ /*
-+ * Intel (?) bug: The HC can write back the overlay region
-+ * even after the IAA interrupt occurs. In self-defense,
-+ * always go through two IAA cycles for each QH.
-+ */
-+ if (qh->qh_state == QH_STATE_UNLINK_WAIT) {
-+ qh->qh_state = QH_STATE_UNLINK;
-+ } else {
-+ ehci->async_iaa = qh;
-+ ehci->async_unlink = qh->unlink_next;
-+ qh->unlink_next = NULL;
-+ }
-
- /* Make sure the unlinks are all visible to the hardware */
- wmb();
-@@ -1306,6 +1316,19 @@ static void unlink_empty_async(struct ehci_hcd *ehci)
- }
- }
-
-+/* The root hub is suspended; unlink all the async QHs */
-+static void unlink_empty_async_suspended(struct ehci_hcd *ehci)
-+{
-+ struct ehci_qh *qh;
-+
-+ while (ehci->async->qh_next.qh) {
-+ qh = ehci->async->qh_next.qh;
-+ WARN_ON(!list_empty(&qh->qtd_list));
-+ single_unlink_async(ehci, qh);
-+ }
-+ start_iaa_cycle(ehci, false);
-+}
-+
- /* makes sure the async qh will become idle */
- /* caller must own ehci->lock */
-
-diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
-index 20dbdcb..c3fa130 100644
---- a/drivers/usb/host/ehci-timer.c
-+++ b/drivers/usb/host/ehci-timer.c
-@@ -304,7 +304,7 @@ static void ehci_iaa_watchdog(struct ehci_hcd *ehci)
- * (a) SMP races against real IAA firing and retriggering, and
- * (b) clean HC shutdown, when IAA watchdog was pending.
- */
-- if (ehci->async_iaa) {
-+ if (1) {
- u32 cmd, status;
-
- /* If we get here, IAA is *REALLY* late. It's barely
-diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
-index f1f01a8..849470b 100644
---- a/drivers/usb/host/xhci.c
-+++ b/drivers/usb/host/xhci.c
-@@ -350,7 +350,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
- * generate interrupts. Don't even try to enable MSI.
- */
- if (xhci->quirks & XHCI_BROKEN_MSI)
-- return 0;
-+ goto legacy_irq;
-
- /* unregister the legacy interrupt */
- if (hcd->irq)
-@@ -371,6 +371,7 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
- return -EINVAL;
- }
-
-+ legacy_irq:
- /* fall back to legacy interrupt*/
- ret = request_irq(pdev->irq, &usb_hcd_irq, IRQF_SHARED,
- hcd->irq_descr, hcd);
-diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
-index f791bd0..2c510e4 100644
---- a/drivers/usb/host/xhci.h
-+++ b/drivers/usb/host/xhci.h
-@@ -206,8 +206,8 @@ struct xhci_op_regs {
- /* bits 12:31 are reserved (and should be preserved on writes). */
-
- /* IMAN - Interrupt Management Register */
--#define IMAN_IP (1 << 1)
--#define IMAN_IE (1 << 0)
-+#define IMAN_IE (1 << 1)
-+#define IMAN_IP (1 << 0)
-
- /* USBSTS - USB status - status bitmasks */
- /* HC not running - set to 1 when run/stop bit is cleared. */
-diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c
-index 7c71769d..41613a2 100644
---- a/drivers/usb/musb/da8xx.c
-+++ b/drivers/usb/musb/da8xx.c
-@@ -327,7 +327,7 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci)
- u8 devctl = musb_readb(mregs, MUSB_DEVCTL);
- int err;
-
-- err = musb->int_usb & USB_INTR_VBUSERROR;
-+ err = musb->int_usb & MUSB_INTR_VBUSERROR;
- if (err) {
- /*
- * The Mentor core doesn't debounce VBUS as needed
-diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c
-index 203358d..34e702b 100644
---- a/drivers/usb/serial/garmin_gps.c
-+++ b/drivers/usb/serial/garmin_gps.c
-@@ -959,10 +959,7 @@ static void garmin_close(struct usb_serial_port *port)
- if (!serial)
- return;
-
-- mutex_lock(&port->serial->disc_mutex);
--
-- if (!port->serial->disconnected)
-- garmin_clear(garmin_data_p);
-+ garmin_clear(garmin_data_p);
-
- /* shutdown our urbs */
- usb_kill_urb(port->read_urb);
-@@ -971,8 +968,6 @@ static void garmin_close(struct usb_serial_port *port)
- /* keep reset state so we know that we must start a new session */
- if (garmin_data_p->state != STATE_RESET)
- garmin_data_p->state = STATE_DISCONNECTED;
--
-- mutex_unlock(&port->serial->disc_mutex);
- }
-
-
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index 82afc4d..aa6462f 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -2702,6 +2702,7 @@ static struct usb_serial_driver edgeport_2port_device = {
- .set_termios = edge_set_termios,
- .tiocmget = edge_tiocmget,
- .tiocmset = edge_tiocmset,
-+ .get_icount = edge_get_icount,
- .write = edge_write,
- .write_room = edge_write_room,
- .chars_in_buffer = edge_chars_in_buffer,
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 15af799..3dc3ad2 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -151,6 +151,7 @@ static void destroy_serial(struct kref *kref)
- }
- }
-
-+ usb_put_intf(serial->interface);
- usb_put_dev(serial->dev);
- kfree(serial);
- }
-@@ -614,7 +615,7 @@ static struct usb_serial *create_serial(struct usb_device *dev,
- }
- serial->dev = usb_get_dev(dev);
- serial->type = driver;
-- serial->interface = interface;
-+ serial->interface = usb_get_intf(interface);
- kref_init(&serial->kref);
- mutex_init(&serial->disc_mutex);
- serial->minor = SERIAL_TTY_NO_MINOR;
-diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
-index d305a5a..b75e90b 100644
---- a/drivers/usb/storage/unusual_devs.h
-+++ b/drivers/usb/storage/unusual_devs.h
-@@ -488,6 +488,13 @@ UNUSUAL_DEV( 0x04e8, 0x5122, 0x0000, 0x9999,
- USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_MAX_SECTORS_64 | US_FL_BULK_IGNORE_TAG),
-
-+/* Added by Dmitry Artamonow <mad_soft@inbox.ru> */
-+UNUSUAL_DEV( 0x04e8, 0x5136, 0x0000, 0x9999,
-+ "Samsung",
-+ "YP-Z3",
-+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
-+ US_FL_MAX_SECTORS_64),
-+
- /* Entry and supporting patch by Theodore Kilgore <kilgota@auburn.edu>.
- * Device uses standards-violating 32-byte Bulk Command Block Wrappers and
- * reports itself as "Proprietary SCSI Bulk." Cf. device entry 0x084d:0x0011.
-diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
-index 959b1cd..ec6fb3f 100644
---- a/drivers/vhost/net.c
-+++ b/drivers/vhost/net.c
-@@ -339,7 +339,8 @@ static void handle_tx(struct vhost_net *net)
- msg.msg_controllen = 0;
- ubufs = NULL;
- } else {
-- struct ubuf_info *ubuf = &vq->ubuf_info[head];
-+ struct ubuf_info *ubuf;
-+ ubuf = vq->ubuf_info + vq->upend_idx;
-
- vq->heads[vq->upend_idx].len =
- VHOST_DMA_IN_PROGRESS;
-diff --git a/drivers/video/ep93xx-fb.c b/drivers/video/ep93xx-fb.c
-index 3f2519d..e06cd5d 100644
---- a/drivers/video/ep93xx-fb.c
-+++ b/drivers/video/ep93xx-fb.c
-@@ -23,6 +23,7 @@
- #include <linux/slab.h>
- #include <linux/clk.h>
- #include <linux/fb.h>
-+#include <linux/io.h>
-
- #include <linux/platform_data/video-ep93xx.h>
-
-diff --git a/drivers/watchdog/sp5100_tco.c b/drivers/watchdog/sp5100_tco.c
-index e3b8f75..0e9d8c4 100644
---- a/drivers/watchdog/sp5100_tco.c
-+++ b/drivers/watchdog/sp5100_tco.c
-@@ -40,13 +40,12 @@
- #include "sp5100_tco.h"
-
- /* Module and version information */
--#define TCO_VERSION "0.03"
-+#define TCO_VERSION "0.05"
- #define TCO_MODULE_NAME "SP5100 TCO timer"
- #define TCO_DRIVER_NAME TCO_MODULE_NAME ", v" TCO_VERSION
-
- /* internal variables */
- static u32 tcobase_phys;
--static u32 resbase_phys;
- static u32 tco_wdt_fired;
- static void __iomem *tcobase;
- static unsigned int pm_iobase;
-@@ -54,10 +53,6 @@ static DEFINE_SPINLOCK(tco_lock); /* Guards the hardware */
- static unsigned long timer_alive;
- static char tco_expect_close;
- static struct pci_dev *sp5100_tco_pci;
--static struct resource wdt_res = {
-- .name = "Watchdog Timer",
-- .flags = IORESOURCE_MEM,
--};
-
- /* the watchdog platform device */
- static struct platform_device *sp5100_tco_platform_device;
-@@ -75,12 +70,6 @@ module_param(nowayout, bool, 0);
- MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started."
- " (default=" __MODULE_STRING(WATCHDOG_NOWAYOUT) ")");
-
--static unsigned int force_addr;
--module_param(force_addr, uint, 0);
--MODULE_PARM_DESC(force_addr, "Force the use of specified MMIO address."
-- " ONLY USE THIS PARAMETER IF YOU REALLY KNOW"
-- " WHAT YOU ARE DOING (default=none)");
--
- /*
- * Some TCO specific functions
- */
-@@ -176,39 +165,6 @@ static void tco_timer_enable(void)
- }
- }
-
--static void tco_timer_disable(void)
--{
-- int val;
--
-- if (sp5100_tco_pci->revision >= 0x40) {
-- /* For SB800 or later */
-- /* Enable watchdog decode bit and Disable watchdog timer */
-- outb(SB800_PM_WATCHDOG_CONTROL, SB800_IO_PM_INDEX_REG);
-- val = inb(SB800_IO_PM_DATA_REG);
-- val |= SB800_PCI_WATCHDOG_DECODE_EN;
-- val |= SB800_PM_WATCHDOG_DISABLE;
-- outb(val, SB800_IO_PM_DATA_REG);
-- } else {
-- /* For SP5100 or SB7x0 */
-- /* Enable watchdog decode bit */
-- pci_read_config_dword(sp5100_tco_pci,
-- SP5100_PCI_WATCHDOG_MISC_REG,
-- &val);
--
-- val |= SP5100_PCI_WATCHDOG_DECODE_EN;
--
-- pci_write_config_dword(sp5100_tco_pci,
-- SP5100_PCI_WATCHDOG_MISC_REG,
-- val);
--
-- /* Disable Watchdog timer */
-- outb(SP5100_PM_WATCHDOG_CONTROL, SP5100_IO_PM_INDEX_REG);
-- val = inb(SP5100_IO_PM_DATA_REG);
-- val |= SP5100_PM_WATCHDOG_DISABLE;
-- outb(val, SP5100_IO_PM_DATA_REG);
-- }
--}
--
- /*
- * /dev/watchdog handling
- */
-@@ -361,7 +317,7 @@ static unsigned char sp5100_tco_setupdevice(void)
- {
- struct pci_dev *dev = NULL;
- const char *dev_name = NULL;
-- u32 val, tmp_val;
-+ u32 val;
- u32 index_reg, data_reg, base_addr;
-
- /* Match the PCI device */
-@@ -459,63 +415,8 @@ static unsigned char sp5100_tco_setupdevice(void)
- } else
- pr_debug("SBResource_MMIO is disabled(0x%04x)\n", val);
-
-- /*
-- * Lastly re-programming the watchdog timer MMIO address,
-- * This method is a last resort...
-- *
-- * Before re-programming, to ensure that the watchdog timer
-- * is disabled, disable the watchdog timer.
-- */
-- tco_timer_disable();
--
-- if (force_addr) {
-- /*
-- * Force the use of watchdog timer MMIO address, and aligned to
-- * 8byte boundary.
-- */
-- force_addr &= ~0x7;
-- val = force_addr;
--
-- pr_info("Force the use of 0x%04x as MMIO address\n", val);
-- } else {
-- /*
-- * Get empty slot into the resource tree for watchdog timer.
-- */
-- if (allocate_resource(&iomem_resource,
-- &wdt_res,
-- SP5100_WDT_MEM_MAP_SIZE,
-- 0xf0000000,
-- 0xfffffff8,
-- 0x8,
-- NULL,
-- NULL)) {
-- pr_err("MMIO allocation failed\n");
-- goto unreg_region;
-- }
--
-- val = resbase_phys = wdt_res.start;
-- pr_debug("Got 0x%04x from resource tree\n", val);
-- }
--
-- /* Restore to the low three bits */
-- outb(base_addr+0, index_reg);
-- tmp_val = val | (inb(data_reg) & 0x7);
--
-- /* Re-programming the watchdog timer base address */
-- outb(base_addr+0, index_reg);
-- outb((tmp_val >> 0) & 0xff, data_reg);
-- outb(base_addr+1, index_reg);
-- outb((tmp_val >> 8) & 0xff, data_reg);
-- outb(base_addr+2, index_reg);
-- outb((tmp_val >> 16) & 0xff, data_reg);
-- outb(base_addr+3, index_reg);
-- outb((tmp_val >> 24) & 0xff, data_reg);
--
-- if (!request_mem_region_exclusive(val, SP5100_WDT_MEM_MAP_SIZE,
-- dev_name)) {
-- pr_err("MMIO address 0x%04x already in use\n", val);
-- goto unreg_resource;
-- }
-+ pr_notice("failed to find MMIO address, giving up.\n");
-+ goto unreg_region;
-
- setup_wdt:
- tcobase_phys = val;
-@@ -555,9 +456,6 @@ setup_wdt:
-
- unreg_mem_region:
- release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
--unreg_resource:
-- if (resbase_phys)
-- release_resource(&wdt_res);
- unreg_region:
- release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
- exit:
-@@ -567,7 +465,6 @@ exit:
- static int sp5100_tco_init(struct platform_device *dev)
- {
- int ret;
-- char addr_str[16];
-
- /*
- * Check whether or not the hardware watchdog is there. If found, then
-@@ -599,23 +496,14 @@ static int sp5100_tco_init(struct platform_device *dev)
- clear_bit(0, &timer_alive);
-
- /* Show module parameters */
-- if (force_addr == tcobase_phys)
-- /* The force_addr is vaild */
-- sprintf(addr_str, "0x%04x", force_addr);
-- else
-- strcpy(addr_str, "none");
--
-- pr_info("initialized (0x%p). heartbeat=%d sec (nowayout=%d, "
-- "force_addr=%s)\n",
-- tcobase, heartbeat, nowayout, addr_str);
-+ pr_info("initialized (0x%p). heartbeat=%d sec (nowayout=%d)\n",
-+ tcobase, heartbeat, nowayout);
-
- return 0;
-
- exit:
- iounmap(tcobase);
- release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-- if (resbase_phys)
-- release_resource(&wdt_res);
- release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
- return ret;
- }
-@@ -630,8 +518,6 @@ static void sp5100_tco_cleanup(void)
- misc_deregister(&sp5100_tco_miscdev);
- iounmap(tcobase);
- release_mem_region(tcobase_phys, SP5100_WDT_MEM_MAP_SIZE);
-- if (resbase_phys)
-- release_resource(&wdt_res);
- release_region(pm_iobase, SP5100_PM_IOPORTS_SIZE);
- }
-
-diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h
-index 71594a0..2b28c00 100644
---- a/drivers/watchdog/sp5100_tco.h
-+++ b/drivers/watchdog/sp5100_tco.h
-@@ -57,7 +57,7 @@
- #define SB800_PM_WATCHDOG_DISABLE (1 << 2)
- #define SB800_PM_WATCHDOG_SECOND_RES (3 << 0)
- #define SB800_ACPI_MMIO_DECODE_EN (1 << 0)
--#define SB800_ACPI_MMIO_SEL (1 << 2)
-+#define SB800_ACPI_MMIO_SEL (1 << 1)
-
-
- #define SB800_PM_WDT_MMIO_OFFSET 0xB00
-diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
-index cfd1ce3..1d36db1 100644
---- a/fs/cifs/asn1.c
-+++ b/fs/cifs/asn1.c
-@@ -614,53 +614,10 @@ decode_negTokenInit(unsigned char *security_blob, int length,
- }
- }
-
-- /* mechlistMIC */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- /* Check if we have reached the end of the blob, but with
-- no mechListMic (e.g. NTLMSSP instead of KRB5) */
-- if (ctx.error == ASN1_ERR_DEC_EMPTY)
-- goto decode_negtoken_exit;
-- cFYI(1, "Error decoding last part negTokenInit exit3");
-- return 0;
-- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-- /* tag = 3 indicating mechListMIC */
-- cFYI(1, "Exit 4 cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end);
-- return 0;
-- }
--
-- /* sequence */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- cFYI(1, "Error decoding last part negTokenInit exit5");
-- return 0;
-- } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
-- || (tag != ASN1_SEQ)) {
-- cFYI(1, "cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end);
-- }
--
-- /* sequence of */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- cFYI(1, "Error decoding last part negTokenInit exit 7");
-- return 0;
-- } else if ((cls != ASN1_CTX) || (con != ASN1_CON)) {
-- cFYI(1, "Exit 8 cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end);
-- return 0;
-- }
--
-- /* general string */
-- if (asn1_header_decode(&ctx, &end, &cls, &con, &tag) == 0) {
-- cFYI(1, "Error decoding last part negTokenInit exit9");
-- return 0;
-- } else if ((cls != ASN1_UNI) || (con != ASN1_PRI)
-- || (tag != ASN1_GENSTR)) {
-- cFYI(1, "Exit10 cls = %d con = %d tag = %d end = %p (%d)",
-- cls, con, tag, end, *end);
-- return 0;
-- }
-- cFYI(1, "Need to call asn1_octets_decode() function for %s",
-- ctx.pointer); /* is this UTF-8 or ASCII? */
--decode_negtoken_exit:
-+ /*
-+ * We currently ignore anything at the end of the SPNEGO blob after
-+ * the mechTypes have been parsed, since none of that info is
-+ * used at the moment.
-+ */
- return 1;
- }
-diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
-index e328339..b9db388 100644
---- a/fs/cifs/cifsfs.c
-+++ b/fs/cifs/cifsfs.c
-@@ -91,6 +91,30 @@ struct workqueue_struct *cifsiod_wq;
- __u8 cifs_client_guid[SMB2_CLIENT_GUID_SIZE];
- #endif
-
-+/*
-+ * Bumps refcount for cifs super block.
-+ * Note that it should be only called if a referece to VFS super block is
-+ * already held, e.g. in open-type syscalls context. Otherwise it can race with
-+ * atomic_dec_and_test in deactivate_locked_super.
-+ */
-+void
-+cifs_sb_active(struct super_block *sb)
-+{
-+ struct cifs_sb_info *server = CIFS_SB(sb);
-+
-+ if (atomic_inc_return(&server->active) == 1)
-+ atomic_inc(&sb->s_active);
-+}
-+
-+void
-+cifs_sb_deactive(struct super_block *sb)
-+{
-+ struct cifs_sb_info *server = CIFS_SB(sb);
-+
-+ if (atomic_dec_and_test(&server->active))
-+ deactivate_super(sb);
-+}
-+
- static int
- cifs_read_super(struct super_block *sb)
- {
-diff --git a/fs/cifs/cifsfs.h b/fs/cifs/cifsfs.h
-index 7163419..0e32c34 100644
---- a/fs/cifs/cifsfs.h
-+++ b/fs/cifs/cifsfs.h
-@@ -41,6 +41,10 @@ extern struct file_system_type cifs_fs_type;
- extern const struct address_space_operations cifs_addr_ops;
- extern const struct address_space_operations cifs_addr_ops_smallbuf;
-
-+/* Functions related to super block operations */
-+extern void cifs_sb_active(struct super_block *sb);
-+extern void cifs_sb_deactive(struct super_block *sb);
-+
- /* Functions related to inodes */
- extern const struct inode_operations cifs_dir_inode_ops;
- extern struct inode *cifs_root_iget(struct super_block *);
-diff --git a/fs/cifs/file.c b/fs/cifs/file.c
-index 8ea6ca5..1d93ee8 100644
---- a/fs/cifs/file.c
-+++ b/fs/cifs/file.c
-@@ -294,6 +294,8 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,
- INIT_WORK(&cfile->oplock_break, cifs_oplock_break);
- mutex_init(&cfile->fh_mutex);
-
-+ cifs_sb_active(inode->i_sb);
-+
- /*
- * If the server returned a read oplock and we have mandatory brlocks,
- * set oplock level to None.
-@@ -343,7 +345,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
- struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
- struct TCP_Server_Info *server = tcon->ses->server;
- struct cifsInodeInfo *cifsi = CIFS_I(inode);
-- struct cifs_sb_info *cifs_sb = CIFS_SB(inode->i_sb);
-+ struct super_block *sb = inode->i_sb;
-+ struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
- struct cifsLockInfo *li, *tmp;
- struct cifs_fid fid;
- struct cifs_pending_open open;
-@@ -408,6 +411,7 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
-
- cifs_put_tlink(cifs_file->tlink);
- dput(cifs_file->dentry);
-+ cifs_sb_deactive(sb);
- kfree(cifs_file);
- }
-
-diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index 8462eb3..bbcd6a0 100644
---- a/fs/ext4/ext4.h
-+++ b/fs/ext4/ext4.h
-@@ -338,9 +338,9 @@ struct ext4_group_desc
- */
-
- struct flex_groups {
-- atomic_t free_inodes;
-- atomic_t free_clusters;
-- atomic_t used_dirs;
-+ atomic64_t free_clusters;
-+ atomic_t free_inodes;
-+ atomic_t used_dirs;
- };
-
- #define EXT4_BG_INODE_UNINIT 0x0001 /* Inode table/bitmap not in use */
-diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
-index d42a8c4..4d315a0 100644
---- a/fs/ext4/extents.c
-+++ b/fs/ext4/extents.c
-@@ -3089,6 +3089,7 @@ static int ext4_split_extent(handle_t *handle,
- int err = 0;
- int uninitialized;
- int split_flag1, flags1;
-+ int allocated = map->m_len;
-
- depth = ext_depth(inode);
- ex = path[depth].p_ext;
-@@ -3108,6 +3109,8 @@ static int ext4_split_extent(handle_t *handle,
- map->m_lblk + map->m_len, split_flag1, flags1);
- if (err)
- goto out;
-+ } else {
-+ allocated = ee_len - (map->m_lblk - ee_block);
- }
-
- ext4_ext_drop_refs(path);
-@@ -3130,7 +3133,7 @@ static int ext4_split_extent(handle_t *handle,
-
- ext4_ext_show_leaf(inode, path);
- out:
-- return err ? err : map->m_len;
-+ return err ? err : allocated;
- }
-
- /*
-@@ -3275,7 +3278,7 @@ static int ext4_ext_convert_to_initialized(handle_t *handle,
-
- if (EXT4_EXT_MAY_ZEROOUT & split_flag)
- max_zeroout = sbi->s_extent_max_zeroout_kb >>
-- inode->i_sb->s_blocksize_bits;
-+ (inode->i_sb->s_blocksize_bits - 10);
-
- /* If extent is less than s_max_zeroout_kb, zeroout directly */
- if (max_zeroout && (ee_len <= max_zeroout)) {
-@@ -3720,6 +3723,7 @@ out:
- allocated - map->m_len);
- allocated = map->m_len;
- }
-+ map->m_len = allocated;
-
- /*
- * If we have done fallocate with the offset that is already
-diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
-index 3f32c80..ec2909e 100644
---- a/fs/ext4/ialloc.c
-+++ b/fs/ext4/ialloc.c
-@@ -324,8 +324,8 @@ error_return:
- }
-
- struct orlov_stats {
-+ __u64 free_clusters;
- __u32 free_inodes;
-- __u32 free_clusters;
- __u32 used_dirs;
- };
-
-@@ -342,7 +342,7 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g,
-
- if (flex_size > 1) {
- stats->free_inodes = atomic_read(&flex_group[g].free_inodes);
-- stats->free_clusters = atomic_read(&flex_group[g].free_clusters);
-+ stats->free_clusters = atomic64_read(&flex_group[g].free_clusters);
- stats->used_dirs = atomic_read(&flex_group[g].used_dirs);
- return;
- }
-diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
-index 39f1fa7..22c5c67 100644
---- a/fs/ext4/inode.c
-+++ b/fs/ext4/inode.c
-@@ -211,7 +211,8 @@ void ext4_evict_inode(struct inode *inode)
- * don't use page cache.
- */
- if (ext4_should_journal_data(inode) &&
-- (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode))) {
-+ (S_ISLNK(inode->i_mode) || S_ISREG(inode->i_mode)) &&
-+ inode->i_ino != EXT4_JOURNAL_INO) {
- journal_t *journal = EXT4_SB(inode->i_sb)->s_journal;
- tid_t commit_tid = EXT4_I(inode)->i_datasync_tid;
-
-diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
-index 28bbf9b..82f8c2d 100644
---- a/fs/ext4/mballoc.c
-+++ b/fs/ext4/mballoc.c
-@@ -2829,8 +2829,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
- if (sbi->s_log_groups_per_flex) {
- ext4_group_t flex_group = ext4_flex_group(sbi,
- ac->ac_b_ex.fe_group);
-- atomic_sub(ac->ac_b_ex.fe_len,
-- &sbi->s_flex_groups[flex_group].free_clusters);
-+ atomic64_sub(ac->ac_b_ex.fe_len,
-+ &sbi->s_flex_groups[flex_group].free_clusters);
- }
-
- err = ext4_handle_dirty_metadata(handle, NULL, bitmap_bh);
-@@ -4691,8 +4691,8 @@ do_more:
-
- if (sbi->s_log_groups_per_flex) {
- ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
-- atomic_add(count_clusters,
-- &sbi->s_flex_groups[flex_group].free_clusters);
-+ atomic64_add(count_clusters,
-+ &sbi->s_flex_groups[flex_group].free_clusters);
- }
-
- ext4_mb_unload_buddy(&e4b);
-@@ -4836,8 +4836,8 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,
-
- if (sbi->s_log_groups_per_flex) {
- ext4_group_t flex_group = ext4_flex_group(sbi, block_group);
-- atomic_add(EXT4_NUM_B2C(sbi, blocks_freed),
-- &sbi->s_flex_groups[flex_group].free_clusters);
-+ atomic64_add(EXT4_NUM_B2C(sbi, blocks_freed),
-+ &sbi->s_flex_groups[flex_group].free_clusters);
- }
-
- ext4_mb_unload_buddy(&e4b);
-diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
-index 1aab70d..9eace36 100644
---- a/fs/ext4/resize.c
-+++ b/fs/ext4/resize.c
-@@ -1360,8 +1360,8 @@ static void ext4_update_super(struct super_block *sb,
- sbi->s_log_groups_per_flex) {
- ext4_group_t flex_group;
- flex_group = ext4_flex_group(sbi, group_data[0].group);
-- atomic_add(EXT4_NUM_B2C(sbi, free_blocks),
-- &sbi->s_flex_groups[flex_group].free_clusters);
-+ atomic64_add(EXT4_NUM_B2C(sbi, free_blocks),
-+ &sbi->s_flex_groups[flex_group].free_clusters);
- atomic_add(EXT4_INODES_PER_GROUP(sb) * flex_gd->count,
- &sbi->s_flex_groups[flex_group].free_inodes);
- }
-diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index 5fa223d..24c767d 100644
---- a/fs/ext4/super.c
-+++ b/fs/ext4/super.c
-@@ -1979,8 +1979,8 @@ static int ext4_fill_flex_info(struct super_block *sb)
- flex_group = ext4_flex_group(sbi, i);
- atomic_add(ext4_free_inodes_count(sb, gdp),
- &sbi->s_flex_groups[flex_group].free_inodes);
-- atomic_add(ext4_free_group_clusters(sb, gdp),
-- &sbi->s_flex_groups[flex_group].free_clusters);
-+ atomic64_add(ext4_free_group_clusters(sb, gdp),
-+ &sbi->s_flex_groups[flex_group].free_clusters);
- atomic_add(ext4_used_dirs_count(sb, gdp),
- &sbi->s_flex_groups[flex_group].used_dirs);
- }
-diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
-index df9f297..73b9253 100644
---- a/fs/jbd2/transaction.c
-+++ b/fs/jbd2/transaction.c
-@@ -1047,9 +1047,12 @@ out:
- void jbd2_journal_set_triggers(struct buffer_head *bh,
- struct jbd2_buffer_trigger_type *type)
- {
-- struct journal_head *jh = bh2jh(bh);
-+ struct journal_head *jh = jbd2_journal_grab_journal_head(bh);
-
-+ if (WARN_ON(!jh))
-+ return;
- jh->b_triggers = type;
-+ jbd2_journal_put_journal_head(jh);
- }
-
- void jbd2_buffer_frozen_trigger(struct journal_head *jh, void *mapped_data,
-@@ -1101,17 +1104,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
- {
- transaction_t *transaction = handle->h_transaction;
- journal_t *journal = transaction->t_journal;
-- struct journal_head *jh = bh2jh(bh);
-+ struct journal_head *jh;
- int ret = 0;
-
-- jbd_debug(5, "journal_head %p\n", jh);
-- JBUFFER_TRACE(jh, "entry");
- if (is_handle_aborted(handle))
- goto out;
-- if (!buffer_jbd(bh)) {
-+ jh = jbd2_journal_grab_journal_head(bh);
-+ if (!jh) {
- ret = -EUCLEAN;
- goto out;
- }
-+ jbd_debug(5, "journal_head %p\n", jh);
-+ JBUFFER_TRACE(jh, "entry");
-
- jbd_lock_bh_state(bh);
-
-@@ -1202,6 +1206,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
- spin_unlock(&journal->j_list_lock);
- out_unlock_bh:
- jbd_unlock_bh_state(bh);
-+ jbd2_journal_put_journal_head(jh);
- out:
- JBUFFER_TRACE(jh, "exit");
- WARN_ON(ret); /* All errors are bugs, so dump the stack */
-diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
-index d586117..69c6413 100644
---- a/fs/nfsd/vfs.c
-+++ b/fs/nfsd/vfs.c
-@@ -1013,6 +1013,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
- int host_err;
- int stable = *stablep;
- int use_wgather;
-+ loff_t pos = offset;
-
- dentry = file->f_path.dentry;
- inode = dentry->d_inode;
-@@ -1025,7 +1026,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
-
- /* Write the data. */
- oldfs = get_fs(); set_fs(KERNEL_DS);
-- host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
-+ host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &pos);
- set_fs(oldfs);
- if (host_err < 0)
- goto out_nfserr;
-diff --git a/fs/proc/generic.c b/fs/proc/generic.c
-index 76ddae8..b796da2 100644
---- a/fs/proc/generic.c
-+++ b/fs/proc/generic.c
-@@ -412,8 +412,7 @@ static const struct dentry_operations proc_dentry_operations =
- struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *dir,
- struct dentry *dentry)
- {
-- struct inode *inode = NULL;
-- int error = -ENOENT;
-+ struct inode *inode;
-
- spin_lock(&proc_subdir_lock);
- for (de = de->subdir; de ; de = de->next) {
-@@ -422,22 +421,16 @@ struct dentry *proc_lookup_de(struct proc_dir_entry *de, struct inode *dir,
- if (!memcmp(dentry->d_name.name, de->name, de->namelen)) {
- pde_get(de);
- spin_unlock(&proc_subdir_lock);
-- error = -ENOMEM;
- inode = proc_get_inode(dir->i_sb, de);
-- goto out_unlock;
-+ if (!inode)
-+ return ERR_PTR(-ENOMEM);
-+ d_set_d_op(dentry, &proc_dentry_operations);
-+ d_add(dentry, inode);
-+ return NULL;
- }
- }
- spin_unlock(&proc_subdir_lock);
--out_unlock:
--
-- if (inode) {
-- d_set_d_op(dentry, &proc_dentry_operations);
-- d_add(dentry, inode);
-- return NULL;
-- }
-- if (de)
-- pde_put(de);
-- return ERR_PTR(error);
-+ return ERR_PTR(-ENOENT);
- }
-
- struct dentry *proc_lookup(struct inode *dir, struct dentry *dentry,
-diff --git a/fs/proc/inode.c b/fs/proc/inode.c
-index 439ae688..0ac1e1b 100644
---- a/fs/proc/inode.c
-+++ b/fs/proc/inode.c
-@@ -445,12 +445,10 @@ static const struct file_operations proc_reg_file_ops_no_compat = {
-
- struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
- {
-- struct inode * inode;
-+ struct inode *inode = new_inode_pseudo(sb);
-
-- inode = iget_locked(sb, de->low_ino);
-- if (!inode)
-- return NULL;
-- if (inode->i_state & I_NEW) {
-+ if (inode) {
-+ inode->i_ino = de->low_ino;
- inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
- PROC_I(inode)->pde = de;
-
-@@ -478,11 +476,10 @@ struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
- inode->i_fop = de->proc_fops;
- }
- }
-- unlock_new_inode(inode);
- } else
- pde_put(de);
- return inode;
--}
-+}
-
- int proc_fill_super(struct super_block *s)
- {
-@@ -499,6 +496,5 @@ int proc_fill_super(struct super_block *s)
- return 0;
-
- printk("proc_read_super: get root inode failed\n");
-- pde_put(&proc_root);
- return -ENOMEM;
- }
-diff --git a/fs/udf/udf_sb.h b/fs/udf/udf_sb.h
-index 5f02722..8d1c9d4 100644
---- a/fs/udf/udf_sb.h
-+++ b/fs/udf/udf_sb.h
-@@ -82,7 +82,7 @@ struct udf_virtual_data {
- struct udf_bitmap {
- __u32 s_extLength;
- __u32 s_extPosition;
-- __u16 s_nr_groups;
-+ int s_nr_groups;
- struct buffer_head **s_block_bitmap;
- };
-
-diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
-index c5c35e6..1cdbfe9 100644
---- a/include/drm/drm_pciids.h
-+++ b/include/drm/drm_pciids.h
-@@ -568,7 +568,11 @@
- {0x1002, 0x9908, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x9909, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x990A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-- {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x990B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x990C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x990D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x990E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x990F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x9910, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x9913, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x9917, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-@@ -579,6 +583,13 @@
- {0x1002, 0x9992, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x9993, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x9994, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x9995, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x9996, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x9997, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x9998, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x9999, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x999A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-+ {0x1002, 0x999B, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x99A0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x99A2, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- {0x1002, 0x99A4, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_ARUBA|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
-diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index 320e976..98399e2 100644
---- a/include/linux/skbuff.h
-+++ b/include/linux/skbuff.h
-@@ -491,7 +491,7 @@ struct sk_buff {
- union {
- __u32 mark;
- __u32 dropcount;
-- __u32 avail_size;
-+ __u32 reserved_tailroom;
- };
-
- sk_buff_data_t inner_transport_header;
-@@ -1269,11 +1269,13 @@ static inline void __skb_fill_page_desc(struct sk_buff *skb, int i,
- * do not lose pfmemalloc information as the pages would not be
- * allocated using __GFP_MEMALLOC.
- */
-- if (page->pfmemalloc && !page->mapping)
-- skb->pfmemalloc = true;
- frag->page.p = page;
- frag->page_offset = off;
- skb_frag_size_set(frag, size);
-+
-+ page = compound_head(page);
-+ if (page->pfmemalloc && !page->mapping)
-+ skb->pfmemalloc = true;
- }
-
- /**
-@@ -1428,7 +1430,10 @@ static inline int skb_tailroom(const struct sk_buff *skb)
- */
- static inline int skb_availroom(const struct sk_buff *skb)
- {
-- return skb_is_nonlinear(skb) ? 0 : skb->avail_size - skb->len;
-+ if (skb_is_nonlinear(skb))
-+ return 0;
-+
-+ return skb->end - skb->tail - skb->reserved_tailroom;
- }
-
- /**
-diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h
-index 3b8f9d4..cc25b70 100644
---- a/include/linux/usb/cdc_ncm.h
-+++ b/include/linux/usb/cdc_ncm.h
-@@ -127,6 +127,7 @@ struct cdc_ncm_ctx {
- u16 connected;
- };
-
-+extern u8 cdc_ncm_select_altsetting(struct usbnet *dev, struct usb_interface *intf);
- extern int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_altsetting);
- extern void cdc_ncm_unbind(struct usbnet *dev, struct usb_interface *intf);
- extern struct sk_buff *cdc_ncm_fill_tx_frame(struct cdc_ncm_ctx *ctx, struct sk_buff *skb, __le32 sign);
-diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
-index 32786a0..2ab2e43 100644
---- a/include/net/inet_frag.h
-+++ b/include/net/inet_frag.h
-@@ -35,6 +35,13 @@ struct inet_frag_queue {
-
- #define INETFRAGS_HASHSZ 64
-
-+/* averaged:
-+ * max_depth = default ipfrag_high_thresh / INETFRAGS_HASHSZ /
-+ * rounded up (SKB_TRUELEN(0) + sizeof(struct ipq or
-+ * struct frag_queue))
-+ */
-+#define INETFRAGS_MAXDEPTH 128
-+
- struct inet_frags {
- struct hlist_head hash[INETFRAGS_HASHSZ];
- rwlock_t lock;
-@@ -65,6 +72,8 @@ int inet_frag_evictor(struct netns_frags *nf, struct inet_frags *f, bool force);
- struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
- struct inet_frags *f, void *key, unsigned int hash)
- __releases(&f->lock);
-+void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
-+ const char *prefix);
-
- static inline void inet_frag_put(struct inet_frag_queue *q, struct inet_frags *f)
- {
-diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
-index 9497be1..e49db91 100644
---- a/include/net/ip_fib.h
-+++ b/include/net/ip_fib.h
-@@ -152,18 +152,16 @@ struct fib_result_nl {
- };
-
- #ifdef CONFIG_IP_ROUTE_MULTIPATH
--
- #define FIB_RES_NH(res) ((res).fi->fib_nh[(res).nh_sel])
--
--#define FIB_TABLE_HASHSZ 2
--
- #else /* CONFIG_IP_ROUTE_MULTIPATH */
--
- #define FIB_RES_NH(res) ((res).fi->fib_nh[0])
-+#endif /* CONFIG_IP_ROUTE_MULTIPATH */
-
-+#ifdef CONFIG_IP_MULTIPLE_TABLES
- #define FIB_TABLE_HASHSZ 256
--
--#endif /* CONFIG_IP_ROUTE_MULTIPATH */
-+#else
-+#define FIB_TABLE_HASHSZ 2
-+#endif
-
- extern __be32 fib_info_update_nh_saddr(struct net *net, struct fib_nh *nh);
-
-diff --git a/ipc/mqueue.c b/ipc/mqueue.c
-index 71a3ca1..6ebfbf5 100644
---- a/ipc/mqueue.c
-+++ b/ipc/mqueue.c
-@@ -840,7 +840,8 @@ out_putfd:
- fd = error;
- }
- mutex_unlock(&root->d_inode->i_mutex);
-- mnt_drop_write(mnt);
-+ if (!ro)
-+ mnt_drop_write(mnt);
- out_putname:
- putname(name);
- return fd;
-diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
-index f113755..a13987a 100644
---- a/kernel/time/tick-broadcast.c
-+++ b/kernel/time/tick-broadcast.c
-@@ -66,7 +66,8 @@ static void tick_broadcast_start_periodic(struct clock_event_device *bc)
- */
- int tick_check_broadcast_device(struct clock_event_device *dev)
- {
-- if ((tick_broadcast_device.evtdev &&
-+ if ((dev->features & CLOCK_EVT_FEAT_DUMMY) ||
-+ (tick_broadcast_device.evtdev &&
- tick_broadcast_device.evtdev->rating >= dev->rating) ||
- (dev->features & CLOCK_EVT_FEAT_C3STOP))
- return 0;
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 43defd1..b27052c 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -3082,8 +3082,8 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops,
- continue;
- }
-
-- hlist_del(&entry->node);
-- call_rcu(&entry->rcu, ftrace_free_entry_rcu);
-+ hlist_del_rcu(&entry->node);
-+ call_rcu_sched(&entry->rcu, ftrace_free_entry_rcu);
- }
- }
- __disable_ftrace_function_probe();
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 3c13e46..2ffbc24 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -703,7 +703,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
- void
- update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
- {
-- struct ring_buffer *buf = tr->buffer;
-+ struct ring_buffer *buf;
-
- if (trace_stop_count)
- return;
-@@ -715,6 +715,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
- }
- arch_spin_lock(&ftrace_max_lock);
-
-+ buf = tr->buffer;
- tr->buffer = max_tr.buffer;
- max_tr.buffer = buf;
-
-@@ -2849,8 +2850,12 @@ static void set_tracer_flags(unsigned int mask, int enabled)
- if (mask == TRACE_ITER_RECORD_CMD)
- trace_event_enable_cmd_record(enabled);
-
-- if (mask == TRACE_ITER_OVERWRITE)
-+ if (mask == TRACE_ITER_OVERWRITE) {
- ring_buffer_change_overwrite(global_trace.buffer, enabled);
-+#ifdef CONFIG_TRACER_MAX_TRACE
-+ ring_buffer_change_overwrite(max_tr.buffer, enabled);
-+#endif
-+ }
-
- if (mask == TRACE_ITER_PRINTK)
- trace_printk_start_stop_comm(enabled);
-@@ -2870,6 +2875,8 @@ static int trace_set_options(char *option)
- cmp += 2;
- }
-
-+ mutex_lock(&trace_types_lock);
-+
- for (i = 0; trace_options[i]; i++) {
- if (strcmp(cmp, trace_options[i]) == 0) {
- set_tracer_flags(1 << i, !neg);
-@@ -2878,11 +2885,10 @@ static int trace_set_options(char *option)
- }
-
- /* If no option could be set, test the specific tracer options */
-- if (!trace_options[i]) {
-- mutex_lock(&trace_types_lock);
-+ if (!trace_options[i])
- ret = set_tracer_option(current_trace, cmp, neg);
-- mutex_unlock(&trace_types_lock);
-- }
-+
-+ mutex_unlock(&trace_types_lock);
-
- return ret;
- }
-@@ -4640,7 +4646,10 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
-
- if (val != 0 && val != 1)
- return -EINVAL;
-+
-+ mutex_lock(&trace_types_lock);
- set_tracer_flags(1 << index, val);
-+ mutex_unlock(&trace_types_lock);
-
- *ppos += cnt;
-
-diff --git a/mm/hugetlb.c b/mm/hugetlb.c
-index 546db81..d7cec92 100644
---- a/mm/hugetlb.c
-+++ b/mm/hugetlb.c
-@@ -2127,8 +2127,12 @@ int hugetlb_report_node_meminfo(int nid, char *buf)
- /* Return the number pages of memory we physically have, in PAGE_SIZE units. */
- unsigned long hugetlb_total_pages(void)
- {
-- struct hstate *h = &default_hstate;
-- return h->nr_huge_pages * pages_per_huge_page(h);
-+ struct hstate *h;
-+ unsigned long nr_total_pages = 0;
-+
-+ for_each_hstate(h)
-+ nr_total_pages += h->nr_huge_pages * pages_per_huge_page(h);
-+ return nr_total_pages;
- }
-
- static int hugetlb_acct_memory(struct hstate *h, long delta)
-diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
-index 7d02ebd..1ee94d0 100644
---- a/net/batman-adv/bat_iv_ogm.c
-+++ b/net/batman-adv/bat_iv_ogm.c
-@@ -1298,7 +1298,8 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
- batadv_ogm_packet = (struct batadv_ogm_packet *)packet_buff;
-
- /* unpack the aggregated packets and process them one by one */
-- do {
-+ while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
-+ batadv_ogm_packet->tt_num_changes)) {
- tt_buff = packet_buff + buff_pos + BATADV_OGM_HLEN;
-
- batadv_iv_ogm_process(ethhdr, batadv_ogm_packet, tt_buff,
-@@ -1309,8 +1310,7 @@ static int batadv_iv_ogm_receive(struct sk_buff *skb,
-
- packet_pos = packet_buff + buff_pos;
- batadv_ogm_packet = (struct batadv_ogm_packet *)packet_pos;
-- } while (batadv_iv_ogm_aggr_packet(buff_pos, packet_len,
-- batadv_ogm_packet->tt_num_changes));
-+ }
-
- kfree_skb(skb);
- return NET_RX_SUCCESS;
-diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
-index 5dc66ab..580e176 100644
---- a/net/bridge/br_netlink.c
-+++ b/net/bridge/br_netlink.c
-@@ -28,6 +28,7 @@ static inline size_t br_port_info_size(void)
- + nla_total_size(1) /* IFLA_BRPORT_MODE */
- + nla_total_size(1) /* IFLA_BRPORT_GUARD */
- + nla_total_size(1) /* IFLA_BRPORT_PROTECT */
-+ + nla_total_size(1) /* IFLA_BRPORT_FAST_LEAVE */
- + 0;
- }
-
-diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 798f920..6212ec9 100644
---- a/net/core/rtnetlink.c
-+++ b/net/core/rtnetlink.c
-@@ -2539,7 +2539,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
- struct rtattr *attr = (void *)nlh + NLMSG_ALIGN(min_len);
-
- while (RTA_OK(attr, attrlen)) {
-- unsigned int flavor = attr->rta_type;
-+ unsigned int flavor = attr->rta_type & NLA_TYPE_MASK;
- if (flavor) {
- if (flavor > rta_max[sz_idx])
- return -EINVAL;
-diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
-index 4750d2b..03f5af7 100644
---- a/net/ipv4/inet_fragment.c
-+++ b/net/ipv4/inet_fragment.c
-@@ -21,6 +21,7 @@
- #include <linux/rtnetlink.h>
- #include <linux/slab.h>
-
-+#include <net/sock.h>
- #include <net/inet_frag.h>
-
- static void inet_frag_secret_rebuild(unsigned long dummy)
-@@ -276,6 +277,7 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
- {
- struct inet_frag_queue *q;
- struct hlist_node *n;
-+ int depth = 0;
-
- hlist_for_each_entry(q, n, &f->hash[hash], list) {
- if (q->net == nf && f->match(q, key)) {
-@@ -283,9 +285,25 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf,
- read_unlock(&f->lock);
- return q;
- }
-+ depth++;
- }
- read_unlock(&f->lock);
-
-- return inet_frag_create(nf, f, key);
-+ if (depth <= INETFRAGS_MAXDEPTH)
-+ return inet_frag_create(nf, f, key);
-+ else
-+ return ERR_PTR(-ENOBUFS);
- }
- EXPORT_SYMBOL(inet_frag_find);
-+
-+void inet_frag_maybe_warn_overflow(struct inet_frag_queue *q,
-+ const char *prefix)
-+{
-+ static const char msg[] = "inet_frag_find: Fragment hash bucket"
-+ " list length grew over limit " __stringify(INETFRAGS_MAXDEPTH)
-+ ". Dropping fragment.\n";
-+
-+ if (PTR_ERR(q) == -ENOBUFS)
-+ LIMIT_NETDEBUG(KERN_WARNING "%s%s", prefix, msg);
-+}
-+EXPORT_SYMBOL(inet_frag_maybe_warn_overflow);
-diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
-index eb9d63a..a8fc332 100644
---- a/net/ipv4/ip_fragment.c
-+++ b/net/ipv4/ip_fragment.c
-@@ -299,14 +299,11 @@ static inline struct ipq *ip_find(struct net *net, struct iphdr *iph, u32 user)
- hash = ipqhashfn(iph->id, iph->saddr, iph->daddr, iph->protocol);
-
- q = inet_frag_find(&net->ipv4.frags, &ip4_frags, &arg, hash);
-- if (q == NULL)
-- goto out_nomem;
--
-+ if (IS_ERR_OR_NULL(q)) {
-+ inet_frag_maybe_warn_overflow(q, pr_fmt());
-+ return NULL;
-+ }
- return container_of(q, struct ipq, q);
--
--out_nomem:
-- LIMIT_NETDEBUG(KERN_ERR pr_fmt("ip_frag_create: no memory left !\n"));
-- return NULL;
- }
-
- /* Is the fragment too far ahead to be part of ipq? */
-diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
-index e81b1ca..a85062b 100644
---- a/net/ipv4/ip_gre.c
-+++ b/net/ipv4/ip_gre.c
-@@ -761,10 +761,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
-
- if (dev->header_ops && dev->type == ARPHRD_IPGRE) {
- gre_hlen = 0;
-- if (skb->protocol == htons(ETH_P_IP))
-- tiph = (const struct iphdr *)skb->data;
-- else
-- tiph = &tunnel->parms.iph;
-+ tiph = (const struct iphdr *)skb->data;
- } else {
- gre_hlen = tunnel->hlen;
- tiph = &tunnel->parms.iph;
-diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
-index f6289bf..9100fe0 100644
---- a/net/ipv4/ip_options.c
-+++ b/net/ipv4/ip_options.c
-@@ -370,7 +370,6 @@ int ip_options_compile(struct net *net,
- }
- switch (optptr[3]&0xF) {
- case IPOPT_TS_TSONLY:
-- opt->ts = optptr - iph;
- if (skb)
- timeptr = &optptr[optptr[2]-1];
- opt->ts_needtime = 1;
-@@ -381,7 +380,6 @@ int ip_options_compile(struct net *net,
- pp_ptr = optptr + 2;
- goto error;
- }
-- opt->ts = optptr - iph;
- if (rt) {
- spec_dst_fill(&spec_dst, skb);
- memcpy(&optptr[optptr[2]-1], &spec_dst, 4);
-@@ -396,7 +394,6 @@ int ip_options_compile(struct net *net,
- pp_ptr = optptr + 2;
- goto error;
- }
-- opt->ts = optptr - iph;
- {
- __be32 addr;
- memcpy(&addr, &optptr[optptr[2]-1], 4);
-@@ -429,12 +426,12 @@ int ip_options_compile(struct net *net,
- pp_ptr = optptr + 3;
- goto error;
- }
-- opt->ts = optptr - iph;
- if (skb) {
- optptr[3] = (optptr[3]&0xF)|((overflow+1)<<4);
- opt->is_changed = 1;
- }
- }
-+ opt->ts = optptr - iph;
- break;
- case IPOPT_RA:
- if (optlen < 4) {
-diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
-index 2aa69c8..45b63ca 100644
---- a/net/ipv4/tcp.c
-+++ b/net/ipv4/tcp.c
-@@ -773,7 +773,7 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
- * Make sure that we have exactly size bytes
- * available to the caller, no more, no less.
- */
-- skb->avail_size = size;
-+ skb->reserved_tailroom = skb->end - skb->tail - size;
- return skb;
- }
- __kfree_skb(skb);
-diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index eadb693..d9130a9 100644
---- a/net/ipv4/tcp_ipv4.c
-+++ b/net/ipv4/tcp_ipv4.c
-@@ -274,13 +274,6 @@ static void tcp_v4_mtu_reduced(struct sock *sk)
- struct inet_sock *inet = inet_sk(sk);
- u32 mtu = tcp_sk(sk)->mtu_info;
-
-- /* We are not interested in TCP_LISTEN and open_requests (SYN-ACKs
-- * send out by Linux are always <576bytes so they should go through
-- * unfragmented).
-- */
-- if (sk->sk_state == TCP_LISTEN)
-- return;
--
- dst = inet_csk_update_pmtu(sk, mtu);
- if (!dst)
- return;
-@@ -408,6 +401,13 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
- goto out;
-
- if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */
-+ /* We are not interested in TCP_LISTEN and open_requests
-+ * (SYN-ACKs send out by Linux are always <576bytes so
-+ * they should go through unfragmented).
-+ */
-+ if (sk->sk_state == TCP_LISTEN)
-+ goto out;
-+
- tp->mtu_info = info;
- if (!sock_owned_by_user(sk)) {
- tcp_v4_mtu_reduced(sk);
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index ff031a5..c36c6c2 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1298,7 +1298,6 @@ static void __pskb_trim_head(struct sk_buff *skb, int len)
- eat = min_t(int, len, skb_headlen(skb));
- if (eat) {
- __skb_pull(skb, eat);
-- skb->avail_size -= eat;
- len -= eat;
- if (!len)
- return;
-diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
-index 3dacecc..2f3a018 100644
---- a/net/ipv6/netfilter/nf_conntrack_reasm.c
-+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
-@@ -14,6 +14,8 @@
- * 2 of the License, or (at your option) any later version.
- */
-
-+#define pr_fmt(fmt) "IPv6-nf: " fmt
-+
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/string.h>
-@@ -180,13 +182,11 @@ static inline struct frag_queue *fq_find(struct net *net, __be32 id,
-
- q = inet_frag_find(&net->nf_frag.frags, &nf_frags, &arg, hash);
- local_bh_enable();
-- if (q == NULL)
-- goto oom;
--
-+ if (IS_ERR_OR_NULL(q)) {
-+ inet_frag_maybe_warn_overflow(q, pr_fmt());
-+ return NULL;
-+ }
- return container_of(q, struct frag_queue, q);
--
--oom:
-- return NULL;
- }
-
-
-diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
-index e5253ec..d9ba8a2 100644
---- a/net/ipv6/reassembly.c
-+++ b/net/ipv6/reassembly.c
-@@ -26,6 +26,9 @@
- * YOSHIFUJI,H. @USAGI Always remove fragment header to
- * calculate ICV correctly.
- */
-+
-+#define pr_fmt(fmt) "IPv6: " fmt
-+
- #include <linux/errno.h>
- #include <linux/types.h>
- #include <linux/string.h>
-@@ -197,9 +200,10 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src, const struct in6
- hash = inet6_hash_frag(id, src, dst, ip6_frags.rnd);
-
- q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
-- if (q == NULL)
-+ if (IS_ERR_OR_NULL(q)) {
-+ inet_frag_maybe_warn_overflow(q, pr_fmt());
- return NULL;
--
-+ }
- return container_of(q, struct frag_queue, q);
- }
-
-diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
-index 4f435371..8d19346 100644
---- a/net/ipv6/tcp_ipv6.c
-+++ b/net/ipv6/tcp_ipv6.c
-@@ -389,6 +389,13 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
- }
-
- if (type == ICMPV6_PKT_TOOBIG) {
-+ /* We are not interested in TCP_LISTEN and open_requests
-+ * (SYN-ACKs send out by Linux are always <576bytes so
-+ * they should go through unfragmented).
-+ */
-+ if (sk->sk_state == TCP_LISTEN)
-+ goto out;
-+
- tp->mtu_info = ntohl(info);
- if (!sock_owned_by_user(sk))
- tcp_v6_mtu_reduced(sk);
-diff --git a/net/sctp/associola.c b/net/sctp/associola.c
-index b45ed1f..67c6823 100644
---- a/net/sctp/associola.c
-+++ b/net/sctp/associola.c
-@@ -1080,7 +1080,7 @@ struct sctp_transport *sctp_assoc_lookup_tsn(struct sctp_association *asoc,
- transports) {
-
- if (transport == active)
-- break;
-+ continue;
- list_for_each_entry(chunk, &transport->transmitted,
- transmitted_list) {
- if (key == chunk->subh.data_hdr->tsn) {
-diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
-index 5131fcf..de1a013 100644
---- a/net/sctp/sm_statefuns.c
-+++ b/net/sctp/sm_statefuns.c
-@@ -2082,7 +2082,7 @@ sctp_disposition_t sctp_sf_do_5_2_4_dupcook(struct net *net,
- }
-
- /* Delete the tempory new association. */
-- sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(new_asoc));
-+ sctp_add_cmd_sf(commands, SCTP_CMD_SET_ASOC, SCTP_ASOC(new_asoc));
- sctp_add_cmd_sf(commands, SCTP_CMD_DELETE_TCB, SCTP_NULL());
-
- /* Restore association pointer to provide SCTP command interpeter
-diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
-index 713e9af..e46b6a3 100644
---- a/sound/pci/hda/hda_codec.c
-+++ b/sound/pci/hda/hda_codec.c
-@@ -2967,7 +2967,7 @@ static unsigned int convert_to_spdif_status(unsigned short val)
- if (val & AC_DIG1_PROFESSIONAL)
- sbits |= IEC958_AES0_PROFESSIONAL;
- if (sbits & IEC958_AES0_PROFESSIONAL) {
-- if (sbits & AC_DIG1_EMPHASIS)
-+ if (val & AC_DIG1_EMPHASIS)
- sbits |= IEC958_AES0_PRO_EMPHASIS_5015;
- } else {
- if (val & AC_DIG1_EMPHASIS)
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index 009b77a..09fae16 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -1175,7 +1175,7 @@ static int patch_cxt5045(struct hda_codec *codec)
- }
-
- if (spec->beep_amp)
-- snd_hda_attach_beep_device(codec, spec->beep_amp);
-+ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
-
- return 0;
- }
-@@ -1954,7 +1954,7 @@ static int patch_cxt5051(struct hda_codec *codec)
- }
-
- if (spec->beep_amp)
-- snd_hda_attach_beep_device(codec, spec->beep_amp);
-+ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
-
- return 0;
- }
-@@ -3136,7 +3136,7 @@ static int patch_cxt5066(struct hda_codec *codec)
- }
-
- if (spec->beep_amp)
-- snd_hda_attach_beep_device(codec, spec->beep_amp);
-+ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
-
- return 0;
- }
-@@ -4576,7 +4576,7 @@ static int patch_conexant_auto(struct hda_codec *codec)
- spec->capture_stream = &cx_auto_pcm_analog_capture;
- codec->patch_ops = cx_auto_patch_ops;
- if (spec->beep_amp)
-- snd_hda_attach_beep_device(codec, spec->beep_amp);
-+ snd_hda_attach_beep_device(codec, get_amp_nid_(spec->beep_amp));
-
- /* Some laptops with Conexant chips show stalls in S3 resume,
- * which falls into the single-cmd mode.
-diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
-index e90daf8..64a564d 100644
---- a/sound/usb/mixer.c
-+++ b/sound/usb/mixer.c
-@@ -715,8 +715,9 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
- case UAC2_CLOCK_SELECTOR: {
- struct uac_selector_unit_descriptor *d = p1;
- /* call recursively to retrieve the channel info */
-- if (check_input_term(state, d->baSourceID[0], term) < 0)
-- return -ENODEV;
-+ err = check_input_term(state, d->baSourceID[0], term);
-+ if (err < 0)
-+ return err;
- term->type = d->bDescriptorSubtype << 16; /* virtual type */
- term->id = id;
- term->name = uac_selector_unit_iSelector(d);
-@@ -725,7 +726,8 @@ static int check_input_term(struct mixer_build *state, int id, struct usb_audio_
- case UAC1_PROCESSING_UNIT:
- case UAC1_EXTENSION_UNIT:
- /* UAC2_PROCESSING_UNIT_V2 */
-- /* UAC2_EFFECT_UNIT */ {
-+ /* UAC2_EFFECT_UNIT */
-+ case UAC2_EXTENSION_UNIT_V2: {
- struct uac_processing_unit_descriptor *d = p1;
-
- if (state->mixer->protocol == UAC_VERSION_2 &&
-@@ -1355,8 +1357,9 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, void
- return err;
-
- /* determine the input source type and name */
-- if (check_input_term(state, hdr->bSourceID, &iterm) < 0)
-- return -EINVAL;
-+ err = check_input_term(state, hdr->bSourceID, &iterm);
-+ if (err < 0)
-+ return err;
-
- master_bits = snd_usb_combine_bytes(bmaControls, csize);
- /* master configuration quirks */
-@@ -2051,6 +2054,8 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
- return parse_audio_extension_unit(state, unitid, p1);
- else /* UAC_VERSION_2 */
- return parse_audio_processing_unit(state, unitid, p1);
-+ case UAC2_EXTENSION_UNIT_V2:
-+ return parse_audio_extension_unit(state, unitid, p1);
- default:
- snd_printk(KERN_ERR "usbaudio: unit %u: unexpected type 0x%02x\n", unitid, p1[2]);
- return -EINVAL;
-@@ -2117,7 +2122,7 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
- state.oterm.type = le16_to_cpu(desc->wTerminalType);
- state.oterm.name = desc->iTerminal;
- err = parse_audio_unit(&state, desc->bSourceID);
-- if (err < 0)
-+ if (err < 0 && err != -EINVAL)
- return err;
- } else { /* UAC_VERSION_2 */
- struct uac2_output_terminal_descriptor *desc = p;
-@@ -2129,12 +2134,12 @@ static int snd_usb_mixer_controls(struct usb_mixer_interface *mixer)
- state.oterm.type = le16_to_cpu(desc->wTerminalType);
- state.oterm.name = desc->iTerminal;
- err = parse_audio_unit(&state, desc->bSourceID);
-- if (err < 0)
-+ if (err < 0 && err != -EINVAL)
- return err;
-
- /* for UAC2, use the same approach to also add the clock selectors */
- err = parse_audio_unit(&state, desc->bCSourceID);
-- if (err < 0)
-+ if (err < 0 && err != -EINVAL)
- return err;
- }
- }
diff --git a/3.8.6/1005_linux-3.8.6.patch b/3.8.6/1005_linux-3.8.6.patch
deleted file mode 100644
index 94a07ae..0000000
--- a/3.8.6/1005_linux-3.8.6.patch
+++ /dev/null
@@ -1,5592 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 14b38cf..10075d6 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 8
--SUBLEVEL = 5
-+SUBLEVEL = 6
- EXTRAVERSION =
- NAME = Displaced Humerus Anterior
-
-diff --git a/arch/arm/boot/dts/kirkwood-goflexnet.dts b/arch/arm/boot/dts/kirkwood-goflexnet.dts
-index bd83b8f..c3573be 100644
---- a/arch/arm/boot/dts/kirkwood-goflexnet.dts
-+++ b/arch/arm/boot/dts/kirkwood-goflexnet.dts
-@@ -77,6 +77,7 @@
- };
-
- nand@3000000 {
-+ chip-delay = <40>;
- status = "okay";
-
- partition@0 {
-diff --git a/arch/arm/include/asm/signal.h b/arch/arm/include/asm/signal.h
-index 9a0ea6a..7f79136 100644
---- a/arch/arm/include/asm/signal.h
-+++ b/arch/arm/include/asm/signal.h
-@@ -29,6 +29,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
-index 031805b..7f26faf 100644
---- a/arch/arm/mach-cns3xxx/core.c
-+++ b/arch/arm/mach-cns3xxx/core.c
-@@ -22,19 +22,9 @@
-
- static struct map_desc cns3xxx_io_desc[] __initdata = {
- {
-- .virtual = CNS3XXX_TC11MP_TWD_BASE_VIRT,
-- .pfn = __phys_to_pfn(CNS3XXX_TC11MP_TWD_BASE),
-- .length = SZ_4K,
-- .type = MT_DEVICE,
-- }, {
-- .virtual = CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT,
-- .pfn = __phys_to_pfn(CNS3XXX_TC11MP_GIC_CPU_BASE),
-- .length = SZ_4K,
-- .type = MT_DEVICE,
-- }, {
-- .virtual = CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT,
-- .pfn = __phys_to_pfn(CNS3XXX_TC11MP_GIC_DIST_BASE),
-- .length = SZ_4K,
-+ .virtual = CNS3XXX_TC11MP_SCU_BASE_VIRT,
-+ .pfn = __phys_to_pfn(CNS3XXX_TC11MP_SCU_BASE),
-+ .length = SZ_8K,
- .type = MT_DEVICE,
- }, {
- .virtual = CNS3XXX_TIMER1_2_3_BASE_VIRT,
-diff --git a/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h b/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
-index 191c8e5..b1021aa 100644
---- a/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
-+++ b/arch/arm/mach-cns3xxx/include/mach/cns3xxx.h
-@@ -94,10 +94,10 @@
- #define RTC_INTR_STS_OFFSET 0x34
-
- #define CNS3XXX_MISC_BASE 0x76000000 /* Misc Control */
--#define CNS3XXX_MISC_BASE_VIRT 0xFFF07000 /* Misc Control */
-+#define CNS3XXX_MISC_BASE_VIRT 0xFB000000 /* Misc Control */
-
- #define CNS3XXX_PM_BASE 0x77000000 /* Power Management Control */
--#define CNS3XXX_PM_BASE_VIRT 0xFFF08000
-+#define CNS3XXX_PM_BASE_VIRT 0xFB001000
-
- #define PM_CLK_GATE_OFFSET 0x00
- #define PM_SOFT_RST_OFFSET 0x04
-@@ -109,7 +109,7 @@
- #define PM_PLL_HM_PD_OFFSET 0x1C
-
- #define CNS3XXX_UART0_BASE 0x78000000 /* UART 0 */
--#define CNS3XXX_UART0_BASE_VIRT 0xFFF09000
-+#define CNS3XXX_UART0_BASE_VIRT 0xFB002000
-
- #define CNS3XXX_UART1_BASE 0x78400000 /* UART 1 */
- #define CNS3XXX_UART1_BASE_VIRT 0xFFF0A000
-@@ -130,7 +130,7 @@
- #define CNS3XXX_I2S_BASE_VIRT 0xFFF10000
-
- #define CNS3XXX_TIMER1_2_3_BASE 0x7C800000 /* Timer */
--#define CNS3XXX_TIMER1_2_3_BASE_VIRT 0xFFF10800
-+#define CNS3XXX_TIMER1_2_3_BASE_VIRT 0xFB003000
-
- #define TIMER1_COUNTER_OFFSET 0x00
- #define TIMER1_AUTO_RELOAD_OFFSET 0x04
-@@ -227,16 +227,16 @@
- * Testchip peripheral and fpga gic regions
- */
- #define CNS3XXX_TC11MP_SCU_BASE 0x90000000 /* IRQ, Test chip */
--#define CNS3XXX_TC11MP_SCU_BASE_VIRT 0xFF000000
-+#define CNS3XXX_TC11MP_SCU_BASE_VIRT 0xFB004000
-
- #define CNS3XXX_TC11MP_GIC_CPU_BASE 0x90000100 /* Test chip interrupt controller CPU interface */
--#define CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT 0xFF000100
-+#define CNS3XXX_TC11MP_GIC_CPU_BASE_VIRT (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x100)
-
- #define CNS3XXX_TC11MP_TWD_BASE 0x90000600
--#define CNS3XXX_TC11MP_TWD_BASE_VIRT 0xFF000600
-+#define CNS3XXX_TC11MP_TWD_BASE_VIRT (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x600)
-
- #define CNS3XXX_TC11MP_GIC_DIST_BASE 0x90001000 /* Test chip interrupt controller distributor */
--#define CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT 0xFF001000
-+#define CNS3XXX_TC11MP_GIC_DIST_BASE_VIRT (CNS3XXX_TC11MP_SCU_BASE_VIRT + 0x1000)
-
- #define CNS3XXX_TC11MP_L220_BASE 0x92002000 /* L220 registers */
- #define CNS3XXX_TC11MP_L220_BASE_VIRT 0xFF002000
-diff --git a/arch/arm/mach-imx/common.h b/arch/arm/mach-imx/common.h
-index fa36fb8..122da24 100644
---- a/arch/arm/mach-imx/common.h
-+++ b/arch/arm/mach-imx/common.h
-@@ -116,6 +116,8 @@ void tzic_handle_irq(struct pt_regs *);
-
- extern void imx_enable_cpu(int cpu, bool enable);
- extern void imx_set_cpu_jump(int cpu, void *jump_addr);
-+extern u32 imx_get_cpu_arg(int cpu);
-+extern void imx_set_cpu_arg(int cpu, u32 arg);
- #ifdef CONFIG_DEBUG_LL
- extern void imx_lluart_map_io(void);
- #else
-diff --git a/arch/arm/mach-imx/hotplug.c b/arch/arm/mach-imx/hotplug.c
-index 7bc5fe1..361a253 100644
---- a/arch/arm/mach-imx/hotplug.c
-+++ b/arch/arm/mach-imx/hotplug.c
-@@ -46,11 +46,23 @@ static inline void cpu_enter_lowpower(void)
- void imx_cpu_die(unsigned int cpu)
- {
- cpu_enter_lowpower();
-+ /*
-+ * We use the cpu jumping argument register to sync with
-+ * imx_cpu_kill() which is running on cpu0 and waiting for
-+ * the register being cleared to kill the cpu.
-+ */
-+ imx_set_cpu_arg(cpu, ~0);
- cpu_do_idle();
- }
-
- int imx_cpu_kill(unsigned int cpu)
- {
-+ unsigned long timeout = jiffies + msecs_to_jiffies(50);
-+
-+ while (imx_get_cpu_arg(cpu) == 0)
-+ if (time_after(jiffies, timeout))
-+ return 0;
- imx_enable_cpu(cpu, false);
-+ imx_set_cpu_arg(cpu, 0);
- return 1;
- }
-diff --git a/arch/arm/mach-imx/src.c b/arch/arm/mach-imx/src.c
-index e15f155..09a742f 100644
---- a/arch/arm/mach-imx/src.c
-+++ b/arch/arm/mach-imx/src.c
-@@ -43,6 +43,18 @@ void imx_set_cpu_jump(int cpu, void *jump_addr)
- src_base + SRC_GPR1 + cpu * 8);
- }
-
-+u32 imx_get_cpu_arg(int cpu)
-+{
-+ cpu = cpu_logical_map(cpu);
-+ return readl_relaxed(src_base + SRC_GPR1 + cpu * 8 + 4);
-+}
-+
-+void imx_set_cpu_arg(int cpu, u32 arg)
-+{
-+ cpu = cpu_logical_map(cpu);
-+ writel_relaxed(arg, src_base + SRC_GPR1 + cpu * 8 + 4);
-+}
-+
- void imx_src_prepare_restart(void)
- {
- u32 val;
-diff --git a/arch/arm/mach-omap2/common.h b/arch/arm/mach-omap2/common.h
-index 948bcaa..b9adf69 100644
---- a/arch/arm/mach-omap2/common.h
-+++ b/arch/arm/mach-omap2/common.h
-@@ -286,5 +286,8 @@ extern void omap_reserve(void);
- struct omap_hwmod;
- extern int omap_dss_reset(struct omap_hwmod *);
-
-+/* SoC specific clock initializer */
-+extern int (*omap_clk_init)(void);
-+
- #endif /* __ASSEMBLER__ */
- #endif /* __ARCH_ARM_MACH_OMAP2PLUS_COMMON_H */
-diff --git a/arch/arm/mach-omap2/io.c b/arch/arm/mach-omap2/io.c
-index 2c3fdd6..5c445ca 100644
---- a/arch/arm/mach-omap2/io.c
-+++ b/arch/arm/mach-omap2/io.c
-@@ -55,6 +55,12 @@
- #include "prm44xx.h"
-
- /*
-+ * omap_clk_init: points to a function that does the SoC-specific
-+ * clock initializations
-+ */
-+int (*omap_clk_init)(void);
-+
-+/*
- * The machine specific code may provide the extra mapping besides the
- * default mapping provided here.
- */
-@@ -397,7 +403,7 @@ void __init omap2420_init_early(void)
- omap242x_clockdomains_init();
- omap2420_hwmod_init();
- omap_hwmod_init_postsetup();
-- omap2420_clk_init();
-+ omap_clk_init = omap2420_clk_init;
- }
-
- void __init omap2420_init_late(void)
-@@ -427,7 +433,7 @@ void __init omap2430_init_early(void)
- omap243x_clockdomains_init();
- omap2430_hwmod_init();
- omap_hwmod_init_postsetup();
-- omap2430_clk_init();
-+ omap_clk_init = omap2430_clk_init;
- }
-
- void __init omap2430_init_late(void)
-@@ -462,7 +468,7 @@ void __init omap3_init_early(void)
- omap3xxx_clockdomains_init();
- omap3xxx_hwmod_init();
- omap_hwmod_init_postsetup();
-- omap3xxx_clk_init();
-+ omap_clk_init = omap3xxx_clk_init;
- }
-
- void __init omap3430_init_early(void)
-@@ -500,7 +506,7 @@ void __init ti81xx_init_early(void)
- omap3xxx_clockdomains_init();
- omap3xxx_hwmod_init();
- omap_hwmod_init_postsetup();
-- omap3xxx_clk_init();
-+ omap_clk_init = omap3xxx_clk_init;
- }
-
- void __init omap3_init_late(void)
-@@ -568,7 +574,7 @@ void __init am33xx_init_early(void)
- am33xx_clockdomains_init();
- am33xx_hwmod_init();
- omap_hwmod_init_postsetup();
-- am33xx_clk_init();
-+ omap_clk_init = am33xx_clk_init;
- }
- #endif
-
-@@ -593,7 +599,7 @@ void __init omap4430_init_early(void)
- omap44xx_clockdomains_init();
- omap44xx_hwmod_init();
- omap_hwmod_init_postsetup();
-- omap4xxx_clk_init();
-+ omap_clk_init = omap4xxx_clk_init;
- }
-
- void __init omap4430_init_late(void)
-diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
-index b8ad6e6..559c87b 100644
---- a/arch/arm/mach-omap2/timer.c
-+++ b/arch/arm/mach-omap2/timer.c
-@@ -554,6 +554,8 @@ static inline void __init realtime_counter_init(void)
- clksrc_nr, clksrc_src) \
- static void __init omap##name##_gptimer_timer_init(void) \
- { \
-+ if (omap_clk_init) \
-+ omap_clk_init(); \
- omap_dmtimer_init(); \
- omap2_gp_clockevent_init((clkev_nr), clkev_src, clkev_prop); \
- omap2_gptimer_clocksource_init((clksrc_nr), clksrc_src); \
-@@ -563,6 +565,8 @@ static void __init omap##name##_gptimer_timer_init(void) \
- clksrc_nr, clksrc_src) \
- static void __init omap##name##_sync32k_timer_init(void) \
- { \
-+ if (omap_clk_init) \
-+ omap_clk_init(); \
- omap_dmtimer_init(); \
- omap2_gp_clockevent_init((clkev_nr), clkev_src, clkev_prop); \
- /* Enable the use of clocksource="gp_timer" kernel parameter */ \
-diff --git a/arch/avr32/include/asm/signal.h b/arch/avr32/include/asm/signal.h
-index 9326d18..b65e61a 100644
---- a/arch/avr32/include/asm/signal.h
-+++ b/arch/avr32/include/asm/signal.h
-@@ -29,6 +29,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/cris/include/asm/signal.h b/arch/cris/include/asm/signal.h
-index c0cb1fd..a7e267c 100644
---- a/arch/cris/include/asm/signal.h
-+++ b/arch/cris/include/asm/signal.h
-@@ -29,6 +29,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/h8300/include/asm/signal.h b/arch/h8300/include/asm/signal.h
-index 66c81c6..4bf76ac 100644
---- a/arch/h8300/include/asm/signal.h
-+++ b/arch/h8300/include/asm/signal.h
-@@ -29,6 +29,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/m32r/include/asm/signal.h b/arch/m32r/include/asm/signal.h
-index a5ba4a2..04ccbcd 100644
---- a/arch/m32r/include/asm/signal.h
-+++ b/arch/m32r/include/asm/signal.h
-@@ -22,6 +22,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/m68k/include/asm/signal.h b/arch/m68k/include/asm/signal.h
-index 9c8c46b..60370da 100644
---- a/arch/m68k/include/asm/signal.h
-+++ b/arch/m68k/include/asm/signal.h
-@@ -29,6 +29,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/mn10300/include/asm/signal.h b/arch/mn10300/include/asm/signal.h
-index d280e97..d673860 100644
---- a/arch/mn10300/include/asm/signal.h
-+++ b/arch/mn10300/include/asm/signal.h
-@@ -39,6 +39,7 @@ struct sigaction {
- __sigrestore_t sa_restorer;
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/powerpc/include/asm/signal.h b/arch/powerpc/include/asm/signal.h
-index a101637..fbe66c4 100644
---- a/arch/powerpc/include/asm/signal.h
-+++ b/arch/powerpc/include/asm/signal.h
-@@ -1,6 +1,7 @@
- #ifndef _ASM_POWERPC_SIGNAL_H
- #define _ASM_POWERPC_SIGNAL_H
-
-+#define __ARCH_HAS_SA_RESTORER
- #include <uapi/asm/signal.h>
-
- #endif /* _ASM_POWERPC_SIGNAL_H */
-diff --git a/arch/s390/include/asm/signal.h b/arch/s390/include/asm/signal.h
-index db7ddfa..639f569 100644
---- a/arch/s390/include/asm/signal.h
-+++ b/arch/s390/include/asm/signal.h
-@@ -34,6 +34,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/arch/sparc/include/asm/signal.h b/arch/sparc/include/asm/signal.h
-index 77b8585..2f0df05 100644
---- a/arch/sparc/include/asm/signal.h
-+++ b/arch/sparc/include/asm/signal.h
-@@ -26,5 +26,7 @@ struct k_sigaction {
- void __user *ka_restorer;
- };
-
-+#define __ARCH_HAS_SA_RESTORER
-+
- #endif /* !(__ASSEMBLY__) */
- #endif /* !(__SPARC_SIGNAL_H) */
-diff --git a/arch/tile/kernel/setup.c b/arch/tile/kernel/setup.c
-index d1e15f7..7a5aa1a 100644
---- a/arch/tile/kernel/setup.c
-+++ b/arch/tile/kernel/setup.c
-@@ -1004,15 +1004,8 @@ void __cpuinit setup_cpu(int boot)
-
- #ifdef CONFIG_BLK_DEV_INITRD
-
--/*
-- * Note that the kernel can potentially support other compression
-- * techniques than gz, though we don't do so by default. If we ever
-- * decide to do so we can either look for other filename extensions,
-- * or just allow a file with this name to be compressed with an
-- * arbitrary compressor (somewhat counterintuitively).
-- */
- static int __initdata set_initramfs_file;
--static char __initdata initramfs_file[128] = "initramfs.cpio.gz";
-+static char __initdata initramfs_file[128] = "initramfs";
-
- static int __init setup_initramfs_file(char *str)
- {
-@@ -1026,9 +1019,9 @@ static int __init setup_initramfs_file(char *str)
- early_param("initramfs_file", setup_initramfs_file);
-
- /*
-- * We look for an "initramfs.cpio.gz" file in the hvfs.
-- * If there is one, we allocate some memory for it and it will be
-- * unpacked to the initramfs.
-+ * We look for a file called "initramfs" in the hvfs. If there is one, we
-+ * allocate some memory for it and it will be unpacked to the initramfs.
-+ * If it's compressed, the initd code will uncompress it first.
- */
- static void __init load_hv_initrd(void)
- {
-@@ -1038,10 +1031,16 @@ static void __init load_hv_initrd(void)
-
- fd = hv_fs_findfile((HV_VirtAddr) initramfs_file);
- if (fd == HV_ENOENT) {
-- if (set_initramfs_file)
-+ if (set_initramfs_file) {
- pr_warning("No such hvfs initramfs file '%s'\n",
- initramfs_file);
-- return;
-+ return;
-+ } else {
-+ /* Try old backwards-compatible name. */
-+ fd = hv_fs_findfile((HV_VirtAddr)"initramfs.cpio.gz");
-+ if (fd == HV_ENOENT)
-+ return;
-+ }
- }
- BUG_ON(fd < 0);
- stat = hv_fs_fstat(fd);
-diff --git a/arch/x86/include/asm/signal.h b/arch/x86/include/asm/signal.h
-index 216bf36..111d272 100644
---- a/arch/x86/include/asm/signal.h
-+++ b/arch/x86/include/asm/signal.h
-@@ -31,6 +31,9 @@ typedef sigset_t compat_sigset_t;
- #include <uapi/asm/signal.h>
- #ifndef __ASSEMBLY__
- extern void do_notify_resume(struct pt_regs *, void *, __u32);
-+
-+#define __ARCH_HAS_SA_RESTORER
-+
- #ifdef __i386__
- struct old_sigaction {
- __sighandler_t sa_handler;
-diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h
-index c20d1ce..e709884 100644
---- a/arch/x86/include/asm/xen/hypercall.h
-+++ b/arch/x86/include/asm/xen/hypercall.h
-@@ -382,14 +382,14 @@ HYPERVISOR_console_io(int cmd, int count, char *str)
- return _hypercall3(int, console_io, cmd, count, str);
- }
-
--extern int __must_check HYPERVISOR_physdev_op_compat(int, void *);
-+extern int __must_check xen_physdev_op_compat(int, void *);
-
- static inline int
- HYPERVISOR_physdev_op(int cmd, void *arg)
- {
- int rc = _hypercall2(int, physdev_op, cmd, arg);
- if (unlikely(rc == -ENOSYS))
-- rc = HYPERVISOR_physdev_op_compat(cmd, arg);
-+ rc = xen_physdev_op_compat(cmd, arg);
- return rc;
- }
-
-diff --git a/arch/xtensa/include/asm/signal.h b/arch/xtensa/include/asm/signal.h
-index 6f586bd..83e23f4 100644
---- a/arch/xtensa/include/asm/signal.h
-+++ b/arch/xtensa/include/asm/signal.h
-@@ -21,6 +21,7 @@ struct sigaction {
- void (*sa_restorer)(void);
- sigset_t sa_mask; /* mask last for extensibility */
- };
-+#define __ARCH_HAS_SA_RESTORER
-
- struct k_sigaction {
- struct sigaction sa;
-diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
-index 25ef5c0..92b6d7c 100644
---- a/drivers/block/aoe/aoecmd.c
-+++ b/drivers/block/aoe/aoecmd.c
-@@ -51,8 +51,9 @@ new_skb(ulong len)
- {
- struct sk_buff *skb;
-
-- skb = alloc_skb(len, GFP_ATOMIC);
-+ skb = alloc_skb(len + MAX_HEADER, GFP_ATOMIC);
- if (skb) {
-+ skb_reserve(skb, MAX_HEADER);
- skb_reset_mac_header(skb);
- skb_reset_network_header(skb);
- skb->protocol = __constant_htons(ETH_P_AOE);
-diff --git a/drivers/block/loop.c b/drivers/block/loop.c
-index 8bc6d39..f74f2c0 100644
---- a/drivers/block/loop.c
-+++ b/drivers/block/loop.c
-@@ -917,6 +917,11 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode,
- lo->lo_flags |= LO_FLAGS_PARTSCAN;
- if (lo->lo_flags & LO_FLAGS_PARTSCAN)
- ioctl_by_bdev(bdev, BLKRRPART, 0);
-+
-+ /* Grab the block_device to prevent its destruction after we
-+ * put /dev/loopXX inode. Later in loop_clr_fd() we bdput(bdev).
-+ */
-+ bdgrab(bdev);
- return 0;
-
- out_clr:
-@@ -1026,8 +1031,10 @@ static int loop_clr_fd(struct loop_device *lo)
- memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
- memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
- memset(lo->lo_file_name, 0, LO_NAME_SIZE);
-- if (bdev)
-+ if (bdev) {
-+ bdput(bdev);
- invalidate_bdev(bdev);
-+ }
- set_capacity(lo->lo_disk, 0);
- loop_sysfs_exit(lo);
- if (bdev) {
-diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
-index e34a7b4..ef6d9be 100644
---- a/drivers/block/xen-blkback/blkback.c
-+++ b/drivers/block/xen-blkback/blkback.c
-@@ -679,6 +679,16 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
- return err;
- }
-
-+static int dispatch_other_io(struct xen_blkif *blkif,
-+ struct blkif_request *req,
-+ struct pending_req *pending_req)
-+{
-+ free_req(pending_req);
-+ make_response(blkif, req->u.other.id, req->operation,
-+ BLKIF_RSP_EOPNOTSUPP);
-+ return -EIO;
-+}
-+
- static void xen_blk_drain_io(struct xen_blkif *blkif)
- {
- atomic_set(&blkif->drain, 1);
-@@ -800,17 +810,30 @@ __do_block_io_op(struct xen_blkif *blkif)
-
- /* Apply all sanity checks to /private copy/ of request. */
- barrier();
-- if (unlikely(req.operation == BLKIF_OP_DISCARD)) {
-+
-+ switch (req.operation) {
-+ case BLKIF_OP_READ:
-+ case BLKIF_OP_WRITE:
-+ case BLKIF_OP_WRITE_BARRIER:
-+ case BLKIF_OP_FLUSH_DISKCACHE:
-+ if (dispatch_rw_block_io(blkif, &req, pending_req))
-+ goto done;
-+ break;
-+ case BLKIF_OP_DISCARD:
- free_req(pending_req);
- if (dispatch_discard_io(blkif, &req))
-- break;
-- } else if (dispatch_rw_block_io(blkif, &req, pending_req))
-+ goto done;
- break;
-+ default:
-+ if (dispatch_other_io(blkif, &req, pending_req))
-+ goto done;
-+ break;
-+ }
-
- /* Yield point for this unbounded loop. */
- cond_resched();
- }
--
-+done:
- return more_to_do;
- }
-
-@@ -978,13 +1001,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
- bio->bi_end_io = end_block_io_op;
- }
-
-- /*
-- * We set it one so that the last submit_bio does not have to call
-- * atomic_inc.
-- */
- atomic_set(&pending_req->pendcnt, nbio);
--
-- /* Get a reference count for the disk queue and start sending I/O */
- blk_start_plug(&plug);
-
- for (i = 0; i < nbio; i++)
-@@ -1012,6 +1029,7 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
- fail_put_bio:
- for (i = 0; i < nbio; i++)
- bio_put(biolist[i]);
-+ atomic_set(&pending_req->pendcnt, 1);
- __end_block_io_op(pending_req, -EINVAL);
- msleep(1); /* back off a bit */
- return -EIO;
-diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h
-index 6072390..195278a 100644
---- a/drivers/block/xen-blkback/common.h
-+++ b/drivers/block/xen-blkback/common.h
-@@ -77,11 +77,18 @@ struct blkif_x86_32_request_discard {
- uint64_t nr_sectors;
- } __attribute__((__packed__));
-
-+struct blkif_x86_32_request_other {
-+ uint8_t _pad1;
-+ blkif_vdev_t _pad2;
-+ uint64_t id; /* private guest value, echoed in resp */
-+} __attribute__((__packed__));
-+
- struct blkif_x86_32_request {
- uint8_t operation; /* BLKIF_OP_??? */
- union {
- struct blkif_x86_32_request_rw rw;
- struct blkif_x86_32_request_discard discard;
-+ struct blkif_x86_32_request_other other;
- } u;
- } __attribute__((__packed__));
-
-@@ -113,11 +120,19 @@ struct blkif_x86_64_request_discard {
- uint64_t nr_sectors;
- } __attribute__((__packed__));
-
-+struct blkif_x86_64_request_other {
-+ uint8_t _pad1;
-+ blkif_vdev_t _pad2;
-+ uint32_t _pad3; /* offsetof(blkif_..,u.discard.id)==8 */
-+ uint64_t id; /* private guest value, echoed in resp */
-+} __attribute__((__packed__));
-+
- struct blkif_x86_64_request {
- uint8_t operation; /* BLKIF_OP_??? */
- union {
- struct blkif_x86_64_request_rw rw;
- struct blkif_x86_64_request_discard discard;
-+ struct blkif_x86_64_request_other other;
- } u;
- } __attribute__((__packed__));
-
-@@ -278,6 +293,11 @@ static inline void blkif_get_x86_32_req(struct blkif_request *dst,
- dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
- break;
- default:
-+ /*
-+ * Don't know how to translate this op. Only get the
-+ * ID so failure can be reported to the frontend.
-+ */
-+ dst->u.other.id = src->u.other.id;
- break;
- }
- }
-@@ -309,6 +329,11 @@ static inline void blkif_get_x86_64_req(struct blkif_request *dst,
- dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
- break;
- default:
-+ /*
-+ * Don't know how to translate this op. Only get the
-+ * ID so failure can be reported to the frontend.
-+ */
-+ dst->u.other.id = src->u.other.id;
- break;
- }
- }
-diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
-index c3dae2e..2e39eaf 100644
---- a/drivers/block/xen-blkfront.c
-+++ b/drivers/block/xen-blkfront.c
-@@ -44,7 +44,7 @@
- #include <linux/mutex.h>
- #include <linux/scatterlist.h>
- #include <linux/bitmap.h>
--#include <linux/llist.h>
-+#include <linux/list.h>
-
- #include <xen/xen.h>
- #include <xen/xenbus.h>
-@@ -68,7 +68,7 @@ enum blkif_state {
- struct grant {
- grant_ref_t gref;
- unsigned long pfn;
-- struct llist_node node;
-+ struct list_head node;
- };
-
- struct blk_shadow {
-@@ -105,7 +105,7 @@ struct blkfront_info
- struct work_struct work;
- struct gnttab_free_callback callback;
- struct blk_shadow shadow[BLK_RING_SIZE];
-- struct llist_head persistent_gnts;
-+ struct list_head persistent_gnts;
- unsigned int persistent_gnts_c;
- unsigned long shadow_free;
- unsigned int feature_flush;
-@@ -371,10 +371,11 @@ static int blkif_queue_request(struct request *req)
- lsect = fsect + (sg->length >> 9) - 1;
-
- if (info->persistent_gnts_c) {
-- BUG_ON(llist_empty(&info->persistent_gnts));
-- gnt_list_entry = llist_entry(
-- llist_del_first(&info->persistent_gnts),
-- struct grant, node);
-+ BUG_ON(list_empty(&info->persistent_gnts));
-+ gnt_list_entry = list_first_entry(
-+ &info->persistent_gnts,
-+ struct grant, node);
-+ list_del(&gnt_list_entry->node);
-
- ref = gnt_list_entry->gref;
- buffer_mfn = pfn_to_mfn(gnt_list_entry->pfn);
-@@ -790,9 +791,8 @@ static void blkif_restart_queue(struct work_struct *work)
-
- static void blkif_free(struct blkfront_info *info, int suspend)
- {
-- struct llist_node *all_gnts;
-- struct grant *persistent_gnt, *tmp;
-- struct llist_node *n;
-+ struct grant *persistent_gnt;
-+ struct grant *n;
-
- /* Prevent new requests being issued until we fix things up. */
- spin_lock_irq(&info->io_lock);
-@@ -804,20 +804,15 @@ static void blkif_free(struct blkfront_info *info, int suspend)
-
- /* Remove all persistent grants */
- if (info->persistent_gnts_c) {
-- all_gnts = llist_del_all(&info->persistent_gnts);
-- persistent_gnt = llist_entry(all_gnts, typeof(*(persistent_gnt)), node);
-- while (persistent_gnt) {
-+ list_for_each_entry_safe(persistent_gnt, n,
-+ &info->persistent_gnts, node) {
-+ list_del(&persistent_gnt->node);
- gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
- __free_page(pfn_to_page(persistent_gnt->pfn));
-- tmp = persistent_gnt;
-- n = persistent_gnt->node.next;
-- if (n)
-- persistent_gnt = llist_entry(n, typeof(*(persistent_gnt)), node);
-- else
-- persistent_gnt = NULL;
-- kfree(tmp);
-+ kfree(persistent_gnt);
-+ info->persistent_gnts_c--;
- }
-- info->persistent_gnts_c = 0;
-+ BUG_ON(info->persistent_gnts_c != 0);
- }
-
- /* No more gnttab callback work. */
-@@ -875,7 +870,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
- }
- /* Add the persistent grant into the list of free grants */
- for (i = 0; i < s->req.u.rw.nr_segments; i++) {
-- llist_add(&s->grants_used[i]->node, &info->persistent_gnts);
-+ list_add(&s->grants_used[i]->node, &info->persistent_gnts);
- info->persistent_gnts_c++;
- }
- }
-@@ -1171,7 +1166,7 @@ static int blkfront_probe(struct xenbus_device *dev,
- spin_lock_init(&info->io_lock);
- info->xbdev = dev;
- info->vdevice = vdevice;
-- init_llist_head(&info->persistent_gnts);
-+ INIT_LIST_HEAD(&info->persistent_gnts);
- info->persistent_gnts_c = 0;
- info->connected = BLKIF_STATE_DISCONNECTED;
- INIT_WORK(&info->work, blkif_restart_queue);
-diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
-index 33c9a44..1c0929b 100644
---- a/drivers/bluetooth/ath3k.c
-+++ b/drivers/bluetooth/ath3k.c
-@@ -73,8 +73,10 @@ static struct usb_device_id ath3k_table[] = {
- { USB_DEVICE(0x03F0, 0x311D) },
-
- /* Atheros AR3012 with sflash firmware*/
-+ { USB_DEVICE(0x0CF3, 0x0036) },
- { USB_DEVICE(0x0CF3, 0x3004) },
- { USB_DEVICE(0x0CF3, 0x311D) },
-+ { USB_DEVICE(0x0CF3, 0x817a) },
- { USB_DEVICE(0x13d3, 0x3375) },
- { USB_DEVICE(0x04CA, 0x3005) },
- { USB_DEVICE(0x04CA, 0x3006) },
-@@ -105,8 +107,10 @@ MODULE_DEVICE_TABLE(usb, ath3k_table);
- static struct usb_device_id ath3k_blist_tbl[] = {
-
- /* Atheros AR3012 with sflash firmware*/
-+ { USB_DEVICE(0x0CF3, 0x0036), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
-+ { USB_DEVICE(0x0CF3, 0x817a), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
-diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
-index 7e351e3..568e703 100644
---- a/drivers/bluetooth/btusb.c
-+++ b/drivers/bluetooth/btusb.c
-@@ -131,8 +131,10 @@ static struct usb_device_id blacklist_table[] = {
- { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
-
- /* Atheros 3012 with sflash firmware */
-+ { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
-+ { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
- { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index ee4dbea..a4b7aa0 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -152,7 +152,8 @@ struct ports_device {
- spinlock_t ports_lock;
-
- /* To protect the vq operations for the control channel */
-- spinlock_t cvq_lock;
-+ spinlock_t c_ivq_lock;
-+ spinlock_t c_ovq_lock;
-
- /* The current config space is stored here */
- struct virtio_console_config config;
-@@ -575,11 +576,14 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
- vq = portdev->c_ovq;
-
- sg_init_one(sg, &cpkt, sizeof(cpkt));
-+
-+ spin_lock(&portdev->c_ovq_lock);
- if (virtqueue_add_buf(vq, sg, 1, 0, &cpkt, GFP_ATOMIC) == 0) {
- virtqueue_kick(vq);
- while (!virtqueue_get_buf(vq, &len))
- cpu_relax();
- }
-+ spin_unlock(&portdev->c_ovq_lock);
- return 0;
- }
-
-@@ -1715,23 +1719,23 @@ static void control_work_handler(struct work_struct *work)
- portdev = container_of(work, struct ports_device, control_work);
- vq = portdev->c_ivq;
-
-- spin_lock(&portdev->cvq_lock);
-+ spin_lock(&portdev->c_ivq_lock);
- while ((buf = virtqueue_get_buf(vq, &len))) {
-- spin_unlock(&portdev->cvq_lock);
-+ spin_unlock(&portdev->c_ivq_lock);
-
- buf->len = len;
- buf->offset = 0;
-
- handle_control_message(portdev, buf);
-
-- spin_lock(&portdev->cvq_lock);
-+ spin_lock(&portdev->c_ivq_lock);
- if (add_inbuf(portdev->c_ivq, buf) < 0) {
- dev_warn(&portdev->vdev->dev,
- "Error adding buffer to queue\n");
- free_buf(buf, false);
- }
- }
-- spin_unlock(&portdev->cvq_lock);
-+ spin_unlock(&portdev->c_ivq_lock);
- }
-
- static void out_intr(struct virtqueue *vq)
-@@ -1996,10 +2000,12 @@ static int virtcons_probe(struct virtio_device *vdev)
- if (multiport) {
- unsigned int nr_added_bufs;
-
-- spin_lock_init(&portdev->cvq_lock);
-+ spin_lock_init(&portdev->c_ivq_lock);
-+ spin_lock_init(&portdev->c_ovq_lock);
- INIT_WORK(&portdev->control_work, &control_work_handler);
-
-- nr_added_bufs = fill_queue(portdev->c_ivq, &portdev->cvq_lock);
-+ nr_added_bufs = fill_queue(portdev->c_ivq,
-+ &portdev->c_ivq_lock);
- if (!nr_added_bufs) {
- dev_err(&vdev->dev,
- "Error allocating buffers for control queue\n");
-@@ -2150,7 +2156,7 @@ static int virtcons_restore(struct virtio_device *vdev)
- return ret;
-
- if (use_multiport(portdev))
-- fill_queue(portdev->c_ivq, &portdev->cvq_lock);
-+ fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
-
- list_for_each_entry(port, &portdev->ports, list) {
- port->in_vq = portdev->in_vqs[port->id];
-diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
-index b2a0a07..cf268b1 100644
---- a/drivers/crypto/caam/caamalg.c
-+++ b/drivers/crypto/caam/caamalg.c
-@@ -1650,11 +1650,7 @@ struct caam_alg_template {
- };
-
- static struct caam_alg_template driver_algs[] = {
-- /*
-- * single-pass ipsec_esp descriptor
-- * authencesn(*,*) is also registered, although not present
-- * explicitly here.
-- */
-+ /* single-pass ipsec_esp descriptor */
- {
- .name = "authenc(hmac(md5),cbc(aes))",
- .driver_name = "authenc-hmac-md5-cbc-aes-caam",
-@@ -2217,9 +2213,7 @@ static int __init caam_algapi_init(void)
- for (i = 0; i < ARRAY_SIZE(driver_algs); i++) {
- /* TODO: check if h/w supports alg */
- struct caam_crypto_alg *t_alg;
-- bool done = false;
-
--authencesn:
- t_alg = caam_alg_alloc(ctrldev, &driver_algs[i]);
- if (IS_ERR(t_alg)) {
- err = PTR_ERR(t_alg);
-@@ -2233,25 +2227,8 @@ authencesn:
- dev_warn(ctrldev, "%s alg registration failed\n",
- t_alg->crypto_alg.cra_driver_name);
- kfree(t_alg);
-- } else {
-+ } else
- list_add_tail(&t_alg->entry, &priv->alg_list);
-- if (driver_algs[i].type == CRYPTO_ALG_TYPE_AEAD &&
-- !memcmp(driver_algs[i].name, "authenc", 7) &&
-- !done) {
-- char *name;
--
-- name = driver_algs[i].name;
-- memmove(name + 10, name + 7, strlen(name) - 7);
-- memcpy(name + 7, "esn", 3);
--
-- name = driver_algs[i].driver_name;
-- memmove(name + 10, name + 7, strlen(name) - 7);
-- memcpy(name + 7, "esn", 3);
--
-- done = true;
-- goto authencesn;
-- }
-- }
- }
- if (!list_empty(&priv->alg_list))
- dev_info(ctrldev, "%s algorithms registered in /proc/crypto\n",
-diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h
-index cf15e78..762aeff 100644
---- a/drivers/crypto/caam/compat.h
-+++ b/drivers/crypto/caam/compat.h
-@@ -23,7 +23,6 @@
- #include <linux/types.h>
- #include <linux/debugfs.h>
- #include <linux/circ_buf.h>
--#include <linux/string.h>
- #include <net/xfrm.h>
-
- #include <crypto/algapi.h>
-diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
-index 09b184a..5b2b5e6 100644
---- a/drivers/crypto/talitos.c
-+++ b/drivers/crypto/talitos.c
-@@ -38,7 +38,6 @@
- #include <linux/spinlock.h>
- #include <linux/rtnetlink.h>
- #include <linux/slab.h>
--#include <linux/string.h>
-
- #include <crypto/algapi.h>
- #include <crypto/aes.h>
-@@ -1974,11 +1973,7 @@ struct talitos_alg_template {
- };
-
- static struct talitos_alg_template driver_algs[] = {
-- /*
-- * AEAD algorithms. These use a single-pass ipsec_esp descriptor.
-- * authencesn(*,*) is also registered, although not present
-- * explicitly here.
-- */
-+ /* AEAD algorithms. These use a single-pass ipsec_esp descriptor */
- { .type = CRYPTO_ALG_TYPE_AEAD,
- .alg.crypto = {
- .cra_name = "authenc(hmac(sha1),cbc(aes))",
-@@ -2820,9 +2815,7 @@ static int talitos_probe(struct platform_device *ofdev)
- if (hw_supports(dev, driver_algs[i].desc_hdr_template)) {
- struct talitos_crypto_alg *t_alg;
- char *name = NULL;
-- bool authenc = false;
-
--authencesn:
- t_alg = talitos_alg_alloc(dev, &driver_algs[i]);
- if (IS_ERR(t_alg)) {
- err = PTR_ERR(t_alg);
-@@ -2837,8 +2830,6 @@ authencesn:
- err = crypto_register_alg(
- &t_alg->algt.alg.crypto);
- name = t_alg->algt.alg.crypto.cra_driver_name;
-- authenc = authenc ? !authenc :
-- !(bool)memcmp(name, "authenc", 7);
- break;
- case CRYPTO_ALG_TYPE_AHASH:
- err = crypto_register_ahash(
-@@ -2851,25 +2842,8 @@ authencesn:
- dev_err(dev, "%s alg registration failed\n",
- name);
- kfree(t_alg);
-- } else {
-+ } else
- list_add_tail(&t_alg->entry, &priv->alg_list);
-- if (authenc) {
-- struct crypto_alg *alg =
-- &driver_algs[i].alg.crypto;
--
-- name = alg->cra_name;
-- memmove(name + 10, name + 7,
-- strlen(name) - 7);
-- memcpy(name + 7, "esn", 3);
--
-- name = alg->cra_driver_name;
-- memmove(name + 10, name + 7,
-- strlen(name) - 7);
-- memcpy(name + 7, "esn", 3);
--
-- goto authencesn;
-- }
-- }
- }
- }
- if (!list_empty(&priv->alg_list))
-diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
-index e1d6253..b07cb37 100644
---- a/drivers/firmware/efivars.c
-+++ b/drivers/firmware/efivars.c
-@@ -1669,6 +1669,53 @@ static ssize_t efivar_delete(struct file *filp, struct kobject *kobj,
- return count;
- }
-
-+static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor)
-+{
-+ struct efivar_entry *entry, *n;
-+ struct efivars *efivars = &__efivars;
-+ unsigned long strsize1, strsize2;
-+ bool found = false;
-+
-+ strsize1 = utf16_strsize(variable_name, 1024);
-+ list_for_each_entry_safe(entry, n, &efivars->list, list) {
-+ strsize2 = utf16_strsize(entry->var.VariableName, 1024);
-+ if (strsize1 == strsize2 &&
-+ !memcmp(variable_name, &(entry->var.VariableName),
-+ strsize2) &&
-+ !efi_guidcmp(entry->var.VendorGuid,
-+ *vendor)) {
-+ found = true;
-+ break;
-+ }
-+ }
-+ return found;
-+}
-+
-+/*
-+ * Returns the size of variable_name, in bytes, including the
-+ * terminating NULL character, or variable_name_size if no NULL
-+ * character is found among the first variable_name_size bytes.
-+ */
-+static unsigned long var_name_strnsize(efi_char16_t *variable_name,
-+ unsigned long variable_name_size)
-+{
-+ unsigned long len;
-+ efi_char16_t c;
-+
-+ /*
-+ * The variable name is, by definition, a NULL-terminated
-+ * string, so make absolutely sure that variable_name_size is
-+ * the value we expect it to be. If not, return the real size.
-+ */
-+ for (len = 2; len <= variable_name_size; len += sizeof(c)) {
-+ c = variable_name[(len / sizeof(c)) - 1];
-+ if (!c)
-+ break;
-+ }
-+
-+ return min(len, variable_name_size);
-+}
-+
- /*
- * Let's not leave out systab information that snuck into
- * the efivars driver
-@@ -1864,6 +1911,28 @@ void unregister_efivars(struct efivars *efivars)
- }
- EXPORT_SYMBOL_GPL(unregister_efivars);
-
-+/*
-+ * Print a warning when duplicate EFI variables are encountered and
-+ * disable the sysfs workqueue since the firmware is buggy.
-+ */
-+static void dup_variable_bug(efi_char16_t *s16, efi_guid_t *vendor_guid,
-+ unsigned long len16)
-+{
-+ size_t i, len8 = len16 / sizeof(efi_char16_t);
-+ char *s8;
-+
-+ s8 = kzalloc(len8, GFP_KERNEL);
-+ if (!s8)
-+ return;
-+
-+ for (i = 0; i < len8; i++)
-+ s8[i] = s16[i];
-+
-+ printk(KERN_WARNING "efivars: duplicate variable: %s-%pUl\n",
-+ s8, vendor_guid);
-+ kfree(s8);
-+}
-+
- int register_efivars(struct efivars *efivars,
- const struct efivar_operations *ops,
- struct kobject *parent_kobj)
-@@ -1912,6 +1981,24 @@ int register_efivars(struct efivars *efivars,
- &vendor_guid);
- switch (status) {
- case EFI_SUCCESS:
-+ variable_name_size = var_name_strnsize(variable_name,
-+ variable_name_size);
-+
-+ /*
-+ * Some firmware implementations return the
-+ * same variable name on multiple calls to
-+ * get_next_variable(). Terminate the loop
-+ * immediately as there is no guarantee that
-+ * we'll ever see a different variable name,
-+ * and may end up looping here forever.
-+ */
-+ if (variable_is_present(variable_name, &vendor_guid)) {
-+ dup_variable_bug(variable_name, &vendor_guid,
-+ variable_name_size);
-+ status = EFI_NOT_FOUND;
-+ break;
-+ }
-+
- efivar_create_sysfs_entry(efivars,
- variable_name_size,
- variable_name,
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 80aa1fc..e6e4df7 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -7420,8 +7420,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- {
- struct drm_device *dev = crtc->dev;
- struct drm_i915_private *dev_priv = dev->dev_private;
-- struct intel_framebuffer *intel_fb;
-- struct drm_i915_gem_object *obj;
-+ struct drm_framebuffer *old_fb = crtc->fb;
-+ struct drm_i915_gem_object *obj = to_intel_framebuffer(fb)->obj;
- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
- struct intel_unpin_work *work;
- unsigned long flags;
-@@ -7446,8 +7446,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
-
- work->event = event;
- work->crtc = crtc;
-- intel_fb = to_intel_framebuffer(crtc->fb);
-- work->old_fb_obj = intel_fb->obj;
-+ work->old_fb_obj = to_intel_framebuffer(old_fb)->obj;
- INIT_WORK(&work->work, intel_unpin_work_fn);
-
- ret = drm_vblank_get(dev, intel_crtc->pipe);
-@@ -7467,9 +7466,6 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
- intel_crtc->unpin_work = work;
- spin_unlock_irqrestore(&dev->event_lock, flags);
-
-- intel_fb = to_intel_framebuffer(fb);
-- obj = intel_fb->obj;
--
- if (atomic_read(&intel_crtc->unpin_work_count) >= 2)
- flush_workqueue(dev_priv->wq);
-
-@@ -7507,6 +7503,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
-
- cleanup_pending:
- atomic_dec(&intel_crtc->unpin_work_count);
-+ crtc->fb = old_fb;
- atomic_sub(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
- drm_gem_object_unreference(&work->old_fb_obj->base);
- drm_gem_object_unreference(&obj->base);
-diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
-index 2e1c10a..73ce6e9 100644
---- a/drivers/gpu/drm/i915/intel_dp.c
-+++ b/drivers/gpu/drm/i915/intel_dp.c
-@@ -788,6 +788,7 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
- struct intel_dp_m_n m_n;
- int pipe = intel_crtc->pipe;
- enum transcoder cpu_transcoder = intel_crtc->cpu_transcoder;
-+ int target_clock;
-
- /*
- * Find the lane count in the intel_encoder private
-@@ -803,13 +804,22 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
- }
- }
-
-+ target_clock = mode->clock;
-+ for_each_encoder_on_crtc(dev, crtc, intel_encoder) {
-+ if (intel_encoder->type == INTEL_OUTPUT_EDP) {
-+ target_clock = intel_edp_target_clock(intel_encoder,
-+ mode);
-+ break;
-+ }
-+ }
-+
- /*
- * Compute the GMCH and Link ratios. The '3' here is
- * the number of bytes_per_pixel post-LUT, which we always
- * set up for 8-bits of R/G/B, or 3 bytes total.
- */
- intel_dp_compute_m_n(intel_crtc->bpp, lane_count,
-- mode->clock, adjusted_mode->clock, &m_n);
-+ target_clock, adjusted_mode->clock, &m_n);
-
- if (IS_HASWELL(dev)) {
- I915_WRITE(PIPE_DATA_M1(cpu_transcoder),
-diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
-index 266e2ae..160a309 100644
---- a/drivers/hid/hid-ids.h
-+++ b/drivers/hid/hid-ids.h
-@@ -587,6 +587,9 @@
- #define USB_VENDOR_ID_MONTEREY 0x0566
- #define USB_DEVICE_ID_GENIUS_KB29E 0x3004
-
-+#define USB_VENDOR_ID_MSI 0x1770
-+#define USB_DEVICE_ID_MSI_GX680R_LED_PANEL 0xff00
-+
- #define USB_VENDOR_ID_NATIONAL_SEMICONDUCTOR 0x0400
- #define USB_DEVICE_ID_N_S_HARMONY 0xc359
-
-@@ -678,6 +681,9 @@
- #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001 0x3001
- #define USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008 0x3008
-
-+#define USB_VENDOR_ID_REALTEK 0x0bda
-+#define USB_DEVICE_ID_REALTEK_READER 0x0152
-+
- #define USB_VENDOR_ID_ROCCAT 0x1e7d
- #define USB_DEVICE_ID_ROCCAT_ARVO 0x30d4
- #define USB_DEVICE_ID_ROCCAT_ISKU 0x319c
-diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
-index e0e6abf..19b8360 100644
---- a/drivers/hid/usbhid/hid-quirks.c
-+++ b/drivers/hid/usbhid/hid-quirks.c
-@@ -73,6 +73,7 @@ static const struct hid_blacklist {
- { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
-+ { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_PIXART, USB_DEVICE_ID_PIXART_OPTICAL_TOUCH_SCREEN1, HID_QUIRK_NO_INIT_REPORTS },
-@@ -80,6 +81,7 @@ static const struct hid_blacklist {
- { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3001, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET },
-+ { USB_VENDOR_ID_REALTEK, USB_DEVICE_ID_REALTEK_READER, HID_QUIRK_NO_INIT_REPORTS },
- { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_SIGMATEL, USB_DEVICE_ID_SIGMATEL_STMP3780, HID_QUIRK_NOGET },
- { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
-diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
-index c1c74e0..4647b50 100644
---- a/drivers/iommu/amd_iommu.c
-+++ b/drivers/iommu/amd_iommu.c
-@@ -2466,18 +2466,16 @@ static int device_change_notifier(struct notifier_block *nb,
-
- /* allocate a protection domain if a device is added */
- dma_domain = find_protection_domain(devid);
-- if (dma_domain)
-- goto out;
-- dma_domain = dma_ops_domain_alloc();
-- if (!dma_domain)
-- goto out;
-- dma_domain->target_dev = devid;
--
-- spin_lock_irqsave(&iommu_pd_list_lock, flags);
-- list_add_tail(&dma_domain->list, &iommu_pd_list);
-- spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
--
-- dev_data = get_dev_data(dev);
-+ if (!dma_domain) {
-+ dma_domain = dma_ops_domain_alloc();
-+ if (!dma_domain)
-+ goto out;
-+ dma_domain->target_dev = devid;
-+
-+ spin_lock_irqsave(&iommu_pd_list_lock, flags);
-+ list_add_tail(&dma_domain->list, &iommu_pd_list);
-+ spin_unlock_irqrestore(&iommu_pd_list_lock, flags);
-+ }
-
- dev->archdata.dma_ops = &amd_iommu_dma_ops;
-
-diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
-index 45e5d06..dd53210 100644
---- a/drivers/media/pci/bt8xx/bttv-driver.c
-+++ b/drivers/media/pci/bt8xx/bttv-driver.c
-@@ -250,17 +250,19 @@ static u8 SRAM_Table[][60] =
- vdelay start of active video in 2 * field lines relative to
- trailing edge of /VRESET pulse (VDELAY register).
- sheight height of active video in 2 * field lines.
-+ extraheight Added to sheight for cropcap.bounds.height only
- videostart0 ITU-R frame line number of the line corresponding
- to vdelay in the first field. */
- #define CROPCAP(minhdelayx1, hdelayx1, swidth, totalwidth, sqwidth, \
-- vdelay, sheight, videostart0) \
-+ vdelay, sheight, extraheight, videostart0) \
- .cropcap.bounds.left = minhdelayx1, \
- /* * 2 because vertically we count field lines times two, */ \
- /* e.g. 23 * 2 to 23 * 2 + 576 in PAL-BGHI defrect. */ \
- .cropcap.bounds.top = (videostart0) * 2 - (vdelay) + MIN_VDELAY, \
- /* 4 is a safety margin at the end of the line. */ \
- .cropcap.bounds.width = (totalwidth) - (minhdelayx1) - 4, \
-- .cropcap.bounds.height = (sheight) + (vdelay) - MIN_VDELAY, \
-+ .cropcap.bounds.height = (sheight) + (extraheight) + (vdelay) - \
-+ MIN_VDELAY, \
- .cropcap.defrect.left = hdelayx1, \
- .cropcap.defrect.top = (videostart0) * 2, \
- .cropcap.defrect.width = swidth, \
-@@ -301,9 +303,10 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* totalwidth */ 1135,
- /* sqwidth */ 944,
- /* vdelay */ 0x20,
-- /* bt878 (and bt848?) can capture another
-- line below active video. */
-- /* sheight */ (576 + 2) + 0x20 - 2,
-+ /* sheight */ 576,
-+ /* bt878 (and bt848?) can capture another
-+ line below active video. */
-+ /* extraheight */ 2,
- /* videostart0 */ 23)
- },{
- .v4l2_id = V4L2_STD_NTSC_M | V4L2_STD_NTSC_M_KR,
-@@ -330,6 +333,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 780,
- /* vdelay */ 0x1a,
- /* sheight */ 480,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- },{
- .v4l2_id = V4L2_STD_SECAM,
-@@ -355,6 +359,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 944,
- /* vdelay */ 0x20,
- /* sheight */ 576,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- },{
- .v4l2_id = V4L2_STD_PAL_Nc,
-@@ -380,6 +385,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 780,
- /* vdelay */ 0x1a,
- /* sheight */ 576,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- },{
- .v4l2_id = V4L2_STD_PAL_M,
-@@ -405,6 +411,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 780,
- /* vdelay */ 0x1a,
- /* sheight */ 480,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- },{
- .v4l2_id = V4L2_STD_PAL_N,
-@@ -430,6 +437,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 944,
- /* vdelay */ 0x20,
- /* sheight */ 576,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- },{
- .v4l2_id = V4L2_STD_NTSC_M_JP,
-@@ -455,6 +463,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 780,
- /* vdelay */ 0x16,
- /* sheight */ 480,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- },{
- /* that one hopefully works with the strange timing
-@@ -484,6 +493,7 @@ const struct bttv_tvnorm bttv_tvnorms[] = {
- /* sqwidth */ 944,
- /* vdelay */ 0x1a,
- /* sheight */ 480,
-+ /* extraheight */ 0,
- /* videostart0 */ 23)
- }
- };
-diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
-index 272f81a..27cdf1f 100644
---- a/drivers/net/bonding/bond_main.c
-+++ b/drivers/net/bonding/bond_main.c
-@@ -1955,12 +1955,11 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
- return -EINVAL;
- }
-
-+ write_unlock_bh(&bond->lock);
- /* unregister rx_handler early so bond_handle_frame wouldn't be called
- * for this slave anymore.
- */
- netdev_rx_handler_unregister(slave_dev);
-- write_unlock_bh(&bond->lock);
-- synchronize_net();
- write_lock_bh(&bond->lock);
-
- if (!bond->params.fail_over_mac) {
-diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
-index 1c9e09f..ea7a388 100644
---- a/drivers/net/bonding/bond_sysfs.c
-+++ b/drivers/net/bonding/bond_sysfs.c
-@@ -183,6 +183,11 @@ int bond_create_slave_symlinks(struct net_device *master,
- sprintf(linkname, "slave_%s", slave->name);
- ret = sysfs_create_link(&(master->dev.kobj), &(slave->dev.kobj),
- linkname);
-+
-+ /* free the master link created earlier in case of error */
-+ if (ret)
-+ sysfs_remove_link(&(slave->dev.kobj), "master");
-+
- return ret;
-
- }
-@@ -522,7 +527,7 @@ static ssize_t bonding_store_arp_interval(struct device *d,
- goto out;
- }
- if (new_value < 0) {
-- pr_err("%s: Invalid arp_interval value %d not in range 1-%d; rejected.\n",
-+ pr_err("%s: Invalid arp_interval value %d not in range 0-%d; rejected.\n",
- bond->dev->name, new_value, INT_MAX);
- ret = -EINVAL;
- goto out;
-@@ -537,14 +542,15 @@ static ssize_t bonding_store_arp_interval(struct device *d,
- pr_info("%s: Setting ARP monitoring interval to %d.\n",
- bond->dev->name, new_value);
- bond->params.arp_interval = new_value;
-- if (bond->params.miimon) {
-- pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
-- bond->dev->name, bond->dev->name);
-- bond->params.miimon = 0;
-- }
-- if (!bond->params.arp_targets[0]) {
-- pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
-- bond->dev->name);
-+ if (new_value) {
-+ if (bond->params.miimon) {
-+ pr_info("%s: ARP monitoring cannot be used with MII monitoring. %s Disabling MII monitoring.\n",
-+ bond->dev->name, bond->dev->name);
-+ bond->params.miimon = 0;
-+ }
-+ if (!bond->params.arp_targets[0])
-+ pr_info("%s: ARP monitoring has been set up, but no ARP targets have been specified.\n",
-+ bond->dev->name);
- }
- if (bond->dev->flags & IFF_UP) {
- /* If the interface is up, we may need to fire off
-@@ -552,10 +558,13 @@ static ssize_t bonding_store_arp_interval(struct device *d,
- * timer will get fired off when the open function
- * is called.
- */
-- cancel_delayed_work_sync(&bond->mii_work);
-- queue_delayed_work(bond->wq, &bond->arp_work, 0);
-+ if (!new_value) {
-+ cancel_delayed_work_sync(&bond->arp_work);
-+ } else {
-+ cancel_delayed_work_sync(&bond->mii_work);
-+ queue_delayed_work(bond->wq, &bond->arp_work, 0);
-+ }
- }
--
- out:
- rtnl_unlock();
- return ret;
-@@ -697,7 +706,7 @@ static ssize_t bonding_store_downdelay(struct device *d,
- }
- if (new_value < 0) {
- pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
-- bond->dev->name, new_value, 1, INT_MAX);
-+ bond->dev->name, new_value, 0, INT_MAX);
- ret = -EINVAL;
- goto out;
- } else {
-@@ -752,8 +761,8 @@ static ssize_t bonding_store_updelay(struct device *d,
- goto out;
- }
- if (new_value < 0) {
-- pr_err("%s: Invalid down delay value %d not in range %d-%d; rejected.\n",
-- bond->dev->name, new_value, 1, INT_MAX);
-+ pr_err("%s: Invalid up delay value %d not in range %d-%d; rejected.\n",
-+ bond->dev->name, new_value, 0, INT_MAX);
- ret = -EINVAL;
- goto out;
- } else {
-@@ -963,37 +972,37 @@ static ssize_t bonding_store_miimon(struct device *d,
- }
- if (new_value < 0) {
- pr_err("%s: Invalid miimon value %d not in range %d-%d; rejected.\n",
-- bond->dev->name, new_value, 1, INT_MAX);
-+ bond->dev->name, new_value, 0, INT_MAX);
- ret = -EINVAL;
- goto out;
-- } else {
-- pr_info("%s: Setting MII monitoring interval to %d.\n",
-- bond->dev->name, new_value);
-- bond->params.miimon = new_value;
-- if (bond->params.updelay)
-- pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
-- bond->dev->name,
-- bond->params.updelay * bond->params.miimon);
-- if (bond->params.downdelay)
-- pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
-- bond->dev->name,
-- bond->params.downdelay * bond->params.miimon);
-- if (bond->params.arp_interval) {
-- pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
-- bond->dev->name);
-- bond->params.arp_interval = 0;
-- if (bond->params.arp_validate) {
-- bond->params.arp_validate =
-- BOND_ARP_VALIDATE_NONE;
-- }
-- }
--
-- if (bond->dev->flags & IFF_UP) {
-- /* If the interface is up, we may need to fire off
-- * the MII timer. If the interface is down, the
-- * timer will get fired off when the open function
-- * is called.
-- */
-+ }
-+ pr_info("%s: Setting MII monitoring interval to %d.\n",
-+ bond->dev->name, new_value);
-+ bond->params.miimon = new_value;
-+ if (bond->params.updelay)
-+ pr_info("%s: Note: Updating updelay (to %d) since it is a multiple of the miimon value.\n",
-+ bond->dev->name,
-+ bond->params.updelay * bond->params.miimon);
-+ if (bond->params.downdelay)
-+ pr_info("%s: Note: Updating downdelay (to %d) since it is a multiple of the miimon value.\n",
-+ bond->dev->name,
-+ bond->params.downdelay * bond->params.miimon);
-+ if (new_value && bond->params.arp_interval) {
-+ pr_info("%s: MII monitoring cannot be used with ARP monitoring. Disabling ARP monitoring...\n",
-+ bond->dev->name);
-+ bond->params.arp_interval = 0;
-+ if (bond->params.arp_validate)
-+ bond->params.arp_validate = BOND_ARP_VALIDATE_NONE;
-+ }
-+ if (bond->dev->flags & IFF_UP) {
-+ /* If the interface is up, we may need to fire off
-+ * the MII timer. If the interface is down, the
-+ * timer will get fired off when the open function
-+ * is called.
-+ */
-+ if (!new_value) {
-+ cancel_delayed_work_sync(&bond->mii_work);
-+ } else {
- cancel_delayed_work_sync(&bond->arp_work);
- queue_delayed_work(bond->wq, &bond->mii_work, 0);
- }
-diff --git a/drivers/net/can/sja1000/plx_pci.c b/drivers/net/can/sja1000/plx_pci.c
-index 11d1062..08a606c 100644
---- a/drivers/net/can/sja1000/plx_pci.c
-+++ b/drivers/net/can/sja1000/plx_pci.c
-@@ -348,7 +348,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
- */
- if ((priv->read_reg(priv, REG_CR) & REG_CR_BASICCAN_INITIAL_MASK) ==
- REG_CR_BASICCAN_INITIAL &&
-- (priv->read_reg(priv, REG_SR) == REG_SR_BASICCAN_INITIAL) &&
-+ (priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_BASICCAN_INITIAL) &&
- (priv->read_reg(priv, REG_IR) == REG_IR_BASICCAN_INITIAL))
- flag = 1;
-
-@@ -360,7 +360,7 @@ static inline int plx_pci_check_sja1000(const struct sja1000_priv *priv)
- * See states on p. 23 of the Datasheet.
- */
- if (priv->read_reg(priv, REG_MOD) == REG_MOD_PELICAN_INITIAL &&
-- priv->read_reg(priv, REG_SR) == REG_SR_PELICAN_INITIAL &&
-+ priv->read_reg(priv, SJA1000_REG_SR) == REG_SR_PELICAN_INITIAL &&
- priv->read_reg(priv, REG_IR) == REG_IR_PELICAN_INITIAL)
- return flag;
-
-diff --git a/drivers/net/can/sja1000/sja1000.c b/drivers/net/can/sja1000/sja1000.c
-index 83ee11e..43921f9 100644
---- a/drivers/net/can/sja1000/sja1000.c
-+++ b/drivers/net/can/sja1000/sja1000.c
-@@ -91,7 +91,7 @@ static void sja1000_write_cmdreg(struct sja1000_priv *priv, u8 val)
- */
- spin_lock_irqsave(&priv->cmdreg_lock, flags);
- priv->write_reg(priv, REG_CMR, val);
-- priv->read_reg(priv, REG_SR);
-+ priv->read_reg(priv, SJA1000_REG_SR);
- spin_unlock_irqrestore(&priv->cmdreg_lock, flags);
- }
-
-@@ -499,7 +499,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
-
- while ((isrc = priv->read_reg(priv, REG_IR)) && (n < SJA1000_MAX_IRQ)) {
- n++;
-- status = priv->read_reg(priv, REG_SR);
-+ status = priv->read_reg(priv, SJA1000_REG_SR);
- /* check for absent controller due to hw unplug */
- if (status == 0xFF && sja1000_is_absent(priv))
- return IRQ_NONE;
-@@ -526,7 +526,7 @@ irqreturn_t sja1000_interrupt(int irq, void *dev_id)
- /* receive interrupt */
- while (status & SR_RBS) {
- sja1000_rx(dev);
-- status = priv->read_reg(priv, REG_SR);
-+ status = priv->read_reg(priv, SJA1000_REG_SR);
- /* check for absent controller */
- if (status == 0xFF && sja1000_is_absent(priv))
- return IRQ_NONE;
-diff --git a/drivers/net/can/sja1000/sja1000.h b/drivers/net/can/sja1000/sja1000.h
-index afa9984..aa48e05 100644
---- a/drivers/net/can/sja1000/sja1000.h
-+++ b/drivers/net/can/sja1000/sja1000.h
-@@ -56,7 +56,7 @@
- /* SJA1000 registers - manual section 6.4 (Pelican Mode) */
- #define REG_MOD 0x00
- #define REG_CMR 0x01
--#define REG_SR 0x02
-+#define SJA1000_REG_SR 0x02
- #define REG_IR 0x03
- #define REG_IER 0x04
- #define REG_ALC 0x0B
-diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e.h b/drivers/net/ethernet/atheros/atl1e/atl1e.h
-index 829b5ad..edfdf6b 100644
---- a/drivers/net/ethernet/atheros/atl1e/atl1e.h
-+++ b/drivers/net/ethernet/atheros/atl1e/atl1e.h
-@@ -438,7 +438,6 @@ struct atl1e_adapter {
- struct atl1e_hw hw;
- struct atl1e_hw_stats hw_stats;
-
-- bool have_msi;
- u32 wol;
- u16 link_speed;
- u16 link_duplex;
-diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
-index e4466a3..35faab7 100644
---- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
-+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
-@@ -1851,34 +1851,19 @@ static void atl1e_free_irq(struct atl1e_adapter *adapter)
- struct net_device *netdev = adapter->netdev;
-
- free_irq(adapter->pdev->irq, netdev);
--
-- if (adapter->have_msi)
-- pci_disable_msi(adapter->pdev);
- }
-
- static int atl1e_request_irq(struct atl1e_adapter *adapter)
- {
- struct pci_dev *pdev = adapter->pdev;
- struct net_device *netdev = adapter->netdev;
-- int flags = 0;
- int err = 0;
-
-- adapter->have_msi = true;
-- err = pci_enable_msi(pdev);
-- if (err) {
-- netdev_dbg(netdev,
-- "Unable to allocate MSI interrupt Error: %d\n", err);
-- adapter->have_msi = false;
-- }
--
-- if (!adapter->have_msi)
-- flags |= IRQF_SHARED;
-- err = request_irq(pdev->irq, atl1e_intr, flags, netdev->name, netdev);
-+ err = request_irq(pdev->irq, atl1e_intr, IRQF_SHARED, netdev->name,
-+ netdev);
- if (err) {
- netdev_dbg(adapter->netdev,
- "Unable to allocate interrupt Error: %d\n", err);
-- if (adapter->have_msi)
-- pci_disable_msi(pdev);
- return err;
- }
- netdev_dbg(netdev, "atl1e_request_irq OK\n");
-diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
-index 3ec98f2..8a5253c 100644
---- a/drivers/net/ethernet/broadcom/tg3.c
-+++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -14403,8 +14403,11 @@ static void tg3_read_vpd(struct tg3 *tp)
- if (j + len > block_end)
- goto partno;
-
-- memcpy(tp->fw_ver, &vpd_data[j], len);
-- strncat(tp->fw_ver, " bc ", vpdlen - len - 1);
-+ if (len >= sizeof(tp->fw_ver))
-+ len = sizeof(tp->fw_ver) - 1;
-+ memset(tp->fw_ver, 0, sizeof(tp->fw_ver));
-+ snprintf(tp->fw_ver, sizeof(tp->fw_ver), "%.*s bc ", len,
-+ &vpd_data[j]);
- }
-
- partno:
-diff --git a/drivers/net/ethernet/davicom/dm9000.c b/drivers/net/ethernet/davicom/dm9000.c
-index c73472c..d67de83 100644
---- a/drivers/net/ethernet/davicom/dm9000.c
-+++ b/drivers/net/ethernet/davicom/dm9000.c
-@@ -257,6 +257,107 @@ static void dm9000_dumpblk_32bit(void __iomem *reg, int count)
- tmp = readl(reg);
- }
-
-+/*
-+ * Sleep, either by using msleep() or if we are suspending, then
-+ * use mdelay() to sleep.
-+ */
-+static void dm9000_msleep(board_info_t *db, unsigned int ms)
-+{
-+ if (db->in_suspend)
-+ mdelay(ms);
-+ else
-+ msleep(ms);
-+}
-+
-+/* Read a word from phyxcer */
-+static int
-+dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
-+{
-+ board_info_t *db = netdev_priv(dev);
-+ unsigned long flags;
-+ unsigned int reg_save;
-+ int ret;
-+
-+ mutex_lock(&db->addr_lock);
-+
-+ spin_lock_irqsave(&db->lock, flags);
-+
-+ /* Save previous register address */
-+ reg_save = readb(db->io_addr);
-+
-+ /* Fill the phyxcer register into REG_0C */
-+ iow(db, DM9000_EPAR, DM9000_PHY | reg);
-+
-+ /* Issue phyxcer read command */
-+ iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS);
-+
-+ writeb(reg_save, db->io_addr);
-+ spin_unlock_irqrestore(&db->lock, flags);
-+
-+ dm9000_msleep(db, 1); /* Wait read complete */
-+
-+ spin_lock_irqsave(&db->lock, flags);
-+ reg_save = readb(db->io_addr);
-+
-+ iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */
-+
-+ /* The read data keeps on REG_0D & REG_0E */
-+ ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
-+
-+ /* restore the previous address */
-+ writeb(reg_save, db->io_addr);
-+ spin_unlock_irqrestore(&db->lock, flags);
-+
-+ mutex_unlock(&db->addr_lock);
-+
-+ dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
-+ return ret;
-+}
-+
-+/* Write a word to phyxcer */
-+static void
-+dm9000_phy_write(struct net_device *dev,
-+ int phyaddr_unused, int reg, int value)
-+{
-+ board_info_t *db = netdev_priv(dev);
-+ unsigned long flags;
-+ unsigned long reg_save;
-+
-+ dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
-+ mutex_lock(&db->addr_lock);
-+
-+ spin_lock_irqsave(&db->lock, flags);
-+
-+ /* Save previous register address */
-+ reg_save = readb(db->io_addr);
-+
-+ /* Fill the phyxcer register into REG_0C */
-+ iow(db, DM9000_EPAR, DM9000_PHY | reg);
-+
-+ /* Fill the written data into REG_0D & REG_0E */
-+ iow(db, DM9000_EPDRL, value);
-+ iow(db, DM9000_EPDRH, value >> 8);
-+
-+ /* Issue phyxcer write command */
-+ iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW);
-+
-+ writeb(reg_save, db->io_addr);
-+ spin_unlock_irqrestore(&db->lock, flags);
-+
-+ dm9000_msleep(db, 1); /* Wait write complete */
-+
-+ spin_lock_irqsave(&db->lock, flags);
-+ reg_save = readb(db->io_addr);
-+
-+ iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */
-+
-+ /* restore the previous address */
-+ writeb(reg_save, db->io_addr);
-+
-+ spin_unlock_irqrestore(&db->lock, flags);
-+ mutex_unlock(&db->addr_lock);
-+}
-+
- /* dm9000_set_io
- *
- * select the specified set of io routines to use with the
-@@ -794,6 +895,9 @@ dm9000_init_dm9000(struct net_device *dev)
-
- iow(db, DM9000_GPCR, GPCR_GEP_CNTL); /* Let GPIO0 output */
-
-+ dm9000_phy_write(dev, 0, MII_BMCR, BMCR_RESET); /* PHY RESET */
-+ dm9000_phy_write(dev, 0, MII_DM_DSPCR, DSPCR_INIT_PARAM); /* Init */
-+
- ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
-
- /* if wol is needed, then always set NCR_WAKEEN otherwise we end
-@@ -1200,109 +1304,6 @@ dm9000_open(struct net_device *dev)
- return 0;
- }
-
--/*
-- * Sleep, either by using msleep() or if we are suspending, then
-- * use mdelay() to sleep.
-- */
--static void dm9000_msleep(board_info_t *db, unsigned int ms)
--{
-- if (db->in_suspend)
-- mdelay(ms);
-- else
-- msleep(ms);
--}
--
--/*
-- * Read a word from phyxcer
-- */
--static int
--dm9000_phy_read(struct net_device *dev, int phy_reg_unused, int reg)
--{
-- board_info_t *db = netdev_priv(dev);
-- unsigned long flags;
-- unsigned int reg_save;
-- int ret;
--
-- mutex_lock(&db->addr_lock);
--
-- spin_lock_irqsave(&db->lock,flags);
--
-- /* Save previous register address */
-- reg_save = readb(db->io_addr);
--
-- /* Fill the phyxcer register into REG_0C */
-- iow(db, DM9000_EPAR, DM9000_PHY | reg);
--
-- iow(db, DM9000_EPCR, EPCR_ERPRR | EPCR_EPOS); /* Issue phyxcer read command */
--
-- writeb(reg_save, db->io_addr);
-- spin_unlock_irqrestore(&db->lock,flags);
--
-- dm9000_msleep(db, 1); /* Wait read complete */
--
-- spin_lock_irqsave(&db->lock,flags);
-- reg_save = readb(db->io_addr);
--
-- iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer read command */
--
-- /* The read data keeps on REG_0D & REG_0E */
-- ret = (ior(db, DM9000_EPDRH) << 8) | ior(db, DM9000_EPDRL);
--
-- /* restore the previous address */
-- writeb(reg_save, db->io_addr);
-- spin_unlock_irqrestore(&db->lock,flags);
--
-- mutex_unlock(&db->addr_lock);
--
-- dm9000_dbg(db, 5, "phy_read[%02x] -> %04x\n", reg, ret);
-- return ret;
--}
--
--/*
-- * Write a word to phyxcer
-- */
--static void
--dm9000_phy_write(struct net_device *dev,
-- int phyaddr_unused, int reg, int value)
--{
-- board_info_t *db = netdev_priv(dev);
-- unsigned long flags;
-- unsigned long reg_save;
--
-- dm9000_dbg(db, 5, "phy_write[%02x] = %04x\n", reg, value);
-- mutex_lock(&db->addr_lock);
--
-- spin_lock_irqsave(&db->lock,flags);
--
-- /* Save previous register address */
-- reg_save = readb(db->io_addr);
--
-- /* Fill the phyxcer register into REG_0C */
-- iow(db, DM9000_EPAR, DM9000_PHY | reg);
--
-- /* Fill the written data into REG_0D & REG_0E */
-- iow(db, DM9000_EPDRL, value);
-- iow(db, DM9000_EPDRH, value >> 8);
--
-- iow(db, DM9000_EPCR, EPCR_EPOS | EPCR_ERPRW); /* Issue phyxcer write command */
--
-- writeb(reg_save, db->io_addr);
-- spin_unlock_irqrestore(&db->lock, flags);
--
-- dm9000_msleep(db, 1); /* Wait write complete */
--
-- spin_lock_irqsave(&db->lock,flags);
-- reg_save = readb(db->io_addr);
--
-- iow(db, DM9000_EPCR, 0x0); /* Clear phyxcer write command */
--
-- /* restore the previous address */
-- writeb(reg_save, db->io_addr);
--
-- spin_unlock_irqrestore(&db->lock, flags);
-- mutex_unlock(&db->addr_lock);
--}
--
- static void
- dm9000_shutdown(struct net_device *dev)
- {
-@@ -1501,7 +1502,12 @@ dm9000_probe(struct platform_device *pdev)
- db->flags |= DM9000_PLATF_SIMPLE_PHY;
- #endif
-
-- dm9000_reset(db);
-+ /* Fixing bug on dm9000_probe, takeover dm9000_reset(db),
-+ * Need 'NCR_MAC_LBK' bit to indeed stable our DM9000 fifo
-+ * while probe stage.
-+ */
-+
-+ iow(db, DM9000_NCR, NCR_MAC_LBK | NCR_RST);
-
- /* try multiple times, DM9000 sometimes gets the read wrong */
- for (i = 0; i < 8; i++) {
-diff --git a/drivers/net/ethernet/davicom/dm9000.h b/drivers/net/ethernet/davicom/dm9000.h
-index 55688bd..9ce058a 100644
---- a/drivers/net/ethernet/davicom/dm9000.h
-+++ b/drivers/net/ethernet/davicom/dm9000.h
-@@ -69,7 +69,9 @@
- #define NCR_WAKEEN (1<<6)
- #define NCR_FCOL (1<<4)
- #define NCR_FDX (1<<3)
--#define NCR_LBK (3<<1)
-+
-+#define NCR_RESERVED (3<<1)
-+#define NCR_MAC_LBK (1<<1)
- #define NCR_RST (1<<0)
-
- #define NSR_SPEED (1<<7)
-@@ -167,5 +169,12 @@
- #define ISR_LNKCHNG (1<<5)
- #define ISR_UNDERRUN (1<<4)
-
-+/* Davicom MII registers.
-+ */
-+
-+#define MII_DM_DSPCR 0x1b /* DSP Control Register */
-+
-+#define DSPCR_INIT_PARAM 0xE100 /* DSP init parameter */
-+
- #endif /* _DM9000X_H_ */
-
-diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
-index c40526c..547c9f1 100644
---- a/drivers/net/ethernet/freescale/fec_ptp.c
-+++ b/drivers/net/ethernet/freescale/fec_ptp.c
-@@ -128,6 +128,7 @@ void fec_ptp_start_cyclecounter(struct net_device *ndev)
-
- spin_unlock_irqrestore(&fep->tmreg_lock, flags);
- }
-+EXPORT_SYMBOL(fec_ptp_start_cyclecounter);
-
- /**
- * fec_ptp_adjfreq - adjust ptp cycle frequency
-@@ -318,6 +319,7 @@ int fec_ptp_ioctl(struct net_device *ndev, struct ifreq *ifr, int cmd)
- return copy_to_user(ifr->ifr_data, &config, sizeof(config)) ?
- -EFAULT : 0;
- }
-+EXPORT_SYMBOL(fec_ptp_ioctl);
-
- /**
- * fec_time_keep - call timecounter_read every second to avoid timer overrun
-@@ -381,3 +383,4 @@ void fec_ptp_init(struct net_device *ndev, struct platform_device *pdev)
- pr_info("registered PHC device on %s\n", ndev->name);
- }
- }
-+EXPORT_SYMBOL(fec_ptp_init);
-diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
-index 3269eb3..d23dc5e 100644
---- a/drivers/net/ethernet/marvell/sky2.c
-+++ b/drivers/net/ethernet/marvell/sky2.c
-@@ -1067,7 +1067,7 @@ static void sky2_ramset(struct sky2_hw *hw, u16 q, u32 start, u32 space)
- sky2_write32(hw, RB_ADDR(q, RB_RX_UTHP), tp);
- sky2_write32(hw, RB_ADDR(q, RB_RX_LTHP), space/2);
-
-- tp = space - 2048/8;
-+ tp = space - 8192/8;
- sky2_write32(hw, RB_ADDR(q, RB_RX_UTPP), tp);
- sky2_write32(hw, RB_ADDR(q, RB_RX_LTPP), space/4);
- } else {
-diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
-index 615ac63..ec6dcd8 100644
---- a/drivers/net/ethernet/marvell/sky2.h
-+++ b/drivers/net/ethernet/marvell/sky2.h
-@@ -2074,7 +2074,7 @@ enum {
- GM_IS_RX_FF_OR = 1<<1, /* Receive FIFO Overrun */
- GM_IS_RX_COMPL = 1<<0, /* Frame Reception Complete */
-
--#define GMAC_DEF_MSK GM_IS_TX_FF_UR
-+#define GMAC_DEF_MSK (GM_IS_TX_FF_UR | GM_IS_RX_FF_OR)
- };
-
- /* GMAC_LINK_CTRL 16 bit GMAC Link Control Reg (YUKON only) */
-diff --git a/drivers/net/ethernet/micrel/ks8851.c b/drivers/net/ethernet/micrel/ks8851.c
-index 286816a..1e42882 100644
---- a/drivers/net/ethernet/micrel/ks8851.c
-+++ b/drivers/net/ethernet/micrel/ks8851.c
-@@ -547,7 +547,7 @@ static void ks8851_rx_pkts(struct ks8851_net *ks)
- for (; rxfc != 0; rxfc--) {
- rxh = ks8851_rdreg32(ks, KS_RXFHSR);
- rxstat = rxh & 0xffff;
-- rxlen = rxh >> 16;
-+ rxlen = (rxh >> 16) & 0xfff;
-
- netif_dbg(ks, rx_status, ks->netdev,
- "rx: stat 0x%04x, len 0x%04x\n", rxstat, rxlen);
-diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
-index 39ab4d0..73ce7dd 100644
---- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
-+++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
-@@ -1726,9 +1726,9 @@ pch_gbe_clean_rx(struct pch_gbe_adapter *adapter,
-
- skb->protocol = eth_type_trans(skb, netdev);
- if (tcp_ip_status & PCH_GBE_RXD_ACC_STAT_TCPIPOK)
-- skb->ip_summed = CHECKSUM_NONE;
-- else
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-+ else
-+ skb->ip_summed = CHECKSUM_NONE;
-
- napi_gro_receive(&adapter->napi, skb);
- (*work_done)++;
-diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
-index 40aff68..3b1be52 100644
---- a/drivers/net/ethernet/ti/cpsw.c
-+++ b/drivers/net/ethernet/ti/cpsw.c
-@@ -375,7 +375,7 @@ void cpsw_tx_handler(void *token, int len, int status)
- struct cpsw_priv *priv = netdev_priv(ndev);
-
- if (unlikely(netif_queue_stopped(ndev)))
-- netif_start_queue(ndev);
-+ netif_wake_queue(ndev);
- cpts_tx_timestamp(&priv->cpts, skb);
- priv->stats.tx_packets++;
- priv->stats.tx_bytes += len;
-@@ -1111,7 +1111,7 @@ static int cpsw_probe_dt(struct cpsw_platform_data *data,
- struct platform_device *mdio;
-
- parp = of_get_property(slave_node, "phy_id", &lenp);
-- if ((parp == NULL) && (lenp != (sizeof(void *) * 2))) {
-+ if ((parp == NULL) || (lenp != (sizeof(void *) * 2))) {
- pr_err("Missing slave[%d] phy_id property\n", i);
- ret = -EINVAL;
- goto error_ret;
-diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
-index 2a3e2c5..4ebcb24 100644
---- a/drivers/net/ethernet/ti/davinci_emac.c
-+++ b/drivers/net/ethernet/ti/davinci_emac.c
-@@ -1055,7 +1055,7 @@ static void emac_tx_handler(void *token, int len, int status)
- atomic_dec(&priv->cur_tx);
-
- if (unlikely(netif_queue_stopped(ndev)))
-- netif_start_queue(ndev);
-+ netif_wake_queue(ndev);
- ndev->stats.tx_packets++;
- ndev->stats.tx_bytes += len;
- dev_kfree_skb_any(skb);
-diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
-index 251a335..937c09d 100644
---- a/drivers/net/usb/smsc75xx.c
-+++ b/drivers/net/usb/smsc75xx.c
-@@ -914,8 +914,12 @@ static int smsc75xx_set_rx_max_frame_length(struct usbnet *dev, int size)
- static int smsc75xx_change_mtu(struct net_device *netdev, int new_mtu)
- {
- struct usbnet *dev = netdev_priv(netdev);
-+ int ret;
-+
-+ if (new_mtu > MAX_SINGLE_PACKET_SIZE)
-+ return -EINVAL;
-
-- int ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu);
-+ ret = smsc75xx_set_rx_max_frame_length(dev, new_mtu + ETH_HLEN);
- if (ret < 0) {
- netdev_warn(dev->net, "Failed to set mac rx frame length\n");
- return ret;
-@@ -1324,7 +1328,7 @@ static int smsc75xx_reset(struct usbnet *dev)
-
- netif_dbg(dev, ifup, dev->net, "FCT_TX_CTL set to 0x%08x\n", buf);
-
-- ret = smsc75xx_set_rx_max_frame_length(dev, 1514);
-+ ret = smsc75xx_set_rx_max_frame_length(dev, dev->net->mtu + ETH_HLEN);
- if (ret < 0) {
- netdev_warn(dev->net, "Failed to set max rx frame length\n");
- return ret;
-@@ -2136,8 +2140,8 @@ static int smsc75xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
- else if (rx_cmd_a & (RX_CMD_A_LONG | RX_CMD_A_RUNT))
- dev->net->stats.rx_frame_errors++;
- } else {
-- /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */
-- if (unlikely(size > (ETH_FRAME_LEN + 12))) {
-+ /* MAX_SINGLE_PACKET_SIZE + 4(CRC) + 2(COE) + 4(Vlan) */
-+ if (unlikely(size > (MAX_SINGLE_PACKET_SIZE + ETH_HLEN + 12))) {
- netif_dbg(dev, rx_err, dev->net,
- "size err rx_cmd_a=0x%08x\n",
- rx_cmd_a);
-diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-index 56317b0..e99f481 100644
---- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
-@@ -976,6 +976,7 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
- AR_PHY_CL_TAB_1,
- AR_PHY_CL_TAB_2 };
-
-+ /* Use chip chainmask only for calibration */
- ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
-
- if (rtt) {
-@@ -1131,6 +1132,9 @@ skip_tx_iqcal:
- ar9003_hw_rtt_disable(ah);
- }
-
-+ /* Revert chainmask to runtime parameters */
-+ ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
-+
- /* Initialize list pointers */
- ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
- ah->supp_cals = IQ_MISMATCH_CAL;
-diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
-index ade3afb..7fdac6c 100644
---- a/drivers/net/wireless/ath/ath9k/link.c
-+++ b/drivers/net/wireless/ath/ath9k/link.c
-@@ -28,21 +28,21 @@ void ath_tx_complete_poll_work(struct work_struct *work)
- int i;
- bool needreset = false;
-
-- for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-- if (ATH_TXQ_SETUP(sc, i)) {
-- txq = &sc->tx.txq[i];
-- ath_txq_lock(sc, txq);
-- if (txq->axq_depth) {
-- if (txq->axq_tx_inprogress) {
-- needreset = true;
-- ath_txq_unlock(sc, txq);
-- break;
-- } else {
-- txq->axq_tx_inprogress = true;
-- }
-+ for (i = 0; i < IEEE80211_NUM_ACS; i++) {
-+ txq = sc->tx.txq_map[i];
-+
-+ ath_txq_lock(sc, txq);
-+ if (txq->axq_depth) {
-+ if (txq->axq_tx_inprogress) {
-+ needreset = true;
-+ ath_txq_unlock(sc, txq);
-+ break;
-+ } else {
-+ txq->axq_tx_inprogress = true;
- }
-- ath_txq_unlock_complete(sc, txq);
- }
-+ ath_txq_unlock_complete(sc, txq);
-+ }
-
- if (needreset) {
- ath_dbg(ath9k_hw_common(sc->sc_ah), RESET,
-@@ -170,7 +170,8 @@ void ath_rx_poll(unsigned long data)
- {
- struct ath_softc *sc = (struct ath_softc *)data;
-
-- ieee80211_queue_work(sc->hw, &sc->hw_check_work);
-+ if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
-+ ieee80211_queue_work(sc->hw, &sc->hw_check_work);
- }
-
- /*
-diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
-index 38bc5a7..1221469 100644
---- a/drivers/net/wireless/b43/dma.c
-+++ b/drivers/net/wireless/b43/dma.c
-@@ -1487,8 +1487,12 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
- const struct b43_dma_ops *ops;
- struct b43_dmaring *ring;
- struct b43_dmadesc_meta *meta;
-+ static const struct b43_txstatus fake; /* filled with 0 */
-+ const struct b43_txstatus *txstat;
- int slot, firstused;
- bool frame_succeed;
-+ int skip;
-+ static u8 err_out1, err_out2;
-
- ring = parse_cookie(dev, status->cookie, &slot);
- if (unlikely(!ring))
-@@ -1501,13 +1505,36 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
- firstused = ring->current_slot - ring->used_slots + 1;
- if (firstused < 0)
- firstused = ring->nr_slots + firstused;
-+
-+ skip = 0;
- if (unlikely(slot != firstused)) {
- /* This possibly is a firmware bug and will result in
-- * malfunction, memory leaks and/or stall of DMA functionality. */
-- b43dbg(dev->wl, "Out of order TX status report on DMA ring %d. "
-- "Expected %d, but got %d\n",
-- ring->index, firstused, slot);
-- return;
-+ * malfunction, memory leaks and/or stall of DMA functionality.
-+ */
-+ if (slot == next_slot(ring, next_slot(ring, firstused))) {
-+ /* If a single header/data pair was missed, skip over
-+ * the first two slots in an attempt to recover.
-+ */
-+ slot = firstused;
-+ skip = 2;
-+ if (!err_out1) {
-+ /* Report the error once. */
-+ b43dbg(dev->wl,
-+ "Skip on DMA ring %d slot %d.\n",
-+ ring->index, slot);
-+ err_out1 = 1;
-+ }
-+ } else {
-+ /* More than a single header/data pair were missed.
-+ * Report this error once.
-+ */
-+ if (!err_out2)
-+ b43dbg(dev->wl,
-+ "Out of order TX status report on DMA ring %d. Expected %d, but got %d\n",
-+ ring->index, firstused, slot);
-+ err_out2 = 1;
-+ return;
-+ }
- }
-
- ops = ring->ops;
-@@ -1522,11 +1549,13 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
- slot, firstused, ring->index);
- break;
- }
-+
- if (meta->skb) {
- struct b43_private_tx_info *priv_info =
-- b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
-+ b43_get_priv_tx_info(IEEE80211_SKB_CB(meta->skb));
-
-- unmap_descbuffer(ring, meta->dmaaddr, meta->skb->len, 1);
-+ unmap_descbuffer(ring, meta->dmaaddr,
-+ meta->skb->len, 1);
- kfree(priv_info->bouncebuffer);
- priv_info->bouncebuffer = NULL;
- } else {
-@@ -1538,8 +1567,9 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
- struct ieee80211_tx_info *info;
-
- if (unlikely(!meta->skb)) {
-- /* This is a scatter-gather fragment of a frame, so
-- * the skb pointer must not be NULL. */
-+ /* This is a scatter-gather fragment of a frame,
-+ * so the skb pointer must not be NULL.
-+ */
- b43dbg(dev->wl, "TX status unexpected NULL skb "
- "at slot %d (first=%d) on ring %d\n",
- slot, firstused, ring->index);
-@@ -1550,9 +1580,18 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
-
- /*
- * Call back to inform the ieee80211 subsystem about
-- * the status of the transmission.
-+ * the status of the transmission. When skipping over
-+ * a missed TX status report, use a status structure
-+ * filled with zeros to indicate that the frame was not
-+ * sent (frame_count 0) and not acknowledged
- */
-- frame_succeed = b43_fill_txstatus_report(dev, info, status);
-+ if (unlikely(skip))
-+ txstat = &fake;
-+ else
-+ txstat = status;
-+
-+ frame_succeed = b43_fill_txstatus_report(dev, info,
-+ txstat);
- #ifdef CONFIG_B43_DEBUG
- if (frame_succeed)
- ring->nr_succeed_tx_packets++;
-@@ -1580,12 +1619,14 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
- /* Everything unmapped and free'd. So it's not used anymore. */
- ring->used_slots--;
-
-- if (meta->is_last_fragment) {
-+ if (meta->is_last_fragment && !skip) {
- /* This is the last scatter-gather
- * fragment of the frame. We are done. */
- break;
- }
- slot = next_slot(ring, slot);
-+ if (skip > 0)
-+ --skip;
- }
- if (ring->stopped) {
- B43_WARN_ON(free_slots(ring) < TX_SLOTS_PER_FRAME);
-diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
-index 3c35382..e8486c1 100644
---- a/drivers/net/wireless/b43/phy_n.c
-+++ b/drivers/net/wireless/b43/phy_n.c
-@@ -1564,7 +1564,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
- u16 clip_off[2] = { 0xFFFF, 0xFFFF };
-
- u8 vcm_final = 0;
-- s8 offset[4];
-+ s32 offset[4];
- s32 results[8][4] = { };
- s32 results_min[4] = { };
- s32 poll_results[4] = { };
-@@ -1615,7 +1615,7 @@ static void b43_nphy_rev3_rssi_cal(struct b43_wldev *dev)
- }
- for (i = 0; i < 4; i += 2) {
- s32 curr;
-- s32 mind = 40;
-+ s32 mind = 0x100000;
- s32 minpoll = 249;
- u8 minvcm = 0;
- if (2 * core != i)
-@@ -1732,7 +1732,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
- u8 regs_save_radio[2];
- u16 regs_save_phy[2];
-
-- s8 offset[4];
-+ s32 offset[4];
- u8 core;
- u8 rail;
-
-@@ -1799,7 +1799,7 @@ static void b43_nphy_rev2_rssi_cal(struct b43_wldev *dev, u8 type)
- }
-
- for (i = 0; i < 4; i++) {
-- s32 mind = 40;
-+ s32 mind = 0x100000;
- u8 minvcm = 0;
- s32 minpoll = 249;
- s32 curr;
-diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
-index 6ff4660..0348f42 100644
---- a/drivers/net/wireless/iwlwifi/dvm/lib.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
-@@ -1262,6 +1262,15 @@ int iwl_dvm_send_cmd(struct iwl_priv *priv, struct iwl_host_cmd *cmd)
- }
-
- /*
-+ * This can happen upon FW ASSERT: we clear the STATUS_FW_ERROR flag
-+ * in iwl_down but cancel the workers only later.
-+ */
-+ if (!priv->ucode_loaded) {
-+ IWL_ERR(priv, "Fw not loaded - dropping CMD: %x\n", cmd->id);
-+ return -EIO;
-+ }
-+
-+ /*
- * Synchronous commands from this op-mode must hold
- * the mutex, this ensures we don't try to send two
- * (or more) synchronous commands at a time.
-diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
-index c6467e5..9b138b8 100644
---- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
-+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
-@@ -450,6 +450,8 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
- return -EIO;
- }
-
-+ priv->ucode_loaded = true;
-+
- /*
- * This step takes a long time (60-80ms!!) and
- * WoWLAN image should be loaded quickly, so
-@@ -474,8 +476,6 @@ int iwl_load_ucode_wait_alive(struct iwl_priv *priv,
- return ret;
- }
-
-- priv->ucode_loaded = true;
--
- return 0;
- }
-
-diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
-index c6cd922..d760da9 100644
---- a/drivers/net/wireless/iwlwifi/pcie/tx.c
-+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
-@@ -1242,7 +1242,7 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
- for (i = 0; i < IWL_MAX_CMD_TFDS; i++) {
- int copy = 0;
-
-- if (!cmd->len)
-+ if (!cmd->len[i])
- continue;
-
- /* need at least IWL_HCMD_MIN_COPY_SIZE copied */
-diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
-index 5f438e6..bc9a402 100644
---- a/drivers/net/wireless/mwifiex/cmdevt.c
-+++ b/drivers/net/wireless/mwifiex/cmdevt.c
-@@ -156,6 +156,20 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
- return -1;
- }
-
-+ cmd_code = le16_to_cpu(host_cmd->command);
-+ cmd_size = le16_to_cpu(host_cmd->size);
-+
-+ if (adapter->hw_status == MWIFIEX_HW_STATUS_RESET &&
-+ cmd_code != HostCmd_CMD_FUNC_SHUTDOWN &&
-+ cmd_code != HostCmd_CMD_FUNC_INIT) {
-+ dev_err(adapter->dev,
-+ "DNLD_CMD: FW in reset state, ignore cmd %#x\n",
-+ cmd_code);
-+ mwifiex_complete_cmd(adapter, cmd_node);
-+ mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
-+ return -1;
-+ }
-+
- /* Set command sequence number */
- adapter->seq_num++;
- host_cmd->seq_num = cpu_to_le16(HostCmd_SET_SEQ_NO_BSS_INFO
-@@ -167,9 +181,6 @@ static int mwifiex_dnld_cmd_to_fw(struct mwifiex_private *priv,
- adapter->curr_cmd = cmd_node;
- spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
-
-- cmd_code = le16_to_cpu(host_cmd->command);
-- cmd_size = le16_to_cpu(host_cmd->size);
--
- /* Adjust skb length */
- if (cmd_node->cmd_skb->len > cmd_size)
- /*
-@@ -488,8 +499,6 @@ int mwifiex_send_cmd_sync(struct mwifiex_private *priv, uint16_t cmd_no,
-
- ret = mwifiex_send_cmd_async(priv, cmd_no, cmd_action, cmd_oid,
- data_buf);
-- if (!ret)
-- ret = mwifiex_wait_queue_complete(adapter);
-
- return ret;
- }
-@@ -592,9 +601,10 @@ int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
- if (cmd_no == HostCmd_CMD_802_11_SCAN) {
- mwifiex_queue_scan_cmd(priv, cmd_node);
- } else {
-- adapter->cmd_queued = cmd_node;
- mwifiex_insert_cmd_to_pending_q(adapter, cmd_node, true);
- queue_work(adapter->workqueue, &adapter->main_work);
-+ if (cmd_node->wait_q_enabled)
-+ ret = mwifiex_wait_queue_complete(adapter, cmd_node);
- }
-
- return ret;
-diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
-index 39f03ce..78c3aa6 100644
---- a/drivers/net/wireless/mwifiex/init.c
-+++ b/drivers/net/wireless/mwifiex/init.c
-@@ -707,6 +707,14 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
- return ret;
- }
-
-+ /* cancel current command */
-+ if (adapter->curr_cmd) {
-+ dev_warn(adapter->dev, "curr_cmd is still in processing\n");
-+ del_timer(&adapter->cmd_timer);
-+ mwifiex_insert_cmd_to_free_q(adapter, adapter->curr_cmd);
-+ adapter->curr_cmd = NULL;
-+ }
-+
- /* shut down mwifiex */
- dev_dbg(adapter->dev, "info: shutdown mwifiex...\n");
-
-diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
-index 1b3cfc8..db39449 100644
---- a/drivers/net/wireless/mwifiex/main.h
-+++ b/drivers/net/wireless/mwifiex/main.h
-@@ -714,7 +714,6 @@ struct mwifiex_adapter {
- u16 cmd_wait_q_required;
- struct mwifiex_wait_queue cmd_wait_q;
- u8 scan_wait_q_woken;
-- struct cmd_ctrl_node *cmd_queued;
- spinlock_t queue_lock; /* lock for tx queues */
- struct completion fw_load;
- u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
-@@ -994,7 +993,8 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
- struct mwifiex_multicast_list *mcast_list);
- int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
- struct net_device *dev);
--int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter);
-+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
-+ struct cmd_ctrl_node *cmd_queued);
- int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
- struct cfg80211_ssid *req_ssid);
- int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type);
-diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
-index 973a9d9..8955a0e 100644
---- a/drivers/net/wireless/mwifiex/scan.c
-+++ b/drivers/net/wireless/mwifiex/scan.c
-@@ -1366,10 +1366,13 @@ int mwifiex_scan_networks(struct mwifiex_private *priv,
- list_del(&cmd_node->list);
- spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
- flags);
-- adapter->cmd_queued = cmd_node;
- mwifiex_insert_cmd_to_pending_q(adapter, cmd_node,
- true);
- queue_work(adapter->workqueue, &adapter->main_work);
-+
-+ /* Perform internal scan synchronously */
-+ if (!priv->scan_request)
-+ mwifiex_wait_queue_complete(adapter, cmd_node);
- } else {
- spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
- flags);
-@@ -1923,9 +1926,6 @@ int mwifiex_request_scan(struct mwifiex_private *priv,
- /* Normal scan */
- ret = mwifiex_scan_networks(priv, NULL);
-
-- if (!ret)
-- ret = mwifiex_wait_queue_complete(priv->adapter);
--
- up(&priv->async_sem);
-
- return ret;
-diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
-index f542bb8..1798bc7 100644
---- a/drivers/net/wireless/mwifiex/sta_ioctl.c
-+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
-@@ -54,16 +54,10 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
- * This function waits on a cmd wait queue. It also cancels the pending
- * request after waking up, in case of errors.
- */
--int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
-+int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter,
-+ struct cmd_ctrl_node *cmd_queued)
- {
- int status;
-- struct cmd_ctrl_node *cmd_queued;
--
-- if (!adapter->cmd_queued)
-- return 0;
--
-- cmd_queued = adapter->cmd_queued;
-- adapter->cmd_queued = NULL;
-
- dev_dbg(adapter->dev, "cmd pending\n");
- atomic_inc(&adapter->cmd_pending);
-diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
-index 2106fcf..82bc684 100644
---- a/drivers/net/wireless/rtlwifi/usb.c
-+++ b/drivers/net/wireless/rtlwifi/usb.c
-@@ -854,6 +854,7 @@ static void _rtl_usb_transmit(struct ieee80211_hw *hw, struct sk_buff *skb,
- if (unlikely(!_urb)) {
- RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
- "Can't allocate urb. Drop skb!\n");
-+ kfree_skb(skb);
- return;
- }
- urb_list = &rtlusb->tx_pending[ep_num];
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 2785843..5a0f54a 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -200,8 +200,8 @@ static int regulator_check_consumers(struct regulator_dev *rdev,
- }
-
- if (*min_uV > *max_uV) {
-- dev_err(regulator->dev, "Restricting voltage, %u-%uuV\n",
-- regulator->min_uV, regulator->max_uV);
-+ rdev_err(rdev, "Restricting voltage, %u-%uuV\n",
-+ *min_uV, *max_uV);
- return -EINVAL;
- }
-
-diff --git a/drivers/staging/comedi/drivers/s626.c b/drivers/staging/comedi/drivers/s626.c
-index 6dc1d28..5b65b52 100644
---- a/drivers/staging/comedi/drivers/s626.c
-+++ b/drivers/staging/comedi/drivers/s626.c
-@@ -1482,7 +1482,7 @@ static int s626_ai_cmd(struct comedi_device *dev, struct comedi_subdevice *s)
- case TRIG_NONE:
- /* continous acquisition */
- devpriv->ai_continous = 1;
-- devpriv->ai_sample_count = 0;
-+ devpriv->ai_sample_count = 1;
- break;
- }
-
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index bd587b7..fcf880f 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -1136,8 +1136,10 @@ target_setup_cmd_from_cdb(struct se_cmd *cmd, unsigned char *cdb)
- return ret;
-
- ret = target_check_reservation(cmd);
-- if (ret)
-+ if (ret) {
-+ cmd->scsi_status = SAM_STAT_RESERVATION_CONFLICT;
- return ret;
-+ }
-
- ret = dev->transport->parse_cdb(cmd);
- if (ret)
-diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
-index 922e85a..2d2288d 100644
---- a/drivers/tty/serial/atmel_serial.c
-+++ b/drivers/tty/serial/atmel_serial.c
-@@ -158,7 +158,7 @@ struct atmel_uart_port {
- };
-
- static struct atmel_uart_port atmel_ports[ATMEL_MAX_UART];
--static unsigned long atmel_ports_in_use;
-+static DECLARE_BITMAP(atmel_ports_in_use, ATMEL_MAX_UART);
-
- #ifdef SUPPORT_SYSRQ
- static struct console atmel_console;
-@@ -1768,15 +1768,14 @@ static int atmel_serial_probe(struct platform_device *pdev)
- if (ret < 0)
- /* port id not found in platform data nor device-tree aliases:
- * auto-enumerate it */
-- ret = find_first_zero_bit(&atmel_ports_in_use,
-- sizeof(atmel_ports_in_use));
-+ ret = find_first_zero_bit(atmel_ports_in_use, ATMEL_MAX_UART);
-
-- if (ret > ATMEL_MAX_UART) {
-+ if (ret >= ATMEL_MAX_UART) {
- ret = -ENODEV;
- goto err;
- }
-
-- if (test_and_set_bit(ret, &atmel_ports_in_use)) {
-+ if (test_and_set_bit(ret, atmel_ports_in_use)) {
- /* port already in use */
- ret = -EBUSY;
- goto err;
-@@ -1856,7 +1855,7 @@ static int atmel_serial_remove(struct platform_device *pdev)
-
- /* "port" is allocated statically, so we shouldn't free it */
-
-- clear_bit(port->line, &atmel_ports_in_use);
-+ clear_bit(port->line, atmel_ports_in_use);
-
- clk_put(atmel_port->clk);
-
-diff --git a/drivers/tty/vt/vc_screen.c b/drivers/tty/vt/vc_screen.c
-index fa7268a..6abb92c 100644
---- a/drivers/tty/vt/vc_screen.c
-+++ b/drivers/tty/vt/vc_screen.c
-@@ -93,7 +93,7 @@ vcs_poll_data_free(struct vcs_poll_data *poll)
- static struct vcs_poll_data *
- vcs_poll_data_get(struct file *file)
- {
-- struct vcs_poll_data *poll = file->private_data;
-+ struct vcs_poll_data *poll = file->private_data, *kill = NULL;
-
- if (poll)
- return poll;
-@@ -122,10 +122,12 @@ vcs_poll_data_get(struct file *file)
- file->private_data = poll;
- } else {
- /* someone else raced ahead of us */
-- vcs_poll_data_free(poll);
-+ kill = poll;
- poll = file->private_data;
- }
- spin_unlock(&file->f_lock);
-+ if (kill)
-+ vcs_poll_data_free(kill);
-
- return poll;
- }
-diff --git a/drivers/usb/gadget/udc-core.c b/drivers/usb/gadget/udc-core.c
-index 4d90a80..34a3907 100644
---- a/drivers/usb/gadget/udc-core.c
-+++ b/drivers/usb/gadget/udc-core.c
-@@ -265,7 +265,7 @@ static void usb_gadget_remove_driver(struct usb_udc *udc)
- usb_gadget_disconnect(udc->gadget);
- udc->driver->disconnect(udc->gadget);
- udc->driver->unbind(udc->gadget);
-- usb_gadget_udc_stop(udc->gadget, udc->driver);
-+ usb_gadget_udc_stop(udc->gadget, NULL);
- } else {
- usb_gadget_stop(udc->gadget, udc->driver);
- }
-diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
-index b476daf..010f686 100644
---- a/drivers/usb/host/ehci-sched.c
-+++ b/drivers/usb/host/ehci-sched.c
-@@ -1214,6 +1214,7 @@ itd_urb_transaction (
-
- memset (itd, 0, sizeof *itd);
- itd->itd_dma = itd_dma;
-+ itd->frame = 9999; /* an invalid value */
- list_add (&itd->itd_list, &sched->td_list);
- }
- spin_unlock_irqrestore (&ehci->lock, flags);
-@@ -1915,6 +1916,7 @@ sitd_urb_transaction (
-
- memset (sitd, 0, sizeof *sitd);
- sitd->sitd_dma = sitd_dma;
-+ sitd->frame = 9999; /* an invalid value */
- list_add (&sitd->sitd_list, &iso_sched->td_list);
- }
-
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index 7f76a49..f2845f1 100644
---- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -2027,8 +2027,8 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
- if (event_trb != ep_ring->dequeue &&
- event_trb != td->last_trb)
- td->urb->actual_length =
-- td->urb->transfer_buffer_length
-- - TRB_LEN(le32_to_cpu(event->transfer_len));
-+ td->urb->transfer_buffer_length -
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
- else
- td->urb->actual_length = 0;
-
-@@ -2060,7 +2060,7 @@ static int process_ctrl_td(struct xhci_hcd *xhci, struct xhci_td *td,
- /* Maybe the event was for the data stage? */
- td->urb->actual_length =
- td->urb->transfer_buffer_length -
-- TRB_LEN(le32_to_cpu(event->transfer_len));
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
- xhci_dbg(xhci, "Waiting for status "
- "stage event\n");
- return 0;
-@@ -2096,7 +2096,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
- /* handle completion code */
- switch (trb_comp_code) {
- case COMP_SUCCESS:
-- if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
-+ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0) {
- frame->status = 0;
- break;
- }
-@@ -2141,7 +2141,7 @@ static int process_isoc_td(struct xhci_hcd *xhci, struct xhci_td *td,
- len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2]));
- }
- len += TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-- TRB_LEN(le32_to_cpu(event->transfer_len));
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
-
- if (trb_comp_code != COMP_STOP_INVAL) {
- frame->actual_length = len;
-@@ -2199,7 +2199,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
- case COMP_SUCCESS:
- /* Double check that the HW transferred everything. */
- if (event_trb != td->last_trb ||
-- TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
- xhci_warn(xhci, "WARN Successful completion "
- "on short TX\n");
- if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
-@@ -2227,18 +2227,18 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
- "%d bytes untransferred\n",
- td->urb->ep->desc.bEndpointAddress,
- td->urb->transfer_buffer_length,
-- TRB_LEN(le32_to_cpu(event->transfer_len)));
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
- /* Fast path - was this the last TRB in the TD for this URB? */
- if (event_trb == td->last_trb) {
-- if (TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
-+ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) != 0) {
- td->urb->actual_length =
- td->urb->transfer_buffer_length -
-- TRB_LEN(le32_to_cpu(event->transfer_len));
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
- if (td->urb->transfer_buffer_length <
- td->urb->actual_length) {
- xhci_warn(xhci, "HC gave bad length "
- "of %d bytes left\n",
-- TRB_LEN(le32_to_cpu(event->transfer_len)));
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)));
- td->urb->actual_length = 0;
- if (td->urb->transfer_flags & URB_SHORT_NOT_OK)
- *status = -EREMOTEIO;
-@@ -2280,7 +2280,7 @@ static int process_bulk_intr_td(struct xhci_hcd *xhci, struct xhci_td *td,
- if (trb_comp_code != COMP_STOP_INVAL)
- td->urb->actual_length +=
- TRB_LEN(le32_to_cpu(cur_trb->generic.field[2])) -
-- TRB_LEN(le32_to_cpu(event->transfer_len));
-+ EVENT_TRB_LEN(le32_to_cpu(event->transfer_len));
- }
-
- return finish_td(xhci, td, event_trb, event, ep, status, false);
-@@ -2368,7 +2368,7 @@ static int handle_tx_event(struct xhci_hcd *xhci,
- * transfer type
- */
- case COMP_SUCCESS:
-- if (TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
-+ if (EVENT_TRB_LEN(le32_to_cpu(event->transfer_len)) == 0)
- break;
- if (xhci->quirks & XHCI_TRUST_TX_LENGTH)
- trb_comp_code = COMP_SHORT_TX;
-diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
-index 2c510e4..6a563ef 100644
---- a/drivers/usb/host/xhci.h
-+++ b/drivers/usb/host/xhci.h
-@@ -972,6 +972,10 @@ struct xhci_transfer_event {
- __le32 flags;
- };
-
-+/* Transfer event TRB length bit mask */
-+/* bits 0:23 */
-+#define EVENT_TRB_LEN(p) ((p) & 0xffffff)
-+
- /** Transfer Event bit fields **/
- #define TRB_TO_EP_ID(p) (((p) >> 16) & 0x1f)
-
-diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c
-index a88882c..0b44e45 100644
---- a/drivers/usb/serial/ark3116.c
-+++ b/drivers/usb/serial/ark3116.c
-@@ -62,7 +62,6 @@ static int is_irda(struct usb_serial *serial)
- }
-
- struct ark3116_private {
-- wait_queue_head_t delta_msr_wait;
- struct async_icount icount;
- int irda; /* 1 for irda device */
-
-@@ -146,7 +145,6 @@ static int ark3116_port_probe(struct usb_serial_port *port)
- if (!priv)
- return -ENOMEM;
-
-- init_waitqueue_head(&priv->delta_msr_wait);
- mutex_init(&priv->hw_lock);
- spin_lock_init(&priv->status_lock);
-
-@@ -456,10 +454,14 @@ static int ark3116_ioctl(struct tty_struct *tty,
- case TIOCMIWAIT:
- for (;;) {
- struct async_icount prev = priv->icount;
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- if ((prev.rng == priv->icount.rng) &&
- (prev.dsr == priv->icount.dsr) &&
- (prev.dcd == priv->icount.dcd) &&
-@@ -580,7 +582,7 @@ static void ark3116_update_msr(struct usb_serial_port *port, __u8 msr)
- priv->icount.dcd++;
- if (msr & UART_MSR_TERI)
- priv->icount.rng++;
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- }
- }
-
-diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
-index d255f66..07d4650 100644
---- a/drivers/usb/serial/ch341.c
-+++ b/drivers/usb/serial/ch341.c
-@@ -80,7 +80,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
-
- struct ch341_private {
- spinlock_t lock; /* access lock */
-- wait_queue_head_t delta_msr_wait; /* wait queue for modem status */
- unsigned baud_rate; /* set baud rate */
- u8 line_control; /* set line control value RTS/DTR */
- u8 line_status; /* active status of modem control inputs */
-@@ -252,7 +251,6 @@ static int ch341_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->lock);
-- init_waitqueue_head(&priv->delta_msr_wait);
- priv->baud_rate = DEFAULT_BAUD_RATE;
- priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR;
-
-@@ -298,7 +296,7 @@ static void ch341_dtr_rts(struct usb_serial_port *port, int on)
- priv->line_control &= ~(CH341_BIT_RTS | CH341_BIT_DTR);
- spin_unlock_irqrestore(&priv->lock, flags);
- ch341_set_handshake(port->serial->dev, priv->line_control);
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- }
-
- static void ch341_close(struct usb_serial_port *port)
-@@ -491,7 +489,7 @@ static void ch341_read_int_callback(struct urb *urb)
- tty_kref_put(tty);
- }
-
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- }
-
- exit:
-@@ -517,11 +515,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- spin_unlock_irqrestore(&priv->lock, flags);
-
- while (!multi_change) {
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->lock, flags);
- status = priv->line_status;
- multi_change = priv->multi_status_change;
-diff --git a/drivers/usb/serial/cypress_m8.c b/drivers/usb/serial/cypress_m8.c
-index fd8c35f..a06076f 100644
---- a/drivers/usb/serial/cypress_m8.c
-+++ b/drivers/usb/serial/cypress_m8.c
-@@ -111,7 +111,6 @@ struct cypress_private {
- int baud_rate; /* stores current baud rate in
- integer form */
- int isthrottled; /* if throttled, discard reads */
-- wait_queue_head_t delta_msr_wait; /* used for TIOCMIWAIT */
- char prev_status, diff_status; /* used for TIOCMIWAIT */
- /* we pass a pointer to this as the argument sent to
- cypress_set_termios old_termios */
-@@ -449,7 +448,6 @@ static int cypress_generic_port_probe(struct usb_serial_port *port)
- kfree(priv);
- return -ENOMEM;
- }
-- init_waitqueue_head(&priv->delta_msr_wait);
-
- usb_reset_configuration(serial->dev);
-
-@@ -868,12 +866,16 @@ static int cypress_ioctl(struct tty_struct *tty,
- switch (cmd) {
- /* This code comes from drivers/char/serial.c and ftdi_sio.c */
- case TIOCMIWAIT:
-- while (priv != NULL) {
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ for (;;) {
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-- else {
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
-+ {
- char diff = priv->diff_status;
- if (diff == 0)
- return -EIO; /* no change => error */
-@@ -1187,7 +1189,7 @@ static void cypress_read_int_callback(struct urb *urb)
- if (priv->current_status != priv->prev_status) {
- priv->diff_status |= priv->current_status ^
- priv->prev_status;
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- priv->prev_status = priv->current_status;
- }
- spin_unlock_irqrestore(&priv->lock, flags);
-diff --git a/drivers/usb/serial/f81232.c b/drivers/usb/serial/f81232.c
-index 6e4eb57..1e64343 100644
---- a/drivers/usb/serial/f81232.c
-+++ b/drivers/usb/serial/f81232.c
-@@ -47,7 +47,6 @@ MODULE_DEVICE_TABLE(usb, id_table);
-
- struct f81232_private {
- spinlock_t lock;
-- wait_queue_head_t delta_msr_wait;
- u8 line_control;
- u8 line_status;
- };
-@@ -112,7 +111,7 @@ static void f81232_process_read_urb(struct urb *urb)
- line_status = priv->line_status;
- priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
- spin_unlock_irqrestore(&priv->lock, flags);
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
-
- if (!urb->actual_length)
- return;
-@@ -261,11 +260,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- spin_unlock_irqrestore(&priv->lock, flags);
-
- while (1) {
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->lock, flags);
- status = priv->line_status;
- spin_unlock_irqrestore(&priv->lock, flags);
-@@ -327,7 +329,6 @@ static int f81232_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->lock);
-- init_waitqueue_head(&priv->delta_msr_wait);
-
- usb_set_serial_port_data(port, priv);
-
-diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
-index d07fccf..8e4f40b 100644
---- a/drivers/usb/serial/ftdi_sio.c
-+++ b/drivers/usb/serial/ftdi_sio.c
-@@ -69,9 +69,7 @@ struct ftdi_private {
- int flags; /* some ASYNC_xxxx flags are supported */
- unsigned long last_dtr_rts; /* saved modem control outputs */
- struct async_icount icount;
-- wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
- char prev_status; /* Used for TIOCMIWAIT */
-- bool dev_gone; /* Used to abort TIOCMIWAIT */
- char transmit_empty; /* If transmitter is empty or not */
- __u16 interface; /* FT2232C, FT2232H or FT4232H port interface
- (0 for FT232/245) */
-@@ -642,6 +640,7 @@ static struct usb_device_id id_table_combined [] = {
- { USB_DEVICE(FTDI_VID, FTDI_RM_CANVIEW_PID) },
- { USB_DEVICE(ACTON_VID, ACTON_SPECTRAPRO_PID) },
- { USB_DEVICE(CONTEC_VID, CONTEC_COM1USBH_PID) },
-+ { USB_DEVICE(MITSUBISHI_VID, MITSUBISHI_FXUSB_PID) },
- { USB_DEVICE(BANDB_VID, BANDB_USOTL4_PID) },
- { USB_DEVICE(BANDB_VID, BANDB_USTL4_PID) },
- { USB_DEVICE(BANDB_VID, BANDB_USO9ML2_PID) },
-@@ -1691,10 +1690,8 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
-
- kref_init(&priv->kref);
- mutex_init(&priv->cfg_lock);
-- init_waitqueue_head(&priv->delta_msr_wait);
-
- priv->flags = ASYNC_LOW_LATENCY;
-- priv->dev_gone = false;
-
- if (quirk && quirk->port_probe)
- quirk->port_probe(priv);
-@@ -1840,8 +1837,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
- {
- struct ftdi_private *priv = usb_get_serial_port_data(port);
-
-- priv->dev_gone = true;
-- wake_up_interruptible_all(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
-
- remove_sysfs_attrs(port);
-
-@@ -1990,7 +1986,7 @@ static int ftdi_process_packet(struct tty_struct *tty,
- if (diff_status & FTDI_RS0_RLSD)
- priv->icount.dcd++;
-
-- wake_up_interruptible_all(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- priv->prev_status = status;
- }
-
-@@ -2447,11 +2443,15 @@ static int ftdi_ioctl(struct tty_struct *tty,
- */
- case TIOCMIWAIT:
- cprev = priv->icount;
-- while (!priv->dev_gone) {
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ for (;;) {
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- cnow = priv->icount;
- if (((arg & TIOCM_RNG) && (cnow.rng != cprev.rng)) ||
- ((arg & TIOCM_DSR) && (cnow.dsr != cprev.dsr)) ||
-@@ -2461,8 +2461,6 @@ static int ftdi_ioctl(struct tty_struct *tty,
- }
- cprev = cnow;
- }
-- return -EIO;
-- break;
- case TIOCSERGETLSR:
- return get_lsr_info(port, (struct serial_struct __user *)arg);
- break;
-diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
-index 9d359e1..e79861e 100644
---- a/drivers/usb/serial/ftdi_sio_ids.h
-+++ b/drivers/usb/serial/ftdi_sio_ids.h
-@@ -584,6 +584,13 @@
- #define CONTEC_COM1USBH_PID 0x8311 /* COM-1(USB)H */
-
- /*
-+ * Mitsubishi Electric Corp. (http://www.meau.com)
-+ * Submitted by Konstantin Holoborodko
-+ */
-+#define MITSUBISHI_VID 0x06D3
-+#define MITSUBISHI_FXUSB_PID 0x0284 /* USB/RS422 converters: FX-USB-AW/-BD */
-+
-+/*
- * Definitions for B&B Electronics products.
- */
- #define BANDB_VID 0x0856 /* B&B Electronics Vendor ID */
-diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
-index 7b770c7..adfd73d 100644
---- a/drivers/usb/serial/io_edgeport.c
-+++ b/drivers/usb/serial/io_edgeport.c
-@@ -110,7 +110,6 @@ struct edgeport_port {
- wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */
- wait_queue_head_t wait_open; /* for handling sleeping while waiting for open to finish */
- wait_queue_head_t wait_command; /* for handling sleeping while waiting for command to finish */
-- wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */
-
- struct async_icount icount;
- struct usb_serial_port *port; /* loop back to the owner of this object */
-@@ -884,7 +883,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
- /* initialize our wait queues */
- init_waitqueue_head(&edge_port->wait_open);
- init_waitqueue_head(&edge_port->wait_chase);
-- init_waitqueue_head(&edge_port->delta_msr_wait);
- init_waitqueue_head(&edge_port->wait_command);
-
- /* initialize our icount structure */
-@@ -1669,13 +1667,17 @@ static int edge_ioctl(struct tty_struct *tty,
- dev_dbg(&port->dev, "%s (%d) TIOCMIWAIT\n", __func__, port->number);
- cprev = edge_port->icount;
- while (1) {
-- prepare_to_wait(&edge_port->delta_msr_wait,
-+ prepare_to_wait(&port->delta_msr_wait,
- &wait, TASK_INTERRUPTIBLE);
- schedule();
-- finish_wait(&edge_port->delta_msr_wait, &wait);
-+ finish_wait(&port->delta_msr_wait, &wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- cnow = edge_port->icount;
- if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
- cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
-@@ -2055,7 +2057,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 newMsr)
- icount->dcd++;
- if (newMsr & EDGEPORT_MSR_DELTA_RI)
- icount->rng++;
-- wake_up_interruptible(&edge_port->delta_msr_wait);
-+ wake_up_interruptible(&edge_port->port->delta_msr_wait);
- }
-
- /* Save the new modem status */
-diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
-index aa6462f..1db782d 100644
---- a/drivers/usb/serial/io_ti.c
-+++ b/drivers/usb/serial/io_ti.c
-@@ -87,9 +87,6 @@ struct edgeport_port {
- int close_pending;
- int lsr_event;
- struct async_icount icount;
-- wait_queue_head_t delta_msr_wait; /* for handling sleeping while
-- waiting for msr change to
-- happen */
- struct edgeport_serial *edge_serial;
- struct usb_serial_port *port;
- __u8 bUartMode; /* Port type, 0: RS232, etc. */
-@@ -1518,7 +1515,7 @@ static void handle_new_msr(struct edgeport_port *edge_port, __u8 msr)
- icount->dcd++;
- if (msr & EDGEPORT_MSR_DELTA_RI)
- icount->rng++;
-- wake_up_interruptible(&edge_port->delta_msr_wait);
-+ wake_up_interruptible(&edge_port->port->delta_msr_wait);
- }
-
- /* Save the new modem status */
-@@ -1821,7 +1818,6 @@ static int edge_open(struct tty_struct *tty, struct usb_serial_port *port)
- dev = port->serial->dev;
-
- memset(&(edge_port->icount), 0x00, sizeof(edge_port->icount));
-- init_waitqueue_head(&edge_port->delta_msr_wait);
-
- /* turn off loopback */
- status = ti_do_config(edge_port, UMPC_SET_CLR_LOOPBACK, 0);
-@@ -2488,10 +2484,14 @@ static int edge_ioctl(struct tty_struct *tty,
- dev_dbg(&port->dev, "%s - TIOCMIWAIT\n", __func__);
- cprev = edge_port->icount;
- while (1) {
-- interruptible_sleep_on(&edge_port->delta_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- cnow = edge_port->icount;
- if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
- cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
-diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c
-index d9c8651..3b9f834 100644
---- a/drivers/usb/serial/mct_u232.c
-+++ b/drivers/usb/serial/mct_u232.c
-@@ -114,8 +114,6 @@ struct mct_u232_private {
- unsigned char last_msr; /* Modem Status Register */
- unsigned int rx_flags; /* Throttling flags */
- struct async_icount icount;
-- wait_queue_head_t msr_wait; /* for handling sleeping while waiting
-- for msr change to happen */
- };
-
- #define THROTTLED 0x01
-@@ -409,7 +407,6 @@ static int mct_u232_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->lock);
-- init_waitqueue_head(&priv->msr_wait);
-
- usb_set_serial_port_data(port, priv);
-
-@@ -606,7 +603,7 @@ static void mct_u232_read_int_callback(struct urb *urb)
- tty_kref_put(tty);
- }
- #endif
-- wake_up_interruptible(&priv->msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- spin_unlock_irqrestore(&priv->lock, flags);
- exit:
- retval = usb_submit_urb(urb, GFP_ATOMIC);
-@@ -815,13 +812,17 @@ static int mct_u232_ioctl(struct tty_struct *tty,
- cprev = mct_u232_port->icount;
- spin_unlock_irqrestore(&mct_u232_port->lock, flags);
- for ( ; ; ) {
-- prepare_to_wait(&mct_u232_port->msr_wait,
-+ prepare_to_wait(&port->delta_msr_wait,
- &wait, TASK_INTERRUPTIBLE);
- schedule();
-- finish_wait(&mct_u232_port->msr_wait, &wait);
-+ finish_wait(&port->delta_msr_wait, &wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&mct_u232_port->lock, flags);
- cnow = mct_u232_port->icount;
- spin_unlock_irqrestore(&mct_u232_port->lock, flags);
-diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
-index 66d9e08..3b909e0 100644
---- a/drivers/usb/serial/mos7840.c
-+++ b/drivers/usb/serial/mos7840.c
-@@ -219,7 +219,6 @@ struct moschip_port {
- char open;
- char open_ports;
- wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */
-- wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */
- int delta_msr_cond;
- struct async_icount icount;
- struct usb_serial_port *port; /* loop back to the owner of this object */
-@@ -423,6 +422,9 @@ static void mos7840_handle_new_msr(struct moschip_port *port, __u8 new_msr)
- icount->rng++;
- smp_wmb();
- }
-+
-+ mos7840_port->delta_msr_cond = 1;
-+ wake_up_interruptible(&port->port->delta_msr_wait);
- }
- }
-
-@@ -1131,7 +1133,6 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port)
-
- /* initialize our wait queues */
- init_waitqueue_head(&mos7840_port->wait_chase);
-- init_waitqueue_head(&mos7840_port->delta_msr_wait);
-
- /* initialize our icount structure */
- memset(&(mos7840_port->icount), 0x00, sizeof(mos7840_port->icount));
-@@ -2021,8 +2022,6 @@ static void mos7840_change_port_settings(struct tty_struct *tty,
- mos7840_port->read_urb_busy = false;
- }
- }
-- wake_up(&mos7840_port->delta_msr_wait);
-- mos7840_port->delta_msr_cond = 1;
- dev_dbg(&port->dev, "%s - mos7840_port->shadowLCR is End %x\n", __func__,
- mos7840_port->shadowLCR);
- }
-@@ -2223,13 +2222,18 @@ static int mos7840_ioctl(struct tty_struct *tty,
- while (1) {
- /* interruptible_sleep_on(&mos7840_port->delta_msr_wait); */
- mos7840_port->delta_msr_cond = 0;
-- wait_event_interruptible(mos7840_port->delta_msr_wait,
-- (mos7840_port->
-+ wait_event_interruptible(port->delta_msr_wait,
-+ (port->serial->disconnected ||
-+ mos7840_port->
- delta_msr_cond == 1));
-
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- cnow = mos7840_port->icount;
- smp_rmb();
- if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
-diff --git a/drivers/usb/serial/oti6858.c b/drivers/usb/serial/oti6858.c
-index d217fd6..ae4495a 100644
---- a/drivers/usb/serial/oti6858.c
-+++ b/drivers/usb/serial/oti6858.c
-@@ -188,7 +188,6 @@ struct oti6858_private {
- u8 setup_done;
- struct delayed_work delayed_setup_work;
-
-- wait_queue_head_t intr_wait;
- struct usb_serial_port *port; /* USB port with which associated */
- };
-
-@@ -339,7 +338,6 @@ static int oti6858_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->lock);
-- init_waitqueue_head(&priv->intr_wait);
- priv->port = port;
- INIT_DELAYED_WORK(&priv->delayed_setup_work, setup_line);
- INIT_DELAYED_WORK(&priv->delayed_write_work, send_data);
-@@ -664,11 +662,15 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- spin_unlock_irqrestore(&priv->lock, flags);
-
- while (1) {
-- wait_event_interruptible(priv->intr_wait,
-+ wait_event_interruptible(port->delta_msr_wait,
-+ port->serial->disconnected ||
- priv->status.pin_state != prev);
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->lock, flags);
- status = priv->status.pin_state & PIN_MASK;
- spin_unlock_irqrestore(&priv->lock, flags);
-@@ -763,7 +765,7 @@ static void oti6858_read_int_callback(struct urb *urb)
-
- if (!priv->transient) {
- if (xs->pin_state != priv->status.pin_state)
-- wake_up_interruptible(&priv->intr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- memcpy(&priv->status, xs, OTI6858_CTRL_PKT_SIZE);
- }
-
-diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
-index 6002419..bb056a1 100644
---- a/drivers/usb/serial/pl2303.c
-+++ b/drivers/usb/serial/pl2303.c
-@@ -139,7 +139,6 @@ struct pl2303_serial_private {
-
- struct pl2303_private {
- spinlock_t lock;
-- wait_queue_head_t delta_msr_wait;
- u8 line_control;
- u8 line_status;
- };
-@@ -233,7 +232,6 @@ static int pl2303_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->lock);
-- init_waitqueue_head(&priv->delta_msr_wait);
-
- usb_set_serial_port_data(port, priv);
-
-@@ -607,11 +605,14 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- spin_unlock_irqrestore(&priv->lock, flags);
-
- while (1) {
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->lock, flags);
- status = priv->line_status;
- spin_unlock_irqrestore(&priv->lock, flags);
-@@ -719,7 +720,7 @@ static void pl2303_update_line_status(struct usb_serial_port *port,
- spin_unlock_irqrestore(&priv->lock, flags);
- if (priv->line_status & UART_BREAK_ERROR)
- usb_serial_handle_break(port);
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
-
- tty = tty_port_tty_get(&port->port);
- if (!tty)
-@@ -784,7 +785,7 @@ static void pl2303_process_read_urb(struct urb *urb)
- line_status = priv->line_status;
- priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
- spin_unlock_irqrestore(&priv->lock, flags);
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
-
- if (!urb->actual_length)
- return;
-diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c
-index a8d5110..9f34c99 100644
---- a/drivers/usb/serial/quatech2.c
-+++ b/drivers/usb/serial/quatech2.c
-@@ -128,7 +128,6 @@ struct qt2_port_private {
- u8 shadowLSR;
- u8 shadowMSR;
-
-- wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
- struct async_icount icount;
-
- struct usb_serial_port *port;
-@@ -506,8 +505,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- spin_unlock_irqrestore(&priv->lock, flags);
-
- while (1) {
-- wait_event_interruptible(priv->delta_msr_wait,
-- ((priv->icount.rng != prev.rng) ||
-+ wait_event_interruptible(port->delta_msr_wait,
-+ (port->serial->disconnected ||
-+ (priv->icount.rng != prev.rng) ||
- (priv->icount.dsr != prev.dsr) ||
- (priv->icount.dcd != prev.dcd) ||
- (priv->icount.cts != prev.cts)));
-@@ -515,6 +515,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->lock, flags);
- cur = priv->icount;
- spin_unlock_irqrestore(&priv->lock, flags);
-@@ -841,7 +844,6 @@ static int qt2_port_probe(struct usb_serial_port *port)
-
- spin_lock_init(&port_priv->lock);
- spin_lock_init(&port_priv->urb_lock);
-- init_waitqueue_head(&port_priv->delta_msr_wait);
- port_priv->port = port;
-
- port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
-@@ -984,7 +986,7 @@ static void qt2_update_msr(struct usb_serial_port *port, unsigned char *ch)
- if (newMSR & UART_MSR_TERI)
- port_priv->icount.rng++;
-
-- wake_up_interruptible(&port_priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- }
- }
-
-diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c
-index a42536a..85de44d 100644
---- a/drivers/usb/serial/spcp8x5.c
-+++ b/drivers/usb/serial/spcp8x5.c
-@@ -149,7 +149,6 @@ enum spcp8x5_type {
- struct spcp8x5_private {
- spinlock_t lock;
- enum spcp8x5_type type;
-- wait_queue_head_t delta_msr_wait;
- u8 line_control;
- u8 line_status;
- };
-@@ -179,7 +178,6 @@ static int spcp8x5_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->lock);
-- init_waitqueue_head(&priv->delta_msr_wait);
- priv->type = type;
-
- usb_set_serial_port_data(port , priv);
-@@ -476,7 +474,7 @@ static void spcp8x5_process_read_urb(struct urb *urb)
- priv->line_status &= ~UART_STATE_TRANSIENT_MASK;
- spin_unlock_irqrestore(&priv->lock, flags);
- /* wake up the wait for termios */
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
-
- if (!urb->actual_length)
- return;
-@@ -526,12 +524,15 @@ static int spcp8x5_wait_modem_info(struct usb_serial_port *port,
-
- while (1) {
- /* wake up in bulk read */
-- interruptible_sleep_on(&priv->delta_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
-
- /* see if a signal did it */
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->lock, flags);
- status = priv->line_status;
- spin_unlock_irqrestore(&priv->lock, flags);
-diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c
-index d938396..44d5949 100644
---- a/drivers/usb/serial/ssu100.c
-+++ b/drivers/usb/serial/ssu100.c
-@@ -61,7 +61,6 @@ struct ssu100_port_private {
- spinlock_t status_lock;
- u8 shadowLSR;
- u8 shadowMSR;
-- wait_queue_head_t delta_msr_wait; /* Used for TIOCMIWAIT */
- struct async_icount icount;
- };
-
-@@ -355,8 +354,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- spin_unlock_irqrestore(&priv->status_lock, flags);
-
- while (1) {
-- wait_event_interruptible(priv->delta_msr_wait,
-- ((priv->icount.rng != prev.rng) ||
-+ wait_event_interruptible(port->delta_msr_wait,
-+ (port->serial->disconnected ||
-+ (priv->icount.rng != prev.rng) ||
- (priv->icount.dsr != prev.dsr) ||
- (priv->icount.dcd != prev.dcd) ||
- (priv->icount.cts != prev.cts)));
-@@ -364,6 +364,9 @@ static int wait_modem_info(struct usb_serial_port *port, unsigned int arg)
- if (signal_pending(current))
- return -ERESTARTSYS;
-
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- spin_lock_irqsave(&priv->status_lock, flags);
- cur = priv->icount;
- spin_unlock_irqrestore(&priv->status_lock, flags);
-@@ -445,7 +448,6 @@ static int ssu100_port_probe(struct usb_serial_port *port)
- return -ENOMEM;
-
- spin_lock_init(&priv->status_lock);
-- init_waitqueue_head(&priv->delta_msr_wait);
-
- usb_set_serial_port_data(port, priv);
-
-@@ -537,7 +539,7 @@ static void ssu100_update_msr(struct usb_serial_port *port, u8 msr)
- priv->icount.dcd++;
- if (msr & UART_MSR_TERI)
- priv->icount.rng++;
-- wake_up_interruptible(&priv->delta_msr_wait);
-+ wake_up_interruptible(&port->delta_msr_wait);
- }
- }
-
-diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
-index f2530d2..4a8b685 100644
---- a/drivers/usb/serial/ti_usb_3410_5052.c
-+++ b/drivers/usb/serial/ti_usb_3410_5052.c
-@@ -74,7 +74,6 @@ struct ti_port {
- int tp_flags;
- int tp_closing_wait;/* in .01 secs */
- struct async_icount tp_icount;
-- wait_queue_head_t tp_msr_wait; /* wait for msr change */
- wait_queue_head_t tp_write_wait;
- struct ti_device *tp_tdev;
- struct usb_serial_port *tp_port;
-@@ -432,7 +431,6 @@ static int ti_port_probe(struct usb_serial_port *port)
- else
- tport->tp_uart_base_addr = TI_UART2_BASE_ADDR;
- tport->tp_closing_wait = closing_wait;
-- init_waitqueue_head(&tport->tp_msr_wait);
- init_waitqueue_head(&tport->tp_write_wait);
- if (kfifo_alloc(&tport->write_fifo, TI_WRITE_BUF_SIZE, GFP_KERNEL)) {
- kfree(tport);
-@@ -784,9 +782,13 @@ static int ti_ioctl(struct tty_struct *tty,
- dev_dbg(&port->dev, "%s - TIOCMIWAIT\n", __func__);
- cprev = tport->tp_icount;
- while (1) {
-- interruptible_sleep_on(&tport->tp_msr_wait);
-+ interruptible_sleep_on(&port->delta_msr_wait);
- if (signal_pending(current))
- return -ERESTARTSYS;
-+
-+ if (port->serial->disconnected)
-+ return -EIO;
-+
- cnow = tport->tp_icount;
- if (cnow.rng == cprev.rng && cnow.dsr == cprev.dsr &&
- cnow.dcd == cprev.dcd && cnow.cts == cprev.cts)
-@@ -1400,7 +1402,7 @@ static void ti_handle_new_msr(struct ti_port *tport, __u8 msr)
- icount->dcd++;
- if (msr & TI_MSR_DELTA_RI)
- icount->rng++;
-- wake_up_interruptible(&tport->tp_msr_wait);
-+ wake_up_interruptible(&tport->tp_port->delta_msr_wait);
- spin_unlock_irqrestore(&tport->tp_lock, flags);
- }
-
-diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
-index 3dc3ad2..dec95e8 100644
---- a/drivers/usb/serial/usb-serial.c
-+++ b/drivers/usb/serial/usb-serial.c
-@@ -897,6 +897,7 @@ static int usb_serial_probe(struct usb_interface *interface,
- port->port.ops = &serial_port_ops;
- port->serial = serial;
- spin_lock_init(&port->lock);
-+ init_waitqueue_head(&port->delta_msr_wait);
- /* Keep this for private driver use for the moment but
- should probably go away */
- INIT_WORK(&port->work, usb_serial_port_work);
-diff --git a/drivers/xen/events.c b/drivers/xen/events.c
-index 74d77df..8aa3867 100644
---- a/drivers/xen/events.c
-+++ b/drivers/xen/events.c
-@@ -388,11 +388,23 @@ static void unmask_evtchn(int port)
-
- if (unlikely((cpu != cpu_from_evtchn(port))))
- do_hypercall = 1;
-- else
-+ else {
-+ /*
-+ * Need to clear the mask before checking pending to
-+ * avoid a race with an event becoming pending.
-+ *
-+ * EVTCHNOP_unmask will only trigger an upcall if the
-+ * mask bit was set, so if a hypercall is needed
-+ * remask the event.
-+ */
-+ sync_clear_bit(port, &s->evtchn_mask[0]);
- evtchn_pending = sync_test_bit(port, &s->evtchn_pending[0]);
-
-- if (unlikely(evtchn_pending && xen_hvm_domain()))
-- do_hypercall = 1;
-+ if (unlikely(evtchn_pending && xen_hvm_domain())) {
-+ sync_set_bit(port, &s->evtchn_mask[0]);
-+ do_hypercall = 1;
-+ }
-+ }
-
- /* Slow path (hypercall) if this is a non-local port or if this is
- * an hvm domain and an event is pending (hvm domains don't have
-@@ -403,8 +415,6 @@ static void unmask_evtchn(int port)
- } else {
- struct vcpu_info *vcpu_info = __this_cpu_read(xen_vcpu);
-
-- sync_clear_bit(port, &s->evtchn_mask[0]);
--
- /*
- * The following is basically the equivalent of
- * 'hw_resend_irq'. Just like a real IO-APIC we 'lose
-diff --git a/drivers/xen/fallback.c b/drivers/xen/fallback.c
-index 0ef7c4d..b04fb64 100644
---- a/drivers/xen/fallback.c
-+++ b/drivers/xen/fallback.c
-@@ -44,7 +44,7 @@ int xen_event_channel_op_compat(int cmd, void *arg)
- }
- EXPORT_SYMBOL_GPL(xen_event_channel_op_compat);
-
--int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
-+int xen_physdev_op_compat(int cmd, void *arg)
- {
- struct physdev_op op;
- int rc;
-@@ -78,3 +78,4 @@ int HYPERVISOR_physdev_op_compat(int cmd, void *arg)
-
- return rc;
- }
-+EXPORT_SYMBOL_GPL(xen_physdev_op_compat);
-diff --git a/drivers/xen/xen-pciback/pci_stub.c b/drivers/xen/xen-pciback/pci_stub.c
-index 9204126..a2278ba 100644
---- a/drivers/xen/xen-pciback/pci_stub.c
-+++ b/drivers/xen/xen-pciback/pci_stub.c
-@@ -17,6 +17,7 @@
- #include <xen/events.h>
- #include <asm/xen/pci.h>
- #include <asm/xen/hypervisor.h>
-+#include <xen/interface/physdev.h>
- #include "pciback.h"
- #include "conf_space.h"
- #include "conf_space_quirks.h"
-@@ -85,37 +86,52 @@ static struct pcistub_device *pcistub_device_alloc(struct pci_dev *dev)
- static void pcistub_device_release(struct kref *kref)
- {
- struct pcistub_device *psdev;
-+ struct pci_dev *dev;
- struct xen_pcibk_dev_data *dev_data;
-
- psdev = container_of(kref, struct pcistub_device, kref);
-- dev_data = pci_get_drvdata(psdev->dev);
-+ dev = psdev->dev;
-+ dev_data = pci_get_drvdata(dev);
-
-- dev_dbg(&psdev->dev->dev, "pcistub_device_release\n");
-+ dev_dbg(&dev->dev, "pcistub_device_release\n");
-
-- xen_unregister_device_domain_owner(psdev->dev);
-+ xen_unregister_device_domain_owner(dev);
-
- /* Call the reset function which does not take lock as this
- * is called from "unbind" which takes a device_lock mutex.
- */
-- __pci_reset_function_locked(psdev->dev);
-- if (pci_load_and_free_saved_state(psdev->dev,
-- &dev_data->pci_saved_state)) {
-- dev_dbg(&psdev->dev->dev, "Could not reload PCI state\n");
-- } else
-- pci_restore_state(psdev->dev);
-+ __pci_reset_function_locked(dev);
-+ if (pci_load_and_free_saved_state(dev, &dev_data->pci_saved_state))
-+ dev_dbg(&dev->dev, "Could not reload PCI state\n");
-+ else
-+ pci_restore_state(dev);
-+
-+ if (pci_find_capability(dev, PCI_CAP_ID_MSIX)) {
-+ struct physdev_pci_device ppdev = {
-+ .seg = pci_domain_nr(dev->bus),
-+ .bus = dev->bus->number,
-+ .devfn = dev->devfn
-+ };
-+ int err = HYPERVISOR_physdev_op(PHYSDEVOP_release_msix,
-+ &ppdev);
-+
-+ if (err)
-+ dev_warn(&dev->dev, "MSI-X release failed (%d)\n",
-+ err);
-+ }
-
- /* Disable the device */
-- xen_pcibk_reset_device(psdev->dev);
-+ xen_pcibk_reset_device(dev);
-
- kfree(dev_data);
-- pci_set_drvdata(psdev->dev, NULL);
-+ pci_set_drvdata(dev, NULL);
-
- /* Clean-up the device */
-- xen_pcibk_config_free_dyn_fields(psdev->dev);
-- xen_pcibk_config_free_dev(psdev->dev);
-+ xen_pcibk_config_free_dyn_fields(dev);
-+ xen_pcibk_config_free_dev(dev);
-
-- psdev->dev->dev_flags &= ~PCI_DEV_FLAGS_ASSIGNED;
-- pci_dev_put(psdev->dev);
-+ dev->dev_flags &= ~PCI_DEV_FLAGS_ASSIGNED;
-+ pci_dev_put(dev);
-
- kfree(psdev);
- }
-@@ -355,6 +371,19 @@ static int pcistub_init_device(struct pci_dev *dev)
- if (err)
- goto config_release;
-
-+ if (pci_find_capability(dev, PCI_CAP_ID_MSIX)) {
-+ struct physdev_pci_device ppdev = {
-+ .seg = pci_domain_nr(dev->bus),
-+ .bus = dev->bus->number,
-+ .devfn = dev->devfn
-+ };
-+
-+ err = HYPERVISOR_physdev_op(PHYSDEVOP_prepare_msix, &ppdev);
-+ if (err)
-+ dev_err(&dev->dev, "MSI-X preparation failed (%d)\n",
-+ err);
-+ }
-+
- /* We need the device active to save the state. */
- dev_dbg(&dev->dev, "save state of device\n");
- pci_save_state(dev);
-diff --git a/fs/block_dev.c b/fs/block_dev.c
-index 78edf76..883dc49 100644
---- a/fs/block_dev.c
-+++ b/fs/block_dev.c
-@@ -551,6 +551,7 @@ struct block_device *bdgrab(struct block_device *bdev)
- ihold(bdev->bd_inode);
- return bdev;
- }
-+EXPORT_SYMBOL(bdgrab);
-
- long nr_blockdev_pages(void)
- {
-diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
-index eea5da7..ce1c169 100644
---- a/fs/btrfs/ctree.c
-+++ b/fs/btrfs/ctree.c
-@@ -651,6 +651,8 @@ tree_mod_log_insert_root(struct btrfs_fs_info *fs_info,
- if (tree_mod_dont_log(fs_info, NULL))
- return 0;
-
-+ __tree_mod_log_free_eb(fs_info, old_root);
-+
- ret = tree_mod_alloc(fs_info, flags, &tm);
- if (ret < 0)
- goto out;
-@@ -736,7 +738,7 @@ tree_mod_log_search(struct btrfs_fs_info *fs_info, u64 start, u64 min_seq)
- static noinline void
- tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,
- struct extent_buffer *src, unsigned long dst_offset,
-- unsigned long src_offset, int nr_items)
-+ unsigned long src_offset, int nr_items, int log_removal)
- {
- int ret;
- int i;
-@@ -750,10 +752,12 @@ tree_mod_log_eb_copy(struct btrfs_fs_info *fs_info, struct extent_buffer *dst,
- }
-
- for (i = 0; i < nr_items; i++) {
-- ret = tree_mod_log_insert_key_locked(fs_info, src,
-- i + src_offset,
-- MOD_LOG_KEY_REMOVE);
-- BUG_ON(ret < 0);
-+ if (log_removal) {
-+ ret = tree_mod_log_insert_key_locked(fs_info, src,
-+ i + src_offset,
-+ MOD_LOG_KEY_REMOVE);
-+ BUG_ON(ret < 0);
-+ }
- ret = tree_mod_log_insert_key_locked(fs_info, dst,
- i + dst_offset,
- MOD_LOG_KEY_ADD);
-@@ -927,7 +931,6 @@ static noinline int update_ref_for_cow(struct btrfs_trans_handle *trans,
- ret = btrfs_dec_ref(trans, root, buf, 1, 1);
- BUG_ON(ret); /* -ENOMEM */
- }
-- tree_mod_log_free_eb(root->fs_info, buf);
- clean_tree_block(trans, root, buf);
- *last_ref = 1;
- }
-@@ -1046,6 +1049,7 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
- btrfs_set_node_ptr_generation(parent, parent_slot,
- trans->transid);
- btrfs_mark_buffer_dirty(parent);
-+ tree_mod_log_free_eb(root->fs_info, buf);
- btrfs_free_tree_block(trans, root, buf, parent_start,
- last_ref);
- }
-@@ -1755,7 +1759,6 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
- goto enospc;
- }
-
-- tree_mod_log_free_eb(root->fs_info, root->node);
- tree_mod_log_set_root_pointer(root, child);
- rcu_assign_pointer(root->node, child);
-
-@@ -3000,7 +3003,7 @@ static int push_node_left(struct btrfs_trans_handle *trans,
- push_items = min(src_nritems - 8, push_items);
-
- tree_mod_log_eb_copy(root->fs_info, dst, src, dst_nritems, 0,
-- push_items);
-+ push_items, 1);
- copy_extent_buffer(dst, src,
- btrfs_node_key_ptr_offset(dst_nritems),
- btrfs_node_key_ptr_offset(0),
-@@ -3071,7 +3074,7 @@ static int balance_node_right(struct btrfs_trans_handle *trans,
- sizeof(struct btrfs_key_ptr));
-
- tree_mod_log_eb_copy(root->fs_info, dst, src, 0,
-- src_nritems - push_items, push_items);
-+ src_nritems - push_items, push_items, 1);
- copy_extent_buffer(dst, src,
- btrfs_node_key_ptr_offset(0),
- btrfs_node_key_ptr_offset(src_nritems - push_items),
-@@ -3223,12 +3226,18 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
- int mid;
- int ret;
- u32 c_nritems;
-+ int tree_mod_log_removal = 1;
-
- c = path->nodes[level];
- WARN_ON(btrfs_header_generation(c) != trans->transid);
- if (c == root->node) {
- /* trying to split the root, lets make a new one */
- ret = insert_new_root(trans, root, path, level + 1);
-+ /*
-+ * removal of root nodes has been logged by
-+ * tree_mod_log_set_root_pointer due to locking
-+ */
-+ tree_mod_log_removal = 0;
- if (ret)
- return ret;
- } else {
-@@ -3266,7 +3275,8 @@ static noinline int split_node(struct btrfs_trans_handle *trans,
- (unsigned long)btrfs_header_chunk_tree_uuid(split),
- BTRFS_UUID_SIZE);
-
-- tree_mod_log_eb_copy(root->fs_info, split, c, 0, mid, c_nritems - mid);
-+ tree_mod_log_eb_copy(root->fs_info, split, c, 0, mid, c_nritems - mid,
-+ tree_mod_log_removal);
- copy_extent_buffer(split, c,
- btrfs_node_key_ptr_offset(0),
- btrfs_node_key_ptr_offset(mid),
-diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
-index 5a3327b..d170412 100644
---- a/fs/btrfs/extent-tree.c
-+++ b/fs/btrfs/extent-tree.c
-@@ -4308,7 +4308,7 @@ static void update_global_block_rsv(struct btrfs_fs_info *fs_info)
- spin_lock(&sinfo->lock);
- spin_lock(&block_rsv->lock);
-
-- block_rsv->size = num_bytes;
-+ block_rsv->size = min_t(u64, num_bytes, 512 * 1024 * 1024);
-
- num_bytes = sinfo->bytes_used + sinfo->bytes_pinned +
- sinfo->bytes_reserved + sinfo->bytes_readonly +
-@@ -4601,14 +4601,49 @@ int btrfs_delalloc_reserve_metadata(struct inode *inode, u64 num_bytes)
- * If the inodes csum_bytes is the same as the original
- * csum_bytes then we know we haven't raced with any free()ers
- * so we can just reduce our inodes csum bytes and carry on.
-- * Otherwise we have to do the normal free thing to account for
-- * the case that the free side didn't free up its reserve
-- * because of this outstanding reservation.
- */
-- if (BTRFS_I(inode)->csum_bytes == csum_bytes)
-+ if (BTRFS_I(inode)->csum_bytes == csum_bytes) {
- calc_csum_metadata_size(inode, num_bytes, 0);
-- else
-- to_free = calc_csum_metadata_size(inode, num_bytes, 0);
-+ } else {
-+ u64 orig_csum_bytes = BTRFS_I(inode)->csum_bytes;
-+ u64 bytes;
-+
-+ /*
-+ * This is tricky, but first we need to figure out how much we
-+ * free'd from any free-ers that occured during this
-+ * reservation, so we reset ->csum_bytes to the csum_bytes
-+ * before we dropped our lock, and then call the free for the
-+ * number of bytes that were freed while we were trying our
-+ * reservation.
-+ */
-+ bytes = csum_bytes - BTRFS_I(inode)->csum_bytes;
-+ BTRFS_I(inode)->csum_bytes = csum_bytes;
-+ to_free = calc_csum_metadata_size(inode, bytes, 0);
-+
-+
-+ /*
-+ * Now we need to see how much we would have freed had we not
-+ * been making this reservation and our ->csum_bytes were not
-+ * artificially inflated.
-+ */
-+ BTRFS_I(inode)->csum_bytes = csum_bytes - num_bytes;
-+ bytes = csum_bytes - orig_csum_bytes;
-+ bytes = calc_csum_metadata_size(inode, bytes, 0);
-+
-+ /*
-+ * Now reset ->csum_bytes to what it should be. If bytes is
-+ * more than to_free then we would have free'd more space had we
-+ * not had an artificially high ->csum_bytes, so we need to free
-+ * the remainder. If bytes is the same or less then we don't
-+ * need to do anything, the other free-ers did the correct
-+ * thing.
-+ */
-+ BTRFS_I(inode)->csum_bytes = orig_csum_bytes - num_bytes;
-+ if (bytes > to_free)
-+ to_free = bytes - to_free;
-+ else
-+ to_free = 0;
-+ }
- spin_unlock(&BTRFS_I(inode)->lock);
- if (dropped)
- to_free += btrfs_calc_trans_metadata_size(root, dropped);
-diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
-index 1b319df..125397e 100644
---- a/fs/btrfs/extent_io.c
-+++ b/fs/btrfs/extent_io.c
-@@ -1258,6 +1258,39 @@ int unlock_extent(struct extent_io_tree *tree, u64 start, u64 end)
- GFP_NOFS);
- }
-
-+int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end)
-+{
-+ unsigned long index = start >> PAGE_CACHE_SHIFT;
-+ unsigned long end_index = end >> PAGE_CACHE_SHIFT;
-+ struct page *page;
-+
-+ while (index <= end_index) {
-+ page = find_get_page(inode->i_mapping, index);
-+ BUG_ON(!page); /* Pages should be in the extent_io_tree */
-+ clear_page_dirty_for_io(page);
-+ page_cache_release(page);
-+ index++;
-+ }
-+ return 0;
-+}
-+
-+int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end)
-+{
-+ unsigned long index = start >> PAGE_CACHE_SHIFT;
-+ unsigned long end_index = end >> PAGE_CACHE_SHIFT;
-+ struct page *page;
-+
-+ while (index <= end_index) {
-+ page = find_get_page(inode->i_mapping, index);
-+ BUG_ON(!page); /* Pages should be in the extent_io_tree */
-+ account_page_redirty(page);
-+ __set_page_dirty_nobuffers(page);
-+ page_cache_release(page);
-+ index++;
-+ }
-+ return 0;
-+}
-+
- /*
- * helper function to set both pages and extents in the tree writeback
- */
-diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
-index 2eacfab..715b474 100644
---- a/fs/btrfs/extent_io.h
-+++ b/fs/btrfs/extent_io.h
-@@ -329,6 +329,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset,
- unsigned long *map_len);
- int extent_range_uptodate(struct extent_io_tree *tree,
- u64 start, u64 end);
-+int extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end);
-+int extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end);
- int extent_clear_unlock_delalloc(struct inode *inode,
- struct extent_io_tree *tree,
- u64 start, u64 end, struct page *locked_page,
-diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
-index 659ea81..7c4e6cc 100644
---- a/fs/btrfs/inode.c
-+++ b/fs/btrfs/inode.c
-@@ -352,6 +352,7 @@ static noinline int compress_file_range(struct inode *inode,
- int i;
- int will_compress;
- int compress_type = root->fs_info->compress_type;
-+ int redirty = 0;
-
- /* if this is a small write inside eof, kick off a defrag */
- if ((end - start + 1) < 16 * 1024 &&
-@@ -414,6 +415,17 @@ again:
- if (BTRFS_I(inode)->force_compress)
- compress_type = BTRFS_I(inode)->force_compress;
-
-+ /*
-+ * we need to call clear_page_dirty_for_io on each
-+ * page in the range. Otherwise applications with the file
-+ * mmap'd can wander in and change the page contents while
-+ * we are compressing them.
-+ *
-+ * If the compression fails for any reason, we set the pages
-+ * dirty again later on.
-+ */
-+ extent_range_clear_dirty_for_io(inode, start, end);
-+ redirty = 1;
- ret = btrfs_compress_pages(compress_type,
- inode->i_mapping, start,
- total_compressed, pages,
-@@ -555,6 +567,8 @@ cleanup_and_bail_uncompressed:
- __set_page_dirty_nobuffers(locked_page);
- /* unlocked later on in the async handlers */
- }
-+ if (redirty)
-+ extent_range_redirty_for_io(inode, start, end);
- add_async_extent(async_cow, start, end - start + 1,
- 0, NULL, 0, BTRFS_COMPRESS_NONE);
- *num_added += 1;
-diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c
-index 67783e0..48761b6 100644
---- a/fs/btrfs/scrub.c
-+++ b/fs/btrfs/scrub.c
-@@ -541,7 +541,6 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
- eb = path->nodes[0];
- ei = btrfs_item_ptr(eb, path->slots[0], struct btrfs_extent_item);
- item_size = btrfs_item_size_nr(eb, path->slots[0]);
-- btrfs_release_path(path);
-
- if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) {
- do {
-@@ -557,7 +556,9 @@ static void scrub_print_warning(const char *errstr, struct scrub_block *sblock)
- ret < 0 ? -1 : ref_level,
- ret < 0 ? -1 : ref_root);
- } while (ret != 1);
-+ btrfs_release_path(path);
- } else {
-+ btrfs_release_path(path);
- swarn.path = path;
- swarn.dev = dev;
- iterate_extent_inodes(fs_info, found_key.objectid,
-diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index b6818ee..744a69b 100644
---- a/fs/btrfs/tree-log.c
-+++ b/fs/btrfs/tree-log.c
-@@ -1384,7 +1384,10 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans,
-
- btrfs_release_path(path);
- if (ret == 0) {
-- btrfs_inc_nlink(inode);
-+ if (!inode->i_nlink)
-+ set_nlink(inode, 1);
-+ else
-+ btrfs_inc_nlink(inode);
- ret = btrfs_update_inode(trans, root, inode);
- } else if (ret == -EEXIST) {
- ret = 0;
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 19153a0..c3bbf85 100644
---- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2552,7 +2552,6 @@ static int prepend_path(const struct path *path,
- bool slash = false;
- int error = 0;
-
-- br_read_lock(&vfsmount_lock);
- while (dentry != root->dentry || vfsmnt != root->mnt) {
- struct dentry * parent;
-
-@@ -2582,8 +2581,6 @@ static int prepend_path(const struct path *path,
- if (!error && !slash)
- error = prepend(buffer, buflen, "/", 1);
-
--out:
-- br_read_unlock(&vfsmount_lock);
- return error;
-
- global_root:
-@@ -2600,7 +2597,7 @@ global_root:
- error = prepend(buffer, buflen, "/", 1);
- if (!error)
- error = is_mounted(vfsmnt) ? 1 : 2;
-- goto out;
-+ return error;
- }
-
- /**
-@@ -2627,9 +2624,11 @@ char *__d_path(const struct path *path,
- int error;
-
- prepend(&res, &buflen, "\0", 1);
-+ br_read_lock(&vfsmount_lock);
- write_seqlock(&rename_lock);
- error = prepend_path(path, root, &res, &buflen);
- write_sequnlock(&rename_lock);
-+ br_read_unlock(&vfsmount_lock);
-
- if (error < 0)
- return ERR_PTR(error);
-@@ -2646,9 +2645,11 @@ char *d_absolute_path(const struct path *path,
- int error;
-
- prepend(&res, &buflen, "\0", 1);
-+ br_read_lock(&vfsmount_lock);
- write_seqlock(&rename_lock);
- error = prepend_path(path, &root, &res, &buflen);
- write_sequnlock(&rename_lock);
-+ br_read_unlock(&vfsmount_lock);
-
- if (error > 1)
- error = -EINVAL;
-@@ -2712,11 +2713,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
- return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
-
- get_fs_root(current->fs, &root);
-+ br_read_lock(&vfsmount_lock);
- write_seqlock(&rename_lock);
- error = path_with_deleted(path, &root, &res, &buflen);
-+ write_sequnlock(&rename_lock);
-+ br_read_unlock(&vfsmount_lock);
- if (error < 0)
- res = ERR_PTR(error);
-- write_sequnlock(&rename_lock);
- path_put(&root);
- return res;
- }
-@@ -2871,6 +2874,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
- get_fs_root_and_pwd(current->fs, &root, &pwd);
-
- error = -ENOENT;
-+ br_read_lock(&vfsmount_lock);
- write_seqlock(&rename_lock);
- if (!d_unlinked(pwd.dentry)) {
- unsigned long len;
-@@ -2880,6 +2884,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
- prepend(&cwd, &buflen, "\0", 1);
- error = prepend_path(&pwd, &root, &cwd, &buflen);
- write_sequnlock(&rename_lock);
-+ br_read_unlock(&vfsmount_lock);
-
- if (error < 0)
- goto out;
-@@ -2900,6 +2905,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
- }
- } else {
- write_sequnlock(&rename_lock);
-+ br_read_unlock(&vfsmount_lock);
- }
-
- out:
-diff --git a/fs/namespace.c b/fs/namespace.c
-index a51054f..5dd7709 100644
---- a/fs/namespace.c
-+++ b/fs/namespace.c
-@@ -798,6 +798,10 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
- }
-
- mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~MNT_WRITE_HOLD;
-+ /* Don't allow unprivileged users to change mount flags */
-+ if ((flag & CL_UNPRIVILEGED) && (mnt->mnt.mnt_flags & MNT_READONLY))
-+ mnt->mnt.mnt_flags |= MNT_LOCK_READONLY;
-+
- atomic_inc(&sb->s_active);
- mnt->mnt.mnt_sb = sb;
- mnt->mnt.mnt_root = dget(root);
-@@ -1736,6 +1740,9 @@ static int change_mount_flags(struct vfsmount *mnt, int ms_flags)
- if (readonly_request == __mnt_is_readonly(mnt))
- return 0;
-
-+ if (mnt->mnt_flags & MNT_LOCK_READONLY)
-+ return -EPERM;
-+
- if (readonly_request)
- error = mnt_make_readonly(real_mount(mnt));
- else
-@@ -2365,7 +2372,7 @@ static struct mnt_namespace *dup_mnt_ns(struct mnt_namespace *mnt_ns,
- /* First pass: copy the tree topology */
- copy_flags = CL_COPY_ALL | CL_EXPIRE;
- if (user_ns != mnt_ns->user_ns)
-- copy_flags |= CL_SHARED_TO_SLAVE;
-+ copy_flags |= CL_SHARED_TO_SLAVE | CL_UNPRIVILEGED;
- new = copy_tree(old, old->mnt.mnt_root, copy_flags);
- if (IS_ERR(new)) {
- up_write(&namespace_sem);
-@@ -2758,6 +2765,51 @@ bool our_mnt(struct vfsmount *mnt)
- return check_mnt(real_mount(mnt));
- }
-
-+bool current_chrooted(void)
-+{
-+ /* Does the current process have a non-standard root */
-+ struct path ns_root;
-+ struct path fs_root;
-+ bool chrooted;
-+
-+ /* Find the namespace root */
-+ ns_root.mnt = ¤t->nsproxy->mnt_ns->root->mnt;
-+ ns_root.dentry = ns_root.mnt->mnt_root;
-+ path_get(&ns_root);
-+ while (d_mountpoint(ns_root.dentry) && follow_down_one(&ns_root))
-+ ;
-+
-+ get_fs_root(current->fs, &fs_root);
-+
-+ chrooted = !path_equal(&fs_root, &ns_root);
-+
-+ path_put(&fs_root);
-+ path_put(&ns_root);
-+
-+ return chrooted;
-+}
-+
-+void update_mnt_policy(struct user_namespace *userns)
-+{
-+ struct mnt_namespace *ns = current->nsproxy->mnt_ns;
-+ struct mount *mnt;
-+
-+ down_read(&namespace_sem);
-+ list_for_each_entry(mnt, &ns->list, mnt_list) {
-+ switch (mnt->mnt.mnt_sb->s_magic) {
-+ case SYSFS_MAGIC:
-+ userns->may_mount_sysfs = true;
-+ break;
-+ case PROC_SUPER_MAGIC:
-+ userns->may_mount_proc = true;
-+ break;
-+ }
-+ if (userns->may_mount_sysfs && userns->may_mount_proc)
-+ break;
-+ }
-+ up_read(&namespace_sem);
-+}
-+
- static void *mntns_get(struct task_struct *task)
- {
- struct mnt_namespace *ns = NULL;
-diff --git a/fs/nfs/blocklayout/blocklayoutdm.c b/fs/nfs/blocklayout/blocklayoutdm.c
-index 737d839..6fc7b5c 100644
---- a/fs/nfs/blocklayout/blocklayoutdm.c
-+++ b/fs/nfs/blocklayout/blocklayoutdm.c
-@@ -55,7 +55,8 @@ static void dev_remove(struct net *net, dev_t dev)
-
- bl_pipe_msg.bl_wq = &nn->bl_wq;
- memset(msg, 0, sizeof(*msg));
-- msg->data = kzalloc(1 + sizeof(bl_umount_request), GFP_NOFS);
-+ msg->len = sizeof(bl_msg) + bl_msg.totallen;
-+ msg->data = kzalloc(msg->len, GFP_NOFS);
- if (!msg->data)
- goto out;
-
-@@ -66,7 +67,6 @@ static void dev_remove(struct net *net, dev_t dev)
- memcpy(msg->data, &bl_msg, sizeof(bl_msg));
- dataptr = (uint8_t *) msg->data;
- memcpy(&dataptr[sizeof(bl_msg)], &bl_umount_request, sizeof(bl_umount_request));
-- msg->len = sizeof(bl_msg) + bl_msg.totallen;
-
- add_wait_queue(&nn->bl_wq, &wq);
- if (rpc_queue_upcall(nn->bl_device_pipe, msg) < 0) {
-diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c
-index bc3968f..cf4ed87 100644
---- a/fs/nfs/idmap.c
-+++ b/fs/nfs/idmap.c
-@@ -725,9 +725,9 @@ out1:
- return ret;
- }
-
--static int nfs_idmap_instantiate(struct key *key, struct key *authkey, char *data)
-+static int nfs_idmap_instantiate(struct key *key, struct key *authkey, char *data, size_t datalen)
- {
-- return key_instantiate_and_link(key, data, strlen(data) + 1,
-+ return key_instantiate_and_link(key, data, datalen,
- id_resolver_cache->thread_keyring,
- authkey);
- }
-@@ -737,6 +737,7 @@ static int nfs_idmap_read_and_verify_message(struct idmap_msg *im,
- struct key *key, struct key *authkey)
- {
- char id_str[NFS_UINT_MAXLEN];
-+ size_t len;
- int ret = -ENOKEY;
-
- /* ret = -ENOKEY */
-@@ -746,13 +747,15 @@ static int nfs_idmap_read_and_verify_message(struct idmap_msg *im,
- case IDMAP_CONV_NAMETOID:
- if (strcmp(upcall->im_name, im->im_name) != 0)
- break;
-- sprintf(id_str, "%d", im->im_id);
-- ret = nfs_idmap_instantiate(key, authkey, id_str);
-+ /* Note: here we store the NUL terminator too */
-+ len = sprintf(id_str, "%d", im->im_id) + 1;
-+ ret = nfs_idmap_instantiate(key, authkey, id_str, len);
- break;
- case IDMAP_CONV_IDTONAME:
- if (upcall->im_id != im->im_id)
- break;
-- ret = nfs_idmap_instantiate(key, authkey, im->im_name);
-+ len = strlen(im->im_name);
-+ ret = nfs_idmap_instantiate(key, authkey, im->im_name, len);
- break;
- default:
- ret = -EINVAL;
-diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
-index 49eeb04..4fb234d 100644
---- a/fs/nfs/nfs4filelayout.c
-+++ b/fs/nfs/nfs4filelayout.c
-@@ -129,7 +129,6 @@ static void filelayout_fenceme(struct inode *inode, struct pnfs_layout_hdr *lo)
- {
- if (!test_and_clear_bit(NFS_LAYOUT_RETURN, &lo->plh_flags))
- return;
-- clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(inode)->flags);
- pnfs_return_layout(inode);
- }
-
-diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
-index 3cb5e77..3d905e3 100644
---- a/fs/nfs/nfs4proc.c
-+++ b/fs/nfs/nfs4proc.c
-@@ -6366,22 +6366,8 @@ nfs4_layoutcommit_done(struct rpc_task *task, void *calldata)
- static void nfs4_layoutcommit_release(void *calldata)
- {
- struct nfs4_layoutcommit_data *data = calldata;
-- struct pnfs_layout_segment *lseg, *tmp;
-- unsigned long *bitlock = &NFS_I(data->args.inode)->flags;
-
- pnfs_cleanup_layoutcommit(data);
-- /* Matched by references in pnfs_set_layoutcommit */
-- list_for_each_entry_safe(lseg, tmp, &data->lseg_list, pls_lc_list) {
-- list_del_init(&lseg->pls_lc_list);
-- if (test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT,
-- &lseg->pls_flags))
-- pnfs_put_lseg(lseg);
-- }
--
-- clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
-- smp_mb__after_clear_bit();
-- wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
--
- put_rpccred(data->cred);
- kfree(data);
- }
-diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
-index 97767c8..3b71623 100644
---- a/fs/nfs/pnfs.c
-+++ b/fs/nfs/pnfs.c
-@@ -417,6 +417,16 @@ should_free_lseg(struct pnfs_layout_range *lseg_range,
- lo_seg_intersecting(lseg_range, recall_range);
- }
-
-+static bool pnfs_lseg_dec_and_remove_zero(struct pnfs_layout_segment *lseg,
-+ struct list_head *tmp_list)
-+{
-+ if (!atomic_dec_and_test(&lseg->pls_refcount))
-+ return false;
-+ pnfs_layout_remove_lseg(lseg->pls_layout, lseg);
-+ list_add(&lseg->pls_list, tmp_list);
-+ return true;
-+}
-+
- /* Returns 1 if lseg is removed from list, 0 otherwise */
- static int mark_lseg_invalid(struct pnfs_layout_segment *lseg,
- struct list_head *tmp_list)
-@@ -430,11 +440,8 @@ static int mark_lseg_invalid(struct pnfs_layout_segment *lseg,
- */
- dprintk("%s: lseg %p ref %d\n", __func__, lseg,
- atomic_read(&lseg->pls_refcount));
-- if (atomic_dec_and_test(&lseg->pls_refcount)) {
-- pnfs_layout_remove_lseg(lseg->pls_layout, lseg);
-- list_add(&lseg->pls_list, tmp_list);
-+ if (pnfs_lseg_dec_and_remove_zero(lseg, tmp_list))
- rv = 1;
-- }
- }
- return rv;
- }
-@@ -777,6 +784,21 @@ send_layoutget(struct pnfs_layout_hdr *lo,
- return lseg;
- }
-
-+static void pnfs_clear_layoutcommit(struct inode *inode,
-+ struct list_head *head)
-+{
-+ struct nfs_inode *nfsi = NFS_I(inode);
-+ struct pnfs_layout_segment *lseg, *tmp;
-+
-+ if (!test_and_clear_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags))
-+ return;
-+ list_for_each_entry_safe(lseg, tmp, &nfsi->layout->plh_segs, pls_list) {
-+ if (!test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
-+ continue;
-+ pnfs_lseg_dec_and_remove_zero(lseg, head);
-+ }
-+}
-+
- /*
- * Initiates a LAYOUTRETURN(FILE), and removes the pnfs_layout_hdr
- * when the layout segment list is empty.
-@@ -808,6 +830,7 @@ _pnfs_return_layout(struct inode *ino)
- /* Reference matched in nfs4_layoutreturn_release */
- pnfs_get_layout_hdr(lo);
- empty = list_empty(&lo->plh_segs);
-+ pnfs_clear_layoutcommit(ino, &tmp_list);
- pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL);
- /* Don't send a LAYOUTRETURN if list was initially empty */
- if (empty) {
-@@ -820,8 +843,6 @@ _pnfs_return_layout(struct inode *ino)
- spin_unlock(&ino->i_lock);
- pnfs_free_lseg_list(&tmp_list);
-
-- WARN_ON(test_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags));
--
- lrp = kzalloc(sizeof(*lrp), GFP_KERNEL);
- if (unlikely(lrp == NULL)) {
- status = -ENOMEM;
-@@ -1459,7 +1480,6 @@ static void pnfs_ld_handle_write_error(struct nfs_write_data *data)
- dprintk("pnfs write error = %d\n", hdr->pnfs_error);
- if (NFS_SERVER(hdr->inode)->pnfs_curr_ld->flags &
- PNFS_LAYOUTRET_ON_ERROR) {
-- clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(hdr->inode)->flags);
- pnfs_return_layout(hdr->inode);
- }
- if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags))
-@@ -1614,7 +1634,6 @@ static void pnfs_ld_handle_read_error(struct nfs_read_data *data)
- dprintk("pnfs read error = %d\n", hdr->pnfs_error);
- if (NFS_SERVER(hdr->inode)->pnfs_curr_ld->flags &
- PNFS_LAYOUTRET_ON_ERROR) {
-- clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(hdr->inode)->flags);
- pnfs_return_layout(hdr->inode);
- }
- if (!test_and_set_bit(NFS_IOHDR_REDO, &hdr->flags))
-@@ -1747,11 +1766,27 @@ static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
-
- list_for_each_entry(lseg, &NFS_I(inode)->layout->plh_segs, pls_list) {
- if (lseg->pls_range.iomode == IOMODE_RW &&
-- test_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
-+ test_and_clear_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
- list_add(&lseg->pls_lc_list, listp);
- }
- }
-
-+static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *listp)
-+{
-+ struct pnfs_layout_segment *lseg, *tmp;
-+ unsigned long *bitlock = &NFS_I(inode)->flags;
-+
-+ /* Matched by references in pnfs_set_layoutcommit */
-+ list_for_each_entry_safe(lseg, tmp, listp, pls_lc_list) {
-+ list_del_init(&lseg->pls_lc_list);
-+ pnfs_put_lseg(lseg);
-+ }
-+
-+ clear_bit_unlock(NFS_INO_LAYOUTCOMMITTING, bitlock);
-+ smp_mb__after_clear_bit();
-+ wake_up_bit(bitlock, NFS_INO_LAYOUTCOMMITTING);
-+}
-+
- void pnfs_set_lo_fail(struct pnfs_layout_segment *lseg)
- {
- pnfs_layout_io_set_failed(lseg->pls_layout, lseg->pls_range.iomode);
-@@ -1796,6 +1831,7 @@ void pnfs_cleanup_layoutcommit(struct nfs4_layoutcommit_data *data)
-
- if (nfss->pnfs_curr_ld->cleanup_layoutcommit)
- nfss->pnfs_curr_ld->cleanup_layoutcommit(data);
-+ pnfs_list_write_lseg_done(data->args.inode, &data->lseg_list);
- }
-
- /*
-diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
-index 0dc1158..d1dd710 100644
---- a/fs/nfsd/nfs4xdr.c
-+++ b/fs/nfsd/nfs4xdr.c
-@@ -264,7 +264,7 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs *argp, u32 *bmval,
- iattr->ia_valid |= ATTR_SIZE;
- }
- if (bmval[0] & FATTR4_WORD0_ACL) {
-- int nace;
-+ u32 nace;
- struct nfs4_ace *ace;
-
- READ_BUF(4); len += 4;
-diff --git a/fs/pnode.c b/fs/pnode.c
-index 3e000a5..8b29d21 100644
---- a/fs/pnode.c
-+++ b/fs/pnode.c
-@@ -9,6 +9,7 @@
- #include <linux/mnt_namespace.h>
- #include <linux/mount.h>
- #include <linux/fs.h>
-+#include <linux/nsproxy.h>
- #include "internal.h"
- #include "pnode.h"
-
-@@ -220,6 +221,7 @@ static struct mount *get_source(struct mount *dest,
- int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,
- struct mount *source_mnt, struct list_head *tree_list)
- {
-+ struct user_namespace *user_ns = current->nsproxy->mnt_ns->user_ns;
- struct mount *m, *child;
- int ret = 0;
- struct mount *prev_dest_mnt = dest_mnt;
-@@ -237,6 +239,10 @@ int propagate_mnt(struct mount *dest_mnt, struct dentry *dest_dentry,
-
- source = get_source(m, prev_dest_mnt, prev_src_mnt, &type);
-
-+ /* Notice when we are propagating across user namespaces */
-+ if (m->mnt_ns->user_ns != user_ns)
-+ type |= CL_UNPRIVILEGED;
-+
- child = copy_tree(source, source->mnt.mnt_root, type);
- if (IS_ERR(child)) {
- ret = PTR_ERR(child);
-diff --git a/fs/pnode.h b/fs/pnode.h
-index 19b853a3..a0493d5 100644
---- a/fs/pnode.h
-+++ b/fs/pnode.h
-@@ -23,6 +23,7 @@
- #define CL_MAKE_SHARED 0x08
- #define CL_PRIVATE 0x10
- #define CL_SHARED_TO_SLAVE 0x20
-+#define CL_UNPRIVILEGED 0x40
-
- static inline void set_mnt_shared(struct mount *mnt)
- {
-diff --git a/fs/proc/root.c b/fs/proc/root.c
-index c6e9fac..9c7fab1 100644
---- a/fs/proc/root.c
-+++ b/fs/proc/root.c
-@@ -16,6 +16,7 @@
- #include <linux/sched.h>
- #include <linux/module.h>
- #include <linux/bitops.h>
-+#include <linux/user_namespace.h>
- #include <linux/mount.h>
- #include <linux/pid_namespace.h>
- #include <linux/parser.h>
-@@ -108,6 +109,9 @@ static struct dentry *proc_mount(struct file_system_type *fs_type,
- } else {
- ns = task_active_pid_ns(current);
- options = data;
-+
-+ if (!current_user_ns()->may_mount_proc)
-+ return ERR_PTR(-EPERM);
- }
-
- sb = sget(fs_type, proc_test_super, proc_set_super, flags, ns);
-diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
-index 2fbdff6..1f8c823 100644
---- a/fs/sysfs/dir.c
-+++ b/fs/sysfs/dir.c
-@@ -1020,6 +1020,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
- ino = parent_sd->s_ino;
- if (filldir(dirent, ".", 1, filp->f_pos, ino, DT_DIR) == 0)
- filp->f_pos++;
-+ else
-+ return 0;
- }
- if (filp->f_pos == 1) {
- if (parent_sd->s_parent)
-@@ -1028,6 +1030,8 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
- ino = parent_sd->s_ino;
- if (filldir(dirent, "..", 2, filp->f_pos, ino, DT_DIR) == 0)
- filp->f_pos++;
-+ else
-+ return 0;
- }
- mutex_lock(&sysfs_mutex);
- for (pos = sysfs_dir_pos(ns, parent_sd, filp->f_pos, pos);
-@@ -1058,10 +1062,21 @@ static int sysfs_readdir(struct file * filp, void * dirent, filldir_t filldir)
- return 0;
- }
-
-+static loff_t sysfs_dir_llseek(struct file *file, loff_t offset, int whence)
-+{
-+ struct inode *inode = file->f_path.dentry->d_inode;
-+ loff_t ret;
-+
-+ mutex_lock(&inode->i_mutex);
-+ ret = generic_file_llseek(file, offset, whence);
-+ mutex_unlock(&inode->i_mutex);
-+
-+ return ret;
-+}
-
- const struct file_operations sysfs_dir_operations = {
- .read = generic_read_dir,
- .readdir = sysfs_readdir,
- .release = sysfs_dir_release,
-- .llseek = generic_file_llseek,
-+ .llseek = sysfs_dir_llseek,
- };
-diff --git a/fs/sysfs/mount.c b/fs/sysfs/mount.c
-index db940a9..fb328d1 100644
---- a/fs/sysfs/mount.c
-+++ b/fs/sysfs/mount.c
-@@ -19,6 +19,7 @@
- #include <linux/module.h>
- #include <linux/magic.h>
- #include <linux/slab.h>
-+#include <linux/user_namespace.h>
-
- #include "sysfs.h"
-
-@@ -111,6 +112,9 @@ static struct dentry *sysfs_mount(struct file_system_type *fs_type,
- struct super_block *sb;
- int error;
-
-+ if (!(flags & MS_KERNMOUNT) && !current_user_ns()->may_mount_sysfs)
-+ return ERR_PTR(-EPERM);
-+
- info = kzalloc(sizeof(*info), GFP_KERNEL);
- if (!info)
- return ERR_PTR(-ENOMEM);
-diff --git a/include/linux/fs_struct.h b/include/linux/fs_struct.h
-index d0ae3a8..324f931 100644
---- a/include/linux/fs_struct.h
-+++ b/include/linux/fs_struct.h
-@@ -50,4 +50,6 @@ static inline void get_fs_root_and_pwd(struct fs_struct *fs, struct path *root,
- spin_unlock(&fs->lock);
- }
-
-+extern bool current_chrooted(void);
-+
- #endif /* _LINUX_FS_STRUCT_H */
-diff --git a/include/linux/mount.h b/include/linux/mount.h
-index d7029f4..73005f9 100644
---- a/include/linux/mount.h
-+++ b/include/linux/mount.h
-@@ -47,6 +47,8 @@ struct mnt_namespace;
-
- #define MNT_INTERNAL 0x4000
-
-+#define MNT_LOCK_READONLY 0x400000
-+
- struct vfsmount {
- struct dentry *mnt_root; /* root of the mounted tree */
- struct super_block *mnt_sb; /* pointer to superblock */
-diff --git a/include/linux/thermal.h b/include/linux/thermal.h
-index fe82022..90a8dfa 100644
---- a/include/linux/thermal.h
-+++ b/include/linux/thermal.h
-@@ -44,7 +44,7 @@
- /* Adding event notification support elements */
- #define THERMAL_GENL_FAMILY_NAME "thermal_event"
- #define THERMAL_GENL_VERSION 0x01
--#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_group"
-+#define THERMAL_GENL_MCAST_GROUP_NAME "thermal_mc_grp"
-
- /* Default Thermal Governor */
- #if defined(CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE)
-diff --git a/include/linux/usb/serial.h b/include/linux/usb/serial.h
-index ef9be7e..1819b59 100644
---- a/include/linux/usb/serial.h
-+++ b/include/linux/usb/serial.h
-@@ -66,6 +66,7 @@
- * port.
- * @flags: usb serial port flags
- * @write_wait: a wait_queue_head_t used by the port.
-+ * @delta_msr_wait: modem-status-change wait queue
- * @work: work queue entry for the line discipline waking up.
- * @throttled: nonzero if the read urb is inactive to throttle the device
- * @throttle_req: nonzero if the tty wants to throttle us
-@@ -112,6 +113,7 @@ struct usb_serial_port {
-
- unsigned long flags;
- wait_queue_head_t write_wait;
-+ wait_queue_head_t delta_msr_wait;
- struct work_struct work;
- char throttled;
- char throttle_req;
-diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h
-index b9bd2e6..5209cfe 100644
---- a/include/linux/user_namespace.h
-+++ b/include/linux/user_namespace.h
-@@ -26,6 +26,8 @@ struct user_namespace {
- kuid_t owner;
- kgid_t group;
- unsigned int proc_inum;
-+ bool may_mount_sysfs;
-+ bool may_mount_proc;
- };
-
- extern struct user_namespace init_user_ns;
-@@ -82,4 +84,6 @@ static inline void put_user_ns(struct user_namespace *ns)
-
- #endif
-
-+void update_mnt_policy(struct user_namespace *userns);
-+
- #endif /* _LINUX_USER_H */
-diff --git a/include/uapi/asm-generic/signal.h b/include/uapi/asm-generic/signal.h
-index 6fae30f..8cc2850 100644
---- a/include/uapi/asm-generic/signal.h
-+++ b/include/uapi/asm-generic/signal.h
-@@ -93,6 +93,10 @@ typedef unsigned long old_sigset_t;
-
- #include <asm-generic/signal-defs.h>
-
-+#ifdef SA_RESTORER
-+#define __ARCH_HAS_SA_RESTORER
-+#endif
-+
- struct sigaction {
- __sighandler_t sa_handler;
- unsigned long sa_flags;
-diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h
-index 93f5fa9..afafd70 100644
---- a/include/uapi/linux/packet_diag.h
-+++ b/include/uapi/linux/packet_diag.h
-@@ -33,9 +33,11 @@ enum {
- PACKET_DIAG_TX_RING,
- PACKET_DIAG_FANOUT,
-
-- PACKET_DIAG_MAX,
-+ __PACKET_DIAG_MAX,
- };
-
-+#define PACKET_DIAG_MAX (__PACKET_DIAG_MAX - 1)
-+
- struct packet_diag_info {
- __u32 pdi_index;
- __u32 pdi_version;
-diff --git a/include/uapi/linux/unix_diag.h b/include/uapi/linux/unix_diag.h
-index b8a2494..b9e2a6a 100644
---- a/include/uapi/linux/unix_diag.h
-+++ b/include/uapi/linux/unix_diag.h
-@@ -39,9 +39,11 @@ enum {
- UNIX_DIAG_MEMINFO,
- UNIX_DIAG_SHUTDOWN,
-
-- UNIX_DIAG_MAX,
-+ __UNIX_DIAG_MAX,
- };
-
-+#define UNIX_DIAG_MAX (__UNIX_DIAG_MAX - 1)
-+
- struct unix_diag_vfs {
- __u32 udiag_vfs_ino;
- __u32 udiag_vfs_dev;
-diff --git a/include/xen/interface/io/blkif.h b/include/xen/interface/io/blkif.h
-index 01c3d62..ffd4652 100644
---- a/include/xen/interface/io/blkif.h
-+++ b/include/xen/interface/io/blkif.h
-@@ -138,11 +138,21 @@ struct blkif_request_discard {
- uint8_t _pad3;
- } __attribute__((__packed__));
-
-+struct blkif_request_other {
-+ uint8_t _pad1;
-+ blkif_vdev_t _pad2; /* only for read/write requests */
-+#ifdef CONFIG_X86_64
-+ uint32_t _pad3; /* offsetof(blkif_req..,u.other.id)==8*/
-+#endif
-+ uint64_t id; /* private guest value, echoed in resp */
-+} __attribute__((__packed__));
-+
- struct blkif_request {
- uint8_t operation; /* BLKIF_OP_??? */
- union {
- struct blkif_request_rw rw;
- struct blkif_request_discard discard;
-+ struct blkif_request_other other;
- } u;
- } __attribute__((__packed__));
-
-diff --git a/include/xen/interface/physdev.h b/include/xen/interface/physdev.h
-index 1844d31..7000bb1 100644
---- a/include/xen/interface/physdev.h
-+++ b/include/xen/interface/physdev.h
-@@ -251,6 +251,12 @@ struct physdev_pci_device_add {
-
- #define PHYSDEVOP_pci_device_remove 26
- #define PHYSDEVOP_restore_msi_ext 27
-+/*
-+ * Dom0 should use these two to announce MMIO resources assigned to
-+ * MSI-X capable devices won't (prepare) or may (release) change.
-+ */
-+#define PHYSDEVOP_prepare_msix 30
-+#define PHYSDEVOP_release_msix 31
- struct physdev_pci_device {
- /* IN */
- uint16_t seg;
-diff --git a/ipc/mqueue.c b/ipc/mqueue.c
-index 6ebfbf5..f3f40dc 100644
---- a/ipc/mqueue.c
-+++ b/ipc/mqueue.c
-@@ -330,8 +330,16 @@ static struct dentry *mqueue_mount(struct file_system_type *fs_type,
- int flags, const char *dev_name,
- void *data)
- {
-- if (!(flags & MS_KERNMOUNT))
-- data = current->nsproxy->ipc_ns;
-+ if (!(flags & MS_KERNMOUNT)) {
-+ struct ipc_namespace *ns = current->nsproxy->ipc_ns;
-+ /* Don't allow mounting unless the caller has CAP_SYS_ADMIN
-+ * over the ipc namespace.
-+ */
-+ if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
-+ return ERR_PTR(-EPERM);
-+
-+ data = ns;
-+ }
- return mount_ns(fs_type, flags, data, mqueue_fill_super);
- }
-
-diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c
-index c1c3dc1..bea15bd 100644
---- a/kernel/pid_namespace.c
-+++ b/kernel/pid_namespace.c
-@@ -181,6 +181,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
- int nr;
- int rc;
- struct task_struct *task, *me = current;
-+ int init_pids = thread_group_leader(me) ? 1 : 2;
-
- /* Don't allow any more processes into the pid namespace */
- disable_pid_allocation(pid_ns);
-@@ -230,7 +231,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns)
- */
- for (;;) {
- set_current_state(TASK_UNINTERRUPTIBLE);
-- if (pid_ns->nr_hashed == 1)
-+ if (pid_ns->nr_hashed == init_pids)
- break;
- schedule();
- }
-diff --git a/kernel/signal.c b/kernel/signal.c
-index 7591ccc..dec9c30 100644
---- a/kernel/signal.c
-+++ b/kernel/signal.c
-@@ -485,7 +485,7 @@ flush_signal_handlers(struct task_struct *t, int force_default)
- if (force_default || ka->sa.sa_handler != SIG_IGN)
- ka->sa.sa_handler = SIG_DFL;
- ka->sa.sa_flags = 0;
--#ifdef SA_RESTORER
-+#ifdef __ARCH_HAS_SA_RESTORER
- ka->sa.sa_restorer = NULL;
- #endif
- sigemptyset(&ka->sa.sa_mask);
-diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
-index 2ffbc24..fe1d581 100644
---- a/kernel/trace/trace.c
-+++ b/kernel/trace/trace.c
-@@ -2836,11 +2836,25 @@ static int set_tracer_option(struct tracer *trace, char *cmp, int neg)
- return -EINVAL;
- }
-
--static void set_tracer_flags(unsigned int mask, int enabled)
-+/* Some tracers require overwrite to stay enabled */
-+int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set)
-+{
-+ if (tracer->enabled && (mask & TRACE_ITER_OVERWRITE) && !set)
-+ return -1;
-+
-+ return 0;
-+}
-+
-+int set_tracer_flag(unsigned int mask, int enabled)
- {
- /* do nothing if flag is already set */
- if (!!(trace_flags & mask) == !!enabled)
-- return;
-+ return 0;
-+
-+ /* Give the tracer a chance to approve the change */
-+ if (current_trace->flag_changed)
-+ if (current_trace->flag_changed(current_trace, mask, !!enabled))
-+ return -EINVAL;
-
- if (enabled)
- trace_flags |= mask;
-@@ -2859,13 +2873,15 @@ static void set_tracer_flags(unsigned int mask, int enabled)
-
- if (mask == TRACE_ITER_PRINTK)
- trace_printk_start_stop_comm(enabled);
-+
-+ return 0;
- }
-
- static int trace_set_options(char *option)
- {
- char *cmp;
- int neg = 0;
-- int ret = 0;
-+ int ret = -ENODEV;
- int i;
-
- cmp = strstrip(option);
-@@ -2879,7 +2895,7 @@ static int trace_set_options(char *option)
-
- for (i = 0; trace_options[i]; i++) {
- if (strcmp(cmp, trace_options[i]) == 0) {
-- set_tracer_flags(1 << i, !neg);
-+ ret = set_tracer_flag(1 << i, !neg);
- break;
- }
- }
-@@ -2898,6 +2914,7 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
- size_t cnt, loff_t *ppos)
- {
- char buf[64];
-+ int ret;
-
- if (cnt >= sizeof(buf))
- return -EINVAL;
-@@ -2907,7 +2924,9 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
-
- buf[cnt] = 0;
-
-- trace_set_options(buf);
-+ ret = trace_set_options(buf);
-+ if (ret < 0)
-+ return ret;
-
- *ppos += cnt;
-
-@@ -3213,6 +3232,9 @@ static int tracing_set_tracer(const char *buf)
- goto out;
-
- trace_branch_disable();
-+
-+ current_trace->enabled = false;
-+
- if (current_trace && current_trace->reset)
- current_trace->reset(tr);
- if (current_trace && current_trace->use_max_tr) {
-@@ -3244,6 +3266,7 @@ static int tracing_set_tracer(const char *buf)
- }
-
- current_trace = t;
-+ current_trace->enabled = true;
- trace_branch_enable(tr);
- out:
- mutex_unlock(&trace_types_lock);
-@@ -4648,9 +4671,12 @@ trace_options_core_write(struct file *filp, const char __user *ubuf, size_t cnt,
- return -EINVAL;
-
- mutex_lock(&trace_types_lock);
-- set_tracer_flags(1 << index, val);
-+ ret = set_tracer_flag(1 << index, val);
- mutex_unlock(&trace_types_lock);
-
-+ if (ret < 0)
-+ return ret;
-+
- *ppos += cnt;
-
- return cnt;
-diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
-index c75d798..23f1d2c 100644
---- a/kernel/trace/trace.h
-+++ b/kernel/trace/trace.h
-@@ -283,10 +283,14 @@ struct tracer {
- enum print_line_t (*print_line)(struct trace_iterator *iter);
- /* If you handled the flag setting, return 0 */
- int (*set_flag)(u32 old_flags, u32 bit, int set);
-+ /* Return 0 if OK with change, else return non-zero */
-+ int (*flag_changed)(struct tracer *tracer,
-+ u32 mask, int set);
- struct tracer *next;
- struct tracer_flags *flags;
- bool print_max;
- bool use_max_tr;
-+ bool enabled;
- };
-
-
-@@ -835,6 +839,8 @@ extern const char *__stop___trace_bprintk_fmt[];
-
- void trace_printk_init_buffers(void);
- void trace_printk_start_comm(void);
-+int trace_keep_overwrite(struct tracer *tracer, u32 mask, int set);
-+int set_tracer_flag(unsigned int mask, int enabled);
-
- #undef FTRACE_ENTRY
- #define FTRACE_ENTRY(call, struct_name, id, tstruct, print, filter) \
-diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
-index 713a2ca..443b25b 100644
---- a/kernel/trace/trace_irqsoff.c
-+++ b/kernel/trace/trace_irqsoff.c
-@@ -32,7 +32,7 @@ enum {
-
- static int trace_type __read_mostly;
-
--static int save_lat_flag;
-+static int save_flags;
-
- static void stop_irqsoff_tracer(struct trace_array *tr, int graph);
- static int start_irqsoff_tracer(struct trace_array *tr, int graph);
-@@ -558,8 +558,11 @@ static void stop_irqsoff_tracer(struct trace_array *tr, int graph)
-
- static void __irqsoff_tracer_init(struct trace_array *tr)
- {
-- save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT;
-- trace_flags |= TRACE_ITER_LATENCY_FMT;
-+ save_flags = trace_flags;
-+
-+ /* non overwrite screws up the latency tracers */
-+ set_tracer_flag(TRACE_ITER_OVERWRITE, 1);
-+ set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1);
-
- tracing_max_latency = 0;
- irqsoff_trace = tr;
-@@ -573,10 +576,13 @@ static void __irqsoff_tracer_init(struct trace_array *tr)
-
- static void irqsoff_tracer_reset(struct trace_array *tr)
- {
-+ int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
-+ int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
-+
- stop_irqsoff_tracer(tr, is_graph());
-
-- if (!save_lat_flag)
-- trace_flags &= ~TRACE_ITER_LATENCY_FMT;
-+ set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag);
-+ set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag);
- }
-
- static void irqsoff_tracer_start(struct trace_array *tr)
-@@ -609,6 +615,7 @@ static struct tracer irqsoff_tracer __read_mostly =
- .print_line = irqsoff_print_line,
- .flags = &tracer_flags,
- .set_flag = irqsoff_set_flag,
-+ .flag_changed = trace_keep_overwrite,
- #ifdef CONFIG_FTRACE_SELFTEST
- .selftest = trace_selftest_startup_irqsoff,
- #endif
-@@ -642,6 +649,7 @@ static struct tracer preemptoff_tracer __read_mostly =
- .print_line = irqsoff_print_line,
- .flags = &tracer_flags,
- .set_flag = irqsoff_set_flag,
-+ .flag_changed = trace_keep_overwrite,
- #ifdef CONFIG_FTRACE_SELFTEST
- .selftest = trace_selftest_startup_preemptoff,
- #endif
-@@ -677,6 +685,7 @@ static struct tracer preemptirqsoff_tracer __read_mostly =
- .print_line = irqsoff_print_line,
- .flags = &tracer_flags,
- .set_flag = irqsoff_set_flag,
-+ .flag_changed = trace_keep_overwrite,
- #ifdef CONFIG_FTRACE_SELFTEST
- .selftest = trace_selftest_startup_preemptirqsoff,
- #endif
-diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
-index 9fe45fc..17bfec6 100644
---- a/kernel/trace/trace_sched_wakeup.c
-+++ b/kernel/trace/trace_sched_wakeup.c
-@@ -36,7 +36,7 @@ static void __wakeup_reset(struct trace_array *tr);
- static int wakeup_graph_entry(struct ftrace_graph_ent *trace);
- static void wakeup_graph_return(struct ftrace_graph_ret *trace);
-
--static int save_lat_flag;
-+static int save_flags;
-
- #define TRACE_DISPLAY_GRAPH 1
-
-@@ -540,8 +540,11 @@ static void stop_wakeup_tracer(struct trace_array *tr)
-
- static int __wakeup_tracer_init(struct trace_array *tr)
- {
-- save_lat_flag = trace_flags & TRACE_ITER_LATENCY_FMT;
-- trace_flags |= TRACE_ITER_LATENCY_FMT;
-+ save_flags = trace_flags;
-+
-+ /* non overwrite screws up the latency tracers */
-+ set_tracer_flag(TRACE_ITER_OVERWRITE, 1);
-+ set_tracer_flag(TRACE_ITER_LATENCY_FMT, 1);
-
- tracing_max_latency = 0;
- wakeup_trace = tr;
-@@ -563,12 +566,15 @@ static int wakeup_rt_tracer_init(struct trace_array *tr)
-
- static void wakeup_tracer_reset(struct trace_array *tr)
- {
-+ int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
-+ int overwrite_flag = save_flags & TRACE_ITER_OVERWRITE;
-+
- stop_wakeup_tracer(tr);
- /* make sure we put back any tasks we are tracing */
- wakeup_reset(tr);
-
-- if (!save_lat_flag)
-- trace_flags &= ~TRACE_ITER_LATENCY_FMT;
-+ set_tracer_flag(TRACE_ITER_LATENCY_FMT, lat_flag);
-+ set_tracer_flag(TRACE_ITER_OVERWRITE, overwrite_flag);
- }
-
- static void wakeup_tracer_start(struct trace_array *tr)
-@@ -594,6 +600,7 @@ static struct tracer wakeup_tracer __read_mostly =
- .print_line = wakeup_print_line,
- .flags = &tracer_flags,
- .set_flag = wakeup_set_flag,
-+ .flag_changed = trace_keep_overwrite,
- #ifdef CONFIG_FTRACE_SELFTEST
- .selftest = trace_selftest_startup_wakeup,
- #endif
-@@ -615,6 +622,7 @@ static struct tracer wakeup_rt_tracer __read_mostly =
- .print_line = wakeup_print_line,
- .flags = &tracer_flags,
- .set_flag = wakeup_set_flag,
-+ .flag_changed = trace_keep_overwrite,
- #ifdef CONFIG_FTRACE_SELFTEST
- .selftest = trace_selftest_startup_wakeup,
- #endif
-diff --git a/kernel/user.c b/kernel/user.c
-index 33acb5e..7f6ff2b 100644
---- a/kernel/user.c
-+++ b/kernel/user.c
-@@ -53,6 +53,8 @@ struct user_namespace init_user_ns = {
- .owner = GLOBAL_ROOT_UID,
- .group = GLOBAL_ROOT_GID,
- .proc_inum = PROC_USER_INIT_INO,
-+ .may_mount_sysfs = true,
-+ .may_mount_proc = true,
- };
- EXPORT_SYMBOL_GPL(init_user_ns);
-
-diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
-index dbfe36a7..f45e128 100644
---- a/kernel/user_namespace.c
-+++ b/kernel/user_namespace.c
-@@ -61,6 +61,15 @@ int create_user_ns(struct cred *new)
- kgid_t group = new->egid;
- int ret;
-
-+ /*
-+ * Verify that we can not violate the policy of which files
-+ * may be accessed that is specified by the root directory,
-+ * by verifing that the root directory is at the root of the
-+ * mount namespace which allows all files to be accessed.
-+ */
-+ if (current_chrooted())
-+ return -EPERM;
-+
- /* The creator needs a mapping in the parent user namespace
- * or else we won't be able to reasonably tell userspace who
- * created a user_namespace.
-@@ -87,6 +96,8 @@ int create_user_ns(struct cred *new)
-
- set_cred_user_ns(new, ns);
-
-+ update_mnt_policy(ns);
-+
- return 0;
- }
-
-diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
-index a292e80..acc74ad 100644
---- a/net/8021q/vlan.c
-+++ b/net/8021q/vlan.c
-@@ -86,13 +86,6 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
-
- grp = &vlan_info->grp;
-
-- /* Take it out of our own structures, but be sure to interlock with
-- * HW accelerating devices or SW vlan input packet processing if
-- * VLAN is not 0 (leave it there for 802.1p).
-- */
-- if (vlan_id)
-- vlan_vid_del(real_dev, vlan_id);
--
- grp->nr_vlan_devs--;
-
- if (vlan->flags & VLAN_FLAG_GVRP)
-@@ -108,6 +101,13 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
- if (grp->nr_vlan_devs == 0)
- vlan_gvrp_uninit_applicant(real_dev);
-
-+ /* Take it out of our own structures, but be sure to interlock with
-+ * HW accelerating devices or SW vlan input packet processing if
-+ * VLAN is not 0 (leave it there for 802.1p).
-+ */
-+ if (vlan_id)
-+ vlan_vid_del(real_dev, vlan_id);
-+
- /* Get rid of the vlan's reference to real_dev */
- dev_put(real_dev);
- }
-diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
-index 57f250c..aaf1957 100644
---- a/net/bluetooth/sco.c
-+++ b/net/bluetooth/sco.c
-@@ -361,6 +361,7 @@ static void __sco_sock_close(struct sock *sk)
- sco_chan_del(sk, ECONNRESET);
- break;
-
-+ case BT_CONNECT2:
- case BT_CONNECT:
- case BT_DISCONN:
- sco_chan_del(sk, ECONNRESET);
-diff --git a/net/core/dev.c b/net/core/dev.c
-index 1339f77..5d9c43d 100644
---- a/net/core/dev.c
-+++ b/net/core/dev.c
-@@ -1591,7 +1591,6 @@ void net_enable_timestamp(void)
- return;
- }
- #endif
-- WARN_ON(in_interrupt());
- static_key_slow_inc(&netstamp_needed);
- }
- EXPORT_SYMBOL(net_enable_timestamp);
-@@ -3277,6 +3276,7 @@ int netdev_rx_handler_register(struct net_device *dev,
- if (dev->rx_handler)
- return -EBUSY;
-
-+ /* Note: rx_handler_data must be set before rx_handler */
- rcu_assign_pointer(dev->rx_handler_data, rx_handler_data);
- rcu_assign_pointer(dev->rx_handler, rx_handler);
-
-@@ -3297,6 +3297,11 @@ void netdev_rx_handler_unregister(struct net_device *dev)
-
- ASSERT_RTNL();
- RCU_INIT_POINTER(dev->rx_handler, NULL);
-+ /* a reader seeing a non NULL rx_handler in a rcu_read_lock()
-+ * section has a guarantee to see a non NULL rx_handler_data
-+ * as well.
-+ */
-+ synchronize_net();
- RCU_INIT_POINTER(dev->rx_handler_data, NULL);
- }
- EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
-diff --git a/net/core/flow.c b/net/core/flow.c
-index b0901ee..3bad824 100644
---- a/net/core/flow.c
-+++ b/net/core/flow.c
-@@ -329,7 +329,7 @@ static void flow_cache_flush_per_cpu(void *data)
- struct flow_flush_info *info = data;
- struct tasklet_struct *tasklet;
-
-- tasklet = this_cpu_ptr(&info->cache->percpu->flush_tasklet);
-+ tasklet = &this_cpu_ptr(info->cache->percpu)->flush_tasklet;
- tasklet->data = (unsigned long)info;
- tasklet_schedule(tasklet);
- }
-diff --git a/net/core/scm.c b/net/core/scm.c
-index 905dcc6..2dc6cda 100644
---- a/net/core/scm.c
-+++ b/net/core/scm.c
-@@ -24,6 +24,7 @@
- #include <linux/interrupt.h>
- #include <linux/netdevice.h>
- #include <linux/security.h>
-+#include <linux/pid_namespace.h>
- #include <linux/pid.h>
- #include <linux/nsproxy.h>
- #include <linux/slab.h>
-@@ -52,7 +53,8 @@ static __inline__ int scm_check_creds(struct ucred *creds)
- if (!uid_valid(uid) || !gid_valid(gid))
- return -EINVAL;
-
-- if ((creds->pid == task_tgid_vnr(current) || nsown_capable(CAP_SYS_ADMIN)) &&
-+ if ((creds->pid == task_tgid_vnr(current) ||
-+ ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
- ((uid_eq(uid, cred->uid) || uid_eq(uid, cred->euid) ||
- uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
- ((gid_eq(gid, cred->gid) || gid_eq(gid, cred->egid) ||
-diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
-index 66702d3..9841a71 100644
---- a/net/ipv4/tcp_input.c
-+++ b/net/ipv4/tcp_input.c
-@@ -2064,11 +2064,8 @@ void tcp_enter_loss(struct sock *sk, int how)
- if (tcp_is_reno(tp))
- tcp_reset_reno_sack(tp);
-
-- if (!how) {
-- /* Push undo marker, if it was plain RTO and nothing
-- * was retransmitted. */
-- tp->undo_marker = tp->snd_una;
-- } else {
-+ tp->undo_marker = tp->snd_una;
-+ if (how) {
- tp->sacked_out = 0;
- tp->fackets_out = 0;
- }
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index c36c6c2..17d659e 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -1809,8 +1809,11 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
- goto send_now;
- }
-
-- /* Ok, it looks like it is advisable to defer. */
-- tp->tso_deferred = 1 | (jiffies << 1);
-+ /* Ok, it looks like it is advisable to defer.
-+ * Do not rearm the timer if already set to not break TCP ACK clocking.
-+ */
-+ if (!tp->tso_deferred)
-+ tp->tso_deferred = 1 | (jiffies << 1);
-
- return true;
-
-diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
-index 1b5d8cb..a36d17e 100644
---- a/net/ipv6/addrconf.c
-+++ b/net/ipv6/addrconf.c
-@@ -4787,26 +4787,20 @@ static void addrconf_sysctl_unregister(struct inet6_dev *idev)
-
- static int __net_init addrconf_init_net(struct net *net)
- {
-- int err;
-+ int err = -ENOMEM;
- struct ipv6_devconf *all, *dflt;
-
-- err = -ENOMEM;
-- all = &ipv6_devconf;
-- dflt = &ipv6_devconf_dflt;
-+ all = kmemdup(&ipv6_devconf, sizeof(ipv6_devconf), GFP_KERNEL);
-+ if (all == NULL)
-+ goto err_alloc_all;
-
-- if (!net_eq(net, &init_net)) {
-- all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
-- if (all == NULL)
-- goto err_alloc_all;
-+ dflt = kmemdup(&ipv6_devconf_dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
-+ if (dflt == NULL)
-+ goto err_alloc_dflt;
-
-- dflt = kmemdup(dflt, sizeof(ipv6_devconf_dflt), GFP_KERNEL);
-- if (dflt == NULL)
-- goto err_alloc_dflt;
-- } else {
-- /* these will be inherited by all namespaces */
-- dflt->autoconf = ipv6_defaults.autoconf;
-- dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
-- }
-+ /* these will be inherited by all namespaces */
-+ dflt->autoconf = ipv6_defaults.autoconf;
-+ dflt->disable_ipv6 = ipv6_defaults.disable_ipv6;
-
- net->ipv6.devconf_all = all;
- net->ipv6.devconf_dflt = dflt;
-diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
-index b196852..dee9964 100644
---- a/net/ipv6/ip6_input.c
-+++ b/net/ipv6/ip6_input.c
-@@ -118,6 +118,27 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
- ipv6_addr_loopback(&hdr->daddr))
- goto err;
-
-+ /* RFC4291 Errata ID: 3480
-+ * Interface-Local scope spans only a single interface on a
-+ * node and is useful only for loopback transmission of
-+ * multicast. Packets with interface-local scope received
-+ * from another node must be discarded.
-+ */
-+ if (!(skb->pkt_type == PACKET_LOOPBACK ||
-+ dev->flags & IFF_LOOPBACK) &&
-+ ipv6_addr_is_multicast(&hdr->daddr) &&
-+ IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
-+ goto err;
-+
-+ /* RFC4291 2.7
-+ * Nodes must not originate a packet to a multicast address whose scope
-+ * field contains the reserved value 0; if such a packet is received, it
-+ * must be silently dropped.
-+ */
-+ if (ipv6_addr_is_multicast(&hdr->daddr) &&
-+ IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 0)
-+ goto err;
-+
- /*
- * RFC4291 2.7
- * Multicast addresses must not be used as source addresses in IPv6
-diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
-index b833677..4d04105 100644
---- a/net/irda/af_irda.c
-+++ b/net/irda/af_irda.c
-@@ -2584,8 +2584,10 @@ bed:
- NULL, NULL, NULL);
-
- /* Check if the we got some results */
-- if (!self->cachedaddr)
-- return -EAGAIN; /* Didn't find any devices */
-+ if (!self->cachedaddr) {
-+ err = -EAGAIN; /* Didn't find any devices */
-+ goto out;
-+ }
- daddr = self->cachedaddr;
- /* Cleanup */
- self->cachedaddr = 0;
-diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
-index 9979bf8..e14e676 100644
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3401,6 +3401,10 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
- ret = 0;
-
- out:
-+ /* don't print the message below for VHT mismatch if VHT is disabled */
-+ if (ret & IEEE80211_STA_DISABLE_VHT)
-+ vht_chandef = *chandef;
-+
- while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
- IEEE80211_CHAN_DISABLED)) {
- if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
-diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index ca9fde1..c8b32a0 100644
---- a/net/mac80211/sta_info.c
-+++ b/net/mac80211/sta_info.c
-@@ -756,6 +756,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
- struct ieee80211_local *local;
- struct ieee80211_sub_if_data *sdata;
- int ret, i;
-+ bool have_key = false;
-
- might_sleep();
-
-@@ -783,12 +784,19 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
- list_del_rcu(&sta->list);
-
- mutex_lock(&local->key_mtx);
-- for (i = 0; i < NUM_DEFAULT_KEYS; i++)
-+ for (i = 0; i < NUM_DEFAULT_KEYS; i++) {
- __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
-- if (sta->ptk)
-+ have_key = true;
-+ }
-+ if (sta->ptk) {
- __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
-+ have_key = true;
-+ }
- mutex_unlock(&local->key_mtx);
-
-+ if (!have_key)
-+ synchronize_net();
-+
- sta->dead = true;
-
- local->num_sta--;
-diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
-index f2aabb6..5a55be3 100644
---- a/net/netlink/genetlink.c
-+++ b/net/netlink/genetlink.c
-@@ -142,6 +142,7 @@ int genl_register_mc_group(struct genl_family *family,
- int err = 0;
-
- BUG_ON(grp->name[0] == '\0');
-+ BUG_ON(memchr(grp->name, '\0', GENL_NAMSIZ) == NULL);
-
- genl_lock();
-
-diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c
-index 4e606fc..5578628 100644
---- a/net/sched/sch_fq_codel.c
-+++ b/net/sched/sch_fq_codel.c
-@@ -195,7 +195,7 @@ static int fq_codel_enqueue(struct sk_buff *skb, struct Qdisc *sch)
- flow->deficit = q->quantum;
- flow->dropped = 0;
- }
-- if (++sch->q.qlen < sch->limit)
-+ if (++sch->q.qlen <= sch->limit)
- return NET_XMIT_SUCCESS;
-
- q->drop_overlimit++;
-diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
-index fb20f25..f8529fc 100644
---- a/net/sunrpc/sched.c
-+++ b/net/sunrpc/sched.c
-@@ -180,6 +180,8 @@ static void __rpc_add_wait_queue(struct rpc_wait_queue *queue,
- list_add_tail(&task->u.tk_wait.list, &queue->tasks[0]);
- task->tk_waitqueue = queue;
- queue->qlen++;
-+ /* barrier matches the read in rpc_wake_up_task_queue_locked() */
-+ smp_wmb();
- rpc_set_queued(task);
-
- dprintk("RPC: %5u added to queue %p \"%s\"\n",
-@@ -430,8 +432,11 @@ static void __rpc_do_wake_up_task(struct rpc_wait_queue *queue, struct rpc_task
- */
- static void rpc_wake_up_task_queue_locked(struct rpc_wait_queue *queue, struct rpc_task *task)
- {
-- if (RPC_IS_QUEUED(task) && task->tk_waitqueue == queue)
-- __rpc_do_wake_up_task(queue, task);
-+ if (RPC_IS_QUEUED(task)) {
-+ smp_rmb();
-+ if (task->tk_waitqueue == queue)
-+ __rpc_do_wake_up_task(queue, task);
-+ }
- }
-
- /*
-diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 5b5c876..b45eb65 100644
---- a/net/unix/af_unix.c
-+++ b/net/unix/af_unix.c
-@@ -384,7 +384,7 @@ static void unix_sock_destructor(struct sock *sk)
- #endif
- }
-
--static int unix_release_sock(struct sock *sk, int embrion)
-+static void unix_release_sock(struct sock *sk, int embrion)
- {
- struct unix_sock *u = unix_sk(sk);
- struct path path;
-@@ -453,8 +453,6 @@ static int unix_release_sock(struct sock *sk, int embrion)
-
- if (unix_tot_inflight)
- unix_gc(); /* Garbage collect fds */
--
-- return 0;
- }
-
- static void init_peercred(struct sock *sk)
-@@ -701,9 +699,10 @@ static int unix_release(struct socket *sock)
- if (!sk)
- return 0;
-
-+ unix_release_sock(sk, 0);
- sock->sk = NULL;
-
-- return unix_release_sock(sk, 0);
-+ return 0;
- }
-
- static int unix_autobind(struct socket *sock)
diff --git a/3.8.6/4420_grsecurity-2.9.1-3.8.6-201304052305.patch b/3.8.6/4420_grsecurity-2.9.1-3.8.6-201304102034.patch
similarity index 99%
rename from 3.8.6/4420_grsecurity-2.9.1-3.8.6-201304052305.patch
rename to 3.8.6/4420_grsecurity-2.9.1-3.8.6-201304102034.patch
index 6870621..a1f299e 100644
--- a/3.8.6/4420_grsecurity-2.9.1-3.8.6-201304052305.patch
+++ b/3.8.6/4420_grsecurity-2.9.1-3.8.6-201304102034.patch
@@ -259,7 +259,7 @@ index 986614d..e8bfedc 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index 10075d6..dcb3e14 100644
+index 10075d6..8a01f3b 100644
--- a/Makefile
+++ b/Makefile
@@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -269,7 +269,7 @@ index 10075d6..dcb3e14 100644
-HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
-HOSTCXXFLAGS = -O2
+HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
-+HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
++HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
+HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
# Decide whether to build built-in, modular, or both.
@@ -5019,19 +5019,10 @@ index 54ff557..70c88b7 100644
static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
diff --git a/arch/ia64/include/asm/uaccess.h b/arch/ia64/include/asm/uaccess.h
-index 449c8c0..50cdf87 100644
+index 449c8c0..18965fb 100644
--- a/arch/ia64/include/asm/uaccess.h
+++ b/arch/ia64/include/asm/uaccess.h
-@@ -42,6 +42,8 @@
- #include <asm/pgtable.h>
- #include <asm/io.h>
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * For historical reasons, the following macros are grossly misnamed:
- */
-@@ -240,12 +242,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
+@@ -240,12 +240,24 @@ extern unsigned long __must_check __copy_user (void __user *to, const void __use
static inline unsigned long
__copy_to_user (void __user *to, const void *from, unsigned long count)
{
@@ -5056,7 +5047,7 @@ index 449c8c0..50cdf87 100644
return __copy_user((__force void __user *) to, from, count);
}
-@@ -255,10 +269,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -255,10 +267,13 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void __user *__cu_to = (to); \
const void *__cu_from = (from); \
@@ -5072,7 +5063,7 @@ index 449c8c0..50cdf87 100644
__cu_len; \
})
-@@ -266,11 +283,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
+@@ -266,11 +281,14 @@ __copy_from_user (void *to, const void __user *from, unsigned long count)
({ \
void *__cu_to = (to); \
const void __user *__cu_from = (from); \
@@ -5208,9 +5199,18 @@ index 24603be..948052d 100644
DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
}
diff --git a/arch/ia64/kernel/palinfo.c b/arch/ia64/kernel/palinfo.c
-index 77597e5..6f28f3f 100644
+index 77597e5..189dd62f 100644
--- a/arch/ia64/kernel/palinfo.c
+++ b/arch/ia64/kernel/palinfo.c
+@@ -977,7 +977,7 @@ create_palinfo_proc_entries(unsigned int cpu)
+ struct proc_dir_entry **pdir;
+ struct proc_dir_entry *cpu_dir;
+ int j;
+- char cpustr[sizeof(CPUSTR)];
++ char cpustr[3+4+1];
+
+
+ /*
@@ -1045,7 +1045,7 @@ static int __cpuinit palinfo_cpu_callback(struct notifier_block *nfb,
return NOTIFY_OK;
}
@@ -6707,19 +6707,10 @@ index 406b7b9..af63426 100644
#define _TIF_USER_WORK_MASK (_TIF_SIGPENDING | _TIF_NEED_RESCHED | \
_TIF_NOTIFY_RESUME | _TIF_UPROBE)
diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h
-index 4db4959..335e00c 100644
+index 4db4959..aba5c41 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
-@@ -13,6 +13,8 @@
- #define VERIFY_READ 0
- #define VERIFY_WRITE 1
-
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+
- /*
- * The fs value determines whether argument validity checking should be
- * performed or not. If get_fs() == USER_DS, checking is performed, with
-@@ -318,52 +320,6 @@ do { \
+@@ -318,52 +318,6 @@ do { \
extern unsigned long __copy_tofrom_user(void __user *to,
const void __user *from, unsigned long size);
@@ -6772,7 +6763,7 @@ index 4db4959..335e00c 100644
static inline unsigned long __copy_from_user_inatomic(void *to,
const void __user *from, unsigned long n)
{
-@@ -387,6 +343,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
+@@ -387,6 +341,10 @@ static inline unsigned long __copy_from_user_inatomic(void *to,
if (ret == 0)
return 0;
}
@@ -6783,7 +6774,7 @@ index 4db4959..335e00c 100644
return __copy_tofrom_user((__force void __user *)to, from, n);
}
-@@ -413,6 +373,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
+@@ -413,6 +371,10 @@ static inline unsigned long __copy_to_user_inatomic(void __user *to,
if (ret == 0)
return 0;
}
@@ -6794,7 +6785,7 @@ index 4db4959..335e00c 100644
return __copy_tofrom_user(to, (__force const void __user *)from, n);
}
-@@ -430,6 +394,92 @@ static inline unsigned long __copy_to_user(void __user *to,
+@@ -430,6 +392,92 @@ static inline unsigned long __copy_to_user(void __user *to,
return __copy_to_user_inatomic(to, from, size);
}
@@ -8409,20 +8400,13 @@ index 269bd92..e46a9b8 100644
* Thread-synchronous status.
*
diff --git a/arch/sparc/include/asm/uaccess.h b/arch/sparc/include/asm/uaccess.h
-index 0167d26..9acd8ed 100644
+index 0167d26..767bb0c 100644
--- a/arch/sparc/include/asm/uaccess.h
+++ b/arch/sparc/include/asm/uaccess.h
-@@ -1,5 +1,13 @@
+@@ -1,5 +1,6 @@
#ifndef ___ASM_SPARC_UACCESS_H
#define ___ASM_SPARC_UACCESS_H
+
-+#ifdef __KERNEL__
-+#ifndef __ASSEMBLY__
-+#include <linux/types.h>
-+extern void check_object_size(const void *ptr, unsigned long n, bool to);
-+#endif
-+#endif
-+
#if defined(__sparc__) && defined(__arch64__)
#include <asm/uaccess_64.h>
#else
@@ -8609,6 +8593,19 @@ index cdb80b2..5ca141d 100644
(void *) gp->tpc,
(void *) gp->o7,
(void *) gp->i7,
+diff --git a/arch/sparc/kernel/prom_common.c b/arch/sparc/kernel/prom_common.c
+index 1303021..c2a6321 100644
+--- a/arch/sparc/kernel/prom_common.c
++++ b/arch/sparc/kernel/prom_common.c
+@@ -143,7 +143,7 @@ static int __init prom_common_nextprop(phandle node, char *prev, char *buf)
+
+ unsigned int prom_early_allocated __initdata;
+
+-static struct of_pdt_ops prom_sparc_ops __initdata = {
++static struct of_pdt_ops prom_sparc_ops __initconst = {
+ .nextprop = prom_common_nextprop,
+ .getproplen = prom_getproplen,
+ .getproperty = prom_getproperty,
diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c
index 7ff45e4..a58f271 100644
--- a/arch/sparc/kernel/ptrace_64.c
@@ -9050,6 +9047,115 @@ index 8201c25e..072a2a7 100644
regs->tpc, (void *) regs->tpc);
}
}
+diff --git a/arch/sparc/kernel/us3_cpufreq.c b/arch/sparc/kernel/us3_cpufreq.c
+index eb1624b..f9f4ddb 100644
+--- a/arch/sparc/kernel/us3_cpufreq.c
++++ b/arch/sparc/kernel/us3_cpufreq.c
+@@ -18,14 +18,12 @@
+ #include <asm/head.h>
+ #include <asm/timer.h>
+
+-static struct cpufreq_driver *cpufreq_us3_driver;
+-
+ struct us3_freq_percpu_info {
+ struct cpufreq_frequency_table table[4];
+ };
+
+ /* Indexed by cpu number. */
+-static struct us3_freq_percpu_info *us3_freq_table;
++static struct us3_freq_percpu_info us3_freq_table[NR_CPUS];
+
+ /* UltraSPARC-III has three dividers: 1, 2, and 32. These are controlled
+ * in the Safari config register.
+@@ -191,12 +189,25 @@ static int __init us3_freq_cpu_init(struct cpufreq_policy *policy)
+
+ static int us3_freq_cpu_exit(struct cpufreq_policy *policy)
+ {
+- if (cpufreq_us3_driver)
+- us3_set_cpu_divider_index(policy->cpu, 0);
++ us3_set_cpu_divider_index(policy->cpu, 0);
+
+ return 0;
+ }
+
++static int __init us3_freq_init(void);
++static void __exit us3_freq_exit(void);
++
++static struct cpufreq_driver cpufreq_us3_driver = {
++ .init = us3_freq_cpu_init,
++ .verify = us3_freq_verify,
++ .target = us3_freq_target,
++ .get = us3_freq_get,
++ .exit = us3_freq_cpu_exit,
++ .owner = THIS_MODULE,
++ .name = "UltraSPARC-III",
++
++};
++
+ static int __init us3_freq_init(void)
+ {
+ unsigned long manuf, impl, ver;
+@@ -213,57 +224,15 @@ static int __init us3_freq_init(void)
+ (impl == CHEETAH_IMPL ||
+ impl == CHEETAH_PLUS_IMPL ||
+ impl == JAGUAR_IMPL ||
+- impl == PANTHER_IMPL)) {
+- struct cpufreq_driver *driver;
+-
+- ret = -ENOMEM;
+- driver = kzalloc(sizeof(struct cpufreq_driver), GFP_KERNEL);
+- if (!driver)
+- goto err_out;
+-
+- us3_freq_table = kzalloc(
+- (NR_CPUS * sizeof(struct us3_freq_percpu_info)),
+- GFP_KERNEL);
+- if (!us3_freq_table)
+- goto err_out;
+-
+- driver->init = us3_freq_cpu_init;
+- driver->verify = us3_freq_verify;
+- driver->target = us3_freq_target;
+- driver->get = us3_freq_get;
+- driver->exit = us3_freq_cpu_exit;
+- driver->owner = THIS_MODULE,
+- strcpy(driver->name, "UltraSPARC-III");
+-
+- cpufreq_us3_driver = driver;
+- ret = cpufreq_register_driver(driver);
+- if (ret)
+- goto err_out;
+-
+- return 0;
+-
+-err_out:
+- if (driver) {
+- kfree(driver);
+- cpufreq_us3_driver = NULL;
+- }
+- kfree(us3_freq_table);
+- us3_freq_table = NULL;
+- return ret;
+- }
++ impl == PANTHER_IMPL))
++ return cpufreq_register_driver(cpufreq_us3_driver);
+
+ return -ENODEV;
+ }
+
+ static void __exit us3_freq_exit(void)
+ {
+- if (cpufreq_us3_driver) {
+- cpufreq_unregister_driver(cpufreq_us3_driver);
+- kfree(cpufreq_us3_driver);
+- cpufreq_us3_driver = NULL;
+- kfree(us3_freq_table);
+- us3_freq_table = NULL;
+- }
++ cpufreq_unregister_driver(cpufreq_us3_driver);
+ }
+
+ MODULE_AUTHOR("David S. Miller <davem@redhat.com>");
diff --git a/arch/sparc/lib/Makefile b/arch/sparc/lib/Makefile
index 8410065f2..4fd4ca22 100644
--- a/arch/sparc/lib/Makefile
@@ -28846,7 +28952,7 @@ index 75c9a6a..498d677 100644
if (vma == &gate_vma)
return "[vsyscall]";
diff --git a/arch/x86/mm/iomap_32.c b/arch/x86/mm/iomap_32.c
-index 7b179b4..6bd1777 100644
+index 7b179b4..6bd17777 100644
--- a/arch/x86/mm/iomap_32.c
+++ b/arch/x86/mm/iomap_32.c
@@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long pfn, pgprot_t prot)
@@ -35690,6 +35796,58 @@ index 598c281..60d590e 100644
- *sequence) <= (1 << 23)));
*sequence = cur_fence;
+diff --git a/drivers/gpu/drm/mgag200/mgag200_mode.c b/drivers/gpu/drm/mgag200/mgag200_mode.c
+index 4f50c40..2e7c949 100644
+--- a/drivers/gpu/drm/mgag200/mgag200_mode.c
++++ b/drivers/gpu/drm/mgag200/mgag200_mode.c
+@@ -751,8 +751,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ int i;
+ unsigned char misc = 0;
+ unsigned char ext_vga[6];
+- unsigned char ext_vga_index24;
+- unsigned char dac_index90 = 0;
+ u8 bppshift;
+
+ static unsigned char dacvalue[] = {
+@@ -803,7 +801,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ option2 = 0x0000b000;
+ break;
+ case G200_ER:
+- dac_index90 = 0;
+ break;
+ }
+
+@@ -852,10 +849,8 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ WREG_DAC(i, dacvalue[i]);
+ }
+
+- if (mdev->type == G200_ER) {
+- WREG_DAC(0x90, dac_index90);
+- }
+-
++ if (mdev->type == G200_ER)
++ WREG_DAC(0x90, 0);
+
+ if (option)
+ pci_write_config_dword(dev->pdev, PCI_MGA_OPTION, option);
+@@ -952,8 +947,6 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ if (mdev->type == G200_WB)
+ ext_vga[1] |= 0x88;
+
+- ext_vga_index24 = 0x05;
+-
+ /* Set pixel clocks */
+ misc = 0x2d;
+ WREG8(MGA_MISC_OUT, misc);
+@@ -965,7 +958,7 @@ static int mga_crtc_mode_set(struct drm_crtc *crtc,
+ }
+
+ if (mdev->type == G200_ER)
+- WREG_ECRT(24, ext_vga_index24);
++ WREG_ECRT(0x24, 0x5);
+
+ if (mdev->type == G200_EV) {
+ WREG_ECRT(6, 0);
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index 865eddf..62c4cc3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -44666,6 +44824,27 @@ index 57c01ab..8a05959 100644
}
/*
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index b28e66c..4a62e12 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -331,6 +331,7 @@ static long vfio_pci_ioctl(void *device_data,
+
+ if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) {
+ size_t size;
++ int max = vfio_pci_get_irq_count(vdev, hdr.index);
+
+ if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL)
+ size = sizeof(uint8_t);
+@@ -340,7 +341,7 @@ static long vfio_pci_ioctl(void *device_data,
+ return -EINVAL;
+
+ if (hdr.argsz - minsz < hdr.count * size ||
+- hdr.count > vfio_pci_get_irq_count(vdev, hdr.index))
++ hdr.start >= max || hdr.start + hdr.count > max)
+ return -EINVAL;
+
+ data = memdup_user((void __user *)(arg + minsz),
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index 8c55011..eed4ae1a 100644
--- a/drivers/video/aty/aty128fb.c
@@ -50355,10 +50534,51 @@ index cc7709e..7e7211f 100644
/* Free the char* */
kfree(buf);
diff --git a/fs/ecryptfs/miscdev.c b/fs/ecryptfs/miscdev.c
-index 412e6ed..4292d22 100644
+index 412e6ed..d8263e8 100644
--- a/fs/ecryptfs/miscdev.c
+++ b/fs/ecryptfs/miscdev.c
-@@ -315,7 +315,7 @@ check_list:
+@@ -80,13 +80,6 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
+ int rc;
+
+ mutex_lock(&ecryptfs_daemon_hash_mux);
+- rc = try_module_get(THIS_MODULE);
+- if (rc == 0) {
+- rc = -EIO;
+- printk(KERN_ERR "%s: Error attempting to increment module use "
+- "count; rc = [%d]\n", __func__, rc);
+- goto out_unlock_daemon_list;
+- }
+ rc = ecryptfs_find_daemon_by_euid(&daemon);
+ if (!rc) {
+ rc = -EINVAL;
+@@ -96,7 +89,7 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
+ if (rc) {
+ printk(KERN_ERR "%s: Error attempting to spawn daemon; "
+ "rc = [%d]\n", __func__, rc);
+- goto out_module_put_unlock_daemon_list;
++ goto out_unlock_daemon_list;
+ }
+ mutex_lock(&daemon->mux);
+ if (daemon->flags & ECRYPTFS_DAEMON_MISCDEV_OPEN) {
+@@ -108,9 +101,6 @@ ecryptfs_miscdev_open(struct inode *inode, struct file *file)
+ atomic_inc(&ecryptfs_num_miscdev_opens);
+ out_unlock_daemon:
+ mutex_unlock(&daemon->mux);
+-out_module_put_unlock_daemon_list:
+- if (rc)
+- module_put(THIS_MODULE);
+ out_unlock_daemon_list:
+ mutex_unlock(&ecryptfs_daemon_hash_mux);
+ return rc;
+@@ -147,7 +137,6 @@ ecryptfs_miscdev_release(struct inode *inode, struct file *file)
+ "bug.\n", __func__, rc);
+ BUG();
+ }
+- module_put(THIS_MODULE);
+ return rc;
+ }
+
+@@ -315,7 +304,7 @@ check_list:
goto out_unlock_msg_ctx;
i = PKT_TYPE_SIZE + PKT_CTR_SIZE;
if (msg_ctx->msg) {
@@ -50367,6 +50587,14 @@ index 412e6ed..4292d22 100644
goto out_unlock_msg_ctx;
i += packet_length_size;
if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
+@@ -471,6 +460,7 @@ out_free:
+
+
+ static const struct file_operations ecryptfs_miscdev_fops = {
++ .owner = THIS_MODULE,
+ .open = ecryptfs_miscdev_open,
+ .poll = ecryptfs_miscdev_poll,
+ .read = ecryptfs_miscdev_read,
diff --git a/fs/ecryptfs/read_write.c b/fs/ecryptfs/read_write.c
index b2a34a1..162fa69 100644
--- a/fs/ecryptfs/read_write.c
@@ -53797,7 +54025,7 @@ index ec97aef..e67718d 100644
out:
return len;
diff --git a/fs/namespace.c b/fs/namespace.c
-index 5dd7709..0002ebe 100644
+index 5dd7709..6f64e9c 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1219,6 +1219,9 @@ static int do_umount(struct mount *mnt, int flags)
@@ -53820,6 +54048,15 @@ index 5dd7709..0002ebe 100644
return retval;
}
+@@ -1713,7 +1719,7 @@ static int do_loopback(struct path *path, const char *old_name,
+
+ if (IS_ERR(mnt)) {
+ err = PTR_ERR(mnt);
+- goto out;
++ goto out2;
+ }
+
+ err = graft_tree(mnt, path);
@@ -2294,6 +2300,16 @@ long do_mount(const char *dev_name, const char *dir_name,
MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
MS_STRICTATIME);
@@ -53905,6 +54142,111 @@ index ebeb94c..ff35337 100644
}
void nfs_fattr_init(struct nfs_fattr *fattr)
+diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
+index 2e9779b..5a43da0 100644
+--- a/fs/nfs/nfs4client.c
++++ b/fs/nfs/nfs4client.c
+@@ -300,7 +300,7 @@ int nfs40_walk_client_list(struct nfs_client *new,
+ struct rpc_cred *cred)
+ {
+ struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
+- struct nfs_client *pos, *n, *prev = NULL;
++ struct nfs_client *pos, *prev = NULL;
+ struct nfs4_setclientid_res clid = {
+ .clientid = new->cl_clientid,
+ .confirm = new->cl_confirm,
+@@ -308,10 +308,23 @@ int nfs40_walk_client_list(struct nfs_client *new,
+ int status = -NFS4ERR_STALE_CLIENTID;
+
+ spin_lock(&nn->nfs_client_lock);
+- list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
++ list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+ /* If "pos" isn't marked ready, we can't trust the
+ * remaining fields in "pos" */
+- if (pos->cl_cons_state < NFS_CS_READY)
++ if (pos->cl_cons_state > NFS_CS_READY) {
++ atomic_inc(&pos->cl_count);
++ spin_unlock(&nn->nfs_client_lock);
++
++ if (prev)
++ nfs_put_client(prev);
++ prev = pos;
++
++ status = nfs_wait_client_init_complete(pos);
++ spin_lock(&nn->nfs_client_lock);
++ if (status < 0)
++ continue;
++ }
++ if (pos->cl_cons_state != NFS_CS_READY)
+ continue;
+
+ if (pos->rpc_ops != new->rpc_ops)
+@@ -423,16 +436,16 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ struct rpc_cred *cred)
+ {
+ struct nfs_net *nn = net_generic(new->cl_net, nfs_net_id);
+- struct nfs_client *pos, *n, *prev = NULL;
++ struct nfs_client *pos, *prev = NULL;
+ int status = -NFS4ERR_STALE_CLIENTID;
+
+ spin_lock(&nn->nfs_client_lock);
+- list_for_each_entry_safe(pos, n, &nn->nfs_client_list, cl_share_link) {
++ list_for_each_entry(pos, &nn->nfs_client_list, cl_share_link) {
+ /* If "pos" isn't marked ready, we can't trust the
+ * remaining fields in "pos", especially the client
+ * ID and serverowner fields. Wait for CREATE_SESSION
+ * to finish. */
+- if (pos->cl_cons_state < NFS_CS_READY) {
++ if (pos->cl_cons_state > NFS_CS_READY) {
+ atomic_inc(&pos->cl_count);
+ spin_unlock(&nn->nfs_client_lock);
+
+@@ -440,18 +453,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ nfs_put_client(prev);
+ prev = pos;
+
+- nfs4_schedule_lease_recovery(pos);
+ status = nfs_wait_client_init_complete(pos);
+- if (status < 0) {
+- nfs_put_client(pos);
+- spin_lock(&nn->nfs_client_lock);
+- continue;
++ if (status == 0) {
++ nfs4_schedule_lease_recovery(pos);
++ status = nfs4_wait_clnt_recover(pos);
+ }
+- status = pos->cl_cons_state;
+ spin_lock(&nn->nfs_client_lock);
+ if (status < 0)
+ continue;
+ }
++ if (pos->cl_cons_state != NFS_CS_READY)
++ continue;
+
+ if (pos->rpc_ops != new->rpc_ops)
+ continue;
+@@ -469,17 +481,17 @@ int nfs41_walk_client_list(struct nfs_client *new,
+ continue;
+
+ atomic_inc(&pos->cl_count);
+- spin_unlock(&nn->nfs_client_lock);
++ *result = pos;
+ dprintk("NFS: <-- %s using nfs_client = %p ({%d})\n",
+ __func__, pos, atomic_read(&pos->cl_count));
+-
+- *result = pos;
+- return 0;
++ break;
+ }
+
+ /* No matching nfs_client found. */
+ spin_unlock(&nn->nfs_client_lock);
+ dprintk("NFS: <-- %s status = %d\n", __func__, status);
++ if (prev)
++ nfs_put_client(prev);
+ return status;
+ }
+ #endif /* CONFIG_NFS_V4_1 */
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 9d1c5db..1e13db8 100644
--- a/fs/nfsd/nfs4proc.c
@@ -57679,7 +58021,7 @@ index 0000000..1b9afa9
+endif
diff --git a/grsecurity/gracl.c b/grsecurity/gracl.c
new file mode 100644
-index 0000000..d0e7b38
+index 0000000..b306b36
--- /dev/null
+++ b/grsecurity/gracl.c
@@ -0,0 +1,4071 @@
@@ -60015,7 +60357,7 @@ index 0000000..d0e7b38
+ return;
+
+ for (i = 0; i < RLIM_NLIMITS; i++) {
-+ if (!(proc->resmask & (1 << i)))
++ if (!(proc->resmask & (1U << i)))
+ continue;
+
+ task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
@@ -61250,7 +61592,7 @@ index 0000000..d0e7b38
+ acl = task->acl;
+
+ if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
-+ !(acl->resmask & (1 << (unsigned short) res))))
++ !(acl->resmask & (1U << (unsigned short) res))))
+ return;
+
+ if (wanted >= acl->res[res].rlim_cur) {
@@ -62420,10 +62762,10 @@ index 0000000..a340c17
+}
diff --git a/grsecurity/gracl_ip.c b/grsecurity/gracl_ip.c
new file mode 100644
-index 0000000..4699807
+index 0000000..8132048
--- /dev/null
+++ b/grsecurity/gracl_ip.c
-@@ -0,0 +1,384 @@
+@@ -0,0 +1,387 @@
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
+#include <asm/errno.h>
@@ -62530,7 +62872,7 @@ index 0000000..4699807
+
+ curr = current->acl;
+
-+ if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
++ if (curr->sock_families[domain / 32] & (1U << (domain % 32))) {
+ /* the family is allowed, if this is PF_INET allow it only if
+ the extra sock type/protocol checks pass */
+ if (domain == PF_INET)
@@ -62557,8 +62899,8 @@ index 0000000..4699807
+ if (!curr->ips)
+ goto exit;
+
-+ if ((curr->ip_type & (1 << type)) &&
-+ (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
++ if ((curr->ip_type & (1U << type)) &&
++ (curr->ip_proto[protocol / 32] & (1U << (protocol % 32))))
+ goto exit;
+
+ if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
@@ -62595,6 +62937,9 @@ index 0000000..4699807
+ gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain),
+ gr_socktype_to_name(type), gr_proto_to_name(protocol));
+ else
++#ifndef CONFIG_IPV6
++ if (domain != PF_INET6)
++#endif
+ gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain),
+ gr_socktype_to_name(type), protocol);
+
@@ -62610,8 +62955,8 @@ index 0000000..4699807
+ (ip_port <= ip->high) &&
+ ((ntohl(ip_addr) & our_netmask) ==
+ (ntohl(our_addr) & our_netmask))
-+ && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
-+ && (ip->type & (1 << type))) {
++ && (ip->proto[protocol / 32] & (1U << (protocol % 32)))
++ && (ip->type & (1U << type))) {
+ if (ip->mode & GR_INVERT)
+ return 2; // specifically denied
+ else
@@ -63097,7 +63442,7 @@ index 0000000..39645c9
+}
diff --git a/grsecurity/gracl_segv.c b/grsecurity/gracl_segv.c
new file mode 100644
-index 0000000..8c8fc9d
+index 0000000..cb1e5ab
--- /dev/null
+++ b/grsecurity/gracl_segv.c
@@ -0,0 +1,303 @@
@@ -63298,7 +63643,7 @@ index 0000000..8c8fc9d
+
+ curr = task->acl;
+
-+ if (!(curr->resmask & (1 << GR_CRASH_RES)))
++ if (!(curr->resmask & (1U << GR_CRASH_RES)))
+ return;
+
+ if (time_before_eq(curr->expires, get_seconds())) {
@@ -63364,7 +63709,7 @@ index 0000000..8c8fc9d
+ current->role);
+ read_unlock(&gr_inode_lock);
+
-+ if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
++ if (!curr || !(curr->resmask & (1U << GR_CRASH_RES)) ||
+ (!curr->crashes && !curr->expires))
+ return 0;
+
@@ -85838,7 +86183,7 @@ index 8acce01..2e306bb 100644
return error;
}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 6212ec9..dd4ad3b 100644
+index 6212ec9..5ee16b2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -58,7 +58,7 @@ struct rtnl_link {
@@ -85876,6 +86221,24 @@ index 6212ec9..dd4ad3b 100644
}
EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
+@@ -1068,7 +1071,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ rcu_read_lock();
+ cb->seq = net->dev_base_seq;
+
+- if (nlmsg_parse(cb->nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
++ if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+ ifla_policy) >= 0) {
+
+ if (tb[IFLA_EXT_MASK])
+@@ -1924,7 +1927,7 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
+ u32 ext_filter_mask = 0;
+ u16 min_ifinfo_dump_size = 0;
+
+- if (nlmsg_parse(nlh, sizeof(struct rtgenmsg), tb, IFLA_MAX,
++ if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+ ifla_policy) >= 0) {
+ if (tb[IFLA_EXT_MASK])
+ ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
diff --git a/net/core/scm.c b/net/core/scm.c
index 2dc6cda..2159524 100644
--- a/net/core/scm.c
@@ -89667,7 +90030,7 @@ index bf3c6e8..376d8d0 100644
table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
diff --git a/net/socket.c b/net/socket.c
-index 2ca51c7..9a9c83e 100644
+index 2ca51c7..ee5feb5 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -89,6 +89,7 @@
@@ -89829,6 +90192,15 @@ index 2ca51c7..9a9c83e 100644
SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
unsigned int, flags, struct sockaddr __user *, addr,
int, addr_len)
+@@ -1840,7 +1902,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
+ struct socket *sock;
+ struct iovec iov;
+ struct msghdr msg;
+- struct sockaddr_storage address;
++ struct sockaddr_storage address = { };
+ int err, err2;
+ int fput_needed;
+
@@ -2047,7 +2109,7 @@ static int __sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
* checking falls down on this.
*/
@@ -89947,10 +90319,52 @@ index 2ca51c7..9a9c83e 100644
set_fs(KERNEL_DS);
if (level == SOL_SOCKET)
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
-index 507b5e8..049e64a 100644
+index 507b5e8..75e88ea 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
-@@ -1272,7 +1272,9 @@ call_start(struct rpc_task *task)
+@@ -303,10 +303,8 @@ static struct rpc_clnt * rpc_new_client(const struct rpc_create_args *args, stru
+ err = rpciod_up();
+ if (err)
+ goto out_no_rpciod;
++
+ err = -EINVAL;
+- if (!xprt)
+- goto out_no_xprt;
+-
+ if (args->version >= program->nrvers)
+ goto out_err;
+ version = program->version[args->version];
+@@ -381,10 +379,9 @@ out_no_principal:
+ out_no_stats:
+ kfree(clnt);
+ out_err:
+- xprt_put(xprt);
+-out_no_xprt:
+ rpciod_down();
+ out_no_rpciod:
++ xprt_put(xprt);
+ return ERR_PTR(err);
+ }
+
+@@ -511,7 +508,7 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
+ new = rpc_new_client(args, xprt);
+ if (IS_ERR(new)) {
+ err = PTR_ERR(new);
+- goto out_put;
++ goto out_err;
+ }
+
+ atomic_inc(&clnt->cl_count);
+@@ -524,8 +521,6 @@ static struct rpc_clnt *__rpc_clone_client(struct rpc_create_args *args,
+ new->cl_chatty = clnt->cl_chatty;
+ return new;
+
+-out_put:
+- xprt_put(xprt);
+ out_err:
+ dprintk("RPC: %s: returned error %d\n", __func__, err);
+ return ERR_PTR(err);
+@@ -1272,7 +1267,9 @@ call_start(struct rpc_task *task)
(RPC_IS_ASYNC(task) ? "async" : "sync"));
/* Increment call count */
@@ -91059,7 +91473,7 @@ index e4fd45b..2eeb5c4 100644
shdr = (Elf_Shdr *)((char *)ehdr + _r(&ehdr->e_shoff));
shstrtab_sec = shdr + r2(&ehdr->e_shstrndx);
diff --git a/security/Kconfig b/security/Kconfig
-index e9c6ac7..20df9f1 100644
+index e9c6ac7..721e9d0 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -4,6 +4,944 @@
@@ -91818,7 +92232,7 @@ index e9c6ac7..20df9f1 100644
+
+config PAX_MEMORY_STACKLEAK
+ bool "Sanitize kernel stack"
-+ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY)
++ default y if (GRKERNSEC_CONFIG_AUTO && GRKERNSEC_CONFIG_PRIORITY_SECURITY && !(GRKERNSEC_CONFIG_VIRT_HOST && GRKERNSEC_CONFIG_VIRT_XEN))
+ depends on X86
+ help
+ By saying Y here the kernel will erase the kernel stack before it
@@ -100857,17 +101271,20 @@ index 0000000..ddd5b2e
+alloc_dr_65495 alloc_dr 2 65495 NULL
diff --git a/tools/gcc/size_overflow_plugin.c b/tools/gcc/size_overflow_plugin.c
new file mode 100644
-index 0000000..63c46e5
+index 0000000..9db0d0e
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin.c
-@@ -0,0 +1,2050 @@
+@@ -0,0 +1,2114 @@
+/*
-+ * Copyright 2011, 2012 by Emese Revfy <re.emese@gmail.com>
++ * Copyright 2011, 2012, 2013 by Emese Revfy <re.emese@gmail.com>
+ * Licensed under the GPL v2, or (at your option) v3
+ *
+ * Homepage:
+ * http://www.grsecurity.net/~ephox/overflow_plugin/
+ *
++ * Documentation:
++ * http://forums.grsecurity.net/viewtopic.php?f=7&t=3043
++ *
+ * This plugin recomputes expressions of function arguments marked by a size_overflow attribute
+ * with double integer precision (DImode/TImode for 32/64 bit integer types).
+ * The recomputed argument is checked against TYPE_MAX and an event is logged on overflow and the triggering process is killed.
@@ -100947,7 +101364,7 @@ index 0000000..63c46e5
+static void print_missing_msg(tree func, unsigned int argnum);
+
+static struct plugin_info size_overflow_plugin_info = {
-+ .version = "20130316beta",
++ .version = "20130410beta",
+ .help = "no-size-overflow\tturn off size overflow checking\n",
+};
+
@@ -101752,6 +102169,61 @@ index 0000000..63c46e5
+ return create_assign(visited, stmt, rhs1, AFTER_STMT);
+}
+
++static bool no_uses(tree node)
++{
++ imm_use_iterator imm_iter;
++ use_operand_p use_p;
++
++ FOR_EACH_IMM_USE_FAST(use_p, imm_iter, node) {
++ const_gimple use_stmt = USE_STMT(use_p);
++ if (use_stmt == NULL)
++ return true;
++ if (is_gimple_debug(use_stmt))
++ continue;
++ if (!(gimple_bb(use_stmt)->flags & BB_REACHABLE))
++ continue;
++ return false;
++ }
++ return true;
++}
++
++// 3.8.5 mm/page-writeback.c __ilog2_u64(): ret, uint + uintmax; uint -> int; int max
++static bool is_const_plus_unsigned_signed_truncation(const_tree lhs)
++{
++ tree rhs1, lhs_type, rhs_type, rhs2, not_const_rhs;
++ gimple def_stmt = get_def_stmt(lhs);
++
++ if (!def_stmt || !gimple_assign_cast_p(def_stmt))
++ return false;
++
++ rhs1 = gimple_assign_rhs1(def_stmt);
++ rhs_type = TREE_TYPE(rhs1);
++ lhs_type = TREE_TYPE(lhs);
++ if (TYPE_UNSIGNED(lhs_type) || !TYPE_UNSIGNED(rhs_type))
++ return false;
++ if (TYPE_MODE(lhs_type) != TYPE_MODE(rhs_type))
++ return false;
++
++ def_stmt = get_def_stmt(rhs1);
++ if (!def_stmt || gimple_code(def_stmt) != GIMPLE_ASSIGN || gimple_num_ops(def_stmt) != 3)
++ return false;
++
++ if (gimple_assign_rhs_code(def_stmt) != PLUS_EXPR)
++ return false;
++
++ rhs1 = gimple_assign_rhs1(def_stmt);
++ rhs2 = gimple_assign_rhs2(def_stmt);
++ if (!is_gimple_constant(rhs1) && !is_gimple_constant(rhs2))
++ return false;
++
++ if (is_gimple_constant(rhs2))
++ not_const_rhs = rhs1;
++ else
++ not_const_rhs = rhs2;
++
++ return no_uses(not_const_rhs);
++}
++
+static bool skip_lhs_cast_check(const_gimple stmt)
+{
+ const_tree rhs = gimple_assign_rhs1(stmt);
@@ -101761,6 +102233,9 @@ index 0000000..63c46e5
+ if (gimple_code(def_stmt) == GIMPLE_ASM)
+ return true;
+
++ if (is_const_plus_unsigned_signed_truncation(rhs))
++ return true;
++
+ return false;
+}
+
@@ -102010,6 +102485,9 @@ index 0000000..63c46e5
+
+ gcc_assert(TREE_CODE(rhs_type) == INTEGER_TYPE || TREE_CODE(rhs_type) == ENUMERAL_TYPE);
+
++ if (is_const_plus_unsigned_signed_truncation(rhs))
++ return;
++
+ type_max = cast_a_tree(size_overflow_type, TYPE_MAX_VALUE(rhs_type));
+ // typemax (-1) < typemin (0)
+ if (TREE_OVERFLOW(type_max))
@@ -103246,10 +103724,10 @@ index 0000000..ac2901e
+}
diff --git a/tools/gcc/structleak_plugin.c b/tools/gcc/structleak_plugin.c
new file mode 100644
-index 0000000..77a6b1d
+index 0000000..5afca14
--- /dev/null
+++ b/tools/gcc/structleak_plugin.c
-@@ -0,0 +1,270 @@
+@@ -0,0 +1,271 @@
+/*
+ * Copyright 2013 by PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -103307,7 +103785,7 @@ index 0000000..77a6b1d
+void debug_gimple_stmt(gimple gs);
+
+static struct plugin_info structleak_plugin_info = {
-+ .version = "201303270300",
++ .version = "201304082245",
+ .help = "disable\tdo not activate plugin\n",
+};
+
@@ -103389,18 +103867,19 @@ index 0000000..77a6b1d
+ // first check if the variable is already initialized, warn otherwise
+ for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
+ gimple stmt = gsi_stmt(gsi);
++ tree rhs1 = gimple_assign_rhs1(stmt);
+
-+ // we're looking for an assignment...
-+ if (!(is_gimple_assign(stmt)))
++ // we're looking for an assignment of a single rhs...
++ if (!gimple_assign_single_p(stmt))
+ continue;
-+ // ... of a single rhs (unary op)...
-+ if (gimple_num_ops(stmt) != 2)
++ // ... of a non-clobbering expression...
++ if (TREE_CLOBBER_P(rhs1))
+ continue;
+ // ... to our variable...
+ if (gimple_get_lhs(stmt) != var)
+ continue;
+ // if it's an initializer then we're good
-+ if (TREE_CODE(gimple_assign_rhs1(stmt)) == CONSTRUCTOR)
++ if (TREE_CODE(rhs1) == CONSTRUCTOR)
+ return;
+ }
+
@@ -103442,7 +103921,7 @@ index 0000000..77a6b1d
+ tree type = TREE_TYPE(var);
+
+ gcc_assert(DECL_P(var));
-+ if (is_global_var(var))
++ if (!auto_var_in_fn_p(var, current_function_decl))
+ continue;
+
+ // only care about structure types
diff --git a/3.8.6/4425_grsec_remove_EI_PAX.patch b/3.8.6/4425_grsec_remove_EI_PAX.patch
index 97e6951..7d06ac2 100644
--- a/3.8.6/4425_grsec_remove_EI_PAX.patch
+++ b/3.8.6/4425_grsec_remove_EI_PAX.patch
@@ -8,7 +8,7 @@ X-Gentoo-Bug-URL: https://bugs.gentoo.org/445600
diff -Nuar linux-3.7.1-hardened.orig/security/Kconfig linux-3.7.1-hardened/security/Kconfig
--- linux-3.7.1-hardened.orig/security/Kconfig 2012-12-26 08:39:29.000000000 -0500
+++ linux-3.7.1-hardened/security/Kconfig 2012-12-26 09:05:44.000000000 -0500
-@@ -263,7 +263,7 @@
+@@ -265,7 +265,7 @@
config PAX_EI_PAX
bool 'Use legacy ELF header marking'
diff --git a/3.8.6/4435_grsec-mute-warnings.patch b/3.8.6/4435_grsec-mute-warnings.patch
index e1a7a3c..ed941d5 100644
--- a/3.8.6/4435_grsec-mute-warnings.patch
+++ b/3.8.6/4435_grsec-mute-warnings.patch
@@ -37,7 +37,7 @@ Acked-by: Christian Heim <phreak@gentoo.org>
HOSTCXX = g++
-HOSTCFLAGS = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
+HOSTCFLAGS = -Wall -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
- HOSTCLFAGS += $(call cc-option, -Wno-empty-body)
+ HOSTCFLAGS += $(call cc-option, -Wno-empty-body)
HOSTCXXFLAGS = -O2 -Wall -W -fno-delete-null-pointer-checks
diff --git a/3.8.6/4450_grsec-kconfig-default-gids.patch b/3.8.6/4450_grsec-kconfig-default-gids.patch
index 3dfdc8f..7c20c40 100644
--- a/3.8.6/4450_grsec-kconfig-default-gids.patch
+++ b/3.8.6/4450_grsec-kconfig-default-gids.patch
@@ -16,7 +16,7 @@ from shooting themselves in the foot.
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2012-10-13 09:51:35.000000000 -0400
+++ b/grsecurity/Kconfig 2012-10-13 09:52:32.000000000 -0400
-@@ -572,7 +572,7 @@
+@@ -578,7 +578,7 @@
config GRKERNSEC_AUDIT_GID
int "GID for auditing"
depends on GRKERNSEC_AUDIT_GROUP
@@ -25,7 +25,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
config GRKERNSEC_EXECLOG
bool "Exec logging"
-@@ -792,7 +792,7 @@
+@@ -798,7 +798,7 @@
config GRKERNSEC_TPE_UNTRUSTED_GID
int "GID for TPE-untrusted users"
depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -34,7 +34,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*enabled* for. If the sysctl option is enabled, a sysctl option
-@@ -801,7 +801,7 @@
+@@ -807,7 +807,7 @@
config GRKERNSEC_TPE_TRUSTED_GID
int "GID for TPE-trusted users"
depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -43,7 +43,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -894,7 +894,7 @@
+@@ -900,7 +900,7 @@
config GRKERNSEC_SOCKET_ALL_GID
int "GID to deny all sockets for"
depends on GRKERNSEC_SOCKET_ALL
@@ -52,7 +52,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Here you can choose the GID to disable socket access for. Remember to
add the users you want socket access disabled for to the GID
-@@ -915,7 +915,7 @@
+@@ -921,7 +921,7 @@
config GRKERNSEC_SOCKET_CLIENT_GID
int "GID to deny client sockets for"
depends on GRKERNSEC_SOCKET_CLIENT
@@ -61,7 +61,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
help
Here you can choose the GID to disable client socket access for.
Remember to add the users you want client socket access disabled for to
-@@ -933,7 +933,7 @@
+@@ -939,7 +939,7 @@
config GRKERNSEC_SOCKET_SERVER_GID
int "GID to deny server sockets for"
depends on GRKERNSEC_SOCKET_SERVER
@@ -73,7 +73,7 @@ diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
diff -Nuar a/security/Kconfig b/security/Kconfig
--- a/security/Kconfig 2012-10-13 09:51:35.000000000 -0400
+++ b/security/Kconfig 2012-10-13 09:52:59.000000000 -0400
-@@ -191,7 +191,7 @@
+@@ -193,7 +193,7 @@
config GRKERNSEC_PROC_GID
int "GID exempted from /proc restrictions"
@@ -82,7 +82,7 @@ diff -Nuar a/security/Kconfig b/security/Kconfig
help
Setting this GID determines which group will be exempted from
grsecurity's /proc restrictions, allowing users of the specified
-@@ -202,7 +202,7 @@
+@@ -204,7 +204,7 @@
config GRKERNSEC_TPE_UNTRUSTED_GID
int "GID for TPE-untrusted users"
depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
@@ -91,7 +91,7 @@ diff -Nuar a/security/Kconfig b/security/Kconfig
help
Setting this GID determines which group untrusted users should
be added to. These users will be placed under grsecurity's Trusted Path
-@@ -214,7 +214,7 @@
+@@ -216,7 +216,7 @@
config GRKERNSEC_TPE_TRUSTED_GID
int "GID for TPE-trusted users"
depends on GRKERNSEC_CONFIG_SERVER && GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
@@ -100,7 +100,7 @@ diff -Nuar a/security/Kconfig b/security/Kconfig
help
Setting this GID determines what group TPE restrictions will be
*disabled* for. If the sysctl option is enabled, a sysctl option
-@@ -223,7 +223,7 @@
+@@ -225,7 +225,7 @@
config GRKERNSEC_SYMLINKOWN_GID
int "GID for users with kernel-enforced SymlinksIfOwnerMatch"
depends on GRKERNSEC_CONFIG_SERVER
diff --git a/3.8.6/4465_selinux-avc_audit-log-curr_ip.patch b/3.8.6/4465_selinux-avc_audit-log-curr_ip.patch
index 5b614b1..0a309c8 100644
--- a/3.8.6/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/3.8.6/4465_selinux-avc_audit-log-curr_ip.patch
@@ -28,7 +28,7 @@ Signed-off-by: Lorenzo Hernandez Garcia-Hierro <lorenzo@gnu.org>
diff -Naur a/grsecurity/Kconfig b/grsecurity/Kconfig
--- a/grsecurity/Kconfig 2011-04-17 19:25:54.000000000 -0400
+++ b/grsecurity/Kconfig 2011-04-17 19:32:53.000000000 -0400
-@@ -992,6 +992,27 @@
+@@ -998,6 +998,27 @@
menu "Logging Options"
depends on GRKERNSEC
diff --git a/3.8.6/4470_disable-compat_vdso.patch b/3.8.6/4470_disable-compat_vdso.patch
index 1037ba9..3ef36aa 100644
--- a/3.8.6/4470_disable-compat_vdso.patch
+++ b/3.8.6/4470_disable-compat_vdso.patch
@@ -26,7 +26,7 @@ Closes bug: http://bugs.gentoo.org/show_bug.cgi?id=210138
diff -urp a/arch/x86/Kconfig b/arch/x86/Kconfig
--- a/arch/x86/Kconfig 2009-07-31 01:36:57.323857684 +0100
+++ b/arch/x86/Kconfig 2009-07-31 01:51:39.395749681 +0100
-@@ -1704,17 +1704,8 @@
+@@ -1742,17 +1742,8 @@
config COMPAT_VDSO
def_bool n
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2013-04-12 0:58 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-04-12 0:58 [gentoo-commits] proj/hardened-patchset:master commit in: 3.8.6/, 2.6.32/, 3.2.43/, 3.2.42/ Anthony G. Basile
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox