From: "Anthony G. Basile" <blueness@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/hardened-patchset:master commit in: 3.2.68/, 3.19.4/, 3.14.37/, 3.19.3/, 3.14.38/
Date: Wed, 15 Apr 2015 13:11:16 +0000 (UTC) [thread overview]
Message-ID: <1429103556.c58db926b1c0ffd5715c7cbd4ccb1c273d417ab4.blueness@gentoo> (raw)
commit: c58db926b1c0ffd5715c7cbd4ccb1c273d417ab4
Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
AuthorDate: Wed Apr 15 13:12:36 2015 +0000
Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org>
CommitDate: Wed Apr 15 13:12:36 2015 +0000
URL: https://gitweb.gentoo.org/proj/hardened-patchset.git/commit/?id=c58db926
Grsec/PaX: 3.1-{3.2.68,3.14.38,3.19.4}-201504142300
3.14.37/1036_linux-3.14.37.patch | 2861 --------------
{3.14.37 => 3.14.38}/0000_README | 6 +-
3.14.38/1037_linux-3.14.38.patch | 1029 +++++
.../4420_grsecurity-3.1-3.14.38-201504142259.patch | 222 +-
{3.19.3 => 3.14.38}/4425_grsec_remove_EI_PAX.patch | 0
.../4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
.../4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
.../4470_disable-compat_vdso.patch | 0
{3.19.3 => 3.14.38}/4475_emutramp_default_on.patch | 0
3.19.3/1002_linux-3.19.3.patch | 4081 --------------------
{3.19.3 => 3.19.4}/0000_README | 6 +-
3.19.4/1003_linux-3.19.4.patch | 3185 +++++++++++++++
.../4420_grsecurity-3.1-3.19.4-201504142300.patch | 614 ++-
{3.14.37 => 3.19.4}/4425_grsec_remove_EI_PAX.patch | 0
.../4427_force_XATTR_PAX_tmpfs.patch | 0
.../4430_grsec-remove-localversion-grsec.patch | 0
{3.19.3 => 3.19.4}/4435_grsec-mute-warnings.patch | 0
.../4440_grsec-remove-protected-paths.patch | 0
.../4450_grsec-kconfig-default-gids.patch | 0
.../4465_selinux-avc_audit-log-curr_ip.patch | 0
{3.19.3 => 3.19.4}/4470_disable-compat_vdso.patch | 0
{3.14.37 => 3.19.4}/4475_emutramp_default_on.patch | 0
3.2.68/0000_README | 2 +-
... 4420_grsecurity-3.1-3.2.68-201504142258.patch} | 378 +-
28 files changed, 5214 insertions(+), 7170 deletions(-)
diff --git a/3.14.37/1036_linux-3.14.37.patch b/3.14.37/1036_linux-3.14.37.patch
deleted file mode 100644
index b25a2ef..0000000
--- a/3.14.37/1036_linux-3.14.37.patch
+++ /dev/null
@@ -1,2861 +0,0 @@
-diff --git a/Makefile b/Makefile
-index 4e6537b..c24acc0 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 14
--SUBLEVEL = 36
-+SUBLEVEL = 37
- EXTRAVERSION =
- NAME = Remembering Coco
-
-diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-index e96da9a..f2512e1 100644
---- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-@@ -243,10 +243,18 @@
- ti,invert-autoidle-bit;
- };
-
-+ dpll_core_byp_mux: dpll_core_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x012c>;
-+ };
-+
- dpll_core_ck: dpll_core_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-core-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
- reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
- };
-
-@@ -309,10 +317,18 @@
- clock-div = <1>;
- };
-
-+ dpll_dsp_byp_mux: dpll_dsp_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x0240>;
-+ };
-+
- dpll_dsp_ck: dpll_dsp_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
- reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
- };
-
-@@ -335,10 +351,18 @@
- clock-div = <1>;
- };
-
-+ dpll_iva_byp_mux: dpll_iva_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x01ac>;
-+ };
-+
- dpll_iva_ck: dpll_iva_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
- reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
- };
-
-@@ -361,10 +385,18 @@
- clock-div = <1>;
- };
-
-+ dpll_gpu_byp_mux: dpll_gpu_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x02e4>;
-+ };
-+
- dpll_gpu_ck: dpll_gpu_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
- reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
- };
-
-@@ -398,10 +430,18 @@
- clock-div = <1>;
- };
-
-+ dpll_ddr_byp_mux: dpll_ddr_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x021c>;
-+ };
-+
- dpll_ddr_ck: dpll_ddr_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
- reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
- };
-
-@@ -416,10 +456,18 @@
- ti,invert-autoidle-bit;
- };
-
-+ dpll_gmac_byp_mux: dpll_gmac_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x02b4>;
-+ };
-+
- dpll_gmac_ck: dpll_gmac_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
- reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
- };
-
-@@ -482,10 +530,18 @@
- clock-div = <1>;
- };
-
-+ dpll_eve_byp_mux: dpll_eve_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x0290>;
-+ };
-+
- dpll_eve_ck: dpll_eve_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
- reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
- };
-
-@@ -1214,10 +1270,18 @@
- clock-div = <1>;
- };
-
-+ dpll_per_byp_mux: dpll_per_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x014c>;
-+ };
-+
- dpll_per_ck: dpll_per_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
- reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
- };
-
-@@ -1240,10 +1304,18 @@
- clock-div = <1>;
- };
-
-+ dpll_usb_byp_mux: dpll_usb_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x018c>;
-+ };
-+
- dpll_usb_ck: dpll_usb_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-j-type-clock";
-- clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
- reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
- };
-
-diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
-index 71e5fc7..1d1800f 100644
---- a/arch/arm/crypto/aesbs-core.S_shipped
-+++ b/arch/arm/crypto/aesbs-core.S_shipped
-@@ -58,14 +58,18 @@
- # define VFP_ABI_FRAME 0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__ 7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
-
- #ifdef __thumb__
- # define adrl adr
- #endif
-
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch armv7-a
-+.fpu neon
-+
- .text
- .syntax unified @ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -74,8 +78,6 @@
- .code 32
- #endif
-
--.fpu neon
--
- .type _bsaes_decrypt8,%function
- .align 4
- _bsaes_decrypt8:
-@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
- vld1.8 {q8}, [r0] @ initial tweak
- adr r2, .Lxts_magic
-
-+#ifndef XTS_CHAIN_TWEAK
- tst r9, #0xf @ if not multiple of 16
- it ne @ Thumb2 thing, sanity check in ARM
- subne r9, #0x10 @ subtract another 16 bytes
-+#endif
- subs r9, #0x80
-
- blo .Lxts_dec_short
-diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
-index be068db..a4d3856 100644
---- a/arch/arm/crypto/bsaes-armv7.pl
-+++ b/arch/arm/crypto/bsaes-armv7.pl
-@@ -701,14 +701,18 @@ $code.=<<___;
- # define VFP_ABI_FRAME 0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__ 7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
-
- #ifdef __thumb__
- # define adrl adr
- #endif
-
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch armv7-a
-+.fpu neon
-+
- .text
- .syntax unified @ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -717,8 +721,6 @@ $code.=<<___;
- .code 32
- #endif
-
--.fpu neon
--
- .type _bsaes_decrypt8,%function
- .align 4
- _bsaes_decrypt8:
-@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
- vld1.8 {@XMM[8]}, [r0] @ initial tweak
- adr $magic, .Lxts_magic
-
-+#ifndef XTS_CHAIN_TWEAK
- tst $len, #0xf @ if not multiple of 16
- it ne @ Thumb2 thing, sanity check in ARM
- subne $len, #0x10 @ subtract another 16 bytes
-+#endif
- subs $len, #0x80
-
- blo .Lxts_dec_short
-diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
-index c5101dc..1d4df3b 100644
---- a/arch/arm/mach-at91/pm.h
-+++ b/arch/arm/mach-at91/pm.h
-@@ -45,7 +45,7 @@ static inline void at91rm9200_standby(void)
- " mcr p15, 0, %0, c7, c0, 4\n\t"
- " str %5, [%1, %2]"
- :
-- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
-+ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
- "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
- "r" (lpr));
- }
-diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
-index fbd7678..3974881 100644
---- a/arch/arm64/mm/dma-mapping.c
-+++ b/arch/arm64/mm/dma-mapping.c
-@@ -44,6 +44,7 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size,
- flags |= GFP_DMA32;
- if (IS_ENABLED(CONFIG_DMA_CMA)) {
- struct page *page;
-+ void *addr;
-
- size = PAGE_ALIGN(size);
- page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
-@@ -52,7 +53,10 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size,
- return NULL;
-
- *dma_handle = phys_to_dma(dev, page_to_phys(page));
-- return page_address(page);
-+ addr = page_address(page);
-+ if (flags & __GFP_ZERO)
-+ memset(addr, 0, size);
-+ return addr;
- } else {
- return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
- }
-diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
-index 617b9fe..3ccb677 100644
---- a/arch/sparc/kernel/perf_event.c
-+++ b/arch/sparc/kernel/perf_event.c
-@@ -960,6 +960,8 @@ out:
- cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
- }
-
-+static void sparc_pmu_start(struct perf_event *event, int flags);
-+
- /* On this PMU each PIC has it's own PCR control register. */
- static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- {
-@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- struct perf_event *cp = cpuc->event[i];
- struct hw_perf_event *hwc = &cp->hw;
- int idx = hwc->idx;
-- u64 enc;
-
- if (cpuc->current_idx[i] != PIC_NO_INDEX)
- continue;
-
-- sparc_perf_event_set_period(cp, hwc, idx);
- cpuc->current_idx[i] = idx;
-
-- enc = perf_event_get_enc(cpuc->events[i]);
-- cpuc->pcr[idx] &= ~mask_for_index(idx);
-- if (hwc->state & PERF_HES_STOPPED)
-- cpuc->pcr[idx] |= nop_for_index(idx);
-- else
-- cpuc->pcr[idx] |= event_encoding(enc, idx);
-+ sparc_pmu_start(cp, PERF_EF_RELOAD);
- }
- out:
- for (i = 0; i < cpuc->n_events; i++) {
-@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- int i;
-
- local_irq_save(flags);
-- perf_pmu_disable(event->pmu);
-
- for (i = 0; i < cpuc->n_events; i++) {
- if (event == cpuc->event[i]) {
-@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- }
- }
-
-- perf_pmu_enable(event->pmu);
- local_irq_restore(flags);
- }
-
-@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
- unsigned long flags;
-
- local_irq_save(flags);
-- perf_pmu_disable(event->pmu);
-
- n0 = cpuc->n_events;
- if (n0 >= sparc_pmu->max_hw_events)
-@@ -1394,7 +1386,6 @@ nocheck:
-
- ret = 0;
- out:
-- perf_pmu_enable(event->pmu);
- local_irq_restore(flags);
- return ret;
- }
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index c6f7113..1a79d68 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -281,6 +281,8 @@ void arch_trigger_all_cpu_backtrace(void)
- printk(" TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
- gp->tpc, gp->o7, gp->i7, gp->rpc);
- }
-+
-+ touch_nmi_watchdog();
- }
-
- memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-@@ -356,6 +358,8 @@ static void pmu_snapshot_all_cpus(void)
- (cpu == this_cpu ? '*' : ' '), cpu,
- pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
- pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
-+
-+ touch_nmi_watchdog();
- }
-
- memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index beb0b5a..25db14a 100644
---- a/arch/sparc/kernel/sys_sparc_64.c
-+++ b/arch/sparc/kernel/sys_sparc_64.c
-@@ -332,7 +332,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
- long err;
-
- /* No need for backward compatibility. We can start fresh... */
-- if (call <= SEMCTL) {
-+ if (call <= SEMTIMEDOP) {
- switch (call) {
- case SEMOP:
- err = sys_semtimedop(first, ptr,
-diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
-index b7f6334..857ad4f 100644
---- a/arch/sparc/lib/memmove.S
-+++ b/arch/sparc/lib/memmove.S
-@@ -8,9 +8,11 @@
-
- .text
- ENTRY(memmove) /* o0=dst o1=src o2=len */
-- mov %o0, %g1
-+ brz,pn %o2, 99f
-+ mov %o0, %g1
-+
- cmp %o0, %o1
-- bleu,pt %xcc, memcpy
-+ bleu,pt %xcc, 2f
- add %o1, %o2, %g7
- cmp %g7, %o0
- bleu,pt %xcc, memcpy
-@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
- stb %g7, [%o0]
- bne,pt %icc, 1b
- sub %o0, 1, %o0
--
-+99:
- retl
- mov %g1, %o0
-+
-+ /* We can't just call memcpy for these memmove cases. On some
-+ * chips the memcpy uses cache initializing stores and when dst
-+ * and src are close enough, those can clobber the source data
-+ * before we've loaded it in.
-+ */
-+2: or %o0, %o1, %g7
-+ or %o2, %g7, %g7
-+ andcc %g7, 0x7, %g0
-+ bne,pn %xcc, 4f
-+ nop
-+
-+3: ldx [%o1], %g7
-+ add %o1, 8, %o1
-+ subcc %o2, 8, %o2
-+ add %o0, 8, %o0
-+ bne,pt %icc, 3b
-+ stx %g7, [%o0 - 0x8]
-+ ba,a,pt %xcc, 99b
-+
-+4: ldub [%o1], %g7
-+ add %o1, 1, %o1
-+ subcc %o2, 1, %o2
-+ add %o0, 1, %o0
-+ bne,pt %icc, 4b
-+ stb %g7, [%o0 - 0x1]
-+ ba,a,pt %xcc, 99b
- ENDPROC(memmove)
-diff --git a/arch/sparc/mm/srmmu.c b/arch/sparc/mm/srmmu.c
-index cfbe53c..09daebd 100644
---- a/arch/sparc/mm/srmmu.c
-+++ b/arch/sparc/mm/srmmu.c
-@@ -460,10 +460,12 @@ static void __init sparc_context_init(int numctx)
- void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm,
- struct task_struct *tsk)
- {
-+ unsigned long flags;
-+
- if (mm->context == NO_CONTEXT) {
-- spin_lock(&srmmu_context_spinlock);
-+ spin_lock_irqsave(&srmmu_context_spinlock, flags);
- alloc_context(old_mm, mm);
-- spin_unlock(&srmmu_context_spinlock);
-+ spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
- srmmu_ctxd_set(&srmmu_context_table[mm->context], mm->pgd);
- }
-
-@@ -988,14 +990,15 @@ int init_new_context(struct task_struct *tsk, struct mm_struct *mm)
-
- void destroy_context(struct mm_struct *mm)
- {
-+ unsigned long flags;
-
- if (mm->context != NO_CONTEXT) {
- flush_cache_mm(mm);
- srmmu_ctxd_set(&srmmu_context_table[mm->context], srmmu_swapper_pg_dir);
- flush_tlb_mm(mm);
-- spin_lock(&srmmu_context_spinlock);
-+ spin_lock_irqsave(&srmmu_context_spinlock, flags);
- free_context(mm->context);
-- spin_unlock(&srmmu_context_spinlock);
-+ spin_unlock_irqrestore(&srmmu_context_spinlock, flags);
- mm->context = NO_CONTEXT;
- }
- }
-diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
-index 6dfb7d0..6d4faba 100644
---- a/arch/x86/crypto/aesni-intel_glue.c
-+++ b/arch/x86/crypto/aesni-intel_glue.c
-@@ -1109,7 +1109,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
- if (!src)
- return -ENOMEM;
-- assoc = (src + req->cryptlen + auth_tag_len);
-+ assoc = (src + req->cryptlen);
- scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
- scatterwalk_map_and_copy(assoc, req->assoc, 0,
- req->assoclen, 0);
-@@ -1134,7 +1134,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- scatterwalk_done(&src_sg_walk, 0, 0);
- scatterwalk_done(&assoc_sg_walk, 0, 0);
- } else {
-- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
-+ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
- kfree(src);
- }
- return retval;
-diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
-index cea1c76..1ac1c00 100644
---- a/arch/x86/include/asm/fpu-internal.h
-+++ b/arch/x86/include/asm/fpu-internal.h
-@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_struct *tsk)
- preempt_disable();
- tsk->thread.fpu_counter = 0;
- __drop_fpu(tsk);
-- clear_used_math();
-+ clear_stopped_child_used_math(tsk);
- preempt_enable();
- }
-
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index dd50e26..7a09aca 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -375,7 +375,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- * thread's fpu state, reconstruct fxstate from the fsave
- * header. Sanitize the copied state etc.
- */
-- struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
-+ struct fpu *fpu = &tsk->thread.fpu;
- struct user_i387_ia32_struct env;
- int err = 0;
-
-@@ -389,14 +389,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- */
- drop_fpu(tsk);
-
-- if (__copy_from_user(xsave, buf_fx, state_size) ||
-+ if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
- __copy_from_user(&env, buf, sizeof(env))) {
-+ fpu_finit(fpu);
- err = -1;
- } else {
- sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-- set_used_math();
- }
-
-+ set_used_math();
- if (use_eager_fpu()) {
- preempt_disable();
- math_state_restore();
-diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
-index 31776d0..d7ec4e2 100644
---- a/arch/x86/vdso/vdso32/sigreturn.S
-+++ b/arch/x86/vdso/vdso32/sigreturn.S
-@@ -17,6 +17,7 @@
- .text
- .globl __kernel_sigreturn
- .type __kernel_sigreturn,@function
-+ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
- ALIGN
- __kernel_sigreturn:
- .LSTART_sigreturn:
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index eff9d58..102463ba 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- {
- struct ibmvtpm_dev *ibmvtpm;
- struct ibmvtpm_crq crq;
-- u64 *word = (u64 *) &crq;
-+ __be64 *word = (__be64 *)&crq;
- int rc;
-
- ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
-@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
- crq.valid = (u8)IBMVTPM_VALID_CMD;
- crq.msg = (u8)VTPM_TPM_COMMAND;
-- crq.len = (u16)count;
-- crq.data = ibmvtpm->rtce_dma_handle;
-+ crq.len = cpu_to_be16(count);
-+ crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
-
-- rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
-- cpu_to_be64(word[1]));
-+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-+ be64_to_cpu(word[1]));
- if (rc != H_SUCCESS) {
- dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
- rc = 0;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
-index bd82a79..b2c231b 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.h
-+++ b/drivers/char/tpm/tpm_ibmvtpm.h
-@@ -22,9 +22,9 @@
- struct ibmvtpm_crq {
- u8 valid;
- u8 msg;
-- u16 len;
-- u32 data;
-- u64 reserved;
-+ __be16 len;
-+ __be32 data;
-+ __be64 reserved;
- } __attribute__((packed, aligned(8)));
-
- struct ibmvtpm_crq_queue {
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index 6928d09..b08eadb 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -142,6 +142,7 @@ struct ports_device {
- * notification
- */
- struct work_struct control_work;
-+ struct work_struct config_work;
-
- struct list_head ports;
-
-@@ -1832,10 +1833,21 @@ static void config_intr(struct virtio_device *vdev)
-
- portdev = vdev->priv;
-
-+ if (!use_multiport(portdev))
-+ schedule_work(&portdev->config_work);
-+}
-+
-+static void config_work_handler(struct work_struct *work)
-+{
-+ struct ports_device *portdev;
-+
-+ portdev = container_of(work, struct ports_device, control_work);
- if (!use_multiport(portdev)) {
-+ struct virtio_device *vdev;
- struct port *port;
- u16 rows, cols;
-
-+ vdev = portdev->vdev;
- virtio_cread(vdev, struct virtio_console_config, cols, &cols);
- virtio_cread(vdev, struct virtio_console_config, rows, &rows);
-
-@@ -2024,12 +2036,14 @@ static int virtcons_probe(struct virtio_device *vdev)
- spin_lock_init(&portdev->ports_lock);
- INIT_LIST_HEAD(&portdev->ports);
-
-+ INIT_WORK(&portdev->config_work, &config_work_handler);
-+ INIT_WORK(&portdev->control_work, &control_work_handler);
-+
- if (multiport) {
- unsigned int nr_added_bufs;
-
- spin_lock_init(&portdev->c_ivq_lock);
- spin_lock_init(&portdev->c_ovq_lock);
-- INIT_WORK(&portdev->control_work, &control_work_handler);
-
- nr_added_bufs = fill_queue(portdev->c_ivq,
- &portdev->c_ivq_lock);
-@@ -2097,6 +2111,8 @@ static void virtcons_remove(struct virtio_device *vdev)
- /* Finish up work that's lined up */
- if (use_multiport(portdev))
- cancel_work_sync(&portdev->control_work);
-+ else
-+ cancel_work_sync(&portdev->config_work);
-
- list_for_each_entry_safe(port, port2, &portdev->ports, list)
- unplug_port(port);
-@@ -2148,6 +2164,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
-
- virtqueue_disable_cb(portdev->c_ivq);
- cancel_work_sync(&portdev->control_work);
-+ cancel_work_sync(&portdev->config_work);
- /*
- * Once more: if control_work_handler() was running, it would
- * enable the cb as the last step.
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index 0cca5f2..663394f 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -1306,6 +1306,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
- (x << 16) | y);
- viewport_w = crtc->mode.hdisplay;
- viewport_h = (crtc->mode.vdisplay + 1) & ~1;
-+ if ((rdev->family >= CHIP_BONAIRE) &&
-+ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
-+ viewport_h *= 2;
- WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
- (viewport_w << 16) | viewport_h);
-
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index f0ed0ba..c3664bc 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -7069,6 +7069,9 @@ int cik_irq_set(struct radeon_device *rdev)
- WREG32(DC_HPD5_INT_CONTROL, hpd5);
- WREG32(DC_HPD6_INT_CONTROL, hpd6);
-
-+ /* posting read */
-+ RREG32(SRBM_STATUS);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 7138f3e..ee9f0b4 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -4596,6 +4596,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
- WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
- WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
-
-+ /* posting read */
-+ RREG32(SRBM_STATUS);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index 07620e1..e28de20 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -742,6 +742,10 @@ int r100_irq_set(struct radeon_device *rdev)
- tmp |= RADEON_FP2_DETECT_MASK;
- }
- WREG32(RADEON_GEN_INT_CNTL, tmp);
-+
-+ /* read back to post the write */
-+ RREG32(RADEON_GEN_INT_CNTL);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index 788f602..74a8a38 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -3647,6 +3647,9 @@ int r600_irq_set(struct radeon_device *rdev)
- WREG32(RV770_CG_THERMAL_INT, thermal_int);
- }
-
-+ /* posting read */
-+ RREG32(R_000E50_SRBM_STATUS);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
-index 7f2d6c0..2f2d2ce 100644
---- a/drivers/gpu/drm/radeon/radeon_cs.c
-+++ b/drivers/gpu/drm/radeon/radeon_cs.c
-@@ -179,11 +179,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
- u32 ring = RADEON_CS_RING_GFX;
- s32 priority = 0;
-
-+ INIT_LIST_HEAD(&p->validated);
-+
- if (!cs->num_chunks) {
- return 0;
- }
-+
- /* get chunks */
-- INIT_LIST_HEAD(&p->validated);
- p->idx = 0;
- p->ib.sa_bo = NULL;
- p->ib.semaphore = NULL;
-diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index e5619d5..4261b38 100644
---- a/drivers/gpu/drm/radeon/rs600.c
-+++ b/drivers/gpu/drm/radeon/rs600.c
-@@ -700,6 +700,10 @@ int rs600_irq_set(struct radeon_device *rdev)
- WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
- if (ASIC_IS_DCE2(rdev))
- WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
-+
-+ /* posting read */
-+ RREG32(R_000040_GEN_INT_CNTL);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index 52b64ad..2f2decc 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -5958,6 +5958,9 @@ int si_irq_set(struct radeon_device *rdev)
-
- WREG32(CG_THERMAL_INT, thermal_int);
-
-+ /* posting read */
-+ RREG32(SRBM_STATUS);
-+
- return 0;
- }
-
-@@ -6875,8 +6878,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
-
- if (!vclk || !dclk) {
-- /* keep the Bypass mode, put PLL to sleep */
-- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+ /* keep the Bypass mode */
- return 0;
- }
-
-@@ -6892,8 +6894,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- /* set VCO_MODE to 1 */
- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
-
-- /* toggle UPLL_SLEEP to 1 then back to 0 */
-- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+ /* disable sleep mode */
- WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
-
- /* deassert UPLL_RESET */
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index fb7c36e..0771dcb 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -733,32 +733,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- goto out_err1;
- }
-
-- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-- (dev_priv->vram_size >> PAGE_SHIFT));
-- if (unlikely(ret != 0)) {
-- DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-- goto out_err2;
-- }
--
-- dev_priv->has_gmr = true;
-- if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-- refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-- VMW_PL_GMR) != 0) {
-- DRM_INFO("No GMR memory available. "
-- "Graphics memory resources are very limited.\n");
-- dev_priv->has_gmr = false;
-- }
--
-- if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-- dev_priv->has_mob = true;
-- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-- VMW_PL_MOB) != 0) {
-- DRM_INFO("No MOB memory available. "
-- "3D will be disabled.\n");
-- dev_priv->has_mob = false;
-- }
-- }
--
- dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
- dev_priv->mmio_size);
-
-@@ -821,6 +795,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- goto out_no_fman;
- }
-
-+
-+ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-+ (dev_priv->vram_size >> PAGE_SHIFT));
-+ if (unlikely(ret != 0)) {
-+ DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-+ goto out_no_vram;
-+ }
-+
-+ dev_priv->has_gmr = true;
-+ if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-+ refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-+ VMW_PL_GMR) != 0) {
-+ DRM_INFO("No GMR memory available. "
-+ "Graphics memory resources are very limited.\n");
-+ dev_priv->has_gmr = false;
-+ }
-+
-+ if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-+ dev_priv->has_mob = true;
-+ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-+ VMW_PL_MOB) != 0) {
-+ DRM_INFO("No MOB memory available. "
-+ "3D will be disabled.\n");
-+ dev_priv->has_mob = false;
-+ }
-+ }
-+
- vmw_kms_save_vga(dev_priv);
-
- /* Start kms and overlay systems, needs fifo. */
-@@ -846,6 +847,12 @@ out_no_fifo:
- vmw_kms_close(dev_priv);
- out_no_kms:
- vmw_kms_restore_vga(dev_priv);
-+ if (dev_priv->has_mob)
-+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+ if (dev_priv->has_gmr)
-+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+out_no_vram:
- vmw_fence_manager_takedown(dev_priv->fman);
- out_no_fman:
- if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-@@ -861,12 +868,6 @@ out_err4:
- iounmap(dev_priv->mmio_virt);
- out_err3:
- arch_phys_wc_del(dev_priv->mmio_mtrr);
-- if (dev_priv->has_mob)
-- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-- if (dev_priv->has_gmr)
-- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
--out_err2:
- (void)ttm_bo_device_release(&dev_priv->bdev);
- out_err1:
- vmw_ttm_global_release(dev_priv);
-@@ -896,6 +897,13 @@ static int vmw_driver_unload(struct drm_device *dev)
- }
- vmw_kms_close(dev_priv);
- vmw_overlay_close(dev_priv);
-+
-+ if (dev_priv->has_mob)
-+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+ if (dev_priv->has_gmr)
-+ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+
- vmw_fence_manager_takedown(dev_priv->fman);
- if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
- drm_irq_uninstall(dev_priv->dev);
-@@ -907,11 +915,6 @@ static int vmw_driver_unload(struct drm_device *dev)
- ttm_object_device_release(&dev_priv->tdev);
- iounmap(dev_priv->mmio_virt);
- arch_phys_wc_del(dev_priv->mmio_mtrr);
-- if (dev_priv->has_mob)
-- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-- if (dev_priv->has_gmr)
-- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
- (void)ttm_bo_device_release(&dev_priv->bdev);
- vmw_ttm_global_release(dev_priv);
-
-diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
-index 51e15fd..d058b00 100644
---- a/drivers/mtd/nand/pxa3xx_nand.c
-+++ b/drivers/mtd/nand/pxa3xx_nand.c
-@@ -481,6 +481,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
- nand_writel(info, NDCR, ndcr | int_mask);
- }
-
-+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
-+{
-+ if (info->ecc_bch) {
-+ int timeout;
-+
-+ /*
-+ * According to the datasheet, when reading from NDDB
-+ * with BCH enabled, after each 32 bytes reads, we
-+ * have to make sure that the NDSR.RDDREQ bit is set.
-+ *
-+ * Drain the FIFO 8 32 bits reads at a time, and skip
-+ * the polling on the last read.
-+ */
-+ while (len > 8) {
-+ __raw_readsl(info->mmio_base + NDDB, data, 8);
-+
-+ for (timeout = 0;
-+ !(nand_readl(info, NDSR) & NDSR_RDDREQ);
-+ timeout++) {
-+ if (timeout >= 5) {
-+ dev_err(&info->pdev->dev,
-+ "Timeout on RDDREQ while draining the FIFO\n");
-+ return;
-+ }
-+
-+ mdelay(1);
-+ }
-+
-+ data += 32;
-+ len -= 8;
-+ }
-+ }
-+
-+ __raw_readsl(info->mmio_base + NDDB, data, len);
-+}
-+
- static void handle_data_pio(struct pxa3xx_nand_info *info)
- {
- unsigned int do_bytes = min(info->data_size, info->chunk_size);
-@@ -497,14 +533,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
- DIV_ROUND_UP(info->oob_size, 4));
- break;
- case STATE_PIO_READING:
-- __raw_readsl(info->mmio_base + NDDB,
-- info->data_buff + info->data_buff_pos,
-- DIV_ROUND_UP(do_bytes, 4));
-+ drain_fifo(info,
-+ info->data_buff + info->data_buff_pos,
-+ DIV_ROUND_UP(do_bytes, 4));
-
- if (info->oob_size > 0)
-- __raw_readsl(info->mmio_base + NDDB,
-- info->oob_buff + info->oob_buff_pos,
-- DIV_ROUND_UP(info->oob_size, 4));
-+ drain_fifo(info,
-+ info->oob_buff + info->oob_buff_pos,
-+ DIV_ROUND_UP(info->oob_size, 4));
- break;
- default:
- dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
-diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index 1468c46..84ad2b4 100644
---- a/drivers/net/can/dev.c
-+++ b/drivers/net/can/dev.c
-@@ -502,6 +502,14 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
- skb->pkt_type = PACKET_BROADCAST;
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-+ skb_reset_mac_header(skb);
-+ skb_reset_network_header(skb);
-+ skb_reset_transport_header(skb);
-+
-+ skb_reset_mac_header(skb);
-+ skb_reset_network_header(skb);
-+ skb_reset_transport_header(skb);
-+
- can_skb_reserve(skb);
- can_skb_prv(skb)->ifindex = dev->ifindex;
-
-diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-index 7d43822..2428740 100644
---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-@@ -12395,6 +12395,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
- pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
- PCICFG_VENDOR_ID_OFFSET);
-
-+ /* Set PCIe reset type to fundamental for EEH recovery */
-+ pdev->needs_freset = 1;
-+
- /* AER (Advanced Error reporting) configuration */
- rc = pci_enable_pcie_error_reporting(pdev);
- if (!rc)
-diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
-index 3eed708..fe48f4c 100644
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -300,9 +300,18 @@ static const struct driver_info cx82310_info = {
- .tx_fixup = cx82310_tx_fixup,
- };
-
-+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
-+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
-+ USB_DEVICE_ID_MATCH_DEV_INFO, \
-+ .idVendor = (vend), \
-+ .idProduct = (prod), \
-+ .bDeviceClass = (cl), \
-+ .bDeviceSubClass = (sc), \
-+ .bDeviceProtocol = (pr)
-+
- static const struct usb_device_id products[] = {
- {
-- USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
-+ USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
- .driver_info = (unsigned long) &cx82310_info
- },
- { },
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index b798404..5d8d2dc 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -1764,10 +1764,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
- trace_regulator_enable(rdev_get_name(rdev));
-
- if (rdev->ena_pin) {
-- ret = regulator_ena_gpio_ctrl(rdev, true);
-- if (ret < 0)
-- return ret;
-- rdev->ena_gpio_state = 1;
-+ if (!rdev->ena_gpio_state) {
-+ ret = regulator_ena_gpio_ctrl(rdev, true);
-+ if (ret < 0)
-+ return ret;
-+ rdev->ena_gpio_state = 1;
-+ }
- } else if (rdev->desc->ops->enable) {
- ret = rdev->desc->ops->enable(rdev);
- if (ret < 0)
-@@ -1897,10 +1899,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
- trace_regulator_disable(rdev_get_name(rdev));
-
- if (rdev->ena_pin) {
-- ret = regulator_ena_gpio_ctrl(rdev, false);
-- if (ret < 0)
-- return ret;
-- rdev->ena_gpio_state = 0;
-+ if (rdev->ena_gpio_state) {
-+ ret = regulator_ena_gpio_ctrl(rdev, false);
-+ if (ret < 0)
-+ return ret;
-+ rdev->ena_gpio_state = 0;
-+ }
-
- } else if (rdev->desc->ops->disable) {
- ret = rdev->desc->ops->disable(rdev);
-@@ -3454,12 +3458,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
- config->ena_gpio, ret);
- goto wash;
- }
--
-- if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-- rdev->ena_gpio_state = 1;
--
-- if (config->ena_gpio_invert)
-- rdev->ena_gpio_state = !rdev->ena_gpio_state;
- }
-
- /* set regulator constraints */
-@@ -3631,9 +3629,11 @@ int regulator_suspend_finish(void)
- list_for_each_entry(rdev, ®ulator_list, list) {
- mutex_lock(&rdev->mutex);
- if (rdev->use_count > 0 || rdev->constraints->always_on) {
-- error = _regulator_do_enable(rdev);
-- if (error)
-- ret = error;
-+ if (!_regulator_is_enabled(rdev)) {
-+ error = _regulator_do_enable(rdev);
-+ if (error)
-+ ret = error;
-+ }
- } else {
- if (!have_full_constraints())
- goto unlock;
-diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
-index 62b58d3..60de662 100644
---- a/drivers/scsi/libsas/sas_discover.c
-+++ b/drivers/scsi/libsas/sas_discover.c
-@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
- struct sas_discovery_event *ev = to_sas_discovery_event(work);
- struct asd_sas_port *port = ev->port;
- struct sas_ha_struct *ha = port->ha;
-+ struct domain_device *ddev = port->port_dev;
-
- /* prevent revalidation from finding sata links in recovery */
- mutex_lock(&ha->disco_mutex);
-@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
- SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
- task_pid_nr(current));
-
-- if (port->port_dev)
-- res = sas_ex_revalidate_domain(port->port_dev);
-+ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
-+ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
-+ res = sas_ex_revalidate_domain(ddev);
-
- SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
- port->id, task_pid_nr(current), res);
-diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
-index 5d7b07f..5f8c6d2 100644
---- a/drivers/spi/spi-atmel.c
-+++ b/drivers/spi/spi-atmel.c
-@@ -781,17 +781,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
- (unsigned long long)xfer->rx_dma);
- }
-
-- /* REVISIT: We're waiting for ENDRX before we start the next
-+ /* REVISIT: We're waiting for RXBUFF before we start the next
- * transfer because we need to handle some difficult timing
-- * issues otherwise. If we wait for ENDTX in one transfer and
-- * then starts waiting for ENDRX in the next, it's difficult
-- * to tell the difference between the ENDRX interrupt we're
-- * actually waiting for and the ENDRX interrupt of the
-+ * issues otherwise. If we wait for TXBUFE in one transfer and
-+ * then starts waiting for RXBUFF in the next, it's difficult
-+ * to tell the difference between the RXBUFF interrupt we're
-+ * actually waiting for and the RXBUFF interrupt of the
- * previous transfer.
- *
- * It should be doable, though. Just not now...
- */
-- spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
-+ spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
- spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
- }
-
-diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
-index 971855e..fe091a8 100644
---- a/drivers/spi/spi-pl022.c
-+++ b/drivers/spi/spi-pl022.c
-@@ -503,12 +503,12 @@ static void giveback(struct pl022 *pl022)
- pl022->cur_msg = NULL;
- pl022->cur_transfer = NULL;
- pl022->cur_chip = NULL;
-- spi_finalize_current_message(pl022->master);
-
- /* disable the SPI/SSP operation */
- writew((readw(SSP_CR1(pl022->virtbase)) &
- (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
-
-+ spi_finalize_current_message(pl022->master);
- }
-
- /**
-diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
-index be89260..27e1a6e 100644
---- a/drivers/staging/iio/adc/mxs-lradc.c
-+++ b/drivers/staging/iio/adc/mxs-lradc.c
-@@ -1159,7 +1159,6 @@ static irqreturn_t mxs_lradc_handle_irq(int irq, void *data)
- LRADC_CTRL1_LRADC_IRQ(TOUCHSCREEN_VCHANNEL2));
- }
-
-- if (iio_buffer_enabled(iio))
- if (iio_buffer_enabled(iio)) {
- if (reg & lradc->buffer_vchans)
- iio_trigger_poll(iio->trig, iio_get_time_ns());
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index 104f29e..e168a63 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -4196,11 +4196,17 @@ int iscsit_close_connection(
- pr_debug("Closing iSCSI connection CID %hu on SID:"
- " %u\n", conn->cid, sess->sid);
- /*
-- * Always up conn_logout_comp just in case the RX Thread is sleeping
-- * and the logout response never got sent because the connection
-- * failed.
-+ * Always up conn_logout_comp for the traditional TCP case just in case
-+ * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
-+ * response never got sent because the connection failed.
-+ *
-+ * However for iser-target, isert_wait4logout() is using conn_logout_comp
-+ * to signal logout response TX interrupt completion. Go ahead and skip
-+ * this for iser since isert_rx_opcode() does not wait on logout failure,
-+ * and to avoid iscsi_conn pointer dereference in iser-target code.
- */
-- complete(&conn->conn_logout_comp);
-+ if (conn->conn_transport->transport_type == ISCSI_TCP)
-+ complete(&conn->conn_logout_comp);
-
- iscsi_release_thread_set(conn);
-
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index 26ae688..093b8cb 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -1591,8 +1591,6 @@ int target_configure_device(struct se_device *dev)
- ret = dev->transport->configure_device(dev);
- if (ret)
- goto out;
-- dev->dev_flags |= DF_CONFIGURED;
--
- /*
- * XXX: there is not much point to have two different values here..
- */
-@@ -1654,6 +1652,8 @@ int target_configure_device(struct se_device *dev)
- list_add_tail(&dev->g_dev_node, &g_device_list);
- mutex_unlock(&g_device_mutex);
-
-+ dev->dev_flags |= DF_CONFIGURED;
-+
- return 0;
-
- out_free_alua:
-diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
-index 0fccdcf..70cb375 100644
---- a/drivers/target/target_core_pr.c
-+++ b/drivers/target/target_core_pr.c
-@@ -76,7 +76,7 @@ enum preempt_type {
- };
-
- static void __core_scsi3_complete_pro_release(struct se_device *, struct se_node_acl *,
-- struct t10_pr_registration *, int);
-+ struct t10_pr_registration *, int, int);
-
- static sense_reason_t
- target_scsi2_reservation_check(struct se_cmd *cmd)
-@@ -528,6 +528,18 @@ static int core_scsi3_pr_seq_non_holder(
-
- return 0;
- }
-+ } else if (we && registered_nexus) {
-+ /*
-+ * Reads are allowed for Write Exclusive locks
-+ * from all registrants.
-+ */
-+ if (cmd->data_direction == DMA_FROM_DEVICE) {
-+ pr_debug("Allowing READ CDB: 0x%02x for %s"
-+ " reservation\n", cdb[0],
-+ core_scsi3_pr_dump_type(pr_reg_type));
-+
-+ return 0;
-+ }
- }
- pr_debug("%s Conflict for %sregistered nexus %s CDB: 0x%2x"
- " for %s reservation\n", transport_dump_cmd_direction(cmd),
-@@ -1186,7 +1198,7 @@ static int core_scsi3_check_implicit_release(
- * service action with the SERVICE ACTION RESERVATION KEY
- * field set to zero (see 5.7.11.3).
- */
-- __core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0);
-+ __core_scsi3_complete_pro_release(dev, nacl, pr_reg, 0, 1);
- ret = 1;
- /*
- * For 'All Registrants' reservation types, all existing
-@@ -1228,7 +1240,8 @@ static void __core_scsi3_free_registration(
-
- pr_reg->pr_reg_deve->def_pr_registered = 0;
- pr_reg->pr_reg_deve->pr_res_key = 0;
-- list_del(&pr_reg->pr_reg_list);
-+ if (!list_empty(&pr_reg->pr_reg_list))
-+ list_del(&pr_reg->pr_reg_list);
- /*
- * Caller accessing *pr_reg using core_scsi3_locate_pr_reg(),
- * so call core_scsi3_put_pr_reg() to decrement our reference.
-@@ -1280,6 +1293,7 @@ void core_scsi3_free_pr_reg_from_nacl(
- {
- struct t10_reservation *pr_tmpl = &dev->t10_pr;
- struct t10_pr_registration *pr_reg, *pr_reg_tmp, *pr_res_holder;
-+ bool free_reg = false;
- /*
- * If the passed se_node_acl matches the reservation holder,
- * release the reservation.
-@@ -1287,13 +1301,18 @@ void core_scsi3_free_pr_reg_from_nacl(
- spin_lock(&dev->dev_reservation_lock);
- pr_res_holder = dev->dev_pr_res_holder;
- if ((pr_res_holder != NULL) &&
-- (pr_res_holder->pr_reg_nacl == nacl))
-- __core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0);
-+ (pr_res_holder->pr_reg_nacl == nacl)) {
-+ __core_scsi3_complete_pro_release(dev, nacl, pr_res_holder, 0, 1);
-+ free_reg = true;
-+ }
- spin_unlock(&dev->dev_reservation_lock);
- /*
- * Release any registration associated with the struct se_node_acl.
- */
- spin_lock(&pr_tmpl->registration_lock);
-+ if (pr_res_holder && free_reg)
-+ __core_scsi3_free_registration(dev, pr_res_holder, NULL, 0);
-+
- list_for_each_entry_safe(pr_reg, pr_reg_tmp,
- &pr_tmpl->registration_list, pr_reg_list) {
-
-@@ -1316,7 +1335,7 @@ void core_scsi3_free_all_registrations(
- if (pr_res_holder != NULL) {
- struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
- __core_scsi3_complete_pro_release(dev, pr_res_nacl,
-- pr_res_holder, 0);
-+ pr_res_holder, 0, 0);
- }
- spin_unlock(&dev->dev_reservation_lock);
-
-@@ -2126,13 +2145,13 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
- /*
- * sa_res_key=0 Unregister Reservation Key for registered I_T Nexus.
- */
-- pr_holder = core_scsi3_check_implicit_release(
-- cmd->se_dev, pr_reg);
-+ type = pr_reg->pr_res_type;
-+ pr_holder = core_scsi3_check_implicit_release(cmd->se_dev,
-+ pr_reg);
- if (pr_holder < 0) {
- ret = TCM_RESERVATION_CONFLICT;
- goto out;
- }
-- type = pr_reg->pr_res_type;
-
- spin_lock(&pr_tmpl->registration_lock);
- /*
-@@ -2290,6 +2309,7 @@ core_scsi3_pro_reserve(struct se_cmd *cmd, int type, int scope, u64 res_key)
- spin_lock(&dev->dev_reservation_lock);
- pr_res_holder = dev->dev_pr_res_holder;
- if (pr_res_holder) {
-+ int pr_res_type = pr_res_holder->pr_res_type;
- /*
- * From spc4r17 Section 5.7.9: Reserving:
- *
-@@ -2300,7 +2320,9 @@ core_scsi3_pro_reserve(struct se_cmd *cmd, int type, int scope, u64 res_key)
- * the logical unit, then the command shall be completed with
- * RESERVATION CONFLICT status.
- */
-- if (pr_res_holder != pr_reg) {
-+ if ((pr_res_holder != pr_reg) &&
-+ (pr_res_type != PR_TYPE_WRITE_EXCLUSIVE_ALLREG) &&
-+ (pr_res_type != PR_TYPE_EXCLUSIVE_ACCESS_ALLREG)) {
- struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
- pr_err("SPC-3 PR: Attempted RESERVE from"
- " [%s]: %s while reservation already held by"
-@@ -2406,23 +2428,59 @@ static void __core_scsi3_complete_pro_release(
- struct se_device *dev,
- struct se_node_acl *se_nacl,
- struct t10_pr_registration *pr_reg,
-- int explicit)
-+ int explicit,
-+ int unreg)
- {
- struct target_core_fabric_ops *tfo = se_nacl->se_tpg->se_tpg_tfo;
- char i_buf[PR_REG_ISID_ID_LEN];
-+ int pr_res_type = 0, pr_res_scope = 0;
-
- memset(i_buf, 0, PR_REG_ISID_ID_LEN);
- core_pr_dump_initiator_port(pr_reg, i_buf, PR_REG_ISID_ID_LEN);
- /*
- * Go ahead and release the current PR reservation holder.
-+ * If an All Registrants reservation is currently active and
-+ * a unregister operation is requested, replace the current
-+ * dev_pr_res_holder with another active registration.
- */
-- dev->dev_pr_res_holder = NULL;
-+ if (dev->dev_pr_res_holder) {
-+ pr_res_type = dev->dev_pr_res_holder->pr_res_type;
-+ pr_res_scope = dev->dev_pr_res_holder->pr_res_scope;
-+ dev->dev_pr_res_holder->pr_res_type = 0;
-+ dev->dev_pr_res_holder->pr_res_scope = 0;
-+ dev->dev_pr_res_holder->pr_res_holder = 0;
-+ dev->dev_pr_res_holder = NULL;
-+ }
-+ if (!unreg)
-+ goto out;
-
-- pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared"
-- " reservation holder TYPE: %s ALL_TG_PT: %d\n",
-- tfo->get_fabric_name(), (explicit) ? "explicit" : "implicit",
-- core_scsi3_pr_dump_type(pr_reg->pr_res_type),
-- (pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
-+ spin_lock(&dev->t10_pr.registration_lock);
-+ list_del_init(&pr_reg->pr_reg_list);
-+ /*
-+ * If the I_T nexus is a reservation holder, the persistent reservation
-+ * is of an all registrants type, and the I_T nexus is the last remaining
-+ * registered I_T nexus, then the device server shall also release the
-+ * persistent reservation.
-+ */
-+ if (!list_empty(&dev->t10_pr.registration_list) &&
-+ ((pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG) ||
-+ (pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG))) {
-+ dev->dev_pr_res_holder =
-+ list_entry(dev->t10_pr.registration_list.next,
-+ struct t10_pr_registration, pr_reg_list);
-+ dev->dev_pr_res_holder->pr_res_type = pr_res_type;
-+ dev->dev_pr_res_holder->pr_res_scope = pr_res_scope;
-+ dev->dev_pr_res_holder->pr_res_holder = 1;
-+ }
-+ spin_unlock(&dev->t10_pr.registration_lock);
-+out:
-+ if (!dev->dev_pr_res_holder) {
-+ pr_debug("SPC-3 PR [%s] Service Action: %s RELEASE cleared"
-+ " reservation holder TYPE: %s ALL_TG_PT: %d\n",
-+ tfo->get_fabric_name(), (explicit) ? "explicit" :
-+ "implicit", core_scsi3_pr_dump_type(pr_res_type),
-+ (pr_reg->pr_reg_all_tg_pt) ? 1 : 0);
-+ }
- pr_debug("SPC-3 PR [%s] RELEASE Node: %s%s\n",
- tfo->get_fabric_name(), se_nacl->initiatorname,
- i_buf);
-@@ -2553,7 +2611,7 @@ core_scsi3_emulate_pro_release(struct se_cmd *cmd, int type, int scope,
- * server shall not establish a unit attention condition.
- */
- __core_scsi3_complete_pro_release(dev, se_sess->se_node_acl,
-- pr_reg, 1);
-+ pr_reg, 1, 0);
-
- spin_unlock(&dev->dev_reservation_lock);
-
-@@ -2641,7 +2699,7 @@ core_scsi3_emulate_pro_clear(struct se_cmd *cmd, u64 res_key)
- if (pr_res_holder) {
- struct se_node_acl *pr_res_nacl = pr_res_holder->pr_reg_nacl;
- __core_scsi3_complete_pro_release(dev, pr_res_nacl,
-- pr_res_holder, 0);
-+ pr_res_holder, 0, 0);
- }
- spin_unlock(&dev->dev_reservation_lock);
- /*
-@@ -2700,7 +2758,7 @@ static void __core_scsi3_complete_pro_preempt(
- */
- if (dev->dev_pr_res_holder)
- __core_scsi3_complete_pro_release(dev, nacl,
-- dev->dev_pr_res_holder, 0);
-+ dev->dev_pr_res_holder, 0, 0);
-
- dev->dev_pr_res_holder = pr_reg;
- pr_reg->pr_res_holder = 1;
-@@ -2944,8 +3002,8 @@ core_scsi3_pro_preempt(struct se_cmd *cmd, int type, int scope, u64 res_key,
- */
- if (pr_reg_n != pr_res_holder)
- __core_scsi3_complete_pro_release(dev,
-- pr_res_holder->pr_reg_nacl,
-- dev->dev_pr_res_holder, 0);
-+ pr_res_holder->pr_reg_nacl,
-+ dev->dev_pr_res_holder, 0, 0);
- /*
- * b) Remove the registrations for all I_T nexuses identified
- * by the SERVICE ACTION RESERVATION KEY field, except the
-@@ -3415,7 +3473,7 @@ after_iport_check:
- * holder (i.e., the I_T nexus on which the
- */
- __core_scsi3_complete_pro_release(dev, pr_res_nacl,
-- dev->dev_pr_res_holder, 0);
-+ dev->dev_pr_res_holder, 0, 0);
- /*
- * g) Move the persistent reservation to the specified I_T nexus using
- * the same scope and type as the persistent reservation released in
-@@ -3855,7 +3913,8 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- unsigned char *buf;
- u32 add_desc_len = 0, add_len = 0, desc_len, exp_desc_len;
- u32 off = 8; /* off into first Full Status descriptor */
-- int format_code = 0;
-+ int format_code = 0, pr_res_type = 0, pr_res_scope = 0;
-+ bool all_reg = false;
-
- if (cmd->data_length < 8) {
- pr_err("PRIN SA READ_FULL_STATUS SCSI Data Length: %u"
-@@ -3872,6 +3931,19 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- buf[2] = ((dev->t10_pr.pr_generation >> 8) & 0xff);
- buf[3] = (dev->t10_pr.pr_generation & 0xff);
-
-+ spin_lock(&dev->dev_reservation_lock);
-+ if (dev->dev_pr_res_holder) {
-+ struct t10_pr_registration *pr_holder = dev->dev_pr_res_holder;
-+
-+ if (pr_holder->pr_res_type == PR_TYPE_WRITE_EXCLUSIVE_ALLREG ||
-+ pr_holder->pr_res_type == PR_TYPE_EXCLUSIVE_ACCESS_ALLREG) {
-+ all_reg = true;
-+ pr_res_type = pr_holder->pr_res_type;
-+ pr_res_scope = pr_holder->pr_res_scope;
-+ }
-+ }
-+ spin_unlock(&dev->dev_reservation_lock);
-+
- spin_lock(&pr_tmpl->registration_lock);
- list_for_each_entry_safe(pr_reg, pr_reg_tmp,
- &pr_tmpl->registration_list, pr_reg_list) {
-@@ -3921,14 +3993,20 @@ core_scsi3_pri_read_full_status(struct se_cmd *cmd)
- * reservation holder for PR_HOLDER bit.
- *
- * Also, if this registration is the reservation
-- * holder, fill in SCOPE and TYPE in the next byte.
-+ * holder or there is an All Registrants reservation
-+ * active, fill in SCOPE and TYPE in the next byte.
- */
- if (pr_reg->pr_res_holder) {
- buf[off++] |= 0x01;
- buf[off++] = (pr_reg->pr_res_scope & 0xf0) |
- (pr_reg->pr_res_type & 0x0f);
-- } else
-+ } else if (all_reg) {
-+ buf[off++] |= 0x01;
-+ buf[off++] = (pr_res_scope & 0xf0) |
-+ (pr_res_type & 0x0f);
-+ } else {
- off += 2;
-+ }
-
- off += 4; /* Skip over reserved area */
- /*
-diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
-index 0f199f6..29f2880 100644
---- a/drivers/target/target_core_pscsi.c
-+++ b/drivers/target/target_core_pscsi.c
-@@ -1111,7 +1111,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
- struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
- struct scsi_device *sd = pdv->pdv_sd;
-
-- return sd->type;
-+ return (sd) ? sd->type : TYPE_NO_LUN;
- }
-
- static sector_t pscsi_get_blocks(struct se_device *dev)
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index e6463ef..9e54c0f 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2327,6 +2327,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
- list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
- out:
- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+
-+ if (ret && ack_kref)
-+ target_put_sess_cmd(se_sess, se_cmd);
-+
- return ret;
- }
- EXPORT_SYMBOL(target_get_sess_cmd);
-diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index feda344..5892eab 100644
---- a/drivers/tty/serial/8250/8250_pci.c
-+++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -66,7 +66,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
- "Please send the output of lspci -vv, this\n"
- "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
- "manufacturer and name of serial board or\n"
-- "modem board to rmk+serial@arm.linux.org.uk.\n",
-+ "modem board to <linux-serial@vger.kernel.org>.\n",
- pci_name(dev), str, dev->vendor, dev->device,
- dev->subsystem_vendor, dev->subsystem_device);
- }
-diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
-index f4a9e33..c8860a8 100644
---- a/drivers/xen/events/events_base.c
-+++ b/drivers/xen/events/events_base.c
-@@ -547,20 +547,26 @@ static unsigned int __startup_pirq(unsigned int irq)
- pirq_query_unmask(irq);
-
- rc = set_evtchn_to_irq(evtchn, irq);
-- if (rc != 0) {
-- pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-- irq, rc);
-- xen_evtchn_close(evtchn);
-- return 0;
-- }
-+ if (rc)
-+ goto err;
-+
- bind_evtchn_to_cpu(evtchn, 0);
- info->evtchn = evtchn;
-
-+ rc = xen_evtchn_port_setup(info);
-+ if (rc)
-+ goto err;
-+
- out:
- unmask_evtchn(evtchn);
- eoi_pirq(irq_get_irq_data(irq));
-
- return 0;
-+
-+err:
-+ pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
-+ xen_evtchn_close(evtchn);
-+ return 0;
- }
-
- static unsigned int startup_pirq(struct irq_data *data)
-diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
-index 46ae0f9..75fe3d4 100644
---- a/drivers/xen/xen-pciback/conf_space.c
-+++ b/drivers/xen/xen-pciback/conf_space.c
-@@ -16,7 +16,7 @@
- #include "conf_space.h"
- #include "conf_space_quirks.h"
-
--static bool permissive;
-+bool permissive;
- module_param(permissive, bool, 0644);
-
- /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
-diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
-index e56c934..2e1d73d 100644
---- a/drivers/xen/xen-pciback/conf_space.h
-+++ b/drivers/xen/xen-pciback/conf_space.h
-@@ -64,6 +64,8 @@ struct config_field_entry {
- void *data;
- };
-
-+extern bool permissive;
-+
- #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
-
- /* Add fields to a device - the add_fields macro expects to get a pointer to
-diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
-index c5ee825..2d73693 100644
---- a/drivers/xen/xen-pciback/conf_space_header.c
-+++ b/drivers/xen/xen-pciback/conf_space_header.c
-@@ -11,6 +11,10 @@
- #include "pciback.h"
- #include "conf_space.h"
-
-+struct pci_cmd_info {
-+ u16 val;
-+};
-+
- struct pci_bar_info {
- u32 val;
- u32 len_val;
-@@ -20,22 +24,36 @@ struct pci_bar_info {
- #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
- #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
-
--static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+/* Bits guests are allowed to control in permissive mode. */
-+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
-+ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
-+ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
-+
-+static void *command_init(struct pci_dev *dev, int offset)
- {
-- int i;
-- int ret;
--
-- ret = xen_pcibk_read_config_word(dev, offset, value, data);
-- if (!pci_is_enabled(dev))
-- return ret;
--
-- for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-- if (dev->resource[i].flags & IORESOURCE_IO)
-- *value |= PCI_COMMAND_IO;
-- if (dev->resource[i].flags & IORESOURCE_MEM)
-- *value |= PCI_COMMAND_MEMORY;
-+ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
-+ int err;
-+
-+ if (!cmd)
-+ return ERR_PTR(-ENOMEM);
-+
-+ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
-+ if (err) {
-+ kfree(cmd);
-+ return ERR_PTR(err);
- }
-
-+ return cmd;
-+}
-+
-+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+{
-+ int ret = pci_read_config_word(dev, offset, value);
-+ const struct pci_cmd_info *cmd = data;
-+
-+ *value &= PCI_COMMAND_GUEST;
-+ *value |= cmd->val & ~PCI_COMMAND_GUEST;
-+
- return ret;
- }
-
-@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- {
- struct xen_pcibk_dev_data *dev_data;
- int err;
-+ u16 val;
-+ struct pci_cmd_info *cmd = data;
-
- dev_data = pci_get_drvdata(dev);
- if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
-@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- }
- }
-
-+ cmd->val = value;
-+
-+ if (!permissive && (!dev_data || !dev_data->permissive))
-+ return 0;
-+
-+ /* Only allow the guest to control certain bits. */
-+ err = pci_read_config_word(dev, offset, &val);
-+ if (err || val == value)
-+ return err;
-+
-+ value &= PCI_COMMAND_GUEST;
-+ value |= val & ~PCI_COMMAND_GUEST;
-+
- return pci_write_config_word(dev, offset, value);
- }
-
-@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
- {
- .offset = PCI_COMMAND,
- .size = 2,
-+ .init = command_init,
-+ .release = bar_release,
- .u.w.read = command_read,
- .u.w.write = command_write,
- },
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index 6eb13c6..499155c 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -819,8 +819,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
-
- newpage = buf->page;
-
-- if (WARN_ON(!PageUptodate(newpage)))
-- return -EIO;
-+ if (!PageUptodate(newpage))
-+ SetPageUptodate(newpage);
-
- ClearPageMappedToDisk(newpage);
-
-@@ -1726,6 +1726,9 @@ copy_finish:
- static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
- unsigned int size, struct fuse_copy_state *cs)
- {
-+ /* Don't try to move pages (yet) */
-+ cs->move_pages = 0;
-+
- switch (code) {
- case FUSE_NOTIFY_POLL:
- return fuse_notify_poll(fc, size, cs);
-diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
-index 5bee816..14538a8 100644
---- a/fs/nilfs2/segment.c
-+++ b/fs/nilfs2/segment.c
-@@ -1906,6 +1906,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- struct the_nilfs *nilfs)
- {
- struct nilfs_inode_info *ii, *n;
-+ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
- int defer_iput = false;
-
- spin_lock(&nilfs->ns_inode_lock);
-@@ -1918,10 +1919,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- brelse(ii->i_bh);
- ii->i_bh = NULL;
- list_del_init(&ii->i_dirty);
-- if (!ii->vfs_inode.i_nlink) {
-+ if (!ii->vfs_inode.i_nlink || during_mount) {
- /*
-- * Defer calling iput() to avoid a deadlock
-- * over I_SYNC flag for inodes with i_nlink == 0
-+ * Defer calling iput() to avoid deadlocks if
-+ * i_nlink == 0 or mount is not yet finished.
- */
- list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
- defer_iput = true;
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index c4b2646..c254671 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -1227,6 +1227,9 @@ out:
-
- static int pagemap_open(struct inode *inode, struct file *file)
- {
-+ /* do not disclose physical addresses: attack vector */
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
- pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
- "to stop being page-shift some time soon. See the "
- "linux/Documentation/vm/pagemap.txt for details.\n");
-diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
-index 6c62cfa..bc9d2c2 100644
---- a/include/linux/workqueue.h
-+++ b/include/linux/workqueue.h
-@@ -71,7 +71,8 @@ enum {
- /* data contains off-queue information when !WORK_STRUCT_PWQ */
- WORK_OFFQ_FLAG_BASE = WORK_STRUCT_COLOR_SHIFT,
-
-- WORK_OFFQ_CANCELING = (1 << WORK_OFFQ_FLAG_BASE),
-+ __WORK_OFFQ_CANCELING = WORK_OFFQ_FLAG_BASE,
-+ WORK_OFFQ_CANCELING = (1 << __WORK_OFFQ_CANCELING),
-
- /*
- * When a work item is off queue, its high bits point to the last
-diff --git a/kernel/cpuset.c b/kernel/cpuset.c
-index 2fb2877..7b4530b 100644
---- a/kernel/cpuset.c
-+++ b/kernel/cpuset.c
-@@ -503,9 +503,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
-
- rcu_read_lock();
- cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
-- if (cp == root_cs)
-- continue;
--
- /* skip the whole subtree if @cp doesn't have any CPU */
- if (cpumask_empty(cp->cpus_allowed)) {
- pos_css = css_rightmost_descendant(pos_css);
-diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
-index cbd69d8..2ca4a8b 100644
---- a/kernel/printk/console_cmdline.h
-+++ b/kernel/printk/console_cmdline.h
-@@ -3,7 +3,7 @@
-
- struct console_cmdline
- {
-- char name[8]; /* Name of the driver */
-+ char name[16]; /* Name of the driver */
- int index; /* Minor dev. to use */
- char *options; /* Options for the driver */
- #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index 8c086e6..a755ad7 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -2280,6 +2280,7 @@ void register_console(struct console *newcon)
- for (i = 0, c = console_cmdline;
- i < MAX_CMDLINECONSOLES && c->name[0];
- i++, c++) {
-+ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
- if (strcmp(c->name, newcon->name) != 0)
- continue;
- if (newcon->index >= 0 &&
-diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index f6f31d8..423c9e3 100644
---- a/kernel/workqueue.c
-+++ b/kernel/workqueue.c
-@@ -2893,19 +2893,57 @@ bool flush_work(struct work_struct *work)
- }
- EXPORT_SYMBOL_GPL(flush_work);
-
-+struct cwt_wait {
-+ wait_queue_t wait;
-+ struct work_struct *work;
-+};
-+
-+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
-+{
-+ struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
-+
-+ if (cwait->work != key)
-+ return 0;
-+ return autoremove_wake_function(wait, mode, sync, key);
-+}
-+
- static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
- {
-+ static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
- unsigned long flags;
- int ret;
-
- do {
- ret = try_to_grab_pending(work, is_dwork, &flags);
- /*
-- * If someone else is canceling, wait for the same event it
-- * would be waiting for before retrying.
-+ * If someone else is already canceling, wait for it to
-+ * finish. flush_work() doesn't work for PREEMPT_NONE
-+ * because we may get scheduled between @work's completion
-+ * and the other canceling task resuming and clearing
-+ * CANCELING - flush_work() will return false immediately
-+ * as @work is no longer busy, try_to_grab_pending() will
-+ * return -ENOENT as @work is still being canceled and the
-+ * other canceling task won't be able to clear CANCELING as
-+ * we're hogging the CPU.
-+ *
-+ * Let's wait for completion using a waitqueue. As this
-+ * may lead to the thundering herd problem, use a custom
-+ * wake function which matches @work along with exclusive
-+ * wait and wakeup.
- */
-- if (unlikely(ret == -ENOENT))
-- flush_work(work);
-+ if (unlikely(ret == -ENOENT)) {
-+ struct cwt_wait cwait;
-+
-+ init_wait(&cwait.wait);
-+ cwait.wait.func = cwt_wakefn;
-+ cwait.work = work;
-+
-+ prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
-+ TASK_UNINTERRUPTIBLE);
-+ if (work_is_canceling(work))
-+ schedule();
-+ finish_wait(&cancel_waitq, &cwait.wait);
-+ }
- } while (unlikely(ret < 0));
-
- /* tell other tasks trying to grab @work to back off */
-@@ -2914,6 +2952,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
-
- flush_work(work);
- clear_work_data(work);
-+
-+ /*
-+ * Paired with prepare_to_wait() above so that either
-+ * waitqueue_active() is visible here or !work_is_canceling() is
-+ * visible there.
-+ */
-+ smp_mb();
-+ if (waitqueue_active(&cancel_waitq))
-+ __wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
-+
- return ret;
- }
-
-diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
-index 7a85967..f0f5c5c 100644
---- a/lib/lz4/lz4_decompress.c
-+++ b/lib/lz4/lz4_decompress.c
-@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
- /* Error: request to write beyond destination buffer */
- if (cpy > oend)
- goto _output_error;
-+ if ((ref + COPYLENGTH) > oend ||
-+ (op + COPYLENGTH) > oend)
-+ goto _output_error;
- LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
- while (op < cpy)
- *op++ = *ref++;
-diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index d6be3ed..526bf56 100644
---- a/net/caif/caif_socket.c
-+++ b/net/caif/caif_socket.c
-@@ -283,7 +283,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
- int copylen;
-
- ret = -EOPNOTSUPP;
-- if (m->msg_flags&MSG_OOB)
-+ if (flags & MSG_OOB)
- goto read_error;
-
- skb = skb_recv_datagram(sk, flags, 0 , &ret);
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index a27f8aa..5e9a227 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -262,6 +262,9 @@ int can_send(struct sk_buff *skb, int loop)
- goto inval_skb;
- }
-
-+ skb->ip_summed = CHECKSUM_UNNECESSARY;
-+
-+ skb_reset_mac_header(skb);
- skb_reset_network_header(skb);
- skb_reset_transport_header(skb);
-
-diff --git a/net/compat.c b/net/compat.c
-index 275af79..d125290 100644
---- a/net/compat.c
-+++ b/net/compat.c
-@@ -71,6 +71,13 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
- __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
- __get_user(kmsg->msg_flags, &umsg->msg_flags))
- return -EFAULT;
-+
-+ if (!tmp1)
-+ kmsg->msg_namelen = 0;
-+
-+ if (kmsg->msg_namelen < 0)
-+ return -EINVAL;
-+
- if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
- kmsg->msg_namelen = sizeof(struct sockaddr_storage);
- kmsg->msg_name = compat_ptr(tmp1);
-diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
-index cf9cd13..e731c96 100644
---- a/net/core/sysctl_net_core.c
-+++ b/net/core/sysctl_net_core.c
-@@ -25,6 +25,8 @@
- static int zero = 0;
- static int one = 1;
- static int ushort_max = USHRT_MAX;
-+static int min_sndbuf = SOCK_MIN_SNDBUF;
-+static int min_rcvbuf = SOCK_MIN_RCVBUF;
-
- #ifdef CONFIG_RPS
- static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
-@@ -223,7 +225,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_sndbuf,
- },
- {
- .procname = "rmem_max",
-@@ -231,7 +233,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_rcvbuf,
- },
- {
- .procname = "wmem_default",
-@@ -239,7 +241,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_sndbuf,
- },
- {
- .procname = "rmem_default",
-@@ -247,7 +249,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_rcvbuf,
- },
- {
- .procname = "dev_weight",
-diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index e34dccb..4eeba4e 100644
---- a/net/ipv4/inet_diag.c
-+++ b/net/ipv4/inet_diag.c
-@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
- mutex_unlock(&inet_diag_table_mutex);
- }
-
-+static size_t inet_sk_attr_size(void)
-+{
-+ return nla_total_size(sizeof(struct tcp_info))
-+ + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
-+ + nla_total_size(1) /* INET_DIAG_TOS */
-+ + nla_total_size(1) /* INET_DIAG_TCLASS */
-+ + nla_total_size(sizeof(struct inet_diag_meminfo))
-+ + nla_total_size(sizeof(struct inet_diag_msg))
-+ + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
-+ + nla_total_size(TCP_CA_NAME_MAX)
-+ + nla_total_size(sizeof(struct tcpvegas_info))
-+ + 64;
-+}
-+
- int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
- struct sk_buff *skb, struct inet_diag_req_v2 *req,
- struct user_namespace *user_ns,
-@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
- if (err)
- goto out;
-
-- rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-- sizeof(struct inet_diag_meminfo) +
-- sizeof(struct tcp_info) + 64, GFP_KERNEL);
-+ rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
- if (!rep) {
- err = -ENOMEM;
- goto out;
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 7efa26b..d0c3108 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2617,15 +2617,11 @@ void tcp_send_fin(struct sock *sk)
- } else {
- /* Socket is locked, keep trying until memory is available. */
- for (;;) {
-- skb = alloc_skb_fclone(MAX_TCP_HEADER,
-- sk->sk_allocation);
-+ skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
- if (skb)
- break;
- yield();
- }
--
-- /* Reserve space for headers and prepare control bits. */
-- skb_reserve(skb, MAX_TCP_HEADER);
- /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
- tcp_init_nondata_skb(skb, tp->write_seq,
- TCPHDR_ACK | TCPHDR_FIN);
-@@ -2899,9 +2895,9 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
- {
- struct tcp_sock *tp = tcp_sk(sk);
- struct tcp_fastopen_request *fo = tp->fastopen_req;
-- int syn_loss = 0, space, i, err = 0, iovlen = fo->data->msg_iovlen;
-- struct sk_buff *syn_data = NULL, *data;
-+ int syn_loss = 0, space, err = 0;
- unsigned long last_syn_loss = 0;
-+ struct sk_buff *syn_data;
-
- tp->rx_opt.mss_clamp = tp->advmss; /* If MSS is not cached */
- tcp_fastopen_cache_get(sk, &tp->rx_opt.mss_clamp, &fo->cookie,
-@@ -2932,42 +2928,38 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
- /* limit to order-0 allocations */
- space = min_t(size_t, space, SKB_MAX_HEAD(MAX_TCP_HEADER));
-
-- syn_data = skb_copy_expand(syn, MAX_TCP_HEADER, space,
-- sk->sk_allocation);
-- if (syn_data == NULL)
-+ syn_data = sk_stream_alloc_skb(sk, space, sk->sk_allocation);
-+ if (!syn_data)
- goto fallback;
-+ syn_data->ip_summed = CHECKSUM_PARTIAL;
-+ memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
-+ if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space),
-+ fo->data->msg_iov, 0, space))) {
-+ kfree_skb(syn_data);
-+ goto fallback;
-+ }
-
-- for (i = 0; i < iovlen && syn_data->len < space; ++i) {
-- struct iovec *iov = &fo->data->msg_iov[i];
-- unsigned char __user *from = iov->iov_base;
-- int len = iov->iov_len;
--
-- if (syn_data->len + len > space)
-- len = space - syn_data->len;
-- else if (i + 1 == iovlen)
-- /* No more data pending in inet_wait_for_connect() */
-- fo->data = NULL;
-+ /* No more data pending in inet_wait_for_connect() */
-+ if (space == fo->size)
-+ fo->data = NULL;
-+ fo->copied = space;
-
-- if (skb_add_data(syn_data, from, len))
-- goto fallback;
-- }
-+ tcp_connect_queue_skb(sk, syn_data);
-
-- /* Queue a data-only packet after the regular SYN for retransmission */
-- data = pskb_copy(syn_data, sk->sk_allocation);
-- if (data == NULL)
-- goto fallback;
-- TCP_SKB_CB(data)->seq++;
-- TCP_SKB_CB(data)->tcp_flags &= ~TCPHDR_SYN;
-- TCP_SKB_CB(data)->tcp_flags = (TCPHDR_ACK|TCPHDR_PSH);
-- tcp_connect_queue_skb(sk, data);
-- fo->copied = data->len;
-+ err = tcp_transmit_skb(sk, syn_data, 1, sk->sk_allocation);
-
-- if (tcp_transmit_skb(sk, syn_data, 0, sk->sk_allocation) == 0) {
-+ /* Now full SYN+DATA was cloned and sent (or not),
-+ * remove the SYN from the original skb (syn_data)
-+ * we keep in write queue in case of a retransmit, as we
-+ * also have the SYN packet (with no data) in the same queue.
-+ */
-+ TCP_SKB_CB(syn_data)->seq++;
-+ TCP_SKB_CB(syn_data)->tcp_flags = TCPHDR_ACK | TCPHDR_PSH;
-+ if (!err) {
- tp->syn_data = (fo->copied > 0);
- NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPFASTOPENACTIVE);
- goto done;
- }
-- syn_data = NULL;
-
- fallback:
- /* Send a regular SYN with Fast Open cookie request option */
-@@ -2976,7 +2968,6 @@ fallback:
- err = tcp_transmit_skb(sk, syn, 1, sk->sk_allocation);
- if (err)
- tp->syn_fastopen = 0;
-- kfree_skb(syn_data);
- done:
- fo->cookie.len = -1; /* Exclude Fast Open option for SYN retries */
- return err;
-@@ -2996,13 +2987,10 @@ int tcp_connect(struct sock *sk)
- return 0;
- }
-
-- buff = alloc_skb_fclone(MAX_TCP_HEADER + 15, sk->sk_allocation);
-- if (unlikely(buff == NULL))
-+ buff = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
-+ if (unlikely(!buff))
- return -ENOBUFS;
-
-- /* Reserve space for headers. */
-- skb_reserve(buff, MAX_TCP_HEADER);
--
- tcp_init_nondata_skb(buff, tp->write_seq++, TCPHDR_SYN);
- tp->retrans_stamp = TCP_SKB_CB(buff)->when = tcp_time_stamp;
- tcp_connect_queue_skb(sk, buff);
-diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
-index b4d5e1d..27ca796 100644
---- a/net/ipv6/fib6_rules.c
-+++ b/net/ipv6/fib6_rules.c
-@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
- goto again;
- flp6->saddr = saddr;
- }
-+ err = rt->dst.error;
- goto out;
- }
- again:
-diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
-index 27d3f40..847d2a2 100644
---- a/net/netfilter/ipvs/ip_vs_core.c
-+++ b/net/netfilter/ipvs/ip_vs_core.c
-@@ -658,16 +658,24 @@ static inline int ip_vs_gather_frags(struct sk_buff *skb, u_int32_t user)
- return err;
- }
-
--static int ip_vs_route_me_harder(int af, struct sk_buff *skb)
-+static int ip_vs_route_me_harder(int af, struct sk_buff *skb,
-+ unsigned int hooknum)
- {
-+ if (!sysctl_snat_reroute(skb))
-+ return 0;
-+ /* Reroute replies only to remote clients (FORWARD and LOCAL_OUT) */
-+ if (NF_INET_LOCAL_IN == hooknum)
-+ return 0;
- #ifdef CONFIG_IP_VS_IPV6
- if (af == AF_INET6) {
-- if (sysctl_snat_reroute(skb) && ip6_route_me_harder(skb) != 0)
-+ struct dst_entry *dst = skb_dst(skb);
-+
-+ if (dst->dev && !(dst->dev->flags & IFF_LOOPBACK) &&
-+ ip6_route_me_harder(skb) != 0)
- return 1;
- } else
- #endif
-- if ((sysctl_snat_reroute(skb) ||
-- skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
-+ if (!(skb_rtable(skb)->rt_flags & RTCF_LOCAL) &&
- ip_route_me_harder(skb, RTN_LOCAL) != 0)
- return 1;
-
-@@ -790,7 +798,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
- union nf_inet_addr *snet,
- __u8 protocol, struct ip_vs_conn *cp,
- struct ip_vs_protocol *pp,
-- unsigned int offset, unsigned int ihl)
-+ unsigned int offset, unsigned int ihl,
-+ unsigned int hooknum)
- {
- unsigned int verdict = NF_DROP;
-
-@@ -820,7 +829,7 @@ static int handle_response_icmp(int af, struct sk_buff *skb,
- #endif
- ip_vs_nat_icmp(skb, pp, cp, 1);
-
-- if (ip_vs_route_me_harder(af, skb))
-+ if (ip_vs_route_me_harder(af, skb, hooknum))
- goto out;
-
- /* do the statistics and put it back */
-@@ -915,7 +924,7 @@ static int ip_vs_out_icmp(struct sk_buff *skb, int *related,
-
- snet.ip = iph->saddr;
- return handle_response_icmp(AF_INET, skb, &snet, cih->protocol, cp,
-- pp, ciph.len, ihl);
-+ pp, ciph.len, ihl, hooknum);
- }
-
- #ifdef CONFIG_IP_VS_IPV6
-@@ -980,7 +989,8 @@ static int ip_vs_out_icmp_v6(struct sk_buff *skb, int *related,
- snet.in6 = ciph.saddr.in6;
- writable = ciph.len;
- return handle_response_icmp(AF_INET6, skb, &snet, ciph.protocol, cp,
-- pp, writable, sizeof(struct ipv6hdr));
-+ pp, writable, sizeof(struct ipv6hdr),
-+ hooknum);
- }
- #endif
-
-@@ -1039,7 +1049,8 @@ static inline bool is_new_conn(const struct sk_buff *skb,
- */
- static unsigned int
- handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
-- struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
-+ struct ip_vs_conn *cp, struct ip_vs_iphdr *iph,
-+ unsigned int hooknum)
- {
- struct ip_vs_protocol *pp = pd->pp;
-
-@@ -1077,7 +1088,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
- * if it came from this machine itself. So re-compute
- * the routing information.
- */
-- if (ip_vs_route_me_harder(af, skb))
-+ if (ip_vs_route_me_harder(af, skb, hooknum))
- goto drop;
-
- IP_VS_DBG_PKT(10, af, pp, skb, 0, "After SNAT");
-@@ -1180,7 +1191,7 @@ ip_vs_out(unsigned int hooknum, struct sk_buff *skb, int af)
- cp = pp->conn_out_get(af, skb, &iph, 0);
-
- if (likely(cp))
-- return handle_response(af, skb, pd, cp, &iph);
-+ return handle_response(af, skb, pd, cp, &iph, hooknum);
- if (sysctl_nat_icmp_send(net) &&
- (pp->protocol == IPPROTO_TCP ||
- pp->protocol == IPPROTO_UDP ||
-diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
-index db80126..a8027e7 100644
---- a/net/netfilter/ipvs/ip_vs_sync.c
-+++ b/net/netfilter/ipvs/ip_vs_sync.c
-@@ -891,6 +891,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
- IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
- return;
- }
-+ if (!(flags & IP_VS_CONN_F_TEMPLATE))
-+ kfree(param->pe_data);
- }
-
- if (opt)
-@@ -1164,6 +1166,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
- (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
- );
- #endif
-+ ip_vs_pe_put(param.pe);
- return 0;
- /* Error exit */
- out:
-diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
-index ad97961..7350723 100644
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -611,8 +611,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
- struct xt_match *match = nft_match->ops.data;
-
- if (strcmp(match->name, mt_name) == 0 &&
-- match->revision == rev && match->family == family)
-+ match->revision == rev && match->family == family) {
-+ if (!try_module_get(match->me))
-+ return ERR_PTR(-ENOENT);
-+
- return &nft_match->ops;
-+ }
- }
-
- match = xt_request_find_match(family, mt_name, rev);
-@@ -682,8 +686,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
- struct xt_target *target = nft_target->ops.data;
-
- if (strcmp(target->name, tg_name) == 0 &&
-- target->revision == rev && target->family == family)
-+ target->revision == rev && target->family == family) {
-+ if (!try_module_get(target->me))
-+ return ERR_PTR(-ENOENT);
-+
- return &nft_target->ops;
-+ }
- }
-
- target = xt_request_find_target(family, tg_name, rev);
-diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
-index 1ba6793..13332db 100644
---- a/net/netfilter/xt_socket.c
-+++ b/net/netfilter/xt_socket.c
-@@ -243,12 +243,13 @@ static int
- extract_icmp6_fields(const struct sk_buff *skb,
- unsigned int outside_hdrlen,
- int *protocol,
-- struct in6_addr **raddr,
-- struct in6_addr **laddr,
-+ const struct in6_addr **raddr,
-+ const struct in6_addr **laddr,
- __be16 *rport,
-- __be16 *lport)
-+ __be16 *lport,
-+ struct ipv6hdr *ipv6_var)
- {
-- struct ipv6hdr *inside_iph, _inside_iph;
-+ const struct ipv6hdr *inside_iph;
- struct icmp6hdr *icmph, _icmph;
- __be16 *ports, _ports[2];
- u8 inside_nexthdr;
-@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
- if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
- return 1;
-
-- inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
-+ inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
-+ sizeof(*ipv6_var), ipv6_var);
- if (inside_iph == NULL)
- return 1;
- inside_nexthdr = inside_iph->nexthdr;
-
-- inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
-+ inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
-+ sizeof(*ipv6_var),
- &inside_nexthdr, &inside_fragoff);
- if (inside_hdrlen < 0)
- return 1; /* hjm: Packet has no/incomplete transport layer headers. */
-@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
- static bool
- socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
- {
-- struct ipv6hdr *iph = ipv6_hdr(skb);
-+ struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
- struct udphdr _hdr, *hp = NULL;
- struct sock *sk = skb->sk;
-- struct in6_addr *daddr = NULL, *saddr = NULL;
-+ const struct in6_addr *daddr = NULL, *saddr = NULL;
- __be16 uninitialized_var(dport), uninitialized_var(sport);
- int thoff = 0, uninitialized_var(tproto);
- const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
-@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
-
- } else if (tproto == IPPROTO_ICMPV6) {
- if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
-- &sport, &dport))
-+ &sport, &dport, &ipv6_var))
- return false;
- } else {
- return false;
-diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
-index a817705..dba8d08 100644
---- a/net/rds/iw_rdma.c
-+++ b/net/rds/iw_rdma.c
-@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
- int *unpinned);
- static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
-
--static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
-+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
-+ struct rds_iw_device **rds_iwdev,
-+ struct rdma_cm_id **cm_id)
- {
- struct rds_iw_device *iwdev;
- struct rds_iw_cm_id *i_cm_id;
-@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- src_addr->sin_port,
- dst_addr->sin_addr.s_addr,
- dst_addr->sin_port,
-- rs->rs_bound_addr,
-- rs->rs_bound_port,
-- rs->rs_conn_addr,
-- rs->rs_conn_port);
-+ src->sin_addr.s_addr,
-+ src->sin_port,
-+ dst->sin_addr.s_addr,
-+ dst->sin_port);
- #ifdef WORKING_TUPLE_DETECTION
-- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-- src_addr->sin_port == rs->rs_bound_port &&
-- dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-- dst_addr->sin_port == rs->rs_conn_port) {
-+ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
-+ src_addr->sin_port == src->sin_port &&
-+ dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
-+ dst_addr->sin_port == dst->sin_port) {
- #else
- /* FIXME - needs to compare the local and remote
- * ipaddr/port tuple, but the ipaddr is the only
-@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- * zero'ed. It doesn't appear to be properly populated
- * during connection setup...
- */
-- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
-+ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
- #endif
- spin_unlock_irq(&iwdev->spinlock);
- *rds_iwdev = iwdev;
-@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
- {
- struct sockaddr_in *src_addr, *dst_addr;
- struct rds_iw_device *rds_iwdev_old;
-- struct rds_sock rs;
- struct rdma_cm_id *pcm_id;
- int rc;
-
- src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-
-- rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-- rs.rs_bound_port = src_addr->sin_port;
-- rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-- rs.rs_conn_port = dst_addr->sin_port;
--
-- rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
-+ rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
- if (rc)
- rds_iw_remove_cm_id(rds_iwdev, cm_id);
-
-@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
- struct rds_iw_device *rds_iwdev;
- struct rds_iw_mr *ibmr = NULL;
- struct rdma_cm_id *cm_id;
-+ struct sockaddr_in src = {
-+ .sin_addr.s_addr = rs->rs_bound_addr,
-+ .sin_port = rs->rs_bound_port,
-+ };
-+ struct sockaddr_in dst = {
-+ .sin_addr.s_addr = rs->rs_conn_addr,
-+ .sin_port = rs->rs_conn_port,
-+ };
- int ret;
-
-- ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
-+ ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
- if (ret || !cm_id) {
- ret = -ENODEV;
- goto out;
-diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
-index 34b5490..4949f75 100644
---- a/net/rxrpc/ar-recvmsg.c
-+++ b/net/rxrpc/ar-recvmsg.c
-@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
- if (!skb) {
- /* nothing remains on the queue */
- if (copied &&
-- (msg->msg_flags & MSG_PEEK || timeo == 0))
-+ (flags & MSG_PEEK || timeo == 0))
- goto out;
-
- /* wait for a message to turn up */
-diff --git a/sound/core/control.c b/sound/core/control.c
-index 98a29b2..f2082a3 100644
---- a/sound/core/control.c
-+++ b/sound/core/control.c
-@@ -1168,6 +1168,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
-
- if (info->count < 1)
- return -EINVAL;
-+ if (!*info->id.name)
-+ return -EINVAL;
-+ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
-+ return -EINVAL;
- access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
- (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
- SNDRV_CTL_ELEM_ACCESS_INACTIVE|
-diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
-index d9a09bd..9a23bde 100644
---- a/sound/pci/hda/hda_generic.c
-+++ b/sound/pci/hda/hda_generic.c
-@@ -653,12 +653,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
- return val;
- }
-
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
-+{
-+ unsigned int wcaps = get_wcaps(codec, nid);
-+ hda_nid_t conn;
-+
-+ if (wcaps & AC_WCAP_STEREO)
-+ return true;
-+ if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+ return false;
-+ if (snd_hda_get_num_conns(codec, nid) != 1)
-+ return false;
-+ if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
-+ return false;
-+ return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
-+}
-+
- /* initialize the amp value (only at the first time) */
- static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
- {
- unsigned int caps = query_amp_caps(codec, nid, dir);
- int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-- snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+
-+ if (is_stereo_amps(codec, nid, dir))
-+ snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+ else
-+ snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
-+}
-+
-+/* update the amp, doing in stereo or mono depending on NID */
-+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
-+ unsigned int mask, unsigned int val)
-+{
-+ if (is_stereo_amps(codec, nid, dir))
-+ return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
-+ mask, val);
-+ else
-+ return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
-+ mask, val);
- }
-
- /* calculate amp value mask we can modify;
-@@ -698,7 +731,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
- return;
-
- val &= mask;
-- snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
-+ update_amp(codec, nid, dir, idx, mask, val);
- }
-
- static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
-@@ -4337,13 +4370,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
- has_amp = nid_has_mute(codec, mix, HDA_INPUT);
- for (i = 0; i < nums; i++) {
- if (has_amp)
-- snd_hda_codec_amp_stereo(codec, mix,
-- HDA_INPUT, i,
-- 0xff, HDA_AMP_MUTE);
-+ update_amp(codec, mix, HDA_INPUT, i,
-+ 0xff, HDA_AMP_MUTE);
- else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-- snd_hda_codec_amp_stereo(codec, conn[i],
-- HDA_OUTPUT, 0,
-- 0xff, HDA_AMP_MUTE);
-+ update_amp(codec, conn[i], HDA_OUTPUT, 0,
-+ 0xff, HDA_AMP_MUTE);
- }
- }
-
-diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
-index 2f3059b..84e8879 100644
---- a/sound/pci/hda/hda_intel.c
-+++ b/sound/pci/hda/hda_intel.c
-@@ -959,7 +959,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
- }
- }
-
-- if (!bus->no_response_fallback)
-+ if (bus->no_response_fallback)
- return -1;
-
- if (!chip->polling_mode && chip->poll_count < 2) {
-diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
-index ce5a6da..05e19f7 100644
---- a/sound/pci/hda/hda_proc.c
-+++ b/sound/pci/hda/hda_proc.c
-@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
- (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
- }
-
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
-+ int dir, unsigned int wcaps, int indices)
-+{
-+ hda_nid_t conn;
-+
-+ if (wcaps & AC_WCAP_STEREO)
-+ return true;
-+ /* check for a stereo-to-mono mix; it must be:
-+ * only a single connection, only for input, and only a mixer widget
-+ */
-+ if (indices != 1 || dir != HDA_INPUT ||
-+ get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+ return false;
-+
-+ if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
-+ return false;
-+ /* the connection source is a stereo? */
-+ wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
-+ return !!(wcaps & AC_WCAP_STEREO);
-+}
-+
- static void print_amp_vals(struct snd_info_buffer *buffer,
- struct hda_codec *codec, hda_nid_t nid,
-- int dir, int stereo, int indices)
-+ int dir, unsigned int wcaps, int indices)
- {
- unsigned int val;
-+ bool stereo;
- int i;
-
-+ stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
-+
- dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
- for (i = 0; i < indices; i++) {
- snd_iprintf(buffer, " [");
-@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- (codec->single_adc_amp &&
- wid_type == AC_WID_AUD_IN))
- print_amp_vals(buffer, codec, nid, HDA_INPUT,
-- wid_caps & AC_WCAP_STEREO,
-- 1);
-+ wid_caps, 1);
- else
- print_amp_vals(buffer, codec, nid, HDA_INPUT,
-- wid_caps & AC_WCAP_STEREO,
-- conn_len);
-+ wid_caps, conn_len);
- }
- if (wid_caps & AC_WCAP_OUT_AMP) {
- snd_iprintf(buffer, " Amp-Out caps: ");
-@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- if (wid_type == AC_WID_PIN &&
- codec->pin_amp_workaround)
- print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-- wid_caps & AC_WCAP_STEREO,
-- conn_len);
-+ wid_caps, conn_len);
- else
- print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-- wid_caps & AC_WCAP_STEREO, 1);
-+ wid_caps, 1);
- }
-
- switch (wid_type) {
-diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
-index fc492ac..51e2080 100644
---- a/sound/pci/hda/patch_cirrus.c
-+++ b/sound/pci/hda/patch_cirrus.c
-@@ -396,6 +396,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
- SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
- SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
- SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
-+ SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
- SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
- SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
- {} /* terminator */
-@@ -587,6 +588,7 @@ static int patch_cs420x(struct hda_codec *codec)
- return -ENOMEM;
-
- spec->gen.automute_hook = cs_automute;
-+ codec->single_adc_amp = 1;
-
- snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
- cs420x_fixups);
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index ffc1946..976493c 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -3232,6 +3232,7 @@ enum {
- CXT_PINCFG_LENOVO_TP410,
- CXT_PINCFG_LEMOTE_A1004,
- CXT_PINCFG_LEMOTE_A1205,
-+ CXT_PINCFG_COMPAQ_CQ60,
- CXT_FIXUP_STEREO_DMIC,
- CXT_FIXUP_INC_MIC_BOOST,
- CXT_FIXUP_HEADPHONE_MIC_PIN,
-@@ -3368,6 +3369,15 @@ static const struct hda_fixup cxt_fixups[] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = cxt_pincfg_lemote,
- },
-+ [CXT_PINCFG_COMPAQ_CQ60] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ /* 0x17 was falsely set up as a mic, it should 0x1d */
-+ { 0x17, 0x400001f0 },
-+ { 0x1d, 0x97a70120 },
-+ { }
-+ }
-+ },
- [CXT_FIXUP_STEREO_DMIC] = {
- .type = HDA_FIXUP_FUNC,
- .v.func = cxt_fixup_stereo_dmic,
-@@ -3411,6 +3421,7 @@ static const struct hda_fixup cxt_fixups[] = {
- };
-
- static const struct snd_pci_quirk cxt5051_fixups[] = {
-+ SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
- SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
- {}
- };
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index 83bddbd..5293b5a 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
- }
- }
- },
-+{
-+ USB_DEVICE(0x0582, 0x0159),
-+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-+ /* .vendor_name = "Roland", */
-+ /* .product_name = "UA-22", */
-+ .ifnum = QUIRK_ANY_INTERFACE,
-+ .type = QUIRK_COMPOSITE,
-+ .data = (const struct snd_usb_audio_quirk[]) {
-+ {
-+ .ifnum = 0,
-+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
-+ },
-+ {
-+ .ifnum = 1,
-+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
-+ },
-+ {
-+ .ifnum = 2,
-+ .type = QUIRK_MIDI_FIXED_ENDPOINT,
-+ .data = & (const struct snd_usb_midi_endpoint_info) {
-+ .out_cables = 0x0001,
-+ .in_cables = 0x0001
-+ }
-+ },
-+ {
-+ .ifnum = -1
-+ }
-+ }
-+ }
-+},
- /* this catches most recent vendor-specific Roland devices */
- {
- .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
diff --git a/3.14.37/0000_README b/3.14.38/0000_README
similarity index 93%
rename from 3.14.37/0000_README
rename to 3.14.38/0000_README
index cbf4ba6..de197d5 100644
--- a/3.14.37/0000_README
+++ b/3.14.38/0000_README
@@ -2,11 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1036_linux-3.14.37.patch
+Patch: 1037_linux-3.14.38.patch
From: http://www.kernel.org
-Desc: Linux 3.14.37
+Desc: Linux 3.14.38
-Patch: 4420_grsecurity-3.1-3.14.37-201504051405.patch
+Patch: 4420_grsecurity-3.1-3.14.38-201504142259.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.14.38/1037_linux-3.14.38.patch b/3.14.38/1037_linux-3.14.38.patch
new file mode 100644
index 0000000..261e9f9
--- /dev/null
+++ b/3.14.38/1037_linux-3.14.38.patch
@@ -0,0 +1,1029 @@
+diff --git a/Makefile b/Makefile
+index c24acc0..f09e19d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 37
++SUBLEVEL = 38
+ EXTRAVERSION =
+ NAME = Remembering Coco
+
+diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
+index a9eee33..101a42b 100644
+--- a/arch/arm64/include/asm/mmu_context.h
++++ b/arch/arm64/include/asm/mmu_context.h
+@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ {
+ unsigned int cpu = smp_processor_id();
+
++ /*
++ * init_mm.pgd does not contain any user mappings and it is always
++ * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
++ */
++ if (next == &init_mm) {
++ cpu_set_reserved_ttbr0();
++ return;
++ }
++
+ if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
+ check_and_switch_context(next, tsk);
+ }
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+index 1382fec..7fcb1ac 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+@@ -50,6 +50,7 @@ ethernet@b0000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b0000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+index 221cd2e..9f25427 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+@@ -50,6 +50,7 @@ ethernet@b1000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b1000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+index 61456c3..cd7c318 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+@@ -49,6 +49,7 @@ ethernet@b2000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b2000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index 38d5073..5193116 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1422,7 +1422,7 @@ machine_check_handle_early:
+ bne 9f /* continue in V mode if we are. */
+
+ 5:
+-#ifdef CONFIG_KVM_BOOK3S_64_HV
++#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
+ /*
+ * We are coming from kernel context. Check if we are coming from
+ * guest. if yes, then we can continue. We will fall through
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index cde4e0a..bf38292 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -24,10 +24,10 @@
+ static struct kobject *mobility_kobj;
+
+ struct update_props_workarea {
+- u32 phandle;
+- u32 state;
+- u64 reserved;
+- u32 nprops;
++ __be32 phandle;
++ __be32 state;
++ __be64 reserved;
++ __be32 nprops;
+ } __packed;
+
+ #define NODE_ACTION_MASK 0xff000000
+@@ -53,11 +53,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ return rc;
+ }
+
+-static int delete_dt_node(u32 phandle)
++static int delete_dt_node(__be32 phandle)
+ {
+ struct device_node *dn;
+
+- dn = of_find_node_by_phandle(phandle);
++ dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ if (!dn)
+ return -ENOENT;
+
+@@ -126,7 +126,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
+ return 0;
+ }
+
+-static int update_dt_node(u32 phandle, s32 scope)
++static int update_dt_node(__be32 phandle, s32 scope)
+ {
+ struct update_props_workarea *upwa;
+ struct device_node *dn;
+@@ -135,6 +135,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ char *prop_data;
+ char *rtas_buf;
+ int update_properties_token;
++ u32 nprops;
+ u32 vd;
+
+ update_properties_token = rtas_token("ibm,update-properties");
+@@ -145,7 +146,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ if (!rtas_buf)
+ return -ENOMEM;
+
+- dn = of_find_node_by_phandle(phandle);
++ dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ if (!dn) {
+ kfree(rtas_buf);
+ return -ENOENT;
+@@ -161,6 +162,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ break;
+
+ prop_data = rtas_buf + sizeof(*upwa);
++ nprops = be32_to_cpu(upwa->nprops);
+
+ /* On the first call to ibm,update-properties for a node the
+ * the first property value descriptor contains an empty
+@@ -169,17 +171,17 @@ static int update_dt_node(u32 phandle, s32 scope)
+ */
+ if (*prop_data == 0) {
+ prop_data++;
+- vd = *(u32 *)prop_data;
++ vd = be32_to_cpu(*(__be32 *)prop_data);
+ prop_data += vd + sizeof(vd);
+- upwa->nprops--;
++ nprops--;
+ }
+
+- for (i = 0; i < upwa->nprops; i++) {
++ for (i = 0; i < nprops; i++) {
+ char *prop_name;
+
+ prop_name = prop_data;
+ prop_data += strlen(prop_name) + 1;
+- vd = *(u32 *)prop_data;
++ vd = be32_to_cpu(*(__be32 *)prop_data);
+ prop_data += sizeof(vd);
+
+ switch (vd) {
+@@ -211,13 +213,13 @@ static int update_dt_node(u32 phandle, s32 scope)
+ return 0;
+ }
+
+-static int add_dt_node(u32 parent_phandle, u32 drc_index)
++static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ {
+ struct device_node *dn;
+ struct device_node *parent_dn;
+ int rc;
+
+- parent_dn = of_find_node_by_phandle(parent_phandle);
++ parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
+ if (!parent_dn)
+ return -ENOENT;
+
+@@ -236,7 +238,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
+ int pseries_devicetree_update(s32 scope)
+ {
+ char *rtas_buf;
+- u32 *data;
++ __be32 *data;
+ int update_nodes_token;
+ int rc;
+
+@@ -253,17 +255,17 @@ int pseries_devicetree_update(s32 scope)
+ if (rc && rc != 1)
+ break;
+
+- data = (u32 *)rtas_buf + 4;
+- while (*data & NODE_ACTION_MASK) {
++ data = (__be32 *)rtas_buf + 4;
++ while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
+ int i;
+- u32 action = *data & NODE_ACTION_MASK;
+- int node_count = *data & NODE_COUNT_MASK;
++ u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
++ u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
+
+ data++;
+
+ for (i = 0; i < node_count; i++) {
+- u32 phandle = *data++;
+- u32 drc_index;
++ __be32 phandle = *data++;
++ __be32 drc_index;
+
+ switch (action) {
+ case DELETE_DT_NODE:
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index 930cad4..2b946bc 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -313,7 +313,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (pos == 0) {
+ memmove(blk + offset * map->cache_word_size,
+ blk, rbnode->blklen * map->cache_word_size);
+- bitmap_shift_right(present, present, offset, blklen);
++ bitmap_shift_left(present, present, offset, blklen);
+ }
+
+ /* update the rbnode block, its size and the base register */
+diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
+index 1a6205b..35b0161 100644
+--- a/drivers/clocksource/time-efm32.c
++++ b/drivers/clocksource/time-efm32.c
+@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
+ clock_event_ddata.base = base;
+ clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
+
+- setup_irq(irq, &efm32_clock_event_irq);
+-
+ clockevents_config_and_register(&clock_event_ddata.evtdev,
+ DIV_ROUND_CLOSEST(rate, 1024),
+ 0xf, 0xffff);
+
++ setup_irq(irq, &efm32_clock_event_irq);
++
+ return 0;
+
+ err_get_irq:
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index deebcd6..4f0f361 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -172,10 +172,6 @@ static void __init sun5i_timer_init(struct device_node *node)
+
+ ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+
+- ret = setup_irq(irq, &sun5i_timer_irq);
+- if (ret)
+- pr_warn("failed to setup irq %d\n", irq);
+-
+ /* Enable timer0 interrupt */
+ val = readl(timer_base + TIMER_IRQ_EN_REG);
+ writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+@@ -185,6 +181,10 @@ static void __init sun5i_timer_init(struct device_node *node)
+
+ clockevents_config_and_register(&sun5i_clockevent, rate,
+ TIMER_SYNC_TICKS, 0xffffffff);
++
++ ret = setup_irq(irq, &sun5i_timer_irq);
++ if (ret)
++ pr_warn("failed to setup irq %d\n", irq);
+ }
+ CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
+ sun5i_timer_init);
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 453822c..fe8b0c9 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -48,6 +48,8 @@ static bool dw_dma_of_filter(struct dma_chan *chan, void *param)
+ return true;
+ }
+
++#define DRV_NAME "dw_dmac"
++
+ static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
+ struct of_dma *ofdma)
+ {
+@@ -293,7 +295,7 @@ static struct platform_driver dw_driver = {
+ .remove = dw_remove,
+ .shutdown = dw_shutdown,
+ .driver = {
+- .name = "dw_dmac",
++ .name = DRV_NAME,
+ .pm = &dw_dev_pm_ops,
+ .of_match_table = of_match_ptr(dw_dma_of_id_table),
+ .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
+@@ -314,3 +316,4 @@ module_exit(dw_exit);
+
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
++MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index d2a8d64..080e767 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -291,9 +291,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ struct request_queue *q = bdev_get_queue(where->bdev);
+ unsigned short logical_block_size = queue_logical_block_size(q);
+ sector_t num_sectors;
++ unsigned int uninitialized_var(special_cmd_max_sectors);
+
+- /* Reject unsupported discard requests */
+- if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
++ /*
++ * Reject unsupported discard and write same requests.
++ */
++ if (rw & REQ_DISCARD)
++ special_cmd_max_sectors = q->limits.max_discard_sectors;
++ else if (rw & REQ_WRITE_SAME)
++ special_cmd_max_sectors = q->limits.max_write_same_sectors;
++ if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+ dec_count(io, region, -EOPNOTSUPP);
+ return;
+ }
+@@ -319,7 +326,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ store_io_and_region_in_bio(bio, io, region);
+
+ if (rw & REQ_DISCARD) {
+- num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ remaining -= num_sectors;
+ } else if (rw & REQ_WRITE_SAME) {
+@@ -328,7 +335,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ */
+ dp->get_page(dp, &page, &len, &offset);
+ bio_add_page(bio, page, logical_block_size, offset);
+- num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
++ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+
+ offset = 0;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 1582c3da..e400591 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2352,10 +2352,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ set_bit(DMF_FREEING, &md->flags);
+ spin_unlock(&_minor_lock);
+
++ /*
++ * Take suspend_lock so that presuspend and postsuspend methods
++ * do not race with internal suspend.
++ */
++ mutex_lock(&md->suspend_lock);
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
+ dm_table_postsuspend_targets(map);
+ }
++ mutex_unlock(&md->suspend_lock);
+
+ /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+ dm_put_live_table(md, srcu_idx);
+diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
+index 38917a8..2df3cbc 100644
+--- a/drivers/mfd/kempld-core.c
++++ b/drivers/mfd/kempld-core.c
+@@ -629,7 +629,7 @@ static int __init kempld_init(void)
+ if (force_device_id[0]) {
+ for (id = kempld_dmi_table; id->matches[0].slot != DMI_NONE; id++)
+ if (strstr(id->ident, force_device_id))
+- if (id->callback && id->callback(id))
++ if (id->callback && !id->callback(id))
+ break;
+ if (id->matches[0].slot == DMI_NONE)
+ return -ENODEV;
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index 9339ccc..ad0e71c 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1516,7 +1516,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ {
+ struct pcnet32_private *lp;
+ int i, media;
+- int fdx, mii, fset, dxsuflo;
++ int fdx, mii, fset, dxsuflo, sram;
+ int chip_version;
+ char *chipname;
+ struct net_device *dev;
+@@ -1553,7 +1553,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ }
+
+ /* initialize variables */
+- fdx = mii = fset = dxsuflo = 0;
++ fdx = mii = fset = dxsuflo = sram = 0;
+ chip_version = (chip_version >> 12) & 0xffff;
+
+ switch (chip_version) {
+@@ -1586,6 +1586,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C973"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2626:
+ chipname = "PCnet/Home 79C978"; /* PCI */
+@@ -1609,6 +1610,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C975"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2628:
+ chipname = "PCnet/PRO 79C976";
+@@ -1637,6 +1639,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ dxsuflo = 1;
+ }
+
++ /*
++ * The Am79C973/Am79C975 controllers come with 12K of SRAM
++ * which we can use for the Tx/Rx buffers but most importantly,
++ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
++ * Tx fifo underflows.
++ */
++ if (sram) {
++ /*
++ * The SRAM is being configured in two steps. First we
++ * set the SRAM size in the BCR25:SRAM_SIZE bits. According
++ * to the datasheet, each bit corresponds to a 512-byte
++ * page so we can have at most 24 pages. The SRAM_SIZE
++ * holds the value of the upper 8 bits of the 16-bit SRAM size.
++ * The low 8-bits start at 0x00 and end at 0xff. So the
++ * address range is from 0x0000 up to 0x17ff. Therefore,
++ * the SRAM_SIZE is set to 0x17. The next step is to set
++ * the BCR26:SRAM_BND midway through so the Tx and Rx
++ * buffers can share the SRAM equally.
++ */
++ a->write_bcr(ioaddr, 25, 0x17);
++ a->write_bcr(ioaddr, 26, 0xc);
++ /* And finally enable the NOUFLO bit */
++ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
++ }
++
+ dev = alloc_etherdev(sizeof(*lp));
+ if (!dev) {
+ ret = -ENOMEM;
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index a041746..4a3b8b7 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -594,7 +594,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
+
+ ret = iwl_mvm_mac_ctxt_add(mvm, vif);
+ if (ret)
+- goto out_remove_mac;
++ goto out_release;
+
+ iwl_mvm_power_disable(mvm, vif);
+
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index 48f20ff..bbff99d 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ struct device_node *p;
+ const __be32 *intspec, *tmp, *addr;
+ u32 intsize, intlen;
+- int i, res = -EINVAL;
++ int i, res;
+
+ pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
+
+@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+
+ /* Get size of interrupt specifier */
+ tmp = of_get_property(p, "#interrupt-cells", NULL);
+- if (tmp == NULL)
++ if (tmp == NULL) {
++ res = -EINVAL;
+ goto out;
++ }
+ intsize = be32_to_cpu(*tmp);
+
+ pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
+
+ /* Check index */
+- if ((index + 1) * intsize > intlen)
++ if ((index + 1) * intsize > intlen) {
++ res = -EINVAL;
+ goto out;
++ }
+
+ /* Copy intspec into irq structure */
+ intspec += index * intsize;
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index 34d56f7..86592dd 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -50,7 +50,9 @@ static void devm_phy_consume(struct device *dev, void *res)
+
+ static int devm_phy_match(struct device *dev, void *res, void *match_data)
+ {
+- return res == match_data;
++ struct phy **phy = res;
++
++ return *phy == match_data;
+ }
+
+ static struct phy *phy_lookup(struct device *device, const char *port)
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 9d81f76..1817f3f 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -1515,7 +1515,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
+ /*
+ * Finally register the new FC Nexus with TCM
+ */
+- __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
++ transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index fbf3b22..d6563ec 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -846,13 +846,14 @@ void spi_finalize_current_message(struct spi_master *master)
+ "failed to unprepare message: %d\n", ret);
+ }
+ }
++
++ trace_spi_message_done(mesg);
++
+ master->cur_msg_prepared = false;
+
+ mesg->state = NULL;
+ if (mesg->complete)
+ mesg->complete(mesg->context);
+-
+- trace_spi_message_done(mesg);
+ }
+ EXPORT_SYMBOL_GPL(spi_finalize_current_message);
+
+diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
+index edb1b27..dbd9d44 100644
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -936,6 +936,7 @@ bool RFbSetPower(
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ byPwr = pDevice->abyOFDMPwrTbl[uCH];
+ if (pDevice->byRFType == RF_UW2452) {
+diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
+index 1e8f64b..2dc48d4 100644
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -752,6 +752,7 @@ int RFbSetPower(struct vnt_private *priv, u32 rate, u32 channel)
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ case RATE_24M:
+ case RATE_36M:
+diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
+index e415af3..c67d379 100644
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -346,7 +346,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ ep = fc_seq_exch(seq);
+ if (ep) {
+ lport = ep->lp;
+- if (lport && (ep->xid <= lport->lro_xid))
++ if (lport && (ep->xid <= lport->lro_xid)) {
+ /*
+ * "ddp_done" trigger invalidation of HW
+ * specific DDP context
+@@ -361,6 +361,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ * identified using ep->xid)
+ */
+ cmd->was_ddp_setup = 0;
++ }
+ }
+ }
+ }
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index 6e560d5..754fdf8 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -131,13 +131,16 @@ skip:
+ hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ hfs_bnode_dump(node);
+
+- if (new_node) {
+- /* update parent key if we inserted a key
+- * at the start of the first node
+- */
+- if (!rec && new_node != node)
+- hfs_brec_update_parent(fd);
++ /*
++ * update parent key if we inserted a key
++ * at the start of the node and it is not the new node
++ */
++ if (!rec && new_node != node) {
++ hfs_bnode_read_key(node, fd->search_key, data_off + size);
++ hfs_brec_update_parent(fd);
++ }
+
++ if (new_node) {
+ hfs_bnode_put(fd->bnode);
+ if (!new_node->parent) {
+ hfs_btree_inc_height(tree);
+@@ -168,9 +171,6 @@ skip:
+ goto again;
+ }
+
+- if (!rec)
+- hfs_brec_update_parent(fd);
+-
+ return 0;
+ }
+
+@@ -370,6 +370,8 @@ again:
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
+ __hfs_brec_find(parent, fd, hfs_find_rec_by_key);
++ if (fd->record < 0)
++ return -ENOENT;
+ hfs_bnode_dump(parent);
+ rec = fd->record;
+
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 69cffb4..60146fe 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4232,6 +4232,13 @@ static void perf_pending_event(struct irq_work *entry)
+ {
+ struct perf_event *event = container_of(entry,
+ struct perf_event, pending);
++ int rctx;
++
++ rctx = perf_swevent_get_recursion_context();
++ /*
++ * If we 'fail' here, that's OK, it means recursion is already disabled
++ * and we won't recurse 'further'.
++ */
+
+ if (event->pending_disable) {
+ event->pending_disable = 0;
+@@ -4242,6 +4249,9 @@ static void perf_pending_event(struct irq_work *entry)
+ event->pending_wakeup = 0;
+ perf_event_wakeup(event);
+ }
++
++ if (rctx >= 0)
++ perf_swevent_put_recursion_context(rctx);
+ }
+
+ /*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index bf7a1bb..e278c64 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -57,13 +57,24 @@ struct ieee80211_local;
+ #define IEEE80211_UNSET_POWER_LEVEL INT_MIN
+
+ /*
+- * Some APs experience problems when working with U-APSD. Decrease the
+- * probability of that happening by using legacy mode for all ACs but VO.
+- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+- * setting, and always treats non-VO ACs as legacy.
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
+ */
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+
+ #define IEEE80211_DEFAULT_MAX_SP_LEN \
+ IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 815ca56..9abb445 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2107,6 +2107,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ hdr = (struct ieee80211_hdr *) skb->data;
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
++ if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++ return RX_DROP_MONITOR;
++
+ /* frame is in RMC, don't forward */
+ if (ieee80211_is_data(hdr->frame_control) &&
+ is_multicast_ether_addr(hdr->addr1) &&
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 18d73df..c260243 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4190,6 +4190,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
+ if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
+ return -EINVAL;
+
++ /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
++ * as userspace might just pass through the capabilities from the IEs
++ * directly, rather than enforcing this restriction and returning an
++ * error in this case.
++ */
++ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
++ params.ht_capa = NULL;
++ params.vht_capa = NULL;
++ }
++
+ /* When you run into this, adjust the code below for the new flag */
+ BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+
+diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
+index f78b27a..23454e9 100644
+--- a/sound/soc/codecs/adav80x.c
++++ b/sound/soc/codecs/adav80x.c
+@@ -319,7 +319,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+- unsigned int deemph = ucontrol->value.enumerated.item[0];
++ unsigned int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -335,7 +335,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = adav80x->deemph;
++ ucontrol->value.integer.value[0] = adav80x->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
+index 94cbe50..d718472 100644
+--- a/sound/soc/codecs/ak4641.c
++++ b/sound/soc/codecs/ak4641.c
+@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = ak4641->deemph;
++ ucontrol->value.integer.value[0] = ak4641->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index ce05fd9..a0ad41a 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -288,7 +288,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = cs4271->deemph;
++ ucontrol->value.integer.value[0] = cs4271->deemph;
+ return 0;
+ }
+
+@@ -298,7 +298,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- cs4271->deemph = ucontrol->value.enumerated.item[0];
++ cs4271->deemph = ucontrol->value.integer.value[0];
+ return cs4271_set_deemph(codec);
+ }
+
+diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
+index 73f9c36..651e2fe 100644
+--- a/sound/soc/codecs/pcm1681.c
++++ b/sound/soc/codecs/pcm1681.c
+@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = priv->deemph;
++ ucontrol->value.integer.value[0] = priv->deemph;
+
+ return 0;
+ }
+@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- priv->deemph = ucontrol->value.enumerated.item[0];
++ priv->deemph = ucontrol->value.integer.value[0];
+
+ return pcm1681_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index 715589f..e93c36f 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1198,13 +1198,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ /* Enable VDDC charge pump */
+ ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+ } else if (vddio >= 3100 && vdda >= 3100) {
+- /*
+- * if vddio and vddd > 3.1v,
+- * charge pump should be clean before set ana_pwr
+- */
+- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+- SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
+-
++ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+ /* VDDC use VDDIO rail */
+ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
+index a895a5e..c6c6500 100644
+--- a/sound/soc/codecs/tas5086.c
++++ b/sound/soc/codecs/tas5086.c
+@@ -275,7 +275,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = priv->deemph;
++ ucontrol->value.integer.value[0] = priv->deemph;
+
+ return 0;
+ }
+@@ -286,7 +286,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- priv->deemph = ucontrol->value.enumerated.item[0];
++ priv->deemph = ucontrol->value.integer.value[0];
+
+ return tas5086_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index 8ae5027..1a9f457 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->anc_active;
++ ucontrol->value.integer.value[0] = wm2000->anc_active;
+
+ return 0;
+ }
+@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int anc_active = ucontrol->value.enumerated.item[0];
++ int anc_active = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (anc_active > 1)
+@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
++ ucontrol->value.integer.value[0] = wm2000->spk_ena;
+
+ return 0;
+ }
+@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int val = ucontrol->value.enumerated.item[0];
++ int val = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (val > 1)
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index 0297203..e593722 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -122,7 +122,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8731->deemph;
++ ucontrol->value.integer.value[0] = wm8731->deemph;
+
+ return 0;
+ }
+@@ -132,7 +132,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index eebcb1d..ae7d76e 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8903->deemph;
++ ucontrol->value.integer.value[0] = wm8903->deemph;
+
+ return 0;
+ }
+@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 53bbfac..66cb9e9 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -523,7 +523,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8904->deemph;
++ ucontrol->value.integer.value[0] = wm8904->deemph;
+ return 0;
+ }
+
+@@ -532,7 +532,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 82c8ba9..1c1fc61 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8955->deemph;
++ ucontrol->value.integer.value[0] = wm8955->deemph;
+ return 0;
+ }
+
+@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index 942ef84..2a0bfb8 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -181,7 +181,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8960->deemph;
++ ucontrol->value.integer.value[0] = wm8960->deemph;
+ return 0;
+ }
+
+@@ -190,7 +190,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/jz4740/Makefile b/sound/soc/jz4740/Makefile
+index be873c1..d32c540 100644
+--- a/sound/soc/jz4740/Makefile
++++ b/sound/soc/jz4740/Makefile
+@@ -1,10 +1,8 @@
+ #
+ # Jz4740 Platform Support
+ #
+-snd-soc-jz4740-objs := jz4740-pcm.o
+ snd-soc-jz4740-i2s-objs := jz4740-i2s.o
+
+-obj-$(CONFIG_SND_JZ4740_SOC) += snd-soc-jz4740.o
+ obj-$(CONFIG_SND_JZ4740_SOC_I2S) += snd-soc-jz4740-i2s.o
+
+ # Jz4740 Machine Support
diff --git a/3.14.37/4420_grsecurity-3.1-3.14.37-201504051405.patch b/3.14.38/4420_grsecurity-3.1-3.14.38-201504142259.patch
similarity index 99%
rename from 3.14.37/4420_grsecurity-3.1-3.14.37-201504051405.patch
rename to 3.14.38/4420_grsecurity-3.1-3.14.38-201504142259.patch
index b383085..daa158d 100644
--- a/3.14.37/4420_grsecurity-3.1-3.14.37-201504051405.patch
+++ b/3.14.38/4420_grsecurity-3.1-3.14.38-201504142259.patch
@@ -295,7 +295,7 @@ index 5d91ba1..ef1d374 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index c24acc0..eab5b13 100644
+index f09e19d..bfca3b8 100644
--- a/Makefile
+++ b/Makefile
@@ -244,8 +244,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -8621,7 +8621,7 @@ index 063b65d..7a26e9d 100644
ld r4,_DAR(r1)
bl .bad_page_fault
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index 38d5073..f00af8d 100644
+index 5193116..1fed658 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1584,10 +1584,10 @@ handle_page_fault:
@@ -45247,7 +45247,7 @@ index e9d33ad..dae9880d 100644
pmd->bl_info.value_type.inc = data_block_inc;
pmd->bl_info.value_type.dec = data_block_dec;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 1582c3da..2a5ea0b 100644
+index e400591..a94ae6b 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -187,9 +187,9 @@ struct mapped_device {
@@ -45282,7 +45282,7 @@ index 1582c3da..2a5ea0b 100644
wake_up(&md->eventq);
}
-@@ -2740,18 +2740,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -2746,18 +2746,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
uint32_t dm_next_uevent_seq(struct mapped_device *md)
{
@@ -52001,10 +52001,10 @@ index eb81c98..e6716ae 100644
return blk_trace_startstop(sdp->device->request_queue, 1);
case BLKTRACESTOP:
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index fbf3b22..f5c8b60 100644
+index d6563ec..a1c5da2 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
-@@ -1980,7 +1980,7 @@ int spi_bus_unlock(struct spi_master *master)
+@@ -1981,7 +1981,7 @@ int spi_bus_unlock(struct spi_master *master)
EXPORT_SYMBOL_GPL(spi_bus_unlock);
/* portable code must never pass more than 32 bytes */
@@ -52817,6 +52817,19 @@ index 67ba48b..24e602f 100644
pDevice->apdev->netdev_ops = &apdev_netdev_ops;
pDevice->apdev->type = ARPHRD_IEEE80211;
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index e168a63..b61c555 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1165,7 +1165,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ * traditional iSCSI block I/O.
+ */
+ if (iscsit_allocate_iovecs(cmd) < 0) {
+- return iscsit_add_reject_cmd(cmd,
++ return iscsit_reject_cmd(cmd,
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+ immed_data = cmd->immediate_data;
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index 24884ca..26c8220 100644
--- a/drivers/target/sbp/sbp_target.c
@@ -86077,7 +86090,7 @@ index a964f72..b475afb 100644
}
diff --git a/include/linux/sched.h b/include/linux/sched.h
-index 218b058..7a1fb15 100644
+index 218b058..30088db 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -133,6 +133,7 @@ struct fs_struct;
@@ -86332,6 +86345,15 @@ index 218b058..7a1fb15 100644
{
return tsk->pid;
}
+@@ -1695,7 +1809,7 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+ }
+
+
+-static int pid_alive(const struct task_struct *p);
++static inline int pid_alive(const struct task_struct *p);
+ static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
+ {
+ pid_t pid = 0;
@@ -2015,6 +2129,25 @@ extern u64 sched_clock_cpu(int cpu);
extern void sched_clock_init(void);
@@ -90281,7 +90303,7 @@ index 449518e..2658dd6 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 69cffb4..54dc2d9 100644
+index 60146fe..2e89117 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -159,8 +159,15 @@ static struct srcu_struct pmus_srcu;
@@ -90353,7 +90375,7 @@ index 69cffb4..54dc2d9 100644
arch_perf_update_userpage(userpg, now);
-@@ -4381,7 +4388,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -4391,7 +4398,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
/* Data. */
sp = perf_user_stack_pointer(regs);
@@ -90362,7 +90384,7 @@ index 69cffb4..54dc2d9 100644
dyn_size = dump_size - rem;
perf_output_skip(handle, rem);
-@@ -4472,11 +4479,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4482,11 +4489,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -90376,7 +90398,7 @@ index 69cffb4..54dc2d9 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -6755,7 +6762,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -6765,7 +6772,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(task_active_pid_ns(current));
@@ -90385,7 +90407,7 @@ index 69cffb4..54dc2d9 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -7055,6 +7062,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -7065,6 +7072,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -90397,7 +90419,7 @@ index 69cffb4..54dc2d9 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -7393,10 +7405,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -7403,10 +7415,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -91320,7 +91342,7 @@ index 18ff0b9..40b0eab 100644
/* Don't allow clients that don't understand the native
diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 6b375af..c1c119c 100644
+index 6b375af..d5d59d4 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -75,7 +75,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -91459,9 +91481,9 @@ index 6b375af..c1c119c 100644
+ */
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
+ strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
-+ strncmp(sub_info->path, "/usr/libexec/", 13) &&
++ strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
+ strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
++ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
+ retval = -EPERM;
+ goto fail;
+ }
@@ -106300,7 +106322,7 @@ index 453e974..b3a43a5 100644
if (local->use_chanctx)
*chandef = local->monitor_chandef;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index bf7a1bb..1619d8e 100644
+index e278c64..f6d3f3d 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -28,6 +28,7 @@
@@ -106311,7 +106333,7 @@ index bf7a1bb..1619d8e 100644
#include "key.h"
#include "sta_info.h"
#include "debug.h"
-@@ -995,7 +996,7 @@ struct ieee80211_local {
+@@ -1006,7 +1007,7 @@ struct ieee80211_local {
/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
spinlock_t queue_stop_reason_lock;
@@ -107337,6 +107359,18 @@ index e5b65ac..f3b6fb7 100644
if (likely(*recent == gen))
return 0;
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 378c3a6..ba4382c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -193,6 +193,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ }
+
+ atomic_set(&conn->c_state, RDS_CONN_DOWN);
++ conn->c_send_gen = 0;
+ conn->c_reconnect_jiffies = 0;
+ INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker);
+ INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker);
diff --git a/net/rds/ib.h b/net/rds/ib.h
index 7280ab8..e04f4ea 100644
--- a/net/rds/ib.h
@@ -107470,10 +107504,18 @@ index 4e37c1c..40084d8 100644
rds_rdma_free_op(op);
else
diff --git a/net/rds/rds.h b/net/rds/rds.h
-index 48f8ffc..0ef3eec 100644
+index 48f8ffc..5c46cac 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
-@@ -449,7 +449,7 @@ struct rds_transport {
+@@ -110,6 +110,7 @@ struct rds_connection {
+ void *c_transport_data;
+
+ atomic_t c_state;
++ unsigned long c_send_gen;
+ unsigned long c_flags;
+ unsigned long c_reconnect_jiffies;
+ struct delayed_work c_send_w;
+@@ -449,7 +450,7 @@ struct rds_transport {
void (*sync_mr)(void *trans_private, int direction);
void (*free_mr)(void *trans_private, int invalidate);
void (*flush_mrs)(void);
@@ -107483,10 +107525,85 @@ index 48f8ffc..0ef3eec 100644
struct rds_sock {
struct sock rs_sk;
diff --git a/net/rds/send.c b/net/rds/send.c
-index a82fb66..1ea9251 100644
+index a82fb66..54c5c19 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
-@@ -593,8 +593,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
+@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn)
+ struct scatterlist *sg;
+ int ret = 0;
+ LIST_HEAD(to_be_dropped);
++ int batch_count;
++ unsigned long send_gen = 0;
+
+ restart:
++ batch_count = 0;
+
+ /*
+ * sendmsg calls here after having queued its message on the send
+@@ -157,6 +160,17 @@ restart:
+ }
+
+ /*
++ * we record the send generation after doing the xmit acquire.
++ * if someone else manages to jump in and do some work, we'll use
++ * this to avoid a goto restart farther down.
++ *
++ * The acquire_in_xmit() check above ensures that only one
++ * caller can increment c_send_gen at any time.
++ */
++ conn->c_send_gen++;
++ send_gen = conn->c_send_gen;
++
++ /*
+ * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+ * we do the opposite to avoid races.
+ */
+@@ -202,6 +216,16 @@ restart:
+ if (!rm) {
+ unsigned int len;
+
++ batch_count++;
++
++ /* we want to process as big a batch as we can, but
++ * we also want to avoid softlockups. If we've been
++ * through a lot of messages, lets back off and see
++ * if anyone else jumps in
++ */
++ if (batch_count >= 1024)
++ goto over_batch;
++
+ spin_lock_irqsave(&conn->c_lock, flags);
+
+ if (!list_empty(&conn->c_send_queue)) {
+@@ -357,9 +381,9 @@ restart:
+ }
+ }
+
++over_batch:
+ if (conn->c_trans->xmit_complete)
+ conn->c_trans->xmit_complete(conn);
+-
+ release_in_xmit(conn);
+
+ /* Nuke any messages we decided not to retransmit. */
+@@ -380,10 +404,15 @@ restart:
+ * If the transport cannot continue (i.e ret != 0), then it must
+ * call us when more room is available, such as from the tx
+ * completion handler.
++ *
++ * We have an extra generation check here so that if someone manages
++ * to jump in after our release_in_xmit, we'll see that they have done
++ * some work and we will skip our goto
+ */
+ if (ret == 0) {
+ smp_mb();
+- if (!list_empty(&conn->c_send_queue)) {
++ if (!list_empty(&conn->c_send_queue) &&
++ send_gen == conn->c_send_gen) {
+ rds_stats_inc(s_send_lock_queue_raced);
+ goto restart;
+ }
+@@ -593,8 +622,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
sock_put(rds_rs_to_sk(rs));
}
rs = rm->m_rs;
@@ -107499,7 +107616,7 @@ index a82fb66..1ea9251 100644
spin_lock(&rs->rs_lock);
if (test_and_clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags)) {
-@@ -638,9 +641,6 @@ unlock_and_drop:
+@@ -638,9 +670,6 @@ unlock_and_drop:
* queue. This means that in the TCP case, the message may not have been
* assigned the m_ack_seq yet - but that's fine as long as tcp_is_acked
* checks the RDS_MSG_HAS_ACK_SEQ bit.
@@ -107509,7 +107626,7 @@ index a82fb66..1ea9251 100644
*/
void rds_send_drop_acked(struct rds_connection *conn, u64 ack,
is_acked_func is_acked)
-@@ -711,6 +711,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
+@@ -711,6 +740,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
*/
if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
spin_unlock_irqrestore(&conn->c_lock, flags);
@@ -108774,7 +108891,7 @@ index 6424372..afd36e9 100644
sub->evt.event = htohl(event, sub->swap);
sub->evt.found_lower = htohl(found_lower, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 94404f1..5c1346e 100644
+index 94404f1..ac544a1 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -108855,12 +108972,33 @@ index 94404f1..5c1346e 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2373,8 +2399,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2371,10 +2397,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ seq_putc(seq, '@');
+ i++;
}
- for ( ; i < len; i++)
- seq_putc(seq, u->addr->name->sun_path[i]);
+- for ( ; i < len; i++)
+- seq_putc(seq, u->addr->name->sun_path[i]);
- }
- unix_state_unlock(s);
++ for ( ; i < len; i++) {
++ char c = u->addr->name->sun_path[i];
++ switch (c) {
++ case '\n':
++ seq_putc(seq, '\\');
++ seq_putc(seq, 'n');
++ break;
++ case '\t':
++ seq_putc(seq, '\\');
++ seq_putc(seq, 't');
++ break;
++ case '\\':
++ seq_putc(seq, '\\');
++ seq_putc(seq, '\\');
++ break;
++ default:
++ seq_putc(seq, c);
++ }
++ }
+ } else if (peer)
+ seq_printf(seq, " P%lu", sock_i_ino(peer));
+
@@ -109406,14 +109544,14 @@ index 078fe1d..fbdb363 100644
fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
new file mode 100644
-index 0000000..822fa9e
+index 0000000..eaa4fce
--- /dev/null
+++ b/scripts/gcc-plugin.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+srctree=$(dirname "$0")
+gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
+#include "gcc-common.h"
+#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
+#warning $2 CXX
@@ -111278,6 +111416,19 @@ index 9f05847..7933395 100644
rtnl_lock();
for_each_net(net)
rt_genid_bump_all(net);
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index d60c0ee..6c4cbd9 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ goto out;
+
+ /* No partial writes. */
+- length = EINVAL;
++ length = -EINVAL;
+ if (*ppos != 0)
+ goto out;
+
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 14f52be..7352368 100644
--- a/security/smack/smack_lsm.c
@@ -112451,10 +112602,10 @@ index 0000000..5452feea
+}
diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
new file mode 100644
-index 0000000..54461af
+index 0000000..d44bd9f
--- /dev/null
+++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,210 @@
+@@ -0,0 +1,215 @@
+/*
+ * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -112559,7 +112710,8 @@ index 0000000..54461af
+#if BUILDING_GCC_VERSION >= 4008
+ .optinfo_flags = OPTGROUP_NONE,
+#endif
-+#if BUILDING_GCC_VERSION >= 4009
++#if BUILDING_GCC_VERSION >= 5000
++#elif BUILDING_GCC_VERSION == 4009
+ .has_gate = false,
+ .has_execute = true,
+#else
@@ -112585,7 +112737,11 @@ index 0000000..54461af
+class colorize_rearm_pass : public simple_ipa_opt_pass {
+public:
+ colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
++#if BUILDING_GCC_VERSION >= 5000
++ virtual unsigned int execute(function *) { return execute_colorize_rearm(); }
++#else
+ unsigned int execute() { return execute_colorize_rearm(); }
++#endif
+};
+}
+
diff --git a/3.19.3/4425_grsec_remove_EI_PAX.patch b/3.14.38/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.19.3/4425_grsec_remove_EI_PAX.patch
rename to 3.14.38/4425_grsec_remove_EI_PAX.patch
diff --git a/3.14.37/4427_force_XATTR_PAX_tmpfs.patch b/3.14.38/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.14.37/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.14.38/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.19.3/4430_grsec-remove-localversion-grsec.patch b/3.14.38/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.19.3/4430_grsec-remove-localversion-grsec.patch
rename to 3.14.38/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.14.37/4435_grsec-mute-warnings.patch b/3.14.38/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.14.37/4435_grsec-mute-warnings.patch
rename to 3.14.38/4435_grsec-mute-warnings.patch
diff --git a/3.19.3/4440_grsec-remove-protected-paths.patch b/3.14.38/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.19.3/4440_grsec-remove-protected-paths.patch
rename to 3.14.38/4440_grsec-remove-protected-paths.patch
diff --git a/3.14.37/4450_grsec-kconfig-default-gids.patch b/3.14.38/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.14.37/4450_grsec-kconfig-default-gids.patch
rename to 3.14.38/4450_grsec-kconfig-default-gids.patch
diff --git a/3.14.37/4465_selinux-avc_audit-log-curr_ip.patch b/3.14.38/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.14.37/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.14.38/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.14.37/4470_disable-compat_vdso.patch b/3.14.38/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.14.37/4470_disable-compat_vdso.patch
rename to 3.14.38/4470_disable-compat_vdso.patch
diff --git a/3.19.3/4475_emutramp_default_on.patch b/3.14.38/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.19.3/4475_emutramp_default_on.patch
rename to 3.14.38/4475_emutramp_default_on.patch
diff --git a/3.19.3/1002_linux-3.19.3.patch b/3.19.3/1002_linux-3.19.3.patch
deleted file mode 100644
index a17587c..0000000
--- a/3.19.3/1002_linux-3.19.3.patch
+++ /dev/null
@@ -1,4081 +0,0 @@
-diff --git a/Makefile b/Makefile
-index e49665a..713bf26 100644
---- a/Makefile
-+++ b/Makefile
-@@ -1,6 +1,6 @@
- VERSION = 3
- PATCHLEVEL = 19
--SUBLEVEL = 2
-+SUBLEVEL = 3
- EXTRAVERSION =
- NAME = Diseased Newt
-
-diff --git a/arch/arm/boot/dts/am33xx-clocks.dtsi b/arch/arm/boot/dts/am33xx-clocks.dtsi
-index 712edce..071b56a 100644
---- a/arch/arm/boot/dts/am33xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/am33xx-clocks.dtsi
-@@ -99,7 +99,7 @@
- ehrpwm0_tbclk: ehrpwm0_tbclk@44e10664 {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <0>;
- reg = <0x0664>;
- };
-@@ -107,7 +107,7 @@
- ehrpwm1_tbclk: ehrpwm1_tbclk@44e10664 {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <1>;
- reg = <0x0664>;
- };
-@@ -115,7 +115,7 @@
- ehrpwm2_tbclk: ehrpwm2_tbclk@44e10664 {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <2>;
- reg = <0x0664>;
- };
-diff --git a/arch/arm/boot/dts/am43xx-clocks.dtsi b/arch/arm/boot/dts/am43xx-clocks.dtsi
-index c7dc9da..cfb4968 100644
---- a/arch/arm/boot/dts/am43xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/am43xx-clocks.dtsi
-@@ -107,7 +107,7 @@
- ehrpwm0_tbclk: ehrpwm0_tbclk {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <0>;
- reg = <0x0664>;
- };
-@@ -115,7 +115,7 @@
- ehrpwm1_tbclk: ehrpwm1_tbclk {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <1>;
- reg = <0x0664>;
- };
-@@ -123,7 +123,7 @@
- ehrpwm2_tbclk: ehrpwm2_tbclk {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <2>;
- reg = <0x0664>;
- };
-@@ -131,7 +131,7 @@
- ehrpwm3_tbclk: ehrpwm3_tbclk {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <4>;
- reg = <0x0664>;
- };
-@@ -139,7 +139,7 @@
- ehrpwm4_tbclk: ehrpwm4_tbclk {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <5>;
- reg = <0x0664>;
- };
-@@ -147,7 +147,7 @@
- ehrpwm5_tbclk: ehrpwm5_tbclk {
- #clock-cells = <0>;
- compatible = "ti,gate-clock";
-- clocks = <&dpll_per_m2_ck>;
-+ clocks = <&l4ls_gclk>;
- ti,bit-shift = <6>;
- reg = <0x0664>;
- };
-diff --git a/arch/arm/boot/dts/dra7xx-clocks.dtsi b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-index 4bdcbd6..99b09a4 100644
---- a/arch/arm/boot/dts/dra7xx-clocks.dtsi
-+++ b/arch/arm/boot/dts/dra7xx-clocks.dtsi
-@@ -243,10 +243,18 @@
- ti,invert-autoidle-bit;
- };
-
-+ dpll_core_byp_mux: dpll_core_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x012c>;
-+ };
-+
- dpll_core_ck: dpll_core_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-core-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_core_byp_mux>;
- reg = <0x0120>, <0x0124>, <0x012c>, <0x0128>;
- };
-
-@@ -309,10 +317,18 @@
- clock-div = <1>;
- };
-
-+ dpll_dsp_byp_mux: dpll_dsp_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x0240>;
-+ };
-+
- dpll_dsp_ck: dpll_dsp_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dsp_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_dsp_byp_mux>;
- reg = <0x0234>, <0x0238>, <0x0240>, <0x023c>;
- };
-
-@@ -335,10 +351,18 @@
- clock-div = <1>;
- };
-
-+ dpll_iva_byp_mux: dpll_iva_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x01ac>;
-+ };
-+
- dpll_iva_ck: dpll_iva_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&iva_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_iva_byp_mux>;
- reg = <0x01a0>, <0x01a4>, <0x01ac>, <0x01a8>;
- };
-
-@@ -361,10 +385,18 @@
- clock-div = <1>;
- };
-
-+ dpll_gpu_byp_mux: dpll_gpu_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x02e4>;
-+ };
-+
- dpll_gpu_ck: dpll_gpu_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_gpu_byp_mux>;
- reg = <0x02d8>, <0x02dc>, <0x02e4>, <0x02e0>;
- };
-
-@@ -398,10 +430,18 @@
- clock-div = <1>;
- };
-
-+ dpll_ddr_byp_mux: dpll_ddr_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x021c>;
-+ };
-+
- dpll_ddr_ck: dpll_ddr_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_ddr_byp_mux>;
- reg = <0x0210>, <0x0214>, <0x021c>, <0x0218>;
- };
-
-@@ -416,10 +456,18 @@
- ti,invert-autoidle-bit;
- };
-
-+ dpll_gmac_byp_mux: dpll_gmac_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ ti,bit-shift = <23>;
-+ reg = <0x02b4>;
-+ };
-+
- dpll_gmac_ck: dpll_gmac_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&dpll_abe_m3x2_ck>;
-+ clocks = <&sys_clkin1>, <&dpll_gmac_byp_mux>;
- reg = <0x02a8>, <0x02ac>, <0x02b4>, <0x02b0>;
- };
-
-@@ -482,10 +530,18 @@
- clock-div = <1>;
- };
-
-+ dpll_eve_byp_mux: dpll_eve_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x0290>;
-+ };
-+
- dpll_eve_ck: dpll_eve_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&eve_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_eve_byp_mux>;
- reg = <0x0284>, <0x0288>, <0x0290>, <0x028c>;
- };
-
-@@ -1249,10 +1305,18 @@
- clock-div = <1>;
- };
-
-+ dpll_per_byp_mux: dpll_per_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x014c>;
-+ };
-+
- dpll_per_ck: dpll_per_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-clock";
-- clocks = <&sys_clkin1>, <&per_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_per_byp_mux>;
- reg = <0x0140>, <0x0144>, <0x014c>, <0x0148>;
- };
-
-@@ -1275,10 +1339,18 @@
- clock-div = <1>;
- };
-
-+ dpll_usb_byp_mux: dpll_usb_byp_mux {
-+ #clock-cells = <0>;
-+ compatible = "ti,mux-clock";
-+ clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+ ti,bit-shift = <23>;
-+ reg = <0x018c>;
-+ };
-+
- dpll_usb_ck: dpll_usb_ck {
- #clock-cells = <0>;
- compatible = "ti,omap4-dpll-j-type-clock";
-- clocks = <&sys_clkin1>, <&usb_dpll_hs_clk_div>;
-+ clocks = <&sys_clkin1>, <&dpll_usb_byp_mux>;
- reg = <0x0180>, <0x0184>, <0x018c>, <0x0188>;
- };
-
-diff --git a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-index f1cd214..a626e6d 100644
---- a/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-+++ b/arch/arm/boot/dts/imx6qdl-sabresd.dtsi
-@@ -35,6 +35,7 @@
- regulator-max-microvolt = <5000000>;
- gpio = <&gpio3 22 0>;
- enable-active-high;
-+ vin-supply = <&swbst_reg>;
- };
-
- reg_usb_h1_vbus: regulator@1 {
-@@ -45,6 +46,7 @@
- regulator-max-microvolt = <5000000>;
- gpio = <&gpio1 29 0>;
- enable-active-high;
-+ vin-supply = <&swbst_reg>;
- };
-
- reg_audio: regulator@2 {
-diff --git a/arch/arm/boot/dts/imx6sl-evk.dts b/arch/arm/boot/dts/imx6sl-evk.dts
-index fda4932..945887d 100644
---- a/arch/arm/boot/dts/imx6sl-evk.dts
-+++ b/arch/arm/boot/dts/imx6sl-evk.dts
-@@ -52,6 +52,7 @@
- regulator-max-microvolt = <5000000>;
- gpio = <&gpio4 0 0>;
- enable-active-high;
-+ vin-supply = <&swbst_reg>;
- };
-
- reg_usb_otg2_vbus: regulator@1 {
-@@ -62,6 +63,7 @@
- regulator-max-microvolt = <5000000>;
- gpio = <&gpio4 2 0>;
- enable-active-high;
-+ vin-supply = <&swbst_reg>;
- };
-
- reg_aud3v: regulator@2 {
-diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
-index 71e5fc7..1d1800f 100644
---- a/arch/arm/crypto/aesbs-core.S_shipped
-+++ b/arch/arm/crypto/aesbs-core.S_shipped
-@@ -58,14 +58,18 @@
- # define VFP_ABI_FRAME 0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__ 7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
-
- #ifdef __thumb__
- # define adrl adr
- #endif
-
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch armv7-a
-+.fpu neon
-+
- .text
- .syntax unified @ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -74,8 +78,6 @@
- .code 32
- #endif
-
--.fpu neon
--
- .type _bsaes_decrypt8,%function
- .align 4
- _bsaes_decrypt8:
-@@ -2095,9 +2097,11 @@ bsaes_xts_decrypt:
- vld1.8 {q8}, [r0] @ initial tweak
- adr r2, .Lxts_magic
-
-+#ifndef XTS_CHAIN_TWEAK
- tst r9, #0xf @ if not multiple of 16
- it ne @ Thumb2 thing, sanity check in ARM
- subne r9, #0x10 @ subtract another 16 bytes
-+#endif
- subs r9, #0x80
-
- blo .Lxts_dec_short
-diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
-index be068db..a4d3856 100644
---- a/arch/arm/crypto/bsaes-armv7.pl
-+++ b/arch/arm/crypto/bsaes-armv7.pl
-@@ -701,14 +701,18 @@ $code.=<<___;
- # define VFP_ABI_FRAME 0
- # define BSAES_ASM_EXTENDED_KEY
- # define XTS_CHAIN_TWEAK
--# define __ARM_ARCH__ 7
-+# define __ARM_ARCH__ __LINUX_ARM_ARCH__
-+# define __ARM_MAX_ARCH__ 7
- #endif
-
- #ifdef __thumb__
- # define adrl adr
- #endif
-
--#if __ARM_ARCH__>=7
-+#if __ARM_MAX_ARCH__>=7
-+.arch armv7-a
-+.fpu neon
-+
- .text
- .syntax unified @ ARMv7-capable assembler is expected to handle this
- #ifdef __thumb2__
-@@ -717,8 +721,6 @@ $code.=<<___;
- .code 32
- #endif
-
--.fpu neon
--
- .type _bsaes_decrypt8,%function
- .align 4
- _bsaes_decrypt8:
-@@ -2076,9 +2078,11 @@ bsaes_xts_decrypt:
- vld1.8 {@XMM[8]}, [r0] @ initial tweak
- adr $magic, .Lxts_magic
-
-+#ifndef XTS_CHAIN_TWEAK
- tst $len, #0xf @ if not multiple of 16
- it ne @ Thumb2 thing, sanity check in ARM
- subne $len, #0x10 @ subtract another 16 bytes
-+#endif
- subs $len, #0x80
-
- blo .Lxts_dec_short
-diff --git a/arch/arm/mach-at91/pm.h b/arch/arm/mach-at91/pm.h
-index d2c8996..86c0aa8 100644
---- a/arch/arm/mach-at91/pm.h
-+++ b/arch/arm/mach-at91/pm.h
-@@ -44,7 +44,7 @@ static inline void at91rm9200_standby(void)
- " mcr p15, 0, %0, c7, c0, 4\n\t"
- " str %5, [%1, %2]"
- :
-- : "r" (0), "r" (AT91_BASE_SYS), "r" (AT91RM9200_SDRAMC_LPR),
-+ : "r" (0), "r" (at91_ramc_base[0]), "r" (AT91RM9200_SDRAMC_LPR),
- "r" (1), "r" (AT91RM9200_SDRAMC_SRR),
- "r" (lpr));
- }
-diff --git a/arch/arm/mach-exynos/platsmp.c b/arch/arm/mach-exynos/platsmp.c
-index 7a1ebfe..0abb7df 100644
---- a/arch/arm/mach-exynos/platsmp.c
-+++ b/arch/arm/mach-exynos/platsmp.c
-@@ -126,8 +126,7 @@ static inline void platform_do_lowpower(unsigned int cpu, int *spurious)
- */
- void exynos_cpu_power_down(int cpu)
- {
-- if (cpu == 0 && (of_machine_is_compatible("samsung,exynos5420") ||
-- of_machine_is_compatible("samsung,exynos5800"))) {
-+ if (cpu == 0 && (soc_is_exynos5420() || soc_is_exynos5800())) {
- /*
- * Bypass power down for CPU0 during suspend. Check for
- * the SYS_PWR_REG value to decide if we are suspending
-diff --git a/arch/arm64/include/asm/tlb.h b/arch/arm64/include/asm/tlb.h
-index c028fe3..53d9c35 100644
---- a/arch/arm64/include/asm/tlb.h
-+++ b/arch/arm64/include/asm/tlb.h
-@@ -48,6 +48,7 @@ static inline void tlb_flush(struct mmu_gather *tlb)
- static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
- unsigned long addr)
- {
-+ __flush_tlb_pgtable(tlb->mm, addr);
- pgtable_page_dtor(pte);
- tlb_remove_entry(tlb, pte);
- }
-@@ -56,6 +57,7 @@ static inline void __pte_free_tlb(struct mmu_gather *tlb, pgtable_t pte,
- static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
- unsigned long addr)
- {
-+ __flush_tlb_pgtable(tlb->mm, addr);
- tlb_remove_entry(tlb, virt_to_page(pmdp));
- }
- #endif
-@@ -64,6 +66,7 @@ static inline void __pmd_free_tlb(struct mmu_gather *tlb, pmd_t *pmdp,
- static inline void __pud_free_tlb(struct mmu_gather *tlb, pud_t *pudp,
- unsigned long addr)
- {
-+ __flush_tlb_pgtable(tlb->mm, addr);
- tlb_remove_entry(tlb, virt_to_page(pudp));
- }
- #endif
-diff --git a/arch/arm64/include/asm/tlbflush.h b/arch/arm64/include/asm/tlbflush.h
-index 73f0ce5..8b8d8cb 100644
---- a/arch/arm64/include/asm/tlbflush.h
-+++ b/arch/arm64/include/asm/tlbflush.h
-@@ -149,6 +149,19 @@ static inline void flush_tlb_kernel_range(unsigned long start, unsigned long end
- }
-
- /*
-+ * Used to invalidate the TLB (walk caches) corresponding to intermediate page
-+ * table levels (pgd/pud/pmd).
-+ */
-+static inline void __flush_tlb_pgtable(struct mm_struct *mm,
-+ unsigned long uaddr)
-+{
-+ unsigned long addr = uaddr >> 12 | ((unsigned long)ASID(mm) << 48);
-+
-+ dsb(ishst);
-+ asm("tlbi vae1is, %0" : : "r" (addr));
-+ dsb(ish);
-+}
-+/*
- * On AArch64, the cache coherency is handled via the set_pte_at() function.
- */
- static inline void update_mmu_cache(struct vm_area_struct *vma,
-diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
-index d920942..df34a70 100644
---- a/arch/arm64/mm/dma-mapping.c
-+++ b/arch/arm64/mm/dma-mapping.c
-@@ -51,7 +51,7 @@ static int __init early_coherent_pool(char *p)
- }
- early_param("coherent_pool", early_coherent_pool);
-
--static void *__alloc_from_pool(size_t size, struct page **ret_page)
-+static void *__alloc_from_pool(size_t size, struct page **ret_page, gfp_t flags)
- {
- unsigned long val;
- void *ptr = NULL;
-@@ -67,6 +67,8 @@ static void *__alloc_from_pool(size_t size, struct page **ret_page)
-
- *ret_page = phys_to_page(phys);
- ptr = (void *)val;
-+ if (flags & __GFP_ZERO)
-+ memset(ptr, 0, size);
- }
-
- return ptr;
-@@ -101,6 +103,7 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
- flags |= GFP_DMA;
- if (IS_ENABLED(CONFIG_DMA_CMA) && (flags & __GFP_WAIT)) {
- struct page *page;
-+ void *addr;
-
- size = PAGE_ALIGN(size);
- page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
-@@ -109,7 +112,10 @@ static void *__dma_alloc_coherent(struct device *dev, size_t size,
- return NULL;
-
- *dma_handle = phys_to_dma(dev, page_to_phys(page));
-- return page_address(page);
-+ addr = page_address(page);
-+ if (flags & __GFP_ZERO)
-+ memset(addr, 0, size);
-+ return addr;
- } else {
- return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
- }
-@@ -145,7 +151,7 @@ static void *__dma_alloc_noncoherent(struct device *dev, size_t size,
-
- if (!(flags & __GFP_WAIT)) {
- struct page *page = NULL;
-- void *addr = __alloc_from_pool(size, &page);
-+ void *addr = __alloc_from_pool(size, &page, flags);
-
- if (addr)
- *dma_handle = phys_to_dma(dev, page_to_phys(page));
-diff --git a/arch/powerpc/include/asm/iommu.h b/arch/powerpc/include/asm/iommu.h
-index 9cfa370..f1ea597 100644
---- a/arch/powerpc/include/asm/iommu.h
-+++ b/arch/powerpc/include/asm/iommu.h
-@@ -113,6 +113,7 @@ extern void iommu_register_group(struct iommu_table *tbl,
- int pci_domain_number, unsigned long pe_num);
- extern int iommu_add_device(struct device *dev);
- extern void iommu_del_device(struct device *dev);
-+extern int __init tce_iommu_bus_notifier_init(void);
- #else
- static inline void iommu_register_group(struct iommu_table *tbl,
- int pci_domain_number,
-@@ -128,6 +129,11 @@ static inline int iommu_add_device(struct device *dev)
- static inline void iommu_del_device(struct device *dev)
- {
- }
-+
-+static inline int __init tce_iommu_bus_notifier_init(void)
-+{
-+ return 0;
-+}
- #endif /* !CONFIG_IOMMU_API */
-
- static inline void set_iommu_table_base_and_group(struct device *dev,
-diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
-index 5d3968c..b054f33 100644
---- a/arch/powerpc/kernel/iommu.c
-+++ b/arch/powerpc/kernel/iommu.c
-@@ -1175,4 +1175,30 @@ void iommu_del_device(struct device *dev)
- }
- EXPORT_SYMBOL_GPL(iommu_del_device);
-
-+static int tce_iommu_bus_notifier(struct notifier_block *nb,
-+ unsigned long action, void *data)
-+{
-+ struct device *dev = data;
-+
-+ switch (action) {
-+ case BUS_NOTIFY_ADD_DEVICE:
-+ return iommu_add_device(dev);
-+ case BUS_NOTIFY_DEL_DEVICE:
-+ if (dev->iommu_group)
-+ iommu_del_device(dev);
-+ return 0;
-+ default:
-+ return 0;
-+ }
-+}
-+
-+static struct notifier_block tce_iommu_bus_nb = {
-+ .notifier_call = tce_iommu_bus_notifier,
-+};
-+
-+int __init tce_iommu_bus_notifier_init(void)
-+{
-+ bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
-+ return 0;
-+}
- #endif /* CONFIG_IOMMU_API */
-diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
-index 8b2d2dc..c68cc9d 100644
---- a/arch/powerpc/kernel/smp.c
-+++ b/arch/powerpc/kernel/smp.c
-@@ -555,8 +555,8 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
- if (smp_ops->give_timebase)
- smp_ops->give_timebase();
-
-- /* Wait until cpu puts itself in the online map */
-- while (!cpu_online(cpu))
-+ /* Wait until cpu puts itself in the online & active maps */
-+ while (!cpu_online(cpu) || !cpu_active(cpu))
- cpu_relax();
-
- return 0;
-diff --git a/arch/powerpc/platforms/powernv/pci.c b/arch/powerpc/platforms/powernv/pci.c
-index 4945e87..3948b8a 100644
---- a/arch/powerpc/platforms/powernv/pci.c
-+++ b/arch/powerpc/platforms/powernv/pci.c
-@@ -866,30 +866,4 @@ void __init pnv_pci_init(void)
- #endif
- }
-
--static int tce_iommu_bus_notifier(struct notifier_block *nb,
-- unsigned long action, void *data)
--{
-- struct device *dev = data;
--
-- switch (action) {
-- case BUS_NOTIFY_ADD_DEVICE:
-- return iommu_add_device(dev);
-- case BUS_NOTIFY_DEL_DEVICE:
-- if (dev->iommu_group)
-- iommu_del_device(dev);
-- return 0;
-- default:
-- return 0;
-- }
--}
--
--static struct notifier_block tce_iommu_bus_nb = {
-- .notifier_call = tce_iommu_bus_notifier,
--};
--
--static int __init tce_iommu_bus_notifier_init(void)
--{
-- bus_register_notifier(&pci_bus_type, &tce_iommu_bus_nb);
-- return 0;
--}
- machine_subsys_initcall_sync(powernv, tce_iommu_bus_notifier_init);
-diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c
-index 1d3d52d..7803a19 100644
---- a/arch/powerpc/platforms/pseries/iommu.c
-+++ b/arch/powerpc/platforms/pseries/iommu.c
-@@ -1340,3 +1340,5 @@ static int __init disable_multitce(char *str)
- }
-
- __setup("multitce=", disable_multitce);
-+
-+machine_subsys_initcall_sync(pseries, tce_iommu_bus_notifier_init);
-diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
-index 9af01dc..e3bab3a 100644
---- a/arch/s390/kvm/kvm-s390.c
-+++ b/arch/s390/kvm/kvm-s390.c
-@@ -159,7 +159,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
- case KVM_CAP_ONE_REG:
- case KVM_CAP_ENABLE_CAP:
- case KVM_CAP_S390_CSS_SUPPORT:
-- case KVM_CAP_IRQFD:
- case KVM_CAP_IOEVENTFD:
- case KVM_CAP_DEVICE_CTRL:
- case KVM_CAP_ENABLE_CAP_VM:
-diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
-index 62c5ea6..ec86d4f 100644
---- a/arch/s390/pci/pci_mmio.c
-+++ b/arch/s390/pci/pci_mmio.c
-@@ -64,8 +64,7 @@ SYSCALL_DEFINE3(s390_pci_mmio_write, unsigned long, mmio_addr,
- if (copy_from_user(buf, user_buffer, length))
- goto out;
-
-- memcpy_toio(io_addr, buf, length);
-- ret = 0;
-+ ret = zpci_memcpy_toio(io_addr, buf, length);
- out:
- if (buf != local_buf)
- kfree(buf);
-@@ -98,16 +97,16 @@ SYSCALL_DEFINE3(s390_pci_mmio_read, unsigned long, mmio_addr,
- goto out;
- io_addr = (void *)((pfn << PAGE_SHIFT) | (mmio_addr & ~PAGE_MASK));
-
-- ret = -EFAULT;
-- if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE)
-+ if ((unsigned long) io_addr < ZPCI_IOMAP_ADDR_BASE) {
-+ ret = -EFAULT;
- goto out;
--
-- memcpy_fromio(buf, io_addr, length);
--
-- if (copy_to_user(user_buffer, buf, length))
-+ }
-+ ret = zpci_memcpy_fromio(buf, io_addr, length);
-+ if (ret)
- goto out;
-+ if (copy_to_user(user_buffer, buf, length))
-+ ret = -EFAULT;
-
-- ret = 0;
- out:
- if (buf != local_buf)
- kfree(buf);
-diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c
-index 46a5e45..af53c25 100644
---- a/arch/sparc/kernel/perf_event.c
-+++ b/arch/sparc/kernel/perf_event.c
-@@ -960,6 +960,8 @@ out:
- cpuc->pcr[0] |= cpuc->event[0]->hw.config_base;
- }
-
-+static void sparc_pmu_start(struct perf_event *event, int flags);
-+
- /* On this PMU each PIC has it's own PCR control register. */
- static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- {
-@@ -972,20 +974,13 @@ static void calculate_multiple_pcrs(struct cpu_hw_events *cpuc)
- struct perf_event *cp = cpuc->event[i];
- struct hw_perf_event *hwc = &cp->hw;
- int idx = hwc->idx;
-- u64 enc;
-
- if (cpuc->current_idx[i] != PIC_NO_INDEX)
- continue;
-
-- sparc_perf_event_set_period(cp, hwc, idx);
- cpuc->current_idx[i] = idx;
-
-- enc = perf_event_get_enc(cpuc->events[i]);
-- cpuc->pcr[idx] &= ~mask_for_index(idx);
-- if (hwc->state & PERF_HES_STOPPED)
-- cpuc->pcr[idx] |= nop_for_index(idx);
-- else
-- cpuc->pcr[idx] |= event_encoding(enc, idx);
-+ sparc_pmu_start(cp, PERF_EF_RELOAD);
- }
- out:
- for (i = 0; i < cpuc->n_events; i++) {
-@@ -1101,7 +1096,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- int i;
-
- local_irq_save(flags);
-- perf_pmu_disable(event->pmu);
-
- for (i = 0; i < cpuc->n_events; i++) {
- if (event == cpuc->event[i]) {
-@@ -1127,7 +1121,6 @@ static void sparc_pmu_del(struct perf_event *event, int _flags)
- }
- }
-
-- perf_pmu_enable(event->pmu);
- local_irq_restore(flags);
- }
-
-@@ -1361,7 +1354,6 @@ static int sparc_pmu_add(struct perf_event *event, int ef_flags)
- unsigned long flags;
-
- local_irq_save(flags);
-- perf_pmu_disable(event->pmu);
-
- n0 = cpuc->n_events;
- if (n0 >= sparc_pmu->max_hw_events)
-@@ -1394,7 +1386,6 @@ nocheck:
-
- ret = 0;
- out:
-- perf_pmu_enable(event->pmu);
- local_irq_restore(flags);
- return ret;
- }
-diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
-index 0be7bf9..46a5964 100644
---- a/arch/sparc/kernel/process_64.c
-+++ b/arch/sparc/kernel/process_64.c
-@@ -287,6 +287,8 @@ void arch_trigger_all_cpu_backtrace(bool include_self)
- printk(" TPC[%lx] O7[%lx] I7[%lx] RPC[%lx]\n",
- gp->tpc, gp->o7, gp->i7, gp->rpc);
- }
-+
-+ touch_nmi_watchdog();
- }
-
- memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-@@ -362,6 +364,8 @@ static void pmu_snapshot_all_cpus(void)
- (cpu == this_cpu ? '*' : ' '), cpu,
- pp->pcr[0], pp->pcr[1], pp->pcr[2], pp->pcr[3],
- pp->pic[0], pp->pic[1], pp->pic[2], pp->pic[3]);
-+
-+ touch_nmi_watchdog();
- }
-
- memset(global_cpu_snapshot, 0, sizeof(global_cpu_snapshot));
-diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c
-index c85403d..30e7ddb 100644
---- a/arch/sparc/kernel/sys_sparc_64.c
-+++ b/arch/sparc/kernel/sys_sparc_64.c
-@@ -333,7 +333,7 @@ SYSCALL_DEFINE6(sparc_ipc, unsigned int, call, int, first, unsigned long, second
- long err;
-
- /* No need for backward compatibility. We can start fresh... */
-- if (call <= SEMCTL) {
-+ if (call <= SEMTIMEDOP) {
- switch (call) {
- case SEMOP:
- err = sys_semtimedop(first, ptr,
-diff --git a/arch/sparc/lib/memmove.S b/arch/sparc/lib/memmove.S
-index b7f6334..857ad4f 100644
---- a/arch/sparc/lib/memmove.S
-+++ b/arch/sparc/lib/memmove.S
-@@ -8,9 +8,11 @@
-
- .text
- ENTRY(memmove) /* o0=dst o1=src o2=len */
-- mov %o0, %g1
-+ brz,pn %o2, 99f
-+ mov %o0, %g1
-+
- cmp %o0, %o1
-- bleu,pt %xcc, memcpy
-+ bleu,pt %xcc, 2f
- add %o1, %o2, %g7
- cmp %g7, %o0
- bleu,pt %xcc, memcpy
-@@ -24,7 +26,34 @@ ENTRY(memmove) /* o0=dst o1=src o2=len */
- stb %g7, [%o0]
- bne,pt %icc, 1b
- sub %o0, 1, %o0
--
-+99:
- retl
- mov %g1, %o0
-+
-+ /* We can't just call memcpy for these memmove cases. On some
-+ * chips the memcpy uses cache initializing stores and when dst
-+ * and src are close enough, those can clobber the source data
-+ * before we've loaded it in.
-+ */
-+2: or %o0, %o1, %g7
-+ or %o2, %g7, %g7
-+ andcc %g7, 0x7, %g0
-+ bne,pn %xcc, 4f
-+ nop
-+
-+3: ldx [%o1], %g7
-+ add %o1, 8, %o1
-+ subcc %o2, 8, %o2
-+ add %o0, 8, %o0
-+ bne,pt %icc, 3b
-+ stx %g7, [%o0 - 0x8]
-+ ba,a,pt %xcc, 99b
-+
-+4: ldub [%o1], %g7
-+ add %o1, 1, %o1
-+ subcc %o2, 1, %o2
-+ add %o0, 1, %o0
-+ bne,pt %icc, 4b
-+ stb %g7, [%o0 - 0x1]
-+ ba,a,pt %xcc, 99b
- ENDPROC(memmove)
-diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
-index ae855f4..95ad7ad 100644
---- a/arch/x86/crypto/aesni-intel_glue.c
-+++ b/arch/x86/crypto/aesni-intel_glue.c
-@@ -1133,7 +1133,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
- if (!src)
- return -ENOMEM;
-- assoc = (src + req->cryptlen + auth_tag_len);
-+ assoc = (src + req->cryptlen);
- scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
- scatterwalk_map_and_copy(assoc, req->assoc, 0,
- req->assoclen, 0);
-@@ -1158,7 +1158,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
- scatterwalk_done(&src_sg_walk, 0, 0);
- scatterwalk_done(&assoc_sg_walk, 0, 0);
- } else {
-- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
-+ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
- kfree(src);
- }
- return retval;
-diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
-index e97622f..f895358 100644
---- a/arch/x86/include/asm/fpu-internal.h
-+++ b/arch/x86/include/asm/fpu-internal.h
-@@ -368,7 +368,7 @@ static inline void drop_fpu(struct task_struct *tsk)
- preempt_disable();
- tsk->thread.fpu_counter = 0;
- __drop_fpu(tsk);
-- clear_used_math();
-+ clear_stopped_child_used_math(tsk);
- preempt_enable();
- }
-
-diff --git a/arch/x86/kernel/apic/apic_numachip.c b/arch/x86/kernel/apic/apic_numachip.c
-index c2fd21f..017149c 100644
---- a/arch/x86/kernel/apic/apic_numachip.c
-+++ b/arch/x86/kernel/apic/apic_numachip.c
-@@ -37,10 +37,12 @@ static const struct apic apic_numachip;
- static unsigned int get_apic_id(unsigned long x)
- {
- unsigned long value;
-- unsigned int id;
-+ unsigned int id = (x >> 24) & 0xff;
-
-- rdmsrl(MSR_FAM10H_NODE_ID, value);
-- id = ((x >> 24) & 0xffU) | ((value << 2) & 0xff00U);
-+ if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
-+ rdmsrl(MSR_FAM10H_NODE_ID, value);
-+ id |= (value << 2) & 0xff00;
-+ }
-
- return id;
- }
-@@ -155,10 +157,18 @@ static int __init numachip_probe(void)
-
- static void fixup_cpu_id(struct cpuinfo_x86 *c, int node)
- {
-- if (c->phys_proc_id != node) {
-- c->phys_proc_id = node;
-- per_cpu(cpu_llc_id, smp_processor_id()) = node;
-+ u64 val;
-+ u32 nodes = 1;
-+
-+ this_cpu_write(cpu_llc_id, node);
-+
-+ /* Account for nodes per socket in multi-core-module processors */
-+ if (static_cpu_has_safe(X86_FEATURE_NODEID_MSR)) {
-+ rdmsrl(MSR_FAM10H_NODE_ID, val);
-+ nodes = ((val >> 3) & 7) + 1;
- }
-+
-+ c->phys_proc_id = node / nodes;
- }
-
- static int __init numachip_system_init(void)
-diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
-index 88900e2..89f4e64 100644
---- a/arch/x86/kernel/traps.c
-+++ b/arch/x86/kernel/traps.c
-@@ -300,7 +300,7 @@ dotraplinkage void do_bounds(struct pt_regs *regs, long error_code)
- goto exit;
- conditional_sti(regs);
-
-- if (!user_mode(regs))
-+ if (!user_mode_vm(regs))
- die("bounds", regs, error_code);
-
- if (!cpu_feature_enabled(X86_FEATURE_MPX)) {
-@@ -566,7 +566,7 @@ dotraplinkage void do_debug(struct pt_regs *regs, long error_code)
- * then it's very likely the result of an icebp/int01 trap.
- * User wants a sigtrap for that.
- */
-- if (!dr6 && user_mode(regs))
-+ if (!dr6 && user_mode_vm(regs))
- user_icebp = 1;
-
- /* Catch kmemcheck conditions first of all! */
-diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
-index 0de1fae..8be1e17 100644
---- a/arch/x86/kernel/xsave.c
-+++ b/arch/x86/kernel/xsave.c
-@@ -378,7 +378,7 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- * thread's fpu state, reconstruct fxstate from the fsave
- * header. Sanitize the copied state etc.
- */
-- struct xsave_struct *xsave = &tsk->thread.fpu.state->xsave;
-+ struct fpu *fpu = &tsk->thread.fpu;
- struct user_i387_ia32_struct env;
- int err = 0;
-
-@@ -392,14 +392,15 @@ int __restore_xstate_sig(void __user *buf, void __user *buf_fx, int size)
- */
- drop_fpu(tsk);
-
-- if (__copy_from_user(xsave, buf_fx, state_size) ||
-+ if (__copy_from_user(&fpu->state->xsave, buf_fx, state_size) ||
- __copy_from_user(&env, buf, sizeof(env))) {
-+ fpu_finit(fpu);
- err = -1;
- } else {
- sanitize_restored_xstate(tsk, &env, xstate_bv, fx_only);
-- set_used_math();
- }
-
-+ set_used_math();
- if (use_eager_fpu()) {
- preempt_disable();
- math_state_restore();
-diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index c259814..64d76c1 100644
---- a/arch/x86/kvm/x86.c
-+++ b/arch/x86/kvm/x86.c
-@@ -2716,7 +2716,6 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext)
- case KVM_CAP_USER_NMI:
- case KVM_CAP_REINJECT_CONTROL:
- case KVM_CAP_IRQ_INJECT_STATUS:
-- case KVM_CAP_IRQFD:
- case KVM_CAP_IOEVENTFD:
- case KVM_CAP_IOEVENTFD_NO_LENGTH:
- case KVM_CAP_PIT2:
-diff --git a/arch/x86/vdso/vdso32/sigreturn.S b/arch/x86/vdso/vdso32/sigreturn.S
-index 31776d0..d7ec4e2 100644
---- a/arch/x86/vdso/vdso32/sigreturn.S
-+++ b/arch/x86/vdso/vdso32/sigreturn.S
-@@ -17,6 +17,7 @@
- .text
- .globl __kernel_sigreturn
- .type __kernel_sigreturn,@function
-+ nop /* this guy is needed for .LSTARTFDEDLSI1 below (watch for HACK) */
- ALIGN
- __kernel_sigreturn:
- .LSTART_sigreturn:
-diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
-index 376a0a9..cc45a9f 100644
---- a/arch/x86/xen/p2m.c
-+++ b/arch/x86/xen/p2m.c
-@@ -567,7 +567,7 @@ static bool alloc_p2m(unsigned long pfn)
- if (p2m_pfn == PFN_DOWN(__pa(p2m_missing)))
- p2m_init(p2m);
- else
-- p2m_init_identity(p2m, pfn);
-+ p2m_init_identity(p2m, pfn & ~(P2M_PER_PAGE - 1));
-
- spin_lock_irqsave(&p2m_update_lock, flags);
-
-diff --git a/drivers/char/tpm/tpm_i2c_stm_st33.c b/drivers/char/tpm/tpm_i2c_stm_st33.c
-index 7d1c540..3f187a5 100644
---- a/drivers/char/tpm/tpm_i2c_stm_st33.c
-+++ b/drivers/char/tpm/tpm_i2c_stm_st33.c
-@@ -397,7 +397,7 @@ static int wait_for_stat(struct tpm_chip *chip, u8 mask, unsigned long timeout,
- */
- static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
- {
-- int size = 0, burstcnt, len;
-+ int size = 0, burstcnt, len, ret;
- struct i2c_client *client;
-
- client = (struct i2c_client *)TPM_VPRIV(chip);
-@@ -406,13 +406,15 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
- wait_for_stat(chip,
- TPM_STS_DATA_AVAIL | TPM_STS_VALID,
- chip->vendor.timeout_c,
-- &chip->vendor.read_queue)
-- == 0) {
-+ &chip->vendor.read_queue) == 0) {
- burstcnt = get_burstcount(chip);
- if (burstcnt < 0)
- return burstcnt;
- len = min_t(int, burstcnt, count - size);
-- I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
-+ ret = I2C_READ_DATA(client, TPM_DATA_FIFO, buf + size, len);
-+ if (ret < 0)
-+ return ret;
-+
- size += len;
- }
- return size;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
-index eff9d58..102463ba 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.c
-+++ b/drivers/char/tpm/tpm_ibmvtpm.c
-@@ -124,7 +124,7 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- {
- struct ibmvtpm_dev *ibmvtpm;
- struct ibmvtpm_crq crq;
-- u64 *word = (u64 *) &crq;
-+ __be64 *word = (__be64 *)&crq;
- int rc;
-
- ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
-@@ -145,11 +145,11 @@ static int tpm_ibmvtpm_send(struct tpm_chip *chip, u8 *buf, size_t count)
- memcpy((void *)ibmvtpm->rtce_buf, (void *)buf, count);
- crq.valid = (u8)IBMVTPM_VALID_CMD;
- crq.msg = (u8)VTPM_TPM_COMMAND;
-- crq.len = (u16)count;
-- crq.data = ibmvtpm->rtce_dma_handle;
-+ crq.len = cpu_to_be16(count);
-+ crq.data = cpu_to_be32(ibmvtpm->rtce_dma_handle);
-
-- rc = ibmvtpm_send_crq(ibmvtpm->vdev, cpu_to_be64(word[0]),
-- cpu_to_be64(word[1]));
-+ rc = ibmvtpm_send_crq(ibmvtpm->vdev, be64_to_cpu(word[0]),
-+ be64_to_cpu(word[1]));
- if (rc != H_SUCCESS) {
- dev_err(ibmvtpm->dev, "tpm_ibmvtpm_send failed rc=%d\n", rc);
- rc = 0;
-diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
-index bd82a79..b2c231b 100644
---- a/drivers/char/tpm/tpm_ibmvtpm.h
-+++ b/drivers/char/tpm/tpm_ibmvtpm.h
-@@ -22,9 +22,9 @@
- struct ibmvtpm_crq {
- u8 valid;
- u8 msg;
-- u16 len;
-- u32 data;
-- u64 reserved;
-+ __be16 len;
-+ __be32 data;
-+ __be64 reserved;
- } __attribute__((packed, aligned(8)));
-
- struct ibmvtpm_crq_queue {
-diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
-index de03df9..c3aac4c 100644
---- a/drivers/char/virtio_console.c
-+++ b/drivers/char/virtio_console.c
-@@ -142,6 +142,7 @@ struct ports_device {
- * notification
- */
- struct work_struct control_work;
-+ struct work_struct config_work;
-
- struct list_head ports;
-
-@@ -1837,10 +1838,21 @@ static void config_intr(struct virtio_device *vdev)
-
- portdev = vdev->priv;
-
-+ if (!use_multiport(portdev))
-+ schedule_work(&portdev->config_work);
-+}
-+
-+static void config_work_handler(struct work_struct *work)
-+{
-+ struct ports_device *portdev;
-+
-+ portdev = container_of(work, struct ports_device, control_work);
- if (!use_multiport(portdev)) {
-+ struct virtio_device *vdev;
- struct port *port;
- u16 rows, cols;
-
-+ vdev = portdev->vdev;
- virtio_cread(vdev, struct virtio_console_config, cols, &cols);
- virtio_cread(vdev, struct virtio_console_config, rows, &rows);
-
-@@ -2031,12 +2043,14 @@ static int virtcons_probe(struct virtio_device *vdev)
-
- virtio_device_ready(portdev->vdev);
-
-+ INIT_WORK(&portdev->config_work, &config_work_handler);
-+ INIT_WORK(&portdev->control_work, &control_work_handler);
-+
- if (multiport) {
- unsigned int nr_added_bufs;
-
- spin_lock_init(&portdev->c_ivq_lock);
- spin_lock_init(&portdev->c_ovq_lock);
-- INIT_WORK(&portdev->control_work, &control_work_handler);
-
- nr_added_bufs = fill_queue(portdev->c_ivq,
- &portdev->c_ivq_lock);
-@@ -2104,6 +2118,8 @@ static void virtcons_remove(struct virtio_device *vdev)
- /* Finish up work that's lined up */
- if (use_multiport(portdev))
- cancel_work_sync(&portdev->control_work);
-+ else
-+ cancel_work_sync(&portdev->config_work);
-
- list_for_each_entry_safe(port, port2, &portdev->ports, list)
- unplug_port(port);
-@@ -2155,6 +2171,7 @@ static int virtcons_freeze(struct virtio_device *vdev)
-
- virtqueue_disable_cb(portdev->c_ivq);
- cancel_work_sync(&portdev->control_work);
-+ cancel_work_sync(&portdev->config_work);
- /*
- * Once more: if control_work_handler() was running, it would
- * enable the cb as the last step.
-diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
-index 5213da4..29168fa 100644
---- a/drivers/gpu/drm/drm_crtc.c
-+++ b/drivers/gpu/drm/drm_crtc.c
-@@ -42,9 +42,10 @@
- #include "drm_crtc_internal.h"
- #include "drm_internal.h"
-
--static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-- struct drm_mode_fb_cmd2 *r,
-- struct drm_file *file_priv);
-+static struct drm_framebuffer *
-+internal_framebuffer_create(struct drm_device *dev,
-+ struct drm_mode_fb_cmd2 *r,
-+ struct drm_file *file_priv);
-
- /* Avoid boilerplate. I'm tired of typing. */
- #define DRM_ENUM_NAME_FN(fnname, list) \
-@@ -2817,13 +2818,11 @@ static int drm_mode_cursor_universal(struct drm_crtc *crtc,
- */
- if (req->flags & DRM_MODE_CURSOR_BO) {
- if (req->handle) {
-- fb = add_framebuffer_internal(dev, &fbreq, file_priv);
-+ fb = internal_framebuffer_create(dev, &fbreq, file_priv);
- if (IS_ERR(fb)) {
- DRM_DEBUG_KMS("failed to wrap cursor buffer in drm framebuffer\n");
- return PTR_ERR(fb);
- }
--
-- drm_framebuffer_reference(fb);
- } else {
- fb = NULL;
- }
-@@ -3175,9 +3174,10 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
- return 0;
- }
-
--static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
-- struct drm_mode_fb_cmd2 *r,
-- struct drm_file *file_priv)
-+static struct drm_framebuffer *
-+internal_framebuffer_create(struct drm_device *dev,
-+ struct drm_mode_fb_cmd2 *r,
-+ struct drm_file *file_priv)
- {
- struct drm_mode_config *config = &dev->mode_config;
- struct drm_framebuffer *fb;
-@@ -3209,12 +3209,6 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
- return fb;
- }
-
-- mutex_lock(&file_priv->fbs_lock);
-- r->fb_id = fb->base.id;
-- list_add(&fb->filp_head, &file_priv->fbs);
-- DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-- mutex_unlock(&file_priv->fbs_lock);
--
- return fb;
- }
-
-@@ -3236,15 +3230,24 @@ static struct drm_framebuffer *add_framebuffer_internal(struct drm_device *dev,
- int drm_mode_addfb2(struct drm_device *dev,
- void *data, struct drm_file *file_priv)
- {
-+ struct drm_mode_fb_cmd2 *r = data;
- struct drm_framebuffer *fb;
-
- if (!drm_core_check_feature(dev, DRIVER_MODESET))
- return -EINVAL;
-
-- fb = add_framebuffer_internal(dev, data, file_priv);
-+ fb = internal_framebuffer_create(dev, r, file_priv);
- if (IS_ERR(fb))
- return PTR_ERR(fb);
-
-+ /* Transfer ownership to the filp for reaping on close */
-+
-+ DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
-+ mutex_lock(&file_priv->fbs_lock);
-+ r->fb_id = fb->base.id;
-+ list_add(&fb->filp_head, &file_priv->fbs);
-+ mutex_unlock(&file_priv->fbs_lock);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
-index 7643300..4e6405e 100644
---- a/drivers/gpu/drm/i915/i915_drv.c
-+++ b/drivers/gpu/drm/i915/i915_drv.c
-@@ -622,7 +622,7 @@ static int i915_drm_suspend(struct drm_device *dev)
- return 0;
- }
-
--static int i915_drm_suspend_late(struct drm_device *drm_dev)
-+static int i915_drm_suspend_late(struct drm_device *drm_dev, bool hibernation)
- {
- struct drm_i915_private *dev_priv = drm_dev->dev_private;
- int ret;
-@@ -636,7 +636,17 @@ static int i915_drm_suspend_late(struct drm_device *drm_dev)
- }
-
- pci_disable_device(drm_dev->pdev);
-- pci_set_power_state(drm_dev->pdev, PCI_D3hot);
-+ /*
-+ * During hibernation on some GEN4 platforms the BIOS may try to access
-+ * the device even though it's already in D3 and hang the machine. So
-+ * leave the device in D0 on those platforms and hope the BIOS will
-+ * power down the device properly. Platforms where this was seen:
-+ * Lenovo Thinkpad X301, X61s
-+ */
-+ if (!(hibernation &&
-+ drm_dev->pdev->subsystem_vendor == PCI_VENDOR_ID_LENOVO &&
-+ INTEL_INFO(dev_priv)->gen == 4))
-+ pci_set_power_state(drm_dev->pdev, PCI_D3hot);
-
- return 0;
- }
-@@ -662,7 +672,7 @@ int i915_suspend_legacy(struct drm_device *dev, pm_message_t state)
- if (error)
- return error;
-
-- return i915_drm_suspend_late(dev);
-+ return i915_drm_suspend_late(dev, false);
- }
-
- static int i915_drm_resume(struct drm_device *dev)
-@@ -934,8 +944,7 @@ static int i915_pm_suspend(struct device *dev)
-
- static int i915_pm_suspend_late(struct device *dev)
- {
-- struct pci_dev *pdev = to_pci_dev(dev);
-- struct drm_device *drm_dev = pci_get_drvdata(pdev);
-+ struct drm_device *drm_dev = dev_to_i915(dev)->dev;
-
- /*
- * We have a suspedn ordering issue with the snd-hda driver also
-@@ -949,13 +958,22 @@ static int i915_pm_suspend_late(struct device *dev)
- if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
- return 0;
-
-- return i915_drm_suspend_late(drm_dev);
-+ return i915_drm_suspend_late(drm_dev, false);
-+}
-+
-+static int i915_pm_poweroff_late(struct device *dev)
-+{
-+ struct drm_device *drm_dev = dev_to_i915(dev)->dev;
-+
-+ if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
-+ return 0;
-+
-+ return i915_drm_suspend_late(drm_dev, true);
- }
-
- static int i915_pm_resume_early(struct device *dev)
- {
-- struct pci_dev *pdev = to_pci_dev(dev);
-- struct drm_device *drm_dev = pci_get_drvdata(pdev);
-+ struct drm_device *drm_dev = dev_to_i915(dev)->dev;
-
- if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
- return 0;
-@@ -965,8 +983,7 @@ static int i915_pm_resume_early(struct device *dev)
-
- static int i915_pm_resume(struct device *dev)
- {
-- struct pci_dev *pdev = to_pci_dev(dev);
-- struct drm_device *drm_dev = pci_get_drvdata(pdev);
-+ struct drm_device *drm_dev = dev_to_i915(dev)->dev;
-
- if (drm_dev->switch_power_state == DRM_SWITCH_POWER_OFF)
- return 0;
-@@ -1517,7 +1534,7 @@ static const struct dev_pm_ops i915_pm_ops = {
- .thaw_early = i915_pm_resume_early,
- .thaw = i915_pm_resume,
- .poweroff = i915_pm_suspend,
-- .poweroff_late = i915_pm_suspend_late,
-+ .poweroff_late = i915_pm_poweroff_late,
- .restore_early = i915_pm_resume_early,
- .restore = i915_pm_resume,
-
-diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
-index 0936b0f..ddd005c 100644
---- a/drivers/gpu/drm/i915/i915_drv.h
-+++ b/drivers/gpu/drm/i915/i915_drv.h
-@@ -1781,6 +1781,11 @@ static inline struct drm_i915_private *to_i915(const struct drm_device *dev)
- return dev->dev_private;
- }
-
-+static inline struct drm_i915_private *dev_to_i915(struct device *dev)
-+{
-+ return to_i915(dev_get_drvdata(dev));
-+}
-+
- /* Iterate over initialised rings */
- #define for_each_ring(ring__, dev_priv__, i__) \
- for ((i__) = 0; (i__) < I915_NUM_RINGS; (i__)++) \
-diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
-index 30d4eb3..c10b52e 100644
---- a/drivers/gpu/drm/i915/intel_display.c
-+++ b/drivers/gpu/drm/i915/intel_display.c
-@@ -9702,7 +9702,7 @@ void intel_check_page_flip(struct drm_device *dev, int pipe)
- struct drm_crtc *crtc = dev_priv->pipe_to_crtc_mapping[pipe];
- struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-
-- WARN_ON(!in_irq());
-+ WARN_ON(!in_interrupt());
-
- if (crtc == NULL)
- return;
-diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
-index ed644a4..86807ee 100644
---- a/drivers/gpu/drm/radeon/atombios_crtc.c
-+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
-@@ -1405,6 +1405,9 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
- (x << 16) | y);
- viewport_w = crtc->mode.hdisplay;
- viewport_h = (crtc->mode.vdisplay + 1) & ~1;
-+ if ((rdev->family >= CHIP_BONAIRE) &&
-+ (crtc->mode.flags & DRM_MODE_FLAG_INTERLACE))
-+ viewport_h *= 2;
- WREG32(EVERGREEN_VIEWPORT_SIZE + radeon_crtc->crtc_offset,
- (viewport_w << 16) | viewport_h);
-
-diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
-index de9a562..53b9ac3 100644
---- a/drivers/gpu/drm/radeon/cik.c
-+++ b/drivers/gpu/drm/radeon/cik.c
-@@ -7526,6 +7526,9 @@ int cik_irq_set(struct radeon_device *rdev)
- WREG32(DC_HPD5_INT_CONTROL, hpd5);
- WREG32(DC_HPD6_INT_CONTROL, hpd6);
-
-+ /* posting read */
-+ RREG32(SRBM_STATUS);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
-index 85995b4..c674f63 100644
---- a/drivers/gpu/drm/radeon/evergreen.c
-+++ b/drivers/gpu/drm/radeon/evergreen.c
-@@ -4589,6 +4589,9 @@ int evergreen_irq_set(struct radeon_device *rdev)
- WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC4_REGISTER_OFFSET, afmt5);
- WREG32(AFMT_AUDIO_PACKET_CONTROL + EVERGREEN_CRTC5_REGISTER_OFFSET, afmt6);
-
-+ /* posting read */
-+ RREG32(SRBM_STATUS);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
-index 279801c..04f2514 100644
---- a/drivers/gpu/drm/radeon/r100.c
-+++ b/drivers/gpu/drm/radeon/r100.c
-@@ -728,6 +728,10 @@ int r100_irq_set(struct radeon_device *rdev)
- tmp |= RADEON_FP2_DETECT_MASK;
- }
- WREG32(RADEON_GEN_INT_CNTL, tmp);
-+
-+ /* read back to post the write */
-+ RREG32(RADEON_GEN_INT_CNTL);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
-index ef5d606..0e2cf2a 100644
---- a/drivers/gpu/drm/radeon/r600.c
-+++ b/drivers/gpu/drm/radeon/r600.c
-@@ -3783,6 +3783,9 @@ int r600_irq_set(struct radeon_device *rdev)
- WREG32(RV770_CG_THERMAL_INT, thermal_int);
- }
-
-+ /* posting read */
-+ RREG32(R_000E50_SRBM_STATUS);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
-index c830863..26e7d28 100644
---- a/drivers/gpu/drm/radeon/radeon_cs.c
-+++ b/drivers/gpu/drm/radeon/radeon_cs.c
-@@ -256,11 +256,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
- u32 ring = RADEON_CS_RING_GFX;
- s32 priority = 0;
-
-+ INIT_LIST_HEAD(&p->validated);
-+
- if (!cs->num_chunks) {
- return 0;
- }
-+
- /* get chunks */
-- INIT_LIST_HEAD(&p->validated);
- p->idx = 0;
- p->ib.sa_bo = NULL;
- p->const_ib.sa_bo = NULL;
-diff --git a/drivers/gpu/drm/radeon/radeon_fence.c b/drivers/gpu/drm/radeon/radeon_fence.c
-index d13d1b5..df09ca7 100644
---- a/drivers/gpu/drm/radeon/radeon_fence.c
-+++ b/drivers/gpu/drm/radeon/radeon_fence.c
-@@ -1030,37 +1030,59 @@ static inline bool radeon_test_signaled(struct radeon_fence *fence)
- return test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags);
- }
-
-+struct radeon_wait_cb {
-+ struct fence_cb base;
-+ struct task_struct *task;
-+};
-+
-+static void
-+radeon_fence_wait_cb(struct fence *fence, struct fence_cb *cb)
-+{
-+ struct radeon_wait_cb *wait =
-+ container_of(cb, struct radeon_wait_cb, base);
-+
-+ wake_up_process(wait->task);
-+}
-+
- static signed long radeon_fence_default_wait(struct fence *f, bool intr,
- signed long t)
- {
- struct radeon_fence *fence = to_radeon_fence(f);
- struct radeon_device *rdev = fence->rdev;
-- bool signaled;
-+ struct radeon_wait_cb cb;
-
-- fence_enable_sw_signaling(&fence->base);
-+ cb.task = current;
-
-- /*
-- * This function has to return -EDEADLK, but cannot hold
-- * exclusive_lock during the wait because some callers
-- * may already hold it. This means checking needs_reset without
-- * lock, and not fiddling with any gpu internals.
-- *
-- * The callback installed with fence_enable_sw_signaling will
-- * run before our wait_event_*timeout call, so we will see
-- * both the signaled fence and the changes to needs_reset.
-- */
-+ if (fence_add_callback(f, &cb.base, radeon_fence_wait_cb))
-+ return t;
-+
-+ while (t > 0) {
-+ if (intr)
-+ set_current_state(TASK_INTERRUPTIBLE);
-+ else
-+ set_current_state(TASK_UNINTERRUPTIBLE);
-+
-+ /*
-+ * radeon_test_signaled must be called after
-+ * set_current_state to prevent a race with wake_up_process
-+ */
-+ if (radeon_test_signaled(fence))
-+ break;
-+
-+ if (rdev->needs_reset) {
-+ t = -EDEADLK;
-+ break;
-+ }
-+
-+ t = schedule_timeout(t);
-+
-+ if (t > 0 && intr && signal_pending(current))
-+ t = -ERESTARTSYS;
-+ }
-+
-+ __set_current_state(TASK_RUNNING);
-+ fence_remove_callback(f, &cb.base);
-
-- if (intr)
-- t = wait_event_interruptible_timeout(rdev->fence_queue,
-- ((signaled = radeon_test_signaled(fence)) ||
-- rdev->needs_reset), t);
-- else
-- t = wait_event_timeout(rdev->fence_queue,
-- ((signaled = radeon_test_signaled(fence)) ||
-- rdev->needs_reset), t);
--
-- if (t > 0 && !signaled)
-- return -EDEADLK;
- return t;
- }
-
-diff --git a/drivers/gpu/drm/radeon/radeon_kfd.c b/drivers/gpu/drm/radeon/radeon_kfd.c
-index bef9a09..2151cec 100644
---- a/drivers/gpu/drm/radeon/radeon_kfd.c
-+++ b/drivers/gpu/drm/radeon/radeon_kfd.c
-@@ -152,7 +152,7 @@ void radeon_kfd_device_init(struct radeon_device *rdev)
- .compute_vmid_bitmap = 0xFF00,
-
- .first_compute_pipe = 1,
-- .compute_pipe_count = 8 - 1,
-+ .compute_pipe_count = 4 - 1,
- };
-
- radeon_doorbell_get_kfd_info(rdev,
-diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
-index 040d284..24f7d30 100644
---- a/drivers/gpu/drm/radeon/radeon_object.c
-+++ b/drivers/gpu/drm/radeon/radeon_object.c
-@@ -173,17 +173,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
- else
- rbo->placements[i].lpfn = 0;
- }
--
-- /*
-- * Use two-ended allocation depending on the buffer size to
-- * improve fragmentation quality.
-- * 512kb was measured as the most optimal number.
-- */
-- if (rbo->tbo.mem.size > 512 * 1024) {
-- for (i = 0; i < c; i++) {
-- rbo->placements[i].flags |= TTM_PL_FLAG_TOPDOWN;
-- }
-- }
- }
-
- int radeon_bo_create(struct radeon_device *rdev,
-diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
-index 74bce91..0396606 100644
---- a/drivers/gpu/drm/radeon/rs600.c
-+++ b/drivers/gpu/drm/radeon/rs600.c
-@@ -693,6 +693,10 @@ int rs600_irq_set(struct radeon_device *rdev)
- WREG32(R_007D18_DC_HOT_PLUG_DETECT2_INT_CONTROL, hpd2);
- if (ASIC_IS_DCE2(rdev))
- WREG32(R_007408_HDMI0_AUDIO_PACKET_CONTROL, hdmi0);
-+
-+ /* posting read */
-+ RREG32(R_000040_GEN_INT_CNTL);
-+
- return 0;
- }
-
-diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
-index 5d89b87..eed21db 100644
---- a/drivers/gpu/drm/radeon/si.c
-+++ b/drivers/gpu/drm/radeon/si.c
-@@ -6198,6 +6198,9 @@ int si_irq_set(struct radeon_device *rdev)
-
- WREG32(CG_THERMAL_INT, thermal_int);
-
-+ /* posting read */
-+ RREG32(SRBM_STATUS);
-+
- return 0;
- }
-
-@@ -7118,8 +7121,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_BYPASS_EN_MASK, ~UPLL_BYPASS_EN_MASK);
-
- if (!vclk || !dclk) {
-- /* keep the Bypass mode, put PLL to sleep */
-- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+ /* keep the Bypass mode */
- return 0;
- }
-
-@@ -7135,8 +7137,7 @@ int si_set_uvd_clocks(struct radeon_device *rdev, u32 vclk, u32 dclk)
- /* set VCO_MODE to 1 */
- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_VCO_MODE_MASK, ~UPLL_VCO_MODE_MASK);
-
-- /* toggle UPLL_SLEEP to 1 then back to 0 */
-- WREG32_P(CG_UPLL_FUNC_CNTL, UPLL_SLEEP_MASK, ~UPLL_SLEEP_MASK);
-+ /* disable sleep mode */
- WREG32_P(CG_UPLL_FUNC_CNTL, 0, ~UPLL_SLEEP_MASK);
-
- /* deassert UPLL_RESET */
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-index 6c6b655..74a2e23 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
-@@ -725,32 +725,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- goto out_err1;
- }
-
-- ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-- (dev_priv->vram_size >> PAGE_SHIFT));
-- if (unlikely(ret != 0)) {
-- DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-- goto out_err2;
-- }
--
-- dev_priv->has_gmr = true;
-- if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-- refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-- VMW_PL_GMR) != 0) {
-- DRM_INFO("No GMR memory available. "
-- "Graphics memory resources are very limited.\n");
-- dev_priv->has_gmr = false;
-- }
--
-- if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-- dev_priv->has_mob = true;
-- if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-- VMW_PL_MOB) != 0) {
-- DRM_INFO("No MOB memory available. "
-- "3D will be disabled.\n");
-- dev_priv->has_mob = false;
-- }
-- }
--
- dev_priv->mmio_mtrr = arch_phys_wc_add(dev_priv->mmio_start,
- dev_priv->mmio_size);
-
-@@ -813,6 +787,33 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
- goto out_no_fman;
- }
-
-+
-+ ret = ttm_bo_init_mm(&dev_priv->bdev, TTM_PL_VRAM,
-+ (dev_priv->vram_size >> PAGE_SHIFT));
-+ if (unlikely(ret != 0)) {
-+ DRM_ERROR("Failed initializing memory manager for VRAM.\n");
-+ goto out_no_vram;
-+ }
-+
-+ dev_priv->has_gmr = true;
-+ if (((dev_priv->capabilities & (SVGA_CAP_GMR | SVGA_CAP_GMR2)) == 0) ||
-+ refuse_dma || ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_GMR,
-+ VMW_PL_GMR) != 0) {
-+ DRM_INFO("No GMR memory available. "
-+ "Graphics memory resources are very limited.\n");
-+ dev_priv->has_gmr = false;
-+ }
-+
-+ if (dev_priv->capabilities & SVGA_CAP_GBOBJECTS) {
-+ dev_priv->has_mob = true;
-+ if (ttm_bo_init_mm(&dev_priv->bdev, VMW_PL_MOB,
-+ VMW_PL_MOB) != 0) {
-+ DRM_INFO("No MOB memory available. "
-+ "3D will be disabled.\n");
-+ dev_priv->has_mob = false;
-+ }
-+ }
-+
- vmw_kms_save_vga(dev_priv);
-
- /* Start kms and overlay systems, needs fifo. */
-@@ -838,6 +839,12 @@ out_no_fifo:
- vmw_kms_close(dev_priv);
- out_no_kms:
- vmw_kms_restore_vga(dev_priv);
-+ if (dev_priv->has_mob)
-+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+ if (dev_priv->has_gmr)
-+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+out_no_vram:
- vmw_fence_manager_takedown(dev_priv->fman);
- out_no_fman:
- if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-@@ -853,12 +860,6 @@ out_err4:
- iounmap(dev_priv->mmio_virt);
- out_err3:
- arch_phys_wc_del(dev_priv->mmio_mtrr);
-- if (dev_priv->has_mob)
-- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-- if (dev_priv->has_gmr)
-- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
--out_err2:
- (void)ttm_bo_device_release(&dev_priv->bdev);
- out_err1:
- vmw_ttm_global_release(dev_priv);
-@@ -887,6 +888,13 @@ static int vmw_driver_unload(struct drm_device *dev)
- }
- vmw_kms_close(dev_priv);
- vmw_overlay_close(dev_priv);
-+
-+ if (dev_priv->has_mob)
-+ (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-+ if (dev_priv->has_gmr)
-+ (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-+ (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
-+
- vmw_fence_manager_takedown(dev_priv->fman);
- if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
- drm_irq_uninstall(dev_priv->dev);
-@@ -898,11 +906,6 @@ static int vmw_driver_unload(struct drm_device *dev)
- ttm_object_device_release(&dev_priv->tdev);
- iounmap(dev_priv->mmio_virt);
- arch_phys_wc_del(dev_priv->mmio_mtrr);
-- if (dev_priv->has_mob)
-- (void) ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_MOB);
-- if (dev_priv->has_gmr)
-- (void)ttm_bo_clean_mm(&dev_priv->bdev, VMW_PL_GMR);
-- (void)ttm_bo_clean_mm(&dev_priv->bdev, TTM_PL_VRAM);
- (void)ttm_bo_device_release(&dev_priv->bdev);
- vmw_ttm_global_release(dev_priv);
-
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-index 33176d0..1e11489 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
-@@ -2780,13 +2780,11 @@ int vmw_execbuf_ioctl(struct drm_device *dev, void *data,
- NULL, arg->command_size, arg->throttle_us,
- (void __user *)(unsigned long)arg->fence_rep,
- NULL);
--
-+ ttm_read_unlock(&dev_priv->reservation_sem);
- if (unlikely(ret != 0))
-- goto out_unlock;
-+ return ret;
-
- vmw_kms_cursor_post_execbuf(dev_priv);
-
--out_unlock:
-- ttm_read_unlock(&dev_priv->reservation_sem);
-- return ret;
-+ return 0;
- }
-diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-index 8725b79..07cda8c 100644
---- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
-@@ -2033,23 +2033,17 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
- int i;
- struct drm_mode_config *mode_config = &dev->mode_config;
-
-- ret = ttm_read_lock(&dev_priv->reservation_sem, true);
-- if (unlikely(ret != 0))
-- return ret;
--
- if (!arg->num_outputs) {
- struct drm_vmw_rect def_rect = {0, 0, 800, 600};
- vmw_du_update_layout(dev_priv, 1, &def_rect);
-- goto out_unlock;
-+ return 0;
- }
-
- rects_size = arg->num_outputs * sizeof(struct drm_vmw_rect);
- rects = kcalloc(arg->num_outputs, sizeof(struct drm_vmw_rect),
- GFP_KERNEL);
-- if (unlikely(!rects)) {
-- ret = -ENOMEM;
-- goto out_unlock;
-- }
-+ if (unlikely(!rects))
-+ return -ENOMEM;
-
- user_rects = (void __user *)(unsigned long)arg->rects;
- ret = copy_from_user(rects, user_rects, rects_size);
-@@ -2074,7 +2068,5 @@ int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
-
- out_free:
- kfree(rects);
--out_unlock:
-- ttm_read_unlock(&dev_priv->reservation_sem);
- return ret;
- }
-diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
-index e9eae57..6366333 100644
---- a/drivers/i2c/i2c-core.c
-+++ b/drivers/i2c/i2c-core.c
-@@ -679,9 +679,6 @@ static int i2c_device_remove(struct device *dev)
- status = driver->remove(client);
- }
-
-- if (dev->of_node)
-- irq_dispose_mapping(client->irq);
--
- dev_pm_domain_detach(&client->dev, true);
- return status;
- }
-diff --git a/drivers/irqchip/irq-armada-370-xp.c b/drivers/irqchip/irq-armada-370-xp.c
-index 463c235..4387dae 100644
---- a/drivers/irqchip/irq-armada-370-xp.c
-+++ b/drivers/irqchip/irq-armada-370-xp.c
-@@ -69,6 +69,7 @@ static void __iomem *per_cpu_int_base;
- static void __iomem *main_int_base;
- static struct irq_domain *armada_370_xp_mpic_domain;
- static u32 doorbell_mask_reg;
-+static int parent_irq;
- #ifdef CONFIG_PCI_MSI
- static struct irq_domain *armada_370_xp_msi_domain;
- static DECLARE_BITMAP(msi_used, PCI_MSI_DOORBELL_NR);
-@@ -356,6 +357,7 @@ static int armada_xp_mpic_secondary_init(struct notifier_block *nfb,
- {
- if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
- armada_xp_mpic_smp_cpu_init();
-+
- return NOTIFY_OK;
- }
-
-@@ -364,6 +366,20 @@ static struct notifier_block armada_370_xp_mpic_cpu_notifier = {
- .priority = 100,
- };
-
-+static int mpic_cascaded_secondary_init(struct notifier_block *nfb,
-+ unsigned long action, void *hcpu)
-+{
-+ if (action == CPU_STARTING || action == CPU_STARTING_FROZEN)
-+ enable_percpu_irq(parent_irq, IRQ_TYPE_NONE);
-+
-+ return NOTIFY_OK;
-+}
-+
-+static struct notifier_block mpic_cascaded_cpu_notifier = {
-+ .notifier_call = mpic_cascaded_secondary_init,
-+ .priority = 100,
-+};
-+
- #endif /* CONFIG_SMP */
-
- static struct irq_domain_ops armada_370_xp_mpic_irq_ops = {
-@@ -539,7 +555,7 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
- struct device_node *parent)
- {
- struct resource main_int_res, per_cpu_int_res;
-- int parent_irq, nr_irqs, i;
-+ int nr_irqs, i;
- u32 control;
-
- BUG_ON(of_address_to_resource(node, 0, &main_int_res));
-@@ -587,6 +603,9 @@ static int __init armada_370_xp_mpic_of_init(struct device_node *node,
- register_cpu_notifier(&armada_370_xp_mpic_cpu_notifier);
- #endif
- } else {
-+#ifdef CONFIG_SMP
-+ register_cpu_notifier(&mpic_cascaded_cpu_notifier);
-+#endif
- irq_set_chained_handler(parent_irq,
- armada_370_xp_mpic_handle_cascade_irq);
- }
-diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
-index 96b0b1d..bc67736 100644
---- a/drivers/mtd/nand/pxa3xx_nand.c
-+++ b/drivers/mtd/nand/pxa3xx_nand.c
-@@ -480,6 +480,42 @@ static void disable_int(struct pxa3xx_nand_info *info, uint32_t int_mask)
- nand_writel(info, NDCR, ndcr | int_mask);
- }
-
-+static void drain_fifo(struct pxa3xx_nand_info *info, void *data, int len)
-+{
-+ if (info->ecc_bch) {
-+ int timeout;
-+
-+ /*
-+ * According to the datasheet, when reading from NDDB
-+ * with BCH enabled, after each 32 bytes reads, we
-+ * have to make sure that the NDSR.RDDREQ bit is set.
-+ *
-+ * Drain the FIFO 8 32 bits reads at a time, and skip
-+ * the polling on the last read.
-+ */
-+ while (len > 8) {
-+ __raw_readsl(info->mmio_base + NDDB, data, 8);
-+
-+ for (timeout = 0;
-+ !(nand_readl(info, NDSR) & NDSR_RDDREQ);
-+ timeout++) {
-+ if (timeout >= 5) {
-+ dev_err(&info->pdev->dev,
-+ "Timeout on RDDREQ while draining the FIFO\n");
-+ return;
-+ }
-+
-+ mdelay(1);
-+ }
-+
-+ data += 32;
-+ len -= 8;
-+ }
-+ }
-+
-+ __raw_readsl(info->mmio_base + NDDB, data, len);
-+}
-+
- static void handle_data_pio(struct pxa3xx_nand_info *info)
- {
- unsigned int do_bytes = min(info->data_size, info->chunk_size);
-@@ -496,14 +532,14 @@ static void handle_data_pio(struct pxa3xx_nand_info *info)
- DIV_ROUND_UP(info->oob_size, 4));
- break;
- case STATE_PIO_READING:
-- __raw_readsl(info->mmio_base + NDDB,
-- info->data_buff + info->data_buff_pos,
-- DIV_ROUND_UP(do_bytes, 4));
-+ drain_fifo(info,
-+ info->data_buff + info->data_buff_pos,
-+ DIV_ROUND_UP(do_bytes, 4));
-
- if (info->oob_size > 0)
-- __raw_readsl(info->mmio_base + NDDB,
-- info->oob_buff + info->oob_buff_pos,
-- DIV_ROUND_UP(info->oob_size, 4));
-+ drain_fifo(info,
-+ info->oob_buff + info->oob_buff_pos,
-+ DIV_ROUND_UP(info->oob_size, 4));
- break;
- default:
- dev_err(&info->pdev->dev, "%s: invalid state %d\n", __func__,
-diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
-index 847c1f8..62ca0e8 100644
---- a/drivers/net/can/dev.c
-+++ b/drivers/net/can/dev.c
-@@ -578,6 +578,10 @@ struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
- skb->pkt_type = PACKET_BROADCAST;
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-+ skb_reset_mac_header(skb);
-+ skb_reset_network_header(skb);
-+ skb_reset_transport_header(skb);
-+
- can_skb_reserve(skb);
- can_skb_prv(skb)->ifindex = dev->ifindex;
-
-@@ -602,6 +606,10 @@ struct sk_buff *alloc_canfd_skb(struct net_device *dev,
- skb->pkt_type = PACKET_BROADCAST;
- skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-+ skb_reset_mac_header(skb);
-+ skb_reset_network_header(skb);
-+ skb_reset_transport_header(skb);
-+
- can_skb_reserve(skb);
- can_skb_prv(skb)->ifindex = dev->ifindex;
-
-diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
-index 7af379c..913a2bc 100644
---- a/drivers/net/can/usb/kvaser_usb.c
-+++ b/drivers/net/can/usb/kvaser_usb.c
-@@ -12,6 +12,7 @@
- * Copyright (C) 2012 Olivier Sobrie <olivier@sobrie.be>
- */
-
-+#include <linux/kernel.h>
- #include <linux/completion.h>
- #include <linux/module.h>
- #include <linux/netdevice.h>
-@@ -403,8 +404,15 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id,
- while (pos <= actual_len - MSG_HEADER_LEN) {
- tmp = buf + pos;
-
-- if (!tmp->len)
-- break;
-+ /* Handle messages crossing the USB endpoint max packet
-+ * size boundary. Check kvaser_usb_read_bulk_callback()
-+ * for further details.
-+ */
-+ if (tmp->len == 0) {
-+ pos = round_up(pos,
-+ dev->bulk_in->wMaxPacketSize);
-+ continue;
-+ }
-
- if (pos + tmp->len > actual_len) {
- dev_err(dev->udev->dev.parent,
-@@ -980,8 +988,19 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
- while (pos <= urb->actual_length - MSG_HEADER_LEN) {
- msg = urb->transfer_buffer + pos;
-
-- if (!msg->len)
-- break;
-+ /* The Kvaser firmware can only read and write messages that
-+ * does not cross the USB's endpoint wMaxPacketSize boundary.
-+ * If a follow-up command crosses such boundary, firmware puts
-+ * a placeholder zero-length command in its place then aligns
-+ * the real command to the next max packet size.
-+ *
-+ * Handle such cases or we're going to miss a significant
-+ * number of events in case of a heavy rx load on the bus.
-+ */
-+ if (msg->len == 0) {
-+ pos = round_up(pos, dev->bulk_in->wMaxPacketSize);
-+ continue;
-+ }
-
- if (pos + msg->len > urb->actual_length) {
- dev_err(dev->udev->dev.parent, "Format error\n");
-@@ -989,7 +1008,6 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb)
- }
-
- kvaser_usb_handle_message(dev, msg);
--
- pos += msg->len;
- }
-
-diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-index 72eef9f..ac6a0ef 100644
---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
-@@ -12722,6 +12722,9 @@ static int bnx2x_init_dev(struct bnx2x *bp, struct pci_dev *pdev,
- pci_write_config_dword(bp->pdev, PCICFG_GRC_ADDRESS,
- PCICFG_VENDOR_ID_OFFSET);
-
-+ /* Set PCIe reset type to fundamental for EEH recovery */
-+ pdev->needs_freset = 1;
-+
- /* AER (Advanced Error reporting) configuration */
- rc = pci_enable_pcie_error_reporting(pdev);
- if (!rc)
-diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
-index bba8777..fba3c98 100644
---- a/drivers/net/ethernet/freescale/fec_main.c
-+++ b/drivers/net/ethernet/freescale/fec_main.c
-@@ -1448,8 +1448,7 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
-
- vlan_packet_rcvd = true;
-
-- skb_copy_to_linear_data_offset(skb, VLAN_HLEN,
-- data, (2 * ETH_ALEN));
-+ memmove(skb->data + VLAN_HLEN, data, ETH_ALEN * 2);
- skb_pull(skb, VLAN_HLEN);
- }
-
-@@ -1566,7 +1565,7 @@ fec_enet_interrupt(int irq, void *dev_id)
- writel(int_events, fep->hwp + FEC_IEVENT);
- fec_enet_collect_events(fep, int_events);
-
-- if (fep->work_tx || fep->work_rx) {
-+ if ((fep->work_tx || fep->work_rx) && fep->link) {
- ret = IRQ_HANDLED;
-
- if (napi_schedule_prep(&fep->napi)) {
-diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
-index 944a112..8805ef1 100644
---- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
-+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
-@@ -451,7 +451,7 @@ struct mlx4_en_port_stats {
- unsigned long rx_chksum_none;
- unsigned long rx_chksum_complete;
- unsigned long tx_chksum_offload;
--#define NUM_PORT_STATS 9
-+#define NUM_PORT_STATS 10
- };
-
- struct mlx4_en_perf_stats {
-diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
-index 3eed708..fe48f4c 100644
---- a/drivers/net/usb/cx82310_eth.c
-+++ b/drivers/net/usb/cx82310_eth.c
-@@ -300,9 +300,18 @@ static const struct driver_info cx82310_info = {
- .tx_fixup = cx82310_tx_fixup,
- };
-
-+#define USB_DEVICE_CLASS(vend, prod, cl, sc, pr) \
-+ .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \
-+ USB_DEVICE_ID_MATCH_DEV_INFO, \
-+ .idVendor = (vend), \
-+ .idProduct = (prod), \
-+ .bDeviceClass = (cl), \
-+ .bDeviceSubClass = (sc), \
-+ .bDeviceProtocol = (pr)
-+
- static const struct usb_device_id products[] = {
- {
-- USB_DEVICE_AND_INTERFACE_INFO(0x0572, 0xcb01, 0xff, 0, 0),
-+ USB_DEVICE_CLASS(0x0572, 0xcb01, 0xff, 0, 0),
- .driver_info = (unsigned long) &cx82310_info
- },
- { },
-diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
-index 059fdf1..0ad6c0c 100644
---- a/drivers/net/virtio_net.c
-+++ b/drivers/net/virtio_net.c
-@@ -1444,8 +1444,10 @@ static void virtnet_free_queues(struct virtnet_info *vi)
- {
- int i;
-
-- for (i = 0; i < vi->max_queue_pairs; i++)
-+ for (i = 0; i < vi->max_queue_pairs; i++) {
-+ napi_hash_del(&vi->rq[i].napi);
- netif_napi_del(&vi->rq[i].napi);
-+ }
-
- kfree(vi->rq);
- kfree(vi->sq);
-@@ -1936,11 +1938,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
- cancel_delayed_work_sync(&vi->refill);
-
- if (netif_running(vi->dev)) {
-- for (i = 0; i < vi->max_queue_pairs; i++) {
-+ for (i = 0; i < vi->max_queue_pairs; i++)
- napi_disable(&vi->rq[i].napi);
-- napi_hash_del(&vi->rq[i].napi);
-- netif_napi_del(&vi->rq[i].napi);
-- }
- }
-
- remove_vq_common(vi);
-diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
-index 47731cb..2fa0dbb 100644
---- a/drivers/net/wireless/b43/main.c
-+++ b/drivers/net/wireless/b43/main.c
-@@ -5322,6 +5322,7 @@ static void b43_supported_bands(struct b43_wldev *dev, bool *have_2ghz_phy,
- case 0x432a: /* BCM4321 */
- case 0x432d: /* BCM4322 */
- case 0x4352: /* BCM43222 */
-+ case 0x435a: /* BCM43228 */
- case 0x4333: /* BCM4331 */
- case 0x43a2: /* BCM4360 */
- case 0x43b3: /* BCM4352 */
-diff --git a/drivers/of/base.c b/drivers/of/base.c
-index 36536b6..65a47f4 100644
---- a/drivers/of/base.c
-+++ b/drivers/of/base.c
-@@ -714,16 +714,12 @@ static struct device_node *__of_find_node_by_path(struct device_node *parent,
- const char *path)
- {
- struct device_node *child;
-- int len = strchrnul(path, '/') - path;
-- int term;
-+ int len;
-
-+ len = strcspn(path, "/:");
- if (!len)
- return NULL;
-
-- term = strchrnul(path, ':') - path;
-- if (term < len)
-- len = term;
--
- __for_each_child_of_node(parent, child) {
- const char *name = strrchr(child->full_name, '/');
- if (WARN(!name, "malformed device_node %s\n", child->full_name))
-@@ -768,8 +764,12 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
-
- /* The path could begin with an alias */
- if (*path != '/') {
-- char *p = strchrnul(path, '/');
-- int len = separator ? separator - path : p - path;
-+ int len;
-+ const char *p = separator;
-+
-+ if (!p)
-+ p = strchrnul(path, '/');
-+ len = p - path;
-
- /* of_aliases must not be NULL */
- if (!of_aliases)
-@@ -794,6 +794,8 @@ struct device_node *of_find_node_opts_by_path(const char *path, const char **opt
- path++; /* Increment past '/' delimiter */
- np = __of_find_node_by_path(np, path);
- path = strchrnul(path, '/');
-+ if (separator && separator < path)
-+ break;
- }
- raw_spin_unlock_irqrestore(&devtree_lock, flags);
- return np;
-diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
-index aa012fb..312f23a 100644
---- a/drivers/pci/pci-sysfs.c
-+++ b/drivers/pci/pci-sysfs.c
-@@ -521,7 +521,8 @@ static ssize_t driver_override_store(struct device *dev,
- struct pci_dev *pdev = to_pci_dev(dev);
- char *driver_override, *old = pdev->driver_override, *cp;
-
-- if (count > PATH_MAX)
-+ /* We need to keep extra room for a newline */
-+ if (count >= (PAGE_SIZE - 1))
- return -EINVAL;
-
- driver_override = kstrndup(buf, count, GFP_KERNEL);
-@@ -549,7 +550,7 @@ static ssize_t driver_override_show(struct device *dev,
- {
- struct pci_dev *pdev = to_pci_dev(dev);
-
-- return sprintf(buf, "%s\n", pdev->driver_override);
-+ return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override);
- }
- static DEVICE_ATTR_RW(driver_override);
-
-diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
-index 9c48fb3..a5761d0 100644
---- a/drivers/regulator/core.c
-+++ b/drivers/regulator/core.c
-@@ -1843,10 +1843,12 @@ static int _regulator_do_enable(struct regulator_dev *rdev)
- }
-
- if (rdev->ena_pin) {
-- ret = regulator_ena_gpio_ctrl(rdev, true);
-- if (ret < 0)
-- return ret;
-- rdev->ena_gpio_state = 1;
-+ if (!rdev->ena_gpio_state) {
-+ ret = regulator_ena_gpio_ctrl(rdev, true);
-+ if (ret < 0)
-+ return ret;
-+ rdev->ena_gpio_state = 1;
-+ }
- } else if (rdev->desc->ops->enable) {
- ret = rdev->desc->ops->enable(rdev);
- if (ret < 0)
-@@ -1943,10 +1945,12 @@ static int _regulator_do_disable(struct regulator_dev *rdev)
- trace_regulator_disable(rdev_get_name(rdev));
-
- if (rdev->ena_pin) {
-- ret = regulator_ena_gpio_ctrl(rdev, false);
-- if (ret < 0)
-- return ret;
-- rdev->ena_gpio_state = 0;
-+ if (rdev->ena_gpio_state) {
-+ ret = regulator_ena_gpio_ctrl(rdev, false);
-+ if (ret < 0)
-+ return ret;
-+ rdev->ena_gpio_state = 0;
-+ }
-
- } else if (rdev->desc->ops->disable) {
- ret = rdev->desc->ops->disable(rdev);
-@@ -3678,12 +3682,6 @@ regulator_register(const struct regulator_desc *regulator_desc,
- config->ena_gpio, ret);
- goto wash;
- }
--
-- if (config->ena_gpio_flags & GPIOF_OUT_INIT_HIGH)
-- rdev->ena_gpio_state = 1;
--
-- if (config->ena_gpio_invert)
-- rdev->ena_gpio_state = !rdev->ena_gpio_state;
- }
-
- /* set regulator constraints */
-@@ -3856,9 +3854,11 @@ int regulator_suspend_finish(void)
- list_for_each_entry(rdev, ®ulator_list, list) {
- mutex_lock(&rdev->mutex);
- if (rdev->use_count > 0 || rdev->constraints->always_on) {
-- error = _regulator_do_enable(rdev);
-- if (error)
-- ret = error;
-+ if (!_regulator_is_enabled(rdev)) {
-+ error = _regulator_do_enable(rdev);
-+ if (error)
-+ ret = error;
-+ }
- } else {
- if (!have_full_constraints())
- goto unlock;
-diff --git a/drivers/regulator/rk808-regulator.c b/drivers/regulator/rk808-regulator.c
-index c94a3e0..3f67228 100644
---- a/drivers/regulator/rk808-regulator.c
-+++ b/drivers/regulator/rk808-regulator.c
-@@ -235,6 +235,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(0),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG2",
-@@ -249,6 +250,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(1),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG3",
-@@ -263,6 +265,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_BUCK4_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(2),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG4",
-@@ -277,6 +280,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(3),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG5",
-@@ -291,6 +295,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(4),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG6",
-@@ -305,6 +310,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(5),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG7",
-@@ -319,6 +325,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(6),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "LDO_REG8",
-@@ -333,6 +340,7 @@ static const struct regulator_desc rk808_reg[] = {
- .vsel_mask = RK808_LDO_VSEL_MASK,
- .enable_reg = RK808_LDO_EN_REG,
- .enable_mask = BIT(7),
-+ .enable_time = 400,
- .owner = THIS_MODULE,
- }, {
- .name = "SWITCH_REG1",
-diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
-index 4241eea..f4cf685 100644
---- a/drivers/rtc/rtc-s3c.c
-+++ b/drivers/rtc/rtc-s3c.c
-@@ -849,6 +849,7 @@ static struct s3c_rtc_data const s3c2443_rtc_data = {
-
- static struct s3c_rtc_data const s3c6410_rtc_data = {
- .max_user_freq = 32768,
-+ .needs_src_clk = true,
- .irq_handler = s3c6410_rtc_irq,
- .set_freq = s3c6410_rtc_setfreq,
- .enable_tick = s3c6410_rtc_enable_tick,
-diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c
-index 62b58d3..60de662 100644
---- a/drivers/scsi/libsas/sas_discover.c
-+++ b/drivers/scsi/libsas/sas_discover.c
-@@ -500,6 +500,7 @@ static void sas_revalidate_domain(struct work_struct *work)
- struct sas_discovery_event *ev = to_sas_discovery_event(work);
- struct asd_sas_port *port = ev->port;
- struct sas_ha_struct *ha = port->ha;
-+ struct domain_device *ddev = port->port_dev;
-
- /* prevent revalidation from finding sata links in recovery */
- mutex_lock(&ha->disco_mutex);
-@@ -514,8 +515,9 @@ static void sas_revalidate_domain(struct work_struct *work)
- SAS_DPRINTK("REVALIDATING DOMAIN on port %d, pid:%d\n", port->id,
- task_pid_nr(current));
-
-- if (port->port_dev)
-- res = sas_ex_revalidate_domain(port->port_dev);
-+ if (ddev && (ddev->dev_type == SAS_FANOUT_EXPANDER_DEVICE ||
-+ ddev->dev_type == SAS_EDGE_EXPANDER_DEVICE))
-+ res = sas_ex_revalidate_domain(ddev);
-
- SAS_DPRINTK("done REVALIDATING DOMAIN on port %d, pid:%d, res 0x%x\n",
- port->id, task_pid_nr(current), res);
-diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
-index 23d8f5f5..df93c97 100644
---- a/drivers/spi/spi-atmel.c
-+++ b/drivers/spi/spi-atmel.c
-@@ -764,17 +764,17 @@ static void atmel_spi_pdc_next_xfer(struct spi_master *master,
- (unsigned long long)xfer->rx_dma);
- }
-
-- /* REVISIT: We're waiting for ENDRX before we start the next
-+ /* REVISIT: We're waiting for RXBUFF before we start the next
- * transfer because we need to handle some difficult timing
-- * issues otherwise. If we wait for ENDTX in one transfer and
-- * then starts waiting for ENDRX in the next, it's difficult
-- * to tell the difference between the ENDRX interrupt we're
-- * actually waiting for and the ENDRX interrupt of the
-+ * issues otherwise. If we wait for TXBUFE in one transfer and
-+ * then starts waiting for RXBUFF in the next, it's difficult
-+ * to tell the difference between the RXBUFF interrupt we're
-+ * actually waiting for and the RXBUFF interrupt of the
- * previous transfer.
- *
- * It should be doable, though. Just not now...
- */
-- spi_writel(as, IER, SPI_BIT(ENDRX) | SPI_BIT(OVRES));
-+ spi_writel(as, IER, SPI_BIT(RXBUFF) | SPI_BIT(OVRES));
- spi_writel(as, PTCR, SPI_BIT(TXTEN) | SPI_BIT(RXTEN));
- }
-
-diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
-index a67d37c..22ca08a 100644
---- a/drivers/spi/spi-dw-mid.c
-+++ b/drivers/spi/spi-dw-mid.c
-@@ -139,6 +139,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_tx(struct dw_spi *dws)
- 1,
- DMA_MEM_TO_DEV,
- DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-+ if (!txdesc)
-+ return NULL;
-+
- txdesc->callback = dw_spi_dma_tx_done;
- txdesc->callback_param = dws;
-
-@@ -184,6 +187,9 @@ static struct dma_async_tx_descriptor *dw_spi_dma_prepare_rx(struct dw_spi *dws)
- 1,
- DMA_DEV_TO_MEM,
- DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
-+ if (!rxdesc)
-+ return NULL;
-+
- rxdesc->callback = dw_spi_dma_rx_done;
- rxdesc->callback_param = dws;
-
-diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c
-index 89ca162..ee513a8 100644
---- a/drivers/spi/spi-pl022.c
-+++ b/drivers/spi/spi-pl022.c
-@@ -534,12 +534,12 @@ static void giveback(struct pl022 *pl022)
- pl022->cur_msg = NULL;
- pl022->cur_transfer = NULL;
- pl022->cur_chip = NULL;
-- spi_finalize_current_message(pl022->master);
-
- /* disable the SPI/SSP operation */
- writew((readw(SSP_CR1(pl022->virtbase)) &
- (~SSP_CR1_MASK_SSE)), SSP_CR1(pl022->virtbase));
-
-+ spi_finalize_current_message(pl022->master);
- }
-
- /**
-diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
-index aebde32..8d27db47 100644
---- a/drivers/target/iscsi/iscsi_target.c
-+++ b/drivers/target/iscsi/iscsi_target.c
-@@ -4221,11 +4221,17 @@ int iscsit_close_connection(
- pr_debug("Closing iSCSI connection CID %hu on SID:"
- " %u\n", conn->cid, sess->sid);
- /*
-- * Always up conn_logout_comp just in case the RX Thread is sleeping
-- * and the logout response never got sent because the connection
-- * failed.
-+ * Always up conn_logout_comp for the traditional TCP case just in case
-+ * the RX Thread in iscsi_target_rx_opcode() is sleeping and the logout
-+ * response never got sent because the connection failed.
-+ *
-+ * However for iser-target, isert_wait4logout() is using conn_logout_comp
-+ * to signal logout response TX interrupt completion. Go ahead and skip
-+ * this for iser since isert_rx_opcode() does not wait on logout failure,
-+ * and to avoid iscsi_conn pointer dereference in iser-target code.
- */
-- complete(&conn->conn_logout_comp);
-+ if (conn->conn_transport->transport_type == ISCSI_TCP)
-+ complete(&conn->conn_logout_comp);
-
- iscsi_release_thread_set(conn);
-
-diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
-index 58f49ff..54da2a4 100644
---- a/drivers/target/target_core_device.c
-+++ b/drivers/target/target_core_device.c
-@@ -1534,8 +1534,6 @@ int target_configure_device(struct se_device *dev)
- ret = dev->transport->configure_device(dev);
- if (ret)
- goto out;
-- dev->dev_flags |= DF_CONFIGURED;
--
- /*
- * XXX: there is not much point to have two different values here..
- */
-@@ -1597,6 +1595,8 @@ int target_configure_device(struct se_device *dev)
- list_add_tail(&dev->g_dev_node, &g_device_list);
- mutex_unlock(&g_device_mutex);
-
-+ dev->dev_flags |= DF_CONFIGURED;
-+
- return 0;
-
- out_free_alua:
-diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c
-index 1045dcd..f6c954c 100644
---- a/drivers/target/target_core_pscsi.c
-+++ b/drivers/target/target_core_pscsi.c
-@@ -1121,7 +1121,7 @@ static u32 pscsi_get_device_type(struct se_device *dev)
- struct pscsi_dev_virt *pdv = PSCSI_DEV(dev);
- struct scsi_device *sd = pdv->pdv_sd;
-
-- return sd->type;
-+ return (sd) ? sd->type : TYPE_NO_LUN;
- }
-
- static sector_t pscsi_get_blocks(struct se_device *dev)
-diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
-index 0adc0f6..ac3cbab 100644
---- a/drivers/target/target_core_transport.c
-+++ b/drivers/target/target_core_transport.c
-@@ -2389,6 +2389,10 @@ int target_get_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd,
- list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list);
- out:
- spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags);
-+
-+ if (ret && ack_kref)
-+ target_put_sess_cmd(se_sess, se_cmd);
-+
- return ret;
- }
- EXPORT_SYMBOL(target_get_sess_cmd);
-diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
-index 555de07..7d89da3 100644
---- a/drivers/tty/serial/8250/8250_dw.c
-+++ b/drivers/tty/serial/8250/8250_dw.c
-@@ -111,7 +111,10 @@ static void dw8250_serial_out(struct uart_port *p, int offset, int value)
- dw8250_force_idle(p);
- writeb(value, p->membase + (UART_LCR << p->regshift));
- }
-- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+ /*
-+ * FIXME: this deadlocks if port->lock is already held
-+ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+ */
- }
- }
-
-@@ -155,7 +158,10 @@ static void dw8250_serial_outq(struct uart_port *p, int offset, int value)
- __raw_writeq(value & 0xff,
- p->membase + (UART_LCR << p->regshift));
- }
-- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+ /*
-+ * FIXME: this deadlocks if port->lock is already held
-+ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+ */
- }
- }
- #endif /* CONFIG_64BIT */
-@@ -179,7 +185,10 @@ static void dw8250_serial_out32(struct uart_port *p, int offset, int value)
- dw8250_force_idle(p);
- writel(value, p->membase + (UART_LCR << p->regshift));
- }
-- dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+ /*
-+ * FIXME: this deadlocks if port->lock is already held
-+ * dev_err(p->dev, "Couldn't set LCR to %d\n", value);
-+ */
- }
- }
-
-diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
-index d1f8dc6..1442956 100644
---- a/drivers/tty/serial/8250/8250_pci.c
-+++ b/drivers/tty/serial/8250/8250_pci.c
-@@ -69,7 +69,7 @@ static void moan_device(const char *str, struct pci_dev *dev)
- "Please send the output of lspci -vv, this\n"
- "message (0x%04x,0x%04x,0x%04x,0x%04x), the\n"
- "manufacturer and name of serial board or\n"
-- "modem board to rmk+serial@arm.linux.org.uk.\n",
-+ "modem board to <linux-serial@vger.kernel.org>.\n",
- pci_name(dev), str, dev->vendor, dev->device,
- dev->subsystem_vendor, dev->subsystem_device);
- }
-diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
-index db49ec4..9fbbaa0 100644
---- a/drivers/usb/gadget/legacy/inode.c
-+++ b/drivers/usb/gadget/legacy/inode.c
-@@ -566,7 +566,6 @@ static ssize_t ep_copy_to_user(struct kiocb_priv *priv)
- if (total == 0)
- break;
- }
--
- return len;
- }
-
-@@ -585,6 +584,7 @@ static void ep_user_copy_worker(struct work_struct *work)
- aio_complete(iocb, ret, ret);
-
- kfree(priv->buf);
-+ kfree(priv->iv);
- kfree(priv);
- }
-
-@@ -605,6 +605,7 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req)
- */
- if (priv->iv == NULL || unlikely(req->actual == 0)) {
- kfree(req->buf);
-+ kfree(priv->iv);
- kfree(priv);
- iocb->private = NULL;
- /* aio_complete() reports bytes-transferred _and_ faults */
-@@ -640,7 +641,7 @@ ep_aio_rwtail(
- struct usb_request *req;
- ssize_t value;
-
-- priv = kmalloc(sizeof *priv, GFP_KERNEL);
-+ priv = kzalloc(sizeof *priv, GFP_KERNEL);
- if (!priv) {
- value = -ENOMEM;
- fail:
-@@ -649,7 +650,14 @@ fail:
- }
- iocb->private = priv;
- priv->iocb = iocb;
-- priv->iv = iv;
-+ if (iv) {
-+ priv->iv = kmemdup(iv, nr_segs * sizeof(struct iovec),
-+ GFP_KERNEL);
-+ if (!priv->iv) {
-+ kfree(priv);
-+ goto fail;
-+ }
-+ }
- priv->nr_segs = nr_segs;
- INIT_WORK(&priv->work, ep_user_copy_worker);
-
-@@ -689,6 +697,7 @@ fail:
- mutex_unlock(&epdata->lock);
-
- if (unlikely(value)) {
-+ kfree(priv->iv);
- kfree(priv);
- put_ep(epdata);
- } else
-diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
-index b4bca2d..70fba97 100644
---- a/drivers/xen/events/events_base.c
-+++ b/drivers/xen/events/events_base.c
-@@ -526,20 +526,26 @@ static unsigned int __startup_pirq(unsigned int irq)
- pirq_query_unmask(irq);
-
- rc = set_evtchn_to_irq(evtchn, irq);
-- if (rc != 0) {
-- pr_err("irq%d: Failed to set port to irq mapping (%d)\n",
-- irq, rc);
-- xen_evtchn_close(evtchn);
-- return 0;
-- }
-+ if (rc)
-+ goto err;
-+
- bind_evtchn_to_cpu(evtchn, 0);
- info->evtchn = evtchn;
-
-+ rc = xen_evtchn_port_setup(info);
-+ if (rc)
-+ goto err;
-+
- out:
- unmask_evtchn(evtchn);
- eoi_pirq(irq_get_irq_data(irq));
-
- return 0;
-+
-+err:
-+ pr_err("irq%d: Failed to set port to irq mapping (%d)\n", irq, rc);
-+ xen_evtchn_close(evtchn);
-+ return 0;
- }
-
- static unsigned int startup_pirq(struct irq_data *data)
-diff --git a/drivers/xen/xen-pciback/conf_space.c b/drivers/xen/xen-pciback/conf_space.c
-index 46ae0f9..75fe3d4 100644
---- a/drivers/xen/xen-pciback/conf_space.c
-+++ b/drivers/xen/xen-pciback/conf_space.c
-@@ -16,7 +16,7 @@
- #include "conf_space.h"
- #include "conf_space_quirks.h"
-
--static bool permissive;
-+bool permissive;
- module_param(permissive, bool, 0644);
-
- /* This is where xen_pcibk_read_config_byte, xen_pcibk_read_config_word,
-diff --git a/drivers/xen/xen-pciback/conf_space.h b/drivers/xen/xen-pciback/conf_space.h
-index e56c934..2e1d73d 100644
---- a/drivers/xen/xen-pciback/conf_space.h
-+++ b/drivers/xen/xen-pciback/conf_space.h
-@@ -64,6 +64,8 @@ struct config_field_entry {
- void *data;
- };
-
-+extern bool permissive;
-+
- #define OFFSET(cfg_entry) ((cfg_entry)->base_offset+(cfg_entry)->field->offset)
-
- /* Add fields to a device - the add_fields macro expects to get a pointer to
-diff --git a/drivers/xen/xen-pciback/conf_space_header.c b/drivers/xen/xen-pciback/conf_space_header.c
-index c5ee825..2d73693 100644
---- a/drivers/xen/xen-pciback/conf_space_header.c
-+++ b/drivers/xen/xen-pciback/conf_space_header.c
-@@ -11,6 +11,10 @@
- #include "pciback.h"
- #include "conf_space.h"
-
-+struct pci_cmd_info {
-+ u16 val;
-+};
-+
- struct pci_bar_info {
- u32 val;
- u32 len_val;
-@@ -20,22 +24,36 @@ struct pci_bar_info {
- #define is_enable_cmd(value) ((value)&(PCI_COMMAND_MEMORY|PCI_COMMAND_IO))
- #define is_master_cmd(value) ((value)&PCI_COMMAND_MASTER)
-
--static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+/* Bits guests are allowed to control in permissive mode. */
-+#define PCI_COMMAND_GUEST (PCI_COMMAND_MASTER|PCI_COMMAND_SPECIAL| \
-+ PCI_COMMAND_INVALIDATE|PCI_COMMAND_VGA_PALETTE| \
-+ PCI_COMMAND_WAIT|PCI_COMMAND_FAST_BACK)
-+
-+static void *command_init(struct pci_dev *dev, int offset)
- {
-- int i;
-- int ret;
--
-- ret = xen_pcibk_read_config_word(dev, offset, value, data);
-- if (!pci_is_enabled(dev))
-- return ret;
--
-- for (i = 0; i < PCI_ROM_RESOURCE; i++) {
-- if (dev->resource[i].flags & IORESOURCE_IO)
-- *value |= PCI_COMMAND_IO;
-- if (dev->resource[i].flags & IORESOURCE_MEM)
-- *value |= PCI_COMMAND_MEMORY;
-+ struct pci_cmd_info *cmd = kmalloc(sizeof(*cmd), GFP_KERNEL);
-+ int err;
-+
-+ if (!cmd)
-+ return ERR_PTR(-ENOMEM);
-+
-+ err = pci_read_config_word(dev, PCI_COMMAND, &cmd->val);
-+ if (err) {
-+ kfree(cmd);
-+ return ERR_PTR(err);
- }
-
-+ return cmd;
-+}
-+
-+static int command_read(struct pci_dev *dev, int offset, u16 *value, void *data)
-+{
-+ int ret = pci_read_config_word(dev, offset, value);
-+ const struct pci_cmd_info *cmd = data;
-+
-+ *value &= PCI_COMMAND_GUEST;
-+ *value |= cmd->val & ~PCI_COMMAND_GUEST;
-+
- return ret;
- }
-
-@@ -43,6 +61,8 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- {
- struct xen_pcibk_dev_data *dev_data;
- int err;
-+ u16 val;
-+ struct pci_cmd_info *cmd = data;
-
- dev_data = pci_get_drvdata(dev);
- if (!pci_is_enabled(dev) && is_enable_cmd(value)) {
-@@ -83,6 +103,19 @@ static int command_write(struct pci_dev *dev, int offset, u16 value, void *data)
- }
- }
-
-+ cmd->val = value;
-+
-+ if (!permissive && (!dev_data || !dev_data->permissive))
-+ return 0;
-+
-+ /* Only allow the guest to control certain bits. */
-+ err = pci_read_config_word(dev, offset, &val);
-+ if (err || val == value)
-+ return err;
-+
-+ value &= PCI_COMMAND_GUEST;
-+ value |= val & ~PCI_COMMAND_GUEST;
-+
- return pci_write_config_word(dev, offset, value);
- }
-
-@@ -282,6 +315,8 @@ static const struct config_field header_common[] = {
- {
- .offset = PCI_COMMAND,
- .size = 2,
-+ .init = command_init,
-+ .release = bar_release,
- .u.w.read = command_read,
- .u.w.write = command_write,
- },
-diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
-index ed19a7d..71c4619 100644
---- a/fs/fuse/dev.c
-+++ b/fs/fuse/dev.c
-@@ -890,8 +890,8 @@ static int fuse_try_move_page(struct fuse_copy_state *cs, struct page **pagep)
-
- newpage = buf->page;
-
-- if (WARN_ON(!PageUptodate(newpage)))
-- return -EIO;
-+ if (!PageUptodate(newpage))
-+ SetPageUptodate(newpage);
-
- ClearPageMappedToDisk(newpage);
-
-@@ -1797,6 +1797,9 @@ copy_finish:
- static int fuse_notify(struct fuse_conn *fc, enum fuse_notify_code code,
- unsigned int size, struct fuse_copy_state *cs)
- {
-+ /* Don't try to move pages (yet) */
-+ cs->move_pages = 0;
-+
- switch (code) {
- case FUSE_NOTIFY_POLL:
- return fuse_notify_poll(fc, size, cs);
-diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
-index 469086b..0c3f303 100644
---- a/fs/nilfs2/segment.c
-+++ b/fs/nilfs2/segment.c
-@@ -1907,6 +1907,7 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- struct the_nilfs *nilfs)
- {
- struct nilfs_inode_info *ii, *n;
-+ int during_mount = !(sci->sc_super->s_flags & MS_ACTIVE);
- int defer_iput = false;
-
- spin_lock(&nilfs->ns_inode_lock);
-@@ -1919,10 +1920,10 @@ static void nilfs_segctor_drop_written_files(struct nilfs_sc_info *sci,
- brelse(ii->i_bh);
- ii->i_bh = NULL;
- list_del_init(&ii->i_dirty);
-- if (!ii->vfs_inode.i_nlink) {
-+ if (!ii->vfs_inode.i_nlink || during_mount) {
- /*
-- * Defer calling iput() to avoid a deadlock
-- * over I_SYNC flag for inodes with i_nlink == 0
-+ * Defer calling iput() to avoid deadlocks if
-+ * i_nlink == 0 or mount is not yet finished.
- */
- list_add_tail(&ii->i_dirty, &sci->sc_iput_queue);
- defer_iput = true;
-diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
-index 88f9b83..f86e549 100644
---- a/fs/proc/task_mmu.c
-+++ b/fs/proc/task_mmu.c
-@@ -1326,6 +1326,9 @@ out:
-
- static int pagemap_open(struct inode *inode, struct file *file)
- {
-+ /* do not disclose physical addresses: attack vector */
-+ if (!capable(CAP_SYS_ADMIN))
-+ return -EPERM;
- pr_warn_once("Bits 55-60 of /proc/PID/pagemap entries are about "
- "to stop being page-shift some time soon. See the "
- "linux/Documentation/vm/pagemap.txt for details.\n");
-diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
-index 057038c..b405a62 100644
---- a/include/linux/serial_core.h
-+++ b/include/linux/serial_core.h
-@@ -146,9 +146,9 @@ struct uart_port {
- #define UPIO_HUB6 (1) /* Hub6 ISA card */
- #define UPIO_MEM (2) /* 8b MMIO access */
- #define UPIO_MEM32 (3) /* 32b little endian */
--#define UPIO_MEM32BE (4) /* 32b big endian */
--#define UPIO_AU (5) /* Au1x00 and RT288x type IO */
--#define UPIO_TSI (6) /* Tsi108/109 type IO */
-+#define UPIO_AU (4) /* Au1x00 and RT288x type IO */
-+#define UPIO_TSI (5) /* Tsi108/109 type IO */
-+#define UPIO_MEM32BE (6) /* 32b big endian */
-
- unsigned int read_status_mask; /* driver specific */
- unsigned int ignore_status_mask; /* driver specific */
-diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h
-index b996e6cd..9eb54f4 100644
---- a/include/linux/workqueue.h
-+++ b/include/linux/workqueue.h
-@@ -70,7 +70,8 @@ enum {
- /* data contains off-queue information when !WORK_STRUCT_PWQ */
- WORK_OFFQ_FLAG_BASE = WORK_STRUCT_COLOR_SHIFT,
-
-- WORK_OFFQ_CANCELING = (1 << WORK_OFFQ_FLAG_BASE),
-+ __WORK_OFFQ_CANCELING = WORK_OFFQ_FLAG_BASE,
-+ WORK_OFFQ_CANCELING = (1 << __WORK_OFFQ_CANCELING),
-
- /*
- * When a work item is off queue, its high bits point to the last
-diff --git a/kernel/cpuset.c b/kernel/cpuset.c
-index 64b257f..9e25599 100644
---- a/kernel/cpuset.c
-+++ b/kernel/cpuset.c
-@@ -548,9 +548,6 @@ static void update_domain_attr_tree(struct sched_domain_attr *dattr,
-
- rcu_read_lock();
- cpuset_for_each_descendant_pre(cp, pos_css, root_cs) {
-- if (cp == root_cs)
-- continue;
--
- /* skip the whole subtree if @cp doesn't have any CPU */
- if (cpumask_empty(cp->cpus_allowed)) {
- pos_css = css_rightmost_descendant(pos_css);
-@@ -873,7 +870,7 @@ static void update_cpumasks_hier(struct cpuset *cs, struct cpumask *new_cpus)
- * If it becomes empty, inherit the effective mask of the
- * parent, which is guaranteed to have some CPUs.
- */
-- if (cpumask_empty(new_cpus))
-+ if (cgroup_on_dfl(cp->css.cgroup) && cpumask_empty(new_cpus))
- cpumask_copy(new_cpus, parent->effective_cpus);
-
- /* Skip the whole subtree if the cpumask remains the same. */
-@@ -1129,7 +1126,7 @@ static void update_nodemasks_hier(struct cpuset *cs, nodemask_t *new_mems)
- * If it becomes empty, inherit the effective mask of the
- * parent, which is guaranteed to have some MEMs.
- */
-- if (nodes_empty(*new_mems))
-+ if (cgroup_on_dfl(cp->css.cgroup) && nodes_empty(*new_mems))
- *new_mems = parent->effective_mems;
-
- /* Skip the whole subtree if the nodemask remains the same. */
-@@ -1992,7 +1989,9 @@ static int cpuset_css_online(struct cgroup_subsys_state *css)
-
- spin_lock_irq(&callback_lock);
- cs->mems_allowed = parent->mems_allowed;
-+ cs->effective_mems = parent->mems_allowed;
- cpumask_copy(cs->cpus_allowed, parent->cpus_allowed);
-+ cpumask_copy(cs->effective_cpus, parent->cpus_allowed);
- spin_unlock_irq(&callback_lock);
- out_unlock:
- mutex_unlock(&cpuset_mutex);
-diff --git a/kernel/printk/console_cmdline.h b/kernel/printk/console_cmdline.h
-index cbd69d8..2ca4a8b 100644
---- a/kernel/printk/console_cmdline.h
-+++ b/kernel/printk/console_cmdline.h
-@@ -3,7 +3,7 @@
-
- struct console_cmdline
- {
-- char name[8]; /* Name of the driver */
-+ char name[16]; /* Name of the driver */
- int index; /* Minor dev. to use */
- char *options; /* Options for the driver */
- #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
-diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
-index fae29e3..2cdd353 100644
---- a/kernel/printk/printk.c
-+++ b/kernel/printk/printk.c
-@@ -2464,6 +2464,7 @@ void register_console(struct console *newcon)
- for (i = 0, c = console_cmdline;
- i < MAX_CMDLINECONSOLES && c->name[0];
- i++, c++) {
-+ BUILD_BUG_ON(sizeof(c->name) != sizeof(newcon->name));
- if (strcmp(c->name, newcon->name) != 0)
- continue;
- if (newcon->index >= 0 &&
-diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
-index 224e768..af5bffd 100644
---- a/kernel/trace/ftrace.c
-+++ b/kernel/trace/ftrace.c
-@@ -1059,6 +1059,12 @@ static __init void ftrace_profile_debugfs(struct dentry *d_tracer)
-
- static struct pid * const ftrace_swapper_pid = &init_struct_pid;
-
-+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
-+static int ftrace_graph_active;
-+#else
-+# define ftrace_graph_active 0
-+#endif
-+
- #ifdef CONFIG_DYNAMIC_FTRACE
-
- static struct ftrace_ops *removed_ops;
-@@ -2041,8 +2047,12 @@ static int ftrace_check_record(struct dyn_ftrace *rec, int enable, int update)
- if (!ftrace_rec_count(rec))
- rec->flags = 0;
- else
-- /* Just disable the record (keep REGS state) */
-- rec->flags &= ~FTRACE_FL_ENABLED;
-+ /*
-+ * Just disable the record, but keep the ops TRAMP
-+ * and REGS states. The _EN flags must be disabled though.
-+ */
-+ rec->flags &= ~(FTRACE_FL_ENABLED | FTRACE_FL_TRAMP_EN |
-+ FTRACE_FL_REGS_EN);
- }
-
- return FTRACE_UPDATE_MAKE_NOP;
-@@ -2688,24 +2698,36 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command)
-
- static void ftrace_startup_sysctl(void)
- {
-+ int command;
-+
- if (unlikely(ftrace_disabled))
- return;
-
- /* Force update next time */
- saved_ftrace_func = NULL;
- /* ftrace_start_up is true if we want ftrace running */
-- if (ftrace_start_up)
-- ftrace_run_update_code(FTRACE_UPDATE_CALLS);
-+ if (ftrace_start_up) {
-+ command = FTRACE_UPDATE_CALLS;
-+ if (ftrace_graph_active)
-+ command |= FTRACE_START_FUNC_RET;
-+ ftrace_startup_enable(command);
-+ }
- }
-
- static void ftrace_shutdown_sysctl(void)
- {
-+ int command;
-+
- if (unlikely(ftrace_disabled))
- return;
-
- /* ftrace_start_up is true if ftrace is running */
-- if (ftrace_start_up)
-- ftrace_run_update_code(FTRACE_DISABLE_CALLS);
-+ if (ftrace_start_up) {
-+ command = FTRACE_DISABLE_CALLS;
-+ if (ftrace_graph_active)
-+ command |= FTRACE_STOP_FUNC_RET;
-+ ftrace_run_update_code(command);
-+ }
- }
-
- static cycle_t ftrace_update_time;
-@@ -5558,12 +5580,12 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
-
- if (ftrace_enabled) {
-
-- ftrace_startup_sysctl();
--
- /* we are starting ftrace again */
- if (ftrace_ops_list != &ftrace_list_end)
- update_ftrace_function();
-
-+ ftrace_startup_sysctl();
-+
- } else {
- /* stopping ftrace calls (just send to ftrace_stub) */
- ftrace_trace_function = ftrace_stub;
-@@ -5590,8 +5612,6 @@ static struct ftrace_ops graph_ops = {
- ASSIGN_OPS_HASH(graph_ops, &global_ops.local_hash)
- };
-
--static int ftrace_graph_active;
--
- int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
- {
- return 0;
-diff --git a/kernel/workqueue.c b/kernel/workqueue.c
-index beeeac9..82d0c8d 100644
---- a/kernel/workqueue.c
-+++ b/kernel/workqueue.c
-@@ -2728,19 +2728,57 @@ bool flush_work(struct work_struct *work)
- }
- EXPORT_SYMBOL_GPL(flush_work);
-
-+struct cwt_wait {
-+ wait_queue_t wait;
-+ struct work_struct *work;
-+};
-+
-+static int cwt_wakefn(wait_queue_t *wait, unsigned mode, int sync, void *key)
-+{
-+ struct cwt_wait *cwait = container_of(wait, struct cwt_wait, wait);
-+
-+ if (cwait->work != key)
-+ return 0;
-+ return autoremove_wake_function(wait, mode, sync, key);
-+}
-+
- static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
- {
-+ static DECLARE_WAIT_QUEUE_HEAD(cancel_waitq);
- unsigned long flags;
- int ret;
-
- do {
- ret = try_to_grab_pending(work, is_dwork, &flags);
- /*
-- * If someone else is canceling, wait for the same event it
-- * would be waiting for before retrying.
-+ * If someone else is already canceling, wait for it to
-+ * finish. flush_work() doesn't work for PREEMPT_NONE
-+ * because we may get scheduled between @work's completion
-+ * and the other canceling task resuming and clearing
-+ * CANCELING - flush_work() will return false immediately
-+ * as @work is no longer busy, try_to_grab_pending() will
-+ * return -ENOENT as @work is still being canceled and the
-+ * other canceling task won't be able to clear CANCELING as
-+ * we're hogging the CPU.
-+ *
-+ * Let's wait for completion using a waitqueue. As this
-+ * may lead to the thundering herd problem, use a custom
-+ * wake function which matches @work along with exclusive
-+ * wait and wakeup.
- */
-- if (unlikely(ret == -ENOENT))
-- flush_work(work);
-+ if (unlikely(ret == -ENOENT)) {
-+ struct cwt_wait cwait;
-+
-+ init_wait(&cwait.wait);
-+ cwait.wait.func = cwt_wakefn;
-+ cwait.work = work;
-+
-+ prepare_to_wait_exclusive(&cancel_waitq, &cwait.wait,
-+ TASK_UNINTERRUPTIBLE);
-+ if (work_is_canceling(work))
-+ schedule();
-+ finish_wait(&cancel_waitq, &cwait.wait);
-+ }
- } while (unlikely(ret < 0));
-
- /* tell other tasks trying to grab @work to back off */
-@@ -2749,6 +2787,16 @@ static bool __cancel_work_timer(struct work_struct *work, bool is_dwork)
-
- flush_work(work);
- clear_work_data(work);
-+
-+ /*
-+ * Paired with prepare_to_wait() above so that either
-+ * waitqueue_active() is visible here or !work_is_canceling() is
-+ * visible there.
-+ */
-+ smp_mb();
-+ if (waitqueue_active(&cancel_waitq))
-+ __wake_up(&cancel_waitq, TASK_NORMAL, 1, work);
-+
- return ret;
- }
-
-diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
-index 7a85967..f0f5c5c 100644
---- a/lib/lz4/lz4_decompress.c
-+++ b/lib/lz4/lz4_decompress.c
-@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
- /* Error: request to write beyond destination buffer */
- if (cpy > oend)
- goto _output_error;
-+ if ((ref + COPYLENGTH) > oend ||
-+ (op + COPYLENGTH) > oend)
-+ goto _output_error;
- LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
- while (op < cpy)
- *op++ = *ref++;
-diff --git a/lib/seq_buf.c b/lib/seq_buf.c
-index 4eedfed..f25c33b 100644
---- a/lib/seq_buf.c
-+++ b/lib/seq_buf.c
-@@ -61,7 +61,7 @@ int seq_buf_vprintf(struct seq_buf *s, const char *fmt, va_list args)
-
- if (s->len < s->size) {
- len = vsnprintf(s->buffer + s->len, s->size - s->len, fmt, args);
-- if (seq_buf_can_fit(s, len)) {
-+ if (s->len + len < s->size) {
- s->len += len;
- return 0;
- }
-@@ -154,7 +154,7 @@ int seq_buf_bprintf(struct seq_buf *s, const char *fmt, const u32 *binary)
-
- if (s->len < s->size) {
- ret = bstr_printf(s->buffer + s->len, len, fmt, binary);
-- if (seq_buf_can_fit(s, ret)) {
-+ if (s->len + ret < s->size) {
- s->len += ret;
- return 0;
- }
-diff --git a/mm/cma.c b/mm/cma.c
-index a85ae28..f1bbcb6 100644
---- a/mm/cma.c
-+++ b/mm/cma.c
-@@ -64,15 +64,17 @@ static unsigned long cma_bitmap_aligned_mask(struct cma *cma, int align_order)
- return (1UL << (align_order - cma->order_per_bit)) - 1;
- }
-
-+/*
-+ * Find a PFN aligned to the specified order and return an offset represented in
-+ * order_per_bits.
-+ */
- static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
- {
-- unsigned int alignment;
--
- if (align_order <= cma->order_per_bit)
- return 0;
-- alignment = 1UL << (align_order - cma->order_per_bit);
-- return ALIGN(cma->base_pfn, alignment) -
-- (cma->base_pfn >> cma->order_per_bit);
-+
-+ return (ALIGN(cma->base_pfn, (1UL << align_order))
-+ - cma->base_pfn) >> cma->order_per_bit;
- }
-
- static unsigned long cma_bitmap_maxno(struct cma *cma)
-diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
-index 769b185..a6e2da0 100644
---- a/net/caif/caif_socket.c
-+++ b/net/caif/caif_socket.c
-@@ -281,7 +281,7 @@ static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
- int copylen;
-
- ret = -EOPNOTSUPP;
-- if (m->msg_flags&MSG_OOB)
-+ if (flags & MSG_OOB)
- goto read_error;
-
- skb = skb_recv_datagram(sk, flags, 0 , &ret);
-diff --git a/net/can/af_can.c b/net/can/af_can.c
-index 66e0804..32d710e 100644
---- a/net/can/af_can.c
-+++ b/net/can/af_can.c
-@@ -259,6 +259,9 @@ int can_send(struct sk_buff *skb, int loop)
- goto inval_skb;
- }
-
-+ skb->ip_summed = CHECKSUM_UNNECESSARY;
-+
-+ skb_reset_mac_header(skb);
- skb_reset_network_header(skb);
- skb_reset_transport_header(skb);
-
-diff --git a/net/compat.c b/net/compat.c
-index 94d3d5e..f7bd286 100644
---- a/net/compat.c
-+++ b/net/compat.c
-@@ -49,6 +49,13 @@ ssize_t get_compat_msghdr(struct msghdr *kmsg,
- __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
- __get_user(kmsg->msg_flags, &umsg->msg_flags))
- return -EFAULT;
-+
-+ if (!uaddr)
-+ kmsg->msg_namelen = 0;
-+
-+ if (kmsg->msg_namelen < 0)
-+ return -EINVAL;
-+
- if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
- kmsg->msg_namelen = sizeof(struct sockaddr_storage);
- kmsg->msg_control = compat_ptr(tmp3);
-diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
-index 31baba2..bbb1d5a 100644
---- a/net/core/sysctl_net_core.c
-+++ b/net/core/sysctl_net_core.c
-@@ -25,6 +25,8 @@
- static int zero = 0;
- static int one = 1;
- static int ushort_max = USHRT_MAX;
-+static int min_sndbuf = SOCK_MIN_SNDBUF;
-+static int min_rcvbuf = SOCK_MIN_RCVBUF;
-
- static int net_msg_warn; /* Unused, but still a sysctl */
-
-@@ -237,7 +239,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_sndbuf,
- },
- {
- .procname = "rmem_max",
-@@ -245,7 +247,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_rcvbuf,
- },
- {
- .procname = "wmem_default",
-@@ -253,7 +255,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_sndbuf,
- },
- {
- .procname = "rmem_default",
-@@ -261,7 +263,7 @@ static struct ctl_table net_core_table[] = {
- .maxlen = sizeof(int),
- .mode = 0644,
- .proc_handler = proc_dointvec_minmax,
-- .extra1 = &one,
-+ .extra1 = &min_rcvbuf,
- },
- {
- .procname = "dev_weight",
-diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
-index e34dccb..4eeba4e 100644
---- a/net/ipv4/inet_diag.c
-+++ b/net/ipv4/inet_diag.c
-@@ -71,6 +71,20 @@ static inline void inet_diag_unlock_handler(
- mutex_unlock(&inet_diag_table_mutex);
- }
-
-+static size_t inet_sk_attr_size(void)
-+{
-+ return nla_total_size(sizeof(struct tcp_info))
-+ + nla_total_size(1) /* INET_DIAG_SHUTDOWN */
-+ + nla_total_size(1) /* INET_DIAG_TOS */
-+ + nla_total_size(1) /* INET_DIAG_TCLASS */
-+ + nla_total_size(sizeof(struct inet_diag_meminfo))
-+ + nla_total_size(sizeof(struct inet_diag_msg))
-+ + nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
-+ + nla_total_size(TCP_CA_NAME_MAX)
-+ + nla_total_size(sizeof(struct tcpvegas_info))
-+ + 64;
-+}
-+
- int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
- struct sk_buff *skb, struct inet_diag_req_v2 *req,
- struct user_namespace *user_ns,
-@@ -324,9 +338,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo, struct sk_buff *in_s
- if (err)
- goto out;
-
-- rep = nlmsg_new(sizeof(struct inet_diag_msg) +
-- sizeof(struct inet_diag_meminfo) +
-- sizeof(struct tcp_info) + 64, GFP_KERNEL);
-+ rep = nlmsg_new(inet_sk_attr_size(), GFP_KERNEL);
- if (!rep) {
- err = -ENOMEM;
- goto out;
-diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
-index 8670e68..f2d4097 100644
---- a/net/ipv4/tcp_cong.c
-+++ b/net/ipv4/tcp_cong.c
-@@ -309,6 +309,12 @@ EXPORT_SYMBOL_GPL(tcp_slow_start);
- */
- void tcp_cong_avoid_ai(struct tcp_sock *tp, u32 w, u32 acked)
- {
-+ /* If credits accumulated at a higher w, apply them gently now. */
-+ if (tp->snd_cwnd_cnt >= w) {
-+ tp->snd_cwnd_cnt = 0;
-+ tp->snd_cwnd++;
-+ }
-+
- tp->snd_cwnd_cnt += acked;
- if (tp->snd_cwnd_cnt >= w) {
- u32 delta = tp->snd_cwnd_cnt / w;
-diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
-index 4b276d1..06d3d66 100644
---- a/net/ipv4/tcp_cubic.c
-+++ b/net/ipv4/tcp_cubic.c
-@@ -306,8 +306,10 @@ tcp_friendliness:
- }
- }
-
-- if (ca->cnt == 0) /* cannot be zero */
-- ca->cnt = 1;
-+ /* The maximum rate of cwnd increase CUBIC allows is 1 packet per
-+ * 2 packets ACKed, meaning cwnd grows at 1.5x per RTT.
-+ */
-+ ca->cnt = max(ca->cnt, 2U);
- }
-
- static void bictcp_cong_avoid(struct sock *sk, u32 ack, u32 acked)
-diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
-index 65caf8b..9790f39 100644
---- a/net/ipv4/tcp_output.c
-+++ b/net/ipv4/tcp_output.c
-@@ -2775,15 +2775,11 @@ void tcp_send_fin(struct sock *sk)
- } else {
- /* Socket is locked, keep trying until memory is available. */
- for (;;) {
-- skb = alloc_skb_fclone(MAX_TCP_HEADER,
-- sk->sk_allocation);
-+ skb = sk_stream_alloc_skb(sk, 0, sk->sk_allocation);
- if (skb)
- break;
- yield();
- }
--
-- /* Reserve space for headers and prepare control bits. */
-- skb_reserve(skb, MAX_TCP_HEADER);
- /* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */
- tcp_init_nondata_skb(skb, tp->write_seq,
- TCPHDR_ACK | TCPHDR_FIN);
-diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
-index b4d5e1d..27ca796 100644
---- a/net/ipv6/fib6_rules.c
-+++ b/net/ipv6/fib6_rules.c
-@@ -104,6 +104,7 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
- goto again;
- flp6->saddr = saddr;
- }
-+ err = rt->dst.error;
- goto out;
- }
- again:
-diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
-index a562769..4b869d3 100644
---- a/net/ipv6/udp_offload.c
-+++ b/net/ipv6/udp_offload.c
-@@ -112,11 +112,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
- fptr = (struct frag_hdr *)(skb_network_header(skb) + unfrag_ip6hlen);
- fptr->nexthdr = nexthdr;
- fptr->reserved = 0;
-- if (skb_shinfo(skb)->ip6_frag_id)
-- fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-- else
-- ipv6_select_ident(fptr,
-- (struct rt6_info *)skb_dst(skb));
-+ if (!skb_shinfo(skb)->ip6_frag_id)
-+ ipv6_proxy_select_ident(skb);
-+ fptr->identification = skb_shinfo(skb)->ip6_frag_id;
-
- /* Fragment the skb. ipv6 header and the remaining fields of the
- * fragment header are updated in ipv6_gso_segment()
-diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
-index b8295a4..fdcda8b 100644
---- a/net/netfilter/ipvs/ip_vs_ctl.c
-+++ b/net/netfilter/ipvs/ip_vs_ctl.c
-@@ -3399,7 +3399,7 @@ static int ip_vs_genl_set_cmd(struct sk_buff *skb, struct genl_info *info)
- if (udest.af == 0)
- udest.af = svc->af;
-
-- if (udest.af != svc->af) {
-+ if (udest.af != svc->af && cmd != IPVS_CMD_DEL_DEST) {
- /* The synchronization protocol is incompatible
- * with mixed family services
- */
-diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
-index c47ffd7..d93ceeb 100644
---- a/net/netfilter/ipvs/ip_vs_sync.c
-+++ b/net/netfilter/ipvs/ip_vs_sync.c
-@@ -896,6 +896,8 @@ static void ip_vs_proc_conn(struct net *net, struct ip_vs_conn_param *param,
- IP_VS_DBG(2, "BACKUP, add new conn. failed\n");
- return;
- }
-+ if (!(flags & IP_VS_CONN_F_TEMPLATE))
-+ kfree(param->pe_data);
- }
-
- if (opt)
-@@ -1169,6 +1171,7 @@ static inline int ip_vs_proc_sync_conn(struct net *net, __u8 *p, __u8 *msg_end)
- (opt_flags & IPVS_OPT_F_SEQ_DATA ? &opt : NULL)
- );
- #endif
-+ ip_vs_pe_put(param.pe);
- return 0;
- /* Error exit */
- out:
-diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
-index 1ff04bc..f77f4cc 100644
---- a/net/netfilter/nf_tables_api.c
-+++ b/net/netfilter/nf_tables_api.c
-@@ -227,7 +227,7 @@ nft_rule_deactivate_next(struct net *net, struct nft_rule *rule)
-
- static inline void nft_rule_clear(struct net *net, struct nft_rule *rule)
- {
-- rule->genmask = 0;
-+ rule->genmask &= ~(1 << gencursor_next(net));
- }
-
- static int
-@@ -3606,12 +3606,11 @@ static int nf_tables_commit(struct sk_buff *skb)
- &te->elem,
- NFT_MSG_DELSETELEM, 0);
- te->set->ops->get(te->set, &te->elem);
-- te->set->ops->remove(te->set, &te->elem);
- nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-- if (te->elem.flags & NFT_SET_MAP) {
-- nft_data_uninit(&te->elem.data,
-- te->set->dtype);
-- }
-+ if (te->set->flags & NFT_SET_MAP &&
-+ !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
-+ nft_data_uninit(&te->elem.data, te->set->dtype);
-+ te->set->ops->remove(te->set, &te->elem);
- nft_trans_destroy(trans);
- break;
- }
-@@ -3652,7 +3651,7 @@ static int nf_tables_abort(struct sk_buff *skb)
- {
- struct net *net = sock_net(skb->sk);
- struct nft_trans *trans, *next;
-- struct nft_set *set;
-+ struct nft_trans_elem *te;
-
- list_for_each_entry_safe(trans, next, &net->nft.commit_list, list) {
- switch (trans->msg_type) {
-@@ -3713,9 +3712,13 @@ static int nf_tables_abort(struct sk_buff *skb)
- break;
- case NFT_MSG_NEWSETELEM:
- nft_trans_elem_set(trans)->nelems--;
-- set = nft_trans_elem_set(trans);
-- set->ops->get(set, &nft_trans_elem(trans));
-- set->ops->remove(set, &nft_trans_elem(trans));
-+ te = (struct nft_trans_elem *)trans->data;
-+ te->set->ops->get(te->set, &te->elem);
-+ nft_data_uninit(&te->elem.key, NFT_DATA_VALUE);
-+ if (te->set->flags & NFT_SET_MAP &&
-+ !(te->elem.flags & NFT_SET_ELEM_INTERVAL_END))
-+ nft_data_uninit(&te->elem.data, te->set->dtype);
-+ te->set->ops->remove(te->set, &te->elem);
- nft_trans_destroy(trans);
- break;
- case NFT_MSG_DELSETELEM:
-diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
-index 265e190..b636486 100644
---- a/net/netfilter/nft_compat.c
-+++ b/net/netfilter/nft_compat.c
-@@ -578,8 +578,12 @@ nft_match_select_ops(const struct nft_ctx *ctx,
- struct xt_match *match = nft_match->ops.data;
-
- if (strcmp(match->name, mt_name) == 0 &&
-- match->revision == rev && match->family == family)
-+ match->revision == rev && match->family == family) {
-+ if (!try_module_get(match->me))
-+ return ERR_PTR(-ENOENT);
-+
- return &nft_match->ops;
-+ }
- }
-
- match = xt_request_find_match(family, mt_name, rev);
-@@ -648,8 +652,12 @@ nft_target_select_ops(const struct nft_ctx *ctx,
- struct xt_target *target = nft_target->ops.data;
-
- if (strcmp(target->name, tg_name) == 0 &&
-- target->revision == rev && target->family == family)
-+ target->revision == rev && target->family == family) {
-+ if (!try_module_get(target->me))
-+ return ERR_PTR(-ENOENT);
-+
- return &nft_target->ops;
-+ }
- }
-
- target = xt_request_find_target(family, tg_name, rev);
-diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
-index 1ba6793..13332db 100644
---- a/net/netfilter/xt_socket.c
-+++ b/net/netfilter/xt_socket.c
-@@ -243,12 +243,13 @@ static int
- extract_icmp6_fields(const struct sk_buff *skb,
- unsigned int outside_hdrlen,
- int *protocol,
-- struct in6_addr **raddr,
-- struct in6_addr **laddr,
-+ const struct in6_addr **raddr,
-+ const struct in6_addr **laddr,
- __be16 *rport,
-- __be16 *lport)
-+ __be16 *lport,
-+ struct ipv6hdr *ipv6_var)
- {
-- struct ipv6hdr *inside_iph, _inside_iph;
-+ const struct ipv6hdr *inside_iph;
- struct icmp6hdr *icmph, _icmph;
- __be16 *ports, _ports[2];
- u8 inside_nexthdr;
-@@ -263,12 +264,14 @@ extract_icmp6_fields(const struct sk_buff *skb,
- if (icmph->icmp6_type & ICMPV6_INFOMSG_MASK)
- return 1;
-
-- inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph), sizeof(_inside_iph), &_inside_iph);
-+ inside_iph = skb_header_pointer(skb, outside_hdrlen + sizeof(_icmph),
-+ sizeof(*ipv6_var), ipv6_var);
- if (inside_iph == NULL)
- return 1;
- inside_nexthdr = inside_iph->nexthdr;
-
-- inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) + sizeof(_inside_iph),
-+ inside_hdrlen = ipv6_skip_exthdr(skb, outside_hdrlen + sizeof(_icmph) +
-+ sizeof(*ipv6_var),
- &inside_nexthdr, &inside_fragoff);
- if (inside_hdrlen < 0)
- return 1; /* hjm: Packet has no/incomplete transport layer headers. */
-@@ -315,10 +318,10 @@ xt_socket_get_sock_v6(struct net *net, const u8 protocol,
- static bool
- socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
- {
-- struct ipv6hdr *iph = ipv6_hdr(skb);
-+ struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
- struct udphdr _hdr, *hp = NULL;
- struct sock *sk = skb->sk;
-- struct in6_addr *daddr = NULL, *saddr = NULL;
-+ const struct in6_addr *daddr = NULL, *saddr = NULL;
- __be16 uninitialized_var(dport), uninitialized_var(sport);
- int thoff = 0, uninitialized_var(tproto);
- const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
-@@ -342,7 +345,7 @@ socket_mt6_v1_v2(const struct sk_buff *skb, struct xt_action_param *par)
-
- } else if (tproto == IPPROTO_ICMPV6) {
- if (extract_icmp6_fields(skb, thoff, &tproto, &saddr, &daddr,
-- &sport, &dport))
-+ &sport, &dport, &ipv6_var))
- return false;
- } else {
- return false;
-diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
-index a817705..dba8d08 100644
---- a/net/rds/iw_rdma.c
-+++ b/net/rds/iw_rdma.c
-@@ -88,7 +88,9 @@ static unsigned int rds_iw_unmap_fastreg_list(struct rds_iw_mr_pool *pool,
- int *unpinned);
- static void rds_iw_destroy_fastreg(struct rds_iw_mr_pool *pool, struct rds_iw_mr *ibmr);
-
--static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwdev, struct rdma_cm_id **cm_id)
-+static int rds_iw_get_device(struct sockaddr_in *src, struct sockaddr_in *dst,
-+ struct rds_iw_device **rds_iwdev,
-+ struct rdma_cm_id **cm_id)
- {
- struct rds_iw_device *iwdev;
- struct rds_iw_cm_id *i_cm_id;
-@@ -112,15 +114,15 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- src_addr->sin_port,
- dst_addr->sin_addr.s_addr,
- dst_addr->sin_port,
-- rs->rs_bound_addr,
-- rs->rs_bound_port,
-- rs->rs_conn_addr,
-- rs->rs_conn_port);
-+ src->sin_addr.s_addr,
-+ src->sin_port,
-+ dst->sin_addr.s_addr,
-+ dst->sin_port);
- #ifdef WORKING_TUPLE_DETECTION
-- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr &&
-- src_addr->sin_port == rs->rs_bound_port &&
-- dst_addr->sin_addr.s_addr == rs->rs_conn_addr &&
-- dst_addr->sin_port == rs->rs_conn_port) {
-+ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr &&
-+ src_addr->sin_port == src->sin_port &&
-+ dst_addr->sin_addr.s_addr == dst->sin_addr.s_addr &&
-+ dst_addr->sin_port == dst->sin_port) {
- #else
- /* FIXME - needs to compare the local and remote
- * ipaddr/port tuple, but the ipaddr is the only
-@@ -128,7 +130,7 @@ static int rds_iw_get_device(struct rds_sock *rs, struct rds_iw_device **rds_iwd
- * zero'ed. It doesn't appear to be properly populated
- * during connection setup...
- */
-- if (src_addr->sin_addr.s_addr == rs->rs_bound_addr) {
-+ if (src_addr->sin_addr.s_addr == src->sin_addr.s_addr) {
- #endif
- spin_unlock_irq(&iwdev->spinlock);
- *rds_iwdev = iwdev;
-@@ -180,19 +182,13 @@ int rds_iw_update_cm_id(struct rds_iw_device *rds_iwdev, struct rdma_cm_id *cm_i
- {
- struct sockaddr_in *src_addr, *dst_addr;
- struct rds_iw_device *rds_iwdev_old;
-- struct rds_sock rs;
- struct rdma_cm_id *pcm_id;
- int rc;
-
- src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
- dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
-
-- rs.rs_bound_addr = src_addr->sin_addr.s_addr;
-- rs.rs_bound_port = src_addr->sin_port;
-- rs.rs_conn_addr = dst_addr->sin_addr.s_addr;
-- rs.rs_conn_port = dst_addr->sin_port;
--
-- rc = rds_iw_get_device(&rs, &rds_iwdev_old, &pcm_id);
-+ rc = rds_iw_get_device(src_addr, dst_addr, &rds_iwdev_old, &pcm_id);
- if (rc)
- rds_iw_remove_cm_id(rds_iwdev, cm_id);
-
-@@ -598,9 +594,17 @@ void *rds_iw_get_mr(struct scatterlist *sg, unsigned long nents,
- struct rds_iw_device *rds_iwdev;
- struct rds_iw_mr *ibmr = NULL;
- struct rdma_cm_id *cm_id;
-+ struct sockaddr_in src = {
-+ .sin_addr.s_addr = rs->rs_bound_addr,
-+ .sin_port = rs->rs_bound_port,
-+ };
-+ struct sockaddr_in dst = {
-+ .sin_addr.s_addr = rs->rs_conn_addr,
-+ .sin_port = rs->rs_conn_port,
-+ };
- int ret;
-
-- ret = rds_iw_get_device(rs, &rds_iwdev, &cm_id);
-+ ret = rds_iw_get_device(&src, &dst, &rds_iwdev, &cm_id);
- if (ret || !cm_id) {
- ret = -ENODEV;
- goto out;
-diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
-index 4575485..19a5606 100644
---- a/net/rxrpc/ar-recvmsg.c
-+++ b/net/rxrpc/ar-recvmsg.c
-@@ -87,7 +87,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
- if (!skb) {
- /* nothing remains on the queue */
- if (copied &&
-- (msg->msg_flags & MSG_PEEK || timeo == 0))
-+ (flags & MSG_PEEK || timeo == 0))
- goto out;
-
- /* wait for a message to turn up */
-diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
-index 09487af..95fdf4e 100644
---- a/net/sched/cls_u32.c
-+++ b/net/sched/cls_u32.c
-@@ -78,8 +78,11 @@ struct tc_u_hnode {
- struct tc_u_common *tp_c;
- int refcnt;
- unsigned int divisor;
-- struct tc_u_knode __rcu *ht[1];
- struct rcu_head rcu;
-+ /* The 'ht' field MUST be the last field in structure to allow for
-+ * more entries allocated at end of structure.
-+ */
-+ struct tc_u_knode __rcu *ht[1];
- };
-
- struct tc_u_common {
-diff --git a/net/socket.c b/net/socket.c
-index 418795c..d50e7ca 100644
---- a/net/socket.c
-+++ b/net/socket.c
-@@ -1765,6 +1765,8 @@ SYSCALL_DEFINE6(sendto, int, fd, void __user *, buff, size_t, len,
-
- if (len > INT_MAX)
- len = INT_MAX;
-+ if (unlikely(!access_ok(VERIFY_READ, buff, len)))
-+ return -EFAULT;
- sock = sockfd_lookup_light(fd, &err, &fput_needed);
- if (!sock)
- goto out;
-@@ -1823,6 +1825,8 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
-
- if (size > INT_MAX)
- size = INT_MAX;
-+ if (unlikely(!access_ok(VERIFY_WRITE, ubuf, size)))
-+ return -EFAULT;
- sock = sockfd_lookup_light(fd, &err, &fput_needed);
- if (!sock)
- goto out;
-diff --git a/sound/core/control.c b/sound/core/control.c
-index bb96a46..23b018b 100644
---- a/sound/core/control.c
-+++ b/sound/core/control.c
-@@ -1168,6 +1168,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
-
- if (info->count < 1)
- return -EINVAL;
-+ if (!*info->id.name)
-+ return -EINVAL;
-+ if (strnlen(info->id.name, sizeof(info->id.name)) >= sizeof(info->id.name))
-+ return -EINVAL;
- access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
- (info->access & (SNDRV_CTL_ELEM_ACCESS_READWRITE|
- SNDRV_CTL_ELEM_ACCESS_INACTIVE|
-diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
-index c2aa3cd..a9536bb 100644
---- a/sound/pci/hda/hda_controller.c
-+++ b/sound/pci/hda/hda_controller.c
-@@ -1160,7 +1160,7 @@ static unsigned int azx_rirb_get_response(struct hda_bus *bus,
- }
- }
-
-- if (!bus->no_response_fallback)
-+ if (bus->no_response_fallback)
- return -1;
-
- if (!chip->polling_mode && chip->poll_count < 2) {
-diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
-index b680b4e..8ec5289 100644
---- a/sound/pci/hda/hda_generic.c
-+++ b/sound/pci/hda/hda_generic.c
-@@ -687,12 +687,45 @@ static int get_amp_val_to_activate(struct hda_codec *codec, hda_nid_t nid,
- return val;
- }
-
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid, int dir)
-+{
-+ unsigned int wcaps = get_wcaps(codec, nid);
-+ hda_nid_t conn;
-+
-+ if (wcaps & AC_WCAP_STEREO)
-+ return true;
-+ if (dir != HDA_INPUT || get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+ return false;
-+ if (snd_hda_get_num_conns(codec, nid) != 1)
-+ return false;
-+ if (snd_hda_get_connections(codec, nid, &conn, 1) < 0)
-+ return false;
-+ return !!(get_wcaps(codec, conn) & AC_WCAP_STEREO);
-+}
-+
- /* initialize the amp value (only at the first time) */
- static void init_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx)
- {
- unsigned int caps = query_amp_caps(codec, nid, dir);
- int val = get_amp_val_to_activate(codec, nid, dir, caps, false);
-- snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+
-+ if (is_stereo_amps(codec, nid, dir))
-+ snd_hda_codec_amp_init_stereo(codec, nid, dir, idx, 0xff, val);
-+ else
-+ snd_hda_codec_amp_init(codec, nid, 0, dir, idx, 0xff, val);
-+}
-+
-+/* update the amp, doing in stereo or mono depending on NID */
-+static int update_amp(struct hda_codec *codec, hda_nid_t nid, int dir, int idx,
-+ unsigned int mask, unsigned int val)
-+{
-+ if (is_stereo_amps(codec, nid, dir))
-+ return snd_hda_codec_amp_stereo(codec, nid, dir, idx,
-+ mask, val);
-+ else
-+ return snd_hda_codec_amp_update(codec, nid, 0, dir, idx,
-+ mask, val);
- }
-
- /* calculate amp value mask we can modify;
-@@ -732,7 +765,7 @@ static void activate_amp(struct hda_codec *codec, hda_nid_t nid, int dir,
- return;
-
- val &= mask;
-- snd_hda_codec_amp_stereo(codec, nid, dir, idx, mask, val);
-+ update_amp(codec, nid, dir, idx, mask, val);
- }
-
- static void activate_amp_out(struct hda_codec *codec, struct nid_path *path,
-@@ -4424,13 +4457,11 @@ static void mute_all_mixer_nid(struct hda_codec *codec, hda_nid_t mix)
- has_amp = nid_has_mute(codec, mix, HDA_INPUT);
- for (i = 0; i < nums; i++) {
- if (has_amp)
-- snd_hda_codec_amp_stereo(codec, mix,
-- HDA_INPUT, i,
-- 0xff, HDA_AMP_MUTE);
-+ update_amp(codec, mix, HDA_INPUT, i,
-+ 0xff, HDA_AMP_MUTE);
- else if (nid_has_volume(codec, conn[i], HDA_OUTPUT))
-- snd_hda_codec_amp_stereo(codec, conn[i],
-- HDA_OUTPUT, 0,
-- 0xff, HDA_AMP_MUTE);
-+ update_amp(codec, conn[i], HDA_OUTPUT, 0,
-+ 0xff, HDA_AMP_MUTE);
- }
- }
-
-diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
-index ce5a6da..05e19f7 100644
---- a/sound/pci/hda/hda_proc.c
-+++ b/sound/pci/hda/hda_proc.c
-@@ -134,13 +134,38 @@ static void print_amp_caps(struct snd_info_buffer *buffer,
- (caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT);
- }
-
-+/* is this a stereo widget or a stereo-to-mono mix? */
-+static bool is_stereo_amps(struct hda_codec *codec, hda_nid_t nid,
-+ int dir, unsigned int wcaps, int indices)
-+{
-+ hda_nid_t conn;
-+
-+ if (wcaps & AC_WCAP_STEREO)
-+ return true;
-+ /* check for a stereo-to-mono mix; it must be:
-+ * only a single connection, only for input, and only a mixer widget
-+ */
-+ if (indices != 1 || dir != HDA_INPUT ||
-+ get_wcaps_type(wcaps) != AC_WID_AUD_MIX)
-+ return false;
-+
-+ if (snd_hda_get_raw_connections(codec, nid, &conn, 1) < 0)
-+ return false;
-+ /* the connection source is a stereo? */
-+ wcaps = snd_hda_param_read(codec, conn, AC_PAR_AUDIO_WIDGET_CAP);
-+ return !!(wcaps & AC_WCAP_STEREO);
-+}
-+
- static void print_amp_vals(struct snd_info_buffer *buffer,
- struct hda_codec *codec, hda_nid_t nid,
-- int dir, int stereo, int indices)
-+ int dir, unsigned int wcaps, int indices)
- {
- unsigned int val;
-+ bool stereo;
- int i;
-
-+ stereo = is_stereo_amps(codec, nid, dir, wcaps, indices);
-+
- dir = dir == HDA_OUTPUT ? AC_AMP_GET_OUTPUT : AC_AMP_GET_INPUT;
- for (i = 0; i < indices; i++) {
- snd_iprintf(buffer, " [");
-@@ -757,12 +782,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- (codec->single_adc_amp &&
- wid_type == AC_WID_AUD_IN))
- print_amp_vals(buffer, codec, nid, HDA_INPUT,
-- wid_caps & AC_WCAP_STEREO,
-- 1);
-+ wid_caps, 1);
- else
- print_amp_vals(buffer, codec, nid, HDA_INPUT,
-- wid_caps & AC_WCAP_STEREO,
-- conn_len);
-+ wid_caps, conn_len);
- }
- if (wid_caps & AC_WCAP_OUT_AMP) {
- snd_iprintf(buffer, " Amp-Out caps: ");
-@@ -771,11 +794,10 @@ static void print_codec_info(struct snd_info_entry *entry,
- if (wid_type == AC_WID_PIN &&
- codec->pin_amp_workaround)
- print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-- wid_caps & AC_WCAP_STEREO,
-- conn_len);
-+ wid_caps, conn_len);
- else
- print_amp_vals(buffer, codec, nid, HDA_OUTPUT,
-- wid_caps & AC_WCAP_STEREO, 1);
-+ wid_caps, 1);
- }
-
- switch (wid_type) {
-diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c
-index 1589c9b..dd2b3d9 100644
---- a/sound/pci/hda/patch_cirrus.c
-+++ b/sound/pci/hda/patch_cirrus.c
-@@ -393,6 +393,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = {
- SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81),
- SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122),
- SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
-+ SND_PCI_QUIRK(0x106b, 0x5600, "MacBookAir 5,2", CS420X_MBP81),
- SND_PCI_QUIRK(0x106b, 0x5b00, "MacBookAir 4,2", CS420X_MBA42),
- SND_PCI_QUIRK_VENDOR(0x106b, "Apple", CS420X_APPLE),
- {} /* terminator */
-@@ -584,6 +585,7 @@ static int patch_cs420x(struct hda_codec *codec)
- return -ENOMEM;
-
- spec->gen.automute_hook = cs_automute;
-+ codec->single_adc_amp = 1;
-
- snd_hda_pick_fixup(codec, cs420x_models, cs420x_fixup_tbl,
- cs420x_fixups);
-diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
-index fd3ed18..da67ea8 100644
---- a/sound/pci/hda/patch_conexant.c
-+++ b/sound/pci/hda/patch_conexant.c
-@@ -223,6 +223,7 @@ enum {
- CXT_PINCFG_LENOVO_TP410,
- CXT_PINCFG_LEMOTE_A1004,
- CXT_PINCFG_LEMOTE_A1205,
-+ CXT_PINCFG_COMPAQ_CQ60,
- CXT_FIXUP_STEREO_DMIC,
- CXT_FIXUP_INC_MIC_BOOST,
- CXT_FIXUP_HEADPHONE_MIC_PIN,
-@@ -660,6 +661,15 @@ static const struct hda_fixup cxt_fixups[] = {
- .type = HDA_FIXUP_PINS,
- .v.pins = cxt_pincfg_lemote,
- },
-+ [CXT_PINCFG_COMPAQ_CQ60] = {
-+ .type = HDA_FIXUP_PINS,
-+ .v.pins = (const struct hda_pintbl[]) {
-+ /* 0x17 was falsely set up as a mic, it should 0x1d */
-+ { 0x17, 0x400001f0 },
-+ { 0x1d, 0x97a70120 },
-+ { }
-+ }
-+ },
- [CXT_FIXUP_STEREO_DMIC] = {
- .type = HDA_FIXUP_FUNC,
- .v.func = cxt_fixup_stereo_dmic,
-@@ -769,6 +779,7 @@ static const struct hda_model_fixup cxt5047_fixup_models[] = {
- };
-
- static const struct snd_pci_quirk cxt5051_fixups[] = {
-+ SND_PCI_QUIRK(0x103c, 0x360b, "Compaq CQ60", CXT_PINCFG_COMPAQ_CQ60),
- SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo X200", CXT_PINCFG_LENOVO_X200),
- {}
- };
-diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
-index 0a598af..e61c167 100644
---- a/sound/usb/quirks-table.h
-+++ b/sound/usb/quirks-table.h
-@@ -1773,6 +1773,36 @@ YAMAHA_DEVICE(0x7010, "UB99"),
- }
- }
- },
-+{
-+ USB_DEVICE(0x0582, 0x0159),
-+ .driver_info = (unsigned long) & (const struct snd_usb_audio_quirk) {
-+ /* .vendor_name = "Roland", */
-+ /* .product_name = "UA-22", */
-+ .ifnum = QUIRK_ANY_INTERFACE,
-+ .type = QUIRK_COMPOSITE,
-+ .data = (const struct snd_usb_audio_quirk[]) {
-+ {
-+ .ifnum = 0,
-+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
-+ },
-+ {
-+ .ifnum = 1,
-+ .type = QUIRK_AUDIO_STANDARD_INTERFACE
-+ },
-+ {
-+ .ifnum = 2,
-+ .type = QUIRK_MIDI_FIXED_ENDPOINT,
-+ .data = & (const struct snd_usb_midi_endpoint_info) {
-+ .out_cables = 0x0001,
-+ .in_cables = 0x0001
-+ }
-+ },
-+ {
-+ .ifnum = -1
-+ }
-+ }
-+ }
-+},
- /* this catches most recent vendor-specific Roland devices */
- {
- .match_flags = USB_DEVICE_ID_MATCH_VENDOR |
-diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
-index 1cc6e2e..ec83b11 100644
---- a/virt/kvm/kvm_main.c
-+++ b/virt/kvm/kvm_main.c
-@@ -2416,6 +2416,7 @@ static long kvm_vm_ioctl_check_extension_generic(struct kvm *kvm, long arg)
- case KVM_CAP_SIGNAL_MSI:
- #endif
- #ifdef CONFIG_HAVE_KVM_IRQFD
-+ case KVM_CAP_IRQFD:
- case KVM_CAP_IRQFD_RESAMPLE:
- #endif
- case KVM_CAP_CHECK_EXTENSION_VM:
diff --git a/3.19.3/0000_README b/3.19.4/0000_README
similarity index 94%
rename from 3.19.3/0000_README
rename to 3.19.4/0000_README
index 571c76c..d6b2506 100644
--- a/3.19.3/0000_README
+++ b/3.19.4/0000_README
@@ -2,11 +2,11 @@ README
-----------------------------------------------------------------------------
Individual Patch Descriptions:
-----------------------------------------------------------------------------
-Patch: 1002_linux-3.19.3.patch
+Patch: 1003_linux-3.19.4.patch
From: http://www.kernel.org
-Desc: Linux 3.19.3
+Desc: Linux 3.19.4
-Patch: 4420_grsecurity-3.1-3.19.3-201504021826.patch
+Patch: 4420_grsecurity-3.1-3.19.4-201504142300.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.19.4/1003_linux-3.19.4.patch b/3.19.4/1003_linux-3.19.4.patch
new file mode 100644
index 0000000..4c73b31
--- /dev/null
+++ b/3.19.4/1003_linux-3.19.4.patch
@@ -0,0 +1,3185 @@
+diff --git a/Makefile b/Makefile
+index 713bf26..2ef2078 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 19
+-SUBLEVEL = 3
++SUBLEVEL = 4
+ EXTRAVERSION =
+ NAME = Diseased Newt
+
+diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
+index cb95930..d8c25b7 100644
+--- a/arch/arm64/include/asm/cmpxchg.h
++++ b/arch/arm64/include/asm/cmpxchg.h
+@@ -246,14 +246,30 @@ static inline unsigned long __cmpxchg_mb(volatile void *ptr, unsigned long old,
+ __ret; \
+ })
+
+-#define this_cpu_cmpxchg_1(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-#define this_cpu_cmpxchg_2(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-#define this_cpu_cmpxchg_4(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-#define this_cpu_cmpxchg_8(ptr, o, n) cmpxchg_local(raw_cpu_ptr(&(ptr)), o, n)
+-
+-#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2) \
+- cmpxchg_double_local(raw_cpu_ptr(&(ptr1)), raw_cpu_ptr(&(ptr2)), \
+- o1, o2, n1, n2)
++#define _protect_cmpxchg_local(pcp, o, n) \
++({ \
++ typeof(*raw_cpu_ptr(&(pcp))) __ret; \
++ preempt_disable(); \
++ __ret = cmpxchg_local(raw_cpu_ptr(&(pcp)), o, n); \
++ preempt_enable(); \
++ __ret; \
++})
++
++#define this_cpu_cmpxchg_1(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++#define this_cpu_cmpxchg_2(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++#define this_cpu_cmpxchg_4(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++#define this_cpu_cmpxchg_8(ptr, o, n) _protect_cmpxchg_local(ptr, o, n)
++
++#define this_cpu_cmpxchg_double_8(ptr1, ptr2, o1, o2, n1, n2) \
++({ \
++ int __ret; \
++ preempt_disable(); \
++ __ret = cmpxchg_double_local( raw_cpu_ptr(&(ptr1)), \
++ raw_cpu_ptr(&(ptr2)), \
++ o1, o2, n1, n2); \
++ preempt_enable(); \
++ __ret; \
++})
+
+ #define cmpxchg64(ptr,o,n) cmpxchg((ptr),(o),(n))
+ #define cmpxchg64_local(ptr,o,n) cmpxchg_local((ptr),(o),(n))
+diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
+index a9eee33..101a42b 100644
+--- a/arch/arm64/include/asm/mmu_context.h
++++ b/arch/arm64/include/asm/mmu_context.h
+@@ -151,6 +151,15 @@ switch_mm(struct mm_struct *prev, struct mm_struct *next,
+ {
+ unsigned int cpu = smp_processor_id();
+
++ /*
++ * init_mm.pgd does not contain any user mappings and it is always
++ * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
++ */
++ if (next == &init_mm) {
++ cpu_set_reserved_ttbr0();
++ return;
++ }
++
+ if (!cpumask_test_and_set_cpu(cpu, mm_cpumask(next)) || prev != next)
+ check_and_switch_context(next, tsk);
+ }
+diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
+index 09da25b..4fde8c1 100644
+--- a/arch/arm64/include/asm/percpu.h
++++ b/arch/arm64/include/asm/percpu.h
+@@ -204,25 +204,47 @@ static inline unsigned long __percpu_xchg(void *ptr, unsigned long val,
+ return ret;
+ }
+
++#define _percpu_read(pcp) \
++({ \
++ typeof(pcp) __retval; \
++ preempt_disable(); \
++ __retval = (typeof(pcp))__percpu_read(raw_cpu_ptr(&(pcp)), \
++ sizeof(pcp)); \
++ preempt_enable(); \
++ __retval; \
++})
++
++#define _percpu_write(pcp, val) \
++do { \
++ preempt_disable(); \
++ __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val), \
++ sizeof(pcp)); \
++ preempt_enable(); \
++} while(0) \
++
++#define _pcp_protect(operation, pcp, val) \
++({ \
++ typeof(pcp) __retval; \
++ preempt_disable(); \
++ __retval = (typeof(pcp))operation(raw_cpu_ptr(&(pcp)), \
++ (val), sizeof(pcp)); \
++ preempt_enable(); \
++ __retval; \
++})
++
+ #define _percpu_add(pcp, val) \
+- __percpu_add(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
++ _pcp_protect(__percpu_add, pcp, val)
+
+-#define _percpu_add_return(pcp, val) (typeof(pcp)) (_percpu_add(pcp, val))
++#define _percpu_add_return(pcp, val) _percpu_add(pcp, val)
+
+ #define _percpu_and(pcp, val) \
+- __percpu_and(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
++ _pcp_protect(__percpu_and, pcp, val)
+
+ #define _percpu_or(pcp, val) \
+- __percpu_or(raw_cpu_ptr(&(pcp)), val, sizeof(pcp))
+-
+-#define _percpu_read(pcp) (typeof(pcp)) \
+- (__percpu_read(raw_cpu_ptr(&(pcp)), sizeof(pcp)))
+-
+-#define _percpu_write(pcp, val) \
+- __percpu_write(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp))
++ _pcp_protect(__percpu_or, pcp, val)
+
+ #define _percpu_xchg(pcp, val) (typeof(pcp)) \
+- (__percpu_xchg(raw_cpu_ptr(&(pcp)), (unsigned long)(val), sizeof(pcp)))
++ _pcp_protect(__percpu_xchg, pcp, (unsigned long)(val))
+
+ #define this_cpu_add_1(pcp, val) _percpu_add(pcp, val)
+ #define this_cpu_add_2(pcp, val) _percpu_add(pcp, val)
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+index 1382fec..7fcb1ac 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-0.dtsi
+@@ -50,6 +50,7 @@ ethernet@b0000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b0000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+index 221cd2e..9f25427 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-1.dtsi
+@@ -50,6 +50,7 @@ ethernet@b1000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b1000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+index 61456c3..cd7c318 100644
+--- a/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
++++ b/arch/powerpc/boot/dts/fsl/pq3-etsec2-2.dtsi
+@@ -49,6 +49,7 @@ ethernet@b2000 {
+ fsl,num_tx_queues = <0x8>;
+ fsl,magic-packet;
+ local-mac-address = [ 00 00 00 00 00 00 ];
++ ranges;
+
+ queue-group@b2000 {
+ #address-cells = <1>;
+diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
+index c2df815..9519e6b 100644
+--- a/arch/powerpc/kernel/exceptions-64s.S
++++ b/arch/powerpc/kernel/exceptions-64s.S
+@@ -1408,7 +1408,7 @@ machine_check_handle_early:
+ bne 9f /* continue in V mode if we are. */
+
+ 5:
+-#ifdef CONFIG_KVM_BOOK3S_64_HV
++#ifdef CONFIG_KVM_BOOK3S_64_HANDLER
+ /*
+ * We are coming from kernel context. Check if we are coming from
+ * guest. if yes, then we can continue. We will fall through
+diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c
+index e7cb6d4..f8c9ff7 100644
+--- a/arch/powerpc/platforms/pseries/mobility.c
++++ b/arch/powerpc/platforms/pseries/mobility.c
+@@ -25,10 +25,10 @@
+ static struct kobject *mobility_kobj;
+
+ struct update_props_workarea {
+- u32 phandle;
+- u32 state;
+- u64 reserved;
+- u32 nprops;
++ __be32 phandle;
++ __be32 state;
++ __be64 reserved;
++ __be32 nprops;
+ } __packed;
+
+ #define NODE_ACTION_MASK 0xff000000
+@@ -54,11 +54,11 @@ static int mobility_rtas_call(int token, char *buf, s32 scope)
+ return rc;
+ }
+
+-static int delete_dt_node(u32 phandle)
++static int delete_dt_node(__be32 phandle)
+ {
+ struct device_node *dn;
+
+- dn = of_find_node_by_phandle(phandle);
++ dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ if (!dn)
+ return -ENOENT;
+
+@@ -127,7 +127,7 @@ static int update_dt_property(struct device_node *dn, struct property **prop,
+ return 0;
+ }
+
+-static int update_dt_node(u32 phandle, s32 scope)
++static int update_dt_node(__be32 phandle, s32 scope)
+ {
+ struct update_props_workarea *upwa;
+ struct device_node *dn;
+@@ -136,6 +136,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ char *prop_data;
+ char *rtas_buf;
+ int update_properties_token;
++ u32 nprops;
+ u32 vd;
+
+ update_properties_token = rtas_token("ibm,update-properties");
+@@ -146,7 +147,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ if (!rtas_buf)
+ return -ENOMEM;
+
+- dn = of_find_node_by_phandle(phandle);
++ dn = of_find_node_by_phandle(be32_to_cpu(phandle));
+ if (!dn) {
+ kfree(rtas_buf);
+ return -ENOENT;
+@@ -162,6 +163,7 @@ static int update_dt_node(u32 phandle, s32 scope)
+ break;
+
+ prop_data = rtas_buf + sizeof(*upwa);
++ nprops = be32_to_cpu(upwa->nprops);
+
+ /* On the first call to ibm,update-properties for a node the
+ * the first property value descriptor contains an empty
+@@ -170,17 +172,17 @@ static int update_dt_node(u32 phandle, s32 scope)
+ */
+ if (*prop_data == 0) {
+ prop_data++;
+- vd = *(u32 *)prop_data;
++ vd = be32_to_cpu(*(__be32 *)prop_data);
+ prop_data += vd + sizeof(vd);
+- upwa->nprops--;
++ nprops--;
+ }
+
+- for (i = 0; i < upwa->nprops; i++) {
++ for (i = 0; i < nprops; i++) {
+ char *prop_name;
+
+ prop_name = prop_data;
+ prop_data += strlen(prop_name) + 1;
+- vd = *(u32 *)prop_data;
++ vd = be32_to_cpu(*(__be32 *)prop_data);
+ prop_data += sizeof(vd);
+
+ switch (vd) {
+@@ -212,13 +214,13 @@ static int update_dt_node(u32 phandle, s32 scope)
+ return 0;
+ }
+
+-static int add_dt_node(u32 parent_phandle, u32 drc_index)
++static int add_dt_node(__be32 parent_phandle, __be32 drc_index)
+ {
+ struct device_node *dn;
+ struct device_node *parent_dn;
+ int rc;
+
+- parent_dn = of_find_node_by_phandle(parent_phandle);
++ parent_dn = of_find_node_by_phandle(be32_to_cpu(parent_phandle));
+ if (!parent_dn)
+ return -ENOENT;
+
+@@ -237,7 +239,7 @@ static int add_dt_node(u32 parent_phandle, u32 drc_index)
+ int pseries_devicetree_update(s32 scope)
+ {
+ char *rtas_buf;
+- u32 *data;
++ __be32 *data;
+ int update_nodes_token;
+ int rc;
+
+@@ -254,17 +256,17 @@ int pseries_devicetree_update(s32 scope)
+ if (rc && rc != 1)
+ break;
+
+- data = (u32 *)rtas_buf + 4;
+- while (*data & NODE_ACTION_MASK) {
++ data = (__be32 *)rtas_buf + 4;
++ while (be32_to_cpu(*data) & NODE_ACTION_MASK) {
+ int i;
+- u32 action = *data & NODE_ACTION_MASK;
+- int node_count = *data & NODE_COUNT_MASK;
++ u32 action = be32_to_cpu(*data) & NODE_ACTION_MASK;
++ u32 node_count = be32_to_cpu(*data) & NODE_COUNT_MASK;
+
+ data++;
+
+ for (i = 0; i < node_count; i++) {
+- u32 phandle = *data++;
+- u32 drc_index;
++ __be32 phandle = *data++;
++ __be32 drc_index;
+
+ switch (action) {
+ case DELETE_DT_NODE:
+diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
+index 0da5865..8e1f5f6 100644
+--- a/drivers/base/regmap/internal.h
++++ b/drivers/base/regmap/internal.h
+@@ -237,4 +237,12 @@ extern struct regcache_ops regcache_rbtree_ops;
+ extern struct regcache_ops regcache_lzo_ops;
+ extern struct regcache_ops regcache_flat_ops;
+
++static inline const char *regmap_name(const struct regmap *map)
++{
++ if (map->dev)
++ return dev_name(map->dev);
++
++ return map->name;
++}
++
+ #endif
+diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
+index d453a2c..81751a4 100644
+--- a/drivers/base/regmap/regcache-rbtree.c
++++ b/drivers/base/regmap/regcache-rbtree.c
+@@ -307,7 +307,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
+ if (pos == 0) {
+ memmove(blk + offset * map->cache_word_size,
+ blk, rbnode->blklen * map->cache_word_size);
+- bitmap_shift_right(present, present, offset, blklen);
++ bitmap_shift_left(present, present, offset, blklen);
+ }
+
+ /* update the rbnode block, its size and the base register */
+diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
+index f373c35..f5db662 100644
+--- a/drivers/base/regmap/regcache.c
++++ b/drivers/base/regmap/regcache.c
+@@ -218,7 +218,7 @@ int regcache_read(struct regmap *map,
+ ret = map->cache_ops->read(map, reg, value);
+
+ if (ret == 0)
+- trace_regmap_reg_read_cache(map->dev, reg, *value);
++ trace_regmap_reg_read_cache(map, reg, *value);
+
+ return ret;
+ }
+@@ -311,7 +311,7 @@ int regcache_sync(struct regmap *map)
+ dev_dbg(map->dev, "Syncing %s cache\n",
+ map->cache_ops->name);
+ name = map->cache_ops->name;
+- trace_regcache_sync(map->dev, name, "start");
++ trace_regcache_sync(map, name, "start");
+
+ if (!map->cache_dirty)
+ goto out;
+@@ -346,7 +346,7 @@ out:
+
+ regmap_async_complete(map);
+
+- trace_regcache_sync(map->dev, name, "stop");
++ trace_regcache_sync(map, name, "stop");
+
+ return ret;
+ }
+@@ -381,7 +381,7 @@ int regcache_sync_region(struct regmap *map, unsigned int min,
+ name = map->cache_ops->name;
+ dev_dbg(map->dev, "Syncing %s cache from %d-%d\n", name, min, max);
+
+- trace_regcache_sync(map->dev, name, "start region");
++ trace_regcache_sync(map, name, "start region");
+
+ if (!map->cache_dirty)
+ goto out;
+@@ -401,7 +401,7 @@ out:
+
+ regmap_async_complete(map);
+
+- trace_regcache_sync(map->dev, name, "stop region");
++ trace_regcache_sync(map, name, "stop region");
+
+ return ret;
+ }
+@@ -428,7 +428,7 @@ int regcache_drop_region(struct regmap *map, unsigned int min,
+
+ map->lock(map->lock_arg);
+
+- trace_regcache_drop_region(map->dev, min, max);
++ trace_regcache_drop_region(map, min, max);
+
+ ret = map->cache_ops->drop(map, min, max);
+
+@@ -455,7 +455,7 @@ void regcache_cache_only(struct regmap *map, bool enable)
+ map->lock(map->lock_arg);
+ WARN_ON(map->cache_bypass && enable);
+ map->cache_only = enable;
+- trace_regmap_cache_only(map->dev, enable);
++ trace_regmap_cache_only(map, enable);
+ map->unlock(map->lock_arg);
+ }
+ EXPORT_SYMBOL_GPL(regcache_cache_only);
+@@ -493,7 +493,7 @@ void regcache_cache_bypass(struct regmap *map, bool enable)
+ map->lock(map->lock_arg);
+ WARN_ON(map->cache_only && enable);
+ map->cache_bypass = enable;
+- trace_regmap_cache_bypass(map->dev, enable);
++ trace_regmap_cache_bypass(map, enable);
+ map->unlock(map->lock_arg);
+ }
+ EXPORT_SYMBOL_GPL(regcache_cache_bypass);
+diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
+index d2f8a81..ee731bb 100644
+--- a/drivers/base/regmap/regmap.c
++++ b/drivers/base/regmap/regmap.c
+@@ -1280,7 +1280,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ if (map->async && map->bus->async_write) {
+ struct regmap_async *async;
+
+- trace_regmap_async_write_start(map->dev, reg, val_len);
++ trace_regmap_async_write_start(map, reg, val_len);
+
+ spin_lock_irqsave(&map->async_lock, flags);
+ async = list_first_entry_or_null(&map->async_free,
+@@ -1338,8 +1338,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ return ret;
+ }
+
+- trace_regmap_hw_write_start(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_write_start(map, reg, val_len / map->format.val_bytes);
+
+ /* If we're doing a single register write we can probably just
+ * send the work_buf directly, otherwise try to do a gather
+@@ -1371,8 +1370,7 @@ int _regmap_raw_write(struct regmap *map, unsigned int reg,
+ kfree(buf);
+ }
+
+- trace_regmap_hw_write_done(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_write_done(map, reg, val_len / map->format.val_bytes);
+
+ return ret;
+ }
+@@ -1406,12 +1404,12 @@ static int _regmap_bus_formatted_write(void *context, unsigned int reg,
+
+ map->format.format_write(map, reg, val);
+
+- trace_regmap_hw_write_start(map->dev, reg, 1);
++ trace_regmap_hw_write_start(map, reg, 1);
+
+ ret = map->bus->write(map->bus_context, map->work_buf,
+ map->format.buf_size);
+
+- trace_regmap_hw_write_done(map->dev, reg, 1);
++ trace_regmap_hw_write_done(map, reg, 1);
+
+ return ret;
+ }
+@@ -1469,7 +1467,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
+ dev_info(map->dev, "%x <= %x\n", reg, val);
+ #endif
+
+- trace_regmap_reg_write(map->dev, reg, val);
++ trace_regmap_reg_write(map, reg, val);
+
+ return map->reg_write(context, reg, val);
+ }
+@@ -1772,7 +1770,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
+ for (i = 0; i < num_regs; i++) {
+ int reg = regs[i].reg;
+ int val = regs[i].def;
+- trace_regmap_hw_write_start(map->dev, reg, 1);
++ trace_regmap_hw_write_start(map, reg, 1);
+ map->format.format_reg(u8, reg, map->reg_shift);
+ u8 += reg_bytes + pad_bytes;
+ map->format.format_val(u8, val, 0);
+@@ -1787,7 +1785,7 @@ static int _regmap_raw_multi_reg_write(struct regmap *map,
+
+ for (i = 0; i < num_regs; i++) {
+ int reg = regs[i].reg;
+- trace_regmap_hw_write_done(map->dev, reg, 1);
++ trace_regmap_hw_write_done(map, reg, 1);
+ }
+ return ret;
+ }
+@@ -2058,15 +2056,13 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
+ */
+ u8[0] |= map->read_flag_mask;
+
+- trace_regmap_hw_read_start(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_read_start(map, reg, val_len / map->format.val_bytes);
+
+ ret = map->bus->read(map->bus_context, map->work_buf,
+ map->format.reg_bytes + map->format.pad_bytes,
+ val, val_len);
+
+- trace_regmap_hw_read_done(map->dev, reg,
+- val_len / map->format.val_bytes);
++ trace_regmap_hw_read_done(map, reg, val_len / map->format.val_bytes);
+
+ return ret;
+ }
+@@ -2122,7 +2118,7 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
+ dev_info(map->dev, "%x => %x\n", reg, *val);
+ #endif
+
+- trace_regmap_reg_read(map->dev, reg, *val);
++ trace_regmap_reg_read(map, reg, *val);
+
+ if (!map->cache_bypass)
+ regcache_write(map, reg, *val);
+@@ -2479,7 +2475,7 @@ void regmap_async_complete_cb(struct regmap_async *async, int ret)
+ struct regmap *map = async->map;
+ bool wake;
+
+- trace_regmap_async_io_complete(map->dev);
++ trace_regmap_async_io_complete(map);
+
+ spin_lock(&map->async_lock);
+ list_move(&async->list, &map->async_free);
+@@ -2524,7 +2520,7 @@ int regmap_async_complete(struct regmap *map)
+ if (!map->bus || !map->bus->async_write)
+ return 0;
+
+- trace_regmap_async_complete_start(map->dev);
++ trace_regmap_async_complete_start(map);
+
+ wait_event(map->async_waitq, regmap_async_is_done(map));
+
+@@ -2533,7 +2529,7 @@ int regmap_async_complete(struct regmap *map)
+ map->async_ret = 0;
+ spin_unlock_irqrestore(&map->async_lock, flags);
+
+- trace_regmap_async_complete_done(map->dev);
++ trace_regmap_async_complete_done(map);
+
+ return ret;
+ }
+diff --git a/drivers/clocksource/time-efm32.c b/drivers/clocksource/time-efm32.c
+index bba62f9..ec57ba2 100644
+--- a/drivers/clocksource/time-efm32.c
++++ b/drivers/clocksource/time-efm32.c
+@@ -225,12 +225,12 @@ static int __init efm32_clockevent_init(struct device_node *np)
+ clock_event_ddata.base = base;
+ clock_event_ddata.periodic_top = DIV_ROUND_CLOSEST(rate, 1024 * HZ);
+
+- setup_irq(irq, &efm32_clock_event_irq);
+-
+ clockevents_config_and_register(&clock_event_ddata.evtdev,
+ DIV_ROUND_CLOSEST(rate, 1024),
+ 0xf, 0xffff);
+
++ setup_irq(irq, &efm32_clock_event_irq);
++
+ return 0;
+
+ err_get_irq:
+diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
+index 0226844..5dcbf90 100644
+--- a/drivers/clocksource/timer-sun5i.c
++++ b/drivers/clocksource/timer-sun5i.c
+@@ -178,10 +178,6 @@ static void __init sun5i_timer_init(struct device_node *node)
+
+ ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+
+- ret = setup_irq(irq, &sun5i_timer_irq);
+- if (ret)
+- pr_warn("failed to setup irq %d\n", irq);
+-
+ /* Enable timer0 interrupt */
+ val = readl(timer_base + TIMER_IRQ_EN_REG);
+ writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+@@ -191,6 +187,10 @@ static void __init sun5i_timer_init(struct device_node *node)
+
+ clockevents_config_and_register(&sun5i_clockevent, rate,
+ TIMER_SYNC_TICKS, 0xffffffff);
++
++ ret = setup_irq(irq, &sun5i_timer_irq);
++ if (ret)
++ pr_warn("failed to setup irq %d\n", irq);
+ }
+ CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
+ sun5i_timer_init);
+diff --git a/drivers/cpuidle/cpuidle-mvebu-v7.c b/drivers/cpuidle/cpuidle-mvebu-v7.c
+index 38e6861..cefa074 100644
+--- a/drivers/cpuidle/cpuidle-mvebu-v7.c
++++ b/drivers/cpuidle/cpuidle-mvebu-v7.c
+@@ -37,11 +37,11 @@ static int mvebu_v7_enter_idle(struct cpuidle_device *dev,
+ deepidle = true;
+
+ ret = mvebu_v7_cpu_suspend(deepidle);
++ cpu_pm_exit();
++
+ if (ret)
+ return ret;
+
+- cpu_pm_exit();
+-
+ return index;
+ }
+
+diff --git a/drivers/dma/dw/platform.c b/drivers/dma/dw/platform.c
+index 32ea1ac..272f01f 100644
+--- a/drivers/dma/dw/platform.c
++++ b/drivers/dma/dw/platform.c
+@@ -26,6 +26,8 @@
+
+ #include "internal.h"
+
++#define DRV_NAME "dw_dmac"
++
+ static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec,
+ struct of_dma *ofdma)
+ {
+@@ -284,7 +286,7 @@ static struct platform_driver dw_driver = {
+ .remove = dw_remove,
+ .shutdown = dw_shutdown,
+ .driver = {
+- .name = "dw_dmac",
++ .name = DRV_NAME,
+ .pm = &dw_dev_pm_ops,
+ .of_match_table = of_match_ptr(dw_dma_of_id_table),
+ .acpi_match_table = ACPI_PTR(dw_dma_acpi_id_table),
+@@ -305,3 +307,4 @@ module_exit(dw_exit);
+
+ MODULE_LICENSE("GPL v2");
+ MODULE_DESCRIPTION("Synopsys DesignWare DMA Controller platform driver");
++MODULE_ALIAS("platform:" DRV_NAME);
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 23e26e0..2176874 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -120,32 +120,41 @@ void synaptics_reset(struct psmouse *psmouse)
+
+ static bool cr48_profile_sensor;
+
++#define ANY_BOARD_ID 0
+ struct min_max_quirk {
+ const char * const *pnp_ids;
++ struct {
++ unsigned long int min, max;
++ } board_id;
+ int x_min, x_max, y_min, y_max;
+ };
+
+ static const struct min_max_quirk min_max_pnpid_table[] = {
+ {
+ (const char * const []){"LEN0033", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1024, 5052, 2258, 4832
+ },
+ {
+- (const char * const []){"LEN0035", "LEN0042", NULL},
++ (const char * const []){"LEN0042", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1232, 5710, 1156, 4696
+ },
+ {
+ (const char * const []){"LEN0034", "LEN0036", "LEN0037",
+ "LEN0039", "LEN2002", "LEN2004",
+ NULL},
++ {ANY_BOARD_ID, 2961},
+ 1024, 5112, 2024, 4832
+ },
+ {
+ (const char * const []){"LEN2001", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1024, 5022, 2508, 4832
+ },
+ {
+ (const char * const []){"LEN2006", NULL},
++ {ANY_BOARD_ID, ANY_BOARD_ID},
+ 1264, 5675, 1171, 4688
+ },
+ { }
+@@ -241,6 +250,10 @@ static int synaptics_board_id(struct psmouse *psmouse)
+ struct synaptics_data *priv = psmouse->private;
+ unsigned char bid[3];
+
++ /* firmwares prior 7.5 have no board_id encoded */
++ if (SYN_ID_FULL(priv->identity) < 0x705)
++ return 0;
++
+ if (synaptics_send_cmd(psmouse, SYN_QUE_MODES, bid))
+ return -1;
+ priv->board_id = ((bid[0] & 0xfc) << 6) | bid[1];
+@@ -343,7 +356,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ {
+ struct synaptics_data *priv = psmouse->private;
+ unsigned char resp[3];
+- int i;
+
+ if (SYN_ID_MAJOR(priv->identity) < 4)
+ return 0;
+@@ -355,17 +367,6 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ }
+ }
+
+- for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
+- if (psmouse_matches_pnp_id(psmouse,
+- min_max_pnpid_table[i].pnp_ids)) {
+- priv->x_min = min_max_pnpid_table[i].x_min;
+- priv->x_max = min_max_pnpid_table[i].x_max;
+- priv->y_min = min_max_pnpid_table[i].y_min;
+- priv->y_max = min_max_pnpid_table[i].y_max;
+- return 0;
+- }
+- }
+-
+ if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 5 &&
+ SYN_CAP_MAX_DIMENSIONS(priv->ext_cap_0c)) {
+ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MAX_COORDS, resp)) {
+@@ -374,23 +375,69 @@ static int synaptics_resolution(struct psmouse *psmouse)
+ } else {
+ priv->x_max = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
+ priv->y_max = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
++ psmouse_info(psmouse,
++ "queried max coordinates: x [..%d], y [..%d]\n",
++ priv->x_max, priv->y_max);
+ }
+ }
+
+- if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 &&
+- SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c)) {
++ if (SYN_CAP_MIN_DIMENSIONS(priv->ext_cap_0c) &&
++ (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 7 ||
++ /*
++ * Firmware v8.1 does not report proper number of extended
++ * capabilities, but has been proven to report correct min
++ * coordinates.
++ */
++ SYN_ID_FULL(priv->identity) == 0x801)) {
+ if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_MIN_COORDS, resp)) {
+ psmouse_warn(psmouse,
+ "device claims to have min coordinates query, but I'm not able to read it.\n");
+ } else {
+ priv->x_min = (resp[0] << 5) | ((resp[1] & 0x0f) << 1);
+ priv->y_min = (resp[2] << 5) | ((resp[1] & 0xf0) >> 3);
++ psmouse_info(psmouse,
++ "queried min coordinates: x [%d..], y [%d..]\n",
++ priv->x_min, priv->y_min);
+ }
+ }
+
+ return 0;
+ }
+
++/*
++ * Apply quirk(s) if the hardware matches
++ */
++
++static void synaptics_apply_quirks(struct psmouse *psmouse)
++{
++ struct synaptics_data *priv = psmouse->private;
++ int i;
++
++ for (i = 0; min_max_pnpid_table[i].pnp_ids; i++) {
++ if (!psmouse_matches_pnp_id(psmouse,
++ min_max_pnpid_table[i].pnp_ids))
++ continue;
++
++ if (min_max_pnpid_table[i].board_id.min != ANY_BOARD_ID &&
++ priv->board_id < min_max_pnpid_table[i].board_id.min)
++ continue;
++
++ if (min_max_pnpid_table[i].board_id.max != ANY_BOARD_ID &&
++ priv->board_id > min_max_pnpid_table[i].board_id.max)
++ continue;
++
++ priv->x_min = min_max_pnpid_table[i].x_min;
++ priv->x_max = min_max_pnpid_table[i].x_max;
++ priv->y_min = min_max_pnpid_table[i].y_min;
++ priv->y_max = min_max_pnpid_table[i].y_max;
++ psmouse_info(psmouse,
++ "quirked min/max coordinates: x [%d..%d], y [%d..%d]\n",
++ priv->x_min, priv->x_max,
++ priv->y_min, priv->y_max);
++ break;
++ }
++}
++
+ static int synaptics_query_hardware(struct psmouse *psmouse)
+ {
+ if (synaptics_identify(psmouse))
+@@ -406,6 +453,8 @@ static int synaptics_query_hardware(struct psmouse *psmouse)
+ if (synaptics_resolution(psmouse))
+ return -1;
+
++ synaptics_apply_quirks(psmouse);
++
+ return 0;
+ }
+
+@@ -613,6 +662,18 @@ static void synaptics_parse_agm(const unsigned char buf[],
+ priv->agm_pending = true;
+ }
+
++static void synaptics_parse_ext_buttons(const unsigned char buf[],
++ struct synaptics_data *priv,
++ struct synaptics_hw_state *hw)
++{
++ unsigned int ext_bits =
++ (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++ unsigned int ext_mask = GENMASK(ext_bits - 1, 0);
++
++ hw->ext_buttons = buf[4] & ext_mask;
++ hw->ext_buttons |= (buf[5] & ext_mask) << ext_bits;
++}
++
+ static bool is_forcepad;
+
+ static int synaptics_parse_hw_state(const unsigned char buf[],
+@@ -699,28 +760,9 @@ static int synaptics_parse_hw_state(const unsigned char buf[],
+ hw->down = ((buf[0] ^ buf[3]) & 0x02) ? 1 : 0;
+ }
+
+- if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) &&
++ if (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) > 0 &&
+ ((buf[0] ^ buf[3]) & 0x02)) {
+- switch (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) & ~0x01) {
+- default:
+- /*
+- * if nExtBtn is greater than 8 it should be
+- * considered invalid and treated as 0
+- */
+- break;
+- case 8:
+- hw->ext_buttons |= ((buf[5] & 0x08)) ? 0x80 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x08)) ? 0x40 : 0;
+- case 6:
+- hw->ext_buttons |= ((buf[5] & 0x04)) ? 0x20 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x04)) ? 0x10 : 0;
+- case 4:
+- hw->ext_buttons |= ((buf[5] & 0x02)) ? 0x08 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x02)) ? 0x04 : 0;
+- case 2:
+- hw->ext_buttons |= ((buf[5] & 0x01)) ? 0x02 : 0;
+- hw->ext_buttons |= ((buf[4] & 0x01)) ? 0x01 : 0;
+- }
++ synaptics_parse_ext_buttons(buf, priv, hw);
+ }
+ } else {
+ hw->x = (((buf[1] & 0x1f) << 8) | buf[2]);
+@@ -782,12 +824,35 @@ static void synaptics_report_semi_mt_data(struct input_dev *dev,
+ }
+ }
+
++static void synaptics_report_ext_buttons(struct psmouse *psmouse,
++ const struct synaptics_hw_state *hw)
++{
++ struct input_dev *dev = psmouse->dev;
++ struct synaptics_data *priv = psmouse->private;
++ int ext_bits = (SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap) + 1) >> 1;
++ int i;
++
++ if (!SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap))
++ return;
++
++ /* Bug in FW 8.1, buttons are reported only when ExtBit is 1 */
++ if (SYN_ID_FULL(priv->identity) == 0x801 &&
++ !((psmouse->packet[0] ^ psmouse->packet[3]) & 0x02))
++ return;
++
++ for (i = 0; i < ext_bits; i++) {
++ input_report_key(dev, BTN_0 + 2 * i,
++ hw->ext_buttons & (1 << i));
++ input_report_key(dev, BTN_1 + 2 * i,
++ hw->ext_buttons & (1 << (i + ext_bits)));
++ }
++}
++
+ static void synaptics_report_buttons(struct psmouse *psmouse,
+ const struct synaptics_hw_state *hw)
+ {
+ struct input_dev *dev = psmouse->dev;
+ struct synaptics_data *priv = psmouse->private;
+- int i;
+
+ input_report_key(dev, BTN_LEFT, hw->left);
+ input_report_key(dev, BTN_RIGHT, hw->right);
+@@ -800,8 +865,7 @@ static void synaptics_report_buttons(struct psmouse *psmouse,
+ input_report_key(dev, BTN_BACK, hw->down);
+ }
+
+- for (i = 0; i < SYN_CAP_MULTI_BUTTON_NO(priv->ext_cap); i++)
+- input_report_key(dev, BTN_0 + i, hw->ext_buttons & (1 << i));
++ synaptics_report_ext_buttons(psmouse, hw);
+ }
+
+ static void synaptics_report_slot(struct input_dev *dev, int slot,
+diff --git a/drivers/md/dm-io.c b/drivers/md/dm-io.c
+index 37de017..74adcd2 100644
+--- a/drivers/md/dm-io.c
++++ b/drivers/md/dm-io.c
+@@ -289,9 +289,16 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ struct request_queue *q = bdev_get_queue(where->bdev);
+ unsigned short logical_block_size = queue_logical_block_size(q);
+ sector_t num_sectors;
++ unsigned int uninitialized_var(special_cmd_max_sectors);
+
+- /* Reject unsupported discard requests */
+- if ((rw & REQ_DISCARD) && !blk_queue_discard(q)) {
++ /*
++ * Reject unsupported discard and write same requests.
++ */
++ if (rw & REQ_DISCARD)
++ special_cmd_max_sectors = q->limits.max_discard_sectors;
++ else if (rw & REQ_WRITE_SAME)
++ special_cmd_max_sectors = q->limits.max_write_same_sectors;
++ if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+ dec_count(io, region, -EOPNOTSUPP);
+ return;
+ }
+@@ -317,7 +324,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ store_io_and_region_in_bio(bio, io, region);
+
+ if (rw & REQ_DISCARD) {
+- num_sectors = min_t(sector_t, q->limits.max_discard_sectors, remaining);
++ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+ remaining -= num_sectors;
+ } else if (rw & REQ_WRITE_SAME) {
+@@ -326,7 +333,7 @@ static void do_region(int rw, unsigned region, struct dm_io_region *where,
+ */
+ dp->get_page(dp, &page, &len, &offset);
+ bio_add_page(bio, page, logical_block_size, offset);
+- num_sectors = min_t(sector_t, q->limits.max_write_same_sectors, remaining);
++ num_sectors = min_t(sector_t, special_cmd_max_sectors, remaining);
+ bio->bi_iter.bi_size = num_sectors << SECTOR_SHIFT;
+
+ offset = 0;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 8b204ae2..f83a0f3 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -20,6 +20,8 @@
+ #include <linux/log2.h>
+ #include <linux/dm-kcopyd.h>
+
++#include "dm.h"
++
+ #include "dm-exception-store.h"
+
+ #define DM_MSG_PREFIX "snapshots"
+@@ -291,12 +293,23 @@ struct origin {
+ };
+
+ /*
++ * This structure is allocated for each origin target
++ */
++struct dm_origin {
++ struct dm_dev *dev;
++ struct dm_target *ti;
++ unsigned split_boundary;
++ struct list_head hash_list;
++};
++
++/*
+ * Size of the hash table for origin volumes. If we make this
+ * the size of the minors list then it should be nearly perfect
+ */
+ #define ORIGIN_HASH_SIZE 256
+ #define ORIGIN_MASK 0xFF
+ static struct list_head *_origins;
++static struct list_head *_dm_origins;
+ static struct rw_semaphore _origins_lock;
+
+ static DECLARE_WAIT_QUEUE_HEAD(_pending_exceptions_done);
+@@ -310,12 +323,22 @@ static int init_origin_hash(void)
+ _origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
+ GFP_KERNEL);
+ if (!_origins) {
+- DMERR("unable to allocate memory");
++ DMERR("unable to allocate memory for _origins");
+ return -ENOMEM;
+ }
+-
+ for (i = 0; i < ORIGIN_HASH_SIZE; i++)
+ INIT_LIST_HEAD(_origins + i);
++
++ _dm_origins = kmalloc(ORIGIN_HASH_SIZE * sizeof(struct list_head),
++ GFP_KERNEL);
++ if (!_dm_origins) {
++ DMERR("unable to allocate memory for _dm_origins");
++ kfree(_origins);
++ return -ENOMEM;
++ }
++ for (i = 0; i < ORIGIN_HASH_SIZE; i++)
++ INIT_LIST_HEAD(_dm_origins + i);
++
+ init_rwsem(&_origins_lock);
+
+ return 0;
+@@ -324,6 +347,7 @@ static int init_origin_hash(void)
+ static void exit_origin_hash(void)
+ {
+ kfree(_origins);
++ kfree(_dm_origins);
+ }
+
+ static unsigned origin_hash(struct block_device *bdev)
+@@ -350,6 +374,30 @@ static void __insert_origin(struct origin *o)
+ list_add_tail(&o->hash_list, sl);
+ }
+
++static struct dm_origin *__lookup_dm_origin(struct block_device *origin)
++{
++ struct list_head *ol;
++ struct dm_origin *o;
++
++ ol = &_dm_origins[origin_hash(origin)];
++ list_for_each_entry (o, ol, hash_list)
++ if (bdev_equal(o->dev->bdev, origin))
++ return o;
++
++ return NULL;
++}
++
++static void __insert_dm_origin(struct dm_origin *o)
++{
++ struct list_head *sl = &_dm_origins[origin_hash(o->dev->bdev)];
++ list_add_tail(&o->hash_list, sl);
++}
++
++static void __remove_dm_origin(struct dm_origin *o)
++{
++ list_del(&o->hash_list);
++}
++
+ /*
+ * _origins_lock must be held when calling this function.
+ * Returns number of snapshots registered using the supplied cow device, plus:
+@@ -1840,9 +1888,40 @@ static int snapshot_preresume(struct dm_target *ti)
+ static void snapshot_resume(struct dm_target *ti)
+ {
+ struct dm_snapshot *s = ti->private;
+- struct dm_snapshot *snap_src = NULL, *snap_dest = NULL;
++ struct dm_snapshot *snap_src = NULL, *snap_dest = NULL, *snap_merging = NULL;
++ struct dm_origin *o;
++ struct mapped_device *origin_md = NULL;
++ bool must_restart_merging = false;
+
+ down_read(&_origins_lock);
++
++ o = __lookup_dm_origin(s->origin->bdev);
++ if (o)
++ origin_md = dm_table_get_md(o->ti->table);
++ if (!origin_md) {
++ (void) __find_snapshots_sharing_cow(s, NULL, NULL, &snap_merging);
++ if (snap_merging)
++ origin_md = dm_table_get_md(snap_merging->ti->table);
++ }
++ if (origin_md == dm_table_get_md(ti->table))
++ origin_md = NULL;
++ if (origin_md) {
++ if (dm_hold(origin_md))
++ origin_md = NULL;
++ }
++
++ up_read(&_origins_lock);
++
++ if (origin_md) {
++ dm_internal_suspend_fast(origin_md);
++ if (snap_merging && test_bit(RUNNING_MERGE, &snap_merging->state_bits)) {
++ must_restart_merging = true;
++ stop_merge(snap_merging);
++ }
++ }
++
++ down_read(&_origins_lock);
++
+ (void) __find_snapshots_sharing_cow(s, &snap_src, &snap_dest, NULL);
+ if (snap_src && snap_dest) {
+ down_write(&snap_src->lock);
+@@ -1851,8 +1930,16 @@ static void snapshot_resume(struct dm_target *ti)
+ up_write(&snap_dest->lock);
+ up_write(&snap_src->lock);
+ }
++
+ up_read(&_origins_lock);
+
++ if (origin_md) {
++ if (must_restart_merging)
++ start_merge(snap_merging);
++ dm_internal_resume_fast(origin_md);
++ dm_put(origin_md);
++ }
++
+ /* Now we have correct chunk size, reregister */
+ reregister_snapshot(s);
+
+@@ -2133,11 +2220,6 @@ static int origin_write_extent(struct dm_snapshot *merging_snap,
+ * Origin: maps a linear range of a device, with hooks for snapshotting.
+ */
+
+-struct dm_origin {
+- struct dm_dev *dev;
+- unsigned split_boundary;
+-};
+-
+ /*
+ * Construct an origin mapping: <dev_path>
+ * The context for an origin is merely a 'struct dm_dev *'
+@@ -2166,6 +2248,7 @@ static int origin_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ goto bad_open;
+ }
+
++ o->ti = ti;
+ ti->private = o;
+ ti->num_flush_bios = 1;
+
+@@ -2180,6 +2263,7 @@ bad_alloc:
+ static void origin_dtr(struct dm_target *ti)
+ {
+ struct dm_origin *o = ti->private;
++
+ dm_put_device(ti, o->dev);
+ kfree(o);
+ }
+@@ -2216,6 +2300,19 @@ static void origin_resume(struct dm_target *ti)
+ struct dm_origin *o = ti->private;
+
+ o->split_boundary = get_origin_minimum_chunksize(o->dev->bdev);
++
++ down_write(&_origins_lock);
++ __insert_dm_origin(o);
++ up_write(&_origins_lock);
++}
++
++static void origin_postsuspend(struct dm_target *ti)
++{
++ struct dm_origin *o = ti->private;
++
++ down_write(&_origins_lock);
++ __remove_dm_origin(o);
++ up_write(&_origins_lock);
+ }
+
+ static void origin_status(struct dm_target *ti, status_type_t type,
+@@ -2258,12 +2355,13 @@ static int origin_iterate_devices(struct dm_target *ti,
+
+ static struct target_type origin_target = {
+ .name = "snapshot-origin",
+- .version = {1, 8, 1},
++ .version = {1, 9, 0},
+ .module = THIS_MODULE,
+ .ctr = origin_ctr,
+ .dtr = origin_dtr,
+ .map = origin_map,
+ .resume = origin_resume,
++ .postsuspend = origin_postsuspend,
+ .status = origin_status,
+ .merge = origin_merge,
+ .iterate_devices = origin_iterate_devices,
+@@ -2271,7 +2369,7 @@ static struct target_type origin_target = {
+
+ static struct target_type snapshot_target = {
+ .name = "snapshot",
+- .version = {1, 12, 0},
++ .version = {1, 13, 0},
+ .module = THIS_MODULE,
+ .ctr = snapshot_ctr,
+ .dtr = snapshot_dtr,
+@@ -2285,7 +2383,7 @@ static struct target_type snapshot_target = {
+
+ static struct target_type merge_target = {
+ .name = dm_snapshot_merge_target_name,
+- .version = {1, 2, 0},
++ .version = {1, 3, 0},
+ .module = THIS_MODULE,
+ .ctr = snapshot_ctr,
+ .dtr = snapshot_dtr,
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 07705ee..159a113 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2357,17 +2357,6 @@ static int thin_bio_map(struct dm_target *ti, struct bio *bio)
+ return DM_MAPIO_REMAPPED;
+
+ case -ENODATA:
+- if (get_pool_mode(tc->pool) == PM_READ_ONLY) {
+- /*
+- * This block isn't provisioned, and we have no way
+- * of doing so.
+- */
+- handle_unserviceable_bio(tc->pool, bio);
+- cell_defer_no_holder(tc, virt_cell);
+- return DM_MAPIO_SUBMITTED;
+- }
+- /* fall through */
+-
+ case -EWOULDBLOCK:
+ thin_defer_cell(tc, virt_cell);
+ return DM_MAPIO_SUBMITTED;
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 64b10e0..b71c600 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -2507,6 +2507,19 @@ void dm_get(struct mapped_device *md)
+ BUG_ON(test_bit(DMF_FREEING, &md->flags));
+ }
+
++int dm_hold(struct mapped_device *md)
++{
++ spin_lock(&_minor_lock);
++ if (test_bit(DMF_FREEING, &md->flags)) {
++ spin_unlock(&_minor_lock);
++ return -EBUSY;
++ }
++ dm_get(md);
++ spin_unlock(&_minor_lock);
++ return 0;
++}
++EXPORT_SYMBOL_GPL(dm_hold);
++
+ const char *dm_device_name(struct mapped_device *md)
+ {
+ return md->name;
+@@ -2526,10 +2539,16 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
+ set_bit(DMF_FREEING, &md->flags);
+ spin_unlock(&_minor_lock);
+
++ /*
++ * Take suspend_lock so that presuspend and postsuspend methods
++ * do not race with internal suspend.
++ */
++ mutex_lock(&md->suspend_lock);
+ if (!dm_suspended_md(md)) {
+ dm_table_presuspend_targets(map);
+ dm_table_postsuspend_targets(map);
+ }
++ mutex_unlock(&md->suspend_lock);
+
+ /* dm_put_live_table must be before msleep, otherwise deadlock is possible */
+ dm_put_live_table(md, srcu_idx);
+@@ -3001,6 +3020,7 @@ void dm_internal_suspend_fast(struct mapped_device *md)
+ flush_workqueue(md->wq);
+ dm_wait_for_completion(md, TASK_UNINTERRUPTIBLE);
+ }
++EXPORT_SYMBOL_GPL(dm_internal_suspend_fast);
+
+ void dm_internal_resume_fast(struct mapped_device *md)
+ {
+@@ -3012,6 +3032,7 @@ void dm_internal_resume_fast(struct mapped_device *md)
+ done:
+ mutex_unlock(&md->suspend_lock);
+ }
++EXPORT_SYMBOL_GPL(dm_internal_resume_fast);
+
+ /*-----------------------------------------------------------------
+ * Event notification.
+diff --git a/drivers/mfd/kempld-core.c b/drivers/mfd/kempld-core.c
+index f38ec42..5615522 100644
+--- a/drivers/mfd/kempld-core.c
++++ b/drivers/mfd/kempld-core.c
+@@ -739,7 +739,7 @@ static int __init kempld_init(void)
+ for (id = kempld_dmi_table;
+ id->matches[0].slot != DMI_NONE; id++)
+ if (strstr(id->ident, force_device_id))
+- if (id->callback && id->callback(id))
++ if (id->callback && !id->callback(id))
+ break;
+ if (id->matches[0].slot == DMI_NONE)
+ return -ENODEV;
+diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
+index e2e3aaf..30f088b 100644
+--- a/drivers/net/ethernet/amd/pcnet32.c
++++ b/drivers/net/ethernet/amd/pcnet32.c
+@@ -1543,7 +1543,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ {
+ struct pcnet32_private *lp;
+ int i, media;
+- int fdx, mii, fset, dxsuflo;
++ int fdx, mii, fset, dxsuflo, sram;
+ int chip_version;
+ char *chipname;
+ struct net_device *dev;
+@@ -1580,7 +1580,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ }
+
+ /* initialize variables */
+- fdx = mii = fset = dxsuflo = 0;
++ fdx = mii = fset = dxsuflo = sram = 0;
+ chip_version = (chip_version >> 12) & 0xffff;
+
+ switch (chip_version) {
+@@ -1613,6 +1613,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C973"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2626:
+ chipname = "PCnet/Home 79C978"; /* PCI */
+@@ -1636,6 +1637,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ chipname = "PCnet/FAST III 79C975"; /* PCI */
+ fdx = 1;
+ mii = 1;
++ sram = 1;
+ break;
+ case 0x2628:
+ chipname = "PCnet/PRO 79C976";
+@@ -1664,6 +1666,31 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
+ dxsuflo = 1;
+ }
+
++ /*
++ * The Am79C973/Am79C975 controllers come with 12K of SRAM
++ * which we can use for the Tx/Rx buffers but most importantly,
++ * the use of SRAM allow us to use the BCR18:NOUFLO bit to avoid
++ * Tx fifo underflows.
++ */
++ if (sram) {
++ /*
++ * The SRAM is being configured in two steps. First we
++ * set the SRAM size in the BCR25:SRAM_SIZE bits. According
++ * to the datasheet, each bit corresponds to a 512-byte
++ * page so we can have at most 24 pages. The SRAM_SIZE
++ * holds the value of the upper 8 bits of the 16-bit SRAM size.
++ * The low 8-bits start at 0x00 and end at 0xff. So the
++ * address range is from 0x0000 up to 0x17ff. Therefore,
++ * the SRAM_SIZE is set to 0x17. The next step is to set
++ * the BCR26:SRAM_BND midway through so the Tx and Rx
++ * buffers can share the SRAM equally.
++ */
++ a->write_bcr(ioaddr, 25, 0x17);
++ a->write_bcr(ioaddr, 26, 0xc);
++ /* And finally enable the NOUFLO bit */
++ a->write_bcr(ioaddr, 18, a->read_bcr(ioaddr, 18) | (1 << 11));
++ }
++
+ dev = alloc_etherdev(sizeof(*lp));
+ if (!dev) {
+ ret = -ENOMEM;
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+index 50cdf70..8eff275 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/vendor.c
+@@ -39,13 +39,22 @@ static int brcmf_cfg80211_vndr_cmds_dcmd_handler(struct wiphy *wiphy,
+ void *dcmd_buf = NULL, *wr_pointer;
+ u16 msglen, maxmsglen = PAGE_SIZE - 0x100;
+
+- brcmf_dbg(TRACE, "cmd %x set %d len %d\n", cmdhdr->cmd, cmdhdr->set,
+- cmdhdr->len);
++ if (len < sizeof(*cmdhdr)) {
++ brcmf_err("vendor command too short: %d\n", len);
++ return -EINVAL;
++ }
+
+ vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
+ ifp = vif->ifp;
+
+- len -= sizeof(struct brcmf_vndr_dcmd_hdr);
++ brcmf_dbg(TRACE, "ifidx=%d, cmd=%d\n", ifp->ifidx, cmdhdr->cmd);
++
++ if (cmdhdr->offset > len) {
++ brcmf_err("bad buffer offset %d > %d\n", cmdhdr->offset, len);
++ return -EINVAL;
++ }
++
++ len -= cmdhdr->offset;
+ ret_len = cmdhdr->len;
+ if (ret_len > 0 || len > 0) {
+ if (len > BRCMF_DCMD_MAXLEN) {
+diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
+index c3817fa..06f6cc0 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
+@@ -95,7 +95,8 @@ static const struct iwl_eeprom_params iwl1000_eeprom_params = {
+ .nvm_calib_ver = EEPROM_1000_TX_POWER_VERSION, \
+ .base_params = &iwl1000_base_params, \
+ .eeprom_params = &iwl1000_eeprom_params, \
+- .led_mode = IWL_LED_BLINK
++ .led_mode = IWL_LED_BLINK, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl1000_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 1000 BGN",
+@@ -121,7 +122,8 @@ const struct iwl_cfg iwl1000_bg_cfg = {
+ .base_params = &iwl1000_base_params, \
+ .eeprom_params = &iwl1000_eeprom_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+- .rx_with_siso_diversity = true
++ .rx_with_siso_diversity = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl100_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 100 BGN",
+diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
+index 21e5d08..890b95f 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
+@@ -123,7 +123,9 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
+ .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION, \
+ .base_params = &iwl2000_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
++
+
+ const struct iwl_cfg iwl2000_2bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 2200 BGN",
+@@ -149,7 +151,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
+ .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION, \
+ .base_params = &iwl2030_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl2030_2bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
+@@ -170,7 +173,8 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
+ .base_params = &iwl2000_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+- .rx_with_siso_diversity = true
++ .rx_with_siso_diversity = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl105_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 105 BGN",
+@@ -197,7 +201,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
+ .base_params = &iwl2030_base_params, \
+ .eeprom_params = &iwl20x0_eeprom_params, \
+ .led_mode = IWL_LED_RF_STATE, \
+- .rx_with_siso_diversity = true
++ .rx_with_siso_diversity = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl135_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N 135 BGN",
+diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
+index 332bbede..724194e 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
+@@ -93,7 +93,8 @@ static const struct iwl_eeprom_params iwl5000_eeprom_params = {
+ .nvm_calib_ver = EEPROM_5000_TX_POWER_VERSION, \
+ .base_params = &iwl5000_base_params, \
+ .eeprom_params = &iwl5000_eeprom_params, \
+- .led_mode = IWL_LED_BLINK
++ .led_mode = IWL_LED_BLINK, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl5300_agn_cfg = {
+ .name = "Intel(R) Ultimate N WiFi Link 5300 AGN",
+@@ -158,7 +159,8 @@ const struct iwl_cfg iwl5350_agn_cfg = {
+ .base_params = &iwl5000_base_params, \
+ .eeprom_params = &iwl5000_eeprom_params, \
+ .led_mode = IWL_LED_BLINK, \
+- .internal_wimax_coex = true
++ .internal_wimax_coex = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl5150_agn_cfg = {
+ .name = "Intel(R) WiMAX/WiFi Link 5150 AGN",
+diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
+index 8f2c3c8..21b2630 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
+@@ -145,7 +145,8 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
+ .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION, \
+ .base_params = &iwl6000_g2_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6005_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6205 AGN",
+@@ -199,7 +200,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
+ .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION, \
+ .base_params = &iwl6000_g2_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6030_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
+@@ -235,7 +237,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
+ .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION, \
+ .base_params = &iwl6000_g2_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_RF_STATE
++ .led_mode = IWL_LED_RF_STATE, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6035_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
+@@ -290,7 +293,8 @@ const struct iwl_cfg iwl130_bg_cfg = {
+ .nvm_calib_ver = EEPROM_6000_TX_POWER_VERSION, \
+ .base_params = &iwl6000_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+- .led_mode = IWL_LED_BLINK
++ .led_mode = IWL_LED_BLINK, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6000i_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N 6200 AGN",
+@@ -322,7 +326,8 @@ const struct iwl_cfg iwl6000i_2bg_cfg = {
+ .base_params = &iwl6050_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+ .led_mode = IWL_LED_BLINK, \
+- .internal_wimax_coex = true
++ .internal_wimax_coex = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6050_2agn_cfg = {
+ .name = "Intel(R) Centrino(R) Advanced-N + WiMAX 6250 AGN",
+@@ -347,7 +352,8 @@ const struct iwl_cfg iwl6050_2abg_cfg = {
+ .base_params = &iwl6050_base_params, \
+ .eeprom_params = &iwl6000_eeprom_params, \
+ .led_mode = IWL_LED_BLINK, \
+- .internal_wimax_coex = true
++ .internal_wimax_coex = true, \
++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K
+
+ const struct iwl_cfg iwl6150_bgn_cfg = {
+ .name = "Intel(R) Centrino(R) Wireless-N + WiMAX 6150 BGN",
+diff --git a/drivers/net/wireless/iwlwifi/mvm/coex.c b/drivers/net/wireless/iwlwifi/mvm/coex.c
+index a3bfda4..ae5a4ec 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/coex.c
++++ b/drivers/net/wireless/iwlwifi/mvm/coex.c
+@@ -793,7 +793,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
+ if (!vif->bss_conf.assoc)
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+- if (IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
++ if (mvmvif->phy_ctxt &&
++ IWL_COEX_IS_RRC_ON(mvm->last_bt_notif.ttc_rrc_status,
+ mvmvif->phy_ctxt->id))
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+index b3210cf..d804585 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
++++ b/drivers/net/wireless/iwlwifi/mvm/coex_legacy.c
+@@ -832,7 +832,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
+ if (!vif->bss_conf.assoc)
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+- if (data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
++ if (mvmvif->phy_ctxt &&
++ data->notif->rrc_enabled & BIT(mvmvif->phy_ctxt->id))
+ smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+ IWL_DEBUG_COEX(data->mvm,
+diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
+index 30ceb67..1a03270 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
++++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
+@@ -146,9 +146,12 @@ enum rs_column_mode {
+ #define MAX_NEXT_COLUMNS 7
+ #define MAX_COLUMN_CHECKS 3
+
++struct rs_tx_column;
++
+ typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
+ struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl);
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col);
+
+ struct rs_tx_column {
+ enum rs_column_mode mode;
+@@ -159,13 +162,15 @@ struct rs_tx_column {
+ };
+
+ static bool rs_ant_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+- return iwl_mvm_bt_coex_is_ant_avail(mvm, tbl->rate.ant);
++ return iwl_mvm_bt_coex_is_ant_avail(mvm, next_col->ant);
+ }
+
+ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+ if (!sta->ht_cap.ht_supported)
+ return false;
+@@ -183,7 +188,8 @@ static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ }
+
+ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+ if (!sta->ht_cap.ht_supported)
+ return false;
+@@ -192,7 +198,8 @@ static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+ }
+
+ static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+- struct iwl_scale_tbl_info *tbl)
++ struct iwl_scale_tbl_info *tbl,
++ const struct rs_tx_column *next_col)
+ {
+ struct rs_rate *rate = &tbl->rate;
+ struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+@@ -1594,7 +1601,7 @@ static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
+
+ for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
+ allow_func = next_col->checks[j];
+- if (allow_func && !allow_func(mvm, sta, tbl))
++ if (allow_func && !allow_func(mvm, sta, tbl, next_col))
+ break;
+ }
+
+diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
+index 54fafbf..f8d6f30 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
++++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
+@@ -750,8 +750,7 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
+ * request
+ */
+ list_for_each_entry(te_data, &mvm->time_event_list, list) {
+- if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE &&
+- te_data->running) {
++ if (te_data->vif->type == NL80211_IFTYPE_P2P_DEVICE) {
+ mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+ is_p2p = true;
+ goto remove_te;
+@@ -766,10 +765,8 @@ void iwl_mvm_stop_roc(struct iwl_mvm *mvm)
+ * request
+ */
+ list_for_each_entry(te_data, &mvm->aux_roc_te_list, list) {
+- if (te_data->running) {
+- mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
+- goto remove_te;
+- }
++ mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif);
++ goto remove_te;
+ }
+
+ remove_te:
+diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
+index 40b6d1d..af24869 100644
+--- a/drivers/net/wireless/rtlwifi/base.c
++++ b/drivers/net/wireless/rtlwifi/base.c
+@@ -1314,8 +1314,11 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
+ }
+
+ return true;
+- } else if (0x86DD == ether_type) {
+- return true;
++ } else if (ETH_P_IPV6 == ether_type) {
++ /* TODO: Handle any IPv6 cases that need special handling.
++ * For now, always return false
++ */
++ goto end;
+ }
+
+ end:
+diff --git a/drivers/of/irq.c b/drivers/of/irq.c
+index 0d77658..1a79806 100644
+--- a/drivers/of/irq.c
++++ b/drivers/of/irq.c
+@@ -290,7 +290,7 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+ struct device_node *p;
+ const __be32 *intspec, *tmp, *addr;
+ u32 intsize, intlen;
+- int i, res = -EINVAL;
++ int i, res;
+
+ pr_debug("of_irq_parse_one: dev=%s, index=%d\n", of_node_full_name(device), index);
+
+@@ -323,15 +323,19 @@ int of_irq_parse_one(struct device_node *device, int index, struct of_phandle_ar
+
+ /* Get size of interrupt specifier */
+ tmp = of_get_property(p, "#interrupt-cells", NULL);
+- if (tmp == NULL)
++ if (tmp == NULL) {
++ res = -EINVAL;
+ goto out;
++ }
+ intsize = be32_to_cpu(*tmp);
+
+ pr_debug(" intsize=%d intlen=%d\n", intsize, intlen);
+
+ /* Check index */
+- if ((index + 1) * intsize > intlen)
++ if ((index + 1) * intsize > intlen) {
++ res = -EINVAL;
+ goto out;
++ }
+
+ /* Copy intspec into irq structure */
+ intspec += index * intsize;
+diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
+index a12d353..04fc84f 100644
+--- a/drivers/phy/phy-core.c
++++ b/drivers/phy/phy-core.c
+@@ -52,7 +52,9 @@ static void devm_phy_consume(struct device *dev, void *res)
+
+ static int devm_phy_match(struct device *dev, void *res, void *match_data)
+ {
+- return res == match_data;
++ struct phy **phy = res;
++
++ return *phy == match_data;
+ }
+
+ /**
+diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
+index 97b5e4e..63d4033 100644
+--- a/drivers/powercap/intel_rapl.c
++++ b/drivers/powercap/intel_rapl.c
+@@ -73,7 +73,7 @@
+
+ #define TIME_WINDOW_MAX_MSEC 40000
+ #define TIME_WINDOW_MIN_MSEC 250
+-
++#define ENERGY_UNIT_SCALE 1000 /* scale from driver unit to powercap unit */
+ enum unit_type {
+ ARBITRARY_UNIT, /* no translation */
+ POWER_UNIT,
+@@ -158,6 +158,7 @@ struct rapl_domain {
+ struct rapl_power_limit rpl[NR_POWER_LIMITS];
+ u64 attr_map; /* track capabilities */
+ unsigned int state;
++ unsigned int domain_energy_unit;
+ int package_id;
+ };
+ #define power_zone_to_rapl_domain(_zone) \
+@@ -190,6 +191,7 @@ struct rapl_defaults {
+ void (*set_floor_freq)(struct rapl_domain *rd, bool mode);
+ u64 (*compute_time_window)(struct rapl_package *rp, u64 val,
+ bool to_raw);
++ unsigned int dram_domain_energy_unit;
+ };
+ static struct rapl_defaults *rapl_defaults;
+
+@@ -227,7 +229,8 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
+ static int rapl_write_data_raw(struct rapl_domain *rd,
+ enum rapl_primitives prim,
+ unsigned long long value);
+-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
++static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
++ enum unit_type type, u64 value,
+ int to_raw);
+ static void package_power_limit_irq_save(int package_id);
+
+@@ -305,7 +308,9 @@ static int get_energy_counter(struct powercap_zone *power_zone, u64 *energy_raw)
+
+ static int get_max_energy_counter(struct powercap_zone *pcd_dev, u64 *energy)
+ {
+- *energy = rapl_unit_xlate(0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
++ struct rapl_domain *rd = power_zone_to_rapl_domain(pcd_dev);
++
++ *energy = rapl_unit_xlate(rd, 0, ENERGY_UNIT, ENERGY_STATUS_MASK, 0);
+ return 0;
+ }
+
+@@ -639,6 +644,11 @@ static void rapl_init_domains(struct rapl_package *rp)
+ rd->msrs[4] = MSR_DRAM_POWER_INFO;
+ rd->rpl[0].prim_id = PL1_ENABLE;
+ rd->rpl[0].name = pl1_name;
++ rd->domain_energy_unit =
++ rapl_defaults->dram_domain_energy_unit;
++ if (rd->domain_energy_unit)
++ pr_info("DRAM domain energy unit %dpj\n",
++ rd->domain_energy_unit);
+ break;
+ }
+ if (mask) {
+@@ -648,11 +658,13 @@ static void rapl_init_domains(struct rapl_package *rp)
+ }
+ }
+
+-static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
++static u64 rapl_unit_xlate(struct rapl_domain *rd, int package,
++ enum unit_type type, u64 value,
+ int to_raw)
+ {
+ u64 units = 1;
+ struct rapl_package *rp;
++ u64 scale = 1;
+
+ rp = find_package_by_id(package);
+ if (!rp)
+@@ -663,7 +675,12 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+ units = rp->power_unit;
+ break;
+ case ENERGY_UNIT:
+- units = rp->energy_unit;
++ scale = ENERGY_UNIT_SCALE;
++ /* per domain unit takes precedence */
++ if (rd && rd->domain_energy_unit)
++ units = rd->domain_energy_unit;
++ else
++ units = rp->energy_unit;
+ break;
+ case TIME_UNIT:
+ return rapl_defaults->compute_time_window(rp, value, to_raw);
+@@ -673,11 +690,11 @@ static u64 rapl_unit_xlate(int package, enum unit_type type, u64 value,
+ };
+
+ if (to_raw)
+- return div64_u64(value, units);
++ return div64_u64(value, units) * scale;
+
+ value *= units;
+
+- return value;
++ return div64_u64(value, scale);
+ }
+
+ /* in the order of enum rapl_primitives */
+@@ -773,7 +790,7 @@ static int rapl_read_data_raw(struct rapl_domain *rd,
+ final = value & rp->mask;
+ final = final >> rp->shift;
+ if (xlate)
+- *data = rapl_unit_xlate(rd->package_id, rp->unit, final, 0);
++ *data = rapl_unit_xlate(rd, rd->package_id, rp->unit, final, 0);
+ else
+ *data = final;
+
+@@ -799,7 +816,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
+ "failed to read msr 0x%x on cpu %d\n", msr, cpu);
+ return -EIO;
+ }
+- value = rapl_unit_xlate(rd->package_id, rp->unit, value, 1);
++ value = rapl_unit_xlate(rd, rd->package_id, rp->unit, value, 1);
+ msr_val &= ~rp->mask;
+ msr_val |= value << rp->shift;
+ if (wrmsrl_safe_on_cpu(cpu, msr, msr_val)) {
+@@ -818,7 +835,7 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
+ * calculate units differ on different CPUs.
+ * We convert the units to below format based on CPUs.
+ * i.e.
+- * energy unit: microJoules : Represented in microJoules by default
++ * energy unit: picoJoules : Represented in picoJoules by default
+ * power unit : microWatts : Represented in milliWatts by default
+ * time unit : microseconds: Represented in seconds by default
+ */
+@@ -834,7 +851,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
+ }
+
+ value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+- rp->energy_unit = 1000000 / (1 << value);
++ rp->energy_unit = ENERGY_UNIT_SCALE * 1000000 / (1 << value);
+
+ value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+ rp->power_unit = 1000000 / (1 << value);
+@@ -842,7 +859,7 @@ static int rapl_check_unit_core(struct rapl_package *rp, int cpu)
+ value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+ rp->time_unit = 1000000 / (1 << value);
+
+- pr_debug("Core CPU package %d energy=%duJ, time=%dus, power=%duW\n",
++ pr_debug("Core CPU package %d energy=%dpJ, time=%dus, power=%duW\n",
+ rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
+
+ return 0;
+@@ -859,7 +876,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
+ return -ENODEV;
+ }
+ value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
+- rp->energy_unit = 1 << value;
++ rp->energy_unit = ENERGY_UNIT_SCALE * 1 << value;
+
+ value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
+ rp->power_unit = (1 << value) * 1000;
+@@ -867,7 +884,7 @@ static int rapl_check_unit_atom(struct rapl_package *rp, int cpu)
+ value = (msr_val & TIME_UNIT_MASK) >> TIME_UNIT_OFFSET;
+ rp->time_unit = 1000000 / (1 << value);
+
+- pr_debug("Atom package %d energy=%duJ, time=%dus, power=%duW\n",
++ pr_debug("Atom package %d energy=%dpJ, time=%dus, power=%duW\n",
+ rp->id, rp->energy_unit, rp->time_unit, rp->power_unit);
+
+ return 0;
+@@ -1017,6 +1034,13 @@ static const struct rapl_defaults rapl_defaults_core = {
+ .compute_time_window = rapl_compute_time_window_core,
+ };
+
++static const struct rapl_defaults rapl_defaults_hsw_server = {
++ .check_unit = rapl_check_unit_core,
++ .set_floor_freq = set_floor_freq_default,
++ .compute_time_window = rapl_compute_time_window_core,
++ .dram_domain_energy_unit = 15300,
++};
++
+ static const struct rapl_defaults rapl_defaults_atom = {
+ .check_unit = rapl_check_unit_atom,
+ .set_floor_freq = set_floor_freq_atom,
+@@ -1037,7 +1061,7 @@ static const struct x86_cpu_id rapl_ids[] = {
+ RAPL_CPU(0x3a, rapl_defaults_core),/* Ivy Bridge */
+ RAPL_CPU(0x3c, rapl_defaults_core),/* Haswell */
+ RAPL_CPU(0x3d, rapl_defaults_core),/* Broadwell */
+- RAPL_CPU(0x3f, rapl_defaults_core),/* Haswell */
++ RAPL_CPU(0x3f, rapl_defaults_hsw_server),/* Haswell servers */
+ RAPL_CPU(0x45, rapl_defaults_core),/* Haswell ULT */
+ RAPL_CPU(0x4C, rapl_defaults_atom),/* Braswell */
+ RAPL_CPU(0x4A, rapl_defaults_atom),/* Tangier */
+diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
+index 9205f43..1819831 100644
+--- a/drivers/regulator/palmas-regulator.c
++++ b/drivers/regulator/palmas-regulator.c
+@@ -1572,6 +1572,10 @@ static int palmas_regulators_probe(struct platform_device *pdev)
+ if (!pmic)
+ return -ENOMEM;
+
++ if (of_device_is_compatible(node, "ti,tps659038-pmic"))
++ palmas_generic_regs_info[PALMAS_REG_REGEN2].ctrl_addr =
++ TPS659038_REGEN2_CTRL;
++
+ pmic->dev = &pdev->dev;
+ pmic->palmas = palmas;
+ palmas->pmic = pmic;
+diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+index 73f9fee..272a264 100644
+--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c
++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c
+@@ -1598,7 +1598,7 @@ static int tcm_qla2xxx_check_initiator_node_acl(
+ /*
+ * Finally register the new FC Nexus with TCM
+ */
+- __transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
++ transport_register_session(se_nacl->se_tpg, se_nacl, se_sess, sess);
+
+ return 0;
+ }
+diff --git a/drivers/spi/spi-dw-mid.c b/drivers/spi/spi-dw-mid.c
+index 22ca08a..8076e89 100644
+--- a/drivers/spi/spi-dw-mid.c
++++ b/drivers/spi/spi-dw-mid.c
+@@ -108,7 +108,8 @@ static void dw_spi_dma_tx_done(void *arg)
+ {
+ struct dw_spi *dws = arg;
+
+- if (test_and_clear_bit(TX_BUSY, &dws->dma_chan_busy) & BIT(RX_BUSY))
++ clear_bit(TX_BUSY, &dws->dma_chan_busy);
++ if (test_bit(RX_BUSY, &dws->dma_chan_busy))
+ return;
+ dw_spi_xfer_done(dws);
+ }
+@@ -156,7 +157,8 @@ static void dw_spi_dma_rx_done(void *arg)
+ {
+ struct dw_spi *dws = arg;
+
+- if (test_and_clear_bit(RX_BUSY, &dws->dma_chan_busy) & BIT(TX_BUSY))
++ clear_bit(RX_BUSY, &dws->dma_chan_busy);
++ if (test_bit(TX_BUSY, &dws->dma_chan_busy))
+ return;
+ dw_spi_xfer_done(dws);
+ }
+diff --git a/drivers/spi/spi-qup.c b/drivers/spi/spi-qup.c
+index e7fb5a0..e27c12a 100644
+--- a/drivers/spi/spi-qup.c
++++ b/drivers/spi/spi-qup.c
+@@ -489,7 +489,7 @@ static int spi_qup_probe(struct platform_device *pdev)
+ struct resource *res;
+ struct device *dev;
+ void __iomem *base;
+- u32 max_freq, iomode;
++ u32 max_freq, iomode, num_cs;
+ int ret, irq, size;
+
+ dev = &pdev->dev;
+@@ -541,10 +541,11 @@ static int spi_qup_probe(struct platform_device *pdev)
+ }
+
+ /* use num-cs unless not present or out of range */
+- if (of_property_read_u16(dev->of_node, "num-cs",
+- &master->num_chipselect) ||
+- (master->num_chipselect > SPI_NUM_CHIPSELECTS))
++ if (of_property_read_u32(dev->of_node, "num-cs", &num_cs) ||
++ num_cs > SPI_NUM_CHIPSELECTS)
+ master->num_chipselect = SPI_NUM_CHIPSELECTS;
++ else
++ master->num_chipselect = num_cs;
+
+ master->bus_num = pdev->id;
+ master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH | SPI_LOOP;
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 66a70e9..a17f533 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1073,13 +1073,14 @@ void spi_finalize_current_message(struct spi_master *master)
+ "failed to unprepare message: %d\n", ret);
+ }
+ }
++
++ trace_spi_message_done(mesg);
++
+ master->cur_msg_prepared = false;
+
+ mesg->state = NULL;
+ if (mesg->complete)
+ mesg->complete(mesg->context);
+-
+- trace_spi_message_done(mesg);
+ }
+ EXPORT_SYMBOL_GPL(spi_finalize_current_message);
+
+diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c
+index cd1a277..ace0521 100644
+--- a/drivers/staging/vt6655/device_main.c
++++ b/drivers/staging/vt6655/device_main.c
+@@ -357,16 +357,6 @@ static void device_init_registers(struct vnt_private *pDevice)
+ /* zonetype initial */
+ pDevice->byOriginalZonetype = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
+
+- /* Get RFType */
+- pDevice->byRFType = SROMbyReadEmbedded(pDevice->PortOffset, EEP_OFS_RFTYPE);
+-
+- /* force change RevID for VT3253 emu */
+- if ((pDevice->byRFType & RF_EMU) != 0)
+- pDevice->byRevId = 0x80;
+-
+- pDevice->byRFType &= RF_MASK;
+- pr_debug("pDevice->byRFType = %x\n", pDevice->byRFType);
+-
+ if (!pDevice->bZoneRegExist)
+ pDevice->byZoneType = pDevice->abyEEPROM[EEP_OFS_ZONETYPE];
+
+@@ -1806,6 +1796,12 @@ vt6655_probe(struct pci_dev *pcid, const struct pci_device_id *ent)
+ MACvInitialize(priv->PortOffset);
+ MACvReadEtherAddress(priv->PortOffset, priv->abyCurrentNetAddr);
+
++ /* Get RFType */
++ priv->byRFType = SROMbyReadEmbedded(priv->PortOffset, EEP_OFS_RFTYPE);
++ priv->byRFType &= RF_MASK;
++
++ dev_dbg(&pcid->dev, "RF Type = %x\n", priv->byRFType);
++
+ device_get_options(priv);
+ device_set_options(priv);
+ /* Mask out the options cannot be set to the chip */
+diff --git a/drivers/staging/vt6655/rf.c b/drivers/staging/vt6655/rf.c
+index 32ef993..5d65ad0 100644
+--- a/drivers/staging/vt6655/rf.c
++++ b/drivers/staging/vt6655/rf.c
+@@ -791,6 +791,7 @@ bool RFbSetPower(
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ byPwr = priv->abyOFDMPwrTbl[uCH];
+ if (priv->byRFType == RF_UW2452)
+diff --git a/drivers/staging/vt6656/rf.c b/drivers/staging/vt6656/rf.c
+index c42cde5..c4286cc 100644
+--- a/drivers/staging/vt6656/rf.c
++++ b/drivers/staging/vt6656/rf.c
+@@ -640,6 +640,7 @@ int vnt_rf_setpower(struct vnt_private *priv, u32 rate, u32 channel)
+ break;
+ case RATE_6M:
+ case RATE_9M:
++ case RATE_12M:
+ case RATE_18M:
+ case RATE_24M:
+ case RATE_36M:
+diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
+index 97b486c..583e755 100644
+--- a/drivers/target/tcm_fc/tfc_io.c
++++ b/drivers/target/tcm_fc/tfc_io.c
+@@ -359,7 +359,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ ep = fc_seq_exch(seq);
+ if (ep) {
+ lport = ep->lp;
+- if (lport && (ep->xid <= lport->lro_xid))
++ if (lport && (ep->xid <= lport->lro_xid)) {
+ /*
+ * "ddp_done" trigger invalidation of HW
+ * specific DDP context
+@@ -374,6 +374,7 @@ void ft_invl_hw_context(struct ft_cmd *cmd)
+ * identified using ep->xid)
+ */
+ cmd->was_ddp_setup = 0;
++ }
+ }
+ }
+ }
+diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c
+index 4fe18ce..7c14565 100644
+--- a/drivers/usb/chipidea/udc.c
++++ b/drivers/usb/chipidea/udc.c
+@@ -929,6 +929,13 @@ __acquires(hwep->lock)
+ return retval;
+ }
+
++static int otg_a_alt_hnp_support(struct ci_hdrc *ci)
++{
++ dev_warn(&ci->gadget.dev,
++ "connect the device to an alternate port if you want HNP\n");
++ return isr_setup_status_phase(ci);
++}
++
+ /**
+ * isr_setup_packet_handler: setup packet handler
+ * @ci: UDC descriptor
+@@ -1061,6 +1068,10 @@ __acquires(ci->lock)
+ ci);
+ }
+ break;
++ case USB_DEVICE_A_ALT_HNP_SUPPORT:
++ if (ci_otg_is_fsm_mode(ci))
++ err = otg_a_alt_hnp_support(ci);
++ break;
+ default:
+ goto delegate;
+ }
+diff --git a/drivers/usb/common/usb-otg-fsm.c b/drivers/usb/common/usb-otg-fsm.c
+index c6b35b7..61d538a 100644
+--- a/drivers/usb/common/usb-otg-fsm.c
++++ b/drivers/usb/common/usb-otg-fsm.c
+@@ -150,9 +150,9 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+ break;
+ case OTG_STATE_B_PERIPHERAL:
+ otg_chrg_vbus(fsm, 0);
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
++ otg_loc_conn(fsm, 1);
+ break;
+ case OTG_STATE_B_WAIT_ACON:
+ otg_chrg_vbus(fsm, 0);
+@@ -213,10 +213,10 @@ static int otg_set_state(struct otg_fsm *fsm, enum usb_otg_state new_state)
+
+ break;
+ case OTG_STATE_A_PERIPHERAL:
+- otg_loc_conn(fsm, 1);
+ otg_loc_sof(fsm, 0);
+ otg_set_protocol(fsm, PROTO_GADGET);
+ otg_drv_vbus(fsm, 1);
++ otg_loc_conn(fsm, 1);
+ otg_add_timer(fsm, A_BIDL_ADIS);
+ break;
+ case OTG_STATE_A_WAIT_VFALL:
+diff --git a/drivers/usb/phy/phy-am335x-control.c b/drivers/usb/phy/phy-am335x-control.c
+index 403fab7..7b3035f 100644
+--- a/drivers/usb/phy/phy-am335x-control.c
++++ b/drivers/usb/phy/phy-am335x-control.c
+@@ -126,6 +126,9 @@ struct phy_control *am335x_get_phy_control(struct device *dev)
+ return NULL;
+
+ dev = bus_find_device(&platform_bus_type, NULL, node, match);
++ if (!dev)
++ return NULL;
++
+ ctrl_usb = dev_get_drvdata(dev);
+ if (!ctrl_usb)
+ return NULL;
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index 8257042..c85ea53 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -113,6 +113,13 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
++/* Reported-by: Benjamin Tissoires <benjamin.tissoires@redhat.com> */
++UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999,
++ "Initio Corporation",
++ "",
++ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++ US_FL_NO_ATA_1X),
++
+ /* Reported-by: Tom Arild Naess <tanaess@gmail.com> */
+ UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999,
+ "JMicron",
+diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
+index 50c5f42..b8b7a6c 100644
+--- a/drivers/virtio/virtio_balloon.c
++++ b/drivers/virtio/virtio_balloon.c
+@@ -29,6 +29,7 @@
+ #include <linux/module.h>
+ #include <linux/balloon_compaction.h>
+ #include <linux/oom.h>
++#include <linux/wait.h>
+
+ /*
+ * Balloon device works in 4K page units. So each page is pointed to by
+@@ -335,17 +336,25 @@ static int virtballoon_oom_notify(struct notifier_block *self,
+ static int balloon(void *_vballoon)
+ {
+ struct virtio_balloon *vb = _vballoon;
++ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+
+ set_freezable();
+ while (!kthread_should_stop()) {
+ s64 diff;
+
+ try_to_freeze();
+- wait_event_interruptible(vb->config_change,
+- (diff = towards_target(vb)) != 0
+- || vb->need_stats_update
+- || kthread_should_stop()
+- || freezing(current));
++
++ add_wait_queue(&vb->config_change, &wait);
++ for (;;) {
++ if ((diff = towards_target(vb)) != 0 ||
++ vb->need_stats_update ||
++ kthread_should_stop() ||
++ freezing(current))
++ break;
++ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
++ }
++ remove_wait_queue(&vb->config_change, &wait);
++
+ if (vb->need_stats_update)
+ stats_handle_request(vb);
+ if (diff > 0)
+@@ -494,6 +503,8 @@ static int virtballoon_probe(struct virtio_device *vdev)
+ if (err < 0)
+ goto out_oom_notify;
+
++ virtio_device_ready(vdev);
++
+ vb->thread = kthread_run(balloon, vb, "vballoon");
+ if (IS_ERR(vb->thread)) {
+ err = PTR_ERR(vb->thread);
+diff --git a/fs/hfsplus/brec.c b/fs/hfsplus/brec.c
+index 6e560d5..754fdf8 100644
+--- a/fs/hfsplus/brec.c
++++ b/fs/hfsplus/brec.c
+@@ -131,13 +131,16 @@ skip:
+ hfs_bnode_write(node, entry, data_off + key_len, entry_len);
+ hfs_bnode_dump(node);
+
+- if (new_node) {
+- /* update parent key if we inserted a key
+- * at the start of the first node
+- */
+- if (!rec && new_node != node)
+- hfs_brec_update_parent(fd);
++ /*
++ * update parent key if we inserted a key
++ * at the start of the node and it is not the new node
++ */
++ if (!rec && new_node != node) {
++ hfs_bnode_read_key(node, fd->search_key, data_off + size);
++ hfs_brec_update_parent(fd);
++ }
+
++ if (new_node) {
+ hfs_bnode_put(fd->bnode);
+ if (!new_node->parent) {
+ hfs_btree_inc_height(tree);
+@@ -168,9 +171,6 @@ skip:
+ goto again;
+ }
+
+- if (!rec)
+- hfs_brec_update_parent(fd);
+-
+ return 0;
+ }
+
+@@ -370,6 +370,8 @@ again:
+ if (IS_ERR(parent))
+ return PTR_ERR(parent);
+ __hfs_brec_find(parent, fd, hfs_find_rec_by_key);
++ if (fd->record < 0)
++ return -ENOENT;
+ hfs_bnode_dump(parent);
+ rec = fd->record;
+
+diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
+index ca6d2acc..f39722b 100644
+--- a/include/linux/device-mapper.h
++++ b/include/linux/device-mapper.h
+@@ -368,6 +368,7 @@ int dm_create(int minor, struct mapped_device **md);
+ */
+ struct mapped_device *dm_get_md(dev_t dev);
+ void dm_get(struct mapped_device *md);
++int dm_hold(struct mapped_device *md);
+ void dm_put(struct mapped_device *md);
+
+ /*
+diff --git a/include/linux/mfd/palmas.h b/include/linux/mfd/palmas.h
+index fb0390a..ee7b1ce 100644
+--- a/include/linux/mfd/palmas.h
++++ b/include/linux/mfd/palmas.h
+@@ -2999,6 +2999,9 @@ enum usb_irq_events {
+ #define PALMAS_GPADC_TRIM15 0x0E
+ #define PALMAS_GPADC_TRIM16 0x0F
+
++/* TPS659038 regen2_ctrl offset iss different from palmas */
++#define TPS659038_REGEN2_CTRL 0x12
++
+ /* TPS65917 Interrupt registers */
+
+ /* Registers for function INTERRUPT */
+diff --git a/include/trace/events/regmap.h b/include/trace/events/regmap.h
+index 23d5615..22317d2 100644
+--- a/include/trace/events/regmap.h
++++ b/include/trace/events/regmap.h
+@@ -7,27 +7,26 @@
+ #include <linux/ktime.h>
+ #include <linux/tracepoint.h>
+
+-struct device;
+-struct regmap;
++#include "../../../drivers/base/regmap/internal.h"
+
+ /*
+ * Log register events
+ */
+ DECLARE_EVENT_CLASS(regmap_reg,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val),
++ TP_ARGS(map, reg, val),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( unsigned int, reg )
+- __field( unsigned int, val )
++ __string( name, regmap_name(map) )
++ __field( unsigned int, reg )
++ __field( unsigned int, val )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->reg = reg;
+ __entry->val = val;
+ ),
+@@ -39,45 +38,45 @@ DECLARE_EVENT_CLASS(regmap_reg,
+
+ DEFINE_EVENT(regmap_reg, regmap_reg_write,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val)
++ TP_ARGS(map, reg, val)
+
+ );
+
+ DEFINE_EVENT(regmap_reg, regmap_reg_read,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val)
++ TP_ARGS(map, reg, val)
+
+ );
+
+ DEFINE_EVENT(regmap_reg, regmap_reg_read_cache,
+
+- TP_PROTO(struct device *dev, unsigned int reg,
++ TP_PROTO(struct regmap *map, unsigned int reg,
+ unsigned int val),
+
+- TP_ARGS(dev, reg, val)
++ TP_ARGS(map, reg, val)
+
+ );
+
+ DECLARE_EVENT_CLASS(regmap_block,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count),
++ TP_ARGS(map, reg, count),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( unsigned int, reg )
+- __field( int, count )
++ __string( name, regmap_name(map) )
++ __field( unsigned int, reg )
++ __field( int, count )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->reg = reg;
+ __entry->count = count;
+ ),
+@@ -89,48 +88,48 @@ DECLARE_EVENT_CLASS(regmap_block,
+
+ DEFINE_EVENT(regmap_block, regmap_hw_read_start,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_block, regmap_hw_read_done,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_block, regmap_hw_write_start,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_block, regmap_hw_write_done,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ TRACE_EVENT(regcache_sync,
+
+- TP_PROTO(struct device *dev, const char *type,
++ TP_PROTO(struct regmap *map, const char *type,
+ const char *status),
+
+- TP_ARGS(dev, type, status),
++ TP_ARGS(map, type, status),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __string( status, status )
+- __string( type, type )
+- __field( int, type )
++ __string( name, regmap_name(map) )
++ __string( status, status )
++ __string( type, type )
++ __field( int, type )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __assign_str(status, status);
+ __assign_str(type, type);
+ ),
+@@ -141,17 +140,17 @@ TRACE_EVENT(regcache_sync,
+
+ DECLARE_EVENT_CLASS(regmap_bool,
+
+- TP_PROTO(struct device *dev, bool flag),
++ TP_PROTO(struct regmap *map, bool flag),
+
+- TP_ARGS(dev, flag),
++ TP_ARGS(map, flag),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( int, flag )
++ __string( name, regmap_name(map) )
++ __field( int, flag )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->flag = flag;
+ ),
+
+@@ -161,32 +160,32 @@ DECLARE_EVENT_CLASS(regmap_bool,
+
+ DEFINE_EVENT(regmap_bool, regmap_cache_only,
+
+- TP_PROTO(struct device *dev, bool flag),
++ TP_PROTO(struct regmap *map, bool flag),
+
+- TP_ARGS(dev, flag)
++ TP_ARGS(map, flag)
+
+ );
+
+ DEFINE_EVENT(regmap_bool, regmap_cache_bypass,
+
+- TP_PROTO(struct device *dev, bool flag),
++ TP_PROTO(struct regmap *map, bool flag),
+
+- TP_ARGS(dev, flag)
++ TP_ARGS(map, flag)
+
+ );
+
+ DECLARE_EVENT_CLASS(regmap_async,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev),
++ TP_ARGS(map),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
++ __string( name, regmap_name(map) )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ ),
+
+ TP_printk("%s", __get_str(name))
+@@ -194,50 +193,50 @@ DECLARE_EVENT_CLASS(regmap_async,
+
+ DEFINE_EVENT(regmap_block, regmap_async_write_start,
+
+- TP_PROTO(struct device *dev, unsigned int reg, int count),
++ TP_PROTO(struct regmap *map, unsigned int reg, int count),
+
+- TP_ARGS(dev, reg, count)
++ TP_ARGS(map, reg, count)
+ );
+
+ DEFINE_EVENT(regmap_async, regmap_async_io_complete,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev)
++ TP_ARGS(map)
+
+ );
+
+ DEFINE_EVENT(regmap_async, regmap_async_complete_start,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev)
++ TP_ARGS(map)
+
+ );
+
+ DEFINE_EVENT(regmap_async, regmap_async_complete_done,
+
+- TP_PROTO(struct device *dev),
++ TP_PROTO(struct regmap *map),
+
+- TP_ARGS(dev)
++ TP_ARGS(map)
+
+ );
+
+ TRACE_EVENT(regcache_drop_region,
+
+- TP_PROTO(struct device *dev, unsigned int from,
++ TP_PROTO(struct regmap *map, unsigned int from,
+ unsigned int to),
+
+- TP_ARGS(dev, from, to),
++ TP_ARGS(map, from, to),
+
+ TP_STRUCT__entry(
+- __string( name, dev_name(dev) )
+- __field( unsigned int, from )
+- __field( unsigned int, to )
++ __string( name, regmap_name(map) )
++ __field( unsigned int, from )
++ __field( unsigned int, to )
+ ),
+
+ TP_fast_assign(
+- __assign_str(name, dev_name(dev));
++ __assign_str(name, regmap_name(map));
+ __entry->from = from;
+ __entry->to = to;
+ ),
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 19efcf1..7959624 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4412,6 +4412,13 @@ static void perf_pending_event(struct irq_work *entry)
+ {
+ struct perf_event *event = container_of(entry,
+ struct perf_event, pending);
++ int rctx;
++
++ rctx = perf_swevent_get_recursion_context();
++ /*
++ * If we 'fail' here, that's OK, it means recursion is already disabled
++ * and we won't recurse 'further'.
++ */
+
+ if (event->pending_disable) {
+ event->pending_disable = 0;
+@@ -4422,6 +4429,9 @@ static void perf_pending_event(struct irq_work *entry)
+ event->pending_wakeup = 0;
+ perf_event_wakeup(event);
+ }
++
++ if (rctx >= 0)
++ perf_swevent_put_recursion_context(rctx);
+ }
+
+ /*
+diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
+index cc6e964..fa7568c 100644
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -58,13 +58,24 @@ struct ieee80211_local;
+ #define IEEE80211_UNSET_POWER_LEVEL INT_MIN
+
+ /*
+- * Some APs experience problems when working with U-APSD. Decrease the
+- * probability of that happening by using legacy mode for all ACs but VO.
+- * The AP that caused us trouble was a Cisco 4410N. It ignores our
+- * setting, and always treats non-VO ACs as legacy.
++ * Some APs experience problems when working with U-APSD. Decreasing the
++ * probability of that happening by using legacy mode for all ACs but VO isn't
++ * enough.
++ *
++ * Cisco 4410N originally forced us to enable VO by default only because it
++ * treated non-VO ACs as legacy.
++ *
++ * However some APs (notably Netgear R7000) silently reclassify packets to
++ * different ACs. Since u-APSD ACs require trigger frames for frame retrieval
++ * clients would never see some frames (e.g. ARP responses) or would fetch them
++ * accidentally after a long time.
++ *
++ * It makes little sense to enable u-APSD queues by default because it needs
++ * userspace applications to be aware of it to actually take advantage of the
++ * possible additional powersavings. Implicitly depending on driver autotrigger
++ * frame support doesn't make much sense.
+ */
+-#define IEEE80211_DEFAULT_UAPSD_QUEUES \
+- IEEE80211_WMM_IE_STA_QOSINFO_AC_VO
++#define IEEE80211_DEFAULT_UAPSD_QUEUES 0
+
+ #define IEEE80211_DEFAULT_MAX_SP_LEN \
+ IEEE80211_WMM_IE_STA_QOSINFO_SP_ALL
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index d69ca51..b448e8f 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2191,6 +2191,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ hdr = (struct ieee80211_hdr *) skb->data;
+ mesh_hdr = (struct ieee80211s_hdr *) (skb->data + hdrlen);
+
++ if (ieee80211_drop_unencrypted(rx, hdr->frame_control))
++ return RX_DROP_MONITOR;
++
+ /* frame is in RMC, don't forward */
+ if (ieee80211_is_data(hdr->frame_control) &&
+ is_multicast_ether_addr(hdr->addr1) &&
+diff --git a/net/mac80211/util.c b/net/mac80211/util.c
+index 974ebe7..1ce38e7 100644
+--- a/net/mac80211/util.c
++++ b/net/mac80211/util.c
+@@ -3153,7 +3153,7 @@ int ieee80211_check_combinations(struct ieee80211_sub_if_data *sdata,
+ wdev_iter = &sdata_iter->wdev;
+
+ if (sdata_iter == sdata ||
+- rcu_access_pointer(sdata_iter->vif.chanctx_conf) == NULL ||
++ !ieee80211_sdata_running(sdata_iter) ||
+ local->hw.wiphy->software_iftypes & BIT(wdev_iter->iftype))
+ continue;
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 8887c6e..e13325f 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -4360,6 +4360,16 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
+ if (parse_station_flags(info, dev->ieee80211_ptr->iftype, ¶ms))
+ return -EINVAL;
+
++ /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
++ * as userspace might just pass through the capabilities from the IEs
++ * directly, rather than enforcing this restriction and returning an
++ * error in this case.
++ */
++ if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
++ params.ht_capa = NULL;
++ params.vht_capa = NULL;
++ }
++
+ /* When you run into this, adjust the code below for the new flag */
+ BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+
+diff --git a/sound/soc/codecs/adav80x.c b/sound/soc/codecs/adav80x.c
+index b67480f..4373ada 100644
+--- a/sound/soc/codecs/adav80x.c
++++ b/sound/soc/codecs/adav80x.c
+@@ -317,7 +317,7 @@ static int adav80x_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+- unsigned int deemph = ucontrol->value.enumerated.item[0];
++ unsigned int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -333,7 +333,7 @@ static int adav80x_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct adav80x *adav80x = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = adav80x->deemph;
++ ucontrol->value.integer.value[0] = adav80x->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/ak4641.c b/sound/soc/codecs/ak4641.c
+index 70861c7..81b54a2 100644
+--- a/sound/soc/codecs/ak4641.c
++++ b/sound/soc/codecs/ak4641.c
+@@ -76,7 +76,7 @@ static int ak4641_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+@@ -92,7 +92,7 @@ static int ak4641_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct ak4641_priv *ak4641 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = ak4641->deemph;
++ ucontrol->value.integer.value[0] = ak4641->deemph;
+ return 0;
+ };
+
+diff --git a/sound/soc/codecs/ak4671.c b/sound/soc/codecs/ak4671.c
+index 686cacb..a981c1e 100644
+--- a/sound/soc/codecs/ak4671.c
++++ b/sound/soc/codecs/ak4671.c
+@@ -343,25 +343,25 @@ static const struct snd_soc_dapm_widget ak4671_dapm_widgets[] = {
+ };
+
+ static const struct snd_soc_dapm_route ak4671_intercon[] = {
+- {"DAC Left", "NULL", "PMPLL"},
+- {"DAC Right", "NULL", "PMPLL"},
+- {"ADC Left", "NULL", "PMPLL"},
+- {"ADC Right", "NULL", "PMPLL"},
++ {"DAC Left", NULL, "PMPLL"},
++ {"DAC Right", NULL, "PMPLL"},
++ {"ADC Left", NULL, "PMPLL"},
++ {"ADC Right", NULL, "PMPLL"},
+
+ /* Outputs */
+- {"LOUT1", "NULL", "LOUT1 Mixer"},
+- {"ROUT1", "NULL", "ROUT1 Mixer"},
+- {"LOUT2", "NULL", "LOUT2 Mix Amp"},
+- {"ROUT2", "NULL", "ROUT2 Mix Amp"},
+- {"LOUT3", "NULL", "LOUT3 Mixer"},
+- {"ROUT3", "NULL", "ROUT3 Mixer"},
++ {"LOUT1", NULL, "LOUT1 Mixer"},
++ {"ROUT1", NULL, "ROUT1 Mixer"},
++ {"LOUT2", NULL, "LOUT2 Mix Amp"},
++ {"ROUT2", NULL, "ROUT2 Mix Amp"},
++ {"LOUT3", NULL, "LOUT3 Mixer"},
++ {"ROUT3", NULL, "ROUT3 Mixer"},
+
+ {"LOUT1 Mixer", "DACL", "DAC Left"},
+ {"ROUT1 Mixer", "DACR", "DAC Right"},
+ {"LOUT2 Mixer", "DACHL", "DAC Left"},
+ {"ROUT2 Mixer", "DACHR", "DAC Right"},
+- {"LOUT2 Mix Amp", "NULL", "LOUT2 Mixer"},
+- {"ROUT2 Mix Amp", "NULL", "ROUT2 Mixer"},
++ {"LOUT2 Mix Amp", NULL, "LOUT2 Mixer"},
++ {"ROUT2 Mix Amp", NULL, "ROUT2 Mixer"},
+ {"LOUT3 Mixer", "DACSL", "DAC Left"},
+ {"ROUT3 Mixer", "DACSR", "DAC Right"},
+
+@@ -381,18 +381,18 @@ static const struct snd_soc_dapm_route ak4671_intercon[] = {
+ {"LIN2", NULL, "Mic Bias"},
+ {"RIN2", NULL, "Mic Bias"},
+
+- {"ADC Left", "NULL", "LIN MUX"},
+- {"ADC Right", "NULL", "RIN MUX"},
++ {"ADC Left", NULL, "LIN MUX"},
++ {"ADC Right", NULL, "RIN MUX"},
+
+ /* Analog Loops */
+- {"LIN1 Mixing Circuit", "NULL", "LIN1"},
+- {"RIN1 Mixing Circuit", "NULL", "RIN1"},
+- {"LIN2 Mixing Circuit", "NULL", "LIN2"},
+- {"RIN2 Mixing Circuit", "NULL", "RIN2"},
+- {"LIN3 Mixing Circuit", "NULL", "LIN3"},
+- {"RIN3 Mixing Circuit", "NULL", "RIN3"},
+- {"LIN4 Mixing Circuit", "NULL", "LIN4"},
+- {"RIN4 Mixing Circuit", "NULL", "RIN4"},
++ {"LIN1 Mixing Circuit", NULL, "LIN1"},
++ {"RIN1 Mixing Circuit", NULL, "RIN1"},
++ {"LIN2 Mixing Circuit", NULL, "LIN2"},
++ {"RIN2 Mixing Circuit", NULL, "RIN2"},
++ {"LIN3 Mixing Circuit", NULL, "LIN3"},
++ {"RIN3 Mixing Circuit", NULL, "RIN3"},
++ {"LIN4 Mixing Circuit", NULL, "LIN4"},
++ {"RIN4 Mixing Circuit", NULL, "RIN4"},
+
+ {"LOUT1 Mixer", "LINL1", "LIN1 Mixing Circuit"},
+ {"ROUT1 Mixer", "RINR1", "RIN1 Mixing Circuit"},
+diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
+index 79a4efc..7d3a6ac 100644
+--- a/sound/soc/codecs/cs4271.c
++++ b/sound/soc/codecs/cs4271.c
+@@ -286,7 +286,7 @@ static int cs4271_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = cs4271->deemph;
++ ucontrol->value.integer.value[0] = cs4271->deemph;
+ return 0;
+ }
+
+@@ -296,7 +296,7 @@ static int cs4271_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct cs4271_private *cs4271 = snd_soc_codec_get_drvdata(codec);
+
+- cs4271->deemph = ucontrol->value.enumerated.item[0];
++ cs4271->deemph = ucontrol->value.integer.value[0];
+ return cs4271_set_deemph(codec);
+ }
+
+diff --git a/sound/soc/codecs/da732x.c b/sound/soc/codecs/da732x.c
+index 61b2f9a..e3110c6 100644
+--- a/sound/soc/codecs/da732x.c
++++ b/sound/soc/codecs/da732x.c
+@@ -876,11 +876,11 @@ static const struct snd_soc_dapm_widget da732x_dapm_widgets[] = {
+
+ static const struct snd_soc_dapm_route da732x_dapm_routes[] = {
+ /* Inputs */
+- {"AUX1L PGA", "NULL", "AUX1L"},
+- {"AUX1R PGA", "NULL", "AUX1R"},
++ {"AUX1L PGA", NULL, "AUX1L"},
++ {"AUX1R PGA", NULL, "AUX1R"},
+ {"MIC1 PGA", NULL, "MIC1"},
+- {"MIC2 PGA", "NULL", "MIC2"},
+- {"MIC3 PGA", "NULL", "MIC3"},
++ {"MIC2 PGA", NULL, "MIC2"},
++ {"MIC3 PGA", NULL, "MIC3"},
+
+ /* Capture Path */
+ {"ADC1 Left MUX", "MIC1", "MIC1 PGA"},
+diff --git a/sound/soc/codecs/es8328.c b/sound/soc/codecs/es8328.c
+index f273251..c5f35a0 100644
+--- a/sound/soc/codecs/es8328.c
++++ b/sound/soc/codecs/es8328.c
+@@ -120,7 +120,7 @@ static int es8328_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = es8328->deemph;
++ ucontrol->value.integer.value[0] = es8328->deemph;
+ return 0;
+ }
+
+@@ -129,7 +129,7 @@ static int es8328_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct es8328_priv *es8328 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c
+index a722a02..477e13d 100644
+--- a/sound/soc/codecs/pcm1681.c
++++ b/sound/soc/codecs/pcm1681.c
+@@ -118,7 +118,7 @@ static int pcm1681_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = priv->deemph;
++ ucontrol->value.integer.value[0] = priv->deemph;
+
+ return 0;
+ }
+@@ -129,7 +129,7 @@ static int pcm1681_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct pcm1681_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- priv->deemph = ucontrol->value.enumerated.item[0];
++ priv->deemph = ucontrol->value.integer.value[0];
+
+ return pcm1681_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
+index aa98be3..10d2415 100644
+--- a/sound/soc/codecs/sgtl5000.c
++++ b/sound/soc/codecs/sgtl5000.c
+@@ -1149,13 +1149,7 @@ static int sgtl5000_set_power_regs(struct snd_soc_codec *codec)
+ /* Enable VDDC charge pump */
+ ana_pwr |= SGTL5000_VDDC_CHRGPMP_POWERUP;
+ } else if (vddio >= 3100 && vdda >= 3100) {
+- /*
+- * if vddio and vddd > 3.1v,
+- * charge pump should be clean before set ana_pwr
+- */
+- snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER,
+- SGTL5000_VDDC_CHRGPMP_POWERUP, 0);
+-
++ ana_pwr &= ~SGTL5000_VDDC_CHRGPMP_POWERUP;
+ /* VDDC use VDDIO rail */
+ lreg_ctrl |= SGTL5000_VDDC_ASSN_OVRD;
+ lreg_ctrl |= SGTL5000_VDDC_MAN_ASSN_VDDIO <<
+diff --git a/sound/soc/codecs/sn95031.c b/sound/soc/codecs/sn95031.c
+index 1f451a1..4ff4aa7 100644
+--- a/sound/soc/codecs/sn95031.c
++++ b/sound/soc/codecs/sn95031.c
+@@ -531,8 +531,8 @@ static const struct snd_soc_dapm_route sn95031_audio_map[] = {
+ /* speaker map */
+ { "IHFOUTL", NULL, "Speaker Rail"},
+ { "IHFOUTR", NULL, "Speaker Rail"},
+- { "IHFOUTL", "NULL", "Speaker Left Playback"},
+- { "IHFOUTR", "NULL", "Speaker Right Playback"},
++ { "IHFOUTL", NULL, "Speaker Left Playback"},
++ { "IHFOUTR", NULL, "Speaker Right Playback"},
+ { "Speaker Left Playback", NULL, "Speaker Left Filter"},
+ { "Speaker Right Playback", NULL, "Speaker Right Filter"},
+ { "Speaker Left Filter", NULL, "IHFDAC Left"},
+diff --git a/sound/soc/codecs/tas5086.c b/sound/soc/codecs/tas5086.c
+index 249ef5c..32942be 100644
+--- a/sound/soc/codecs/tas5086.c
++++ b/sound/soc/codecs/tas5086.c
+@@ -281,7 +281,7 @@ static int tas5086_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = priv->deemph;
++ ucontrol->value.integer.value[0] = priv->deemph;
+
+ return 0;
+ }
+@@ -292,7 +292,7 @@ static int tas5086_put_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct tas5086_private *priv = snd_soc_codec_get_drvdata(codec);
+
+- priv->deemph = ucontrol->value.enumerated.item[0];
++ priv->deemph = ucontrol->value.integer.value[0];
+
+ return tas5086_set_deemph(codec);
+ }
+diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
+index 34ef65c..8eeab47 100644
+--- a/sound/soc/codecs/wm2000.c
++++ b/sound/soc/codecs/wm2000.c
+@@ -610,7 +610,7 @@ static int wm2000_anc_mode_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->anc_active;
++ ucontrol->value.integer.value[0] = wm2000->anc_active;
+
+ return 0;
+ }
+@@ -620,7 +620,7 @@ static int wm2000_anc_mode_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int anc_active = ucontrol->value.enumerated.item[0];
++ int anc_active = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (anc_active > 1)
+@@ -643,7 +643,7 @@ static int wm2000_speaker_get(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+
+- ucontrol->value.enumerated.item[0] = wm2000->spk_ena;
++ ucontrol->value.integer.value[0] = wm2000->spk_ena;
+
+ return 0;
+ }
+@@ -653,7 +653,7 @@ static int wm2000_speaker_put(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm2000_priv *wm2000 = dev_get_drvdata(codec->dev);
+- int val = ucontrol->value.enumerated.item[0];
++ int val = ucontrol->value.integer.value[0];
+ int ret;
+
+ if (val > 1)
+diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c
+index b115ed8..391534f 100644
+--- a/sound/soc/codecs/wm8731.c
++++ b/sound/soc/codecs/wm8731.c
+@@ -125,7 +125,7 @@ static int wm8731_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8731->deemph;
++ ucontrol->value.integer.value[0] = wm8731->deemph;
+
+ return 0;
+ }
+@@ -135,7 +135,7 @@ static int wm8731_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8731_priv *wm8731 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8903.c b/sound/soc/codecs/wm8903.c
+index cc6b0ef..15435c9 100644
+--- a/sound/soc/codecs/wm8903.c
++++ b/sound/soc/codecs/wm8903.c
+@@ -442,7 +442,7 @@ static int wm8903_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8903->deemph;
++ ucontrol->value.integer.value[0] = wm8903->deemph;
+
+ return 0;
+ }
+@@ -452,7 +452,7 @@ static int wm8903_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8903_priv *wm8903 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+ int ret = 0;
+
+ if (deemph > 1)
+diff --git a/sound/soc/codecs/wm8904.c b/sound/soc/codecs/wm8904.c
+index 75b87c5..b945a3b 100644
+--- a/sound/soc/codecs/wm8904.c
++++ b/sound/soc/codecs/wm8904.c
+@@ -525,7 +525,7 @@ static int wm8904_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8904->deemph;
++ ucontrol->value.integer.value[0] = wm8904->deemph;
+ return 0;
+ }
+
+@@ -534,7 +534,7 @@ static int wm8904_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8904_priv *wm8904 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8955.c b/sound/soc/codecs/wm8955.c
+index 1173f7f..035bdc4 100644
+--- a/sound/soc/codecs/wm8955.c
++++ b/sound/soc/codecs/wm8955.c
+@@ -393,7 +393,7 @@ static int wm8955_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8955->deemph;
++ ucontrol->value.integer.value[0] = wm8955->deemph;
+ return 0;
+ }
+
+@@ -402,7 +402,7 @@ static int wm8955_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8955_priv *wm8955 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
+index a96eb49..0435aeb 100644
+--- a/sound/soc/codecs/wm8960.c
++++ b/sound/soc/codecs/wm8960.c
+@@ -182,7 +182,7 @@ static int wm8960_get_deemph(struct snd_kcontrol *kcontrol,
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+
+- ucontrol->value.enumerated.item[0] = wm8960->deemph;
++ ucontrol->value.integer.value[0] = wm8960->deemph;
+ return 0;
+ }
+
+@@ -191,7 +191,7 @@ static int wm8960_put_deemph(struct snd_kcontrol *kcontrol,
+ {
+ struct snd_soc_codec *codec = snd_soc_kcontrol_codec(kcontrol);
+ struct wm8960_priv *wm8960 = snd_soc_codec_get_drvdata(codec);
+- int deemph = ucontrol->value.enumerated.item[0];
++ int deemph = ucontrol->value.integer.value[0];
+
+ if (deemph > 1)
+ return -EINVAL;
+diff --git a/sound/soc/codecs/wm9712.c b/sound/soc/codecs/wm9712.c
+index 9517571..98c9525 100644
+--- a/sound/soc/codecs/wm9712.c
++++ b/sound/soc/codecs/wm9712.c
+@@ -180,7 +180,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
+ struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
+ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
+ struct wm9712_priv *wm9712 = snd_soc_codec_get_drvdata(codec);
+- unsigned int val = ucontrol->value.enumerated.item[0];
++ unsigned int val = ucontrol->value.integer.value[0];
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
+ unsigned int mixer, mask, shift, old;
+@@ -193,7 +193,7 @@ static int wm9712_hp_mixer_put(struct snd_kcontrol *kcontrol,
+
+ mutex_lock(&wm9712->lock);
+ old = wm9712->hp_mixer[mixer];
+- if (ucontrol->value.enumerated.item[0])
++ if (ucontrol->value.integer.value[0])
+ wm9712->hp_mixer[mixer] |= mask;
+ else
+ wm9712->hp_mixer[mixer] &= ~mask;
+@@ -231,7 +231,7 @@ static int wm9712_hp_mixer_get(struct snd_kcontrol *kcontrol,
+ mixer = mc->shift >> 8;
+ shift = mc->shift & 0xff;
+
+- ucontrol->value.enumerated.item[0] =
++ ucontrol->value.integer.value[0] =
+ (wm9712->hp_mixer[mixer] >> shift) & 1;
+
+ return 0;
+diff --git a/sound/soc/codecs/wm9713.c b/sound/soc/codecs/wm9713.c
+index 6ab1122..db644c6 100644
+--- a/sound/soc/codecs/wm9713.c
++++ b/sound/soc/codecs/wm9713.c
+@@ -255,7 +255,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
+ struct snd_soc_dapm_context *dapm = snd_soc_dapm_kcontrol_dapm(kcontrol);
+ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(dapm);
+ struct wm9713_priv *wm9713 = snd_soc_codec_get_drvdata(codec);
+- unsigned int val = ucontrol->value.enumerated.item[0];
++ unsigned int val = ucontrol->value.integer.value[0];
+ struct soc_mixer_control *mc =
+ (struct soc_mixer_control *)kcontrol->private_value;
+ unsigned int mixer, mask, shift, old;
+@@ -268,7 +268,7 @@ static int wm9713_hp_mixer_put(struct snd_kcontrol *kcontrol,
+
+ mutex_lock(&wm9713->lock);
+ old = wm9713->hp_mixer[mixer];
+- if (ucontrol->value.enumerated.item[0])
++ if (ucontrol->value.integer.value[0])
+ wm9713->hp_mixer[mixer] |= mask;
+ else
+ wm9713->hp_mixer[mixer] &= ~mask;
+@@ -306,7 +306,7 @@ static int wm9713_hp_mixer_get(struct snd_kcontrol *kcontrol,
+ mixer = mc->shift >> 8;
+ shift = mc->shift & 0xff;
+
+- ucontrol->value.enumerated.item[0] =
++ ucontrol->value.integer.value[0] =
+ (wm9713->hp_mixer[mixer] >> shift) & 1;
+
+ return 0;
diff --git a/3.19.3/4420_grsecurity-3.1-3.19.3-201504021826.patch b/3.19.4/4420_grsecurity-3.1-3.19.4-201504142300.patch
similarity index 99%
rename from 3.19.3/4420_grsecurity-3.1-3.19.3-201504021826.patch
rename to 3.19.4/4420_grsecurity-3.1-3.19.4-201504142300.patch
index f16dac3..93459d8 100644
--- a/3.19.3/4420_grsecurity-3.1-3.19.3-201504021826.patch
+++ b/3.19.4/4420_grsecurity-3.1-3.19.4-201504142300.patch
@@ -373,7 +373,7 @@ index 176d4fe..6eabd3c 100644
pcd. [PARIDE]
diff --git a/Makefile b/Makefile
-index 713bf26..9ceae96 100644
+index 2ef2078..dbf475b 100644
--- a/Makefile
+++ b/Makefile
@@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -4823,7 +4823,7 @@ index a5abb00..9cbca9a 100644
#define smp_load_acquire(p) \
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
-index 09da25b..3ea0d64 100644
+index 4fde8c1..441f84f 100644
--- a/arch/arm64/include/asm/percpu.h
+++ b/arch/arm64/include/asm/percpu.h
@@ -135,16 +135,16 @@ static inline void __percpu_write(void *ptr, unsigned long val, int size)
@@ -8898,7 +8898,7 @@ index 3e68d1c..72a5ee6 100644
ld r4,_DAR(r1)
bl bad_page_fault
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
-index c2df815..bae3d12 100644
+index 9519e6b..13f6c38 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -1599,10 +1599,10 @@ handle_page_fault:
@@ -17747,7 +17747,7 @@ index 802dde3..9183e68 100644
#include <asm-generic/memory_model.h>
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
-index b3bebf9..e1f5d95 100644
+index b3bebf9..13ac22e 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -7,9 +7,9 @@
@@ -17762,6 +17762,17 @@ index b3bebf9..e1f5d95 100644
{
unsigned long y = x - __START_KERNEL_map;
+@@ -20,8 +20,8 @@ static inline unsigned long __phys_addr_nodebug(unsigned long x)
+ }
+
+ #ifdef CONFIG_DEBUG_VIRTUAL
+-extern unsigned long __phys_addr(unsigned long);
+-extern unsigned long __phys_addr_symbol(unsigned long);
++extern unsigned long __intentional_overflow(-1) __phys_addr(unsigned long);
++extern unsigned long __intentional_overflow(-1) __phys_addr_symbol(unsigned long);
+ #else
+ #define __phys_addr(x) __phys_addr_nodebug(x)
+ #define __phys_addr_symbol(x) \
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index 32444ae..1a1624b 100644
--- a/arch/x86/include/asm/paravirt.h
@@ -19629,7 +19640,7 @@ index 04905bf..1178cdf 100644
}
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
-index 0d592e0..7430aad 100644
+index 0d592e0..cbc90a3 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -7,6 +7,7 @@
@@ -19692,7 +19703,24 @@ index 0d592e0..7430aad 100644
/*
* The exception table consists of pairs of addresses relative to the
-@@ -176,10 +210,12 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+@@ -134,11 +168,13 @@ extern int __get_user_8(void);
+ extern int __get_user_bad(void);
+
+ /*
+- * This is a type: either unsigned long, if the argument fits into
+- * that type, or otherwise unsigned long long.
++ * This is a type: either (un)signed int, if the argument fits into
++ * that type, or otherwise (un)signed long long.
+ */
+ #define __inttype(x) \
+-__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
++__typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0U), \
++ __builtin_choose_expr(__type_is_unsigned(__typeof__(x)), 0ULL, 0LL),\
++ __builtin_choose_expr(__type_is_unsigned(__typeof__(x)), 0U, 0)))
+
+ /**
+ * get_user: - Get a simple variable from user space.
+@@ -176,10 +212,12 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
register __inttype(*(ptr)) __val_gu asm("%"_ASM_DX); \
__chk_user_ptr(ptr); \
might_fault(); \
@@ -19705,7 +19733,7 @@ index 0d592e0..7430aad 100644
__ret_gu; \
})
-@@ -187,13 +223,21 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+@@ -187,13 +225,21 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
: "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
@@ -19730,7 +19758,7 @@ index 0d592e0..7430aad 100644
"3: " ASM_CLAC "\n" \
".section .fixup,\"ax\"\n" \
"4: movl %3,%0\n" \
-@@ -206,8 +250,8 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
+@@ -206,8 +252,8 @@ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL))
#define __put_user_asm_ex_u64(x, addr) \
asm volatile(ASM_STAC "\n" \
@@ -19741,7 +19769,7 @@ index 0d592e0..7430aad 100644
"3: " ASM_CLAC "\n" \
_ASM_EXTABLE_EX(1b, 2b) \
_ASM_EXTABLE_EX(2b, 3b) \
-@@ -257,7 +301,8 @@ extern void __put_user_8(void);
+@@ -257,7 +303,8 @@ extern void __put_user_8(void);
__typeof__(*(ptr)) __pu_val; \
__chk_user_ptr(ptr); \
might_fault(); \
@@ -19751,7 +19779,7 @@ index 0d592e0..7430aad 100644
switch (sizeof(*(ptr))) { \
case 1: \
__put_user_x(1, __pu_val, ptr, __ret_pu); \
-@@ -275,6 +320,7 @@ extern void __put_user_8(void);
+@@ -275,6 +322,7 @@ extern void __put_user_8(void);
__put_user_x(X, __pu_val, ptr, __ret_pu); \
break; \
} \
@@ -19759,7 +19787,7 @@ index 0d592e0..7430aad 100644
__ret_pu; \
})
-@@ -355,8 +401,10 @@ do { \
+@@ -355,8 +403,10 @@ do { \
} while (0)
#define __get_user_asm(x, addr, err, itype, rtype, ltype, errret) \
@@ -19771,7 +19799,7 @@ index 0d592e0..7430aad 100644
"2: " ASM_CLAC "\n" \
".section .fixup,\"ax\"\n" \
"3: mov %3,%0\n" \
-@@ -364,8 +412,10 @@ do { \
+@@ -364,8 +414,10 @@ do { \
" jmp 2b\n" \
".previous\n" \
_ASM_EXTABLE(1b, 3b) \
@@ -19784,7 +19812,7 @@ index 0d592e0..7430aad 100644
#define __get_user_size_ex(x, ptr, size) \
do { \
-@@ -389,7 +439,7 @@ do { \
+@@ -389,7 +441,7 @@ do { \
} while (0)
#define __get_user_asm_ex(x, addr, itype, rtype, ltype) \
@@ -19793,7 +19821,7 @@ index 0d592e0..7430aad 100644
"2:\n" \
_ASM_EXTABLE_EX(1b, 2b) \
: ltype(x) : "m" (__m(addr)))
-@@ -406,13 +456,24 @@ do { \
+@@ -406,13 +458,24 @@ do { \
int __gu_err; \
unsigned long __gu_val; \
__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
@@ -19820,7 +19848,7 @@ index 0d592e0..7430aad 100644
/*
* Tell gcc we read from memory instead of writing: this is because
-@@ -420,8 +481,10 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -420,8 +483,10 @@ struct __large_struct { unsigned long buf[100]; };
* aliasing issues.
*/
#define __put_user_asm(x, addr, err, itype, rtype, ltype, errret) \
@@ -19832,7 +19860,7 @@ index 0d592e0..7430aad 100644
"2: " ASM_CLAC "\n" \
".section .fixup,\"ax\"\n" \
"3: mov %3,%0\n" \
-@@ -429,10 +492,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -429,10 +494,12 @@ struct __large_struct { unsigned long buf[100]; };
".previous\n" \
_ASM_EXTABLE(1b, 3b) \
: "=r"(err) \
@@ -19847,7 +19875,7 @@ index 0d592e0..7430aad 100644
"2:\n" \
_ASM_EXTABLE_EX(1b, 2b) \
: : ltype(x), "m" (__m(addr)))
-@@ -442,11 +507,13 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -442,11 +509,13 @@ struct __large_struct { unsigned long buf[100]; };
*/
#define uaccess_try do { \
current_thread_info()->uaccess_err = 0; \
@@ -19861,7 +19889,7 @@ index 0d592e0..7430aad 100644
(err) |= (current_thread_info()->uaccess_err ? -EFAULT : 0); \
} while (0)
-@@ -471,8 +538,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -471,8 +540,12 @@ struct __large_struct { unsigned long buf[100]; };
* On error, the variable @x is set to zero.
*/
@@ -19874,7 +19902,7 @@ index 0d592e0..7430aad 100644
/**
* __put_user: - Write a simple value into user space, with less checking.
-@@ -494,8 +565,12 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -494,8 +567,12 @@ struct __large_struct { unsigned long buf[100]; };
* Returns zero on success, or -EFAULT on error.
*/
@@ -19887,7 +19915,7 @@ index 0d592e0..7430aad 100644
#define __get_user_unaligned __get_user
#define __put_user_unaligned __put_user
-@@ -513,7 +588,7 @@ struct __large_struct { unsigned long buf[100]; };
+@@ -513,7 +590,7 @@ struct __large_struct { unsigned long buf[100]; };
#define get_user_ex(x, ptr) do { \
unsigned long __gue_val; \
__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr)))); \
@@ -19896,7 +19924,7 @@ index 0d592e0..7430aad 100644
} while (0)
#define put_user_try uaccess_try
-@@ -531,7 +606,7 @@ extern __must_check long strlen_user(const char __user *str);
+@@ -531,7 +608,7 @@ extern __must_check long strlen_user(const char __user *str);
extern __must_check long strnlen_user(const char __user *str, long n);
unsigned long __must_check clear_user(void __user *mem, unsigned long len);
@@ -19905,7 +19933,7 @@ index 0d592e0..7430aad 100644
extern void __cmpxchg_wrong_size(void)
__compiletime_error("Bad argument size for cmpxchg");
-@@ -542,18 +617,19 @@ extern void __cmpxchg_wrong_size(void)
+@@ -542,18 +619,19 @@ extern void __cmpxchg_wrong_size(void)
__typeof__(ptr) __uval = (uval); \
__typeof__(*(ptr)) __old = (old); \
__typeof__(*(ptr)) __new = (new); \
@@ -19927,7 +19955,7 @@ index 0d592e0..7430aad 100644
: "i" (-EFAULT), "q" (__new), "1" (__old) \
: "memory" \
); \
-@@ -562,14 +638,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -562,14 +640,14 @@ extern void __cmpxchg_wrong_size(void)
case 2: \
{ \
asm volatile("\t" ASM_STAC "\n" \
@@ -19944,7 +19972,7 @@ index 0d592e0..7430aad 100644
: "i" (-EFAULT), "r" (__new), "1" (__old) \
: "memory" \
); \
-@@ -578,14 +654,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -578,14 +656,14 @@ extern void __cmpxchg_wrong_size(void)
case 4: \
{ \
asm volatile("\t" ASM_STAC "\n" \
@@ -19961,7 +19989,7 @@ index 0d592e0..7430aad 100644
: "i" (-EFAULT), "r" (__new), "1" (__old) \
: "memory" \
); \
-@@ -597,14 +673,14 @@ extern void __cmpxchg_wrong_size(void)
+@@ -597,14 +675,14 @@ extern void __cmpxchg_wrong_size(void)
__cmpxchg_wrong_size(); \
\
asm volatile("\t" ASM_STAC "\n" \
@@ -19978,7 +20006,7 @@ index 0d592e0..7430aad 100644
: "i" (-EFAULT), "r" (__new), "1" (__old) \
: "memory" \
); \
-@@ -613,6 +689,7 @@ extern void __cmpxchg_wrong_size(void)
+@@ -613,6 +691,7 @@ extern void __cmpxchg_wrong_size(void)
default: \
__cmpxchg_wrong_size(); \
} \
@@ -19986,7 +20014,7 @@ index 0d592e0..7430aad 100644
*__uval = __old; \
__ret; \
})
-@@ -636,17 +713,6 @@ extern struct movsl_mask {
+@@ -636,17 +715,6 @@ extern struct movsl_mask {
#define ARCH_HAS_NOCACHE_UACCESS 1
@@ -20004,7 +20032,7 @@ index 0d592e0..7430aad 100644
#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
# define copy_user_diag __compiletime_error
#else
-@@ -656,7 +722,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
+@@ -656,7 +724,7 @@ unsigned long __must_check _copy_to_user(void __user *to, const void *from,
extern void copy_user_diag("copy_from_user() buffer size is too small")
copy_from_user_overflow(void);
extern void copy_user_diag("copy_to_user() buffer size is too small")
@@ -20013,7 +20041,7 @@ index 0d592e0..7430aad 100644
#undef copy_user_diag
-@@ -669,7 +735,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
+@@ -669,7 +737,7 @@ __copy_from_user_overflow(void) __asm__("copy_from_user_overflow");
extern void
__compiletime_warning("copy_to_user() buffer size is not provably correct")
@@ -20022,7 +20050,7 @@ index 0d592e0..7430aad 100644
#define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
#else
-@@ -684,10 +750,16 @@ __copy_from_user_overflow(int size, unsigned long count)
+@@ -684,10 +752,16 @@ __copy_from_user_overflow(int size, unsigned long count)
#endif
@@ -20040,7 +20068,7 @@ index 0d592e0..7430aad 100644
might_fault();
-@@ -709,12 +781,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -709,12 +783,15 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
* case, and do only runtime checking for non-constant sizes.
*/
@@ -20062,7 +20090,7 @@ index 0d592e0..7430aad 100644
return n;
}
-@@ -722,17 +797,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
+@@ -722,17 +799,18 @@ copy_from_user(void *to, const void __user *from, unsigned long n)
static inline unsigned long __must_check
copy_to_user(void __user *to, const void *from, unsigned long n)
{
@@ -33776,7 +33804,7 @@ index 9f0614d..92ae64a 100644
p += get_opcode(p, &opcode);
for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
-index 6fb6927..4fc13c0 100644
+index 6fb6927..634b0f7 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -97,10 +97,71 @@ static inline void pgd_list_del(pgd_t *pgd)
@@ -33829,7 +33857,7 @@ index 6fb6927..4fc13c0 100644
+#define pyd_t pgd_t
+#define paravirt_release_pxd(pfn) paravirt_release_pud(pfn)
+#define pgtable_pxd_page_ctor(page) true
-+#define pgtable_pxd_page_dtor(page)
++#define pgtable_pxd_page_dtor(page) do {} while (0)
+#define pxd_free(mm, pud) pud_free((mm), (pud))
+#define pyd_populate(mm, pgd, pud) pgd_populate((mm), (pgd), (pud))
+#define pyd_offset(mm, address) pgd_offset((mm), (address))
@@ -36126,6 +36154,28 @@ index f890d43..97b0482 100644
if (do_copy)
bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
else
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 2390c55..e3fefe4 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -1456,7 +1456,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
+
+ do {
+ page = alloc_pages_node(set->numa_node,
+- GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY,
++ GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO,
+ this_order);
+ if (page)
+ break;
+@@ -1478,8 +1478,6 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set,
+ left -= to_do * rq_size;
+ for (j = 0; j < to_do; j++) {
+ tags->rqs[i] = p;
+- tags->rqs[i]->atomic_flags = 0;
+- tags->rqs[i]->cmd_flags = 0;
+ if (set->ops->init_request) {
+ if (set->ops->init_request(set->driver_data,
+ tags->rqs[i], hctx_idx, i,
diff --git a/block/blk-softirq.c b/block/blk-softirq.c
index 53b1737..08177d2e 100644
--- a/block/blk-softirq.c
@@ -36348,6 +36398,23 @@ index c305d41..a96de79 100644
if (!ret)
kobject_uevent(&pinst->kobj, KOBJ_ADD);
+diff --git a/crypto/zlib.c b/crypto/zlib.c
+index 0eefa9d..0fa3d29 100644
+--- a/crypto/zlib.c
++++ b/crypto/zlib.c
+@@ -95,10 +95,10 @@ static int zlib_compress_setup(struct crypto_pcomp *tfm, void *params,
+ zlib_comp_exit(ctx);
+
+ window_bits = tb[ZLIB_COMP_WINDOWBITS]
+- ? nla_get_u32(tb[ZLIB_COMP_WINDOWBITS])
++ ? nla_get_s32(tb[ZLIB_COMP_WINDOWBITS])
+ : MAX_WBITS;
+ mem_level = tb[ZLIB_COMP_MEMLEVEL]
+- ? nla_get_u32(tb[ZLIB_COMP_MEMLEVEL])
++ ? nla_get_s32(tb[ZLIB_COMP_MEMLEVEL])
+ : DEF_MEM_LEVEL;
+
+ workspacesize = zlib_deflate_workspacesize(window_bits, mem_level);
diff --git a/drivers/acpi/acpica/hwxfsleep.c b/drivers/acpi/acpica/hwxfsleep.c
index 6921c7f..78e1af7 100644
--- a/drivers/acpi/acpica/hwxfsleep.c
@@ -40675,7 +40742,7 @@ index b250130..98df2a4 100644
imx_drm_crtc = kzalloc(sizeof(*imx_drm_crtc), GFP_KERNEL);
diff --git a/drivers/gpu/drm/mga/mga_drv.h b/drivers/gpu/drm/mga/mga_drv.h
-index b4a2014..219ab78 100644
+index b4a20149..219ab78 100644
--- a/drivers/gpu/drm/mga/mga_drv.h
+++ b/drivers/gpu/drm/mga/mga_drv.h
@@ -122,9 +122,9 @@ typedef struct drm_mga_private {
@@ -44394,7 +44461,7 @@ index 43adbb8..7b34305 100644
pmd->bl_info.value_type.inc = data_block_inc;
pmd->bl_info.value_type.dec = data_block_dec;
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
-index 64b10e0..07db8f4 100644
+index b71c600..d0b85b3 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -185,9 +185,9 @@ struct mapped_device {
@@ -44429,7 +44496,7 @@ index 64b10e0..07db8f4 100644
wake_up(&md->eventq);
}
-@@ -3034,18 +3034,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
+@@ -3055,18 +3055,18 @@ int dm_kobject_uevent(struct mapped_device *md, enum kobject_action action,
uint32_t dm_next_uevent_seq(struct mapped_device *md)
{
@@ -44709,9 +44776,39 @@ index 32e282f..5cec803 100644
rdev_dec_pending(rdev, mddev);
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
-index 8577cc7..e80e05d 100644
+index 8577cc7..5779d5b 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
+@@ -950,23 +950,23 @@ async_copy_data(int frombio, struct bio *bio, struct page **page,
+ struct bio_vec bvl;
+ struct bvec_iter iter;
+ struct page *bio_page;
+- int page_offset;
++ s64 page_offset;
+ struct async_submit_ctl submit;
+ enum async_tx_flags flags = 0;
+
+ if (bio->bi_iter.bi_sector >= sector)
+- page_offset = (signed)(bio->bi_iter.bi_sector - sector) * 512;
++ page_offset = (s64)(bio->bi_iter.bi_sector - sector) * 512;
+ else
+- page_offset = (signed)(sector - bio->bi_iter.bi_sector) * -512;
++ page_offset = (s64)(sector - bio->bi_iter.bi_sector) * -512;
+
+ if (frombio)
+ flags |= ASYNC_TX_FENCE;
+ init_async_submit(&submit, flags, tx, NULL, NULL, NULL);
+
+ bio_for_each_segment(bvl, bio, iter) {
+- int len = bvl.bv_len;
+- int clen;
+- int b_offset = 0;
++ s64 len = bvl.bv_len;
++ s64 clen;
++ s64 b_offset = 0;
+
+ if (page_offset < 0) {
+ b_offset = -page_offset;
@@ -1730,6 +1730,10 @@ static int grow_one_stripe(struct r5conf *conf, int hash)
return 1;
}
@@ -51832,10 +51929,10 @@ index 011a336..fb2b7a0 100644
.read = fuse_read,
};
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
-index 66a70e9..f82cea4 100644
+index a17f533..a2ff039 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
-@@ -2238,7 +2238,7 @@ int spi_bus_unlock(struct spi_master *master)
+@@ -2239,7 +2239,7 @@ int spi_bus_unlock(struct spi_master *master)
EXPORT_SYMBOL_GPL(spi_bus_unlock);
/* portable code must never pass more than 32 bytes */
@@ -52329,6 +52426,19 @@ index 46dad63..fe4acdc 100644
/** Register functions (in the bus driver) to get called by visorchipset
* whenever a bus or device appears for which this service partition is
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index 8d27db47..22d67c0 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -1185,7 +1185,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
+ * traditional iSCSI block I/O.
+ */
+ if (iscsit_allocate_iovecs(cmd) < 0) {
+- return iscsit_add_reject_cmd(cmd,
++ return iscsit_reject_cmd(cmd,
+ ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
+ }
+ immed_data = cmd->immediate_data;
diff --git a/drivers/target/sbp/sbp_target.c b/drivers/target/sbp/sbp_target.c
index 9512af6..045bf5a 100644
--- a/drivers/target/sbp/sbp_target.c
@@ -61875,7 +61985,7 @@ index 999ff5c..2281df9 100644
retval = -EFAULT;
goto out_handle;
diff --git a/fs/file.c b/fs/file.c
-index ee738ea..f6c1562 100644
+index ee738ea..f6c15629 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -16,6 +16,7 @@
@@ -80368,7 +80478,7 @@ index c8c5659..d09f2ad 100644
* Mark a position in code as unreachable. This can be used to
* suppress control flow warnings after asm blocks that transfer
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
-index fa6a314..752a6ef 100644
+index fa6a314..a1b01ad 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -5,11 +5,14 @@
@@ -80538,7 +80648,16 @@ index fa6a314..752a6ef 100644
/* Simple shorthand for a section definition */
#ifndef __section
# define __section(S) __attribute__ ((__section__(#S)))
-@@ -462,8 +528,9 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+@@ -383,6 +449,8 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
+ # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
+ #endif
+
++#define __type_is_unsigned(t) (__same_type((t)0, 0UL) || __same_type((t)0, 0U) || __same_type((t)0, (unsigned short)0) || __same_type((t)0, (unsigned char)0))
++
+ /* Is this type a native word size -- useful for atomic operations */
+ #ifndef __native_word
+ # define __native_word(t) (sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
+@@ -462,8 +530,9 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s
*/
#define __ACCESS_ONCE(x) ({ \
__maybe_unused typeof(x) __var = (__force typeof(x)) 0; \
@@ -85467,28 +85586,24 @@ index e7a018e..49f8b17 100644
extern dma_addr_t swiotlb_map_page(struct device *dev, struct page *page,
unsigned long offset, size_t size,
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
-index 85893d7..4923581 100644
+index 85893d7..e78c660 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
-@@ -99,10 +99,16 @@ union bpf_attr;
- #define __MAP(n,...) __MAP##n(__VA_ARGS__)
-
- #define __SC_DECL(t, a) t a
-+#define __TYPE_IS_U(t) (__same_type((t)0, 0UL) || __same_type((t)0, 0U) || __same_type((t)0, (unsigned short)0) || __same_type((t)0, (unsigned char)0))
+@@ -102,7 +102,12 @@ union bpf_attr;
#define __TYPE_IS_L(t) (__same_type((t)0, 0L))
#define __TYPE_IS_UL(t) (__same_type((t)0, 0UL))
#define __TYPE_IS_LL(t) (__same_type((t)0, 0LL) || __same_type((t)0, 0ULL))
-#define __SC_LONG(t, a) __typeof(__builtin_choose_expr(__TYPE_IS_LL(t), 0LL, 0L)) a
-+#define __SC_LONG(t, a) __typeof( \
++#define __SC_LONG(t, a) __typeof__( \
+ __builtin_choose_expr( \
+ sizeof(t) > sizeof(int), \
+ (t) 0, \
-+ __builtin_choose_expr(__TYPE_IS_U(t), 0UL, 0L) \
++ __builtin_choose_expr(__type_is_unsigned(t), 0UL, 0L) \
+ )) a
#define __SC_CAST(t, a) (t) a
#define __SC_ARGS(t, a) a
#define __SC_TEST(t, a) (void)BUILD_BUG_ON_ZERO(!__TYPE_IS_LL(t) && sizeof(t) > sizeof(long))
-@@ -384,11 +390,11 @@ asmlinkage long sys_sync(void);
+@@ -384,11 +389,11 @@ asmlinkage long sys_sync(void);
asmlinkage long sys_fsync(unsigned int fd);
asmlinkage long sys_fdatasync(unsigned int fd);
asmlinkage long sys_bdflush(int func, long data);
@@ -85504,7 +85619,7 @@ index 85893d7..4923581 100644
asmlinkage long sys_truncate(const char __user *path, long length);
asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length);
asmlinkage long sys_stat(const char __user *filename,
-@@ -600,7 +606,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
+@@ -600,7 +605,7 @@ asmlinkage long sys_getsockname(int, struct sockaddr __user *, int __user *);
asmlinkage long sys_getpeername(int, struct sockaddr __user *, int __user *);
asmlinkage long sys_send(int, void __user *, size_t, unsigned);
asmlinkage long sys_sendto(int, void __user *, size_t, unsigned,
@@ -88728,7 +88843,7 @@ index 60f6bb8..104bb07 100644
#ifdef CONFIG_MODULE_UNLOAD
{
diff --git a/kernel/events/core.c b/kernel/events/core.c
-index 19efcf133..7c05c93 100644
+index 7959624..c01b886 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -170,8 +170,15 @@ static struct srcu_struct pmus_srcu;
@@ -88800,7 +88915,7 @@ index 19efcf133..7c05c93 100644
arch_perf_update_userpage(userpg, now);
-@@ -4568,7 +4575,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
+@@ -4578,7 +4585,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size,
/* Data. */
sp = perf_user_stack_pointer(regs);
@@ -88809,7 +88924,7 @@ index 19efcf133..7c05c93 100644
dyn_size = dump_size - rem;
perf_output_skip(handle, rem);
-@@ -4659,11 +4666,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
+@@ -4669,11 +4676,11 @@ static void perf_output_read_one(struct perf_output_handle *handle,
values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
values[n++] = enabled +
@@ -88823,7 +88938,7 @@ index 19efcf133..7c05c93 100644
}
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(event);
-@@ -6994,7 +7001,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
+@@ -7004,7 +7011,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
event->parent = parent_event;
event->ns = get_pid_ns(task_active_pid_ns(current));
@@ -88832,7 +88947,7 @@ index 19efcf133..7c05c93 100644
event->state = PERF_EVENT_STATE_INACTIVE;
-@@ -7275,6 +7282,11 @@ SYSCALL_DEFINE5(perf_event_open,
+@@ -7285,6 +7292,11 @@ SYSCALL_DEFINE5(perf_event_open,
if (flags & ~PERF_FLAG_ALL)
return -EINVAL;
@@ -88844,7 +88959,7 @@ index 19efcf133..7c05c93 100644
err = perf_copy_attr(attr_uptr, &attr);
if (err)
return err;
-@@ -7642,10 +7654,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -7652,10 +7664,10 @@ static void sync_child_event(struct perf_event *child_event,
/*
* Add back the child's count to the parent's count:
*/
@@ -89707,7 +89822,7 @@ index 9a8a01a..3c35dd6 100644
/* Don't allow clients that don't understand the native
diff --git a/kernel/kmod.c b/kernel/kmod.c
-index 2777f40..a26e825 100644
+index 2777f40..a689506 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -68,7 +68,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -89855,9 +89970,9 @@ index 2777f40..a26e825 100644
+ */
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
+ strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
-+ strncmp(sub_info->path, "/usr/libexec/", 13) &&
++ strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
+ strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
++ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
+ retval = -EPERM;
+ goto out;
+ }
@@ -95834,7 +95949,7 @@ index d53adf9..03a24bf 100644
set_fs(old_fs);
diff --git a/mm/madvise.c b/mm/madvise.c
-index a271adc..831d82f 100644
+index a271adc..5e1a2b4 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -51,6 +51,10 @@ static long madvise_behavior(struct vm_area_struct *vma,
@@ -95887,9 +96002,9 @@ index a271adc..831d82f 100644
+ .nonlinear_vma = vma_m,
+ .last_index = ULONG_MAX,
+ };
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
++ zap_page_range(vma_m, start + SEGMEXEC_TASK_SIZE, end - start, &details);
+ } else
-+ zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
++ zap_page_range(vma_m, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
+ }
+#endif
+
@@ -96867,7 +96982,7 @@ index 73cf098..ab547c7 100644
capable(CAP_IPC_LOCK))
ret = do_mlockall(flags);
diff --git a/mm/mmap.c b/mm/mmap.c
-index e5cc3ca..bb9333f 100644
+index e5cc3ca..2bfa432 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -41,6 +41,7 @@
@@ -96963,7 +97078,19 @@ index e5cc3ca..bb9333f 100644
mm->end_data, mm->start_data))
goto out;
-@@ -978,6 +1007,12 @@ static int
+@@ -780,10 +809,8 @@ again: remove_next = 1 + (end > next->vm_end);
+
+ importer->anon_vma = exporter->anon_vma;
+ error = anon_vma_clone(importer, exporter);
+- if (error) {
+- importer->anon_vma = NULL;
++ if (error)
+ return error;
+- }
+ }
+ }
+
+@@ -978,6 +1005,12 @@ static int
can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
{
@@ -96976,7 +97103,7 @@ index e5cc3ca..bb9333f 100644
if (is_mergeable_vma(vma, file, vm_flags) &&
is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
if (vma->vm_pgoff == vm_pgoff)
-@@ -997,6 +1032,12 @@ static int
+@@ -997,6 +1030,12 @@ static int
can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
{
@@ -96989,7 +97116,7 @@ index e5cc3ca..bb9333f 100644
if (is_mergeable_vma(vma, file, vm_flags) &&
is_mergeable_anon_vma(anon_vma, vma->anon_vma, vma)) {
pgoff_t vm_pglen;
-@@ -1046,6 +1087,13 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1046,6 +1085,13 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
struct vm_area_struct *area, *next;
int err;
@@ -97003,7 +97130,7 @@ index e5cc3ca..bb9333f 100644
/*
* We later require that vma->vm_flags == vm_flags,
* so this tests vma->vm_flags & VM_SPECIAL, too.
-@@ -1061,6 +1109,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1061,6 +1107,15 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
if (next && next->vm_end == end) /* cases 6, 7, 8 */
next = next->vm_next;
@@ -97019,7 +97146,7 @@ index e5cc3ca..bb9333f 100644
/*
* Can it merge with the predecessor?
*/
-@@ -1080,9 +1137,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1080,9 +1135,24 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
/* cases 1, 6 */
err = vma_adjust(prev, prev->vm_start,
next->vm_end, prev->vm_pgoff, NULL);
@@ -97045,7 +97172,7 @@ index e5cc3ca..bb9333f 100644
if (err)
return NULL;
khugepaged_enter_vma_merge(prev, vm_flags);
-@@ -1096,12 +1168,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
+@@ -1096,12 +1166,27 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
mpol_equal(policy, vma_policy(next)) &&
can_vma_merge_before(next, vm_flags,
anon_vma, file, pgoff+pglen)) {
@@ -97075,7 +97202,7 @@ index e5cc3ca..bb9333f 100644
if (err)
return NULL;
khugepaged_enter_vma_merge(area, vm_flags);
-@@ -1210,8 +1297,10 @@ none:
+@@ -1210,8 +1295,10 @@ none:
void vm_stat_account(struct mm_struct *mm, unsigned long flags,
struct file *file, long pages)
{
@@ -97088,7 +97215,7 @@ index e5cc3ca..bb9333f 100644
mm->total_vm += pages;
-@@ -1219,7 +1308,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
+@@ -1219,7 +1306,7 @@ void vm_stat_account(struct mm_struct *mm, unsigned long flags,
mm->shared_vm += pages;
if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
mm->exec_vm += pages;
@@ -97097,7 +97224,7 @@ index e5cc3ca..bb9333f 100644
mm->stack_vm += pages;
}
#endif /* CONFIG_PROC_FS */
-@@ -1249,6 +1338,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
+@@ -1249,6 +1336,7 @@ static inline int mlock_future_check(struct mm_struct *mm,
locked += mm->locked_vm;
lock_limit = rlimit(RLIMIT_MEMLOCK);
lock_limit >>= PAGE_SHIFT;
@@ -97105,7 +97232,7 @@ index e5cc3ca..bb9333f 100644
if (locked > lock_limit && !capable(CAP_IPC_LOCK))
return -EAGAIN;
}
-@@ -1275,7 +1365,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1275,7 +1363,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
* (the exception is when the underlying filesystem is noexec
* mounted, in which case we dont add PROT_EXEC.)
*/
@@ -97114,7 +97241,7 @@ index e5cc3ca..bb9333f 100644
if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
prot |= PROT_EXEC;
-@@ -1301,7 +1391,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1301,7 +1389,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
/* Obtain the address to map to. we verify (or select) it and ensure
* that it represents a valid section of the address space.
*/
@@ -97123,7 +97250,7 @@ index e5cc3ca..bb9333f 100644
if (addr & ~PAGE_MASK)
return addr;
-@@ -1312,6 +1402,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1312,6 +1400,43 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
@@ -97167,7 +97294,7 @@ index e5cc3ca..bb9333f 100644
if (flags & MAP_LOCKED)
if (!can_do_mlock())
return -EPERM;
-@@ -1399,6 +1526,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
+@@ -1399,6 +1524,9 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
vm_flags |= VM_NORESERVE;
}
@@ -97177,7 +97304,7 @@ index e5cc3ca..bb9333f 100644
addr = mmap_region(file, addr, len, vm_flags, pgoff);
if (!IS_ERR_VALUE(addr) &&
((vm_flags & VM_LOCKED) ||
-@@ -1492,7 +1622,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
+@@ -1492,7 +1620,7 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
vm_flags_t vm_flags = vma->vm_flags;
/* If it was private or non-writable, the write bit is already clear */
@@ -97186,7 +97313,7 @@ index e5cc3ca..bb9333f 100644
return 0;
/* The backer wishes to know when pages are first written to? */
-@@ -1543,7 +1673,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1543,7 +1671,22 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
struct rb_node **rb_link, *rb_parent;
unsigned long charged = 0;
@@ -97209,7 +97336,7 @@ index e5cc3ca..bb9333f 100644
if (!may_expand_vm(mm, len >> PAGE_SHIFT)) {
unsigned long nr_pages;
-@@ -1562,11 +1707,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
+@@ -1562,11 +1705,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr,
/* Clear old maps */
error = -ENOMEM;
@@ -97222,7 +97349,7 @@ index e5cc3ca..bb9333f 100644
}
/*
-@@ -1597,6 +1741,16 @@ munmap_back:
+@@ -1597,6 +1739,16 @@ munmap_back:
goto unacct_error;
}
@@ -97239,7 +97366,7 @@ index e5cc3ca..bb9333f 100644
vma->vm_mm = mm;
vma->vm_start = addr;
vma->vm_end = addr + len;
-@@ -1627,6 +1781,13 @@ munmap_back:
+@@ -1627,6 +1779,13 @@ munmap_back:
if (error)
goto unmap_and_free_vma;
@@ -97253,7 +97380,7 @@ index e5cc3ca..bb9333f 100644
/* Can addr have changed??
*
* Answer: Yes, several device drivers can do it in their
-@@ -1645,6 +1806,12 @@ munmap_back:
+@@ -1645,6 +1804,12 @@ munmap_back:
}
vma_link(mm, vma, prev, rb_link, rb_parent);
@@ -97266,7 +97393,7 @@ index e5cc3ca..bb9333f 100644
/* Once vma denies write, undo our temporary denial count */
if (file) {
if (vm_flags & VM_SHARED)
-@@ -1657,6 +1824,7 @@ out:
+@@ -1657,6 +1822,7 @@ out:
perf_event_mmap(vma);
vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
@@ -97274,7 +97401,7 @@ index e5cc3ca..bb9333f 100644
if (vm_flags & VM_LOCKED) {
if (!((vm_flags & VM_SPECIAL) || is_vm_hugetlb_page(vma) ||
vma == get_gate_vma(current->mm)))
-@@ -1694,6 +1862,12 @@ allow_write_and_free_vma:
+@@ -1694,6 +1860,12 @@ allow_write_and_free_vma:
if (vm_flags & VM_DENYWRITE)
allow_write_access(file);
free_vma:
@@ -97287,7 +97414,7 @@ index e5cc3ca..bb9333f 100644
kmem_cache_free(vm_area_cachep, vma);
unacct_error:
if (charged)
-@@ -1701,7 +1875,63 @@ unacct_error:
+@@ -1701,7 +1873,63 @@ unacct_error:
return error;
}
@@ -97352,7 +97479,7 @@ index e5cc3ca..bb9333f 100644
{
/*
* We implement the search by looking for an rbtree node that
-@@ -1749,11 +1979,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
+@@ -1749,11 +1977,29 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info)
}
}
@@ -97383,7 +97510,7 @@ index e5cc3ca..bb9333f 100644
if (gap_end >= low_limit && gap_end - gap_start >= length)
goto found;
-@@ -1803,7 +2051,7 @@ found:
+@@ -1803,7 +2049,7 @@ found:
return gap_start;
}
@@ -97392,7 +97519,7 @@ index e5cc3ca..bb9333f 100644
{
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
-@@ -1857,6 +2105,24 @@ check_current:
+@@ -1857,6 +2103,24 @@ check_current:
gap_end = vma->vm_start;
if (gap_end < low_limit)
return -ENOMEM;
@@ -97417,7 +97544,7 @@ index e5cc3ca..bb9333f 100644
if (gap_start <= high_limit && gap_end - gap_start >= length)
goto found;
-@@ -1920,6 +2186,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1920,6 +2184,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
struct vm_unmapped_area_info info;
@@ -97425,7 +97552,7 @@ index e5cc3ca..bb9333f 100644
if (len > TASK_SIZE - mmap_min_addr)
return -ENOMEM;
-@@ -1927,11 +2194,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1927,11 +2192,15 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
if (flags & MAP_FIXED)
return addr;
@@ -97442,7 +97569,7 @@ index e5cc3ca..bb9333f 100644
return addr;
}
-@@ -1940,6 +2211,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+@@ -1940,6 +2209,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
info.low_limit = mm->mmap_base;
info.high_limit = TASK_SIZE;
info.align_mask = 0;
@@ -97450,7 +97577,7 @@ index e5cc3ca..bb9333f 100644
return vm_unmapped_area(&info);
}
#endif
-@@ -1958,6 +2230,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1958,6 +2228,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
struct mm_struct *mm = current->mm;
unsigned long addr = addr0;
struct vm_unmapped_area_info info;
@@ -97458,7 +97585,7 @@ index e5cc3ca..bb9333f 100644
/* requested length too big for entire address space */
if (len > TASK_SIZE - mmap_min_addr)
-@@ -1966,12 +2239,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1966,12 +2237,16 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
if (flags & MAP_FIXED)
return addr;
@@ -97476,7 +97603,7 @@ index e5cc3ca..bb9333f 100644
return addr;
}
-@@ -1980,6 +2257,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1980,6 +2255,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
info.low_limit = max(PAGE_SIZE, mmap_min_addr);
info.high_limit = mm->mmap_base;
info.align_mask = 0;
@@ -97484,7 +97611,7 @@ index e5cc3ca..bb9333f 100644
addr = vm_unmapped_area(&info);
/*
-@@ -1992,6 +2270,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+@@ -1992,6 +2268,12 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
VM_BUG_ON(addr != -ENOMEM);
info.flags = 0;
info.low_limit = TASK_UNMAPPED_BASE;
@@ -97497,7 +97624,7 @@ index e5cc3ca..bb9333f 100644
info.high_limit = TASK_SIZE;
addr = vm_unmapped_area(&info);
}
-@@ -2092,6 +2376,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
+@@ -2092,6 +2374,28 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr,
return vma;
}
@@ -97526,7 +97653,7 @@ index e5cc3ca..bb9333f 100644
/*
* Verify that the stack growth is acceptable and
* update accounting. This is shared with both the
-@@ -2109,8 +2415,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2109,8 +2413,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
/* Stack limit test */
actual_size = size;
@@ -97536,7 +97663,7 @@ index e5cc3ca..bb9333f 100644
if (actual_size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur))
return -ENOMEM;
-@@ -2121,6 +2426,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2121,6 +2424,7 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
locked = mm->locked_vm + grow;
limit = ACCESS_ONCE(rlim[RLIMIT_MEMLOCK].rlim_cur);
limit >>= PAGE_SHIFT;
@@ -97544,7 +97671,7 @@ index e5cc3ca..bb9333f 100644
if (locked > limit && !capable(CAP_IPC_LOCK))
return -ENOMEM;
}
-@@ -2150,37 +2456,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
+@@ -2150,37 +2454,48 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns
* PA-RISC uses this for its stack; IA64 for its Register Backing Store.
* vma is the last one with address > vma->vm_end. Have to extend vma.
*/
@@ -97602,7 +97729,7 @@ index e5cc3ca..bb9333f 100644
unsigned long size, grow;
size = address - vma->vm_start;
-@@ -2215,6 +2532,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
+@@ -2215,6 +2530,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address)
}
}
}
@@ -97611,7 +97738,7 @@ index e5cc3ca..bb9333f 100644
vma_unlock_anon_vma(vma);
khugepaged_enter_vma_merge(vma, vma->vm_flags);
validate_mm(vma->vm_mm);
-@@ -2229,6 +2548,8 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2229,6 +2546,8 @@ int expand_downwards(struct vm_area_struct *vma,
unsigned long address)
{
int error;
@@ -97620,7 +97747,7 @@ index e5cc3ca..bb9333f 100644
/*
* We must make sure the anon_vma is allocated
-@@ -2242,6 +2563,15 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2242,6 +2561,15 @@ int expand_downwards(struct vm_area_struct *vma,
if (error)
return error;
@@ -97636,7 +97763,7 @@ index e5cc3ca..bb9333f 100644
vma_lock_anon_vma(vma);
/*
-@@ -2251,9 +2581,17 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2251,9 +2579,17 @@ int expand_downwards(struct vm_area_struct *vma,
*/
/* Somebody else might have raced and expanded it already */
@@ -97655,7 +97782,7 @@ index e5cc3ca..bb9333f 100644
size = vma->vm_end - address;
grow = (vma->vm_start - address) >> PAGE_SHIFT;
-@@ -2278,13 +2616,27 @@ int expand_downwards(struct vm_area_struct *vma,
+@@ -2278,13 +2614,27 @@ int expand_downwards(struct vm_area_struct *vma,
vma->vm_pgoff -= grow;
anon_vma_interval_tree_post_update_vma(vma);
vma_gap_update(vma);
@@ -97683,7 +97810,7 @@ index e5cc3ca..bb9333f 100644
khugepaged_enter_vma_merge(vma, vma->vm_flags);
validate_mm(vma->vm_mm);
return error;
-@@ -2384,6 +2736,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2384,6 +2734,13 @@ static void remove_vma_list(struct mm_struct *mm, struct vm_area_struct *vma)
do {
long nrpages = vma_pages(vma);
@@ -97697,7 +97824,7 @@ index e5cc3ca..bb9333f 100644
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += nrpages;
vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
-@@ -2428,6 +2787,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2428,6 +2785,16 @@ detach_vmas_to_be_unmapped(struct mm_struct *mm, struct vm_area_struct *vma,
insertion_point = (prev ? &prev->vm_next : &mm->mmap);
vma->vm_prev = NULL;
do {
@@ -97714,7 +97841,7 @@ index e5cc3ca..bb9333f 100644
vma_rb_erase(vma, &mm->mm_rb);
mm->map_count--;
tail_vma = vma;
-@@ -2455,14 +2824,33 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2455,14 +2822,33 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
struct vm_area_struct *new;
int err = -ENOMEM;
@@ -97748,7 +97875,7 @@ index e5cc3ca..bb9333f 100644
/* most fields are the same, copy all, and then fixup */
*new = *vma;
-@@ -2475,6 +2863,22 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2475,6 +2861,22 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
}
@@ -97771,7 +97898,7 @@ index e5cc3ca..bb9333f 100644
err = vma_dup_policy(vma, new);
if (err)
goto out_free_vma;
-@@ -2495,6 +2899,38 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2495,6 +2897,38 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
else
err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
@@ -97810,7 +97937,7 @@ index e5cc3ca..bb9333f 100644
/* Success. */
if (!err)
return 0;
-@@ -2504,10 +2940,18 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2504,10 +2938,18 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
new->vm_ops->close(new);
if (new->vm_file)
fput(new->vm_file);
@@ -97830,7 +97957,7 @@ index e5cc3ca..bb9333f 100644
kmem_cache_free(vm_area_cachep, new);
out_err:
return err;
-@@ -2520,6 +2964,15 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2520,6 +2962,15 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
unsigned long addr, int new_below)
{
@@ -97846,7 +97973,7 @@ index e5cc3ca..bb9333f 100644
if (mm->map_count >= sysctl_max_map_count)
return -ENOMEM;
-@@ -2531,11 +2984,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
+@@ -2531,11 +2982,30 @@ int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
* work. This now handles partial unmappings.
* Jeremy Fitzhardinge <jeremy@goop.org>
*/
@@ -97877,7 +98004,7 @@ index e5cc3ca..bb9333f 100644
if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
return -EINVAL;
-@@ -2613,6 +3085,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+@@ -2613,6 +3083,8 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
/* Fix up all other VM information */
remove_vma_list(mm, vma);
@@ -97886,7 +98013,7 @@ index e5cc3ca..bb9333f 100644
return 0;
}
-@@ -2621,6 +3095,13 @@ int vm_munmap(unsigned long start, size_t len)
+@@ -2621,6 +3093,13 @@ int vm_munmap(unsigned long start, size_t len)
int ret;
struct mm_struct *mm = current->mm;
@@ -97900,7 +98027,7 @@ index e5cc3ca..bb9333f 100644
down_write(&mm->mmap_sem);
ret = do_munmap(mm, start, len);
up_write(&mm->mmap_sem);
-@@ -2634,16 +3115,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
+@@ -2634,16 +3113,6 @@ SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
return vm_munmap(addr, len);
}
@@ -97917,7 +98044,7 @@ index e5cc3ca..bb9333f 100644
/*
* this is really a simplified "do_mmap". it only handles
* anonymous maps. eventually we may be able to do some
-@@ -2657,6 +3128,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2657,6 +3126,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
struct rb_node **rb_link, *rb_parent;
pgoff_t pgoff = addr >> PAGE_SHIFT;
int error;
@@ -97925,7 +98052,7 @@ index e5cc3ca..bb9333f 100644
len = PAGE_ALIGN(len);
if (!len)
-@@ -2664,10 +3136,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2664,10 +3134,24 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
@@ -97950,7 +98077,7 @@ index e5cc3ca..bb9333f 100644
error = mlock_future_check(mm, mm->def_flags, len);
if (error)
return error;
-@@ -2681,21 +3167,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2681,21 +3165,20 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
/*
* Clear old maps. this also does some error checking for us
*/
@@ -97975,7 +98102,7 @@ index e5cc3ca..bb9333f 100644
return -ENOMEM;
/* Can we just expand an old private anonymous mapping? */
-@@ -2709,7 +3194,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2709,7 +3192,7 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
*/
vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
if (!vma) {
@@ -97984,7 +98111,7 @@ index e5cc3ca..bb9333f 100644
return -ENOMEM;
}
-@@ -2723,10 +3208,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
+@@ -2723,10 +3206,11 @@ static unsigned long do_brk(unsigned long addr, unsigned long len)
vma_link(mm, vma, prev, rb_link, rb_parent);
out:
perf_event_mmap(vma);
@@ -97998,7 +98125,7 @@ index e5cc3ca..bb9333f 100644
return addr;
}
-@@ -2788,6 +3274,7 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2788,6 +3272,7 @@ void exit_mmap(struct mm_struct *mm)
while (vma) {
if (vma->vm_flags & VM_ACCOUNT)
nr_accounted += vma_pages(vma);
@@ -98006,7 +98133,7 @@ index e5cc3ca..bb9333f 100644
vma = remove_vma(vma);
}
vm_unacct_memory(nr_accounted);
-@@ -2805,6 +3292,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2805,6 +3290,13 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
struct vm_area_struct *prev;
struct rb_node **rb_link, *rb_parent;
@@ -98020,7 +98147,7 @@ index e5cc3ca..bb9333f 100644
/*
* The vm_pgoff of a purely anonymous vma should be irrelevant
* until its first write fault, when page's anon_vma and index
-@@ -2828,7 +3322,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
+@@ -2828,7 +3320,21 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma)
security_vm_enough_memory_mm(mm, vma_pages(vma)))
return -ENOMEM;
@@ -98042,7 +98169,7 @@ index e5cc3ca..bb9333f 100644
return 0;
}
-@@ -2847,6 +3355,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2847,6 +3353,8 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
struct rb_node **rb_link, *rb_parent;
bool faulted_in_anon_vma = true;
@@ -98051,7 +98178,7 @@ index e5cc3ca..bb9333f 100644
/*
* If anonymous vma has not yet been faulted, update new pgoff
* to match new location, to increase its chance of merging.
-@@ -2911,6 +3421,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
+@@ -2911,6 +3419,39 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap,
return NULL;
}
@@ -98091,7 +98218,7 @@ index e5cc3ca..bb9333f 100644
/*
* Return true if the calling process may expand its vm space by the passed
* number of pages
-@@ -2922,6 +3465,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
+@@ -2922,6 +3463,7 @@ int may_expand_vm(struct mm_struct *mm, unsigned long npages)
lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
@@ -98099,7 +98226,7 @@ index e5cc3ca..bb9333f 100644
if (cur + npages > lim)
return 0;
return 1;
-@@ -3004,6 +3548,22 @@ static struct vm_area_struct *__install_special_mapping(
+@@ -3004,6 +3546,22 @@ static struct vm_area_struct *__install_special_mapping(
vma->vm_start = addr;
vma->vm_end = addr + len;
@@ -98736,7 +98863,7 @@ index 5077afc..846c9ef 100644
if (!mm || IS_ERR(mm)) {
rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH;
diff --git a/mm/rmap.c b/mm/rmap.c
-index 71cd5bd..e259089 100644
+index 71cd5bd..0ff9eb3 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -166,6 +166,10 @@ int anon_vma_prepare(struct vm_area_struct *vma)
@@ -98817,7 +98944,21 @@ index 71cd5bd..e259089 100644
{
struct anon_vma_chain *avc, *pavc;
struct anon_vma *root = NULL;
-@@ -296,7 +331,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+@@ -287,6 +322,13 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
+ return 0;
+
+ enomem_failure:
++ /*
++ * dst->anon_vma is dropped here otherwise its degree can be incorrectly
++ * decremented in unlink_anon_vmas().
++ * We can safely do this because callers of anon_vma_clone() don't care
++ * about dst->anon_vma if anon_vma_clone() failed.
++ */
++ dst->anon_vma = NULL;
+ unlink_anon_vmas(dst);
+ return -ENOMEM;
+ }
+@@ -296,7 +338,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
* the corresponding VMA in the parent process is attached to.
* Returns 0 on success, non-zero on failure.
*/
@@ -98826,7 +98967,7 @@ index 71cd5bd..e259089 100644
{
struct anon_vma_chain *avc;
struct anon_vma *anon_vma;
-@@ -416,8 +451,10 @@ static void anon_vma_ctor(void *data)
+@@ -416,8 +458,10 @@ static void anon_vma_ctor(void *data)
void __init anon_vma_init(void)
{
anon_vma_cachep = kmem_cache_create("anon_vma", sizeof(struct anon_vma),
@@ -102484,6 +102625,25 @@ index f99f41b..1879da9 100644
return nh->nh_saddr;
}
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index b986298..7e726da 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -765,12 +765,12 @@ EXPORT_SYMBOL(gue_build_header);
+
+ #ifdef CONFIG_NET_FOU_IP_TUNNELS
+
+-static const struct ip_tunnel_encap_ops __read_mostly fou_iptun_ops = {
++static const struct ip_tunnel_encap_ops fou_iptun_ops = {
+ .encap_hlen = fou_encap_hlen,
+ .build_header = fou_build_header,
+ };
+
+-static const struct ip_tunnel_encap_ops __read_mostly gue_iptun_ops = {
++static const struct ip_tunnel_encap_ops gue_iptun_ops = {
+ .encap_hlen = gue_encap_hlen,
+ .build_header = gue_build_header,
+ };
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 9111a4e..3576905 100644
--- a/net/ipv4/inet_hashtables.c
@@ -103300,6 +103460,19 @@ index 63d2680..2db9d6b 100644
} else if (fastopen) { /* received a valid RST pkt */
reqsk_fastopen_remove(sk, req, true);
tcp_reset(sk);
+diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
+index 9790f39..9f29453 100644
+--- a/net/ipv4/tcp_output.c
++++ b/net/ipv4/tcp_output.c
+@@ -2931,6 +2931,8 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
+ }
+ #endif
+
++ /* Do not fool tcpdump (if any), clean our debris */
++ skb->tstamp.tv64 = 0;
+ return skb;
+ }
+ EXPORT_SYMBOL(tcp_make_synack);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index ebf5ff5..4d1ff32 100644
--- a/net/ipv4/tcp_probe.c
@@ -104529,7 +104702,7 @@ index e75d5c5..429fc95 100644
if (local->use_chanctx)
*chandef = local->monitor_chandef;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
-index cc6e964..029a3a3 100644
+index fa7568c..74c815c 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -29,6 +29,7 @@
@@ -104540,7 +104713,7 @@ index cc6e964..029a3a3 100644
#include "key.h"
#include "sta_info.h"
#include "debug.h"
-@@ -1114,7 +1115,7 @@ struct ieee80211_local {
+@@ -1125,7 +1126,7 @@ struct ieee80211_local {
/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
spinlock_t queue_stop_reason_lock;
@@ -104683,7 +104856,7 @@ index d53355b..21f583a 100644
if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
-index 974ebe7..57bcd3c 100644
+index 1ce38e7..77267ad 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1757,7 +1757,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
@@ -105486,6 +105659,18 @@ index e5b65ac..f3b6fb7 100644
if (likely(*recent == gen))
return 0;
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 378c3a6..ba4382c 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -193,6 +193,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ }
+
+ atomic_set(&conn->c_state, RDS_CONN_DOWN);
++ conn->c_send_gen = 0;
+ conn->c_reconnect_jiffies = 0;
+ INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker);
+ INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker);
diff --git a/net/rds/ib.h b/net/rds/ib.h
index c36d713..af45bf2 100644
--- a/net/rds/ib.h
@@ -105583,10 +105768,18 @@ index a66d179..cf1e258 100644
#endif
diff --git a/net/rds/rds.h b/net/rds/rds.h
-index c2a5eef..90ba1fd 100644
+index c2a5eef..87a7460 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
-@@ -448,7 +448,7 @@ struct rds_transport {
+@@ -110,6 +110,7 @@ struct rds_connection {
+ void *c_transport_data;
+
+ atomic_t c_state;
++ unsigned long c_send_gen;
+ unsigned long c_flags;
+ unsigned long c_reconnect_jiffies;
+ struct delayed_work c_send_w;
+@@ -448,7 +449,7 @@ struct rds_transport {
void (*sync_mr)(void *trans_private, int direction);
void (*free_mr)(void *trans_private, int invalidate);
void (*flush_mrs)(void);
@@ -105595,6 +105788,85 @@ index c2a5eef..90ba1fd 100644
struct rds_sock {
struct sock rs_sk;
+diff --git a/net/rds/send.c b/net/rds/send.c
+index 42f65d4..49f77ef 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn)
+ struct scatterlist *sg;
+ int ret = 0;
+ LIST_HEAD(to_be_dropped);
++ int batch_count;
++ unsigned long send_gen = 0;
+
+ restart:
++ batch_count = 0;
+
+ /*
+ * sendmsg calls here after having queued its message on the send
+@@ -157,6 +160,17 @@ restart:
+ }
+
+ /*
++ * we record the send generation after doing the xmit acquire.
++ * if someone else manages to jump in and do some work, we'll use
++ * this to avoid a goto restart farther down.
++ *
++ * The acquire_in_xmit() check above ensures that only one
++ * caller can increment c_send_gen at any time.
++ */
++ conn->c_send_gen++;
++ send_gen = conn->c_send_gen;
++
++ /*
+ * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+ * we do the opposite to avoid races.
+ */
+@@ -202,6 +216,16 @@ restart:
+ if (!rm) {
+ unsigned int len;
+
++ batch_count++;
++
++ /* we want to process as big a batch as we can, but
++ * we also want to avoid softlockups. If we've been
++ * through a lot of messages, lets back off and see
++ * if anyone else jumps in
++ */
++ if (batch_count >= 1024)
++ goto over_batch;
++
+ spin_lock_irqsave(&conn->c_lock, flags);
+
+ if (!list_empty(&conn->c_send_queue)) {
+@@ -357,9 +381,9 @@ restart:
+ }
+ }
+
++over_batch:
+ if (conn->c_trans->xmit_complete)
+ conn->c_trans->xmit_complete(conn);
+-
+ release_in_xmit(conn);
+
+ /* Nuke any messages we decided not to retransmit. */
+@@ -380,10 +404,15 @@ restart:
+ * If the transport cannot continue (i.e ret != 0), then it must
+ * call us when more room is available, such as from the tx
+ * completion handler.
++ *
++ * We have an extra generation check here so that if someone manages
++ * to jump in after our release_in_xmit, we'll see that they have done
++ * some work and we will skip our goto
+ */
+ if (ret == 0) {
+ smp_mb();
+- if (!list_empty(&conn->c_send_queue)) {
++ if (!list_empty(&conn->c_send_queue) &&
++ send_gen == conn->c_send_gen) {
+ rds_stats_inc(s_send_lock_queue_raced);
+ goto restart;
+ }
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index edac9ef..16bcb98 100644
--- a/net/rds/tcp.c
@@ -106740,7 +107012,7 @@ index 0344206..bff8abf 100644
sub->evt.event = htohl(event, sub->swap);
sub->evt.found_lower = htohl(found_lower, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8e1b102..900d70f 100644
+index 8e1b102..20af1b2 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -791,6 +791,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -106821,12 +107093,33 @@ index 8e1b102..900d70f 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2378,8 +2404,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2376,10 +2402,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ seq_putc(seq, '@');
+ i++;
}
- for ( ; i < len; i++)
- seq_putc(seq, u->addr->name->sun_path[i]);
+- for ( ; i < len; i++)
+- seq_putc(seq, u->addr->name->sun_path[i]);
- }
- unix_state_unlock(s);
++ for ( ; i < len; i++) {
++ char c = u->addr->name->sun_path[i];
++ switch (c) {
++ case '\n':
++ seq_putc(seq, '\\');
++ seq_putc(seq, 'n');
++ break;
++ case '\t':
++ seq_putc(seq, '\\');
++ seq_putc(seq, 't');
++ break;
++ case '\\':
++ seq_putc(seq, '\\');
++ seq_putc(seq, '\\');
++ break;
++ default:
++ seq_putc(seq, c);
++ }
++ }
+ } else if (peer)
+ seq_printf(seq, " P%lu", sock_i_ino(peer));
+
@@ -107371,14 +107664,14 @@ index b304068..462d24e 100644
fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianness? %#x\n",
diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
new file mode 100644
-index 0000000..822fa9e
+index 0000000..eaa4fce
--- /dev/null
+++ b/scripts/gcc-plugin.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+srctree=$(dirname "$0")
+gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
+#include "gcc-common.h"
+#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
+#warning $2 CXX
@@ -107804,7 +108097,7 @@ index cdb491d..8d32bfc 100755
# Find all available archs
find_all_archs()
diff --git a/security/Kconfig b/security/Kconfig
-index beb86b5..653742f 100644
+index beb86b5..3bc66c1 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -4,6 +4,975 @@
@@ -108122,9 +108415,9 @@ index beb86b5..653742f 100644
+ bool 'Use filesystem extended attributes marking'
+ default y if GRKERNSEC_CONFIG_AUTO
+ select CIFS_XATTR if CIFS
-+ select F2FS_FS_XATTR if F2FS_FS
+ select EXT2_FS_XATTR if EXT2_FS
+ select EXT3_FS_XATTR if EXT3_FS
++ select F2FS_FS_XATTR if F2FS_FS
+ select JFFS2_FS_XATTR if JFFS2_FS
+ select REISERFS_FS_XATTR if REISERFS_FS
+ select SQUASHFS_XATTR if SQUASHFS
@@ -109217,6 +109510,19 @@ index 1450f85..a91e0bc 100644
rt_genid_bump_all(net);
}
rtnl_unlock();
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 33db1ad..138949a 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -152,7 +152,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ goto out;
+
+ /* No partial writes. */
+- length = EINVAL;
++ length = -EINVAL;
+ if (*ppos != 0)
+ goto out;
+
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index a717877..0747450 100644
--- a/security/smack/smack_lsm.c
@@ -110350,10 +110656,10 @@ index 0000000..5452feea
+}
diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
new file mode 100644
-index 0000000..54461af
+index 0000000..d44bd9f
--- /dev/null
+++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,210 @@
+@@ -0,0 +1,215 @@
+/*
+ * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -110458,7 +110764,8 @@ index 0000000..54461af
+#if BUILDING_GCC_VERSION >= 4008
+ .optinfo_flags = OPTGROUP_NONE,
+#endif
-+#if BUILDING_GCC_VERSION >= 4009
++#if BUILDING_GCC_VERSION >= 5000
++#elif BUILDING_GCC_VERSION == 4009
+ .has_gate = false,
+ .has_execute = true,
+#else
@@ -110484,7 +110791,11 @@ index 0000000..54461af
+class colorize_rearm_pass : public simple_ipa_opt_pass {
+public:
+ colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
++#if BUILDING_GCC_VERSION >= 5000
++ virtual unsigned int execute(function *) { return execute_colorize_rearm(); }
++#else
+ unsigned int execute() { return execute_colorize_rearm(); }
++#endif
+};
+}
+
@@ -116268,10 +116579,10 @@ index 0000000..b8e7188
+}
diff --git a/tools/gcc/size_overflow_plugin/size_overflow_hash.data b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
new file mode 100644
-index 0000000..b125100
+index 0000000..889a054
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow_hash.data
-@@ -0,0 +1,27713 @@
+@@ -0,0 +1,27714 @@
+intel_fake_agp_alloc_by_type_1 intel_fake_agp_alloc_by_type 1 1 NULL nohasharray
+iwl_set_tx_power_1 iwl_set_tx_power 0 1 &intel_fake_agp_alloc_by_type_1
+ocfs2_get_refcount_tree_3 ocfs2_get_refcount_tree 0 3 NULL
@@ -119979,6 +120290,7 @@ index 0000000..b125100
+ext4_try_to_write_inline_data_8785 ext4_try_to_write_inline_data 4-3 8785 NULL
+show_hardware_8789 show_hardware 0 8789 NULL
+edd_show_sectors_8794 edd_show_sectors 0 8794 NULL
++__bitmap_weight_8796 __bitmap_weight 0 8796 NULL
+ip_vs_remote_request6_8805 ip_vs_remote_request6 0 8805 NULL
+gfs2_glock_nq_8808 gfs2_glock_nq 0 8808 NULL nohasharray
+prod_id2_show_8808 prod_id2_show 0 8808 &gfs2_glock_nq_8808 nohasharray
diff --git a/3.14.37/4425_grsec_remove_EI_PAX.patch b/3.19.4/4425_grsec_remove_EI_PAX.patch
similarity index 100%
rename from 3.14.37/4425_grsec_remove_EI_PAX.patch
rename to 3.19.4/4425_grsec_remove_EI_PAX.patch
diff --git a/3.19.3/4427_force_XATTR_PAX_tmpfs.patch b/3.19.4/4427_force_XATTR_PAX_tmpfs.patch
similarity index 100%
rename from 3.19.3/4427_force_XATTR_PAX_tmpfs.patch
rename to 3.19.4/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/3.14.37/4430_grsec-remove-localversion-grsec.patch b/3.19.4/4430_grsec-remove-localversion-grsec.patch
similarity index 100%
rename from 3.14.37/4430_grsec-remove-localversion-grsec.patch
rename to 3.19.4/4430_grsec-remove-localversion-grsec.patch
diff --git a/3.19.3/4435_grsec-mute-warnings.patch b/3.19.4/4435_grsec-mute-warnings.patch
similarity index 100%
rename from 3.19.3/4435_grsec-mute-warnings.patch
rename to 3.19.4/4435_grsec-mute-warnings.patch
diff --git a/3.14.37/4440_grsec-remove-protected-paths.patch b/3.19.4/4440_grsec-remove-protected-paths.patch
similarity index 100%
rename from 3.14.37/4440_grsec-remove-protected-paths.patch
rename to 3.19.4/4440_grsec-remove-protected-paths.patch
diff --git a/3.19.3/4450_grsec-kconfig-default-gids.patch b/3.19.4/4450_grsec-kconfig-default-gids.patch
similarity index 100%
rename from 3.19.3/4450_grsec-kconfig-default-gids.patch
rename to 3.19.4/4450_grsec-kconfig-default-gids.patch
diff --git a/3.19.3/4465_selinux-avc_audit-log-curr_ip.patch b/3.19.4/4465_selinux-avc_audit-log-curr_ip.patch
similarity index 100%
rename from 3.19.3/4465_selinux-avc_audit-log-curr_ip.patch
rename to 3.19.4/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/3.19.3/4470_disable-compat_vdso.patch b/3.19.4/4470_disable-compat_vdso.patch
similarity index 100%
rename from 3.19.3/4470_disable-compat_vdso.patch
rename to 3.19.4/4470_disable-compat_vdso.patch
diff --git a/3.14.37/4475_emutramp_default_on.patch b/3.19.4/4475_emutramp_default_on.patch
similarity index 100%
rename from 3.14.37/4475_emutramp_default_on.patch
rename to 3.19.4/4475_emutramp_default_on.patch
diff --git a/3.2.68/0000_README b/3.2.68/0000_README
index b13028d..1221adb 100644
--- a/3.2.68/0000_README
+++ b/3.2.68/0000_README
@@ -190,7 +190,7 @@ Patch: 1067_linux-3.2.68.patch
From: http://www.kernel.org
Desc: Linux 3.2.68
-Patch: 4420_grsecurity-3.1-3.2.68-201504021823.patch
+Patch: 4420_grsecurity-3.1-3.2.68-201504142258.patch
From: http://www.grsecurity.net
Desc: hardened-sources base patch from upstream grsecurity
diff --git a/3.2.68/4420_grsecurity-3.1-3.2.68-201504021823.patch b/3.2.68/4420_grsecurity-3.1-3.2.68-201504142258.patch
similarity index 99%
rename from 3.2.68/4420_grsecurity-3.1-3.2.68-201504021823.patch
rename to 3.2.68/4420_grsecurity-3.1-3.2.68-201504142258.patch
index e85b221..6147d13 100644
--- a/3.2.68/4420_grsecurity-3.1-3.2.68-201504021823.patch
+++ b/3.2.68/4420_grsecurity-3.1-3.2.68-201504142258.patch
@@ -4004,7 +4004,7 @@ index e59cd1a..8e329d6 100644
typedef struct { unsigned long long pte; } pte_t;
#define pte_val(x) ((x).pte)
diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h
-index 881d18b..cea38bc 100644
+index 881d18b4..cea38bc 100644
--- a/arch/mips/include/asm/pgalloc.h
+++ b/arch/mips/include/asm/pgalloc.h
@@ -37,6 +37,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd)
@@ -11408,6 +11408,28 @@ index 3470624..9b476a3 100644
ret
+ENDPROC(aesni_ctr_enc)
#endif
+diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c
+index 16acf68..3b3a62f 100644
+--- a/arch/x86/crypto/aesni-intel_glue.c
++++ b/arch/x86/crypto/aesni-intel_glue.c
+@@ -1202,7 +1202,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ src = kmalloc(req->cryptlen + req->assoclen, GFP_ATOMIC);
+ if (!src)
+ return -ENOMEM;
+- assoc = (src + req->cryptlen + auth_tag_len);
++ assoc = (src + req->cryptlen);
+ scatterwalk_map_and_copy(src, req->src, 0, req->cryptlen, 0);
+ scatterwalk_map_and_copy(assoc, req->assoc, 0,
+ req->assoclen, 0);
+@@ -1227,7 +1227,7 @@ static int __driver_rfc4106_decrypt(struct aead_request *req)
+ scatterwalk_done(&src_sg_walk, 0, 0);
+ scatterwalk_done(&assoc_sg_walk, 0, 0);
+ } else {
+- scatterwalk_map_and_copy(dst, req->dst, 0, req->cryptlen, 1);
++ scatterwalk_map_and_copy(dst, req->dst, 0, tempCipherLen, 1);
+ kfree(src);
+ }
+ return retval;
diff --git a/arch/x86/crypto/blowfish-x86_64-asm_64.S b/arch/x86/crypto/blowfish-x86_64-asm_64.S
index 391d245..c73d634 100644
--- a/arch/x86/crypto/blowfish-x86_64-asm_64.S
@@ -90544,7 +90566,7 @@ index dc7bc08..4601964 100644
/* Don't allow clients that don't understand the native
diff --git a/kernel/kmod.c b/kernel/kmod.c
-index a16dac1..d6f7dbc 100644
+index a16dac1..e744189 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -64,7 +64,7 @@ static void free_modprobe_argv(struct subprocess_info *info)
@@ -90683,9 +90705,9 @@ index a16dac1..d6f7dbc 100644
+ */
+ if ((strncmp(sub_info->path, "/sbin/", 6) && strncmp(sub_info->path, "/usr/lib/", 9) &&
+ strncmp(sub_info->path, "/lib/", 5) && strncmp(sub_info->path, "/lib64/", 7) &&
-+ strncmp(sub_info->path, "/usr/libexec/", 13) &&
++ strncmp(sub_info->path, "/usr/libexec/", 13) && strncmp(sub_info->path, "/usr/bin/", 9) &&
+ strcmp(sub_info->path, "/usr/share/apport/apport")) || strstr(sub_info->path, "..")) {
-+ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of /sbin and system library paths\n", sub_info->path);
++ printk(KERN_ALERT "grsec: denied exec of usermode helper binary %.950s located outside of permitted system paths\n", sub_info->path);
+ retval = -EPERM;
+ goto fail;
+ }
@@ -108467,6 +108489,18 @@ index e5b65ac..f3b6fb7 100644
if (likely(*recent == gen))
return 0;
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 9e07c75..da1c1fe 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -188,6 +188,7 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
+ }
+
+ atomic_set(&conn->c_state, RDS_CONN_DOWN);
++ conn->c_send_gen = 0;
+ conn->c_reconnect_jiffies = 0;
+ INIT_DELAYED_WORK(&conn->c_send_w, rds_send_worker);
+ INIT_DELAYED_WORK(&conn->c_recv_w, rds_recv_worker);
diff --git a/net/rds/ib.h b/net/rds/ib.h
index edfaaaf..8c89879 100644
--- a/net/rds/ib.h
@@ -108688,10 +108722,18 @@ index 4e37c1c..40084d8 100644
rds_rdma_free_op(op);
else
diff --git a/net/rds/rds.h b/net/rds/rds.h
-index 7eaba18..a3c303f 100644
+index 7eaba18..b322557 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
-@@ -449,7 +449,7 @@ struct rds_transport {
+@@ -110,6 +110,7 @@ struct rds_connection {
+ void *c_transport_data;
+
+ atomic_t c_state;
++ unsigned long c_send_gen;
+ unsigned long c_flags;
+ unsigned long c_reconnect_jiffies;
+ struct delayed_work c_send_w;
+@@ -449,7 +450,7 @@ struct rds_transport {
void (*sync_mr)(void *trans_private, int direction);
void (*free_mr)(void *trans_private, int invalidate);
void (*flush_mrs)(void);
@@ -108701,10 +108743,85 @@ index 7eaba18..a3c303f 100644
struct rds_sock {
struct sock rs_sk;
diff --git a/net/rds/send.c b/net/rds/send.c
-index 88eace5..b5947e7 100644
+index 88eace5..f33ba5d 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
-@@ -593,8 +593,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
+@@ -140,8 +140,11 @@ int rds_send_xmit(struct rds_connection *conn)
+ struct scatterlist *sg;
+ int ret = 0;
+ LIST_HEAD(to_be_dropped);
++ int batch_count;
++ unsigned long send_gen = 0;
+
+ restart:
++ batch_count = 0;
+
+ /*
+ * sendmsg calls here after having queued its message on the send
+@@ -157,6 +160,17 @@ restart:
+ }
+
+ /*
++ * we record the send generation after doing the xmit acquire.
++ * if someone else manages to jump in and do some work, we'll use
++ * this to avoid a goto restart farther down.
++ *
++ * The acquire_in_xmit() check above ensures that only one
++ * caller can increment c_send_gen at any time.
++ */
++ conn->c_send_gen++;
++ send_gen = conn->c_send_gen;
++
++ /*
+ * rds_conn_shutdown() sets the conn state and then tests RDS_IN_XMIT,
+ * we do the opposite to avoid races.
+ */
+@@ -202,6 +216,16 @@ restart:
+ if (!rm) {
+ unsigned int len;
+
++ batch_count++;
++
++ /* we want to process as big a batch as we can, but
++ * we also want to avoid softlockups. If we've been
++ * through a lot of messages, lets back off and see
++ * if anyone else jumps in
++ */
++ if (batch_count >= 1024)
++ goto over_batch;
++
+ spin_lock_irqsave(&conn->c_lock, flags);
+
+ if (!list_empty(&conn->c_send_queue)) {
+@@ -357,9 +381,9 @@ restart:
+ }
+ }
+
++over_batch:
+ if (conn->c_trans->xmit_complete)
+ conn->c_trans->xmit_complete(conn);
+-
+ release_in_xmit(conn);
+
+ /* Nuke any messages we decided not to retransmit. */
+@@ -380,10 +404,15 @@ restart:
+ * If the transport cannot continue (i.e ret != 0), then it must
+ * call us when more room is available, such as from the tx
+ * completion handler.
++ *
++ * We have an extra generation check here so that if someone manages
++ * to jump in after our release_in_xmit, we'll see that they have done
++ * some work and we will skip our goto
+ */
+ if (ret == 0) {
+ smp_mb();
+- if (!list_empty(&conn->c_send_queue)) {
++ if (!list_empty(&conn->c_send_queue) &&
++ send_gen == conn->c_send_gen) {
+ rds_stats_inc(s_send_lock_queue_raced);
+ goto restart;
+ }
+@@ -593,8 +622,11 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
sock_put(rds_rs_to_sk(rs));
}
rs = rm->m_rs;
@@ -108717,7 +108834,7 @@ index 88eace5..b5947e7 100644
spin_lock(&rs->rs_lock);
if (test_and_clear_bit(RDS_MSG_ON_SOCK, &rm->m_flags)) {
-@@ -638,9 +641,6 @@ unlock_and_drop:
+@@ -638,9 +670,6 @@ unlock_and_drop:
* queue. This means that in the TCP case, the message may not have been
* assigned the m_ack_seq yet - but that's fine as long as tcp_is_acked
* checks the RDS_MSG_HAS_ACK_SEQ bit.
@@ -108727,7 +108844,7 @@ index 88eace5..b5947e7 100644
*/
void rds_send_drop_acked(struct rds_connection *conn, u64 ack,
is_acked_func is_acked)
-@@ -711,6 +711,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
+@@ -711,6 +740,9 @@ void rds_send_drop_to(struct rds_sock *rs, struct sockaddr_in *dest)
*/
if (!test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) {
spin_unlock_irqrestore(&conn->c_lock, flags);
@@ -110489,7 +110606,7 @@ index 1983717..4d6102c 100644
sub->evt.event = htohl(event, sub->swap);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
-index 8705ee3..c66fcaa 100644
+index 8705ee3..cf68ef1 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -768,6 +768,12 @@ static struct sock *unix_find_other(struct net *net,
@@ -110570,12 +110687,33 @@ index 8705ee3..c66fcaa 100644
seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
s,
-@@ -2305,8 +2332,10 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+@@ -2303,10 +2330,29 @@ static int unix_seq_show(struct seq_file *seq, void *v)
+ seq_putc(seq, '@');
+ i++;
}
- for ( ; i < len; i++)
- seq_putc(seq, u->addr->name->sun_path[i]);
+- for ( ; i < len; i++)
+- seq_putc(seq, u->addr->name->sun_path[i]);
- }
- unix_state_unlock(s);
++ for ( ; i < len; i++) {
++ char c = u->addr->name->sun_path[i];
++ switch (c) {
++ case '\n':
++ seq_putc(seq, '\\');
++ seq_putc(seq, 'n');
++ break;
++ case '\t':
++ seq_putc(seq, '\\');
++ seq_putc(seq, 't');
++ break;
++ case '\\':
++ seq_putc(seq, '\\');
++ seq_putc(seq, '\\');
++ break;
++ default:
++ seq_putc(seq, c);
++ }
++ }
+ } else if (peer)
+ seq_printf(seq, " P%lu", sock_i_ino(peer));
+
@@ -111183,14 +111321,14 @@ index cb1f50c..cef2a7c 100644
fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
diff --git a/scripts/gcc-plugin.sh b/scripts/gcc-plugin.sh
new file mode 100644
-index 0000000..822fa9e
+index 0000000..eaa4fce
--- /dev/null
+++ b/scripts/gcc-plugin.sh
@@ -0,0 +1,51 @@
+#!/bin/sh
+srctree=$(dirname "$0")
+gccplugins_dir=$($3 -print-file-name=plugin)
-+plugincc=$($1 -E - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
++plugincc=$($1 -E -x c++ - -o /dev/null -I"${srctree}"/../tools/gcc -I"${gccplugins_dir}"/include 2>&1 <<EOF
+#include "gcc-common.h"
+#if BUILDING_GCC_VERSION >= 4008 || defined(ENABLE_BUILD_WITH_CXX)
+#warning $2 CXX
@@ -114167,6 +114305,19 @@ index b43813c..74be837 100644
}
#else
static inline int selinux_xfrm_enabled(void)
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index 4dd8dcf..bac8928 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
+ goto out;
+
+ /* No partial writes. */
+- length = EINVAL;
++ length = -EINVAL;
+ if (*ppos != 0)
+ goto out;
+
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index e3adb49..9798c61 100644
--- a/security/smack/smack_lsm.c
@@ -115021,11 +115172,12 @@ index 0a7ca6c..f4b948c 100644
};
diff --git a/tools/gcc/.gitignore b/tools/gcc/.gitignore
new file mode 100644
-index 0000000..de92ed9
+index 0000000..60e7af2
--- /dev/null
+++ b/tools/gcc/.gitignore
-@@ -0,0 +1 @@
+@@ -0,0 +1,2 @@
+randomize_layout_seed.h
++randomize_layout_hash.h
diff --git a/tools/gcc/Makefile b/tools/gcc/Makefile
new file mode 100644
index 0000000..7b8921f
@@ -115242,10 +115394,10 @@ index 0000000..5452feea
+}
diff --git a/tools/gcc/colorize_plugin.c b/tools/gcc/colorize_plugin.c
new file mode 100644
-index 0000000..54461af
+index 0000000..d44bd9f
--- /dev/null
+++ b/tools/gcc/colorize_plugin.c
-@@ -0,0 +1,210 @@
+@@ -0,0 +1,215 @@
+/*
+ * Copyright 2012-2014 by PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -115350,7 +115502,8 @@ index 0000000..54461af
+#if BUILDING_GCC_VERSION >= 4008
+ .optinfo_flags = OPTGROUP_NONE,
+#endif
-+#if BUILDING_GCC_VERSION >= 4009
++#if BUILDING_GCC_VERSION >= 5000
++#elif BUILDING_GCC_VERSION == 4009
+ .has_gate = false,
+ .has_execute = true,
+#else
@@ -115376,7 +115529,11 @@ index 0000000..54461af
+class colorize_rearm_pass : public simple_ipa_opt_pass {
+public:
+ colorize_rearm_pass() : simple_ipa_opt_pass(colorize_rearm_pass_data, g) {}
++#if BUILDING_GCC_VERSION >= 5000
++ virtual unsigned int execute(function *) { return execute_colorize_rearm(); }
++#else
+ unsigned int execute() { return execute_colorize_rearm(); }
++#endif
+};
+}
+
@@ -116022,10 +116179,10 @@ index 0000000..3b5af59
+}
diff --git a/tools/gcc/gcc-common.h b/tools/gcc/gcc-common.h
new file mode 100644
-index 0000000..cd95c07
+index 0000000..14ec226
--- /dev/null
+++ b/tools/gcc/gcc-common.h
-@@ -0,0 +1,375 @@
+@@ -0,0 +1,520 @@
+#ifndef GCC_COMMON_H_INCLUDED
+#define GCC_COMMON_H_INCLUDED
+
@@ -116106,6 +116263,10 @@ index 0000000..cd95c07
+#include "tree-cfgcleanup.h"
+#endif
+
++#if BUILDING_GCC_VERSION >= 4008
++#include "is-a.h"
++#endif
++
+#include "diagnostic.h"
+//#include "tree-diagnostic.h"
+#include "tree-dump.h"
@@ -116148,6 +116309,9 @@ index 0000000..cd95c07
+//#include "lto-streamer.h"
+#endif
+//#include "lto-compress.h"
++#if BUILDING_GCC_VERSION >= 5000
++//#include "lto-section-names.h"
++#endif
+
+//#include "expr.h" where are you...
+extern rtx emit_move_insn(rtx x, rtx y);
@@ -116176,11 +116340,11 @@ index 0000000..cd95c07
+#define C_TYPE_FIELDS_READONLY(TYPE) TREE_LANG_FLAG_1(TYPE)
+
+#if BUILDING_GCC_VERSION == 4005
-+#define FOR_EACH_VEC_ELT_REVERSE(T,V,I,P) for (I = VEC_length(T, (V)) - 1; VEC_iterate(T, (V), (I), (P)); (I)--)
-+#define FOR_EACH_LOCAL_DECL(FUN, I, D) FOR_EACH_VEC_ELT_REVERSE(tree, (FUN)->local_decls, I, D)
++#define FOR_EACH_LOCAL_DECL(FUN, I, D) for (tree vars = (FUN)->local_decls; vars && (D = TREE_VALUE(vars)); vars = TREE_CHAIN(vars), I)
+#define DECL_CHAIN(NODE) (TREE_CHAIN(DECL_MINIMAL_CHECK(NODE)))
+#define FOR_EACH_VEC_ELT(T, V, I, P) for (I = 0; VEC_iterate(T, (V), (I), (P)); ++(I))
+#define TODO_rebuild_cgraph_edges 0
++#define SCOPE_FILE_SCOPE_P(EXP) (!(EXP))
+
+#ifndef O_BINARY
+#define O_BINARY 0
@@ -116324,6 +116488,7 @@ index 0000000..cd95c07
+#define PROP_loops 0
+#define NODE_SYMBOL(node) (node)
+#define NODE_DECL(node) (node)->decl
++#define INSN_LOCATION(INSN) RTL_LOCATION(INSN)
+
+static inline int bb_loop_depth(const_basic_block bb)
+{
@@ -116344,6 +116509,13 @@ index 0000000..cd95c07
+ cgraph_create_edge_including_clones((caller), (callee), (old_call_stmt), (call_stmt), (count), (freq), (reason))
+#endif
+
++#if BUILDING_GCC_VERSION == 4007 || BUILDING_GCC_VERSION == 4008
++static inline struct cgraph_node *cgraph_alias_target(struct cgraph_node *n)
++{
++ return cgraph_alias_aliased_node(n);
++}
++#endif
++
+#if BUILDING_GCC_VERSION <= 4008
+#define ENTRY_BLOCK_PTR_FOR_FN(FN) ENTRY_BLOCK_PTR_FOR_FUNCTION(FN)
+#define EXIT_BLOCK_PTR_FOR_FN(FN) EXIT_BLOCK_PTR_FOR_FUNCTION(FN)
@@ -116363,6 +116535,11 @@ index 0000000..cd95c07
+}
+
+#define ipa_remove_stmt_references(cnode, stmt)
++typedef union gimple_statement_d gasm;
++typedef union gimple_statement_d gassign;
++typedef union gimple_statement_d gcall;
++typedef union gimple_statement_d gphi;
++typedef union gimple_statement_d greturn;
+#endif
+
+#if BUILDING_GCC_VERSION == 4008
@@ -116380,6 +116557,29 @@ index 0000000..cd95c07
+
+#if BUILDING_GCC_VERSION <= 4009
+#define TODO_verify_il 0
++#define AVAIL_INTERPOSABLE AVAIL_OVERWRITABLE
++#endif
++
++#if BUILDING_GCC_VERSION == 4009
++typedef struct gimple_statement_base gasm;
++typedef struct gimple_statement_base gassign;
++typedef struct gimple_statement_base gcall;
++typedef struct gimple_statement_base gphi;
++typedef struct gimple_statement_base greturn;
++#endif
++
++#if BUILDING_GCC_VERSION <= 4009
++typedef struct rtx_def rtx_insn;
++
++static inline gasm *as_a_gasm(gimple stmt)
++{
++ return stmt;
++}
++
++static inline gcall *as_a_gcall(gimple stmt)
++{
++ return stmt;
++}
+#endif
+
+#if BUILDING_GCC_VERSION >= 4009
@@ -116396,8 +116596,110 @@ index 0000000..cd95c07
+#define TODO_verify_stmts TODO_verify_il
+#define TODO_verify_rtl_sharing TODO_verify_il
+
++#define TREE_INT_CST_HIGH(NODE) ({ TREE_INT_CST_EXT_NUNITS(NODE) > 1 ? (unsigned HOST_WIDE_INT)TREE_INT_CST_ELT(NODE, 1) : 0; })
++
++#define INSN_DELETED_P(insn) (insn)->deleted()
++
++extern bool is_simple_builtin(tree);
++
++// symtab/cgraph related
+#define debug_cgraph_node(node) (node)->debug()
+#define cgraph_get_node(decl) cgraph_node::get(decl)
++#define cgraph_n_nodes symtab->cgraph_count
++#define cgraph_max_uid symtab->cgraph_max_uid
++
++typedef struct cgraph_node *cgraph_node_ptr;
++typedef struct cgraph_edge *cgraph_edge_p;
++
++static inline void change_decl_assembler_name(tree decl, tree name)
++{
++ symtab->change_decl_assembler_name(decl, name);
++}
++
++static inline void varpool_finalize_decl(tree decl)
++{
++ varpool_node::finalize_decl(decl);
++}
++
++static inline cgraph_node_ptr cgraph_function_node(cgraph_node_ptr node, enum availability *availability)
++{
++ return node->function_symbol(availability);
++}
++
++static inline cgraph_node_ptr cgraph_function_or_thunk_node(cgraph_node_ptr node, enum availability *availability = NULL)
++{
++ return node->ultimate_alias_target(availability);
++}
++
++static inline bool cgraph_only_called_directly_p(cgraph_node_ptr node)
++{
++ return node->only_called_directly_p();
++}
++
++static inline enum availability cgraph_function_body_availability(cgraph_node_ptr node)
++{
++ return node->get_availability();
++}
++
++static inline cgraph_node_ptr cgraph_alias_target(cgraph_node_ptr node)
++{
++ return node->get_alias_target();
++}
++
++static inline struct cgraph_node_hook_list *cgraph_add_function_insertion_hook(cgraph_node_hook hook, void *data)
++{
++ return symtab->add_cgraph_insertion_hook(hook, data);
++}
++
++static inline void cgraph_remove_function_insertion_hook(struct cgraph_node_hook_list *entry)
++{
++ symtab->remove_cgraph_insertion_hook(entry);
++}
++
++static inline struct cgraph_node_hook_list *cgraph_add_node_removal_hook(cgraph_node_hook hook, void *data)
++{
++ return symtab->add_cgraph_removal_hook(hook, data);
++}
++
++static inline void cgraph_remove_node_removal_hook(struct cgraph_node_hook_list *entry)
++{
++ symtab->remove_cgraph_removal_hook(entry);
++}
++
++static inline struct cgraph_2node_hook_list *cgraph_add_node_duplication_hook(cgraph_2node_hook hook, void *data)
++{
++ return symtab->add_cgraph_duplication_hook(hook, data);
++}
++
++static inline void cgraph_remove_node_duplication_hook(struct cgraph_2node_hook_list *entry)
++{
++ symtab->remove_cgraph_duplication_hook(entry);
++}
++
++// gimple related
++static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree lhs, tree op1, tree op2 MEM_STAT_DECL)
++{
++ return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT);
++}
++
++static inline gasm *as_a_gasm(gimple stmt)
++{
++ return as_a<gasm *>(stmt);
++}
++
++static inline gcall *as_a_gcall(gimple stmt)
++{
++ return as_a<gcall *>(stmt);
++}
++
++// IPA/LTO related
++#define ipa_ref_list_referring_iterate(L,I,P) (L)->referring.iterate((I), &(P))
++#define ipa_ref_list_reference_iterate(L,I,P) (L)->reference.iterate((I), &(P))
++
++static inline cgraph_node_ptr ipa_ref_referring_node(struct ipa_ref *ref)
++{
++ return dyn_cast<cgraph_node_ptr>(ref->referring);
++}
+#endif
+
+#endif
@@ -117134,10 +117436,10 @@ index 0000000..89f256d
+}
diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
new file mode 100644
-index 0000000..e48b323
+index 0000000..2a39357
--- /dev/null
+++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,466 @@
+@@ -0,0 +1,467 @@
+/*
+ * Copyright 2012-2014 by the PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -117163,7 +117465,7 @@ index 0000000..e48b323
+
+int plugin_is_GPL_compatible;
+
-+static tree latent_entropy_decl;
++static GTY(()) tree latent_entropy_decl;
+
+static struct plugin_info latent_entropy_plugin_info = {
+ .version = "201409101820",
@@ -117508,6 +117810,7 @@ index 0000000..e48b323
+ TREE_STATIC(latent_entropy_decl) = 1;
+ TREE_PUBLIC(latent_entropy_decl) = 1;
+ TREE_USED(latent_entropy_decl) = 1;
++ DECL_PRESERVE_P(latent_entropy_decl) = 1;
+ TREE_THIS_VOLATILE(latent_entropy_decl) = 1;
+ DECL_EXTERNAL(latent_entropy_decl) = 1;
+ DECL_ARTIFICIAL(latent_entropy_decl) = 1;
@@ -122614,7 +122917,7 @@ index 0000000..7c9e6d1
+
diff --git a/tools/gcc/size_overflow_plugin/size_overflow.h b/tools/gcc/size_overflow_plugin/size_overflow.h
new file mode 100644
-index 0000000..e5b4e50
+index 0000000..37f8fc3
--- /dev/null
+++ b/tools/gcc/size_overflow_plugin/size_overflow.h
@@ -0,0 +1,127 @@
@@ -122647,11 +122950,11 @@ index 0000000..e5b4e50
+};
+
+// size_overflow_plugin.c
-+extern tree report_size_overflow_decl;
-+extern tree size_overflow_type_HI;
-+extern tree size_overflow_type_SI;
-+extern tree size_overflow_type_DI;
-+extern tree size_overflow_type_TI;
++extern GTY(()) tree report_size_overflow_decl;
++extern GTY(()) tree size_overflow_type_HI;
++extern GTY(()) tree size_overflow_type_SI;
++extern GTY(()) tree size_overflow_type_DI;
++extern GTY(()) tree size_overflow_type_TI;
+
+
+// size_overflow_plugin_hash.c
@@ -128740,10 +129043,10 @@ index 0000000..0888f6c
+
diff --git a/tools/gcc/stackleak_plugin.c b/tools/gcc/stackleak_plugin.c
new file mode 100644
-index 0000000..924652b
+index 0000000..90125d6
--- /dev/null
+++ b/tools/gcc/stackleak_plugin.c
-@@ -0,0 +1,395 @@
+@@ -0,0 +1,396 @@
+/*
+ * Copyright 2011-2014 by the PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
@@ -128771,7 +129074,8 @@ index 0000000..924652b
+static int track_frame_size = -1;
+static const char track_function[] = "pax_track_stack";
+static const char check_function[] = "pax_check_alloca";
-+static tree track_function_decl, check_function_decl;
++static GTY(()) tree track_function_decl;
++static GTY(()) tree check_function_decl;
+static bool init_locals;
+
+static struct plugin_info stackleak_plugin_info = {
reply other threads:[~2015-04-15 13:11 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1429103556.c58db926b1c0ffd5715c7cbd4ccb1c273d417ab4.blueness@gentoo \
--to=blueness@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox